@ionite/core 0.0.24-beta.20261003.16 → 0.0.24-beta.20261003.17

package/dist/index.d.ts

@@ -2068,6 +2068,11 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	* Read on every acquisition because the platform rotates it.
 	*/
 	federatedTokenFile?: string;
+	/**
+	* `managed_identity`: get the token from the platform's managed identity endpoint instead of an
+	* IdP token URL. `clientId` is the managed identity's client ID; `scope` names the audience.
+	*/
+	authMethod?: "managed_identity";
 };
 /**
 * Server-Only Workload Configuration
@@ -2101,7 +2106,7 @@ type ServerOnlyWorkloadConfig = WorkloadConfigBase & {
 * detected based on which fields are present:
 *
 * - **JWT Bearer Grant**: Requires `workload_id` + `private_key`
-* - **Client Credentials**: Requires `client_id` + `client_secret`
+* - **Client Credentials**: Requires `client_id` + `client_secret`, a federated token file, or `authMethod: "managed_identity"`
 * - **Server-Only**: Only `jwks_uri` (and optionally `issuer`) for token validation
 *
 * The developer uses the same API regardless of mode - the library handles the details.

package/dist/index.js

@@ -1,2 +1,2 @@
-import{$ as Ct,A as Je,Aa as zt,B as Xe,Ba as Ft,Ca as qt,Da as Vt,Ea as Gt,Fa as Bt,G as Ze,Ga as Ht,H as Qe,Ha as Yt,I as et,Ia as Jt,J as tt,Ja as Xt,K as ot,Ka as Zt,L as rt,La as Qt,M as nt,Ma as eo,N as st,Na as to,O as it,P as at,Q as pt,Qa as oo,R as ct,Ra as ro,S as mt,Sa as no,T as lt,Ta as so,Ua as io,V as ut,Va as ao,W as dt,Wa as po,X as gt,Y as yt,Z as ft,_ as St,a as he,aa as Tt,b as Ie,ba as kt,c as be,ca as Rt,d as _e,da as Et,e as xe,ea as At,f as Oe,fa as ht,g as Pe,ga as x,h as we,ha as It,i as Me,ia as bt,j as ve,ja as O,k as Ke,ka as P,l as Ne,la as _t,m as De,ma as xt,n as Le,na as Ot,o as We,oa as Pt,p as je,pa as wt,q as Ue,qa as Mt,r as $e,ra as vt,s as ze,sa as Kt,t as Fe,ta as Nt,u as qe,ua as Dt,v as Ve,va as Lt,w as Ge,wa as Wt,x as Be,xa as jt,y as He,ya as Ut,z as Ye,za as $t}from"./shared/core-njzaahvy.js";var Y="0.0.24-beta.20261003.16";class y extends Error{constructor(e,t){super(e,t.cause!==void 0?{cause:t.cause}:void 0);this.name="ConfigSourceError",this.kind=t.kind,this.recoverable=t.recoverable,this.code=t.code,this.status=t.status,this.path=t.path,this.sourceType=t.sourceType,Object.setPrototypeOf(this,y.prototype)}}function J(e){return e instanceof y}var c=["workload"],C={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:c,recommendedSubjectTypes:c},T={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},k={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},R={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},E={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},A={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:c,recommendedSubjectTypes:c},h={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:c,recommendedSubjectTypes:c},I={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:c},b={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:c,recommendedSubjectTypes:c},_={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},X=[C,T,k,R,E,A,h,I,b,_],Z={"iam.read":{permission:C,subjectType:["workload"]},"iam.users.write":{permission:T,subjectType:["workload"]},"iam.groups.write":{permission:k,subjectType:["workload"]},"iam.workloads.write":{permission:R,subjectType:["workload"]},"iam.customers.write":{permission:E,subjectType:["workload"]},"iam.access-requests.write":{permission:A,subjectType:["workload"]},"capabilitiez.read":{permission:h,subjectType:["workload"]},"ciam.magic-link.create":{permission:I,subjectType:["workload","user"]},"authz.oaa.sync":{permission:b,subjectType:["workload"]},"tenant.manage":{permission:_,subjectType:["workload"]}};var Q=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function K(e){if(e===null||typeof e!=="object")return e;let t={};for(let[o,r]of Object.entries(e)){if(Q.includes(o)||o==="validators"||o==="setStores")continue;t[o]=r!==null&&typeof r==="object"&&!Array.isArray(r)&&Object.getPrototypeOf(r)===Object.prototype?K(r):r}return t}function ee(e){return K(e)}function f(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} must be an object.`);return e}function u(e,t){if(e===void 0)return;if(typeof e!=="string"||e.length===0||!Number.isFinite(Date.parse(e)))throw Error(`${t} must be a valid timestamp string.`);return e}function N(e,t,o){if(!Array.isArray(e)||!o.allowEmpty&&e.length===0)throw Error(`${t} keys must be ${o.allowEmpty?"an":"a non-empty"} array.`);let r=new Set;return e.map((s,n)=>{let i=f(s,`${t} keys[${n}]`);if(typeof i.id!=="string"||i.id.length===0)throw Error(`${t} keys[${n}].id must be a non-empty string.`);if(r.has(i.id))throw Error(`${t} contains duplicate key id "${i.id}".`);if(r.add(i.id),!["pending","active","deprecated","rotated","revoked"].includes(String(i.state)))throw Error(`${t} keys[${n}].state is invalid.`);if(i.value!==void 0&&(typeof i.value!=="string"||i.value.length===0))throw Error(`${t} keys[${n}].value must be a non-empty string when present.`);let p=i.meta===void 0?void 0:f(i.meta,`${t} keys[${n}].meta`);return{id:i.id,state:i.state,...i.value===void 0?{}:{value:i.value},...i.notBefore===void 0?{}:{notBefore:u(i.notBefore,`${t} keys[${n}].notBefore`)},...i.notAfter===void 0?{}:{notAfter:u(i.notAfter,`${t} keys[${n}].notAfter`)},...i.createdAt===void 0?{}:{createdAt:u(i.createdAt,`${t} keys[${n}].createdAt`)},...i.activatedAt===void 0?{}:{activatedAt:u(i.activatedAt,`${t} keys[${n}].activatedAt`)},...i.deprecatedAt===void 0?{}:{deprecatedAt:u(i.deprecatedAt,`${t} keys[${n}].deprecatedAt`)},...i.rotatedAt===void 0?{}:{rotatedAt:u(i.rotatedAt,`${t} keys[${n}].rotatedAt`)},...i.revokedAt===void 0?{}:{revokedAt:u(i.revokedAt,`${t} keys[${n}].revokedAt`)},...p?{meta:{...p}}:{}}})}function te(e,t,o){if(e===void 0)return;if(!Array.isArray(e))throw Error(`${o} slots must be an array.`);let r=new Set,s=e.map((n,i)=>{if(n===null)return null;if(typeof n!=="string"||n.length===0)throw Error(`${o} slots[${i}] must be a non-empty key id or null.`);if(r.has(n))throw Error(`${o} slots contain duplicate key id "${n}".`);r.add(n);let p=t.find((a)=>a.id===n);if(!p)throw Error(`${o} slot key "${n}" is not present in keys.`);if(p.state!=="active")throw Error(`${o} slot key "${n}" must have state "active".`);if(!p.value)throw Error(`${o} slot key "${n}" must include a value.`);return n});if(t.length===0&&s.some((n)=>n!==null))throw Error(`${o} slots must be omitted or all-null when keys is empty.`);return s}function oe(e){let o=f(e,"KMS pool");if(o.kind!=="kms")throw Error('KMS pool kind must be "kms".');let r=N(o.keys,"KMS pool",{allowEmpty:!0}),s=te(o.slots,r,"KMS pool");return s?{kind:"kms",slots:s,keys:r}:{kind:"kms",keys:r}}function re(e){let o=f(e,"KMS pool control document");if(o.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:N(o.keys,"KMS pool control document",{allowEmpty:!0})}}var ne={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function L(e){if(typeof e==="string")return e;try{return JSON.stringify(e)??String(e)}catch{return String(e)}}function S(e){let t=L(e);return/^[A-Za-z0-9_./:@+|-]+$/.test(t)?t:JSON.stringify(t)}function se(e){return L(e).replaceAll("\r","\\r").replaceAll(`
+import{$ as Ct,A as Je,Aa as zt,B as Xe,Ba as Ft,Ca as qt,Da as Vt,Ea as Gt,Fa as Bt,G as Ze,Ga as Ht,H as Qe,Ha as Yt,I as et,Ia as Jt,J as tt,Ja as Xt,K as ot,Ka as Zt,L as rt,La as Qt,M as nt,Ma as eo,N as st,Na as to,O as it,P as at,Q as pt,Qa as oo,R as ct,Ra as ro,S as mt,Sa as no,T as lt,Ta as so,Ua as io,V as ut,Va as ao,W as dt,Wa as po,X as gt,Y as yt,Z as ft,_ as St,a as he,aa as Tt,b as Ie,ba as kt,c as be,ca as Rt,d as _e,da as Et,e as xe,ea as At,f as Oe,fa as ht,g as Pe,ga as x,h as we,ha as It,i as Me,ia as bt,j as ve,ja as O,k as Ke,ka as P,l as Ne,la as _t,m as De,ma as xt,n as Le,na as Ot,o as We,oa as Pt,p as je,pa as wt,q as Ue,qa as Mt,r as $e,ra as vt,s as ze,sa as Kt,t as Fe,ta as Nt,u as qe,ua as Dt,v as Ve,va as Lt,w as Ge,wa as Wt,x as Be,xa as jt,y as He,ya as Ut,z as Ye,za as $t}from"./shared/core-njzaahvy.js";var Y="0.0.24-beta.20261003.17";class y extends Error{constructor(e,t){super(e,t.cause!==void 0?{cause:t.cause}:void 0);this.name="ConfigSourceError",this.kind=t.kind,this.recoverable=t.recoverable,this.code=t.code,this.status=t.status,this.path=t.path,this.sourceType=t.sourceType,Object.setPrototypeOf(this,y.prototype)}}function J(e){return e instanceof y}var c=["workload"],C={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users, Groups, Workloads, and Customers via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:c,recommendedSubjectTypes:c},T={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},k={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},R={id:"ion:iam:workloads:write",name:"Manage Workloads (SCIM Workloads)",description:"Authorizes a workload to create, replace, modify, and delete Workload principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},E={id:"ion:iam:customers:write",name:"Manage Customers (SCIM Customers)",description:"Authorizes a workload to create, replace, modify, and delete Customer principals via SCIM, including access-root revocation on delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},A={id:"ion:iam:access-requests:write",name:"Submit Access Requests",description:"Authorizes a workload to submit an access request on a principal's behalf via the AccessRequests endpoint.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:c,recommendedSubjectTypes:c},h={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:c,recommendedSubjectTypes:c},I={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:c},b={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:c,recommendedSubjectTypes:c},_={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:c,recommendedSubjectTypes:c},X=[C,T,k,R,E,A,h,I,b,_],Z={"iam.read":{permission:C,subjectType:["workload"]},"iam.users.write":{permission:T,subjectType:["workload"]},"iam.groups.write":{permission:k,subjectType:["workload"]},"iam.workloads.write":{permission:R,subjectType:["workload"]},"iam.customers.write":{permission:E,subjectType:["workload"]},"iam.access-requests.write":{permission:A,subjectType:["workload"]},"capabilitiez.read":{permission:h,subjectType:["workload"]},"ciam.magic-link.create":{permission:I,subjectType:["workload","user"]},"authz.oaa.sync":{permission:b,subjectType:["workload"]},"tenant.manage":{permission:_,subjectType:["workload"]}};var Q=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function K(e){if(e===null||typeof e!=="object")return e;let t={};for(let[o,r]of Object.entries(e)){if(Q.includes(o)||o==="validators"||o==="setStores")continue;t[o]=r!==null&&typeof r==="object"&&!Array.isArray(r)&&Object.getPrototypeOf(r)===Object.prototype?K(r):r}return t}function ee(e){return K(e)}function f(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`${t} must be an object.`);return e}function u(e,t){if(e===void 0)return;if(typeof e!=="string"||e.length===0||!Number.isFinite(Date.parse(e)))throw Error(`${t} must be a valid timestamp string.`);return e}function N(e,t,o){if(!Array.isArray(e)||!o.allowEmpty&&e.length===0)throw Error(`${t} keys must be ${o.allowEmpty?"an":"a non-empty"} array.`);let r=new Set;return e.map((s,n)=>{let i=f(s,`${t} keys[${n}]`);if(typeof i.id!=="string"||i.id.length===0)throw Error(`${t} keys[${n}].id must be a non-empty string.`);if(r.has(i.id))throw Error(`${t} contains duplicate key id "${i.id}".`);if(r.add(i.id),!["pending","active","deprecated","rotated","revoked"].includes(String(i.state)))throw Error(`${t} keys[${n}].state is invalid.`);if(i.value!==void 0&&(typeof i.value!=="string"||i.value.length===0))throw Error(`${t} keys[${n}].value must be a non-empty string when present.`);let p=i.meta===void 0?void 0:f(i.meta,`${t} keys[${n}].meta`);return{id:i.id,state:i.state,...i.value===void 0?{}:{value:i.value},...i.notBefore===void 0?{}:{notBefore:u(i.notBefore,`${t} keys[${n}].notBefore`)},...i.notAfter===void 0?{}:{notAfter:u(i.notAfter,`${t} keys[${n}].notAfter`)},...i.createdAt===void 0?{}:{createdAt:u(i.createdAt,`${t} keys[${n}].createdAt`)},...i.activatedAt===void 0?{}:{activatedAt:u(i.activatedAt,`${t} keys[${n}].activatedAt`)},...i.deprecatedAt===void 0?{}:{deprecatedAt:u(i.deprecatedAt,`${t} keys[${n}].deprecatedAt`)},...i.rotatedAt===void 0?{}:{rotatedAt:u(i.rotatedAt,`${t} keys[${n}].rotatedAt`)},...i.revokedAt===void 0?{}:{revokedAt:u(i.revokedAt,`${t} keys[${n}].revokedAt`)},...p?{meta:{...p}}:{}}})}function te(e,t,o){if(e===void 0)return;if(!Array.isArray(e))throw Error(`${o} slots must be an array.`);let r=new Set,s=e.map((n,i)=>{if(n===null)return null;if(typeof n!=="string"||n.length===0)throw Error(`${o} slots[${i}] must be a non-empty key id or null.`);if(r.has(n))throw Error(`${o} slots contain duplicate key id "${n}".`);r.add(n);let p=t.find((a)=>a.id===n);if(!p)throw Error(`${o} slot key "${n}" is not present in keys.`);if(p.state!=="active")throw Error(`${o} slot key "${n}" must have state "active".`);if(!p.value)throw Error(`${o} slot key "${n}" must include a value.`);return n});if(t.length===0&&s.some((n)=>n!==null))throw Error(`${o} slots must be omitted or all-null when keys is empty.`);return s}function oe(e){let o=f(e,"KMS pool");if(o.kind!=="kms")throw Error('KMS pool kind must be "kms".');let r=N(o.keys,"KMS pool",{allowEmpty:!0}),s=te(o.slots,r,"KMS pool");return s?{kind:"kms",slots:s,keys:r}:{kind:"kms",keys:r}}function re(e){let o=f(e,"KMS pool control document");if(o.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:N(o.keys,"KMS pool control document",{allowEmpty:!0})}}var ne={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function L(e){if(typeof e==="string")return e;try{return JSON.stringify(e)??String(e)}catch{return String(e)}}function S(e){let t=L(e);return/^[A-Za-z0-9_./:@+|-]+$/.test(t)?t:JSON.stringify(t)}function se(e){return L(e).replaceAll("\r","\\r").replaceAll(`
 `,"\\n")}function D(e,t,o){if(o==null)return;if(o instanceof Error){if(e.push(`${t}.name=${S(o.name)}`),e.push(`${t}.message=${S(o.message)}`),o.stack)e.push(`${t}.stack=${S(o.stack)}`);return}e.push(`${t}=${S(o)}`)}function d(e,t,o=[],r=new Date){let s=se(t instanceof Error?t.message:t??""),n=[];for(let[i,p]of o.entries()){if(p&&typeof p==="object"&&!Array.isArray(p)&&!(p instanceof Error)&&Object.getPrototypeOf(p)===Object.prototype){for(let[a,l]of Object.entries(p))D(n,a,l);continue}D(n,`param.${i}`,p)}return[r.toISOString(),ne[e],s,...n].filter(Boolean).join(" ")}var W={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},ie=W,ae={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},pe={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},ce={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},me={trace:()=>{},debug:(e,...t)=>globalThis.console.debug(d("debug",e,t)),info:(e,...t)=>globalThis.console.info(d("info",e,t)),warn:(e,...t)=>globalThis.console.warn(d("warn",e,t)),error:(e,...t)=>globalThis.console.error(d("error",e,t))};function le(e,t){if(typeof t!=="number"||t<=0)return e;return new Promise((o,r)=>{let s=setTimeout(()=>{r(Error(`Authz catalog entry did not become ready within ${t}ms`))},t);e.then(()=>{clearTimeout(s),o()},(n)=>{clearTimeout(s),r(n)})})}function ue(e,t){let o=!1,r,s=t.then(()=>{o=!0},(i)=>{o=!1,r=i}),n=e;return Object.defineProperty(n,"ready",{enumerable:!1,configurable:!0,value:(i)=>le(s.then(()=>{if(!o)throw r}),i)}),Object.defineProperty(n,"isReady",{enumerable:!1,configurable:!0,value:()=>o}),n}var w=Object.freeze({jsonc:x,env:"text/x-dotenv",text:"text/plain",binary:P,yaml:"application/yaml",toml:"application/toml",xml:O});function M(e){if(!e.id.trim())throw Error("defineSecretType: id is required");let t=e.mimeType?.trim()||w[e.format],o=Object.freeze({id:e.id,...e.label?{label:e.label}:{},format:e.format,mimeType:t,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id});return Object.freeze({id:e.id,...e.label?{label:e.label}:{},format:e.format,mimeType:t,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},...e.schema?{schema:e.schema}:{},toRegistryEntry:()=>o})}function de(e="jsonc"){return{format:e,mimeType:w[e],typeId:e}}class j extends Error{constructor(e,t){super(`Secret content type mismatch: expected "${e.mimeType}" (${e.format}) but received "${t.mimeType}" (${t.format})`);this.name="SecretContentTypeMismatchError",this.expected=e,this.received=t}}var ge=M({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var z={beforeTenantSegments:["ui"]},F={beforeTenantSegments:["api"]};function U(e){return(e??[]).map((t)=>t.trim()).filter(Boolean)}function q(e){let t=e.trim();if(!t)return"/";let o=t.replace(/\\/g,"/").replace(/\/+/g,"/");return o.startsWith("/")?o:`/${o}`}function V(e){return q(e).split("/").filter(Boolean)}function g(e){return{beforeTenantSegments:U(e?.beforeTenantSegments),afterTenantSegments:U(e?.afterTenantSegments)}}function G(e){if(e?.type==="host")return{type:"host",baseDomain:v(e.baseDomain)};if(e?.type==="selector")return e;return{type:"path",ui:g(e?.ui??z),api:g(e?.api??F)}}function v(e){let t=e.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!t)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return t}function ye(e,t){let o=e.trim().replace(/\.$/,"").toLowerCase(),r=v(t);if(!o.endsWith(`.${r}`))return null;let s=o.slice(0,-(r.length+1));if(!s||s.includes("."))return null;return{id:s}}function fe(e,t){let o=g(t),r=o.beforeTenantSegments??[],s=o.afterTenantSegments??[],n=V(e),i=r.length+1+s.length;if(n.length<i)return null;for(let m=0;m<r.length;m++)if(n[m]!==r[m])return null;let p=r.length,a=n[p];if(!a)return null;for(let m=0;m<s.length;m++)if(n[p+1+m]!==s[m])return null;let l=n.slice(p+1+s.length);return{id:decodeURIComponent(a),restSegments:l,restPath:l.length>0?`/${l.join("/")}`:"/"}}function B(e,t="/",o){let r=g(o),s=r.beforeTenantSegments??[],n=r.afterTenantSegments??[],i=V(t),p=[...s,encodeURIComponent(e),...n,...i];return p.length>0?`/${p.join("/")}`:"/"}function Se(e,t="/",o,r="ui"){let s=G(o);if(s.type==="host"||s.type==="selector")return q(t);return B(e,t,s[r])}function Ce(e){return{"~standard":{version:1,vendor:e,validate:(t)=>{if(typeof t!=="object"||t===null)return{issues:[{message:"Expected an object"}]};let o=t,r=[],s={...o},n=["iss","sub"];for(let a of n)if(a in o){if(typeof o[a]!=="string")r.push({message:`${a} must be a string`,path:[a]})}else r.push({message:`${a} is required`,path:[a]});if("aud"in o&&o.aud!==void 0){let a=o.aud;if(typeof a!=="string"&&!Array.isArray(a))r.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(a)&&!a.every((l)=>typeof l==="string"))r.push({message:"aud array must contain only strings",path:["aud"]})}let i=["jti","scope"];for(let a of i)if(a in o&&o[a]!==void 0){if(typeof o[a]!=="string")r.push({message:`${a} must be a string`,path:[a]})}let p=["exp","iat"];for(let a of p)if(a in o){if(typeof o[a]!=="number")r.push({message:`${a} must be a number`,path:[a]})}else r.push({message:`${a} is required`,path:[a]});if(r.length>0)return{issues:r};return{value:s}}}}}function Te(e){return{"~standard":{version:1,vendor:e,validate:(t)=>{if(typeof t!=="object"||t===null)return{issues:[{message:"Expected an object"}]};let o=t,r=[],s={};if("access_token"in o)if(typeof o.access_token==="string")s.access_token=o.access_token;else r.push({message:"access_token must be a string",path:["access_token"]});else r.push({message:"access_token is required",path:["access_token"]});if("token_type"in o)if(typeof o.token_type==="string")s.token_type=o.token_type;else r.push({message:"token_type must be a string",path:["token_type"]});else r.push({message:"token_type is required",path:["token_type"]});if("scope"in o)if(typeof o.scope==="string"||o.scope===void 0)s.scope=o.scope;else r.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in o)if(typeof o.refresh_token==="string"||o.refresh_token===void 0)s.refresh_token=o.refresh_token;else r.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in o)if(typeof o.expires==="string"||o.expires===void 0)s.expires=o.expires;else r.push({message:"expires must be a string",path:["expires"]});if("expires_in"in o)if(typeof o.expires_in==="number"||o.expires_in===void 0)s.expires_in=o.expires_in;else r.push({message:"expires_in must be a number",path:["expires_in"]});if(r.length>0)return{issues:r};return{value:s}}}}}function ke(e){let t=new Uint8Array(e);return crypto.getRandomValues(t),t}function Re(e){let t="",o=ke(e);for(let r=0;r<e;r++){let s=o[r]%32;t+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(s)}return t}function Ee(e,t){let o="";for(let r=t;r>0;r--){let s=e%32;o="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(s)+o,e=Math.floor(e/32)}return o}function Ae(e){let t=Date.now(),o=Ee(t,10),r=Re(16);return`${e??""}${o}${r}`}export{_t as ACCEPT_JSON,Pt as ACCEPT_OCTET_STREAM,xt as ACCEPT_SCIM,Ot as ACCEPT_XML,Ue as AssignmentPolicyError,Ke as CANONICAL_RISK_LEVELS,vt as CONTENT_TYPE_FORM,wt as CONTENT_TYPE_JSON,Nt as CONTENT_TYPE_OCTET_STREAM,Mt as CONTENT_TYPE_SCIM,Kt as CONTENT_TYPE_XML,y as ConfigSourceError,tt as DEFAULT_DISCOVERED_COOKIE_MAX,ot as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,et as DEFAULT_DISPLAY_COOKIE_MAX,Ne as DEFAULT_RISK_LEVEL,w as DEFAULT_SECRET_MIME_TYPES,F as DEFAULT_TENANT_API_NAMESPACE,z as DEFAULT_TENANT_UI_NAMESPACE,rt as DISCOVERED_COOKIE_PREFIX,Ze as DISPLAY_COOKIE_SUFFIX,Qe as DISPLAY_COOKIE_VERSION,ft as ECID_SCHEME,St as EcidFormatError,bt as FORM_MEDIA_TYPE,De as ION_AUTHZ_GROUP_SCHEMA,b as ION_AUTHZ_OAA_SYNC,h as ION_CAPABILITIEZ_READ,I as ION_CIAM_MAGIC_LINK_CREATE,Z as ION_ENDPOINT_PERMISSIONS,A as ION_IAM_ACCESS_REQUESTS_WRITE,E as ION_IAM_CUSTOMERS_WRITE,k as ION_IAM_GROUPS_WRITE,C as ION_IAM_READ,T as ION_IAM_USERS_WRITE,R as ION_IAM_WORKLOADS_WRITE,no as ION_SCIM_CUSTOMER_SCHEMA,oo as ION_SCIM_USER_EXTENSION_URN,ro as ION_SCIM_WORKLOAD_SCHEMA,X as ION_SDK_PERMISSIONS,_ as ION_TENANT_MANAGE,Qt as IoniteError,x as JSON_MEDIA_TYPE,xe as KNOWN_BASE_CUSTOMER_KEYS,_e as KNOWN_BASE_USER_KEYS,be as KNOWN_ENTITLEMENT_KEYS,Oe as KNOWN_WORKLOAD_KEYS,P as OCTET_STREAM_MEDIA_TYPE,Le as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,It as SCIM_MEDIA_TYPE,j as SecretContentTypeMismatchError,Xt as StoreConflictError,O as XML_MEDIA_TYPE,Je as accessRefId,Xe as accessRootId,Rt as assertEcid,je as assertRequiredSubjectType,We as assertValidSubjectTypeScoping,B as buildTenantPath,Se as buildTenantUrl,Ve as catalogEntityStore,Yt as claimsToUser,dt as compareDisplayExpiryDesc,Ie as configTrustedClientGrants,Pe as customAttributes,po as customerResourceSchema,ae as debugLogger,lt as decodeDisplayCookie,Jt as decodeUser,Gt as deepEqualPlain,at as defaultDisplayUser,ie as defaultLogger,de as defaultSecretContentType,Fe as defineCatalog,M as defineSecretType,He as deprecateRetiredCodeCatalogRows,yt as discoveredProfileCookieName,mt as encodeDisplayCookie,Tt as formatEcid,d as formatLogLine,Ae as generateULID,qe as getCodeCatalogEntity,io as groupResourceSchema,ht as idTokenClaimsSchema,pe as infoLogger,$e as isCodeCatalog,eo as isConfigLocator,J as isConfigSourceError,Ct as isEcid,Dt as isJsonResponse,Zt as isStoreConflictError,Ce as jwtAssertionClaimsSchema,we as list,Me as listGenerator,ye as matchTenantHost,fe as matchTenantPath,ve as matchesListFilter,Be as materializeCodeCatalogEntity,Ge as mergeCodeCatalogEntity,zt as mergeConfig,Ut as must,v as normalizeTenantBaseDomain,g as normalizeTenantPathNamespace,G as normalizeTenantRoutingStrategy,Et as oidcCallbackSchema,kt as parseEcid,qt as parseJsonc,re as parseKmsPoolControlDocument,oe as parseKmsPoolDocument,me as prettyLogger,gt as profileCookieName,ct as projectDisplayUser,ut as readDisplayCookies,Wt as readJsonResponse,ue as readyCatalogEntry,ge as remoteConfigSecretType,st as resolveDiscoveredCookieMax,it as resolveDiscoveredCookieTtlSeconds,nt as resolveDisplayCookieMax,pt as sanitizeDisplayUser,ee as serializeConfig,W as silentLogger,Bt as stableConfigHash,Ft as stripJsonComments,to as tmIntegrationState,ze as toCodeCatalog,At as tokenResponseSchema,Vt as trimTrailingSlash,he as trustedClientPermissionsForPrincipal,Lt as unexpectedBodySummary,Ye as unionCatalogRead,so as userSchema,$t as validationFailureResponse,Y as version,Ht as waitOn,ce as warnLogger,jt as withValidate,ao as workloadResourceSchema,Te as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -1897,6 +1897,11 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	* Read on every acquisition because the platform rotates it.
 	*/
 	federatedTokenFile?: string;
+	/**
+	* `managed_identity`: get the token from the platform's managed identity endpoint instead of an
+	* IdP token URL. `clientId` is the managed identity's client ID; `scope` names the audience.
+	*/
+	authMethod?: "managed_identity";
 };
 /**
 * Server-Only Workload Configuration
@@ -1930,7 +1935,7 @@ type ServerOnlyWorkloadConfig = WorkloadConfigBase & {
 * detected based on which fields are present:
 *
 * - **JWT Bearer Grant**: Requires `workload_id` + `private_key`
-* - **Client Credentials**: Requires `client_id` + `client_secret`
+* - **Client Credentials**: Requires `client_id` + `client_secret`, a federated token file, or `authMethod: "managed_identity"`
 * - **Server-Only**: Only `jwks_uri` (and optionally `issuer`) for token validation
 *
 * The developer uses the same API regardless of mode - the library handles the details.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/core",
-  "version": "0.0.24-beta.20261003.16",
+  "version": "0.0.24-beta.20261003.17",
   "description": "ionite Core (client-safe main entry; server handlers under ./server)",
   "private": false,
   "author": "ionite",