@vertesia/ui 1.6.0-dev.20260918.090710Z → 1.6.0-dev.20260923.085325Z

package/lib/vertesia-ui-env.js

@@ -1,2 +1,2 @@
-function e(){if(typeof window>`u`)return;let e=window.__VERTESIA_RUNTIME_CONFIG__;if(e?.authMode===`central`)return e;if(e?.authMode!==`firebase`)return;let t=e.firebase;if(t?.apiKey&&t.authDomain&&t.projectId&&t.appId)return e}function t(e){if(!e)return;let t=t=>typeof e[t]==`string`?e[t].trim():``,n=t(`VITE_AUTH_MODE`);if(n&&n!==`firebase`&&n!==`central`)throw Error(`VITE_AUTH_MODE must be firebase or central`);if(!n)return;if(n===`central`)return{authMode:`central`};let r={apiKey:`VITE_FIREBASE_API_KEY`,authDomain:`VITE_FIREBASE_AUTH_DOMAIN`,projectId:`VITE_FIREBASE_PROJECT_ID`,appId:`VITE_FIREBASE_APP_ID`},i=Object.values(r).filter(e=>!t(e));if(i.length)throw Error(`Firebase authentication requires: ${i.join(`, `)}`);return{authMode:`firebase`,firebase:{apiKey:t(r.apiKey),authDomain:t(r.authDomain),projectId:t(r.projectId),appId:t(r.appId)}}}var n=class{_props;constructor(e){this._props=e}init(n,r){let i=e()??t(r),a=i?.authMode===`firebase`?i.firebase:void 0;this._props=n&&a&&!n.firebase?{...n,firebase:a}:n;let o=i?.authMode===`central`?i.authUrl?.trim():void 0;this._props&&o&&(this._props={...this._props,endpoints:{...this._props.endpoints,auth:o}});let s=typeof r?.VITE_FIREBASE_TENANT_ID==`string`?r.VITE_FIREBASE_TENANT_ID.trim():``;if(this._props?.firebase&&s&&!this._props.firebase.tenantId&&(this._props={...this._props,firebase:{...this._props.firebase,tenantId:s}}),this._props&&this._props.defaultAuthSelection===void 0&&r){let e=typeof r.VITE_VERTESIA_ACCOUNT_ID==`string`&&r.VITE_VERTESIA_ACCOUNT_ID.trim()||void 0,t=typeof r.VITE_VERTESIA_PROJECT_ID==`string`&&r.VITE_VERTESIA_PROJECT_ID.trim()||void 0;(e||t)&&(this._props={...this._props,defaultAuthSelection:{accountId:e,projectId:t}})}return i&&typeof window<`u`&&window.AUTH_MODE===void 0&&(window.AUTH_MODE=i.authMode),this}prop(e){if(!this._props)throw Error(`VertesiaEnvironment was not initialized`);return this._props[e]}get version(){return this.prop(`version`)}get commitTimestamp(){return this._props?.commitTimestamp}get sdkVersion(){return this._props?.sdkVersion}get name(){return this.prop(`name`)}get type(){return this.prop(`type`)}get isProd(){return this.type===`production`||this.type===`preview`}get isDev(){return!this.isProd}get isLocalDev(){return this.prop(`isLocalDev`)}get isDocker(){return this.prop(`isDocker`)}get endpoints(){return this.prop(`endpoints`)}get firebase(){return this.prop(`firebase`)}get region(){return this._props?.region}get datadog(){return this.datadogRum}get datadogRum(){return this._props?.datadogRum??!1}get datadogLogs(){return this._props?.datadogLogs??!1}get devAuthToken(){return this._props?.devAuthToken}get defaultAuthSelection(){return this._props?.defaultAuthSelection}get oauth(){return this._props?.oauth}get authTokenProvider(){return this._props?.authTokenProvider}get logger(){return this._props?.logger??console}onLogin(e){this._props?.onLogin?.(e)}onLogout(){this._props?.onLogout?.()}};const r=new n;export{r as Env,n as VertesiaEnvironment};
+const e=/^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/,t=`[a-z0-9](?:[a-z0-9-]*[a-z0-9])?`,n=`(?:${t}\\.)?`,r=[RegExp(`^cloud\\.${n}vertesia\\.io$`),RegExp(`^${t}\\.cloud\\.${n}vertesia\\.io$`),RegExp(`^${t}\\.ui\\.${t}\\.vertesia\\.io$`)],i=[RegExp(`^apps(?:-preview|-preprod)?\\.${n}vertesia\\.io$`),RegExp(`^app-gateway-${t}\\.api\\.${t}\\.vertesia\\.io$`)];function a(t){return t===`localhost`||t.endsWith(`.localhost`)||t===`::1`||t===`[::1]`?!0:e.test(t)}function o(e){return e.toLowerCase().replace(/\.$/,``)}const s=[RegExp(`^auth\\.${n}vertesia\\.io$`)];function c(e,t={}){try{let n=new URL(e),r=o(n.hostname);return n.username||n.password||n.search||n.hash||n.pathname!==`/`?!1:t.allowLoopback&&a(r)?n.protocol===`http:`||n.protocol===`https:`:n.protocol===`https:`&&!n.port&&s.some(e=>e.test(r))}catch{return!1}}function l(){if(typeof window>`u`)return;let e=window.__VERTESIA_RUNTIME_CONFIG__;if(e?.authMode===`central`)return e;if(e?.authMode!==`firebase`)return;let t=e.firebase;if(t?.apiKey&&t.authDomain&&t.projectId&&t.appId)return e}function u(e){if(!e)return;let t=t=>typeof e[t]==`string`?e[t].trim():``,n=t(`VITE_AUTH_MODE`);if(n&&n!==`firebase`&&n!==`central`)throw Error(`VITE_AUTH_MODE must be firebase or central`);if(!n)return;if(n===`central`)return{authMode:`central`};let r={apiKey:`VITE_FIREBASE_API_KEY`,authDomain:`VITE_FIREBASE_AUTH_DOMAIN`,projectId:`VITE_FIREBASE_PROJECT_ID`,appId:`VITE_FIREBASE_APP_ID`},i=Object.values(r).filter(e=>!t(e));if(i.length)throw Error(`Firebase authentication requires: ${i.join(`, `)}`);return{authMode:`firebase`,firebase:{apiKey:t(r.apiKey),authDomain:t(r.authDomain),projectId:t(r.projectId),appId:t(r.appId)}}}var d=class{_props;constructor(e){this._props=e}init(e,t){let n=l()??u(t),r=n?.authMode===`firebase`?n.firebase:void 0;this._props=e&&r&&!e.firebase?{...e,firebase:r}:e;let i=n?.authMode===`central`?n.authUrl?.trim():void 0;this._props&&i&&c(i,{allowLoopback:this._props.isLocalDev})&&(this._props={...this._props,endpoints:{...this._props.endpoints,auth:i}}),this._props&&n?.authMode===`central`&&n.oauth&&(this._props={...this._props,oauth:n.oauth,endpoints:{...this._props.endpoints,...n.endpoints}}),this._props&&n?.allowLegacyIframeAuth!==void 0&&(this._props={...this._props,allowLegacyIframeAuth:n.allowLegacyIframeAuth});let a=typeof t?.VITE_FIREBASE_TENANT_ID==`string`?t.VITE_FIREBASE_TENANT_ID.trim():``;if(this._props?.firebase&&a&&!this._props.firebase.tenantId&&(this._props={...this._props,firebase:{...this._props.firebase,tenantId:a}}),this._props&&this._props.defaultAuthSelection===void 0&&t){let e=typeof t.VITE_VERTESIA_ACCOUNT_ID==`string`&&t.VITE_VERTESIA_ACCOUNT_ID.trim()||void 0,n=typeof t.VITE_VERTESIA_PROJECT_ID==`string`&&t.VITE_VERTESIA_PROJECT_ID.trim()||void 0;(e||n)&&(this._props={...this._props,defaultAuthSelection:{accountId:e,projectId:n}})}return n&&typeof window<`u`&&window.AUTH_MODE===void 0&&(window.AUTH_MODE=n.authMode),this}prop(e){if(!this._props)throw Error(`VertesiaEnvironment was not initialized`);return this._props[e]}get version(){return this.prop(`version`)}get commitTimestamp(){return this._props?.commitTimestamp}get sdkVersion(){return this._props?.sdkVersion}get name(){return this.prop(`name`)}get type(){return this.prop(`type`)}get isProd(){return this.type===`production`||this.type===`preview`}get isDev(){return!this.isProd}get isLocalDev(){return this.prop(`isLocalDev`)}get isDocker(){return this.prop(`isDocker`)}get endpoints(){return this.prop(`endpoints`)}get firebase(){return this.prop(`firebase`)}get region(){return this._props?.region}get datadog(){return this.datadogRum}get datadogRum(){return this._props?.datadogRum??!1}get datadogLogs(){return this._props?.datadogLogs??!1}get devAuthToken(){return this._props?.devAuthToken}get defaultAuthSelection(){return this._props?.defaultAuthSelection}get allowLegacyIframeAuth(){return this._props?.allowLegacyIframeAuth??!1}get oauth(){return this._props?.oauth}get authTokenProvider(){return this._props?.authTokenProvider}get logger(){return this._props?.logger??console}onLogin(e){this._props?.onLogin?.(e)}onLogout(){this._props?.onLogout?.()}};const f=new d;export{f as Env,r as FIRST_PARTY_HOST_PATTERNS,i as GATEWAY_HOST_PATTERNS,d as VertesiaEnvironment,a as isLoopbackHostname,c as isTrustedAuthBrokerUrl,o as normalizeHostname};
 //# sourceMappingURL=vertesia-ui-env.js.map

package/lib/vertesia-ui-env.js.map

@@ -1 +1 @@
-{"version":3,"file":"vertesia-ui-env.js","names":[],"sources":["env/index.js"],"sourcesContent":["// hook to initialize the environment and auth session\n// the main app must call this hook before rendering the page.\nfunction injectedRuntimeConfig() {\n    if (typeof window === 'undefined')\n        return undefined;\n    const runtimeConfig = window.__VERTESIA_RUNTIME_CONFIG__;\n    if (runtimeConfig?.authMode === 'central')\n        return runtimeConfig;\n    if (runtimeConfig?.authMode !== 'firebase')\n        return undefined;\n    const firebase = runtimeConfig.firebase;\n    if (!firebase?.apiKey || !firebase.authDomain || !firebase.projectId || !firebase.appId)\n        return undefined;\n    return runtimeConfig;\n}\nfunction buildRuntimeConfig(env) {\n    if (!env)\n        return undefined;\n    const value = (name) => (typeof env[name] === 'string' ? env[name].trim() : '');\n    const mode = value('VITE_AUTH_MODE');\n    if (mode && mode !== 'firebase' && mode !== 'central') {\n        throw new Error('VITE_AUTH_MODE must be firebase or central');\n    }\n    // Firebase build settings are only consumed after an explicit opt-in.\n    if (!mode)\n        return undefined;\n    if (mode === 'central')\n        return { authMode: 'central' };\n    const fields = {\n        apiKey: 'VITE_FIREBASE_API_KEY',\n        authDomain: 'VITE_FIREBASE_AUTH_DOMAIN',\n        projectId: 'VITE_FIREBASE_PROJECT_ID',\n        appId: 'VITE_FIREBASE_APP_ID',\n    };\n    const missing = Object.values(fields).filter((name) => !value(name));\n    if (missing.length) {\n        throw new Error(`Firebase authentication requires: ${missing.join(', ')}`);\n    }\n    return {\n        authMode: 'firebase',\n        firebase: {\n            apiKey: value(fields.apiKey),\n            authDomain: value(fields.authDomain),\n            projectId: value(fields.projectId),\n            appId: value(fields.appId),\n        },\n    };\n}\nexport class VertesiaEnvironment {\n    _props;\n    constructor(_props) {\n        this._props = _props;\n    }\n    init(props, buildEnv) {\n        // Host runtime configuration takes precedence over static deployment defaults.\n        const runtimeConfig = injectedRuntimeConfig() ?? buildRuntimeConfig(buildEnv);\n        const runtimeFirebase = runtimeConfig?.authMode === 'firebase' ? runtimeConfig.firebase : undefined;\n        this._props = props && runtimeFirebase && !props.firebase ? { ...props, firebase: runtimeFirebase } : props;\n        const authUrl = runtimeConfig?.authMode === 'central' ? runtimeConfig.authUrl?.trim() : undefined;\n        if (this._props && authUrl) {\n            this._props = { ...this._props, endpoints: { ...this._props.endpoints, auth: authUrl } };\n        }\n        const tenantId = typeof buildEnv?.VITE_FIREBASE_TENANT_ID === 'string' ? buildEnv.VITE_FIREBASE_TENANT_ID.trim() : '';\n        if (this._props?.firebase && tenantId && !this._props.firebase.tenantId) {\n            this._props = { ...this._props, firebase: { ...this._props.firebase, tenantId } };\n        }\n        if (this._props && this._props.defaultAuthSelection === undefined && buildEnv) {\n            const accountId = typeof buildEnv.VITE_VERTESIA_ACCOUNT_ID === 'string'\n                ? buildEnv.VITE_VERTESIA_ACCOUNT_ID.trim() || undefined\n                : undefined;\n            const projectId = typeof buildEnv.VITE_VERTESIA_PROJECT_ID === 'string'\n                ? buildEnv.VITE_VERTESIA_PROJECT_ID.trim() || undefined\n                : undefined;\n            if (accountId || projectId)\n                this._props = { ...this._props, defaultAuthSelection: { accountId, projectId } };\n        }\n        if (runtimeConfig && typeof window !== 'undefined' && window.AUTH_MODE === undefined) {\n            window.AUTH_MODE = runtimeConfig.authMode;\n        }\n        return this;\n    }\n    prop(name) {\n        if (!this._props) {\n            throw new Error('VertesiaEnvironment was not initialized');\n        }\n        return this._props[name];\n    }\n    get version() {\n        return this.prop('version');\n    }\n    get commitTimestamp() {\n        return this._props?.commitTimestamp;\n    }\n    get sdkVersion() {\n        return this._props?.sdkVersion;\n    }\n    get name() {\n        return this.prop('name');\n    }\n    get type() {\n        return this.prop('type');\n    }\n    get isProd() {\n        return this.type === 'production' || this.type === 'preview';\n    }\n    get isDev() {\n        return !this.isProd;\n    }\n    get isLocalDev() {\n        return this.prop('isLocalDev');\n    }\n    get isDocker() {\n        return this.prop('isDocker');\n    }\n    get endpoints() {\n        return this.prop('endpoints');\n    }\n    get firebase() {\n        return this.prop('firebase');\n    }\n    get region() {\n        return this._props?.region;\n    }\n    /**\n     * @deprecated Use datadogRum and datadogLogs instead for more granular control. This will be removed in a future release. Is an alias for DatadogRUM\n     *\n     */\n    get datadog() {\n        return this.datadogRum;\n    }\n    get datadogRum() {\n        return this._props?.datadogRum ?? false;\n    }\n    get datadogLogs() {\n        return this._props?.datadogLogs ?? false;\n    }\n    get devAuthToken() {\n        return this._props?.devAuthToken;\n    }\n    get defaultAuthSelection() {\n        return this._props?.defaultAuthSelection;\n    }\n    get oauth() {\n        return this._props?.oauth;\n    }\n    get authTokenProvider() {\n        return this._props?.authTokenProvider;\n    }\n    get logger() {\n        return this._props?.logger ?? console;\n    }\n    /**\n     * Callback to notify the host app when the user logs in.\n     */\n    onLogin(token) {\n        this._props?.onLogin?.(token);\n    }\n    /**\n     * Callback to notify the host app when the user logs out\n     */\n    onLogout() {\n        this._props?.onLogout?.();\n    }\n}\nconst Env = new VertesiaEnvironment();\nexport { Env };\n//# sourceMappingURL=index.js.map"],"mappings":"AAEA,SAAS,GAAwB,CAC7B,GAAI,OAAO,OAAW,IAClB,OACJ,IAAM,EAAgB,OAAO,4BAC7B,GAAI,GAAe,WAAa,UAC5B,OAAO,EACX,GAAI,GAAe,WAAa,WAC5B,OACJ,IAAM,EAAW,EAAc,SAC3B,GAAC,GAAU,QAAW,EAAS,YAAe,EAAS,WAAc,EAAS,MAElF,OAAO,CACX,CACA,SAAS,EAAmB,EAAK,CAC7B,GAAI,CAAC,EACD,OACJ,IAAM,EAAS,GAAU,OAAO,EAAI,IAAU,SAAW,EAAI,EAAK,CAAC,KAAK,EAAI,GACtE,EAAO,EAAM,gBAAgB,EACnC,GAAI,GAAQ,IAAS,YAAc,IAAS,UACxC,MAAU,MAAM,4CAA4C,EAGhE,GAAI,CAAC,EACD,OACJ,GAAI,IAAS,UACT,MAAO,CAAE,SAAU,SAAU,EACjC,IAAM,EAAS,CACX,OAAQ,wBACR,WAAY,4BACZ,UAAW,2BACX,MAAO,sBACX,EACM,EAAU,OAAO,OAAO,CAAM,CAAC,CAAC,OAAQ,GAAS,CAAC,EAAM,CAAI,CAAC,EACnE,GAAI,EAAQ,OACR,MAAU,MAAM,qCAAqC,EAAQ,KAAK,IAAI,GAAG,EAE7E,MAAO,CACH,SAAU,WACV,SAAU,CACN,OAAQ,EAAM,EAAO,MAAM,EAC3B,WAAY,EAAM,EAAO,UAAU,EACnC,UAAW,EAAM,EAAO,SAAS,EACjC,MAAO,EAAM,EAAO,KAAK,CAC7B,CACJ,CACJ,CACA,IAAa,EAAb,KAAiC,CAC7B,OACA,YAAY,EAAQ,CAChB,KAAK,OAAS,CAClB,CACA,KAAK,EAAO,EAAU,CAElB,IAAM,EAAgB,EAAsB,GAAK,EAAmB,CAAQ,EACtE,EAAkB,GAAe,WAAa,WAAa,EAAc,SAAW,IAAA,GAC1F,KAAK,OAAS,GAAS,GAAmB,CAAC,EAAM,SAAW,CAAE,GAAG,EAAO,SAAU,CAAgB,EAAI,EACtG,IAAM,EAAU,GAAe,WAAa,UAAY,EAAc,SAAS,KAAK,EAAI,IAAA,GACpF,KAAK,QAAU,IACf,KAAK,OAAS,CAAE,GAAG,KAAK,OAAQ,UAAW,CAAE,GAAG,KAAK,OAAO,UAAW,KAAM,CAAQ,CAAE,GAE3F,IAAM,EAAW,OAAO,GAAU,yBAA4B,SAAW,EAAS,wBAAwB,KAAK,EAAI,GAInH,GAHI,KAAK,QAAQ,UAAY,GAAY,CAAC,KAAK,OAAO,SAAS,WAC3D,KAAK,OAAS,CAAE,GAAG,KAAK,OAAQ,SAAU,CAAE,GAAG,KAAK,OAAO,SAAU,UAAS,CAAE,GAEhF,KAAK,QAAU,KAAK,OAAO,uBAAyB,IAAA,IAAa,EAAU,CAC3E,IAAM,EAAY,OAAO,EAAS,0BAA6B,UACzD,EAAS,yBAAyB,KAAK,GACvC,IAAA,GACA,EAAY,OAAO,EAAS,0BAA6B,UACzD,EAAS,yBAAyB,KAAK,GACvC,IAAA,IACF,GAAa,KACb,KAAK,OAAS,CAAE,GAAG,KAAK,OAAQ,qBAAsB,CAAE,YAAW,WAAU,CAAE,EACvF,CAIA,OAHI,GAAiB,OAAO,OAAW,KAAe,OAAO,YAAc,IAAA,KACvE,OAAO,UAAY,EAAc,UAE9B,IACX,CACA,KAAK,EAAM,CACP,GAAI,CAAC,KAAK,OACN,MAAU,MAAM,yCAAyC,EAE7D,OAAO,KAAK,OAAO,EACvB,CACA,IAAI,SAAU,CACV,OAAO,KAAK,KAAK,SAAS,CAC9B,CACA,IAAI,iBAAkB,CAClB,OAAO,KAAK,QAAQ,eACxB,CACA,IAAI,YAAa,CACb,OAAO,KAAK,QAAQ,UACxB,CACA,IAAI,MAAO,CACP,OAAO,KAAK,KAAK,MAAM,CAC3B,CACA,IAAI,MAAO,CACP,OAAO,KAAK,KAAK,MAAM,CAC3B,CACA,IAAI,QAAS,CACT,OAAO,KAAK,OAAS,cAAgB,KAAK,OAAS,SACvD,CACA,IAAI,OAAQ,CACR,MAAO,CAAC,KAAK,MACjB,CACA,IAAI,YAAa,CACb,OAAO,KAAK,KAAK,YAAY,CACjC,CACA,IAAI,UAAW,CACX,OAAO,KAAK,KAAK,UAAU,CAC/B,CACA,IAAI,WAAY,CACZ,OAAO,KAAK,KAAK,WAAW,CAChC,CACA,IAAI,UAAW,CACX,OAAO,KAAK,KAAK,UAAU,CAC/B,CACA,IAAI,QAAS,CACT,OAAO,KAAK,QAAQ,MACxB,CAKA,IAAI,SAAU,CACV,OAAO,KAAK,UAChB,CACA,IAAI,YAAa,CACb,OAAO,KAAK,QAAQ,YAAc,EACtC,CACA,IAAI,aAAc,CACd,OAAO,KAAK,QAAQ,aAAe,EACvC,CACA,IAAI,cAAe,CACf,OAAO,KAAK,QAAQ,YACxB,CACA,IAAI,sBAAuB,CACvB,OAAO,KAAK,QAAQ,oBACxB,CACA,IAAI,OAAQ,CACR,OAAO,KAAK,QAAQ,KACxB,CACA,IAAI,mBAAoB,CACpB,OAAO,KAAK,QAAQ,iBACxB,CACA,IAAI,QAAS,CACT,OAAO,KAAK,QAAQ,QAAU,OAClC,CAIA,QAAQ,EAAO,CACX,KAAK,QAAQ,UAAU,CAAK,CAChC,CAIA,UAAW,CACP,KAAK,QAAQ,WAAW,CAC5B,CACJ,EACA,MAAM,EAAM,IAAI"}
+{"version":3,"file":"vertesia-ui-env.js","names":[],"sources":["session/auth/vertesiaHosts.js","env/index.js"],"sourcesContent":["const LOOPBACK_IPV4 = /^127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$/;\n/** A single DNS label: alphanumeric, inner hyphens allowed. */\nexport const LABEL = '[a-z0-9](?:[a-z0-9-]*[a-z0-9])?';\n/** The region label is optional throughout, because each regional host has a global US alias. */\nexport const REGION = `(?:${LABEL}\\\\.)?`;\n/**\n * Hostnames served by the UI backend — Vertesia's own code, not merely a Vertesia-owned name:\n *   `cloud.vertesia.io`, `cloud.us1.vertesia.io`                     — the Cloud UI\n *   `preprod.cloud.vertesia.io`, `preview.cloud.us1.vertesia.io`     — its preview/preprod tiers\n *   `acme.cloud.us1.vertesia.io`                                     — per-IdP-tenant branded hosts\n *   `dev-feat-x.ui.dev1.vertesia.io`                                 — dynamic per-branch dev envs\n *\n * Mirrors the load-balancer host rules (region-lb/main.tf: `cloud.${var.domain}`,\n * `*.cloud.${var.domain}`, `*.ui.${var.domain}`) rather than the DNS zone, so a name we merely own\n * is not trusted for what serves it.\n */\nexport const FIRST_PARTY_HOST_PATTERNS = [\n    new RegExp(`^cloud\\\\.${REGION}vertesia\\\\.io$`),\n    new RegExp(`^${LABEL}\\\\.cloud\\\\.${REGION}vertesia\\\\.io$`),\n    new RegExp(`^${LABEL}\\\\.ui\\\\.${LABEL}\\\\.vertesia\\\\.io$`),\n];\n/**\n * Public app-gateway origins. Stable tiers use the `apps*` browser-facing host, while development\n * environments reach the gateway through its `*.api.*` Cloud Run route:\n *   `apps.us1.vertesia.io`, `apps-preview.us1.vertesia.io`\n *   `app-gateway-dev1.api.dev1.vertesia.io`, `app-gateway-us3.api.us3.vertesia.io`\n *\n * The second label is deliberately unconstrained. Branch environments do NOT each get a gateway —\n * they share their region's (`detectGatewayUrl` in packages/server-common/src/env/ServerEnv.ts:444\n * and `getAppgenServerBaseUrl` in packages/workflows/.../app_workspace/workspace-utils.ts), so the\n * host published to browsers is region-scoped, while the per-branch `app-gateway-dev-<branch>`\n * shape in the infrastructure README also exists. Matching `app-gateway-<anything>` covers both,\n * and every Cloud Run service named that way *is* a gateway (region-compute/main.tf:373).\n *\n * These serve every tenant's published application from one shared origin, and published assets\n * need no authentication — so this is generated, low-trust code sitting on a Vertesia-owned\n * hostname. Owning the domain is not the test; which backend serves the origin is.\n *\n * Two load-balancer variables can map further hostnames onto the same backend —\n * `appgen_host_aliases` and `appgen_preview_host_aliases` in\n * infrastructure/terraform/modules/region-lb/variables.tf. Both are empty in every region today; if\n * one is ever set, add the alias here too, or it silently falls through to the permissive branch of\n * Policy L and becomes an origin that may receive a token at any path.\n */\nexport const GATEWAY_HOST_PATTERNS = [\n    new RegExp(`^apps(?:-preview|-preprod)?\\\\.${REGION}vertesia\\\\.io$`),\n    new RegExp(`^app-gateway-${LABEL}\\\\.api\\\\.${LABEL}\\\\.vertesia\\\\.io$`),\n];\nexport function isLoopbackHostname(hostname) {\n    if (hostname === 'localhost' || hostname.endsWith('.localhost')) {\n        return true;\n    }\n    if (hostname === '::1' || hostname === '[::1]') {\n        return true;\n    }\n    return LOOPBACK_IPV4.test(hostname);\n}\nexport function normalizeHostname(hostname) {\n    return hostname.toLowerCase().replace(/\\.$/, '');\n}\nexport const AUTH_BROKER_HOST_PATTERNS = [new RegExp(`^auth\\\\.${REGION}vertesia\\\\.io$`)];\nexport function isTrustedAuthBrokerUrl(value, options = {}) {\n    try {\n        const url = new URL(value);\n        const hostname = normalizeHostname(url.hostname);\n        if (url.username || url.password || url.search || url.hash || url.pathname !== '/')\n            return false;\n        if (options.allowLoopback && isLoopbackHostname(hostname)) {\n            return url.protocol === 'http:' || url.protocol === 'https:';\n        }\n        return (url.protocol === 'https:' &&\n            !url.port &&\n            AUTH_BROKER_HOST_PATTERNS.some((pattern) => pattern.test(hostname)));\n    }\n    catch {\n        return false;\n    }\n}\n//# sourceMappingURL=vertesiaHosts.js.map","import { isTrustedAuthBrokerUrl } from '../session/auth/vertesiaHosts.js';\nexport { FIRST_PARTY_HOST_PATTERNS, GATEWAY_HOST_PATTERNS, isLoopbackHostname, isTrustedAuthBrokerUrl, normalizeHostname, } from '../session/auth/vertesiaHosts.js';\nfunction injectedRuntimeConfig() {\n    if (typeof window === 'undefined')\n        return undefined;\n    const runtimeConfig = window.__VERTESIA_RUNTIME_CONFIG__;\n    if (runtimeConfig?.authMode === 'central')\n        return runtimeConfig;\n    if (runtimeConfig?.authMode !== 'firebase')\n        return undefined;\n    const firebase = runtimeConfig.firebase;\n    if (!firebase?.apiKey || !firebase.authDomain || !firebase.projectId || !firebase.appId)\n        return undefined;\n    return runtimeConfig;\n}\nfunction buildRuntimeConfig(env) {\n    if (!env)\n        return undefined;\n    const value = (name) => (typeof env[name] === 'string' ? env[name].trim() : '');\n    const mode = value('VITE_AUTH_MODE');\n    if (mode && mode !== 'firebase' && mode !== 'central') {\n        throw new Error('VITE_AUTH_MODE must be firebase or central');\n    }\n    // Firebase build settings are only consumed after an explicit opt-in.\n    if (!mode)\n        return undefined;\n    if (mode === 'central')\n        return { authMode: 'central' };\n    const fields = {\n        apiKey: 'VITE_FIREBASE_API_KEY',\n        authDomain: 'VITE_FIREBASE_AUTH_DOMAIN',\n        projectId: 'VITE_FIREBASE_PROJECT_ID',\n        appId: 'VITE_FIREBASE_APP_ID',\n    };\n    const missing = Object.values(fields).filter((name) => !value(name));\n    if (missing.length) {\n        throw new Error(`Firebase authentication requires: ${missing.join(', ')}`);\n    }\n    return {\n        authMode: 'firebase',\n        firebase: {\n            apiKey: value(fields.apiKey),\n            authDomain: value(fields.authDomain),\n            projectId: value(fields.projectId),\n            appId: value(fields.appId),\n        },\n    };\n}\nexport class VertesiaEnvironment {\n    _props;\n    constructor(_props) {\n        this._props = _props;\n    }\n    init(props, buildEnv) {\n        // Host runtime configuration takes precedence over static deployment defaults.\n        const runtimeConfig = injectedRuntimeConfig() ?? buildRuntimeConfig(buildEnv);\n        const runtimeFirebase = runtimeConfig?.authMode === 'firebase' ? runtimeConfig.firebase : undefined;\n        this._props = props && runtimeFirebase && !props.firebase ? { ...props, firebase: runtimeFirebase } : props;\n        const authUrl = runtimeConfig?.authMode === 'central' ? runtimeConfig.authUrl?.trim() : undefined;\n        if (this._props && authUrl && isTrustedAuthBrokerUrl(authUrl, { allowLoopback: this._props.isLocalDev })) {\n            this._props = { ...this._props, endpoints: { ...this._props.endpoints, auth: authUrl } };\n        }\n        if (this._props && runtimeConfig?.authMode === 'central' && runtimeConfig.oauth) {\n            this._props = {\n                ...this._props,\n                oauth: runtimeConfig.oauth,\n                endpoints: { ...this._props.endpoints, ...runtimeConfig.endpoints },\n            };\n        }\n        if (this._props && runtimeConfig?.allowLegacyIframeAuth !== undefined) {\n            this._props = { ...this._props, allowLegacyIframeAuth: runtimeConfig.allowLegacyIframeAuth };\n        }\n        const tenantId = typeof buildEnv?.VITE_FIREBASE_TENANT_ID === 'string' ? buildEnv.VITE_FIREBASE_TENANT_ID.trim() : '';\n        if (this._props?.firebase && tenantId && !this._props.firebase.tenantId) {\n            this._props = { ...this._props, firebase: { ...this._props.firebase, tenantId } };\n        }\n        if (this._props && this._props.defaultAuthSelection === undefined && buildEnv) {\n            const accountId = typeof buildEnv.VITE_VERTESIA_ACCOUNT_ID === 'string'\n                ? buildEnv.VITE_VERTESIA_ACCOUNT_ID.trim() || undefined\n                : undefined;\n            const projectId = typeof buildEnv.VITE_VERTESIA_PROJECT_ID === 'string'\n                ? buildEnv.VITE_VERTESIA_PROJECT_ID.trim() || undefined\n                : undefined;\n            if (accountId || projectId)\n                this._props = { ...this._props, defaultAuthSelection: { accountId, projectId } };\n        }\n        if (runtimeConfig && typeof window !== 'undefined' && window.AUTH_MODE === undefined) {\n            window.AUTH_MODE = runtimeConfig.authMode;\n        }\n        return this;\n    }\n    prop(name) {\n        if (!this._props) {\n            throw new Error('VertesiaEnvironment was not initialized');\n        }\n        return this._props[name];\n    }\n    get version() {\n        return this.prop('version');\n    }\n    get commitTimestamp() {\n        return this._props?.commitTimestamp;\n    }\n    get sdkVersion() {\n        return this._props?.sdkVersion;\n    }\n    get name() {\n        return this.prop('name');\n    }\n    get type() {\n        return this.prop('type');\n    }\n    get isProd() {\n        return this.type === 'production' || this.type === 'preview';\n    }\n    get isDev() {\n        return !this.isProd;\n    }\n    get isLocalDev() {\n        return this.prop('isLocalDev');\n    }\n    get isDocker() {\n        return this.prop('isDocker');\n    }\n    get endpoints() {\n        return this.prop('endpoints');\n    }\n    get firebase() {\n        return this.prop('firebase');\n    }\n    get region() {\n        return this._props?.region;\n    }\n    /**\n     * @deprecated Use datadogRum and datadogLogs instead for more granular control. This will be removed in a future release. Is an alias for DatadogRUM\n     *\n     */\n    get datadog() {\n        return this.datadogRum;\n    }\n    get datadogRum() {\n        return this._props?.datadogRum ?? false;\n    }\n    get datadogLogs() {\n        return this._props?.datadogLogs ?? false;\n    }\n    get devAuthToken() {\n        return this._props?.devAuthToken;\n    }\n    get defaultAuthSelection() {\n        return this._props?.defaultAuthSelection;\n    }\n    get allowLegacyIframeAuth() {\n        return this._props?.allowLegacyIframeAuth ?? false;\n    }\n    get oauth() {\n        return this._props?.oauth;\n    }\n    get authTokenProvider() {\n        return this._props?.authTokenProvider;\n    }\n    get logger() {\n        return this._props?.logger ?? console;\n    }\n    /**\n     * Callback to notify the host app when the user logs in.\n     */\n    onLogin(token) {\n        this._props?.onLogin?.(token);\n    }\n    /**\n     * Callback to notify the host app when the user logs out\n     */\n    onLogout() {\n        this._props?.onLogout?.();\n    }\n}\nconst Env = new VertesiaEnvironment();\nexport { Env };\n//# sourceMappingURL=index.js.map"],"mappings":"AAAA,MAAM,EAAgB,mCAET,EAAQ,kCAER,EAAS,MAAM,EAAM,OAYrB,EAA4B,CACjC,OAAO,YAAY,EAAO,eAAe,EACzC,OAAO,IAAI,EAAM,aAAa,EAAO,eAAe,EACpD,OAAO,IAAI,EAAM,UAAU,EAAM,kBAAkB,CAC3D,EAwBa,EAAwB,CAC7B,OAAO,iCAAiC,EAAO,eAAe,EAC9D,OAAO,gBAAgB,EAAM,WAAW,EAAM,kBAAkB,CACxE,EACA,SAAgB,EAAmB,EAAU,CAOzC,OANI,IAAa,aAAe,EAAS,SAAS,YAAY,GAG1D,IAAa,OAAS,IAAa,QAC5B,GAEJ,EAAc,KAAK,CAAQ,CACtC,CACA,SAAgB,EAAkB,EAAU,CACxC,OAAO,EAAS,YAAY,CAAC,CAAC,QAAQ,MAAO,EAAE,CACnD,CACA,MAAa,EAA4B,CAAK,OAAO,WAAW,EAAO,eAAe,CAAC,EACvF,SAAgB,EAAuB,EAAO,EAAU,CAAC,EAAG,CACxD,GAAI,CACA,IAAM,EAAM,IAAI,IAAI,CAAK,EACnB,EAAW,EAAkB,EAAI,QAAQ,EAM/C,OALI,EAAI,UAAY,EAAI,UAAY,EAAI,QAAU,EAAI,MAAQ,EAAI,WAAa,IACpE,GACP,EAAQ,eAAiB,EAAmB,CAAQ,EAC7C,EAAI,WAAa,SAAW,EAAI,WAAa,SAEhD,EAAI,WAAa,UACrB,CAAC,EAAI,MACL,EAA0B,KAAM,GAAY,EAAQ,KAAK,CAAQ,CAAC,CAC1E,MACM,CACF,MAAO,EACX,CACJ,CC3EA,SAAS,GAAwB,CAC7B,GAAI,OAAO,OAAW,IAClB,OACJ,IAAM,EAAgB,OAAO,4BAC7B,GAAI,GAAe,WAAa,UAC5B,OAAO,EACX,GAAI,GAAe,WAAa,WAC5B,OACJ,IAAM,EAAW,EAAc,SAC3B,GAAC,GAAU,QAAW,EAAS,YAAe,EAAS,WAAc,EAAS,MAElF,OAAO,CACX,CACA,SAAS,EAAmB,EAAK,CAC7B,GAAI,CAAC,EACD,OACJ,IAAM,EAAS,GAAU,OAAO,EAAI,IAAU,SAAW,EAAI,EAAK,CAAC,KAAK,EAAI,GACtE,EAAO,EAAM,gBAAgB,EACnC,GAAI,GAAQ,IAAS,YAAc,IAAS,UACxC,MAAU,MAAM,4CAA4C,EAGhE,GAAI,CAAC,EACD,OACJ,GAAI,IAAS,UACT,MAAO,CAAE,SAAU,SAAU,EACjC,IAAM,EAAS,CACX,OAAQ,wBACR,WAAY,4BACZ,UAAW,2BACX,MAAO,sBACX,EACM,EAAU,OAAO,OAAO,CAAM,CAAC,CAAC,OAAQ,GAAS,CAAC,EAAM,CAAI,CAAC,EACnE,GAAI,EAAQ,OACR,MAAU,MAAM,qCAAqC,EAAQ,KAAK,IAAI,GAAG,EAE7E,MAAO,CACH,SAAU,WACV,SAAU,CACN,OAAQ,EAAM,EAAO,MAAM,EAC3B,WAAY,EAAM,EAAO,UAAU,EACnC,UAAW,EAAM,EAAO,SAAS,EACjC,MAAO,EAAM,EAAO,KAAK,CAC7B,CACJ,CACJ,CACA,IAAa,EAAb,KAAiC,CAC7B,OACA,YAAY,EAAQ,CAChB,KAAK,OAAS,CAClB,CACA,KAAK,EAAO,EAAU,CAElB,IAAM,EAAgB,EAAsB,GAAK,EAAmB,CAAQ,EACtE,EAAkB,GAAe,WAAa,WAAa,EAAc,SAAW,IAAA,GAC1F,KAAK,OAAS,GAAS,GAAmB,CAAC,EAAM,SAAW,CAAE,GAAG,EAAO,SAAU,CAAgB,EAAI,EACtG,IAAM,EAAU,GAAe,WAAa,UAAY,EAAc,SAAS,KAAK,EAAI,IAAA,GACpF,KAAK,QAAU,GAAW,EAAuB,EAAS,CAAE,cAAe,KAAK,OAAO,UAAW,CAAC,IACnG,KAAK,OAAS,CAAE,GAAG,KAAK,OAAQ,UAAW,CAAE,GAAG,KAAK,OAAO,UAAW,KAAM,CAAQ,CAAE,GAEvF,KAAK,QAAU,GAAe,WAAa,WAAa,EAAc,QACtE,KAAK,OAAS,CACV,GAAG,KAAK,OACR,MAAO,EAAc,MACrB,UAAW,CAAE,GAAG,KAAK,OAAO,UAAW,GAAG,EAAc,SAAU,CACtE,GAEA,KAAK,QAAU,GAAe,wBAA0B,IAAA,KACxD,KAAK,OAAS,CAAE,GAAG,KAAK,OAAQ,sBAAuB,EAAc,qBAAsB,GAE/F,IAAM,EAAW,OAAO,GAAU,yBAA4B,SAAW,EAAS,wBAAwB,KAAK,EAAI,GAInH,GAHI,KAAK,QAAQ,UAAY,GAAY,CAAC,KAAK,OAAO,SAAS,WAC3D,KAAK,OAAS,CAAE,GAAG,KAAK,OAAQ,SAAU,CAAE,GAAG,KAAK,OAAO,SAAU,UAAS,CAAE,GAEhF,KAAK,QAAU,KAAK,OAAO,uBAAyB,IAAA,IAAa,EAAU,CAC3E,IAAM,EAAY,OAAO,EAAS,0BAA6B,UACzD,EAAS,yBAAyB,KAAK,GACvC,IAAA,GACA,EAAY,OAAO,EAAS,0BAA6B,UACzD,EAAS,yBAAyB,KAAK,GACvC,IAAA,IACF,GAAa,KACb,KAAK,OAAS,CAAE,GAAG,KAAK,OAAQ,qBAAsB,CAAE,YAAW,WAAU,CAAE,EACvF,CAIA,OAHI,GAAiB,OAAO,OAAW,KAAe,OAAO,YAAc,IAAA,KACvE,OAAO,UAAY,EAAc,UAE9B,IACX,CACA,KAAK,EAAM,CACP,GAAI,CAAC,KAAK,OACN,MAAU,MAAM,yCAAyC,EAE7D,OAAO,KAAK,OAAO,EACvB,CACA,IAAI,SAAU,CACV,OAAO,KAAK,KAAK,SAAS,CAC9B,CACA,IAAI,iBAAkB,CAClB,OAAO,KAAK,QAAQ,eACxB,CACA,IAAI,YAAa,CACb,OAAO,KAAK,QAAQ,UACxB,CACA,IAAI,MAAO,CACP,OAAO,KAAK,KAAK,MAAM,CAC3B,CACA,IAAI,MAAO,CACP,OAAO,KAAK,KAAK,MAAM,CAC3B,CACA,IAAI,QAAS,CACT,OAAO,KAAK,OAAS,cAAgB,KAAK,OAAS,SACvD,CACA,IAAI,OAAQ,CACR,MAAO,CAAC,KAAK,MACjB,CACA,IAAI,YAAa,CACb,OAAO,KAAK,KAAK,YAAY,CACjC,CACA,IAAI,UAAW,CACX,OAAO,KAAK,KAAK,UAAU,CAC/B,CACA,IAAI,WAAY,CACZ,OAAO,KAAK,KAAK,WAAW,CAChC,CACA,IAAI,UAAW,CACX,OAAO,KAAK,KAAK,UAAU,CAC/B,CACA,IAAI,QAAS,CACT,OAAO,KAAK,QAAQ,MACxB,CAKA,IAAI,SAAU,CACV,OAAO,KAAK,UAChB,CACA,IAAI,YAAa,CACb,OAAO,KAAK,QAAQ,YAAc,EACtC,CACA,IAAI,aAAc,CACd,OAAO,KAAK,QAAQ,aAAe,EACvC,CACA,IAAI,cAAe,CACf,OAAO,KAAK,QAAQ,YACxB,CACA,IAAI,sBAAuB,CACvB,OAAO,KAAK,QAAQ,oBACxB,CACA,IAAI,uBAAwB,CACxB,OAAO,KAAK,QAAQ,uBAAyB,EACjD,CACA,IAAI,OAAQ,CACR,OAAO,KAAK,QAAQ,KACxB,CACA,IAAI,mBAAoB,CACpB,OAAO,KAAK,QAAQ,iBACxB,CACA,IAAI,QAAS,CACT,OAAO,KAAK,QAAQ,QAAU,OAClC,CAIA,QAAQ,EAAO,CACX,KAAK,QAAQ,UAAU,CAAK,CAChC,CAIA,UAAW,CACP,KAAK,QAAQ,WAAW,CAC5B,CACJ,EACA,MAAM,EAAM,IAAI"}