@ionite/core 0.0.24-beta.20261024.46 → 0.0.24-beta.20261024.48

package/dist/index.d.ts

@@ -5667,8 +5667,12 @@ type IoniteBase = {
 	describe(): IoniteDescription;
 	/** Most recent RemoteConfig application outcome (last applied time and last error, if any). */
 	configStatus: ConfigApplyStatus;
-	/** Release config subscriptions and background resources. */
-	close(): void;
+	/**
+	* Release config subscriptions and background resources. Resolves once every module's teardown
+	* has settled, including the OpenTelemetry flush, so a shutdown path can await it before exiting.
+	* Idempotent: repeat calls return the same promise. Never rejects; teardown failures are logged.
+	*/
+	close(): Promise<void>;
 	/**
 	* Replace runtime store instances. Resolves once the stores have been applied; when config has
 	* already loaded this re-runs the (possibly async) `beforeChange` hook, so callers that depend on
@@ -5913,7 +5917,7 @@ type TmIoniteConfig = {
 	url: string;
 	/** Required `iss` claim on ionite-signed staged-request handles and ionite workload tokens. */
 	issuer: string;
-	/** ionite JWKS endpoint used to verify signed staged-request handles. */
+	/** ionite JWKS endpoint used to verify signed staged-request handles and TM access tokens. */
 	jwksUri: string;
 	/** Required `aud` claim binding an ionite-staged request to this App. */
 	audience: string;
@@ -5922,6 +5926,13 @@ type TmIoniteConfig = {
 	/** Named outgoing workload client that authenticates every `ion.tm.sendWebhook` call to ionite. */
 	webhookClient?: string;
 };
+/**
+* JOSE `typ` header every staged-request handle MUST carry (RFC 8725 §3.11). Handles and TM access
+* tokens share one issuer, key, and audience (`tm.ionite`), and handles ride a browser URL, so this
+* header is the only thing keeping a handle from being accepted as a TM bearer: `ion.tm` requires it
+* on handles and rejects it on every workload-authenticated route.
+*/
+declare const TM_STAGED_HANDLE_TYP = "ion-tm-handle+jwt";
 type RemoteTmConfig = {
 	enabled: true;
 	ionite: TmIoniteConfig;
@@ -7439,4 +7450,4 @@ declare function generateULID(prefix?: string): string;
 * `vaultTtl` is HTTP-only.
 */
 declare function vaultConfigLocatorTransportError(locator: Record<string, unknown>): string | undefined;
-export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, AccessSubject, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseDelegate, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, Delegate, DelegateContext, DelegateDescription, DelegateOwner, DelegateOwnerType, DelegateStore, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkDelegateConfig, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundDelegatesConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_DELEGATES_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_DELEGATE_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteDelegateConfig, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimDelegate, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, accessSubjectId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, delegateResourceSchema, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };
+export { ACCEPT_JSON, ACCEPT_OCTET_STREAM, ACCEPT_SCIM, ACCEPT_XML, AccessAssignmentStore, AccessCatalogStore, AccessChange, AccessCheckReason, AccessCheckResult, AccessCheckTarget, AccessIndex, AccessMutationResult, AccessMutationStatus, AccessProvenance, AccessRef, AccessRequestCreate, AccessRequestInput, AccessRequestLookup, AccessRequestResult, AccessRequestsDestination, AccessStatus, AccessSubject, Address, ApplicationValidators, AssignmentPolicyError, AuthenticatedPrincipal, AuthenticatedUser, Authz, AuthzConfig, AuthzDecision, AuthzDescription, AuthzEntityBase, AuthzOaaConfig, AuthzOaaPrincipalConfig, AuthzScimGroupExtension, AuthzScimGroupType, AwsConfigLocator, AwsSecretsConfig, AzureAuthMethod, AzureConfigLocator, AzureSecretsConfig, BaseCustomer, BaseDelegate, BaseTenant, BaseUser, BaseWorkloadIdentity, CANONICAL_RISK_LEVELS, CIAM, CIAMConfig, CIAMConfigFromCode, CIAMConfigFromCodeInput, CIAMProviderBranding, CIAMProviderColors, CIAMProviderConfig, CIAMProviderDescriptor, CIAMProviderType, CIAMValidators, CONTENT_TYPE_FORM, CONTENT_TYPE_JSON, CONTENT_TYPE_OCTET_STREAM, CONTENT_TYPE_SCIM, CONTENT_TYPE_XML, CacheConfig, CachedWorkloadToken, CapabilitiezManifest, CapabilityEndpointUrls, CapabilityKey, CapabilityState, CatalogChange, CatalogChangeKind, CatalogChangeListener, CatalogEntityKind, ChangeListener, CiamDescription, CiamProviderDescription, ClaimsAsEntitlements, ClaimsAsEntitlementsDescription, ClientCredentialsWorkloadConfig, CodeCatalog, CodeCatalogInput, CodeCatalogNamespace, ConfigApplyStatus, ConfigChangeCallback, ConfigChangeOptions, ConfigChangeResult, ConfigErrorKind, ConfigExportEnvelope, ConfigLocator, ConfigSource, ConfigSourceEnv, ConfigSourceError, ConfigSourceErrorInit, ConfigSourceOrigin, ConfigSourceResolver, ConfigSourceType, ConfigSubscriptionOptions, ConnectRequestContext, CookieDescription, CreateGroupOptions, CreateTenantRequest, CreateUserOptions, Customer, CustomerStore, CustomerStoreOptions, DEFAULT_DISCOVERED_COOKIE_MAX, DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS, DEFAULT_DISPLAY_COOKIE_MAX, DEFAULT_RISK_LEVEL, DEFAULT_SECRET_MIME_TYPES, DEFAULT_TENANT_API_NAMESPACE, DEFAULT_TENANT_UI_NAMESPACE, DISCOVERED_COOKIE_PREFIX, DISPLAY_COOKIE_SUFFIX, DISPLAY_COOKIE_VERSION, Delegate, DelegateContext, DelegateDescription, DelegateOwner, DelegateOwnerType, DelegateStore, DerivedEntitlement, DescribedSecretsSource, DestinationReference, DevSecretsConfig, DiscoveredDisplayCookieConfig, DisplayAuthType, DisplayCookieConfig, DisplayCookieEnvelope, DisplayIdentity, DisplayUser, ECID_SCHEME, ENTRA_ION_EXTENSION_URN, EcidFormatError, EffectiveEdge, EgressChannelOutcome, EgressOutcome, Email, EndpointOperation, EndpointPermission, EnterpriseExtension, Entitlement, EntitlementType, EntityStore, EnvironmentType, FORM_MEDIA_TYPE, FrameworkConfig, FrameworkConfigInput, FrameworkDelegateConfig, FrameworkLfvConfig, FrameworkOtelConfig, FrameworkSecretsModuleConfig, FrameworkSecretsSourceConfig, FrameworkStores, FrameworkTmConfig, FrameworkWorkloadConfig, FrameworkWorkloadConfigFromCode, FrameworkWorkloadIncomingOutgoing, GcpConfigLocator, GcpSecretsConfig, GrantRequest, Group, GroupMember, GroupResource, GroupsInboundHandlerConfig, IAM, IAMAccessRequestsConfig, IAMAppRegistry, IAMAppValidators, IAMConfig, IAMConfigFromCode, IAMDiscoveryConfig, IAMDiscoveryContext, IAMDiscoveryHandlerConfig, IAMEndpointFlag, IAMGroupsInbound, IAMGroupsOutbound, IAMHandlerConfig, IAMInboundCustomersConfig, IAMInboundDelegatesConfig, IAMInboundPrincipalContext, IAMInboundUserContext, IAMInboundUsersConfig, IAMInboundWorkloadsConfig, IAMPrincipalsInbound, IAMProviderConfig, IAMProviderType, IAMUsersInbound, IAMValidators, ION_AUTHZ_GROUP_SCHEMA, ION_AUTHZ_OAA_SYNC, ION_CAPABILITIEZ_READ, ION_CIAM_MAGIC_LINK_CREATE, ION_ENDPOINT_PERMISSIONS, ION_IAM_ACCESS_REQUESTS_WRITE, ION_IAM_CUSTOMERS_WRITE, ION_IAM_DELEGATES_WRITE, ION_IAM_GROUPS_WRITE, ION_IAM_READ, ION_IAM_USERS_WRITE, ION_IAM_WORKLOADS_WRITE, ION_SCIM_CUSTOMER_SCHEMA, ION_SCIM_DELEGATE_SCHEMA, ION_SCIM_USER_EXTENSION_URN, ION_SCIM_WORKLOAD_SCHEMA, ION_SDK_PERMISSIONS, ION_TENANT_MANAGE, IamAssignmentPolicy, IamDeltaEmitter, IamDeltaMode, IamDeltaReconcileInput, IamDeltaReconcileResult, IamDeltaResourceType, IamDescription, IamPrincipalDescription, IamPrincipalKind, IamPrincipalKindFlag, IdTokenClaims, IdentityResolution, InMemoryTenantStoreOptions, InboundEntitlementDecision, InboundEntitlementRequest, InferSecretType, Ionite, IoniteBase, IoniteDescription, IoniteError, IoniteErrorContext, IoniteErrorJson, IoniteErrorOptions, IoniteLogAttributes, IoniteUserExtension, IoniteValidators, JSON_MEDIA_TYPE, JWTAssertionClaims, JwtBearerWorkloadConfig, KNOWN_BASE_CUSTOMER_KEYS, KNOWN_BASE_USER_KEYS, KNOWN_ENTITLEMENT_KEYS, KNOWN_WORKLOAD_KEYS, Kms, KmsAddKeysRequest, KmsAddKeysResult, KmsAllocationPolicy, KmsAllocationStrategy, KmsConfig, KmsDescription, KmsIssuedKey, KmsIssuerEvent, KmsIssuerEventListener, KmsIssuerEventName, KmsKey, KmsKeyState, KmsParkDisposition, KmsParkReport, KmsParkRequest, KmsParkResult, KmsPool, KmsPoolConfig, KmsPoolControlDocument, KmsPoolDescription, KmsPoolDocument, KmsPoolIssuer, KmsPoolListener, KmsPoolSlot, KmsRevokeKeyRequest, KmsRevokeKeyResult, LfvActionAcceptedResponse, LfvActionName, LfvActionRequestBase, LfvCallbackEnvelope, LfvCallbackHeaders, LfvCallbackKind, LfvCallbackTransport, LfvEd25519PrivateJwk, LfvEd25519PublicJwk, LfvErrorCode, LfvErrorResponse, LfvJwks, LfvOtpRequest, LfvOtpResponse, ListFilter, ListOptions, ListResult, Logger, MagicLink, MagicLinkStore, MetaData, MirrorConfigLocator, ModifiableFrameworkConfig, ModuleDescription, ModuleDescriptionBase, ModuleName, ModuleReadiness, ModuleReadinessState, Name, NoReserved, OCTET_STREAM_MEDIA_TYPE, OaaAccessChangeBatchItem, OaaAccessTargetType, OaaClient, OaaDescription, OaaPrincipalPopulation, OaaSyncInput, OaaSyncOptions, OaaSyncResult, OidcCallbackParams, Otel, OtelAttributeValue, OtelAttributes, OtelConfig, OtelConsoleMode, OtelDescription, OtelLevels, OtelLogLevel, OtelLogRecord, OtelMetricsSignalConfig, OtelOAuthClientCredentialsConfig, OtelProtocol, OtelProviderType, OtelSignalConfig, OtelSignalDescription, OtelSignalName, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, ParsedEcid, Permission, PhoneNumber, Photo, PrincipalInboundHandlerConfig, ReactiveHandle, ReadJsonResponseOptions, ReadinessReport, ReadyAccessCatalogEntry, ReadyzEndpointConfig, ReconcileReport, RecordTenantConsentInput, RegisterIAMAppError, RegisterIAMAppPayload, RegisterIAMAppResult, RegisterSSOAppError, RegisterSSOAppPayload, RegisterSSOAppResult, RemoteConfig, RemoteConfigLoadErrorKind, RemoteConfigRetryContext, RemoteConfigRetryHook, RemoteConfigRetryOptions, RemoteDelegateConfig, RemoteTmConfig, RequireReadyResult, ResolvedRoute, ResolvedVaultLfvSecretsConfig, Resource, ResourceChange, ResourceChangeListener, ResourceProvider, RiskLevel, Role, RouteFilterResult, RouteModule, RoutingOptions, SCIM_MEDIA_TYPE, SSO, SSOAppRegistry, SSOAppValidators, SSOConfig, SSOConfigFromCode, SSOHandlerConfig, SSOValidators, ScimAuthenticationScheme, ScimCustomer, ScimDelegate, ScimError, Group2 as ScimGroup, ScimListResponse, ScimMutationSummary, ScimPatchErrorType, ScimPatchOperation, ScimResourceType, ScimResourceTypeSchemaExtension, ScimResult, Role2 as ScimRole, ScimSchemaAttributeDefinition, ScimSchemaDefinition, ScimServiceProviderConfig, User as ScimUser, ScimWorkload, Secret, SecretContentType, SecretContentTypeMismatchError, SecretEvent, SecretEventListener, SecretEventName, SecretFormat, SecretHandle, SecretLifecycleRequest, SecretRequestSeverity, SecretTypeDescriptor, SecretTypeInput, SecretTypeRegistryEntry, Secrets, SecretsDescription, SecretsModuleConfig, SecretsOperationOptions, SecretsSource, SecretsSourceConfig, SecretsSourceDescription, SecretsSourceMap, SecretsSourceOrigin, SecretsSourceType, SecretsSubscriptionOptions, SecretsTransport, SecretsValidators, SecretsWriteOptions, ServerOnlyWorkloadConfig, Session, SessionStore, SetTenantIntegrationOptions, SsoDescription, StagedIntegration, StandardSchemaWithValidate, StateCookie, StoreConflictError, StoreConflictKind, SubjectRef, SubjectScope, SubjectType, SubjectTypeScoping, SubscriptionMode, TM_STAGED_HANDLE_TYP, TenantCreatePlan, TenantDirectory, TenantDirectoryIdentity, TenantHostMatch, TenantHostRoutingStrategy, TenantIntegration, TenantIntegrationStatus, TenantIntegrationView, TenantIonCache, TenantManagement, TenantPathMatch, TenantPathNamespace, TenantPathRoutingStrategy, TenantResponse, TenantRoutingStrategy, TenantSelectorRoutingStrategy, TenantStatus, TenantStore, TenantValidators, TenantWebhookPayload, TmDescription, TmIoniteConfig, TokenResponse, TokenValidationResult, TrustedIdp, TrustedProvisioningClient, UnexpectedBodySummary, UpdateTenantRequest, UserEndpointPolicy, UserStore, UserStoreOptions, UsersInboundHandlerConfig, ValidateResult, VaultAuthHeader, VaultConfigLocator, VaultLfvSecretsConfig, VaultSecretsConfig, VaultWorkloadAuthConfig, WorkforceUser, Workload, WorkloadClient, WorkloadClientDescription, WorkloadConfig, WorkloadConfigMap, WorkloadDescription, WorkloadGetToken, WorkloadIdentity, WorkloadIdentityStore, WorkloadIncomingOutgoing, WorkloadPrincipal, WorkloadTokenResponse, WorkloadTokenStore, WorkloadTrustedIdpDescription, WorkloadValidators, X509Certificate, XML_MEDIA_TYPE, accessRefId, accessRootId, accessSubjectId, assertEcid, assertRequiredSubjectType, assertValidSubjectTypeScoping, buildTenantPath, buildTenantUrl, catalogEntityStore, claimsToUser, compareDisplayExpiryDesc, configSourceOriginLogFields, configTrustedClientGrants, customAttributes, customerResourceSchema, debugLogger, decodeDisplayCookie, decodeUser, deepEqualPlain, defaultDisplayUser, defaultLogger, defaultSecretContentType, defineCatalog, defineSecretType, delegateResourceSchema, deprecateRetiredCodeCatalogRows, describeOriginUrl, discoveredProfileCookieName, encodeDisplayCookie, errorLogAttributes, formatEcid, formatLogLine, generateULID, getCodeCatalogEntity, groupResourceSchema, idTokenClaimsSchema, infoLogger, isCodeCatalog, isConfigLocator, isConfigSourceError, isEcid, isJsonResponse, isStoreConflictError, jwtAssertionClaimsSchema, list, listGenerator, matchTenantHost, matchTenantPath, matchesListFilter, materializeCodeCatalogEntity, mergeCodeCatalogEntity, mergeConfig, must, normalizeTenantBaseDomain, normalizeTenantPathNamespace, normalizeTenantRoutingStrategy, oidcCallbackSchema, parseEcid, parseJsonc, parseKmsPoolControlDocument, parseKmsPoolDocument, prettyLogger, profileCookieName, projectDisplayUser, readDisplayCookies, readJsonResponse, readyCatalogEntry, remoteConfigSecretType, resolveDiscoveredCookieMax, resolveDiscoveredCookieTtlSeconds, resolveDisplayCookieMax, sanitizeDisplayUser, serializeConfig, silentLogger, stableConfigHash, stripJsonComments, tmIntegrationState, toCodeCatalog, tokenResponseSchema, trimTrailingSlash, trustedClientPermissionsForPrincipal, unexpectedBodySummary, unionCatalogRead, userSchema, validationFailureResponse, vaultConfigLocatorTransportError, version, waitOn, warnLogger, withValidate, workloadResourceSchema, workloadTokenResponseSchema };

package/dist/index.js

@@ -1,2 +1,2 @@
-import{ee,He,p,x,E,P,c,n,te,K,u,Fe,ne,y,t,Je,h,U,re,Le,$e,Ye,qe,W,V,A,z,se,B,r,f,Ze,G,Qe,et,tt,ie,ae,H,ce,be,Te,g,F,Ke,J,_,O,Y,We,M,Ve,nt,rt,j,o,S,k,b,st,ot,le,pe,me,N,Ae,Re,Ie,ve,xe,Ee,Pe,Ue,De,_e,Oe,fe,it,ge,ye,T,a,at,L,Me,je,l,he,ct,ut,i,R,w,dt,lt,ze,Z,d,m,e,Se,pt,Be,mt,I,C,ft,gt,Q,yt,v,q,Ne,ht}from"./shared/core-ec2wrd0t.js";var Vt="0.0.24-beta.20261024.46";class kt extends n{constructor(s,D){let X=D.kind==="connection"||D.kind==="timeout"||D.kind==="not_found";super(s,{cause:D.cause,status:X?503:500,upstreamStatus:D.status});this.name="ConfigSourceError";this.kind=D.kind,this.recoverable=D.recoverable,this.code=D.code,this.path=D.path,this.sourceType=D.sourceType}}function zt(s){return s instanceof kt}function Bt(s){let D=s?.trim();if(!D)return;try{let X=new URL(D),oe=X.pathname.replace(/\/+$/g,"");return`${X.protocol}//${X.host}${oe}`}catch{return}}function xt(s,D="ion.config.source"){if(!s)return{};let X={[`${D}.type`]:s.type};if(s.transport)X[`${D}.transport`]=s.transport;if(s.url)X[`${D}.url`]=s.url;if(s.path)X[`${D}.path`]=s.path;if(s.from)Object.assign(X,xt(s.from,`${D}.from`));return X}var Gt=["sessionStore","userStore","customerStore","delegateStore","accessStore","tokenStore","magicLinkStore","store"];function _t(s){if(s===null||typeof s!=="object")return s;let D={};for(let[X,oe]of Object.entries(s)){if(Gt.includes(X)||X==="validators"||X==="setStores")continue;D[X]=oe!==null&&typeof oe==="object"&&!Array.isArray(oe)&&Object.getPrototypeOf(oe)===Object.prototype?_t(oe):oe}return D}function Ht(s){return _t(s)}function Rt(s,D){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${D} must be an object.`);return s}function St(s,D){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${D} must be a valid timestamp string.`);return s}function vt(s,D,X){if(!Array.isArray(s)||!X.allowEmpty&&s.length===0)throw Error(`${D} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let oe=new Set;return s.map((ue,de)=>{let Ce=Rt(ue,`${D} keys[${de}]`);if(typeof Ce.id!=="string"||Ce.id.length===0)throw Error(`${D} keys[${de}].id must be a non-empty string.`);if(oe.has(Ce.id))throw Error(`${D} contains duplicate key id "${Ce.id}".`);if(oe.add(Ce.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Ce.state)))throw Error(`${D} keys[${de}].state is invalid.`);if(Ce.value!==void 0&&(typeof Ce.value!=="string"||Ce.value.length===0))throw Error(`${D} keys[${de}].value must be a non-empty string when present.`);let we=Ce.meta===void 0?void 0:Rt(Ce.meta,`${D} keys[${de}].meta`);return{id:Ce.id,state:Ce.state,...Ce.value===void 0?{}:{value:Ce.value},...Ce.notBefore===void 0?{}:{notBefore:St(Ce.notBefore,`${D} keys[${de}].notBefore`)},...Ce.notAfter===void 0?{}:{notAfter:St(Ce.notAfter,`${D} keys[${de}].notAfter`)},...Ce.createdAt===void 0?{}:{createdAt:St(Ce.createdAt,`${D} keys[${de}].createdAt`)},...Ce.activatedAt===void 0?{}:{activatedAt:St(Ce.activatedAt,`${D} keys[${de}].activatedAt`)},...Ce.deprecatedAt===void 0?{}:{deprecatedAt:St(Ce.deprecatedAt,`${D} keys[${de}].deprecatedAt`)},...Ce.rotatedAt===void 0?{}:{rotatedAt:St(Ce.rotatedAt,`${D} keys[${de}].rotatedAt`)},...Ce.revokedAt===void 0?{}:{revokedAt:St(Ce.revokedAt,`${D} keys[${de}].revokedAt`)},...we?{meta:{...we}}:{}}})}function Yt(s,D,X){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${X} slots must be an array.`);let oe=new Set,ue=s.map((de,Ce)=>{if(de===null)return null;if(typeof de!=="string"||de.length===0)throw Error(`${X} slots[${Ce}] must be a non-empty key id or null.`);if(oe.has(de))throw Error(`${X} slots contain duplicate key id "${de}".`);oe.add(de);let we=D.find((ke)=>ke.id===de);if(!we)throw Error(`${X} slot key "${de}" is not present in keys.`);if(we.state!=="active")throw Error(`${X} slot key "${de}" must have state "active".`);if(!we.value)throw Error(`${X} slot key "${de}" must include a value.`);return de});if(D.length===0&&ue.some((de)=>de!==null))throw Error(`${X} slots must be omitted or all-null when keys is empty.`);return ue}function Jt(s){let X=Rt(s,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let oe=vt(X.keys,"KMS pool",{allowEmpty:!0}),ue=Yt(X.slots,oe,"KMS pool");return ue?{kind:"kms",slots:ue,keys:oe}:{kind:"kms",keys:oe}}function Xt(s){let X=Rt(s,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:vt(X.keys,"KMS pool control document",{allowEmpty:!0})}}var Zt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function Ot(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function Ct(s){let D=Ot(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(D)?D:JSON.stringify(D)}function Qt(s){return Ot(s).replaceAll("\r","\\r").replaceAll(`
-`,"\\n")}function Pt(s,D,X){if(X==null)return;if(X instanceof Error){let oe=te(X);if(oe){for(let[ue,de]of Object.entries(oe))if(de!=null)s.push(`${ue}=${Ct(de)}`);return}if(s.push(`${D}.name=${Ct(X.name)}`),s.push(`${D}.message=${Ct(X.message)}`),X.stack)s.push(`${D}.stack=${Ct(X.stack)}`);return}s.push(`${D}=${Ct(X)}`)}function Tt(s,D,X=[],oe=new Date){let ue=Qt(D instanceof Error?D.message:D??""),de=[];for(let[Ce,we]of X.entries()){if(we&&typeof we==="object"&&!Array.isArray(we)&&!(we instanceof Error)&&Object.getPrototypeOf(we)===Object.prototype){for(let[ke,Xe]of Object.entries(we))Pt(de,ke,Xe);continue}Pt(de,`param.${Ce}`,we)}return[oe.toISOString(),Zt[s],ue,...de].filter(Boolean).join(" ")}var wt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},eo=wt,to={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},oo={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},ro={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},no={trace:()=>{},debug:(s,...D)=>globalThis.console.debug(Tt("debug",s,D)),info:(s,...D)=>globalThis.console.info(Tt("info",s,D)),warn:(s,...D)=>globalThis.console.warn(Tt("warn",s,D)),error:(s,...D)=>globalThis.console.error(Tt("error",s,D))};function so(s,D){if(typeof D!=="number"||D<=0)return s;return new Promise((X,oe)=>{let ue=setTimeout(()=>{oe(Error(`Authz catalog entry did not become ready within ${D}ms`))},D);s.then(()=>{clearTimeout(ue),X()},(de)=>{clearTimeout(ue),oe(de)})})}function io(s,D){let X=!1,oe,ue=D.then(()=>{X=!0},(Ce)=>{X=!1,oe=Ce}),de=s;return Object.defineProperty(de,"ready",{enumerable:!1,configurable:!0,value:(Ce)=>so(ue.then(()=>{if(!X)throw oe}),Ce)}),Object.defineProperty(de,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),de}var At=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:je,yaml:"application/yaml",toml:"application/toml",xml:Me});function It(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let D=s.mimeType?.trim()||At[s.format],X=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:D,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>X})}function ao(s="jsonc"){return{format:s,mimeType:At[s],typeId:s}}class Dt extends n{constructor(s,D){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${D.mimeType}" (${D.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=D}}var po=It({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Lt={beforeTenantSegments:["ui"]},Mt={beforeTenantSegments:["api"]};function Kt(s){return(s??[]).map((D)=>D.trim()).filter(Boolean)}function Nt(s){let D=s.trim();if(!D)return"/";let X=D.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function $t(s){return Nt(s).split("/").filter(Boolean)}function Et(s){return{beforeTenantSegments:Kt(s?.beforeTenantSegments),afterTenantSegments:Kt(s?.afterTenantSegments)}}function Ut(s){if(s?.type==="host")return{type:"host",baseDomain:bt(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:Et(s?.ui??Lt),api:Et(s?.api??Mt)}}function bt(s){let D=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!D)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return D}function co(s,D){let X=s.trim().replace(/\.$/,"").toLowerCase(),oe=bt(D);if(!X.endsWith(`.${oe}`))return null;let ue=X.slice(0,-(oe.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function mo(s,D){let X=Et(D),oe=X.beforeTenantSegments??[],ue=X.afterTenantSegments??[],de=$t(s),Ce=oe.length+1+ue.length;if(de.length<Ce)return null;for(let Ge=0;Ge<oe.length;Ge++)if(de[Ge]!==oe[Ge])return null;let we=oe.length,ke=de[we];if(!ke)return null;for(let Ge=0;Ge<ue.length;Ge++)if(de[we+1+Ge]!==ue[Ge])return null;let Xe=de.slice(we+1+ue.length);return{id:decodeURIComponent(ke),restSegments:Xe,restPath:Xe.length>0?`/${Xe.join("/")}`:"/"}}function Ft(s,D="/",X){let oe=Et(X),ue=oe.beforeTenantSegments??[],de=oe.afterTenantSegments??[],Ce=$t(D),we=[...ue,encodeURIComponent(s),...de,...Ce];return we.length>0?`/${we.join("/")}`:"/"}function uo(s,D="/",X,oe="ui"){let ue=Ut(X);if(ue.type==="host"||ue.type==="selector")return Nt(D);return Ft(s,D,ue[oe])}function lo(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={...X},de=["iss","sub"];for(let ke of de)if(ke in X){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if("aud"in X&&X.aud!==void 0){let ke=X.aud;if(typeof ke!=="string"&&!Array.isArray(ke))oe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ke)&&!ke.every((Xe)=>typeof Xe==="string"))oe.push({message:"aud array must contain only strings",path:["aud"]})}let Ce=["jti","scope"];for(let ke of Ce)if(ke in X&&X[ke]!==void 0){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}let we=["exp","iat"];for(let ke of we)if(ke in X){if(typeof X[ke]!=="number")oe.push({message:`${ke} must be a number`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function go(s){return{"~standard":{version:1,vendor:s,validate:(D)=>{if(typeof D!=="object"||D===null)return{issues:[{message:"Expected an object"}]};let X=D,oe=[],ue={};if("access_token"in X)if(typeof X.access_token==="string")ue.access_token=X.access_token;else oe.push({message:"access_token must be a string",path:["access_token"]});else oe.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")ue.token_type=X.token_type;else oe.push({message:"token_type must be a string",path:["token_type"]});else oe.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)ue.scope=X.scope;else oe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)ue.refresh_token=X.refresh_token;else oe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)ue.expires=X.expires;else oe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)ue.expires_in=X.expires_in;else oe.push({message:"expires_in must be a number",path:["expires_in"]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function fo(s){let D=new Uint8Array(s);return crypto.getRandomValues(D),D}function yo(s){let D="",X=fo(s);for(let oe=0;oe<s;oe++){let ue=X[oe]%32;D+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return D}function So(s,D){let X="";for(let oe=D;oe>0;oe--){let ue=s%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+X,s=Math.floor(s/32)}return X}function Co(s){let D=Date.now(),X=So(D,10),oe=yo(16);return`${s??""}${X}${oe}`}var Wt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function qt(s){return typeof s==="string"&&s.trim().length>0}function To(s){let D=qt(s.vaultUrl)?s.vaultUrl:void 0,X=Object.keys(s).some((ue)=>ue.startsWith("vaultLfv")&&s[ue]!==void 0);if(D&&X)return"vaultUrl and vaultLfv* are mutually exclusive";if(!D&&!X)return;if(X){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(Wt.some((ue)=>!qt(s[ue])))return`LFV requires ${Wt.join(", ")}`;return}let oe;try{oe=new URL(D).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(oe==="http:"||oe==="https:")return;if(oe==="ws:"||oe==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{l as ACCEPT_JSON,ut as ACCEPT_OCTET_STREAM,he as ACCEPT_SCIM,ct as ACCEPT_XML,Le as AssignmentPolicyError,ne as CANONICAL_RISK_LEVELS,w as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,lt as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,dt as CONTENT_TYPE_XML,kt as ConfigSourceError,et as DEFAULT_DISCOVERED_COOKIE_MAX,tt as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Qe as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,At as DEFAULT_SECRET_MIME_TYPES,Mt as DEFAULT_TENANT_API_NAMESPACE,Lt as DEFAULT_TENANT_UI_NAMESPACE,ie as DISCOVERED_COOKIE_PREFIX,Ze as DISPLAY_COOKIE_SUFFIX,G as DISPLAY_COOKIE_VERSION,We as ECID_SCHEME,N as ENTRA_ION_EXTENSION_URN,M as EcidFormatError,L as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,_e as ION_AUTHZ_OAA_SYNC,Ue as ION_CAPABILITIEZ_READ,De as ION_CIAM_MAGIC_LINK_CREATE,it as ION_ENDPOINT_PERMISSIONS,Pe as ION_IAM_ACCESS_REQUESTS_WRITE,xe as ION_IAM_CUSTOMERS_WRITE,Ee as ION_IAM_DELEGATES_WRITE,Ie as ION_IAM_GROUPS_WRITE,Ae as ION_IAM_READ,Re as ION_IAM_USERS_WRITE,ve as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,b as ION_SCIM_DELEGATE_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,fe as ION_SDK_PERMISSIONS,Oe as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,E as KNOWN_BASE_CUSTOMER_KEYS,x as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,P as KNOWN_WORKLOAD_KEYS,je as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,at as SCIM_MEDIA_TYPE,Dt as SecretContentTypeMismatchError,v as StoreConflictError,Me as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,Je as accessSubjectId,j as assertEcid,re as assertRequiredSubjectType,U as assertValidSubjectTypeScoping,Ft as buildTenantPath,uo as buildTenantUrl,V as catalogEntityStore,Q as claimsToUser,_ as compareDisplayExpiryDesc,xt as configSourceOriginLogFields,He as configTrustedClientGrants,c as customAttributes,pe as customerResourceSchema,to as debugLogger,Ke as decodeDisplayCookie,yt as decodeUser,C as deepEqualPlain,be as defaultDisplayUser,eo as defaultLogger,ao as defaultSecretContentType,qe as defineCatalog,It as defineSecretType,me as delegateResourceSchema,se as deprecateRetiredCodeCatalogRows,Bt as describeOriginUrl,Y as discoveredProfileCookieName,F as encodeDisplayCookie,te as errorLogAttributes,nt as formatEcid,Tt as formatLogLine,Co as generateULID,W as getCodeCatalogEntity,ot as groupResourceSchema,T as idTokenClaimsSchema,oo as infoLogger,$e as isCodeCatalog,Ne as isConfigLocator,zt as isConfigSourceError,Ve as isEcid,ze as isJsonResponse,q as isStoreConflictError,lo as jwtAssertionClaimsSchema,K as list,u as listGenerator,co as matchTenantHost,mo as matchTenantPath,Fe as matchesListFilter,z as materializeCodeCatalogEntity,A as mergeCodeCatalogEntity,pt as mergeConfig,e as must,bt as normalizeTenantBaseDomain,Et as normalizeTenantPathNamespace,Ut as normalizeTenantRoutingStrategy,ge as oidcCallbackSchema,rt as parseEcid,mt as parseJsonc,Xt as parseKmsPoolControlDocument,Jt as parseKmsPoolDocument,no as prettyLogger,O as profileCookieName,g as projectDisplayUser,J as readDisplayCookies,d as readJsonResponse,io as readyCatalogEntry,po as remoteConfigSecretType,H as resolveDiscoveredCookieMax,ce as resolveDiscoveredCookieTtlSeconds,ae as resolveDisplayCookieMax,Te as sanitizeDisplayUser,Ht as serializeConfig,wt as silentLogger,ft as stableConfigHash,Be as stripJsonComments,ht as tmIntegrationState,Ye as toCodeCatalog,ye as tokenResponseSchema,I as trimTrailingSlash,ee as trustedClientPermissionsForPrincipal,Z as unexpectedBodySummary,B as unionCatalogRead,st as userSchema,Se as validationFailureResponse,To as vaultConfigLocatorTransportError,Vt as version,gt as waitOn,ro as warnLogger,m as withValidate,le as workloadResourceSchema,go as workloadTokenResponseSchema};
+import{ee,He,p,x,E,P,c,n,te,K,u,Fe,ne,y,t,Je,h,D,re,Le,$e,Ye,qe,W,V,A,z,se,B,r,f,Ze,G,Qe,et,tt,ie,ae,H,ce,be,Te,g,F,Ke,J,_,O,Y,We,M,Ve,nt,rt,j,o,S,k,b,st,ot,le,pe,me,N,Ae,Re,Ie,ve,xe,Ee,Pe,De,Ue,_e,Oe,fe,it,ge,ye,T,a,at,L,Me,je,l,he,ct,ut,i,R,w,dt,lt,ze,Z,d,m,e,Se,pt,Be,mt,I,C,ft,gt,Q,yt,v,q,Ne,ht,St}from"./shared/core-0nsg7t0c.js";var zt="0.0.24-beta.20261024.48";class At extends n{constructor(s,U){let X=U.kind==="connection"||U.kind==="timeout"||U.kind==="not_found";super(s,{cause:U.cause,status:X?503:500,upstreamStatus:U.status});this.name="ConfigSourceError";this.kind=U.kind,this.recoverable=U.recoverable,this.code=U.code,this.path=U.path,this.sourceType=U.sourceType}}function Bt(s){return s instanceof At}function Gt(s){let U=s?.trim();if(!U)return;try{let X=new URL(U),oe=X.pathname.replace(/\/+$/g,"");return`${X.protocol}//${X.host}${oe}`}catch{return}}function _t(s,U="ion.config.source"){if(!s)return{};let X={[`${U}.type`]:s.type};if(s.transport)X[`${U}.transport`]=s.transport;if(s.url)X[`${U}.url`]=s.url;if(s.path)X[`${U}.path`]=s.path;if(s.from)Object.assign(X,_t(s.from,`${U}.from`));return X}var Ht=["sessionStore","userStore","customerStore","delegateStore","accessStore","tokenStore","magicLinkStore","store"];function Pt(s){if(s===null||typeof s!=="object")return s;let U={};for(let[X,oe]of Object.entries(s)){if(Ht.includes(X)||X==="validators"||X==="setStores")continue;U[X]=oe!==null&&typeof oe==="object"&&!Array.isArray(oe)&&Object.getPrototypeOf(oe)===Object.prototype?Pt(oe):oe}return U}function Yt(s){return Pt(s)}function kt(s,U){if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`${U} must be an object.`);return s}function Ct(s,U){if(s===void 0)return;if(typeof s!=="string"||s.length===0||!Number.isFinite(Date.parse(s)))throw Error(`${U} must be a valid timestamp string.`);return s}function vt(s,U,X){if(!Array.isArray(s)||!X.allowEmpty&&s.length===0)throw Error(`${U} keys must be ${X.allowEmpty?"an":"a non-empty"} array.`);let oe=new Set;return s.map((ue,de)=>{let Ce=kt(ue,`${U} keys[${de}]`);if(typeof Ce.id!=="string"||Ce.id.length===0)throw Error(`${U} keys[${de}].id must be a non-empty string.`);if(oe.has(Ce.id))throw Error(`${U} contains duplicate key id "${Ce.id}".`);if(oe.add(Ce.id),!["pending","active","deprecated","rotated","revoked"].includes(String(Ce.state)))throw Error(`${U} keys[${de}].state is invalid.`);if(Ce.value!==void 0&&(typeof Ce.value!=="string"||Ce.value.length===0))throw Error(`${U} keys[${de}].value must be a non-empty string when present.`);let we=Ce.meta===void 0?void 0:kt(Ce.meta,`${U} keys[${de}].meta`);return{id:Ce.id,state:Ce.state,...Ce.value===void 0?{}:{value:Ce.value},...Ce.notBefore===void 0?{}:{notBefore:Ct(Ce.notBefore,`${U} keys[${de}].notBefore`)},...Ce.notAfter===void 0?{}:{notAfter:Ct(Ce.notAfter,`${U} keys[${de}].notAfter`)},...Ce.createdAt===void 0?{}:{createdAt:Ct(Ce.createdAt,`${U} keys[${de}].createdAt`)},...Ce.activatedAt===void 0?{}:{activatedAt:Ct(Ce.activatedAt,`${U} keys[${de}].activatedAt`)},...Ce.deprecatedAt===void 0?{}:{deprecatedAt:Ct(Ce.deprecatedAt,`${U} keys[${de}].deprecatedAt`)},...Ce.rotatedAt===void 0?{}:{rotatedAt:Ct(Ce.rotatedAt,`${U} keys[${de}].rotatedAt`)},...Ce.revokedAt===void 0?{}:{revokedAt:Ct(Ce.revokedAt,`${U} keys[${de}].revokedAt`)},...we?{meta:{...we}}:{}}})}function Jt(s,U,X){if(s===void 0)return;if(!Array.isArray(s))throw Error(`${X} slots must be an array.`);let oe=new Set,ue=s.map((de,Ce)=>{if(de===null)return null;if(typeof de!=="string"||de.length===0)throw Error(`${X} slots[${Ce}] must be a non-empty key id or null.`);if(oe.has(de))throw Error(`${X} slots contain duplicate key id "${de}".`);oe.add(de);let we=U.find((ke)=>ke.id===de);if(!we)throw Error(`${X} slot key "${de}" is not present in keys.`);if(we.state!=="active")throw Error(`${X} slot key "${de}" must have state "active".`);if(!we.value)throw Error(`${X} slot key "${de}" must include a value.`);return de});if(U.length===0&&ue.some((de)=>de!==null))throw Error(`${X} slots must be omitted or all-null when keys is empty.`);return ue}function Xt(s){let X=kt(s,"KMS pool");if(X.kind!=="kms")throw Error('KMS pool kind must be "kms".');let oe=vt(X.keys,"KMS pool",{allowEmpty:!0}),ue=Jt(X.slots,oe,"KMS pool");return ue?{kind:"kms",slots:ue,keys:oe}:{kind:"kms",keys:oe}}function Zt(s){let X=kt(s,"KMS pool control document");if(X.kind!=="kms")throw Error('KMS pool control document kind must be "kms".');return{kind:"kms",keys:vt(X.keys,"KMS pool control document",{allowEmpty:!0})}}var Qt={trace:"TRACE",debug:"DEBUG",info:"INFO ",warn:"WARN ",error:"ERROR"};function wt(s){if(typeof s==="string")return s;try{return JSON.stringify(s)??String(s)}catch{return String(s)}}function Tt(s){let U=wt(s);return/^[A-Za-z0-9_./:@+|-]+$/.test(U)?U:JSON.stringify(U)}function eo(s){return wt(s).replaceAll("\r","\\r").replaceAll(`
+`,"\\n")}function Ot(s,U,X){if(X==null)return;if(X instanceof Error){let oe=te(X);if(oe){for(let[ue,de]of Object.entries(oe))if(de!=null)s.push(`${ue}=${Tt(de)}`);return}if(s.push(`${U}.name=${Tt(X.name)}`),s.push(`${U}.message=${Tt(X.message)}`),X.stack)s.push(`${U}.stack=${Tt(X.stack)}`);return}s.push(`${U}=${Tt(X)}`)}function Et(s,U,X=[],oe=new Date){let ue=eo(U instanceof Error?U.message:U??""),de=[];for(let[Ce,we]of X.entries()){if(we&&typeof we==="object"&&!Array.isArray(we)&&!(we instanceof Error)&&Object.getPrototypeOf(we)===Object.prototype){for(let[ke,Xe]of Object.entries(we))Ot(de,ke,Xe);continue}Ot(de,`param.${Ce}`,we)}return[oe.toISOString(),Qt[s],ue,...de].filter(Boolean).join(" ")}var Dt={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},to=Dt,oo={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},ro={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},no={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error},so={trace:()=>{},debug:(s,...U)=>globalThis.console.debug(Et("debug",s,U)),info:(s,...U)=>globalThis.console.info(Et("info",s,U)),warn:(s,...U)=>globalThis.console.warn(Et("warn",s,U)),error:(s,...U)=>globalThis.console.error(Et("error",s,U))};function io(s,U){if(typeof U!=="number"||U<=0)return s;return new Promise((X,oe)=>{let ue=setTimeout(()=>{oe(Error(`Authz catalog entry did not become ready within ${U}ms`))},U);s.then(()=>{clearTimeout(ue),X()},(de)=>{clearTimeout(ue),oe(de)})})}function ao(s,U){let X=!1,oe,ue=U.then(()=>{X=!0},(Ce)=>{X=!1,oe=Ce}),de=s;return Object.defineProperty(de,"ready",{enumerable:!1,configurable:!0,value:(Ce)=>io(ue.then(()=>{if(!X)throw oe}),Ce)}),Object.defineProperty(de,"isReady",{enumerable:!1,configurable:!0,value:()=>X}),de}var It=Object.freeze({jsonc:a,env:"text/x-dotenv",text:"text/plain",binary:je,yaml:"application/yaml",toml:"application/toml",xml:Me});function bt(s){if(!s.id.trim())throw Error("defineSecretType: id is required");let U=s.mimeType?.trim()||It[s.format],X=Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},typeId:s.id});return Object.freeze({id:s.id,...s.label?{label:s.label}:{},format:s.format,mimeType:U,...s.schemaUrl?{schemaUrl:s.schemaUrl}:{},...s.schema?{schema:s.schema}:{},toRegistryEntry:()=>X})}function po(s="jsonc"){return{format:s,mimeType:It[s],typeId:s}}class Kt extends n{constructor(s,U){super(`Secret content type mismatch: expected "${s.mimeType}" (${s.format}) but received "${U.mimeType}" (${U.format})`,{status:500});this.name="SecretContentTypeMismatchError";this.expected=s,this.received=U}}var co=bt({id:"ionite-remote-config",label:"ionite RemoteConfig",format:"jsonc",mimeType:"application/vnd.ionite.remote-config+json",schemaUrl:"https://ionite.com/schemas/remote-config.json"});var Mt={beforeTenantSegments:["ui"]},Nt={beforeTenantSegments:["api"]};function Lt(s){return(s??[]).map((U)=>U.trim()).filter(Boolean)}function $t(s){let U=s.trim();if(!U)return"/";let X=U.replace(/\\/g,"/").replace(/\/+/g,"/");return X.startsWith("/")?X:`/${X}`}function Ut(s){return $t(s).split("/").filter(Boolean)}function Rt(s){return{beforeTenantSegments:Lt(s?.beforeTenantSegments),afterTenantSegments:Lt(s?.afterTenantSegments)}}function Ft(s){if(s?.type==="host")return{type:"host",baseDomain:xt(s.baseDomain)};if(s?.type==="selector")return s;return{type:"path",ui:Rt(s?.ui??Mt),api:Rt(s?.api??Nt)}}function xt(s){let U=s.trim().replace(/^\.+|\.+$/g,"").toLowerCase();if(!U)throw Error('Host tenant routing requires a non-empty baseDomain such as "app.example.com".');return U}function mo(s,U){let X=s.trim().replace(/\.$/,"").toLowerCase(),oe=xt(U);if(!X.endsWith(`.${oe}`))return null;let ue=X.slice(0,-(oe.length+1));if(!ue||ue.includes("."))return null;return{id:ue}}function uo(s,U){let X=Rt(U),oe=X.beforeTenantSegments??[],ue=X.afterTenantSegments??[],de=Ut(s),Ce=oe.length+1+ue.length;if(de.length<Ce)return null;for(let Ge=0;Ge<oe.length;Ge++)if(de[Ge]!==oe[Ge])return null;let we=oe.length,ke=de[we];if(!ke)return null;for(let Ge=0;Ge<ue.length;Ge++)if(de[we+1+Ge]!==ue[Ge])return null;let Xe=de.slice(we+1+ue.length);return{id:decodeURIComponent(ke),restSegments:Xe,restPath:Xe.length>0?`/${Xe.join("/")}`:"/"}}function Wt(s,U="/",X){let oe=Rt(X),ue=oe.beforeTenantSegments??[],de=oe.afterTenantSegments??[],Ce=Ut(U),we=[...ue,encodeURIComponent(s),...de,...Ce];return we.length>0?`/${we.join("/")}`:"/"}function lo(s,U="/",X,oe="ui"){let ue=Ft(X);if(ue.type==="host"||ue.type==="selector")return $t(U);return Wt(s,U,ue[oe])}function go(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let X=U,oe=[],ue={...X},de=["iss","sub"];for(let ke of de)if(ke in X){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if("aud"in X&&X.aud!==void 0){let ke=X.aud;if(typeof ke!=="string"&&!Array.isArray(ke))oe.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(ke)&&!ke.every((Xe)=>typeof Xe==="string"))oe.push({message:"aud array must contain only strings",path:["aud"]})}let Ce=["jti","scope"];for(let ke of Ce)if(ke in X&&X[ke]!==void 0){if(typeof X[ke]!=="string")oe.push({message:`${ke} must be a string`,path:[ke]})}let we=["exp","iat"];for(let ke of we)if(ke in X){if(typeof X[ke]!=="number")oe.push({message:`${ke} must be a number`,path:[ke]})}else oe.push({message:`${ke} is required`,path:[ke]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function fo(s){return{"~standard":{version:1,vendor:s,validate:(U)=>{if(typeof U!=="object"||U===null)return{issues:[{message:"Expected an object"}]};let X=U,oe=[],ue={};if("access_token"in X)if(typeof X.access_token==="string")ue.access_token=X.access_token;else oe.push({message:"access_token must be a string",path:["access_token"]});else oe.push({message:"access_token is required",path:["access_token"]});if("token_type"in X)if(typeof X.token_type==="string")ue.token_type=X.token_type;else oe.push({message:"token_type must be a string",path:["token_type"]});else oe.push({message:"token_type is required",path:["token_type"]});if("scope"in X)if(typeof X.scope==="string"||X.scope===void 0)ue.scope=X.scope;else oe.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in X)if(typeof X.refresh_token==="string"||X.refresh_token===void 0)ue.refresh_token=X.refresh_token;else oe.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in X)if(typeof X.expires==="string"||X.expires===void 0)ue.expires=X.expires;else oe.push({message:"expires must be a string",path:["expires"]});if("expires_in"in X)if(typeof X.expires_in==="number"||X.expires_in===void 0)ue.expires_in=X.expires_in;else oe.push({message:"expires_in must be a number",path:["expires_in"]});if(oe.length>0)return{issues:oe};return{value:ue}}}}}function yo(s){let U=new Uint8Array(s);return crypto.getRandomValues(U),U}function So(s){let U="",X=yo(s);for(let oe=0;oe<s;oe++){let ue=X[oe]%32;U+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)}return U}function Co(s,U){let X="";for(let oe=U;oe>0;oe--){let ue=s%32;X="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(ue)+X,s=Math.floor(s/32)}return X}function To(s){let U=Date.now(),X=Co(U,10),oe=So(16);return`${s??""}${X}${oe}`}var qt=["vaultLfvServerUrl","vaultLfvDeliveryEndpoint","vaultLfvEventsEndpoint","vaultClientId"];function jt(s){return typeof s==="string"&&s.trim().length>0}function Eo(s){let U=jt(s.vaultUrl)?s.vaultUrl:void 0,X=Object.keys(s).some((ue)=>ue.startsWith("vaultLfv")&&s[ue]!==void 0);if(U&&X)return"vaultUrl and vaultLfv* are mutually exclusive";if(!U&&!X)return;if(X){if(s.vaultTtl!==void 0)return"vaultTtl is supported only with an HTTP vaultUrl";if(qt.some((ue)=>!jt(s[ue])))return`LFV requires ${qt.join(", ")}`;return}let oe;try{oe=new URL(U).protocol}catch{return"vaultUrl must be an absolute http(s) or ws(s) URL"}if(oe==="http:"||oe==="https:")return;if(oe==="ws:"||oe==="wss:")return s.vaultTtl===void 0?void 0:"vaultTtl is supported only with an HTTP vaultUrl";return"vaultUrl must use http, https, ws, or wss"}export{l as ACCEPT_JSON,ut as ACCEPT_OCTET_STREAM,he as ACCEPT_SCIM,ct as ACCEPT_XML,Le as AssignmentPolicyError,ne as CANONICAL_RISK_LEVELS,w as CONTENT_TYPE_FORM,i as CONTENT_TYPE_JSON,lt as CONTENT_TYPE_OCTET_STREAM,R as CONTENT_TYPE_SCIM,dt as CONTENT_TYPE_XML,At as ConfigSourceError,et as DEFAULT_DISCOVERED_COOKIE_MAX,tt as DEFAULT_DISCOVERED_COOKIE_TTL_SECONDS,Qe as DEFAULT_DISPLAY_COOKIE_MAX,y as DEFAULT_RISK_LEVEL,It as DEFAULT_SECRET_MIME_TYPES,Nt as DEFAULT_TENANT_API_NAMESPACE,Mt as DEFAULT_TENANT_UI_NAMESPACE,ie as DISCOVERED_COOKIE_PREFIX,Ze as DISPLAY_COOKIE_SUFFIX,G as DISPLAY_COOKIE_VERSION,We as ECID_SCHEME,N as ENTRA_ION_EXTENSION_URN,M as EcidFormatError,L as FORM_MEDIA_TYPE,t as ION_AUTHZ_GROUP_SCHEMA,_e as ION_AUTHZ_OAA_SYNC,De as ION_CAPABILITIEZ_READ,Ue as ION_CIAM_MAGIC_LINK_CREATE,it as ION_ENDPOINT_PERMISSIONS,Pe as ION_IAM_ACCESS_REQUESTS_WRITE,xe as ION_IAM_CUSTOMERS_WRITE,Ee as ION_IAM_DELEGATES_WRITE,Ie as ION_IAM_GROUPS_WRITE,Ae as ION_IAM_READ,Re as ION_IAM_USERS_WRITE,ve as ION_IAM_WORKLOADS_WRITE,k as ION_SCIM_CUSTOMER_SCHEMA,b as ION_SCIM_DELEGATE_SCHEMA,o as ION_SCIM_USER_EXTENSION_URN,S as ION_SCIM_WORKLOAD_SCHEMA,fe as ION_SDK_PERMISSIONS,Oe as ION_TENANT_MANAGE,n as IoniteError,a as JSON_MEDIA_TYPE,E as KNOWN_BASE_CUSTOMER_KEYS,x as KNOWN_BASE_USER_KEYS,p as KNOWN_ENTITLEMENT_KEYS,P as KNOWN_WORKLOAD_KEYS,je as OCTET_STREAM_MEDIA_TYPE,h as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,at as SCIM_MEDIA_TYPE,Kt as SecretContentTypeMismatchError,v as StoreConflictError,ht as TM_STAGED_HANDLE_TYP,Me as XML_MEDIA_TYPE,r as accessRefId,f as accessRootId,Je as accessSubjectId,j as assertEcid,re as assertRequiredSubjectType,D as assertValidSubjectTypeScoping,Wt as buildTenantPath,lo as buildTenantUrl,V as catalogEntityStore,Q as claimsToUser,_ as compareDisplayExpiryDesc,_t as configSourceOriginLogFields,He as configTrustedClientGrants,c as customAttributes,pe as customerResourceSchema,oo as debugLogger,Ke as decodeDisplayCookie,yt as decodeUser,C as deepEqualPlain,be as defaultDisplayUser,to as defaultLogger,po as defaultSecretContentType,qe as defineCatalog,bt as defineSecretType,me as delegateResourceSchema,se as deprecateRetiredCodeCatalogRows,Gt as describeOriginUrl,Y as discoveredProfileCookieName,F as encodeDisplayCookie,te as errorLogAttributes,nt as formatEcid,Et as formatLogLine,To as generateULID,W as getCodeCatalogEntity,ot as groupResourceSchema,T as idTokenClaimsSchema,ro as infoLogger,$e as isCodeCatalog,Ne as isConfigLocator,Bt as isConfigSourceError,Ve as isEcid,ze as isJsonResponse,q as isStoreConflictError,go as jwtAssertionClaimsSchema,K as list,u as listGenerator,mo as matchTenantHost,uo as matchTenantPath,Fe as matchesListFilter,z as materializeCodeCatalogEntity,A as mergeCodeCatalogEntity,pt as mergeConfig,e as must,xt as normalizeTenantBaseDomain,Rt as normalizeTenantPathNamespace,Ft as normalizeTenantRoutingStrategy,ge as oidcCallbackSchema,rt as parseEcid,mt as parseJsonc,Zt as parseKmsPoolControlDocument,Xt as parseKmsPoolDocument,so as prettyLogger,O as profileCookieName,g as projectDisplayUser,J as readDisplayCookies,d as readJsonResponse,ao as readyCatalogEntry,co as remoteConfigSecretType,H as resolveDiscoveredCookieMax,ce as resolveDiscoveredCookieTtlSeconds,ae as resolveDisplayCookieMax,Te as sanitizeDisplayUser,Yt as serializeConfig,Dt as silentLogger,ft as stableConfigHash,Be as stripJsonComments,St as tmIntegrationState,Ye as toCodeCatalog,ye as tokenResponseSchema,I as trimTrailingSlash,ee as trustedClientPermissionsForPrincipal,Z as unexpectedBodySummary,B as unionCatalogRead,st as userSchema,Se as validationFailureResponse,Eo as vaultConfigLocatorTransportError,zt as version,gt as waitOn,no as warnLogger,m as withValidate,le as workloadResourceSchema,fo as workloadTokenResponseSchema};

package/dist/server.d.ts

@@ -5193,8 +5193,12 @@ type IoniteBase = {
 	describe(): IoniteDescription;
 	/** Most recent RemoteConfig application outcome (last applied time and last error, if any). */
 	configStatus: ConfigApplyStatus;
-	/** Release config subscriptions and background resources. */
-	close(): void;
+	/**
+	* Release config subscriptions and background resources. Resolves once every module's teardown
+	* has settled, including the OpenTelemetry flush, so a shutdown path can await it before exiting.
+	* Idempotent: repeat calls return the same promise. Never rejects; teardown failures are logged.
+	*/
+	close(): Promise<void>;
 	/**
 	* Replace runtime store instances. Resolves once the stores have been applied; when config has
 	* already loaded this re-runs the (possibly async) `beforeChange` hook, so callers that depend on
@@ -5285,7 +5289,7 @@ type TmIoniteConfig = {
 	url: string;
 	/** Required `iss` claim on ionite-signed staged-request handles and ionite workload tokens. */
 	issuer: string;
-	/** ionite JWKS endpoint used to verify signed staged-request handles. */
+	/** ionite JWKS endpoint used to verify signed staged-request handles and TM access tokens. */
 	jwksUri: string;
 	/** Required `aud` claim binding an ionite-staged request to this App. */
 	audience: string;