@ionite/core 0.0.24-beta.20260910.1 → 0.0.24-beta.20260915.3

package/dist/index.d.ts

@@ -1,4 +1,19 @@
 import { version } from "../package.json";
+/**
+* Reject SDK-owned names in extension-only types. Principal stores also accept validator-inferred
+* complete object types, identified by `TFullShapeKeys`; their SDK fields are removed before merge.
+*/
+type NoReserved<
+	TAttributes,
+	TReserved extends PropertyKey,
+	TFullShapeKeys extends PropertyKey = never
+> = TAttributes extends object ? [TFullShapeKeys] extends [never] ? TAttributes & { [TKey in Extract<keyof TAttributes, TReserved>]? : never } : [TFullShapeKeys] extends [keyof TAttributes] ? Omit<TAttributes, TReserved> : TAttributes & { [TKey in Extract<keyof TAttributes, TReserved>]? : never } : TAttributes;
+declare const KNOWN_ENTITLEMENT_KEYS: readonly ["id", "name", "displayName", "description", "providerId", "source", "deprecated", "type", "parent", "resources", "assignableSubjectTypes", "recommendedSubjectTypes", "requestable", "riskLevel", "requestUrl", "action", "permissionTypes", "resourceTypes", "applyToSubResources", "permissions", "groups", "roles"];
+declare const KNOWN_BASE_USER_KEYS: readonly ["id", "userName", "name", "email", "avatar", "userType", "tenantId", "externalId", "providerId", "requestUrl", "ecid", "accountClass", "displayName", "scimName", "emails", "nickName", "active", "title", "preferredLanguage", "locale", "timezone", "phoneNumbers", "ims", "photos", "addresses", "roles", "groups", "entitlements", "x509Certificates", "scimEnterprise", "scimSchemaExtensions", "createdAt", "updatedAt", "sso"];
+declare const KNOWN_BASE_CUSTOMER_KEYS: readonly ["id", "userName", "name", "email", "avatar", "userType", "tenantId", "externalId", "providerId", "requestUrl", "displayName", "emails", "phoneNumbers", "active", "createdAt", "updatedAt", "ciam"];
+declare const KNOWN_WORKLOAD_KEYS: readonly ["id", "clientId", "displayName", "description", "externalId", "providerId", "requestUrl", "ecid", "active", "scopes", "createdAt", "updatedAt", "metadata"];
+/** Return the AppDev-owned, enumerable attributes on an object, omitting SDK keys and undefined values. */
+declare function customAttributes(value: object, knownKeys: readonly PropertyKey[]): Record<string, unknown> | undefined;
 import { StandardSchemaV1 as StandardSchemaV19 } from "@standard-schema/spec";
 import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
 /**
@@ -91,6 +106,11 @@ interface Logger {
 	error(message?: unknown, ...optionalParams: unknown[]): void;
 }
 /**
+* Renders a structured logger call as one greppable line while leaving the source fields separate
+* for telemetry exporters.
+*/
+declare function formatLogLine(level: keyof Logger, message: unknown, optionalParams?: unknown[], timestamp?: Date): string;
+/**
 * No-op implementation — does nothing for any log level
 */
 declare const silentLogger: Logger;
@@ -111,6 +131,10 @@ declare const infoLogger: Logger;
 * Logger that logs messages warn and error to the console.
 */
 declare const warnLogger: Logger;
+/**
+* Human-readable single-line console logger for local application output.
+*/
+declare const prettyLogger: Logger;
 /** Synchronous, in-memory read surface for one code catalog entity kind. */
 type CodeCatalogNamespace<TEntity> = {
 	get(id: string): TEntity | undefined;
@@ -120,16 +144,16 @@ type CodeCatalogNamespace<TEntity> = {
 * Normalized, frozen code-declared catalog produced by {@link defineCatalog}. All entities are
 * deep-frozen and id-indexed.
 */
-type CodeCatalog = {
-	groups: CodeCatalogNamespace<Group>;
-	roles: CodeCatalogNamespace<Role>;
-	permissions: CodeCatalogNamespace<Permission>;
+type CodeCatalog<TAttributes extends object = object> = {
+	groups: CodeCatalogNamespace<Group<TAttributes>>;
+	roles: CodeCatalogNamespace<Role<TAttributes>>;
+	permissions: CodeCatalogNamespace<Permission<TAttributes>>;
 };
 /** Declarative input for {@link defineCatalog} (plain arrays authored in app code). */
-type CodeCatalogInput = {
-	groups?: readonly Group[];
-	roles?: readonly Role[];
-	permissions?: readonly Permission[];
+type CodeCatalogInput<TAttributes extends object = object> = {
+	groups?: readonly Group<TAttributes>[];
+	roles?: readonly Role<TAttributes>[];
+	permissions?: readonly Permission<TAttributes>[];
 };
 /** True when the value is already a normalized {@link CodeCatalog} (vs a declarative input). */
 declare function isCodeCatalog(value: CodeCatalog | CodeCatalogInput): value is CodeCatalog;
@@ -150,9 +174,9 @@ type CatalogEntityKind = "group" | "role" | "permission";
 * - every entitlement declares a required non-empty `assignableSubjectTypes` within the platform
 *   ceiling, and `recommendedSubjectTypes` is a subset of it.
 *
-* Side effects: every entity (and its arrays/metadata) is frozen.
+* Side effects: every entity and each directly-held array value is frozen.
 */
-declare function defineCatalog(input: CodeCatalogInput): CodeCatalog;
+declare function defineCatalog<TAttributes extends object = Record<string, unknown>>(input: CodeCatalogInput<NoInfer<TAttributes>>): CodeCatalog<TAttributes>;
 /** Resolve one code entity and its kind from the shared id space. */
 declare function getCodeCatalogEntity(code: CodeCatalog | undefined, id: string): {
 	entity: Group | Role | Permission;
@@ -161,14 +185,21 @@ declare function getCodeCatalogEntity(code: CodeCatalog | undefined, id: string)
 /** Return the entity namespace for one catalog kind. */
 declare function catalogEntityStore<TEntity extends Group | Role | Permission>(catalog: AccessCatalogStore, kind: CatalogEntityKind): EntityStore<TEntity>;
 /**
-* Merge a materialized row with its code template. The row owns presentation, receipts, lifecycle,
-* and other runtime metadata; code owns ids, subject scoping, and graph/resource structure.
+* Merge a materialized row with its code template. The row owns receipts, lifecycle, other runtime
+* metadata, and any IAM-authored presentation overrides (`displayName`, `riskLevel`) — a stored
+* value means IAM expressed an opinion, an absent one keeps following code edits. Code owns ids,
+* subject scoping, and graph/resource structure.
 */
 declare function mergeCodeCatalogEntity<TEntity extends Group | Role | Permission>(kind: CatalogEntityKind, code: TEntity, stored: TEntity): TEntity;
 /**
 * Insert a code template into the runtime catalog only when no row exists. Existing rows are never
-* rewritten, preserving IAM-renamed presentation and receipts. `insertIfAbsent` closes the race
+* rewritten, preserving IAM-authored presentation and receipts. `insertIfAbsent` closes the race
 * between the initial read and insert.
+*
+* Advisory presentation (`riskLevel`, `displayName`, and custom attributes) is deliberately NOT
+* persisted: on the durable row an absent value means "no IAM override", so the merged read keeps
+* following later code edits. Snapshotting the seed here would freeze it — indistinguishable from
+* an IAM-authored value.
 */
 declare function materializeCodeCatalogEntity<TEntity extends Group | Role | Permission>(kind: CatalogEntityKind, code: TEntity, store: EntityStore<TEntity>): Promise<TEntity>;
 /**
@@ -512,6 +543,8 @@ interface ScimWorkload {
 	requestUrl?: string;
 	/** Enterprise Controlled ID for workload correlation across datasources. */
 	ecid?: string;
+	/** AppDev custom attributes. App code seeds values; IAM may persist overrides. */
+	attributes?: Record<string, unknown>;
 	meta?: {
 		resourceType?: string;
 		created?: string;
@@ -532,6 +565,8 @@ interface ScimCustomer {
 	emails?: Email[];
 	providerId?: string;
 	requestUrl?: string;
+	/** AppDev custom attributes. App code seeds values; IAM may persist overrides. */
+	attributes?: Record<string, unknown>;
 	meta?: {
 		resourceType?: string;
 		created?: string;
@@ -649,6 +684,8 @@ interface IoniteUserExtension {
 	* `daily`, `privileged`, `break_glass`, `service`.
 	*/
 	accountClass?: string;
+	/** AppDev custom attributes. App code seeds values; IAM may persist overrides. */
+	attributes?: Record<string, unknown>;
 }
 /**
 * SCIM User Resource
@@ -1117,7 +1154,7 @@ type AuthenticatedPrincipal = AuthenticatedUser | WorkloadPrincipal;
 *
 * @template TExtended - Type-safe custom data that consumers can add to users
 */
-type BaseUser<TExtended = object> = BaseUserFields & {
+type BaseUserSdkFields = {
 	/**
 	* Optional ionite tenant identifier for tenant-aware apps.
 	* Built-in user stores can use this when registering HRD mappings.
@@ -1269,7 +1306,9 @@ type BaseUser<TExtended = object> = BaseUserFields & {
 	* Simple app stores MAY omit this field.
 	*/
 	sso?: WorkforceUser["sso"];
-} & TExtended;
+};
+type BaseUserReservedKey = keyof BaseUserFields | keyof BaseUserSdkFields;
+type BaseUser<TExtended = object> = BaseUserFields & BaseUserSdkFields & NoReserved<TExtended, BaseUserReservedKey, "userName" | "name" | "email">;
 type UserStoreOptions = {
 	tenantId: string;
 	tenants: TenantStore;
@@ -1352,7 +1391,7 @@ interface UserStore<TExtended = object> {
 *
 * @template TExtended - Type-safe custom data that consumers can add to workload identities.
 */
-type BaseWorkloadIdentity<TExtended = object> = {
+type BaseWorkloadIdentitySdkFields = {
 	/**
 	* Stable subject id for this workload. Used as the AccessIndex subject for
 	* `subjectType: 'workload'` checks. Typically `clientId`, a workload id, or the token `sub`.
@@ -1389,7 +1428,9 @@ type BaseWorkloadIdentity<TExtended = object> = {
 	updatedAt?: Date;
 	/** Optional free-form metadata bag. */
 	metadata?: Record<string, unknown>;
-} & TExtended;
+};
+type BaseWorkloadIdentityReservedKey = keyof BaseWorkloadIdentitySdkFields;
+type BaseWorkloadIdentity<TExtended = object> = BaseWorkloadIdentitySdkFields & NoReserved<TExtended, BaseWorkloadIdentityReservedKey, "id">;
 /**
 * Abstract interface for workload identity storage backends. Implement to back the registry with
 * in-memory, Redis, or a database. Mirrors {@link UserStore}.
@@ -2712,6 +2753,8 @@ type OtelProtocol = "http/protobuf" | "http/json";
 type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
 type OtelLogLevel = "trace" | "debug" | "info" | "warn" | "error";
 type OtelLevels = Partial<Record<OtelLogLevel, boolean>>;
+/** Local console mirror policy: disable it or set its minimum emitted severity. */
+type OtelConsoleMode = "off" | OtelLogLevel;
 type OtelAttributeValue = string | number | boolean | string[] | number[] | boolean[];
 type OtelAttributes = Record<string, OtelAttributeValue>;
 type OtelSignalConfig = {
@@ -2758,6 +2801,8 @@ type OtelConfig = {
 	deploymentEnvironment?: string;
 	resourceAttributes?: OtelAttributes;
 	levels?: OtelLevels;
+	/** `'off'` exports only to OTel; a level dual-emits at or above that severity. Defaults to `'info'`. */
+	console?: OtelConsoleMode;
 	traces?: boolean | OtelSignalConfig;
 	metrics?: boolean | OtelMetricsSignalConfig;
 	logs?: boolean | OtelSignalConfig;
@@ -2769,7 +2814,8 @@ type OtelConfig = {
 type FrameworkOtelConfig = {
 	levels?: OtelLevels;
 	instrument?: unknown[];
-	console?: boolean | ((record: OtelLogRecord) => void);
+	/** Optional app-owned destination/renderer for records admitted by `RemoteConfig.otel.console`. */
+	console?: (record: OtelLogRecord) => void;
 	spanProcessors?: unknown[];
 	metricReaders?: unknown[];
 	logRecordProcessors?: unknown[];
@@ -4903,7 +4949,7 @@ type InMemoryTenantStoreOptions = {
 *
 * @template TExtended - Type-safe custom data that consumers can add to customers
 */
-type BaseCustomer<TExtended = object> = BaseUserFields & {
+type BaseCustomerSdkFields = {
 	/**
 	* Optional ionite tenant identifier for tenant-aware apps.
 	*/
@@ -4950,7 +4996,9 @@ type BaseCustomer<TExtended = object> = BaseUserFields & {
 	* Simple app stores MAY omit this field.
 	*/
 	ciam?: Customer["ciam"];
-} & TExtended;
+};
+type BaseCustomerReservedKey = keyof BaseUserFields | keyof BaseCustomerSdkFields;
+type BaseCustomer<TExtended = object> = BaseUserFields & BaseCustomerSdkFields & NoReserved<TExtended, BaseCustomerReservedKey, "userName" | "name" | "email">;
 type CustomerStoreOptions = {
 	tenantId: string;
 	tenants: TenantStore;
@@ -5003,7 +5051,7 @@ interface CustomerStore<TExtended = object> {
 	*/
 	list(options?: ListOptions): Promise<ListResult<BaseCustomer<TExtended>>>;
 }
-type AuthzEntityBase = {
+type AuthzEntityBaseFields = {
 	id: string;
 	name: string;
 	displayName?: string;
@@ -5014,37 +5062,24 @@ type AuthzEntityBase = {
 	source?: "code" | "app" | "scim";
 	/** A retired entitlement may be deleted by IAM after its grants have been removed. */
 	deprecated?: boolean;
-	metadata?: Record<string, unknown>;
 };
-type Resource = AuthzEntityBase & {
+type ResourceFields<TAttributes extends object = object> = {
 	type: string;
-	parent?: string | Resource;
-	resources?: Array<string | Resource>;
-};
-/**
-* AppDev-owned subject-type scoping shared by every catalog entitlement (group/role/permission).
-*
-* - `assignableSubjectTypes` is the AppDev **veto**: the hard, required, non-empty ceiling of
-*   principal kinds that may ever hold this entitlement. It is authored in application code and is
-*   **read-only** to the IAM tool (projected through SCIM as a `readOnly` attribute). There is no
-*   default-to-workforce and no unset-means-unrestricted: every entitlement declares its audience
-*   explicitly. A grant whose `subjectType` is outside this set is rejected.
-* - `recommendedSubjectTypes` is the AppDev **advisory default**: a (non-binding) subset of
-*   `assignableSubjectTypes` the IAM tool should default to. It is also read-only to IAM; the IAM
-*   tool is responsible for tracking changes to it over time. It MUST be a subset of
-*   `assignableSubjectTypes` (validated when the entitlement is authored).
-*/
-type SubjectTypeScoping = {
-	/** AppDev veto: required non-empty ceiling of principal kinds that may hold this entitlement (read-only to IAM). */
-	assignableSubjectTypes: SubjectType[];
-	/** AppDev advisory default principal kinds; must be a subset of `assignableSubjectTypes` (read-only to IAM). */
-	recommendedSubjectTypes?: SubjectType[];
+	parent?: string | Resource<TAttributes>;
+	resources?: Array<string | Resource<TAttributes>>;
 };
-type Permission = AuthzEntityBase & SubjectTypeScoping & {
+type EntitlementPresentationFields = {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
+	/**
+	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
+	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
+	*/
+	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
+};
+type PermissionFields = EntitlementPresentationFields & {
 	action?: string;
 	/** Canonical OAA permission types (maps to OAA `permission_type`). */
 	permissionTypes?: string[];
@@ -5053,33 +5088,60 @@ type Permission = AuthzEntityBase & SubjectTypeScoping & {
 	/** When true, the permission also applies to a resource's sub-resources (maps to OAA `apply_to_sub_resources`). */
 	applyToSubResources?: boolean;
 };
-type Role = AuthzEntityBase & SubjectTypeScoping & {
-	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
-	requestable?: boolean;
-	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
-	requestUrl?: string;
+type RoleFields<TAttributes extends object = object> = EntitlementPresentationFields & {
 	/** Permissions this role confers (definitional). Roles are flat bundles — OAA has no nested-role edge. */
-	permissions?: Array<string | Permission>;
+	permissions?: Array<string | Permission<TAttributes>>;
 };
-type Group = AuthzEntityBase & SubjectTypeScoping & {
-	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
-	requestable?: boolean;
-	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
-	requestUrl?: string;
+type GroupFields<TAttributes extends object = object> = EntitlementPresentationFields & {
 	/** Nested child groups composed into this group (definitional). */
-	groups?: Array<string | Group>;
+	groups?: Array<string | Group<TAttributes>>;
 	/** Roles this group confers (group is the principal). Projected as OAA `local_group` role assignments. */
-	roles?: Array<string | Role>;
+	roles?: Array<string | Role<TAttributes>>;
 	/** Permissions this group confers (group is the principal). Projected as OAA `local_group` application permissions. */
-	permissions?: Array<string | Permission>;
+	permissions?: Array<string | Permission<TAttributes>>;
 	/**
 	* Resource scope this entitlement binds to. When set, a member-add grant inherits these resources
 	* (so the conferred role/permissions are scoped to them), and OAA projects the group's role/
 	* permission assignments as resource-scoped (`apply_to_application: false`) rather than app-wide.
 	* Empty/undefined means application-wide (the conferred access applies to the whole application).
 	*/
-	resources?: Array<string | Resource>;
+	resources?: Array<string | Resource<TAttributes>>;
+};
+/**
+* AppDev-owned subject-type scoping shared by every catalog entitlement (group/role/permission).
+*
+* - `assignableSubjectTypes` is the AppDev **veto**: the hard, required, non-empty ceiling of
+*   principal kinds that may ever hold this entitlement. It is authored in application code and is
+*   **read-only** to the IAM tool (projected through SCIM as a `readOnly` attribute). There is no
+*   default-to-workforce and no unset-means-unrestricted: every entitlement declares its audience
+*   explicitly. A grant whose `subjectType` is outside this set is rejected.
+* - `recommendedSubjectTypes` is the AppDev **advisory default**: a (non-binding) subset of
+*   `assignableSubjectTypes` the IAM tool should default to. It is also read-only to IAM; the IAM
+*   tool is responsible for tracking changes to it over time. It MUST be a subset of
+*   `assignableSubjectTypes` (validated when the entitlement is authored).
+*/
+type SubjectTypeScoping = {
+	/** AppDev veto: required non-empty ceiling of principal kinds that may hold this entitlement (read-only to IAM). */
+	assignableSubjectTypes: SubjectType[];
+	/** AppDev advisory default principal kinds; must be a subset of `assignableSubjectTypes` (read-only to IAM). */
+	recommendedSubjectTypes?: SubjectType[];
 };
+type EntitlementReservedKey = keyof AuthzEntityBaseFields | keyof SubjectTypeScoping | keyof ResourceFields | keyof PermissionFields | keyof RoleFields | keyof GroupFields;
+/**
+* Fields shared by App-authored authorization entities. Custom attributes stay flat and type-safe;
+* SDK-owned names are reserved so future protocol fields cannot silently collide with app data.
+*/
+type AuthzEntityBase<TAttributes extends object = object> = AuthzEntityBaseFields & NoReserved<TAttributes, EntitlementReservedKey>;
+type Resource<TAttributes extends object = object> = AuthzEntityBase<TAttributes> & ResourceFields<TAttributes>;
+/** Suggested IAM governance labels for an entitlement's advisory risk classification. */
+declare const CANONICAL_RISK_LEVELS: readonly ["basic", "elevated", "privileged", "admin"];
+/** Canonical IAM governance suggestions with autocomplete, while allowing AppDev-defined labels. */
+type RiskLevel = (typeof CANONICAL_RISK_LEVELS)[number] | (string & {});
+/** Risk projected to IAM when an entitlement does not declare or store an explicit classification. */
+declare const DEFAULT_RISK_LEVEL = "basic";
+type Permission<TAttributes extends object = object> = AuthzEntityBase<TAttributes> & SubjectTypeScoping & PermissionFields;
+type Role<TAttributes extends object = object> = AuthzEntityBase<TAttributes> & SubjectTypeScoping & RoleFields<TAttributes>;
+type Group<TAttributes extends object = object> = AuthzEntityBase<TAttributes> & SubjectTypeScoping & GroupFields<TAttributes>;
 type OaaAccessTargetType = "group" | "role" | "permission";
 /**
 * The kind of an Entitlement. An **Entitlement** is any catalog object that can grant a user access
@@ -5092,12 +5154,14 @@ type OaaAccessTargetType = "group" | "role" | "permission";
 */
 type EntitlementType = OaaAccessTargetType;
 /** A catalog Entitlement: a group, role, or permission (see {@link EntitlementType}). */
-type Entitlement = Group | Role | Permission;
+type Entitlement<TAttributes extends object = object> = Group<TAttributes> | Role<TAttributes> | Permission<TAttributes>;
 declare const ION_AUTHZ_GROUP_SCHEMA = "urn:ionite:params:scim:schemas:extension:authz:2.0:Group";
 type AuthzScimGroupType = OaaAccessTargetType;
 type AuthzScimGroupExtension = {
 	type?: AuthzScimGroupType;
 	requestable?: boolean;
+	/** Advisory access-risk classification. Writable by IAM; unset catalog values project as `basic`. */
+	riskLevel?: string;
 	/** Destination service-provider id written back by IAM. */
 	providerId?: string;
 	/** IAM-owned deep link for requesting this entitlement. Writable by IAM. */
@@ -5117,6 +5181,8 @@ type AuthzScimGroupExtension = {
 	assignableSubjectTypes?: SubjectType[];
 	/** AppDev advisory default principal kinds (subset of `assignableSubjectTypes`). Read-only to IAM. */
 	recommendedSubjectTypes?: SubjectType[];
+	/** AppDev custom attributes. Code seeds values; IAM may persist presentation overrides. */
+	attributes?: Record<string, unknown>;
 };
 type AccessRef<T> = string | T;
 /**
@@ -5161,28 +5227,28 @@ type CatalogChangeKind = OaaAccessTargetType;
 * Resource changes are NOT catalog changes: resources live in the application's own store and are
 * signaled through {@link ResourceProvider.changed} instead.
 */
-type CatalogChange = {
+type CatalogChange<TAttributes extends object = object> = {
 	op: "set";
 	kind: CatalogChangeKind;
-	entity: Group | Role | Permission;
-	previous: Group | Role | Permission | undefined;
+	entity: Group<TAttributes> | Role<TAttributes> | Permission<TAttributes>;
+	previous: Group<TAttributes> | Role<TAttributes> | Permission<TAttributes> | undefined;
 } | {
 	op: "delete";
 	kind: CatalogChangeKind;
-	entity: Group | Role | Permission;
+	entity: Group<TAttributes> | Role<TAttributes> | Permission<TAttributes>;
 };
 /** Listener invoked with a {@link CatalogChange} after a durable catalog write lands. */
-type CatalogChangeListener = (change: CatalogChange) => void;
-type AccessCatalogStore = {
-	groups: EntityStore<Group>;
-	roles: EntityStore<Role>;
-	permissions: EntityStore<Permission>;
+type CatalogChangeListener<TAttributes extends object = object> = (change: CatalogChange<TAttributes>) => void;
+type AccessCatalogStore<TAttributes extends object = object> = {
+	groups: EntityStore<Group<TAttributes>>;
+	roles: EntityStore<Role<TAttributes>>;
+	permissions: EntityStore<Permission<TAttributes>>;
 	/**
 	* Reactive change subscription (the catalog analog of {@link ReactiveHandle}). When implemented,
 	* the SDK subscribes once at wiring time and projects each change to OAA and ready IAM delta.
 	* Stores that omit it rely on later full sync/reconcile. Returns an unsubscribe function.
 	*/
-	afterChange?(listener: CatalogChangeListener): () => void;
+	afterChange?(listener: CatalogChangeListener<TAttributes>): () => void;
 };
 /** A resource change signaled by a {@link ResourceProvider} after the app's own write lands. */
 type ResourceChange = {
@@ -6126,4 +6192,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { workloadTokenResponseSchema, workloadResourceSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, remoteConfigSecretType, readyCatalogEntry, parseKmsPoolDocument, parseKmsPoolControlDocument, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, mergeCodeCatalogEntity, materializeCodeCatalogEntity, matchesListFilter, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, getCodeCatalogEntity, generateULID, formatEcid, deprecateRetiredCodeCatalogRows, defineSecretType, defineCatalog, defaultSecretContentType, defaultLogger, deepEqualPlain, decodeUser, debugLogger, customerResourceSchema, configTrustedClientGrants, claimsToUser, catalogEntityStore, buildTenantPath, assertValidSubjectTypeScoping, assertRequiredSubjectType, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsWriteOptions, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretTypeRegistryEntry, SecretTypeInput, SecretTypeDescriptor, SecretRequestSeverity, SecretLifecycleRequest, SecretHandle, SecretFormat, SecretEventName, SecretEventListener, SecretEvent, SecretContentTypeMismatchError, SecretContentType, Secret, ScimWorkload, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimCustomer, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, PrincipalInboundHandlerConfig, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaPrincipalPopulation, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MirrorConfigLocator, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsRevokeKeyResult, KmsRevokeKeyRequest, KmsPoolSlot, KmsPoolListener, KmsPoolIssuer, KmsPoolDocument, KmsPoolControlDocument, KmsPoolConfig, KmsPool, KmsParkResult, KmsParkRequest, KmsParkReport, KmsParkDisposition, KmsKeyState, KmsKey, KmsIssuerEventName, KmsIssuerEventListener, KmsIssuerEvent, KmsIssuedKey, KmsConfig, KmsAllocationStrategy, KmsAllocationPolicy, KmsAddKeysResult, KmsAddKeysRequest, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InferSecretType, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamPrincipalKindFlag, IamPrincipalKind, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaReconcileInput, IamDeltaMode, IamDeltaEmitter, IamAssignmentPolicy, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_WORKLOAD_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_CUSTOMER_SCHEMA, ION_IAM_WORKLOADS_WRITE, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_ACCESS_REQUESTS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMPrincipalsInbound, IAMInboundWorkloadsConfig, IAMInboundUsersConfig, IAMInboundUserContext, IAMInboundPrincipalContext, IAMInboundCustomersConfig, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMEndpointFlag, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAMAccessRequestsConfig, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DestinationReference, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_SECRET_MIME_TYPES, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogEntityKind, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaPrincipalConfig, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, AssignmentPolicyError, ApplicationValidators, Address, AccessStatus, AccessRequestSubmit, AccessRequestResult, AccessRequestCreate, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };
+export { AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestSubmit, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DestinationReference, DevSecretsConfig, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantIonCache, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UpdateTenantRequest, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, catalogEntityStore, claimsToUser, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeUser, deepEqualPlain, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, readyCatalogEntry, remoteConfigSecretType, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1 +1,2 @@
-import{$ as Q1,A as v0,B as A0,C as w0,D as O0,E as _0,F as g0,G as y0,H as h0,I as p0,J as c0,K as m0,L as d0,M as u0,N as l0,O as o0,P as a0,Q as n0,R as i0,S as s0,T as r0,U as t0,V as e0,W as J1,X as X1,_ as $1,a as q0,aa as B1,b as j0,ba as V1,c as z0,ca as Z1,d as U0,da as H1,e as Y0,ea as G1,f as C0,g as K0,h as P0,i as M0,j as D0,k as W0,l as x0,m as b0,n as E0,o as S0,p as L0,q as N0,r as R0,s as I0,t as T0,u as k0,z as f0}from"./shared/core-ys2a23v0.js";var g="0.0.24-beta.20260910.1";class Y extends Error{kind;recoverable;code;status;path;sourceType;constructor(J,$){super(J,$.cause!==void 0?{cause:$.cause}:void 0);this.name="ConfigSourceError",this.kind=$.kind,this.recoverable=$.recoverable,this.code=$.code,this.status=$.status,this.path=$.path,this.sourceType=$.sourceType,Object.setPrototypeOf(this,Y.prototype)}}function y(J){return J instanceof Y}var G=["workload"],K={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:G,recommendedSubjectTypes:G},P={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},M={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},D={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},W={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},x={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:G,recommendedSubjectTypes:G},b={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:G,recommendedSubjectTypes:G},E={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:G},S={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:G,recommendedSubjectTypes:G},L={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},h=[K,P,M,D,W,x,b,E,S,L],p={"iam.read":{permission:K,subjectType:["workload"]},"iam.users.write":{permission:P,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"iam.workloads.write":{permission:D,subjectType:["workload"]},"iam.customers.write":{permission:W,subjectType:["workload"]},"iam.access-requests.write":{permission:x,subjectType:["workload"]},"capabilitiez.read":{permission:b,subjectType:["workload"]},"ciam.magic-link.create":{permission:E,subjectType:["workload","user"]},"authz.oaa.sync":{permission:S,subjectType:["workload"]},"tenant.manage":{permission:L,subjectType:["workload"]}};var c=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function I(J){if(J===null||typeof J!=="object")return J;let $={};for(let[X,Q]of Object.entries(J)){if(c.includes(X)||X==="validators"||X==="setStores")continue;$[X]=Q!==null&&typeof Q==="object"&&!Array.isArray(Q)&&Object.getPrototypeOf(Q)===Object.prototype?I(Q):Q}return $}function m(J){return I(J)}function C(J,$){if(!J||typeof J!=="object"||Array.isArray(J))throw Error(`${$} must be an object.`);return J}function j(J,$){if(J===void 0)return;if(typeof J!=="string"||J.length===0||!Number.isFinite(Date.parse(J)))throw Error(`${$} must be a valid timestamp string.`);return J}function T(J,$,X){if(!Array.isArray(J)||!X.allowEmpty&&J.length===0)throw Error(`${$} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let Q=new Set;return J.map((Z,B)=>{let V=C(Z,`${$} keys[${B}]`);if(typeof V.id!=="string"||V.id.length===0)throw Error(`${$} keys[${B}].id must be a non-empty string.`);if(Q.has(V.id))throw Error(`${$} contains duplicate key id "${V.id}".`);if(Q.add(V.id),!["pending","active","deprecated","rotated","revoked"].includes(String(V.state)))throw Error(`${$} keys[${B}].state is invalid.`);if(V.value!==void 0&&(typeof V.value!=="string"||V.value.length===0))throw Error(`${$} keys[${B}].value must be a non-empty string when present.`);let F=V.meta===void 0?void 0:C(V.meta,`${$} keys[${B}].meta`);return{id:V.id,state:V.state,...V.value===void 0?{}:{value:V.value},...V.notBefore===void 0?{}:{notBefore:j(V.notBefore,`${$} keys[${B}].notBefore`)},...V.notAfter===void 0?{}:{notAfter:j(V.notAfter,`${$} keys[${B}].notAfter`)},...V.createdAt===void 0?{}:{createdAt:j(V.createdAt,`${$} keys[${B}].createdAt`)},...V.activatedAt===void 0?{}:{activatedAt:j(V.activatedAt,`${$} keys[${B}].activatedAt`)},...V.deprecatedAt===void 0?{}:{deprecatedAt:j(V.deprecatedAt,`${$} keys[${B}].deprecatedAt`)},...V.rotatedAt===void 0?{}:{rotatedAt:j(V.rotatedAt,`${$} keys[${B}].rotatedAt`)},...V.revokedAt===void 0?{}:{revokedAt:j(V.revokedAt,`${$} keys[${B}].revokedAt`)},...F?{meta:{...F}}:{}}})}function d(J,$,X){if(J===void 0)return;if(!Array.isArray(J))throw Error(`${X} slots must be an array.`);let Q=new Set,Z=J.map((B,V)=>{if(B===null)return null;if(typeof B!=="string"||B.length===0)throw Error(`${X} slots[${V}] must be a non-empty key id or null.`);if(Q.has(B))throw Error(`${X} slots contain duplicate key id "${B}".`);Q.add(B);let F=$.find((H)=>H.id===B);if(!F)throw Error(`${X} slot key "${B}" is not present in keys.`);if(F.state!=="active")throw Error(`${X} slot key "${B}" must have state "active".`);if(!F.value)throw Error(`${X} slot key "${B}" must include a value.`);return B});if($.length===0&&Z.some((B)=>B!==null))throw Error(`${X} slots must be omitted or all-null when keys is empty.`);return Z}function u(J){let X=C(J,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let Q=T(X.keys,"KMS pool",{allowEmpty:!0}),Z=d(X.slots,Q,"KMS pool");return Z?{kind:"kms",slots:Z,keys:Q}:{kind:"kms",keys:Q}}function l(J){let X=C(J,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:T(X.keys,"KMS pool control document",{allowEmpty:!0})}}var k={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},o=k,a={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},n={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},i={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function s(J,$){if(typeof $!=="number"||$<=0)return J;return new Promise((X,Q)=>{let Z=setTimeout(()=>{Q(Error(`Authz catalog entry did not become ready within ${$}ms`))},$);J.then(()=>{clearTimeout(Z),X()},(B)=>{clearTimeout(Z),Q(B)})})}function r(J,$){let X=!1,Q,Z=$.then(()=>{X=!0},(V)=>{X=!1,Q=V}),B=J;return Object.defineProperty(B,"ready",{enumerable:!1,configurable:!0,value:(V)=>s(Z.then(()=>{if(!X)throw Q}),V)}),Object.defineProperty(B,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),B}var N=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function R(J){if(!J.id.trim())throw Error("defineSecretType: id is required");let $=J.mimeType?.trim()||N[J.format],X=Object.freeze({id:J.id,...J.label?{label:J.label}:{},format:J.format,mimeType:$,...J.schemaUrl?{schemaUrl:J.schemaUrl}:{},typeId:J.id});return Object.freeze({id:J.id,...J.label?{label:J.label}:{},format:J.format,mimeType:$,...J.schemaUrl?{schemaUrl:J.schemaUrl}:{},...J.schema?{schema:J.schema}:{},toRegistryEntry:()=>X})}function t(J="jsonc"){return{format:J,mimeType:N[J],typeId:J}}class f extends Error{expected;received;constructor(J,$){super(`Secret content type mismatch: expected "${J.mimeType}" (${J.format}) but received "${$.mimeType}" (${$.format})`);this.name="SecretContentTypeMismatchError",this.expected=J,this.received=$}}var e=R({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var A={beforeTenantSegments:["ui"]},w={beforeTenantSegments:["api"]};function v(J){return(J??[]).map(($)=>$.trim()).filter(Boolean)}function J0(J){let $=J.trim();if(!$)return"/";let X=$.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function O(J){return J0(J).split("/").filter(Boolean)}function U(J){return{beforeTenantSegments:v(J?.beforeTenantSegments),afterTenantSegments:v(J?.afterTenantSegments)}}function X0(J){return{type:"path",ui:U(J?.ui??A),api:U(J?.api??w)}}function $0(J,$){let X=U($),Q=X.beforeTenantSegments??[],Z=X.afterTenantSegments??[],B=O(J),V=Q.length+1+Z.length;if(B.length<V)return null;for(let q=0;q<Q.length;q++)if(B[q]!==Q[q])return null;let F=Q.length,H=B[F];if(!H)return null;for(let q=0;q<Z.length;q++)if(B[F+1+q]!==Z[q])return null;let z=B.slice(F+1+Z.length);return{id:decodeURIComponent(H),restSegments:z,restPath:z.length>0?`/${z.join("/")}`:"/"}}function Q0(J,$="/",X){let Q=U(X),Z=Q.beforeTenantSegments??[],B=Q.afterTenantSegments??[],V=O($),F=[...Z,encodeURIComponent(J),...B,...V];return F.length>0?`/${F.join("/")}`:"/"}function B0(J){return{"~standard":{version:1,vendor:J,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let X=$,Q=[],Z={...X},B=["iss","sub"];for(let H of B)if(H in X){if(typeof X[H]!=="string")Q.push({message:`${H} must be a string`,path:[H]})}else Q.push({message:`${H} is required`,path:[H]});if("aud"in X&&X.aud!==void 0){let H=X.aud;if(typeof H!=="string"&&!Array.isArray(H))Q.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(H)&&!H.every((z)=>typeof z==="string"))Q.push({message:"aud array must contain only strings",path:["aud"]})}let V=["jti","scope"];for(let H of V)if(H in X&&X[H]!==void 0){if(typeof X[H]!=="string")Q.push({message:`${H} must be a string`,path:[H]})}let F=["exp","iat"];for(let H of F)if(H in X){if(typeof X[H]!=="number")Q.push({message:`${H} must be a number`,path:[H]})}else Q.push({message:`${H} is required`,path:[H]});if(Q.length>0)return{issues:Q};return{value:Z}}}}}function V0(J){return{"~standard":{version:1,vendor:J,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let X=$,Q=[],Z={};if("access_token"in X)if(typeof X.access_token==="string")Z.access_token=X.access_token;else Q.push({message:"access_token must be a string",path:["access_token"]});else Q.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")Z.token_type=X.token_type;else Q.push({message:"token_type must be a string",path:["token_type"]});else Q.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)Z.scope=X.scope;else Q.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)Z.refresh_token=X.refresh_token;else Q.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)Z.expires=X.expires;else Q.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)Z.expires_in=X.expires_in;else Q.push({message:"expires_in must be a number",path:["expires_in"]});if(Q.length>0)return{issues:Q};return{value:Z}}}}}function Z0(J){let $=new Uint8Array(J);return crypto.getRandomValues($),$}function H0(J){let $="",X=Z0(J);for(let Q=0;Q<J;Q++){let Z=X[Q]%32;$+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)}return $}function G0(J,$){let X="";for(let Q=$;Q>0;Q--){let Z=J%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)+X,J=Math.floor(J/32)}return X}function F0(J){let $=Date.now(),X=G0($,10),Q=H0(16);return`${J??""}${X}${Q}`}export{V0 as workloadTokenResponseSchema,H1 as workloadResourceSchema,p0 as withValidate,i as warnLogger,i0 as waitOn,g as version,m0 as validationFailureResponse,V1 as userSchema,I0 as unionCatalogRead,q0 as trustedClientPermissionsForPrincipal,o0 as trimTrailingSlash,y0 as tokenResponseSchema,x0 as toCodeCatalog,u0 as stripJsonComments,n0 as stableConfigHash,k as silentLogger,m as serializeConfig,e as remoteConfigSecretType,r as readyCatalogEntry,u as parseKmsPoolDocument,l as parseKmsPoolControlDocument,l0 as parseJsonc,O0 as parseEcid,g0 as oidcCallbackSchema,X0 as normalizeTenantRoutingStrategy,U as normalizeTenantPathNamespace,c0 as must,d0 as mergeConfig,L0 as mergeCodeCatalogEntity,N0 as materializeCodeCatalogEntity,Y0 as matchesListFilter,$0 as matchTenantPath,U0 as listGenerator,z0 as list,B0 as jwtAssertionClaimsSchema,e0 as isStoreConflictError,A0 as isEcid,y as isConfigSourceError,X1 as isConfigLocator,W0 as isCodeCatalog,n as infoLogger,h0 as idTokenClaimsSchema,Z1 as groupResourceSchema,E0 as getCodeCatalogEntity,F0 as generateULID,w0 as formatEcid,R0 as deprecateRetiredCodeCatalogRows,R as defineSecretType,b0 as defineCatalog,t as defaultSecretContentType,o as defaultLogger,a0 as deepEqualPlain,r0 as decodeUser,a as debugLogger,G1 as customerResourceSchema,j0 as configTrustedClientGrants,s0 as claimsToUser,S0 as catalogEntityStore,Q0 as buildTenantPath,P0 as assertValidSubjectTypeScoping,M0 as assertRequiredSubjectType,_0 as assertEcid,k0 as accessRootId,T0 as accessRefId,t0 as StoreConflictError,f as SecretContentTypeMismatchError,K0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,J1 as IoniteError,L as ION_TENANT_MANAGE,h as ION_SDK_PERMISSIONS,Q1 as ION_SCIM_WORKLOAD_SCHEMA,$1 as ION_SCIM_USER_EXTENSION_URN,B1 as ION_SCIM_CUSTOMER_SCHEMA,D as ION_IAM_WORKLOADS_WRITE,P as ION_IAM_USERS_WRITE,K as ION_IAM_READ,M as ION_IAM_GROUPS_WRITE,W as ION_IAM_CUSTOMERS_WRITE,x as ION_IAM_ACCESS_REQUESTS_WRITE,p as ION_ENDPOINT_PERMISSIONS,E as ION_CIAM_MAGIC_LINK_CREATE,b as ION_CAPABILITIEZ_READ,S as ION_AUTHZ_OAA_SYNC,C0 as ION_AUTHZ_GROUP_SCHEMA,v0 as EcidFormatError,f0 as ECID_SCHEME,A as DEFAULT_TENANT_UI_NAMESPACE,w as DEFAULT_TENANT_API_NAMESPACE,N as DEFAULT_SECRET_MIME_TYPES,Y as ConfigSourceError,D0 as AssignmentPolicyError};
+import{E,X,o,y,h,S,n,R,i,Q,U,u,e,d,q,j,V,F,ee,J,A,I,g,v,M,x,r,c,re,b,H,ne,se,k,N,L,l,a,t,D,oe,Y,ie,w,C,ae,ce,P,ue,p,T,G,B,s,m,f,le,pe,K,W}from"./shared/core-mybn3422.js";var He="0.0.24-beta.20260915.3";class Ae extends Error{constructor(O,_){super(O,_.cause!==void 0?{cause:_.cause}:void 0);this.name="ConfigSourceError",this.kind=_.kind,this.recoverable=_.recoverable,this.code=_.code,this.status=_.status,this.path=_.path,this.sourceType=_.sourceType,Object.setPrototypeOf(this,Ae.prototype)}}function Je(O){return O instanceof Ae}var fe=["workload"],Ee={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Ie={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},we={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},xe={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Pe={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Oe={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},_e={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},ve={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:fe},Ke={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Me={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Ye=[Ee,Ie,we,xe,Pe,Oe,_e,ve,Ke,Me],Ze={"iam.read":{permission:Ee,subjectType:["workload"]},"iam.users.write":{permission:Ie,subjectType:["workload"]},"iam.groups.write":{permission:we,subjectType:["workload"]},"iam.workloads.write":{permission:xe,subjectType:["workload"]},"iam.customers.write":{permission:Pe,subjectType:["workload"]},"iam.access-requests.write":{permission:Oe,subjectType:["workload"]},"capabilitiez.read":{permission:_e,subjectType:["workload"]},"ciam.magic-link.create":{permission:ve,subjectType:["workload","user"]},"authz.oaa.sync":{permission:Ke,subjectType:["workload"]},"tenant.manage":{permission:Me,subjectType:["workload"]}};var Qe=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function De(O){if(O===null||typeof O!=="object")return O;let _={};for(let[z,Z]of Object.entries(O)){if(Qe.includes(z)||z==="validators"||z==="setStores")continue;_[z]=Z!==null&&typeof Z==="object"&&!Array.isArray(Z)&&Object.getPrototypeOf(Z)===Object.prototype?De(Z):Z}return _}function Xe(O){return De(O)}function he(O,_){if(!O||typeof O!=="object"||Array.isArray(O))throw Error(`${_} must be an object.`);return O}function ke(O,_){if(O===void 0)return;if(typeof O!=="string"||O.length===0||!Number.isFinite(Date.parse(O)))throw Error(`${_} must be a valid timestamp string.`);return O}function We(O,_,z){if(!Array.isArray(O)||!z.allowEmpty&&O.length===0)throw Error(`${_} keys must be ${z.allowEmpty?"an":"a non-empty"} array.`);let Z=new Set;return O.map((de,te)=>{let me=he(de,`${_} keys[${te}]`);if(typeof me.id!=="string"||me.id.length===0)throw Error(`${_} keys[${te}].id must be a non-empty string.`);if(Z.has(me.id))throw Error(`${_} contains duplicate key id "${me.id}".`);if(Z.add(me.id),!["pending","active","deprecated","rotated","revoked"].includes(String(me.state)))throw Error(`${_} keys[${te}].state is invalid.`);if(me.value!==void 0&&(typeof me.value!=="string"||me.value.length===0))throw Error(`${_} keys[${te}].value must be a non-empty string when present.`);let ye=me.meta===void 0?void 0:he(me.meta,`${_} keys[${te}].meta`);return{id:me.id,state:me.state,...me.value===void 0?{}:{value:me.value},...me.notBefore===void 0?{}:{notBefore:ke(me.notBefore,`${_} keys[${te}].notBefore`)},...me.notAfter===void 0?{}:{notAfter:ke(me.notAfter,`${_} keys[${te}].notAfter`)},...me.createdAt===void 0?{}:{createdAt:ke(me.createdAt,`${_} keys[${te}].createdAt`)},...me.activatedAt===void 0?{}:{activatedAt:ke(me.activatedAt,`${_} keys[${te}].activatedAt`)},...me.deprecatedAt===void 0?{}:{deprecatedAt:ke(me.deprecatedAt,`${_} keys[${te}].deprecatedAt`)},...me.rotatedAt===void 0?{}:{rotatedAt:ke(me.rotatedAt,`${_} keys[${te}].rotatedAt`)},...me.revokedAt===void 0?{}:{revokedAt:ke(me.revokedAt,`${_} keys[${te}].revokedAt`)},...ye?{meta:{...ye}}:{}}})}function et(O,_,z){if(O===void 0)return;if(!Array.isArray(O))throw Error(`${z} slots must be an array.`);let Z=new Set,de=O.map((te,me)=>{if(te===null)return null;if(typeof te!=="string"||te.length===0)throw Error(`${z} slots[${me}] must be a non-empty key id or null.`);if(Z.has(te))throw Error(`${z} slots contain duplicate key id "${te}".`);Z.add(te);let ye=_.find((ge)=>ge.id===te);if(!ye)throw Error(`${z} slot key "${te}" is not present in keys.`);if(ye.state!=="active")throw Error(`${z} slot key "${te}" must have state "active".`);if(!ye.value)throw Error(`${z} slot key "${te}" must include a value.`);return te});if(_.length===0&&de.some((te)=>te!==null))throw Error(`${z} slots must be omitted or all-null when keys is empty.`);return de}function tt(O){let z=he(O,"KMS pool");if(z.kind!=="kms")throw Error('KMS pool kind must be "kms".');let Z=We(z.keys,"KMS pool",{allowEmpty:!0}),de=et(z.slots,Z,"KMS pool");return de?{kind:"kms",slots:de,keys:Z}:{kind:"kms",keys:Z}}function ot(O){let z=he(O,"KMS pool control document");if(z.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:We(z.keys,"KMS pool control document",{allowEmpty:!0})}}var rt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function $e(O){if(typeof O==="string")return O;try{return JSON.stringify(O)??String(O)}catch{return String(O)}}function be(O){let _=$e(O);return/^[A-Za-z0-9_./:@+|-]+$/.test(_)?_:JSON.stringify(_)}function nt(O){return $e(O).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function je(O,_,z){if(z==null)return;if(z instanceof Error){if(O.push(`${_}.name=${be(z.name)}`),O.push(`${_}.message=${be(z.message)}`),z.stack)O.push(`${_}.stack=${be(z.stack)}`);return}O.push(`${_}=${be(z)}`)}function Re(O,_,z=[],Z=new Date){let de=nt(_ instanceof Error?_.message:_??""),te=[];for(let[me,ye]of z.entries()){if(ye&&typeof ye==="object"&&!Array.isArray(ye)&&!(ye instanceof Error)&&Object.getPrototypeOf(ye)===Object.prototype){for(let[ge,Ce]of Object.entries(ye))je(te,ge,Ce);continue}je(te,`param.${me}`,ye)}return[Z.toISOString(),rt[O],de,...te].filter(Boolean).join(" ")}var Ue={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},st=Ue,it={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},at={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},pt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},ct={trace:()=>{},debug:(O,..._)=>globalThis.console.debug(Re("debug",O,_)),info:(O,..._)=>globalThis.console.info(Re("info",O,_)),warn:(O,..._)=>globalThis.console.warn(Re("warn",O,_)),error:(O,..._)=>globalThis.console.error(Re("error",O,_))};function mt(O,_){if(typeof _!=="number"||_<=0)return O;return new Promise((z,Z)=>{let de=setTimeout(()=>{Z(Error(`Authz catalog entry did not become ready within ${_}ms`))},_);O.then(()=>{clearTimeout(de),z()},(te)=>{clearTimeout(de),Z(te)})})}function ut(O,_){let z=!1,Z,de=_.then(()=>{z=!0},(me)=>{z=!1,Z=me}),te=O;return Object.defineProperty(te,"ready",{enumerable:!1,configurable:!0,value:(me)=>mt(de.then(()=>{if(!z)throw Z}),me)}),Object.defineProperty(te,"isReady",{enumerable:!1,configurable:!0,value:()=>z}),te}var Ne=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function Le(O){if(!O.id.trim())throw Error("defineSecretType: id is required");let _=O.mimeType?.trim()||Ne[O.format],z=Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:_,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},typeId:O.id});return Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:_,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},...O.schema?{schema:O.schema}:{},toRegistryEntry:()=>z})}function dt(O="jsonc"){return{format:O,mimeType:Ne[O],typeId:O}}class qe extends Error{constructor(O,_){super(`Secret content type mismatch: expected "${O.mimeType}" (${O.format}) but received "${_.mimeType}" (${_.format})`);this.name="SecretContentTypeMismatchError",this.expected=O,this.received=_}}var lt=Le({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Fe={beforeTenantSegments:["ui"]},Ge={beforeTenantSegments:["api"]};function ze(O){return(O??[]).map((_)=>_.trim()).filter(Boolean)}function gt(O){let _=O.trim();if(!_)return"/";let z=_.replace(/\\/g,"/").replace(/\/+/g,"/");return z.startsWith("/")?z:`/${z}`}function Ve(O){return gt(O).split("/").filter(Boolean)}function Te(O){return{beforeTenantSegments:ze(O?.beforeTenantSegments),afterTenantSegments:ze(O?.afterTenantSegments)}}function yt(O){return{type:"path",ui:Te(O?.ui??Fe),api:Te(O?.api??Ge)}}function ft(O,_){let z=Te(_),Z=z.beforeTenantSegments??[],de=z.afterTenantSegments??[],te=Ve(O),me=Z.length+1+de.length;if(te.length<me)return null;for(let Se=0;Se<Z.length;Se++)if(te[Se]!==Z[Se])return null;let ye=Z.length,ge=te[ye];if(!ge)return null;for(let Se=0;Se<de.length;Se++)if(te[ye+1+Se]!==de[Se])return null;let Ce=te.slice(ye+1+de.length);return{id:decodeURIComponent(ge),restSegments:Ce,restPath:Ce.length>0?`/${Ce.join("/")}`:"/"}}function St(O,_="/",z){let Z=Te(z),de=Z.beforeTenantSegments??[],te=Z.afterTenantSegments??[],me=Ve(_),ye=[...de,encodeURIComponent(O),...te,...me];return ye.length>0?`/${ye.join("/")}`:"/"}function Ct(O){return{"~standard":{version:1,vendor:O,validate:(_)=>{if(typeof _!=="object"||_===null)return{issues:[{message:"Expected an object"}]};let z=_,Z=[],de={...z},te=["iss","sub"];for(let ge of te)if(ge in z){if(typeof z[ge]!=="string")Z.push({message:`${ge} must be a string`,path:[ge]})}else Z.push({message:`${ge} is required`,path:[ge]});if("aud"in z&&z.aud!==void 0){let ge=z.aud;if(typeof ge!=="string"&&!Array.isArray(ge))Z.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ge)&&!ge.every((Ce)=>typeof Ce==="string"))Z.push({message:"aud array must contain only strings",path:["aud"]})}let me=["jti","scope"];for(let ge of me)if(ge in z&&z[ge]!==void 0){if(typeof z[ge]!=="string")Z.push({message:`${ge} must be a string`,path:[ge]})}let ye=["exp","iat"];for(let ge of ye)if(ge in z){if(typeof z[ge]!=="number")Z.push({message:`${ge} must be a number`,path:[ge]})}else Z.push({message:`${ge} is required`,path:[ge]});if(Z.length>0)return{issues:Z};return{value:de}}}}}function kt(O){return{"~standard":{version:1,vendor:O,validate:(_)=>{if(typeof _!=="object"||_===null)return{issues:[{message:"Expected an object"}]};let z=_,Z=[],de={};if("access_token"in z)if(typeof z.access_token==="string")de.access_token=z.access_token;else Z.push({message:"access_token must be a string",path:["access_token"]});else Z.push({message:"access_token is required",path:["access_token"]});if("token_type"in z)if(typeof z.token_type==="string")de.token_type=z.token_type;else Z.push({message:"token_type must be a string",path:["token_type"]});else Z.push({message:"token_type is required",path:["token_type"]});if("scope"in z)if(typeof z.scope==="string"||z.scope===void 0)de.scope=z.scope;else Z.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in z)if(typeof z.refresh_token==="string"||z.refresh_token===void 0)de.refresh_token=z.refresh_token;else Z.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in z)if(typeof z.expires==="string"||z.expires===void 0)de.expires=z.expires;else Z.push({message:"expires must be a string",path:["expires"]});if("expires_in"in z)if(typeof z.expires_in==="number"||z.expires_in===void 0)de.expires_in=z.expires_in;else Z.push({message:"expires_in must be a number",path:["expires_in"]});if(Z.length>0)return{issues:Z};return{value:de}}}}}function Rt(O){let _=new Uint8Array(O);return crypto.getRandomValues(_),_}function Tt(O){let _="",z=Rt(O);for(let Z=0;Z<O;Z++){let de=z[Z]%32;_+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(de)}return _}function At(O,_){let z="";for(let Z=_;Z>0;Z--){let de=O%32;z="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(de)+z,O=Math.floor(O/32)}return z}function ht(O){let _=Date.now(),z=At(_,10),Z=Tt(16);return`${O??""}${z}${Z}`}export{V as AssignmentPolicyError,U as CANONICAL_RISK_LEVELS,Ae as ConfigSourceError,u as DEFAULT_RISK_LEVEL,Ne as DEFAULT_SECRET_MIME_TYPES,Ge as DEFAULT_TENANT_API_NAMESPACE,Fe as DEFAULT_TENANT_UI_NAMESPACE,re as ECID_SCHEME,b as EcidFormatError,e as ION_AUTHZ_GROUP_SCHEMA,Ke as ION_AUTHZ_OAA_SYNC,_e as ION_CAPABILITIEZ_READ,ve as ION_CIAM_MAGIC_LINK_CREATE,Ze as ION_ENDPOINT_PERMISSIONS,Oe as ION_IAM_ACCESS_REQUESTS_WRITE,Pe as ION_IAM_CUSTOMERS_WRITE,we as ION_IAM_GROUPS_WRITE,Ee as ION_IAM_READ,Ie as ION_IAM_USERS_WRITE,xe as ION_IAM_WORKLOADS_WRITE,f as ION_SCIM_CUSTOMER_SCHEMA,s as ION_SCIM_USER_EXTENSION_URN,m as ION_SCIM_WORKLOAD_SCHEMA,Ye as ION_SDK_PERMISSIONS,Me as ION_TENANT_MANAGE,G as IoniteError,h as KNOWN_BASE_CUSTOMER_KEYS,y as KNOWN_BASE_USER_KEYS,o as KNOWN_ENTITLEMENT_KEYS,S as KNOWN_WORKLOAD_KEYS,d as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,qe as SecretContentTypeMismatchError,p as StoreConflictError,r as accessRefId,c as accessRootId,k as assertEcid,j as assertRequiredSubjectType,q as assertValidSubjectTypeScoping,St as buildTenantPath,I as catalogEntityStore,P as claimsToUser,X as configTrustedClientGrants,n as customAttributes,W as customerResourceSchema,it as debugLogger,ue as decodeUser,C as deepEqualPlain,st as defaultLogger,dt as defaultSecretContentType,J as defineCatalog,Le as defineSecretType,M as deprecateRetiredCodeCatalogRows,ne as formatEcid,Re as formatLogLine,ht as generateULID,A as getCodeCatalogEntity,pe as groupResourceSchema,l as idTokenClaimsSchema,at as infoLogger,F as isCodeCatalog,B as isConfigLocator,Je as isConfigSourceError,H as isEcid,T as isStoreConflictError,Ct as jwtAssertionClaimsSchema,R as list,i as listGenerator,ft as matchTenantPath,Q as matchesListFilter,v as materializeCodeCatalogEntity,g as mergeCodeCatalogEntity,oe as mergeConfig,t as must,Te as normalizeTenantPathNamespace,yt as normalizeTenantRoutingStrategy,N as oidcCallbackSchema,se as parseEcid,ie as parseJsonc,ot as parseKmsPoolControlDocument,tt as parseKmsPoolDocument,ct as prettyLogger,ut as readyCatalogEntry,lt as remoteConfigSecretType,Xe as serializeConfig,Ue as silentLogger,ae as stableConfigHash,Y as stripJsonComments,ee as toCodeCatalog,L as tokenResponseSchema,w as trimTrailingSlash,E as trustedClientPermissionsForPrincipal,x as unionCatalogRead,le as userSchema,D as validationFailureResponse,He as version,ce as waitOn,pt as warnLogger,a as withValidate,K as workloadResourceSchema,kt as workloadTokenResponseSchema};