@ionite/core 0.0.24-beta.20261024.47 → 0.0.24-beta.20261024.49

package/dist/shared/core-0nsg7t0c.js

@@ -0,0 +1,4 @@
+function dn(Tt){if(Tt===void 0||Tt===null)return[];return Array.isArray(Tt)?Tt:[Tt]}function pn(Tt){if(typeof Tt!=="string")return;return Tt.endsWith("/")?Tt.slice(0,-1):Tt}function Pn(Tt,bt){if(pn(bt.issuer)!==pn(Tt.claims?.iss))return!1;let At=dn(bt.audience);if(At.length===0)return!1;let xt=dn(Tt.claims?.aud),Rt=typeof Tt.claims?.azp==="string"?Tt.claims.azp:void 0;if(!(At.some((Ct)=>xt.includes(Ct))||(Rt?At.includes(Rt):!1)))return!1;let wt=Tt.clientId??Tt.workloadId??Tt.claims?.sub;return bt.clientId===wt}function ee(Tt,bt){let At=Tt?.trustedProvisioningClients;if(!At?.length)return;let xt=new Set;for(let Rt of At){if(!Pn(bt,Rt))continue;for(let It of Rt.permissions??[])xt.add(It)}return xt.size>0?xt:void 0}function He(Tt){let bt=Tt?.trustedProvisioningClients;if(!bt?.length)return[];let At=[];for(let xt of bt)for(let Rt of xt.permissions??[])At.push({subject:xt.clientId,subjectType:"workload",targetType:"permission",target:Rt,status:"active",provenance:{source:"eci-trusted",actor:xt.clientId}});return At}var p=["id","name","displayName","description","providerId","source","deprecated","type","parent","resources","assignableSubjectTypes","recommendedSubjectTypes","requestable","riskLevel","requestUrl","action","permissionTypes","resourceTypes","applyToSubResources","permissions","groups","roles"],x=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","ecid","accountClass","displayName","scimName","emails","nickName","active","title","preferredLanguage","locale","timezone","phoneNumbers","ims","photos","addresses","roles","groups","entitlements","x509Certificates","scimEnterprise","scimSchemaExtensions","createdAt","updatedAt","sso"],E=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","displayName","emails","phoneNumbers","active","createdAt","updatedAt","ciam"],P=["id","clientId","displayName","description","externalId","providerId","requestUrl","ecid","active","scopes","createdAt","updatedAt","metadata"];function c(Tt,bt){let At=new Set(bt),xt=Object.fromEntries(Object.entries(Tt).filter(([Rt,It])=>!At.has(Rt)&&It!==void 0));return Object.keys(xt).length>0?xt:void 0}var ln=new WeakSet;function fn(Tt,bt){Object.defineProperty(Tt,"log",{value:bt,enumerable:!1,writable:!0,configurable:!0})}class n extends Error{constructor(Tt,bt={}){super(Tt,{cause:bt.cause});this.name="IoniteError",this.status=bt.status??500,this.upstreamStatus=bt.upstreamStatus,this.statusText=bt.statusText,this.detail=bt.detail,this.ionId=bt.ionId,fn(this,bt.log),Object.setPrototypeOf(this,new.target.prototype)}get _tag(){return this.name}attachContext(Tt){if(this.ionId===void 0&&Tt.ionId!==void 0)this.ionId=Tt.ionId;if(this.log===void 0&&Tt.log!==void 0)fn(this,Tt.log);return this}safeBody(){return{}}toLogAttributes(){let Tt=ln.has(this)&&this.cause instanceof Error?this.cause:this;return{"exception.type":Tt.name,"exception.message":Tt.message,...Tt.stack?{"exception.stacktrace":Tt.stack}:{},...this.ionId!==void 0?{"ion.id":this.ionId}:{},"http.status_code":this.status,...this.upstreamStatus!==void 0?{"ion.upstream.status":this.upstreamStatus}:{}}}response(Tt){let bt=Tt?.headers.get("accept")??"";if(bt.includes("text/html")&&!bt.includes("application/json")){let At=this.statusText?this.detail??this.statusText:"Internal Server Error";return new Response(At,{status:this.status,headers:{"content-type":"text/plain; charset=utf-8"}})}if(!this.statusText)return Response.json({error:"internal_error"},{status:this.status});return Response.json({error:this.statusText,...this.detail!==void 0?{detail:this.detail}:{},...this.safeBody()},{status:this.status})}toJSON(){return{name:this.name,_tag:this._tag,status:this.status,...this.statusText!==void 0?{statusText:this.statusText}:{},...this.detail!==void 0?{detail:this.detail}:{},...this.ionId!==void 0?{ionId:this.ionId}:{}}}static from(Tt,bt){if(Tt instanceof n){if(bt)Tt.attachContext(bt);return Tt}let At=Tt instanceof Error?Tt.message:"internal_error",xt=new n(At,{status:500,cause:Tt,ionId:bt?.ionId,log:bt?.log});return ln.add(xt),xt}}function te(Tt){if(!Tt||typeof Tt!=="object")return;let bt=Tt.toLogAttributes;if(typeof bt!=="function")return;let At=bt.call(Tt);if(!At||typeof At!=="object")return;return At}function K(Tt,bt,At,xt){let Rt=bt.length,It=xt??Tt,wt=It>0?Math.floor(At/It)+1:1,Ct=It>0?Math.ceil(Tt/It):0;return{total:Tt,count:Rt,items:bt,size:It,page:wt,pages:Ct}}async function*u(Tt,bt,At=1000){let xt=0;while(!0){let Rt=await Tt(xt,At);if(Rt.items.length===0)break;for(let It of Rt.items)yield(bt?await bt(It):It)??It;if(Rt.items.length<At||xt+Rt.items.length>=Rt.total)break;xt+=At}}function Fe(Tt,bt){if(!bt)return!0;if(bt.requestable!==void 0&&Boolean(Tt.requestable)!==bt.requestable)return!1;if(bt.userName!==void 0){if((Tt.userName??Tt.clientId)!==bt.userName)return!1}if(bt.externalId!==void 0&&Tt.externalId!==bt.externalId)return!1;if(bt.updatedAfter!==void 0){if(!(Tt.updatedAt instanceof Date))return!1;let At=bt.updatedAfter instanceof Date?bt.updatedAfter:new Date(bt.updatedAfter);if(Number.isNaN(At.getTime())||Tt.updatedAt<=At)return!1}return!0}var ne=["basic","elevated","privileged","admin"],y="basic",t="urn:ionite:params:scim:schemas:extension:authz:2.0:Group";function Je(Tt){if("id"in Tt&&typeof Tt.id==="string"&&Tt.id)return Tt.id;if(!("claims"in Tt))return;return Tt.clientId||Tt.workloadId||Tt.claims.sub||void 0}var h=["user","workload","customer","delegate"];function D(Tt){let{assignableSubjectTypes:bt,recommendedSubjectTypes:At}=Tt,xt=Tt.id?` for "${Tt.id}"`:"";if(!bt||bt.length===0)throw Error(`assignableSubjectTypes${xt} is required and must be a non-empty subset of [${h.join(", ")}]`);let Rt=bt.filter((It)=>!h.includes(It));if(Rt.length>0)throw Error(`assignableSubjectTypes${xt} contains values outside the platform ceiling [${h.join(", ")}]: ${Rt.join(", ")}`);if(At){let It=At.filter((wt)=>!bt.includes(wt));if(It.length>0)throw Error(`recommendedSubjectTypes${xt} must be a subset of assignableSubjectTypes; offending values: ${It.join(", ")}`)}}function re(Tt,bt="subjectType"){if(Tt!=="user"&&Tt!=="customer"&&Tt!=="workload"&&Tt!=="delegate")throw Error(`${bt} is required and must be one of [user, customer, workload, delegate]; got ${Tt===void 0?"undefined":JSON.stringify(Tt)}`)}class Le extends n{constructor(Tt,bt,At){super(Tt,{status:403,statusText:"assignment_forbidden"});this.name="AssignmentPolicyError";this.policy=bt,this.requestUrl=At}safeBody(){return{policy:this.policy,...this.requestUrl?{requestUrl:this.requestUrl}:{}}}toLogAttributes(){return{...super.toLogAttributes(),"authz.assignment_policy":this.policy,...this.requestUrl?{"authz.request_url":this.requestUrl}:{}}}}function $e(Tt){return typeof Tt.groups?.get==="function"}function Ye(Tt){return $e(Tt)?Tt:qe(Tt)}class Kt extends n{constructor(Tt){super(`defineCatalog: ${Tt}`,{status:500});this.name="CodeCatalogError"}}function mn(Tt){return typeof Tt==="string"?Tt:Tt.id}function _n(Tt){for(let bt of Object.values(Tt))if(Array.isArray(bt))Object.freeze(bt);Object.freeze(Tt)}function Jt(Tt,bt){try{D(bt)}catch(At){throw new Kt(`${Tt} "${bt.id}": ${At instanceof Error?At.message:String(At)}`)}}function Xt(Tt){let bt=new Map(Tt.map((xt)=>[xt.id,xt])),At=Object.freeze([...Tt]);return Object.freeze({get:(xt)=>bt.get(xt),list:()=>At})}function qe(Tt){let bt=Tt.groups??[],At=Tt.roles??[],xt=Tt.permissions??[],Rt=new Map,It=(Pt,kt)=>{for(let _t of kt){if(!_t.id)throw new Kt(`a ${Pt} is missing its required "id".`);let jt=Rt.get(_t.id);if(jt)throw new Kt(`duplicate id "${_t.id}" (declared as both ${jt} and ${Pt}).`);Rt.set(_t.id,Pt)}};It("group",bt),It("role",At),It("permission",xt);let wt=(Pt,kt,_t,jt)=>{let Nt=mn(jt),Dt=Rt.get(Nt);if(Dt===void 0)throw new Kt(`${Pt} "${kt}" references ${_t} "${Nt}", which is not declared in the catalog.`);if(Dt!==_t)throw new Kt(`${Pt} "${kt}" references "${Nt}" as a ${_t}, but it is a ${Dt}.`)};for(let Pt of At){Jt("role",Pt);for(let kt of Pt.permissions??[])wt("role",Pt.id,"permission",kt)}for(let Pt of xt)Jt("permission",Pt);for(let Pt of bt){Jt("group",Pt);for(let kt of Pt.groups??[])wt("group",Pt.id,"group",kt);for(let kt of Pt.roles??[])wt("group",Pt.id,"role",kt);for(let kt of Pt.permissions??[])wt("group",Pt.id,"permission",kt)}let Ct=new Map(bt.map((Pt)=>[Pt.id,Pt])),Ot=new Map,vt=(Pt,kt)=>{let _t=Ot.get(Pt);if(_t==="done")return;if(_t==="visiting")throw new Kt(`group composition cycle: ${[...kt,Pt].join(" -> ")}.`);Ot.set(Pt,"visiting");for(let jt of Ct.get(Pt)?.groups??[])vt(mn(jt),[...kt,Pt]);Ot.set(Pt,"done")};for(let Pt of bt)vt(Pt.id,[]);for(let Pt of[...bt,...At,...xt])_n(Pt);return Object.freeze({groups:Xt(bt),roles:Xt(At),permissions:Xt(xt)})}function W(Tt,bt){let At=Tt?.groups.get(bt);if(At)return{entity:At,kind:"group"};let xt=Tt?.roles.get(bt);if(xt)return{entity:xt,kind:"role"};let Rt=Tt?.permissions.get(bt);return Rt?{entity:Rt,kind:"permission"}:void 0}function V(Tt,bt){return bt==="group"?Tt.groups:bt==="role"?Tt.roles:Tt.permissions}function A(Tt,bt,At){let xt={...bt,...At,id:bt.id,requestable:bt.requestable,source:At.source??"code",assignableSubjectTypes:bt.assignableSubjectTypes,recommendedSubjectTypes:bt.recommendedSubjectTypes};if(Tt==="group"){let It=bt;return{...xt,groups:It.groups,roles:It.roles,permissions:It.permissions,resources:It.resources}}if(Tt==="role")return{...xt,permissions:bt.permissions};let Rt=bt;return{...xt,action:Rt.action,permissionTypes:Rt.permissionTypes,resourceTypes:Rt.resourceTypes,applyToSubResources:Rt.applyToSubResources}}async function z(Tt,bt,At){let xt=await At.get(bt.id);if(xt)return A(Tt,bt,xt);let Rt=Object.entries(bt).filter(([kt])=>p.includes(kt)),{riskLevel:It,displayName:wt,...Ct}=Object.fromEntries(Rt),Ot={...Ct,source:"code"},vt=At.insertIfAbsent(Ot);await vt.ready();let Pt=await At.get(bt.id)??vt;return A(Tt,bt,Pt)}async function se(Tt,bt,At){let xt=async(Rt,It)=>{let wt=At?[await Rt.get(At)].filter((Ct)=>Ct!==void 0):u((Ct,Ot)=>Rt.list({start:Ct,limit:Ot}));for await(let Ct of wt){if(Ct.source!=="code"||Ct.deprecated===!0||It?.get(Ct.id))continue;await Rt.set({...Ct,deprecated:!0}).ready()}};await xt(bt.groups,Tt?.groups),await xt(bt.roles,Tt?.roles),await xt(bt.permissions,Tt?.permissions)}function Zt(Tt,bt,At){let xt=()=>{if(!At)throw Error(`Cannot write ${Tt} definitions: no AccessCatalogStore is wired (the code-declared catalog is read-only).`);return At};return{async get(It){let wt=bt.get(It);if(!At)return wt;let Ct=await At.get(It);return Ct&&wt?A(Tt,wt,Ct):Ct??wt},set(It){return xt().set(It)},insertIfAbsent(It){return xt().insertIfAbsent(It)},async delete(It){await xt().delete(It)},async list(It){let wt=Math.max(0,It?.start??0),Ct=It?.limit,Ot=It?.filter?.requestable,vt=[];if(At)for await(let jt of u((Nt,Dt)=>At.list({start:Nt,limit:Dt})))vt.push(jt);let Pt=new Map(vt.map((jt)=>[jt.id,jt])),kt=[...bt.list().map((jt)=>{let Nt=Pt.get(jt.id);return Nt?A(Tt,jt,Nt):jt}),...vt.filter((jt)=>!bt.get(jt.id))].filter((jt)=>Ot===void 0||Boolean(jt.requestable)===Ot),_t=Ct!=null?wt+Ct:void 0;return K(kt.length,kt.slice(wt,_t),wt,Ct)}}}function B(Tt,bt){if(!Tt)return bt;return{groups:Zt("group",Tt.groups,bt?.groups),roles:Zt("role",Tt.roles,bt?.roles),permissions:Zt("permission",Tt.permissions,bt?.permissions),afterChange:bt?.afterChange?.bind(bt)}}function r(Tt){if(typeof Tt==="string")return Tt.trim();if(Tt&&typeof Tt==="object"){let bt=Tt;for(let At of["id","value","name","displayName"]){let xt=bt[At];if(typeof xt==="string"&&xt.trim())return xt.trim()}}return""}function f(Tt){let bt=r(Tt.subject),At=r(Tt.target);if(!bt)throw Error("Access change subject must resolve to a non-empty id.");if(!Tt.targetType)throw Error("Access change targetType is required.");if(!At)throw Error("Access change target must resolve to a non-empty id.");let xt=(Tt.resources??[]).map((It)=>It.trim()).filter(Boolean),Rt=!Tt.applyToApplication&&xt.length>0?[...xt].sort().join(","):"app";return re(Tt.subjectType,"Access change subjectType"),`${Tt.subjectType}:${bt}:${Tt.targetType}:${At}:${Rt}`}function vn(Tt){let bt=(Tt.resources??[]).map((At)=>At.trim()).filter(Boolean);if(Tt.applyToApplication||bt.length===0)return[void 0];return bt}async function yn(Tt,bt,At,xt,Rt){if(xt==="resource")return At?.get(Rt);let It=bt?xt==="group"?bt.groups.get(Rt):xt==="role"?bt.roles.get(Rt):bt.permissions.get(Rt):void 0;if(Tt){let Ct=await(xt==="group"?Tt.groups:xt==="role"?Tt.roles:Tt.permissions).get(Rt);if(Ct)return It?A(xt,It,Ct):Ct}return It}class oe{constructor(Tt,bt,At){this.catalog=Tt;this.resources=bt;this.code=At;this.nodes=new Map;this.subResources=new Map;this.children=new Map}getNode(Tt,bt){let At=`${Tt}:${bt}`,xt=this.nodes.get(At);if(!xt)xt=yn(this.catalog,this.code,this.resources,Tt,bt),this.nodes.set(At,xt);return xt}resourceChildren(Tt){let bt=this.children.get(Tt);if(!bt)bt=Tn(Tt,this.view()),this.children.set(Tt,bt);return bt}resourceAndSubResourceIds(Tt){let bt=this.subResources.get(Tt);if(!bt)bt=bn(Tt,this.view()),this.subResources.set(Tt,bt);return bt}view(){return{catalog:this.catalog,code:this.code,resources:this.resources,cache:this}}invalidate(Tt){this.clear()}clear(){this.nodes.clear(),this.subResources.clear(),this.children.clear()}}async function Bt(Tt,bt,At){if(Tt.cache)return Tt.cache.getNode(bt,At);return yn(Tt.catalog,Tt.code,Tt.resources,bt,At)}async function gn(Tt,bt){if(typeof Tt!=="string")return Tt;return Bt(bt,"resource",Tt)}async function Tn(Tt,bt){if(bt.resources?.children)return bt.resources.children(Tt);let At=await gn(Tt,bt),xt=[];for(let Rt of At?.resources??[]){let It=await gn(Rt,bt);if(It)xt.push(It);else if(typeof Rt==="string"&&Rt.trim())xt.push({id:Rt.trim()})}return xt}async function hn(Tt,bt){if(bt.cache)return bt.cache.resourceChildren(Tt);return Tn(Tt,bt)}async function bn(Tt,bt){let At=[],xt=new Set,Rt=async(It)=>{if(!It||xt.has(It))return;xt.add(It),At.push(It);for(let wt of await hn(It,bt))await Rt(r(wt))};return await Rt(r(Tt)),At}async function U(Tt,bt){let At=Tt.id??f(Tt),xt=r(Tt.subject);if(!xt)throw Error("Access change subject must resolve to a non-empty id.");re(Tt.subjectType,"Access change subjectType");let Rt=Tt.subjectType,It=vn(Tt),wt=[],Ct=new Set,Ot=new Set,vt=(_t,jt,Nt)=>{if(!jt)return;let Dt=`${_t}:${jt}:${Nt??""}`;if(Ct.has(Dt))return;Ct.add(Dt),wt.push({subject:xt,subjectType:Rt,targetType:_t,target:jt,resource:Nt,rootId:At})},Pt=async(_t,jt,Nt)=>{for(let Dt of It)if(_t==="permission"&&Nt?.applyToSubResources&&Dt){let Lt=bt.cache?await bt.cache.resourceAndSubResourceIds(Dt):await bn(Dt,bt);for(let qt of Lt)vt("permission",jt,qt)}else vt(_t,jt,Dt)},kt=async(_t,jt)=>{let Nt=r(jt);if(!Nt)return;let Dt=`${_t}:${Nt}`;if(Ot.has(Dt))return;if(Ot.add(Dt),_t==="group"){let qt=typeof jt==="string"?await Bt(bt,"group",Nt):jt;await Pt("group",Nt,void 0);for(let Ut of qt?.groups??[])await kt("group",Ut);for(let Ut of qt?.roles??[])await kt("role",Ut);for(let Ut of qt?.permissions??[])await kt("permission",Ut);return}if(_t==="role"){let qt=typeof jt==="string"?await Bt(bt,"role",Nt):jt;await Pt("role",Nt,void 0);for(let Ut of qt?.permissions??[])await kt("permission",Ut);return}let Lt=typeof jt==="string"?await Bt(bt,"permission",Nt):jt;await Pt("permission",Nt,Lt)};return await kt(Tt.targetType,Tt.target),wt}async function ke(Tt,bt,At,xt){let{accessStore:Rt,accessIndex:It,catalogStore:wt,code:Ct,resources:Ot}=At;if(!It||!wt&&!Ct)return 0;if(!Rt)return await It.replaceSubject(Tt,bt,[]),0;let vt={catalog:wt,code:Ct,resources:Ot,cache:xt},Pt=[],kt=0;for await(let _t of u((jt,Nt)=>Rt.listBySubject(Tt,bt,{start:jt,limit:Nt}))){let jt=_t.id??f(_t),Nt=await U({..._t,id:jt},vt);Pt.push(...Nt),kt+=1}return await It.replaceSubject(Tt,bt,Pt),kt}async function Xe(Tt,bt,At){let xt=new Map,Rt=new Map,It=new Map,wt=new Map,Ct=new Set,Ot=(kt,_t)=>Bt(At,kt,_t),vt=async(kt)=>{let _t=r(kt);if(!_t||wt.has(_t))return;let jt=typeof kt==="string"?await Ot("resource",_t):kt;if(!jt)return;wt.set(_t,jt);let Nt=jt.resources??(jt.id?await hn(jt.id,At):[]);for(let Dt of Nt)await vt(Dt)},Pt=async(kt,_t)=>{let jt=r(_t);if(!jt)return;let Nt=`${kt}:${jt}`;if(Ct.has(Nt))return;if(Ct.add(Nt),kt==="group"){let Lt=typeof _t==="string"?await Ot("group",jt):_t;if(!Lt)return;xt.set(jt,Lt);for(let qt of Lt.groups??[])await Pt("group",qt);for(let qt of Lt.roles??[])await Pt("role",qt);for(let qt of Lt.permissions??[])await Pt("permission",qt);for(let qt of Lt.resources??[])await vt(qt);return}if(kt==="role"){let Lt=typeof _t==="string"?await Ot("role",jt):_t;if(!Lt)return;Rt.set(jt,Lt);for(let qt of Lt.permissions??[])await Pt("permission",qt);return}let Dt=typeof _t==="string"?await Ot("permission",jt):_t;if(!Dt)return;It.set(jt,Dt)};if(Ct.add(`${bt}:${r(Tt)}`),bt==="group"){let kt=Tt;for(let _t of kt.groups??[])await Pt("group",_t);for(let _t of kt.roles??[])await Pt("role",_t);for(let _t of kt.permissions??[])await Pt("permission",_t);for(let _t of kt.resources??[])await vt(_t)}else{let kt=Tt;for(let _t of kt.permissions??[])await Pt("permission",_t)}return{groups:[...xt.values()],roles:[...Rt.values()],permissions:[...It.values()],resources:[...wt.values()]}}var Ze=".profile",G=1,Qe=10,et=10,tt=14400,ie="ion.discovered",jn=new Set(["sid","sub","tokens","access_token","id_token","refresh_token","accessClaims","roles","groups","permissions","grants"]);function ae(Tt){if(typeof Tt!=="number"||!Number.isFinite(Tt)||Tt<1)return 10;return Math.floor(Tt)}function H(Tt){if(typeof Tt!=="number"||!Number.isFinite(Tt)||Tt<1)return 10;return Math.floor(Tt)}function ce(Tt){if(typeof Tt!=="number"||!Number.isFinite(Tt)||Tt<1)return 14400;return Math.floor(Tt)}function be(Tt){let bt={};if(Tt.name)bt.name=Tt.name;if(Tt.email)bt.email=Tt.email;if(Tt.avatar)bt.avatar=Tt.avatar;return bt}function Te(Tt){if(!Tt||typeof Tt!=="object"||Array.isArray(Tt))return{};let bt={};for(let[At,xt]of Object.entries(Tt)){if(jn.has(At))continue;if(typeof xt==="string"||typeof xt==="number"||typeof xt==="boolean"||xt===null)bt[At]=xt}return bt}function On(Tt){let bt=Tt;return{name:typeof bt.name==="string"?bt.name:void 0,email:typeof bt.email==="string"?bt.email:void 0,avatar:typeof bt.avatar==="string"?bt.avatar:void 0}}function g(Tt,bt){let At=On(Tt);if(!bt)return be(At);try{return Te(bt(Tt))}catch{return be(At)}}function F(Tt){return btoa(JSON.stringify(Tt))}function Ke(Tt){try{let bt=JSON.parse(atob(Tt));if(!bt||typeof bt!=="object"||Array.isArray(bt))return;let At=bt;if(At.v!==1)return;if(At.authType!=="sso"&&At.authType!=="ciam")return;if(At.kind!==void 0&&At.kind!=="session"&&At.kind!=="discovered")return;if(typeof At.expiresAt!=="string"||!At.expiresAt)return;let xt=typeof At.tenantId==="string"&&At.tenantId?At.tenantId:void 0,Rt=typeof At.tenantName==="string"&&At.tenantName?At.tenantName:void 0;return{v:1,...At.kind?{kind:At.kind}:{},...xt?{tenantId:xt}:{},authType:At.authType,expiresAt:At.expiresAt,user:Te(At.user),...Rt?{tenantName:Rt}:{}}}catch{return}}function ue(Tt){let bt={};if(!Tt)return bt;for(let At of Tt.split(";")){let xt=At.trim();if(!xt)continue;let Rt=xt.indexOf("=");if(Rt===-1)continue;bt[xt.slice(0,Rt).trim()]=xt.slice(Rt+1).trim()}return bt}function J(Tt){let bt=ue(Tt),At=[];for(let[xt,Rt]of Object.entries(bt)){if(!xt.endsWith(".profile")||!Rt)continue;let It=Ke(Rt);if(!It)continue;At.push({name:xt,prefix:xt.slice(0,-8),envelope:It})}return At}function _(Tt,bt){let At=Tt?Date.parse(Tt):Number.NaN,xt=bt?Date.parse(bt):Number.NaN,Rt=Number.isFinite(At),It=Number.isFinite(xt);if(Rt&&It)return xt-At;if(Rt)return-1;if(It)return 1;return 0}function O(Tt){return`${Tt}.profile`}function Y(Tt){return O(`ion.discovered.${encodeURIComponent(Tt)}`)}var We="ecid",An=/^ecid:([A-Za-z0-9._-]+):([A-Za-z0-9_-]+)$/,Nn=/^[A-Za-z0-9._-]+$/,Dn=/^[A-Za-z0-9_-]+$/;class M extends n{constructor(Tt){super(Tt,{status:400,statusText:"invalid_ecid"});this.name="EcidFormatError"}}function Ve(Tt){return typeof Tt==="string"&&An.test(Tt)}function nt(Tt,bt){if(!Tt||!Nn.test(Tt))throw new M(`Invalid ECID realm ${JSON.stringify(Tt)}: must be non-empty and match [A-Za-z0-9._-].`);if(!bt||!Dn.test(bt))throw new M(`Invalid ECID opaque ${JSON.stringify(bt)}: must be non-empty and match [A-Za-z0-9_-].`);return`${We}:${Tt}:${bt}`}function rt(Tt){let bt=typeof Tt==="string"?Tt.match(An):null;if(!bt)throw new M(`Invalid ECID ${JSON.stringify(Tt)}: expected "ecid:<realm>:<opaque>".`);return{realm:bt[1],opaque:bt[2]}}function j(Tt){if(!Ve(Tt))throw new M(`Invalid ECID ${JSON.stringify(Tt)}: expected "ecid:<realm>:<opaque>".`);return Tt}class s extends n{constructor(Tt,bt){super(Tt,{status:400,statusText:bt});this.name="ScimPatchError";this.scimType=bt}}var Ft="[A-Za-z_$][\\w$-]*",Un=new RegExp(`^(${Ft})(?:\\[(.*)\\])?(?:\\.(${Ft}))?$`),Mn=new RegExp(`^\\s*(${Ft}(?:\\.${Ft})?)\\s+eq\\s+(?:"((?:[^"\\\\]|\\\\.)*)"|(true|false|null|-?\\d+(?:\\.\\d+)?))\\s*$`,"i");function qn(Tt,bt){let At=Tt.match(Mn);if(!At?.[1])throw new s(`Unsupported filter in PATCH path "${bt}" (only "<attr> eq <value>")`,"invalidFilter");if(At[2]!==void 0)return{attr:At[1],value:At[2].replace(/\\(.)/g,"$1")};let xt=At[3]?.toLowerCase();if(xt==="true")return{attr:At[1],value:!0};if(xt==="false")return{attr:At[1],value:!1};if(xt==="null")return{attr:At[1],value:null};return{attr:At[1],value:Number(At[3])}}function de(Tt){let bt,At=Tt.trim();if(At.toLowerCase().startsWith("urn:")){let Rt=At.indexOf("["),It=Rt===-1?At:At.slice(0,Rt),wt=It.lastIndexOf(":"),Ct=It.slice(wt+1).split(".")[0]??"";if(/^[A-Z]/.test(Ct)){bt=At.slice(0,wt+1+Ct.length);let Ot=At.slice(bt.length);if(Ot==="")return{schema:bt};if(!Ot.startsWith("."))throw new s(`Invalid PATCH path "${Tt}"`,"invalidPath");At=Ot.slice(1)}else bt=At.slice(0,wt),At=At.slice(wt+1)}let xt=At.match(Un);if(!xt?.[1])throw new s(`Invalid PATCH path "${Tt}"`,"invalidPath");return{schema:bt,attr:xt[1],filter:xt[2]!==void 0?qn(xt[2],Tt):void 0,subAttr:xt[3]}}function $t(Tt){return typeof Tt==="object"&&Tt!==null&&!Array.isArray(Tt)}function zt(Tt,bt){if(bt in Tt)return bt;let At=bt.toLowerCase();return Object.keys(Tt).find((xt)=>xt.toLowerCase()===At)??bt}function Ln(Tt,bt){let At=Tt;for(let xt of bt.split(".")){if(!$t(At))return;At=At[zt(At,xt)]}return At}function Wt(Tt,bt){if(!$t(Tt))return!1;let At=Ln(Tt,bt.attr);if(typeof At==="string"&&typeof bt.value==="string")return At.toLowerCase()===bt.value.toLowerCase();return At===bt.value}function Qt(Tt,bt,At){let xt=Tt[bt];if(Array.isArray(xt)){Tt[bt]=[...xt,...Array.isArray(At)?At:[At]];return}if($t(xt)&&$t(At)){Tt[bt]={...xt,...At};return}Tt[bt]=At}function $n(Tt,bt,At){if(!bt)return Tt;let xt=zt(Tt,bt),Rt=Tt[xt];if($t(Rt))return Rt;if(!At)return;let It={};return Tt[xt]=It,It}function en(Tt){return Tt.attr.includes(".")?{}:{[Tt.attr]:Tt.value}}function Sn(Tt,bt,At,xt){let Rt=de(At);if(Rt.attr===void 0){let Ct=zt(Tt,Rt.schema??At);if(bt==="remove")delete Tt[Ct];else if(bt==="add")Qt(Tt,Ct,xt);else Tt[Ct]=xt;return}let It=$n(Tt,Rt.schema,bt!=="remove");if(!It)return;let wt=zt(It,Rt.attr);if(Rt.filter){let Ct=Rt.filter,Ot=It[wt];if(Ot!==void 0&&!Array.isArray(Ot))throw new s(`PATCH path "${At}" filters a non-multi-valued attribute`,"invalidPath");let vt=Ot??[];if(bt==="remove"){It[wt]=Rt.subAttr?vt.map((kt)=>{if(!Wt(kt,Ct)||!$t(kt))return kt;let _t={...kt};return delete _t[zt(_t,Rt.subAttr)],_t}):vt.filter((kt)=>!Wt(kt,Ct));return}if(!vt.some((kt)=>Wt(kt,Ct))){let kt=Rt.subAttr?{...en(Ct),[Rt.subAttr]:xt}:$t(xt)?{...en(Ct),...xt}:void 0;if(!kt)throw new s(`PATCH value for "${At}" must be an object`,"invalidValue");It[wt]=[...vt,kt];return}It[wt]=vt.map((kt)=>{if(!Wt(kt,Ct)||!$t(kt))return kt;if(Rt.subAttr)return{...kt,[zt(kt,Rt.subAttr)]:xt};if(!$t(xt))throw new s(`PATCH value for "${At}" must be an object`,"invalidValue");return bt==="add"?{...kt,...xt}:{...en(Ct),...xt}});return}if(Rt.subAttr){let Ct=It[wt];if(bt==="remove"){if($t(Ct)){let Pt={...Ct};delete Pt[zt(Pt,Rt.subAttr)],It[wt]=Pt}return}if(Ct!==void 0&&!$t(Ct))throw new s(`PATCH path "${At}" targets a sub-attribute of a non-complex attribute`,"invalidPath");let Ot={...Ct??{}},vt=zt(Ot,Rt.subAttr);if(bt==="add")Qt(Ot,vt,xt);else Ot[vt]=xt;It[wt]=Ot;return}if(bt==="remove"){let Ct=It[wt];if(Array.isArray(Ct)&&Array.isArray(xt)){let Ot=xt.filter($t).map((vt)=>vt.value);It[wt]=Ct.filter((vt)=>!($t(vt)&&Ot.includes(vt.value)));return}delete It[wt];return}if(bt==="add"){Qt(It,wt,xt);return}It[wt]=xt}function X(Tt,bt){let At=typeof bt.op==="string"?bt.op.toLowerCase():"";if(At!=="add"&&At!=="replace"&&At!=="remove")throw new s(`Unsupported PATCH op "${String(bt.op)}"`,"invalidSyntax");if(!bt.path){if(At==="remove")throw new s("PATCH remove requires a path","noTarget");if(!$t(bt.value))throw new s(`PATCH ${At} without a path requires an object value`,"invalidValue");for(let[xt,Rt]of Object.entries(bt.value))Sn(Tt,At,xt,Rt);return}Sn(Tt,At,bt.path,bt.value)}var o="urn:ionite:scim:schemas:extension:ion:2.0:User",S="urn:ionite:scim:schemas:core:2.0:Workload",k="urn:ionite:scim:schemas:core:2.0:Customer",b="urn:ionite:scim:schemas:core:2.0:Delegate";function Et(Tt,bt,At,xt,Rt){if(Tt===void 0||Tt===null){if(At)xt.push({message:`${bt} is required`,path:Rt});return}if(typeof Tt!=="string"){xt.push({message:`${bt} must be a string`,path:Rt});return}return Tt}function Vt(Tt,bt,At,xt){if(Tt===void 0||Tt===null)return;if(typeof Tt!=="boolean"){At.push({message:`${bt} must be a boolean`,path:xt});return}return Tt}function zn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(typeof Tt!=="object"||Tt===null){bt.push({message:"name must be an object",path:At});return}let xt=Tt,Rt={};return Rt.formatted=Et(xt.formatted,"formatted",!1,bt,[...At,"formatted"]),Rt.familyName=Et(xt.familyName,"familyName",!1,bt,[...At,"familyName"]),Rt.givenName=Et(xt.givenName,"givenName",!1,bt,[...At,"givenName"]),Rt.middleName=Et(xt.middleName,"middleName",!1,bt,[...At,"middleName"]),Rt.honorificPrefix=Et(xt.honorificPrefix,"honorificPrefix",!1,bt,[...At,"honorificPrefix"]),Rt.honorificSuffix=Et(xt.honorificSuffix,"honorificSuffix",!1,bt,[...At,"honorificSuffix"]),Rt}function Gn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"emails must be an array",path:At});return}let xt=[];for(let Rt=0;Rt<Tt.length;Rt++){let It=Tt[Rt],wt=[...At,Rt];if(typeof It!=="object"||It===null){bt.push({message:"email must be an object",path:wt});continue}let Ct=It,Ot=Et(Ct.value,"value",!0,bt,[...wt,"value"]);if(Ot)xt.push({value:Ot,display:Et(Ct.display,"display",!1,bt,[...wt,"display"]),type:Et(Ct.type,"type",!1,bt,[...wt,"type"]),primary:Vt(Ct.primary,"primary",bt,[...wt,"primary"])})}return xt.length>0?xt:void 0}function Kn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"phoneNumbers must be an array",path:At});return}let xt=[];for(let Rt=0;Rt<Tt.length;Rt++){let It=Tt[Rt],wt=[...At,Rt];if(typeof It!=="object"||It===null){bt.push({message:"phoneNumber must be an object",path:wt});continue}let Ct=It,Ot=Et(Ct.value,"value",!0,bt,[...wt,"value"]);if(Ot)xt.push({value:Ot,display:Et(Ct.display,"display",!1,bt,[...wt,"display"]),type:Et(Ct.type,"type",!1,bt,[...wt,"type"]),primary:Vt(Ct.primary,"primary",bt,[...wt,"primary"])})}return xt.length>0?xt:void 0}function Bn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"addresses must be an array",path:At});return}let xt=[];for(let Rt=0;Rt<Tt.length;Rt++){let It=Tt[Rt],wt=[...At,Rt];if(typeof It!=="object"||It===null){bt.push({message:"address must be an object",path:wt});continue}let Ct=It;xt.push({formatted:Et(Ct.formatted,"formatted",!1,bt,[...wt,"formatted"]),streetAddress:Et(Ct.streetAddress,"streetAddress",!1,bt,[...wt,"streetAddress"]),locality:Et(Ct.locality,"locality",!1,bt,[...wt,"locality"]),region:Et(Ct.region,"region",!1,bt,[...wt,"region"]),postalCode:Et(Ct.postalCode,"postalCode",!1,bt,[...wt,"postalCode"]),country:Et(Ct.country,"country",!1,bt,[...wt,"country"]),type:Et(Ct.type,"type",!1,bt,[...wt,"type"]),primary:Vt(Ct.primary,"primary",bt,[...wt,"primary"])})}return xt.length>0?xt:void 0}function Vn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"groups must be an array",path:At});return}let xt=[];for(let Rt=0;Rt<Tt.length;Rt++){let It=Tt[Rt],wt=[...At,Rt];if(typeof It!=="object"||It===null){bt.push({message:"group must be an object",path:wt});continue}let Ct=It,Ot=Et(Ct.value,"value",!0,bt,[...wt,"value"]);if(Ot)xt.push({value:Ot,$ref:Et(Ct.$ref,"$ref",!1,bt,[...wt,"$ref"]),display:Et(Ct.display,"display",!1,bt,[...wt,"display"]),type:Et(Ct.type,"type",!1,bt,[...wt,"type"])})}return xt.length>0?xt:void 0}function Hn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"roles must be an array",path:At});return}let xt=[];for(let Rt=0;Rt<Tt.length;Rt++){let It=Tt[Rt],wt=[...At,Rt];if(typeof It!=="object"||It===null){bt.push({message:"role must be an object",path:wt});continue}let Ct=It,Ot=Et(Ct.value,"value",!0,bt,[...wt,"value"]);if(Ot)xt.push({value:Ot,display:Et(Ct.display,"display",!1,bt,[...wt,"display"]),type:Et(Ct.type,"type",!1,bt,[...wt,"type"]),primary:Vt(Ct.primary,"primary",bt,[...wt,"primary"])})}return xt.length>0?xt:void 0}function Wn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(typeof Tt!=="object"||Tt===null){bt.push({message:"Enterprise User extension must be an object",path:At});return}let xt=Tt,Rt={};if(Rt.employeeNumber=Et(xt.employeeNumber,"employeeNumber",!1,bt,[...At,"employeeNumber"]),Rt.costCenter=Et(xt.costCenter,"costCenter",!1,bt,[...At,"costCenter"]),Rt.organization=Et(xt.organization,"organization",!1,bt,[...At,"organization"]),Rt.division=Et(xt.division,"division",!1,bt,[...At,"division"]),Rt.department=Et(xt.department,"department",!1,bt,[...At,"department"]),xt.manager!==void 0&&xt.manager!==null)if(typeof xt.manager!=="object"||xt.manager===null)bt.push({message:"manager must be an object",path:[...At,"manager"]});else{let It=xt.manager;Rt.manager={value:Et(It.value,"value",!1,bt,[...At,"manager","value"]),$ref:Et(It.$ref,"$ref",!1,bt,[...At,"manager","$ref"]),displayName:Et(It.displayName,"displayName",!1,bt,[...At,"manager","displayName"])}}return Rt}function st(Tt){return{"~standard":{version:1,vendor:Tt,validate:(bt)=>{if(typeof bt!=="object"||bt===null)return{issues:[{message:"Expected an object"}]};let At=bt,xt=[],Rt={},It=Et(At.userName,"userName",!0,xt,["userName"]);if(!It)return{issues:xt};if(Rt.userName=It,Rt.id=Et(At.id,"id",!1,xt,["id"]),Rt.externalId=Et(At.externalId,"externalId",!1,xt,["externalId"]),Rt.displayName=Et(At.displayName,"displayName",!1,xt,["displayName"]),Rt.nickName=Et(At.nickName,"nickName",!1,xt,["nickName"]),Rt.profileUrl=Et(At.profileUrl,"profileUrl",!1,xt,["profileUrl"]),Rt.title=Et(At.title,"title",!1,xt,["title"]),Rt.userType=Et(At.userType,"userType",!1,xt,["userType"]),Rt.preferredLanguage=Et(At.preferredLanguage,"preferredLanguage",!1,xt,["preferredLanguage"]),Rt.locale=Et(At.locale,"locale",!1,xt,["locale"]),Rt.timezone=Et(At.timezone,"timezone",!1,xt,["timezone"]),At.password!==void 0)xt.push({message:"password is not supported: the SDK does not accept credentials via SCIM",path:["password"]});Rt.active=Vt(At.active,"active",xt,["active"]),Rt.name=zn(At.name,xt,["name"]),Rt.emails=Gn(At.emails,xt,["emails"]),Rt.phoneNumbers=Kn(At.phoneNumbers,xt,["phoneNumbers"]),Rt.addresses=Bn(At.addresses,xt,["addresses"]),Rt.groups=Vn(At.groups,xt,["groups"]),Rt.roles=Hn(At.roles,xt,["roles"]);let wt="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(At[wt]!==void 0)Rt[wt]=Wn(At[wt],xt,[wt]);if(At.schemas!==void 0)if(Array.isArray(At.schemas))Rt.schemas=At.schemas.filter((Ct)=>typeof Ct==="string");else xt.push({message:"schemas must be an array",path:["schemas"]});if(At.meta!==void 0)if(typeof At.meta==="object"&&At.meta!==null){let Ct=At.meta;Rt.meta={resourceType:typeof Ct.resourceType==="string"?Ct.resourceType:void 0,created:typeof Ct.created==="string"?Ct.created:void 0,lastModified:typeof Ct.lastModified==="string"?Ct.lastModified:void 0,location:typeof Ct.location==="string"?Ct.location:void 0,version:typeof Ct.version==="string"?Ct.version:void 0}}else xt.push({message:"meta must be an object",path:["meta"]});if(xt.length>0)return{issues:xt};return{value:Rt}}}}}function Fn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"members must be an array",path:At});return}let xt=[];for(let Rt=0;Rt<Tt.length;Rt++){let It=Tt[Rt],wt=[...At,Rt];if(typeof It!=="object"||It===null){bt.push({message:"member must be an object",path:wt});continue}let Ct=It,Ot=Et(Ct.value,"value",!0,bt,[...wt,"value"]);if(Ot){let vt=Et(Ct.type,"type",!1,bt,[...wt,"type"]);if(vt!==void 0&&vt!=="User"&&vt!=="Group"&&vt!=="Workload"&&vt!=="Customer"&&vt!=="Delegate")bt.push({message:"type must be 'User', 'Group', 'Workload', 'Customer', or 'Delegate'",path:[...wt,"type"]});xt.push({value:Ot,$ref:Et(Ct.$ref,"$ref",!1,bt,[...wt,"$ref"]),display:Et(Ct.display,"display",!1,bt,[...wt,"display"]),type:vt==="User"||vt==="Group"||vt==="Workload"||vt==="Customer"||vt==="Delegate"?vt:void 0})}}return xt.length>0?xt:void 0}function ot(Tt){return{"~standard":{version:1,vendor:Tt,validate:(bt)=>{if(typeof bt!=="object"||bt===null)return{issues:[{message:"Expected an object"}]};let At=bt,xt=[],Rt={},It=Et(At.displayName,"displayName",!0,xt,["displayName"]);if(!It)return{issues:xt};if(Rt.displayName=It,Rt.id=Et(At.id,"id",!1,xt,["id"]),Rt.externalId=Et(At.externalId,"externalId",!1,xt,["externalId"]),Rt.members=Fn(At.members,xt,["members"]),At.schemas!==void 0)if(Array.isArray(At.schemas))Rt.schemas=At.schemas.filter((wt)=>typeof wt==="string");else xt.push({message:"schemas must be an array",path:["schemas"]});if(At.meta!==void 0)if(typeof At.meta==="object"&&At.meta!==null){let wt=At.meta;Rt.meta={resourceType:typeof wt.resourceType==="string"?wt.resourceType:void 0,created:typeof wt.created==="string"?wt.created:void 0,lastModified:typeof wt.lastModified==="string"?wt.lastModified:void 0,location:typeof wt.location==="string"?wt.location:void 0,version:typeof wt.version==="string"?wt.version:void 0}}else xt.push({message:"meta must be an object",path:["meta"]});if(xt.length>0)return{issues:xt};return{value:Rt}}}}}function tn(Tt,bt){if(Tt===void 0)return;if(typeof Tt!=="object"||Tt===null){bt.push({message:"meta must be an object",path:["meta"]});return}let At=Tt;return{resourceType:typeof At.resourceType==="string"?At.resourceType:void 0,created:typeof At.created==="string"?At.created:void 0,lastModified:typeof At.lastModified==="string"?At.lastModified:void 0,location:typeof At.location==="string"?At.location:void 0,version:typeof At.version==="string"?At.version:void 0}}function nn(Tt,bt){if(Tt===void 0)return;if(!Array.isArray(Tt)){bt.push({message:"schemas must be an array",path:["schemas"]});return}return Tt.filter((At)=>typeof At==="string")}function xn(Tt,bt){if(Tt===void 0)return;if(typeof Tt!=="object"||Tt===null||Array.isArray(Tt)){bt.push({message:"attributes must be an object",path:["attributes"]});return}return{...Tt}}var le={"~standard":{version:1,vendor:"ionite",validate:(Tt)=>{let bt=[];if(typeof Tt!=="object"||Tt===null)return{issues:[{message:"Workload must be an object"}]};let At=Tt,xt={schemas:nn(At.schemas,bt),id:Et(At.id,"id",!1,bt,["id"]),externalId:Et(At.externalId,"externalId",!1,bt,["externalId"]),userName:Et(At.userName,"userName",!1,bt,["userName"]),displayName:Et(At.displayName,"displayName",!1,bt,["displayName"]),description:Et(At.description,"description",!1,bt,["description"]),active:typeof At.active==="boolean"?At.active:void 0,providerId:Et(At.providerId,"providerId",!1,bt,["providerId"]),requestUrl:Et(At.requestUrl,"requestUrl",!1,bt,["requestUrl"]),attributes:xn(At.attributes,bt),meta:tn(At.meta,bt)};if(bt.length>0)return{issues:bt};return{value:xt}}}},pe={"~standard":{version:1,vendor:"ionite",validate:(Tt)=>{let bt=[];if(typeof Tt!=="object"||Tt===null)return{issues:[{message:"Customer must be an object"}]};let At=Tt,xt=At.emails,Rt;if(xt!==void 0)if(!Array.isArray(xt))bt.push({message:"emails must be an array",path:["emails"]});else Rt=xt.filter((wt)=>typeof wt==="object"&&wt!==null&&typeof wt.value==="string");let It={schemas:nn(At.schemas,bt),id:Et(At.id,"id",!1,bt,["id"]),externalId:Et(At.externalId,"externalId",!1,bt,["externalId"]),userName:Et(At.userName,"userName",!1,bt,["userName"]),displayName:Et(At.displayName,"displayName",!1,bt,["displayName"]),active:typeof At.active==="boolean"?At.active:void 0,emails:Rt,providerId:Et(At.providerId,"providerId",!1,bt,["providerId"]),requestUrl:Et(At.requestUrl,"requestUrl",!1,bt,["requestUrl"]),attributes:xn(At.attributes,bt),meta:tn(At.meta,bt)};if(bt.length>0)return{issues:bt};return{value:It}}}},me={"~standard":{version:1,vendor:"ionite",validate:(Tt)=>{let bt=[];if(typeof Tt!=="object"||Tt===null)return{issues:[{message:"Delegate must be an object"}]};let At=Tt,xt=typeof At.owner==="object"&&At.owner!==null?At.owner:void 0,Rt=Et(xt?.value,"value",!0,bt,["owner","value"]),It=Et(xt?.type,"type",!0,bt,["owner","type"]);if(It!==void 0&&It!=="User"&&It!=="Customer"&&It!=="Workload")bt.push({message:"owner.type must be 'User', 'Customer', or 'Workload'",path:["owner","type"]});let wt={schemas:nn(At.schemas,bt),id:Et(At.id,"id",!1,bt,["id"]),externalId:Et(At.externalId,"externalId",!1,bt,["externalId"]),userName:Et(At.userName,"userName",!1,bt,["userName"]),displayName:Et(At.displayName,"displayName",!1,bt,["displayName"]),active:typeof At.active==="boolean"?At.active:void 0,owner:{value:Rt??"",type:It==="Customer"||It==="Workload"?It:"User"},clientId:Et(At.clientId,"clientId",!1,bt,["clientId"]),expiresAt:Et(At.expiresAt,"expiresAt",!1,bt,["expiresAt"]),tokenHash:Et(At.tokenHash,"tokenHash",!1,bt,["tokenHash"]),previousTokenHash:Et(At.previousTokenHash,"previousTokenHash",!1,bt,["previousTokenHash"]),previousTokenHashExpiresAt:Et(At.previousTokenHashExpiresAt,"previousTokenHashExpiresAt",!1,bt,["previousTokenHashExpiresAt"]),lastUsedAt:Et(At.lastUsedAt,"lastUsedAt",!1,bt,["lastUsedAt"]),lastUsedWindowSeconds:typeof At.lastUsedWindowSeconds==="number"?At.lastUsedWindowSeconds:void 0,providerId:Et(At.providerId,"providerId",!1,bt,["providerId"]),requestUrl:Et(At.requestUrl,"requestUrl",!1,bt,["requestUrl"]),meta:tn(At.meta,bt)};if(bt.length>0)return{issues:bt};return{value:wt}}}};var Yn=new Set(["active"]);function wn(Tt){if(typeof Tt!=="string")return Tt;let bt=Tt.toLowerCase();if(bt==="true")return!0;if(bt==="false")return!1;return Tt}var Cn="urn:ietf:params:scim:schemas:extension:enterprise:2.0:user";function Jn(Tt){let bt=Tt.toLowerCase();return bt==="manager"||bt===`${Cn}:manager`}function sn(Tt){if(typeof Tt==="string")return Tt?{value:Tt}:Tt;if(Array.isArray(Tt))return Tt.length>0?sn(Tt[0]):Tt;return Tt}var Xn="WindowsAzureActiveDirectoryRole";function Zn(Tt){if(typeof Tt.value!=="string"||!Tt.value.startsWith("{"))return Tt;try{let bt=JSON.parse(Tt.value);if(typeof bt.value!=="string")return Tt;return{displayName:bt.displayName,...Tt,value:bt.value}}catch{return Tt}}function Rn(Tt){if(typeof Tt!=="object"||Tt===null)return Tt;let{displayName:bt,...At}=Zn(Tt);if(typeof bt==="string"&&At.display===void 0)At.display=bt;if(At.type===Xn)delete At.type;if("primary"in At)At.primary=wn(At.primary);return At}function Qn(Tt){return Array.isArray(Tt)?Tt.map(Rn):Rn(Tt)}function Yt(Tt,bt){let At=Tt.toLowerCase();if(Yn.has(At))return wn(bt);if(Jn(Tt))return sn(bt);if(At==="roles")return Qn(bt);if(At===Cn&&typeof bt==="object"&&bt!==null&&"manager"in bt)return{...bt,manager:sn(bt.manager)};return bt}function es(Tt){if(typeof Tt!=="object"||Tt===null||Array.isArray(Tt))return Tt;let bt={...Tt};for(let At of Object.keys(bt))bt[At]=Yt(At,bt[At]);return bt}function ts(Tt){return Tt.op.toLowerCase()==="add"&&Tt.path?.toLowerCase()==="roles"}var N="urn:ietf:params:scim:schemas:extension:ionite:2.0:User",rn=N.toLowerCase();function on(Tt){let bt=Tt.toLowerCase();if(bt===rn)return o;if(bt.startsWith(`${rn}:`))return o+Tt.slice(N.length);return Tt}function ns(Tt){return Tt.map((bt)=>{let At=bt.path?{...bt,path:on(bt.path)}:bt;if(ts(At))return{...At,op:"replace",value:Yt("roles",At.value)};if(At.path)return{...At,value:Yt(At.path,At.value)};if(typeof At.value==="object"&&At.value!==null&&!Array.isArray(At.value)){let xt={};for(let[Rt,It]of Object.entries(At.value)){let wt=on(Rt);if(wt in xt)throw new s(`PATCH value carries ${wt} under both names; send one`,"invalidValue");xt[wt]=Yt(wt,It)}return{...At,value:xt}}return At})}function ss(Tt){if(typeof Tt!=="object"||Tt===null||Array.isArray(Tt))return Tt;let bt=Tt,At=Object.keys(bt).find((Ct)=>Ct.toLowerCase()===rn);if(At===void 0)return Tt;let xt=o.toLowerCase();if(Object.keys(bt).some((Ct)=>Ct.toLowerCase()===xt))throw new s(`User carries both ${o} and ${N}; send one`,"invalidValue");let{[At]:Rt,...It}=bt,wt=Array.isArray(It.schemas)?It.schemas.map((Ct)=>typeof Ct==="string"?on(Ct):Ct):It.schemas;return{...It,...wt!==void 0&&{schemas:wt},[o]:Rt}}function rs(Tt){let{[o]:bt,...At}=Tt;if(bt===void 0)return Tt;return{...At,schemas:At.schemas?.map((xt)=>xt===o?N:xt),[N]:bt}}var is={scim:{},entra:{normalizeResource:es,normalizePatch:ns,normalizeUser:ss,projectUser:rs},okta:{},sailpoint:{}},Gt=(Tt)=>Tt,In={type:"scim",normalizeResource:Gt,normalizePatch:Gt,normalizeUser:Gt,projectUser:Gt};function we(Tt){for(let bt of["client_id","azp","sub"]){let At=Tt?.[bt];if(typeof At==="string"&&At)return At}return}function Ce(Tt,bt){if(!Tt||!bt)return In;for(let[At,xt]of Object.entries(Tt)){if(xt.enabled===!1||!xt.clientIds?.includes(bt))continue;let Rt=is[xt.type];if(!Rt)continue;return{name:At,type:xt.type,normalizeResource:Rt.normalizeResource??Gt,normalizePatch:Rt.normalizePatch??Gt,normalizeUser:Rt.normalizeUser??Gt,projectUser:Rt.projectUser??Gt}}return In}var Mt=["workload"],Ae={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Re={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Ie={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},ve={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},xe={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Ee={id:"ion:iam:delegates:write",name:"Manage Delegates (SCIM Delegates)",description:"Authorizes a workload to create, replace, modify, and delete Delegate principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Pe={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},De={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Ue={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Mt},_e={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Oe={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},fe=[Ae,Re,Ie,ve,xe,Ee,Pe,De,Ue,_e,Oe],it={"iam.read":{permission:Ae,subjectType:["workload"]},"iam.users.write":{permission:Re,subjectType:["workload"]},"iam.groups.write":{permission:Ie,subjectType:["workload"]},"iam.workloads.write":{permission:ve,subjectType:["workload"]},"iam.customers.write":{permission:xe,subjectType:["workload"]},"iam.delegates.write":{permission:Ee,subjectType:["workload"]},"iam.access-requests.write":{permission:Pe,subjectType:["workload"]},"capabilitiez.read":{permission:De,subjectType:["workload"]},"ciam.magic-link.create":{permission:Ue,subjectType:["workload","user"]},"authz.oaa.sync":{permission:_e,subjectType:["workload"]},"tenant.manage":{permission:Oe,subjectType:["workload"]}};function ge(Tt){return{"~standard":{version:1,vendor:Tt,validate:(bt)=>{if(typeof bt!=="object"||bt===null)return{issues:[{message:"Expected an object"}]};let At=bt,xt=[],Rt={};if("code"in At)if(typeof At.code==="string")Rt.code=At.code;else xt.push({message:"code must be a string",path:["code"]});else if(!("error"in At))xt.push({message:"code is required",path:["code"]});if("state"in At)if(typeof At.state==="string"||At.state===void 0)Rt.state=At.state;else xt.push({message:"state must be a string",path:["state"]});if("session_state"in At)if(typeof At.session_state==="string"||At.session_state===void 0)Rt.session_state=At.session_state;else xt.push({message:"session_state must be a string",path:["session_state"]});if("error"in At){if(typeof At.error==="string")Rt.error=At.error;else xt.push({message:"error must be a string",path:["error"]});if("error_description"in At)if(typeof At.error_description==="string"||At.error_description===void 0)Rt.error_description=At.error_description;else xt.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in At)if(typeof At.error_uri==="string"||At.error_uri===void 0)Rt.error_uri=At.error_uri;else xt.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in At)if(typeof At.iss==="string"||At.iss===void 0)Rt.iss=At.iss;else xt.push({message:"iss must be a string",path:["iss"]});if(xt.length>0)return{issues:xt};return{value:Rt}}}}}function ye(Tt){return{"~standard":{version:1,vendor:Tt,validate:(bt)=>{if(typeof bt!=="object"||bt===null)return{issues:[{message:"Expected an object"}]};let At=bt,xt=[],Rt={};if("access_token"in At)if(typeof At.access_token==="string")Rt.access_token=At.access_token;else xt.push({message:"access_token must be a string",path:["access_token"]});else xt.push({message:"access_token is required",path:["access_token"]});if("id_token"in At)if(typeof At.id_token==="string")Rt.id_token=At.id_token;else xt.push({message:"id_token must be a string",path:["id_token"]});else xt.push({message:"id_token is required",path:["id_token"]});if("token_type"in At)if(typeof At.token_type==="string")Rt.token_type=At.token_type;else xt.push({message:"token_type must be a string",path:["token_type"]});else xt.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in At)if(typeof At.refresh_token==="string"||At.refresh_token===void 0)Rt.refresh_token=At.refresh_token;else xt.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in At)if(typeof At.scope==="string"||At.scope===void 0)Rt.scope=At.scope;else xt.push({message:"scope must be a string",path:["scope"]});if("session_state"in At)if(typeof At.session_state==="string"||At.session_state===void 0)Rt.session_state=At.session_state;else xt.push({message:"session_state must be a string",path:["session_state"]});if("expires"in At)if(typeof At.expires==="string"||At.expires===void 0)Rt.expires=At.expires;else xt.push({message:"expires must be a string",path:["expires"]});if("expires_in"in At)if(typeof At.expires_in==="number"||At.expires_in===void 0)Rt.expires_in=At.expires_in;else xt.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in At)if(typeof At.refresh_expires_in==="number"||At.refresh_expires_in===void 0)Rt.refresh_expires_in=At.refresh_expires_in;else xt.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(xt.length>0)return{issues:xt};return{value:Rt}}}}}function T(Tt){return{"~standard":{version:1,vendor:Tt,validate:(bt)=>{if(typeof bt!=="object"||bt===null)return{issues:[{message:"Expected an object"}]};let At=bt,xt=[],Rt={...At},It=["iss","sub"];for(let vt of It)if(typeof At[vt]!=="string")xt.push({message:`${vt} is required and must be a string`,path:[vt]});let wt=At.aud;if(!(typeof wt==="string"||Array.isArray(wt)&&wt.length>0&&wt.every((vt)=>typeof vt==="string")))xt.push({message:"aud is required and must be a string or a non-empty array of strings",path:["aud"]});if(typeof At.exp!=="number")xt.push({message:"exp is required and must be a number",path:["exp"]});let Ot=["sid","name","email","preferred_username","picture"];for(let vt of Ot)if(vt in At&&At[vt]!==void 0){if(typeof At[vt]!=="string")xt.push({message:`${vt} must be a string`,path:[vt]})}if("iat"in At&&At.iat!==void 0&&typeof At.iat!=="number")xt.push({message:"iat must be a number",path:["iat"]});if(xt.length>0)return{issues:xt};return{value:Rt}}}}}var a="application/json",at="application/scim+json",L="application/x-www-form-urlencoded",Me="application/xml",je="application/octet-stream",l=Object.freeze({Accept:"application/json"}),he=Object.freeze({Accept:"application/scim+json, application/json"}),ct=Object.freeze({Accept:"application/xml"}),ut=Object.freeze({Accept:"application/octet-stream"}),i=Object.freeze({"Content-Type":"application/json"}),R=Object.freeze({"Content-Type":"application/scim+json"}),w=Object.freeze({"Content-Type":"application/x-www-form-urlencoded"}),dt=Object.freeze({"Content-Type":"application/xml"}),lt=Object.freeze({"Content-Type":"application/octet-stream"});function ze(Tt){let bt=Tt.headers.get("content-type")?.split(";",1)[0]?.trim().toLowerCase();return Boolean(bt&&(bt==="application/json"||bt.endsWith("+json")))}function os(Tt){let bt=Tt.replace(/\s+/g," ").trim();return bt?bt.slice(0,300):void 0}async function Z(Tt,bt={}){let At=Tt.headers.get("content-type")??void 0,xt;try{xt=await Tt.text()}catch{return{contentType:At}}let Rt=/<title(?:\s[^>]*)?>([\s\S]*?)<\/title>/i.exec(xt)?.[1],It=os(Rt??(bt.redact?"":xt));return{contentType:At,excerpt:It}}async function d(Tt,bt={}){if(ze(Tt))return await Tt.json();let At=await Z(Tt,{redact:bt.redact});bt.log?.warn("Expected a JSON response body but received a different content type",{"ion.operation":bt.operation??"http.response","ion.outcome":"degraded",reason:"non_json_response",status:Tt.status,contentType:At.contentType,excerpt:At.excerpt});let xt=[At.contentType,At.excerpt].filter(Boolean).join(": ");throw Error(`Expected a JSON response body${xt?`; received ${xt}`:""}`)}function m(Tt){let bt=Tt["~standard"];return Object.assign(Tt,{validate(At){return Promise.resolve(bt.validate(At))}})}function e(Tt,bt="Assertion failed. Required value is null or undefined."){if(Tt===void 0||Tt===null)throw Error(bt);return Tt}function Se(Tt,bt){return Response.json({error:"validation_failed",message:bt,issues:Tt},{status:400,headers:i})}function pt(Tt,bt,At=[]){let xt={...Tt,...bt};for(let Rt of At)xt[Rt]=Tt?.[Rt]??bt?.[Rt];return xt}function Be(Tt){let bt="",At=0,xt=Tt.length;while(At<xt){let Rt=Tt[At];if(Rt==='"'||Rt==="'"){let It=Rt;bt+=Rt,At++;while(At<xt){let wt=Tt[At];if(wt==="\\"){if(bt+=wt,At+1<xt)bt+=Tt[At+1],At+=2;else At++;continue}if(wt===It){bt+=wt,At++;break}bt+=wt,At++}continue}if(Rt==="/"&&At+1<xt){let It=Tt[At+1];if(It==="/"){At+=2;while(At<xt&&Tt[At]!==`
+`)At++;if(At<xt)bt+=`
+`;At++;continue}if(It==="*"){At+=2;while(At+1<xt&&!(Tt[At]==="*"&&Tt[At+1]==="/"))At++;At+=2;continue}}bt+=Rt,At++}return bt}function as(Tt){let bt="",At=!1,xt=!1;for(let Rt=0;Rt<Tt.length;Rt+=1){let It=Tt[Rt];if(At){if(bt+=It,xt)xt=!1;else if(It==="\\")xt=!0;else if(It==='"')At=!1;continue}if(It==='"'){At=!0,bt+=It;continue}if(It===","){let wt=Rt+1;while(wt<Tt.length&&/\s/.test(Tt[wt]??""))wt+=1;let Ct=Tt[wt];if(Ct==="}"||Ct==="]")continue}bt+=It}return bt}function mt(Tt){let bt=as(Be(Tt));return JSON.parse(bt)}function I(Tt){return Tt==="/"?Tt:Tt.replace(/\/+$/,"")}function an(Tt){if(Tt===null||typeof Tt!=="object"||Array.isArray(Tt))return!1;let bt=Object.getPrototypeOf(Tt);return bt===Object.prototype||bt===null}function un(Tt){return Object.keys(Tt).filter((bt)=>Tt[bt]!==void 0).sort()}function C(Tt,bt){if(Object.is(Tt,bt))return!0;if(Tt===null||bt===null)return Tt===bt;if(Array.isArray(Tt)||Array.isArray(bt)){if(!Array.isArray(Tt)||!Array.isArray(bt)||Tt.length!==bt.length)return!1;for(let Rt=0;Rt<Tt.length;Rt+=1)if(!C(Tt[Rt],bt[Rt]))return!1;return!0}if(!an(Tt)||!an(bt))return!1;let At=un(Tt),xt=un(bt);if(At.length!==xt.length)return!1;for(let Rt=0;Rt<At.length;Rt+=1)if(At[Rt]!==xt[Rt])return!1;for(let Rt of At)if(!C(Tt[Rt],bt[Rt]))return!1;return!0}function cn(Tt,bt){if(Tt===null||Tt===void 0){bt.push("n");return}if(Array.isArray(Tt)){bt.push("[");for(let At of Tt)cn(At,bt);bt.push("]");return}if(an(Tt)){bt.push("{");for(let At of un(Tt))bt.push(JSON.stringify(At),":"),cn(Tt[At],bt);bt.push("}");return}bt.push(JSON.stringify(Tt))}function ft(Tt){let bt=[];cn(Tt,bt);let At=bt.join(""),xt=2166136261;for(let Rt=0;Rt<At.length;Rt+=1)xt^=At.charCodeAt(Rt),xt=xt*16777619%9007199254740992;return`${At.length.toString(36)}:${xt.toString(36)}`}async function gt(Tt,bt=async(wt)=>wt.status===200,At=1000,xt=1e4,Rt,It){let wt=Date.now(),Ct=`Awaiting Ping (${Tt})`;return new Promise((Ot,vt)=>{let Pt=null,kt=null,_t=null,jt=!1,Nt=()=>{if(Pt)clearTimeout(Pt);if(kt)clearInterval(kt);if(_t)clearTimeout(_t);Pt=null,kt=null,_t=null},Dt=(Ut)=>{if(jt)return;jt=!0,Nt(),Ut()},Lt=Math.max(At,1e4),qt=async()=>{try{let Ut=await fetch(Tt,{headers:l,signal:AbortSignal.timeout(Lt)});if(Ut.ok){if(await bt(Ut)){Dt(Ot);return}Ct=`Response test failed: ${Ut.status}: ${Ut.statusText} - ${Tt}`}else try{let Ht=await d(Ut,{log:It,operation:"wait_on.probe"});Ct=`Response error: ${Ut.status}: ${Ut.statusText} - ${Tt}: ${JSON.stringify(Ht)}`}catch(Ht){let kn=Ht instanceof Error?`: ${Ht.message}`:"";Ct=`Response error: ${Ut.status}: ${Ut.statusText} - ${Tt}${kn}`}}catch(Ut){Ct=`${Ut instanceof Error?Ut.message:String(Ut)} - ${Tt}`}if(!jt)Pt=setTimeout(()=>void qt(),At)};if(xt>0)kt=setInterval(()=>{It?.warn(`${Ct}: ${Date.now()-wt}ms`)},xt);if(Rt)_t=setTimeout(()=>{Dt(()=>vt(Error(`Timeout: ${Rt}ms: ${Ct}`)))},Rt);qt()})}var us="@ionite/core",cs=m(T(us));function Q(Tt){let bt=Tt.exp!=null?new Date(Tt.exp*1000):new Date,At=Tt.iss??"";return{id:Tt.sub??"",userName:Tt.preferred_username??"",name:Tt.name??"",email:Tt.email??"",avatar:Tt.picture,sso:{profile:{...Tt,iss:Tt.iss??At,aud:Tt.aud},tenant:{id:Tt.idp??At,name:At},tokenType:"Bearer",expires:bt}}}function ds(Tt){let bt=Tt.replace(/-/g,"+").replace(/_/g,"/");return atob(bt)}async function yt(Tt){let bt=Tt.split(".");if(bt.length!==3)throw Error("Invalid JWT");let At=ds(bt[1]),xt=JSON.parse(At),Rt=await cs.validate(xt);if(Rt.issues)throw Error(`ID token claims validation failed: ${Rt.issues.map((It)=>It.message).join("; ")}`);if(Rt.value)return Q(Rt.value);throw Error("ID token claims validation failed")}class v extends n{constructor(Tt,bt,At){super(Tt,{status:409,statusText:"conflict"});this.name="StoreConflictError";this.code="conflict";this.kind=bt,this.field=At}safeBody(){return{kind:this.kind,...this.field!==void 0?{field:this.field}:{}}}}function q(Tt){return Tt instanceof v||typeof Tt==="object"&&Tt!=null&&Tt.code==="conflict"}function Ne(Tt){if(typeof Tt!=="object"||Tt==null)return!1;let bt=Tt.type;if(bt==="vault"||bt==="aws"||bt==="azure"||bt==="gcp")return!0;if(bt!=="mirror")return!1;let At=Tt;return Ne(At.from)&&At.from.type!=="mirror"&&Ne(At.to)&&At.to.type==="vault"}var ht="ion-tm-handle+jwt";function St(Tt,bt=Date.now()){let At=Tt?.integration;if(!At)return{state:"none"};if(Date.parse(At.expiresAt)<=bt)return{state:"expired",integration:At};if(At.status==="consented"&&At.handoverAppliedAt&&Tt.configLocator)return{state:"integrated",integration:At};return{state:At.status,integration:At}}class En{constructor(){this.tenants=new Map;this.integrationHandles=new Map;this.requestTokens=new Map;this.ioniteIds=new Map}async get(Tt){return this.tenants.get(Tt)}async list(Tt){let bt=Array.from(this.tenants.values()),At=Math.max(0,Tt?.start??0),xt=Tt?.limit,Rt=bt.length,It=xt!=null?At+xt:void 0,wt=bt.slice(At,It);return K(Rt,wt,At,xt)}async upsert(Tt){let bt=this.tenants.get(Tt.id);if(bt?.ioniteId!==Tt.ioniteId){if(bt?.ioniteId)throw Error("ionite id cannot change");if(Tt.ioniteId){let At=this.ioniteIds.get(Tt.ioniteId);if(At&&At!==Tt.id)throw Error("ionite id is already in use");this.ioniteIds.set(Tt.ioniteId,Tt.id)}}if(bt?.integration?.handleHash!==Tt.integration?.handleHash){if(bt?.integration)this.integrationHandles.delete(bt.integration.handleHash);if(Tt.integration){let At=this.integrationHandles.get(Tt.integration.handleHash);if(At&&At!==Tt.id)throw Error("Integration handle hash is already in use");this.integrationHandles.set(Tt.integration.handleHash,Tt.id)}}if(bt?.requestTokenHash!==Tt.requestTokenHash){if(bt?.requestTokenHash)this.requestTokens.delete(bt.requestTokenHash);if(Tt.requestTokenHash){let At=this.requestTokens.get(Tt.requestTokenHash);if(At&&At!==Tt.id)throw Error("Request token hash is already in use");this.requestTokens.set(Tt.requestTokenHash,Tt.id)}}return this.tenants.set(Tt.id,Tt),Tt}async delete(Tt){let bt=this.tenants.get(Tt),At=bt!==void 0;if(bt?.integration)this.integrationHandles.delete(bt.integration.handleHash);if(bt?.requestTokenHash)this.requestTokens.delete(bt.requestTokenHash);if(bt?.ioniteId)this.ioniteIds.delete(bt.ioniteId);return this.tenants.delete(Tt),At?1:0}async setIntegration(Tt,bt,At){let xt=this.tenants.get(Tt);if(!xt)return;let Rt=xt.integration?.handleHash;if(At?.expectedHandleHash!==void 0&&(At.expectedHandleHash===null?Rt!==void 0:Rt!==At.expectedHandleHash))return;if(At?.expectedVersion!==void 0&&xt.integration?.version!==At.expectedVersion)return;if(C(xt.integration,bt))return xt;if(bt){let Ct=this.integrationHandles.get(bt.handleHash);if(Ct&&Ct!==Tt)throw Error("Integration handle hash is already in use")}if(xt.integration)this.integrationHandles.delete(xt.integration.handleHash);if(bt)this.integrationHandles.set(bt.handleHash,Tt);let It=bt?.ioniteId??xt.ioniteId;if(It){if(xt.ioniteId&&xt.ioniteId!==It)throw Error("ionite id cannot change");let Ct=this.ioniteIds.get(It);if(Ct&&Ct!==Tt)throw Error("ionite id is already in use");this.ioniteIds.set(It,Tt)}let wt={...xt,ioniteId:It,integration:bt,updatedAt:new Date};return this.tenants.set(Tt,wt),wt}async getByIntegrationHandleHash(Tt){let bt=this.integrationHandles.get(Tt);return bt?this.tenants.get(bt):void 0}async getByRequestTokenHash(Tt){let bt=this.requestTokens.get(Tt);return bt?this.tenants.get(bt):void 0}async replaceActionRequest(Tt,bt){let At=this.requestTokens.get(Tt),xt=At?this.tenants.get(At):void 0;if(!xt||xt.id!==bt.id||xt.status!=="action_required")return;return this.upsert(bt)}async getByIoniteId(Tt){let bt=this.ioniteIds.get(Tt);return bt?this.tenants.get(bt):void 0}}class Ge{constructor(Tt={}){this.ionCache=Tt.ionCache,this.store=new En}async get(Tt){return this.store.get(Tt)}async list(Tt){return this.store.list(Tt)}async upsert(Tt){let bt=await this.store.upsert(Tt);return this.ionCache?.delete(Tt.id),bt}async delete(Tt){let bt=await this.store.delete(Tt);return this.ionCache?.delete(Tt),bt}async getIon(Tt){if(!this.ionCache)throw Error(`${this.constructor.name}.getIon() requires an app-owned ionCache. Pass { ionCache } (an lru-cache instance whose fetchMethod builds the tenant Ionite and whose dispose `+"closes it) — the SDK does not cache tenant runtimes. See the multi-tenant docs.");return this.ionCache.fetch(Tt)}async setIntegration(Tt,bt,At){return this.store.setIntegration(Tt,bt,At)}async getByIntegrationHandleHash(Tt){return this.store.getByIntegrationHandleHash(Tt)}async getByRequestTokenHash(Tt){return this.store.getByRequestTokenHash(Tt)}async replaceActionRequest(Tt,bt){let At=await this.store.replaceActionRequest(Tt,bt);if(At)this.ionCache?.delete(At.id);return At}async getByIoniteId(Tt){return this.store.getByIoniteId(Tt)}}
+export{ee,He,p,x,E,P,c,n,te,K,u,Fe,ne,y,t,Je,h,D,re,Le,$e,Ye,qe,W,V,A,z,se,B,r,f,oe,U,ke,Xe,Ze,G,Qe,et,tt,ie,ae,H,ce,be,Te,g,F,Ke,ue,J,_,O,Y,We,M,Ve,nt,rt,j,s,de,X,o,S,k,b,st,ot,le,pe,me,N,we,Ce,Ae,Re,Ie,ve,xe,Ee,Pe,De,Ue,_e,Oe,fe,it,ge,ye,T,a,at,L,Me,je,l,he,ct,ut,i,R,w,dt,lt,ze,Z,d,m,e,Se,pt,Be,mt,I,C,ft,gt,Q,yt,v,q,Ne,ht,St,Ge};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/core",
-  "version": "0.0.24-beta.20261024.47",
+  "version": "0.0.24-beta.20261024.49",
   "description": "ionite Core (client-safe main entry; server handlers under ./server)",
   "private": false,
   "author": "ionite",

package/dist/shared/core-g9rg6g0j.js

@@ -1,4 +0,0 @@
-function pn(Tt){if(Tt===void 0||Tt===null)return[];return Array.isArray(Tt)?Tt:[Tt]}function ln(Tt){if(typeof Tt!=="string")return;return Tt.endsWith("/")?Tt.slice(0,-1):Tt}function _n(Tt,bt){if(ln(bt.issuer)!==ln(Tt.claims?.iss))return!1;let At=pn(bt.audience);if(At.length===0)return!1;let Rt=pn(Tt.claims?.aud),xt=typeof Tt.claims?.azp==="string"?Tt.claims.azp:void 0;if(!(At.some((Ct)=>Rt.includes(Ct))||(xt?At.includes(xt):!1)))return!1;let wt=Tt.clientId??Tt.workloadId??Tt.claims?.sub;return bt.clientId===wt}function ee(Tt,bt){let At=Tt?.trustedProvisioningClients;if(!At?.length)return;let Rt=new Set;for(let xt of At){if(!_n(bt,xt))continue;for(let It of xt.permissions??[])Rt.add(It)}return Rt.size>0?Rt:void 0}function He(Tt){let bt=Tt?.trustedProvisioningClients;if(!bt?.length)return[];let At=[];for(let Rt of bt)for(let xt of Rt.permissions??[])At.push({subject:Rt.clientId,subjectType:"workload",targetType:"permission",target:xt,status:"active",provenance:{source:"eci-trusted",actor:Rt.clientId}});return At}var p=["id","name","displayName","description","providerId","source","deprecated","type","parent","resources","assignableSubjectTypes","recommendedSubjectTypes","requestable","riskLevel","requestUrl","action","permissionTypes","resourceTypes","applyToSubResources","permissions","groups","roles"],x=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","ecid","accountClass","displayName","scimName","emails","nickName","active","title","preferredLanguage","locale","timezone","phoneNumbers","ims","photos","addresses","roles","groups","entitlements","x509Certificates","scimEnterprise","scimSchemaExtensions","createdAt","updatedAt","sso"],E=["id","userName","name","email","avatar","userType","tenantId","externalId","providerId","requestUrl","displayName","emails","phoneNumbers","active","createdAt","updatedAt","ciam"],P=["id","clientId","displayName","description","externalId","providerId","requestUrl","ecid","active","scopes","createdAt","updatedAt","metadata"];function c(Tt,bt){let At=new Set(bt),Rt=Object.fromEntries(Object.entries(Tt).filter(([xt,It])=>!At.has(xt)&&It!==void 0));return Object.keys(Rt).length>0?Rt:void 0}var fn=new WeakSet;function gn(Tt,bt){Object.defineProperty(Tt,"log",{value:bt,enumerable:!1,writable:!0,configurable:!0})}class n extends Error{constructor(Tt,bt={}){super(Tt,{cause:bt.cause});this.name="IoniteError",this.status=bt.status??500,this.upstreamStatus=bt.upstreamStatus,this.statusText=bt.statusText,this.detail=bt.detail,this.ionId=bt.ionId,gn(this,bt.log),Object.setPrototypeOf(this,new.target.prototype)}get _tag(){return this.name}attachContext(Tt){if(this.ionId===void 0&&Tt.ionId!==void 0)this.ionId=Tt.ionId;if(this.log===void 0&&Tt.log!==void 0)gn(this,Tt.log);return this}safeBody(){return{}}toLogAttributes(){let Tt=fn.has(this)&&this.cause instanceof Error?this.cause:this;return{"exception.type":Tt.name,"exception.message":Tt.message,...Tt.stack?{"exception.stacktrace":Tt.stack}:{},...this.ionId!==void 0?{"ion.id":this.ionId}:{},"http.status_code":this.status,...this.upstreamStatus!==void 0?{"ion.upstream.status":this.upstreamStatus}:{}}}response(Tt){let bt=Tt?.headers.get("accept")??"";if(bt.includes("text/html")&&!bt.includes("application/json")){let At=this.statusText?this.detail??this.statusText:"Internal Server Error";return new Response(At,{status:this.status,headers:{"content-type":"text/plain; charset=utf-8"}})}if(!this.statusText)return Response.json({error:"internal_error"},{status:this.status});return Response.json({error:this.statusText,...this.detail!==void 0?{detail:this.detail}:{},...this.safeBody()},{status:this.status})}toJSON(){return{name:this.name,_tag:this._tag,status:this.status,...this.statusText!==void 0?{statusText:this.statusText}:{},...this.detail!==void 0?{detail:this.detail}:{},...this.ionId!==void 0?{ionId:this.ionId}:{}}}static from(Tt,bt){if(Tt instanceof n){if(bt)Tt.attachContext(bt);return Tt}let At=Tt instanceof Error?Tt.message:"internal_error",Rt=new n(At,{status:500,cause:Tt,ionId:bt?.ionId,log:bt?.log});return fn.add(Rt),Rt}}function te(Tt){if(!Tt||typeof Tt!=="object")return;let bt=Tt.toLogAttributes;if(typeof bt!=="function")return;let At=bt.call(Tt);if(!At||typeof At!=="object")return;return At}function K(Tt,bt,At,Rt){let xt=bt.length,It=Rt??Tt,wt=It>0?Math.floor(At/It)+1:1,Ct=It>0?Math.ceil(Tt/It):0;return{total:Tt,count:xt,items:bt,size:It,page:wt,pages:Ct}}async function*u(Tt,bt,At=1000){let Rt=0;while(!0){let xt=await Tt(Rt,At);if(xt.items.length===0)break;for(let It of xt.items)yield(bt?await bt(It):It)??It;if(xt.items.length<At||Rt+xt.items.length>=xt.total)break;Rt+=At}}function Fe(Tt,bt){if(!bt)return!0;if(bt.requestable!==void 0&&Boolean(Tt.requestable)!==bt.requestable)return!1;if(bt.userName!==void 0){if((Tt.userName??Tt.clientId)!==bt.userName)return!1}if(bt.externalId!==void 0&&Tt.externalId!==bt.externalId)return!1;if(bt.updatedAfter!==void 0){if(!(Tt.updatedAt instanceof Date))return!1;let At=bt.updatedAfter instanceof Date?bt.updatedAfter:new Date(bt.updatedAfter);if(Number.isNaN(At.getTime())||Tt.updatedAt<=At)return!1}return!0}var ne=["basic","elevated","privileged","admin"],y="basic",t="urn:ionite:params:scim:schemas:extension:authz:2.0:Group";function Je(Tt){if("id"in Tt&&typeof Tt.id==="string"&&Tt.id)return Tt.id;if(!("claims"in Tt))return;return Tt.clientId||Tt.workloadId||Tt.claims.sub||void 0}var h=["user","workload","customer","delegate"];function U(Tt){let{assignableSubjectTypes:bt,recommendedSubjectTypes:At}=Tt,Rt=Tt.id?` for "${Tt.id}"`:"";if(!bt||bt.length===0)throw Error(`assignableSubjectTypes${Rt} is required and must be a non-empty subset of [${h.join(", ")}]`);let xt=bt.filter((It)=>!h.includes(It));if(xt.length>0)throw Error(`assignableSubjectTypes${Rt} contains values outside the platform ceiling [${h.join(", ")}]: ${xt.join(", ")}`);if(At){let It=At.filter((wt)=>!bt.includes(wt));if(It.length>0)throw Error(`recommendedSubjectTypes${Rt} must be a subset of assignableSubjectTypes; offending values: ${It.join(", ")}`)}}function re(Tt,bt="subjectType"){if(Tt!=="user"&&Tt!=="customer"&&Tt!=="workload"&&Tt!=="delegate")throw Error(`${bt} is required and must be one of [user, customer, workload, delegate]; got ${Tt===void 0?"undefined":JSON.stringify(Tt)}`)}class Le extends n{constructor(Tt,bt,At){super(Tt,{status:403,statusText:"assignment_forbidden"});this.name="AssignmentPolicyError";this.policy=bt,this.requestUrl=At}safeBody(){return{policy:this.policy,...this.requestUrl?{requestUrl:this.requestUrl}:{}}}toLogAttributes(){return{...super.toLogAttributes(),"authz.assignment_policy":this.policy,...this.requestUrl?{"authz.request_url":this.requestUrl}:{}}}}function qe(Tt){return typeof Tt.groups?.get==="function"}function Ye(Tt){return qe(Tt)?Tt:$e(Tt)}class Bt extends n{constructor(Tt){super(`defineCatalog: ${Tt}`,{status:500});this.name="CodeCatalogError"}}function mn(Tt){return typeof Tt==="string"?Tt:Tt.id}function vn(Tt){for(let bt of Object.values(Tt))if(Array.isArray(bt))Object.freeze(bt);Object.freeze(Tt)}function Xt(Tt,bt){try{U(bt)}catch(At){throw new Bt(`${Tt} "${bt.id}": ${At instanceof Error?At.message:String(At)}`)}}function Zt(Tt){let bt=new Map(Tt.map((Rt)=>[Rt.id,Rt])),At=Object.freeze([...Tt]);return Object.freeze({get:(Rt)=>bt.get(Rt),list:()=>At})}function $e(Tt){let bt=Tt.groups??[],At=Tt.roles??[],Rt=Tt.permissions??[],xt=new Map,It=(_t,Pt)=>{for(let vt of Pt){if(!vt.id)throw new Bt(`a ${_t} is missing its required "id".`);let Ot=xt.get(vt.id);if(Ot)throw new Bt(`duplicate id "${vt.id}" (declared as both ${Ot} and ${_t}).`);xt.set(vt.id,_t)}};It("group",bt),It("role",At),It("permission",Rt);let wt=(_t,Pt,vt,Ot)=>{let Dt=mn(Ot),qt=xt.get(Dt);if(qt===void 0)throw new Bt(`${_t} "${Pt}" references ${vt} "${Dt}", which is not declared in the catalog.`);if(qt!==vt)throw new Bt(`${_t} "${Pt}" references "${Dt}" as a ${vt}, but it is a ${qt}.`)};for(let _t of At){Xt("role",_t);for(let Pt of _t.permissions??[])wt("role",_t.id,"permission",Pt)}for(let _t of Rt)Xt("permission",_t);for(let _t of bt){Xt("group",_t);for(let Pt of _t.groups??[])wt("group",_t.id,"group",Pt);for(let Pt of _t.roles??[])wt("group",_t.id,"role",Pt);for(let Pt of _t.permissions??[])wt("group",_t.id,"permission",Pt)}let Ct=new Map(bt.map((_t)=>[_t.id,_t])),Nt=new Map,jt=(_t,Pt)=>{let vt=Nt.get(_t);if(vt==="done")return;if(vt==="visiting")throw new Bt(`group composition cycle: ${[...Pt,_t].join(" -> ")}.`);Nt.set(_t,"visiting");for(let Ot of Ct.get(_t)?.groups??[])jt(mn(Ot),[...Pt,_t]);Nt.set(_t,"done")};for(let _t of bt)jt(_t.id,[]);for(let _t of[...bt,...At,...Rt])vn(_t);return Object.freeze({groups:Zt(bt),roles:Zt(At),permissions:Zt(Rt)})}function W(Tt,bt){let At=Tt?.groups.get(bt);if(At)return{entity:At,kind:"group"};let Rt=Tt?.roles.get(bt);if(Rt)return{entity:Rt,kind:"role"};let xt=Tt?.permissions.get(bt);return xt?{entity:xt,kind:"permission"}:void 0}function V(Tt,bt){return bt==="group"?Tt.groups:bt==="role"?Tt.roles:Tt.permissions}function R(Tt,bt,At){let Rt={...bt,...At,id:bt.id,requestable:bt.requestable,source:At.source??"code",assignableSubjectTypes:bt.assignableSubjectTypes,recommendedSubjectTypes:bt.recommendedSubjectTypes};if(Tt==="group"){let It=bt;return{...Rt,groups:It.groups,roles:It.roles,permissions:It.permissions,resources:It.resources}}if(Tt==="role")return{...Rt,permissions:bt.permissions};let xt=bt;return{...Rt,action:xt.action,permissionTypes:xt.permissionTypes,resourceTypes:xt.resourceTypes,applyToSubResources:xt.applyToSubResources}}async function z(Tt,bt,At){let Rt=await At.get(bt.id);if(Rt)return R(Tt,bt,Rt);let xt=Object.entries(bt).filter(([Pt])=>p.includes(Pt)),{riskLevel:It,displayName:wt,...Ct}=Object.fromEntries(xt),Nt={...Ct,source:"code"},jt=At.insertIfAbsent(Nt);await jt.ready();let _t=await At.get(bt.id)??jt;return R(Tt,bt,_t)}async function se(Tt,bt,At){let Rt=async(xt,It)=>{let wt=At?[await xt.get(At)].filter((Ct)=>Ct!==void 0):u((Ct,Nt)=>xt.list({start:Ct,limit:Nt}));for await(let Ct of wt){if(Ct.source!=="code"||Ct.deprecated===!0||It?.get(Ct.id))continue;await xt.set({...Ct,deprecated:!0}).ready()}};await Rt(bt.groups,Tt?.groups),await Rt(bt.roles,Tt?.roles),await Rt(bt.permissions,Tt?.permissions)}function Qt(Tt,bt,At){let Rt=()=>{if(!At)throw Error(`Cannot write ${Tt} definitions: no AccessCatalogStore is wired (the code-declared catalog is read-only).`);return At};return{async get(It){let wt=bt.get(It);if(!At)return wt;let Ct=await At.get(It);return Ct&&wt?R(Tt,wt,Ct):Ct??wt},set(It){return Rt().set(It)},insertIfAbsent(It){return Rt().insertIfAbsent(It)},async delete(It){await Rt().delete(It)},async list(It){let wt=Math.max(0,It?.start??0),Ct=It?.limit,Nt=It?.filter?.requestable,jt=[];if(At)for await(let Ot of u((Dt,qt)=>At.list({start:Dt,limit:qt})))jt.push(Ot);let _t=new Map(jt.map((Ot)=>[Ot.id,Ot])),Pt=[...bt.list().map((Ot)=>{let Dt=_t.get(Ot.id);return Dt?R(Tt,Ot,Dt):Ot}),...jt.filter((Ot)=>!bt.get(Ot.id))].filter((Ot)=>Nt===void 0||Boolean(Ot.requestable)===Nt),vt=Ct!=null?wt+Ct:void 0;return K(Pt.length,Pt.slice(wt,vt),wt,Ct)}}}function B(Tt,bt){if(!Tt)return bt;return{groups:Qt("group",Tt.groups,bt?.groups),roles:Qt("role",Tt.roles,bt?.roles),permissions:Qt("permission",Tt.permissions,bt?.permissions),afterChange:bt?.afterChange?.bind(bt)}}function r(Tt){if(typeof Tt==="string")return Tt.trim();if(Tt&&typeof Tt==="object"){let bt=Tt;for(let At of["id","value","name","displayName"]){let Rt=bt[At];if(typeof Rt==="string"&&Rt.trim())return Rt.trim()}}return""}function f(Tt){let bt=r(Tt.subject),At=r(Tt.target);if(!bt)throw Error("Access change subject must resolve to a non-empty id.");if(!Tt.targetType)throw Error("Access change targetType is required.");if(!At)throw Error("Access change target must resolve to a non-empty id.");let Rt=(Tt.resources??[]).map((It)=>It.trim()).filter(Boolean),xt=!Tt.applyToApplication&&Rt.length>0?[...Rt].sort().join(","):"app";return re(Tt.subjectType,"Access change subjectType"),`${Tt.subjectType}:${bt}:${Tt.targetType}:${At}:${xt}`}function jn(Tt){let bt=(Tt.resources??[]).map((At)=>At.trim()).filter(Boolean);if(Tt.applyToApplication||bt.length===0)return[void 0];return bt}async function Tn(Tt,bt,At,Rt,xt){if(Rt==="resource")return At?.get(xt);let It=bt?Rt==="group"?bt.groups.get(xt):Rt==="role"?bt.roles.get(xt):bt.permissions.get(xt):void 0;if(Tt){let Ct=await(Rt==="group"?Tt.groups:Rt==="role"?Tt.roles:Tt.permissions).get(xt);if(Ct)return It?R(Rt,It,Ct):Ct}return It}class oe{constructor(Tt,bt,At){this.catalog=Tt;this.resources=bt;this.code=At;this.nodes=new Map;this.subResources=new Map;this.children=new Map}getNode(Tt,bt){let At=`${Tt}:${bt}`,Rt=this.nodes.get(At);if(!Rt)Rt=Tn(this.catalog,this.code,this.resources,Tt,bt),this.nodes.set(At,Rt);return Rt}resourceChildren(Tt){let bt=this.children.get(Tt);if(!bt)bt=hn(Tt,this.view()),this.children.set(Tt,bt);return bt}resourceAndSubResourceIds(Tt){let bt=this.subResources.get(Tt);if(!bt)bt=An(Tt,this.view()),this.subResources.set(Tt,bt);return bt}view(){return{catalog:this.catalog,code:this.code,resources:this.resources,cache:this}}invalidate(Tt){this.clear()}clear(){this.nodes.clear(),this.subResources.clear(),this.children.clear()}}async function Vt(Tt,bt,At){if(Tt.cache)return Tt.cache.getNode(bt,At);return Tn(Tt.catalog,Tt.code,Tt.resources,bt,At)}async function yn(Tt,bt){if(typeof Tt!=="string")return Tt;return Vt(bt,"resource",Tt)}async function hn(Tt,bt){if(bt.resources?.children)return bt.resources.children(Tt);let At=await yn(Tt,bt),Rt=[];for(let xt of At?.resources??[]){let It=await yn(xt,bt);if(It)Rt.push(It);else if(typeof xt==="string"&&xt.trim())Rt.push({id:xt.trim()})}return Rt}async function bn(Tt,bt){if(bt.cache)return bt.cache.resourceChildren(Tt);return hn(Tt,bt)}async function An(Tt,bt){let At=[],Rt=new Set,xt=async(It)=>{if(!It||Rt.has(It))return;Rt.add(It),At.push(It);for(let wt of await bn(It,bt))await xt(r(wt))};return await xt(r(Tt)),At}async function D(Tt,bt){let At=Tt.id??f(Tt),Rt=r(Tt.subject);if(!Rt)throw Error("Access change subject must resolve to a non-empty id.");re(Tt.subjectType,"Access change subjectType");let xt=Tt.subjectType,It=jn(Tt),wt=[],Ct=new Set,Nt=new Set,jt=(vt,Ot,Dt)=>{if(!Ot)return;let qt=`${vt}:${Ot}:${Dt??""}`;if(Ct.has(qt))return;Ct.add(qt),wt.push({subject:Rt,subjectType:xt,targetType:vt,target:Ot,resource:Dt,rootId:At})},_t=async(vt,Ot,Dt)=>{for(let qt of It)if(vt==="permission"&&Dt?.applyToSubResources&&qt){let $t=bt.cache?await bt.cache.resourceAndSubResourceIds(qt):await An(qt,bt);for(let Lt of $t)jt("permission",Ot,Lt)}else jt(vt,Ot,qt)},Pt=async(vt,Ot)=>{let Dt=r(Ot);if(!Dt)return;let qt=`${vt}:${Dt}`;if(Nt.has(qt))return;if(Nt.add(qt),vt==="group"){let Lt=typeof Ot==="string"?await Vt(bt,"group",Dt):Ot;await _t("group",Dt,void 0);for(let Ut of Lt?.groups??[])await Pt("group",Ut);for(let Ut of Lt?.roles??[])await Pt("role",Ut);for(let Ut of Lt?.permissions??[])await Pt("permission",Ut);return}if(vt==="role"){let Lt=typeof Ot==="string"?await Vt(bt,"role",Dt):Ot;await _t("role",Dt,void 0);for(let Ut of Lt?.permissions??[])await Pt("permission",Ut);return}let $t=typeof Ot==="string"?await Vt(bt,"permission",Dt):Ot;await _t("permission",Dt,$t)};return await Pt(Tt.targetType,Tt.target),wt}async function ke(Tt,bt,At,Rt){let{accessStore:xt,accessIndex:It,catalogStore:wt,code:Ct,resources:Nt}=At;if(!It||!wt&&!Ct)return 0;if(!xt)return await It.replaceSubject(Tt,bt,[]),0;let jt={catalog:wt,code:Ct,resources:Nt,cache:Rt},_t=[],Pt=0;for await(let vt of u((Ot,Dt)=>xt.listBySubject(Tt,bt,{start:Ot,limit:Dt}))){let Ot=vt.id??f(vt),Dt=await D({...vt,id:Ot},jt);_t.push(...Dt),Pt+=1}return await It.replaceSubject(Tt,bt,_t),Pt}async function Xe(Tt,bt,At){let Rt=new Map,xt=new Map,It=new Map,wt=new Map,Ct=new Set,Nt=(Pt,vt)=>Vt(At,Pt,vt),jt=async(Pt)=>{let vt=r(Pt);if(!vt||wt.has(vt))return;let Ot=typeof Pt==="string"?await Nt("resource",vt):Pt;if(!Ot)return;wt.set(vt,Ot);let Dt=Ot.resources??(Ot.id?await bn(Ot.id,At):[]);for(let qt of Dt)await jt(qt)},_t=async(Pt,vt)=>{let Ot=r(vt);if(!Ot)return;let Dt=`${Pt}:${Ot}`;if(Ct.has(Dt))return;if(Ct.add(Dt),Pt==="group"){let $t=typeof vt==="string"?await Nt("group",Ot):vt;if(!$t)return;Rt.set(Ot,$t);for(let Lt of $t.groups??[])await _t("group",Lt);for(let Lt of $t.roles??[])await _t("role",Lt);for(let Lt of $t.permissions??[])await _t("permission",Lt);for(let Lt of $t.resources??[])await jt(Lt);return}if(Pt==="role"){let $t=typeof vt==="string"?await Nt("role",Ot):vt;if(!$t)return;xt.set(Ot,$t);for(let Lt of $t.permissions??[])await _t("permission",Lt);return}let qt=typeof vt==="string"?await Nt("permission",Ot):vt;if(!qt)return;It.set(Ot,qt)};if(Ct.add(`${bt}:${r(Tt)}`),bt==="group"){let Pt=Tt;for(let vt of Pt.groups??[])await _t("group",vt);for(let vt of Pt.roles??[])await _t("role",vt);for(let vt of Pt.permissions??[])await _t("permission",vt);for(let vt of Pt.resources??[])await jt(vt)}else{let Pt=Tt;for(let vt of Pt.permissions??[])await _t("permission",vt)}return{groups:[...Rt.values()],roles:[...xt.values()],permissions:[...It.values()],resources:[...wt.values()]}}var Ze=".profile",G=1,Qe=10,et=10,tt=14400,ie="ion.discovered",On=new Set(["sid","sub","tokens","access_token","id_token","refresh_token","accessClaims","roles","groups","permissions","grants"]);function ae(Tt){if(typeof Tt!=="number"||!Number.isFinite(Tt)||Tt<1)return 10;return Math.floor(Tt)}function H(Tt){if(typeof Tt!=="number"||!Number.isFinite(Tt)||Tt<1)return 10;return Math.floor(Tt)}function ce(Tt){if(typeof Tt!=="number"||!Number.isFinite(Tt)||Tt<1)return 14400;return Math.floor(Tt)}function be(Tt){let bt={};if(Tt.name)bt.name=Tt.name;if(Tt.email)bt.email=Tt.email;if(Tt.avatar)bt.avatar=Tt.avatar;return bt}function Te(Tt){if(!Tt||typeof Tt!=="object"||Array.isArray(Tt))return{};let bt={};for(let[At,Rt]of Object.entries(Tt)){if(On.has(At))continue;if(typeof Rt==="string"||typeof Rt==="number"||typeof Rt==="boolean"||Rt===null)bt[At]=Rt}return bt}function Nn(Tt){let bt=Tt;return{name:typeof bt.name==="string"?bt.name:void 0,email:typeof bt.email==="string"?bt.email:void 0,avatar:typeof bt.avatar==="string"?bt.avatar:void 0}}function g(Tt,bt){let At=Nn(Tt);if(!bt)return be(At);try{return Te(bt(Tt))}catch{return be(At)}}function F(Tt){return btoa(JSON.stringify(Tt))}function Ke(Tt){try{let bt=JSON.parse(atob(Tt));if(!bt||typeof bt!=="object"||Array.isArray(bt))return;let At=bt;if(At.v!==1)return;if(At.authType!=="sso"&&At.authType!=="ciam")return;if(At.kind!==void 0&&At.kind!=="session"&&At.kind!=="discovered")return;if(typeof At.expiresAt!=="string"||!At.expiresAt)return;let Rt=typeof At.tenantId==="string"&&At.tenantId?At.tenantId:void 0,xt=typeof At.tenantName==="string"&&At.tenantName?At.tenantName:void 0;return{v:1,...At.kind?{kind:At.kind}:{},...Rt?{tenantId:Rt}:{},authType:At.authType,expiresAt:At.expiresAt,user:Te(At.user),...xt?{tenantName:xt}:{}}}catch{return}}function ue(Tt){let bt={};if(!Tt)return bt;for(let At of Tt.split(";")){let Rt=At.trim();if(!Rt)continue;let xt=Rt.indexOf("=");if(xt===-1)continue;bt[Rt.slice(0,xt).trim()]=Rt.slice(xt+1).trim()}return bt}function J(Tt){let bt=ue(Tt),At=[];for(let[Rt,xt]of Object.entries(bt)){if(!Rt.endsWith(".profile")||!xt)continue;let It=Ke(xt);if(!It)continue;At.push({name:Rt,prefix:Rt.slice(0,-8),envelope:It})}return At}function _(Tt,bt){let At=Tt?Date.parse(Tt):Number.NaN,Rt=bt?Date.parse(bt):Number.NaN,xt=Number.isFinite(At),It=Number.isFinite(Rt);if(xt&&It)return Rt-At;if(xt)return-1;if(It)return 1;return 0}function O(Tt){return`${Tt}.profile`}function Y(Tt){return O(`ion.discovered.${encodeURIComponent(Tt)}`)}var We="ecid",Rn=/^ecid:([A-Za-z0-9._-]+):([A-Za-z0-9_-]+)$/,Dn=/^[A-Za-z0-9._-]+$/,qn=/^[A-Za-z0-9_-]+$/;class M extends n{constructor(Tt){super(Tt,{status:400,statusText:"invalid_ecid"});this.name="EcidFormatError"}}function Ve(Tt){return typeof Tt==="string"&&Rn.test(Tt)}function nt(Tt,bt){if(!Tt||!Dn.test(Tt))throw new M(`Invalid ECID realm ${JSON.stringify(Tt)}: must be non-empty and match [A-Za-z0-9._-].`);if(!bt||!qn.test(bt))throw new M(`Invalid ECID opaque ${JSON.stringify(bt)}: must be non-empty and match [A-Za-z0-9_-].`);return`${We}:${Tt}:${bt}`}function rt(Tt){let bt=typeof Tt==="string"?Tt.match(Rn):null;if(!bt)throw new M(`Invalid ECID ${JSON.stringify(Tt)}: expected "ecid:<realm>:<opaque>".`);return{realm:bt[1],opaque:bt[2]}}function j(Tt){if(!Ve(Tt))throw new M(`Invalid ECID ${JSON.stringify(Tt)}: expected "ecid:<realm>:<opaque>".`);return Tt}class s extends n{constructor(Tt,bt){super(Tt,{status:400,statusText:bt});this.name="ScimPatchError";this.scimType=bt}}var Yt="[A-Za-z_$][\\w$-]*",Un=new RegExp(`^(${Yt})(?:\\[(.*)\\])?(?:\\.(${Yt}))?$`),Mn=new RegExp(`^\\s*(${Yt}(?:\\.${Yt})?)\\s+eq\\s+(?:"((?:[^"\\\\]|\\\\.)*)"|(true|false|null|-?\\d+(?:\\.\\d+)?))\\s*$`,"i");function Ln(Tt,bt){let At=Tt.match(Mn);if(!At?.[1])throw new s(`Unsupported filter in PATCH path "${bt}" (only "<attr> eq <value>")`,"invalidFilter");if(At[2]!==void 0)return{attr:At[1],value:At[2].replace(/\\(.)/g,"$1")};let Rt=At[3]?.toLowerCase();if(Rt==="true")return{attr:At[1],value:!0};if(Rt==="false")return{attr:At[1],value:!1};if(Rt==="null")return{attr:At[1],value:null};return{attr:At[1],value:Number(At[3])}}function de(Tt){let bt,At=Tt.trim();if(At.toLowerCase().startsWith("urn:")){let xt=At.indexOf("["),It=xt===-1?At:At.slice(0,xt),wt=It.lastIndexOf(":"),Ct=It.slice(wt+1).split(".")[0]??"";if(/^[A-Z]/.test(Ct)){bt=At.slice(0,wt+1+Ct.length);let Nt=At.slice(bt.length);if(Nt==="")return{schema:bt};if(!Nt.startsWith("."))throw new s(`Invalid PATCH path "${Tt}"`,"invalidPath");At=Nt.slice(1)}else bt=At.slice(0,wt),At=At.slice(wt+1)}let Rt=At.match(Un);if(!Rt?.[1])throw new s(`Invalid PATCH path "${Tt}"`,"invalidPath");return{schema:bt,attr:Rt[1],filter:Rt[2]!==void 0?Ln(Rt[2],Tt):void 0,subAttr:Rt[3]}}function zt(Tt){return typeof Tt==="object"&&Tt!==null&&!Array.isArray(Tt)}function Gt(Tt,bt){if(bt in Tt)return bt;let At=bt.toLowerCase();return Object.keys(Tt).find((Rt)=>Rt.toLowerCase()===At)??bt}function $n(Tt,bt){let At=Tt;for(let Rt of bt.split(".")){if(!zt(At))return;At=At[Gt(At,Rt)]}return At}function Ft(Tt,bt){if(!zt(Tt))return!1;let At=$n(Tt,bt.attr);if(typeof At==="string"&&typeof bt.value==="string")return At.toLowerCase()===bt.value.toLowerCase();return At===bt.value}function en(Tt,bt,At){let Rt=Tt[bt];if(Array.isArray(Rt)){Tt[bt]=[...Rt,...Array.isArray(At)?At:[At]];return}if(zt(Rt)&&zt(At)){Tt[bt]={...Rt,...At};return}Tt[bt]=At}function zn(Tt,bt,At){if(!bt)return Tt;let Rt=Gt(Tt,bt),xt=Tt[Rt];if(zt(xt))return xt;if(!At)return;let It={};return Tt[Rt]=It,It}function tn(Tt){return Tt.attr.includes(".")?{}:{[Tt.attr]:Tt.value}}function Sn(Tt,bt,At,Rt){let xt=de(At);if(xt.attr===void 0){let Ct=Gt(Tt,xt.schema??At);if(bt==="remove")delete Tt[Ct];else if(bt==="add")en(Tt,Ct,Rt);else Tt[Ct]=Rt;return}let It=zn(Tt,xt.schema,bt!=="remove");if(!It)return;let wt=Gt(It,xt.attr);if(xt.filter){let Ct=xt.filter,Nt=It[wt];if(Nt!==void 0&&!Array.isArray(Nt))throw new s(`PATCH path "${At}" filters a non-multi-valued attribute`,"invalidPath");let jt=Nt??[];if(bt==="remove"){It[wt]=xt.subAttr?jt.map((Pt)=>{if(!Ft(Pt,Ct)||!zt(Pt))return Pt;let vt={...Pt};return delete vt[Gt(vt,xt.subAttr)],vt}):jt.filter((Pt)=>!Ft(Pt,Ct));return}if(!jt.some((Pt)=>Ft(Pt,Ct))){let Pt=xt.subAttr?{...tn(Ct),[xt.subAttr]:Rt}:zt(Rt)?{...tn(Ct),...Rt}:void 0;if(!Pt)throw new s(`PATCH value for "${At}" must be an object`,"invalidValue");It[wt]=[...jt,Pt];return}It[wt]=jt.map((Pt)=>{if(!Ft(Pt,Ct)||!zt(Pt))return Pt;if(xt.subAttr)return{...Pt,[Gt(Pt,xt.subAttr)]:Rt};if(!zt(Rt))throw new s(`PATCH value for "${At}" must be an object`,"invalidValue");return bt==="add"?{...Pt,...Rt}:{...tn(Ct),...Rt}});return}if(xt.subAttr){let Ct=It[wt];if(bt==="remove"){if(zt(Ct)){let _t={...Ct};delete _t[Gt(_t,xt.subAttr)],It[wt]=_t}return}if(Ct!==void 0&&!zt(Ct))throw new s(`PATCH path "${At}" targets a sub-attribute of a non-complex attribute`,"invalidPath");let Nt={...Ct??{}},jt=Gt(Nt,xt.subAttr);if(bt==="add")en(Nt,jt,Rt);else Nt[jt]=Rt;It[wt]=Nt;return}if(bt==="remove"){let Ct=It[wt];if(Array.isArray(Ct)&&Array.isArray(Rt)){let Nt=Rt.filter(zt).map((jt)=>jt.value);It[wt]=Ct.filter((jt)=>!(zt(jt)&&Nt.includes(jt.value)));return}delete It[wt];return}if(bt==="add"){en(It,wt,Rt);return}It[wt]=Rt}function X(Tt,bt){let At=typeof bt.op==="string"?bt.op.toLowerCase():"";if(At!=="add"&&At!=="replace"&&At!=="remove")throw new s(`Unsupported PATCH op "${String(bt.op)}"`,"invalidSyntax");if(!bt.path){if(At==="remove")throw new s("PATCH remove requires a path","noTarget");if(!zt(bt.value))throw new s(`PATCH ${At} without a path requires an object value`,"invalidValue");for(let[Rt,xt]of Object.entries(bt.value))Sn(Tt,At,Rt,xt);return}Sn(Tt,At,bt.path,bt.value)}var o="urn:ionite:scim:schemas:extension:ion:2.0:User",S="urn:ionite:scim:schemas:core:2.0:Workload",k="urn:ionite:scim:schemas:core:2.0:Customer",b="urn:ionite:scim:schemas:core:2.0:Delegate";function Et(Tt,bt,At,Rt,xt){if(Tt===void 0||Tt===null){if(At)Rt.push({message:`${bt} is required`,path:xt});return}if(typeof Tt!=="string"){Rt.push({message:`${bt} must be a string`,path:xt});return}return Tt}function Ht(Tt,bt,At,Rt){if(Tt===void 0||Tt===null)return;if(typeof Tt!=="boolean"){At.push({message:`${bt} must be a boolean`,path:Rt});return}return Tt}function Gn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(typeof Tt!=="object"||Tt===null){bt.push({message:"name must be an object",path:At});return}let Rt=Tt,xt={};return xt.formatted=Et(Rt.formatted,"formatted",!1,bt,[...At,"formatted"]),xt.familyName=Et(Rt.familyName,"familyName",!1,bt,[...At,"familyName"]),xt.givenName=Et(Rt.givenName,"givenName",!1,bt,[...At,"givenName"]),xt.middleName=Et(Rt.middleName,"middleName",!1,bt,[...At,"middleName"]),xt.honorificPrefix=Et(Rt.honorificPrefix,"honorificPrefix",!1,bt,[...At,"honorificPrefix"]),xt.honorificSuffix=Et(Rt.honorificSuffix,"honorificSuffix",!1,bt,[...At,"honorificSuffix"]),xt}function Kn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"emails must be an array",path:At});return}let Rt=[];for(let xt=0;xt<Tt.length;xt++){let It=Tt[xt],wt=[...At,xt];if(typeof It!=="object"||It===null){bt.push({message:"email must be an object",path:wt});continue}let Ct=It,Nt=Et(Ct.value,"value",!0,bt,[...wt,"value"]);if(Nt)Rt.push({value:Nt,display:Et(Ct.display,"display",!1,bt,[...wt,"display"]),type:Et(Ct.type,"type",!1,bt,[...wt,"type"]),primary:Ht(Ct.primary,"primary",bt,[...wt,"primary"])})}return Rt.length>0?Rt:void 0}function Bn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"phoneNumbers must be an array",path:At});return}let Rt=[];for(let xt=0;xt<Tt.length;xt++){let It=Tt[xt],wt=[...At,xt];if(typeof It!=="object"||It===null){bt.push({message:"phoneNumber must be an object",path:wt});continue}let Ct=It,Nt=Et(Ct.value,"value",!0,bt,[...wt,"value"]);if(Nt)Rt.push({value:Nt,display:Et(Ct.display,"display",!1,bt,[...wt,"display"]),type:Et(Ct.type,"type",!1,bt,[...wt,"type"]),primary:Ht(Ct.primary,"primary",bt,[...wt,"primary"])})}return Rt.length>0?Rt:void 0}function Vn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"addresses must be an array",path:At});return}let Rt=[];for(let xt=0;xt<Tt.length;xt++){let It=Tt[xt],wt=[...At,xt];if(typeof It!=="object"||It===null){bt.push({message:"address must be an object",path:wt});continue}let Ct=It;Rt.push({formatted:Et(Ct.formatted,"formatted",!1,bt,[...wt,"formatted"]),streetAddress:Et(Ct.streetAddress,"streetAddress",!1,bt,[...wt,"streetAddress"]),locality:Et(Ct.locality,"locality",!1,bt,[...wt,"locality"]),region:Et(Ct.region,"region",!1,bt,[...wt,"region"]),postalCode:Et(Ct.postalCode,"postalCode",!1,bt,[...wt,"postalCode"]),country:Et(Ct.country,"country",!1,bt,[...wt,"country"]),type:Et(Ct.type,"type",!1,bt,[...wt,"type"]),primary:Ht(Ct.primary,"primary",bt,[...wt,"primary"])})}return Rt.length>0?Rt:void 0}function Hn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"groups must be an array",path:At});return}let Rt=[];for(let xt=0;xt<Tt.length;xt++){let It=Tt[xt],wt=[...At,xt];if(typeof It!=="object"||It===null){bt.push({message:"group must be an object",path:wt});continue}let Ct=It,Nt=Et(Ct.value,"value",!0,bt,[...wt,"value"]);if(Nt)Rt.push({value:Nt,$ref:Et(Ct.$ref,"$ref",!1,bt,[...wt,"$ref"]),display:Et(Ct.display,"display",!1,bt,[...wt,"display"]),type:Et(Ct.type,"type",!1,bt,[...wt,"type"])})}return Rt.length>0?Rt:void 0}function Wn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"roles must be an array",path:At});return}let Rt=[];for(let xt=0;xt<Tt.length;xt++){let It=Tt[xt],wt=[...At,xt];if(typeof It!=="object"||It===null){bt.push({message:"role must be an object",path:wt});continue}let Ct=It,Nt=Et(Ct.value,"value",!0,bt,[...wt,"value"]);if(Nt)Rt.push({value:Nt,display:Et(Ct.display,"display",!1,bt,[...wt,"display"]),type:Et(Ct.type,"type",!1,bt,[...wt,"type"]),primary:Ht(Ct.primary,"primary",bt,[...wt,"primary"])})}return Rt.length>0?Rt:void 0}function Fn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(typeof Tt!=="object"||Tt===null){bt.push({message:"Enterprise User extension must be an object",path:At});return}let Rt=Tt,xt={};if(xt.employeeNumber=Et(Rt.employeeNumber,"employeeNumber",!1,bt,[...At,"employeeNumber"]),xt.costCenter=Et(Rt.costCenter,"costCenter",!1,bt,[...At,"costCenter"]),xt.organization=Et(Rt.organization,"organization",!1,bt,[...At,"organization"]),xt.division=Et(Rt.division,"division",!1,bt,[...At,"division"]),xt.department=Et(Rt.department,"department",!1,bt,[...At,"department"]),Rt.manager!==void 0&&Rt.manager!==null)if(typeof Rt.manager!=="object"||Rt.manager===null)bt.push({message:"manager must be an object",path:[...At,"manager"]});else{let It=Rt.manager;xt.manager={value:Et(It.value,"value",!1,bt,[...At,"manager","value"]),$ref:Et(It.$ref,"$ref",!1,bt,[...At,"manager","$ref"]),displayName:Et(It.displayName,"displayName",!1,bt,[...At,"manager","displayName"])}}return xt}function st(Tt){return{"~standard":{version:1,vendor:Tt,validate:(bt)=>{if(typeof bt!=="object"||bt===null)return{issues:[{message:"Expected an object"}]};let At=bt,Rt=[],xt={},It=Et(At.userName,"userName",!0,Rt,["userName"]);if(!It)return{issues:Rt};if(xt.userName=It,xt.id=Et(At.id,"id",!1,Rt,["id"]),xt.externalId=Et(At.externalId,"externalId",!1,Rt,["externalId"]),xt.displayName=Et(At.displayName,"displayName",!1,Rt,["displayName"]),xt.nickName=Et(At.nickName,"nickName",!1,Rt,["nickName"]),xt.profileUrl=Et(At.profileUrl,"profileUrl",!1,Rt,["profileUrl"]),xt.title=Et(At.title,"title",!1,Rt,["title"]),xt.userType=Et(At.userType,"userType",!1,Rt,["userType"]),xt.preferredLanguage=Et(At.preferredLanguage,"preferredLanguage",!1,Rt,["preferredLanguage"]),xt.locale=Et(At.locale,"locale",!1,Rt,["locale"]),xt.timezone=Et(At.timezone,"timezone",!1,Rt,["timezone"]),At.password!==void 0)Rt.push({message:"password is not supported: the SDK does not accept credentials via SCIM",path:["password"]});xt.active=Ht(At.active,"active",Rt,["active"]),xt.name=Gn(At.name,Rt,["name"]),xt.emails=Kn(At.emails,Rt,["emails"]),xt.phoneNumbers=Bn(At.phoneNumbers,Rt,["phoneNumbers"]),xt.addresses=Vn(At.addresses,Rt,["addresses"]),xt.groups=Hn(At.groups,Rt,["groups"]),xt.roles=Wn(At.roles,Rt,["roles"]);let wt="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User";if(At[wt]!==void 0)xt[wt]=Fn(At[wt],Rt,[wt]);if(At.schemas!==void 0)if(Array.isArray(At.schemas))xt.schemas=At.schemas.filter((Ct)=>typeof Ct==="string");else Rt.push({message:"schemas must be an array",path:["schemas"]});if(At.meta!==void 0)if(typeof At.meta==="object"&&At.meta!==null){let Ct=At.meta;xt.meta={resourceType:typeof Ct.resourceType==="string"?Ct.resourceType:void 0,created:typeof Ct.created==="string"?Ct.created:void 0,lastModified:typeof Ct.lastModified==="string"?Ct.lastModified:void 0,location:typeof Ct.location==="string"?Ct.location:void 0,version:typeof Ct.version==="string"?Ct.version:void 0}}else Rt.push({message:"meta must be an object",path:["meta"]});if(Rt.length>0)return{issues:Rt};return{value:xt}}}}}function Yn(Tt,bt,At){if(Tt===void 0||Tt===null)return;if(!Array.isArray(Tt)){bt.push({message:"members must be an array",path:At});return}let Rt=[];for(let xt=0;xt<Tt.length;xt++){let It=Tt[xt],wt=[...At,xt];if(typeof It!=="object"||It===null){bt.push({message:"member must be an object",path:wt});continue}let Ct=It,Nt=Et(Ct.value,"value",!0,bt,[...wt,"value"]);if(Nt){let jt=Et(Ct.type,"type",!1,bt,[...wt,"type"]);if(jt!==void 0&&jt!=="User"&&jt!=="Group"&&jt!=="Workload"&&jt!=="Customer"&&jt!=="Delegate")bt.push({message:"type must be 'User', 'Group', 'Workload', 'Customer', or 'Delegate'",path:[...wt,"type"]});Rt.push({value:Nt,$ref:Et(Ct.$ref,"$ref",!1,bt,[...wt,"$ref"]),display:Et(Ct.display,"display",!1,bt,[...wt,"display"]),type:jt==="User"||jt==="Group"||jt==="Workload"||jt==="Customer"||jt==="Delegate"?jt:void 0})}}return Rt.length>0?Rt:void 0}function ot(Tt){return{"~standard":{version:1,vendor:Tt,validate:(bt)=>{if(typeof bt!=="object"||bt===null)return{issues:[{message:"Expected an object"}]};let At=bt,Rt=[],xt={},It=Et(At.displayName,"displayName",!0,Rt,["displayName"]);if(!It)return{issues:Rt};if(xt.displayName=It,xt.id=Et(At.id,"id",!1,Rt,["id"]),xt.externalId=Et(At.externalId,"externalId",!1,Rt,["externalId"]),xt.members=Yn(At.members,Rt,["members"]),At.schemas!==void 0)if(Array.isArray(At.schemas))xt.schemas=At.schemas.filter((wt)=>typeof wt==="string");else Rt.push({message:"schemas must be an array",path:["schemas"]});if(At.meta!==void 0)if(typeof At.meta==="object"&&At.meta!==null){let wt=At.meta;xt.meta={resourceType:typeof wt.resourceType==="string"?wt.resourceType:void 0,created:typeof wt.created==="string"?wt.created:void 0,lastModified:typeof wt.lastModified==="string"?wt.lastModified:void 0,location:typeof wt.location==="string"?wt.location:void 0,version:typeof wt.version==="string"?wt.version:void 0}}else Rt.push({message:"meta must be an object",path:["meta"]});if(Rt.length>0)return{issues:Rt};return{value:xt}}}}}function nn(Tt,bt){if(Tt===void 0)return;if(typeof Tt!=="object"||Tt===null){bt.push({message:"meta must be an object",path:["meta"]});return}let At=Tt;return{resourceType:typeof At.resourceType==="string"?At.resourceType:void 0,created:typeof At.created==="string"?At.created:void 0,lastModified:typeof At.lastModified==="string"?At.lastModified:void 0,location:typeof At.location==="string"?At.location:void 0,version:typeof At.version==="string"?At.version:void 0}}function sn(Tt,bt){if(Tt===void 0)return;if(!Array.isArray(Tt)){bt.push({message:"schemas must be an array",path:["schemas"]});return}return Tt.filter((At)=>typeof At==="string")}function xn(Tt,bt){if(Tt===void 0)return;if(typeof Tt!=="object"||Tt===null||Array.isArray(Tt)){bt.push({message:"attributes must be an object",path:["attributes"]});return}return{...Tt}}var le={"~standard":{version:1,vendor:"ionite",validate:(Tt)=>{let bt=[];if(typeof Tt!=="object"||Tt===null)return{issues:[{message:"Workload must be an object"}]};let At=Tt,Rt={schemas:sn(At.schemas,bt),id:Et(At.id,"id",!1,bt,["id"]),externalId:Et(At.externalId,"externalId",!1,bt,["externalId"]),userName:Et(At.userName,"userName",!1,bt,["userName"]),displayName:Et(At.displayName,"displayName",!1,bt,["displayName"]),description:Et(At.description,"description",!1,bt,["description"]),active:typeof At.active==="boolean"?At.active:void 0,providerId:Et(At.providerId,"providerId",!1,bt,["providerId"]),requestUrl:Et(At.requestUrl,"requestUrl",!1,bt,["requestUrl"]),attributes:xn(At.attributes,bt),meta:nn(At.meta,bt)};if(bt.length>0)return{issues:bt};return{value:Rt}}}},pe={"~standard":{version:1,vendor:"ionite",validate:(Tt)=>{let bt=[];if(typeof Tt!=="object"||Tt===null)return{issues:[{message:"Customer must be an object"}]};let At=Tt,Rt=At.emails,xt;if(Rt!==void 0)if(!Array.isArray(Rt))bt.push({message:"emails must be an array",path:["emails"]});else xt=Rt.filter((wt)=>typeof wt==="object"&&wt!==null&&typeof wt.value==="string");let It={schemas:sn(At.schemas,bt),id:Et(At.id,"id",!1,bt,["id"]),externalId:Et(At.externalId,"externalId",!1,bt,["externalId"]),userName:Et(At.userName,"userName",!1,bt,["userName"]),displayName:Et(At.displayName,"displayName",!1,bt,["displayName"]),active:typeof At.active==="boolean"?At.active:void 0,emails:xt,providerId:Et(At.providerId,"providerId",!1,bt,["providerId"]),requestUrl:Et(At.requestUrl,"requestUrl",!1,bt,["requestUrl"]),attributes:xn(At.attributes,bt),meta:nn(At.meta,bt)};if(bt.length>0)return{issues:bt};return{value:It}}}},me={"~standard":{version:1,vendor:"ionite",validate:(Tt)=>{let bt=[];if(typeof Tt!=="object"||Tt===null)return{issues:[{message:"Delegate must be an object"}]};let At=Tt,Rt=typeof At.owner==="object"&&At.owner!==null?At.owner:void 0,xt=Et(Rt?.value,"value",!0,bt,["owner","value"]),It=Et(Rt?.type,"type",!0,bt,["owner","type"]);if(It!==void 0&&It!=="User"&&It!=="Customer"&&It!=="Workload")bt.push({message:"owner.type must be 'User', 'Customer', or 'Workload'",path:["owner","type"]});let wt={schemas:sn(At.schemas,bt),id:Et(At.id,"id",!1,bt,["id"]),externalId:Et(At.externalId,"externalId",!1,bt,["externalId"]),userName:Et(At.userName,"userName",!1,bt,["userName"]),displayName:Et(At.displayName,"displayName",!1,bt,["displayName"]),active:typeof At.active==="boolean"?At.active:void 0,owner:{value:xt??"",type:It==="Customer"||It==="Workload"?It:"User"},clientId:Et(At.clientId,"clientId",!1,bt,["clientId"]),expiresAt:Et(At.expiresAt,"expiresAt",!1,bt,["expiresAt"]),tokenHash:Et(At.tokenHash,"tokenHash",!1,bt,["tokenHash"]),previousTokenHash:Et(At.previousTokenHash,"previousTokenHash",!1,bt,["previousTokenHash"]),previousTokenHashExpiresAt:Et(At.previousTokenHashExpiresAt,"previousTokenHashExpiresAt",!1,bt,["previousTokenHashExpiresAt"]),lastUsedAt:Et(At.lastUsedAt,"lastUsedAt",!1,bt,["lastUsedAt"]),lastUsedWindowSeconds:typeof At.lastUsedWindowSeconds==="number"?At.lastUsedWindowSeconds:void 0,providerId:Et(At.providerId,"providerId",!1,bt,["providerId"]),requestUrl:Et(At.requestUrl,"requestUrl",!1,bt,["requestUrl"]),meta:nn(At.meta,bt)};if(bt.length>0)return{issues:bt};return{value:wt}}}};var Jn=new Set(["active"]);function Cn(Tt){if(typeof Tt!=="string")return Tt;let bt=Tt.toLowerCase();if(bt==="true")return!0;if(bt==="false")return!1;return Tt}var En="urn:ietf:params:scim:schemas:extension:enterprise:2.0:user";function Xn(Tt){let bt=Tt.toLowerCase();return bt==="manager"||bt===`${En}:manager`}function rn(Tt){if(typeof Tt==="string")return Tt?{value:Tt}:Tt;if(Array.isArray(Tt))return Tt.length>0?rn(Tt[0]):Tt;return Tt}var Zn="WindowsAzureActiveDirectoryRole";function Qn(Tt){if(typeof Tt.value!=="string"||!Tt.value.startsWith("{"))return Tt;try{let bt=JSON.parse(Tt.value);if(typeof bt.value!=="string")return Tt;return{displayName:bt.displayName,...Tt,value:bt.value}}catch{return Tt}}function In(Tt){if(typeof Tt!=="object"||Tt===null)return Tt;let{displayName:bt,...At}=Qn(Tt);if(typeof bt==="string"&&At.display===void 0)At.display=bt;if(At.type===Zn)delete At.type;if("primary"in At)At.primary=Cn(At.primary);return At}function es(Tt){return Array.isArray(Tt)?Tt.map(In):In(Tt)}function Jt(Tt,bt){let At=Tt.toLowerCase();if(Jn.has(At))return Cn(bt);if(Xn(Tt))return rn(bt);if(At==="roles")return es(bt);if(At===En&&typeof bt==="object"&&bt!==null&&"manager"in bt)return{...bt,manager:rn(bt.manager)};return bt}function ts(Tt){if(typeof Tt!=="object"||Tt===null||Array.isArray(Tt))return Tt;let bt={...Tt};for(let At of Object.keys(bt))bt[At]=Jt(At,bt[At]);return bt}function ns(Tt){return Tt.op.toLowerCase()==="add"&&Tt.path?.toLowerCase()==="roles"}var N="urn:ietf:params:scim:schemas:extension:ionite:2.0:User",on=N.toLowerCase();function an(Tt){let bt=Tt.toLowerCase();if(bt===on)return o;if(bt.startsWith(`${on}:`))return o+Tt.slice(N.length);return Tt}function ss(Tt){return Tt.map((bt)=>{let At=bt.path?{...bt,path:an(bt.path)}:bt;if(ns(At))return{...At,op:"replace",value:Jt("roles",At.value)};if(At.path)return{...At,value:Jt(At.path,At.value)};if(typeof At.value==="object"&&At.value!==null&&!Array.isArray(At.value)){let Rt={};for(let[xt,It]of Object.entries(At.value)){let wt=an(xt);if(wt in Rt)throw new s(`PATCH value carries ${wt} under both names; send one`,"invalidValue");Rt[wt]=Jt(wt,It)}return{...At,value:Rt}}return At})}function rs(Tt){if(typeof Tt!=="object"||Tt===null||Array.isArray(Tt))return Tt;let bt=Tt,At=Object.keys(bt).find((Ct)=>Ct.toLowerCase()===on);if(At===void 0)return Tt;let Rt=o.toLowerCase();if(Object.keys(bt).some((Ct)=>Ct.toLowerCase()===Rt))throw new s(`User carries both ${o} and ${N}; send one`,"invalidValue");let{[At]:xt,...It}=bt,wt=Array.isArray(It.schemas)?It.schemas.map((Ct)=>typeof Ct==="string"?an(Ct):Ct):It.schemas;return{...It,...wt!==void 0&&{schemas:wt},[o]:xt}}function is(Tt){let{[o]:bt,...At}=Tt;if(bt===void 0)return Tt;return{...At,schemas:At.schemas?.map((Rt)=>Rt===o?N:Rt),[N]:bt}}var os={scim:{},entra:{normalizeResource:ts,normalizePatch:ss,normalizeUser:rs,projectUser:is},okta:{},sailpoint:{}},Kt=(Tt)=>Tt,wn={type:"scim",normalizeResource:Kt,normalizePatch:Kt,normalizeUser:Kt,projectUser:Kt};function we(Tt){for(let bt of["client_id","azp","sub"]){let At=Tt?.[bt];if(typeof At==="string"&&At)return At}return}function Ce(Tt,bt){if(!Tt||!bt)return wn;for(let[At,Rt]of Object.entries(Tt)){if(Rt.enabled===!1||!Rt.clientIds?.includes(bt))continue;let xt=os[Rt.type];if(!xt)continue;return{name:At,type:Rt.type,normalizeResource:xt.normalizeResource??Kt,normalizePatch:xt.normalizePatch??Kt,normalizeUser:xt.normalizeUser??Kt,projectUser:xt.projectUser??Kt}}return wn}var Mt=["workload"],Re={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Ae={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Ie={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},ve={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},xe={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Ee={id:"ion:iam:delegates:write",name:"Manage Delegates (SCIM Delegates)",description:"Authorizes a workload to create, replace, modify, and delete Delegate principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Pe={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Ue={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},De={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Mt},_e={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},Oe={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Mt,recommendedSubjectTypes:Mt},fe=[Re,Ae,Ie,ve,xe,Ee,Pe,Ue,De,_e,Oe],it={"iam.read":{permission:Re,subjectType:["workload"]},"iam.users.write":{permission:Ae,subjectType:["workload"]},"iam.groups.write":{permission:Ie,subjectType:["workload"]},"iam.workloads.write":{permission:ve,subjectType:["workload"]},"iam.customers.write":{permission:xe,subjectType:["workload"]},"iam.delegates.write":{permission:Ee,subjectType:["workload"]},"iam.access-requests.write":{permission:Pe,subjectType:["workload"]},"capabilitiez.read":{permission:Ue,subjectType:["workload"]},"ciam.magic-link.create":{permission:De,subjectType:["workload","user"]},"authz.oaa.sync":{permission:_e,subjectType:["workload"]},"tenant.manage":{permission:Oe,subjectType:["workload"]}};function ge(Tt){return{"~standard":{version:1,vendor:Tt,validate:(bt)=>{if(typeof bt!=="object"||bt===null)return{issues:[{message:"Expected an object"}]};let At=bt,Rt=[],xt={};if("code"in At)if(typeof At.code==="string")xt.code=At.code;else Rt.push({message:"code must be a string",path:["code"]});else if(!("error"in At))Rt.push({message:"code is required",path:["code"]});if("state"in At)if(typeof At.state==="string"||At.state===void 0)xt.state=At.state;else Rt.push({message:"state must be a string",path:["state"]});if("session_state"in At)if(typeof At.session_state==="string"||At.session_state===void 0)xt.session_state=At.session_state;else Rt.push({message:"session_state must be a string",path:["session_state"]});if("error"in At){if(typeof At.error==="string")xt.error=At.error;else Rt.push({message:"error must be a string",path:["error"]});if("error_description"in At)if(typeof At.error_description==="string"||At.error_description===void 0)xt.error_description=At.error_description;else Rt.push({message:"error_description must be a string",path:["error_description"]});if("error_uri"in At)if(typeof At.error_uri==="string"||At.error_uri===void 0)xt.error_uri=At.error_uri;else Rt.push({message:"error_uri must be a string",path:["error_uri"]})}if("iss"in At)if(typeof At.iss==="string"||At.iss===void 0)xt.iss=At.iss;else Rt.push({message:"iss must be a string",path:["iss"]});if(Rt.length>0)return{issues:Rt};return{value:xt}}}}}function ye(Tt){return{"~standard":{version:1,vendor:Tt,validate:(bt)=>{if(typeof bt!=="object"||bt===null)return{issues:[{message:"Expected an object"}]};let At=bt,Rt=[],xt={};if("access_token"in At)if(typeof At.access_token==="string")xt.access_token=At.access_token;else Rt.push({message:"access_token must be a string",path:["access_token"]});else Rt.push({message:"access_token is required",path:["access_token"]});if("id_token"in At)if(typeof At.id_token==="string")xt.id_token=At.id_token;else Rt.push({message:"id_token must be a string",path:["id_token"]});else Rt.push({message:"id_token is required",path:["id_token"]});if("token_type"in At)if(typeof At.token_type==="string")xt.token_type=At.token_type;else Rt.push({message:"token_type must be a string",path:["token_type"]});else Rt.push({message:"token_type is required",path:["token_type"]});if("refresh_token"in At)if(typeof At.refresh_token==="string"||At.refresh_token===void 0)xt.refresh_token=At.refresh_token;else Rt.push({message:"refresh_token must be a string",path:["refresh_token"]});if("scope"in At)if(typeof At.scope==="string"||At.scope===void 0)xt.scope=At.scope;else Rt.push({message:"scope must be a string",path:["scope"]});if("session_state"in At)if(typeof At.session_state==="string"||At.session_state===void 0)xt.session_state=At.session_state;else Rt.push({message:"session_state must be a string",path:["session_state"]});if("expires"in At)if(typeof At.expires==="string"||At.expires===void 0)xt.expires=At.expires;else Rt.push({message:"expires must be a string",path:["expires"]});if("expires_in"in At)if(typeof At.expires_in==="number"||At.expires_in===void 0)xt.expires_in=At.expires_in;else Rt.push({message:"expires_in must be a number",path:["expires_in"]});if("refresh_expires_in"in At)if(typeof At.refresh_expires_in==="number"||At.refresh_expires_in===void 0)xt.refresh_expires_in=At.refresh_expires_in;else Rt.push({message:"refresh_expires_in must be a number",path:["refresh_expires_in"]});if(Rt.length>0)return{issues:Rt};return{value:xt}}}}}function T(Tt){return{"~standard":{version:1,vendor:Tt,validate:(bt)=>{if(typeof bt!=="object"||bt===null)return{issues:[{message:"Expected an object"}]};let At=bt,Rt=[],xt={...At},It=["iss","sub"];for(let jt of It)if(typeof At[jt]!=="string")Rt.push({message:`${jt} is required and must be a string`,path:[jt]});let wt=At.aud;if(!(typeof wt==="string"||Array.isArray(wt)&&wt.length>0&&wt.every((jt)=>typeof jt==="string")))Rt.push({message:"aud is required and must be a string or a non-empty array of strings",path:["aud"]});if(typeof At.exp!=="number")Rt.push({message:"exp is required and must be a number",path:["exp"]});let Nt=["sid","name","email","preferred_username","picture"];for(let jt of Nt)if(jt in At&&At[jt]!==void 0){if(typeof At[jt]!=="string")Rt.push({message:`${jt} must be a string`,path:[jt]})}if("iat"in At&&At.iat!==void 0&&typeof At.iat!=="number")Rt.push({message:"iat must be a number",path:["iat"]});if(Rt.length>0)return{issues:Rt};return{value:xt}}}}}var a="application/json",at="application/scim+json",L="application/x-www-form-urlencoded",Me="application/xml",je="application/octet-stream",l=Object.freeze({Accept:"application/json"}),he=Object.freeze({Accept:"application/scim+json, application/json"}),ct=Object.freeze({Accept:"application/xml"}),ut=Object.freeze({Accept:"application/octet-stream"}),i=Object.freeze({"Content-Type":"application/json"}),A=Object.freeze({"Content-Type":"application/scim+json"}),w=Object.freeze({"Content-Type":"application/x-www-form-urlencoded"}),dt=Object.freeze({"Content-Type":"application/xml"}),lt=Object.freeze({"Content-Type":"application/octet-stream"});function ze(Tt){let bt=Tt.headers.get("content-type")?.split(";",1)[0]?.trim().toLowerCase();return Boolean(bt&&(bt==="application/json"||bt.endsWith("+json")))}function as(Tt){let bt=Tt.replace(/\s+/g," ").trim();return bt?bt.slice(0,300):void 0}async function Z(Tt,bt={}){let At=Tt.headers.get("content-type")??void 0,Rt;try{Rt=await Tt.text()}catch{return{contentType:At}}let xt=/<title(?:\s[^>]*)?>([\s\S]*?)<\/title>/i.exec(Rt)?.[1],It=as(xt??(bt.redact?"":Rt));return{contentType:At,excerpt:It}}async function d(Tt,bt={}){if(ze(Tt))return await Tt.json();let At=await Z(Tt,{redact:bt.redact});bt.log?.warn("Expected a JSON response body but received a different content type",{"ion.operation":bt.operation??"http.response","ion.outcome":"degraded",reason:"non_json_response",status:Tt.status,contentType:At.contentType,excerpt:At.excerpt});let Rt=[At.contentType,At.excerpt].filter(Boolean).join(": ");throw Error(`Expected a JSON response body${Rt?`; received ${Rt}`:""}`)}function m(Tt){let bt=Tt["~standard"];return Object.assign(Tt,{validate(At){return Promise.resolve(bt.validate(At))}})}function e(Tt,bt="Assertion failed. Required value is null or undefined."){if(Tt===void 0||Tt===null)throw Error(bt);return Tt}function Se(Tt,bt){return Response.json({error:"validation_failed",message:bt,issues:Tt},{status:400,headers:i})}function pt(Tt,bt,At=[]){let Rt={...Tt,...bt};for(let xt of At)Rt[xt]=Tt?.[xt]??bt?.[xt];return Rt}function Be(Tt){let bt="",At=0,Rt=Tt.length;while(At<Rt){let xt=Tt[At];if(xt==='"'||xt==="'"){let It=xt;bt+=xt,At++;while(At<Rt){let wt=Tt[At];if(wt==="\\"){if(bt+=wt,At+1<Rt)bt+=Tt[At+1],At+=2;else At++;continue}if(wt===It){bt+=wt,At++;break}bt+=wt,At++}continue}if(xt==="/"&&At+1<Rt){let It=Tt[At+1];if(It==="/"){At+=2;while(At<Rt&&Tt[At]!==`
-`)At++;if(At<Rt)bt+=`
-`;At++;continue}if(It==="*"){At+=2;while(At+1<Rt&&!(Tt[At]==="*"&&Tt[At+1]==="/"))At++;At+=2;continue}}bt+=xt,At++}return bt}function us(Tt){let bt="",At=!1,Rt=!1;for(let xt=0;xt<Tt.length;xt+=1){let It=Tt[xt];if(At){if(bt+=It,Rt)Rt=!1;else if(It==="\\")Rt=!0;else if(It==='"')At=!1;continue}if(It==='"'){At=!0,bt+=It;continue}if(It===","){let wt=xt+1;while(wt<Tt.length&&/\s/.test(Tt[wt]??""))wt+=1;let Ct=Tt[wt];if(Ct==="}"||Ct==="]")continue}bt+=It}return bt}function mt(Tt){let bt=us(Be(Tt));return JSON.parse(bt)}function I(Tt){return Tt==="/"?Tt:Tt.replace(/\/+$/,"")}function un(Tt){if(Tt===null||typeof Tt!=="object"||Array.isArray(Tt))return!1;let bt=Object.getPrototypeOf(Tt);return bt===Object.prototype||bt===null}function cn(Tt){return Object.keys(Tt).filter((bt)=>Tt[bt]!==void 0).sort()}function C(Tt,bt){if(Object.is(Tt,bt))return!0;if(Tt===null||bt===null)return Tt===bt;if(Array.isArray(Tt)||Array.isArray(bt)){if(!Array.isArray(Tt)||!Array.isArray(bt)||Tt.length!==bt.length)return!1;for(let xt=0;xt<Tt.length;xt+=1)if(!C(Tt[xt],bt[xt]))return!1;return!0}if(!un(Tt)||!un(bt))return!1;let At=cn(Tt),Rt=cn(bt);if(At.length!==Rt.length)return!1;for(let xt=0;xt<At.length;xt+=1)if(At[xt]!==Rt[xt])return!1;for(let xt of At)if(!C(Tt[xt],bt[xt]))return!1;return!0}function dn(Tt,bt){if(Tt===null||Tt===void 0){bt.push("n");return}if(Array.isArray(Tt)){bt.push("[");for(let At of Tt)dn(At,bt);bt.push("]");return}if(un(Tt)){bt.push("{");for(let At of cn(Tt))bt.push(JSON.stringify(At),":"),dn(Tt[At],bt);bt.push("}");return}bt.push(JSON.stringify(Tt))}function ft(Tt){let bt=[];dn(Tt,bt);let At=bt.join(""),Rt=2166136261;for(let xt=0;xt<At.length;xt+=1)Rt^=At.charCodeAt(xt),Rt=Rt*16777619%9007199254740992;return`${At.length.toString(36)}:${Rt.toString(36)}`}async function gt(Tt,bt=async(wt)=>wt.status===200,At=1000,Rt=1e4,xt,It){let wt=Date.now(),Ct=`Awaiting Ping (${Tt})`;return new Promise((Nt,jt)=>{let _t=null,Pt=null,vt=null,Ot=!1,Dt=()=>{if(_t)clearTimeout(_t);if(Pt)clearInterval(Pt);if(vt)clearTimeout(vt);_t=null,Pt=null,vt=null},qt=(Ut)=>{if(Ot)return;Ot=!0,Dt(),Ut()},$t=Math.max(At,1e4),Lt=async()=>{try{let Ut=await fetch(Tt,{headers:l,signal:AbortSignal.timeout($t)});if(Ut.ok){if(await bt(Ut)){qt(Nt);return}Ct=`Response test failed: ${Ut.status}: ${Ut.statusText} - ${Tt}`}else try{let Wt=await d(Ut,{log:It,operation:"wait_on.probe"});Ct=`Response error: ${Ut.status}: ${Ut.statusText} - ${Tt}: ${JSON.stringify(Wt)}`}catch(Wt){let Pn=Wt instanceof Error?`: ${Wt.message}`:"";Ct=`Response error: ${Ut.status}: ${Ut.statusText} - ${Tt}${Pn}`}}catch(Ut){Ct=`${Ut instanceof Error?Ut.message:String(Ut)} - ${Tt}`}if(!Ot)_t=setTimeout(()=>void Lt(),At)};if(Rt>0)Pt=setInterval(()=>{It?.warn(`${Ct}: ${Date.now()-wt}ms`)},Rt);if(xt)vt=setTimeout(()=>{qt(()=>jt(Error(`Timeout: ${xt}ms: ${Ct}`)))},xt);Lt()})}var cs="@ionite/core",ds=m(T(cs));function Q(Tt){let bt=Tt.exp!=null?new Date(Tt.exp*1000):new Date,At=Tt.iss??"";return{id:Tt.sub??"",userName:Tt.preferred_username??"",name:Tt.name??"",email:Tt.email??"",avatar:Tt.picture,sso:{profile:{...Tt,iss:Tt.iss??At,aud:Tt.aud},tenant:{id:Tt.idp??At,name:At},tokenType:"Bearer",expires:bt}}}function ps(Tt){let bt=Tt.replace(/-/g,"+").replace(/_/g,"/");return atob(bt)}async function yt(Tt){let bt=Tt.split(".");if(bt.length!==3)throw Error("Invalid JWT");let At=ps(bt[1]),Rt=JSON.parse(At),xt=await ds.validate(Rt);if(xt.issues)throw Error(`ID token claims validation failed: ${xt.issues.map((It)=>It.message).join("; ")}`);if(xt.value)return Q(xt.value);throw Error("ID token claims validation failed")}class v extends n{constructor(Tt,bt,At){super(Tt,{status:409,statusText:"conflict"});this.name="StoreConflictError";this.code="conflict";this.kind=bt,this.field=At}safeBody(){return{kind:this.kind,...this.field!==void 0?{field:this.field}:{}}}}function q(Tt){return Tt instanceof v||typeof Tt==="object"&&Tt!=null&&Tt.code==="conflict"}function Ne(Tt){if(typeof Tt!=="object"||Tt==null)return!1;let bt=Tt.type;if(bt==="vault"||bt==="aws"||bt==="azure"||bt==="gcp")return!0;if(bt!=="mirror")return!1;let At=Tt;return Ne(At.from)&&At.from.type!=="mirror"&&Ne(At.to)&&At.to.type==="vault"}var ht="ion-tm-handle+jwt",St="urn:ietf:params:oauth:request_uri:";function kt(Tt,bt=Date.now()){let At=Tt?.integration;if(!At)return{state:"none"};if(Date.parse(At.expiresAt)<=bt)return{state:"expired",integration:At};if(At.status==="consented"&&At.handoverAppliedAt&&Tt.configLocator)return{state:"integrated",integration:At};return{state:At.status,integration:At}}class kn{constructor(){this.tenants=new Map;this.integrationHandles=new Map;this.requestTokens=new Map;this.ioniteIds=new Map;this.stagedRequests=new Map}async get(Tt){return this.tenants.get(Tt)}async list(Tt){let bt=Array.from(this.tenants.values()),At=Math.max(0,Tt?.start??0),Rt=Tt?.limit,xt=bt.length,It=Rt!=null?At+Rt:void 0,wt=bt.slice(At,It);return K(xt,wt,At,Rt)}async upsert(Tt){let bt=this.tenants.get(Tt.id);if(bt?.ioniteId!==Tt.ioniteId){if(bt?.ioniteId)throw Error("ionite id cannot change");if(Tt.ioniteId){let At=this.ioniteIds.get(Tt.ioniteId);if(At&&At!==Tt.id)throw Error("ionite id is already in use");this.ioniteIds.set(Tt.ioniteId,Tt.id)}}if(bt?.integration?.handleHash!==Tt.integration?.handleHash){if(bt?.integration)this.integrationHandles.delete(bt.integration.handleHash);if(Tt.integration){let At=this.integrationHandles.get(Tt.integration.handleHash);if(At&&At!==Tt.id)throw Error("Integration handle hash is already in use");this.integrationHandles.set(Tt.integration.handleHash,Tt.id)}}if(bt?.requestTokenHash!==Tt.requestTokenHash){if(bt?.requestTokenHash)this.requestTokens.delete(bt.requestTokenHash);if(Tt.requestTokenHash){let At=this.requestTokens.get(Tt.requestTokenHash);if(At&&At!==Tt.id)throw Error("Request token hash is already in use");this.requestTokens.set(Tt.requestTokenHash,Tt.id)}}return this.tenants.set(Tt.id,Tt),Tt}async delete(Tt){let bt=this.tenants.get(Tt),At=bt!==void 0;if(bt?.integration)this.integrationHandles.delete(bt.integration.handleHash);if(bt?.requestTokenHash)this.requestTokens.delete(bt.requestTokenHash);if(bt?.ioniteId)this.ioniteIds.delete(bt.ioniteId);return this.tenants.delete(Tt),At?1:0}async setIntegration(Tt,bt,At){let Rt=this.tenants.get(Tt);if(!Rt)return;let xt=Rt.integration?.handleHash;if(At?.expectedHandleHash!==void 0&&(At.expectedHandleHash===null?xt!==void 0:xt!==At.expectedHandleHash))return;if(At?.expectedVersion!==void 0&&Rt.integration?.version!==At.expectedVersion)return;if(C(Rt.integration,bt))return Rt;if(bt){let Ct=this.integrationHandles.get(bt.handleHash);if(Ct&&Ct!==Tt)throw Error("Integration handle hash is already in use")}if(Rt.integration)this.integrationHandles.delete(Rt.integration.handleHash);if(bt)this.integrationHandles.set(bt.handleHash,Tt);let It=bt?.ioniteId??Rt.ioniteId;if(It){if(Rt.ioniteId&&Rt.ioniteId!==It)throw Error("ionite id cannot change");let Ct=this.ioniteIds.get(It);if(Ct&&Ct!==Tt)throw Error("ionite id is already in use");this.ioniteIds.set(It,Tt)}let wt={...Rt,ioniteId:It,integration:bt,updatedAt:new Date};return this.tenants.set(Tt,wt),wt}async getByIntegrationHandleHash(Tt){let bt=this.integrationHandles.get(Tt);return bt?this.tenants.get(bt):void 0}async setStagedRequest(Tt,bt){let At=Date.now();for(let[Rt,xt]of this.stagedRequests)if(!(Date.parse(xt.expiresAt)>At))this.stagedRequests.delete(Rt);this.stagedRequests.set(Tt,bt)}async getStagedRequest(Tt){let bt=this.stagedRequests.get(Tt);if(!bt)return;if(Date.parse(bt.expiresAt)>Date.now())return bt;this.stagedRequests.delete(Tt);return}async getByRequestTokenHash(Tt){let bt=this.requestTokens.get(Tt);return bt?this.tenants.get(bt):void 0}async replaceActionRequest(Tt,bt){let At=this.requestTokens.get(Tt),Rt=At?this.tenants.get(At):void 0;if(!Rt||Rt.id!==bt.id||Rt.status!=="action_required")return;return this.upsert(bt)}async getByIoniteId(Tt){let bt=this.ioniteIds.get(Tt);return bt?this.tenants.get(bt):void 0}}class Ge{constructor(Tt={}){this.ionCache=Tt.ionCache,this.store=new kn}async get(Tt){return this.store.get(Tt)}async list(Tt){return this.store.list(Tt)}async upsert(Tt){let bt=await this.store.upsert(Tt);return this.ionCache?.delete(Tt.id),bt}async delete(Tt){let bt=await this.store.delete(Tt);return this.ionCache?.delete(Tt),bt}async getIon(Tt){if(!this.ionCache)throw Error(`${this.constructor.name}.getIon() requires an app-owned ionCache. Pass { ionCache } (an lru-cache instance whose fetchMethod builds the tenant Ionite and whose dispose `+"closes it) — the SDK does not cache tenant runtimes. See the multi-tenant docs.");return this.ionCache.fetch(Tt)}async setIntegration(Tt,bt,At){return this.store.setIntegration(Tt,bt,At)}async getByIntegrationHandleHash(Tt){return this.store.getByIntegrationHandleHash(Tt)}async setStagedRequest(Tt,bt){return this.store.setStagedRequest(Tt,bt)}async getStagedRequest(Tt){return this.store.getStagedRequest(Tt)}async getByRequestTokenHash(Tt){return this.store.getByRequestTokenHash(Tt)}async replaceActionRequest(Tt,bt){let At=await this.store.replaceActionRequest(Tt,bt);if(At)this.ionCache?.delete(At.id);return At}async getByIoniteId(Tt){return this.store.getByIoniteId(Tt)}}
-export{ee,He,p,x,E,P,c,n,te,K,u,Fe,ne,y,t,Je,h,U,re,Le,qe,Ye,$e,W,V,R,z,se,B,r,f,oe,D,ke,Xe,Ze,G,Qe,et,tt,ie,ae,H,ce,be,Te,g,F,Ke,ue,J,_,O,Y,We,M,Ve,nt,rt,j,s,de,X,o,S,k,b,st,ot,le,pe,me,N,we,Ce,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,De,_e,Oe,fe,it,ge,ye,T,a,at,L,Me,je,l,he,ct,ut,i,A,w,dt,lt,ze,Z,d,m,e,Se,pt,Be,mt,I,C,ft,gt,Q,yt,v,q,Ne,ht,St,kt,Ge};