@ionite/core 0.0.22 → 0.0.23-beta.20260729.1

package/dist/index.d.ts

@@ -1136,7 +1136,7 @@ type ModuleReadinessState = {
 * Holistic, read-only readiness snapshot for an ionite instance. Returned by
 * `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
 * DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
-* non-ES dependency checks to build their health endpoints.
+* non-ionite dependency checks to build their health endpoints.
 */
 type ReadinessReport = {
 	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
@@ -1615,7 +1615,7 @@ type TrustedIdp = {
 * Workload config with separate incoming (server) and outgoing (client) roles.
 * - **incoming**: Server-only config for validating tokens presented to this app. Either a single
 *   `{ jwksUri, issuer }` config, or a list of {@link TrustedIdp} entries for multi-IdP trust.
-* - **outgoing**: Map of named clients for outbound calls; use getWorkloadToken(client, ion, scope?) from server (client is required and must be one of the outgoing names; pass the ES instance).
+* - **outgoing**: Map of named clients for outbound calls; use getWorkloadToken(client, ion, scope?) from server (client is required and must be one of the outgoing names; pass the Ionite instance).
 */
 type WorkloadIncomingOutgoing = {
 	incoming?: Partial<WorkloadConfig> | TrustedIdp[];
@@ -2424,7 +2424,7 @@ declare function stripJsonComments(content: string): string;
 declare function parseJsonc<T>(content: string): T;
 /**
 * Trim trailing slashes from a routing path while preserving the lone root `'/'`. This is the single
-* shared rule used by the ES routing surfaces (router, tenant-manager, adaptive-framework URL
+* shared rule used by the ionite routing surfaces (router, tenant-manager, adaptive-framework URL
 * derivation, IAM discovery) so trailing-slash normalization can never drift between them (§8.4).
 *
 * Note: this is intentionally NOT used by the redirect/LFV path-COMPARE helpers (which deliberately
@@ -3227,7 +3227,7 @@ type ConfigLocator = VaultConfigLocator | AwsConfigLocator | AzureConfigLocator
 * - `path`: the tenant-specific secret path within that source.
 * - `ttl` (optional): poll interval (ms) for the tenant config subscription.
 *
-* This keeps credentials/connection wiring on the root ES (ConfigSource-owned) and out of the tenant
+* This keeps credentials/connection wiring on the root Ionite (ConfigSource-owned) and out of the tenant
 * store, and forces apps to declare their secrets sources up front rather than spinning them up
 * ad-hoc per tenant.
 */
@@ -3238,7 +3238,7 @@ type TenantConfigLocator = {
 };
 /**
 * Minimal handle needed to materialize a tenant's {@link ConfigSource} from a {@link TenantConfigLocator}.
-* Structurally satisfied by an `Ionite` instance (`es`): the default `secret` client plus
+* Structurally satisfied by an `Ionite` instance (`ion`): the default `secret` client plus
 * the optional named `secrets` sources.
 */
 type ConfigSourceResolver = {
@@ -3280,7 +3280,7 @@ type AuthzOaaConfig = {
 	};
 };
 /**
-* A config-declared workload client that is pre-authorized to hold specific `es:*` (or app) permissions
+* A config-declared workload client that is pre-authorized to hold specific `ion:*` (or app) permissions
 * WITHOUT a stored grant in the AccessAssignmentStore. This is a read-path overlay used for bootstrap
 * and provisioning identities (e.g. the deployer, tenant provisioning, SCIM aggregators) so the SDK
 * never has to write seed grants to a remote store at initialization (see
@@ -3389,7 +3389,7 @@ type FrameworkConfig = {
 	validators: IoniteValidators;
 };
 /**
-* ES-mounted endpoint paths are deterministic from `basePath` and are NOT customizable in code.
+* ionite-mounted endpoint paths are deterministic from `basePath` and are NOT customizable in code.
 * The `*FromCode` types below strip those endpoint URLs from the module config that application
 * code may pass. App-owned redirect behavior comes from the `beforeLogin`/`afterLogin`/`beforeLogout`/
 * `afterLogout` callbacks, which are code-only and therefore kept. RemoteConfig-only intent flags (e.g. IAM `users`/`groups`
@@ -3812,7 +3812,7 @@ type CIAM<
 	ready?: (timeout?: number) => Promise<void>;
 };
 /**
-* CIAM config that code may provide; excludes vault-only secrets (`providers`) and ES-derived
+* CIAM config that code may provide; excludes vault-only secrets (`providers`) and ionite-derived
 * endpoint URLs (`customerLoginUrl`, `customerCallbackUrl`, `customerProvidersUrl`).
 */
 type CIAMConfigFromCode<
@@ -3903,7 +3903,7 @@ type IoniteBase = {
 	/**
 	* Holistic, read-only readiness snapshot: per-module readiness plus config-application status.
 	* Composition data for building health endpoints; does not gate the request path. Combine with
-	* `requireReady([...])` and your own non-ES service checks in your `/readyz` handler.
+	* `requireReady([...])` and your own non-ionite service checks in your `/readyz` handler.
 	*/
 	readiness(): ReadinessReport;
 	/**
@@ -3976,7 +3976,7 @@ type RoutingOptions = {
 /**
 * Optional hooks for config application lifecycle in `ionite(...)`.
 * - beforeChange runs before applying config and can return overrides.
-* - afterChange runs after applying config and receives the configured ES instance.
+* - afterChange runs after applying config and receives the configured Ionite instance.
 */
 type ConfigChangeOptions = {
 	beforeChange?: ConfigChangeCallback;
@@ -4101,8 +4101,8 @@ type BaseTenant = {
 	updatedAt: Date;
 	/**
 	* Serializable pointer used to materialize this tenant's ConfigSource. Resolves against the root
-	* ES secrets sources ({@link TenantConfigLocator}); carries no connection details or credentials.
-	* Required: every tenant has config, so `createEs`/`tenantConfigSource` can rely on it without a
+	* ionite secrets sources ({@link TenantConfigLocator}); carries no connection details or credentials.
+	* Required: every tenant has config, so `createIon`/`tenantConfigSource` can rely on it without a
 	* runtime presence guard.
 	*/
 	configLocator: TenantConfigLocator;
@@ -4122,7 +4122,7 @@ type TenantFactory<TTenant extends BaseTenant = BaseTenant> = (tenant: TTenant)
 * const ionCache = new LRUCache<string, Ionite>({
 *   max: 100,
 *   ttl: 1000 * 60 * 60,
-*   dispose: (es) => ion.close(), // full lifecycle: evicted/invalidated runtimes are closed
+*   dispose: (ion) => ion.close(), // full lifecycle: evicted/invalidated runtimes are closed
 *   fetchMethod: async (id) => {
 *     const tenant = await tenants.get(id); // `tenants` assigned below; resolved at call time
 *     return tenant ? createTenantIon(tenant) : undefined;
@@ -4182,7 +4182,7 @@ type BaseUser<TExtended = object> = BaseUserFields & {
 	* Optional Enterprise Controlled ID: a system-of-record-owned identity correlator formatted as
 	* `ecid:<realm>:<opaque>` (realm = the minting authority's id). Correlates this account to a
 	* single identity across systems. Minted by the enterprise SOR (via an ECI), never by the app;
-	* received on the SCIM ES extension or the `ecid` JWT claim. Never an authorization subject.
+	* received on the SCIM ionite extension or the `ecid` JWT claim. Never an authorization subject.
 	* See https://ionite.com/docs/llms-ecid.txt.
 	*/
 	ecid?: string;

package/dist/index.js

@@ -1 +1 @@
-import{A as K0,B as C0,C as W0,D as P0,E as D0,F as k0,G as E0,H as v0,I as w0,J as S0,K as R0,L as T0,M as b0,N as L0,Q as I0,R as N0,S as y0,T as A0,U as _0,V as f0,a as r,b as t,c as s,d as e,e as Q0,f as X0,l as $0,m as J0,n as V0,o as B0,p as x0,q as Z0,r as F0,s as H0,t as q0,u as G0,v as U0,w as j0,x as Y0,y as z0,z as M0}from"./shared/core-02035cvg.js";var S="0.0.22";class j extends Error{kind;recoverable;code;status;path;sourceType;constructor($,J){super($,J.cause!==void 0?{cause:J.cause}:void 0);this.name="ConfigSourceError",this.kind=J.kind,this.recoverable=J.recoverable,this.code=J.code,this.status=J.status,this.path=J.path,this.sourceType=J.sourceType,Object.setPrototypeOf(this,j.prototype)}}function R($){return $ instanceof j}var Z=["workload"],Y={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},z={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},M={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},K={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},C={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Z},W={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},P={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},T=[Y,z,M,K,C,W,P],b={"iam.read":{permission:Y,subjectType:["workload"]},"iam.users.write":{permission:z,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:K,subjectType:["workload"]},"ciam.magic-link.create":{permission:C,subjectType:["workload","user"]},"authz.oaa.sync":{permission:W,subjectType:["workload"]},"tenant.manage":{permission:P,subjectType:["workload"]}};var L=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function D($){if($===null||typeof $!=="object")return $;let J={};for(let[Q,X]of Object.entries($)){if(L.includes(Q)||Q==="validators"||Q==="setStores")continue;J[Q]=X!==null&&typeof X==="object"&&!Array.isArray(X)&&Object.getPrototypeOf(X)===Object.prototype?D(X):X}return J}function I($){return D($)}var k={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},N=k,y={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},A={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},_={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function f($,J){if(typeof J!=="number"||J<=0)return $;return new Promise((Q,X)=>{let B=setTimeout(()=>{X(Error(`Authz catalog entry did not become ready within ${J}ms`))},J);$.then(()=>{clearTimeout(B),Q()},(x)=>{clearTimeout(B),X(x)})})}function O($,J){let Q=!1,X,B=J.then(()=>{Q=!0},(F)=>{Q=!1,X=F}),x=$;return Object.defineProperty(x,"ready",{enumerable:!1,configurable:!0,value:(F)=>f(B.then(()=>{if(!Q)throw X}),F)}),Object.defineProperty(x,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),x}var h={beforeTenantSegments:["ui"]},p={beforeTenantSegments:["api"]};function E($){return($??[]).map((J)=>J.trim()).filter(Boolean)}function g($){let J=$.trim();if(!J)return"/";let Q=J.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function v($){return g($).split("/").filter(Boolean)}function U($){return{beforeTenantSegments:E($?.beforeTenantSegments),afterTenantSegments:E($?.afterTenantSegments)}}function d($){return{type:"path",ui:U($?.ui),api:U($?.api)}}function c($,J){let Q=U(J),X=Q.beforeTenantSegments??[],B=Q.afterTenantSegments??[],x=v($),F=X.length+1+B.length;if(x.length<F)return null;for(let H=0;H<X.length;H++)if(x[H]!==X[H])return null;let q=X.length,V=x[q];if(!V)return null;for(let H=0;H<B.length;H++)if(x[q+1+H]!==B[H])return null;let G=x.slice(q+1+B.length);return{id:decodeURIComponent(V),restSegments:G,restPath:G.length>0?`/${G.join("/")}`:"/"}}function m($,J="/",Q){let X=U(Q),B=X.beforeTenantSegments??[],x=X.afterTenantSegments??[],F=v(J),q=[...B,encodeURIComponent($),...x,...F];return q.length>0?`/${q.join("/")}`:"/"}function u($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={...Q},x=["iss","sub"];for(let V of x)if(V in Q){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if("aud"in Q&&Q.aud!==void 0){let V=Q.aud;if(typeof V!=="string"&&!Array.isArray(V))X.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(V)&&!V.every((G)=>typeof G==="string"))X.push({message:"aud array must contain only strings",path:["aud"]})}let F=["jti","scope"];for(let V of F)if(V in Q&&Q[V]!==void 0){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}let q=["exp","iat"];for(let V of q)if(V in Q){if(typeof Q[V]!=="number")X.push({message:`${V} must be a number`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if(X.length>0)return{issues:X};return{value:B}}}}}function l($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={};if("access_token"in Q)if(typeof Q.access_token==="string")B.access_token=Q.access_token;else X.push({message:"access_token must be a string",path:["access_token"]});else X.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")B.token_type=Q.token_type;else X.push({message:"token_type must be a string",path:["token_type"]});else X.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)B.scope=Q.scope;else X.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)B.refresh_token=Q.refresh_token;else X.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)B.expires=Q.expires;else X.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)B.expires_in=Q.expires_in;else X.push({message:"expires_in must be a number",path:["expires_in"]});if(X.length>0)return{issues:X};return{value:B}}}}}function n($){let J=new Uint8Array($);return crypto.getRandomValues(J),J}function a($){let J="",Q=n($);for(let X=0;X<$;X++){let B=Q[X]%32;J+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)}return J}function o($,J){let Q="";for(let X=J;X>0;X--){let B=$%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)+Q,$=Math.floor($/32)}return Q}function i($){let J=Date.now(),Q=o(J,10),X=a(16);return`${$??""}${Q}${X}`}export{l as workloadTokenResponseSchema,z0 as withValidate,_ as warnLogger,v0 as waitOn,S as version,K0 as validationFailureResponse,_0 as userSchema,B0 as unionCatalogRead,r as trustedClientPermissionsForPrincipal,D0 as trimTrailingSlash,j0 as tokenResponseSchema,J0 as toCodeCatalog,W0 as stripJsonComments,E0 as stableConfigHash,k as silentLogger,I as serializeConfig,O as readyCatalogEntry,P0 as parseJsonc,q0 as parseEcid,U0 as oidcCallbackSchema,d as normalizeTenantRoutingStrategy,U as normalizeTenantPathNamespace,M0 as must,C0 as mergeConfig,c as matchTenantPath,e as listGenerator,s as list,u as jwtAssertionClaimsSchema,T0 as isStoreConflictError,F0 as isEcid,R as isConfigSourceError,L0 as isConfigLocator,$0 as isCodeCatalog,A as infoLogger,Y0 as idTokenClaimsSchema,f0 as groupResourceSchema,i as generateULID,H0 as formatEcid,V0 as defineCatalog,N as defaultLogger,k0 as deepEqualPlain,S0 as decodeUser,y as debugLogger,t as configTrustedClientGrants,w0 as claimsToUser,m as buildTenantPath,y0 as assertValidSubjectTypeScoping,G0 as assertEcid,X0 as accessRootId,Q0 as accessRefId,R0 as StoreConflictError,N0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,b0 as IoniteError,P as ION_TENANT_MANAGE,T as ION_SDK_PERMISSIONS,A0 as ION_SCIM_USER_EXTENSION_URN,z as ION_IAM_USERS_WRITE,Y as ION_IAM_READ,M as ION_IAM_GROUPS_WRITE,b as ION_ENDPOINT_PERMISSIONS,C as ION_CIAM_MAGIC_LINK_CREATE,K as ION_CAPABILITIEZ_READ,W as ION_AUTHZ_OAA_SYNC,I0 as ION_AUTHZ_GROUP_SCHEMA,Z0 as EcidFormatError,x0 as ECID_SCHEME,h as DEFAULT_TENANT_UI_NAMESPACE,p as DEFAULT_TENANT_API_NAMESPACE,j as ConfigSourceError};
+import{A as K0,B as C0,C as W0,D as P0,E as D0,F as k0,G as E0,H as v0,I as w0,J as S0,K as R0,L as T0,M as b0,N as L0,Q as I0,R as N0,S as y0,T as A0,U as _0,V as f0,a as r,b as t,c as s,d as e,e as Q0,f as X0,l as $0,m as J0,n as V0,o as B0,p as x0,q as Z0,r as F0,s as H0,t as q0,u as G0,v as U0,w as j0,x as Y0,y as z0,z as M0}from"./shared/core-02035cvg.js";var S="0.0.23-beta.20260729.1";class j extends Error{kind;recoverable;code;status;path;sourceType;constructor($,J){super($,J.cause!==void 0?{cause:J.cause}:void 0);this.name="ConfigSourceError",this.kind=J.kind,this.recoverable=J.recoverable,this.code=J.code,this.status=J.status,this.path=J.path,this.sourceType=J.sourceType,Object.setPrototypeOf(this,j.prototype)}}function R($){return $ instanceof j}var Z=["workload"],Y={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},z={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},M={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},K={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},C={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:Z},W={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},P={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:Z,recommendedSubjectTypes:Z},T=[Y,z,M,K,C,W,P],b={"iam.read":{permission:Y,subjectType:["workload"]},"iam.users.write":{permission:z,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:K,subjectType:["workload"]},"ciam.magic-link.create":{permission:C,subjectType:["workload","user"]},"authz.oaa.sync":{permission:W,subjectType:["workload"]},"tenant.manage":{permission:P,subjectType:["workload"]}};var L=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function D($){if($===null||typeof $!=="object")return $;let J={};for(let[Q,X]of Object.entries($)){if(L.includes(Q)||Q==="validators"||Q==="setStores")continue;J[Q]=X!==null&&typeof X==="object"&&!Array.isArray(X)&&Object.getPrototypeOf(X)===Object.prototype?D(X):X}return J}function I($){return D($)}var k={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},N=k,y={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},A={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},_={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function f($,J){if(typeof J!=="number"||J<=0)return $;return new Promise((Q,X)=>{let B=setTimeout(()=>{X(Error(`Authz catalog entry did not become ready within ${J}ms`))},J);$.then(()=>{clearTimeout(B),Q()},(x)=>{clearTimeout(B),X(x)})})}function O($,J){let Q=!1,X,B=J.then(()=>{Q=!0},(F)=>{Q=!1,X=F}),x=$;return Object.defineProperty(x,"ready",{enumerable:!1,configurable:!0,value:(F)=>f(B.then(()=>{if(!Q)throw X}),F)}),Object.defineProperty(x,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),x}var h={beforeTenantSegments:["ui"]},p={beforeTenantSegments:["api"]};function E($){return($??[]).map((J)=>J.trim()).filter(Boolean)}function g($){let J=$.trim();if(!J)return"/";let Q=J.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function v($){return g($).split("/").filter(Boolean)}function U($){return{beforeTenantSegments:E($?.beforeTenantSegments),afterTenantSegments:E($?.afterTenantSegments)}}function d($){return{type:"path",ui:U($?.ui),api:U($?.api)}}function c($,J){let Q=U(J),X=Q.beforeTenantSegments??[],B=Q.afterTenantSegments??[],x=v($),F=X.length+1+B.length;if(x.length<F)return null;for(let H=0;H<X.length;H++)if(x[H]!==X[H])return null;let q=X.length,V=x[q];if(!V)return null;for(let H=0;H<B.length;H++)if(x[q+1+H]!==B[H])return null;let G=x.slice(q+1+B.length);return{id:decodeURIComponent(V),restSegments:G,restPath:G.length>0?`/${G.join("/")}`:"/"}}function m($,J="/",Q){let X=U(Q),B=X.beforeTenantSegments??[],x=X.afterTenantSegments??[],F=v(J),q=[...B,encodeURIComponent($),...x,...F];return q.length>0?`/${q.join("/")}`:"/"}function u($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={...Q},x=["iss","sub"];for(let V of x)if(V in Q){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if("aud"in Q&&Q.aud!==void 0){let V=Q.aud;if(typeof V!=="string"&&!Array.isArray(V))X.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(V)&&!V.every((G)=>typeof G==="string"))X.push({message:"aud array must contain only strings",path:["aud"]})}let F=["jti","scope"];for(let V of F)if(V in Q&&Q[V]!==void 0){if(typeof Q[V]!=="string")X.push({message:`${V} must be a string`,path:[V]})}let q=["exp","iat"];for(let V of q)if(V in Q){if(typeof Q[V]!=="number")X.push({message:`${V} must be a number`,path:[V]})}else X.push({message:`${V} is required`,path:[V]});if(X.length>0)return{issues:X};return{value:B}}}}}function l($){return{"~standard":{version:1,vendor:$,validate:(J)=>{if(typeof J!=="object"||J===null)return{issues:[{message:"Expected an object"}]};let Q=J,X=[],B={};if("access_token"in Q)if(typeof Q.access_token==="string")B.access_token=Q.access_token;else X.push({message:"access_token must be a string",path:["access_token"]});else X.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")B.token_type=Q.token_type;else X.push({message:"token_type must be a string",path:["token_type"]});else X.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)B.scope=Q.scope;else X.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)B.refresh_token=Q.refresh_token;else X.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)B.expires=Q.expires;else X.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)B.expires_in=Q.expires_in;else X.push({message:"expires_in must be a number",path:["expires_in"]});if(X.length>0)return{issues:X};return{value:B}}}}}function n($){let J=new Uint8Array($);return crypto.getRandomValues(J),J}function a($){let J="",Q=n($);for(let X=0;X<$;X++){let B=Q[X]%32;J+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)}return J}function o($,J){let Q="";for(let X=J;X>0;X--){let B=$%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(B)+Q,$=Math.floor($/32)}return Q}function i($){let J=Date.now(),Q=o(J,10),X=a(16);return`${$??""}${Q}${X}`}export{l as workloadTokenResponseSchema,z0 as withValidate,_ as warnLogger,v0 as waitOn,S as version,K0 as validationFailureResponse,_0 as userSchema,B0 as unionCatalogRead,r as trustedClientPermissionsForPrincipal,D0 as trimTrailingSlash,j0 as tokenResponseSchema,J0 as toCodeCatalog,W0 as stripJsonComments,E0 as stableConfigHash,k as silentLogger,I as serializeConfig,O as readyCatalogEntry,P0 as parseJsonc,q0 as parseEcid,U0 as oidcCallbackSchema,d as normalizeTenantRoutingStrategy,U as normalizeTenantPathNamespace,M0 as must,C0 as mergeConfig,c as matchTenantPath,e as listGenerator,s as list,u as jwtAssertionClaimsSchema,T0 as isStoreConflictError,F0 as isEcid,R as isConfigSourceError,L0 as isConfigLocator,$0 as isCodeCatalog,A as infoLogger,Y0 as idTokenClaimsSchema,f0 as groupResourceSchema,i as generateULID,H0 as formatEcid,V0 as defineCatalog,N as defaultLogger,k0 as deepEqualPlain,S0 as decodeUser,y as debugLogger,t as configTrustedClientGrants,w0 as claimsToUser,m as buildTenantPath,y0 as assertValidSubjectTypeScoping,G0 as assertEcid,X0 as accessRootId,Q0 as accessRefId,R0 as StoreConflictError,N0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,b0 as IoniteError,P as ION_TENANT_MANAGE,T as ION_SDK_PERMISSIONS,A0 as ION_SCIM_USER_EXTENSION_URN,z as ION_IAM_USERS_WRITE,Y as ION_IAM_READ,M as ION_IAM_GROUPS_WRITE,b as ION_ENDPOINT_PERMISSIONS,C as ION_CIAM_MAGIC_LINK_CREATE,K as ION_CAPABILITIEZ_READ,W as ION_AUTHZ_OAA_SYNC,I0 as ION_AUTHZ_GROUP_SCHEMA,Z0 as EcidFormatError,x0 as ECID_SCHEME,h as DEFAULT_TENANT_UI_NAMESPACE,p as DEFAULT_TENANT_API_NAMESPACE,j as ConfigSourceError};

package/dist/server.d.ts

@@ -1071,7 +1071,7 @@ type ModuleReadinessState = {
 * Holistic, read-only readiness snapshot for an ionite instance. Returned by
 * `ion.readiness()` and used by the built-in `${basePath}/readyz` endpoint. This is composition
 * DATA, not a request gate: applications combine it (via `ion.requireReady([...])`) with their own
-* non-ES dependency checks to build their health endpoints.
+* non-ionite dependency checks to build their health endpoints.
 */
 type ReadinessReport = {
 	/** True when config has been applied (`applied`) and every ACTIVE module is ready. */
@@ -1550,7 +1550,7 @@ type TrustedIdp = {
 * Workload config with separate incoming (server) and outgoing (client) roles.
 * - **incoming**: Server-only config for validating tokens presented to this app. Either a single
 *   `{ jwksUri, issuer }` config, or a list of {@link TrustedIdp} entries for multi-IdP trust.
-* - **outgoing**: Map of named clients for outbound calls; use getWorkloadToken(client, ion, scope?) from server (client is required and must be one of the outgoing names; pass the ES instance).
+* - **outgoing**: Map of named clients for outbound calls; use getWorkloadToken(client, ion, scope?) from server (client is required and must be one of the outgoing names; pass the Ionite instance).
 */
 type WorkloadIncomingOutgoing = {
 	incoming?: Partial<WorkloadConfig> | TrustedIdp[];
@@ -3075,7 +3075,7 @@ type AzureSecretsConfig = {
 * - `path`: the tenant-specific secret path within that source.
 * - `ttl` (optional): poll interval (ms) for the tenant config subscription.
 *
-* This keeps credentials/connection wiring on the root ES (ConfigSource-owned) and out of the tenant
+* This keeps credentials/connection wiring on the root Ionite (ConfigSource-owned) and out of the tenant
 * store, and forces apps to declare their secrets sources up front rather than spinning them up
 * ad-hoc per tenant.
 */
@@ -3109,7 +3109,7 @@ type AuthzOaaConfig = {
 	};
 };
 /**
-* A config-declared workload client that is pre-authorized to hold specific `es:*` (or app) permissions
+* A config-declared workload client that is pre-authorized to hold specific `ion:*` (or app) permissions
 * WITHOUT a stored grant in the AccessAssignmentStore. This is a read-path overlay used for bootstrap
 * and provisioning identities (e.g. the deployer, tenant provisioning, SCIM aggregators) so the SDK
 * never has to write seed grants to a remote store at initialization (see
@@ -3560,7 +3560,7 @@ type CIAM<
 	ready?: (timeout?: number) => Promise<void>;
 };
 /**
-* CIAM config that code may provide; excludes vault-only secrets (`providers`) and ES-derived
+* CIAM config that code may provide; excludes vault-only secrets (`providers`) and ionite-derived
 * endpoint URLs (`customerLoginUrl`, `customerCallbackUrl`, `customerProvidersUrl`).
 */
 type CIAMConfigFromCode<
@@ -3631,7 +3631,7 @@ type IoniteBase = {
 	/**
 	* Holistic, read-only readiness snapshot: per-module readiness plus config-application status.
 	* Composition data for building health endpoints; does not gate the request path. Combine with
-	* `requireReady([...])` and your own non-ES service checks in your `/readyz` handler.
+	* `requireReady([...])` and your own non-ionite service checks in your `/readyz` handler.
 	*/
 	readiness(): ReadinessReport;
 	/**
@@ -3682,8 +3682,8 @@ type BaseTenant = {
 	updatedAt: Date;
 	/**
 	* Serializable pointer used to materialize this tenant's ConfigSource. Resolves against the root
-	* ES secrets sources ({@link TenantConfigLocator}); carries no connection details or credentials.
-	* Required: every tenant has config, so `createEs`/`tenantConfigSource` can rely on it without a
+	* ionite secrets sources ({@link TenantConfigLocator}); carries no connection details or credentials.
+	* Required: every tenant has config, so `createIon`/`tenantConfigSource` can rely on it without a
 	* runtime presence guard.
 	*/
 	configLocator: TenantConfigLocator;
@@ -3702,7 +3702,7 @@ type BaseTenant = {
 * const ionCache = new LRUCache<string, Ionite>({
 *   max: 100,
 *   ttl: 1000 * 60 * 60,
-*   dispose: (es) => ion.close(), // full lifecycle: evicted/invalidated runtimes are closed
+*   dispose: (ion) => ion.close(), // full lifecycle: evicted/invalidated runtimes are closed
 *   fetchMethod: async (id) => {
 *     const tenant = await tenants.get(id); // `tenants` assigned below; resolved at call time
 *     return tenant ? createTenantIon(tenant) : undefined;
@@ -3773,7 +3773,7 @@ type BaseUser<TExtended = object> = BaseUserFields & {
 	* Optional Enterprise Controlled ID: a system-of-record-owned identity correlator formatted as
 	* `ecid:<realm>:<opaque>` (realm = the minting authority's id). Correlates this account to a
 	* single identity across systems. Minted by the enterprise SOR (via an ECI), never by the app;
-	* received on the SCIM ES extension or the `ecid` JWT claim. Never an authorization subject.
+	* received on the SCIM ionite extension or the `ecid` JWT claim. Never an authorization subject.
 	* See https://ionite.com/docs/llms-ecid.txt.
 	*/
 	ecid?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/core",
-  "version": "0.0.22",
+  "version": "0.0.23-beta.20260729.1",
   "description": "ionite Core (client-safe main entry; server handlers under ./server)",
   "private": false,
   "author": "ionite",