@ionite/core 0.0.24-beta.20261022.44 → 0.0.24-beta.20261024.46

package/dist/index.d.ts

@@ -377,7 +377,7 @@ interface DelegateStore<TExtended = object> {
 	list(options?: ListOptions): Promise<ListResult<BaseDelegate<TExtended>>>;
 	/**
 	* Record usage: set only `lastUsedAt` (not `updatedAt`) and never emit IAM delta. Called
-	* fire-and-forget at most once per `iam.delegates.lastUsedWindowSeconds` per process.
+	* fire-and-forget at most once per `delegate.lastUsedWindowSeconds` per process.
 	*/
 	touch(id: string, at: Date): Promise<void>;
 }
@@ -1908,43 +1908,6 @@ declare function readDisplayCookies(cookieHeader: string | null | undefined): Pa
 declare function compareDisplayExpiryDesc(a: string | undefined, b: string | undefined): number;
 declare function profileCookieName(cookiesPrefix: string): string;
 declare function discoveredProfileCookieName(tenantId: string): string;
-import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
-type ScimPatchOperation = {
-	op: string;
-	path?: string;
-	value?: unknown;
-};
-type ScimPatchErrorType = "invalidPath" | "invalidFilter" | "noTarget" | "invalidValue" | "invalidSyntax";
-/** Built-in inbound SCIM provider types. `scim` is a strictly conformant client (no normalization). */
-type IAMProviderType = "scim" | "entra" | "okta" | "sailpoint";
-/** A single inbound SCIM provider declaration (ConfigSource-only). */
-type IAMProviderConfig = {
-	/** Provider adapter type. Selects the request normalizer. */
-	type: IAMProviderType;
-	/** Whether this entry is active. Defaults to true when omitted. */
-	enabled?: boolean;
-	/**
-	* Workload client ids whose inbound SCIM calls this entry covers, compared against the validated
-	* token's `client_id`, then `azp`, then `sub` (the SDK's canonical workload id order).
-	*/
-	clientIds: string[];
-	/** Optional display metadata for operator UIs. */
-	branding?: {
-		displayName: string;
-		iconUrl?: string;
-	};
-};
-/**
-* The name Entra uses for the ion User extension. Entra's SCIM client sends a custom extension in create
-* POSTs only when it is named `urn:ietf:params:scim:schemas:extension:<Name>:2.0:User`; it omits
-* `ION_SCIM_USER_EXTENSION_URN` from creates and sends it only on later PATCHes, so an Entra-provisioned
-* account would arrive without its ECID until the next sync. Measured in the iosite sandbox. Map Entra
-* attributes to this name; the `entra` preset translates it to the canonical URN inbound and back on
-* responses, so Entra's GET-based drift check compares like with like. Entra-only: `urn:ietf:params:scim:`
-* is IANA-managed (RFC 7643 §10) and not part of the general contract.
-* https://learn.microsoft.com/entra/identity/app-provisioning/customize-application-attributes
-*/
-declare const ENTRA_ION_EXTENSION_URN = "urn:ietf:params:scim:schemas:extension:ionite:2.0:User";
 type ChangeListener = () => void;
 /**
 * Reactive source/adapter contract. Implemented by config-source-backed adapters
@@ -1986,7 +1949,7 @@ type ModuleReadiness = {
 * block. Apps that DO treat delta as a hard dependency can gate on `ion.iam.delta.isReady()` /
 * `ion.iam.delta.ready()` explicitly instead.
 */
-type ModuleName = "sso" | "ciam" | "iam" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
+type ModuleName = "sso" | "ciam" | "iam" | "delegate" | "workload" | "otel" | "secrets" | "kms" | "authz" | "tm";
 /** Per-module readiness snapshot in {@link ReadinessReport}. */
 type ModuleReadinessState = {
 	/** Whether the module is active (present/requested) in the effective config. Inactive modules never block readiness. */
@@ -2022,7 +1985,7 @@ type RequireReadyResult = {
 		reason?: string;
 	}>;
 };
-type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "sso.claims_authz" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "ciam.claims_authz" | "iam.users" | "iam.groups" | "iam.groups.create" | "iam.workloads" | "iam.customers" | "iam.delegates" | "workload.incoming" | "workload.outgoing" | "workload.claims_authz" | "authz.oaa" | "authz.access_requests" | "tm.integration";
+type CapabilityKey = "sso.login" | "sso.jit" | "sso.logout" | "sso.back_channel_logout" | "sso.claims_authz" | "ciam.magic_link" | "ciam.oidc_login" | "ciam.customer" | "ciam.logout" | "ciam.claims_authz" | "iam.users" | "iam.groups" | "iam.groups.create" | "iam.workloads" | "iam.customers" | "iam.delegates" | "delegate.resolve" | "workload.incoming" | "workload.outgoing" | "workload.claims_authz" | "authz.oaa" | "authz.access_requests" | "tm.integration";
 type CapabilityEndpointUrls = {
 	readyzUrl: string;
 	capabilitiezUrl: string;
@@ -2262,6 +2225,12 @@ type IamDescription = ModuleDescriptionBase<"iam"> & {
 	};
 	urls: Partial<CapabilityEndpointUrls["iam"]>;
 };
+type DelegateDescription = ModuleDescriptionBase<"delegate"> & {
+	enabled: boolean;
+	storeWired: boolean;
+	header: string;
+	lastUsedWindowSeconds: number;
+};
 type WorkloadTrustedIdpDescription = {
 	issuer: string;
 	jwksUri: string;
@@ -2381,7 +2350,7 @@ type TmDescription = ModuleDescriptionBase<"tm"> & {
 	/** Effective `action_required` request-token lifetime, including the one-hour default. */
 	requestTokenTtlSeconds: number;
 };
-type ModuleDescription = SsoDescription | CiamDescription | IamDescription | WorkloadDescription | SecretsDescription | KmsDescription | OtelDescription | AuthzDescription | TmDescription;
+type ModuleDescription = SsoDescription | CiamDescription | IamDescription | DelegateDescription | WorkloadDescription | SecretsDescription | KmsDescription | OtelDescription | AuthzDescription | TmDescription;
 type IoniteDescription = {
 	id?: string;
 	sdk: {
@@ -2397,6 +2366,68 @@ type IoniteDescription = {
 		description?: ModuleDescription;
 	}>;
 };
+/** ConfigSource-owned delegate authentication and usage-touch intent. */
+type RemoteDelegateConfig = {
+	enabled?: boolean;
+	/** Coarse minimum interval between usage timestamp writes. Defaults to one hour. */
+	lastUsedWindowSeconds?: number;
+};
+/** Application-owned delegate credential storage and request-header wiring. */
+type FrameworkDelegateConfig = {
+	delegateStore?: DelegateStore;
+	/** Header carrying delegate credentials. Defaults to `authorization`. */
+	header?: string;
+};
+/** Stable top-level delegate authentication handle. */
+type Delegate = {
+	/** Secret-free, JSON-serializable configuration and readiness summary. */
+	describe(): DelegateDescription;
+	/** True when delegate authentication is active and a delegate store is wired. */
+	isReady(): boolean;
+	/** Resolves when delegate authentication next becomes ready. */
+	ready(timeout?: number): Promise<void>;
+	/** True when the request presents an `ion_dlg_` credential, whether or not the module is ready. */
+	hasCredential(request: Request): boolean;
+	/** Resolves a valid delegate credential to its owner principal with delegate context attached. */
+	resolve(request: Request): Promise<AuthenticatedPrincipal | undefined>;
+};
+import { StandardSchemaV1 as StandardSchemaV15 } from "@standard-schema/spec";
+type ScimPatchOperation = {
+	op: string;
+	path?: string;
+	value?: unknown;
+};
+type ScimPatchErrorType = "invalidPath" | "invalidFilter" | "noTarget" | "invalidValue" | "invalidSyntax";
+/** Built-in inbound SCIM provider types. `scim` is a strictly conformant client (no normalization). */
+type IAMProviderType = "scim" | "entra" | "okta" | "sailpoint";
+/** A single inbound SCIM provider declaration (ConfigSource-only). */
+type IAMProviderConfig = {
+	/** Provider adapter type. Selects the request normalizer. */
+	type: IAMProviderType;
+	/** Whether this entry is active. Defaults to true when omitted. */
+	enabled?: boolean;
+	/**
+	* Workload client ids whose inbound SCIM calls this entry covers, compared against the validated
+	* token's `client_id`, then `azp`, then `sub` (the SDK's canonical workload id order).
+	*/
+	clientIds: string[];
+	/** Optional display metadata for operator UIs. */
+	branding?: {
+		displayName: string;
+		iconUrl?: string;
+	};
+};
+/**
+* The name Entra uses for the ion User extension. Entra's SCIM client sends a custom extension in create
+* POSTs only when it is named `urn:ietf:params:scim:schemas:extension:<Name>:2.0:User`; it omits
+* `ION_SCIM_USER_EXTENSION_URN` from creates and sends it only on later PATCHes, so an Entra-provisioned
+* account would arrive without its ECID until the next sync. Measured in the iosite sandbox. Map Entra
+* attributes to this name; the `entra` preset translates it to the canonical URN inbound and back on
+* responses, so Entra's GET-based drift check compares like with like. Entra-only: `urn:ietf:params:scim:`
+* is IANA-managed (RFC 7643 §10) and not part of the general contract.
+* https://learn.microsoft.com/entra/identity/app-provisioning/customize-application-attributes
+*/
+declare const ENTRA_ION_EXTENSION_URN = "urn:ietf:params:scim:schemas:extension:ionite:2.0:User";
 import { StandardSchemaV1 as StandardSchemaV14 } from "@standard-schema/spec";
 /**
 * Token caching for workload identity authentication.
@@ -2923,10 +2954,6 @@ type IAMConfig = {
 	* Store for inbound customer provisioning. When configured, `/Customers` is served.
 	*/
 	customerStore?: CustomerStore;
-	/** Store for IAM-governed delegate principals. When configured, `/Delegates` is served. */
-	delegateStore?: DelegateStore;
-	/** FrameworkConfig-only header carrying delegate credentials. Defaults to `authorization`. */
-	delegateHeader?: string;
 	/**
 	* Destination-only hook for `POST /AccessRequests`. Apps that are not IAM destinations omit this
 	* and the endpoint returns 404.
@@ -2978,11 +3005,8 @@ type IAMConfig = {
 	* consumed by {@link Authz.grant}. `delta` is the Ops-owned per-kind egress mode.
 	*/
 	customers?: IamPrincipalKindFlag;
-	/** RemoteConfig intent for delegate principals. */
-	delegates?: IamPrincipalKindFlag & {
-		/** Coarse minimum interval between usage timestamp writes. Defaults to one hour. */
-		lastUsedWindowSeconds?: number;
-	};
+	/** RemoteConfig intent for delegate governance. Authentication intent lives at `RemoteConfig.delegate`. */
+	delegates?: IamPrincipalKindFlag;
 	/**
 	* RemoteConfig intent flag for the inbound SCIM Groups endpoint. Set by Ops/ECI via the
 	* ConfigSource; not configurable from application code. Effective availability also requires an
@@ -3305,9 +3329,7 @@ type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "delegates" | "
 	users: IamPrincipalKind;
 	workloads: IamPrincipalKind;
 	customers: IamPrincipalKind;
-	delegates: IamPrincipalKind & {
-		lastUsedWindowSeconds: number;
-	};
+	delegates: IamPrincipalKind;
 	groups: {
 		enabled: boolean;
 	};
@@ -3340,14 +3362,6 @@ type IAM = Omit<IAMConfig, "users" | "workloads" | "customers" | "delegates" | "
 	customers_inbound?: IAMPrincipalsInbound;
 	delegates_inbound?: IAMPrincipalsInbound;
 	/**
-	* True when the request presents a delegate credential (`ion_dlg_` on `delegateHeader`), valid or
-	* not. Present only when delegates are enabled and a `delegateStore` is wired. A request that
-	* presents one never falls back to a session or workload token.
-	*/
-	hasDelegateCredential?: (request: Request) => boolean;
-	/** Resolve a delegate credential to its owner principal, with delegate context attached. */
-	resolveDelegate?: (request: Request) => Promise<AuthenticatedPrincipal | undefined>;
-	/**
 	* Framework-agnostic request handler for the IAM module.
 	* Routes to discovery, users_inbound, groups_inbound, or principal-kind inbound based on path.
 	*/
@@ -4793,6 +4807,8 @@ type ConfigSourceOrigin = {
 	from?: ConfigSourceOrigin;
 };
 type ConfigSourceEnv = {
+	LEO_URL?: string;
+	LEO_TOKEN?: string;
 	ION_CONFIG_TYPE?: ConfigSourceType;
 	ION_VAULT_URL?: string;
 	ION_VAULT_TOKEN?: string;
@@ -5042,6 +5058,7 @@ type FrameworkConfig = {
 	log?: Logger;
 	sso?: SSOConfig | null;
 	iam?: IAMConfig | null;
+	delegate?: FrameworkDelegateConfig | null;
 	workload?: FrameworkWorkloadConfig | null;
 	secrets?: FrameworkSecretsModuleConfig | null;
 	/** Framework-only LFV callback wiring (`callbackTransport` and/or `singleProcess`). */
@@ -5094,6 +5111,8 @@ type RemoteConfig = {
 	id: string;
 	sso?: SSOConfig;
 	iam?: IAMConfig;
+	/** Delegate authentication intent and usage-touch policy. */
+	delegate?: RemoteDelegateConfig;
 	/**
 	* Workload: single config, or incoming/outgoing (server vs client roles), or flat map of named clients.
 	* Preferred: { incoming: { jwksUri, issuer }, outgoing: { TNT_*: { clientId, ... } } }.
@@ -5598,6 +5617,8 @@ type IoniteBase = {
 	kms?: Kms;
 	sso?: SSO;
 	iam?: IAM;
+	/** Stable delegate authentication handle, including while inactive or awaiting its store. */
+	delegate: Delegate;
 	workload?: Workload | AggregateWorkload;
 	ciam?: CIAM;
 	tm?: TenantManagement;
@@ -7418,4 +7439,4 @@ declare function generateULID(prefix?: string): string;
 * `vaultTtl` is HTTP-only.
 */
 declare function vaultConfigLocatorTransportError(locator: Record<string, unknown>): string | undefined;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, AccessSubject, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseDelegate, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DelegateContext, DelegateOwner, DelegateOwnerType, DelegateStore, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundDelegatesConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_DELEGATES_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_DELEGATE_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimDelegate, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, accessSubjectId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, delegateResourceSchema, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, AccessSubject, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseDelegate, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, Delegate, DelegateContext, DelegateDescription, DelegateOwner, DelegateOwnerType, DelegateStore, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkDelegateConfig, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundDelegatesConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_DELEGATES_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_DELEGATE_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteDelegateConfig, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimDelegate, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, accessSubjectId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, delegateResourceSchema, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{ee,He,p,x,E,P,c,n,te,K,u,Fe,ne,y,t,Je,h,U,re,Le,qe,Ye,$e,W,V,A,z,se,B,r,f,Ze,G,Qe,et,tt,ie,ae,H,ce,be,Te,g,F,Ke,J,_,O,Y,We,M,Ve,nt,rt,j,o,S,k,b,st,ot,le,pe,me,N,Ae,Re,Ie,ve,xe,Ee,Pe,Ue,De,_e,Oe,fe,it,ge,ye,T,a,at,L,Me,je,l,he,ct,ut,i,R,w,dt,lt,ze,Z,d,m,e,Se,pt,Be,mt,I,C,ft,gt,Q,yt,v,q,Ne,ht}from"./shared/core-npxeanaf.js";var Vt="0.0.24-beta.20261022.44";class kt extends n{constructor(s,D){let X=D.kind==="connection"||D.kind==="timeout"||D.kind==="not_found";super(s,{cause:D.cause,status:X?503:500,upstreamStatus:D.status});this.name="ConfigSourceError";this.kind=D.kind,this.recoverable=D.recoverable,this.code=D.code,this.path=D.path,this.sourceType=D.sourceType}}function zt(s){return s instanceof kt}function Bt(s){let D=s?.trim();if(!D)return;try{let X=new URL(D),oe=X.pathname.replace(/\/+$/g,"");return`${X.protocol}//${X.host}${oe}`}catch{return}}function xt(s,D="ion.config.source"){if(!s)return{};let X={[`${D}.type`]:s.type};if(s.transport)X[`${D}.transport`]=s.transport;if(s.url)X[`${D}.url`]=s.url;if(s.path)X[`${D}.path`]=s.path;if(s.from)Object.assign(X,xt(s.from,`${D}.from`));return X}var Gt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function _t(s){if(s===null||typeof s!=="object")return s;let D={};for(let[X,oe]of Object.entries(s)){if(Gt.includes(X)||X==="validators"||X==="setStores")continue;D[X]=oe!==null&&typeof oe==="object"&&!Array.isArray(oe)&&Object.getPrototypeOf(oe)===Object.prototype?_t(oe):oe}return D}function Ht(s){return _t(s)}function Rt(s,D){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${D} must be an object.`);return s}function St(s,D){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${D} must be a valid timestamp string.`);return s}function vt(s,D,X){if(!Array.isArray(s)||!X.allowEmpty&&s.length===0)throw Error(`${D} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let oe=new Set;return s.map((ue,de)=>{let Ce=Rt(ue,`${D} keys[${de}]`);if(typeof Ce.id!=="string"||Ce.id.length===0)throw Error(`${D} keys[${de}].id must be a non-empty string.`);if(oe.has(Ce.id))throw Error(`${D} contains duplicate key id "${Ce.id}".`);if(oe.add(Ce.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Ce.state)))throw Error(`${D} keys[${de}].state is invalid.`);if(Ce.value!==void 0&&(typeof Ce.value!=="string"||Ce.value.length===0))throw Error(`${D} keys[${de}].value must be a non-empty string when present.`);let we=Ce.meta===void 0?void 0:Rt(Ce.meta,`${D} keys[${de}].meta`);return{id:Ce.id,state:Ce.state,...Ce.value===void 0?{}:{value:Ce.value},...Ce.notBefore===void 0?{}:{notBefore:St(Ce.notBefore,`${D} keys[${de}].notBefore`)},...Ce.notAfter===void 0?{}:{notAfter:St(Ce.notAfter,`${D} keys[${de}].notAfter`)},...Ce.createdAt===void 0?{}:{createdAt:St(Ce.createdAt,`${D} keys[${de}].createdAt`)},...Ce.activatedAt===void 0?{}:{activatedAt:St(Ce.activatedAt,`${D} keys[${de}].activatedAt`)},...Ce.deprecatedAt===void 0?{}:{deprecatedAt:St(Ce.deprecatedAt,`${D} keys[${de}].deprecatedAt`)},...Ce.rotatedAt===void 0?{}:{rotatedAt:St(Ce.rotatedAt,`${D} keys[${de}].rotatedAt`)},...Ce.revokedAt===void 0?{}:{revokedAt:St(Ce.revokedAt,`${D} keys[${de}].revokedAt`)},...we?{meta:{...we}}:{}}})}function Yt(s,D,X){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${X} slots must be an array.`);let oe=new Set,ue=s.map((de,Ce)=>{if(de===null)return null;if(typeof de!=="string"||de.length===0)throw Error(`${X} slots[${Ce}] must be a non-empty key id or null.`);if(oe.has(de))throw Error(`${X} slots contain duplicate key id "${de}".`);oe.add(de);let we=D.find((ke)=>ke.id===de);if(!we)throw Error(`${X} slot key "${de}" is not present in keys.`);if(we.state!=="active")throw Error(`${X} slot key "${de}" must have state "active".`);if(!we.value)throw Error(`${X} slot key "${de}" must include a value.`);return de});if(D.length===0&&ue.some((de)=>de!==null))throw Error(`${X} slots must be omitted or all-null when keys is empty.`);return ue}function Jt(s){let X=Rt(s,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let oe=vt(X.keys,"KMS pool",{allowEmpty:!0}),ue=Yt(X.slots,oe,"KMS pool");return ue?{kind:"kms",slots:ue,keys:oe}:{kind:"kms",keys:oe}}function Xt(s){let X=Rt(s,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:vt(X.keys,"KMS pool control document",{allowEmpty:!0})}}var Zt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function Ot(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function Ct(s){let D=Ot(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(D)?D:JSON.stringify(D)}function Qt(s){return Ot(s).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function Pt(s,D,X){if(X==null)return;if(X instanceof Error){let oe=te(X);if(oe){for(let[ue,de]of Object.entries(oe))if(de!=null)s.push(`${ue}=${Ct(de)}`);return}if(s.push(`${D}.name=${Ct(X.name)}`),s.push(`${D}.message=${Ct(X.message)}`),X.stack)s.push(`${D}.stack=${Ct(X.stack)}`);return}s.push(`${D}=${Ct(X)}`)}function Tt(s,D,X=[],oe=new Date){let ue=Qt(D instanceof Error?D.message:D??""),de=[];for(let[Ce,we]of X.entries()){if(we&&typeof we==="object"&&!Array.isArray(we)&&!(we instanceof Error)&&Object.getPrototypeOf(we)===Object.prototype){for(let[ke,Xe]of Object.entries(we))Pt(de,ke,Xe);continue}Pt(de,`param.${Ce}`,we)}return[oe.toISOString(),Zt[s],ue,...de].filter(Boolean).join(" ")}var wt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},eo=wt,to={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},oo={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},ro={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},no={trace:()=>{},debug:(s,...D)=>globalThis.console.debug(Tt("debug",s,D)),info:(s,...D)=>globalThis.console.info(Tt("info",s,D)),warn:(s,...D)=>globalThis.console.warn(Tt("warn",s,D)),error:(s,...D)=>globalThis.console.error(Tt("error",s,D))};function so(s,D){if(typeof D!=="number"||D<=0)return s;return new Promise((X,oe)=>{let ue=setTimeout(()=>{oe(Error(`Authz catalog entry did not become ready within ${D}ms`))},D);s.then(()=>{clearTimeout(ue),X()},(de)=>{clearTimeout(ue),oe(de)})})}function io(s,D){let X=!1,oe,ue=D.then(()=>{X=!0},(Ce)=>{X=!1,oe=Ce}),de=s;return Object.defineProperty(de,"ready",{enumerable:!1,configurable:!0,value:(Ce)=>so(ue.then(()=>{if(!X)throw oe}),Ce)}),Object.defineProperty(de,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),de}var At=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:je,yaml:"application/yaml",toml:"application/toml",xml:Me});function It(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let D=s.mimeType?.trim()||At[s.format],X=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>X})}function ao(s="jsonc"){return{format:s,mimeType:At[s],typeId:s}}class Dt extends n{constructor(s,D){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${D.mimeType}" (${D.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=D}}var po=It({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Lt={beforeTenantSegments:["ui"]},Mt={beforeTenantSegments:["api"]};function Kt(s){return(s??[]).map((D)=>D.trim()).filter(Boolean)}function Nt(s){let D=s.trim();if(!D)return"/";let X=D.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function $t(s){return Nt(s).split("/").filter(Boolean)}function Et(s){return{beforeTenantSegments:Kt(s?.beforeTenantSegments),afterTenantSegments:Kt(s?.afterTenantSegments)}}function Ut(s){if(s?.type==="host")return{type:"host",baseDomain:bt(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:Et(s?.ui??Lt),api:Et(s?.api??Mt)}}function bt(s){let D=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!D)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return D}function co(s,D){let X=s.trim().replace(/\.$/,"").toLowerCase(),oe=bt(D);if(!X.endsWith(`.${oe}`))return null;let ue=X.slice(0,-(oe.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function uo(s,D){let X=Et(D),oe=X.beforeTenantSegments??[],ue=X.afterTenantSegments??[],de=$t(s),Ce=oe.length+1+ue.length;if(de.length<Ce)return null;for(let Ge=0;Ge<oe.length;Ge++)if(de[Ge]!==oe[Ge])return null;let we=oe.length,ke=de[we];if(!ke)return null;for(let Ge=0;Ge<ue.length;Ge++)if(de[we+1+Ge]!==ue[Ge])return null;let Xe=de.slice(we+1+ue.length);return{id:decodeURIComponent(ke),restSegments:Xe,restPath:Xe.length>0?`/${Xe.join("/")}`:"/"}}function Ft(s,D="/",X){let oe=Et(X),ue=oe.beforeTenantSegments??[],de=oe.afterTenantSegments??[],Ce=$t(D),we=[...ue,encodeURIComponent(s),...de,...Ce];return we.length>0?`/${we.join("/")}`:"/"}function mo(s,D="/",X,oe="ui"){let ue=Ut(X);if(ue.type==="host"||ue.type==="selector")return Nt(D);return Ft(s,D,ue[oe])}function lo(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={...X},de=["iss","sub"];for(let ke of de)if(ke in X){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if("aud"in X&&X.aud!==void 0){let ke=X.aud;if(typeof ke!=="string"&&!Array.isArray(ke))oe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ke)&&!ke.every((Xe)=>typeof Xe==="string"))oe.push({message:"aud array must contain only strings",path:["aud"]})}let Ce=["jti","scope"];for(let ke of Ce)if(ke in X&&X[ke]!==void 0){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}let we=["exp","iat"];for(let ke of we)if(ke in X){if(typeof X[ke]!=="number")oe.push({message:`${ke} must be a number`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function go(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={};if("access_token"in X)if(typeof X.access_token==="string")ue.access_token=X.access_token;else oe.push({message:"access_token must be a string",path:["access_token"]});else oe.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")ue.token_type=X.token_type;else oe.push({message:"token_type must be a string",path:["token_type"]});else oe.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)ue.scope=X.scope;else oe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)ue.refresh_token=X.refresh_token;else oe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)ue.expires=X.expires;else oe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)ue.expires_in=X.expires_in;else oe.push({message:"expires_in must be a number",path:["expires_in"]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function fo(s){let D=new Uint8Array(s);return crypto.getRandomValues(D),D}function yo(s){let D="",X=fo(s);for(let oe=0;oe<s;oe++){let ue=X[oe]%32;D+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return D}function So(s,D){let X="";for(let oe=D;oe>0;oe--){let ue=s%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+X,s=Math.floor(s/32)}return X}function Co(s){let D=Date.now(),X=So(D,10),oe=yo(16);return`${s??""}${X}${oe}`}var Wt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function qt(s){return typeof s==="string"&&s.trim().length>0}function To(s){let D=qt(s.vaultUrl)?s.vaultUrl:void 0,X=Object.keys(s).some((ue)=>ue.startsWith("vaultLfv")&&s[ue]!==void 0);if(D&&X)return"vaultUrl and vaultLfv* are mutually exclusive";if(!D&&!X)return;if(X){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(Wt.some((ue)=>!qt(s[ue])))return`LFV requires ${Wt.join(", ")}`;return}let oe;try{oe=new URL(D).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(oe==="http:"||oe==="https:")return;if(oe==="ws:"||oe==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{l as ACCEPT_JSON,ut as ACCEPT_OCTET_STREAM,he as ACCEPT_SCIM,ct as ACCEPT_XML,Le as AssignmentPolicyError,ne as CANONICAL_RISK_LEVELS,w as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,lt as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,dt as CONTENT_TYPE_XML,kt as ConfigSourceError,et as DEFAULT_DISCOVERED_COOKIE_MAX,tt as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Qe as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,At as DEFAULT_SECRET_MIME_TYPES,Mt as DEFAULT_TENANT_API_NAMESPACE,Lt as DEFAULT_TENANT_UI_NAMESPACE,ie as DISCOVERED_COOKIE_PREFIX,Ze as DISPLAY_COOKIE_SUFFIX,G as DISPLAY_COOKIE_VERSION,We as ECID_SCHEME,N as ENTRA_ION_EXTENSION_URN,M as EcidFormatError,L as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,_e as ION_AUTHZ_OAA_SYNC,Ue as ION_CAPABILITIEZ_READ,De as ION_CIAM_MAGIC_LINK_CREATE,it as ION_ENDPOINT_PERMISSIONS,Pe as ION_IAM_ACCESS_REQUESTS_WRITE,xe as ION_IAM_CUSTOMERS_WRITE,Ee as ION_IAM_DELEGATES_WRITE,Ie as ION_IAM_GROUPS_WRITE,Ae as ION_IAM_READ,Re as ION_IAM_USERS_WRITE,ve as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,b as ION_SCIM_DELEGATE_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,fe as ION_SDK_PERMISSIONS,Oe as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,E as KNOWN_BASE_CUSTOMER_KEYS,x as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,P as KNOWN_WORKLOAD_KEYS,je as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,at as SCIM_MEDIA_TYPE,Dt as SecretContentTypeMismatchError,v as StoreConflictError,Me as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,Je as accessSubjectId,j as assertEcid,re as assertRequiredSubjectType,U as assertValidSubjectTypeScoping,Ft as buildTenantPath,mo as buildTenantUrl,V as catalogEntityStore,Q as claimsToUser,_ as compareDisplayExpiryDesc,xt as configSourceOriginLogFields,He as configTrustedClientGrants,c as customAttributes,pe as customerResourceSchema,to as debugLogger,Ke as decodeDisplayCookie,yt as decodeUser,C as deepEqualPlain,be as defaultDisplayUser,eo as defaultLogger,ao as defaultSecretContentType,$e as defineCatalog,It as defineSecretType,me as delegateResourceSchema,se as deprecateRetiredCodeCatalogRows,Bt as describeOriginUrl,Y as discoveredProfileCookieName,F as encodeDisplayCookie,te as errorLogAttributes,nt as formatEcid,Tt as formatLogLine,Co as generateULID,W as getCodeCatalogEntity,ot as groupResourceSchema,T as idTokenClaimsSchema,oo as infoLogger,qe as isCodeCatalog,Ne as isConfigLocator,zt as isConfigSourceError,Ve as isEcid,ze as isJsonResponse,q as isStoreConflictError,lo as jwtAssertionClaimsSchema,K as list,u as listGenerator,co as matchTenantHost,uo as matchTenantPath,Fe as matchesListFilter,z as materializeCodeCatalogEntity,A as mergeCodeCatalogEntity,pt as mergeConfig,e as must,bt as normalizeTenantBaseDomain,Et as normalizeTenantPathNamespace,Ut as normalizeTenantRoutingStrategy,ge as oidcCallbackSchema,rt as parseEcid,mt as parseJsonc,Xt as parseKmsPoolControlDocument,Jt as parseKmsPoolDocument,no as prettyLogger,O as profileCookieName,g as projectDisplayUser,J as readDisplayCookies,d as readJsonResponse,io as readyCatalogEntry,po as remoteConfigSecretType,H as resolveDiscoveredCookieMax,ce as resolveDiscoveredCookieTtlSeconds,ae as resolveDisplayCookieMax,Te as sanitizeDisplayUser,Ht as serializeConfig,wt as silentLogger,ft as stableConfigHash,Be as stripJsonComments,ht as tmIntegrationState,Ye as toCodeCatalog,ye as tokenResponseSchema,I as trimTrailingSlash,ee as trustedClientPermissionsForPrincipal,Z as unexpectedBodySummary,B as unionCatalogRead,st as userSchema,Se as validationFailureResponse,To as vaultConfigLocatorTransportError,Vt as version,gt as waitOn,ro as warnLogger,m as withValidate,le as workloadResourceSchema,go as workloadTokenResponseSchema};
+import{ee,He,p,x,E,P,c,n,te,K,u,Fe,ne,y,t,Je,h,U,re,Le,$e,Ye,qe,W,V,A,z,se,B,r,f,Ze,G,Qe,et,tt,ie,ae,H,ce,be,Te,g,F,Ke,J,_,O,Y,We,M,Ve,nt,rt,j,o,S,k,b,st,ot,le,pe,me,N,Ae,Re,Ie,ve,xe,Ee,Pe,Ue,De,_e,Oe,fe,it,ge,ye,T,a,at,L,Me,je,l,he,ct,ut,i,R,w,dt,lt,ze,Z,d,m,e,Se,pt,Be,mt,I,C,ft,gt,Q,yt,v,q,Ne,ht}from"./shared/core-ec2wrd0t.js";var Vt="0.0.24-beta.20261024.46";class kt extends n{constructor(s,D){let X=D.kind==="connection"||D.kind==="timeout"||D.kind==="not_found";super(s,{cause:D.cause,status:X?503:500,upstreamStatus:D.status});this.name="ConfigSourceError";this.kind=D.kind,this.recoverable=D.recoverable,this.code=D.code,this.path=D.path,this.sourceType=D.sourceType}}function zt(s){return s instanceof kt}function Bt(s){let D=s?.trim();if(!D)return;try{let X=new URL(D),oe=X.pathname.replace(/\/+$/g,"");return`${X.protocol}//${X.host}${oe}`}catch{return}}function xt(s,D="ion.config.source"){if(!s)return{};let X={[`${D}.type`]:s.type};if(s.transport)X[`${D}.transport`]=s.transport;if(s.url)X[`${D}.url`]=s.url;if(s.path)X[`${D}.path`]=s.path;if(s.from)Object.assign(X,xt(s.from,`${D}.from`));return X}var Gt=["sessionStore","userStore","customerStore","delegateStore","accessStore","tokenStore","magicLinkStore","store"];function _t(s){if(s===null||typeof s!=="object")return s;let D={};for(let[X,oe]of Object.entries(s)){if(Gt.includes(X)||X==="validators"||X==="setStores")continue;D[X]=oe!==null&&typeof oe==="object"&&!Array.isArray(oe)&&Object.getPrototypeOf(oe)===Object.prototype?_t(oe):oe}return D}function Ht(s){return _t(s)}function Rt(s,D){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${D} must be an object.`);return s}function St(s,D){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${D} must be a valid timestamp string.`);return s}function vt(s,D,X){if(!Array.isArray(s)||!X.allowEmpty&&s.length===0)throw Error(`${D} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let oe=new Set;return s.map((ue,de)=>{let Ce=Rt(ue,`${D} keys[${de}]`);if(typeof Ce.id!=="string"||Ce.id.length===0)throw Error(`${D} keys[${de}].id must be a non-empty string.`);if(oe.has(Ce.id))throw Error(`${D} contains duplicate key id "${Ce.id}".`);if(oe.add(Ce.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Ce.state)))throw Error(`${D} keys[${de}].state is invalid.`);if(Ce.value!==void 0&&(typeof Ce.value!=="string"||Ce.value.length===0))throw Error(`${D} keys[${de}].value must be a non-empty string when present.`);let we=Ce.meta===void 0?void 0:Rt(Ce.meta,`${D} keys[${de}].meta`);return{id:Ce.id,state:Ce.state,...Ce.value===void 0?{}:{value:Ce.value},...Ce.notBefore===void 0?{}:{notBefore:St(Ce.notBefore,`${D} keys[${de}].notBefore`)},...Ce.notAfter===void 0?{}:{notAfter:St(Ce.notAfter,`${D} keys[${de}].notAfter`)},...Ce.createdAt===void 0?{}:{createdAt:St(Ce.createdAt,`${D} keys[${de}].createdAt`)},...Ce.activatedAt===void 0?{}:{activatedAt:St(Ce.activatedAt,`${D} keys[${de}].activatedAt`)},...Ce.deprecatedAt===void 0?{}:{deprecatedAt:St(Ce.deprecatedAt,`${D} keys[${de}].deprecatedAt`)},...Ce.rotatedAt===void 0?{}:{rotatedAt:St(Ce.rotatedAt,`${D} keys[${de}].rotatedAt`)},...Ce.revokedAt===void 0?{}:{revokedAt:St(Ce.revokedAt,`${D} keys[${de}].revokedAt`)},...we?{meta:{...we}}:{}}})}function Yt(s,D,X){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${X} slots must be an array.`);let oe=new Set,ue=s.map((de,Ce)=>{if(de===null)return null;if(typeof de!=="string"||de.length===0)throw Error(`${X} slots[${Ce}] must be a non-empty key id or null.`);if(oe.has(de))throw Error(`${X} slots contain duplicate key id "${de}".`);oe.add(de);let we=D.find((ke)=>ke.id===de);if(!we)throw Error(`${X} slot key "${de}" is not present in keys.`);if(we.state!=="active")throw Error(`${X} slot key "${de}" must have state "active".`);if(!we.value)throw Error(`${X} slot key "${de}" must include a value.`);return de});if(D.length===0&&ue.some((de)=>de!==null))throw Error(`${X} slots must be omitted or all-null when keys is empty.`);return ue}function Jt(s){let X=Rt(s,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let oe=vt(X.keys,"KMS pool",{allowEmpty:!0}),ue=Yt(X.slots,oe,"KMS pool");return ue?{kind:"kms",slots:ue,keys:oe}:{kind:"kms",keys:oe}}function Xt(s){let X=Rt(s,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:vt(X.keys,"KMS pool control document",{allowEmpty:!0})}}var Zt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function Ot(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function Ct(s){let D=Ot(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(D)?D:JSON.stringify(D)}function Qt(s){return Ot(s).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function Pt(s,D,X){if(X==null)return;if(X instanceof Error){let oe=te(X);if(oe){for(let[ue,de]of Object.entries(oe))if(de!=null)s.push(`${ue}=${Ct(de)}`);return}if(s.push(`${D}.name=${Ct(X.name)}`),s.push(`${D}.message=${Ct(X.message)}`),X.stack)s.push(`${D}.stack=${Ct(X.stack)}`);return}s.push(`${D}=${Ct(X)}`)}function Tt(s,D,X=[],oe=new Date){let ue=Qt(D instanceof Error?D.message:D??""),de=[];for(let[Ce,we]of X.entries()){if(we&&typeof we==="object"&&!Array.isArray(we)&&!(we instanceof Error)&&Object.getPrototypeOf(we)===Object.prototype){for(let[ke,Xe]of Object.entries(we))Pt(de,ke,Xe);continue}Pt(de,`param.${Ce}`,we)}return[oe.toISOString(),Zt[s],ue,...de].filter(Boolean).join(" ")}var wt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},eo=wt,to={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},oo={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},ro={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},no={trace:()=>{},debug:(s,...D)=>globalThis.console.debug(Tt("debug",s,D)),info:(s,...D)=>globalThis.console.info(Tt("info",s,D)),warn:(s,...D)=>globalThis.console.warn(Tt("warn",s,D)),error:(s,...D)=>globalThis.console.error(Tt("error",s,D))};function so(s,D){if(typeof D!=="number"||D<=0)return s;return new Promise((X,oe)=>{let ue=setTimeout(()=>{oe(Error(`Authz catalog entry did not become ready within ${D}ms`))},D);s.then(()=>{clearTimeout(ue),X()},(de)=>{clearTimeout(ue),oe(de)})})}function io(s,D){let X=!1,oe,ue=D.then(()=>{X=!0},(Ce)=>{X=!1,oe=Ce}),de=s;return Object.defineProperty(de,"ready",{enumerable:!1,configurable:!0,value:(Ce)=>so(ue.then(()=>{if(!X)throw oe}),Ce)}),Object.defineProperty(de,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),de}var At=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:je,yaml:"application/yaml",toml:"application/toml",xml:Me});function It(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let D=s.mimeType?.trim()||At[s.format],X=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>X})}function ao(s="jsonc"){return{format:s,mimeType:At[s],typeId:s}}class Dt extends n{constructor(s,D){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${D.mimeType}" (${D.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=D}}var po=It({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Lt={beforeTenantSegments:["ui"]},Mt={beforeTenantSegments:["api"]};function Kt(s){return(s??[]).map((D)=>D.trim()).filter(Boolean)}function Nt(s){let D=s.trim();if(!D)return"/";let X=D.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function $t(s){return Nt(s).split("/").filter(Boolean)}function Et(s){return{beforeTenantSegments:Kt(s?.beforeTenantSegments),afterTenantSegments:Kt(s?.afterTenantSegments)}}function Ut(s){if(s?.type==="host")return{type:"host",baseDomain:bt(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:Et(s?.ui??Lt),api:Et(s?.api??Mt)}}function bt(s){let D=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!D)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return D}function co(s,D){let X=s.trim().replace(/\.$/,"").toLowerCase(),oe=bt(D);if(!X.endsWith(`.${oe}`))return null;let ue=X.slice(0,-(oe.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function mo(s,D){let X=Et(D),oe=X.beforeTenantSegments??[],ue=X.afterTenantSegments??[],de=$t(s),Ce=oe.length+1+ue.length;if(de.length<Ce)return null;for(let Ge=0;Ge<oe.length;Ge++)if(de[Ge]!==oe[Ge])return null;let we=oe.length,ke=de[we];if(!ke)return null;for(let Ge=0;Ge<ue.length;Ge++)if(de[we+1+Ge]!==ue[Ge])return null;let Xe=de.slice(we+1+ue.length);return{id:decodeURIComponent(ke),restSegments:Xe,restPath:Xe.length>0?`/${Xe.join("/")}`:"/"}}function Ft(s,D="/",X){let oe=Et(X),ue=oe.beforeTenantSegments??[],de=oe.afterTenantSegments??[],Ce=$t(D),we=[...ue,encodeURIComponent(s),...de,...Ce];return we.length>0?`/${we.join("/")}`:"/"}function uo(s,D="/",X,oe="ui"){let ue=Ut(X);if(ue.type==="host"||ue.type==="selector")return Nt(D);return Ft(s,D,ue[oe])}function lo(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={...X},de=["iss","sub"];for(let ke of de)if(ke in X){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if("aud"in X&&X.aud!==void 0){let ke=X.aud;if(typeof ke!=="string"&&!Array.isArray(ke))oe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ke)&&!ke.every((Xe)=>typeof Xe==="string"))oe.push({message:"aud array must contain only strings",path:["aud"]})}let Ce=["jti","scope"];for(let ke of Ce)if(ke in X&&X[ke]!==void 0){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}let we=["exp","iat"];for(let ke of we)if(ke in X){if(typeof X[ke]!=="number")oe.push({message:`${ke} must be a number`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function go(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={};if("access_token"in X)if(typeof X.access_token==="string")ue.access_token=X.access_token;else oe.push({message:"access_token must be a string",path:["access_token"]});else oe.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")ue.token_type=X.token_type;else oe.push({message:"token_type must be a string",path:["token_type"]});else oe.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)ue.scope=X.scope;else oe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)ue.refresh_token=X.refresh_token;else oe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)ue.expires=X.expires;else oe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)ue.expires_in=X.expires_in;else oe.push({message:"expires_in must be a number",path:["expires_in"]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function fo(s){let D=new Uint8Array(s);return crypto.getRandomValues(D),D}function yo(s){let D="",X=fo(s);for(let oe=0;oe<s;oe++){let ue=X[oe]%32;D+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return D}function So(s,D){let X="";for(let oe=D;oe>0;oe--){let ue=s%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+X,s=Math.floor(s/32)}return X}function Co(s){let D=Date.now(),X=So(D,10),oe=yo(16);return`${s??""}${X}${oe}`}var Wt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function qt(s){return typeof s==="string"&&s.trim().length>0}function To(s){let D=qt(s.vaultUrl)?s.vaultUrl:void 0,X=Object.keys(s).some((ue)=>ue.startsWith("vaultLfv")&&s[ue]!==void 0);if(D&&X)return"vaultUrl and vaultLfv* are mutually exclusive";if(!D&&!X)return;if(X){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(Wt.some((ue)=>!qt(s[ue])))return`LFV requires ${Wt.join(", ")}`;return}let oe;try{oe=new URL(D).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(oe==="http:"||oe==="https:")return;if(oe==="ws:"||oe==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{l as ACCEPT_JSON,ut as ACCEPT_OCTET_STREAM,he as ACCEPT_SCIM,ct as ACCEPT_XML,Le as AssignmentPolicyError,ne as CANONICAL_RISK_LEVELS,w as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,lt as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,dt as CONTENT_TYPE_XML,kt as ConfigSourceError,et as DEFAULT_DISCOVERED_COOKIE_MAX,tt as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Qe as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,At as DEFAULT_SECRET_MIME_TYPES,Mt as DEFAULT_TENANT_API_NAMESPACE,Lt as DEFAULT_TENANT_UI_NAMESPACE,ie as DISCOVERED_COOKIE_PREFIX,Ze as DISPLAY_COOKIE_SUFFIX,G as DISPLAY_COOKIE_VERSION,We as ECID_SCHEME,N as ENTRA_ION_EXTENSION_URN,M as EcidFormatError,L as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,_e as ION_AUTHZ_OAA_SYNC,Ue as ION_CAPABILITIEZ_READ,De as ION_CIAM_MAGIC_LINK_CREATE,it as ION_ENDPOINT_PERMISSIONS,Pe as ION_IAM_ACCESS_REQUESTS_WRITE,xe as ION_IAM_CUSTOMERS_WRITE,Ee as ION_IAM_DELEGATES_WRITE,Ie as ION_IAM_GROUPS_WRITE,Ae as ION_IAM_READ,Re as ION_IAM_USERS_WRITE,ve as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,b as ION_SCIM_DELEGATE_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,fe as ION_SDK_PERMISSIONS,Oe as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,E as KNOWN_BASE_CUSTOMER_KEYS,x as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,P as KNOWN_WORKLOAD_KEYS,je as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,at as SCIM_MEDIA_TYPE,Dt as SecretContentTypeMismatchError,v as StoreConflictError,Me as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,Je as accessSubjectId,j as assertEcid,re as assertRequiredSubjectType,U as assertValidSubjectTypeScoping,Ft as buildTenantPath,uo as buildTenantUrl,V as catalogEntityStore,Q as claimsToUser,_ as compareDisplayExpiryDesc,xt as configSourceOriginLogFields,He as configTrustedClientGrants,c as customAttributes,pe as customerResourceSchema,to as debugLogger,Ke as decodeDisplayCookie,yt as decodeUser,C as deepEqualPlain,be as defaultDisplayUser,eo as defaultLogger,ao as defaultSecretContentType,qe as defineCatalog,It as defineSecretType,me as delegateResourceSchema,se as deprecateRetiredCodeCatalogRows,Bt as describeOriginUrl,Y as discoveredProfileCookieName,F as encodeDisplayCookie,te as errorLogAttributes,nt as formatEcid,Tt as formatLogLine,Co as generateULID,W as getCodeCatalogEntity,ot as groupResourceSchema,T as idTokenClaimsSchema,oo as infoLogger,$e as isCodeCatalog,Ne as isConfigLocator,zt as isConfigSourceError,Ve as isEcid,ze as isJsonResponse,q as isStoreConflictError,lo as jwtAssertionClaimsSchema,K as list,u as listGenerator,co as matchTenantHost,mo as matchTenantPath,Fe as matchesListFilter,z as materializeCodeCatalogEntity,A as mergeCodeCatalogEntity,pt as mergeConfig,e as must,bt as normalizeTenantBaseDomain,Et as normalizeTenantPathNamespace,Ut as normalizeTenantRoutingStrategy,ge as oidcCallbackSchema,rt as parseEcid,mt as parseJsonc,Xt as parseKmsPoolControlDocument,Jt as parseKmsPoolDocument,no as prettyLogger,O as profileCookieName,g as projectDisplayUser,J as readDisplayCookies,d as readJsonResponse,io as readyCatalogEntry,po as remoteConfigSecretType,H as resolveDiscoveredCookieMax,ce as resolveDiscoveredCookieTtlSeconds,ae as resolveDisplayCookieMax,Te as sanitizeDisplayUser,Ht as serializeConfig,wt as silentLogger,ft as stableConfigHash,Be as stripJsonComments,ht as tmIntegrationState,Ye as toCodeCatalog,ye as tokenResponseSchema,I as trimTrailingSlash,ee as trustedClientPermissionsForPrincipal,Z as unexpectedBodySummary,B as unionCatalogRead,st as userSchema,Se as validationFailureResponse,To as vaultConfigLocatorTransportError,Vt as version,gt as waitOn,ro as warnLogger,m as withValidate,le as workloadResourceSchema,go as workloadTokenResponseSchema};