@ionite/core 0.0.24-beta.20261024.49 → 0.0.24-beta.20261024.50

package/dist/index.d.ts

@@ -5933,6 +5933,18 @@ type TmIoniteConfig = {
 * on handles and rejects it on every workload-authenticated route.
 */
 declare const TM_STAGED_HANDLE_TYP = "ion-tm-handle+jwt";
+/**
+* Prefix of the opaque reference `integrations/stage` returns (RFC 9126 §2.2 `request_uri`). ionite
+* pushes the signed handle over the workload-authenticated back channel and sends the browser only
+* this reference, so the JWT and its claims never reach browser history, `Referer`, or access logs.
+*/
+declare const TM_REQUEST_URI_PREFIX = "urn:ietf:params:oauth:request_uri:";
+/** A pushed staged request: the verified handle behind one `request_uri`, kept App-side until it expires. */
+type StagedRequestRecord = {
+	handle: string;
+	/** The handle's own expiry; stores MUST NOT return the record after it. */
+	expiresAt: string;
+};
 type RemoteTmConfig = {
 	enabled: true;
 	ionite: TmIoniteConfig;
@@ -5944,8 +5956,8 @@ type RemoteTmConfig = {
 	*/
 	requestTokenTtlSeconds?: number;
 };
+/** What `onConnectRequest` sees. The signed handle is deliberately absent: no App API takes it. */
 type StagedIntegration = {
-	handle: string;
 	ioniteName?: string;
 	ioniteId: string;
 	productId: string;
@@ -5954,6 +5966,11 @@ type StagedIntegration = {
 	expiresAt: string;
 	requestId: string;
 	tenantHint?: string;
+	/**
+	* The pushed `request_uri` the browser arrived with. Put this in any URL the App builds for its
+	* consent page, and pass it to `recordConsent`.
+	*/
+	requestUri: string;
 };
 type ConnectRequestContext<TTenant extends BaseTenant = BaseTenant> = {
 	request: Request;
@@ -6019,7 +6036,8 @@ type FrameworkTmConfig<TTenant extends BaseTenant = BaseTenant> = {
 	}) => unknown;
 };
 type RecordTenantConsentInput = {
-	handle: string;
+	/** `staged.requestUri` from `onConnectRequest`. */
+	requestUri: string;
 	tenantId: string;
 	decision: "consented" | "declined";
 	decidedBy?: string;
@@ -6124,6 +6142,15 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
+	/**
+	* Pushed staged requests, keyed by the SHA-256 digest of their `request_uri`. Consent (stage,
+	* authorize, `recordConsent`) needs these two plus `setIntegration`/`getByIntegrationHandleHash`
+	* and answers 501 without them; redeem and need only that integration pair. `getStagedRequest` MUST return `undefined` once
+	* `record.expiresAt` has passed, and must be shared across App replicas: ionite pushes to one and
+	* the browser may reach another.
+	*/
+	setStagedRequest?(requestUriHash: string, record: StagedRequestRecord): Promise<void>;
+	getStagedRequest?(requestUriHash: string): Promise<StagedRequestRecord | undefined>;
 	/** Indexed lookup by the SHA-256 digest of an App onboarding request token. */
 	getByRequestTokenHash?(requestTokenHash: string): Promise<TTenant | undefined>;
 	/**
@@ -7450,4 +7477,4 @@ declare function generateULID(prefix?: string): string;
 * `vaultTtl` is HTTP-only.
 */
 declare function vaultConfigLocatorTransportError(locator: Record<string, unknown>): string | undefined;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, AccessSubject, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseDelegate, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, Delegate, DelegateContext, DelegateDescription, DelegateOwner, DelegateOwnerType, DelegateStore, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkDelegateConfig, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundDelegatesConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_DELEGATES_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_DELEGATE_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteDelegateConfig, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimDelegate, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TM_STAGED_HANDLE_TYP, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, accessSubjectId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, delegateResourceSchema, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, AccessSubject, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseDelegate, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, Delegate, DelegateContext, DelegateDescription, DelegateOwner, DelegateOwnerType, DelegateStore, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkDelegateConfig, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundDelegatesConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_DELEGATES_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_DELEGATE_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteDelegateConfig, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimDelegate, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StagedRequestRecord, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TM_REQUEST_URI_PREFIX, TM_STAGED_HANDLE_TYP, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, accessSubjectId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, delegateResourceSchema, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{ee,He,p,x,E,P,c,n,te,K,u,Fe,ne,y,t,Je,h,D,re,Le,$e,Ye,qe,W,V,A,z,se,B,r,f,Ze,G,Qe,et,tt,ie,ae,H,ce,be,Te,g,F,Ke,J,_,O,Y,We,M,Ve,nt,rt,j,o,S,k,b,st,ot,le,pe,me,N,Ae,Re,Ie,ve,xe,Ee,Pe,De,Ue,_e,Oe,fe,it,ge,ye,T,a,at,L,Me,je,l,he,ct,ut,i,R,w,dt,lt,ze,Z,d,m,e,Se,pt,Be,mt,I,C,ft,gt,Q,yt,v,q,Ne,ht,St}from"./shared/core-0nsg7t0c.js";var zt="0.0.24-beta.20261024.49";class At extends n{constructor(s,U){let X=U.kind==="connection"||U.kind==="timeout"||U.kind==="not_found";super(s,{cause:U.cause,status:X?503:500,upstreamStatus:U.status});this.name="ConfigSourceError";this.kind=U.kind,this.recoverable=U.recoverable,this.code=U.code,this.path=U.path,this.sourceType=U.sourceType}}function Bt(s){return s instanceof At}function Gt(s){let U=s?.trim();if(!U)return;try{let X=new URL(U),oe=X.pathname.replace(/\/+$/g,"");return`${X.protocol}//${X.host}${oe}`}catch{return}}function _t(s,U="ion.config.source"){if(!s)return{};let X={[`${U}.type`]:s.type};if(s.transport)X[`${U}.transport`]=s.transport;if(s.url)X[`${U}.url`]=s.url;if(s.path)X[`${U}.path`]=s.path;if(s.from)Object.assign(X,_t(s.from,`${U}.from`));return X}var Ht=["sessionStore","userStore","customerStore","delegateStore","accessStore","tokenStore","magicLinkStore","store"];function Pt(s){if(s===null||typeof s!=="object")return s;let U={};for(let[X,oe]of Object.entries(s)){if(Ht.includes(X)||X==="validators"||X==="setStores")continue;U[X]=oe!==null&&typeof oe==="object"&&!Array.isArray(oe)&&Object.getPrototypeOf(oe)===Object.prototype?Pt(oe):oe}return U}function Yt(s){return Pt(s)}function kt(s,U){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${U} must be an object.`);return s}function Ct(s,U){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${U} must be a valid timestamp string.`);return s}function vt(s,U,X){if(!Array.isArray(s)||!X.allowEmpty&&s.length===0)throw Error(`${U} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let oe=new Set;return s.map((ue,de)=>{let Ce=kt(ue,`${U} keys[${de}]`);if(typeof Ce.id!=="string"||Ce.id.length===0)throw Error(`${U} keys[${de}].id must be a non-empty string.`);if(oe.has(Ce.id))throw Error(`${U} contains duplicate key id "${Ce.id}".`);if(oe.add(Ce.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Ce.state)))throw Error(`${U} keys[${de}].state is invalid.`);if(Ce.value!==void 0&&(typeof Ce.value!=="string"||Ce.value.length===0))throw Error(`${U} keys[${de}].value must be a non-empty string when present.`);let we=Ce.meta===void 0?void 0:kt(Ce.meta,`${U} keys[${de}].meta`);return{id:Ce.id,state:Ce.state,...Ce.value===void 0?{}:{value:Ce.value},...Ce.notBefore===void 0?{}:{notBefore:Ct(Ce.notBefore,`${U} keys[${de}].notBefore`)},...Ce.notAfter===void 0?{}:{notAfter:Ct(Ce.notAfter,`${U} keys[${de}].notAfter`)},...Ce.createdAt===void 0?{}:{createdAt:Ct(Ce.createdAt,`${U} keys[${de}].createdAt`)},...Ce.activatedAt===void 0?{}:{activatedAt:Ct(Ce.activatedAt,`${U} keys[${de}].activatedAt`)},...Ce.deprecatedAt===void 0?{}:{deprecatedAt:Ct(Ce.deprecatedAt,`${U} keys[${de}].deprecatedAt`)},...Ce.rotatedAt===void 0?{}:{rotatedAt:Ct(Ce.rotatedAt,`${U} keys[${de}].rotatedAt`)},...Ce.revokedAt===void 0?{}:{revokedAt:Ct(Ce.revokedAt,`${U} keys[${de}].revokedAt`)},...we?{meta:{...we}}:{}}})}function Jt(s,U,X){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${X} slots must be an array.`);let oe=new Set,ue=s.map((de,Ce)=>{if(de===null)return null;if(typeof de!=="string"||de.length===0)throw Error(`${X} slots[${Ce}] must be a non-empty key id or null.`);if(oe.has(de))throw Error(`${X} slots contain duplicate key id "${de}".`);oe.add(de);let we=U.find((ke)=>ke.id===de);if(!we)throw Error(`${X} slot key "${de}" is not present in keys.`);if(we.state!=="active")throw Error(`${X} slot key "${de}" must have state "active".`);if(!we.value)throw Error(`${X} slot key "${de}" must include a value.`);return de});if(U.length===0&&ue.some((de)=>de!==null))throw Error(`${X} slots must be omitted or all-null when keys is empty.`);return ue}function Xt(s){let X=kt(s,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let oe=vt(X.keys,"KMS pool",{allowEmpty:!0}),ue=Jt(X.slots,oe,"KMS pool");return ue?{kind:"kms",slots:ue,keys:oe}:{kind:"kms",keys:oe}}function Zt(s){let X=kt(s,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:vt(X.keys,"KMS pool control document",{allowEmpty:!0})}}var Qt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function wt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function Tt(s){let U=wt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(U)?U:JSON.stringify(U)}function eo(s){return wt(s).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function Ot(s,U,X){if(X==null)return;if(X instanceof Error){let oe=te(X);if(oe){for(let[ue,de]of Object.entries(oe))if(de!=null)s.push(`${ue}=${Tt(de)}`);return}if(s.push(`${U}.name=${Tt(X.name)}`),s.push(`${U}.message=${Tt(X.message)}`),X.stack)s.push(`${U}.stack=${Tt(X.stack)}`);return}s.push(`${U}=${Tt(X)}`)}function Et(s,U,X=[],oe=new Date){let ue=eo(U instanceof Error?U.message:U??""),de=[];for(let[Ce,we]of X.entries()){if(we&&typeof we==="object"&&!Array.isArray(we)&&!(we instanceof Error)&&Object.getPrototypeOf(we)===Object.prototype){for(let[ke,Xe]of Object.entries(we))Ot(de,ke,Xe);continue}Ot(de,`param.${Ce}`,we)}return[oe.toISOString(),Qt[s],ue,...de].filter(Boolean).join(" ")}var Dt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},to=Dt,oo={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},ro={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},no={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},so={trace:()=>{},debug:(s,...U)=>globalThis.console.debug(Et("debug",s,U)),info:(s,...U)=>globalThis.console.info(Et("info",s,U)),warn:(s,...U)=>globalThis.console.warn(Et("warn",s,U)),error:(s,...U)=>globalThis.console.error(Et("error",s,U))};function io(s,U){if(typeof U!=="number"||U<=0)return s;return new Promise((X,oe)=>{let ue=setTimeout(()=>{oe(Error(`Authz catalog entry did not become ready within ${U}ms`))},U);s.then(()=>{clearTimeout(ue),X()},(de)=>{clearTimeout(ue),oe(de)})})}function ao(s,U){let X=!1,oe,ue=U.then(()=>{X=!0},(Ce)=>{X=!1,oe=Ce}),de=s;return Object.defineProperty(de,"ready",{enumerable:!1,configurable:!0,value:(Ce)=>io(ue.then(()=>{if(!X)throw oe}),Ce)}),Object.defineProperty(de,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),de}var It=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:je,yaml:"application/yaml",toml:"application/toml",xml:Me});function bt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let U=s.mimeType?.trim()||It[s.format],X=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>X})}function po(s="jsonc"){return{format:s,mimeType:It[s],typeId:s}}class Kt extends n{constructor(s,U){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${U.mimeType}" (${U.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=U}}var co=bt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Mt={beforeTenantSegments:["ui"]},Nt={beforeTenantSegments:["api"]};function Lt(s){return(s??[]).map((U)=>U.trim()).filter(Boolean)}function $t(s){let U=s.trim();if(!U)return"/";let X=U.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function Ut(s){return $t(s).split("/").filter(Boolean)}function Rt(s){return{beforeTenantSegments:Lt(s?.beforeTenantSegments),afterTenantSegments:Lt(s?.afterTenantSegments)}}function Ft(s){if(s?.type==="host")return{type:"host",baseDomain:xt(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:Rt(s?.ui??Mt),api:Rt(s?.api??Nt)}}function xt(s){let U=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!U)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return U}function mo(s,U){let X=s.trim().replace(/\.$/,"").toLowerCase(),oe=xt(U);if(!X.endsWith(`.${oe}`))return null;let ue=X.slice(0,-(oe.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function uo(s,U){let X=Rt(U),oe=X.beforeTenantSegments??[],ue=X.afterTenantSegments??[],de=Ut(s),Ce=oe.length+1+ue.length;if(de.length<Ce)return null;for(let Ge=0;Ge<oe.length;Ge++)if(de[Ge]!==oe[Ge])return null;let we=oe.length,ke=de[we];if(!ke)return null;for(let Ge=0;Ge<ue.length;Ge++)if(de[we+1+Ge]!==ue[Ge])return null;let Xe=de.slice(we+1+ue.length);return{id:decodeURIComponent(ke),restSegments:Xe,restPath:Xe.length>0?`/${Xe.join("/")}`:"/"}}function Wt(s,U="/",X){let oe=Rt(X),ue=oe.beforeTenantSegments??[],de=oe.afterTenantSegments??[],Ce=Ut(U),we=[...ue,encodeURIComponent(s),...de,...Ce];return we.length>0?`/${we.join("/")}`:"/"}function lo(s,U="/",X,oe="ui"){let ue=Ft(X);if(ue.type==="host"||ue.type==="selector")return $t(U);return Wt(s,U,ue[oe])}function go(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let X=U,oe=[],ue={...X},de=["iss","sub"];for(let ke of de)if(ke in X){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if("aud"in X&&X.aud!==void 0){let ke=X.aud;if(typeof ke!=="string"&&!Array.isArray(ke))oe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ke)&&!ke.every((Xe)=>typeof Xe==="string"))oe.push({message:"aud array must contain only strings",path:["aud"]})}let Ce=["jti","scope"];for(let ke of Ce)if(ke in X&&X[ke]!==void 0){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}let we=["exp","iat"];for(let ke of we)if(ke in X){if(typeof X[ke]!=="number")oe.push({message:`${ke} must be a number`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function fo(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let X=U,oe=[],ue={};if("access_token"in X)if(typeof X.access_token==="string")ue.access_token=X.access_token;else oe.push({message:"access_token must be a string",path:["access_token"]});else oe.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")ue.token_type=X.token_type;else oe.push({message:"token_type must be a string",path:["token_type"]});else oe.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)ue.scope=X.scope;else oe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)ue.refresh_token=X.refresh_token;else oe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)ue.expires=X.expires;else oe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)ue.expires_in=X.expires_in;else oe.push({message:"expires_in must be a number",path:["expires_in"]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function yo(s){let U=new Uint8Array(s);return crypto.getRandomValues(U),U}function So(s){let U="",X=yo(s);for(let oe=0;oe<s;oe++){let ue=X[oe]%32;U+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return U}function Co(s,U){let X="";for(let oe=U;oe>0;oe--){let ue=s%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+X,s=Math.floor(s/32)}return X}function To(s){let U=Date.now(),X=Co(U,10),oe=So(16);return`${s??""}${X}${oe}`}var qt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function jt(s){return typeof s==="string"&&s.trim().length>0}function Eo(s){let U=jt(s.vaultUrl)?s.vaultUrl:void 0,X=Object.keys(s).some((ue)=>ue.startsWith("vaultLfv")&&s[ue]!==void 0);if(U&&X)return"vaultUrl and vaultLfv* are mutually exclusive";if(!U&&!X)return;if(X){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(qt.some((ue)=>!jt(s[ue])))return`LFV requires ${qt.join(", ")}`;return}let oe;try{oe=new URL(U).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(oe==="http:"||oe==="https:")return;if(oe==="ws:"||oe==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{l as ACCEPT_JSON,ut as ACCEPT_OCTET_STREAM,he as ACCEPT_SCIM,ct as ACCEPT_XML,Le as AssignmentPolicyError,ne as CANONICAL_RISK_LEVELS,w as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,lt as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,dt as CONTENT_TYPE_XML,At as ConfigSourceError,et as DEFAULT_DISCOVERED_COOKIE_MAX,tt as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Qe as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,It as DEFAULT_SECRET_MIME_TYPES,Nt as DEFAULT_TENANT_API_NAMESPACE,Mt as DEFAULT_TENANT_UI_NAMESPACE,ie as DISCOVERED_COOKIE_PREFIX,Ze as DISPLAY_COOKIE_SUFFIX,G as DISPLAY_COOKIE_VERSION,We as ECID_SCHEME,N as ENTRA_ION_EXTENSION_URN,M as EcidFormatError,L as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,_e as ION_AUTHZ_OAA_SYNC,De as ION_CAPABILITIEZ_READ,Ue as ION_CIAM_MAGIC_LINK_CREATE,it as ION_ENDPOINT_PERMISSIONS,Pe as ION_IAM_ACCESS_REQUESTS_WRITE,xe as ION_IAM_CUSTOMERS_WRITE,Ee as ION_IAM_DELEGATES_WRITE,Ie as ION_IAM_GROUPS_WRITE,Ae as ION_IAM_READ,Re as ION_IAM_USERS_WRITE,ve as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,b as ION_SCIM_DELEGATE_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,fe as ION_SDK_PERMISSIONS,Oe as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,E as KNOWN_BASE_CUSTOMER_KEYS,x as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,P as KNOWN_WORKLOAD_KEYS,je as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,at as SCIM_MEDIA_TYPE,Kt as SecretContentTypeMismatchError,v as StoreConflictError,ht as TM_STAGED_HANDLE_TYP,Me as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,Je as accessSubjectId,j as assertEcid,re as assertRequiredSubjectType,D as assertValidSubjectTypeScoping,Wt as buildTenantPath,lo as buildTenantUrl,V as catalogEntityStore,Q as claimsToUser,_ as compareDisplayExpiryDesc,_t as configSourceOriginLogFields,He as configTrustedClientGrants,c as customAttributes,pe as customerResourceSchema,oo as debugLogger,Ke as decodeDisplayCookie,yt as decodeUser,C as deepEqualPlain,be as defaultDisplayUser,to as defaultLogger,po as defaultSecretContentType,qe as defineCatalog,bt as defineSecretType,me as delegateResourceSchema,se as deprecateRetiredCodeCatalogRows,Gt as describeOriginUrl,Y as discoveredProfileCookieName,F as encodeDisplayCookie,te as errorLogAttributes,nt as formatEcid,Et as formatLogLine,To as generateULID,W as getCodeCatalogEntity,ot as groupResourceSchema,T as idTokenClaimsSchema,ro as infoLogger,$e as isCodeCatalog,Ne as isConfigLocator,Bt as isConfigSourceError,Ve as isEcid,ze as isJsonResponse,q as isStoreConflictError,go as jwtAssertionClaimsSchema,K as list,u as listGenerator,mo as matchTenantHost,uo as matchTenantPath,Fe as matchesListFilter,z as materializeCodeCatalogEntity,A as mergeCodeCatalogEntity,pt as mergeConfig,e as must,xt as normalizeTenantBaseDomain,Rt as normalizeTenantPathNamespace,Ft as normalizeTenantRoutingStrategy,ge as oidcCallbackSchema,rt as parseEcid,mt as parseJsonc,Zt as parseKmsPoolControlDocument,Xt as parseKmsPoolDocument,so as prettyLogger,O as profileCookieName,g as projectDisplayUser,J as readDisplayCookies,d as readJsonResponse,ao as readyCatalogEntry,co as remoteConfigSecretType,H as resolveDiscoveredCookieMax,ce as resolveDiscoveredCookieTtlSeconds,ae as resolveDisplayCookieMax,Te as sanitizeDisplayUser,Yt as serializeConfig,Dt as silentLogger,ft as stableConfigHash,Be as stripJsonComments,St as tmIntegrationState,Ye as toCodeCatalog,ye as tokenResponseSchema,I as trimTrailingSlash,ee as trustedClientPermissionsForPrincipal,Z as unexpectedBodySummary,B as unionCatalogRead,st as userSchema,Se as validationFailureResponse,Eo as vaultConfigLocatorTransportError,zt as version,gt as waitOn,no as warnLogger,m as withValidate,le as workloadResourceSchema,fo as workloadTokenResponseSchema};
+import{ee,He,p,x,E,P,c,n,te,K,u,Fe,ne,y,t,Je,h,U,re,Le,qe,Ye,$e,W,V,R,z,se,B,r,f,Ze,G,Qe,et,tt,ie,ae,H,ce,be,Te,g,F,Ke,J,_,O,Y,We,M,Ve,nt,rt,j,o,S,k,b,st,ot,le,pe,me,N,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,De,_e,Oe,fe,it,ge,ye,T,a,at,L,Me,je,l,he,ct,ut,i,A,w,dt,lt,ze,Z,d,m,e,Se,pt,Be,mt,I,C,ft,gt,Q,yt,v,q,Ne,ht,St,kt}from"./shared/core-g9rg6g0j.js";var Bt="0.0.24-beta.20261024.50";class It extends n{constructor(s,D){let X=D.kind==="connection"||D.kind==="timeout"||D.kind==="not_found";super(s,{cause:D.cause,status:X?503:500,upstreamStatus:D.status});this.name="ConfigSourceError";this.kind=D.kind,this.recoverable=D.recoverable,this.code=D.code,this.path=D.path,this.sourceType=D.sourceType}}function Gt(s){return s instanceof It}function Ht(s){let D=s?.trim();if(!D)return;try{let X=new URL(D),oe=X.pathname.replace(/\/+$/g,"");return`${X.protocol}//${X.host}${oe}`}catch{return}}function Pt(s,D="ion.config.source"){if(!s)return{};let X={[`${D}.type`]:s.type};if(s.transport)X[`${D}.transport`]=s.transport;if(s.url)X[`${D}.url`]=s.url;if(s.path)X[`${D}.path`]=s.path;if(s.from)Object.assign(X,Pt(s.from,`${D}.from`));return X}var Yt=["sessionStore","userStore","customerStore","delegateStore","accessStore","tokenStore","magicLinkStore","store"];function vt(s){if(s===null||typeof s!=="object")return s;let D={};for(let[X,oe]of Object.entries(s)){if(Yt.includes(X)||X==="validators"||X==="setStores")continue;D[X]=oe!==null&&typeof oe==="object"&&!Array.isArray(oe)&&Object.getPrototypeOf(oe)===Object.prototype?vt(oe):oe}return D}function Jt(s){return vt(s)}function At(s,D){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${D} must be an object.`);return s}function Ct(s,D){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${D} must be a valid timestamp string.`);return s}function Ot(s,D,X){if(!Array.isArray(s)||!X.allowEmpty&&s.length===0)throw Error(`${D} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let oe=new Set;return s.map((ue,de)=>{let Ce=At(ue,`${D} keys[${de}]`);if(typeof Ce.id!=="string"||Ce.id.length===0)throw Error(`${D} keys[${de}].id must be a non-empty string.`);if(oe.has(Ce.id))throw Error(`${D} contains duplicate key id "${Ce.id}".`);if(oe.add(Ce.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Ce.state)))throw Error(`${D} keys[${de}].state is invalid.`);if(Ce.value!==void 0&&(typeof Ce.value!=="string"||Ce.value.length===0))throw Error(`${D} keys[${de}].value must be a non-empty string when present.`);let we=Ce.meta===void 0?void 0:At(Ce.meta,`${D} keys[${de}].meta`);return{id:Ce.id,state:Ce.state,...Ce.value===void 0?{}:{value:Ce.value},...Ce.notBefore===void 0?{}:{notBefore:Ct(Ce.notBefore,`${D} keys[${de}].notBefore`)},...Ce.notAfter===void 0?{}:{notAfter:Ct(Ce.notAfter,`${D} keys[${de}].notAfter`)},...Ce.createdAt===void 0?{}:{createdAt:Ct(Ce.createdAt,`${D} keys[${de}].createdAt`)},...Ce.activatedAt===void 0?{}:{activatedAt:Ct(Ce.activatedAt,`${D} keys[${de}].activatedAt`)},...Ce.deprecatedAt===void 0?{}:{deprecatedAt:Ct(Ce.deprecatedAt,`${D} keys[${de}].deprecatedAt`)},...Ce.rotatedAt===void 0?{}:{rotatedAt:Ct(Ce.rotatedAt,`${D} keys[${de}].rotatedAt`)},...Ce.revokedAt===void 0?{}:{revokedAt:Ct(Ce.revokedAt,`${D} keys[${de}].revokedAt`)},...we?{meta:{...we}}:{}}})}function Xt(s,D,X){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${X} slots must be an array.`);let oe=new Set,ue=s.map((de,Ce)=>{if(de===null)return null;if(typeof de!=="string"||de.length===0)throw Error(`${X} slots[${Ce}] must be a non-empty key id or null.`);if(oe.has(de))throw Error(`${X} slots contain duplicate key id "${de}".`);oe.add(de);let we=D.find((ke)=>ke.id===de);if(!we)throw Error(`${X} slot key "${de}" is not present in keys.`);if(we.state!=="active")throw Error(`${X} slot key "${de}" must have state "active".`);if(!we.value)throw Error(`${X} slot key "${de}" must include a value.`);return de});if(D.length===0&&ue.some((de)=>de!==null))throw Error(`${X} slots must be omitted or all-null when keys is empty.`);return ue}function Zt(s){let X=At(s,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let oe=Ot(X.keys,"KMS pool",{allowEmpty:!0}),ue=Xt(X.slots,oe,"KMS pool");return ue?{kind:"kms",slots:ue,keys:oe}:{kind:"kms",keys:oe}}function Qt(s){let X=At(s,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:Ot(X.keys,"KMS pool control document",{allowEmpty:!0})}}var eo={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function Dt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function Tt(s){let D=Dt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(D)?D:JSON.stringify(D)}function to(s){return Dt(s).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function wt(s,D,X){if(X==null)return;if(X instanceof Error){let oe=te(X);if(oe){for(let[ue,de]of Object.entries(oe))if(de!=null)s.push(`${ue}=${Tt(de)}`);return}if(s.push(`${D}.name=${Tt(X.name)}`),s.push(`${D}.message=${Tt(X.message)}`),X.stack)s.push(`${D}.stack=${Tt(X.stack)}`);return}s.push(`${D}=${Tt(X)}`)}function Et(s,D,X=[],oe=new Date){let ue=to(D instanceof Error?D.message:D??""),de=[];for(let[Ce,we]of X.entries()){if(we&&typeof we==="object"&&!Array.isArray(we)&&!(we instanceof Error)&&Object.getPrototypeOf(we)===Object.prototype){for(let[ke,Xe]of Object.entries(we))wt(de,ke,Xe);continue}wt(de,`param.${Ce}`,we)}return[oe.toISOString(),eo[s],ue,...de].filter(Boolean).join(" ")}var Kt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},oo=Kt,ro={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},no={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},so={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},io={trace:()=>{},debug:(s,...D)=>globalThis.console.debug(Et("debug",s,D)),info:(s,...D)=>globalThis.console.info(Et("info",s,D)),warn:(s,...D)=>globalThis.console.warn(Et("warn",s,D)),error:(s,...D)=>globalThis.console.error(Et("error",s,D))};function ao(s,D){if(typeof D!=="number"||D<=0)return s;return new Promise((X,oe)=>{let ue=setTimeout(()=>{oe(Error(`Authz catalog entry did not become ready within ${D}ms`))},D);s.then(()=>{clearTimeout(ue),X()},(de)=>{clearTimeout(ue),oe(de)})})}function po(s,D){let X=!1,oe,ue=D.then(()=>{X=!0},(Ce)=>{X=!1,oe=Ce}),de=s;return Object.defineProperty(de,"ready",{enumerable:!1,configurable:!0,value:(Ce)=>ao(ue.then(()=>{if(!X)throw oe}),Ce)}),Object.defineProperty(de,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),de}var bt=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:je,yaml:"application/yaml",toml:"application/toml",xml:Me});function xt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let D=s.mimeType?.trim()||bt[s.format],X=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>X})}function co(s="jsonc"){return{format:s,mimeType:bt[s],typeId:s}}class Lt extends n{constructor(s,D){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${D.mimeType}" (${D.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=D}}var mo=xt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Nt={beforeTenantSegments:["ui"]},$t={beforeTenantSegments:["api"]};function Mt(s){return(s??[]).map((D)=>D.trim()).filter(Boolean)}function Ut(s){let D=s.trim();if(!D)return"/";let X=D.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function Ft(s){return Ut(s).split("/").filter(Boolean)}function Rt(s){return{beforeTenantSegments:Mt(s?.beforeTenantSegments),afterTenantSegments:Mt(s?.afterTenantSegments)}}function Wt(s){if(s?.type==="host")return{type:"host",baseDomain:_t(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:Rt(s?.ui??Nt),api:Rt(s?.api??$t)}}function _t(s){let D=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!D)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return D}function uo(s,D){let X=s.trim().replace(/\.$/,"").toLowerCase(),oe=_t(D);if(!X.endsWith(`.${oe}`))return null;let ue=X.slice(0,-(oe.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function lo(s,D){let X=Rt(D),oe=X.beforeTenantSegments??[],ue=X.afterTenantSegments??[],de=Ft(s),Ce=oe.length+1+ue.length;if(de.length<Ce)return null;for(let Ge=0;Ge<oe.length;Ge++)if(de[Ge]!==oe[Ge])return null;let we=oe.length,ke=de[we];if(!ke)return null;for(let Ge=0;Ge<ue.length;Ge++)if(de[we+1+Ge]!==ue[Ge])return null;let Xe=de.slice(we+1+ue.length);return{id:decodeURIComponent(ke),restSegments:Xe,restPath:Xe.length>0?`/${Xe.join("/")}`:"/"}}function qt(s,D="/",X){let oe=Rt(X),ue=oe.beforeTenantSegments??[],de=oe.afterTenantSegments??[],Ce=Ft(D),we=[...ue,encodeURIComponent(s),...de,...Ce];return we.length>0?`/${we.join("/")}`:"/"}function go(s,D="/",X,oe="ui"){let ue=Wt(X);if(ue.type==="host"||ue.type==="selector")return Ut(D);return qt(s,D,ue[oe])}function fo(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={...X},de=["iss","sub"];for(let ke of de)if(ke in X){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if("aud"in X&&X.aud!==void 0){let ke=X.aud;if(typeof ke!=="string"&&!Array.isArray(ke))oe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ke)&&!ke.every((Xe)=>typeof Xe==="string"))oe.push({message:"aud array must contain only strings",path:["aud"]})}let Ce=["jti","scope"];for(let ke of Ce)if(ke in X&&X[ke]!==void 0){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}let we=["exp","iat"];for(let ke of we)if(ke in X){if(typeof X[ke]!=="number")oe.push({message:`${ke} must be a number`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function yo(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={};if("access_token"in X)if(typeof X.access_token==="string")ue.access_token=X.access_token;else oe.push({message:"access_token must be a string",path:["access_token"]});else oe.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")ue.token_type=X.token_type;else oe.push({message:"token_type must be a string",path:["token_type"]});else oe.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)ue.scope=X.scope;else oe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)ue.refresh_token=X.refresh_token;else oe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)ue.expires=X.expires;else oe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)ue.expires_in=X.expires_in;else oe.push({message:"expires_in must be a number",path:["expires_in"]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function So(s){let D=new Uint8Array(s);return crypto.getRandomValues(D),D}function Co(s){let D="",X=So(s);for(let oe=0;oe<s;oe++){let ue=X[oe]%32;D+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return D}function To(s,D){let X="";for(let oe=D;oe>0;oe--){let ue=s%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+X,s=Math.floor(s/32)}return X}function Eo(s){let D=Date.now(),X=To(D,10),oe=Co(16);return`${s??""}${X}${oe}`}var jt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function Vt(s){return typeof s==="string"&&s.trim().length>0}function Ro(s){let D=Vt(s.vaultUrl)?s.vaultUrl:void 0,X=Object.keys(s).some((ue)=>ue.startsWith("vaultLfv")&&s[ue]!==void 0);if(D&&X)return"vaultUrl and vaultLfv* are mutually exclusive";if(!D&&!X)return;if(X){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(jt.some((ue)=>!Vt(s[ue])))return`LFV requires ${jt.join(", ")}`;return}let oe;try{oe=new URL(D).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(oe==="http:"||oe==="https:")return;if(oe==="ws:"||oe==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{l as ACCEPT_JSON,ut as ACCEPT_OCTET_STREAM,he as ACCEPT_SCIM,ct as ACCEPT_XML,Le as AssignmentPolicyError,ne as CANONICAL_RISK_LEVELS,w as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,lt as CONTENT_TYPE_OCTET_STREAM,A as CONTENT_TYPE_SCIM,dt as CONTENT_TYPE_XML,It as ConfigSourceError,et as DEFAULT_DISCOVERED_COOKIE_MAX,tt as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Qe as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,bt as DEFAULT_SECRET_MIME_TYPES,$t as DEFAULT_TENANT_API_NAMESPACE,Nt as DEFAULT_TENANT_UI_NAMESPACE,ie as DISCOVERED_COOKIE_PREFIX,Ze as DISPLAY_COOKIE_SUFFIX,G as DISPLAY_COOKIE_VERSION,We as ECID_SCHEME,N as ENTRA_ION_EXTENSION_URN,M as EcidFormatError,L as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,_e as ION_AUTHZ_OAA_SYNC,Ue as ION_CAPABILITIEZ_READ,De as ION_CIAM_MAGIC_LINK_CREATE,it as ION_ENDPOINT_PERMISSIONS,Pe as ION_IAM_ACCESS_REQUESTS_WRITE,xe as ION_IAM_CUSTOMERS_WRITE,Ee as ION_IAM_DELEGATES_WRITE,Ie as ION_IAM_GROUPS_WRITE,Re as ION_IAM_READ,Ae as ION_IAM_USERS_WRITE,ve as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,b as ION_SCIM_DELEGATE_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,fe as ION_SDK_PERMISSIONS,Oe as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,E as KNOWN_BASE_CUSTOMER_KEYS,x as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,P as KNOWN_WORKLOAD_KEYS,je as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,at as SCIM_MEDIA_TYPE,Lt as SecretContentTypeMismatchError,v as StoreConflictError,St as TM_REQUEST_URI_PREFIX,ht as TM_STAGED_HANDLE_TYP,Me as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,Je as accessSubjectId,j as assertEcid,re as assertRequiredSubjectType,U as assertValidSubjectTypeScoping,qt as buildTenantPath,go as buildTenantUrl,V as catalogEntityStore,Q as claimsToUser,_ as compareDisplayExpiryDesc,Pt as configSourceOriginLogFields,He as configTrustedClientGrants,c as customAttributes,pe as customerResourceSchema,ro as debugLogger,Ke as decodeDisplayCookie,yt as decodeUser,C as deepEqualPlain,be as defaultDisplayUser,oo as defaultLogger,co as defaultSecretContentType,$e as defineCatalog,xt as defineSecretType,me as delegateResourceSchema,se as deprecateRetiredCodeCatalogRows,Ht as describeOriginUrl,Y as discoveredProfileCookieName,F as encodeDisplayCookie,te as errorLogAttributes,nt as formatEcid,Et as formatLogLine,Eo as generateULID,W as getCodeCatalogEntity,ot as groupResourceSchema,T as idTokenClaimsSchema,no as infoLogger,qe as isCodeCatalog,Ne as isConfigLocator,Gt as isConfigSourceError,Ve as isEcid,ze as isJsonResponse,q as isStoreConflictError,fo as jwtAssertionClaimsSchema,K as list,u as listGenerator,uo as matchTenantHost,lo as matchTenantPath,Fe as matchesListFilter,z as materializeCodeCatalogEntity,R as mergeCodeCatalogEntity,pt as mergeConfig,e as must,_t as normalizeTenantBaseDomain,Rt as normalizeTenantPathNamespace,Wt as normalizeTenantRoutingStrategy,ge as oidcCallbackSchema,rt as parseEcid,mt as parseJsonc,Qt as parseKmsPoolControlDocument,Zt as parseKmsPoolDocument,io as prettyLogger,O as profileCookieName,g as projectDisplayUser,J as readDisplayCookies,d as readJsonResponse,po as readyCatalogEntry,mo as remoteConfigSecretType,H as resolveDiscoveredCookieMax,ce as resolveDiscoveredCookieTtlSeconds,ae as resolveDisplayCookieMax,Te as sanitizeDisplayUser,Jt as serializeConfig,Kt as silentLogger,ft as stableConfigHash,Be as stripJsonComments,kt as tmIntegrationState,Ye as toCodeCatalog,ye as tokenResponseSchema,I as trimTrailingSlash,ee as trustedClientPermissionsForPrincipal,Z as unexpectedBodySummary,B as unionCatalogRead,st as userSchema,Se as validationFailureResponse,Ro as vaultConfigLocatorTransportError,Bt as version,gt as waitOn,so as warnLogger,m as withValidate,le as workloadResourceSchema,yo as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -5298,6 +5298,12 @@ type TmIoniteConfig = {
 	/** Named outgoing workload client that authenticates every `ion.tm.sendWebhook` call to ionite. */
 	webhookClient?: string;
 };
+/** A pushed staged request: the verified handle behind one `request_uri`, kept App-side until it expires. */
+type StagedRequestRecord = {
+	handle: string;
+	/** The handle's own expiry; stores MUST NOT return the record after it. */
+	expiresAt: string;
+};
 type RemoteTmConfig = {
 	enabled: true;
 	ionite: TmIoniteConfig;
@@ -5310,7 +5316,8 @@ type RemoteTmConfig = {
 	requestTokenTtlSeconds?: number;
 };
 type RecordTenantConsentInput = {
-	handle: string;
+	/** `staged.requestUri` from `onConnectRequest`. */
+	requestUri: string;
 	tenantId: string;
 	decision: "consented" | "declined";
 	decidedBy?: string;
@@ -5383,6 +5390,15 @@ interface TenantStore<TTenant extends BaseTenant = BaseTenant> {
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration?(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash?(handleHash: string): Promise<TTenant | undefined>;
+	/**
+	* Pushed staged requests, keyed by the SHA-256 digest of their `request_uri`. Consent (stage,
+	* authorize, `recordConsent`) needs these two plus `setIntegration`/`getByIntegrationHandleHash`
+	* and answers 501 without them; redeem and need only that integration pair. `getStagedRequest` MUST return `undefined` once
+	* `record.expiresAt` has passed, and must be shared across App replicas: ionite pushes to one and
+	* the browser may reach another.
+	*/
+	setStagedRequest?(requestUriHash: string, record: StagedRequestRecord): Promise<void>;
+	getStagedRequest?(requestUriHash: string): Promise<StagedRequestRecord | undefined>;
 	/** Indexed lookup by the SHA-256 digest of an App onboarding request token. */
 	getByRequestTokenHash?(requestTokenHash: string): Promise<TTenant | undefined>;
 	/**
@@ -5414,6 +5430,8 @@ declare class InMemoryTenantStore<TTenant extends BaseTenant = BaseTenant> imple
 	getIon(id: string): Promise<Ionite | undefined>;
 	setIntegration(tenantId: string, integration: TenantIntegration | undefined, options?: SetTenantIntegrationOptions): Promise<TTenant | undefined>;
 	getByIntegrationHandleHash(handleHash: string): Promise<TTenant | undefined>;
+	setStagedRequest(requestUriHash: string, record: StagedRequestRecord): Promise<void>;
+	getStagedRequest(requestUriHash: string): Promise<StagedRequestRecord | undefined>;
 	getByRequestTokenHash(requestTokenHash: string): Promise<TTenant | undefined>;
 	replaceActionRequest(expectedRequestTokenHash: string, tenant: TTenant): Promise<TTenant | undefined>;
 	getByIoniteId(ioniteId: string): Promise<TTenant | undefined>;