@ionite/core 0.0.24-beta.20261005.20 → 0.0.24-beta.20261006.22

package/dist/index.d.ts

@@ -1578,6 +1578,19 @@ type CIAMProviderConfig = {
 	claimsAsEntitlements?: ClaimsAsEntitlements;
 	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
 	accessRequests?: AccessRequestsDestination;
+	/**
+	* Microsoft only. Which Entra tenants may sign in when the provider uses a
+	* multi-tenant authority (`/common`, `/organizations`, `/consumers`). Entra mints
+	* tenant-scoped issuers (`https://login.microsoftonline.com/{tid}/v2.0`), so no
+	* single `authority` can be compared by strict equality; this constrains the
+	* accepted `tid` instead.
+	*
+	* `'any'` (default) accepts any work/school tenant and personal accounts,
+	* `'consumers'` accepts only personal Microsoft accounts, and an array accepts
+	* only the listed tenant GUIDs. Ignored when `authority` names a single tenant —
+	* that keeps the strict-equality check.
+	*/
+	allowedTenants?: "any" | "consumers" | string[];
 };
 /** Sanitized provider entry returned by the discovery endpoint for the UI. */
 type CIAMProviderDescriptor = {
@@ -1796,7 +1809,7 @@ type RequireReadyResult = {
 		reason?: string;
 	}>;
 };
-type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "sso.claims_authz" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "ciam.claims_authz" | "iam.users" | "iam.groups" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "workload.claims_authz" | "authz.oaa" | "authz.access_requests" | "tm.integration";
+type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "sso.claims_authz" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "ciam.claims_authz" | "iam.users" | "iam.groups" | "iam.groups.create" | "iam.workloads" | "iam.customers" | "workload.incoming" | "workload.outgoing" | "workload.claims_authz" | "authz.oaa" | "authz.access_requests" | "tm.integration";
 type CapabilityEndpointUrls = {
 	readyzUrl: string;
 	capabilitiezUrl: string;
@@ -2048,7 +2061,7 @@ type WorkloadClientDescription = {
 	idpTokenUrl?: string;
 	scope?: string;
 	audience?: string;
-	authMethod: "client_secret" | "private_key_jwt" | "server_only";
+	authMethod: "client_secret" | "federated_token" | "managed_identity" | "private_key_jwt" | "server_only";
 };
 type WorkloadDescription = ModuleDescriptionBase<"workload"> & {
 	incoming: {
@@ -2127,6 +2140,8 @@ type AuthzDescription = ModuleDescriptionBase<"authz"> & {
 		permissions: string[];
 	}>;
 	oaa?: OaaDescription;
+	/** True when the App explicitly accepts IAM-sourced entitlement creation. */
+	inboundEntitlements: boolean;
 	stores: {
 		accessStore: boolean;
 		accessIndex: boolean;
@@ -2136,7 +2151,7 @@ type AuthzDescription = ModuleDescriptionBase<"authz"> & {
 };
 type TmDescription = ModuleDescriptionBase<"tm"> & {
 	enabled: boolean;
-	integrator?: {
+	ionite?: {
 		id: string;
 		name?: string;
 		url: string;
@@ -2468,10 +2483,21 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	*/
 	clientId: string;
 	/**
-	* OAuth2 client secret
-	* REQUIRED for Client Credentials mode
+	* OAuth2 client secret. Omit it to authenticate with a federated token instead
+	* (see `federatedTokenFile`). A client secret wins when both are present.
 	*/
-	clientSecret: string;
+	clientSecret?: string;
+	/**
+	* Path to a projected federated token (e.g. AKS Workload Identity), sent as a jwt-bearer
+	* `client_assertion` in place of `client_secret`. Defaults to `AZURE_FEDERATED_TOKEN_FILE`.
+	* Read on every acquisition because the platform rotates it.
+	*/
+	federatedTokenFile?: string;
+	/**
+	* `managed_identity`: get the token from the platform's managed identity endpoint instead of an
+	* IdP token URL. `clientId` is the managed identity's client ID; `scope` names the audience.
+	*/
+	authMethod?: "managed_identity";
 };
 /**
 * Server-Only Workload Configuration
@@ -2505,7 +2531,7 @@ type ServerOnlyWorkloadConfig = WorkloadConfigBase & {
 * detected based on which fields are present:
 *
 * - **JWT Bearer Grant**: Requires `workload_id` + `private_key`
-* - **Client Credentials**: Requires `client_id` + `client_secret`
+* - **Client Credentials**: Requires `client_id` + `client_secret`, a federated token file, or `authMethod: "managed_identity"`
 * - **Server-Only**: Only `jwks_uri` (and optionally `issuer`) for token validation
 *
 * The developer uses the same API regardless of mode - the library handles the details.
@@ -2654,7 +2680,8 @@ interface IAMHandlerConfig {
 * IAM configuration
 *
 * - If `url` is provided, groups_outbound is enabled (app calls external IAM)
-* - If a `catalogStore` is provided, groups_inbound is enabled (external IAM calls app)
+* - If a catalog source is provided, groups_inbound is enabled (external IAM calls app);
+*   `POST /Groups` additionally requires `AuthzConfig.onInboundEntitlement`
 * - If `userStore` is provided, users_inbound is enabled (external IAM calls app)
 */
 type IAMConfig = {
@@ -2999,7 +3026,7 @@ type IAMGroupsOutbound = {
 };
 /**
 * Groups Inbound extension - for receiving group provisioning from external IAM providers.
-* Enabled when a `catalogStore` is configured.
+* Enabled when a catalog source is configured; IAM-sourced create remains AppDev opt-in.
 */
 type IAMGroupsInbound = {
 	/**
@@ -3024,7 +3051,7 @@ type IAMUsersInbound = {
 *
 * - Core functions are user-related (outbound to external IAM)
 * - `groups_outbound` is available when `url` is configured
-* - `groups_inbound` is available when a `catalogStore` is configured
+* - `groups_inbound` is available when a catalog source is configured
 * - `users_inbound` is available when `userStore` is configured
 */
 type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "groups"> & {
@@ -3052,7 +3079,8 @@ type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "groups"> & {
 	groups_outbound?: IAMGroupsOutbound;
 	/**
 	* Groups Inbound extension - receive group provisioning from external IAM.
-	* Available when a `catalogStore` is configured.
+	* Available when a catalog source is configured. `POST /Groups` returns 501 unless the App
+	* implements `AuthzConfig.onInboundEntitlement` and wires an `AccessCatalogStore`.
 	*/
 	groups_inbound?: IAMGroupsInbound;
 	/**
@@ -4712,6 +4740,12 @@ type AuthzConfig = {
 	* have been updated. Best-effort and isolated — throwing here never affects the SCIM response.
 	*/
 	onAccessMutation?: (summary: ScimMutationSummary) => void;
+	/**
+	* Explicit AppDev opt-in for IAM-sourced entitlement definitions. Inbound SCIM `POST /Groups`
+	* returns 501 when omitted. The callback may reject the proposal or accept it while attaching
+	* App-owned catalog structure; IAM-owned presentation is persisted from the SCIM resource.
+	*/
+	onInboundEntitlement?: (input: InboundEntitlementRequest) => InboundEntitlementDecision | Promise<InboundEntitlementDecision>;
 };
 /**
 * Configuration supplied by the framework/application when creating an ionite instance.
@@ -4793,7 +4827,7 @@ type RemoteConfig = {
 	/** OpenTelemetry collector/exporter config loaded from ConfigSource. */
 	otel?: OtelConfig;
 	authz?: AuthzConfig;
-	/** ConfigSource-owned Tenant Management activation and trusted integrator identity. */
+	/** ConfigSource-owned Tenant Management activation and trusted ionite identity. */
 	tm?: RemoteTmConfig;
 	/**
 	* Built-in readiness endpoint intent (Ops/ECI). The SDK mounts `${basePath}/readyz` by default;
@@ -5405,10 +5439,10 @@ type ConfigChangeOptions = {
 type EnvironmentType = "POC" | "DEV" | "QA" | "PROD";
 type TenantStatus = "pending" | "processing" | "completed" | "failed" | "action_required";
 type CreateTenantRequestBase = {
-	/** App-owned routing key. The integrator may suggest it; the App may reject a collision. */
+	/** App-owned routing key. ionite may suggest it; the App may reject a collision. */
 	id: string;
-	/** Stable tenant id in the integrator/ionite domain. */
-	integratorTenantId: string;
+	/** Stable tenant id in the ionite domain. */
+	ioniteId: string;
 	companyId: string;
 	companyName: string;
 	environmentType: EnvironmentType;
@@ -5421,8 +5455,8 @@ type CreateTenantRequestBase = {
 /**
 * Body for creating a tenant (`POST ${basePath}`). `configLocator` may be supplied immediately or
 * patched later after the tenant's ConfigSource has been provisioned. Idempotent by
-* `integratorTenantId`: re-submitting that id re-applies the existing App tenant even when its
-* App-owned `id` differs from the integrator's original suggestion.
+* `ioniteId`: re-submitting that id re-applies the existing App tenant even when its
+* App-owned `id` differs from ionite's original suggestion.
 */
 type CreateTenantRequest<TExtended extends object = object> = CreateTenantRequestBase & TExtended;
 /**
@@ -5498,8 +5532,8 @@ declare function isConfigLocator(value: unknown): value is ConfigLocator;
 type BaseTenant = {
 	/** App-owned routing key. */
 	id: string;
-	/** Stable tenant id in the integrator/ionite domain, once this tenant is known to ionite. */
-	integratorTenantId?: string;
+	/** Stable tenant id in the ionite domain, once this tenant is known to ionite. */
+	ioniteId?: string;
 	companyId: string;
 	companyName: string;
 	environmentType: EnvironmentType;
@@ -5521,7 +5555,7 @@ type BaseTenant = {
 	*/
 	configLocator?: ConfigLocator;
 	/**
-	* App-internal state for an integrator-requested Tenant Management handover. Protocol-internal
+	* App-internal state for an ionite-requested Tenant Management handover. Protocol-internal
 	* fields are never serialized by the TM wire handlers.
 	*/
 	integration?: TenantIntegration;
@@ -5529,9 +5563,8 @@ type BaseTenant = {
 type TenantIntegrationStatus = "consent_requested" | "consented" | "declined";
 type TenantIntegration = {
 	version: number;
-	integrator: string;
-	integratorName?: string;
-	integratorTenantId: string;
+	ioniteName?: string;
+	ioniteId: string;
 	productId: string;
 	applicationId: string;
 	handleHash: string;
@@ -5555,26 +5588,36 @@ type SetTenantIntegrationOptions = {
 	/** Compare-and-set guard for transitions within the same handle. */
 	expectedVersion?: number;
 };
-type TmIntegratorConfig = {
+/**
+* ConfigSource-only trust for the ionite control plane that drives Tenant Management. Code never
+* sets these fields; do not duplicate them in `workload.incoming` or `authz.trustedProvisioningClients`.
+*/
+type TmIoniteConfig = {
+	/** Stable identifier of the trusted ionite control plane. */
 	id: string;
+	/** Optional human-readable name used in consent copy. */
 	name?: string;
+	/** Browser-facing ionite URL used to restart an integration. */
 	url: string;
+	/** Required `iss` claim on ionite-signed staged-request handles and ionite workload tokens. */
 	issuer: string;
+	/** ionite JWKS endpoint used to verify signed staged-request handles. */
 	jwksUri: string;
+	/** Required `aud` claim binding an ionite-staged request to this App. */
 	audience: string;
+	/** Required `azp`/client identity of the trusted ionite control plane. */
 	clientId: string;
 };
 type RemoteTmConfig = {
 	enabled: true;
-	integrator: TmIntegratorConfig;
+	ionite: TmIoniteConfig;
 	consentTtlSeconds?: number;
 	maxRedeemAttempts?: number;
 };
 type StagedIntegration = {
 	handle: string;
-	integrator: string;
-	integratorName?: string;
-	integratorTenantId: string;
+	ioniteName?: string;
+	ioniteId: string;
 	productId: string;
 	applicationId: string;
 	issuedAt: string;
@@ -5701,6 +5744,19 @@ interface TenantDirectory<TTenant extends BaseTenant = BaseTenant> {
 	findUserTenants?(identity: TenantDirectoryIdentity, options?: ListOptions): Promise<ListResult<TTenant>>;
 	findTenantsByEmailDomain?(domain: string, options?: ListOptions): Promise<ListResult<TTenant>>;
 }
+/**
+* App-owned tenant persistence for routing and Tenant Management.
+*
+* Tenants carry two ids: `id` is the App-owned routing key and `ioniteId` is ionite's stable id.
+* Implementations MUST keep `ioniteId` unique across tenants and MUST treat it as immutable once
+* set: `upsert` and `setIntegration` reject a different `ioniteId` for a bound tenant (the
+* built-in in-memory and Redis stores throw `ionite id cannot change`) and an `upsert` that omits
+* `ioniteId` keeps the stored value. The TM handler enforces the same rule at the HTTP layer; the
+* store rule protects App-owned write paths that bypass `ion.tm`.
+*
+* `setIntegration` and `getByIntegrationHandleHash` are required only for ionite consent. They are
+* metadata-only writes and MUST NOT evict the tenant runtime cache; ordinary `upsert`/`delete` do.
+*/
 interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	get(id: string): Promise<TTenant | undefined>;
 	list(options?: ListOptions): Promise<ListResult<TTenant>>;
@@ -5709,7 +5765,8 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
-	getByIntegratorTenantId(integratorTenantId: string): Promise<TTenant | undefined>;
+	/** Looks up a tenant by ionite's stable id; TM create is idempotent by this key. */
+	getByIoniteId(ioniteId: string): Promise<TTenant | undefined>;
 }
 type InMemoryTenantStoreOptions = {
 	/**
@@ -5934,6 +5991,35 @@ type OaaAccessTargetType = "group" | "role" | "permission";
 type EntitlementType = OaaAccessTargetType;
 /** A catalog Entitlement: a group, role, or permission (see {@link EntitlementType}). */
 type Entitlement<TAttributes extends object = object> = Group<TAttributes> | Role<TAttributes> | Permission<TAttributes>;
+/** Validated IAM-authored presentation and membership proposed through inbound SCIM `POST /Groups`. */
+type InboundEntitlementRequest = {
+	type: EntitlementType;
+	displayName: string;
+	description?: string;
+	externalId?: string;
+	riskLevel?: RiskLevel;
+	attributes?: Record<string, unknown>;
+	resources?: string[];
+	members: GroupMember[];
+	request: Request;
+};
+/**
+* AppDev decision for an IAM-sourced entitlement. Accepting may attach only App-owned structure;
+* IAM-owned presentation remains sourced from the inbound SCIM resource.
+*/
+type InboundEntitlementDecision = {
+	accept: false;
+	reason?: string;
+} | {
+	accept: true;
+	id?: string;
+	assignableSubjectTypes?: SubjectType[];
+	recommendedSubjectTypes?: SubjectType[];
+	permissions?: string[];
+	roles?: string[];
+	groups?: string[];
+	resources?: string[];
+};
 declare const ION_AUTHZ_GROUP_SCHEMA = "urn:ionite:params:scim:schemas:extension:authz:2.0:Group";
 type AuthzScimGroupType = OaaAccessTargetType;
 type AuthzScimGroupExtension = {
@@ -6962,4 +7048,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIntegratorConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AccessStatus, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorOptions, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceType, SecretsSubscriptionOptions, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, discoveredProfileCookieName, encodeDisplayCookie, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{H,je,d,A,I,v,o,M,c,Ne,J,f,e,g,de,Y,le,Ee,Le,Pe,j,N,T,L,X,K,n,p,Ke,q,qe,We,Ve,Q,ee,W,te,me,fe,m,V,Ue,z,E,P,B,ze,U,_e,Be,Ge,_,ge,ye,he,Se,ke,be,Ce,Te,we,Re,re,Fe,se,oe,y,s,He,O,Ae,Ie,i,ie,Je,Ye,r,w,h,Xe,Ze,Oe,G,a,l,t,ae,Qe,De,et,R,S,tt,nt,F,rt,k,D,ve,xe,st,u,b,C,it,at,ce,ue}from"./shared/core-hjq34ezq.js";var Mt="0.0.24-beta.20261005.20";class ft extends Error{constructor(x,Z){super(x,Z.cause!==void 0?{cause:Z.cause}:void 0);this.name="ConfigSourceError",this.kind=Z.kind,this.recoverable=Z.recoverable,this.code=Z.code,this.status=Z.status,this.path=Z.path,this.sourceType=Z.sourceType,Object.setPrototypeOf(this,ft.prototype)}}function Lt(x){return x instanceof ft}var Nt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function Rt(x){if(x===null||typeof x!=="object")return x;let Z={};for(let[ne,pe]of Object.entries(x)){if(Nt.includes(ne)||ne==="validators"||ne==="setStores")continue;Z[ne]=pe!==null&&typeof pe==="object"&&!Array.isArray(pe)&&Object.getPrototypeOf(pe)===Object.prototype?Rt(pe):pe}return Z}function $t(x){return Rt(x)}function yt(x,Z){if(!x||typeof x!=="object"||Array.isArray(x))throw Error(`${Z} must be an object.`);return x}function ut(x,Z){if(x===void 0)return;if(typeof x!=="string"||x.length===0||!Number.isFinite(Date.parse(x)))throw Error(`${Z} must be a valid timestamp string.`);return x}function Et(x,Z,ne){if(!Array.isArray(x)||!ne.allowEmpty&&x.length===0)throw Error(`${Z} keys must be ${ne.allowEmpty?"an":"a non-empty"} array.`);let pe=new Set;return x.map(($e,Me)=>{let ot=yt($e,`${Z} keys[${Me}]`);if(typeof ot.id!=="string"||ot.id.length===0)throw Error(`${Z} keys[${Me}].id must be a non-empty string.`);if(pe.has(ot.id))throw Error(`${Z} contains duplicate key id "${ot.id}".`);if(pe.add(ot.id),!["pending","active","deprecated","rotated","revoked"].includes(String(ot.state)))throw Error(`${Z} keys[${Me}].state is invalid.`);if(ot.value!==void 0&&(typeof ot.value!=="string"||ot.value.length===0))throw Error(`${Z} keys[${Me}].value must be a non-empty string when present.`);let ct=ot.meta===void 0?void 0:yt(ot.meta,`${Z} keys[${Me}].meta`);return{id:ot.id,state:ot.state,...ot.value===void 0?{}:{value:ot.value},...ot.notBefore===void 0?{}:{notBefore:ut(ot.notBefore,`${Z} keys[${Me}].notBefore`)},...ot.notAfter===void 0?{}:{notAfter:ut(ot.notAfter,`${Z} keys[${Me}].notAfter`)},...ot.createdAt===void 0?{}:{createdAt:ut(ot.createdAt,`${Z} keys[${Me}].createdAt`)},...ot.activatedAt===void 0?{}:{activatedAt:ut(ot.activatedAt,`${Z} keys[${Me}].activatedAt`)},...ot.deprecatedAt===void 0?{}:{deprecatedAt:ut(ot.deprecatedAt,`${Z} keys[${Me}].deprecatedAt`)},...ot.rotatedAt===void 0?{}:{rotatedAt:ut(ot.rotatedAt,`${Z} keys[${Me}].rotatedAt`)},...ot.revokedAt===void 0?{}:{revokedAt:ut(ot.revokedAt,`${Z} keys[${Me}].revokedAt`)},...ct?{meta:{...ct}}:{}}})}function Wt(x,Z,ne){if(x===void 0)return;if(!Array.isArray(x))throw Error(`${ne} slots must be an array.`);let pe=new Set,$e=x.map((Me,ot)=>{if(Me===null)return null;if(typeof Me!=="string"||Me.length===0)throw Error(`${ne} slots[${ot}] must be a non-empty key id or null.`);if(pe.has(Me))throw Error(`${ne} slots contain duplicate key id "${Me}".`);pe.add(Me);let ct=Z.find((pt)=>pt.id===Me);if(!ct)throw Error(`${ne} slot key "${Me}" is not present in keys.`);if(ct.state!=="active")throw Error(`${ne} slot key "${Me}" must have state "active".`);if(!ct.value)throw Error(`${ne} slot key "${Me}" must include a value.`);return Me});if(Z.length===0&&$e.some((Me)=>Me!==null))throw Error(`${ne} slots must be omitted or all-null when keys is empty.`);return $e}function Ut(x){let ne=yt(x,"KMS pool");if(ne.kind!=="kms")throw Error('KMS pool kind must be "kms".');let pe=Et(ne.keys,"KMS pool",{allowEmpty:!0}),$e=Wt(ne.slots,pe,"KMS pool");return $e?{kind:"kms",slots:$e,keys:pe}:{kind:"kms",keys:pe}}function Ft(x){let ne=yt(x,"KMS pool control document");if(ne.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:Et(ne.keys,"KMS pool control document",{allowEmpty:!0})}}var qt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function ht(x){if(typeof x==="string")return x;try{return JSON.stringify(x)??String(x)}catch{return String(x)}}function St(x){let Z=ht(x);return/^[A-Za-z0-9_./:@+|-]+$/.test(Z)?Z:JSON.stringify(Z)}function zt(x){return ht(x).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function At(x,Z,ne){if(ne==null)return;if(ne instanceof Error){if(x.push(`${Z}.name=${St(ne.name)}`),x.push(`${Z}.message=${St(ne.message)}`),ne.stack)x.push(`${Z}.stack=${St(ne.stack)}`);return}x.push(`${Z}=${St(ne)}`)}function dt(x,Z,ne=[],pe=new Date){let $e=zt(Z instanceof Error?Z.message:Z??""),Me=[];for(let[ot,ct]of ne.entries()){if(ct&&typeof ct==="object"&&!Array.isArray(ct)&&!(ct instanceof Error)&&Object.getPrototypeOf(ct)===Object.prototype){for(let[pt,lt]of Object.entries(ct))At(Me,pt,lt);continue}At(Me,`param.${ot}`,ct)}return[pe.toISOString(),qt[x],$e,...Me].filter(Boolean).join(" ")}var It={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Vt=It,jt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Bt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Gt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Ht={trace:()=>{},debug:(x,...Z)=>globalThis.console.debug(dt("debug",x,Z)),info:(x,...Z)=>globalThis.console.info(dt("info",x,Z)),warn:(x,...Z)=>globalThis.console.warn(dt("warn",x,Z)),error:(x,...Z)=>globalThis.console.error(dt("error",x,Z))};function Yt(x,Z){if(typeof Z!=="number"||Z<=0)return x;return new Promise((ne,pe)=>{let $e=setTimeout(()=>{pe(Error(`Authz catalog entry did not become ready within ${Z}ms`))},Z);x.then(()=>{clearTimeout($e),ne()},(Me)=>{clearTimeout($e),pe(Me)})})}function Jt(x,Z){let ne=!1,pe,$e=Z.then(()=>{ne=!0},(ot)=>{ne=!1,pe=ot}),Me=x;return Object.defineProperty(Me,"ready",{enumerable:!1,configurable:!0,value:(ot)=>Yt($e.then(()=>{if(!ne)throw pe}),ot)}),Object.defineProperty(Me,"isReady",{enumerable:!1,configurable:!0,value:()=>ne}),Me}var Ct=Object.freeze({jsonc:s,env:"text/x-dotenv",text:"text/plain",binary:Ie,yaml:"application/yaml",toml:"application/toml",xml:Ae});function kt(x){if(!x.id.trim())throw Error("defineSecretType: id is required");let Z=x.mimeType?.trim()||Ct[x.format],ne=Object.freeze({id:x.id,...x.label?{label:x.label}:{},format:x.format,mimeType:Z,...x.schemaUrl?{schemaUrl:x.schemaUrl}:{},typeId:x.id});return Object.freeze({id:x.id,...x.label?{label:x.label}:{},format:x.format,mimeType:Z,...x.schemaUrl?{schemaUrl:x.schemaUrl}:{},...x.schema?{schema:x.schema}:{},toRegistryEntry:()=>ne})}function Xt(x="jsonc"){return{format:x,mimeType:Ct[x],typeId:x}}class bt extends Error{constructor(x,Z){super(`Secret content type mismatch: expected "${x.mimeType}" (${x.format}) but received "${Z.mimeType}" (${Z.format})`);this.name="SecretContentTypeMismatchError",this.expected=x,this.received=Z}}var Zt=kt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Pt={beforeTenantSegments:["ui"]},_t={beforeTenantSegments:["api"]};function xt(x){return(x??[]).map((Z)=>Z.trim()).filter(Boolean)}function Ot(x){let Z=x.trim();if(!Z)return"/";let ne=Z.replace(/\\/g,"/").replace(/\/+/g,"/");return ne.startsWith("/")?ne:`/${ne}`}function vt(x){return Ot(x).split("/").filter(Boolean)}function gt(x){return{beforeTenantSegments:xt(x?.beforeTenantSegments),afterTenantSegments:xt(x?.afterTenantSegments)}}function wt(x){if(x?.type==="host")return{type:"host",baseDomain:Tt(x.baseDomain)};if(x?.type==="selector")return x;return{type:"path",ui:gt(x?.ui??Pt),api:gt(x?.api??_t)}}function Tt(x){let Z=x.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!Z)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return Z}function Qt(x,Z){let ne=x.trim().replace(/\.$/,"").toLowerCase(),pe=Tt(Z);if(!ne.endsWith(`.${pe}`))return null;let $e=ne.slice(0,-(pe.length+1));if(!$e||$e.includes("."))return null;return{id:$e}}function eo(x,Z){let ne=gt(Z),pe=ne.beforeTenantSegments??[],$e=ne.afterTenantSegments??[],Me=vt(x),ot=pe.length+1+$e.length;if(Me.length<ot)return null;for(let mt=0;mt<pe.length;mt++)if(Me[mt]!==pe[mt])return null;let ct=pe.length,pt=Me[ct];if(!pt)return null;for(let mt=0;mt<$e.length;mt++)if(Me[ct+1+mt]!==$e[mt])return null;let lt=Me.slice(ct+1+$e.length);return{id:decodeURIComponent(pt),restSegments:lt,restPath:lt.length>0?`/${lt.join("/")}`:"/"}}function Kt(x,Z="/",ne){let pe=gt(ne),$e=pe.beforeTenantSegments??[],Me=pe.afterTenantSegments??[],ot=vt(Z),ct=[...$e,encodeURIComponent(x),...Me,...ot];return ct.length>0?`/${ct.join("/")}`:"/"}function to(x,Z="/",ne,pe="ui"){let $e=wt(ne);if($e.type==="host"||$e.type==="selector")return Ot(Z);return Kt(x,Z,$e[pe])}function oo(x){return{"~standard":{version:1,vendor:x,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let ne=Z,pe=[],$e={...ne},Me=["iss","sub"];for(let pt of Me)if(pt in ne){if(typeof ne[pt]!=="string")pe.push({message:`${pt} must be a string`,path:[pt]})}else pe.push({message:`${pt} is required`,path:[pt]});if("aud"in ne&&ne.aud!==void 0){let pt=ne.aud;if(typeof pt!=="string"&&!Array.isArray(pt))pe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(pt)&&!pt.every((lt)=>typeof lt==="string"))pe.push({message:"aud array must contain only strings",path:["aud"]})}let ot=["jti","scope"];for(let pt of ot)if(pt in ne&&ne[pt]!==void 0){if(typeof ne[pt]!=="string")pe.push({message:`${pt} must be a string`,path:[pt]})}let ct=["exp","iat"];for(let pt of ct)if(pt in ne){if(typeof ne[pt]!=="number")pe.push({message:`${pt} must be a number`,path:[pt]})}else pe.push({message:`${pt} is required`,path:[pt]});if(pe.length>0)return{issues:pe};return{value:$e}}}}}function ro(x){return{"~standard":{version:1,vendor:x,validate:(Z)=>{if(typeof Z!=="object"||Z===null)return{issues:[{message:"Expected an object"}]};let ne=Z,pe=[],$e={};if("access_token"in ne)if(typeof ne.access_token==="string")$e.access_token=ne.access_token;else pe.push({message:"access_token must be a string",path:["access_token"]});else pe.push({message:"access_token is required",path:["access_token"]});if("token_type"in ne)if(typeof ne.token_type==="string")$e.token_type=ne.token_type;else pe.push({message:"token_type must be a string",path:["token_type"]});else pe.push({message:"token_type is required",path:["token_type"]});if("scope"in ne)if(typeof ne.scope==="string"||ne.scope===void 0)$e.scope=ne.scope;else pe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in ne)if(typeof ne.refresh_token==="string"||ne.refresh_token===void 0)$e.refresh_token=ne.refresh_token;else pe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in ne)if(typeof ne.expires==="string"||ne.expires===void 0)$e.expires=ne.expires;else pe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in ne)if(typeof ne.expires_in==="number"||ne.expires_in===void 0)$e.expires_in=ne.expires_in;else pe.push({message:"expires_in must be a number",path:["expires_in"]});if(pe.length>0)return{issues:pe};return{value:$e}}}}}function no(x){let Z=new Uint8Array(x);return crypto.getRandomValues(Z),Z}function so(x){let Z="",ne=no(x);for(let pe=0;pe<x;pe++){let $e=ne[pe]%32;Z+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt($e)}return Z}function io(x,Z){let ne="";for(let pe=Z;pe>0;pe--){let $e=x%32;ne="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt($e)+ne,x=Math.floor(x/32)}return ne}function ao(x){let Z=Date.now(),ne=io(Z,10),pe=so(16);return`${x??""}${ne}${pe}`}export{i as ACCEPT_JSON,Ye as ACCEPT_OCTET_STREAM,ie as ACCEPT_SCIM,Je as ACCEPT_XML,le as AssignmentPolicyError,J as CANONICAL_RISK_LEVELS,h as CONTENT_TYPE_FORM,r as CONTENT_TYPE_JSON,Ze as CONTENT_TYPE_OCTET_STREAM,w as CONTENT_TYPE_SCIM,Xe as CONTENT_TYPE_XML,ft as ConfigSourceError,We as DEFAULT_DISCOVERED_COOKIE_MAX,Ve as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,qe as DEFAULT_DISPLAY_COOKIE_MAX,f as DEFAULT_RISK_LEVEL,Ct as DEFAULT_SECRET_MIME_TYPES,_t as DEFAULT_TENANT_API_NAMESPACE,Pt as DEFAULT_TENANT_UI_NAMESPACE,Q as DISCOVERED_COOKIE_PREFIX,Ke as DISPLAY_COOKIE_SUFFIX,q as DISPLAY_COOKIE_VERSION,ze as ECID_SCHEME,U as EcidFormatError,O as FORM_MEDIA_TYPE,e as ION_AUTHZ_GROUP_SCHEMA,we as ION_AUTHZ_OAA_SYNC,Ce as ION_CAPABILITIEZ_READ,Te as ION_CIAM_MAGIC_LINK_CREATE,Fe as ION_ENDPOINT_PERMISSIONS,be as ION_IAM_ACCESS_REQUESTS_WRITE,ke as ION_IAM_CUSTOMERS_WRITE,he as ION_IAM_GROUPS_WRITE,ge as ION_IAM_READ,ye as ION_IAM_USERS_WRITE,Se as ION_IAM_WORKLOADS_WRITE,C as ION_SCIM_CUSTOMER_SCHEMA,u as ION_SCIM_USER_EXTENSION_URN,b as ION_SCIM_WORKLOAD_SCHEMA,re as ION_SDK_PERMISSIONS,Re as ION_TENANT_MANAGE,ve as IoniteError,s as JSON_MEDIA_TYPE,I as KNOWN_BASE_CUSTOMER_KEYS,A as KNOWN_BASE_USER_KEYS,d as KNOWN_ENTITLEMENT_KEYS,v as KNOWN_WORKLOAD_KEYS,Ie as OCTET_STREAM_MEDIA_TYPE,g as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,He as SCIM_MEDIA_TYPE,bt as SecretContentTypeMismatchError,k as StoreConflictError,Ae as XML_MEDIA_TYPE,n as accessRefId,p as accessRootId,_ as assertEcid,Y as assertRequiredSubjectType,de as assertValidSubjectTypeScoping,Kt as buildTenantPath,to as buildTenantUrl,N as catalogEntityStore,F as claimsToUser,E as compareDisplayExpiryDesc,je as configTrustedClientGrants,o as customAttributes,ue as customerResourceSchema,jt as debugLogger,Ue as decodeDisplayCookie,rt as decodeUser,S as deepEqualPlain,me as defaultDisplayUser,Vt as defaultLogger,Xt as defaultSecretContentType,Pe as defineCatalog,kt as defineSecretType,X as deprecateRetiredCodeCatalogRows,B as discoveredProfileCookieName,V as encodeDisplayCookie,Be as formatEcid,dt as formatLogLine,ao as generateULID,j as getCodeCatalogEntity,at as groupResourceSchema,y as idTokenClaimsSchema,Bt as infoLogger,Ee as isCodeCatalog,xe as isConfigLocator,Lt as isConfigSourceError,_e as isEcid,Oe as isJsonResponse,D as isStoreConflictError,oo as jwtAssertionClaimsSchema,M as list,c as listGenerator,Qt as matchTenantHost,eo as matchTenantPath,Ne as matchesListFilter,L as materializeCodeCatalogEntity,T as mergeCodeCatalogEntity,Qe as mergeConfig,t as must,Tt as normalizeTenantBaseDomain,gt as normalizeTenantPathNamespace,wt as normalizeTenantRoutingStrategy,se as oidcCallbackSchema,Ge as parseEcid,et as parseJsonc,Ft as parseKmsPoolControlDocument,Ut as parseKmsPoolDocument,Ht as prettyLogger,P as profileCookieName,m as projectDisplayUser,z as readDisplayCookies,a as readJsonResponse,Jt as readyCatalogEntry,Zt as remoteConfigSecretType,W as resolveDiscoveredCookieMax,te as resolveDiscoveredCookieTtlSeconds,ee as resolveDisplayCookieMax,fe as sanitizeDisplayUser,$t as serializeConfig,It as silentLogger,tt as stableConfigHash,De as stripJsonComments,st as tmIntegrationState,Le as toCodeCatalog,oe as tokenResponseSchema,R as trimTrailingSlash,H as trustedClientPermissionsForPrincipal,G as unexpectedBodySummary,K as unionCatalogRead,it as userSchema,ae as validationFailureResponse,Mt as version,nt as waitOn,Gt as warnLogger,l as withValidate,ce as workloadResourceSchema,ro as workloadTokenResponseSchema};
+import{J,je,d,A,I,v,o,j,c,Ne,Y,f,e,g,x,X,le,Ee,Le,Pe,N,L,T,K,Z,q,n,p,Ke,W,qe,We,Ve,ee,te,V,ne,me,fe,m,z,Ue,B,P,U,G,ze,_,_e,Be,Ge,O,ge,ye,he,Se,ke,be,Ce,Te,we,Re,se,Fe,oe,ie,y,s,He,D,Ae,Ie,i,ae,Je,Ye,r,w,h,Xe,Ze,Oe,F,a,l,t,ce,Qe,De,et,R,S,tt,nt,H,rt,k,M,ve,xe,st,u,b,C,it,at,ue,de}from"./shared/core-knezf9yx.js";var Mt="0.0.24-beta.20261006.22";class ft extends Error{constructor(E,Q){super(E,Q.cause!==void 0?{cause:Q.cause}:void 0);this.name="ConfigSourceError",this.kind=Q.kind,this.recoverable=Q.recoverable,this.code=Q.code,this.status=Q.status,this.path=Q.path,this.sourceType=Q.sourceType,Object.setPrototypeOf(this,ft.prototype)}}function Lt(E){return E instanceof ft}var Nt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function Rt(E){if(E===null||typeof E!=="object")return E;let Q={};for(let[re,pe]of Object.entries(E)){if(Nt.includes(re)||re==="validators"||re==="setStores")continue;Q[re]=pe!==null&&typeof pe==="object"&&!Array.isArray(pe)&&Object.getPrototypeOf(pe)===Object.prototype?Rt(pe):pe}return Q}function $t(E){return Rt(E)}function yt(E,Q){if(!E||typeof E!=="object"||Array.isArray(E))throw Error(`${Q} must be an object.`);return E}function ut(E,Q){if(E===void 0)return;if(typeof E!=="string"||E.length===0||!Number.isFinite(Date.parse(E)))throw Error(`${Q} must be a valid timestamp string.`);return E}function Et(E,Q,re){if(!Array.isArray(E)||!re.allowEmpty&&E.length===0)throw Error(`${Q} keys must be ${re.allowEmpty?"an":"a non-empty"} array.`);let pe=new Set;return E.map(($e,Me)=>{let ot=yt($e,`${Q} keys[${Me}]`);if(typeof ot.id!=="string"||ot.id.length===0)throw Error(`${Q} keys[${Me}].id must be a non-empty string.`);if(pe.has(ot.id))throw Error(`${Q} contains duplicate key id "${ot.id}".`);if(pe.add(ot.id),!["pending","active","deprecated","rotated","revoked"].includes(String(ot.state)))throw Error(`${Q} keys[${Me}].state is invalid.`);if(ot.value!==void 0&&(typeof ot.value!=="string"||ot.value.length===0))throw Error(`${Q} keys[${Me}].value must be a non-empty string when present.`);let ct=ot.meta===void 0?void 0:yt(ot.meta,`${Q} keys[${Me}].meta`);return{id:ot.id,state:ot.state,...ot.value===void 0?{}:{value:ot.value},...ot.notBefore===void 0?{}:{notBefore:ut(ot.notBefore,`${Q} keys[${Me}].notBefore`)},...ot.notAfter===void 0?{}:{notAfter:ut(ot.notAfter,`${Q} keys[${Me}].notAfter`)},...ot.createdAt===void 0?{}:{createdAt:ut(ot.createdAt,`${Q} keys[${Me}].createdAt`)},...ot.activatedAt===void 0?{}:{activatedAt:ut(ot.activatedAt,`${Q} keys[${Me}].activatedAt`)},...ot.deprecatedAt===void 0?{}:{deprecatedAt:ut(ot.deprecatedAt,`${Q} keys[${Me}].deprecatedAt`)},...ot.rotatedAt===void 0?{}:{rotatedAt:ut(ot.rotatedAt,`${Q} keys[${Me}].rotatedAt`)},...ot.revokedAt===void 0?{}:{revokedAt:ut(ot.revokedAt,`${Q} keys[${Me}].revokedAt`)},...ct?{meta:{...ct}}:{}}})}function Wt(E,Q,re){if(E===void 0)return;if(!Array.isArray(E))throw Error(`${re} slots must be an array.`);let pe=new Set,$e=E.map((Me,ot)=>{if(Me===null)return null;if(typeof Me!=="string"||Me.length===0)throw Error(`${re} slots[${ot}] must be a non-empty key id or null.`);if(pe.has(Me))throw Error(`${re} slots contain duplicate key id "${Me}".`);pe.add(Me);let ct=Q.find((pt)=>pt.id===Me);if(!ct)throw Error(`${re} slot key "${Me}" is not present in keys.`);if(ct.state!=="active")throw Error(`${re} slot key "${Me}" must have state "active".`);if(!ct.value)throw Error(`${re} slot key "${Me}" must include a value.`);return Me});if(Q.length===0&&$e.some((Me)=>Me!==null))throw Error(`${re} slots must be omitted or all-null when keys is empty.`);return $e}function Ut(E){let re=yt(E,"KMS pool");if(re.kind!=="kms")throw Error('KMS pool kind must be "kms".');let pe=Et(re.keys,"KMS pool",{allowEmpty:!0}),$e=Wt(re.slots,pe,"KMS pool");return $e?{kind:"kms",slots:$e,keys:pe}:{kind:"kms",keys:pe}}function Ft(E){let re=yt(E,"KMS pool control document");if(re.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:Et(re.keys,"KMS pool control document",{allowEmpty:!0})}}var qt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function ht(E){if(typeof E==="string")return E;try{return JSON.stringify(E)??String(E)}catch{return String(E)}}function St(E){let Q=ht(E);return/^[A-Za-z0-9_./:@+|-]+$/.test(Q)?Q:JSON.stringify(Q)}function zt(E){return ht(E).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function At(E,Q,re){if(re==null)return;if(re instanceof Error){if(E.push(`${Q}.name=${St(re.name)}`),E.push(`${Q}.message=${St(re.message)}`),re.stack)E.push(`${Q}.stack=${St(re.stack)}`);return}E.push(`${Q}=${St(re)}`)}function dt(E,Q,re=[],pe=new Date){let $e=zt(Q instanceof Error?Q.message:Q??""),Me=[];for(let[ot,ct]of re.entries()){if(ct&&typeof ct==="object"&&!Array.isArray(ct)&&!(ct instanceof Error)&&Object.getPrototypeOf(ct)===Object.prototype){for(let[pt,lt]of Object.entries(ct))At(Me,pt,lt);continue}At(Me,`param.${ot}`,ct)}return[pe.toISOString(),qt[E],$e,...Me].filter(Boolean).join(" ")}var It={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Vt=It,jt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Bt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Gt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Ht={trace:()=>{},debug:(E,...Q)=>globalThis.console.debug(dt("debug",E,Q)),info:(E,...Q)=>globalThis.console.info(dt("info",E,Q)),warn:(E,...Q)=>globalThis.console.warn(dt("warn",E,Q)),error:(E,...Q)=>globalThis.console.error(dt("error",E,Q))};function Yt(E,Q){if(typeof Q!=="number"||Q<=0)return E;return new Promise((re,pe)=>{let $e=setTimeout(()=>{pe(Error(`Authz catalog entry did not become ready within ${Q}ms`))},Q);E.then(()=>{clearTimeout($e),re()},(Me)=>{clearTimeout($e),pe(Me)})})}function Jt(E,Q){let re=!1,pe,$e=Q.then(()=>{re=!0},(ot)=>{re=!1,pe=ot}),Me=E;return Object.defineProperty(Me,"ready",{enumerable:!1,configurable:!0,value:(ot)=>Yt($e.then(()=>{if(!re)throw pe}),ot)}),Object.defineProperty(Me,"isReady",{enumerable:!1,configurable:!0,value:()=>re}),Me}var Ct=Object.freeze({jsonc:s,env:"text/x-dotenv",text:"text/plain",binary:Ie,yaml:"application/yaml",toml:"application/toml",xml:Ae});function kt(E){if(!E.id.trim())throw Error("defineSecretType: id is required");let Q=E.mimeType?.trim()||Ct[E.format],re=Object.freeze({id:E.id,...E.label?{label:E.label}:{},format:E.format,mimeType:Q,...E.schemaUrl?{schemaUrl:E.schemaUrl}:{},typeId:E.id});return Object.freeze({id:E.id,...E.label?{label:E.label}:{},format:E.format,mimeType:Q,...E.schemaUrl?{schemaUrl:E.schemaUrl}:{},...E.schema?{schema:E.schema}:{},toRegistryEntry:()=>re})}function Xt(E="jsonc"){return{format:E,mimeType:Ct[E],typeId:E}}class bt extends Error{constructor(E,Q){super(`Secret content type mismatch: expected "${E.mimeType}" (${E.format}) but received "${Q.mimeType}" (${Q.format})`);this.name="SecretContentTypeMismatchError",this.expected=E,this.received=Q}}var Zt=kt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Pt={beforeTenantSegments:["ui"]},_t={beforeTenantSegments:["api"]};function xt(E){return(E??[]).map((Q)=>Q.trim()).filter(Boolean)}function Ot(E){let Q=E.trim();if(!Q)return"/";let re=Q.replace(/\\/g,"/").replace(/\/+/g,"/");return re.startsWith("/")?re:`/${re}`}function vt(E){return Ot(E).split("/").filter(Boolean)}function gt(E){return{beforeTenantSegments:xt(E?.beforeTenantSegments),afterTenantSegments:xt(E?.afterTenantSegments)}}function wt(E){if(E?.type==="host")return{type:"host",baseDomain:Tt(E.baseDomain)};if(E?.type==="selector")return E;return{type:"path",ui:gt(E?.ui??Pt),api:gt(E?.api??_t)}}function Tt(E){let Q=E.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!Q)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return Q}function Qt(E,Q){let re=E.trim().replace(/\.$/,"").toLowerCase(),pe=Tt(Q);if(!re.endsWith(`.${pe}`))return null;let $e=re.slice(0,-(pe.length+1));if(!$e||$e.includes("."))return null;return{id:$e}}function eo(E,Q){let re=gt(Q),pe=re.beforeTenantSegments??[],$e=re.afterTenantSegments??[],Me=vt(E),ot=pe.length+1+$e.length;if(Me.length<ot)return null;for(let mt=0;mt<pe.length;mt++)if(Me[mt]!==pe[mt])return null;let ct=pe.length,pt=Me[ct];if(!pt)return null;for(let mt=0;mt<$e.length;mt++)if(Me[ct+1+mt]!==$e[mt])return null;let lt=Me.slice(ct+1+$e.length);return{id:decodeURIComponent(pt),restSegments:lt,restPath:lt.length>0?`/${lt.join("/")}`:"/"}}function Kt(E,Q="/",re){let pe=gt(re),$e=pe.beforeTenantSegments??[],Me=pe.afterTenantSegments??[],ot=vt(Q),ct=[...$e,encodeURIComponent(E),...Me,...ot];return ct.length>0?`/${ct.join("/")}`:"/"}function to(E,Q="/",re,pe="ui"){let $e=wt(re);if($e.type==="host"||$e.type==="selector")return Ot(Q);return Kt(E,Q,$e[pe])}function oo(E){return{"~standard":{version:1,vendor:E,validate:(Q)=>{if(typeof Q!=="object"||Q===null)return{issues:[{message:"Expected an object"}]};let re=Q,pe=[],$e={...re},Me=["iss","sub"];for(let pt of Me)if(pt in re){if(typeof re[pt]!=="string")pe.push({message:`${pt} must be a string`,path:[pt]})}else pe.push({message:`${pt} is required`,path:[pt]});if("aud"in re&&re.aud!==void 0){let pt=re.aud;if(typeof pt!=="string"&&!Array.isArray(pt))pe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(pt)&&!pt.every((lt)=>typeof lt==="string"))pe.push({message:"aud array must contain only strings",path:["aud"]})}let ot=["jti","scope"];for(let pt of ot)if(pt in re&&re[pt]!==void 0){if(typeof re[pt]!=="string")pe.push({message:`${pt} must be a string`,path:[pt]})}let ct=["exp","iat"];for(let pt of ct)if(pt in re){if(typeof re[pt]!=="number")pe.push({message:`${pt} must be a number`,path:[pt]})}else pe.push({message:`${pt} is required`,path:[pt]});if(pe.length>0)return{issues:pe};return{value:$e}}}}}function ro(E){return{"~standard":{version:1,vendor:E,validate:(Q)=>{if(typeof Q!=="object"||Q===null)return{issues:[{message:"Expected an object"}]};let re=Q,pe=[],$e={};if("access_token"in re)if(typeof re.access_token==="string")$e.access_token=re.access_token;else pe.push({message:"access_token must be a string",path:["access_token"]});else pe.push({message:"access_token is required",path:["access_token"]});if("token_type"in re)if(typeof re.token_type==="string")$e.token_type=re.token_type;else pe.push({message:"token_type must be a string",path:["token_type"]});else pe.push({message:"token_type is required",path:["token_type"]});if("scope"in re)if(typeof re.scope==="string"||re.scope===void 0)$e.scope=re.scope;else pe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in re)if(typeof re.refresh_token==="string"||re.refresh_token===void 0)$e.refresh_token=re.refresh_token;else pe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in re)if(typeof re.expires==="string"||re.expires===void 0)$e.expires=re.expires;else pe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in re)if(typeof re.expires_in==="number"||re.expires_in===void 0)$e.expires_in=re.expires_in;else pe.push({message:"expires_in must be a number",path:["expires_in"]});if(pe.length>0)return{issues:pe};return{value:$e}}}}}function no(E){let Q=new Uint8Array(E);return crypto.getRandomValues(Q),Q}function so(E){let Q="",re=no(E);for(let pe=0;pe<E;pe++){let $e=re[pe]%32;Q+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt($e)}return Q}function io(E,Q){let re="";for(let pe=Q;pe>0;pe--){let $e=E%32;re="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt($e)+re,E=Math.floor(E/32)}return re}function ao(E){let Q=Date.now(),re=io(Q,10),pe=so(16);return`${E??""}${re}${pe}`}export{i as ACCEPT_JSON,Ye as ACCEPT_OCTET_STREAM,ae as ACCEPT_SCIM,Je as ACCEPT_XML,le as AssignmentPolicyError,Y as CANONICAL_RISK_LEVELS,h as CONTENT_TYPE_FORM,r as CONTENT_TYPE_JSON,Ze as CONTENT_TYPE_OCTET_STREAM,w as CONTENT_TYPE_SCIM,Xe as CONTENT_TYPE_XML,ft as ConfigSourceError,We as DEFAULT_DISCOVERED_COOKIE_MAX,Ve as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,qe as DEFAULT_DISPLAY_COOKIE_MAX,f as DEFAULT_RISK_LEVEL,Ct as DEFAULT_SECRET_MIME_TYPES,_t as DEFAULT_TENANT_API_NAMESPACE,Pt as DEFAULT_TENANT_UI_NAMESPACE,ee as DISCOVERED_COOKIE_PREFIX,Ke as DISPLAY_COOKIE_SUFFIX,W as DISPLAY_COOKIE_VERSION,ze as ECID_SCHEME,_ as EcidFormatError,D as FORM_MEDIA_TYPE,e as ION_AUTHZ_GROUP_SCHEMA,we as ION_AUTHZ_OAA_SYNC,Ce as ION_CAPABILITIEZ_READ,Te as ION_CIAM_MAGIC_LINK_CREATE,Fe as ION_ENDPOINT_PERMISSIONS,be as ION_IAM_ACCESS_REQUESTS_WRITE,ke as ION_IAM_CUSTOMERS_WRITE,he as ION_IAM_GROUPS_WRITE,ge as ION_IAM_READ,ye as ION_IAM_USERS_WRITE,Se as ION_IAM_WORKLOADS_WRITE,C as ION_SCIM_CUSTOMER_SCHEMA,u as ION_SCIM_USER_EXTENSION_URN,b as ION_SCIM_WORKLOAD_SCHEMA,se as ION_SDK_PERMISSIONS,Re as ION_TENANT_MANAGE,ve as IoniteError,s as JSON_MEDIA_TYPE,I as KNOWN_BASE_CUSTOMER_KEYS,A as KNOWN_BASE_USER_KEYS,d as KNOWN_ENTITLEMENT_KEYS,v as KNOWN_WORKLOAD_KEYS,Ie as OCTET_STREAM_MEDIA_TYPE,g as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,He as SCIM_MEDIA_TYPE,bt as SecretContentTypeMismatchError,k as StoreConflictError,Ae as XML_MEDIA_TYPE,n as accessRefId,p as accessRootId,O as assertEcid,X as assertRequiredSubjectType,x as assertValidSubjectTypeScoping,Kt as buildTenantPath,to as buildTenantUrl,L as catalogEntityStore,H as claimsToUser,P as compareDisplayExpiryDesc,je as configTrustedClientGrants,o as customAttributes,de as customerResourceSchema,jt as debugLogger,Ue as decodeDisplayCookie,rt as decodeUser,S as deepEqualPlain,me as defaultDisplayUser,Vt as defaultLogger,Xt as defaultSecretContentType,Pe as defineCatalog,kt as defineSecretType,Z as deprecateRetiredCodeCatalogRows,G as discoveredProfileCookieName,z as encodeDisplayCookie,Be as formatEcid,dt as formatLogLine,ao as generateULID,N as getCodeCatalogEntity,at as groupResourceSchema,y as idTokenClaimsSchema,Bt as infoLogger,Ee as isCodeCatalog,xe as isConfigLocator,Lt as isConfigSourceError,_e as isEcid,Oe as isJsonResponse,M as isStoreConflictError,oo as jwtAssertionClaimsSchema,j as list,c as listGenerator,Qt as matchTenantHost,eo as matchTenantPath,Ne as matchesListFilter,K as materializeCodeCatalogEntity,T as mergeCodeCatalogEntity,Qe as mergeConfig,t as must,Tt as normalizeTenantBaseDomain,gt as normalizeTenantPathNamespace,wt as normalizeTenantRoutingStrategy,oe as oidcCallbackSchema,Ge as parseEcid,et as parseJsonc,Ft as parseKmsPoolControlDocument,Ut as parseKmsPoolDocument,Ht as prettyLogger,U as profileCookieName,m as projectDisplayUser,B as readDisplayCookies,a as readJsonResponse,Jt as readyCatalogEntry,Zt as remoteConfigSecretType,V as resolveDiscoveredCookieMax,ne as resolveDiscoveredCookieTtlSeconds,te as resolveDisplayCookieMax,fe as sanitizeDisplayUser,$t as serializeConfig,It as silentLogger,tt as stableConfigHash,De as stripJsonComments,st as tmIntegrationState,Le as toCodeCatalog,ie as tokenResponseSchema,R as trimTrailingSlash,J as trustedClientPermissionsForPrincipal,F as unexpectedBodySummary,q as unionCatalogRead,it as userSchema,ce as validationFailureResponse,Mt as version,nt as waitOn,Gt as warnLogger,l as withValidate,ue as workloadResourceSchema,ro as workloadTokenResponseSchema};