@ionite/core 0.0.24-beta.20261013.30 → 0.0.24-beta.20261019.39

package/dist/index.d.ts

@@ -2277,6 +2277,7 @@ type TmDescription = ModuleDescriptionBase<"tm"> & {
 		jwksUri: string;
 		audience: string;
 		clientId: string;
+		webhookClient?: string;
 	};
 	consentTtlSeconds?: number;
 	maxRedeemAttempts?: number;
@@ -3597,6 +3598,13 @@ interface SessionStore<TExtended = object> {
 	* @param sid - The session.sid to delete
 	*/
 	delete(sid: string): Promise<void>;
+	/**
+	* Delete every live or rotation-grace record associated with the Identity Provider's `sid`.
+	*
+	* Refresh may rotate the SDK session id while retaining {@link Session.idpSid}; back-channel
+	* logout carries the IdP value and must revoke the complete family, not only the original key.
+	*/
+	deleteByIdpSid(idpSid: string): Promise<void>;
 }
 type DisplayCookieAttributes = {
 	path: string;
@@ -5586,7 +5594,11 @@ type ConfigChangeOptions = {
 type EnvironmentType = "POC" | "DEV" | "QA" | "PROD";
 type TenantStatus = "pending" | "processing" | "completed" | "failed" | "action_required";
 type CreateTenantRequestBase = {
-	/** App-owned routing key. ionite may suggest it; the App may reject a collision. */
+	/**
+	* Suggested App-owned routing key. The App SHOULD keep it when free, MAY normalize it to its
+	* routing rules, and rejects a collision with `409 tenant_id_taken`. The response `id` is
+	* authoritative.
+	*/
 	id: string;
 	/** Stable tenant id in the ionite domain. */
 	ioniteId: string;
@@ -5597,7 +5609,8 @@ type CreateTenantRequestBase = {
 	configLocator?: ConfigLocator;
 	email?: string;
 	webhookUrl?: string;
-	callbackUrl?: string;
+	/** Optional post-onboarding destination supplied by ionite and stored as App-owned metadata. */
+	returnUrl?: string;
 };
 /**
 * Body for creating a tenant (`POST ${basePath}`). `configLocator` may be supplied immediately or
@@ -5619,14 +5632,21 @@ type UpdateTenantRequest<TExtended extends object = object> = {
 	configLocator?: ConfigLocator;
 	email?: string;
 	webhookUrl?: string;
-	callbackUrl?: string;
+	/** Optional post-onboarding destination supplied by ionite and stored as App-owned metadata. */
+	returnUrl?: string;
 } & TExtended;
+/**
+* Tenant-management create/update response. `id` is the App tenant id actually stored, which can
+* differ from the suggested id; callers address the tenant and derive tenant URLs from it.
+*/
 type TenantResponse = {
+	id: string;
 	tenantUrl?: string;
 	status: Exclude<TenantStatus, "action_required">;
 	error?: string;
 	refs?: RefUrls[];
 } | {
+	id: string;
 	status: "action_required";
 	actionUrl: string;
 	requestToken: string;
@@ -5652,9 +5672,6 @@ interface TenantWebhookPayload {
 	companyId: string;
 	status: TenantStatus;
 	tenantUrl?: string;
-	actionUrl?: string;
-	requestToken?: string;
-	expiresAt?: string;
 	error?: string;
 }
 type TenantValidators<
@@ -5677,12 +5694,13 @@ type BaseTenant = {
 	environmentType: EnvironmentType;
 	email?: string;
 	webhookUrl?: string;
-	callbackUrl?: string;
+	/** Optional post-onboarding destination. The App decides whether to navigate to it. */
+	returnUrl?: string;
 	tenantUrl?: string;
 	status: TenantStatus;
 	error?: string;
-	actionUrl?: string;
-	requestToken?: string;
+	/** SHA-256 of the current `action_required` token. The plaintext token is never persisted. */
+	requestTokenHash?: string;
 	expiresAt?: string;
 	createdAt: Date;
 	updatedAt: Date;
@@ -5745,6 +5763,8 @@ type TmIoniteConfig = {
 	audience: string;
 	/** Required `azp`/client identity of the trusted ionite control plane. */
 	clientId: string;
+	/** Named outgoing workload client used to authenticate tenant-completion webhooks to ionite. */
+	webhookClient?: string;
 };
 type RemoteTmConfig = {
 	enabled: true;
@@ -5778,6 +5798,16 @@ type ConfigExportEnvelope = {
 	version: 1;
 	config: Record<string, unknown>;
 };
+type TenantCreatePlan = {
+	status: "action_required";
+	/** App-owned completion path, for example `/onboard`. */
+	path: string;
+	/** Public origin the browser uses to open the action URL. */
+	origin: string;
+} | {
+	status: "pending" | "processing" | "completed";
+	tenantUrl?: string;
+};
 type FrameworkTmConfig<TTenant extends BaseTenant = BaseTenant> = {
 	basePath: string;
 	store: TenantStore<TTenant>;
@@ -5788,6 +5818,16 @@ type FrameworkTmConfig<TTenant extends BaseTenant = BaseTenant> = {
 		purge(id: string): Promise<void>;
 	};
 	tenantIonBasePath?: (tenant: TTenant) => string | undefined;
+	/**
+	* Chooses the initial create response without taking ownership of protocol mechanics. TM is the
+	* sole minter for `action_required` links and re-runs this hook when ionite repeats a pending
+	* create for the same `ioniteId`.
+	*/
+	planCreate?: (context: {
+		create: CreateTenantRequest;
+		existing?: TTenant;
+		request: Request;
+	}) => TenantCreatePlan | undefined | Promise<TenantCreatePlan | undefined>;
 	onConnectRequest?: (context: ConnectRequestContext<TTenant>) => Response | Promise<Response>;
 	exportConfig?: (context: {
 		tenant: TTenant;
@@ -5845,6 +5885,15 @@ type TenantManagement<TTenant extends BaseTenant = BaseTenant> = ModuleReadiness
 	describe(): TmDescription;
 	handler(request: Request): Promise<Response>;
 	getTenant(id: string): Promise<TTenant | undefined>;
+	getActionRequest(requestToken: string): Promise<TTenant | undefined>;
+	completeActionRequest(input: {
+		requestToken: string;
+		tenant: TTenant;
+	}): Promise<{
+		tenant: TTenant;
+	}>;
+	/** Sends a workload-authenticated lifecycle update to ionite. Delivery is best-effort. */
+	sendWebhook(webhookUrl: string, payload: TenantWebhookPayload): Promise<void>;
 	recordConsent(input: RecordTenantConsentInput): Promise<TTenant>;
 	/**
 	* Mint the `action_required` fields TM requires: a request token, a browser action URL, and an
@@ -5924,6 +5973,13 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
+	/** Indexed lookup by the SHA-256 digest of an App onboarding request token. */
+	getByRequestTokenHash?(requestTokenHash: string): Promise<TTenant | undefined>;
+	/**
+	* Atomically replaces an `action_required` tenant only when the supplied request-token digest
+	* still owns it. Implementations clear the request-token index as part of the same write.
+	*/
+	completeActionRequest?(requestTokenHash: string, tenant: TTenant): Promise<TTenant | undefined>;
 	/** Looks up a tenant by ionite's stable id; TM create is idempotent by this key. */
 	getByIoniteId(ioniteId: string): Promise<TTenant | undefined>;
 }
@@ -7222,4 +7278,4 @@ declare function generateULID(prefix?: string): string;
 * `vaultTtl` is HTTP-only.
 */
 declare function vaultConfigLocatorTransportError(locator: Record<string, unknown>): string | undefined;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{Q,We,p,v,x,E,c,n,ee,q,d,Be,te,y,t,h,P,ne,Me,je,Ge,Ne,K,z,w,V,re,W,r,f,He,B,Je,Ye,Xe,oe,ie,G,ae,Se,ke,g,F,Le,H,_,O,J,$e,D,qe,Ze,Qe,M,o,S,k,et,tt,de,le,j,Ce,we,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,pe,nt,me,fe,b,a,rt,N,_e,Oe,u,ge,st,ot,i,R,T,it,at,Ke,X,l,m,e,ye,ct,ze,ut,A,C,dt,lt,Z,pt,I,L,De,mt}from"./shared/core-kjeaqpzk.js";var Ft="0.0.24-beta.20261013.30";class Tt extends n{constructor(s,U){let Y=U.kind==="connection"||U.kind==="timeout"||U.kind==="not_found";super(s,{cause:U.cause,status:Y?503:500,upstreamStatus:U.status});this.name="ConfigSourceError";this.kind=U.kind,this.recoverable=U.recoverable,this.code=U.code,this.path=U.path,this.sourceType=U.sourceType}}function Wt(s){return s instanceof Tt}function qt(s){let U=s?.trim();if(!U)return;try{let Y=new URL(U),se=Y.pathname.replace(/\/+$/g,"");return`${Y.protocol}//${Y.host}${se}`}catch{return}}function ht(s,U="ion.config.source"){if(!s)return{};let Y={[`${U}.type`]:s.type};if(s.transport)Y[`${U}.transport`]=s.transport;if(s.url)Y[`${U}.url`]=s.url;if(s.path)Y[`${U}.path`]=s.path;if(s.from)Object.assign(Y,ht(s.from,`${U}.from`));return Y}var Vt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function At(s){if(s===null||typeof s!=="object")return s;let U={};for(let[Y,se]of Object.entries(s)){if(Vt.includes(Y)||Y==="validators"||Y==="setStores")continue;U[Y]=se!==null&&typeof se==="object"&&!Array.isArray(se)&&Object.getPrototypeOf(se)===Object.prototype?At(se):se}return U}function jt(s){return At(s)}function Ct(s,U){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${U} must be an object.`);return s}function gt(s,U){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${U} must be a valid timestamp string.`);return s}function It(s,U,Y){if(!Array.isArray(s)||!Y.allowEmpty&&s.length===0)throw Error(`${U} keys must be ${Y.allowEmpty?"an":"a non-empty"} array.`);let se=new Set;return s.map((ce,ue)=>{let Te=Ct(ce,`${U} keys[${ue}]`);if(typeof Te.id!=="string"||Te.id.length===0)throw Error(`${U} keys[${ue}].id must be a non-empty string.`);if(se.has(Te.id))throw Error(`${U} contains duplicate key id "${Te.id}".`);if(se.add(Te.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Te.state)))throw Error(`${U} keys[${ue}].state is invalid.`);if(Te.value!==void 0&&(typeof Te.value!=="string"||Te.value.length===0))throw Error(`${U} keys[${ue}].value must be a non-empty string when present.`);let be=Te.meta===void 0?void 0:Ct(Te.meta,`${U} keys[${ue}].meta`);return{id:Te.id,state:Te.state,...Te.value===void 0?{}:{value:Te.value},...Te.notBefore===void 0?{}:{notBefore:gt(Te.notBefore,`${U} keys[${ue}].notBefore`)},...Te.notAfter===void 0?{}:{notAfter:gt(Te.notAfter,`${U} keys[${ue}].notAfter`)},...Te.createdAt===void 0?{}:{createdAt:gt(Te.createdAt,`${U} keys[${ue}].createdAt`)},...Te.activatedAt===void 0?{}:{activatedAt:gt(Te.activatedAt,`${U} keys[${ue}].activatedAt`)},...Te.deprecatedAt===void 0?{}:{deprecatedAt:gt(Te.deprecatedAt,`${U} keys[${ue}].deprecatedAt`)},...Te.rotatedAt===void 0?{}:{rotatedAt:gt(Te.rotatedAt,`${U} keys[${ue}].rotatedAt`)},...Te.revokedAt===void 0?{}:{revokedAt:gt(Te.revokedAt,`${U} keys[${ue}].revokedAt`)},...be?{meta:{...be}}:{}}})}function zt(s,U,Y){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${Y} slots must be an array.`);let se=new Set,ce=s.map((ue,Te)=>{if(ue===null)return null;if(typeof ue!=="string"||ue.length===0)throw Error(`${Y} slots[${Te}] must be a non-empty key id or null.`);if(se.has(ue))throw Error(`${Y} slots contain duplicate key id "${ue}".`);se.add(ue);let be=U.find((he)=>he.id===ue);if(!be)throw Error(`${Y} slot key "${ue}" is not present in keys.`);if(be.state!=="active")throw Error(`${Y} slot key "${ue}" must have state "active".`);if(!be.value)throw Error(`${Y} slot key "${ue}" must include a value.`);return ue});if(U.length===0&&ce.some((ue)=>ue!==null))throw Error(`${Y} slots must be omitted or all-null when keys is empty.`);return ce}function Bt(s){let Y=Ct(s,"KMS pool");if(Y.kind!=="kms")throw Error('KMS pool kind must be "kms".');let se=It(Y.keys,"KMS pool",{allowEmpty:!0}),ce=zt(Y.slots,se,"KMS pool");return ce?{kind:"kms",slots:ce,keys:se}:{kind:"kms",keys:se}}function Ht(s){let Y=Ct(s,"KMS pool control document");if(Y.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:It(Y.keys,"KMS pool control document",{allowEmpty:!0})}}var Gt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function xt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function ft(s){let U=xt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(U)?U:JSON.stringify(U)}function Yt(s){return xt(s).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function bt(s,U,Y){if(Y==null)return;if(Y instanceof Error){let se=ee(Y);if(se){for(let[ce,ue]of Object.entries(se))if(ue!=null)s.push(`${ce}=${ft(ue)}`);return}if(s.push(`${U}.name=${ft(Y.name)}`),s.push(`${U}.message=${ft(Y.message)}`),Y.stack)s.push(`${U}.stack=${ft(Y.stack)}`);return}s.push(`${U}=${ft(Y)}`)}function yt(s,U,Y=[],se=new Date){let ce=Yt(U instanceof Error?U.message:U??""),ue=[];for(let[Te,be]of Y.entries()){if(be&&typeof be==="object"&&!Array.isArray(be)&&!(be instanceof Error)&&Object.getPrototypeOf(be)===Object.prototype){for(let[he,Ve]of Object.entries(be))bt(ue,he,Ve);continue}bt(ue,`param.${Te}`,be)}return[se.toISOString(),Gt[s],ce,...ue].filter(Boolean).join(" ")}var vt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Jt=vt,Xt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Zt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Qt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},eo={trace:()=>{},debug:(s,...U)=>globalThis.console.debug(yt("debug",s,U)),info:(s,...U)=>globalThis.console.info(yt("info",s,U)),warn:(s,...U)=>globalThis.console.warn(yt("warn",s,U)),error:(s,...U)=>globalThis.console.error(yt("error",s,U))};function to(s,U){if(typeof U!=="number"||U<=0)return s;return new Promise((Y,se)=>{let ce=setTimeout(()=>{se(Error(`Authz catalog entry did not become ready within ${U}ms`))},U);s.then(()=>{clearTimeout(ce),Y()},(ue)=>{clearTimeout(ce),se(ue)})})}function oo(s,U){let Y=!1,se,ce=U.then(()=>{Y=!0},(Te)=>{Y=!1,se=Te}),ue=s;return Object.defineProperty(ue,"ready",{enumerable:!1,configurable:!0,value:(Te)=>to(ce.then(()=>{if(!Y)throw se}),Te)}),Object.defineProperty(ue,"isReady",{enumerable:!1,configurable:!0,value:()=>Y}),ue}var Rt=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:Oe,yaml:"application/yaml",toml:"application/toml",xml:_e});function kt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let U=s.mimeType?.trim()||Rt[s.format],Y=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>Y})}function ro(s="jsonc"){return{format:s,mimeType:Rt[s],typeId:s}}class Pt extends n{constructor(s,U){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${U.mimeType}" (${U.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=U}}var no=kt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var _t={beforeTenantSegments:["ui"]},wt={beforeTenantSegments:["api"]};function Ot(s){return(s??[]).map((U)=>U.trim()).filter(Boolean)}function Kt(s){let U=s.trim();if(!U)return"/";let Y=U.replace(/\\/g,"/").replace(/\/+/g,"/");return Y.startsWith("/")?Y:`/${Y}`}function Lt(s){return Kt(s).split("/").filter(Boolean)}function St(s){return{beforeTenantSegments:Ot(s?.beforeTenantSegments),afterTenantSegments:Ot(s?.afterTenantSegments)}}function Dt(s){if(s?.type==="host")return{type:"host",baseDomain:Et(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:St(s?.ui??_t),api:St(s?.api??wt)}}function Et(s){let U=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!U)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return U}function so(s,U){let Y=s.trim().replace(/\.$/,"").toLowerCase(),se=Et(U);if(!Y.endsWith(`.${se}`))return null;let ce=Y.slice(0,-(se.length+1));if(!ce||ce.includes("."))return null;return{id:ce}}function io(s,U){let Y=St(U),se=Y.beforeTenantSegments??[],ce=Y.afterTenantSegments??[],ue=Lt(s),Te=se.length+1+ce.length;if(ue.length<Te)return null;for(let Fe=0;Fe<se.length;Fe++)if(ue[Fe]!==se[Fe])return null;let be=se.length,he=ue[be];if(!he)return null;for(let Fe=0;Fe<ce.length;Fe++)if(ue[be+1+Fe]!==ce[Fe])return null;let Ve=ue.slice(be+1+ce.length);return{id:decodeURIComponent(he),restSegments:Ve,restPath:Ve.length>0?`/${Ve.join("/")}`:"/"}}function Mt(s,U="/",Y){let se=St(Y),ce=se.beforeTenantSegments??[],ue=se.afterTenantSegments??[],Te=Lt(U),be=[...ce,encodeURIComponent(s),...ue,...Te];return be.length>0?`/${be.join("/")}`:"/"}function ao(s,U="/",Y,se="ui"){let ce=Dt(Y);if(ce.type==="host"||ce.type==="selector")return Kt(U);return Mt(s,U,ce[se])}function po(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ce={...Y},ue=["iss","sub"];for(let he of ue)if(he in Y){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if("aud"in Y&&Y.aud!==void 0){let he=Y.aud;if(typeof he!=="string"&&!Array.isArray(he))se.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(he)&&!he.every((Ve)=>typeof Ve==="string"))se.push({message:"aud array must contain only strings",path:["aud"]})}let Te=["jti","scope"];for(let he of Te)if(he in Y&&Y[he]!==void 0){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}let be=["exp","iat"];for(let he of be)if(he in Y){if(typeof Y[he]!=="number")se.push({message:`${he} must be a number`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if(se.length>0)return{issues:se};return{value:ce}}}}}function co(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ce={};if("access_token"in Y)if(typeof Y.access_token==="string")ce.access_token=Y.access_token;else se.push({message:"access_token must be a string",path:["access_token"]});else se.push({message:"access_token is required",path:["access_token"]});if("token_type"in Y)if(typeof Y.token_type==="string")ce.token_type=Y.token_type;else se.push({message:"token_type must be a string",path:["token_type"]});else se.push({message:"token_type is required",path:["token_type"]});if("scope"in Y)if(typeof Y.scope==="string"||Y.scope===void 0)ce.scope=Y.scope;else se.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Y)if(typeof Y.refresh_token==="string"||Y.refresh_token===void 0)ce.refresh_token=Y.refresh_token;else se.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Y)if(typeof Y.expires==="string"||Y.expires===void 0)ce.expires=Y.expires;else se.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Y)if(typeof Y.expires_in==="number"||Y.expires_in===void 0)ce.expires_in=Y.expires_in;else se.push({message:"expires_in must be a number",path:["expires_in"]});if(se.length>0)return{issues:se};return{value:ce}}}}}function uo(s){let U=new Uint8Array(s);return crypto.getRandomValues(U),U}function mo(s){let U="",Y=uo(s);for(let se=0;se<s;se++){let ce=Y[se]%32;U+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ce)}return U}function lo(s,U){let Y="";for(let se=U;se>0;se--){let ce=s%32;Y="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ce)+Y,s=Math.floor(s/32)}return Y}function go(s){let U=Date.now(),Y=lo(U,10),se=mo(16);return`${s??""}${Y}${se}`}var Nt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function $t(s){return typeof s==="string"&&s.trim().length>0}function fo(s){let U=$t(s.vaultUrl)?s.vaultUrl:void 0,Y=Object.keys(s).some((ce)=>ce.startsWith("vaultLfv")&&s[ce]!==void 0);if(U&&Y)return"vaultUrl and vaultLfv* are mutually exclusive";if(!U&&!Y)return;if(Y){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(Nt.some((ce)=>!$t(s[ce])))return`LFV requires ${Nt.join(", ")}`;return}let se;try{se=new URL(U).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(se==="http:"||se==="https:")return;if(se==="ws:"||se==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{u as ACCEPT_JSON,ot as ACCEPT_OCTET_STREAM,ge as ACCEPT_SCIM,st as ACCEPT_XML,Me as AssignmentPolicyError,te as CANONICAL_RISK_LEVELS,T as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,at as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,it as CONTENT_TYPE_XML,Tt as ConfigSourceError,Ye as DEFAULT_DISCOVERED_COOKIE_MAX,Xe as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Je as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,Rt as DEFAULT_SECRET_MIME_TYPES,wt as DEFAULT_TENANT_API_NAMESPACE,_t as DEFAULT_TENANT_UI_NAMESPACE,oe as DISCOVERED_COOKIE_PREFIX,He as DISPLAY_COOKIE_SUFFIX,B as DISPLAY_COOKIE_VERSION,$e as ECID_SCHEME,j as ENTRA_ION_EXTENSION_URN,D as EcidFormatError,N as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,Pe as ION_AUTHZ_OAA_SYNC,xe as ION_CAPABILITIEZ_READ,Ee as ION_CIAM_MAGIC_LINK_CREATE,nt as ION_ENDPOINT_PERMISSIONS,ve as ION_IAM_ACCESS_REQUESTS_WRITE,Ie as ION_IAM_CUSTOMERS_WRITE,Re as ION_IAM_GROUPS_WRITE,Ce as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Ae as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,pe as ION_SDK_PERMISSIONS,Ue as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,x as KNOWN_BASE_CUSTOMER_KEYS,v as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,E as KNOWN_WORKLOAD_KEYS,Oe as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,rt as SCIM_MEDIA_TYPE,Pt as SecretContentTypeMismatchError,I as StoreConflictError,_e as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,M as assertEcid,ne as assertRequiredSubjectType,P as assertValidSubjectTypeScoping,Mt as buildTenantPath,ao as buildTenantUrl,z as catalogEntityStore,Z as claimsToUser,_ as compareDisplayExpiryDesc,ht as configSourceOriginLogFields,We as configTrustedClientGrants,c as customAttributes,le as customerResourceSchema,Xt as debugLogger,Le as decodeDisplayCookie,pt as decodeUser,C as deepEqualPlain,Se as defaultDisplayUser,Jt as defaultLogger,ro as defaultSecretContentType,Ne as defineCatalog,kt as defineSecretType,re as deprecateRetiredCodeCatalogRows,qt as describeOriginUrl,J as discoveredProfileCookieName,F as encodeDisplayCookie,ee as errorLogAttributes,Ze as formatEcid,yt as formatLogLine,go as generateULID,K as getCodeCatalogEntity,tt as groupResourceSchema,b as idTokenClaimsSchema,Zt as infoLogger,je as isCodeCatalog,De as isConfigLocator,Wt as isConfigSourceError,qe as isEcid,Ke as isJsonResponse,L as isStoreConflictError,po as jwtAssertionClaimsSchema,q as list,d as listGenerator,so as matchTenantHost,io as matchTenantPath,Be as matchesListFilter,V as materializeCodeCatalogEntity,w as mergeCodeCatalogEntity,ct as mergeConfig,e as must,Et as normalizeTenantBaseDomain,St as normalizeTenantPathNamespace,Dt as normalizeTenantRoutingStrategy,me as oidcCallbackSchema,Qe as parseEcid,ut as parseJsonc,Ht as parseKmsPoolControlDocument,Bt as parseKmsPoolDocument,eo as prettyLogger,O as profileCookieName,g as projectDisplayUser,H as readDisplayCookies,l as readJsonResponse,oo as readyCatalogEntry,no as remoteConfigSecretType,G as resolveDiscoveredCookieMax,ae as resolveDiscoveredCookieTtlSeconds,ie as resolveDisplayCookieMax,ke as sanitizeDisplayUser,jt as serializeConfig,vt as silentLogger,dt as stableConfigHash,ze as stripJsonComments,mt as tmIntegrationState,Ge as toCodeCatalog,fe as tokenResponseSchema,A as trimTrailingSlash,Q as trustedClientPermissionsForPrincipal,X as unexpectedBodySummary,W as unionCatalogRead,et as userSchema,ye as validationFailureResponse,fo as vaultConfigLocatorTransportError,Ft as version,lt as waitOn,Qt as warnLogger,m as withValidate,de as workloadResourceSchema,co as workloadTokenResponseSchema};
+import{Q,We,p,v,x,E,c,n,ee,q,u,Be,te,y,t,h,P,ne,Me,je,Ge,Ne,K,z,w,V,re,W,r,f,Fe,B,Je,Ye,Xe,oe,ie,G,ae,Se,ke,g,H,Le,F,_,O,J,$e,D,qe,Ze,Qe,M,o,S,k,et,tt,de,le,j,Ce,we,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,pe,nt,me,fe,b,a,rt,N,_e,Oe,l,ge,st,ot,i,R,T,it,at,Ke,X,d,m,e,ye,ct,ze,ut,A,C,dt,lt,Z,pt,I,L,De,mt}from"./shared/core-g4q48zcc.js";var Ft="0.0.24-beta.20261019.39";class Tt extends n{constructor(s,U){let Y=U.kind==="connection"||U.kind==="timeout"||U.kind==="not_found";super(s,{cause:U.cause,status:Y?503:500,upstreamStatus:U.status});this.name="ConfigSourceError";this.kind=U.kind,this.recoverable=U.recoverable,this.code=U.code,this.path=U.path,this.sourceType=U.sourceType}}function Wt(s){return s instanceof Tt}function qt(s){let U=s?.trim();if(!U)return;try{let Y=new URL(U),se=Y.pathname.replace(/\/+$/g,"");return`${Y.protocol}//${Y.host}${se}`}catch{return}}function ht(s,U="ion.config.source"){if(!s)return{};let Y={[`${U}.type`]:s.type};if(s.transport)Y[`${U}.transport`]=s.transport;if(s.url)Y[`${U}.url`]=s.url;if(s.path)Y[`${U}.path`]=s.path;if(s.from)Object.assign(Y,ht(s.from,`${U}.from`));return Y}var Vt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function At(s){if(s===null||typeof s!=="object")return s;let U={};for(let[Y,se]of Object.entries(s)){if(Vt.includes(Y)||Y==="validators"||Y==="setStores")continue;U[Y]=se!==null&&typeof se==="object"&&!Array.isArray(se)&&Object.getPrototypeOf(se)===Object.prototype?At(se):se}return U}function jt(s){return At(s)}function Ct(s,U){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${U} must be an object.`);return s}function gt(s,U){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${U} must be a valid timestamp string.`);return s}function It(s,U,Y){if(!Array.isArray(s)||!Y.allowEmpty&&s.length===0)throw Error(`${U} keys must be ${Y.allowEmpty?"an":"a non-empty"} array.`);let se=new Set;return s.map((ce,ue)=>{let Te=Ct(ce,`${U} keys[${ue}]`);if(typeof Te.id!=="string"||Te.id.length===0)throw Error(`${U} keys[${ue}].id must be a non-empty string.`);if(se.has(Te.id))throw Error(`${U} contains duplicate key id "${Te.id}".`);if(se.add(Te.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Te.state)))throw Error(`${U} keys[${ue}].state is invalid.`);if(Te.value!==void 0&&(typeof Te.value!=="string"||Te.value.length===0))throw Error(`${U} keys[${ue}].value must be a non-empty string when present.`);let be=Te.meta===void 0?void 0:Ct(Te.meta,`${U} keys[${ue}].meta`);return{id:Te.id,state:Te.state,...Te.value===void 0?{}:{value:Te.value},...Te.notBefore===void 0?{}:{notBefore:gt(Te.notBefore,`${U} keys[${ue}].notBefore`)},...Te.notAfter===void 0?{}:{notAfter:gt(Te.notAfter,`${U} keys[${ue}].notAfter`)},...Te.createdAt===void 0?{}:{createdAt:gt(Te.createdAt,`${U} keys[${ue}].createdAt`)},...Te.activatedAt===void 0?{}:{activatedAt:gt(Te.activatedAt,`${U} keys[${ue}].activatedAt`)},...Te.deprecatedAt===void 0?{}:{deprecatedAt:gt(Te.deprecatedAt,`${U} keys[${ue}].deprecatedAt`)},...Te.rotatedAt===void 0?{}:{rotatedAt:gt(Te.rotatedAt,`${U} keys[${ue}].rotatedAt`)},...Te.revokedAt===void 0?{}:{revokedAt:gt(Te.revokedAt,`${U} keys[${ue}].revokedAt`)},...be?{meta:{...be}}:{}}})}function zt(s,U,Y){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${Y} slots must be an array.`);let se=new Set,ce=s.map((ue,Te)=>{if(ue===null)return null;if(typeof ue!=="string"||ue.length===0)throw Error(`${Y} slots[${Te}] must be a non-empty key id or null.`);if(se.has(ue))throw Error(`${Y} slots contain duplicate key id "${ue}".`);se.add(ue);let be=U.find((he)=>he.id===ue);if(!be)throw Error(`${Y} slot key "${ue}" is not present in keys.`);if(be.state!=="active")throw Error(`${Y} slot key "${ue}" must have state "active".`);if(!be.value)throw Error(`${Y} slot key "${ue}" must include a value.`);return ue});if(U.length===0&&ce.some((ue)=>ue!==null))throw Error(`${Y} slots must be omitted or all-null when keys is empty.`);return ce}function Bt(s){let Y=Ct(s,"KMS pool");if(Y.kind!=="kms")throw Error('KMS pool kind must be "kms".');let se=It(Y.keys,"KMS pool",{allowEmpty:!0}),ce=zt(Y.slots,se,"KMS pool");return ce?{kind:"kms",slots:ce,keys:se}:{kind:"kms",keys:se}}function Ht(s){let Y=Ct(s,"KMS pool control document");if(Y.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:It(Y.keys,"KMS pool control document",{allowEmpty:!0})}}var Gt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function xt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function ft(s){let U=xt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(U)?U:JSON.stringify(U)}function Yt(s){return xt(s).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function bt(s,U,Y){if(Y==null)return;if(Y instanceof Error){let se=ee(Y);if(se){for(let[ce,ue]of Object.entries(se))if(ue!=null)s.push(`${ce}=${ft(ue)}`);return}if(s.push(`${U}.name=${ft(Y.name)}`),s.push(`${U}.message=${ft(Y.message)}`),Y.stack)s.push(`${U}.stack=${ft(Y.stack)}`);return}s.push(`${U}=${ft(Y)}`)}function yt(s,U,Y=[],se=new Date){let ce=Yt(U instanceof Error?U.message:U??""),ue=[];for(let[Te,be]of Y.entries()){if(be&&typeof be==="object"&&!Array.isArray(be)&&!(be instanceof Error)&&Object.getPrototypeOf(be)===Object.prototype){for(let[he,He]of Object.entries(be))bt(ue,he,He);continue}bt(ue,`param.${Te}`,be)}return[se.toISOString(),Gt[s],ce,...ue].filter(Boolean).join(" ")}var Pt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Jt=Pt,Xt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Zt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Qt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},eo={trace:()=>{},debug:(s,...U)=>globalThis.console.debug(yt("debug",s,U)),info:(s,...U)=>globalThis.console.info(yt("info",s,U)),warn:(s,...U)=>globalThis.console.warn(yt("warn",s,U)),error:(s,...U)=>globalThis.console.error(yt("error",s,U))};function to(s,U){if(typeof U!=="number"||U<=0)return s;return new Promise((Y,se)=>{let ce=setTimeout(()=>{se(Error(`Authz catalog entry did not become ready within ${U}ms`))},U);s.then(()=>{clearTimeout(ce),Y()},(ue)=>{clearTimeout(ce),se(ue)})})}function oo(s,U){let Y=!1,se,ce=U.then(()=>{Y=!0},(Te)=>{Y=!1,se=Te}),ue=s;return Object.defineProperty(ue,"ready",{enumerable:!1,configurable:!0,value:(Te)=>to(ce.then(()=>{if(!Y)throw se}),Te)}),Object.defineProperty(ue,"isReady",{enumerable:!1,configurable:!0,value:()=>Y}),ue}var Rt=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:Oe,yaml:"application/yaml",toml:"application/toml",xml:_e});function kt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let U=s.mimeType?.trim()||Rt[s.format],Y=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>Y})}function ro(s="jsonc"){return{format:s,mimeType:Rt[s],typeId:s}}class vt extends n{constructor(s,U){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${U.mimeType}" (${U.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=U}}var no=kt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var _t={beforeTenantSegments:["ui"]},wt={beforeTenantSegments:["api"]};function Ot(s){return(s??[]).map((U)=>U.trim()).filter(Boolean)}function Kt(s){let U=s.trim();if(!U)return"/";let Y=U.replace(/\\/g,"/").replace(/\/+/g,"/");return Y.startsWith("/")?Y:`/${Y}`}function Lt(s){return Kt(s).split("/").filter(Boolean)}function St(s){return{beforeTenantSegments:Ot(s?.beforeTenantSegments),afterTenantSegments:Ot(s?.afterTenantSegments)}}function Dt(s){if(s?.type==="host")return{type:"host",baseDomain:Et(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:St(s?.ui??_t),api:St(s?.api??wt)}}function Et(s){let U=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!U)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return U}function so(s,U){let Y=s.trim().replace(/\.$/,"").toLowerCase(),se=Et(U);if(!Y.endsWith(`.${se}`))return null;let ce=Y.slice(0,-(se.length+1));if(!ce||ce.includes("."))return null;return{id:ce}}function io(s,U){let Y=St(U),se=Y.beforeTenantSegments??[],ce=Y.afterTenantSegments??[],ue=Lt(s),Te=se.length+1+ce.length;if(ue.length<Te)return null;for(let Ve=0;Ve<se.length;Ve++)if(ue[Ve]!==se[Ve])return null;let be=se.length,he=ue[be];if(!he)return null;for(let Ve=0;Ve<ce.length;Ve++)if(ue[be+1+Ve]!==ce[Ve])return null;let He=ue.slice(be+1+ce.length);return{id:decodeURIComponent(he),restSegments:He,restPath:He.length>0?`/${He.join("/")}`:"/"}}function Mt(s,U="/",Y){let se=St(Y),ce=se.beforeTenantSegments??[],ue=se.afterTenantSegments??[],Te=Lt(U),be=[...ce,encodeURIComponent(s),...ue,...Te];return be.length>0?`/${be.join("/")}`:"/"}function ao(s,U="/",Y,se="ui"){let ce=Dt(Y);if(ce.type==="host"||ce.type==="selector")return Kt(U);return Mt(s,U,ce[se])}function po(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ce={...Y},ue=["iss","sub"];for(let he of ue)if(he in Y){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if("aud"in Y&&Y.aud!==void 0){let he=Y.aud;if(typeof he!=="string"&&!Array.isArray(he))se.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(he)&&!he.every((He)=>typeof He==="string"))se.push({message:"aud array must contain only strings",path:["aud"]})}let Te=["jti","scope"];for(let he of Te)if(he in Y&&Y[he]!==void 0){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}let be=["exp","iat"];for(let he of be)if(he in Y){if(typeof Y[he]!=="number")se.push({message:`${he} must be a number`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if(se.length>0)return{issues:se};return{value:ce}}}}}function co(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ce={};if("access_token"in Y)if(typeof Y.access_token==="string")ce.access_token=Y.access_token;else se.push({message:"access_token must be a string",path:["access_token"]});else se.push({message:"access_token is required",path:["access_token"]});if("token_type"in Y)if(typeof Y.token_type==="string")ce.token_type=Y.token_type;else se.push({message:"token_type must be a string",path:["token_type"]});else se.push({message:"token_type is required",path:["token_type"]});if("scope"in Y)if(typeof Y.scope==="string"||Y.scope===void 0)ce.scope=Y.scope;else se.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Y)if(typeof Y.refresh_token==="string"||Y.refresh_token===void 0)ce.refresh_token=Y.refresh_token;else se.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Y)if(typeof Y.expires==="string"||Y.expires===void 0)ce.expires=Y.expires;else se.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Y)if(typeof Y.expires_in==="number"||Y.expires_in===void 0)ce.expires_in=Y.expires_in;else se.push({message:"expires_in must be a number",path:["expires_in"]});if(se.length>0)return{issues:se};return{value:ce}}}}}function uo(s){let U=new Uint8Array(s);return crypto.getRandomValues(U),U}function mo(s){let U="",Y=uo(s);for(let se=0;se<s;se++){let ce=Y[se]%32;U+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ce)}return U}function lo(s,U){let Y="";for(let se=U;se>0;se--){let ce=s%32;Y="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ce)+Y,s=Math.floor(s/32)}return Y}function go(s){let U=Date.now(),Y=lo(U,10),se=mo(16);return`${s??""}${Y}${se}`}var Nt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function $t(s){return typeof s==="string"&&s.trim().length>0}function fo(s){let U=$t(s.vaultUrl)?s.vaultUrl:void 0,Y=Object.keys(s).some((ce)=>ce.startsWith("vaultLfv")&&s[ce]!==void 0);if(U&&Y)return"vaultUrl and vaultLfv* are mutually exclusive";if(!U&&!Y)return;if(Y){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(Nt.some((ce)=>!$t(s[ce])))return`LFV requires ${Nt.join(", ")}`;return}let se;try{se=new URL(U).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(se==="http:"||se==="https:")return;if(se==="ws:"||se==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{l as ACCEPT_JSON,ot as ACCEPT_OCTET_STREAM,ge as ACCEPT_SCIM,st as ACCEPT_XML,Me as AssignmentPolicyError,te as CANONICAL_RISK_LEVELS,T as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,at as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,it as CONTENT_TYPE_XML,Tt as ConfigSourceError,Ye as DEFAULT_DISCOVERED_COOKIE_MAX,Xe as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Je as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,Rt as DEFAULT_SECRET_MIME_TYPES,wt as DEFAULT_TENANT_API_NAMESPACE,_t as DEFAULT_TENANT_UI_NAMESPACE,oe as DISCOVERED_COOKIE_PREFIX,Fe as DISPLAY_COOKIE_SUFFIX,B as DISPLAY_COOKIE_VERSION,$e as ECID_SCHEME,j as ENTRA_ION_EXTENSION_URN,D as EcidFormatError,N as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,Pe as ION_AUTHZ_OAA_SYNC,xe as ION_CAPABILITIEZ_READ,Ee as ION_CIAM_MAGIC_LINK_CREATE,nt as ION_ENDPOINT_PERMISSIONS,ve as ION_IAM_ACCESS_REQUESTS_WRITE,Ie as ION_IAM_CUSTOMERS_WRITE,Re as ION_IAM_GROUPS_WRITE,Ce as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Ae as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,pe as ION_SDK_PERMISSIONS,Ue as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,x as KNOWN_BASE_CUSTOMER_KEYS,v as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,E as KNOWN_WORKLOAD_KEYS,Oe as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,rt as SCIM_MEDIA_TYPE,vt as SecretContentTypeMismatchError,I as StoreConflictError,_e as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,M as assertEcid,ne as assertRequiredSubjectType,P as assertValidSubjectTypeScoping,Mt as buildTenantPath,ao as buildTenantUrl,z as catalogEntityStore,Z as claimsToUser,_ as compareDisplayExpiryDesc,ht as configSourceOriginLogFields,We as configTrustedClientGrants,c as customAttributes,le as customerResourceSchema,Xt as debugLogger,Le as decodeDisplayCookie,pt as decodeUser,C as deepEqualPlain,Se as defaultDisplayUser,Jt as defaultLogger,ro as defaultSecretContentType,Ne as defineCatalog,kt as defineSecretType,re as deprecateRetiredCodeCatalogRows,qt as describeOriginUrl,J as discoveredProfileCookieName,H as encodeDisplayCookie,ee as errorLogAttributes,Ze as formatEcid,yt as formatLogLine,go as generateULID,K as getCodeCatalogEntity,tt as groupResourceSchema,b as idTokenClaimsSchema,Zt as infoLogger,je as isCodeCatalog,De as isConfigLocator,Wt as isConfigSourceError,qe as isEcid,Ke as isJsonResponse,L as isStoreConflictError,po as jwtAssertionClaimsSchema,q as list,u as listGenerator,so as matchTenantHost,io as matchTenantPath,Be as matchesListFilter,V as materializeCodeCatalogEntity,w as mergeCodeCatalogEntity,ct as mergeConfig,e as must,Et as normalizeTenantBaseDomain,St as normalizeTenantPathNamespace,Dt as normalizeTenantRoutingStrategy,me as oidcCallbackSchema,Qe as parseEcid,ut as parseJsonc,Ht as parseKmsPoolControlDocument,Bt as parseKmsPoolDocument,eo as prettyLogger,O as profileCookieName,g as projectDisplayUser,F as readDisplayCookies,d as readJsonResponse,oo as readyCatalogEntry,no as remoteConfigSecretType,G as resolveDiscoveredCookieMax,ae as resolveDiscoveredCookieTtlSeconds,ie as resolveDisplayCookieMax,ke as sanitizeDisplayUser,jt as serializeConfig,Pt as silentLogger,dt as stableConfigHash,ze as stripJsonComments,mt as tmIntegrationState,Ge as toCodeCatalog,fe as tokenResponseSchema,A as trimTrailingSlash,Q as trustedClientPermissionsForPrincipal,X as unexpectedBodySummary,W as unionCatalogRead,et as userSchema,ye as validationFailureResponse,fo as vaultConfigLocatorTransportError,Ft as version,lt as waitOn,Qt as warnLogger,m as withValidate,de as workloadResourceSchema,co as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -2089,6 +2089,7 @@ type TmDescription = ModuleDescriptionBase<"tm"> & {
 		jwksUri: string;
 		audience: string;
 		clientId: string;
+		webhookClient?: string;
 	};
 	consentTtlSeconds?: number;
 	maxRedeemAttempts?: number;
@@ -3380,6 +3381,13 @@ interface SessionStore<TExtended = object> {
 	* @param sid - The session.sid to delete
 	*/
 	delete(sid: string): Promise<void>;
+	/**
+	* Delete every live or rotation-grace record associated with the Identity Provider's `sid`.
+	*
+	* Refresh may rotate the SDK session id while retaining {@link Session.idpSid}; back-channel
+	* logout carries the IdP value and must revoke the complete family, not only the original key.
+	*/
+	deleteByIdpSid(idpSid: string): Promise<void>;
 }
 type DisplayCookieAttributes = {
 	path: string;
@@ -5052,9 +5060,6 @@ interface TenantWebhookPayload {
 	companyId: string;
 	status: TenantStatus;
 	tenantUrl?: string;
-	actionUrl?: string;
-	requestToken?: string;
-	expiresAt?: string;
 	error?: string;
 }
 type BaseTenant = {
@@ -5067,12 +5072,13 @@ type BaseTenant = {
 	environmentType: EnvironmentType;
 	email?: string;
 	webhookUrl?: string;
-	callbackUrl?: string;
+	/** Optional post-onboarding destination. The App decides whether to navigate to it. */
+	returnUrl?: string;
 	tenantUrl?: string;
 	status: TenantStatus;
 	error?: string;
-	actionUrl?: string;
-	requestToken?: string;
+	/** SHA-256 of the current `action_required` token. The plaintext token is never persisted. */
+	requestTokenHash?: string;
 	expiresAt?: string;
 	createdAt: Date;
 	updatedAt: Date;
@@ -5135,6 +5141,8 @@ type TmIoniteConfig = {
 	audience: string;
 	/** Required `azp`/client identity of the trusted ionite control plane. */
 	clientId: string;
+	/** Named outgoing workload client used to authenticate tenant-completion webhooks to ionite. */
+	webhookClient?: string;
 };
 type RemoteTmConfig = {
 	enabled: true;
@@ -5169,6 +5177,15 @@ type TenantManagement<TTenant extends BaseTenant = BaseTenant> = ModuleReadiness
 	describe(): TmDescription;
 	handler(request: Request): Promise<Response>;
 	getTenant(id: string): Promise<TTenant | undefined>;
+	getActionRequest(requestToken: string): Promise<TTenant | undefined>;
+	completeActionRequest(input: {
+		requestToken: string;
+		tenant: TTenant;
+	}): Promise<{
+		tenant: TTenant;
+	}>;
+	/** Sends a workload-authenticated lifecycle update to ionite. Delivery is best-effort. */
+	sendWebhook(webhookUrl: string, payload: TenantWebhookPayload): Promise<void>;
 	recordConsent(input: RecordTenantConsentInput): Promise<TTenant>;
 	/**
 	* Mint the `action_required` fields TM requires: a request token, a browser action URL, and an
@@ -5228,6 +5245,13 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
+	/** Indexed lookup by the SHA-256 digest of an App onboarding request token. */
+	getByRequestTokenHash?(requestTokenHash: string): Promise<TTenant | undefined>;
+	/**
+	* Atomically replaces an `action_required` tenant only when the supplied request-token digest
+	* still owns it. Implementations clear the request-token index as part of the same write.
+	*/
+	completeActionRequest?(requestTokenHash: string, tenant: TTenant): Promise<TTenant | undefined>;
 	/** Looks up a tenant by ionite's stable id; TM create is idempotent by this key. */
 	getByIoniteId(ioniteId: string): Promise<TTenant | undefined>;
 }
@@ -5249,9 +5273,10 @@ declare class InMemoryTenantStore<TTenant extends BaseTenant = BaseTenant> imple
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash(handleHash: string): Promise<TTenant | undefined>;
+	getByRequestTokenHash(requestTokenHash: string): Promise<TTenant | undefined>;
+	completeActionRequest(requestTokenHash: string, tenant: TTenant): Promise<TTenant | undefined>;
 	getByIoniteId(ioniteId: string): Promise<TTenant | undefined>;
 }
-declare function sendTenantWebhook(webhookUrl: string, payload: TenantWebhookPayload, log: Logger): Promise<void>;
 /**
 * Persisted CIAM customer record with identity fields and tracking metadata.
 *
@@ -6751,4 +6776,4 @@ type TenantAccessLoginUrlOptions = {
 	tenantIonBasePath?: (tenantId: string) => string;
 };
 declare function tenantAccessLoginUrl(tenantId: string, options: TenantAccessLoginUrlOptions): string;
-export { AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, CreateGroupOptions, CreateUserOptions, DeriveClaimsInput, DerivedEntitlement, DiscoveredTenantCookie, DisplayCookieAttributes, DisplayCookieCandidate, DisplayCookieTrim, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, IdTokenIssuerPolicy, InMemoryTenantStore, JWKS, MICROSOFT_CONSUMERS_TENANT_ID, MicrosoftAllowedTenants, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimPatchError, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, SigningKey, SigningKeyRing, StateCookie, StaticSigningKeyRingDocument, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, applyScimPatchOperation, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, decodeUnverifiedJwtPayload, defaultRedirectPolicies, deriveClaimsEntitlements, derivedEntitlementsFor, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, formatDisplayClearCookie, formatDisplaySetCookie, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getOwnedTenantIds, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, inboundCallerId, initiateLogin, isMicrosoftMultiTenantAuthority, isRedirectAllowed, listSsoClientIdsFromCookies, matchesMicrosoftIssuer, microsoftIssuerTenantId, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, parseScimPatchPath, pkceChallengeFromVerifier, planDiscoveredTenantCookies, planDisplayCookieClear, planDisplayCookieHeaders, reconcileSubjectAccess, rememberDerivedEntitlements, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveIamProvider, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveTenantOwner, resolveTenantSession, resolveUser, sameOriginRedirectRules, selectDisplayCookies, sendTenantWebhook, setDiscoveryClock, setJwksClock, setJwksRetry, signCompactJwt, signLfvPayload, sso, staticSigningKeyRing, stringifyLfvJwks, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, verifyCompactJwt, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };
+export { AccessRequestCreate, AccessRequestResult, AccessRequestsDestination, AfterLoginContext, AfterLoginHook, AfterLogoutContext, AfterLogoutHook, AssertTrustedIdTokenClaimsOptions, BeforeLoginContext, BeforeLoginHook, BeforeLogoutContext, BeforeLogoutHook, CACHE_BOUNDS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CIAM_PROVIDER_PRESETS, CatalogAdjacencyCache, CatalogView, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, CreateGroupOptions, CreateUserOptions, DeriveClaimsInput, DerivedEntitlement, DiscoveredTenantCookie, DisplayCookieAttributes, DisplayCookieCandidate, DisplayCookieTrim, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMConfig, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundUserContext, IAMInboundUsersConfig, IAMUsersInbound, IAMValidators, IdTokenIssuerPolicy, InMemoryTenantStore, JWKS, MICROSOFT_CONSUMERS_TENANT_ID, MicrosoftAllowedTenants, ReconcileStores, RedirectContext, RedirectPolicy, RedirectResult, RedirectRule, RedirectRuleContext, RedirectVerdict, ReferencedDefinitions, ResolveTenantOwnerOptions, ResolveTenantSessionOptions, ResolvedCacheConfig, ResolvedJwksCacheConfig, ResolvedSessionCacheConfig, ResolvedSessionReadCacheConfig, SSO, SSOConfig, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimError, ScimListResponse, ScimPatchError, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, SessionDiscoveryOptions, SessionResponse, SigningKey, SigningKeyRing, StateCookie, StaticSigningKeyRingDocument, TENANT_OWNER_PERMISSION, TenantAccessDenial, TenantAccessDenialReason, TenantAccessLoginUrlOptions, TenantAccessResult, TenantAccessSession, TenantAccessSessionKind, UsersInboundHandlerConfig, VerifyIdTokenOptions, VerifyLogoutTokenOptions, VerifyUserOptions, allowHosts, allowOrigins, allowRelativePaths, allowSameOrigin, applyScimPatchOperation, assertSubjectTypeAssignable, assertTrustedIdTokenClaims, baseCustomerToScim, baseUserToScimUser, baseWorkloadToScim, blockDangerousUrls, buildAuthorizationUrl, buildLfvSigningInput, callback, captureRedirect, ciam, clearDiscoveryCache, clearJwksCache, collectReferencedDefinitions, configureJwksCache, decodeUnverifiedJwtPayload, defaultRedirectPolicies, deriveClaimsEntitlements, derivedEntitlementsFor, discoverOidcEndpoints, discoverSessionRecords, discoverSessions, entitlementToScimGroup, exchangeAuthorizationCode, expandRoot, fetchUserInfo, formatDisplayClearCookie, formatDisplaySetCookie, generateAppleClientSecret, generateLfvEd25519KeyPair, getCachedVerificationKey, getCustomer, getDiscoveredSessionUsers, getJwks, getOwnedTenantIds, getProviderPreset, getPublicKeyForKid, getPublicKeyFromJwks, getUser, getVerificationKeyForKid, has, hasAll2 as hasAll, hasAllScope, hasAny2 as hasAny, hasAnyScope, hasGroup2 as hasGroup, hasPermission2 as hasPermission, hasRole2 as hasRole, hasScope, iam, inboundCallerId, initiateLogin, isMicrosoftMultiTenantAuthority, isRedirectAllowed, listSsoClientIdsFromCookies, matchesMicrosoftIssuer, microsoftIssuerTenantId, normalizeOidcIssuer, orderedEnabledProviders, parseLfvJwks, parseScimPatchPath, pkceChallengeFromVerifier, planDiscoveredTenantCookies, planDisplayCookieClear, planDisplayCookieHeaders, reconcileSubjectAccess, rememberDerivedEntitlements, resolveAfterRedirect, resolveCacheConfig, resolveCapturedRedirect, resolveCiamProvider, resolveCustomer, resolveIamProvider, resolveJwkForKid, resolveJwksCacheConfig, resolveProviderBranding, resolveRedirect, resolveSessionCacheConfig, resolveTenantOwner, resolveTenantSession, resolveUser, sameOriginRedirectRules, selectDisplayCookies, setDiscoveryClock, setJwksClock, setJwksRetry, signCompactJwt, signLfvPayload, sso, staticSigningKeyRing, stringifyLfvJwks, tenantAccessLoginUrl, tenantOwnerEntitlementId, tenantOwnerPermission, tenantResourceId, verifyCompactJwt, verifyIdToken, verifyLfvSignature, verifyLogoutToken, verifyUser, withSetCookies };