@ionite/core 0.0.23-beta.20260827.1 → 0.0.23-beta.20260829.1

package/dist/index.d.ts

@@ -2734,6 +2734,18 @@ type SSOConfig<
 	* @default 60
 	*/
 	rotationGraceSeconds?: number;
+	/**
+	* Fallback session window (seconds) used ONLY when the IdP's token response carries a
+	* `refresh_token` but no `refresh_expires_in`. An IdP-provided `refresh_expires_in` ALWAYS wins —
+	* this value never overrides it. `refresh_expires_in` is a Keycloak extension (standard OAuth
+	* token responses carry no refresh-token expiry field), so for IdPs that omit it this bounds the
+	* session cookie expiry and the session-store TTL. It re-arms on every successful refresh, so it
+	* behaves as an idle window, not a max session lifetime. Ops-governed (ConfigSource); no upper
+	* clamp (deliberate: windows longer than the default are honored); non-numeric or `< 1` values
+	* fall back to the default.
+	* @default 86400
+	*/
+	sessionWindowSeconds?: number;
 } & SSOHandlerConfig;
 type StateCookie = {
 	state: string;
@@ -5027,6 +5039,15 @@ declare function assertValidSubjectTypeScoping(entity: SubjectTypeScoping & {
 	id?: string;
 }): void;
 /**
+* Fail closed when a grant, edge, or check is missing a concrete {@link SubjectType}.
+*
+* Principal kind is never inferred. A JS caller or third-party store that omits `subjectType` must
+* throw rather than silently write into the `user:` bucket. Used by `accessRootId`, `expandRoot`,
+* and the SDK's own assignment-store / index implementations; exported so custom stores can
+* enforce the same contract before persisting.
+*/
+declare function assertRequiredSubjectType(value: unknown, label?: string): asserts value is SubjectType;
+/**
 * A granted "root" relationship between a principal and a catalog target. Roots are the source of
 * truth in the AccessAssignmentStore; the AccessIndex is materialized from roots + the catalog.
 */
@@ -5039,8 +5060,8 @@ type AccessChange<
 	/** Deterministic id derived from `subjectType:subject:targetType:target[:scope]`; assigned by stores/orchestration. */
 	id?: string;
 	subject: AccessRef<TUser>;
-	/** The principal kind this grant is for. Omitted is treated as `'user'`. */
-	subjectType?: SubjectType;
+	/** The principal kind this grant is for. Required; never inferred or defaulted. */
+	subjectType: SubjectType;
 	targetType: OaaAccessTargetType;
 	target: AccessRef<TGroup | TRole | TPermission>;
 	/** Specific resource ids this grant is scoped to (maps to OAA assignment `resources`). */
@@ -5088,16 +5109,16 @@ interface AccessAssignmentStore<TAccess = AccessChange> {
 		target: string;
 	}>): Promise<Map<string, TAccess[]>>;
 	/**
-	* List active granted roots held by a specific principal (optionally scoped to a `subjectType`,
-	* default `'user'`). Powers per-subject reconcile/rebuild (`ion.authz.reconcile`) and SCIM user
-	* delete (revoke the subject's roots before removing the record).
+	* List active granted roots held by a specific principal of a concrete `subjectType`. Powers
+	* per-subject reconcile/rebuild (`ion.authz.reconcile`) and SCIM user delete (revoke the
+	* subject's roots before removing the record).
 	*/
-	listBySubject(subject: string, subjectType?: SubjectType, options?: ListOptions): Promise<ListResult<TAccess>>;
+	listBySubject(subject: string, subjectType: SubjectType, options?: ListOptions): Promise<ListResult<TAccess>>;
 }
-/** A principal reference (id + optional kind) used by reconcile/orphan-sweep enumeration. */
+/** A principal reference (id + kind) used by reconcile/orphan-sweep enumeration. */
 type SubjectRef = {
 	subject: string;
-	subjectType?: SubjectType;
+	subjectType: SubjectType;
 };
 /** A single check target, optionally scoped to a resource. */
 type AccessCheckTarget<TTarget = Group | Role | Permission> = {
@@ -5112,8 +5133,8 @@ type AccessCheckTarget<TTarget = Group | Role | Permission> = {
 */
 type EffectiveEdge = {
 	subject: string;
-	/** The principal kind this edge belongs to (propagated from the root). Omitted is treated as `'user'`. */
-	subjectType?: SubjectType;
+	/** The principal kind this edge belongs to (propagated from the root). Required; never inferred. */
+	subjectType: SubjectType;
 	targetType: OaaAccessTargetType;
 	target: string;
 	resource?: string;
@@ -5129,12 +5150,12 @@ type EffectiveEdge = {
 * Revoking one role removes only its rows — overlapping permissions from the other role remain.
 */
 interface AccessIndex {
-	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
+	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
+	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
 	/** Replace the index rows attributed to `rootId` with `edges` (set-based materialization). */
 	materialize(rootId: string, edges: EffectiveEdge[]): Promise<void>;
 	/**
@@ -5146,8 +5167,9 @@ interface AccessIndex {
 	replaceSubject(subject: string, subjectType: SubjectType, edges: EffectiveEdge[]): Promise<void>;
 	/** Remove all index rows attributed to `rootId`. */
 	removeByRoot(rootId: string): Promise<void>;
-	/** Clear all index rows, or only those for a single subject (optionally scoped to a `subjectType`). */
-	clear(subject?: string, subjectType?: SubjectType): Promise<void>;
+	/** Clear all index rows, or only those for a single subject of a concrete `subjectType`. */
+	clear(): Promise<void>;
+	clear(subject: string, subjectType: SubjectType): Promise<void>;
 	/**
 	* Enumerate the distinct subjects that currently have any index rows. Powers full `reconcile`'s
 	* orphan sweep (clearing index subjects that have no live roots). Optional: indexes that cannot
@@ -5165,7 +5187,7 @@ interface AccessIndex {
 	*/
 	setSubjectDisabled?(subject: string, subjectType: SubjectType, disabled: boolean): Promise<void>;
 	/** Whether the subject-disabled marker is currently set (see {@link setSubjectDisabled}). */
-	isSubjectDisabled?(subject: string, subjectType?: SubjectType): Promise<boolean>;
+	isSubjectDisabled?(subject: string, subjectType: SubjectType): Promise<boolean>;
 }
 type OaaSyncOptions = {
 	mode?: "snapshot" | "incremental";
@@ -5323,12 +5345,12 @@ type Authz = {
 	};
 	/** The wired closure index powering `has*`, when the app provided one via stores. */
 	accessIndex?: AccessIndex;
-	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
+	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
+	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
 	/**
 	* Run a **full reconciliation**: re-derive the entire `AccessIndex` from `AccessAssignmentStore`
 	* roots + `AccessCatalogStore`. It enumerates the union of every assignment-store subject and every
@@ -5802,4 +5824,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { workloadTokenResponseSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, remoteConfigSecretType, readyCatalogEntry, parseKmsPoolDocument, parseKmsPoolControlDocument, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, mergeCodeCatalogEntity, materializeCodeCatalogEntity, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, getCodeCatalogEntity, generateULID, formatEcid, deprecateRetiredCodeCatalogRows, defineSecretType, defineCatalog, defaultSecretContentType, defaultLogger, deepEqualPlain, decodeUser, debugLogger, configTrustedClientGrants, claimsToUser, catalogEntityStore, buildTenantPath, assertValidSubjectTypeScoping, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsWriteOptions, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretTypeRegistryEntry, SecretTypeInput, SecretTypeDescriptor, SecretRequestSeverity, SecretLifecycleRequest, SecretHandle, SecretFormat, SecretEventName, SecretEventListener, SecretEvent, SecretContentTypeMismatchError, SecretContentType, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MirrorConfigLocator, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsRevokeKeyResult, KmsRevokeKeyRequest, KmsPoolSlot, KmsPoolListener, KmsPoolIssuer, KmsPoolDocument, KmsPoolControlDocument, KmsPoolConfig, KmsPool, KmsParkResult, KmsParkRequest, KmsParkReport, KmsParkDisposition, KmsKeyState, KmsKey, KmsIssuerEventName, KmsIssuerEventListener, KmsIssuerEvent, KmsIssuedKey, KmsConfig, KmsAllocationStrategy, KmsAllocationPolicy, KmsAddKeysResult, KmsAddKeysRequest, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InferSecretType, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaReconcileInput, IamDeltaMode, IamDeltaEmitter, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_USER_EXTENSION_URN, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DestinationReference, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_SECRET_MIME_TYPES, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogEntityKind, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, ApplicationValidators, Address, AccessStatus, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };
+export { workloadTokenResponseSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, remoteConfigSecretType, readyCatalogEntry, parseKmsPoolDocument, parseKmsPoolControlDocument, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, mergeCodeCatalogEntity, materializeCodeCatalogEntity, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, getCodeCatalogEntity, generateULID, formatEcid, deprecateRetiredCodeCatalogRows, defineSecretType, defineCatalog, defaultSecretContentType, defaultLogger, deepEqualPlain, decodeUser, debugLogger, configTrustedClientGrants, claimsToUser, catalogEntityStore, buildTenantPath, assertValidSubjectTypeScoping, assertRequiredSubjectType, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsWriteOptions, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretTypeRegistryEntry, SecretTypeInput, SecretTypeDescriptor, SecretRequestSeverity, SecretLifecycleRequest, SecretHandle, SecretFormat, SecretEventName, SecretEventListener, SecretEvent, SecretContentTypeMismatchError, SecretContentType, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MirrorConfigLocator, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsRevokeKeyResult, KmsRevokeKeyRequest, KmsPoolSlot, KmsPoolListener, KmsPoolIssuer, KmsPoolDocument, KmsPoolControlDocument, KmsPoolConfig, KmsPool, KmsParkResult, KmsParkRequest, KmsParkReport, KmsParkDisposition, KmsKeyState, KmsKey, KmsIssuerEventName, KmsIssuerEventListener, KmsIssuerEvent, KmsIssuedKey, KmsConfig, KmsAllocationStrategy, KmsAllocationPolicy, KmsAddKeysResult, KmsAddKeysRequest, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InferSecretType, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaReconcileInput, IamDeltaMode, IamDeltaEmitter, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_USER_EXTENSION_URN, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DestinationReference, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_SECRET_MIME_TYPES, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogEntityKind, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, ApplicationValidators, Address, AccessStatus, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };

package/dist/index.js

@@ -1 +1 @@
-import{A as T0,B as A0,C as O0,D as _0,E as k0,F as f0,G as v0,H as w0,I as g0,J as y0,K as h0,L as p0,M as c0,N as m0,O as d0,P as u0,Q as l0,R as o0,U as a0,V as n0,W as i0,X as s0,Y as r0,Z as t0,a as H0,b as G0,c as F0,d as q0,e as j0,f as U0,g as z0,h as Y0,i as K0,j as W0,k as C0,l as M0,m as D0,n as P0,o as x0,t as b0,u as R0,v as L0,w as S0,x as E0,y as I0,z as N0}from"./shared/core-15896f6h.js";var f="0.0.23-beta.20260827.1";class Y extends Error{kind;recoverable;code;status;path;sourceType;constructor(J,X){super(J,X.cause!==void 0?{cause:X.cause}:void 0);this.name="ConfigSourceError",this.kind=X.kind,this.recoverable=X.recoverable,this.code=X.code,this.status=X.status,this.path=X.path,this.sourceType=X.sourceType,Object.setPrototypeOf(this,Y.prototype)}}function v(J){return J instanceof Y}var F=["workload"],W={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:F,recommendedSubjectTypes:F},C={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:F,recommendedSubjectTypes:F},M={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:F,recommendedSubjectTypes:F},D={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:F,recommendedSubjectTypes:F},P={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:F},x={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:F,recommendedSubjectTypes:F},b={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:F,recommendedSubjectTypes:F},w=[W,C,M,D,P,x,b],g={"iam.read":{permission:W,subjectType:["workload"]},"iam.users.write":{permission:C,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:D,subjectType:["workload"]},"ciam.magic-link.create":{permission:P,subjectType:["workload","user"]},"authz.oaa.sync":{permission:x,subjectType:["workload"]},"tenant.manage":{permission:b,subjectType:["workload"]}};var y=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function S(J){if(J===null||typeof J!=="object")return J;let X={};for(let[Q,$]of Object.entries(J)){if(y.includes(Q)||Q==="validators"||Q==="setStores")continue;X[Q]=$!==null&&typeof $==="object"&&!Array.isArray($)&&Object.getPrototypeOf($)===Object.prototype?S($):$}return X}function h(J){return S(J)}function K(J,X){if(!J||typeof J!=="object"||Array.isArray(J))throw Error(`${X} must be an object.`);return J}function j(J,X){if(J===void 0)return;if(typeof J!=="string"||J.length===0||!Number.isFinite(Date.parse(J)))throw Error(`${X} must be a valid timestamp string.`);return J}function E(J,X,Q){if(!Array.isArray(J)||!Q.allowEmpty&&J.length===0)throw Error(`${X} keys must be ${Q.allowEmpty?"an":"a non-empty"} array.`);let $=new Set;return J.map((Z,B)=>{let V=K(Z,`${X} keys[${B}]`);if(typeof V.id!=="string"||V.id.length===0)throw Error(`${X} keys[${B}].id must be a non-empty string.`);if($.has(V.id))throw Error(`${X} contains duplicate key id "${V.id}".`);if($.add(V.id),!["pending","active","deprecated","rotated","revoked"].includes(String(V.state)))throw Error(`${X} keys[${B}].state is invalid.`);if(V.value!==void 0&&(typeof V.value!=="string"||V.value.length===0))throw Error(`${X} keys[${B}].value must be a non-empty string when present.`);let G=V.meta===void 0?void 0:K(V.meta,`${X} keys[${B}].meta`);return{id:V.id,state:V.state,...V.value===void 0?{}:{value:V.value},...V.notBefore===void 0?{}:{notBefore:j(V.notBefore,`${X} keys[${B}].notBefore`)},...V.notAfter===void 0?{}:{notAfter:j(V.notAfter,`${X} keys[${B}].notAfter`)},...V.createdAt===void 0?{}:{createdAt:j(V.createdAt,`${X} keys[${B}].createdAt`)},...V.activatedAt===void 0?{}:{activatedAt:j(V.activatedAt,`${X} keys[${B}].activatedAt`)},...V.deprecatedAt===void 0?{}:{deprecatedAt:j(V.deprecatedAt,`${X} keys[${B}].deprecatedAt`)},...V.rotatedAt===void 0?{}:{rotatedAt:j(V.rotatedAt,`${X} keys[${B}].rotatedAt`)},...V.revokedAt===void 0?{}:{revokedAt:j(V.revokedAt,`${X} keys[${B}].revokedAt`)},...G?{meta:{...G}}:{}}})}function p(J,X,Q){if(J===void 0)return;if(!Array.isArray(J))throw Error(`${Q} slots must be an array.`);let $=new Set,Z=J.map((B,V)=>{if(B===null)return null;if(typeof B!=="string"||B.length===0)throw Error(`${Q} slots[${V}] must be a non-empty key id or null.`);if($.has(B))throw Error(`${Q} slots contain duplicate key id "${B}".`);$.add(B);let G=X.find((H)=>H.id===B);if(!G)throw Error(`${Q} slot key "${B}" is not present in keys.`);if(G.state!=="active")throw Error(`${Q} slot key "${B}" must have state "active".`);if(!G.value)throw Error(`${Q} slot key "${B}" must include a value.`);return B});if(X.length===0&&Z.some((B)=>B!==null))throw Error(`${Q} slots must be omitted or all-null when keys is empty.`);return Z}function c(J){let Q=K(J,"KMS pool");if(Q.kind!=="kms")throw Error('KMS pool kind must be "kms".');let $=E(Q.keys,"KMS pool",{allowEmpty:!0}),Z=p(Q.slots,$,"KMS pool");return Z?{kind:"kms",slots:Z,keys:$}:{kind:"kms",keys:$}}function m(J){let Q=K(J,"KMS pool control document");if(Q.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:E(Q.keys,"KMS pool control document",{allowEmpty:!0})}}var I={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},d=I,u={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},l={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},o={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function a(J,X){if(typeof X!=="number"||X<=0)return J;return new Promise((Q,$)=>{let Z=setTimeout(()=>{$(Error(`Authz catalog entry did not become ready within ${X}ms`))},X);J.then(()=>{clearTimeout(Z),Q()},(B)=>{clearTimeout(Z),$(B)})})}function n(J,X){let Q=!1,$,Z=X.then(()=>{Q=!0},(V)=>{Q=!1,$=V}),B=J;return Object.defineProperty(B,"ready",{enumerable:!1,configurable:!0,value:(V)=>a(Z.then(()=>{if(!Q)throw $}),V)}),Object.defineProperty(B,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),B}var R=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function L(J){if(!J.id.trim())throw Error("defineSecretType: id is required");let X=J.mimeType?.trim()||R[J.format],Q=Object.freeze({id:J.id,...J.label?{label:J.label}:{},format:J.format,mimeType:X,...J.schemaUrl?{schemaUrl:J.schemaUrl}:{},typeId:J.id});return Object.freeze({id:J.id,...J.label?{label:J.label}:{},format:J.format,mimeType:X,...J.schemaUrl?{schemaUrl:J.schemaUrl}:{},...J.schema?{schema:J.schema}:{},toRegistryEntry:()=>Q})}function i(J="jsonc"){return{format:J,mimeType:R[J],typeId:J}}class N extends Error{expected;received;constructor(J,X){super(`Secret content type mismatch: expected "${J.mimeType}" (${J.format}) but received "${X.mimeType}" (${X.format})`);this.name="SecretContentTypeMismatchError",this.expected=J,this.received=X}}var s=L({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var A={beforeTenantSegments:["ui"]},O={beforeTenantSegments:["api"]};function T(J){return(J??[]).map((X)=>X.trim()).filter(Boolean)}function r(J){let X=J.trim();if(!X)return"/";let Q=X.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function _(J){return r(J).split("/").filter(Boolean)}function z(J){return{beforeTenantSegments:T(J?.beforeTenantSegments),afterTenantSegments:T(J?.afterTenantSegments)}}function t(J){return{type:"path",ui:z(J?.ui??A),api:z(J?.api??O)}}function e(J,X){let Q=z(X),$=Q.beforeTenantSegments??[],Z=Q.afterTenantSegments??[],B=_(J),V=$.length+1+Z.length;if(B.length<V)return null;for(let q=0;q<$.length;q++)if(B[q]!==$[q])return null;let G=$.length,H=B[G];if(!H)return null;for(let q=0;q<Z.length;q++)if(B[G+1+q]!==Z[q])return null;let U=B.slice(G+1+Z.length);return{id:decodeURIComponent(H),restSegments:U,restPath:U.length>0?`/${U.join("/")}`:"/"}}function J0(J,X="/",Q){let $=z(Q),Z=$.beforeTenantSegments??[],B=$.afterTenantSegments??[],V=_(X),G=[...Z,encodeURIComponent(J),...B,...V];return G.length>0?`/${G.join("/")}`:"/"}function Q0(J){return{"~standard":{version:1,vendor:J,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,$=[],Z={...Q},B=["iss","sub"];for(let H of B)if(H in Q){if(typeof Q[H]!=="string")$.push({message:`${H} must be a string`,path:[H]})}else $.push({message:`${H} is required`,path:[H]});if("aud"in Q&&Q.aud!==void 0){let H=Q.aud;if(typeof H!=="string"&&!Array.isArray(H))$.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(H)&&!H.every((U)=>typeof U==="string"))$.push({message:"aud array must contain only strings",path:["aud"]})}let V=["jti","scope"];for(let H of V)if(H in Q&&Q[H]!==void 0){if(typeof Q[H]!=="string")$.push({message:`${H} must be a string`,path:[H]})}let G=["exp","iat"];for(let H of G)if(H in Q){if(typeof Q[H]!=="number")$.push({message:`${H} must be a number`,path:[H]})}else $.push({message:`${H} is required`,path:[H]});if($.length>0)return{issues:$};return{value:Z}}}}}function X0(J){return{"~standard":{version:1,vendor:J,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,$=[],Z={};if("access_token"in Q)if(typeof Q.access_token==="string")Z.access_token=Q.access_token;else $.push({message:"access_token must be a string",path:["access_token"]});else $.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")Z.token_type=Q.token_type;else $.push({message:"token_type must be a string",path:["token_type"]});else $.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)Z.scope=Q.scope;else $.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)Z.refresh_token=Q.refresh_token;else $.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)Z.expires=Q.expires;else $.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)Z.expires_in=Q.expires_in;else $.push({message:"expires_in must be a number",path:["expires_in"]});if($.length>0)return{issues:$};return{value:Z}}}}}function $0(J){let X=new Uint8Array(J);return crypto.getRandomValues(X),X}function B0(J){let X="",Q=$0(J);for(let $=0;$<J;$++){let Z=Q[$]%32;X+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)}return X}function V0(J,X){let Q="";for(let $=X;$>0;$--){let Z=J%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)+Q,J=Math.floor(J/32)}return Q}function Z0(J){let X=Date.now(),Q=V0(X,10),$=B0(16);return`${J??""}${Q}${$}`}export{X0 as workloadTokenResponseSchema,O0 as withValidate,o as warnLogger,p0 as waitOn,f as version,k0 as validationFailureResponse,r0 as userSchema,D0 as unionCatalogRead,H0 as trustedClientPermissionsForPrincipal,g0 as trimTrailingSlash,T0 as tokenResponseSchema,U0 as toCodeCatalog,v0 as stripJsonComments,h0 as stableConfigHash,I as silentLogger,h as serializeConfig,s as remoteConfigSecretType,n as readyCatalogEntry,c as parseKmsPoolDocument,m as parseKmsPoolControlDocument,w0 as parseJsonc,E0 as parseEcid,N0 as oidcCallbackSchema,t as normalizeTenantRoutingStrategy,z as normalizeTenantPathNamespace,_0 as must,f0 as mergeConfig,W0 as mergeCodeCatalogEntity,C0 as materializeCodeCatalogEntity,e as matchTenantPath,q0 as listGenerator,F0 as list,Q0 as jwtAssertionClaimsSchema,u0 as isStoreConflictError,L0 as isEcid,v as isConfigSourceError,o0 as isConfigLocator,j0 as isCodeCatalog,l as infoLogger,A0 as idTokenClaimsSchema,t0 as groupResourceSchema,Y0 as getCodeCatalogEntity,Z0 as generateULID,S0 as formatEcid,M0 as deprecateRetiredCodeCatalogRows,L as defineSecretType,z0 as defineCatalog,i as defaultSecretContentType,d as defaultLogger,y0 as deepEqualPlain,m0 as decodeUser,u as debugLogger,G0 as configTrustedClientGrants,c0 as claimsToUser,K0 as catalogEntityStore,J0 as buildTenantPath,i0 as assertValidSubjectTypeScoping,I0 as assertEcid,x0 as accessRootId,P0 as accessRefId,d0 as StoreConflictError,N as SecretContentTypeMismatchError,n0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,l0 as IoniteError,b as ION_TENANT_MANAGE,w as ION_SDK_PERMISSIONS,s0 as ION_SCIM_USER_EXTENSION_URN,C as ION_IAM_USERS_WRITE,W as ION_IAM_READ,M as ION_IAM_GROUPS_WRITE,g as ION_ENDPOINT_PERMISSIONS,P as ION_CIAM_MAGIC_LINK_CREATE,D as ION_CAPABILITIEZ_READ,x as ION_AUTHZ_OAA_SYNC,a0 as ION_AUTHZ_GROUP_SCHEMA,R0 as EcidFormatError,b0 as ECID_SCHEME,A as DEFAULT_TENANT_UI_NAMESPACE,O as DEFAULT_TENANT_API_NAMESPACE,R as DEFAULT_SECRET_MIME_TYPES,Y as ConfigSourceError};
+import{A as T0,B as A0,C as O0,D as _0,E as k0,F as f0,G as v0,H as w0,I as g0,J as y0,K as h0,L as p0,M as c0,N as m0,O as d0,P as u0,Q as l0,R as o0,S as a0,T as n0,U as i0,V as s0,Y as r0,Z as t0,_ as e0,a as H0,b as G0,c as F0,d as q0,e as j0,f as U0,g as z0,h as Y0,i as K0,j as W0,k as C0,l as M0,m as D0,n as P0,o as x0,p as b0,q as R0,r as L0,s as S0,x as E0,y as I0,z as N0}from"./shared/core-fm0d5w83.js";var f="0.0.23-beta.20260829.1";class Y extends Error{kind;recoverable;code;status;path;sourceType;constructor(J,X){super(J,X.cause!==void 0?{cause:X.cause}:void 0);this.name="ConfigSourceError",this.kind=X.kind,this.recoverable=X.recoverable,this.code=X.code,this.status=X.status,this.path=X.path,this.sourceType=X.sourceType,Object.setPrototypeOf(this,Y.prototype)}}function v(J){return J instanceof Y}var F=["workload"],W={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:F,recommendedSubjectTypes:F},C={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:F,recommendedSubjectTypes:F},M={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:F,recommendedSubjectTypes:F},D={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:F,recommendedSubjectTypes:F},P={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:F},x={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:F,recommendedSubjectTypes:F},b={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:F,recommendedSubjectTypes:F},w=[W,C,M,D,P,x,b],g={"iam.read":{permission:W,subjectType:["workload"]},"iam.users.write":{permission:C,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:D,subjectType:["workload"]},"ciam.magic-link.create":{permission:P,subjectType:["workload","user"]},"authz.oaa.sync":{permission:x,subjectType:["workload"]},"tenant.manage":{permission:b,subjectType:["workload"]}};var y=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function S(J){if(J===null||typeof J!=="object")return J;let X={};for(let[Q,$]of Object.entries(J)){if(y.includes(Q)||Q==="validators"||Q==="setStores")continue;X[Q]=$!==null&&typeof $==="object"&&!Array.isArray($)&&Object.getPrototypeOf($)===Object.prototype?S($):$}return X}function h(J){return S(J)}function K(J,X){if(!J||typeof J!=="object"||Array.isArray(J))throw Error(`${X} must be an object.`);return J}function j(J,X){if(J===void 0)return;if(typeof J!=="string"||J.length===0||!Number.isFinite(Date.parse(J)))throw Error(`${X} must be a valid timestamp string.`);return J}function E(J,X,Q){if(!Array.isArray(J)||!Q.allowEmpty&&J.length===0)throw Error(`${X} keys must be ${Q.allowEmpty?"an":"a non-empty"} array.`);let $=new Set;return J.map((Z,B)=>{let V=K(Z,`${X} keys[${B}]`);if(typeof V.id!=="string"||V.id.length===0)throw Error(`${X} keys[${B}].id must be a non-empty string.`);if($.has(V.id))throw Error(`${X} contains duplicate key id "${V.id}".`);if($.add(V.id),!["pending","active","deprecated","rotated","revoked"].includes(String(V.state)))throw Error(`${X} keys[${B}].state is invalid.`);if(V.value!==void 0&&(typeof V.value!=="string"||V.value.length===0))throw Error(`${X} keys[${B}].value must be a non-empty string when present.`);let G=V.meta===void 0?void 0:K(V.meta,`${X} keys[${B}].meta`);return{id:V.id,state:V.state,...V.value===void 0?{}:{value:V.value},...V.notBefore===void 0?{}:{notBefore:j(V.notBefore,`${X} keys[${B}].notBefore`)},...V.notAfter===void 0?{}:{notAfter:j(V.notAfter,`${X} keys[${B}].notAfter`)},...V.createdAt===void 0?{}:{createdAt:j(V.createdAt,`${X} keys[${B}].createdAt`)},...V.activatedAt===void 0?{}:{activatedAt:j(V.activatedAt,`${X} keys[${B}].activatedAt`)},...V.deprecatedAt===void 0?{}:{deprecatedAt:j(V.deprecatedAt,`${X} keys[${B}].deprecatedAt`)},...V.rotatedAt===void 0?{}:{rotatedAt:j(V.rotatedAt,`${X} keys[${B}].rotatedAt`)},...V.revokedAt===void 0?{}:{revokedAt:j(V.revokedAt,`${X} keys[${B}].revokedAt`)},...G?{meta:{...G}}:{}}})}function p(J,X,Q){if(J===void 0)return;if(!Array.isArray(J))throw Error(`${Q} slots must be an array.`);let $=new Set,Z=J.map((B,V)=>{if(B===null)return null;if(typeof B!=="string"||B.length===0)throw Error(`${Q} slots[${V}] must be a non-empty key id or null.`);if($.has(B))throw Error(`${Q} slots contain duplicate key id "${B}".`);$.add(B);let G=X.find((H)=>H.id===B);if(!G)throw Error(`${Q} slot key "${B}" is not present in keys.`);if(G.state!=="active")throw Error(`${Q} slot key "${B}" must have state "active".`);if(!G.value)throw Error(`${Q} slot key "${B}" must include a value.`);return B});if(X.length===0&&Z.some((B)=>B!==null))throw Error(`${Q} slots must be omitted or all-null when keys is empty.`);return Z}function c(J){let Q=K(J,"KMS pool");if(Q.kind!=="kms")throw Error('KMS pool kind must be "kms".');let $=E(Q.keys,"KMS pool",{allowEmpty:!0}),Z=p(Q.slots,$,"KMS pool");return Z?{kind:"kms",slots:Z,keys:$}:{kind:"kms",keys:$}}function m(J){let Q=K(J,"KMS pool control document");if(Q.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:E(Q.keys,"KMS pool control document",{allowEmpty:!0})}}var I={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},d=I,u={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},l={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},o={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function a(J,X){if(typeof X!=="number"||X<=0)return J;return new Promise((Q,$)=>{let Z=setTimeout(()=>{$(Error(`Authz catalog entry did not become ready within ${X}ms`))},X);J.then(()=>{clearTimeout(Z),Q()},(B)=>{clearTimeout(Z),$(B)})})}function n(J,X){let Q=!1,$,Z=X.then(()=>{Q=!0},(V)=>{Q=!1,$=V}),B=J;return Object.defineProperty(B,"ready",{enumerable:!1,configurable:!0,value:(V)=>a(Z.then(()=>{if(!Q)throw $}),V)}),Object.defineProperty(B,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),B}var R=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function L(J){if(!J.id.trim())throw Error("defineSecretType: id is required");let X=J.mimeType?.trim()||R[J.format],Q=Object.freeze({id:J.id,...J.label?{label:J.label}:{},format:J.format,mimeType:X,...J.schemaUrl?{schemaUrl:J.schemaUrl}:{},typeId:J.id});return Object.freeze({id:J.id,...J.label?{label:J.label}:{},format:J.format,mimeType:X,...J.schemaUrl?{schemaUrl:J.schemaUrl}:{},...J.schema?{schema:J.schema}:{},toRegistryEntry:()=>Q})}function i(J="jsonc"){return{format:J,mimeType:R[J],typeId:J}}class N extends Error{expected;received;constructor(J,X){super(`Secret content type mismatch: expected "${J.mimeType}" (${J.format}) but received "${X.mimeType}" (${X.format})`);this.name="SecretContentTypeMismatchError",this.expected=J,this.received=X}}var s=L({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var A={beforeTenantSegments:["ui"]},O={beforeTenantSegments:["api"]};function T(J){return(J??[]).map((X)=>X.trim()).filter(Boolean)}function r(J){let X=J.trim();if(!X)return"/";let Q=X.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function _(J){return r(J).split("/").filter(Boolean)}function z(J){return{beforeTenantSegments:T(J?.beforeTenantSegments),afterTenantSegments:T(J?.afterTenantSegments)}}function t(J){return{type:"path",ui:z(J?.ui??A),api:z(J?.api??O)}}function e(J,X){let Q=z(X),$=Q.beforeTenantSegments??[],Z=Q.afterTenantSegments??[],B=_(J),V=$.length+1+Z.length;if(B.length<V)return null;for(let q=0;q<$.length;q++)if(B[q]!==$[q])return null;let G=$.length,H=B[G];if(!H)return null;for(let q=0;q<Z.length;q++)if(B[G+1+q]!==Z[q])return null;let U=B.slice(G+1+Z.length);return{id:decodeURIComponent(H),restSegments:U,restPath:U.length>0?`/${U.join("/")}`:"/"}}function J0(J,X="/",Q){let $=z(Q),Z=$.beforeTenantSegments??[],B=$.afterTenantSegments??[],V=_(X),G=[...Z,encodeURIComponent(J),...B,...V];return G.length>0?`/${G.join("/")}`:"/"}function Q0(J){return{"~standard":{version:1,vendor:J,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,$=[],Z={...Q},B=["iss","sub"];for(let H of B)if(H in Q){if(typeof Q[H]!=="string")$.push({message:`${H} must be a string`,path:[H]})}else $.push({message:`${H} is required`,path:[H]});if("aud"in Q&&Q.aud!==void 0){let H=Q.aud;if(typeof H!=="string"&&!Array.isArray(H))$.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(H)&&!H.every((U)=>typeof U==="string"))$.push({message:"aud array must contain only strings",path:["aud"]})}let V=["jti","scope"];for(let H of V)if(H in Q&&Q[H]!==void 0){if(typeof Q[H]!=="string")$.push({message:`${H} must be a string`,path:[H]})}let G=["exp","iat"];for(let H of G)if(H in Q){if(typeof Q[H]!=="number")$.push({message:`${H} must be a number`,path:[H]})}else $.push({message:`${H} is required`,path:[H]});if($.length>0)return{issues:$};return{value:Z}}}}}function X0(J){return{"~standard":{version:1,vendor:J,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,$=[],Z={};if("access_token"in Q)if(typeof Q.access_token==="string")Z.access_token=Q.access_token;else $.push({message:"access_token must be a string",path:["access_token"]});else $.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")Z.token_type=Q.token_type;else $.push({message:"token_type must be a string",path:["token_type"]});else $.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)Z.scope=Q.scope;else $.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)Z.refresh_token=Q.refresh_token;else $.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)Z.expires=Q.expires;else $.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)Z.expires_in=Q.expires_in;else $.push({message:"expires_in must be a number",path:["expires_in"]});if($.length>0)return{issues:$};return{value:Z}}}}}function $0(J){let X=new Uint8Array(J);return crypto.getRandomValues(X),X}function B0(J){let X="",Q=$0(J);for(let $=0;$<J;$++){let Z=Q[$]%32;X+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)}return X}function V0(J,X){let Q="";for(let $=X;$>0;$--){let Z=J%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)+Q,J=Math.floor(J/32)}return Q}function Z0(J){let X=Date.now(),Q=V0(X,10),$=B0(16);return`${J??""}${Q}${$}`}export{X0 as workloadTokenResponseSchema,v0 as withValidate,o as warnLogger,u0 as waitOn,f as version,g0 as validationFailureResponse,t0 as userSchema,D0 as unionCatalogRead,H0 as trustedClientPermissionsForPrincipal,c0 as trimTrailingSlash,k0 as tokenResponseSchema,U0 as toCodeCatalog,h0 as stripJsonComments,d0 as stableConfigHash,I as silentLogger,h as serializeConfig,s as remoteConfigSecretType,n as readyCatalogEntry,c as parseKmsPoolDocument,m as parseKmsPoolControlDocument,p0 as parseJsonc,A0 as parseEcid,_0 as oidcCallbackSchema,t as normalizeTenantRoutingStrategy,z as normalizeTenantPathNamespace,w0 as must,y0 as mergeConfig,W0 as mergeCodeCatalogEntity,C0 as materializeCodeCatalogEntity,e as matchTenantPath,q0 as listGenerator,F0 as list,Q0 as jwtAssertionClaimsSchema,n0 as isStoreConflictError,N0 as isEcid,v as isConfigSourceError,s0 as isConfigLocator,j0 as isCodeCatalog,l as infoLogger,f0 as idTokenClaimsSchema,e0 as groupResourceSchema,Y0 as getCodeCatalogEntity,Z0 as generateULID,T0 as formatEcid,M0 as deprecateRetiredCodeCatalogRows,L as defineSecretType,z0 as defineCatalog,i as defaultSecretContentType,d as defaultLogger,m0 as deepEqualPlain,o0 as decodeUser,u as debugLogger,G0 as configTrustedClientGrants,l0 as claimsToUser,K0 as catalogEntityStore,J0 as buildTenantPath,b0 as assertValidSubjectTypeScoping,R0 as assertRequiredSubjectType,O0 as assertEcid,S0 as accessRootId,L0 as accessRefId,a0 as StoreConflictError,N as SecretContentTypeMismatchError,x0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,i0 as IoniteError,b as ION_TENANT_MANAGE,w as ION_SDK_PERMISSIONS,r0 as ION_SCIM_USER_EXTENSION_URN,C as ION_IAM_USERS_WRITE,W as ION_IAM_READ,M as ION_IAM_GROUPS_WRITE,g as ION_ENDPOINT_PERMISSIONS,P as ION_CIAM_MAGIC_LINK_CREATE,D as ION_CAPABILITIEZ_READ,x as ION_AUTHZ_OAA_SYNC,P0 as ION_AUTHZ_GROUP_SCHEMA,I0 as EcidFormatError,E0 as ECID_SCHEME,A as DEFAULT_TENANT_UI_NAMESPACE,O as DEFAULT_TENANT_API_NAMESPACE,R as DEFAULT_SECRET_MIME_TYPES,Y as ConfigSourceError};

package/dist/server.d.ts

@@ -2648,6 +2648,18 @@ type SSOConfig<
 	* @default 60
 	*/
 	rotationGraceSeconds?: number;
+	/**
+	* Fallback session window (seconds) used ONLY when the IdP's token response carries a
+	* `refresh_token` but no `refresh_expires_in`. An IdP-provided `refresh_expires_in` ALWAYS wins —
+	* this value never overrides it. `refresh_expires_in` is a Keycloak extension (standard OAuth
+	* token responses carry no refresh-token expiry field), so for IdPs that omit it this bounds the
+	* session cookie expiry and the session-store TTL. It re-arms on every successful refresh, so it
+	* behaves as an idle window, not a max session lifetime. Ops-governed (ConfigSource); no upper
+	* clamp (deliberate: windows longer than the default are honored); non-numeric or `< 1` values
+	* fall back to the default.
+	* @default 86400
+	*/
+	sessionWindowSeconds?: number;
 } & SSOHandlerConfig;
 type StateCookie = {
 	state: string;
@@ -4519,8 +4531,8 @@ type AccessChange<
 	/** Deterministic id derived from `subjectType:subject:targetType:target[:scope]`; assigned by stores/orchestration. */
 	id?: string;
 	subject: AccessRef<TUser>;
-	/** The principal kind this grant is for. Omitted is treated as `'user'`. */
-	subjectType?: SubjectType;
+	/** The principal kind this grant is for. Required; never inferred or defaulted. */
+	subjectType: SubjectType;
 	targetType: OaaAccessTargetType;
 	target: AccessRef<TGroup | TRole | TPermission>;
 	/** Specific resource ids this grant is scoped to (maps to OAA assignment `resources`). */
@@ -4568,16 +4580,16 @@ interface AccessAssignmentStore<TAccess = AccessChange> {
 		target: string;
 	}>): Promise<Map<string, TAccess[]>>;
 	/**
-	* List active granted roots held by a specific principal (optionally scoped to a `subjectType`,
-	* default `'user'`). Powers per-subject reconcile/rebuild (`ion.authz.reconcile`) and SCIM user
-	* delete (revoke the subject's roots before removing the record).
+	* List active granted roots held by a specific principal of a concrete `subjectType`. Powers
+	* per-subject reconcile/rebuild (`ion.authz.reconcile`) and SCIM user delete (revoke the
+	* subject's roots before removing the record).
 	*/
-	listBySubject(subject: string, subjectType?: SubjectType, options?: ListOptions): Promise<ListResult<TAccess>>;
+	listBySubject(subject: string, subjectType: SubjectType, options?: ListOptions): Promise<ListResult<TAccess>>;
 }
-/** A principal reference (id + optional kind) used by reconcile/orphan-sweep enumeration. */
+/** A principal reference (id + kind) used by reconcile/orphan-sweep enumeration. */
 type SubjectRef = {
 	subject: string;
-	subjectType?: SubjectType;
+	subjectType: SubjectType;
 };
 /** A single check target, optionally scoped to a resource. */
 type AccessCheckTarget<TTarget = Group | Role | Permission> = {
@@ -4592,8 +4604,8 @@ type AccessCheckTarget<TTarget = Group | Role | Permission> = {
 */
 type EffectiveEdge = {
 	subject: string;
-	/** The principal kind this edge belongs to (propagated from the root). Omitted is treated as `'user'`. */
-	subjectType?: SubjectType;
+	/** The principal kind this edge belongs to (propagated from the root). Required; never inferred. */
+	subjectType: SubjectType;
 	targetType: OaaAccessTargetType;
 	target: string;
 	resource?: string;
@@ -4609,12 +4621,12 @@ type EffectiveEdge = {
 * Revoking one role removes only its rows — overlapping permissions from the other role remain.
 */
 interface AccessIndex {
-	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
+	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
+	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
 	/** Replace the index rows attributed to `rootId` with `edges` (set-based materialization). */
 	materialize(rootId: string, edges: EffectiveEdge[]): Promise<void>;
 	/**
@@ -4626,8 +4638,9 @@ interface AccessIndex {
 	replaceSubject(subject: string, subjectType: SubjectType, edges: EffectiveEdge[]): Promise<void>;
 	/** Remove all index rows attributed to `rootId`. */
 	removeByRoot(rootId: string): Promise<void>;
-	/** Clear all index rows, or only those for a single subject (optionally scoped to a `subjectType`). */
-	clear(subject?: string, subjectType?: SubjectType): Promise<void>;
+	/** Clear all index rows, or only those for a single subject of a concrete `subjectType`. */
+	clear(): Promise<void>;
+	clear(subject: string, subjectType: SubjectType): Promise<void>;
 	/**
 	* Enumerate the distinct subjects that currently have any index rows. Powers full `reconcile`'s
 	* orphan sweep (clearing index subjects that have no live roots). Optional: indexes that cannot
@@ -4645,7 +4658,7 @@ interface AccessIndex {
 	*/
 	setSubjectDisabled?(subject: string, subjectType: SubjectType, disabled: boolean): Promise<void>;
 	/** Whether the subject-disabled marker is currently set (see {@link setSubjectDisabled}). */
-	isSubjectDisabled?(subject: string, subjectType?: SubjectType): Promise<boolean>;
+	isSubjectDisabled?(subject: string, subjectType: SubjectType): Promise<boolean>;
 }
 type OaaSyncOptions = {
 	mode?: "snapshot" | "incremental";
@@ -4803,12 +4816,12 @@ type Authz = {
 	};
 	/** The wired closure index powering `has*`, when the app provided one via stores. */
 	accessIndex?: AccessIndex;
-	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource?: AccessRef<Resource>, subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
-	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType?: SubjectType): Promise<AuthzDecision>;
+	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasGroup(subject: AccessRef<BaseUser>, group: AccessRef<Group>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasRole(subject: AccessRef<BaseUser>, role: AccessRef<Role>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasPermission(subject: AccessRef<BaseUser>, permission: AccessRef<Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
+	hasAny(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
+	hasAll(subject: AccessRef<BaseUser>, targets: AccessCheckTarget[], subjectType: SubjectType): Promise<AuthzDecision>;
 	/**
 	* Run a **full reconciliation**: re-derive the entire `AccessIndex` from `AccessAssignmentStore`
 	* roots + `AccessCatalogStore`. It enumerates the union of every assignment-store subject and every