@ionite/core 0.0.23-beta.20260820.2 → 0.0.23-beta.20260825.2

package/dist/index.d.ts

@@ -2103,8 +2103,11 @@ type KmsKey = {
 /** Personalized per-client view delivered by a secrets source. */
 type KmsPoolDocument = {
 	kind: "kms";
-	/** Omitted when the server has revoked the previous grant and no replacement is available yet. */
-	active?: string;
+	/**
+	* Granted key id per requested slot. `null` means the slot is unfilled. Omitted when the server
+	* has no grant (and no unfilled demand) for this client.
+	*/
+	slots?: (string | null)[];
 	keys: KmsKey[];
 };
 type KmsAllocationStrategy = "spread" | "low-quota-first";
@@ -2113,6 +2116,74 @@ type KmsAllocationPolicy = {
 	maxHoldersPerKey?: number;
 	/** Grace period during which a gracefully rotated key remains accepted. Defaults to 300 seconds. */
 	overlapSeconds?: number;
+	/** Allocation exclusion for a cooldown park. Defaults to 300 seconds. */
+	cooldownSeconds?: number;
+	/** Usable-key floor that triggers `kms_pool_low` issuer events. */
+	minKeys?: number;
+	/** Seconds before `notAfter` to emit `kms_key_expiring`. Defaults to 300. */
+	expiryWarnSeconds?: number;
+};
+/** Evidence an app submits when a used KMS key failed. The SDK resolves `value` to a key id locally. */
+type KmsParkReport = {
+	/** The key value the app actually used. Never sent on the wire. */
+	value: string;
+	/** HTTP-style status from the failed call (e.g. 429, 403). */
+	status?: number;
+	reason?: string;
+};
+/** Server-decided park outcome. The app never classifies; the vault maps evidence to this. */
+type KmsParkDisposition = "cooldown" | "suspect";
+type KmsParkResult = {
+	parked: boolean;
+	/** True when the used value no longer maps to a delivered grant (already rotated away). */
+	stale?: boolean;
+	disposition?: KmsParkDisposition;
+};
+/** Client-to-vault park request after local value→id resolution. Never carries the secret value. */
+type KmsParkRequest = {
+	keyId: string;
+	status?: number;
+	reason?: string;
+};
+/** Key material an issuer submits. The vault assigns `id` when omitted; issued keys enter `active`. */
+type KmsIssuedKey = {
+	id?: string;
+	value: string;
+	notBefore?: string;
+	notAfter?: string;
+	meta?: Record<string, unknown>;
+};
+type KmsAddKeysRequest = {
+	keys: KmsIssuedKey[];
+};
+type KmsAddKeysResult = {
+	keys: {
+		id: string;
+	}[];
+};
+type KmsRevokeKeyRequest = {
+	keyId: string;
+	reason?: string;
+};
+type KmsRevokeKeyResult = {
+	revoked: boolean;
+};
+type KmsIssuerEventName = "kms_key_parked" | "kms_key_expiring" | "kms_pool_low";
+type KmsIssuerEvent = {
+	path: string;
+	event: KmsIssuerEventName;
+	requestId?: string;
+	/** Metadata-only. Never the secret value. */
+	keyId?: string;
+};
+type KmsIssuerEventListener = (event: KmsIssuerEvent) => void;
+/** Issuer handle for a named pool. Readiness is `configured && sourceBound`, not slot-grant readiness. */
+type KmsPoolIssuer = {
+	addKeys(keys: KmsIssuedKey[], timeout?: number): Promise<KmsAddKeysResult>;
+	revokeKey(request: KmsRevokeKeyRequest, timeout?: number): Promise<KmsRevokeKeyResult>;
+	events(listener: KmsIssuerEventListener): () => void;
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
 };
 /** Key-material document stored by the vault. Operational assignment and policy state is external. */
 type KmsPoolControlDocument = {
@@ -2129,15 +2200,47 @@ type KmsPoolConfig = {
 /** ConfigSource-owned named KMS pool declarations. */
 type KmsConfig = Record<string, KmsPoolConfig>;
 type KmsPoolListener = (current: KmsKey | undefined) => void;
+/** One requested grant slot. Under-filled slots stay not-ready until the server assigns a distinct key. */
+type KmsPoolSlot = {
+	/**
+	* Returns this slot's granted key. Calls wait on the pool's shared local subscription until a
+	* grant is available; repeated calls resolve from the local cache and never initiate a vault request.
+	*/
+	value(timeout?: number): Promise<string>;
+	/** Synchronous local-cache read. Returns `undefined` when this slot has no usable grant yet. */
+	current(): string | undefined;
+	/** Notifies immediately and whenever this slot's selected active key changes. */
+	subscribe(listener: KmsPoolListener): () => void;
+	/**
+	* Advises the vault that `report.value` failed. Resolves the value to a key id locally and never
+	* sends the secret on the wire. Slot form is a pool alias; value is always explicit.
+	*/
+	park(report: KmsParkReport, timeout?: number): Promise<KmsParkResult>;
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
+};
 type KmsPool = {
 	/**
-	* Returns the current granted key. Calls wait on one shared local subscription until a grant is
-	* available; repeated calls resolve from the local cache and never initiate a vault request.
+	* Returns the current granted key for slot 0. Calls wait on one shared local subscription until a
+	* grant is available; repeated calls resolve from the local cache and never initiate a vault request.
 	*/
 	value(timeout?: number): Promise<string>;
-	/** Timing-safe verification against the active key and usable deprecated rotation-overlap keys. */
+	/** Synchronous local-cache read of slot 0. Returns `undefined` when no usable grant is cached. */
+	current(): string | undefined;
+	/**
+	* Returns `n` stable slot handles that stay distinct across rotation. Demand is the max `n`
+	* requested in this process and never shrinks. Under-filled slots are not ready until the server
+	* assigns a distinct key.
+	*/
+	unique(n: number): KmsPoolSlot[];
+	/** Timing-safe verification against every delivered active key and usable deprecated overlap keys. */
 	accepts(candidate: string): boolean;
-	/** Notifies immediately and whenever the selected active key changes. */
+	/**
+	* Advises the vault that `report.value` failed. Resolves the value to a key id locally (timing-safe)
+	* and sends only the key id. A stale value (no longer in the delivered grant) is a no-op.
+	*/
+	park(report: KmsParkReport, timeout?: number): Promise<KmsParkResult>;
+	/** Notifies immediately and whenever slot 0's selected active key changes. */
 	subscribe(listener: KmsPoolListener): () => void;
 	beforeChange(listener: ChangeListener): () => void;
 	afterChange(listener: ChangeListener): () => void;
@@ -2152,6 +2255,8 @@ type Kms = ModuleReadiness & {
 	readonly config: Readonly<KmsConfig>;
 	listPools(): string[];
 	getPool(name: string): KmsPool;
+	/** Issuer handle for a named pool. Independent of consumer slot grants. */
+	issuer(name: string): KmsPoolIssuer;
 };
 /** Parse and fail closed on a personalized KMS pool document. */
 declare function parseKmsPoolDocument(value: unknown): KmsPoolDocument;
@@ -2947,18 +3052,25 @@ type SecretLifecycleRequest = {
 	severity?: SecretRequestSeverity;
 	incidentRef?: string;
 };
-type SecretEventName = "rotate_requested" | "revoke_requested" | "created" | "updated" | "deleted" | "rotated" | "revoked" | "removed" | "path_removed" | "lease_expiring_soon" | "lease_revoked" | (string & {});
+type SecretEventName = "rotate_requested" | "revoke_requested" | "created" | "updated" | "deleted" | "rotated" | "revoked" | "removed" | "path_removed" | "lease_expiring_soon" | "lease_revoked" | "kms_key_parked" | "kms_key_expiring" | "kms_pool_low" | (string & {});
 type SecretEvent = {
 	path: string;
 	event: SecretEventName;
 	requestId?: string;
 	issuedAt?: string | number;
 	expiresAt?: string | number;
+	/** Metadata-only KMS key id. Never the secret value. */
+	keyId?: string;
 };
 type SecretEventListener = (event: SecretEvent) => void;
 type SecretsOperationOptions = {
 	/** Optional timeout in milliseconds for this secrets operation. */
 	timeout?: number;
+	/**
+	* Requested distinct KMS grant slots for this client. Carried on LFV/WebSocket/HTTP KMS reads so
+	* the vault can allocate that many unique keys. Omitted demand is treated as one slot.
+	*/
+	kmsSlots?: number;
 };
 type SecretsWriteOptions = SecretsOperationOptions & {
 	/** Content contract stored with the secret and returned by all transports. Required on every write. */
@@ -3017,6 +3129,13 @@ type LfvCallbackTransport = {
 /** Framework-only LFV runtime wiring. Live transports MUST never be supplied by RemoteConfig. */
 type FrameworkLfvConfig = {
 	callbackTransport?: LfvCallbackTransport;
+	/**
+	* Declare that this process is the only LFV callback receiver. Required when a manager-built
+	* vault+lfv source is applied without `callbackTransport`. ConfigSource bootstrap LFV clients
+	* (mirrored, vault, and lfv ConfigSources) are exempt. Never set this in a multi-replica
+	* deployment: it opts out of the fail-closed transport gate.
+	*/
+	singleProcess?: boolean;
 };
 type SecretsSource = ReactiveHandle & ModuleReadiness & {
 	type: SecretsSourceType;
@@ -3060,6 +3179,19 @@ type SecretsSource = ReactiveHandle & ModuleReadiness & {
 	*/
 	requestRevoke(path: string, request?: SecretLifecycleRequest, options?: SecretsOperationOptions): Promise<void>;
 	/**
+	* Advises the vault that a granted KMS key failed. Carries the resolved key id, never the value.
+	* Non-vault sources throw not-supported.
+	*/
+	parkKmsKey(path: string, request: KmsParkRequest, options?: SecretsOperationOptions): Promise<KmsParkResult>;
+	/**
+	* Issues keys into a managed KMS pool. Non-vault sources throw not-supported.
+	*/
+	addKmsKeys(path: string, request: KmsAddKeysRequest, options?: SecretsOperationOptions): Promise<KmsAddKeysResult>;
+	/**
+	* Hard-revokes a key in a managed KMS pool. Non-vault sources throw not-supported.
+	*/
+	revokeKmsKey(path: string, request: KmsRevokeKeyRequest, options?: SecretsOperationOptions): Promise<KmsRevokeKeyResult>;
+	/**
 	* Reads metadata for the given path.
 	*/
 	getMetadata(path: string, options?: SecretsOperationOptions): Promise<Record<string, unknown>>;
@@ -3108,6 +3240,12 @@ type Secrets = ModuleReadiness & {
 	requestRotate(sourceName: string, path: string, request?: SecretLifecycleRequest, options?: SecretsOperationOptions): Promise<void>;
 	/** Requests revocation for a secret path in a named secrets source client. */
 	requestRevoke(sourceName: string, path: string, request?: SecretLifecycleRequest, options?: SecretsOperationOptions): Promise<void>;
+	/** Advises a named vault source that a granted KMS key failed. */
+	parkKmsKey(sourceName: string, path: string, request: KmsParkRequest, options?: SecretsOperationOptions): Promise<KmsParkResult>;
+	/** Issues keys into a named vault KMS pool. */
+	addKmsKeys(sourceName: string, path: string, request: KmsAddKeysRequest, options?: SecretsOperationOptions): Promise<KmsAddKeysResult>;
+	/** Hard-revokes a key in a named vault KMS pool. */
+	revokeKmsKey(sourceName: string, path: string, request: KmsRevokeKeyRequest, options?: SecretsOperationOptions): Promise<KmsRevokeKeyResult>;
 	/** Reads metadata for a secret path in a named secrets source client. */
 	getMetadata(sourceName: string, path: string, options?: SecretsOperationOptions): Promise<Record<string, unknown>>;
 	/** Subscribes to secret changes on a named secrets source client. */
@@ -3595,7 +3733,7 @@ type FrameworkConfig = {
 	iam?: IAMConfig | null;
 	workload?: FrameworkWorkloadConfig | null;
 	secrets?: FrameworkSecretsModuleConfig | null;
-	/** Framework-only distributed LFV callback wiring (for example Redis Pub/Sub). */
+	/** Framework-only LFV callback wiring (`callbackTransport` and/or `singleProcess`). */
 	lfv?: FrameworkLfvConfig;
 	ciam?: CIAMConfig | null;
 	authz?: AuthzConfig | null;
@@ -4103,7 +4241,13 @@ type IoniteBase = {
 	* module (SSO, IAM, Workload, or CIAM) based on the configured URLs.
 	*/
 	handler: (request: Request) => Promise<Response>;
-	/** Returns a promise that resolves when configured at least once. If timeout is > 0, rejects after timeout ms. */
+	/**
+	* Returns a promise that resolves when configured at least once. With no argument it waits up to
+	* the instance's default bound (`IoniteConfig.readyTimeoutMs`, 30s unless overridden) and then
+	* rejects — config that never arrives is an Ops failure and should fail loudly. Pass `timeout > 0`
+	* for an explicit bound, or `0`/`Infinity` to wait indefinitely. Module handles
+	* (`ion.sso.ready()` etc.) keep the indefinite no-timeout feature-gate semantics.
+	*/
 	ready(timeout?: number): Promise<void>;
 	/**
 	* Narrow bootstrap signal: true once RemoteConfig has been applied at least once, false otherwise.
@@ -4159,7 +4303,7 @@ type ResolvedRoute = {
 	handler: (request: Request) => Promise<Response>;
 };
 type RouteFilterResult = "continue" | "not_handled" | Response;
-/** Default maximum time, in milliseconds, that `ion.handler(request)` waits for config readiness. */
+/** Runtime routing customization hooks for `ion.handler(request)` (which never waits on readiness). */
 type RoutingOptions = {
 	/**
 	* Runs before routing. Return:
@@ -5317,6 +5461,11 @@ type CapabilitiezManifest = {
 	urls: CapabilityEndpointUrls;
 	modules: Record<ModuleName, ModuleReadinessState>;
 	capabilities: Record<CapabilityKey, CapabilityState>;
+	/**
+	* True when FrameworkConfig wired a live LFV callback transport. Boolean only — the transport
+	* object, Redis URL, and credentials are never exposed.
+	*/
+	lfvCallbackTransport: boolean;
 };
 /**
 * Fields a {@link ConfigSource} may attach to a thrown error so the SDK can classify load/subscribe
@@ -5606,12 +5755,14 @@ type IAMAppRegistry = {
 type IAMAppValidators = {
 	registerIAMAppPayload: StandardSchemaV110<unknown, RegisterIAMAppPayload>;
 };
-type LfvActionName = "read_secret" | "create_secret" | "update_secret" | "delete_secret" | "request_rotate" | "request_revoke" | "rotate_secret" | "revoke_secret" | "list_paths" | "list_secrets" | "read_metadata" | "remove_path";
+type LfvActionName = "read_secret" | "create_secret" | "update_secret" | "delete_secret" | "request_rotate" | "request_revoke" | "rotate_secret" | "revoke_secret" | "list_paths" | "list_secrets" | "read_metadata" | "remove_path" | "kms_park" | "kms_add_keys" | "kms_revoke_key";
 type LfvOtpRequest = {
 	request_id: string;
 	path: string;
 	action: LfvActionName;
 	ttl?: number;
+	/** Distinct KMS grant slots requested for this client. Omitted demand is treated as one slot. */
+	kms_slots?: number;
 };
 type LfvOtpResponse = {
 	request_id: string;
@@ -5624,6 +5775,20 @@ type LfvActionRequestBase = {
 	request_id: string;
 	otp: string;
 	path: string;
+	/** Distinct KMS grant slots requested for this client. Omitted demand is treated as one slot. */
+	kms_slots?: number;
+	/** Resolved KMS key id for `kms_park` / `kms_revoke_key`. Never the secret value. */
+	key_id?: string;
+	status?: number;
+	reason?: string;
+	/** Issued keys for `kms_add_keys`. */
+	keys?: Array<{
+		id?: string;
+		value: string;
+		notBefore?: string;
+		notAfter?: string;
+		meta?: Record<string, unknown>;
+	}>;
 };
 type LfvActionAcceptedResponse = {
 	request_id: string;
@@ -5637,4 +5802,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { workloadTokenResponseSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, remoteConfigSecretType, readyCatalogEntry, parseKmsPoolDocument, parseKmsPoolControlDocument, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, mergeCodeCatalogEntity, materializeCodeCatalogEntity, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, getCodeCatalogEntity, generateULID, formatEcid, deprecateRetiredCodeCatalogRows, defineSecretType, defineCatalog, defaultSecretContentType, defaultLogger, deepEqualPlain, decodeUser, debugLogger, configTrustedClientGrants, claimsToUser, catalogEntityStore, buildTenantPath, assertValidSubjectTypeScoping, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsWriteOptions, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretTypeRegistryEntry, SecretTypeInput, SecretTypeDescriptor, SecretRequestSeverity, SecretLifecycleRequest, SecretHandle, SecretFormat, SecretEventName, SecretEventListener, SecretEvent, SecretContentTypeMismatchError, SecretContentType, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MirrorConfigLocator, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsPoolListener, KmsPoolDocument, KmsPoolControlDocument, KmsPoolConfig, KmsPool, KmsKeyState, KmsKey, KmsConfig, KmsAllocationStrategy, KmsAllocationPolicy, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InferSecretType, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaReconcileInput, IamDeltaMode, IamDeltaEmitter, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_USER_EXTENSION_URN, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DestinationReference, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_SECRET_MIME_TYPES, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogEntityKind, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, ApplicationValidators, Address, AccessStatus, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };
+export { workloadTokenResponseSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, remoteConfigSecretType, readyCatalogEntry, parseKmsPoolDocument, parseKmsPoolControlDocument, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, mergeCodeCatalogEntity, materializeCodeCatalogEntity, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, getCodeCatalogEntity, generateULID, formatEcid, deprecateRetiredCodeCatalogRows, defineSecretType, defineCatalog, defaultSecretContentType, defaultLogger, deepEqualPlain, decodeUser, debugLogger, configTrustedClientGrants, claimsToUser, catalogEntityStore, buildTenantPath, assertValidSubjectTypeScoping, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsWriteOptions, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretTypeRegistryEntry, SecretTypeInput, SecretTypeDescriptor, SecretRequestSeverity, SecretLifecycleRequest, SecretHandle, SecretFormat, SecretEventName, SecretEventListener, SecretEvent, SecretContentTypeMismatchError, SecretContentType, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MirrorConfigLocator, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsRevokeKeyResult, KmsRevokeKeyRequest, KmsPoolSlot, KmsPoolListener, KmsPoolIssuer, KmsPoolDocument, KmsPoolControlDocument, KmsPoolConfig, KmsPool, KmsParkResult, KmsParkRequest, KmsParkReport, KmsParkDisposition, KmsKeyState, KmsKey, KmsIssuerEventName, KmsIssuerEventListener, KmsIssuerEvent, KmsIssuedKey, KmsConfig, KmsAllocationStrategy, KmsAllocationPolicy, KmsAddKeysResult, KmsAddKeysRequest, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InferSecretType, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaReconcileInput, IamDeltaMode, IamDeltaEmitter, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_USER_EXTENSION_URN, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DestinationReference, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_SECRET_MIME_TYPES, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogEntityKind, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, ApplicationValidators, Address, AccessStatus, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };

package/dist/index.js

@@ -1 +1 @@
-import{A as I0,B as A0,C as T0,D as _0,E as O0,F as k0,G as v0,H as w0,I as f0,J as y0,K as g0,L as h0,M as m0,N as c0,O as d0,P as p0,Q as u0,R as l0,U as a0,V as n0,W as o0,X as r0,Y as s0,Z as i0,a as Z0,b as H0,c as G0,d as F0,e as q0,f as j0,g as U0,h as z0,i as Y0,j as K0,k as W0,l as C0,m as M0,n as P0,o as D0,t as x0,u as E0,v as b0,w as L0,x as S0,y as R0,z as N0}from"./shared/core-15896f6h.js";var O="0.0.23-beta.20260820.2";class Y extends Error{kind;recoverable;code;status;path;sourceType;constructor(Q,$){super(Q,$.cause!==void 0?{cause:$.cause}:void 0);this.name="ConfigSourceError",this.kind=$.kind,this.recoverable=$.recoverable,this.code=$.code,this.status=$.status,this.path=$.path,this.sourceType=$.sourceType,Object.setPrototypeOf(this,Y.prototype)}}function k(Q){return Q instanceof Y}var G=["workload"],W={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:G,recommendedSubjectTypes:G},C={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},M={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},P={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:G,recommendedSubjectTypes:G},D={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:G},x={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:G,recommendedSubjectTypes:G},E={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},v=[W,C,M,P,D,x,E],w={"iam.read":{permission:W,subjectType:["workload"]},"iam.users.write":{permission:C,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:P,subjectType:["workload"]},"ciam.magic-link.create":{permission:D,subjectType:["workload","user"]},"authz.oaa.sync":{permission:x,subjectType:["workload"]},"tenant.manage":{permission:E,subjectType:["workload"]}};var f=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function S(Q){if(Q===null||typeof Q!=="object")return Q;let $={};for(let[X,J]of Object.entries(Q)){if(f.includes(X)||X==="validators"||X==="setStores")continue;$[X]=J!==null&&typeof J==="object"&&!Array.isArray(J)&&Object.getPrototypeOf(J)===Object.prototype?S(J):J}return $}function y(Q){return S(Q)}function K(Q,$){if(!Q||typeof Q!=="object"||Array.isArray(Q))throw Error(`${$} must be an object.`);return Q}function j(Q,$){if(Q===void 0)return;if(typeof Q!=="string"||Q.length===0||!Number.isFinite(Date.parse(Q)))throw Error(`${$} must be a valid timestamp string.`);return Q}function R(Q,$,X){if(!Array.isArray(Q)||!X.allowEmpty&&Q.length===0)throw Error(`${$} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let J=new Set;return Q.map((V,Z)=>{let B=K(V,`${$} keys[${Z}]`);if(typeof B.id!=="string"||B.id.length===0)throw Error(`${$} keys[${Z}].id must be a non-empty string.`);if(J.has(B.id))throw Error(`${$} contains duplicate key id "${B.id}".`);if(J.add(B.id),!["pending","active","deprecated","rotated","revoked"].includes(String(B.state)))throw Error(`${$} keys[${Z}].state is invalid.`);if(B.value!==void 0&&(typeof B.value!=="string"||B.value.length===0))throw Error(`${$} keys[${Z}].value must be a non-empty string when present.`);let F=B.meta===void 0?void 0:K(B.meta,`${$} keys[${Z}].meta`);return{id:B.id,state:B.state,...B.value===void 0?{}:{value:B.value},...B.notBefore===void 0?{}:{notBefore:j(B.notBefore,`${$} keys[${Z}].notBefore`)},...B.notAfter===void 0?{}:{notAfter:j(B.notAfter,`${$} keys[${Z}].notAfter`)},...B.createdAt===void 0?{}:{createdAt:j(B.createdAt,`${$} keys[${Z}].createdAt`)},...B.activatedAt===void 0?{}:{activatedAt:j(B.activatedAt,`${$} keys[${Z}].activatedAt`)},...B.deprecatedAt===void 0?{}:{deprecatedAt:j(B.deprecatedAt,`${$} keys[${Z}].deprecatedAt`)},...B.rotatedAt===void 0?{}:{rotatedAt:j(B.rotatedAt,`${$} keys[${Z}].rotatedAt`)},...B.revokedAt===void 0?{}:{revokedAt:j(B.revokedAt,`${$} keys[${Z}].revokedAt`)},...F?{meta:{...F}}:{}}})}function g(Q){let X=K(Q,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let J=R(X.keys,"KMS pool",{allowEmpty:!0});if(J.length===0){if(X.active!==void 0)throw Error("KMS pool active must be omitted when keys is empty.");return{kind:"kms",keys:J}}if(typeof X.active!=="string"||X.active.length===0)throw Error("KMS pool active must be a non-empty key id when keys are present.");let V=J.find((Z)=>Z.id===X.active);if(!V)throw Error(`KMS pool active key "${X.active}" is not present in keys.`);if(V.state!=="active")throw Error(`KMS pool active key "${X.active}" must have state "active".`);if(!V.value)throw Error(`KMS pool active key "${X.active}" must include a value.`);return{kind:"kms",active:X.active,keys:J}}function h(Q){let X=K(Q,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:R(X.keys,"KMS pool control document",{allowEmpty:!0})}}var N={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},m=N,c={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},d={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},p={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function u(Q,$){if(typeof $!=="number"||$<=0)return Q;return new Promise((X,J)=>{let V=setTimeout(()=>{J(Error(`Authz catalog entry did not become ready within ${$}ms`))},$);Q.then(()=>{clearTimeout(V),X()},(Z)=>{clearTimeout(V),J(Z)})})}function l(Q,$){let X=!1,J,V=$.then(()=>{X=!0},(B)=>{X=!1,J=B}),Z=Q;return Object.defineProperty(Z,"ready",{enumerable:!1,configurable:!0,value:(B)=>u(V.then(()=>{if(!X)throw J}),B)}),Object.defineProperty(Z,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),Z}var b=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function L(Q){if(!Q.id.trim())throw Error("defineSecretType: id is required");let $=Q.mimeType?.trim()||b[Q.format],X=Object.freeze({id:Q.id,...Q.label?{label:Q.label}:{},format:Q.format,mimeType:$,...Q.schemaUrl?{schemaUrl:Q.schemaUrl}:{},typeId:Q.id});return Object.freeze({id:Q.id,...Q.label?{label:Q.label}:{},format:Q.format,mimeType:$,...Q.schemaUrl?{schemaUrl:Q.schemaUrl}:{},...Q.schema?{schema:Q.schema}:{},toRegistryEntry:()=>X})}function a(Q="jsonc"){return{format:Q,mimeType:b[Q],typeId:Q}}class I extends Error{expected;received;constructor(Q,$){super(`Secret content type mismatch: expected "${Q.mimeType}" (${Q.format}) but received "${$.mimeType}" (${$.format})`);this.name="SecretContentTypeMismatchError",this.expected=Q,this.received=$}}var n=L({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var o={beforeTenantSegments:["ui"]},r={beforeTenantSegments:["api"]};function A(Q){return(Q??[]).map(($)=>$.trim()).filter(Boolean)}function s(Q){let $=Q.trim();if(!$)return"/";let X=$.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function T(Q){return s(Q).split("/").filter(Boolean)}function z(Q){return{beforeTenantSegments:A(Q?.beforeTenantSegments),afterTenantSegments:A(Q?.afterTenantSegments)}}function i(Q){return{type:"path",ui:z(Q?.ui),api:z(Q?.api)}}function t(Q,$){let X=z($),J=X.beforeTenantSegments??[],V=X.afterTenantSegments??[],Z=T(Q),B=J.length+1+V.length;if(Z.length<B)return null;for(let q=0;q<J.length;q++)if(Z[q]!==J[q])return null;let F=J.length,H=Z[F];if(!H)return null;for(let q=0;q<V.length;q++)if(Z[F+1+q]!==V[q])return null;let U=Z.slice(F+1+V.length);return{id:decodeURIComponent(H),restSegments:U,restPath:U.length>0?`/${U.join("/")}`:"/"}}function e(Q,$="/",X){let J=z(X),V=J.beforeTenantSegments??[],Z=J.afterTenantSegments??[],B=T($),F=[...V,encodeURIComponent(Q),...Z,...B];return F.length>0?`/${F.join("/")}`:"/"}function Q0(Q){return{"~standard":{version:1,vendor:Q,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let X=$,J=[],V={...X},Z=["iss","sub"];for(let H of Z)if(H in X){if(typeof X[H]!=="string")J.push({message:`${H} must be a string`,path:[H]})}else J.push({message:`${H} is required`,path:[H]});if("aud"in X&&X.aud!==void 0){let H=X.aud;if(typeof H!=="string"&&!Array.isArray(H))J.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(H)&&!H.every((U)=>typeof U==="string"))J.push({message:"aud array must contain only strings",path:["aud"]})}let B=["jti","scope"];for(let H of B)if(H in X&&X[H]!==void 0){if(typeof X[H]!=="string")J.push({message:`${H} must be a string`,path:[H]})}let F=["exp","iat"];for(let H of F)if(H in X){if(typeof X[H]!=="number")J.push({message:`${H} must be a number`,path:[H]})}else J.push({message:`${H} is required`,path:[H]});if(J.length>0)return{issues:J};return{value:V}}}}}function X0(Q){return{"~standard":{version:1,vendor:Q,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let X=$,J=[],V={};if("access_token"in X)if(typeof X.access_token==="string")V.access_token=X.access_token;else J.push({message:"access_token must be a string",path:["access_token"]});else J.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")V.token_type=X.token_type;else J.push({message:"token_type must be a string",path:["token_type"]});else J.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)V.scope=X.scope;else J.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)V.refresh_token=X.refresh_token;else J.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)V.expires=X.expires;else J.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)V.expires_in=X.expires_in;else J.push({message:"expires_in must be a number",path:["expires_in"]});if(J.length>0)return{issues:J};return{value:V}}}}}function $0(Q){let $=new Uint8Array(Q);return crypto.getRandomValues($),$}function J0(Q){let $="",X=$0(Q);for(let J=0;J<Q;J++){let V=X[J]%32;$+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(V)}return $}function B0(Q,$){let X="";for(let J=$;J>0;J--){let V=Q%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(V)+X,Q=Math.floor(Q/32)}return X}function V0(Q){let $=Date.now(),X=B0($,10),J=J0(16);return`${Q??""}${X}${J}`}export{X0 as workloadTokenResponseSchema,T0 as withValidate,p as warnLogger,h0 as waitOn,O as version,O0 as validationFailureResponse,s0 as userSchema,M0 as unionCatalogRead,Z0 as trustedClientPermissionsForPrincipal,f0 as trimTrailingSlash,I0 as tokenResponseSchema,j0 as toCodeCatalog,v0 as stripJsonComments,g0 as stableConfigHash,N as silentLogger,y as serializeConfig,n as remoteConfigSecretType,l as readyCatalogEntry,g as parseKmsPoolDocument,h as parseKmsPoolControlDocument,w0 as parseJsonc,S0 as parseEcid,N0 as oidcCallbackSchema,i as normalizeTenantRoutingStrategy,z as normalizeTenantPathNamespace,_0 as must,k0 as mergeConfig,K0 as mergeCodeCatalogEntity,W0 as materializeCodeCatalogEntity,t as matchTenantPath,F0 as listGenerator,G0 as list,Q0 as jwtAssertionClaimsSchema,p0 as isStoreConflictError,b0 as isEcid,k as isConfigSourceError,l0 as isConfigLocator,q0 as isCodeCatalog,d as infoLogger,A0 as idTokenClaimsSchema,i0 as groupResourceSchema,z0 as getCodeCatalogEntity,V0 as generateULID,L0 as formatEcid,C0 as deprecateRetiredCodeCatalogRows,L as defineSecretType,U0 as defineCatalog,a as defaultSecretContentType,m as defaultLogger,y0 as deepEqualPlain,c0 as decodeUser,c as debugLogger,H0 as configTrustedClientGrants,m0 as claimsToUser,Y0 as catalogEntityStore,e as buildTenantPath,o0 as assertValidSubjectTypeScoping,R0 as assertEcid,D0 as accessRootId,P0 as accessRefId,d0 as StoreConflictError,I as SecretContentTypeMismatchError,n0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,u0 as IoniteError,E as ION_TENANT_MANAGE,v as ION_SDK_PERMISSIONS,r0 as ION_SCIM_USER_EXTENSION_URN,C as ION_IAM_USERS_WRITE,W as ION_IAM_READ,M as ION_IAM_GROUPS_WRITE,w as ION_ENDPOINT_PERMISSIONS,D as ION_CIAM_MAGIC_LINK_CREATE,P as ION_CAPABILITIEZ_READ,x as ION_AUTHZ_OAA_SYNC,a0 as ION_AUTHZ_GROUP_SCHEMA,E0 as EcidFormatError,x0 as ECID_SCHEME,o as DEFAULT_TENANT_UI_NAMESPACE,r as DEFAULT_TENANT_API_NAMESPACE,b as DEFAULT_SECRET_MIME_TYPES,Y as ConfigSourceError};
+import{A as T0,B as A0,C as O0,D as _0,E as k0,F as f0,G as v0,H as w0,I as g0,J as y0,K as h0,L as p0,M as c0,N as m0,O as d0,P as u0,Q as l0,R as o0,U as a0,V as n0,W as i0,X as s0,Y as r0,Z as t0,a as H0,b as G0,c as F0,d as q0,e as j0,f as U0,g as z0,h as Y0,i as K0,j as W0,k as C0,l as M0,m as D0,n as P0,o as x0,t as b0,u as R0,v as L0,w as S0,x as E0,y as I0,z as N0}from"./shared/core-15896f6h.js";var f="0.0.23-beta.20260825.2";class Y extends Error{kind;recoverable;code;status;path;sourceType;constructor(J,X){super(J,X.cause!==void 0?{cause:X.cause}:void 0);this.name="ConfigSourceError",this.kind=X.kind,this.recoverable=X.recoverable,this.code=X.code,this.status=X.status,this.path=X.path,this.sourceType=X.sourceType,Object.setPrototypeOf(this,Y.prototype)}}function v(J){return J instanceof Y}var F=["workload"],W={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:F,recommendedSubjectTypes:F},C={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:F,recommendedSubjectTypes:F},M={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:F,recommendedSubjectTypes:F},D={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:F,recommendedSubjectTypes:F},P={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:F},x={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:F,recommendedSubjectTypes:F},b={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:F,recommendedSubjectTypes:F},w=[W,C,M,D,P,x,b],g={"iam.read":{permission:W,subjectType:["workload"]},"iam.users.write":{permission:C,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:D,subjectType:["workload"]},"ciam.magic-link.create":{permission:P,subjectType:["workload","user"]},"authz.oaa.sync":{permission:x,subjectType:["workload"]},"tenant.manage":{permission:b,subjectType:["workload"]}};var y=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function S(J){if(J===null||typeof J!=="object")return J;let X={};for(let[Q,$]of Object.entries(J)){if(y.includes(Q)||Q==="validators"||Q==="setStores")continue;X[Q]=$!==null&&typeof $==="object"&&!Array.isArray($)&&Object.getPrototypeOf($)===Object.prototype?S($):$}return X}function h(J){return S(J)}function K(J,X){if(!J||typeof J!=="object"||Array.isArray(J))throw Error(`${X} must be an object.`);return J}function j(J,X){if(J===void 0)return;if(typeof J!=="string"||J.length===0||!Number.isFinite(Date.parse(J)))throw Error(`${X} must be a valid timestamp string.`);return J}function E(J,X,Q){if(!Array.isArray(J)||!Q.allowEmpty&&J.length===0)throw Error(`${X} keys must be ${Q.allowEmpty?"an":"a non-empty"} array.`);let $=new Set;return J.map((Z,B)=>{let V=K(Z,`${X} keys[${B}]`);if(typeof V.id!=="string"||V.id.length===0)throw Error(`${X} keys[${B}].id must be a non-empty string.`);if($.has(V.id))throw Error(`${X} contains duplicate key id "${V.id}".`);if($.add(V.id),!["pending","active","deprecated","rotated","revoked"].includes(String(V.state)))throw Error(`${X} keys[${B}].state is invalid.`);if(V.value!==void 0&&(typeof V.value!=="string"||V.value.length===0))throw Error(`${X} keys[${B}].value must be a non-empty string when present.`);let G=V.meta===void 0?void 0:K(V.meta,`${X} keys[${B}].meta`);return{id:V.id,state:V.state,...V.value===void 0?{}:{value:V.value},...V.notBefore===void 0?{}:{notBefore:j(V.notBefore,`${X} keys[${B}].notBefore`)},...V.notAfter===void 0?{}:{notAfter:j(V.notAfter,`${X} keys[${B}].notAfter`)},...V.createdAt===void 0?{}:{createdAt:j(V.createdAt,`${X} keys[${B}].createdAt`)},...V.activatedAt===void 0?{}:{activatedAt:j(V.activatedAt,`${X} keys[${B}].activatedAt`)},...V.deprecatedAt===void 0?{}:{deprecatedAt:j(V.deprecatedAt,`${X} keys[${B}].deprecatedAt`)},...V.rotatedAt===void 0?{}:{rotatedAt:j(V.rotatedAt,`${X} keys[${B}].rotatedAt`)},...V.revokedAt===void 0?{}:{revokedAt:j(V.revokedAt,`${X} keys[${B}].revokedAt`)},...G?{meta:{...G}}:{}}})}function p(J,X,Q){if(J===void 0)return;if(!Array.isArray(J))throw Error(`${Q} slots must be an array.`);let $=new Set,Z=J.map((B,V)=>{if(B===null)return null;if(typeof B!=="string"||B.length===0)throw Error(`${Q} slots[${V}] must be a non-empty key id or null.`);if($.has(B))throw Error(`${Q} slots contain duplicate key id "${B}".`);$.add(B);let G=X.find((H)=>H.id===B);if(!G)throw Error(`${Q} slot key "${B}" is not present in keys.`);if(G.state!=="active")throw Error(`${Q} slot key "${B}" must have state "active".`);if(!G.value)throw Error(`${Q} slot key "${B}" must include a value.`);return B});if(X.length===0&&Z.some((B)=>B!==null))throw Error(`${Q} slots must be omitted or all-null when keys is empty.`);return Z}function c(J){let Q=K(J,"KMS pool");if(Q.kind!=="kms")throw Error('KMS pool kind must be "kms".');let $=E(Q.keys,"KMS pool",{allowEmpty:!0}),Z=p(Q.slots,$,"KMS pool");return Z?{kind:"kms",slots:Z,keys:$}:{kind:"kms",keys:$}}function m(J){let Q=K(J,"KMS pool control document");if(Q.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:E(Q.keys,"KMS pool control document",{allowEmpty:!0})}}var I={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},d=I,u={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},l={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},o={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function a(J,X){if(typeof X!=="number"||X<=0)return J;return new Promise((Q,$)=>{let Z=setTimeout(()=>{$(Error(`Authz catalog entry did not become ready within ${X}ms`))},X);J.then(()=>{clearTimeout(Z),Q()},(B)=>{clearTimeout(Z),$(B)})})}function n(J,X){let Q=!1,$,Z=X.then(()=>{Q=!0},(V)=>{Q=!1,$=V}),B=J;return Object.defineProperty(B,"ready",{enumerable:!1,configurable:!0,value:(V)=>a(Z.then(()=>{if(!Q)throw $}),V)}),Object.defineProperty(B,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),B}var R=Object.freeze({jsonc:"application/json",env:"text/x-dotenv",text:"text/plain",binary:"application/octet-stream",yaml:"application/yaml",toml:"application/toml",xml:"application/xml"});function L(J){if(!J.id.trim())throw Error("defineSecretType: id is required");let X=J.mimeType?.trim()||R[J.format],Q=Object.freeze({id:J.id,...J.label?{label:J.label}:{},format:J.format,mimeType:X,...J.schemaUrl?{schemaUrl:J.schemaUrl}:{},typeId:J.id});return Object.freeze({id:J.id,...J.label?{label:J.label}:{},format:J.format,mimeType:X,...J.schemaUrl?{schemaUrl:J.schemaUrl}:{},...J.schema?{schema:J.schema}:{},toRegistryEntry:()=>Q})}function i(J="jsonc"){return{format:J,mimeType:R[J],typeId:J}}class N extends Error{expected;received;constructor(J,X){super(`Secret content type mismatch: expected "${J.mimeType}" (${J.format}) but received "${X.mimeType}" (${X.format})`);this.name="SecretContentTypeMismatchError",this.expected=J,this.received=X}}var s=L({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var A={beforeTenantSegments:["ui"]},O={beforeTenantSegments:["api"]};function T(J){return(J??[]).map((X)=>X.trim()).filter(Boolean)}function r(J){let X=J.trim();if(!X)return"/";let Q=X.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function _(J){return r(J).split("/").filter(Boolean)}function z(J){return{beforeTenantSegments:T(J?.beforeTenantSegments),afterTenantSegments:T(J?.afterTenantSegments)}}function t(J){return{type:"path",ui:z(J?.ui??A),api:z(J?.api??O)}}function e(J,X){let Q=z(X),$=Q.beforeTenantSegments??[],Z=Q.afterTenantSegments??[],B=_(J),V=$.length+1+Z.length;if(B.length<V)return null;for(let q=0;q<$.length;q++)if(B[q]!==$[q])return null;let G=$.length,H=B[G];if(!H)return null;for(let q=0;q<Z.length;q++)if(B[G+1+q]!==Z[q])return null;let U=B.slice(G+1+Z.length);return{id:decodeURIComponent(H),restSegments:U,restPath:U.length>0?`/${U.join("/")}`:"/"}}function J0(J,X="/",Q){let $=z(Q),Z=$.beforeTenantSegments??[],B=$.afterTenantSegments??[],V=_(X),G=[...Z,encodeURIComponent(J),...B,...V];return G.length>0?`/${G.join("/")}`:"/"}function Q0(J){return{"~standard":{version:1,vendor:J,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,$=[],Z={...Q},B=["iss","sub"];for(let H of B)if(H in Q){if(typeof Q[H]!=="string")$.push({message:`${H} must be a string`,path:[H]})}else $.push({message:`${H} is required`,path:[H]});if("aud"in Q&&Q.aud!==void 0){let H=Q.aud;if(typeof H!=="string"&&!Array.isArray(H))$.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(H)&&!H.every((U)=>typeof U==="string"))$.push({message:"aud array must contain only strings",path:["aud"]})}let V=["jti","scope"];for(let H of V)if(H in Q&&Q[H]!==void 0){if(typeof Q[H]!=="string")$.push({message:`${H} must be a string`,path:[H]})}let G=["exp","iat"];for(let H of G)if(H in Q){if(typeof Q[H]!=="number")$.push({message:`${H} must be a number`,path:[H]})}else $.push({message:`${H} is required`,path:[H]});if($.length>0)return{issues:$};return{value:Z}}}}}function X0(J){return{"~standard":{version:1,vendor:J,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,$=[],Z={};if("access_token"in Q)if(typeof Q.access_token==="string")Z.access_token=Q.access_token;else $.push({message:"access_token must be a string",path:["access_token"]});else $.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")Z.token_type=Q.token_type;else $.push({message:"token_type must be a string",path:["token_type"]});else $.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)Z.scope=Q.scope;else $.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)Z.refresh_token=Q.refresh_token;else $.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)Z.expires=Q.expires;else $.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)Z.expires_in=Q.expires_in;else $.push({message:"expires_in must be a number",path:["expires_in"]});if($.length>0)return{issues:$};return{value:Z}}}}}function $0(J){let X=new Uint8Array(J);return crypto.getRandomValues(X),X}function B0(J){let X="",Q=$0(J);for(let $=0;$<J;$++){let Z=Q[$]%32;X+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)}return X}function V0(J,X){let Q="";for(let $=X;$>0;$--){let Z=J%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)+Q,J=Math.floor(J/32)}return Q}function Z0(J){let X=Date.now(),Q=V0(X,10),$=B0(16);return`${J??""}${Q}${$}`}export{X0 as workloadTokenResponseSchema,O0 as withValidate,o as warnLogger,p0 as waitOn,f as version,k0 as validationFailureResponse,r0 as userSchema,D0 as unionCatalogRead,H0 as trustedClientPermissionsForPrincipal,g0 as trimTrailingSlash,T0 as tokenResponseSchema,U0 as toCodeCatalog,v0 as stripJsonComments,h0 as stableConfigHash,I as silentLogger,h as serializeConfig,s as remoteConfigSecretType,n as readyCatalogEntry,c as parseKmsPoolDocument,m as parseKmsPoolControlDocument,w0 as parseJsonc,E0 as parseEcid,N0 as oidcCallbackSchema,t as normalizeTenantRoutingStrategy,z as normalizeTenantPathNamespace,_0 as must,f0 as mergeConfig,W0 as mergeCodeCatalogEntity,C0 as materializeCodeCatalogEntity,e as matchTenantPath,q0 as listGenerator,F0 as list,Q0 as jwtAssertionClaimsSchema,u0 as isStoreConflictError,L0 as isEcid,v as isConfigSourceError,o0 as isConfigLocator,j0 as isCodeCatalog,l as infoLogger,A0 as idTokenClaimsSchema,t0 as groupResourceSchema,Y0 as getCodeCatalogEntity,Z0 as generateULID,S0 as formatEcid,M0 as deprecateRetiredCodeCatalogRows,L as defineSecretType,z0 as defineCatalog,i as defaultSecretContentType,d as defaultLogger,y0 as deepEqualPlain,m0 as decodeUser,u as debugLogger,G0 as configTrustedClientGrants,c0 as claimsToUser,K0 as catalogEntityStore,J0 as buildTenantPath,i0 as assertValidSubjectTypeScoping,I0 as assertEcid,x0 as accessRootId,P0 as accessRefId,d0 as StoreConflictError,N as SecretContentTypeMismatchError,n0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,l0 as IoniteError,b as ION_TENANT_MANAGE,w as ION_SDK_PERMISSIONS,s0 as ION_SCIM_USER_EXTENSION_URN,C as ION_IAM_USERS_WRITE,W as ION_IAM_READ,M as ION_IAM_GROUPS_WRITE,g as ION_ENDPOINT_PERMISSIONS,P as ION_CIAM_MAGIC_LINK_CREATE,D as ION_CAPABILITIEZ_READ,x as ION_AUTHZ_OAA_SYNC,a0 as ION_AUTHZ_GROUP_SCHEMA,R0 as EcidFormatError,b0 as ECID_SCHEME,A as DEFAULT_TENANT_UI_NAMESPACE,O as DEFAULT_TENANT_API_NAMESPACE,R as DEFAULT_SECRET_MIME_TYPES,Y as ConfigSourceError};

package/dist/server.d.ts

@@ -2011,6 +2011,68 @@ type KmsKey = {
 	/** Control-plane metadata used for allocation policy and UI. Consumers should treat it as opaque. */
 	meta?: Record<string, unknown>;
 };
+/** Evidence an app submits when a used KMS key failed. The SDK resolves `value` to a key id locally. */
+type KmsParkReport = {
+	/** The key value the app actually used. Never sent on the wire. */
+	value: string;
+	/** HTTP-style status from the failed call (e.g. 429, 403). */
+	status?: number;
+	reason?: string;
+};
+/** Server-decided park outcome. The app never classifies; the vault maps evidence to this. */
+type KmsParkDisposition = "cooldown" | "suspect";
+type KmsParkResult = {
+	parked: boolean;
+	/** True when the used value no longer maps to a delivered grant (already rotated away). */
+	stale?: boolean;
+	disposition?: KmsParkDisposition;
+};
+/** Client-to-vault park request after local value→id resolution. Never carries the secret value. */
+type KmsParkRequest = {
+	keyId: string;
+	status?: number;
+	reason?: string;
+};
+/** Key material an issuer submits. The vault assigns `id` when omitted; issued keys enter `active`. */
+type KmsIssuedKey = {
+	id?: string;
+	value: string;
+	notBefore?: string;
+	notAfter?: string;
+	meta?: Record<string, unknown>;
+};
+type KmsAddKeysRequest = {
+	keys: KmsIssuedKey[];
+};
+type KmsAddKeysResult = {
+	keys: {
+		id: string;
+	}[];
+};
+type KmsRevokeKeyRequest = {
+	keyId: string;
+	reason?: string;
+};
+type KmsRevokeKeyResult = {
+	revoked: boolean;
+};
+type KmsIssuerEventName = "kms_key_parked" | "kms_key_expiring" | "kms_pool_low";
+type KmsIssuerEvent = {
+	path: string;
+	event: KmsIssuerEventName;
+	requestId?: string;
+	/** Metadata-only. Never the secret value. */
+	keyId?: string;
+};
+type KmsIssuerEventListener = (event: KmsIssuerEvent) => void;
+/** Issuer handle for a named pool. Readiness is `configured && sourceBound`, not slot-grant readiness. */
+type KmsPoolIssuer = {
+	addKeys(keys: KmsIssuedKey[], timeout?: number): Promise<KmsAddKeysResult>;
+	revokeKey(request: KmsRevokeKeyRequest, timeout?: number): Promise<KmsRevokeKeyResult>;
+	events(listener: KmsIssuerEventListener): () => void;
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
+};
 /** ConfigSource-owned pointer to a KMS pool document. */
 type KmsPoolConfig = {
 	/** Named `ion.secrets` source. Omit to use the default `ion.secret` source. */
@@ -2021,15 +2083,47 @@ type KmsPoolConfig = {
 /** ConfigSource-owned named KMS pool declarations. */
 type KmsConfig = Record<string, KmsPoolConfig>;
 type KmsPoolListener = (current: KmsKey | undefined) => void;
+/** One requested grant slot. Under-filled slots stay not-ready until the server assigns a distinct key. */
+type KmsPoolSlot = {
+	/**
+	* Returns this slot's granted key. Calls wait on the pool's shared local subscription until a
+	* grant is available; repeated calls resolve from the local cache and never initiate a vault request.
+	*/
+	value(timeout?: number): Promise<string>;
+	/** Synchronous local-cache read. Returns `undefined` when this slot has no usable grant yet. */
+	current(): string | undefined;
+	/** Notifies immediately and whenever this slot's selected active key changes. */
+	subscribe(listener: KmsPoolListener): () => void;
+	/**
+	* Advises the vault that `report.value` failed. Resolves the value to a key id locally and never
+	* sends the secret on the wire. Slot form is a pool alias; value is always explicit.
+	*/
+	park(report: KmsParkReport, timeout?: number): Promise<KmsParkResult>;
+	isReady(): boolean;
+	ready(timeout?: number): Promise<void>;
+};
 type KmsPool = {
 	/**
-	* Returns the current granted key. Calls wait on one shared local subscription until a grant is
-	* available; repeated calls resolve from the local cache and never initiate a vault request.
+	* Returns the current granted key for slot 0. Calls wait on one shared local subscription until a
+	* grant is available; repeated calls resolve from the local cache and never initiate a vault request.
 	*/
 	value(timeout?: number): Promise<string>;
-	/** Timing-safe verification against the active key and usable deprecated rotation-overlap keys. */
+	/** Synchronous local-cache read of slot 0. Returns `undefined` when no usable grant is cached. */
+	current(): string | undefined;
+	/**
+	* Returns `n` stable slot handles that stay distinct across rotation. Demand is the max `n`
+	* requested in this process and never shrinks. Under-filled slots are not ready until the server
+	* assigns a distinct key.
+	*/
+	unique(n: number): KmsPoolSlot[];
+	/** Timing-safe verification against every delivered active key and usable deprecated overlap keys. */
 	accepts(candidate: string): boolean;
-	/** Notifies immediately and whenever the selected active key changes. */
+	/**
+	* Advises the vault that `report.value` failed. Resolves the value to a key id locally (timing-safe)
+	* and sends only the key id. A stale value (no longer in the delivered grant) is a no-op.
+	*/
+	park(report: KmsParkReport, timeout?: number): Promise<KmsParkResult>;
+	/** Notifies immediately and whenever slot 0's selected active key changes. */
 	subscribe(listener: KmsPoolListener): () => void;
 	beforeChange(listener: ChangeListener): () => void;
 	afterChange(listener: ChangeListener): () => void;
@@ -2044,6 +2138,8 @@ type Kms = ModuleReadiness & {
 	readonly config: Readonly<KmsConfig>;
 	listPools(): string[];
 	getPool(name: string): KmsPool;
+	/** Issuer handle for a named pool. Independent of consumer slot grants. */
+	issuer(name: string): KmsPoolIssuer;
 };
 type OtelProtocol = "http/protobuf" | "http/json";
 type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
@@ -2867,18 +2963,25 @@ type SecretLifecycleRequest = {
 	severity?: SecretRequestSeverity;
 	incidentRef?: string;
 };
-type SecretEventName = "rotate_requested" | "revoke_requested" | "created" | "updated" | "deleted" | "rotated" | "revoked" | "removed" | "path_removed" | "lease_expiring_soon" | "lease_revoked" | (string & {});
+type SecretEventName = "rotate_requested" | "revoke_requested" | "created" | "updated" | "deleted" | "rotated" | "revoked" | "removed" | "path_removed" | "lease_expiring_soon" | "lease_revoked" | "kms_key_parked" | "kms_key_expiring" | "kms_pool_low" | (string & {});
 type SecretEvent = {
 	path: string;
 	event: SecretEventName;
 	requestId?: string;
 	issuedAt?: string | number;
 	expiresAt?: string | number;
+	/** Metadata-only KMS key id. Never the secret value. */
+	keyId?: string;
 };
 type SecretEventListener = (event: SecretEvent) => void;
 type SecretsOperationOptions = {
 	/** Optional timeout in milliseconds for this secrets operation. */
 	timeout?: number;
+	/**
+	* Requested distinct KMS grant slots for this client. Carried on LFV/WebSocket/HTTP KMS reads so
+	* the vault can allocate that many unique keys. Omitted demand is treated as one slot.
+	*/
+	kmsSlots?: number;
 };
 type SecretsWriteOptions = SecretsOperationOptions & {
 	/** Content contract stored with the secret and returned by all transports. Required on every write. */
@@ -2949,6 +3052,19 @@ type SecretsSource = ReactiveHandle & ModuleReadiness & {
 	*/
 	requestRevoke(path: string, request?: SecretLifecycleRequest, options?: SecretsOperationOptions): Promise<void>;
 	/**
+	* Advises the vault that a granted KMS key failed. Carries the resolved key id, never the value.
+	* Non-vault sources throw not-supported.
+	*/
+	parkKmsKey(path: string, request: KmsParkRequest, options?: SecretsOperationOptions): Promise<KmsParkResult>;
+	/**
+	* Issues keys into a managed KMS pool. Non-vault sources throw not-supported.
+	*/
+	addKmsKeys(path: string, request: KmsAddKeysRequest, options?: SecretsOperationOptions): Promise<KmsAddKeysResult>;
+	/**
+	* Hard-revokes a key in a managed KMS pool. Non-vault sources throw not-supported.
+	*/
+	revokeKmsKey(path: string, request: KmsRevokeKeyRequest, options?: SecretsOperationOptions): Promise<KmsRevokeKeyResult>;
+	/**
 	* Reads metadata for the given path.
 	*/
 	getMetadata(path: string, options?: SecretsOperationOptions): Promise<Record<string, unknown>>;
@@ -2990,6 +3106,12 @@ type Secrets = ModuleReadiness & {
 	requestRotate(sourceName: string, path: string, request?: SecretLifecycleRequest, options?: SecretsOperationOptions): Promise<void>;
 	/** Requests revocation for a secret path in a named secrets source client. */
 	requestRevoke(sourceName: string, path: string, request?: SecretLifecycleRequest, options?: SecretsOperationOptions): Promise<void>;
+	/** Advises a named vault source that a granted KMS key failed. */
+	parkKmsKey(sourceName: string, path: string, request: KmsParkRequest, options?: SecretsOperationOptions): Promise<KmsParkResult>;
+	/** Issues keys into a named vault KMS pool. */
+	addKmsKeys(sourceName: string, path: string, request: KmsAddKeysRequest, options?: SecretsOperationOptions): Promise<KmsAddKeysResult>;
+	/** Hard-revokes a key in a named vault KMS pool. */
+	revokeKmsKey(sourceName: string, path: string, request: KmsRevokeKeyRequest, options?: SecretsOperationOptions): Promise<KmsRevokeKeyResult>;
 	/** Reads metadata for a secret path in a named secrets source client. */
 	getMetadata(sourceName: string, path: string, options?: SecretsOperationOptions): Promise<Record<string, unknown>>;
 	/** Subscribes to secret changes on a named secrets source client. */
@@ -3783,7 +3905,13 @@ type IoniteBase = {
 	* module (SSO, IAM, Workload, or CIAM) based on the configured URLs.
 	*/
 	handler: (request: Request) => Promise<Response>;
-	/** Returns a promise that resolves when configured at least once. If timeout is > 0, rejects after timeout ms. */
+	/**
+	* Returns a promise that resolves when configured at least once. With no argument it waits up to
+	* the instance's default bound (`IoniteConfig.readyTimeoutMs`, 30s unless overridden) and then
+	* rejects — config that never arrives is an Ops failure and should fail loudly. Pass `timeout > 0`
+	* for an explicit bound, or `0`/`Infinity` to wait indefinitely. Module handles
+	* (`ion.sso.ready()` etc.) keep the indefinite no-timeout feature-gate semantics.
+	*/
 	ready(timeout?: number): Promise<void>;
 	/**
 	* Narrow bootstrap signal: true once RemoteConfig has been applied at least once, false otherwise.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/core",
-  "version": "0.0.23-beta.20260820.2",
+  "version": "0.0.23-beta.20260825.2",
   "description": "ionite Core (client-safe main entry; server handlers under ./server)",
   "private": false,
   "author": "ionite",