@ionite/core 0.0.24-beta.20261007.23 → 0.0.24-beta.20261007.24

package/dist/index.d.ts

@@ -104,11 +104,11 @@ declare class IoniteError extends Error {
 	readonly statusText?: string;
 	readonly detail?: string;
 	ionId?: string;
-	/** Effect `catchTag` discriminator. Equals the class name. */
-	readonly _tag: string;
 	/** Non-enumerable. Absent from `JSON.stringify` and `toJSON`. */
 	log?: Logger;
 	constructor(message: string, options?: IoniteErrorOptions);
+	/** Effect `catchTag` discriminator. Equals `name`, the declared class name. */
+	get _tag(): string;
 	/** Attach runtime context only where it is still unset. The innermost handle wins. */
 	attachContext(ctx: IoniteErrorContext): this;
 	/** Extra client-safe JSON fields. Included only when `statusText` is set. */
@@ -4111,6 +4111,7 @@ declare function defineSecretType(input: SecretTypeInput<unknown>): SecretTypeDe
 declare function defaultSecretContentType(format?: SecretFormat): SecretContentType;
 /** Raised before decoding when a stored secret does not match the requested runtime contract. */
 declare class SecretContentTypeMismatchError extends IoniteError {
+	readonly name = "SecretContentTypeMismatchError";
 	readonly expected: SecretContentType;
 	readonly received: SecretContentType;
 	constructor(expected: SecretContentType, received: SecretContentType);
@@ -6772,6 +6773,7 @@ type IamAssignmentPolicy = "app" | "iam" | "iam-request" | "idp";
 * caller to the request page without catching a generic error.
 */
 declare class AssignmentPolicyError extends IoniteError {
+	readonly name = "AssignmentPolicyError";
 	readonly policy: IamAssignmentPolicy;
 	readonly requestUrl?: string;
 	constructor(message: string, policy: IamAssignmentPolicy, requestUrl?: string);
@@ -6851,6 +6853,7 @@ type ConfigSourceErrorInit = {
 * https://ionite.com/docs/llms-configuration.txt.
 */
 declare class ConfigSourceError extends IoniteError {
+	readonly name = "ConfigSourceError";
 	readonly kind: RemoteConfigLoadErrorKind;
 	readonly recoverable?: boolean;
 	readonly code?: string;
@@ -6876,6 +6879,7 @@ declare function configSourceOriginLogFields(origin: ConfigSourceOrigin | undefi
 declare const ECID_SCHEME = "ecid";
 /** Thrown when an ECID string (or a segment) is malformed. */
 declare class EcidFormatError extends IoniteError {
+	readonly name = "EcidFormatError";
 	constructor(message: string);
 }
 /** Parsed ECID segments. */
@@ -6993,6 +6997,7 @@ declare const remoteConfigSecretType: SecretTypeDescriptor<RemoteConfig>;
 */
 type StoreConflictKind = "already_exists" | "unique_violation";
 declare class StoreConflictError extends IoniteError {
+	readonly name = "StoreConflictError";
 	/** Stable discriminator so callers can branch without an `instanceof` across package boundaries. */
 	readonly code: "conflict";
 	readonly kind: StoreConflictKind;

package/dist/index.js

@@ -1,2 +1,2 @@
-import{Y,Le,l,I,v,x,i,r,X,N,u,$e,Z,g,e,y,E,Q,Ee,Pe,Ke,Ue,L,K,T,q,ee,W,n,m,We,V,Ve,ze,Be,ne,re,z,se,fe,ge,f,B,_e,G,U,_,F,Oe,O,De,Ge,Fe,D,ye,he,Se,ke,be,Ce,Te,we,Re,Ae,ie,Je,ae,ce,h,o,He,M,Ie,ve,a,ue,Ye,Xe,s,w,S,Ze,Qe,Me,J,c,p,t,de,et,je,tt,R,k,nt,rt,H,st,A,j,xe,ot,d,b,C,at,ct,le,pe}from"./shared/core-y6y95p25.js";var Nt="0.0.24-beta.20261007.23";class Ct extends r{constructor(P,te){let oe=te.kind==="connection"||te.kind==="timeout"||te.kind==="not_found";super(P,{cause:te.cause,status:oe?503:500,upstreamStatus:te.status});this.kind=te.kind,this.recoverable=te.recoverable,this.code=te.code,this.path=te.path,this.sourceType=te.sourceType}}function $t(P){return P instanceof Ct}function Ut(P){let te=P?.trim();if(!te)return;try{let oe=new URL(te),me=oe.pathname.replace(/\/+$/g,"");return`${oe.protocol}//${oe.host}${me}`}catch{return}}function Et(P,te="ion.config.source"){if(!P)return{};let oe={[`${te}.type`]:P.type};if(P.transport)oe[`${te}.transport`]=P.transport;if(P.url)oe[`${te}.url`]=P.url;if(P.path)oe[`${te}.path`]=P.path;if(P.from)Object.assign(oe,Et(P.from,`${te}.from`));return oe}var Wt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function At(P){if(P===null||typeof P!=="object")return P;let te={};for(let[oe,me]of Object.entries(P)){if(Wt.includes(oe)||oe==="validators"||oe==="setStores")continue;te[oe]=me!==null&&typeof me==="object"&&!Array.isArray(me)&&Object.getPrototypeOf(me)===Object.prototype?At(me):me}return te}function Ft(P){return At(P)}function St(P,te){if(!P||typeof P!=="object"||Array.isArray(P))throw Error(`${te} must be an object.`);return P}function dt(P,te){if(P===void 0)return;if(typeof P!=="string"||P.length===0||!Number.isFinite(Date.parse(P)))throw Error(`${te} must be a valid timestamp string.`);return P}function ht(P,te,oe){if(!Array.isArray(P)||!oe.allowEmpty&&P.length===0)throw Error(`${te} keys must be ${oe.allowEmpty?"an":"a non-empty"} array.`);let me=new Set;return P.map((qe,Ne)=>{let it=St(qe,`${te} keys[${Ne}]`);if(typeof it.id!=="string"||it.id.length===0)throw Error(`${te} keys[${Ne}].id must be a non-empty string.`);if(me.has(it.id))throw Error(`${te} contains duplicate key id "${it.id}".`);if(me.add(it.id),!["pending","active","deprecated","rotated","revoked"].includes(String(it.state)))throw Error(`${te} keys[${Ne}].state is invalid.`);if(it.value!==void 0&&(typeof it.value!=="string"||it.value.length===0))throw Error(`${te} keys[${Ne}].value must be a non-empty string when present.`);let mt=it.meta===void 0?void 0:St(it.meta,`${te} keys[${Ne}].meta`);return{id:it.id,state:it.state,...it.value===void 0?{}:{value:it.value},...it.notBefore===void 0?{}:{notBefore:dt(it.notBefore,`${te} keys[${Ne}].notBefore`)},...it.notAfter===void 0?{}:{notAfter:dt(it.notAfter,`${te} keys[${Ne}].notAfter`)},...it.createdAt===void 0?{}:{createdAt:dt(it.createdAt,`${te} keys[${Ne}].createdAt`)},...it.activatedAt===void 0?{}:{activatedAt:dt(it.activatedAt,`${te} keys[${Ne}].activatedAt`)},...it.deprecatedAt===void 0?{}:{deprecatedAt:dt(it.deprecatedAt,`${te} keys[${Ne}].deprecatedAt`)},...it.rotatedAt===void 0?{}:{rotatedAt:dt(it.rotatedAt,`${te} keys[${Ne}].rotatedAt`)},...it.revokedAt===void 0?{}:{revokedAt:dt(it.revokedAt,`${te} keys[${Ne}].revokedAt`)},...mt?{meta:{...mt}}:{}}})}function qt(P,te,oe){if(P===void 0)return;if(!Array.isArray(P))throw Error(`${oe} slots must be an array.`);let me=new Set,qe=P.map((Ne,it)=>{if(Ne===null)return null;if(typeof Ne!=="string"||Ne.length===0)throw Error(`${oe} slots[${it}] must be a non-empty key id or null.`);if(me.has(Ne))throw Error(`${oe} slots contain duplicate key id "${Ne}".`);me.add(Ne);let mt=te.find((pt)=>pt.id===Ne);if(!mt)throw Error(`${oe} slot key "${Ne}" is not present in keys.`);if(mt.state!=="active")throw Error(`${oe} slot key "${Ne}" must have state "active".`);if(!mt.value)throw Error(`${oe} slot key "${Ne}" must include a value.`);return Ne});if(te.length===0&&qe.some((Ne)=>Ne!==null))throw Error(`${oe} slots must be omitted or all-null when keys is empty.`);return qe}function Vt(P){let oe=St(P,"KMS pool");if(oe.kind!=="kms")throw Error('KMS pool kind must be "kms".');let me=ht(oe.keys,"KMS pool",{allowEmpty:!0}),qe=qt(oe.slots,me,"KMS pool");return qe?{kind:"kms",slots:qe,keys:me}:{kind:"kms",keys:me}}function zt(P){let oe=St(P,"KMS pool control document");if(oe.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:ht(oe.keys,"KMS pool control document",{allowEmpty:!0})}}var jt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function bt(P){if(typeof P==="string")return P;try{return JSON.stringify(P)??String(P)}catch{return String(P)}}function gt(P){let te=bt(P);return/^[A-Za-z0-9_./:@+|-]+$/.test(te)?te:JSON.stringify(te)}function Bt(P){return bt(P).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function It(P,te,oe){if(oe==null)return;if(oe instanceof Error){let me=X(oe);if(me){for(let[qe,Ne]of Object.entries(me))if(Ne!=null)P.push(`${qe}=${gt(Ne)}`);return}if(P.push(`${te}.name=${gt(oe.name)}`),P.push(`${te}.message=${gt(oe.message)}`),oe.stack)P.push(`${te}.stack=${gt(oe.stack)}`);return}P.push(`${te}=${gt(oe)}`)}function ft(P,te,oe=[],me=new Date){let qe=Bt(te instanceof Error?te.message:te??""),Ne=[];for(let[it,mt]of oe.entries()){if(mt&&typeof mt==="object"&&!Array.isArray(mt)&&!(mt instanceof Error)&&Object.getPrototypeOf(mt)===Object.prototype){for(let[pt,lt]of Object.entries(mt))It(Ne,pt,lt);continue}It(Ne,`param.${it}`,mt)}return[me.toISOString(),jt[P],qe,...Ne].filter(Boolean).join(" ")}var xt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Gt=xt,Ht={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Yt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Jt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Xt={trace:()=>{},debug:(P,...te)=>globalThis.console.debug(ft("debug",P,te)),info:(P,...te)=>globalThis.console.info(ft("info",P,te)),warn:(P,...te)=>globalThis.console.warn(ft("warn",P,te)),error:(P,...te)=>globalThis.console.error(ft("error",P,te))};function Zt(P,te){if(typeof te!=="number"||te<=0)return P;return new Promise((oe,me)=>{let qe=setTimeout(()=>{me(Error(`Authz catalog entry did not become ready within ${te}ms`))},te);P.then(()=>{clearTimeout(qe),oe()},(Ne)=>{clearTimeout(qe),me(Ne)})})}function Qt(P,te){let oe=!1,me,qe=te.then(()=>{oe=!0},(it)=>{oe=!1,me=it}),Ne=P;return Object.defineProperty(Ne,"ready",{enumerable:!1,configurable:!0,value:(it)=>Zt(qe.then(()=>{if(!oe)throw me}),it)}),Object.defineProperty(Ne,"isReady",{enumerable:!1,configurable:!0,value:()=>oe}),Ne}var kt=Object.freeze({jsonc:o,env:"text/x-dotenv",text:"text/plain",binary:ve,yaml:"application/yaml",toml:"application/toml",xml:Ie});function Rt(P){if(!P.id.trim())throw Error("defineSecretType: id is required");let te=P.mimeType?.trim()||kt[P.format],oe=Object.freeze({id:P.id,...P.label?{label:P.label}:{},format:P.format,mimeType:te,...P.schemaUrl?{schemaUrl:P.schemaUrl}:{},typeId:P.id});return Object.freeze({id:P.id,...P.label?{label:P.label}:{},format:P.format,mimeType:te,...P.schemaUrl?{schemaUrl:P.schemaUrl}:{},...P.schema?{schema:P.schema}:{},toRegistryEntry:()=>oe})}function eo(P="jsonc"){return{format:P,mimeType:kt[P],typeId:P}}class Pt extends r{constructor(P,te){super(`Secret content type mismatch: expected "${P.mimeType}" (${P.format}) but received "${te.mimeType}" (${te.format})`,{status:500});this.expected=P,this.received=te}}var to=Rt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var _t={beforeTenantSegments:["ui"]},wt={beforeTenantSegments:["api"]};function Ot(P){return(P??[]).map((te)=>te.trim()).filter(Boolean)}function vt(P){let te=P.trim();if(!te)return"/";let oe=te.replace(/\\/g,"/").replace(/\/+/g,"/");return oe.startsWith("/")?oe:`/${oe}`}function Kt(P){return vt(P).split("/").filter(Boolean)}function yt(P){return{beforeTenantSegments:Ot(P?.beforeTenantSegments),afterTenantSegments:Ot(P?.afterTenantSegments)}}function Dt(P){if(P?.type==="host")return{type:"host",baseDomain:Tt(P.baseDomain)};if(P?.type==="selector")return P;return{type:"path",ui:yt(P?.ui??_t),api:yt(P?.api??wt)}}function Tt(P){let te=P.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!te)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return te}function oo(P,te){let oe=P.trim().replace(/\.$/,"").toLowerCase(),me=Tt(te);if(!oe.endsWith(`.${me}`))return null;let qe=oe.slice(0,-(me.length+1));if(!qe||qe.includes("."))return null;return{id:qe}}function ro(P,te){let oe=yt(te),me=oe.beforeTenantSegments??[],qe=oe.afterTenantSegments??[],Ne=Kt(P),it=me.length+1+qe.length;if(Ne.length<it)return null;for(let ut=0;ut<me.length;ut++)if(Ne[ut]!==me[ut])return null;let mt=me.length,pt=Ne[mt];if(!pt)return null;for(let ut=0;ut<qe.length;ut++)if(Ne[mt+1+ut]!==qe[ut])return null;let lt=Ne.slice(mt+1+qe.length);return{id:decodeURIComponent(pt),restSegments:lt,restPath:lt.length>0?`/${lt.join("/")}`:"/"}}function Lt(P,te="/",oe){let me=yt(oe),qe=me.beforeTenantSegments??[],Ne=me.afterTenantSegments??[],it=Kt(te),mt=[...qe,encodeURIComponent(P),...Ne,...it];return mt.length>0?`/${mt.join("/")}`:"/"}function no(P,te="/",oe,me="ui"){let qe=Dt(oe);if(qe.type==="host"||qe.type==="selector")return vt(te);return Lt(P,te,qe[me])}function so(P){return{"~standard":{version:1,vendor:P,validate:(te)=>{if(typeof te!=="object"||te===null)return{issues:[{message:"Expected an object"}]};let oe=te,me=[],qe={...oe},Ne=["iss","sub"];for(let pt of Ne)if(pt in oe){if(typeof oe[pt]!=="string")me.push({message:`${pt} must be a string`,path:[pt]})}else me.push({message:`${pt} is required`,path:[pt]});if("aud"in oe&&oe.aud!==void 0){let pt=oe.aud;if(typeof pt!=="string"&&!Array.isArray(pt))me.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(pt)&&!pt.every((lt)=>typeof lt==="string"))me.push({message:"aud array must contain only strings",path:["aud"]})}let it=["jti","scope"];for(let pt of it)if(pt in oe&&oe[pt]!==void 0){if(typeof oe[pt]!=="string")me.push({message:`${pt} must be a string`,path:[pt]})}let mt=["exp","iat"];for(let pt of mt)if(pt in oe){if(typeof oe[pt]!=="number")me.push({message:`${pt} must be a number`,path:[pt]})}else me.push({message:`${pt} is required`,path:[pt]});if(me.length>0)return{issues:me};return{value:qe}}}}}function io(P){return{"~standard":{version:1,vendor:P,validate:(te)=>{if(typeof te!=="object"||te===null)return{issues:[{message:"Expected an object"}]};let oe=te,me=[],qe={};if("access_token"in oe)if(typeof oe.access_token==="string")qe.access_token=oe.access_token;else me.push({message:"access_token must be a string",path:["access_token"]});else me.push({message:"access_token is required",path:["access_token"]});if("token_type"in oe)if(typeof oe.token_type==="string")qe.token_type=oe.token_type;else me.push({message:"token_type must be a string",path:["token_type"]});else me.push({message:"token_type is required",path:["token_type"]});if("scope"in oe)if(typeof oe.scope==="string"||oe.scope===void 0)qe.scope=oe.scope;else me.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in oe)if(typeof oe.refresh_token==="string"||oe.refresh_token===void 0)qe.refresh_token=oe.refresh_token;else me.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in oe)if(typeof oe.expires==="string"||oe.expires===void 0)qe.expires=oe.expires;else me.push({message:"expires must be a string",path:["expires"]});if("expires_in"in oe)if(typeof oe.expires_in==="number"||oe.expires_in===void 0)qe.expires_in=oe.expires_in;else me.push({message:"expires_in must be a number",path:["expires_in"]});if(me.length>0)return{issues:me};return{value:qe}}}}}function ao(P){let te=new Uint8Array(P);return crypto.getRandomValues(te),te}function po(P){let te="",oe=ao(P);for(let me=0;me<P;me++){let qe=oe[me]%32;te+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(qe)}return te}function co(P,te){let oe="";for(let me=te;me>0;me--){let qe=P%32;oe="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(qe)+oe,P=Math.floor(P/32)}return oe}function mo(P){let te=Date.now(),oe=co(te,10),me=po(16);return`${P??""}${oe}${me}`}export{a as ACCEPT_JSON,Xe as ACCEPT_OCTET_STREAM,ue as ACCEPT_SCIM,Ye as ACCEPT_XML,Ee as AssignmentPolicyError,Z as CANONICAL_RISK_LEVELS,S as CONTENT_TYPE_FORM,s as CONTENT_TYPE_JSON,Qe as CONTENT_TYPE_OCTET_STREAM,w as CONTENT_TYPE_SCIM,Ze as CONTENT_TYPE_XML,Ct as ConfigSourceError,ze as DEFAULT_DISCOVERED_COOKIE_MAX,Be as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Ve as DEFAULT_DISPLAY_COOKIE_MAX,g as DEFAULT_RISK_LEVEL,kt as DEFAULT_SECRET_MIME_TYPES,wt as DEFAULT_TENANT_API_NAMESPACE,_t as DEFAULT_TENANT_UI_NAMESPACE,ne as DISCOVERED_COOKIE_PREFIX,We as DISPLAY_COOKIE_SUFFIX,V as DISPLAY_COOKIE_VERSION,Oe as ECID_SCHEME,O as EcidFormatError,M as FORM_MEDIA_TYPE,e as ION_AUTHZ_GROUP_SCHEMA,Re as ION_AUTHZ_OAA_SYNC,Te as ION_CAPABILITIEZ_READ,we as ION_CIAM_MAGIC_LINK_CREATE,Je as ION_ENDPOINT_PERMISSIONS,Ce as ION_IAM_ACCESS_REQUESTS_WRITE,be as ION_IAM_CUSTOMERS_WRITE,Se as ION_IAM_GROUPS_WRITE,ye as ION_IAM_READ,he as ION_IAM_USERS_WRITE,ke as ION_IAM_WORKLOADS_WRITE,C as ION_SCIM_CUSTOMER_SCHEMA,d as ION_SCIM_USER_EXTENSION_URN,b as ION_SCIM_WORKLOAD_SCHEMA,ie as ION_SDK_PERMISSIONS,Ae as ION_TENANT_MANAGE,r as IoniteError,o as JSON_MEDIA_TYPE,v as KNOWN_BASE_CUSTOMER_KEYS,I as KNOWN_BASE_USER_KEYS,l as KNOWN_ENTITLEMENT_KEYS,x as KNOWN_WORKLOAD_KEYS,ve as OCTET_STREAM_MEDIA_TYPE,y as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,He as SCIM_MEDIA_TYPE,Pt as SecretContentTypeMismatchError,A as StoreConflictError,Ie as XML_MEDIA_TYPE,n as accessRefId,m as accessRootId,D as assertEcid,Q as assertRequiredSubjectType,E as assertValidSubjectTypeScoping,Lt as buildTenantPath,no as buildTenantUrl,K as catalogEntityStore,H as claimsToUser,U as compareDisplayExpiryDesc,Et as configSourceOriginLogFields,Le as configTrustedClientGrants,i as customAttributes,pe as customerResourceSchema,Ht as debugLogger,_e as decodeDisplayCookie,st as decodeUser,k as deepEqualPlain,fe as defaultDisplayUser,Gt as defaultLogger,eo as defaultSecretContentType,Ue as defineCatalog,Rt as defineSecretType,ee as deprecateRetiredCodeCatalogRows,Ut as describeOriginUrl,F as discoveredProfileCookieName,B as encodeDisplayCookie,X as errorLogAttributes,Ge as formatEcid,ft as formatLogLine,mo as generateULID,L as getCodeCatalogEntity,ct as groupResourceSchema,h as idTokenClaimsSchema,Yt as infoLogger,Pe as isCodeCatalog,xe as isConfigLocator,$t as isConfigSourceError,De as isEcid,Me as isJsonResponse,j as isStoreConflictError,so as jwtAssertionClaimsSchema,N as list,u as listGenerator,oo as matchTenantHost,ro as matchTenantPath,$e as matchesListFilter,q as materializeCodeCatalogEntity,T as mergeCodeCatalogEntity,et as mergeConfig,t as must,Tt as normalizeTenantBaseDomain,yt as normalizeTenantPathNamespace,Dt as normalizeTenantRoutingStrategy,ae as oidcCallbackSchema,Fe as parseEcid,tt as parseJsonc,zt as parseKmsPoolControlDocument,Vt as parseKmsPoolDocument,Xt as prettyLogger,_ as profileCookieName,f as projectDisplayUser,G as readDisplayCookies,c as readJsonResponse,Qt as readyCatalogEntry,to as remoteConfigSecretType,z as resolveDiscoveredCookieMax,se as resolveDiscoveredCookieTtlSeconds,re as resolveDisplayCookieMax,ge as sanitizeDisplayUser,Ft as serializeConfig,xt as silentLogger,nt as stableConfigHash,je as stripJsonComments,ot as tmIntegrationState,Ke as toCodeCatalog,ce as tokenResponseSchema,R as trimTrailingSlash,Y as trustedClientPermissionsForPrincipal,J as unexpectedBodySummary,W as unionCatalogRead,at as userSchema,de as validationFailureResponse,Nt as version,rt as waitOn,Jt as warnLogger,p as withValidate,le as workloadResourceSchema,io as workloadTokenResponseSchema};
+import{Y,Le,l,I,v,x,i,r,X,N,u,$e,Z,g,e,y,E,Q,Ee,Pe,Ke,Ue,L,K,T,q,ee,W,n,m,We,V,Ve,ze,Be,ne,re,z,se,fe,ge,f,B,_e,G,U,_,F,Oe,O,De,Ge,Fe,D,ye,he,Se,ke,be,Ce,Te,we,Re,Ae,ie,Je,ae,ce,h,o,He,M,Ie,ve,a,ue,Ye,Xe,s,w,S,Ze,Qe,Me,J,c,p,t,de,et,je,tt,R,k,nt,rt,H,st,A,j,xe,ot,d,b,C,at,ct,le,pe}from"./shared/core-jcvkk7kx.js";var Nt="0.0.24-beta.20261007.24";class Ct extends r{constructor(P,te){let oe=te.kind==="connection"||te.kind==="timeout"||te.kind==="not_found";super(P,{cause:te.cause,status:oe?503:500,upstreamStatus:te.status});this.name="ConfigSourceError";this.kind=te.kind,this.recoverable=te.recoverable,this.code=te.code,this.path=te.path,this.sourceType=te.sourceType}}function $t(P){return P instanceof Ct}function Ut(P){let te=P?.trim();if(!te)return;try{let oe=new URL(te),me=oe.pathname.replace(/\/+$/g,"");return`${oe.protocol}//${oe.host}${me}`}catch{return}}function Et(P,te="ion.config.source"){if(!P)return{};let oe={[`${te}.type`]:P.type};if(P.transport)oe[`${te}.transport`]=P.transport;if(P.url)oe[`${te}.url`]=P.url;if(P.path)oe[`${te}.path`]=P.path;if(P.from)Object.assign(oe,Et(P.from,`${te}.from`));return oe}var Wt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function At(P){if(P===null||typeof P!=="object")return P;let te={};for(let[oe,me]of Object.entries(P)){if(Wt.includes(oe)||oe==="validators"||oe==="setStores")continue;te[oe]=me!==null&&typeof me==="object"&&!Array.isArray(me)&&Object.getPrototypeOf(me)===Object.prototype?At(me):me}return te}function Ft(P){return At(P)}function St(P,te){if(!P||typeof P!=="object"||Array.isArray(P))throw Error(`${te} must be an object.`);return P}function dt(P,te){if(P===void 0)return;if(typeof P!=="string"||P.length===0||!Number.isFinite(Date.parse(P)))throw Error(`${te} must be a valid timestamp string.`);return P}function ht(P,te,oe){if(!Array.isArray(P)||!oe.allowEmpty&&P.length===0)throw Error(`${te} keys must be ${oe.allowEmpty?"an":"a non-empty"} array.`);let me=new Set;return P.map((qe,Ne)=>{let it=St(qe,`${te} keys[${Ne}]`);if(typeof it.id!=="string"||it.id.length===0)throw Error(`${te} keys[${Ne}].id must be a non-empty string.`);if(me.has(it.id))throw Error(`${te} contains duplicate key id "${it.id}".`);if(me.add(it.id),!["pending","active","deprecated","rotated","revoked"].includes(String(it.state)))throw Error(`${te} keys[${Ne}].state is invalid.`);if(it.value!==void 0&&(typeof it.value!=="string"||it.value.length===0))throw Error(`${te} keys[${Ne}].value must be a non-empty string when present.`);let mt=it.meta===void 0?void 0:St(it.meta,`${te} keys[${Ne}].meta`);return{id:it.id,state:it.state,...it.value===void 0?{}:{value:it.value},...it.notBefore===void 0?{}:{notBefore:dt(it.notBefore,`${te} keys[${Ne}].notBefore`)},...it.notAfter===void 0?{}:{notAfter:dt(it.notAfter,`${te} keys[${Ne}].notAfter`)},...it.createdAt===void 0?{}:{createdAt:dt(it.createdAt,`${te} keys[${Ne}].createdAt`)},...it.activatedAt===void 0?{}:{activatedAt:dt(it.activatedAt,`${te} keys[${Ne}].activatedAt`)},...it.deprecatedAt===void 0?{}:{deprecatedAt:dt(it.deprecatedAt,`${te} keys[${Ne}].deprecatedAt`)},...it.rotatedAt===void 0?{}:{rotatedAt:dt(it.rotatedAt,`${te} keys[${Ne}].rotatedAt`)},...it.revokedAt===void 0?{}:{revokedAt:dt(it.revokedAt,`${te} keys[${Ne}].revokedAt`)},...mt?{meta:{...mt}}:{}}})}function qt(P,te,oe){if(P===void 0)return;if(!Array.isArray(P))throw Error(`${oe} slots must be an array.`);let me=new Set,qe=P.map((Ne,it)=>{if(Ne===null)return null;if(typeof Ne!=="string"||Ne.length===0)throw Error(`${oe} slots[${it}] must be a non-empty key id or null.`);if(me.has(Ne))throw Error(`${oe} slots contain duplicate key id "${Ne}".`);me.add(Ne);let mt=te.find((pt)=>pt.id===Ne);if(!mt)throw Error(`${oe} slot key "${Ne}" is not present in keys.`);if(mt.state!=="active")throw Error(`${oe} slot key "${Ne}" must have state "active".`);if(!mt.value)throw Error(`${oe} slot key "${Ne}" must include a value.`);return Ne});if(te.length===0&&qe.some((Ne)=>Ne!==null))throw Error(`${oe} slots must be omitted or all-null when keys is empty.`);return qe}function Vt(P){let oe=St(P,"KMS pool");if(oe.kind!=="kms")throw Error('KMS pool kind must be "kms".');let me=ht(oe.keys,"KMS pool",{allowEmpty:!0}),qe=qt(oe.slots,me,"KMS pool");return qe?{kind:"kms",slots:qe,keys:me}:{kind:"kms",keys:me}}function zt(P){let oe=St(P,"KMS pool control document");if(oe.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:ht(oe.keys,"KMS pool control document",{allowEmpty:!0})}}var jt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function bt(P){if(typeof P==="string")return P;try{return JSON.stringify(P)??String(P)}catch{return String(P)}}function gt(P){let te=bt(P);return/^[A-Za-z0-9_./:@+|-]+$/.test(te)?te:JSON.stringify(te)}function Bt(P){return bt(P).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function It(P,te,oe){if(oe==null)return;if(oe instanceof Error){let me=X(oe);if(me){for(let[qe,Ne]of Object.entries(me))if(Ne!=null)P.push(`${qe}=${gt(Ne)}`);return}if(P.push(`${te}.name=${gt(oe.name)}`),P.push(`${te}.message=${gt(oe.message)}`),oe.stack)P.push(`${te}.stack=${gt(oe.stack)}`);return}P.push(`${te}=${gt(oe)}`)}function ft(P,te,oe=[],me=new Date){let qe=Bt(te instanceof Error?te.message:te??""),Ne=[];for(let[it,mt]of oe.entries()){if(mt&&typeof mt==="object"&&!Array.isArray(mt)&&!(mt instanceof Error)&&Object.getPrototypeOf(mt)===Object.prototype){for(let[pt,lt]of Object.entries(mt))It(Ne,pt,lt);continue}It(Ne,`param.${it}`,mt)}return[me.toISOString(),jt[P],qe,...Ne].filter(Boolean).join(" ")}var xt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Gt=xt,Ht={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Yt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Jt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Xt={trace:()=>{},debug:(P,...te)=>globalThis.console.debug(ft("debug",P,te)),info:(P,...te)=>globalThis.console.info(ft("info",P,te)),warn:(P,...te)=>globalThis.console.warn(ft("warn",P,te)),error:(P,...te)=>globalThis.console.error(ft("error",P,te))};function Zt(P,te){if(typeof te!=="number"||te<=0)return P;return new Promise((oe,me)=>{let qe=setTimeout(()=>{me(Error(`Authz catalog entry did not become ready within ${te}ms`))},te);P.then(()=>{clearTimeout(qe),oe()},(Ne)=>{clearTimeout(qe),me(Ne)})})}function Qt(P,te){let oe=!1,me,qe=te.then(()=>{oe=!0},(it)=>{oe=!1,me=it}),Ne=P;return Object.defineProperty(Ne,"ready",{enumerable:!1,configurable:!0,value:(it)=>Zt(qe.then(()=>{if(!oe)throw me}),it)}),Object.defineProperty(Ne,"isReady",{enumerable:!1,configurable:!0,value:()=>oe}),Ne}var kt=Object.freeze({jsonc:o,env:"text/x-dotenv",text:"text/plain",binary:ve,yaml:"application/yaml",toml:"application/toml",xml:Ie});function Rt(P){if(!P.id.trim())throw Error("defineSecretType: id is required");let te=P.mimeType?.trim()||kt[P.format],oe=Object.freeze({id:P.id,...P.label?{label:P.label}:{},format:P.format,mimeType:te,...P.schemaUrl?{schemaUrl:P.schemaUrl}:{},typeId:P.id});return Object.freeze({id:P.id,...P.label?{label:P.label}:{},format:P.format,mimeType:te,...P.schemaUrl?{schemaUrl:P.schemaUrl}:{},...P.schema?{schema:P.schema}:{},toRegistryEntry:()=>oe})}function eo(P="jsonc"){return{format:P,mimeType:kt[P],typeId:P}}class Pt extends r{constructor(P,te){super(`Secret content type mismatch: expected "${P.mimeType}" (${P.format}) but received "${te.mimeType}" (${te.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=P,this.received=te}}var to=Rt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var _t={beforeTenantSegments:["ui"]},vt={beforeTenantSegments:["api"]};function Ot(P){return(P??[]).map((te)=>te.trim()).filter(Boolean)}function wt(P){let te=P.trim();if(!te)return"/";let oe=te.replace(/\\/g,"/").replace(/\/+/g,"/");return oe.startsWith("/")?oe:`/${oe}`}function Kt(P){return wt(P).split("/").filter(Boolean)}function yt(P){return{beforeTenantSegments:Ot(P?.beforeTenantSegments),afterTenantSegments:Ot(P?.afterTenantSegments)}}function Dt(P){if(P?.type==="host")return{type:"host",baseDomain:Tt(P.baseDomain)};if(P?.type==="selector")return P;return{type:"path",ui:yt(P?.ui??_t),api:yt(P?.api??vt)}}function Tt(P){let te=P.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!te)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return te}function oo(P,te){let oe=P.trim().replace(/\.$/,"").toLowerCase(),me=Tt(te);if(!oe.endsWith(`.${me}`))return null;let qe=oe.slice(0,-(me.length+1));if(!qe||qe.includes("."))return null;return{id:qe}}function ro(P,te){let oe=yt(te),me=oe.beforeTenantSegments??[],qe=oe.afterTenantSegments??[],Ne=Kt(P),it=me.length+1+qe.length;if(Ne.length<it)return null;for(let ut=0;ut<me.length;ut++)if(Ne[ut]!==me[ut])return null;let mt=me.length,pt=Ne[mt];if(!pt)return null;for(let ut=0;ut<qe.length;ut++)if(Ne[mt+1+ut]!==qe[ut])return null;let lt=Ne.slice(mt+1+qe.length);return{id:decodeURIComponent(pt),restSegments:lt,restPath:lt.length>0?`/${lt.join("/")}`:"/"}}function Mt(P,te="/",oe){let me=yt(oe),qe=me.beforeTenantSegments??[],Ne=me.afterTenantSegments??[],it=Kt(te),mt=[...qe,encodeURIComponent(P),...Ne,...it];return mt.length>0?`/${mt.join("/")}`:"/"}function no(P,te="/",oe,me="ui"){let qe=Dt(oe);if(qe.type==="host"||qe.type==="selector")return wt(te);return Mt(P,te,qe[me])}function so(P){return{"~standard":{version:1,vendor:P,validate:(te)=>{if(typeof te!=="object"||te===null)return{issues:[{message:"Expected an object"}]};let oe=te,me=[],qe={...oe},Ne=["iss","sub"];for(let pt of Ne)if(pt in oe){if(typeof oe[pt]!=="string")me.push({message:`${pt} must be a string`,path:[pt]})}else me.push({message:`${pt} is required`,path:[pt]});if("aud"in oe&&oe.aud!==void 0){let pt=oe.aud;if(typeof pt!=="string"&&!Array.isArray(pt))me.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(pt)&&!pt.every((lt)=>typeof lt==="string"))me.push({message:"aud array must contain only strings",path:["aud"]})}let it=["jti","scope"];for(let pt of it)if(pt in oe&&oe[pt]!==void 0){if(typeof oe[pt]!=="string")me.push({message:`${pt} must be a string`,path:[pt]})}let mt=["exp","iat"];for(let pt of mt)if(pt in oe){if(typeof oe[pt]!=="number")me.push({message:`${pt} must be a number`,path:[pt]})}else me.push({message:`${pt} is required`,path:[pt]});if(me.length>0)return{issues:me};return{value:qe}}}}}function io(P){return{"~standard":{version:1,vendor:P,validate:(te)=>{if(typeof te!=="object"||te===null)return{issues:[{message:"Expected an object"}]};let oe=te,me=[],qe={};if("access_token"in oe)if(typeof oe.access_token==="string")qe.access_token=oe.access_token;else me.push({message:"access_token must be a string",path:["access_token"]});else me.push({message:"access_token is required",path:["access_token"]});if("token_type"in oe)if(typeof oe.token_type==="string")qe.token_type=oe.token_type;else me.push({message:"token_type must be a string",path:["token_type"]});else me.push({message:"token_type is required",path:["token_type"]});if("scope"in oe)if(typeof oe.scope==="string"||oe.scope===void 0)qe.scope=oe.scope;else me.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in oe)if(typeof oe.refresh_token==="string"||oe.refresh_token===void 0)qe.refresh_token=oe.refresh_token;else me.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in oe)if(typeof oe.expires==="string"||oe.expires===void 0)qe.expires=oe.expires;else me.push({message:"expires must be a string",path:["expires"]});if("expires_in"in oe)if(typeof oe.expires_in==="number"||oe.expires_in===void 0)qe.expires_in=oe.expires_in;else me.push({message:"expires_in must be a number",path:["expires_in"]});if(me.length>0)return{issues:me};return{value:qe}}}}}function ao(P){let te=new Uint8Array(P);return crypto.getRandomValues(te),te}function po(P){let te="",oe=ao(P);for(let me=0;me<P;me++){let qe=oe[me]%32;te+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(qe)}return te}function co(P,te){let oe="";for(let me=te;me>0;me--){let qe=P%32;oe="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(qe)+oe,P=Math.floor(P/32)}return oe}function mo(P){let te=Date.now(),oe=co(te,10),me=po(16);return`${P??""}${oe}${me}`}export{a as ACCEPT_JSON,Xe as ACCEPT_OCTET_STREAM,ue as ACCEPT_SCIM,Ye as ACCEPT_XML,Ee as AssignmentPolicyError,Z as CANONICAL_RISK_LEVELS,S as CONTENT_TYPE_FORM,s as CONTENT_TYPE_JSON,Qe as CONTENT_TYPE_OCTET_STREAM,w as CONTENT_TYPE_SCIM,Ze as CONTENT_TYPE_XML,Ct as ConfigSourceError,ze as DEFAULT_DISCOVERED_COOKIE_MAX,Be as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Ve as DEFAULT_DISPLAY_COOKIE_MAX,g as DEFAULT_RISK_LEVEL,kt as DEFAULT_SECRET_MIME_TYPES,vt as DEFAULT_TENANT_API_NAMESPACE,_t as DEFAULT_TENANT_UI_NAMESPACE,ne as DISCOVERED_COOKIE_PREFIX,We as DISPLAY_COOKIE_SUFFIX,V as DISPLAY_COOKIE_VERSION,Oe as ECID_SCHEME,O as EcidFormatError,M as FORM_MEDIA_TYPE,e as ION_AUTHZ_GROUP_SCHEMA,Re as ION_AUTHZ_OAA_SYNC,Te as ION_CAPABILITIEZ_READ,we as ION_CIAM_MAGIC_LINK_CREATE,Je as ION_ENDPOINT_PERMISSIONS,Ce as ION_IAM_ACCESS_REQUESTS_WRITE,be as ION_IAM_CUSTOMERS_WRITE,Se as ION_IAM_GROUPS_WRITE,ye as ION_IAM_READ,he as ION_IAM_USERS_WRITE,ke as ION_IAM_WORKLOADS_WRITE,C as ION_SCIM_CUSTOMER_SCHEMA,d as ION_SCIM_USER_EXTENSION_URN,b as ION_SCIM_WORKLOAD_SCHEMA,ie as ION_SDK_PERMISSIONS,Ae as ION_TENANT_MANAGE,r as IoniteError,o as JSON_MEDIA_TYPE,v as KNOWN_BASE_CUSTOMER_KEYS,I as KNOWN_BASE_USER_KEYS,l as KNOWN_ENTITLEMENT_KEYS,x as KNOWN_WORKLOAD_KEYS,ve as OCTET_STREAM_MEDIA_TYPE,y as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,He as SCIM_MEDIA_TYPE,Pt as SecretContentTypeMismatchError,A as StoreConflictError,Ie as XML_MEDIA_TYPE,n as accessRefId,m as accessRootId,D as assertEcid,Q as assertRequiredSubjectType,E as assertValidSubjectTypeScoping,Mt as buildTenantPath,no as buildTenantUrl,K as catalogEntityStore,H as claimsToUser,U as compareDisplayExpiryDesc,Et as configSourceOriginLogFields,Le as configTrustedClientGrants,i as customAttributes,pe as customerResourceSchema,Ht as debugLogger,_e as decodeDisplayCookie,st as decodeUser,k as deepEqualPlain,fe as defaultDisplayUser,Gt as defaultLogger,eo as defaultSecretContentType,Ue as defineCatalog,Rt as defineSecretType,ee as deprecateRetiredCodeCatalogRows,Ut as describeOriginUrl,F as discoveredProfileCookieName,B as encodeDisplayCookie,X as errorLogAttributes,Ge as formatEcid,ft as formatLogLine,mo as generateULID,L as getCodeCatalogEntity,ct as groupResourceSchema,h as idTokenClaimsSchema,Yt as infoLogger,Pe as isCodeCatalog,xe as isConfigLocator,$t as isConfigSourceError,De as isEcid,Me as isJsonResponse,j as isStoreConflictError,so as jwtAssertionClaimsSchema,N as list,u as listGenerator,oo as matchTenantHost,ro as matchTenantPath,$e as matchesListFilter,q as materializeCodeCatalogEntity,T as mergeCodeCatalogEntity,et as mergeConfig,t as must,Tt as normalizeTenantBaseDomain,yt as normalizeTenantPathNamespace,Dt as normalizeTenantRoutingStrategy,ae as oidcCallbackSchema,Fe as parseEcid,tt as parseJsonc,zt as parseKmsPoolControlDocument,Vt as parseKmsPoolDocument,Xt as prettyLogger,_ as profileCookieName,f as projectDisplayUser,G as readDisplayCookies,c as readJsonResponse,Qt as readyCatalogEntry,to as remoteConfigSecretType,z as resolveDiscoveredCookieMax,se as resolveDiscoveredCookieTtlSeconds,re as resolveDisplayCookieMax,ge as sanitizeDisplayUser,Ft as serializeConfig,xt as silentLogger,nt as stableConfigHash,je as stripJsonComments,ot as tmIntegrationState,Ke as toCodeCatalog,ce as tokenResponseSchema,R as trimTrailingSlash,Y as trustedClientPermissionsForPrincipal,J as unexpectedBodySummary,W as unionCatalogRead,at as userSchema,de as validationFailureResponse,Nt as version,rt as waitOn,Jt as warnLogger,p as withValidate,le as workloadResourceSchema,io as workloadTokenResponseSchema};