@ionite/core 0.0.24-beta.20261008.26 → 0.0.24-beta.20261010.28

package/dist/index.d.ts

@@ -1398,6 +1398,12 @@ interface UserStore<TExtended = object> {
 	*/
 	getByExternalId?(externalId: string): Promise<BaseUser<TExtended> | undefined>;
 	/**
+	* Optional case-insensitive secondary-index lookup by `userName` (RFC 7643 `caseExact: false`), used
+	* to answer SCIM `userName eq` filters. Implementations that omit it remain correct; callers fall
+	* back to paged `list()` scans. Unlike `lookup`, it never participates in SSO login resolution.
+	*/
+	getByUserName?(userName: string): Promise<BaseUser<TExtended> | undefined>;
+	/**
 	* Retrieve a user based on their SCIM attributes or SSO JWT Claims.
 	*
 	* @param user - The user to lookup by SCIM attributes or SSO JWT Claims
@@ -1808,6 +1814,42 @@ declare function compareDisplayExpiryDesc(a: string | undefined, b: string | und
 declare function profileCookieName(cookiesPrefix: string): string;
 declare function discoveredProfileCookieName(tenantId: string): string;
 import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
+type ScimPatchOperation = {
+	op: string;
+	path?: string;
+	value?: unknown;
+};
+type ScimPatchErrorType = "invalidPath" | "invalidFilter" | "noTarget" | "invalidValue" | "invalidSyntax";
+/** Built-in inbound SCIM provider types. `scim` is a strictly conformant client (no normalization). */
+type IAMProviderType = "scim" | "entra" | "okta" | "sailpoint";
+/** A single inbound SCIM provider declaration (ConfigSource-only). */
+type IAMProviderConfig = {
+	/** Provider adapter type. Selects the request normalizer. */
+	type: IAMProviderType;
+	/** Whether this entry is active. Defaults to true when omitted. */
+	enabled?: boolean;
+	/**
+	* Workload client ids whose inbound SCIM calls this entry covers, compared against the validated
+	* token's `client_id`, then `azp`, then `sub` (the SDK's canonical workload id order).
+	*/
+	clientIds: string[];
+	/** Optional display metadata for operator UIs. */
+	branding?: {
+		displayName: string;
+		iconUrl?: string;
+	};
+};
+/**
+* The name Entra uses for the ion User extension. Entra's SCIM client sends a custom extension in create
+* POSTs only when it is named `urn:ietf:params:scim:schemas:extension:<Name>:2.0:User`; it omits
+* `ION_SCIM_USER_EXTENSION_URN` from creates and sends it only on later PATCHes, so an Entra-provisioned
+* account would arrive without its ECID until the next sync. Measured in the iosite sandbox. Map Entra
+* attributes to this name; the `entra` preset translates it to the canonical URN inbound and back on
+* responses, so Entra's GET-based drift check compares like with like. Entra-only: `urn:ietf:params:scim:`
+* is IANA-managed (RFC 7643 §10) and not part of the general contract.
+* https://learn.microsoft.com/entra/identity/app-provisioning/customize-application-attributes
+*/
+declare const ENTRA_ION_EXTENSION_URN = "urn:ietf:params:scim:schemas:extension:ionite:2.0:User";
 type ChangeListener = () => void;
 /**
 * Reactive source/adapter contract. Implemented by config-source-backed adapters
@@ -2841,6 +2883,12 @@ type IAMConfig = {
 	* token is used. Module-wide; per-kind enablement lives on `users`/`workloads`/`customers`.
 	*/
 	deltaAudience?: string;
+	/**
+	* RemoteConfig-only: inbound SCIM provider entries keyed by name, like `ciam.providers`. An entry
+	* selects a vendor preset (see `iam-providers.ts`) for the workload clients it lists; callers it
+	* does not list are handled as strictly conformant SCIM clients.
+	*/
+	providers?: Record<string, IAMProviderConfig>;
 };
 /**
 * Per-endpoint enablement flag carried in RemoteConfig (Ops/ECI intent).
@@ -4892,7 +4940,7 @@ type FrameworkConfig = {
 * enablement) are also stripped from code.
 */
 type SSOConfigFromCode = Omit<SSOConfig, "loginUrl" | "userUrl" | "logoutUrl" | "logoutBackChannelUrl" | "refreshUrl" | "redirectUri" | "claimsAsEntitlements" | "accessRequests">;
-type IAMConfigFromCode = Omit<IAMConfig, "usersUrl" | "groupsUrl" | "workloadsUrl" | "customersUrl" | "users" | "workloads" | "customers" | "groups" | "discovery" | "deltaAudience"> & {
+type IAMConfigFromCode = Omit<IAMConfig, "usersUrl" | "groupsUrl" | "workloadsUrl" | "customersUrl" | "users" | "workloads" | "customers" | "groups" | "discovery" | "deltaAudience" | "providers"> & {
 	discovery?: Omit<IAMDiscoveryConfig, "basePath">;
 };
 type WorkloadServerConfigFromCode = Omit<Partial<WorkloadConfig>, "tokenUrl" | "validateUrl" | "jwksUrl" | "refreshUrl" | "claimsAsEntitlements">;
@@ -7186,4 +7234,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{Y,Le,l,I,v,x,i,r,X,N,u,$e,Z,g,e,y,E,Q,Ee,Pe,Ke,Ue,L,K,T,q,ee,W,n,m,We,V,Ve,ze,Be,ne,re,z,se,fe,ge,f,B,_e,G,U,_,F,Oe,O,De,Ge,Fe,D,ye,he,Se,ke,be,Ce,Te,we,Re,Ae,ie,Je,ae,ce,h,o,He,M,Ie,ve,a,ue,Ye,Xe,s,w,S,Ze,Qe,Me,J,c,p,t,de,et,je,tt,R,k,nt,rt,H,st,A,j,xe,ot,d,b,C,at,ct,le,pe}from"./shared/core-jcvkk7kx.js";var Nt="0.0.24-beta.20261008.26";class Ct extends r{constructor(P,te){let oe=te.kind==="connection"||te.kind==="timeout"||te.kind==="not_found";super(P,{cause:te.cause,status:oe?503:500,upstreamStatus:te.status});this.name="ConfigSourceError";this.kind=te.kind,this.recoverable=te.recoverable,this.code=te.code,this.path=te.path,this.sourceType=te.sourceType}}function $t(P){return P instanceof Ct}function Ut(P){let te=P?.trim();if(!te)return;try{let oe=new URL(te),me=oe.pathname.replace(/\/+$/g,"");return`${oe.protocol}//${oe.host}${me}`}catch{return}}function Et(P,te="ion.config.source"){if(!P)return{};let oe={[`${te}.type`]:P.type};if(P.transport)oe[`${te}.transport`]=P.transport;if(P.url)oe[`${te}.url`]=P.url;if(P.path)oe[`${te}.path`]=P.path;if(P.from)Object.assign(oe,Et(P.from,`${te}.from`));return oe}var Wt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function At(P){if(P===null||typeof P!=="object")return P;let te={};for(let[oe,me]of Object.entries(P)){if(Wt.includes(oe)||oe==="validators"||oe==="setStores")continue;te[oe]=me!==null&&typeof me==="object"&&!Array.isArray(me)&&Object.getPrototypeOf(me)===Object.prototype?At(me):me}return te}function Ft(P){return At(P)}function St(P,te){if(!P||typeof P!=="object"||Array.isArray(P))throw Error(`${te} must be an object.`);return P}function dt(P,te){if(P===void 0)return;if(typeof P!=="string"||P.length===0||!Number.isFinite(Date.parse(P)))throw Error(`${te} must be a valid timestamp string.`);return P}function ht(P,te,oe){if(!Array.isArray(P)||!oe.allowEmpty&&P.length===0)throw Error(`${te} keys must be ${oe.allowEmpty?"an":"a non-empty"} array.`);let me=new Set;return P.map((qe,Ne)=>{let it=St(qe,`${te} keys[${Ne}]`);if(typeof it.id!=="string"||it.id.length===0)throw Error(`${te} keys[${Ne}].id must be a non-empty string.`);if(me.has(it.id))throw Error(`${te} contains duplicate key id "${it.id}".`);if(me.add(it.id),!["pending","active","deprecated","rotated","revoked"].includes(String(it.state)))throw Error(`${te} keys[${Ne}].state is invalid.`);if(it.value!==void 0&&(typeof it.value!=="string"||it.value.length===0))throw Error(`${te} keys[${Ne}].value must be a non-empty string when present.`);let mt=it.meta===void 0?void 0:St(it.meta,`${te} keys[${Ne}].meta`);return{id:it.id,state:it.state,...it.value===void 0?{}:{value:it.value},...it.notBefore===void 0?{}:{notBefore:dt(it.notBefore,`${te} keys[${Ne}].notBefore`)},...it.notAfter===void 0?{}:{notAfter:dt(it.notAfter,`${te} keys[${Ne}].notAfter`)},...it.createdAt===void 0?{}:{createdAt:dt(it.createdAt,`${te} keys[${Ne}].createdAt`)},...it.activatedAt===void 0?{}:{activatedAt:dt(it.activatedAt,`${te} keys[${Ne}].activatedAt`)},...it.deprecatedAt===void 0?{}:{deprecatedAt:dt(it.deprecatedAt,`${te} keys[${Ne}].deprecatedAt`)},...it.rotatedAt===void 0?{}:{rotatedAt:dt(it.rotatedAt,`${te} keys[${Ne}].rotatedAt`)},...it.revokedAt===void 0?{}:{revokedAt:dt(it.revokedAt,`${te} keys[${Ne}].revokedAt`)},...mt?{meta:{...mt}}:{}}})}function qt(P,te,oe){if(P===void 0)return;if(!Array.isArray(P))throw Error(`${oe} slots must be an array.`);let me=new Set,qe=P.map((Ne,it)=>{if(Ne===null)return null;if(typeof Ne!=="string"||Ne.length===0)throw Error(`${oe} slots[${it}] must be a non-empty key id or null.`);if(me.has(Ne))throw Error(`${oe} slots contain duplicate key id "${Ne}".`);me.add(Ne);let mt=te.find((pt)=>pt.id===Ne);if(!mt)throw Error(`${oe} slot key "${Ne}" is not present in keys.`);if(mt.state!=="active")throw Error(`${oe} slot key "${Ne}" must have state "active".`);if(!mt.value)throw Error(`${oe} slot key "${Ne}" must include a value.`);return Ne});if(te.length===0&&qe.some((Ne)=>Ne!==null))throw Error(`${oe} slots must be omitted or all-null when keys is empty.`);return qe}function Vt(P){let oe=St(P,"KMS pool");if(oe.kind!=="kms")throw Error('KMS pool kind must be "kms".');let me=ht(oe.keys,"KMS pool",{allowEmpty:!0}),qe=qt(oe.slots,me,"KMS pool");return qe?{kind:"kms",slots:qe,keys:me}:{kind:"kms",keys:me}}function zt(P){let oe=St(P,"KMS pool control document");if(oe.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:ht(oe.keys,"KMS pool control document",{allowEmpty:!0})}}var jt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function bt(P){if(typeof P==="string")return P;try{return JSON.stringify(P)??String(P)}catch{return String(P)}}function gt(P){let te=bt(P);return/^[A-Za-z0-9_./:@+|-]+$/.test(te)?te:JSON.stringify(te)}function Bt(P){return bt(P).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function It(P,te,oe){if(oe==null)return;if(oe instanceof Error){let me=X(oe);if(me){for(let[qe,Ne]of Object.entries(me))if(Ne!=null)P.push(`${qe}=${gt(Ne)}`);return}if(P.push(`${te}.name=${gt(oe.name)}`),P.push(`${te}.message=${gt(oe.message)}`),oe.stack)P.push(`${te}.stack=${gt(oe.stack)}`);return}P.push(`${te}=${gt(oe)}`)}function ft(P,te,oe=[],me=new Date){let qe=Bt(te instanceof Error?te.message:te??""),Ne=[];for(let[it,mt]of oe.entries()){if(mt&&typeof mt==="object"&&!Array.isArray(mt)&&!(mt instanceof Error)&&Object.getPrototypeOf(mt)===Object.prototype){for(let[pt,lt]of Object.entries(mt))It(Ne,pt,lt);continue}It(Ne,`param.${it}`,mt)}return[me.toISOString(),jt[P],qe,...Ne].filter(Boolean).join(" ")}var xt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Gt=xt,Ht={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Yt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Jt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Xt={trace:()=>{},debug:(P,...te)=>globalThis.console.debug(ft("debug",P,te)),info:(P,...te)=>globalThis.console.info(ft("info",P,te)),warn:(P,...te)=>globalThis.console.warn(ft("warn",P,te)),error:(P,...te)=>globalThis.console.error(ft("error",P,te))};function Zt(P,te){if(typeof te!=="number"||te<=0)return P;return new Promise((oe,me)=>{let qe=setTimeout(()=>{me(Error(`Authz catalog entry did not become ready within ${te}ms`))},te);P.then(()=>{clearTimeout(qe),oe()},(Ne)=>{clearTimeout(qe),me(Ne)})})}function Qt(P,te){let oe=!1,me,qe=te.then(()=>{oe=!0},(it)=>{oe=!1,me=it}),Ne=P;return Object.defineProperty(Ne,"ready",{enumerable:!1,configurable:!0,value:(it)=>Zt(qe.then(()=>{if(!oe)throw me}),it)}),Object.defineProperty(Ne,"isReady",{enumerable:!1,configurable:!0,value:()=>oe}),Ne}var kt=Object.freeze({jsonc:o,env:"text/x-dotenv",text:"text/plain",binary:ve,yaml:"application/yaml",toml:"application/toml",xml:Ie});function Rt(P){if(!P.id.trim())throw Error("defineSecretType: id is required");let te=P.mimeType?.trim()||kt[P.format],oe=Object.freeze({id:P.id,...P.label?{label:P.label}:{},format:P.format,mimeType:te,...P.schemaUrl?{schemaUrl:P.schemaUrl}:{},typeId:P.id});return Object.freeze({id:P.id,...P.label?{label:P.label}:{},format:P.format,mimeType:te,...P.schemaUrl?{schemaUrl:P.schemaUrl}:{},...P.schema?{schema:P.schema}:{},toRegistryEntry:()=>oe})}function eo(P="jsonc"){return{format:P,mimeType:kt[P],typeId:P}}class Pt extends r{constructor(P,te){super(`Secret content type mismatch: expected "${P.mimeType}" (${P.format}) but received "${te.mimeType}" (${te.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=P,this.received=te}}var to=Rt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var _t={beforeTenantSegments:["ui"]},vt={beforeTenantSegments:["api"]};function Ot(P){return(P??[]).map((te)=>te.trim()).filter(Boolean)}function wt(P){let te=P.trim();if(!te)return"/";let oe=te.replace(/\\/g,"/").replace(/\/+/g,"/");return oe.startsWith("/")?oe:`/${oe}`}function Kt(P){return wt(P).split("/").filter(Boolean)}function yt(P){return{beforeTenantSegments:Ot(P?.beforeTenantSegments),afterTenantSegments:Ot(P?.afterTenantSegments)}}function Dt(P){if(P?.type==="host")return{type:"host",baseDomain:Tt(P.baseDomain)};if(P?.type==="selector")return P;return{type:"path",ui:yt(P?.ui??_t),api:yt(P?.api??vt)}}function Tt(P){let te=P.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!te)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return te}function oo(P,te){let oe=P.trim().replace(/\.$/,"").toLowerCase(),me=Tt(te);if(!oe.endsWith(`.${me}`))return null;let qe=oe.slice(0,-(me.length+1));if(!qe||qe.includes("."))return null;return{id:qe}}function ro(P,te){let oe=yt(te),me=oe.beforeTenantSegments??[],qe=oe.afterTenantSegments??[],Ne=Kt(P),it=me.length+1+qe.length;if(Ne.length<it)return null;for(let ut=0;ut<me.length;ut++)if(Ne[ut]!==me[ut])return null;let mt=me.length,pt=Ne[mt];if(!pt)return null;for(let ut=0;ut<qe.length;ut++)if(Ne[mt+1+ut]!==qe[ut])return null;let lt=Ne.slice(mt+1+qe.length);return{id:decodeURIComponent(pt),restSegments:lt,restPath:lt.length>0?`/${lt.join("/")}`:"/"}}function Mt(P,te="/",oe){let me=yt(oe),qe=me.beforeTenantSegments??[],Ne=me.afterTenantSegments??[],it=Kt(te),mt=[...qe,encodeURIComponent(P),...Ne,...it];return mt.length>0?`/${mt.join("/")}`:"/"}function no(P,te="/",oe,me="ui"){let qe=Dt(oe);if(qe.type==="host"||qe.type==="selector")return wt(te);return Mt(P,te,qe[me])}function so(P){return{"~standard":{version:1,vendor:P,validate:(te)=>{if(typeof te!=="object"||te===null)return{issues:[{message:"Expected an object"}]};let oe=te,me=[],qe={...oe},Ne=["iss","sub"];for(let pt of Ne)if(pt in oe){if(typeof oe[pt]!=="string")me.push({message:`${pt} must be a string`,path:[pt]})}else me.push({message:`${pt} is required`,path:[pt]});if("aud"in oe&&oe.aud!==void 0){let pt=oe.aud;if(typeof pt!=="string"&&!Array.isArray(pt))me.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(pt)&&!pt.every((lt)=>typeof lt==="string"))me.push({message:"aud array must contain only strings",path:["aud"]})}let it=["jti","scope"];for(let pt of it)if(pt in oe&&oe[pt]!==void 0){if(typeof oe[pt]!=="string")me.push({message:`${pt} must be a string`,path:[pt]})}let mt=["exp","iat"];for(let pt of mt)if(pt in oe){if(typeof oe[pt]!=="number")me.push({message:`${pt} must be a number`,path:[pt]})}else me.push({message:`${pt} is required`,path:[pt]});if(me.length>0)return{issues:me};return{value:qe}}}}}function io(P){return{"~standard":{version:1,vendor:P,validate:(te)=>{if(typeof te!=="object"||te===null)return{issues:[{message:"Expected an object"}]};let oe=te,me=[],qe={};if("access_token"in oe)if(typeof oe.access_token==="string")qe.access_token=oe.access_token;else me.push({message:"access_token must be a string",path:["access_token"]});else me.push({message:"access_token is required",path:["access_token"]});if("token_type"in oe)if(typeof oe.token_type==="string")qe.token_type=oe.token_type;else me.push({message:"token_type must be a string",path:["token_type"]});else me.push({message:"token_type is required",path:["token_type"]});if("scope"in oe)if(typeof oe.scope==="string"||oe.scope===void 0)qe.scope=oe.scope;else me.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in oe)if(typeof oe.refresh_token==="string"||oe.refresh_token===void 0)qe.refresh_token=oe.refresh_token;else me.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in oe)if(typeof oe.expires==="string"||oe.expires===void 0)qe.expires=oe.expires;else me.push({message:"expires must be a string",path:["expires"]});if("expires_in"in oe)if(typeof oe.expires_in==="number"||oe.expires_in===void 0)qe.expires_in=oe.expires_in;else me.push({message:"expires_in must be a number",path:["expires_in"]});if(me.length>0)return{issues:me};return{value:qe}}}}}function ao(P){let te=new Uint8Array(P);return crypto.getRandomValues(te),te}function po(P){let te="",oe=ao(P);for(let me=0;me<P;me++){let qe=oe[me]%32;te+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(qe)}return te}function co(P,te){let oe="";for(let me=te;me>0;me--){let qe=P%32;oe="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(qe)+oe,P=Math.floor(P/32)}return oe}function mo(P){let te=Date.now(),oe=co(te,10),me=po(16);return`${P??""}${oe}${me}`}export{a as ACCEPT_JSON,Xe as ACCEPT_OCTET_STREAM,ue as ACCEPT_SCIM,Ye as ACCEPT_XML,Ee as AssignmentPolicyError,Z as CANONICAL_RISK_LEVELS,S as CONTENT_TYPE_FORM,s as CONTENT_TYPE_JSON,Qe as CONTENT_TYPE_OCTET_STREAM,w as CONTENT_TYPE_SCIM,Ze as CONTENT_TYPE_XML,Ct as ConfigSourceError,ze as DEFAULT_DISCOVERED_COOKIE_MAX,Be as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Ve as DEFAULT_DISPLAY_COOKIE_MAX,g as DEFAULT_RISK_LEVEL,kt as DEFAULT_SECRET_MIME_TYPES,vt as DEFAULT_TENANT_API_NAMESPACE,_t as DEFAULT_TENANT_UI_NAMESPACE,ne as DISCOVERED_COOKIE_PREFIX,We as DISPLAY_COOKIE_SUFFIX,V as DISPLAY_COOKIE_VERSION,Oe as ECID_SCHEME,O as EcidFormatError,M as FORM_MEDIA_TYPE,e as ION_AUTHZ_GROUP_SCHEMA,Re as ION_AUTHZ_OAA_SYNC,Te as ION_CAPABILITIEZ_READ,we as ION_CIAM_MAGIC_LINK_CREATE,Je as ION_ENDPOINT_PERMISSIONS,Ce as ION_IAM_ACCESS_REQUESTS_WRITE,be as ION_IAM_CUSTOMERS_WRITE,Se as ION_IAM_GROUPS_WRITE,ye as ION_IAM_READ,he as ION_IAM_USERS_WRITE,ke as ION_IAM_WORKLOADS_WRITE,C as ION_SCIM_CUSTOMER_SCHEMA,d as ION_SCIM_USER_EXTENSION_URN,b as ION_SCIM_WORKLOAD_SCHEMA,ie as ION_SDK_PERMISSIONS,Ae as ION_TENANT_MANAGE,r as IoniteError,o as JSON_MEDIA_TYPE,v as KNOWN_BASE_CUSTOMER_KEYS,I as KNOWN_BASE_USER_KEYS,l as KNOWN_ENTITLEMENT_KEYS,x as KNOWN_WORKLOAD_KEYS,ve as OCTET_STREAM_MEDIA_TYPE,y as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,He as SCIM_MEDIA_TYPE,Pt as SecretContentTypeMismatchError,A as StoreConflictError,Ie as XML_MEDIA_TYPE,n as accessRefId,m as accessRootId,D as assertEcid,Q as assertRequiredSubjectType,E as assertValidSubjectTypeScoping,Mt as buildTenantPath,no as buildTenantUrl,K as catalogEntityStore,H as claimsToUser,U as compareDisplayExpiryDesc,Et as configSourceOriginLogFields,Le as configTrustedClientGrants,i as customAttributes,pe as customerResourceSchema,Ht as debugLogger,_e as decodeDisplayCookie,st as decodeUser,k as deepEqualPlain,fe as defaultDisplayUser,Gt as defaultLogger,eo as defaultSecretContentType,Ue as defineCatalog,Rt as defineSecretType,ee as deprecateRetiredCodeCatalogRows,Ut as describeOriginUrl,F as discoveredProfileCookieName,B as encodeDisplayCookie,X as errorLogAttributes,Ge as formatEcid,ft as formatLogLine,mo as generateULID,L as getCodeCatalogEntity,ct as groupResourceSchema,h as idTokenClaimsSchema,Yt as infoLogger,Pe as isCodeCatalog,xe as isConfigLocator,$t as isConfigSourceError,De as isEcid,Me as isJsonResponse,j as isStoreConflictError,so as jwtAssertionClaimsSchema,N as list,u as listGenerator,oo as matchTenantHost,ro as matchTenantPath,$e as matchesListFilter,q as materializeCodeCatalogEntity,T as mergeCodeCatalogEntity,et as mergeConfig,t as must,Tt as normalizeTenantBaseDomain,yt as normalizeTenantPathNamespace,Dt as normalizeTenantRoutingStrategy,ae as oidcCallbackSchema,Fe as parseEcid,tt as parseJsonc,zt as parseKmsPoolControlDocument,Vt as parseKmsPoolDocument,Xt as prettyLogger,_ as profileCookieName,f as projectDisplayUser,G as readDisplayCookies,c as readJsonResponse,Qt as readyCatalogEntry,to as remoteConfigSecretType,z as resolveDiscoveredCookieMax,se as resolveDiscoveredCookieTtlSeconds,re as resolveDisplayCookieMax,ge as sanitizeDisplayUser,Ft as serializeConfig,xt as silentLogger,nt as stableConfigHash,je as stripJsonComments,ot as tmIntegrationState,Ke as toCodeCatalog,ce as tokenResponseSchema,R as trimTrailingSlash,Y as trustedClientPermissionsForPrincipal,J as unexpectedBodySummary,W as unionCatalogRead,at as userSchema,de as validationFailureResponse,Nt as version,rt as waitOn,Jt as warnLogger,p as withValidate,le as workloadResourceSchema,io as workloadTokenResponseSchema};
+import{Q,Ve,p,v,x,E,c,n,ee,q,d,Be,te,y,t,h,P,ne,Me,je,Ge,Ne,K,z,w,W,re,V,r,f,He,B,Je,Ye,Xe,oe,ie,G,ae,Se,ke,g,F,Le,H,_,O,J,$e,D,qe,Ze,Qe,M,o,S,k,et,tt,de,le,j,Ce,we,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,pe,nt,me,fe,b,a,rt,N,_e,Oe,u,ge,st,ot,i,R,T,it,at,Ke,X,l,m,e,ye,ct,ze,ut,A,C,dt,lt,Z,pt,I,L,De,mt}from"./shared/core-xm7tmw7a.js";var $t="0.0.24-beta.20261010.28";class kt extends n{constructor(s,U){let Y=U.kind==="connection"||U.kind==="timeout"||U.kind==="not_found";super(s,{cause:U.cause,status:Y?503:500,upstreamStatus:U.status});this.name="ConfigSourceError";this.kind=U.kind,this.recoverable=U.recoverable,this.code=U.code,this.path=U.path,this.sourceType=U.sourceType}}function Ut(s){return s instanceof kt}function Wt(s){let U=s?.trim();if(!U)return;try{let Y=new URL(U),se=Y.pathname.replace(/\/+$/g,"");return`${Y.protocol}//${Y.host}${se}`}catch{return}}function At(s,U="ion.config.source"){if(!s)return{};let Y={[`${U}.type`]:s.type};if(s.transport)Y[`${U}.transport`]=s.transport;if(s.url)Y[`${U}.url`]=s.url;if(s.path)Y[`${U}.path`]=s.path;if(s.from)Object.assign(Y,At(s.from,`${U}.from`));return Y}var Ft=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function ht(s){if(s===null||typeof s!=="object")return s;let U={};for(let[Y,se]of Object.entries(s)){if(Ft.includes(Y)||Y==="validators"||Y==="setStores")continue;U[Y]=se!==null&&typeof se==="object"&&!Array.isArray(se)&&Object.getPrototypeOf(se)===Object.prototype?ht(se):se}return U}function qt(s){return ht(s)}function Ct(s,U){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${U} must be an object.`);return s}function gt(s,U){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${U} must be a valid timestamp string.`);return s}function It(s,U,Y){if(!Array.isArray(s)||!Y.allowEmpty&&s.length===0)throw Error(`${U} keys must be ${Y.allowEmpty?"an":"a non-empty"} array.`);let se=new Set;return s.map((ue,ce)=>{let Te=Ct(ue,`${U} keys[${ce}]`);if(typeof Te.id!=="string"||Te.id.length===0)throw Error(`${U} keys[${ce}].id must be a non-empty string.`);if(se.has(Te.id))throw Error(`${U} contains duplicate key id "${Te.id}".`);if(se.add(Te.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Te.state)))throw Error(`${U} keys[${ce}].state is invalid.`);if(Te.value!==void 0&&(typeof Te.value!=="string"||Te.value.length===0))throw Error(`${U} keys[${ce}].value must be a non-empty string when present.`);let be=Te.meta===void 0?void 0:Ct(Te.meta,`${U} keys[${ce}].meta`);return{id:Te.id,state:Te.state,...Te.value===void 0?{}:{value:Te.value},...Te.notBefore===void 0?{}:{notBefore:gt(Te.notBefore,`${U} keys[${ce}].notBefore`)},...Te.notAfter===void 0?{}:{notAfter:gt(Te.notAfter,`${U} keys[${ce}].notAfter`)},...Te.createdAt===void 0?{}:{createdAt:gt(Te.createdAt,`${U} keys[${ce}].createdAt`)},...Te.activatedAt===void 0?{}:{activatedAt:gt(Te.activatedAt,`${U} keys[${ce}].activatedAt`)},...Te.deprecatedAt===void 0?{}:{deprecatedAt:gt(Te.deprecatedAt,`${U} keys[${ce}].deprecatedAt`)},...Te.rotatedAt===void 0?{}:{rotatedAt:gt(Te.rotatedAt,`${U} keys[${ce}].rotatedAt`)},...Te.revokedAt===void 0?{}:{revokedAt:gt(Te.revokedAt,`${U} keys[${ce}].revokedAt`)},...be?{meta:{...be}}:{}}})}function Vt(s,U,Y){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${Y} slots must be an array.`);let se=new Set,ue=s.map((ce,Te)=>{if(ce===null)return null;if(typeof ce!=="string"||ce.length===0)throw Error(`${Y} slots[${Te}] must be a non-empty key id or null.`);if(se.has(ce))throw Error(`${Y} slots contain duplicate key id "${ce}".`);se.add(ce);let be=U.find((he)=>he.id===ce);if(!be)throw Error(`${Y} slot key "${ce}" is not present in keys.`);if(be.state!=="active")throw Error(`${Y} slot key "${ce}" must have state "active".`);if(!be.value)throw Error(`${Y} slot key "${ce}" must include a value.`);return ce});if(U.length===0&&ue.some((ce)=>ce!==null))throw Error(`${Y} slots must be omitted or all-null when keys is empty.`);return ue}function zt(s){let Y=Ct(s,"KMS pool");if(Y.kind!=="kms")throw Error('KMS pool kind must be "kms".');let se=It(Y.keys,"KMS pool",{allowEmpty:!0}),ue=Vt(Y.slots,se,"KMS pool");return ue?{kind:"kms",slots:ue,keys:se}:{kind:"kms",keys:se}}function jt(s){let Y=Ct(s,"KMS pool control document");if(Y.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:It(Y.keys,"KMS pool control document",{allowEmpty:!0})}}var Bt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function xt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function ft(s){let U=xt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(U)?U:JSON.stringify(U)}function Gt(s){return xt(s).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function bt(s,U,Y){if(Y==null)return;if(Y instanceof Error){let se=ee(Y);if(se){for(let[ue,ce]of Object.entries(se))if(ce!=null)s.push(`${ue}=${ft(ce)}`);return}if(s.push(`${U}.name=${ft(Y.name)}`),s.push(`${U}.message=${ft(Y.message)}`),Y.stack)s.push(`${U}.stack=${ft(Y.stack)}`);return}s.push(`${U}=${ft(Y)}`)}function yt(s,U,Y=[],se=new Date){let ue=Gt(U instanceof Error?U.message:U??""),ce=[];for(let[Te,be]of Y.entries()){if(be&&typeof be==="object"&&!Array.isArray(be)&&!(be instanceof Error)&&Object.getPrototypeOf(be)===Object.prototype){for(let[he,Fe]of Object.entries(be))bt(ce,he,Fe);continue}bt(ce,`param.${Te}`,be)}return[se.toISOString(),Bt[s],ue,...ce].filter(Boolean).join(" ")}var Pt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Ht=Pt,Yt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Jt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Xt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Zt={trace:()=>{},debug:(s,...U)=>globalThis.console.debug(yt("debug",s,U)),info:(s,...U)=>globalThis.console.info(yt("info",s,U)),warn:(s,...U)=>globalThis.console.warn(yt("warn",s,U)),error:(s,...U)=>globalThis.console.error(yt("error",s,U))};function Qt(s,U){if(typeof U!=="number"||U<=0)return s;return new Promise((Y,se)=>{let ue=setTimeout(()=>{se(Error(`Authz catalog entry did not become ready within ${U}ms`))},U);s.then(()=>{clearTimeout(ue),Y()},(ce)=>{clearTimeout(ue),se(ce)})})}function eo(s,U){let Y=!1,se,ue=U.then(()=>{Y=!0},(Te)=>{Y=!1,se=Te}),ce=s;return Object.defineProperty(ce,"ready",{enumerable:!1,configurable:!0,value:(Te)=>Qt(ue.then(()=>{if(!Y)throw se}),Te)}),Object.defineProperty(ce,"isReady",{enumerable:!1,configurable:!0,value:()=>Y}),ce}var Tt=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:Oe,yaml:"application/yaml",toml:"application/toml",xml:_e});function Rt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let U=s.mimeType?.trim()||Tt[s.format],Y=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>Y})}function to(s="jsonc"){return{format:s,mimeType:Tt[s],typeId:s}}class Ot extends n{constructor(s,U){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${U.mimeType}" (${U.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=U}}var oo=Rt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var vt={beforeTenantSegments:["ui"]},wt={beforeTenantSegments:["api"]};function _t(s){return(s??[]).map((U)=>U.trim()).filter(Boolean)}function Kt(s){let U=s.trim();if(!U)return"/";let Y=U.replace(/\\/g,"/").replace(/\/+/g,"/");return Y.startsWith("/")?Y:`/${Y}`}function Dt(s){return Kt(s).split("/").filter(Boolean)}function St(s){return{beforeTenantSegments:_t(s?.beforeTenantSegments),afterTenantSegments:_t(s?.afterTenantSegments)}}function Mt(s){if(s?.type==="host")return{type:"host",baseDomain:Et(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:St(s?.ui??vt),api:St(s?.api??wt)}}function Et(s){let U=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!U)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return U}function ro(s,U){let Y=s.trim().replace(/\.$/,"").toLowerCase(),se=Et(U);if(!Y.endsWith(`.${se}`))return null;let ue=Y.slice(0,-(se.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function no(s,U){let Y=St(U),se=Y.beforeTenantSegments??[],ue=Y.afterTenantSegments??[],ce=Dt(s),Te=se.length+1+ue.length;if(ce.length<Te)return null;for(let We=0;We<se.length;We++)if(ce[We]!==se[We])return null;let be=se.length,he=ce[be];if(!he)return null;for(let We=0;We<ue.length;We++)if(ce[be+1+We]!==ue[We])return null;let Fe=ce.slice(be+1+ue.length);return{id:decodeURIComponent(he),restSegments:Fe,restPath:Fe.length>0?`/${Fe.join("/")}`:"/"}}function Lt(s,U="/",Y){let se=St(Y),ue=se.beforeTenantSegments??[],ce=se.afterTenantSegments??[],Te=Dt(U),be=[...ue,encodeURIComponent(s),...ce,...Te];return be.length>0?`/${be.join("/")}`:"/"}function so(s,U="/",Y,se="ui"){let ue=Mt(Y);if(ue.type==="host"||ue.type==="selector")return Kt(U);return Lt(s,U,ue[se])}function io(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ue={...Y},ce=["iss","sub"];for(let he of ce)if(he in Y){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if("aud"in Y&&Y.aud!==void 0){let he=Y.aud;if(typeof he!=="string"&&!Array.isArray(he))se.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(he)&&!he.every((Fe)=>typeof Fe==="string"))se.push({message:"aud array must contain only strings",path:["aud"]})}let Te=["jti","scope"];for(let he of Te)if(he in Y&&Y[he]!==void 0){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}let be=["exp","iat"];for(let he of be)if(he in Y){if(typeof Y[he]!=="number")se.push({message:`${he} must be a number`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if(se.length>0)return{issues:se};return{value:ue}}}}}function ao(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ue={};if("access_token"in Y)if(typeof Y.access_token==="string")ue.access_token=Y.access_token;else se.push({message:"access_token must be a string",path:["access_token"]});else se.push({message:"access_token is required",path:["access_token"]});if("token_type"in Y)if(typeof Y.token_type==="string")ue.token_type=Y.token_type;else se.push({message:"token_type must be a string",path:["token_type"]});else se.push({message:"token_type is required",path:["token_type"]});if("scope"in Y)if(typeof Y.scope==="string"||Y.scope===void 0)ue.scope=Y.scope;else se.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Y)if(typeof Y.refresh_token==="string"||Y.refresh_token===void 0)ue.refresh_token=Y.refresh_token;else se.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Y)if(typeof Y.expires==="string"||Y.expires===void 0)ue.expires=Y.expires;else se.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Y)if(typeof Y.expires_in==="number"||Y.expires_in===void 0)ue.expires_in=Y.expires_in;else se.push({message:"expires_in must be a number",path:["expires_in"]});if(se.length>0)return{issues:se};return{value:ue}}}}}function po(s){let U=new Uint8Array(s);return crypto.getRandomValues(U),U}function co(s){let U="",Y=po(s);for(let se=0;se<s;se++){let ue=Y[se]%32;U+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return U}function mo(s,U){let Y="";for(let se=U;se>0;se--){let ue=s%32;Y="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+Y,s=Math.floor(s/32)}return Y}function uo(s){let U=Date.now(),Y=mo(U,10),se=co(16);return`${s??""}${Y}${se}`}export{u as ACCEPT_JSON,ot as ACCEPT_OCTET_STREAM,ge as ACCEPT_SCIM,st as ACCEPT_XML,Me as AssignmentPolicyError,te as CANONICAL_RISK_LEVELS,T as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,at as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,it as CONTENT_TYPE_XML,kt as ConfigSourceError,Ye as DEFAULT_DISCOVERED_COOKIE_MAX,Xe as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Je as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,Tt as DEFAULT_SECRET_MIME_TYPES,wt as DEFAULT_TENANT_API_NAMESPACE,vt as DEFAULT_TENANT_UI_NAMESPACE,oe as DISCOVERED_COOKIE_PREFIX,He as DISPLAY_COOKIE_SUFFIX,B as DISPLAY_COOKIE_VERSION,$e as ECID_SCHEME,j as ENTRA_ION_EXTENSION_URN,D as EcidFormatError,N as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,Pe as ION_AUTHZ_OAA_SYNC,xe as ION_CAPABILITIEZ_READ,Ee as ION_CIAM_MAGIC_LINK_CREATE,nt as ION_ENDPOINT_PERMISSIONS,ve as ION_IAM_ACCESS_REQUESTS_WRITE,Ie as ION_IAM_CUSTOMERS_WRITE,Re as ION_IAM_GROUPS_WRITE,Ce as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Ae as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,pe as ION_SDK_PERMISSIONS,Ue as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,x as KNOWN_BASE_CUSTOMER_KEYS,v as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,E as KNOWN_WORKLOAD_KEYS,Oe as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,rt as SCIM_MEDIA_TYPE,Ot as SecretContentTypeMismatchError,I as StoreConflictError,_e as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,M as assertEcid,ne as assertRequiredSubjectType,P as assertValidSubjectTypeScoping,Lt as buildTenantPath,so as buildTenantUrl,z as catalogEntityStore,Z as claimsToUser,_ as compareDisplayExpiryDesc,At as configSourceOriginLogFields,Ve as configTrustedClientGrants,c as customAttributes,le as customerResourceSchema,Yt as debugLogger,Le as decodeDisplayCookie,pt as decodeUser,C as deepEqualPlain,Se as defaultDisplayUser,Ht as defaultLogger,to as defaultSecretContentType,Ne as defineCatalog,Rt as defineSecretType,re as deprecateRetiredCodeCatalogRows,Wt as describeOriginUrl,J as discoveredProfileCookieName,F as encodeDisplayCookie,ee as errorLogAttributes,Ze as formatEcid,yt as formatLogLine,uo as generateULID,K as getCodeCatalogEntity,tt as groupResourceSchema,b as idTokenClaimsSchema,Jt as infoLogger,je as isCodeCatalog,De as isConfigLocator,Ut as isConfigSourceError,qe as isEcid,Ke as isJsonResponse,L as isStoreConflictError,io as jwtAssertionClaimsSchema,q as list,d as listGenerator,ro as matchTenantHost,no as matchTenantPath,Be as matchesListFilter,W as materializeCodeCatalogEntity,w as mergeCodeCatalogEntity,ct as mergeConfig,e as must,Et as normalizeTenantBaseDomain,St as normalizeTenantPathNamespace,Mt as normalizeTenantRoutingStrategy,me as oidcCallbackSchema,Qe as parseEcid,ut as parseJsonc,jt as parseKmsPoolControlDocument,zt as parseKmsPoolDocument,Zt as prettyLogger,O as profileCookieName,g as projectDisplayUser,H as readDisplayCookies,l as readJsonResponse,eo as readyCatalogEntry,oo as remoteConfigSecretType,G as resolveDiscoveredCookieMax,ae as resolveDiscoveredCookieTtlSeconds,ie as resolveDisplayCookieMax,ke as sanitizeDisplayUser,qt as serializeConfig,Pt as silentLogger,dt as stableConfigHash,ze as stripJsonComments,mt as tmIntegrationState,Ge as toCodeCatalog,fe as tokenResponseSchema,A as trimTrailingSlash,Q as trustedClientPermissionsForPrincipal,X as unexpectedBodySummary,V as unionCatalogRead,et as userSchema,ye as validationFailureResponse,$t as version,lt as waitOn,Xt as warnLogger,m as withValidate,de as workloadResourceSchema,ao as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -17,6 +17,80 @@ interface Logger {
 	warn(message?: unknown, ...optionalParams: unknown[]): void;
 	error(message?: unknown, ...optionalParams: unknown[]): void;
 }
+/** Runtime identity attached when an error leaves an ionite handle. */
+type IoniteErrorContext = {
+	/** `RemoteConfig.id` of the runtime that threw. On a tenant runtime this is the tenant id. */
+	ionId?: string;
+	/** Logger for that runtime. Non-enumerable on the error so serializers cannot reach a live handle. */
+	log?: Logger;
+};
+type IoniteErrorOptions = ErrorOptions & {
+	/**
+	* Client HTTP status. Always the status an App should send. Defaults to 500.
+	* Transport errors put the upstream status on {@link IoniteErrorOptions.upstreamStatus}.
+	*/
+	status?: number;
+	/** Upstream transport status. Server-side only: never returned by {@link IoniteError.response}. */
+	upstreamStatus?: number;
+	/** Client-safe reason code. When set, it is the `error` field of {@link IoniteError.response}. Never put `message` here. */
+	statusText?: string;
+	/** Client-safe explanation. Returned as `detail` only when `statusText` is set. */
+	detail?: string;
+	ionId?: string;
+	log?: Logger;
+};
+type IoniteErrorJson = {
+	name: string;
+	_tag: string;
+	status: number;
+	statusText?: string;
+	detail?: string;
+	ionId?: string;
+};
+type IoniteLogAttributes = Record<string, string | number | boolean | undefined>;
+/**
+* Base error for ionite runtimes.
+*
+* The runtime that throws stamps `ionId` and a non-enumerable `log` so an App error hook can log on
+* the right tenant without the SDK knowing the framework. `message` and `upstreamStatus` are
+* server-side. {@link IoniteError.response} returns `statusText`, `detail`, and
+* {@link IoniteError.safeBody}.
+*
+* `status` is always the client HTTP status. The App owns the hook that logs and returns a response;
+* the SDK decides only for the protocol routes it serves.
+*/
+declare class IoniteError extends Error {
+	/** Client HTTP status. Always set. */
+	readonly status: number;
+	/** Upstream transport status. Absent from {@link IoniteError.response} and {@link IoniteError.toJSON}. */
+	readonly upstreamStatus?: number;
+	readonly statusText?: string;
+	readonly detail?: string;
+	ionId?: string;
+	/** Non-enumerable. Absent from `JSON.stringify` and `toJSON`. */
+	log?: Logger;
+	constructor(message: string, options?: IoniteErrorOptions);
+	/** Effect `catchTag` discriminator. Equals `name`, the declared class name. */
+	get _tag(): string;
+	/** Attach runtime context only where it is still unset. The innermost handle wins. */
+	attachContext(ctx: IoniteErrorContext): this;
+	/** Extra client-safe JSON fields. Included only when `statusText` is set. */
+	protected safeBody(): Record<string, unknown>;
+	toLogAttributes(): IoniteLogAttributes;
+	/**
+	* Default client response. JSON unless the request asks for HTML and not JSON, in which case the
+	* body is plain text of `detail`, else `statusText`, else `Internal Server Error`.
+	* `message` and `upstreamStatus` are never included.
+	*/
+	response(request?: Request): Response;
+	toJSON(): IoniteErrorJson;
+	/**
+	* Normalize any thrown value. An existing {@link IoniteError} is returned unchanged aside from
+	* filling unset context. Anything else is wrapped at status 500 with the original as `cause`.
+	* A foreign `status` is not copied: it is not App response policy.
+	*/
+	static from(error: unknown, ctx?: IoniteErrorContext): IoniteError;
+}
 import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
 /**
 * ConfigSource-only block that lets an issuing IdP's token claims satisfy `has*` checks.
@@ -1129,6 +1203,12 @@ interface UserStore<TExtended = object> {
 	*/
 	getByExternalId?(externalId: string): Promise<BaseUser<TExtended> | undefined>;
 	/**
+	* Optional case-insensitive secondary-index lookup by `userName` (RFC 7643 `caseExact: false`), used
+	* to answer SCIM `userName eq` filters. Implementations that omit it remain correct; callers fall
+	* back to paged `list()` scans. Unlike `lookup`, it never participates in SSO login resolution.
+	*/
+	getByUserName?(userName: string): Promise<BaseUser<TExtended> | undefined>;
+	/**
 	* Retrieve a user based on their SCIM attributes or SSO JWT Claims.
 	*
 	* @param user - The user to lookup by SCIM attributes or SSO JWT Claims
@@ -1565,6 +1645,73 @@ type ParsedDisplayCookie = {
 	envelope: DisplayCookieEnvelope;
 };
 import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
+type ScimPatchOperation = {
+	op: string;
+	path?: string;
+	value?: unknown;
+};
+type ScimPatchErrorType = "invalidPath" | "invalidFilter" | "noTarget" | "invalidValue" | "invalidSyntax";
+declare class ScimPatchError extends IoniteError {
+	readonly name = "ScimPatchError";
+	readonly scimType: ScimPatchErrorType;
+	constructor(message: string, scimType: ScimPatchErrorType);
+}
+type EqFilter = {
+	attr: string;
+	value: string | number | boolean | null;
+};
+type ParsedPath = {
+	/** Extension schema URN the attribute lives under; undefined for core attributes. */
+	schema?: string;
+	/** Top-level attribute (inside `schema` when set); undefined when the path names the whole extension. */
+	attr?: string;
+	filter?: EqFilter;
+	subAttr?: string;
+};
+/**
+* Split a PATCH path into schema, attribute, optional filter and sub-attribute. Schema URNs end in a
+* resource-type segment that starts uppercase (`...:2.0:User`), which is how a whole-extension path
+* is told apart from `...:2.0:User:department`.
+*/
+declare function parseScimPatchPath(path: string): ParsedPath;
+/** Apply one PATCH operation to a SCIM resource in place. Throws {@link ScimPatchError} on an invalid op. */
+declare function applyScimPatchOperation(resource: Record<string, unknown>, operation: ScimPatchOperation): void;
+/** Built-in inbound SCIM provider types. `scim` is a strictly conformant client (no normalization). */
+type IAMProviderType = "scim" | "entra" | "okta" | "sailpoint";
+/** A single inbound SCIM provider declaration (ConfigSource-only). */
+type IAMProviderConfig = {
+	/** Provider adapter type. Selects the request normalizer. */
+	type: IAMProviderType;
+	/** Whether this entry is active. Defaults to true when omitted. */
+	enabled?: boolean;
+	/**
+	* Workload client ids whose inbound SCIM calls this entry covers, compared against the validated
+	* token's `client_id`, then `azp`, then `sub` (the SDK's canonical workload id order).
+	*/
+	clientIds: string[];
+	/** Optional display metadata for operator UIs. */
+	branding?: {
+		displayName: string;
+		iconUrl?: string;
+	};
+};
+/** Effective provider for an inbound request. */
+type ResolvedIamProvider = {
+	/** Provider key from `iam.providers`; undefined for the default strict preset. */
+	name?: string;
+	type: IAMProviderType;
+	normalizeResource: (resource: unknown) => unknown;
+	normalizePatch: (operations: ScimPatchOperation[]) => ScimPatchOperation[];
+	normalizeUser: (body: unknown) => unknown;
+	projectUser: (resource: User) => User;
+};
+/** Canonical caller id of a validated workload token: `client_id`, then `azp`, then `sub`. */
+declare function inboundCallerId(claims: Record<string, unknown> | undefined): string | undefined;
+/**
+* Pick the provider entry covering `callerId`. Returns the strict `scim` preset when no enabled entry
+* lists the caller.
+*/
+declare function resolveIamProvider(providers: Record<string, IAMProviderConfig> | undefined, callerId: string | undefined): ResolvedIamProvider;
 type ChangeListener = () => void;
 /**
 * Reactive source/adapter contract. Implemented by config-source-backed adapters
@@ -2531,6 +2678,12 @@ type IAMConfig = {
 	* token is used. Module-wide; per-kind enablement lives on `users`/`workloads`/`customers`.
 	*/
 	deltaAudience?: string;
+	/**
+	* RemoteConfig-only: inbound SCIM provider entries keyed by name, like `ciam.providers`. An entry
+	* selects a vendor preset (see `iam-providers.ts`) for the workload clients it lists; callers it
+	* does not list are handled as strictly conformant SCIM clients.
+	*/
+	providers?: Record<string, IAMProviderConfig>;
 };
 /**
 * Per-endpoint enablement flag carried in RemoteConfig (Ops/ECI intent).
@@ -6608,4 +6761,4 @@ type TenantAccessLoginUrlOptions = {
 	tenantIonBasePath?: (tenantId: string) => string;
 };
 declare function tenantAccessLoginUrl(tenantId: string, options: TenantAccessLoginUrlOptions): string;
-export { AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, CreateGroupOptions, CreateUserOptions, DeriveClaimsInput, DerivedEntitlement, DiscoveredTenantCookie, DisplayCookieAttributes, DisplayCookieCandidate, DisplayCookieTrim, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, IdTokenIssuerPolicy, InMemoryTenantStore, JWKS, MICROSOFT_CONSUMERS_TENANT_ID, MicrosoftAllowedTenants, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, SigningKey, SigningKeyRing, StateCookie, StaticSigningKeyRingDocument, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, decodeUnverifiedJwtPayload, defaultRedirectPolicies, deriveClaimsEntitlements, derivedEntitlementsFor, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, formatDisplayClearCookie, formatDisplaySetCookie, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getOwnedTenantIds, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, initiateLogin, isMicrosoftMultiTenantAuthority, isRedirectAllowed, listSsoClientIdsFromCookies, matchesMicrosoftIssuer, microsoftIssuerTenantId, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, pkceChallengeFromVerifier, planDiscoveredTenantCookies, planDisplayCookieClear, planDisplayCookieHeaders, reconcileSubjectAccess, rememberDerivedEntitlements, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveTenantOwner, resolveTenantSession, resolveUser, sameOriginRedirectRules, selectDisplayCookies, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signCompactJwt, signLfvPayload, sso, staticSigningKeyRing, stringifyLfvJwks, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, verifyCompactJwt, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };
+export { AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, CreateGroupOptions, CreateUserOptions, DeriveClaimsInput, DerivedEntitlement, DiscoveredTenantCookie, DisplayCookieAttributes, DisplayCookieCandidate, DisplayCookieTrim, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, IdTokenIssuerPolicy, InMemoryTenantStore, JWKS, MICROSOFT_CONSUMERS_TENANT_ID, MicrosoftAllowedTenants, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimPatchError, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, SigningKey, SigningKeyRing, StateCookie, StaticSigningKeyRingDocument, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, applyScimPatchOperation, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, decodeUnverifiedJwtPayload, defaultRedirectPolicies, deriveClaimsEntitlements, derivedEntitlementsFor, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, formatDisplayClearCookie, formatDisplaySetCookie, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getOwnedTenantIds, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, inboundCallerId, initiateLogin, isMicrosoftMultiTenantAuthority, isRedirectAllowed, listSsoClientIdsFromCookies, matchesMicrosoftIssuer, microsoftIssuerTenantId, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, parseScimPatchPath, pkceChallengeFromVerifier, planDiscoveredTenantCookies, planDisplayCookieClear, planDisplayCookieHeaders, reconcileSubjectAccess, rememberDerivedEntitlements, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveIamProvider, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveTenantOwner, resolveTenantSession, resolveUser, sameOriginRedirectRules, selectDisplayCookies, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signCompactJwt, signLfvPayload, sso, staticSigningKeyRing, stringifyLfvJwks, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, verifyCompactJwt, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };