@ionite/core 0.0.24-beta.20261009.27 → 0.0.24-beta.20261010.28
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +12 -1
- package/dist/index.js +2 -2
- package/dist/server.d.ts +3 -0
- package/dist/server.js +1 -1
- package/dist/shared/core-xm7tmw7a.js +4 -0
- package/package.json +1 -1
- package/dist/shared/core-c116edxs.js +0 -4
package/dist/index.d.ts
CHANGED
|
@@ -1839,6 +1839,17 @@ type IAMProviderConfig = {
|
|
|
1839
1839
|
iconUrl?: string;
|
|
1840
1840
|
};
|
|
1841
1841
|
};
|
|
1842
|
+
/**
|
|
1843
|
+
* The name Entra uses for the ion User extension. Entra's SCIM client sends a custom extension in create
|
|
1844
|
+
* POSTs only when it is named `urn:ietf:params:scim:schemas:extension:<Name>:2.0:User`; it omits
|
|
1845
|
+
* `ION_SCIM_USER_EXTENSION_URN` from creates and sends it only on later PATCHes, so an Entra-provisioned
|
|
1846
|
+
* account would arrive without its ECID until the next sync. Measured in the iosite sandbox. Map Entra
|
|
1847
|
+
* attributes to this name; the `entra` preset translates it to the canonical URN inbound and back on
|
|
1848
|
+
* responses, so Entra's GET-based drift check compares like with like. Entra-only: `urn:ietf:params:scim:`
|
|
1849
|
+
* is IANA-managed (RFC 7643 §10) and not part of the general contract.
|
|
1850
|
+
* https://learn.microsoft.com/entra/identity/app-provisioning/customize-application-attributes
|
|
1851
|
+
*/
|
|
1852
|
+
declare const ENTRA_ION_EXTENSION_URN = "urn:ietf:params:scim:schemas:extension:ionite:2.0:User";
|
|
1842
1853
|
type ChangeListener = () => void;
|
|
1843
1854
|
/**
|
|
1844
1855
|
* Reactive source/adapter contract. Implemented by config-source-backed adapters
|
|
@@ -7223,4 +7234,4 @@ type LfvErrorResponse = {
|
|
|
7223
7234
|
};
|
|
7224
7235
|
/** Generates a ULID */
|
|
7225
7236
|
declare function generateULID(prefix?: string): string;
|
|
7226
|
-
export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
|
|
7237
|
+
export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
|
package/dist/index.js
CHANGED
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
import{
|
|
2
|
-
`,"\\n")}function It(P,te,oe){if(oe==null)return;if(oe instanceof Error){let me=X(oe);if(me){for(let[Ne,Ke]of Object.entries(me))if(Ke!=null)P.push(`${Ne}=${gt(Ke)}`);return}if(P.push(`${te}.name=${gt(oe.name)}`),P.push(`${te}.message=${gt(oe.message)}`),oe.stack)P.push(`${te}.stack=${gt(oe.stack)}`);return}P.push(`${te}=${gt(oe)}`)}function ft(P,te,oe=[],me=new Date){let Ne=Bt(te instanceof Error?te.message:te??""),Ke=[];for(let[it,mt]of oe.entries()){if(mt&&typeof mt==="object"&&!Array.isArray(mt)&&!(mt instanceof Error)&&Object.getPrototypeOf(mt)===Object.prototype){for(let[pt,lt]of Object.entries(mt))It(Ke,pt,lt);continue}It(Ke,`param.${it}`,mt)}return[me.toISOString(),jt[P],Ne,...Ke].filter(Boolean).join(" ")}var xt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Gt=xt,Ht={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Yt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Jt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Xt={trace:()=>{},debug:(P,...te)=>globalThis.console.debug(ft("debug",P,te)),info:(P,...te)=>globalThis.console.info(ft("info",P,te)),warn:(P,...te)=>globalThis.console.warn(ft("warn",P,te)),error:(P,...te)=>globalThis.console.error(ft("error",P,te))};function Zt(P,te){if(typeof te!=="number"||te<=0)return P;return new Promise((oe,me)=>{let Ne=setTimeout(()=>{me(Error(`Authz catalog entry did not become ready within ${te}ms`))},te);P.then(()=>{clearTimeout(Ne),oe()},(Ke)=>{clearTimeout(Ne),me(Ke)})})}function Qt(P,te){let oe=!1,me,Ne=te.then(()=>{oe=!0},(it)=>{oe=!1,me=it}),Ke=P;return Object.defineProperty(Ke,"ready",{enumerable:!1,configurable:!0,value:(it)=>Zt(Ne.then(()=>{if(!oe)throw me}),it)}),Object.defineProperty(Ke,"isReady",{enumerable:!1,configurable:!0,value:()=>oe}),Ke}var kt=Object.freeze({jsonc:o,env:"text/x-dotenv",text:"text/plain",binary:ve,yaml:"application/yaml",toml:"application/toml",xml:Ie});function Tt(P){if(!P.id.trim())throw Error("defineSecretType: id is required");let te=P.mimeType?.trim()||kt[P.format],oe=Object.freeze({id:P.id,...P.label?{label:P.label}:{},format:P.format,mimeType:te,...P.schemaUrl?{schemaUrl:P.schemaUrl}:{},typeId:P.id});return Object.freeze({id:P.id,...P.label?{label:P.label}:{},format:P.format,mimeType:te,...P.schemaUrl?{schemaUrl:P.schemaUrl}:{},...P.schema?{schema:P.schema}:{},toRegistryEntry:()=>oe})}function eo(P="jsonc"){return{format:P,mimeType:kt[P],typeId:P}}class Pt extends n{constructor(P,te){super(`Secret content type mismatch: expected "${P.mimeType}" (${P.format}) but received "${te.mimeType}" (${te.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=P,this.received=te}}var to=Tt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var _t={beforeTenantSegments:["ui"]},vt={beforeTenantSegments:["api"]};function Ot(P){return(P??[]).map((te)=>te.trim()).filter(Boolean)}function wt(P){let te=P.trim();if(!te)return"/";let oe=te.replace(/\\/g,"/").replace(/\/+/g,"/");return oe.startsWith("/")?oe:`/${oe}`}function Kt(P){return wt(P).split("/").filter(Boolean)}function yt(P){return{beforeTenantSegments:Ot(P?.beforeTenantSegments),afterTenantSegments:Ot(P?.afterTenantSegments)}}function Dt(P){if(P?.type==="host")return{type:"host",baseDomain:Rt(P.baseDomain)};if(P?.type==="selector")return P;return{type:"path",ui:yt(P?.ui??_t),api:yt(P?.api??vt)}}function Rt(P){let te=P.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!te)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return te}function oo(P,te){let oe=P.trim().replace(/\.$/,"").toLowerCase(),me=Rt(te);if(!oe.endsWith(`.${me}`))return null;let Ne=oe.slice(0,-(me.length+1));if(!Ne||Ne.includes("."))return null;return{id:Ne}}function ro(P,te){let oe=yt(te),me=oe.beforeTenantSegments??[],Ne=oe.afterTenantSegments??[],Ke=Kt(P),it=me.length+1+Ne.length;if(Ke.length<it)return null;for(let ut=0;ut<me.length;ut++)if(Ke[ut]!==me[ut])return null;let mt=me.length,pt=Ke[mt];if(!pt)return null;for(let ut=0;ut<Ne.length;ut++)if(Ke[mt+1+ut]!==Ne[ut])return null;let lt=Ke.slice(mt+1+Ne.length);return{id:decodeURIComponent(pt),restSegments:lt,restPath:lt.length>0?`/${lt.join("/")}`:"/"}}function Mt(P,te="/",oe){let me=yt(oe),Ne=me.beforeTenantSegments??[],Ke=me.afterTenantSegments??[],it=Kt(te),mt=[...Ne,encodeURIComponent(P),...Ke,...it];return mt.length>0?`/${mt.join("/")}`:"/"}function no(P,te="/",oe,me="ui"){let Ne=Dt(oe);if(Ne.type==="host"||Ne.type==="selector")return wt(te);return Mt(P,te,Ne[me])}function so(P){return{"~standard":{version:1,vendor:P,validate:(te)=>{if(typeof te!=="object"||te===null)return{issues:[{message:"Expected an object"}]};let oe=te,me=[],Ne={...oe},Ke=["iss","sub"];for(let pt of Ke)if(pt in oe){if(typeof oe[pt]!=="string")me.push({message:`${pt} must be a string`,path:[pt]})}else me.push({message:`${pt} is required`,path:[pt]});if("aud"in oe&&oe.aud!==void 0){let pt=oe.aud;if(typeof pt!=="string"&&!Array.isArray(pt))me.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(pt)&&!pt.every((lt)=>typeof lt==="string"))me.push({message:"aud array must contain only strings",path:["aud"]})}let it=["jti","scope"];for(let pt of it)if(pt in oe&&oe[pt]!==void 0){if(typeof oe[pt]!=="string")me.push({message:`${pt} must be a string`,path:[pt]})}let mt=["exp","iat"];for(let pt of mt)if(pt in oe){if(typeof oe[pt]!=="number")me.push({message:`${pt} must be a number`,path:[pt]})}else me.push({message:`${pt} is required`,path:[pt]});if(me.length>0)return{issues:me};return{value:Ne}}}}}function io(P){return{"~standard":{version:1,vendor:P,validate:(te)=>{if(typeof te!=="object"||te===null)return{issues:[{message:"Expected an object"}]};let oe=te,me=[],Ne={};if("access_token"in oe)if(typeof oe.access_token==="string")Ne.access_token=oe.access_token;else me.push({message:"access_token must be a string",path:["access_token"]});else me.push({message:"access_token is required",path:["access_token"]});if("token_type"in oe)if(typeof oe.token_type==="string")Ne.token_type=oe.token_type;else me.push({message:"token_type must be a string",path:["token_type"]});else me.push({message:"token_type is required",path:["token_type"]});if("scope"in oe)if(typeof oe.scope==="string"||oe.scope===void 0)Ne.scope=oe.scope;else me.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in oe)if(typeof oe.refresh_token==="string"||oe.refresh_token===void 0)Ne.refresh_token=oe.refresh_token;else me.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in oe)if(typeof oe.expires==="string"||oe.expires===void 0)Ne.expires=oe.expires;else me.push({message:"expires must be a string",path:["expires"]});if("expires_in"in oe)if(typeof oe.expires_in==="number"||oe.expires_in===void 0)Ne.expires_in=oe.expires_in;else me.push({message:"expires_in must be a number",path:["expires_in"]});if(me.length>0)return{issues:me};return{value:Ne}}}}}function ao(P){let te=new Uint8Array(P);return crypto.getRandomValues(te),te}function po(P){let te="",oe=ao(P);for(let me=0;me<P;me++){let Ne=oe[me]%32;te+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Ne)}return te}function co(P,te){let oe="";for(let me=te;me>0;me--){let Ne=P%32;oe="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Ne)+oe,P=Math.floor(P/32)}return oe}function mo(P){let te=Date.now(),oe=co(te,10),me=po(16);return`${P??""}${oe}${me}`}export{a as ACCEPT_JSON,Xe as ACCEPT_OCTET_STREAM,ue as ACCEPT_SCIM,Ye as ACCEPT_XML,Ee as AssignmentPolicyError,Z as CANONICAL_RISK_LEVELS,S as CONTENT_TYPE_FORM,s as CONTENT_TYPE_JSON,Qe as CONTENT_TYPE_OCTET_STREAM,w as CONTENT_TYPE_SCIM,Ze as CONTENT_TYPE_XML,Ct as ConfigSourceError,ze as DEFAULT_DISCOVERED_COOKIE_MAX,Be as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Ve as DEFAULT_DISPLAY_COOKIE_MAX,g as DEFAULT_RISK_LEVEL,kt as DEFAULT_SECRET_MIME_TYPES,vt as DEFAULT_TENANT_API_NAMESPACE,_t as DEFAULT_TENANT_UI_NAMESPACE,ne as DISCOVERED_COOKIE_PREFIX,We as DISPLAY_COOKIE_SUFFIX,V as DISPLAY_COOKIE_VERSION,Oe as ECID_SCHEME,O as EcidFormatError,M as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,Re as ION_AUTHZ_OAA_SYNC,Ce as ION_CAPABILITIEZ_READ,we as ION_CIAM_MAGIC_LINK_CREATE,He as ION_ENDPOINT_PERMISSIONS,Te as ION_IAM_ACCESS_REQUESTS_WRITE,be as ION_IAM_CUSTOMERS_WRITE,Se as ION_IAM_GROUPS_WRITE,ye as ION_IAM_READ,he as ION_IAM_USERS_WRITE,ke as ION_IAM_WORKLOADS_WRITE,T as ION_SCIM_CUSTOMER_SCHEMA,d as ION_SCIM_USER_EXTENSION_URN,b as ION_SCIM_WORKLOAD_SCHEMA,ie as ION_SDK_PERMISSIONS,Ae as ION_TENANT_MANAGE,n as IoniteError,o as JSON_MEDIA_TYPE,v as KNOWN_BASE_CUSTOMER_KEYS,I as KNOWN_BASE_USER_KEYS,l as KNOWN_ENTITLEMENT_KEYS,x as KNOWN_WORKLOAD_KEYS,ve as OCTET_STREAM_MEDIA_TYPE,y as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,Je as SCIM_MEDIA_TYPE,Pt as SecretContentTypeMismatchError,A as StoreConflictError,Ie as XML_MEDIA_TYPE,r as accessRefId,m as accessRootId,D as assertEcid,Q as assertRequiredSubjectType,E as assertValidSubjectTypeScoping,Mt as buildTenantPath,no as buildTenantUrl,q as catalogEntityStore,J as claimsToUser,U as compareDisplayExpiryDesc,Et as configSourceOriginLogFields,Le as configTrustedClientGrants,i as customAttributes,pe as customerResourceSchema,Ht as debugLogger,_e as decodeDisplayCookie,st as decodeUser,k as deepEqualPlain,fe as defaultDisplayUser,Gt as defaultLogger,eo as defaultSecretContentType,Ue as defineCatalog,Tt as defineSecretType,ee as deprecateRetiredCodeCatalogRows,Ut as describeOriginUrl,F as discoveredProfileCookieName,B as encodeDisplayCookie,X as errorLogAttributes,Ge as formatEcid,ft as formatLogLine,mo as generateULID,L as getCodeCatalogEntity,ct as groupResourceSchema,h as idTokenClaimsSchema,Yt as infoLogger,Pe as isCodeCatalog,xe as isConfigLocator,$t as isConfigSourceError,De as isEcid,Me as isJsonResponse,j as isStoreConflictError,so as jwtAssertionClaimsSchema,N as list,c as listGenerator,oo as matchTenantHost,ro as matchTenantPath,$e as matchesListFilter,K as materializeCodeCatalogEntity,C as mergeCodeCatalogEntity,et as mergeConfig,e as must,Rt as normalizeTenantBaseDomain,yt as normalizeTenantPathNamespace,Dt as normalizeTenantRoutingStrategy,ae as oidcCallbackSchema,Fe as parseEcid,tt as parseJsonc,zt as parseKmsPoolControlDocument,Vt as parseKmsPoolDocument,Xt as prettyLogger,_ as profileCookieName,f as projectDisplayUser,G as readDisplayCookies,u as readJsonResponse,Qt as readyCatalogEntry,to as remoteConfigSecretType,z as resolveDiscoveredCookieMax,se as resolveDiscoveredCookieTtlSeconds,re as resolveDisplayCookieMax,ge as sanitizeDisplayUser,Ft as serializeConfig,xt as silentLogger,nt as stableConfigHash,je as stripJsonComments,ot as tmIntegrationState,qe as toCodeCatalog,ce as tokenResponseSchema,R as trimTrailingSlash,Y as trustedClientPermissionsForPrincipal,H as unexpectedBodySummary,W as unionCatalogRead,at as userSchema,de as validationFailureResponse,Nt as version,rt as waitOn,Jt as warnLogger,p as withValidate,le as workloadResourceSchema,io as workloadTokenResponseSchema};
|
|
1
|
+
import{Q,Ve,p,v,x,E,c,n,ee,q,d,Be,te,y,t,h,P,ne,Me,je,Ge,Ne,K,z,w,W,re,V,r,f,He,B,Je,Ye,Xe,oe,ie,G,ae,Se,ke,g,F,Le,H,_,O,J,$e,D,qe,Ze,Qe,M,o,S,k,et,tt,de,le,j,Ce,we,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,pe,nt,me,fe,b,a,rt,N,_e,Oe,u,ge,st,ot,i,R,T,it,at,Ke,X,l,m,e,ye,ct,ze,ut,A,C,dt,lt,Z,pt,I,L,De,mt}from"./shared/core-xm7tmw7a.js";var $t="0.0.24-beta.20261010.28";class kt extends n{constructor(s,U){let Y=U.kind==="connection"||U.kind==="timeout"||U.kind==="not_found";super(s,{cause:U.cause,status:Y?503:500,upstreamStatus:U.status});this.name="ConfigSourceError";this.kind=U.kind,this.recoverable=U.recoverable,this.code=U.code,this.path=U.path,this.sourceType=U.sourceType}}function Ut(s){return s instanceof kt}function Wt(s){let U=s?.trim();if(!U)return;try{let Y=new URL(U),se=Y.pathname.replace(/\/+$/g,"");return`${Y.protocol}//${Y.host}${se}`}catch{return}}function At(s,U="ion.config.source"){if(!s)return{};let Y={[`${U}.type`]:s.type};if(s.transport)Y[`${U}.transport`]=s.transport;if(s.url)Y[`${U}.url`]=s.url;if(s.path)Y[`${U}.path`]=s.path;if(s.from)Object.assign(Y,At(s.from,`${U}.from`));return Y}var Ft=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function ht(s){if(s===null||typeof s!=="object")return s;let U={};for(let[Y,se]of Object.entries(s)){if(Ft.includes(Y)||Y==="validators"||Y==="setStores")continue;U[Y]=se!==null&&typeof se==="object"&&!Array.isArray(se)&&Object.getPrototypeOf(se)===Object.prototype?ht(se):se}return U}function qt(s){return ht(s)}function Ct(s,U){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${U} must be an object.`);return s}function gt(s,U){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${U} must be a valid timestamp string.`);return s}function It(s,U,Y){if(!Array.isArray(s)||!Y.allowEmpty&&s.length===0)throw Error(`${U} keys must be ${Y.allowEmpty?"an":"a non-empty"} array.`);let se=new Set;return s.map((ue,ce)=>{let Te=Ct(ue,`${U} keys[${ce}]`);if(typeof Te.id!=="string"||Te.id.length===0)throw Error(`${U} keys[${ce}].id must be a non-empty string.`);if(se.has(Te.id))throw Error(`${U} contains duplicate key id "${Te.id}".`);if(se.add(Te.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Te.state)))throw Error(`${U} keys[${ce}].state is invalid.`);if(Te.value!==void 0&&(typeof Te.value!=="string"||Te.value.length===0))throw Error(`${U} keys[${ce}].value must be a non-empty string when present.`);let be=Te.meta===void 0?void 0:Ct(Te.meta,`${U} keys[${ce}].meta`);return{id:Te.id,state:Te.state,...Te.value===void 0?{}:{value:Te.value},...Te.notBefore===void 0?{}:{notBefore:gt(Te.notBefore,`${U} keys[${ce}].notBefore`)},...Te.notAfter===void 0?{}:{notAfter:gt(Te.notAfter,`${U} keys[${ce}].notAfter`)},...Te.createdAt===void 0?{}:{createdAt:gt(Te.createdAt,`${U} keys[${ce}].createdAt`)},...Te.activatedAt===void 0?{}:{activatedAt:gt(Te.activatedAt,`${U} keys[${ce}].activatedAt`)},...Te.deprecatedAt===void 0?{}:{deprecatedAt:gt(Te.deprecatedAt,`${U} keys[${ce}].deprecatedAt`)},...Te.rotatedAt===void 0?{}:{rotatedAt:gt(Te.rotatedAt,`${U} keys[${ce}].rotatedAt`)},...Te.revokedAt===void 0?{}:{revokedAt:gt(Te.revokedAt,`${U} keys[${ce}].revokedAt`)},...be?{meta:{...be}}:{}}})}function Vt(s,U,Y){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${Y} slots must be an array.`);let se=new Set,ue=s.map((ce,Te)=>{if(ce===null)return null;if(typeof ce!=="string"||ce.length===0)throw Error(`${Y} slots[${Te}] must be a non-empty key id or null.`);if(se.has(ce))throw Error(`${Y} slots contain duplicate key id "${ce}".`);se.add(ce);let be=U.find((he)=>he.id===ce);if(!be)throw Error(`${Y} slot key "${ce}" is not present in keys.`);if(be.state!=="active")throw Error(`${Y} slot key "${ce}" must have state "active".`);if(!be.value)throw Error(`${Y} slot key "${ce}" must include a value.`);return ce});if(U.length===0&&ue.some((ce)=>ce!==null))throw Error(`${Y} slots must be omitted or all-null when keys is empty.`);return ue}function zt(s){let Y=Ct(s,"KMS pool");if(Y.kind!=="kms")throw Error('KMS pool kind must be "kms".');let se=It(Y.keys,"KMS pool",{allowEmpty:!0}),ue=Vt(Y.slots,se,"KMS pool");return ue?{kind:"kms",slots:ue,keys:se}:{kind:"kms",keys:se}}function jt(s){let Y=Ct(s,"KMS pool control document");if(Y.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:It(Y.keys,"KMS pool control document",{allowEmpty:!0})}}var Bt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function xt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function ft(s){let U=xt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(U)?U:JSON.stringify(U)}function Gt(s){return xt(s).replaceAll("\r","\\r").replaceAll(`
|
|
2
|
+
`,"\\n")}function bt(s,U,Y){if(Y==null)return;if(Y instanceof Error){let se=ee(Y);if(se){for(let[ue,ce]of Object.entries(se))if(ce!=null)s.push(`${ue}=${ft(ce)}`);return}if(s.push(`${U}.name=${ft(Y.name)}`),s.push(`${U}.message=${ft(Y.message)}`),Y.stack)s.push(`${U}.stack=${ft(Y.stack)}`);return}s.push(`${U}=${ft(Y)}`)}function yt(s,U,Y=[],se=new Date){let ue=Gt(U instanceof Error?U.message:U??""),ce=[];for(let[Te,be]of Y.entries()){if(be&&typeof be==="object"&&!Array.isArray(be)&&!(be instanceof Error)&&Object.getPrototypeOf(be)===Object.prototype){for(let[he,Fe]of Object.entries(be))bt(ce,he,Fe);continue}bt(ce,`param.${Te}`,be)}return[se.toISOString(),Bt[s],ue,...ce].filter(Boolean).join(" ")}var Pt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Ht=Pt,Yt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Jt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Xt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Zt={trace:()=>{},debug:(s,...U)=>globalThis.console.debug(yt("debug",s,U)),info:(s,...U)=>globalThis.console.info(yt("info",s,U)),warn:(s,...U)=>globalThis.console.warn(yt("warn",s,U)),error:(s,...U)=>globalThis.console.error(yt("error",s,U))};function Qt(s,U){if(typeof U!=="number"||U<=0)return s;return new Promise((Y,se)=>{let ue=setTimeout(()=>{se(Error(`Authz catalog entry did not become ready within ${U}ms`))},U);s.then(()=>{clearTimeout(ue),Y()},(ce)=>{clearTimeout(ue),se(ce)})})}function eo(s,U){let Y=!1,se,ue=U.then(()=>{Y=!0},(Te)=>{Y=!1,se=Te}),ce=s;return Object.defineProperty(ce,"ready",{enumerable:!1,configurable:!0,value:(Te)=>Qt(ue.then(()=>{if(!Y)throw se}),Te)}),Object.defineProperty(ce,"isReady",{enumerable:!1,configurable:!0,value:()=>Y}),ce}var Tt=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:Oe,yaml:"application/yaml",toml:"application/toml",xml:_e});function Rt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let U=s.mimeType?.trim()||Tt[s.format],Y=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>Y})}function to(s="jsonc"){return{format:s,mimeType:Tt[s],typeId:s}}class Ot extends n{constructor(s,U){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${U.mimeType}" (${U.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=U}}var oo=Rt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var vt={beforeTenantSegments:["ui"]},wt={beforeTenantSegments:["api"]};function _t(s){return(s??[]).map((U)=>U.trim()).filter(Boolean)}function Kt(s){let U=s.trim();if(!U)return"/";let Y=U.replace(/\\/g,"/").replace(/\/+/g,"/");return Y.startsWith("/")?Y:`/${Y}`}function Dt(s){return Kt(s).split("/").filter(Boolean)}function St(s){return{beforeTenantSegments:_t(s?.beforeTenantSegments),afterTenantSegments:_t(s?.afterTenantSegments)}}function Mt(s){if(s?.type==="host")return{type:"host",baseDomain:Et(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:St(s?.ui??vt),api:St(s?.api??wt)}}function Et(s){let U=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!U)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return U}function ro(s,U){let Y=s.trim().replace(/\.$/,"").toLowerCase(),se=Et(U);if(!Y.endsWith(`.${se}`))return null;let ue=Y.slice(0,-(se.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function no(s,U){let Y=St(U),se=Y.beforeTenantSegments??[],ue=Y.afterTenantSegments??[],ce=Dt(s),Te=se.length+1+ue.length;if(ce.length<Te)return null;for(let We=0;We<se.length;We++)if(ce[We]!==se[We])return null;let be=se.length,he=ce[be];if(!he)return null;for(let We=0;We<ue.length;We++)if(ce[be+1+We]!==ue[We])return null;let Fe=ce.slice(be+1+ue.length);return{id:decodeURIComponent(he),restSegments:Fe,restPath:Fe.length>0?`/${Fe.join("/")}`:"/"}}function Lt(s,U="/",Y){let se=St(Y),ue=se.beforeTenantSegments??[],ce=se.afterTenantSegments??[],Te=Dt(U),be=[...ue,encodeURIComponent(s),...ce,...Te];return be.length>0?`/${be.join("/")}`:"/"}function so(s,U="/",Y,se="ui"){let ue=Mt(Y);if(ue.type==="host"||ue.type==="selector")return Kt(U);return Lt(s,U,ue[se])}function io(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ue={...Y},ce=["iss","sub"];for(let he of ce)if(he in Y){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if("aud"in Y&&Y.aud!==void 0){let he=Y.aud;if(typeof he!=="string"&&!Array.isArray(he))se.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(he)&&!he.every((Fe)=>typeof Fe==="string"))se.push({message:"aud array must contain only strings",path:["aud"]})}let Te=["jti","scope"];for(let he of Te)if(he in Y&&Y[he]!==void 0){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}let be=["exp","iat"];for(let he of be)if(he in Y){if(typeof Y[he]!=="number")se.push({message:`${he} must be a number`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if(se.length>0)return{issues:se};return{value:ue}}}}}function ao(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ue={};if("access_token"in Y)if(typeof Y.access_token==="string")ue.access_token=Y.access_token;else se.push({message:"access_token must be a string",path:["access_token"]});else se.push({message:"access_token is required",path:["access_token"]});if("token_type"in Y)if(typeof Y.token_type==="string")ue.token_type=Y.token_type;else se.push({message:"token_type must be a string",path:["token_type"]});else se.push({message:"token_type is required",path:["token_type"]});if("scope"in Y)if(typeof Y.scope==="string"||Y.scope===void 0)ue.scope=Y.scope;else se.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Y)if(typeof Y.refresh_token==="string"||Y.refresh_token===void 0)ue.refresh_token=Y.refresh_token;else se.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Y)if(typeof Y.expires==="string"||Y.expires===void 0)ue.expires=Y.expires;else se.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Y)if(typeof Y.expires_in==="number"||Y.expires_in===void 0)ue.expires_in=Y.expires_in;else se.push({message:"expires_in must be a number",path:["expires_in"]});if(se.length>0)return{issues:se};return{value:ue}}}}}function po(s){let U=new Uint8Array(s);return crypto.getRandomValues(U),U}function co(s){let U="",Y=po(s);for(let se=0;se<s;se++){let ue=Y[se]%32;U+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return U}function mo(s,U){let Y="";for(let se=U;se>0;se--){let ue=s%32;Y="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+Y,s=Math.floor(s/32)}return Y}function uo(s){let U=Date.now(),Y=mo(U,10),se=co(16);return`${s??""}${Y}${se}`}export{u as ACCEPT_JSON,ot as ACCEPT_OCTET_STREAM,ge as ACCEPT_SCIM,st as ACCEPT_XML,Me as AssignmentPolicyError,te as CANONICAL_RISK_LEVELS,T as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,at as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,it as CONTENT_TYPE_XML,kt as ConfigSourceError,Ye as DEFAULT_DISCOVERED_COOKIE_MAX,Xe as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Je as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,Tt as DEFAULT_SECRET_MIME_TYPES,wt as DEFAULT_TENANT_API_NAMESPACE,vt as DEFAULT_TENANT_UI_NAMESPACE,oe as DISCOVERED_COOKIE_PREFIX,He as DISPLAY_COOKIE_SUFFIX,B as DISPLAY_COOKIE_VERSION,$e as ECID_SCHEME,j as ENTRA_ION_EXTENSION_URN,D as EcidFormatError,N as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,Pe as ION_AUTHZ_OAA_SYNC,xe as ION_CAPABILITIEZ_READ,Ee as ION_CIAM_MAGIC_LINK_CREATE,nt as ION_ENDPOINT_PERMISSIONS,ve as ION_IAM_ACCESS_REQUESTS_WRITE,Ie as ION_IAM_CUSTOMERS_WRITE,Re as ION_IAM_GROUPS_WRITE,Ce as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Ae as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,pe as ION_SDK_PERMISSIONS,Ue as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,x as KNOWN_BASE_CUSTOMER_KEYS,v as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,E as KNOWN_WORKLOAD_KEYS,Oe as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,rt as SCIM_MEDIA_TYPE,Ot as SecretContentTypeMismatchError,I as StoreConflictError,_e as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,M as assertEcid,ne as assertRequiredSubjectType,P as assertValidSubjectTypeScoping,Lt as buildTenantPath,so as buildTenantUrl,z as catalogEntityStore,Z as claimsToUser,_ as compareDisplayExpiryDesc,At as configSourceOriginLogFields,Ve as configTrustedClientGrants,c as customAttributes,le as customerResourceSchema,Yt as debugLogger,Le as decodeDisplayCookie,pt as decodeUser,C as deepEqualPlain,Se as defaultDisplayUser,Ht as defaultLogger,to as defaultSecretContentType,Ne as defineCatalog,Rt as defineSecretType,re as deprecateRetiredCodeCatalogRows,Wt as describeOriginUrl,J as discoveredProfileCookieName,F as encodeDisplayCookie,ee as errorLogAttributes,Ze as formatEcid,yt as formatLogLine,uo as generateULID,K as getCodeCatalogEntity,tt as groupResourceSchema,b as idTokenClaimsSchema,Jt as infoLogger,je as isCodeCatalog,De as isConfigLocator,Ut as isConfigSourceError,qe as isEcid,Ke as isJsonResponse,L as isStoreConflictError,io as jwtAssertionClaimsSchema,q as list,d as listGenerator,ro as matchTenantHost,no as matchTenantPath,Be as matchesListFilter,W as materializeCodeCatalogEntity,w as mergeCodeCatalogEntity,ct as mergeConfig,e as must,Et as normalizeTenantBaseDomain,St as normalizeTenantPathNamespace,Mt as normalizeTenantRoutingStrategy,me as oidcCallbackSchema,Qe as parseEcid,ut as parseJsonc,jt as parseKmsPoolControlDocument,zt as parseKmsPoolDocument,Zt as prettyLogger,O as profileCookieName,g as projectDisplayUser,H as readDisplayCookies,l as readJsonResponse,eo as readyCatalogEntry,oo as remoteConfigSecretType,G as resolveDiscoveredCookieMax,ae as resolveDiscoveredCookieTtlSeconds,ie as resolveDisplayCookieMax,ke as sanitizeDisplayUser,qt as serializeConfig,Pt as silentLogger,dt as stableConfigHash,ze as stripJsonComments,mt as tmIntegrationState,Ge as toCodeCatalog,fe as tokenResponseSchema,A as trimTrailingSlash,Q as trustedClientPermissionsForPrincipal,X as unexpectedBodySummary,V as unionCatalogRead,et as userSchema,ye as validationFailureResponse,$t as version,lt as waitOn,Xt as warnLogger,m as withValidate,de as workloadResourceSchema,ao as workloadTokenResponseSchema};
|
package/dist/server.d.ts
CHANGED
|
@@ -1700,7 +1700,10 @@ type ResolvedIamProvider = {
|
|
|
1700
1700
|
/** Provider key from `iam.providers`; undefined for the default strict preset. */
|
|
1701
1701
|
name?: string;
|
|
1702
1702
|
type: IAMProviderType;
|
|
1703
|
+
normalizeResource: (resource: unknown) => unknown;
|
|
1703
1704
|
normalizePatch: (operations: ScimPatchOperation[]) => ScimPatchOperation[];
|
|
1705
|
+
normalizeUser: (body: unknown) => unknown;
|
|
1706
|
+
projectUser: (resource: User) => User;
|
|
1704
1707
|
};
|
|
1705
1708
|
/** Canonical caller id of a validated workload token: `client_id`, then `azp`, then `sub`. */
|
|
1706
1709
|
declare function inboundCallerId(claims: Record<string, unknown> | undefined): string | undefined;
|