@ionite/core 0.0.24-beta.20260915.2 → 0.0.24-beta.20260915.3

package/dist/index.d.ts

@@ -1,4 +1,19 @@
 import { version } from "../package.json";
+/**
+* Reject SDK-owned names in extension-only types. Principal stores also accept validator-inferred
+* complete object types, identified by `TFullShapeKeys`; their SDK fields are removed before merge.
+*/
+type NoReserved<
+	TAttributes,
+	TReserved extends PropertyKey,
+	TFullShapeKeys extends PropertyKey = never
+> = TAttributes extends object ? [TFullShapeKeys] extends [never] ? TAttributes & { [TKey in Extract<keyof TAttributes, TReserved>]? : never } : [TFullShapeKeys] extends [keyof TAttributes] ? Omit<TAttributes, TReserved> : TAttributes & { [TKey in Extract<keyof TAttributes, TReserved>]? : never } : TAttributes;
+declare const KNOWN_ENTITLEMENT_KEYS: readonly ["id", "name", "displayName", "description", "providerId", "source", "deprecated", "type", "parent", "resources", "assignableSubjectTypes", "recommendedSubjectTypes", "requestable", "riskLevel", "requestUrl", "action", "permissionTypes", "resourceTypes", "applyToSubResources", "permissions", "groups", "roles"];
+declare const KNOWN_BASE_USER_KEYS: readonly ["id", "userName", "name", "email", "avatar", "userType", "tenantId", "externalId", "providerId", "requestUrl", "ecid", "accountClass", "displayName", "scimName", "emails", "nickName", "active", "title", "preferredLanguage", "locale", "timezone", "phoneNumbers", "ims", "photos", "addresses", "roles", "groups", "entitlements", "x509Certificates", "scimEnterprise", "scimSchemaExtensions", "createdAt", "updatedAt", "sso"];
+declare const KNOWN_BASE_CUSTOMER_KEYS: readonly ["id", "userName", "name", "email", "avatar", "userType", "tenantId", "externalId", "providerId", "requestUrl", "displayName", "emails", "phoneNumbers", "active", "createdAt", "updatedAt", "ciam"];
+declare const KNOWN_WORKLOAD_KEYS: readonly ["id", "clientId", "displayName", "description", "externalId", "providerId", "requestUrl", "ecid", "active", "scopes", "createdAt", "updatedAt", "metadata"];
+/** Return the AppDev-owned, enumerable attributes on an object, omitting SDK keys and undefined values. */
+declare function customAttributes(value: object, knownKeys: readonly PropertyKey[]): Record<string, unknown> | undefined;
 import { StandardSchemaV1 as StandardSchemaV19 } from "@standard-schema/spec";
 import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
 /**
@@ -129,16 +144,16 @@ type CodeCatalogNamespace<TEntity> = {
 * Normalized, frozen code-declared catalog produced by {@link defineCatalog}. All entities are
 * deep-frozen and id-indexed.
 */
-type CodeCatalog = {
-	groups: CodeCatalogNamespace<Group>;
-	roles: CodeCatalogNamespace<Role>;
-	permissions: CodeCatalogNamespace<Permission>;
+type CodeCatalog<TAttributes extends object = object> = {
+	groups: CodeCatalogNamespace<Group<TAttributes>>;
+	roles: CodeCatalogNamespace<Role<TAttributes>>;
+	permissions: CodeCatalogNamespace<Permission<TAttributes>>;
 };
 /** Declarative input for {@link defineCatalog} (plain arrays authored in app code). */
-type CodeCatalogInput = {
-	groups?: readonly Group[];
-	roles?: readonly Role[];
-	permissions?: readonly Permission[];
+type CodeCatalogInput<TAttributes extends object = object> = {
+	groups?: readonly Group<TAttributes>[];
+	roles?: readonly Role<TAttributes>[];
+	permissions?: readonly Permission<TAttributes>[];
 };
 /** True when the value is already a normalized {@link CodeCatalog} (vs a declarative input). */
 declare function isCodeCatalog(value: CodeCatalog | CodeCatalogInput): value is CodeCatalog;
@@ -159,9 +174,9 @@ type CatalogEntityKind = "group" | "role" | "permission";
 * - every entitlement declares a required non-empty `assignableSubjectTypes` within the platform
 *   ceiling, and `recommendedSubjectTypes` is a subset of it.
 *
-* Side effects: every entity (and its arrays/metadata) is frozen.
+* Side effects: every entity and each directly-held array value is frozen.
 */
-declare function defineCatalog(input: CodeCatalogInput): CodeCatalog;
+declare function defineCatalog<TAttributes extends object = Record<string, unknown>>(input: CodeCatalogInput<NoInfer<TAttributes>>): CodeCatalog<TAttributes>;
 /** Resolve one code entity and its kind from the shared id space. */
 declare function getCodeCatalogEntity(code: CodeCatalog | undefined, id: string): {
 	entity: Group | Role | Permission;
@@ -181,9 +196,10 @@ declare function mergeCodeCatalogEntity<TEntity extends Group | Role | Permissio
 * rewritten, preserving IAM-authored presentation and receipts. `insertIfAbsent` closes the race
 * between the initial read and insert.
 *
-* Advisory presentation (`riskLevel`, `displayName`) is deliberately NOT persisted: on the durable
-* row an absent value means "no IAM override", so the merged read keeps following later code edits.
-* Snapshotting the seed here would freeze it — indistinguishable from an IAM-authored value.
+* Advisory presentation (`riskLevel`, `displayName`, and custom attributes) is deliberately NOT
+* persisted: on the durable row an absent value means "no IAM override", so the merged read keeps
+* following later code edits. Snapshotting the seed here would freeze it — indistinguishable from
+* an IAM-authored value.
 */
 declare function materializeCodeCatalogEntity<TEntity extends Group | Role | Permission>(kind: CatalogEntityKind, code: TEntity, store: EntityStore<TEntity>): Promise<TEntity>;
 /**
@@ -527,6 +543,8 @@ interface ScimWorkload {
 	requestUrl?: string;
 	/** Enterprise Controlled ID for workload correlation across datasources. */
 	ecid?: string;
+	/** AppDev custom attributes. App code seeds values; IAM may persist overrides. */
+	attributes?: Record<string, unknown>;
 	meta?: {
 		resourceType?: string;
 		created?: string;
@@ -547,6 +565,8 @@ interface ScimCustomer {
 	emails?: Email[];
 	providerId?: string;
 	requestUrl?: string;
+	/** AppDev custom attributes. App code seeds values; IAM may persist overrides. */
+	attributes?: Record<string, unknown>;
 	meta?: {
 		resourceType?: string;
 		created?: string;
@@ -664,6 +684,8 @@ interface IoniteUserExtension {
 	* `daily`, `privileged`, `break_glass`, `service`.
 	*/
 	accountClass?: string;
+	/** AppDev custom attributes. App code seeds values; IAM may persist overrides. */
+	attributes?: Record<string, unknown>;
 }
 /**
 * SCIM User Resource
@@ -1132,7 +1154,7 @@ type AuthenticatedPrincipal = AuthenticatedUser | WorkloadPrincipal;
 *
 * @template TExtended - Type-safe custom data that consumers can add to users
 */
-type BaseUser<TExtended = object> = BaseUserFields & {
+type BaseUserSdkFields = {
 	/**
 	* Optional ionite tenant identifier for tenant-aware apps.
 	* Built-in user stores can use this when registering HRD mappings.
@@ -1284,7 +1306,9 @@ type BaseUser<TExtended = object> = BaseUserFields & {
 	* Simple app stores MAY omit this field.
 	*/
 	sso?: WorkforceUser["sso"];
-} & TExtended;
+};
+type BaseUserReservedKey = keyof BaseUserFields | keyof BaseUserSdkFields;
+type BaseUser<TExtended = object> = BaseUserFields & BaseUserSdkFields & NoReserved<TExtended, BaseUserReservedKey, "userName" | "name" | "email">;
 type UserStoreOptions = {
 	tenantId: string;
 	tenants: TenantStore;
@@ -1367,7 +1391,7 @@ interface UserStore<TExtended = object> {
 *
 * @template TExtended - Type-safe custom data that consumers can add to workload identities.
 */
-type BaseWorkloadIdentity<TExtended = object> = {
+type BaseWorkloadIdentitySdkFields = {
 	/**
 	* Stable subject id for this workload. Used as the AccessIndex subject for
 	* `subjectType: 'workload'` checks. Typically `clientId`, a workload id, or the token `sub`.
@@ -1404,7 +1428,9 @@ type BaseWorkloadIdentity<TExtended = object> = {
 	updatedAt?: Date;
 	/** Optional free-form metadata bag. */
 	metadata?: Record<string, unknown>;
-} & TExtended;
+};
+type BaseWorkloadIdentityReservedKey = keyof BaseWorkloadIdentitySdkFields;
+type BaseWorkloadIdentity<TExtended = object> = BaseWorkloadIdentitySdkFields & NoReserved<TExtended, BaseWorkloadIdentityReservedKey, "id">;
 /**
 * Abstract interface for workload identity storage backends. Implement to back the registry with
 * in-memory, Redis, or a database. Mirrors {@link UserStore}.
@@ -4923,7 +4949,7 @@ type InMemoryTenantStoreOptions = {
 *
 * @template TExtended - Type-safe custom data that consumers can add to customers
 */
-type BaseCustomer<TExtended = object> = BaseUserFields & {
+type BaseCustomerSdkFields = {
 	/**
 	* Optional ionite tenant identifier for tenant-aware apps.
 	*/
@@ -4970,7 +4996,9 @@ type BaseCustomer<TExtended = object> = BaseUserFields & {
 	* Simple app stores MAY omit this field.
 	*/
 	ciam?: Customer["ciam"];
-} & TExtended;
+};
+type BaseCustomerReservedKey = keyof BaseUserFields | keyof BaseCustomerSdkFields;
+type BaseCustomer<TExtended = object> = BaseUserFields & BaseCustomerSdkFields & NoReserved<TExtended, BaseCustomerReservedKey, "userName" | "name" | "email">;
 type CustomerStoreOptions = {
 	tenantId: string;
 	tenants: TenantStore;
@@ -5023,7 +5051,7 @@ interface CustomerStore<TExtended = object> {
 	*/
 	list(options?: ListOptions): Promise<ListResult<BaseCustomer<TExtended>>>;
 }
-type AuthzEntityBase = {
+type AuthzEntityBaseFields = {
 	id: string;
 	name: string;
 	displayName?: string;
@@ -5034,39 +5062,13 @@ type AuthzEntityBase = {
 	source?: "code" | "app" | "scim";
 	/** A retired entitlement may be deleted by IAM after its grants have been removed. */
 	deprecated?: boolean;
-	metadata?: Record<string, unknown>;
 };
-type Resource = AuthzEntityBase & {
+type ResourceFields<TAttributes extends object = object> = {
 	type: string;
-	parent?: string | Resource;
-	resources?: Array<string | Resource>;
+	parent?: string | Resource<TAttributes>;
+	resources?: Array<string | Resource<TAttributes>>;
 };
-/**
-* AppDev-owned subject-type scoping shared by every catalog entitlement (group/role/permission).
-*
-* - `assignableSubjectTypes` is the AppDev **veto**: the hard, required, non-empty ceiling of
-*   principal kinds that may ever hold this entitlement. It is authored in application code and is
-*   **read-only** to the IAM tool (projected through SCIM as a `readOnly` attribute). There is no
-*   default-to-workforce and no unset-means-unrestricted: every entitlement declares its audience
-*   explicitly. A grant whose `subjectType` is outside this set is rejected.
-* - `recommendedSubjectTypes` is the AppDev **advisory default**: a (non-binding) subset of
-*   `assignableSubjectTypes` the IAM tool should default to. It is also read-only to IAM; the IAM
-*   tool is responsible for tracking changes to it over time. It MUST be a subset of
-*   `assignableSubjectTypes` (validated when the entitlement is authored).
-*/
-type SubjectTypeScoping = {
-	/** AppDev veto: required non-empty ceiling of principal kinds that may hold this entitlement (read-only to IAM). */
-	assignableSubjectTypes: SubjectType[];
-	/** AppDev advisory default principal kinds; must be a subset of `assignableSubjectTypes` (read-only to IAM). */
-	recommendedSubjectTypes?: SubjectType[];
-};
-/** Suggested IAM governance labels for an entitlement's advisory risk classification. */
-declare const CANONICAL_RISK_LEVELS: readonly ["basic", "elevated", "privileged", "admin"];
-/** Canonical IAM governance suggestions with autocomplete, while allowing AppDev-defined labels. */
-type RiskLevel = (typeof CANONICAL_RISK_LEVELS)[number] | (string & {});
-/** Risk projected to IAM when an entitlement does not declare or store an explicit classification. */
-declare const DEFAULT_RISK_LEVEL = "basic";
-type Permission = AuthzEntityBase & SubjectTypeScoping & {
+type EntitlementPresentationFields = {
 	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
 	requestable?: boolean;
 	/**
@@ -5076,6 +5078,8 @@ type Permission = AuthzEntityBase & SubjectTypeScoping & {
 	riskLevel?: RiskLevel;
 	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
 	requestUrl?: string;
+};
+type PermissionFields = EntitlementPresentationFields & {
 	action?: string;
 	/** Canonical OAA permission types (maps to OAA `permission_type`). */
 	permissionTypes?: string[];
@@ -5084,43 +5088,60 @@ type Permission = AuthzEntityBase & SubjectTypeScoping & {
 	/** When true, the permission also applies to a resource's sub-resources (maps to OAA `apply_to_sub_resources`). */
 	applyToSubResources?: boolean;
 };
-type Role = AuthzEntityBase & SubjectTypeScoping & {
-	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
-	requestable?: boolean;
-	/**
-	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
-	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
-	*/
-	riskLevel?: RiskLevel;
-	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
-	requestUrl?: string;
+type RoleFields<TAttributes extends object = object> = EntitlementPresentationFields & {
 	/** Permissions this role confers (definitional). Roles are flat bundles — OAA has no nested-role edge. */
-	permissions?: Array<string | Permission>;
+	permissions?: Array<string | Permission<TAttributes>>;
 };
-type Group = AuthzEntityBase & SubjectTypeScoping & {
-	/** True when this catalog entry should be exposed as requestable access in IAM tooling. */
-	requestable?: boolean;
-	/**
-	* Advisory access-risk classification. App code seeds the initial value; IAM may replace it after
-	* materialization. Unset values project to IAM as {@link DEFAULT_RISK_LEVEL}.
-	*/
-	riskLevel?: RiskLevel;
-	/** IAM-owned deep link where a principal can request this entitlement, when the destination provides one. */
-	requestUrl?: string;
+type GroupFields<TAttributes extends object = object> = EntitlementPresentationFields & {
 	/** Nested child groups composed into this group (definitional). */
-	groups?: Array<string | Group>;
+	groups?: Array<string | Group<TAttributes>>;
 	/** Roles this group confers (group is the principal). Projected as OAA `local_group` role assignments. */
-	roles?: Array<string | Role>;
+	roles?: Array<string | Role<TAttributes>>;
 	/** Permissions this group confers (group is the principal). Projected as OAA `local_group` application permissions. */
-	permissions?: Array<string | Permission>;
+	permissions?: Array<string | Permission<TAttributes>>;
 	/**
 	* Resource scope this entitlement binds to. When set, a member-add grant inherits these resources
 	* (so the conferred role/permissions are scoped to them), and OAA projects the group's role/
 	* permission assignments as resource-scoped (`apply_to_application: false`) rather than app-wide.
 	* Empty/undefined means application-wide (the conferred access applies to the whole application).
 	*/
-	resources?: Array<string | Resource>;
+	resources?: Array<string | Resource<TAttributes>>;
+};
+/**
+* AppDev-owned subject-type scoping shared by every catalog entitlement (group/role/permission).
+*
+* - `assignableSubjectTypes` is the AppDev **veto**: the hard, required, non-empty ceiling of
+*   principal kinds that may ever hold this entitlement. It is authored in application code and is
+*   **read-only** to the IAM tool (projected through SCIM as a `readOnly` attribute). There is no
+*   default-to-workforce and no unset-means-unrestricted: every entitlement declares its audience
+*   explicitly. A grant whose `subjectType` is outside this set is rejected.
+* - `recommendedSubjectTypes` is the AppDev **advisory default**: a (non-binding) subset of
+*   `assignableSubjectTypes` the IAM tool should default to. It is also read-only to IAM; the IAM
+*   tool is responsible for tracking changes to it over time. It MUST be a subset of
+*   `assignableSubjectTypes` (validated when the entitlement is authored).
+*/
+type SubjectTypeScoping = {
+	/** AppDev veto: required non-empty ceiling of principal kinds that may hold this entitlement (read-only to IAM). */
+	assignableSubjectTypes: SubjectType[];
+	/** AppDev advisory default principal kinds; must be a subset of `assignableSubjectTypes` (read-only to IAM). */
+	recommendedSubjectTypes?: SubjectType[];
 };
+type EntitlementReservedKey = keyof AuthzEntityBaseFields | keyof SubjectTypeScoping | keyof ResourceFields | keyof PermissionFields | keyof RoleFields | keyof GroupFields;
+/**
+* Fields shared by App-authored authorization entities. Custom attributes stay flat and type-safe;
+* SDK-owned names are reserved so future protocol fields cannot silently collide with app data.
+*/
+type AuthzEntityBase<TAttributes extends object = object> = AuthzEntityBaseFields & NoReserved<TAttributes, EntitlementReservedKey>;
+type Resource<TAttributes extends object = object> = AuthzEntityBase<TAttributes> & ResourceFields<TAttributes>;
+/** Suggested IAM governance labels for an entitlement's advisory risk classification. */
+declare const CANONICAL_RISK_LEVELS: readonly ["basic", "elevated", "privileged", "admin"];
+/** Canonical IAM governance suggestions with autocomplete, while allowing AppDev-defined labels. */
+type RiskLevel = (typeof CANONICAL_RISK_LEVELS)[number] | (string & {});
+/** Risk projected to IAM when an entitlement does not declare or store an explicit classification. */
+declare const DEFAULT_RISK_LEVEL = "basic";
+type Permission<TAttributes extends object = object> = AuthzEntityBase<TAttributes> & SubjectTypeScoping & PermissionFields;
+type Role<TAttributes extends object = object> = AuthzEntityBase<TAttributes> & SubjectTypeScoping & RoleFields<TAttributes>;
+type Group<TAttributes extends object = object> = AuthzEntityBase<TAttributes> & SubjectTypeScoping & GroupFields<TAttributes>;
 type OaaAccessTargetType = "group" | "role" | "permission";
 /**
 * The kind of an Entitlement. An **Entitlement** is any catalog object that can grant a user access
@@ -5133,7 +5154,7 @@ type OaaAccessTargetType = "group" | "role" | "permission";
 */
 type EntitlementType = OaaAccessTargetType;
 /** A catalog Entitlement: a group, role, or permission (see {@link EntitlementType}). */
-type Entitlement = Group | Role | Permission;
+type Entitlement<TAttributes extends object = object> = Group<TAttributes> | Role<TAttributes> | Permission<TAttributes>;
 declare const ION_AUTHZ_GROUP_SCHEMA = "urn:ionite:params:scim:schemas:extension:authz:2.0:Group";
 type AuthzScimGroupType = OaaAccessTargetType;
 type AuthzScimGroupExtension = {
@@ -5160,6 +5181,8 @@ type AuthzScimGroupExtension = {
 	assignableSubjectTypes?: SubjectType[];
 	/** AppDev advisory default principal kinds (subset of `assignableSubjectTypes`). Read-only to IAM. */
 	recommendedSubjectTypes?: SubjectType[];
+	/** AppDev custom attributes. Code seeds values; IAM may persist presentation overrides. */
+	attributes?: Record<string, unknown>;
 };
 type AccessRef<T> = string | T;
 /**
@@ -5204,28 +5227,28 @@ type CatalogChangeKind = OaaAccessTargetType;
 * Resource changes are NOT catalog changes: resources live in the application's own store and are
 * signaled through {@link ResourceProvider.changed} instead.
 */
-type CatalogChange = {
+type CatalogChange<TAttributes extends object = object> = {
 	op: "set";
 	kind: CatalogChangeKind;
-	entity: Group | Role | Permission;
-	previous: Group | Role | Permission | undefined;
+	entity: Group<TAttributes> | Role<TAttributes> | Permission<TAttributes>;
+	previous: Group<TAttributes> | Role<TAttributes> | Permission<TAttributes> | undefined;
 } | {
 	op: "delete";
 	kind: CatalogChangeKind;
-	entity: Group | Role | Permission;
+	entity: Group<TAttributes> | Role<TAttributes> | Permission<TAttributes>;
 };
 /** Listener invoked with a {@link CatalogChange} after a durable catalog write lands. */
-type CatalogChangeListener = (change: CatalogChange) => void;
-type AccessCatalogStore = {
-	groups: EntityStore<Group>;
-	roles: EntityStore<Role>;
-	permissions: EntityStore<Permission>;
+type CatalogChangeListener<TAttributes extends object = object> = (change: CatalogChange<TAttributes>) => void;
+type AccessCatalogStore<TAttributes extends object = object> = {
+	groups: EntityStore<Group<TAttributes>>;
+	roles: EntityStore<Role<TAttributes>>;
+	permissions: EntityStore<Permission<TAttributes>>;
 	/**
 	* Reactive change subscription (the catalog analog of {@link ReactiveHandle}). When implemented,
 	* the SDK subscribes once at wiring time and projects each change to OAA and ready IAM delta.
 	* Stores that omit it rely on later full sync/reconcile. Returns an unsubscribe function.
 	*/
-	afterChange?(listener: CatalogChangeListener): () => void;
+	afterChange?(listener: CatalogChangeListener<TAttributes>): () => void;
 };
 /** A resource change signaled by a {@link ResourceProvider} after the app's own write lands. */
 type ResourceChange = {
@@ -6169,4 +6192,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestSubmit, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DestinationReference, DevSecretsConfig, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JWTAssertionClaims, JwtBearerWorkloadConfig, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantIonCache, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UpdateTenantRequest, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, catalogEntityStore, claimsToUser, configTrustedClientGrants, customerResourceSchema, debugLogger, decodeUser, deepEqualPlain, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, readyCatalogEntry, remoteConfigSecretType, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestSubmit, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DestinationReference, DevSecretsConfig, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantIonCache, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UpdateTenantRequest, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, catalogEntityStore, claimsToUser, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeUser, deepEqualPlain, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, readyCatalogEntry, remoteConfigSecretType, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{T,J,S,s,F,A,a,e,c,O,I,L,W,H,z,k,b,m,w,v,C,r,i,Z,f,K,X,Q,g,E,U,u,o,t,M,ee,G,te,y,D,re,ne,R,se,d,h,q,V,n,l,p,ie,ae,j,_}from"./shared/core-mm9kc485.js";var ze="0.0.24-beta.20260915.2";class Se extends Error{constructor(x,P){super(x,P.cause!==void 0?{cause:P.cause}:void 0);this.name="ConfigSourceError",this.kind=P.kind,this.recoverable=P.recoverable,this.code=P.code,this.status=P.status,this.path=P.path,this.sourceType=P.sourceType,Object.setPrototypeOf(this,Se.prototype)}}function Fe(x){return x instanceof Se}var de=["workload"],Re={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Te={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:de,recommendedSubjectTypes:de},he={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Ae={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:de,recommendedSubjectTypes:de},be={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Ee={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Ie={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:de,recommendedSubjectTypes:de},we={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:de},xe={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Pe={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:de,recommendedSubjectTypes:de},Ge=[Re,Te,he,Ae,be,Ee,Ie,we,xe,Pe],Ve={"iam.read":{permission:Re,subjectType:["workload"]},"iam.users.write":{permission:Te,subjectType:["workload"]},"iam.groups.write":{permission:he,subjectType:["workload"]},"iam.workloads.write":{permission:Ae,subjectType:["workload"]},"iam.customers.write":{permission:be,subjectType:["workload"]},"iam.access-requests.write":{permission:Ee,subjectType:["workload"]},"capabilitiez.read":{permission:Ie,subjectType:["workload"]},"ciam.magic-link.create":{permission:we,subjectType:["workload","user"]},"authz.oaa.sync":{permission:xe,subjectType:["workload"]},"tenant.manage":{permission:Pe,subjectType:["workload"]}};var Be=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function _e(x){if(x===null||typeof x!=="object")return x;let P={};for(let[N,B]of Object.entries(x)){if(Be.includes(N)||N==="validators"||N==="setStores")continue;P[N]=B!==null&&typeof B==="object"&&!Array.isArray(B)&&Object.getPrototypeOf(B)===Object.prototype?_e(B):B}return P}function He(x){return _e(x)}function Ce(x,P){if(!x||typeof x!=="object"||Array.isArray(x))throw Error(`${P} must be an object.`);return x}function ge(x,P){if(x===void 0)return;if(typeof x!=="string"||x.length===0||!Number.isFinite(Date.parse(x)))throw Error(`${P} must be a valid timestamp string.`);return x}function Ke(x,P,N){if(!Array.isArray(x)||!N.allowEmpty&&x.length===0)throw Error(`${P} keys must be ${N.allowEmpty?"an":"a non-empty"} array.`);let B=new Set;return x.map((pe,Y)=>{let oe=Ce(pe,`${P} keys[${Y}]`);if(typeof oe.id!=="string"||oe.id.length===0)throw Error(`${P} keys[${Y}].id must be a non-empty string.`);if(B.has(oe.id))throw Error(`${P} contains duplicate key id "${oe.id}".`);if(B.add(oe.id),!["pending","active","deprecated","rotated","revoked"].includes(String(oe.state)))throw Error(`${P} keys[${Y}].state is invalid.`);if(oe.value!==void 0&&(typeof oe.value!=="string"||oe.value.length===0))throw Error(`${P} keys[${Y}].value must be a non-empty string when present.`);let me=oe.meta===void 0?void 0:Ce(oe.meta,`${P} keys[${Y}].meta`);return{id:oe.id,state:oe.state,...oe.value===void 0?{}:{value:oe.value},...oe.notBefore===void 0?{}:{notBefore:ge(oe.notBefore,`${P} keys[${Y}].notBefore`)},...oe.notAfter===void 0?{}:{notAfter:ge(oe.notAfter,`${P} keys[${Y}].notAfter`)},...oe.createdAt===void 0?{}:{createdAt:ge(oe.createdAt,`${P} keys[${Y}].createdAt`)},...oe.activatedAt===void 0?{}:{activatedAt:ge(oe.activatedAt,`${P} keys[${Y}].activatedAt`)},...oe.deprecatedAt===void 0?{}:{deprecatedAt:ge(oe.deprecatedAt,`${P} keys[${Y}].deprecatedAt`)},...oe.rotatedAt===void 0?{}:{rotatedAt:ge(oe.rotatedAt,`${P} keys[${Y}].rotatedAt`)},...oe.revokedAt===void 0?{}:{revokedAt:ge(oe.revokedAt,`${P} keys[${Y}].revokedAt`)},...me?{meta:{...me}}:{}}})}function Je(x,P,N){if(x===void 0)return;if(!Array.isArray(x))throw Error(`${N} slots must be an array.`);let B=new Set,pe=x.map((Y,oe)=>{if(Y===null)return null;if(typeof Y!=="string"||Y.length===0)throw Error(`${N} slots[${oe}] must be a non-empty key id or null.`);if(B.has(Y))throw Error(`${N} slots contain duplicate key id "${Y}".`);B.add(Y);let me=P.find((ce)=>ce.id===Y);if(!me)throw Error(`${N} slot key "${Y}" is not present in keys.`);if(me.state!=="active")throw Error(`${N} slot key "${Y}" must have state "active".`);if(!me.value)throw Error(`${N} slot key "${Y}" must include a value.`);return Y});if(P.length===0&&pe.some((Y)=>Y!==null))throw Error(`${N} slots must be omitted or all-null when keys is empty.`);return pe}function Ye(x){let N=Ce(x,"KMS pool");if(N.kind!=="kms")throw Error('KMS pool kind must be "kms".');let B=Ke(N.keys,"KMS pool",{allowEmpty:!0}),pe=Je(N.slots,B,"KMS pool");return pe?{kind:"kms",slots:pe,keys:B}:{kind:"kms",keys:B}}function Ze(x){let N=Ce(x,"KMS pool control document");if(N.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:Ke(N.keys,"KMS pool control document",{allowEmpty:!0})}}var Qe={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function Le(x){if(typeof x==="string")return x;try{return JSON.stringify(x)??String(x)}catch{return String(x)}}function ke(x){let P=Le(x);return/^[A-Za-z0-9_./:@+|-]+$/.test(P)?P:JSON.stringify(P)}function Xe(x){return Le(x).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function Me(x,P,N){if(N==null)return;if(N instanceof Error){if(x.push(`${P}.name=${ke(N.name)}`),x.push(`${P}.message=${ke(N.message)}`),N.stack)x.push(`${P}.stack=${ke(N.stack)}`);return}x.push(`${P}=${ke(N)}`)}function ye(x,P,N=[],B=new Date){let pe=Xe(P instanceof Error?P.message:P??""),Y=[];for(let[oe,me]of N.entries()){if(me&&typeof me==="object"&&!Array.isArray(me)&&!(me instanceof Error)&&Object.getPrototypeOf(me)===Object.prototype){for(let[ce,ue]of Object.entries(me))Me(Y,ce,ue);continue}Me(Y,`param.${oe}`,me)}return[B.toISOString(),Qe[x],pe,...Y].filter(Boolean).join(" ")}var Ne={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},et=Ne,tt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},ot={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},rt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},nt={trace:()=>{},debug:(x,...P)=>globalThis.console.debug(ye("debug",x,P)),info:(x,...P)=>globalThis.console.info(ye("info",x,P)),warn:(x,...P)=>globalThis.console.warn(ye("warn",x,P)),error:(x,...P)=>globalThis.console.error(ye("error",x,P))};function st(x,P){if(typeof P!=="number"||P<=0)return x;return new Promise((N,B)=>{let pe=setTimeout(()=>{B(Error(`Authz catalog entry did not become ready within ${P}ms`))},P);x.then(()=>{clearTimeout(pe),N()},(Y)=>{clearTimeout(pe),B(Y)})})}function it(x,P){let N=!1,B,pe=P.then(()=>{N=!0},(oe)=>{N=!1,B=oe}),Y=x;return Object.defineProperty(Y,"ready",{enumerable:!1,configurable:!0,value:(oe)=>st(pe.then(()=>{if(!N)throw B}),oe)}),Object.defineProperty(Y,"isReady",{enumerable:!1,configurable:!0,value:()=>N}),Y}var Oe=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function ve(x){if(!x.id.trim())throw Error("defineSecretType: id is required");let P=x.mimeType?.trim()||Oe[x.format],N=Object.freeze({id:x.id,...x.label?{label:x.label}:{},format:x.format,mimeType:P,...x.schemaUrl?{schemaUrl:x.schemaUrl}:{},typeId:x.id});return Object.freeze({id:x.id,...x.label?{label:x.label}:{},format:x.format,mimeType:P,...x.schemaUrl?{schemaUrl:x.schemaUrl}:{},...x.schema?{schema:x.schema}:{},toRegistryEntry:()=>N})}function at(x="jsonc"){return{format:x,mimeType:Oe[x],typeId:x}}class De extends Error{constructor(x,P){super(`Secret content type mismatch: expected "${x.mimeType}" (${x.format}) but received "${P.mimeType}" (${P.format})`);this.name="SecretContentTypeMismatchError",this.expected=x,this.received=P}}var pt=ve({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var We={beforeTenantSegments:["ui"]},$e={beforeTenantSegments:["api"]};function je(x){return(x??[]).map((P)=>P.trim()).filter(Boolean)}function ct(x){let P=x.trim();if(!P)return"/";let N=P.replace(/\\/g,"/").replace(/\/+/g,"/");return N.startsWith("/")?N:`/${N}`}function qe(x){return ct(x).split("/").filter(Boolean)}function fe(x){return{beforeTenantSegments:je(x?.beforeTenantSegments),afterTenantSegments:je(x?.afterTenantSegments)}}function mt(x){return{type:"path",ui:fe(x?.ui??We),api:fe(x?.api??$e)}}function dt(x,P){let N=fe(P),B=N.beforeTenantSegments??[],pe=N.afterTenantSegments??[],Y=qe(x),oe=B.length+1+pe.length;if(Y.length<oe)return null;for(let le=0;le<B.length;le++)if(Y[le]!==B[le])return null;let me=B.length,ce=Y[me];if(!ce)return null;for(let le=0;le<pe.length;le++)if(Y[me+1+le]!==pe[le])return null;let ue=Y.slice(me+1+pe.length);return{id:decodeURIComponent(ce),restSegments:ue,restPath:ue.length>0?`/${ue.join("/")}`:"/"}}function lt(x,P="/",N){let B=fe(N),pe=B.beforeTenantSegments??[],Y=B.afterTenantSegments??[],oe=qe(P),me=[...pe,encodeURIComponent(x),...Y,...oe];return me.length>0?`/${me.join("/")}`:"/"}function ut(x){return{"~standard":{version:1,vendor:x,validate:(P)=>{if(typeof P!=="object"||P===null)return{issues:[{message:"Expected an object"}]};let N=P,B=[],pe={...N},Y=["iss","sub"];for(let ce of Y)if(ce in N){if(typeof N[ce]!=="string")B.push({message:`${ce} must be a string`,path:[ce]})}else B.push({message:`${ce} is required`,path:[ce]});if("aud"in N&&N.aud!==void 0){let ce=N.aud;if(typeof ce!=="string"&&!Array.isArray(ce))B.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ce)&&!ce.every((ue)=>typeof ue==="string"))B.push({message:"aud array must contain only strings",path:["aud"]})}let oe=["jti","scope"];for(let ce of oe)if(ce in N&&N[ce]!==void 0){if(typeof N[ce]!=="string")B.push({message:`${ce} must be a string`,path:[ce]})}let me=["exp","iat"];for(let ce of me)if(ce in N){if(typeof N[ce]!=="number")B.push({message:`${ce} must be a number`,path:[ce]})}else B.push({message:`${ce} is required`,path:[ce]});if(B.length>0)return{issues:B};return{value:pe}}}}}function gt(x){return{"~standard":{version:1,vendor:x,validate:(P)=>{if(typeof P!=="object"||P===null)return{issues:[{message:"Expected an object"}]};let N=P,B=[],pe={};if("access_token"in N)if(typeof N.access_token==="string")pe.access_token=N.access_token;else B.push({message:"access_token must be a string",path:["access_token"]});else B.push({message:"access_token is required",path:["access_token"]});if("token_type"in N)if(typeof N.token_type==="string")pe.token_type=N.token_type;else B.push({message:"token_type must be a string",path:["token_type"]});else B.push({message:"token_type is required",path:["token_type"]});if("scope"in N)if(typeof N.scope==="string"||N.scope===void 0)pe.scope=N.scope;else B.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in N)if(typeof N.refresh_token==="string"||N.refresh_token===void 0)pe.refresh_token=N.refresh_token;else B.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in N)if(typeof N.expires==="string"||N.expires===void 0)pe.expires=N.expires;else B.push({message:"expires must be a string",path:["expires"]});if("expires_in"in N)if(typeof N.expires_in==="number"||N.expires_in===void 0)pe.expires_in=N.expires_in;else B.push({message:"expires_in must be a number",path:["expires_in"]});if(B.length>0)return{issues:B};return{value:pe}}}}}function yt(x){let P=new Uint8Array(x);return crypto.getRandomValues(P),P}function ft(x){let P="",N=yt(x);for(let B=0;B<x;B++){let pe=N[B]%32;P+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(pe)}return P}function St(x,P){let N="";for(let B=P;B>0;B--){let pe=x%32;N="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(pe)+N,x=Math.floor(x/32)}return N}function Ct(x){let P=Date.now(),N=St(P,10),B=ft(16);return`${x??""}${N}${B}`}export{L as AssignmentPolicyError,A as CANONICAL_RISK_LEVELS,Se as ConfigSourceError,a as DEFAULT_RISK_LEVEL,Oe as DEFAULT_SECRET_MIME_TYPES,$e as DEFAULT_TENANT_API_NAMESPACE,We as DEFAULT_TENANT_UI_NAMESPACE,Z as ECID_SCHEME,f as EcidFormatError,e as ION_AUTHZ_GROUP_SCHEMA,xe as ION_AUTHZ_OAA_SYNC,Ie as ION_CAPABILITIEZ_READ,we as ION_CIAM_MAGIC_LINK_CREATE,Ve as ION_ENDPOINT_PERMISSIONS,Ee as ION_IAM_ACCESS_REQUESTS_WRITE,be as ION_IAM_CUSTOMERS_WRITE,he as ION_IAM_GROUPS_WRITE,Re as ION_IAM_READ,Te as ION_IAM_USERS_WRITE,Ae as ION_IAM_WORKLOADS_WRITE,p as ION_SCIM_CUSTOMER_SCHEMA,n as ION_SCIM_USER_EXTENSION_URN,l as ION_SCIM_WORKLOAD_SCHEMA,Ge as ION_SDK_PERMISSIONS,Pe as ION_TENANT_MANAGE,q as IoniteError,c as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,De as SecretContentTypeMismatchError,d as StoreConflictError,r as accessRefId,i as accessRootId,g as assertEcid,I as assertRequiredSubjectType,O as assertValidSubjectTypeScoping,lt as buildTenantPath,b as catalogEntityStore,R as claimsToUser,J as configTrustedClientGrants,_ as customerResourceSchema,tt as debugLogger,se as decodeUser,D as deepEqualPlain,et as defaultLogger,at as defaultSecretContentType,z as defineCatalog,ve as defineSecretType,v as deprecateRetiredCodeCatalogRows,X as formatEcid,ye as formatLogLine,Ct as generateULID,k as getCodeCatalogEntity,ae as groupResourceSchema,u as idTokenClaimsSchema,ot as infoLogger,W as isCodeCatalog,V as isConfigLocator,Fe as isConfigSourceError,K as isEcid,h as isStoreConflictError,ut as jwtAssertionClaimsSchema,S as list,s as listGenerator,dt as matchTenantPath,F as matchesListFilter,w as materializeCodeCatalogEntity,m as mergeCodeCatalogEntity,ee as mergeConfig,t as must,fe as normalizeTenantPathNamespace,mt as normalizeTenantRoutingStrategy,E as oidcCallbackSchema,Q as parseEcid,te as parseJsonc,Ze as parseKmsPoolControlDocument,Ye as parseKmsPoolDocument,nt as prettyLogger,it as readyCatalogEntry,pt as remoteConfigSecretType,He as serializeConfig,Ne as silentLogger,re as stableConfigHash,G as stripJsonComments,H as toCodeCatalog,U as tokenResponseSchema,y as trimTrailingSlash,T as trustedClientPermissionsForPrincipal,C as unionCatalogRead,ie as userSchema,M as validationFailureResponse,ze as version,ne as waitOn,rt as warnLogger,o as withValidate,j as workloadResourceSchema,gt as workloadTokenResponseSchema};
+import{E,X,o,y,h,S,n,R,i,Q,U,u,e,d,q,j,V,F,ee,J,A,I,g,v,M,x,r,c,re,b,H,ne,se,k,N,L,l,a,t,D,oe,Y,ie,w,C,ae,ce,P,ue,p,T,G,B,s,m,f,le,pe,K,W}from"./shared/core-mybn3422.js";var He="0.0.24-beta.20260915.3";class Ae extends Error{constructor(O,_){super(O,_.cause!==void 0?{cause:_.cause}:void 0);this.name="ConfigSourceError",this.kind=_.kind,this.recoverable=_.recoverable,this.code=_.code,this.status=_.status,this.path=_.path,this.sourceType=_.sourceType,Object.setPrototypeOf(this,Ae.prototype)}}function Je(O){return O instanceof Ae}var fe=["workload"],Ee={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Ie={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},we={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},xe={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Pe={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Oe={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},_e={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},ve={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:fe},Ke={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Me={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Ye=[Ee,Ie,we,xe,Pe,Oe,_e,ve,Ke,Me],Ze={"iam.read":{permission:Ee,subjectType:["workload"]},"iam.users.write":{permission:Ie,subjectType:["workload"]},"iam.groups.write":{permission:we,subjectType:["workload"]},"iam.workloads.write":{permission:xe,subjectType:["workload"]},"iam.customers.write":{permission:Pe,subjectType:["workload"]},"iam.access-requests.write":{permission:Oe,subjectType:["workload"]},"capabilitiez.read":{permission:_e,subjectType:["workload"]},"ciam.magic-link.create":{permission:ve,subjectType:["workload","user"]},"authz.oaa.sync":{permission:Ke,subjectType:["workload"]},"tenant.manage":{permission:Me,subjectType:["workload"]}};var Qe=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function De(O){if(O===null||typeof O!=="object")return O;let _={};for(let[z,Z]of Object.entries(O)){if(Qe.includes(z)||z==="validators"||z==="setStores")continue;_[z]=Z!==null&&typeof Z==="object"&&!Array.isArray(Z)&&Object.getPrototypeOf(Z)===Object.prototype?De(Z):Z}return _}function Xe(O){return De(O)}function he(O,_){if(!O||typeof O!=="object"||Array.isArray(O))throw Error(`${_} must be an object.`);return O}function ke(O,_){if(O===void 0)return;if(typeof O!=="string"||O.length===0||!Number.isFinite(Date.parse(O)))throw Error(`${_} must be a valid timestamp string.`);return O}function We(O,_,z){if(!Array.isArray(O)||!z.allowEmpty&&O.length===0)throw Error(`${_} keys must be ${z.allowEmpty?"an":"a non-empty"} array.`);let Z=new Set;return O.map((de,te)=>{let me=he(de,`${_} keys[${te}]`);if(typeof me.id!=="string"||me.id.length===0)throw Error(`${_} keys[${te}].id must be a non-empty string.`);if(Z.has(me.id))throw Error(`${_} contains duplicate key id "${me.id}".`);if(Z.add(me.id),!["pending","active","deprecated","rotated","revoked"].includes(String(me.state)))throw Error(`${_} keys[${te}].state is invalid.`);if(me.value!==void 0&&(typeof me.value!=="string"||me.value.length===0))throw Error(`${_} keys[${te}].value must be a non-empty string when present.`);let ye=me.meta===void 0?void 0:he(me.meta,`${_} keys[${te}].meta`);return{id:me.id,state:me.state,...me.value===void 0?{}:{value:me.value},...me.notBefore===void 0?{}:{notBefore:ke(me.notBefore,`${_} keys[${te}].notBefore`)},...me.notAfter===void 0?{}:{notAfter:ke(me.notAfter,`${_} keys[${te}].notAfter`)},...me.createdAt===void 0?{}:{createdAt:ke(me.createdAt,`${_} keys[${te}].createdAt`)},...me.activatedAt===void 0?{}:{activatedAt:ke(me.activatedAt,`${_} keys[${te}].activatedAt`)},...me.deprecatedAt===void 0?{}:{deprecatedAt:ke(me.deprecatedAt,`${_} keys[${te}].deprecatedAt`)},...me.rotatedAt===void 0?{}:{rotatedAt:ke(me.rotatedAt,`${_} keys[${te}].rotatedAt`)},...me.revokedAt===void 0?{}:{revokedAt:ke(me.revokedAt,`${_} keys[${te}].revokedAt`)},...ye?{meta:{...ye}}:{}}})}function et(O,_,z){if(O===void 0)return;if(!Array.isArray(O))throw Error(`${z} slots must be an array.`);let Z=new Set,de=O.map((te,me)=>{if(te===null)return null;if(typeof te!=="string"||te.length===0)throw Error(`${z} slots[${me}] must be a non-empty key id or null.`);if(Z.has(te))throw Error(`${z} slots contain duplicate key id "${te}".`);Z.add(te);let ye=_.find((ge)=>ge.id===te);if(!ye)throw Error(`${z} slot key "${te}" is not present in keys.`);if(ye.state!=="active")throw Error(`${z} slot key "${te}" must have state "active".`);if(!ye.value)throw Error(`${z} slot key "${te}" must include a value.`);return te});if(_.length===0&&de.some((te)=>te!==null))throw Error(`${z} slots must be omitted or all-null when keys is empty.`);return de}function tt(O){let z=he(O,"KMS pool");if(z.kind!=="kms")throw Error('KMS pool kind must be "kms".');let Z=We(z.keys,"KMS pool",{allowEmpty:!0}),de=et(z.slots,Z,"KMS pool");return de?{kind:"kms",slots:de,keys:Z}:{kind:"kms",keys:Z}}function ot(O){let z=he(O,"KMS pool control document");if(z.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:We(z.keys,"KMS pool control document",{allowEmpty:!0})}}var rt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function $e(O){if(typeof O==="string")return O;try{return JSON.stringify(O)??String(O)}catch{return String(O)}}function be(O){let _=$e(O);return/^[A-Za-z0-9_./:@+|-]+$/.test(_)?_:JSON.stringify(_)}function nt(O){return $e(O).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function je(O,_,z){if(z==null)return;if(z instanceof Error){if(O.push(`${_}.name=${be(z.name)}`),O.push(`${_}.message=${be(z.message)}`),z.stack)O.push(`${_}.stack=${be(z.stack)}`);return}O.push(`${_}=${be(z)}`)}function Re(O,_,z=[],Z=new Date){let de=nt(_ instanceof Error?_.message:_??""),te=[];for(let[me,ye]of z.entries()){if(ye&&typeof ye==="object"&&!Array.isArray(ye)&&!(ye instanceof Error)&&Object.getPrototypeOf(ye)===Object.prototype){for(let[ge,Ce]of Object.entries(ye))je(te,ge,Ce);continue}je(te,`param.${me}`,ye)}return[Z.toISOString(),rt[O],de,...te].filter(Boolean).join(" ")}var Ue={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},st=Ue,it={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},at={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},pt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},ct={trace:()=>{},debug:(O,..._)=>globalThis.console.debug(Re("debug",O,_)),info:(O,..._)=>globalThis.console.info(Re("info",O,_)),warn:(O,..._)=>globalThis.console.warn(Re("warn",O,_)),error:(O,..._)=>globalThis.console.error(Re("error",O,_))};function mt(O,_){if(typeof _!=="number"||_<=0)return O;return new Promise((z,Z)=>{let de=setTimeout(()=>{Z(Error(`Authz catalog entry did not become ready within ${_}ms`))},_);O.then(()=>{clearTimeout(de),z()},(te)=>{clearTimeout(de),Z(te)})})}function ut(O,_){let z=!1,Z,de=_.then(()=>{z=!0},(me)=>{z=!1,Z=me}),te=O;return Object.defineProperty(te,"ready",{enumerable:!1,configurable:!0,value:(me)=>mt(de.then(()=>{if(!z)throw Z}),me)}),Object.defineProperty(te,"isReady",{enumerable:!1,configurable:!0,value:()=>z}),te}var Ne=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function Le(O){if(!O.id.trim())throw Error("defineSecretType: id is required");let _=O.mimeType?.trim()||Ne[O.format],z=Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:_,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},typeId:O.id});return Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:_,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},...O.schema?{schema:O.schema}:{},toRegistryEntry:()=>z})}function dt(O="jsonc"){return{format:O,mimeType:Ne[O],typeId:O}}class qe extends Error{constructor(O,_){super(`Secret content type mismatch: expected "${O.mimeType}" (${O.format}) but received "${_.mimeType}" (${_.format})`);this.name="SecretContentTypeMismatchError",this.expected=O,this.received=_}}var lt=Le({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Fe={beforeTenantSegments:["ui"]},Ge={beforeTenantSegments:["api"]};function ze(O){return(O??[]).map((_)=>_.trim()).filter(Boolean)}function gt(O){let _=O.trim();if(!_)return"/";let z=_.replace(/\\/g,"/").replace(/\/+/g,"/");return z.startsWith("/")?z:`/${z}`}function Ve(O){return gt(O).split("/").filter(Boolean)}function Te(O){return{beforeTenantSegments:ze(O?.beforeTenantSegments),afterTenantSegments:ze(O?.afterTenantSegments)}}function yt(O){return{type:"path",ui:Te(O?.ui??Fe),api:Te(O?.api??Ge)}}function ft(O,_){let z=Te(_),Z=z.beforeTenantSegments??[],de=z.afterTenantSegments??[],te=Ve(O),me=Z.length+1+de.length;if(te.length<me)return null;for(let Se=0;Se<Z.length;Se++)if(te[Se]!==Z[Se])return null;let ye=Z.length,ge=te[ye];if(!ge)return null;for(let Se=0;Se<de.length;Se++)if(te[ye+1+Se]!==de[Se])return null;let Ce=te.slice(ye+1+de.length);return{id:decodeURIComponent(ge),restSegments:Ce,restPath:Ce.length>0?`/${Ce.join("/")}`:"/"}}function St(O,_="/",z){let Z=Te(z),de=Z.beforeTenantSegments??[],te=Z.afterTenantSegments??[],me=Ve(_),ye=[...de,encodeURIComponent(O),...te,...me];return ye.length>0?`/${ye.join("/")}`:"/"}function Ct(O){return{"~standard":{version:1,vendor:O,validate:(_)=>{if(typeof _!=="object"||_===null)return{issues:[{message:"Expected an object"}]};let z=_,Z=[],de={...z},te=["iss","sub"];for(let ge of te)if(ge in z){if(typeof z[ge]!=="string")Z.push({message:`${ge} must be a string`,path:[ge]})}else Z.push({message:`${ge} is required`,path:[ge]});if("aud"in z&&z.aud!==void 0){let ge=z.aud;if(typeof ge!=="string"&&!Array.isArray(ge))Z.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ge)&&!ge.every((Ce)=>typeof Ce==="string"))Z.push({message:"aud array must contain only strings",path:["aud"]})}let me=["jti","scope"];for(let ge of me)if(ge in z&&z[ge]!==void 0){if(typeof z[ge]!=="string")Z.push({message:`${ge} must be a string`,path:[ge]})}let ye=["exp","iat"];for(let ge of ye)if(ge in z){if(typeof z[ge]!=="number")Z.push({message:`${ge} must be a number`,path:[ge]})}else Z.push({message:`${ge} is required`,path:[ge]});if(Z.length>0)return{issues:Z};return{value:de}}}}}function kt(O){return{"~standard":{version:1,vendor:O,validate:(_)=>{if(typeof _!=="object"||_===null)return{issues:[{message:"Expected an object"}]};let z=_,Z=[],de={};if("access_token"in z)if(typeof z.access_token==="string")de.access_token=z.access_token;else Z.push({message:"access_token must be a string",path:["access_token"]});else Z.push({message:"access_token is required",path:["access_token"]});if("token_type"in z)if(typeof z.token_type==="string")de.token_type=z.token_type;else Z.push({message:"token_type must be a string",path:["token_type"]});else Z.push({message:"token_type is required",path:["token_type"]});if("scope"in z)if(typeof z.scope==="string"||z.scope===void 0)de.scope=z.scope;else Z.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in z)if(typeof z.refresh_token==="string"||z.refresh_token===void 0)de.refresh_token=z.refresh_token;else Z.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in z)if(typeof z.expires==="string"||z.expires===void 0)de.expires=z.expires;else Z.push({message:"expires must be a string",path:["expires"]});if("expires_in"in z)if(typeof z.expires_in==="number"||z.expires_in===void 0)de.expires_in=z.expires_in;else Z.push({message:"expires_in must be a number",path:["expires_in"]});if(Z.length>0)return{issues:Z};return{value:de}}}}}function Rt(O){let _=new Uint8Array(O);return crypto.getRandomValues(_),_}function Tt(O){let _="",z=Rt(O);for(let Z=0;Z<O;Z++){let de=z[Z]%32;_+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(de)}return _}function At(O,_){let z="";for(let Z=_;Z>0;Z--){let de=O%32;z="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(de)+z,O=Math.floor(O/32)}return z}function ht(O){let _=Date.now(),z=At(_,10),Z=Tt(16);return`${O??""}${z}${Z}`}export{V as AssignmentPolicyError,U as CANONICAL_RISK_LEVELS,Ae as ConfigSourceError,u as DEFAULT_RISK_LEVEL,Ne as DEFAULT_SECRET_MIME_TYPES,Ge as DEFAULT_TENANT_API_NAMESPACE,Fe as DEFAULT_TENANT_UI_NAMESPACE,re as ECID_SCHEME,b as EcidFormatError,e as ION_AUTHZ_GROUP_SCHEMA,Ke as ION_AUTHZ_OAA_SYNC,_e as ION_CAPABILITIEZ_READ,ve as ION_CIAM_MAGIC_LINK_CREATE,Ze as ION_ENDPOINT_PERMISSIONS,Oe as ION_IAM_ACCESS_REQUESTS_WRITE,Pe as ION_IAM_CUSTOMERS_WRITE,we as ION_IAM_GROUPS_WRITE,Ee as ION_IAM_READ,Ie as ION_IAM_USERS_WRITE,xe as ION_IAM_WORKLOADS_WRITE,f as ION_SCIM_CUSTOMER_SCHEMA,s as ION_SCIM_USER_EXTENSION_URN,m as ION_SCIM_WORKLOAD_SCHEMA,Ye as ION_SDK_PERMISSIONS,Me as ION_TENANT_MANAGE,G as IoniteError,h as KNOWN_BASE_CUSTOMER_KEYS,y as KNOWN_BASE_USER_KEYS,o as KNOWN_ENTITLEMENT_KEYS,S as KNOWN_WORKLOAD_KEYS,d as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,qe as SecretContentTypeMismatchError,p as StoreConflictError,r as accessRefId,c as accessRootId,k as assertEcid,j as assertRequiredSubjectType,q as assertValidSubjectTypeScoping,St as buildTenantPath,I as catalogEntityStore,P as claimsToUser,X as configTrustedClientGrants,n as customAttributes,W as customerResourceSchema,it as debugLogger,ue as decodeUser,C as deepEqualPlain,st as defaultLogger,dt as defaultSecretContentType,J as defineCatalog,Le as defineSecretType,M as deprecateRetiredCodeCatalogRows,ne as formatEcid,Re as formatLogLine,ht as generateULID,A as getCodeCatalogEntity,pe as groupResourceSchema,l as idTokenClaimsSchema,at as infoLogger,F as isCodeCatalog,B as isConfigLocator,Je as isConfigSourceError,H as isEcid,T as isStoreConflictError,Ct as jwtAssertionClaimsSchema,R as list,i as listGenerator,ft as matchTenantPath,Q as matchesListFilter,v as materializeCodeCatalogEntity,g as mergeCodeCatalogEntity,oe as mergeConfig,t as must,Te as normalizeTenantPathNamespace,yt as normalizeTenantRoutingStrategy,N as oidcCallbackSchema,se as parseEcid,ie as parseJsonc,ot as parseKmsPoolControlDocument,tt as parseKmsPoolDocument,ct as prettyLogger,ut as readyCatalogEntry,lt as remoteConfigSecretType,Xe as serializeConfig,Ue as silentLogger,ae as stableConfigHash,Y as stripJsonComments,ee as toCodeCatalog,L as tokenResponseSchema,w as trimTrailingSlash,E as trustedClientPermissionsForPrincipal,x as unionCatalogRead,le as userSchema,D as validationFailureResponse,He as version,ce as waitOn,pt as warnLogger,a as withValidate,K as workloadResourceSchema,kt as workloadTokenResponseSchema};