@ionite/core 0.0.24-beta.20260910.1 → 0.0.24-beta.20260915.2

package/dist/index.d.ts

@@ -91,6 +91,11 @@ interface Logger {
 	error(message?: unknown, ...optionalParams: unknown[]): void;
 }
 /**
+* Renders a structured logger call as one greppable line while leaving the source fields separate
+* for telemetry exporters.
+*/
+declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
+/**
 * No-op implementation — does nothing for any log level
 */
 declare const silentLogger: Logger;
@@ -111,6 +116,10 @@ declare const infoLogger: Logger;
 * Logger that logs messages warn and error to the console.
 */
 declare const warnLogger: Logger;
+/**
+* Human-readable single-line console logger for local application output.
+*/
+declare const prettyLogger: Logger;
 /** Synchronous, in-memory read surface for one code catalog entity kind. */
 type CodeCatalogNamespace<TEntity> = {
 	get(id: string): TEntity | undefined;
@@ -161,14 +170,20 @@ declare function getCodeCatalogEntity(code: CodeCatalog | undefined, id: string)
 /** Return the entity namespace for one catalog kind. */
 declare function catalogEntityStore<TEntity extends Group | Role | Permission>(catalog: AccessCatalogStore, kind: CatalogEntityKind): EntityStore<TEntity>;
 /**
-* Merge a materialized row with its code template. The row owns presentation, receipts, lifecycle,
-* and other runtime metadata; code owns ids, subject scoping, and graph/resource structure.
+* Merge a materialized row with its code template. The row owns receipts, lifecycle, other runtime
+* metadata, and any IAM-authored presentation overrides (`displayName`, `riskLevel`) — a stored
+* value means IAM expressed an opinion, an absent one keeps following code edits. Code owns ids,
+* subject scoping, and graph/resource structure.
 */
 declare function mergeCodeCatalogEntity<TEntity extends Group | Role | Permission>(kind: CatalogEntityKind, code: TEntity, stored: TEntity): TEntity;
 /**
 * Insert a code template into the runtime catalog only when no row exists. Existing rows are never
-* rewritten, preserving IAM-renamed presentation and receipts. `insertIfAbsent` closes the race
+* rewritten, preserving IAM-authored presentation and receipts. `insertIfAbsent` closes the race
 * between the initial read and insert.
+*
+* Advisory presentation (`riskLevel`, `displayName`) is deliberately NOT persisted: on the durable
+* row an absent value means "no IAM override", so the merged read keeps following later code edits.
+* Snapshotting the seed here would freeze it — indistinguishable from an IAM-authored value.
 */
 declare function materializeCodeCatalogEntity<TEntity extends Group | Role | Permission>(kind: CatalogEntityKind, code: TEntity, store: EntityStore<TEntity>): Promise<TEntity>;
 /**
@@ -2712,6 +2727,8 @@ type OtelProtocol = "http/protobuf" | "http/json";
 type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
 type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
 type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
+/** Local console mirror policy: disable it or set its minimum emitted severity. */
+type OtelConsoleMode = "off" | OtelLogLevel;
 type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
 type OtelAttributes = Record<string, OtelAttributeValue>;
 type OtelSignalConfig = {
@@ -2758,6 +2775,8 @@ type OtelConfig = {
 	deploymentEnvironment?: string;
 	resourceAttributes?: OtelAttributes;
 	levels?: OtelLevels;
+	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
+	console?: OtelConsoleMode;
 	traces?: boolean | OtelSignalConfig;
 	metrics?: boolean | OtelMetricsSignalConfig;
 	logs?: boolean | OtelSignalConfig;
@@ -2769,7 +2788,8 @@ type OtelConfig = {
 type FrameworkOtelConfig = {
 	levels?: OtelLevels;
 	instrument?: unknown[];
-	console?: boolean | ((record: OtelLogRecord) => void);
+	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
+	console?: (record: OtelLogRecord) => void;
 	spanProcessors?: unknown[];
 	metricReaders?: unknown[];
 	logRecordProcessors?: unknown[];
@@ -5040,9 +5060,20 @@ type SubjectTypeScoping = {
 	/** AppDev advisory default principal kinds; must be a subset of `assignableSubjectTypes` (read-only to IAM). */
 	recommendedSubjectTypes?: SubjectType[];
 };
+/** Suggested IAM governance labels for an entitlement's advisory risk classification. */
+declare const CANONICAL_RISK_LEVELS: readonly ["basic", "elevated", "privileged", "admin"];
+/** Canonical IAM governance suggestions with autocomplete, while allowing AppDev-defined labels. */
+type RiskLevel = (typeof CANONICAL_RISK_LEVELS)[number] | (string & {});
+/** Risk projected to IAM when an entitlement does not declare or store an explicit classification. */
+declare const DEFAULT_RISK_LEVEL = "basic";
 type Permission = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
+	/**
+	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
+	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
+	*/
+	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
 	action?: string;
@@ -5056,6 +5087,11 @@ type Permission = AuthzEntityBase & SubjectTypeScoping & {
 type Role = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
+	/**
+	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
+	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
+	*/
+	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
 	/** Permissions this role confers (definitional). Roles are flat bundles — OAA has no nested-role edge. */
@@ -5064,6 +5100,11 @@ type Role = AuthzEntityBase & SubjectTypeScoping & {
 type Group = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
+	/**
+	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
+	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
+	*/
+	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
 	/** Nested child groups composed into this group (definitional). */
@@ -5098,6 +5139,8 @@ type AuthzScimGroupType = OaaAccessTargetType;
 type AuthzScimGroupExtension = {
 	type?: AuthzScimGroupType;
 	requestable?: boolean;
+	/** Advisory access-risk classification. Writable by IAM; unset catalog values project as `basic`. */
+	riskLevel?: string;
 	/** Destination service-provider id written back by IAM. */
 	providerId?: string;
 	/** IAM-owned deep link for requesting this entitlement. Writable by IAM. */
@@ -6126,4 +6169,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { workloadTokenResponseSchema, workloadResourceSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, remoteConfigSecretType, readyCatalogEntry, parseKmsPoolDocument, parseKmsPoolControlDocument, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, mergeCodeCatalogEntity, materializeCodeCatalogEntity, matchesListFilter, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, getCodeCatalogEntity, generateULID, formatEcid, deprecateRetiredCodeCatalogRows, defineSecretType, defineCatalog, defaultSecretContentType, defaultLogger, deepEqualPlain, decodeUser, debugLogger, customerResourceSchema, configTrustedClientGrants, claimsToUser, catalogEntityStore, buildTenantPath, assertValidSubjectTypeScoping, assertRequiredSubjectType, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsWriteOptions, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretTypeRegistryEntry, SecretTypeInput, SecretTypeDescriptor, SecretRequestSeverity, SecretLifecycleRequest, SecretHandle, SecretFormat, SecretEventName, SecretEventListener, SecretEvent, SecretContentTypeMismatchError, SecretContentType, Secret, ScimWorkload, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimCustomer, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, PrincipalInboundHandlerConfig, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaPrincipalPopulation, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MirrorConfigLocator, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsRevokeKeyResult, KmsRevokeKeyRequest, KmsPoolSlot, KmsPoolListener, KmsPoolIssuer, KmsPoolDocument, KmsPoolControlDocument, KmsPoolConfig, KmsPool, KmsParkResult, KmsParkRequest, KmsParkReport, KmsParkDisposition, KmsKeyState, KmsKey, KmsIssuerEventName, KmsIssuerEventListener, KmsIssuerEvent, KmsIssuedKey, KmsConfig, KmsAllocationStrategy, KmsAllocationPolicy, KmsAddKeysResult, KmsAddKeysRequest, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InferSecretType, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamPrincipalKindFlag, IamPrincipalKind, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaReconcileInput, IamDeltaMode, IamDeltaEmitter, IamAssignmentPolicy, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_WORKLOAD_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_CUSTOMER_SCHEMA, ION_IAM_WORKLOADS_WRITE, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_ACCESS_REQUESTS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMPrincipalsInbound, IAMInboundWorkloadsConfig, IAMInboundUsersConfig, IAMInboundUserContext, IAMInboundPrincipalContext, IAMInboundCustomersConfig, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMEndpointFlag, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAMAccessRequestsConfig, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DestinationReference, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_SECRET_MIME_TYPES, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogEntityKind, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaPrincipalConfig, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, AssignmentPolicyError, ApplicationValidators, Address, AccessStatus, AccessRequestSubmit, AccessRequestResult, AccessRequestCreate, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };
+export { AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestSubmit, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DestinationReference, DevSecretsConfig, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JWTAssertionClaims, JwtBearerWorkloadConfig, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantIonCache, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UpdateTenantRequest, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, catalogEntityStore, claimsToUser, configTrustedClientGrants, customerResourceSchema, debugLogger, decodeUser, deepEqualPlain, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, readyCatalogEntry, remoteConfigSecretType, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1 +1,2 @@
-import{$ as Q1,A as v0,B as A0,C as w0,D as O0,E as _0,F as g0,G as y0,H as h0,I as p0,J as c0,K as m0,L as d0,M as u0,N as l0,O as o0,P as a0,Q as n0,R as i0,S as s0,T as r0,U as t0,V as e0,W as J1,X as X1,_ as $1,a as q0,aa as B1,b as j0,ba as V1,c as z0,ca as Z1,d as U0,da as H1,e as Y0,ea as G1,f as C0,g as K0,h as P0,i as M0,j as D0,k as W0,l as x0,m as b0,n as E0,o as S0,p as L0,q as N0,r as R0,s as I0,t as T0,u as k0,z as f0}from"./shared/core-ys2a23v0.js";var g="0.0.24-beta.20260910.1";class Y extends Error{kind;recoverable;code;status;path;sourceType;constructor(J,$){super(J,$.cause!==void 0?{cause:$.cause}:void 0);this.name="ConfigSourceError",this.kind=$.kind,this.recoverable=$.recoverable,this.code=$.code,this.status=$.status,this.path=$.path,this.sourceType=$.sourceType,Object.setPrototypeOf(this,Y.prototype)}}function y(J){return J instanceof Y}var G=["workload"],K={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:G,recommendedSubjectTypes:G},P={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},M={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},D={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},W={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},x={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:G,recommendedSubjectTypes:G},b={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:G,recommendedSubjectTypes:G},E={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:G},S={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:G,recommendedSubjectTypes:G},L={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},h=[K,P,M,D,W,x,b,E,S,L],p={"iam.read":{permission:K,subjectType:["workload"]},"iam.users.write":{permission:P,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"iam.workloads.write":{permission:D,subjectType:["workload"]},"iam.customers.write":{permission:W,subjectType:["workload"]},"iam.access-requests.write":{permission:x,subjectType:["workload"]},"capabilitiez.read":{permission:b,subjectType:["workload"]},"ciam.magic-link.create":{permission:E,subjectType:["workload","user"]},"authz.oaa.sync":{permission:S,subjectType:["workload"]},"tenant.manage":{permission:L,subjectType:["workload"]}};var c=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function I(J){if(J===null||typeof J!=="object")return J;let $={};for(let[X,Q]of Object.entries(J)){if(c.includes(X)||X==="validators"||X==="setStores")continue;$[X]=Q!==null&&typeof Q==="object"&&!Array.isArray(Q)&&Object.getPrototypeOf(Q)===Object.prototype?I(Q):Q}return $}function m(J){return I(J)}function C(J,$){if(!J||typeof J!=="object"||Array.isArray(J))throw Error(`${$} must be an object.`);return J}function j(J,$){if(J===void 0)return;if(typeof J!=="string"||J.length===0||!Number.isFinite(Date.parse(J)))throw Error(`${$} must be a valid timestamp string.`);return J}function T(J,$,X){if(!Array.isArray(J)||!X.allowEmpty&&J.length===0)throw Error(`${$} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let Q=new Set;return J.map((Z,B)=>{let V=C(Z,`${$} keys[${B}]`);if(typeof V.id!=="string"||V.id.length===0)throw Error(`${$} keys[${B}].id must be a non-empty string.`);if(Q.has(V.id))throw Error(`${$} contains duplicate key id "${V.id}".`);if(Q.add(V.id),!["pending","active","deprecated","rotated","revoked"].includes(String(V.state)))throw Error(`${$} keys[${B}].state is invalid.`);if(V.value!==void 0&&(typeof V.value!=="string"||V.value.length===0))throw Error(`${$} keys[${B}].value must be a non-empty string when present.`);let F=V.meta===void 0?void 0:C(V.meta,`${$} keys[${B}].meta`);return{id:V.id,state:V.state,...V.value===void 0?{}:{value:V.value},...V.notBefore===void 0?{}:{notBefore:j(V.notBefore,`${$} keys[${B}].notBefore`)},...V.notAfter===void 0?{}:{notAfter:j(V.notAfter,`${$} keys[${B}].notAfter`)},...V.createdAt===void 0?{}:{createdAt:j(V.createdAt,`${$} keys[${B}].createdAt`)},...V.activatedAt===void 0?{}:{activatedAt:j(V.activatedAt,`${$} keys[${B}].activatedAt`)},...V.deprecatedAt===void 0?{}:{deprecatedAt:j(V.deprecatedAt,`${$} keys[${B}].deprecatedAt`)},...V.rotatedAt===void 0?{}:{rotatedAt:j(V.rotatedAt,`${$} keys[${B}].rotatedAt`)},...V.revokedAt===void 0?{}:{revokedAt:j(V.revokedAt,`${$} keys[${B}].revokedAt`)},...F?{meta:{...F}}:{}}})}function d(J,$,X){if(J===void 0)return;if(!Array.isArray(J))throw Error(`${X} slots must be an array.`);let Q=new Set,Z=J.map((B,V)=>{if(B===null)return null;if(typeof B!=="string"||B.length===0)throw Error(`${X} slots[${V}] must be a non-empty key id or null.`);if(Q.has(B))throw Error(`${X} slots contain duplicate key id "${B}".`);Q.add(B);let F=$.find((H)=>H.id===B);if(!F)throw Error(`${X} slot key "${B}" is not present in keys.`);if(F.state!=="active")throw Error(`${X} slot key "${B}" must have state "active".`);if(!F.value)throw Error(`${X} slot key "${B}" must include a value.`);return B});if($.length===0&&Z.some((B)=>B!==null))throw Error(`${X} slots must be omitted or all-null when keys is empty.`);return Z}function u(J){let X=C(J,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let Q=T(X.keys,"KMS pool",{allowEmpty:!0}),Z=d(X.slots,Q,"KMS pool");return Z?{kind:"kms",slots:Z,keys:Q}:{kind:"kms",keys:Q}}function l(J){let X=C(J,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:T(X.keys,"KMS pool control document",{allowEmpty:!0})}}var k={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},o=k,a={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},n={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},i={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function s(J,$){if(typeof $!=="number"||$<=0)return J;return new Promise((X,Q)=>{let Z=setTimeout(()=>{Q(Error(`Authz catalog entry did not become ready within ${$}ms`))},$);J.then(()=>{clearTimeout(Z),X()},(B)=>{clearTimeout(Z),Q(B)})})}function r(J,$){let X=!1,Q,Z=$.then(()=>{X=!0},(V)=>{X=!1,Q=V}),B=J;return Object.defineProperty(B,"ready",{enumerable:!1,configurable:!0,value:(V)=>s(Z.then(()=>{if(!X)throw Q}),V)}),Object.defineProperty(B,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),B}var N=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function R(J){if(!J.id.trim())throw Error("defineSecretType: id is required");let $=J.mimeType?.trim()||N[J.format],X=Object.freeze({id:J.id,...J.label?{label:J.label}:{},format:J.format,mimeType:$,...J.schemaUrl?{schemaUrl:J.schemaUrl}:{},typeId:J.id});return Object.freeze({id:J.id,...J.label?{label:J.label}:{},format:J.format,mimeType:$,...J.schemaUrl?{schemaUrl:J.schemaUrl}:{},...J.schema?{schema:J.schema}:{},toRegistryEntry:()=>X})}function t(J="jsonc"){return{format:J,mimeType:N[J],typeId:J}}class f extends Error{expected;received;constructor(J,$){super(`Secret content type mismatch: expected "${J.mimeType}" (${J.format}) but received "${$.mimeType}" (${$.format})`);this.name="SecretContentTypeMismatchError",this.expected=J,this.received=$}}var e=R({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var A={beforeTenantSegments:["ui"]},w={beforeTenantSegments:["api"]};function v(J){return(J??[]).map(($)=>$.trim()).filter(Boolean)}function J0(J){let $=J.trim();if(!$)return"/";let X=$.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function O(J){return J0(J).split("/").filter(Boolean)}function U(J){return{beforeTenantSegments:v(J?.beforeTenantSegments),afterTenantSegments:v(J?.afterTenantSegments)}}function X0(J){return{type:"path",ui:U(J?.ui??A),api:U(J?.api??w)}}function $0(J,$){let X=U($),Q=X.beforeTenantSegments??[],Z=X.afterTenantSegments??[],B=O(J),V=Q.length+1+Z.length;if(B.length<V)return null;for(let q=0;q<Q.length;q++)if(B[q]!==Q[q])return null;let F=Q.length,H=B[F];if(!H)return null;for(let q=0;q<Z.length;q++)if(B[F+1+q]!==Z[q])return null;let z=B.slice(F+1+Z.length);return{id:decodeURIComponent(H),restSegments:z,restPath:z.length>0?`/${z.join("/")}`:"/"}}function Q0(J,$="/",X){let Q=U(X),Z=Q.beforeTenantSegments??[],B=Q.afterTenantSegments??[],V=O($),F=[...Z,encodeURIComponent(J),...B,...V];return F.length>0?`/${F.join("/")}`:"/"}function B0(J){return{"~standard":{version:1,vendor:J,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let X=$,Q=[],Z={...X},B=["iss","sub"];for(let H of B)if(H in X){if(typeof X[H]!=="string")Q.push({message:`${H} must be a string`,path:[H]})}else Q.push({message:`${H} is required`,path:[H]});if("aud"in X&&X.aud!==void 0){let H=X.aud;if(typeof H!=="string"&&!Array.isArray(H))Q.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(H)&&!H.every((z)=>typeof z==="string"))Q.push({message:"aud array must contain only strings",path:["aud"]})}let V=["jti","scope"];for(let H of V)if(H in X&&X[H]!==void 0){if(typeof X[H]!=="string")Q.push({message:`${H} must be a string`,path:[H]})}let F=["exp","iat"];for(let H of F)if(H in X){if(typeof X[H]!=="number")Q.push({message:`${H} must be a number`,path:[H]})}else Q.push({message:`${H} is required`,path:[H]});if(Q.length>0)return{issues:Q};return{value:Z}}}}}function V0(J){return{"~standard":{version:1,vendor:J,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let X=$,Q=[],Z={};if("access_token"in X)if(typeof X.access_token==="string")Z.access_token=X.access_token;else Q.push({message:"access_token must be a string",path:["access_token"]});else Q.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")Z.token_type=X.token_type;else Q.push({message:"token_type must be a string",path:["token_type"]});else Q.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)Z.scope=X.scope;else Q.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)Z.refresh_token=X.refresh_token;else Q.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)Z.expires=X.expires;else Q.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)Z.expires_in=X.expires_in;else Q.push({message:"expires_in must be a number",path:["expires_in"]});if(Q.length>0)return{issues:Q};return{value:Z}}}}}function Z0(J){let $=new Uint8Array(J);return crypto.getRandomValues($),$}function H0(J){let $="",X=Z0(J);for(let Q=0;Q<J;Q++){let Z=X[Q]%32;$+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)}return $}function G0(J,$){let X="";for(let Q=$;Q>0;Q--){let Z=J%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)+X,J=Math.floor(J/32)}return X}function F0(J){let $=Date.now(),X=G0($,10),Q=H0(16);return`${J??""}${X}${Q}`}export{V0 as workloadTokenResponseSchema,H1 as workloadResourceSchema,p0 as withValidate,i as warnLogger,i0 as waitOn,g as version,m0 as validationFailureResponse,V1 as userSchema,I0 as unionCatalogRead,q0 as trustedClientPermissionsForPrincipal,o0 as trimTrailingSlash,y0 as tokenResponseSchema,x0 as toCodeCatalog,u0 as stripJsonComments,n0 as stableConfigHash,k as silentLogger,m as serializeConfig,e as remoteConfigSecretType,r as readyCatalogEntry,u as parseKmsPoolDocument,l as parseKmsPoolControlDocument,l0 as parseJsonc,O0 as parseEcid,g0 as oidcCallbackSchema,X0 as normalizeTenantRoutingStrategy,U as normalizeTenantPathNamespace,c0 as must,d0 as mergeConfig,L0 as mergeCodeCatalogEntity,N0 as materializeCodeCatalogEntity,Y0 as matchesListFilter,$0 as matchTenantPath,U0 as listGenerator,z0 as list,B0 as jwtAssertionClaimsSchema,e0 as isStoreConflictError,A0 as isEcid,y as isConfigSourceError,X1 as isConfigLocator,W0 as isCodeCatalog,n as infoLogger,h0 as idTokenClaimsSchema,Z1 as groupResourceSchema,E0 as getCodeCatalogEntity,F0 as generateULID,w0 as formatEcid,R0 as deprecateRetiredCodeCatalogRows,R as defineSecretType,b0 as defineCatalog,t as defaultSecretContentType,o as defaultLogger,a0 as deepEqualPlain,r0 as decodeUser,a as debugLogger,G1 as customerResourceSchema,j0 as configTrustedClientGrants,s0 as claimsToUser,S0 as catalogEntityStore,Q0 as buildTenantPath,P0 as assertValidSubjectTypeScoping,M0 as assertRequiredSubjectType,_0 as assertEcid,k0 as accessRootId,T0 as accessRefId,t0 as StoreConflictError,f as SecretContentTypeMismatchError,K0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,J1 as IoniteError,L as ION_TENANT_MANAGE,h as ION_SDK_PERMISSIONS,Q1 as ION_SCIM_WORKLOAD_SCHEMA,$1 as ION_SCIM_USER_EXTENSION_URN,B1 as ION_SCIM_CUSTOMER_SCHEMA,D as ION_IAM_WORKLOADS_WRITE,P as ION_IAM_USERS_WRITE,K as ION_IAM_READ,M as ION_IAM_GROUPS_WRITE,W as ION_IAM_CUSTOMERS_WRITE,x as ION_IAM_ACCESS_REQUESTS_WRITE,p as ION_ENDPOINT_PERMISSIONS,E as ION_CIAM_MAGIC_LINK_CREATE,b as ION_CAPABILITIEZ_READ,S as ION_AUTHZ_OAA_SYNC,C0 as ION_AUTHZ_GROUP_SCHEMA,v0 as EcidFormatError,f0 as ECID_SCHEME,A as DEFAULT_TENANT_UI_NAMESPACE,w as DEFAULT_TENANT_API_NAMESPACE,N as DEFAULT_SECRET_MIME_TYPES,Y as ConfigSourceError,D0 as AssignmentPolicyError};
+import{T,J,S,s,F,A,a,e,c,O,I,L,W,H,z,k,b,m,w,v,C,r,i,Z,f,K,X,Q,g,E,U,u,o,t,M,ee,G,te,y,D,re,ne,R,se,d,h,q,V,n,l,p,ie,ae,j,_}from"./shared/core-mm9kc485.js";var ze="0.0.24-beta.20260915.2";class Se extends Error{constructor(x,P){super(x,P.cause!==void 0?{cause:P.cause}:void 0);this.name="ConfigSourceError",this.kind=P.kind,this.recoverable=P.recoverable,this.code=P.code,this.status=P.status,this.path=P.path,this.sourceType=P.sourceType,Object.setPrototypeOf(this,Se.prototype)}}function Fe(x){return x instanceof Se}var de=["workload"],Re={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Te={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:de,recommendedSubjectTypes:de},he={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Ae={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:de,recommendedSubjectTypes:de},be={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Ee={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Ie={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:de,recommendedSubjectTypes:de},we={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:de},xe={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Pe={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Ge=[Re,Te,he,Ae,be,Ee,Ie,we,xe,Pe],Ve={"iam.read":{permission:Re,subjectType:["workload"]},"iam.users.write":{permission:Te,subjectType:["workload"]},"iam.groups.write":{permission:he,subjectType:["workload"]},"iam.workloads.write":{permission:Ae,subjectType:["workload"]},"iam.customers.write":{permission:be,subjectType:["workload"]},"iam.access-requests.write":{permission:Ee,subjectType:["workload"]},"capabilitiez.read":{permission:Ie,subjectType:["workload"]},"ciam.magic-link.create":{permission:we,subjectType:["workload","user"]},"authz.oaa.sync":{permission:xe,subjectType:["workload"]},"tenant.manage":{permission:Pe,subjectType:["workload"]}};var Be=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function _e(x){if(x===null||typeof x!=="object")return x;let P={};for(let[N,B]of Object.entries(x)){if(Be.includes(N)||N==="validators"||N==="setStores")continue;P[N]=B!==null&&typeof B==="object"&&!Array.isArray(B)&&Object.getPrototypeOf(B)===Object.prototype?_e(B):B}return P}function He(x){return _e(x)}function Ce(x,P){if(!x||typeof x!=="object"||Array.isArray(x))throw Error(`${P} must be an object.`);return x}function ge(x,P){if(x===void 0)return;if(typeof x!=="string"||x.length===0||!Number.isFinite(Date.parse(x)))throw Error(`${P} must be a valid timestamp string.`);return x}function Ke(x,P,N){if(!Array.isArray(x)||!N.allowEmpty&&x.length===0)throw Error(`${P} keys must be ${N.allowEmpty?"an":"a non-empty"} array.`);let B=new Set;return x.map((pe,Y)=>{let oe=Ce(pe,`${P} keys[${Y}]`);if(typeof oe.id!=="string"||oe.id.length===0)throw Error(`${P} keys[${Y}].id must be a non-empty string.`);if(B.has(oe.id))throw Error(`${P} contains duplicate key id "${oe.id}".`);if(B.add(oe.id),!["pending","active","deprecated","rotated","revoked"].includes(String(oe.state)))throw Error(`${P} keys[${Y}].state is invalid.`);if(oe.value!==void 0&&(typeof oe.value!=="string"||oe.value.length===0))throw Error(`${P} keys[${Y}].value must be a non-empty string when present.`);let me=oe.meta===void 0?void 0:Ce(oe.meta,`${P} keys[${Y}].meta`);return{id:oe.id,state:oe.state,...oe.value===void 0?{}:{value:oe.value},...oe.notBefore===void 0?{}:{notBefore:ge(oe.notBefore,`${P} keys[${Y}].notBefore`)},...oe.notAfter===void 0?{}:{notAfter:ge(oe.notAfter,`${P} keys[${Y}].notAfter`)},...oe.createdAt===void 0?{}:{createdAt:ge(oe.createdAt,`${P} keys[${Y}].createdAt`)},...oe.activatedAt===void 0?{}:{activatedAt:ge(oe.activatedAt,`${P} keys[${Y}].activatedAt`)},...oe.deprecatedAt===void 0?{}:{deprecatedAt:ge(oe.deprecatedAt,`${P} keys[${Y}].deprecatedAt`)},...oe.rotatedAt===void 0?{}:{rotatedAt:ge(oe.rotatedAt,`${P} keys[${Y}].rotatedAt`)},...oe.revokedAt===void 0?{}:{revokedAt:ge(oe.revokedAt,`${P} keys[${Y}].revokedAt`)},...me?{meta:{...me}}:{}}})}function Je(x,P,N){if(x===void 0)return;if(!Array.isArray(x))throw Error(`${N} slots must be an array.`);let B=new Set,pe=x.map((Y,oe)=>{if(Y===null)return null;if(typeof Y!=="string"||Y.length===0)throw Error(`${N} slots[${oe}] must be a non-empty key id or null.`);if(B.has(Y))throw Error(`${N} slots contain duplicate key id "${Y}".`);B.add(Y);let me=P.find((ce)=>ce.id===Y);if(!me)throw Error(`${N} slot key "${Y}" is not present in keys.`);if(me.state!=="active")throw Error(`${N} slot key "${Y}" must have state "active".`);if(!me.value)throw Error(`${N} slot key "${Y}" must include a value.`);return Y});if(P.length===0&&pe.some((Y)=>Y!==null))throw Error(`${N} slots must be omitted or all-null when keys is empty.`);return pe}function Ye(x){let N=Ce(x,"KMS pool");if(N.kind!=="kms")throw Error('KMS pool kind must be "kms".');let B=Ke(N.keys,"KMS pool",{allowEmpty:!0}),pe=Je(N.slots,B,"KMS pool");return pe?{kind:"kms",slots:pe,keys:B}:{kind:"kms",keys:B}}function Ze(x){let N=Ce(x,"KMS pool control document");if(N.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:Ke(N.keys,"KMS pool control document",{allowEmpty:!0})}}var Qe={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function Le(x){if(typeof x==="string")return x;try{return JSON.stringify(x)??String(x)}catch{return String(x)}}function ke(x){let P=Le(x);return/^[A-Za-z0-9_./:@+|-]+$/.test(P)?P:JSON.stringify(P)}function Xe(x){return Le(x).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function Me(x,P,N){if(N==null)return;if(N instanceof Error){if(x.push(`${P}.name=${ke(N.name)}`),x.push(`${P}.message=${ke(N.message)}`),N.stack)x.push(`${P}.stack=${ke(N.stack)}`);return}x.push(`${P}=${ke(N)}`)}function ye(x,P,N=[],B=new Date){let pe=Xe(P instanceof Error?P.message:P??""),Y=[];for(let[oe,me]of N.entries()){if(me&&typeof me==="object"&&!Array.isArray(me)&&!(me instanceof Error)&&Object.getPrototypeOf(me)===Object.prototype){for(let[ce,ue]of Object.entries(me))Me(Y,ce,ue);continue}Me(Y,`param.${oe}`,me)}return[B.toISOString(),Qe[x],pe,...Y].filter(Boolean).join(" ")}var Ne={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},et=Ne,tt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},ot={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},rt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},nt={trace:()=>{},debug:(x,...P)=>globalThis.console.debug(ye("debug",x,P)),info:(x,...P)=>globalThis.console.info(ye("info",x,P)),warn:(x,...P)=>globalThis.console.warn(ye("warn",x,P)),error:(x,...P)=>globalThis.console.error(ye("error",x,P))};function st(x,P){if(typeof P!=="number"||P<=0)return x;return new Promise((N,B)=>{let pe=setTimeout(()=>{B(Error(`Authz catalog entry did not become ready within ${P}ms`))},P);x.then(()=>{clearTimeout(pe),N()},(Y)=>{clearTimeout(pe),B(Y)})})}function it(x,P){let N=!1,B,pe=P.then(()=>{N=!0},(oe)=>{N=!1,B=oe}),Y=x;return Object.defineProperty(Y,"ready",{enumerable:!1,configurable:!0,value:(oe)=>st(pe.then(()=>{if(!N)throw B}),oe)}),Object.defineProperty(Y,"isReady",{enumerable:!1,configurable:!0,value:()=>N}),Y}var Oe=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function ve(x){if(!x.id.trim())throw Error("defineSecretType: id is required");let P=x.mimeType?.trim()||Oe[x.format],N=Object.freeze({id:x.id,...x.label?{label:x.label}:{},format:x.format,mimeType:P,...x.schemaUrl?{schemaUrl:x.schemaUrl}:{},typeId:x.id});return Object.freeze({id:x.id,...x.label?{label:x.label}:{},format:x.format,mimeType:P,...x.schemaUrl?{schemaUrl:x.schemaUrl}:{},...x.schema?{schema:x.schema}:{},toRegistryEntry:()=>N})}function at(x="jsonc"){return{format:x,mimeType:Oe[x],typeId:x}}class De extends Error{constructor(x,P){super(`Secret content type mismatch: expected "${x.mimeType}" (${x.format}) but received "${P.mimeType}" (${P.format})`);this.name="SecretContentTypeMismatchError",this.expected=x,this.received=P}}var pt=ve({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var We={beforeTenantSegments:["ui"]},$e={beforeTenantSegments:["api"]};function je(x){return(x??[]).map((P)=>P.trim()).filter(Boolean)}function ct(x){let P=x.trim();if(!P)return"/";let N=P.replace(/\\/g,"/").replace(/\/+/g,"/");return N.startsWith("/")?N:`/${N}`}function qe(x){return ct(x).split("/").filter(Boolean)}function fe(x){return{beforeTenantSegments:je(x?.beforeTenantSegments),afterTenantSegments:je(x?.afterTenantSegments)}}function mt(x){return{type:"path",ui:fe(x?.ui??We),api:fe(x?.api??$e)}}function dt(x,P){let N=fe(P),B=N.beforeTenantSegments??[],pe=N.afterTenantSegments??[],Y=qe(x),oe=B.length+1+pe.length;if(Y.length<oe)return null;for(let le=0;le<B.length;le++)if(Y[le]!==B[le])return null;let me=B.length,ce=Y[me];if(!ce)return null;for(let le=0;le<pe.length;le++)if(Y[me+1+le]!==pe[le])return null;let ue=Y.slice(me+1+pe.length);return{id:decodeURIComponent(ce),restSegments:ue,restPath:ue.length>0?`/${ue.join("/")}`:"/"}}function lt(x,P="/",N){let B=fe(N),pe=B.beforeTenantSegments??[],Y=B.afterTenantSegments??[],oe=qe(P),me=[...pe,encodeURIComponent(x),...Y,...oe];return me.length>0?`/${me.join("/")}`:"/"}function ut(x){return{"~standard":{version:1,vendor:x,validate:(P)=>{if(typeof P!=="object"||P===null)return{issues:[{message:"Expected an object"}]};let N=P,B=[],pe={...N},Y=["iss","sub"];for(let ce of Y)if(ce in N){if(typeof N[ce]!=="string")B.push({message:`${ce} must be a string`,path:[ce]})}else B.push({message:`${ce} is required`,path:[ce]});if("aud"in N&&N.aud!==void 0){let ce=N.aud;if(typeof ce!=="string"&&!Array.isArray(ce))B.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ce)&&!ce.every((ue)=>typeof ue==="string"))B.push({message:"aud array must contain only strings",path:["aud"]})}let oe=["jti","scope"];for(let ce of oe)if(ce in N&&N[ce]!==void 0){if(typeof N[ce]!=="string")B.push({message:`${ce} must be a string`,path:[ce]})}let me=["exp","iat"];for(let ce of me)if(ce in N){if(typeof N[ce]!=="number")B.push({message:`${ce} must be a number`,path:[ce]})}else B.push({message:`${ce} is required`,path:[ce]});if(B.length>0)return{issues:B};return{value:pe}}}}}function gt(x){return{"~standard":{version:1,vendor:x,validate:(P)=>{if(typeof P!=="object"||P===null)return{issues:[{message:"Expected an object"}]};let N=P,B=[],pe={};if("access_token"in N)if(typeof N.access_token==="string")pe.access_token=N.access_token;else B.push({message:"access_token must be a string",path:["access_token"]});else B.push({message:"access_token is required",path:["access_token"]});if("token_type"in N)if(typeof N.token_type==="string")pe.token_type=N.token_type;else B.push({message:"token_type must be a string",path:["token_type"]});else B.push({message:"token_type is required",path:["token_type"]});if("scope"in N)if(typeof N.scope==="string"||N.scope===void 0)pe.scope=N.scope;else B.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in N)if(typeof N.refresh_token==="string"||N.refresh_token===void 0)pe.refresh_token=N.refresh_token;else B.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in N)if(typeof N.expires==="string"||N.expires===void 0)pe.expires=N.expires;else B.push({message:"expires must be a string",path:["expires"]});if("expires_in"in N)if(typeof N.expires_in==="number"||N.expires_in===void 0)pe.expires_in=N.expires_in;else B.push({message:"expires_in must be a number",path:["expires_in"]});if(B.length>0)return{issues:B};return{value:pe}}}}}function yt(x){let P=new Uint8Array(x);return crypto.getRandomValues(P),P}function ft(x){let P="",N=yt(x);for(let B=0;B<x;B++){let pe=N[B]%32;P+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(pe)}return P}function St(x,P){let N="";for(let B=P;B>0;B--){let pe=x%32;N="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(pe)+N,x=Math.floor(x/32)}return N}function Ct(x){let P=Date.now(),N=St(P,10),B=ft(16);return`${x??""}${N}${B}`}export{L as AssignmentPolicyError,A as CANONICAL_RISK_LEVELS,Se as ConfigSourceError,a as DEFAULT_RISK_LEVEL,Oe as DEFAULT_SECRET_MIME_TYPES,$e as DEFAULT_TENANT_API_NAMESPACE,We as DEFAULT_TENANT_UI_NAMESPACE,Z as ECID_SCHEME,f as EcidFormatError,e as ION_AUTHZ_GROUP_SCHEMA,xe as ION_AUTHZ_OAA_SYNC,Ie as ION_CAPABILITIEZ_READ,we as ION_CIAM_MAGIC_LINK_CREATE,Ve as ION_ENDPOINT_PERMISSIONS,Ee as ION_IAM_ACCESS_REQUESTS_WRITE,be as ION_IAM_CUSTOMERS_WRITE,he as ION_IAM_GROUPS_WRITE,Re as ION_IAM_READ,Te as ION_IAM_USERS_WRITE,Ae as ION_IAM_WORKLOADS_WRITE,p as ION_SCIM_CUSTOMER_SCHEMA,n as ION_SCIM_USER_EXTENSION_URN,l as ION_SCIM_WORKLOAD_SCHEMA,Ge as ION_SDK_PERMISSIONS,Pe as ION_TENANT_MANAGE,q as IoniteError,c as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,De as SecretContentTypeMismatchError,d as StoreConflictError,r as accessRefId,i as accessRootId,g as assertEcid,I as assertRequiredSubjectType,O as assertValidSubjectTypeScoping,lt as buildTenantPath,b as catalogEntityStore,R as claimsToUser,J as configTrustedClientGrants,_ as customerResourceSchema,tt as debugLogger,se as decodeUser,D as deepEqualPlain,et as defaultLogger,at as defaultSecretContentType,z as defineCatalog,ve as defineSecretType,v as deprecateRetiredCodeCatalogRows,X as formatEcid,ye as formatLogLine,Ct as generateULID,k as getCodeCatalogEntity,ae as groupResourceSchema,u as idTokenClaimsSchema,ot as infoLogger,W as isCodeCatalog,V as isConfigLocator,Fe as isConfigSourceError,K as isEcid,h as isStoreConflictError,ut as jwtAssertionClaimsSchema,S as list,s as listGenerator,dt as matchTenantPath,F as matchesListFilter,w as materializeCodeCatalogEntity,m as mergeCodeCatalogEntity,ee as mergeConfig,t as must,fe as normalizeTenantPathNamespace,mt as normalizeTenantRoutingStrategy,E as oidcCallbackSchema,Q as parseEcid,te as parseJsonc,Ze as parseKmsPoolControlDocument,Ye as parseKmsPoolDocument,nt as prettyLogger,it as readyCatalogEntry,pt as remoteConfigSecretType,He as serializeConfig,Ne as silentLogger,re as stableConfigHash,G as stripJsonComments,H as toCodeCatalog,U as tokenResponseSchema,y as trimTrailingSlash,T as trustedClientPermissionsForPrincipal,C as unionCatalogRead,ie as userSchema,M as validationFailureResponse,ze as version,ne as waitOn,rt as warnLogger,o as withValidate,j as workloadResourceSchema,gt as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -2572,6 +2572,8 @@ type OtelProtocol = "http/protobuf" | "http/json";
 type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
 type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
 type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
+/** Local console mirror policy: disable it or set its minimum emitted severity. */
+type OtelConsoleMode = "off" | OtelLogLevel;
 type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
 type OtelAttributes = Record<string, OtelAttributeValue>;
 type OtelSignalConfig = {
@@ -2612,6 +2614,8 @@ type OtelConfig = {
 	deploymentEnvironment?: string;
 	resourceAttributes?: OtelAttributes;
 	levels?: OtelLevels;
+	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
+	console?: OtelConsoleMode;
 	traces?: boolean | OtelSignalConfig;
 	metrics?: boolean | OtelMetricsSignalConfig;
 	logs?: boolean | OtelSignalConfig;
@@ -4537,9 +4541,18 @@ type SubjectTypeScoping = {
 	/** AppDev advisory default principal kinds; must be a subset of `assignableSubjectTypes` (read-only to IAM). */
 	recommendedSubjectTypes?: SubjectType[];
 };
+/** Suggested IAM governance labels for an entitlement's advisory risk classification. */
+declare const CANONICAL_RISK_LEVELS: readonly ["basic", "elevated", "privileged", "admin"];
+/** Canonical IAM governance suggestions with autocomplete, while allowing AppDev-defined labels. */
+type RiskLevel = (typeof CANONICAL_RISK_LEVELS)[number] | (string & {});
 type Permission = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
+	/**
+	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
+	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
+	*/
+	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
 	action?: string;
@@ -4553,6 +4566,11 @@ type Permission = AuthzEntityBase & SubjectTypeScoping & {
 type Role2 = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
+	/**
+	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
+	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
+	*/
+	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
 	/** Permissions this role confers (definitional). Roles are flat bundles — OAA has no nested-role edge. */
@@ -4561,6 +4579,11 @@ type Role2 = AuthzEntityBase & SubjectTypeScoping & {
 type Group2 = AuthzEntityBase & SubjectTypeScoping & {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
+	/**
+	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
+	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
+	*/
+	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
 	/** Nested child groups composed into this group (definitional). */
@@ -5633,4 +5656,4 @@ type VerifyUserOptions = {
 *   does not match, or the token is expired.
 */
 declare function verifyUser(jwt: string, options: VerifyUserOptions): Promise<WorkforceUser>;
-export { withSetCookies, verifyUser, verifyLogoutToken, verifyLfvSignature, verifyIdToken, stringifyLfvJwks, sso, signLfvPayload, setJwksRetry, setJwksClock, setDiscoveryClock, sendTenantWebhook, sameOriginRedirectRules, resolveUser, resolveSessionCacheConfig, resolveRedirect, resolveProviderBranding, resolveJwksCacheConfig, resolveJwkForKid, resolveCustomer, resolveCiamProvider, resolveCapturedRedirect, resolveCacheConfig, resolveAfterRedirect, reconcileSubjectAccess, pkceChallengeFromVerifier, parseLfvJwks, orderedEnabledProviders, normalizeOidcIssuer, listSsoClientIdsFromCookies, isRedirectAllowed, initiateLogin, iam, hasScope, hasRole2 as hasRole, hasPermission2 as hasPermission, hasGroup2 as hasGroup, hasAnyScope, hasAny2 as hasAny, hasAllScope, hasAll2 as hasAll, has, getVerificationKeyForKid, getUser, getPublicKeyFromJwks, getPublicKeyForKid, getProviderPreset, getJwks, getDiscoveredSessionUsers, getCustomer, getCachedVerificationKey, generateLfvEd25519KeyPair, generateAppleClientSecret, fetchUserInfo, expandRoot, exchangeAuthorizationCode, entitlementToScimGroup, discoverSessions, discoverSessionRecords, discoverOidcEndpoints, defaultRedirectPolicies, configureJwksCache, collectReferencedDefinitions, clearJwksCache, clearDiscoveryCache, ciam, captureRedirect, callback, buildLfvSigningInput, buildAuthorizationUrl, blockDangerousUrls, baseWorkloadToScim, baseUserToScimUser, baseCustomerToScim, assertTrustedIdTokenClaims, assertSubjectTypeAssignable, allowSameOrigin, allowRelativePaths, allowOrigins, allowHosts, VerifyUserOptions, VerifyLogoutTokenOptions, VerifyIdTokenOptions, UsersInboundHandlerConfig, StateCookie, SessionResponse, SessionDiscoveryOptions, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimListResponse, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfig, SSO, ResolvedSessionReadCacheConfig, ResolvedSessionCacheConfig, ResolvedJwksCacheConfig, ResolvedCacheConfig, ReferencedDefinitions, RedirectVerdict, RedirectRuleContext, RedirectRule, RedirectResult, RedirectPolicy, RedirectContext, ReconcileStores, JWKS, InMemoryTenantStore, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfig, IAMAccessRequestsConfig, IAM, GroupsInboundHandlerConfig, CreateUserOptions, CreateGroupOptions, CatalogView, CatalogAdjacencyCache, CIAM_PROVIDER_PRESETS, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCode, CIAMConfig, CIAM, CACHE_BOUNDS, BeforeLogoutHook, BeforeLogoutContext, BeforeLoginHook, BeforeLoginContext, AssertTrustedIdTokenClaimsOptions, AfterLogoutHook, AfterLogoutContext, AfterLoginHook, AfterLoginContext, AccessRequestSubmit, AccessRequestResult, AccessRequestCreate };
+export { AccessRequestCreate, AccessRequestResult, AccessRequestSubmit, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, CreateGroupOptions, CreateUserOptions, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, InMemoryTenantStore, JWKS, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, StateCookie, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, defaultRedirectPolicies, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, reconcileSubjectAccess, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveUser, sameOriginRedirectRules, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signLfvPayload, sso, stringifyLfvJwks, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };