@ionite/core 0.0.24-beta.20260921.7 → 0.0.24-beta.20260922.10

package/dist/index.d.ts

@@ -1498,11 +1498,13 @@ type AccessRequestCreate = {
 	subjectType: SubjectType;
 	targetType: EntitlementType;
 	target: string;
+	operation: "grant" | "revoke";
 	justification?: string;
 };
 type AccessRequestResult = {
 	id: string;
 	status: "pending" | "approved" | "denied";
+	operation: "grant" | "revoke";
 	trackingUrl: string;
 };
 /** SCIM resource types the delta patch adapter addresses. */
@@ -1628,7 +1630,7 @@ type ModuleReadiness = {
 * block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
 * `ion.iam.delta.ready()` explicitly instead.
 */
-type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz";
+type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
 /** Per-module readiness snapshot in {@link ReadinessReport}. */
 type ModuleReadinessState = {
 	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
@@ -2256,15 +2258,17 @@ type IamPrincipalKind = {
 	assignment: IamAssignmentPolicy;
 	delta?: IamDeltaMode;
 };
+/**
+* Destination-side inbox contract. The destination owns idempotency: when a pending request
+* already exists for the same (subjectType, subject, target, operation) tuple, `create` must
+* return that request with `created: false` (the handler answers 200 instead of 201). Operation
+* arrays are forbidden — one request carries exactly one `'grant' | 'revoke'`.
+*/
 type IAMAccessRequestsConfig = {
-	create: (request: AccessRequestCreate) => Promise<AccessRequestResult>;
-};
-type AccessRequestSubmit = {
-	subject: AccessChange["subject"];
-	subjectType: SubjectType;
-	targetType: EntitlementType;
-	target: AccessChange["target"];
-	justification?: string;
+	create: (request: AccessRequestCreate) => Promise<{
+		request: AccessRequestResult;
+		created: boolean;
+	}>;
 };
 type IAMEntitlementRequestUrlContext = {
 	request: Request;
@@ -4157,6 +4161,7 @@ type FrameworkConfig = {
 	ciam?: CIAMConfig | null;
 	authz?: AuthzConfig | null;
 	otel?: FrameworkOtelConfig | null;
+	tm?: FrameworkTmConfig | null;
 	validators: IoniteValidators;
 };
 /**
@@ -4216,6 +4221,8 @@ type RemoteConfig = {
 	/** OpenTelemetry collector/exporter config loaded from ConfigSource. */
 	otel?: OtelConfig;
 	authz?: AuthzConfig;
+	/** ConfigSource-owned Tenant Management activation and trusted integrator identity. */
+	tm?: RemoteTmConfig;
 	/**
 	* Built-in readiness endpoint intent (Ops/ECI). The SDK mounts `${basePath}/readyz` by default;
 	* set `enabled: false` to disable that route (returns 404). Not configurable from application
@@ -4666,6 +4673,7 @@ type IoniteBase = {
 	iam?: IAM;
 	workload?: Workload | AggregateWorkload;
 	ciam?: CIAM;
+	tm?: TenantManagement;
 	authz: Authz;
 	otel?: Otel;
 	/**
@@ -4893,7 +4901,121 @@ type BaseTenant = {
 	* integration completes; runtime construction must reject or remain unavailable while absent.
 	*/
 	configLocator?: ConfigLocator;
+	/**
+	* App-internal state for an integrator-requested Tenant Management handover. Protocol-internal
+	* fields are never serialized by the TM wire handlers.
+	*/
+	integration?: TenantIntegration;
+};
+type TenantIntegrationStatus = "consent_requested" | "consented" | "declined";
+type TenantIntegration = {
+	version: number;
+	integrator: string;
+	integratorName?: string;
+	integratorTenantId: string;
+	productId: string;
+	applicationId: string;
+	handleHash: string;
+	status: TenantIntegrationStatus;
+	expiresAt: string;
+	redeemAttempts: number;
+	requestedAt: string;
+	decidedAt?: string;
+	decidedBy?: string;
+	consentRedeemedAt?: string;
+	exportTokenHash?: string;
+	configExportedAt?: string;
+	handoverAppliedAt?: string;
+};
+type SetTenantIntegrationOptions = {
+	/**
+	* Compare-and-set guard. `null` requires no current integration; a string requires that current
+	* handle hash. Omit only when the caller intentionally accepts the current value.
+	*/
+	expectedHandleHash?: string | null;
+	/** Compare-and-set guard for transitions within the same handle. */
+	expectedVersion?: number;
+};
+type TmIntegratorConfig = {
+	id: string;
+	name?: string;
+	url: string;
+	issuer: string;
+	jwksUri: string;
+	audience: string;
+	clientId: string;
+};
+type RemoteTmConfig = {
+	enabled: true;
+	integrator: TmIntegratorConfig;
+	consentTtlSeconds?: number;
+	maxRedeemAttempts?: number;
+};
+type StagedIntegration = {
+	handle: string;
+	integrator: string;
+	integratorName?: string;
+	integratorTenantId: string;
+	productId: string;
+	applicationId: string;
+	issuedAt: string;
+	expiresAt: string;
+	requestId: string;
+	tenantHint?: string;
+};
+type ConnectRequestContext<TTenant extends BaseTenant = BaseTenant> = {
+	request: Request;
+	ion: Ionite;
+	staged: StagedIntegration;
+	tenant?: TTenant;
+};
+type ConfigExportEnvelope = {
+	version: 1;
+	config: Record<string, unknown>;
+};
+type FrameworkTmConfig<TTenant extends BaseTenant = BaseTenant> = {
+	basePath: string;
+	store: TenantStore<TTenant>;
+	validators: {
+		tenant: TenantValidators;
+	};
+	mirror?: {
+		purge(id: string): Promise<void>;
+	};
+	tenantIonBasePath?: (tenant: TTenant) => string | undefined;
+	onConnectRequest?: (context: ConnectRequestContext<TTenant>) => Response | Promise<Response>;
+	exportConfig?: (context: {
+		tenant: TTenant;
+	}) => ConfigExportEnvelope | Promise<ConfigExportEnvelope>;
+	onHandoverApplied?: (context: {
+		tenant: TTenant;
+		previousLocator?: ConfigLocator;
+	}) => void | Promise<void>;
+};
+type RecordTenantConsentInput = {
+	handle: string;
+	tenantId: string;
+	decision: "consented" | "declined";
+	decidedBy?: string;
+};
+type TenantIntegrationView = {
+	state: "none";
+} | {
+	state: "expired";
+	integration: TenantIntegration;
+} | {
+	state: "integrated";
+	integration: TenantIntegration;
+} | {
+	state: TenantIntegrationStatus;
+	integration: TenantIntegration;
+};
+type TenantManagement<TTenant extends BaseTenant = BaseTenant> = ModuleReadiness & {
+	handler(request: Request): Promise<Response>;
+	getTenant(id: string): Promise<TTenant | undefined>;
+	recordConsent(input: RecordTenantConsentInput): Promise<TTenant>;
 };
+declare function tmIntegrationState(tenant: BaseTenant | undefined, now?: number): TenantIntegrationView;
 /**
 * A single-flight cache of per-tenant {@link Ionite} instances, supplied by the app.
 *
@@ -4931,6 +5053,8 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	upsert(tenant: TTenant): Promise<TTenant>;
 	delete(id: string): Promise<number>;
 	getIon(id: string): Promise<Ionite | undefined>;
+	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
+	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
 }
 type InMemoryTenantStoreOptions = {
 	/**
@@ -5709,18 +5833,21 @@ type Authz = {
 	*/
 	grant(change: AccessChange): Promise<AccessChange>;
 	/**
-	* Submit an access request on a principal's behalf. Allowed only when that kind's assignment
-	* policy is `'iam-request'`. Authenticated with the module-wide `deltaAudience` workload client.
+	* Submit one grant or revoke request on a principal's behalf. Allowed only when that kind's
+	* assignment policy is `'iam-request'`. One operation maps to one approval decision, status,
+	* and tracking URL. Authenticated with the module-wide `deltaAudience` workload client.
 	*/
 	requestAccess(change: {
 		subject: AccessChange["subject"];
 		subjectType: SubjectType;
 		targetType: EntitlementType;
 		target: AccessChange["target"];
+		operation: "grant" | "revoke";
 		justification?: string;
 	}): Promise<{
 		id: string;
 		status: "pending" | "approved" | "denied";
+		operation: "grant" | "revoke";
 		trackingUrl: string;
 	}>;
 	/**
@@ -5788,7 +5915,7 @@ declare function trustedClientPermissionsForPrincipal(authz: AuthzConfig | null
 * OAA full sync — they are NEVER written to a store or materialized into the AccessIndex.
 */
 declare function configTrustedClientGrants(authz: AuthzConfig | null | undefined): AccessChange[];
-type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "iam.users" | "iam.groups" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "authz.oaa";
+type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "iam.users" | "iam.groups" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "authz.oaa" | "tm.integration";
 type CapabilityEndpointUrls = {
 	readyzUrl: string;
 	capabilitiezUrl: string;
@@ -6192,4 +6319,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestSubmit, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DestinationReference, DevSecretsConfig, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantIonCache, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UpdateTenantRequest, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, catalogEntityStore, claimsToUser, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeUser, deepEqualPlain, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, readyCatalogEntry, remoteConfigSecretType, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DestinationReference, DevSecretsConfig, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UpdateTenantRequest, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, catalogEntityStore, claimsToUser, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeUser, deepEqualPlain, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, readyCatalogEntry, remoteConfigSecretType, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{E,X,o,y,h,S,n,R,i,Q,U,u,e,d,q,j,V,F,ee,J,A,I,g,v,M,x,r,c,re,b,H,ne,se,k,N,L,l,a,t,D,oe,Y,ie,w,C,ae,ce,P,ue,p,T,G,B,s,m,f,le,pe,K,W}from"./shared/core-mybn3422.js";var He="0.0.24-beta.20260921.7";class Ae extends Error{constructor(O,_){super(O,_.cause!==void 0?{cause:_.cause}:void 0);this.name="ConfigSourceError",this.kind=_.kind,this.recoverable=_.recoverable,this.code=_.code,this.status=_.status,this.path=_.path,this.sourceType=_.sourceType,Object.setPrototypeOf(this,Ae.prototype)}}function Je(O){return O instanceof Ae}var fe=["workload"],Ee={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Ie={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},we={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},xe={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Pe={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Oe={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},_e={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},ve={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:fe},Ke={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Me={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:fe,recommendedSubjectTypes:fe},Ye=[Ee,Ie,we,xe,Pe,Oe,_e,ve,Ke,Me],Ze={"iam.read":{permission:Ee,subjectType:["workload"]},"iam.users.write":{permission:Ie,subjectType:["workload"]},"iam.groups.write":{permission:we,subjectType:["workload"]},"iam.workloads.write":{permission:xe,subjectType:["workload"]},"iam.customers.write":{permission:Pe,subjectType:["workload"]},"iam.access-requests.write":{permission:Oe,subjectType:["workload"]},"capabilitiez.read":{permission:_e,subjectType:["workload"]},"ciam.magic-link.create":{permission:ve,subjectType:["workload","user"]},"authz.oaa.sync":{permission:Ke,subjectType:["workload"]},"tenant.manage":{permission:Me,subjectType:["workload"]}};var Qe=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function De(O){if(O===null||typeof O!=="object")return O;let _={};for(let[z,Z]of Object.entries(O)){if(Qe.includes(z)||z==="validators"||z==="setStores")continue;_[z]=Z!==null&&typeof Z==="object"&&!Array.isArray(Z)&&Object.getPrototypeOf(Z)===Object.prototype?De(Z):Z}return _}function Xe(O){return De(O)}function he(O,_){if(!O||typeof O!=="object"||Array.isArray(O))throw Error(`${_} must be an object.`);return O}function ke(O,_){if(O===void 0)return;if(typeof O!=="string"||O.length===0||!Number.isFinite(Date.parse(O)))throw Error(`${_} must be a valid timestamp string.`);return O}function We(O,_,z){if(!Array.isArray(O)||!z.allowEmpty&&O.length===0)throw Error(`${_} keys must be ${z.allowEmpty?"an":"a non-empty"} array.`);let Z=new Set;return O.map((de,te)=>{let me=he(de,`${_} keys[${te}]`);if(typeof me.id!=="string"||me.id.length===0)throw Error(`${_} keys[${te}].id must be a non-empty string.`);if(Z.has(me.id))throw Error(`${_} contains duplicate key id "${me.id}".`);if(Z.add(me.id),!["pending","active","deprecated","rotated","revoked"].includes(String(me.state)))throw Error(`${_} keys[${te}].state is invalid.`);if(me.value!==void 0&&(typeof me.value!=="string"||me.value.length===0))throw Error(`${_} keys[${te}].value must be a non-empty string when present.`);let ye=me.meta===void 0?void 0:he(me.meta,`${_} keys[${te}].meta`);return{id:me.id,state:me.state,...me.value===void 0?{}:{value:me.value},...me.notBefore===void 0?{}:{notBefore:ke(me.notBefore,`${_} keys[${te}].notBefore`)},...me.notAfter===void 0?{}:{notAfter:ke(me.notAfter,`${_} keys[${te}].notAfter`)},...me.createdAt===void 0?{}:{createdAt:ke(me.createdAt,`${_} keys[${te}].createdAt`)},...me.activatedAt===void 0?{}:{activatedAt:ke(me.activatedAt,`${_} keys[${te}].activatedAt`)},...me.deprecatedAt===void 0?{}:{deprecatedAt:ke(me.deprecatedAt,`${_} keys[${te}].deprecatedAt`)},...me.rotatedAt===void 0?{}:{rotatedAt:ke(me.rotatedAt,`${_} keys[${te}].rotatedAt`)},...me.revokedAt===void 0?{}:{revokedAt:ke(me.revokedAt,`${_} keys[${te}].revokedAt`)},...ye?{meta:{...ye}}:{}}})}function et(O,_,z){if(O===void 0)return;if(!Array.isArray(O))throw Error(`${z} slots must be an array.`);let Z=new Set,de=O.map((te,me)=>{if(te===null)return null;if(typeof te!=="string"||te.length===0)throw Error(`${z} slots[${me}] must be a non-empty key id or null.`);if(Z.has(te))throw Error(`${z} slots contain duplicate key id "${te}".`);Z.add(te);let ye=_.find((ge)=>ge.id===te);if(!ye)throw Error(`${z} slot key "${te}" is not present in keys.`);if(ye.state!=="active")throw Error(`${z} slot key "${te}" must have state "active".`);if(!ye.value)throw Error(`${z} slot key "${te}" must include a value.`);return te});if(_.length===0&&de.some((te)=>te!==null))throw Error(`${z} slots must be omitted or all-null when keys is empty.`);return de}function tt(O){let z=he(O,"KMS pool");if(z.kind!=="kms")throw Error('KMS pool kind must be "kms".');let Z=We(z.keys,"KMS pool",{allowEmpty:!0}),de=et(z.slots,Z,"KMS pool");return de?{kind:"kms",slots:de,keys:Z}:{kind:"kms",keys:Z}}function ot(O){let z=he(O,"KMS pool control document");if(z.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:We(z.keys,"KMS pool control document",{allowEmpty:!0})}}var rt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function $e(O){if(typeof O==="string")return O;try{return JSON.stringify(O)??String(O)}catch{return String(O)}}function be(O){let _=$e(O);return/^[A-Za-z0-9_./:@+|-]+$/.test(_)?_:JSON.stringify(_)}function nt(O){return $e(O).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function je(O,_,z){if(z==null)return;if(z instanceof Error){if(O.push(`${_}.name=${be(z.name)}`),O.push(`${_}.message=${be(z.message)}`),z.stack)O.push(`${_}.stack=${be(z.stack)}`);return}O.push(`${_}=${be(z)}`)}function Re(O,_,z=[],Z=new Date){let de=nt(_ instanceof Error?_.message:_??""),te=[];for(let[me,ye]of z.entries()){if(ye&&typeof ye==="object"&&!Array.isArray(ye)&&!(ye instanceof Error)&&Object.getPrototypeOf(ye)===Object.prototype){for(let[ge,Ce]of Object.entries(ye))je(te,ge,Ce);continue}je(te,`param.${me}`,ye)}return[Z.toISOString(),rt[O],de,...te].filter(Boolean).join(" ")}var Ue={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},st=Ue,it={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},at={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},pt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},ct={trace:()=>{},debug:(O,..._)=>globalThis.console.debug(Re("debug",O,_)),info:(O,..._)=>globalThis.console.info(Re("info",O,_)),warn:(O,..._)=>globalThis.console.warn(Re("warn",O,_)),error:(O,..._)=>globalThis.console.error(Re("error",O,_))};function mt(O,_){if(typeof _!=="number"||_<=0)return O;return new Promise((z,Z)=>{let de=setTimeout(()=>{Z(Error(`Authz catalog entry did not become ready within ${_}ms`))},_);O.then(()=>{clearTimeout(de),z()},(te)=>{clearTimeout(de),Z(te)})})}function ut(O,_){let z=!1,Z,de=_.then(()=>{z=!0},(me)=>{z=!1,Z=me}),te=O;return Object.defineProperty(te,"ready",{enumerable:!1,configurable:!0,value:(me)=>mt(de.then(()=>{if(!z)throw Z}),me)}),Object.defineProperty(te,"isReady",{enumerable:!1,configurable:!0,value:()=>z}),te}var Ne=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function Le(O){if(!O.id.trim())throw Error("defineSecretType: id is required");let _=O.mimeType?.trim()||Ne[O.format],z=Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:_,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},typeId:O.id});return Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:_,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},...O.schema?{schema:O.schema}:{},toRegistryEntry:()=>z})}function dt(O="jsonc"){return{format:O,mimeType:Ne[O],typeId:O}}class qe extends Error{constructor(O,_){super(`Secret content type mismatch: expected "${O.mimeType}" (${O.format}) but received "${_.mimeType}" (${_.format})`);this.name="SecretContentTypeMismatchError",this.expected=O,this.received=_}}var lt=Le({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Fe={beforeTenantSegments:["ui"]},Ge={beforeTenantSegments:["api"]};function ze(O){return(O??[]).map((_)=>_.trim()).filter(Boolean)}function gt(O){let _=O.trim();if(!_)return"/";let z=_.replace(/\\/g,"/").replace(/\/+/g,"/");return z.startsWith("/")?z:`/${z}`}function Ve(O){return gt(O).split("/").filter(Boolean)}function Te(O){return{beforeTenantSegments:ze(O?.beforeTenantSegments),afterTenantSegments:ze(O?.afterTenantSegments)}}function yt(O){return{type:"path",ui:Te(O?.ui??Fe),api:Te(O?.api??Ge)}}function ft(O,_){let z=Te(_),Z=z.beforeTenantSegments??[],de=z.afterTenantSegments??[],te=Ve(O),me=Z.length+1+de.length;if(te.length<me)return null;for(let Se=0;Se<Z.length;Se++)if(te[Se]!==Z[Se])return null;let ye=Z.length,ge=te[ye];if(!ge)return null;for(let Se=0;Se<de.length;Se++)if(te[ye+1+Se]!==de[Se])return null;let Ce=te.slice(ye+1+de.length);return{id:decodeURIComponent(ge),restSegments:Ce,restPath:Ce.length>0?`/${Ce.join("/")}`:"/"}}function St(O,_="/",z){let Z=Te(z),de=Z.beforeTenantSegments??[],te=Z.afterTenantSegments??[],me=Ve(_),ye=[...de,encodeURIComponent(O),...te,...me];return ye.length>0?`/${ye.join("/")}`:"/"}function Ct(O){return{"~standard":{version:1,vendor:O,validate:(_)=>{if(typeof _!=="object"||_===null)return{issues:[{message:"Expected an object"}]};let z=_,Z=[],de={...z},te=["iss","sub"];for(let ge of te)if(ge in z){if(typeof z[ge]!=="string")Z.push({message:`${ge} must be a string`,path:[ge]})}else Z.push({message:`${ge} is required`,path:[ge]});if("aud"in z&&z.aud!==void 0){let ge=z.aud;if(typeof ge!=="string"&&!Array.isArray(ge))Z.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ge)&&!ge.every((Ce)=>typeof Ce==="string"))Z.push({message:"aud array must contain only strings",path:["aud"]})}let me=["jti","scope"];for(let ge of me)if(ge in z&&z[ge]!==void 0){if(typeof z[ge]!=="string")Z.push({message:`${ge} must be a string`,path:[ge]})}let ye=["exp","iat"];for(let ge of ye)if(ge in z){if(typeof z[ge]!=="number")Z.push({message:`${ge} must be a number`,path:[ge]})}else Z.push({message:`${ge} is required`,path:[ge]});if(Z.length>0)return{issues:Z};return{value:de}}}}}function kt(O){return{"~standard":{version:1,vendor:O,validate:(_)=>{if(typeof _!=="object"||_===null)return{issues:[{message:"Expected an object"}]};let z=_,Z=[],de={};if("access_token"in z)if(typeof z.access_token==="string")de.access_token=z.access_token;else Z.push({message:"access_token must be a string",path:["access_token"]});else Z.push({message:"access_token is required",path:["access_token"]});if("token_type"in z)if(typeof z.token_type==="string")de.token_type=z.token_type;else Z.push({message:"token_type must be a string",path:["token_type"]});else Z.push({message:"token_type is required",path:["token_type"]});if("scope"in z)if(typeof z.scope==="string"||z.scope===void 0)de.scope=z.scope;else Z.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in z)if(typeof z.refresh_token==="string"||z.refresh_token===void 0)de.refresh_token=z.refresh_token;else Z.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in z)if(typeof z.expires==="string"||z.expires===void 0)de.expires=z.expires;else Z.push({message:"expires must be a string",path:["expires"]});if("expires_in"in z)if(typeof z.expires_in==="number"||z.expires_in===void 0)de.expires_in=z.expires_in;else Z.push({message:"expires_in must be a number",path:["expires_in"]});if(Z.length>0)return{issues:Z};return{value:de}}}}}function Rt(O){let _=new Uint8Array(O);return crypto.getRandomValues(_),_}function Tt(O){let _="",z=Rt(O);for(let Z=0;Z<O;Z++){let de=z[Z]%32;_+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(de)}return _}function At(O,_){let z="";for(let Z=_;Z>0;Z--){let de=O%32;z="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(de)+z,O=Math.floor(O/32)}return z}function ht(O){let _=Date.now(),z=At(_,10),Z=Tt(16);return`${O??""}${z}${Z}`}export{V as AssignmentPolicyError,U as CANONICAL_RISK_LEVELS,Ae as ConfigSourceError,u as DEFAULT_RISK_LEVEL,Ne as DEFAULT_SECRET_MIME_TYPES,Ge as DEFAULT_TENANT_API_NAMESPACE,Fe as DEFAULT_TENANT_UI_NAMESPACE,re as ECID_SCHEME,b as EcidFormatError,e as ION_AUTHZ_GROUP_SCHEMA,Ke as ION_AUTHZ_OAA_SYNC,_e as ION_CAPABILITIEZ_READ,ve as ION_CIAM_MAGIC_LINK_CREATE,Ze as ION_ENDPOINT_PERMISSIONS,Oe as ION_IAM_ACCESS_REQUESTS_WRITE,Pe as ION_IAM_CUSTOMERS_WRITE,we as ION_IAM_GROUPS_WRITE,Ee as ION_IAM_READ,Ie as ION_IAM_USERS_WRITE,xe as ION_IAM_WORKLOADS_WRITE,f as ION_SCIM_CUSTOMER_SCHEMA,s as ION_SCIM_USER_EXTENSION_URN,m as ION_SCIM_WORKLOAD_SCHEMA,Ye as ION_SDK_PERMISSIONS,Me as ION_TENANT_MANAGE,G as IoniteError,h as KNOWN_BASE_CUSTOMER_KEYS,y as KNOWN_BASE_USER_KEYS,o as KNOWN_ENTITLEMENT_KEYS,S as KNOWN_WORKLOAD_KEYS,d as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,qe as SecretContentTypeMismatchError,p as StoreConflictError,r as accessRefId,c as accessRootId,k as assertEcid,j as assertRequiredSubjectType,q as assertValidSubjectTypeScoping,St as buildTenantPath,I as catalogEntityStore,P as claimsToUser,X as configTrustedClientGrants,n as customAttributes,W as customerResourceSchema,it as debugLogger,ue as decodeUser,C as deepEqualPlain,st as defaultLogger,dt as defaultSecretContentType,J as defineCatalog,Le as defineSecretType,M as deprecateRetiredCodeCatalogRows,ne as formatEcid,Re as formatLogLine,ht as generateULID,A as getCodeCatalogEntity,pe as groupResourceSchema,l as idTokenClaimsSchema,at as infoLogger,F as isCodeCatalog,B as isConfigLocator,Je as isConfigSourceError,H as isEcid,T as isStoreConflictError,Ct as jwtAssertionClaimsSchema,R as list,i as listGenerator,ft as matchTenantPath,Q as matchesListFilter,v as materializeCodeCatalogEntity,g as mergeCodeCatalogEntity,oe as mergeConfig,t as must,Te as normalizeTenantPathNamespace,yt as normalizeTenantRoutingStrategy,N as oidcCallbackSchema,se as parseEcid,ie as parseJsonc,ot as parseKmsPoolControlDocument,tt as parseKmsPoolDocument,ct as prettyLogger,ut as readyCatalogEntry,lt as remoteConfigSecretType,Xe as serializeConfig,Ue as silentLogger,ae as stableConfigHash,Y as stripJsonComments,ee as toCodeCatalog,L as tokenResponseSchema,w as trimTrailingSlash,E as trustedClientPermissionsForPrincipal,x as unionCatalogRead,le as userSchema,D as validationFailureResponse,He as version,ce as waitOn,pt as warnLogger,a as withValidate,K as workloadResourceSchema,kt as workloadTokenResponseSchema};
+import{E,X,o,h,S,b,r,R,i,Q,U,u,e,d,W,M,V,H,ee,F,A,I,y,v,j,x,n,c,ne,k,J,re,se,w,N,L,l,a,t,D,oe,Y,ie,C,p,ae,ce,P,ue,m,T,G,B,de,s,f,g,pe,me,q,K}from"./shared/core-j5xhxcmq.js";var Je="0.0.24-beta.20260922.10";class Ae extends Error{constructor(O,_){super(O,_.cause!==void 0?{cause:_.cause}:void 0);this.name="ConfigSourceError",this.kind=_.kind,this.recoverable=_.recoverable,this.code=_.code,this.status=_.status,this.path=_.path,this.sourceType=_.sourceType,Object.setPrototypeOf(this,Ae.prototype)}}function Ye(O){return O instanceof Ae}var Se=["workload"],Ie={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},we={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},xe={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Pe={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Oe={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},_e={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},ve={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Ke={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Se},Me={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Ne={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Ze=[Ie,we,xe,Pe,Oe,_e,ve,Ke,Me,Ne],Qe={"iam.read":{permission:Ie,subjectType:["workload"]},"iam.users.write":{permission:we,subjectType:["workload"]},"iam.groups.write":{permission:xe,subjectType:["workload"]},"iam.workloads.write":{permission:Pe,subjectType:["workload"]},"iam.customers.write":{permission:Oe,subjectType:["workload"]},"iam.access-requests.write":{permission:_e,subjectType:["workload"]},"capabilitiez.read":{permission:ve,subjectType:["workload"]},"ciam.magic-link.create":{permission:Ke,subjectType:["workload","user"]},"authz.oaa.sync":{permission:Me,subjectType:["workload"]},"tenant.manage":{permission:Ne,subjectType:["workload"]}};var Xe=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function We(O){if(O===null||typeof O!=="object")return O;let _={};for(let[z,Z]of Object.entries(O)){if(Xe.includes(z)||z==="validators"||z==="setStores")continue;_[z]=Z!==null&&typeof Z==="object"&&!Array.isArray(Z)&&Object.getPrototypeOf(Z)===Object.prototype?We(Z):Z}return _}function et(O){return We(O)}function be(O,_){if(!O||typeof O!=="object"||Array.isArray(O))throw Error(`${_} must be an object.`);return O}function Re(O,_){if(O===void 0)return;if(typeof O!=="string"||O.length===0||!Number.isFinite(Date.parse(O)))throw Error(`${_} must be a valid timestamp string.`);return O}function je(O,_,z){if(!Array.isArray(O)||!z.allowEmpty&&O.length===0)throw Error(`${_} keys must be ${z.allowEmpty?"an":"a non-empty"} array.`);let Z=new Set;return O.map((ge,te)=>{let le=be(ge,`${_} keys[${te}]`);if(typeof le.id!=="string"||le.id.length===0)throw Error(`${_} keys[${te}].id must be a non-empty string.`);if(Z.has(le.id))throw Error(`${_} contains duplicate key id "${le.id}".`);if(Z.add(le.id),!["pending","active","deprecated","rotated","revoked"].includes(String(le.state)))throw Error(`${_} keys[${te}].state is invalid.`);if(le.value!==void 0&&(typeof le.value!=="string"||le.value.length===0))throw Error(`${_} keys[${te}].value must be a non-empty string when present.`);let fe=le.meta===void 0?void 0:be(le.meta,`${_} keys[${te}].meta`);return{id:le.id,state:le.state,...le.value===void 0?{}:{value:le.value},...le.notBefore===void 0?{}:{notBefore:Re(le.notBefore,`${_} keys[${te}].notBefore`)},...le.notAfter===void 0?{}:{notAfter:Re(le.notAfter,`${_} keys[${te}].notAfter`)},...le.createdAt===void 0?{}:{createdAt:Re(le.createdAt,`${_} keys[${te}].createdAt`)},...le.activatedAt===void 0?{}:{activatedAt:Re(le.activatedAt,`${_} keys[${te}].activatedAt`)},...le.deprecatedAt===void 0?{}:{deprecatedAt:Re(le.deprecatedAt,`${_} keys[${te}].deprecatedAt`)},...le.rotatedAt===void 0?{}:{rotatedAt:Re(le.rotatedAt,`${_} keys[${te}].rotatedAt`)},...le.revokedAt===void 0?{}:{revokedAt:Re(le.revokedAt,`${_} keys[${te}].revokedAt`)},...fe?{meta:{...fe}}:{}}})}function tt(O,_,z){if(O===void 0)return;if(!Array.isArray(O))throw Error(`${z} slots must be an array.`);let Z=new Set,ge=O.map((te,le)=>{if(te===null)return null;if(typeof te!=="string"||te.length===0)throw Error(`${z} slots[${le}] must be a non-empty key id or null.`);if(Z.has(te))throw Error(`${z} slots contain duplicate key id "${te}".`);Z.add(te);let fe=_.find((ye)=>ye.id===te);if(!fe)throw Error(`${z} slot key "${te}" is not present in keys.`);if(fe.state!=="active")throw Error(`${z} slot key "${te}" must have state "active".`);if(!fe.value)throw Error(`${z} slot key "${te}" must include a value.`);return te});if(_.length===0&&ge.some((te)=>te!==null))throw Error(`${z} slots must be omitted or all-null when keys is empty.`);return ge}function ot(O){let z=be(O,"KMS pool");if(z.kind!=="kms")throw Error('KMS pool kind must be "kms".');let Z=je(z.keys,"KMS pool",{allowEmpty:!0}),ge=tt(z.slots,Z,"KMS pool");return ge?{kind:"kms",slots:ge,keys:Z}:{kind:"kms",keys:Z}}function rt(O){let z=be(O,"KMS pool control document");if(z.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:je(z.keys,"KMS pool control document",{allowEmpty:!0})}}var nt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function Ue(O){if(typeof O==="string")return O;try{return JSON.stringify(O)??String(O)}catch{return String(O)}}function Ee(O){let _=Ue(O);return/^[A-Za-z0-9_./:@+|-]+$/.test(_)?_:JSON.stringify(_)}function st(O){return Ue(O).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function $e(O,_,z){if(z==null)return;if(z instanceof Error){if(O.push(`${_}.name=${Ee(z.name)}`),O.push(`${_}.message=${Ee(z.message)}`),z.stack)O.push(`${_}.stack=${Ee(z.stack)}`);return}O.push(`${_}=${Ee(z)}`)}function Te(O,_,z=[],Z=new Date){let ge=st(_ instanceof Error?_.message:_??""),te=[];for(let[le,fe]of z.entries()){if(fe&&typeof fe==="object"&&!Array.isArray(fe)&&!(fe instanceof Error)&&Object.getPrototypeOf(fe)===Object.prototype){for(let[ye,ke]of Object.entries(fe))$e(te,ye,ke);continue}$e(te,`param.${le}`,fe)}return[Z.toISOString(),nt[O],ge,...te].filter(Boolean).join(" ")}var qe={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},it=qe,at={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},pt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},ct={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},mt={trace:()=>{},debug:(O,..._)=>globalThis.console.debug(Te("debug",O,_)),info:(O,..._)=>globalThis.console.info(Te("info",O,_)),warn:(O,..._)=>globalThis.console.warn(Te("warn",O,_)),error:(O,..._)=>globalThis.console.error(Te("error",O,_))};function ut(O,_){if(typeof _!=="number"||_<=0)return O;return new Promise((z,Z)=>{let ge=setTimeout(()=>{Z(Error(`Authz catalog entry did not become ready within ${_}ms`))},_);O.then(()=>{clearTimeout(ge),z()},(te)=>{clearTimeout(ge),Z(te)})})}function dt(O,_){let z=!1,Z,ge=_.then(()=>{z=!0},(le)=>{z=!1,Z=le}),te=O;return Object.defineProperty(te,"ready",{enumerable:!1,configurable:!0,value:(le)=>ut(ge.then(()=>{if(!z)throw Z}),le)}),Object.defineProperty(te,"isReady",{enumerable:!1,configurable:!0,value:()=>z}),te}var Le=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function De(O){if(!O.id.trim())throw Error("defineSecretType: id is required");let _=O.mimeType?.trim()||Le[O.format],z=Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:_,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},typeId:O.id});return Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:_,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},...O.schema?{schema:O.schema}:{},toRegistryEntry:()=>z})}function lt(O="jsonc"){return{format:O,mimeType:Le[O],typeId:O}}class ze extends Error{constructor(O,_){super(`Secret content type mismatch: expected "${O.mimeType}" (${O.format}) but received "${_.mimeType}" (${_.format})`);this.name="SecretContentTypeMismatchError",this.expected=O,this.received=_}}var gt=De({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Ve={beforeTenantSegments:["ui"]},Ge={beforeTenantSegments:["api"]};function Fe(O){return(O??[]).map((_)=>_.trim()).filter(Boolean)}function yt(O){let _=O.trim();if(!_)return"/";let z=_.replace(/\\/g,"/").replace(/\/+/g,"/");return z.startsWith("/")?z:`/${z}`}function Be(O){return yt(O).split("/").filter(Boolean)}function he(O){return{beforeTenantSegments:Fe(O?.beforeTenantSegments),afterTenantSegments:Fe(O?.afterTenantSegments)}}function ft(O){return{type:"path",ui:he(O?.ui??Ve),api:he(O?.api??Ge)}}function St(O,_){let z=he(_),Z=z.beforeTenantSegments??[],ge=z.afterTenantSegments??[],te=Be(O),le=Z.length+1+ge.length;if(te.length<le)return null;for(let Ce=0;Ce<Z.length;Ce++)if(te[Ce]!==Z[Ce])return null;let fe=Z.length,ye=te[fe];if(!ye)return null;for(let Ce=0;Ce<ge.length;Ce++)if(te[fe+1+Ce]!==ge[Ce])return null;let ke=te.slice(fe+1+ge.length);return{id:decodeURIComponent(ye),restSegments:ke,restPath:ke.length>0?`/${ke.join("/")}`:"/"}}function Ct(O,_="/",z){let Z=he(z),ge=Z.beforeTenantSegments??[],te=Z.afterTenantSegments??[],le=Be(_),fe=[...ge,encodeURIComponent(O),...te,...le];return fe.length>0?`/${fe.join("/")}`:"/"}function kt(O){return{"~standard":{version:1,vendor:O,validate:(_)=>{if(typeof _!=="object"||_===null)return{issues:[{message:"Expected an object"}]};let z=_,Z=[],ge={...z},te=["iss","sub"];for(let ye of te)if(ye in z){if(typeof z[ye]!=="string")Z.push({message:`${ye} must be a string`,path:[ye]})}else Z.push({message:`${ye} is required`,path:[ye]});if("aud"in z&&z.aud!==void 0){let ye=z.aud;if(typeof ye!=="string"&&!Array.isArray(ye))Z.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ye)&&!ye.every((ke)=>typeof ke==="string"))Z.push({message:"aud array must contain only strings",path:["aud"]})}let le=["jti","scope"];for(let ye of le)if(ye in z&&z[ye]!==void 0){if(typeof z[ye]!=="string")Z.push({message:`${ye} must be a string`,path:[ye]})}let fe=["exp","iat"];for(let ye of fe)if(ye in z){if(typeof z[ye]!=="number")Z.push({message:`${ye} must be a number`,path:[ye]})}else Z.push({message:`${ye} is required`,path:[ye]});if(Z.length>0)return{issues:Z};return{value:ge}}}}}function Rt(O){return{"~standard":{version:1,vendor:O,validate:(_)=>{if(typeof _!=="object"||_===null)return{issues:[{message:"Expected an object"}]};let z=_,Z=[],ge={};if("access_token"in z)if(typeof z.access_token==="string")ge.access_token=z.access_token;else Z.push({message:"access_token must be a string",path:["access_token"]});else Z.push({message:"access_token is required",path:["access_token"]});if("token_type"in z)if(typeof z.token_type==="string")ge.token_type=z.token_type;else Z.push({message:"token_type must be a string",path:["token_type"]});else Z.push({message:"token_type is required",path:["token_type"]});if("scope"in z)if(typeof z.scope==="string"||z.scope===void 0)ge.scope=z.scope;else Z.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in z)if(typeof z.refresh_token==="string"||z.refresh_token===void 0)ge.refresh_token=z.refresh_token;else Z.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in z)if(typeof z.expires==="string"||z.expires===void 0)ge.expires=z.expires;else Z.push({message:"expires must be a string",path:["expires"]});if("expires_in"in z)if(typeof z.expires_in==="number"||z.expires_in===void 0)ge.expires_in=z.expires_in;else Z.push({message:"expires_in must be a number",path:["expires_in"]});if(Z.length>0)return{issues:Z};return{value:ge}}}}}function Tt(O){let _=new Uint8Array(O);return crypto.getRandomValues(_),_}function ht(O){let _="",z=Tt(O);for(let Z=0;Z<O;Z++){let ge=z[Z]%32;_+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ge)}return _}function At(O,_){let z="";for(let Z=_;Z>0;Z--){let ge=O%32;z="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ge)+z,O=Math.floor(O/32)}return z}function bt(O){let _=Date.now(),z=At(_,10),Z=ht(16);return`${O??""}${z}${Z}`}export{V as AssignmentPolicyError,U as CANONICAL_RISK_LEVELS,Ae as ConfigSourceError,u as DEFAULT_RISK_LEVEL,Le as DEFAULT_SECRET_MIME_TYPES,Ge as DEFAULT_TENANT_API_NAMESPACE,Ve as DEFAULT_TENANT_UI_NAMESPACE,ne as ECID_SCHEME,k as EcidFormatError,e as ION_AUTHZ_GROUP_SCHEMA,Me as ION_AUTHZ_OAA_SYNC,ve as ION_CAPABILITIEZ_READ,Ke as ION_CIAM_MAGIC_LINK_CREATE,Qe as ION_ENDPOINT_PERMISSIONS,_e as ION_IAM_ACCESS_REQUESTS_WRITE,Oe as ION_IAM_CUSTOMERS_WRITE,xe as ION_IAM_GROUPS_WRITE,Ie as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Pe as ION_IAM_WORKLOADS_WRITE,g as ION_SCIM_CUSTOMER_SCHEMA,s as ION_SCIM_USER_EXTENSION_URN,f as ION_SCIM_WORKLOAD_SCHEMA,Ze as ION_SDK_PERMISSIONS,Ne as ION_TENANT_MANAGE,G as IoniteError,S as KNOWN_BASE_CUSTOMER_KEYS,h as KNOWN_BASE_USER_KEYS,o as KNOWN_ENTITLEMENT_KEYS,b as KNOWN_WORKLOAD_KEYS,d as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,ze as SecretContentTypeMismatchError,m as StoreConflictError,n as accessRefId,c as accessRootId,w as assertEcid,M as assertRequiredSubjectType,W as assertValidSubjectTypeScoping,Ct as buildTenantPath,I as catalogEntityStore,P as claimsToUser,X as configTrustedClientGrants,r as customAttributes,K as customerResourceSchema,at as debugLogger,ue as decodeUser,p as deepEqualPlain,it as defaultLogger,lt as defaultSecretContentType,F as defineCatalog,De as defineSecretType,j as deprecateRetiredCodeCatalogRows,re as formatEcid,Te as formatLogLine,bt as generateULID,A as getCodeCatalogEntity,me as groupResourceSchema,l as idTokenClaimsSchema,pt as infoLogger,H as isCodeCatalog,B as isConfigLocator,Ye as isConfigSourceError,J as isEcid,T as isStoreConflictError,kt as jwtAssertionClaimsSchema,R as list,i as listGenerator,St as matchTenantPath,Q as matchesListFilter,v as materializeCodeCatalogEntity,y as mergeCodeCatalogEntity,oe as mergeConfig,t as must,he as normalizeTenantPathNamespace,ft as normalizeTenantRoutingStrategy,N as oidcCallbackSchema,se as parseEcid,ie as parseJsonc,rt as parseKmsPoolControlDocument,ot as parseKmsPoolDocument,mt as prettyLogger,dt as readyCatalogEntry,gt as remoteConfigSecretType,et as serializeConfig,qe as silentLogger,ae as stableConfigHash,Y as stripJsonComments,de as tmIntegrationState,ee as toCodeCatalog,L as tokenResponseSchema,C as trimTrailingSlash,E as trustedClientPermissionsForPrincipal,x as unionCatalogRead,pe as userSchema,D as validationFailureResponse,Je as version,ce as waitOn,ct as warnLogger,a as withValidate,q as workloadResourceSchema,Rt as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -1364,11 +1364,13 @@ type AccessRequestCreate = {
 	subjectType: SubjectType;
 	targetType: EntitlementType;
 	target: string;
+	operation: "grant" | "revoke";
 	justification?: string;
 };
 type AccessRequestResult = {
 	id: string;
 	status: "pending" | "approved" | "denied";
+	operation: "grant" | "revoke";
 	trackingUrl: string;
 };
 /** SCIM resource types the delta patch adapter addresses. */
@@ -1494,7 +1496,7 @@ type ModuleReadiness = {
 * block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
 * `ion.iam.delta.ready()` explicitly instead.
 */
-type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz";
+type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
 /** Per-module readiness snapshot in {@link ReadinessReport}. */
 type ModuleReadinessState = {
 	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
@@ -2107,15 +2109,17 @@ type IamPrincipalKind = {
 	assignment: IamAssignmentPolicy;
 	delta?: IamDeltaMode;
 };
+/**
+* Destination-side inbox contract. The destination owns idempotency: when a pending request
+* already exists for the same (subjectType, subject, target, operation) tuple, `create` must
+* return that request with `created: false` (the handler answers 200 instead of 201). Operation
+* arrays are forbidden — one request carries exactly one `'grant' | 'revoke'`.
+*/
 type IAMAccessRequestsConfig = {
-	create: (request: AccessRequestCreate) => Promise<AccessRequestResult>;
-};
-type AccessRequestSubmit = {
-	subject: AccessChange["subject"];
-	subjectType: SubjectType;
-	targetType: EntitlementType;
-	target: AccessChange["target"];
-	justification?: string;
+	create: (request: AccessRequestCreate) => Promise<{
+		request: AccessRequestResult;
+		created: boolean;
+	}>;
 };
 type IAMEntitlementRequestUrlContext = {
 	request: Request;
@@ -3895,6 +3899,8 @@ type RemoteConfig = {
 	/** OpenTelemetry collector/exporter config loaded from ConfigSource. */
 	otel?: OtelConfig;
 	authz?: AuthzConfig;
+	/** ConfigSource-owned Tenant Management activation and trusted integrator identity. */
+	tm?: RemoteTmConfig;
 	/**
 	* Built-in readiness endpoint intent (Ops/ECI). The SDK mounts `${basePath}/readyz` by default;
 	* set `enabled: false` to disable that route (returns 404). Not configurable from application
@@ -4280,6 +4286,7 @@ type IoniteBase = {
 	iam?: IAM;
 	workload?: Workload | AggregateWorkload;
 	ciam?: CIAM;
+	tm?: TenantManagement;
 	authz: Authz;
 	otel?: Otel;
 	/**
@@ -4360,6 +4367,66 @@ type BaseTenant = {
 	* integration completes; runtime construction must reject or remain unavailable while absent.
 	*/
 	configLocator?: ConfigLocator;
+	/**
+	* App-internal state for an integrator-requested Tenant Management handover. Protocol-internal
+	* fields are never serialized by the TM wire handlers.
+	*/
+	integration?: TenantIntegration;
+};
+type TenantIntegrationStatus = "consent_requested" | "consented" | "declined";
+type TenantIntegration = {
+	version: number;
+	integrator: string;
+	integratorName?: string;
+	integratorTenantId: string;
+	productId: string;
+	applicationId: string;
+	handleHash: string;
+	status: TenantIntegrationStatus;
+	expiresAt: string;
+	redeemAttempts: number;
+	requestedAt: string;
+	decidedAt?: string;
+	decidedBy?: string;
+	consentRedeemedAt?: string;
+	exportTokenHash?: string;
+	configExportedAt?: string;
+	handoverAppliedAt?: string;
+};
+type SetTenantIntegrationOptions = {
+	/**
+	* Compare-and-set guard. `null` requires no current integration; a string requires that current
+	* handle hash. Omit only when the caller intentionally accepts the current value.
+	*/
+	expectedHandleHash?: string | null;
+	/** Compare-and-set guard for transitions within the same handle. */
+	expectedVersion?: number;
+};
+type TmIntegratorConfig = {
+	id: string;
+	name?: string;
+	url: string;
+	issuer: string;
+	jwksUri: string;
+	audience: string;
+	clientId: string;
+};
+type RemoteTmConfig = {
+	enabled: true;
+	integrator: TmIntegratorConfig;
+	consentTtlSeconds?: number;
+	maxRedeemAttempts?: number;
+};
+type RecordTenantConsentInput = {
+	handle: string;
+	tenantId: string;
+	decision: "consented" | "declined";
+	decidedBy?: string;
+};
+type TenantManagement<TTenant extends BaseTenant = BaseTenant> = ModuleReadiness & {
+	handler(request: Request): Promise<Response>;
+	getTenant(id: string): Promise<TTenant | undefined>;
+	recordConsent(input: RecordTenantConsentInput): Promise<TTenant>;
 };
 /**
 * A single-flight cache of per-tenant {@link Ionite} instances, supplied by the app.
@@ -4398,6 +4465,8 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	upsert(tenant: TTenant): Promise<TTenant>;
 	delete(id: string): Promise<number>;
 	getIon(id: string): Promise<Ionite | undefined>;
+	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
+	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
 }
 type InMemoryTenantStoreOptions = {
 	/**
@@ -4415,6 +4484,8 @@ declare class InMemoryTenantStore<TTenant extends BaseTenant = BaseTenant> imple
 	upsert(tenant: TTenant): Promise<TTenant>;
 	delete(id: string): Promise<number>;
 	getIon(id: string): Promise<Ionite | undefined>;
+	setIntegration(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
+	getByIntegrationHandleHash(handleHash: string): Promise<TTenant | undefined>;
 }
 declare function sendTenantWebhook(webhookUrl: string, payload: TenantWebhookPayload, log: Logger): Promise<void>;
 /**
@@ -5123,18 +5194,21 @@ type Authz = {
 	*/
 	grant(change: AccessChange): Promise<AccessChange>;
 	/**
-	* Submit an access request on a principal's behalf. Allowed only when that kind's assignment
-	* policy is `'iam-request'`. Authenticated with the module-wide `deltaAudience` workload client.
+	* Submit one grant or revoke request on a principal's behalf. Allowed only when that kind's
+	* assignment policy is `'iam-request'`. One operation maps to one approval decision, status,
+	* and tracking URL. Authenticated with the module-wide `deltaAudience` workload client.
 	*/
 	requestAccess(change: {
 		subject: AccessChange["subject"];
 		subjectType: SubjectType;
 		targetType: EntitlementType;
 		target: AccessChange["target"];
+		operation: "grant" | "revoke";
 		justification?: string;
 	}): Promise<{
 		id: string;
 		status: "pending" | "approved" | "denied";
+		operation: "grant" | "revoke";
 		trackingUrl: string;
 	}>;
 	/**
@@ -5670,4 +5744,4 @@ type VerifyUserOptions = {
 *   does not match, or the token is expired.
 */
 declare function verifyUser(jwt: string, options: VerifyUserOptions): Promise<WorkforceUser>;
-export { AccessRequestCreate, AccessRequestResult, AccessRequestSubmit, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, CreateGroupOptions, CreateUserOptions, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, InMemoryTenantStore, JWKS, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, StateCookie, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, defaultRedirectPolicies, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, reconcileSubjectAccess, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveUser, sameOriginRedirectRules, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signLfvPayload, sso, stringifyLfvJwks, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };
+export { AccessRequestCreate, AccessRequestResult, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, CreateGroupOptions, CreateUserOptions, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, InMemoryTenantStore, JWKS, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, StateCookie, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, defaultRedirectPolicies, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, reconcileSubjectAccess, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveUser, sameOriginRedirectRules, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signLfvPayload, sso, stringifyLfvJwks, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };