@ionite/core 0.0.24-beta.20260922.9 → 0.0.24-beta.20260927.13

package/dist/index.d.ts

@@ -96,6 +96,93 @@ type CIAMProviderDescriptor = {
 	url?: string;
 };
 /**
+* Light display cookies (`${cookiesPrefix}.profile`).
+*
+* The envelope is SDK-owned. App code supplies only `user`. The cookie is not an
+* authentication input: the server never reads it to resolve a session, and the browser
+* may forge it. `expiresAt` is display metadata so a client can order entries without a
+* round trip; authoritative expiry is the peer `${cookiesPrefix}.session` record.
+*/
+declare const DISPLAY_COOKIE_SUFFIX = ".profile";
+declare const DISPLAY_COOKIE_VERSION = 1;
+declare const DEFAULT_DISPLAY_COOKIE_MAX = 10;
+declare const DEFAULT_DISCOVERED_COOKIE_MAX = 10;
+declare const DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS: number;
+declare const DISCOVERED_COOKIE_PREFIX = "ion.discovered";
+type DisplayCookieConfig = {
+	/**
+	* When true, the SDK writes a non-HttpOnly display cookie beside the opaque session cookie.
+	* ConfigSource-only. Default false.
+	*/
+	enabled?: boolean;
+	/**
+	* How many display cookies a single response may leave on the browser, newest session window
+	* first. ConfigSource-only. Values below 1 fall back to {@link DEFAULT_DISPLAY_COOKIE_MAX}.
+	* @default 10
+	*/
+	max?: number;
+	/**
+	* Session-less tenant hints written by an App after an explicit directory lookup.
+	* ConfigSource-only and off unless `enabled` is true.
+	*/
+	discovered?: DiscoveredDisplayCookieConfig;
+};
+type DiscoveredDisplayCookieConfig = {
+	enabled?: boolean;
+	/** Browser hint lifetime. This is not a session expiry. @default 14400 */
+	ttlSeconds?: number;
+	/** Independent cap; discovered hints never displace live-session entries. @default 10 */
+	max?: number;
+};
+/** What `${basePath}/auth/user` and `${basePath}/auth/customer` return. ConfigSource-only. */
+type UserEndpointPolicy = "full" | "display" | "off";
+type DisplayUser = Record<string, string | number | boolean | null>;
+type DisplayAuthType = "sso" | "ciam";
+type DisplayCookieEnvelope = {
+	v: typeof DISPLAY_COOKIE_VERSION;
+	/**
+	* Session envelopes omit this field (absent means `'session'`) so the wire format stays identical
+	* to cookies written before discovered hints existed; only discovered hints set it explicitly.
+	* Readers must treat `undefined` as `'session'`.
+	*/
+	kind?: "session" | "discovered";
+	tenantId?: string;
+	authType: DisplayAuthType;
+	/** ISO timestamp copied from the session window at write time. Display only. */
+	expiresAt: string;
+	user: DisplayUser;
+	tenantName?: string;
+};
+type DisplayIdentity = {
+	name?: string;
+	email?: string;
+	avatar?: string;
+};
+declare function resolveDisplayCookieMax(max: number | undefined): number;
+declare function resolveDiscoveredCookieMax(max: number | undefined): number;
+declare function resolveDiscoveredCookieTtlSeconds(ttlSeconds: number | undefined): number;
+declare function defaultDisplayUser(identity: DisplayIdentity): DisplayUser;
+/** Drop non-primitives and auth-bearing keys. Display cookies carry UI fields only. */
+declare function sanitizeDisplayUser(value: unknown): DisplayUser;
+/**
+* AppDev projection runs on the full user (including custom attributes). When omitted, or when it
+* throws, the cookie carries name, email, and avatar only. Forbidden and non-primitive fields are
+* dropped either way — a projector cannot put a session id or token into the cookie.
+*/
+declare function projectDisplayUser<TUser extends object>(user: TUser, projector?: (user: TUser) => unknown): DisplayUser;
+declare function encodeDisplayCookie(envelope: DisplayCookieEnvelope): string;
+declare function decodeDisplayCookie(raw: string): DisplayCookieEnvelope | undefined;
+type ParsedDisplayCookie = {
+	name: string;
+	prefix: string;
+	envelope: DisplayCookieEnvelope;
+};
+declare function readDisplayCookies(cookieHeader: string | null | undefined): ParsedDisplayCookie[];
+/** Client ordering: newest session window first. Invalid timestamps sort last. */
+declare function compareDisplayExpiryDesc(a: string | undefined, b: string | undefined): number;
+declare function profileCookieName(cookiesPrefix: string): string;
+declare function discoveredProfileCookieName(tenantId: string): string;
+/**
 * Minimal logger interface compatible with common structured logging patterns.
 */
 interface Logger {
@@ -2258,20 +2345,18 @@ type IamPrincipalKind = {
 	assignment: IamAssignmentPolicy;
 	delta?: IamDeltaMode;
 };
+/**
+* Destination-side inbox contract. The destination owns idempotency: when a pending request
+* already exists for the same (subjectType, subject, target, operation) tuple, `create` must
+* return that request with `created: false` (the handler answers 200 instead of 201). Operation
+* arrays are forbidden — one request carries exactly one `'grant' | 'revoke'`.
+*/
 type IAMAccessRequestsConfig = {
 	create: (request: AccessRequestCreate) => Promise<{
 		request: AccessRequestResult;
 		created: boolean;
 	}>;
 };
-type AccessRequestSubmit = {
-	subject: AccessChange["subject"];
-	subjectType: SubjectType;
-	targetType: EntitlementType;
-	target: AccessChange["target"];
-	operation: "grant" | "revoke";
-	justification?: string;
-};
 type IAMEntitlementRequestUrlContext = {
 	request: Request;
 	tenantId?: string;
@@ -3003,6 +3088,22 @@ interface SessionStore<TExtended = object> {
 	*/
 	delete(sid: string): Promise<void>;
 }
+type DisplayCookieAttributes = {
+	path: string;
+	domain?: string;
+	secure: boolean;
+	sameSite: "Strict" | "Lax";
+};
+type DisplayCookieCandidate = ParsedDisplayCookie & {
+	kind: "session" | "discovered";
+	/** Authoritative session-window expiry from the peer session record. */
+	sessionExpiresAt?: Date;
+	live: boolean;
+};
+type DisplayCookieTrim = (candidates: DisplayCookieCandidate[], options: {
+	max: number;
+	maxDiscovered: number;
+}) => DisplayCookieCandidate[];
 /**
 * What a login/logout `after*` hook may return:
 * - a `string` destination (validated against the same-origin safety floor),
@@ -3029,6 +3130,10 @@ type AfterLoginContext<
 > = {
 	request: Request;
 	context?: TCtx;
+	/** Current Ops policy for App-invoked discovered-tenant cookie planning. */
+	displayCookie?: DisplayCookieConfig;
+	/** Effective attributes shared by SDK session/display cookies. */
+	displayCookieAttributes: DisplayCookieAttributes;
 } & ({
 	ok: true;
 	user: TUser;
@@ -3089,6 +3194,85 @@ type IdentityResolution<T> = {
 };
 import { StandardSchemaV1 as StandardSchemaV16 } from "@standard-schema/spec";
 /**
+* Header media types are intentionally limited to values the SDK puts on the wire or has committed
+* to use. This is not a general MIME-type catalog; format metadata belongs with its owning feature.
+*/
+declare const JSON_MEDIA_TYPE = "application/json";
+declare const SCIM_MEDIA_TYPE = "application/scim+json";
+declare const FORM_MEDIA_TYPE = "application/x-www-form-urlencoded";
+declare const XML_MEDIA_TYPE = "application/xml";
+declare const OCTET_STREAM_MEDIA_TYPE = "application/octet-stream";
+/** Spreadable `Accept` header for outbound requests that expect a JSON body. */
+declare const ACCEPT_JSON: Readonly<{
+	Accept: typeof JSON_MEDIA_TYPE;
+}>;
+/**
+* Spreadable `Accept` header for outbound SCIM requests. Plain JSON is listed second so an
+* intermediary that only negotiates it can still match, while RFC 7644 servers keep answering
+* `application/scim+json`.
+*/
+declare const ACCEPT_SCIM: Readonly<{
+	Accept: `${typeof SCIM_MEDIA_TYPE}, ${typeof JSON_MEDIA_TYPE}`;
+}>;
+/** Spreadable `Accept` header reserved for SAML and other XML document retrieval. */
+declare const ACCEPT_XML: Readonly<{
+	Accept: typeof XML_MEDIA_TYPE;
+}>;
+/** Spreadable `Accept` header reserved for binary secret and file retrieval. */
+declare const ACCEPT_OCTET_STREAM: Readonly<{
+	Accept: typeof OCTET_STREAM_MEDIA_TYPE;
+}>;
+/** Spreadable `Content-Type` header for a JSON body. */
+declare const CONTENT_TYPE_JSON: Readonly<{
+	"Content-Type": typeof JSON_MEDIA_TYPE;
+}>;
+/** Spreadable `Content-Type` header for an RFC 7644 SCIM body. */
+declare const CONTENT_TYPE_SCIM: Readonly<{
+	"Content-Type": typeof SCIM_MEDIA_TYPE;
+}>;
+/** Spreadable `Content-Type` header for a URL-encoded form body. */
+declare const CONTENT_TYPE_FORM: Readonly<{
+	"Content-Type": typeof FORM_MEDIA_TYPE;
+}>;
+/** Spreadable `Content-Type` header for an XML body. */
+declare const CONTENT_TYPE_XML: Readonly<{
+	"Content-Type": typeof XML_MEDIA_TYPE;
+}>;
+/** Spreadable `Content-Type` header for an opaque binary body. */
+declare const CONTENT_TYPE_OCTET_STREAM: Readonly<{
+	"Content-Type": typeof OCTET_STREAM_MEDIA_TYPE;
+}>;
+/** Bounded diagnostic view of a response body that was not the expected representation. */
+type UnexpectedBodySummary = {
+	contentType?: string;
+	/** HTML `<title>` when present, else (unless redacted) the first ~300 chars of body text. */
+	excerpt?: string;
+};
+type ReadJsonResponseOptions = {
+	log?: Logger;
+	/** `ion.operation` value for the mismatch warning (defaults to `http.response`). */
+	operation?: string;
+	/** Secret-bearing transports set this so the excerpt never carries raw body text (title only). */
+	redact?: boolean;
+};
+/** Whether the response declares a JSON-compatible media type (`application/json` or any `+json`). */
+declare function isJsonResponse(response: Response): boolean;
+/**
+* Summarize a body the caller did not expect (typically an intermediary's HTML error page) as
+* `{ contentType, excerpt }` without ever surfacing the full payload. Consumes the response body;
+* pass a `.clone()` when the original must remain readable.
+*/
+declare function unexpectedBodySummary(response: Response, options?: {
+	redact?: boolean;
+}): Promise<UnexpectedBodySummary>;
+/**
+* Parse an expected-JSON response after verifying its media type. A non-JSON body (a proxy, tunnel,
+* or misconfigured origin answering instead of the service) warn-logs `reason: 'non_json_response'`
+* with a bounded, title-first excerpt and throws — the mismatch must reach Ops as an operational
+* signal, never as an opaque JSON parse error.
+*/
+declare function readJsonResponse<T>(response: Response, options?: ReadJsonResponseOptions): Promise<T>;
+/**
 * Result type for Standard Schema validation (success or failure).
 */
 type ValidateResult<T> = StandardSchemaV16.Result<T>;
@@ -3183,6 +3367,11 @@ type SSOConfig<
 	cookiesSecure?: boolean;
 	cookiesSameSite?: "Strict" | "Lax";
 	/**
+	* Parent hostname shared by host-scoped tenants. Omit for host-only cookies.
+	* ConfigSource-only; must match the App's host routing `baseDomain`.
+	*/
+	cookiesDomain?: string;
+	/**
 	* Optional tenant/application id copied into server-side sessions.
 	* Server integrations default this from the Ionite instance id.
 	*/
@@ -3243,6 +3432,28 @@ type SSOConfig<
 	* @default 86400
 	*/
 	sessionWindowSeconds?: number;
+	/**
+	* Browser-readable display cookie beside the opaque session cookie. ConfigSource-only.
+	* Off unless `enabled` is true. The server never reads this cookie to authenticate.
+	*/
+	displayCookie?: DisplayCookieConfig;
+	/**
+	* What `GET ${basePath}/auth/user` returns. ConfigSource-only.
+	* `full` is the verified user, `display` is the {@link displayUser} projection, `off` is 404.
+	* @default 'full'
+	*/
+	userEndpoint?: UserEndpointPolicy;
+	/**
+	* Code-only projection of the full user into the display cookie and the `display` user endpoint.
+	* Omitted: name, email, and avatar. Cannot override a disabled {@link displayCookie}.
+	*/
+	displayUser?: (user: WorkforceUser) => unknown;
+	/**
+	* Code-only cap trim. Candidates are live sessions newest first, then discovered hints newest
+	* first. `max` and `maxDiscovered` are enforced independently after the hook; the session cookie
+	* being written is kept even if this hook omits it.
+	*/
+	trimDisplayCookies?: DisplayCookieTrim;
 } & SSOHandlerConfig;
 type StateCookie = {
 	state: string;
@@ -4506,6 +4717,33 @@ type CIAMConfig<
 	*/
 	cookiesSameSite?: "Strict" | "Lax";
 	/**
+	* Parent hostname shared by host-scoped tenants. Omit for host-only cookies.
+	* ConfigSource-only; must match the App's host routing `baseDomain`.
+	*/
+	cookiesDomain?: string;
+	/**
+	* Browser-readable display cookie beside the opaque customer session cookie. ConfigSource-only.
+	* Off unless `enabled` is true. The server never reads this cookie to authenticate.
+	*/
+	displayCookie?: DisplayCookieConfig;
+	/**
+	* What `GET ${basePath}/auth/customer` returns. ConfigSource-only.
+	* `full` is the verified customer, `display` is the {@link displayUser} projection, `off` is 404.
+	* @default 'full'
+	*/
+	userEndpoint?: UserEndpointPolicy;
+	/**
+	* Code-only projection of the full customer into the display cookie and the `display` customer
+	* endpoint. Omitted: name, email, and avatar. Cannot override a disabled {@link displayCookie}.
+	*/
+	displayUser?: (user: Customer) => unknown;
+	/**
+	* Code-only cap trim. Candidates are live sessions newest first, then discovered hints newest
+	* first. `max` and `maxDiscovered` are enforced independently after the hook; the session cookie
+	* being written is kept even if this hook omits it.
+	*/
+	trimDisplayCookies?: DisplayCookieTrim;
+	/**
 	* Optional tenant/application id copied into server-side sessions.
 	* Server integrations default this from the Ionite instance id.
 	*/
@@ -4578,6 +4816,8 @@ type CIAM<
 	resolveCustomer: (request: Request) => Promise<IdentityResolution<Customer>>;
 	logout: (request: Request) => Promise<Response>;
 	handler: (request: Request) => Promise<Response>;
+	/** `GET ${basePath}/auth/customer`, including the Ops `userEndpoint` policy and display-cookie sync. */
+	customerHandler: (request: Request) => Promise<Response>;
 	/**
 	* Returns the sanitized, ordered list of enabled customer-login providers
 	* for the given request origin (never includes secrets).
@@ -4993,6 +5233,14 @@ type FrameworkTmConfig<TTenant extends BaseTenant = BaseTenant> = {
 		tenant: TTenant;
 		previousLocator?: ConfigLocator;
 	}) => void | Promise<void>;
+	/** Runs after a tenant POST has durably upserted its row. Awaited; the return value is ignored and failures are logged without rolling back the tenant. */
+	onTenantCreated?: (context: {
+		tenant: TTenant;
+	}) => unknown;
+	/** Runs after a tenant DELETE has removed its row. Awaited; the return value is ignored and failures are logged without changing the HTTP result. */
+	onTenantDeleted?: (context: {
+		tenantId: string;
+	}) => unknown;
 };
 type RecordTenantConsentInput = {
 	handle: string;
@@ -5049,6 +5297,25 @@ type TenantIonCache = {
 	fetch(id: string): Promise<Ionite | undefined>;
 	delete(id: string): unknown;
 };
+type TenantDirectoryIdentity = {
+	id?: string;
+	email?: string;
+	externalId?: string;
+};
+/**
+* Optional App-owned identity-to-tenant directory. This is deliberately separate from
+* {@link TenantStore}: tenant routing, Tenant Management, and ordinary multi-tenant Apps never need
+* these methods.
+*
+* Implement `findUserTenants` only for post-login directory discovery (for example, seeding
+* short-lived discovered-tenant display cookies). Implement `findTenantsByEmailDomain` only for
+* pre-login home-realm discovery where a domain is genuinely authoritative. The SDK never calls
+* either method implicitly; omitting both changes no SDK behavior.
+*/
+interface TenantDirectory<TTenant extends BaseTenant = BaseTenant> {
+	findUserTenants?(identity: TenantDirectoryIdentity, options?: ListOptions): Promise<ListResult<TTenant>>;
+	findTenantsByEmailDomain?(domain: string, options?: ListOptions): Promise<ListResult<TTenant>>;
+}
 interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	get(id: string): Promise<TTenant | undefined>;
 	list(options?: ListOptions): Promise<ListResult<TTenant>>;
@@ -5793,6 +6060,10 @@ type Authz = {
 	entitlements: {
 		list(options?: ListOptions): Promise<ListResult<Entitlement>>;
 	};
+	/** Durable catalog authority, when wired. Used by explicit app-owned entitlement lifecycles. */
+	readonly catalogStore?: AccessCatalogStore;
+	/** Durable direct-grant authority, when wired. Used by explicit app-owned grant lifecycles. */
+	readonly accessStore?: AccessAssignmentStore;
 	/** The wired closure index powering `has*`, when the app provided one via stores. */
 	accessIndex?: AccessIndex;
 	has(subject: AccessRef<BaseUser>, targetType: OaaAccessTargetType, target: AccessRef<Group | Role | Permission>, resource: AccessRef<Resource> | undefined, subjectType: SubjectType): Promise<AuthzDecision>;
@@ -6173,24 +6444,46 @@ type TenantPathRoutingStrategy = {
 	ui?: TenantPathNamespace;
 	api?: TenantPathNamespace;
 };
+type TenantHostRoutingStrategy = {
+	type: "host";
+	baseDomain: string;
+};
+type TenantSelectorRoutingStrategy = {
+	type: "selector";
+};
 /**
-* Tenant routing is URL/path-based only. Detecting a tenant from unverified request input (JWT
-* claims, headers, host/subdomain, cookies) is intentionally NOT provided by the SDK: it is easy to
-* spoof and must be paired with app-owned verification. Apps that need it can supply a `custom`
-* resolver (see `ResolveTenantFromRequestOptions.custom`) that does its own validation.
+* Routing selects which tenant runtime should handle a request; it never authenticates that choice.
+* Path segments, hosts, headers, and cookies are all untrusted selectors. Every strategy must still
+* enforce the SDK's tenant-bound session check before serving tenant data.
 */
-type TenantRoutingStrategy = TenantPathRoutingStrategy;
+type TenantRoutingStrategy = TenantPathRoutingStrategy | TenantHostRoutingStrategy | TenantSelectorRoutingStrategy;
 type TenantPathMatch = {
 	id: string;
 	restSegments: string[];
 	restPath: string;
 };
+type TenantHostMatch = {
+	id: string;
+};
 declare const DEFAULT_TENANT_UI_NAMESPACE: TenantPathNamespace;
 declare const DEFAULT_TENANT_API_NAMESPACE: TenantPathNamespace;
 declare function normalizeTenantPathNamespace(namespace?: TenantPathNamespace): TenantPathNamespace;
-declare function normalizeTenantRoutingStrategy(strategy?: TenantRoutingStrategy): TenantPathRoutingStrategy;
+declare function normalizeTenantRoutingStrategy(strategy?: TenantRoutingStrategy): TenantRoutingStrategy;
+/**
+* Throws on an empty result: a host strategy with no `baseDomain` would otherwise silently match no
+* host and every tenant request would 404 with nothing pointing at the configuration mistake.
+*/
+declare function normalizeTenantBaseDomain(baseDomain: string): string;
+declare function matchTenantHost(hostname: string, baseDomain: string): TenantHostMatch | null;
 declare function matchTenantPath(pathname: string, namespace?: TenantPathNamespace): TenantPathMatch | null;
 declare function buildTenantPath(id: string, restPath?: string, namespace?: TenantPathNamespace): string;
+/**
+* Only the path strategy encodes the tenant in a URL the SDK can build. Host and selector strategies
+* return the normalized `restPath` unchanged because the tenant is carried elsewhere (the origin, or
+* App-owned selector state): a scheme-relative `//{id}.{baseDomain}` guess would break behind port
+* mappings and dev proxies, and a selector switch is a mutation the App must perform explicitly.
+*/
+declare function buildTenantUrl(id: string, restPath?: string, strategy?: TenantRoutingStrategy, namespace?: "api" | "ui"): string;
 import { StandardSchemaV1 as StandardSchemaV110 } from "@standard-schema/spec";
 type RegisterSSOAppPayload = {
 	/** Redirect URIs for the client. */
@@ -6321,4 +6614,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestSubmit, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DestinationReference, DevSecretsConfig, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UpdateTenantRequest, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, catalogEntityStore, claimsToUser, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeUser, deepEqualPlain, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, readyCatalogEntry, remoteConfigSecretType, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadConfig, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{E,X,o,h,S,b,r,R,i,Q,U,u,e,d,W,M,V,H,ee,F,A,I,y,v,j,x,n,c,ne,k,J,re,se,w,N,L,l,a,t,D,oe,Y,ie,C,p,ae,ce,P,ue,m,T,G,B,de,s,f,g,pe,me,q,K}from"./shared/core-j5xhxcmq.js";var Je="0.0.24-beta.20260922.9";class he extends Error{constructor(O,_){super(O,_.cause!==void 0?{cause:_.cause}:void 0);this.name="ConfigSourceError",this.kind=_.kind,this.recoverable=_.recoverable,this.code=_.code,this.status=_.status,this.path=_.path,this.sourceType=_.sourceType,Object.setPrototypeOf(this,he.prototype)}}function Ye(O){return O instanceof he}var Se=["workload"],Ie={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},we={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},xe={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Pe={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Oe={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},_e={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},ve={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Ke={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Se},Me={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Ne={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Se,recommendedSubjectTypes:Se},Ze=[Ie,we,xe,Pe,Oe,_e,ve,Ke,Me,Ne],Qe={"iam.read":{permission:Ie,subjectType:["workload"]},"iam.users.write":{permission:we,subjectType:["workload"]},"iam.groups.write":{permission:xe,subjectType:["workload"]},"iam.workloads.write":{permission:Pe,subjectType:["workload"]},"iam.customers.write":{permission:Oe,subjectType:["workload"]},"iam.access-requests.write":{permission:_e,subjectType:["workload"]},"capabilitiez.read":{permission:ve,subjectType:["workload"]},"ciam.magic-link.create":{permission:Ke,subjectType:["workload","user"]},"authz.oaa.sync":{permission:Me,subjectType:["workload"]},"tenant.manage":{permission:Ne,subjectType:["workload"]}};var Xe=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function We(O){if(O===null||typeof O!=="object")return O;let _={};for(let[z,Z]of Object.entries(O)){if(Xe.includes(z)||z==="validators"||z==="setStores")continue;_[z]=Z!==null&&typeof Z==="object"&&!Array.isArray(Z)&&Object.getPrototypeOf(Z)===Object.prototype?We(Z):Z}return _}function et(O){return We(O)}function be(O,_){if(!O||typeof O!=="object"||Array.isArray(O))throw Error(`${_} must be an object.`);return O}function Re(O,_){if(O===void 0)return;if(typeof O!=="string"||O.length===0||!Number.isFinite(Date.parse(O)))throw Error(`${_} must be a valid timestamp string.`);return O}function je(O,_,z){if(!Array.isArray(O)||!z.allowEmpty&&O.length===0)throw Error(`${_} keys must be ${z.allowEmpty?"an":"a non-empty"} array.`);let Z=new Set;return O.map((ge,te)=>{let le=be(ge,`${_} keys[${te}]`);if(typeof le.id!=="string"||le.id.length===0)throw Error(`${_} keys[${te}].id must be a non-empty string.`);if(Z.has(le.id))throw Error(`${_} contains duplicate key id "${le.id}".`);if(Z.add(le.id),!["pending","active","deprecated","rotated","revoked"].includes(String(le.state)))throw Error(`${_} keys[${te}].state is invalid.`);if(le.value!==void 0&&(typeof le.value!=="string"||le.value.length===0))throw Error(`${_} keys[${te}].value must be a non-empty string when present.`);let fe=le.meta===void 0?void 0:be(le.meta,`${_} keys[${te}].meta`);return{id:le.id,state:le.state,...le.value===void 0?{}:{value:le.value},...le.notBefore===void 0?{}:{notBefore:Re(le.notBefore,`${_} keys[${te}].notBefore`)},...le.notAfter===void 0?{}:{notAfter:Re(le.notAfter,`${_} keys[${te}].notAfter`)},...le.createdAt===void 0?{}:{createdAt:Re(le.createdAt,`${_} keys[${te}].createdAt`)},...le.activatedAt===void 0?{}:{activatedAt:Re(le.activatedAt,`${_} keys[${te}].activatedAt`)},...le.deprecatedAt===void 0?{}:{deprecatedAt:Re(le.deprecatedAt,`${_} keys[${te}].deprecatedAt`)},...le.rotatedAt===void 0?{}:{rotatedAt:Re(le.rotatedAt,`${_} keys[${te}].rotatedAt`)},...le.revokedAt===void 0?{}:{revokedAt:Re(le.revokedAt,`${_} keys[${te}].revokedAt`)},...fe?{meta:{...fe}}:{}}})}function tt(O,_,z){if(O===void 0)return;if(!Array.isArray(O))throw Error(`${z} slots must be an array.`);let Z=new Set,ge=O.map((te,le)=>{if(te===null)return null;if(typeof te!=="string"||te.length===0)throw Error(`${z} slots[${le}] must be a non-empty key id or null.`);if(Z.has(te))throw Error(`${z} slots contain duplicate key id "${te}".`);Z.add(te);let fe=_.find((ye)=>ye.id===te);if(!fe)throw Error(`${z} slot key "${te}" is not present in keys.`);if(fe.state!=="active")throw Error(`${z} slot key "${te}" must have state "active".`);if(!fe.value)throw Error(`${z} slot key "${te}" must include a value.`);return te});if(_.length===0&&ge.some((te)=>te!==null))throw Error(`${z} slots must be omitted or all-null when keys is empty.`);return ge}function ot(O){let z=be(O,"KMS pool");if(z.kind!=="kms")throw Error('KMS pool kind must be "kms".');let Z=je(z.keys,"KMS pool",{allowEmpty:!0}),ge=tt(z.slots,Z,"KMS pool");return ge?{kind:"kms",slots:ge,keys:Z}:{kind:"kms",keys:Z}}function rt(O){let z=be(O,"KMS pool control document");if(z.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:je(z.keys,"KMS pool control document",{allowEmpty:!0})}}var nt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function qe(O){if(typeof O==="string")return O;try{return JSON.stringify(O)??String(O)}catch{return String(O)}}function Ee(O){let _=qe(O);return/^[A-Za-z0-9_./:@+|-]+$/.test(_)?_:JSON.stringify(_)}function st(O){return qe(O).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function $e(O,_,z){if(z==null)return;if(z instanceof Error){if(O.push(`${_}.name=${Ee(z.name)}`),O.push(`${_}.message=${Ee(z.message)}`),z.stack)O.push(`${_}.stack=${Ee(z.stack)}`);return}O.push(`${_}=${Ee(z)}`)}function Te(O,_,z=[],Z=new Date){let ge=st(_ instanceof Error?_.message:_??""),te=[];for(let[le,fe]of z.entries()){if(fe&&typeof fe==="object"&&!Array.isArray(fe)&&!(fe instanceof Error)&&Object.getPrototypeOf(fe)===Object.prototype){for(let[ye,ke]of Object.entries(fe))$e(te,ye,ke);continue}$e(te,`param.${le}`,fe)}return[Z.toISOString(),nt[O],ge,...te].filter(Boolean).join(" ")}var Ue={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},it=Ue,at={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},pt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},ct={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},mt={trace:()=>{},debug:(O,..._)=>globalThis.console.debug(Te("debug",O,_)),info:(O,..._)=>globalThis.console.info(Te("info",O,_)),warn:(O,..._)=>globalThis.console.warn(Te("warn",O,_)),error:(O,..._)=>globalThis.console.error(Te("error",O,_))};function ut(O,_){if(typeof _!=="number"||_<=0)return O;return new Promise((z,Z)=>{let ge=setTimeout(()=>{Z(Error(`Authz catalog entry did not become ready within ${_}ms`))},_);O.then(()=>{clearTimeout(ge),z()},(te)=>{clearTimeout(ge),Z(te)})})}function dt(O,_){let z=!1,Z,ge=_.then(()=>{z=!0},(le)=>{z=!1,Z=le}),te=O;return Object.defineProperty(te,"ready",{enumerable:!1,configurable:!0,value:(le)=>ut(ge.then(()=>{if(!z)throw Z}),le)}),Object.defineProperty(te,"isReady",{enumerable:!1,configurable:!0,value:()=>z}),te}var Le=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function De(O){if(!O.id.trim())throw Error("defineSecretType: id is required");let _=O.mimeType?.trim()||Le[O.format],z=Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:_,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},typeId:O.id});return Object.freeze({id:O.id,...O.label?{label:O.label}:{},format:O.format,mimeType:_,...O.schemaUrl?{schemaUrl:O.schemaUrl}:{},...O.schema?{schema:O.schema}:{},toRegistryEntry:()=>z})}function lt(O="jsonc"){return{format:O,mimeType:Le[O],typeId:O}}class ze extends Error{constructor(O,_){super(`Secret content type mismatch: expected "${O.mimeType}" (${O.format}) but received "${_.mimeType}" (${_.format})`);this.name="SecretContentTypeMismatchError",this.expected=O,this.received=_}}var gt=De({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Ve={beforeTenantSegments:["ui"]},Ge={beforeTenantSegments:["api"]};function Fe(O){return(O??[]).map((_)=>_.trim()).filter(Boolean)}function yt(O){let _=O.trim();if(!_)return"/";let z=_.replace(/\\/g,"/").replace(/\/+/g,"/");return z.startsWith("/")?z:`/${z}`}function Be(O){return yt(O).split("/").filter(Boolean)}function Ae(O){return{beforeTenantSegments:Fe(O?.beforeTenantSegments),afterTenantSegments:Fe(O?.afterTenantSegments)}}function ft(O){return{type:"path",ui:Ae(O?.ui??Ve),api:Ae(O?.api??Ge)}}function St(O,_){let z=Ae(_),Z=z.beforeTenantSegments??[],ge=z.afterTenantSegments??[],te=Be(O),le=Z.length+1+ge.length;if(te.length<le)return null;for(let Ce=0;Ce<Z.length;Ce++)if(te[Ce]!==Z[Ce])return null;let fe=Z.length,ye=te[fe];if(!ye)return null;for(let Ce=0;Ce<ge.length;Ce++)if(te[fe+1+Ce]!==ge[Ce])return null;let ke=te.slice(fe+1+ge.length);return{id:decodeURIComponent(ye),restSegments:ke,restPath:ke.length>0?`/${ke.join("/")}`:"/"}}function Ct(O,_="/",z){let Z=Ae(z),ge=Z.beforeTenantSegments??[],te=Z.afterTenantSegments??[],le=Be(_),fe=[...ge,encodeURIComponent(O),...te,...le];return fe.length>0?`/${fe.join("/")}`:"/"}function kt(O){return{"~standard":{version:1,vendor:O,validate:(_)=>{if(typeof _!=="object"||_===null)return{issues:[{message:"Expected an object"}]};let z=_,Z=[],ge={...z},te=["iss","sub"];for(let ye of te)if(ye in z){if(typeof z[ye]!=="string")Z.push({message:`${ye} must be a string`,path:[ye]})}else Z.push({message:`${ye} is required`,path:[ye]});if("aud"in z&&z.aud!==void 0){let ye=z.aud;if(typeof ye!=="string"&&!Array.isArray(ye))Z.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ye)&&!ye.every((ke)=>typeof ke==="string"))Z.push({message:"aud array must contain only strings",path:["aud"]})}let le=["jti","scope"];for(let ye of le)if(ye in z&&z[ye]!==void 0){if(typeof z[ye]!=="string")Z.push({message:`${ye} must be a string`,path:[ye]})}let fe=["exp","iat"];for(let ye of fe)if(ye in z){if(typeof z[ye]!=="number")Z.push({message:`${ye} must be a number`,path:[ye]})}else Z.push({message:`${ye} is required`,path:[ye]});if(Z.length>0)return{issues:Z};return{value:ge}}}}}function Rt(O){return{"~standard":{version:1,vendor:O,validate:(_)=>{if(typeof _!=="object"||_===null)return{issues:[{message:"Expected an object"}]};let z=_,Z=[],ge={};if("access_token"in z)if(typeof z.access_token==="string")ge.access_token=z.access_token;else Z.push({message:"access_token must be a string",path:["access_token"]});else Z.push({message:"access_token is required",path:["access_token"]});if("token_type"in z)if(typeof z.token_type==="string")ge.token_type=z.token_type;else Z.push({message:"token_type must be a string",path:["token_type"]});else Z.push({message:"token_type is required",path:["token_type"]});if("scope"in z)if(typeof z.scope==="string"||z.scope===void 0)ge.scope=z.scope;else Z.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in z)if(typeof z.refresh_token==="string"||z.refresh_token===void 0)ge.refresh_token=z.refresh_token;else Z.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in z)if(typeof z.expires==="string"||z.expires===void 0)ge.expires=z.expires;else Z.push({message:"expires must be a string",path:["expires"]});if("expires_in"in z)if(typeof z.expires_in==="number"||z.expires_in===void 0)ge.expires_in=z.expires_in;else Z.push({message:"expires_in must be a number",path:["expires_in"]});if(Z.length>0)return{issues:Z};return{value:ge}}}}}function Tt(O){let _=new Uint8Array(O);return crypto.getRandomValues(_),_}function At(O){let _="",z=Tt(O);for(let Z=0;Z<O;Z++){let ge=z[Z]%32;_+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ge)}return _}function ht(O,_){let z="";for(let Z=_;Z>0;Z--){let ge=O%32;z="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ge)+z,O=Math.floor(O/32)}return z}function bt(O){let _=Date.now(),z=ht(_,10),Z=At(16);return`${O??""}${z}${Z}`}export{V as AssignmentPolicyError,U as CANONICAL_RISK_LEVELS,he as ConfigSourceError,u as DEFAULT_RISK_LEVEL,Le as DEFAULT_SECRET_MIME_TYPES,Ge as DEFAULT_TENANT_API_NAMESPACE,Ve as DEFAULT_TENANT_UI_NAMESPACE,ne as ECID_SCHEME,k as EcidFormatError,e as ION_AUTHZ_GROUP_SCHEMA,Me as ION_AUTHZ_OAA_SYNC,ve as ION_CAPABILITIEZ_READ,Ke as ION_CIAM_MAGIC_LINK_CREATE,Qe as ION_ENDPOINT_PERMISSIONS,_e as ION_IAM_ACCESS_REQUESTS_WRITE,Oe as ION_IAM_CUSTOMERS_WRITE,xe as ION_IAM_GROUPS_WRITE,Ie as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Pe as ION_IAM_WORKLOADS_WRITE,g as ION_SCIM_CUSTOMER_SCHEMA,s as ION_SCIM_USER_EXTENSION_URN,f as ION_SCIM_WORKLOAD_SCHEMA,Ze as ION_SDK_PERMISSIONS,Ne as ION_TENANT_MANAGE,G as IoniteError,S as KNOWN_BASE_CUSTOMER_KEYS,h as KNOWN_BASE_USER_KEYS,o as KNOWN_ENTITLEMENT_KEYS,b as KNOWN_WORKLOAD_KEYS,d as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,ze as SecretContentTypeMismatchError,m as StoreConflictError,n as accessRefId,c as accessRootId,w as assertEcid,M as assertRequiredSubjectType,W as assertValidSubjectTypeScoping,Ct as buildTenantPath,I as catalogEntityStore,P as claimsToUser,X as configTrustedClientGrants,r as customAttributes,K as customerResourceSchema,at as debugLogger,ue as decodeUser,p as deepEqualPlain,it as defaultLogger,lt as defaultSecretContentType,F as defineCatalog,De as defineSecretType,j as deprecateRetiredCodeCatalogRows,re as formatEcid,Te as formatLogLine,bt as generateULID,A as getCodeCatalogEntity,me as groupResourceSchema,l as idTokenClaimsSchema,pt as infoLogger,H as isCodeCatalog,B as isConfigLocator,Ye as isConfigSourceError,J as isEcid,T as isStoreConflictError,kt as jwtAssertionClaimsSchema,R as list,i as listGenerator,St as matchTenantPath,Q as matchesListFilter,v as materializeCodeCatalogEntity,y as mergeCodeCatalogEntity,oe as mergeConfig,t as must,Ae as normalizeTenantPathNamespace,ft as normalizeTenantRoutingStrategy,N as oidcCallbackSchema,se as parseEcid,ie as parseJsonc,rt as parseKmsPoolControlDocument,ot as parseKmsPoolDocument,mt as prettyLogger,dt as readyCatalogEntry,gt as remoteConfigSecretType,et as serializeConfig,Ue as silentLogger,ae as stableConfigHash,Y as stripJsonComments,de as tmIntegrationState,ee as toCodeCatalog,L as tokenResponseSchema,C as trimTrailingSlash,E as trustedClientPermissionsForPrincipal,x as unionCatalogRead,pe as userSchema,D as validationFailureResponse,Je as version,ce as waitOn,ct as warnLogger,a as withValidate,q as workloadResourceSchema,Rt as workloadTokenResponseSchema};
+import{F,Ae,d,R,A,I,o,M,c,Ie,H,f,e,g,ue,J,de,Se,ve,ke,D,j,T,N,Y,L,n,p,Ee,K,Pe,_e,Ue,Q,ee,W,te,pe,me,m,q,be,z,v,x,V,Oe,E,Ce,Me,De,P,re,se,y,s,je,_,fe,ge,i,oe,Ne,Le,r,w,h,$e,Ke,Te,B,a,l,t,ie,We,we,qe,U,S,ze,Ve,G,Be,k,O,ye,he,Ge,u,b,C,He,Je,ae,ce}from"./shared/core-anx7e6cp.js";var Kt="0.0.24-beta.20260927.13";class nt extends Error{constructor(X,Z){super(X,Z.cause!==void 0?{cause:Z.cause}:void 0);this.name="ConfigSourceError",this.kind=Z.kind,this.recoverable=Z.recoverable,this.code=Z.code,this.status=Z.status,this.path=Z.path,this.sourceType=Z.sourceType,Object.setPrototypeOf(this,nt.prototype)}}function Nt(X){return X instanceof nt}var Ze=["workload"],at={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Ze,recommendedSubjectTypes:Ze},pt={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Ze,recommendedSubjectTypes:Ze},ct={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Ze,recommendedSubjectTypes:Ze},mt={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Ze,recommendedSubjectTypes:Ze},lt={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Ze,recommendedSubjectTypes:Ze},ut={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:Ze,recommendedSubjectTypes:Ze},dt={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Ze,recommendedSubjectTypes:Ze},gt={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Ze},yt={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Ze,recommendedSubjectTypes:Ze},ft={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Ze,recommendedSubjectTypes:Ze},Dt=[at,pt,ct,mt,lt,ut,dt,gt,yt,ft],Lt={"iam.read":{permission:at,subjectType:["workload"]},"iam.users.write":{permission:pt,subjectType:["workload"]},"iam.groups.write":{permission:ct,subjectType:["workload"]},"iam.workloads.write":{permission:mt,subjectType:["workload"]},"iam.customers.write":{permission:lt,subjectType:["workload"]},"iam.access-requests.write":{permission:ut,subjectType:["workload"]},"capabilitiez.read":{permission:dt,subjectType:["workload"]},"ciam.magic-link.create":{permission:gt,subjectType:["workload","user"]},"authz.oaa.sync":{permission:yt,subjectType:["workload"]},"tenant.manage":{permission:ft,subjectType:["workload"]}};var Wt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function kt(X){if(X===null||typeof X!=="object")return X;let Z={};for(let[ne,le]of Object.entries(X)){if(Wt.includes(ne)||ne==="validators"||ne==="setStores")continue;Z[ne]=le!==null&&typeof le==="object"&&!Array.isArray(le)&&Object.getPrototypeOf(le)===Object.prototype?kt(le):le}return Z}function jt(X){return kt(X)}function st(X,Z){if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`${Z} must be an object.`);return X}function tt(X,Z){if(X===void 0)return;if(typeof X!=="string"||X.length===0||!Number.isFinite(Date.parse(X)))throw Error(`${Z} must be a valid timestamp string.`);return X}function Rt(X,Z,ne){if(!Array.isArray(X)||!ne.allowEmpty&&X.length===0)throw Error(`${Z} keys must be ${ne.allowEmpty?"an":"a non-empty"} array.`);let le=new Set;return X.map((xe,Re)=>{let Fe=st(xe,`${Z} keys[${Re}]`);if(typeof Fe.id!=="string"||Fe.id.length===0)throw Error(`${Z} keys[${Re}].id must be a non-empty string.`);if(le.has(Fe.id))throw Error(`${Z} contains duplicate key id "${Fe.id}".`);if(le.add(Fe.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Fe.state)))throw Error(`${Z} keys[${Re}].state is invalid.`);if(Fe.value!==void 0&&(typeof Fe.value!=="string"||Fe.value.length===0))throw Error(`${Z} keys[${Re}].value must be a non-empty string when present.`);let Xe=Fe.meta===void 0?void 0:st(Fe.meta,`${Z} keys[${Re}].meta`);return{id:Fe.id,state:Fe.state,...Fe.value===void 0?{}:{value:Fe.value},...Fe.notBefore===void 0?{}:{notBefore:tt(Fe.notBefore,`${Z} keys[${Re}].notBefore`)},...Fe.notAfter===void 0?{}:{notAfter:tt(Fe.notAfter,`${Z} keys[${Re}].notAfter`)},...Fe.createdAt===void 0?{}:{createdAt:tt(Fe.createdAt,`${Z} keys[${Re}].createdAt`)},...Fe.activatedAt===void 0?{}:{activatedAt:tt(Fe.activatedAt,`${Z} keys[${Re}].activatedAt`)},...Fe.deprecatedAt===void 0?{}:{deprecatedAt:tt(Fe.deprecatedAt,`${Z} keys[${Re}].deprecatedAt`)},...Fe.rotatedAt===void 0?{}:{rotatedAt:tt(Fe.rotatedAt,`${Z} keys[${Re}].rotatedAt`)},...Fe.revokedAt===void 0?{}:{revokedAt:tt(Fe.revokedAt,`${Z} keys[${Re}].revokedAt`)},...Xe?{meta:{...Xe}}:{}}})}function Ut(X,Z,ne){if(X===void 0)return;if(!Array.isArray(X))throw Error(`${ne} slots must be an array.`);let le=new Set,xe=X.map((Re,Fe)=>{if(Re===null)return null;if(typeof Re!=="string"||Re.length===0)throw Error(`${ne} slots[${Fe}] must be a non-empty key id or null.`);if(le.has(Re))throw Error(`${ne} slots contain duplicate key id "${Re}".`);le.add(Re);let Xe=Z.find((Ye)=>Ye.id===Re);if(!Xe)throw Error(`${ne} slot key "${Re}" is not present in keys.`);if(Xe.state!=="active")throw Error(`${ne} slot key "${Re}" must have state "active".`);if(!Xe.value)throw Error(`${ne} slot key "${Re}" must include a value.`);return Re});if(Z.length===0&&xe.some((Re)=>Re!==null))throw Error(`${ne} slots must be omitted or all-null when keys is empty.`);return xe}function $t(X){let ne=st(X,"KMS pool");if(ne.kind!=="kms")throw Error('KMS pool kind must be "kms".');let le=Rt(ne.keys,"KMS pool",{allowEmpty:!0}),xe=Ut(ne.slots,le,"KMS pool");return xe?{kind:"kms",slots:xe,keys:le}:{kind:"kms",keys:le}}function zt(X){let ne=st(X,"KMS pool control document");if(ne.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:Rt(ne.keys,"KMS pool control document",{allowEmpty:!0})}}var Ft={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function At(X){if(typeof X==="string")return X;try{return JSON.stringify(X)??String(X)}catch{return String(X)}}function it(X){let Z=At(X);return/^[A-Za-z0-9_./:@+|-]+$/.test(Z)?Z:JSON.stringify(Z)}function qt(X){return At(X).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function Et(X,Z,ne){if(ne==null)return;if(ne instanceof Error){if(X.push(`${Z}.name=${it(ne.name)}`),X.push(`${Z}.message=${it(ne.message)}`),ne.stack)X.push(`${Z}.stack=${it(ne.stack)}`);return}X.push(`${Z}=${it(ne)}`)}function ot(X,Z,ne=[],le=new Date){let xe=qt(Z instanceof Error?Z.message:Z??""),Re=[];for(let[Fe,Xe]of ne.entries()){if(Xe&&typeof Xe==="object"&&!Array.isArray(Xe)&&!(Xe instanceof Error)&&Object.getPrototypeOf(Xe)===Object.prototype){for(let[Ye,et]of Object.entries(Xe))Et(Re,Ye,et);continue}Et(Re,`param.${Fe}`,Xe)}return[le.toISOString(),Ft[X],xe,...Re].filter(Boolean).join(" ")}var ht={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Vt=ht,Gt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Bt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Ht={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Yt={trace:()=>{},debug:(X,...Z)=>globalThis.console.debug(ot("debug",X,Z)),info:(X,...Z)=>globalThis.console.info(ot("info",X,Z)),warn:(X,...Z)=>globalThis.console.warn(ot("warn",X,Z)),error:(X,...Z)=>globalThis.console.error(ot("error",X,Z))};function Jt(X,Z){if(typeof Z!=="number"||Z<=0)return X;return new Promise((ne,le)=>{let xe=setTimeout(()=>{le(Error(`Authz catalog entry did not become ready within ${Z}ms`))},Z);X.then(()=>{clearTimeout(xe),ne()},(Re)=>{clearTimeout(xe),le(Re)})})}function Xt(X,Z){let ne=!1,le,xe=Z.then(()=>{ne=!0},(Fe)=>{ne=!1,le=Fe}),Re=X;return Object.defineProperty(Re,"ready",{enumerable:!1,configurable:!0,value:(Fe)=>Jt(xe.then(()=>{if(!ne)throw le}),Fe)}),Object.defineProperty(Re,"isReady",{enumerable:!1,configurable:!0,value:()=>ne}),Re}var St=Object.freeze({jsonc:s,env:"text/x-dotenv",text:"text/plain",binary:ge,yaml:"application/yaml",toml:"application/toml",xml:fe});function Ct(X){if(!X.id.trim())throw Error("defineSecretType: id is required");let Z=X.mimeType?.trim()||St[X.format],ne=Object.freeze({id:X.id,...X.label?{label:X.label}:{},format:X.format,mimeType:Z,...X.schemaUrl?{schemaUrl:X.schemaUrl}:{},typeId:X.id});return Object.freeze({id:X.id,...X.label?{label:X.label}:{},format:X.format,mimeType:Z,...X.schemaUrl?{schemaUrl:X.schemaUrl}:{},...X.schema?{schema:X.schema}:{},toRegistryEntry:()=>ne})}function Zt(X="jsonc"){return{format:X,mimeType:St[X],typeId:X}}class It extends Error{constructor(X,Z){super(`Secret content type mismatch: expected "${X.mimeType}" (${X.format}) but received "${Z.mimeType}" (${Z.format})`);this.name="SecretContentTypeMismatchError",this.expected=X,this.received=Z}}var Qt=Ct({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var _t={beforeTenantSegments:["ui"]},xt={beforeTenantSegments:["api"]};function bt(X){return(X??[]).map((Z)=>Z.trim()).filter(Boolean)}function Ot(X){let Z=X.trim();if(!Z)return"/";let ne=Z.replace(/\\/g,"/").replace(/\/+/g,"/");return ne.startsWith("/")?ne:`/${ne}`}function Pt(X){return Ot(X).split("/").filter(Boolean)}function rt(X){return{beforeTenantSegments:bt(X?.beforeTenantSegments),afterTenantSegments:bt(X?.afterTenantSegments)}}function wt(X){if(X?.type==="host")return{type:"host",baseDomain:Tt(X.baseDomain)};if(X?.type==="selector")return X;return{type:"path",ui:rt(X?.ui??_t),api:rt(X?.api??xt)}}function Tt(X){let Z=X.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!Z)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return Z}function eo(X,Z){let ne=X.trim().replace(/\.$/,"").toLowerCase(),le=Tt(Z);if(!ne.endsWith(`.${le}`))return null;let xe=ne.slice(0,-(le.length+1));if(!xe||xe.includes("."))return null;return{id:xe}}function to(X,Z){let ne=rt(Z),le=ne.beforeTenantSegments??[],xe=ne.afterTenantSegments??[],Re=Pt(X),Fe=le.length+1+xe.length;if(Re.length<Fe)return null;for(let Qe=0;Qe<le.length;Qe++)if(Re[Qe]!==le[Qe])return null;let Xe=le.length,Ye=Re[Xe];if(!Ye)return null;for(let Qe=0;Qe<xe.length;Qe++)if(Re[Xe+1+Qe]!==xe[Qe])return null;let et=Re.slice(Xe+1+xe.length);return{id:decodeURIComponent(Ye),restSegments:et,restPath:et.length>0?`/${et.join("/")}`:"/"}}function Mt(X,Z="/",ne){let le=rt(ne),xe=le.beforeTenantSegments??[],Re=le.afterTenantSegments??[],Fe=Pt(Z),Xe=[...xe,encodeURIComponent(X),...Re,...Fe];return Xe.length>0?`/${Xe.join("/")}`:"/"}function oo(X,Z="/",ne,le="ui"){let xe=wt(ne);if(xe.type==="host"||xe.type==="selector")return Ot(Z);return Mt(X,Z,xe[le])}function ro(X){return{"~standard":{version:1,vendor:X,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let ne=Z,le=[],xe={...ne},Re=["iss","sub"];for(let Ye of Re)if(Ye in ne){if(typeof ne[Ye]!=="string")le.push({message:`${Ye} must be a string`,path:[Ye]})}else le.push({message:`${Ye} is required`,path:[Ye]});if("aud"in ne&&ne.aud!==void 0){let Ye=ne.aud;if(typeof Ye!=="string"&&!Array.isArray(Ye))le.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(Ye)&&!Ye.every((et)=>typeof et==="string"))le.push({message:"aud array must contain only strings",path:["aud"]})}let Fe=["jti","scope"];for(let Ye of Fe)if(Ye in ne&&ne[Ye]!==void 0){if(typeof ne[Ye]!=="string")le.push({message:`${Ye} must be a string`,path:[Ye]})}let Xe=["exp","iat"];for(let Ye of Xe)if(Ye in ne){if(typeof ne[Ye]!=="number")le.push({message:`${Ye} must be a number`,path:[Ye]})}else le.push({message:`${Ye} is required`,path:[Ye]});if(le.length>0)return{issues:le};return{value:xe}}}}}function no(X){return{"~standard":{version:1,vendor:X,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let ne=Z,le=[],xe={};if("access_token"in ne)if(typeof ne.access_token==="string")xe.access_token=ne.access_token;else le.push({message:"access_token must be a string",path:["access_token"]});else le.push({message:"access_token is required",path:["access_token"]});if("token_type"in ne)if(typeof ne.token_type==="string")xe.token_type=ne.token_type;else le.push({message:"token_type must be a string",path:["token_type"]});else le.push({message:"token_type is required",path:["token_type"]});if("scope"in ne)if(typeof ne.scope==="string"||ne.scope===void 0)xe.scope=ne.scope;else le.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in ne)if(typeof ne.refresh_token==="string"||ne.refresh_token===void 0)xe.refresh_token=ne.refresh_token;else le.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in ne)if(typeof ne.expires==="string"||ne.expires===void 0)xe.expires=ne.expires;else le.push({message:"expires must be a string",path:["expires"]});if("expires_in"in ne)if(typeof ne.expires_in==="number"||ne.expires_in===void 0)xe.expires_in=ne.expires_in;else le.push({message:"expires_in must be a number",path:["expires_in"]});if(le.length>0)return{issues:le};return{value:xe}}}}}function so(X){let Z=new Uint8Array(X);return crypto.getRandomValues(Z),Z}function io(X){let Z="",ne=so(X);for(let le=0;le<X;le++){let xe=ne[le]%32;Z+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(xe)}return Z}function ao(X,Z){let ne="";for(let le=Z;le>0;le--){let xe=X%32;ne="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(xe)+ne,X=Math.floor(X/32)}return ne}function po(X){let Z=Date.now(),ne=ao(Z,10),le=io(16);return`${X??""}${ne}${le}`}export{i as ACCEPT_JSON,Le as ACCEPT_OCTET_STREAM,oe as ACCEPT_SCIM,Ne as ACCEPT_XML,de as AssignmentPolicyError,H as CANONICAL_RISK_LEVELS,h as CONTENT_TYPE_FORM,r as CONTENT_TYPE_JSON,Ke as CONTENT_TYPE_OCTET_STREAM,w as CONTENT_TYPE_SCIM,$e as CONTENT_TYPE_XML,nt as ConfigSourceError,_e as DEFAULT_DISCOVERED_COOKIE_MAX,Ue as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Pe as DEFAULT_DISPLAY_COOKIE_MAX,f as DEFAULT_RISK_LEVEL,St as DEFAULT_SECRET_MIME_TYPES,xt as DEFAULT_TENANT_API_NAMESPACE,_t as DEFAULT_TENANT_UI_NAMESPACE,Q as DISCOVERED_COOKIE_PREFIX,Ee as DISPLAY_COOKIE_SUFFIX,K as DISPLAY_COOKIE_VERSION,Oe as ECID_SCHEME,E as EcidFormatError,_ as FORM_MEDIA_TYPE,e as ION_AUTHZ_GROUP_SCHEMA,yt as ION_AUTHZ_OAA_SYNC,dt as ION_CAPABILITIEZ_READ,gt as ION_CIAM_MAGIC_LINK_CREATE,Lt as ION_ENDPOINT_PERMISSIONS,ut as ION_IAM_ACCESS_REQUESTS_WRITE,lt as ION_IAM_CUSTOMERS_WRITE,ct as ION_IAM_GROUPS_WRITE,at as ION_IAM_READ,pt as ION_IAM_USERS_WRITE,mt as ION_IAM_WORKLOADS_WRITE,C as ION_SCIM_CUSTOMER_SCHEMA,u as ION_SCIM_USER_EXTENSION_URN,b as ION_SCIM_WORKLOAD_SCHEMA,Dt as ION_SDK_PERMISSIONS,ft as ION_TENANT_MANAGE,ye as IoniteError,s as JSON_MEDIA_TYPE,A as KNOWN_BASE_CUSTOMER_KEYS,R as KNOWN_BASE_USER_KEYS,d as KNOWN_ENTITLEMENT_KEYS,I as KNOWN_WORKLOAD_KEYS,ge as OCTET_STREAM_MEDIA_TYPE,g as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,je as SCIM_MEDIA_TYPE,It as SecretContentTypeMismatchError,k as StoreConflictError,fe as XML_MEDIA_TYPE,n as accessRefId,p as accessRootId,P as assertEcid,J as assertRequiredSubjectType,ue as assertValidSubjectTypeScoping,Mt as buildTenantPath,oo as buildTenantUrl,j as catalogEntityStore,G as claimsToUser,v as compareDisplayExpiryDesc,Ae as configTrustedClientGrants,o as customAttributes,ce as customerResourceSchema,Gt as debugLogger,be as decodeDisplayCookie,Be as decodeUser,S as deepEqualPlain,pe as defaultDisplayUser,Vt as defaultLogger,Zt as defaultSecretContentType,ke as defineCatalog,Ct as defineSecretType,Y as deprecateRetiredCodeCatalogRows,V as discoveredProfileCookieName,q as encodeDisplayCookie,Me as formatEcid,ot as formatLogLine,po as generateULID,D as getCodeCatalogEntity,Je as groupResourceSchema,y as idTokenClaimsSchema,Bt as infoLogger,Se as isCodeCatalog,he as isConfigLocator,Nt as isConfigSourceError,Ce as isEcid,Te as isJsonResponse,O as isStoreConflictError,ro as jwtAssertionClaimsSchema,M as list,c as listGenerator,eo as matchTenantHost,to as matchTenantPath,Ie as matchesListFilter,N as materializeCodeCatalogEntity,T as mergeCodeCatalogEntity,We as mergeConfig,t as must,Tt as normalizeTenantBaseDomain,rt as normalizeTenantPathNamespace,wt as normalizeTenantRoutingStrategy,re as oidcCallbackSchema,De as parseEcid,qe as parseJsonc,zt as parseKmsPoolControlDocument,$t as parseKmsPoolDocument,Yt as prettyLogger,x as profileCookieName,m as projectDisplayUser,z as readDisplayCookies,a as readJsonResponse,Xt as readyCatalogEntry,Qt as remoteConfigSecretType,W as resolveDiscoveredCookieMax,te as resolveDiscoveredCookieTtlSeconds,ee as resolveDisplayCookieMax,me as sanitizeDisplayUser,jt as serializeConfig,ht as silentLogger,ze as stableConfigHash,we as stripJsonComments,Ge as tmIntegrationState,ve as toCodeCatalog,se as tokenResponseSchema,U as trimTrailingSlash,F as trustedClientPermissionsForPrincipal,B as unexpectedBodySummary,L as unionCatalogRead,He as userSchema,ie as validationFailureResponse,Kt as version,Ve as waitOn,Ht as warnLogger,l as withValidate,ae as workloadResourceSchema,no as workloadTokenResponseSchema};