@ionite/core 0.0.24-beta.20261013.29 → 0.0.24-beta.20261013.30

package/dist/index.d.ts

@@ -4452,7 +4452,7 @@ type SecretsSourceConfig = DevSecretsConfig | GcpSecretsConfig | VaultSecretsCon
 type SecretsModuleConfig = Record<string, SecretsSourceConfig>;
 type DevSecretsConfig = {
 	type: "dev";
-	ioniteUrl: string;
+	url: string;
 };
 type GcpSecretsConfig = {
 	type: "gcp";
@@ -4549,7 +4549,8 @@ type VaultSecretsConfig = (VaultSecretsConfigBase & {
 });
 type AwsSecretsConfig = {
 	type: "aws";
-	webhookUrl: string;
+	/** Env: ION_AWS_URL */
+	url: string;
 };
 type AzureAuthMethod = "client_secret" | "workload_identity" | "managed_identity";
 type AzureSecretsConfig = {
@@ -4571,7 +4572,7 @@ type AzureSecretsConfig = {
 	authMethod?: AzureAuthMethod;
 	/**
 	* Azure Entra directory tenant id (GUID), used for OAuth2 token exchange.
-	* Env: ION_AZURE_TENANT_ID
+	* Env: ION_AZURE_ENTRA_TENANT_ID
 	*/
 	entraTenantId?: string;
 	/**
@@ -4586,7 +4587,7 @@ type AzureSecretsConfig = {
 	clientSecret?: string;
 	/**
 	* Path to the projected federated token file (AKS Workload Identity).
-	* Env: ION_AZURE_FEDERATED_TOKEN_FILE or AZURE_FEDERATED_TOKEN_FILE
+	* Env: ION_AZURE_FEDERATED_TOKEN_FILE
 	*/
 	federatedTokenFile?: string;
 	/**
@@ -4601,19 +4602,13 @@ type AzureSecretsConfig = {
 	*/
 	imdsApiVersion?: string;
 	/**
-	* Key Vault URL, e.g. https://myvault.vault.azure.net
-	* Env: ION_AZURE_KEY_VAULT_URL
-	*/
-	vaultUrl?: string;
-	/**
-	* Alternative to vaultUrl. If provided, vaultUrl is derived as:
-	* https://${vaultName}.vault.azure.net
-	* Env: ION_AZURE_KEY_VAULT_NAME
+	* Key Vault `https` URL, e.g. https://myvault.vault.azure.net. Required to build the source.
+	* Env: ION_AZURE_URL
 	*/
-	vaultName?: string;
+	url?: string;
 	/**
 	* Key Vault API version.
-	* Env: ION_AZURE_KEY_VAULT_API_VERSION
+	* Env: ION_AZURE_API_VERSION
 	* Default: 7.4
 	*/
 	apiVersion?: string;
@@ -4682,22 +4677,26 @@ type ConfigSourceEnv = {
 	ION_AZURE_SCOPE?: string;
 	ION_AZURE_SECRET_NAME_PREFIX?: string;
 	ION_AZURE_AUTH_METHOD?: AzureAuthMethod;
-	ION_AZURE_TENANT_ID?: string;
+	ION_AZURE_ENTRA_TENANT_ID?: string;
 	ION_AZURE_CLIENT_ID?: string;
 	ION_AZURE_CLIENT_SECRET?: string;
 	ION_AZURE_FEDERATED_TOKEN_FILE?: string;
 	ION_AZURE_MANAGED_IDENTITY_CLIENT_ID?: string;
 	ION_AZURE_IMDS_API_VERSION?: string;
 	ION_AZURE_PATH?: string;
-	ION_AZURE_VAULT_URL?: string;
-	ION_AZURE_VAULT_NAME?: string;
+	ION_AZURE_URL?: string;
 	ION_AZURE_TTL?: string;
-	ION_AWS_WEBHOOK_URL?: string;
+	ION_AWS_URL?: string;
 	ION_AWS_TTL?: string;
 	ION_GCP_TTL?: string;
 	/** Complete upstream ConfigLocator for `ION_CONFIG_TYPE=mirror`, using existing names after this prefix. */
 	[key: `ION_FROM_${string}`]: string | undefined;
 };
+/**
+* At most one transport: `vaultUrl` (`http(s)` or `ws(s)`) or `vaultLfv*`. A tenant-record locator
+* with neither is path-only and names a document in the App's own vault (`configFromSource`); a
+* root/bootstrap locator must select a transport.
+*/
 type VaultConfigLocator = {
 	type: "vault";
 	vaultUrl?: string;
@@ -4720,7 +4719,7 @@ type VaultConfigLocator = {
 };
 type AwsConfigLocator = {
 	type: "aws";
-	awsWebhookUrl: string;
+	awsUrl: string;
 	awsTtl?: number;
 };
 type AzureConfigLocator = {
@@ -4733,8 +4732,7 @@ type AzureConfigLocator = {
 	azureManagedIdentityClientId?: string;
 	azureImdsApiVersion?: string;
 	azurePath?: string;
-	azureVaultUrl?: string;
-	azureVaultName?: string;
+	azureUrl?: string;
 	azureApiVersion?: string;
 	azureScope?: string;
 	azureSecretNamePrefix?: string;
@@ -7216,4 +7214,12 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+/**
+* Explain why a serialized vault `ConfigLocator` selects an invalid transport, or return `undefined`
+* when it is valid. `vaultUrl` selects HTTP (`http(s)`) or WebSocket (`ws(s)`); any `vaultLfv*` field
+* selects LFV; the two are mutually exclusive. A locator with neither is path-only: `vaultPath` names
+* a document in the App's own vault, and `vaultTtl` is that read's polling fallback. Otherwise
+* `vaultTtl` is HTTP-only.
+*/
+declare function vaultConfigLocatorTransportError(locator: Record<string, unknown>): string | undefined;
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, ActionRequiredInput, ActionRequiredPlan, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{Q,Ve,p,v,x,E,c,n,ee,q,d,Be,te,y,t,h,P,ne,Me,je,Ge,Ne,K,z,w,W,re,V,r,f,He,B,Je,Ye,Xe,oe,ie,G,ae,Se,ke,g,F,Le,H,_,O,J,$e,D,qe,Ze,Qe,M,o,S,k,et,tt,de,le,j,Ce,we,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,pe,nt,me,fe,b,a,rt,N,_e,Oe,u,ge,st,ot,i,R,T,it,at,Ke,X,l,m,e,ye,ct,ze,ut,A,C,dt,lt,Z,pt,I,L,De,mt}from"./shared/core-xm7tmw7a.js";var $t="0.0.24-beta.20261013.29";class Tt extends n{constructor(s,U){let Y=U.kind==="connection"||U.kind==="timeout"||U.kind==="not_found";super(s,{cause:U.cause,status:Y?503:500,upstreamStatus:U.status});this.name="ConfigSourceError";this.kind=U.kind,this.recoverable=U.recoverable,this.code=U.code,this.path=U.path,this.sourceType=U.sourceType}}function Ut(s){return s instanceof Tt}function Wt(s){let U=s?.trim();if(!U)return;try{let Y=new URL(U),se=Y.pathname.replace(/\/+$/g,"");return`${Y.protocol}//${Y.host}${se}`}catch{return}}function At(s,U="ion.config.source"){if(!s)return{};let Y={[`${U}.type`]:s.type};if(s.transport)Y[`${U}.transport`]=s.transport;if(s.url)Y[`${U}.url`]=s.url;if(s.path)Y[`${U}.path`]=s.path;if(s.from)Object.assign(Y,At(s.from,`${U}.from`));return Y}var Ft=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function ht(s){if(s===null||typeof s!=="object")return s;let U={};for(let[Y,se]of Object.entries(s)){if(Ft.includes(Y)||Y==="validators"||Y==="setStores")continue;U[Y]=se!==null&&typeof se==="object"&&!Array.isArray(se)&&Object.getPrototypeOf(se)===Object.prototype?ht(se):se}return U}function qt(s){return ht(s)}function Ct(s,U){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${U} must be an object.`);return s}function gt(s,U){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${U} must be a valid timestamp string.`);return s}function It(s,U,Y){if(!Array.isArray(s)||!Y.allowEmpty&&s.length===0)throw Error(`${U} keys must be ${Y.allowEmpty?"an":"a non-empty"} array.`);let se=new Set;return s.map((ue,ce)=>{let Te=Ct(ue,`${U} keys[${ce}]`);if(typeof Te.id!=="string"||Te.id.length===0)throw Error(`${U} keys[${ce}].id must be a non-empty string.`);if(se.has(Te.id))throw Error(`${U} contains duplicate key id "${Te.id}".`);if(se.add(Te.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Te.state)))throw Error(`${U} keys[${ce}].state is invalid.`);if(Te.value!==void 0&&(typeof Te.value!=="string"||Te.value.length===0))throw Error(`${U} keys[${ce}].value must be a non-empty string when present.`);let be=Te.meta===void 0?void 0:Ct(Te.meta,`${U} keys[${ce}].meta`);return{id:Te.id,state:Te.state,...Te.value===void 0?{}:{value:Te.value},...Te.notBefore===void 0?{}:{notBefore:gt(Te.notBefore,`${U} keys[${ce}].notBefore`)},...Te.notAfter===void 0?{}:{notAfter:gt(Te.notAfter,`${U} keys[${ce}].notAfter`)},...Te.createdAt===void 0?{}:{createdAt:gt(Te.createdAt,`${U} keys[${ce}].createdAt`)},...Te.activatedAt===void 0?{}:{activatedAt:gt(Te.activatedAt,`${U} keys[${ce}].activatedAt`)},...Te.deprecatedAt===void 0?{}:{deprecatedAt:gt(Te.deprecatedAt,`${U} keys[${ce}].deprecatedAt`)},...Te.rotatedAt===void 0?{}:{rotatedAt:gt(Te.rotatedAt,`${U} keys[${ce}].rotatedAt`)},...Te.revokedAt===void 0?{}:{revokedAt:gt(Te.revokedAt,`${U} keys[${ce}].revokedAt`)},...be?{meta:{...be}}:{}}})}function zt(s,U,Y){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${Y} slots must be an array.`);let se=new Set,ue=s.map((ce,Te)=>{if(ce===null)return null;if(typeof ce!=="string"||ce.length===0)throw Error(`${Y} slots[${Te}] must be a non-empty key id or null.`);if(se.has(ce))throw Error(`${Y} slots contain duplicate key id "${ce}".`);se.add(ce);let be=U.find((he)=>he.id===ce);if(!be)throw Error(`${Y} slot key "${ce}" is not present in keys.`);if(be.state!=="active")throw Error(`${Y} slot key "${ce}" must have state "active".`);if(!be.value)throw Error(`${Y} slot key "${ce}" must include a value.`);return ce});if(U.length===0&&ue.some((ce)=>ce!==null))throw Error(`${Y} slots must be omitted or all-null when keys is empty.`);return ue}function Vt(s){let Y=Ct(s,"KMS pool");if(Y.kind!=="kms")throw Error('KMS pool kind must be "kms".');let se=It(Y.keys,"KMS pool",{allowEmpty:!0}),ue=zt(Y.slots,se,"KMS pool");return ue?{kind:"kms",slots:ue,keys:se}:{kind:"kms",keys:se}}function jt(s){let Y=Ct(s,"KMS pool control document");if(Y.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:It(Y.keys,"KMS pool control document",{allowEmpty:!0})}}var Bt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function xt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function ft(s){let U=xt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(U)?U:JSON.stringify(U)}function Gt(s){return xt(s).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function bt(s,U,Y){if(Y==null)return;if(Y instanceof Error){let se=ee(Y);if(se){for(let[ue,ce]of Object.entries(se))if(ce!=null)s.push(`${ue}=${ft(ce)}`);return}if(s.push(`${U}.name=${ft(Y.name)}`),s.push(`${U}.message=${ft(Y.message)}`),Y.stack)s.push(`${U}.stack=${ft(Y.stack)}`);return}s.push(`${U}=${ft(Y)}`)}function yt(s,U,Y=[],se=new Date){let ue=Gt(U instanceof Error?U.message:U??""),ce=[];for(let[Te,be]of Y.entries()){if(be&&typeof be==="object"&&!Array.isArray(be)&&!(be instanceof Error)&&Object.getPrototypeOf(be)===Object.prototype){for(let[he,Fe]of Object.entries(be))bt(ce,he,Fe);continue}bt(ce,`param.${Te}`,be)}return[se.toISOString(),Bt[s],ue,...ce].filter(Boolean).join(" ")}var Pt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Ht=Pt,Yt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Jt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Xt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},Zt={trace:()=>{},debug:(s,...U)=>globalThis.console.debug(yt("debug",s,U)),info:(s,...U)=>globalThis.console.info(yt("info",s,U)),warn:(s,...U)=>globalThis.console.warn(yt("warn",s,U)),error:(s,...U)=>globalThis.console.error(yt("error",s,U))};function Qt(s,U){if(typeof U!=="number"||U<=0)return s;return new Promise((Y,se)=>{let ue=setTimeout(()=>{se(Error(`Authz catalog entry did not become ready within ${U}ms`))},U);s.then(()=>{clearTimeout(ue),Y()},(ce)=>{clearTimeout(ue),se(ce)})})}function eo(s,U){let Y=!1,se,ue=U.then(()=>{Y=!0},(Te)=>{Y=!1,se=Te}),ce=s;return Object.defineProperty(ce,"ready",{enumerable:!1,configurable:!0,value:(Te)=>Qt(ue.then(()=>{if(!Y)throw se}),Te)}),Object.defineProperty(ce,"isReady",{enumerable:!1,configurable:!0,value:()=>Y}),ce}var kt=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:Oe,yaml:"application/yaml",toml:"application/toml",xml:_e});function Rt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let U=s.mimeType?.trim()||kt[s.format],Y=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>Y})}function to(s="jsonc"){return{format:s,mimeType:kt[s],typeId:s}}class Ot extends n{constructor(s,U){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${U.mimeType}" (${U.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=U}}var oo=Rt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var vt={beforeTenantSegments:["ui"]},wt={beforeTenantSegments:["api"]};function _t(s){return(s??[]).map((U)=>U.trim()).filter(Boolean)}function Kt(s){let U=s.trim();if(!U)return"/";let Y=U.replace(/\\/g,"/").replace(/\/+/g,"/");return Y.startsWith("/")?Y:`/${Y}`}function Dt(s){return Kt(s).split("/").filter(Boolean)}function St(s){return{beforeTenantSegments:_t(s?.beforeTenantSegments),afterTenantSegments:_t(s?.afterTenantSegments)}}function Mt(s){if(s?.type==="host")return{type:"host",baseDomain:Et(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:St(s?.ui??vt),api:St(s?.api??wt)}}function Et(s){let U=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!U)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return U}function ro(s,U){let Y=s.trim().replace(/\.$/,"").toLowerCase(),se=Et(U);if(!Y.endsWith(`.${se}`))return null;let ue=Y.slice(0,-(se.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function no(s,U){let Y=St(U),se=Y.beforeTenantSegments??[],ue=Y.afterTenantSegments??[],ce=Dt(s),Te=se.length+1+ue.length;if(ce.length<Te)return null;for(let We=0;We<se.length;We++)if(ce[We]!==se[We])return null;let be=se.length,he=ce[be];if(!he)return null;for(let We=0;We<ue.length;We++)if(ce[be+1+We]!==ue[We])return null;let Fe=ce.slice(be+1+ue.length);return{id:decodeURIComponent(he),restSegments:Fe,restPath:Fe.length>0?`/${Fe.join("/")}`:"/"}}function Lt(s,U="/",Y){let se=St(Y),ue=se.beforeTenantSegments??[],ce=se.afterTenantSegments??[],Te=Dt(U),be=[...ue,encodeURIComponent(s),...ce,...Te];return be.length>0?`/${be.join("/")}`:"/"}function so(s,U="/",Y,se="ui"){let ue=Mt(Y);if(ue.type==="host"||ue.type==="selector")return Kt(U);return Lt(s,U,ue[se])}function io(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ue={...Y},ce=["iss","sub"];for(let he of ce)if(he in Y){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if("aud"in Y&&Y.aud!==void 0){let he=Y.aud;if(typeof he!=="string"&&!Array.isArray(he))se.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(he)&&!he.every((Fe)=>typeof Fe==="string"))se.push({message:"aud array must contain only strings",path:["aud"]})}let Te=["jti","scope"];for(let he of Te)if(he in Y&&Y[he]!==void 0){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}let be=["exp","iat"];for(let he of be)if(he in Y){if(typeof Y[he]!=="number")se.push({message:`${he} must be a number`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if(se.length>0)return{issues:se};return{value:ue}}}}}function ao(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ue={};if("access_token"in Y)if(typeof Y.access_token==="string")ue.access_token=Y.access_token;else se.push({message:"access_token must be a string",path:["access_token"]});else se.push({message:"access_token is required",path:["access_token"]});if("token_type"in Y)if(typeof Y.token_type==="string")ue.token_type=Y.token_type;else se.push({message:"token_type must be a string",path:["token_type"]});else se.push({message:"token_type is required",path:["token_type"]});if("scope"in Y)if(typeof Y.scope==="string"||Y.scope===void 0)ue.scope=Y.scope;else se.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Y)if(typeof Y.refresh_token==="string"||Y.refresh_token===void 0)ue.refresh_token=Y.refresh_token;else se.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Y)if(typeof Y.expires==="string"||Y.expires===void 0)ue.expires=Y.expires;else se.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Y)if(typeof Y.expires_in==="number"||Y.expires_in===void 0)ue.expires_in=Y.expires_in;else se.push({message:"expires_in must be a number",path:["expires_in"]});if(se.length>0)return{issues:se};return{value:ue}}}}}function po(s){let U=new Uint8Array(s);return crypto.getRandomValues(U),U}function co(s){let U="",Y=po(s);for(let se=0;se<s;se++){let ue=Y[se]%32;U+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return U}function mo(s,U){let Y="";for(let se=U;se>0;se--){let ue=s%32;Y="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+Y,s=Math.floor(s/32)}return Y}function uo(s){let U=Date.now(),Y=mo(U,10),se=co(16);return`${s??""}${Y}${se}`}export{u as ACCEPT_JSON,ot as ACCEPT_OCTET_STREAM,ge as ACCEPT_SCIM,st as ACCEPT_XML,Me as AssignmentPolicyError,te as CANONICAL_RISK_LEVELS,T as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,at as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,it as CONTENT_TYPE_XML,Tt as ConfigSourceError,Ye as DEFAULT_DISCOVERED_COOKIE_MAX,Xe as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Je as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,kt as DEFAULT_SECRET_MIME_TYPES,wt as DEFAULT_TENANT_API_NAMESPACE,vt as DEFAULT_TENANT_UI_NAMESPACE,oe as DISCOVERED_COOKIE_PREFIX,He as DISPLAY_COOKIE_SUFFIX,B as DISPLAY_COOKIE_VERSION,$e as ECID_SCHEME,j as ENTRA_ION_EXTENSION_URN,D as EcidFormatError,N as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,Pe as ION_AUTHZ_OAA_SYNC,xe as ION_CAPABILITIEZ_READ,Ee as ION_CIAM_MAGIC_LINK_CREATE,nt as ION_ENDPOINT_PERMISSIONS,ve as ION_IAM_ACCESS_REQUESTS_WRITE,Ie as ION_IAM_CUSTOMERS_WRITE,Re as ION_IAM_GROUPS_WRITE,Ce as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Ae as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,pe as ION_SDK_PERMISSIONS,Ue as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,x as KNOWN_BASE_CUSTOMER_KEYS,v as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,E as KNOWN_WORKLOAD_KEYS,Oe as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,rt as SCIM_MEDIA_TYPE,Ot as SecretContentTypeMismatchError,I as StoreConflictError,_e as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,M as assertEcid,ne as assertRequiredSubjectType,P as assertValidSubjectTypeScoping,Lt as buildTenantPath,so as buildTenantUrl,z as catalogEntityStore,Z as claimsToUser,_ as compareDisplayExpiryDesc,At as configSourceOriginLogFields,Ve as configTrustedClientGrants,c as customAttributes,le as customerResourceSchema,Yt as debugLogger,Le as decodeDisplayCookie,pt as decodeUser,C as deepEqualPlain,Se as defaultDisplayUser,Ht as defaultLogger,to as defaultSecretContentType,Ne as defineCatalog,Rt as defineSecretType,re as deprecateRetiredCodeCatalogRows,Wt as describeOriginUrl,J as discoveredProfileCookieName,F as encodeDisplayCookie,ee as errorLogAttributes,Ze as formatEcid,yt as formatLogLine,uo as generateULID,K as getCodeCatalogEntity,tt as groupResourceSchema,b as idTokenClaimsSchema,Jt as infoLogger,je as isCodeCatalog,De as isConfigLocator,Ut as isConfigSourceError,qe as isEcid,Ke as isJsonResponse,L as isStoreConflictError,io as jwtAssertionClaimsSchema,q as list,d as listGenerator,ro as matchTenantHost,no as matchTenantPath,Be as matchesListFilter,W as materializeCodeCatalogEntity,w as mergeCodeCatalogEntity,ct as mergeConfig,e as must,Et as normalizeTenantBaseDomain,St as normalizeTenantPathNamespace,Mt as normalizeTenantRoutingStrategy,me as oidcCallbackSchema,Qe as parseEcid,ut as parseJsonc,jt as parseKmsPoolControlDocument,Vt as parseKmsPoolDocument,Zt as prettyLogger,O as profileCookieName,g as projectDisplayUser,H as readDisplayCookies,l as readJsonResponse,eo as readyCatalogEntry,oo as remoteConfigSecretType,G as resolveDiscoveredCookieMax,ae as resolveDiscoveredCookieTtlSeconds,ie as resolveDisplayCookieMax,ke as sanitizeDisplayUser,qt as serializeConfig,Pt as silentLogger,dt as stableConfigHash,ze as stripJsonComments,mt as tmIntegrationState,Ge as toCodeCatalog,fe as tokenResponseSchema,A as trimTrailingSlash,Q as trustedClientPermissionsForPrincipal,X as unexpectedBodySummary,V as unionCatalogRead,et as userSchema,ye as validationFailureResponse,$t as version,lt as waitOn,Xt as warnLogger,m as withValidate,de as workloadResourceSchema,ao as workloadTokenResponseSchema};
+import{Q,We,p,v,x,E,c,n,ee,q,d,Be,te,y,t,h,P,ne,Me,je,Ge,Ne,K,z,w,V,re,W,r,f,He,B,Je,Ye,Xe,oe,ie,G,ae,Se,ke,g,F,Le,H,_,O,J,$e,D,qe,Ze,Qe,M,o,S,k,et,tt,de,le,j,Ce,we,Re,Ae,Ie,ve,xe,Ee,Pe,Ue,pe,nt,me,fe,b,a,rt,N,_e,Oe,u,ge,st,ot,i,R,T,it,at,Ke,X,l,m,e,ye,ct,ze,ut,A,C,dt,lt,Z,pt,I,L,De,mt}from"./shared/core-kjeaqpzk.js";var Ft="0.0.24-beta.20261013.30";class Tt extends n{constructor(s,U){let Y=U.kind==="connection"||U.kind==="timeout"||U.kind==="not_found";super(s,{cause:U.cause,status:Y?503:500,upstreamStatus:U.status});this.name="ConfigSourceError";this.kind=U.kind,this.recoverable=U.recoverable,this.code=U.code,this.path=U.path,this.sourceType=U.sourceType}}function Wt(s){return s instanceof Tt}function qt(s){let U=s?.trim();if(!U)return;try{let Y=new URL(U),se=Y.pathname.replace(/\/+$/g,"");return`${Y.protocol}//${Y.host}${se}`}catch{return}}function ht(s,U="ion.config.source"){if(!s)return{};let Y={[`${U}.type`]:s.type};if(s.transport)Y[`${U}.transport`]=s.transport;if(s.url)Y[`${U}.url`]=s.url;if(s.path)Y[`${U}.path`]=s.path;if(s.from)Object.assign(Y,ht(s.from,`${U}.from`));return Y}var Vt=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore","store"];function At(s){if(s===null||typeof s!=="object")return s;let U={};for(let[Y,se]of Object.entries(s)){if(Vt.includes(Y)||Y==="validators"||Y==="setStores")continue;U[Y]=se!==null&&typeof se==="object"&&!Array.isArray(se)&&Object.getPrototypeOf(se)===Object.prototype?At(se):se}return U}function jt(s){return At(s)}function Ct(s,U){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${U} must be an object.`);return s}function gt(s,U){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${U} must be a valid timestamp string.`);return s}function It(s,U,Y){if(!Array.isArray(s)||!Y.allowEmpty&&s.length===0)throw Error(`${U} keys must be ${Y.allowEmpty?"an":"a non-empty"} array.`);let se=new Set;return s.map((ce,ue)=>{let Te=Ct(ce,`${U} keys[${ue}]`);if(typeof Te.id!=="string"||Te.id.length===0)throw Error(`${U} keys[${ue}].id must be a non-empty string.`);if(se.has(Te.id))throw Error(`${U} contains duplicate key id "${Te.id}".`);if(se.add(Te.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Te.state)))throw Error(`${U} keys[${ue}].state is invalid.`);if(Te.value!==void 0&&(typeof Te.value!=="string"||Te.value.length===0))throw Error(`${U} keys[${ue}].value must be a non-empty string when present.`);let be=Te.meta===void 0?void 0:Ct(Te.meta,`${U} keys[${ue}].meta`);return{id:Te.id,state:Te.state,...Te.value===void 0?{}:{value:Te.value},...Te.notBefore===void 0?{}:{notBefore:gt(Te.notBefore,`${U} keys[${ue}].notBefore`)},...Te.notAfter===void 0?{}:{notAfter:gt(Te.notAfter,`${U} keys[${ue}].notAfter`)},...Te.createdAt===void 0?{}:{createdAt:gt(Te.createdAt,`${U} keys[${ue}].createdAt`)},...Te.activatedAt===void 0?{}:{activatedAt:gt(Te.activatedAt,`${U} keys[${ue}].activatedAt`)},...Te.deprecatedAt===void 0?{}:{deprecatedAt:gt(Te.deprecatedAt,`${U} keys[${ue}].deprecatedAt`)},...Te.rotatedAt===void 0?{}:{rotatedAt:gt(Te.rotatedAt,`${U} keys[${ue}].rotatedAt`)},...Te.revokedAt===void 0?{}:{revokedAt:gt(Te.revokedAt,`${U} keys[${ue}].revokedAt`)},...be?{meta:{...be}}:{}}})}function zt(s,U,Y){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${Y} slots must be an array.`);let se=new Set,ce=s.map((ue,Te)=>{if(ue===null)return null;if(typeof ue!=="string"||ue.length===0)throw Error(`${Y} slots[${Te}] must be a non-empty key id or null.`);if(se.has(ue))throw Error(`${Y} slots contain duplicate key id "${ue}".`);se.add(ue);let be=U.find((he)=>he.id===ue);if(!be)throw Error(`${Y} slot key "${ue}" is not present in keys.`);if(be.state!=="active")throw Error(`${Y} slot key "${ue}" must have state "active".`);if(!be.value)throw Error(`${Y} slot key "${ue}" must include a value.`);return ue});if(U.length===0&&ce.some((ue)=>ue!==null))throw Error(`${Y} slots must be omitted or all-null when keys is empty.`);return ce}function Bt(s){let Y=Ct(s,"KMS pool");if(Y.kind!=="kms")throw Error('KMS pool kind must be "kms".');let se=It(Y.keys,"KMS pool",{allowEmpty:!0}),ce=zt(Y.slots,se,"KMS pool");return ce?{kind:"kms",slots:ce,keys:se}:{kind:"kms",keys:se}}function Ht(s){let Y=Ct(s,"KMS pool control document");if(Y.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:It(Y.keys,"KMS pool control document",{allowEmpty:!0})}}var Gt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function xt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function ft(s){let U=xt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(U)?U:JSON.stringify(U)}function Yt(s){return xt(s).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function bt(s,U,Y){if(Y==null)return;if(Y instanceof Error){let se=ee(Y);if(se){for(let[ce,ue]of Object.entries(se))if(ue!=null)s.push(`${ce}=${ft(ue)}`);return}if(s.push(`${U}.name=${ft(Y.name)}`),s.push(`${U}.message=${ft(Y.message)}`),Y.stack)s.push(`${U}.stack=${ft(Y.stack)}`);return}s.push(`${U}=${ft(Y)}`)}function yt(s,U,Y=[],se=new Date){let ce=Yt(U instanceof Error?U.message:U??""),ue=[];for(let[Te,be]of Y.entries()){if(be&&typeof be==="object"&&!Array.isArray(be)&&!(be instanceof Error)&&Object.getPrototypeOf(be)===Object.prototype){for(let[he,Ve]of Object.entries(be))bt(ue,he,Ve);continue}bt(ue,`param.${Te}`,be)}return[se.toISOString(),Gt[s],ce,...ue].filter(Boolean).join(" ")}var vt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},Jt=vt,Xt={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},Zt={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},Qt={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},eo={trace:()=>{},debug:(s,...U)=>globalThis.console.debug(yt("debug",s,U)),info:(s,...U)=>globalThis.console.info(yt("info",s,U)),warn:(s,...U)=>globalThis.console.warn(yt("warn",s,U)),error:(s,...U)=>globalThis.console.error(yt("error",s,U))};function to(s,U){if(typeof U!=="number"||U<=0)return s;return new Promise((Y,se)=>{let ce=setTimeout(()=>{se(Error(`Authz catalog entry did not become ready within ${U}ms`))},U);s.then(()=>{clearTimeout(ce),Y()},(ue)=>{clearTimeout(ce),se(ue)})})}function oo(s,U){let Y=!1,se,ce=U.then(()=>{Y=!0},(Te)=>{Y=!1,se=Te}),ue=s;return Object.defineProperty(ue,"ready",{enumerable:!1,configurable:!0,value:(Te)=>to(ce.then(()=>{if(!Y)throw se}),Te)}),Object.defineProperty(ue,"isReady",{enumerable:!1,configurable:!0,value:()=>Y}),ue}var Rt=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:Oe,yaml:"application/yaml",toml:"application/toml",xml:_e});function kt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let U=s.mimeType?.trim()||Rt[s.format],Y=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>Y})}function ro(s="jsonc"){return{format:s,mimeType:Rt[s],typeId:s}}class Pt extends n{constructor(s,U){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${U.mimeType}" (${U.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=U}}var no=kt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var _t={beforeTenantSegments:["ui"]},wt={beforeTenantSegments:["api"]};function Ot(s){return(s??[]).map((U)=>U.trim()).filter(Boolean)}function Kt(s){let U=s.trim();if(!U)return"/";let Y=U.replace(/\\/g,"/").replace(/\/+/g,"/");return Y.startsWith("/")?Y:`/${Y}`}function Lt(s){return Kt(s).split("/").filter(Boolean)}function St(s){return{beforeTenantSegments:Ot(s?.beforeTenantSegments),afterTenantSegments:Ot(s?.afterTenantSegments)}}function Dt(s){if(s?.type==="host")return{type:"host",baseDomain:Et(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:St(s?.ui??_t),api:St(s?.api??wt)}}function Et(s){let U=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!U)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return U}function so(s,U){let Y=s.trim().replace(/\.$/,"").toLowerCase(),se=Et(U);if(!Y.endsWith(`.${se}`))return null;let ce=Y.slice(0,-(se.length+1));if(!ce||ce.includes("."))return null;return{id:ce}}function io(s,U){let Y=St(U),se=Y.beforeTenantSegments??[],ce=Y.afterTenantSegments??[],ue=Lt(s),Te=se.length+1+ce.length;if(ue.length<Te)return null;for(let Fe=0;Fe<se.length;Fe++)if(ue[Fe]!==se[Fe])return null;let be=se.length,he=ue[be];if(!he)return null;for(let Fe=0;Fe<ce.length;Fe++)if(ue[be+1+Fe]!==ce[Fe])return null;let Ve=ue.slice(be+1+ce.length);return{id:decodeURIComponent(he),restSegments:Ve,restPath:Ve.length>0?`/${Ve.join("/")}`:"/"}}function Mt(s,U="/",Y){let se=St(Y),ce=se.beforeTenantSegments??[],ue=se.afterTenantSegments??[],Te=Lt(U),be=[...ce,encodeURIComponent(s),...ue,...Te];return be.length>0?`/${be.join("/")}`:"/"}function ao(s,U="/",Y,se="ui"){let ce=Dt(Y);if(ce.type==="host"||ce.type==="selector")return Kt(U);return Mt(s,U,ce[se])}function po(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ce={...Y},ue=["iss","sub"];for(let he of ue)if(he in Y){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if("aud"in Y&&Y.aud!==void 0){let he=Y.aud;if(typeof he!=="string"&&!Array.isArray(he))se.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(he)&&!he.every((Ve)=>typeof Ve==="string"))se.push({message:"aud array must contain only strings",path:["aud"]})}let Te=["jti","scope"];for(let he of Te)if(he in Y&&Y[he]!==void 0){if(typeof Y[he]!=="string")se.push({message:`${he} must be a string`,path:[he]})}let be=["exp","iat"];for(let he of be)if(he in Y){if(typeof Y[he]!=="number")se.push({message:`${he} must be a number`,path:[he]})}else se.push({message:`${he} is required`,path:[he]});if(se.length>0)return{issues:se};return{value:ce}}}}}function co(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let Y=U,se=[],ce={};if("access_token"in Y)if(typeof Y.access_token==="string")ce.access_token=Y.access_token;else se.push({message:"access_token must be a string",path:["access_token"]});else se.push({message:"access_token is required",path:["access_token"]});if("token_type"in Y)if(typeof Y.token_type==="string")ce.token_type=Y.token_type;else se.push({message:"token_type must be a string",path:["token_type"]});else se.push({message:"token_type is required",path:["token_type"]});if("scope"in Y)if(typeof Y.scope==="string"||Y.scope===void 0)ce.scope=Y.scope;else se.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Y)if(typeof Y.refresh_token==="string"||Y.refresh_token===void 0)ce.refresh_token=Y.refresh_token;else se.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Y)if(typeof Y.expires==="string"||Y.expires===void 0)ce.expires=Y.expires;else se.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Y)if(typeof Y.expires_in==="number"||Y.expires_in===void 0)ce.expires_in=Y.expires_in;else se.push({message:"expires_in must be a number",path:["expires_in"]});if(se.length>0)return{issues:se};return{value:ce}}}}}function uo(s){let U=new Uint8Array(s);return crypto.getRandomValues(U),U}function mo(s){let U="",Y=uo(s);for(let se=0;se<s;se++){let ce=Y[se]%32;U+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ce)}return U}function lo(s,U){let Y="";for(let se=U;se>0;se--){let ce=s%32;Y="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ce)+Y,s=Math.floor(s/32)}return Y}function go(s){let U=Date.now(),Y=lo(U,10),se=mo(16);return`${s??""}${Y}${se}`}var Nt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function $t(s){return typeof s==="string"&&s.trim().length>0}function fo(s){let U=$t(s.vaultUrl)?s.vaultUrl:void 0,Y=Object.keys(s).some((ce)=>ce.startsWith("vaultLfv")&&s[ce]!==void 0);if(U&&Y)return"vaultUrl and vaultLfv* are mutually exclusive";if(!U&&!Y)return;if(Y){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(Nt.some((ce)=>!$t(s[ce])))return`LFV requires ${Nt.join(", ")}`;return}let se;try{se=new URL(U).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(se==="http:"||se==="https:")return;if(se==="ws:"||se==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{u as ACCEPT_JSON,ot as ACCEPT_OCTET_STREAM,ge as ACCEPT_SCIM,st as ACCEPT_XML,Me as AssignmentPolicyError,te as CANONICAL_RISK_LEVELS,T as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,at as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,it as CONTENT_TYPE_XML,Tt as ConfigSourceError,Ye as DEFAULT_DISCOVERED_COOKIE_MAX,Xe as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Je as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,Rt as DEFAULT_SECRET_MIME_TYPES,wt as DEFAULT_TENANT_API_NAMESPACE,_t as DEFAULT_TENANT_UI_NAMESPACE,oe as DISCOVERED_COOKIE_PREFIX,He as DISPLAY_COOKIE_SUFFIX,B as DISPLAY_COOKIE_VERSION,$e as ECID_SCHEME,j as ENTRA_ION_EXTENSION_URN,D as EcidFormatError,N as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,Pe as ION_AUTHZ_OAA_SYNC,xe as ION_CAPABILITIEZ_READ,Ee as ION_CIAM_MAGIC_LINK_CREATE,nt as ION_ENDPOINT_PERMISSIONS,ve as ION_IAM_ACCESS_REQUESTS_WRITE,Ie as ION_IAM_CUSTOMERS_WRITE,Re as ION_IAM_GROUPS_WRITE,Ce as ION_IAM_READ,we as ION_IAM_USERS_WRITE,Ae as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,pe as ION_SDK_PERMISSIONS,Ue as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,x as KNOWN_BASE_CUSTOMER_KEYS,v as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,E as KNOWN_WORKLOAD_KEYS,Oe as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,rt as SCIM_MEDIA_TYPE,Pt as SecretContentTypeMismatchError,I as StoreConflictError,_e as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,M as assertEcid,ne as assertRequiredSubjectType,P as assertValidSubjectTypeScoping,Mt as buildTenantPath,ao as buildTenantUrl,z as catalogEntityStore,Z as claimsToUser,_ as compareDisplayExpiryDesc,ht as configSourceOriginLogFields,We as configTrustedClientGrants,c as customAttributes,le as customerResourceSchema,Xt as debugLogger,Le as decodeDisplayCookie,pt as decodeUser,C as deepEqualPlain,Se as defaultDisplayUser,Jt as defaultLogger,ro as defaultSecretContentType,Ne as defineCatalog,kt as defineSecretType,re as deprecateRetiredCodeCatalogRows,qt as describeOriginUrl,J as discoveredProfileCookieName,F as encodeDisplayCookie,ee as errorLogAttributes,Ze as formatEcid,yt as formatLogLine,go as generateULID,K as getCodeCatalogEntity,tt as groupResourceSchema,b as idTokenClaimsSchema,Zt as infoLogger,je as isCodeCatalog,De as isConfigLocator,Wt as isConfigSourceError,qe as isEcid,Ke as isJsonResponse,L as isStoreConflictError,po as jwtAssertionClaimsSchema,q as list,d as listGenerator,so as matchTenantHost,io as matchTenantPath,Be as matchesListFilter,V as materializeCodeCatalogEntity,w as mergeCodeCatalogEntity,ct as mergeConfig,e as must,Et as normalizeTenantBaseDomain,St as normalizeTenantPathNamespace,Dt as normalizeTenantRoutingStrategy,me as oidcCallbackSchema,Qe as parseEcid,ut as parseJsonc,Ht as parseKmsPoolControlDocument,Bt as parseKmsPoolDocument,eo as prettyLogger,O as profileCookieName,g as projectDisplayUser,H as readDisplayCookies,l as readJsonResponse,oo as readyCatalogEntry,no as remoteConfigSecretType,G as resolveDiscoveredCookieMax,ae as resolveDiscoveredCookieTtlSeconds,ie as resolveDisplayCookieMax,ke as sanitizeDisplayUser,jt as serializeConfig,vt as silentLogger,dt as stableConfigHash,ze as stripJsonComments,mt as tmIntegrationState,Ge as toCodeCatalog,fe as tokenResponseSchema,A as trimTrailingSlash,Q as trustedClientPermissionsForPrincipal,X as unexpectedBodySummary,W as unionCatalogRead,et as userSchema,ye as validationFailureResponse,fo as vaultConfigLocatorTransportError,Ft as version,lt as waitOn,Qt as warnLogger,m as withValidate,de as workloadResourceSchema,co as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -4193,7 +4193,7 @@ type SecretsSourceConfig = DevSecretsConfig | GcpSecretsConfig | VaultSecretsCon
 type SecretsModuleConfig = Record<string, SecretsSourceConfig>;
 type DevSecretsConfig = {
 	type: "dev";
-	ioniteUrl: string;
+	url: string;
 };
 type GcpSecretsConfig = {
 	type: "gcp";
@@ -4281,7 +4281,8 @@ type VaultSecretsConfig = (VaultSecretsConfigBase & {
 });
 type AwsSecretsConfig = {
 	type: "aws";
-	webhookUrl: string;
+	/** Env: ION_AWS_URL */
+	url: string;
 };
 type AzureAuthMethod = "client_secret" | "workload_identity" | "managed_identity";
 type AzureSecretsConfig = {
@@ -4303,7 +4304,7 @@ type AzureSecretsConfig = {
 	authMethod?: AzureAuthMethod;
 	/**
 	* Azure Entra directory tenant id (GUID), used for OAuth2 token exchange.
-	* Env: ION_AZURE_TENANT_ID
+	* Env: ION_AZURE_ENTRA_TENANT_ID
 	*/
 	entraTenantId?: string;
 	/**
@@ -4318,7 +4319,7 @@ type AzureSecretsConfig = {
 	clientSecret?: string;
 	/**
 	* Path to the projected federated token file (AKS Workload Identity).
-	* Env: ION_AZURE_FEDERATED_TOKEN_FILE or AZURE_FEDERATED_TOKEN_FILE
+	* Env: ION_AZURE_FEDERATED_TOKEN_FILE
 	*/
 	federatedTokenFile?: string;
 	/**
@@ -4333,19 +4334,13 @@ type AzureSecretsConfig = {
 	*/
 	imdsApiVersion?: string;
 	/**
-	* Key Vault URL, e.g. https://myvault.vault.azure.net
-	* Env: ION_AZURE_KEY_VAULT_URL
-	*/
-	vaultUrl?: string;
-	/**
-	* Alternative to vaultUrl. If provided, vaultUrl is derived as:
-	* https://${vaultName}.vault.azure.net
-	* Env: ION_AZURE_KEY_VAULT_NAME
+	* Key Vault `https` URL, e.g. https://myvault.vault.azure.net. Required to build the source.
+	* Env: ION_AZURE_URL
 	*/
-	vaultName?: string;
+	url?: string;
 	/**
 	* Key Vault API version.
-	* Env: ION_AZURE_KEY_VAULT_API_VERSION
+	* Env: ION_AZURE_API_VERSION
 	* Default: 7.4
 	*/
 	apiVersion?: string;
@@ -4369,6 +4364,11 @@ type AzureSecretsConfig = {
 	*/
 	ttl?: number;
 };
+/**
+* At most one transport: `vaultUrl` (`http(s)` or `ws(s)`) or `vaultLfv*`. A tenant-record locator
+* with neither is path-only and names a document in the App's own vault (`configFromSource`); a
+* root/bootstrap locator must select a transport.
+*/
 type VaultConfigLocator = {
 	type: "vault";
 	vaultUrl?: string;
@@ -4391,7 +4391,7 @@ type VaultConfigLocator = {
 };
 type AwsConfigLocator = {
 	type: "aws";
-	awsWebhookUrl: string;
+	awsUrl: string;
 	awsTtl?: number;
 };
 type AzureConfigLocator = {
@@ -4404,8 +4404,7 @@ type AzureConfigLocator = {
 	azureManagedIdentityClientId?: string;
 	azureImdsApiVersion?: string;
 	azurePath?: string;
-	azureVaultUrl?: string;
-	azureVaultName?: string;
+	azureUrl?: string;
 	azureApiVersion?: string;
 	azureScope?: string;
 	azureSecretNamePrefix?: string;