@ionite/core 0.0.24-beta.20261003.17 → 0.0.24-beta.20261006.21

package/dist/shared/core-knezf9yx.js

@@ -0,0 +1,4 @@
+function Kt(ct){if(ct===void 0||ct===null)return[];return Array.isArray(ct)?ct:[ct]}function $t(ct){if(typeof ct!=="string")return;return ct.endsWith("/")?ct.slice(0,-1):ct}function Qt(ct,ut){if($t(ut.issuer)!==$t(ct.claims?.iss))return!1;let dt=Kt(ut.audience);if(dt.length===0)return!1;let pt=Kt(ct.claims?.aud),lt=typeof ct.claims?.azp==="string"?ct.claims.azp:void 0;if(!(dt.some((gt)=>pt.includes(gt))||(lt?dt.includes(lt):!1)))return!1;let ft=ct.clientId??ct.workloadId??ct.claims?.sub;return ut.clientId===ft}function J(ct,ut){let dt=ct?.trustedProvisioningClients;if(!dt?.length)return;let pt=new Set;for(let lt of dt){if(!Qt(ut,lt))continue;for(let mt of lt.permissions??[])pt.add(mt)}return pt.size>0?pt:void 0}function je(ct){let ut=ct?.trustedProvisioningClients;if(!ut?.length)return[];let dt=[];for(let pt of ut)for(let lt of pt.permissions??[])dt.push({subject:pt.clientId,subjectType:"workload",targetType:"permission",target:lt,status:"active",provenance:{source:"eci-trusted",actor:pt.clientId}});return dt}var d=["id","name","displayName","description","providerId","source","deprecated","type","parent","resources","assignableSubjectTypes","recommendedSubjectTypes","requestable","riskLevel","requestUrl","action","permissionTypes","resourceTypes","applyToSubResources","permissions","groups","roles"],A=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","ecid","accountClass","displayName","scimName","emails","nickName","active","title","preferredLanguage","locale","timezone","phoneNumbers","ims","photos","addresses","roles","groups","entitlements","x509Certificates","scimEnterprise","scimSchemaExtensions","createdAt","updatedAt","sso"],I=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","displayName","emails","phoneNumbers","active","createdAt","updatedAt","ciam"],v=["id","clientId","displayName","description","externalId","providerId","requestUrl","ecid","active","scopes","createdAt","updatedAt","metadata"];function o(ct,ut){let dt=new Set(ut),pt=Object.fromEntries(Object.entries(ct).filter(([lt,mt])=>!dt.has(lt)&&mt!==void 0));return Object.keys(pt).length>0?pt:void 0}function j(ct,ut,dt,pt){let lt=ut.length,mt=pt??ct,ft=mt>0?Math.floor(dt/mt)+1:1,gt=mt>0?Math.ceil(ct/mt):0;return{total:ct,count:lt,items:ut,size:mt,page:ft,pages:gt}}async function*c(ct,ut,dt=1000){let pt=0;while(!0){let lt=await ct(pt,dt);if(lt.items.length===0)break;for(let mt of lt.items)yield(ut?await ut(mt):mt)??mt;if(lt.items.length<dt||pt+lt.items.length>=lt.total)break;pt+=dt}}function Ne(ct,ut){if(!ut)return!0;if(ut.requestable!==void 0&&Boolean(ct.requestable)!==ut.requestable)return!1;if(ut.userName!==void 0){if((ct.userName??ct.clientId)!==ut.userName)return!1}if(ut.externalId!==void 0&&ct.externalId!==ut.externalId)return!1;if(ut.updatedAfter!==void 0){if(!(ct.updatedAt instanceof Date))return!1;let dt=ut.updatedAfter instanceof Date?ut.updatedAfter:new Date(ut.updatedAfter);if(Number.isNaN(dt.getTime())||ct.updatedAt<=dt)return!1}return!0}var Y=["basic","elevated","privileged","admin"],f="basic",e="urn:ionite:params:scim:schemas:extension:authz:2.0:Group",g=["user","workload","customer"];function x(ct){let{assignableSubjectTypes:ut,recommendedSubjectTypes:dt}=ct,pt=ct.id?` for "${ct.id}"`:"";if(!ut||ut.length===0)throw Error(`assignableSubjectTypes${pt} is required and must be a non-empty subset of [${g.join(", ")}]`);let lt=ut.filter((mt)=>!g.includes(mt));if(lt.length>0)throw Error(`assignableSubjectTypes${pt} contains values outside the platform ceiling [${g.join(", ")}]: ${lt.join(", ")}`);if(dt){let mt=dt.filter((ft)=>!ut.includes(ft));if(mt.length>0)throw Error(`recommendedSubjectTypes${pt} must be a subset of assignableSubjectTypes; offending values: ${mt.join(", ")}`)}}function X(ct,ut="subjectType"){if(ct!=="user"&&ct!=="customer"&&ct!=="workload")throw Error(`${ut} is required and must be one of [user, customer, workload]; got ${ct===void 0?"undefined":JSON.stringify(ct)}`)}class le extends Error{constructor(ct,ut,dt){super(ct);this.name="AssignmentPolicyError",this.policy=ut,this.requestUrl=dt,Object.setPrototypeOf(this,le.prototype)}}function Ee(ct){return typeof ct.groups?.get==="function"}function Le(ct){return Ee(ct)?ct:Pe(ct)}class Pt extends Error{constructor(ct){super(`defineCatalog: ${ct}`);this.name="CodeCatalogError"}}function qt(ct){return typeof ct==="string"?ct:ct.id}function en(ct){for(let ut of Object.values(ct))if(Array.isArray(ut))Object.freeze(ut);Object.freeze(ct)}function Ot(ct,ut){try{x(ut)}catch(dt){throw new Pt(`${ct} "${ut.id}": ${dt instanceof Error?dt.message:String(dt)}`)}}function Nt(ct){let ut=new Map(ct.map((pt)=>[pt.id,pt])),dt=Object.freeze([...ct]);return Object.freeze({get:(pt)=>ut.get(pt),list:()=>dt})}function Pe(ct){let ut=ct.groups??[],dt=ct.roles??[],pt=ct.permissions??[],lt=new Map,mt=(Tt,At)=>{for(let ht of At){if(!ht.id)throw new Pt(`a ${Tt} is missing its required "id".`);let bt=lt.get(ht.id);if(bt)throw new Pt(`duplicate id "${ht.id}" (declared as both ${bt} and ${Tt}).`);lt.set(ht.id,Tt)}};mt("group",ut),mt("role",dt),mt("permission",pt);let ft=(Tt,At,ht,bt)=>{let Ct=qt(bt),Rt=lt.get(Ct);if(Rt===void 0)throw new Pt(`${Tt} "${At}" references ${ht} "${Ct}", which is not declared in the catalog.`);if(Rt!==ht)throw new Pt(`${Tt} "${At}" references "${Ct}" as a ${ht}, but it is a ${Rt}.`)};for(let Tt of dt){Ot("role",Tt);for(let At of Tt.permissions??[])ft("role",Tt.id,"permission",At)}for(let Tt of pt)Ot("permission",Tt);for(let Tt of ut){Ot("group",Tt);for(let At of Tt.groups??[])ft("group",Tt.id,"group",At);for(let At of Tt.roles??[])ft("group",Tt.id,"role",At);for(let At of Tt.permissions??[])ft("group",Tt.id,"permission",At)}let gt=new Map(ut.map((Tt)=>[Tt.id,Tt])),xt=new Map,St=(Tt,At)=>{let ht=xt.get(Tt);if(ht==="done")return;if(ht==="visiting")throw new Pt(`group composition cycle: ${[...At,Tt].join(" -> ")}.`);xt.set(Tt,"visiting");for(let bt of gt.get(Tt)?.groups??[])St(qt(bt),[...At,Tt]);xt.set(Tt,"done")};for(let Tt of ut)St(Tt.id,[]);for(let Tt of[...ut,...dt,...pt])en(Tt);return Object.freeze({groups:Nt(ut),roles:Nt(dt),permissions:Nt(pt)})}function N(ct,ut){let dt=ct?.groups.get(ut);if(dt)return{entity:dt,kind:"group"};let pt=ct?.roles.get(ut);if(pt)return{entity:pt,kind:"role"};let lt=ct?.permissions.get(ut);return lt?{entity:lt,kind:"permission"}:void 0}function L(ct,ut){return ut==="group"?ct.groups:ut==="role"?ct.roles:ct.permissions}function T(ct,ut,dt){let pt={...ut,...dt,id:ut.id,requestable:ut.requestable,source:dt.source??"code",assignableSubjectTypes:ut.assignableSubjectTypes,recommendedSubjectTypes:ut.recommendedSubjectTypes};if(ct==="group"){let mt=ut;return{...pt,groups:mt.groups,roles:mt.roles,permissions:mt.permissions,resources:mt.resources}}if(ct==="role")return{...pt,permissions:ut.permissions};let lt=ut;return{...pt,action:lt.action,permissionTypes:lt.permissionTypes,resourceTypes:lt.resourceTypes,applyToSubResources:lt.applyToSubResources}}async function K(ct,ut,dt){let pt=await dt.get(ut.id);if(pt)return T(ct,ut,pt);let lt=Object.entries(ut).filter(([At])=>d.includes(At)),{riskLevel:mt,displayName:ft,...gt}=Object.fromEntries(lt),xt={...gt,source:"code"},St=dt.insertIfAbsent(xt);await St.ready();let Tt=await dt.get(ut.id)??St;return T(ct,ut,Tt)}async function Z(ct,ut,dt){let pt=async(lt,mt)=>{let ft=dt?[await lt.get(dt)].filter((gt)=>gt!==void 0):c((gt,xt)=>lt.list({start:gt,limit:xt}));for await(let gt of ft){if(gt.source!=="code"||gt.deprecated===!0||mt?.get(gt.id))continue;await lt.set({...gt,deprecated:!0}).ready()}};await pt(ut.groups,ct?.groups),await pt(ut.roles,ct?.roles),await pt(ut.permissions,ct?.permissions)}function Dt(ct,ut,dt){let pt=()=>{if(!dt)throw Error(`Cannot write ${ct} definitions: no AccessCatalogStore is wired (the code-declared catalog is read-only).`);return dt};return{async get(mt){let ft=ut.get(mt);if(!dt)return ft;let gt=await dt.get(mt);return gt&&ft?T(ct,ft,gt):gt??ft},set(mt){return pt().set(mt)},insertIfAbsent(mt){return pt().insertIfAbsent(mt)},async delete(mt){await pt().delete(mt)},async list(mt){let ft=Math.max(0,mt?.start??0),gt=mt?.limit,xt=mt?.filter?.requestable,St=[];if(dt)for await(let bt of c((Ct,Rt)=>dt.list({start:Ct,limit:Rt})))St.push(bt);let Tt=new Map(St.map((bt)=>[bt.id,bt])),At=[...ut.list().map((bt)=>{let Ct=Tt.get(bt.id);return Ct?T(ct,bt,Ct):bt}),...St.filter((bt)=>!ut.get(bt.id))].filter((bt)=>xt===void 0||Boolean(bt.requestable)===xt),ht=gt!=null?ft+gt:void 0;return j(At.length,At.slice(ft,ht),ft,gt)}}}function q(ct,ut){if(!ct)return ut;return{groups:Dt("group",ct.groups,ut?.groups),roles:Dt("role",ct.roles,ut?.roles),permissions:Dt("permission",ct.permissions,ut?.permissions),afterChange:ut?.afterChange?.bind(ut)}}function n(ct){if(typeof ct==="string")return ct.trim();if(ct&&typeof ct==="object"){let ut=ct;for(let dt of["id","value","name","displayName"]){let pt=ut[dt];if(typeof pt==="string"&&pt.trim())return pt.trim()}}return""}function p(ct){let ut=n(ct.subject),dt=n(ct.target);if(!ut)throw Error("Access change subject must resolve to a non-empty id.");if(!ct.targetType)throw Error("Access change targetType is required.");if(!dt)throw Error("Access change target must resolve to a non-empty id.");let pt=(ct.resources??[]).map((mt)=>mt.trim()).filter(Boolean),lt=!ct.applyToApplication&&pt.length>0?[...pt].sort().join(","):"app";return X(ct.subjectType,"Access change subjectType"),`${ct.subjectType}:${ut}:${ct.targetType}:${dt}:${lt}`}function tn(ct){let ut=(ct.resources??[]).map((dt)=>dt.trim()).filter(Boolean);if(ct.applyToApplication||ut.length===0)return[void 0];return ut}async function zt(ct,ut,dt,pt,lt){if(pt==="resource")return dt?.get(lt);let mt=ut?pt==="group"?ut.groups.get(lt):pt==="role"?ut.roles.get(lt):ut.permissions.get(lt):void 0;if(ct){let gt=await(pt==="group"?ct.groups:pt==="role"?ct.roles:ct.permissions).get(lt);if(gt)return mt?T(pt,mt,gt):gt}return mt}class Q{constructor(ct,ut,dt){this.catalog=ct;this.resources=ut;this.code=dt;this.nodes=new Map;this.subResources=new Map;this.children=new Map}getNode(ct,ut){let dt=`${ct}:${ut}`,pt=this.nodes.get(dt);if(!pt)pt=zt(this.catalog,this.code,this.resources,ct,ut),this.nodes.set(dt,pt);return pt}resourceChildren(ct){let ut=this.children.get(ct);if(!ut)ut=Bt(ct,this.view()),this.children.set(ct,ut);return ut}resourceAndSubResourceIds(ct){let ut=this.subResources.get(ct);if(!ut)ut=Wt(ct,this.view()),this.subResources.set(ct,ut);return ut}view(){return{catalog:this.catalog,code:this.code,resources:this.resources,cache:this}}invalidate(ct){this.clear()}clear(){this.nodes.clear(),this.subResources.clear(),this.children.clear()}}async function _t(ct,ut,dt){if(ct.cache)return ct.cache.getNode(ut,dt);return zt(ct.catalog,ct.code,ct.resources,ut,dt)}async function Gt(ct,ut){if(typeof ct!=="string")return ct;return _t(ut,"resource",ct)}async function Bt(ct,ut){if(ut.resources?.children)return ut.resources.children(ct);let dt=await Gt(ct,ut),pt=[];for(let lt of dt?.resources??[]){let mt=await Gt(lt,ut);if(mt)pt.push(mt);else if(typeof lt==="string"&&lt.trim())pt.push({id:lt.trim()})}return pt}async function Vt(ct,ut){if(ut.cache)return ut.cache.resourceChildren(ct);return Bt(ct,ut)}async function Wt(ct,ut){let dt=[],pt=new Set,lt=async(mt)=>{if(!mt||pt.has(mt))return;pt.add(mt),dt.push(mt);for(let ft of await Vt(mt,ut))await lt(n(ft))};return await lt(n(ct)),dt}async function E(ct,ut){let dt=ct.id??p(ct),pt=n(ct.subject);if(!pt)throw Error("Access change subject must resolve to a non-empty id.");X(ct.subjectType,"Access change subjectType");let lt=ct.subjectType,mt=tn(ct),ft=[],gt=new Set,xt=new Set,St=(ht,bt,Ct)=>{if(!bt)return;let Rt=`${ht}:${bt}:${Ct??""}`;if(gt.has(Rt))return;gt.add(Rt),ft.push({subject:pt,subjectType:lt,targetType:ht,target:bt,resource:Ct,rootId:dt})},Tt=async(ht,bt,Ct)=>{for(let Rt of mt)if(ht==="permission"&&Ct?.applyToSubResources&&Rt){let wt=ut.cache?await ut.cache.resourceAndSubResourceIds(Rt):await Wt(Rt,ut);for(let It of wt)St("permission",bt,It)}else St(ht,bt,Rt)},At=async(ht,bt)=>{let Ct=n(bt);if(!Ct)return;let Rt=`${ht}:${Ct}`;if(xt.has(Rt))return;if(xt.add(Rt),ht==="group"){let It=typeof bt==="string"?await _t(ut,"group",Ct):bt;await Tt("group",Ct,void 0);for(let Et of It?.groups??[])await At("group",Et);for(let Et of It?.roles??[])await At("role",Et);for(let Et of It?.permissions??[])await At("permission",Et);return}if(ht==="role"){let It=typeof bt==="string"?await _t(ut,"role",Ct):bt;await Tt("role",Ct,void 0);for(let Et of It?.permissions??[])await At("permission",Et);return}let wt=typeof bt==="string"?await _t(ut,"permission",Ct):bt;await Tt("permission",Ct,wt)};return await At(ct.targetType,ct.target),ft}async function pe(ct,ut,dt,pt){let{accessStore:lt,accessIndex:mt,catalogStore:ft,code:gt,resources:xt}=dt;if(!mt||!ft&&!gt)return 0;if(!lt)return await mt.replaceSubject(ct,ut,[]),0;let St={catalog:ft,code:gt,resources:xt,cache:pt},Tt=[],At=0;for await(let ht of c((bt,Ct)=>lt.listBySubject(ct,ut,{start:bt,limit:Ct}))){let bt=ht.id??p(ht),Ct=await E({...ht,id:bt},St);Tt.push(...Ct),At+=1}return await mt.replaceSubject(ct,ut,Tt),At}async function $e(ct,ut,dt){let pt=new Map,lt=new Map,mt=new Map,ft=new Map,gt=new Set,xt=(At,ht)=>_t(dt,At,ht),St=async(At)=>{let ht=n(At);if(!ht||ft.has(ht))return;let bt=typeof At==="string"?await xt("resource",ht):At;if(!bt)return;ft.set(ht,bt);let Ct=bt.resources??(bt.id?await Vt(bt.id,dt):[]);for(let Rt of Ct)await St(Rt)},Tt=async(At,ht)=>{let bt=n(ht);if(!bt)return;let Ct=`${At}:${bt}`;if(gt.has(Ct))return;if(gt.add(Ct),At==="group"){let wt=typeof ht==="string"?await xt("group",bt):ht;if(!wt)return;pt.set(bt,wt);for(let It of wt.groups??[])await Tt("group",It);for(let It of wt.roles??[])await Tt("role",It);for(let It of wt.permissions??[])await Tt("permission",It);for(let It of wt.resources??[])await St(It);return}if(At==="role"){let wt=typeof ht==="string"?await xt("role",bt):ht;if(!wt)return;lt.set(bt,wt);for(let It of wt.permissions??[])await Tt("permission",It);return}let Rt=typeof ht==="string"?await xt("permission",bt):ht;if(!Rt)return;mt.set(bt,Rt)};if(gt.add(`${ut}:${n(ct)}`),ut==="group"){let At=ct;for(let ht of At.groups??[])await Tt("group",ht);for(let ht of At.roles??[])await Tt("role",ht);for(let ht of At.permissions??[])await Tt("permission",ht);for(let ht of At.resources??[])await St(ht)}else{let At=ct;for(let ht of At.permissions??[])await Tt("permission",ht)}return{groups:[...pt.values()],roles:[...lt.values()],permissions:[...mt.values()],resources:[...ft.values()]}}var Ke=".profile",W=1,qe=10,We=10,Ve=14400,ee="ion.discovered",nn=new Set(["sid","sub","tokens","access_token","id_token","refresh_token","accessClaims","roles","groups","permissions","grants"]);function te(ct){if(typeof ct!=="number"||!Number.isFinite(ct)||ct<1)return 10;return Math.floor(ct)}function V(ct){if(typeof ct!=="number"||!Number.isFinite(ct)||ct<1)return 10;return Math.floor(ct)}function ne(ct){if(typeof ct!=="number"||!Number.isFinite(ct)||ct<1)return 14400;return Math.floor(ct)}function me(ct){let ut={};if(ct.name)ut.name=ct.name;if(ct.email)ut.email=ct.email;if(ct.avatar)ut.avatar=ct.avatar;return ut}function fe(ct){if(!ct||typeof ct!=="object"||Array.isArray(ct))return{};let ut={};for(let[dt,pt]of Object.entries(ct)){if(nn.has(dt))continue;if(typeof pt==="string"||typeof pt==="number"||typeof pt==="boolean"||pt===null)ut[dt]=pt}return ut}function sn(ct){let ut=ct;return{name:typeof ut.name==="string"?ut.name:void 0,email:typeof ut.email==="string"?ut.email:void 0,avatar:typeof ut.avatar==="string"?ut.avatar:void 0}}function m(ct,ut){let dt=sn(ct);if(!ut)return me(dt);try{return fe(ut(ct))}catch{return me(dt)}}function z(ct){return btoa(JSON.stringify(ct))}function Ue(ct){try{let ut=JSON.parse(atob(ct));if(!ut||typeof ut!=="object"||Array.isArray(ut))return;let dt=ut;if(dt.v!==1)return;if(dt.authType!=="sso"&&dt.authType!=="ciam")return;if(dt.kind!==void 0&&dt.kind!=="session"&&dt.kind!=="discovered")return;if(typeof dt.expiresAt!=="string"||!dt.expiresAt)return;let pt=typeof dt.tenantId==="string"&&dt.tenantId?dt.tenantId:void 0,lt=typeof dt.tenantName==="string"&&dt.tenantName?dt.tenantName:void 0;return{v:1,...dt.kind?{kind:dt.kind}:{},...pt?{tenantId:pt}:{},authType:dt.authType,expiresAt:dt.expiresAt,user:fe(dt.user),...lt?{tenantName:lt}:{}}}catch{return}}function re(ct){let ut={};if(!ct)return ut;for(let dt of ct.split(";")){let pt=dt.trim();if(!pt)continue;let lt=pt.indexOf("=");if(lt===-1)continue;ut[pt.slice(0,lt).trim()]=pt.slice(lt+1).trim()}return ut}function B(ct){let ut=re(ct),dt=[];for(let[pt,lt]of Object.entries(ut)){if(!pt.endsWith(".profile")||!lt)continue;let mt=Ue(lt);if(!mt)continue;dt.push({name:pt,prefix:pt.slice(0,-8),envelope:mt})}return dt}function P(ct,ut){let dt=ct?Date.parse(ct):Number.NaN,pt=ut?Date.parse(ut):Number.NaN,lt=Number.isFinite(dt),mt=Number.isFinite(pt);if(lt&&mt)return pt-dt;if(lt)return-1;if(mt)return 1;return 0}function U(ct){return`${ct}.profile`}function G(ct){return U(`ion.discovered.${encodeURIComponent(ct)}`)}var ze="ecid",Ft=/^ecid:([A-Za-z0-9._-]+):([A-Za-z0-9_-]+)$/,rn=/^[A-Za-z0-9._-]+$/,on=/^[A-Za-z0-9_-]+$/;class _ extends Error{constructor(ct){super(ct);this.name="EcidFormatError"}}function _e(ct){return typeof ct==="string"&&Ft.test(ct)}function Be(ct,ut){if(!ct||!rn.test(ct))throw new _(`Invalid ECID realm ${JSON.stringify(ct)}: must be non-empty and match [A-Za-z0-9._-].`);if(!ut||!on.test(ut))throw new _(`Invalid ECID opaque ${JSON.stringify(ut)}: must be non-empty and match [A-Za-z0-9_-].`);return`ecid:${ct}:${ut}`}function Ge(ct){let ut=typeof ct==="string"?ct.match(Ft):null;if(!ut)throw new _(`Invalid ECID ${JSON.stringify(ct)}: expected "ecid:<realm>:<opaque>".`);return{realm:ut[1],opaque:ut[2]}}function O(ct){if(!_e(ct))throw new _(`Invalid ECID ${JSON.stringify(ct)}: expected "ecid:<realm>:<opaque>".`);return ct}var kt=["workload"],ge={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},ye={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},he={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},Se={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},ke={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},be={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},Ce={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},Te={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:kt},we={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},Re={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},se=[ge,ye,he,Se,ke,be,Ce,Te,we,Re],Fe={"iam.read":{permission:ge,subjectType:["workload"]},"iam.users.write":{permission:ye,subjectType:["workload"]},"iam.groups.write":{permission:he,subjectType:["workload"]},"iam.workloads.write":{permission:Se,subjectType:["workload"]},"iam.customers.write":{permission:ke,subjectType:["workload"]},"iam.access-requests.write":{permission:be,subjectType:["workload"]},"capabilitiez.read":{permission:Ce,subjectType:["workload"]},"ciam.magic-link.create":{permission:Te,subjectType:["workload","user"]},"authz.oaa.sync":{permission:we,subjectType:["workload"]},"tenant.manage":{permission:Re,subjectType:["workload"]}};function oe(ct){return{"~standard":{version:1,vendor:ct,validate:(ut)=>{if(typeof ut!=="object"||ut===null)return{issues:[{message:"Expected an object"}]};let dt=ut,pt=[],lt={};if("code"in dt)if(typeof dt.code==="string")lt.code=dt.code;else pt.push({message:"code must be a string",path:["code"]});else if(!("error"in dt))pt.push({message:"code is required",path:["code"]});if("state"in dt)if(typeof dt.state==="string"||dt.state===void 0)lt.state=dt.state;else pt.push({message:"state must be a string",path:["state"]});if("session_state"in dt)if(typeof dt.session_state==="string"||dt.session_state===void 0)lt.session_state=dt.session_state;else pt.push({message:"session_state must be a string",path:["session_state"]});if("error"in dt){if(typeof dt.error==="string")lt.error=dt.error;else pt.push({message:"error must be a string",path:["error"]});if("error_description"in dt)if(typeof dt.error_description==="string"||dt.error_description===void 0)lt.error_description=dt.error_description;else pt.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in dt)if(typeof dt.error_uri==="string"||dt.error_uri===void 0)lt.error_uri=dt.error_uri;else pt.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in dt)if(typeof dt.iss==="string"||dt.iss===void 0)lt.iss=dt.iss;else pt.push({message:"iss must be a string",path:["iss"]});if(pt.length>0)return{issues:pt};return{value:lt}}}}}function ie(ct){return{"~standard":{version:1,vendor:ct,validate:(ut)=>{if(typeof ut!=="object"||ut===null)return{issues:[{message:"Expected an object"}]};let dt=ut,pt=[],lt={};if("access_token"in dt)if(typeof dt.access_token==="string")lt.access_token=dt.access_token;else pt.push({message:"access_token must be a string",path:["access_token"]});else pt.push({message:"access_token is required",path:["access_token"]});if("id_token"in dt)if(typeof dt.id_token==="string")lt.id_token=dt.id_token;else pt.push({message:"id_token must be a string",path:["id_token"]});else pt.push({message:"id_token is required",path:["id_token"]});if("token_type"in dt)if(typeof dt.token_type==="string")lt.token_type=dt.token_type;else pt.push({message:"token_type must be a string",path:["token_type"]});else pt.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in dt)if(typeof dt.refresh_token==="string"||dt.refresh_token===void 0)lt.refresh_token=dt.refresh_token;else pt.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in dt)if(typeof dt.scope==="string"||dt.scope===void 0)lt.scope=dt.scope;else pt.push({message:"scope must be a string",path:["scope"]});if("session_state"in dt)if(typeof dt.session_state==="string"||dt.session_state===void 0)lt.session_state=dt.session_state;else pt.push({message:"session_state must be a string",path:["session_state"]});if("expires"in dt)if(typeof dt.expires==="string"||dt.expires===void 0)lt.expires=dt.expires;else pt.push({message:"expires must be a string",path:["expires"]});if("expires_in"in dt)if(typeof dt.expires_in==="number"||dt.expires_in===void 0)lt.expires_in=dt.expires_in;else pt.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in dt)if(typeof dt.refresh_expires_in==="number"||dt.refresh_expires_in===void 0)lt.refresh_expires_in=dt.refresh_expires_in;else pt.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(pt.length>0)return{issues:pt};return{value:lt}}}}}function y(ct){return{"~standard":{version:1,vendor:ct,validate:(ut)=>{if(typeof ut!=="object"||ut===null)return{issues:[{message:"Expected an object"}]};let dt=ut,pt=[],lt={...dt},mt=["iss","sub"];for(let St of mt)if(typeof dt[St]!=="string")pt.push({message:`${St} is required and must be a string`,path:[St]});let ft=dt.aud;if(!(typeof ft==="string"||Array.isArray(ft)&&ft.length>0&&ft.every((St)=>typeof St==="string")))pt.push({message:"aud is required and must be a string or a non-empty array of strings",path:["aud"]});if(typeof dt.exp!=="number")pt.push({message:"exp is required and must be a number",path:["exp"]});let xt=["sid","name","email","preferred_username","picture"];for(let St of xt)if(St in dt&&dt[St]!==void 0){if(typeof dt[St]!=="string")pt.push({message:`${St} must be a string`,path:[St]})}if("iat"in dt&&dt.iat!==void 0&&typeof dt.iat!=="number")pt.push({message:"iat must be a number",path:["iat"]});if(pt.length>0)return{issues:pt};return{value:lt}}}}}var s="application/json",He="application/scim+json",D="application/x-www-form-urlencoded",Ae="application/xml",Ie="application/octet-stream",i=Object.freeze({Accept:"application/json"}),ae=Object.freeze({Accept:"application/scim+json, application/json"}),Je=Object.freeze({Accept:"application/xml"}),Ye=Object.freeze({Accept:"application/octet-stream"}),r=Object.freeze({"Content-Type":"application/json"}),w=Object.freeze({"Content-Type":"application/scim+json"}),h=Object.freeze({"Content-Type":"application/x-www-form-urlencoded"}),Xe=Object.freeze({"Content-Type":"application/xml"}),Ze=Object.freeze({"Content-Type":"application/octet-stream"});function Oe(ct){let ut=ct.headers.get("content-type")?.split(";",1)[0]?.trim().toLowerCase();return Boolean(ut&&(ut==="application/json"||ut.endsWith("+json")))}function an(ct){let ut=ct.replace(/\s+/g," ").trim();return ut?ut.slice(0,300):void 0}async function F(ct,ut={}){let dt=ct.headers.get("content-type")??void 0,pt;try{pt=await ct.text()}catch{return{contentType:dt}}let lt=/<title(?:\s[^>]*)?>([\s\S]*?)<\/title>/i.exec(pt)?.[1],mt=an(lt??(ut.redact?"":pt));return{contentType:dt,excerpt:mt}}async function a(ct,ut={}){if(Oe(ct))return await ct.json();let dt=await F(ct,{redact:ut.redact});ut.log?.warn("Expected a JSON response body but received a different content type",{"ion.operation":ut.operation??"http.response","ion.outcome":"degraded",reason:"non_json_response",status:ct.status,contentType:dt.contentType,excerpt:dt.excerpt});let pt=[dt.contentType,dt.excerpt].filter(Boolean).join(": ");throw Error(`Expected a JSON response body${pt?`; received ${pt}`:""}`)}function l(ct){let ut=ct["~standard"];return Object.assign(ct,{validate(dt){return Promise.resolve(ut.validate(dt))}})}function t(ct,ut="Assertion failed. Required value is null or undefined."){if(ct===void 0||ct===null)throw Error(ut);return ct}function ce(ct,ut){return Response.json({error:"validation_failed",message:ut,issues:ct},{status:400,headers:r})}function Qe(ct,ut,dt=[]){let pt={...ct,...ut};for(let lt of dt)pt[lt]=ct?.[lt]??ut?.[lt];return pt}function De(ct){let ut="",dt=0,pt=ct.length;while(dt<pt){let lt=ct[dt];if(lt==='"'||lt==="'"){let mt=lt;ut+=lt,dt++;while(dt<pt){let ft=ct[dt];if(ft==="\\"){if(ut+=ft,dt+1<pt)ut+=ct[dt+1],dt+=2;else dt++;continue}if(ft===mt){ut+=ft,dt++;break}ut+=ft,dt++}continue}if(lt==="/"&&dt+1<pt){let mt=ct[dt+1];if(mt==="/"){dt+=2;while(dt<pt&&ct[dt]!==`
+`)dt++;if(dt<pt)ut+=`
+`;dt++;continue}if(mt==="*"){dt+=2;while(dt+1<pt&&!(ct[dt]==="*"&&ct[dt+1]==="/"))dt++;dt+=2;continue}}ut+=lt,dt++}return ut}function cn(ct){let ut="",dt=!1,pt=!1;for(let lt=0;lt<ct.length;lt+=1){let mt=ct[lt];if(dt){if(ut+=mt,pt)pt=!1;else if(mt==="\\")pt=!0;else if(mt==='"')dt=!1;continue}if(mt==='"'){dt=!0,ut+=mt;continue}if(mt===","){let ft=lt+1;while(ft<ct.length&&/\s/.test(ct[ft]??""))ft+=1;let gt=ct[ft];if(gt==="}"||gt==="]")continue}ut+=mt}return ut}function et(ct){let ut=cn(De(ct));return JSON.parse(ut)}function R(ct){return ct==="/"?ct:ct.replace(/\/+$/,"")}function Mt(ct){if(ct===null||typeof ct!=="object"||Array.isArray(ct))return!1;let ut=Object.getPrototypeOf(ct);return ut===Object.prototype||ut===null}function Ut(ct){return Object.keys(ct).filter((ut)=>ct[ut]!==void 0).sort()}function S(ct,ut){if(Object.is(ct,ut))return!0;if(ct===null||ut===null)return ct===ut;if(Array.isArray(ct)||Array.isArray(ut)){if(!Array.isArray(ct)||!Array.isArray(ut)||ct.length!==ut.length)return!1;for(let lt=0;lt<ct.length;lt+=1)if(!S(ct[lt],ut[lt]))return!1;return!0}if(!Mt(ct)||!Mt(ut))return!1;let dt=Ut(ct),pt=Ut(ut);if(dt.length!==pt.length)return!1;for(let lt=0;lt<dt.length;lt+=1)if(dt[lt]!==pt[lt])return!1;for(let lt of dt)if(!S(ct[lt],ut[lt]))return!1;return!0}function Lt(ct,ut){if(ct===null||ct===void 0){ut.push("n");return}if(Array.isArray(ct)){ut.push("[");for(let dt of ct)Lt(dt,ut);ut.push("]");return}if(Mt(ct)){ut.push("{");for(let dt of Ut(ct))ut.push(JSON.stringify(dt),":"),Lt(ct[dt],ut);ut.push("}");return}ut.push(JSON.stringify(ct))}function tt(ct){let ut=[];Lt(ct,ut);let dt=ut.join(""),pt=2166136261;for(let lt=0;lt<dt.length;lt+=1)pt^=dt.charCodeAt(lt),pt=pt*16777619%9007199254740992;return`${dt.length.toString(36)}:${pt.toString(36)}`}async function nt(ct,ut=async(ft)=>ft.status===200,dt=1000,pt=1e4,lt,mt){let ft=Date.now(),gt=`Awaiting Ping (${ct})`;return new Promise((xt,St)=>{let Tt=null,At=null,ht=null,bt=!1,Ct=()=>{if(Tt)clearTimeout(Tt);if(At)clearInterval(At);if(ht)clearTimeout(ht);Tt=null,At=null,ht=null},Rt=(Et)=>{if(bt)return;bt=!0,Ct(),Et()},wt=Math.max(dt,1e4),It=async()=>{try{let Et=await fetch(ct,{headers:i,signal:AbortSignal.timeout(wt)});if(Et.ok){if(await ut(Et)){Rt(xt);return}gt=`Response test failed: ${Et.status}: ${Et.statusText} - ${ct}`}else try{let vt=await a(Et,{log:mt,operation:"wait_on.probe"});gt=`Response error: ${Et.status}: ${Et.statusText} - ${ct}: ${JSON.stringify(vt)}`}catch(vt){let Zt=vt instanceof Error?`: ${vt.message}`:"";gt=`Response error: ${Et.status}: ${Et.statusText} - ${ct}${Zt}`}}catch(Et){gt=`${Et instanceof Error?Et.message:String(Et)} - ${ct}`}if(!bt)Tt=setTimeout(()=>void It(),dt)};if(pt>0)At=setInterval(()=>{mt?.warn(`${gt}: ${Date.now()-ft}ms`)},pt);if(lt)ht=setTimeout(()=>{Rt(()=>St(Error(`Timeout: ${lt}ms: ${gt}`)))},lt);It()})}var un="@ionite/core",dn=l(y(un));function H(ct){let ut=ct.exp!=null?new Date(ct.exp*1000):new Date,dt=ct.iss??"";return{id:ct.sub??"",userName:ct.preferred_username??"",name:ct.name??"",email:ct.email??"",avatar:ct.picture,sso:{profile:{...ct,iss:ct.iss??dt,aud:ct.aud},tenant:{id:ct.idp??dt,name:dt},tokenType:"Bearer",expires:ut}}}function pn(ct){let ut=ct.replace(/-/g,"+").replace(/_/g,"/");return atob(ut)}async function rt(ct){let ut=ct.split(".");if(ut.length!==3)throw Error("Invalid JWT");let dt=pn(ut[1]),pt=JSON.parse(dt),lt=await dn.validate(pt);if(lt.issues)throw Error(`ID token claims validation failed: ${lt.issues.map((mt)=>mt.message).join("; ")}`);if(lt.value)return H(lt.value);throw Error("ID token claims validation failed")}class k extends Error{constructor(ct,ut,dt){super(ct);this.code="conflict";this.name="StoreConflictError",this.kind=ut,this.field=dt,Object.setPrototypeOf(this,k.prototype)}}function M(ct){return ct instanceof k||typeof ct==="object"&&ct!=null&&ct.code==="conflict"}class ve extends Error{constructor(ct,ut={}){super(ct,{cause:ut.cause});this.name="IoniteError",this.status=ut.status,this.statusText=ut.statusText,Object.setPrototypeOf(this,ve.prototype)}}function xe(ct){if(typeof ct!=="object"||ct==null)return!1;let ut=ct.type;if(ut==="vault"||ut==="aws"||ut==="azure"||ut==="gcp")return!0;if(ut!=="mirror")return!1;let dt=ct;return xe(dt.from)&&dt.from.type!=="mirror"&&xe(dt.to)&&dt.to.type==="vault"}function st(ct,ut=Date.now()){let dt=ct?.integration;if(!dt)return{state:"none"};if(Date.parse(dt.expiresAt)<=ut)return{state:"expired",integration:dt};if(dt.status==="consented"&&dt.handoverAppliedAt&&ct.configLocator)return{state:"integrated",integration:dt};return{state:dt.status,integration:dt}}class Yt{constructor(){this.tenants=new Map;this.integrationHandles=new Map;this.ioniteIds=new Map}async get(ct){return this.tenants.get(ct)}async list(ct){let ut=Array.from(this.tenants.values()),dt=Math.max(0,ct?.start??0),pt=ct?.limit,lt=ut.length,mt=pt!=null?dt+pt:void 0,ft=ut.slice(dt,mt);return j(lt,ft,dt,pt)}async upsert(ct){let ut=this.tenants.get(ct.id);if(ut?.ioniteId!==ct.ioniteId){if(ut?.ioniteId)throw Error("ionite id cannot change");if(ct.ioniteId){let dt=this.ioniteIds.get(ct.ioniteId);if(dt&&dt!==ct.id)throw Error("ionite id is already in use");this.ioniteIds.set(ct.ioniteId,ct.id)}}if(ut?.integration?.handleHash!==ct.integration?.handleHash){if(ut?.integration)this.integrationHandles.delete(ut.integration.handleHash);if(ct.integration){let dt=this.integrationHandles.get(ct.integration.handleHash);if(dt&&dt!==ct.id)throw Error("Integration handle hash is already in use");this.integrationHandles.set(ct.integration.handleHash,ct.id)}}return this.tenants.set(ct.id,ct),ct}async delete(ct){let ut=this.tenants.get(ct),dt=ut!==void 0;if(ut?.integration)this.integrationHandles.delete(ut.integration.handleHash);if(ut?.ioniteId)this.ioniteIds.delete(ut.ioniteId);return this.tenants.delete(ct),dt?1:0}async setIntegration(ct,ut,dt){let pt=this.tenants.get(ct);if(!pt)return;let lt=pt.integration?.handleHash;if(dt?.expectedHandleHash!==void 0&&(dt.expectedHandleHash===null?lt!==void 0:lt!==dt.expectedHandleHash))return;if(dt?.expectedVersion!==void 0&&pt.integration?.version!==dt.expectedVersion)return;if(S(pt.integration,ut))return pt;if(ut){let gt=this.integrationHandles.get(ut.handleHash);if(gt&&gt!==ct)throw Error("Integration handle hash is already in use")}if(pt.integration)this.integrationHandles.delete(pt.integration.handleHash);if(ut)this.integrationHandles.set(ut.handleHash,ct);let mt=ut?.ioniteId??pt.ioniteId;if(mt){if(pt.ioniteId&&pt.ioniteId!==mt)throw Error("ionite id cannot change");let gt=this.ioniteIds.get(mt);if(gt&&gt!==ct)throw Error("ionite id is already in use");this.ioniteIds.set(mt,ct)}let ft={...pt,ioniteId:mt,integration:ut,updatedAt:new Date};return this.tenants.set(ct,ft),ft}async getByIntegrationHandleHash(ct){let ut=this.integrationHandles.get(ct);return ut?this.tenants.get(ut):void 0}async getByIoniteId(ct){let ut=this.ioniteIds.get(ct);return ut?this.tenants.get(ut):void 0}}class Me{constructor(ct={}){this.ionCache=ct.ionCache,this.store=new Yt}async get(ct){return this.store.get(ct)}async list(ct){return this.store.list(ct)}async upsert(ct){let ut=await this.store.upsert(ct);return this.ionCache?.delete(ct.id),ut}async delete(ct){let ut=await this.store.delete(ct);return this.ionCache?.delete(ct),ut}async getIon(ct){if(!this.ionCache)throw Error(`${this.constructor.name}.getIon() requires an app-owned ionCache. Pass { ionCache } (an lru-cache instance whose fetchMethod builds the tenant Ionite and whose dispose `+"closes it) — the SDK does not cache tenant runtimes. See the multi-tenant docs.");return this.ionCache.fetch(ct)}async setIntegration(ct,ut,dt){return this.store.setIntegration(ct,ut,dt)}async getByIntegrationHandleHash(ct){return this.store.getByIntegrationHandleHash(ct)}async getByIoniteId(ct){return this.store.getByIoniteId(ct)}}function ln(ct,ut,dt){return(async()=>{try{let pt=await fetch(ct,{method:"POST",headers:{...i,...r},body:JSON.stringify(ut)});if(!pt.ok)dt.error("Failed to send webhook update",{"ion.operation":"webhook.update","ion.outcome":"failure",status:pt.status,statusText:pt.statusText})}catch(pt){dt.error("Failed to send webhook update",{"ion.operation":"webhook.update","ion.outcome":"failure"},pt)}})()}async function ot(ct,ut,dt){return ln(ct,ut,dt)}var u="urn:ionite:scim:schemas:extension:ion:2.0:User",b="urn:ionite:scim:schemas:core:2.0:Workload",C="urn:ionite:scim:schemas:core:2.0:Customer";function yt(ct,ut,dt,pt,lt){if(ct===void 0||ct===null){if(dt)pt.push({message:`${ut} is required`,path:lt});return}if(typeof ct!=="string"){pt.push({message:`${ut} must be a string`,path:lt});return}return ct}function jt(ct,ut,dt,pt){if(ct===void 0||ct===null)return;if(typeof ct!=="boolean"){dt.push({message:`${ut} must be a boolean`,path:pt});return}return ct}function mn(ct,ut,dt){if(ct===void 0||ct===null)return;if(typeof ct!=="object"||ct===null){ut.push({message:"name must be an object",path:dt});return}let pt=ct,lt={};return lt.formatted=yt(pt.formatted,"formatted",!1,ut,[...dt,"formatted"]),lt.familyName=yt(pt.familyName,"familyName",!1,ut,[...dt,"familyName"]),lt.givenName=yt(pt.givenName,"givenName",!1,ut,[...dt,"givenName"]),lt.middleName=yt(pt.middleName,"middleName",!1,ut,[...dt,"middleName"]),lt.honorificPrefix=yt(pt.honorificPrefix,"honorificPrefix",!1,ut,[...dt,"honorificPrefix"]),lt.honorificSuffix=yt(pt.honorificSuffix,"honorificSuffix",!1,ut,[...dt,"honorificSuffix"]),lt}function fn(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"emails must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"email must be an object",path:ft});continue}let gt=mt,xt=yt(gt.value,"value",!0,ut,[...ft,"value"]);if(xt)pt.push({value:xt,display:yt(gt.display,"display",!1,ut,[...ft,"display"]),type:yt(gt.type,"type",!1,ut,[...ft,"type"]),primary:jt(gt.primary,"primary",ut,[...ft,"primary"])})}return pt.length>0?pt:void 0}function gn(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"phoneNumbers must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"phoneNumber must be an object",path:ft});continue}let gt=mt,xt=yt(gt.value,"value",!0,ut,[...ft,"value"]);if(xt)pt.push({value:xt,display:yt(gt.display,"display",!1,ut,[...ft,"display"]),type:yt(gt.type,"type",!1,ut,[...ft,"type"]),primary:jt(gt.primary,"primary",ut,[...ft,"primary"])})}return pt.length>0?pt:void 0}function yn(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"addresses must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"address must be an object",path:ft});continue}let gt=mt;pt.push({formatted:yt(gt.formatted,"formatted",!1,ut,[...ft,"formatted"]),streetAddress:yt(gt.streetAddress,"streetAddress",!1,ut,[...ft,"streetAddress"]),locality:yt(gt.locality,"locality",!1,ut,[...ft,"locality"]),region:yt(gt.region,"region",!1,ut,[...ft,"region"]),postalCode:yt(gt.postalCode,"postalCode",!1,ut,[...ft,"postalCode"]),country:yt(gt.country,"country",!1,ut,[...ft,"country"]),type:yt(gt.type,"type",!1,ut,[...ft,"type"]),primary:jt(gt.primary,"primary",ut,[...ft,"primary"])})}return pt.length>0?pt:void 0}function Tn(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"groups must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"group must be an object",path:ft});continue}let gt=mt,xt=yt(gt.value,"value",!0,ut,[...ft,"value"]);if(xt)pt.push({value:xt,$ref:yt(gt.$ref,"$ref",!1,ut,[...ft,"$ref"]),display:yt(gt.display,"display",!1,ut,[...ft,"display"]),type:yt(gt.type,"type",!1,ut,[...ft,"type"])})}return pt.length>0?pt:void 0}function hn(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"roles must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"role must be an object",path:ft});continue}let gt=mt,xt=yt(gt.value,"value",!0,ut,[...ft,"value"]);if(xt)pt.push({value:xt,display:yt(gt.display,"display",!1,ut,[...ft,"display"]),type:yt(gt.type,"type",!1,ut,[...ft,"type"]),primary:jt(gt.primary,"primary",ut,[...ft,"primary"])})}return pt.length>0?pt:void 0}function bn(ct,ut,dt){if(ct===void 0||ct===null)return;if(typeof ct!=="object"||ct===null){ut.push({message:"Enterprise User extension must be an object",path:dt});return}let pt=ct,lt={};if(lt.employeeNumber=yt(pt.employeeNumber,"employeeNumber",!1,ut,[...dt,"employeeNumber"]),lt.costCenter=yt(pt.costCenter,"costCenter",!1,ut,[...dt,"costCenter"]),lt.organization=yt(pt.organization,"organization",!1,ut,[...dt,"organization"]),lt.division=yt(pt.division,"division",!1,ut,[...dt,"division"]),lt.department=yt(pt.department,"department",!1,ut,[...dt,"department"]),pt.manager!==void 0&&pt.manager!==null)if(typeof pt.manager!=="object"||pt.manager===null)ut.push({message:"manager must be an object",path:[...dt,"manager"]});else{let mt=pt.manager;lt.manager={value:yt(mt.value,"value",!1,ut,[...dt,"manager","value"]),$ref:yt(mt.$ref,"$ref",!1,ut,[...dt,"manager","$ref"]),displayName:yt(mt.displayName,"displayName",!1,ut,[...dt,"manager","displayName"])}}return lt}function it(ct){return{"~standard":{version:1,vendor:ct,validate:(ut)=>{if(typeof ut!=="object"||ut===null)return{issues:[{message:"Expected an object"}]};let dt=ut,pt=[],lt={},mt=yt(dt.userName,"userName",!0,pt,["userName"]);if(!mt)return{issues:pt};if(lt.userName=mt,lt.id=yt(dt.id,"id",!1,pt,["id"]),lt.externalId=yt(dt.externalId,"externalId",!1,pt,["externalId"]),lt.displayName=yt(dt.displayName,"displayName",!1,pt,["displayName"]),lt.nickName=yt(dt.nickName,"nickName",!1,pt,["nickName"]),lt.profileUrl=yt(dt.profileUrl,"profileUrl",!1,pt,["profileUrl"]),lt.title=yt(dt.title,"title",!1,pt,["title"]),lt.userType=yt(dt.userType,"userType",!1,pt,["userType"]),lt.preferredLanguage=yt(dt.preferredLanguage,"preferredLanguage",!1,pt,["preferredLanguage"]),lt.locale=yt(dt.locale,"locale",!1,pt,["locale"]),lt.timezone=yt(dt.timezone,"timezone",!1,pt,["timezone"]),dt.password!==void 0)pt.push({message:"password is not supported: the SDK does not accept credentials via SCIM",path:["password"]});lt.active=jt(dt.active,"active",pt,["active"]),lt.name=mn(dt.name,pt,["name"]),lt.emails=fn(dt.emails,pt,["emails"]),lt.phoneNumbers=gn(dt.phoneNumbers,pt,["phoneNumbers"]),lt.addresses=yn(dt.addresses,pt,["addresses"]),lt.groups=Tn(dt.groups,pt,["groups"]),lt.roles=hn(dt.roles,pt,["roles"]);let ft="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(dt[ft]!==void 0)lt[ft]=bn(dt[ft],pt,[ft]);if(dt.schemas!==void 0)if(Array.isArray(dt.schemas))lt.schemas=dt.schemas.filter((gt)=>typeof gt==="string");else pt.push({message:"schemas must be an array",path:["schemas"]});if(dt.meta!==void 0)if(typeof dt.meta==="object"&&dt.meta!==null){let gt=dt.meta;lt.meta={resourceType:typeof gt.resourceType==="string"?gt.resourceType:void 0,created:typeof gt.created==="string"?gt.created:void 0,lastModified:typeof gt.lastModified==="string"?gt.lastModified:void 0,location:typeof gt.location==="string"?gt.location:void 0,version:typeof gt.version==="string"?gt.version:void 0}}else pt.push({message:"meta must be an object",path:["meta"]});if(pt.length>0)return{issues:pt};return{value:lt}}}}}function An(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"members must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"member must be an object",path:ft});continue}let gt=mt,xt=yt(gt.value,"value",!0,ut,[...ft,"value"]);if(xt){let St=yt(gt.type,"type",!1,ut,[...ft,"type"]);if(St!==void 0&&St!=="User"&&St!=="Group"&&St!=="Workload"&&St!=="Customer")ut.push({message:"type must be 'User', 'Group', 'Workload', or 'Customer'",path:[...ft,"type"]});pt.push({value:xt,$ref:yt(gt.$ref,"$ref",!1,ut,[...ft,"$ref"]),display:yt(gt.display,"display",!1,ut,[...ft,"display"]),type:St==="User"||St==="Group"||St==="Workload"||St==="Customer"?St:void 0})}}return pt.length>0?pt:void 0}function at(ct){return{"~standard":{version:1,vendor:ct,validate:(ut)=>{if(typeof ut!=="object"||ut===null)return{issues:[{message:"Expected an object"}]};let dt=ut,pt=[],lt={},mt=yt(dt.displayName,"displayName",!0,pt,["displayName"]);if(!mt)return{issues:pt};if(lt.displayName=mt,lt.id=yt(dt.id,"id",!1,pt,["id"]),lt.externalId=yt(dt.externalId,"externalId",!1,pt,["externalId"]),lt.members=An(dt.members,pt,["members"]),dt.schemas!==void 0)if(Array.isArray(dt.schemas))lt.schemas=dt.schemas.filter((ft)=>typeof ft==="string");else pt.push({message:"schemas must be an array",path:["schemas"]});if(dt.meta!==void 0)if(typeof dt.meta==="object"&&dt.meta!==null){let ft=dt.meta;lt.meta={resourceType:typeof ft.resourceType==="string"?ft.resourceType:void 0,created:typeof ft.created==="string"?ft.created:void 0,lastModified:typeof ft.lastModified==="string"?ft.lastModified:void 0,location:typeof ft.location==="string"?ft.location:void 0,version:typeof ft.version==="string"?ft.version:void 0}}else pt.push({message:"meta must be an object",path:["meta"]});if(pt.length>0)return{issues:pt};return{value:lt}}}}}function Ht(ct,ut){if(ct===void 0)return;if(typeof ct!=="object"||ct===null){ut.push({message:"meta must be an object",path:["meta"]});return}let dt=ct;return{resourceType:typeof dt.resourceType==="string"?dt.resourceType:void 0,created:typeof dt.created==="string"?dt.created:void 0,lastModified:typeof dt.lastModified==="string"?dt.lastModified:void 0,location:typeof dt.location==="string"?dt.location:void 0,version:typeof dt.version==="string"?dt.version:void 0}}function Jt(ct,ut){if(ct===void 0)return;if(!Array.isArray(ct)){ut.push({message:"schemas must be an array",path:["schemas"]});return}return ct.filter((dt)=>typeof dt==="string")}function Xt(ct,ut){if(ct===void 0)return;if(typeof ct!=="object"||ct===null||Array.isArray(ct)){ut.push({message:"attributes must be an object",path:["attributes"]});return}return{...ct}}var ue={"~standard":{version:1,vendor:"ionite",validate:(ct)=>{let ut=[];if(typeof ct!=="object"||ct===null)return{issues:[{message:"Workload must be an object"}]};let dt=ct,pt={schemas:Jt(dt.schemas,ut),id:yt(dt.id,"id",!1,ut,["id"]),externalId:yt(dt.externalId,"externalId",!1,ut,["externalId"]),userName:yt(dt.userName,"userName",!1,ut,["userName"]),displayName:yt(dt.displayName,"displayName",!1,ut,["displayName"]),description:yt(dt.description,"description",!1,ut,["description"]),active:typeof dt.active==="boolean"?dt.active:void 0,providerId:yt(dt.providerId,"providerId",!1,ut,["providerId"]),requestUrl:yt(dt.requestUrl,"requestUrl",!1,ut,["requestUrl"]),attributes:Xt(dt.attributes,ut),meta:Ht(dt.meta,ut)};if(ut.length>0)return{issues:ut};return{value:pt}}}},de={"~standard":{version:1,vendor:"ionite",validate:(ct)=>{let ut=[];if(typeof ct!=="object"||ct===null)return{issues:[{message:"Customer must be an object"}]};let dt=ct,pt=dt.emails,lt;if(pt!==void 0)if(!Array.isArray(pt))ut.push({message:"emails must be an array",path:["emails"]});else lt=pt.filter((ft)=>typeof ft==="object"&&ft!==null&&typeof ft.value==="string");let mt={schemas:Jt(dt.schemas,ut),id:yt(dt.id,"id",!1,ut,["id"]),externalId:yt(dt.externalId,"externalId",!1,ut,["externalId"]),userName:yt(dt.userName,"userName",!1,ut,["userName"]),displayName:yt(dt.displayName,"displayName",!1,ut,["displayName"]),active:typeof dt.active==="boolean"?dt.active:void 0,emails:lt,providerId:yt(dt.providerId,"providerId",!1,ut,["providerId"]),requestUrl:yt(dt.requestUrl,"requestUrl",!1,ut,["requestUrl"]),attributes:Xt(dt.attributes,ut),meta:Ht(dt.meta,ut)};if(ut.length>0)return{issues:ut};return{value:mt}}}};
+export{J,je,d,A,I,v,o,j,c,Ne,Y,f,e,g,x,X,le,Ee,Le,Pe,N,L,T,K,Z,q,n,p,Q,E,pe,$e,Ke,W,qe,We,Ve,ee,te,V,ne,me,fe,m,z,Ue,re,B,P,U,G,ze,_,_e,Be,Ge,O,ge,ye,he,Se,ke,be,Ce,Te,we,Re,se,Fe,oe,ie,y,s,He,D,Ae,Ie,i,ae,Je,Ye,r,w,h,Xe,Ze,Oe,F,a,l,t,ce,Qe,De,et,R,S,tt,nt,H,rt,k,M,ve,xe,st,Me,ot,u,b,C,it,at,ue,de};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/core",
-  "version": "0.0.24-beta.20261003.17",
+  "version": "0.0.24-beta.20261006.21",
   "description": "ionite Core (client-safe main entry; server handlers under ./server)",
   "private": false,
   "author": "ionite",

package/dist/shared/core-njzaahvy.js

@@ -1,4 +0,0 @@
-function G(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function q(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function le(e,t){if(q(t.issuer)!==q(e.claims?.iss))return!1;let n=G(t.audience);if(n.length===0)return!1;let s=G(e.claims?.aud),r=typeof e.claims?.azp==="string"?e.claims.azp:void 0;if(!(n.some((a)=>s.includes(a))||(r?n.includes(r):!1)))return!1;let o=e.clientId??e.workloadId??e.claims?.sub;return t.clientId===o}function We(e,t){let n=e?.trustedProvisioningClients;if(!n?.length)return;let s=new Set;for(let r of n){if(!le(t,r))continue;for(let i of r.permissions??[])s.add(i)}return s.size>0?s:void 0}function Ye(e){let t=e?.trustedProvisioningClients;if(!t?.length)return[];let n=[];for(let s of t)for(let r of s.permissions??[])n.push({subject:s.clientId,subjectType:"workload",targetType:"permission",target:r,status:"active",provenance:{source:"eci-trusted",actor:s.clientId}});return n}var V=["id","name","displayName","description","providerId","source","deprecated","type","parent","resources","assignableSubjectTypes","recommendedSubjectTypes","requestable","riskLevel","requestUrl","action","permissionTypes","resourceTypes","applyToSubResources","permissions","groups","roles"],Je=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","ecid","accountClass","displayName","scimName","emails","nickName","active","title","preferredLanguage","locale","timezone","phoneNumbers","ims","photos","addresses","roles","groups","entitlements","x509Certificates","scimEnterprise","scimSchemaExtensions","createdAt","updatedAt","sso"],Xe=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","displayName","emails","phoneNumbers","active","createdAt","updatedAt","ciam"],Ze=["id","clientId","displayName","description","externalId","providerId","requestUrl","ecid","active","scopes","createdAt","updatedAt","metadata"];function Qe(e,t){let n=new Set(t),s=Object.fromEntries(Object.entries(e).filter(([r,i])=>!n.has(r)&&i!==void 0));return Object.keys(s).length>0?s:void 0}function w(e,t,n,s){let r=t.length,i=s??e,o=i>0?Math.floor(n/i)+1:1,a=i>0?Math.ceil(e/i):0;return{total:e,count:r,items:t,size:i,page:o,pages:a}}async function*C(e,t,n=1000){let s=0;while(!0){let r=await e(s,n);if(r.items.length===0)break;for(let i of r.items)yield(t?await t(i):i)??i;if(r.items.length<n||s+r.items.length>=r.total)break;s+=n}}function tt(e,t){if(!t)return!0;if(t.requestable!==void 0&&Boolean(e.requestable)!==t.requestable)return!1;if(t.userName!==void 0){if((e.userName??e.clientId)!==t.userName)return!1}if(t.externalId!==void 0&&e.externalId!==t.externalId)return!1;if(t.updatedAfter!==void 0){if(!(e.updatedAt instanceof Date))return!1;let n=t.updatedAfter instanceof Date?t.updatedAfter:new Date(t.updatedAfter);if(Number.isNaN(n.getTime())||e.updatedAt<=n)return!1}return!0}var st=["basic","elevated","privileged","admin"],rt="basic",it="urn:ionite:params:scim:schemas:extension:authz:2.0:Group",_=["user","workload","customer"];function z(e){let{assignableSubjectTypes:t,recommendedSubjectTypes:n}=e,s=e.id?` for "${e.id}"`:"";if(!t||t.length===0)throw Error(`assignableSubjectTypes${s} is required and must be a non-empty subset of [${_.join(", ")}]`);let r=t.filter((i)=>!_.includes(i));if(r.length>0)throw Error(`assignableSubjectTypes${s} contains values outside the platform ceiling [${_.join(", ")}]: ${r.join(", ")}`);if(n){let i=n.filter((o)=>!t.includes(o));if(i.length>0)throw Error(`recommendedSubjectTypes${s} must be a subset of assignableSubjectTypes; offending values: ${i.join(", ")}`)}}function j(e,t="subjectType"){if(e!=="user"&&e!=="customer"&&e!=="workload")throw Error(`${t} is required and must be one of [user, customer, workload]; got ${e===void 0?"undefined":JSON.stringify(e)}`)}class F extends Error{constructor(e,t,n){super(e);this.name="AssignmentPolicyError",this.policy=t,this.requestUrl=n,Object.setPrototypeOf(this,F.prototype)}}function fe(e){return typeof e.groups?.get==="function"}function dt(e){return fe(e)?e:me(e)}class x extends Error{constructor(e){super(`defineCatalog: ${e}`);this.name="CodeCatalogError"}}function W(e){return typeof e==="string"?e:e.id}function ge(e){for(let t of Object.values(e))if(Array.isArray(t))Object.freeze(t);Object.freeze(e)}function v(e,t){try{z(t)}catch(n){throw new x(`${e} "${t.id}": ${n instanceof Error?n.message:String(n)}`)}}function O(e){let t=new Map(e.map((s)=>[s.id,s])),n=Object.freeze([...e]);return Object.freeze({get:(s)=>t.get(s),list:()=>n})}function me(e){let t=e.groups??[],n=e.roles??[],s=e.permissions??[],r=new Map,i=(u,l)=>{for(let d of l){if(!d.id)throw new x(`a ${u} is missing its required "id".`);let p=r.get(d.id);if(p)throw new x(`duplicate id "${d.id}" (declared as both ${p} and ${u}).`);r.set(d.id,u)}};i("group",t),i("role",n),i("permission",s);let o=(u,l,d,p)=>{let m=W(p),y=r.get(m);if(y===void 0)throw new x(`${u} "${l}" references ${d} "${m}", which is not declared in the catalog.`);if(y!==d)throw new x(`${u} "${l}" references "${m}" as a ${d}, but it is a ${y}.`)};for(let u of n){v("role",u);for(let l of u.permissions??[])o("role",u.id,"permission",l)}for(let u of s)v("permission",u);for(let u of t){v("group",u);for(let l of u.groups??[])o("group",u.id,"group",l);for(let l of u.roles??[])o("group",u.id,"role",l);for(let l of u.permissions??[])o("group",u.id,"permission",l)}let a=new Map(t.map((u)=>[u.id,u])),g=new Map,f=(u,l)=>{let d=g.get(u);if(d==="done")return;if(d==="visiting")throw new x(`group composition cycle: ${[...l,u].join(" -> ")}.`);g.set(u,"visiting");for(let p of a.get(u)?.groups??[])f(W(p),[...l,u]);g.set(u,"done")};for(let u of t)f(u.id,[]);for(let u of[...t,...n,...s])ge(u);return Object.freeze({groups:O(t),roles:O(n),permissions:O(s)})}function pt(e,t){let n=e?.groups.get(t);if(n)return{entity:n,kind:"group"};let s=e?.roles.get(t);if(s)return{entity:s,kind:"role"};let r=e?.permissions.get(t);return r?{entity:r,kind:"permission"}:void 0}function lt(e,t){return t==="group"?e.groups:t==="role"?e.roles:e.permissions}function S(e,t,n){let s={...t,...n,id:t.id,requestable:t.requestable,source:n.source??"code",assignableSubjectTypes:t.assignableSubjectTypes,recommendedSubjectTypes:t.recommendedSubjectTypes};if(e==="group"){let i=t;return{...s,groups:i.groups,roles:i.roles,permissions:i.permissions,resources:i.resources}}if(e==="role")return{...s,permissions:t.permissions};let r=t;return{...s,action:r.action,permissionTypes:r.permissionTypes,resourceTypes:r.resourceTypes,applyToSubResources:r.applyToSubResources}}async function ft(e,t,n){let s=await n.get(t.id);if(s)return S(e,t,s);let r=Object.entries(t).filter(([l])=>V.includes(l)),{riskLevel:i,displayName:o,...a}=Object.fromEntries(r),g={...a,source:"code"},f=n.insertIfAbsent(g);await f.ready();let u=await n.get(t.id)??f;return S(e,t,u)}async function gt(e,t,n){let s=async(r,i)=>{let o=n?[await r.get(n)].filter((a)=>a!==void 0):C((a,g)=>r.list({start:a,limit:g}));for await(let a of o){if(a.source!=="code"||a.deprecated===!0||i?.get(a.id))continue;await r.set({...a,deprecated:!0}).ready()}};await s(t.groups,e?.groups),await s(t.roles,e?.roles),await s(t.permissions,e?.permissions)}function N(e,t,n){let s=()=>{if(!n)throw Error(`Cannot write ${e} definitions: no AccessCatalogStore is wired (the code-declared catalog is read-only).`);return n};return{async get(i){let o=t.get(i);if(!n)return o;let a=await n.get(i);return a&&o?S(e,o,a):a??o},set(i){return s().set(i)},insertIfAbsent(i){return s().insertIfAbsent(i)},async delete(i){await s().delete(i)},async list(i){let o=Math.max(0,i?.start??0),a=i?.limit,g=i?.filter?.requestable,f=[];if(n)for await(let p of C((m,y)=>n.list({start:m,limit:y})))f.push(p);let u=new Map(f.map((p)=>[p.id,p])),l=[...t.list().map((p)=>{let m=u.get(p.id);return m?S(e,p,m):p}),...f.filter((p)=>!t.get(p.id))].filter((p)=>g===void 0||Boolean(p.requestable)===g),d=a!=null?o+a:void 0;return w(l.length,l.slice(o,d),o,a)}}}function mt(e,t){if(!e)return t;return{groups:N("group",e.groups,t?.groups),roles:N("role",e.roles,t?.roles),permissions:N("permission",e.permissions,t?.permissions),afterChange:t?.afterChange?.bind(t)}}function A(e){if(typeof e==="string")return e.trim();if(e&&typeof e==="object"){let t=e;for(let n of["id","value","name","displayName"]){let s=t[n];if(typeof s==="string"&&s.trim())return s.trim()}}return""}function H(e){let t=A(e.subject),n=A(e.target);if(!t)throw Error("Access change subject must resolve to a non-empty id.");if(!e.targetType)throw Error("Access change targetType is required.");if(!n)throw Error("Access change target must resolve to a non-empty id.");let s=(e.resources??[]).map((i)=>i.trim()).filter(Boolean),r=!e.applyToApplication&&s.length>0?[...s].sort().join(","):"app";return j(e.subjectType,"Access change subjectType"),`${e.subjectType}:${t}:${e.targetType}:${n}:${r}`}function ye(e){let t=(e.resources??[]).map((n)=>n.trim()).filter(Boolean);if(e.applyToApplication||t.length===0)return[void 0];return t}async function J(e,t,n,s,r){if(s==="resource")return n?.get(r);let i=t?s==="group"?t.groups.get(r):s==="role"?t.roles.get(r):t.permissions.get(r):void 0;if(e){let a=await(s==="group"?e.groups:s==="role"?e.roles:e.permissions).get(r);if(a)return i?S(s,i,a):a}return i}class Te{constructor(e,t,n){this.catalog=e;this.resources=t;this.code=n;this.nodes=new Map;this.subResources=new Map;this.children=new Map}getNode(e,t){let n=`${e}:${t}`,s=this.nodes.get(n);if(!s)s=J(this.catalog,this.code,this.resources,e,t),this.nodes.set(n,s);return s}resourceChildren(e){let t=this.children.get(e);if(!t)t=X(e,this.view()),this.children.set(e,t);return t}resourceAndSubResourceIds(e){let t=this.subResources.get(e);if(!t)t=Q(e,this.view()),this.subResources.set(e,t);return t}view(){return{catalog:this.catalog,code:this.code,resources:this.resources,cache:this}}invalidate(e){this.clear()}clear(){this.nodes.clear(),this.subResources.clear(),this.children.clear()}}async function R(e,t,n){if(e.cache)return e.cache.getNode(t,n);return J(e.catalog,e.code,e.resources,t,n)}async function Y(e,t){if(typeof e!=="string")return e;return R(t,"resource",e)}async function X(e,t){if(t.resources?.children)return t.resources.children(e);let n=await Y(e,t),s=[];for(let r of n?.resources??[]){let i=await Y(r,t);if(i)s.push(i);else if(typeof r==="string"&&r.trim())s.push({id:r.trim()})}return s}async function Z(e,t){if(t.cache)return t.cache.resourceChildren(e);return X(e,t)}async function Q(e,t){let n=[],s=new Set,r=async(i)=>{if(!i||s.has(i))return;s.add(i),n.push(i);for(let o of await Z(i,t))await r(A(o))};return await r(A(e)),n}async function he(e,t){let n=e.id??H(e),s=A(e.subject);if(!s)throw Error("Access change subject must resolve to a non-empty id.");j(e.subjectType,"Access change subjectType");let r=e.subjectType,i=ye(e),o=[],a=new Set,g=new Set,f=(d,p,m)=>{if(!p)return;let y=`${d}:${p}:${m??""}`;if(a.has(y))return;a.add(y),o.push({subject:s,subjectType:r,targetType:d,target:p,resource:m,rootId:n})},u=async(d,p,m)=>{for(let y of i)if(d==="permission"&&m?.applyToSubResources&&y){let b=t.cache?await t.cache.resourceAndSubResourceIds(y):await Q(y,t);for(let h of b)f("permission",p,h)}else f(d,p,y)},l=async(d,p)=>{let m=A(p);if(!m)return;let y=`${d}:${m}`;if(g.has(y))return;if(g.add(y),d==="group"){let h=typeof p==="string"?await R(t,"group",m):p;await u("group",m,void 0);for(let T of h?.groups??[])await l("group",T);for(let T of h?.roles??[])await l("role",T);for(let T of h?.permissions??[])await l("permission",T);return}if(d==="role"){let h=typeof p==="string"?await R(t,"role",m):p;await u("role",m,void 0);for(let T of h?.permissions??[])await l("permission",T);return}let b=typeof p==="string"?await R(t,"permission",m):p;await u("permission",m,b)};return await l(e.targetType,e.target),o}async function At(e,t,n,s){let{accessStore:r,accessIndex:i,catalogStore:o,code:a,resources:g}=n;if(!i||!o&&!a)return 0;if(!r)return await i.replaceSubject(e,t,[]),0;let f={catalog:o,code:a,resources:g,cache:s},u=[],l=0;for await(let d of C((p,m)=>r.listBySubject(e,t,{start:p,limit:m}))){let p=d.id??H(d),m=await he({...d,id:p},f);u.push(...m),l+=1}return await i.replaceSubject(e,t,u),l}async function xt(e,t,n){let s=new Map,r=new Map,i=new Map,o=new Map,a=new Set,g=(l,d)=>R(n,l,d),f=async(l)=>{let d=A(l);if(!d||o.has(d))return;let p=typeof l==="string"?await g("resource",d):l;if(!p)return;o.set(d,p);let m=p.resources??(p.id?await Z(p.id,n):[]);for(let y of m)await f(y)},u=async(l,d)=>{let p=A(d);if(!p)return;let m=`${l}:${p}`;if(a.has(m))return;if(a.add(m),l==="group"){let b=typeof d==="string"?await g("group",p):d;if(!b)return;s.set(p,b);for(let h of b.groups??[])await u("group",h);for(let h of b.roles??[])await u("role",h);for(let h of b.permissions??[])await u("permission",h);for(let h of b.resources??[])await f(h);return}if(l==="role"){let b=typeof d==="string"?await g("role",p):d;if(!b)return;r.set(p,b);for(let h of b.permissions??[])await u("permission",h);return}let y=typeof d==="string"?await g("permission",p):d;if(!y)return;i.set(p,y)};if(a.add(`${t}:${A(e)}`),t==="group"){let l=e;for(let d of l.groups??[])await u("group",d);for(let d of l.roles??[])await u("role",d);for(let d of l.permissions??[])await u("permission",d);for(let d of l.resources??[])await f(d)}else{let l=e;for(let d of l.permissions??[])await u("permission",d)}return{groups:[...s.values()],roles:[...r.values()],permissions:[...i.values()],resources:[...o.values()]}}var Ct=".profile",Rt=1,Et=10,kt=10,It=14400,wt="ion.discovered",be=new Set(["sid","sub","tokens","access_token","id_token","refresh_token","accessClaims","roles","groups","permissions","grants"]);function Pt(e){if(typeof e!=="number"||!Number.isFinite(e)||e<1)return 10;return Math.floor(e)}function _t(e){if(typeof e!=="number"||!Number.isFinite(e)||e<1)return 10;return Math.floor(e)}function jt(e){if(typeof e!=="number"||!Number.isFinite(e)||e<1)return 14400;return Math.floor(e)}function ee(e){let t={};if(e.name)t.name=e.name;if(e.email)t.email=e.email;if(e.avatar)t.avatar=e.avatar;return t}function te(e){if(!e||typeof e!=="object"||Array.isArray(e))return{};let t={};for(let[n,s]of Object.entries(e)){if(be.has(n))continue;if(typeof s==="string"||typeof s==="number"||typeof s==="boolean"||s===null)t[n]=s}return t}function Ae(e){let t=e;return{name:typeof t.name==="string"?t.name:void 0,email:typeof t.email==="string"?t.email:void 0,avatar:typeof t.avatar==="string"?t.avatar:void 0}}function vt(e,t){let n=Ae(e);if(!t)return ee(n);try{return te(t(e))}catch{return ee(n)}}function Ot(e){return btoa(JSON.stringify(e))}function xe(e){try{let t=JSON.parse(atob(e));if(!t||typeof t!=="object"||Array.isArray(t))return;let n=t;if(n.v!==1)return;if(n.authType!=="sso"&&n.authType!=="ciam")return;if(n.kind!==void 0&&n.kind!=="session"&&n.kind!=="discovered")return;if(typeof n.expiresAt!=="string"||!n.expiresAt)return;let s=typeof n.tenantId==="string"&&n.tenantId?n.tenantId:void 0,r=typeof n.tenantName==="string"&&n.tenantName?n.tenantName:void 0;return{v:1,...n.kind?{kind:n.kind}:{},...s?{tenantId:s}:{},authType:n.authType,expiresAt:n.expiresAt,user:te(n.user),...r?{tenantName:r}:{}}}catch{return}}function Se(e){let t={};if(!e)return t;for(let n of e.split(";")){let s=n.trim();if(!s)continue;let r=s.indexOf("=");if(r===-1)continue;t[s.slice(0,r).trim()]=s.slice(r+1).trim()}return t}function Nt(e){let t=Se(e),n=[];for(let[s,r]of Object.entries(t)){if(!s.endsWith(".profile")||!r)continue;let i=xe(r);if(!i)continue;n.push({name:s,prefix:s.slice(0,-8),envelope:i})}return n}function Dt(e,t){let n=e?Date.parse(e):Number.NaN,s=t?Date.parse(t):Number.NaN,r=Number.isFinite(n),i=Number.isFinite(s);if(r&&i)return s-n;if(r)return-1;if(i)return 1;return 0}function Ce(e){return`${e}.profile`}function Mt(e){return Ce(`ion.discovered.${encodeURIComponent(e)}`)}var Lt="ecid",ne=/^ecid:([A-Za-z0-9._-]+):([A-Za-z0-9_-]+)$/,Re=/^[A-Za-z0-9._-]+$/,Ee=/^[A-Za-z0-9_-]+$/;class E extends Error{constructor(e){super(e);this.name="EcidFormatError"}}function ke(e){return typeof e==="string"&&ne.test(e)}function $t(e,t){if(!e||!Re.test(e))throw new E(`Invalid ECID realm ${JSON.stringify(e)}: must be non-empty and match [A-Za-z0-9._-].`);if(!t||!Ee.test(t))throw new E(`Invalid ECID opaque ${JSON.stringify(t)}: must be non-empty and match [A-Za-z0-9_-].`);return`ecid:${e}:${t}`}function Kt(e){let t=typeof e==="string"?e.match(ne):null;if(!t)throw new E(`Invalid ECID ${JSON.stringify(e)}: expected "ecid:<realm>:<opaque>".`);return{realm:t[1],opaque:t[2]}}function Bt(e){if(!ke(e))throw new E(`Invalid ECID ${JSON.stringify(e)}: expected "ecid:<realm>:<opaque>".`);return e}function qt(e){return{"~standard":{version:1,vendor:e,validate:(t)=>{if(typeof t!=="object"||t===null)return{issues:[{message:"Expected an object"}]};let n=t,s=[],r={};if("code"in n)if(typeof n.code==="string")r.code=n.code;else s.push({message:"code must be a string",path:["code"]});else if(!("error"in n))s.push({message:"code is required",path:["code"]});if("state"in n)if(typeof n.state==="string"||n.state===void 0)r.state=n.state;else s.push({message:"state must be a string",path:["state"]});if("session_state"in n)if(typeof n.session_state==="string"||n.session_state===void 0)r.session_state=n.session_state;else s.push({message:"session_state must be a string",path:["session_state"]});if("error"in n){if(typeof n.error==="string")r.error=n.error;else s.push({message:"error must be a string",path:["error"]});if("error_description"in n)if(typeof n.error_description==="string"||n.error_description===void 0)r.error_description=n.error_description;else s.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in n)if(typeof n.error_uri==="string"||n.error_uri===void 0)r.error_uri=n.error_uri;else s.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in n)if(typeof n.iss==="string"||n.iss===void 0)r.iss=n.iss;else s.push({message:"iss must be a string",path:["iss"]});if(s.length>0)return{issues:s};return{value:r}}}}}function Vt(e){return{"~standard":{version:1,vendor:e,validate:(t)=>{if(typeof t!=="object"||t===null)return{issues:[{message:"Expected an object"}]};let n=t,s=[],r={};if("access_token"in n)if(typeof n.access_token==="string")r.access_token=n.access_token;else s.push({message:"access_token must be a string",path:["access_token"]});else s.push({message:"access_token is required",path:["access_token"]});if("id_token"in n)if(typeof n.id_token==="string")r.id_token=n.id_token;else s.push({message:"id_token must be a string",path:["id_token"]});else s.push({message:"id_token is required",path:["id_token"]});if("token_type"in n)if(typeof n.token_type==="string")r.token_type=n.token_type;else s.push({message:"token_type must be a string",path:["token_type"]});else s.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in n)if(typeof n.refresh_token==="string"||n.refresh_token===void 0)r.refresh_token=n.refresh_token;else s.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in n)if(typeof n.scope==="string"||n.scope===void 0)r.scope=n.scope;else s.push({message:"scope must be a string",path:["scope"]});if("session_state"in n)if(typeof n.session_state==="string"||n.session_state===void 0)r.session_state=n.session_state;else s.push({message:"session_state must be a string",path:["session_state"]});if("expires"in n)if(typeof n.expires==="string"||n.expires===void 0)r.expires=n.expires;else s.push({message:"expires must be a string",path:["expires"]});if("expires_in"in n)if(typeof n.expires_in==="number"||n.expires_in===void 0)r.expires_in=n.expires_in;else s.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in n)if(typeof n.refresh_expires_in==="number"||n.refresh_expires_in===void 0)r.refresh_expires_in=n.refresh_expires_in;else s.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(s.length>0)return{issues:s};return{value:r}}}}}function se(e){return{"~standard":{version:1,vendor:e,validate:(t)=>{if(typeof t!=="object"||t===null)return{issues:[{message:"Expected an object"}]};let n=t,s=[],r={...n},i=["iss","sub"];for(let f of i)if(typeof n[f]!=="string")s.push({message:`${f} is required and must be a string`,path:[f]});let o=n.aud;if(!(typeof o==="string"||Array.isArray(o)&&o.length>0&&o.every((f)=>typeof f==="string")))s.push({message:"aud is required and must be a string or a non-empty array of strings",path:["aud"]});if(typeof n.exp!=="number")s.push({message:"exp is required and must be a number",path:["exp"]});let g=["sid","name","email","preferred_username","picture"];for(let f of g)if(f in n&&n[f]!==void 0){if(typeof n[f]!=="string")s.push({message:`${f} must be a string`,path:[f]})}if("iat"in n&&n.iat!==void 0&&typeof n.iat!=="number")s.push({message:"iat must be a number",path:["iat"]});if(s.length>0)return{issues:s};return{value:r}}}}}var Ft="application/json",Wt="application/scim+json",Yt="application/x-www-form-urlencoded",Ht="application/xml",Jt="application/octet-stream",L=Object.freeze({Accept:"application/json"}),Xt=Object.freeze({Accept:"application/scim+json, application/json"}),Zt=Object.freeze({Accept:"application/xml"}),Qt=Object.freeze({Accept:"application/octet-stream"}),K=Object.freeze({"Content-Type":"application/json"}),en=Object.freeze({"Content-Type":"application/scim+json"}),tn=Object.freeze({"Content-Type":"application/x-www-form-urlencoded"}),nn=Object.freeze({"Content-Type":"application/xml"}),sn=Object.freeze({"Content-Type":"application/octet-stream"});function Ie(e){let t=e.headers.get("content-type")?.split(";",1)[0]?.trim().toLowerCase();return Boolean(t&&(t==="application/json"||t.endsWith("+json")))}function we(e){let t=e.replace(/\s+/g," ").trim();return t?t.slice(0,300):void 0}async function Pe(e,t={}){let n=e.headers.get("content-type")??void 0,s;try{s=await e.text()}catch{return{contentType:n}}let r=/<title(?:\s[^>]*)?>([\s\S]*?)<\/title>/i.exec(s)?.[1],i=we(r??(t.redact?"":s));return{contentType:n,excerpt:i}}async function _e(e,t={}){if(Ie(e))return await e.json();let n=await Pe(e,{redact:t.redact});t.log?.warn("Expected a JSON response body but received a different content type",{"ion.operation":t.operation??"http.response","ion.outcome":"degraded",reason:"non_json_response",status:e.status,contentType:n.contentType,excerpt:n.excerpt});let s=[n.contentType,n.excerpt].filter(Boolean).join(": ");throw Error(`Expected a JSON response body${s?`; received ${s}`:""}`)}function re(e){let t=e["~standard"];return Object.assign(e,{validate(n){return Promise.resolve(t.validate(n))}})}function rn(e,t="Assertion failed. Required value is null or undefined."){if(e===void 0||e===null)throw Error(t);return e}function on(e,t){return Response.json({error:"validation_failed",message:t,issues:e},{status:400,headers:K})}function an(e,t,n=[]){let s={...e,...t};for(let r of n)s[r]=e?.[r]??t?.[r];return s}function je(e){let t="",n=0,s=e.length;while(n<s){let r=e[n];if(r==='"'||r==="'"){let i=r;t+=r,n++;while(n<s){let o=e[n];if(o==="\\"){if(t+=o,n+1<s)t+=e[n+1],n+=2;else n++;continue}if(o===i){t+=o,n++;break}t+=o,n++}continue}if(r==="/"&&n+1<s){let i=e[n+1];if(i==="/"){n+=2;while(n<s&&e[n]!==`
-`)n++;if(n<s)t+=`
-`;n++;continue}if(i==="*"){n+=2;while(n+1<s&&!(e[n]==="*"&&e[n+1]==="/"))n++;n+=2;continue}}t+=r,n++}return t}function ve(e){let t="",n=!1,s=!1;for(let r=0;r<e.length;r+=1){let i=e[r];if(n){if(t+=i,s)s=!1;else if(i==="\\")s=!0;else if(i==='"')n=!1;continue}if(i==='"'){n=!0,t+=i;continue}if(i===","){let o=r+1;while(o<e.length&&/\s/.test(e[o]??""))o+=1;let a=e[o];if(a==="}"||a==="]")continue}t+=i}return t}function cn(e){let t=ve(je(e));return JSON.parse(t)}function un(e){return e==="/"?e:e.replace(/\/+$/,"")}function D(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=Object.getPrototypeOf(e);return t===Object.prototype||t===null}function M(e){return Object.keys(e).filter((t)=>e[t]!==void 0).sort()}function P(e,t){if(Object.is(e,t))return!0;if(e===null||t===null)return e===t;if(Array.isArray(e)||Array.isArray(t)){if(!Array.isArray(e)||!Array.isArray(t)||e.length!==t.length)return!1;for(let r=0;r<e.length;r+=1)if(!P(e[r],t[r]))return!1;return!0}if(!D(e)||!D(t))return!1;let n=M(e),s=M(t);if(n.length!==s.length)return!1;for(let r=0;r<n.length;r+=1)if(n[r]!==s[r])return!1;for(let r of n)if(!P(e[r],t[r]))return!1;return!0}function U(e,t){if(e===null||e===void 0){t.push("n");return}if(Array.isArray(e)){t.push("[");for(let n of e)U(n,t);t.push("]");return}if(D(e)){t.push("{");for(let n of M(e))t.push(JSON.stringify(n),":"),U(e[n],t);t.push("}");return}t.push(JSON.stringify(e))}function dn(e){let t=[];U(e,t);let n=t.join(""),s=2166136261;for(let r=0;r<n.length;r+=1)s^=n.charCodeAt(r),s=s*16777619%9007199254740992;return`${n.length.toString(36)}:${s.toString(36)}`}async function pn(e,t=async(o)=>o.status===200,n=1000,s=1e4,r,i){let o=Date.now(),a=`Awaiting Ping (${e})`;return new Promise((g,f)=>{let u=null,l=null,d=null,p=!1,m=()=>{if(u)clearTimeout(u);if(l)clearInterval(l);if(d)clearTimeout(d);u=null,l=null,d=null},y=(T)=>{if(p)return;p=!0,m(),T()},b=Math.max(n,1e4),h=async()=>{try{let T=await fetch(e,{headers:L,signal:AbortSignal.timeout(b)});if(T.ok){if(await t(T)){y(g);return}a=`Response test failed: ${T.status}: ${T.statusText} - ${e}`}else try{let I=await _e(T,{log:i,operation:"wait_on.probe"});a=`Response error: ${T.status}: ${T.statusText} - ${e}: ${JSON.stringify(I)}`}catch(I){let pe=I instanceof Error?`: ${I.message}`:"";a=`Response error: ${T.status}: ${T.statusText} - ${e}${pe}`}}catch(T){a=`${T instanceof Error?T.message:String(T)} - ${e}`}if(!p)u=setTimeout(()=>void h(),n)};if(s>0)l=setInterval(()=>{i?.warn(`${a}: ${Date.now()-o}ms`)},s);if(r)d=setTimeout(()=>{y(()=>f(Error(`Timeout: ${r}ms: ${a}`)))},r);h()})}var Oe="@ionite/core",Ne=re(se(Oe));function De(e){let t=e.exp!=null?new Date(e.exp*1000):new Date,n=e.iss??"";return{id:e.sub??"",userName:e.preferred_username??"",name:e.name??"",email:e.email??"",avatar:e.picture,sso:{profile:{...e,iss:e.iss??n,aud:e.aud},tenant:{id:e.idp??n,name:n},tokenType:"Bearer",expires:t}}}function Me(e){let t=e.replace(/-/g,"+").replace(/_/g,"/");return atob(t)}async function mn(e){let t=e.split(".");if(t.length!==3)throw Error("Invalid JWT");let n=Me(t[1]),s=JSON.parse(n),r=await Ne.validate(s);if(r.issues)throw Error(`ID token claims validation failed: ${r.issues.map((i)=>i.message).join("; ")}`);if(r.value)return De(r.value);throw Error("ID token claims validation failed")}class B extends Error{constructor(e,t,n){super(e);this.code="conflict";this.name="StoreConflictError",this.kind=t,this.field=n,Object.setPrototypeOf(this,B.prototype)}}function Tn(e){return e instanceof B||typeof e==="object"&&e!=null&&e.code==="conflict"}class oe extends Error{constructor(e,t={}){super(e,{cause:t.cause});this.name="IoniteError",this.status=t.status,this.statusText=t.statusText,Object.setPrototypeOf(this,oe.prototype)}}function ie(e){if(typeof e!=="object"||e==null)return!1;let t=e.type;if(t==="vault"||t==="aws"||t==="azure"||t==="gcp")return!0;if(t!=="mirror")return!1;let n=e;return ie(n.from)&&n.from.type!=="mirror"&&ie(n.to)&&n.to.type==="vault"}function xn(e,t=Date.now()){let n=e?.integration;if(!n)return{state:"none"};if(Date.parse(n.expiresAt)<=t)return{state:"expired",integration:n};if(n.status==="consented"&&n.handoverAppliedAt&&e.configLocator)return{state:"integrated",integration:n};return{state:n.status,integration:n}}class ae{constructor(){this.tenants=new Map;this.integrationHandles=new Map}async get(e){return this.tenants.get(e)}async list(e){let t=Array.from(this.tenants.values()),n=Math.max(0,e?.start??0),s=e?.limit,r=t.length,i=s!=null?n+s:void 0,o=t.slice(n,i);return w(r,o,n,s)}async upsert(e){let t=this.tenants.get(e.id);if(t?.integration?.handleHash!==e.integration?.handleHash){if(t?.integration)this.integrationHandles.delete(t.integration.handleHash);if(e.integration){let n=this.integrationHandles.get(e.integration.handleHash);if(n&&n!==e.id)throw Error("Integration handle hash is already in use");this.integrationHandles.set(e.integration.handleHash,e.id)}}return this.tenants.set(e.id,e),e}async delete(e){let t=this.tenants.get(e),n=t!==void 0;if(t?.integration)this.integrationHandles.delete(t.integration.handleHash);return this.tenants.delete(e),n?1:0}async setIntegration(e,t,n){let s=this.tenants.get(e);if(!s)return;let r=s.integration?.handleHash;if(n?.expectedHandleHash!==void 0&&(n.expectedHandleHash===null?r!==void 0:r!==n.expectedHandleHash))return;if(n?.expectedVersion!==void 0&&s.integration?.version!==n.expectedVersion)return;if(P(s.integration,t))return s;if(t){let o=this.integrationHandles.get(t.handleHash);if(o&&o!==e)throw Error("Integration handle hash is already in use")}if(s.integration)this.integrationHandles.delete(s.integration.handleHash);if(t)this.integrationHandles.set(t.handleHash,e);let i={...s,integration:t,updatedAt:new Date};return this.tenants.set(e,i),i}async getByIntegrationHandleHash(e){let t=this.integrationHandles.get(e);return t?this.tenants.get(t):void 0}}class Ue{constructor(e={}){this.ionCache=e.ionCache,this.store=new ae}async get(e){return this.store.get(e)}async list(e){return this.store.list(e)}async upsert(e){let t=await this.store.upsert(e);return this.ionCache?.delete(e.id),t}async delete(e){let t=await this.store.delete(e);return this.ionCache?.delete(e),t}async getIon(e){if(!this.ionCache)throw Error(`${this.constructor.name}.getIon() requires an app-owned ionCache. Pass { ionCache } (an lru-cache instance whose fetchMethod builds the tenant Ionite and whose dispose `+"closes it) — the SDK does not cache tenant runtimes. See the multi-tenant docs.");return this.ionCache.fetch(e)}async setIntegration(e,t,n){return this.store.setIntegration(e,t,n)}async getByIntegrationHandleHash(e){return this.store.getByIntegrationHandleHash(e)}}function Le(e,t,n){return(async()=>{try{let s=await fetch(e,{method:"POST",headers:{...L,...K},body:JSON.stringify(t)});if(!s.ok)n.error("Failed to send webhook update",{"ion.operation":"webhook.update","ion.outcome":"failure",status:s.status,statusText:s.statusText})}catch(s){n.error("Failed to send webhook update",{"ion.operation":"webhook.update","ion.outcome":"failure"},s)}})()}async function Sn(e,t,n){return Le(e,t,n)}var Rn="urn:ionite:scim:schemas:extension:ion:2.0:User",En="urn:ionite:scim:schemas:core:2.0:Workload",kn="urn:ionite:scim:schemas:core:2.0:Customer";function c(e,t,n,s,r){if(e===void 0||e===null){if(n)s.push({message:`${t} is required`,path:r});return}if(typeof e!=="string"){s.push({message:`${t} must be a string`,path:r});return}return e}function k(e,t,n,s){if(e===void 0||e===null)return;if(typeof e!=="boolean"){n.push({message:`${t} must be a boolean`,path:s});return}return e}function $e(e,t,n){if(e===void 0||e===null)return;if(typeof e!=="object"||e===null){t.push({message:"name must be an object",path:n});return}let s=e,r={};return r.formatted=c(s.formatted,"formatted",!1,t,[...n,"formatted"]),r.familyName=c(s.familyName,"familyName",!1,t,[...n,"familyName"]),r.givenName=c(s.givenName,"givenName",!1,t,[...n,"givenName"]),r.middleName=c(s.middleName,"middleName",!1,t,[...n,"middleName"]),r.honorificPrefix=c(s.honorificPrefix,"honorificPrefix",!1,t,[...n,"honorificPrefix"]),r.honorificSuffix=c(s.honorificSuffix,"honorificSuffix",!1,t,[...n,"honorificSuffix"]),r}function Ke(e,t,n){if(e===void 0||e===null)return;if(!Array.isArray(e)){t.push({message:"emails must be an array",path:n});return}let s=[];for(let r=0;r<e.length;r++){let i=e[r],o=[...n,r];if(typeof i!=="object"||i===null){t.push({message:"email must be an object",path:o});continue}let a=i,g=c(a.value,"value",!0,t,[...o,"value"]);if(g)s.push({value:g,display:c(a.display,"display",!1,t,[...o,"display"]),type:c(a.type,"type",!1,t,[...o,"type"]),primary:k(a.primary,"primary",t,[...o,"primary"])})}return s.length>0?s:void 0}function Be(e,t,n){if(e===void 0||e===null)return;if(!Array.isArray(e)){t.push({message:"phoneNumbers must be an array",path:n});return}let s=[];for(let r=0;r<e.length;r++){let i=e[r],o=[...n,r];if(typeof i!=="object"||i===null){t.push({message:"phoneNumber must be an object",path:o});continue}let a=i,g=c(a.value,"value",!0,t,[...o,"value"]);if(g)s.push({value:g,display:c(a.display,"display",!1,t,[...o,"display"]),type:c(a.type,"type",!1,t,[...o,"type"]),primary:k(a.primary,"primary",t,[...o,"primary"])})}return s.length>0?s:void 0}function Ge(e,t,n){if(e===void 0||e===null)return;if(!Array.isArray(e)){t.push({message:"addresses must be an array",path:n});return}let s=[];for(let r=0;r<e.length;r++){let i=e[r],o=[...n,r];if(typeof i!=="object"||i===null){t.push({message:"address must be an object",path:o});continue}let a=i;s.push({formatted:c(a.formatted,"formatted",!1,t,[...o,"formatted"]),streetAddress:c(a.streetAddress,"streetAddress",!1,t,[...o,"streetAddress"]),locality:c(a.locality,"locality",!1,t,[...o,"locality"]),region:c(a.region,"region",!1,t,[...o,"region"]),postalCode:c(a.postalCode,"postalCode",!1,t,[...o,"postalCode"]),country:c(a.country,"country",!1,t,[...o,"country"]),type:c(a.type,"type",!1,t,[...o,"type"]),primary:k(a.primary,"primary",t,[...o,"primary"])})}return s.length>0?s:void 0}function qe(e,t,n){if(e===void 0||e===null)return;if(!Array.isArray(e)){t.push({message:"groups must be an array",path:n});return}let s=[];for(let r=0;r<e.length;r++){let i=e[r],o=[...n,r];if(typeof i!=="object"||i===null){t.push({message:"group must be an object",path:o});continue}let a=i,g=c(a.value,"value",!0,t,[...o,"value"]);if(g)s.push({value:g,$ref:c(a.$ref,"$ref",!1,t,[...o,"$ref"]),display:c(a.display,"display",!1,t,[...o,"display"]),type:c(a.type,"type",!1,t,[...o,"type"])})}return s.length>0?s:void 0}function Ve(e,t,n){if(e===void 0||e===null)return;if(!Array.isArray(e)){t.push({message:"roles must be an array",path:n});return}let s=[];for(let r=0;r<e.length;r++){let i=e[r],o=[...n,r];if(typeof i!=="object"||i===null){t.push({message:"role must be an object",path:o});continue}let a=i,g=c(a.value,"value",!0,t,[...o,"value"]);if(g)s.push({value:g,display:c(a.display,"display",!1,t,[...o,"display"]),type:c(a.type,"type",!1,t,[...o,"type"]),primary:k(a.primary,"primary",t,[...o,"primary"])})}return s.length>0?s:void 0}function ze(e,t,n){if(e===void 0||e===null)return;if(typeof e!=="object"||e===null){t.push({message:"Enterprise User extension must be an object",path:n});return}let s=e,r={};if(r.employeeNumber=c(s.employeeNumber,"employeeNumber",!1,t,[...n,"employeeNumber"]),r.costCenter=c(s.costCenter,"costCenter",!1,t,[...n,"costCenter"]),r.organization=c(s.organization,"organization",!1,t,[...n,"organization"]),r.division=c(s.division,"division",!1,t,[...n,"division"]),r.department=c(s.department,"department",!1,t,[...n,"department"]),s.manager!==void 0&&s.manager!==null)if(typeof s.manager!=="object"||s.manager===null)t.push({message:"manager must be an object",path:[...n,"manager"]});else{let i=s.manager;r.manager={value:c(i.value,"value",!1,t,[...n,"manager","value"]),$ref:c(i.$ref,"$ref",!1,t,[...n,"manager","$ref"]),displayName:c(i.displayName,"displayName",!1,t,[...n,"manager","displayName"])}}return r}function In(e){return{"~standard":{version:1,vendor:e,validate:(t)=>{if(typeof t!=="object"||t===null)return{issues:[{message:"Expected an object"}]};let n=t,s=[],r={},i=c(n.userName,"userName",!0,s,["userName"]);if(!i)return{issues:s};if(r.userName=i,r.id=c(n.id,"id",!1,s,["id"]),r.externalId=c(n.externalId,"externalId",!1,s,["externalId"]),r.displayName=c(n.displayName,"displayName",!1,s,["displayName"]),r.nickName=c(n.nickName,"nickName",!1,s,["nickName"]),r.profileUrl=c(n.profileUrl,"profileUrl",!1,s,["profileUrl"]),r.title=c(n.title,"title",!1,s,["title"]),r.userType=c(n.userType,"userType",!1,s,["userType"]),r.preferredLanguage=c(n.preferredLanguage,"preferredLanguage",!1,s,["preferredLanguage"]),r.locale=c(n.locale,"locale",!1,s,["locale"]),r.timezone=c(n.timezone,"timezone",!1,s,["timezone"]),n.password!==void 0)s.push({message:"password is not supported: the SDK does not accept credentials via SCIM",path:["password"]});r.active=k(n.active,"active",s,["active"]),r.name=$e(n.name,s,["name"]),r.emails=Ke(n.emails,s,["emails"]),r.phoneNumbers=Be(n.phoneNumbers,s,["phoneNumbers"]),r.addresses=Ge(n.addresses,s,["addresses"]),r.groups=qe(n.groups,s,["groups"]),r.roles=Ve(n.roles,s,["roles"]);let o="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(n[o]!==void 0)r[o]=ze(n[o],s,[o]);if(n.schemas!==void 0)if(Array.isArray(n.schemas))r.schemas=n.schemas.filter((a)=>typeof a==="string");else s.push({message:"schemas must be an array",path:["schemas"]});if(n.meta!==void 0)if(typeof n.meta==="object"&&n.meta!==null){let a=n.meta;r.meta={resourceType:typeof a.resourceType==="string"?a.resourceType:void 0,created:typeof a.created==="string"?a.created:void 0,lastModified:typeof a.lastModified==="string"?a.lastModified:void 0,location:typeof a.location==="string"?a.location:void 0,version:typeof a.version==="string"?a.version:void 0}}else s.push({message:"meta must be an object",path:["meta"]});if(s.length>0)return{issues:s};return{value:r}}}}}function Fe(e,t,n){if(e===void 0||e===null)return;if(!Array.isArray(e)){t.push({message:"members must be an array",path:n});return}let s=[];for(let r=0;r<e.length;r++){let i=e[r],o=[...n,r];if(typeof i!=="object"||i===null){t.push({message:"member must be an object",path:o});continue}let a=i,g=c(a.value,"value",!0,t,[...o,"value"]);if(g){let f=c(a.type,"type",!1,t,[...o,"type"]);if(f!==void 0&&f!=="User"&&f!=="Group"&&f!=="Workload"&&f!=="Customer")t.push({message:"type must be 'User', 'Group', 'Workload', or 'Customer'",path:[...o,"type"]});s.push({value:g,$ref:c(a.$ref,"$ref",!1,t,[...o,"$ref"]),display:c(a.display,"display",!1,t,[...o,"display"]),type:f==="User"||f==="Group"||f==="Workload"||f==="Customer"?f:void 0})}}return s.length>0?s:void 0}function wn(e){return{"~standard":{version:1,vendor:e,validate:(t)=>{if(typeof t!=="object"||t===null)return{issues:[{message:"Expected an object"}]};let n=t,s=[],r={},i=c(n.displayName,"displayName",!0,s,["displayName"]);if(!i)return{issues:s};if(r.displayName=i,r.id=c(n.id,"id",!1,s,["id"]),r.externalId=c(n.externalId,"externalId",!1,s,["externalId"]),r.members=Fe(n.members,s,["members"]),n.schemas!==void 0)if(Array.isArray(n.schemas))r.schemas=n.schemas.filter((o)=>typeof o==="string");else s.push({message:"schemas must be an array",path:["schemas"]});if(n.meta!==void 0)if(typeof n.meta==="object"&&n.meta!==null){let o=n.meta;r.meta={resourceType:typeof o.resourceType==="string"?o.resourceType:void 0,created:typeof o.created==="string"?o.created:void 0,lastModified:typeof o.lastModified==="string"?o.lastModified:void 0,location:typeof o.location==="string"?o.location:void 0,version:typeof o.version==="string"?o.version:void 0}}else s.push({message:"meta must be an object",path:["meta"]});if(s.length>0)return{issues:s};return{value:r}}}}}function ce(e,t){if(e===void 0)return;if(typeof e!=="object"||e===null){t.push({message:"meta must be an object",path:["meta"]});return}let n=e;return{resourceType:typeof n.resourceType==="string"?n.resourceType:void 0,created:typeof n.created==="string"?n.created:void 0,lastModified:typeof n.lastModified==="string"?n.lastModified:void 0,location:typeof n.location==="string"?n.location:void 0,version:typeof n.version==="string"?n.version:void 0}}function ue(e,t){if(e===void 0)return;if(!Array.isArray(e)){t.push({message:"schemas must be an array",path:["schemas"]});return}return e.filter((n)=>typeof n==="string")}function de(e,t){if(e===void 0)return;if(typeof e!=="object"||e===null||Array.isArray(e)){t.push({message:"attributes must be an object",path:["attributes"]});return}return{...e}}var Pn={"~standard":{version:1,vendor:"ionite",validate:(e)=>{let t=[];if(typeof e!=="object"||e===null)return{issues:[{message:"Workload must be an object"}]};let n=e,s={schemas:ue(n.schemas,t),id:c(n.id,"id",!1,t,["id"]),externalId:c(n.externalId,"externalId",!1,t,["externalId"]),userName:c(n.userName,"userName",!1,t,["userName"]),displayName:c(n.displayName,"displayName",!1,t,["displayName"]),description:c(n.description,"description",!1,t,["description"]),active:typeof n.active==="boolean"?n.active:void 0,providerId:c(n.providerId,"providerId",!1,t,["providerId"]),requestUrl:c(n.requestUrl,"requestUrl",!1,t,["requestUrl"]),attributes:de(n.attributes,t),meta:ce(n.meta,t)};if(t.length>0)return{issues:t};return{value:s}}}},_n={"~standard":{version:1,vendor:"ionite",validate:(e)=>{let t=[];if(typeof e!=="object"||e===null)return{issues:[{message:"Customer must be an object"}]};let n=e,s=n.emails,r;if(s!==void 0)if(!Array.isArray(s))t.push({message:"emails must be an array",path:["emails"]});else r=s.filter((o)=>typeof o==="object"&&o!==null&&typeof o.value==="string");let i={schemas:ue(n.schemas,t),id:c(n.id,"id",!1,t,["id"]),externalId:c(n.externalId,"externalId",!1,t,["externalId"]),userName:c(n.userName,"userName",!1,t,["userName"]),displayName:c(n.displayName,"displayName",!1,t,["displayName"]),active:typeof n.active==="boolean"?n.active:void 0,emails:r,providerId:c(n.providerId,"providerId",!1,t,["providerId"]),requestUrl:c(n.requestUrl,"requestUrl",!1,t,["requestUrl"]),attributes:de(n.attributes,t),meta:ce(n.meta,t)};if(t.length>0)return{issues:t};return{value:i}}}};
-export{We as a,Ye as b,V as c,Je as d,Xe as e,Ze as f,Qe as g,w as h,C as i,tt as j,st as k,rt as l,it as m,_ as n,z as o,j as p,F as q,fe as r,dt as s,me as t,pt as u,lt as v,S as w,ft as x,gt as y,mt as z,A,H as B,Te as C,he as D,At as E,xt as F,Ct as G,Rt as H,Et as I,kt as J,It as K,wt as L,Pt as M,_t as N,jt as O,ee as P,te as Q,vt as R,Ot as S,xe as T,Se as U,Nt as V,Dt as W,Ce as X,Mt as Y,Lt as Z,E as _,ke as $,$t as aa,Kt as ba,Bt as ca,qt as da,Vt as ea,se as fa,Ft as ga,Wt as ha,Yt as ia,Ht as ja,Jt as ka,L as la,Xt as ma,Zt as na,Qt as oa,K as pa,en as qa,tn as ra,nn as sa,sn as ta,Ie as ua,Pe as va,_e as wa,re as xa,rn as ya,on as za,an as Aa,je as Ba,cn as Ca,un as Da,P as Ea,dn as Fa,pn as Ga,De as Ha,mn as Ia,B as Ja,Tn as Ka,oe as La,ie as Ma,xn as Na,Ue as Oa,Sn as Pa,Rn as Qa,En as Ra,kn as Sa,In as Ta,wn as Ua,Pn as Va,_n as Wa};