@ionite/core 0.0.24-beta.20261010.28 → 0.0.24-beta.20261013.29

package/dist/index.d.ts

@@ -4419,8 +4419,6 @@ type Secrets = ModuleReadiness & {
 	/** Handles LFV events callbacks for configured LFV sources. */
 	handleLfvEvents?(request: Request): Promise<Response>;
 };
-/** Vault websocket fields framework/app code MAY set; the per-frame `token` is ConfigSource-owned. */
-type FrameworkVaultWebSocketSecretsConfig = Omit<VaultWebSocketSecretsConfig, "token">;
 /**
 * Maps a single concrete {@link SecretsSourceConfig} member to its framework/app-settable shape by
 * dropping ConfigSource-owned credentials/trust material. This is a distributive conditional (over a
@@ -4428,11 +4426,9 @@ type FrameworkVaultWebSocketSecretsConfig = Omit<VaultWebSocketSecretsConfig, "t
 * union's common keys.
 *
 * ConfigSource-owned (never settable from code): vault `token`, vault `workload` (OAuth client
-* credentials), vault websocket `token`, and azure `clientSecret`.
+* credentials), and azure `clientSecret`.
 */
-type FrameworkSecretsSourceConfigOf<T> = T extends VaultSecretsConfig ? Partial<Omit<T, "token" | "workload" | "websocket">> & {
-	websocket?: Partial<FrameworkVaultWebSocketSecretsConfig>;
-} : T extends AzureSecretsConfig ? Partial<Omit<T, "clientSecret">> : Partial<T>;
+type FrameworkSecretsSourceConfigOf<T> = T extends VaultSecretsConfig ? Partial<Omit<T, "token" | "workload">> : T extends AzureSecretsConfig ? Partial<Omit<T, "clientSecret">> : Partial<T>;
 /**
 * Partial secrets source config used in framework/app code to declare expected source names and
 * non-secret wiring (paths, endpoints, ttl, transforms). ConfigSource-backed values provide the
@@ -4464,8 +4460,6 @@ type GcpSecretsConfig = {
 type VaultLfvSecretsConfig = {
 	/** LFV server base URL for OTP/action endpoints. */
 	lfvServerUrl?: string;
-	/** LFV client id used for OTP issuance. */
-	clientId?: string;
 	deliveryEndpoint: string;
 	/**
 	* JWKS JSON document (Ed25519) used to verify LFV delivery/events callback signatures.
@@ -4473,7 +4467,6 @@ type VaultLfvSecretsConfig = {
 	*/
 	verifyJwks?: string;
 	eventsEndpoint: string;
-	path?: string;
 	/**
 	* Timeout in milliseconds when waiting for a LFV delivery payload after a read request.
 	* After this duration, an error is thrown.
@@ -4508,27 +4501,12 @@ type VaultLfvSecretsConfig = {
 * Runtime-ready LFV source config.
 * Input config can be partially declared/merged, but LFV operations require these fields.
 */
-type ResolvedVaultLfvSecretsConfig = Omit<VaultLfvSecretsConfig, "lfvServerUrl" | "clientId" | "path"> & {
+type ResolvedVaultLfvSecretsConfig = Omit<VaultLfvSecretsConfig, "lfvServerUrl"> & {
 	lfvServerUrl: string;
 	clientId: string;
 	path: string;
 };
-type VaultWebSocketAuthHeader = "X-Vault-Token" | "Authorization";
-type VaultWebSocketSecretsConfig = {
-	/** Websocket URL for vault command execution and live secret subscriptions. */
-	url?: string;
-	/** Token used to authenticate each subscription/command frame on the shared socket. */
-	token?: string;
-	/**
-	* Vault client id sent with every subscription/command frame for per-frame authentication and
-	* client-side demultiplexing. The server resolves the owning tenant from this client id, so two
-	* sources sharing one socket and path can receive different secrets. When omitted the server
-	* derives the client id from the token.
-	*/
-	clientId?: string;
-	/** Header name used to send the websocket token. Defaults to X-Vault-Token. */
-	header?: VaultWebSocketAuthHeader;
-};
+type VaultAuthHeader = "X-Vault-Token" | "Authorization";
 type VaultWorkloadAuthConfig = {
 	/** OAuth2 token endpoint used to mint workload access tokens for vault calls. */
 	idpTokenUrl?: string;
@@ -4539,23 +4517,36 @@ type VaultWorkloadAuthConfig = {
 	/** Optional OAuth2 scope for the workload token request. */
 	scope?: string;
 };
-type VaultSecretsConfig = {
+type VaultSecretsConfigBase = {
 	type: "vault";
-	url?: string;
+	/** Static transport token. ConfigSource-owned. */
 	token?: string;
-	/** Optional workload identity used to authenticate vault HTTP and websocket requests. */
+	/** Client id shared by WebSocket frame authentication and LFV OTP issuance. */
+	clientId?: string;
+	/** Token header semantics for HTTP and WebSocket. Defaults to X-Vault-Token. */
+	header?: VaultAuthHeader;
+	/** Default/source path shared by ConfigSource and LFV transports. */
+	path?: string;
+	/** Optional workload identity used to authenticate vault HTTP and WebSocket requests. */
 	workload?: VaultWorkloadAuthConfig;
-	/** Optional LFV transport capability for reads/lifecycle operations. */
-	lfv?: VaultLfvSecretsConfig;
-	/** Optional websocket capability for vault commands and live subscriptions. */
-	websocket?: VaultWebSocketSecretsConfig;
 	/**
-	* MINIMUM: 600_000 milliseconds (10 minutes). Polls the path every ttl milliseconds and calls onConfig when config changes.
+	* HTTP-only polling interval. MINIMUM: 600_000 milliseconds (10 minutes).
 	*/
 	ttl?: number;
 	/** Optional logger used for vault source warnings. */
 	log?: Logger;
 };
+type VaultSecretsConfig = (VaultSecretsConfigBase & {
+	/**
+	* Complete vault transport URL. `http(s)` selects HTTP; `ws(s)` selects WebSocket.
+	*/
+	url: string;
+	lfv?: never;
+}) | (VaultSecretsConfigBase & {
+	/** Exclusive LFV transport alternative to `url`. */
+	lfv: VaultLfvSecretsConfig;
+	url?: never;
+});
 type AwsSecretsConfig = {
 	type: "aws";
 	webhookUrl: string;
@@ -4657,9 +4648,8 @@ type ConfigSourceType = "vault" | "azure" | "aws" | "gcp" | "mirror";
 type ConfigSourceOrigin = {
 	type: ConfigSourceType;
 	/**
-	* Transport a vault-backed source reads the document through. When a direct `url` and a
-	* `websocket.url` are both configured, reads use HTTP and the websocket carries live updates;
-	* this field reports the read path.
+	* Transport a vault-backed source reads the document through. The top-level URL scheme selects
+	* HTTP or WebSocket; LFV is the exclusive URL-less alternative.
 	*/
 	transport?: SecretsTransport;
 	/** Server URL without userinfo, query, or fragment. */
@@ -4673,6 +4663,8 @@ type ConfigSourceEnv = {
 	ION_CONFIG_TYPE?: ConfigSourceType;
 	ION_VAULT_URL?: string;
 	ION_VAULT_TOKEN?: string;
+	ION_VAULT_CLIENT_ID?: string;
+	ION_VAULT_HEADER?: VaultAuthHeader;
 	ION_VAULT_PATH?: string;
 	ION_VAULT_TTL?: string;
 	ION_VAULT_WORKLOAD_TOKEN_URL?: string;
@@ -4680,18 +4672,12 @@ type ConfigSourceEnv = {
 	ION_VAULT_WORKLOAD_CLIENT_SECRET?: string;
 	ION_VAULT_WORKLOAD_SCOPE?: string;
 	ION_VAULT_LFV_SERVER_URL?: string;
-	ION_VAULT_LFV_CLIENT_ID?: string;
 	ION_VAULT_LFV_DELIVERY_ENDPOINT?: string;
 	ION_VAULT_LFV_VERIFY_JWKS?: string;
 	ION_VAULT_LFV_EVENTS_ENDPOINT?: string;
-	ION_VAULT_LFV_PATH?: string;
 	ION_VAULT_LFV_DELIVERY_TIMEOUT?: string;
 	ION_VAULT_LFV_RETRY_INTERVAL?: string;
 	ION_VAULT_LFV_WARN_INTERVAL?: string;
-	ION_VAULT_WEBSOCKET_URL?: string;
-	ION_VAULT_WEBSOCKET_TOKEN?: string;
-	ION_VAULT_WEBSOCKET_CLIENT_ID?: string;
-	ION_VAULT_WEBSOCKET_HEADER?: "X-Vault-Token" | "Authorization";
 	ION_AZURE_API_VERSION?: string;
 	ION_AZURE_SCOPE?: string;
 	ION_AZURE_SECRET_NAME_PREFIX?: string;
@@ -4716,6 +4702,8 @@ type VaultConfigLocator = {
 	type: "vault";
 	vaultUrl?: string;
 	vaultToken?: string;
+	vaultClientId?: string;
+	vaultHeader?: VaultAuthHeader;
 	vaultPath: string;
 	vaultTtl?: number;
 	vaultWorkloadTokenUrl?: string;
@@ -4723,18 +4711,12 @@ type VaultConfigLocator = {
 	vaultWorkloadClientSecret?: string;
 	vaultWorkloadScope?: string;
 	vaultLfvServerUrl?: string;
-	vaultLfvClientId?: string;
 	vaultLfvDeliveryEndpoint?: string;
 	vaultLfvVerifyJwks?: string;
 	vaultLfvEventsEndpoint?: string;
-	vaultLfvPath?: string;
 	vaultLfvDeliveryTimeout?: number;
 	vaultLfvRetryInterval?: number;
 	vaultLfvWarnInterval?: number;
-	vaultWebsocketUrl?: string;
-	vaultWebsocketToken?: string;
-	vaultWebsocketClientId?: string;
-	vaultWebsocketHeader?: VaultWebSocketAuthHeader;
 };
 type AwsConfigLocator = {
 	type: "aws";
@@ -7234,4 +7216,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWebSocketAuthHeader, VaultWebSocketSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{Q,Ve,p,v,x,E,c,n,ee,q,d,Be,te,y,t,h,P,ne,Me,je,Ge,Ne,K,z,w,W,re,V,r,f,He,B,Je,Ye,Xe,oe,ie,G,ae,Se,ke,g,F,Le,H,_,O,J,$e,D,qe,Ze,Qe,M,o,S,k,et,tt,de,le,j,Ce,we,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,pe,nt,me,fe,b,a,rt,N,_e,Oe,u,ge,st,ot,i,R,T,it,at,Ke,X,l,m,e,ye,ct,ze,ut,A,C,dt,lt,Z,pt,I,L,De,mt}from"./shared/core-xm7tmw7a.js";var $t="0.0.24-beta.20261010.28";class kt extends n{constructor(s,U){let Y=U.kind==="connection"||U.kind==="timeout"||U.kind==="not_found";super(s,{cause:U.cause,status:Y?503:500,upstreamStatus:U.status});this.name="ConfigSourceError";this.kind=U.kind,this.recoverable=U.recoverable,this.code=U.code,this.path=U.path,this.sourceType=U.sourceType}}function Ut(s){return s instanceof kt}function Wt(s){let U=s?.trim();if(!U)return;try{let Y=new URL(U),se=Y.pathname.replace(/\/+$/g,"");return`${Y.protocol}//${Y.host}${se}`}catch{return}}function At(s,U="ion.config.source"){if(!s)return{};let Y={[`${U}.type`]:s.type};if(s.transport)Y[`${U}.transport`]=s.transport;if(s.url)Y[`${U}.url`]=s.url;if(s.path)Y[`${U}.path`]=s.path;if(s.from)Object.assign(Y,At(s.from,`${U}.from`));return Y}var Ft=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function ht(s){if(s===null||typeof s!=="object")return s;let U={};for(let[Y,se]of Object.entries(s)){if(Ft.includes(Y)||Y==="validators"||Y==="setStores")continue;U[Y]=se!==null&&typeof se==="object"&&!Array.isArray(se)&&Object.getPrototypeOf(se)===Object.prototype?ht(se):se}return U}function qt(s){return ht(s)}function Ct(s,U){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${U} must be an object.`);return s}function gt(s,U){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${U} must be a valid timestamp string.`);return s}function It(s,U,Y){if(!Array.isArray(s)||!Y.allowEmpty&&s.length===0)throw Error(`${U} keys must be ${Y.allowEmpty?"an":"a non-empty"} array.`);let se=new Set;return s.map((ue,ce)=>{let Te=Ct(ue,`${U} keys[${ce}]`);if(typeof Te.id!=="string"||Te.id.length===0)throw Error(`${U} keys[${ce}].id must be a non-empty string.`);if(se.has(Te.id))throw Error(`${U} contains duplicate key id "${Te.id}".`);if(se.add(Te.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Te.state)))throw Error(`${U} keys[${ce}].state is invalid.`);if(Te.value!==void 0&&(typeof Te.value!=="string"||Te.value.length===0))throw Error(`${U} keys[${ce}].value must be a non-empty string when present.`);let be=Te.meta===void 0?void 0:Ct(Te.meta,`${U} keys[${ce}].meta`);return{id:Te.id,state:Te.state,...Te.value===void 0?{}:{value:Te.value},...Te.notBefore===void 0?{}:{notBefore:gt(Te.notBefore,`${U} keys[${ce}].notBefore`)},...Te.notAfter===void 0?{}:{notAfter:gt(Te.notAfter,`${U} keys[${ce}].notAfter`)},...Te.createdAt===void 0?{}:{createdAt:gt(Te.createdAt,`${U} keys[${ce}].createdAt`)},...Te.activatedAt===void 0?{}:{activatedAt:gt(Te.activatedAt,`${U} keys[${ce}].activatedAt`)},...Te.deprecatedAt===void 0?{}:{deprecatedAt:gt(Te.deprecatedAt,`${U} keys[${ce}].deprecatedAt`)},...Te.rotatedAt===void 0?{}:{rotatedAt:gt(Te.rotatedAt,`${U} keys[${ce}].rotatedAt`)},...Te.revokedAt===void 0?{}:{revokedAt:gt(Te.revokedAt,`${U} keys[${ce}].revokedAt`)},...be?{meta:{...be}}:{}}})}function Vt(s,U,Y){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${Y} slots must be an array.`);let se=new Set,ue=s.map((ce,Te)=>{if(ce===null)return null;if(typeof ce!=="string"||ce.length===0)throw Error(`${Y} slots[${Te}] must be a non-empty key id or null.`);if(se.has(ce))throw Error(`${Y} slots contain duplicate key id "${ce}".`);se.add(ce);let be=U.find((he)=>he.id===ce);if(!be)throw Error(`${Y} slot key "${ce}" is not present in keys.`);if(be.state!=="active")throw Error(`${Y} slot key "${ce}" must have state "active".`);if(!be.value)throw Error(`${Y} slot key "${ce}" must include a value.`);return ce});if(U.length===0&&ue.some((ce)=>ce!==null))throw Error(`${Y} slots must be omitted or all-null when keys is empty.`);return ue}function zt(s){let Y=Ct(s,"KMS pool");if(Y.kind!=="kms")throw Error('KMS pool kind must be "kms".');let se=It(Y.keys,"KMS pool",{allowEmpty:!0}),ue=Vt(Y.slots,se,"KMS pool");return ue?{kind:"kms",slots:ue,keys:se}:{kind:"kms",keys:se}}function jt(s){let Y=Ct(s,"KMS pool control document");if(Y.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:It(Y.keys,"KMS pool control document",{allowEmpty:!0})}}var Bt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function xt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function ft(s){let U=xt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(U)?U:JSON.stringify(U)}function Gt(s){return xt(s).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function bt(s,U,Y){if(Y==null)return;if(Y instanceof Error){let se=ee(Y);if(se){for(let[ue,ce]of Object.entries(se))if(ce!=null)s.push(`${ue}=${ft(ce)}`);return}if(s.push(`${U}.name=${ft(Y.name)}`),s.push(`${U}.message=${ft(Y.message)}`),Y.stack)s.push(`${U}.stack=${ft(Y.stack)}`);return}s.push(`${U}=${ft(Y)}`)}function yt(s,U,Y=[],se=new Date){let ue=Gt(U instanceof Error?U.message:U??""),ce=[];for(let[Te,be]of Y.entries()){if(be&&typeof be==="object"&&!Array.isArray(be)&&!(be instanceof Error)&&Object.getPrototypeOf(be)===Object.prototype){for(let[he,Fe]of Object.entries(be))bt(ce,he,Fe);continue}bt(ce,`param.${Te}`,be)}return[se.toISOString(),Bt[s],ue,...ce].filter(Boolean).join(" ")}var Pt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Ht=Pt,Yt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Jt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Xt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Zt={trace:()=>{},debug:(s,...U)=>globalThis.console.debug(yt("debug",s,U)),info:(s,...U)=>globalThis.console.info(yt("info",s,U)),warn:(s,...U)=>globalThis.console.warn(yt("warn",s,U)),error:(s,...U)=>globalThis.console.error(yt("error",s,U))};function Qt(s,U){if(typeof U!=="number"||U<=0)return s;return new Promise((Y,se)=>{let ue=setTimeout(()=>{se(Error(`Authz catalog entry did not become ready within ${U}ms`))},U);s.then(()=>{clearTimeout(ue),Y()},(ce)=>{clearTimeout(ue),se(ce)})})}function eo(s,U){let Y=!1,se,ue=U.then(()=>{Y=!0},(Te)=>{Y=!1,se=Te}),ce=s;return Object.defineProperty(ce,"ready",{enumerable:!1,configurable:!0,value:(Te)=>Qt(ue.then(()=>{if(!Y)throw se}),Te)}),Object.defineProperty(ce,"isReady",{enumerable:!1,configurable:!0,value:()=>Y}),ce}var Tt=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:Oe,yaml:"application/yaml",toml:"application/toml",xml:_e});function Rt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let U=s.mimeType?.trim()||Tt[s.format],Y=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>Y})}function to(s="jsonc"){return{format:s,mimeType:Tt[s],typeId:s}}class Ot extends n{constructor(s,U){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${U.mimeType}" (${U.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=U}}var oo=Rt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var vt={beforeTenantSegments:["ui"]},wt={beforeTenantSegments:["api"]};function _t(s){return(s??[]).map((U)=>U.trim()).filter(Boolean)}function Kt(s){let U=s.trim();if(!U)return"/";let Y=U.replace(/\\/g,"/").replace(/\/+/g,"/");return Y.startsWith("/")?Y:`/${Y}`}function Dt(s){return Kt(s).split("/").filter(Boolean)}function St(s){return{beforeTenantSegments:_t(s?.beforeTenantSegments),afterTenantSegments:_t(s?.afterTenantSegments)}}function Mt(s){if(s?.type==="host")return{type:"host",baseDomain:Et(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:St(s?.ui??vt),api:St(s?.api??wt)}}function Et(s){let U=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!U)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return U}function ro(s,U){let Y=s.trim().replace(/\.$/,"").toLowerCase(),se=Et(U);if(!Y.endsWith(`.${se}`))return null;let ue=Y.slice(0,-(se.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function no(s,U){let Y=St(U),se=Y.beforeTenantSegments??[],ue=Y.afterTenantSegments??[],ce=Dt(s),Te=se.length+1+ue.length;if(ce.length<Te)return null;for(let We=0;We<se.length;We++)if(ce[We]!==se[We])return null;let be=se.length,he=ce[be];if(!he)return null;for(let We=0;We<ue.length;We++)if(ce[be+1+We]!==ue[We])return null;let Fe=ce.slice(be+1+ue.length);return{id:decodeURIComponent(he),restSegments:Fe,restPath:Fe.length>0?`/${Fe.join("/")}`:"/"}}function Lt(s,U="/",Y){let se=St(Y),ue=se.beforeTenantSegments??[],ce=se.afterTenantSegments??[],Te=Dt(U),be=[...ue,encodeURIComponent(s),...ce,...Te];return be.length>0?`/${be.join("/")}`:"/"}function so(s,U="/",Y,se="ui"){let ue=Mt(Y);if(ue.type==="host"||ue.type==="selector")return Kt(U);return Lt(s,U,ue[se])}function io(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ue={...Y},ce=["iss","sub"];for(let he of ce)if(he in Y){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if("aud"in Y&&Y.aud!==void 0){let he=Y.aud;if(typeof he!=="string"&&!Array.isArray(he))se.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(he)&&!he.every((Fe)=>typeof Fe==="string"))se.push({message:"aud array must contain only strings",path:["aud"]})}let Te=["jti","scope"];for(let he of Te)if(he in Y&&Y[he]!==void 0){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}let be=["exp","iat"];for(let he of be)if(he in Y){if(typeof Y[he]!=="number")se.push({message:`${he} must be a number`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if(se.length>0)return{issues:se};return{value:ue}}}}}function ao(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ue={};if("access_token"in Y)if(typeof Y.access_token==="string")ue.access_token=Y.access_token;else se.push({message:"access_token must be a string",path:["access_token"]});else se.push({message:"access_token is required",path:["access_token"]});if("token_type"in Y)if(typeof Y.token_type==="string")ue.token_type=Y.token_type;else se.push({message:"token_type must be a string",path:["token_type"]});else se.push({message:"token_type is required",path:["token_type"]});if("scope"in Y)if(typeof Y.scope==="string"||Y.scope===void 0)ue.scope=Y.scope;else se.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Y)if(typeof Y.refresh_token==="string"||Y.refresh_token===void 0)ue.refresh_token=Y.refresh_token;else se.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Y)if(typeof Y.expires==="string"||Y.expires===void 0)ue.expires=Y.expires;else se.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Y)if(typeof Y.expires_in==="number"||Y.expires_in===void 0)ue.expires_in=Y.expires_in;else se.push({message:"expires_in must be a number",path:["expires_in"]});if(se.length>0)return{issues:se};return{value:ue}}}}}function po(s){let U=new Uint8Array(s);return crypto.getRandomValues(U),U}function co(s){let U="",Y=po(s);for(let se=0;se<s;se++){let ue=Y[se]%32;U+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return U}function mo(s,U){let Y="";for(let se=U;se>0;se--){let ue=s%32;Y="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+Y,s=Math.floor(s/32)}return Y}function uo(s){let U=Date.now(),Y=mo(U,10),se=co(16);return`${s??""}${Y}${se}`}export{u as ACCEPT_JSON,ot as ACCEPT_OCTET_STREAM,ge as ACCEPT_SCIM,st as ACCEPT_XML,Me as AssignmentPolicyError,te as CANONICAL_RISK_LEVELS,T as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,at as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,it as CONTENT_TYPE_XML,kt as ConfigSourceError,Ye as DEFAULT_DISCOVERED_COOKIE_MAX,Xe as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Je as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,Tt as DEFAULT_SECRET_MIME_TYPES,wt as DEFAULT_TENANT_API_NAMESPACE,vt as DEFAULT_TENANT_UI_NAMESPACE,oe as DISCOVERED_COOKIE_PREFIX,He as DISPLAY_COOKIE_SUFFIX,B as DISPLAY_COOKIE_VERSION,$e as ECID_SCHEME,j as ENTRA_ION_EXTENSION_URN,D as EcidFormatError,N as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,Pe as ION_AUTHZ_OAA_SYNC,xe as ION_CAPABILITIEZ_READ,Ee as ION_CIAM_MAGIC_LINK_CREATE,nt as ION_ENDPOINT_PERMISSIONS,ve as ION_IAM_ACCESS_REQUESTS_WRITE,Ie as ION_IAM_CUSTOMERS_WRITE,Re as ION_IAM_GROUPS_WRITE,Ce as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Ae as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,pe as ION_SDK_PERMISSIONS,Ue as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,x as KNOWN_BASE_CUSTOMER_KEYS,v as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,E as KNOWN_WORKLOAD_KEYS,Oe as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,rt as SCIM_MEDIA_TYPE,Ot as SecretContentTypeMismatchError,I as StoreConflictError,_e as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,M as assertEcid,ne as assertRequiredSubjectType,P as assertValidSubjectTypeScoping,Lt as buildTenantPath,so as buildTenantUrl,z as catalogEntityStore,Z as claimsToUser,_ as compareDisplayExpiryDesc,At as configSourceOriginLogFields,Ve as configTrustedClientGrants,c as customAttributes,le as customerResourceSchema,Yt as debugLogger,Le as decodeDisplayCookie,pt as decodeUser,C as deepEqualPlain,Se as defaultDisplayUser,Ht as defaultLogger,to as defaultSecretContentType,Ne as defineCatalog,Rt as defineSecretType,re as deprecateRetiredCodeCatalogRows,Wt as describeOriginUrl,J as discoveredProfileCookieName,F as encodeDisplayCookie,ee as errorLogAttributes,Ze as formatEcid,yt as formatLogLine,uo as generateULID,K as getCodeCatalogEntity,tt as groupResourceSchema,b as idTokenClaimsSchema,Jt as infoLogger,je as isCodeCatalog,De as isConfigLocator,Ut as isConfigSourceError,qe as isEcid,Ke as isJsonResponse,L as isStoreConflictError,io as jwtAssertionClaimsSchema,q as list,d as listGenerator,ro as matchTenantHost,no as matchTenantPath,Be as matchesListFilter,W as materializeCodeCatalogEntity,w as mergeCodeCatalogEntity,ct as mergeConfig,e as must,Et as normalizeTenantBaseDomain,St as normalizeTenantPathNamespace,Mt as normalizeTenantRoutingStrategy,me as oidcCallbackSchema,Qe as parseEcid,ut as parseJsonc,jt as parseKmsPoolControlDocument,zt as parseKmsPoolDocument,Zt as prettyLogger,O as profileCookieName,g as projectDisplayUser,H as readDisplayCookies,l as readJsonResponse,eo as readyCatalogEntry,oo as remoteConfigSecretType,G as resolveDiscoveredCookieMax,ae as resolveDiscoveredCookieTtlSeconds,ie as resolveDisplayCookieMax,ke as sanitizeDisplayUser,qt as serializeConfig,Pt as silentLogger,dt as stableConfigHash,ze as stripJsonComments,mt as tmIntegrationState,Ge as toCodeCatalog,fe as tokenResponseSchema,A as trimTrailingSlash,Q as trustedClientPermissionsForPrincipal,X as unexpectedBodySummary,V as unionCatalogRead,et as userSchema,ye as validationFailureResponse,$t as version,lt as waitOn,Xt as warnLogger,m as withValidate,de as workloadResourceSchema,ao as workloadTokenResponseSchema};
+import{Q,Ve,p,v,x,E,c,n,ee,q,d,Be,te,y,t,h,P,ne,Me,je,Ge,Ne,K,z,w,W,re,V,r,f,He,B,Je,Ye,Xe,oe,ie,G,ae,Se,ke,g,F,Le,H,_,O,J,$e,D,qe,Ze,Qe,M,o,S,k,et,tt,de,le,j,Ce,we,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,pe,nt,me,fe,b,a,rt,N,_e,Oe,u,ge,st,ot,i,R,T,it,at,Ke,X,l,m,e,ye,ct,ze,ut,A,C,dt,lt,Z,pt,I,L,De,mt}from"./shared/core-xm7tmw7a.js";var $t="0.0.24-beta.20261013.29";class Tt extends n{constructor(s,U){let Y=U.kind==="connection"||U.kind==="timeout"||U.kind==="not_found";super(s,{cause:U.cause,status:Y?503:500,upstreamStatus:U.status});this.name="ConfigSourceError";this.kind=U.kind,this.recoverable=U.recoverable,this.code=U.code,this.path=U.path,this.sourceType=U.sourceType}}function Ut(s){return s instanceof Tt}function Wt(s){let U=s?.trim();if(!U)return;try{let Y=new URL(U),se=Y.pathname.replace(/\/+$/g,"");return`${Y.protocol}//${Y.host}${se}`}catch{return}}function At(s,U="ion.config.source"){if(!s)return{};let Y={[`${U}.type`]:s.type};if(s.transport)Y[`${U}.transport`]=s.transport;if(s.url)Y[`${U}.url`]=s.url;if(s.path)Y[`${U}.path`]=s.path;if(s.from)Object.assign(Y,At(s.from,`${U}.from`));return Y}var Ft=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function ht(s){if(s===null||typeof s!=="object")return s;let U={};for(let[Y,se]of Object.entries(s)){if(Ft.includes(Y)||Y==="validators"||Y==="setStores")continue;U[Y]=se!==null&&typeof se==="object"&&!Array.isArray(se)&&Object.getPrototypeOf(se)===Object.prototype?ht(se):se}return U}function qt(s){return ht(s)}function Ct(s,U){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${U} must be an object.`);return s}function gt(s,U){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${U} must be a valid timestamp string.`);return s}function It(s,U,Y){if(!Array.isArray(s)||!Y.allowEmpty&&s.length===0)throw Error(`${U} keys must be ${Y.allowEmpty?"an":"a non-empty"} array.`);let se=new Set;return s.map((ue,ce)=>{let Te=Ct(ue,`${U} keys[${ce}]`);if(typeof Te.id!=="string"||Te.id.length===0)throw Error(`${U} keys[${ce}].id must be a non-empty string.`);if(se.has(Te.id))throw Error(`${U} contains duplicate key id "${Te.id}".`);if(se.add(Te.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Te.state)))throw Error(`${U} keys[${ce}].state is invalid.`);if(Te.value!==void 0&&(typeof Te.value!=="string"||Te.value.length===0))throw Error(`${U} keys[${ce}].value must be a non-empty string when present.`);let be=Te.meta===void 0?void 0:Ct(Te.meta,`${U} keys[${ce}].meta`);return{id:Te.id,state:Te.state,...Te.value===void 0?{}:{value:Te.value},...Te.notBefore===void 0?{}:{notBefore:gt(Te.notBefore,`${U} keys[${ce}].notBefore`)},...Te.notAfter===void 0?{}:{notAfter:gt(Te.notAfter,`${U} keys[${ce}].notAfter`)},...Te.createdAt===void 0?{}:{createdAt:gt(Te.createdAt,`${U} keys[${ce}].createdAt`)},...Te.activatedAt===void 0?{}:{activatedAt:gt(Te.activatedAt,`${U} keys[${ce}].activatedAt`)},...Te.deprecatedAt===void 0?{}:{deprecatedAt:gt(Te.deprecatedAt,`${U} keys[${ce}].deprecatedAt`)},...Te.rotatedAt===void 0?{}:{rotatedAt:gt(Te.rotatedAt,`${U} keys[${ce}].rotatedAt`)},...Te.revokedAt===void 0?{}:{revokedAt:gt(Te.revokedAt,`${U} keys[${ce}].revokedAt`)},...be?{meta:{...be}}:{}}})}function zt(s,U,Y){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${Y} slots must be an array.`);let se=new Set,ue=s.map((ce,Te)=>{if(ce===null)return null;if(typeof ce!=="string"||ce.length===0)throw Error(`${Y} slots[${Te}] must be a non-empty key id or null.`);if(se.has(ce))throw Error(`${Y} slots contain duplicate key id "${ce}".`);se.add(ce);let be=U.find((he)=>he.id===ce);if(!be)throw Error(`${Y} slot key "${ce}" is not present in keys.`);if(be.state!=="active")throw Error(`${Y} slot key "${ce}" must have state "active".`);if(!be.value)throw Error(`${Y} slot key "${ce}" must include a value.`);return ce});if(U.length===0&&ue.some((ce)=>ce!==null))throw Error(`${Y} slots must be omitted or all-null when keys is empty.`);return ue}function Vt(s){let Y=Ct(s,"KMS pool");if(Y.kind!=="kms")throw Error('KMS pool kind must be "kms".');let se=It(Y.keys,"KMS pool",{allowEmpty:!0}),ue=zt(Y.slots,se,"KMS pool");return ue?{kind:"kms",slots:ue,keys:se}:{kind:"kms",keys:se}}function jt(s){let Y=Ct(s,"KMS pool control document");if(Y.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:It(Y.keys,"KMS pool control document",{allowEmpty:!0})}}var Bt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function xt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function ft(s){let U=xt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(U)?U:JSON.stringify(U)}function Gt(s){return xt(s).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function bt(s,U,Y){if(Y==null)return;if(Y instanceof Error){let se=ee(Y);if(se){for(let[ue,ce]of Object.entries(se))if(ce!=null)s.push(`${ue}=${ft(ce)}`);return}if(s.push(`${U}.name=${ft(Y.name)}`),s.push(`${U}.message=${ft(Y.message)}`),Y.stack)s.push(`${U}.stack=${ft(Y.stack)}`);return}s.push(`${U}=${ft(Y)}`)}function yt(s,U,Y=[],se=new Date){let ue=Gt(U instanceof Error?U.message:U??""),ce=[];for(let[Te,be]of Y.entries()){if(be&&typeof be==="object"&&!Array.isArray(be)&&!(be instanceof Error)&&Object.getPrototypeOf(be)===Object.prototype){for(let[he,Fe]of Object.entries(be))bt(ce,he,Fe);continue}bt(ce,`param.${Te}`,be)}return[se.toISOString(),Bt[s],ue,...ce].filter(Boolean).join(" ")}var Pt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Ht=Pt,Yt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Jt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Xt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Zt={trace:()=>{},debug:(s,...U)=>globalThis.console.debug(yt("debug",s,U)),info:(s,...U)=>globalThis.console.info(yt("info",s,U)),warn:(s,...U)=>globalThis.console.warn(yt("warn",s,U)),error:(s,...U)=>globalThis.console.error(yt("error",s,U))};function Qt(s,U){if(typeof U!=="number"||U<=0)return s;return new Promise((Y,se)=>{let ue=setTimeout(()=>{se(Error(`Authz catalog entry did not become ready within ${U}ms`))},U);s.then(()=>{clearTimeout(ue),Y()},(ce)=>{clearTimeout(ue),se(ce)})})}function eo(s,U){let Y=!1,se,ue=U.then(()=>{Y=!0},(Te)=>{Y=!1,se=Te}),ce=s;return Object.defineProperty(ce,"ready",{enumerable:!1,configurable:!0,value:(Te)=>Qt(ue.then(()=>{if(!Y)throw se}),Te)}),Object.defineProperty(ce,"isReady",{enumerable:!1,configurable:!0,value:()=>Y}),ce}var kt=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:Oe,yaml:"application/yaml",toml:"application/toml",xml:_e});function Rt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let U=s.mimeType?.trim()||kt[s.format],Y=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>Y})}function to(s="jsonc"){return{format:s,mimeType:kt[s],typeId:s}}class Ot extends n{constructor(s,U){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${U.mimeType}" (${U.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=U}}var oo=Rt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var vt={beforeTenantSegments:["ui"]},wt={beforeTenantSegments:["api"]};function _t(s){return(s??[]).map((U)=>U.trim()).filter(Boolean)}function Kt(s){let U=s.trim();if(!U)return"/";let Y=U.replace(/\\/g,"/").replace(/\/+/g,"/");return Y.startsWith("/")?Y:`/${Y}`}function Dt(s){return Kt(s).split("/").filter(Boolean)}function St(s){return{beforeTenantSegments:_t(s?.beforeTenantSegments),afterTenantSegments:_t(s?.afterTenantSegments)}}function Mt(s){if(s?.type==="host")return{type:"host",baseDomain:Et(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:St(s?.ui??vt),api:St(s?.api??wt)}}function Et(s){let U=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!U)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return U}function ro(s,U){let Y=s.trim().replace(/\.$/,"").toLowerCase(),se=Et(U);if(!Y.endsWith(`.${se}`))return null;let ue=Y.slice(0,-(se.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function no(s,U){let Y=St(U),se=Y.beforeTenantSegments??[],ue=Y.afterTenantSegments??[],ce=Dt(s),Te=se.length+1+ue.length;if(ce.length<Te)return null;for(let We=0;We<se.length;We++)if(ce[We]!==se[We])return null;let be=se.length,he=ce[be];if(!he)return null;for(let We=0;We<ue.length;We++)if(ce[be+1+We]!==ue[We])return null;let Fe=ce.slice(be+1+ue.length);return{id:decodeURIComponent(he),restSegments:Fe,restPath:Fe.length>0?`/${Fe.join("/")}`:"/"}}function Lt(s,U="/",Y){let se=St(Y),ue=se.beforeTenantSegments??[],ce=se.afterTenantSegments??[],Te=Dt(U),be=[...ue,encodeURIComponent(s),...ce,...Te];return be.length>0?`/${be.join("/")}`:"/"}function so(s,U="/",Y,se="ui"){let ue=Mt(Y);if(ue.type==="host"||ue.type==="selector")return Kt(U);return Lt(s,U,ue[se])}function io(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ue={...Y},ce=["iss","sub"];for(let he of ce)if(he in Y){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if("aud"in Y&&Y.aud!==void 0){let he=Y.aud;if(typeof he!=="string"&&!Array.isArray(he))se.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(he)&&!he.every((Fe)=>typeof Fe==="string"))se.push({message:"aud array must contain only strings",path:["aud"]})}let Te=["jti","scope"];for(let he of Te)if(he in Y&&Y[he]!==void 0){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}let be=["exp","iat"];for(let he of be)if(he in Y){if(typeof Y[he]!=="number")se.push({message:`${he} must be a number`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if(se.length>0)return{issues:se};return{value:ue}}}}}function ao(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ue={};if("access_token"in Y)if(typeof Y.access_token==="string")ue.access_token=Y.access_token;else se.push({message:"access_token must be a string",path:["access_token"]});else se.push({message:"access_token is required",path:["access_token"]});if("token_type"in Y)if(typeof Y.token_type==="string")ue.token_type=Y.token_type;else se.push({message:"token_type must be a string",path:["token_type"]});else se.push({message:"token_type is required",path:["token_type"]});if("scope"in Y)if(typeof Y.scope==="string"||Y.scope===void 0)ue.scope=Y.scope;else se.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Y)if(typeof Y.refresh_token==="string"||Y.refresh_token===void 0)ue.refresh_token=Y.refresh_token;else se.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Y)if(typeof Y.expires==="string"||Y.expires===void 0)ue.expires=Y.expires;else se.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Y)if(typeof Y.expires_in==="number"||Y.expires_in===void 0)ue.expires_in=Y.expires_in;else se.push({message:"expires_in must be a number",path:["expires_in"]});if(se.length>0)return{issues:se};return{value:ue}}}}}function po(s){let U=new Uint8Array(s);return crypto.getRandomValues(U),U}function co(s){let U="",Y=po(s);for(let se=0;se<s;se++){let ue=Y[se]%32;U+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return U}function mo(s,U){let Y="";for(let se=U;se>0;se--){let ue=s%32;Y="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+Y,s=Math.floor(s/32)}return Y}function uo(s){let U=Date.now(),Y=mo(U,10),se=co(16);return`${s??""}${Y}${se}`}export{u as ACCEPT_JSON,ot as ACCEPT_OCTET_STREAM,ge as ACCEPT_SCIM,st as ACCEPT_XML,Me as AssignmentPolicyError,te as CANONICAL_RISK_LEVELS,T as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,at as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,it as CONTENT_TYPE_XML,Tt as ConfigSourceError,Ye as DEFAULT_DISCOVERED_COOKIE_MAX,Xe as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Je as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,kt as DEFAULT_SECRET_MIME_TYPES,wt as DEFAULT_TENANT_API_NAMESPACE,vt as DEFAULT_TENANT_UI_NAMESPACE,oe as DISCOVERED_COOKIE_PREFIX,He as DISPLAY_COOKIE_SUFFIX,B as DISPLAY_COOKIE_VERSION,$e as ECID_SCHEME,j as ENTRA_ION_EXTENSION_URN,D as EcidFormatError,N as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,Pe as ION_AUTHZ_OAA_SYNC,xe as ION_CAPABILITIEZ_READ,Ee as ION_CIAM_MAGIC_LINK_CREATE,nt as ION_ENDPOINT_PERMISSIONS,ve as ION_IAM_ACCESS_REQUESTS_WRITE,Ie as ION_IAM_CUSTOMERS_WRITE,Re as ION_IAM_GROUPS_WRITE,Ce as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Ae as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,pe as ION_SDK_PERMISSIONS,Ue as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,x as KNOWN_BASE_CUSTOMER_KEYS,v as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,E as KNOWN_WORKLOAD_KEYS,Oe as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,rt as SCIM_MEDIA_TYPE,Ot as SecretContentTypeMismatchError,I as StoreConflictError,_e as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,M as assertEcid,ne as assertRequiredSubjectType,P as assertValidSubjectTypeScoping,Lt as buildTenantPath,so as buildTenantUrl,z as catalogEntityStore,Z as claimsToUser,_ as compareDisplayExpiryDesc,At as configSourceOriginLogFields,Ve as configTrustedClientGrants,c as customAttributes,le as customerResourceSchema,Yt as debugLogger,Le as decodeDisplayCookie,pt as decodeUser,C as deepEqualPlain,Se as defaultDisplayUser,Ht as defaultLogger,to as defaultSecretContentType,Ne as defineCatalog,Rt as defineSecretType,re as deprecateRetiredCodeCatalogRows,Wt as describeOriginUrl,J as discoveredProfileCookieName,F as encodeDisplayCookie,ee as errorLogAttributes,Ze as formatEcid,yt as formatLogLine,uo as generateULID,K as getCodeCatalogEntity,tt as groupResourceSchema,b as idTokenClaimsSchema,Jt as infoLogger,je as isCodeCatalog,De as isConfigLocator,Ut as isConfigSourceError,qe as isEcid,Ke as isJsonResponse,L as isStoreConflictError,io as jwtAssertionClaimsSchema,q as list,d as listGenerator,ro as matchTenantHost,no as matchTenantPath,Be as matchesListFilter,W as materializeCodeCatalogEntity,w as mergeCodeCatalogEntity,ct as mergeConfig,e as must,Et as normalizeTenantBaseDomain,St as normalizeTenantPathNamespace,Mt as normalizeTenantRoutingStrategy,me as oidcCallbackSchema,Qe as parseEcid,ut as parseJsonc,jt as parseKmsPoolControlDocument,Vt as parseKmsPoolDocument,Zt as prettyLogger,O as profileCookieName,g as projectDisplayUser,H as readDisplayCookies,l as readJsonResponse,eo as readyCatalogEntry,oo as remoteConfigSecretType,G as resolveDiscoveredCookieMax,ae as resolveDiscoveredCookieTtlSeconds,ie as resolveDisplayCookieMax,ke as sanitizeDisplayUser,qt as serializeConfig,Pt as silentLogger,dt as stableConfigHash,ze as stripJsonComments,mt as tmIntegrationState,Ge as toCodeCatalog,fe as tokenResponseSchema,A as trimTrailingSlash,Q as trustedClientPermissionsForPrincipal,X as unexpectedBodySummary,V as unionCatalogRead,et as userSchema,ye as validationFailureResponse,$t as version,lt as waitOn,Xt as warnLogger,m as withValidate,de as workloadResourceSchema,ao as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -4201,8 +4201,6 @@ type GcpSecretsConfig = {
 type VaultLfvSecretsConfig = {
 	/** LFV server base URL for OTP/action endpoints. */
 	lfvServerUrl?: string;
-	/** LFV client id used for OTP issuance. */
-	clientId?: string;
 	deliveryEndpoint: string;
 	/**
 	* JWKS JSON document (Ed25519) used to verify LFV delivery/events callback signatures.
@@ -4210,7 +4208,6 @@ type VaultLfvSecretsConfig = {
 	*/
 	verifyJwks?: string;
 	eventsEndpoint: string;
-	path?: string;
 	/**
 	* Timeout in milliseconds when waiting for a LFV delivery payload after a read request.
 	* After this duration, an error is thrown.
@@ -4241,22 +4238,7 @@ type VaultLfvSecretsConfig = {
 	*/
 	log?: Logger;
 };
-type VaultWebSocketAuthHeader = "X-Vault-Token" | "Authorization";
-type VaultWebSocketSecretsConfig = {
-	/** Websocket URL for vault command execution and live secret subscriptions. */
-	url?: string;
-	/** Token used to authenticate each subscription/command frame on the shared socket. */
-	token?: string;
-	/**
-	* Vault client id sent with every subscription/command frame for per-frame authentication and
-	* client-side demultiplexing. The server resolves the owning tenant from this client id, so two
-	* sources sharing one socket and path can receive different secrets. When omitted the server
-	* derives the client id from the token.
-	*/
-	clientId?: string;
-	/** Header name used to send the websocket token. Defaults to X-Vault-Token. */
-	header?: VaultWebSocketAuthHeader;
-};
+type VaultAuthHeader = "X-Vault-Token" | "Authorization";
 type VaultWorkloadAuthConfig = {
 	/** OAuth2 token endpoint used to mint workload access tokens for vault calls. */
 	idpTokenUrl?: string;
@@ -4267,23 +4249,36 @@ type VaultWorkloadAuthConfig = {
 	/** Optional OAuth2 scope for the workload token request. */
 	scope?: string;
 };
-type VaultSecretsConfig = {
+type VaultSecretsConfigBase = {
 	type: "vault";
-	url?: string;
+	/** Static transport token. ConfigSource-owned. */
 	token?: string;
-	/** Optional workload identity used to authenticate vault HTTP and websocket requests. */
+	/** Client id shared by WebSocket frame authentication and LFV OTP issuance. */
+	clientId?: string;
+	/** Token header semantics for HTTP and WebSocket. Defaults to X-Vault-Token. */
+	header?: VaultAuthHeader;
+	/** Default/source path shared by ConfigSource and LFV transports. */
+	path?: string;
+	/** Optional workload identity used to authenticate vault HTTP and WebSocket requests. */
 	workload?: VaultWorkloadAuthConfig;
-	/** Optional LFV transport capability for reads/lifecycle operations. */
-	lfv?: VaultLfvSecretsConfig;
-	/** Optional websocket capability for vault commands and live subscriptions. */
-	websocket?: VaultWebSocketSecretsConfig;
 	/**
-	* MINIMUM: 600_000 milliseconds (10 minutes). Polls the path every ttl milliseconds and calls onConfig when config changes.
+	* HTTP-only polling interval. MINIMUM: 600_000 milliseconds (10 minutes).
 	*/
 	ttl?: number;
 	/** Optional logger used for vault source warnings. */
 	log?: Logger;
 };
+type VaultSecretsConfig = (VaultSecretsConfigBase & {
+	/**
+	* Complete vault transport URL. `http(s)` selects HTTP; `ws(s)` selects WebSocket.
+	*/
+	url: string;
+	lfv?: never;
+}) | (VaultSecretsConfigBase & {
+	/** Exclusive LFV transport alternative to `url`. */
+	lfv: VaultLfvSecretsConfig;
+	url?: never;
+});
 type AwsSecretsConfig = {
 	type: "aws";
 	webhookUrl: string;
@@ -4378,6 +4373,8 @@ type VaultConfigLocator = {
 	type: "vault";
 	vaultUrl?: string;
 	vaultToken?: string;
+	vaultClientId?: string;
+	vaultHeader?: VaultAuthHeader;
 	vaultPath: string;
 	vaultTtl?: number;
 	vaultWorkloadTokenUrl?: string;
@@ -4385,18 +4382,12 @@ type VaultConfigLocator = {
 	vaultWorkloadClientSecret?: string;
 	vaultWorkloadScope?: string;
 	vaultLfvServerUrl?: string;
-	vaultLfvClientId?: string;
 	vaultLfvDeliveryEndpoint?: string;
 	vaultLfvVerifyJwks?: string;
 	vaultLfvEventsEndpoint?: string;
-	vaultLfvPath?: string;
 	vaultLfvDeliveryTimeout?: number;
 	vaultLfvRetryInterval?: number;
 	vaultLfvWarnInterval?: number;
-	vaultWebsocketUrl?: string;
-	vaultWebsocketToken?: string;
-	vaultWebsocketClientId?: string;
-	vaultWebsocketHeader?: VaultWebSocketAuthHeader;
 };
 type AwsConfigLocator = {
 	type: "aws";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/core",
-  "version": "0.0.24-beta.20261010.28",
+  "version": "0.0.24-beta.20261013.29",
   "description": "ionite Core (client-safe main entry; server handlers under ./server)",
   "private": false,
   "author": "ionite",