@ionite/core 0.0.24-beta.20261006.21 → 0.0.24-beta.20261007.23

package/dist/shared/core-y6y95p25.js

@@ -0,0 +1,4 @@
+function Gt(ut){if(ut===void 0||ut===null)return[];return Array.isArray(ut)?ut:[ut]}function Kt(ut){if(typeof ut!=="string")return;return ut.endsWith("/")?ut.slice(0,-1):ut}function nn(ut,dt){if(Kt(dt.issuer)!==Kt(ut.claims?.iss))return!1;let pt=Gt(dt.audience);if(pt.length===0)return!1;let lt=Gt(ut.claims?.aud),mt=typeof ut.claims?.azp==="string"?ut.claims.azp:void 0;if(!(pt.some((yt)=>lt.includes(yt))||(mt?pt.includes(mt):!1)))return!1;let gt=ut.clientId??ut.workloadId??ut.claims?.sub;return dt.clientId===gt}function Y(ut,dt){let pt=ut?.trustedProvisioningClients;if(!pt?.length)return;let lt=new Set;for(let mt of pt){if(!nn(dt,mt))continue;for(let ft of mt.permissions??[])lt.add(ft)}return lt.size>0?lt:void 0}function Le(ut){let dt=ut?.trustedProvisioningClients;if(!dt?.length)return[];let pt=[];for(let lt of dt)for(let mt of lt.permissions??[])pt.push({subject:lt.clientId,subjectType:"workload",targetType:"permission",target:mt,status:"active",provenance:{source:"eci-trusted",actor:lt.clientId}});return pt}var l=["id","name","displayName","description","providerId","source","deprecated","type","parent","resources","assignableSubjectTypes","recommendedSubjectTypes","requestable","riskLevel","requestUrl","action","permissionTypes","resourceTypes","applyToSubResources","permissions","groups","roles"],I=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","ecid","accountClass","displayName","scimName","emails","nickName","active","title","preferredLanguage","locale","timezone","phoneNumbers","ims","photos","addresses","roles","groups","entitlements","x509Certificates","scimEnterprise","scimSchemaExtensions","createdAt","updatedAt","sso"],v=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","displayName","emails","phoneNumbers","active","createdAt","updatedAt","ciam"],x=["id","clientId","displayName","description","externalId","providerId","requestUrl","ecid","active","scopes","createdAt","updatedAt","metadata"];function i(ut,dt){let pt=new Set(dt),lt=Object.fromEntries(Object.entries(ut).filter(([mt,ft])=>!pt.has(mt)&&ft!==void 0));return Object.keys(lt).length>0?lt:void 0}var $t=new WeakSet;function Bt(ut,dt){Object.defineProperty(ut,"log",{value:dt,enumerable:!1,writable:!0,configurable:!0})}class r extends Error{constructor(ut,dt={}){super(ut,{cause:dt.cause});this.name=new.target.name,this._tag=new.target.name,this.status=dt.status??500,this.upstreamStatus=dt.upstreamStatus,this.statusText=dt.statusText,this.detail=dt.detail,this.ionId=dt.ionId,Bt(this,dt.log),Object.setPrototypeOf(this,new.target.prototype)}attachContext(ut){if(this.ionId===void 0&&ut.ionId!==void 0)this.ionId=ut.ionId;if(this.log===void 0&&ut.log!==void 0)Bt(this,ut.log);return this}safeBody(){return{}}toLogAttributes(){let ut=$t.has(this)&&this.cause instanceof Error?this.cause:this;return{"exception.type":ut.name,"exception.message":ut.message,...ut.stack?{"exception.stacktrace":ut.stack}:{},...this.ionId!==void 0?{"ion.id":this.ionId}:{},"http.status_code":this.status,...this.upstreamStatus!==void 0?{"ion.upstream.status":this.upstreamStatus}:{}}}response(ut){let dt=ut?.headers.get("accept")??"";if(dt.includes("text/html")&&!dt.includes("application/json")){let pt=this.statusText?this.detail??this.statusText:"Internal Server Error";return new Response(pt,{status:this.status,headers:{"content-type":"text/plain; charset=utf-8"}})}if(!this.statusText)return Response.json({error:"internal_error"},{status:this.status});return Response.json({error:this.statusText,...this.detail!==void 0?{detail:this.detail}:{},...this.safeBody()},{status:this.status})}toJSON(){return{name:this.name,_tag:this._tag,status:this.status,...this.statusText!==void 0?{statusText:this.statusText}:{},...this.detail!==void 0?{detail:this.detail}:{},...this.ionId!==void 0?{ionId:this.ionId}:{}}}static from(ut,dt){if(ut instanceof r){if(dt)ut.attachContext(dt);return ut}let pt=ut instanceof Error?ut.message:"internal_error",lt=new r(pt,{status:500,cause:ut,ionId:dt?.ionId,log:dt?.log});return $t.add(lt),lt}}function X(ut){if(!ut||typeof ut!=="object")return;let dt=ut.toLogAttributes;if(typeof dt!=="function")return;let pt=dt.call(ut);if(!pt||typeof pt!=="object")return;return pt}function N(ut,dt,pt,lt){let mt=dt.length,ft=lt??ut,gt=ft>0?Math.floor(pt/ft)+1:1,yt=ft>0?Math.ceil(ut/ft):0;return{total:ut,count:mt,items:dt,size:ft,page:gt,pages:yt}}async function*u(ut,dt,pt=1000){let lt=0;while(!0){let mt=await ut(lt,pt);if(mt.items.length===0)break;for(let ft of mt.items)yield(dt?await dt(ft):ft)??ft;if(mt.items.length<pt||lt+mt.items.length>=mt.total)break;lt+=pt}}function $e(ut,dt){if(!dt)return!0;if(dt.requestable!==void 0&&Boolean(ut.requestable)!==dt.requestable)return!1;if(dt.userName!==void 0){if((ut.userName??ut.clientId)!==dt.userName)return!1}if(dt.externalId!==void 0&&ut.externalId!==dt.externalId)return!1;if(dt.updatedAfter!==void 0){if(!(ut.updatedAt instanceof Date))return!1;let pt=dt.updatedAfter instanceof Date?dt.updatedAfter:new Date(dt.updatedAfter);if(Number.isNaN(pt.getTime())||ut.updatedAt<=pt)return!1}return!0}var Z=["basic","elevated","privileged","admin"],g="basic",e="urn:ionite:params:scim:schemas:extension:authz:2.0:Group",y=["user","workload","customer"];function E(ut){let{assignableSubjectTypes:dt,recommendedSubjectTypes:pt}=ut,lt=ut.id?` for "${ut.id}"`:"";if(!dt||dt.length===0)throw Error(`assignableSubjectTypes${lt} is required and must be a non-empty subset of [${y.join(", ")}]`);let mt=dt.filter((ft)=>!y.includes(ft));if(mt.length>0)throw Error(`assignableSubjectTypes${lt} contains values outside the platform ceiling [${y.join(", ")}]: ${mt.join(", ")}`);if(pt){let ft=pt.filter((gt)=>!dt.includes(gt));if(ft.length>0)throw Error(`recommendedSubjectTypes${lt} must be a subset of assignableSubjectTypes; offending values: ${ft.join(", ")}`)}}function Q(ut,dt="subjectType"){if(ut!=="user"&&ut!=="customer"&&ut!=="workload")throw Error(`${dt} is required and must be one of [user, customer, workload]; got ${ut===void 0?"undefined":JSON.stringify(ut)}`)}class Ee extends r{constructor(ut,dt,pt){super(ut,{status:403,statusText:"assignment_forbidden"});this.policy=dt,this.requestUrl=pt}safeBody(){return{policy:this.policy,...this.requestUrl?{requestUrl:this.requestUrl}:{}}}toLogAttributes(){return{...super.toLogAttributes(),"authz.assignment_policy":this.policy,...this.requestUrl?{"authz.request_url":this.requestUrl}:{}}}}function Pe(ut){return typeof ut.groups?.get==="function"}function Ke(ut){return Pe(ut)?ut:Ue(ut)}class _t extends r{constructor(ut){super(`defineCatalog: ${ut}`,{status:500})}}function zt(ut){return typeof ut==="string"?ut:ut.id}function sn(ut){for(let dt of Object.values(ut))if(Array.isArray(dt))Object.freeze(dt);Object.freeze(ut)}function Nt(ut,dt){try{E(dt)}catch(pt){throw new _t(`${ut} "${dt.id}": ${pt instanceof Error?pt.message:String(pt)}`)}}function Dt(ut){let dt=new Map(ut.map((lt)=>[lt.id,lt])),pt=Object.freeze([...ut]);return Object.freeze({get:(lt)=>dt.get(lt),list:()=>pt})}function Ue(ut){let dt=ut.groups??[],pt=ut.roles??[],lt=ut.permissions??[],mt=new Map,ft=(ht,xt)=>{for(let bt of xt){if(!bt.id)throw new _t(`a ${ht} is missing its required "id".`);let At=mt.get(bt.id);if(At)throw new _t(`duplicate id "${bt.id}" (declared as both ${At} and ${ht}).`);mt.set(bt.id,ht)}};ft("group",dt),ft("role",pt),ft("permission",lt);let gt=(ht,xt,bt,At)=>{let It=zt(At),Ct=mt.get(It);if(Ct===void 0)throw new _t(`${ht} "${xt}" references ${bt} "${It}", which is not declared in the catalog.`);if(Ct!==bt)throw new _t(`${ht} "${xt}" references "${It}" as a ${bt}, but it is a ${Ct}.`)};for(let ht of pt){Nt("role",ht);for(let xt of ht.permissions??[])gt("role",ht.id,"permission",xt)}for(let ht of lt)Nt("permission",ht);for(let ht of dt){Nt("group",ht);for(let xt of ht.groups??[])gt("group",ht.id,"group",xt);for(let xt of ht.roles??[])gt("group",ht.id,"role",xt);for(let xt of ht.permissions??[])gt("group",ht.id,"permission",xt)}let yt=new Map(dt.map((ht)=>[ht.id,ht])),Rt=new Map,St=(ht,xt)=>{let bt=Rt.get(ht);if(bt==="done")return;if(bt==="visiting")throw new _t(`group composition cycle: ${[...xt,ht].join(" -> ")}.`);Rt.set(ht,"visiting");for(let At of yt.get(ht)?.groups??[])St(zt(At),[...xt,ht]);Rt.set(ht,"done")};for(let ht of dt)St(ht.id,[]);for(let ht of[...dt,...pt,...lt])sn(ht);return Object.freeze({groups:Dt(dt),roles:Dt(pt),permissions:Dt(lt)})}function L(ut,dt){let pt=ut?.groups.get(dt);if(pt)return{entity:pt,kind:"group"};let lt=ut?.roles.get(dt);if(lt)return{entity:lt,kind:"role"};let mt=ut?.permissions.get(dt);return mt?{entity:mt,kind:"permission"}:void 0}function K(ut,dt){return dt==="group"?ut.groups:dt==="role"?ut.roles:ut.permissions}function T(ut,dt,pt){let lt={...dt,...pt,id:dt.id,requestable:dt.requestable,source:pt.source??"code",assignableSubjectTypes:dt.assignableSubjectTypes,recommendedSubjectTypes:dt.recommendedSubjectTypes};if(ut==="group"){let ft=dt;return{...lt,groups:ft.groups,roles:ft.roles,permissions:ft.permissions,resources:ft.resources}}if(ut==="role")return{...lt,permissions:dt.permissions};let mt=dt;return{...lt,action:mt.action,permissionTypes:mt.permissionTypes,resourceTypes:mt.resourceTypes,applyToSubResources:mt.applyToSubResources}}async function q(ut,dt,pt){let lt=await pt.get(dt.id);if(lt)return T(ut,dt,lt);let mt=Object.entries(dt).filter(([xt])=>l.includes(xt)),{riskLevel:ft,displayName:gt,...yt}=Object.fromEntries(mt),Rt={...yt,source:"code"},St=pt.insertIfAbsent(Rt);await St.ready();let ht=await pt.get(dt.id)??St;return T(ut,dt,ht)}async function ee(ut,dt,pt){let lt=async(mt,ft)=>{let gt=pt?[await mt.get(pt)].filter((yt)=>yt!==void 0):u((yt,Rt)=>mt.list({start:yt,limit:Rt}));for await(let yt of gt){if(yt.source!=="code"||yt.deprecated===!0||ft?.get(yt.id))continue;await mt.set({...yt,deprecated:!0}).ready()}};await lt(dt.groups,ut?.groups),await lt(dt.roles,ut?.roles),await lt(dt.permissions,ut?.permissions)}function Mt(ut,dt,pt){let lt=()=>{if(!pt)throw Error(`Cannot write ${ut} definitions: no AccessCatalogStore is wired (the code-declared catalog is read-only).`);return pt};return{async get(ft){let gt=dt.get(ft);if(!pt)return gt;let yt=await pt.get(ft);return yt&&gt?T(ut,gt,yt):yt??gt},set(ft){return lt().set(ft)},insertIfAbsent(ft){return lt().insertIfAbsent(ft)},async delete(ft){await lt().delete(ft)},async list(ft){let gt=Math.max(0,ft?.start??0),yt=ft?.limit,Rt=ft?.filter?.requestable,St=[];if(pt)for await(let At of u((It,Ct)=>pt.list({start:It,limit:Ct})))St.push(At);let ht=new Map(St.map((At)=>[At.id,At])),xt=[...dt.list().map((At)=>{let It=ht.get(At.id);return It?T(ut,At,It):At}),...St.filter((At)=>!dt.get(At.id))].filter((At)=>Rt===void 0||Boolean(At.requestable)===Rt),bt=yt!=null?gt+yt:void 0;return N(xt.length,xt.slice(gt,bt),gt,yt)}}}function W(ut,dt){if(!ut)return dt;return{groups:Mt("group",ut.groups,dt?.groups),roles:Mt("role",ut.roles,dt?.roles),permissions:Mt("permission",ut.permissions,dt?.permissions),afterChange:dt?.afterChange?.bind(dt)}}function n(ut){if(typeof ut==="string")return ut.trim();if(ut&&typeof ut==="object"){let dt=ut;for(let pt of["id","value","name","displayName"]){let lt=dt[pt];if(typeof lt==="string"&&lt.trim())return lt.trim()}}return""}function m(ut){let dt=n(ut.subject),pt=n(ut.target);if(!dt)throw Error("Access change subject must resolve to a non-empty id.");if(!ut.targetType)throw Error("Access change targetType is required.");if(!pt)throw Error("Access change target must resolve to a non-empty id.");let lt=(ut.resources??[]).map((ft)=>ft.trim()).filter(Boolean),mt=!ut.applyToApplication&&lt.length>0?[...lt].sort().join(","):"app";return Q(ut.subjectType,"Access change subjectType"),`${ut.subjectType}:${dt}:${ut.targetType}:${pt}:${mt}`}function rn(ut){let dt=(ut.resources??[]).map((pt)=>pt.trim()).filter(Boolean);if(ut.applyToApplication||dt.length===0)return[void 0];return dt}async function Wt(ut,dt,pt,lt,mt){if(lt==="resource")return pt?.get(mt);let ft=dt?lt==="group"?dt.groups.get(mt):lt==="role"?dt.roles.get(mt):dt.permissions.get(mt):void 0;if(ut){let yt=await(lt==="group"?ut.groups:lt==="role"?ut.roles:ut.permissions).get(mt);if(yt)return ft?T(lt,ft,yt):yt}return ft}class te{constructor(ut,dt,pt){this.catalog=ut;this.resources=dt;this.code=pt;this.nodes=new Map;this.subResources=new Map;this.children=new Map}getNode(ut,dt){let pt=`${ut}:${dt}`,lt=this.nodes.get(pt);if(!lt)lt=Wt(this.catalog,this.code,this.resources,ut,dt),this.nodes.set(pt,lt);return lt}resourceChildren(ut){let dt=this.children.get(ut);if(!dt)dt=Ft(ut,this.view()),this.children.set(ut,dt);return dt}resourceAndSubResourceIds(ut){let dt=this.subResources.get(ut);if(!dt)dt=Ht(ut,this.view()),this.subResources.set(ut,dt);return dt}view(){return{catalog:this.catalog,code:this.code,resources:this.resources,cache:this}}invalidate(ut){this.clear()}clear(){this.nodes.clear(),this.subResources.clear(),this.children.clear()}}async function jt(ut,dt,pt){if(ut.cache)return ut.cache.getNode(dt,pt);return Wt(ut.catalog,ut.code,ut.resources,dt,pt)}async function Vt(ut,dt){if(typeof ut!=="string")return ut;return jt(dt,"resource",ut)}async function Ft(ut,dt){if(dt.resources?.children)return dt.resources.children(ut);let pt=await Vt(ut,dt),lt=[];for(let mt of pt?.resources??[]){let ft=await Vt(mt,dt);if(ft)lt.push(ft);else if(typeof mt==="string"&&mt.trim())lt.push({id:mt.trim()})}return lt}async function Yt(ut,dt){if(dt.cache)return dt.cache.resourceChildren(ut);return Ft(ut,dt)}async function Ht(ut,dt){let pt=[],lt=new Set,mt=async(ft)=>{if(!ft||lt.has(ft))return;lt.add(ft),pt.push(ft);for(let gt of await Yt(ft,dt))await mt(n(gt))};return await mt(n(ut)),pt}async function P(ut,dt){let pt=ut.id??m(ut),lt=n(ut.subject);if(!lt)throw Error("Access change subject must resolve to a non-empty id.");Q(ut.subjectType,"Access change subjectType");let mt=ut.subjectType,ft=rn(ut),gt=[],yt=new Set,Rt=new Set,St=(bt,At,It)=>{if(!At)return;let Ct=`${bt}:${At}:${It??""}`;if(yt.has(Ct))return;yt.add(Ct),gt.push({subject:lt,subjectType:mt,targetType:bt,target:At,resource:It,rootId:pt})},ht=async(bt,At,It)=>{for(let Ct of ft)if(bt==="permission"&&It?.applyToSubResources&&Ct){let Pt=dt.cache?await dt.cache.resourceAndSubResourceIds(Ct):await Ht(Ct,dt);for(let kt of Pt)St("permission",At,kt)}else St(bt,At,Ct)},xt=async(bt,At)=>{let It=n(At);if(!It)return;let Ct=`${bt}:${It}`;if(Rt.has(Ct))return;if(Rt.add(Ct),bt==="group"){let kt=typeof At==="string"?await jt(dt,"group",It):At;await ht("group",It,void 0);for(let Et of kt?.groups??[])await xt("group",Et);for(let Et of kt?.roles??[])await xt("role",Et);for(let Et of kt?.permissions??[])await xt("permission",Et);return}if(bt==="role"){let kt=typeof At==="string"?await jt(dt,"role",It):At;await ht("role",It,void 0);for(let Et of kt?.permissions??[])await xt("permission",Et);return}let Pt=typeof At==="string"?await jt(dt,"permission",It):At;await ht("permission",It,Pt)};return await xt(ut.targetType,ut.target),gt}async function me(ut,dt,pt,lt){let{accessStore:mt,accessIndex:ft,catalogStore:gt,code:yt,resources:Rt}=pt;if(!ft||!gt&&!yt)return 0;if(!mt)return await ft.replaceSubject(ut,dt,[]),0;let St={catalog:gt,code:yt,resources:Rt,cache:lt},ht=[],xt=0;for await(let bt of u((At,It)=>mt.listBySubject(ut,dt,{start:At,limit:It}))){let At=bt.id??m(bt),It=await P({...bt,id:At},St);ht.push(...It),xt+=1}return await ft.replaceSubject(ut,dt,ht),xt}async function qe(ut,dt,pt){let lt=new Map,mt=new Map,ft=new Map,gt=new Map,yt=new Set,Rt=(xt,bt)=>jt(pt,xt,bt),St=async(xt)=>{let bt=n(xt);if(!bt||gt.has(bt))return;let At=typeof xt==="string"?await Rt("resource",bt):xt;if(!At)return;gt.set(bt,At);let It=At.resources??(At.id?await Yt(At.id,pt):[]);for(let Ct of It)await St(Ct)},ht=async(xt,bt)=>{let At=n(bt);if(!At)return;let It=`${xt}:${At}`;if(yt.has(It))return;if(yt.add(It),xt==="group"){let Pt=typeof bt==="string"?await Rt("group",At):bt;if(!Pt)return;lt.set(At,Pt);for(let kt of Pt.groups??[])await ht("group",kt);for(let kt of Pt.roles??[])await ht("role",kt);for(let kt of Pt.permissions??[])await ht("permission",kt);for(let kt of Pt.resources??[])await St(kt);return}if(xt==="role"){let Pt=typeof bt==="string"?await Rt("role",At):bt;if(!Pt)return;mt.set(At,Pt);for(let kt of Pt.permissions??[])await ht("permission",kt);return}let Ct=typeof bt==="string"?await Rt("permission",At):bt;if(!Ct)return;ft.set(At,Ct)};if(yt.add(`${dt}:${n(ut)}`),dt==="group"){let xt=ut;for(let bt of xt.groups??[])await ht("group",bt);for(let bt of xt.roles??[])await ht("role",bt);for(let bt of xt.permissions??[])await ht("permission",bt);for(let bt of xt.resources??[])await St(bt)}else{let xt=ut;for(let bt of xt.permissions??[])await ht("permission",bt)}return{groups:[...lt.values()],roles:[...mt.values()],permissions:[...ft.values()],resources:[...gt.values()]}}var We=".profile",V=1,Ve=10,ze=10,Be=14400,ne="ion.discovered",on=new Set(["sid","sub","tokens","access_token","id_token","refresh_token","accessClaims","roles","groups","permissions","grants"]);function re(ut){if(typeof ut!=="number"||!Number.isFinite(ut)||ut<1)return 10;return Math.floor(ut)}function z(ut){if(typeof ut!=="number"||!Number.isFinite(ut)||ut<1)return 10;return Math.floor(ut)}function se(ut){if(typeof ut!=="number"||!Number.isFinite(ut)||ut<1)return 14400;return Math.floor(ut)}function fe(ut){let dt={};if(ut.name)dt.name=ut.name;if(ut.email)dt.email=ut.email;if(ut.avatar)dt.avatar=ut.avatar;return dt}function ge(ut){if(!ut||typeof ut!=="object"||Array.isArray(ut))return{};let dt={};for(let[pt,lt]of Object.entries(ut)){if(on.has(pt))continue;if(typeof lt==="string"||typeof lt==="number"||typeof lt==="boolean"||lt===null)dt[pt]=lt}return dt}function an(ut){let dt=ut;return{name:typeof dt.name==="string"?dt.name:void 0,email:typeof dt.email==="string"?dt.email:void 0,avatar:typeof dt.avatar==="string"?dt.avatar:void 0}}function f(ut,dt){let pt=an(ut);if(!dt)return fe(pt);try{return ge(dt(ut))}catch{return fe(pt)}}function B(ut){return btoa(JSON.stringify(ut))}function _e(ut){try{let dt=JSON.parse(atob(ut));if(!dt||typeof dt!=="object"||Array.isArray(dt))return;let pt=dt;if(pt.v!==1)return;if(pt.authType!=="sso"&&pt.authType!=="ciam")return;if(pt.kind!==void 0&&pt.kind!=="session"&&pt.kind!=="discovered")return;if(typeof pt.expiresAt!=="string"||!pt.expiresAt)return;let lt=typeof pt.tenantId==="string"&&pt.tenantId?pt.tenantId:void 0,mt=typeof pt.tenantName==="string"&&pt.tenantName?pt.tenantName:void 0;return{v:1,...pt.kind?{kind:pt.kind}:{},...lt?{tenantId:lt}:{},authType:pt.authType,expiresAt:pt.expiresAt,user:ge(pt.user),...mt?{tenantName:mt}:{}}}catch{return}}function oe(ut){let dt={};if(!ut)return dt;for(let pt of ut.split(";")){let lt=pt.trim();if(!lt)continue;let mt=lt.indexOf("=");if(mt===-1)continue;dt[lt.slice(0,mt).trim()]=lt.slice(mt+1).trim()}return dt}function G(ut){let dt=oe(ut),pt=[];for(let[lt,mt]of Object.entries(dt)){if(!lt.endsWith(".profile")||!mt)continue;let ft=_e(mt);if(!ft)continue;pt.push({name:lt,prefix:lt.slice(0,-8),envelope:ft})}return pt}function U(ut,dt){let pt=ut?Date.parse(ut):Number.NaN,lt=dt?Date.parse(dt):Number.NaN,mt=Number.isFinite(pt),ft=Number.isFinite(lt);if(mt&&ft)return lt-pt;if(mt)return-1;if(ft)return 1;return 0}function _(ut){return`${ut}.profile`}function F(ut){return _(`ion.discovered.${encodeURIComponent(ut)}`)}var Oe="ecid",Jt=/^ecid:([A-Za-z0-9._-]+):([A-Za-z0-9_-]+)$/,cn=/^[A-Za-z0-9._-]+$/,un=/^[A-Za-z0-9_-]+$/;class O extends r{constructor(ut){super(ut,{status:400,statusText:"invalid_ecid"})}}function De(ut){return typeof ut==="string"&&Jt.test(ut)}function Ge(ut,dt){if(!ut||!cn.test(ut))throw new O(`Invalid ECID realm ${JSON.stringify(ut)}: must be non-empty and match [A-Za-z0-9._-].`);if(!dt||!un.test(dt))throw new O(`Invalid ECID opaque ${JSON.stringify(dt)}: must be non-empty and match [A-Za-z0-9_-].`);return`${Oe}:${ut}:${dt}`}function Fe(ut){let dt=typeof ut==="string"?ut.match(Jt):null;if(!dt)throw new O(`Invalid ECID ${JSON.stringify(ut)}: expected "ecid:<realm>:<opaque>".`);return{realm:dt[1],opaque:dt[2]}}function D(ut){if(!De(ut))throw new O(`Invalid ECID ${JSON.stringify(ut)}: expected "ecid:<realm>:<opaque>".`);return ut}var wt=["workload"],ye={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:wt,recommendedSubjectTypes:wt},he={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:wt,recommendedSubjectTypes:wt},Se={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:wt,recommendedSubjectTypes:wt},ke={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:wt,recommendedSubjectTypes:wt},be={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:wt,recommendedSubjectTypes:wt},Ce={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:wt,recommendedSubjectTypes:wt},Te={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:wt,recommendedSubjectTypes:wt},we={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:wt},Re={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:wt,recommendedSubjectTypes:wt},Ae={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:wt,recommendedSubjectTypes:wt},ie=[ye,he,Se,ke,be,Ce,Te,we,Re,Ae],Je={"iam.read":{permission:ye,subjectType:["workload"]},"iam.users.write":{permission:he,subjectType:["workload"]},"iam.groups.write":{permission:Se,subjectType:["workload"]},"iam.workloads.write":{permission:ke,subjectType:["workload"]},"iam.customers.write":{permission:be,subjectType:["workload"]},"iam.access-requests.write":{permission:Ce,subjectType:["workload"]},"capabilitiez.read":{permission:Te,subjectType:["workload"]},"ciam.magic-link.create":{permission:we,subjectType:["workload","user"]},"authz.oaa.sync":{permission:Re,subjectType:["workload"]},"tenant.manage":{permission:Ae,subjectType:["workload"]}};function ae(ut){return{"~standard":{version:1,vendor:ut,validate:(dt)=>{if(typeof dt!=="object"||dt===null)return{issues:[{message:"Expected an object"}]};let pt=dt,lt=[],mt={};if("code"in pt)if(typeof pt.code==="string")mt.code=pt.code;else lt.push({message:"code must be a string",path:["code"]});else if(!("error"in pt))lt.push({message:"code is required",path:["code"]});if("state"in pt)if(typeof pt.state==="string"||pt.state===void 0)mt.state=pt.state;else lt.push({message:"state must be a string",path:["state"]});if("session_state"in pt)if(typeof pt.session_state==="string"||pt.session_state===void 0)mt.session_state=pt.session_state;else lt.push({message:"session_state must be a string",path:["session_state"]});if("error"in pt){if(typeof pt.error==="string")mt.error=pt.error;else lt.push({message:"error must be a string",path:["error"]});if("error_description"in pt)if(typeof pt.error_description==="string"||pt.error_description===void 0)mt.error_description=pt.error_description;else lt.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in pt)if(typeof pt.error_uri==="string"||pt.error_uri===void 0)mt.error_uri=pt.error_uri;else lt.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in pt)if(typeof pt.iss==="string"||pt.iss===void 0)mt.iss=pt.iss;else lt.push({message:"iss must be a string",path:["iss"]});if(lt.length>0)return{issues:lt};return{value:mt}}}}}function ce(ut){return{"~standard":{version:1,vendor:ut,validate:(dt)=>{if(typeof dt!=="object"||dt===null)return{issues:[{message:"Expected an object"}]};let pt=dt,lt=[],mt={};if("access_token"in pt)if(typeof pt.access_token==="string")mt.access_token=pt.access_token;else lt.push({message:"access_token must be a string",path:["access_token"]});else lt.push({message:"access_token is required",path:["access_token"]});if("id_token"in pt)if(typeof pt.id_token==="string")mt.id_token=pt.id_token;else lt.push({message:"id_token must be a string",path:["id_token"]});else lt.push({message:"id_token is required",path:["id_token"]});if("token_type"in pt)if(typeof pt.token_type==="string")mt.token_type=pt.token_type;else lt.push({message:"token_type must be a string",path:["token_type"]});else lt.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in pt)if(typeof pt.refresh_token==="string"||pt.refresh_token===void 0)mt.refresh_token=pt.refresh_token;else lt.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in pt)if(typeof pt.scope==="string"||pt.scope===void 0)mt.scope=pt.scope;else lt.push({message:"scope must be a string",path:["scope"]});if("session_state"in pt)if(typeof pt.session_state==="string"||pt.session_state===void 0)mt.session_state=pt.session_state;else lt.push({message:"session_state must be a string",path:["session_state"]});if("expires"in pt)if(typeof pt.expires==="string"||pt.expires===void 0)mt.expires=pt.expires;else lt.push({message:"expires must be a string",path:["expires"]});if("expires_in"in pt)if(typeof pt.expires_in==="number"||pt.expires_in===void 0)mt.expires_in=pt.expires_in;else lt.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in pt)if(typeof pt.refresh_expires_in==="number"||pt.refresh_expires_in===void 0)mt.refresh_expires_in=pt.refresh_expires_in;else lt.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(lt.length>0)return{issues:lt};return{value:mt}}}}}function h(ut){return{"~standard":{version:1,vendor:ut,validate:(dt)=>{if(typeof dt!=="object"||dt===null)return{issues:[{message:"Expected an object"}]};let pt=dt,lt=[],mt={...pt},ft=["iss","sub"];for(let St of ft)if(typeof pt[St]!=="string")lt.push({message:`${St} is required and must be a string`,path:[St]});let gt=pt.aud;if(!(typeof gt==="string"||Array.isArray(gt)&&gt.length>0&&gt.every((St)=>typeof St==="string")))lt.push({message:"aud is required and must be a string or a non-empty array of strings",path:["aud"]});if(typeof pt.exp!=="number")lt.push({message:"exp is required and must be a number",path:["exp"]});let Rt=["sid","name","email","preferred_username","picture"];for(let St of Rt)if(St in pt&&pt[St]!==void 0){if(typeof pt[St]!=="string")lt.push({message:`${St} must be a string`,path:[St]})}if("iat"in pt&&pt.iat!==void 0&&typeof pt.iat!=="number")lt.push({message:"iat must be a number",path:["iat"]});if(lt.length>0)return{issues:lt};return{value:mt}}}}}var o="application/json",He="application/scim+json",M="application/x-www-form-urlencoded",Ie="application/xml",ve="application/octet-stream",a=Object.freeze({Accept:"application/json"}),ue=Object.freeze({Accept:"application/scim+json, application/json"}),Ye=Object.freeze({Accept:"application/xml"}),Xe=Object.freeze({Accept:"application/octet-stream"}),s=Object.freeze({"Content-Type":"application/json"}),w=Object.freeze({"Content-Type":"application/scim+json"}),S=Object.freeze({"Content-Type":"application/x-www-form-urlencoded"}),Ze=Object.freeze({"Content-Type":"application/xml"}),Qe=Object.freeze({"Content-Type":"application/octet-stream"});function Me(ut){let dt=ut.headers.get("content-type")?.split(";",1)[0]?.trim().toLowerCase();return Boolean(dt&&(dt==="application/json"||dt.endsWith("+json")))}function dn(ut){let dt=ut.replace(/\s+/g," ").trim();return dt?dt.slice(0,300):void 0}async function J(ut,dt={}){let pt=ut.headers.get("content-type")??void 0,lt;try{lt=await ut.text()}catch{return{contentType:pt}}let mt=/<title(?:\s[^>]*)?>([\s\S]*?)<\/title>/i.exec(lt)?.[1],ft=dn(mt??(dt.redact?"":lt));return{contentType:pt,excerpt:ft}}async function c(ut,dt={}){if(Me(ut))return await ut.json();let pt=await J(ut,{redact:dt.redact});dt.log?.warn("Expected a JSON response body but received a different content type",{"ion.operation":dt.operation??"http.response","ion.outcome":"degraded",reason:"non_json_response",status:ut.status,contentType:pt.contentType,excerpt:pt.excerpt});let lt=[pt.contentType,pt.excerpt].filter(Boolean).join(": ");throw Error(`Expected a JSON response body${lt?`; received ${lt}`:""}`)}function p(ut){let dt=ut["~standard"];return Object.assign(ut,{validate(pt){return Promise.resolve(dt.validate(pt))}})}function t(ut,dt="Assertion failed. Required value is null or undefined."){if(ut===void 0||ut===null)throw Error(dt);return ut}function de(ut,dt){return Response.json({error:"validation_failed",message:dt,issues:ut},{status:400,headers:s})}function et(ut,dt,pt=[]){let lt={...ut,...dt};for(let mt of pt)lt[mt]=ut?.[mt]??dt?.[mt];return lt}function je(ut){let dt="",pt=0,lt=ut.length;while(pt<lt){let mt=ut[pt];if(mt==='"'||mt==="'"){let ft=mt;dt+=mt,pt++;while(pt<lt){let gt=ut[pt];if(gt==="\\"){if(dt+=gt,pt+1<lt)dt+=ut[pt+1],pt+=2;else pt++;continue}if(gt===ft){dt+=gt,pt++;break}dt+=gt,pt++}continue}if(mt==="/"&&pt+1<lt){let ft=ut[pt+1];if(ft==="/"){pt+=2;while(pt<lt&&ut[pt]!==`
+`)pt++;if(pt<lt)dt+=`
+`;pt++;continue}if(ft==="*"){pt+=2;while(pt+1<lt&&!(ut[pt]==="*"&&ut[pt+1]==="/"))pt++;pt+=2;continue}}dt+=mt,pt++}return dt}function pn(ut){let dt="",pt=!1,lt=!1;for(let mt=0;mt<ut.length;mt+=1){let ft=ut[mt];if(pt){if(dt+=ft,lt)lt=!1;else if(ft==="\\")lt=!0;else if(ft==='"')pt=!1;continue}if(ft==='"'){pt=!0,dt+=ft;continue}if(ft===","){let gt=mt+1;while(gt<ut.length&&/\s/.test(ut[gt]??""))gt+=1;let yt=ut[gt];if(yt==="}"||yt==="]")continue}dt+=ft}return dt}function tt(ut){let dt=pn(je(ut));return JSON.parse(dt)}function R(ut){return ut==="/"?ut:ut.replace(/\/+$/,"")}function Ut(ut){if(ut===null||typeof ut!=="object"||Array.isArray(ut))return!1;let dt=Object.getPrototypeOf(ut);return dt===Object.prototype||dt===null}function Lt(ut){return Object.keys(ut).filter((dt)=>ut[dt]!==void 0).sort()}function k(ut,dt){if(Object.is(ut,dt))return!0;if(ut===null||dt===null)return ut===dt;if(Array.isArray(ut)||Array.isArray(dt)){if(!Array.isArray(ut)||!Array.isArray(dt)||ut.length!==dt.length)return!1;for(let mt=0;mt<ut.length;mt+=1)if(!k(ut[mt],dt[mt]))return!1;return!0}if(!Ut(ut)||!Ut(dt))return!1;let pt=Lt(ut),lt=Lt(dt);if(pt.length!==lt.length)return!1;for(let mt=0;mt<pt.length;mt+=1)if(pt[mt]!==lt[mt])return!1;for(let mt of pt)if(!k(ut[mt],dt[mt]))return!1;return!0}function qt(ut,dt){if(ut===null||ut===void 0){dt.push("n");return}if(Array.isArray(ut)){dt.push("[");for(let pt of ut)qt(pt,dt);dt.push("]");return}if(Ut(ut)){dt.push("{");for(let pt of Lt(ut))dt.push(JSON.stringify(pt),":"),qt(ut[pt],dt);dt.push("}");return}dt.push(JSON.stringify(ut))}function nt(ut){let dt=[];qt(ut,dt);let pt=dt.join(""),lt=2166136261;for(let mt=0;mt<pt.length;mt+=1)lt^=pt.charCodeAt(mt),lt=lt*16777619%9007199254740992;return`${pt.length.toString(36)}:${lt.toString(36)}`}async function rt(ut,dt=async(gt)=>gt.status===200,pt=1000,lt=1e4,mt,ft){let gt=Date.now(),yt=`Awaiting Ping (${ut})`;return new Promise((Rt,St)=>{let ht=null,xt=null,bt=null,At=!1,It=()=>{if(ht)clearTimeout(ht);if(xt)clearInterval(xt);if(bt)clearTimeout(bt);ht=null,xt=null,bt=null},Ct=(Et)=>{if(At)return;At=!0,It(),Et()},Pt=Math.max(pt,1e4),kt=async()=>{try{let Et=await fetch(ut,{headers:a,signal:AbortSignal.timeout(Pt)});if(Et.ok){if(await dt(Et)){Ct(Rt);return}yt=`Response test failed: ${Et.status}: ${Et.statusText} - ${ut}`}else try{let Ot=await c(Et,{log:ft,operation:"wait_on.probe"});yt=`Response error: ${Et.status}: ${Et.statusText} - ${ut}: ${JSON.stringify(Ot)}`}catch(Ot){let tn=Ot instanceof Error?`: ${Ot.message}`:"";yt=`Response error: ${Et.status}: ${Et.statusText} - ${ut}${tn}`}}catch(Et){yt=`${Et instanceof Error?Et.message:String(Et)} - ${ut}`}if(!At)ht=setTimeout(()=>void kt(),pt)};if(lt>0)xt=setInterval(()=>{ft?.warn(`${yt}: ${Date.now()-gt}ms`)},lt);if(mt)bt=setTimeout(()=>{Ct(()=>St(Error(`Timeout: ${mt}ms: ${yt}`)))},mt);kt()})}var ln="@ionite/core",mn=p(h(ln));function H(ut){let dt=ut.exp!=null?new Date(ut.exp*1000):new Date,pt=ut.iss??"";return{id:ut.sub??"",userName:ut.preferred_username??"",name:ut.name??"",email:ut.email??"",avatar:ut.picture,sso:{profile:{...ut,iss:ut.iss??pt,aud:ut.aud},tenant:{id:ut.idp??pt,name:pt},tokenType:"Bearer",expires:dt}}}function fn(ut){let dt=ut.replace(/-/g,"+").replace(/_/g,"/");return atob(dt)}async function st(ut){let dt=ut.split(".");if(dt.length!==3)throw Error("Invalid JWT");let pt=fn(dt[1]),lt=JSON.parse(pt),mt=await mn.validate(lt);if(mt.issues)throw Error(`ID token claims validation failed: ${mt.issues.map((ft)=>ft.message).join("; ")}`);if(mt.value)return H(mt.value);throw Error("ID token claims validation failed")}class A extends r{constructor(ut,dt,pt){super(ut,{status:409,statusText:"conflict"});this.code="conflict";this.kind=dt,this.field=pt}safeBody(){return{kind:this.kind,...this.field!==void 0?{field:this.field}:{}}}}function j(ut){return ut instanceof A||typeof ut==="object"&&ut!=null&&ut.code==="conflict"}function xe(ut){if(typeof ut!=="object"||ut==null)return!1;let dt=ut.type;if(dt==="vault"||dt==="aws"||dt==="azure"||dt==="gcp")return!0;if(dt!=="mirror")return!1;let pt=ut;return xe(pt.from)&&pt.from.type!=="mirror"&&xe(pt.to)&&pt.to.type==="vault"}function ot(ut,dt=Date.now()){let pt=ut?.integration;if(!pt)return{state:"none"};if(Date.parse(pt.expiresAt)<=dt)return{state:"expired",integration:pt};if(pt.status==="consented"&&pt.handoverAppliedAt&&ut.configLocator)return{state:"integrated",integration:pt};return{state:pt.status,integration:pt}}class Xt{constructor(){this.tenants=new Map;this.integrationHandles=new Map;this.ioniteIds=new Map}async get(ut){return this.tenants.get(ut)}async list(ut){let dt=Array.from(this.tenants.values()),pt=Math.max(0,ut?.start??0),lt=ut?.limit,mt=dt.length,ft=lt!=null?pt+lt:void 0,gt=dt.slice(pt,ft);return N(mt,gt,pt,lt)}async upsert(ut){let dt=this.tenants.get(ut.id);if(dt?.ioniteId!==ut.ioniteId){if(dt?.ioniteId)throw Error("ionite id cannot change");if(ut.ioniteId){let pt=this.ioniteIds.get(ut.ioniteId);if(pt&&pt!==ut.id)throw Error("ionite id is already in use");this.ioniteIds.set(ut.ioniteId,ut.id)}}if(dt?.integration?.handleHash!==ut.integration?.handleHash){if(dt?.integration)this.integrationHandles.delete(dt.integration.handleHash);if(ut.integration){let pt=this.integrationHandles.get(ut.integration.handleHash);if(pt&&pt!==ut.id)throw Error("Integration handle hash is already in use");this.integrationHandles.set(ut.integration.handleHash,ut.id)}}return this.tenants.set(ut.id,ut),ut}async delete(ut){let dt=this.tenants.get(ut),pt=dt!==void 0;if(dt?.integration)this.integrationHandles.delete(dt.integration.handleHash);if(dt?.ioniteId)this.ioniteIds.delete(dt.ioniteId);return this.tenants.delete(ut),pt?1:0}async setIntegration(ut,dt,pt){let lt=this.tenants.get(ut);if(!lt)return;let mt=lt.integration?.handleHash;if(pt?.expectedHandleHash!==void 0&&(pt.expectedHandleHash===null?mt!==void 0:mt!==pt.expectedHandleHash))return;if(pt?.expectedVersion!==void 0&&lt.integration?.version!==pt.expectedVersion)return;if(k(lt.integration,dt))return lt;if(dt){let yt=this.integrationHandles.get(dt.handleHash);if(yt&&yt!==ut)throw Error("Integration handle hash is already in use")}if(lt.integration)this.integrationHandles.delete(lt.integration.handleHash);if(dt)this.integrationHandles.set(dt.handleHash,ut);let ft=dt?.ioniteId??lt.ioniteId;if(ft){if(lt.ioniteId&&lt.ioniteId!==ft)throw Error("ionite id cannot change");let yt=this.ioniteIds.get(ft);if(yt&&yt!==ut)throw Error("ionite id is already in use");this.ioniteIds.set(ft,ut)}let gt={...lt,ioniteId:ft,integration:dt,updatedAt:new Date};return this.tenants.set(ut,gt),gt}async getByIntegrationHandleHash(ut){let dt=this.integrationHandles.get(ut);return dt?this.tenants.get(dt):void 0}async getByIoniteId(ut){let dt=this.ioniteIds.get(ut);return dt?this.tenants.get(dt):void 0}}class Ne{constructor(ut={}){this.ionCache=ut.ionCache,this.store=new Xt}async get(ut){return this.store.get(ut)}async list(ut){return this.store.list(ut)}async upsert(ut){let dt=await this.store.upsert(ut);return this.ionCache?.delete(ut.id),dt}async delete(ut){let dt=await this.store.delete(ut);return this.ionCache?.delete(ut),dt}async getIon(ut){if(!this.ionCache)throw Error(`${this.constructor.name}.getIon() requires an app-owned ionCache. Pass { ionCache } (an lru-cache instance whose fetchMethod builds the tenant Ionite and whose dispose `+"closes it) — the SDK does not cache tenant runtimes. See the multi-tenant docs.");return this.ionCache.fetch(ut)}async setIntegration(ut,dt,pt){return this.store.setIntegration(ut,dt,pt)}async getByIntegrationHandleHash(ut){return this.store.getByIntegrationHandleHash(ut)}async getByIoniteId(ut){return this.store.getByIoniteId(ut)}}function gn(ut,dt,pt){return(async()=>{try{let lt=await fetch(ut,{method:"POST",headers:{...a,...s},body:JSON.stringify(dt)});if(!lt.ok)pt.error("Failed to send webhook update",{"ion.operation":"webhook.update","ion.outcome":"failure",status:lt.status,statusText:lt.statusText})}catch(lt){pt.error("Failed to send webhook update",{"ion.operation":"webhook.update","ion.outcome":"failure"},lt)}})()}async function it(ut,dt,pt){return gn(ut,dt,pt)}var d="urn:ionite:scim:schemas:extension:ion:2.0:User",b="urn:ionite:scim:schemas:core:2.0:Workload",C="urn:ionite:scim:schemas:core:2.0:Customer";function Tt(ut,dt,pt,lt,mt){if(ut===void 0||ut===null){if(pt)lt.push({message:`${dt} is required`,path:mt});return}if(typeof ut!=="string"){lt.push({message:`${dt} must be a string`,path:mt});return}return ut}function vt(ut,dt,pt,lt){if(ut===void 0||ut===null)return;if(typeof ut!=="boolean"){pt.push({message:`${dt} must be a boolean`,path:lt});return}return ut}function yn(ut,dt,pt){if(ut===void 0||ut===null)return;if(typeof ut!=="object"||ut===null){dt.push({message:"name must be an object",path:pt});return}let lt=ut,mt={};return mt.formatted=Tt(lt.formatted,"formatted",!1,dt,[...pt,"formatted"]),mt.familyName=Tt(lt.familyName,"familyName",!1,dt,[...pt,"familyName"]),mt.givenName=Tt(lt.givenName,"givenName",!1,dt,[...pt,"givenName"]),mt.middleName=Tt(lt.middleName,"middleName",!1,dt,[...pt,"middleName"]),mt.honorificPrefix=Tt(lt.honorificPrefix,"honorificPrefix",!1,dt,[...pt,"honorificPrefix"]),mt.honorificSuffix=Tt(lt.honorificSuffix,"honorificSuffix",!1,dt,[...pt,"honorificSuffix"]),mt}function Tn(ut,dt,pt){if(ut===void 0||ut===null)return;if(!Array.isArray(ut)){dt.push({message:"emails must be an array",path:pt});return}let lt=[];for(let mt=0;mt<ut.length;mt++){let ft=ut[mt],gt=[...pt,mt];if(typeof ft!=="object"||ft===null){dt.push({message:"email must be an object",path:gt});continue}let yt=ft,Rt=Tt(yt.value,"value",!0,dt,[...gt,"value"]);if(Rt)lt.push({value:Rt,display:Tt(yt.display,"display",!1,dt,[...gt,"display"]),type:Tt(yt.type,"type",!1,dt,[...gt,"type"]),primary:vt(yt.primary,"primary",dt,[...gt,"primary"])})}return lt.length>0?lt:void 0}function hn(ut,dt,pt){if(ut===void 0||ut===null)return;if(!Array.isArray(ut)){dt.push({message:"phoneNumbers must be an array",path:pt});return}let lt=[];for(let mt=0;mt<ut.length;mt++){let ft=ut[mt],gt=[...pt,mt];if(typeof ft!=="object"||ft===null){dt.push({message:"phoneNumber must be an object",path:gt});continue}let yt=ft,Rt=Tt(yt.value,"value",!0,dt,[...gt,"value"]);if(Rt)lt.push({value:Rt,display:Tt(yt.display,"display",!1,dt,[...gt,"display"]),type:Tt(yt.type,"type",!1,dt,[...gt,"type"]),primary:vt(yt.primary,"primary",dt,[...gt,"primary"])})}return lt.length>0?lt:void 0}function bn(ut,dt,pt){if(ut===void 0||ut===null)return;if(!Array.isArray(ut)){dt.push({message:"addresses must be an array",path:pt});return}let lt=[];for(let mt=0;mt<ut.length;mt++){let ft=ut[mt],gt=[...pt,mt];if(typeof ft!=="object"||ft===null){dt.push({message:"address must be an object",path:gt});continue}let yt=ft;lt.push({formatted:Tt(yt.formatted,"formatted",!1,dt,[...gt,"formatted"]),streetAddress:Tt(yt.streetAddress,"streetAddress",!1,dt,[...gt,"streetAddress"]),locality:Tt(yt.locality,"locality",!1,dt,[...gt,"locality"]),region:Tt(yt.region,"region",!1,dt,[...gt,"region"]),postalCode:Tt(yt.postalCode,"postalCode",!1,dt,[...gt,"postalCode"]),country:Tt(yt.country,"country",!1,dt,[...gt,"country"]),type:Tt(yt.type,"type",!1,dt,[...gt,"type"]),primary:vt(yt.primary,"primary",dt,[...gt,"primary"])})}return lt.length>0?lt:void 0}function An(ut,dt,pt){if(ut===void 0||ut===null)return;if(!Array.isArray(ut)){dt.push({message:"groups must be an array",path:pt});return}let lt=[];for(let mt=0;mt<ut.length;mt++){let ft=ut[mt],gt=[...pt,mt];if(typeof ft!=="object"||ft===null){dt.push({message:"group must be an object",path:gt});continue}let yt=ft,Rt=Tt(yt.value,"value",!0,dt,[...gt,"value"]);if(Rt)lt.push({value:Rt,$ref:Tt(yt.$ref,"$ref",!1,dt,[...gt,"$ref"]),display:Tt(yt.display,"display",!1,dt,[...gt,"display"]),type:Tt(yt.type,"type",!1,dt,[...gt,"type"])})}return lt.length>0?lt:void 0}function xn(ut,dt,pt){if(ut===void 0||ut===null)return;if(!Array.isArray(ut)){dt.push({message:"roles must be an array",path:pt});return}let lt=[];for(let mt=0;mt<ut.length;mt++){let ft=ut[mt],gt=[...pt,mt];if(typeof ft!=="object"||ft===null){dt.push({message:"role must be an object",path:gt});continue}let yt=ft,Rt=Tt(yt.value,"value",!0,dt,[...gt,"value"]);if(Rt)lt.push({value:Rt,display:Tt(yt.display,"display",!1,dt,[...gt,"display"]),type:Tt(yt.type,"type",!1,dt,[...gt,"type"]),primary:vt(yt.primary,"primary",dt,[...gt,"primary"])})}return lt.length>0?lt:void 0}function Sn(ut,dt,pt){if(ut===void 0||ut===null)return;if(typeof ut!=="object"||ut===null){dt.push({message:"Enterprise User extension must be an object",path:pt});return}let lt=ut,mt={};if(mt.employeeNumber=Tt(lt.employeeNumber,"employeeNumber",!1,dt,[...pt,"employeeNumber"]),mt.costCenter=Tt(lt.costCenter,"costCenter",!1,dt,[...pt,"costCenter"]),mt.organization=Tt(lt.organization,"organization",!1,dt,[...pt,"organization"]),mt.division=Tt(lt.division,"division",!1,dt,[...pt,"division"]),mt.department=Tt(lt.department,"department",!1,dt,[...pt,"department"]),lt.manager!==void 0&&lt.manager!==null)if(typeof lt.manager!=="object"||lt.manager===null)dt.push({message:"manager must be an object",path:[...pt,"manager"]});else{let ft=lt.manager;mt.manager={value:Tt(ft.value,"value",!1,dt,[...pt,"manager","value"]),$ref:Tt(ft.$ref,"$ref",!1,dt,[...pt,"manager","$ref"]),displayName:Tt(ft.displayName,"displayName",!1,dt,[...pt,"manager","displayName"])}}return mt}function at(ut){return{"~standard":{version:1,vendor:ut,validate:(dt)=>{if(typeof dt!=="object"||dt===null)return{issues:[{message:"Expected an object"}]};let pt=dt,lt=[],mt={},ft=Tt(pt.userName,"userName",!0,lt,["userName"]);if(!ft)return{issues:lt};if(mt.userName=ft,mt.id=Tt(pt.id,"id",!1,lt,["id"]),mt.externalId=Tt(pt.externalId,"externalId",!1,lt,["externalId"]),mt.displayName=Tt(pt.displayName,"displayName",!1,lt,["displayName"]),mt.nickName=Tt(pt.nickName,"nickName",!1,lt,["nickName"]),mt.profileUrl=Tt(pt.profileUrl,"profileUrl",!1,lt,["profileUrl"]),mt.title=Tt(pt.title,"title",!1,lt,["title"]),mt.userType=Tt(pt.userType,"userType",!1,lt,["userType"]),mt.preferredLanguage=Tt(pt.preferredLanguage,"preferredLanguage",!1,lt,["preferredLanguage"]),mt.locale=Tt(pt.locale,"locale",!1,lt,["locale"]),mt.timezone=Tt(pt.timezone,"timezone",!1,lt,["timezone"]),pt.password!==void 0)lt.push({message:"password is not supported: the SDK does not accept credentials via SCIM",path:["password"]});mt.active=vt(pt.active,"active",lt,["active"]),mt.name=yn(pt.name,lt,["name"]),mt.emails=Tn(pt.emails,lt,["emails"]),mt.phoneNumbers=hn(pt.phoneNumbers,lt,["phoneNumbers"]),mt.addresses=bn(pt.addresses,lt,["addresses"]),mt.groups=An(pt.groups,lt,["groups"]),mt.roles=xn(pt.roles,lt,["roles"]);let gt="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(pt[gt]!==void 0)mt[gt]=Sn(pt[gt],lt,[gt]);if(pt.schemas!==void 0)if(Array.isArray(pt.schemas))mt.schemas=pt.schemas.filter((yt)=>typeof yt==="string");else lt.push({message:"schemas must be an array",path:["schemas"]});if(pt.meta!==void 0)if(typeof pt.meta==="object"&&pt.meta!==null){let yt=pt.meta;mt.meta={resourceType:typeof yt.resourceType==="string"?yt.resourceType:void 0,created:typeof yt.created==="string"?yt.created:void 0,lastModified:typeof yt.lastModified==="string"?yt.lastModified:void 0,location:typeof yt.location==="string"?yt.location:void 0,version:typeof yt.version==="string"?yt.version:void 0}}else lt.push({message:"meta must be an object",path:["meta"]});if(lt.length>0)return{issues:lt};return{value:mt}}}}}function Rn(ut,dt,pt){if(ut===void 0||ut===null)return;if(!Array.isArray(ut)){dt.push({message:"members must be an array",path:pt});return}let lt=[];for(let mt=0;mt<ut.length;mt++){let ft=ut[mt],gt=[...pt,mt];if(typeof ft!=="object"||ft===null){dt.push({message:"member must be an object",path:gt});continue}let yt=ft,Rt=Tt(yt.value,"value",!0,dt,[...gt,"value"]);if(Rt){let St=Tt(yt.type,"type",!1,dt,[...gt,"type"]);if(St!==void 0&&St!=="User"&&St!=="Group"&&St!=="Workload"&&St!=="Customer")dt.push({message:"type must be 'User', 'Group', 'Workload', or 'Customer'",path:[...gt,"type"]});lt.push({value:Rt,$ref:Tt(yt.$ref,"$ref",!1,dt,[...gt,"$ref"]),display:Tt(yt.display,"display",!1,dt,[...gt,"display"]),type:St==="User"||St==="Group"||St==="Workload"||St==="Customer"?St:void 0})}}return lt.length>0?lt:void 0}function ct(ut){return{"~standard":{version:1,vendor:ut,validate:(dt)=>{if(typeof dt!=="object"||dt===null)return{issues:[{message:"Expected an object"}]};let pt=dt,lt=[],mt={},ft=Tt(pt.displayName,"displayName",!0,lt,["displayName"]);if(!ft)return{issues:lt};if(mt.displayName=ft,mt.id=Tt(pt.id,"id",!1,lt,["id"]),mt.externalId=Tt(pt.externalId,"externalId",!1,lt,["externalId"]),mt.members=Rn(pt.members,lt,["members"]),pt.schemas!==void 0)if(Array.isArray(pt.schemas))mt.schemas=pt.schemas.filter((gt)=>typeof gt==="string");else lt.push({message:"schemas must be an array",path:["schemas"]});if(pt.meta!==void 0)if(typeof pt.meta==="object"&&pt.meta!==null){let gt=pt.meta;mt.meta={resourceType:typeof gt.resourceType==="string"?gt.resourceType:void 0,created:typeof gt.created==="string"?gt.created:void 0,lastModified:typeof gt.lastModified==="string"?gt.lastModified:void 0,location:typeof gt.location==="string"?gt.location:void 0,version:typeof gt.version==="string"?gt.version:void 0}}else lt.push({message:"meta must be an object",path:["meta"]});if(lt.length>0)return{issues:lt};return{value:mt}}}}}function Zt(ut,dt){if(ut===void 0)return;if(typeof ut!=="object"||ut===null){dt.push({message:"meta must be an object",path:["meta"]});return}let pt=ut;return{resourceType:typeof pt.resourceType==="string"?pt.resourceType:void 0,created:typeof pt.created==="string"?pt.created:void 0,lastModified:typeof pt.lastModified==="string"?pt.lastModified:void 0,location:typeof pt.location==="string"?pt.location:void 0,version:typeof pt.version==="string"?pt.version:void 0}}function Qt(ut,dt){if(ut===void 0)return;if(!Array.isArray(ut)){dt.push({message:"schemas must be an array",path:["schemas"]});return}return ut.filter((pt)=>typeof pt==="string")}function en(ut,dt){if(ut===void 0)return;if(typeof ut!=="object"||ut===null||Array.isArray(ut)){dt.push({message:"attributes must be an object",path:["attributes"]});return}return{...ut}}var le={"~standard":{version:1,vendor:"ionite",validate:(ut)=>{let dt=[];if(typeof ut!=="object"||ut===null)return{issues:[{message:"Workload must be an object"}]};let pt=ut,lt={schemas:Qt(pt.schemas,dt),id:Tt(pt.id,"id",!1,dt,["id"]),externalId:Tt(pt.externalId,"externalId",!1,dt,["externalId"]),userName:Tt(pt.userName,"userName",!1,dt,["userName"]),displayName:Tt(pt.displayName,"displayName",!1,dt,["displayName"]),description:Tt(pt.description,"description",!1,dt,["description"]),active:typeof pt.active==="boolean"?pt.active:void 0,providerId:Tt(pt.providerId,"providerId",!1,dt,["providerId"]),requestUrl:Tt(pt.requestUrl,"requestUrl",!1,dt,["requestUrl"]),attributes:en(pt.attributes,dt),meta:Zt(pt.meta,dt)};if(dt.length>0)return{issues:dt};return{value:lt}}}},pe={"~standard":{version:1,vendor:"ionite",validate:(ut)=>{let dt=[];if(typeof ut!=="object"||ut===null)return{issues:[{message:"Customer must be an object"}]};let pt=ut,lt=pt.emails,mt;if(lt!==void 0)if(!Array.isArray(lt))dt.push({message:"emails must be an array",path:["emails"]});else mt=lt.filter((gt)=>typeof gt==="object"&&gt!==null&&typeof gt.value==="string");let ft={schemas:Qt(pt.schemas,dt),id:Tt(pt.id,"id",!1,dt,["id"]),externalId:Tt(pt.externalId,"externalId",!1,dt,["externalId"]),userName:Tt(pt.userName,"userName",!1,dt,["userName"]),displayName:Tt(pt.displayName,"displayName",!1,dt,["displayName"]),active:typeof pt.active==="boolean"?pt.active:void 0,emails:mt,providerId:Tt(pt.providerId,"providerId",!1,dt,["providerId"]),requestUrl:Tt(pt.requestUrl,"requestUrl",!1,dt,["requestUrl"]),attributes:en(pt.attributes,dt),meta:Zt(pt.meta,dt)};if(dt.length>0)return{issues:dt};return{value:ft}}}};
+export{Y,Le,l,I,v,x,i,r,X,N,u,$e,Z,g,e,y,E,Q,Ee,Pe,Ke,Ue,L,K,T,q,ee,W,n,m,te,P,me,qe,We,V,Ve,ze,Be,ne,re,z,se,fe,ge,f,B,_e,oe,G,U,_,F,Oe,O,De,Ge,Fe,D,ye,he,Se,ke,be,Ce,Te,we,Re,Ae,ie,Je,ae,ce,h,o,He,M,Ie,ve,a,ue,Ye,Xe,s,w,S,Ze,Qe,Me,J,c,p,t,de,et,je,tt,R,k,nt,rt,H,st,A,j,xe,ot,Ne,it,d,b,C,at,ct,le,pe};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/core",
-  "version": "0.0.24-beta.20261006.21",
+  "version": "0.0.24-beta.20261007.23",
   "description": "ionite Core (client-safe main entry; server handlers under ./server)",
   "private": false,
   "author": "ionite",

package/dist/shared/core-knezf9yx.js

@@ -1,4 +0,0 @@
-function Kt(ct){if(ct===void 0||ct===null)return[];return Array.isArray(ct)?ct:[ct]}function $t(ct){if(typeof ct!=="string")return;return ct.endsWith("/")?ct.slice(0,-1):ct}function Qt(ct,ut){if($t(ut.issuer)!==$t(ct.claims?.iss))return!1;let dt=Kt(ut.audience);if(dt.length===0)return!1;let pt=Kt(ct.claims?.aud),lt=typeof ct.claims?.azp==="string"?ct.claims.azp:void 0;if(!(dt.some((gt)=>pt.includes(gt))||(lt?dt.includes(lt):!1)))return!1;let ft=ct.clientId??ct.workloadId??ct.claims?.sub;return ut.clientId===ft}function J(ct,ut){let dt=ct?.trustedProvisioningClients;if(!dt?.length)return;let pt=new Set;for(let lt of dt){if(!Qt(ut,lt))continue;for(let mt of lt.permissions??[])pt.add(mt)}return pt.size>0?pt:void 0}function je(ct){let ut=ct?.trustedProvisioningClients;if(!ut?.length)return[];let dt=[];for(let pt of ut)for(let lt of pt.permissions??[])dt.push({subject:pt.clientId,subjectType:"workload",targetType:"permission",target:lt,status:"active",provenance:{source:"eci-trusted",actor:pt.clientId}});return dt}var d=["id","name","displayName","description","providerId","source","deprecated","type","parent","resources","assignableSubjectTypes","recommendedSubjectTypes","requestable","riskLevel","requestUrl","action","permissionTypes","resourceTypes","applyToSubResources","permissions","groups","roles"],A=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","ecid","accountClass","displayName","scimName","emails","nickName","active","title","preferredLanguage","locale","timezone","phoneNumbers","ims","photos","addresses","roles","groups","entitlements","x509Certificates","scimEnterprise","scimSchemaExtensions","createdAt","updatedAt","sso"],I=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","displayName","emails","phoneNumbers","active","createdAt","updatedAt","ciam"],v=["id","clientId","displayName","description","externalId","providerId","requestUrl","ecid","active","scopes","createdAt","updatedAt","metadata"];function o(ct,ut){let dt=new Set(ut),pt=Object.fromEntries(Object.entries(ct).filter(([lt,mt])=>!dt.has(lt)&&mt!==void 0));return Object.keys(pt).length>0?pt:void 0}function j(ct,ut,dt,pt){let lt=ut.length,mt=pt??ct,ft=mt>0?Math.floor(dt/mt)+1:1,gt=mt>0?Math.ceil(ct/mt):0;return{total:ct,count:lt,items:ut,size:mt,page:ft,pages:gt}}async function*c(ct,ut,dt=1000){let pt=0;while(!0){let lt=await ct(pt,dt);if(lt.items.length===0)break;for(let mt of lt.items)yield(ut?await ut(mt):mt)??mt;if(lt.items.length<dt||pt+lt.items.length>=lt.total)break;pt+=dt}}function Ne(ct,ut){if(!ut)return!0;if(ut.requestable!==void 0&&Boolean(ct.requestable)!==ut.requestable)return!1;if(ut.userName!==void 0){if((ct.userName??ct.clientId)!==ut.userName)return!1}if(ut.externalId!==void 0&&ct.externalId!==ut.externalId)return!1;if(ut.updatedAfter!==void 0){if(!(ct.updatedAt instanceof Date))return!1;let dt=ut.updatedAfter instanceof Date?ut.updatedAfter:new Date(ut.updatedAfter);if(Number.isNaN(dt.getTime())||ct.updatedAt<=dt)return!1}return!0}var Y=["basic","elevated","privileged","admin"],f="basic",e="urn:ionite:params:scim:schemas:extension:authz:2.0:Group",g=["user","workload","customer"];function x(ct){let{assignableSubjectTypes:ut,recommendedSubjectTypes:dt}=ct,pt=ct.id?` for "${ct.id}"`:"";if(!ut||ut.length===0)throw Error(`assignableSubjectTypes${pt} is required and must be a non-empty subset of [${g.join(", ")}]`);let lt=ut.filter((mt)=>!g.includes(mt));if(lt.length>0)throw Error(`assignableSubjectTypes${pt} contains values outside the platform ceiling [${g.join(", ")}]: ${lt.join(", ")}`);if(dt){let mt=dt.filter((ft)=>!ut.includes(ft));if(mt.length>0)throw Error(`recommendedSubjectTypes${pt} must be a subset of assignableSubjectTypes; offending values: ${mt.join(", ")}`)}}function X(ct,ut="subjectType"){if(ct!=="user"&&ct!=="customer"&&ct!=="workload")throw Error(`${ut} is required and must be one of [user, customer, workload]; got ${ct===void 0?"undefined":JSON.stringify(ct)}`)}class le extends Error{constructor(ct,ut,dt){super(ct);this.name="AssignmentPolicyError",this.policy=ut,this.requestUrl=dt,Object.setPrototypeOf(this,le.prototype)}}function Ee(ct){return typeof ct.groups?.get==="function"}function Le(ct){return Ee(ct)?ct:Pe(ct)}class Pt extends Error{constructor(ct){super(`defineCatalog: ${ct}`);this.name="CodeCatalogError"}}function qt(ct){return typeof ct==="string"?ct:ct.id}function en(ct){for(let ut of Object.values(ct))if(Array.isArray(ut))Object.freeze(ut);Object.freeze(ct)}function Ot(ct,ut){try{x(ut)}catch(dt){throw new Pt(`${ct} "${ut.id}": ${dt instanceof Error?dt.message:String(dt)}`)}}function Nt(ct){let ut=new Map(ct.map((pt)=>[pt.id,pt])),dt=Object.freeze([...ct]);return Object.freeze({get:(pt)=>ut.get(pt),list:()=>dt})}function Pe(ct){let ut=ct.groups??[],dt=ct.roles??[],pt=ct.permissions??[],lt=new Map,mt=(Tt,At)=>{for(let ht of At){if(!ht.id)throw new Pt(`a ${Tt} is missing its required "id".`);let bt=lt.get(ht.id);if(bt)throw new Pt(`duplicate id "${ht.id}" (declared as both ${bt} and ${Tt}).`);lt.set(ht.id,Tt)}};mt("group",ut),mt("role",dt),mt("permission",pt);let ft=(Tt,At,ht,bt)=>{let Ct=qt(bt),Rt=lt.get(Ct);if(Rt===void 0)throw new Pt(`${Tt} "${At}" references ${ht} "${Ct}", which is not declared in the catalog.`);if(Rt!==ht)throw new Pt(`${Tt} "${At}" references "${Ct}" as a ${ht}, but it is a ${Rt}.`)};for(let Tt of dt){Ot("role",Tt);for(let At of Tt.permissions??[])ft("role",Tt.id,"permission",At)}for(let Tt of pt)Ot("permission",Tt);for(let Tt of ut){Ot("group",Tt);for(let At of Tt.groups??[])ft("group",Tt.id,"group",At);for(let At of Tt.roles??[])ft("group",Tt.id,"role",At);for(let At of Tt.permissions??[])ft("group",Tt.id,"permission",At)}let gt=new Map(ut.map((Tt)=>[Tt.id,Tt])),xt=new Map,St=(Tt,At)=>{let ht=xt.get(Tt);if(ht==="done")return;if(ht==="visiting")throw new Pt(`group composition cycle: ${[...At,Tt].join(" -> ")}.`);xt.set(Tt,"visiting");for(let bt of gt.get(Tt)?.groups??[])St(qt(bt),[...At,Tt]);xt.set(Tt,"done")};for(let Tt of ut)St(Tt.id,[]);for(let Tt of[...ut,...dt,...pt])en(Tt);return Object.freeze({groups:Nt(ut),roles:Nt(dt),permissions:Nt(pt)})}function N(ct,ut){let dt=ct?.groups.get(ut);if(dt)return{entity:dt,kind:"group"};let pt=ct?.roles.get(ut);if(pt)return{entity:pt,kind:"role"};let lt=ct?.permissions.get(ut);return lt?{entity:lt,kind:"permission"}:void 0}function L(ct,ut){return ut==="group"?ct.groups:ut==="role"?ct.roles:ct.permissions}function T(ct,ut,dt){let pt={...ut,...dt,id:ut.id,requestable:ut.requestable,source:dt.source??"code",assignableSubjectTypes:ut.assignableSubjectTypes,recommendedSubjectTypes:ut.recommendedSubjectTypes};if(ct==="group"){let mt=ut;return{...pt,groups:mt.groups,roles:mt.roles,permissions:mt.permissions,resources:mt.resources}}if(ct==="role")return{...pt,permissions:ut.permissions};let lt=ut;return{...pt,action:lt.action,permissionTypes:lt.permissionTypes,resourceTypes:lt.resourceTypes,applyToSubResources:lt.applyToSubResources}}async function K(ct,ut,dt){let pt=await dt.get(ut.id);if(pt)return T(ct,ut,pt);let lt=Object.entries(ut).filter(([At])=>d.includes(At)),{riskLevel:mt,displayName:ft,...gt}=Object.fromEntries(lt),xt={...gt,source:"code"},St=dt.insertIfAbsent(xt);await St.ready();let Tt=await dt.get(ut.id)??St;return T(ct,ut,Tt)}async function Z(ct,ut,dt){let pt=async(lt,mt)=>{let ft=dt?[await lt.get(dt)].filter((gt)=>gt!==void 0):c((gt,xt)=>lt.list({start:gt,limit:xt}));for await(let gt of ft){if(gt.source!=="code"||gt.deprecated===!0||mt?.get(gt.id))continue;await lt.set({...gt,deprecated:!0}).ready()}};await pt(ut.groups,ct?.groups),await pt(ut.roles,ct?.roles),await pt(ut.permissions,ct?.permissions)}function Dt(ct,ut,dt){let pt=()=>{if(!dt)throw Error(`Cannot write ${ct} definitions: no AccessCatalogStore is wired (the code-declared catalog is read-only).`);return dt};return{async get(mt){let ft=ut.get(mt);if(!dt)return ft;let gt=await dt.get(mt);return gt&&ft?T(ct,ft,gt):gt??ft},set(mt){return pt().set(mt)},insertIfAbsent(mt){return pt().insertIfAbsent(mt)},async delete(mt){await pt().delete(mt)},async list(mt){let ft=Math.max(0,mt?.start??0),gt=mt?.limit,xt=mt?.filter?.requestable,St=[];if(dt)for await(let bt of c((Ct,Rt)=>dt.list({start:Ct,limit:Rt})))St.push(bt);let Tt=new Map(St.map((bt)=>[bt.id,bt])),At=[...ut.list().map((bt)=>{let Ct=Tt.get(bt.id);return Ct?T(ct,bt,Ct):bt}),...St.filter((bt)=>!ut.get(bt.id))].filter((bt)=>xt===void 0||Boolean(bt.requestable)===xt),ht=gt!=null?ft+gt:void 0;return j(At.length,At.slice(ft,ht),ft,gt)}}}function q(ct,ut){if(!ct)return ut;return{groups:Dt("group",ct.groups,ut?.groups),roles:Dt("role",ct.roles,ut?.roles),permissions:Dt("permission",ct.permissions,ut?.permissions),afterChange:ut?.afterChange?.bind(ut)}}function n(ct){if(typeof ct==="string")return ct.trim();if(ct&&typeof ct==="object"){let ut=ct;for(let dt of["id","value","name","displayName"]){let pt=ut[dt];if(typeof pt==="string"&&pt.trim())return pt.trim()}}return""}function p(ct){let ut=n(ct.subject),dt=n(ct.target);if(!ut)throw Error("Access change subject must resolve to a non-empty id.");if(!ct.targetType)throw Error("Access change targetType is required.");if(!dt)throw Error("Access change target must resolve to a non-empty id.");let pt=(ct.resources??[]).map((mt)=>mt.trim()).filter(Boolean),lt=!ct.applyToApplication&&pt.length>0?[...pt].sort().join(","):"app";return X(ct.subjectType,"Access change subjectType"),`${ct.subjectType}:${ut}:${ct.targetType}:${dt}:${lt}`}function tn(ct){let ut=(ct.resources??[]).map((dt)=>dt.trim()).filter(Boolean);if(ct.applyToApplication||ut.length===0)return[void 0];return ut}async function zt(ct,ut,dt,pt,lt){if(pt==="resource")return dt?.get(lt);let mt=ut?pt==="group"?ut.groups.get(lt):pt==="role"?ut.roles.get(lt):ut.permissions.get(lt):void 0;if(ct){let gt=await(pt==="group"?ct.groups:pt==="role"?ct.roles:ct.permissions).get(lt);if(gt)return mt?T(pt,mt,gt):gt}return mt}class Q{constructor(ct,ut,dt){this.catalog=ct;this.resources=ut;this.code=dt;this.nodes=new Map;this.subResources=new Map;this.children=new Map}getNode(ct,ut){let dt=`${ct}:${ut}`,pt=this.nodes.get(dt);if(!pt)pt=zt(this.catalog,this.code,this.resources,ct,ut),this.nodes.set(dt,pt);return pt}resourceChildren(ct){let ut=this.children.get(ct);if(!ut)ut=Bt(ct,this.view()),this.children.set(ct,ut);return ut}resourceAndSubResourceIds(ct){let ut=this.subResources.get(ct);if(!ut)ut=Wt(ct,this.view()),this.subResources.set(ct,ut);return ut}view(){return{catalog:this.catalog,code:this.code,resources:this.resources,cache:this}}invalidate(ct){this.clear()}clear(){this.nodes.clear(),this.subResources.clear(),this.children.clear()}}async function _t(ct,ut,dt){if(ct.cache)return ct.cache.getNode(ut,dt);return zt(ct.catalog,ct.code,ct.resources,ut,dt)}async function Gt(ct,ut){if(typeof ct!=="string")return ct;return _t(ut,"resource",ct)}async function Bt(ct,ut){if(ut.resources?.children)return ut.resources.children(ct);let dt=await Gt(ct,ut),pt=[];for(let lt of dt?.resources??[]){let mt=await Gt(lt,ut);if(mt)pt.push(mt);else if(typeof lt==="string"&&lt.trim())pt.push({id:lt.trim()})}return pt}async function Vt(ct,ut){if(ut.cache)return ut.cache.resourceChildren(ct);return Bt(ct,ut)}async function Wt(ct,ut){let dt=[],pt=new Set,lt=async(mt)=>{if(!mt||pt.has(mt))return;pt.add(mt),dt.push(mt);for(let ft of await Vt(mt,ut))await lt(n(ft))};return await lt(n(ct)),dt}async function E(ct,ut){let dt=ct.id??p(ct),pt=n(ct.subject);if(!pt)throw Error("Access change subject must resolve to a non-empty id.");X(ct.subjectType,"Access change subjectType");let lt=ct.subjectType,mt=tn(ct),ft=[],gt=new Set,xt=new Set,St=(ht,bt,Ct)=>{if(!bt)return;let Rt=`${ht}:${bt}:${Ct??""}`;if(gt.has(Rt))return;gt.add(Rt),ft.push({subject:pt,subjectType:lt,targetType:ht,target:bt,resource:Ct,rootId:dt})},Tt=async(ht,bt,Ct)=>{for(let Rt of mt)if(ht==="permission"&&Ct?.applyToSubResources&&Rt){let wt=ut.cache?await ut.cache.resourceAndSubResourceIds(Rt):await Wt(Rt,ut);for(let It of wt)St("permission",bt,It)}else St(ht,bt,Rt)},At=async(ht,bt)=>{let Ct=n(bt);if(!Ct)return;let Rt=`${ht}:${Ct}`;if(xt.has(Rt))return;if(xt.add(Rt),ht==="group"){let It=typeof bt==="string"?await _t(ut,"group",Ct):bt;await Tt("group",Ct,void 0);for(let Et of It?.groups??[])await At("group",Et);for(let Et of It?.roles??[])await At("role",Et);for(let Et of It?.permissions??[])await At("permission",Et);return}if(ht==="role"){let It=typeof bt==="string"?await _t(ut,"role",Ct):bt;await Tt("role",Ct,void 0);for(let Et of It?.permissions??[])await At("permission",Et);return}let wt=typeof bt==="string"?await _t(ut,"permission",Ct):bt;await Tt("permission",Ct,wt)};return await At(ct.targetType,ct.target),ft}async function pe(ct,ut,dt,pt){let{accessStore:lt,accessIndex:mt,catalogStore:ft,code:gt,resources:xt}=dt;if(!mt||!ft&&!gt)return 0;if(!lt)return await mt.replaceSubject(ct,ut,[]),0;let St={catalog:ft,code:gt,resources:xt,cache:pt},Tt=[],At=0;for await(let ht of c((bt,Ct)=>lt.listBySubject(ct,ut,{start:bt,limit:Ct}))){let bt=ht.id??p(ht),Ct=await E({...ht,id:bt},St);Tt.push(...Ct),At+=1}return await mt.replaceSubject(ct,ut,Tt),At}async function $e(ct,ut,dt){let pt=new Map,lt=new Map,mt=new Map,ft=new Map,gt=new Set,xt=(At,ht)=>_t(dt,At,ht),St=async(At)=>{let ht=n(At);if(!ht||ft.has(ht))return;let bt=typeof At==="string"?await xt("resource",ht):At;if(!bt)return;ft.set(ht,bt);let Ct=bt.resources??(bt.id?await Vt(bt.id,dt):[]);for(let Rt of Ct)await St(Rt)},Tt=async(At,ht)=>{let bt=n(ht);if(!bt)return;let Ct=`${At}:${bt}`;if(gt.has(Ct))return;if(gt.add(Ct),At==="group"){let wt=typeof ht==="string"?await xt("group",bt):ht;if(!wt)return;pt.set(bt,wt);for(let It of wt.groups??[])await Tt("group",It);for(let It of wt.roles??[])await Tt("role",It);for(let It of wt.permissions??[])await Tt("permission",It);for(let It of wt.resources??[])await St(It);return}if(At==="role"){let wt=typeof ht==="string"?await xt("role",bt):ht;if(!wt)return;lt.set(bt,wt);for(let It of wt.permissions??[])await Tt("permission",It);return}let Rt=typeof ht==="string"?await xt("permission",bt):ht;if(!Rt)return;mt.set(bt,Rt)};if(gt.add(`${ut}:${n(ct)}`),ut==="group"){let At=ct;for(let ht of At.groups??[])await Tt("group",ht);for(let ht of At.roles??[])await Tt("role",ht);for(let ht of At.permissions??[])await Tt("permission",ht);for(let ht of At.resources??[])await St(ht)}else{let At=ct;for(let ht of At.permissions??[])await Tt("permission",ht)}return{groups:[...pt.values()],roles:[...lt.values()],permissions:[...mt.values()],resources:[...ft.values()]}}var Ke=".profile",W=1,qe=10,We=10,Ve=14400,ee="ion.discovered",nn=new Set(["sid","sub","tokens","access_token","id_token","refresh_token","accessClaims","roles","groups","permissions","grants"]);function te(ct){if(typeof ct!=="number"||!Number.isFinite(ct)||ct<1)return 10;return Math.floor(ct)}function V(ct){if(typeof ct!=="number"||!Number.isFinite(ct)||ct<1)return 10;return Math.floor(ct)}function ne(ct){if(typeof ct!=="number"||!Number.isFinite(ct)||ct<1)return 14400;return Math.floor(ct)}function me(ct){let ut={};if(ct.name)ut.name=ct.name;if(ct.email)ut.email=ct.email;if(ct.avatar)ut.avatar=ct.avatar;return ut}function fe(ct){if(!ct||typeof ct!=="object"||Array.isArray(ct))return{};let ut={};for(let[dt,pt]of Object.entries(ct)){if(nn.has(dt))continue;if(typeof pt==="string"||typeof pt==="number"||typeof pt==="boolean"||pt===null)ut[dt]=pt}return ut}function sn(ct){let ut=ct;return{name:typeof ut.name==="string"?ut.name:void 0,email:typeof ut.email==="string"?ut.email:void 0,avatar:typeof ut.avatar==="string"?ut.avatar:void 0}}function m(ct,ut){let dt=sn(ct);if(!ut)return me(dt);try{return fe(ut(ct))}catch{return me(dt)}}function z(ct){return btoa(JSON.stringify(ct))}function Ue(ct){try{let ut=JSON.parse(atob(ct));if(!ut||typeof ut!=="object"||Array.isArray(ut))return;let dt=ut;if(dt.v!==1)return;if(dt.authType!=="sso"&&dt.authType!=="ciam")return;if(dt.kind!==void 0&&dt.kind!=="session"&&dt.kind!=="discovered")return;if(typeof dt.expiresAt!=="string"||!dt.expiresAt)return;let pt=typeof dt.tenantId==="string"&&dt.tenantId?dt.tenantId:void 0,lt=typeof dt.tenantName==="string"&&dt.tenantName?dt.tenantName:void 0;return{v:1,...dt.kind?{kind:dt.kind}:{},...pt?{tenantId:pt}:{},authType:dt.authType,expiresAt:dt.expiresAt,user:fe(dt.user),...lt?{tenantName:lt}:{}}}catch{return}}function re(ct){let ut={};if(!ct)return ut;for(let dt of ct.split(";")){let pt=dt.trim();if(!pt)continue;let lt=pt.indexOf("=");if(lt===-1)continue;ut[pt.slice(0,lt).trim()]=pt.slice(lt+1).trim()}return ut}function B(ct){let ut=re(ct),dt=[];for(let[pt,lt]of Object.entries(ut)){if(!pt.endsWith(".profile")||!lt)continue;let mt=Ue(lt);if(!mt)continue;dt.push({name:pt,prefix:pt.slice(0,-8),envelope:mt})}return dt}function P(ct,ut){let dt=ct?Date.parse(ct):Number.NaN,pt=ut?Date.parse(ut):Number.NaN,lt=Number.isFinite(dt),mt=Number.isFinite(pt);if(lt&&mt)return pt-dt;if(lt)return-1;if(mt)return 1;return 0}function U(ct){return`${ct}.profile`}function G(ct){return U(`ion.discovered.${encodeURIComponent(ct)}`)}var ze="ecid",Ft=/^ecid:([A-Za-z0-9._-]+):([A-Za-z0-9_-]+)$/,rn=/^[A-Za-z0-9._-]+$/,on=/^[A-Za-z0-9_-]+$/;class _ extends Error{constructor(ct){super(ct);this.name="EcidFormatError"}}function _e(ct){return typeof ct==="string"&&Ft.test(ct)}function Be(ct,ut){if(!ct||!rn.test(ct))throw new _(`Invalid ECID realm ${JSON.stringify(ct)}: must be non-empty and match [A-Za-z0-9._-].`);if(!ut||!on.test(ut))throw new _(`Invalid ECID opaque ${JSON.stringify(ut)}: must be non-empty and match [A-Za-z0-9_-].`);return`ecid:${ct}:${ut}`}function Ge(ct){let ut=typeof ct==="string"?ct.match(Ft):null;if(!ut)throw new _(`Invalid ECID ${JSON.stringify(ct)}: expected "ecid:<realm>:<opaque>".`);return{realm:ut[1],opaque:ut[2]}}function O(ct){if(!_e(ct))throw new _(`Invalid ECID ${JSON.stringify(ct)}: expected "ecid:<realm>:<opaque>".`);return ct}var kt=["workload"],ge={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},ye={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},he={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},Se={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},ke={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},be={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},Ce={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},Te={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:kt},we={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},Re={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:kt,recommendedSubjectTypes:kt},se=[ge,ye,he,Se,ke,be,Ce,Te,we,Re],Fe={"iam.read":{permission:ge,subjectType:["workload"]},"iam.users.write":{permission:ye,subjectType:["workload"]},"iam.groups.write":{permission:he,subjectType:["workload"]},"iam.workloads.write":{permission:Se,subjectType:["workload"]},"iam.customers.write":{permission:ke,subjectType:["workload"]},"iam.access-requests.write":{permission:be,subjectType:["workload"]},"capabilitiez.read":{permission:Ce,subjectType:["workload"]},"ciam.magic-link.create":{permission:Te,subjectType:["workload","user"]},"authz.oaa.sync":{permission:we,subjectType:["workload"]},"tenant.manage":{permission:Re,subjectType:["workload"]}};function oe(ct){return{"~standard":{version:1,vendor:ct,validate:(ut)=>{if(typeof ut!=="object"||ut===null)return{issues:[{message:"Expected an object"}]};let dt=ut,pt=[],lt={};if("code"in dt)if(typeof dt.code==="string")lt.code=dt.code;else pt.push({message:"code must be a string",path:["code"]});else if(!("error"in dt))pt.push({message:"code is required",path:["code"]});if("state"in dt)if(typeof dt.state==="string"||dt.state===void 0)lt.state=dt.state;else pt.push({message:"state must be a string",path:["state"]});if("session_state"in dt)if(typeof dt.session_state==="string"||dt.session_state===void 0)lt.session_state=dt.session_state;else pt.push({message:"session_state must be a string",path:["session_state"]});if("error"in dt){if(typeof dt.error==="string")lt.error=dt.error;else pt.push({message:"error must be a string",path:["error"]});if("error_description"in dt)if(typeof dt.error_description==="string"||dt.error_description===void 0)lt.error_description=dt.error_description;else pt.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in dt)if(typeof dt.error_uri==="string"||dt.error_uri===void 0)lt.error_uri=dt.error_uri;else pt.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in dt)if(typeof dt.iss==="string"||dt.iss===void 0)lt.iss=dt.iss;else pt.push({message:"iss must be a string",path:["iss"]});if(pt.length>0)return{issues:pt};return{value:lt}}}}}function ie(ct){return{"~standard":{version:1,vendor:ct,validate:(ut)=>{if(typeof ut!=="object"||ut===null)return{issues:[{message:"Expected an object"}]};let dt=ut,pt=[],lt={};if("access_token"in dt)if(typeof dt.access_token==="string")lt.access_token=dt.access_token;else pt.push({message:"access_token must be a string",path:["access_token"]});else pt.push({message:"access_token is required",path:["access_token"]});if("id_token"in dt)if(typeof dt.id_token==="string")lt.id_token=dt.id_token;else pt.push({message:"id_token must be a string",path:["id_token"]});else pt.push({message:"id_token is required",path:["id_token"]});if("token_type"in dt)if(typeof dt.token_type==="string")lt.token_type=dt.token_type;else pt.push({message:"token_type must be a string",path:["token_type"]});else pt.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in dt)if(typeof dt.refresh_token==="string"||dt.refresh_token===void 0)lt.refresh_token=dt.refresh_token;else pt.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in dt)if(typeof dt.scope==="string"||dt.scope===void 0)lt.scope=dt.scope;else pt.push({message:"scope must be a string",path:["scope"]});if("session_state"in dt)if(typeof dt.session_state==="string"||dt.session_state===void 0)lt.session_state=dt.session_state;else pt.push({message:"session_state must be a string",path:["session_state"]});if("expires"in dt)if(typeof dt.expires==="string"||dt.expires===void 0)lt.expires=dt.expires;else pt.push({message:"expires must be a string",path:["expires"]});if("expires_in"in dt)if(typeof dt.expires_in==="number"||dt.expires_in===void 0)lt.expires_in=dt.expires_in;else pt.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in dt)if(typeof dt.refresh_expires_in==="number"||dt.refresh_expires_in===void 0)lt.refresh_expires_in=dt.refresh_expires_in;else pt.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(pt.length>0)return{issues:pt};return{value:lt}}}}}function y(ct){return{"~standard":{version:1,vendor:ct,validate:(ut)=>{if(typeof ut!=="object"||ut===null)return{issues:[{message:"Expected an object"}]};let dt=ut,pt=[],lt={...dt},mt=["iss","sub"];for(let St of mt)if(typeof dt[St]!=="string")pt.push({message:`${St} is required and must be a string`,path:[St]});let ft=dt.aud;if(!(typeof ft==="string"||Array.isArray(ft)&&ft.length>0&&ft.every((St)=>typeof St==="string")))pt.push({message:"aud is required and must be a string or a non-empty array of strings",path:["aud"]});if(typeof dt.exp!=="number")pt.push({message:"exp is required and must be a number",path:["exp"]});let xt=["sid","name","email","preferred_username","picture"];for(let St of xt)if(St in dt&&dt[St]!==void 0){if(typeof dt[St]!=="string")pt.push({message:`${St} must be a string`,path:[St]})}if("iat"in dt&&dt.iat!==void 0&&typeof dt.iat!=="number")pt.push({message:"iat must be a number",path:["iat"]});if(pt.length>0)return{issues:pt};return{value:lt}}}}}var s="application/json",He="application/scim+json",D="application/x-www-form-urlencoded",Ae="application/xml",Ie="application/octet-stream",i=Object.freeze({Accept:"application/json"}),ae=Object.freeze({Accept:"application/scim+json, application/json"}),Je=Object.freeze({Accept:"application/xml"}),Ye=Object.freeze({Accept:"application/octet-stream"}),r=Object.freeze({"Content-Type":"application/json"}),w=Object.freeze({"Content-Type":"application/scim+json"}),h=Object.freeze({"Content-Type":"application/x-www-form-urlencoded"}),Xe=Object.freeze({"Content-Type":"application/xml"}),Ze=Object.freeze({"Content-Type":"application/octet-stream"});function Oe(ct){let ut=ct.headers.get("content-type")?.split(";",1)[0]?.trim().toLowerCase();return Boolean(ut&&(ut==="application/json"||ut.endsWith("+json")))}function an(ct){let ut=ct.replace(/\s+/g," ").trim();return ut?ut.slice(0,300):void 0}async function F(ct,ut={}){let dt=ct.headers.get("content-type")??void 0,pt;try{pt=await ct.text()}catch{return{contentType:dt}}let lt=/<title(?:\s[^>]*)?>([\s\S]*?)<\/title>/i.exec(pt)?.[1],mt=an(lt??(ut.redact?"":pt));return{contentType:dt,excerpt:mt}}async function a(ct,ut={}){if(Oe(ct))return await ct.json();let dt=await F(ct,{redact:ut.redact});ut.log?.warn("Expected a JSON response body but received a different content type",{"ion.operation":ut.operation??"http.response","ion.outcome":"degraded",reason:"non_json_response",status:ct.status,contentType:dt.contentType,excerpt:dt.excerpt});let pt=[dt.contentType,dt.excerpt].filter(Boolean).join(": ");throw Error(`Expected a JSON response body${pt?`; received ${pt}`:""}`)}function l(ct){let ut=ct["~standard"];return Object.assign(ct,{validate(dt){return Promise.resolve(ut.validate(dt))}})}function t(ct,ut="Assertion failed. Required value is null or undefined."){if(ct===void 0||ct===null)throw Error(ut);return ct}function ce(ct,ut){return Response.json({error:"validation_failed",message:ut,issues:ct},{status:400,headers:r})}function Qe(ct,ut,dt=[]){let pt={...ct,...ut};for(let lt of dt)pt[lt]=ct?.[lt]??ut?.[lt];return pt}function De(ct){let ut="",dt=0,pt=ct.length;while(dt<pt){let lt=ct[dt];if(lt==='"'||lt==="'"){let mt=lt;ut+=lt,dt++;while(dt<pt){let ft=ct[dt];if(ft==="\\"){if(ut+=ft,dt+1<pt)ut+=ct[dt+1],dt+=2;else dt++;continue}if(ft===mt){ut+=ft,dt++;break}ut+=ft,dt++}continue}if(lt==="/"&&dt+1<pt){let mt=ct[dt+1];if(mt==="/"){dt+=2;while(dt<pt&&ct[dt]!==`
-`)dt++;if(dt<pt)ut+=`
-`;dt++;continue}if(mt==="*"){dt+=2;while(dt+1<pt&&!(ct[dt]==="*"&&ct[dt+1]==="/"))dt++;dt+=2;continue}}ut+=lt,dt++}return ut}function cn(ct){let ut="",dt=!1,pt=!1;for(let lt=0;lt<ct.length;lt+=1){let mt=ct[lt];if(dt){if(ut+=mt,pt)pt=!1;else if(mt==="\\")pt=!0;else if(mt==='"')dt=!1;continue}if(mt==='"'){dt=!0,ut+=mt;continue}if(mt===","){let ft=lt+1;while(ft<ct.length&&/\s/.test(ct[ft]??""))ft+=1;let gt=ct[ft];if(gt==="}"||gt==="]")continue}ut+=mt}return ut}function et(ct){let ut=cn(De(ct));return JSON.parse(ut)}function R(ct){return ct==="/"?ct:ct.replace(/\/+$/,"")}function Mt(ct){if(ct===null||typeof ct!=="object"||Array.isArray(ct))return!1;let ut=Object.getPrototypeOf(ct);return ut===Object.prototype||ut===null}function Ut(ct){return Object.keys(ct).filter((ut)=>ct[ut]!==void 0).sort()}function S(ct,ut){if(Object.is(ct,ut))return!0;if(ct===null||ut===null)return ct===ut;if(Array.isArray(ct)||Array.isArray(ut)){if(!Array.isArray(ct)||!Array.isArray(ut)||ct.length!==ut.length)return!1;for(let lt=0;lt<ct.length;lt+=1)if(!S(ct[lt],ut[lt]))return!1;return!0}if(!Mt(ct)||!Mt(ut))return!1;let dt=Ut(ct),pt=Ut(ut);if(dt.length!==pt.length)return!1;for(let lt=0;lt<dt.length;lt+=1)if(dt[lt]!==pt[lt])return!1;for(let lt of dt)if(!S(ct[lt],ut[lt]))return!1;return!0}function Lt(ct,ut){if(ct===null||ct===void 0){ut.push("n");return}if(Array.isArray(ct)){ut.push("[");for(let dt of ct)Lt(dt,ut);ut.push("]");return}if(Mt(ct)){ut.push("{");for(let dt of Ut(ct))ut.push(JSON.stringify(dt),":"),Lt(ct[dt],ut);ut.push("}");return}ut.push(JSON.stringify(ct))}function tt(ct){let ut=[];Lt(ct,ut);let dt=ut.join(""),pt=2166136261;for(let lt=0;lt<dt.length;lt+=1)pt^=dt.charCodeAt(lt),pt=pt*16777619%9007199254740992;return`${dt.length.toString(36)}:${pt.toString(36)}`}async function nt(ct,ut=async(ft)=>ft.status===200,dt=1000,pt=1e4,lt,mt){let ft=Date.now(),gt=`Awaiting Ping (${ct})`;return new Promise((xt,St)=>{let Tt=null,At=null,ht=null,bt=!1,Ct=()=>{if(Tt)clearTimeout(Tt);if(At)clearInterval(At);if(ht)clearTimeout(ht);Tt=null,At=null,ht=null},Rt=(Et)=>{if(bt)return;bt=!0,Ct(),Et()},wt=Math.max(dt,1e4),It=async()=>{try{let Et=await fetch(ct,{headers:i,signal:AbortSignal.timeout(wt)});if(Et.ok){if(await ut(Et)){Rt(xt);return}gt=`Response test failed: ${Et.status}: ${Et.statusText} - ${ct}`}else try{let vt=await a(Et,{log:mt,operation:"wait_on.probe"});gt=`Response error: ${Et.status}: ${Et.statusText} - ${ct}: ${JSON.stringify(vt)}`}catch(vt){let Zt=vt instanceof Error?`: ${vt.message}`:"";gt=`Response error: ${Et.status}: ${Et.statusText} - ${ct}${Zt}`}}catch(Et){gt=`${Et instanceof Error?Et.message:String(Et)} - ${ct}`}if(!bt)Tt=setTimeout(()=>void It(),dt)};if(pt>0)At=setInterval(()=>{mt?.warn(`${gt}: ${Date.now()-ft}ms`)},pt);if(lt)ht=setTimeout(()=>{Rt(()=>St(Error(`Timeout: ${lt}ms: ${gt}`)))},lt);It()})}var un="@ionite/core",dn=l(y(un));function H(ct){let ut=ct.exp!=null?new Date(ct.exp*1000):new Date,dt=ct.iss??"";return{id:ct.sub??"",userName:ct.preferred_username??"",name:ct.name??"",email:ct.email??"",avatar:ct.picture,sso:{profile:{...ct,iss:ct.iss??dt,aud:ct.aud},tenant:{id:ct.idp??dt,name:dt},tokenType:"Bearer",expires:ut}}}function pn(ct){let ut=ct.replace(/-/g,"+").replace(/_/g,"/");return atob(ut)}async function rt(ct){let ut=ct.split(".");if(ut.length!==3)throw Error("Invalid JWT");let dt=pn(ut[1]),pt=JSON.parse(dt),lt=await dn.validate(pt);if(lt.issues)throw Error(`ID token claims validation failed: ${lt.issues.map((mt)=>mt.message).join("; ")}`);if(lt.value)return H(lt.value);throw Error("ID token claims validation failed")}class k extends Error{constructor(ct,ut,dt){super(ct);this.code="conflict";this.name="StoreConflictError",this.kind=ut,this.field=dt,Object.setPrototypeOf(this,k.prototype)}}function M(ct){return ct instanceof k||typeof ct==="object"&&ct!=null&&ct.code==="conflict"}class ve extends Error{constructor(ct,ut={}){super(ct,{cause:ut.cause});this.name="IoniteError",this.status=ut.status,this.statusText=ut.statusText,Object.setPrototypeOf(this,ve.prototype)}}function xe(ct){if(typeof ct!=="object"||ct==null)return!1;let ut=ct.type;if(ut==="vault"||ut==="aws"||ut==="azure"||ut==="gcp")return!0;if(ut!=="mirror")return!1;let dt=ct;return xe(dt.from)&&dt.from.type!=="mirror"&&xe(dt.to)&&dt.to.type==="vault"}function st(ct,ut=Date.now()){let dt=ct?.integration;if(!dt)return{state:"none"};if(Date.parse(dt.expiresAt)<=ut)return{state:"expired",integration:dt};if(dt.status==="consented"&&dt.handoverAppliedAt&&ct.configLocator)return{state:"integrated",integration:dt};return{state:dt.status,integration:dt}}class Yt{constructor(){this.tenants=new Map;this.integrationHandles=new Map;this.ioniteIds=new Map}async get(ct){return this.tenants.get(ct)}async list(ct){let ut=Array.from(this.tenants.values()),dt=Math.max(0,ct?.start??0),pt=ct?.limit,lt=ut.length,mt=pt!=null?dt+pt:void 0,ft=ut.slice(dt,mt);return j(lt,ft,dt,pt)}async upsert(ct){let ut=this.tenants.get(ct.id);if(ut?.ioniteId!==ct.ioniteId){if(ut?.ioniteId)throw Error("ionite id cannot change");if(ct.ioniteId){let dt=this.ioniteIds.get(ct.ioniteId);if(dt&&dt!==ct.id)throw Error("ionite id is already in use");this.ioniteIds.set(ct.ioniteId,ct.id)}}if(ut?.integration?.handleHash!==ct.integration?.handleHash){if(ut?.integration)this.integrationHandles.delete(ut.integration.handleHash);if(ct.integration){let dt=this.integrationHandles.get(ct.integration.handleHash);if(dt&&dt!==ct.id)throw Error("Integration handle hash is already in use");this.integrationHandles.set(ct.integration.handleHash,ct.id)}}return this.tenants.set(ct.id,ct),ct}async delete(ct){let ut=this.tenants.get(ct),dt=ut!==void 0;if(ut?.integration)this.integrationHandles.delete(ut.integration.handleHash);if(ut?.ioniteId)this.ioniteIds.delete(ut.ioniteId);return this.tenants.delete(ct),dt?1:0}async setIntegration(ct,ut,dt){let pt=this.tenants.get(ct);if(!pt)return;let lt=pt.integration?.handleHash;if(dt?.expectedHandleHash!==void 0&&(dt.expectedHandleHash===null?lt!==void 0:lt!==dt.expectedHandleHash))return;if(dt?.expectedVersion!==void 0&&pt.integration?.version!==dt.expectedVersion)return;if(S(pt.integration,ut))return pt;if(ut){let gt=this.integrationHandles.get(ut.handleHash);if(gt&&gt!==ct)throw Error("Integration handle hash is already in use")}if(pt.integration)this.integrationHandles.delete(pt.integration.handleHash);if(ut)this.integrationHandles.set(ut.handleHash,ct);let mt=ut?.ioniteId??pt.ioniteId;if(mt){if(pt.ioniteId&&pt.ioniteId!==mt)throw Error("ionite id cannot change");let gt=this.ioniteIds.get(mt);if(gt&&gt!==ct)throw Error("ionite id is already in use");this.ioniteIds.set(mt,ct)}let ft={...pt,ioniteId:mt,integration:ut,updatedAt:new Date};return this.tenants.set(ct,ft),ft}async getByIntegrationHandleHash(ct){let ut=this.integrationHandles.get(ct);return ut?this.tenants.get(ut):void 0}async getByIoniteId(ct){let ut=this.ioniteIds.get(ct);return ut?this.tenants.get(ut):void 0}}class Me{constructor(ct={}){this.ionCache=ct.ionCache,this.store=new Yt}async get(ct){return this.store.get(ct)}async list(ct){return this.store.list(ct)}async upsert(ct){let ut=await this.store.upsert(ct);return this.ionCache?.delete(ct.id),ut}async delete(ct){let ut=await this.store.delete(ct);return this.ionCache?.delete(ct),ut}async getIon(ct){if(!this.ionCache)throw Error(`${this.constructor.name}.getIon() requires an app-owned ionCache. Pass { ionCache } (an lru-cache instance whose fetchMethod builds the tenant Ionite and whose dispose `+"closes it) — the SDK does not cache tenant runtimes. See the multi-tenant docs.");return this.ionCache.fetch(ct)}async setIntegration(ct,ut,dt){return this.store.setIntegration(ct,ut,dt)}async getByIntegrationHandleHash(ct){return this.store.getByIntegrationHandleHash(ct)}async getByIoniteId(ct){return this.store.getByIoniteId(ct)}}function ln(ct,ut,dt){return(async()=>{try{let pt=await fetch(ct,{method:"POST",headers:{...i,...r},body:JSON.stringify(ut)});if(!pt.ok)dt.error("Failed to send webhook update",{"ion.operation":"webhook.update","ion.outcome":"failure",status:pt.status,statusText:pt.statusText})}catch(pt){dt.error("Failed to send webhook update",{"ion.operation":"webhook.update","ion.outcome":"failure"},pt)}})()}async function ot(ct,ut,dt){return ln(ct,ut,dt)}var u="urn:ionite:scim:schemas:extension:ion:2.0:User",b="urn:ionite:scim:schemas:core:2.0:Workload",C="urn:ionite:scim:schemas:core:2.0:Customer";function yt(ct,ut,dt,pt,lt){if(ct===void 0||ct===null){if(dt)pt.push({message:`${ut} is required`,path:lt});return}if(typeof ct!=="string"){pt.push({message:`${ut} must be a string`,path:lt});return}return ct}function jt(ct,ut,dt,pt){if(ct===void 0||ct===null)return;if(typeof ct!=="boolean"){dt.push({message:`${ut} must be a boolean`,path:pt});return}return ct}function mn(ct,ut,dt){if(ct===void 0||ct===null)return;if(typeof ct!=="object"||ct===null){ut.push({message:"name must be an object",path:dt});return}let pt=ct,lt={};return lt.formatted=yt(pt.formatted,"formatted",!1,ut,[...dt,"formatted"]),lt.familyName=yt(pt.familyName,"familyName",!1,ut,[...dt,"familyName"]),lt.givenName=yt(pt.givenName,"givenName",!1,ut,[...dt,"givenName"]),lt.middleName=yt(pt.middleName,"middleName",!1,ut,[...dt,"middleName"]),lt.honorificPrefix=yt(pt.honorificPrefix,"honorificPrefix",!1,ut,[...dt,"honorificPrefix"]),lt.honorificSuffix=yt(pt.honorificSuffix,"honorificSuffix",!1,ut,[...dt,"honorificSuffix"]),lt}function fn(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"emails must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"email must be an object",path:ft});continue}let gt=mt,xt=yt(gt.value,"value",!0,ut,[...ft,"value"]);if(xt)pt.push({value:xt,display:yt(gt.display,"display",!1,ut,[...ft,"display"]),type:yt(gt.type,"type",!1,ut,[...ft,"type"]),primary:jt(gt.primary,"primary",ut,[...ft,"primary"])})}return pt.length>0?pt:void 0}function gn(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"phoneNumbers must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"phoneNumber must be an object",path:ft});continue}let gt=mt,xt=yt(gt.value,"value",!0,ut,[...ft,"value"]);if(xt)pt.push({value:xt,display:yt(gt.display,"display",!1,ut,[...ft,"display"]),type:yt(gt.type,"type",!1,ut,[...ft,"type"]),primary:jt(gt.primary,"primary",ut,[...ft,"primary"])})}return pt.length>0?pt:void 0}function yn(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"addresses must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"address must be an object",path:ft});continue}let gt=mt;pt.push({formatted:yt(gt.formatted,"formatted",!1,ut,[...ft,"formatted"]),streetAddress:yt(gt.streetAddress,"streetAddress",!1,ut,[...ft,"streetAddress"]),locality:yt(gt.locality,"locality",!1,ut,[...ft,"locality"]),region:yt(gt.region,"region",!1,ut,[...ft,"region"]),postalCode:yt(gt.postalCode,"postalCode",!1,ut,[...ft,"postalCode"]),country:yt(gt.country,"country",!1,ut,[...ft,"country"]),type:yt(gt.type,"type",!1,ut,[...ft,"type"]),primary:jt(gt.primary,"primary",ut,[...ft,"primary"])})}return pt.length>0?pt:void 0}function Tn(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"groups must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"group must be an object",path:ft});continue}let gt=mt,xt=yt(gt.value,"value",!0,ut,[...ft,"value"]);if(xt)pt.push({value:xt,$ref:yt(gt.$ref,"$ref",!1,ut,[...ft,"$ref"]),display:yt(gt.display,"display",!1,ut,[...ft,"display"]),type:yt(gt.type,"type",!1,ut,[...ft,"type"])})}return pt.length>0?pt:void 0}function hn(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"roles must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"role must be an object",path:ft});continue}let gt=mt,xt=yt(gt.value,"value",!0,ut,[...ft,"value"]);if(xt)pt.push({value:xt,display:yt(gt.display,"display",!1,ut,[...ft,"display"]),type:yt(gt.type,"type",!1,ut,[...ft,"type"]),primary:jt(gt.primary,"primary",ut,[...ft,"primary"])})}return pt.length>0?pt:void 0}function bn(ct,ut,dt){if(ct===void 0||ct===null)return;if(typeof ct!=="object"||ct===null){ut.push({message:"Enterprise User extension must be an object",path:dt});return}let pt=ct,lt={};if(lt.employeeNumber=yt(pt.employeeNumber,"employeeNumber",!1,ut,[...dt,"employeeNumber"]),lt.costCenter=yt(pt.costCenter,"costCenter",!1,ut,[...dt,"costCenter"]),lt.organization=yt(pt.organization,"organization",!1,ut,[...dt,"organization"]),lt.division=yt(pt.division,"division",!1,ut,[...dt,"division"]),lt.department=yt(pt.department,"department",!1,ut,[...dt,"department"]),pt.manager!==void 0&&pt.manager!==null)if(typeof pt.manager!=="object"||pt.manager===null)ut.push({message:"manager must be an object",path:[...dt,"manager"]});else{let mt=pt.manager;lt.manager={value:yt(mt.value,"value",!1,ut,[...dt,"manager","value"]),$ref:yt(mt.$ref,"$ref",!1,ut,[...dt,"manager","$ref"]),displayName:yt(mt.displayName,"displayName",!1,ut,[...dt,"manager","displayName"])}}return lt}function it(ct){return{"~standard":{version:1,vendor:ct,validate:(ut)=>{if(typeof ut!=="object"||ut===null)return{issues:[{message:"Expected an object"}]};let dt=ut,pt=[],lt={},mt=yt(dt.userName,"userName",!0,pt,["userName"]);if(!mt)return{issues:pt};if(lt.userName=mt,lt.id=yt(dt.id,"id",!1,pt,["id"]),lt.externalId=yt(dt.externalId,"externalId",!1,pt,["externalId"]),lt.displayName=yt(dt.displayName,"displayName",!1,pt,["displayName"]),lt.nickName=yt(dt.nickName,"nickName",!1,pt,["nickName"]),lt.profileUrl=yt(dt.profileUrl,"profileUrl",!1,pt,["profileUrl"]),lt.title=yt(dt.title,"title",!1,pt,["title"]),lt.userType=yt(dt.userType,"userType",!1,pt,["userType"]),lt.preferredLanguage=yt(dt.preferredLanguage,"preferredLanguage",!1,pt,["preferredLanguage"]),lt.locale=yt(dt.locale,"locale",!1,pt,["locale"]),lt.timezone=yt(dt.timezone,"timezone",!1,pt,["timezone"]),dt.password!==void 0)pt.push({message:"password is not supported: the SDK does not accept credentials via SCIM",path:["password"]});lt.active=jt(dt.active,"active",pt,["active"]),lt.name=mn(dt.name,pt,["name"]),lt.emails=fn(dt.emails,pt,["emails"]),lt.phoneNumbers=gn(dt.phoneNumbers,pt,["phoneNumbers"]),lt.addresses=yn(dt.addresses,pt,["addresses"]),lt.groups=Tn(dt.groups,pt,["groups"]),lt.roles=hn(dt.roles,pt,["roles"]);let ft="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(dt[ft]!==void 0)lt[ft]=bn(dt[ft],pt,[ft]);if(dt.schemas!==void 0)if(Array.isArray(dt.schemas))lt.schemas=dt.schemas.filter((gt)=>typeof gt==="string");else pt.push({message:"schemas must be an array",path:["schemas"]});if(dt.meta!==void 0)if(typeof dt.meta==="object"&&dt.meta!==null){let gt=dt.meta;lt.meta={resourceType:typeof gt.resourceType==="string"?gt.resourceType:void 0,created:typeof gt.created==="string"?gt.created:void 0,lastModified:typeof gt.lastModified==="string"?gt.lastModified:void 0,location:typeof gt.location==="string"?gt.location:void 0,version:typeof gt.version==="string"?gt.version:void 0}}else pt.push({message:"meta must be an object",path:["meta"]});if(pt.length>0)return{issues:pt};return{value:lt}}}}}function An(ct,ut,dt){if(ct===void 0||ct===null)return;if(!Array.isArray(ct)){ut.push({message:"members must be an array",path:dt});return}let pt=[];for(let lt=0;lt<ct.length;lt++){let mt=ct[lt],ft=[...dt,lt];if(typeof mt!=="object"||mt===null){ut.push({message:"member must be an object",path:ft});continue}let gt=mt,xt=yt(gt.value,"value",!0,ut,[...ft,"value"]);if(xt){let St=yt(gt.type,"type",!1,ut,[...ft,"type"]);if(St!==void 0&&St!=="User"&&St!=="Group"&&St!=="Workload"&&St!=="Customer")ut.push({message:"type must be 'User', 'Group', 'Workload', or 'Customer'",path:[...ft,"type"]});pt.push({value:xt,$ref:yt(gt.$ref,"$ref",!1,ut,[...ft,"$ref"]),display:yt(gt.display,"display",!1,ut,[...ft,"display"]),type:St==="User"||St==="Group"||St==="Workload"||St==="Customer"?St:void 0})}}return pt.length>0?pt:void 0}function at(ct){return{"~standard":{version:1,vendor:ct,validate:(ut)=>{if(typeof ut!=="object"||ut===null)return{issues:[{message:"Expected an object"}]};let dt=ut,pt=[],lt={},mt=yt(dt.displayName,"displayName",!0,pt,["displayName"]);if(!mt)return{issues:pt};if(lt.displayName=mt,lt.id=yt(dt.id,"id",!1,pt,["id"]),lt.externalId=yt(dt.externalId,"externalId",!1,pt,["externalId"]),lt.members=An(dt.members,pt,["members"]),dt.schemas!==void 0)if(Array.isArray(dt.schemas))lt.schemas=dt.schemas.filter((ft)=>typeof ft==="string");else pt.push({message:"schemas must be an array",path:["schemas"]});if(dt.meta!==void 0)if(typeof dt.meta==="object"&&dt.meta!==null){let ft=dt.meta;lt.meta={resourceType:typeof ft.resourceType==="string"?ft.resourceType:void 0,created:typeof ft.created==="string"?ft.created:void 0,lastModified:typeof ft.lastModified==="string"?ft.lastModified:void 0,location:typeof ft.location==="string"?ft.location:void 0,version:typeof ft.version==="string"?ft.version:void 0}}else pt.push({message:"meta must be an object",path:["meta"]});if(pt.length>0)return{issues:pt};return{value:lt}}}}}function Ht(ct,ut){if(ct===void 0)return;if(typeof ct!=="object"||ct===null){ut.push({message:"meta must be an object",path:["meta"]});return}let dt=ct;return{resourceType:typeof dt.resourceType==="string"?dt.resourceType:void 0,created:typeof dt.created==="string"?dt.created:void 0,lastModified:typeof dt.lastModified==="string"?dt.lastModified:void 0,location:typeof dt.location==="string"?dt.location:void 0,version:typeof dt.version==="string"?dt.version:void 0}}function Jt(ct,ut){if(ct===void 0)return;if(!Array.isArray(ct)){ut.push({message:"schemas must be an array",path:["schemas"]});return}return ct.filter((dt)=>typeof dt==="string")}function Xt(ct,ut){if(ct===void 0)return;if(typeof ct!=="object"||ct===null||Array.isArray(ct)){ut.push({message:"attributes must be an object",path:["attributes"]});return}return{...ct}}var ue={"~standard":{version:1,vendor:"ionite",validate:(ct)=>{let ut=[];if(typeof ct!=="object"||ct===null)return{issues:[{message:"Workload must be an object"}]};let dt=ct,pt={schemas:Jt(dt.schemas,ut),id:yt(dt.id,"id",!1,ut,["id"]),externalId:yt(dt.externalId,"externalId",!1,ut,["externalId"]),userName:yt(dt.userName,"userName",!1,ut,["userName"]),displayName:yt(dt.displayName,"displayName",!1,ut,["displayName"]),description:yt(dt.description,"description",!1,ut,["description"]),active:typeof dt.active==="boolean"?dt.active:void 0,providerId:yt(dt.providerId,"providerId",!1,ut,["providerId"]),requestUrl:yt(dt.requestUrl,"requestUrl",!1,ut,["requestUrl"]),attributes:Xt(dt.attributes,ut),meta:Ht(dt.meta,ut)};if(ut.length>0)return{issues:ut};return{value:pt}}}},de={"~standard":{version:1,vendor:"ionite",validate:(ct)=>{let ut=[];if(typeof ct!=="object"||ct===null)return{issues:[{message:"Customer must be an object"}]};let dt=ct,pt=dt.emails,lt;if(pt!==void 0)if(!Array.isArray(pt))ut.push({message:"emails must be an array",path:["emails"]});else lt=pt.filter((ft)=>typeof ft==="object"&&ft!==null&&typeof ft.value==="string");let mt={schemas:Jt(dt.schemas,ut),id:yt(dt.id,"id",!1,ut,["id"]),externalId:yt(dt.externalId,"externalId",!1,ut,["externalId"]),userName:yt(dt.userName,"userName",!1,ut,["userName"]),displayName:yt(dt.displayName,"displayName",!1,ut,["displayName"]),active:typeof dt.active==="boolean"?dt.active:void 0,emails:lt,providerId:yt(dt.providerId,"providerId",!1,ut,["providerId"]),requestUrl:yt(dt.requestUrl,"requestUrl",!1,ut,["requestUrl"]),attributes:Xt(dt.attributes,ut),meta:Ht(dt.meta,ut)};if(ut.length>0)return{issues:ut};return{value:mt}}}};
-export{J,je,d,A,I,v,o,j,c,Ne,Y,f,e,g,x,X,le,Ee,Le,Pe,N,L,T,K,Z,q,n,p,Q,E,pe,$e,Ke,W,qe,We,Ve,ee,te,V,ne,me,fe,m,z,Ue,re,B,P,U,G,ze,_,_e,Be,Ge,O,ge,ye,he,Se,ke,be,Ce,Te,we,Re,se,Fe,oe,ie,y,s,He,D,Ae,Ie,i,ae,Je,Ye,r,w,h,Xe,Ze,Oe,F,a,l,t,ce,Qe,De,et,R,S,tt,nt,H,rt,k,M,ve,xe,st,Me,ot,u,b,C,it,at,ue,de};