@ionite/core 0.0.23-beta.20260809.2 → 0.0.23-beta.20260812.3

package/dist/index.d.ts

@@ -2053,33 +2053,57 @@ type IAM = IAMConfig & {
 	delta?: IamDeltaEmitter;
 };
 type KmsKeyState = "pending" | "active" | "deprecated" | "revoked";
+type KmsPoolKind = "token" | "allocation";
 type KmsTokenKey = {
 	id: string;
 	state: KmsKeyState;
 	value?: string;
 	notBefore?: string;
 	notAfter?: string;
+	/** Control-plane metadata used for allocation policy and UI. Consumers should treat it as opaque. */
+	meta?: Record<string, unknown>;
 };
 type KmsTokenPoolDocument = {
 	kind: "token";
 	active: string;
 	keys: KmsTokenKey[];
 };
-/** ConfigSource-owned pointer to a token-pool document. */
+/** Per-client allocation view delivered by a secrets source. */
+type KmsAllocationPoolView = {
+	kind: "allocation";
+	active: string;
+	keys: KmsTokenKey[];
+};
+type KmsPoolDocument = KmsTokenPoolDocument | KmsAllocationPoolView;
+type KmsAllocationStrategy = "spread" | "low-quota-first";
+type KmsAllocationPolicy = {
+	strategy?: KmsAllocationStrategy;
+	maxHoldersPerKey?: number;
+};
+/** Control-plane allocation document stored by the vault. Clients receive a personalized view instead. */
+type KmsAllocationPoolDocument = {
+	kind: "allocation";
+	keys: KmsTokenKey[];
+	assignments: Record<string, string>;
+	policy?: KmsAllocationPolicy;
+};
+/** ConfigSource-owned pointer to a KMS pool document. */
 type KmsPoolConfig = {
+	/** Pool semantics. Defaults to `token`. */
+	kind?: KmsPoolKind;
 	/** Named `ion.secrets` source. Omit to use the default `ion.secret` source. */
 	source?: string;
 	/** Secret path. Defaults to `/kms/{poolName}`. */
 	path?: string;
 };
-/** ConfigSource-owned named token-pool declarations. */
+/** ConfigSource-owned named KMS pool declarations. */
 type KmsConfig = Record<string, KmsPoolConfig>;
 type KmsPoolListener = (current: KmsTokenKey | undefined) => void;
 type KmsPool = {
-	/** Returns the usable active token metadata and value. Throws while the pool is not ready. */
-	current(): KmsTokenKey;
-	/** Returns keys accepted during the current overlap window (active plus usable deprecated keys). */
-	valid(): KmsTokenKey[];
+	/** Returns the usable token value, briefly awaiting only a locally scheduled imminent activation. */
+	value(): Promise<string>;
+	/** Timing-safe verification against the active token and usable deprecated overlap tokens. */
+	accepts(candidate: string): boolean;
 	/** Notifies immediately and whenever the selected active token changes. */
 	subscribe(listener: KmsPoolListener): () => void;
 	beforeChange(listener: ChangeListener): () => void;
@@ -2095,11 +2119,14 @@ type Kms = ModuleReadiness & {
 	readonly config: Readonly<KmsConfig>;
 	listPools(): string[];
 	getPool(name: string): KmsPool;
-	currentToken(name: string): string;
-	validTokens(name: string): KmsTokenKey[];
 };
-/** Parse and fail closed on an invalid v1 token-pool document. */
-declare function parseKmsTokenPool(value: unknown): KmsTokenPoolDocument;
+/** Parse and fail closed on a personalized KMS pool document. */
+declare function parseKmsPoolDocument(value: unknown): KmsTokenPoolDocument;
+declare function parseKmsPoolDocument(value: unknown, expectedKind: "token"): KmsTokenPoolDocument;
+declare function parseKmsPoolDocument(value: unknown, expectedKind: "allocation"): KmsAllocationPoolView;
+declare function parseKmsPoolDocument(value: unknown, expectedKind: KmsPoolKind): KmsPoolDocument;
+/** Parse and fail closed on a control-plane allocation-pool document. */
+declare function parseKmsAllocationPool(value: unknown): KmsAllocationPoolDocument;
 type OtelSignalName = "traces" | "metrics" | "logs";
 type OtelProtocol = "http/protobuf" | "http/json";
 type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
@@ -2838,7 +2865,7 @@ type SecretLifecycleRequest = {
 	severity?: SecretRequestSeverity;
 	incidentRef?: string;
 };
-type SecretEventName = "rotate_requested" | "revoke_requested" | "created" | "updated" | "deleted" | "rotated" | "revoked" | "removed" | "acl_updated" | "path_removed" | "lease_expiring_soon" | "lease_revoked" | (string & {});
+type SecretEventName = "rotate_requested" | "revoke_requested" | "created" | "updated" | "deleted" | "rotated" | "revoked" | "removed" | "path_removed" | "lease_expiring_soon" | "lease_revoked" | (string & {});
 type SecretEvent = {
 	path: string;
 	event: SecretEventName;
@@ -5187,6 +5214,12 @@ type CapabilityState = {
 	reason?: string;
 };
 type CapabilitiezManifest = {
+	sdk: {
+		/** Runtime @ionite/server version serving this manifest. */
+		version: string;
+		/** Version of the stable capability/test-unit vocabulary. */
+		catalogVersion: number;
+	};
 	basePath: string;
 	urls: CapabilityEndpointUrls;
 	modules: Record<ModuleName, ModuleReadinessState>;
@@ -5472,7 +5505,7 @@ type IAMAppRegistry = {
 type IAMAppValidators = {
 	registerIAMAppPayload: StandardSchemaV19<unknown, RegisterIAMAppPayload>;
 };
-type LfvActionName = "read_secret" | "create_secret" | "update_secret" | "delete_secret" | "request_rotate" | "request_revoke" | "rotate_secret" | "revoke_secret" | "list_paths" | "list_secrets" | "read_metadata" | "read_acl" | "write_acl" | "remove_path";
+type LfvActionName = "read_secret" | "create_secret" | "update_secret" | "delete_secret" | "request_rotate" | "request_revoke" | "rotate_secret" | "revoke_secret" | "list_paths" | "list_secrets" | "read_metadata" | "remove_path";
 type LfvOtpRequest = {
 	request_id: string;
 	path: string;
@@ -5503,4 +5536,4 @@ type LfvErrorResponse = {
 };
 /** Generates a ULID */
 declare function generateULID(prefix?: string): string;
-export { workloadTokenResponseSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, readyCatalogEntry, parseKmsTokenPool, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, generateULID, formatEcid, defineCatalog, defaultLogger, deepEqualPlain, decodeUser, debugLogger, configTrustedClientGrants, claimsToUser, buildTenantPath, assertValidSubjectTypeScoping, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, TenantFactory, TenantConfigLocator, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretRequestSeverity, SecretLifecycleRequest, SecretEventName, SecretEventListener, SecretEvent, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelopeListener, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsTokenPoolDocument, KmsTokenKey, KmsPoolListener, KmsPoolConfig, KmsPool, KmsKeyState, KmsConfig, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaMode, IamDeltaIdMapStore, IamDeltaIdMapKey, IamDeltaEmitter, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_USER_EXTENSION_URN, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, ApplicationValidators, Address, AccessStatus, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };
+export { workloadTokenResponseSchema, withValidate, warnLogger, waitOn, version, validationFailureResponse, userSchema, unionCatalogRead, trustedClientPermissionsForPrincipal, trimTrailingSlash, tokenResponseSchema, toCodeCatalog, stripJsonComments, stableConfigHash, silentLogger, serializeConfig, readyCatalogEntry, parseKmsPoolDocument, parseKmsAllocationPool, parseJsonc, parseEcid, oidcCallbackSchema, normalizeTenantRoutingStrategy, normalizeTenantPathNamespace, must, mergeConfig, matchTenantPath, listGenerator, list, jwtAssertionClaimsSchema, isStoreConflictError, isEcid, isConfigSourceError, isConfigLocator, isCodeCatalog, infoLogger, idTokenClaimsSchema, groupResourceSchema, generateULID, formatEcid, defineCatalog, defaultLogger, deepEqualPlain, decodeUser, debugLogger, configTrustedClientGrants, claimsToUser, buildTenantPath, assertValidSubjectTypeScoping, assertEcid, accessRootId, accessRefId, X509Certificate, WorkloadValidators, WorkloadTokenStore, WorkloadTokenResponse, WorkloadPrincipal, WorkloadIncomingOutgoing, WorkloadIdentityStore, WorkloadIdentity, WorkloadGetToken, WorkloadConfigMap, WorkloadConfig, WorkloadClient, Workload, WorkforceUser, VaultWorkloadAuthConfig, VaultWebSocketSecretsConfig, VaultWebSocketAuthHeader, VaultSecretsConfig, VaultLfvSecretsConfig, VaultConfigLocator, ValidateResult, UsersInboundHandlerConfig, UserStoreOptions, UserStore, UpdateTenantRequest, TrustedProvisioningClient, TrustedIdp, TokenValidationResult, TokenResponse, TenantWebhookPayload, TenantValidators, TenantStore, TenantStatus, TenantRoutingStrategy, TenantResponse, TenantPathRoutingStrategy, TenantPathNamespace, TenantPathMatch, TenantIonCache, TenantFactory, TenantConfigLocator, SubscriptionMode, SubjectTypeScoping, SubjectType, SubjectScope, SubjectRef, StoreConflictKind, StoreConflictError, StateCookie, StandardSchemaWithValidate, SessionStore, Session, ServerOnlyWorkloadConfig, SecretsValidators, SecretsSubscriptionOptions, SecretsSourceType, SecretsSourceMap, SecretsSourceConfig, SecretsSource, SecretsOperationOptions, SecretsModuleConfig, Secrets, SecretRequestSeverity, SecretLifecycleRequest, SecretEventName, SecretEventListener, SecretEvent, Secret, User as ScimUser, ScimServiceProviderConfig, ScimSchemaDefinition, ScimSchemaAttributeDefinition, Role2 as ScimRole, ScimResult, ScimResourceTypeSchemaExtension, ScimResourceType, ScimMutationSummary, ScimListResponse, Group2 as ScimGroup, ScimError, ScimAuthenticationScheme, SSOValidators, SSOHandlerConfig, SSOConfigFromCode, SSOConfig, SSOAppValidators, SSOAppRegistry, SSO, RoutingOptions, RouteModule, RouteFilterResult, Role, ResourceProvider, ResourceChangeListener, ResourceChange, Resource, ResolvedVaultLfvSecretsConfig, ResolvedRoute, RequireReadyResult, RemoteConfigRetryOptions, RemoteConfigRetryHook, RemoteConfigRetryContext, RemoteConfigLoadErrorKind, RemoteConfig, RegisterSSOAppResult, RegisterSSOAppPayload, RegisterSSOAppError, RegisterIAMAppResult, RegisterIAMAppPayload, RegisterIAMAppError, ReconcileReport, ReadyzEndpointConfig, ReadyAccessCatalogEntry, ReadinessReport, ReactiveHandle, Photo, PhoneNumber, Permission, ParsedEcid, PLATFORM_ASSIGNABLE_SUBJECT_TYPES, OtelSignalName, OtelSignalConfig, OtelProviderType, OtelProtocol, OtelOAuthClientCredentialsConfig, OtelMetricsSignalConfig, OtelLogRecord, OtelLogLevel, OtelLevels, OtelConfig, OtelAttributes, OtelAttributeValue, Otel, OidcCallbackParams, OaaSyncResult, OaaSyncOptions, OaaSyncInput, OaaClient, OaaAccessTargetType, OaaAccessChangeBatchItem, Name, ModuleReadinessState, ModuleReadiness, ModuleName, ModifiableFrameworkConfig, MetaData, MagicLinkStore, MagicLink, Logger, ListResult, ListOptions, ListFilter, LfvOtpResponse, LfvOtpRequest, LfvJwks, LfvErrorResponse, LfvErrorCode, LfvEd25519PublicJwk, LfvEd25519PrivateJwk, LfvCallbackTransport, LfvCallbackKind, LfvCallbackHeaders, LfvCallbackEnvelopeListener, LfvCallbackEnvelope, LfvActionRequestBase, LfvActionName, LfvActionAcceptedResponse, KmsTokenPoolDocument, KmsTokenKey, KmsPoolListener, KmsPoolKind, KmsPoolDocument, KmsPoolConfig, KmsPool, KmsKeyState, KmsConfig, KmsAllocationStrategy, KmsAllocationPoolView, KmsAllocationPoolDocument, KmsAllocationPolicy, Kms, JwtBearerWorkloadConfig, JWTAssertionClaims, IoniteValidators, IoniteUserExtension, IoniteErrorOptions, IoniteError, IoniteBase, Ionite, InMemoryTenantStoreOptions, IdentityResolution, IdTokenClaims, IamDeltaResourceType, IamDeltaReconcileResult, IamDeltaMode, IamDeltaIdMapStore, IamDeltaIdMapKey, IamDeltaEmitter, ION_TENANT_MANAGE, ION_SDK_PERMISSIONS, ION_SCIM_USER_EXTENSION_URN, ION_IAM_USERS_WRITE, ION_IAM_READ, ION_IAM_GROUPS_WRITE, ION_ENDPOINT_PERMISSIONS, ION_CIAM_MAGIC_LINK_CREATE, ION_CAPABILITIEZ_READ, ION_AUTHZ_OAA_SYNC, ION_AUTHZ_GROUP_SCHEMA, IAMValidators, IAMUsersInbound, IAMInboundUsersConfig, IAMInboundUserContext, IAMHandlerConfig, IAMGroupsOutbound, IAMGroupsInbound, IAMDiscoveryHandlerConfig, IAMDiscoveryContext, IAMDiscoveryConfig, IAMConfigFromCode, IAMConfig, IAMAppValidators, IAMAppRegistry, IAM, GroupsInboundHandlerConfig, GroupResource, GroupMember, Group, GcpSecretsConfig, GcpConfigLocator, FrameworkWorkloadIncomingOutgoing, FrameworkWorkloadConfigFromCode, FrameworkWorkloadConfig, FrameworkStores, FrameworkSecretsSourceConfig, FrameworkSecretsModuleConfig, FrameworkOtelConfig, FrameworkLfvConfig, FrameworkConfigInput, FrameworkConfig, EnvironmentType, EntityStore, EntitlementType, Entitlement, EnterpriseExtension, EndpointPermission, EndpointOperation, Email, EgressOutcome, EgressChannelOutcome, EffectiveEdge, EcidFormatError, ECID_SCHEME, DevSecretsConfig, DEFAULT_TENANT_UI_NAMESPACE, DEFAULT_TENANT_API_NAMESPACE, CustomerStoreOptions, CustomerStore, Customer, CreateUserOptions, CreateTenantRequest, CreateGroupOptions, ConfigSubscriptionOptions, ConfigSourceType, ConfigSourceResolver, ConfigSourceErrorInit, ConfigSourceError, ConfigSourceEnv, ConfigSource, ConfigLocator, ConfigErrorKind, ConfigChangeResult, ConfigChangeOptions, ConfigChangeCallback, ConfigApplyStatus, CodeCatalogNamespace, CodeCatalogInput, CodeCatalog, ClientCredentialsWorkloadConfig, ChangeListener, CatalogChangeListener, CatalogChangeKind, CatalogChange, CapabilityState, CapabilityKey, CapabilityEndpointUrls, CapabilitiezManifest, CachedWorkloadToken, CacheConfig, CIAMValidators, CIAMProviderType, CIAMProviderDescriptor, CIAMProviderConfig, CIAMProviderColors, CIAMProviderBranding, CIAMConfigFromCodeInput, CIAMConfigFromCode, CIAMConfig, CIAM, BaseWorkloadIdentity, BaseUser, BaseTenant, BaseCustomer, AzureSecretsConfig, AzureConfigLocator, AzureAuthMethod, AwsSecretsConfig, AwsConfigLocator, AuthzScimGroupType, AuthzScimGroupExtension, AuthzOaaConfig, AuthzEntityBase, AuthzDecision, AuthzConfig, Authz, AuthenticatedUser, AuthenticatedPrincipal, ApplicationValidators, Address, AccessStatus, AccessRef, AccessProvenance, AccessMutationStatus, AccessMutationResult, AccessIndex, AccessCheckTarget, AccessCheckResult, AccessCheckReason, AccessChange, AccessCatalogStore, AccessAssignmentStore };

package/dist/index.js

@@ -1 +1 @@
-import{A as P0,B as D0,C as E0,D as S0,E as R0,F as b0,G as w0,H as T0,I as L0,J as I0,K as N0,L as k0,M as A0,N as _0,Q as v0,R as f0,S as O0,T as y0,U as h0,V as g0,a as e,b as Q0,c as X0,d as $0,e as J0,f as V0,l as B0,m as Z0,n as F0,o as H0,p as G0,q as q0,r as U0,s as j0,t as x0,u as Y0,v as z0,w as M0,x as K0,y as C0,z as W0}from"./shared/core-f0gk15rd.js";var L="0.0.23-beta.20260809.2";class x extends Error{kind;recoverable;code;status;path;sourceType;constructor($,X){super($,X.cause!==void 0?{cause:X.cause}:void 0);this.name="ConfigSourceError",this.kind=X.kind,this.recoverable=X.recoverable,this.code=X.code,this.status=X.status,this.path=X.path,this.sourceType=X.sourceType,Object.setPrototypeOf(this,x.prototype)}}function I($){return $ instanceof x}var G=["workload"],Y={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:G,recommendedSubjectTypes:G},z={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},M={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},K={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:G,recommendedSubjectTypes:G},C={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:G},W={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:G,recommendedSubjectTypes:G},P={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:G,recommendedSubjectTypes:G},N=[Y,z,M,K,C,W,P],k={"iam.read":{permission:Y,subjectType:["workload"]},"iam.users.write":{permission:z,subjectType:["workload"]},"iam.groups.write":{permission:M,subjectType:["workload"]},"capabilitiez.read":{permission:K,subjectType:["workload"]},"ciam.magic-link.create":{permission:C,subjectType:["workload","user"]},"authz.oaa.sync":{permission:W,subjectType:["workload"]},"tenant.manage":{permission:P,subjectType:["workload"]}};var A=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function D($){if($===null||typeof $!=="object")return $;let X={};for(let[Q,J]of Object.entries($)){if(A.includes(Q)||Q==="validators"||Q==="setStores")continue;X[Q]=J!==null&&typeof J==="object"&&!Array.isArray(J)&&Object.getPrototypeOf(J)===Object.prototype?D(J):J}return X}function _($){return D($)}function E($,X){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`${X} must be an object.`);return $}function S($,X){if($===void 0)return;if(typeof $!=="string"||$.length===0||!Number.isFinite(Date.parse($)))throw Error(`${X} must be a valid timestamp string.`);return $}function v($){let X=E($,"KMS token pool");if(X.kind!=="token")throw Error('KMS token pool kind must be "token".');if(typeof X.active!=="string"||X.active.length===0)throw Error("KMS token pool active must be a non-empty key id.");if(!Array.isArray(X.keys)||X.keys.length===0)throw Error("KMS token pool keys must be a non-empty array.");let Q=new Set,J=X.keys.map((F,H)=>{let Z=E(F,`KMS token pool keys[${H}]`);if(typeof Z.id!=="string"||Z.id.length===0)throw Error(`KMS token pool keys[${H}].id must be a non-empty string.`);if(Q.has(Z.id))throw Error(`KMS token pool contains duplicate key id "${Z.id}".`);if(Q.add(Z.id),!["pending","active","deprecated","revoked"].includes(String(Z.state)))throw Error(`KMS token pool keys[${H}].state is invalid.`);if(Z.value!==void 0&&(typeof Z.value!=="string"||Z.value.length===0))throw Error(`KMS token pool keys[${H}].value must be a non-empty string when present.`);return{id:Z.id,state:Z.state,...Z.value===void 0?{}:{value:Z.value},...Z.notBefore===void 0?{}:{notBefore:S(Z.notBefore,`KMS token pool keys[${H}].notBefore`)},...Z.notAfter===void 0?{}:{notAfter:S(Z.notAfter,`KMS token pool keys[${H}].notAfter`)}}}),V=J.find((F)=>F.id===X.active);if(!V)throw Error(`KMS token pool active key "${X.active}" is not present in keys.`);if(V.state!=="active")throw Error(`KMS token pool active key "${X.active}" must have state "active".`);if(!V.value)throw Error(`KMS token pool active key "${X.active}" must include a value.`);return{kind:"token",active:X.active,keys:J}}var R={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},f=R,O={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},y={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},h={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function g($,X){if(typeof X!=="number"||X<=0)return $;return new Promise((Q,J)=>{let V=setTimeout(()=>{J(Error(`Authz catalog entry did not become ready within ${X}ms`))},X);$.then(()=>{clearTimeout(V),Q()},(F)=>{clearTimeout(V),J(F)})})}function p($,X){let Q=!1,J,V=X.then(()=>{Q=!0},(H)=>{Q=!1,J=H}),F=$;return Object.defineProperty(F,"ready",{enumerable:!1,configurable:!0,value:(H)=>g(V.then(()=>{if(!Q)throw J}),H)}),Object.defineProperty(F,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),F}var d={beforeTenantSegments:["ui"]},c={beforeTenantSegments:["api"]};function b($){return($??[]).map((X)=>X.trim()).filter(Boolean)}function m($){let X=$.trim();if(!X)return"/";let Q=X.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function w($){return m($).split("/").filter(Boolean)}function j($){return{beforeTenantSegments:b($?.beforeTenantSegments),afterTenantSegments:b($?.afterTenantSegments)}}function u($){return{type:"path",ui:j($?.ui),api:j($?.api)}}function l($,X){let Q=j(X),J=Q.beforeTenantSegments??[],V=Q.afterTenantSegments??[],F=w($),H=J.length+1+V.length;if(F.length<H)return null;for(let q=0;q<J.length;q++)if(F[q]!==J[q])return null;let Z=J.length,B=F[Z];if(!B)return null;for(let q=0;q<V.length;q++)if(F[Z+1+q]!==V[q])return null;let U=F.slice(Z+1+V.length);return{id:decodeURIComponent(B),restSegments:U,restPath:U.length>0?`/${U.join("/")}`:"/"}}function n($,X="/",Q){let J=j(Q),V=J.beforeTenantSegments??[],F=J.afterTenantSegments??[],H=w(X),Z=[...V,encodeURIComponent($),...F,...H];return Z.length>0?`/${Z.join("/")}`:"/"}function a($){return{"~standard":{version:1,vendor:$,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,J=[],V={...Q},F=["iss","sub"];for(let B of F)if(B in Q){if(typeof Q[B]!=="string")J.push({message:`${B} must be a string`,path:[B]})}else J.push({message:`${B} is required`,path:[B]});if("aud"in Q&&Q.aud!==void 0){let B=Q.aud;if(typeof B!=="string"&&!Array.isArray(B))J.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(B)&&!B.every((U)=>typeof U==="string"))J.push({message:"aud array must contain only strings",path:["aud"]})}let H=["jti","scope"];for(let B of H)if(B in Q&&Q[B]!==void 0){if(typeof Q[B]!=="string")J.push({message:`${B} must be a string`,path:[B]})}let Z=["exp","iat"];for(let B of Z)if(B in Q){if(typeof Q[B]!=="number")J.push({message:`${B} must be a number`,path:[B]})}else J.push({message:`${B} is required`,path:[B]});if(J.length>0)return{issues:J};return{value:V}}}}}function i($){return{"~standard":{version:1,vendor:$,validate:(X)=>{if(typeof X!=="object"||X===null)return{issues:[{message:"Expected an object"}]};let Q=X,J=[],V={};if("access_token"in Q)if(typeof Q.access_token==="string")V.access_token=Q.access_token;else J.push({message:"access_token must be a string",path:["access_token"]});else J.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")V.token_type=Q.token_type;else J.push({message:"token_type must be a string",path:["token_type"]});else J.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)V.scope=Q.scope;else J.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)V.refresh_token=Q.refresh_token;else J.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)V.expires=Q.expires;else J.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)V.expires_in=Q.expires_in;else J.push({message:"expires_in must be a number",path:["expires_in"]});if(J.length>0)return{issues:J};return{value:V}}}}}function r($){let X=new Uint8Array($);return crypto.getRandomValues(X),X}function o($){let X="",Q=r($);for(let J=0;J<$;J++){let V=Q[J]%32;X+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(V)}return X}function t($,X){let Q="";for(let J=X;J>0;J--){let V=$%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(V)+Q,$=Math.floor($/32)}return Q}function s($){let X=Date.now(),Q=t(X,10),J=o(16);return`${$??""}${Q}${J}`}export{i as workloadTokenResponseSchema,C0 as withValidate,h as warnLogger,T0 as waitOn,L as version,P0 as validationFailureResponse,h0 as userSchema,H0 as unionCatalogRead,e as trustedClientPermissionsForPrincipal,R0 as trimTrailingSlash,M0 as tokenResponseSchema,Z0 as toCodeCatalog,E0 as stripJsonComments,w0 as stableConfigHash,R as silentLogger,_ as serializeConfig,p as readyCatalogEntry,v as parseKmsTokenPool,S0 as parseJsonc,x0 as parseEcid,z0 as oidcCallbackSchema,u as normalizeTenantRoutingStrategy,j as normalizeTenantPathNamespace,W0 as must,D0 as mergeConfig,l as matchTenantPath,$0 as listGenerator,X0 as list,a as jwtAssertionClaimsSchema,k0 as isStoreConflictError,U0 as isEcid,I as isConfigSourceError,_0 as isConfigLocator,B0 as isCodeCatalog,y as infoLogger,K0 as idTokenClaimsSchema,g0 as groupResourceSchema,s as generateULID,j0 as formatEcid,F0 as defineCatalog,f as defaultLogger,b0 as deepEqualPlain,I0 as decodeUser,O as debugLogger,Q0 as configTrustedClientGrants,L0 as claimsToUser,n as buildTenantPath,O0 as assertValidSubjectTypeScoping,Y0 as assertEcid,V0 as accessRootId,J0 as accessRefId,N0 as StoreConflictError,f0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,A0 as IoniteError,P as ION_TENANT_MANAGE,N as ION_SDK_PERMISSIONS,y0 as ION_SCIM_USER_EXTENSION_URN,z as ION_IAM_USERS_WRITE,Y as ION_IAM_READ,M as ION_IAM_GROUPS_WRITE,k as ION_ENDPOINT_PERMISSIONS,C as ION_CIAM_MAGIC_LINK_CREATE,K as ION_CAPABILITIEZ_READ,W as ION_AUTHZ_OAA_SYNC,v0 as ION_AUTHZ_GROUP_SCHEMA,q0 as EcidFormatError,G0 as ECID_SCHEME,d as DEFAULT_TENANT_UI_NAMESPACE,c as DEFAULT_TENANT_API_NAMESPACE,x as ConfigSourceError};
+import{A as K0,B as b0,C as T0,D as L0,E as R0,F as N0,G as A0,H as _0,I as I0,J as f0,K as O0,L as v0,M as k0,N as w0,Q as y0,R as g0,S as h0,T as p0,U as m0,V as c0,a as $0,b as J0,c as V0,d as B0,e as Z0,f as F0,l as G0,m as H0,n as U0,o as q0,p as j0,q as Y0,r as z0,s as M0,t as C0,u as W0,v as D0,w as E0,x as P0,y as x0,z as S0}from"./shared/core-f0gk15rd.js";var A="0.0.23-beta.20260812.3";class z extends Error{kind;recoverable;code;status;path;sourceType;constructor(X,$){super(X,$.cause!==void 0?{cause:$.cause}:void 0);this.name="ConfigSourceError",this.kind=$.kind,this.recoverable=$.recoverable,this.code=$.code,this.status=$.status,this.path=$.path,this.sourceType=$.sourceType,Object.setPrototypeOf(this,z.prototype)}}function _(X){return X instanceof z}var q=["workload"],M={id:"ion:iam:read",name:"Read Identities (SCIM)",description:"Authorizes a workload to list and read Users and Groups via the SCIM endpoints.",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:q,recommendedSubjectTypes:q},C={id:"ion:iam:users:write",name:"Manage Identities (SCIM Users)",description:"Authorizes a workload to create, replace, modify (including attribute changes), and delete Users via SCIM, including access-root revocation on user delete.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},W={id:"ion:iam:groups:write",name:"Manage Groups & Access (SCIM Groups)",description:"Authorizes a workload to create, replace, modify, and delete Groups via SCIM, including membership changes that grant or revoke entitlements.",requestable:!1,permissionTypes:["DataCreate","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},D={id:"ion:capabilitiez:read",name:"Read Capability Manifest",description:"Authorizes a workload to read the capability manifest at the capabilitiez endpoint (only when RemoteConfig.capabilitiez is enabled).",requestable:!1,permissionTypes:["DataRead"],assignableSubjectTypes:q,recommendedSubjectTypes:q},E={id:"ion:ciam:magic-link:create",name:"Issue CIAM Magic Links",description:"Authorizes a caller to mint customer magic-link login credentials via the magic-link endpoint. Grant narrowly.",requestable:!1,permissionTypes:["DataCreate"],assignableSubjectTypes:["workload","user"],recommendedSubjectTypes:q},P={id:"ion:authz:oaa:sync",name:"Trigger OAA Full Sync",description:"Authorizes a workload (Ops/ECI client) to trigger a full OAA reconcile via the authz OAA sync endpoint (only when RemoteConfig.authz.oaa.fullSync.enabled is true).",requestable:!1,permissionTypes:["DataWrite"],assignableSubjectTypes:q,recommendedSubjectTypes:q},x={id:"ion:tenant:manage",name:"Manage Tenants",description:"Authorizes a workload (ECI/TMS client) to create, read, update, and delete tenant records via the tenant-management endpoints.",requestable:!1,permissionTypes:["DataCreate","DataRead","DataWrite","DataDelete"],assignableSubjectTypes:q,recommendedSubjectTypes:q},I=[M,C,W,D,E,P,x],f={"iam.read":{permission:M,subjectType:["workload"]},"iam.users.write":{permission:C,subjectType:["workload"]},"iam.groups.write":{permission:W,subjectType:["workload"]},"capabilitiez.read":{permission:D,subjectType:["workload"]},"ciam.magic-link.create":{permission:E,subjectType:["workload","user"]},"authz.oaa.sync":{permission:P,subjectType:["workload"]},"tenant.manage":{permission:x,subjectType:["workload"]}};var O=["sessionStore","userStore","customerStore","accessStore","tokenStore","magicLinkStore"];function S(X){if(X===null||typeof X!=="object")return X;let $={};for(let[Q,J]of Object.entries(X)){if(O.includes(Q)||Q==="validators"||Q==="setStores")continue;$[Q]=J!==null&&typeof J==="object"&&!Array.isArray(J)&&Object.getPrototypeOf(J)===Object.prototype?S(J):J}return $}function v(X){return S(X)}function j(X,$){if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`${$} must be an object.`);return X}function K(X,$){if(X===void 0)return;if(typeof X!=="string"||X.length===0||!Number.isFinite(Date.parse(X)))throw Error(`${$} must be a valid timestamp string.`);return X}function b(X,$,Q){if(!Array.isArray(X)||!Q.allowEmpty&&X.length===0)throw Error(`${$} keys must be ${Q.allowEmpty?"an":"a non-empty"} array.`);let J=new Set;return X.map((Z,F)=>{let B=j(Z,`${$} keys[${F}]`);if(typeof B.id!=="string"||B.id.length===0)throw Error(`${$} keys[${F}].id must be a non-empty string.`);if(J.has(B.id))throw Error(`${$} contains duplicate key id "${B.id}".`);if(J.add(B.id),!["pending","active","deprecated","revoked"].includes(String(B.state)))throw Error(`${$} keys[${F}].state is invalid.`);if(B.value!==void 0&&(typeof B.value!=="string"||B.value.length===0))throw Error(`${$} keys[${F}].value must be a non-empty string when present.`);let U=B.meta===void 0?void 0:j(B.meta,`${$} keys[${F}].meta`);return{id:B.id,state:B.state,...B.value===void 0?{}:{value:B.value},...B.notBefore===void 0?{}:{notBefore:K(B.notBefore,`${$} keys[${F}].notBefore`)},...B.notAfter===void 0?{}:{notAfter:K(B.notAfter,`${$} keys[${F}].notAfter`)},...U?{meta:{...U}}:{}}})}function k(X,$){let Q=`KMS ${$} pool`,J=j(X,Q);if(J.kind!==$)throw Error(`${Q} kind must be "${$}".`);if(typeof J.active!=="string"||J.active.length===0)throw Error(`${Q} active must be a non-empty key id.`);let Z=b(J.keys,Q,{allowEmpty:!1}),F=Z.find((B)=>B.id===J.active);if(!F)throw Error(`${Q} active key "${J.active}" is not present in keys.`);if(F.state!=="active")throw Error(`${Q} active key "${J.active}" must have state "active".`);if(!F.value)throw Error(`${Q} active key "${J.active}" must include a value.`);return{kind:$,active:J.active,keys:Z}}function w(X,$="token"){return k(X,$)}function y(X){let Q=j(X,"KMS allocation pool");if(Q.kind!=="allocation")throw Error('KMS allocation pool kind must be "allocation".');let J=b(Q.keys,"KMS allocation pool",{allowEmpty:!0}),Z=j(Q.assignments,"KMS allocation pool assignments"),F={},B=new Map(J.map((V)=>[V.id,V]));for(let[V,H]of Object.entries(Z)){if(V.length===0||typeof H!=="string"||H.length===0)throw Error("KMS allocation pool assignments must map non-empty client ids to non-empty key ids.");let G=B.get(H);if(!G)throw Error(`KMS allocation pool assignment for "${V}" references missing key "${H}".`);if(G.state!=="active"||!G.value)throw Error(`KMS allocation pool assignment for "${V}" must reference an active key with a value.`);F[V]=H}let U;if(Q.policy!==void 0){let V=j(Q.policy,"KMS allocation pool policy"),H=V.strategy;if(H!==void 0&&H!=="spread"&&H!=="low-quota-first")throw Error("KMS allocation pool policy.strategy is invalid.");let G=V.maxHoldersPerKey;if(G!==void 0&&(typeof G!=="number"||!Number.isInteger(G)||G<=0))throw Error("KMS allocation pool policy.maxHoldersPerKey must be a positive integer when present.");U={...H?{strategy:H}:{},...G===void 0?{}:{maxHoldersPerKey:G}}}return{kind:"allocation",keys:J,assignments:F,...U?{policy:U}:{}}}var T={trace:()=>{},debug:()=>{},info:()=>{},warn:()=>{},error:()=>{}},g=T,h={trace:()=>{},debug:console.debug,info:console.info,warn:console.warn,error:console.error},p={trace:()=>{},debug:()=>{},info:console.info,warn:console.warn,error:console.error},m={trace:()=>{},debug:()=>{},info:()=>{},warn:console.warn,error:console.error};function c(X,$){if(typeof $!=="number"||$<=0)return X;return new Promise((Q,J)=>{let Z=setTimeout(()=>{J(Error(`Authz catalog entry did not become ready within ${$}ms`))},$);X.then(()=>{clearTimeout(Z),Q()},(F)=>{clearTimeout(Z),J(F)})})}function u(X,$){let Q=!1,J,Z=$.then(()=>{Q=!0},(B)=>{Q=!1,J=B}),F=X;return Object.defineProperty(F,"ready",{enumerable:!1,configurable:!0,value:(B)=>c(Z.then(()=>{if(!Q)throw J}),B)}),Object.defineProperty(F,"isReady",{enumerable:!1,configurable:!0,value:()=>Q}),F}var d={beforeTenantSegments:["ui"]},l={beforeTenantSegments:["api"]};function L(X){return(X??[]).map(($)=>$.trim()).filter(Boolean)}function n(X){let $=X.trim();if(!$)return"/";let Q=$.replace(/\\/g,"/").replace(/\/+/g,"/");return Q.startsWith("/")?Q:`/${Q}`}function R(X){return n(X).split("/").filter(Boolean)}function Y(X){return{beforeTenantSegments:L(X?.beforeTenantSegments),afterTenantSegments:L(X?.afterTenantSegments)}}function a(X){return{type:"path",ui:Y(X?.ui),api:Y(X?.api)}}function i(X,$){let Q=Y($),J=Q.beforeTenantSegments??[],Z=Q.afterTenantSegments??[],F=R(X),B=J.length+1+Z.length;if(F.length<B)return null;for(let G=0;G<J.length;G++)if(F[G]!==J[G])return null;let U=J.length,V=F[U];if(!V)return null;for(let G=0;G<Z.length;G++)if(F[U+1+G]!==Z[G])return null;let H=F.slice(U+1+Z.length);return{id:decodeURIComponent(V),restSegments:H,restPath:H.length>0?`/${H.join("/")}`:"/"}}function o(X,$="/",Q){let J=Y(Q),Z=J.beforeTenantSegments??[],F=J.afterTenantSegments??[],B=R($),U=[...Z,encodeURIComponent(X),...F,...B];return U.length>0?`/${U.join("/")}`:"/"}function r(X){return{"~standard":{version:1,vendor:X,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let Q=$,J=[],Z={...Q},F=["iss","sub"];for(let V of F)if(V in Q){if(typeof Q[V]!=="string")J.push({message:`${V} must be a string`,path:[V]})}else J.push({message:`${V} is required`,path:[V]});if("aud"in Q&&Q.aud!==void 0){let V=Q.aud;if(typeof V!=="string"&&!Array.isArray(V))J.push({message:"aud must be a string or array of strings",path:["aud"]});else if(Array.isArray(V)&&!V.every((H)=>typeof H==="string"))J.push({message:"aud array must contain only strings",path:["aud"]})}let B=["jti","scope"];for(let V of B)if(V in Q&&Q[V]!==void 0){if(typeof Q[V]!=="string")J.push({message:`${V} must be a string`,path:[V]})}let U=["exp","iat"];for(let V of U)if(V in Q){if(typeof Q[V]!=="number")J.push({message:`${V} must be a number`,path:[V]})}else J.push({message:`${V} is required`,path:[V]});if(J.length>0)return{issues:J};return{value:Z}}}}}function t(X){return{"~standard":{version:1,vendor:X,validate:($)=>{if(typeof $!=="object"||$===null)return{issues:[{message:"Expected an object"}]};let Q=$,J=[],Z={};if("access_token"in Q)if(typeof Q.access_token==="string")Z.access_token=Q.access_token;else J.push({message:"access_token must be a string",path:["access_token"]});else J.push({message:"access_token is required",path:["access_token"]});if("token_type"in Q)if(typeof Q.token_type==="string")Z.token_type=Q.token_type;else J.push({message:"token_type must be a string",path:["token_type"]});else J.push({message:"token_type is required",path:["token_type"]});if("scope"in Q)if(typeof Q.scope==="string"||Q.scope===void 0)Z.scope=Q.scope;else J.push({message:"scope must be a string",path:["scope"]});if("refresh_token"in Q)if(typeof Q.refresh_token==="string"||Q.refresh_token===void 0)Z.refresh_token=Q.refresh_token;else J.push({message:"refresh_token must be a string",path:["refresh_token"]});if("expires"in Q)if(typeof Q.expires==="string"||Q.expires===void 0)Z.expires=Q.expires;else J.push({message:"expires must be a string",path:["expires"]});if("expires_in"in Q)if(typeof Q.expires_in==="number"||Q.expires_in===void 0)Z.expires_in=Q.expires_in;else J.push({message:"expires_in must be a number",path:["expires_in"]});if(J.length>0)return{issues:J};return{value:Z}}}}}function s(X){let $=new Uint8Array(X);return crypto.getRandomValues($),$}function e(X){let $="",Q=s(X);for(let J=0;J<X;J++){let Z=Q[J]%32;$+="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)}return $}function Q0(X,$){let Q="";for(let J=$;J>0;J--){let Z=X%32;Q="0123456789ABCDEFGHJKMNPQRSTVWXYZ".charAt(Z)+Q,X=Math.floor(X/32)}return Q}function X0(X){let $=Date.now(),Q=Q0($,10),J=e(16);return`${X??""}${Q}${J}`}export{t as workloadTokenResponseSchema,x0 as withValidate,m as warnLogger,_0 as waitOn,A as version,K0 as validationFailureResponse,m0 as userSchema,q0 as unionCatalogRead,$0 as trustedClientPermissionsForPrincipal,R0 as trimTrailingSlash,E0 as tokenResponseSchema,H0 as toCodeCatalog,T0 as stripJsonComments,A0 as stableConfigHash,T as silentLogger,v as serializeConfig,u as readyCatalogEntry,w as parseKmsPoolDocument,y as parseKmsAllocationPool,L0 as parseJsonc,C0 as parseEcid,D0 as oidcCallbackSchema,a as normalizeTenantRoutingStrategy,Y as normalizeTenantPathNamespace,S0 as must,b0 as mergeConfig,i as matchTenantPath,B0 as listGenerator,V0 as list,r as jwtAssertionClaimsSchema,v0 as isStoreConflictError,z0 as isEcid,_ as isConfigSourceError,w0 as isConfigLocator,G0 as isCodeCatalog,p as infoLogger,P0 as idTokenClaimsSchema,c0 as groupResourceSchema,X0 as generateULID,M0 as formatEcid,U0 as defineCatalog,g as defaultLogger,N0 as deepEqualPlain,f0 as decodeUser,h as debugLogger,J0 as configTrustedClientGrants,I0 as claimsToUser,o as buildTenantPath,h0 as assertValidSubjectTypeScoping,W0 as assertEcid,F0 as accessRootId,Z0 as accessRefId,O0 as StoreConflictError,g0 as PLATFORM_ASSIGNABLE_SUBJECT_TYPES,k0 as IoniteError,x as ION_TENANT_MANAGE,I as ION_SDK_PERMISSIONS,p0 as ION_SCIM_USER_EXTENSION_URN,C as ION_IAM_USERS_WRITE,M as ION_IAM_READ,W as ION_IAM_GROUPS_WRITE,f as ION_ENDPOINT_PERMISSIONS,E as ION_CIAM_MAGIC_LINK_CREATE,D as ION_CAPABILITIEZ_READ,P as ION_AUTHZ_OAA_SYNC,y0 as ION_AUTHZ_GROUP_SCHEMA,Y0 as EcidFormatError,j0 as ECID_SCHEME,d as DEFAULT_TENANT_UI_NAMESPACE,l as DEFAULT_TENANT_API_NAMESPACE,z as ConfigSourceError};

package/dist/server.d.ts

@@ -1984,28 +1984,33 @@ type IAM = IAMConfig & {
 */
 declare function iam(validators: IAMValidators, log: Logger, workload: Workload | undefined, authz: Authz, accessStore?: AccessAssignmentStore, accessIndex?: AccessIndex, catalogStore?: AccessCatalogStore, codeCatalog?: CodeCatalog, resources?: ResourceProvider, fromVault?: Partial<IAMConfig>, fromCode?: Partial<IAMConfig>, iamDelta?: IamDeltaEmitter, onAccessMutation?: (summary: ScimMutationSummary) => void, trustedClientGrants?: AccessChange[], authzQueueSettle?: () => Promise<void>): IAM | undefined;
 type KmsKeyState = "pending" | "active" | "deprecated" | "revoked";
+type KmsPoolKind = "token" | "allocation";
 type KmsTokenKey = {
 	id: string;
 	state: KmsKeyState;
 	value?: string;
 	notBefore?: string;
 	notAfter?: string;
+	/** Control-plane metadata used for allocation policy and UI. Consumers should treat it as opaque. */
+	meta?: Record<string, unknown>;
 };
-/** ConfigSource-owned pointer to a token-pool document. */
+/** ConfigSource-owned pointer to a KMS pool document. */
 type KmsPoolConfig = {
+	/** Pool semantics. Defaults to `token`. */
+	kind?: KmsPoolKind;
 	/** Named `ion.secrets` source. Omit to use the default `ion.secret` source. */
 	source?: string;
 	/** Secret path. Defaults to `/kms/{poolName}`. */
 	path?: string;
 };
-/** ConfigSource-owned named token-pool declarations. */
+/** ConfigSource-owned named KMS pool declarations. */
 type KmsConfig = Record<string, KmsPoolConfig>;
 type KmsPoolListener = (current: KmsTokenKey | undefined) => void;
 type KmsPool = {
-	/** Returns the usable active token metadata and value. Throws while the pool is not ready. */
-	current(): KmsTokenKey;
-	/** Returns keys accepted during the current overlap window (active plus usable deprecated keys). */
-	valid(): KmsTokenKey[];
+	/** Returns the usable token value, briefly awaiting only a locally scheduled imminent activation. */
+	value(): Promise<string>;
+	/** Timing-safe verification against the active token and usable deprecated overlap tokens. */
+	accepts(candidate: string): boolean;
 	/** Notifies immediately and whenever the selected active token changes. */
 	subscribe(listener: KmsPoolListener): () => void;
 	beforeChange(listener: ChangeListener): () => void;
@@ -2021,8 +2026,6 @@ type Kms = ModuleReadiness & {
 	readonly config: Readonly<KmsConfig>;
 	listPools(): string[];
 	getPool(name: string): KmsPool;
-	currentToken(name: string): string;
-	validTokens(name: string): KmsTokenKey[];
 };
 type OtelProtocol = "http/protobuf" | "http/json";
 type OtelProviderType = "otlp" | "grafana-lgtm" | "datadog" | "splunk" | "elastic";
@@ -2814,7 +2817,7 @@ type SecretLifecycleRequest = {
 	severity?: SecretRequestSeverity;
 	incidentRef?: string;
 };
-type SecretEventName = "rotate_requested" | "revoke_requested" | "created" | "updated" | "deleted" | "rotated" | "revoked" | "removed" | "acl_updated" | "path_removed" | "lease_expiring_soon" | "lease_revoked" | (string & {});
+type SecretEventName = "rotate_requested" | "revoke_requested" | "created" | "updated" | "deleted" | "rotated" | "revoked" | "removed" | "path_removed" | "lease_expiring_soon" | "lease_revoked" | (string & {});
 type SecretEvent = {
 	path: string;
 	event: SecretEventName;
@@ -4690,7 +4693,7 @@ declare class CatalogAdjacencyCache {
 	private readonly nodes;
 	private readonly subResources;
 	private readonly children;
-	constructor(catalog: AccessCatalogStore | undefined, resources?: ResourceProvider, code?: CodeCatalog);
+	constructor(catalog: AccessCatalogStore | undefined, resources?: ResourceProvider | undefined, code?: CodeCatalog | undefined);
 	getNode(kind: "group" | "role" | "permission" | "resource", id: string): Promise<Group2 | Role2 | Permission | Resource | undefined>;
 	/** Memoized direct children of a resource (provider `children()`, else `Resource.resources` refs). */
 	resourceChildren(id: string): Promise<Resource[]>;

package/dist/server.js

@@ -1 +1 @@
-import{A as s9,E as P1,I as o9,K as L9,L as $9,O as a4,P as t4,Q as B5,R as X9,T as I5,a as D9,d as l9,e as M5,f as W1,g as G1,h as Y9,i as B9,j as W9,k as n4,o as G9,u as A1,v as U9,w as k9,x as D1,y as n5,z as p}from"./shared/core-f0gk15rd.js";var J2="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",M9=["user","customer","workload"],Z2={user:async(J,Z)=>Z.sso?.getUser(J),customer:async(J,Z)=>Z.ciam?.getCustomer(J),workload:async(J,Z)=>{let $=await Z.workload?.getWorkloadIdentity?.(J);if(!$)return;let X=$.clientId??$.workloadId??$.claims.sub;return X?{...$,id:X}:void 0}};function $2(J){if(J==="any")return M9;let Z=Array.isArray(J)?J:[J];return M9.filter(($)=>Z.includes($))}function X2(J){let Z=J.headers.get("cookie");if(!Z)return[];return Z.split(";").map(($)=>$.slice(0,$.indexOf("=")===-1?$.length:$.indexOf("=")).trim()).filter(Boolean)}function Q2(J,Z){let $=J.headers.get("authorization")?.toLowerCase().startsWith("bearer ")??!1,X=X2(J),Q=new Set;for(let H of X){if(H.startsWith("ion.sso"))Q.add("user");if(H.startsWith("ion.ciam"))Q.add("customer")}let L=X.length>0&&!Q.has("user")&&!Q.has("customer");return Z.filter((H)=>{if(H==="workload")return $;if(X.length===0)return!1;return Q.has(H)||L})}function X5(J){return typeof J==="string"?J:J.id}function _9(J){let{subject:Z,subjectType:$}=J,X;if($==="user")X=Z.sso?.scope;else if($==="customer")X=Z.ciam?.scope;else if($==="workload")X=Z.scope;return new Set((X??"").split(/\s+/).filter(Boolean))}function b1(J,Z,$){let X=_9(J),Q=Z.filter((H)=>X.has(H));return{allow:$==="any"?Q.length>0:Z.length>0&&Q.length===Z.length,metadata:{reason:"scope",wantedScopes:Z,matchedScopes:Q}}}function d5(J,Z){return($)=>{if(J.length===0)return;let X=_9($),Q=J.filter((H)=>X.has(H));return(Z==="any"?Q.length>0:Q.length===J.length)?Q:void 0}}function H1(J,Z,$){return(X)=>{if(Z.length===0||X.subjectType!=="workload")return;let Q=D9(J.config?.authz,X.subject);if(!Q)return;let L=Z.filter((B)=>Q.has(B));return($==="any"?L.length>0:L.length===Z.length)?L:void 0}}function K2(J,Z){if(J.subjectType==="workload"){let $=J.subject.scopesAsEntitlements;if(typeof $==="boolean")return $}return Z.config?.authz?.scopesAsEntitlements===!0}function y1(J,Z,$,X,Q){return{allow:$==="ok",subject:Z?.subject,subjectType:Z?.subjectType,reason:$,decision:X,response(){if($==="ok")return new Response(null,{status:204});if($==="unauthenticated")return J.log.warn("authz.denied",{reason:$,...Q()}),Response.json({error:"Unauthorized"},{status:401});if($==="not_configured")return J.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...Q()}),Response.json({error:"not_configured"},{status:503});return J.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...Q()}),Response.json({error:"Forbidden"},{status:403})}}}function Y2(J,Z,$){return new Promise((X)=>{let Q=[],L=J.length,H=!1,B=()=>{if(L-=1,L===0&&!H)H=!0,X({outcomes:Q})};for(let W of J)Z(W).then((F)=>{if(Q.push({principal:W,decision:F}),!H&&F.allow){H=!0,X({matched:{principal:W,decision:F},outcomes:Q});return}B()},(F)=>{$?.(W,F),Q.push({principal:W,decision:{allow:!1,metadata:{reason:"error"}}}),B()})})}async function A5(J,Z,$,X,Q,L,H){p(Z,J2);let B=Q2(J,$2($)),F=(await Promise.all(B.map(async(q)=>{let c=await Z2[q](J,Z);return c?.id?{subject:c,subjectType:q,subjectId:c.id}:void 0}))).filter((q)=>q!==void 0);if(F.length===0)return y1(Z,void 0,"unauthenticated",void 0,Q);let g=async(q)=>{let c=Z.authz.accessIndex;if(!c?.isSubjectDisabled)return!1;return c.isSubjectDisabled(q.subjectId,q.subjectType)},u=async(q)=>{if(H){let c=H(q);if(c&&c.length>0){if(await g(q))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"trusted-client",matchedPermissions:c}}}}if(L&&K2(q,Z)){let c=L(q);if(c&&c.length>0){if(await g(q))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"scope",matchedScopes:c}}}}return X(q)},{matched:t,outcomes:o}=await Y2(F,u,(q,c)=>{Z.log.warn("authz.check_error",{"ion.operation":"authz.check","ion.outcome":"error",subject:q.subjectId,subjectType:q.subjectType,error:c instanceof Error?c.message:String(c),...Q()})});if(t){if(t.decision.metadata?.reason==="scope")Z.log.info("authz.scope_honor",{"ion.operation":"authz.scope_honor","ion.outcome":"allow",subject:t.principal.subjectId,subjectType:t.principal.subjectType,matchedScopes:t.decision.metadata.matchedScopes,...Q()});return y1(Z,t.principal,"ok",t.decision,Q)}let F5=o.length>0&&o.every((q)=>{let c=q.decision.metadata?.reason;return c==="access_index_not_configured"||c==="error"}),i=o[0],H5=F5?"not_configured":"forbidden";return y1(Z,i?.principal,H5,i?.decision,Q)}async function B2(J,Z,$,X,Q,L="any"){return A5(J,Z,L,(H)=>Z.authz.has(H.subjectId,$,X,Q,H.subjectType),()=>({targetType:$,target:X5(X),resource:Q?X5(Q):void 0}),Q?void 0:d5([X5(X)],"any"),$==="permission"&&!Q?H1(Z,[X5(X)],"any"):void 0)}async function W2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(L)=>Z.authz.hasPermission(L.subjectId,$,X,L.subjectType),()=>({targetType:"permission",target:X5($),resource:X?X5(X):void 0}),X?void 0:d5([X5($)],"any"),X?void 0:H1(Z,[X5($)],"any"))}async function G2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(L)=>Z.authz.hasRole(L.subjectId,$,X,L.subjectType),()=>({targetType:"role",target:X5($),resource:X?X5(X):void 0}),X?void 0:d5([X5($)],"any"))}async function L2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(L)=>Z.authz.hasGroup(L.subjectId,$,X,L.subjectType),()=>({targetType:"group",target:X5($),resource:X?X5(X):void 0}),X?void 0:d5([X5($)],"any"))}async function F2(J,Z,$,X="any"){let Q=$.filter((H)=>!H.resource).map((H)=>X5(H.target)),L=$.filter((H)=>!H.resource&&H.targetType==="permission").map((H)=>X5(H.target));return A5(J,Z,X,(H)=>Z.authz.hasAny(H.subjectId,$,H.subjectType),()=>({targets:$.map((H)=>`${H.targetType}:${X5(H.target)}`)}),Q.length>0?d5(Q,"any"):void 0,L.length>0?H1(Z,L,"any"):void 0)}async function H2(J,Z,$,X="any"){let Q=$.length>0&&$.every((B)=>!B.resource),L=$.length>0&&$.every((B)=>!B.resource&&B.targetType==="permission"),H=$.map((B)=>X5(B.target));return A5(J,Z,X,(B)=>Z.authz.hasAll(B.subjectId,$,B.subjectType),()=>({targets:$.map((B)=>`${B.targetType}:${X5(B.target)}`)}),Q?d5(H,"all"):void 0,L?H1(Z,H,"all"):void 0)}async function V2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,[$],"any")),()=>({scope:$}))}async function N2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,$,"any")),()=>({scopes:$}))}async function M2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,$,"all")),()=>({scopes:$}))}function K5(J){return typeof J==="string"&&J.length>0?J:void 0}function P9(J){let Z=K5(J.email);return{sub:String(J.sub??""),email:Z,name:K5(J.name),userName:K5(J.preferred_username)??Z,avatar:K5(J.picture)}}var z9={oidc:{flow:"id_token",scope:"openid profile email",branding:{displayName:"Single sign-on"},mapClaims:P9},google:{flow:"id_token",authorizationUrl:"https://accounts.google.com/o/oauth2/v2/auth",tokenUrl:"https://oauth2.googleapis.com/token",jwksUri:"https://www.googleapis.com/oauth2/v3/certs",scope:"openid email profile",branding:{displayName:"Google",iconUrl:"https://www.gstatic.com/firebasejs/ui/2.0.0/images/auth/google.svg",colors:{light:"#ffffff",dark:"#131314",secondary:"#4285F4"},url:"https://accounts.google.com"},mapClaims:P9},microsoft:{flow:"id_token",authorizationUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",tokenUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/token",jwksUri:"https://login.microsoftonline.com/common/discovery/v2.0/keys",scope:"openid email profile",branding:{displayName:"Microsoft",colors:{light:"#ffffff",dark:"#2f2f2f",secondary:"#0067b8"},url:"https://login.microsoftonline.com"},mapClaims:(J)=>{let Z=K5(J.email)??K5(J.preferred_username);return{sub:String(J.sub??J.oid??""),email:Z,name:K5(J.name),userName:K5(J.preferred_username)??Z,avatar:K5(J.picture)}}},apple:{flow:"id_token",authorizationUrl:"https://appleid.apple.com/auth/authorize",tokenUrl:"https://appleid.apple.com/auth/token",jwksUri:"https://appleid.apple.com/auth/keys",scope:"openid email name",extraAuthParams:{response_mode:"form_post"},branding:{displayName:"Apple",colors:{light:"#000000",dark:"#ffffff"},url:"https://appleid.apple.com"},mapClaims:(J)=>{let Z=K5(J.email);return{sub:String(J.sub??""),email:Z,name:K5(J.name),userName:Z}}},github:{flow:"userinfo",authorizationUrl:"https://github.com/login/oauth/authorize",tokenUrl:"https://github.com/login/oauth/access_token",userInfoUrl:"https://api.github.com/user",scope:"read:user user:email",branding:{displayName:"GitHub",colors:{light:"#24292f",dark:"#ffffff"},url:"https://github.com"},mapClaims:(J)=>({sub:String(J.id??J.node_id??""),email:K5(J.email),name:K5(J.name)??K5(J.login),userName:K5(J.login),avatar:K5(J.avatar_url)})}};function q1(J){if(J==="magic-link")return;return z9[J]}function V1(J,Z){if(Z.type==="magic-link")return;let $=q1(Z.type);if(!$)return;return{name:J,type:Z.type,flow:$.flow,authorizationUrl:Z.authorizationUrl??$.authorizationUrl,tokenUrl:Z.tokenUrl??$.tokenUrl,jwksUri:Z.jwksUri??$.jwksUri,userInfoUrl:Z.userInfoUrl??$.userInfoUrl,scope:Z.scope??$.scope,clientId:Z.clientId,clientSecret:Z.clientSecret,extraAuthParams:$.extraAuthParams,branding:{...$.branding,...Z.branding},mapClaims:$.mapClaims,config:Z}}function C1(J){return{...q1(J.type)?.branding??{displayName:J.type},...J.branding}}function v1(J){if(!J)return[];return Object.entries(J).filter(([,Z])=>Z.enabled!==!1).map(([Z,$],X)=>({name:Z,config:$,index:X})).sort((Z,$)=>{let X=Z.config.order??Number.MAX_SAFE_INTEGER,Q=$.config.order??Number.MAX_SAFE_INTEGER;if(X!==Q)return X-Q;return Z.index-$.index}).map(({name:Z,config:$})=>({name:Z,config:$}))}var E9=600000,k1=256,L5=new Map;function D2(J){if(typeof J?.ttlMs==="number"&&Number.isFinite(J.ttlMs))E9=Math.min(Math.max(J.ttlMs,60000),86400000);if(typeof J?.maxEntries==="number"&&Number.isFinite(J.maxEntries)){k1=Math.max(1,Math.floor(J.maxEntries));while(L5.size>k1){let Z=L5.keys().next().value;if(Z===void 0)break;L5.delete(Z)}}}function O9(J,Z){L5.delete(J),L5.set(J,Z);while(L5.size>k1){let $=L5.keys().next().value;if($===void 0)break;L5.delete($)}}var o5=new Map,f1=()=>Date.now();function _2(J){f1=J??(()=>Date.now())}var h1={};function P2(J){h1=J??{}}function z2(J){if(!J)return;if(/\bno-store\b/i.test(J))return 60000;let Z=/max-age\s*=\s*(\d+)/i.exec(J);if(!Z)return;let $=Number(Z[1]);return Number.isFinite($)?$*1000:void 0}function O2(J){let $=z2(J)??E9;return Math.min(Math.max($,60000),86400000)}async function g1(J,Z=3,$=1000,X=30000,Q){let L=Error("Placeholder Error");for(let H=0;H<=Z;H++)try{return await J()}catch(B){if(L=B instanceof Error?B:Error(String(B)),B instanceof Error&&B.message.includes("400"))throw B;if(H===Z)throw L;let W=Math.min($*2**H,X),F=Math.random()*0.1*W;await new Promise((g)=>setTimeout(g,W+F)),Q?.warn(`Retry attempt ${H+1} after ${W+F}ms delay`)}throw L}async function r5(J,Z,$){let X=L5.get(J);if(!$?.forceRefresh&&X&&X.expiresAt>f1())return O9(J,X),X.jwks;let Q=o5.get(J);if(Q)return Q;let L=(async()=>{try{return await g1(async()=>{let H=await fetch(J);if(!H.ok)throw Error("Failed to fetch JWKS");let B=await H.json(),W=O2(H.headers.get("cache-control"));return O9(J,{jwks:B,expiresAt:f1()+W,importedKeys:new Map}),B},h1.maxRetries,h1.baseDelayMs,void 0,Z)}catch(H){let B=L5.get(J);if(B)return Z?.warn("JWKS refresh failed; serving last-known-good keys",{"ion.operation":"jwks.refresh","ion.outcome":"degraded"}),B.jwks;throw H}finally{o5.delete(J)}})();return o5.set(J,L),L}function E2(J){if(J){L5.delete(J),o5.delete(J);return}L5.clear(),o5.clear()}async function j2(J,Z,$){return(await j9(J,Z,$)).jwk}async function j9(J,Z,$){if(!Z?.trim())throw Error("JWT header missing kid");await r5(J,$);let X=L5.get(J),Q=X?.jwks.keys.find((L)=>L.kid===Z);if(!Q)await r5(J,$,{forceRefresh:!0}),X=L5.get(J),Q=X?.jwks.keys.find((L)=>L.kid===Z);if(!X||!Q)throw Error("Public key not found");return{jwk:Q,entry:X}}async function m1(J,Z,$,X,Q){let{jwk:L,entry:H}=await j9(J,Z,Q),B=`${Z}\x00${$}`,W=H.importedKeys.get(B);if(W)return W;let F=X(L);return F.catch(()=>{if(H.importedKeys.get(B)===F)H.importedKeys.delete(B)}),H.importedKeys.set(B,F),F}async function A2(J,Z){let $=J.keys.find((X)=>X.kid===Z);if(!$)throw Error("Public key not found");return A9($)}function A9(J){return crypto.subtle.importKey("jwk",{kty:J.kty,n:J.n,e:J.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}async function w2(J,Z,$){return m1(J,Z,"rs256",A9,$)}var U1={RS256:{kty:"RSA",importParams:{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},verifyParams:{name:"RSASSA-PKCS1-v1_5"}},ES256:{kty:"EC",crv:"P-256",importParams:{name:"ECDSA",namedCurve:"P-256"},verifyParams:{name:"ECDSA",hash:"SHA-256"}}};async function p1(J,Z,$,X){if(typeof $!=="string"||!($ in U1))throw Error(`Unsupported JWT alg "${String($)}" (allowed: ${Object.keys(U1).join(", ")})`);let Q=U1[$];return{key:await m1(J,Z,`oidc:${$}`,(H)=>{if(H.kty!==Q.kty)throw Error(`JWK type "${H.kty}" does not match token alg "${$}"`);if(Q.kty==="EC"){let B=H;if(B.crv!==Q.crv)throw Error(`JWK curve "${String(B.crv)}" does not match token alg "${$}"`);return crypto.subtle.importKey("jwk",{kty:"EC",crv:B.crv,x:B.x,y:B.y},Q.importParams,!1,["verify"])}return crypto.subtle.importKey("jwk",{kty:H.kty,n:H.n,e:H.e},Q.importParams,!1,["verify"])},X),algorithm:Q.verifyParams}}function _5(J=32){let Z=new Uint8Array(J);return crypto.getRandomValues(Z),Array.from(Z,($)=>$.toString(16).padStart(2,"0")).join("").substring(0,J)}function N1(J){let Z="";return J.forEach(($)=>{Z+=String.fromCharCode($)}),btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function T9(J){let Z=J.replace(/-/g,"+").replace(/_/g,"/"),$=Z.padEnd(Z.length+(4-Z.length%4)%4,"="),X=atob($),Q=new Uint8Array(X.length);for(let L=0;L<X.length;L++)Q[L]=X.charCodeAt(L);return Q}function w9(J){let Z=new TextDecoder().decode(T9(J));return JSON.parse(Z)}async function J1(J){let Z=new TextEncoder().encode(J),$=await crypto.subtle.digest("SHA-256",Z);return N1(new Uint8Array($))}function l1(J){let Z=new URL(J.authorizationUrl);if(Z.searchParams.set("client_id",J.clientId),Z.searchParams.set("redirect_uri",J.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("scope",J.scope),Z.searchParams.set("state",J.state),J.codeChallenge)Z.searchParams.set("code_challenge",J.codeChallenge),Z.searchParams.set("code_challenge_method","S256");if(J.nonce)Z.searchParams.set("nonce",J.nonce);for(let[$,X]of Object.entries(J.extraParams??{}))Z.searchParams.set($,X);return Z.toString()}async function c1(J){let Z=new URLSearchParams;if(Z.append("grant_type","authorization_code"),Z.append("code",J.code),Z.append("redirect_uri",J.redirectUri),Z.append("client_id",J.clientId),J.clientSecret)Z.append("client_secret",J.clientSecret);if(J.codeVerifier)Z.append("code_verifier",J.codeVerifier);let $=await fetch(J.tokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:Z.toString()}),X=await $.json();if(!$.ok){let Q=X;throw J.log?.error("OIDC authorization-code exchange failed",{"ion.operation":"token.exchange","ion.outcome":"failure","http.status_code":$.status,oidc_error:Q.error}),Error(`Token exchange failed: ${Q.error||$.statusText} - ${Q.error_description||""}`.trim())}if(typeof X.access_token!=="string")throw Error("Token exchange response missing access_token");return X}var S9=60;function e5(J){return J.trim().replace(/\/$/,"")}function R9(J){let{claims:Z,audience:$}=J,X=e5(J.issuer),Q=J.nowSec??Math.floor(Date.now()/1000),L=J.clockSkewSec??S9,H=Z.iss;if(typeof H!=="string"||e5(H)!==X)throw Error("ID token issuer mismatch");let B=Z.aud,W=Array.isArray(B)?B.includes($):typeof B==="string"&&B===$,F=typeof Z.azp==="string"&&Z.azp===$;if(!W&&!F)throw Error("ID token audience mismatch");if(typeof Z.exp!=="number")throw Error("ID token missing exp");if(Z.exp<Q-L)throw Error("ID token expired");if(J.expectedNonce!==void 0){if(Z.nonce!==J.expectedNonce)throw Error("ID token nonce mismatch")}}async function x9(J,Z,$){let X=J.split(".");if(X.length!==3)throw Error("Invalid JWT");let Q=w9(X[0]),L=w9(X[1]),H=T9(X[2]),{key:B,algorithm:W}=await p1(Z,Q.kid,Q.alg,$),F=new TextEncoder().encode(`${X[0]}.${X[1]}`);if(!await crypto.subtle.verify(W,B,H,F))throw Error("Invalid JWT signature");return{header:Q,payload:L}}async function S5(J){let{payload:Z}=await x9(J.idToken,J.jwksUri,J.log);return R9({claims:Z,issuer:J.issuer,audience:J.audience,clockSkewSec:J.clockSkewSec,expectedNonce:J.expectedNonce}),Z}var I2="http://schemas.openid.net/event/backchannel-logout";async function d1(J){let{payload:Z}=await x9(J.logoutToken,J.jwksUri,J.log),$=e5(J.issuer),X=Z.iss;if(typeof X!=="string"||e5(X)!==$)throw Error("Logout token issuer mismatch");let Q=Z.aud,L=Array.isArray(Q)?Q.includes(J.audience):typeof Q==="string"&&Q===J.audience,H=typeof Z.azp==="string"&&Z.azp===J.audience;if(!L&&!H)throw Error("Logout token audience mismatch");if(Z.nonce!=null)throw Error("Logout token must not contain a nonce");let B=Z.events;if(!(typeof B==="object"&&B!==null&&!Array.isArray(B)&&Object.hasOwn(B,I2)))throw Error("Logout token missing back-channel logout event");let F=typeof Z.sid==="string"&&Z.sid.length>0,g=typeof Z.sub==="string"&&Z.sub.length>0;if(!F&&!g)throw Error("Logout token missing sid and sub");if(typeof Z.exp==="number"){let u=Math.floor(Date.now()/1000),t=J.clockSkewSec??S9;if(Z.exp<u-t)throw Error("Logout token expired")}return Z}var T2=3600000,S2=60000,R2=86400000,x2=256,w5=new Map,s5=new Map;function I9(J,Z){w5.delete(J),w5.set(J,Z);while(w5.size>x2){let $=w5.keys().next().value;if($===void 0)break;w5.delete($)}}var u1=()=>Date.now();function y2(J){u1=J??(()=>Date.now())}function b2(J){if(J){w5.delete(J),s5.delete(J);return}w5.clear(),s5.clear()}function q2(J){let Z=J?/max-age\s*=\s*(\d+)/i.exec(J):null,$=Z?Number(Z[1]):Number.NaN,X=Number.isFinite($)?$*1000:T2;return Math.min(Math.max(X,S2),R2)}async function n1(J){let Z=w5.get(J);if(Z&&Z.expiresAt>u1())return I9(J,Z),Z.endpoints;let $=s5.get(J);if($)return $;let X=(async()=>{try{let Q=J.replace(/\/$/,""),L=await fetch(`${Q}/.well-known/openid-configuration`,{headers:{Accept:"application/json"}});if(!L.ok)throw Error(`OIDC discovery failed for ${J} with status ${L.status}`);let H=await L.json(),B={authorizationUrl:typeof H.authorization_endpoint==="string"?H.authorization_endpoint:void 0,tokenUrl:typeof H.token_endpoint==="string"?H.token_endpoint:void 0,jwksUri:typeof H.jwks_uri==="string"?H.jwks_uri:void 0,userInfoUrl:typeof H.userinfo_endpoint==="string"?H.userinfo_endpoint:void 0};return I9(J,{endpoints:B,expiresAt:u1()+q2(L.headers.get("cache-control"))}),B}catch(Q){let L=w5.get(J);if(L)return L.endpoints;throw Q}finally{s5.delete(J)}})();return s5.set(J,X),X}async function a1(J,Z){let $=await fetch(J,{headers:{Authorization:`Bearer ${Z}`,Accept:"application/json","User-Agent":"ionite-ciam"}});if(!$.ok)throw Error(`UserInfo request failed with status ${$.status}`);return await $.json()}function C2(J){let Z=J.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,""),$=atob(Z),X=new Uint8Array($.length);for(let Q=0;Q<$.length;Q++)X[Q]=$.charCodeAt(Q);return X}async function t1(J){let Z=Math.floor(Date.now()/1000),$={alg:"ES256",kid:J.keyId,typ:"JWT"},X={iss:J.teamId,iat:Z,exp:Z+(J.expiresInSeconds??3600),aud:"https://appleid.apple.com",sub:J.clientId},Q=N1(new TextEncoder().encode(JSON.stringify($))),L=N1(new TextEncoder().encode(JSON.stringify(X))),H=`${Q}.${L}`,B=await crypto.subtle.importKey("pkcs8",C2(J.privateKey),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),W=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},B,new TextEncoder().encode(H));return`${H}.${N1(new Uint8Array(W))}`}function v2(J){for(let Z=0;Z<J.length;Z++){let $=J.charCodeAt(Z);if($<=31||$===127)return!0}return!1}function U2(J,Z){let $=null;try{$=new URL(J,Z)}catch{$=null}let X="";try{X=new URL(Z).origin}catch{X=""}return{candidate:J,url:$,requestOrigin:X}}function y9(J,Z,$){let X=U2(J,$),Q=!1;for(let L of Z){let H=L(X);if(H==="deny")return!1;if(H==="allow")Q=!0}return Q}function b9(){return({candidate:J,url:Z})=>{if(v2(J))return"deny";if(J.includes("\\"))return"deny";if(J.startsWith("//"))return"deny";if(!Z)return"deny";if(Z.protocol!=="http:"&&Z.protocol!=="https:")return"deny";if(Z.username||Z.password)return"deny";return"abstain"}}function q9(){return({candidate:J})=>J.startsWith("/")&&!J.startsWith("//")&&!J.startsWith("/\\")?"allow":"abstain"}function C9(){return({url:J,requestOrigin:Z})=>J&&Z&&J.origin===Z?"allow":"abstain"}function k2(...J){let Z=new Set(J.map(($)=>{try{return new URL($).origin}catch{return $}}));return({url:$})=>$&&Z.has($.origin)?"allow":"abstain"}function f2(...J){let Z=J.map(($)=>$.toLowerCase());return({url:$})=>{if(!$)return"abstain";let X=$.hostname.toLowerCase();for(let Q of Z)if(Q.startsWith(".")){if(X===Q.slice(1)||X.endsWith(Q))return"allow"}else if(X===Q)return"allow";return"abstain"}}function i1(){return[b9(),q9(),C9()]}function v9(J,Z,$){if(!J)return!1;return y9(J,Z,$)}function o1(J,Z){if(!J)return Z.fallback;return y9(J,Z.rules,Z.requestUrl)?J:Z.fallback}var h2={rules:i1(),fallback:"/"};function g2(J,Z,$="redirect"){let X=new URL(J.url).searchParams.get($)??void 0;return v9(X,Z.rules,J.url)?{redirect:X}:void 0}function m2(J,Z){let $=J.context;return o1($?.redirect,{rules:Z.rules,fallback:Z.fallback,requestUrl:J.request.url})}function R5(J,Z,$){if(J instanceof Response)return{response:J};if(typeof J==="string")return{location:o1(J,{rules:i1(),fallback:Z,requestUrl:$})};return{location:Z}}function C5(J,Z){if(Z.length===0)return J;let $=new Headers(J.headers);for(let X of Z)$.append("Set-Cookie",X);return new Response(J.body,{status:J.status,statusText:J.statusText,headers:$})}var M1="ciam",p2="id_token",u2="access_token";function l2(J,Z,$,X,Q,L){if(!$&&!X)return;let H=new WeakMap,B={...$,...X},W={...B,magicLinkTtl:B.magicLinkTtl??3600,sessionTtl:B.sessionTtl??86400,cookiesSecure:B.cookiesSecure!==void 0?B.cookiesSecure:!0,cookiesSameSite:B.cookiesSameSite!==void 0?B.cookiesSameSite:"Strict",cookiesPrefix:B.cookiesPrefix??(B.ciamId?`ion.ciam.${B.ciamId}`:"ion.ciam"),cookiesPath:B.cookiesPath??"/"};function F(){if(!W.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and first-party logout.");return W.sessionStore}function g(){F()}let u=J.callbackParams??n5(U9("ionite.ciam")),t=J.idTokenClaims??n5(D1("ionite.ciam")),o=J.tokenResponse??n5(k9("ionite.ciam"));function F5(K=32){let N=new Uint8Array(K);return crypto.getRandomValues(N),Array.from(N,(V)=>V.toString(16).padStart(2,"0")).join("").substring(0,K)}function i(K,N,V,D=W.cookiesSameSite??"Strict"){if(!W)throw Error("ionite CIAM Manager not initialized");if(K=`${W.cookiesPrefix}.${K}`,typeof N!=="string")N=btoa(JSON.stringify(N));let E;if(V instanceof Date)E=`Expires=${V.toUTCString()}`;else if(typeof V==="number")E=`Max-Age=${V}`;else throw Error("Invalid expires type",V);if(N.length>4000)throw Error(`Error setting cookie: ${K}. Cookie length is: ${N.length}`);return`${K}=${N}; ${E}; Path=${W.cookiesPath}; HttpOnly;${W.cookiesSecure?" Secure;":""} SameSite=${D};`}function H5(K){if(!W)throw Error("ionite CIAM Manager not initialized");return`${W.cookiesPrefix}.${K}=; Max-Age=0; Path=${W.cookiesPath}; HttpOnly;${W.cookiesSecure?" Secure;":""} SameSite=${W.cookiesSameSite};`}function q(K,N,V=!1){if(!W)throw Error("ionite CIAM Manager not initialized");let D=N.headers.get("cookie");if(!D)return null;let E=`${W.cookiesPrefix}.${K}`,A=D.split(";").find((j)=>j.trim().startsWith(`${E}=`));if(!A)return null;let _=A.indexOf("="),M=A.substring(_+1).trim();if(!V)return M;try{let j=atob(M);return JSON.parse(j)}catch(j){return Z.error("[CIAM] Failed to parse cookie",{"ion.operation":"cookie.parse","ion.outcome":"failure",cookieName:E},j),null}}function c(K){return`cstate_${K}`}async function Q5(K,N,V,D){let E=await W.afterLogin?.({...N,request:K,context:V}),A=R5(E,"/",K.url);if(A.response)return C5(A.response,D.map(([,_])=>_));return new Response(N.ok?"Authentication successful, redirecting":"Authentication failed, redirecting",{status:302,headers:[["Location",A.location],...D]})}function r(K,N){return["Set-Cookie",i("session",K,N)]}function $5(K){if(!K)return;if(K instanceof Date)return K;let N=new Date(K);return Number.isNaN(N.getTime())?void 0:N}async function D5(K){let N=q("session",K);if(!N)return;let V=await F().get(N);if(V&&W.tenantId&&V.tenantId&&V.tenantId!==W.tenantId)return;if(V?.authType!=="ciam")return;let D=$5(V.expiresAt);if(D&&Date.now()>D.getTime()){await F().delete(N);return}return V}async function f5(K){if(!W)throw Error("ionite CIAM Manager not initialized");g();let N=H.get(K);if(N)return N;let V=h5(K);return H.set(K,V),V}async function h5(K){try{let N=await D5(K);if(!N?.claims?.sub)return{status:"unauthenticated"};return{status:"authenticated",value:z5(N.claims)}}catch(N){return Z.error("CIAM session resolution failed",{"ion.operation":"ciam.session","ion.outcome":"degraded"},N),{status:"degraded",error:N instanceof Error?N:void 0}}}async function g5(K){let N=await f5(K);return N.status==="authenticated"?N.value:void 0}async function m5(K){if(!W)throw Error("ionite CIAM Manager not initialized");g();let N;try{N=await g5(K)}catch{N=void 0}let V=await W.beforeLogout?.({request:K,user:N});try{let P=q("session",K);if(P)await F().delete(P)}catch(P){Z.warn("Failed to delete CIAM session",{"ion.operation":"session.delete","ion.outcome":"degraded"},P)}let D=[["Set-Cookie",H5("session")]],E=await W.afterLogout?.({request:K,context:V}),A=R5(E,"/",K.url);if(A.response)return C5(A.response,D.map(([,P])=>P));let _=A.location??"/",M=K.headers.get("accept");if(M?.includes("application/json")||M?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:_}),{status:200,headers:[["Content-Type","application/json"],...D]});return new Response("Logged out",{status:302,headers:[["Location",_],...D]})}function p5(K){return K.id||K.email||`ciam-${K.userName}`}function T5(K,N,V){return{sub:p5(K),iss:M1,aud:M1,typ:p2,exp:Math.floor(V.getTime()/1000),iat:Math.floor(Date.now()/1000),email:K.email,name:K.name,preferred_username:K.userName,picture:K.avatar,sid:N}}function b5(K,N,V){return{sub:K,iss:M1,aud:M1,typ:u2,exp:Math.floor(V.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:N,scope:"openid profile email"}}function z5(K){let N=K.exp?new Date(K.exp*1000):new Date;return{id:K.sub,userName:K.preferred_username??"",name:K.name??"",email:K.email??"",avatar:K.picture,userType:"customer",ciam:{profile:K,scope:"openid profile email",tokenType:"Bearer",expires:N}}}async function u5(K){if(!W)throw Error("ionite CIAM Manager not initialized");if(!Q)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:{"Content-Type":"application/json"}});if(!await Q.getWorkloadIdentity(K))return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:{"Content-Type":"application/json"}});let V,D;try{if(!K.headers.get("content-type")?.includes("application/json"))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:{"Content-Type":"application/json"}});let b=await K.text(),C=JSON.parse(b);D=typeof C?.redirect==="string"&&C.redirect.length>0?C.redirect:void 0;let U={userName:C.userName,name:C.name,email:C.email,avatar:C.avatar},Y=await J.customer.validate(U);if(Y.issues)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:{"Content-Type":"application/json"}});V=Y.value}catch(v){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:{"Content-Type":"application/json"}})}let A=new URL(K.url).searchParams.get("ttl"),_=A?parseInt(A,10):W.magicLinkTtl??3600;if(Number.isNaN(_)||_<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:{"Content-Type":"application/json"}});let M=F5(32),j=new Date(Date.now()+_*1000);if(!W.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:500,headers:{"Content-Type":"application/json"}});try{await W.magicLinkStore.create(M,V,j)}catch(v){return Z.error("Error creating magic link",{"ion.operation":"magic_link.create","ion.outcome":"failure"},v),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:{"Content-Type":"application/json"}})}let P=new URL(K.url),I=W.magicLinkLoginUrl||"/magic-link/login",T=new URL(I,P.origin);if(T.searchParams.set("token",M),D)T.searchParams.set("redirect",D);return new Response(JSON.stringify({magicLink:T.toString(),expiresAt:j.toISOString()}),{status:200,headers:{"Content-Type":"application/json"}})}async function l5(K){if(!W)throw Error("ionite CIAM Manager not initialized");g();let V=new URL(K.url).searchParams.get("token");if(!V)return Q5(K,{ok:!1,error:Error("Missing magic-link token")},void 0,[]);if(!W.magicLinkStore)return Q5(K,{ok:!1,error:Error("Magic link store not configured")},void 0,[]);let D=await W.magicLinkStore.getAndDelete(V);if(!D)return Q5(K,{ok:!1,error:Error("Magic link invalid, expired, or already used")},void 0,[]);let E=new Date(Date.now()+(W.sessionTtl??86400)*1000),A=F5(32),_=p5(D.customer),M=T5(D.customer,A,E),j=b5(_,A,E),P=z5(M),I;try{let v={sid:A,sub:_,authType:"ciam",tenantId:W.tenantId,expiresAt:E,claims:M,accessClaims:j,createdAt:new Date};await F().create(v),I=v}catch(v){throw Z.warn("Failed to create session",{"ion.operation":"session.create","ion.outcome":"degraded"},v),v}if(W.customerStore)try{let v=P.id;if(v){let b=new Date,C=await W.customerStore.get(v);if(C||W.enableJitUserProvisioning){let U={...C??{},...P,id:v,tenantId:C?.tenantId,createdAt:C?.createdAt??b,updatedAt:b,userType:C?.userType??"customer"};await W.customerStore.upsert(U)}}}catch(v){Z.warn("Failed to store customer",{"ion.operation":"customer.store","ion.outcome":"degraded"},v)}let T=[r(A,E)];return Q5(K,{ok:!0,user:P,session:I},void 0,T)}function V5(K,N=200,V=[]){return new Response(JSON.stringify(K),{status:N,headers:[["Content-Type","application/json"],...V]})}function W5(K,N){try{return new URL(K).toString()}catch{let V=new URL(N).origin,D=W.cookiesSecure?V.replace(/^http:\/\//,"https://"):V;return new URL(K,D).toString()}}function c5(){let K=W.customerLoginUrl||"/auth/customer/login",N=K.includes("?")?"&":"?";return v1(W.providers).map(({name:V,config:D})=>{let E=C1(D);return{name:V,type:D.type,displayName:E.displayName,loginUrl:`${K}${N}provider=${encodeURIComponent(V)}`,iconUrl:E.iconUrl,colors:E.colors,url:E.url}})}async function x(K){if(!K)return{};let{authorizationUrl:N,tokenUrl:V,jwksUri:D,userInfoUrl:E}=K,A=K.config.authority;if(A&&(!N||!V||K.flow==="id_token"&&!D))try{let M=await n1(A);N=N??M.authorizationUrl,V=V??M.tokenUrl,D=D??M.jwksUri,E=E??M.userInfoUrl}catch(M){Z.error("CIAM provider OIDC discovery failed",{"ion.operation":"ciam.oidc.discovery","ion.outcome":"failure"},M)}return{authorizationUrl:N,tokenUrl:V,jwksUri:D,userInfoUrl:E}}async function k(K){if(K.type==="apple"){let{teamId:N,keyId:V,privateKey:D,clientId:E}=K.config;if(N&&V&&D&&E)return t1({teamId:N,keyId:V,privateKey:D,clientId:E})}return K.clientSecret}async function m(K){F();let V=new URL(K.url).searchParams.get("provider");if(!V)return V5({error:"Missing required query parameter: provider"},400);let D=W.providers?.[V];if(!D||D.enabled===!1||D.type==="magic-link")return V5({error:`Unknown or disabled CIAM provider: ${V}`},404);let E=V1(V,D);if(!E?.clientId)return V5({error:`CIAM provider ${V} is not fully configured`},500);let A=await x(E);if(!A.authorizationUrl)return V5({error:`CIAM provider ${V} is missing an authorization endpoint`},500);let _=W.customerCallbackUrl||"/auth/customer/callback",M=W5(_,K.url),j=_5(),P=_5(64),I=_5(),T=E.flow==="id_token",v=T?await J1(P):void 0,b=await W.beforeLogin?.({request:K}),C=l1({authorizationUrl:A.authorizationUrl,clientId:E.clientId,redirectUri:M,scope:E.scope,state:j,codeChallenge:v,nonce:I,extraParams:E.extraAuthParams}),U={provider:V,state:j,codeVerifier:T?P:void 0,nonce:I,redirectUri:M,...b===void 0?{}:{context:b}};return new Response("Redirecting to CIAM provider",{status:302,headers:[["Location",C],["Set-Cookie",i(c(j),U,W.loginStateTtl??600,"Lax")]]})}async function d(K){if(K.method==="POST"){if((K.headers.get("content-type")??"").includes("application/x-www-form-urlencoded")){let V=await K.text();return Object.fromEntries(new URLSearchParams(V).entries())}}return Object.fromEntries(new URL(K.url).searchParams.entries())}async function s(K,N){let V=K.mapClaims(N);if(!V.sub)return{ok:!1};let D=`${K.name}:${V.sub}`,E={id:D,userName:V.userName||V.email||D,name:V.name||"",email:V.email||"",avatar:V.avatar,userType:"customer"},A=D;if(W.customerStore){let T=await W.customerStore.lookup(E)??await W.customerStore.get(D);if(A=T?.id??D,!T&&!W.enableJitUserProvisioning)return Z.warn("CIAM JIT customer provisioning disabled: unknown customer rejected",{"ion.operation":"customer.store","ion.outcome":"skipped"}),{ok:!1};let v=new Date,b={...T??{},...E,id:A,tenantId:T?.tenantId,createdAt:T?.createdAt??v,updatedAt:v,userType:T?.userType??"customer"};await W.customerStore.upsert(b)}let _=new Date(Date.now()+(W.sessionTtl??86400)*1000),M=_5(32),j={sub:A,iss:K.name,aud:K.clientId,exp:Math.floor(_.getTime()/1000),iat:Math.floor(Date.now()/1000),email:V.email,name:V.name,preferred_username:V.userName??V.email,picture:V.avatar,sid:M},P={sid:M,sub:A,authType:"ciam",tenantId:W.tenantId,expiresAt:_,claims:j,accessClaims:{sub:A,sid:M,scope:K.scope},createdAt:new Date},I=F();try{await I.create(P)}catch(T){if(!await I.get(M))throw T;await I.update(M,P)}return{ok:!0,claims:j,sid:M,expires:_}}async function G(K){F();let N,V,D=(E)=>{let A=N?[["Set-Cookie",H5(N)]]:[];return Q5(K,{ok:!1,error:E},V,A)};try{let E=await d(K),A=await u.validate(E);if(A.issues||!A.value)return D(Error("Invalid CIAM callback parameters"));let{code:_,state:M}=A.value;if(!M)return D(Error("Missing CIAM callback state"));N=c(M);let j=q(N,K,!0);if(V=j?.context,!j?.provider||!j.state||j.state!==M)return Z.warn("CIAM callback state verification failed",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),D(Error("CIAM callback state verification failed"));let P=W.providers?.[j.provider];if(!P)return D(Error("Unknown CIAM provider"));let I=V1(j.provider,P);if(!I?.clientId)return D(Error("CIAM provider not configured"));let T=await x(I);if(!T.tokenUrl)return D(Error("CIAM provider missing token endpoint"));let v=await k(I),b=await c1({tokenUrl:T.tokenUrl,clientId:I.clientId,clientSecret:v,redirectUri:j.redirectUri||W5(W.customerCallbackUrl||"/auth/customer/callback",K.url),code:_,codeVerifier:I.flow==="id_token"?j.codeVerifier:void 0,log:Z}),C;if(I.flow==="id_token"){let S=I.config.authority;if(!b.id_token||!T.jwksUri||!S)return D(Error("CIAM id_token flow misconfigured"));if(!j.nonce)return D(Error("CIAM callback state cookie missing nonce"));if((await o.validate(b)).issues)return Z.warn("CIAM token response validation failed",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),D(Error("CIAM token response validation failed"));C=await S5({idToken:b.id_token,jwksUri:T.jwksUri,issuer:S,audience:I.clientId,expectedNonce:j.nonce,log:Z});let R=await t.validate(C);if(!R.issues)C=R.value}else{if(!T.userInfoUrl)return D(Error("CIAM provider missing userinfo endpoint"));C=await a1(T.userInfoUrl,b.access_token);let S=I.config.authority;if(b.id_token&&T.jwksUri&&S){let y=await S5({idToken:b.id_token,jwksUri:T.jwksUri,issuer:S,audience:I.clientId,expectedNonce:j.nonce||void 0,log:Z}),R=typeof y.sub==="string"?y.sub:"";if(R){if(typeof C.sub==="string"&&C.sub.length>0&&C.sub!==R)return Z.warn("CIAM UserInfo sub does not match verified id_token sub",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),D(Error("CIAM UserInfo sub mismatch"));C.sub=R}}if(typeof C.sub!=="string"||C.sub.length===0)return Z.warn("CIAM UserInfo response missing sub",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),D(Error("CIAM UserInfo response missing sub"))}let U=await s(I,C);if(!U.ok)return D(Error("Failed to persist CIAM customer"));let Y=z5(U.claims);Z.info("CIAM third-party sign-in succeeded",{"ion.operation":"ciam.oidc.callback","ion.outcome":"success",provider:I.name});let z=[["Set-Cookie",H5(N)],r(U.sid,U.expires)];return Q5(K,{ok:!0,user:Y,session:void 0},V,z)}catch(E){return Z.error("Error during CIAM third-party sign-in callback",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"},E),D(E)}}async function O(K){if(!W)throw Error("ionite CIAM Manager not initialized");g();let N=W.magicLinkUrl||"/magic-link",V=W.magicLinkLoginUrl||"/magic-link/login",D=W.logoutUrl||"/auth/customer/logout",E=W.customerLoginUrl||"/auth/customer/login",A=W.customerCallbackUrl||"/auth/customer/callback",_=W.customerProvidersUrl||"/auth/customer/providers",M=new URL(K.url).pathname,j=(U)=>{if(!U)return;try{return new URL(U).pathname}catch{return U.startsWith("/")?U:`/${U}`}};if(j(N)===M&&K.method==="POST")return u5(K);if(j(V)===M&&K.method==="GET")return l5(K);if(j(D)===M&&K.method==="GET")return m5(K);if(j(_)===M&&K.method==="GET")return V5({providers:c5()});if(j(E)===M&&K.method==="GET")return m(K);if(j(A)===M&&(K.method==="GET"||K.method==="POST"))return G(K);return new Response("Not Found",{status:404})}return{...W,getCustomer:g5,resolveCustomer:f5,logout:m5,handler:O,listCustomerProviders:c5}}async function c2(J,Z){return p(Z,"Ionite instance is required. Create one with ionite(source, config) and pass it to this function."),Z.ciam?.getCustomer(J)}async function d2(J,Z){return p(Z,"Ionite instance is required. Create one with ionite(source, config) and pass it to this function."),await Z.ciam?.resolveCustomer(J)??{status:"unauthenticated"}}var Y1="application/scim+json",n2="urn:ietf:params:scim:api:messages:2.0:ListResponse",Q9="urn:ietf:params:scim:api:messages:2.0:Error",z1="urn:ietf:params:scim:schemas:core:2.0:User",k5="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",O1="urn:ietf:params:scim:schemas:core:2.0:Group",a2="urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",f9="urn:ietf:params:scim:schemas:core:2.0:ResourceType",Z1="urn:ietf:params:scim:schemas:core:2.0:Schema",t2="00000000000000000000000000000000";function i2(J){let Z={timestamp:new Date().toISOString()};if(J)Z.actor=J;try{let Q=globalThis[Symbol.for("opentelemetry.js.api.1")]?.trace?.getActiveSpan?.()?.spanContext?.(),L=Q?.traceId;if(L&&L!==t2){if(Z.traceId=L,Q?.spanId)Z.spanId=Q.spanId}}catch{}return Z}class B1 extends Error{constructor(J){super(J);this.name="SubjectTypeNotAssignableError",Object.setPrototypeOf(this,B1.prototype)}}async function o2(J,Z,$,X,Q){let L=X.subjectType??"user";if(!X9.includes(L))throw new B1(`Cannot grant ${X.targetType} "${M5(X.target)}" to a "${L}" principal: only [${X9.join(", ")}] principals are assignable on this platform.`);let H=G9(Z,J);if(!H&&!Q)return;let B=M5(X.target),W;if(Q)W=await Q.getNode(X.targetType,B);else if(H){if(W=await(X.targetType==="group"?H.groups:X.targetType==="role"?H.roles:H.permissions).get(B),!W&&X.targetType==="group")W=await $?.entitlement?.(B)}let F=W?.assignableSubjectTypes;if(F&&F.length>0&&!F.includes(L))throw new B1(`Cannot grant ${X.targetType} "${B}" to a "${L}" principal: this entitlement restricts assignment to [${F.join(", ")}].`)}async function r2(J,Z,$,X){await o2(J.catalogStore,J.codeCatalog,J.resources,Z,X);let Q={...Z,status:Z.status??"active",provenance:Z.provenance??i2()};if(Q.id=W1(Q),await J.accessStore?.grant(Q),J.accessIndex&&(J.catalogStore||J.codeCatalog)){let L=await B9(Q,{catalog:J.catalogStore,code:J.codeCatalog,resources:J.resources,cache:X});await J.accessIndex.materialize(Q.id,L)}return $?.push({op:"add",change:Q}),Q}async function E1(J,Z,$){let X=Z.id??W1(Z);await J.accessStore?.revoke(Z),await J.accessIndex?.removeByRoot(X),$?.push({op:"delete",change:{...Z,id:X}})}async function K9(J,Z){let $=await s2(J,Z),X=await J4(J,Z);return{oaa:$,delta:X}}async function s2(J,Z){if(Z.length===0||!J.authz.oaa.isReady())return{status:"skipped"};return F9(J,"authz.oaa.push","OAA incremental access push failed after SCIM mutation; full sync will reconcile",()=>J.authz.oaa.pushAccessChanges(Z),{count:Z.length})}async function F9(J,Z,$,X,Q){try{return await X(),{status:"ok"}}catch(L){return J.log?.warn($,{"ion.operation":Z,"ion.outcome":"degraded",...Q,error:y5(L)}),{status:"degraded",reason:y5(L)}}}var e2=6;async function J4(J,Z){let $=J.iamDelta;if(!$?.isReady()||Z.length===0)return{status:"skipped"};let X=new Map;for(let W of Z){let F=`${W.change.subjectType??"user"}:${M5(W.change.subject)}\x00${W.change.targetType}:${M5(W.change.target)}`;X.set(F,W)}let Q=[...X.values()],L=Q.map(({op:W,change:F})=>()=>W==="add"?$.onGrant(F):$.onRevoke(F)),B=(await Z4(L,e2)).filter((W)=>W.status==="rejected");if(B.length>0)return J.log?.warn("IAM delta egress degraded after SCIM mutation; IAM server reconcile/aggregation will recover",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",failed:B.length,total:Q.length,error:y5(B[0]?.reason)}),{status:"degraded",reason:y5(B[0]?.reason)};return{status:"ok"}}async function Z4(J,Z){let $=Array(J.length),X=0,Q=async()=>{while(!0){let H=X++;if(H>=J.length)return;let B=J[H];if(!B)continue;try{$[H]={status:"fulfilled",value:await B()}}catch(W){$[H]={status:"rejected",reason:W}}}},L=Array.from({length:Math.min(Z,J.length)},Q);return await Promise.all(L),$}class w1 extends Error{constructor(J){super(J);this.name="DerivedRevokeError",Object.setPrototypeOf(this,w1.prototype)}}class i5 extends Error{summary;clientError;constructor(J,Z,$=!1){super(J);this.name="ScimMutationError",this.summary=Z,this.clientError=$,Object.setPrototypeOf(this,i5.prototype)}}function h(J,Z,$){return new Response(JSON.stringify({schemas:[Q9],status:String(J),scimType:$,detail:Z}),{status:J,headers:{"Content-Type":Y1}})}function a5(J,Z){let $=Z?.totalResults??J.length,X=Z?.startIndex??1,Q=Z?.itemsPerPage??J.length;return new Response(JSON.stringify({schemas:[n2],totalResults:$,startIndex:X,itemsPerPage:Q,Resources:J}),{status:200,headers:{"Content-Type":Y1}})}function N5(J,Z=200){return new Response(JSON.stringify(J),{status:Z,headers:{"Content-Type":Y1}})}function h9(J){return h(J.clientError?409:500,`${J.message}; authz mutation summary: ${JSON.stringify(J.summary)}`,J.clientError?"mutability":"invalidValue")}function K1(J){return W1(J)}function r1(J,Z){return X1(g9(J),g9(Z))}function g9(J){let Z=new Map;if(!J?.id)return Z;for(let $ of J.groups??[]){let X={subject:J.id,targetType:"group",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type}:void 0};Z.set(K1(X),X)}for(let $ of J.roles??[]){let X={subject:J.id,targetType:"role",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(K1(X),X)}for(let $ of J.entitlements??[]){let X={subject:J.id,targetType:"permission",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(K1(X),X)}return Z}function $1(J,Z,$,X){let Q=new Map,L=X&&X.length>0?X:void 0;for(let H of J??[]){let B={subject:H.value,targetType:Z,target:$,resources:L,metadata:H.display||H.type?{display:H.display,type:H.type}:void 0};Q.set(K1(B),B)}return Q}function s1(J){let Z=J[B5]?.resources;return Z&&Z.length>0?Z:void 0}function $4(J,Z,$){let X=J[B5];if(J.displayName!==void 0&&J.displayName!==(Z.displayName??Z.name))return!0;if(J.externalId!==void 0&&J.externalId!==Z.externalId)return!0;if(X?.type!==void 0&&X.type!==$)return!0;if(X?.requestable!==void 0&&Boolean(X.requestable)!==Boolean(Z.requestable))return!0;if(X?.description!==void 0&&X.description!==Z.description)return!0;if(X?.resources!==void 0){let Q=[...X.resources].sort().join(","),L=[...j1(Z)??[]].sort().join(",");if(Q!==L)return!0}return!1}function m9(J){let Z=new Map;for(let $ of J)Z.set(K1($),$);return Z}async function O5(J,Z,$,X,Q,L,H){let B=[],W=new Set,F=H?H.get(`${X}:${Q}`)??[]:Z?(await Z.listByTarget(X,Q)).items:[];for(let g of F){let u=M5(g.subject);if(W.has(u))continue;W.add(u);let t=g.metadata,o=g.subjectType==="workload"?"Workload":t?.type??"User";B.push({value:u,...t?.display?{display:t.display}:{},type:o})}for(let g of L??[]){if(g.targetType!==X||M5(g.target)!==Q)continue;let u=M5(g.subject);if(W.has(u))continue;W.add(u),B.push({value:u,type:"Workload"})}if(X==="group"){let g=await J.groups.get(Q)??await $?.entitlement?.(Q);for(let u of g?.groups??[]){let t=M5(u);if(!t||W.has(t))continue;W.add(t),B.push({value:t,type:"Group"})}}return B.length>0?B:void 0}function X1(J,Z){let $=[];for(let[X,Q]of Z)if(!J.has(X))$.push({action:"grant",change:Q});for(let[X,Q]of J)if(!Z.has(X))$.push({action:"revoke",change:Q});return $}async function e1(J,Z){if(J.oaa.isReady())await J.oaa.pushUser(Z)}async function v5(J,Z,$,X){let Q={metadataApplied:!1,access:[]},L=[],H=new Y9(J.catalogStore,J.resources,J.codeCatalog);try{try{await Z(),Q.metadataApplied=!0}catch(B){for(let W of $)Q.access.push({change:W.change,status:"rolled_back"});throw Q.metadataApplied=!1,new i5(`SCIM metadata write failed: ${y5(B)}`,Q,!1)}if(X)await F9(J,"authz.oaa.metadata","OAA metadata projection failed after SCIM write; full sync will reconcile",X);for(let B=0;B<$.length;B++){let W=$[B];try{if(W.action==="grant")await r2(J,W.change,L,H);else await Y4(J,W.change,L);Q.access.push({change:W.change,status:"applied"})}catch(F){Q.access.push({change:W.change,status:"failed",error:F});for(let u=B+1;u<$.length;u++)Q.access.push({change:$[u].change,status:"rolled_back"});let g=F instanceof w1||F instanceof B1;if(!g)await Q4(J,W.change,H);throw new i5(g?y5(F):`SCIM access mutation failed: ${y5(F)}`,Q,g)}}return Q}finally{await X4(J),Q.egress=await K9(J,L),K4(J,Q)}}function y5(J){return J instanceof Error?J.message:String(J)}async function X4(J){try{await J.settleAuthz?.()}catch{}}async function Q4(J,Z,$){if(!J.accessIndex||!J.catalogStore&&!J.codeCatalog||!J.accessStore)return;let X=M5(Z.subject);if(!X)return;let Q=Z.subjectType??"user";try{await W9(X,Q,{accessStore:J.accessStore,accessIndex:J.accessIndex,catalogStore:J.catalogStore,code:J.codeCatalog,resources:J.resources},$)}catch(L){J.log?.warn("Per-subject reconcile after failed SCIM access mutation failed",{"ion.operation":"authz.reconcile.subject.repair","ion.outcome":"degraded",subject:X,subjectType:Q,error:y5(L)})}}function K4(J,Z){if(!J.onAccessMutation)return;try{J.onAccessMutation(Z)}catch{}}async function Y4(J,Z,$){if(J.accessStore){let X=Z.id??W1(Z);if(!await J.accessStore.get(X)){if((J.accessIndex?await J.accessIndex.has(Z.subject,Z.targetType,Z.target,Z.resources?.[0],Z.subjectType):{allow:!1}).allow)throw new w1(`Cannot revoke ${Z.targetType} "${M5(Z.target)}" for "${M5(Z.subject)}": it is not a directly granted root (it is derived from group/role membership). Remove the granting group/role instead.`);await E1(J,Z,$);return}}await E1(J,Z,$)}function Q1(J){let Z=J[B5]?.type??"group";if(Z==="group"||Z==="role"||Z==="permission")return Z;throw Error(`Unsupported ionite SCIM Group authz type "${String(Z)}"`)}async function J9(J,Z,$){if(!J.oaa.isReady())return;if($==="role"){await J.oaa.pushRole(Z);return}if($==="permission"){await J.oaa.pushPermission(Z);return}await J.oaa.pushGroup(Z)}function j1(J){let Z=J.resources;if(!Z||Z.length===0)return;let $=Z.map((X)=>typeof X==="string"?X:X.id).filter(Boolean);return $.length>0?$:void 0}function E5(J,Z,$){return{schemas:[O1],id:J.id,externalId:J.externalId,displayName:J.displayName??J.name,members:$,[B5]:{type:Z,requestable:J.requestable,description:J.description,resources:Z==="group"?j1(J):void 0,assignableSubjectTypes:J.assignableSubjectTypes,recommendedSubjectTypes:J.recommendedSubjectTypes}}}function B4(J,Z){let $=J[B5],X={id:Z,name:J.displayName,displayName:J.displayName,description:$?.description??J.displayName,externalId:J.externalId,requestable:$?.requestable};if($?.resources!==void 0)X.resources=$.resources;return X}function W4(J){if(!J)return;let Z=J.trim().match(/^requestable\s+eq\s+(true|false)$/i);if(!Z)return;return{requestable:Z[1]?.toLowerCase()==="true"}}function p9(J){if(!J)return;let Z=J.trim().match(/^externalId\s+eq\s+"([^"]*)"$/i);return Z?Z[1]:void 0}async function H9(J,Z){if(!J?.entitlements)return[];let $=J.entitlements.bind(J),X=[];for await(let Q of l9((L,H)=>J.list({start:L,limit:H})))for(let L of $(Q)){if(Z?.requestable!==void 0&&Boolean(L.requestable)!==Z.requestable)continue;X.push(G1(L))}return X}async function G4(J,Z,$,X,Q){let L=[{store:J.groups,type:"group"},{store:J.roles,type:"role"},{store:J.permissions,type:"permission"}],H;if(L.every(({store:W})=>typeof W.getByExternalId==="function"))H=(await Promise.all(L.map(async({store:F,type:g})=>{let u=await F.getByExternalId?.(X);return u?{entity:u,type:g}:void 0}))).filter((F)=>F!==void 0);else{let W={start:0},[F,g,u]=await Promise.all([J.groups.list(W),J.roles.list(W),J.permissions.list(W)]);H=[...F.items.map((o)=>({entity:o,type:"group"})),...g.items.map((o)=>({entity:o,type:"role"})),...u.items.map((o)=>({entity:o,type:"permission"}))].filter(({entity:o})=>o.externalId===X)}if($?.entitlements){let W=await H9($);for(let F of W)if(F.externalId===X)H.push({entity:F,type:"group"})}if(H.length>1)throw new L9(`Ambiguous externalId "${X}": ${H.length} entitlements share it (${H.map((W)=>`${W.type}:${W.entity.id}`).join(", ")})`,"unique_violation","externalId");let B=H[0];if(!B)return;return E5(B.entity,B.type,await O5(J,Z,$,B.type,B.entity.id,Q))}async function L4(J,Z,$,X,Q){let L=Math.max(0,X.start),H=X.limit!=null?L+X.limit:void 0,B={start:0,limit:H,filter:X.filter},[W,F,g]=await Promise.all([J.groups.list(B),J.roles.list(B),J.permissions.list(B)]),u=[...W.items.map((r)=>({entity:r,type:"group"})),...F.items.map((r)=>({entity:r,type:"role"})),...g.items.map((r)=>({entity:r,type:"permission"}))],t=W.total+F.total+g.total,o=u.slice(L,H),F5=0,i=[];if($?.entitlements){let r=await H9($,X.filter);F5=r.length;let $5=X.limit!=null?X.limit-o.length:void 0;if($5===void 0||$5>0){let D5=Math.max(0,L-t);i=$5===void 0?r.slice(D5):r.slice(D5,D5+$5)}}let H5=[...o,...i.map((r)=>({entity:r,type:"group"}))],q=t+F5,c=Z?.listByTargets?await Z.listByTargets(H5.map(({entity:r,type:$5})=>({targetType:$5,target:r.id}))):void 0,Q5=await Promise.all(H5.map(async({entity:r,type:$5})=>E5(r,$5,await O5(J,Z,$,$5,r.id,Q,c))));return{resources:Q5,total:q,count:Q5.length}}async function _1(J,Z,$,X,Q){let[L,H,B]=await Promise.all([J.groups.get(X),J.roles.get(X),J.permissions.get(X)]);if(L)return E5(L,"group",await O5(J,Z,$,"group",X,Q));if(H)return E5(H,"role",await O5(J,Z,$,"role",X,Q));if(B)return E5(B,"permission",await O5(J,Z,$,"permission",X,Q));let W=G1(await $?.entitlement?.(X));if(W)return E5(W,"group",await O5(J,Z,$,"group",X,Q));return}async function Z9(J,Z,$){let X=Q1(Z),L={...(X==="role"?await J.roles.get($):X==="permission"?await J.permissions.get($):await J.groups.get($))??{},...B4(Z,$)},H=X==="role"?J.roles.set(L):X==="permission"?J.permissions.set(L):J.groups.set(L);return await H.ready(),H}async function F4(J,Z){await Promise.all([J.groups.delete(Z),J.roles.delete(Z),J.permissions.delete(Z)])}function u9(){return crypto.randomUUID()}function t5(J,Z){let $=J;if(typeof $.validate==="function")return $.validate(Z);return Promise.resolve(J["~standard"].validate(Z))}function H4(J){if(!J)return;try{return new URL(J).pathname}catch{return J.startsWith("/")?J:`/${J}`}}function U5(J){let Z=H4(J);return Z?P1(Z):void 0}function V4(J,Z){let $=U5(J);if($?.endsWith("/Users"))return $.slice(0,-6);let X=U5(Z);if(X?.endsWith("/Groups"))return X.slice(0,-7);return}function x5(J,Z){return new URL(Z,J.url).toString()}function w(J,Z,$,X){let{multiValued:Q=!1,...L}=X??{};return{name:J,type:Z,description:$,multiValued:Q,...L}}function N4(J,Z){return{schemas:[a2],documentationUri:Z?.documentationUri,patch:{supported:!0},bulk:{supported:!1},filter:{supported:!0,maxResults:1000},changePassword:{supported:!1},sort:{supported:!1},etag:{supported:!1},authenticationSchemes:[{type:"oauthbearertoken",name:"OAuth Bearer Token",description:"Use an ionite workload bearer token for IAM discovery and provisioning requests.",primary:!0}],meta:{resourceType:"ServiceProviderConfig",location:x5(J.request,`${J.basePath}/ServiceProviderConfig`)}}}function M4(J){let Z=[];if(J.supportsUsers)Z.push({schemas:[f9],id:"User",name:"User",description:"User Account",endpoint:J.usersUrl,schema:z1,schemaExtensions:[{schema:k5,required:!1},{schema:I5,required:!1}],meta:{resourceType:"ResourceType",location:x5(J.request,`${J.basePath}/ResourceTypes/User`)}});if(J.supportsGroups)Z.push({schemas:[f9],id:"Group",name:"Group",description:"Group",endpoint:J.groupsUrl,schema:O1,schemaExtensions:[{schema:B5,required:!1}],meta:{resourceType:"ResourceType",location:x5(J.request,`${J.basePath}/ResourceTypes/Group`)}});return Z}function D4(J){let Z=[];if(J.supportsUsers)Z.push({schemas:[Z1],id:z1,name:"User",description:"User Account",meta:{resourceType:"Schema",location:x5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(z1)}`)},attributes:[w("id","string","Unique identifier for the User.",{multiValued:!1,required:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),w("externalId","string","External identifier from the provisioning client.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",uniqueness:"none"}),w("userName","string","Unique identifier typically used for login.",{multiValued:!1,required:!0,caseExact:!1,mutability:"readWrite",returned:"default",uniqueness:"server"}),w("name","complex","The components of the user name.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",subAttributes:[w("formatted","string","The full name, including titles and suffixes.",{multiValued:!1}),w("familyName","string","The family name of the User.",{multiValued:!1}),w("givenName","string","The given name of the User.",{multiValued:!1}),w("middleName","string","The middle name(s) of the User.",{multiValued:!1}),w("honorificPrefix","string","The honorific prefix(es) of the User.",{multiValued:!1}),w("honorificSuffix","string","The honorific suffix(es) of the User.",{multiValued:!1})]}),w("displayName","string","The name of the User, suitable for display.",{multiValued:!1}),w("nickName","string","The casual way to address the user.",{multiValued:!1}),w("profileUrl","reference","A URL pointing to the User profile.",{multiValued:!1,referenceTypes:["external"]}),w("title","string","The user title, such as Vice President.",{multiValued:!1}),w("userType","string","The relationship between the organization and the User.",{multiValued:!1}),w("preferredLanguage","string","Preferred written or spoken language.",{multiValued:!1}),w("locale","string","Default location for localizing values.",{multiValued:!1}),w("timezone","string","The User time zone.",{multiValued:!1}),w("active","boolean","The User administrative status.",{multiValued:!1}),w("emails","complex","Email addresses for the User.",{multiValued:!0,subAttributes:[w("value","string","Email address value.",{multiValued:!1,required:!0}),w("display","string","Display label for the email.",{multiValued:!1}),w("type","string","Email type such as work or home.",{multiValued:!1}),w("primary","boolean","Primary email indicator.",{multiValued:!1})]}),w("phoneNumbers","complex","Phone numbers for the User.",{multiValued:!0,subAttributes:[w("value","string","Phone number value.",{multiValued:!1,required:!0}),w("display","string","Display label for the phone number.",{multiValued:!1}),w("type","string","Phone number type.",{multiValued:!1}),w("primary","boolean","Primary phone number indicator.",{multiValued:!1})]}),w("photos","complex","Photo URLs for the User.",{multiValued:!0,subAttributes:[w("value","reference","Photo URL.",{multiValued:!1,required:!0,referenceTypes:["external"]}),w("display","string","Display label for the photo.",{multiValued:!1}),w("type","string","Photo type.",{multiValued:!1}),w("primary","boolean","Primary photo indicator.",{multiValued:!1})]}),w("addresses","complex","Physical mailing addresses for the User.",{multiValued:!0,subAttributes:[w("formatted","string","Formatted mailing address.",{multiValued:!1}),w("streetAddress","string","Full street address component.",{multiValued:!1}),w("locality","string","City or locality.",{multiValued:!1}),w("region","string","State or region.",{multiValued:!1}),w("postalCode","string","Postal code.",{multiValued:!1}),w("country","string","Country.",{multiValued:!1}),w("type","string","Address type.",{multiValued:!1}),w("primary","boolean","Primary address indicator.",{multiValued:!1})]}),w("groups","complex","Groups to which the User belongs.",{multiValued:!0,mutability:"readOnly",subAttributes:[w("value","string","Group identifier.",{multiValued:!1,required:!0}),w("$ref","reference","Reference to the Group resource.",{multiValued:!1,referenceTypes:["Group"]}),w("display","string","Display name of the group.",{multiValued:!1}),w("type","string","Relationship type.",{multiValued:!1})]}),w("entitlements","complex","Entitlements for the User.",{multiValued:!0,subAttributes:[w("value","string","Entitlement value.",{multiValued:!1,required:!0}),w("display","string","Display value.",{multiValued:!1}),w("type","string","Entitlement type.",{multiValued:!1}),w("primary","boolean","Primary entitlement indicator.",{multiValued:!1})]}),w("roles","complex","Roles for the User.",{multiValued:!0,subAttributes:[w("value","string","Role value.",{multiValued:!1,required:!0}),w("display","string","Display value.",{multiValued:!1}),w("type","string","Role type.",{multiValued:!1}),w("primary","boolean","Primary role indicator.",{multiValued:!1})]}),w("x509Certificates","complex","Certificates issued to the User.",{multiValued:!0,subAttributes:[w("value","string","Certificate value.",{multiValued:!1,required:!0}),w("display","string","Display value.",{multiValued:!1}),w("type","string","Certificate type.",{multiValued:!1}),w("primary","boolean","Primary certificate indicator.",{multiValued:!1})]})]}),Z.push({schemas:[Z1],id:k5,name:"EnterpriseUser",description:"Enterprise User extension",meta:{resourceType:"Schema",location:x5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(k5)}`)},attributes:[w("employeeNumber","string","Numeric or alphanumeric identifier assigned to a person.",{multiValued:!1}),w("costCenter","string","Name of a cost center.",{multiValued:!1}),w("organization","string","Name of an organization.",{multiValued:!1}),w("division","string","Name of a division.",{multiValued:!1}),w("department","string","Name of a department.",{multiValued:!1}),w("manager","complex","The User manager.",{multiValued:!1,subAttributes:[w("value","string","Identifier of the manager User resource.",{multiValued:!1}),w("$ref","reference","Reference to the manager User resource.",{multiValued:!1,referenceTypes:["User"]}),w("displayName","string","Display name of the manager.",{multiValued:!1})]})]}),Z.push({schemas:[Z1],id:I5,name:"IoniteUser",description:"ionite User extension carrying the Enterprise Controlled ID (ECID) identity correlator and the account purpose (accountClass). See https://ionite.com/docs/llms-ecid.txt.",meta:{resourceType:"Schema",location:x5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(I5)}`)},attributes:[w("ecid","string","Enterprise Controlled ID formatted as 'ecid:<realm>:<opaque>' (realm = the minting authority's id). Correlates multiple accounts to one identity.",{multiValued:!1,caseExact:!0}),w("accountClass","string","Account purpose (distinct from userType persona). Open value set: 'daily', 'privileged', 'break_glass', 'service'.",{multiValued:!1})]}),Z.push({schemas:[Z1],id:B5,name:"IoniteAuthzGroup",description:"ionite authorization metadata for SCIM Group resources.",meta:{resourceType:"Schema",location:x5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(B5)}`)},attributes:[w("type","string","Authorization entity kind: group, role, or permission.",{multiValued:!1,required:!1}),w("requestable","boolean","Whether this catalog entry should be requestable access in IAM tooling.",{multiValued:!1,required:!1}),w("description","string","Human-readable authorization entity description.",{multiValued:!1,required:!1}),w("assignableSubjectTypes","string","AppDev-owned hard ceiling of principal kinds (user, workload) that may hold this entitlement. Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]}),w("recommendedSubjectTypes","string","AppDev advisory default principal kinds (subset of assignableSubjectTypes). Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]})]});if(J.supportsGroups)Z.push({schemas:[Z1],id:O1,name:"Group",description:"Group",meta:{resourceType:"Schema",location:x5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(O1)}`)},attributes:[w("id","string","Unique identifier for the Group.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),w("externalId","string","External identifier from the provisioning client.",{multiValued:!1,uniqueness:"none"}),w("displayName","string","Human-readable name for the Group.",{multiValued:!1,required:!0,uniqueness:"none"}),w("members","complex","Members of the Group.",{multiValued:!0,subAttributes:[w("value","string","Identifier of the member resource.",{multiValued:!1,required:!0}),w("$ref","reference","Reference to the member resource.",{multiValued:!1,referenceTypes:["User","Group"]}),w("display","string","Display name of the member.",{multiValued:!1}),w("type","string","Member type.",{multiValued:!1})]})]});return Z}function _4(J,Z,$,X,Q,L,H,B,W,F,g,u,t,o,F5){let i={authz:X,settleAuthz:F5,accessStore:Q,accessIndex:L,catalogStore:H,codeCatalog:B,resources:W,log:Z,iamDelta:u,onAccessMutation:t};if(!F&&!g)return;let q={...F,...g},c=q.users?.enabled!==!1,Q5=q.groups?.enabled!==!1;if(Boolean(q.url||q.userStore||H||B)&&!$)Z.error("IAM requires workload identity for SCIM push/pull operations",{"ion.operation":"workload.require","ion.outcome":"failure"});function $5(){if(!$)throw Z.error("IAM requires workload identity for SCIM push/pull operations",{"ion.operation":"workload.require","ion.outcome":"failure"}),Error("IAM requires workload identity for SCIM push/pull operations");return $}async function D5(x){let k=$5(),m=x.headers.get("Authorization");if(!m?.startsWith("Bearer "))return!1;try{let d=m.substring(7);return(await k.validateToken(d)).valid}catch{return!1}}async function f5(){let x=$5(),k=typeof x.getServerToken==="function"?await x.getServerToken():await x.getToken();return new Headers({"Content-Type":Y1,Accept:Y1,Authorization:`Bearer ${k}`})}async function h5(x,k,m,d){if(!q.url)throw Error("IAM URL not configured for outgoing requests");let s=`${q.url}${k}`;try{let G=await f5(),O=await fetch(s,{method:x,headers:G,body:m?JSON.stringify(m):void 0}),K=await O.json();if(!O.ok)return{success:!1,error:K,status:O.status};let N=await d["~standard"].validate(K);if(N.issues)return Z.error("SCIM response validation failed",{"ion.operation":"scim.response.validate","ion.outcome":"failure",validationIssues:N.issues}),{success:!1,error:{schemas:[Q9],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${N.issues.map((V)=>V.message).join("; ")}`},status:400};return{success:!0,data:N.value,status:O.status}}catch(G){return{success:!1,error:{schemas:[Q9],status:"500",detail:G instanceof Error?G.message:"Unknown error occurred"},status:500}}}function g5(){return q.url}function m5(x,k){let m=U5(k?.usersUrl??q.usersUrl??"/api/iam/Users")??"/api/iam/Users",d=U5(k?.groupsUrl??q.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",s=U5(k?.discovery?.basePath??q.discovery?.basePath)??V4(m,d);if(!s)return;return{request:x,basePath:s,usersUrl:m,groupsUrl:d,supportsUsers:c&&Boolean(q.userStore),supportsGroups:Q5&&Boolean(H||B)}}async function p5(x){let k=N4(x,q.discovery);return await q.discovery?.buildServiceProviderConfig?.(x,k)??k}async function T5(x){let k=M4(x);return await q.discovery?.buildResourceTypes?.(x,k)??k}async function b5(x){let k=D4(x);return await q.discovery?.buildSchemas?.(x,k)??k}async function z5(x,k){let m=m5(x,k);if(!m)return;let d=P1(new URL(x.url).pathname),{basePath:s}=m;if(d!==s&&!d.startsWith(`${s}/`))return;let G=P1(d.slice(s.length)||"/");if(!(G==="/ServiceProviderConfig"||G==="/ResourceTypes"||G.startsWith("/ResourceTypes/")||G==="/Schemas"||G.startsWith("/Schemas/")))return;if(x.method!=="GET")return h(405,"Method not allowed");if(!await D5(x))return h(401,"Authorization required");if(G==="/ServiceProviderConfig")return N5(await p5(m));if(G==="/ResourceTypes")return a5(await T5(m));if(G.startsWith("/ResourceTypes/")){let N=decodeURIComponent(G.slice(15)),V=(await T5(m)).find((D)=>D.id===N||D.name===N);return V?N5(V):h(404,"Resource not found")}if(G==="/Schemas")return a5(await b5(m));if(G.startsWith("/Schemas/")){let N=decodeURIComponent(G.slice(9)),V=(await b5(m)).find((D)=>D.id===N);return V?N5(V):h(404,"Resource not found")}return}let u5,l5;if(q.url)l5=async(k,m)=>{let d={...k,schemas:k.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return h5("POST","/Users",d,J.user)},u5={createGroup:async(k,m)=>{let d={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:k,externalId:m?.externalId,members:m?.members};return h5("POST","/Groups",d,J.group)}};let V5;if(H||B){let x=G9(B,H),k=async(_)=>{if(!W?.entitlement)return;let[M,j,P]=await Promise.all([x.groups.get(_),x.roles.get(_),x.permissions.get(_)]);if(M||j||P)return;return G1(await W.entitlement(_))},m=(_,M)=>h(403,`Entitlement "${_}" is derived from the application's resource data (ResourceProvider.entitlements); its definition cannot be ${M} through SCIM. Member add/remove is allowed; the definition changes only when the application's resources or derivation logic change.`,"mutability"),d=(_)=>{if(!B)return;let M=B.groups.get(_);if(M)return{entity:M,type:"group"};let j=B.roles.get(_);if(j)return{entity:j,type:"role"};let P=B.permissions.get(_);if(P)return{entity:P,type:"permission"};return},s=(_,M)=>h(403,`Entitlement "${_}" is declared in application code (authz.catalog); its definition cannot be ${M} through SCIM. Member add/remove is allowed; the definition changes only when the application code changes.`,"mutability"),G=(_)=>_.path==="members"||Boolean(_.path?.startsWith("members[")),O=async(_,M)=>{if(!await D5(_))return h(401,"Authorization required");let P=new URL(_.url),I=M?.basePath??"/Groups",T=P.pathname;if(T.startsWith(I))T=T.substring(I.length);let b=T.match(/^\/([^/]+)$/)?.[1],C=_.method;try{if(b)switch(C){case"GET":return await N(b);case"PUT":return await D(_,b);case"PATCH":return await E(_,b);case"DELETE":return await A(b);default:return h(405,"Method not allowed")}else if(T===""||T==="/")switch(C){case"GET":return await K(_);case"POST":return await V(_);default:return h(405,"Method not allowed")}return h(404,"Resource not found")}catch(U){if(U instanceof i5)return h9(U);if($9(U))return h(409,U.message,"uniqueness");return Z.error("Groups inbound handler error",{"ion.operation":"scim.groups.handler","ion.outcome":"failure"},U),h(500,U instanceof Error?U.message:"Internal server error")}},K=async(_)=>{let M=new URL(_.url),j=M.searchParams.get("startIndex"),P=M.searchParams.get("count"),I=j!=null?parseInt(j,10):void 0,T=P!=null?parseInt(P,10):void 0,v=I!=null&&!Number.isNaN(I)?Math.max(0,I-1):0,b=T!=null&&!Number.isNaN(T)?T:void 0,C=M.searchParams.get("filter"),U=p9(C);if(U!==void 0){let S=await G4(x,Q,W,U,o),y=S?[S]:[];return a5(y,{totalResults:y.length,startIndex:1,itemsPerPage:y.length})}let Y=W4(C),z=await L4(x,Q,W,{start:v,limit:b,filter:Y},o);return a5(z.resources,{totalResults:z.total,startIndex:v+1,itemsPerPage:z.count})},N=async(_)=>{let M=await _1(x,Q,W,_,o);if(!M)return h(404,`Group ${_} not found`,"invalidValue");return N5(M)},V=async(_)=>{let M=await _.json(),j=await t5(J.group,M);if(j.issues)return Z.error("Group creation validation failed",{"ion.operation":"scim.group.create","ion.outcome":"failure",validationIssues:j.issues}),h(400,`Request validation failed: ${j.issues.map((Y)=>Y.message).join("; ")}`,"invalidValue");let P=j.value;if(!P.displayName)return h(400,"displayName is required","invalidValue");if(!H)return h(501,"Group creation is not supported: this application declares its catalog in code (authz.catalog) and wires no AccessCatalogStore for SCIM-authored definitions.","invalidValue");if(P.externalId){let Y=P.externalId,z=B&&(B.groups.getByExternalId(Y)??B.roles.getByExternalId(Y)??B.permissions.getByExternalId(Y)),S=!z&&W?.entitlements?(await H9(W)).find((R)=>R.externalId===Y):void 0,y=z||S;if(y)throw new L9(`externalId "${Y}" is already used by ${z?"code-declared":"resource-derived"} entitlement "${y.id}"`,"unique_violation","externalId")}let I=Q1(P),T=u9(),v=s1(P),b=X1(new Map,$1(P.members,I,T,v)),C;await v5(i,async()=>{C=await Z9(x,P,T)},b,()=>J9(X,C,I));let U=await O5(x,Q,W,I,T);return N5(E5(C,I,U),201)},D=async(_,M)=>{let j=await _.json(),P=await t5(J.group,j);if(P.issues)return Z.error("Group replacement validation failed",{"ion.operation":"scim.group.replace","ion.outcome":"failure",validationIssues:P.issues}),h(400,`Request validation failed: ${P.issues.map((f)=>f.message).join("; ")}`,"invalidValue");let I=P.value,T=Q1(I);if(!await _1(x,Q,W,M))return h(404,`Group ${M} not found`,"invalidValue");let b=d(M),C=b?void 0:await k(M),U=b??(C?{entity:C,type:"group"}:void 0);if(U){if($4(I,U.entity,U.type))return b?s(M,"replaced"):m(M,"replaced");let f=j1(U.entity),l=Q?(await Q.listByTarget(U.type,M)).items:[],n=X1(m9(l),$1(I.members,U.type,M,f));await v5(i,async()=>{},n);let a=await O5(x,Q,W,U.type,M);return N5(E5(U.entity,U.type,a))}let Y=s1(I),z=Q?(await Q.listByTarget(T,M)).items:[],S=X1(m9(z),$1(I.members,T,M,Y)),y;await v5(i,async()=>{y=await Z9(x,I,M)},S,()=>J9(X,y,T));let R=await O5(x,Q,W,T,M);return N5(E5(y,T,R))},E=async(_,M)=>{let j=await _1(x,Q,W,M);if(!j)return h(404,`Group ${M} not found`,"invalidValue");let P=d(M),I=P?void 0:await k(M),T=P??(I?{entity:I,type:"group"}:void 0),v=await _.json();if(T&&(v.Operations??[]).some((R)=>!G(R)))return P?s(M,"patched"):m(M,"patched");let b={...j};for(let R of v.Operations??[])if(R.op==="replace"&&R.path&&R.value!==void 0){if(R.path==="displayName")b.displayName=R.value;else if(R.path===`${B5}.requestable`)b[B5]={...b[B5],requestable:Boolean(R.value)};else if(R.path===`${B5}.description`)b[B5]={...b[B5],description:String(R.value)}}else if(R.op==="add"&&R.path==="members"&&R.value!==void 0){let f=R.value;b.members=[...b.members??[],...f]}else if(R.op==="remove"&&R.path?.startsWith("members[")){let f=R.path.match(/members\[value eq "([^"]+)"\]/);if(f)b.members=(b.members??[]).filter((l)=>l.value!==f[1])}let C=await t5(J.group,b);if(C.issues)return Z.error("Group patch validation failed",{"ion.operation":"scim.group.patch","ion.outcome":"failure",validationIssues:C.issues}),h(400,`Request validation failed: ${C.issues.map((R)=>R.message).join("; ")}`,"invalidValue");let U=Q1(b),Y=T?j1(T.entity):s1(b),z=X1($1(j.members,U,M,Y),$1(b.members,U,M,Y)),S;await v5(i,async()=>{if(!T)S=await Z9(x,b,M)},z,T?void 0:()=>J9(X,S,U));let y=await O5(x,Q,W,U,M);return N5(E5(T?.entity??S,U,y))},A=async(_)=>{let M=await _1(x,Q,W,_);if(!M)return h(404,`Group ${_} not found`,"invalidValue");if(d(_))return s(_,"deleted");if(await k(_))return m(_,"deleted");let j=Q1(M);if(Q){let P=await Q.listByTarget(j,_),I=[];for(let T of P.items)await E1(i,T,I);await K9(i,I)}return await F4(x,_),new Response(null,{status:204})};V5={handler:O}}let W5;if(q.userStore){let{userStore:x,inboundUsers:k}=q,m=(Y)=>Y?.find((z)=>z.primary)?.value||Y?.[0]?.value,d=(Y)=>{if(Y.scimName)return Y.scimName;if(!Y.name)return;let[z,...S]=Y.name.split(" ");return{givenName:z,familyName:S.join(" ")||void 0}},s=(Y)=>Object.keys(Y.scimSchemaExtensions??{}).filter((z)=>z.startsWith("urn:")&&Y.scimSchemaExtensions?.[z]!==void 0),G=(Y)=>{let z={};if(Y.ecid!==void 0)z.ecid=Y.ecid;if(Y.accountClass!==void 0)z.accountClass=Y.accountClass;return z.ecid!==void 0||z.accountClass!==void 0?z:void 0},O=(Y)=>{let z=new Set([z1]);if(Y.scimEnterprise!==void 0)z.add(k5);if(G(Y)!==void 0)z.add(I5);for(let S of s(Y))z.add(S);return Array.from(z)},K=(Y)=>{let z={};if(Y.scimEnterprise!==void 0)z[k5]=Y.scimEnterprise;let S=G(Y);if(S!==void 0)z[I5]=S;for(let[y,R]of Object.entries(Y.scimSchemaExtensions??{}))if(y.startsWith("urn:")&&y!==I5&&R!==void 0)z[y]=R;return z},N=(Y)=>{let z=Y.userName||Y.email||Y.id||"",S=Y.emails??(Y.email?[{value:Y.email,primary:!0}]:[]);return{schemas:O(Y),id:Y.id,externalId:Y.externalId,userName:z,displayName:Y.displayName??Y.name??z,name:d(Y),nickName:Y.nickName,profileUrl:Y.avatar,title:Y.title,userType:Y.userType,preferredLanguage:Y.preferredLanguage,locale:Y.locale,timezone:Y.timezone,active:Y.active??!0,emails:S,phoneNumbers:Y.phoneNumbers,ims:Y.ims,photos:Y.photos,addresses:Y.addresses,groups:Y.groups,entitlements:Y.entitlements,roles:Y.roles,x509Certificates:Y.x509Certificates,meta:{resourceType:"User",created:(Y.createdAt??Y.updatedAt??new Date).toISOString(),lastModified:(Y.updatedAt??Y.createdAt??new Date).toISOString()},...K(Y)}},V=async(Y)=>{if(k?.mapBaseUserToScim)return await k.mapBaseUserToScim(Y);return N(Y)},D=async(Y,z)=>{if(k?.mapValidatedScimToBaseUser)return await k.mapValidatedScimToBaseUser(Y,z);let S=new Date,y=m(Y.emails),R=Y.name?.formatted||[Y.name?.givenName,Y.name?.middleName,Y.name?.familyName].filter(Boolean).join(" ").trim()||Y.displayName,f=Y.id||z.existing?.id||u9(),l=Y.userName||y||z.existing?.userName||f,n=R||Y.displayName||z.existing?.name||l,a=Object.fromEntries(Object.entries(Y).filter(([j5,G5])=>j5.startsWith("urn:")&&j5!==k5&&j5!==I5&&G5!==void 0)),e=Y[I5],q5=e?.ecid!==void 0&&e.ecid!==null?A1(e.ecid):z.existing?.ecid,Z5=e?.accountClass??z.existing?.accountClass,J5=z.existing?.sso;return{...z.existing??{},id:f,userName:l,name:n,email:y||z.existing?.email||l,avatar:Y.profileUrl,sso:{...J5??{},profile:{...J5?.profile??{},sub:f,iss:J5?.profile.iss??"iam-provisioned",aud:J5?.profile.aud??"iam-provisioned",exp:J5?.profile.exp??Math.floor(Date.now()/1000)+3600,iat:J5?.profile.iat??Math.floor(Date.now()/1000),email:y||z.existing?.email||l,email_verified:!0,name:n,preferred_username:l},tenant:J5?.tenant??{id:"iam-provisioned",name:"IAM Provisioned"},scope:J5?.scope??"openid profile email",tokenType:J5?.tokenType??"Bearer",expires:J5?.expires??new Date(Date.now()+3600000)},externalId:Y.externalId,ecid:q5,accountClass:Z5,displayName:Y.displayName,scimName:Y.name,emails:Y.emails,nickName:Y.nickName,title:Y.title,preferredLanguage:Y.preferredLanguage,locale:Y.locale,timezone:Y.timezone,active:Y.active,phoneNumbers:Y.phoneNumbers,ims:Y.ims,photos:Y.photos,addresses:Y.addresses,groups:Y.groups,entitlements:Y.entitlements,roles:Y.roles,x509Certificates:Y.x509Certificates,scimEnterprise:Y[k5],scimSchemaExtensions:Object.keys(a).length>0?a:void 0,createdAt:z.existing?.createdAt??(Y.meta?.created?new Date(Y.meta.created):S),updatedAt:Y.meta?.lastModified?new Date(Y.meta.lastModified):S,userType:Y.userType}},E=(Y,z,S)=>{Y[z]=S},A=(Y,z,S)=>{let y=Y[z];if(Array.isArray(y)){Y[z]=[...y,...Array.isArray(S)?S:[S]];return}if(y&&typeof y==="object"&&!Array.isArray(y)&&S&&typeof S==="object"&&!Array.isArray(S)){Y[z]={...y,...S};return}Y[z]=S},_=(Y,z,S)=>{let y=z.match(/^(urn:.*:(?:User|Group))(?::(.+))?$/),R=y?[y[1],...y[2]?.split(":")??[]]:z.split("."),f=Y;for(let n of R.slice(0,-1)){let a=f[n];if(a===void 0){if(!S)return null;f[n]={}}else if(a===null||typeof a!=="object"||Array.isArray(a)){if(!S)return null;f[n]={}}f=f[n]}let l=R.at(-1);if(!l)return null;return{parent:f,key:l}},M=(Y,z)=>{let S=z.op.toLowerCase();if(!z.path){if(S!=="remove"&&z.value&&typeof z.value==="object"&&!Array.isArray(z.value))Object.assign(Y,z.value);return}let y=z.path.match(/^([A-Za-z0-9]+)\[value eq "([^"]+)"\]$/);if(y&&S==="remove"){let[,f,l]=y,n=Y[f];if(Array.isArray(n))Y[f]=n.filter((a)=>!(a&&typeof a==="object"&&("value"in a)&&a.value===l));return}let R=_(Y,z.path,S!=="remove");if(!R)return;if(S==="remove"){delete R.parent[R.key];return}if(S==="add"){A(R.parent,R.key,z.value);return}E(R.parent,R.key,z.value)},j=async(Y,z)=>{if(!await D5(Y))return h(401,"Authorization required");let y=new URL(Y.url),R=z?.basePath??"/Users",f=y.pathname;if(f.startsWith(R))f=f.substring(R.length);let n=f.match(/^\/([^/]+)$/)?.[1],a=Y.method;try{if(n)switch(a){case"GET":return await I(n);case"PUT":return await b(Y,n);case"PATCH":return await C(Y,n);case"DELETE":return await U(n);default:return h(405,"Method not allowed")}else if(f===""||f==="/")switch(a){case"GET":return await P(Y);case"POST":return await v(Y);default:return h(405,"Method not allowed")}return h(404,"Resource not found")}catch(e){if(e instanceof i5)return h9(e);if($9(e))return h(409,e.message,"uniqueness");return Z.error("Users inbound handler error",{"ion.operation":"scim.users.handler","ion.outcome":"failure"},e),h(500,e instanceof Error?e.message:"Internal server error")}},P=async(Y)=>{let z=new URL(Y.url),S=z.searchParams.get("startIndex"),y=z.searchParams.get("count"),R=S!=null?parseInt(S,10):void 0,f=y!=null?parseInt(y,10):void 0,l=R!=null&&!Number.isNaN(R)?Math.max(0,R-1):0,n=f!=null&&!Number.isNaN(f)?f:void 0,a=p9(z.searchParams.get("filter"));if(a!==void 0){let Z5=await x.lookup({externalId:a}),J5=Z5?[await V(Z5)]:[];return a5(J5,{totalResults:J5.length,startIndex:1,itemsPerPage:J5.length})}let e=await x.list({start:l,limit:n}),q5=await Promise.all(e.items.map((Z5)=>V(Z5)));return a5(q5,{totalResults:e.total,startIndex:l+1,itemsPerPage:e.count})},I=async(Y)=>{let z=await x.get(Y);if(!z)return h(404,`User ${Y} not found`,"invalidValue");return N5(await V(z))},T=async(Y,z)=>{let S=i.accessIndex;if(!S?.setSubjectDisabled||!z.id)return;let y=Y?Y.active??!0:!0,R=z.active??!0;if(Y&&y===R)return;if(!Y&&R)return;await S.setSubjectDisabled(z.id,"user",!R)},v=async(Y)=>{let z=await Y.json(),S=await t5(J.user,z);if(S.issues)return Z.error("User creation validation failed",{"ion.operation":"scim.user.create","ion.outcome":"failure",validationIssues:S.issues}),h(400,`Request validation failed: ${S.issues.map((f)=>f.message).join("; ")}`,"invalidValue");let y=S.value;if(!y.userName&&!y.emails?.[0]?.value)return h(400,"userName or email is required","invalidValue");let R=await D(y,{mode:"create"});return await v5(i,async()=>{await x.upsert(R),await T(void 0,R)},r1(void 0,R),async()=>{await e1(X,R)}),N5(await V(R),201)},b=async(Y,z)=>{let S=await x.get(z);if(!S)return h(404,`User ${z} not found`,"invalidValue");let y=await Y.json(),R=await t5(J.user,y);if(R.issues)return Z.error("User replacement validation failed",{"ion.operation":"scim.user.replace","ion.outcome":"failure",validationIssues:R.issues}),h(400,`Request validation failed: ${R.issues.map((n)=>n.message).join("; ")}`,"invalidValue");let f=R.value,l=await D({...f,id:z},{existing:S,mode:"replace"});return l.createdAt=S.createdAt,l.updatedAt=new Date,await v5(i,async()=>{await x.upsert(l),await T(S,l)},r1(S,l),async()=>{await e1(X,l)}),N5(await V(l))},C=async(Y,z)=>{let S=await x.get(z);if(!S)return h(404,`User ${z} not found`,"invalidValue");let R=(await Y.json()).Operations??[],l={...await V(S)};for(let e of R)M(l,e);let n=await t5(J.user,l);if(n.issues)return Z.error("User patch validation failed",{"ion.operation":"scim.user.patch","ion.outcome":"failure",validationIssues:n.issues}),h(400,`Request validation failed: ${n.issues.map((e)=>e.message).join("; ")}`,"invalidValue");let a=await D(n.value,{existing:S,mode:"patch"});return a.updatedAt=new Date,await v5(i,async()=>{await x.upsert(a),await T(S,a)},r1(S,a),async()=>{await e1(X,a)}),N5(await V(a))},U=async(Y)=>{if(!await x.get(Y))return h(404,`User ${Y} not found`,"invalidValue");if(Q){let S=await Q.listBySubject(Y,"user"),y=[];for(let R of S.items)await E1(i,R,y);await K9(i,y)}if(await x.delete(Y),await i.accessIndex?.setSubjectDisabled?.(Y,"user",!1),i.authz.oaa.isReady())await F9(i,"authz.oaa.delete","OAA incremental user delete failed; full sync will reconcile",()=>i.authz.oaa.deleteUser(Y),{id:Y,kind:"user"});return new Response(null,{status:204})};W5={handler:j}}async function c5(x,k){$5();let m=new URL(x.url).pathname,d=U5(k?.usersUrl??q.usersUrl??"/api/iam/Users")??"/api/iam/Users",s=U5(k?.groupsUrl??q.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",G=await z5(x,k);if(G)return G;let O=(K)=>m===K||m.startsWith(`${K}/`);if(O(d)){if(!c)return h(404,"SCIM Users endpoint is disabled by RemoteConfig");if(!W5)return h(501,"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application.");return W5.handler(x,{basePath:d})}if(O(s)){if(!Q5)return h(404,"SCIM Groups endpoint is disabled by RemoteConfig");if(!V5)return h(501,"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.");return V5.handler(x,{basePath:s})}return h(404,"Resource not found")}return{...q,createUser:l5,getBaseUrl:g5,groups_outbound:u5,groups_inbound:V5,users_inbound:W5,handler:c5,delta:u}}function V9(J,Z){let $=new TextEncoder().encode(J),X=typeof Z==="string"?new TextEncoder().encode(Z):Z,Q=new Uint8Array($.length+1+X.length);return Q.set($,0),Q[$.length]=46,Q.set(X,$.length+1),Q}function P4(J){let Z=J.replace(/-/g,"+").replace(/_/g,"/"),$=Z.length%4===0?"":"=".repeat(4-Z.length%4),X=atob(Z+$),Q=new Uint8Array(X.length);for(let L=0;L<X.length;L++)Q[L]=X.charCodeAt(L);return Q}function z4(J){let Z="";for(let $ of J)Z+=String.fromCharCode($);return btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function c9(J){let Z=JSON.parse(J);if(!Z||typeof Z!=="object"||!Array.isArray(Z.keys))throw Error("Invalid JWKS: expected { keys: [...] }");return Z}function O4(J){return JSON.stringify(J)}async function E4(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x},{name:"Ed25519"},!0,["verify"])}async function j4(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x,d:J.d},{name:"Ed25519"},!0,["sign"])}async function A4(J){let $=(typeof J.jwks==="string"?c9(J.jwks):J.jwks).keys.find((X)=>X.kid===J.kid&&X.kty==="OKP"&&X.crv==="Ed25519");if(!$?.x)return!1;try{let X=await E4($),Q=V9(J.requestId,J.rawBody),L=P4(J.signatureB64Url);return crypto.subtle.verify({name:"Ed25519"},X,L,Q)}catch{return!1}}async function w4(J){let Z=await j4(J.privateKeyJwk),$=V9(J.requestId,J.rawBody),X=await crypto.subtle.sign({name:"Ed25519"},Z,$);return z4(new Uint8Array(X))}async function I4(J){let Z=await crypto.subtle.generateKey({name:"Ed25519"},!0,["sign","verify"]),$=await crypto.subtle.exportKey("jwk",Z.privateKey),Q=(await crypto.subtle.exportKey("jwk",Z.publicKey)).x,L=$.d;if(!Q||!L)throw Error("Failed to export Ed25519 key material (missing x/d)");return{privateJwk:{kty:"OKP",crv:"Ed25519",x:Q,d:L,kid:J,alg:"EdDSA",use:"sig"},publicJwks:{keys:[{kty:"OKP",crv:"Ed25519",x:Q,kid:J,alg:"EdDSA",use:"sig"}]}}}var L1={jwksTtlSeconds:{min:60,max:86400,default:600},jwksMaxEntries:{min:16,max:4096,default:256},sessionReadTtlSeconds:{min:1,max:300,default:30},sessionReadMaxEntries:{min:16,max:65536,default:1024}};function I1(J,Z){if(typeof J!=="number"||!Number.isFinite(J))return Z.default;let $=Math.floor(J);if($<Z.min)return Z.min;if($>Z.max)return Z.max;return $}function d9(J){return{ttlMs:I1(J?.ttlSeconds,L1.jwksTtlSeconds)*1000,maxEntries:I1(J?.maxEntries,L1.jwksMaxEntries)}}function n9(J){let Z=J?.read;return{read:{enabled:Z?.enabled===!0,ttlMs:I1(Z?.ttlSeconds,L1.sessionReadTtlSeconds)*1000,maxEntries:I1(Z?.maxEntries,L1.sessionReadMaxEntries)}}}function T4(J){return{jwks:d9(J?.jwks),session:n9(J?.session)}}function S4(J){let Z={};if(!J)return Z;let $=J.split(";");for(let X of $){let Q=X.trim();if(!Q)continue;let L=Q.indexOf("=");if(L===-1)continue;Z[Q.slice(0,L).trim()]=Q.slice(L+1).trim()}return Z}function a9(J){if(!J.expiresAt)return!1;let Z=J.expiresAt instanceof Date?J.expiresAt:new Date(J.expiresAt);return!Number.isNaN(Z.getTime())&&Date.now()>Z.getTime()}function R4(J){if(!J||typeof J!=="object"||Array.isArray(J))return;let{access_token:Z,id_token:$,refresh_token:X,tokens:Q,...L}=J;return L}function P5(J,Z){let $=J[Z];return typeof $==="string"?$:""}function x4(J,Z){let $=J.exp;if(typeof $==="number")return new Date($*1000);if(typeof $==="string"&&$.trim()){let X=Number($);if(!Number.isNaN(X))return new Date(X*1000)}if(Z instanceof Date)return Z;if(Z){let X=new Date(Z);if(!Number.isNaN(X.getTime()))return X}return new Date}function y4(J){let Z=J.claims;if(!Z?.sub||typeof Z.sub!=="string")return;let $=x4(Z,J.expiresAt);if(J.authType==="sso")return{id:Z.sub,userName:P5(Z,"preferred_username"),name:P5(Z,"name"),email:P5(Z,"email"),avatar:P5(Z,"picture")||void 0,sso:{profile:Z,tenant:{id:P5(Z,"idp")||P5(Z,"iss"),name:P5(Z,"iss")},tokenType:"Bearer",expires:$}};return{id:Z.sub,userName:P5(Z,"preferred_username"),name:P5(Z,"name"),email:P5(Z,"email"),avatar:P5(Z,"picture")||void 0,userType:"customer",ciam:{profile:Z,scope:"openid profile email",tokenType:"Bearer",expires:$}}}function b4(J){if(J.authType!=="sso"&&J.authType!=="ciam")return;if(a9(J))return;return{sid:J.sid,authType:J.authType,tenantId:typeof J.tenantId==="string"?J.tenantId:void 0,sub:J.sub,expiresAt:J.expiresAt,createdAt:J.createdAt,claims:R4(J.claims)}}function q4(J,Z){if(!J.endsWith(".session"))return!1;if(!Z||Z.length===0)return!0;return Z.some(($)=>J===`${$}.session`)}function C4(J){if(J===void 0)return;let Z=(Array.isArray(J)?J:[J]).map(($)=>$.trim()).filter(($)=>$.length>0);return Z.length>0?Z:void 0}async function t9(J,Z,$){return(await i9(J,Z,$)).map(b4).filter((Q)=>Boolean(Q))}async function i9(J,Z,$){let X=S4(J.headers.get("cookie")),Q=C4($?.cookiesPrefix),L=[],H=new Set;for(let[B,W]of Object.entries(X)){if(!q4(B,Q)||!W)continue;if(H.has(W))continue;H.add(W);let F=await Z.get(W);if(!F)continue;if(F.authType!=="sso"&&F.authType!=="ciam")continue;if(a9(F))continue;L.push(F)}return L}async function v4(J,Z,$){return(await t9(J,Z,$)).map(y4).filter((Q)=>Boolean(Q))}var U4="@ionite/core",k4=n5(D1(U4));async function f4(J,Z){let $=await S5({idToken:J,jwksUri:Z.jwksUri,issuer:Z.issuer,audience:Z.audience}),X=await k4.validate($);if(X.issues)throw Error(`ID token claims validation failed: ${X.issues.map((H)=>H.message).join("; ")}`);let Q=X.value;if(Q===void 0)throw Error("ID token claims missing");return o9(Q)}function Y5(J){return Date.now()-J}function N9(J){if(J instanceof Error)return{"error.name":J.name,"error.message":J.message};return{"error.name":typeof J,"error.message":String(J)}}function T1(J,Z){if(!J)return{};try{let $=new URL(J);return{[`${Z}.origin`]:$.origin,[`${Z}.path`]:$.pathname}}catch{return{[`${Z}.path`]:J.startsWith("/")?J:`/${J}`}}}function S1(J,Z=5){if(!Array.isArray(J))return[String(J)];return J.slice(0,Z).map(($)=>{if(!$||typeof $!=="object")return String($);let X=$,Q=Array.isArray(X.path)?X.path.join("."):String(X.path??""),L=typeof X.message==="string"?X.message:String(X.message??"validation failed");return Q?`${Q}: ${L}`:L})}function h4(J){if(!J||typeof J!=="object")return{};let Z=J;return{oidc_error:typeof Z.error==="string"?Z.error:void 0,oidc_error_description:typeof Z.error_description==="string"?Z.error_description:void 0,oidc_error_uri:typeof Z.error_uri==="string"?Z.error_uri:void 0}}function g4(J,Z={}){let $=typeof J==="string"?J:J?.headers.get("cookie")??void 0;if(!$)return[];let Q=`${Z.cookiePrefix??"ion.sso"}.`,L=new Set;for(let H of Object.keys(p4($))){if(!H.startsWith(Q))continue;let B=H.slice(Q.length),W=B.lastIndexOf(".");if(W<=0)continue;let F=B.slice(0,W).trim();if(F)L.add(F)}return Array.from(L)}function m4(J,Z,$,X,Q){if(!$&&!X)return;let L=new WeakMap,H=new Map,B={...$,...X},W=!!(B.authority&&B.tokenUrl&&B.authorizationUrl&&B.clientId&&B.redirectUri&&B.scope),F={...B,authority:W?p(B.authority,"Missing 'authority' from SSO Config"):B.authority,tokenUrl:W?p(B.tokenUrl,"Missing 'tokenUrl' from SSO Config"):B.tokenUrl,authorizationUrl:W?p(B.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):B.authorizationUrl,clientId:W?p(B.clientId,"Missing 'clientId' from SSO Config"):B.clientId,redirectUri:W?p(B.redirectUri,"Missing 'redirectUri' from SSO Config"):B.redirectUri,scope:W?p(B.scope,"Missing 'scope' from SSO Config"):B.scope,responseType:B.responseType??"code",cookiesSecure:B.cookiesSecure!==void 0?B.cookiesSecure:!0,cookiesSameSite:B.cookiesSameSite!==void 0?B.cookiesSameSite:"Strict",cookiesPrefix:B.cookiesPrefix??(B.clientId?`ion.sso.${B.clientId}`:"ion.sso"),cookiesPath:B.cookiesPath??"/"},g=Math.min(600,Math.max(0,Math.floor(Number(F.rotationGraceSeconds??60))||0))*1000;function u(){let G=[];if(!F.authority)G.push("authority");if(!F.tokenUrl)G.push("tokenUrl");if(!F.authorizationUrl)G.push("authorizationUrl");if(!F.clientId)G.push("clientId");if(!F.redirectUri)G.push("redirectUri");if(!F.scope)G.push("scope");if(G.length>0)throw Error(`Missing OIDC configuration fields: ${G.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing ionite.`)}async function t(G){if(!F)throw Error("ionite SSO Manager not initialized");let O=L.get(G);if(O)return O;let K=o(G);return L.set(G,K),K}async function o(G){try{let{tokens:O,session:K,refreshedUser:N}=await W5(G);if(!O)return{status:"unauthenticated"};if(N)return{status:"authenticated",value:N};if(K?.claims)return{status:"authenticated",value:$5(K.claims,O,z5(K.expiresAt))};return{status:"unauthenticated"}}catch(O){if(r9(O))return{status:"unauthenticated"};return Z.error("Error parsing user from cookies",{"ion.operation":"cookie.parse","ion.outcome":"degraded"},O),{status:"degraded",error:O instanceof Error?O:void 0}}}async function F5(G){let O=await t(G);return O.status==="authenticated"?O.value:void 0}async function i(G){if(!F)throw Error("ionite SSO Manager not initialized");u();let O=p(F.redirectUri,"Missing 'redirectUri' from SSO Config"),K=p(F.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"),N=p(F.clientId,"Missing 'clientId' from SSO Config"),V=p(F.scope,"Missing 'scope' from SSO Config"),D=F.cookiesSecure?G.url.replace(/^http:\/\//,"https://"):G.url,E=_5(),A=_5(64),_=_5(),M=O;try{new URL(M)}catch{if(D)try{let v=new URL(D),b=M.startsWith("//")?M.slice(1):M.startsWith("/")?M:`/${M}`;M=new URL(b,v.origin).toString()}catch{try{let v=new URL(K),b=M.startsWith("//")?M.slice(1):M.startsWith("/")?M:`/${M}`;M=new URL(b,v.origin).toString()}catch{throw Error(`Invalid redirectUri: "${O}". It must be a valid absolute URL.`)}}}let j=new URL(K);j.searchParams.append("client_id",N),j.searchParams.append("redirect_uri",M),j.searchParams.append("response_type","code"),j.searchParams.append("scope",V),j.searchParams.append("state",E),j.searchParams.append("nonce",_);let P=await J1(A);j.searchParams.append("code_challenge",P),j.searchParams.append("code_challenge_method","S256");let I=await F.beforeLogin?.({request:G}),T=I===void 0?{state:E,codeVerifier:A,nonce:_}:{state:E,codeVerifier:A,nonce:_,context:I};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:j.toString(),"Set-Cookie":x(d(E),T,F.loginStateTtl??600,"Lax")}})}async function H5(G){if(!F)throw Error("ionite SSO Manager not initialized");let O;try{O=await F5(G)}catch{O=void 0}let K=await F.beforeLogout?.({request:G,user:O}),N=m("session",G),V;try{V=await W5(G);let P=V.tokens?.refresh_token??m("refresh",G);if(P)await g5(P)}catch(P){Z.warn("Failed to revoke token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},P)}if(F.sessionStore)try{let P=V?.sid??N;if(P)await F.sessionStore.delete(P)}catch(P){Z.warn("Failed to delete session",{"ion.operation":"session.delete","ion.outcome":"degraded"},P)}let D=[["Set-Cookie",k("session")]],E=await F.afterLogout?.({request:G,context:K}),A=R5(E,"/",G.url);if(A.response){let P=new Headers(A.response.headers);for(let[,I]of D)P.append("Set-Cookie",I);return new Response(A.response.body,{status:A.response.status,statusText:A.response.statusText,headers:P})}let _=A.location??"/",M=G.headers.get("accept");if(M?.includes("application/json")||M?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:_}),{status:200,headers:[["Content-Type","application/json"],...D]});return new Response("Logged out",{status:302,headers:[["Location",_],...D]})}async function q(G){if(!F)throw Error("ionite SSO Manager not initialized");if(!F.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{if(!G.headers.get("content-type")?.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let K=await G.text(),V=new URLSearchParams(K).get("logout_token");if(!V)return new Response("Missing logout_token parameter",{status:400});let D=p(F.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify logout tokens."),E=p(F.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify logout tokens."),A=F.jwksUri||`${D}/protocol/openid-connect/certs`,_=await d1({logoutToken:V,jwksUri:A,issuer:D,audience:E,log:Z}),M=typeof _.sid==="string"?_.sid:void 0;if(!M)return Z.warn("Back-Channel Logout: logout_token missing sid claim",{"ion.operation":"backchannel_logout","ion.outcome":"failure"}),new Response("Invalid logout_token: missing sid claim",{status:400});return await F.sessionStore.delete(M),Z.info("Back-Channel Logout: successfully deleted session",{"ion.module":"sso",sid:M}),new Response("OK",{status:200})}catch(O){return Z.error("Error during back-channel logout",{"ion.operation":"backchannel_logout","ion.outcome":"failure"},O),new Response("Internal Server Error",{status:500})}}async function c(G){if(!F)throw Error("ionite SSO Manager not initialized");let O=Date.now(),K=new URL(G.url),N=new URLSearchParams(K.search);Z.debug("SSO callback received",{"ion.event":"ion.sso.callback.received","ion.module":"sso","ion.operation":"sign_in.callback","http.method":G.method,"url.path":K.pathname,hasCode:N.has("code"),hasState:N.has("state"),hasError:N.has("error"),...T1(N.get("iss")??void 0,"oidc.issuer")});let V=Object.fromEntries(N.entries()),D=await J.callbackParams.validate(V);if(D.issues)return Z.warn("SSO callback parameter validation failed",{"ion.event":"ion.sso.callback.validation_failed","ion.operation":"sign_in.callback","ion.outcome":"failure","validation.issues":S1(D.issues)}),s9(D.issues,"OIDC callback parameters validation failed");let{code:E,state:A}=D.value,_;try{let M=p(A,'OIDC "state" was not present in the callback parameters'),j=m(d(M),G,!0),{codeVerifier:P,state:I,nonce:T,context:v}=j??{};_=v,Z.debug("SSO callback state cookie read",{"ion.event":"ion.sso.callback.state_cookie_read","ion.module":"sso","ion.operation":"sign_in.callback",hasStateCookie:Boolean(j),hasCodeVerifier:Boolean(P),hasStateVerifier:Boolean(I),hasNonce:Boolean(T),hasContext:v!==void 0});let b=p(P,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');p(I,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');let C=p(T,'OIDC "nonce" was not present in cookies, ensure that the SSO login was initiated correctly'),U=p(E,'OIDC "code" was not present in the callback parameters');if(A!==I)throw Z.warn("SSO callback state verification failed",{"ion.event":"ion.sso.callback.state_verification_failed","ion.operation":"sign_in.callback","ion.outcome":"failure"}),Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');Z.debug("SSO callback state verified",{"ion.event":"ion.sso.callback.state_verified","ion.module":"sso","ion.operation":"sign_in.callback"});let Y=F.cookiesSecure?G.url.replace(/^http:\/\//,"https://"):G.url,z=await f5(U,b,Y),{tokenExpiresAt:S,sessionExpiresAt:y}=Q5(z);z.expires=S.toISOString();let R=Date.now();Z.debug("SSO ID token parsing started",{"ion.event":"ion.sso.id_token.parse_started","ion.module":"sso","ion.operation":"id_token.parse"});let f=await r(z,C,y);Z.debug("SSO ID token parsing completed",{"ion.event":"ion.sso.id_token.parse_completed","ion.module":"sso","ion.operation":"id_token.parse","duration.ms":Y5(R),"user.id":f.id});let l,n;{let Z5=T5("SSO requires sessionStore configuration for opaque session cookies."),J5=typeof f.sso.profile.sid==="string"?f.sso.profile.sid:void 0,j5=J5||_5(32),G5=f.id;if(Z.debug("SSO session creation evaluated",{"ion.event":"ion.sso.session.create_evaluated","ion.module":"sso","ion.operation":"session.create",hasSid:Boolean(j5),hasIdpSid:Boolean(J5),hasSub:Boolean(G5),"user.id":G5}),!G5)throw Error("Session creation failed: missing sub in ID token claims");let x1=Date.now(),F1={sid:j5,sub:G5,idpSid:J5,authType:"sso",tenantId:F.tenantId,tokens:z,claims:f.sso.profile,expiresAt:y,createdAt:new Date};await b5(Z5,F1),n=F1,l=["Set-Cookie",x("session",j5,y)],Z.info("SSO session created",{"ion.event":"ion.sso.session.created","ion.operation":"session.create","ion.outcome":"success","duration.ms":Y5(x1),"user.id":G5})}if(F.userStore)try{let Z5=f.id;if(Z5){let J5=new Date,j5=Date.now();Z.debug("SSO user store lookup started",{"ion.event":"ion.sso.user.lookup_started","ion.module":"sso","ion.operation":"user.lookup","user.id":Z5});let G5=await F.userStore.get(Z5);if(Z.debug("SSO user store lookup completed",{"ion.event":"ion.sso.user.lookup_completed","ion.module":"sso","ion.operation":"user.lookup","duration.ms":Y5(j5),"user.id":Z5,found:Boolean(G5)}),G5||F.enableJitUserProvisioning){let x1=Date.now(),F1={...G5??{},...f,id:Z5,tenantId:G5?.tenantId,createdAt:G5?.createdAt??J5,updatedAt:J5};await F.userStore.upsert(F1),Z.info("SSO user stored",{"ion.event":"ion.sso.user.stored","ion.operation":"user.store","ion.outcome":"success","duration.ms":Y5(x1),"user.id":Z5,existing:Boolean(G5),jitProvisioning:Boolean(F.enableJitUserProvisioning)})}else Z.warn("JIT user provisioning disabled: user not found in store and will not be created",{"ion.event":"ion.sso.user.skipped","ion.operation":"user.store","ion.outcome":"skipped","user.id":Z5})}else Z.warn("User storage skipped: missing sub in ID token claims",{"ion.event":"ion.sso.user.skipped","ion.operation":"user.store","ion.outcome":"skipped"})}catch(Z5){Z.warn("Failed to store user",{"ion.event":"ion.sso.user.store_failed","ion.operation":"user.store","ion.outcome":"degraded",...N9(Z5)})}Z.info("SSO sign-in succeeded",{"ion.event":"ion.sso.sign_in.succeeded","ion.operation":"sign_in.callback","ion.outcome":"success","duration.ms":Y5(O),"user.id":f.id});let a=[["Set-Cookie",k(d(M))],...l?[l]:[]],e=await F.afterLogin?.({ok:!0,request:G,user:f,session:n,context:_}),q5=R5(e,"/",G.url);if(q5.response)return C5(q5.response,a.map(([,Z5])=>Z5));return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",q5.location],...a]})}catch(M){Z.error("Error during sign-in callback",{"ion.event":"ion.sso.sign_in.callback_failed","ion.operation":"sign_in.callback","ion.outcome":"failure","duration.ms":Y5(O),...N9(M)});let j=A?[["Set-Cookie",k(d(A))]]:[],P=await F.afterLogin?.({ok:!1,request:G,error:M,context:_}),I=R5(P,"/",G.url);if(I.response)return C5(I.response,j.map(([,T])=>T));return new Response("Authentication failed, redirecting",{status:302,headers:[["Location",I.location],...j]})}}function Q5(G){let O=Date.now(),K=Number(G.expires_in??3600)||3600,N=new Date(O+K*1000),V;if(G.refresh_expires_in!=null&&Number.isFinite(Number(G.refresh_expires_in)))V=Number(G.refresh_expires_in);else if(G.refresh_token)V=86400;else V=K;return{tokenExpiresAt:N,sessionExpiresAt:new Date(O+V*1000)}}async function r(G,O,K){if(!F)throw Error("ionite SSO Manager not initialized");let N=Date.now(),V=await p5(G.id_token,O);return Z.debug("SSO user parsed from ID token",{"ion.event":"ion.sso.user.parse_completed","ion.module":"sso","ion.operation":"id_token.parse","duration.ms":Y5(N),"user.id":V.sub,hasEmail:Boolean(V.email),hasName:Boolean(V.name)}),$5(V,G,K)}function $5(G,O,K){let N=K??Q5(O).sessionExpiresAt,V=G.ecid!==void 0&&G.ecid!==null?A1(G.ecid):void 0;return{id:G.sub,userName:G.preferred_username||"",name:G.name||"",email:G.email||"",emails:[{value:G.email||"",primary:!0}],...V?{ecid:V}:{},avatar:G.picture,sso:{profile:{...G},tenant:{id:G.idp||G.iss||"",name:G.iss||""},scope:O.scope,tokenType:O.token_type,sessionState:O.session_state,expires:N}}}async function D5(G){if(!F.userStore)return G;let O=await F.userStore.lookup(G);if(!O)return G;return{...G,...O,id:G.id,sso:G.sso}}async function f5(G,O,K){if(!F)throw Error("ionite SSO Manager not initialized");u();let N=p(F.tokenUrl,"Missing 'tokenUrl' from SSO Config"),V=p(F.redirectUri,"Missing 'redirectUri' from SSO Config"),D=p(F.clientId,"Missing 'clientId' from SSO Config"),E=V;try{new URL(E)}catch{if(K)try{let _=new URL(K),M=E.startsWith("//")?E.slice(1):E.startsWith("/")?E:`/${E}`;E=new URL(M,_.origin).toString()}catch{try{let _=new URL(N),M=E.startsWith("//")?E.slice(1):E.startsWith("/")?E:`/${E}`;E=new URL(M,_.origin).toString()}catch{throw Error(`Invalid redirectUri: "${V}". It must be a valid absolute URL.`)}}}let A=new URLSearchParams;if(A.append("grant_type","authorization_code"),A.append("code",G),A.append("redirect_uri",E),A.append("client_id",D),F.clientSecret)A.append("client_secret",F.clientSecret);A.append("code_verifier",O);try{let _=Date.now();Z.debug("SSO token exchange started",{"ion.event":"ion.sso.token.exchange_started","ion.module":"sso","ion.operation":"token.exchange",...T1(N,"oidc.token_url"),...T1(E,"oidc.redirect_uri"),hasClientSecret:Boolean(F.clientSecret)});let M=await fetch(N,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:A.toString()});Z.debug("SSO token exchange response received",{"ion.event":"ion.sso.token.response_received","ion.module":"sso","ion.operation":"token.exchange","http.status_code":M.status,"duration.ms":Y5(_)}),Z.debug("SSO token exchange response body read started",{"ion.event":"ion.sso.token.response_body_read_started","ion.module":"sso","ion.operation":"token.exchange"});let j=await M.json();if(Z.debug("SSO token exchange response body read completed",{"ion.event":"ion.sso.token.response_body_read_completed","ion.module":"sso","ion.operation":"token.exchange","duration.ms":Y5(_)}),!M.ok){Z.error("Token exchange error",{"ion.event":"ion.sso.token.exchange_failed","ion.operation":"token.exchange","ion.outcome":"failure","http.status_code":M.status,"duration.ms":Y5(_),...h4(j)});let I=j;throw Error(`Token exchange failed: ${I.error||M.statusText} - ${I.error_description||""}`.trim())}let P=await J.tokenResponse.validate(j);if(P.issues)throw Z.error("Token response validation failed",{"ion.event":"ion.sso.token.response_validation_failed","ion.operation":"token.exchange","ion.outcome":"failure","duration.ms":Y5(_),"validation.issues":S1(P.issues)}),Error(`Token response validation failed: ${P.issues}`);return Z.debug("SSO token exchange completed",{"ion.event":"ion.sso.token.exchange_completed","ion.module":"sso","ion.operation":"token.exchange","ion.outcome":"success","duration.ms":Y5(_),tokenType:P.value.token_type,hasAccessToken:Boolean(P.value.access_token),hasIdToken:Boolean(P.value.id_token),hasRefreshToken:Boolean(P.value.refresh_token),expiresIn:P.value.expires_in}),P.value}catch(_){throw Z.error("Error during token exchange",{"ion.event":"ion.sso.token.exchange_failed","ion.operation":"token.exchange","ion.outcome":"failure",...N9(_)}),_}}async function h5(G){return g1(async()=>{if(!F)throw Error("ionite SSO Manager not initialized");u();let O=p(F.tokenUrl,"Missing 'tokenUrl' from SSO Config"),K=p(F.clientId,"Missing 'clientId' from SSO Config"),N=new URLSearchParams;N.append("grant_type","refresh_token"),N.append("refresh_token",G),N.append("client_id",K);let V=await fetch(O,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:N.toString()}),D=await V.json();if(!V.ok){Z.error("Token refresh error",{"ion.operation":"token.refresh","ion.outcome":"failure",response:D});let A=D;throw Error(`Token refresh failed: ${A.error||V.statusText} - ${A.error_description||""}`.trim())}let E=await J.tokenResponse.validate(D);if(E.issues)throw Z.error("Token refresh response validation failed",{"ion.event":"ion.sso.token.refresh_validation_failed","ion.operation":"token.refresh","ion.outcome":"failure","validation.issues":S1(E.issues)}),Error(`Token refresh response validation failed: ${E.issues}`);return E.value},void 0,void 0,void 0,Z)}async function g5(G){try{if(!F)throw Error("ionite SSO Manager not initialized");if(!F.revocationEndpoint)return;let O=p(F.clientId,"Missing 'clientId' from SSO Config"),K=new URLSearchParams;K.append("token",G),K.append("token_type_hint","refresh_token"),K.append("client_id",O);let N=await fetch(F.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:K.toString()});if(!N.ok)Z.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:N.status,statusText:N.statusText});else Z.info("Token revoked successfully",{"ion.module":"sso"})}catch(O){Z.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},O)}}async function m5(){if(!F)throw Error("ionite SSO Manager not initialized");let G=F.authority;if(!F.jwksUri&&!G)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let O=F.jwksUri||`${G}/protocol/openid-connect/certs`;return r5(O,Z)}async function p5(G,O){let K=Date.now(),N=p(F.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify ID tokens."),V=p(F.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify ID tokens."),D=F.jwksUri||`${N}/protocol/openid-connect/certs`;Z.debug("SSO ID token verification started",{"ion.event":"ion.sso.id_token.verify_started","ion.module":"sso","ion.operation":"id_token.verify",...T1(D,"oidc.jwks_uri")});let E;try{E=await S5({idToken:G,jwksUri:D,issuer:N,audience:V,expectedNonce:O,log:Z})}catch(_){throw Z.error("SSO ID token verification failed",{"ion.event":"ion.sso.id_token.verify_failed","ion.module":"sso","ion.operation":"id_token.verify","ion.outcome":"failure","duration.ms":Y5(K)},_),_}Z.debug("SSO ID token signature verified",{"ion.event":"ion.sso.id_token.signature_verified","ion.module":"sso","ion.operation":"id_token.verify","duration.ms":Y5(K)});let A=await J.idTokenClaims.validate(E);if(A.issues)throw Z.error("ID token claims validation failed",{"ion.event":"ion.sso.id_token.validation_failed","ion.operation":"id_token.validate","ion.outcome":"failure","duration.ms":Y5(K),"validation.issues":S1(A.issues)}),Error(`ID token claims validation failed: ${A.issues}`);return Z.debug("SSO ID token claims validated",{"ion.event":"ion.sso.id_token.claims_validated","ion.module":"sso","ion.operation":"id_token.validate","ion.outcome":"success","duration.ms":Y5(K),"user.id":A.value.sub,hasIssuer:Boolean(A.value.iss),hasAudience:Boolean(A.value.aud)}),A.value}function T5(G="SSO sessionStore is required for opaque session cookies."){if(!F.sessionStore)throw Error(G);return F.sessionStore}async function b5(G,O){try{await G.create(O)}catch(K){if(!await G.get(O.sid))throw K;await G.update(O.sid,O)}}function z5(G){if(!G)return;if(G instanceof Date)return G;let O=new Date(G);return Number.isNaN(O.getTime())?void 0:O}function u5(G){let O=G.tokens;if(!O?.access_token||!O.id_token||!O.token_type)return;return O}async function l5(G,O=!1){let K=T5(),N=m("session",G);if(!N)return{tokens:void 0,refreshHeaders:[]};let V=await K.get(N);if(V&&F.tenantId&&V.tenantId&&V.tenantId!==F.tenantId)return{tokens:void 0,refreshHeaders:[["Set-Cookie",k("session")]],sid:N};if(V?.authType!=="sso")return{tokens:void 0,refreshHeaders:[["Set-Cookie",k("session")]],sid:N};let D=u5(V);if(!D)return{tokens:void 0,refreshHeaders:[["Set-Cookie",k("session")]],sid:N};let E=z5(V.expiresAt);if(E?Date.now()>E.getTime():!1)return await K.delete(N),{tokens:void 0,sid:N,refreshHeaders:[["Set-Cookie",k("session")]]};let _=z5(D.expires),M=_?Date.now()>_.getTime():!0;if((O||M)&&D.refresh_token)return V5(N,V,D);return{tokens:D,sid:N,session:V,refreshHeaders:[]}}function V5(G,O,K){let N=H.get(G);if(N)return N;let V=T5(),D=(async()=>{let E=await h5(K.refresh_token),{tokenExpiresAt:A,sessionExpiresAt:_}=Q5(E);E.expires=A.toISOString();let M=await r(E,void 0,_),j=M.sso.profile,P=_5(32),I={...O,sid:P,tokens:E,claims:j,expiresAt:_,createdAt:new Date};await b5(V,I);try{if(g<=0)await V.delete(G);else{let{refresh_token:T,...v}=K;await V.update(G,{tokens:v,expiresAt:new Date(Date.now()+g)})}}catch(T){Z.warn("Failed to retire rotated SSO session record",{"ion.operation":"session.rotate","ion.outcome":"degraded"},T)}return{tokens:E,sid:P,session:I,refreshedUser:M,refreshHeaders:[["Set-Cookie",x("session",P,_)]]}})();return H.set(G,D),D.finally(()=>{H.delete(G)})}async function W5(G,O=!1){return l5(G,O)}async function c5(G){let{tokens:O}=await W5(G);if(!O)return;return O.access_token}function x(G,O,K,N=F.cookiesSameSite??"Strict"){if(!F)throw Error("ionite SSO Manager not initialized");if(G=`${F.cookiesPrefix}.${G}`,typeof O!=="string")O=btoa(JSON.stringify(O));let V;if(K instanceof Date)V=`Expires=${K.toUTCString()}`;else if(typeof K==="number")V=`Max-Age=${K}`;else throw Error("Invalid expires type",K);if(O.length>4000)throw Error(`Error setting cookie: ${G}. Cookie length is: ${O.length}`);return`${G}=${O}; ${V}; Path=${F.cookiesPath}; HttpOnly;${F.cookiesSecure?" Secure;":""} SameSite=${N};`}function k(G){if(!F)throw Error("ionite SSO Manager not initialized");return`${F.cookiesPrefix}.${G}=; Max-Age=0; Path=${F.cookiesPath}; HttpOnly;${F.cookiesSecure?" Secure;":""} SameSite=${F.cookiesSameSite};`}function m(G,O,K=!1){if(!F)throw Error("ionite SSO Manager not initialized");let N=O.headers.get("cookie");if(!N)return null;let V=`${F.cookiesPrefix}.${G}`,D=N.split(";").find((M)=>M.trim().startsWith(`${V}=`));if(!D)return null;let E=D.indexOf("="),A=D.slice(E+1).trim();if(!K)return A;let _=atob(A);return JSON.parse(_)}function d(G){return`state_${G}`}async function s(G,O){if(!F)throw Error("ionite SSO Manager not initialized");let{loginUrl:K,userUrl:N,tokenUrl:V,refreshUrl:D,logoutUrl:E,logoutBackChannelUrl:A,jwksUrl:_,redirectUri:M}={...F,...O},j=new URL(G.url).pathname;if(M){let P;try{P=new URL(M).pathname}catch{try{let I=new URL(G.url),T=M.startsWith("//")?M.slice(1):M;P=new URL(T,I.origin).pathname}catch{P=M.startsWith("/")?M:`/${M}`}}if(P===j)return c(G)}if(K===j)return i(G);if(N===j)try{let{tokens:P,session:I,refreshedUser:T,refreshHeaders:v}=await W5(G);if(!P)return new Response("User not logged in",{status:401,headers:v});let b=T??(I?.claims?$5(I.claims,P,z5(I.expiresAt)):void 0);if(!b)return new Response("User not logged in",{status:401,headers:v});let C=await D5(b);return new Response(JSON.stringify(C),{headers:[["Content-Type","application/json"],...v]})}catch(P){if(r9(P))return new Response("User not logged in",{status:401});return Z.error("Error resolving SSO user",{"ion.operation":"sso.user","ion.outcome":"degraded"},P),new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(V===j){let{tokens:P,refreshHeaders:I}=await W5(G);if(!P)return new Response("User not logged in",{status:401,headers:I});return new Response(JSON.stringify({token:P.access_token,expires:P.expires}),{headers:[["Content-Type","application/json"],...I]})}if(D===j){let{tokens:P,refreshHeaders:I}=await W5(G,!0);if(!P)return new Response("User not logged in",{status:401});return new Response("Refresh Complete",{status:200,headers:I})}if(E===j)return H5(G);if(A===j)return q(G);if(_===j){let P=await m5();return new Response(JSON.stringify(P),{headers:[["Content-Type","application/json"]]})}return new Response("Not Found",{status:404})}return{...F,getUser:F5,resolveUser:t,getJwt:c5,initiateLogin:i,logout:H5,logoutBackChannel:q,callbackHandler:c,handler:s}}function p4(J){let Z={},$=J.split(";");for(let X of $){let Q=X.trim();if(!Q)continue;let L=Q.indexOf("=");if(L===-1)continue;let H=Q.slice(0,L).trim(),B=Q.slice(L+1).trim();Z[H]=B}return Z}function r9(J){if(!(J instanceof Error))return!1;return["Public key not found","Invalid JWT","Invalid JWT signature","ID token expired","ID token issuer mismatch","ID token audience mismatch","ID token nonce mismatch","ID token missing exp","invalid_grant"].some((Z)=>J.message.includes(Z))}function e9(J){return J=J??"SSO Unavailable",new Response(JSON.stringify({error:J}),{status:503,statusText:J,headers:{"Content-Type":"application/json"}})}var R1="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.";async function u4(J,Z){return p(Z,R1),Z.sso?.getUser(J)}async function l4(J,Z){return p(Z,R1),await Z.sso?.resolveUser(J)??{status:"unauthenticated"}}async function c4(J,Z){p(Z,R1);let $=Z.sso;if(!$)return e9();return $.initiateLogin(J)}async function d4(J,Z){p(Z,R1);let $=Z.sso;if(!$)return e9();return $.callbackHandler(J)}export{C5 as withSetCookies,G1 as withDefaultExternalId,f4 as verifyUser,d1 as verifyLogoutToken,A4 as verifyLfvSignature,S5 as verifyIdToken,O4 as stringifyLfvJwks,m4 as sso,w4 as signLfvPayload,P2 as setJwksRetry,_2 as setJwksClock,y2 as setDiscoveryClock,t4 as sendTenantWebhook,i1 as sameOriginRedirectRules,l4 as resolveUser,n9 as resolveSessionCacheConfig,o1 as resolveRedirect,C1 as resolveProviderBranding,d9 as resolveJwksCacheConfig,j2 as resolveJwkForKid,d2 as resolveCustomer,V1 as resolveCiamProvider,m2 as resolveCapturedRedirect,T4 as resolveCacheConfig,R5 as resolveAfterRedirect,W9 as reconcileSubjectAccess,J1 as pkceChallengeFromVerifier,c9 as parseLfvJwks,v1 as orderedEnabledProviders,e5 as normalizeOidcIssuer,g4 as listSsoClientIdsFromCookies,v9 as isRedirectAllowed,c4 as initiateLogin,_4 as iam,V2 as hasScope,G2 as hasRole,W2 as hasPermission,L2 as hasGroup,N2 as hasAnyScope,F2 as hasAny,M2 as hasAllScope,H2 as hasAll,B2 as has,p1 as getVerificationKeyForKid,u4 as getUser,A2 as getPublicKeyFromJwks,w2 as getPublicKeyForKid,q1 as getProviderPreset,r5 as getJwks,v4 as getDiscoveredSessionUsers,c2 as getCustomer,m1 as getCachedVerificationKey,I4 as generateLfvEd25519KeyPair,t1 as generateAppleClientSecret,a1 as fetchUserInfo,B9 as expandRoot,c1 as exchangeAuthorizationCode,t9 as discoverSessions,i9 as discoverSessionRecords,n1 as discoverOidcEndpoints,h2 as defaultRedirectPolicies,D2 as configureJwksCache,n4 as collectReferencedDefinitions,E2 as clearJwksCache,b2 as clearDiscoveryCache,l2 as ciam,g2 as captureRedirect,d4 as callback,V9 as buildLfvSigningInput,l1 as buildAuthorizationUrl,b9 as blockDangerousUrls,R9 as assertTrustedIdTokenClaims,C9 as allowSameOrigin,q9 as allowRelativePaths,k2 as allowOrigins,f2 as allowHosts,a4 as InMemoryTenantStore,Y9 as CatalogAdjacencyCache,z9 as CIAM_PROVIDER_PRESETS,L1 as CACHE_BOUNDS};
+import{A as s9,E as P1,I as o9,K as L9,L as $9,O as a4,P as t4,Q as W5,R as X9,T as I5,a as D9,d as l9,e as M5,f as W1,g as G1,h as Y9,i as B9,j as W9,k as n4,o as G9,u as A1,v as U9,w as k9,x as D1,y as n5,z as p}from"./shared/core-f0gk15rd.js";var J2="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",M9=["user","customer","workload"],Z2={user:async(J,Z)=>Z.sso?.getUser(J),customer:async(J,Z)=>Z.ciam?.getCustomer(J),workload:async(J,Z)=>{let $=await Z.workload?.getWorkloadIdentity?.(J);if(!$)return;let X=$.clientId??$.workloadId??$.claims.sub;return X?{...$,id:X}:void 0}};function $2(J){if(J==="any")return M9;let Z=Array.isArray(J)?J:[J];return M9.filter(($)=>Z.includes($))}function X2(J){let Z=J.headers.get("cookie");if(!Z)return[];return Z.split(";").map(($)=>$.slice(0,$.indexOf("=")===-1?$.length:$.indexOf("=")).trim()).filter(Boolean)}function Q2(J,Z){let $=J.headers.get("authorization")?.toLowerCase().startsWith("bearer ")??!1,X=X2(J),Q=new Set;for(let H of X){if(H.startsWith("ion.sso"))Q.add("user");if(H.startsWith("ion.ciam"))Q.add("customer")}let F=X.length>0&&!Q.has("user")&&!Q.has("customer");return Z.filter((H)=>{if(H==="workload")return $;if(X.length===0)return!1;return Q.has(H)||F})}function X5(J){return typeof J==="string"?J:J.id}function _9(J){let{subject:Z,subjectType:$}=J,X;if($==="user")X=Z.sso?.scope;else if($==="customer")X=Z.ciam?.scope;else if($==="workload")X=Z.scope;return new Set((X??"").split(/\s+/).filter(Boolean))}function b1(J,Z,$){let X=_9(J),Q=Z.filter((H)=>X.has(H));return{allow:$==="any"?Q.length>0:Z.length>0&&Q.length===Z.length,metadata:{reason:"scope",wantedScopes:Z,matchedScopes:Q}}}function d5(J,Z){return($)=>{if(J.length===0)return;let X=_9($),Q=J.filter((H)=>X.has(H));return(Z==="any"?Q.length>0:Q.length===J.length)?Q:void 0}}function H1(J,Z,$){return(X)=>{if(Z.length===0||X.subjectType!=="workload")return;let Q=D9(J.config?.authz,X.subject);if(!Q)return;let F=Z.filter((B)=>Q.has(B));return($==="any"?F.length>0:F.length===Z.length)?F:void 0}}function K2(J,Z){if(J.subjectType==="workload"){let $=J.subject.scopesAsEntitlements;if(typeof $==="boolean")return $}return Z.config?.authz?.scopesAsEntitlements===!0}function y1(J,Z,$,X,Q){return{allow:$==="ok",subject:Z?.subject,subjectType:Z?.subjectType,reason:$,decision:X,response(){if($==="ok")return new Response(null,{status:204});if($==="unauthenticated")return J.log.warn("authz.denied",{reason:$,...Q()}),Response.json({error:"Unauthorized"},{status:401});if($==="not_configured")return J.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...Q()}),Response.json({error:"not_configured"},{status:503});return J.log.warn("authz.denied",{reason:$,subject:Z?.subject?.id,subjectType:Z?.subjectType,...Q()}),Response.json({error:"Forbidden"},{status:403})}}}function Y2(J,Z,$){return new Promise((X)=>{let Q=[],F=J.length,H=!1,B=()=>{if(F-=1,F===0&&!H)H=!0,X({outcomes:Q})};for(let W of J)Z(W).then((L)=>{if(Q.push({principal:W,decision:L}),!H&&L.allow){H=!0,X({matched:{principal:W,decision:L},outcomes:Q});return}B()},(L)=>{$?.(W,L),Q.push({principal:W,decision:{allow:!1,metadata:{reason:"error"}}}),B()})})}async function A5(J,Z,$,X,Q,F,H){p(Z,J2);let B=Q2(J,$2($)),L=(await Promise.all(B.map(async(q)=>{let d=await Z2[q](J,Z);return d?.id?{subject:d,subjectType:q,subjectId:d.id}:void 0}))).filter((q)=>q!==void 0);if(L.length===0)return y1(Z,void 0,"unauthenticated",void 0,Q);let c=async(q)=>{let d=Z.authz.accessIndex;if(!d?.isSubjectDisabled)return!1;return d.isSubjectDisabled(q.subjectId,q.subjectType)},m=async(q)=>{if(H){let d=H(q);if(d&&d.length>0){if(await c(q))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"trusted-client",matchedPermissions:d}}}}if(F&&K2(q,Z)){let d=F(q);if(d&&d.length>0){if(await c(q))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"scope",matchedScopes:d}}}}return X(q)},{matched:a,outcomes:u}=await Y2(L,m,(q,d)=>{Z.log.warn("authz.check_error",{"ion.operation":"authz.check","ion.outcome":"error",subject:q.subjectId,subjectType:q.subjectType,error:d instanceof Error?d.message:String(d),...Q()})});if(a){if(a.decision.metadata?.reason==="scope")Z.log.info("authz.scope_honor",{"ion.operation":"authz.scope_honor","ion.outcome":"allow",subject:a.principal.subjectId,subjectType:a.principal.subjectType,matchedScopes:a.decision.metadata.matchedScopes,...Q()});return y1(Z,a.principal,"ok",a.decision,Q)}let Q5=u.length>0&&u.every((q)=>{let d=q.decision.metadata?.reason;return d==="access_index_not_configured"||d==="error"}),n=u[0],H5=Q5?"not_configured":"forbidden";return y1(Z,n?.principal,H5,n?.decision,Q)}async function B2(J,Z,$,X,Q,F="any"){return A5(J,Z,F,(H)=>Z.authz.has(H.subjectId,$,X,Q,H.subjectType),()=>({targetType:$,target:X5(X),resource:Q?X5(Q):void 0}),Q?void 0:d5([X5(X)],"any"),$==="permission"&&!Q?H1(Z,[X5(X)],"any"):void 0)}async function W2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(F)=>Z.authz.hasPermission(F.subjectId,$,X,F.subjectType),()=>({targetType:"permission",target:X5($),resource:X?X5(X):void 0}),X?void 0:d5([X5($)],"any"),X?void 0:H1(Z,[X5($)],"any"))}async function G2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(F)=>Z.authz.hasRole(F.subjectId,$,X,F.subjectType),()=>({targetType:"role",target:X5($),resource:X?X5(X):void 0}),X?void 0:d5([X5($)],"any"))}async function L2(J,Z,$,X,Q="any"){return A5(J,Z,Q,(F)=>Z.authz.hasGroup(F.subjectId,$,X,F.subjectType),()=>({targetType:"group",target:X5($),resource:X?X5(X):void 0}),X?void 0:d5([X5($)],"any"))}async function F2(J,Z,$,X="any"){let Q=$.filter((H)=>!H.resource).map((H)=>X5(H.target)),F=$.filter((H)=>!H.resource&&H.targetType==="permission").map((H)=>X5(H.target));return A5(J,Z,X,(H)=>Z.authz.hasAny(H.subjectId,$,H.subjectType),()=>({targets:$.map((H)=>`${H.targetType}:${X5(H.target)}`)}),Q.length>0?d5(Q,"any"):void 0,F.length>0?H1(Z,F,"any"):void 0)}async function H2(J,Z,$,X="any"){let Q=$.length>0&&$.every((B)=>!B.resource),F=$.length>0&&$.every((B)=>!B.resource&&B.targetType==="permission"),H=$.map((B)=>X5(B.target));return A5(J,Z,X,(B)=>Z.authz.hasAll(B.subjectId,$,B.subjectType),()=>({targets:$.map((B)=>`${B.targetType}:${X5(B.target)}`)}),Q?d5(H,"all"):void 0,F?H1(Z,H,"all"):void 0)}async function V2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,[$],"any")),()=>({scope:$}))}async function N2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,$,"any")),()=>({scopes:$}))}async function M2(J,Z,$,X="any"){return A5(J,Z,X,(Q)=>Promise.resolve(b1(Q,$,"all")),()=>({scopes:$}))}function Y5(J){return typeof J==="string"&&J.length>0?J:void 0}function P9(J){let Z=Y5(J.email);return{sub:String(J.sub??""),email:Z,name:Y5(J.name),userName:Y5(J.preferred_username)??Z,avatar:Y5(J.picture)}}var z9={oidc:{flow:"id_token",scope:"openid profile email",branding:{displayName:"Single sign-on"},mapClaims:P9},google:{flow:"id_token",authorizationUrl:"https://accounts.google.com/o/oauth2/v2/auth",tokenUrl:"https://oauth2.googleapis.com/token",jwksUri:"https://www.googleapis.com/oauth2/v3/certs",scope:"openid email profile",branding:{displayName:"Google",iconUrl:"https://www.gstatic.com/firebasejs/ui/2.0.0/images/auth/google.svg",colors:{light:"#ffffff",dark:"#131314",secondary:"#4285F4"},url:"https://accounts.google.com"},mapClaims:P9},microsoft:{flow:"id_token",authorizationUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",tokenUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/token",jwksUri:"https://login.microsoftonline.com/common/discovery/v2.0/keys",scope:"openid email profile",branding:{displayName:"Microsoft",colors:{light:"#ffffff",dark:"#2f2f2f",secondary:"#0067b8"},url:"https://login.microsoftonline.com"},mapClaims:(J)=>{let Z=Y5(J.email)??Y5(J.preferred_username);return{sub:String(J.sub??J.oid??""),email:Z,name:Y5(J.name),userName:Y5(J.preferred_username)??Z,avatar:Y5(J.picture)}}},apple:{flow:"id_token",authorizationUrl:"https://appleid.apple.com/auth/authorize",tokenUrl:"https://appleid.apple.com/auth/token",jwksUri:"https://appleid.apple.com/auth/keys",scope:"openid email name",extraAuthParams:{response_mode:"form_post"},branding:{displayName:"Apple",colors:{light:"#000000",dark:"#ffffff"},url:"https://appleid.apple.com"},mapClaims:(J)=>{let Z=Y5(J.email);return{sub:String(J.sub??""),email:Z,name:Y5(J.name),userName:Z}}},github:{flow:"userinfo",authorizationUrl:"https://github.com/login/oauth/authorize",tokenUrl:"https://github.com/login/oauth/access_token",userInfoUrl:"https://api.github.com/user",scope:"read:user user:email",branding:{displayName:"GitHub",colors:{light:"#24292f",dark:"#ffffff"},url:"https://github.com"},mapClaims:(J)=>({sub:String(J.id??J.node_id??""),email:Y5(J.email),name:Y5(J.name)??Y5(J.login),userName:Y5(J.login),avatar:Y5(J.avatar_url)})}};function q1(J){if(J==="magic-link")return;return z9[J]}function V1(J,Z){if(Z.type==="magic-link")return;let $=q1(Z.type);if(!$)return;return{name:J,type:Z.type,flow:$.flow,authorizationUrl:Z.authorizationUrl??$.authorizationUrl,tokenUrl:Z.tokenUrl??$.tokenUrl,jwksUri:Z.jwksUri??$.jwksUri,userInfoUrl:Z.userInfoUrl??$.userInfoUrl,scope:Z.scope??$.scope,clientId:Z.clientId,clientSecret:Z.clientSecret,extraAuthParams:$.extraAuthParams,branding:{...$.branding,...Z.branding},mapClaims:$.mapClaims,config:Z}}function C1(J){return{...q1(J.type)?.branding??{displayName:J.type},...J.branding}}function v1(J){if(!J)return[];return Object.entries(J).filter(([,Z])=>Z.enabled!==!1).map(([Z,$],X)=>({name:Z,config:$,index:X})).sort((Z,$)=>{let X=Z.config.order??Number.MAX_SAFE_INTEGER,Q=$.config.order??Number.MAX_SAFE_INTEGER;if(X!==Q)return X-Q;return Z.index-$.index}).map(({name:Z,config:$})=>({name:Z,config:$}))}var E9=600000,k1=256,F5=new Map;function D2(J){if(typeof J?.ttlMs==="number"&&Number.isFinite(J.ttlMs))E9=Math.min(Math.max(J.ttlMs,60000),86400000);if(typeof J?.maxEntries==="number"&&Number.isFinite(J.maxEntries)){k1=Math.max(1,Math.floor(J.maxEntries));while(F5.size>k1){let Z=F5.keys().next().value;if(Z===void 0)break;F5.delete(Z)}}}function O9(J,Z){F5.delete(J),F5.set(J,Z);while(F5.size>k1){let $=F5.keys().next().value;if($===void 0)break;F5.delete($)}}var o5=new Map,f1=()=>Date.now();function _2(J){f1=J??(()=>Date.now())}var h1={};function P2(J){h1=J??{}}function z2(J){if(!J)return;if(/\bno-store\b/i.test(J))return 60000;let Z=/max-age\s*=\s*(\d+)/i.exec(J);if(!Z)return;let $=Number(Z[1]);return Number.isFinite($)?$*1000:void 0}function O2(J){let $=z2(J)??E9;return Math.min(Math.max($,60000),86400000)}async function g1(J,Z=3,$=1000,X=30000,Q){let F=Error("Placeholder Error");for(let H=0;H<=Z;H++)try{return await J()}catch(B){if(F=B instanceof Error?B:Error(String(B)),B instanceof Error&&B.message.includes("400"))throw B;if(H===Z)throw F;let W=Math.min($*2**H,X),L=Math.random()*0.1*W;await new Promise((c)=>setTimeout(c,W+L)),Q?.warn(`Retry attempt ${H+1} after ${W+L}ms delay`)}throw F}async function r5(J,Z,$){let X=F5.get(J);if(!$?.forceRefresh&&X&&X.expiresAt>f1())return O9(J,X),X.jwks;let Q=o5.get(J);if(Q)return Q;let F=(async()=>{try{return await g1(async()=>{let H=await fetch(J);if(!H.ok)throw Error("Failed to fetch JWKS");let B=await H.json(),W=O2(H.headers.get("cache-control"));return O9(J,{jwks:B,expiresAt:f1()+W,importedKeys:new Map}),B},h1.maxRetries,h1.baseDelayMs,void 0,Z)}catch(H){let B=F5.get(J);if(B)return Z?.warn("JWKS refresh failed; serving last-known-good keys",{"ion.operation":"jwks.refresh","ion.outcome":"degraded"}),B.jwks;throw H}finally{o5.delete(J)}})();return o5.set(J,F),F}function E2(J){if(J){F5.delete(J),o5.delete(J);return}F5.clear(),o5.clear()}async function j2(J,Z,$){return(await j9(J,Z,$)).jwk}async function j9(J,Z,$){if(!Z?.trim())throw Error("JWT header missing kid");await r5(J,$);let X=F5.get(J),Q=X?.jwks.keys.find((F)=>F.kid===Z);if(!Q)await r5(J,$,{forceRefresh:!0}),X=F5.get(J),Q=X?.jwks.keys.find((F)=>F.kid===Z);if(!X||!Q)throw Error("Public key not found");return{jwk:Q,entry:X}}async function m1(J,Z,$,X,Q){let{jwk:F,entry:H}=await j9(J,Z,Q),B=`${Z}\x00${$}`,W=H.importedKeys.get(B);if(W)return W;let L=X(F);return L.catch(()=>{if(H.importedKeys.get(B)===L)H.importedKeys.delete(B)}),H.importedKeys.set(B,L),L}async function A2(J,Z){let $=J.keys.find((X)=>X.kid===Z);if(!$)throw Error("Public key not found");return A9($)}function A9(J){return crypto.subtle.importKey("jwk",{kty:J.kty,n:J.n,e:J.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}async function w2(J,Z,$){return m1(J,Z,"rs256",A9,$)}var U1={RS256:{kty:"RSA",importParams:{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},verifyParams:{name:"RSASSA-PKCS1-v1_5"}},ES256:{kty:"EC",crv:"P-256",importParams:{name:"ECDSA",namedCurve:"P-256"},verifyParams:{name:"ECDSA",hash:"SHA-256"}}};async function p1(J,Z,$,X){if(typeof $!=="string"||!($ in U1))throw Error(`Unsupported JWT alg "${String($)}" (allowed: ${Object.keys(U1).join(", ")})`);let Q=U1[$];return{key:await m1(J,Z,`oidc:${$}`,(H)=>{if(H.kty!==Q.kty)throw Error(`JWK type "${H.kty}" does not match token alg "${$}"`);if(Q.kty==="EC"){let B=H;if(B.crv!==Q.crv)throw Error(`JWK curve "${String(B.crv)}" does not match token alg "${$}"`);return crypto.subtle.importKey("jwk",{kty:"EC",crv:B.crv,x:B.x,y:B.y},Q.importParams,!1,["verify"])}return crypto.subtle.importKey("jwk",{kty:H.kty,n:H.n,e:H.e},Q.importParams,!1,["verify"])},X),algorithm:Q.verifyParams}}function _5(J=32){let Z=new Uint8Array(J);return crypto.getRandomValues(Z),Array.from(Z,($)=>$.toString(16).padStart(2,"0")).join("").substring(0,J)}function N1(J){let Z="";return J.forEach(($)=>{Z+=String.fromCharCode($)}),btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function T9(J){let Z=J.replace(/-/g,"+").replace(/_/g,"/"),$=Z.padEnd(Z.length+(4-Z.length%4)%4,"="),X=atob($),Q=new Uint8Array(X.length);for(let F=0;F<X.length;F++)Q[F]=X.charCodeAt(F);return Q}function w9(J){let Z=new TextDecoder().decode(T9(J));return JSON.parse(Z)}async function J1(J){let Z=new TextEncoder().encode(J),$=await crypto.subtle.digest("SHA-256",Z);return N1(new Uint8Array($))}function l1(J){let Z=new URL(J.authorizationUrl);if(Z.searchParams.set("client_id",J.clientId),Z.searchParams.set("redirect_uri",J.redirectUri),Z.searchParams.set("response_type","code"),Z.searchParams.set("scope",J.scope),Z.searchParams.set("state",J.state),J.codeChallenge)Z.searchParams.set("code_challenge",J.codeChallenge),Z.searchParams.set("code_challenge_method","S256");if(J.nonce)Z.searchParams.set("nonce",J.nonce);for(let[$,X]of Object.entries(J.extraParams??{}))Z.searchParams.set($,X);return Z.toString()}async function c1(J){let Z=new URLSearchParams;if(Z.append("grant_type","authorization_code"),Z.append("code",J.code),Z.append("redirect_uri",J.redirectUri),Z.append("client_id",J.clientId),J.clientSecret)Z.append("client_secret",J.clientSecret);if(J.codeVerifier)Z.append("code_verifier",J.codeVerifier);let $=await fetch(J.tokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:Z.toString()}),X=await $.json();if(!$.ok){let Q=X;throw J.log?.error("OIDC authorization-code exchange failed",{"ion.operation":"token.exchange","ion.outcome":"failure","http.status_code":$.status,oidc_error:Q.error}),Error(`Token exchange failed: ${Q.error||$.statusText} - ${Q.error_description||""}`.trim())}if(typeof X.access_token!=="string")throw Error("Token exchange response missing access_token");return X}var S9=60;function e5(J){return J.trim().replace(/\/$/,"")}function R9(J){let{claims:Z,audience:$}=J,X=e5(J.issuer),Q=J.nowSec??Math.floor(Date.now()/1000),F=J.clockSkewSec??S9,H=Z.iss;if(typeof H!=="string"||e5(H)!==X)throw Error("ID token issuer mismatch");let B=Z.aud,W=Array.isArray(B)?B.includes($):typeof B==="string"&&B===$,L=typeof Z.azp==="string"&&Z.azp===$;if(!W&&!L)throw Error("ID token audience mismatch");if(typeof Z.exp!=="number")throw Error("ID token missing exp");if(Z.exp<Q-F)throw Error("ID token expired");if(J.expectedNonce!==void 0){if(Z.nonce!==J.expectedNonce)throw Error("ID token nonce mismatch")}}async function x9(J,Z,$){let X=J.split(".");if(X.length!==3)throw Error("Invalid JWT");let Q=w9(X[0]),F=w9(X[1]),H=T9(X[2]),{key:B,algorithm:W}=await p1(Z,Q.kid,Q.alg,$),L=new TextEncoder().encode(`${X[0]}.${X[1]}`);if(!await crypto.subtle.verify(W,B,H,L))throw Error("Invalid JWT signature");return{header:Q,payload:F}}async function S5(J){let{payload:Z}=await x9(J.idToken,J.jwksUri,J.log);return R9({claims:Z,issuer:J.issuer,audience:J.audience,clockSkewSec:J.clockSkewSec,expectedNonce:J.expectedNonce}),Z}var I2="http://schemas.openid.net/event/backchannel-logout";async function d1(J){let{payload:Z}=await x9(J.logoutToken,J.jwksUri,J.log),$=e5(J.issuer),X=Z.iss;if(typeof X!=="string"||e5(X)!==$)throw Error("Logout token issuer mismatch");let Q=Z.aud,F=Array.isArray(Q)?Q.includes(J.audience):typeof Q==="string"&&Q===J.audience,H=typeof Z.azp==="string"&&Z.azp===J.audience;if(!F&&!H)throw Error("Logout token audience mismatch");if(Z.nonce!=null)throw Error("Logout token must not contain a nonce");let B=Z.events;if(!(typeof B==="object"&&B!==null&&!Array.isArray(B)&&Object.hasOwn(B,I2)))throw Error("Logout token missing back-channel logout event");let L=typeof Z.sid==="string"&&Z.sid.length>0,c=typeof Z.sub==="string"&&Z.sub.length>0;if(!L&&!c)throw Error("Logout token missing sid and sub");if(typeof Z.exp==="number"){let m=Math.floor(Date.now()/1000),a=J.clockSkewSec??S9;if(Z.exp<m-a)throw Error("Logout token expired")}return Z}var T2=3600000,S2=60000,R2=86400000,x2=256,w5=new Map,s5=new Map;function I9(J,Z){w5.delete(J),w5.set(J,Z);while(w5.size>x2){let $=w5.keys().next().value;if($===void 0)break;w5.delete($)}}var u1=()=>Date.now();function y2(J){u1=J??(()=>Date.now())}function b2(J){if(J){w5.delete(J),s5.delete(J);return}w5.clear(),s5.clear()}function q2(J){let Z=J?/max-age\s*=\s*(\d+)/i.exec(J):null,$=Z?Number(Z[1]):Number.NaN,X=Number.isFinite($)?$*1000:T2;return Math.min(Math.max(X,S2),R2)}async function n1(J){let Z=w5.get(J);if(Z&&Z.expiresAt>u1())return I9(J,Z),Z.endpoints;let $=s5.get(J);if($)return $;let X=(async()=>{try{let Q=J.replace(/\/$/,""),F=await fetch(`${Q}/.well-known/openid-configuration`,{headers:{Accept:"application/json"}});if(!F.ok)throw Error(`OIDC discovery failed for ${J} with status ${F.status}`);let H=await F.json(),B={authorizationUrl:typeof H.authorization_endpoint==="string"?H.authorization_endpoint:void 0,tokenUrl:typeof H.token_endpoint==="string"?H.token_endpoint:void 0,jwksUri:typeof H.jwks_uri==="string"?H.jwks_uri:void 0,userInfoUrl:typeof H.userinfo_endpoint==="string"?H.userinfo_endpoint:void 0};return I9(J,{endpoints:B,expiresAt:u1()+q2(F.headers.get("cache-control"))}),B}catch(Q){let F=w5.get(J);if(F)return F.endpoints;throw Q}finally{s5.delete(J)}})();return s5.set(J,X),X}async function a1(J,Z){let $=await fetch(J,{headers:{Authorization:`Bearer ${Z}`,Accept:"application/json","User-Agent":"ionite-ciam"}});if(!$.ok)throw Error(`UserInfo request failed with status ${$.status}`);return await $.json()}function C2(J){let Z=J.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,""),$=atob(Z),X=new Uint8Array($.length);for(let Q=0;Q<$.length;Q++)X[Q]=$.charCodeAt(Q);return X}async function t1(J){let Z=Math.floor(Date.now()/1000),$={alg:"ES256",kid:J.keyId,typ:"JWT"},X={iss:J.teamId,iat:Z,exp:Z+(J.expiresInSeconds??3600),aud:"https://appleid.apple.com",sub:J.clientId},Q=N1(new TextEncoder().encode(JSON.stringify($))),F=N1(new TextEncoder().encode(JSON.stringify(X))),H=`${Q}.${F}`,B=await crypto.subtle.importKey("pkcs8",C2(J.privateKey),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),W=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},B,new TextEncoder().encode(H));return`${H}.${N1(new Uint8Array(W))}`}function v2(J){for(let Z=0;Z<J.length;Z++){let $=J.charCodeAt(Z);if($<=31||$===127)return!0}return!1}function U2(J,Z){let $=null;try{$=new URL(J,Z)}catch{$=null}let X="";try{X=new URL(Z).origin}catch{X=""}return{candidate:J,url:$,requestOrigin:X}}function y9(J,Z,$){let X=U2(J,$),Q=!1;for(let F of Z){let H=F(X);if(H==="deny")return!1;if(H==="allow")Q=!0}return Q}function b9(){return({candidate:J,url:Z})=>{if(v2(J))return"deny";if(J.includes("\\"))return"deny";if(J.startsWith("//"))return"deny";if(!Z)return"deny";if(Z.protocol!=="http:"&&Z.protocol!=="https:")return"deny";if(Z.username||Z.password)return"deny";return"abstain"}}function q9(){return({candidate:J})=>J.startsWith("/")&&!J.startsWith("//")&&!J.startsWith("/\\")?"allow":"abstain"}function C9(){return({url:J,requestOrigin:Z})=>J&&Z&&J.origin===Z?"allow":"abstain"}function k2(...J){let Z=new Set(J.map(($)=>{try{return new URL($).origin}catch{return $}}));return({url:$})=>$&&Z.has($.origin)?"allow":"abstain"}function f2(...J){let Z=J.map(($)=>$.toLowerCase());return({url:$})=>{if(!$)return"abstain";let X=$.hostname.toLowerCase();for(let Q of Z)if(Q.startsWith(".")){if(X===Q.slice(1)||X.endsWith(Q))return"allow"}else if(X===Q)return"allow";return"abstain"}}function i1(){return[b9(),q9(),C9()]}function v9(J,Z,$){if(!J)return!1;return y9(J,Z,$)}function o1(J,Z){if(!J)return Z.fallback;return y9(J,Z.rules,Z.requestUrl)?J:Z.fallback}var h2={rules:i1(),fallback:"/"};function g2(J,Z,$="redirect"){let X=new URL(J.url).searchParams.get($)??void 0;return v9(X,Z.rules,J.url)?{redirect:X}:void 0}function m2(J,Z){let $=J.context;return o1($?.redirect,{rules:Z.rules,fallback:Z.fallback,requestUrl:J.request.url})}function R5(J,Z,$){if(J instanceof Response)return{response:J};if(typeof J==="string")return{location:o1(J,{rules:i1(),fallback:Z,requestUrl:$})};return{location:Z}}function C5(J,Z){if(Z.length===0)return J;let $=new Headers(J.headers);for(let X of Z)$.append("Set-Cookie",X);return new Response(J.body,{status:J.status,statusText:J.statusText,headers:$})}var M1="ciam",p2="id_token",u2="access_token";function l2(J,Z,$,X,Q,F){if(!$&&!X)return;let H=new WeakMap,B={...$,...X},W={...B,magicLinkTtl:B.magicLinkTtl??3600,sessionTtl:B.sessionTtl??86400,cookiesSecure:B.cookiesSecure!==void 0?B.cookiesSecure:!0,cookiesSameSite:B.cookiesSameSite!==void 0?B.cookiesSameSite:"Strict",cookiesPrefix:B.cookiesPrefix??(B.ciamId?`ion.ciam.${B.ciamId}`:"ion.ciam"),cookiesPath:B.cookiesPath??"/"};function L(){if(!W.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and first-party logout.");return W.sessionStore}function c(){L()}let m=J.callbackParams??n5(U9("ionite.ciam")),a=J.idTokenClaims??n5(D1("ionite.ciam")),u=J.tokenResponse??n5(k9("ionite.ciam"));function Q5(K=32){let N=new Uint8Array(K);return crypto.getRandomValues(N),Array.from(N,(V)=>V.toString(16).padStart(2,"0")).join("").substring(0,K)}function n(K,N,V,D=W.cookiesSameSite??"Strict"){if(!W)throw Error("ionite CIAM Manager not initialized");if(K=`${W.cookiesPrefix}.${K}`,typeof N!=="string")N=btoa(JSON.stringify(N));let E;if(V instanceof Date)E=`Expires=${V.toUTCString()}`;else if(typeof V==="number")E=`Max-Age=${V}`;else throw Error("Invalid expires type",V);if(N.length>4000)throw Error(`Error setting cookie: ${K}. Cookie length is: ${N.length}`);return`${K}=${N}; ${E}; Path=${W.cookiesPath}; HttpOnly;${W.cookiesSecure?" Secure;":""} SameSite=${D};`}function H5(K){if(!W)throw Error("ionite CIAM Manager not initialized");return`${W.cookiesPrefix}.${K}=; Max-Age=0; Path=${W.cookiesPath}; HttpOnly;${W.cookiesSecure?" Secure;":""} SameSite=${W.cookiesSameSite};`}function q(K,N,V=!1){if(!W)throw Error("ionite CIAM Manager not initialized");let D=N.headers.get("cookie");if(!D)return null;let E=`${W.cookiesPrefix}.${K}`,A=D.split(";").find((j)=>j.trim().startsWith(`${E}=`));if(!A)return null;let _=A.indexOf("="),M=A.substring(_+1).trim();if(!V)return M;try{let j=atob(M);return JSON.parse(j)}catch(j){return Z.error("[CIAM] Failed to parse cookie",{"ion.operation":"cookie.parse","ion.outcome":"failure",cookieName:E},j),null}}function d(K){return`cstate_${K}`}async function K5(K,N,V,D){let E=await W.afterLogin?.({...N,request:K,context:V}),A=R5(E,"/",K.url);if(A.response)return C5(A.response,D.map(([,_])=>_));return new Response(N.ok?"Authentication successful, redirecting":"Authentication failed, redirecting",{status:302,headers:[["Location",A.location],...D]})}function r(K,N){return["Set-Cookie",n("session",K,N)]}function $5(K){if(!K)return;if(K instanceof Date)return K;let N=new Date(K);return Number.isNaN(N.getTime())?void 0:N}async function D5(K){let N=q("session",K);if(!N)return;let V=await L().get(N);if(V&&W.tenantId&&V.tenantId&&V.tenantId!==W.tenantId)return;if(V?.authType!=="ciam")return;let D=$5(V.expiresAt);if(D&&Date.now()>D.getTime()){await L().delete(N);return}return V}async function f5(K){if(!W)throw Error("ionite CIAM Manager not initialized");c();let N=H.get(K);if(N)return N;let V=h5(K);return H.set(K,V),V}async function h5(K){try{let N=await D5(K);if(!N?.claims?.sub)return{status:"unauthenticated"};return{status:"authenticated",value:z5(N.claims)}}catch(N){return Z.error("CIAM session resolution failed",{"ion.operation":"ciam.session","ion.outcome":"degraded"},N),{status:"degraded",error:N instanceof Error?N:void 0}}}async function g5(K){let N=await f5(K);return N.status==="authenticated"?N.value:void 0}async function m5(K){if(!W)throw Error("ionite CIAM Manager not initialized");c();let N;try{N=await g5(K)}catch{N=void 0}let V=await W.beforeLogout?.({request:K,user:N});try{let P=q("session",K);if(P)await L().delete(P)}catch(P){Z.warn("Failed to delete CIAM session",{"ion.operation":"session.delete","ion.outcome":"degraded"},P)}let D=[["Set-Cookie",H5("session")]],E=await W.afterLogout?.({request:K,context:V}),A=R5(E,"/",K.url);if(A.response)return C5(A.response,D.map(([,P])=>P));let _=A.location??"/",M=K.headers.get("accept");if(M?.includes("application/json")||M?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:_}),{status:200,headers:[["Content-Type","application/json"],...D]});return new Response("Logged out",{status:302,headers:[["Location",_],...D]})}function p5(K){return K.id||K.email||`ciam-${K.userName}`}function T5(K,N,V){return{sub:p5(K),iss:M1,aud:M1,typ:p2,exp:Math.floor(V.getTime()/1000),iat:Math.floor(Date.now()/1000),email:K.email,name:K.name,preferred_username:K.userName,picture:K.avatar,sid:N}}function b5(K,N,V){return{sub:K,iss:M1,aud:M1,typ:u2,exp:Math.floor(V.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:N,scope:"openid profile email"}}function z5(K){let N=K.exp?new Date(K.exp*1000):new Date;return{id:K.sub,userName:K.preferred_username??"",name:K.name??"",email:K.email??"",avatar:K.picture,userType:"customer",ciam:{profile:K,scope:"openid profile email",tokenType:"Bearer",expires:N}}}async function u5(K){if(!W)throw Error("ionite CIAM Manager not initialized");if(!Q)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:{"Content-Type":"application/json"}});if(!await Q.getWorkloadIdentity(K))return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:{"Content-Type":"application/json"}});let V,D;try{if(!K.headers.get("content-type")?.includes("application/json"))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:{"Content-Type":"application/json"}});let b=await K.text(),C=JSON.parse(b);D=typeof C?.redirect==="string"&&C.redirect.length>0?C.redirect:void 0;let U={userName:C.userName,name:C.name,email:C.email,avatar:C.avatar},Y=await J.customer.validate(U);if(Y.issues)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:{"Content-Type":"application/json"}});V=Y.value}catch(v){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:{"Content-Type":"application/json"}})}let A=new URL(K.url).searchParams.get("ttl"),_=A?parseInt(A,10):W.magicLinkTtl??3600;if(Number.isNaN(_)||_<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:{"Content-Type":"application/json"}});let M=Q5(32),j=new Date(Date.now()+_*1000);if(!W.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:500,headers:{"Content-Type":"application/json"}});try{await W.magicLinkStore.create(M,V,j)}catch(v){return Z.error("Error creating magic link",{"ion.operation":"magic_link.create","ion.outcome":"failure"},v),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:{"Content-Type":"application/json"}})}let P=new URL(K.url),I=W.magicLinkLoginUrl||"/magic-link/login",T=new URL(I,P.origin);if(T.searchParams.set("token",M),D)T.searchParams.set("redirect",D);return new Response(JSON.stringify({magicLink:T.toString(),expiresAt:j.toISOString()}),{status:200,headers:{"Content-Type":"application/json"}})}async function l5(K){if(!W)throw Error("ionite CIAM Manager not initialized");c();let V=new URL(K.url).searchParams.get("token");if(!V)return K5(K,{ok:!1,error:Error("Missing magic-link token")},void 0,[]);if(!W.magicLinkStore)return K5(K,{ok:!1,error:Error("Magic link store not configured")},void 0,[]);let D=await W.magicLinkStore.getAndDelete(V);if(!D)return K5(K,{ok:!1,error:Error("Magic link invalid, expired, or already used")},void 0,[]);let E=new Date(Date.now()+(W.sessionTtl??86400)*1000),A=Q5(32),_=p5(D.customer),M=T5(D.customer,A,E),j=b5(_,A,E),P=z5(M),I;try{let v={sid:A,sub:_,authType:"ciam",tenantId:W.tenantId,expiresAt:E,claims:M,accessClaims:j,createdAt:new Date};await L().create(v),I=v}catch(v){throw Z.warn("Failed to create session",{"ion.operation":"session.create","ion.outcome":"degraded"},v),v}if(W.customerStore)try{let v=P.id;if(v){let b=new Date,C=await W.customerStore.get(v);if(C||W.enableJitUserProvisioning){let U={...C??{},...P,id:v,tenantId:C?.tenantId,createdAt:C?.createdAt??b,updatedAt:b,userType:C?.userType??"customer"};await W.customerStore.upsert(U)}}}catch(v){Z.warn("Failed to store customer",{"ion.operation":"customer.store","ion.outcome":"degraded"},v)}let T=[r(A,E)];return K5(K,{ok:!0,user:P,session:I},void 0,T)}function V5(K,N=200,V=[]){return new Response(JSON.stringify(K),{status:N,headers:[["Content-Type","application/json"],...V]})}function G5(K,N){try{return new URL(K).toString()}catch{let V=new URL(N).origin,D=W.cookiesSecure?V.replace(/^http:\/\//,"https://"):V;return new URL(K,D).toString()}}function c5(){let K=W.customerLoginUrl||"/auth/customer/login",N=K.includes("?")?"&":"?";return v1(W.providers).map(({name:V,config:D})=>{let E=C1(D);return{name:V,type:D.type,displayName:E.displayName,loginUrl:`${K}${N}provider=${encodeURIComponent(V)}`,iconUrl:E.iconUrl,colors:E.colors,url:E.url}})}async function x(K){if(!K)return{};let{authorizationUrl:N,tokenUrl:V,jwksUri:D,userInfoUrl:E}=K,A=K.config.authority;if(A&&(!N||!V||K.flow==="id_token"&&!D))try{let M=await n1(A);N=N??M.authorizationUrl,V=V??M.tokenUrl,D=D??M.jwksUri,E=E??M.userInfoUrl}catch(M){Z.error("CIAM provider OIDC discovery failed",{"ion.operation":"ciam.oidc.discovery","ion.outcome":"failure"},M)}return{authorizationUrl:N,tokenUrl:V,jwksUri:D,userInfoUrl:E}}async function k(K){if(K.type==="apple"){let{teamId:N,keyId:V,privateKey:D,clientId:E}=K.config;if(N&&V&&D&&E)return t1({teamId:N,keyId:V,privateKey:D,clientId:E})}return K.clientSecret}async function g(K){L();let V=new URL(K.url).searchParams.get("provider");if(!V)return V5({error:"Missing required query parameter: provider"},400);let D=W.providers?.[V];if(!D||D.enabled===!1||D.type==="magic-link")return V5({error:`Unknown or disabled CIAM provider: ${V}`},404);let E=V1(V,D);if(!E?.clientId)return V5({error:`CIAM provider ${V} is not fully configured`},500);let A=await x(E);if(!A.authorizationUrl)return V5({error:`CIAM provider ${V} is missing an authorization endpoint`},500);let _=W.customerCallbackUrl||"/auth/customer/callback",M=G5(_,K.url),j=_5(),P=_5(64),I=_5(),T=E.flow==="id_token",v=T?await J1(P):void 0,b=await W.beforeLogin?.({request:K}),C=l1({authorizationUrl:A.authorizationUrl,clientId:E.clientId,redirectUri:M,scope:E.scope,state:j,codeChallenge:v,nonce:I,extraParams:E.extraAuthParams}),U={provider:V,state:j,codeVerifier:T?P:void 0,nonce:I,redirectUri:M,...b===void 0?{}:{context:b}};return new Response("Redirecting to CIAM provider",{status:302,headers:[["Location",C],["Set-Cookie",n(d(j),U,W.loginStateTtl??600,"Lax")]]})}async function t(K){if(K.method==="POST"){if((K.headers.get("content-type")??"").includes("application/x-www-form-urlencoded")){let V=await K.text();return Object.fromEntries(new URLSearchParams(V).entries())}}return Object.fromEntries(new URL(K.url).searchParams.entries())}async function s(K,N){let V=K.mapClaims(N);if(!V.sub)return{ok:!1};let D=`${K.name}:${V.sub}`,E={id:D,userName:V.userName||V.email||D,name:V.name||"",email:V.email||"",avatar:V.avatar,userType:"customer"},A=D;if(W.customerStore){let T=await W.customerStore.lookup(E)??await W.customerStore.get(D);if(A=T?.id??D,!T&&!W.enableJitUserProvisioning)return Z.warn("CIAM JIT customer provisioning disabled: unknown customer rejected",{"ion.operation":"customer.store","ion.outcome":"skipped"}),{ok:!1};let v=new Date,b={...T??{},...E,id:A,tenantId:T?.tenantId,createdAt:T?.createdAt??v,updatedAt:v,userType:T?.userType??"customer"};await W.customerStore.upsert(b)}let _=new Date(Date.now()+(W.sessionTtl??86400)*1000),M=_5(32),j={sub:A,iss:K.name,aud:K.clientId,exp:Math.floor(_.getTime()/1000),iat:Math.floor(Date.now()/1000),email:V.email,name:V.name,preferred_username:V.userName??V.email,picture:V.avatar,sid:M},P={sid:M,sub:A,authType:"ciam",tenantId:W.tenantId,expiresAt:_,claims:j,accessClaims:{sub:A,sid:M,scope:K.scope},createdAt:new Date},I=L();try{await I.create(P)}catch(T){if(!await I.get(M))throw T;await I.update(M,P)}return{ok:!0,claims:j,sid:M,expires:_}}async function G(K){L();let N,V,D=(E)=>{let A=N?[["Set-Cookie",H5(N)]]:[];return K5(K,{ok:!1,error:E},V,A)};try{let E=await t(K),A=await m.validate(E);if(A.issues||!A.value)return D(Error("Invalid CIAM callback parameters"));let{code:_,state:M}=A.value;if(!M)return D(Error("Missing CIAM callback state"));N=d(M);let j=q(N,K,!0);if(V=j?.context,!j?.provider||!j.state||j.state!==M)return Z.warn("CIAM callback state verification failed",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),D(Error("CIAM callback state verification failed"));let P=W.providers?.[j.provider];if(!P)return D(Error("Unknown CIAM provider"));let I=V1(j.provider,P);if(!I?.clientId)return D(Error("CIAM provider not configured"));let T=await x(I);if(!T.tokenUrl)return D(Error("CIAM provider missing token endpoint"));let v=await k(I),b=await c1({tokenUrl:T.tokenUrl,clientId:I.clientId,clientSecret:v,redirectUri:j.redirectUri||G5(W.customerCallbackUrl||"/auth/customer/callback",K.url),code:_,codeVerifier:I.flow==="id_token"?j.codeVerifier:void 0,log:Z}),C;if(I.flow==="id_token"){let S=I.config.authority;if(!b.id_token||!T.jwksUri||!S)return D(Error("CIAM id_token flow misconfigured"));if(!j.nonce)return D(Error("CIAM callback state cookie missing nonce"));if((await u.validate(b)).issues)return Z.warn("CIAM token response validation failed",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),D(Error("CIAM token response validation failed"));C=await S5({idToken:b.id_token,jwksUri:T.jwksUri,issuer:S,audience:I.clientId,expectedNonce:j.nonce,log:Z});let R=await a.validate(C);if(!R.issues)C=R.value}else{if(!T.userInfoUrl)return D(Error("CIAM provider missing userinfo endpoint"));C=await a1(T.userInfoUrl,b.access_token);let S=I.config.authority;if(b.id_token&&T.jwksUri&&S){let y=await S5({idToken:b.id_token,jwksUri:T.jwksUri,issuer:S,audience:I.clientId,expectedNonce:j.nonce||void 0,log:Z}),R=typeof y.sub==="string"?y.sub:"";if(R){if(typeof C.sub==="string"&&C.sub.length>0&&C.sub!==R)return Z.warn("CIAM UserInfo sub does not match verified id_token sub",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),D(Error("CIAM UserInfo sub mismatch"));C.sub=R}}if(typeof C.sub!=="string"||C.sub.length===0)return Z.warn("CIAM UserInfo response missing sub",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),D(Error("CIAM UserInfo response missing sub"))}let U=await s(I,C);if(!U.ok)return D(Error("Failed to persist CIAM customer"));let Y=z5(U.claims);Z.info("CIAM third-party sign-in succeeded",{"ion.operation":"ciam.oidc.callback","ion.outcome":"success",provider:I.name});let z=[["Set-Cookie",H5(N)],r(U.sid,U.expires)];return K5(K,{ok:!0,user:Y,session:void 0},V,z)}catch(E){return Z.error("Error during CIAM third-party sign-in callback",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"},E),D(E)}}async function O(K){if(!W)throw Error("ionite CIAM Manager not initialized");c();let N=W.magicLinkUrl||"/magic-link",V=W.magicLinkLoginUrl||"/magic-link/login",D=W.logoutUrl||"/auth/customer/logout",E=W.customerLoginUrl||"/auth/customer/login",A=W.customerCallbackUrl||"/auth/customer/callback",_=W.customerProvidersUrl||"/auth/customer/providers",M=new URL(K.url).pathname,j=(U)=>{if(!U)return;try{return new URL(U).pathname}catch{return U.startsWith("/")?U:`/${U}`}};if(j(N)===M&&K.method==="POST")return u5(K);if(j(V)===M&&K.method==="GET")return l5(K);if(j(D)===M&&K.method==="GET")return m5(K);if(j(_)===M&&K.method==="GET")return V5({providers:c5()});if(j(E)===M&&K.method==="GET")return g(K);if(j(A)===M&&(K.method==="GET"||K.method==="POST"))return G(K);return new Response("Not Found",{status:404})}return{...W,getCustomer:g5,resolveCustomer:f5,logout:m5,handler:O,listCustomerProviders:c5}}async function c2(J,Z){return p(Z,"Ionite instance is required. Create one with ionite(source, config) and pass it to this function."),Z.ciam?.getCustomer(J)}async function d2(J,Z){return p(Z,"Ionite instance is required. Create one with ionite(source, config) and pass it to this function."),await Z.ciam?.resolveCustomer(J)??{status:"unauthenticated"}}var Y1="application/scim+json",n2="urn:ietf:params:scim:api:messages:2.0:ListResponse",Q9="urn:ietf:params:scim:api:messages:2.0:Error",z1="urn:ietf:params:scim:schemas:core:2.0:User",k5="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",O1="urn:ietf:params:scim:schemas:core:2.0:Group",a2="urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",f9="urn:ietf:params:scim:schemas:core:2.0:ResourceType",Z1="urn:ietf:params:scim:schemas:core:2.0:Schema",t2="00000000000000000000000000000000";function i2(J){let Z={timestamp:new Date().toISOString()};if(J)Z.actor=J;try{let Q=globalThis[Symbol.for("opentelemetry.js.api.1")]?.trace?.getActiveSpan?.()?.spanContext?.(),F=Q?.traceId;if(F&&F!==t2){if(Z.traceId=F,Q?.spanId)Z.spanId=Q.spanId}}catch{}return Z}class B1 extends Error{constructor(J){super(J);this.name="SubjectTypeNotAssignableError",Object.setPrototypeOf(this,B1.prototype)}}async function o2(J,Z,$,X,Q){let F=X.subjectType??"user";if(!X9.includes(F))throw new B1(`Cannot grant ${X.targetType} "${M5(X.target)}" to a "${F}" principal: only [${X9.join(", ")}] principals are assignable on this platform.`);let H=G9(Z,J);if(!H&&!Q)return;let B=M5(X.target),W;if(Q)W=await Q.getNode(X.targetType,B);else if(H){if(W=await(X.targetType==="group"?H.groups:X.targetType==="role"?H.roles:H.permissions).get(B),!W&&X.targetType==="group")W=await $?.entitlement?.(B)}let L=W?.assignableSubjectTypes;if(L&&L.length>0&&!L.includes(F))throw new B1(`Cannot grant ${X.targetType} "${B}" to a "${F}" principal: this entitlement restricts assignment to [${L.join(", ")}].`)}async function r2(J,Z,$,X){await o2(J.catalogStore,J.codeCatalog,J.resources,Z,X);let Q={...Z,status:Z.status??"active",provenance:Z.provenance??i2()};if(Q.id=W1(Q),await J.accessStore?.grant(Q),J.accessIndex&&(J.catalogStore||J.codeCatalog)){let F=await B9(Q,{catalog:J.catalogStore,code:J.codeCatalog,resources:J.resources,cache:X});await J.accessIndex.materialize(Q.id,F)}return $?.push({op:"add",change:Q}),Q}async function E1(J,Z,$){let X=Z.id??W1(Z);await J.accessStore?.revoke(Z),await J.accessIndex?.removeByRoot(X),$?.push({op:"delete",change:{...Z,id:X}})}async function K9(J,Z){let $=await s2(J,Z),X=await J4(J,Z);return{oaa:$,delta:X}}async function s2(J,Z){if(Z.length===0||!J.authz.oaa.isReady())return{status:"skipped"};return F9(J,"authz.oaa.push","OAA incremental access push failed after SCIM mutation; full sync will reconcile",()=>J.authz.oaa.pushAccessChanges(Z),{count:Z.length})}async function F9(J,Z,$,X,Q){try{return await X(),{status:"ok"}}catch(F){return J.log?.warn($,{"ion.operation":Z,"ion.outcome":"degraded",...Q,error:y5(F)}),{status:"degraded",reason:y5(F)}}}var e2=6;async function J4(J,Z){let $=J.iamDelta;if(!$?.isReady()||Z.length===0)return{status:"skipped"};let X=new Map;for(let W of Z){let L=`${W.change.subjectType??"user"}:${M5(W.change.subject)}\x00${W.change.targetType}:${M5(W.change.target)}`;X.set(L,W)}let Q=[...X.values()],F=Q.map(({op:W,change:L})=>()=>W==="add"?$.onGrant(L):$.onRevoke(L)),B=(await Z4(F,e2)).filter((W)=>W.status==="rejected");if(B.length>0)return J.log?.warn("IAM delta egress degraded after SCIM mutation; IAM server reconcile/aggregation will recover",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",failed:B.length,total:Q.length,error:y5(B[0]?.reason)}),{status:"degraded",reason:y5(B[0]?.reason)};return{status:"ok"}}async function Z4(J,Z){let $=Array(J.length),X=0,Q=async()=>{while(!0){let H=X++;if(H>=J.length)return;let B=J[H];if(!B)continue;try{$[H]={status:"fulfilled",value:await B()}}catch(W){$[H]={status:"rejected",reason:W}}}},F=Array.from({length:Math.min(Z,J.length)},Q);return await Promise.all(F),$}class w1 extends Error{constructor(J){super(J);this.name="DerivedRevokeError",Object.setPrototypeOf(this,w1.prototype)}}class i5 extends Error{summary;clientError;constructor(J,Z,$=!1){super(J);this.name="ScimMutationError",this.summary=Z,this.clientError=$,Object.setPrototypeOf(this,i5.prototype)}}function h(J,Z,$){return new Response(JSON.stringify({schemas:[Q9],status:String(J),scimType:$,detail:Z}),{status:J,headers:{"Content-Type":Y1}})}function a5(J,Z){let $=Z?.totalResults??J.length,X=Z?.startIndex??1,Q=Z?.itemsPerPage??J.length;return new Response(JSON.stringify({schemas:[n2],totalResults:$,startIndex:X,itemsPerPage:Q,Resources:J}),{status:200,headers:{"Content-Type":Y1}})}function N5(J,Z=200){return new Response(JSON.stringify(J),{status:Z,headers:{"Content-Type":Y1}})}function h9(J){return h(J.clientError?409:500,`${J.message}; authz mutation summary: ${JSON.stringify(J.summary)}`,J.clientError?"mutability":"invalidValue")}function K1(J){return W1(J)}function r1(J,Z){return X1(g9(J),g9(Z))}function g9(J){let Z=new Map;if(!J?.id)return Z;for(let $ of J.groups??[]){let X={subject:J.id,targetType:"group",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type}:void 0};Z.set(K1(X),X)}for(let $ of J.roles??[]){let X={subject:J.id,targetType:"role",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(K1(X),X)}for(let $ of J.entitlements??[]){let X={subject:J.id,targetType:"permission",target:$.value,metadata:$.display||$.type?{display:$.display,type:$.type,primary:$.primary}:void 0};Z.set(K1(X),X)}return Z}function $1(J,Z,$,X){let Q=new Map,F=X&&X.length>0?X:void 0;for(let H of J??[]){let B={subject:H.value,targetType:Z,target:$,resources:F,metadata:H.display||H.type?{display:H.display,type:H.type}:void 0};Q.set(K1(B),B)}return Q}function s1(J){let Z=J[W5]?.resources;return Z&&Z.length>0?Z:void 0}function $4(J,Z,$){let X=J[W5];if(J.displayName!==void 0&&J.displayName!==(Z.displayName??Z.name))return!0;if(J.externalId!==void 0&&J.externalId!==Z.externalId)return!0;if(X?.type!==void 0&&X.type!==$)return!0;if(X?.requestable!==void 0&&Boolean(X.requestable)!==Boolean(Z.requestable))return!0;if(X?.description!==void 0&&X.description!==Z.description)return!0;if(X?.resources!==void 0){let Q=[...X.resources].sort().join(","),F=[...j1(Z)??[]].sort().join(",");if(Q!==F)return!0}return!1}function m9(J){let Z=new Map;for(let $ of J)Z.set(K1($),$);return Z}async function O5(J,Z,$,X,Q,F,H){let B=[],W=new Set,L=(m,a)=>`${a}\x00${m}`,c=H?H.get(`${X}:${Q}`)??[]:Z?(await Z.listByTarget(X,Q)).items:[];for(let m of c){let a=M5(m.subject),u=m.metadata,Q5=m.subjectType==="workload"?"Workload":u?.type??"User",n=L(a,Q5);if(W.has(n))continue;W.add(n),B.push({value:a,...u?.display?{display:u.display}:{},type:Q5})}for(let m of F??[]){if(m.targetType!==X||M5(m.target)!==Q)continue;let a=M5(m.subject),u=L(a,"Workload");if(W.has(u))continue;W.add(u),B.push({value:a,type:"Workload"})}if(X==="group"){let m=await J.groups.get(Q)??await $?.entitlement?.(Q);for(let a of m?.groups??[]){let u=M5(a),Q5=L(u,"Group");if(!u||W.has(Q5))continue;W.add(Q5),B.push({value:u,type:"Group"})}}return B.length>0?B:void 0}function X1(J,Z){let $=[];for(let[X,Q]of Z)if(!J.has(X))$.push({action:"grant",change:Q});for(let[X,Q]of J)if(!Z.has(X))$.push({action:"revoke",change:Q});return $}async function e1(J,Z){if(J.oaa.isReady())await J.oaa.pushUser(Z)}async function v5(J,Z,$,X){let Q={metadataApplied:!1,access:[]},F=[],H=new Y9(J.catalogStore,J.resources,J.codeCatalog);try{try{await Z(),Q.metadataApplied=!0}catch(B){for(let W of $)Q.access.push({change:W.change,status:"rolled_back"});throw Q.metadataApplied=!1,new i5(`SCIM metadata write failed: ${y5(B)}`,Q,!1)}if(X)await F9(J,"authz.oaa.metadata","OAA metadata projection failed after SCIM write; full sync will reconcile",X);for(let B=0;B<$.length;B++){let W=$[B];try{if(W.action==="grant")await r2(J,W.change,F,H);else await Y4(J,W.change,F);Q.access.push({change:W.change,status:"applied"})}catch(L){Q.access.push({change:W.change,status:"failed",error:L});for(let m=B+1;m<$.length;m++)Q.access.push({change:$[m].change,status:"rolled_back"});let c=L instanceof w1||L instanceof B1;if(!c)await Q4(J,W.change,H);throw new i5(c?y5(L):`SCIM access mutation failed: ${y5(L)}`,Q,c)}}return Q}finally{await X4(J),Q.egress=await K9(J,F),K4(J,Q)}}function y5(J){return J instanceof Error?J.message:String(J)}async function X4(J){try{await J.settleAuthz?.()}catch{}}async function Q4(J,Z,$){if(!J.accessIndex||!J.catalogStore&&!J.codeCatalog||!J.accessStore)return;let X=M5(Z.subject);if(!X)return;let Q=Z.subjectType??"user";try{await W9(X,Q,{accessStore:J.accessStore,accessIndex:J.accessIndex,catalogStore:J.catalogStore,code:J.codeCatalog,resources:J.resources},$)}catch(F){J.log?.warn("Per-subject reconcile after failed SCIM access mutation failed",{"ion.operation":"authz.reconcile.subject.repair","ion.outcome":"degraded",subject:X,subjectType:Q,error:y5(F)})}}function K4(J,Z){if(!J.onAccessMutation)return;try{J.onAccessMutation(Z)}catch{}}async function Y4(J,Z,$){if(J.accessStore){let X=Z.id??W1(Z);if(!await J.accessStore.get(X)){if((J.accessIndex?await J.accessIndex.has(Z.subject,Z.targetType,Z.target,Z.resources?.[0],Z.subjectType):{allow:!1}).allow)throw new w1(`Cannot revoke ${Z.targetType} "${M5(Z.target)}" for "${M5(Z.subject)}": it is not a directly granted root (it is derived from group/role membership). Remove the granting group/role instead.`);await E1(J,Z,$);return}}await E1(J,Z,$)}function Q1(J){let Z=J[W5]?.type??"group";if(Z==="group"||Z==="role"||Z==="permission")return Z;throw Error(`Unsupported ionite SCIM Group authz type "${String(Z)}"`)}async function J9(J,Z,$){if(!J.oaa.isReady())return;if($==="role"){await J.oaa.pushRole(Z);return}if($==="permission"){await J.oaa.pushPermission(Z);return}await J.oaa.pushGroup(Z)}function j1(J){let Z=J.resources;if(!Z||Z.length===0)return;let $=Z.map((X)=>typeof X==="string"?X:X.id).filter(Boolean);return $.length>0?$:void 0}function E5(J,Z,$){return{schemas:[O1],id:J.id,externalId:J.externalId,displayName:J.displayName??J.name,members:$,[W5]:{type:Z,requestable:J.requestable,description:J.description,resources:Z==="group"?j1(J):void 0,assignableSubjectTypes:J.assignableSubjectTypes,recommendedSubjectTypes:J.recommendedSubjectTypes}}}function B4(J,Z){let $=J[W5],X={id:Z,name:J.displayName,displayName:J.displayName,description:$?.description??J.displayName,externalId:J.externalId,requestable:$?.requestable};if($?.resources!==void 0)X.resources=$.resources;return X}function W4(J){if(!J)return;let Z=J.trim().match(/^requestable\s+eq\s+(true|false)$/i);if(!Z)return;return{requestable:Z[1]?.toLowerCase()==="true"}}function p9(J){if(!J)return;let Z=J.trim().match(/^externalId\s+eq\s+"([^"]*)"$/i);return Z?Z[1]:void 0}async function H9(J,Z){if(!J?.entitlements)return[];let $=J.entitlements.bind(J),X=[];for await(let Q of l9((F,H)=>J.list({start:F,limit:H})))for(let F of $(Q)){if(Z?.requestable!==void 0&&Boolean(F.requestable)!==Z.requestable)continue;X.push(G1(F))}return X}async function G4(J,Z,$,X,Q){let F=[{store:J.groups,type:"group"},{store:J.roles,type:"role"},{store:J.permissions,type:"permission"}],H;if(F.every(({store:W})=>typeof W.getByExternalId==="function"))H=(await Promise.all(F.map(async({store:L,type:c})=>{let m=await L.getByExternalId?.(X);return m?{entity:m,type:c}:void 0}))).filter((L)=>L!==void 0);else{let W={start:0},[L,c,m]=await Promise.all([J.groups.list(W),J.roles.list(W),J.permissions.list(W)]);H=[...L.items.map((u)=>({entity:u,type:"group"})),...c.items.map((u)=>({entity:u,type:"role"})),...m.items.map((u)=>({entity:u,type:"permission"}))].filter(({entity:u})=>u.externalId===X)}if($?.entitlements){let W=await H9($);for(let L of W)if(L.externalId===X)H.push({entity:L,type:"group"})}if(H.length>1)throw new L9(`Ambiguous externalId "${X}": ${H.length} entitlements share it (${H.map((W)=>`${W.type}:${W.entity.id}`).join(", ")})`,"unique_violation","externalId");let B=H[0];if(!B)return;return E5(B.entity,B.type,await O5(J,Z,$,B.type,B.entity.id,Q))}async function L4(J,Z,$,X,Q){let F=Math.max(0,X.start),H=X.limit!=null?F+X.limit:void 0,B={start:0,limit:H,filter:X.filter},[W,L,c]=await Promise.all([J.groups.list(B),J.roles.list(B),J.permissions.list(B)]),m=[...W.items.map((r)=>({entity:r,type:"group"})),...L.items.map((r)=>({entity:r,type:"role"})),...c.items.map((r)=>({entity:r,type:"permission"}))],a=W.total+L.total+c.total,u=m.slice(F,H),Q5=0,n=[];if($?.entitlements){let r=await H9($,X.filter);Q5=r.length;let $5=X.limit!=null?X.limit-u.length:void 0;if($5===void 0||$5>0){let D5=Math.max(0,F-a);n=$5===void 0?r.slice(D5):r.slice(D5,D5+$5)}}let H5=[...u,...n.map((r)=>({entity:r,type:"group"}))],q=a+Q5,d=Z?.listByTargets?await Z.listByTargets(H5.map(({entity:r,type:$5})=>({targetType:$5,target:r.id}))):void 0,K5=await Promise.all(H5.map(async({entity:r,type:$5})=>E5(r,$5,await O5(J,Z,$,$5,r.id,Q,d))));return{resources:K5,total:q,count:K5.length}}async function _1(J,Z,$,X,Q){let[F,H,B]=await Promise.all([J.groups.get(X),J.roles.get(X),J.permissions.get(X)]);if(F)return E5(F,"group",await O5(J,Z,$,"group",X,Q));if(H)return E5(H,"role",await O5(J,Z,$,"role",X,Q));if(B)return E5(B,"permission",await O5(J,Z,$,"permission",X,Q));let W=G1(await $?.entitlement?.(X));if(W)return E5(W,"group",await O5(J,Z,$,"group",X,Q));return}async function Z9(J,Z,$){let X=Q1(Z),F={...(X==="role"?await J.roles.get($):X==="permission"?await J.permissions.get($):await J.groups.get($))??{},...B4(Z,$)},H=X==="role"?J.roles.set(F):X==="permission"?J.permissions.set(F):J.groups.set(F);return await H.ready(),H}async function F4(J,Z){await Promise.all([J.groups.delete(Z),J.roles.delete(Z),J.permissions.delete(Z)])}function u9(){return crypto.randomUUID()}function t5(J,Z){let $=J;if(typeof $.validate==="function")return $.validate(Z);return Promise.resolve(J["~standard"].validate(Z))}function H4(J){if(!J)return;try{return new URL(J).pathname}catch{return J.startsWith("/")?J:`/${J}`}}function U5(J){let Z=H4(J);return Z?P1(Z):void 0}function V4(J,Z){let $=U5(J);if($?.endsWith("/Users"))return $.slice(0,-6);let X=U5(Z);if(X?.endsWith("/Groups"))return X.slice(0,-7);return}function x5(J,Z){return new URL(Z,J.url).toString()}function w(J,Z,$,X){let{multiValued:Q=!1,...F}=X??{};return{name:J,type:Z,description:$,multiValued:Q,...F}}function N4(J,Z){return{schemas:[a2],documentationUri:Z?.documentationUri,patch:{supported:!0},bulk:{supported:!1},filter:{supported:!0,maxResults:1000},changePassword:{supported:!1},sort:{supported:!1},etag:{supported:!1},authenticationSchemes:[{type:"oauthbearertoken",name:"OAuth Bearer Token",description:"Use an ionite workload bearer token for IAM discovery and provisioning requests.",primary:!0}],meta:{resourceType:"ServiceProviderConfig",location:x5(J.request,`${J.basePath}/ServiceProviderConfig`)}}}function M4(J){let Z=[];if(J.supportsUsers)Z.push({schemas:[f9],id:"User",name:"User",description:"User Account",endpoint:J.usersUrl,schema:z1,schemaExtensions:[{schema:k5,required:!1},{schema:I5,required:!1}],meta:{resourceType:"ResourceType",location:x5(J.request,`${J.basePath}/ResourceTypes/User`)}});if(J.supportsGroups)Z.push({schemas:[f9],id:"Group",name:"Group",description:"Group",endpoint:J.groupsUrl,schema:O1,schemaExtensions:[{schema:W5,required:!1}],meta:{resourceType:"ResourceType",location:x5(J.request,`${J.basePath}/ResourceTypes/Group`)}});return Z}function D4(J){let Z=[];if(J.supportsUsers)Z.push({schemas:[Z1],id:z1,name:"User",description:"User Account",meta:{resourceType:"Schema",location:x5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(z1)}`)},attributes:[w("id","string","Unique identifier for the User.",{multiValued:!1,required:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),w("externalId","string","External identifier from the provisioning client.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",uniqueness:"none"}),w("userName","string","Unique identifier typically used for login.",{multiValued:!1,required:!0,caseExact:!1,mutability:"readWrite",returned:"default",uniqueness:"server"}),w("name","complex","The components of the user name.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",subAttributes:[w("formatted","string","The full name, including titles and suffixes.",{multiValued:!1}),w("familyName","string","The family name of the User.",{multiValued:!1}),w("givenName","string","The given name of the User.",{multiValued:!1}),w("middleName","string","The middle name(s) of the User.",{multiValued:!1}),w("honorificPrefix","string","The honorific prefix(es) of the User.",{multiValued:!1}),w("honorificSuffix","string","The honorific suffix(es) of the User.",{multiValued:!1})]}),w("displayName","string","The name of the User, suitable for display.",{multiValued:!1}),w("nickName","string","The casual way to address the user.",{multiValued:!1}),w("profileUrl","reference","A URL pointing to the User profile.",{multiValued:!1,referenceTypes:["external"]}),w("title","string","The user title, such as Vice President.",{multiValued:!1}),w("userType","string","The relationship between the organization and the User.",{multiValued:!1}),w("preferredLanguage","string","Preferred written or spoken language.",{multiValued:!1}),w("locale","string","Default location for localizing values.",{multiValued:!1}),w("timezone","string","The User time zone.",{multiValued:!1}),w("active","boolean","The User administrative status.",{multiValued:!1}),w("emails","complex","Email addresses for the User.",{multiValued:!0,subAttributes:[w("value","string","Email address value.",{multiValued:!1,required:!0}),w("display","string","Display label for the email.",{multiValued:!1}),w("type","string","Email type such as work or home.",{multiValued:!1}),w("primary","boolean","Primary email indicator.",{multiValued:!1})]}),w("phoneNumbers","complex","Phone numbers for the User.",{multiValued:!0,subAttributes:[w("value","string","Phone number value.",{multiValued:!1,required:!0}),w("display","string","Display label for the phone number.",{multiValued:!1}),w("type","string","Phone number type.",{multiValued:!1}),w("primary","boolean","Primary phone number indicator.",{multiValued:!1})]}),w("photos","complex","Photo URLs for the User.",{multiValued:!0,subAttributes:[w("value","reference","Photo URL.",{multiValued:!1,required:!0,referenceTypes:["external"]}),w("display","string","Display label for the photo.",{multiValued:!1}),w("type","string","Photo type.",{multiValued:!1}),w("primary","boolean","Primary photo indicator.",{multiValued:!1})]}),w("addresses","complex","Physical mailing addresses for the User.",{multiValued:!0,subAttributes:[w("formatted","string","Formatted mailing address.",{multiValued:!1}),w("streetAddress","string","Full street address component.",{multiValued:!1}),w("locality","string","City or locality.",{multiValued:!1}),w("region","string","State or region.",{multiValued:!1}),w("postalCode","string","Postal code.",{multiValued:!1}),w("country","string","Country.",{multiValued:!1}),w("type","string","Address type.",{multiValued:!1}),w("primary","boolean","Primary address indicator.",{multiValued:!1})]}),w("groups","complex","Groups to which the User belongs.",{multiValued:!0,mutability:"readOnly",subAttributes:[w("value","string","Group identifier.",{multiValued:!1,required:!0}),w("$ref","reference","Reference to the Group resource.",{multiValued:!1,referenceTypes:["Group"]}),w("display","string","Display name of the group.",{multiValued:!1}),w("type","string","Relationship type.",{multiValued:!1})]}),w("entitlements","complex","Entitlements for the User.",{multiValued:!0,subAttributes:[w("value","string","Entitlement value.",{multiValued:!1,required:!0}),w("display","string","Display value.",{multiValued:!1}),w("type","string","Entitlement type.",{multiValued:!1}),w("primary","boolean","Primary entitlement indicator.",{multiValued:!1})]}),w("roles","complex","Roles for the User.",{multiValued:!0,subAttributes:[w("value","string","Role value.",{multiValued:!1,required:!0}),w("display","string","Display value.",{multiValued:!1}),w("type","string","Role type.",{multiValued:!1}),w("primary","boolean","Primary role indicator.",{multiValued:!1})]}),w("x509Certificates","complex","Certificates issued to the User.",{multiValued:!0,subAttributes:[w("value","string","Certificate value.",{multiValued:!1,required:!0}),w("display","string","Display value.",{multiValued:!1}),w("type","string","Certificate type.",{multiValued:!1}),w("primary","boolean","Primary certificate indicator.",{multiValued:!1})]})]}),Z.push({schemas:[Z1],id:k5,name:"EnterpriseUser",description:"Enterprise User extension",meta:{resourceType:"Schema",location:x5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(k5)}`)},attributes:[w("employeeNumber","string","Numeric or alphanumeric identifier assigned to a person.",{multiValued:!1}),w("costCenter","string","Name of a cost center.",{multiValued:!1}),w("organization","string","Name of an organization.",{multiValued:!1}),w("division","string","Name of a division.",{multiValued:!1}),w("department","string","Name of a department.",{multiValued:!1}),w("manager","complex","The User manager.",{multiValued:!1,subAttributes:[w("value","string","Identifier of the manager User resource.",{multiValued:!1}),w("$ref","reference","Reference to the manager User resource.",{multiValued:!1,referenceTypes:["User"]}),w("displayName","string","Display name of the manager.",{multiValued:!1})]})]}),Z.push({schemas:[Z1],id:I5,name:"IoniteUser",description:"ionite User extension carrying the Enterprise Controlled ID (ECID) identity correlator and the account purpose (accountClass). See https://ionite.com/docs/llms-ecid.txt.",meta:{resourceType:"Schema",location:x5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(I5)}`)},attributes:[w("ecid","string","Enterprise Controlled ID formatted as 'ecid:<realm>:<opaque>' (realm = the minting authority's id). Correlates multiple accounts to one identity.",{multiValued:!1,caseExact:!0}),w("accountClass","string","Account purpose (distinct from userType persona). Open value set: 'daily', 'privileged', 'break_glass', 'service'.",{multiValued:!1})]}),Z.push({schemas:[Z1],id:W5,name:"IoniteAuthzGroup",description:"ionite authorization metadata for SCIM Group resources.",meta:{resourceType:"Schema",location:x5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(W5)}`)},attributes:[w("type","string","Authorization entity kind: group, role, or permission.",{multiValued:!1,required:!1}),w("requestable","boolean","Whether this catalog entry should be requestable access in IAM tooling.",{multiValued:!1,required:!1}),w("description","string","Human-readable authorization entity description.",{multiValued:!1,required:!1}),w("assignableSubjectTypes","string","AppDev-owned hard ceiling of principal kinds (user, workload) that may hold this entitlement. Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]}),w("recommendedSubjectTypes","string","AppDev advisory default principal kinds (subset of assignableSubjectTypes). Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload"]})]});if(J.supportsGroups)Z.push({schemas:[Z1],id:O1,name:"Group",description:"Group",meta:{resourceType:"Schema",location:x5(J.request,`${J.basePath}/Schemas/${encodeURIComponent(O1)}`)},attributes:[w("id","string","Unique identifier for the Group.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),w("externalId","string","External identifier from the provisioning client.",{multiValued:!1,uniqueness:"none"}),w("displayName","string","Human-readable name for the Group.",{multiValued:!1,required:!0,uniqueness:"none"}),w("members","complex","Members of the Group.",{multiValued:!0,subAttributes:[w("value","string","Identifier of the member resource.",{multiValued:!1,required:!0}),w("$ref","reference","Reference to the member resource.",{multiValued:!1,referenceTypes:["User","Group"]}),w("display","string","Display name of the member.",{multiValued:!1}),w("type","string","Member type.",{multiValued:!1})]})]});return Z}function _4(J,Z,$,X,Q,F,H,B,W,L,c,m,a,u,Q5){let n={authz:X,settleAuthz:Q5,accessStore:Q,accessIndex:F,catalogStore:H,codeCatalog:B,resources:W,log:Z,iamDelta:m,onAccessMutation:a};if(!L&&!c)return;let q={...L,...c},d=q.users?.enabled!==!1,K5=q.groups?.enabled!==!1;if(Boolean(q.url||q.userStore||H||B)&&!$)Z.error("IAM requires workload identity for SCIM push/pull operations",{"ion.operation":"workload.require","ion.outcome":"failure"});function $5(){if(!$)throw Z.error("IAM requires workload identity for SCIM push/pull operations",{"ion.operation":"workload.require","ion.outcome":"failure"}),Error("IAM requires workload identity for SCIM push/pull operations");return $}async function D5(x){let k=$5(),g=x.headers.get("Authorization");if(!g?.startsWith("Bearer "))return!1;try{let t=g.substring(7);return(await k.validateToken(t)).valid}catch{return!1}}async function f5(){let x=$5(),k=typeof x.getServerToken==="function"?await x.getServerToken():await x.getToken();return new Headers({"Content-Type":Y1,Accept:Y1,Authorization:`Bearer ${k}`})}async function h5(x,k,g,t){if(!q.url)throw Error("IAM URL not configured for outgoing requests");let s=`${q.url}${k}`;try{let G=await f5(),O=await fetch(s,{method:x,headers:G,body:g?JSON.stringify(g):void 0}),K=await O.json();if(!O.ok)return{success:!1,error:K,status:O.status};let N=await t["~standard"].validate(K);if(N.issues)return Z.error("SCIM response validation failed",{"ion.operation":"scim.response.validate","ion.outcome":"failure",validationIssues:N.issues}),{success:!1,error:{schemas:[Q9],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${N.issues.map((V)=>V.message).join("; ")}`},status:400};return{success:!0,data:N.value,status:O.status}}catch(G){return{success:!1,error:{schemas:[Q9],status:"500",detail:G instanceof Error?G.message:"Unknown error occurred"},status:500}}}function g5(){return q.url}function m5(x,k){let g=U5(k?.usersUrl??q.usersUrl??"/api/iam/Users")??"/api/iam/Users",t=U5(k?.groupsUrl??q.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",s=U5(k?.discovery?.basePath??q.discovery?.basePath)??V4(g,t);if(!s)return;return{request:x,basePath:s,usersUrl:g,groupsUrl:t,supportsUsers:d&&Boolean(q.userStore),supportsGroups:K5&&Boolean(H||B)}}async function p5(x){let k=N4(x,q.discovery);return await q.discovery?.buildServiceProviderConfig?.(x,k)??k}async function T5(x){let k=M4(x);return await q.discovery?.buildResourceTypes?.(x,k)??k}async function b5(x){let k=D4(x);return await q.discovery?.buildSchemas?.(x,k)??k}async function z5(x,k){let g=m5(x,k);if(!g)return;let t=P1(new URL(x.url).pathname),{basePath:s}=g;if(t!==s&&!t.startsWith(`${s}/`))return;let G=P1(t.slice(s.length)||"/");if(!(G==="/ServiceProviderConfig"||G==="/ResourceTypes"||G.startsWith("/ResourceTypes/")||G==="/Schemas"||G.startsWith("/Schemas/")))return;if(x.method!=="GET")return h(405,"Method not allowed");if(!await D5(x))return h(401,"Authorization required");if(G==="/ServiceProviderConfig")return N5(await p5(g));if(G==="/ResourceTypes")return a5(await T5(g));if(G.startsWith("/ResourceTypes/")){let N=decodeURIComponent(G.slice(15)),V=(await T5(g)).find((D)=>D.id===N||D.name===N);return V?N5(V):h(404,"Resource not found")}if(G==="/Schemas")return a5(await b5(g));if(G.startsWith("/Schemas/")){let N=decodeURIComponent(G.slice(9)),V=(await b5(g)).find((D)=>D.id===N);return V?N5(V):h(404,"Resource not found")}return}let u5,l5;if(q.url)l5=async(k,g)=>{let t={...k,schemas:k.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return h5("POST","/Users",t,J.user)},u5={createGroup:async(k,g)=>{let t={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:k,externalId:g?.externalId,members:g?.members};return h5("POST","/Groups",t,J.group)}};let V5;if(H||B){let x=G9(B,H),k=async(_)=>{if(!W?.entitlement)return;let[M,j,P]=await Promise.all([x.groups.get(_),x.roles.get(_),x.permissions.get(_)]);if(M||j||P)return;return G1(await W.entitlement(_))},g=(_,M)=>h(403,`Entitlement "${_}" is derived from the application's resource data (ResourceProvider.entitlements); its definition cannot be ${M} through SCIM. Member add/remove is allowed; the definition changes only when the application's resources or derivation logic change.`,"mutability"),t=(_)=>{if(!B)return;let M=B.groups.get(_);if(M)return{entity:M,type:"group"};let j=B.roles.get(_);if(j)return{entity:j,type:"role"};let P=B.permissions.get(_);if(P)return{entity:P,type:"permission"};return},s=(_,M)=>h(403,`Entitlement "${_}" is declared in application code (authz.catalog); its definition cannot be ${M} through SCIM. Member add/remove is allowed; the definition changes only when the application code changes.`,"mutability"),G=(_)=>_.path==="members"||Boolean(_.path?.startsWith("members[")),O=async(_,M)=>{if(!await D5(_))return h(401,"Authorization required");let P=new URL(_.url),I=M?.basePath??"/Groups",T=P.pathname;if(T.startsWith(I))T=T.substring(I.length);let b=T.match(/^\/([^/]+)$/)?.[1],C=_.method;try{if(b)switch(C){case"GET":return await N(b);case"PUT":return await D(_,b);case"PATCH":return await E(_,b);case"DELETE":return await A(b);default:return h(405,"Method not allowed")}else if(T===""||T==="/")switch(C){case"GET":return await K(_);case"POST":return await V(_);default:return h(405,"Method not allowed")}return h(404,"Resource not found")}catch(U){if(U instanceof i5)return h9(U);if($9(U))return h(409,U.message,"uniqueness");return Z.error("Groups inbound handler error",{"ion.operation":"scim.groups.handler","ion.outcome":"failure"},U),h(500,U instanceof Error?U.message:"Internal server error")}},K=async(_)=>{let M=new URL(_.url),j=M.searchParams.get("startIndex"),P=M.searchParams.get("count"),I=j!=null?parseInt(j,10):void 0,T=P!=null?parseInt(P,10):void 0,v=I!=null&&!Number.isNaN(I)?Math.max(0,I-1):0,b=T!=null&&!Number.isNaN(T)?T:void 0,C=M.searchParams.get("filter"),U=p9(C);if(U!==void 0){let S=await G4(x,Q,W,U,u),y=S?[S]:[];return a5(y,{totalResults:y.length,startIndex:1,itemsPerPage:y.length})}let Y=W4(C),z=await L4(x,Q,W,{start:v,limit:b,filter:Y},u);return a5(z.resources,{totalResults:z.total,startIndex:v+1,itemsPerPage:z.count})},N=async(_)=>{let M=await _1(x,Q,W,_,u);if(!M)return h(404,`Group ${_} not found`,"invalidValue");return N5(M)},V=async(_)=>{let M=await _.json(),j=await t5(J.group,M);if(j.issues)return Z.error("Group creation validation failed",{"ion.operation":"scim.group.create","ion.outcome":"failure",validationIssues:j.issues}),h(400,`Request validation failed: ${j.issues.map((Y)=>Y.message).join("; ")}`,"invalidValue");let P=j.value;if(!P.displayName)return h(400,"displayName is required","invalidValue");if(!H)return h(501,"Group creation is not supported: this application declares its catalog in code (authz.catalog) and wires no AccessCatalogStore for SCIM-authored definitions.","invalidValue");if(P.externalId){let Y=P.externalId,z=B&&(B.groups.getByExternalId(Y)??B.roles.getByExternalId(Y)??B.permissions.getByExternalId(Y)),S=!z&&W?.entitlements?(await H9(W)).find((R)=>R.externalId===Y):void 0,y=z||S;if(y)throw new L9(`externalId "${Y}" is already used by ${z?"code-declared":"resource-derived"} entitlement "${y.id}"`,"unique_violation","externalId")}let I=Q1(P),T=u9(),v=s1(P),b=X1(new Map,$1(P.members,I,T,v)),C;await v5(n,async()=>{C=await Z9(x,P,T)},b,()=>J9(X,C,I));let U=await O5(x,Q,W,I,T);return N5(E5(C,I,U),201)},D=async(_,M)=>{let j=await _.json(),P=await t5(J.group,j);if(P.issues)return Z.error("Group replacement validation failed",{"ion.operation":"scim.group.replace","ion.outcome":"failure",validationIssues:P.issues}),h(400,`Request validation failed: ${P.issues.map((f)=>f.message).join("; ")}`,"invalidValue");let I=P.value,T=Q1(I);if(!await _1(x,Q,W,M))return h(404,`Group ${M} not found`,"invalidValue");let b=t(M),C=b?void 0:await k(M),U=b??(C?{entity:C,type:"group"}:void 0);if(U){if($4(I,U.entity,U.type))return b?s(M,"replaced"):g(M,"replaced");let f=j1(U.entity),l=Q?(await Q.listByTarget(U.type,M)).items:[],i=X1(m9(l),$1(I.members,U.type,M,f));await v5(n,async()=>{},i);let o=await O5(x,Q,W,U.type,M);return N5(E5(U.entity,U.type,o))}let Y=s1(I),z=Q?(await Q.listByTarget(T,M)).items:[],S=X1(m9(z),$1(I.members,T,M,Y)),y;await v5(n,async()=>{y=await Z9(x,I,M)},S,()=>J9(X,y,T));let R=await O5(x,Q,W,T,M);return N5(E5(y,T,R))},E=async(_,M)=>{let j=await _1(x,Q,W,M);if(!j)return h(404,`Group ${M} not found`,"invalidValue");let P=t(M),I=P?void 0:await k(M),T=P??(I?{entity:I,type:"group"}:void 0),v=await _.json();if(T&&(v.Operations??[]).some((R)=>!G(R)))return P?s(M,"patched"):g(M,"patched");let b={...j};for(let R of v.Operations??[])if(R.op==="replace"&&R.path&&R.value!==void 0){if(R.path==="displayName")b.displayName=R.value;else if(R.path===`${W5}.requestable`)b[W5]={...b[W5],requestable:Boolean(R.value)};else if(R.path===`${W5}.description`)b[W5]={...b[W5],description:String(R.value)}}else if(R.op==="add"&&R.path==="members"&&R.value!==void 0){let f=R.value;b.members=[...b.members??[],...f]}else if(R.op==="remove"&&R.path?.startsWith("members[")){let f=R.path.match(/members\[value eq "([^"]+)"\]/);if(f)b.members=(b.members??[]).filter((l)=>l.value!==f[1])}let C=await t5(J.group,b);if(C.issues)return Z.error("Group patch validation failed",{"ion.operation":"scim.group.patch","ion.outcome":"failure",validationIssues:C.issues}),h(400,`Request validation failed: ${C.issues.map((R)=>R.message).join("; ")}`,"invalidValue");let U=Q1(b),Y=T?j1(T.entity):s1(b),z=X1($1(j.members,U,M,Y),$1(b.members,U,M,Y)),S;await v5(n,async()=>{if(!T)S=await Z9(x,b,M)},z,T?void 0:()=>J9(X,S,U));let y=await O5(x,Q,W,U,M);return N5(E5(T?.entity??S,U,y))},A=async(_)=>{let M=await _1(x,Q,W,_);if(!M)return h(404,`Group ${_} not found`,"invalidValue");if(t(_))return s(_,"deleted");if(await k(_))return g(_,"deleted");let j=Q1(M);if(Q){let P=await Q.listByTarget(j,_),I=[];for(let T of P.items)await E1(n,T,I);await K9(n,I)}return await F4(x,_),new Response(null,{status:204})};V5={handler:O}}let G5;if(q.userStore){let{userStore:x,inboundUsers:k}=q,g=(Y)=>Y?.find((z)=>z.primary)?.value||Y?.[0]?.value,t=(Y)=>{if(Y.scimName)return Y.scimName;if(!Y.name)return;let[z,...S]=Y.name.split(" ");return{givenName:z,familyName:S.join(" ")||void 0}},s=(Y)=>Object.keys(Y.scimSchemaExtensions??{}).filter((z)=>z.startsWith("urn:")&&Y.scimSchemaExtensions?.[z]!==void 0),G=(Y)=>{let z={};if(Y.ecid!==void 0)z.ecid=Y.ecid;if(Y.accountClass!==void 0)z.accountClass=Y.accountClass;return z.ecid!==void 0||z.accountClass!==void 0?z:void 0},O=(Y)=>{let z=new Set([z1]);if(Y.scimEnterprise!==void 0)z.add(k5);if(G(Y)!==void 0)z.add(I5);for(let S of s(Y))z.add(S);return Array.from(z)},K=(Y)=>{let z={};if(Y.scimEnterprise!==void 0)z[k5]=Y.scimEnterprise;let S=G(Y);if(S!==void 0)z[I5]=S;for(let[y,R]of Object.entries(Y.scimSchemaExtensions??{}))if(y.startsWith("urn:")&&y!==I5&&R!==void 0)z[y]=R;return z},N=(Y)=>{let z=Y.userName||Y.email||Y.id||"",S=Y.emails??(Y.email?[{value:Y.email,primary:!0}]:[]);return{schemas:O(Y),id:Y.id,externalId:Y.externalId,userName:z,displayName:Y.displayName??Y.name??z,name:t(Y),nickName:Y.nickName,profileUrl:Y.avatar,title:Y.title,userType:Y.userType,preferredLanguage:Y.preferredLanguage,locale:Y.locale,timezone:Y.timezone,active:Y.active??!0,emails:S,phoneNumbers:Y.phoneNumbers,ims:Y.ims,photos:Y.photos,addresses:Y.addresses,groups:Y.groups,entitlements:Y.entitlements,roles:Y.roles,x509Certificates:Y.x509Certificates,meta:{resourceType:"User",created:(Y.createdAt??Y.updatedAt??new Date).toISOString(),lastModified:(Y.updatedAt??Y.createdAt??new Date).toISOString()},...K(Y)}},V=async(Y)=>{if(k?.mapBaseUserToScim)return await k.mapBaseUserToScim(Y);return N(Y)},D=async(Y,z)=>{if(k?.mapValidatedScimToBaseUser)return await k.mapValidatedScimToBaseUser(Y,z);let S=new Date,y=g(Y.emails),R=Y.name?.formatted||[Y.name?.givenName,Y.name?.middleName,Y.name?.familyName].filter(Boolean).join(" ").trim()||Y.displayName,f=Y.id||z.existing?.id||u9(),l=Y.userName||y||z.existing?.userName||f,i=R||Y.displayName||z.existing?.name||l,o=Object.fromEntries(Object.entries(Y).filter(([j5,L5])=>j5.startsWith("urn:")&&j5!==k5&&j5!==I5&&L5!==void 0)),e=Y[I5],q5=e?.ecid!==void 0&&e.ecid!==null?A1(e.ecid):z.existing?.ecid,Z5=e?.accountClass??z.existing?.accountClass,J5=z.existing?.sso;return{...z.existing??{},id:f,userName:l,name:i,email:y||z.existing?.email||l,avatar:Y.profileUrl,sso:{...J5??{},profile:{...J5?.profile??{},sub:f,iss:J5?.profile.iss??"iam-provisioned",aud:J5?.profile.aud??"iam-provisioned",exp:J5?.profile.exp??Math.floor(Date.now()/1000)+3600,iat:J5?.profile.iat??Math.floor(Date.now()/1000),email:y||z.existing?.email||l,email_verified:!0,name:i,preferred_username:l},tenant:J5?.tenant??{id:"iam-provisioned",name:"IAM Provisioned"},scope:J5?.scope??"openid profile email",tokenType:J5?.tokenType??"Bearer",expires:J5?.expires??new Date(Date.now()+3600000)},externalId:Y.externalId,ecid:q5,accountClass:Z5,displayName:Y.displayName,scimName:Y.name,emails:Y.emails,nickName:Y.nickName,title:Y.title,preferredLanguage:Y.preferredLanguage,locale:Y.locale,timezone:Y.timezone,active:Y.active,phoneNumbers:Y.phoneNumbers,ims:Y.ims,photos:Y.photos,addresses:Y.addresses,groups:Y.groups,entitlements:Y.entitlements,roles:Y.roles,x509Certificates:Y.x509Certificates,scimEnterprise:Y[k5],scimSchemaExtensions:Object.keys(o).length>0?o:void 0,createdAt:z.existing?.createdAt??(Y.meta?.created?new Date(Y.meta.created):S),updatedAt:Y.meta?.lastModified?new Date(Y.meta.lastModified):S,userType:Y.userType}},E=(Y,z,S)=>{Y[z]=S},A=(Y,z,S)=>{let y=Y[z];if(Array.isArray(y)){Y[z]=[...y,...Array.isArray(S)?S:[S]];return}if(y&&typeof y==="object"&&!Array.isArray(y)&&S&&typeof S==="object"&&!Array.isArray(S)){Y[z]={...y,...S};return}Y[z]=S},_=(Y,z,S)=>{let y=z.match(/^(urn:.*:(?:User|Group))(?::(.+))?$/),R=y?[y[1],...y[2]?.split(":")??[]]:z.split("."),f=Y;for(let i of R.slice(0,-1)){let o=f[i];if(o===void 0){if(!S)return null;f[i]={}}else if(o===null||typeof o!=="object"||Array.isArray(o)){if(!S)return null;f[i]={}}f=f[i]}let l=R.at(-1);if(!l)return null;return{parent:f,key:l}},M=(Y,z)=>{let S=z.op.toLowerCase();if(!z.path){if(S!=="remove"&&z.value&&typeof z.value==="object"&&!Array.isArray(z.value))Object.assign(Y,z.value);return}let y=z.path.match(/^([A-Za-z0-9]+)\[value eq "([^"]+)"\]$/);if(y&&S==="remove"){let[,f,l]=y,i=Y[f];if(Array.isArray(i))Y[f]=i.filter((o)=>!(o&&typeof o==="object"&&("value"in o)&&o.value===l));return}let R=_(Y,z.path,S!=="remove");if(!R)return;if(S==="remove"){delete R.parent[R.key];return}if(S==="add"){A(R.parent,R.key,z.value);return}E(R.parent,R.key,z.value)},j=async(Y,z)=>{if(!await D5(Y))return h(401,"Authorization required");let y=new URL(Y.url),R=z?.basePath??"/Users",f=y.pathname;if(f.startsWith(R))f=f.substring(R.length);let i=f.match(/^\/([^/]+)$/)?.[1],o=Y.method;try{if(i)switch(o){case"GET":return await I(i);case"PUT":return await b(Y,i);case"PATCH":return await C(Y,i);case"DELETE":return await U(i);default:return h(405,"Method not allowed")}else if(f===""||f==="/")switch(o){case"GET":return await P(Y);case"POST":return await v(Y);default:return h(405,"Method not allowed")}return h(404,"Resource not found")}catch(e){if(e instanceof i5)return h9(e);if($9(e))return h(409,e.message,"uniqueness");return Z.error("Users inbound handler error",{"ion.operation":"scim.users.handler","ion.outcome":"failure"},e),h(500,e instanceof Error?e.message:"Internal server error")}},P=async(Y)=>{let z=new URL(Y.url),S=z.searchParams.get("startIndex"),y=z.searchParams.get("count"),R=S!=null?parseInt(S,10):void 0,f=y!=null?parseInt(y,10):void 0,l=R!=null&&!Number.isNaN(R)?Math.max(0,R-1):0,i=f!=null&&!Number.isNaN(f)?f:void 0,o=p9(z.searchParams.get("filter"));if(o!==void 0){let Z5=await x.lookup({externalId:o}),J5=Z5?[await V(Z5)]:[];return a5(J5,{totalResults:J5.length,startIndex:1,itemsPerPage:J5.length})}let e=await x.list({start:l,limit:i}),q5=await Promise.all(e.items.map((Z5)=>V(Z5)));return a5(q5,{totalResults:e.total,startIndex:l+1,itemsPerPage:e.count})},I=async(Y)=>{let z=await x.get(Y);if(!z)return h(404,`User ${Y} not found`,"invalidValue");return N5(await V(z))},T=async(Y,z)=>{let S=n.accessIndex;if(!S?.setSubjectDisabled||!z.id)return;let y=Y?Y.active??!0:!0,R=z.active??!0;if(Y&&y===R)return;if(!Y&&R)return;await S.setSubjectDisabled(z.id,"user",!R)},v=async(Y)=>{let z=await Y.json(),S=await t5(J.user,z);if(S.issues)return Z.error("User creation validation failed",{"ion.operation":"scim.user.create","ion.outcome":"failure",validationIssues:S.issues}),h(400,`Request validation failed: ${S.issues.map((f)=>f.message).join("; ")}`,"invalidValue");let y=S.value;if(!y.userName&&!y.emails?.[0]?.value)return h(400,"userName or email is required","invalidValue");let R=await D(y,{mode:"create"});return await v5(n,async()=>{await x.upsert(R),await T(void 0,R)},r1(void 0,R),async()=>{await e1(X,R)}),N5(await V(R),201)},b=async(Y,z)=>{let S=await x.get(z);if(!S)return h(404,`User ${z} not found`,"invalidValue");let y=await Y.json(),R=await t5(J.user,y);if(R.issues)return Z.error("User replacement validation failed",{"ion.operation":"scim.user.replace","ion.outcome":"failure",validationIssues:R.issues}),h(400,`Request validation failed: ${R.issues.map((i)=>i.message).join("; ")}`,"invalidValue");let f=R.value,l=await D({...f,id:z},{existing:S,mode:"replace"});return l.createdAt=S.createdAt,l.updatedAt=new Date,await v5(n,async()=>{await x.upsert(l),await T(S,l)},r1(S,l),async()=>{await e1(X,l)}),N5(await V(l))},C=async(Y,z)=>{let S=await x.get(z);if(!S)return h(404,`User ${z} not found`,"invalidValue");let R=(await Y.json()).Operations??[],l={...await V(S)};for(let e of R)M(l,e);let i=await t5(J.user,l);if(i.issues)return Z.error("User patch validation failed",{"ion.operation":"scim.user.patch","ion.outcome":"failure",validationIssues:i.issues}),h(400,`Request validation failed: ${i.issues.map((e)=>e.message).join("; ")}`,"invalidValue");let o=await D(i.value,{existing:S,mode:"patch"});return o.updatedAt=new Date,await v5(n,async()=>{await x.upsert(o),await T(S,o)},r1(S,o),async()=>{await e1(X,o)}),N5(await V(o))},U=async(Y)=>{if(!await x.get(Y))return h(404,`User ${Y} not found`,"invalidValue");if(Q){let S=await Q.listBySubject(Y,"user"),y=[];for(let R of S.items)await E1(n,R,y);await K9(n,y)}if(await x.delete(Y),await n.accessIndex?.setSubjectDisabled?.(Y,"user",!1),n.authz.oaa.isReady())await F9(n,"authz.oaa.delete","OAA incremental user delete failed; full sync will reconcile",()=>n.authz.oaa.deleteUser(Y),{id:Y,kind:"user"});return new Response(null,{status:204})};G5={handler:j}}async function c5(x,k){$5();let g=new URL(x.url).pathname,t=U5(k?.usersUrl??q.usersUrl??"/api/iam/Users")??"/api/iam/Users",s=U5(k?.groupsUrl??q.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",G=await z5(x,k);if(G)return G;let O=(K)=>g===K||g.startsWith(`${K}/`);if(O(t)){if(!d)return h(404,"SCIM Users endpoint is disabled by RemoteConfig");if(!G5)return h(501,"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application.");return G5.handler(x,{basePath:t})}if(O(s)){if(!K5)return h(404,"SCIM Groups endpoint is disabled by RemoteConfig");if(!V5)return h(501,"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.");return V5.handler(x,{basePath:s})}return h(404,"Resource not found")}return{...q,createUser:l5,getBaseUrl:g5,groups_outbound:u5,groups_inbound:V5,users_inbound:G5,handler:c5,delta:m}}function V9(J,Z){let $=new TextEncoder().encode(J),X=typeof Z==="string"?new TextEncoder().encode(Z):Z,Q=new Uint8Array($.length+1+X.length);return Q.set($,0),Q[$.length]=46,Q.set(X,$.length+1),Q}function P4(J){let Z=J.replace(/-/g,"+").replace(/_/g,"/"),$=Z.length%4===0?"":"=".repeat(4-Z.length%4),X=atob(Z+$),Q=new Uint8Array(X.length);for(let F=0;F<X.length;F++)Q[F]=X.charCodeAt(F);return Q}function z4(J){let Z="";for(let $ of J)Z+=String.fromCharCode($);return btoa(Z).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function c9(J){let Z=JSON.parse(J);if(!Z||typeof Z!=="object"||!Array.isArray(Z.keys))throw Error("Invalid JWKS: expected { keys: [...] }");return Z}function O4(J){return JSON.stringify(J)}async function E4(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x},{name:"Ed25519"},!0,["verify"])}async function j4(J){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:J.x,d:J.d},{name:"Ed25519"},!0,["sign"])}async function A4(J){let $=(typeof J.jwks==="string"?c9(J.jwks):J.jwks).keys.find((X)=>X.kid===J.kid&&X.kty==="OKP"&&X.crv==="Ed25519");if(!$?.x)return!1;try{let X=await E4($),Q=V9(J.requestId,J.rawBody),F=P4(J.signatureB64Url);return crypto.subtle.verify({name:"Ed25519"},X,F,Q)}catch{return!1}}async function w4(J){let Z=await j4(J.privateKeyJwk),$=V9(J.requestId,J.rawBody),X=await crypto.subtle.sign({name:"Ed25519"},Z,$);return z4(new Uint8Array(X))}async function I4(J){let Z=await crypto.subtle.generateKey({name:"Ed25519"},!0,["sign","verify"]),$=await crypto.subtle.exportKey("jwk",Z.privateKey),Q=(await crypto.subtle.exportKey("jwk",Z.publicKey)).x,F=$.d;if(!Q||!F)throw Error("Failed to export Ed25519 key material (missing x/d)");return{privateJwk:{kty:"OKP",crv:"Ed25519",x:Q,d:F,kid:J,alg:"EdDSA",use:"sig"},publicJwks:{keys:[{kty:"OKP",crv:"Ed25519",x:Q,kid:J,alg:"EdDSA",use:"sig"}]}}}var L1={jwksTtlSeconds:{min:60,max:86400,default:600},jwksMaxEntries:{min:16,max:4096,default:256},sessionReadTtlSeconds:{min:1,max:300,default:30},sessionReadMaxEntries:{min:16,max:65536,default:1024}};function I1(J,Z){if(typeof J!=="number"||!Number.isFinite(J))return Z.default;let $=Math.floor(J);if($<Z.min)return Z.min;if($>Z.max)return Z.max;return $}function d9(J){return{ttlMs:I1(J?.ttlSeconds,L1.jwksTtlSeconds)*1000,maxEntries:I1(J?.maxEntries,L1.jwksMaxEntries)}}function n9(J){let Z=J?.read;return{read:{enabled:Z?.enabled===!0,ttlMs:I1(Z?.ttlSeconds,L1.sessionReadTtlSeconds)*1000,maxEntries:I1(Z?.maxEntries,L1.sessionReadMaxEntries)}}}function T4(J){return{jwks:d9(J?.jwks),session:n9(J?.session)}}function S4(J){let Z={};if(!J)return Z;let $=J.split(";");for(let X of $){let Q=X.trim();if(!Q)continue;let F=Q.indexOf("=");if(F===-1)continue;Z[Q.slice(0,F).trim()]=Q.slice(F+1).trim()}return Z}function a9(J){if(!J.expiresAt)return!1;let Z=J.expiresAt instanceof Date?J.expiresAt:new Date(J.expiresAt);return!Number.isNaN(Z.getTime())&&Date.now()>Z.getTime()}function R4(J){if(!J||typeof J!=="object"||Array.isArray(J))return;let{access_token:Z,id_token:$,refresh_token:X,tokens:Q,...F}=J;return F}function P5(J,Z){let $=J[Z];return typeof $==="string"?$:""}function x4(J,Z){let $=J.exp;if(typeof $==="number")return new Date($*1000);if(typeof $==="string"&&$.trim()){let X=Number($);if(!Number.isNaN(X))return new Date(X*1000)}if(Z instanceof Date)return Z;if(Z){let X=new Date(Z);if(!Number.isNaN(X.getTime()))return X}return new Date}function y4(J){let Z=J.claims;if(!Z?.sub||typeof Z.sub!=="string")return;let $=x4(Z,J.expiresAt);if(J.authType==="sso")return{id:Z.sub,userName:P5(Z,"preferred_username"),name:P5(Z,"name"),email:P5(Z,"email"),avatar:P5(Z,"picture")||void 0,sso:{profile:Z,tenant:{id:P5(Z,"idp")||P5(Z,"iss"),name:P5(Z,"iss")},tokenType:"Bearer",expires:$}};return{id:Z.sub,userName:P5(Z,"preferred_username"),name:P5(Z,"name"),email:P5(Z,"email"),avatar:P5(Z,"picture")||void 0,userType:"customer",ciam:{profile:Z,scope:"openid profile email",tokenType:"Bearer",expires:$}}}function b4(J){if(J.authType!=="sso"&&J.authType!=="ciam")return;if(a9(J))return;return{sid:J.sid,authType:J.authType,tenantId:typeof J.tenantId==="string"?J.tenantId:void 0,sub:J.sub,expiresAt:J.expiresAt,createdAt:J.createdAt,claims:R4(J.claims)}}function q4(J,Z){if(!J.endsWith(".session"))return!1;if(!Z||Z.length===0)return!0;return Z.some(($)=>J===`${$}.session`)}function C4(J){if(J===void 0)return;let Z=(Array.isArray(J)?J:[J]).map(($)=>$.trim()).filter(($)=>$.length>0);return Z.length>0?Z:void 0}async function t9(J,Z,$){return(await i9(J,Z,$)).map(b4).filter((Q)=>Boolean(Q))}async function i9(J,Z,$){let X=S4(J.headers.get("cookie")),Q=C4($?.cookiesPrefix),F=[],H=new Set;for(let[B,W]of Object.entries(X)){if(!q4(B,Q)||!W)continue;if(H.has(W))continue;H.add(W);let L=await Z.get(W);if(!L)continue;if(L.authType!=="sso"&&L.authType!=="ciam")continue;if(a9(L))continue;F.push(L)}return F}async function v4(J,Z,$){return(await t9(J,Z,$)).map(y4).filter((Q)=>Boolean(Q))}var U4="@ionite/core",k4=n5(D1(U4));async function f4(J,Z){let $=await S5({idToken:J,jwksUri:Z.jwksUri,issuer:Z.issuer,audience:Z.audience}),X=await k4.validate($);if(X.issues)throw Error(`ID token claims validation failed: ${X.issues.map((H)=>H.message).join("; ")}`);let Q=X.value;if(Q===void 0)throw Error("ID token claims missing");return o9(Q)}function B5(J){return Date.now()-J}function N9(J){if(J instanceof Error)return{"error.name":J.name,"error.message":J.message};return{"error.name":typeof J,"error.message":String(J)}}function T1(J,Z){if(!J)return{};try{let $=new URL(J);return{[`${Z}.origin`]:$.origin,[`${Z}.path`]:$.pathname}}catch{return{[`${Z}.path`]:J.startsWith("/")?J:`/${J}`}}}function S1(J,Z=5){if(!Array.isArray(J))return[String(J)];return J.slice(0,Z).map(($)=>{if(!$||typeof $!=="object")return String($);let X=$,Q=Array.isArray(X.path)?X.path.join("."):String(X.path??""),F=typeof X.message==="string"?X.message:String(X.message??"validation failed");return Q?`${Q}: ${F}`:F})}function h4(J){if(!J||typeof J!=="object")return{};let Z=J;return{oidc_error:typeof Z.error==="string"?Z.error:void 0,oidc_error_description:typeof Z.error_description==="string"?Z.error_description:void 0,oidc_error_uri:typeof Z.error_uri==="string"?Z.error_uri:void 0}}function g4(J,Z={}){let $=typeof J==="string"?J:J?.headers.get("cookie")??void 0;if(!$)return[];let Q=`${Z.cookiePrefix??"ion.sso"}.`,F=new Set;for(let H of Object.keys(p4($))){if(!H.startsWith(Q))continue;let B=H.slice(Q.length),W=B.lastIndexOf(".");if(W<=0)continue;let L=B.slice(0,W).trim();if(L)F.add(L)}return Array.from(F)}function m4(J,Z,$,X,Q){if(!$&&!X)return;let F=new WeakMap,H=new Map,B={...$,...X},W=!!(B.authority&&B.tokenUrl&&B.authorizationUrl&&B.clientId&&B.redirectUri&&B.scope),L={...B,authority:W?p(B.authority,"Missing 'authority' from SSO Config"):B.authority,tokenUrl:W?p(B.tokenUrl,"Missing 'tokenUrl' from SSO Config"):B.tokenUrl,authorizationUrl:W?p(B.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):B.authorizationUrl,clientId:W?p(B.clientId,"Missing 'clientId' from SSO Config"):B.clientId,redirectUri:W?p(B.redirectUri,"Missing 'redirectUri' from SSO Config"):B.redirectUri,scope:W?p(B.scope,"Missing 'scope' from SSO Config"):B.scope,responseType:B.responseType??"code",cookiesSecure:B.cookiesSecure!==void 0?B.cookiesSecure:!0,cookiesSameSite:B.cookiesSameSite!==void 0?B.cookiesSameSite:"Strict",cookiesPrefix:B.cookiesPrefix??(B.clientId?`ion.sso.${B.clientId}`:"ion.sso"),cookiesPath:B.cookiesPath??"/"},c=Math.min(600,Math.max(0,Math.floor(Number(L.rotationGraceSeconds??60))||0))*1000;function m(){let G=[];if(!L.authority)G.push("authority");if(!L.tokenUrl)G.push("tokenUrl");if(!L.authorizationUrl)G.push("authorizationUrl");if(!L.clientId)G.push("clientId");if(!L.redirectUri)G.push("redirectUri");if(!L.scope)G.push("scope");if(G.length>0)throw Error(`Missing OIDC configuration fields: ${G.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing ionite.`)}async function a(G){if(!L)throw Error("ionite SSO Manager not initialized");let O=F.get(G);if(O)return O;let K=u(G);return F.set(G,K),K}async function u(G){try{let{tokens:O,session:K,refreshedUser:N}=await G5(G);if(!O)return{status:"unauthenticated"};if(N)return{status:"authenticated",value:N};if(K?.claims)return{status:"authenticated",value:$5(K.claims,O,z5(K.expiresAt))};return{status:"unauthenticated"}}catch(O){if(r9(O))return{status:"unauthenticated"};return Z.error("Error parsing user from cookies",{"ion.operation":"cookie.parse","ion.outcome":"degraded"},O),{status:"degraded",error:O instanceof Error?O:void 0}}}async function Q5(G){let O=await a(G);return O.status==="authenticated"?O.value:void 0}async function n(G){if(!L)throw Error("ionite SSO Manager not initialized");m();let O=p(L.redirectUri,"Missing 'redirectUri' from SSO Config"),K=p(L.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"),N=p(L.clientId,"Missing 'clientId' from SSO Config"),V=p(L.scope,"Missing 'scope' from SSO Config"),D=L.cookiesSecure?G.url.replace(/^http:\/\//,"https://"):G.url,E=_5(),A=_5(64),_=_5(),M=O;try{new URL(M)}catch{if(D)try{let v=new URL(D),b=M.startsWith("//")?M.slice(1):M.startsWith("/")?M:`/${M}`;M=new URL(b,v.origin).toString()}catch{try{let v=new URL(K),b=M.startsWith("//")?M.slice(1):M.startsWith("/")?M:`/${M}`;M=new URL(b,v.origin).toString()}catch{throw Error(`Invalid redirectUri: "${O}". It must be a valid absolute URL.`)}}}let j=new URL(K);j.searchParams.append("client_id",N),j.searchParams.append("redirect_uri",M),j.searchParams.append("response_type","code"),j.searchParams.append("scope",V),j.searchParams.append("state",E),j.searchParams.append("nonce",_);let P=await J1(A);j.searchParams.append("code_challenge",P),j.searchParams.append("code_challenge_method","S256");let I=await L.beforeLogin?.({request:G}),T=I===void 0?{state:E,codeVerifier:A,nonce:_}:{state:E,codeVerifier:A,nonce:_,context:I};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:j.toString(),"Set-Cookie":x(t(E),T,L.loginStateTtl??600,"Lax")}})}async function H5(G){if(!L)throw Error("ionite SSO Manager not initialized");let O;try{O=await Q5(G)}catch{O=void 0}let K=await L.beforeLogout?.({request:G,user:O}),N=g("session",G),V;try{V=await G5(G);let P=V.tokens?.refresh_token??g("refresh",G);if(P)await g5(P)}catch(P){Z.warn("Failed to revoke token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},P)}if(L.sessionStore)try{let P=V?.sid??N;if(P)await L.sessionStore.delete(P)}catch(P){Z.warn("Failed to delete session",{"ion.operation":"session.delete","ion.outcome":"degraded"},P)}let D=[["Set-Cookie",k("session")]],E=await L.afterLogout?.({request:G,context:K}),A=R5(E,"/",G.url);if(A.response){let P=new Headers(A.response.headers);for(let[,I]of D)P.append("Set-Cookie",I);return new Response(A.response.body,{status:A.response.status,statusText:A.response.statusText,headers:P})}let _=A.location??"/",M=G.headers.get("accept");if(M?.includes("application/json")||M?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:_}),{status:200,headers:[["Content-Type","application/json"],...D]});return new Response("Logged out",{status:302,headers:[["Location",_],...D]})}async function q(G){if(!L)throw Error("ionite SSO Manager not initialized");if(!L.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{if(!G.headers.get("content-type")?.includes("application/x-www-form-urlencoded"))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let K=await G.text(),V=new URLSearchParams(K).get("logout_token");if(!V)return new Response("Missing logout_token parameter",{status:400});let D=p(L.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify logout tokens."),E=p(L.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify logout tokens."),A=L.jwksUri||`${D}/protocol/openid-connect/certs`,_=await d1({logoutToken:V,jwksUri:A,issuer:D,audience:E,log:Z}),M=typeof _.sid==="string"?_.sid:void 0;if(!M)return Z.warn("Back-Channel Logout: logout_token missing sid claim",{"ion.operation":"backchannel_logout","ion.outcome":"failure"}),new Response("Invalid logout_token: missing sid claim",{status:400});return await L.sessionStore.delete(M),Z.info("Back-Channel Logout: successfully deleted session",{"ion.module":"sso",sid:M}),new Response("OK",{status:200})}catch(O){return Z.error("Error during back-channel logout",{"ion.operation":"backchannel_logout","ion.outcome":"failure"},O),new Response("Internal Server Error",{status:500})}}async function d(G){if(!L)throw Error("ionite SSO Manager not initialized");let O=Date.now(),K=new URL(G.url),N=new URLSearchParams(K.search);Z.debug("SSO callback received",{"ion.event":"ion.sso.callback.received","ion.module":"sso","ion.operation":"sign_in.callback","http.method":G.method,"url.path":K.pathname,hasCode:N.has("code"),hasState:N.has("state"),hasError:N.has("error"),...T1(N.get("iss")??void 0,"oidc.issuer")});let V=Object.fromEntries(N.entries()),D=await J.callbackParams.validate(V);if(D.issues)return Z.warn("SSO callback parameter validation failed",{"ion.event":"ion.sso.callback.validation_failed","ion.operation":"sign_in.callback","ion.outcome":"failure","validation.issues":S1(D.issues)}),s9(D.issues,"OIDC callback parameters validation failed");let{code:E,state:A}=D.value,_;try{let M=p(A,'OIDC "state" was not present in the callback parameters'),j=g(t(M),G,!0),{codeVerifier:P,state:I,nonce:T,context:v}=j??{};_=v,Z.debug("SSO callback state cookie read",{"ion.event":"ion.sso.callback.state_cookie_read","ion.module":"sso","ion.operation":"sign_in.callback",hasStateCookie:Boolean(j),hasCodeVerifier:Boolean(P),hasStateVerifier:Boolean(I),hasNonce:Boolean(T),hasContext:v!==void 0});let b=p(P,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');p(I,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');let C=p(T,'OIDC "nonce" was not present in cookies, ensure that the SSO login was initiated correctly'),U=p(E,'OIDC "code" was not present in the callback parameters');if(A!==I)throw Z.warn("SSO callback state verification failed",{"ion.event":"ion.sso.callback.state_verification_failed","ion.operation":"sign_in.callback","ion.outcome":"failure"}),Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');Z.debug("SSO callback state verified",{"ion.event":"ion.sso.callback.state_verified","ion.module":"sso","ion.operation":"sign_in.callback"});let Y=L.cookiesSecure?G.url.replace(/^http:\/\//,"https://"):G.url,z=await f5(U,b,Y),{tokenExpiresAt:S,sessionExpiresAt:y}=K5(z);z.expires=S.toISOString();let R=Date.now();Z.debug("SSO ID token parsing started",{"ion.event":"ion.sso.id_token.parse_started","ion.module":"sso","ion.operation":"id_token.parse"});let f=await r(z,C,y);Z.debug("SSO ID token parsing completed",{"ion.event":"ion.sso.id_token.parse_completed","ion.module":"sso","ion.operation":"id_token.parse","duration.ms":B5(R),"user.id":f.id});let l,i;{let Z5=T5("SSO requires sessionStore configuration for opaque session cookies."),J5=typeof f.sso.profile.sid==="string"?f.sso.profile.sid:void 0,j5=J5||_5(32),L5=f.id;if(Z.debug("SSO session creation evaluated",{"ion.event":"ion.sso.session.create_evaluated","ion.module":"sso","ion.operation":"session.create",hasSid:Boolean(j5),hasIdpSid:Boolean(J5),hasSub:Boolean(L5),"user.id":L5}),!L5)throw Error("Session creation failed: missing sub in ID token claims");let x1=Date.now(),F1={sid:j5,sub:L5,idpSid:J5,authType:"sso",tenantId:L.tenantId,tokens:z,claims:f.sso.profile,expiresAt:y,createdAt:new Date};await b5(Z5,F1),i=F1,l=["Set-Cookie",x("session",j5,y)],Z.info("SSO session created",{"ion.event":"ion.sso.session.created","ion.operation":"session.create","ion.outcome":"success","duration.ms":B5(x1),"user.id":L5})}if(L.userStore)try{let Z5=f.id;if(Z5){let J5=new Date,j5=Date.now();Z.debug("SSO user store lookup started",{"ion.event":"ion.sso.user.lookup_started","ion.module":"sso","ion.operation":"user.lookup","user.id":Z5});let L5=await L.userStore.get(Z5);if(Z.debug("SSO user store lookup completed",{"ion.event":"ion.sso.user.lookup_completed","ion.module":"sso","ion.operation":"user.lookup","duration.ms":B5(j5),"user.id":Z5,found:Boolean(L5)}),L5||L.enableJitUserProvisioning){let x1=Date.now(),F1={...L5??{},...f,id:Z5,tenantId:L5?.tenantId,createdAt:L5?.createdAt??J5,updatedAt:J5};await L.userStore.upsert(F1),Z.info("SSO user stored",{"ion.event":"ion.sso.user.stored","ion.operation":"user.store","ion.outcome":"success","duration.ms":B5(x1),"user.id":Z5,existing:Boolean(L5),jitProvisioning:Boolean(L.enableJitUserProvisioning)})}else Z.warn("JIT user provisioning disabled: user not found in store and will not be created",{"ion.event":"ion.sso.user.skipped","ion.operation":"user.store","ion.outcome":"skipped","user.id":Z5})}else Z.warn("User storage skipped: missing sub in ID token claims",{"ion.event":"ion.sso.user.skipped","ion.operation":"user.store","ion.outcome":"skipped"})}catch(Z5){Z.warn("Failed to store user",{"ion.event":"ion.sso.user.store_failed","ion.operation":"user.store","ion.outcome":"degraded",...N9(Z5)})}Z.info("SSO sign-in succeeded",{"ion.event":"ion.sso.sign_in.succeeded","ion.operation":"sign_in.callback","ion.outcome":"success","duration.ms":B5(O),"user.id":f.id});let o=[["Set-Cookie",k(t(M))],...l?[l]:[]],e=await L.afterLogin?.({ok:!0,request:G,user:f,session:i,context:_}),q5=R5(e,"/",G.url);if(q5.response)return C5(q5.response,o.map(([,Z5])=>Z5));return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",q5.location],...o]})}catch(M){Z.error("Error during sign-in callback",{"ion.event":"ion.sso.sign_in.callback_failed","ion.operation":"sign_in.callback","ion.outcome":"failure","duration.ms":B5(O),...N9(M)});let j=A?[["Set-Cookie",k(t(A))]]:[],P=await L.afterLogin?.({ok:!1,request:G,error:M,context:_}),I=R5(P,"/",G.url);if(I.response)return C5(I.response,j.map(([,T])=>T));return new Response("Authentication failed, redirecting",{status:302,headers:[["Location",I.location],...j]})}}function K5(G){let O=Date.now(),K=Number(G.expires_in??3600)||3600,N=new Date(O+K*1000),V;if(G.refresh_expires_in!=null&&Number.isFinite(Number(G.refresh_expires_in)))V=Number(G.refresh_expires_in);else if(G.refresh_token)V=86400;else V=K;return{tokenExpiresAt:N,sessionExpiresAt:new Date(O+V*1000)}}async function r(G,O,K){if(!L)throw Error("ionite SSO Manager not initialized");let N=Date.now(),V=await p5(G.id_token,O);return Z.debug("SSO user parsed from ID token",{"ion.event":"ion.sso.user.parse_completed","ion.module":"sso","ion.operation":"id_token.parse","duration.ms":B5(N),"user.id":V.sub,hasEmail:Boolean(V.email),hasName:Boolean(V.name)}),$5(V,G,K)}function $5(G,O,K){let N=K??K5(O).sessionExpiresAt,V=G.ecid!==void 0&&G.ecid!==null?A1(G.ecid):void 0;return{id:G.sub,userName:G.preferred_username||"",name:G.name||"",email:G.email||"",emails:[{value:G.email||"",primary:!0}],...V?{ecid:V}:{},avatar:G.picture,sso:{profile:{...G},tenant:{id:G.idp||G.iss||"",name:G.iss||""},scope:O.scope,tokenType:O.token_type,sessionState:O.session_state,expires:N}}}async function D5(G){if(!L.userStore)return G;let O=await L.userStore.lookup(G);if(!O)return G;return{...G,...O,id:G.id,sso:G.sso}}async function f5(G,O,K){if(!L)throw Error("ionite SSO Manager not initialized");m();let N=p(L.tokenUrl,"Missing 'tokenUrl' from SSO Config"),V=p(L.redirectUri,"Missing 'redirectUri' from SSO Config"),D=p(L.clientId,"Missing 'clientId' from SSO Config"),E=V;try{new URL(E)}catch{if(K)try{let _=new URL(K),M=E.startsWith("//")?E.slice(1):E.startsWith("/")?E:`/${E}`;E=new URL(M,_.origin).toString()}catch{try{let _=new URL(N),M=E.startsWith("//")?E.slice(1):E.startsWith("/")?E:`/${E}`;E=new URL(M,_.origin).toString()}catch{throw Error(`Invalid redirectUri: "${V}". It must be a valid absolute URL.`)}}}let A=new URLSearchParams;if(A.append("grant_type","authorization_code"),A.append("code",G),A.append("redirect_uri",E),A.append("client_id",D),L.clientSecret)A.append("client_secret",L.clientSecret);A.append("code_verifier",O);try{let _=Date.now();Z.debug("SSO token exchange started",{"ion.event":"ion.sso.token.exchange_started","ion.module":"sso","ion.operation":"token.exchange",...T1(N,"oidc.token_url"),...T1(E,"oidc.redirect_uri"),hasClientSecret:Boolean(L.clientSecret)});let M=await fetch(N,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:A.toString()});Z.debug("SSO token exchange response received",{"ion.event":"ion.sso.token.response_received","ion.module":"sso","ion.operation":"token.exchange","http.status_code":M.status,"duration.ms":B5(_)}),Z.debug("SSO token exchange response body read started",{"ion.event":"ion.sso.token.response_body_read_started","ion.module":"sso","ion.operation":"token.exchange"});let j=await M.json();if(Z.debug("SSO token exchange response body read completed",{"ion.event":"ion.sso.token.response_body_read_completed","ion.module":"sso","ion.operation":"token.exchange","duration.ms":B5(_)}),!M.ok){Z.error("Token exchange error",{"ion.event":"ion.sso.token.exchange_failed","ion.operation":"token.exchange","ion.outcome":"failure","http.status_code":M.status,"duration.ms":B5(_),...h4(j)});let I=j;throw Error(`Token exchange failed: ${I.error||M.statusText} - ${I.error_description||""}`.trim())}let P=await J.tokenResponse.validate(j);if(P.issues)throw Z.error("Token response validation failed",{"ion.event":"ion.sso.token.response_validation_failed","ion.operation":"token.exchange","ion.outcome":"failure","duration.ms":B5(_),"validation.issues":S1(P.issues)}),Error(`Token response validation failed: ${P.issues}`);return Z.debug("SSO token exchange completed",{"ion.event":"ion.sso.token.exchange_completed","ion.module":"sso","ion.operation":"token.exchange","ion.outcome":"success","duration.ms":B5(_),tokenType:P.value.token_type,hasAccessToken:Boolean(P.value.access_token),hasIdToken:Boolean(P.value.id_token),hasRefreshToken:Boolean(P.value.refresh_token),expiresIn:P.value.expires_in}),P.value}catch(_){throw Z.error("Error during token exchange",{"ion.event":"ion.sso.token.exchange_failed","ion.operation":"token.exchange","ion.outcome":"failure",...N9(_)}),_}}async function h5(G){return g1(async()=>{if(!L)throw Error("ionite SSO Manager not initialized");m();let O=p(L.tokenUrl,"Missing 'tokenUrl' from SSO Config"),K=p(L.clientId,"Missing 'clientId' from SSO Config"),N=new URLSearchParams;N.append("grant_type","refresh_token"),N.append("refresh_token",G),N.append("client_id",K);let V=await fetch(O,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:N.toString()}),D=await V.json();if(!V.ok){Z.error("Token refresh error",{"ion.operation":"token.refresh","ion.outcome":"failure",response:D});let A=D;throw Error(`Token refresh failed: ${A.error||V.statusText} - ${A.error_description||""}`.trim())}let E=await J.tokenResponse.validate(D);if(E.issues)throw Z.error("Token refresh response validation failed",{"ion.event":"ion.sso.token.refresh_validation_failed","ion.operation":"token.refresh","ion.outcome":"failure","validation.issues":S1(E.issues)}),Error(`Token refresh response validation failed: ${E.issues}`);return E.value},void 0,void 0,void 0,Z)}async function g5(G){try{if(!L)throw Error("ionite SSO Manager not initialized");if(!L.revocationEndpoint)return;let O=p(L.clientId,"Missing 'clientId' from SSO Config"),K=new URLSearchParams;K.append("token",G),K.append("token_type_hint","refresh_token"),K.append("client_id",O);let N=await fetch(L.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:K.toString()});if(!N.ok)Z.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:N.status,statusText:N.statusText});else Z.info("Token revoked successfully",{"ion.module":"sso"})}catch(O){Z.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},O)}}async function m5(){if(!L)throw Error("ionite SSO Manager not initialized");let G=L.authority;if(!L.jwksUri&&!G)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let O=L.jwksUri||`${G}/protocol/openid-connect/certs`;return r5(O,Z)}async function p5(G,O){let K=Date.now(),N=p(L.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify ID tokens."),V=p(L.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify ID tokens."),D=L.jwksUri||`${N}/protocol/openid-connect/certs`;Z.debug("SSO ID token verification started",{"ion.event":"ion.sso.id_token.verify_started","ion.module":"sso","ion.operation":"id_token.verify",...T1(D,"oidc.jwks_uri")});let E;try{E=await S5({idToken:G,jwksUri:D,issuer:N,audience:V,expectedNonce:O,log:Z})}catch(_){throw Z.error("SSO ID token verification failed",{"ion.event":"ion.sso.id_token.verify_failed","ion.module":"sso","ion.operation":"id_token.verify","ion.outcome":"failure","duration.ms":B5(K)},_),_}Z.debug("SSO ID token signature verified",{"ion.event":"ion.sso.id_token.signature_verified","ion.module":"sso","ion.operation":"id_token.verify","duration.ms":B5(K)});let A=await J.idTokenClaims.validate(E);if(A.issues)throw Z.error("ID token claims validation failed",{"ion.event":"ion.sso.id_token.validation_failed","ion.operation":"id_token.validate","ion.outcome":"failure","duration.ms":B5(K),"validation.issues":S1(A.issues)}),Error(`ID token claims validation failed: ${A.issues}`);return Z.debug("SSO ID token claims validated",{"ion.event":"ion.sso.id_token.claims_validated","ion.module":"sso","ion.operation":"id_token.validate","ion.outcome":"success","duration.ms":B5(K),"user.id":A.value.sub,hasIssuer:Boolean(A.value.iss),hasAudience:Boolean(A.value.aud)}),A.value}function T5(G="SSO sessionStore is required for opaque session cookies."){if(!L.sessionStore)throw Error(G);return L.sessionStore}async function b5(G,O){try{await G.create(O)}catch(K){if(!await G.get(O.sid))throw K;await G.update(O.sid,O)}}function z5(G){if(!G)return;if(G instanceof Date)return G;let O=new Date(G);return Number.isNaN(O.getTime())?void 0:O}function u5(G){let O=G.tokens;if(!O?.access_token||!O.id_token||!O.token_type)return;return O}async function l5(G,O=!1){let K=T5(),N=g("session",G);if(!N)return{tokens:void 0,refreshHeaders:[]};let V=await K.get(N);if(V&&L.tenantId&&V.tenantId&&V.tenantId!==L.tenantId)return{tokens:void 0,refreshHeaders:[["Set-Cookie",k("session")]],sid:N};if(V?.authType!=="sso")return{tokens:void 0,refreshHeaders:[["Set-Cookie",k("session")]],sid:N};let D=u5(V);if(!D)return{tokens:void 0,refreshHeaders:[["Set-Cookie",k("session")]],sid:N};let E=z5(V.expiresAt);if(E?Date.now()>E.getTime():!1)return await K.delete(N),{tokens:void 0,sid:N,refreshHeaders:[["Set-Cookie",k("session")]]};let _=z5(D.expires),M=_?Date.now()>_.getTime():!0;if((O||M)&&D.refresh_token)return V5(N,V,D);return{tokens:D,sid:N,session:V,refreshHeaders:[]}}function V5(G,O,K){let N=H.get(G);if(N)return N;let V=T5(),D=(async()=>{let E=await h5(K.refresh_token),{tokenExpiresAt:A,sessionExpiresAt:_}=K5(E);E.expires=A.toISOString();let M=await r(E,void 0,_),j=M.sso.profile,P=_5(32),I={...O,sid:P,tokens:E,claims:j,expiresAt:_,createdAt:new Date};await b5(V,I);try{if(c<=0)await V.delete(G);else{let{refresh_token:T,...v}=K;await V.update(G,{tokens:v,expiresAt:new Date(Date.now()+c)})}}catch(T){Z.warn("Failed to retire rotated SSO session record",{"ion.operation":"session.rotate","ion.outcome":"degraded"},T)}return{tokens:E,sid:P,session:I,refreshedUser:M,refreshHeaders:[["Set-Cookie",x("session",P,_)]]}})();return H.set(G,D),D.finally(()=>{H.delete(G)})}async function G5(G,O=!1){return l5(G,O)}async function c5(G){let{tokens:O}=await G5(G);if(!O)return;return O.access_token}function x(G,O,K,N=L.cookiesSameSite??"Strict"){if(!L)throw Error("ionite SSO Manager not initialized");if(G=`${L.cookiesPrefix}.${G}`,typeof O!=="string")O=btoa(JSON.stringify(O));let V;if(K instanceof Date)V=`Expires=${K.toUTCString()}`;else if(typeof K==="number")V=`Max-Age=${K}`;else throw Error("Invalid expires type",K);if(O.length>4000)throw Error(`Error setting cookie: ${G}. Cookie length is: ${O.length}`);return`${G}=${O}; ${V}; Path=${L.cookiesPath}; HttpOnly;${L.cookiesSecure?" Secure;":""} SameSite=${N};`}function k(G){if(!L)throw Error("ionite SSO Manager not initialized");return`${L.cookiesPrefix}.${G}=; Max-Age=0; Path=${L.cookiesPath}; HttpOnly;${L.cookiesSecure?" Secure;":""} SameSite=${L.cookiesSameSite};`}function g(G,O,K=!1){if(!L)throw Error("ionite SSO Manager not initialized");let N=O.headers.get("cookie");if(!N)return null;let V=`${L.cookiesPrefix}.${G}`,D=N.split(";").find((M)=>M.trim().startsWith(`${V}=`));if(!D)return null;let E=D.indexOf("="),A=D.slice(E+1).trim();if(!K)return A;let _=atob(A);return JSON.parse(_)}function t(G){return`state_${G}`}async function s(G,O){if(!L)throw Error("ionite SSO Manager not initialized");let{loginUrl:K,userUrl:N,tokenUrl:V,refreshUrl:D,logoutUrl:E,logoutBackChannelUrl:A,jwksUrl:_,redirectUri:M}={...L,...O},j=new URL(G.url).pathname;if(M){let P;try{P=new URL(M).pathname}catch{try{let I=new URL(G.url),T=M.startsWith("//")?M.slice(1):M;P=new URL(T,I.origin).pathname}catch{P=M.startsWith("/")?M:`/${M}`}}if(P===j)return d(G)}if(K===j)return n(G);if(N===j)try{let{tokens:P,session:I,refreshedUser:T,refreshHeaders:v}=await G5(G);if(!P)return new Response("User not logged in",{status:401,headers:v});let b=T??(I?.claims?$5(I.claims,P,z5(I.expiresAt)):void 0);if(!b)return new Response("User not logged in",{status:401,headers:v});let C=await D5(b);return new Response(JSON.stringify(C),{headers:[["Content-Type","application/json"],...v]})}catch(P){if(r9(P))return new Response("User not logged in",{status:401});return Z.error("Error resolving SSO user",{"ion.operation":"sso.user","ion.outcome":"degraded"},P),new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(V===j){let{tokens:P,refreshHeaders:I}=await G5(G);if(!P)return new Response("User not logged in",{status:401,headers:I});return new Response(JSON.stringify({token:P.access_token,expires:P.expires}),{headers:[["Content-Type","application/json"],...I]})}if(D===j){let{tokens:P,refreshHeaders:I}=await G5(G,!0);if(!P)return new Response("User not logged in",{status:401});return new Response("Refresh Complete",{status:200,headers:I})}if(E===j)return H5(G);if(A===j)return q(G);if(_===j){let P=await m5();return new Response(JSON.stringify(P),{headers:[["Content-Type","application/json"]]})}return new Response("Not Found",{status:404})}return{...L,getUser:Q5,resolveUser:a,getJwt:c5,initiateLogin:n,logout:H5,logoutBackChannel:q,callbackHandler:d,handler:s}}function p4(J){let Z={},$=J.split(";");for(let X of $){let Q=X.trim();if(!Q)continue;let F=Q.indexOf("=");if(F===-1)continue;let H=Q.slice(0,F).trim(),B=Q.slice(F+1).trim();Z[H]=B}return Z}function r9(J){if(!(J instanceof Error))return!1;return["Public key not found","Invalid JWT","Invalid JWT signature","ID token expired","ID token issuer mismatch","ID token audience mismatch","ID token nonce mismatch","ID token missing exp","invalid_grant"].some((Z)=>J.message.includes(Z))}function e9(J){return J=J??"SSO Unavailable",new Response(JSON.stringify({error:J}),{status:503,statusText:J,headers:{"Content-Type":"application/json"}})}var R1="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.";async function u4(J,Z){return p(Z,R1),Z.sso?.getUser(J)}async function l4(J,Z){return p(Z,R1),await Z.sso?.resolveUser(J)??{status:"unauthenticated"}}async function c4(J,Z){p(Z,R1);let $=Z.sso;if(!$)return e9();return $.initiateLogin(J)}async function d4(J,Z){p(Z,R1);let $=Z.sso;if(!$)return e9();return $.callbackHandler(J)}export{C5 as withSetCookies,G1 as withDefaultExternalId,f4 as verifyUser,d1 as verifyLogoutToken,A4 as verifyLfvSignature,S5 as verifyIdToken,O4 as stringifyLfvJwks,m4 as sso,w4 as signLfvPayload,P2 as setJwksRetry,_2 as setJwksClock,y2 as setDiscoveryClock,t4 as sendTenantWebhook,i1 as sameOriginRedirectRules,l4 as resolveUser,n9 as resolveSessionCacheConfig,o1 as resolveRedirect,C1 as resolveProviderBranding,d9 as resolveJwksCacheConfig,j2 as resolveJwkForKid,d2 as resolveCustomer,V1 as resolveCiamProvider,m2 as resolveCapturedRedirect,T4 as resolveCacheConfig,R5 as resolveAfterRedirect,W9 as reconcileSubjectAccess,J1 as pkceChallengeFromVerifier,c9 as parseLfvJwks,v1 as orderedEnabledProviders,e5 as normalizeOidcIssuer,g4 as listSsoClientIdsFromCookies,v9 as isRedirectAllowed,c4 as initiateLogin,_4 as iam,V2 as hasScope,G2 as hasRole,W2 as hasPermission,L2 as hasGroup,N2 as hasAnyScope,F2 as hasAny,M2 as hasAllScope,H2 as hasAll,B2 as has,p1 as getVerificationKeyForKid,u4 as getUser,A2 as getPublicKeyFromJwks,w2 as getPublicKeyForKid,q1 as getProviderPreset,r5 as getJwks,v4 as getDiscoveredSessionUsers,c2 as getCustomer,m1 as getCachedVerificationKey,I4 as generateLfvEd25519KeyPair,t1 as generateAppleClientSecret,a1 as fetchUserInfo,B9 as expandRoot,c1 as exchangeAuthorizationCode,t9 as discoverSessions,i9 as discoverSessionRecords,n1 as discoverOidcEndpoints,h2 as defaultRedirectPolicies,D2 as configureJwksCache,n4 as collectReferencedDefinitions,E2 as clearJwksCache,b2 as clearDiscoveryCache,l2 as ciam,g2 as captureRedirect,d4 as callback,V9 as buildLfvSigningInput,l1 as buildAuthorizationUrl,b9 as blockDangerousUrls,R9 as assertTrustedIdTokenClaims,C9 as allowSameOrigin,q9 as allowRelativePaths,k2 as allowOrigins,f2 as allowHosts,a4 as InMemoryTenantStore,Y9 as CatalogAdjacencyCache,z9 as CIAM_PROVIDER_PRESETS,L1 as CACHE_BOUNDS};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/core",
-  "version": "0.0.23-beta.20260809.2",
+  "version": "0.0.23-beta.20260812.3",
   "description": "ionite Core (client-safe main entry; server handlers under ./server)",
   "private": false,
   "author": "ionite",