@ionite/core 0.0.24-beta.20261006.21 → 0.0.24-beta.20261007.23

package/dist/index.js

@@ -1,2 +1,2 @@
-import{J,je,d,A,I,v,o,j,c,Ne,Y,f,e,g,x,X,le,Ee,Le,Pe,N,L,T,K,Z,q,n,p,Ke,W,qe,We,Ve,ee,te,V,ne,me,fe,m,z,Ue,B,P,U,G,ze,_,_e,Be,Ge,O,ge,ye,he,Se,ke,be,Ce,Te,we,Re,se,Fe,oe,ie,y,s,He,D,Ae,Ie,i,ae,Je,Ye,r,w,h,Xe,Ze,Oe,F,a,l,t,ce,Qe,De,et,R,S,tt,nt,H,rt,k,M,ve,xe,st,u,b,C,it,at,ue,de}from"./shared/core-knezf9yx.js";var Mt="0.0.24-beta.20261006.21";class ft extends Error{constructor(E,Q){super(E,Q.cause!==void 0?{cause:Q.cause}:void 0);this.name="ConfigSourceError",this.kind=Q.kind,this.recoverable=Q.recoverable,this.code=Q.code,this.status=Q.status,this.path=Q.path,this.sourceType=Q.sourceType,Object.setPrototypeOf(this,ft.prototype)}}function Lt(E){return E instanceof ft}var Nt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function Rt(E){if(E===null||typeof E!=="object")return E;let Q={};for(let[re,pe]of Object.entries(E)){if(Nt.includes(re)||re==="validators"||re==="setStores")continue;Q[re]=pe!==null&&typeof pe==="object"&&!Array.isArray(pe)&&Object.getPrototypeOf(pe)===Object.prototype?Rt(pe):pe}return Q}function $t(E){return Rt(E)}function yt(E,Q){if(!E||typeof E!=="object"||Array.isArray(E))throw Error(`${Q} must be an object.`);return E}function ut(E,Q){if(E===void 0)return;if(typeof E!=="string"||E.length===0||!Number.isFinite(Date.parse(E)))throw Error(`${Q} must be a valid timestamp string.`);return E}function Et(E,Q,re){if(!Array.isArray(E)||!re.allowEmpty&&E.length===0)throw Error(`${Q} keys must be ${re.allowEmpty?"an":"a non-empty"} array.`);let pe=new Set;return E.map(($e,Me)=>{let ot=yt($e,`${Q} keys[${Me}]`);if(typeof ot.id!=="string"||ot.id.length===0)throw Error(`${Q} keys[${Me}].id must be a non-empty string.`);if(pe.has(ot.id))throw Error(`${Q} contains duplicate key id "${ot.id}".`);if(pe.add(ot.id),!["pending","active","deprecated","rotated","revoked"].includes(String(ot.state)))throw Error(`${Q} keys[${Me}].state is invalid.`);if(ot.value!==void 0&&(typeof ot.value!=="string"||ot.value.length===0))throw Error(`${Q} keys[${Me}].value must be a non-empty string when present.`);let ct=ot.meta===void 0?void 0:yt(ot.meta,`${Q} keys[${Me}].meta`);return{id:ot.id,state:ot.state,...ot.value===void 0?{}:{value:ot.value},...ot.notBefore===void 0?{}:{notBefore:ut(ot.notBefore,`${Q} keys[${Me}].notBefore`)},...ot.notAfter===void 0?{}:{notAfter:ut(ot.notAfter,`${Q} keys[${Me}].notAfter`)},...ot.createdAt===void 0?{}:{createdAt:ut(ot.createdAt,`${Q} keys[${Me}].createdAt`)},...ot.activatedAt===void 0?{}:{activatedAt:ut(ot.activatedAt,`${Q} keys[${Me}].activatedAt`)},...ot.deprecatedAt===void 0?{}:{deprecatedAt:ut(ot.deprecatedAt,`${Q} keys[${Me}].deprecatedAt`)},...ot.rotatedAt===void 0?{}:{rotatedAt:ut(ot.rotatedAt,`${Q} keys[${Me}].rotatedAt`)},...ot.revokedAt===void 0?{}:{revokedAt:ut(ot.revokedAt,`${Q} keys[${Me}].revokedAt`)},...ct?{meta:{...ct}}:{}}})}function Wt(E,Q,re){if(E===void 0)return;if(!Array.isArray(E))throw Error(`${re} slots must be an array.`);let pe=new Set,$e=E.map((Me,ot)=>{if(Me===null)return null;if(typeof Me!=="string"||Me.length===0)throw Error(`${re} slots[${ot}] must be a non-empty key id or null.`);if(pe.has(Me))throw Error(`${re} slots contain duplicate key id "${Me}".`);pe.add(Me);let ct=Q.find((pt)=>pt.id===Me);if(!ct)throw Error(`${re} slot key "${Me}" is not present in keys.`);if(ct.state!=="active")throw Error(`${re} slot key "${Me}" must have state "active".`);if(!ct.value)throw Error(`${re} slot key "${Me}" must include a value.`);return Me});if(Q.length===0&&$e.some((Me)=>Me!==null))throw Error(`${re} slots must be omitted or all-null when keys is empty.`);return $e}function Ut(E){let re=yt(E,"KMS pool");if(re.kind!=="kms")throw Error('KMS pool kind must be "kms".');let pe=Et(re.keys,"KMS pool",{allowEmpty:!0}),$e=Wt(re.slots,pe,"KMS pool");return $e?{kind:"kms",slots:$e,keys:pe}:{kind:"kms",keys:pe}}function Ft(E){let re=yt(E,"KMS pool control document");if(re.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:Et(re.keys,"KMS pool control document",{allowEmpty:!0})}}var qt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function ht(E){if(typeof E==="string")return E;try{return JSON.stringify(E)??String(E)}catch{return String(E)}}function St(E){let Q=ht(E);return/^[A-Za-z0-9_./:@+|-]+$/.test(Q)?Q:JSON.stringify(Q)}function zt(E){return ht(E).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function At(E,Q,re){if(re==null)return;if(re instanceof Error){if(E.push(`${Q}.name=${St(re.name)}`),E.push(`${Q}.message=${St(re.message)}`),re.stack)E.push(`${Q}.stack=${St(re.stack)}`);return}E.push(`${Q}=${St(re)}`)}function dt(E,Q,re=[],pe=new Date){let $e=zt(Q instanceof Error?Q.message:Q??""),Me=[];for(let[ot,ct]of re.entries()){if(ct&&typeof ct==="object"&&!Array.isArray(ct)&&!(ct instanceof Error)&&Object.getPrototypeOf(ct)===Object.prototype){for(let[pt,lt]of Object.entries(ct))At(Me,pt,lt);continue}At(Me,`param.${ot}`,ct)}return[pe.toISOString(),qt[E],$e,...Me].filter(Boolean).join(" ")}var It={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Vt=It,jt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Bt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Gt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Ht={trace:()=>{},debug:(E,...Q)=>globalThis.console.debug(dt("debug",E,Q)),info:(E,...Q)=>globalThis.console.info(dt("info",E,Q)),warn:(E,...Q)=>globalThis.console.warn(dt("warn",E,Q)),error:(E,...Q)=>globalThis.console.error(dt("error",E,Q))};function Yt(E,Q){if(typeof Q!=="number"||Q<=0)return E;return new Promise((re,pe)=>{let $e=setTimeout(()=>{pe(Error(`Authz catalog entry did not become ready within ${Q}ms`))},Q);E.then(()=>{clearTimeout($e),re()},(Me)=>{clearTimeout($e),pe(Me)})})}function Jt(E,Q){let re=!1,pe,$e=Q.then(()=>{re=!0},(ot)=>{re=!1,pe=ot}),Me=E;return Object.defineProperty(Me,"ready",{enumerable:!1,configurable:!0,value:(ot)=>Yt($e.then(()=>{if(!re)throw pe}),ot)}),Object.defineProperty(Me,"isReady",{enumerable:!1,configurable:!0,value:()=>re}),Me}var Ct=Object.freeze({jsonc:s,env:"text/x-dotenv",text:"text/plain",binary:Ie,yaml:"application/yaml",toml:"application/toml",xml:Ae});function kt(E){if(!E.id.trim())throw Error("defineSecretType: id is required");let Q=E.mimeType?.trim()||Ct[E.format],re=Object.freeze({id:E.id,...E.label?{label:E.label}:{},format:E.format,mimeType:Q,...E.schemaUrl?{schemaUrl:E.schemaUrl}:{},typeId:E.id});return Object.freeze({id:E.id,...E.label?{label:E.label}:{},format:E.format,mimeType:Q,...E.schemaUrl?{schemaUrl:E.schemaUrl}:{},...E.schema?{schema:E.schema}:{},toRegistryEntry:()=>re})}function Xt(E="jsonc"){return{format:E,mimeType:Ct[E],typeId:E}}class bt extends Error{constructor(E,Q){super(`Secret content type mismatch: expected "${E.mimeType}" (${E.format}) but received "${Q.mimeType}" (${Q.format})`);this.name="SecretContentTypeMismatchError",this.expected=E,this.received=Q}}var Zt=kt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Pt={beforeTenantSegments:["ui"]},_t={beforeTenantSegments:["api"]};function xt(E){return(E??[]).map((Q)=>Q.trim()).filter(Boolean)}function Ot(E){let Q=E.trim();if(!Q)return"/";let re=Q.replace(/\\/g,"/").replace(/\/+/g,"/");return re.startsWith("/")?re:`/${re}`}function vt(E){return Ot(E).split("/").filter(Boolean)}function gt(E){return{beforeTenantSegments:xt(E?.beforeTenantSegments),afterTenantSegments:xt(E?.afterTenantSegments)}}function wt(E){if(E?.type==="host")return{type:"host",baseDomain:Tt(E.baseDomain)};if(E?.type==="selector")return E;return{type:"path",ui:gt(E?.ui??Pt),api:gt(E?.api??_t)}}function Tt(E){let Q=E.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!Q)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return Q}function Qt(E,Q){let re=E.trim().replace(/\.$/,"").toLowerCase(),pe=Tt(Q);if(!re.endsWith(`.${pe}`))return null;let $e=re.slice(0,-(pe.length+1));if(!$e||$e.includes("."))return null;return{id:$e}}function eo(E,Q){let re=gt(Q),pe=re.beforeTenantSegments??[],$e=re.afterTenantSegments??[],Me=vt(E),ot=pe.length+1+$e.length;if(Me.length<ot)return null;for(let mt=0;mt<pe.length;mt++)if(Me[mt]!==pe[mt])return null;let ct=pe.length,pt=Me[ct];if(!pt)return null;for(let mt=0;mt<$e.length;mt++)if(Me[ct+1+mt]!==$e[mt])return null;let lt=Me.slice(ct+1+$e.length);return{id:decodeURIComponent(pt),restSegments:lt,restPath:lt.length>0?`/${lt.join("/")}`:"/"}}function Kt(E,Q="/",re){let pe=gt(re),$e=pe.beforeTenantSegments??[],Me=pe.afterTenantSegments??[],ot=vt(Q),ct=[...$e,encodeURIComponent(E),...Me,...ot];return ct.length>0?`/${ct.join("/")}`:"/"}function to(E,Q="/",re,pe="ui"){let $e=wt(re);if($e.type==="host"||$e.type==="selector")return Ot(Q);return Kt(E,Q,$e[pe])}function oo(E){return{"~standard":{version:1,vendor:E,validate:(Q)=>{if(typeof Q!=="object"||Q===null)return{issues:[{message:"Expected an object"}]};let re=Q,pe=[],$e={...re},Me=["iss","sub"];for(let pt of Me)if(pt in re){if(typeof re[pt]!=="string")pe.push({message:`${pt} must be a string`,path:[pt]})}else pe.push({message:`${pt} is required`,path:[pt]});if("aud"in re&&re.aud!==void 0){let pt=re.aud;if(typeof pt!=="string"&&!Array.isArray(pt))pe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(pt)&&!pt.every((lt)=>typeof lt==="string"))pe.push({message:"aud array must contain only strings",path:["aud"]})}let ot=["jti","scope"];for(let pt of ot)if(pt in re&&re[pt]!==void 0){if(typeof re[pt]!=="string")pe.push({message:`${pt} must be a string`,path:[pt]})}let ct=["exp","iat"];for(let pt of ct)if(pt in re){if(typeof re[pt]!=="number")pe.push({message:`${pt} must be a number`,path:[pt]})}else pe.push({message:`${pt} is required`,path:[pt]});if(pe.length>0)return{issues:pe};return{value:$e}}}}}function ro(E){return{"~standard":{version:1,vendor:E,validate:(Q)=>{if(typeof Q!=="object"||Q===null)return{issues:[{message:"Expected an object"}]};let re=Q,pe=[],$e={};if("access_token"in re)if(typeof re.access_token==="string")$e.access_token=re.access_token;else pe.push({message:"access_token must be a string",path:["access_token"]});else pe.push({message:"access_token is required",path:["access_token"]});if("token_type"in re)if(typeof re.token_type==="string")$e.token_type=re.token_type;else pe.push({message:"token_type must be a string",path:["token_type"]});else pe.push({message:"token_type is required",path:["token_type"]});if("scope"in re)if(typeof re.scope==="string"||re.scope===void 0)$e.scope=re.scope;else pe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in re)if(typeof re.refresh_token==="string"||re.refresh_token===void 0)$e.refresh_token=re.refresh_token;else pe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in re)if(typeof re.expires==="string"||re.expires===void 0)$e.expires=re.expires;else pe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in re)if(typeof re.expires_in==="number"||re.expires_in===void 0)$e.expires_in=re.expires_in;else pe.push({message:"expires_in must be a number",path:["expires_in"]});if(pe.length>0)return{issues:pe};return{value:$e}}}}}function no(E){let Q=new Uint8Array(E);return crypto.getRandomValues(Q),Q}function so(E){let Q="",re=no(E);for(let pe=0;pe<E;pe++){let $e=re[pe]%32;Q+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt($e)}return Q}function io(E,Q){let re="";for(let pe=Q;pe>0;pe--){let $e=E%32;re="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt($e)+re,E=Math.floor(E/32)}return re}function ao(E){let Q=Date.now(),re=io(Q,10),pe=so(16);return`${E??""}${re}${pe}`}export{i as ACCEPT_JSON,Ye as ACCEPT_OCTET_STREAM,ae as ACCEPT_SCIM,Je as ACCEPT_XML,le as AssignmentPolicyError,Y as CANONICAL_RISK_LEVELS,h as CONTENT_TYPE_FORM,r as CONTENT_TYPE_JSON,Ze as CONTENT_TYPE_OCTET_STREAM,w as CONTENT_TYPE_SCIM,Xe as CONTENT_TYPE_XML,ft as ConfigSourceError,We as DEFAULT_DISCOVERED_COOKIE_MAX,Ve as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,qe as DEFAULT_DISPLAY_COOKIE_MAX,f as DEFAULT_RISK_LEVEL,Ct as DEFAULT_SECRET_MIME_TYPES,_t as DEFAULT_TENANT_API_NAMESPACE,Pt as DEFAULT_TENANT_UI_NAMESPACE,ee as DISCOVERED_COOKIE_PREFIX,Ke as DISPLAY_COOKIE_SUFFIX,W as DISPLAY_COOKIE_VERSION,ze as ECID_SCHEME,_ as EcidFormatError,D as FORM_MEDIA_TYPE,e as ION_AUTHZ_GROUP_SCHEMA,we as ION_AUTHZ_OAA_SYNC,Ce as ION_CAPABILITIEZ_READ,Te as ION_CIAM_MAGIC_LINK_CREATE,Fe as ION_ENDPOINT_PERMISSIONS,be as ION_IAM_ACCESS_REQUESTS_WRITE,ke as ION_IAM_CUSTOMERS_WRITE,he as ION_IAM_GROUPS_WRITE,ge as ION_IAM_READ,ye as ION_IAM_USERS_WRITE,Se as ION_IAM_WORKLOADS_WRITE,C as ION_SCIM_CUSTOMER_SCHEMA,u as ION_SCIM_USER_EXTENSION_URN,b as ION_SCIM_WORKLOAD_SCHEMA,se as ION_SDK_PERMISSIONS,Re as ION_TENANT_MANAGE,ve as IoniteError,s as JSON_MEDIA_TYPE,I as KNOWN_BASE_CUSTOMER_KEYS,A as KNOWN_BASE_USER_KEYS,d as KNOWN_ENTITLEMENT_KEYS,v as KNOWN_WORKLOAD_KEYS,Ie as OCTET_STREAM_MEDIA_TYPE,g as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,He as SCIM_MEDIA_TYPE,bt as SecretContentTypeMismatchError,k as StoreConflictError,Ae as XML_MEDIA_TYPE,n as accessRefId,p as accessRootId,O as assertEcid,X as assertRequiredSubjectType,x as assertValidSubjectTypeScoping,Kt as buildTenantPath,to as buildTenantUrl,L as catalogEntityStore,H as claimsToUser,P as compareDisplayExpiryDesc,je as configTrustedClientGrants,o as customAttributes,de as customerResourceSchema,jt as debugLogger,Ue as decodeDisplayCookie,rt as decodeUser,S as deepEqualPlain,me as defaultDisplayUser,Vt as defaultLogger,Xt as defaultSecretContentType,Pe as defineCatalog,kt as defineSecretType,Z as deprecateRetiredCodeCatalogRows,G as discoveredProfileCookieName,z as encodeDisplayCookie,Be as formatEcid,dt as formatLogLine,ao as generateULID,N as getCodeCatalogEntity,at as groupResourceSchema,y as idTokenClaimsSchema,Bt as infoLogger,Ee as isCodeCatalog,xe as isConfigLocator,Lt as isConfigSourceError,_e as isEcid,Oe as isJsonResponse,M as isStoreConflictError,oo as jwtAssertionClaimsSchema,j as list,c as listGenerator,Qt as matchTenantHost,eo as matchTenantPath,Ne as matchesListFilter,K as materializeCodeCatalogEntity,T as mergeCodeCatalogEntity,Qe as mergeConfig,t as must,Tt as normalizeTenantBaseDomain,gt as normalizeTenantPathNamespace,wt as normalizeTenantRoutingStrategy,oe as oidcCallbackSchema,Ge as parseEcid,et as parseJsonc,Ft as parseKmsPoolControlDocument,Ut as parseKmsPoolDocument,Ht as prettyLogger,U as profileCookieName,m as projectDisplayUser,B as readDisplayCookies,a as readJsonResponse,Jt as readyCatalogEntry,Zt as remoteConfigSecretType,V as resolveDiscoveredCookieMax,ne as resolveDiscoveredCookieTtlSeconds,te as resolveDisplayCookieMax,fe as sanitizeDisplayUser,$t as serializeConfig,It as silentLogger,tt as stableConfigHash,De as stripJsonComments,st as tmIntegrationState,Le as toCodeCatalog,ie as tokenResponseSchema,R as trimTrailingSlash,J as trustedClientPermissionsForPrincipal,F as unexpectedBodySummary,q as unionCatalogRead,it as userSchema,ce as validationFailureResponse,Mt as version,nt as waitOn,Gt as warnLogger,l as withValidate,ue as workloadResourceSchema,ro as workloadTokenResponseSchema};
+import{Y,Le,l,I,v,x,i,r,X,N,u,$e,Z,g,e,y,E,Q,Ee,Pe,Ke,Ue,L,K,T,q,ee,W,n,m,We,V,Ve,ze,Be,ne,re,z,se,fe,ge,f,B,_e,G,U,_,F,Oe,O,De,Ge,Fe,D,ye,he,Se,ke,be,Ce,Te,we,Re,Ae,ie,Je,ae,ce,h,o,He,M,Ie,ve,a,ue,Ye,Xe,s,w,S,Ze,Qe,Me,J,c,p,t,de,et,je,tt,R,k,nt,rt,H,st,A,j,xe,ot,d,b,C,at,ct,le,pe}from"./shared/core-y6y95p25.js";var Nt="0.0.24-beta.20261007.23";class Ct extends r{constructor(P,te){let oe=te.kind==="connection"||te.kind==="timeout"||te.kind==="not_found";super(P,{cause:te.cause,status:oe?503:500,upstreamStatus:te.status});this.kind=te.kind,this.recoverable=te.recoverable,this.code=te.code,this.path=te.path,this.sourceType=te.sourceType}}function $t(P){return P instanceof Ct}function Ut(P){let te=P?.trim();if(!te)return;try{let oe=new URL(te),me=oe.pathname.replace(/\/+$/g,"");return`${oe.protocol}//${oe.host}${me}`}catch{return}}function Et(P,te="ion.config.source"){if(!P)return{};let oe={[`${te}.type`]:P.type};if(P.transport)oe[`${te}.transport`]=P.transport;if(P.url)oe[`${te}.url`]=P.url;if(P.path)oe[`${te}.path`]=P.path;if(P.from)Object.assign(oe,Et(P.from,`${te}.from`));return oe}var Wt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function At(P){if(P===null||typeof P!=="object")return P;let te={};for(let[oe,me]of Object.entries(P)){if(Wt.includes(oe)||oe==="validators"||oe==="setStores")continue;te[oe]=me!==null&&typeof me==="object"&&!Array.isArray(me)&&Object.getPrototypeOf(me)===Object.prototype?At(me):me}return te}function Ft(P){return At(P)}function St(P,te){if(!P||typeof P!=="object"||Array.isArray(P))throw Error(`${te} must be an object.`);return P}function dt(P,te){if(P===void 0)return;if(typeof P!=="string"||P.length===0||!Number.isFinite(Date.parse(P)))throw Error(`${te} must be a valid timestamp string.`);return P}function ht(P,te,oe){if(!Array.isArray(P)||!oe.allowEmpty&&P.length===0)throw Error(`${te} keys must be ${oe.allowEmpty?"an":"a non-empty"} array.`);let me=new Set;return P.map((qe,Ne)=>{let it=St(qe,`${te} keys[${Ne}]`);if(typeof it.id!=="string"||it.id.length===0)throw Error(`${te} keys[${Ne}].id must be a non-empty string.`);if(me.has(it.id))throw Error(`${te} contains duplicate key id "${it.id}".`);if(me.add(it.id),!["pending","active","deprecated","rotated","revoked"].includes(String(it.state)))throw Error(`${te} keys[${Ne}].state is invalid.`);if(it.value!==void 0&&(typeof it.value!=="string"||it.value.length===0))throw Error(`${te} keys[${Ne}].value must be a non-empty string when present.`);let mt=it.meta===void 0?void 0:St(it.meta,`${te} keys[${Ne}].meta`);return{id:it.id,state:it.state,...it.value===void 0?{}:{value:it.value},...it.notBefore===void 0?{}:{notBefore:dt(it.notBefore,`${te} keys[${Ne}].notBefore`)},...it.notAfter===void 0?{}:{notAfter:dt(it.notAfter,`${te} keys[${Ne}].notAfter`)},...it.createdAt===void 0?{}:{createdAt:dt(it.createdAt,`${te} keys[${Ne}].createdAt`)},...it.activatedAt===void 0?{}:{activatedAt:dt(it.activatedAt,`${te} keys[${Ne}].activatedAt`)},...it.deprecatedAt===void 0?{}:{deprecatedAt:dt(it.deprecatedAt,`${te} keys[${Ne}].deprecatedAt`)},...it.rotatedAt===void 0?{}:{rotatedAt:dt(it.rotatedAt,`${te} keys[${Ne}].rotatedAt`)},...it.revokedAt===void 0?{}:{revokedAt:dt(it.revokedAt,`${te} keys[${Ne}].revokedAt`)},...mt?{meta:{...mt}}:{}}})}function qt(P,te,oe){if(P===void 0)return;if(!Array.isArray(P))throw Error(`${oe} slots must be an array.`);let me=new Set,qe=P.map((Ne,it)=>{if(Ne===null)return null;if(typeof Ne!=="string"||Ne.length===0)throw Error(`${oe} slots[${it}] must be a non-empty key id or null.`);if(me.has(Ne))throw Error(`${oe} slots contain duplicate key id "${Ne}".`);me.add(Ne);let mt=te.find((pt)=>pt.id===Ne);if(!mt)throw Error(`${oe} slot key "${Ne}" is not present in keys.`);if(mt.state!=="active")throw Error(`${oe} slot key "${Ne}" must have state "active".`);if(!mt.value)throw Error(`${oe} slot key "${Ne}" must include a value.`);return Ne});if(te.length===0&&qe.some((Ne)=>Ne!==null))throw Error(`${oe} slots must be omitted or all-null when keys is empty.`);return qe}function Vt(P){let oe=St(P,"KMS pool");if(oe.kind!=="kms")throw Error('KMS pool kind must be "kms".');let me=ht(oe.keys,"KMS pool",{allowEmpty:!0}),qe=qt(oe.slots,me,"KMS pool");return qe?{kind:"kms",slots:qe,keys:me}:{kind:"kms",keys:me}}function zt(P){let oe=St(P,"KMS pool control document");if(oe.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:ht(oe.keys,"KMS pool control document",{allowEmpty:!0})}}var jt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function bt(P){if(typeof P==="string")return P;try{return JSON.stringify(P)??String(P)}catch{return String(P)}}function gt(P){let te=bt(P);return/^[A-Za-z0-9_./:@+|-]+$/.test(te)?te:JSON.stringify(te)}function Bt(P){return bt(P).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function It(P,te,oe){if(oe==null)return;if(oe instanceof Error){let me=X(oe);if(me){for(let[qe,Ne]of Object.entries(me))if(Ne!=null)P.push(`${qe}=${gt(Ne)}`);return}if(P.push(`${te}.name=${gt(oe.name)}`),P.push(`${te}.message=${gt(oe.message)}`),oe.stack)P.push(`${te}.stack=${gt(oe.stack)}`);return}P.push(`${te}=${gt(oe)}`)}function ft(P,te,oe=[],me=new Date){let qe=Bt(te instanceof Error?te.message:te??""),Ne=[];for(let[it,mt]of oe.entries()){if(mt&&typeof mt==="object"&&!Array.isArray(mt)&&!(mt instanceof Error)&&Object.getPrototypeOf(mt)===Object.prototype){for(let[pt,lt]of Object.entries(mt))It(Ne,pt,lt);continue}It(Ne,`param.${it}`,mt)}return[me.toISOString(),jt[P],qe,...Ne].filter(Boolean).join(" ")}var xt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Gt=xt,Ht={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Yt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Jt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Xt={trace:()=>{},debug:(P,...te)=>globalThis.console.debug(ft("debug",P,te)),info:(P,...te)=>globalThis.console.info(ft("info",P,te)),warn:(P,...te)=>globalThis.console.warn(ft("warn",P,te)),error:(P,...te)=>globalThis.console.error(ft("error",P,te))};function Zt(P,te){if(typeof te!=="number"||te<=0)return P;return new Promise((oe,me)=>{let qe=setTimeout(()=>{me(Error(`Authz catalog entry did not become ready within ${te}ms`))},te);P.then(()=>{clearTimeout(qe),oe()},(Ne)=>{clearTimeout(qe),me(Ne)})})}function Qt(P,te){let oe=!1,me,qe=te.then(()=>{oe=!0},(it)=>{oe=!1,me=it}),Ne=P;return Object.defineProperty(Ne,"ready",{enumerable:!1,configurable:!0,value:(it)=>Zt(qe.then(()=>{if(!oe)throw me}),it)}),Object.defineProperty(Ne,"isReady",{enumerable:!1,configurable:!0,value:()=>oe}),Ne}var kt=Object.freeze({jsonc:o,env:"text/x-dotenv",text:"text/plain",binary:ve,yaml:"application/yaml",toml:"application/toml",xml:Ie});function Rt(P){if(!P.id.trim())throw Error("defineSecretType: id is required");let te=P.mimeType?.trim()||kt[P.format],oe=Object.freeze({id:P.id,...P.label?{label:P.label}:{},format:P.format,mimeType:te,...P.schemaUrl?{schemaUrl:P.schemaUrl}:{},typeId:P.id});return Object.freeze({id:P.id,...P.label?{label:P.label}:{},format:P.format,mimeType:te,...P.schemaUrl?{schemaUrl:P.schemaUrl}:{},...P.schema?{schema:P.schema}:{},toRegistryEntry:()=>oe})}function eo(P="jsonc"){return{format:P,mimeType:kt[P],typeId:P}}class Pt extends r{constructor(P,te){super(`Secret content type mismatch: expected "${P.mimeType}" (${P.format}) but received "${te.mimeType}" (${te.format})`,{status:500});this.expected=P,this.received=te}}var to=Rt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var _t={beforeTenantSegments:["ui"]},wt={beforeTenantSegments:["api"]};function Ot(P){return(P??[]).map((te)=>te.trim()).filter(Boolean)}function vt(P){let te=P.trim();if(!te)return"/";let oe=te.replace(/\\/g,"/").replace(/\/+/g,"/");return oe.startsWith("/")?oe:`/${oe}`}function Kt(P){return vt(P).split("/").filter(Boolean)}function yt(P){return{beforeTenantSegments:Ot(P?.beforeTenantSegments),afterTenantSegments:Ot(P?.afterTenantSegments)}}function Dt(P){if(P?.type==="host")return{type:"host",baseDomain:Tt(P.baseDomain)};if(P?.type==="selector")return P;return{type:"path",ui:yt(P?.ui??_t),api:yt(P?.api??wt)}}function Tt(P){let te=P.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!te)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return te}function oo(P,te){let oe=P.trim().replace(/\.$/,"").toLowerCase(),me=Tt(te);if(!oe.endsWith(`.${me}`))return null;let qe=oe.slice(0,-(me.length+1));if(!qe||qe.includes("."))return null;return{id:qe}}function ro(P,te){let oe=yt(te),me=oe.beforeTenantSegments??[],qe=oe.afterTenantSegments??[],Ne=Kt(P),it=me.length+1+qe.length;if(Ne.length<it)return null;for(let ut=0;ut<me.length;ut++)if(Ne[ut]!==me[ut])return null;let mt=me.length,pt=Ne[mt];if(!pt)return null;for(let ut=0;ut<qe.length;ut++)if(Ne[mt+1+ut]!==qe[ut])return null;let lt=Ne.slice(mt+1+qe.length);return{id:decodeURIComponent(pt),restSegments:lt,restPath:lt.length>0?`/${lt.join("/")}`:"/"}}function Lt(P,te="/",oe){let me=yt(oe),qe=me.beforeTenantSegments??[],Ne=me.afterTenantSegments??[],it=Kt(te),mt=[...qe,encodeURIComponent(P),...Ne,...it];return mt.length>0?`/${mt.join("/")}`:"/"}function no(P,te="/",oe,me="ui"){let qe=Dt(oe);if(qe.type==="host"||qe.type==="selector")return vt(te);return Lt(P,te,qe[me])}function so(P){return{"~standard":{version:1,vendor:P,validate:(te)=>{if(typeof te!=="object"||te===null)return{issues:[{message:"Expected an object"}]};let oe=te,me=[],qe={...oe},Ne=["iss","sub"];for(let pt of Ne)if(pt in oe){if(typeof oe[pt]!=="string")me.push({message:`${pt} must be a string`,path:[pt]})}else me.push({message:`${pt} is required`,path:[pt]});if("aud"in oe&&oe.aud!==void 0){let pt=oe.aud;if(typeof pt!=="string"&&!Array.isArray(pt))me.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(pt)&&!pt.every((lt)=>typeof lt==="string"))me.push({message:"aud array must contain only strings",path:["aud"]})}let it=["jti","scope"];for(let pt of it)if(pt in oe&&oe[pt]!==void 0){if(typeof oe[pt]!=="string")me.push({message:`${pt} must be a string`,path:[pt]})}let mt=["exp","iat"];for(let pt of mt)if(pt in oe){if(typeof oe[pt]!=="number")me.push({message:`${pt} must be a number`,path:[pt]})}else me.push({message:`${pt} is required`,path:[pt]});if(me.length>0)return{issues:me};return{value:qe}}}}}function io(P){return{"~standard":{version:1,vendor:P,validate:(te)=>{if(typeof te!=="object"||te===null)return{issues:[{message:"Expected an object"}]};let oe=te,me=[],qe={};if("access_token"in oe)if(typeof oe.access_token==="string")qe.access_token=oe.access_token;else me.push({message:"access_token must be a string",path:["access_token"]});else me.push({message:"access_token is required",path:["access_token"]});if("token_type"in oe)if(typeof oe.token_type==="string")qe.token_type=oe.token_type;else me.push({message:"token_type must be a string",path:["token_type"]});else me.push({message:"token_type is required",path:["token_type"]});if("scope"in oe)if(typeof oe.scope==="string"||oe.scope===void 0)qe.scope=oe.scope;else me.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in oe)if(typeof oe.refresh_token==="string"||oe.refresh_token===void 0)qe.refresh_token=oe.refresh_token;else me.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in oe)if(typeof oe.expires==="string"||oe.expires===void 0)qe.expires=oe.expires;else me.push({message:"expires must be a string",path:["expires"]});if("expires_in"in oe)if(typeof oe.expires_in==="number"||oe.expires_in===void 0)qe.expires_in=oe.expires_in;else me.push({message:"expires_in must be a number",path:["expires_in"]});if(me.length>0)return{issues:me};return{value:qe}}}}}function ao(P){let te=new Uint8Array(P);return crypto.getRandomValues(te),te}function po(P){let te="",oe=ao(P);for(let me=0;me<P;me++){let qe=oe[me]%32;te+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(qe)}return te}function co(P,te){let oe="";for(let me=te;me>0;me--){let qe=P%32;oe="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(qe)+oe,P=Math.floor(P/32)}return oe}function mo(P){let te=Date.now(),oe=co(te,10),me=po(16);return`${P??""}${oe}${me}`}export{a as ACCEPT_JSON,Xe as ACCEPT_OCTET_STREAM,ue as ACCEPT_SCIM,Ye as ACCEPT_XML,Ee as AssignmentPolicyError,Z as CANONICAL_RISK_LEVELS,S as CONTENT_TYPE_FORM,s as CONTENT_TYPE_JSON,Qe as CONTENT_TYPE_OCTET_STREAM,w as CONTENT_TYPE_SCIM,Ze as CONTENT_TYPE_XML,Ct as ConfigSourceError,ze as DEFAULT_DISCOVERED_COOKIE_MAX,Be as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Ve as DEFAULT_DISPLAY_COOKIE_MAX,g as DEFAULT_RISK_LEVEL,kt as DEFAULT_SECRET_MIME_TYPES,wt as DEFAULT_TENANT_API_NAMESPACE,_t as DEFAULT_TENANT_UI_NAMESPACE,ne as DISCOVERED_COOKIE_PREFIX,We as DISPLAY_COOKIE_SUFFIX,V as DISPLAY_COOKIE_VERSION,Oe as ECID_SCHEME,O as EcidFormatError,M as FORM_MEDIA_TYPE,e as ION_AUTHZ_GROUP_SCHEMA,Re as ION_AUTHZ_OAA_SYNC,Te as ION_CAPABILITIEZ_READ,we as ION_CIAM_MAGIC_LINK_CREATE,Je as ION_ENDPOINT_PERMISSIONS,Ce as ION_IAM_ACCESS_REQUESTS_WRITE,be as ION_IAM_CUSTOMERS_WRITE,Se as ION_IAM_GROUPS_WRITE,ye as ION_IAM_READ,he as ION_IAM_USERS_WRITE,ke as ION_IAM_WORKLOADS_WRITE,C as ION_SCIM_CUSTOMER_SCHEMA,d as ION_SCIM_USER_EXTENSION_URN,b as ION_SCIM_WORKLOAD_SCHEMA,ie as ION_SDK_PERMISSIONS,Ae as ION_TENANT_MANAGE,r as IoniteError,o as JSON_MEDIA_TYPE,v as KNOWN_BASE_CUSTOMER_KEYS,I as KNOWN_BASE_USER_KEYS,l as KNOWN_ENTITLEMENT_KEYS,x as KNOWN_WORKLOAD_KEYS,ve as OCTET_STREAM_MEDIA_TYPE,y as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,He as SCIM_MEDIA_TYPE,Pt as SecretContentTypeMismatchError,A as StoreConflictError,Ie as XML_MEDIA_TYPE,n as accessRefId,m as accessRootId,D as assertEcid,Q as assertRequiredSubjectType,E as assertValidSubjectTypeScoping,Lt as buildTenantPath,no as buildTenantUrl,K as catalogEntityStore,H as claimsToUser,U as compareDisplayExpiryDesc,Et as configSourceOriginLogFields,Le as configTrustedClientGrants,i as customAttributes,pe as customerResourceSchema,Ht as debugLogger,_e as decodeDisplayCookie,st as decodeUser,k as deepEqualPlain,fe as defaultDisplayUser,Gt as defaultLogger,eo as defaultSecretContentType,Ue as defineCatalog,Rt as defineSecretType,ee as deprecateRetiredCodeCatalogRows,Ut as describeOriginUrl,F as discoveredProfileCookieName,B as encodeDisplayCookie,X as errorLogAttributes,Ge as formatEcid,ft as formatLogLine,mo as generateULID,L as getCodeCatalogEntity,ct as groupResourceSchema,h as idTokenClaimsSchema,Yt as infoLogger,Pe as isCodeCatalog,xe as isConfigLocator,$t as isConfigSourceError,De as isEcid,Me as isJsonResponse,j as isStoreConflictError,so as jwtAssertionClaimsSchema,N as list,u as listGenerator,oo as matchTenantHost,ro as matchTenantPath,$e as matchesListFilter,q as materializeCodeCatalogEntity,T as mergeCodeCatalogEntity,et as mergeConfig,t as must,Tt as normalizeTenantBaseDomain,yt as normalizeTenantPathNamespace,Dt as normalizeTenantRoutingStrategy,ae as oidcCallbackSchema,Fe as parseEcid,tt as parseJsonc,zt as parseKmsPoolControlDocument,Vt as parseKmsPoolDocument,Xt as prettyLogger,_ as profileCookieName,f as projectDisplayUser,G as readDisplayCookies,c as readJsonResponse,Qt as readyCatalogEntry,to as remoteConfigSecretType,z as resolveDiscoveredCookieMax,se as resolveDiscoveredCookieTtlSeconds,re as resolveDisplayCookieMax,ge as sanitizeDisplayUser,Ft as serializeConfig,xt as silentLogger,nt as stableConfigHash,je as stripJsonComments,ot as tmIntegrationState,Ke as toCodeCatalog,ce as tokenResponseSchema,R as trimTrailingSlash,Y as trustedClientPermissionsForPrincipal,J as unexpectedBodySummary,W as unionCatalogRead,at as userSchema,de as validationFailureResponse,Nt as version,rt as waitOn,Jt as warnLogger,p as withValidate,le as workloadResourceSchema,io as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -7,6 +7,16 @@ type NoReserved<
 	TReserved extends PropertyKey,
 	TFullShapeKeys extends PropertyKey = never
 > = TAttributes extends object ? [TFullShapeKeys] extends [never] ? TAttributes & { [TKey in Extract<keyof TAttributes, TReserved>]? : never } : [TFullShapeKeys] extends [keyof TAttributes] ? Omit<TAttributes, TReserved> : TAttributes & { [TKey in Extract<keyof TAttributes, TReserved>]? : never } : TAttributes;
+/**
+* Minimal logger interface compatible with common structured logging patterns.
+*/
+interface Logger {
+	trace(message?: unknown, ...optionalParams: unknown[]): void;
+	debug(message?: unknown, ...optionalParams: unknown[]): void;
+	info(message?: unknown, ...optionalParams: unknown[]): void;
+	warn(message?: unknown, ...optionalParams: unknown[]): void;
+	error(message?: unknown, ...optionalParams: unknown[]): void;
+}
 import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
 /**
 * ConfigSource-only block that lets an issuing IdP's token claims satisfy `has*` checks.
@@ -1415,6 +1425,19 @@ type CIAMProviderConfig = {
 	claimsAsEntitlements?: ClaimsAsEntitlements;
 	/** ConfigSource-only IdP assignment workflow used when IAM assignment is `'idp'`. */
 	accessRequests?: AccessRequestsDestination;
+	/**
+	* Microsoft only. Which Entra tenants may sign in when the provider uses a
+	* multi-tenant authority (`/common`, `/organizations`, `/consumers`). Entra mints
+	* tenant-scoped issuers (`https://login.microsoftonline.com/{tid}/v2.0`), so no
+	* single `authority` can be compared by strict equality; this constrains the
+	* accepted `tid` instead.
+	*
+	* `'any'` (default) accepts any work/school tenant and personal accounts,
+	* `'consumers'` accepts only personal Microsoft accounts, and an array accepts
+	* only the listed tenant GUIDs. Ignored when `authority` names a single tenant —
+	* that keeps the strict-equality check.
+	*/
+	allowedTenants?: "any" | "consumers" | string[];
 };
 /** Sanitized provider entry returned by the discovery endpoint for the UI. */
 type CIAMProviderDescriptor = {
@@ -1441,6 +1464,8 @@ type CiamClaimCandidate = {
 type CIAMProviderFlow = "id_token" | "userinfo";
 type CIAMProviderPreset = {
 	flow: CIAMProviderFlow;
+	/** Default issuer/authority when the config omits one. */
+	authority?: string;
 	authorizationUrl?: string;
 	tokenUrl?: string;
 	jwksUri?: string;
@@ -1459,6 +1484,8 @@ type ResolvedCiamProvider = {
 	name: string;
 	type: CIAMProviderType;
 	flow: CIAMProviderFlow;
+	/** Effective issuer/authority (config override, else preset default). */
+	authority?: string;
 	authorizationUrl?: string;
 	tokenUrl?: string;
 	jwksUri?: string;
@@ -1537,16 +1564,6 @@ type ParsedDisplayCookie = {
 	prefix: string;
 	envelope: DisplayCookieEnvelope;
 };
-/**
-* Minimal logger interface compatible with common structured logging patterns.
-*/
-interface Logger {
-	trace(message?: unknown, ...optionalParams: unknown[]): void;
-	debug(message?: unknown, ...optionalParams: unknown[]): void;
-	info(message?: unknown, ...optionalParams: unknown[]): void;
-	warn(message?: unknown, ...optionalParams: unknown[]): void;
-	error(message?: unknown, ...optionalParams: unknown[]): void;
-}
 import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
 type ChangeListener = () => void;
 /**
@@ -1827,7 +1844,7 @@ type WorkloadClientDescription = {
 	idpTokenUrl?: string;
 	scope?: string;
 	audience?: string;
-	authMethod: "client_secret" | "private_key_jwt" | "server_only";
+	authMethod: "client_secret" | "federated_token" | "managed_identity" | "private_key_jwt" | "server_only";
 };
 type WorkloadDescription = ModuleDescriptionBase<"workload"> & {
 	incoming: {
@@ -1928,6 +1945,8 @@ type TmDescription = ModuleDescriptionBase<"tm"> & {
 	};
 	consentTtlSeconds?: number;
 	maxRedeemAttempts?: number;
+	/** Effective `action_required` request-token lifetime, including the one-hour default. */
+	requestTokenTtlSeconds: number;
 };
 type ModuleDescription = SsoDescription | CiamDescription | IamDescription | WorkloadDescription | SecretsDescription | KmsDescription | OtelDescription | AuthzDescription | TmDescription;
 type IoniteDescription = {
@@ -2249,10 +2268,21 @@ type ClientCredentialsWorkloadConfig = WorkloadConfigBase & {
 	*/
 	clientId: string;
 	/**
-	* OAuth2 client secret
-	* REQUIRED for Client Credentials mode
+	* OAuth2 client secret. Omit it to authenticate with a federated token instead
+	* (see `federatedTokenFile`). A client secret wins when both are present.
 	*/
-	clientSecret: string;
+	clientSecret?: string;
+	/**
+	* Path to a projected federated token (e.g. AKS Workload Identity), sent as a jwt-bearer
+	* `client_assertion` in place of `client_secret`. Defaults to `AZURE_FEDERATED_TOKEN_FILE`.
+	* Read on every acquisition because the platform rotates it.
+	*/
+	federatedTokenFile?: string;
+	/**
+	* `managed_identity`: get the token from the platform's managed identity endpoint instead of an
+	* IdP token URL. `clientId` is the managed identity's client ID; `scope` names the audience.
+	*/
+	authMethod?: "managed_identity";
 };
 /**
 * Server-Only Workload Configuration
@@ -2286,7 +2316,7 @@ type ServerOnlyWorkloadConfig = WorkloadConfigBase & {
 * detected based on which fields are present:
 *
 * - **JWT Bearer Grant**: Requires `workload_id` + `private_key`
-* - **Client Credentials**: Requires `client_id` + `client_secret`
+* - **Client Credentials**: Requires `client_id` + `client_secret`, a federated token file, or `authMethod: "managed_identity"`
 * - **Server-Only**: Only `jwks_uri` (and optionally `issuer`) for token validation
 *
 * The developer uses the same API regardless of mode - the library handles the details.
@@ -3791,6 +3821,17 @@ type SecretTypeDescriptor<T = unknown> = Readonly<{
 	toRegistryEntry(): SecretTypeRegistryEntry;
 }>;
 type SecretFormat = "jsonc" | "env" | "text" | "binary" | "yaml" | "toml" | "xml";
+/** How a vault-compatible source reads a secret: direct HTTP, the shared websocket, or LFV delivery. */
+type SecretsTransport = "http" | "websocket" | "lfv";
+/**
+* Log-safe locator of a secrets backend. Carries only the read transport and the server URL (with
+* userinfo, query, and fragment removed) — never tokens, client secrets, or trust material. Config
+* sources built over a client copy it into `ConfigSource.origin`.
+*/
+type SecretsSourceOrigin = {
+	transport?: SecretsTransport;
+	url?: string;
+};
 /**
 * Self-describing content metadata persisted with a secret. `typeId` identifies an authoring preset;
 * decoding never depends on the preset registry because the resolved format/mime/schema travel with
@@ -3869,6 +3910,8 @@ type SecretsSubscriptionOptions = SecretsOperationOptions & {
 };
 type SecretsSource = ReactiveHandle & ModuleReadiness & {
 	type: SecretsSourceType;
+	/** Optional log-safe backend locator. Built-in sources set it; it must never carry credentials. */
+	origin?: SecretsSourceOrigin;
 	/** Creates a lazy, Bun.file-style handle. No I/O occurs until an accessor is awaited. */
 	get(path: string, options?: SecretsOperationOptions): SecretHandle;
 	getFullSecret: <T>(path: string, options?: SecretsOperationOptions) => Promise<Secret<T>>;
@@ -4955,6 +4998,11 @@ type RemoteTmConfig = {
 	ionite: TmIoniteConfig;
 	consentTtlSeconds?: number;
 	maxRedeemAttempts?: number;
+	/**
+	* Lifetime, in seconds, of an App-minted `action_required` request token. Minimum 60; omitted
+	* means {@link DEFAULT_REQUEST_TOKEN_TTL_SECONDS} (one hour). ConfigSource-only.
+	*/
+	requestTokenTtlSeconds?: number;
 };
 type RecordTenantConsentInput = {
 	handle: string;
@@ -4962,12 +5010,28 @@ type RecordTenantConsentInput = {
 	decision: "consented" | "declined";
 	decidedBy?: string;
 };
+type ActionRequiredPlan = {
+	requestToken: string;
+	actionUrl: string;
+	expiresAt: string;
+};
+type ActionRequiredInput = {
+	/** App-owned completion path, for example `/onboard`. */
+	path: string;
+	/** Public origin the browser uses to open the action URL. */
+	origin: string;
+};
 type TenantManagement<TTenant extends BaseTenant = BaseTenant> = ModuleReadiness & {
 	/** Secret-free, JSON-serializable configuration and readiness summary. */
 	describe(): TmDescription;
 	handler(request: Request): Promise<Response>;
 	getTenant(id: string): Promise<TTenant | undefined>;
 	recordConsent(input: RecordTenantConsentInput): Promise<TTenant>;
+	/**
+	* Mint the `action_required` fields TM requires: a request token, a browser action URL, and an
+	* expiry. The lifetime comes from `RemoteConfig.tm.requestTokenTtlSeconds` (default one hour).
+	*/
+	actionRequired(input: ActionRequiredInput): ActionRequiredPlan;
 };
 /**
 * A single-flight cache of per-tenant {@link Ionite} instances, supplied by the app.
@@ -5430,18 +5494,21 @@ type SubjectScope = SubjectType | SubjectType[] | "any";
 * A granted "root" relationship between a principal and a catalog target. Roots are the source of
 * truth in the AccessAssignmentStore; the AccessIndex is materialized from roots + the catalog.
 */
-type AccessChange<
+/**
+* App-facing input to {@link Authz.grant} and {@link Authz.revoke}. Named so a request body can be
+* declared once (`satisfies GrantRequest`) and reused. The durable record is {@link AccessChange},
+* which adds the store-assigned `id`.
+*/
+type GrantRequest<
 	TUser = BaseUser,
 	TGroup = Group2,
 	TRole = Role2,
 	TPermission = Permission
 > = {
-	/** Deterministic id derived from `subjectType:subject:targetType:target[:scope]`; assigned by stores/orchestration. */
-	id?: string;
 	subject: AccessRef<TUser>;
 	/** The principal kind this grant is for. Required; never inferred or defaulted. */
 	subjectType: SubjectType;
-	targetType: OaaAccessTargetType;
+	targetType: EntitlementType;
 	target: AccessRef<TGroup | TRole | TPermission>;
 	/** Specific resource ids this grant is scoped to (maps to OAA assignment `resources`). */
 	resources?: string[];
@@ -5453,6 +5520,33 @@ type AccessChange<
 	status?: AccessStatus;
 	metadata?: Record<string, unknown>;
 };
+type AccessChange<
+	TUser = BaseUser,
+	TGroup = Group2,
+	TRole = Role2,
+	TPermission = Permission
+> = GrantRequest<TUser, TGroup, TRole, TPermission> & {
+	/** Deterministic id derived from `subjectType:subject:targetType:target[:scope]`; assigned by stores/orchestration. */
+	id?: string;
+};
+/** One grant or revoke submitted through {@link Authz.requestAccess}. */
+type AccessRequestInput = {
+	subject: GrantRequest["subject"];
+	subjectType: SubjectType;
+	targetType: EntitlementType;
+	target: GrantRequest["target"];
+	operation: "grant" | "revoke";
+	justification?: string;
+	/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
+	provider?: string;
+};
+/** Lookup for {@link Authz.getAccessRequest}. */
+type AccessRequestLookup = {
+	id: string;
+	subjectType: SubjectType;
+	/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
+	provider?: string;
+};
 /**
 * Granted access **roots** — the durable source of truth for direct assignments
 * (`subject → group | role | permission`). Each root is one explicit grant (for example
@@ -5786,44 +5880,20 @@ type Authz = {
 	* index. IAM SCIM ingress does **not** use this path (it stays policy-exempt). Throws
 	* {@link AssignmentPolicyError} when Ops forbids in-app assignment for the principal kind.
 	*/
-	grant(change: AccessChange): Promise<AccessChange>;
+	grant(change: GrantRequest): Promise<AccessChange>;
 	/**
 	* Submit one grant or revoke request on a principal's behalf. Under `'iam-request'`, targets the
 	* IAM destination; under `'idp'`, targets the claims-bearing SSO/CIAM provider. One operation
 	* maps to one approval decision, status, and tracking URL.
 	*/
-	requestAccess(change: {
-		subject: AccessChange["subject"];
-		subjectType: SubjectType;
-		targetType: EntitlementType;
-		target: AccessChange["target"];
-		operation: "grant" | "revoke";
-		justification?: string;
-		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
-		provider?: string;
-	}): Promise<{
-		id: string;
-		status: "pending" | "approved" | "denied";
-		operation: "grant" | "revoke";
-		trackingUrl: string;
-	}>;
+	requestAccess(change: AccessRequestInput): Promise<AccessRequestResult>;
 	/** Read the destination-owned state of an on-behalf access request. */
-	getAccessRequest(input: {
-		id: string;
-		subjectType: SubjectType;
-		/** CIAM provider key. Required only when multiple providers expose an AccessRequests channel. */
-		provider?: string;
-	}): Promise<{
-		id: string;
-		status: "pending" | "approved" | "denied";
-		operation: "grant" | "revoke";
-		trackingUrl: string;
-	}>;
+	getAccessRequest(input: AccessRequestLookup): Promise<AccessRequestResult>;
 	/**
 	* App-facing revoke of a granted root. Does not re-check assignment policy (removing access is
 	* always allowed from the app once the root exists).
 	*/
-	revoke(change: AccessChange): Promise<void>;
+	revoke(change: GrantRequest): Promise<void>;
 };
 /**
 * Ops-owned assignment policy for one principal kind (`RemoteConfig.iam.{users,workloads,customers}.assignment`).
@@ -6265,10 +6335,69 @@ declare function exchangeAuthorizationCode(options: ExchangeCodeOptions): Promis
 * so `https://idp/realm` and `https://idp/realm/` compare equal.
 */
 declare function normalizeOidcIssuer(iss: string): string;
+/**
+* Microsoft Entra ID issues TENANT-SCOPED issuers even when the app is configured
+* against a `/common` (or `/organizations`, `/consumers`) authority: the ID token's
+* `iss` is always `https://login.microsoftonline.com/{tid}/v2.0`, where `{tid}` is
+* the GUID of the home tenant that authenticated the user. Personal Microsoft
+* accounts (MSA) use the fixed consumers tenant GUID below.
+*
+* So for a multi-tenant or consumer app there is no single `authority` string that
+* can be compared with strict equality — hence {@link matchesMicrosoftIssuer},
+* which validates the issuer's SHAPE and then constrains the `tid` against an
+* operator allowlist. Single-tenant apps should keep an exact `authority` (e.g.
+* `https://login.microsoftonline.com/{their-tid}/v2.0`), which still takes the
+* strict-equality path.
+*/
+declare const MICROSOFT_CONSUMERS_TENANT_ID = "9188040d-6c67-4c5b-b112-36a304b66dad";
+/**
+* Operator constraint on which Entra tenants may sign in, from RemoteConfig
+* (`allowedTenants`). `'any'` accepts any work/school tenant AND personal accounts;
+* `'consumers'` accepts only personal Microsoft accounts; an array accepts only the
+* listed tenant GUIDs (the literal `'consumers'` may appear in the array as an alias
+* for the MSA tenant). Omitted defaults to `'any'`, matching what a `/common`
+* authority already means at the authorization endpoint.
+*/
+type MicrosoftAllowedTenants = "any" | "consumers" | string[];
+/** True when `authority` is a Microsoft multi-tenant/consumer authority (`/common` et al). */
+declare function isMicrosoftMultiTenantAuthority(authority: string): boolean;
+/** Extract the tenant GUID from a well-formed Entra v2 issuer, or undefined. */
+declare function microsoftIssuerTenantId(iss: string): string | undefined;
+/**
+* Validate a Microsoft Entra ID token issuer for a multi-tenant/consumer app.
+*
+* Fails closed in two stages: the issuer must match the exact Entra v2 issuer shape
+* (so an attacker-controlled host can never satisfy it), and the embedded tenant GUID
+* must be permitted by `allowedTenants`. When the token also carries a `tid` claim it
+* MUST agree with the tenant in `iss` — Entra always sets both, and a disagreement
+* means the token was not minted by the tenant it claims.
+*/
+declare function matchesMicrosoftIssuer(options: {
+	iss: string;
+	/** The `tid` claim, when present — cross-checked against the issuer's tenant. */
+	tid?: unknown;
+	allowedTenants?: MicrosoftAllowedTenants;
+}): boolean;
+/**
+* How the `iss` claim is validated. `exact` (the default) requires `iss` to equal
+* the configured issuer after normalization — the correct behaviour for every
+* provider with a fixed issuer. `microsoft-tenant` additionally accepts a
+* tenant-scoped Entra issuer (`https://login.microsoftonline.com/{tid}/v2.0`)
+* constrained by `allowedTenants`, which is the only way a `/common` authority can
+* verify at all (see {@link matchesMicrosoftIssuer}).
+*/
+type IdTokenIssuerPolicy = {
+	mode: "exact";
+} | {
+	mode: "microsoft-tenant";
+	allowedTenants?: MicrosoftAllowedTenants;
+};
 type AssertTrustedIdTokenClaimsOptions = {
 	claims: Record<string, unknown>;
 	/** Expected issuer (provider `authority`). Required. */
 	issuer: string;
+	/** Issuer-matching policy. Defaults to strict equality. */
+	issuerPolicy?: IdTokenIssuerPolicy;
 	/** Expected audience (provider `clientId`). Required. */
 	audience: string;
 	/** Current time in epoch seconds (defaults to now). */
@@ -6297,6 +6426,8 @@ type VerifyIdTokenOptions = {
 	jwksUri: string;
 	/** Expected issuer (provider `authority`). Required; a mismatch throws. */
 	issuer: string;
+	/** Issuer-matching policy. Defaults to strict equality. */
+	issuerPolicy?: IdTokenIssuerPolicy;
 	/** Expected audience (provider `clientId`). Required; a mismatch throws. */
 	audience: string;
 	/** Clock-skew allowance for `exp` in seconds (default 60). */
@@ -6477,4 +6608,4 @@ type TenantAccessLoginUrlOptions = {
 	tenantIonBasePath?: (tenantId: string) => string;
 };
 declare function tenantAccessLoginUrl(tenantId: string, options: TenantAccessLoginUrlOptions): string;
-export { AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, CreateGroupOptions, CreateUserOptions, DeriveClaimsInput, DerivedEntitlement, DiscoveredTenantCookie, DisplayCookieAttributes, DisplayCookieCandidate, DisplayCookieTrim, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, InMemoryTenantStore, JWKS, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, SigningKey, SigningKeyRing, StateCookie, StaticSigningKeyRingDocument, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, decodeUnverifiedJwtPayload, defaultRedirectPolicies, deriveClaimsEntitlements, derivedEntitlementsFor, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, formatDisplayClearCookie, formatDisplaySetCookie, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getOwnedTenantIds, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isRedirectAllowed, listSsoClientIdsFromCookies, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, planDiscoveredTenantCookies, planDisplayCookieClear, planDisplayCookieHeaders, reconcileSubjectAccess, rememberDerivedEntitlements, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveTenantOwner, resolveTenantSession, resolveUser, sameOriginRedirectRules, selectDisplayCookies, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signCompactJwt, signLfvPayload, sso, staticSigningKeyRing, stringifyLfvJwks, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, verifyCompactJwt, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };
+export { AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, CreateGroupOptions, CreateUserOptions, DeriveClaimsInput, DerivedEntitlement, DiscoveredTenantCookie, DisplayCookieAttributes, DisplayCookieCandidate, DisplayCookieTrim, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, IdTokenIssuerPolicy, InMemoryTenantStore, JWKS, MICROSOFT_CONSUMERS_TENANT_ID, MicrosoftAllowedTenants, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, SigningKey, SigningKeyRing, StateCookie, StaticSigningKeyRingDocument, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, decodeUnverifiedJwtPayload, defaultRedirectPolicies, deriveClaimsEntitlements, derivedEntitlementsFor, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, formatDisplayClearCookie, formatDisplaySetCookie, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getOwnedTenantIds, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isMicrosoftMultiTenantAuthority, isRedirectAllowed, listSsoClientIdsFromCookies, matchesMicrosoftIssuer, microsoftIssuerTenantId, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, planDiscoveredTenantCookies, planDisplayCookieClear, planDisplayCookieHeaders, reconcileSubjectAccess, rememberDerivedEntitlements, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveTenantOwner, resolveTenantSession, resolveUser, sameOriginRedirectRules, selectDisplayCookies, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signCompactJwt, signLfvPayload, sso, staticSigningKeyRing, stringifyLfvJwks, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, verifyCompactJwt, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };