@ionite/core 0.0.24-beta.20261024.46 → 0.0.24-beta.20261024.47

package/dist/index.d.ts

@@ -5913,7 +5913,7 @@ type TmIoniteConfig = {
 	url: string;
 	/** Required `iss` claim on ionite-signed staged-request handles and ionite workload tokens. */
 	issuer: string;
-	/** ionite JWKS endpoint used to verify signed staged-request handles. */
+	/** ionite JWKS endpoint used to verify signed staged-request handles and TM access tokens. */
 	jwksUri: string;
 	/** Required `aud` claim binding an ionite-staged request to this App. */
 	audience: string;
@@ -5922,6 +5922,25 @@ type TmIoniteConfig = {
 	/** Named outgoing workload client that authenticates every `ion.tm.sendWebhook` call to ionite. */
 	webhookClient?: string;
 };
+/**
+* JOSE `typ` header every staged-request handle MUST carry (RFC 8725 §3.11). Handles and TM access
+* tokens share one issuer, key, and audience (`tm.ionite`), and handles ride a browser URL, so this
+* header is the only thing keeping a handle from being accepted as a TM bearer: `ion.tm` requires it
+* on handles and rejects it on every workload-authenticated route.
+*/
+declare const TM_STAGED_HANDLE_TYP = "ion-tm-handle+jwt";
+/**
+* Prefix of the opaque reference `integrations/stage` returns (RFC 9126 §2.2 `request_uri`). ionite
+* pushes the signed handle over the workload-authenticated back channel and sends the browser only
+* this reference, so the JWT and its claims never reach browser history, `Referer`, or access logs.
+*/
+declare const TM_REQUEST_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+/** A pushed staged request: the verified handle behind one `request_uri`, kept App-side until it expires. */
+type StagedRequestRecord = {
+	handle: string;
+	/** The handle's own expiry; stores MUST NOT return the record after it. */
+	expiresAt: string;
+};
 type RemoteTmConfig = {
 	enabled: true;
 	ionite: TmIoniteConfig;
@@ -5933,8 +5952,8 @@ type RemoteTmConfig = {
 	*/
 	requestTokenTtlSeconds?: number;
 };
+/** What `onConnectRequest` sees. The signed handle is deliberately absent: no App API takes it. */
 type StagedIntegration = {
-	handle: string;
 	ioniteName?: string;
 	ioniteId: string;
 	productId: string;
@@ -5943,6 +5962,11 @@ type StagedIntegration = {
 	expiresAt: string;
 	requestId: string;
 	tenantHint?: string;
+	/**
+	* The pushed `request_uri` the browser arrived with. Put this in any URL the App builds for its
+	* consent page, and pass it to `recordConsent`.
+	*/
+	requestUri: string;
 };
 type ConnectRequestContext<TTenant extends BaseTenant = BaseTenant> = {
 	request: Request;
@@ -6008,7 +6032,8 @@ type FrameworkTmConfig<TTenant extends BaseTenant = BaseTenant> = {
 	}) => unknown;
 };
 type RecordTenantConsentInput = {
-	handle: string;
+	/** `staged.requestUri` from `onConnectRequest`. */
+	requestUri: string;
 	tenantId: string;
 	decision: "consented" | "declined";
 	decidedBy?: string;
@@ -6113,6 +6138,15 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
+	/**
+	* Pushed staged requests, keyed by the SHA-256 digest of their `request_uri`. Consent (stage,
+	* authorize, `recordConsent`) needs these two plus `setIntegration`/`getByIntegrationHandleHash`
+	* and answers 501 without them; redeem and need only that integration pair. `getStagedRequest` MUST return `undefined` once
+	* `record.expiresAt` has passed, and must be shared across App replicas: ionite pushes to one and
+	* the browser may reach another.
+	*/
+	setStagedRequest?(requestUriHash: string, record: StagedRequestRecord): Promise<void>;
+	getStagedRequest?(requestUriHash: string): Promise<StagedRequestRecord | undefined>;
 	/** Indexed lookup by the SHA-256 digest of an App onboarding request token. */
 	getByRequestTokenHash?(requestTokenHash: string): Promise<TTenant | undefined>;
 	/**
@@ -7439,4 +7473,4 @@ declare function generateULID(prefix?: string): string;
 * `vaultTtl` is HTTP-only.
 */
 declare function vaultConfigLocatorTransportError(locator: Record<string, unknown>): string | undefined;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, AccessSubject, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseDelegate, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, Delegate, DelegateContext, DelegateDescription, DelegateOwner, DelegateOwnerType, DelegateStore, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkDelegateConfig, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundDelegatesConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_DELEGATES_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_DELEGATE_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteDelegateConfig, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimDelegate, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, accessSubjectId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, delegateResourceSchema, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, AccessSubject, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseDelegate, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, Delegate, DelegateContext, DelegateDescription, DelegateOwner, DelegateOwnerType, DelegateStore, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkDelegateConfig, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundDelegatesConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_DELEGATES_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_DELEGATE_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteDelegateConfig, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimDelegate, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StagedRequestRecord, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TM_REQUEST_URI_PREFIX, TM_STAGED_HANDLE_TYP, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, accessSubjectId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, delegateResourceSchema, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{ee,He,p,x,E,P,c,n,te,K,u,Fe,ne,y,t,Je,h,U,re,Le,$e,Ye,qe,W,V,A,z,se,B,r,f,Ze,G,Qe,et,tt,ie,ae,H,ce,be,Te,g,F,Ke,J,_,O,Y,We,M,Ve,nt,rt,j,o,S,k,b,st,ot,le,pe,me,N,Ae,Re,Ie,ve,xe,Ee,Pe,Ue,De,_e,Oe,fe,it,ge,ye,T,a,at,L,Me,je,l,he,ct,ut,i,R,w,dt,lt,ze,Z,d,m,e,Se,pt,Be,mt,I,C,ft,gt,Q,yt,v,q,Ne,ht}from"./shared/core-ec2wrd0t.js";var Vt="0.0.24-beta.20261024.46";class kt extends n{constructor(s,D){let X=D.kind==="connection"||D.kind==="timeout"||D.kind==="not_found";super(s,{cause:D.cause,status:X?503:500,upstreamStatus:D.status});this.name="ConfigSourceError";this.kind=D.kind,this.recoverable=D.recoverable,this.code=D.code,this.path=D.path,this.sourceType=D.sourceType}}function zt(s){return s instanceof kt}function Bt(s){let D=s?.trim();if(!D)return;try{let X=new URL(D),oe=X.pathname.replace(/\/+$/g,"");return`${X.protocol}//${X.host}${oe}`}catch{return}}function xt(s,D="ion.config.source"){if(!s)return{};let X={[`${D}.type`]:s.type};if(s.transport)X[`${D}.transport`]=s.transport;if(s.url)X[`${D}.url`]=s.url;if(s.path)X[`${D}.path`]=s.path;if(s.from)Object.assign(X,xt(s.from,`${D}.from`));return X}var Gt=["sessionStore","userStore","customerStore","delegateStore","accessStore","tokenStore","magicLinkStore","store"];function _t(s){if(s===null||typeof s!=="object")return s;let D={};for(let[X,oe]of Object.entries(s)){if(Gt.includes(X)||X==="validators"||X==="setStores")continue;D[X]=oe!==null&&typeof oe==="object"&&!Array.isArray(oe)&&Object.getPrototypeOf(oe)===Object.prototype?_t(oe):oe}return D}function Ht(s){return _t(s)}function Rt(s,D){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${D} must be an object.`);return s}function St(s,D){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${D} must be a valid timestamp string.`);return s}function vt(s,D,X){if(!Array.isArray(s)||!X.allowEmpty&&s.length===0)throw Error(`${D} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let oe=new Set;return s.map((ue,de)=>{let Ce=Rt(ue,`${D} keys[${de}]`);if(typeof Ce.id!=="string"||Ce.id.length===0)throw Error(`${D} keys[${de}].id must be a non-empty string.`);if(oe.has(Ce.id))throw Error(`${D} contains duplicate key id "${Ce.id}".`);if(oe.add(Ce.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Ce.state)))throw Error(`${D} keys[${de}].state is invalid.`);if(Ce.value!==void 0&&(typeof Ce.value!=="string"||Ce.value.length===0))throw Error(`${D} keys[${de}].value must be a non-empty string when present.`);let we=Ce.meta===void 0?void 0:Rt(Ce.meta,`${D} keys[${de}].meta`);return{id:Ce.id,state:Ce.state,...Ce.value===void 0?{}:{value:Ce.value},...Ce.notBefore===void 0?{}:{notBefore:St(Ce.notBefore,`${D} keys[${de}].notBefore`)},...Ce.notAfter===void 0?{}:{notAfter:St(Ce.notAfter,`${D} keys[${de}].notAfter`)},...Ce.createdAt===void 0?{}:{createdAt:St(Ce.createdAt,`${D} keys[${de}].createdAt`)},...Ce.activatedAt===void 0?{}:{activatedAt:St(Ce.activatedAt,`${D} keys[${de}].activatedAt`)},...Ce.deprecatedAt===void 0?{}:{deprecatedAt:St(Ce.deprecatedAt,`${D} keys[${de}].deprecatedAt`)},...Ce.rotatedAt===void 0?{}:{rotatedAt:St(Ce.rotatedAt,`${D} keys[${de}].rotatedAt`)},...Ce.revokedAt===void 0?{}:{revokedAt:St(Ce.revokedAt,`${D} keys[${de}].revokedAt`)},...we?{meta:{...we}}:{}}})}function Yt(s,D,X){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${X} slots must be an array.`);let oe=new Set,ue=s.map((de,Ce)=>{if(de===null)return null;if(typeof de!=="string"||de.length===0)throw Error(`${X} slots[${Ce}] must be a non-empty key id or null.`);if(oe.has(de))throw Error(`${X} slots contain duplicate key id "${de}".`);oe.add(de);let we=D.find((ke)=>ke.id===de);if(!we)throw Error(`${X} slot key "${de}" is not present in keys.`);if(we.state!=="active")throw Error(`${X} slot key "${de}" must have state "active".`);if(!we.value)throw Error(`${X} slot key "${de}" must include a value.`);return de});if(D.length===0&&ue.some((de)=>de!==null))throw Error(`${X} slots must be omitted or all-null when keys is empty.`);return ue}function Jt(s){let X=Rt(s,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let oe=vt(X.keys,"KMS pool",{allowEmpty:!0}),ue=Yt(X.slots,oe,"KMS pool");return ue?{kind:"kms",slots:ue,keys:oe}:{kind:"kms",keys:oe}}function Xt(s){let X=Rt(s,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:vt(X.keys,"KMS pool control document",{allowEmpty:!0})}}var Zt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function Ot(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function Ct(s){let D=Ot(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(D)?D:JSON.stringify(D)}function Qt(s){return Ot(s).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function Pt(s,D,X){if(X==null)return;if(X instanceof Error){let oe=te(X);if(oe){for(let[ue,de]of Object.entries(oe))if(de!=null)s.push(`${ue}=${Ct(de)}`);return}if(s.push(`${D}.name=${Ct(X.name)}`),s.push(`${D}.message=${Ct(X.message)}`),X.stack)s.push(`${D}.stack=${Ct(X.stack)}`);return}s.push(`${D}=${Ct(X)}`)}function Tt(s,D,X=[],oe=new Date){let ue=Qt(D instanceof Error?D.message:D??""),de=[];for(let[Ce,we]of X.entries()){if(we&&typeof we==="object"&&!Array.isArray(we)&&!(we instanceof Error)&&Object.getPrototypeOf(we)===Object.prototype){for(let[ke,Xe]of Object.entries(we))Pt(de,ke,Xe);continue}Pt(de,`param.${Ce}`,we)}return[oe.toISOString(),Zt[s],ue,...de].filter(Boolean).join(" ")}var wt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},eo=wt,to={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},oo={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},ro={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},no={trace:()=>{},debug:(s,...D)=>globalThis.console.debug(Tt("debug",s,D)),info:(s,...D)=>globalThis.console.info(Tt("info",s,D)),warn:(s,...D)=>globalThis.console.warn(Tt("warn",s,D)),error:(s,...D)=>globalThis.console.error(Tt("error",s,D))};function so(s,D){if(typeof D!=="number"||D<=0)return s;return new Promise((X,oe)=>{let ue=setTimeout(()=>{oe(Error(`Authz catalog entry did not become ready within ${D}ms`))},D);s.then(()=>{clearTimeout(ue),X()},(de)=>{clearTimeout(ue),oe(de)})})}function io(s,D){let X=!1,oe,ue=D.then(()=>{X=!0},(Ce)=>{X=!1,oe=Ce}),de=s;return Object.defineProperty(de,"ready",{enumerable:!1,configurable:!0,value:(Ce)=>so(ue.then(()=>{if(!X)throw oe}),Ce)}),Object.defineProperty(de,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),de}var At=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:je,yaml:"application/yaml",toml:"application/toml",xml:Me});function It(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let D=s.mimeType?.trim()||At[s.format],X=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>X})}function ao(s="jsonc"){return{format:s,mimeType:At[s],typeId:s}}class Dt extends n{constructor(s,D){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${D.mimeType}" (${D.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=D}}var po=It({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Lt={beforeTenantSegments:["ui"]},Mt={beforeTenantSegments:["api"]};function Kt(s){return(s??[]).map((D)=>D.trim()).filter(Boolean)}function Nt(s){let D=s.trim();if(!D)return"/";let X=D.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function $t(s){return Nt(s).split("/").filter(Boolean)}function Et(s){return{beforeTenantSegments:Kt(s?.beforeTenantSegments),afterTenantSegments:Kt(s?.afterTenantSegments)}}function Ut(s){if(s?.type==="host")return{type:"host",baseDomain:bt(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:Et(s?.ui??Lt),api:Et(s?.api??Mt)}}function bt(s){let D=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!D)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return D}function co(s,D){let X=s.trim().replace(/\.$/,"").toLowerCase(),oe=bt(D);if(!X.endsWith(`.${oe}`))return null;let ue=X.slice(0,-(oe.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function mo(s,D){let X=Et(D),oe=X.beforeTenantSegments??[],ue=X.afterTenantSegments??[],de=$t(s),Ce=oe.length+1+ue.length;if(de.length<Ce)return null;for(let Ge=0;Ge<oe.length;Ge++)if(de[Ge]!==oe[Ge])return null;let we=oe.length,ke=de[we];if(!ke)return null;for(let Ge=0;Ge<ue.length;Ge++)if(de[we+1+Ge]!==ue[Ge])return null;let Xe=de.slice(we+1+ue.length);return{id:decodeURIComponent(ke),restSegments:Xe,restPath:Xe.length>0?`/${Xe.join("/")}`:"/"}}function Ft(s,D="/",X){let oe=Et(X),ue=oe.beforeTenantSegments??[],de=oe.afterTenantSegments??[],Ce=$t(D),we=[...ue,encodeURIComponent(s),...de,...Ce];return we.length>0?`/${we.join("/")}`:"/"}function uo(s,D="/",X,oe="ui"){let ue=Ut(X);if(ue.type==="host"||ue.type==="selector")return Nt(D);return Ft(s,D,ue[oe])}function lo(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={...X},de=["iss","sub"];for(let ke of de)if(ke in X){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if("aud"in X&&X.aud!==void 0){let ke=X.aud;if(typeof ke!=="string"&&!Array.isArray(ke))oe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ke)&&!ke.every((Xe)=>typeof Xe==="string"))oe.push({message:"aud array must contain only strings",path:["aud"]})}let Ce=["jti","scope"];for(let ke of Ce)if(ke in X&&X[ke]!==void 0){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}let we=["exp","iat"];for(let ke of we)if(ke in X){if(typeof X[ke]!=="number")oe.push({message:`${ke} must be a number`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function go(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={};if("access_token"in X)if(typeof X.access_token==="string")ue.access_token=X.access_token;else oe.push({message:"access_token must be a string",path:["access_token"]});else oe.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")ue.token_type=X.token_type;else oe.push({message:"token_type must be a string",path:["token_type"]});else oe.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)ue.scope=X.scope;else oe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)ue.refresh_token=X.refresh_token;else oe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)ue.expires=X.expires;else oe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)ue.expires_in=X.expires_in;else oe.push({message:"expires_in must be a number",path:["expires_in"]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function fo(s){let D=new Uint8Array(s);return crypto.getRandomValues(D),D}function yo(s){let D="",X=fo(s);for(let oe=0;oe<s;oe++){let ue=X[oe]%32;D+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return D}function So(s,D){let X="";for(let oe=D;oe>0;oe--){let ue=s%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+X,s=Math.floor(s/32)}return X}function Co(s){let D=Date.now(),X=So(D,10),oe=yo(16);return`${s??""}${X}${oe}`}var Wt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function qt(s){return typeof s==="string"&&s.trim().length>0}function To(s){let D=qt(s.vaultUrl)?s.vaultUrl:void 0,X=Object.keys(s).some((ue)=>ue.startsWith("vaultLfv")&&s[ue]!==void 0);if(D&&X)return"vaultUrl and vaultLfv* are mutually exclusive";if(!D&&!X)return;if(X){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(Wt.some((ue)=>!qt(s[ue])))return`LFV requires ${Wt.join(", ")}`;return}let oe;try{oe=new URL(D).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(oe==="http:"||oe==="https:")return;if(oe==="ws:"||oe==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{l as ACCEPT_JSON,ut as ACCEPT_OCTET_STREAM,he as ACCEPT_SCIM,ct as ACCEPT_XML,Le as AssignmentPolicyError,ne as CANONICAL_RISK_LEVELS,w as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,lt as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,dt as CONTENT_TYPE_XML,kt as ConfigSourceError,et as DEFAULT_DISCOVERED_COOKIE_MAX,tt as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Qe as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,At as DEFAULT_SECRET_MIME_TYPES,Mt as DEFAULT_TENANT_API_NAMESPACE,Lt as DEFAULT_TENANT_UI_NAMESPACE,ie as DISCOVERED_COOKIE_PREFIX,Ze as DISPLAY_COOKIE_SUFFIX,G as DISPLAY_COOKIE_VERSION,We as ECID_SCHEME,N as ENTRA_ION_EXTENSION_URN,M as EcidFormatError,L as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,_e as ION_AUTHZ_OAA_SYNC,Ue as ION_CAPABILITIEZ_READ,De as ION_CIAM_MAGIC_LINK_CREATE,it as ION_ENDPOINT_PERMISSIONS,Pe as ION_IAM_ACCESS_REQUESTS_WRITE,xe as ION_IAM_CUSTOMERS_WRITE,Ee as ION_IAM_DELEGATES_WRITE,Ie as ION_IAM_GROUPS_WRITE,Ae as ION_IAM_READ,Re as ION_IAM_USERS_WRITE,ve as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,b as ION_SCIM_DELEGATE_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,fe as ION_SDK_PERMISSIONS,Oe as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,E as KNOWN_BASE_CUSTOMER_KEYS,x as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,P as KNOWN_WORKLOAD_KEYS,je as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,at as SCIM_MEDIA_TYPE,Dt as SecretContentTypeMismatchError,v as StoreConflictError,Me as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,Je as accessSubjectId,j as assertEcid,re as assertRequiredSubjectType,U as assertValidSubjectTypeScoping,Ft as buildTenantPath,uo as buildTenantUrl,V as catalogEntityStore,Q as claimsToUser,_ as compareDisplayExpiryDesc,xt as configSourceOriginLogFields,He as configTrustedClientGrants,c as customAttributes,pe as customerResourceSchema,to as debugLogger,Ke as decodeDisplayCookie,yt as decodeUser,C as deepEqualPlain,be as defaultDisplayUser,eo as defaultLogger,ao as defaultSecretContentType,qe as defineCatalog,It as defineSecretType,me as delegateResourceSchema,se as deprecateRetiredCodeCatalogRows,Bt as describeOriginUrl,Y as discoveredProfileCookieName,F as encodeDisplayCookie,te as errorLogAttributes,nt as formatEcid,Tt as formatLogLine,Co as generateULID,W as getCodeCatalogEntity,ot as groupResourceSchema,T as idTokenClaimsSchema,oo as infoLogger,$e as isCodeCatalog,Ne as isConfigLocator,zt as isConfigSourceError,Ve as isEcid,ze as isJsonResponse,q as isStoreConflictError,lo as jwtAssertionClaimsSchema,K as list,u as listGenerator,co as matchTenantHost,mo as matchTenantPath,Fe as matchesListFilter,z as materializeCodeCatalogEntity,A as mergeCodeCatalogEntity,pt as mergeConfig,e as must,bt as normalizeTenantBaseDomain,Et as normalizeTenantPathNamespace,Ut as normalizeTenantRoutingStrategy,ge as oidcCallbackSchema,rt as parseEcid,mt as parseJsonc,Xt as parseKmsPoolControlDocument,Jt as parseKmsPoolDocument,no as prettyLogger,O as profileCookieName,g as projectDisplayUser,J as readDisplayCookies,d as readJsonResponse,io as readyCatalogEntry,po as remoteConfigSecretType,H as resolveDiscoveredCookieMax,ce as resolveDiscoveredCookieTtlSeconds,ae as resolveDisplayCookieMax,Te as sanitizeDisplayUser,Ht as serializeConfig,wt as silentLogger,ft as stableConfigHash,Be as stripJsonComments,ht as tmIntegrationState,Ye as toCodeCatalog,ye as tokenResponseSchema,I as trimTrailingSlash,ee as trustedClientPermissionsForPrincipal,Z as unexpectedBodySummary,B as unionCatalogRead,st as userSchema,Se as validationFailureResponse,To as vaultConfigLocatorTransportError,Vt as version,gt as waitOn,ro as warnLogger,m as withValidate,le as workloadResourceSchema,go as workloadTokenResponseSchema};
+import{ee,He,p,x,E,P,c,n,te,K,u,Fe,ne,y,t,Je,h,U,re,Le,qe,Ye,$e,W,V,R,z,se,B,r,f,Ze,G,Qe,et,tt,ie,ae,H,ce,be,Te,g,F,Ke,J,_,O,Y,We,M,Ve,nt,rt,j,o,S,k,b,st,ot,le,pe,me,N,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,De,_e,Oe,fe,it,ge,ye,T,a,at,L,Me,je,l,he,ct,ut,i,A,w,dt,lt,ze,Z,d,m,e,Se,pt,Be,mt,I,C,ft,gt,Q,yt,v,q,Ne,ht,St,kt}from"./shared/core-g9rg6g0j.js";var Bt="0.0.24-beta.20261024.47";class It extends n{constructor(s,D){let X=D.kind==="connection"||D.kind==="timeout"||D.kind==="not_found";super(s,{cause:D.cause,status:X?503:500,upstreamStatus:D.status});this.name="ConfigSourceError";this.kind=D.kind,this.recoverable=D.recoverable,this.code=D.code,this.path=D.path,this.sourceType=D.sourceType}}function Gt(s){return s instanceof It}function Ht(s){let D=s?.trim();if(!D)return;try{let X=new URL(D),oe=X.pathname.replace(/\/+$/g,"");return`${X.protocol}//${X.host}${oe}`}catch{return}}function Pt(s,D="ion.config.source"){if(!s)return{};let X={[`${D}.type`]:s.type};if(s.transport)X[`${D}.transport`]=s.transport;if(s.url)X[`${D}.url`]=s.url;if(s.path)X[`${D}.path`]=s.path;if(s.from)Object.assign(X,Pt(s.from,`${D}.from`));return X}var Yt=["sessionStore","userStore","customerStore","delegateStore","accessStore","tokenStore","magicLinkStore","store"];function vt(s){if(s===null||typeof s!=="object")return s;let D={};for(let[X,oe]of Object.entries(s)){if(Yt.includes(X)||X==="validators"||X==="setStores")continue;D[X]=oe!==null&&typeof oe==="object"&&!Array.isArray(oe)&&Object.getPrototypeOf(oe)===Object.prototype?vt(oe):oe}return D}function Jt(s){return vt(s)}function At(s,D){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${D} must be an object.`);return s}function Ct(s,D){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${D} must be a valid timestamp string.`);return s}function Ot(s,D,X){if(!Array.isArray(s)||!X.allowEmpty&&s.length===0)throw Error(`${D} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let oe=new Set;return s.map((ue,de)=>{let Ce=At(ue,`${D} keys[${de}]`);if(typeof Ce.id!=="string"||Ce.id.length===0)throw Error(`${D} keys[${de}].id must be a non-empty string.`);if(oe.has(Ce.id))throw Error(`${D} contains duplicate key id "${Ce.id}".`);if(oe.add(Ce.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Ce.state)))throw Error(`${D} keys[${de}].state is invalid.`);if(Ce.value!==void 0&&(typeof Ce.value!=="string"||Ce.value.length===0))throw Error(`${D} keys[${de}].value must be a non-empty string when present.`);let we=Ce.meta===void 0?void 0:At(Ce.meta,`${D} keys[${de}].meta`);return{id:Ce.id,state:Ce.state,...Ce.value===void 0?{}:{value:Ce.value},...Ce.notBefore===void 0?{}:{notBefore:Ct(Ce.notBefore,`${D} keys[${de}].notBefore`)},...Ce.notAfter===void 0?{}:{notAfter:Ct(Ce.notAfter,`${D} keys[${de}].notAfter`)},...Ce.createdAt===void 0?{}:{createdAt:Ct(Ce.createdAt,`${D} keys[${de}].createdAt`)},...Ce.activatedAt===void 0?{}:{activatedAt:Ct(Ce.activatedAt,`${D} keys[${de}].activatedAt`)},...Ce.deprecatedAt===void 0?{}:{deprecatedAt:Ct(Ce.deprecatedAt,`${D} keys[${de}].deprecatedAt`)},...Ce.rotatedAt===void 0?{}:{rotatedAt:Ct(Ce.rotatedAt,`${D} keys[${de}].rotatedAt`)},...Ce.revokedAt===void 0?{}:{revokedAt:Ct(Ce.revokedAt,`${D} keys[${de}].revokedAt`)},...we?{meta:{...we}}:{}}})}function Xt(s,D,X){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${X} slots must be an array.`);let oe=new Set,ue=s.map((de,Ce)=>{if(de===null)return null;if(typeof de!=="string"||de.length===0)throw Error(`${X} slots[${Ce}] must be a non-empty key id or null.`);if(oe.has(de))throw Error(`${X} slots contain duplicate key id "${de}".`);oe.add(de);let we=D.find((ke)=>ke.id===de);if(!we)throw Error(`${X} slot key "${de}" is not present in keys.`);if(we.state!=="active")throw Error(`${X} slot key "${de}" must have state "active".`);if(!we.value)throw Error(`${X} slot key "${de}" must include a value.`);return de});if(D.length===0&&ue.some((de)=>de!==null))throw Error(`${X} slots must be omitted or all-null when keys is empty.`);return ue}function Zt(s){let X=At(s,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let oe=Ot(X.keys,"KMS pool",{allowEmpty:!0}),ue=Xt(X.slots,oe,"KMS pool");return ue?{kind:"kms",slots:ue,keys:oe}:{kind:"kms",keys:oe}}function Qt(s){let X=At(s,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:Ot(X.keys,"KMS pool control document",{allowEmpty:!0})}}var eo={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function Dt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function Tt(s){let D=Dt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(D)?D:JSON.stringify(D)}function to(s){return Dt(s).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function wt(s,D,X){if(X==null)return;if(X instanceof Error){let oe=te(X);if(oe){for(let[ue,de]of Object.entries(oe))if(de!=null)s.push(`${ue}=${Tt(de)}`);return}if(s.push(`${D}.name=${Tt(X.name)}`),s.push(`${D}.message=${Tt(X.message)}`),X.stack)s.push(`${D}.stack=${Tt(X.stack)}`);return}s.push(`${D}=${Tt(X)}`)}function Et(s,D,X=[],oe=new Date){let ue=to(D instanceof Error?D.message:D??""),de=[];for(let[Ce,we]of X.entries()){if(we&&typeof we==="object"&&!Array.isArray(we)&&!(we instanceof Error)&&Object.getPrototypeOf(we)===Object.prototype){for(let[ke,Xe]of Object.entries(we))wt(de,ke,Xe);continue}wt(de,`param.${Ce}`,we)}return[oe.toISOString(),eo[s],ue,...de].filter(Boolean).join(" ")}var Kt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},oo=Kt,ro={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},no={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},so={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},io={trace:()=>{},debug:(s,...D)=>globalThis.console.debug(Et("debug",s,D)),info:(s,...D)=>globalThis.console.info(Et("info",s,D)),warn:(s,...D)=>globalThis.console.warn(Et("warn",s,D)),error:(s,...D)=>globalThis.console.error(Et("error",s,D))};function ao(s,D){if(typeof D!=="number"||D<=0)return s;return new Promise((X,oe)=>{let ue=setTimeout(()=>{oe(Error(`Authz catalog entry did not become ready within ${D}ms`))},D);s.then(()=>{clearTimeout(ue),X()},(de)=>{clearTimeout(ue),oe(de)})})}function po(s,D){let X=!1,oe,ue=D.then(()=>{X=!0},(Ce)=>{X=!1,oe=Ce}),de=s;return Object.defineProperty(de,"ready",{enumerable:!1,configurable:!0,value:(Ce)=>ao(ue.then(()=>{if(!X)throw oe}),Ce)}),Object.defineProperty(de,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),de}var bt=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:je,yaml:"application/yaml",toml:"application/toml",xml:Me});function xt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let D=s.mimeType?.trim()||bt[s.format],X=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>X})}function co(s="jsonc"){return{format:s,mimeType:bt[s],typeId:s}}class Lt extends n{constructor(s,D){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${D.mimeType}" (${D.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=D}}var uo=xt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Nt={beforeTenantSegments:["ui"]},$t={beforeTenantSegments:["api"]};function Mt(s){return(s??[]).map((D)=>D.trim()).filter(Boolean)}function Ut(s){let D=s.trim();if(!D)return"/";let X=D.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function Ft(s){return Ut(s).split("/").filter(Boolean)}function Rt(s){return{beforeTenantSegments:Mt(s?.beforeTenantSegments),afterTenantSegments:Mt(s?.afterTenantSegments)}}function Wt(s){if(s?.type==="host")return{type:"host",baseDomain:_t(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:Rt(s?.ui??Nt),api:Rt(s?.api??$t)}}function _t(s){let D=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!D)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return D}function mo(s,D){let X=s.trim().replace(/\.$/,"").toLowerCase(),oe=_t(D);if(!X.endsWith(`.${oe}`))return null;let ue=X.slice(0,-(oe.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function lo(s,D){let X=Rt(D),oe=X.beforeTenantSegments??[],ue=X.afterTenantSegments??[],de=Ft(s),Ce=oe.length+1+ue.length;if(de.length<Ce)return null;for(let Ge=0;Ge<oe.length;Ge++)if(de[Ge]!==oe[Ge])return null;let we=oe.length,ke=de[we];if(!ke)return null;for(let Ge=0;Ge<ue.length;Ge++)if(de[we+1+Ge]!==ue[Ge])return null;let Xe=de.slice(we+1+ue.length);return{id:decodeURIComponent(ke),restSegments:Xe,restPath:Xe.length>0?`/${Xe.join("/")}`:"/"}}function qt(s,D="/",X){let oe=Rt(X),ue=oe.beforeTenantSegments??[],de=oe.afterTenantSegments??[],Ce=Ft(D),we=[...ue,encodeURIComponent(s),...de,...Ce];return we.length>0?`/${we.join("/")}`:"/"}function go(s,D="/",X,oe="ui"){let ue=Wt(X);if(ue.type==="host"||ue.type==="selector")return Ut(D);return qt(s,D,ue[oe])}function fo(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={...X},de=["iss","sub"];for(let ke of de)if(ke in X){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if("aud"in X&&X.aud!==void 0){let ke=X.aud;if(typeof ke!=="string"&&!Array.isArray(ke))oe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ke)&&!ke.every((Xe)=>typeof Xe==="string"))oe.push({message:"aud array must contain only strings",path:["aud"]})}let Ce=["jti","scope"];for(let ke of Ce)if(ke in X&&X[ke]!==void 0){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}let we=["exp","iat"];for(let ke of we)if(ke in X){if(typeof X[ke]!=="number")oe.push({message:`${ke} must be a number`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function yo(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={};if("access_token"in X)if(typeof X.access_token==="string")ue.access_token=X.access_token;else oe.push({message:"access_token must be a string",path:["access_token"]});else oe.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")ue.token_type=X.token_type;else oe.push({message:"token_type must be a string",path:["token_type"]});else oe.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)ue.scope=X.scope;else oe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)ue.refresh_token=X.refresh_token;else oe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)ue.expires=X.expires;else oe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)ue.expires_in=X.expires_in;else oe.push({message:"expires_in must be a number",path:["expires_in"]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function So(s){let D=new Uint8Array(s);return crypto.getRandomValues(D),D}function Co(s){let D="",X=So(s);for(let oe=0;oe<s;oe++){let ue=X[oe]%32;D+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return D}function To(s,D){let X="";for(let oe=D;oe>0;oe--){let ue=s%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+X,s=Math.floor(s/32)}return X}function Eo(s){let D=Date.now(),X=To(D,10),oe=Co(16);return`${s??""}${X}${oe}`}var jt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function Vt(s){return typeof s==="string"&&s.trim().length>0}function Ro(s){let D=Vt(s.vaultUrl)?s.vaultUrl:void 0,X=Object.keys(s).some((ue)=>ue.startsWith("vaultLfv")&&s[ue]!==void 0);if(D&&X)return"vaultUrl and vaultLfv* are mutually exclusive";if(!D&&!X)return;if(X){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(jt.some((ue)=>!Vt(s[ue])))return`LFV requires ${jt.join(", ")}`;return}let oe;try{oe=new URL(D).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(oe==="http:"||oe==="https:")return;if(oe==="ws:"||oe==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{l as ACCEPT_JSON,ut as ACCEPT_OCTET_STREAM,he as ACCEPT_SCIM,ct as ACCEPT_XML,Le as AssignmentPolicyError,ne as CANONICAL_RISK_LEVELS,w as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,lt as CONTENT_TYPE_OCTET_STREAM,A as CONTENT_TYPE_SCIM,dt as CONTENT_TYPE_XML,It as ConfigSourceError,et as DEFAULT_DISCOVERED_COOKIE_MAX,tt as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Qe as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,bt as DEFAULT_SECRET_MIME_TYPES,$t as DEFAULT_TENANT_API_NAMESPACE,Nt as DEFAULT_TENANT_UI_NAMESPACE,ie as DISCOVERED_COOKIE_PREFIX,Ze as DISPLAY_COOKIE_SUFFIX,G as DISPLAY_COOKIE_VERSION,We as ECID_SCHEME,N as ENTRA_ION_EXTENSION_URN,M as EcidFormatError,L as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,_e as ION_AUTHZ_OAA_SYNC,Ue as ION_CAPABILITIEZ_READ,De as ION_CIAM_MAGIC_LINK_CREATE,it as ION_ENDPOINT_PERMISSIONS,Pe as ION_IAM_ACCESS_REQUESTS_WRITE,xe as ION_IAM_CUSTOMERS_WRITE,Ee as ION_IAM_DELEGATES_WRITE,Ie as ION_IAM_GROUPS_WRITE,Re as ION_IAM_READ,Ae as ION_IAM_USERS_WRITE,ve as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,b as ION_SCIM_DELEGATE_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,fe as ION_SDK_PERMISSIONS,Oe as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,E as KNOWN_BASE_CUSTOMER_KEYS,x as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,P as KNOWN_WORKLOAD_KEYS,je as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,at as SCIM_MEDIA_TYPE,Lt as SecretContentTypeMismatchError,v as StoreConflictError,St as TM_REQUEST_URI_PREFIX,ht as TM_STAGED_HANDLE_TYP,Me as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,Je as accessSubjectId,j as assertEcid,re as assertRequiredSubjectType,U as assertValidSubjectTypeScoping,qt as buildTenantPath,go as buildTenantUrl,V as catalogEntityStore,Q as claimsToUser,_ as compareDisplayExpiryDesc,Pt as configSourceOriginLogFields,He as configTrustedClientGrants,c as customAttributes,pe as customerResourceSchema,ro as debugLogger,Ke as decodeDisplayCookie,yt as decodeUser,C as deepEqualPlain,be as defaultDisplayUser,oo as defaultLogger,co as defaultSecretContentType,$e as defineCatalog,xt as defineSecretType,me as delegateResourceSchema,se as deprecateRetiredCodeCatalogRows,Ht as describeOriginUrl,Y as discoveredProfileCookieName,F as encodeDisplayCookie,te as errorLogAttributes,nt as formatEcid,Et as formatLogLine,Eo as generateULID,W as getCodeCatalogEntity,ot as groupResourceSchema,T as idTokenClaimsSchema,no as infoLogger,qe as isCodeCatalog,Ne as isConfigLocator,Gt as isConfigSourceError,Ve as isEcid,ze as isJsonResponse,q as isStoreConflictError,fo as jwtAssertionClaimsSchema,K as list,u as listGenerator,mo as matchTenantHost,lo as matchTenantPath,Fe as matchesListFilter,z as materializeCodeCatalogEntity,R as mergeCodeCatalogEntity,pt as mergeConfig,e as must,_t as normalizeTenantBaseDomain,Rt as normalizeTenantPathNamespace,Wt as normalizeTenantRoutingStrategy,ge as oidcCallbackSchema,rt as parseEcid,mt as parseJsonc,Qt as parseKmsPoolControlDocument,Zt as parseKmsPoolDocument,io as prettyLogger,O as profileCookieName,g as projectDisplayUser,J as readDisplayCookies,d as readJsonResponse,po as readyCatalogEntry,uo as remoteConfigSecretType,H as resolveDiscoveredCookieMax,ce as resolveDiscoveredCookieTtlSeconds,ae as resolveDisplayCookieMax,Te as sanitizeDisplayUser,Jt as serializeConfig,Kt as silentLogger,ft as stableConfigHash,Be as stripJsonComments,kt as tmIntegrationState,Ye as toCodeCatalog,ye as tokenResponseSchema,I as trimTrailingSlash,ee as trustedClientPermissionsForPrincipal,Z as unexpectedBodySummary,B as unionCatalogRead,st as userSchema,Se as validationFailureResponse,Ro as vaultConfigLocatorTransportError,Bt as version,gt as waitOn,so as warnLogger,m as withValidate,le as workloadResourceSchema,yo as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -5285,7 +5285,7 @@ type TmIoniteConfig = {
 	url: string;
 	/** Required `iss` claim on ionite-signed staged-request handles and ionite workload tokens. */
 	issuer: string;
-	/** ionite JWKS endpoint used to verify signed staged-request handles. */
+	/** ionite JWKS endpoint used to verify signed staged-request handles and TM access tokens. */
 	jwksUri: string;
 	/** Required `aud` claim binding an ionite-staged request to this App. */
 	audience: string;
@@ -5294,6 +5294,12 @@ type TmIoniteConfig = {
 	/** Named outgoing workload client that authenticates every `ion.tm.sendWebhook` call to ionite. */
 	webhookClient?: string;
 };
+/** A pushed staged request: the verified handle behind one `request_uri`, kept App-side until it expires. */
+type StagedRequestRecord = {
+	handle: string;
+	/** The handle's own expiry; stores MUST NOT return the record after it. */
+	expiresAt: string;
+};
 type RemoteTmConfig = {
 	enabled: true;
 	ionite: TmIoniteConfig;
@@ -5306,7 +5312,8 @@ type RemoteTmConfig = {
 	requestTokenTtlSeconds?: number;
 };
 type RecordTenantConsentInput = {
-	handle: string;
+	/** `staged.requestUri` from `onConnectRequest`. */
+	requestUri: string;
 	tenantId: string;
 	decision: "consented" | "declined";
 	decidedBy?: string;
@@ -5379,6 +5386,15 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
+	/**
+	* Pushed staged requests, keyed by the SHA-256 digest of their `request_uri`. Consent (stage,
+	* authorize, `recordConsent`) needs these two plus `setIntegration`/`getByIntegrationHandleHash`
+	* and answers 501 without them; redeem and need only that integration pair. `getStagedRequest` MUST return `undefined` once
+	* `record.expiresAt` has passed, and must be shared across App replicas: ionite pushes to one and
+	* the browser may reach another.
+	*/
+	setStagedRequest?(requestUriHash: string, record: StagedRequestRecord): Promise<void>;
+	getStagedRequest?(requestUriHash: string): Promise<StagedRequestRecord | undefined>;
 	/** Indexed lookup by the SHA-256 digest of an App onboarding request token. */
 	getByRequestTokenHash?(requestTokenHash: string): Promise<TTenant | undefined>;
 	/**
@@ -5410,6 +5426,8 @@ declare class InMemoryTenantStore<TTenant extends BaseTenant = BaseTenant> imple
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash(handleHash: string): Promise<TTenant | undefined>;
+	setStagedRequest(requestUriHash: string, record: StagedRequestRecord): Promise<void>;
+	getStagedRequest(requestUriHash: string): Promise<StagedRequestRecord | undefined>;
 	getByRequestTokenHash(requestTokenHash: string): Promise<TTenant | undefined>;
 	replaceActionRequest(expectedRequestTokenHash: string, tenant: TTenant): Promise<TTenant | undefined>;
 	getByIoniteId(ioniteId: string): Promise<TTenant | undefined>;