@ionite/core 0.0.23-beta.20260812.6 → 0.0.23-beta.20260814.1

package/dist/index.d.ts

@@ -389,8 +389,8 @@ type AuthenticatedUser = WorkforceUser | Customer;
 * flows that are inherently human.
 */
 type AuthenticatedPrincipal = AuthenticatedUser | WorkloadPrincipal;
+import { StandardSchemaV1 as StandardSchemaV19 } from "@standard-schema/spec";
 import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
-import { StandardSchemaV1 as StandardSchemaV17 } from "@standard-schema/spec";
 /**
 * Third-party CIAM provider presets and claim mapping.
 *
@@ -2052,45 +2052,45 @@ type IAM = IAMConfig & {
 	*/
 	delta?: IamDeltaEmitter;
 };
-type KmsKeyState = "pending" | "active" | "deprecated" | "revoked";
-type KmsPoolKind = "token" | "allocation";
-type KmsTokenKey = {
+type KmsKeyState = "pending" | "active" | "deprecated" | "rotated" | "revoked";
+type KmsKey = {
 	id: string;
 	state: KmsKeyState;
 	value?: string;
 	notBefore?: string;
 	notAfter?: string;
+	/** Control-plane lifecycle timestamps. Vaults omit these from personalized client grants. */
+	createdAt?: string;
+	activatedAt?: string;
+	deprecatedAt?: string;
+	rotatedAt?: string;
+	revokedAt?: string;
 	/** Control-plane metadata used for allocation policy and UI. Consumers should treat it as opaque. */
 	meta?: Record<string, unknown>;
 };
-type KmsTokenPoolDocument = {
-	kind: "token";
-	active: string;
-	keys: KmsTokenKey[];
-};
-/** Per-client allocation view delivered by a secrets source. */
-type KmsAllocationPoolView = {
-	kind: "allocation";
-	active: string;
-	keys: KmsTokenKey[];
+/** Personalized per-client view delivered by a secrets source. */
+type KmsPoolDocument = {
+	kind: "kms";
+	/** Omitted when the server has revoked the previous grant and no replacement is available yet. */
+	active?: string;
+	keys: KmsKey[];
 };
-type KmsPoolDocument = KmsTokenPoolDocument | KmsAllocationPoolView;
 type KmsAllocationStrategy = "spread" | "low-quota-first";
 type KmsAllocationPolicy = {
 	strategy?: KmsAllocationStrategy;
 	maxHoldersPerKey?: number;
+	/** Grace period during which a gracefully rotated key remains accepted. Defaults to 300 seconds. */
+	overlapSeconds?: number;
 };
-/** Control-plane allocation document stored by the vault. Clients receive a personalized view instead. */
-type KmsAllocationPoolDocument = {
-	kind: "allocation";
-	keys: KmsTokenKey[];
+/** Control-plane pool document stored by the vault. Clients receive a personalized view instead. */
+type KmsPoolControlDocument = {
+	kind: "kms";
+	keys: KmsKey[];
 	assignments: Record<string, string>;
 	policy?: KmsAllocationPolicy;
 };
 /** ConfigSource-owned pointer to a KMS pool document. */
 type KmsPoolConfig = {
-	/** Pool semantics. Defaults to `token`. */
-	kind?: KmsPoolKind;
 	/** Named `ion.secrets` source. Omit to use the default `ion.secret` source. */
 	source?: string;
 	/** Secret path. Defaults to `/kms/{poolName}`. */
@@ -2098,13 +2098,16 @@ type KmsPoolConfig = {
 };
 /** ConfigSource-owned named KMS pool declarations. */
 type KmsConfig = Record<string, KmsPoolConfig>;
-type KmsPoolListener = (current: KmsTokenKey | undefined) => void;
+type KmsPoolListener = (current: KmsKey | undefined) => void;
 type KmsPool = {
-	/** Returns the usable token value, briefly awaiting only a locally scheduled imminent activation. */
-	value(): Promise<string>;
-	/** Timing-safe verification against the active token and usable deprecated overlap tokens. */
+	/**
+	* Returns the current granted key. Calls wait on one shared local subscription until a grant is
+	* available; repeated calls resolve from the local cache and never initiate a vault request.
+	*/
+	value(timeout?: number): Promise<string>;
+	/** Timing-safe verification against the active key and usable deprecated rotation-overlap keys. */
 	accepts(candidate: string): boolean;
-	/** Notifies immediately and whenever the selected active token changes. */
+	/** Notifies immediately and whenever the selected active key changes. */
 	subscribe(listener: KmsPoolListener): () => void;
 	beforeChange(listener: ChangeListener): () => void;
 	afterChange(listener: ChangeListener): () => void;
@@ -2121,12 +2124,9 @@ type Kms = ModuleReadiness & {
 	getPool(name: string): KmsPool;
 };
 /** Parse and fail closed on a personalized KMS pool document. */
-declare function parseKmsPoolDocument(value: unknown): KmsTokenPoolDocument;
-declare function parseKmsPoolDocument(value: unknown, expectedKind: "token"): KmsTokenPoolDocument;
-declare function parseKmsPoolDocument(value: unknown, expectedKind: "allocation"): KmsAllocationPoolView;
-declare function parseKmsPoolDocument(value: unknown, expectedKind: KmsPoolKind): KmsPoolDocument;
-/** Parse and fail closed on a control-plane allocation-pool document. */
-declare function parseKmsAllocationPool(value: unknown): KmsAllocationPoolDocument;
+declare function parseKmsPoolDocument(value: unknown): KmsPoolDocument;
+/** Parse and fail closed on a control-plane KMS pool document. */
+declare function parseKmsPoolControlDocument(value: unknown): KmsPoolControlDocument;
 type OtelSignalName = "traces" | "metrics" | "logs";
 type OtelProtocol = "http/protobuf" | "http/json";
 type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
@@ -2170,7 +2170,7 @@ type OtelConfig = {
 	protocol?: OtelProtocol;
 	headers?: Record<string, string>;
 	apiKey?: string;
-	/** Name of a `RemoteConfig.kms` token pool used for exporter authentication. */
+	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
 	apiKeyPool?: string;
 	apiKeyHeader?: string;
 	oauth?: OtelOAuthClientCredentialsConfig;
@@ -2494,9 +2494,7 @@ declare function validationFailureResponse(issues: unknown, message: string): Re
 * @returns Merged configuration object
 */
 declare function mergeConfig<T extends Record<string, unknown>>(fromVault: T | undefined, fromCode: T | undefined, criticalFields?: string[]): T;
-/**
-* Strips // and /* *\/ comments from JSONC, respecting string literals.
-*/
+/** Strips // and /* *\/ comments from JSONC, respecting string literals. */
 declare function stripJsonComments(content: string): string;
 declare function parseJsonc<T>(content: string): T;
 /**
@@ -2849,6 +2847,57 @@ interface MagicLinkStore<TExtended = object> {
 	*/
 	delete(token: string): Promise<void>;
 }
+import { StandardSchemaV1 as StandardSchemaV17 } from "@standard-schema/spec";
+declare const DEFAULT_SECRET_MIME_TYPES: Readonly<Record<SecretFormat, string>>;
+type SecretTypeRegistryEntry = SecretContentType & {
+	id: string;
+	label?: string;
+};
+type SecretTypeInput<T> = {
+	id: string;
+	label?: string;
+	format: SecretFormat;
+	mimeType?: string;
+	schemaUrl?: string;
+	schema?: StandardSchemaV17<unknown, T>;
+};
+/**
+* Runtime contract for a custom secret type. The Standard Schema value is used only by server-side
+* parsing; `toRegistryEntry()` returns the serializable half that a vault editor can register.
+*/
+type SecretTypeDescriptor<T = unknown> = Readonly<{
+	id: string;
+	label?: string;
+	format: SecretFormat;
+	mimeType: string;
+	schemaUrl?: string;
+	schema?: StandardSchemaV17<unknown, T>;
+	toRegistryEntry(): SecretTypeRegistryEntry;
+}>;
+type InferSecretType<TType> = TType extends SecretTypeDescriptor<infer T> ? T : never;
+declare function defineSecretType<T>(input: SecretTypeInput<T> & {
+	schema: StandardSchemaV17<unknown, T>;
+}): SecretTypeDescriptor<T>;
+declare function defineSecretType(input: SecretTypeInput<unknown>): SecretTypeDescriptor<unknown>;
+declare function defaultSecretContentType(format?: SecretFormat): SecretContentType;
+/** Raised before decoding when a stored secret does not match the requested runtime contract. */
+declare class SecretContentTypeMismatchError extends Error {
+	readonly expected: SecretContentType;
+	readonly received: SecretContentType;
+	constructor(expected: SecretContentType, received: SecretContentType);
+}
+type SecretFormat = "jsonc" | "env" | "text" | "binary" | "yaml" | "toml" | "xml";
+/**
+* Self-describing content metadata persisted with a secret. `typeId` identifies an authoring preset;
+* decoding never depends on the preset registry because the resolved format/mime/schema travel with
+* the secret.
+*/
+type SecretContentType = {
+	format: SecretFormat;
+	mimeType: string;
+	schemaUrl?: string;
+	typeId?: string;
+};
 type Secret<T> = {
 	data: T;
 	metadata: MetaData;
@@ -2857,6 +2906,8 @@ type MetaData = {
 	path: string;
 	version: number;
 	created: Date;
+	/** Absent on legacy secrets, which are interpreted as JSONC. */
+	contentType?: SecretContentType;
 };
 type SecretsSourceType = "vault" | "azure" | "aws" | "gcp" | "dev";
 type SecretRequestSeverity = "low" | "medium" | "high" | "critical";
@@ -2878,6 +2929,24 @@ type SecretsOperationOptions = {
 	/** Optional timeout in milliseconds for this secrets operation. */
 	timeout?: number;
 };
+type SecretsWriteOptions = SecretsOperationOptions & {
+	/** Content contract stored with the secret and returned by all transports. */
+	contentType?: SecretContentType;
+};
+type SecretHandle = {
+	/** Reads the canonical textual representation. Binary secrets reject this accessor. */
+	text(): Promise<string>;
+	/** Decodes JSONC. Other formats reject this accessor. */
+	json<T = unknown>(): Promise<T>;
+	/** Reads the canonical bytes. Text formats are UTF-8 encoded. */
+	bytes(): Promise<Uint8Array>;
+	/** Decodes an env/key=value secret. */
+	env(): Promise<Record<string, string>>;
+	/** Reads metadata without decoding the value. */
+	metadata(): Promise<MetaData>;
+	/** Decodes and validates using a runtime secret-type descriptor. */
+	parse<T>(type: SecretTypeDescriptor<T>): Promise<T>;
+};
 type SubscriptionMode = "fail-fast" | "wait";
 type SecretsSubscriptionOptions = SecretsOperationOptions & {
 	/**
@@ -2923,13 +2992,15 @@ type FrameworkLfvConfig = {
 };
 type SecretsSource = ReactiveHandle & ModuleReadiness & {
 	type: SecretsSourceType;
+	/** Creates a lazy, Bun.file-style handle. No I/O occurs until an accessor is awaited. */
+	get(path: string, options?: SecretsOperationOptions): SecretHandle;
 	getFullSecret: <T>(path: string, options?: SecretsOperationOptions) => Promise<Secret<T>>;
 	getSecret: <T>(path: string, options?: SecretsOperationOptions) => Promise<T>;
 	/**
 	* Write a secret at the given path.
 	* Implementations may throw for read-only or unsupported secret sources.
 	*/
-	putSecret: (path: string, value: Record<string, unknown>, options?: SecretsOperationOptions) => Promise<void>;
+	putSecret: (path: string, value: Record<string, unknown>, options?: SecretsWriteOptions) => Promise<void>;
 	/**
 	* When set, the secret source supports change detection, reads the current value first, and calls onChange
 	* immediately with that value before watching for changes.
@@ -2991,12 +3062,14 @@ type Secrets = ModuleReadiness & {
 	listSecretsSources(): string[];
 	/** Gets a named secrets source client. Throws when missing. */
 	getSecretsSource(sourceName: string): SecretsSource;
+	/** Creates a lazy handle for a secret in a named source. */
+	get(sourceName: string, path: string, options?: SecretsOperationOptions): SecretHandle;
 	/** Reads a secret from a named secrets source client. */
 	getSecret<T>(sourceName: string, path: string, options?: SecretsOperationOptions): Promise<T>;
 	/** Reads full secret data + metadata from a named secrets source client. */
 	getFullSecret<T>(sourceName: string, path: string, options?: SecretsOperationOptions): Promise<Secret<T>>;
 	/** Writes a secret to a named secrets source client. */
-	putSecret(sourceName: string, path: string, value: Record<string, unknown>, options?: SecretsOperationOptions): Promise<void>;
+	putSecret(sourceName: string, path: string, value: Record<string, unknown>, options?: SecretsWriteOptions): Promise<void>;
 	/** Deletes a secret from a named secrets source client. */
 	deleteSecret(sourceName: string, path: string, options?: SecretsOperationOptions): Promise<void>;
 	/** Lists child paths under a base path for a named secrets source client. */
@@ -3563,7 +3636,7 @@ type RemoteConfig = {
 	workload?: WorkloadConfig | WorkloadConfigMap | WorkloadIncomingOutgoing;
 	/** Optional named secrets-source configs available to this App instance. */
 	secrets?: SecretsModuleConfig;
-	/** ConfigSource-owned named managed token pools consumed through `ion.kms`. */
+	/** ConfigSource-owned named server-allocated key pools consumed through `ion.kms`. */
 	kms?: KmsConfig;
 	ciam?: CIAMConfig;
 	/** OpenTelemetry collector/exporter config loaded from ConfigSource. */
@@ -3782,8 +3855,8 @@ type ConfigSource = {
 * built-in core schemas.
 */
 type CIAMValidators = {
-	customer: StandardSchemaV17<unknown, BaseCustomer> & {
-		validate(value: unknown): Promise<StandardSchemaV17.Result<BaseCustomer>>;
+	customer: StandardSchemaV18<unknown, BaseCustomer> & {
+		validate(value: unknown): Promise<StandardSchemaV18.Result<BaseCustomer>>;
 	};
 	callbackParams?: StandardSchemaWithValidate<OidcCallbackParams>;
 	idTokenClaims?: StandardSchemaWithValidate<IdTokenClaims>;
@@ -4205,9 +4278,9 @@ type TenantValidators<
 	TUpdateTenantRequest extends UpdateTenantRequest = UpdateTenantRequest,
 	TTenantResponse extends TenantResponse = TenantResponse
 > = {
-	createTenantRequest: StandardSchemaV18<unknown, TCreateTenantRequest>;
-	updateTenantRequest: StandardSchemaV18<unknown, TUpdateTenantRequest>;
-	tenantResponse?: StandardSchemaV18<unknown, TTenantResponse>;
+	createTenantRequest: StandardSchemaV19<unknown, TCreateTenantRequest>;
+	updateTenantRequest: StandardSchemaV19<unknown, TUpdateTenantRequest>;
+	tenantResponse?: StandardSchemaV19<unknown, TTenantResponse>;
 };
 declare function isConfigLocator(value: unknown): value is ConfigLocator;
 type BaseTenant = {
@@ -5422,7 +5495,7 @@ declare function normalizeTenantPathNamespace(namespace?: TenantPathNamespace):
 declare function normalizeTenantRoutingStrategy(strategy?: TenantRoutingStrategy): TenantPathRoutingStrategy;
 declare function matchTenantPath(pathname: string, namespace?: TenantPathNamespace): TenantPathMatch | null;
 declare function buildTenantPath(id: string, restPath?: string, namespace?: TenantPathNamespace): string;
-import { StandardSchemaV1 as StandardSchemaV19 } from "@standard-schema/spec";
+import { StandardSchemaV1 as StandardSchemaV110 } from "@standard-schema/spec";
 type RegisterSSOAppPayload = {
 	/** Redirect URIs for the client. */
 	redirectUris: string[];
@@ -5464,7 +5537,7 @@ type SSOAppRegistry = {
 	register: (payload: RegisterSSOAppPayload) => Promise<RegisterSSOAppResult>;
 };
 type SSOAppValidators = {
-	registerSSOAppPayload: StandardSchemaV19<unknown, RegisterSSOAppPayload>;
+	registerSSOAppPayload: StandardSchemaV110<unknown, RegisterSSOAppPayload>;
 };
 type RegisterIAMAppPayload = {
 	/** App/tenant identifier (same globally unique id used by the App tenant). */
@@ -5503,7 +5576,7 @@ type IAMAppRegistry = {
 	register: (payload: RegisterIAMAppPayload) => Promise<RegisterIAMAppResult>;
 };
 type IAMAppValidators = {
-	registerIAMAppPayload: StandardSchemaV19<unknown, RegisterIAMAppPayload>;
+	registerIAMAppPayload: StandardSchemaV110<unknown, RegisterIAMAppPayload>;
 };
 type LfvActionName = "read_secret" | "create_secret" | "update_secret" | "delete_secret" | "request_rotate" | "request_revoke" | "rotate_secret" | "revoke_secret" | "list_paths" | "list_secrets" | "read_metadata" | "remove_path";
 type LfvOtpRequest = {
@@ -5536,4 +5609,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { workloadTokenResponseSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, readyCatalogEntry, parseKmsPoolDocument, parseKmsAllocationPool, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, generateULID, formatEcid, defineCatalog, defaultLogger, deepEqualPlain, decodeUser, debugLogger, configTrustedClientGrants, claimsToUser, buildTenantPath, assertValidSubjectTypeScoping, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, TenantFactory, TenantConfigLocator, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretRequestSeverity, SecretLifecycleRequest, SecretEventName, SecretEventListener, SecretEvent, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelopeListener, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsTokenPoolDocument, KmsTokenKey, KmsPoolListener, KmsPoolKind, KmsPoolDocument, KmsPoolConfig, KmsPool, KmsKeyState, KmsConfig, KmsAllocationStrategy, KmsAllocationPoolView, KmsAllocationPoolDocument, KmsAllocationPolicy, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaMode, IamDeltaIdMapStore, IamDeltaIdMapKey, IamDeltaEmitter, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_USER_EXTENSION_URN, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, ApplicationValidators, Address, AccessStatus, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };
+export { workloadTokenResponseSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, readyCatalogEntry, parseKmsPoolDocument, parseKmsPoolControlDocument, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, generateULID, formatEcid, defineSecretType, defineCatalog, defaultSecretContentType, defaultLogger, deepEqualPlain, decodeUser, debugLogger, configTrustedClientGrants, claimsToUser, buildTenantPath, assertValidSubjectTypeScoping, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, TenantFactory, TenantConfigLocator, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsWriteOptions, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretTypeRegistryEntry, SecretTypeInput, SecretTypeDescriptor, SecretRequestSeverity, SecretLifecycleRequest, SecretHandle, SecretFormat, SecretEventName, SecretEventListener, SecretEvent, SecretContentTypeMismatchError, SecretContentType, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelopeListener, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsPoolListener, KmsPoolDocument, KmsPoolControlDocument, KmsPoolConfig, KmsPool, KmsKeyState, KmsKey, KmsConfig, KmsAllocationStrategy, KmsAllocationPolicy, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InferSecretType, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaMode, IamDeltaIdMapStore, IamDeltaIdMapKey, IamDeltaEmitter, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_USER_EXTENSION_URN, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_SECRET_MIME_TYPES, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, ApplicationValidators, Address, AccessStatus, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };

package/dist/index.js

@@ -1 +1 @@
-import{A as K0,B as b0,C as T0,D as L0,E as R0,F as N0,G as A0,H as _0,I as I0,J as f0,K as O0,L as v0,M as k0,N as w0,Q as y0,R as g0,S as h0,T as p0,U as m0,V as c0,a as $0,b as J0,c as V0,d as B0,e as Z0,f as F0,l as G0,m as H0,n as U0,o as q0,p as j0,q as Y0,r as z0,s as M0,t as C0,u as W0,v as D0,w as E0,x as P0,y as x0,z as S0}from"./shared/core-f0gk15rd.js";var A="0.0.23-beta.20260812.6";class z extends Error{kind;recoverable;code;status;path;sourceType;constructor(X,$){super(X,$.cause!==void 0?{cause:$.cause}:void 0);this.name="ConfigSourceError",this.kind=$.kind,this.recoverable=$.recoverable,this.code=$.code,this.status=$.status,this.path=$.path,this.sourceType=$.sourceType,Object.setPrototypeOf(this,z.prototype)}}function _(X){return X instanceof z}var q=["workload"],M={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:q,recommendedSubjectTypes:q},C={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},W={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},D={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:q,recommendedSubjectTypes:q},E={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:q},P={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:q,recommendedSubjectTypes:q},x={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},I=[M,C,W,D,E,P,x],f={"iam.read":{permission:M,subjectType:["workload"]},"iam.users.write":{permission:C,subjectType:["workload"]},"iam.groups.write":{permission:W,subjectType:["workload"]},"capabilitiez.read":{permission:D,subjectType:["workload"]},"ciam.magic-link.create":{permission:E,subjectType:["workload","user"]},"authz.oaa.sync":{permission:P,subjectType:["workload"]},"tenant.manage":{permission:x,subjectType:["workload"]}};var O=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function S(X){if(X===null||typeof X!=="object")return X;let $={};for(let[Q,J]of Object.entries(X)){if(O.includes(Q)||Q==="validators"||Q==="setStores")continue;$[Q]=J!==null&&typeof J==="object"&&!Array.isArray(J)&&Object.getPrototypeOf(J)===Object.prototype?S(J):J}return $}function v(X){return S(X)}function j(X,$){if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`${$} must be an object.`);return X}function K(X,$){if(X===void 0)return;if(typeof X!=="string"||X.length===0||!Number.isFinite(Date.parse(X)))throw Error(`${$} must be a valid timestamp string.`);return X}function b(X,$,Q){if(!Array.isArray(X)||!Q.allowEmpty&&X.length===0)throw Error(`${$} keys must be ${Q.allowEmpty?"an":"a non-empty"} array.`);let J=new Set;return X.map((Z,F)=>{let B=j(Z,`${$} keys[${F}]`);if(typeof B.id!=="string"||B.id.length===0)throw Error(`${$} keys[${F}].id must be a non-empty string.`);if(J.has(B.id))throw Error(`${$} contains duplicate key id "${B.id}".`);if(J.add(B.id),!["pending","active","deprecated","revoked"].includes(String(B.state)))throw Error(`${$} keys[${F}].state is invalid.`);if(B.value!==void 0&&(typeof B.value!=="string"||B.value.length===0))throw Error(`${$} keys[${F}].value must be a non-empty string when present.`);let U=B.meta===void 0?void 0:j(B.meta,`${$} keys[${F}].meta`);return{id:B.id,state:B.state,...B.value===void 0?{}:{value:B.value},...B.notBefore===void 0?{}:{notBefore:K(B.notBefore,`${$} keys[${F}].notBefore`)},...B.notAfter===void 0?{}:{notAfter:K(B.notAfter,`${$} keys[${F}].notAfter`)},...U?{meta:{...U}}:{}}})}function k(X,$){let Q=`KMS ${$} pool`,J=j(X,Q);if(J.kind!==$)throw Error(`${Q} kind must be "${$}".`);if(typeof J.active!=="string"||J.active.length===0)throw Error(`${Q} active must be a non-empty key id.`);let Z=b(J.keys,Q,{allowEmpty:!1}),F=Z.find((B)=>B.id===J.active);if(!F)throw Error(`${Q} active key "${J.active}" is not present in keys.`);if(F.state!=="active")throw Error(`${Q} active key "${J.active}" must have state "active".`);if(!F.value)throw Error(`${Q} active key "${J.active}" must include a value.`);return{kind:$,active:J.active,keys:Z}}function w(X,$="token"){return k(X,$)}function y(X){let Q=j(X,"KMS allocation pool");if(Q.kind!=="allocation")throw Error('KMS allocation pool kind must be "allocation".');let J=b(Q.keys,"KMS allocation pool",{allowEmpty:!0}),Z=j(Q.assignments,"KMS allocation pool assignments"),F={},B=new Map(J.map((V)=>[V.id,V]));for(let[V,H]of Object.entries(Z)){if(V.length===0||typeof H!=="string"||H.length===0)throw Error("KMS allocation pool assignments must map non-empty client ids to non-empty key ids.");let G=B.get(H);if(!G)throw Error(`KMS allocation pool assignment for "${V}" references missing key "${H}".`);if(G.state!=="active"||!G.value)throw Error(`KMS allocation pool assignment for "${V}" must reference an active key with a value.`);F[V]=H}let U;if(Q.policy!==void 0){let V=j(Q.policy,"KMS allocation pool policy"),H=V.strategy;if(H!==void 0&&H!=="spread"&&H!=="low-quota-first")throw Error("KMS allocation pool policy.strategy is invalid.");let G=V.maxHoldersPerKey;if(G!==void 0&&(typeof G!=="number"||!Number.isInteger(G)||G<=0))throw Error("KMS allocation pool policy.maxHoldersPerKey must be a positive integer when present.");U={...H?{strategy:H}:{},...G===void 0?{}:{maxHoldersPerKey:G}}}return{kind:"allocation",keys:J,assignments:F,...U?{policy:U}:{}}}var T={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},g=T,h={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},p={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},m={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function c(X,$){if(typeof $!=="number"||$<=0)return X;return new Promise((Q,J)=>{let Z=setTimeout(()=>{J(Error(`Authz catalog entry did not become ready within ${$}ms`))},$);X.then(()=>{clearTimeout(Z),Q()},(F)=>{clearTimeout(Z),J(F)})})}function u(X,$){let Q=!1,J,Z=$.then(()=>{Q=!0},(B)=>{Q=!1,J=B}),F=X;return Object.defineProperty(F,"ready",{enumerable:!1,configurable:!0,value:(B)=>c(Z.then(()=>{if(!Q)throw J}),B)}),Object.defineProperty(F,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),F}var d={beforeTenantSegments:["ui"]},l={beforeTenantSegments:["api"]};function L(X){return(X??[]).map(($)=>$.trim()).filter(Boolean)}function n(X){let $=X.trim();if(!$)return"/";let Q=$.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function R(X){return n(X).split("/").filter(Boolean)}function Y(X){return{beforeTenantSegments:L(X?.beforeTenantSegments),afterTenantSegments:L(X?.afterTenantSegments)}}function a(X){return{type:"path",ui:Y(X?.ui),api:Y(X?.api)}}function i(X,$){let Q=Y($),J=Q.beforeTenantSegments??[],Z=Q.afterTenantSegments??[],F=R(X),B=J.length+1+Z.length;if(F.length<B)return null;for(let G=0;G<J.length;G++)if(F[G]!==J[G])return null;let U=J.length,V=F[U];if(!V)return null;for(let G=0;G<Z.length;G++)if(F[U+1+G]!==Z[G])return null;let H=F.slice(U+1+Z.length);return{id:decodeURIComponent(V),restSegments:H,restPath:H.length>0?`/${H.join("/")}`:"/"}}function o(X,$="/",Q){let J=Y(Q),Z=J.beforeTenantSegments??[],F=J.afterTenantSegments??[],B=R($),U=[...Z,encodeURIComponent(X),...F,...B];return U.length>0?`/${U.join("/")}`:"/"}function r(X){return{"~standard":{version:1,vendor:X,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let Q=$,J=[],Z={...Q},F=["iss","sub"];for(let V of F)if(V in Q){if(typeof Q[V]!=="string")J.push({message:`${V} must be a string`,path:[V]})}else J.push({message:`${V} is required`,path:[V]});if("aud"in Q&&Q.aud!==void 0){let V=Q.aud;if(typeof V!=="string"&&!Array.isArray(V))J.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(V)&&!V.every((H)=>typeof H==="string"))J.push({message:"aud array must contain only strings",path:["aud"]})}let B=["jti","scope"];for(let V of B)if(V in Q&&Q[V]!==void 0){if(typeof Q[V]!=="string")J.push({message:`${V} must be a string`,path:[V]})}let U=["exp","iat"];for(let V of U)if(V in Q){if(typeof Q[V]!=="number")J.push({message:`${V} must be a number`,path:[V]})}else J.push({message:`${V} is required`,path:[V]});if(J.length>0)return{issues:J};return{value:Z}}}}}function t(X){return{"~standard":{version:1,vendor:X,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let Q=$,J=[],Z={};if("access_token"in Q)if(typeof Q.access_token==="string")Z.access_token=Q.access_token;else J.push({message:"access_token must be a string",path:["access_token"]});else J.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")Z.token_type=Q.token_type;else J.push({message:"token_type must be a string",path:["token_type"]});else J.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)Z.scope=Q.scope;else J.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)Z.refresh_token=Q.refresh_token;else J.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)Z.expires=Q.expires;else J.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)Z.expires_in=Q.expires_in;else J.push({message:"expires_in must be a number",path:["expires_in"]});if(J.length>0)return{issues:J};return{value:Z}}}}}function s(X){let $=new Uint8Array(X);return crypto.getRandomValues($),$}function e(X){let $="",Q=s(X);for(let J=0;J<X;J++){let Z=Q[J]%32;$+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)}return $}function Q0(X,$){let Q="";for(let J=$;J>0;J--){let Z=X%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)+Q,X=Math.floor(X/32)}return Q}function X0(X){let $=Date.now(),Q=Q0($,10),J=e(16);return`${X??""}${Q}${J}`}export{t as workloadTokenResponseSchema,x0 as withValidate,m as warnLogger,_0 as waitOn,A as version,K0 as validationFailureResponse,m0 as userSchema,q0 as unionCatalogRead,$0 as trustedClientPermissionsForPrincipal,R0 as trimTrailingSlash,E0 as tokenResponseSchema,H0 as toCodeCatalog,T0 as stripJsonComments,A0 as stableConfigHash,T as silentLogger,v as serializeConfig,u as readyCatalogEntry,w as parseKmsPoolDocument,y as parseKmsAllocationPool,L0 as parseJsonc,C0 as parseEcid,D0 as oidcCallbackSchema,a as normalizeTenantRoutingStrategy,Y as normalizeTenantPathNamespace,S0 as must,b0 as mergeConfig,i as matchTenantPath,B0 as listGenerator,V0 as list,r as jwtAssertionClaimsSchema,v0 as isStoreConflictError,z0 as isEcid,_ as isConfigSourceError,w0 as isConfigLocator,G0 as isCodeCatalog,p as infoLogger,P0 as idTokenClaimsSchema,c0 as groupResourceSchema,X0 as generateULID,M0 as formatEcid,U0 as defineCatalog,g as defaultLogger,N0 as deepEqualPlain,f0 as decodeUser,h as debugLogger,J0 as configTrustedClientGrants,I0 as claimsToUser,o as buildTenantPath,h0 as assertValidSubjectTypeScoping,W0 as assertEcid,F0 as accessRootId,Z0 as accessRefId,O0 as StoreConflictError,g0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,k0 as IoniteError,x as ION_TENANT_MANAGE,I as ION_SDK_PERMISSIONS,p0 as ION_SCIM_USER_EXTENSION_URN,C as ION_IAM_USERS_WRITE,M as ION_IAM_READ,W as ION_IAM_GROUPS_WRITE,f as ION_ENDPOINT_PERMISSIONS,E as ION_CIAM_MAGIC_LINK_CREATE,D as ION_CAPABILITIEZ_READ,P as ION_AUTHZ_OAA_SYNC,y0 as ION_AUTHZ_GROUP_SCHEMA,Y0 as EcidFormatError,j0 as ECID_SCHEME,d as DEFAULT_TENANT_UI_NAMESPACE,l as DEFAULT_TENANT_API_NAMESPACE,z as ConfigSourceError};
+import{A as A0,B as T0,C as _0,D as I0,E as O0,F as f0,G as w0,H as k0,I as v0,J as g0,K as y0,L as h0,M as m0,N as c0,Q as d0,R as p0,S as u0,T as l0,U as n0,V as a0,a as F0,b as G0,c as H0,d as U0,e as j0,f as q0,l as z0,m as Y0,n as W0,o as C0,p as M0,q as D0,r as K0,s as P0,t as E0,u as x0,v as b0,w as S0,x as L0,y as R0,z as N0}from"./shared/core-ymmjvtpm.js";var O="0.0.23-beta.20260814.1";class W extends Error{kind;recoverable;code;status;path;sourceType;constructor(Q,$){super(Q,$.cause!==void 0?{cause:$.cause}:void 0);this.name="ConfigSourceError",this.kind=$.kind,this.recoverable=$.recoverable,this.code=$.code,this.status=$.status,this.path=$.path,this.sourceType=$.sourceType,Object.setPrototypeOf(this,W.prototype)}}function f(Q){return Q instanceof W}var j=["workload"],C={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:j,recommendedSubjectTypes:j},M={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:j,recommendedSubjectTypes:j},D={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:j,recommendedSubjectTypes:j},K={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:j,recommendedSubjectTypes:j},P={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:j},E={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:j,recommendedSubjectTypes:j},x={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:j,recommendedSubjectTypes:j},w=[C,M,D,K,P,E,x],k={"iam.read":{permission:C,subjectType:["workload"]},"iam.users.write":{permission:M,subjectType:["workload"]},"iam.groups.write":{permission:D,subjectType:["workload"]},"capabilitiez.read":{permission:K,subjectType:["workload"]},"ciam.magic-link.create":{permission:P,subjectType:["workload","user"]},"authz.oaa.sync":{permission:E,subjectType:["workload"]},"tenant.manage":{permission:x,subjectType:["workload"]}};var v=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function L(Q){if(Q===null||typeof Q!=="object")return Q;let $={};for(let[X,J]of Object.entries(Q)){if(v.includes(X)||X==="validators"||X==="setStores")continue;$[X]=J!==null&&typeof J==="object"&&!Array.isArray(J)&&Object.getPrototypeOf(J)===Object.prototype?L(J):J}return $}function g(Q){return L(Q)}function z(Q,$){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw Error(`${$} must be an object.`);return Q}function q(Q,$){if(Q===void 0)return;if(typeof Q!=="string"||Q.length===0||!Number.isFinite(Date.parse(Q)))throw Error(`${$} must be a valid timestamp string.`);return Q}function R(Q,$,X){if(!Array.isArray(Q)||!X.allowEmpty&&Q.length===0)throw Error(`${$} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let J=new Set;return Q.map((Z,F)=>{let V=z(Z,`${$} keys[${F}]`);if(typeof V.id!=="string"||V.id.length===0)throw Error(`${$} keys[${F}].id must be a non-empty string.`);if(J.has(V.id))throw Error(`${$} contains duplicate key id "${V.id}".`);if(J.add(V.id),!["pending","active","deprecated","rotated","revoked"].includes(String(V.state)))throw Error(`${$} keys[${F}].state is invalid.`);if(V.value!==void 0&&(typeof V.value!=="string"||V.value.length===0))throw Error(`${$} keys[${F}].value must be a non-empty string when present.`);let U=V.meta===void 0?void 0:z(V.meta,`${$} keys[${F}].meta`);return{id:V.id,state:V.state,...V.value===void 0?{}:{value:V.value},...V.notBefore===void 0?{}:{notBefore:q(V.notBefore,`${$} keys[${F}].notBefore`)},...V.notAfter===void 0?{}:{notAfter:q(V.notAfter,`${$} keys[${F}].notAfter`)},...V.createdAt===void 0?{}:{createdAt:q(V.createdAt,`${$} keys[${F}].createdAt`)},...V.activatedAt===void 0?{}:{activatedAt:q(V.activatedAt,`${$} keys[${F}].activatedAt`)},...V.deprecatedAt===void 0?{}:{deprecatedAt:q(V.deprecatedAt,`${$} keys[${F}].deprecatedAt`)},...V.rotatedAt===void 0?{}:{rotatedAt:q(V.rotatedAt,`${$} keys[${F}].rotatedAt`)},...V.revokedAt===void 0?{}:{revokedAt:q(V.revokedAt,`${$} keys[${F}].revokedAt`)},...U?{meta:{...U}}:{}}})}function y(Q,$){if(Q===void 0)return;if(typeof Q!=="number"||!Number.isInteger(Q)||Q<0)throw Error(`${$} must be a non-negative integer when present.`);return Q}function h(Q){let X=z(Q,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let J=R(X.keys,"KMS pool",{allowEmpty:!0});if(J.length===0){if(X.active!==void 0)throw Error("KMS pool active must be omitted when keys is empty.");return{kind:"kms",keys:J}}if(typeof X.active!=="string"||X.active.length===0)throw Error("KMS pool active must be a non-empty key id when keys are present.");let Z=J.find((F)=>F.id===X.active);if(!Z)throw Error(`KMS pool active key "${X.active}" is not present in keys.`);if(Z.state!=="active")throw Error(`KMS pool active key "${X.active}" must have state "active".`);if(!Z.value)throw Error(`KMS pool active key "${X.active}" must include a value.`);return{kind:"kms",active:X.active,keys:J}}function m(Q){let X=z(Q,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');let J=R(X.keys,"KMS pool control document",{allowEmpty:!0}),Z=z(X.assignments,"KMS pool control document assignments"),F={},V=new Map(J.map((B)=>[B.id,B]));for(let[B,H]of Object.entries(Z)){if(B.length===0||typeof H!=="string"||H.length===0)throw Error("KMS pool control document assignments must map non-empty client ids to non-empty key ids.");let G=V.get(H);if(!G)throw Error(`KMS pool control document assignment for "${B}" references missing key "${H}".`);if(G.state!=="active"||!G.value)throw Error(`KMS pool control document assignment for "${B}" must reference an active key with a value.`);F[B]=H}let U;if(X.policy!==void 0){let B=z(X.policy,"KMS pool control document policy"),H=B.strategy;if(H!==void 0&&H!=="spread"&&H!=="low-quota-first")throw Error("KMS pool control document policy.strategy is invalid.");let G=B.maxHoldersPerKey;if(G!==void 0&&(typeof G!=="number"||!Number.isInteger(G)||G<=0))throw Error("KMS pool control document policy.maxHoldersPerKey must be a positive integer when present.");let S=y(B.overlapSeconds,"KMS pool control document policy.overlapSeconds");U={...H?{strategy:H}:{},...G===void 0?{}:{maxHoldersPerKey:G},...S===void 0?{}:{overlapSeconds:S}}}if(X.rotation!==void 0)throw Error("KMS pool control document rotation is no longer supported; use policy.overlapSeconds.");return{kind:"kms",keys:J,assignments:F,...U?{policy:U}:{}}}var N={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},c=N,d={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},p={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},u={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function l(Q,$){if(typeof $!=="number"||$<=0)return Q;return new Promise((X,J)=>{let Z=setTimeout(()=>{J(Error(`Authz catalog entry did not become ready within ${$}ms`))},$);Q.then(()=>{clearTimeout(Z),X()},(F)=>{clearTimeout(Z),J(F)})})}function n(Q,$){let X=!1,J,Z=$.then(()=>{X=!0},(V)=>{X=!1,J=V}),F=Q;return Object.defineProperty(F,"ready",{enumerable:!1,configurable:!0,value:(V)=>l(Z.then(()=>{if(!X)throw J}),V)}),Object.defineProperty(F,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),F}var b=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function a(Q){if(!Q.id.trim())throw Error("defineSecretType: id is required");let $=Q.mimeType?.trim()||b[Q.format],X=Object.freeze({id:Q.id,...Q.label?{label:Q.label}:{},format:Q.format,mimeType:$,...Q.schemaUrl?{schemaUrl:Q.schemaUrl}:{},typeId:Q.id});return Object.freeze({id:Q.id,...Q.label?{label:Q.label}:{},format:Q.format,mimeType:$,...Q.schemaUrl?{schemaUrl:Q.schemaUrl}:{},...Q.schema?{schema:Q.schema}:{},toRegistryEntry:()=>X})}function o(Q="jsonc"){return{format:Q,mimeType:b[Q]}}class A extends Error{expected;received;constructor(Q,$){super(`Secret content type mismatch: expected "${Q.mimeType}" (${Q.format}) but received "${$.mimeType}" (${$.format})`);this.name="SecretContentTypeMismatchError",this.expected=Q,this.received=$}}var i={beforeTenantSegments:["ui"]},s={beforeTenantSegments:["api"]};function T(Q){return(Q??[]).map(($)=>$.trim()).filter(Boolean)}function r(Q){let $=Q.trim();if(!$)return"/";let X=$.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function _(Q){return r(Q).split("/").filter(Boolean)}function Y(Q){return{beforeTenantSegments:T(Q?.beforeTenantSegments),afterTenantSegments:T(Q?.afterTenantSegments)}}function t(Q){return{type:"path",ui:Y(Q?.ui),api:Y(Q?.api)}}function e(Q,$){let X=Y($),J=X.beforeTenantSegments??[],Z=X.afterTenantSegments??[],F=_(Q),V=J.length+1+Z.length;if(F.length<V)return null;for(let G=0;G<J.length;G++)if(F[G]!==J[G])return null;let U=J.length,B=F[U];if(!B)return null;for(let G=0;G<Z.length;G++)if(F[U+1+G]!==Z[G])return null;let H=F.slice(U+1+Z.length);return{id:decodeURIComponent(B),restSegments:H,restPath:H.length>0?`/${H.join("/")}`:"/"}}function Q0(Q,$="/",X){let J=Y(X),Z=J.beforeTenantSegments??[],F=J.afterTenantSegments??[],V=_($),U=[...Z,encodeURIComponent(Q),...F,...V];return U.length>0?`/${U.join("/")}`:"/"}function X0(Q){return{"~standard":{version:1,vendor:Q,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let X=$,J=[],Z={...X},F=["iss","sub"];for(let B of F)if(B in X){if(typeof X[B]!=="string")J.push({message:`${B} must be a string`,path:[B]})}else J.push({message:`${B} is required`,path:[B]});if("aud"in X&&X.aud!==void 0){let B=X.aud;if(typeof B!=="string"&&!Array.isArray(B))J.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(B)&&!B.every((H)=>typeof H==="string"))J.push({message:"aud array must contain only strings",path:["aud"]})}let V=["jti","scope"];for(let B of V)if(B in X&&X[B]!==void 0){if(typeof X[B]!=="string")J.push({message:`${B} must be a string`,path:[B]})}let U=["exp","iat"];for(let B of U)if(B in X){if(typeof X[B]!=="number")J.push({message:`${B} must be a number`,path:[B]})}else J.push({message:`${B} is required`,path:[B]});if(J.length>0)return{issues:J};return{value:Z}}}}}function $0(Q){return{"~standard":{version:1,vendor:Q,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let X=$,J=[],Z={};if("access_token"in X)if(typeof X.access_token==="string")Z.access_token=X.access_token;else J.push({message:"access_token must be a string",path:["access_token"]});else J.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")Z.token_type=X.token_type;else J.push({message:"token_type must be a string",path:["token_type"]});else J.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)Z.scope=X.scope;else J.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)Z.refresh_token=X.refresh_token;else J.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)Z.expires=X.expires;else J.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)Z.expires_in=X.expires_in;else J.push({message:"expires_in must be a number",path:["expires_in"]});if(J.length>0)return{issues:J};return{value:Z}}}}}function J0(Q){let $=new Uint8Array(Q);return crypto.getRandomValues($),$}function V0(Q){let $="",X=J0(Q);for(let J=0;J<Q;J++){let Z=X[J]%32;$+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)}return $}function B0(Q,$){let X="";for(let J=$;J>0;J--){let Z=Q%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)+X,Q=Math.floor(Q/32)}return X}function Z0(Q){let $=Date.now(),X=B0($,10),J=V0(16);return`${Q??""}${X}${J}`}export{$0 as workloadTokenResponseSchema,R0 as withValidate,u as warnLogger,k0 as waitOn,O as version,A0 as validationFailureResponse,n0 as userSchema,C0 as unionCatalogRead,F0 as trustedClientPermissionsForPrincipal,O0 as trimTrailingSlash,S0 as tokenResponseSchema,Y0 as toCodeCatalog,_0 as stripJsonComments,w0 as stableConfigHash,N as silentLogger,g as serializeConfig,n as readyCatalogEntry,h as parseKmsPoolDocument,m as parseKmsPoolControlDocument,I0 as parseJsonc,E0 as parseEcid,b0 as oidcCallbackSchema,t as normalizeTenantRoutingStrategy,Y as normalizeTenantPathNamespace,N0 as must,T0 as mergeConfig,e as matchTenantPath,U0 as listGenerator,H0 as list,X0 as jwtAssertionClaimsSchema,h0 as isStoreConflictError,K0 as isEcid,f as isConfigSourceError,c0 as isConfigLocator,z0 as isCodeCatalog,p as infoLogger,L0 as idTokenClaimsSchema,a0 as groupResourceSchema,Z0 as generateULID,P0 as formatEcid,a as defineSecretType,W0 as defineCatalog,o as defaultSecretContentType,c as defaultLogger,f0 as deepEqualPlain,g0 as decodeUser,d as debugLogger,G0 as configTrustedClientGrants,v0 as claimsToUser,Q0 as buildTenantPath,u0 as assertValidSubjectTypeScoping,x0 as assertEcid,q0 as accessRootId,j0 as accessRefId,y0 as StoreConflictError,A as SecretContentTypeMismatchError,p0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,m0 as IoniteError,x as ION_TENANT_MANAGE,w as ION_SDK_PERMISSIONS,l0 as ION_SCIM_USER_EXTENSION_URN,M as ION_IAM_USERS_WRITE,C as ION_IAM_READ,D as ION_IAM_GROUPS_WRITE,k as ION_ENDPOINT_PERMISSIONS,P as ION_CIAM_MAGIC_LINK_CREATE,K as ION_CAPABILITIEZ_READ,E as ION_AUTHZ_OAA_SYNC,d0 as ION_AUTHZ_GROUP_SCHEMA,D0 as EcidFormatError,M0 as ECID_SCHEME,i as DEFAULT_TENANT_UI_NAMESPACE,s as DEFAULT_TENANT_API_NAMESPACE,b as DEFAULT_SECRET_MIME_TYPES,W as ConfigSourceError};

package/dist/server.d.ts

@@ -356,7 +356,7 @@ type AuthenticatedUser = WorkforceUser | Customer;
 * flows that are inherently human.
 */
 type AuthenticatedPrincipal = AuthenticatedUser | WorkloadPrincipal;
-import { StandardSchemaV1 as StandardSchemaV17 } from "@standard-schema/spec";
+import { StandardSchemaV1 as StandardSchemaV18 } from "@standard-schema/spec";
 /**
 * Third-party CIAM provider presets and claim mapping.
 *
@@ -1983,21 +1983,24 @@ type IAM = IAMConfig & {
 * @returns IAM service instance
 */
 declare function iam(validators: IAMValidators, log: Logger, workload: Workload | undefined, authz: Authz, accessStore?: AccessAssignmentStore, accessIndex?: AccessIndex, catalogStore?: AccessCatalogStore, codeCatalog?: CodeCatalog, resources?: ResourceProvider, fromVault?: Partial<IAMConfig>, fromCode?: Partial<IAMConfig>, iamDelta?: IamDeltaEmitter, onAccessMutation?: (summary: ScimMutationSummary) => void, trustedClientGrants?: AccessChange[], authzQueueSettle?: () => Promise<void>): IAM | undefined;
-type KmsKeyState = "pending" | "active" | "deprecated" | "revoked";
-type KmsPoolKind = "token" | "allocation";
-type KmsTokenKey = {
+type KmsKeyState = "pending" | "active" | "deprecated" | "rotated" | "revoked";
+type KmsKey = {
 	id: string;
 	state: KmsKeyState;
 	value?: string;
 	notBefore?: string;
 	notAfter?: string;
+	/** Control-plane lifecycle timestamps. Vaults omit these from personalized client grants. */
+	createdAt?: string;
+	activatedAt?: string;
+	deprecatedAt?: string;
+	rotatedAt?: string;
+	revokedAt?: string;
 	/** Control-plane metadata used for allocation policy and UI. Consumers should treat it as opaque. */
 	meta?: Record<string, unknown>;
 };
 /** ConfigSource-owned pointer to a KMS pool document. */
 type KmsPoolConfig = {
-	/** Pool semantics. Defaults to `token`. */
-	kind?: KmsPoolKind;
 	/** Named `ion.secrets` source. Omit to use the default `ion.secret` source. */
 	source?: string;
 	/** Secret path. Defaults to `/kms/{poolName}`. */
@@ -2005,13 +2008,16 @@ type KmsPoolConfig = {
 };
 /** ConfigSource-owned named KMS pool declarations. */
 type KmsConfig = Record<string, KmsPoolConfig>;
-type KmsPoolListener = (current: KmsTokenKey | undefined) => void;
+type KmsPoolListener = (current: KmsKey | undefined) => void;
 type KmsPool = {
-	/** Returns the usable token value, briefly awaiting only a locally scheduled imminent activation. */
-	value(): Promise<string>;
-	/** Timing-safe verification against the active token and usable deprecated overlap tokens. */
+	/**
+	* Returns the current granted key. Calls wait on one shared local subscription until a grant is
+	* available; repeated calls resolve from the local cache and never initiate a vault request.
+	*/
+	value(timeout?: number): Promise<string>;
+	/** Timing-safe verification against the active key and usable deprecated rotation-overlap keys. */
 	accepts(candidate: string): boolean;
-	/** Notifies immediately and whenever the selected active token changes. */
+	/** Notifies immediately and whenever the selected active key changes. */
 	subscribe(listener: KmsPoolListener): () => void;
 	beforeChange(listener: ChangeListener): () => void;
 	afterChange(listener: ChangeListener): () => void;
@@ -2063,7 +2069,7 @@ type OtelConfig = {
 	protocol?: OtelProtocol;
 	headers?: Record<string, string>;
 	apiKey?: string;
-	/** Name of a `RemoteConfig.kms` token pool used for exporter authentication. */
+	/** Name of a `RemoteConfig.kms` key pool used for exporter authentication. */
 	apiKeyPool?: string;
 	apiKeyHeader?: string;
 	oauth?: OtelOAuthClientCredentialsConfig;
@@ -2801,6 +2807,36 @@ interface MagicLinkStore<TExtended = object> {
 	*/
 	delete(token: string): Promise<void>;
 }
+import { StandardSchemaV1 as StandardSchemaV17 } from "@standard-schema/spec";
+type SecretTypeRegistryEntry = SecretContentType & {
+	id: string;
+	label?: string;
+};
+/**
+* Runtime contract for a custom secret type. The Standard Schema value is used only by server-side
+* parsing; `toRegistryEntry()` returns the serializable half that a vault editor can register.
+*/
+type SecretTypeDescriptor<T = unknown> = Readonly<{
+	id: string;
+	label?: string;
+	format: SecretFormat;
+	mimeType: string;
+	schemaUrl?: string;
+	schema?: StandardSchemaV17<unknown, T>;
+	toRegistryEntry(): SecretTypeRegistryEntry;
+}>;
+type SecretFormat = "jsonc" | "env" | "text" | "binary" | "yaml" | "toml" | "xml";
+/**
+* Self-describing content metadata persisted with a secret. `typeId` identifies an authoring preset;
+* decoding never depends on the preset registry because the resolved format/mime/schema travel with
+* the secret.
+*/
+type SecretContentType = {
+	format: SecretFormat;
+	mimeType: string;
+	schemaUrl?: string;
+	typeId?: string;
+};
 type Secret<T> = {
 	data: T;
 	metadata: MetaData;
@@ -2809,6 +2845,8 @@ type MetaData = {
 	path: string;
 	version: number;
 	created: Date;
+	/** Absent on legacy secrets, which are interpreted as JSONC. */
+	contentType?: SecretContentType;
 };
 type SecretsSourceType = "vault" | "azure" | "aws" | "gcp" | "dev";
 type SecretRequestSeverity = "low" | "medium" | "high" | "critical";
@@ -2830,6 +2868,24 @@ type SecretsOperationOptions = {
 	/** Optional timeout in milliseconds for this secrets operation. */
 	timeout?: number;
 };
+type SecretsWriteOptions = SecretsOperationOptions & {
+	/** Content contract stored with the secret and returned by all transports. */
+	contentType?: SecretContentType;
+};
+type SecretHandle = {
+	/** Reads the canonical textual representation. Binary secrets reject this accessor. */
+	text(): Promise<string>;
+	/** Decodes JSONC. Other formats reject this accessor. */
+	json<T = unknown>(): Promise<T>;
+	/** Reads the canonical bytes. Text formats are UTF-8 encoded. */
+	bytes(): Promise<Uint8Array>;
+	/** Decodes an env/key=value secret. */
+	env(): Promise<Record<string, string>>;
+	/** Reads metadata without decoding the value. */
+	metadata(): Promise<MetaData>;
+	/** Decodes and validates using a runtime secret-type descriptor. */
+	parse<T>(type: SecretTypeDescriptor<T>): Promise<T>;
+};
 type SubscriptionMode = "fail-fast" | "wait";
 type SecretsSubscriptionOptions = SecretsOperationOptions & {
 	/**
@@ -2841,13 +2897,15 @@ type SecretsSubscriptionOptions = SecretsOperationOptions & {
 };
 type SecretsSource = ReactiveHandle & ModuleReadiness & {
 	type: SecretsSourceType;
+	/** Creates a lazy, Bun.file-style handle. No I/O occurs until an accessor is awaited. */
+	get(path: string, options?: SecretsOperationOptions): SecretHandle;
 	getFullSecret: <T>(path: string, options?: SecretsOperationOptions) => Promise<Secret<T>>;
 	getSecret: <T>(path: string, options?: SecretsOperationOptions) => Promise<T>;
 	/**
 	* Write a secret at the given path.
 	* Implementations may throw for read-only or unsupported secret sources.
 	*/
-	putSecret: (path: string, value: Record<string, unknown>, options?: SecretsOperationOptions) => Promise<void>;
+	putSecret: (path: string, value: Record<string, unknown>, options?: SecretsWriteOptions) => Promise<void>;
 	/**
 	* When set, the secret source supports change detection, reads the current value first, and calls onChange
 	* immediately with that value before watching for changes.
@@ -2902,12 +2960,14 @@ type Secrets = ModuleReadiness & {
 	listSecretsSources(): string[];
 	/** Gets a named secrets source client. Throws when missing. */
 	getSecretsSource(sourceName: string): SecretsSource;
+	/** Creates a lazy handle for a secret in a named source. */
+	get(sourceName: string, path: string, options?: SecretsOperationOptions): SecretHandle;
 	/** Reads a secret from a named secrets source client. */
 	getSecret<T>(sourceName: string, path: string, options?: SecretsOperationOptions): Promise<T>;
 	/** Reads full secret data + metadata from a named secrets source client. */
 	getFullSecret<T>(sourceName: string, path: string, options?: SecretsOperationOptions): Promise<Secret<T>>;
 	/** Writes a secret to a named secrets source client. */
-	putSecret(sourceName: string, path: string, value: Record<string, unknown>, options?: SecretsOperationOptions): Promise<void>;
+	putSecret(sourceName: string, path: string, value: Record<string, unknown>, options?: SecretsWriteOptions): Promise<void>;
 	/** Deletes a secret from a named secrets source client. */
 	deleteSecret(sourceName: string, path: string, options?: SecretsOperationOptions): Promise<void>;
 	/** Lists child paths under a base path for a named secrets source client. */
@@ -3276,7 +3336,7 @@ type RemoteConfig = {
 	workload?: WorkloadConfig | WorkloadConfigMap | WorkloadIncomingOutgoing;
 	/** Optional named secrets-source configs available to this App instance. */
 	secrets?: SecretsModuleConfig;
-	/** ConfigSource-owned named managed token pools consumed through `ion.kms`. */
+	/** ConfigSource-owned named server-allocated key pools consumed through `ion.kms`. */
 	kms?: KmsConfig;
 	ciam?: CIAMConfig;
 	/** OpenTelemetry collector/exporter config loaded from ConfigSource. */
@@ -3463,8 +3523,8 @@ declare function resolveCacheConfig(cache: CacheConfig | undefined): ResolvedCac
 * built-in core schemas.
 */
 type CIAMValidators = {
-	customer: StandardSchemaV17<unknown, BaseCustomer> & {
-		validate(value: unknown): Promise<StandardSchemaV17.Result<BaseCustomer>>;
+	customer: StandardSchemaV18<unknown, BaseCustomer> & {
+		validate(value: unknown): Promise<StandardSchemaV18.Result<BaseCustomer>>;
 	};
 	callbackParams?: StandardSchemaWithValidate<OidcCallbackParams>;
 	idTokenClaims?: StandardSchemaWithValidate<IdTokenClaims>;