@ionite/core 0.0.24-beta.20261024.47 → 0.0.24-beta.20261024.49

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/dist/index.d.ts +9 -32
  2. package/dist/index.js +2 -2
  3. package/dist/server.d.ts +7 -21
  4. package/dist/server.js +1 -1
  5. package/dist/shared/core-0nsg7t0c.js +4 -0
  6. package/package.json +1 -1
  7. package/dist/shared/core-g9rg6g0j.js +0 -4
package/dist/server.js CHANGED
@@ -1 +1 @@
1
- import{ee,p,x,E,P,c,n,u,ne,y,t,h,U,W,V,z,se,B,r,f,oe,D,ke,Xe,G,ie,ae,H,ce,g,F,ue,J,_,O,Y,j,s,de,X,o,S,k,b,le,pe,me,we,Ce,fe,ge,ye,T,a,L,l,he,i,A,w,Z,d,m,e,Se,I,C,Q,v,q,Ge}from"./shared/core-g9rg6g0j.js";var ki=new Set(fe.map((R)=>R.id));async function On(R){let M=Si(R.block);if(M.length===0||!R.subjectId)return[];let N=wi(R.claims,R.accessClaims,R.scope),K=R.block.expand===!0,te=K&&R.block.resources===!0,Ie=[],Te=new Set,ve=(Ae)=>{let be=`${Ae.targetType}:${Ae.target}:${Ae.resource??""}`;if(Te.has(be))return;Te.add(be),Ie.push(Ae)};for(let Ae of M){let be=bi(N,Ae);for(let Ke of be){let nt=await vi(R.catalog,Ke);if(!nt){R.log?.debug("claims entitlement dropped: value is not a catalog id",{"ion.event":"ion.authz.claims.unmatched","ion.module":"authz",claim:Ae,value:Ke});continue}if(!K||!R.catalog){ve({targetType:nt,target:Ke,claim:Ae});continue}let dt={subject:R.subjectId,subjectType:R.subjectType,targetType:nt,target:Ke,...te?Ai(await Ii(R.catalog,nt,Ke)):{applyToApplication:!0}},at=await D(dt,R.catalog),He=dt.id;for(let Qe of at){if(Qe.resource&&!te)continue;ve({targetType:Qe.targetType,target:Qe.target,...Qe.resource?{resource:Qe.resource}:{},claim:Ae,root:He??Qe.rootId})}}}return Ie}function In(R){if(!R)return;let M=R.split(".");if(M.length!==3||!M[1])return;try{let N=M[1].replace(/-/g,"+").replace(/_/g,"/"),K=N.padEnd(N.length+(4-N.length%4)%4,"="),te=JSON.parse(atob(K));return te&&typeof te==="object"&&!Array.isArray(te)?te:void 0}catch{return}}var hr=new WeakMap;function _n(R,M,N){let K=hr.get(R)??{};K[M]=N??[],hr.set(R,K)}function kr(R,M){return hr.get(R)?.[M]}function Si(R){return R.claims.filter((M)=>typeof M==="string"&&M.length>0)}function wi(R,M,N){let K={...R};if(M){for(let[te,Ie]of Object.entries(M))if(K[te]===void 0)K[te]=Ie}if(K.scope===void 0&&N)K.scope=N;return K}function bi(R,M){let N=Ci(R,M);if(typeof N==="string")return M==="scope"||M.endsWith(".scope")?N.split(/\s+/).filter(Boolean):N.length>0?[N]:[];if(Array.isArray(N))return N.filter((K)=>typeof K==="string"&&K.length>0);return[]}function Ci(R,M){let N=R;for(let K of M.split(".")){if(!N||typeof N!=="object"||Array.isArray(N))return;N=N[K]}return N}async function vi(R,M){if(ki.has(M))return"permission";if(!R)return;for(let N of["permission","role","group"])if(await Ri(R,N,M))return N;return}async function Ri(R,M,N){if(hs(R,M,N))return!0;let te=M==="permission"?R.catalog?.permissions:M==="role"?R.catalog?.roles:R.catalog?.groups;if(!te)return!1;return await te.get(N)!==void 0}function hs(R,M,N){if(!R.code)return;if(M==="permission")return R.code.permissions.get(N);if(M==="role")return R.code.roles.get(N);return R.code.groups.get(N)}async function Ii(R,M,N){let K=hs(R,M,N),te=M==="permission"?R.catalog?.permissions:M==="role"?R.catalog?.roles:R.catalog?.groups,ve=((te?await te.get(N):void 0)?.resources??K?.resources??[]).map((Ae)=>Ae.trim()).filter(Boolean);return ve.length>0?ve:void 0}function Ai(R){if(!R||R.length===0)return{applyToApplication:!0};return{resources:R}}var wr="ion_dlg_",br=3600;function Ti(R){let M="";for(let N of R)M+=String.fromCharCode(N);return btoa(M).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/u,"")}function xi(){return`ion_dlg_${Ti(crypto.getRandomValues(new Uint8Array(32)))}`}async function ks(R){let M=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(R));return`sha256:${Array.from(new Uint8Array(M),(N)=>N.toString(16).padStart(2,"0")).join("")}`}function Sr(R,M="authorization"){let N=R.headers.get(M);if(!N)return;let K=M.toLowerCase()==="authorization"?N.match(/^Bearer\s+(.+)$/i)?.[1]:N;return K?.startsWith("ion_dlg_")?K:void 0}function Pi(R){let M=new WeakMap,N=new Map,K=new Set,te=async(Ie)=>{let Te=Sr(Ie,R.header);if(!Te)return;let ve=await R.delegateStore.getByTokenHash(await ks(Te));if(!ve||ve.active===!1)return;if(ve.expiresAt&&ve.expiresAt.getTime()<=Date.now())return;if(await R.accessIndex?.isSubjectDisabled?.(ve.id,"delegate"))return;if(await R.accessIndex?.isSubjectDisabled?.(ve.owner.id,ve.owner.type))return;let Ae={id:ve.id,owner:ve.owner,label:ve.label,clientId:ve.clientId,expiresAt:ve.expiresAt},be=ve.expiresAt??new Date(Date.now()+3600000),Ke;if(ve.owner.type==="user"){let He=await R.userStore?.get(ve.owner.id);if(He?.active===!1)return;if(He)Ke={...He,sso:He.sso??{profile:{sub:He.id,name:He.name,email:He.email},tenant:{id:He.tenantId??"",name:""},tokenType:"Bearer",expires:be},delegate:Ae}}else if(ve.owner.type==="customer"){let He=await R.customerStore?.get(ve.owner.id);if(He?.active===!1)return;if(He)Ke={...He,ciam:He.ciam??{profile:{sub:He.id,name:He.name,email:He.email},tokenType:"Bearer",expires:be},delegate:Ae}}else{let He=await R.workloadIdentityStore?.get(ve.owner.id);if(He?.active===!1)return;if(He)Ke={...He,id:He.id,workloadId:He.id,clientId:He.clientId,claims:{iss:"delegate",sub:He.id,exp:Math.floor(be.getTime()/1000),iat:Math.floor(Date.now()/1000)},delegate:Ae}}if(!Ke){let He=`${ve.owner.type}:${ve.owner.id}`;if(!K.has(He))K.add(He),R.log.warn("Delegate owner could not be resolved",{"ion.operation":"delegate.resolve","ion.outcome":"failure",delegateId:ve.id,ownerId:ve.owner.id,ownerType:ve.owner.type});return}let nt=Date.now(),dt=(R.lastUsedWindowSeconds??3600)*1000,at=N.get(ve.id)??ve.lastUsedAt?.getTime()??0;if(nt-at>=dt)N.set(ve.id,nt),R.delegateStore.touch(ve.id,new Date(nt)).catch((He)=>{R.log.warn("Delegate usage timestamp update failed",{"ion.operation":"delegate.touch","ion.outcome":"failure",delegateId:ve.id,error:He instanceof Error?He.message:String(He)})});return Ke};return{hasCredential:(Ie)=>Sr(Ie,R.header)!==void 0,resolve(Ie){let Te=M.get(Ie);if(Te)return Te;let ve=te(Ie);return M.set(Ie,ve),ve}}}var Ui="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",Ss=["user","customer","workload","delegate"],Ei={user:async(R,M)=>{let N=await M.sso?.getUser(R);return N?.delegate?void 0:N},customer:async(R,M)=>{let N=await M.ciam?.getCustomer(R);return N?.delegate?void 0:N},workload:async(R,M)=>{let N=await M.workload?.getWorkloadIdentity?.(R);if(!N)return;let K=N.clientId??N.workloadId??N.claims.sub;return K&&!N.delegate?{...N,id:K}:void 0},delegate:async(R,M)=>M.delegate.resolve(R)};function An(R){return{id:R.subjectId,delegate:R.subject.delegate}}function Di(R){if(R==="any")return Ss;let M=Array.isArray(R)?R:[R];return Ss.filter((N)=>M.includes(N))}function Mi(R){let M=R.headers.get("cookie");if(!M)return[];return M.split(";").map((N)=>N.slice(0,N.indexOf("=")===-1?N.length:N.indexOf("=")).trim()).filter(Boolean)}function Oi(R,M){let N=R.headers.get("authorization")?.match(/^Bearer\s+(.+)$/i)?.[1],K=N!==void 0&&!N.startsWith(wr),te=Mi(R),Ie=new Set;for(let ve of te){if(ve.startsWith("ion.sso"))Ie.add("user");if(ve.startsWith("ion.ciam"))Ie.add("customer")}let Te=te.length>0&&!Ie.has("user")&&!Ie.has("customer");return M.filter((ve)=>{if(ve==="workload")return K;if(ve==="delegate")return!1;if(te.length===0)return!1;return Ie.has(ve)||Te})}function wt(R){return typeof R==="string"?R:R.id}function _i(R){let{subject:M,subjectType:N}=R,K;if(N==="user")K=M.sso?.scope;else if(N==="customer")K=M.ciam?.scope;else if(N==="workload")K=M.scope;return new Set((K??"").split(/\s+/).filter(Boolean))}function vr(R,M,N){let K=_i(R),te=M.filter((Te)=>K.has(Te));return{allow:N==="any"?te.length>0:M.length>0&&te.length===M.length,metadata:{reason:"scope",wantedScopes:M,matchedScopes:te}}}function ws(R,M){if(R.targetType!==M.targetType||R.target!==M.id)return!1;return M.resource?R.resource===M.resource:R.resource===void 0}function Tn(R,M){return(N)=>{if(R.length===0)return;let K=N.derivedEntitlements??[];if(K.length===0)return;let te=R.filter((Te)=>K.some((ve)=>ws(ve,Te)));if(!(M==="any"?te.length>0:te.length===R.length))return;return K.filter((Te)=>te.some((ve)=>ws(Te,ve)))}}function Xn(R,M,N){return(K)=>{if(M.length===0||K.subjectType!=="workload")return;let te=ee(R.config?.authz,K.subject);if(!te)return;let Ie=M.filter((ve)=>te.has(ve));return(N==="any"?Ie.length>0:Ie.length===M.length)?Ie:void 0}}function Cr(R,M,N,K,te){return{allow:N==="ok",subject:M?.subject,subjectType:M?.subjectType,reason:N,decision:K,response(){if(N==="ok")return new Response(null,{status:204});if(N==="unauthenticated")return R.log.warn("authz.denied",{reason:N,...te()}),Response.json({error:"Unauthorized"},{status:401});if(N==="not_configured")return R.log.warn("authz.denied",{reason:N,subject:M?.subject?.id,subjectType:M?.subjectType,...te()}),Response.json({error:"not_configured"},{status:503});return R.log.warn("authz.denied",{reason:N,subject:M?.subject?.id,subjectType:M?.subjectType,...te()}),Response.json({error:"Forbidden"},{status:403})}}}function ji(R,M,N){return new Promise((K)=>{let te=[],Ie=R.length,Te=!1,ve=()=>{if(Ie-=1,Ie===0&&!Te)Te=!0,K({outcomes:te})};for(let Ae of R)M(Ae).then((be)=>{if(te.push({principal:Ae,decision:be}),!Te&&be.allow){Te=!0,K({matched:{principal:Ae,decision:be},outcomes:te});return}ve()},(be)=>{N?.(Ae,be),te.push({principal:Ae,decision:{allow:!1,metadata:{reason:"error"}}}),ve()})})}async function Qt(R,M,N,K,te,Ie,Te){e(M,Ui);let ve=Di(N),Ae=M.delegate.hasCredential(R)?ve.filter((lt)=>lt==="delegate"):Oi(R,ve),Ke=(await Promise.all(Ae.map(async(lt)=>{let Ne=await Ei[lt](R,M);if(!Ne?.id)return;let ft=Ne.delegate?"delegate":lt,St=Ne.delegate?.id??Ne.id,bt=lt==="workload"?Ne.derivedEntitlements:lt==="user"||lt==="customer"?kr(R,lt):void 0;return{subject:Ne,subjectType:ft,subjectId:St,derivedEntitlements:bt}}))).filter((lt)=>lt!==void 0);if(Ke.length===0)return Cr(M,void 0,"unauthenticated",void 0,te);let nt=async(lt)=>{let Ne=M.authz.accessIndex;if(!Ne?.isSubjectDisabled)return!1;return Ne.isSubjectDisabled(lt.subjectId,lt.subjectType)},dt=async(lt)=>{if(Te){let Ne=Te(lt);if(Ne&&Ne.length>0){if(await nt(lt))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"trusted-client",matchedPermissions:Ne}}}}if(Ie){let Ne=Ie(lt);if(Ne&&Ne.length>0){if(await nt(lt))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"claims",matchedIds:Ne.map((ft)=>ft.target),matchedClaims:[...new Set(Ne.map((ft)=>ft.claim))],roots:[...new Set(Ne.map((ft)=>ft.root).filter((ft)=>Boolean(ft)))]}}}}return K(lt)},{matched:at,outcomes:He}=await ji(Ke,dt,(lt,Ne)=>{M.log.warn("authz.check_error",{"ion.operation":"authz.check","ion.outcome":"error",subject:lt.subjectId,subjectType:lt.subjectType,error:Ne instanceof Error?Ne.message:String(Ne),...te()})});if(at){if(at.principal.subjectType==="delegate"&&at.principal.subject.delegate)M.log.info("authz.delegate_honor",{"ion.operation":"authz.delegate_honor","ion.outcome":"allow",delegateId:at.principal.subject.delegate.id,ownerId:at.principal.subject.delegate.owner.id,ownerType:at.principal.subject.delegate.owner.type,...te()});if(at.decision.metadata?.reason==="claims")M.log.info("authz.claims_honor",{"ion.operation":"authz.claims_honor","ion.outcome":"allow",subject:at.principal.subjectId,subjectType:at.principal.subjectType,matchedIds:at.decision.metadata.matchedIds,matchedClaims:at.decision.metadata.matchedClaims,roots:at.decision.metadata.roots,...te()});return Cr(M,at.principal,"ok",at.decision,te)}let Qe=He.length>0&&He.every((lt)=>{let Ne=lt.decision.metadata?.reason;return Ne==="access_index_not_configured"||Ne==="error"}),ot=He[0],ct=Qe?"not_configured":"forbidden";return Cr(M,ot?.principal,ct,ot?.decision,te)}async function Ni(R,M,N,K,te,Ie="any"){return Qt(R,M,Ie,(Te)=>M.authz.has(An(Te),N,K,te,Te.subjectType),()=>({targetType:N,target:wt(K),resource:te?wt(te):void 0}),Tn([{targetType:N,id:wt(K),resource:te?wt(te):void 0}],"any"),N==="permission"&&!te?Xn(M,[wt(K)],"any"):void 0)}async function Li(R,M,N,K,te="any"){return Qt(R,M,te,(Ie)=>M.authz.hasPermission(An(Ie),N,K,Ie.subjectType),()=>({targetType:"permission",target:wt(N),resource:K?wt(K):void 0}),Tn([{targetType:"permission",id:wt(N),resource:K?wt(K):void 0}],"any"),K?void 0:Xn(M,[wt(N)],"any"))}async function $i(R,M,N,K,te="any"){return Qt(R,M,te,(Ie)=>M.authz.hasRole(An(Ie),N,K,Ie.subjectType),()=>({targetType:"role",target:wt(N),resource:K?wt(K):void 0}),Tn([{targetType:"role",id:wt(N),resource:K?wt(K):void 0}],"any"))}async function Wi(R,M,N,K,te="any"){return Qt(R,M,te,(Ie)=>M.authz.hasGroup(An(Ie),N,K,Ie.subjectType),()=>({targetType:"group",target:wt(N),resource:K?wt(K):void 0}),Tn([{targetType:"group",id:wt(N),resource:K?wt(K):void 0}],"any"))}async function Vi(R,M,N,K="any"){let te=N.map((Te)=>({targetType:Te.targetType,id:wt(Te.target),resource:Te.resource?wt(Te.resource):void 0})),Ie=N.filter((Te)=>!Te.resource&&Te.targetType==="permission").map((Te)=>wt(Te.target));return Qt(R,M,K,(Te)=>M.authz.hasAny(An(Te),N,Te.subjectType),()=>({targets:N.map((Te)=>`${Te.targetType}:${wt(Te.target)}`)}),te.length>0?Tn(te,"any"):void 0,Ie.length>0?Xn(M,Ie,"any"):void 0)}async function qi(R,M,N,K="any"){let te=N.map((ve)=>({targetType:ve.targetType,id:wt(ve.target),resource:ve.resource?wt(ve.resource):void 0})),Ie=N.length>0&&N.every((ve)=>!ve.resource&&ve.targetType==="permission"),Te=N.map((ve)=>wt(ve.target));return Qt(R,M,K,(ve)=>M.authz.hasAll(An(ve),N,ve.subjectType),()=>({targets:N.map((ve)=>`${ve.targetType}:${wt(ve.target)}`)}),te.length>0?Tn(te,"all"):void 0,Ie?Xn(M,Te,"all"):void 0)}async function zi(R,M,N,K="any"){return Qt(R,M,K,(te)=>Promise.resolve(vr(te,[N],"any")),()=>({scope:N}))}async function Bi(R,M,N,K="any"){return Qt(R,M,K,(te)=>Promise.resolve(vr(te,N,"any")),()=>({scopes:N}))}async function Gi(R,M,N,K="any"){return Qt(R,M,K,(te)=>Promise.resolve(vr(te,N,"all")),()=>({scopes:N}))}function Tt(R){return typeof R==="string"&&R.length>0?R:void 0}function bs(R){let M=Tt(R.email);return{sub:String(R.sub??""),email:M,name:Tt(R.name),userName:Tt(R.preferred_username)??M,avatar:Tt(R.picture)}}var Cs={oidc:{flow:"id_token",scope:"openid profile email",branding:{displayName:"Single sign-on"},mapClaims:bs},google:{flow:"id_token",authorizationUrl:"https://accounts.google.com/o/oauth2/v2/auth",tokenUrl:"https://oauth2.googleapis.com/token",jwksUri:"https://www.googleapis.com/oauth2/v3/certs",scope:"openid email profile",branding:{displayName:"Google",iconUrl:"https://www.gstatic.com/firebasejs/ui/2.0.0/images/auth/google.svg",colors:{light:"#ffffff",dark:"#131314",secondary:"#4285F4"},url:"https://accounts.google.com"},mapClaims:bs},microsoft:{flow:"id_token",authority:"https://login.microsoftonline.com/common/v2.0",authorizationUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",tokenUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/token",jwksUri:"https://login.microsoftonline.com/common/discovery/v2.0/keys",scope:"openid email profile",branding:{displayName:"Microsoft",colors:{light:"#ffffff",dark:"#2f2f2f",secondary:"#0067b8"},url:"https://login.microsoftonline.com"},mapClaims:(R)=>{let M=Tt(R.email)??Tt(R.preferred_username);return{sub:String(R.sub??R.oid??""),email:M,name:Tt(R.name),userName:Tt(R.preferred_username)??M,avatar:Tt(R.picture)}}},apple:{flow:"id_token",authorizationUrl:"https://appleid.apple.com/auth/authorize",tokenUrl:"https://appleid.apple.com/auth/token",jwksUri:"https://appleid.apple.com/auth/keys",scope:"openid email name",extraAuthParams:{response_mode:"form_post"},branding:{displayName:"Apple",colors:{light:"#000000",dark:"#ffffff"},url:"https://appleid.apple.com"},mapClaims:(R)=>{let M=Tt(R.email);return{sub:String(R.sub??""),email:M,name:Tt(R.name),userName:M}}},github:{flow:"userinfo",authorizationUrl:"https://github.com/login/oauth/authorize",tokenUrl:"https://github.com/login/oauth/access_token",userInfoUrl:"https://api.github.com/user",scope:"read:user user:email",branding:{displayName:"GitHub",colors:{light:"#24292f",dark:"#ffffff"},url:"https://github.com"},mapClaims:(R)=>({sub:String(R.id??R.node_id??""),email:Tt(R.email),name:Tt(R.name)??Tt(R.login),userName:Tt(R.login),avatar:Tt(R.avatar_url)})}};function Rr(R){if(R==="magic-link")return;return Cs[R]}function Zn(R,M){if(M.type==="magic-link")return;let N=Rr(M.type);if(!N)return;return{name:R,type:M.type,flow:N.flow,authority:M.authority??N.authority,authorizationUrl:M.authorizationUrl??N.authorizationUrl,tokenUrl:M.tokenUrl??N.tokenUrl,jwksUri:M.jwksUri??N.jwksUri,userInfoUrl:M.userInfoUrl??N.userInfoUrl,scope:M.scope??N.scope,clientId:M.clientId,clientSecret:M.clientSecret,extraAuthParams:N.extraAuthParams,branding:{...N.branding,...M.branding},mapClaims:N.mapClaims,config:M}}function Ir(R){return{...Rr(R.type)?.branding??{displayName:R.type},...R.branding}}function Ar(R){if(!R)return[];return Object.entries(R).filter(([,M])=>M.enabled!==!1).map(([M,N],K)=>({name:M,config:N,index:K})).sort((M,N)=>{let K=M.config.order??Number.MAX_SAFE_INTEGER,te=N.config.order??Number.MAX_SAFE_INTEGER;if(K!==te)return K-te;return M.index-N.index}).map(({name:M,config:N})=>({name:M,config:N}))}var Qn=(R)=>("sso"in R)?R:void 0,er=(R)=>("ciam"in R)?R:void 0,Ki=(R)=>("claims"in R)?R:void 0;async function jn(R,M,N){try{let K=await R.resolve(M),te=K?N(K):void 0;return te?{status:"authenticated",value:te}:{status:"unauthenticated"}}catch(K){return{status:"degraded",error:K instanceof Error?K:Error(String(K))}}}var Hi=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;function tr(R){if(R===void 0)return;let M=R.trim().toLowerCase();if(!Hi.test(M))throw Error(`Invalid cookiesDomain "${R}": expected a hostname such as "app.example.com" without a scheme, port, path, or leading dot.`);return M}function sn(R){return R?` Domain=${R};`:""}var vs=4000;function Ji(R){return`Expires=${R.toUTCString()}`}function Rs(R){return`Path=${R.path};${sn(R.domain)}${R.secure?" Secure;":""} SameSite=${R.sameSite};`}function Pr(R,M,N,K){if(M.length>vs)throw Error(`Display cookie ${R} value is ${M.length} bytes; the limit is ${vs}.`);return`${R}=${M}; ${Ji(N)}; ${Rs(K)}`}function en(R,M){return`${R}=; Max-Age=0; ${Rs(M)}`}function Tr(R){if(!R)return;let M=R instanceof Date?R:new Date(R);return Number.isNaN(M.getTime())?void 0:M}function xr(R){return!R||R.getTime()>Date.now()}async function Fi(R,M,N){let K=R.envelope.kind??"session";if(K==="discovered"){let ve=Tr(R.envelope.expiresAt);return{...R,kind:K,live:Boolean(ve&&xr(ve))}}let te=M[`${R.prefix}.session`];if(!te)return{...R,kind:K,live:!1};let Ie=await N.get(te);if(!Ie||Ie.authType!=="sso"&&Ie.authType!=="ciam")return{...R,kind:K,live:!1};let Te=Tr(Ie.expiresAt);return{...R,kind:K,live:xr(Te),...Te?{sessionExpiresAt:Te}:{}}}function xn(R,M,N){let K=O(M);return R?.includes(`${K}=`)?[en(K,N)]:[]}function Is(R,M,N,K,te){let Ie=[...R.filter((Ke)=>Ke.kind==="session").slice(0,N),...R.filter((Ke)=>Ke.kind==="discovered").slice(0,K)],Te=te?te(R,{max:N,maxDiscovered:K}):Ie,ve=[...Te.filter((Ke)=>Ke.kind==="session").slice(0,N),...Te.filter((Ke)=>Ke.kind==="discovered").slice(0,K)];if(ve.some((Ke)=>Ke.name===M))return ve;let Ae=R.find((Ke)=>Ke.name===M);if(!Ae)return ve;return[...[Ae,...ve.filter((Ke)=>Ke.kind==="session")].slice(0,N),...ve.filter((Ke)=>Ke.kind==="discovered")]}async function Nn(R){let M=O(R.cookiesPrefix),N=R.attr;if(R.displayCookie?.enabled!==!0)return xn(R.cookieHeader,R.cookiesPrefix,N);if(!R.sessionStore)return[];let K=g(R.user,R.projector),te={v:G,...R.tenantId?{tenantId:R.tenantId}:{},authType:R.authType,expiresAt:R.expiresAt.toISOString(),user:K},Ie={name:M,prefix:R.cookiesPrefix,envelope:te,kind:"session",sessionExpiresAt:R.expiresAt,live:!0},Te=ue(R.cookieHeader),ve=R.sessionStore,Ae=await Promise.all(J(R.cookieHeader).filter((ot)=>ot.name!==M).map((ot)=>Fi(ot,Te,ve))),be=[Ie,...Ae.filter((ot)=>ot.live&&ot.kind==="session")].sort((ot,ct)=>_(ot.sessionExpiresAt?.toISOString()??ot.envelope.expiresAt,ct.sessionExpiresAt?.toISOString()??ct.envelope.expiresAt)),Ke=R.displayCookie.discovered?.enabled===!0?Ae.filter((ot)=>ot.live&&ot.kind==="discovered"&&(!R.tenantId||ot.envelope.tenantId!==R.tenantId)).sort((ot,ct)=>_(ot.envelope.expiresAt,ct.envelope.expiresAt)):[],nt=[...be,...Ke],dt=ae(R.displayCookie?.max),at=H(R.displayCookie.discovered?.max),He=new Set(Is(nt,M,dt,at,R.trim).map((ot)=>ot.name)),Qe=[Pr(M,F(te),R.expiresAt,N)];for(let ot of Ae)if(!He.has(ot.name))Qe.push(en(ot.name,N));return Qe}function Yi(R){let M=ue(R.cookieHeader),N=Object.keys(M).filter((Qe)=>Qe.startsWith(`${ie}.`)&&Qe.endsWith(".profile"));if(!(R.displayCookie?.enabled===!0&&R.displayCookie.discovered?.enabled===!0))return N.map((Qe)=>en(Qe,R.attr));let te=R.now??new Date,Ie=ce(R.displayCookie?.discovered?.ttlSeconds),Te=new Date(te.getTime()+Ie*1000),ve=H(R.displayCookie?.discovered?.max),Ae=J(R.cookieHeader),be=new Set(Ae.filter((Qe)=>(Qe.envelope.kind??"session")==="session").flatMap((Qe)=>Qe.envelope.tenantId?[Qe.envelope.tenantId]:[])),Ke=new Map;for(let Qe of Ae){if(Qe.envelope.kind!=="discovered"||!Qe.envelope.tenantId)continue;let ot=Tr(Qe.envelope.expiresAt);if(ot&&xr(ot)&&!be.has(Qe.envelope.tenantId))Ke.set(Qe.envelope.tenantId,Qe.envelope)}let nt=g(R.user,R.projector);for(let Qe of R.tenants){let ot=Qe.tenantId.trim();if(!ot||be.has(ot))continue;Ke.set(ot,{v:G,kind:"discovered",tenantId:ot,authType:R.authType,expiresAt:Te.toISOString(),user:nt,...Qe.tenantName?{tenantName:Qe.tenantName}:{}})}let dt=[...Ke.values()].sort((Qe,ot)=>_(Qe.expiresAt,ot.expiresAt)).slice(0,ve),at=new Set(dt.map((Qe)=>Y(Qe.tenantId??""))),He=dt.map((Qe)=>Pr(Y(Qe.tenantId??""),F(Qe),new Date(Qe.expiresAt),R.attr));for(let Qe of N)if(!at.has(Qe))He.push(en(Qe,R.attr));return He}var Or=60000,Ts=86400000,xs=600000,Er=256,Et=new Map;function Xi(R){if(typeof R?.ttlMs==="number"&&Number.isFinite(R.ttlMs))xs=Math.min(Math.max(R.ttlMs,Or),Ts);if(typeof R?.maxEntries==="number"&&Number.isFinite(R.maxEntries)){Er=Math.max(1,Math.floor(R.maxEntries));while(Et.size>Er){let M=Et.keys().next().value;if(M===void 0)break;Et.delete(M)}}}function As(R,M){Et.delete(R),Et.set(R,M);while(Et.size>Er){let N=Et.keys().next().value;if(N===void 0)break;Et.delete(N)}}var Ln=new Map,Dr=()=>Date.now();function Zi(R){Dr=R??(()=>Date.now())}var Mr={};function Qi(R){Mr=R??{}}function eo(R){if(!R)return;if(/\bno-store\b/i.test(R))return Or;let M=/max-age\s*=\s*(\d+)/i.exec(R);if(!M)return;let N=Number(M[1]);return Number.isFinite(N)?N*1000:void 0}function to(R){let N=eo(R)??xs;return Math.min(Math.max(N,Or),Ts)}async function _r(R,M=3,N=1000,K=30000,te){let Ie=Error("Placeholder Error");for(let Te=0;Te<=M;Te++)try{return await R()}catch(ve){if(Ie=ve instanceof Error?ve:Error(String(ve)),ve instanceof Error&&ve.message.includes("400"))throw ve;if(Te===M)throw Ie;let Ae=Math.min(N*2**Te,K),be=Math.random()*0.1*Ae;await new Promise((Ke)=>setTimeout(Ke,Ae+be)),te?.warn(`Retry attempt ${Te+1} after ${Ae+be}ms delay`)}throw Ie}async function $n(R,M,N){let K=Et.get(R);if(!N?.forceRefresh&&K&&K.expiresAt>Dr())return As(R,K),K.jwks;let te=Ln.get(R);if(te)return te;let Ie=(async()=>{try{return await _r(async()=>{let Te=await fetch(R,{headers:l});if(!Te.ok){let be=await Z(Te);throw M?.warn("JWKS endpoint returned an error",{"ion.operation":"jwks.fetch","ion.outcome":"degraded",reason:"upstream_error",status:Te.status,contentType:be.contentType,excerpt:be.excerpt}),Error(`Failed to fetch JWKS (${Te.status})`)}let ve=await d(Te,{log:M,operation:"jwks.fetch"}),Ae=to(Te.headers.get("cache-control"));return As(R,{jwks:ve,expiresAt:Dr()+Ae,importedKeys:new Map}),ve},Mr.maxRetries,Mr.baseDelayMs,void 0,M)}catch(Te){let ve=Et.get(R);if(ve)return M?.warn("JWKS refresh failed; serving last-known-good keys",{"ion.operation":"jwks.refresh","ion.outcome":"degraded"}),ve.jwks;throw Te}finally{Ln.delete(R)}})();return Ln.set(R,Ie),Ie}function no(R){if(R){Et.delete(R),Ln.delete(R);return}Et.clear(),Ln.clear()}async function ro(R,M,N){return(await Ps(R,M,N)).jwk}async function Ps(R,M,N){if(!M?.trim())throw Error("JWT header missing kid");await $n(R,N);let K=Et.get(R),te=K?.jwks.keys.find((Ie)=>Ie.kid===M);if(!te)await $n(R,N,{forceRefresh:!0}),K=Et.get(R),te=K?.jwks.keys.find((Ie)=>Ie.kid===M);if(!K||!te)throw Error("Public key not found");return{jwk:te,entry:K}}async function jr(R,M,N,K,te){let{jwk:Ie,entry:Te}=await Ps(R,M,te),ve=`${M}\x00${N}`,Ae=Te.importedKeys.get(ve);if(Ae)return Ae;let be=K(Ie);return be.catch(()=>{if(Te.importedKeys.get(ve)===be)Te.importedKeys.delete(ve)}),Te.importedKeys.set(ve,be),be}async function so(R,M){let N=R.keys.find((K)=>K.kid===M);if(!N)throw Error("Public key not found");return Us(N)}function Us(R){return crypto.subtle.importKey("jwk",{kty:R.kty,n:R.n,e:R.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}async function io(R,M,N){return jr(R,M,"rs256",Us,N)}var Ur={RS256:{kty:"RSA",importParams:{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},verifyParams:{name:"RSASSA-PKCS1-v1_5"}},ES256:{kty:"EC",crv:"P-256",importParams:{name:"ECDSA",namedCurve:"P-256"},verifyParams:{name:"ECDSA",hash:"SHA-256"}}};async function Nr(R,M,N,K){if(typeof N!=="string"||!(N in Ur))throw Error(`Unsupported JWT alg "${String(N)}" (allowed: ${Object.keys(Ur).join(", ")})`);let te=Ur[N];return{key:await jr(R,M,`oidc:${N}`,(Te)=>{if(Te.kty!==te.kty)throw Error(`JWK type "${Te.kty}" does not match token alg "${N}"`);if(te.kty==="EC"){let ve=Te;if(ve.crv!==te.crv)throw Error(`JWK curve "${String(ve.crv)}" does not match token alg "${N}"`);return crypto.subtle.importKey("jwk",{kty:"EC",crv:ve.crv,x:ve.x,y:ve.y},te.importParams,!1,["verify"])}return crypto.subtle.importKey("jwk",{kty:Te.kty,n:Te.n,e:Te.e},te.importParams,!1,["verify"])},K),algorithm:te.verifyParams}}function zt(R=32){let M=new Uint8Array(R);return crypto.getRandomValues(M),Array.from(M,(N)=>N.toString(16).padStart(2,"0")).join("").substring(0,R)}function nr(R){let M="";return R.forEach((N)=>{M+=String.fromCharCode(N)}),btoa(M).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Ms(R){let M=R.replace(/-/g,"+").replace(/_/g,"/"),N=M.padEnd(M.length+(4-M.length%4)%4,"="),K=atob(N),te=new Uint8Array(K.length);for(let Ie=0;Ie<K.length;Ie++)te[Ie]=K.charCodeAt(Ie);return te}function Es(R){let M=new TextDecoder().decode(Ms(R));return JSON.parse(M)}async function Vn(R){let M=new TextEncoder().encode(R),N=await crypto.subtle.digest("SHA-256",M);return nr(new Uint8Array(N))}function Wr(R){let M=new URL(R.authorizationUrl);if(M.searchParams.set("client_id",R.clientId),M.searchParams.set("redirect_uri",R.redirectUri),M.searchParams.set("response_type","code"),M.searchParams.set("scope",R.scope),M.searchParams.set("state",R.state),R.codeChallenge)M.searchParams.set("code_challenge",R.codeChallenge),M.searchParams.set("code_challenge_method","S256");if(R.nonce)M.searchParams.set("nonce",R.nonce);for(let[N,K]of Object.entries(R.extraParams??{}))M.searchParams.set(N,K);return M.toString()}async function Vr(R){let M=new URLSearchParams;if(M.append("grant_type","authorization_code"),M.append("code",R.code),M.append("redirect_uri",R.redirectUri),M.append("client_id",R.clientId),R.clientSecret)M.append("client_secret",R.clientSecret);if(R.codeVerifier)M.append("code_verifier",R.codeVerifier);let N=await fetch(R.tokenUrl,{method:"POST",headers:{...w,...l},body:M.toString()}),K=await d(N,{log:R.log,operation:"oidc.token.exchange"});if(!N.ok){let te=K,Ie=te.error==="invalid_client"&&!R.clientSecret;throw R.log?.error(Ie?"OIDC authorization-code exchange failed: no client_secret was configured; the provider may require a confidential client":"OIDC authorization-code exchange failed",{"ion.operation":"token.exchange","ion.outcome":"failure","http.status_code":N.status,oidc_error:te.error,...Ie?{client_auth:"none"}:{}}),Error(`Token exchange failed: ${te.error||N.statusText} - ${te.error_description||""}`.trim())}if(typeof K.access_token!=="string")throw Error("Token exchange response missing access_token");return K}var Os=60;function hn(R){return R.trim().replace(/\/$/,"")}var Lr="9188040d-6c67-4c5b-b112-36a304b66dad",oo=new Set(["common","organizations","consumers"]),ao=/^https:\/\/login\.microsoftonline\.com\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/v2\.0$/i;function qr(R){let M=/^https:\/\/login\.microsoftonline\.com\/([^/]+)(?:\/v2\.0)?$/i.exec(hn(R));return M?oo.has(M[1].toLowerCase()):!1}function rr(R){let M=ao.exec(hn(R));return M?M[1].toLowerCase():void 0}function _s(R){let M=rr(R.iss);if(!M)return!1;if(R.tid!==void 0){if(typeof R.tid!=="string"||R.tid.toLowerCase()!==M)return!1}let N=R.allowedTenants??"any";if(N==="any")return!0;if(N==="consumers")return M===Lr;if(!Array.isArray(N)||N.length===0)return!1;return N.some((K)=>{let te=K.trim().toLowerCase();if(te==="consumers")return M===Lr;return te===M})}function js(R){let{claims:M,audience:N}=R,K=hn(R.issuer),te=R.nowSec??Math.floor(Date.now()/1000),Ie=R.clockSkewSec??Os,Te=M.iss;if(typeof Te!=="string")throw Error("ID token issuer mismatch");let ve=R.issuerPolicy??{mode:"exact"};if(!(hn(Te)===K||ve.mode==="microsoft-tenant"&&_s({iss:Te,tid:M.tid,allowedTenants:ve.allowedTenants})))throw Error("ID token issuer mismatch");let be=M.aud,Ke=Array.isArray(be)?be.includes(N):typeof be==="string"&&be===N,nt=typeof M.azp==="string"&&M.azp===N;if(!Ke&&!nt)throw Error("ID token audience mismatch");if(typeof M.exp!=="number")throw Error("ID token missing exp");if(M.exp<te-Ie)throw Error("ID token expired");if(R.expectedNonce!==void 0){if(M.nonce!==R.expectedNonce)throw Error("ID token nonce mismatch")}}async function Ns(R,M,N){let K=R.split(".");if(K.length!==3)throw Error("Invalid JWT");let te=Es(K[0]),Ie=Es(K[1]),Te=Ms(K[2]),{key:ve,algorithm:Ae}=await Nr(M,te.kid,te.alg,N),be=new TextEncoder().encode(`${K[0]}.${K[1]}`);if(!await crypto.subtle.verify(Ae,ve,Te,be))throw Error("Invalid JWT signature");return{header:te,payload:Ie}}async function on(R){let{payload:M}=await Ns(R.idToken,R.jwksUri,R.log);return js({claims:M,issuer:R.issuer,issuerPolicy:R.issuerPolicy,audience:R.audience,clockSkewSec:R.clockSkewSec,expectedNonce:R.expectedNonce}),M}var co="http://schemas.openid.net/event/backchannel-logout";async function zr(R){let{payload:M}=await Ns(R.logoutToken,R.jwksUri,R.log),N=hn(R.issuer),K=M.iss;if(typeof K!=="string"||hn(K)!==N)throw Error("Logout token issuer mismatch");let te=M.aud,Ie=Array.isArray(te)?te.includes(R.audience):typeof te==="string"&&te===R.audience,Te=typeof M.azp==="string"&&M.azp===R.audience;if(!Ie&&!Te)throw Error("Logout token audience mismatch");if(M.nonce!=null)throw Error("Logout token must not contain a nonce");let ve=M.events;if(!(typeof ve==="object"&&ve!==null&&!Array.isArray(ve)&&Object.hasOwn(ve,co)))throw Error("Logout token missing back-channel logout event");let be=typeof M.sid==="string"&&M.sid.length>0,Ke=typeof M.sub==="string"&&M.sub.length>0;if(!be&&!Ke)throw Error("Logout token missing sid and sub");if(typeof M.exp==="number"){let nt=Math.floor(Date.now()/1000),dt=R.clockSkewSec??Os;if(M.exp<nt-dt)throw Error("Logout token expired")}return M}var uo=3600000,lo=60000,po=86400000,mo=256,tn=new Map,Wn=new Map;function Ds(R,M){tn.delete(R),tn.set(R,M);while(tn.size>mo){let N=tn.keys().next().value;if(N===void 0)break;tn.delete(N)}}var $r=()=>Date.now();function fo(R){$r=R??(()=>Date.now())}function go(R){if(R){tn.delete(R),Wn.delete(R);return}tn.clear(),Wn.clear()}function yo(R){let M=R?/max-age\s*=\s*(\d+)/i.exec(R):null,N=M?Number(M[1]):Number.NaN,K=Number.isFinite(N)?N*1000:uo;return Math.min(Math.max(K,lo),po)}async function sr(R){let M=tn.get(R);if(M&&M.expiresAt>$r())return Ds(R,M),M.endpoints;let N=Wn.get(R);if(N)return N;let K=(async()=>{try{let te=R.replace(/\/$/,""),Ie=await fetch(`${te}/.well-known/openid-configuration`,{headers:l});if(!Ie.ok)throw Error(`OIDC discovery failed for ${R} with status ${Ie.status}`);let Te=await d(Ie),ve={authorizationUrl:typeof Te.authorization_endpoint==="string"?Te.authorization_endpoint:void 0,tokenUrl:typeof Te.token_endpoint==="string"?Te.token_endpoint:void 0,jwksUri:typeof Te.jwks_uri==="string"?Te.jwks_uri:void 0,userInfoUrl:typeof Te.userinfo_endpoint==="string"?Te.userinfo_endpoint:void 0};return Ds(R,{endpoints:ve,expiresAt:$r()+yo(Ie.headers.get("cache-control"))}),ve}catch(te){let Ie=tn.get(R);if(Ie)return Ie.endpoints;throw te}finally{Wn.delete(R)}})();return Wn.set(R,K),K}async function Br(R,M){let N=await fetch(R,{headers:{Authorization:`Bearer ${M}`,...l,"User-Agent":"ionite-ciam"}});if(!N.ok)throw Error(`UserInfo request failed with status ${N.status}`);return await d(N)}function ho(R){let M=R.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,""),N=atob(M),K=new Uint8Array(N.length);for(let te=0;te<N.length;te++)K[te]=N.charCodeAt(te);return K}async function Gr(R){let M=Math.floor(Date.now()/1000),N={alg:"ES256",kid:R.keyId,typ:"JWT"},K={iss:R.teamId,iat:M,exp:M+(R.expiresInSeconds??3600),aud:"https://appleid.apple.com",sub:R.clientId},te=nr(new TextEncoder().encode(JSON.stringify(N))),Ie=nr(new TextEncoder().encode(JSON.stringify(K))),Te=`${te}.${Ie}`,ve=await crypto.subtle.importKey("pkcs8",ho(R.privateKey),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),Ae=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},ve,new TextEncoder().encode(Te));return`${Te}.${nr(new Uint8Array(Ae))}`}function ko(R){for(let M=0;M<R.length;M++){let N=R.charCodeAt(M);if(N<=31||N===127)return!0}return!1}function So(R,M){let N=null;try{N=new URL(R,M)}catch{N=null}let K="";try{K=new URL(M).origin}catch{K=""}return{candidate:R,url:N,requestOrigin:K}}function Ls(R,M,N){let K=So(R,N),te=!1;for(let Ie of M){let Te=Ie(K);if(Te==="deny")return!1;if(Te==="allow")te=!0}return te}function $s(){return({candidate:R,url:M})=>{if(ko(R))return"deny";if(R.includes("\\"))return"deny";if(R.startsWith("//"))return"deny";if(!M)return"deny";if(M.protocol!=="http:"&&M.protocol!=="https:")return"deny";if(M.username||M.password)return"deny";return"abstain"}}function Ws(){return({candidate:R})=>R.startsWith("/")&&!R.startsWith("//")&&!R.startsWith("/\\")?"allow":"abstain"}function Vs(){return({url:R,requestOrigin:M})=>R&&M&&R.origin===M?"allow":"abstain"}function wo(...R){let M=new Set(R.map((N)=>{try{return new URL(N).origin}catch{return N}}));return({url:N})=>N&&M.has(N.origin)?"allow":"abstain"}function bo(...R){let M=R.map((N)=>N.toLowerCase());return({url:N})=>{if(!N)return"abstain";let K=N.hostname.toLowerCase();for(let te of M)if(te.startsWith(".")){if(K===te.slice(1)||K.endsWith(te))return"allow"}else if(K===te)return"allow";return"abstain"}}function Kr(){return[$s(),Ws(),Vs()]}function qs(R,M,N){if(!R)return!1;return Ls(R,M,N)}function Hr(R,M){if(!R)return M.fallback;return Ls(R,M.rules,M.requestUrl)?R:M.fallback}var Co={rules:Kr(),fallback:"/"};function vo(R,M,N="redirect"){let K=new URL(R.url).searchParams.get(N)??void 0;return qs(K,M.rules,R.url)?{redirect:K}:void 0}function Ro(R,M){let N=R.context;return Hr(N?.redirect,{rules:M.rules,fallback:M.fallback,requestUrl:R.request.url})}function an(R,M,N){if(R instanceof Response)return{response:R};if(typeof R==="string")return{location:Hr(R,{rules:Kr(),fallback:M,requestUrl:N})};return{location:M}}function kn(R,M){if(M.length===0)return R;let N=new Headers(R.headers);for(let K of M)N.append("Set-Cookie",K);return new Response(R.body,{status:R.status,statusText:R.statusText,headers:N})}var ir="ciam",Io="id_token",Ao="access_token";function To(R,M,N,K,te,Ie){if(!N&&!K)return;let Te=new WeakMap,ve={...N,...K},Ae={...ve,magicLinkTtl:ve.magicLinkTtl??3600,sessionTtl:ve.sessionTtl??86400,cookiesSecure:ve.cookiesSecure!==void 0?ve.cookiesSecure:!0,cookiesSameSite:ve.cookiesSameSite!==void 0?ve.cookiesSameSite:"Strict",cookiesPrefix:ve.cookiesPrefix??(ve.ciamId?`ion.ciam.${ve.ciamId}`:"ion.ciam"),cookiesPath:ve.cookiesPath??"/",cookiesDomain:tr(ve.cookiesDomain)};function be(){if(!Ae.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and first-party logout.");return Ae.sessionStore}function Ke(){be()}let nt=R.callbackParams??m(ge("ionite.ciam")),dt=R.idTokenClaims??m(T("ionite.ciam")),at=R.tokenResponse??m(ye("ionite.ciam"));function He(re=32){let Re=new Uint8Array(re);return crypto.getRandomValues(Re),Array.from(Re,(De)=>De.toString(16).padStart(2,"0")).join("").substring(0,re)}function Qe(re,Re,De,Ue=Ae.cookiesSameSite??"Strict"){if(!Ae)throw Error("ionite CIAM Manager not initialized");if(re=`${Ae.cookiesPrefix}.${re}`,typeof Re!=="string")Re=btoa(JSON.stringify(Re));let Me;if(De instanceof Date)Me=`Expires=${De.toUTCString()}`;else if(typeof De==="number")Me=`Max-Age=${De}`;else throw Error("Invalid expires type",De);if(Re.length>4000)throw Error(`Error setting cookie: ${re}. Cookie length is: ${Re.length}`);return`${re}=${Re}; ${Me}; Path=${Ae.cookiesPath};${sn(Ae.cookiesDomain)} HttpOnly;${Ae.cookiesSecure?" Secure;":""} SameSite=${Ue};`}function ot(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");return`${Ae.cookiesPrefix}.${re}=; Max-Age=0; Path=${Ae.cookiesPath};${sn(Ae.cookiesDomain)} HttpOnly;${Ae.cookiesSecure?" Secure;":""} SameSite=${Ae.cookiesSameSite};`}function ct(re,Re,De=!1){if(!Ae)throw Error("ionite CIAM Manager not initialized");let Ue=Re.headers.get("cookie");if(!Ue)return null;let Me=`${Ae.cookiesPrefix}.${re}`,$e=Ue.split(";").find((Ve)=>Ve.trim().startsWith(`${Me}=`));if(!$e)return null;let We=$e.indexOf("="),ze=$e.substring(We+1).trim();if(!De)return ze;try{let Ve=atob(ze);return JSON.parse(Ve)}catch(Ve){return M.error("[CIAM] Failed to parse cookie",{"ion.operation":"cookie.parse","ion.outcome":"failure",cookieName:Me},Ve),null}}function lt(re){return`cstate_${re}`}async function Ne(re,Re,De,Ue){let Me=await Ae.afterLogin?.({...Re,request:re,context:De,displayCookie:Ae.displayCookie,displayCookieAttributes:St()}),$e=an(Me,"/",re.url);if($e.response)return kn($e.response,Ue.map(([,We])=>We));return new Response(Re.ok?"Authentication successful, redirecting":"Authentication failed, redirecting",{status:302,headers:[["Location",$e.location],...Ue]})}function ft(re,Re){return["Set-Cookie",Qe("session",re,Re)]}function St(){return{path:Ae.cookiesPath??"/",domain:Ae.cookiesDomain,secure:Ae.cookiesSecure!==!1,sameSite:Ae.cookiesSameSite??"Strict"}}function bt(){return[["Set-Cookie",ot("session")],["Set-Cookie",en(`${Ae.cookiesPrefix}.profile`,St())]]}function Ut(re){if(Ae.displayCookie?.enabled===!0)return[];return xn(re.headers.get("cookie"),Ae.cookiesPrefix??"ion.ciam",St()).map((Re)=>["Set-Cookie",Re])}async function Ft(re,Re,De){return(await Nn({cookieHeader:re.headers.get("cookie"),sessionStore:Ae.sessionStore,cookiesPrefix:Ae.cookiesPrefix??"ion.ciam",authType:"ciam",tenantId:Ae.tenantId,expiresAt:De,user:Re,projector:Ae.displayUser,displayCookie:Ae.displayCookie,trim:Ae.trimDisplayCookies,attr:St()})).map((Me)=>["Set-Cookie",Me])}function Yt(re){if(!re)return;if(re instanceof Date)return re;let Re=new Date(re);return Number.isNaN(Re.getTime())?void 0:Re}async function En(re){let Re=ct("session",re);if(!Re)return;let De=await be().get(Re);if(De&&Ae.tenantId&&De.tenantId&&De.tenantId!==Ae.tenantId)return;if(De?.authType!=="ciam")return;let Ue=Yt(De.expiresAt);if(Ue&&Date.now()>Ue.getTime()){await be().delete(Re);return}return De}async function Cn(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");Ke();let Re=Te.get(re);if(Re)return Re;let De=pn(re);return Te.set(re,De),De}async function pn(re){try{let Re=await En(re);if(!Re?.claims?.sub)return{status:"unauthenticated"};return _n(re,"customer",Re.entitlements),{status:"authenticated",value:Lt(Re.claims)}}catch(Re){return M.error("CIAM session resolution failed",{"ion.operation":"ciam.session","ion.outcome":"degraded"},Re),{status:"degraded",error:Re instanceof Error?Re:void 0}}}async function nn(re){let Re=await Cn(re);return Re.status==="authenticated"?Re.value:void 0}async function Mt(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");Ke();let Re;try{Re=await nn(re)}catch{Re=void 0}let De=await Ae.beforeLogout?.({request:re,user:Re});try{let rt=ct("session",re);if(rt)await be().delete(rt)}catch(rt){M.warn("Failed to delete CIAM session",{"ion.operation":"session.delete","ion.outcome":"degraded"},rt)}let Ue=bt(),Me=await Ae.afterLogout?.({request:re,context:De}),$e=an(Me,"/",re.url);if($e.response)return kn($e.response,Ue.map(([,rt])=>rt));let We=$e.location??"/",ze=re.headers.get("accept");if(ze?.includes(a)||ze?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:We}),{status:200,headers:[["Content-Type",a],...Ue]});return new Response("Logged out",{status:302,headers:[["Location",We],...Ue]})}function mn(re){return re.id||re.email||`ciam-${re.userName}`}function fn(re,Re,De){return{sub:mn(re),iss:ir,aud:ir,typ:Io,exp:Math.floor(De.getTime()/1000),iat:Math.floor(Date.now()/1000),email:re.email,name:re.name,preferred_username:re.userName,picture:re.avatar,sid:Re}}function vn(re,Re,De){return{sub:re,iss:ir,aud:ir,typ:Ao,exp:Math.floor(De.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:Re,scope:"openid profile email"}}function Lt(re){let Re=re.exp?new Date(re.exp*1000):new Date;return{id:re.sub,userName:re.preferred_username??"",name:re.name??"",email:re.email??"",avatar:re.picture,userType:"customer",ciam:{profile:re,scope:"openid profile email",tokenType:"Bearer",expires:Re}}}async function Dn(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");if(!te)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:i});let Re=await te.getWorkloadIdentity(re);if(!Re||Re.delegate)return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:i});let De,Ue;try{if(!re.headers.get("content-type")?.includes(a))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:i});let Be=await re.text(),Le=JSON.parse(Be);Ue=typeof Le?.redirect==="string"&&Le.redirect.length>0?Le.redirect:void 0;let qe={userName:Le.userName,name:Le.name,email:Le.email,avatar:Le.avatar},Ye=await R.customer.validate(qe);if(Ye.issues)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:i});De=Ye.value}catch(Ee){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:i})}let $e=new URL(re.url).searchParams.get("ttl"),We=$e?parseInt($e,10):Ae.magicLinkTtl??3600;if(Number.isNaN(We)||We<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:i});let ze=He(32),Ve=new Date(Date.now()+We*1000);if(!Ae.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:501,headers:i});try{await Ae.magicLinkStore.create(ze,De,Ve)}catch(Ee){return M.error("Error creating magic link",{"ion.operation":"magic_link.create","ion.outcome":"failure"},Ee),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:i})}let rt=new URL(re.url),ut=Ae.magicLinkLoginUrl||"/magic-link/login",Oe=new URL(ut,rt.origin);if(Oe.searchParams.set("token",ze),Ue)Oe.searchParams.set("redirect",Ue);return new Response(JSON.stringify({magicLink:Oe.toString(),expiresAt:Ve.toISOString()}),{status:200,headers:i})}async function Rn(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");Ke();let De=new URL(re.url).searchParams.get("token");if(!De)return Ne(re,{ok:!1,error:Error("Missing magic-link token")},void 0,[]);if(!Ae.magicLinkStore)return Ne(re,{ok:!1,error:Error("Magic link store not configured")},void 0,[]);let Ue=await Ae.magicLinkStore.getAndDelete(De);if(!Ue)return Ne(re,{ok:!1,error:Error("Magic link invalid, expired, or already used")},void 0,[]);let Me=new Date(Date.now()+(Ae.sessionTtl??86400)*1000),$e=He(32),We=mn(Ue.customer),ze=fn(Ue.customer,$e,Me),Ve=vn(We,$e,Me),rt=Lt(ze),ut;try{let Ee={sid:$e,sub:We,authType:"ciam",tenantId:Ae.tenantId,expiresAt:Me,claims:ze,accessClaims:Ve,createdAt:new Date};await be().create(Ee),ut=Ee}catch(Ee){throw M.warn("Failed to create session",{"ion.operation":"session.create","ion.outcome":"degraded"},Ee),Ee}if(Ae.customerStore)try{let Ee=rt.id;if(Ee){let Be=new Date,Le=await Ae.customerStore.get(Ee);if(Le||Ae.enableJitUserProvisioning){let qe={...Le??{},...rt,id:Ee,tenantId:Le?.tenantId,createdAt:Le?.createdAt??Be,updatedAt:Be,userType:Le?.userType??"customer"};await Ae.customerStore.upsert(qe)}}}catch(Ee){M.warn("Failed to store customer",{"ion.operation":"customer.store","ion.outcome":"degraded"},Ee)}let Oe=[ft($e,Me),...await Ft(re,rt,Me)];return Ne(re,{ok:!0,user:rt,session:ut},void 0,Oe)}function Gt(re,Re=200,De=[]){return new Response(JSON.stringify(re),{status:Re,headers:[["Content-Type",a],...De]})}function $t(re,Re){try{return new URL(re).toString()}catch{let De=new URL(Re).origin,Ue=Ae.cookiesSecure?De.replace(/^http:\/\//,"https://"):De;return new URL(re,Ue).toString()}}function gn(){let re=Ae.customerLoginUrl||"/auth/customer/login",Re=re.includes("?")?"&":"?";return Ar(Ae.providers).map(({name:De,config:Ue})=>{let Me=Ir(Ue);return{name:De,type:Ue.type,displayName:Me.displayName,loginUrl:`${re}${Re}provider=${encodeURIComponent(De)}`,iconUrl:Me.iconUrl,colors:Me.colors,url:Me.url}})}async function Xt(re){if(!re)return{};let{authorizationUrl:Re,tokenUrl:De,jwksUri:Ue,userInfoUrl:Me}=re,$e=re.authority;if($e&&(!Re||!De||re.flow==="id_token"&&!Ue))try{let ze=await sr($e);Re=Re??ze.authorizationUrl,De=De??ze.tokenUrl,Ue=Ue??ze.jwksUri,Me=Me??ze.userInfoUrl}catch(ze){M.error("CIAM provider OIDC discovery failed",{"ion.operation":"ciam.oidc.discovery","ion.outcome":"failure"},ze)}return{authorizationUrl:Re,tokenUrl:De,jwksUri:Ue,userInfoUrl:Me}}function Wt(re,Re){if(re.type!=="microsoft"||!qr(Re))return{mode:"exact"};return{mode:"microsoft-tenant",allowedTenants:re.config.allowedTenants??"any"}}async function Dt(re,Re){let De=In(re),Ue=typeof De?.iss==="string"?De.iss:void 0,Me=Ue?rr(Ue):void 0;if(!Me)return Re;try{let $e=await sr(`https://login.microsoftonline.com/${Me}/v2.0`);if($e.jwksUri)return $e.jwksUri}catch($e){M.warn("CIAM tenant-scoped OIDC discovery failed; falling back to configured JWKS",{"ion.operation":"ciam.oidc.discovery","ion.outcome":"failure"},$e)}return Re}async function Ot(re){if(re.type==="apple"){let{teamId:Re,keyId:De,privateKey:Ue,clientId:Me}=re.config;if(Re&&De&&Ue&&Me)return Gr({teamId:Re,keyId:De,privateKey:Ue,clientId:Me})}return re.clientSecret}async function Zt(re){be();let De=new URL(re.url).searchParams.get("provider");if(!De)return Gt({error:"Missing required query parameter: provider"},400);let Ue=Ae.providers?.[De];if(!Ue||Ue.enabled===!1||Ue.type==="magic-link")return Gt({error:`Unknown or disabled CIAM provider: ${De}`},404);let Me=Zn(De,Ue);if(!Me?.clientId)return Gt({error:`CIAM provider ${De} is not fully configured`},500);let $e=await Xt(Me);if(!$e.authorizationUrl)return Gt({error:`CIAM provider ${De} is missing an authorization endpoint`},500);let We=Ae.customerCallbackUrl||"/auth/customer/callback",ze=$t(We,re.url),Ve=zt(),rt=zt(64),ut=zt(),Oe=Me.flow==="id_token",Ee=Oe?await Vn(rt):void 0,Be=await Ae.beforeLogin?.({request:re}),Le=Wr({authorizationUrl:$e.authorizationUrl,clientId:Me.clientId,redirectUri:ze,scope:Me.scope,state:Ve,codeChallenge:Ee,nonce:ut,extraParams:Me.extraAuthParams}),qe={provider:De,state:Ve,codeVerifier:Oe?rt:void 0,nonce:ut,redirectUri:ze,...Be===void 0?{}:{context:Be}};return new Response("Redirecting to CIAM provider",{status:302,headers:[["Location",Le],["Set-Cookie",Qe(lt(Ve),qe,Ae.loginStateTtl??600,"Lax")]]})}async function Kt(re){if(re.method==="POST"){if((re.headers.get("content-type")??"").includes(L)){let De=await re.text();return Object.fromEntries(new URLSearchParams(De).entries())}}return Object.fromEntries(new URL(re.url).searchParams.entries())}let _t=!1;async function rn(re,Re,De,Ue){let Me=re.config.claimsAsEntitlements;if(!Me?.claims?.length||re.type==="magic-link")return;if(Ae.sessionStore?.capabilities?.derivedEntitlements!==!0){if(!_t)_t=!0,M.warn("CIAM claims entitlements are configured but the session store does not persist them",{"ion.event":"ion.ciam.claims.incapable","ion.module":"ciam","ion.outcome":"degraded"});return}return On({block:Me,claims:Re,accessClaims:In(Ue),subjectType:"customer",subjectId:De,catalog:Ie?.catalogView?.(),log:M})}async function yn(re,Re,De){let Ue=re.mapClaims(Re);if(!Ue.sub)return{ok:!1};let Me=`${re.name}:${Ue.sub}`,$e={id:Me,userName:Ue.userName||Ue.email||Me,name:Ue.name||"",email:Ue.email||"",avatar:Ue.avatar,userType:"customer"},We=Me;if(Ae.customerStore){let Ee=await Ae.customerStore.lookup($e)??await Ae.customerStore.get(Me);if(We=Ee?.id??Me,!Ee&&!Ae.enableJitUserProvisioning)return M.warn("CIAM JIT customer provisioning disabled: unknown customer rejected",{"ion.operation":"customer.store","ion.outcome":"skipped"}),{ok:!1};let Be=new Date,Le={...Ee??{},...$e,id:We,tenantId:Ee?.tenantId,createdAt:Ee?.createdAt??Be,updatedAt:Be,userType:Ee?.userType??"customer"};await Ae.customerStore.upsert(Le)}let ze=new Date(Date.now()+(Ae.sessionTtl??86400)*1000),Ve=zt(32),rt={sub:We,iss:re.name,aud:re.clientId,exp:Math.floor(ze.getTime()/1000),iat:Math.floor(Date.now()/1000),email:Ue.email,name:Ue.name,preferred_username:Ue.userName??Ue.email,picture:Ue.avatar,sid:Ve},ut={sid:Ve,sub:We,authType:"ciam",tenantId:Ae.tenantId,expiresAt:ze,claims:rt,accessClaims:{sub:We,sid:Ve,scope:re.scope},entitlements:await rn(re,Re,We,De),createdAt:new Date},Oe=be();try{await Oe.create(ut)}catch(Ee){if(!await Oe.get(Ve))throw Ee;await Oe.update(Ve,ut)}return{ok:!0,claims:rt,sid:Ve,expires:ze}}async function Je(re){be();let Re,De,Ue=(Me)=>{let $e=Re?[["Set-Cookie",ot(Re)]]:[];return Ne(re,{ok:!1,error:Me},De,$e)};try{let Me=await Kt(re),$e=await nt.validate(Me);if($e.issues||!$e.value)return Ue(Error("Invalid CIAM callback parameters"));let{code:We,state:ze}=$e.value;if(!ze)return Ue(Error("Missing CIAM callback state"));Re=lt(ze);let Ve=ct(Re,re,!0);if(De=Ve?.context,!Ve?.provider||!Ve.state||Ve.state!==ze)return M.warn("CIAM callback state verification failed",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),Ue(Error("CIAM callback state verification failed"));let rt=Ae.providers?.[Ve.provider];if(!rt)return Ue(Error("Unknown CIAM provider"));let ut=Zn(Ve.provider,rt);if(!ut?.clientId)return Ue(Error("CIAM provider not configured"));let Oe=await Xt(ut);if(!Oe.tokenUrl)return Ue(Error("CIAM provider missing token endpoint"));let Ee=await Ot(ut),Be=await Vr({tokenUrl:Oe.tokenUrl,clientId:ut.clientId,clientSecret:Ee,redirectUri:Ve.redirectUri||$t(Ae.customerCallbackUrl||"/auth/customer/callback",re.url),code:We,codeVerifier:ut.flow==="id_token"?Ve.codeVerifier:void 0,log:M}),Le;if(ut.flow==="id_token"){let it=ut.authority;if(!Be.id_token||!Oe.jwksUri||!it)return Ue(Error("CIAM id_token flow misconfigured"));if(!Ve.nonce)return Ue(Error("CIAM callback state cookie missing nonce"));if((await at.validate(Be)).issues)return M.warn("CIAM token response validation failed",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),Ue(Error("CIAM token response validation failed"));let Ze=Wt(ut,it),et=Ze.mode==="microsoft-tenant"?await Dt(Be.id_token,Oe.jwksUri):Oe.jwksUri;Le=await on({idToken:Be.id_token,jwksUri:et,issuer:it,issuerPolicy:Ze,audience:ut.clientId,expectedNonce:Ve.nonce,log:M});let mt=await dt.validate(Le);if(!mt.issues)Le=mt.value}else{if(!Oe.userInfoUrl)return Ue(Error("CIAM provider missing userinfo endpoint"));Le=await Br(Oe.userInfoUrl,Be.access_token);let it=ut.authority;if(Be.id_token&&Oe.jwksUri&&it){let st=Wt(ut,it),Ze=st.mode==="microsoft-tenant"?await Dt(Be.id_token,Oe.jwksUri):Oe.jwksUri,et=await on({idToken:Be.id_token,jwksUri:Ze,issuer:it,issuerPolicy:st,audience:ut.clientId,expectedNonce:Ve.nonce||void 0,log:M}),mt=typeof et.sub==="string"?et.sub:"";if(mt){if(typeof Le.sub==="string"&&Le.sub.length>0&&Le.sub!==mt)return M.warn("CIAM UserInfo sub does not match verified id_token sub",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),Ue(Error("CIAM UserInfo sub mismatch"));Le.sub=mt}}if(typeof Le.sub!=="string"||Le.sub.length===0)return M.warn("CIAM UserInfo response missing sub",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),Ue(Error("CIAM UserInfo response missing sub"))}let qe=await yn(ut,Le,Be.access_token);if(!qe.ok)return Ue(Error("Failed to persist CIAM customer"));let Ye=Lt(qe.claims);M.info("CIAM third-party sign-in succeeded",{"ion.operation":"ciam.oidc.callback","ion.outcome":"success",provider:ut.name});let tt=[["Set-Cookie",ot(Re)],ft(qe.sid,qe.expires),...await Ft(re,Ye,qe.expires)];return Ne(re,{ok:!0,user:Ye,session:void 0},De,tt)}catch(Me){return M.error("Error during CIAM third-party sign-in callback",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"},Me),Ue(Me)}}async function xe(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");Ke();let Re=Ae.magicLinkUrl||"/magic-link",De=Ae.magicLinkLoginUrl||"/magic-link/login",Ue=Ae.logoutUrl||"/auth/customer/logout",Me=Ae.customerLoginUrl||"/auth/customer/login",$e=Ae.customerCallbackUrl||"/auth/customer/callback",We=Ae.customerProvidersUrl||"/auth/customer/providers",ze=new URL(re.url).pathname,Ve=(qe)=>{if(!qe)return;try{return new URL(qe).pathname}catch{return qe.startsWith("/")?qe:`/${qe}`}};if(Ve(Re)===ze&&re.method==="POST")return Dn(re);if(Ve(De)===ze&&re.method==="GET")return Rn(re);if(Ve(Ue)===ze&&re.method==="GET")return Mt(re);if(Ve(We)===ze&&re.method==="GET")return Gt({providers:gn()});if(Ve(Me)===ze&&re.method==="GET")return Zt(re);if(Ve($e)===ze&&(re.method==="GET"||re.method==="POST"))return Je(re);return new Response("Not Found",{status:404})}async function Pe(re){if((Ae.userEndpoint??"full")==="off")return new Response("Not Found",{status:404,headers:Ut(re)});let Re=await Cn(re);if(Re.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:i});if(Re.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:i});let De=Yt(Re.value.ciam?.expires),Ue=Ae.displayCookie?.enabled===!0?De&&!ct("profile",re)?await Ft(re,Re.value,De):[]:Ut(re),Me=Ae.userEndpoint==="display"?g(Re.value,Ae.displayUser):Re.value;return new Response(JSON.stringify(Me),{headers:[["Content-Type",a],...Ue]})}let _e;return _e={...Ae,describe:()=>({module:"ciam",active:!0,ready:_e.isReady?.()??!0,magicLinkTtl:Ae.magicLinkTtl,loginStateTtl:Ae.loginStateTtl,sessionTtl:Ae.sessionTtl,cookies:{prefix:Ae.cookiesPrefix,path:Ae.cookiesPath,secure:Ae.cookiesSecure,sameSite:Ae.cookiesSameSite,domain:Ae.cookiesDomain},displayCookie:Ae.displayCookie,jit:{enabled:Ae.enableJitUserProvisioning===!0,customerStore:Ae.customerStore!==void 0},sessionStore:Ae.sessionStore!==void 0,magicLinkStore:Ae.magicLinkStore!==void 0,providers:Object.entries(Ae.providers??{}).map(([re,Re])=>({name:re,type:Re.type,enabled:Re.enabled!==!1,order:Re.order,branding:Re.branding,authority:Re.authority,authorizationUrl:Re.authorizationUrl,tokenUrl:Re.tokenUrl,jwksUri:Re.jwksUri,userInfoUrl:Re.userInfoUrl,clientId:Re.clientId,scope:Re.scope,...Re.claimsAsEntitlements?.claims?.length?{claimsAsEntitlements:{claims:[...Re.claimsAsEntitlements.claims],expand:Re.claimsAsEntitlements.expand===!0,resources:Re.claimsAsEntitlements.expand===!0&&Re.claimsAsEntitlements.resources===!0,capable:Ae.sessionStore?.capabilities?.derivedEntitlements===!0}}:{},loginUrl:`${Ae.customerLoginUrl??""}?provider=${encodeURIComponent(re)}`})),urls:{magicLinkUrl:Ae.magicLinkUrl??"",magicLinkLoginUrl:Ae.magicLinkLoginUrl??"",customerUrl:Ae.customerUrl??"",customerLoginUrl:Ae.customerLoginUrl??"",customerCallbackUrl:Ae.customerCallbackUrl??"",customerProvidersUrl:Ae.customerProvidersUrl??"",logoutUrl:Ae.logoutUrl??""}}),getCustomer:nn,resolveCustomer:Cn,logout:Mt,handler:xe,customerHandler:Pe,listCustomerProviders:gn},_e}async function xo(R,M){if(e(M,"Ionite instance is required. Create one with ionite(source, config) and pass it to this function."),M.delegate.hasCredential(R)){let N=await M.delegate.resolve(R);return N&&er(N)}return M.ciam?.getCustomer(R)}async function or(R,M){if(e(M,"Ionite instance is required. Create one with ionite(source, config) and pass it to this function."),M.delegate.hasCredential(R))return jn(M.delegate,R,er);return await M.ciam?.resolveCustomer(R)??{status:"unauthenticated"}}var Po="urn:ietf:params:scim:schemas:core:2.0:User",zs="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",Uo="urn:ietf:params:scim:schemas:core:2.0:Group";function Jr(R,M,N){let te=(M==="group"?R.resources:void 0)?.map((Ie)=>typeof Ie==="string"?Ie:Ie.id).filter(Boolean);return{schemas:[Uo,t],id:R.id,externalId:R.providerId,displayName:R.displayName??R.name,members:N,[t]:{type:M,requestable:R.requestable,riskLevel:R.riskLevel??y,providerId:R.providerId,requestUrl:R.requestUrl,source:R.source,deprecated:R.deprecated,description:R.description,resources:te&&te.length>0?te:void 0,assignableSubjectTypes:R.assignableSubjectTypes,recommendedSubjectTypes:R.recommendedSubjectTypes,attributes:c(R,p)}}}function Eo(R){if(R.scimName)return R.scimName;if(!R.name)return;let[M,...N]=R.name.split(" ");return{givenName:M,familyName:N.join(" ")||void 0}}function Do(R){let M={attributes:c(R,x)};if(R.ecid!==void 0)M.ecid=R.ecid;if(R.accountClass!==void 0)M.accountClass=R.accountClass;return M.ecid!==void 0||M.accountClass!==void 0||M.attributes!==void 0?M:void 0}function Mo(R){return Object.keys(R.scimSchemaExtensions??{}).filter((M)=>M.startsWith("urn:")&&R.scimSchemaExtensions?.[M]!==void 0)}function Fr(R){let M=R.userName||R.email||R.id||"",N=R.emails??(R.email?[{value:R.email,primary:!0}]:[]),K=new Set([Po]);if(R.scimEnterprise!==void 0)K.add(zs);let te=Do(R);if(te!==void 0)K.add(o);for(let Te of Mo(R))K.add(Te);let Ie={};if(R.scimEnterprise!==void 0)Ie[zs]=R.scimEnterprise;if(te!==void 0)Ie[o]=te;for(let[Te,ve]of Object.entries(R.scimSchemaExtensions??{}))if(Te.startsWith("urn:")&&Te!==o&&ve!==void 0)Ie[Te]=ve;return{schemas:Array.from(K),id:R.id,externalId:R.externalId,userName:M,displayName:R.displayName??R.name??M,name:Eo(R),nickName:R.nickName,profileUrl:R.avatar,title:R.title,userType:R.userType,preferredLanguage:R.preferredLanguage,locale:R.locale,timezone:R.timezone,active:R.active??!0,emails:N,phoneNumbers:R.phoneNumbers,ims:R.ims,photos:R.photos,addresses:R.addresses,groups:R.groups,entitlements:R.entitlements,roles:R.roles,x509Certificates:R.x509Certificates,meta:{resourceType:"User",created:(R.createdAt??R.updatedAt??new Date).toISOString(),lastModified:(R.updatedAt??R.createdAt??new Date).toISOString()},...Ie}}function Yr(R){return{schemas:[S],id:R.id,externalId:R.externalId,userName:R.clientId??R.id,displayName:R.displayName??R.clientId??R.id,description:R.description,active:R.active??!0,ecid:R.ecid,providerId:R.providerId,requestUrl:R.requestUrl,attributes:c(R,P),meta:{resourceType:"Workload",created:(R.createdAt??R.updatedAt??new Date).toISOString(),lastModified:(R.updatedAt??R.createdAt??new Date).toISOString()}}}function Xr(R){return{schemas:[k],id:R.id,externalId:R.externalId??R.id,userName:R.userName??R.email??R.id,displayName:R.displayName??R.name??R.userName??R.id,active:R.active??!0,emails:R.emails??(R.email?[{value:R.email,primary:!0}]:void 0),providerId:R.providerId,requestUrl:R.requestUrl,attributes:c(R,E),meta:{resourceType:"Customer",created:(R.createdAt??R.updatedAt??new Date).toISOString(),lastModified:(R.updatedAt??R.createdAt??new Date).toISOString()}}}function Bs(R){return{value:R.id,type:R.type==="user"?"User":R.type==="customer"?"Customer":"Workload"}}function Zr(R){return{schemas:[b],id:R.id,externalId:R.externalId??R.id,userName:R.id,displayName:R.label??R.clientId??R.id,active:R.active??!0,owner:Bs(R.owner),clientId:R.clientId,expiresAt:R.expiresAt?.toISOString(),lastUsedAt:R.lastUsedAt?.toISOString(),providerId:R.providerId,requestUrl:R.requestUrl,meta:{resourceType:"Delegate",created:(R.createdAt??R.updatedAt??new Date).toISOString(),lastModified:(R.updatedAt??R.createdAt??new Date).toISOString()}}}function cn(R){return{enabled:R?.enabled!==!1,assignment:R?.assignment??"app",delta:R?.delta}}var Oo="urn:ietf:params:scim:api:messages:2.0:ListResponse",ss="urn:ietf:params:scim:api:messages:2.0:Error",is="urn:ietf:params:scim:schemas:core:2.0:User",Kn="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",os="urn:ietf:params:scim:schemas:core:2.0:Group",_o="urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",qn="urn:ietf:params:scim:schemas:core:2.0:ResourceType",un="urn:ietf:params:scim:schemas:core:2.0:Schema",jo="00000000000000000000000000000000";function No(R){let M={timestamp:new Date().toISOString()};if(R)M.actor=R;try{let te=globalThis[Symbol.for("opentelemetry.js.api.1")]?.trace?.getActiveSpan?.()?.spanContext?.(),Ie=te?.traceId;if(Ie&&Ie!==jo){if(M.traceId=Ie,te?.spanId)M.spanId=te.spanId}}catch{}return M}class dr extends n{constructor(R){super(R,{status:409,statusText:"subject_type_not_assignable"});this.name="SubjectTypeNotAssignableError"}}async function Qs(R,M,N,K){let te=N.subjectType;if(!h.includes(te))throw new dr(`Cannot grant ${N.targetType} "${r(N.target)}" to a "${te}" principal: only [${h.join(", ")}] principals are assignable on this platform.`);let Ie=B(M,R);if(!Ie&&!K)return;let Te=r(N.target),ve;if(K)ve=await K.getNode(N.targetType,Te);else if(Ie)ve=await(N.targetType==="group"?Ie.groups:N.targetType==="role"?Ie.roles:Ie.permissions).get(Te);if(!ve)return;let Ae=ve.assignableSubjectTypes;if(!Ae||Ae.length===0||!Ae.includes(te))throw new dr(`Cannot grant ${N.targetType} "${Te}" to a "${te}" principal: this entitlement restricts assignment to [${(Ae??[]).join(", ")||"none"}].`)}async function Lo(R,M){let N=W(R.codeCatalog,r(M.target));if(!N)return;if(N.kind!==M.targetType)throw Error(`Cannot grant ${M.targetType} "${N.entity.id}": code declares that id as ${N.kind}.`);if(!R.catalogStore)throw Error(`Cannot grant code entitlement "${N.entity.id}": no AccessCatalogStore is wired for materialization.`);await z(N.kind,N.entity,V(R.catalogStore,N.kind))}async function $o(R,M,N,K){await Lo(R,M),await Qs(R.catalogStore,R.codeCatalog,M,K);let te={...M,status:M.status??"active",provenance:M.provenance??No()};if(te.id=f(te),await R.accessStore?.grant(te),R.accessIndex&&(R.catalogStore||R.codeCatalog)){let Ie=await D(te,{catalog:R.catalogStore,code:R.codeCatalog,resources:R.resources,cache:K});await R.accessIndex.materialize(te.id,Ie)}return N?.push({op:"add",change:te}),te}async function Bn(R,M,N){let K=M.id??f(M);await R.accessStore?.revoke(M),await R.accessIndex?.removeByRoot(K),N?.push({op:"delete",change:{...M,id:K}})}async function cr(R,M){let N=await Wo(R,M),K=await qo(R,M);return{oaa:N,delta:K}}async function Wo(R,M){if(M.length===0||!R.authz.oaa.isReady())return{status:"skipped"};return ln(R,"authz.oaa.push","OAA incremental access push failed after SCIM mutation; full sync will reconcile",()=>R.authz.oaa.pushAccessChanges(M),{count:M.length})}async function ln(R,M,N,K,te){try{return await K(),{status:"ok"}}catch(Ie){return R.log?.warn(N,{"ion.operation":M,"ion.outcome":"degraded",...te,error:Jt(Ie)}),{status:"degraded",reason:Jt(Ie)}}}var Vo=6;async function qo(R,M){let N=R.iamDelta;if(!N?.isReady()||M.length===0)return{status:"skipped"};let K=new Map;for(let Ae of M){let be=`${Ae.change.subjectType}:${r(Ae.change.subject)}\x00${Ae.change.targetType}:${r(Ae.change.target)}`;K.set(be,Ae)}let te=[...K.values()],Ie=te.map(({op:Ae,change:be})=>()=>Ae==="add"?N.onGrant(be):N.onRevoke(be)),ve=(await zo(Ie,Vo)).filter((Ae)=>Ae.status==="rejected");if(ve.length>0)return R.log?.warn("IAM delta egress degraded after SCIM mutation; IAM server reconcile/aggregation will recover",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",failed:ve.length,total:te.length,error:Jt(ve[0]?.reason)}),{status:"degraded",reason:Jt(ve[0]?.reason)};return{status:"ok"}}async function zo(R,M){let N=Array(R.length),K=0,te=async()=>{while(!0){let Te=K++;if(Te>=R.length)return;let ve=R[Te];if(!ve)continue;try{N[Te]={status:"fulfilled",value:await ve()}}catch(Ae){N[Te]={status:"rejected",reason:Ae}}}},Ie=Array.from({length:Math.min(M,R.length)},te);return await Promise.all(Ie),N}class us extends n{constructor(R){super(R,{status:409,statusText:"derived_access"});this.name="DerivedRevokeError"}}class Hn extends n{constructor(R,M,N=!1){super(R,{status:N?409:500});this.name="ScimMutationError";this.summary=M,this.clientError=N}}function Fe(R,M,N){return new Response(JSON.stringify({schemas:[ss],status:String(R),scimType:N,detail:M}),{status:R,headers:A})}function Ht(R,M){let N=M?.totalResults??R.length,K=M?.startIndex??1,te=M?.itemsPerPage??R.length;return new Response(JSON.stringify({schemas:[Oo],totalResults:N,startIndex:K,itemsPerPage:te,Resources:R}),{status:200,headers:A})}function xt(R,M=200,N){let K=new Headers(A);if(N)K.set("Location",N);return new Response(JSON.stringify(R),{status:M,headers:K})}function Gs(R){return Fe(R.clientError?409:500,`${R.message}; authz mutation summary: ${JSON.stringify(R.summary)}`,R.clientError?"mutability":"invalidValue")}function Gn(R){return f(R)}function Qr(R,M){return ur(Ks(R),Ks(M))}function Ks(R){let M=new Map;if(!R?.id)return M;for(let N of R.groups??[]){let K={subject:R.id,subjectType:"user",targetType:"group",target:N.value,metadata:N.display||N.type?{display:N.display,type:N.type}:void 0};M.set(Gn(K),K)}for(let N of R.roles??[]){let K={subject:R.id,subjectType:"user",targetType:"role",target:N.value,metadata:N.display||N.type?{display:N.display,type:N.type,primary:N.primary}:void 0};M.set(Gn(K),K)}for(let N of R.entitlements??[]){let K={subject:R.id,subjectType:"user",targetType:"permission",target:N.value,metadata:N.display||N.type?{display:N.display,type:N.type,primary:N.primary}:void 0};M.set(Gn(K),K)}return M}class ds extends n{constructor(R){super(R,{status:400,statusText:"ambiguous_member"});this.name="AmbiguousMemberSubjectTypeError"}}function Bo(R,M,N){if(R.type==="Group")return;if(R.type==="Workload")return"workload";if(R.type==="User")return"user";if(R.type==="Customer")return"customer";if(R.type==="Delegate")return"delegate";let K=M??[];if(K.length===1)return K[0];throw new ds(`SCIM Group member "${R.value}" of entitlement "${N}" omits type, and the entitlement is assignable to more than one principal kind [${K.join(", ")||"none"}]. Set members[].type to User, Workload, Customer, or Delegate.`)}function ar(R,M,N,K,te){let Ie=new Map,Te=K&&K.length>0?K:void 0;for(let ve of R??[]){let Ae=Bo(ve,te,N);if(!Ae)continue;let be={subject:ve.value,subjectType:Ae,targetType:M,target:N,resources:Te,metadata:ve.display||ve.type?{display:ve.display,type:ve.type}:void 0};Ie.set(Gn(be),be)}return Ie}function Hs(R){let M=R[t]?.resources;return M&&M.length>0?M:void 0}function Go(R,M){let N=(te,Ie)=>[...te??[]].sort().join(",")===[...Ie??[]].sort().join(","),K=R[t];if(K?.type!==void 0&&K.type!==M.kind)return!0;if(K?.requestable!==void 0&&K.requestable!==M.entity.requestable)return!0;if(K?.resources!==void 0&&!N(K.resources,as(M.entity)))return!0;if(K?.assignableSubjectTypes!==void 0&&!N(K.assignableSubjectTypes,M.entity.assignableSubjectTypes))return!0;if(K?.recommendedSubjectTypes!==void 0&&!N(K.recommendedSubjectTypes,M.entity.recommendedSubjectTypes))return!0;return!1}function Ko(R,M){let N=(Ie,Te)=>[...Ie??[]].sort().join(",")===[...Te??[]].sort().join(","),K=R[t],te=M[t];if(K?.type!==void 0&&K.type!==te?.type)return!0;if(K?.requestable!==void 0&&K.requestable!==te?.requestable)return!0;if(K?.resources!==void 0&&!N(K.resources,te?.resources))return!0;if(K?.assignableSubjectTypes!==void 0&&!N(K.assignableSubjectTypes,te?.assignableSubjectTypes))return!0;if(K?.recommendedSubjectTypes!==void 0&&!N(K.recommendedSubjectTypes,te?.recommendedSubjectTypes))return!0;return!1}function Ho(R){let M=new Map;for(let N of R)M.set(Gn(N),N);return M}async function wn(R,M,N,K,te,Ie){let Te=[],ve=new Set,Ae=(Ke,nt)=>`${nt}\x00${Ke}`,be=Ie?Ie.get(`${N}:${K}`)??[]:M?(await M.listByTarget(N,K)).items:[];for(let Ke of be){let nt=r(Ke.subject),dt=Ke.metadata,at=Ke.subjectType==="workload"?"Workload":Ke.subjectType==="customer"?"Customer":Ke.subjectType==="delegate"?"Delegate":dt?.type??"User",He=Ae(nt,at);if(ve.has(He))continue;ve.add(He),Te.push({value:nt,...dt?.display?{display:dt.display}:{},type:at})}for(let Ke of te??[]){if(Ke.targetType!==N||r(Ke.target)!==K)continue;let nt=r(Ke.subject),dt=Ae(nt,"Workload");if(ve.has(dt))continue;ve.add(dt),Te.push({value:nt,type:"Workload"})}if(N==="group"){let Ke=await R.groups.get(K);for(let nt of Ke?.groups??[]){let dt=r(nt),at=Ae(dt,"Group");if(!dt||ve.has(at))continue;ve.add(at),Te.push({value:dt,type:"Group"})}}return Te.length>0?Te:void 0}function ur(R,M){let N=[];for(let[K,te]of M)if(!R.has(K))N.push({action:"grant",change:te});for(let[K,te]of R)if(!M.has(K))N.push({action:"revoke",change:te});return N}async function es(R,M){if(R.oaa.isReady())await R.oaa.pushUser(M)}async function Js(R,M,N){if(M?.externalId&&M.externalId!==N.externalId)await R?.onUserDelete(M.externalId);await R?.onUserUpsert(N)}async function Pn(R,M,N,K){let te={metadataApplied:!1,access:[]},Ie={status:"skipped"},Te=[],ve=new oe(R.catalogStore,R.resources,R.codeCatalog);try{try{await M(),te.metadataApplied=!0}catch(Ae){for(let be of N)te.access.push({change:be.change,status:"rolled_back"});throw te.metadataApplied=!1,new Hn(`SCIM metadata write failed: ${Jt(Ae)}`,te,!1)}if(K?.oaa)await ln(R,"authz.oaa.metadata","OAA metadata projection failed after SCIM write; full sync will reconcile",K.oaa);if(K?.delta&&R.iamDelta?.isReady())Ie=await ln(R,"iam.delta.egress","IAM delta metadata projection failed after SCIM write; full aggregation will reconcile",K.delta);for(let Ae=0;Ae<N.length;Ae++){let be=N[Ae];try{if(be.action==="grant")await $o(R,be.change,Te,ve);else await Zo(R,be.change,Te);te.access.push({change:be.change,status:"applied"})}catch(Ke){te.access.push({change:be.change,status:"failed",error:Ke});for(let dt=Ae+1;dt<N.length;dt++)te.access.push({change:N[dt].change,status:"rolled_back"});let nt=Ke instanceof us||Ke instanceof dr;if(!nt)await Yo(R,be.change,ve);throw new Hn(nt?Jt(Ke):`SCIM access mutation failed: ${Jt(Ke)}`,te,nt)}}return te}finally{await Fo(R),te.egress=await cr(R,Te),te.egress.delta=Jo(Ie,te.egress.delta),Xo(R,te)}}function Jo(R,M){if(R.status==="degraded")return R;if(M.status==="degraded")return M;return R.status==="ok"||M.status==="ok"?{status:"ok"}:{status:"skipped"}}function Jt(R){return R instanceof Error?R.message:String(R)}async function Fo(R){try{await R.settleAuthz?.()}catch{}}async function Yo(R,M,N){if(!R.accessIndex||!R.catalogStore&&!R.codeCatalog||!R.accessStore)return;let K=r(M.subject);if(!K)return;let te=M.subjectType;try{await ke(K,te,{accessStore:R.accessStore,accessIndex:R.accessIndex,catalogStore:R.catalogStore,code:R.codeCatalog,resources:R.resources},N)}catch(Ie){R.log?.warn("Per-subject reconcile after failed SCIM access mutation failed",{"ion.operation":"authz.reconcile.subject.repair","ion.outcome":"degraded",subject:K,subjectType:te,error:Jt(Ie)})}}function Xo(R,M){if(!R.onAccessMutation)return;try{R.onAccessMutation(M)}catch{}}async function Zo(R,M,N){if(R.accessStore){let K=M.id??f(M);if(!await R.accessStore.get(K)){if((R.accessIndex?await R.accessIndex.has(M.subject,M.targetType,M.target,M.resources?.[0],M.subjectType):{allow:!1}).allow)throw new us(`Cannot revoke ${M.targetType} "${r(M.target)}" for "${r(M.subject)}": it is not a directly granted root (it is derived from group/role membership). Remove the granting group/role instead.`);await Bn(R,M,N);return}}await Bn(R,M,N)}function Un(R){let M=R[t]?.type??"group";if(M==="group"||M==="role"||M==="permission")return M;throw Error(`Unsupported ionite SCIM Group authz type "${String(M)}"`)}async function ts(R,M,N){if(!R.oaa.isReady())return;if(N==="role"){await R.oaa.pushRole(M);return}if(N==="permission"){await R.oaa.pushPermission(M);return}await R.oaa.pushGroup(M)}function as(R){let M=R.resources;if(!M||M.length===0)return;let N=M.map((K)=>typeof K==="string"?K:K.id).filter(Boolean);return N.length>0?N:void 0}function bn(R,M,N){return Jr(R,M,N)}function Qo(R,M){let N=R[t],te={...c(N?.attributes??{},p),id:M,name:R.displayName,displayName:R.displayName,description:N?.description??R.displayName,requestable:N?.requestable,riskLevel:N?.riskLevel??y,providerId:N?.providerId??R.externalId,requestUrl:N?.requestUrl,assignableSubjectTypes:["user"]};if(N?.resources!==void 0)te.resources=N.resources;return te}var ei=["requestable","description","riskLevel","providerId","requestUrl","attributes"];function ea(R){let M=de(R),N=M.attr?.toLowerCase();if(!N)return;if(!M.schema){if(N==="displayname"&&!M.filter&&!M.subAttr)return"displayName";if(N==="members")return"members";return}if(M.schema.toLowerCase()!==t.toLowerCase()||M.filter)return;let K=ei.find((te)=>te.toLowerCase()===N);return K==="attributes"||!M.subAttr?K:void 0}function ta(R){return R.flatMap((M)=>!M.path&&typeof M.value==="object"&&M.value!==null&&!Array.isArray(M.value)?Object.entries(M.value).map(([N,K])=>({op:M.op,path:N,value:K})):[M])}function cs(R){return Fe(400,`Unsupported filter: ${R}`,"invalidFilter")}function Fs(R){if(!R)return;let M=R.trim().match(/^requestable\s+eq\s+(true|false)$/i);if(!M)return;return{requestable:M[1]?.toLowerCase()==="true"}}function Ys(R){if(!R)return;let M=R.trim().match(/^externalId\s+eq\s+"([^"]*)"$/i);return M?M[1]:void 0}function na(R){if(!R)return;return R.trim().match(/^displayName\s+eq\s+"((?:[^"\\]|\\.)*)"$/i)?.[1]?.replace(/\\(.)/g,"$1")}function ti(R){if(!R)return;let M=R.trim(),N=M.match(/^userName\s+eq\s+"([^"]*)"$/i);if(N)return{userName:N[1]};let K=M.match(/^externalId\s+eq\s+"([^"]*)"$/i);if(K)return{externalId:K[1]};let te=M.match(/^meta\.lastModified\s+gt\s+"([^"]*)"$/i);if(te)return{updatedAfter:te[1]};return}function ra(R,M,N){let K=new Set(["id","schemas"]),te={...R};if(M){let Ie=new Set(M.split(",").map((Te)=>Te.trim()).filter(Boolean));for(let Te of Object.keys(te))if(!K.has(Te)&&!Ie.has(Te))delete te[Te]}if(N){for(let Ie of N.split(",").map((Te)=>Te.trim()).filter(Boolean))if(!K.has(Ie))delete te[Ie]}return te}function ns(R,M){let N=async(te,Ie,Te)=>{let ve=await R.toScim(te),Ae=te.id;return{...ve,id:Ae,meta:{...ve.meta??{},resourceType:R.resourceType,location:Ae?It(Ie,`${Te}/${encodeURIComponent(Ae)}`):void 0}}};return{handler:async(te,Ie)=>{if(!await M.validateAuth(te))return Fe(401,"Authorization required");let Te=new URL(te.url),ve=Ie?.basePath??`/${R.resourceType}s`,Ae=Te.pathname;if(Ae.startsWith(ve))Ae=Ae.substring(ve.length);let be=Ae.match(/^\/([^/]+)$/),Ke;if(be?.[1])try{Ke=decodeURIComponent(be[1])}catch{return Fe(400,`${R.resourceType} id is invalid`,"invalidValue")}let nt=Te.searchParams.get("attributes"),dt=Te.searchParams.get("excludedAttributes"),at=(He)=>ra(He,nt,dt);try{if(Ke){if(te.method==="GET"){let He=await R.store.get(Ke);if(!He)return Fe(404,`${R.resourceType} not found`);return xt(at(await N(He,te,ve)))}if(te.method==="PUT"||te.method==="PATCH"){let He=await R.store.get(Ke);if(!He)return Fe(404,`${R.resourceType} not found`);let Qe=await te.json(),ot=Qe;if(te.method==="PATCH"){let St=Qe.Operations;if(!Array.isArray(St))return Fe(400,"PATCH requires Operations","invalidSyntax");let bt=await R.toScim(He);for(let Ut of St)X(bt,Ut);ot=bt}let ct=await dn(R.validator,ot);if(ct.issues)return Fe(400,ct.issues.map((St)=>St.message).join("; "),"invalidValue");let lt=te.method==="PATCH"?"patch":"replace",Ne=await R.store.upsert({...await R.fromScim(ct.value,{existing:He,mode:lt}),id:He.id??Ke});if(He.active!==Ne.active)await M.accessIndex?.setSubjectDisabled?.(Ne.id,R.subjectType,Ne.active===!1);let ft=Ne.id?It(te,`${ve}/${encodeURIComponent(Ne.id)}`):void 0;for(let St of R.projections??[])await ln(M,`${St.channel}.${R.subjectType}.upsert`,`${R.resourceType} projection degraded after SCIM upsert; aggregation will reconcile`,()=>St.upsert(Ne,He));return xt(at(await N(Ne,te,ve)),200,ft)}if(te.method==="DELETE"){let He=await R.store.get(Ke);if(!He)return Fe(404,`${R.resourceType} not found`);if(M.revokeSubjectAccess)await M.revokeSubjectAccess(Ke,R.subjectType);await R.store.delete(Ke),await M.accessIndex?.setSubjectDisabled?.(Ke,R.subjectType,!1);for(let Qe of R.projections??[])await ln(M,`${Qe.channel}.${R.subjectType}.delete`,`${R.resourceType} projection degraded after SCIM delete; aggregation will reconcile`,()=>Qe.delete(He));return new Response(null,{status:204})}return Fe(405,"Method not allowed")}if(te.method==="GET"){let He=parseInt(Te.searchParams.get("startIndex")??"",10),Qe=parseInt(Te.searchParams.get("count")??"",10),ot=He!=null&&!Number.isNaN(He)?Math.max(0,He-1):0,ct=Qe!=null&&!Number.isNaN(Qe)?Qe:void 0,lt=Te.searchParams.get("filter"),Ne=ti(lt);if(lt?.trim()&&!Ne)return cs(lt);if(Ne?.externalId!==void 0){let bt=R.store.getByExternalId?await R.store.getByExternalId(Ne.externalId):await R.store.lookup({externalId:Ne.externalId}),Ut=bt?[at(await N(bt,te,ve))]:[];return Ht(Ut,{totalResults:Ut.length,startIndex:1,itemsPerPage:Ut.length})}let ft=await R.store.list({start:ot,limit:ct,filter:Ne}),St=await Promise.all(ft.items.map(async(bt)=>at(await N(bt,te,ve))));return Ht(St,{totalResults:ft.total,startIndex:ot+1,itemsPerPage:ft.count})}if(te.method==="POST"){let He=await te.json(),Qe=await dn(R.validator,He);if(Qe.issues)return Fe(400,Qe.issues.map((bt)=>bt.message).join("; "),"invalidValue");let{id:ot,...ct}=Qe.value,lt=await R.fromScim(ct,{mode:"create"}),Ne=typeof lt.id==="string"&&lt.id.trim()?lt.id:Sn();if(await R.store.get(Ne))return Fe(409,`${R.resourceType} id already exists`,"uniqueness");let ft=await R.store.upsert({...lt,id:Ne});if(ft.active===!1)await M.accessIndex?.setSubjectDisabled?.(ft.id,R.subjectType,!0);for(let bt of R.projections??[])await ln(M,`${bt.channel}.${R.subjectType}.upsert`,`${R.resourceType} projection degraded after SCIM create; aggregation will reconcile`,()=>bt.upsert(ft,void 0));let St=ft.id?It(te,`${ve}/${encodeURIComponent(ft.id)}`):void 0;return xt(at(await N(ft,te,ve)),201,St)}return Fe(405,"Method not allowed")}catch(He){if(He instanceof s)return Fe(400,He.message,He.scimType);if(q(He))return Fe(409,He.message,"uniqueness");return Fe(500,He instanceof Error?He.message:"Internal error")}}}}async function sa(R,M,N,K){let te=[],Ie=[["group",R.groups],["role",R.roles],["permission",R.permissions]];for(let[ve,Ae]of Ie)for await(let be of u((Ke,nt)=>Ae.list({start:Ke,limit:nt,filter:{requestable:!0}})))if(be.providerId===N)te.push({entity:be,type:ve});if(te.length>1)throw new v(`Ambiguous providerId "${N}": ${te.length} entitlements share it (${te.map((ve)=>`${ve.type}:${ve.entity.id}`).join(", ")})`,"unique_violation","providerId");let Te=te[0];if(Te?.entity.requestable!==!0)return;return bn(Te.entity,Te.type,await wn(R,M,Te.type,Te.entity.id,K))}async function Xs(R,M,N,K){let te=Math.max(0,N.start),Ie=N.limit!=null?te+N.limit:void 0,Te={start:0,limit:Ie,filter:N.filter},[ve,Ae,be]=await Promise.all([R.groups.list(Te),R.roles.list(Te),R.permissions.list(Te)]),Ke=[...ve.items.map((Qe)=>({entity:Qe,type:"group"})),...Ae.items.map((Qe)=>({entity:Qe,type:"role"})),...be.items.map((Qe)=>({entity:Qe,type:"permission"}))],nt=ve.total+Ae.total+be.total,dt=Ke.slice(te,Ie),at=M?.listByTargets?await M.listByTargets(dt.map(({entity:Qe,type:ot})=>({targetType:ot,target:Qe.id}))):void 0,He=await Promise.all(dt.map(async({entity:Qe,type:ot})=>bn(Qe,ot,await wn(R,M,ot,Qe.id,K,at))));return{resources:He,total:nt,count:He.length}}async function zn(R,M,N,K){let[te,Ie,Te]=await Promise.all([R.groups.get(N),R.roles.get(N),R.permissions.get(N)]);if(te)return bn(te,"group",await wn(R,M,"group",N,K));if(Ie)return bn(Ie,"role",await wn(R,M,"role",N,K));if(Te)return bn(Te,"permission",await wn(R,M,"permission",N,K));return}async function rs(R,M,N,K,te){let Ie=Un(M),Te=Ie==="role"?await R.roles.get(N):Ie==="permission"?await R.permissions.get(N):await R.groups.get(N),ve=Qo(M,N),Ae=Te?.assignableSubjectTypes&&Te.assignableSubjectTypes.length>0?Te.assignableSubjectTypes:["user"],be={...Te??{},...ve,source:Te?.source??"scim",assignableSubjectTypes:te?.assignableSubjectTypes??Ae,recommendedSubjectTypes:te?.recommendedSubjectTypes??Te?.recommendedSubjectTypes};if(te){if(delete be.groups,delete be.roles,delete be.permissions,delete be.resources,Ie==="group")be.groups=te.groups,be.roles=te.roles,be.permissions=te.permissions,be.resources=te.resources;else if(Ie==="role")be.permissions=te.permissions}let Ke=K?K.displayName??K.name:Te?.name;if(ve.displayName===Ke)delete be.displayName;if(ve.riskLevel===(K?.riskLevel??y))delete be.riskLevel;let nt=c(ve,p),dt=K?c(K,p):void 0;if(M[t]?.attributes!==void 0){for(let He of Object.keys(c(Te??{},p)??{}))if(!(He in(nt??{})))delete be[He]}for(let[He,Qe]of Object.entries(nt??{}))if(C(Qe,dt?.[He]))delete be[He];if(K)be.name=K.name;let at=Ie==="role"?R.roles.set(be):Ie==="permission"?R.permissions.set(be):R.groups.set(be);return await at.ready(),at}async function ia(R,M){await Promise.all([R.groups.delete(M),R.roles.delete(M),R.permissions.delete(M)])}function Sn(){return crypto.randomUUID()}function dn(R,M){let N=R;if(typeof N.validate==="function")return N.validate(M);return Promise.resolve(R["~standard"].validate(M))}function oa(R){if(!R)return;try{return new URL(R).pathname}catch{return R.startsWith("/")?R:`/${R}`}}function Nt(R){let M=oa(R);return M?I(M):void 0}function Zs(...R){for(let M of R){let N=Nt(M);if(!N)continue;for(let K of["/Users","/Groups","/Workloads","/Customers","/Delegates"])if(N.endsWith(K))return N.slice(0,-K.length)}return}function It(R,M){return new URL(M,R.url).toString()}function je(R,M,N,K){let{multiValued:te=!1,...Ie}=K??{};return{name:R,type:M,description:N,multiValued:te,...Ie}}function aa(R,M){return{schemas:[_o],documentationUri:M?.documentationUri,patch:{supported:!0},bulk:{supported:!1},filter:{supported:!0,maxResults:1000},changePassword:{supported:!1},sort:{supported:!1},etag:{supported:!1},authenticationSchemes:[{type:"oauthbearertoken",name:"OAuth Bearer Token",description:"Use an ionite workload bearer token for IAM discovery and provisioning requests.",primary:!0}],meta:{resourceType:"ServiceProviderConfig",location:It(R.request,`${R.basePath}/ServiceProviderConfig`)}}}function ca(R){let M=[];if(R.supportsUsers)M.push({schemas:[qn],id:"User",name:"User",description:"User Account",endpoint:R.usersUrl,schema:is,schemaExtensions:[{schema:Kn,required:!1},{schema:o,required:!1}],meta:{resourceType:"ResourceType",location:It(R.request,`${R.basePath}/ResourceTypes/User`)}});if(R.supportsGroups)M.push({schemas:[qn],id:"Group",name:"Group",description:"Group",endpoint:R.groupsUrl,schema:os,schemaExtensions:[{schema:t,required:!1}],meta:{resourceType:"ResourceType",location:It(R.request,`${R.basePath}/ResourceTypes/Group`)}});if(R.supportsWorkloads)M.push({schemas:[qn],id:"Workload",name:"Workload",description:"Workload (machine) principal",endpoint:R.workloadsUrl,schema:S,meta:{resourceType:"ResourceType",location:It(R.request,`${R.basePath}/ResourceTypes/Workload`)}});if(R.supportsCustomers)M.push({schemas:[qn],id:"Customer",name:"Customer",description:"Customer (CIAM) principal",endpoint:R.customersUrl,schema:k,meta:{resourceType:"ResourceType",location:It(R.request,`${R.basePath}/ResourceTypes/Customer`)}});if(R.supportsDelegates)M.push({schemas:[qn],id:"Delegate",name:"Delegate",description:"IAM-governed personal token principal",endpoint:R.delegatesUrl,schema:b,meta:{resourceType:"ResourceType",location:It(R.request,`${R.basePath}/ResourceTypes/Delegate`)}});return M}function ua(R){let M=[];if(R.supportsUsers)M.push({schemas:[un],id:is,name:"User",description:"User Account",meta:{resourceType:"Schema",location:It(R.request,`${R.basePath}/Schemas/${encodeURIComponent(is)}`)},attributes:[je("id","string","Unique identifier for the User.",{multiValued:!1,required:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),je("externalId","string","External identifier from the provisioning client.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",uniqueness:"none"}),je("userName","string","Unique identifier typically used for login.",{multiValued:!1,required:!0,caseExact:!1,mutability:"readWrite",returned:"default",uniqueness:"server"}),je("name","complex","The components of the user name.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",subAttributes:[je("formatted","string","The full name, including titles and suffixes.",{multiValued:!1}),je("familyName","string","The family name of the User.",{multiValued:!1}),je("givenName","string","The given name of the User.",{multiValued:!1}),je("middleName","string","The middle name(s) of the User.",{multiValued:!1}),je("honorificPrefix","string","The honorific prefix(es) of the User.",{multiValued:!1}),je("honorificSuffix","string","The honorific suffix(es) of the User.",{multiValued:!1})]}),je("displayName","string","The name of the User, suitable for display.",{multiValued:!1}),je("nickName","string","The casual way to address the user.",{multiValued:!1}),je("profileUrl","reference","A URL pointing to the User profile.",{multiValued:!1,referenceTypes:["external"]}),je("title","string","The user title, such as Vice President.",{multiValued:!1}),je("userType","string","The relationship between the organization and the User.",{multiValued:!1}),je("preferredLanguage","string","Preferred written or spoken language.",{multiValued:!1}),je("locale","string","Default location for localizing values.",{multiValued:!1}),je("timezone","string","The User time zone.",{multiValued:!1}),je("active","boolean","The User administrative status.",{multiValued:!1}),je("emails","complex","Email addresses for the User.",{multiValued:!0,subAttributes:[je("value","string","Email address value.",{multiValued:!1,required:!0}),je("display","string","Display label for the email.",{multiValued:!1}),je("type","string","Email type such as work or home.",{multiValued:!1}),je("primary","boolean","Primary email indicator.",{multiValued:!1})]}),je("phoneNumbers","complex","Phone numbers for the User.",{multiValued:!0,subAttributes:[je("value","string","Phone number value.",{multiValued:!1,required:!0}),je("display","string","Display label for the phone number.",{multiValued:!1}),je("type","string","Phone number type.",{multiValued:!1}),je("primary","boolean","Primary phone number indicator.",{multiValued:!1})]}),je("photos","complex","Photo URLs for the User.",{multiValued:!0,subAttributes:[je("value","reference","Photo URL.",{multiValued:!1,required:!0,referenceTypes:["external"]}),je("display","string","Display label for the photo.",{multiValued:!1}),je("type","string","Photo type.",{multiValued:!1}),je("primary","boolean","Primary photo indicator.",{multiValued:!1})]}),je("addresses","complex","Physical mailing addresses for the User.",{multiValued:!0,subAttributes:[je("formatted","string","Formatted mailing address.",{multiValued:!1}),je("streetAddress","string","Full street address component.",{multiValued:!1}),je("locality","string","City or locality.",{multiValued:!1}),je("region","string","State or region.",{multiValued:!1}),je("postalCode","string","Postal code.",{multiValued:!1}),je("country","string","Country.",{multiValued:!1}),je("type","string","Address type.",{multiValued:!1}),je("primary","boolean","Primary address indicator.",{multiValued:!1})]}),je("groups","complex","Groups to which the User belongs.",{multiValued:!0,mutability:"readOnly",subAttributes:[je("value","string","Group identifier.",{multiValued:!1,required:!0}),je("$ref","reference","Reference to the Group resource.",{multiValued:!1,referenceTypes:["Group"]}),je("display","string","Display name of the group.",{multiValued:!1}),je("type","string","Relationship type.",{multiValued:!1})]}),je("entitlements","complex","Entitlements for the User.",{multiValued:!0,subAttributes:[je("value","string","Entitlement value.",{multiValued:!1,required:!0}),je("display","string","Display value.",{multiValued:!1}),je("type","string","Entitlement type.",{multiValued:!1}),je("primary","boolean","Primary entitlement indicator.",{multiValued:!1})]}),je("roles","complex","Roles for the User.",{multiValued:!0,subAttributes:[je("value","string","Role value.",{multiValued:!1,required:!0}),je("display","string","Display value.",{multiValued:!1}),je("type","string","Role type.",{multiValued:!1}),je("primary","boolean","Primary role indicator.",{multiValued:!1})]}),je("x509Certificates","complex","Certificates issued to the User.",{multiValued:!0,subAttributes:[je("value","string","Certificate value.",{multiValued:!1,required:!0}),je("display","string","Display value.",{multiValued:!1}),je("type","string","Certificate type.",{multiValued:!1}),je("primary","boolean","Primary certificate indicator.",{multiValued:!1})]})]}),M.push({schemas:[un],id:Kn,name:"EnterpriseUser",description:"Enterprise User extension",meta:{resourceType:"Schema",location:It(R.request,`${R.basePath}/Schemas/${encodeURIComponent(Kn)}`)},attributes:[je("employeeNumber","string","Numeric or alphanumeric identifier assigned to a person.",{multiValued:!1}),je("costCenter","string","Name of a cost center.",{multiValued:!1}),je("organization","string","Name of an organization.",{multiValued:!1}),je("division","string","Name of a division.",{multiValued:!1}),je("department","string","Name of a department.",{multiValued:!1}),je("manager","complex","The User manager.",{multiValued:!1,subAttributes:[je("value","string","Identifier of the manager User resource.",{multiValued:!1}),je("$ref","reference","Reference to the manager User resource.",{multiValued:!1,referenceTypes:["User"]}),je("displayName","string","Display name of the manager.",{multiValued:!1})]})]}),M.push({schemas:[un],id:o,name:"IoniteUser",description:"ionite User extension carrying ECID, account purpose, and AppDev custom attributes. See https://ionite.com/docs/llms-ecid.txt.",meta:{resourceType:"Schema",location:It(R.request,`${R.basePath}/Schemas/${encodeURIComponent(o)}`)},attributes:[je("ecid","string","Enterprise Controlled ID formatted as 'ecid:<realm>:<opaque>' (realm = the minting authority's id). Correlates multiple accounts to one identity.",{multiValued:!1,caseExact:!0}),je("accountClass","string","Account purpose (distinct from userType persona). Open value set: 'daily', 'privileged', 'break_glass', 'service'.",{multiValued:!1}),je("attributes","complex","AppDev custom attributes. IAM may override seeded values.",{multiValued:!1,required:!1,mutability:"readWrite"})]});if(R.supportsGroups)M.push({schemas:[un],id:t,name:"IoniteAuthzGroup",description:"ionite authorization metadata for SCIM Group resources.",meta:{resourceType:"Schema",location:It(R.request,`${R.basePath}/Schemas/${encodeURIComponent(t)}`)},attributes:[je("type","string","Authorization entity kind: group, role, or permission.",{multiValued:!1,required:!1}),je("requestable","boolean","Whether this catalog entry is exposed as assignable access to IAM tooling. Only true entries are served.",{multiValued:!1,required:!1}),je("riskLevel","string",`Advisory access-risk classification. Unset values project as ${y}; canonical values are suggestions, not a closed enum.`,{multiValued:!1,required:!1,mutability:"readWrite",canonicalValues:[...ne]}),je("providerId","string","IAM service-provider id captured when this entitlement is materialized at the destination.",{multiValued:!1,required:!1,mutability:"readWrite"}),je("requestUrl","reference","IAM-owned deep link where a principal can request this entitlement.",{multiValued:!1,required:!1,mutability:"readWrite",referenceTypes:["external"]}),je("source","string","Provenance of the catalog row.",{multiValued:!1,required:!1,mutability:"readOnly",canonicalValues:["code","app","scim"]}),je("deprecated","boolean","Whether this retired entitlement may be deleted.",{multiValued:!1,required:!1,mutability:"readOnly"}),je("description","string","Human-readable authorization entity description.",{multiValued:!1,required:!1}),je("resources","string","Resource ids this entitlement is scoped to.",{multiValued:!0,required:!1}),je("assignableSubjectTypes","string","AppDev-owned required audience of principal kinds (user, workload, customer) that may hold this entitlement. Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload","delegate"]}),je("recommendedSubjectTypes","string","AppDev advisory default principal kinds (subset of assignableSubjectTypes). Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload","delegate"]}),je("attributes","complex","AppDev custom attributes. IAM may override seeded values.",{multiValued:!1,required:!1,mutability:"readWrite"})]});if(R.supportsGroups)M.push({schemas:[un],id:os,name:"Group",description:"Group",meta:{resourceType:"Schema",location:It(R.request,`${R.basePath}/Schemas/${encodeURIComponent(os)}`)},attributes:[je("id","string","Unique identifier for the Group.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),je("externalId","string","External identifier from the provisioning client.",{multiValued:!1,uniqueness:"none"}),je("displayName","string","Human-readable name for the Group.",{multiValued:!1,required:!0,uniqueness:"none"}),je("members","complex","Members of the Group.",{multiValued:!0,subAttributes:[je("value","string","Identifier of the member resource.",{multiValued:!1,required:!0}),je("$ref","reference","Reference to the member resource.",{multiValued:!1,referenceTypes:["User","Group","Workload","Customer","Delegate"]}),je("display","string","Display name of the member.",{multiValued:!1}),je("type","string","Member type.",{multiValued:!1})]})]});if(R.supportsWorkloads)M.push({schemas:[un],id:S,name:"Workload",description:"Workload (machine) principal",meta:{resourceType:"Schema",location:It(R.request,`${R.basePath}/Schemas/${encodeURIComponent(S)}`)},attributes:[je("id","string","Unique identifier for the Workload.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),je("externalId","string","External identifier from the provisioning client.",{multiValued:!1}),je("userName","string","Login identifier, typically the OAuth clientId.",{multiValued:!1}),je("displayName","string","Human-readable name for the Workload.",{multiValued:!1}),je("description","string","Free-form description of the Workload.",{multiValued:!1}),je("active","boolean","Administrative status of the Workload.",{multiValued:!1}),je("attributes","complex","AppDev custom attributes.",{multiValued:!1,required:!1,mutability:"readWrite"})]});if(R.supportsCustomers)M.push({schemas:[un],id:k,name:"Customer",description:"Customer (CIAM) principal",meta:{resourceType:"Schema",location:It(R.request,`${R.basePath}/Schemas/${encodeURIComponent(k)}`)},attributes:[je("id","string","Unique identifier for the Customer.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),je("externalId","string","External identifier from the provisioning client.",{multiValued:!1}),je("userName","string","Unique identifier typically used for login.",{multiValued:!1}),je("displayName","string","Human-readable name for the Customer.",{multiValued:!1}),je("active","boolean","Administrative status of the Customer.",{multiValued:!1}),je("emails","complex","Email addresses for the Customer.",{multiValued:!0,subAttributes:[je("value","string","Email address.",{multiValued:!1,required:!0}),je("primary","boolean","Whether this is the primary email.",{multiValued:!1})]}),je("attributes","complex","AppDev custom attributes.",{multiValued:!1,required:!1,mutability:"readWrite"})]});if(R.supportsDelegates)M.push({schemas:[un],id:b,name:"Delegate",description:"IAM-governed personal token principal",meta:{resourceType:"Schema",location:It(R.request,`${R.basePath}/Schemas/${encodeURIComponent(b)}`)},attributes:[je("id","string","Unique identifier for the Delegate.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),je("externalId","string","External identifier from IAM.",{multiValued:!1}),je("displayName","string","Human-readable label.",{multiValued:!1}),je("active","boolean","Administrative status.",{multiValued:!1}),je("owner","complex","Principal that owns this Delegate.",{multiValued:!1,required:!0,mutability:"immutable",subAttributes:[je("value","string","Owner identifier.",{multiValued:!1,required:!0}),je("type","string","Owner principal type.",{multiValued:!1,required:!0,canonicalValues:["User","Customer","Workload"]})]}),je("clientId","string","Client associated with the Delegate.",{multiValued:!1}),je("expiresAt","dateTime","Expiry controlled by IAM.",{multiValued:!1}),je("tokenHash","string","Current token verifier.",{multiValued:!1,required:!0,mutability:"writeOnly",returned:"never"}),je("previousTokenHash","string","Rotation-overlap token verifier.",{multiValued:!1,mutability:"writeOnly",returned:"never"}),je("previousTokenHashExpiresAt","dateTime","End of the rotation overlap.",{multiValued:!1,mutability:"writeOnly",returned:"never"}),je("lastUsedAt","dateTime","Last observed use.",{multiValued:!1,mutability:"readOnly"}),je("lastUsedWindowSeconds","integer","Maximum coarseness of lastUsedAt, in seconds.",{multiValued:!1,mutability:"readOnly"})]});return M}function da(R,M,N,K,te,Ie,Te,ve,Ae,be,Ke,nt,dt,at,He,Qe,ot){let ct={authz:K,settleAuthz:Qe,accessStore:te,accessIndex:Ie,catalogStore:Te,codeCatalog:ve,resources:Ae,log:M,iamDelta:nt,onAccessMutation:dt,onInboundEntitlement:at};if(!be&&!Ke)return;let Ne={...be,...Ke},ft=Ne.users?.enabled!==!1,St=Ne.groups?.enabled!==!1,bt=Ne.workloads?.enabled!==!1,Ut=Ne.customers?.enabled!==!1,Ft=Ne.delegates?.enabled!==!1,Yt=ot?.delegateStore,En=ot?.lastUsedWindowSeconds??br;if(Boolean(Ne.url||Ne.userStore||Te||ve)&&!N)M.error("IAM requires workload identity for SCIM push/pull operations",{"ion.operation":"workload.require","ion.outcome":"failure"});function pn(){if(!N)throw M.error("IAM requires workload identity for SCIM push/pull operations",{"ion.operation":"workload.require","ion.outcome":"failure"}),Error("IAM requires workload identity for SCIM push/pull operations");return N}async function nn(Je){let xe=pn(),Pe=Je.headers.get("Authorization");if(!Pe?.startsWith("Bearer "))return;try{let _e=Pe.substring(7),re=await xe.validateToken(_e);if(!re.valid)return;return Ce(Ne.providers,we(re.claims))}catch{return}}async function Mt(Je){return await nn(Je)!==void 0}async function mn(){let Je=pn(),xe=typeof Je.getServerToken==="function"?await Je.getServerToken():await Je.getToken();return new Headers({...A,...he,Authorization:`Bearer ${xe}`})}async function fn(Je,xe,Pe,_e){if(!Ne.url)throw Error("IAM URL not configured for outgoing requests");let re=`${Ne.url}${xe}`;try{let Re=await mn(),De=await fetch(re,{method:Je,headers:Re,body:Pe?JSON.stringify(Pe):void 0}),Ue=await d(De,{log:M,operation:"scim.request"});if(!De.ok)return{success:!1,error:Ue,status:De.status};let Me=await _e["~standard"].validate(Ue);if(Me.issues)return M.error("SCIM response validation failed",{"ion.operation":"scim.response.validate","ion.outcome":"failure",validationIssues:Me.issues}),{success:!1,error:{schemas:[ss],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${Me.issues.map(($e)=>$e.message).join("; ")}`},status:400};return{success:!0,data:Me.value,status:De.status}}catch(Re){return{success:!1,error:{schemas:[ss],status:"500",detail:Re instanceof Error?Re.message:"Unknown error occurred"},status:500}}}function vn(){return Ne.url}function Lt(Je,xe){let Pe=Nt(xe?.usersUrl??Ne.usersUrl??"/api/iam/Users")??"/api/iam/Users",_e=Nt(xe?.groupsUrl??Ne.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",re=Nt(xe?.workloadsUrl??Ne.workloadsUrl??"/api/iam/Workloads")??"/api/iam/Workloads",Re=Nt(xe?.customersUrl??Ne.customersUrl??"/api/iam/Customers")??"/api/iam/Customers",De=Nt(xe?.delegatesUrl??Ne.delegatesUrl??"/api/iam/Delegates")??"/api/iam/Delegates",Ue=Nt(xe?.discovery?.basePath??Ne.discovery?.basePath)??Zs(Pe,_e,re,Re,De);if(!Ue)return;return{request:Je,basePath:Ue,usersUrl:Pe,groupsUrl:_e,workloadsUrl:re,customersUrl:Re,delegatesUrl:De,supportsUsers:ft&&Boolean(Ne.userStore),supportsGroups:St&&Boolean(Te||ve),supportsWorkloads:bt&&Boolean(Ne.workloadIdentityStore),supportsCustomers:Ut&&Boolean(Ne.customerStore),supportsDelegates:Ft&&Boolean(Yt)}}async function Dn(Je){let xe=aa(Je,Ne.discovery);return await Ne.discovery?.buildServiceProviderConfig?.(Je,xe)??xe}async function Rn(Je){let xe=ca(Je);return await Ne.discovery?.buildResourceTypes?.(Je,xe)??xe}async function Gt(Je){let xe=ua(Je);return await Ne.discovery?.buildSchemas?.(Je,xe)??xe}async function $t(Je,xe){let Pe=Lt(Je,xe);if(!Pe)return;let _e=I(new URL(Je.url).pathname),{basePath:re}=Pe;if(_e!==re&&!_e.startsWith(`${re}/`))return;let Re=I(_e.slice(re.length)||"/");if(!(Re==="/ServiceProviderConfig"||Re==="/ResourceTypes"||Re.startsWith("/ResourceTypes/")||Re==="/Schemas"||Re.startsWith("/Schemas/")))return;if(Je.method!=="GET")return Fe(405,"Method not allowed");if(!await Mt(Je))return Fe(401,"Authorization required");if(Re==="/ServiceProviderConfig")return xt(await Dn(Pe));if(Re==="/ResourceTypes")return Ht(await Rn(Pe));if(Re.startsWith("/ResourceTypes/")){let Me;try{Me=decodeURIComponent(Re.slice(15))}catch{return Fe(400,"Resource type name is invalid","invalidValue")}let $e=(await Rn(Pe)).find((We)=>We.id===Me||We.name===Me);return $e?xt($e):Fe(404,"Resource not found")}if(Re==="/Schemas")return Ht(await Gt(Pe));if(Re.startsWith("/Schemas/")){let Me;try{Me=decodeURIComponent(Re.slice(9))}catch{return Fe(400,"Schema id is invalid","invalidValue")}let $e=(await Gt(Pe)).find((We)=>We.id===Me);return $e?xt($e):Fe(404,"Resource not found")}return}let gn,Xt;if(Ne.url)Xt=async(xe,Pe)=>{let _e={...xe,schemas:xe.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return fn("POST","/Users",_e,R.user)},gn={createGroup:async(xe,Pe)=>{let _e={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:xe,externalId:Pe?.id,members:Pe?.members};return fn("POST","/Groups",_e,R.group)}};let Wt;if(Te||ve){let Je=B(ve,Te),xe=(Ee,Be,Le)=>{let qe=Ee[t]??{},Ye=Un(Ee),tt=Ee.id,it=tt?It(Be,`${Le}/${encodeURIComponent(tt)}`):void 0,st={id:tt??Ee.externalId??Ee.displayName,name:Ee.displayName,displayName:Ee.displayName,description:qe.description??Ee.displayName,requestable:qe.requestable,providerId:qe.providerId??Ee.externalId,requestUrl:qe.requestUrl,source:qe.source,deprecated:qe.deprecated,riskLevel:qe.riskLevel,assignableSubjectTypes:qe.assignableSubjectTypes,recommendedSubjectTypes:qe.recommendedSubjectTypes},Ze=qe.requestUrl??Ne.entitlementRequestUrl?.(st,Ye,{request:Be});return{...Ee,meta:{...Ee.meta,resourceType:"Group",location:it},[t]:{...qe,requestUrl:Ze}}},Pe=(Ee)=>W(ve,Ee),_e=async(Ee,Be)=>{if(!Te){if(Be)throw Error(`Cannot persist access for code entitlement "${Ee.entity.id}": no AccessCatalogStore is wired.`);return Ee.entity}try{return await z(Ee.kind,Ee.entity,V(Te,Ee.kind))}catch(Le){if(Be)throw Le;return M.warn("Code entitlement discovery materialization failed; serving the code template",{"ion.operation":"iam.catalog.materialize","ion.outcome":"degraded",entitlementId:Ee.entity.id,entitlementType:Ee.kind,error:Jt(Le)}),Ee.entity}},re=async(Ee)=>{if(!Te)return;try{await se(ve,Te,Ee)}catch(Be){M.warn("Retired code entitlement deprecation failed; serving the last durable row",{"ion.operation":"iam.catalog.deprecate","ion.outcome":"degraded",entitlementId:Ee,error:Jt(Be)})}},Re=(Ee,Be)=>Fe(403,`Entitlement "${Ee}" is declared in application code; its structural definition cannot be ${Be} through SCIM. IAM may change presentation and receipts, while code continues to own structure.`,"mutability"),De=(Ee)=>Ee!==void 0&&Ee!=="requestable",Ue=(Ee)=>Ee?.[t]?.requestable===!0,Me=(Ee)=>Fe(404,`Requestable Group ${Ee} not found`,"invalidValue"),$e=async(Ee,Be)=>{let Le=await nn(Ee);if(!Le)return Fe(401,"Authorization required");let qe=new URL(Ee.url),Ye=Be?.basePath??"/Groups",tt=qe.pathname;if(tt.startsWith(Ye))tt=tt.substring(Ye.length);let it=tt.match(/^\/([^/]+)$/),st;if(it?.[1])try{st=decodeURIComponent(it[1])}catch{return Fe(400,"Group id is invalid","invalidValue")}let Ze=Ee.method;try{if(st)switch(Ze){case"GET":return await ze(Ee,Ye,st);case"PUT":return await rt(Ee,Ye,st,Le);case"PATCH":return await ut(Ee,Ye,st,Le);case"DELETE":return await Oe(st);default:return Fe(405,"Method not allowed")}else if(tt===""||tt==="/")switch(Ze){case"GET":return await We(Ee,Ye);case"POST":return await Ve(Ee,Ye,Le);default:return Fe(405,"Method not allowed")}return Fe(404,"Resource not found")}catch(et){if(et instanceof Hn)return Gs(et);if(et instanceof ds)return Fe(400,et.message,"invalidValue");if(et instanceof s)return Fe(400,et.message,et.scimType);if(q(et))return Fe(409,et.message,"uniqueness");return M.error("Groups inbound handler error",{"ion.operation":"scim.groups.handler","ion.outcome":"failure"},et),Fe(500,et instanceof Error?et.message:"Internal server error")}},We=async(Ee,Be)=>{let Le=new URL(Ee.url),qe=Le.searchParams.get("startIndex"),Ye=Le.searchParams.get("count"),tt=qe!=null?parseInt(qe,10):void 0,it=Ye!=null?parseInt(Ye,10):void 0,st=tt!=null&&!Number.isNaN(tt)?Math.max(0,tt-1):0,Ze=it!=null&&!Number.isNaN(it)?it:void 0,et=Le.searchParams.get("filter"),mt=na(et);if(et?.trim()&&mt===void 0&&Ys(et)===void 0&&Fs(et)===void 0)return cs(et);let Rt=Ys(et);if(Rt!==void 0){await re();let pt=await sa(Je,te,Rt,He),vt=pt?[xe(pt,Ee,Be)]:[];return Ht(vt,{totalResults:vt.length,startIndex:1,itemsPerPage:vt.length})}if(Fs(et)?.requestable===!1)return Ht([],{totalResults:0,startIndex:1,itemsPerPage:0});let gt={requestable:!0};if(ve)await Promise.all([...ve.groups.list().filter((pt)=>pt.requestable===!0).map((pt)=>({entity:pt,kind:"group"})),...ve.roles.list().filter((pt)=>pt.requestable===!0).map((pt)=>({entity:pt,kind:"role"})),...ve.permissions.list().filter((pt)=>pt.requestable===!0).map((pt)=>({entity:pt,kind:"permission"}))].map((pt)=>_e(pt,!1)));if(await re(),mt!==void 0){let pt=mt.toLowerCase(),Ct=(await Xs(Je,te,{start:0,filter:gt},He)).resources.filter((Vt)=>Vt.displayName?.toLowerCase()===pt).map((Vt)=>xe(Vt,Ee,Be));return Ht(Ct,{totalResults:Ct.length,startIndex:1,itemsPerPage:Ct.length})}let yt=await Xs(Je,te,{start:st,limit:Ze,filter:gt},He);return Ht(yt.resources.map((pt)=>xe(pt,Ee,Be)),{totalResults:yt.total,startIndex:st+1,itemsPerPage:yt.count})},ze=async(Ee,Be,Le)=>{let qe=Pe(Le);if(qe&&qe.entity.requestable!==!0)return Me(Le);if(qe)await _e(qe,!1);await re(Le);let Ye=await zn(Je,te,Le,He);if(!Ue(Ye))return Me(Le);return xt(xe(Ye,Ee,Be))},Ve=async(Ee,Be,Le)=>{let qe=Le.normalizeResource(await Ee.json()),Ye=await dn(R.group,qe);if(Ye.issues)return M.error("Group creation validation failed",{"ion.operation":"scim.group.create","ion.outcome":"failure",validationIssues:Ye.issues}),Fe(400,`Request validation failed: ${Ye.issues.map((kt)=>kt.message).join("; ")}`,"invalidValue");let tt=Ye.value;if(!tt.displayName)return Fe(400,"displayName is required","invalidValue");if(tt[t]?.requestable===!1)return Fe(400,"SCIM may create only requestable entitlements; non-requestable definitions are App-owned.","invalidValue");if(tt[t]={...tt[t],requestable:!0},!ct.onInboundEntitlement)return Fe(501,"IAM-sourced entitlement creation is not implemented: this application declares no authz.onInboundEntitlement callback.","invalidValue");if(!Te)return Fe(501,"Group creation is not supported: this application declares its catalog in code (authz.catalog) and wires no AccessCatalogStore for SCIM-authored definitions.","invalidValue");let st=Un(tt),Ze=tt[t],et=await ct.onInboundEntitlement({type:st,displayName:tt.displayName,description:Ze?.description,externalId:tt.externalId,riskLevel:Ze?.riskLevel,attributes:Ze?.attributes,resources:Ze?.resources,members:tt.members??[],request:Ee});if(!et.accept)return Fe(403,et.reason??"The application rejected the IAM-sourced entitlement");if((st==="role"?[...et.groups??[],...et.roles??[],...et.resources??[]]:st==="permission"?[...et.groups??[],...et.roles??[],...et.permissions??[],...et.resources??[]]:[]).length>0)throw Error(`onInboundEntitlement returned structure that is invalid for entitlement type "${st}".`);let Rt=et.assignableSubjectTypes??["user"];U({id:et.id,assignableSubjectTypes:Rt,recommendedSubjectTypes:et.recommendedSubjectTypes});let ht=async(kt,jt)=>{await Promise.all((jt??[]).map(async(Mn)=>{if(!(kt==="group"?await Je.groups.get(Mn):kt==="role"?await Je.roles.get(Mn):kt==="permission"?await Je.permissions.get(Mn):await Ae?.get(Mn)))throw Error(`onInboundEntitlement accepted "${tt.displayName}" with unknown ${kt} binding "${Mn}".`)}))};await Promise.all([ht("group",et.groups),ht("role",et.roles),ht("permission",et.permissions),ht("resource",et.resources)]);let gt=et.id??Sn(),[yt,pt,vt]=await Promise.all([Je.groups.get(gt),Je.roles.get(gt),Je.permissions.get(gt)]);if(yt||pt||vt)throw new v(`id "${gt}" already exists in the entitlement catalog`,"unique_violation","id");let Ct=et.resources,Vt=ur(new Map,ar(tt.members,st,gt,Ct,Rt)),qt;await Pn(ct,async()=>{qt=await rs(Je,tt,gt,void 0,{...et,assignableSubjectTypes:Rt})},Vt,{oaa:()=>ts(K,qt,st)});let Fn=await wn(Je,te,st,gt),Yn=xe(bn(qt,st,Fn),Ee,Be);return xt(Yn,201,Yn.meta?.location)},rt=async(Ee,Be,Le,qe)=>{let Ye=qe.normalizeResource(await Ee.json()),tt=await dn(R.group,Ye);if(tt.issues)return M.error("Group replacement validation failed",{"ion.operation":"scim.group.replace","ion.outcome":"failure",validationIssues:tt.issues}),Fe(400,`Request validation failed: ${tt.issues.map((vt)=>vt.message).join("; ")}`,"invalidValue");let it=tt.value,st=Un(it),Ze=Pe(Le);if(Ze&&Ze.entity.requestable!==!0)return Me(Le);if(Ze){if(await _e(Ze,!0),Go(it,Ze))return Re(Le,"replaced")}let et=await zn(Je,te,Le);if(!Ue(et))return Me(Le);if(!Ze&&et[t]?.source==="code"&&Ko(it,et))return Re(Le,"replaced");let mt=Ze?.kind??st,Rt=Ze?as(Ze.entity):Hs(it),ht=te?(await te.listByTarget(mt,Le)).items:[],gt=ur(Ho(ht),ar(it.members,mt,Le,Rt,Ze?.entity.assignableSubjectTypes??et[t]?.assignableSubjectTypes??it[t]?.assignableSubjectTypes)),yt;await Pn(ct,async()=>{yt=await rs(Je,it,Le,Ze?.entity)},gt,{oaa:()=>ts(K,yt,mt)});let pt=await wn(Je,te,mt,Le);return xt(xe(bn(yt,mt,pt),Ee,Be))},ut=async(Ee,Be,Le,qe)=>{let Ye=Pe(Le);if(Ye&&Ye.entity.requestable!==!0)return Me(Le);if(Ye)await _e(Ye,!0);let tt=await zn(Je,te,Le);if(!Ue(tt))return Me(Le);let it=await Ee.json();if(!Array.isArray(it.Operations))return Fe(400,"PATCH requires Operations","invalidSyntax");let st=ta(qe.normalizePatch(it.Operations)).map((kt)=>{if(!kt.path)throw String(kt.op).toLowerCase()==="remove"?new s("PATCH remove requires a path","noTarget"):new s(`PATCH ${String(kt.op)} without a path requires an object value`,"invalidValue");return{op:kt,target:ea(kt.path)}});if((Ye!==void 0||tt[t]?.source==="code")&&st.some(({target:kt})=>!De(kt)))return Re(Le,"patched");let et={...structuredClone(tt)},mt=new Set;for(let{op:kt,target:jt}of st){if(!jt)continue;X(et,kt),mt.add(jt)}let Rt=et[t]??{},ht={...tt[t]};for(let kt of ei){if(!mt.has(kt))continue;let jt=Rt[kt];if(jt===void 0)delete ht[kt];else if(kt==="requestable")ht[kt]=Boolean(jt);else if(kt==="attributes"){if(typeof jt!=="object"||jt===null||Array.isArray(jt))throw new s("PATCH attributes must be an object","invalidValue");ht[kt]=jt}else ht[kt]=String(jt)}let gt={...tt,displayName:mt.has("displayName")?et.displayName:tt.displayName,members:mt.has("members")?et.members:tt.members,[t]:ht},yt=await dn(R.group,gt);if(yt.issues)return M.error("Group patch validation failed",{"ion.operation":"scim.group.patch","ion.outcome":"failure",validationIssues:yt.issues}),Fe(400,`Request validation failed: ${yt.issues.map((kt)=>kt.message).join("; ")}`,"invalidValue");let pt=Ye?.kind??Un(gt),vt=Ye?as(Ye.entity):Hs(gt),Ct=Ye?.entity.assignableSubjectTypes??tt[t]?.assignableSubjectTypes??gt[t]?.assignableSubjectTypes,Vt=ur(ar(tt.members,pt,Le,vt,Ct),ar(gt.members,pt,Le,vt,Ct)),qt,Fn=!Ye||st.some(({target:kt})=>kt!=="members");await Pn(ct,async()=>{if(Fn)qt=await rs(Je,gt,Le,Ye?.entity)},Vt,Fn?{oaa:()=>ts(K,qt,pt)}:void 0);let Yn=await zn(Je,te,Le);return xt(xe(Yn,Ee,Be))},Oe=async(Ee)=>{let Be=Pe(Ee);if(Be&&Be.entity.requestable!==!0)return Me(Ee);if(Be)await _e(Be,!0);let Le=await zn(Je,te,Ee);if(!Ue(Le))return Me(Ee);let qe=Le[t];if((Be||qe?.source==="code")&&qe?.deprecated!==!0)return Fe(403,`Code-owned entitlement "${Ee}" can be deleted only after it is marked deprecated.`,"mutability");let Ye=Un(Le);if(te){let tt=await te.listByTarget(Ye,Ee),it=[];for(let st of tt.items)await Bn(ct,st,it);await cr(ct,it)}return await ia(Je,Ee),new Response(null,{status:204})};Wt={handler:$e}}let Dt,Ot,Zt,Kt;if(Ne.userStore){let{userStore:Je,inboundUsers:xe}=Ne,Pe=(Oe)=>Oe?.find((Ee)=>Ee.primary)?.value||Oe?.[0]?.value,_e=async(Oe)=>{if(xe?.mapBaseUserToScim)return await xe.mapBaseUserToScim(Oe);return Fr(Oe)},re=async(Oe,Ee,Be,Le)=>{let qe=Le.projectUser(await _e(Oe)),Ye=qe.id??Oe.id;return{...qe,id:Ye,meta:{...qe.meta,resourceType:"User",location:Ye?It(Ee,`${Be}/${encodeURIComponent(Ye)}`):void 0}}},Re=async(Oe,Ee)=>{if(xe?.mapValidatedScimToBaseUser)return await xe.mapValidatedScimToBaseUser(Oe,Ee);let Be=new Date,Le=Pe(Oe.emails),qe=Oe.name?.formatted||[Oe.name?.givenName,Oe.name?.middleName,Oe.name?.familyName].filter(Boolean).join(" ").trim()||Oe.displayName,Ye=Oe.id||Ee.existing?.id||Sn(),tt=Oe.userName||Le||Ee.existing?.userName||Ye,it=qe||Oe.displayName||Ee.existing?.name||tt,st=Object.fromEntries(Object.entries(Oe).filter(([gt,yt])=>gt.startsWith("urn:")&&gt!==Kn&&gt!==o&&yt!==void 0)),Ze=Oe[o],et=c(Ze?.attributes??{},x),mt=Ze?.ecid!==void 0&&Ze.ecid!==null?j(Ze.ecid):Ee.existing?.ecid,Rt=Ze?.accountClass??Ee.existing?.accountClass,ht=Ee.existing?.sso;return{...Ee.existing??{},id:Ye,userName:tt,name:it,email:Le||Ee.existing?.email||tt,avatar:Oe.profileUrl,sso:{...ht??{},profile:{...ht?.profile??{},sub:Ye,iss:ht?.profile.iss??"iam-provisioned",aud:ht?.profile.aud??"iam-provisioned",exp:ht?.profile.exp??Math.floor(Date.now()/1000)+3600,iat:ht?.profile.iat??Math.floor(Date.now()/1000),email:Le||Ee.existing?.email||tt,email_verified:!0,name:it,preferred_username:tt},tenant:ht?.tenant??{id:"iam-provisioned",name:"IAM Provisioned"},scope:ht?.scope??"openid profile email",tokenType:ht?.tokenType??"Bearer",expires:ht?.expires??new Date(Date.now()+3600000)},externalId:Oe.externalId,ecid:mt,accountClass:Rt,displayName:Oe.displayName,scimName:Oe.name,emails:Oe.emails,nickName:Oe.nickName,title:Oe.title,preferredLanguage:Oe.preferredLanguage,locale:Oe.locale,timezone:Oe.timezone,active:Oe.active,phoneNumbers:Oe.phoneNumbers,ims:Oe.ims,photos:Oe.photos,addresses:Oe.addresses,groups:Oe.groups,entitlements:Oe.entitlements,roles:Oe.roles,x509Certificates:Oe.x509Certificates,scimEnterprise:Oe[Kn],scimSchemaExtensions:Object.keys(st).length>0?st:void 0,createdAt:Ee.existing?.createdAt??(Oe.meta?.created?new Date(Oe.meta.created):Be),updatedAt:Oe.meta?.lastModified?new Date(Oe.meta.lastModified):Be,userType:Oe.userType,...et}},De=async(Oe,Ee)=>{let Be=await nn(Oe);if(!Be)return Fe(401,"Authorization required");let Le=new URL(Oe.url),qe=Ee?.basePath??"/Users",Ye=Le.pathname;if(Ye.startsWith(qe))Ye=Ye.substring(qe.length);let tt=Ye.match(/^\/([^/]+)$/),it;if(tt?.[1])try{it=decodeURIComponent(tt[1])}catch{return Fe(400,"User id is invalid","invalidValue")}let st=Oe.method;try{if(it)switch(st){case"GET":return await $e(Oe,qe,it,Be);case"PUT":return await Ve(Oe,qe,it,Be);case"PATCH":return await rt(Oe,qe,it,Be);case"DELETE":return await ut(it);default:return Fe(405,"Method not allowed")}else if(Ye===""||Ye==="/")switch(st){case"GET":return await Me(Oe,qe,Be);case"POST":return await ze(Oe,qe,Be);default:return Fe(405,"Method not allowed")}return Fe(404,"Resource not found")}catch(Ze){if(Ze instanceof Hn)return Gs(Ze);if(Ze instanceof s)return Fe(400,Ze.message,Ze.scimType);if(q(Ze))return Fe(409,Ze.message,"uniqueness");return M.error("Users inbound handler error",{"ion.operation":"scim.users.handler","ion.outcome":"failure"},Ze),Fe(500,Ze instanceof Error?Ze.message:"Internal server error")}},Ue=async(Oe)=>{if(Je.getByUserName)return Je.getByUserName(Oe);let Ee=Oe.toLowerCase();for await(let Be of u((Le,qe)=>Je.list({start:Le,limit:qe})))if(Be.userName?.toLowerCase()===Ee)return Be;return},Me=async(Oe,Ee,Be)=>{let Le=new URL(Oe.url),qe=Le.searchParams.get("startIndex"),Ye=Le.searchParams.get("count"),tt=qe!=null?parseInt(qe,10):void 0,it=Ye!=null?parseInt(Ye,10):void 0,st=tt!=null&&!Number.isNaN(tt)?Math.max(0,tt-1):0,Ze=it!=null&&!Number.isNaN(it)?it:void 0,et=Le.searchParams.get("filter"),mt=ti(et);if(et?.trim()&&!mt)return cs(et);let{externalId:Rt,userName:ht}=mt??{};if(Rt!==void 0||ht!==void 0){let pt;if(Rt!==void 0)pt=Je.getByExternalId?await Je.getByExternalId(Rt):await Je.lookup({externalId:Rt});else if(ht!==void 0)pt=await Ue(ht);let vt=pt?[await re(pt,Oe,Ee,Be)]:[];return Ht(vt,{totalResults:vt.length,startIndex:1,itemsPerPage:vt.length})}let gt=await Je.list({start:st,limit:Ze,filter:mt}),yt=await Promise.all(gt.items.map((pt)=>re(pt,Oe,Ee,Be)));return Ht(yt,{totalResults:gt.total,startIndex:st+1,itemsPerPage:gt.count})},$e=async(Oe,Ee,Be,Le)=>{let qe=await Je.get(Be);if(!qe)return Fe(404,`User ${Be} not found`,"invalidValue");return xt(await re(qe,Oe,Ee,Le))},We=async(Oe,Ee)=>{let Be=ct.accessIndex;if(!Be?.setSubjectDisabled||!Ee.id)return;let Le=Oe?Oe.active??!0:!0,qe=Ee.active??!0;if(Oe&&Le===qe)return;if(!Oe&&qe)return;await Be.setSubjectDisabled(Ee.id,"user",!qe)},ze=async(Oe,Ee,Be)=>{let Le=Be.normalizeResource(Be.normalizeUser(await Oe.json())),qe=await dn(R.user,Le);if(qe.issues)return M.error("User creation validation failed",{"ion.operation":"scim.user.create","ion.outcome":"failure",validationIssues:qe.issues}),Fe(400,`Request validation failed: ${qe.issues.map((mt)=>mt.message).join("; ")}`,"invalidValue");let Ye=qe.value;if(!Ye.userName&&!Ye.emails?.[0]?.value)return Fe(400,"userName or email is required","invalidValue");let{id:tt,...it}=Ye,st=await Re(it,{mode:"create"}),Ze={...st,id:st.id?.trim()||Sn()};if(await Je.get(Ze.id))return Fe(409,"User id already exists","uniqueness");await Pn(ct,async()=>{await Je.upsert(Ze),await We(void 0,Ze)},Qr(void 0,Ze),{oaa:async()=>{await es(K,Ze)},delta:async()=>{await ct.iamDelta?.onUserUpsert(Ze)}});let et=await re(Ze,Oe,Ee,Be);return xt(et,201,et.meta?.location)},Ve=async(Oe,Ee,Be,Le)=>{let qe=await Je.get(Be);if(!qe)return Fe(404,`User ${Be} not found`,"invalidValue");let Ye=Le.normalizeResource(Le.normalizeUser(await Oe.json())),tt=await dn(R.user,Ye);if(tt.issues)return M.error("User replacement validation failed",{"ion.operation":"scim.user.replace","ion.outcome":"failure",validationIssues:tt.issues}),Fe(400,`Request validation failed: ${tt.issues.map((Ze)=>Ze.message).join("; ")}`,"invalidValue");let it=tt.value,st=await Re({...it,id:Be},{existing:qe,mode:"replace"});return st.createdAt=qe.createdAt,st.updatedAt=new Date,await Pn(ct,async()=>{await Je.upsert(st),await We(qe,st)},Qr(qe,st),{oaa:async()=>{await es(K,st)},delta:async()=>{await Js(ct.iamDelta,qe,st)}}),xt(await re(st,Oe,Ee,Le))},rt=async(Oe,Ee,Be,Le)=>{let qe=await Je.get(Be);if(!qe)return Fe(404,`User ${Be} not found`,"invalidValue");let Ye=await Oe.json();if(!Array.isArray(Ye.Operations))return Fe(400,"PATCH requires Operations","invalidSyntax");let it={...await _e(qe)};for(let et of Le.normalizePatch(Ye.Operations))X(it,et);let st=await dn(R.user,it);if(st.issues)return M.error("User patch validation failed",{"ion.operation":"scim.user.patch","ion.outcome":"failure",validationIssues:st.issues}),Fe(400,`Request validation failed: ${st.issues.map((et)=>et.message).join("; ")}`,"invalidValue");let Ze=await Re(st.value,{existing:qe,mode:"patch"});return Ze.updatedAt=new Date,await Pn(ct,async()=>{await Je.upsert(Ze),await We(qe,Ze)},Qr(qe,Ze),{oaa:async()=>{await es(K,Ze)},delta:async()=>{await Js(ct.iamDelta,qe,Ze)}}),xt(await re(Ze,Oe,Ee,Le))},ut=async(Oe)=>{let Ee=await Je.get(Oe);if(!Ee)return Fe(404,`User ${Oe} not found`,"invalidValue");if(te){let Be=[];for await(let Le of u((qe,Ye)=>te.listBySubject(Oe,"user",{start:qe,limit:Ye})))await Bn(ct,Le,Be);await cr(ct,Be)}if(await Je.delete(Oe),await ct.accessIndex?.setSubjectDisabled?.(Oe,"user",!1),Ee.externalId&&ct.iamDelta?.isReady())await ln(ct,"iam.delta.egress","IAM delta user delete failed after SCIM write; full aggregation will reconcile",()=>ct.iamDelta?.onUserDelete(Ee.externalId)??Promise.resolve(),{id:Oe,kind:"user"});else if(ct.iamDelta?.isReady())ct.log?.warn("IAM delta: deleted User has no externalId; destination delete skipped",{"ion.operation":"iam.delta.delete","ion.outcome":"skipped",id:Oe,kind:"user"});if(ct.authz.oaa.isReady())await ln(ct,"authz.oaa.delete","OAA incremental user delete failed; full sync will reconcile",()=>ct.authz.oaa.deleteUser(Oe),{id:Oe,kind:"user"});return new Response(null,{status:204})};Dt={handler:De}}let _t=async(Je,xe)=>{if(!te)return;let Pe=[];for await(let _e of u((re,Re)=>te.listBySubject(Je,xe,{start:re,limit:Re})))await Bn(ct,_e,Pe);await cr(ct,Pe)};if(Ne.workloadIdentityStore){let{workloadIdentityStore:Je,inboundWorkloads:xe}=Ne;Ot=ns({resourceType:"Workload",subjectType:"workload",store:Je,validator:R.workload??le,toScim:async(Pe)=>await(xe?.mapBaseWorkloadToScim?.(Pe)??Yr(Pe)),fromScim:async(Pe,_e)=>{if(xe?.mapValidatedScimToBaseWorkload)return xe.mapValidatedScimToBaseWorkload(Pe,_e);let re=_e.existing,Re=Pe,De=Re.id?.trim()||re?.id||Sn(),Ue=c(Re.attributes??{},P);return{...re??{},id:De,externalId:Re.externalId??re?.externalId,clientId:Re.userName??re?.clientId??De,displayName:Re.displayName??re?.displayName,description:Re.description??re?.description,active:Re.active??re?.active??!0,providerId:re?.providerId,requestUrl:re?.requestUrl,...Ue}},projections:[{channel:"oaa",upsert:async(Pe)=>{if(K.oaa.isReady())await K.oaa.pushWorkload(Pe)},delete:async(Pe)=>{if(K.oaa.isReady())await K.oaa.deleteWorkload(Pe.id)}},{channel:"delta",upsert:async(Pe,_e)=>{let re=_e?.externalId??_e?.id,Re=Pe.externalId??Pe.id;if(re&&re!==Re)await nt?.onWorkloadDelete(re);await nt?.onWorkloadUpsert(Pe)},delete:async(Pe)=>{await nt?.onWorkloadDelete(Pe.externalId??Pe.id)}}]},{validateAuth:Mt,accessStore:te,accessIndex:Ie,revokeSubjectAccess:_t,log:M})}if(Ne.customerStore){let{customerStore:Je,inboundCustomers:xe}=Ne;Zt=ns({resourceType:"Customer",subjectType:"customer",store:Je,validator:R.customer??pe,toScim:async(Pe)=>await(xe?.mapBaseCustomerToScim?.(Pe)??Xr(Pe)),fromScim:async(Pe,_e)=>{if(xe?.mapValidatedScimToBaseCustomer)return xe.mapValidatedScimToBaseCustomer(Pe,_e);let re=_e.existing,Re=Pe,De=Re.id?.trim()||re?.id||Sn(),Ue=c(Re.attributes??{},E),Me=Re.emails?.find(($e)=>$e.primary)?.value??Re.emails?.[0]?.value;return{...re??{},id:De,externalId:Re.externalId??re?.externalId??De,userName:Re.userName??re?.userName??De,name:Re.displayName??re?.name??Re.userName??De,email:Me??re?.email??"",displayName:Re.displayName??re?.displayName,emails:Re.emails??re?.emails,active:Re.active??re?.active??!0,providerId:re?.providerId,requestUrl:re?.requestUrl,...Ue}},projections:[{channel:"oaa",upsert:async(Pe)=>{if(K.oaa.isReady())await K.oaa.pushCustomer(Pe)},delete:async(Pe)=>{if(K.oaa.isReady()&&Pe.id)await K.oaa.deleteCustomer(Pe.id)}},{channel:"delta",upsert:async(Pe,_e)=>{let re=_e?.externalId??_e?.id,Re=Pe.externalId??Pe.id;if(re&&re!==Re)await nt?.onCustomerDelete(re);await nt?.onCustomerUpsert(Pe)},delete:async(Pe)=>{let _e=Pe.externalId??Pe.id;if(_e)await nt?.onCustomerDelete(_e)}}]},{validateAuth:Mt,accessStore:te,accessIndex:Ie,revokeSubjectAccess:_t,log:M})}if(Yt){let Je=Yt,xe=Ne.inboundDelegates;Kt=ns({resourceType:"Delegate",subjectType:"delegate",store:Je,validator:R.delegate??me,toScim:async(Pe)=>{let _e={...await(xe?.mapBaseDelegateToScim?.(Pe)??Zr(Pe))};return _e.lastUsedWindowSeconds=En,delete _e.tokenHash,delete _e.previousTokenHash,delete _e.previousTokenHashExpiresAt,_e},fromScim:async(Pe,_e)=>{let re={...Pe};if(delete re.lastUsedWindowSeconds,xe?.mapValidatedScimToBaseDelegate){let $e=await xe.mapValidatedScimToBaseDelegate(re,_e);if(!["user","customer","workload"].includes($e.owner.type))throw new n("Delegate owner must be a user, customer, or workload.",{status:400});if(_e.existing&&(_e.existing.owner.id!==$e.owner.id||_e.existing.owner.type!==$e.owner.type))throw new n("Delegate owner is immutable.",{status:400});return $e}let Re=_e.existing,De=re.owner.type==="User"?"user":re.owner.type==="Customer"?"customer":"workload";if(Re&&(Re.owner.id!==re.owner.value||Re.owner.type!==De))throw new n("Delegate owner is immutable.",{status:400});let Ue=re.tokenHash??Re?.tokenHash;if(!Ue)throw new n("Delegate tokenHash is required.",{status:400});let Me=($e,We)=>$e?new Date($e):We;return{...Re??{},id:re.id?.trim()||Re?.id||Sn(),externalId:re.externalId??Re?.externalId,owner:Re?.owner??{id:re.owner.value,type:De},label:re.displayName??Re?.label,clientId:re.clientId??Re?.clientId,active:re.active??Re?.active??!0,expiresAt:Me(re.expiresAt,Re?.expiresAt),tokenHash:Ue,previousTokenHash:re.previousTokenHash??Re?.previousTokenHash,previousTokenHashExpiresAt:Me(re.previousTokenHashExpiresAt,Re?.previousTokenHashExpiresAt),lastUsedAt:Re?.lastUsedAt,providerId:Re?.providerId,requestUrl:Re?.requestUrl}},projections:[{channel:"oaa",upsert:async(Pe)=>{if(K.oaa.isReady())await K.oaa.pushDelegate(Pe)},delete:async(Pe)=>{if(K.oaa.isReady())await K.oaa.deleteDelegate(Pe.id)}},{channel:"delta",upsert:async(Pe,_e)=>{let re=_e?.externalId??_e?.id,Re=Pe.externalId??Pe.id;if(re&&re!==Re)await nt?.onDelegateDelete(re);await nt?.onDelegateUpsert(Pe)},delete:async(Pe)=>{await nt?.onDelegateDelete(Pe.externalId??Pe.id)}}]},{validateAuth:Mt,accessStore:te,accessIndex:Ie,revokeSubjectAccess:_t,log:M})}async function rn(Je,xe){pn();let Pe=new URL(Je.url).pathname,_e=Nt(xe?.usersUrl??Ne.usersUrl??"/api/iam/Users")??"/api/iam/Users",re=Nt(xe?.groupsUrl??Ne.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",Re=Nt(xe?.workloadsUrl??Ne.workloadsUrl??"/api/iam/Workloads")??"/api/iam/Workloads",De=Nt(xe?.customersUrl??Ne.customersUrl??"/api/iam/Customers")??"/api/iam/Customers",Ue=Nt(xe?.delegatesUrl??Ne.delegatesUrl??"/api/iam/Delegates")??"/api/iam/Delegates",Me=`${Zs(_e,re,Re,De,Ue)??"/api/iam"}/AccessRequests`,$e=await $t(Je,xe);if($e)return $e;let We=(ze)=>Pe===ze||Pe.startsWith(`${ze}/`);if(We(_e)){if(!ft)return Fe(404,"SCIM Users endpoint is disabled by RemoteConfig");if(!Dt)return Fe(501,"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application.");return Dt.handler(Je,{basePath:_e})}if(We(re)){if(!St)return Fe(404,"SCIM Groups endpoint is disabled by RemoteConfig");if(!Wt)return Fe(501,"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.");return Wt.handler(Je,{basePath:re})}if(We(Re)){if(!bt)return Fe(404,"SCIM Workloads endpoint is disabled by RemoteConfig");if(!Ot)return Fe(501,"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application.");return Ot.handler(Je,{basePath:Re})}if(We(De)){if(!Ut)return Fe(404,"SCIM Customers endpoint is disabled by RemoteConfig");if(!Zt)return Fe(501,"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application.");return Zt.handler(Je,{basePath:De})}if(We(Ue)){if(!Ft)return Fe(404,"SCIM Delegates endpoint is disabled by RemoteConfig");if(!Kt)return Fe(501,"SCIM Delegates endpoint is enabled by RemoteConfig but no delegate store capability is wired by the application.");return Kt.handler(Je,{basePath:Ue})}if(We(Me)){if(!Ne.accessRequests)return Fe(404,"AccessRequests endpoint is not configured");if(!await Mt(Je))return Fe(401,"Authorization required");if(Je.method==="GET"){if(!Ne.accessRequests.get)return Fe(404,"AccessRequests read endpoint is not configured");let rt=Pe.startsWith(`${Me}/`)?Pe.slice(Me.length+1):void 0;if(!rt||rt.includes("/"))return Fe(404,"AccessRequest not found");let ut;try{ut=decodeURIComponent(rt)}catch{return Fe(400,"AccessRequest id is invalid","invalidValue")}let Oe=await Ne.accessRequests.get(ut);if(!Oe)return Fe(404,"AccessRequest not found");return xt(Oe,200,Oe.trackingUrl)}if(Je.method!=="POST"||Pe!==Me)return Fe(405,"Method not allowed");let ze;try{ze=await Je.json()}catch{return Fe(400,"Request body must be valid JSON","invalidSyntax")}if(typeof ze.subject!=="string"||!ze.subject||typeof ze.target!=="string"||!ze.target||ze.subjectType!=="user"&&ze.subjectType!=="workload"&&ze.subjectType!=="customer"&&ze.subjectType!=="delegate"||ze.targetType!=="group"&&ze.targetType!=="role"&&ze.targetType!=="permission"||ze.operation!=="grant"&&ze.operation!=="revoke")return Fe(400,"subject, subjectType, targetType, target, and operation are required","invalidValue");let Ve=await Ne.accessRequests.create({subject:ze.subject,subjectType:ze.subjectType,targetType:ze.targetType,target:ze.target,operation:ze.operation,justification:typeof ze.justification==="string"?ze.justification:void 0});return xt(Ve.request,Ve.created?201:200,Ve.request.trackingUrl)}return Fe(404,"Resource not found")}let yn;return yn={...Ne,describe:()=>({module:"iam",active:!0,ready:yn.isReady?.()??!0,url:Ne.url,deltaAudience:Ne.deltaAudience,accessRequests:{...Ne.url?{iam:`${I(Ne.url)}/AccessRequests`}:{},ciam:{}},users:{...cn(Ne.users),storeWired:Ne.userStore!==void 0},workloads:{...cn(Ne.workloads),storeWired:Ne.workloadIdentityStore!==void 0},customers:{...cn(Ne.customers),storeWired:Ne.customerStore!==void 0},delegates:{...cn(Ne.delegates),storeWired:Yt!==void 0},groups:{enabled:St,catalogWired:Te!==void 0},urls:{usersUrl:Ne.usersUrl??"",groupsUrl:Ne.groupsUrl??"",workloadsUrl:Ne.workloadsUrl??"",customersUrl:Ne.customersUrl??"",delegatesUrl:Ne.delegatesUrl??""}}),users:cn(Ne.users),workloads:cn(Ne.workloads),customers:cn(Ne.customers),delegates:cn(Ne.delegates),groups:{enabled:St},createUser:Xt,getBaseUrl:vn,groups_outbound:gn,groups_inbound:Wt,users_inbound:Dt,workloads_inbound:Ot,customers_inbound:Zt,delegates_inbound:Kt,handler:rn,delta:nt},yn}function ls(R,M){let N=new TextEncoder().encode(R),K=typeof M==="string"?new TextEncoder().encode(M):M,te=new Uint8Array(N.length+1+K.length);return te.set(N,0),te[N.length]=46,te.set(K,N.length+1),te}function la(R){let M=R.replace(/-/g,"+").replace(/_/g,"/"),N=M.length%4===0?"":"=".repeat(4-M.length%4),K=atob(M+N),te=new Uint8Array(K.length);for(let Ie=0;Ie<K.length;Ie++)te[Ie]=K.charCodeAt(Ie);return te}function pa(R){let M="";for(let N of R)M+=String.fromCharCode(N);return btoa(M).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function ni(R){let M=JSON.parse(R);if(!M||typeof M!=="object"||!Array.isArray(M.keys))throw Error("Invalid JWKS: expected { keys: [...] }");return M}function ma(R){return JSON.stringify(R)}async function fa(R){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:R.x},{name:"Ed25519"},!0,["verify"])}async function ga(R){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:R.x,d:R.d},{name:"Ed25519"},!0,["sign"])}async function ya(R){let N=(typeof R.jwks==="string"?ni(R.jwks):R.jwks).keys.find((K)=>K.kid===R.kid&&K.kty==="OKP"&&K.crv==="Ed25519");if(!N?.x)return!1;try{let K=await fa(N),te=ls(R.requestId,R.rawBody),Ie=la(R.signatureB64Url);return crypto.subtle.verify({name:"Ed25519"},K,Ie,te)}catch{return!1}}async function ha(R){let M=await ga(R.privateKeyJwk),N=ls(R.requestId,R.rawBody),K=await crypto.subtle.sign({name:"Ed25519"},M,N);return pa(new Uint8Array(K))}async function ka(R){let M=await crypto.subtle.generateKey({name:"Ed25519"},!0,["sign","verify"]),N=await crypto.subtle.exportKey("jwk",M.privateKey),te=(await crypto.subtle.exportKey("jwk",M.publicKey)).x,Ie=N.d;if(!te||!Ie)throw Error("Failed to export Ed25519 key material (missing x/d)");return{privateJwk:{kty:"OKP",crv:"Ed25519",x:te,d:Ie,kid:R,alg:"EdDSA",use:"sig"},publicJwks:{keys:[{kty:"OKP",crv:"Ed25519",x:te,kid:R,alg:"EdDSA",use:"sig"}]}}}var Jn={jwksTtlSeconds:{min:60,max:86400,default:600},jwksMaxEntries:{min:16,max:4096,default:256},sessionReadTtlSeconds:{min:1,max:300,default:30},sessionReadMaxEntries:{min:16,max:65536,default:1024}};function lr(R,M){if(typeof R!=="number"||!Number.isFinite(R))return M.default;let N=Math.floor(R);if(N<M.min)return M.min;if(N>M.max)return M.max;return N}function ri(R){return{ttlMs:lr(R?.ttlSeconds,Jn.jwksTtlSeconds)*1000,maxEntries:lr(R?.maxEntries,Jn.jwksMaxEntries)}}function si(R){let M=R?.read;return{read:{enabled:M?.enabled===!0,ttlMs:lr(M?.ttlSeconds,Jn.sessionReadTtlSeconds)*1000,maxEntries:lr(M?.maxEntries,Jn.sessionReadMaxEntries)}}}function Sa(R){return{jwks:ri(R?.jwks),session:si(R?.session)}}var pr=new TextEncoder,wa=new TextDecoder;function ai(R){let M="";for(let N of R)M+=String.fromCharCode(N);return btoa(M).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function ii(R){return ai(pr.encode(JSON.stringify(R)))}function ci(R){if(!/^[A-Za-z0-9_-]+$/.test(R))return;let M=R.replace(/-/g,"+").replace(/_/g,"/").padEnd(Math.ceil(R.length/4)*4,"=");try{return Uint8Array.from(atob(M),(N)=>N.charCodeAt(0))}catch{return}}function oi(R){let M=ci(R);if(!M)return;try{let N=JSON.parse(wa.decode(M));return N!==null&&typeof N==="object"&&!Array.isArray(N)?N:void 0}catch{return}}function ba(R){return pr.encode(R)}function ui(R){let M=new Uint8Array(R.byteLength);return M.set(R),M.buffer}async function di(R){return crypto.subtle.importKey("raw",ui(ba(R)),{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}function Ca(R){let M=R.active.trim(),N=new Map(Object.entries(R.keys).map(([te,Ie])=>[te.trim(),{kid:te.trim(),secret:Ie}])),K=N.get(M);if(!M||!K?.secret)throw Error("Signing key ring must name a non-empty active key.");for(let te of N.values())if(!te.kid||!te.secret)throw Error("Signing key ring ids and secrets must be non-empty.");return{current:()=>K,find:(te)=>N.get(te)}}async function va(R,M,N){let K=Math.floor(N.ttlSeconds);if(!Number.isFinite(K)||K<1)throw Error("Compact JWT ttlSeconds must be a positive integer.");let te=M.current();if(!te.kid||!te.secret)throw Error("Signing key ring returned an invalid active key.");let Ie=Math.floor(Date.now()/1000),Te=ii({alg:"HS256",kid:te.kid,typ:"JWT"}),ve=ii({...R,iat:Ie,exp:Ie+K}),Ae=`${Te}.${ve}`,be=await crypto.subtle.sign("HMAC",await di(te.secret),pr.encode(Ae));return`${Ae}.${ai(new Uint8Array(be))}`}async function Ra(R,M){let N=R.split(".");if(N.length!==3)return null;let[K,te,Ie]=N;if(!K||!te||!Ie)return null;let Te=oi(K);if(Te?.alg!=="HS256"||Te.typ!=="JWT"||typeof Te.kid!=="string")return null;let ve=M.find(Te.kid);if(!ve?.secret)return null;let Ae=ci(Ie);if(!Ae)return null;if(!await crypto.subtle.verify("HMAC",await di(ve.secret),ui(Ae),pr.encode(`${K}.${te}`)))return null;let Ke=oi(te);if(!Ke)return null;let{iat:nt,exp:dt}=Ke;if(typeof nt!=="number"||typeof dt!=="number"||!Number.isSafeInteger(nt)||!Number.isSafeInteger(dt))return null;let at=Math.floor(Date.now()/1000);if(nt>at+60||dt+60<=at)return null;return Ke}function Ia(R){let M={};if(!R)return M;let N=R.split(";");for(let K of N){let te=K.trim();if(!te)continue;let Ie=te.indexOf("=");if(Ie===-1)continue;M[te.slice(0,Ie).trim()]=te.slice(Ie+1).trim()}return M}function li(R){if(!R.expiresAt)return!1;let M=R.expiresAt instanceof Date?R.expiresAt:new Date(R.expiresAt);return!Number.isNaN(M.getTime())&&Date.now()>M.getTime()}function Aa(R){if(!R||typeof R!=="object"||Array.isArray(R))return;let{access_token:M,id_token:N,refresh_token:K,tokens:te,...Ie}=R;return Ie}function Bt(R,M){let N=R[M];return typeof N==="string"?N:""}function Ta(R,M){let N=R.exp;if(typeof N==="number")return new Date(N*1000);if(typeof N==="string"&&N.trim()){let K=Number(N);if(!Number.isNaN(K))return new Date(K*1000)}if(M instanceof Date)return M;if(M){let K=new Date(M);if(!Number.isNaN(K.getTime()))return K}return new Date}function xa(R){let M=R.claims;if(!M?.sub||typeof M.sub!=="string")return;let N=Ta(M,R.expiresAt);if(R.authType==="sso")return{id:M.sub,userName:Bt(M,"preferred_username"),name:Bt(M,"name"),email:Bt(M,"email"),avatar:Bt(M,"picture")||void 0,sso:{profile:M,tenant:{id:Bt(M,"idp")||Bt(M,"iss"),name:Bt(M,"iss")},tokenType:"Bearer",expires:N}};return{id:M.sub,userName:Bt(M,"preferred_username"),name:Bt(M,"name"),email:Bt(M,"email"),avatar:Bt(M,"picture")||void 0,userType:"customer",ciam:{profile:M,scope:"openid profile email",tokenType:"Bearer",expires:N}}}function Pa(R){if(R.authType!=="sso"&&R.authType!=="ciam")return;if(li(R))return;return{sid:R.sid,authType:R.authType,tenantId:typeof R.tenantId==="string"?R.tenantId:void 0,sub:R.sub,expiresAt:R.expiresAt,createdAt:R.createdAt,claims:Aa(R.claims)}}function Ua(R,M){if(!R.endsWith(".session"))return!1;if(!M||M.length===0)return!0;return M.some((N)=>R===`${N}.session`)}function Ea(R){if(R===void 0)return;let M=(Array.isArray(R)?R:[R]).map((N)=>N.trim()).filter((N)=>N.length>0);return M.length>0?M:void 0}async function pi(R,M,N){return(await mi(R,M,N)).map(Pa).filter((te)=>Boolean(te))}async function mi(R,M,N){let K=Ia(R.headers.get("cookie")),te=Ea(N?.cookiesPrefix),Ie=[],Te=new Set;for(let[ve,Ae]of Object.entries(K)){if(!Ua(ve,te)||!Ae)continue;if(Te.has(Ae))continue;Te.add(Ae);let be=await M.get(Ae);if(!be)continue;if(be.authType!=="sso"&&be.authType!=="ciam")continue;if(li(be))continue;Ie.push(be)}return Ie}async function Da(R,M,N){return(await pi(R,M,N)).map(xa).filter((te)=>Boolean(te))}var Ma="@ionite/core",Oa=m(T(Ma));async function _a(R,M){let N=await on({idToken:R,jwksUri:M.jwksUri,issuer:M.issuer,audience:M.audience}),K=await Oa.validate(N);if(K.issues)throw Error(`ID token claims validation failed: ${K.issues.map((Te)=>Te.message).join("; ")}`);let te=K.value;if(te===void 0)throw Error("ID token claims missing");return Q(te)}function Pt(R){return Date.now()-R}function ps(R){if(R instanceof Error)return{"error.name":R.name,"error.message":R.message};return{"error.name":typeof R,"error.message":String(R)}}function mr(R,M){if(!R)return{};try{let N=new URL(R);return{[`${M}.origin`]:N.origin,[`${M}.path`]:N.pathname}}catch{return{[`${M}.path`]:R.startsWith("/")?R:`/${R}`}}}function fr(R,M=5){if(!Array.isArray(R))return[String(R)];return R.slice(0,M).map((N)=>{if(!N||typeof N!=="object")return String(N);let K=N,te=Array.isArray(K.path)?K.path.join("."):String(K.path??""),Ie=typeof K.message==="string"?K.message:String(K.message??"validation failed");return te?`${te}: ${Ie}`:Ie})}function ja(R){if(!R||typeof R!=="object")return{};let M=R;return{oidc_error:typeof M.error==="string"?M.error:void 0,oidc_error_description:typeof M.error_description==="string"?M.error_description:void 0,oidc_error_uri:typeof M.error_uri==="string"?M.error_uri:void 0}}function Na(R,M={}){let N=typeof R==="string"?R:R?.headers.get("cookie")??void 0;if(!N)return[];let te=`${M.cookiePrefix??"ion.sso"}.`,Ie=new Set;for(let Te of Object.keys($a(N))){if(!Te.startsWith(te))continue;let ve=Te.slice(te.length),Ae=ve.lastIndexOf(".");if(Ae<=0)continue;let be=ve.slice(0,Ae).trim();if(be)Ie.add(be)}return Array.from(Ie)}function La(R,M,N,K,te){if(!N&&!K)return;let Ie=new WeakMap,Te=new Map,ve={...N,...K},Ae=!!(ve.authority&&ve.tokenUrl&&ve.authorizationUrl&&ve.clientId&&ve.redirectUri&&ve.scope),be={...ve,authority:Ae?e(ve.authority,"Missing 'authority' from SSO Config"):ve.authority,tokenUrl:Ae?e(ve.tokenUrl,"Missing 'tokenUrl' from SSO Config"):ve.tokenUrl,authorizationUrl:Ae?e(ve.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):ve.authorizationUrl,clientId:Ae?e(ve.clientId,"Missing 'clientId' from SSO Config"):ve.clientId,redirectUri:Ae?e(ve.redirectUri,"Missing 'redirectUri' from SSO Config"):ve.redirectUri,scope:Ae?e(ve.scope,"Missing 'scope' from SSO Config"):ve.scope,responseType:ve.responseType??"code",cookiesSecure:ve.cookiesSecure!==void 0?ve.cookiesSecure:!0,cookiesSameSite:ve.cookiesSameSite!==void 0?ve.cookiesSameSite:"Strict",cookiesPrefix:ve.cookiesPrefix??(ve.clientId?`ion.sso.${ve.clientId}`:"ion.sso"),cookiesPath:ve.cookiesPath??"/",cookiesDomain:tr(ve.cookiesDomain)},Ke=Math.min(600,Math.max(0,Math.floor(Number(be.rotationGraceSeconds??60))||0))*1000,nt=Math.floor(Number(be.sessionWindowSeconds??86400)),dt=Number.isFinite(nt)&&nt>=1?nt:86400;function at(){let xe=[];if(!be.authority)xe.push("authority");if(!be.tokenUrl)xe.push("tokenUrl");if(!be.authorizationUrl)xe.push("authorizationUrl");if(!be.clientId)xe.push("clientId");if(!be.redirectUri)xe.push("redirectUri");if(!be.scope)xe.push("scope");if(xe.length>0)throw Error(`Missing OIDC configuration fields: ${xe.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing ionite.`)}async function He(xe){if(!be)throw Error("ionite SSO Manager not initialized");let Pe=Ie.get(xe);if(Pe)return Pe;let _e=Qe(xe);return Ie.set(xe,_e),_e}async function Qe(xe){try{let{tokens:Pe,session:_e,refreshedUser:re}=await $t(xe);if(!Pe)return{status:"unauthenticated"};if(_e)_n(xe,"user",_e.entitlements);if(re)return{status:"authenticated",value:re};if(_e?.claims)return{status:"authenticated",value:Ut(_e.claims,Pe,Lt(_e.expiresAt))};return{status:"unauthenticated"}}catch(Pe){if(fi(Pe))return{status:"unauthenticated"};return M.error("Error parsing user from cookies",{"ion.operation":"cookie.parse","ion.outcome":"degraded"},Pe),{status:"degraded",error:Pe instanceof Error?Pe:void 0}}}async function ot(xe){let Pe=await He(xe);return Pe.status==="authenticated"?Pe.value:void 0}async function ct(xe){if(!be)throw Error("ionite SSO Manager not initialized");at();let Pe=e(be.redirectUri,"Missing 'redirectUri' from SSO Config"),_e=e(be.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"),re=e(be.clientId,"Missing 'clientId' from SSO Config"),Re=e(be.scope,"Missing 'scope' from SSO Config"),De=be.cookiesSecure?xe.url.replace(/^http:\/\//,"https://"):xe.url,Ue=zt(),Me=zt(64),$e=zt(),We=Pe;try{new URL(We)}catch{if(De)try{let Oe=new URL(De),Ee=We.startsWith("//")?We.slice(1):We.startsWith("/")?We:`/${We}`;We=new URL(Ee,Oe.origin).toString()}catch{try{let Oe=new URL(_e),Ee=We.startsWith("//")?We.slice(1):We.startsWith("/")?We:`/${We}`;We=new URL(Ee,Oe.origin).toString()}catch{throw Error(`Invalid redirectUri: "${Pe}". It must be a valid absolute URL.`)}}}let ze=new URL(_e);ze.searchParams.append("client_id",re),ze.searchParams.append("redirect_uri",We),ze.searchParams.append("response_type","code"),ze.searchParams.append("scope",Re),ze.searchParams.append("state",Ue),ze.searchParams.append("nonce",$e);let Ve=await Vn(Me);ze.searchParams.append("code_challenge",Ve),ze.searchParams.append("code_challenge_method","S256");let rt=await be.beforeLogin?.({request:xe}),ut=rt===void 0?{state:Ue,codeVerifier:Me,nonce:$e}:{state:Ue,codeVerifier:Me,nonce:$e,context:rt};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:ze.toString(),"Set-Cookie":Xt(rn(Ue),ut,be.loginStateTtl??600,"Lax")}})}async function lt(xe){if(!be)throw Error("ionite SSO Manager not initialized");let Pe;try{Pe=await ot(xe)}catch{Pe=void 0}let _e=await be.beforeLogout?.({request:xe,user:Pe}),re=_t("session",xe),Re;try{Re=await $t(xe);let Ve=Re.tokens?.refresh_token??_t("refresh",xe);if(Ve)await Cn(Ve)}catch(Ve){M.warn("Failed to revoke token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},Ve)}if(be.sessionStore)try{let Ve=Re?.sid??re;if(Ve)await be.sessionStore.delete(Ve)}catch(Ve){M.warn("Failed to delete session",{"ion.operation":"session.delete","ion.outcome":"degraded"},Ve)}let De=Ot(),Ue=await be.afterLogout?.({request:xe,context:_e}),Me=an(Ue,"/",xe.url);if(Me.response){let Ve=new Headers(Me.response.headers);for(let[,rt]of De)Ve.append("Set-Cookie",rt);return new Response(Me.response.body,{status:Me.response.status,statusText:Me.response.statusText,headers:Ve})}let $e=Me.location??"/",We=xe.headers.get("accept");if(We?.includes(a)||We?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:$e}),{status:200,headers:[["Content-Type",a],...De]});return new Response("Logged out",{status:302,headers:[["Location",$e],...De]})}async function Ne(xe){if(!be)throw Error("ionite SSO Manager not initialized");if(!be.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{if(!xe.headers.get("content-type")?.includes(L))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let _e=await xe.text(),Re=new URLSearchParams(_e).get("logout_token");if(!Re)return new Response("Missing logout_token parameter",{status:400});let De=e(be.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify logout tokens."),Ue=e(be.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify logout tokens."),Me=be.jwksUri||`${De}/protocol/openid-connect/certs`,$e=await zr({logoutToken:Re,jwksUri:Me,issuer:De,audience:Ue,log:M}),We=typeof $e.sid==="string"?$e.sid:void 0;if(!We)return M.warn("Back-Channel Logout: logout_token missing sid claim",{"ion.operation":"backchannel_logout","ion.outcome":"failure"}),new Response("Invalid logout_token: missing sid claim",{status:400});return await be.sessionStore.deleteByIdpSid(We),M.info("Back-Channel Logout: successfully deleted session",{"ion.module":"sso",sid:We}),new Response("OK",{status:200})}catch(Pe){return M.error("Error during back-channel logout",{"ion.operation":"backchannel_logout","ion.outcome":"failure"},Pe),new Response("Internal Server Error",{status:500})}}async function ft(xe){if(!be)throw Error("ionite SSO Manager not initialized");let Pe=Date.now(),_e=new URL(xe.url),re=new URLSearchParams(_e.search);M.debug("SSO callback received",{"ion.event":"ion.sso.callback.received","ion.module":"sso","ion.operation":"sign_in.callback","http.method":xe.method,"url.path":_e.pathname,hasCode:re.has("code"),hasState:re.has("state"),hasError:re.has("error"),...mr(re.get("iss")??void 0,"oidc.issuer")});let Re=Object.fromEntries(re.entries()),De=await R.callbackParams.validate(Re);if(De.issues)return M.warn("SSO callback parameter validation failed",{"ion.event":"ion.sso.callback.validation_failed","ion.operation":"sign_in.callback","ion.outcome":"failure","validation.issues":fr(De.issues)}),Se(De.issues,"OIDC callback parameters validation failed");let{code:Ue,state:Me}=De.value,$e;try{let We=e(Me,'OIDC "state" was not present in the callback parameters'),ze=_t(rn(We),xe,!0),{codeVerifier:Ve,state:rt,nonce:ut,context:Oe}=ze??{};$e=Oe,M.debug("SSO callback state cookie read",{"ion.event":"ion.sso.callback.state_cookie_read","ion.module":"sso","ion.operation":"sign_in.callback",hasStateCookie:Boolean(ze),hasCodeVerifier:Boolean(Ve),hasStateVerifier:Boolean(rt),hasNonce:Boolean(ut),hasContext:Oe!==void 0});let Ee=e(Ve,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');e(rt,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');let Be=e(ut,'OIDC "nonce" was not present in cookies, ensure that the SSO login was initiated correctly'),Le=e(Ue,'OIDC "code" was not present in the callback parameters');if(Me!==rt)throw M.warn("SSO callback state verification failed",{"ion.event":"ion.sso.callback.state_verification_failed","ion.operation":"sign_in.callback","ion.outcome":"failure"}),Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');M.debug("SSO callback state verified",{"ion.event":"ion.sso.callback.state_verified","ion.module":"sso","ion.operation":"sign_in.callback"});let qe=be.cookiesSecure?xe.url.replace(/^http:\/\//,"https://"):xe.url,Ye=await Yt(Le,Ee,qe),{tokenExpiresAt:tt,sessionExpiresAt:it}=St(Ye);Ye.expires=tt.toISOString();let st=Date.now();M.debug("SSO ID token parsing started",{"ion.event":"ion.sso.id_token.parse_started","ion.module":"sso","ion.operation":"id_token.parse"});let Ze=await bt(Ye,Be,it);M.debug("SSO ID token parsing completed",{"ion.event":"ion.sso.id_token.parse_completed","ion.module":"sso","ion.operation":"id_token.parse","duration.ms":Pt(st),"user.id":Ze.id});let et,mt;{let yt=Mt("SSO requires sessionStore configuration for opaque session cookies."),pt=typeof Ze.sso.profile.sid==="string"?Ze.sso.profile.sid:void 0,vt=pt||zt(32),Ct=Ze.id;if(M.debug("SSO session creation evaluated",{"ion.event":"ion.sso.session.create_evaluated","ion.module":"sso","ion.operation":"session.create",hasSid:Boolean(vt),hasIdpSid:Boolean(pt),hasSub:Boolean(Ct),"user.id":Ct}),!Ct)throw Error("Session creation failed: missing sub in ID token claims");let Vt=Date.now(),qt=await fn({sid:vt,sub:Ct,idpSid:pt,authType:"sso",tenantId:be.tenantId,tokens:Ye,claims:Ze.sso.profile,expiresAt:it,createdAt:new Date},Ct,Ze.sso.profile,Ye);await vn(yt,qt),mt=qt,et=["Set-Cookie",Xt("session",vt,it)],M.info("SSO session created",{"ion.event":"ion.sso.session.created","ion.operation":"session.create","ion.outcome":"success","duration.ms":Pt(Vt),"user.id":Ct})}if(be.userStore)try{let yt=Ze.id;if(yt){let pt=new Date,vt=Date.now();M.debug("SSO user store lookup started",{"ion.event":"ion.sso.user.lookup_started","ion.module":"sso","ion.operation":"user.lookup","user.id":yt});let Ct=await be.userStore.get(yt);if(M.debug("SSO user store lookup completed",{"ion.event":"ion.sso.user.lookup_completed","ion.module":"sso","ion.operation":"user.lookup","duration.ms":Pt(vt),"user.id":yt,found:Boolean(Ct)}),Ct||be.enableJitUserProvisioning){let Vt=Date.now(),qt={...Ct??{},...Ze,id:yt,tenantId:Ct?.tenantId,createdAt:Ct?.createdAt??pt,updatedAt:pt};await be.userStore.upsert(qt),M.info("SSO user stored",{"ion.event":"ion.sso.user.stored","ion.operation":"user.store","ion.outcome":"success","duration.ms":Pt(Vt),"user.id":yt,existing:Boolean(Ct),jitProvisioning:Boolean(be.enableJitUserProvisioning)})}else M.warn("JIT user provisioning disabled: user not found in store and will not be created",{"ion.event":"ion.sso.user.skipped","ion.operation":"user.store","ion.outcome":"skipped","user.id":yt})}else M.warn("User storage skipped: missing sub in ID token claims",{"ion.event":"ion.sso.user.skipped","ion.operation":"user.store","ion.outcome":"skipped"})}catch(yt){M.warn("Failed to store user",{"ion.event":"ion.sso.user.store_failed","ion.operation":"user.store","ion.outcome":"degraded",...ps(yt)})}M.info("SSO sign-in succeeded",{"ion.event":"ion.sso.sign_in.succeeded","ion.operation":"sign_in.callback","ion.outcome":"success","duration.ms":Pt(Pe),"user.id":Ze.id});let Rt=[["Set-Cookie",Wt(rn(We))],...et?[et]:[],...et?await Kt(xe,await Ft(Ze),it):[]],ht=await be.afterLogin?.({ok:!0,request:xe,user:Ze,session:mt,context:$e,displayCookie:be.displayCookie,displayCookieAttributes:Dt()}),gt=an(ht,"/",xe.url);if(gt.response)return kn(gt.response,Rt.map(([,yt])=>yt));return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",gt.location],...Rt]})}catch(We){M.error("Error during sign-in callback",{"ion.event":"ion.sso.sign_in.callback_failed","ion.operation":"sign_in.callback","ion.outcome":"failure","duration.ms":Pt(Pe),...ps(We)});let ze=Me?[["Set-Cookie",Wt(rn(Me))]]:[],Ve=await be.afterLogin?.({ok:!1,request:xe,error:We,context:$e,displayCookie:be.displayCookie,displayCookieAttributes:Dt()}),rt=an(Ve,"/",xe.url);if(rt.response)return kn(rt.response,ze.map(([,ut])=>ut));return new Response("Authentication failed, redirecting",{status:302,headers:[["Location",rt.location],...ze]})}}function St(xe){let Pe=Date.now(),_e=Number(xe.expires_in??3600)||3600,re=new Date(Pe+_e*1000),Re;if(xe.refresh_expires_in!=null&&Number.isFinite(Number(xe.refresh_expires_in)))Re=Number(xe.refresh_expires_in);else if(xe.refresh_token)Re=dt;else Re=_e;return{tokenExpiresAt:re,sessionExpiresAt:new Date(Pe+Re*1000)}}async function bt(xe,Pe,_e){if(!be)throw Error("ionite SSO Manager not initialized");let re=Date.now(),Re=await nn(xe.id_token,Pe);return M.debug("SSO user parsed from ID token",{"ion.event":"ion.sso.user.parse_completed","ion.module":"sso","ion.operation":"id_token.parse","duration.ms":Pt(re),"user.id":Re.sub,hasEmail:Boolean(Re.email),hasName:Boolean(Re.name)}),Ut(Re,xe,_e)}function Ut(xe,Pe,_e){let re=_e??St(Pe).sessionExpiresAt,Re=xe.ecid!==void 0&&xe.ecid!==null?j(xe.ecid):void 0;return{id:xe.sub,userName:xe.preferred_username||"",name:xe.name||"",email:xe.email||"",emails:[{value:xe.email||"",primary:!0}],...Re?{ecid:Re}:{},avatar:xe.picture,sso:{profile:{...xe},tenant:{id:xe.idp||xe.iss||"",name:xe.iss||""},scope:Pe.scope,tokenType:Pe.token_type,sessionState:Pe.session_state,expires:re}}}async function Ft(xe){if(!be.userStore)return xe;let Pe=await be.userStore.lookup(xe);if(!Pe)return xe;return{...xe,...Pe,id:xe.id,sso:xe.sso}}async function Yt(xe,Pe,_e){if(!be)throw Error("ionite SSO Manager not initialized");at();let re=e(be.tokenUrl,"Missing 'tokenUrl' from SSO Config"),Re=e(be.redirectUri,"Missing 'redirectUri' from SSO Config"),De=e(be.clientId,"Missing 'clientId' from SSO Config"),Ue=Re;try{new URL(Ue)}catch{if(_e)try{let $e=new URL(_e),We=Ue.startsWith("//")?Ue.slice(1):Ue.startsWith("/")?Ue:`/${Ue}`;Ue=new URL(We,$e.origin).toString()}catch{try{let $e=new URL(re),We=Ue.startsWith("//")?Ue.slice(1):Ue.startsWith("/")?Ue:`/${Ue}`;Ue=new URL(We,$e.origin).toString()}catch{throw Error(`Invalid redirectUri: "${Re}". It must be a valid absolute URL.`)}}}let Me=new URLSearchParams;if(Me.append("grant_type","authorization_code"),Me.append("code",xe),Me.append("redirect_uri",Ue),Me.append("client_id",De),be.clientSecret)Me.append("client_secret",be.clientSecret);Me.append("code_verifier",Pe);try{let $e=Date.now();M.debug("SSO token exchange started",{"ion.event":"ion.sso.token.exchange_started","ion.module":"sso","ion.operation":"token.exchange",...mr(re,"oidc.token_url"),...mr(Ue,"oidc.redirect_uri"),hasClientSecret:Boolean(be.clientSecret)});let We=await fetch(re,{method:"POST",headers:{...w,...l},body:Me.toString()});M.debug("SSO token exchange response received",{"ion.event":"ion.sso.token.response_received","ion.module":"sso","ion.operation":"token.exchange","http.status_code":We.status,"duration.ms":Pt($e)}),M.debug("SSO token exchange response body read started",{"ion.event":"ion.sso.token.response_body_read_started","ion.module":"sso","ion.operation":"token.exchange"});let ze=await d(We,{log:M,operation:"token.exchange"});if(M.debug("SSO token exchange response body read completed",{"ion.event":"ion.sso.token.response_body_read_completed","ion.module":"sso","ion.operation":"token.exchange","duration.ms":Pt($e)}),!We.ok){M.error("Token exchange error",{"ion.event":"ion.sso.token.exchange_failed","ion.operation":"token.exchange","ion.outcome":"failure","http.status_code":We.status,"duration.ms":Pt($e),...ja(ze)});let rt=ze;throw Error(`Token exchange failed: ${rt.error||We.statusText} - ${rt.error_description||""}`.trim())}let Ve=await R.tokenResponse.validate(ze);if(Ve.issues)throw M.error("Token response validation failed",{"ion.event":"ion.sso.token.response_validation_failed","ion.operation":"token.exchange","ion.outcome":"failure","duration.ms":Pt($e),"validation.issues":fr(Ve.issues)}),Error(`Token response validation failed: ${Ve.issues}`);return M.debug("SSO token exchange completed",{"ion.event":"ion.sso.token.exchange_completed","ion.module":"sso","ion.operation":"token.exchange","ion.outcome":"success","duration.ms":Pt($e),tokenType:Ve.value.token_type,hasAccessToken:Boolean(Ve.value.access_token),hasIdToken:Boolean(Ve.value.id_token),hasRefreshToken:Boolean(Ve.value.refresh_token),expiresIn:Ve.value.expires_in}),Ve.value}catch($e){throw M.error("Error during token exchange",{"ion.event":"ion.sso.token.exchange_failed","ion.operation":"token.exchange","ion.outcome":"failure",...ps($e)}),$e}}async function En(xe){return _r(async()=>{if(!be)throw Error("ionite SSO Manager not initialized");at();let Pe=e(be.tokenUrl,"Missing 'tokenUrl' from SSO Config"),_e=e(be.clientId,"Missing 'clientId' from SSO Config"),re=new URLSearchParams;if(re.append("grant_type","refresh_token"),re.append("refresh_token",xe),re.append("client_id",_e),be.clientSecret)re.append("client_secret",be.clientSecret);let Re=await fetch(Pe,{method:"POST",headers:{...w,...l},body:re.toString()}),De=await d(Re,{log:M,operation:"token.refresh"});if(!Re.ok){M.error("Token refresh error",{"ion.operation":"token.refresh","ion.outcome":"failure",response:De});let Me=De;throw Error(`Token refresh failed: ${Me.error||Re.statusText} - ${Me.error_description||""}`.trim())}let Ue=await R.tokenResponse.validate(De);if(Ue.issues)throw M.error("Token refresh response validation failed",{"ion.event":"ion.sso.token.refresh_validation_failed","ion.operation":"token.refresh","ion.outcome":"failure","validation.issues":fr(Ue.issues)}),Error(`Token refresh response validation failed: ${Ue.issues}`);return Ue.value},void 0,void 0,void 0,M)}async function Cn(xe){try{if(!be)throw Error("ionite SSO Manager not initialized");if(!be.revocationEndpoint)return;let Pe=e(be.clientId,"Missing 'clientId' from SSO Config"),_e=new URLSearchParams;if(_e.append("token",xe),_e.append("token_type_hint","refresh_token"),_e.append("client_id",Pe),be.clientSecret)_e.append("client_secret",be.clientSecret);let re=await fetch(be.revocationEndpoint,{method:"POST",headers:{...l,...w},body:_e.toString()});if(!re.ok)M.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:re.status,statusText:re.statusText});else M.info("Token revoked successfully",{"ion.module":"sso"})}catch(Pe){M.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},Pe)}}async function pn(){if(!be)throw Error("ionite SSO Manager not initialized");let xe=be.authority;if(!be.jwksUri&&!xe)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let Pe=be.jwksUri||`${xe}/protocol/openid-connect/certs`;return $n(Pe,M)}async function nn(xe,Pe){let _e=Date.now(),re=e(be.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify ID tokens."),Re=e(be.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify ID tokens."),De=be.jwksUri||`${re}/protocol/openid-connect/certs`;M.debug("SSO ID token verification started",{"ion.event":"ion.sso.id_token.verify_started","ion.module":"sso","ion.operation":"id_token.verify",...mr(De,"oidc.jwks_uri")});let Ue;try{Ue=await on({idToken:xe,jwksUri:De,issuer:re,audience:Re,expectedNonce:Pe,log:M})}catch($e){throw M.error("SSO ID token verification failed",{"ion.event":"ion.sso.id_token.verify_failed","ion.module":"sso","ion.operation":"id_token.verify","ion.outcome":"failure","duration.ms":Pt(_e)},$e),$e}M.debug("SSO ID token signature verified",{"ion.event":"ion.sso.id_token.signature_verified","ion.module":"sso","ion.operation":"id_token.verify","duration.ms":Pt(_e)});let Me=await R.idTokenClaims.validate(Ue);if(Me.issues)throw M.error("ID token claims validation failed",{"ion.event":"ion.sso.id_token.validation_failed","ion.operation":"id_token.validate","ion.outcome":"failure","duration.ms":Pt(_e),"validation.issues":fr(Me.issues)}),Error(`ID token claims validation failed: ${Me.issues}`);return M.debug("SSO ID token claims validated",{"ion.event":"ion.sso.id_token.claims_validated","ion.module":"sso","ion.operation":"id_token.validate","ion.outcome":"success","duration.ms":Pt(_e),"user.id":Me.value.sub,hasIssuer:Boolean(Me.value.iss),hasAudience:Boolean(Me.value.aud)}),Me.value}function Mt(xe="SSO sessionStore is required for opaque session cookies."){if(!be.sessionStore)throw Error(xe);return be.sessionStore}let mn=!1;async function fn(xe,Pe,_e,re){let Re=be.claimsAsEntitlements;if(!Re?.claims?.length)return xe;if(be.sessionStore?.capabilities?.derivedEntitlements!==!0){if(!mn)mn=!0,M.warn("SSO claims entitlements are configured but the session store does not persist them",{"ion.event":"ion.sso.claims.incapable","ion.module":"sso","ion.outcome":"degraded"});return xe}let De=await On({block:Re,claims:_e,accessClaims:In(re?.access_token),scope:re?.scope,subjectType:"user",subjectId:Pe,catalog:te?.catalogView?.(),log:M});return{...xe,entitlements:De}}async function vn(xe,Pe){try{await xe.create(Pe)}catch(_e){if(!await xe.get(Pe.sid))throw _e;await xe.update(Pe.sid,Pe)}}function Lt(xe){if(!xe)return;if(xe instanceof Date)return xe;let Pe=new Date(xe);return Number.isNaN(Pe.getTime())?void 0:Pe}function Dn(xe){let Pe=xe.tokens;if(!Pe?.access_token||!Pe.id_token||!Pe.token_type)return;return Pe}async function Rn(xe,Pe=!1){let _e=Mt(),re=_t("session",xe);if(!re)return{tokens:void 0,refreshHeaders:[]};let Re=await _e.get(re);if(Re&&be.tenantId&&Re.tenantId&&Re.tenantId!==be.tenantId)return{tokens:void 0,refreshHeaders:Ot(),sid:re};if(Re?.authType!=="sso")return{tokens:void 0,refreshHeaders:Ot(),sid:re};let De=Dn(Re);if(!De)return{tokens:void 0,refreshHeaders:Ot(),sid:re};let Ue=Lt(Re.expiresAt);if(Ue?Date.now()>Ue.getTime():!1)return await _e.delete(re),{tokens:void 0,sid:re,refreshHeaders:Ot()};let $e=Lt(De.expires),We=$e?Date.now()>$e.getTime():!0;if((Pe||We)&&De.refresh_token)return Gt(xe,re,Re,De);return{tokens:De,sid:re,session:Re,refreshHeaders:Zt(xe)}}function Gt(xe,Pe,_e,re){let Re=Te.get(Pe);if(Re)return Re;let De=Mt(),Ue=(async()=>{let Me=await En(re.refresh_token),{tokenExpiresAt:$e,sessionExpiresAt:We}=St(Me);Me.expires=$e.toISOString();let ze=await bt(Me,void 0,We),Ve=ze.sso.profile,rt=zt(32),ut=await fn({..._e,sid:rt,tokens:Me,claims:Ve,expiresAt:We,createdAt:new Date},_e.sub,Ve,Me);await vn(De,ut);try{if(Ke<=0)await De.delete(Pe);else{let{refresh_token:Oe,...Ee}=re;await De.update(Pe,{tokens:Ee,expiresAt:new Date(Date.now()+Ke)})}}catch(Oe){M.warn("Failed to retire rotated SSO session record",{"ion.operation":"session.rotate","ion.outcome":"degraded"},Oe)}return{tokens:Me,sid:rt,session:ut,refreshedUser:ze,refreshHeaders:[["Set-Cookie",Xt("session",rt,We)],...await Kt(xe,ze,We)]}})();return Te.set(Pe,Ue),Ue.finally(()=>{Te.delete(Pe)})}async function $t(xe,Pe=!1){return Rn(xe,Pe)}async function gn(xe){let{tokens:Pe}=await $t(xe);if(!Pe)return;return Pe.access_token}function Xt(xe,Pe,_e,re=be.cookiesSameSite??"Strict"){if(!be)throw Error("ionite SSO Manager not initialized");if(xe=`${be.cookiesPrefix}.${xe}`,typeof Pe!=="string")Pe=btoa(JSON.stringify(Pe));let Re;if(_e instanceof Date)Re=`Expires=${_e.toUTCString()}`;else if(typeof _e==="number")Re=`Max-Age=${_e}`;else throw Error("Invalid expires type",_e);if(Pe.length>4000)throw Error(`Error setting cookie: ${xe}. Cookie length is: ${Pe.length}`);return`${xe}=${Pe}; ${Re}; Path=${be.cookiesPath};${sn(be.cookiesDomain)} HttpOnly;${be.cookiesSecure?" Secure;":""} SameSite=${re};`}function Wt(xe){if(!be)throw Error("ionite SSO Manager not initialized");return`${be.cookiesPrefix}.${xe}=; Max-Age=0; Path=${be.cookiesPath};${sn(be.cookiesDomain)} HttpOnly;${be.cookiesSecure?" Secure;":""} SameSite=${be.cookiesSameSite};`}function Dt(){return{path:be.cookiesPath??"/",domain:be.cookiesDomain,secure:be.cookiesSecure!==!1,sameSite:be.cookiesSameSite??"Strict"}}function Ot(){return[["Set-Cookie",Wt("session")],["Set-Cookie",en(`${be.cookiesPrefix}.profile`,Dt())]]}function Zt(xe){if(be.displayCookie?.enabled===!0)return[];return xn(xe.headers.get("cookie"),be.cookiesPrefix??"ion.sso",Dt()).map((Pe)=>["Set-Cookie",Pe])}async function Kt(xe,Pe,_e){return(await Nn({cookieHeader:xe.headers.get("cookie"),sessionStore:be.sessionStore,cookiesPrefix:be.cookiesPrefix??"ion.sso",authType:"sso",tenantId:be.tenantId,expiresAt:_e,user:Pe,projector:be.displayUser,displayCookie:be.displayCookie,trim:be.trimDisplayCookies,attr:Dt()})).map((Re)=>["Set-Cookie",Re])}function _t(xe,Pe,_e=!1){if(!be)throw Error("ionite SSO Manager not initialized");let re=Pe.headers.get("cookie");if(!re)return null;let Re=`${be.cookiesPrefix}.${xe}`,De=re.split(";").find((We)=>We.trim().startsWith(`${Re}=`));if(!De)return null;let Ue=De.indexOf("="),Me=De.slice(Ue+1).trim();if(!_e)return Me;let $e=atob(Me);return JSON.parse($e)}function rn(xe){return`state_${xe}`}async function yn(xe,Pe){if(!be)throw Error("ionite SSO Manager not initialized");let{loginUrl:_e,userUrl:re,tokenUrl:Re,refreshUrl:De,logoutUrl:Ue,logoutBackChannelUrl:Me,jwksUrl:$e,redirectUri:We}={...be,...Pe},ze=new URL(xe.url).pathname;if(We){let Ve;try{Ve=new URL(We).pathname}catch{try{let rt=new URL(xe.url),ut=We.startsWith("//")?We.slice(1):We;Ve=new URL(ut,rt.origin).pathname}catch{Ve=We.startsWith("/")?We:`/${We}`}}if(Ve===ze)return ft(xe)}if(_e===ze)return ct(xe);if(re===ze){if((be.userEndpoint??"full")==="off")return new Response("Not Found",{status:404,headers:Zt(xe)});try{let{tokens:Ve,session:rt,refreshedUser:ut,refreshHeaders:Oe}=await $t(xe);if(!Ve)return new Response("User not logged in",{status:401,headers:Oe});let Ee=ut??(rt?.claims?Ut(rt.claims,Ve,Lt(rt.expiresAt)):void 0);if(!Ee)return new Response("User not logged in",{status:401,headers:Oe});let Be=await Ft(Ee),Le=`${be.cookiesPrefix}.profile`,qe=Lt(rt?.expiresAt),Ye=be.displayCookie?.enabled===!0&&qe&&!_t("profile",xe)&&!Oe.some(([,it])=>it.startsWith(`${Le}=`))?await Kt(xe,Be,qe):[],tt=be.userEndpoint==="display"?g(Be,be.displayUser):Be;return new Response(JSON.stringify(tt),{headers:[["Content-Type",a],...Oe,...Ye]})}catch(Ve){if(fi(Ve))return new Response("User not logged in",{status:401});return M.error("Error resolving SSO user",{"ion.operation":"sso.user","ion.outcome":"degraded"},Ve),new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:i})}}if(Re===ze){let{tokens:Ve,refreshHeaders:rt}=await $t(xe);if(!Ve)return new Response("User not logged in",{status:401,headers:rt});return new Response(JSON.stringify({token:Ve.access_token,expires:Ve.expires}),{headers:[["Content-Type",a],...rt]})}if(De===ze){let{tokens:Ve,refreshHeaders:rt}=await $t(xe,!0);if(!Ve)return new Response("User not logged in",{status:401});return new Response("Refresh Complete",{status:200,headers:rt})}if(Ue===ze)return lt(xe);if(Me===ze)return Ne(xe);if($e===ze){let Ve=await pn();return new Response(JSON.stringify(Ve),{headers:[["Content-Type",a]]})}return new Response("Not Found",{status:404})}let Je;return Je={...be,describe:()=>({module:"sso",active:!0,ready:Je.isReady?.()??!0,authority:be.authority,tokenUrl:be.tokenUrl,authorizationUrl:be.authorizationUrl,clientId:be.clientId,redirectUri:be.redirectUri,responseType:be.responseType,scope:be.scope,silentRedirectUri:be.silentRedirectUri,jwksUri:be.jwksUri,endSessionEndpoint:be.endSessionEndpoint,revocationEndpoint:be.revocationEndpoint,cookies:{prefix:be.cookiesPrefix,path:be.cookiesPath,secure:be.cookiesSecure,sameSite:be.cookiesSameSite,domain:be.cookiesDomain},loginStateTtl:be.loginStateTtl,rotationGraceSeconds:be.rotationGraceSeconds,sessionWindowSeconds:be.sessionWindowSeconds,displayCookie:be.displayCookie,jit:{enabled:be.enableJitUserProvisioning===!0,userStore:be.userStore!==void 0},sessionStore:be.sessionStore!==void 0,...be.claimsAsEntitlements?.claims?.length?{claimsAsEntitlements:{claims:[...be.claimsAsEntitlements.claims],expand:be.claimsAsEntitlements.expand===!0,resources:be.claimsAsEntitlements.expand===!0&&be.claimsAsEntitlements.resources===!0,capable:be.sessionStore?.capabilities?.derivedEntitlements===!0}}:{},urls:{loginUrl:be.loginUrl??"",userUrl:be.userUrl??"",logoutUrl:be.logoutUrl??"",logoutBackChannelUrl:be.logoutBackChannelUrl??"",refreshUrl:be.refreshUrl??"",callbackUrl:be.redirectUri??""}}),getUser:ot,resolveUser:He,getJwt:gn,initiateLogin:ct,logout:lt,logoutBackChannel:Ne,callbackHandler:ft,handler:yn},Je}function $a(R){let M={},N=R.split(";");for(let K of N){let te=K.trim();if(!te)continue;let Ie=te.indexOf("=");if(Ie===-1)continue;let Te=te.slice(0,Ie).trim(),ve=te.slice(Ie+1).trim();M[Te]=ve}return M}function fi(R){if(!(R instanceof Error))return!1;return["Public key not found","Invalid JWT","Invalid JWT signature","ID token expired","ID token issuer mismatch","ID token audience mismatch","ID token nonce mismatch","ID token missing exp","invalid_grant"].some((M)=>R.message.includes(M))}function gi(R){return R=R??"SSO Unavailable",new Response(JSON.stringify({error:R}),{status:503,statusText:R,headers:i})}var gr="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.";async function Wa(R,M){if(e(M,gr),M.delegate.hasCredential(R)){let N=await M.delegate.resolve(R);return N&&Qn(N)}return M.sso?.getUser(R)}async function ms(R,M){if(e(M,gr),M.delegate.hasCredential(R))return jn(M.delegate,R,Qn);return await M.sso?.resolveUser(R)??{status:"unauthenticated"}}async function Va(R,M){e(M,gr);let N=M.sso;if(!N)return gi();return N.initiateLogin(R)}async function qa(R,M){e(M,gr);let N=M.sso;if(!N)return gi();return N.callbackHandler(R)}var gs="tenant.owner",fs="tenant.owner.",za="tenant:";function Ba(R){return{id:gs,name:"Tenant owner",description:"Administer one tenant resource",requestable:!1,permissionTypes:["Admin"],resourceTypes:["tenant"],assignableSubjectTypes:["customer"],...R}}function ys(R){let M=R.trim();if(!M)throw Error("tenantId is required");return`${za}${M}`}function Ga(R){let M=R.trim();if(!M)throw Error("tenantId is required");return`${fs}${M}`}function At(R){return{allow:!1,reason:R,response(){if(R==="not_found")return Response.json({error:"Not Found"},{status:404});if(R==="forbidden")return Response.json({error:"Forbidden"},{status:403});if(R==="unavailable")return Response.json({error:"Tenant runtime unavailable"},{status:503});return Response.json({error:"Unauthorized"},{status:401})}}}function yr(R,M){if(!R.id)return At("unavailable");return{allow:!0,session:{id:R.id,email:R.email,name:R.name,kind:M,...R.delegate?{delegate:R.delegate}:{}}}}function yi(R){return R==="access_index_not_configured"||R==="error"}async function hi(R,M){let N;try{N=await or(R,M.rootIon)}catch{return At("unavailable")}if(N.status==="degraded")return At("unavailable");if(N.status==="unauthenticated")return At("unauthenticated");if(!N.value.id)return At("unavailable");try{let K=await M.rootIon.authz.hasPermission(N.value,M.ownerPermission??gs,ys(M.tenantId),"customer");if(K.allow)return yr(N.value,"owner");return At(yi(K.metadata?.reason)?"unavailable":"forbidden")}catch{return At("unavailable")}}async function Ka(R,M){let{tenantIon:N}=M;if(!N)return At("not_found");if(N.isReady()){let te;try{te=await ms(R,N)}catch{return At("unavailable")}if(te.status==="degraded")return At("unavailable");if(te.status==="authenticated"){if(!te.value.id)return At("unavailable");if(!M.permission)return te.value.delegate?At("forbidden"):yr(te.value,"sso");try{let Ie=await N.authz.hasPermission(te.value,M.permission,void 0,"user");if(Ie.allow)return yr(te.value,"sso");return At(yi(Ie.metadata?.reason)?"unavailable":"forbidden")}catch{return At("unavailable")}}if(M.allowTenantCustomer){let Ie;try{Ie=await or(R,N)}catch{return At("unavailable")}if(Ie.status==="degraded")return At("unavailable");if(Ie.status==="authenticated"&&!Ie.value.delegate){if(!Ie.value.id)return At("unavailable");return yr(Ie.value,"customer")}}}let K=await hi(R,M);if(K.allow||K.reason==="unavailable")return K;if(!N.isReady())return At("unavailable");return At("unauthenticated")}async function Ha(R,M){let N=R.authz.accessStore;if(!N)throw Error("Cannot list owned tenants: no AccessAssignmentStore is wired.");let K=new Set;for await(let te of u((Ie,Te)=>N.listBySubject(M,"customer",{start:Ie,limit:Te}))){let Ie=typeof te.target==="string"?te.target:te.target.id;if(te.targetType!=="group"||!Ie.startsWith(fs))continue;let Te=Ie.slice(fs.length);if(!Te||!te.resources?.includes(ys(Te)))continue;K.add(Te)}return[...K].sort()}function Ja(R,M){let N=M.redirectTo.trim()||"/",K=M.tenantIon?.sso?.isReady?.()===!0?`${M.tenantIonBasePath?.(R)??`/api/${encodeURIComponent(R)}/ionite`}/auth/login`:M.fallbackPath,te=new URL(K,"http://localhost");return te.searchParams.set("redirect",N),`${te.pathname}${te.search}`}export{Jn as CACHE_BOUNDS,Cs as CIAM_PROVIDER_PRESETS,oe as CatalogAdjacencyCache,br as DEFAULT_DELEGATE_LAST_USED_WINDOW_SECONDS,wr as DELEGATE_TOKEN_PREFIX,Ge as InMemoryTenantStore,Lr as MICROSOFT_CONSUMERS_TENANT_ID,s as ScimPatchError,gs as TENANT_OWNER_PERMISSION,bo as allowHosts,wo as allowOrigins,Ws as allowRelativePaths,Vs as allowSameOrigin,X as applyScimPatchOperation,Qs as assertSubjectTypeAssignable,js as assertTrustedIdTokenClaims,Xr as baseCustomerToScim,Zr as baseDelegateToScim,Fr as baseUserToScimUser,Yr as baseWorkloadToScim,$s as blockDangerousUrls,Wr as buildAuthorizationUrl,ls as buildLfvSigningInput,qa as callback,vo as captureRedirect,To as ciam,go as clearDiscoveryCache,no as clearJwksCache,Xe as collectReferencedDefinitions,Xi as configureJwksCache,Pi as createDelegateResolver,In as decodeUnverifiedJwtPayload,Co as defaultRedirectPolicies,Bs as delegateOwnerToScim,Sr as delegateTokenFromRequest,On as deriveClaimsEntitlements,kr as derivedEntitlementsFor,sr as discoverOidcEndpoints,mi as discoverSessionRecords,pi as discoverSessions,Jr as entitlementToScimGroup,Vr as exchangeAuthorizationCode,D as expandRoot,Br as fetchUserInfo,en as formatDisplayClearCookie,Pr as formatDisplaySetCookie,Gr as generateAppleClientSecret,xi as generateDelegateToken,ka as generateLfvEd25519KeyPair,jr as getCachedVerificationKey,xo as getCustomer,Da as getDiscoveredSessionUsers,$n as getJwks,Ha as getOwnedTenantIds,Rr as getProviderPreset,io as getPublicKeyForKid,so as getPublicKeyFromJwks,Wa as getUser,Nr as getVerificationKeyForKid,Ni as has,qi as hasAll,Gi as hasAllScope,Vi as hasAny,Bi as hasAnyScope,Wi as hasGroup,Li as hasPermission,$i as hasRole,zi as hasScope,ks as hashDelegateToken,da as iam,we as inboundCallerId,Va as initiateLogin,qr as isMicrosoftMultiTenantAuthority,qs as isRedirectAllowed,Na as listSsoClientIdsFromCookies,_s as matchesMicrosoftIssuer,rr as microsoftIssuerTenantId,hn as normalizeOidcIssuer,Ar as orderedEnabledProviders,ni as parseLfvJwks,de as parseScimPatchPath,er as pickDelegateCustomer,Qn as pickDelegateUser,Ki as pickDelegateWorkload,Vn as pkceChallengeFromVerifier,Yi as planDiscoveredTenantCookies,xn as planDisplayCookieClear,Nn as planDisplayCookieHeaders,ke as reconcileSubjectAccess,_n as rememberDerivedEntitlements,an as resolveAfterRedirect,Sa as resolveCacheConfig,Ro as resolveCapturedRedirect,Zn as resolveCiamProvider,or as resolveCustomer,jn as resolveDelegateIdentity,Ce as resolveIamProvider,ro as resolveJwkForKid,ri as resolveJwksCacheConfig,Ir as resolveProviderBranding,Hr as resolveRedirect,si as resolveSessionCacheConfig,hi as resolveTenantOwner,Ka as resolveTenantSession,ms as resolveUser,Kr as sameOriginRedirectRules,Is as selectDisplayCookies,fo as setDiscoveryClock,Zi as setJwksClock,Qi as setJwksRetry,va as signCompactJwt,ha as signLfvPayload,La as sso,Ca as staticSigningKeyRing,ma as stringifyLfvJwks,Ja as tenantAccessLoginUrl,Ga as tenantOwnerEntitlementId,Ba as tenantOwnerPermission,ys as tenantResourceId,Ra as verifyCompactJwt,on as verifyIdToken,ya as verifyLfvSignature,zr as verifyLogoutToken,_a as verifyUser,kn as withSetCookies};
1
+ import{ee,p,x,E,P,c,n,u,ne,y,t,h,D,W,V,z,se,B,r,f,oe,U,ke,Xe,G,ie,ae,H,ce,g,F,ue,J,_,O,Y,j,s,de,X,o,S,k,b,le,pe,me,we,Ce,fe,ge,ye,T,a,L,l,he,i,R,w,Z,d,m,e,Se,I,C,Q,v,q,Ge}from"./shared/core-0nsg7t0c.js";var ki=new Set(fe.map((A)=>A.id));async function On(A){let M=Si(A.block);if(M.length===0||!A.subjectId)return[];let N=wi(A.claims,A.accessClaims,A.scope),K=A.block.expand===!0,te=K&&A.block.resources===!0,Ie=[],Te=new Set,ve=(Ae)=>{let be=`${Ae.targetType}:${Ae.target}:${Ae.resource??""}`;if(Te.has(be))return;Te.add(be),Ie.push(Ae)};for(let Ae of M){let be=bi(N,Ae);for(let He of be){let nt=await vi(A.catalog,He);if(!nt){A.log?.debug("claims entitlement dropped: value is not a catalog id",{"ion.event":"ion.authz.claims.unmatched","ion.module":"authz",claim:Ae,value:He});continue}if(!K||!A.catalog){ve({targetType:nt,target:He,claim:Ae});continue}let dt={subject:A.subjectId,subjectType:A.subjectType,targetType:nt,target:He,...te?Ai(await Ii(A.catalog,nt,He)):{applyToApplication:!0}},at=await U(dt,A.catalog),Ke=dt.id;for(let Ze of at){if(Ze.resource&&!te)continue;ve({targetType:Ze.targetType,target:Ze.target,...Ze.resource?{resource:Ze.resource}:{},claim:Ae,root:Ke??Ze.rootId})}}}return Ie}function In(A){if(!A)return;let M=A.split(".");if(M.length!==3||!M[1])return;try{let N=M[1].replace(/-/g,"+").replace(/_/g,"/"),K=N.padEnd(N.length+(4-N.length%4)%4,"="),te=JSON.parse(atob(K));return te&&typeof te==="object"&&!Array.isArray(te)?te:void 0}catch{return}}var hr=new WeakMap;function _n(A,M,N){let K=hr.get(A)??{};K[M]=N??[],hr.set(A,K)}function kr(A,M){return hr.get(A)?.[M]}function Si(A){return A.claims.filter((M)=>typeof M==="string"&&M.length>0)}function wi(A,M,N){let K={...A};if(M){for(let[te,Ie]of Object.entries(M))if(K[te]===void 0)K[te]=Ie}if(K.scope===void 0&&N)K.scope=N;return K}function bi(A,M){let N=Ci(A,M);if(typeof N==="string")return M==="scope"||M.endsWith(".scope")?N.split(/\s+/).filter(Boolean):N.length>0?[N]:[];if(Array.isArray(N))return N.filter((K)=>typeof K==="string"&&K.length>0);return[]}function Ci(A,M){let N=A;for(let K of M.split(".")){if(!N||typeof N!=="object"||Array.isArray(N))return;N=N[K]}return N}async function vi(A,M){if(ki.has(M))return"permission";if(!A)return;for(let N of["permission","role","group"])if(await Ri(A,N,M))return N;return}async function Ri(A,M,N){if(hs(A,M,N))return!0;let te=M==="permission"?A.catalog?.permissions:M==="role"?A.catalog?.roles:A.catalog?.groups;if(!te)return!1;return await te.get(N)!==void 0}function hs(A,M,N){if(!A.code)return;if(M==="permission")return A.code.permissions.get(N);if(M==="role")return A.code.roles.get(N);return A.code.groups.get(N)}async function Ii(A,M,N){let K=hs(A,M,N),te=M==="permission"?A.catalog?.permissions:M==="role"?A.catalog?.roles:A.catalog?.groups,ve=((te?await te.get(N):void 0)?.resources??K?.resources??[]).map((Ae)=>Ae.trim()).filter(Boolean);return ve.length>0?ve:void 0}function Ai(A){if(!A||A.length===0)return{applyToApplication:!0};return{resources:A}}var wr="ion_dlg_",br=3600;function Ti(A){let M="";for(let N of A)M+=String.fromCharCode(N);return btoa(M).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/u,"")}function xi(){return`ion_dlg_${Ti(crypto.getRandomValues(new Uint8Array(32)))}`}async function ks(A){let M=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(A));return`sha256:${Array.from(new Uint8Array(M),(N)=>N.toString(16).padStart(2,"0")).join("")}`}function Sr(A,M="authorization"){let N=A.headers.get(M);if(!N)return;let K=M.toLowerCase()==="authorization"?N.match(/^Bearer\s+(.+)$/i)?.[1]:N;return K?.startsWith("ion_dlg_")?K:void 0}function Pi(A){let M=new WeakMap,N=new Map,K=new Set,te=async(Ie)=>{let Te=Sr(Ie,A.header);if(!Te)return;let ve=await A.delegateStore.getByTokenHash(await ks(Te));if(!ve||ve.active===!1)return;if(ve.expiresAt&&ve.expiresAt.getTime()<=Date.now())return;if(await A.accessIndex?.isSubjectDisabled?.(ve.id,"delegate"))return;if(await A.accessIndex?.isSubjectDisabled?.(ve.owner.id,ve.owner.type))return;let Ae={id:ve.id,owner:ve.owner,label:ve.label,clientId:ve.clientId,expiresAt:ve.expiresAt},be=ve.expiresAt??new Date(Date.now()+3600000),He;if(ve.owner.type==="user"){let Ke=await A.userStore?.get(ve.owner.id);if(Ke?.active===!1)return;if(Ke)He={...Ke,sso:Ke.sso??{profile:{sub:Ke.id,name:Ke.name,email:Ke.email},tenant:{id:Ke.tenantId??"",name:""},tokenType:"Bearer",expires:be},delegate:Ae}}else if(ve.owner.type==="customer"){let Ke=await A.customerStore?.get(ve.owner.id);if(Ke?.active===!1)return;if(Ke)He={...Ke,ciam:Ke.ciam??{profile:{sub:Ke.id,name:Ke.name,email:Ke.email},tokenType:"Bearer",expires:be},delegate:Ae}}else{let Ke=await A.workloadIdentityStore?.get(ve.owner.id);if(Ke?.active===!1)return;if(Ke)He={...Ke,id:Ke.id,workloadId:Ke.id,clientId:Ke.clientId,claims:{iss:"delegate",sub:Ke.id,exp:Math.floor(be.getTime()/1000),iat:Math.floor(Date.now()/1000)},delegate:Ae}}if(!He){let Ke=`${ve.owner.type}:${ve.owner.id}`;if(!K.has(Ke))K.add(Ke),A.log.warn("Delegate owner could not be resolved",{"ion.operation":"delegate.resolve","ion.outcome":"failure",delegateId:ve.id,ownerId:ve.owner.id,ownerType:ve.owner.type});return}let nt=Date.now(),dt=(A.lastUsedWindowSeconds??3600)*1000,at=N.get(ve.id)??ve.lastUsedAt?.getTime()??0;if(nt-at>=dt)N.set(ve.id,nt),A.delegateStore.touch(ve.id,new Date(nt)).catch((Ke)=>{A.log.warn("Delegate usage timestamp update failed",{"ion.operation":"delegate.touch","ion.outcome":"failure",delegateId:ve.id,error:Ke instanceof Error?Ke.message:String(Ke)})});return He};return{hasCredential:(Ie)=>Sr(Ie,A.header)!==void 0,resolve(Ie){let Te=M.get(Ie);if(Te)return Te;let ve=te(Ie);return M.set(Ie,ve),ve}}}var Ui="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",Ss=["user","customer","workload","delegate"],Ei={user:async(A,M)=>{let N=await M.sso?.getUser(A);return N?.delegate?void 0:N},customer:async(A,M)=>{let N=await M.ciam?.getCustomer(A);return N?.delegate?void 0:N},workload:async(A,M)=>{let N=await M.workload?.getWorkloadIdentity?.(A);if(!N)return;let K=N.clientId??N.workloadId??N.claims.sub;return K&&!N.delegate?{...N,id:K}:void 0},delegate:async(A,M)=>M.delegate.resolve(A)};function An(A){return{id:A.subjectId,delegate:A.subject.delegate}}function Di(A){if(A==="any")return Ss;let M=Array.isArray(A)?A:[A];return Ss.filter((N)=>M.includes(N))}function Mi(A){let M=A.headers.get("cookie");if(!M)return[];return M.split(";").map((N)=>N.slice(0,N.indexOf("=")===-1?N.length:N.indexOf("=")).trim()).filter(Boolean)}function Oi(A,M){let N=A.headers.get("authorization")?.match(/^Bearer\s+(.+)$/i)?.[1],K=N!==void 0&&!N.startsWith(wr),te=Mi(A),Ie=new Set;for(let ve of te){if(ve.startsWith("ion.sso"))Ie.add("user");if(ve.startsWith("ion.ciam"))Ie.add("customer")}let Te=te.length>0&&!Ie.has("user")&&!Ie.has("customer");return M.filter((ve)=>{if(ve==="workload")return K;if(ve==="delegate")return!1;if(te.length===0)return!1;return Ie.has(ve)||Te})}function wt(A){return typeof A==="string"?A:A.id}function _i(A){let{subject:M,subjectType:N}=A,K;if(N==="user")K=M.sso?.scope;else if(N==="customer")K=M.ciam?.scope;else if(N==="workload")K=M.scope;return new Set((K??"").split(/\s+/).filter(Boolean))}function vr(A,M,N){let K=_i(A),te=M.filter((Te)=>K.has(Te));return{allow:N==="any"?te.length>0:M.length>0&&te.length===M.length,metadata:{reason:"scope",wantedScopes:M,matchedScopes:te}}}function ws(A,M){if(A.targetType!==M.targetType||A.target!==M.id)return!1;return M.resource?A.resource===M.resource:A.resource===void 0}function Tn(A,M){return(N)=>{if(A.length===0)return;let K=N.derivedEntitlements??[];if(K.length===0)return;let te=A.filter((Te)=>K.some((ve)=>ws(ve,Te)));if(!(M==="any"?te.length>0:te.length===A.length))return;return K.filter((Te)=>te.some((ve)=>ws(Te,ve)))}}function Xn(A,M,N){return(K)=>{if(M.length===0||K.subjectType!=="workload")return;let te=ee(A.config?.authz,K.subject);if(!te)return;let Ie=M.filter((ve)=>te.has(ve));return(N==="any"?Ie.length>0:Ie.length===M.length)?Ie:void 0}}function Cr(A,M,N,K,te){return{allow:N==="ok",subject:M?.subject,subjectType:M?.subjectType,reason:N,decision:K,response(){if(N==="ok")return new Response(null,{status:204});if(N==="unauthenticated")return A.log.warn("authz.denied",{reason:N,...te()}),Response.json({error:"Unauthorized"},{status:401});if(N==="not_configured")return A.log.warn("authz.denied",{reason:N,subject:M?.subject?.id,subjectType:M?.subjectType,...te()}),Response.json({error:"not_configured"},{status:503});return A.log.warn("authz.denied",{reason:N,subject:M?.subject?.id,subjectType:M?.subjectType,...te()}),Response.json({error:"Forbidden"},{status:403})}}}function ji(A,M,N){return new Promise((K)=>{let te=[],Ie=A.length,Te=!1,ve=()=>{if(Ie-=1,Ie===0&&!Te)Te=!0,K({outcomes:te})};for(let Ae of A)M(Ae).then((be)=>{if(te.push({principal:Ae,decision:be}),!Te&&be.allow){Te=!0,K({matched:{principal:Ae,decision:be},outcomes:te});return}ve()},(be)=>{N?.(Ae,be),te.push({principal:Ae,decision:{allow:!1,metadata:{reason:"error"}}}),ve()})})}async function Qt(A,M,N,K,te,Ie,Te){e(M,Ui);let ve=Di(N),Ae=M.delegate.hasCredential(A)?ve.filter((lt)=>lt==="delegate"):Oi(A,ve),He=(await Promise.all(Ae.map(async(lt)=>{let Ne=await Ei[lt](A,M);if(!Ne?.id)return;let ft=Ne.delegate?"delegate":lt,St=Ne.delegate?.id??Ne.id,bt=lt==="workload"?Ne.derivedEntitlements:lt==="user"||lt==="customer"?kr(A,lt):void 0;return{subject:Ne,subjectType:ft,subjectId:St,derivedEntitlements:bt}}))).filter((lt)=>lt!==void 0);if(He.length===0)return Cr(M,void 0,"unauthenticated",void 0,te);let nt=async(lt)=>{let Ne=M.authz.accessIndex;if(!Ne?.isSubjectDisabled)return!1;return Ne.isSubjectDisabled(lt.subjectId,lt.subjectType)},dt=async(lt)=>{if(Te){let Ne=Te(lt);if(Ne&&Ne.length>0){if(await nt(lt))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"trusted-client",matchedPermissions:Ne}}}}if(Ie){let Ne=Ie(lt);if(Ne&&Ne.length>0){if(await nt(lt))return{allow:!1,metadata:{reason:"subject_disabled"}};return{allow:!0,metadata:{reason:"claims",matchedIds:Ne.map((ft)=>ft.target),matchedClaims:[...new Set(Ne.map((ft)=>ft.claim))],roots:[...new Set(Ne.map((ft)=>ft.root).filter((ft)=>Boolean(ft)))]}}}}return K(lt)},{matched:at,outcomes:Ke}=await ji(He,dt,(lt,Ne)=>{M.log.warn("authz.check_error",{"ion.operation":"authz.check","ion.outcome":"error",subject:lt.subjectId,subjectType:lt.subjectType,error:Ne instanceof Error?Ne.message:String(Ne),...te()})});if(at){if(at.principal.subjectType==="delegate"&&at.principal.subject.delegate)M.log.info("authz.delegate_honor",{"ion.operation":"authz.delegate_honor","ion.outcome":"allow",delegateId:at.principal.subject.delegate.id,ownerId:at.principal.subject.delegate.owner.id,ownerType:at.principal.subject.delegate.owner.type,...te()});if(at.decision.metadata?.reason==="claims")M.log.info("authz.claims_honor",{"ion.operation":"authz.claims_honor","ion.outcome":"allow",subject:at.principal.subjectId,subjectType:at.principal.subjectType,matchedIds:at.decision.metadata.matchedIds,matchedClaims:at.decision.metadata.matchedClaims,roots:at.decision.metadata.roots,...te()});return Cr(M,at.principal,"ok",at.decision,te)}let Ze=Ke.length>0&&Ke.every((lt)=>{let Ne=lt.decision.metadata?.reason;return Ne==="access_index_not_configured"||Ne==="error"}),ot=Ke[0],ct=Ze?"not_configured":"forbidden";return Cr(M,ot?.principal,ct,ot?.decision,te)}async function Ni(A,M,N,K,te,Ie="any"){return Qt(A,M,Ie,(Te)=>M.authz.has(An(Te),N,K,te,Te.subjectType),()=>({targetType:N,target:wt(K),resource:te?wt(te):void 0}),Tn([{targetType:N,id:wt(K),resource:te?wt(te):void 0}],"any"),N==="permission"&&!te?Xn(M,[wt(K)],"any"):void 0)}async function Li(A,M,N,K,te="any"){return Qt(A,M,te,(Ie)=>M.authz.hasPermission(An(Ie),N,K,Ie.subjectType),()=>({targetType:"permission",target:wt(N),resource:K?wt(K):void 0}),Tn([{targetType:"permission",id:wt(N),resource:K?wt(K):void 0}],"any"),K?void 0:Xn(M,[wt(N)],"any"))}async function Wi(A,M,N,K,te="any"){return Qt(A,M,te,(Ie)=>M.authz.hasRole(An(Ie),N,K,Ie.subjectType),()=>({targetType:"role",target:wt(N),resource:K?wt(K):void 0}),Tn([{targetType:"role",id:wt(N),resource:K?wt(K):void 0}],"any"))}async function $i(A,M,N,K,te="any"){return Qt(A,M,te,(Ie)=>M.authz.hasGroup(An(Ie),N,K,Ie.subjectType),()=>({targetType:"group",target:wt(N),resource:K?wt(K):void 0}),Tn([{targetType:"group",id:wt(N),resource:K?wt(K):void 0}],"any"))}async function Vi(A,M,N,K="any"){let te=N.map((Te)=>({targetType:Te.targetType,id:wt(Te.target),resource:Te.resource?wt(Te.resource):void 0})),Ie=N.filter((Te)=>!Te.resource&&Te.targetType==="permission").map((Te)=>wt(Te.target));return Qt(A,M,K,(Te)=>M.authz.hasAny(An(Te),N,Te.subjectType),()=>({targets:N.map((Te)=>`${Te.targetType}:${wt(Te.target)}`)}),te.length>0?Tn(te,"any"):void 0,Ie.length>0?Xn(M,Ie,"any"):void 0)}async function qi(A,M,N,K="any"){let te=N.map((ve)=>({targetType:ve.targetType,id:wt(ve.target),resource:ve.resource?wt(ve.resource):void 0})),Ie=N.length>0&&N.every((ve)=>!ve.resource&&ve.targetType==="permission"),Te=N.map((ve)=>wt(ve.target));return Qt(A,M,K,(ve)=>M.authz.hasAll(An(ve),N,ve.subjectType),()=>({targets:N.map((ve)=>`${ve.targetType}:${wt(ve.target)}`)}),te.length>0?Tn(te,"all"):void 0,Ie?Xn(M,Te,"all"):void 0)}async function zi(A,M,N,K="any"){return Qt(A,M,K,(te)=>Promise.resolve(vr(te,[N],"any")),()=>({scope:N}))}async function Bi(A,M,N,K="any"){return Qt(A,M,K,(te)=>Promise.resolve(vr(te,N,"any")),()=>({scopes:N}))}async function Gi(A,M,N,K="any"){return Qt(A,M,K,(te)=>Promise.resolve(vr(te,N,"all")),()=>({scopes:N}))}function Tt(A){return typeof A==="string"&&A.length>0?A:void 0}function bs(A){let M=Tt(A.email);return{sub:String(A.sub??""),email:M,name:Tt(A.name),userName:Tt(A.preferred_username)??M,avatar:Tt(A.picture)}}var Cs={oidc:{flow:"id_token",scope:"openid profile email",branding:{displayName:"Single sign-on"},mapClaims:bs},google:{flow:"id_token",authorizationUrl:"https://accounts.google.com/o/oauth2/v2/auth",tokenUrl:"https://oauth2.googleapis.com/token",jwksUri:"https://www.googleapis.com/oauth2/v3/certs",scope:"openid email profile",branding:{displayName:"Google",iconUrl:"https://www.gstatic.com/firebasejs/ui/2.0.0/images/auth/google.svg",colors:{light:"#ffffff",dark:"#131314",secondary:"#4285F4"},url:"https://accounts.google.com"},mapClaims:bs},microsoft:{flow:"id_token",authority:"https://login.microsoftonline.com/common/v2.0",authorizationUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",tokenUrl:"https://login.microsoftonline.com/common/oauth2/v2.0/token",jwksUri:"https://login.microsoftonline.com/common/discovery/v2.0/keys",scope:"openid email profile",branding:{displayName:"Microsoft",colors:{light:"#ffffff",dark:"#2f2f2f",secondary:"#0067b8"},url:"https://login.microsoftonline.com"},mapClaims:(A)=>{let M=Tt(A.email)??Tt(A.preferred_username);return{sub:String(A.sub??A.oid??""),email:M,name:Tt(A.name),userName:Tt(A.preferred_username)??M,avatar:Tt(A.picture)}}},apple:{flow:"id_token",authorizationUrl:"https://appleid.apple.com/auth/authorize",tokenUrl:"https://appleid.apple.com/auth/token",jwksUri:"https://appleid.apple.com/auth/keys",scope:"openid email name",extraAuthParams:{response_mode:"form_post"},branding:{displayName:"Apple",colors:{light:"#000000",dark:"#ffffff"},url:"https://appleid.apple.com"},mapClaims:(A)=>{let M=Tt(A.email);return{sub:String(A.sub??""),email:M,name:Tt(A.name),userName:M}}},github:{flow:"userinfo",authorizationUrl:"https://github.com/login/oauth/authorize",tokenUrl:"https://github.com/login/oauth/access_token",userInfoUrl:"https://api.github.com/user",scope:"read:user user:email",branding:{displayName:"GitHub",colors:{light:"#24292f",dark:"#ffffff"},url:"https://github.com"},mapClaims:(A)=>({sub:String(A.id??A.node_id??""),email:Tt(A.email),name:Tt(A.name)??Tt(A.login),userName:Tt(A.login),avatar:Tt(A.avatar_url)})}};function Rr(A){if(A==="magic-link")return;return Cs[A]}function Zn(A,M){if(M.type==="magic-link")return;let N=Rr(M.type);if(!N)return;return{name:A,type:M.type,flow:N.flow,authority:M.authority??N.authority,authorizationUrl:M.authorizationUrl??N.authorizationUrl,tokenUrl:M.tokenUrl??N.tokenUrl,jwksUri:M.jwksUri??N.jwksUri,userInfoUrl:M.userInfoUrl??N.userInfoUrl,scope:M.scope??N.scope,clientId:M.clientId,clientSecret:M.clientSecret,extraAuthParams:N.extraAuthParams,branding:{...N.branding,...M.branding},mapClaims:N.mapClaims,config:M}}function Ir(A){return{...Rr(A.type)?.branding??{displayName:A.type},...A.branding}}function Ar(A){if(!A)return[];return Object.entries(A).filter(([,M])=>M.enabled!==!1).map(([M,N],K)=>({name:M,config:N,index:K})).sort((M,N)=>{let K=M.config.order??Number.MAX_SAFE_INTEGER,te=N.config.order??Number.MAX_SAFE_INTEGER;if(K!==te)return K-te;return M.index-N.index}).map(({name:M,config:N})=>({name:M,config:N}))}var Qn=(A)=>("sso"in A)?A:void 0,er=(A)=>("ciam"in A)?A:void 0,Ki=(A)=>("claims"in A)?A:void 0;async function jn(A,M,N){try{let K=await A.resolve(M),te=K?N(K):void 0;return te?{status:"authenticated",value:te}:{status:"unauthenticated"}}catch(K){return{status:"degraded",error:K instanceof Error?K:Error(String(K))}}}var Hi=/^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;function tr(A){if(A===void 0)return;let M=A.trim().toLowerCase();if(!Hi.test(M))throw Error(`Invalid cookiesDomain "${A}": expected a hostname such as "app.example.com" without a scheme, port, path, or leading dot.`);return M}function sn(A){return A?` Domain=${A};`:""}var vs=4000;function Ji(A){return`Expires=${A.toUTCString()}`}function Rs(A){return`Path=${A.path};${sn(A.domain)}${A.secure?" Secure;":""} SameSite=${A.sameSite};`}function Pr(A,M,N,K){if(M.length>vs)throw Error(`Display cookie ${A} value is ${M.length} bytes; the limit is ${vs}.`);return`${A}=${M}; ${Ji(N)}; ${Rs(K)}`}function en(A,M){return`${A}=; Max-Age=0; ${Rs(M)}`}function Tr(A){if(!A)return;let M=A instanceof Date?A:new Date(A);return Number.isNaN(M.getTime())?void 0:M}function xr(A){return!A||A.getTime()>Date.now()}async function Fi(A,M,N){let K=A.envelope.kind??"session";if(K==="discovered"){let ve=Tr(A.envelope.expiresAt);return{...A,kind:K,live:Boolean(ve&&xr(ve))}}let te=M[`${A.prefix}.session`];if(!te)return{...A,kind:K,live:!1};let Ie=await N.get(te);if(!Ie||Ie.authType!=="sso"&&Ie.authType!=="ciam")return{...A,kind:K,live:!1};let Te=Tr(Ie.expiresAt);return{...A,kind:K,live:xr(Te),...Te?{sessionExpiresAt:Te}:{}}}function xn(A,M,N){let K=O(M);return A?.includes(`${K}=`)?[en(K,N)]:[]}function Is(A,M,N,K,te){let Ie=[...A.filter((He)=>He.kind==="session").slice(0,N),...A.filter((He)=>He.kind==="discovered").slice(0,K)],Te=te?te(A,{max:N,maxDiscovered:K}):Ie,ve=[...Te.filter((He)=>He.kind==="session").slice(0,N),...Te.filter((He)=>He.kind==="discovered").slice(0,K)];if(ve.some((He)=>He.name===M))return ve;let Ae=A.find((He)=>He.name===M);if(!Ae)return ve;return[...[Ae,...ve.filter((He)=>He.kind==="session")].slice(0,N),...ve.filter((He)=>He.kind==="discovered")]}async function Nn(A){let M=O(A.cookiesPrefix),N=A.attr;if(A.displayCookie?.enabled!==!0)return xn(A.cookieHeader,A.cookiesPrefix,N);if(!A.sessionStore)return[];let K=g(A.user,A.projector),te={v:G,...A.tenantId?{tenantId:A.tenantId}:{},authType:A.authType,expiresAt:A.expiresAt.toISOString(),user:K},Ie={name:M,prefix:A.cookiesPrefix,envelope:te,kind:"session",sessionExpiresAt:A.expiresAt,live:!0},Te=ue(A.cookieHeader),ve=A.sessionStore,Ae=await Promise.all(J(A.cookieHeader).filter((ot)=>ot.name!==M).map((ot)=>Fi(ot,Te,ve))),be=[Ie,...Ae.filter((ot)=>ot.live&&ot.kind==="session")].sort((ot,ct)=>_(ot.sessionExpiresAt?.toISOString()??ot.envelope.expiresAt,ct.sessionExpiresAt?.toISOString()??ct.envelope.expiresAt)),He=A.displayCookie.discovered?.enabled===!0?Ae.filter((ot)=>ot.live&&ot.kind==="discovered"&&(!A.tenantId||ot.envelope.tenantId!==A.tenantId)).sort((ot,ct)=>_(ot.envelope.expiresAt,ct.envelope.expiresAt)):[],nt=[...be,...He],dt=ae(A.displayCookie?.max),at=H(A.displayCookie.discovered?.max),Ke=new Set(Is(nt,M,dt,at,A.trim).map((ot)=>ot.name)),Ze=[Pr(M,F(te),A.expiresAt,N)];for(let ot of Ae)if(!Ke.has(ot.name))Ze.push(en(ot.name,N));return Ze}function Yi(A){let M=ue(A.cookieHeader),N=Object.keys(M).filter((Ze)=>Ze.startsWith(`${ie}.`)&&Ze.endsWith(".profile"));if(!(A.displayCookie?.enabled===!0&&A.displayCookie.discovered?.enabled===!0))return N.map((Ze)=>en(Ze,A.attr));let te=A.now??new Date,Ie=ce(A.displayCookie?.discovered?.ttlSeconds),Te=new Date(te.getTime()+Ie*1000),ve=H(A.displayCookie?.discovered?.max),Ae=J(A.cookieHeader),be=new Set(Ae.filter((Ze)=>(Ze.envelope.kind??"session")==="session").flatMap((Ze)=>Ze.envelope.tenantId?[Ze.envelope.tenantId]:[])),He=new Map;for(let Ze of Ae){if(Ze.envelope.kind!=="discovered"||!Ze.envelope.tenantId)continue;let ot=Tr(Ze.envelope.expiresAt);if(ot&&xr(ot)&&!be.has(Ze.envelope.tenantId))He.set(Ze.envelope.tenantId,Ze.envelope)}let nt=g(A.user,A.projector);for(let Ze of A.tenants){let ot=Ze.tenantId.trim();if(!ot||be.has(ot))continue;He.set(ot,{v:G,kind:"discovered",tenantId:ot,authType:A.authType,expiresAt:Te.toISOString(),user:nt,...Ze.tenantName?{tenantName:Ze.tenantName}:{}})}let dt=[...He.values()].sort((Ze,ot)=>_(Ze.expiresAt,ot.expiresAt)).slice(0,ve),at=new Set(dt.map((Ze)=>Y(Ze.tenantId??""))),Ke=dt.map((Ze)=>Pr(Y(Ze.tenantId??""),F(Ze),new Date(Ze.expiresAt),A.attr));for(let Ze of N)if(!at.has(Ze))Ke.push(en(Ze,A.attr));return Ke}var Or=60000,Ts=86400000,xs=600000,Er=256,Et=new Map;function Xi(A){if(typeof A?.ttlMs==="number"&&Number.isFinite(A.ttlMs))xs=Math.min(Math.max(A.ttlMs,Or),Ts);if(typeof A?.maxEntries==="number"&&Number.isFinite(A.maxEntries)){Er=Math.max(1,Math.floor(A.maxEntries));while(Et.size>Er){let M=Et.keys().next().value;if(M===void 0)break;Et.delete(M)}}}function As(A,M){Et.delete(A),Et.set(A,M);while(Et.size>Er){let N=Et.keys().next().value;if(N===void 0)break;Et.delete(N)}}var Ln=new Map,Dr=()=>Date.now();function Zi(A){Dr=A??(()=>Date.now())}var Mr={};function Qi(A){Mr=A??{}}function eo(A){if(!A)return;if(/\bno-store\b/i.test(A))return Or;let M=/max-age\s*=\s*(\d+)/i.exec(A);if(!M)return;let N=Number(M[1]);return Number.isFinite(N)?N*1000:void 0}function to(A){let N=eo(A)??xs;return Math.min(Math.max(N,Or),Ts)}async function _r(A,M=3,N=1000,K=30000,te){let Ie=Error("Placeholder Error");for(let Te=0;Te<=M;Te++)try{return await A()}catch(ve){if(Ie=ve instanceof Error?ve:Error(String(ve)),ve instanceof Error&&ve.message.includes("400"))throw ve;if(Te===M)throw Ie;let Ae=Math.min(N*2**Te,K),be=Math.random()*0.1*Ae;await new Promise((He)=>setTimeout(He,Ae+be)),te?.warn(`Retry attempt ${Te+1} after ${Ae+be}ms delay`)}throw Ie}async function Wn(A,M,N){let K=Et.get(A);if(!N?.forceRefresh&&K&&K.expiresAt>Dr())return As(A,K),K.jwks;let te=Ln.get(A);if(te)return te;let Ie=(async()=>{try{return await _r(async()=>{let Te=await fetch(A,{headers:l});if(!Te.ok){let be=await Z(Te);throw M?.warn("JWKS endpoint returned an error",{"ion.operation":"jwks.fetch","ion.outcome":"degraded",reason:"upstream_error",status:Te.status,contentType:be.contentType,excerpt:be.excerpt}),Error(`Failed to fetch JWKS (${Te.status})`)}let ve=await d(Te,{log:M,operation:"jwks.fetch"}),Ae=to(Te.headers.get("cache-control"));return As(A,{jwks:ve,expiresAt:Dr()+Ae,importedKeys:new Map}),ve},Mr.maxRetries,Mr.baseDelayMs,void 0,M)}catch(Te){let ve=Et.get(A);if(ve)return M?.warn("JWKS refresh failed; serving last-known-good keys",{"ion.operation":"jwks.refresh","ion.outcome":"degraded"}),ve.jwks;throw Te}finally{Ln.delete(A)}})();return Ln.set(A,Ie),Ie}function no(A){if(A){Et.delete(A),Ln.delete(A);return}Et.clear(),Ln.clear()}async function ro(A,M,N){return(await Ps(A,M,N)).jwk}async function Ps(A,M,N){if(!M?.trim())throw Error("JWT header missing kid");await Wn(A,N);let K=Et.get(A),te=K?.jwks.keys.find((Ie)=>Ie.kid===M);if(!te)await Wn(A,N,{forceRefresh:!0}),K=Et.get(A),te=K?.jwks.keys.find((Ie)=>Ie.kid===M);if(!K||!te)throw Error("Public key not found");return{jwk:te,entry:K}}async function jr(A,M,N,K,te){let{jwk:Ie,entry:Te}=await Ps(A,M,te),ve=`${M}\x00${N}`,Ae=Te.importedKeys.get(ve);if(Ae)return Ae;let be=K(Ie);return be.catch(()=>{if(Te.importedKeys.get(ve)===be)Te.importedKeys.delete(ve)}),Te.importedKeys.set(ve,be),be}async function so(A,M){let N=A.keys.find((K)=>K.kid===M);if(!N)throw Error("Public key not found");return Us(N)}function Us(A){return crypto.subtle.importKey("jwk",{kty:A.kty,n:A.n,e:A.e},{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"])}async function io(A,M,N){return jr(A,M,"rs256",Us,N)}var Ur={RS256:{kty:"RSA",importParams:{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},verifyParams:{name:"RSASSA-PKCS1-v1_5"}},ES256:{kty:"EC",crv:"P-256",importParams:{name:"ECDSA",namedCurve:"P-256"},verifyParams:{name:"ECDSA",hash:"SHA-256"}}};async function Nr(A,M,N,K){if(typeof N!=="string"||!(N in Ur))throw Error(`Unsupported JWT alg "${String(N)}" (allowed: ${Object.keys(Ur).join(", ")})`);let te=Ur[N];return{key:await jr(A,M,`oidc:${N}`,(Te)=>{if(Te.kty!==te.kty)throw Error(`JWK type "${Te.kty}" does not match token alg "${N}"`);if(te.kty==="EC"){let ve=Te;if(ve.crv!==te.crv)throw Error(`JWK curve "${String(ve.crv)}" does not match token alg "${N}"`);return crypto.subtle.importKey("jwk",{kty:"EC",crv:ve.crv,x:ve.x,y:ve.y},te.importParams,!1,["verify"])}return crypto.subtle.importKey("jwk",{kty:Te.kty,n:Te.n,e:Te.e},te.importParams,!1,["verify"])},K),algorithm:te.verifyParams}}function zt(A=32){let M=new Uint8Array(A);return crypto.getRandomValues(M),Array.from(M,(N)=>N.toString(16).padStart(2,"0")).join("").substring(0,A)}function nr(A){let M="";return A.forEach((N)=>{M+=String.fromCharCode(N)}),btoa(M).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function Ms(A){let M=A.replace(/-/g,"+").replace(/_/g,"/"),N=M.padEnd(M.length+(4-M.length%4)%4,"="),K=atob(N),te=new Uint8Array(K.length);for(let Ie=0;Ie<K.length;Ie++)te[Ie]=K.charCodeAt(Ie);return te}function Es(A){let M=new TextDecoder().decode(Ms(A));return JSON.parse(M)}async function Vn(A){let M=new TextEncoder().encode(A),N=await crypto.subtle.digest("SHA-256",M);return nr(new Uint8Array(N))}function $r(A){let M=new URL(A.authorizationUrl);if(M.searchParams.set("client_id",A.clientId),M.searchParams.set("redirect_uri",A.redirectUri),M.searchParams.set("response_type","code"),M.searchParams.set("scope",A.scope),M.searchParams.set("state",A.state),A.codeChallenge)M.searchParams.set("code_challenge",A.codeChallenge),M.searchParams.set("code_challenge_method","S256");if(A.nonce)M.searchParams.set("nonce",A.nonce);for(let[N,K]of Object.entries(A.extraParams??{}))M.searchParams.set(N,K);return M.toString()}async function Vr(A){let M=new URLSearchParams;if(M.append("grant_type","authorization_code"),M.append("code",A.code),M.append("redirect_uri",A.redirectUri),M.append("client_id",A.clientId),A.clientSecret)M.append("client_secret",A.clientSecret);if(A.codeVerifier)M.append("code_verifier",A.codeVerifier);let N=await fetch(A.tokenUrl,{method:"POST",headers:{...w,...l},body:M.toString()}),K=await d(N,{log:A.log,operation:"oidc.token.exchange"});if(!N.ok){let te=K,Ie=te.error==="invalid_client"&&!A.clientSecret;throw A.log?.error(Ie?"OIDC authorization-code exchange failed: no client_secret was configured; the provider may require a confidential client":"OIDC authorization-code exchange failed",{"ion.operation":"token.exchange","ion.outcome":"failure","http.status_code":N.status,oidc_error:te.error,...Ie?{client_auth:"none"}:{}}),Error(`Token exchange failed: ${te.error||N.statusText} - ${te.error_description||""}`.trim())}if(typeof K.access_token!=="string")throw Error("Token exchange response missing access_token");return K}var Os=60;function hn(A){return A.trim().replace(/\/$/,"")}var Lr="9188040d-6c67-4c5b-b112-36a304b66dad",oo=new Set(["common","organizations","consumers"]),ao=/^https:\/\/login\.microsoftonline\.com\/([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\/v2\.0$/i;function qr(A){let M=/^https:\/\/login\.microsoftonline\.com\/([^/]+)(?:\/v2\.0)?$/i.exec(hn(A));return M?oo.has(M[1].toLowerCase()):!1}function rr(A){let M=ao.exec(hn(A));return M?M[1].toLowerCase():void 0}function _s(A){let M=rr(A.iss);if(!M)return!1;if(A.tid!==void 0){if(typeof A.tid!=="string"||A.tid.toLowerCase()!==M)return!1}let N=A.allowedTenants??"any";if(N==="any")return!0;if(N==="consumers")return M===Lr;if(!Array.isArray(N)||N.length===0)return!1;return N.some((K)=>{let te=K.trim().toLowerCase();if(te==="consumers")return M===Lr;return te===M})}function js(A){let{claims:M,audience:N}=A,K=hn(A.issuer),te=A.nowSec??Math.floor(Date.now()/1000),Ie=A.clockSkewSec??Os,Te=M.iss;if(typeof Te!=="string")throw Error("ID token issuer mismatch");let ve=A.issuerPolicy??{mode:"exact"};if(!(hn(Te)===K||ve.mode==="microsoft-tenant"&&_s({iss:Te,tid:M.tid,allowedTenants:ve.allowedTenants})))throw Error("ID token issuer mismatch");let be=M.aud,He=Array.isArray(be)?be.includes(N):typeof be==="string"&&be===N,nt=typeof M.azp==="string"&&M.azp===N;if(!He&&!nt)throw Error("ID token audience mismatch");if(typeof M.exp!=="number")throw Error("ID token missing exp");if(M.exp<te-Ie)throw Error("ID token expired");if(A.expectedNonce!==void 0){if(M.nonce!==A.expectedNonce)throw Error("ID token nonce mismatch")}}async function Ns(A,M,N){let K=A.split(".");if(K.length!==3)throw Error("Invalid JWT");let te=Es(K[0]),Ie=Es(K[1]),Te=Ms(K[2]),{key:ve,algorithm:Ae}=await Nr(M,te.kid,te.alg,N),be=new TextEncoder().encode(`${K[0]}.${K[1]}`);if(!await crypto.subtle.verify(Ae,ve,Te,be))throw Error("Invalid JWT signature");return{header:te,payload:Ie}}async function on(A){let{payload:M}=await Ns(A.idToken,A.jwksUri,A.log);return js({claims:M,issuer:A.issuer,issuerPolicy:A.issuerPolicy,audience:A.audience,clockSkewSec:A.clockSkewSec,expectedNonce:A.expectedNonce}),M}var co="http://schemas.openid.net/event/backchannel-logout";async function zr(A){let{payload:M}=await Ns(A.logoutToken,A.jwksUri,A.log),N=hn(A.issuer),K=M.iss;if(typeof K!=="string"||hn(K)!==N)throw Error("Logout token issuer mismatch");let te=M.aud,Ie=Array.isArray(te)?te.includes(A.audience):typeof te==="string"&&te===A.audience,Te=typeof M.azp==="string"&&M.azp===A.audience;if(!Ie&&!Te)throw Error("Logout token audience mismatch");if(M.nonce!=null)throw Error("Logout token must not contain a nonce");let ve=M.events;if(!(typeof ve==="object"&&ve!==null&&!Array.isArray(ve)&&Object.hasOwn(ve,co)))throw Error("Logout token missing back-channel logout event");let be=typeof M.sid==="string"&&M.sid.length>0,He=typeof M.sub==="string"&&M.sub.length>0;if(!be&&!He)throw Error("Logout token missing sid and sub");if(typeof M.exp==="number"){let nt=Math.floor(Date.now()/1000),dt=A.clockSkewSec??Os;if(M.exp<nt-dt)throw Error("Logout token expired")}return M}var uo=3600000,lo=60000,po=86400000,mo=256,tn=new Map,$n=new Map;function Ds(A,M){tn.delete(A),tn.set(A,M);while(tn.size>mo){let N=tn.keys().next().value;if(N===void 0)break;tn.delete(N)}}var Wr=()=>Date.now();function fo(A){Wr=A??(()=>Date.now())}function go(A){if(A){tn.delete(A),$n.delete(A);return}tn.clear(),$n.clear()}function yo(A){let M=A?/max-age\s*=\s*(\d+)/i.exec(A):null,N=M?Number(M[1]):Number.NaN,K=Number.isFinite(N)?N*1000:uo;return Math.min(Math.max(K,lo),po)}async function sr(A){let M=tn.get(A);if(M&&M.expiresAt>Wr())return Ds(A,M),M.endpoints;let N=$n.get(A);if(N)return N;let K=(async()=>{try{let te=A.replace(/\/$/,""),Ie=await fetch(`${te}/.well-known/openid-configuration`,{headers:l});if(!Ie.ok)throw Error(`OIDC discovery failed for ${A} with status ${Ie.status}`);let Te=await d(Ie),ve={authorizationUrl:typeof Te.authorization_endpoint==="string"?Te.authorization_endpoint:void 0,tokenUrl:typeof Te.token_endpoint==="string"?Te.token_endpoint:void 0,jwksUri:typeof Te.jwks_uri==="string"?Te.jwks_uri:void 0,userInfoUrl:typeof Te.userinfo_endpoint==="string"?Te.userinfo_endpoint:void 0};return Ds(A,{endpoints:ve,expiresAt:Wr()+yo(Ie.headers.get("cache-control"))}),ve}catch(te){let Ie=tn.get(A);if(Ie)return Ie.endpoints;throw te}finally{$n.delete(A)}})();return $n.set(A,K),K}async function Br(A,M){let N=await fetch(A,{headers:{Authorization:`Bearer ${M}`,...l,"User-Agent":"ionite-ciam"}});if(!N.ok)throw Error(`UserInfo request failed with status ${N.status}`);return await d(N)}function ho(A){let M=A.replace(/-----BEGIN [^-]+-----/g,"").replace(/-----END [^-]+-----/g,"").replace(/\s+/g,""),N=atob(M),K=new Uint8Array(N.length);for(let te=0;te<N.length;te++)K[te]=N.charCodeAt(te);return K}async function Gr(A){let M=Math.floor(Date.now()/1000),N={alg:"ES256",kid:A.keyId,typ:"JWT"},K={iss:A.teamId,iat:M,exp:M+(A.expiresInSeconds??3600),aud:"https://appleid.apple.com",sub:A.clientId},te=nr(new TextEncoder().encode(JSON.stringify(N))),Ie=nr(new TextEncoder().encode(JSON.stringify(K))),Te=`${te}.${Ie}`,ve=await crypto.subtle.importKey("pkcs8",ho(A.privateKey),{name:"ECDSA",namedCurve:"P-256"},!1,["sign"]),Ae=await crypto.subtle.sign({name:"ECDSA",hash:"SHA-256"},ve,new TextEncoder().encode(Te));return`${Te}.${nr(new Uint8Array(Ae))}`}function ko(A){for(let M=0;M<A.length;M++){let N=A.charCodeAt(M);if(N<=31||N===127)return!0}return!1}function So(A,M){let N=null;try{N=new URL(A,M)}catch{N=null}let K="";try{K=new URL(M).origin}catch{K=""}return{candidate:A,url:N,requestOrigin:K}}function Ls(A,M,N){let K=So(A,N),te=!1;for(let Ie of M){let Te=Ie(K);if(Te==="deny")return!1;if(Te==="allow")te=!0}return te}function Ws(){return({candidate:A,url:M})=>{if(ko(A))return"deny";if(A.includes("\\"))return"deny";if(A.startsWith("//"))return"deny";if(!M)return"deny";if(M.protocol!=="http:"&&M.protocol!=="https:")return"deny";if(M.username||M.password)return"deny";return"abstain"}}function $s(){return({candidate:A})=>A.startsWith("/")&&!A.startsWith("//")&&!A.startsWith("/\\")?"allow":"abstain"}function Vs(){return({url:A,requestOrigin:M})=>A&&M&&A.origin===M?"allow":"abstain"}function wo(...A){let M=new Set(A.map((N)=>{try{return new URL(N).origin}catch{return N}}));return({url:N})=>N&&M.has(N.origin)?"allow":"abstain"}function bo(...A){let M=A.map((N)=>N.toLowerCase());return({url:N})=>{if(!N)return"abstain";let K=N.hostname.toLowerCase();for(let te of M)if(te.startsWith(".")){if(K===te.slice(1)||K.endsWith(te))return"allow"}else if(K===te)return"allow";return"abstain"}}function Kr(){return[Ws(),$s(),Vs()]}function qs(A,M,N){if(!A)return!1;return Ls(A,M,N)}function Hr(A,M){if(!A)return M.fallback;return Ls(A,M.rules,M.requestUrl)?A:M.fallback}var Co={rules:Kr(),fallback:"/"};function vo(A,M,N="redirect"){let K=new URL(A.url).searchParams.get(N)??void 0;return qs(K,M.rules,A.url)?{redirect:K}:void 0}function Ro(A,M){let N=A.context;return Hr(N?.redirect,{rules:M.rules,fallback:M.fallback,requestUrl:A.request.url})}function an(A,M,N){if(A instanceof Response)return{response:A};if(typeof A==="string")return{location:Hr(A,{rules:Kr(),fallback:M,requestUrl:N})};return{location:M}}function kn(A,M){if(M.length===0)return A;let N=new Headers(A.headers);for(let K of M)N.append("Set-Cookie",K);return new Response(A.body,{status:A.status,statusText:A.statusText,headers:N})}var ir="ciam",Io="id_token",Ao="access_token";function To(A,M,N,K,te,Ie){if(!N&&!K)return;let Te=new WeakMap,ve={...N,...K},Ae={...ve,magicLinkTtl:ve.magicLinkTtl??3600,sessionTtl:ve.sessionTtl??86400,cookiesSecure:ve.cookiesSecure!==void 0?ve.cookiesSecure:!0,cookiesSameSite:ve.cookiesSameSite!==void 0?ve.cookiesSameSite:"Strict",cookiesPrefix:ve.cookiesPrefix??(ve.ciamId?`ion.ciam.${ve.ciamId}`:"ion.ciam"),cookiesPath:ve.cookiesPath??"/",cookiesDomain:tr(ve.cookiesDomain)};function be(){if(!Ae.sessionStore)throw Error("Missing CIAM configuration field: sessionStore. CIAM sessionStore is required for server-side session tracking and first-party logout.");return Ae.sessionStore}function He(){be()}let nt=A.callbackParams??m(ge("ionite.ciam")),dt=A.idTokenClaims??m(T("ionite.ciam")),at=A.tokenResponse??m(ye("ionite.ciam"));function Ke(re=32){let Re=new Uint8Array(re);return crypto.getRandomValues(Re),Array.from(Re,(De)=>De.toString(16).padStart(2,"0")).join("").substring(0,re)}function Ze(re,Re,De,Ue=Ae.cookiesSameSite??"Strict"){if(!Ae)throw Error("ionite CIAM Manager not initialized");if(re=`${Ae.cookiesPrefix}.${re}`,typeof Re!=="string")Re=btoa(JSON.stringify(Re));let Me;if(De instanceof Date)Me=`Expires=${De.toUTCString()}`;else if(typeof De==="number")Me=`Max-Age=${De}`;else throw Error("Invalid expires type",De);if(Re.length>4000)throw Error(`Error setting cookie: ${re}. Cookie length is: ${Re.length}`);return`${re}=${Re}; ${Me}; Path=${Ae.cookiesPath};${sn(Ae.cookiesDomain)} HttpOnly;${Ae.cookiesSecure?" Secure;":""} SameSite=${Ue};`}function ot(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");return`${Ae.cookiesPrefix}.${re}=; Max-Age=0; Path=${Ae.cookiesPath};${sn(Ae.cookiesDomain)} HttpOnly;${Ae.cookiesSecure?" Secure;":""} SameSite=${Ae.cookiesSameSite};`}function ct(re,Re,De=!1){if(!Ae)throw Error("ionite CIAM Manager not initialized");let Ue=Re.headers.get("cookie");if(!Ue)return null;let Me=`${Ae.cookiesPrefix}.${re}`,We=Ue.split(";").find((Ve)=>Ve.trim().startsWith(`${Me}=`));if(!We)return null;let $e=We.indexOf("="),ze=We.substring($e+1).trim();if(!De)return ze;try{let Ve=atob(ze);return JSON.parse(Ve)}catch(Ve){return M.error("[CIAM] Failed to parse cookie",{"ion.operation":"cookie.parse","ion.outcome":"failure",cookieName:Me},Ve),null}}function lt(re){return`cstate_${re}`}async function Ne(re,Re,De,Ue){let Me=await Ae.afterLogin?.({...Re,request:re,context:De,displayCookie:Ae.displayCookie,displayCookieAttributes:St()}),We=an(Me,"/",re.url);if(We.response)return kn(We.response,Ue.map(([,$e])=>$e));return new Response(Re.ok?"Authentication successful, redirecting":"Authentication failed, redirecting",{status:302,headers:[["Location",We.location],...Ue]})}function ft(re,Re){return["Set-Cookie",Ze("session",re,Re)]}function St(){return{path:Ae.cookiesPath??"/",domain:Ae.cookiesDomain,secure:Ae.cookiesSecure!==!1,sameSite:Ae.cookiesSameSite??"Strict"}}function bt(){return[["Set-Cookie",ot("session")],["Set-Cookie",en(`${Ae.cookiesPrefix}.profile`,St())]]}function Ut(re){if(Ae.displayCookie?.enabled===!0)return[];return xn(re.headers.get("cookie"),Ae.cookiesPrefix??"ion.ciam",St()).map((Re)=>["Set-Cookie",Re])}async function Ft(re,Re,De){return(await Nn({cookieHeader:re.headers.get("cookie"),sessionStore:Ae.sessionStore,cookiesPrefix:Ae.cookiesPrefix??"ion.ciam",authType:"ciam",tenantId:Ae.tenantId,expiresAt:De,user:Re,projector:Ae.displayUser,displayCookie:Ae.displayCookie,trim:Ae.trimDisplayCookies,attr:St()})).map((Me)=>["Set-Cookie",Me])}function Yt(re){if(!re)return;if(re instanceof Date)return re;let Re=new Date(re);return Number.isNaN(Re.getTime())?void 0:Re}async function En(re){let Re=ct("session",re);if(!Re)return;let De=await be().get(Re);if(De&&Ae.tenantId&&De.tenantId&&De.tenantId!==Ae.tenantId)return;if(De?.authType!=="ciam")return;let Ue=Yt(De.expiresAt);if(Ue&&Date.now()>Ue.getTime()){await be().delete(Re);return}return De}async function Cn(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");He();let Re=Te.get(re);if(Re)return Re;let De=pn(re);return Te.set(re,De),De}async function pn(re){try{let Re=await En(re);if(!Re?.claims?.sub)return{status:"unauthenticated"};return _n(re,"customer",Re.entitlements),{status:"authenticated",value:Lt(Re.claims)}}catch(Re){return M.error("CIAM session resolution failed",{"ion.operation":"ciam.session","ion.outcome":"degraded"},Re),{status:"degraded",error:Re instanceof Error?Re:void 0}}}async function nn(re){let Re=await Cn(re);return Re.status==="authenticated"?Re.value:void 0}async function Mt(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");He();let Re;try{Re=await nn(re)}catch{Re=void 0}let De=await Ae.beforeLogout?.({request:re,user:Re});try{let rt=ct("session",re);if(rt)await be().delete(rt)}catch(rt){M.warn("Failed to delete CIAM session",{"ion.operation":"session.delete","ion.outcome":"degraded"},rt)}let Ue=bt(),Me=await Ae.afterLogout?.({request:re,context:De}),We=an(Me,"/",re.url);if(We.response)return kn(We.response,Ue.map(([,rt])=>rt));let $e=We.location??"/",ze=re.headers.get("accept");if(ze?.includes(a)||ze?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:$e}),{status:200,headers:[["Content-Type",a],...Ue]});return new Response("Logged out",{status:302,headers:[["Location",$e],...Ue]})}function mn(re){return re.id||re.email||`ciam-${re.userName}`}function fn(re,Re,De){return{sub:mn(re),iss:ir,aud:ir,typ:Io,exp:Math.floor(De.getTime()/1000),iat:Math.floor(Date.now()/1000),email:re.email,name:re.name,preferred_username:re.userName,picture:re.avatar,sid:Re}}function vn(re,Re,De){return{sub:re,iss:ir,aud:ir,typ:Ao,exp:Math.floor(De.getTime()/1000),iat:Math.floor(Date.now()/1000),sid:Re,scope:"openid profile email"}}function Lt(re){let Re=re.exp?new Date(re.exp*1000):new Date;return{id:re.sub,userName:re.preferred_username??"",name:re.name??"",email:re.email??"",avatar:re.picture,userType:"customer",ciam:{profile:re,scope:"openid profile email",tokenType:"Bearer",expires:Re}}}async function Dn(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");if(!te)return new Response(JSON.stringify({error:"Workload authentication required"}),{status:401,headers:i});let Re=await te.getWorkloadIdentity(re);if(!Re||Re.delegate)return new Response(JSON.stringify({error:"Unauthorized: Valid workload token required"}),{status:401,headers:i});let De,Ue;try{if(!re.headers.get("content-type")?.includes(a))return new Response(JSON.stringify({error:"Content-Type must be application/json"}),{status:400,headers:i});let Be=await re.text(),Le=JSON.parse(Be);Ue=typeof Le?.redirect==="string"&&Le.redirect.length>0?Le.redirect:void 0;let qe={userName:Le.userName,name:Le.name,email:Le.email,avatar:Le.avatar},Fe=await A.customer.validate(qe);if(Fe.issues)return new Response(JSON.stringify({error:"Missing required fields: userName, name, email"}),{status:400,headers:i});De=Fe.value}catch(Ee){return new Response(JSON.stringify({error:"Invalid JSON in request body"}),{status:400,headers:i})}let We=new URL(re.url).searchParams.get("ttl"),$e=We?parseInt(We,10):Ae.magicLinkTtl??3600;if(Number.isNaN($e)||$e<=0)return new Response(JSON.stringify({error:"Invalid TTL parameter"}),{status:400,headers:i});let ze=Ke(32),Ve=new Date(Date.now()+$e*1000);if(!Ae.magicLinkStore)return new Response(JSON.stringify({error:"Magic link store not configured"}),{status:501,headers:i});try{await Ae.magicLinkStore.create(ze,De,Ve)}catch(Ee){return M.error("Error creating magic link",{"ion.operation":"magic_link.create","ion.outcome":"failure"},Ee),new Response(JSON.stringify({error:"Failed to create magic link"}),{status:500,headers:i})}let rt=new URL(re.url),ut=Ae.magicLinkLoginUrl||"/magic-link/login",Oe=new URL(ut,rt.origin);if(Oe.searchParams.set("token",ze),Ue)Oe.searchParams.set("redirect",Ue);return new Response(JSON.stringify({magicLink:Oe.toString(),expiresAt:Ve.toISOString()}),{status:200,headers:i})}async function Rn(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");He();let De=new URL(re.url).searchParams.get("token");if(!De)return Ne(re,{ok:!1,error:Error("Missing magic-link token")},void 0,[]);if(!Ae.magicLinkStore)return Ne(re,{ok:!1,error:Error("Magic link store not configured")},void 0,[]);let Ue=await Ae.magicLinkStore.getAndDelete(De);if(!Ue)return Ne(re,{ok:!1,error:Error("Magic link invalid, expired, or already used")},void 0,[]);let Me=new Date(Date.now()+(Ae.sessionTtl??86400)*1000),We=Ke(32),$e=mn(Ue.customer),ze=fn(Ue.customer,We,Me),Ve=vn($e,We,Me),rt=Lt(ze),ut;try{let Ee={sid:We,sub:$e,authType:"ciam",tenantId:Ae.tenantId,expiresAt:Me,claims:ze,accessClaims:Ve,createdAt:new Date};await be().create(Ee),ut=Ee}catch(Ee){throw M.warn("Failed to create session",{"ion.operation":"session.create","ion.outcome":"degraded"},Ee),Ee}if(Ae.customerStore)try{let Ee=rt.id;if(Ee){let Be=new Date,Le=await Ae.customerStore.get(Ee);if(Le||Ae.enableJitUserProvisioning){let qe={...Le??{},...rt,id:Ee,tenantId:Le?.tenantId,createdAt:Le?.createdAt??Be,updatedAt:Be,userType:Le?.userType??"customer"};await Ae.customerStore.upsert(qe)}}}catch(Ee){M.warn("Failed to store customer",{"ion.operation":"customer.store","ion.outcome":"degraded"},Ee)}let Oe=[ft(We,Me),...await Ft(re,rt,Me)];return Ne(re,{ok:!0,user:rt,session:ut},void 0,Oe)}function Gt(re,Re=200,De=[]){return new Response(JSON.stringify(re),{status:Re,headers:[["Content-Type",a],...De]})}function Wt(re,Re){try{return new URL(re).toString()}catch{let De=new URL(Re).origin,Ue=Ae.cookiesSecure?De.replace(/^http:\/\//,"https://"):De;return new URL(re,Ue).toString()}}function gn(){let re=Ae.customerLoginUrl||"/auth/customer/login",Re=re.includes("?")?"&":"?";return Ar(Ae.providers).map(({name:De,config:Ue})=>{let Me=Ir(Ue);return{name:De,type:Ue.type,displayName:Me.displayName,loginUrl:`${re}${Re}provider=${encodeURIComponent(De)}`,iconUrl:Me.iconUrl,colors:Me.colors,url:Me.url}})}async function Xt(re){if(!re)return{};let{authorizationUrl:Re,tokenUrl:De,jwksUri:Ue,userInfoUrl:Me}=re,We=re.authority;if(We&&(!Re||!De||re.flow==="id_token"&&!Ue))try{let ze=await sr(We);Re=Re??ze.authorizationUrl,De=De??ze.tokenUrl,Ue=Ue??ze.jwksUri,Me=Me??ze.userInfoUrl}catch(ze){M.error("CIAM provider OIDC discovery failed",{"ion.operation":"ciam.oidc.discovery","ion.outcome":"failure"},ze)}return{authorizationUrl:Re,tokenUrl:De,jwksUri:Ue,userInfoUrl:Me}}function $t(re,Re){if(re.type!=="microsoft"||!qr(Re))return{mode:"exact"};return{mode:"microsoft-tenant",allowedTenants:re.config.allowedTenants??"any"}}async function Dt(re,Re){let De=In(re),Ue=typeof De?.iss==="string"?De.iss:void 0,Me=Ue?rr(Ue):void 0;if(!Me)return Re;try{let We=await sr(`https://login.microsoftonline.com/${Me}/v2.0`);if(We.jwksUri)return We.jwksUri}catch(We){M.warn("CIAM tenant-scoped OIDC discovery failed; falling back to configured JWKS",{"ion.operation":"ciam.oidc.discovery","ion.outcome":"failure"},We)}return Re}async function Ot(re){if(re.type==="apple"){let{teamId:Re,keyId:De,privateKey:Ue,clientId:Me}=re.config;if(Re&&De&&Ue&&Me)return Gr({teamId:Re,keyId:De,privateKey:Ue,clientId:Me})}return re.clientSecret}async function Zt(re){be();let De=new URL(re.url).searchParams.get("provider");if(!De)return Gt({error:"Missing required query parameter: provider"},400);let Ue=Ae.providers?.[De];if(!Ue||Ue.enabled===!1||Ue.type==="magic-link")return Gt({error:`Unknown or disabled CIAM provider: ${De}`},404);let Me=Zn(De,Ue);if(!Me?.clientId)return Gt({error:`CIAM provider ${De} is not fully configured`},500);let We=await Xt(Me);if(!We.authorizationUrl)return Gt({error:`CIAM provider ${De} is missing an authorization endpoint`},500);let $e=Ae.customerCallbackUrl||"/auth/customer/callback",ze=Wt($e,re.url),Ve=zt(),rt=zt(64),ut=zt(),Oe=Me.flow==="id_token",Ee=Oe?await Vn(rt):void 0,Be=await Ae.beforeLogin?.({request:re}),Le=$r({authorizationUrl:We.authorizationUrl,clientId:Me.clientId,redirectUri:ze,scope:Me.scope,state:Ve,codeChallenge:Ee,nonce:ut,extraParams:Me.extraAuthParams}),qe={provider:De,state:Ve,codeVerifier:Oe?rt:void 0,nonce:ut,redirectUri:ze,...Be===void 0?{}:{context:Be}};return new Response("Redirecting to CIAM provider",{status:302,headers:[["Location",Le],["Set-Cookie",Ze(lt(Ve),qe,Ae.loginStateTtl??600,"Lax")]]})}async function Kt(re){if(re.method==="POST"){if((re.headers.get("content-type")??"").includes(L)){let De=await re.text();return Object.fromEntries(new URLSearchParams(De).entries())}}return Object.fromEntries(new URL(re.url).searchParams.entries())}let _t=!1;async function rn(re,Re,De,Ue){let Me=re.config.claimsAsEntitlements;if(!Me?.claims?.length||re.type==="magic-link")return;if(Ae.sessionStore?.capabilities?.derivedEntitlements!==!0){if(!_t)_t=!0,M.warn("CIAM claims entitlements are configured but the session store does not persist them",{"ion.event":"ion.ciam.claims.incapable","ion.module":"ciam","ion.outcome":"degraded"});return}return On({block:Me,claims:Re,accessClaims:In(Ue),subjectType:"customer",subjectId:De,catalog:Ie?.catalogView?.(),log:M})}async function yn(re,Re,De){let Ue=re.mapClaims(Re);if(!Ue.sub)return{ok:!1};let Me=`${re.name}:${Ue.sub}`,We={id:Me,userName:Ue.userName||Ue.email||Me,name:Ue.name||"",email:Ue.email||"",avatar:Ue.avatar,userType:"customer"},$e=Me;if(Ae.customerStore){let Ee=await Ae.customerStore.lookup(We)??await Ae.customerStore.get(Me);if($e=Ee?.id??Me,!Ee&&!Ae.enableJitUserProvisioning)return M.warn("CIAM JIT customer provisioning disabled: unknown customer rejected",{"ion.operation":"customer.store","ion.outcome":"skipped"}),{ok:!1};let Be=new Date,Le={...Ee??{},...We,id:$e,tenantId:Ee?.tenantId,createdAt:Ee?.createdAt??Be,updatedAt:Be,userType:Ee?.userType??"customer"};await Ae.customerStore.upsert(Le)}let ze=new Date(Date.now()+(Ae.sessionTtl??86400)*1000),Ve=zt(32),rt={sub:$e,iss:re.name,aud:re.clientId,exp:Math.floor(ze.getTime()/1000),iat:Math.floor(Date.now()/1000),email:Ue.email,name:Ue.name,preferred_username:Ue.userName??Ue.email,picture:Ue.avatar,sid:Ve},ut={sid:Ve,sub:$e,authType:"ciam",tenantId:Ae.tenantId,expiresAt:ze,claims:rt,accessClaims:{sub:$e,sid:Ve,scope:re.scope},entitlements:await rn(re,Re,$e,De),createdAt:new Date},Oe=be();try{await Oe.create(ut)}catch(Ee){if(!await Oe.get(Ve))throw Ee;await Oe.update(Ve,ut)}return{ok:!0,claims:rt,sid:Ve,expires:ze}}async function Je(re){be();let Re,De,Ue=(Me)=>{let We=Re?[["Set-Cookie",ot(Re)]]:[];return Ne(re,{ok:!1,error:Me},De,We)};try{let Me=await Kt(re),We=await nt.validate(Me);if(We.issues||!We.value)return Ue(Error("Invalid CIAM callback parameters"));let{code:$e,state:ze}=We.value;if(!ze)return Ue(Error("Missing CIAM callback state"));Re=lt(ze);let Ve=ct(Re,re,!0);if(De=Ve?.context,!Ve?.provider||!Ve.state||Ve.state!==ze)return M.warn("CIAM callback state verification failed",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),Ue(Error("CIAM callback state verification failed"));let rt=Ae.providers?.[Ve.provider];if(!rt)return Ue(Error("Unknown CIAM provider"));let ut=Zn(Ve.provider,rt);if(!ut?.clientId)return Ue(Error("CIAM provider not configured"));let Oe=await Xt(ut);if(!Oe.tokenUrl)return Ue(Error("CIAM provider missing token endpoint"));let Ee=await Ot(ut),Be=await Vr({tokenUrl:Oe.tokenUrl,clientId:ut.clientId,clientSecret:Ee,redirectUri:Ve.redirectUri||Wt(Ae.customerCallbackUrl||"/auth/customer/callback",re.url),code:$e,codeVerifier:ut.flow==="id_token"?Ve.codeVerifier:void 0,log:M}),Le;if(ut.flow==="id_token"){let it=ut.authority;if(!Be.id_token||!Oe.jwksUri||!it)return Ue(Error("CIAM id_token flow misconfigured"));if(!Ve.nonce)return Ue(Error("CIAM callback state cookie missing nonce"));if((await at.validate(Be)).issues)return M.warn("CIAM token response validation failed",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),Ue(Error("CIAM token response validation failed"));let Ye=$t(ut,it),et=Ye.mode==="microsoft-tenant"?await Dt(Be.id_token,Oe.jwksUri):Oe.jwksUri;Le=await on({idToken:Be.id_token,jwksUri:et,issuer:it,issuerPolicy:Ye,audience:ut.clientId,expectedNonce:Ve.nonce,log:M});let mt=await dt.validate(Le);if(!mt.issues)Le=mt.value}else{if(!Oe.userInfoUrl)return Ue(Error("CIAM provider missing userinfo endpoint"));Le=await Br(Oe.userInfoUrl,Be.access_token);let it=ut.authority;if(Be.id_token&&Oe.jwksUri&&it){let st=$t(ut,it),Ye=st.mode==="microsoft-tenant"?await Dt(Be.id_token,Oe.jwksUri):Oe.jwksUri,et=await on({idToken:Be.id_token,jwksUri:Ye,issuer:it,issuerPolicy:st,audience:ut.clientId,expectedNonce:Ve.nonce||void 0,log:M}),mt=typeof et.sub==="string"?et.sub:"";if(mt){if(typeof Le.sub==="string"&&Le.sub.length>0&&Le.sub!==mt)return M.warn("CIAM UserInfo sub does not match verified id_token sub",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),Ue(Error("CIAM UserInfo sub mismatch"));Le.sub=mt}}if(typeof Le.sub!=="string"||Le.sub.length===0)return M.warn("CIAM UserInfo response missing sub",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"}),Ue(Error("CIAM UserInfo response missing sub"))}let qe=await yn(ut,Le,Be.access_token);if(!qe.ok)return Ue(Error("Failed to persist CIAM customer"));let Fe=Lt(qe.claims);M.info("CIAM third-party sign-in succeeded",{"ion.operation":"ciam.oidc.callback","ion.outcome":"success",provider:ut.name});let tt=[["Set-Cookie",ot(Re)],ft(qe.sid,qe.expires),...await Ft(re,Fe,qe.expires)];return Ne(re,{ok:!0,user:Fe,session:void 0},De,tt)}catch(Me){return M.error("Error during CIAM third-party sign-in callback",{"ion.operation":"ciam.oidc.callback","ion.outcome":"failure"},Me),Ue(Me)}}async function xe(re){if(!Ae)throw Error("ionite CIAM Manager not initialized");He();let Re=Ae.magicLinkUrl||"/magic-link",De=Ae.magicLinkLoginUrl||"/magic-link/login",Ue=Ae.logoutUrl||"/auth/customer/logout",Me=Ae.customerLoginUrl||"/auth/customer/login",We=Ae.customerCallbackUrl||"/auth/customer/callback",$e=Ae.customerProvidersUrl||"/auth/customer/providers",ze=new URL(re.url).pathname,Ve=(qe)=>{if(!qe)return;try{return new URL(qe).pathname}catch{return qe.startsWith("/")?qe:`/${qe}`}};if(Ve(Re)===ze&&re.method==="POST")return Dn(re);if(Ve(De)===ze&&re.method==="GET")return Rn(re);if(Ve(Ue)===ze&&re.method==="GET")return Mt(re);if(Ve($e)===ze&&re.method==="GET")return Gt({providers:gn()});if(Ve(Me)===ze&&re.method==="GET")return Zt(re);if(Ve(We)===ze&&(re.method==="GET"||re.method==="POST"))return Je(re);return new Response("Not Found",{status:404})}async function Pe(re){if((Ae.userEndpoint??"full")==="off")return new Response("Not Found",{status:404,headers:Ut(re)});let Re=await Cn(re);if(Re.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:i});if(Re.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:i});let De=Yt(Re.value.ciam?.expires),Ue=Ae.displayCookie?.enabled===!0?De&&!ct("profile",re)?await Ft(re,Re.value,De):[]:Ut(re),Me=Ae.userEndpoint==="display"?g(Re.value,Ae.displayUser):Re.value;return new Response(JSON.stringify(Me),{headers:[["Content-Type",a],...Ue]})}let _e;return _e={...Ae,describe:()=>({module:"ciam",active:!0,ready:_e.isReady?.()??!0,magicLinkTtl:Ae.magicLinkTtl,loginStateTtl:Ae.loginStateTtl,sessionTtl:Ae.sessionTtl,cookies:{prefix:Ae.cookiesPrefix,path:Ae.cookiesPath,secure:Ae.cookiesSecure,sameSite:Ae.cookiesSameSite,domain:Ae.cookiesDomain},displayCookie:Ae.displayCookie,jit:{enabled:Ae.enableJitUserProvisioning===!0,customerStore:Ae.customerStore!==void 0},sessionStore:Ae.sessionStore!==void 0,magicLinkStore:Ae.magicLinkStore!==void 0,providers:Object.entries(Ae.providers??{}).map(([re,Re])=>({name:re,type:Re.type,enabled:Re.enabled!==!1,order:Re.order,branding:Re.branding,authority:Re.authority,authorizationUrl:Re.authorizationUrl,tokenUrl:Re.tokenUrl,jwksUri:Re.jwksUri,userInfoUrl:Re.userInfoUrl,clientId:Re.clientId,scope:Re.scope,...Re.claimsAsEntitlements?.claims?.length?{claimsAsEntitlements:{claims:[...Re.claimsAsEntitlements.claims],expand:Re.claimsAsEntitlements.expand===!0,resources:Re.claimsAsEntitlements.expand===!0&&Re.claimsAsEntitlements.resources===!0,capable:Ae.sessionStore?.capabilities?.derivedEntitlements===!0}}:{},loginUrl:`${Ae.customerLoginUrl??""}?provider=${encodeURIComponent(re)}`})),urls:{magicLinkUrl:Ae.magicLinkUrl??"",magicLinkLoginUrl:Ae.magicLinkLoginUrl??"",customerUrl:Ae.customerUrl??"",customerLoginUrl:Ae.customerLoginUrl??"",customerCallbackUrl:Ae.customerCallbackUrl??"",customerProvidersUrl:Ae.customerProvidersUrl??"",logoutUrl:Ae.logoutUrl??""}}),getCustomer:nn,resolveCustomer:Cn,logout:Mt,handler:xe,customerHandler:Pe,listCustomerProviders:gn},_e}async function xo(A,M){if(e(M,"Ionite instance is required. Create one with ionite(source, config) and pass it to this function."),M.delegate.hasCredential(A)){let N=await M.delegate.resolve(A);return N&&er(N)}return M.ciam?.getCustomer(A)}async function or(A,M){if(e(M,"Ionite instance is required. Create one with ionite(source, config) and pass it to this function."),M.delegate.hasCredential(A))return jn(M.delegate,A,er);return await M.ciam?.resolveCustomer(A)??{status:"unauthenticated"}}var Po="urn:ietf:params:scim:schemas:core:2.0:User",zs="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",Uo="urn:ietf:params:scim:schemas:core:2.0:Group";function Jr(A,M,N){let te=(M==="group"?A.resources:void 0)?.map((Ie)=>typeof Ie==="string"?Ie:Ie.id).filter(Boolean);return{schemas:[Uo,t],id:A.id,externalId:A.providerId,displayName:A.displayName??A.name,members:N,[t]:{type:M,requestable:A.requestable,riskLevel:A.riskLevel??y,providerId:A.providerId,requestUrl:A.requestUrl,source:A.source,deprecated:A.deprecated,description:A.description,resources:te&&te.length>0?te:void 0,assignableSubjectTypes:A.assignableSubjectTypes,recommendedSubjectTypes:A.recommendedSubjectTypes,attributes:c(A,p)}}}function Eo(A){if(A.scimName)return A.scimName;if(!A.name)return;let[M,...N]=A.name.split(" ");return{givenName:M,familyName:N.join(" ")||void 0}}function Do(A){let M={attributes:c(A,x)};if(A.ecid!==void 0)M.ecid=A.ecid;if(A.accountClass!==void 0)M.accountClass=A.accountClass;return M.ecid!==void 0||M.accountClass!==void 0||M.attributes!==void 0?M:void 0}function Mo(A){return Object.keys(A.scimSchemaExtensions??{}).filter((M)=>M.startsWith("urn:")&&A.scimSchemaExtensions?.[M]!==void 0)}function Fr(A){let M=A.userName||A.email||A.id||"",N=A.emails??(A.email?[{value:A.email,primary:!0}]:[]),K=new Set([Po]);if(A.scimEnterprise!==void 0)K.add(zs);let te=Do(A);if(te!==void 0)K.add(o);for(let Te of Mo(A))K.add(Te);let Ie={};if(A.scimEnterprise!==void 0)Ie[zs]=A.scimEnterprise;if(te!==void 0)Ie[o]=te;for(let[Te,ve]of Object.entries(A.scimSchemaExtensions??{}))if(Te.startsWith("urn:")&&Te!==o&&ve!==void 0)Ie[Te]=ve;return{schemas:Array.from(K),id:A.id,externalId:A.externalId,userName:M,displayName:A.displayName??A.name??M,name:Eo(A),nickName:A.nickName,profileUrl:A.avatar,title:A.title,userType:A.userType,preferredLanguage:A.preferredLanguage,locale:A.locale,timezone:A.timezone,active:A.active??!0,emails:N,phoneNumbers:A.phoneNumbers,ims:A.ims,photos:A.photos,addresses:A.addresses,groups:A.groups,entitlements:A.entitlements,roles:A.roles,x509Certificates:A.x509Certificates,meta:{resourceType:"User",created:(A.createdAt??A.updatedAt??new Date).toISOString(),lastModified:(A.updatedAt??A.createdAt??new Date).toISOString()},...Ie}}function Yr(A){return{schemas:[S],id:A.id,externalId:A.externalId,userName:A.clientId??A.id,displayName:A.displayName??A.clientId??A.id,description:A.description,active:A.active??!0,ecid:A.ecid,providerId:A.providerId,requestUrl:A.requestUrl,attributes:c(A,P),meta:{resourceType:"Workload",created:(A.createdAt??A.updatedAt??new Date).toISOString(),lastModified:(A.updatedAt??A.createdAt??new Date).toISOString()}}}function Xr(A){return{schemas:[k],id:A.id,externalId:A.externalId??A.id,userName:A.userName??A.email??A.id,displayName:A.displayName??A.name??A.userName??A.id,active:A.active??!0,emails:A.emails??(A.email?[{value:A.email,primary:!0}]:void 0),providerId:A.providerId,requestUrl:A.requestUrl,attributes:c(A,E),meta:{resourceType:"Customer",created:(A.createdAt??A.updatedAt??new Date).toISOString(),lastModified:(A.updatedAt??A.createdAt??new Date).toISOString()}}}function Bs(A){return{value:A.id,type:A.type==="user"?"User":A.type==="customer"?"Customer":"Workload"}}function Zr(A){return{schemas:[b],id:A.id,externalId:A.externalId??A.id,userName:A.id,displayName:A.label??A.clientId??A.id,active:A.active??!0,owner:Bs(A.owner),clientId:A.clientId,expiresAt:A.expiresAt?.toISOString(),lastUsedAt:A.lastUsedAt?.toISOString(),providerId:A.providerId,requestUrl:A.requestUrl,meta:{resourceType:"Delegate",created:(A.createdAt??A.updatedAt??new Date).toISOString(),lastModified:(A.updatedAt??A.createdAt??new Date).toISOString()}}}function cn(A){return{enabled:A?.enabled!==!1,assignment:A?.assignment??"app",delta:A?.delta}}var Oo="urn:ietf:params:scim:api:messages:2.0:ListResponse",ss="urn:ietf:params:scim:api:messages:2.0:Error",is="urn:ietf:params:scim:schemas:core:2.0:User",Kn="urn:ietf:params:scim:schemas:extension:enterprise:2.0:User",os="urn:ietf:params:scim:schemas:core:2.0:Group",_o="urn:ietf:params:scim:schemas:core:2.0:ServiceProviderConfig",qn="urn:ietf:params:scim:schemas:core:2.0:ResourceType",un="urn:ietf:params:scim:schemas:core:2.0:Schema",jo="00000000000000000000000000000000";function No(A){let M={timestamp:new Date().toISOString()};if(A)M.actor=A;try{let te=globalThis[Symbol.for("opentelemetry.js.api.1")]?.trace?.getActiveSpan?.()?.spanContext?.(),Ie=te?.traceId;if(Ie&&Ie!==jo){if(M.traceId=Ie,te?.spanId)M.spanId=te.spanId}}catch{}return M}class dr extends n{constructor(A){super(A,{status:409,statusText:"subject_type_not_assignable"});this.name="SubjectTypeNotAssignableError"}}async function Qs(A,M,N,K){let te=N.subjectType;if(!h.includes(te))throw new dr(`Cannot grant ${N.targetType} "${r(N.target)}" to a "${te}" principal: only [${h.join(", ")}] principals are assignable on this platform.`);let Ie=B(M,A);if(!Ie&&!K)return;let Te=r(N.target),ve;if(K)ve=await K.getNode(N.targetType,Te);else if(Ie)ve=await(N.targetType==="group"?Ie.groups:N.targetType==="role"?Ie.roles:Ie.permissions).get(Te);if(!ve)return;let Ae=ve.assignableSubjectTypes;if(!Ae||Ae.length===0||!Ae.includes(te))throw new dr(`Cannot grant ${N.targetType} "${Te}" to a "${te}" principal: this entitlement restricts assignment to [${(Ae??[]).join(", ")||"none"}].`)}async function Lo(A,M){let N=W(A.codeCatalog,r(M.target));if(!N)return;if(N.kind!==M.targetType)throw Error(`Cannot grant ${M.targetType} "${N.entity.id}": code declares that id as ${N.kind}.`);if(!A.catalogStore)throw Error(`Cannot grant code entitlement "${N.entity.id}": no AccessCatalogStore is wired for materialization.`);await z(N.kind,N.entity,V(A.catalogStore,N.kind))}async function Wo(A,M,N,K){await Lo(A,M),await Qs(A.catalogStore,A.codeCatalog,M,K);let te={...M,status:M.status??"active",provenance:M.provenance??No()};if(te.id=f(te),await A.accessStore?.grant(te),A.accessIndex&&(A.catalogStore||A.codeCatalog)){let Ie=await U(te,{catalog:A.catalogStore,code:A.codeCatalog,resources:A.resources,cache:K});await A.accessIndex.materialize(te.id,Ie)}return N?.push({op:"add",change:te}),te}async function Bn(A,M,N){let K=M.id??f(M);await A.accessStore?.revoke(M),await A.accessIndex?.removeByRoot(K),N?.push({op:"delete",change:{...M,id:K}})}async function cr(A,M){let N=await $o(A,M),K=await qo(A,M);return{oaa:N,delta:K}}async function $o(A,M){if(M.length===0||!A.authz.oaa.isReady())return{status:"skipped"};return ln(A,"authz.oaa.push","OAA incremental access push failed after SCIM mutation; full sync will reconcile",()=>A.authz.oaa.pushAccessChanges(M),{count:M.length})}async function ln(A,M,N,K,te){try{return await K(),{status:"ok"}}catch(Ie){return A.log?.warn(N,{"ion.operation":M,"ion.outcome":"degraded",...te,error:Jt(Ie)}),{status:"degraded",reason:Jt(Ie)}}}var Vo=6;async function qo(A,M){let N=A.iamDelta;if(!N?.isReady()||M.length===0)return{status:"skipped"};let K=new Map;for(let Ae of M){let be=`${Ae.change.subjectType}:${r(Ae.change.subject)}\x00${Ae.change.targetType}:${r(Ae.change.target)}`;K.set(be,Ae)}let te=[...K.values()],Ie=te.map(({op:Ae,change:be})=>()=>Ae==="add"?N.onGrant(be):N.onRevoke(be)),ve=(await zo(Ie,Vo)).filter((Ae)=>Ae.status==="rejected");if(ve.length>0)return A.log?.warn("IAM delta egress degraded after SCIM mutation; IAM server reconcile/aggregation will recover",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",failed:ve.length,total:te.length,error:Jt(ve[0]?.reason)}),{status:"degraded",reason:Jt(ve[0]?.reason)};return{status:"ok"}}async function zo(A,M){let N=Array(A.length),K=0,te=async()=>{while(!0){let Te=K++;if(Te>=A.length)return;let ve=A[Te];if(!ve)continue;try{N[Te]={status:"fulfilled",value:await ve()}}catch(Ae){N[Te]={status:"rejected",reason:Ae}}}},Ie=Array.from({length:Math.min(M,A.length)},te);return await Promise.all(Ie),N}class us extends n{constructor(A){super(A,{status:409,statusText:"derived_access"});this.name="DerivedRevokeError"}}class Hn extends n{constructor(A,M,N=!1){super(A,{status:N?409:500});this.name="ScimMutationError";this.summary=M,this.clientError=N}}function Qe(A,M,N){return new Response(JSON.stringify({schemas:[ss],status:String(A),scimType:N,detail:M}),{status:A,headers:R})}function Ht(A,M){let N=M?.totalResults??A.length,K=M?.startIndex??1,te=M?.itemsPerPage??A.length;return new Response(JSON.stringify({schemas:[Oo],totalResults:N,startIndex:K,itemsPerPage:te,Resources:A}),{status:200,headers:R})}function xt(A,M=200,N){let K=new Headers(R);if(N)K.set("Location",N);return new Response(JSON.stringify(A),{status:M,headers:K})}function Gs(A){return Qe(A.clientError?409:500,`${A.message}; authz mutation summary: ${JSON.stringify(A.summary)}`,A.clientError?"mutability":"invalidValue")}function Gn(A){return f(A)}function Qr(A,M){return ur(Ks(A),Ks(M))}function Ks(A){let M=new Map;if(!A?.id)return M;for(let N of A.groups??[]){let K={subject:A.id,subjectType:"user",targetType:"group",target:N.value,metadata:N.display||N.type?{display:N.display,type:N.type}:void 0};M.set(Gn(K),K)}for(let N of A.roles??[]){let K={subject:A.id,subjectType:"user",targetType:"role",target:N.value,metadata:N.display||N.type?{display:N.display,type:N.type,primary:N.primary}:void 0};M.set(Gn(K),K)}for(let N of A.entitlements??[]){let K={subject:A.id,subjectType:"user",targetType:"permission",target:N.value,metadata:N.display||N.type?{display:N.display,type:N.type,primary:N.primary}:void 0};M.set(Gn(K),K)}return M}class ds extends n{constructor(A){super(A,{status:400,statusText:"ambiguous_member"});this.name="AmbiguousMemberSubjectTypeError"}}function Bo(A,M,N){if(A.type==="Group")return;if(A.type==="Workload")return"workload";if(A.type==="User")return"user";if(A.type==="Customer")return"customer";if(A.type==="Delegate")return"delegate";let K=M??[];if(K.length===1)return K[0];throw new ds(`SCIM Group member "${A.value}" of entitlement "${N}" omits type, and the entitlement is assignable to more than one principal kind [${K.join(", ")||"none"}]. Set members[].type to User, Workload, Customer, or Delegate.`)}function ar(A,M,N,K,te){let Ie=new Map,Te=K&&K.length>0?K:void 0;for(let ve of A??[]){let Ae=Bo(ve,te,N);if(!Ae)continue;let be={subject:ve.value,subjectType:Ae,targetType:M,target:N,resources:Te,metadata:ve.display||ve.type?{display:ve.display,type:ve.type}:void 0};Ie.set(Gn(be),be)}return Ie}function Hs(A){let M=A[t]?.resources;return M&&M.length>0?M:void 0}function Go(A,M){let N=(te,Ie)=>[...te??[]].sort().join(",")===[...Ie??[]].sort().join(","),K=A[t];if(K?.type!==void 0&&K.type!==M.kind)return!0;if(K?.requestable!==void 0&&K.requestable!==M.entity.requestable)return!0;if(K?.resources!==void 0&&!N(K.resources,as(M.entity)))return!0;if(K?.assignableSubjectTypes!==void 0&&!N(K.assignableSubjectTypes,M.entity.assignableSubjectTypes))return!0;if(K?.recommendedSubjectTypes!==void 0&&!N(K.recommendedSubjectTypes,M.entity.recommendedSubjectTypes))return!0;return!1}function Ko(A,M){let N=(Ie,Te)=>[...Ie??[]].sort().join(",")===[...Te??[]].sort().join(","),K=A[t],te=M[t];if(K?.type!==void 0&&K.type!==te?.type)return!0;if(K?.requestable!==void 0&&K.requestable!==te?.requestable)return!0;if(K?.resources!==void 0&&!N(K.resources,te?.resources))return!0;if(K?.assignableSubjectTypes!==void 0&&!N(K.assignableSubjectTypes,te?.assignableSubjectTypes))return!0;if(K?.recommendedSubjectTypes!==void 0&&!N(K.recommendedSubjectTypes,te?.recommendedSubjectTypes))return!0;return!1}function Ho(A){let M=new Map;for(let N of A)M.set(Gn(N),N);return M}async function wn(A,M,N,K,te,Ie){let Te=[],ve=new Set,Ae=(He,nt)=>`${nt}\x00${He}`,be=Ie?Ie.get(`${N}:${K}`)??[]:M?(await M.listByTarget(N,K)).items:[];for(let He of be){let nt=r(He.subject),dt=He.metadata,at=He.subjectType==="workload"?"Workload":He.subjectType==="customer"?"Customer":He.subjectType==="delegate"?"Delegate":dt?.type??"User",Ke=Ae(nt,at);if(ve.has(Ke))continue;ve.add(Ke),Te.push({value:nt,...dt?.display?{display:dt.display}:{},type:at})}for(let He of te??[]){if(He.targetType!==N||r(He.target)!==K)continue;let nt=r(He.subject),dt=Ae(nt,"Workload");if(ve.has(dt))continue;ve.add(dt),Te.push({value:nt,type:"Workload"})}if(N==="group"){let He=await A.groups.get(K);for(let nt of He?.groups??[]){let dt=r(nt),at=Ae(dt,"Group");if(!dt||ve.has(at))continue;ve.add(at),Te.push({value:dt,type:"Group"})}}return Te.length>0?Te:void 0}function ur(A,M){let N=[];for(let[K,te]of M)if(!A.has(K))N.push({action:"grant",change:te});for(let[K,te]of A)if(!M.has(K))N.push({action:"revoke",change:te});return N}async function es(A,M){if(A.oaa.isReady())await A.oaa.pushUser(M)}async function Js(A,M,N){if(M?.externalId&&M.externalId!==N.externalId)await A?.onUserDelete(M.externalId);await A?.onUserUpsert(N)}async function Pn(A,M,N,K){let te={metadataApplied:!1,access:[]},Ie={status:"skipped"},Te=[],ve=new oe(A.catalogStore,A.resources,A.codeCatalog);try{try{await M(),te.metadataApplied=!0}catch(Ae){for(let be of N)te.access.push({change:be.change,status:"rolled_back"});throw te.metadataApplied=!1,new Hn(`SCIM metadata write failed: ${Jt(Ae)}`,te,!1)}if(K?.oaa)await ln(A,"authz.oaa.metadata","OAA metadata projection failed after SCIM write; full sync will reconcile",K.oaa);if(K?.delta&&A.iamDelta?.isReady())Ie=await ln(A,"iam.delta.egress","IAM delta metadata projection failed after SCIM write; full aggregation will reconcile",K.delta);for(let Ae=0;Ae<N.length;Ae++){let be=N[Ae];try{if(be.action==="grant")await Wo(A,be.change,Te,ve);else await Zo(A,be.change,Te);te.access.push({change:be.change,status:"applied"})}catch(He){te.access.push({change:be.change,status:"failed",error:He});for(let dt=Ae+1;dt<N.length;dt++)te.access.push({change:N[dt].change,status:"rolled_back"});let nt=He instanceof us||He instanceof dr;if(!nt)await Yo(A,be.change,ve);throw new Hn(nt?Jt(He):`SCIM access mutation failed: ${Jt(He)}`,te,nt)}}return te}finally{await Fo(A),te.egress=await cr(A,Te),te.egress.delta=Jo(Ie,te.egress.delta),Xo(A,te)}}function Jo(A,M){if(A.status==="degraded")return A;if(M.status==="degraded")return M;return A.status==="ok"||M.status==="ok"?{status:"ok"}:{status:"skipped"}}function Jt(A){return A instanceof Error?A.message:String(A)}async function Fo(A){try{await A.settleAuthz?.()}catch{}}async function Yo(A,M,N){if(!A.accessIndex||!A.catalogStore&&!A.codeCatalog||!A.accessStore)return;let K=r(M.subject);if(!K)return;let te=M.subjectType;try{await ke(K,te,{accessStore:A.accessStore,accessIndex:A.accessIndex,catalogStore:A.catalogStore,code:A.codeCatalog,resources:A.resources},N)}catch(Ie){A.log?.warn("Per-subject reconcile after failed SCIM access mutation failed",{"ion.operation":"authz.reconcile.subject.repair","ion.outcome":"degraded",subject:K,subjectType:te,error:Jt(Ie)})}}function Xo(A,M){if(!A.onAccessMutation)return;try{A.onAccessMutation(M)}catch{}}async function Zo(A,M,N){if(A.accessStore){let K=M.id??f(M);if(!await A.accessStore.get(K)){if((A.accessIndex?await A.accessIndex.has(M.subject,M.targetType,M.target,M.resources?.[0],M.subjectType):{allow:!1}).allow)throw new us(`Cannot revoke ${M.targetType} "${r(M.target)}" for "${r(M.subject)}": it is not a directly granted root (it is derived from group/role membership). Remove the granting group/role instead.`);await Bn(A,M,N);return}}await Bn(A,M,N)}function Un(A){let M=A[t]?.type??"group";if(M==="group"||M==="role"||M==="permission")return M;throw Error(`Unsupported ionite SCIM Group authz type "${String(M)}"`)}async function ts(A,M,N){if(!A.oaa.isReady())return;if(N==="role"){await A.oaa.pushRole(M);return}if(N==="permission"){await A.oaa.pushPermission(M);return}await A.oaa.pushGroup(M)}function as(A){let M=A.resources;if(!M||M.length===0)return;let N=M.map((K)=>typeof K==="string"?K:K.id).filter(Boolean);return N.length>0?N:void 0}function bn(A,M,N){return Jr(A,M,N)}function Qo(A,M){let N=A[t],te={...c(N?.attributes??{},p),id:M,name:A.displayName,displayName:A.displayName,description:N?.description??A.displayName,requestable:N?.requestable,riskLevel:N?.riskLevel??y,providerId:N?.providerId??A.externalId,requestUrl:N?.requestUrl,assignableSubjectTypes:["user"]};if(N?.resources!==void 0)te.resources=N.resources;return te}var ei=["requestable","description","riskLevel","providerId","requestUrl","attributes"];function ea(A){let M=de(A),N=M.attr?.toLowerCase();if(!N)return;if(!M.schema){if(N==="displayname"&&!M.filter&&!M.subAttr)return"displayName";if(N==="members")return"members";return}if(M.schema.toLowerCase()!==t.toLowerCase()||M.filter)return;let K=ei.find((te)=>te.toLowerCase()===N);return K==="attributes"||!M.subAttr?K:void 0}function ta(A){return A.flatMap((M)=>!M.path&&typeof M.value==="object"&&M.value!==null&&!Array.isArray(M.value)?Object.entries(M.value).map(([N,K])=>({op:M.op,path:N,value:K})):[M])}function cs(A){return Qe(400,`Unsupported filter: ${A}`,"invalidFilter")}function Fs(A){if(!A)return;let M=A.trim().match(/^requestable\s+eq\s+(true|false)$/i);if(!M)return;return{requestable:M[1]?.toLowerCase()==="true"}}function Ys(A){if(!A)return;let M=A.trim().match(/^externalId\s+eq\s+"([^"]*)"$/i);return M?M[1]:void 0}function na(A){if(!A)return;return A.trim().match(/^displayName\s+eq\s+"((?:[^"\\]|\\.)*)"$/i)?.[1]?.replace(/\\(.)/g,"$1")}function ti(A){if(!A)return;let M=A.trim(),N=M.match(/^userName\s+eq\s+"([^"]*)"$/i);if(N)return{userName:N[1]};let K=M.match(/^externalId\s+eq\s+"([^"]*)"$/i);if(K)return{externalId:K[1]};let te=M.match(/^meta\.lastModified\s+gt\s+"([^"]*)"$/i);if(te)return{updatedAfter:te[1]};return}function ra(A,M,N){let K=new Set(["id","schemas"]),te={...A};if(M){let Ie=new Set(M.split(",").map((Te)=>Te.trim()).filter(Boolean));for(let Te of Object.keys(te))if(!K.has(Te)&&!Ie.has(Te))delete te[Te]}if(N){for(let Ie of N.split(",").map((Te)=>Te.trim()).filter(Boolean))if(!K.has(Ie))delete te[Ie]}return te}function ns(A,M){let N=async(te,Ie,Te)=>{let ve=await A.toScim(te),Ae=te.id;return{...ve,id:Ae,meta:{...ve.meta??{},resourceType:A.resourceType,location:Ae?It(Ie,`${Te}/${encodeURIComponent(Ae)}`):void 0}}};return{handler:async(te,Ie)=>{if(!await M.validateAuth(te))return Qe(401,"Authorization required");let Te=new URL(te.url),ve=Ie?.basePath??`/${A.resourceType}s`,Ae=Te.pathname;if(Ae.startsWith(ve))Ae=Ae.substring(ve.length);let be=Ae.match(/^\/([^/]+)$/),He=be?.[1]?decodeURIComponent(be[1]):void 0,nt=Te.searchParams.get("attributes"),dt=Te.searchParams.get("excludedAttributes"),at=(Ke)=>ra(Ke,nt,dt);try{if(He){if(te.method==="GET"){let Ke=await A.store.get(He);if(!Ke)return Qe(404,`${A.resourceType} not found`);return xt(at(await N(Ke,te,ve)))}if(te.method==="PUT"||te.method==="PATCH"){let Ke=await A.store.get(He);if(!Ke)return Qe(404,`${A.resourceType} not found`);let Ze=await te.json(),ot=Ze;if(te.method==="PATCH"){let St=Ze.Operations;if(!Array.isArray(St))return Qe(400,"PATCH requires Operations","invalidSyntax");let bt=await A.toScim(Ke);for(let Ut of St)X(bt,Ut);ot=bt}let ct=await dn(A.validator,ot);if(ct.issues)return Qe(400,ct.issues.map((St)=>St.message).join("; "),"invalidValue");let lt=te.method==="PATCH"?"patch":"replace",Ne=await A.store.upsert({...await A.fromScim(ct.value,{existing:Ke,mode:lt}),id:Ke.id??He});if(Ke.active!==Ne.active)await M.accessIndex?.setSubjectDisabled?.(Ne.id,A.subjectType,Ne.active===!1);let ft=Ne.id?It(te,`${ve}/${encodeURIComponent(Ne.id)}`):void 0;for(let St of A.projections??[])await ln(M,`${St.channel}.${A.subjectType}.upsert`,`${A.resourceType} projection degraded after SCIM upsert; aggregation will reconcile`,()=>St.upsert(Ne,Ke));return xt(at(await N(Ne,te,ve)),200,ft)}if(te.method==="DELETE"){let Ke=await A.store.get(He);if(!Ke)return Qe(404,`${A.resourceType} not found`);if(M.revokeSubjectAccess)await M.revokeSubjectAccess(He,A.subjectType);await A.store.delete(He),await M.accessIndex?.setSubjectDisabled?.(He,A.subjectType,!1);for(let Ze of A.projections??[])await ln(M,`${Ze.channel}.${A.subjectType}.delete`,`${A.resourceType} projection degraded after SCIM delete; aggregation will reconcile`,()=>Ze.delete(Ke));return new Response(null,{status:204})}return Qe(405,"Method not allowed")}if(te.method==="GET"){let Ke=parseInt(Te.searchParams.get("startIndex")??"",10),Ze=parseInt(Te.searchParams.get("count")??"",10),ot=Ke!=null&&!Number.isNaN(Ke)?Math.max(0,Ke-1):0,ct=Ze!=null&&!Number.isNaN(Ze)?Ze:void 0,lt=Te.searchParams.get("filter"),Ne=ti(lt);if(lt?.trim()&&!Ne)return cs(lt);if(Ne?.externalId!==void 0){let bt=A.store.getByExternalId?await A.store.getByExternalId(Ne.externalId):await A.store.lookup({externalId:Ne.externalId}),Ut=bt?[at(await N(bt,te,ve))]:[];return Ht(Ut,{totalResults:Ut.length,startIndex:1,itemsPerPage:Ut.length})}let ft=await A.store.list({start:ot,limit:ct,filter:Ne}),St=await Promise.all(ft.items.map(async(bt)=>at(await N(bt,te,ve))));return Ht(St,{totalResults:ft.total,startIndex:ot+1,itemsPerPage:ft.count})}if(te.method==="POST"){let Ke=await te.json(),Ze=await dn(A.validator,Ke);if(Ze.issues)return Qe(400,Ze.issues.map((bt)=>bt.message).join("; "),"invalidValue");let{id:ot,...ct}=Ze.value,lt=await A.fromScim(ct,{mode:"create"}),Ne=typeof lt.id==="string"&&lt.id.trim()?lt.id:Sn();if(await A.store.get(Ne))return Qe(409,`${A.resourceType} id already exists`,"uniqueness");let ft=await A.store.upsert({...lt,id:Ne});if(ft.active===!1)await M.accessIndex?.setSubjectDisabled?.(ft.id,A.subjectType,!0);for(let bt of A.projections??[])await ln(M,`${bt.channel}.${A.subjectType}.upsert`,`${A.resourceType} projection degraded after SCIM create; aggregation will reconcile`,()=>bt.upsert(ft,void 0));let St=ft.id?It(te,`${ve}/${encodeURIComponent(ft.id)}`):void 0;return xt(at(await N(ft,te,ve)),201,St)}return Qe(405,"Method not allowed")}catch(Ke){if(Ke instanceof s)return Qe(400,Ke.message,Ke.scimType);if(q(Ke))return Qe(409,Ke.message,"uniqueness");return Qe(500,Ke instanceof Error?Ke.message:"Internal error")}}}}async function sa(A,M,N,K){let te=[],Ie=[["group",A.groups],["role",A.roles],["permission",A.permissions]];for(let[ve,Ae]of Ie)for await(let be of u((He,nt)=>Ae.list({start:He,limit:nt,filter:{requestable:!0}})))if(be.providerId===N)te.push({entity:be,type:ve});if(te.length>1)throw new v(`Ambiguous providerId "${N}": ${te.length} entitlements share it (${te.map((ve)=>`${ve.type}:${ve.entity.id}`).join(", ")})`,"unique_violation","providerId");let Te=te[0];if(Te?.entity.requestable!==!0)return;return bn(Te.entity,Te.type,await wn(A,M,Te.type,Te.entity.id,K))}async function Xs(A,M,N,K){let te=Math.max(0,N.start),Ie=N.limit!=null?te+N.limit:void 0,Te={start:0,limit:Ie,filter:N.filter},[ve,Ae,be]=await Promise.all([A.groups.list(Te),A.roles.list(Te),A.permissions.list(Te)]),He=[...ve.items.map((Ze)=>({entity:Ze,type:"group"})),...Ae.items.map((Ze)=>({entity:Ze,type:"role"})),...be.items.map((Ze)=>({entity:Ze,type:"permission"}))],nt=ve.total+Ae.total+be.total,dt=He.slice(te,Ie),at=M?.listByTargets?await M.listByTargets(dt.map(({entity:Ze,type:ot})=>({targetType:ot,target:Ze.id}))):void 0,Ke=await Promise.all(dt.map(async({entity:Ze,type:ot})=>bn(Ze,ot,await wn(A,M,ot,Ze.id,K,at))));return{resources:Ke,total:nt,count:Ke.length}}async function zn(A,M,N,K){let[te,Ie,Te]=await Promise.all([A.groups.get(N),A.roles.get(N),A.permissions.get(N)]);if(te)return bn(te,"group",await wn(A,M,"group",N,K));if(Ie)return bn(Ie,"role",await wn(A,M,"role",N,K));if(Te)return bn(Te,"permission",await wn(A,M,"permission",N,K));return}async function rs(A,M,N,K,te){let Ie=Un(M),Te=Ie==="role"?await A.roles.get(N):Ie==="permission"?await A.permissions.get(N):await A.groups.get(N),ve=Qo(M,N),Ae=Te?.assignableSubjectTypes&&Te.assignableSubjectTypes.length>0?Te.assignableSubjectTypes:["user"],be={...Te??{},...ve,source:Te?.source??"scim",assignableSubjectTypes:te?.assignableSubjectTypes??Ae,recommendedSubjectTypes:te?.recommendedSubjectTypes??Te?.recommendedSubjectTypes};if(te){if(delete be.groups,delete be.roles,delete be.permissions,delete be.resources,Ie==="group")be.groups=te.groups,be.roles=te.roles,be.permissions=te.permissions,be.resources=te.resources;else if(Ie==="role")be.permissions=te.permissions}let He=K?K.displayName??K.name:Te?.name;if(ve.displayName===He)delete be.displayName;if(ve.riskLevel===(K?.riskLevel??y))delete be.riskLevel;let nt=c(ve,p),dt=K?c(K,p):void 0;if(M[t]?.attributes!==void 0){for(let Ke of Object.keys(c(Te??{},p)??{}))if(!(Ke in(nt??{})))delete be[Ke]}for(let[Ke,Ze]of Object.entries(nt??{}))if(C(Ze,dt?.[Ke]))delete be[Ke];if(K)be.name=K.name;let at=Ie==="role"?A.roles.set(be):Ie==="permission"?A.permissions.set(be):A.groups.set(be);return await at.ready(),at}async function ia(A,M){await Promise.all([A.groups.delete(M),A.roles.delete(M),A.permissions.delete(M)])}function Sn(){return crypto.randomUUID()}function dn(A,M){let N=A;if(typeof N.validate==="function")return N.validate(M);return Promise.resolve(A["~standard"].validate(M))}function oa(A){if(!A)return;try{return new URL(A).pathname}catch{return A.startsWith("/")?A:`/${A}`}}function Nt(A){let M=oa(A);return M?I(M):void 0}function Zs(...A){for(let M of A){let N=Nt(M);if(!N)continue;for(let K of["/Users","/Groups","/Workloads","/Customers","/Delegates"])if(N.endsWith(K))return N.slice(0,-K.length)}return}function It(A,M){return new URL(M,A.url).toString()}function je(A,M,N,K){let{multiValued:te=!1,...Ie}=K??{};return{name:A,type:M,description:N,multiValued:te,...Ie}}function aa(A,M){return{schemas:[_o],documentationUri:M?.documentationUri,patch:{supported:!0},bulk:{supported:!1},filter:{supported:!0,maxResults:1000},changePassword:{supported:!1},sort:{supported:!1},etag:{supported:!1},authenticationSchemes:[{type:"oauthbearertoken",name:"OAuth Bearer Token",description:"Use an ionite workload bearer token for IAM discovery and provisioning requests.",primary:!0}],meta:{resourceType:"ServiceProviderConfig",location:It(A.request,`${A.basePath}/ServiceProviderConfig`)}}}function ca(A){let M=[];if(A.supportsUsers)M.push({schemas:[qn],id:"User",name:"User",description:"User Account",endpoint:A.usersUrl,schema:is,schemaExtensions:[{schema:Kn,required:!1},{schema:o,required:!1}],meta:{resourceType:"ResourceType",location:It(A.request,`${A.basePath}/ResourceTypes/User`)}});if(A.supportsGroups)M.push({schemas:[qn],id:"Group",name:"Group",description:"Group",endpoint:A.groupsUrl,schema:os,schemaExtensions:[{schema:t,required:!1}],meta:{resourceType:"ResourceType",location:It(A.request,`${A.basePath}/ResourceTypes/Group`)}});if(A.supportsWorkloads)M.push({schemas:[qn],id:"Workload",name:"Workload",description:"Workload (machine) principal",endpoint:A.workloadsUrl,schema:S,meta:{resourceType:"ResourceType",location:It(A.request,`${A.basePath}/ResourceTypes/Workload`)}});if(A.supportsCustomers)M.push({schemas:[qn],id:"Customer",name:"Customer",description:"Customer (CIAM) principal",endpoint:A.customersUrl,schema:k,meta:{resourceType:"ResourceType",location:It(A.request,`${A.basePath}/ResourceTypes/Customer`)}});if(A.supportsDelegates)M.push({schemas:[qn],id:"Delegate",name:"Delegate",description:"IAM-governed personal token principal",endpoint:A.delegatesUrl,schema:b,meta:{resourceType:"ResourceType",location:It(A.request,`${A.basePath}/ResourceTypes/Delegate`)}});return M}function ua(A){let M=[];if(A.supportsUsers)M.push({schemas:[un],id:is,name:"User",description:"User Account",meta:{resourceType:"Schema",location:It(A.request,`${A.basePath}/Schemas/${encodeURIComponent(is)}`)},attributes:[je("id","string","Unique identifier for the User.",{multiValued:!1,required:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),je("externalId","string","External identifier from the provisioning client.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",uniqueness:"none"}),je("userName","string","Unique identifier typically used for login.",{multiValued:!1,required:!0,caseExact:!1,mutability:"readWrite",returned:"default",uniqueness:"server"}),je("name","complex","The components of the user name.",{multiValued:!1,required:!1,mutability:"readWrite",returned:"default",subAttributes:[je("formatted","string","The full name, including titles and suffixes.",{multiValued:!1}),je("familyName","string","The family name of the User.",{multiValued:!1}),je("givenName","string","The given name of the User.",{multiValued:!1}),je("middleName","string","The middle name(s) of the User.",{multiValued:!1}),je("honorificPrefix","string","The honorific prefix(es) of the User.",{multiValued:!1}),je("honorificSuffix","string","The honorific suffix(es) of the User.",{multiValued:!1})]}),je("displayName","string","The name of the User, suitable for display.",{multiValued:!1}),je("nickName","string","The casual way to address the user.",{multiValued:!1}),je("profileUrl","reference","A URL pointing to the User profile.",{multiValued:!1,referenceTypes:["external"]}),je("title","string","The user title, such as Vice President.",{multiValued:!1}),je("userType","string","The relationship between the organization and the User.",{multiValued:!1}),je("preferredLanguage","string","Preferred written or spoken language.",{multiValued:!1}),je("locale","string","Default location for localizing values.",{multiValued:!1}),je("timezone","string","The User time zone.",{multiValued:!1}),je("active","boolean","The User administrative status.",{multiValued:!1}),je("emails","complex","Email addresses for the User.",{multiValued:!0,subAttributes:[je("value","string","Email address value.",{multiValued:!1,required:!0}),je("display","string","Display label for the email.",{multiValued:!1}),je("type","string","Email type such as work or home.",{multiValued:!1}),je("primary","boolean","Primary email indicator.",{multiValued:!1})]}),je("phoneNumbers","complex","Phone numbers for the User.",{multiValued:!0,subAttributes:[je("value","string","Phone number value.",{multiValued:!1,required:!0}),je("display","string","Display label for the phone number.",{multiValued:!1}),je("type","string","Phone number type.",{multiValued:!1}),je("primary","boolean","Primary phone number indicator.",{multiValued:!1})]}),je("photos","complex","Photo URLs for the User.",{multiValued:!0,subAttributes:[je("value","reference","Photo URL.",{multiValued:!1,required:!0,referenceTypes:["external"]}),je("display","string","Display label for the photo.",{multiValued:!1}),je("type","string","Photo type.",{multiValued:!1}),je("primary","boolean","Primary photo indicator.",{multiValued:!1})]}),je("addresses","complex","Physical mailing addresses for the User.",{multiValued:!0,subAttributes:[je("formatted","string","Formatted mailing address.",{multiValued:!1}),je("streetAddress","string","Full street address component.",{multiValued:!1}),je("locality","string","City or locality.",{multiValued:!1}),je("region","string","State or region.",{multiValued:!1}),je("postalCode","string","Postal code.",{multiValued:!1}),je("country","string","Country.",{multiValued:!1}),je("type","string","Address type.",{multiValued:!1}),je("primary","boolean","Primary address indicator.",{multiValued:!1})]}),je("groups","complex","Groups to which the User belongs.",{multiValued:!0,mutability:"readOnly",subAttributes:[je("value","string","Group identifier.",{multiValued:!1,required:!0}),je("$ref","reference","Reference to the Group resource.",{multiValued:!1,referenceTypes:["Group"]}),je("display","string","Display name of the group.",{multiValued:!1}),je("type","string","Relationship type.",{multiValued:!1})]}),je("entitlements","complex","Entitlements for the User.",{multiValued:!0,subAttributes:[je("value","string","Entitlement value.",{multiValued:!1,required:!0}),je("display","string","Display value.",{multiValued:!1}),je("type","string","Entitlement type.",{multiValued:!1}),je("primary","boolean","Primary entitlement indicator.",{multiValued:!1})]}),je("roles","complex","Roles for the User.",{multiValued:!0,subAttributes:[je("value","string","Role value.",{multiValued:!1,required:!0}),je("display","string","Display value.",{multiValued:!1}),je("type","string","Role type.",{multiValued:!1}),je("primary","boolean","Primary role indicator.",{multiValued:!1})]}),je("x509Certificates","complex","Certificates issued to the User.",{multiValued:!0,subAttributes:[je("value","string","Certificate value.",{multiValued:!1,required:!0}),je("display","string","Display value.",{multiValued:!1}),je("type","string","Certificate type.",{multiValued:!1}),je("primary","boolean","Primary certificate indicator.",{multiValued:!1})]})]}),M.push({schemas:[un],id:Kn,name:"EnterpriseUser",description:"Enterprise User extension",meta:{resourceType:"Schema",location:It(A.request,`${A.basePath}/Schemas/${encodeURIComponent(Kn)}`)},attributes:[je("employeeNumber","string","Numeric or alphanumeric identifier assigned to a person.",{multiValued:!1}),je("costCenter","string","Name of a cost center.",{multiValued:!1}),je("organization","string","Name of an organization.",{multiValued:!1}),je("division","string","Name of a division.",{multiValued:!1}),je("department","string","Name of a department.",{multiValued:!1}),je("manager","complex","The User manager.",{multiValued:!1,subAttributes:[je("value","string","Identifier of the manager User resource.",{multiValued:!1}),je("$ref","reference","Reference to the manager User resource.",{multiValued:!1,referenceTypes:["User"]}),je("displayName","string","Display name of the manager.",{multiValued:!1})]})]}),M.push({schemas:[un],id:o,name:"IoniteUser",description:"ionite User extension carrying ECID, account purpose, and AppDev custom attributes. See https://ionite.com/docs/llms-ecid.txt.",meta:{resourceType:"Schema",location:It(A.request,`${A.basePath}/Schemas/${encodeURIComponent(o)}`)},attributes:[je("ecid","string","Enterprise Controlled ID formatted as 'ecid:<realm>:<opaque>' (realm = the minting authority's id). Correlates multiple accounts to one identity.",{multiValued:!1,caseExact:!0}),je("accountClass","string","Account purpose (distinct from userType persona). Open value set: 'daily', 'privileged', 'break_glass', 'service'.",{multiValued:!1}),je("attributes","complex","AppDev custom attributes. IAM may override seeded values.",{multiValued:!1,required:!1,mutability:"readWrite"})]});if(A.supportsGroups)M.push({schemas:[un],id:t,name:"IoniteAuthzGroup",description:"ionite authorization metadata for SCIM Group resources.",meta:{resourceType:"Schema",location:It(A.request,`${A.basePath}/Schemas/${encodeURIComponent(t)}`)},attributes:[je("type","string","Authorization entity kind: group, role, or permission.",{multiValued:!1,required:!1}),je("requestable","boolean","Whether this catalog entry is exposed as assignable access to IAM tooling. Only true entries are served.",{multiValued:!1,required:!1}),je("riskLevel","string",`Advisory access-risk classification. Unset values project as ${y}; canonical values are suggestions, not a closed enum.`,{multiValued:!1,required:!1,mutability:"readWrite",canonicalValues:[...ne]}),je("providerId","string","IAM service-provider id captured when this entitlement is materialized at the destination.",{multiValued:!1,required:!1,mutability:"readWrite"}),je("requestUrl","reference","IAM-owned deep link where a principal can request this entitlement.",{multiValued:!1,required:!1,mutability:"readWrite",referenceTypes:["external"]}),je("source","string","Provenance of the catalog row.",{multiValued:!1,required:!1,mutability:"readOnly",canonicalValues:["code","app","scim"]}),je("deprecated","boolean","Whether this retired entitlement may be deleted.",{multiValued:!1,required:!1,mutability:"readOnly"}),je("description","string","Human-readable authorization entity description.",{multiValued:!1,required:!1}),je("resources","string","Resource ids this entitlement is scoped to.",{multiValued:!0,required:!1}),je("assignableSubjectTypes","string","AppDev-owned required audience of principal kinds (user, workload, customer) that may hold this entitlement. Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload","delegate"]}),je("recommendedSubjectTypes","string","AppDev advisory default principal kinds (subset of assignableSubjectTypes). Read-only to IAM tooling.",{multiValued:!0,required:!1,mutability:"readOnly",canonicalValues:["user","customer","workload","delegate"]}),je("attributes","complex","AppDev custom attributes. IAM may override seeded values.",{multiValued:!1,required:!1,mutability:"readWrite"})]});if(A.supportsGroups)M.push({schemas:[un],id:os,name:"Group",description:"Group",meta:{resourceType:"Schema",location:It(A.request,`${A.basePath}/Schemas/${encodeURIComponent(os)}`)},attributes:[je("id","string","Unique identifier for the Group.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),je("externalId","string","External identifier from the provisioning client.",{multiValued:!1,uniqueness:"none"}),je("displayName","string","Human-readable name for the Group.",{multiValued:!1,required:!0,uniqueness:"none"}),je("members","complex","Members of the Group.",{multiValued:!0,subAttributes:[je("value","string","Identifier of the member resource.",{multiValued:!1,required:!0}),je("$ref","reference","Reference to the member resource.",{multiValued:!1,referenceTypes:["User","Group","Workload","Customer","Delegate"]}),je("display","string","Display name of the member.",{multiValued:!1}),je("type","string","Member type.",{multiValued:!1})]})]});if(A.supportsWorkloads)M.push({schemas:[un],id:S,name:"Workload",description:"Workload (machine) principal",meta:{resourceType:"Schema",location:It(A.request,`${A.basePath}/Schemas/${encodeURIComponent(S)}`)},attributes:[je("id","string","Unique identifier for the Workload.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),je("externalId","string","External identifier from the provisioning client.",{multiValued:!1}),je("userName","string","Login identifier, typically the OAuth clientId.",{multiValued:!1}),je("displayName","string","Human-readable name for the Workload.",{multiValued:!1}),je("description","string","Free-form description of the Workload.",{multiValued:!1}),je("active","boolean","Administrative status of the Workload.",{multiValued:!1}),je("attributes","complex","AppDev custom attributes.",{multiValued:!1,required:!1,mutability:"readWrite"})]});if(A.supportsCustomers)M.push({schemas:[un],id:k,name:"Customer",description:"Customer (CIAM) principal",meta:{resourceType:"Schema",location:It(A.request,`${A.basePath}/Schemas/${encodeURIComponent(k)}`)},attributes:[je("id","string","Unique identifier for the Customer.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),je("externalId","string","External identifier from the provisioning client.",{multiValued:!1}),je("userName","string","Unique identifier typically used for login.",{multiValued:!1}),je("displayName","string","Human-readable name for the Customer.",{multiValued:!1}),je("active","boolean","Administrative status of the Customer.",{multiValued:!1}),je("emails","complex","Email addresses for the Customer.",{multiValued:!0,subAttributes:[je("value","string","Email address.",{multiValued:!1,required:!0}),je("primary","boolean","Whether this is the primary email.",{multiValued:!1})]}),je("attributes","complex","AppDev custom attributes.",{multiValued:!1,required:!1,mutability:"readWrite"})]});if(A.supportsDelegates)M.push({schemas:[un],id:b,name:"Delegate",description:"IAM-governed personal token principal",meta:{resourceType:"Schema",location:It(A.request,`${A.basePath}/Schemas/${encodeURIComponent(b)}`)},attributes:[je("id","string","Unique identifier for the Delegate.",{multiValued:!1,mutability:"readOnly",returned:"always",uniqueness:"global"}),je("externalId","string","External identifier from IAM.",{multiValued:!1}),je("displayName","string","Human-readable label.",{multiValued:!1}),je("active","boolean","Administrative status.",{multiValued:!1}),je("owner","complex","Principal that owns this Delegate.",{multiValued:!1,required:!0,mutability:"immutable",subAttributes:[je("value","string","Owner identifier.",{multiValued:!1,required:!0}),je("type","string","Owner principal type.",{multiValued:!1,required:!0,canonicalValues:["User","Customer","Workload"]})]}),je("clientId","string","Client associated with the Delegate.",{multiValued:!1}),je("expiresAt","dateTime","Expiry controlled by IAM.",{multiValued:!1}),je("tokenHash","string","Current token verifier.",{multiValued:!1,required:!0,mutability:"writeOnly",returned:"never"}),je("previousTokenHash","string","Rotation-overlap token verifier.",{multiValued:!1,mutability:"writeOnly",returned:"never"}),je("previousTokenHashExpiresAt","dateTime","End of the rotation overlap.",{multiValued:!1,mutability:"writeOnly",returned:"never"}),je("lastUsedAt","dateTime","Last observed use.",{multiValued:!1,mutability:"readOnly"}),je("lastUsedWindowSeconds","integer","Maximum coarseness of lastUsedAt, in seconds.",{multiValued:!1,mutability:"readOnly"})]});return M}function da(A,M,N,K,te,Ie,Te,ve,Ae,be,He,nt,dt,at,Ke,Ze,ot){let ct={authz:K,settleAuthz:Ze,accessStore:te,accessIndex:Ie,catalogStore:Te,codeCatalog:ve,resources:Ae,log:M,iamDelta:nt,onAccessMutation:dt,onInboundEntitlement:at};if(!be&&!He)return;let Ne={...be,...He},ft=Ne.users?.enabled!==!1,St=Ne.groups?.enabled!==!1,bt=Ne.workloads?.enabled!==!1,Ut=Ne.customers?.enabled!==!1,Ft=Ne.delegates?.enabled!==!1,Yt=ot?.delegateStore,En=ot?.lastUsedWindowSeconds??br;if(Boolean(Ne.url||Ne.userStore||Te||ve)&&!N)M.error("IAM requires workload identity for SCIM push/pull operations",{"ion.operation":"workload.require","ion.outcome":"failure"});function pn(){if(!N)throw M.error("IAM requires workload identity for SCIM push/pull operations",{"ion.operation":"workload.require","ion.outcome":"failure"}),Error("IAM requires workload identity for SCIM push/pull operations");return N}async function nn(Je){let xe=pn(),Pe=Je.headers.get("Authorization");if(!Pe?.startsWith("Bearer "))return;try{let _e=Pe.substring(7),re=await xe.validateToken(_e);if(!re.valid)return;return Ce(Ne.providers,we(re.claims))}catch{return}}async function Mt(Je){return await nn(Je)!==void 0}async function mn(){let Je=pn(),xe=typeof Je.getServerToken==="function"?await Je.getServerToken():await Je.getToken();return new Headers({...R,...he,Authorization:`Bearer ${xe}`})}async function fn(Je,xe,Pe,_e){if(!Ne.url)throw Error("IAM URL not configured for outgoing requests");let re=`${Ne.url}${xe}`;try{let Re=await mn(),De=await fetch(re,{method:Je,headers:Re,body:Pe?JSON.stringify(Pe):void 0}),Ue=await d(De,{log:M,operation:"scim.request"});if(!De.ok)return{success:!1,error:Ue,status:De.status};let Me=await _e["~standard"].validate(Ue);if(Me.issues)return M.error("SCIM response validation failed",{"ion.operation":"scim.response.validate","ion.outcome":"failure",validationIssues:Me.issues}),{success:!1,error:{schemas:[ss],status:"400",scimType:"invalidValue",detail:`Response validation failed: ${Me.issues.map((We)=>We.message).join("; ")}`},status:400};return{success:!0,data:Me.value,status:De.status}}catch(Re){return{success:!1,error:{schemas:[ss],status:"500",detail:Re instanceof Error?Re.message:"Unknown error occurred"},status:500}}}function vn(){return Ne.url}function Lt(Je,xe){let Pe=Nt(xe?.usersUrl??Ne.usersUrl??"/api/iam/Users")??"/api/iam/Users",_e=Nt(xe?.groupsUrl??Ne.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",re=Nt(xe?.workloadsUrl??Ne.workloadsUrl??"/api/iam/Workloads")??"/api/iam/Workloads",Re=Nt(xe?.customersUrl??Ne.customersUrl??"/api/iam/Customers")??"/api/iam/Customers",De=Nt(xe?.delegatesUrl??Ne.delegatesUrl??"/api/iam/Delegates")??"/api/iam/Delegates",Ue=Nt(xe?.discovery?.basePath??Ne.discovery?.basePath)??Zs(Pe,_e,re,Re,De);if(!Ue)return;return{request:Je,basePath:Ue,usersUrl:Pe,groupsUrl:_e,workloadsUrl:re,customersUrl:Re,delegatesUrl:De,supportsUsers:ft&&Boolean(Ne.userStore),supportsGroups:St&&Boolean(Te||ve),supportsWorkloads:bt&&Boolean(Ne.workloadIdentityStore),supportsCustomers:Ut&&Boolean(Ne.customerStore),supportsDelegates:Ft&&Boolean(Yt)}}async function Dn(Je){let xe=aa(Je,Ne.discovery);return await Ne.discovery?.buildServiceProviderConfig?.(Je,xe)??xe}async function Rn(Je){let xe=ca(Je);return await Ne.discovery?.buildResourceTypes?.(Je,xe)??xe}async function Gt(Je){let xe=ua(Je);return await Ne.discovery?.buildSchemas?.(Je,xe)??xe}async function Wt(Je,xe){let Pe=Lt(Je,xe);if(!Pe)return;let _e=I(new URL(Je.url).pathname),{basePath:re}=Pe;if(_e!==re&&!_e.startsWith(`${re}/`))return;let Re=I(_e.slice(re.length)||"/");if(!(Re==="/ServiceProviderConfig"||Re==="/ResourceTypes"||Re.startsWith("/ResourceTypes/")||Re==="/Schemas"||Re.startsWith("/Schemas/")))return;if(Je.method!=="GET")return Qe(405,"Method not allowed");if(!await Mt(Je))return Qe(401,"Authorization required");if(Re==="/ServiceProviderConfig")return xt(await Dn(Pe));if(Re==="/ResourceTypes")return Ht(await Rn(Pe));if(Re.startsWith("/ResourceTypes/")){let Me=decodeURIComponent(Re.slice(15)),We=(await Rn(Pe)).find(($e)=>$e.id===Me||$e.name===Me);return We?xt(We):Qe(404,"Resource not found")}if(Re==="/Schemas")return Ht(await Gt(Pe));if(Re.startsWith("/Schemas/")){let Me=decodeURIComponent(Re.slice(9)),We=(await Gt(Pe)).find(($e)=>$e.id===Me);return We?xt(We):Qe(404,"Resource not found")}return}let gn,Xt;if(Ne.url)Xt=async(xe,Pe)=>{let _e={...xe,schemas:xe.schemas??["urn:ietf:params:scim:schemas:core:2.0:User","urn:ietf:params:scim:schemas:extension:enterprise:2.0:User"]};return fn("POST","/Users",_e,A.user)},gn={createGroup:async(xe,Pe)=>{let _e={schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:xe,externalId:Pe?.id,members:Pe?.members};return fn("POST","/Groups",_e,A.group)}};let $t;if(Te||ve){let Je=B(ve,Te),xe=(Ee,Be,Le)=>{let qe=Ee[t]??{},Fe=Un(Ee),tt=Ee.id,it=tt?It(Be,`${Le}/${encodeURIComponent(tt)}`):void 0,st={id:tt??Ee.externalId??Ee.displayName,name:Ee.displayName,displayName:Ee.displayName,description:qe.description??Ee.displayName,requestable:qe.requestable,providerId:qe.providerId??Ee.externalId,requestUrl:qe.requestUrl,source:qe.source,deprecated:qe.deprecated,riskLevel:qe.riskLevel,assignableSubjectTypes:qe.assignableSubjectTypes,recommendedSubjectTypes:qe.recommendedSubjectTypes},Ye=qe.requestUrl??Ne.entitlementRequestUrl?.(st,Fe,{request:Be});return{...Ee,meta:{...Ee.meta,resourceType:"Group",location:it},[t]:{...qe,requestUrl:Ye}}},Pe=(Ee)=>W(ve,Ee),_e=async(Ee,Be)=>{if(!Te){if(Be)throw Error(`Cannot persist access for code entitlement "${Ee.entity.id}": no AccessCatalogStore is wired.`);return Ee.entity}try{return await z(Ee.kind,Ee.entity,V(Te,Ee.kind))}catch(Le){if(Be)throw Le;return M.warn("Code entitlement discovery materialization failed; serving the code template",{"ion.operation":"iam.catalog.materialize","ion.outcome":"degraded",entitlementId:Ee.entity.id,entitlementType:Ee.kind,error:Jt(Le)}),Ee.entity}},re=async(Ee)=>{if(!Te)return;try{await se(ve,Te,Ee)}catch(Be){M.warn("Retired code entitlement deprecation failed; serving the last durable row",{"ion.operation":"iam.catalog.deprecate","ion.outcome":"degraded",entitlementId:Ee,error:Jt(Be)})}},Re=(Ee,Be)=>Qe(403,`Entitlement "${Ee}" is declared in application code; its structural definition cannot be ${Be} through SCIM. IAM may change presentation and receipts, while code continues to own structure.`,"mutability"),De=(Ee)=>Ee!==void 0&&Ee!=="requestable",Ue=(Ee)=>Ee?.[t]?.requestable===!0,Me=(Ee)=>Qe(404,`Requestable Group ${Ee} not found`,"invalidValue"),We=async(Ee,Be)=>{let Le=await nn(Ee);if(!Le)return Qe(401,"Authorization required");let qe=new URL(Ee.url),Fe=Be?.basePath??"/Groups",tt=qe.pathname;if(tt.startsWith(Fe))tt=tt.substring(Fe.length);let st=tt.match(/^\/([^/]+)$/)?.[1],Ye=Ee.method;try{if(st)switch(Ye){case"GET":return await ze(Ee,Fe,st);case"PUT":return await rt(Ee,Fe,st,Le);case"PATCH":return await ut(Ee,Fe,st,Le);case"DELETE":return await Oe(st);default:return Qe(405,"Method not allowed")}else if(tt===""||tt==="/")switch(Ye){case"GET":return await $e(Ee,Fe);case"POST":return await Ve(Ee,Fe,Le);default:return Qe(405,"Method not allowed")}return Qe(404,"Resource not found")}catch(et){if(et instanceof Hn)return Gs(et);if(et instanceof ds)return Qe(400,et.message,"invalidValue");if(et instanceof s)return Qe(400,et.message,et.scimType);if(q(et))return Qe(409,et.message,"uniqueness");return M.error("Groups inbound handler error",{"ion.operation":"scim.groups.handler","ion.outcome":"failure"},et),Qe(500,et instanceof Error?et.message:"Internal server error")}},$e=async(Ee,Be)=>{let Le=new URL(Ee.url),qe=Le.searchParams.get("startIndex"),Fe=Le.searchParams.get("count"),tt=qe!=null?parseInt(qe,10):void 0,it=Fe!=null?parseInt(Fe,10):void 0,st=tt!=null&&!Number.isNaN(tt)?Math.max(0,tt-1):0,Ye=it!=null&&!Number.isNaN(it)?it:void 0,et=Le.searchParams.get("filter"),mt=na(et);if(et?.trim()&&mt===void 0&&Ys(et)===void 0&&Fs(et)===void 0)return cs(et);let Rt=Ys(et);if(Rt!==void 0){await re();let pt=await sa(Je,te,Rt,Ke),vt=pt?[xe(pt,Ee,Be)]:[];return Ht(vt,{totalResults:vt.length,startIndex:1,itemsPerPage:vt.length})}if(Fs(et)?.requestable===!1)return Ht([],{totalResults:0,startIndex:1,itemsPerPage:0});let gt={requestable:!0};if(ve)await Promise.all([...ve.groups.list().filter((pt)=>pt.requestable===!0).map((pt)=>({entity:pt,kind:"group"})),...ve.roles.list().filter((pt)=>pt.requestable===!0).map((pt)=>({entity:pt,kind:"role"})),...ve.permissions.list().filter((pt)=>pt.requestable===!0).map((pt)=>({entity:pt,kind:"permission"}))].map((pt)=>_e(pt,!1)));if(await re(),mt!==void 0){let pt=mt.toLowerCase(),Ct=(await Xs(Je,te,{start:0,filter:gt},Ke)).resources.filter((Vt)=>Vt.displayName?.toLowerCase()===pt).map((Vt)=>xe(Vt,Ee,Be));return Ht(Ct,{totalResults:Ct.length,startIndex:1,itemsPerPage:Ct.length})}let yt=await Xs(Je,te,{start:st,limit:Ye,filter:gt},Ke);return Ht(yt.resources.map((pt)=>xe(pt,Ee,Be)),{totalResults:yt.total,startIndex:st+1,itemsPerPage:yt.count})},ze=async(Ee,Be,Le)=>{let qe=Pe(Le);if(qe&&qe.entity.requestable!==!0)return Me(Le);if(qe)await _e(qe,!1);await re(Le);let Fe=await zn(Je,te,Le,Ke);if(!Ue(Fe))return Me(Le);return xt(xe(Fe,Ee,Be))},Ve=async(Ee,Be,Le)=>{let qe=Le.normalizeResource(await Ee.json()),Fe=await dn(A.group,qe);if(Fe.issues)return M.error("Group creation validation failed",{"ion.operation":"scim.group.create","ion.outcome":"failure",validationIssues:Fe.issues}),Qe(400,`Request validation failed: ${Fe.issues.map((kt)=>kt.message).join("; ")}`,"invalidValue");let tt=Fe.value;if(!tt.displayName)return Qe(400,"displayName is required","invalidValue");if(tt[t]?.requestable===!1)return Qe(400,"SCIM may create only requestable entitlements; non-requestable definitions are App-owned.","invalidValue");if(tt[t]={...tt[t],requestable:!0},!ct.onInboundEntitlement)return Qe(501,"IAM-sourced entitlement creation is not implemented: this application declares no authz.onInboundEntitlement callback.","invalidValue");if(!Te)return Qe(501,"Group creation is not supported: this application declares its catalog in code (authz.catalog) and wires no AccessCatalogStore for SCIM-authored definitions.","invalidValue");let st=Un(tt),Ye=tt[t],et=await ct.onInboundEntitlement({type:st,displayName:tt.displayName,description:Ye?.description,externalId:tt.externalId,riskLevel:Ye?.riskLevel,attributes:Ye?.attributes,resources:Ye?.resources,members:tt.members??[],request:Ee});if(!et.accept)return Qe(403,et.reason??"The application rejected the IAM-sourced entitlement");if((st==="role"?[...et.groups??[],...et.roles??[],...et.resources??[]]:st==="permission"?[...et.groups??[],...et.roles??[],...et.permissions??[],...et.resources??[]]:[]).length>0)throw Error(`onInboundEntitlement returned structure that is invalid for entitlement type "${st}".`);let Rt=et.assignableSubjectTypes??["user"];D({id:et.id,assignableSubjectTypes:Rt,recommendedSubjectTypes:et.recommendedSubjectTypes});let ht=async(kt,jt)=>{await Promise.all((jt??[]).map(async(Mn)=>{if(!(kt==="group"?await Je.groups.get(Mn):kt==="role"?await Je.roles.get(Mn):kt==="permission"?await Je.permissions.get(Mn):await Ae?.get(Mn)))throw Error(`onInboundEntitlement accepted "${tt.displayName}" with unknown ${kt} binding "${Mn}".`)}))};await Promise.all([ht("group",et.groups),ht("role",et.roles),ht("permission",et.permissions),ht("resource",et.resources)]);let gt=et.id??Sn(),[yt,pt,vt]=await Promise.all([Je.groups.get(gt),Je.roles.get(gt),Je.permissions.get(gt)]);if(yt||pt||vt)throw new v(`id "${gt}" already exists in the entitlement catalog`,"unique_violation","id");let Ct=et.resources,Vt=ur(new Map,ar(tt.members,st,gt,Ct,Rt)),qt;await Pn(ct,async()=>{qt=await rs(Je,tt,gt,void 0,{...et,assignableSubjectTypes:Rt})},Vt,{oaa:()=>ts(K,qt,st)});let Fn=await wn(Je,te,st,gt),Yn=xe(bn(qt,st,Fn),Ee,Be);return xt(Yn,201,Yn.meta?.location)},rt=async(Ee,Be,Le,qe)=>{let Fe=qe.normalizeResource(await Ee.json()),tt=await dn(A.group,Fe);if(tt.issues)return M.error("Group replacement validation failed",{"ion.operation":"scim.group.replace","ion.outcome":"failure",validationIssues:tt.issues}),Qe(400,`Request validation failed: ${tt.issues.map((vt)=>vt.message).join("; ")}`,"invalidValue");let it=tt.value,st=Un(it),Ye=Pe(Le);if(Ye&&Ye.entity.requestable!==!0)return Me(Le);if(Ye){if(await _e(Ye,!0),Go(it,Ye))return Re(Le,"replaced")}let et=await zn(Je,te,Le);if(!Ue(et))return Me(Le);if(!Ye&&et[t]?.source==="code"&&Ko(it,et))return Re(Le,"replaced");let mt=Ye?.kind??st,Rt=Ye?as(Ye.entity):Hs(it),ht=te?(await te.listByTarget(mt,Le)).items:[],gt=ur(Ho(ht),ar(it.members,mt,Le,Rt,Ye?.entity.assignableSubjectTypes??et[t]?.assignableSubjectTypes??it[t]?.assignableSubjectTypes)),yt;await Pn(ct,async()=>{yt=await rs(Je,it,Le,Ye?.entity)},gt,{oaa:()=>ts(K,yt,mt)});let pt=await wn(Je,te,mt,Le);return xt(xe(bn(yt,mt,pt),Ee,Be))},ut=async(Ee,Be,Le,qe)=>{let Fe=Pe(Le);if(Fe&&Fe.entity.requestable!==!0)return Me(Le);if(Fe)await _e(Fe,!0);let tt=await zn(Je,te,Le);if(!Ue(tt))return Me(Le);let it=await Ee.json();if(!Array.isArray(it.Operations))return Qe(400,"PATCH requires Operations","invalidSyntax");let st=ta(qe.normalizePatch(it.Operations)).map((kt)=>{if(!kt.path)throw String(kt.op).toLowerCase()==="remove"?new s("PATCH remove requires a path","noTarget"):new s(`PATCH ${String(kt.op)} without a path requires an object value`,"invalidValue");return{op:kt,target:ea(kt.path)}});if((Fe!==void 0||tt[t]?.source==="code")&&st.some(({target:kt})=>!De(kt)))return Re(Le,"patched");let et={...structuredClone(tt)},mt=new Set;for(let{op:kt,target:jt}of st){if(!jt)continue;X(et,kt),mt.add(jt)}let Rt=et[t]??{},ht={...tt[t]};for(let kt of ei){if(!mt.has(kt))continue;let jt=Rt[kt];if(jt===void 0)delete ht[kt];else if(kt==="requestable")ht[kt]=Boolean(jt);else if(kt==="attributes"){if(typeof jt!=="object"||jt===null||Array.isArray(jt))throw new s("PATCH attributes must be an object","invalidValue");ht[kt]=jt}else ht[kt]=String(jt)}let gt={...tt,displayName:mt.has("displayName")?et.displayName:tt.displayName,members:mt.has("members")?et.members:tt.members,[t]:ht},yt=await dn(A.group,gt);if(yt.issues)return M.error("Group patch validation failed",{"ion.operation":"scim.group.patch","ion.outcome":"failure",validationIssues:yt.issues}),Qe(400,`Request validation failed: ${yt.issues.map((kt)=>kt.message).join("; ")}`,"invalidValue");let pt=Fe?.kind??Un(gt),vt=Fe?as(Fe.entity):Hs(gt),Ct=Fe?.entity.assignableSubjectTypes??tt[t]?.assignableSubjectTypes??gt[t]?.assignableSubjectTypes,Vt=ur(ar(tt.members,pt,Le,vt,Ct),ar(gt.members,pt,Le,vt,Ct)),qt,Fn=!Fe||st.some(({target:kt})=>kt!=="members");await Pn(ct,async()=>{if(Fn)qt=await rs(Je,gt,Le,Fe?.entity)},Vt,Fn?{oaa:()=>ts(K,qt,pt)}:void 0);let Yn=await zn(Je,te,Le);return xt(xe(Yn,Ee,Be))},Oe=async(Ee)=>{let Be=Pe(Ee);if(Be&&Be.entity.requestable!==!0)return Me(Ee);if(Be)await _e(Be,!0);let Le=await zn(Je,te,Ee);if(!Ue(Le))return Me(Ee);let qe=Le[t];if((Be||qe?.source==="code")&&qe?.deprecated!==!0)return Qe(403,`Code-owned entitlement "${Ee}" can be deleted only after it is marked deprecated.`,"mutability");let Fe=Un(Le);if(te){let tt=await te.listByTarget(Fe,Ee),it=[];for(let st of tt.items)await Bn(ct,st,it);await cr(ct,it)}return await ia(Je,Ee),new Response(null,{status:204})};$t={handler:We}}let Dt,Ot,Zt,Kt;if(Ne.userStore){let{userStore:Je,inboundUsers:xe}=Ne,Pe=(Oe)=>Oe?.find((Ee)=>Ee.primary)?.value||Oe?.[0]?.value,_e=async(Oe)=>{if(xe?.mapBaseUserToScim)return await xe.mapBaseUserToScim(Oe);return Fr(Oe)},re=async(Oe,Ee,Be,Le)=>{let qe=Le.projectUser(await _e(Oe)),Fe=qe.id??Oe.id;return{...qe,id:Fe,meta:{...qe.meta,resourceType:"User",location:Fe?It(Ee,`${Be}/${encodeURIComponent(Fe)}`):void 0}}},Re=async(Oe,Ee)=>{if(xe?.mapValidatedScimToBaseUser)return await xe.mapValidatedScimToBaseUser(Oe,Ee);let Be=new Date,Le=Pe(Oe.emails),qe=Oe.name?.formatted||[Oe.name?.givenName,Oe.name?.middleName,Oe.name?.familyName].filter(Boolean).join(" ").trim()||Oe.displayName,Fe=Oe.id||Ee.existing?.id||Sn(),tt=Oe.userName||Le||Ee.existing?.userName||Fe,it=qe||Oe.displayName||Ee.existing?.name||tt,st=Object.fromEntries(Object.entries(Oe).filter(([gt,yt])=>gt.startsWith("urn:")&&gt!==Kn&&gt!==o&&yt!==void 0)),Ye=Oe[o],et=c(Ye?.attributes??{},x),mt=Ye?.ecid!==void 0&&Ye.ecid!==null?j(Ye.ecid):Ee.existing?.ecid,Rt=Ye?.accountClass??Ee.existing?.accountClass,ht=Ee.existing?.sso;return{...Ee.existing??{},id:Fe,userName:tt,name:it,email:Le||Ee.existing?.email||tt,avatar:Oe.profileUrl,sso:{...ht??{},profile:{...ht?.profile??{},sub:Fe,iss:ht?.profile.iss??"iam-provisioned",aud:ht?.profile.aud??"iam-provisioned",exp:ht?.profile.exp??Math.floor(Date.now()/1000)+3600,iat:ht?.profile.iat??Math.floor(Date.now()/1000),email:Le||Ee.existing?.email||tt,email_verified:!0,name:it,preferred_username:tt},tenant:ht?.tenant??{id:"iam-provisioned",name:"IAM Provisioned"},scope:ht?.scope??"openid profile email",tokenType:ht?.tokenType??"Bearer",expires:ht?.expires??new Date(Date.now()+3600000)},externalId:Oe.externalId,ecid:mt,accountClass:Rt,displayName:Oe.displayName,scimName:Oe.name,emails:Oe.emails,nickName:Oe.nickName,title:Oe.title,preferredLanguage:Oe.preferredLanguage,locale:Oe.locale,timezone:Oe.timezone,active:Oe.active,phoneNumbers:Oe.phoneNumbers,ims:Oe.ims,photos:Oe.photos,addresses:Oe.addresses,groups:Oe.groups,entitlements:Oe.entitlements,roles:Oe.roles,x509Certificates:Oe.x509Certificates,scimEnterprise:Oe[Kn],scimSchemaExtensions:Object.keys(st).length>0?st:void 0,createdAt:Ee.existing?.createdAt??(Oe.meta?.created?new Date(Oe.meta.created):Be),updatedAt:Oe.meta?.lastModified?new Date(Oe.meta.lastModified):Be,userType:Oe.userType,...et}},De=async(Oe,Ee)=>{let Be=await nn(Oe);if(!Be)return Qe(401,"Authorization required");let Le=new URL(Oe.url),qe=Ee?.basePath??"/Users",Fe=Le.pathname;if(Fe.startsWith(qe))Fe=Fe.substring(qe.length);let it=Fe.match(/^\/([^/]+)$/)?.[1],st=Oe.method;try{if(it)switch(st){case"GET":return await We(Oe,qe,it,Be);case"PUT":return await Ve(Oe,qe,it,Be);case"PATCH":return await rt(Oe,qe,it,Be);case"DELETE":return await ut(it);default:return Qe(405,"Method not allowed")}else if(Fe===""||Fe==="/")switch(st){case"GET":return await Me(Oe,qe,Be);case"POST":return await ze(Oe,qe,Be);default:return Qe(405,"Method not allowed")}return Qe(404,"Resource not found")}catch(Ye){if(Ye instanceof Hn)return Gs(Ye);if(Ye instanceof s)return Qe(400,Ye.message,Ye.scimType);if(q(Ye))return Qe(409,Ye.message,"uniqueness");return M.error("Users inbound handler error",{"ion.operation":"scim.users.handler","ion.outcome":"failure"},Ye),Qe(500,Ye instanceof Error?Ye.message:"Internal server error")}},Ue=async(Oe)=>{if(Je.getByUserName)return Je.getByUserName(Oe);let Ee=Oe.toLowerCase();for await(let Be of u((Le,qe)=>Je.list({start:Le,limit:qe})))if(Be.userName?.toLowerCase()===Ee)return Be;return},Me=async(Oe,Ee,Be)=>{let Le=new URL(Oe.url),qe=Le.searchParams.get("startIndex"),Fe=Le.searchParams.get("count"),tt=qe!=null?parseInt(qe,10):void 0,it=Fe!=null?parseInt(Fe,10):void 0,st=tt!=null&&!Number.isNaN(tt)?Math.max(0,tt-1):0,Ye=it!=null&&!Number.isNaN(it)?it:void 0,et=Le.searchParams.get("filter"),mt=ti(et);if(et?.trim()&&!mt)return cs(et);let{externalId:Rt,userName:ht}=mt??{};if(Rt!==void 0||ht!==void 0){let pt;if(Rt!==void 0)pt=Je.getByExternalId?await Je.getByExternalId(Rt):await Je.lookup({externalId:Rt});else if(ht!==void 0)pt=await Ue(ht);let vt=pt?[await re(pt,Oe,Ee,Be)]:[];return Ht(vt,{totalResults:vt.length,startIndex:1,itemsPerPage:vt.length})}let gt=await Je.list({start:st,limit:Ye,filter:mt}),yt=await Promise.all(gt.items.map((pt)=>re(pt,Oe,Ee,Be)));return Ht(yt,{totalResults:gt.total,startIndex:st+1,itemsPerPage:gt.count})},We=async(Oe,Ee,Be,Le)=>{let qe=await Je.get(Be);if(!qe)return Qe(404,`User ${Be} not found`,"invalidValue");return xt(await re(qe,Oe,Ee,Le))},$e=async(Oe,Ee)=>{let Be=ct.accessIndex;if(!Be?.setSubjectDisabled||!Ee.id)return;let Le=Oe?Oe.active??!0:!0,qe=Ee.active??!0;if(Oe&&Le===qe)return;if(!Oe&&qe)return;await Be.setSubjectDisabled(Ee.id,"user",!qe)},ze=async(Oe,Ee,Be)=>{let Le=Be.normalizeResource(Be.normalizeUser(await Oe.json())),qe=await dn(A.user,Le);if(qe.issues)return M.error("User creation validation failed",{"ion.operation":"scim.user.create","ion.outcome":"failure",validationIssues:qe.issues}),Qe(400,`Request validation failed: ${qe.issues.map((mt)=>mt.message).join("; ")}`,"invalidValue");let Fe=qe.value;if(!Fe.userName&&!Fe.emails?.[0]?.value)return Qe(400,"userName or email is required","invalidValue");let{id:tt,...it}=Fe,st=await Re(it,{mode:"create"}),Ye={...st,id:st.id?.trim()||Sn()};if(await Je.get(Ye.id))return Qe(409,"User id already exists","uniqueness");await Pn(ct,async()=>{await Je.upsert(Ye),await $e(void 0,Ye)},Qr(void 0,Ye),{oaa:async()=>{await es(K,Ye)},delta:async()=>{await ct.iamDelta?.onUserUpsert(Ye)}});let et=await re(Ye,Oe,Ee,Be);return xt(et,201,et.meta?.location)},Ve=async(Oe,Ee,Be,Le)=>{let qe=await Je.get(Be);if(!qe)return Qe(404,`User ${Be} not found`,"invalidValue");let Fe=Le.normalizeResource(Le.normalizeUser(await Oe.json())),tt=await dn(A.user,Fe);if(tt.issues)return M.error("User replacement validation failed",{"ion.operation":"scim.user.replace","ion.outcome":"failure",validationIssues:tt.issues}),Qe(400,`Request validation failed: ${tt.issues.map((Ye)=>Ye.message).join("; ")}`,"invalidValue");let it=tt.value,st=await Re({...it,id:Be},{existing:qe,mode:"replace"});return st.createdAt=qe.createdAt,st.updatedAt=new Date,await Pn(ct,async()=>{await Je.upsert(st),await $e(qe,st)},Qr(qe,st),{oaa:async()=>{await es(K,st)},delta:async()=>{await Js(ct.iamDelta,qe,st)}}),xt(await re(st,Oe,Ee,Le))},rt=async(Oe,Ee,Be,Le)=>{let qe=await Je.get(Be);if(!qe)return Qe(404,`User ${Be} not found`,"invalidValue");let Fe=await Oe.json();if(!Array.isArray(Fe.Operations))return Qe(400,"PATCH requires Operations","invalidSyntax");let it={...await _e(qe)};for(let et of Le.normalizePatch(Fe.Operations))X(it,et);let st=await dn(A.user,it);if(st.issues)return M.error("User patch validation failed",{"ion.operation":"scim.user.patch","ion.outcome":"failure",validationIssues:st.issues}),Qe(400,`Request validation failed: ${st.issues.map((et)=>et.message).join("; ")}`,"invalidValue");let Ye=await Re(st.value,{existing:qe,mode:"patch"});return Ye.updatedAt=new Date,await Pn(ct,async()=>{await Je.upsert(Ye),await $e(qe,Ye)},Qr(qe,Ye),{oaa:async()=>{await es(K,Ye)},delta:async()=>{await Js(ct.iamDelta,qe,Ye)}}),xt(await re(Ye,Oe,Ee,Le))},ut=async(Oe)=>{let Ee=await Je.get(Oe);if(!Ee)return Qe(404,`User ${Oe} not found`,"invalidValue");if(te){let Be=[];for await(let Le of u((qe,Fe)=>te.listBySubject(Oe,"user",{start:qe,limit:Fe})))await Bn(ct,Le,Be);await cr(ct,Be)}if(await Je.delete(Oe),await ct.accessIndex?.setSubjectDisabled?.(Oe,"user",!1),Ee.externalId&&ct.iamDelta?.isReady())await ln(ct,"iam.delta.egress","IAM delta user delete failed after SCIM write; full aggregation will reconcile",()=>ct.iamDelta?.onUserDelete(Ee.externalId)??Promise.resolve(),{id:Oe,kind:"user"});else if(ct.iamDelta?.isReady())ct.log?.warn("IAM delta: deleted User has no externalId; destination delete skipped",{"ion.operation":"iam.delta.delete","ion.outcome":"skipped",id:Oe,kind:"user"});if(ct.authz.oaa.isReady())await ln(ct,"authz.oaa.delete","OAA incremental user delete failed; full sync will reconcile",()=>ct.authz.oaa.deleteUser(Oe),{id:Oe,kind:"user"});return new Response(null,{status:204})};Dt={handler:De}}let _t=async(Je,xe)=>{if(!te)return;let Pe=[];for await(let _e of u((re,Re)=>te.listBySubject(Je,xe,{start:re,limit:Re})))await Bn(ct,_e,Pe);await cr(ct,Pe)};if(Ne.workloadIdentityStore){let{workloadIdentityStore:Je,inboundWorkloads:xe}=Ne;Ot=ns({resourceType:"Workload",subjectType:"workload",store:Je,validator:A.workload??le,toScim:async(Pe)=>await(xe?.mapBaseWorkloadToScim?.(Pe)??Yr(Pe)),fromScim:async(Pe,_e)=>{if(xe?.mapValidatedScimToBaseWorkload)return xe.mapValidatedScimToBaseWorkload(Pe,_e);let re=_e.existing,Re=Pe,De=Re.id?.trim()||re?.id||Sn(),Ue=c(Re.attributes??{},P);return{...re??{},id:De,externalId:Re.externalId??re?.externalId,clientId:Re.userName??re?.clientId??De,displayName:Re.displayName??re?.displayName,description:Re.description??re?.description,active:Re.active??re?.active??!0,providerId:re?.providerId,requestUrl:re?.requestUrl,...Ue}},projections:[{channel:"oaa",upsert:async(Pe)=>{if(K.oaa.isReady())await K.oaa.pushWorkload(Pe)},delete:async(Pe)=>{if(K.oaa.isReady())await K.oaa.deleteWorkload(Pe.id)}},{channel:"delta",upsert:async(Pe,_e)=>{let re=_e?.externalId??_e?.id,Re=Pe.externalId??Pe.id;if(re&&re!==Re)await nt?.onWorkloadDelete(re);await nt?.onWorkloadUpsert(Pe)},delete:async(Pe)=>{await nt?.onWorkloadDelete(Pe.externalId??Pe.id)}}]},{validateAuth:Mt,accessStore:te,accessIndex:Ie,revokeSubjectAccess:_t,log:M})}if(Ne.customerStore){let{customerStore:Je,inboundCustomers:xe}=Ne;Zt=ns({resourceType:"Customer",subjectType:"customer",store:Je,validator:A.customer??pe,toScim:async(Pe)=>await(xe?.mapBaseCustomerToScim?.(Pe)??Xr(Pe)),fromScim:async(Pe,_e)=>{if(xe?.mapValidatedScimToBaseCustomer)return xe.mapValidatedScimToBaseCustomer(Pe,_e);let re=_e.existing,Re=Pe,De=Re.id?.trim()||re?.id||Sn(),Ue=c(Re.attributes??{},E),Me=Re.emails?.find((We)=>We.primary)?.value??Re.emails?.[0]?.value;return{...re??{},id:De,externalId:Re.externalId??re?.externalId??De,userName:Re.userName??re?.userName??De,name:Re.displayName??re?.name??Re.userName??De,email:Me??re?.email??"",displayName:Re.displayName??re?.displayName,emails:Re.emails??re?.emails,active:Re.active??re?.active??!0,providerId:re?.providerId,requestUrl:re?.requestUrl,...Ue}},projections:[{channel:"oaa",upsert:async(Pe)=>{if(K.oaa.isReady())await K.oaa.pushCustomer(Pe)},delete:async(Pe)=>{if(K.oaa.isReady()&&Pe.id)await K.oaa.deleteCustomer(Pe.id)}},{channel:"delta",upsert:async(Pe,_e)=>{let re=_e?.externalId??_e?.id,Re=Pe.externalId??Pe.id;if(re&&re!==Re)await nt?.onCustomerDelete(re);await nt?.onCustomerUpsert(Pe)},delete:async(Pe)=>{let _e=Pe.externalId??Pe.id;if(_e)await nt?.onCustomerDelete(_e)}}]},{validateAuth:Mt,accessStore:te,accessIndex:Ie,revokeSubjectAccess:_t,log:M})}if(Yt){let Je=Yt,xe=Ne.inboundDelegates;Kt=ns({resourceType:"Delegate",subjectType:"delegate",store:Je,validator:A.delegate??me,toScim:async(Pe)=>{let _e={...await(xe?.mapBaseDelegateToScim?.(Pe)??Zr(Pe))};return _e.lastUsedWindowSeconds=En,delete _e.tokenHash,delete _e.previousTokenHash,delete _e.previousTokenHashExpiresAt,_e},fromScim:async(Pe,_e)=>{let re={...Pe};if(delete re.lastUsedWindowSeconds,xe?.mapValidatedScimToBaseDelegate){let We=await xe.mapValidatedScimToBaseDelegate(re,_e);if(!["user","customer","workload"].includes(We.owner.type))throw new n("Delegate owner must be a user, customer, or workload.",{status:400});if(_e.existing&&(_e.existing.owner.id!==We.owner.id||_e.existing.owner.type!==We.owner.type))throw new n("Delegate owner is immutable.",{status:400});return We}let Re=_e.existing,De=re.owner.type==="User"?"user":re.owner.type==="Customer"?"customer":"workload";if(Re&&(Re.owner.id!==re.owner.value||Re.owner.type!==De))throw new n("Delegate owner is immutable.",{status:400});let Ue=re.tokenHash??Re?.tokenHash;if(!Ue)throw new n("Delegate tokenHash is required.",{status:400});let Me=(We,$e)=>We?new Date(We):$e;return{...Re??{},id:re.id?.trim()||Re?.id||Sn(),externalId:re.externalId??Re?.externalId,owner:Re?.owner??{id:re.owner.value,type:De},label:re.displayName??Re?.label,clientId:re.clientId??Re?.clientId,active:re.active??Re?.active??!0,expiresAt:Me(re.expiresAt,Re?.expiresAt),tokenHash:Ue,previousTokenHash:re.previousTokenHash??Re?.previousTokenHash,previousTokenHashExpiresAt:Me(re.previousTokenHashExpiresAt,Re?.previousTokenHashExpiresAt),lastUsedAt:Re?.lastUsedAt,providerId:Re?.providerId,requestUrl:Re?.requestUrl}},projections:[{channel:"oaa",upsert:async(Pe)=>{if(K.oaa.isReady())await K.oaa.pushDelegate(Pe)},delete:async(Pe)=>{if(K.oaa.isReady())await K.oaa.deleteDelegate(Pe.id)}},{channel:"delta",upsert:async(Pe,_e)=>{let re=_e?.externalId??_e?.id,Re=Pe.externalId??Pe.id;if(re&&re!==Re)await nt?.onDelegateDelete(re);await nt?.onDelegateUpsert(Pe)},delete:async(Pe)=>{await nt?.onDelegateDelete(Pe.externalId??Pe.id)}}]},{validateAuth:Mt,accessStore:te,accessIndex:Ie,revokeSubjectAccess:_t,log:M})}async function rn(Je,xe){pn();let Pe=new URL(Je.url).pathname,_e=Nt(xe?.usersUrl??Ne.usersUrl??"/api/iam/Users")??"/api/iam/Users",re=Nt(xe?.groupsUrl??Ne.groupsUrl??"/api/iam/Groups")??"/api/iam/Groups",Re=Nt(xe?.workloadsUrl??Ne.workloadsUrl??"/api/iam/Workloads")??"/api/iam/Workloads",De=Nt(xe?.customersUrl??Ne.customersUrl??"/api/iam/Customers")??"/api/iam/Customers",Ue=Nt(xe?.delegatesUrl??Ne.delegatesUrl??"/api/iam/Delegates")??"/api/iam/Delegates",Me=`${Zs(_e,re,Re,De,Ue)??"/api/iam"}/AccessRequests`,We=await Wt(Je,xe);if(We)return We;let $e=(ze)=>Pe===ze||Pe.startsWith(`${ze}/`);if($e(_e)){if(!ft)return Qe(404,"SCIM Users endpoint is disabled by RemoteConfig");if(!Dt)return Qe(501,"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application.");return Dt.handler(Je,{basePath:_e})}if($e(re)){if(!St)return Qe(404,"SCIM Groups endpoint is disabled by RemoteConfig");if(!$t)return Qe(501,"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application.");return $t.handler(Je,{basePath:re})}if($e(Re)){if(!bt)return Qe(404,"SCIM Workloads endpoint is disabled by RemoteConfig");if(!Ot)return Qe(501,"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application.");return Ot.handler(Je,{basePath:Re})}if($e(De)){if(!Ut)return Qe(404,"SCIM Customers endpoint is disabled by RemoteConfig");if(!Zt)return Qe(501,"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application.");return Zt.handler(Je,{basePath:De})}if($e(Ue)){if(!Ft)return Qe(404,"SCIM Delegates endpoint is disabled by RemoteConfig");if(!Kt)return Qe(501,"SCIM Delegates endpoint is enabled by RemoteConfig but no delegate store capability is wired by the application.");return Kt.handler(Je,{basePath:Ue})}if($e(Me)){if(!Ne.accessRequests)return Qe(404,"AccessRequests endpoint is not configured");if(!await Mt(Je))return Qe(401,"Authorization required");if(Je.method==="GET"){if(!Ne.accessRequests.get)return Qe(404,"AccessRequests read endpoint is not configured");let rt=Pe.startsWith(`${Me}/`)?Pe.slice(Me.length+1):void 0;if(!rt||rt.includes("/"))return Qe(404,"AccessRequest not found");let ut;try{ut=decodeURIComponent(rt)}catch{return Qe(400,"AccessRequest id is invalid","invalidValue")}let Oe=await Ne.accessRequests.get(ut);if(!Oe)return Qe(404,"AccessRequest not found");return xt(Oe,200,Oe.trackingUrl)}if(Je.method!=="POST"||Pe!==Me)return Qe(405,"Method not allowed");let ze;try{ze=await Je.json()}catch{return Qe(400,"Request body must be valid JSON","invalidSyntax")}if(typeof ze.subject!=="string"||!ze.subject||typeof ze.target!=="string"||!ze.target||ze.subjectType!=="user"&&ze.subjectType!=="workload"&&ze.subjectType!=="customer"&&ze.subjectType!=="delegate"||ze.targetType!=="group"&&ze.targetType!=="role"&&ze.targetType!=="permission"||ze.operation!=="grant"&&ze.operation!=="revoke")return Qe(400,"subject, subjectType, targetType, target, and operation are required","invalidValue");let Ve=await Ne.accessRequests.create({subject:ze.subject,subjectType:ze.subjectType,targetType:ze.targetType,target:ze.target,operation:ze.operation,justification:typeof ze.justification==="string"?ze.justification:void 0});return xt(Ve.request,Ve.created?201:200,Ve.request.trackingUrl)}return Qe(404,"Resource not found")}let yn;return yn={...Ne,describe:()=>({module:"iam",active:!0,ready:yn.isReady?.()??!0,url:Ne.url,deltaAudience:Ne.deltaAudience,accessRequests:{...Ne.url?{iam:`${I(Ne.url)}/AccessRequests`}:{},ciam:{}},users:{...cn(Ne.users),storeWired:Ne.userStore!==void 0},workloads:{...cn(Ne.workloads),storeWired:Ne.workloadIdentityStore!==void 0},customers:{...cn(Ne.customers),storeWired:Ne.customerStore!==void 0},delegates:{...cn(Ne.delegates),storeWired:Yt!==void 0},groups:{enabled:St,catalogWired:Te!==void 0},urls:{usersUrl:Ne.usersUrl??"",groupsUrl:Ne.groupsUrl??"",workloadsUrl:Ne.workloadsUrl??"",customersUrl:Ne.customersUrl??"",delegatesUrl:Ne.delegatesUrl??""}}),users:cn(Ne.users),workloads:cn(Ne.workloads),customers:cn(Ne.customers),delegates:cn(Ne.delegates),groups:{enabled:St},createUser:Xt,getBaseUrl:vn,groups_outbound:gn,groups_inbound:$t,users_inbound:Dt,workloads_inbound:Ot,customers_inbound:Zt,delegates_inbound:Kt,handler:rn,delta:nt},yn}function ls(A,M){let N=new TextEncoder().encode(A),K=typeof M==="string"?new TextEncoder().encode(M):M,te=new Uint8Array(N.length+1+K.length);return te.set(N,0),te[N.length]=46,te.set(K,N.length+1),te}function la(A){let M=A.replace(/-/g,"+").replace(/_/g,"/"),N=M.length%4===0?"":"=".repeat(4-M.length%4),K=atob(M+N),te=new Uint8Array(K.length);for(let Ie=0;Ie<K.length;Ie++)te[Ie]=K.charCodeAt(Ie);return te}function pa(A){let M="";for(let N of A)M+=String.fromCharCode(N);return btoa(M).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function ni(A){let M=JSON.parse(A);if(!M||typeof M!=="object"||!Array.isArray(M.keys))throw Error("Invalid JWKS: expected { keys: [...] }");return M}function ma(A){return JSON.stringify(A)}async function fa(A){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:A.x},{name:"Ed25519"},!0,["verify"])}async function ga(A){return crypto.subtle.importKey("jwk",{kty:"OKP",crv:"Ed25519",x:A.x,d:A.d},{name:"Ed25519"},!0,["sign"])}async function ya(A){let N=(typeof A.jwks==="string"?ni(A.jwks):A.jwks).keys.find((K)=>K.kid===A.kid&&K.kty==="OKP"&&K.crv==="Ed25519");if(!N?.x)return!1;try{let K=await fa(N),te=ls(A.requestId,A.rawBody),Ie=la(A.signatureB64Url);return crypto.subtle.verify({name:"Ed25519"},K,Ie,te)}catch{return!1}}async function ha(A){let M=await ga(A.privateKeyJwk),N=ls(A.requestId,A.rawBody),K=await crypto.subtle.sign({name:"Ed25519"},M,N);return pa(new Uint8Array(K))}async function ka(A){let M=await crypto.subtle.generateKey({name:"Ed25519"},!0,["sign","verify"]),N=await crypto.subtle.exportKey("jwk",M.privateKey),te=(await crypto.subtle.exportKey("jwk",M.publicKey)).x,Ie=N.d;if(!te||!Ie)throw Error("Failed to export Ed25519 key material (missing x/d)");return{privateJwk:{kty:"OKP",crv:"Ed25519",x:te,d:Ie,kid:A,alg:"EdDSA",use:"sig"},publicJwks:{keys:[{kty:"OKP",crv:"Ed25519",x:te,kid:A,alg:"EdDSA",use:"sig"}]}}}var Jn={jwksTtlSeconds:{min:60,max:86400,default:600},jwksMaxEntries:{min:16,max:4096,default:256},sessionReadTtlSeconds:{min:1,max:300,default:30},sessionReadMaxEntries:{min:16,max:65536,default:1024}};function lr(A,M){if(typeof A!=="number"||!Number.isFinite(A))return M.default;let N=Math.floor(A);if(N<M.min)return M.min;if(N>M.max)return M.max;return N}function ri(A){return{ttlMs:lr(A?.ttlSeconds,Jn.jwksTtlSeconds)*1000,maxEntries:lr(A?.maxEntries,Jn.jwksMaxEntries)}}function si(A){let M=A?.read;return{read:{enabled:M?.enabled===!0,ttlMs:lr(M?.ttlSeconds,Jn.sessionReadTtlSeconds)*1000,maxEntries:lr(M?.maxEntries,Jn.sessionReadMaxEntries)}}}function Sa(A){return{jwks:ri(A?.jwks),session:si(A?.session)}}var pr=new TextEncoder,wa=new TextDecoder;function ai(A){let M="";for(let N of A)M+=String.fromCharCode(N);return btoa(M).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function ii(A){return ai(pr.encode(JSON.stringify(A)))}function ci(A){if(!/^[A-Za-z0-9_-]+$/.test(A))return;let M=A.replace(/-/g,"+").replace(/_/g,"/").padEnd(Math.ceil(A.length/4)*4,"=");try{return Uint8Array.from(atob(M),(N)=>N.charCodeAt(0))}catch{return}}function oi(A){let M=ci(A);if(!M)return;try{let N=JSON.parse(wa.decode(M));return N!==null&&typeof N==="object"&&!Array.isArray(N)?N:void 0}catch{return}}function ba(A){return pr.encode(A)}function ui(A){let M=new Uint8Array(A.byteLength);return M.set(A),M.buffer}async function di(A){return crypto.subtle.importKey("raw",ui(ba(A)),{name:"HMAC",hash:"SHA-256"},!1,["sign","verify"])}function Ca(A){let M=A.active.trim(),N=new Map(Object.entries(A.keys).map(([te,Ie])=>[te.trim(),{kid:te.trim(),secret:Ie}])),K=N.get(M);if(!M||!K?.secret)throw Error("Signing key ring must name a non-empty active key.");for(let te of N.values())if(!te.kid||!te.secret)throw Error("Signing key ring ids and secrets must be non-empty.");return{current:()=>K,find:(te)=>N.get(te)}}async function va(A,M,N){let K=Math.floor(N.ttlSeconds);if(!Number.isFinite(K)||K<1)throw Error("Compact JWT ttlSeconds must be a positive integer.");let te=M.current();if(!te.kid||!te.secret)throw Error("Signing key ring returned an invalid active key.");let Ie=Math.floor(Date.now()/1000),Te=ii({alg:"HS256",kid:te.kid,typ:"JWT"}),ve=ii({...A,iat:Ie,exp:Ie+K}),Ae=`${Te}.${ve}`,be=await crypto.subtle.sign("HMAC",await di(te.secret),pr.encode(Ae));return`${Ae}.${ai(new Uint8Array(be))}`}async function Ra(A,M){let N=A.split(".");if(N.length!==3)return null;let[K,te,Ie]=N;if(!K||!te||!Ie)return null;let Te=oi(K);if(Te?.alg!=="HS256"||Te.typ!=="JWT"||typeof Te.kid!=="string")return null;let ve=M.find(Te.kid);if(!ve?.secret)return null;let Ae=ci(Ie);if(!Ae)return null;if(!await crypto.subtle.verify("HMAC",await di(ve.secret),ui(Ae),pr.encode(`${K}.${te}`)))return null;let He=oi(te);if(!He)return null;let{iat:nt,exp:dt}=He;if(typeof nt!=="number"||typeof dt!=="number"||!Number.isSafeInteger(nt)||!Number.isSafeInteger(dt))return null;let at=Math.floor(Date.now()/1000);if(nt>at+60||dt+60<=at)return null;return He}function Ia(A){let M={};if(!A)return M;let N=A.split(";");for(let K of N){let te=K.trim();if(!te)continue;let Ie=te.indexOf("=");if(Ie===-1)continue;M[te.slice(0,Ie).trim()]=te.slice(Ie+1).trim()}return M}function li(A){if(!A.expiresAt)return!1;let M=A.expiresAt instanceof Date?A.expiresAt:new Date(A.expiresAt);return!Number.isNaN(M.getTime())&&Date.now()>M.getTime()}function Aa(A){if(!A||typeof A!=="object"||Array.isArray(A))return;let{access_token:M,id_token:N,refresh_token:K,tokens:te,...Ie}=A;return Ie}function Bt(A,M){let N=A[M];return typeof N==="string"?N:""}function Ta(A,M){let N=A.exp;if(typeof N==="number")return new Date(N*1000);if(typeof N==="string"&&N.trim()){let K=Number(N);if(!Number.isNaN(K))return new Date(K*1000)}if(M instanceof Date)return M;if(M){let K=new Date(M);if(!Number.isNaN(K.getTime()))return K}return new Date}function xa(A){let M=A.claims;if(!M?.sub||typeof M.sub!=="string")return;let N=Ta(M,A.expiresAt);if(A.authType==="sso")return{id:M.sub,userName:Bt(M,"preferred_username"),name:Bt(M,"name"),email:Bt(M,"email"),avatar:Bt(M,"picture")||void 0,sso:{profile:M,tenant:{id:Bt(M,"idp")||Bt(M,"iss"),name:Bt(M,"iss")},tokenType:"Bearer",expires:N}};return{id:M.sub,userName:Bt(M,"preferred_username"),name:Bt(M,"name"),email:Bt(M,"email"),avatar:Bt(M,"picture")||void 0,userType:"customer",ciam:{profile:M,scope:"openid profile email",tokenType:"Bearer",expires:N}}}function Pa(A){if(A.authType!=="sso"&&A.authType!=="ciam")return;if(li(A))return;return{sid:A.sid,authType:A.authType,tenantId:typeof A.tenantId==="string"?A.tenantId:void 0,sub:A.sub,expiresAt:A.expiresAt,createdAt:A.createdAt,claims:Aa(A.claims)}}function Ua(A,M){if(!A.endsWith(".session"))return!1;if(!M||M.length===0)return!0;return M.some((N)=>A===`${N}.session`)}function Ea(A){if(A===void 0)return;let M=(Array.isArray(A)?A:[A]).map((N)=>N.trim()).filter((N)=>N.length>0);return M.length>0?M:void 0}async function pi(A,M,N){return(await mi(A,M,N)).map(Pa).filter((te)=>Boolean(te))}async function mi(A,M,N){let K=Ia(A.headers.get("cookie")),te=Ea(N?.cookiesPrefix),Ie=[],Te=new Set;for(let[ve,Ae]of Object.entries(K)){if(!Ua(ve,te)||!Ae)continue;if(Te.has(Ae))continue;Te.add(Ae);let be=await M.get(Ae);if(!be)continue;if(be.authType!=="sso"&&be.authType!=="ciam")continue;if(li(be))continue;Ie.push(be)}return Ie}async function Da(A,M,N){return(await pi(A,M,N)).map(xa).filter((te)=>Boolean(te))}var Ma="@ionite/core",Oa=m(T(Ma));async function _a(A,M){let N=await on({idToken:A,jwksUri:M.jwksUri,issuer:M.issuer,audience:M.audience}),K=await Oa.validate(N);if(K.issues)throw Error(`ID token claims validation failed: ${K.issues.map((Te)=>Te.message).join("; ")}`);let te=K.value;if(te===void 0)throw Error("ID token claims missing");return Q(te)}function Pt(A){return Date.now()-A}function ps(A){if(A instanceof Error)return{"error.name":A.name,"error.message":A.message};return{"error.name":typeof A,"error.message":String(A)}}function mr(A,M){if(!A)return{};try{let N=new URL(A);return{[`${M}.origin`]:N.origin,[`${M}.path`]:N.pathname}}catch{return{[`${M}.path`]:A.startsWith("/")?A:`/${A}`}}}function fr(A,M=5){if(!Array.isArray(A))return[String(A)];return A.slice(0,M).map((N)=>{if(!N||typeof N!=="object")return String(N);let K=N,te=Array.isArray(K.path)?K.path.join("."):String(K.path??""),Ie=typeof K.message==="string"?K.message:String(K.message??"validation failed");return te?`${te}: ${Ie}`:Ie})}function ja(A){if(!A||typeof A!=="object")return{};let M=A;return{oidc_error:typeof M.error==="string"?M.error:void 0,oidc_error_description:typeof M.error_description==="string"?M.error_description:void 0,oidc_error_uri:typeof M.error_uri==="string"?M.error_uri:void 0}}function Na(A,M={}){let N=typeof A==="string"?A:A?.headers.get("cookie")??void 0;if(!N)return[];let te=`${M.cookiePrefix??"ion.sso"}.`,Ie=new Set;for(let Te of Object.keys(Wa(N))){if(!Te.startsWith(te))continue;let ve=Te.slice(te.length),Ae=ve.lastIndexOf(".");if(Ae<=0)continue;let be=ve.slice(0,Ae).trim();if(be)Ie.add(be)}return Array.from(Ie)}function La(A,M,N,K,te){if(!N&&!K)return;let Ie=new WeakMap,Te=new Map,ve={...N,...K},Ae=!!(ve.authority&&ve.tokenUrl&&ve.authorizationUrl&&ve.clientId&&ve.redirectUri&&ve.scope),be={...ve,authority:Ae?e(ve.authority,"Missing 'authority' from SSO Config"):ve.authority,tokenUrl:Ae?e(ve.tokenUrl,"Missing 'tokenUrl' from SSO Config"):ve.tokenUrl,authorizationUrl:Ae?e(ve.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"):ve.authorizationUrl,clientId:Ae?e(ve.clientId,"Missing 'clientId' from SSO Config"):ve.clientId,redirectUri:Ae?e(ve.redirectUri,"Missing 'redirectUri' from SSO Config"):ve.redirectUri,scope:Ae?e(ve.scope,"Missing 'scope' from SSO Config"):ve.scope,responseType:ve.responseType??"code",cookiesSecure:ve.cookiesSecure!==void 0?ve.cookiesSecure:!0,cookiesSameSite:ve.cookiesSameSite!==void 0?ve.cookiesSameSite:"Strict",cookiesPrefix:ve.cookiesPrefix??(ve.clientId?`ion.sso.${ve.clientId}`:"ion.sso"),cookiesPath:ve.cookiesPath??"/",cookiesDomain:tr(ve.cookiesDomain)},He=Math.min(600,Math.max(0,Math.floor(Number(be.rotationGraceSeconds??60))||0))*1000,nt=Math.floor(Number(be.sessionWindowSeconds??86400)),dt=Number.isFinite(nt)&&nt>=1?nt:86400;function at(){let xe=[];if(!be.authority)xe.push("authority");if(!be.tokenUrl)xe.push("tokenUrl");if(!be.authorizationUrl)xe.push("authorizationUrl");if(!be.clientId)xe.push("clientId");if(!be.redirectUri)xe.push("redirectUri");if(!be.scope)xe.push("scope");if(xe.length>0)throw Error(`Missing OIDC configuration fields: ${xe.join(", ")}. OIDC configuration is required for SSO operations. Please provide these fields either in your vault configuration or in the SSO config when initializing ionite.`)}async function Ke(xe){if(!be)throw Error("ionite SSO Manager not initialized");let Pe=Ie.get(xe);if(Pe)return Pe;let _e=Ze(xe);return Ie.set(xe,_e),_e}async function Ze(xe){try{let{tokens:Pe,session:_e,refreshedUser:re}=await Wt(xe);if(!Pe)return{status:"unauthenticated"};if(_e)_n(xe,"user",_e.entitlements);if(re)return{status:"authenticated",value:re};if(_e?.claims)return{status:"authenticated",value:Ut(_e.claims,Pe,Lt(_e.expiresAt))};return{status:"unauthenticated"}}catch(Pe){if(fi(Pe))return{status:"unauthenticated"};return M.error("Error parsing user from cookies",{"ion.operation":"cookie.parse","ion.outcome":"degraded"},Pe),{status:"degraded",error:Pe instanceof Error?Pe:void 0}}}async function ot(xe){let Pe=await Ke(xe);return Pe.status==="authenticated"?Pe.value:void 0}async function ct(xe){if(!be)throw Error("ionite SSO Manager not initialized");at();let Pe=e(be.redirectUri,"Missing 'redirectUri' from SSO Config"),_e=e(be.authorizationUrl,"Missing 'authorizationUrl' from SSO Config"),re=e(be.clientId,"Missing 'clientId' from SSO Config"),Re=e(be.scope,"Missing 'scope' from SSO Config"),De=be.cookiesSecure?xe.url.replace(/^http:\/\//,"https://"):xe.url,Ue=zt(),Me=zt(64),We=zt(),$e=Pe;try{new URL($e)}catch{if(De)try{let Oe=new URL(De),Ee=$e.startsWith("//")?$e.slice(1):$e.startsWith("/")?$e:`/${$e}`;$e=new URL(Ee,Oe.origin).toString()}catch{try{let Oe=new URL(_e),Ee=$e.startsWith("//")?$e.slice(1):$e.startsWith("/")?$e:`/${$e}`;$e=new URL(Ee,Oe.origin).toString()}catch{throw Error(`Invalid redirectUri: "${Pe}". It must be a valid absolute URL.`)}}}let ze=new URL(_e);ze.searchParams.append("client_id",re),ze.searchParams.append("redirect_uri",$e),ze.searchParams.append("response_type","code"),ze.searchParams.append("scope",Re),ze.searchParams.append("state",Ue),ze.searchParams.append("nonce",We);let Ve=await Vn(Me);ze.searchParams.append("code_challenge",Ve),ze.searchParams.append("code_challenge_method","S256");let rt=await be.beforeLogin?.({request:xe}),ut=rt===void 0?{state:Ue,codeVerifier:Me,nonce:We}:{state:Ue,codeVerifier:Me,nonce:We,context:rt};return new Response("Redirecting to SSO Provider",{status:302,headers:{Location:ze.toString(),"Set-Cookie":Xt(rn(Ue),ut,be.loginStateTtl??600,"Lax")}})}async function lt(xe){if(!be)throw Error("ionite SSO Manager not initialized");let Pe;try{Pe=await ot(xe)}catch{Pe=void 0}let _e=await be.beforeLogout?.({request:xe,user:Pe}),re=_t("session",xe),Re;try{Re=await Wt(xe);let Ve=Re.tokens?.refresh_token??_t("refresh",xe);if(Ve)await Cn(Ve)}catch(Ve){M.warn("Failed to revoke token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},Ve)}if(be.sessionStore)try{let Ve=Re?.sid??re;if(Ve)await be.sessionStore.delete(Ve)}catch(Ve){M.warn("Failed to delete session",{"ion.operation":"session.delete","ion.outcome":"degraded"},Ve)}let De=Ot(),Ue=await be.afterLogout?.({request:xe,context:_e}),Me=an(Ue,"/",xe.url);if(Me.response){let Ve=new Headers(Me.response.headers);for(let[,rt]of De)Ve.append("Set-Cookie",rt);return new Response(Me.response.body,{status:Me.response.status,statusText:Me.response.statusText,headers:Ve})}let We=Me.location??"/",$e=xe.headers.get("accept");if($e?.includes(a)||$e?.includes("text/javascript"))return new Response(JSON.stringify({success:!0,message:"Logged out",redirect:We}),{status:200,headers:[["Content-Type",a],...De]});return new Response("Logged out",{status:302,headers:[["Location",We],...De]})}async function Ne(xe){if(!be)throw Error("ionite SSO Manager not initialized");if(!be.sessionStore)throw Error("Back-Channel Logout requires sessionStore configuration");try{if(!xe.headers.get("content-type")?.includes(L))return new Response("Invalid Content-Type, expected application/x-www-form-urlencoded",{status:400});let _e=await xe.text(),Re=new URLSearchParams(_e).get("logout_token");if(!Re)return new Response("Missing logout_token parameter",{status:400});let De=e(be.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify logout tokens."),Ue=e(be.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify logout tokens."),Me=be.jwksUri||`${De}/protocol/openid-connect/certs`,We=await zr({logoutToken:Re,jwksUri:Me,issuer:De,audience:Ue,log:M}),$e=typeof We.sid==="string"?We.sid:void 0;if(!$e)return M.warn("Back-Channel Logout: logout_token missing sid claim",{"ion.operation":"backchannel_logout","ion.outcome":"failure"}),new Response("Invalid logout_token: missing sid claim",{status:400});return await be.sessionStore.deleteByIdpSid($e),M.info("Back-Channel Logout: successfully deleted session",{"ion.module":"sso",sid:$e}),new Response("OK",{status:200})}catch(Pe){return M.error("Error during back-channel logout",{"ion.operation":"backchannel_logout","ion.outcome":"failure"},Pe),new Response("Internal Server Error",{status:500})}}async function ft(xe){if(!be)throw Error("ionite SSO Manager not initialized");let Pe=Date.now(),_e=new URL(xe.url),re=new URLSearchParams(_e.search);M.debug("SSO callback received",{"ion.event":"ion.sso.callback.received","ion.module":"sso","ion.operation":"sign_in.callback","http.method":xe.method,"url.path":_e.pathname,hasCode:re.has("code"),hasState:re.has("state"),hasError:re.has("error"),...mr(re.get("iss")??void 0,"oidc.issuer")});let Re=Object.fromEntries(re.entries()),De=await A.callbackParams.validate(Re);if(De.issues)return M.warn("SSO callback parameter validation failed",{"ion.event":"ion.sso.callback.validation_failed","ion.operation":"sign_in.callback","ion.outcome":"failure","validation.issues":fr(De.issues)}),Se(De.issues,"OIDC callback parameters validation failed");let{code:Ue,state:Me}=De.value,We;try{let $e=e(Me,'OIDC "state" was not present in the callback parameters'),ze=_t(rn($e),xe,!0),{codeVerifier:Ve,state:rt,nonce:ut,context:Oe}=ze??{};We=Oe,M.debug("SSO callback state cookie read",{"ion.event":"ion.sso.callback.state_cookie_read","ion.module":"sso","ion.operation":"sign_in.callback",hasStateCookie:Boolean(ze),hasCodeVerifier:Boolean(Ve),hasStateVerifier:Boolean(rt),hasNonce:Boolean(ut),hasContext:Oe!==void 0});let Ee=e(Ve,'OIDC "codeVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');e(rt,'OIDC "stateVerifier" was not present in cookies, ensure that the SSO login was initiated correctly');let Be=e(ut,'OIDC "nonce" was not present in cookies, ensure that the SSO login was initiated correctly'),Le=e(Ue,'OIDC "code" was not present in the callback parameters');if(Me!==rt)throw M.warn("SSO callback state verification failed",{"ion.event":"ion.sso.callback.state_verification_failed","ion.operation":"sign_in.callback","ion.outcome":"failure"}),Error('SSO State Verifier failed, the "state" request parameter does not equal the "state" in the SSO cookie');M.debug("SSO callback state verified",{"ion.event":"ion.sso.callback.state_verified","ion.module":"sso","ion.operation":"sign_in.callback"});let qe=be.cookiesSecure?xe.url.replace(/^http:\/\//,"https://"):xe.url,Fe=await Yt(Le,Ee,qe),{tokenExpiresAt:tt,sessionExpiresAt:it}=St(Fe);Fe.expires=tt.toISOString();let st=Date.now();M.debug("SSO ID token parsing started",{"ion.event":"ion.sso.id_token.parse_started","ion.module":"sso","ion.operation":"id_token.parse"});let Ye=await bt(Fe,Be,it);M.debug("SSO ID token parsing completed",{"ion.event":"ion.sso.id_token.parse_completed","ion.module":"sso","ion.operation":"id_token.parse","duration.ms":Pt(st),"user.id":Ye.id});let et,mt;{let yt=Mt("SSO requires sessionStore configuration for opaque session cookies."),pt=typeof Ye.sso.profile.sid==="string"?Ye.sso.profile.sid:void 0,vt=pt||zt(32),Ct=Ye.id;if(M.debug("SSO session creation evaluated",{"ion.event":"ion.sso.session.create_evaluated","ion.module":"sso","ion.operation":"session.create",hasSid:Boolean(vt),hasIdpSid:Boolean(pt),hasSub:Boolean(Ct),"user.id":Ct}),!Ct)throw Error("Session creation failed: missing sub in ID token claims");let Vt=Date.now(),qt=await fn({sid:vt,sub:Ct,idpSid:pt,authType:"sso",tenantId:be.tenantId,tokens:Fe,claims:Ye.sso.profile,expiresAt:it,createdAt:new Date},Ct,Ye.sso.profile,Fe);await vn(yt,qt),mt=qt,et=["Set-Cookie",Xt("session",vt,it)],M.info("SSO session created",{"ion.event":"ion.sso.session.created","ion.operation":"session.create","ion.outcome":"success","duration.ms":Pt(Vt),"user.id":Ct})}if(be.userStore)try{let yt=Ye.id;if(yt){let pt=new Date,vt=Date.now();M.debug("SSO user store lookup started",{"ion.event":"ion.sso.user.lookup_started","ion.module":"sso","ion.operation":"user.lookup","user.id":yt});let Ct=await be.userStore.get(yt);if(M.debug("SSO user store lookup completed",{"ion.event":"ion.sso.user.lookup_completed","ion.module":"sso","ion.operation":"user.lookup","duration.ms":Pt(vt),"user.id":yt,found:Boolean(Ct)}),Ct||be.enableJitUserProvisioning){let Vt=Date.now(),qt={...Ct??{},...Ye,id:yt,tenantId:Ct?.tenantId,createdAt:Ct?.createdAt??pt,updatedAt:pt};await be.userStore.upsert(qt),M.info("SSO user stored",{"ion.event":"ion.sso.user.stored","ion.operation":"user.store","ion.outcome":"success","duration.ms":Pt(Vt),"user.id":yt,existing:Boolean(Ct),jitProvisioning:Boolean(be.enableJitUserProvisioning)})}else M.warn("JIT user provisioning disabled: user not found in store and will not be created",{"ion.event":"ion.sso.user.skipped","ion.operation":"user.store","ion.outcome":"skipped","user.id":yt})}else M.warn("User storage skipped: missing sub in ID token claims",{"ion.event":"ion.sso.user.skipped","ion.operation":"user.store","ion.outcome":"skipped"})}catch(yt){M.warn("Failed to store user",{"ion.event":"ion.sso.user.store_failed","ion.operation":"user.store","ion.outcome":"degraded",...ps(yt)})}M.info("SSO sign-in succeeded",{"ion.event":"ion.sso.sign_in.succeeded","ion.operation":"sign_in.callback","ion.outcome":"success","duration.ms":Pt(Pe),"user.id":Ye.id});let Rt=[["Set-Cookie",$t(rn($e))],...et?[et]:[],...et?await Kt(xe,await Ft(Ye),it):[]],ht=await be.afterLogin?.({ok:!0,request:xe,user:Ye,session:mt,context:We,displayCookie:be.displayCookie,displayCookieAttributes:Dt()}),gt=an(ht,"/",xe.url);if(gt.response)return kn(gt.response,Rt.map(([,yt])=>yt));return new Response("Authentication successful, redirecting",{status:302,headers:[["Location",gt.location],...Rt]})}catch($e){M.error("Error during sign-in callback",{"ion.event":"ion.sso.sign_in.callback_failed","ion.operation":"sign_in.callback","ion.outcome":"failure","duration.ms":Pt(Pe),...ps($e)});let ze=Me?[["Set-Cookie",$t(rn(Me))]]:[],Ve=await be.afterLogin?.({ok:!1,request:xe,error:$e,context:We,displayCookie:be.displayCookie,displayCookieAttributes:Dt()}),rt=an(Ve,"/",xe.url);if(rt.response)return kn(rt.response,ze.map(([,ut])=>ut));return new Response("Authentication failed, redirecting",{status:302,headers:[["Location",rt.location],...ze]})}}function St(xe){let Pe=Date.now(),_e=Number(xe.expires_in??3600)||3600,re=new Date(Pe+_e*1000),Re;if(xe.refresh_expires_in!=null&&Number.isFinite(Number(xe.refresh_expires_in)))Re=Number(xe.refresh_expires_in);else if(xe.refresh_token)Re=dt;else Re=_e;return{tokenExpiresAt:re,sessionExpiresAt:new Date(Pe+Re*1000)}}async function bt(xe,Pe,_e){if(!be)throw Error("ionite SSO Manager not initialized");let re=Date.now(),Re=await nn(xe.id_token,Pe);return M.debug("SSO user parsed from ID token",{"ion.event":"ion.sso.user.parse_completed","ion.module":"sso","ion.operation":"id_token.parse","duration.ms":Pt(re),"user.id":Re.sub,hasEmail:Boolean(Re.email),hasName:Boolean(Re.name)}),Ut(Re,xe,_e)}function Ut(xe,Pe,_e){let re=_e??St(Pe).sessionExpiresAt,Re=xe.ecid!==void 0&&xe.ecid!==null?j(xe.ecid):void 0;return{id:xe.sub,userName:xe.preferred_username||"",name:xe.name||"",email:xe.email||"",emails:[{value:xe.email||"",primary:!0}],...Re?{ecid:Re}:{},avatar:xe.picture,sso:{profile:{...xe},tenant:{id:xe.idp||xe.iss||"",name:xe.iss||""},scope:Pe.scope,tokenType:Pe.token_type,sessionState:Pe.session_state,expires:re}}}async function Ft(xe){if(!be.userStore)return xe;let Pe=await be.userStore.lookup(xe);if(!Pe)return xe;return{...xe,...Pe,id:xe.id,sso:xe.sso}}async function Yt(xe,Pe,_e){if(!be)throw Error("ionite SSO Manager not initialized");at();let re=e(be.tokenUrl,"Missing 'tokenUrl' from SSO Config"),Re=e(be.redirectUri,"Missing 'redirectUri' from SSO Config"),De=e(be.clientId,"Missing 'clientId' from SSO Config"),Ue=Re;try{new URL(Ue)}catch{if(_e)try{let We=new URL(_e),$e=Ue.startsWith("//")?Ue.slice(1):Ue.startsWith("/")?Ue:`/${Ue}`;Ue=new URL($e,We.origin).toString()}catch{try{let We=new URL(re),$e=Ue.startsWith("//")?Ue.slice(1):Ue.startsWith("/")?Ue:`/${Ue}`;Ue=new URL($e,We.origin).toString()}catch{throw Error(`Invalid redirectUri: "${Re}". It must be a valid absolute URL.`)}}}let Me=new URLSearchParams;if(Me.append("grant_type","authorization_code"),Me.append("code",xe),Me.append("redirect_uri",Ue),Me.append("client_id",De),be.clientSecret)Me.append("client_secret",be.clientSecret);Me.append("code_verifier",Pe);try{let We=Date.now();M.debug("SSO token exchange started",{"ion.event":"ion.sso.token.exchange_started","ion.module":"sso","ion.operation":"token.exchange",...mr(re,"oidc.token_url"),...mr(Ue,"oidc.redirect_uri"),hasClientSecret:Boolean(be.clientSecret)});let $e=await fetch(re,{method:"POST",headers:{...w,...l},body:Me.toString()});M.debug("SSO token exchange response received",{"ion.event":"ion.sso.token.response_received","ion.module":"sso","ion.operation":"token.exchange","http.status_code":$e.status,"duration.ms":Pt(We)}),M.debug("SSO token exchange response body read started",{"ion.event":"ion.sso.token.response_body_read_started","ion.module":"sso","ion.operation":"token.exchange"});let ze=await d($e,{log:M,operation:"token.exchange"});if(M.debug("SSO token exchange response body read completed",{"ion.event":"ion.sso.token.response_body_read_completed","ion.module":"sso","ion.operation":"token.exchange","duration.ms":Pt(We)}),!$e.ok){M.error("Token exchange error",{"ion.event":"ion.sso.token.exchange_failed","ion.operation":"token.exchange","ion.outcome":"failure","http.status_code":$e.status,"duration.ms":Pt(We),...ja(ze)});let rt=ze;throw Error(`Token exchange failed: ${rt.error||$e.statusText} - ${rt.error_description||""}`.trim())}let Ve=await A.tokenResponse.validate(ze);if(Ve.issues)throw M.error("Token response validation failed",{"ion.event":"ion.sso.token.response_validation_failed","ion.operation":"token.exchange","ion.outcome":"failure","duration.ms":Pt(We),"validation.issues":fr(Ve.issues)}),Error(`Token response validation failed: ${Ve.issues}`);return M.debug("SSO token exchange completed",{"ion.event":"ion.sso.token.exchange_completed","ion.module":"sso","ion.operation":"token.exchange","ion.outcome":"success","duration.ms":Pt(We),tokenType:Ve.value.token_type,hasAccessToken:Boolean(Ve.value.access_token),hasIdToken:Boolean(Ve.value.id_token),hasRefreshToken:Boolean(Ve.value.refresh_token),expiresIn:Ve.value.expires_in}),Ve.value}catch(We){throw M.error("Error during token exchange",{"ion.event":"ion.sso.token.exchange_failed","ion.operation":"token.exchange","ion.outcome":"failure",...ps(We)}),We}}async function En(xe){return _r(async()=>{if(!be)throw Error("ionite SSO Manager not initialized");at();let Pe=e(be.tokenUrl,"Missing 'tokenUrl' from SSO Config"),_e=e(be.clientId,"Missing 'clientId' from SSO Config"),re=new URLSearchParams;if(re.append("grant_type","refresh_token"),re.append("refresh_token",xe),re.append("client_id",_e),be.clientSecret)re.append("client_secret",be.clientSecret);let Re=await fetch(Pe,{method:"POST",headers:{...w,...l},body:re.toString()}),De=await d(Re,{log:M,operation:"token.refresh"});if(!Re.ok){M.error("Token refresh error",{"ion.operation":"token.refresh","ion.outcome":"failure",response:De});let Me=De;throw Error(`Token refresh failed: ${Me.error||Re.statusText} - ${Me.error_description||""}`.trim())}let Ue=await A.tokenResponse.validate(De);if(Ue.issues)throw M.error("Token refresh response validation failed",{"ion.event":"ion.sso.token.refresh_validation_failed","ion.operation":"token.refresh","ion.outcome":"failure","validation.issues":fr(Ue.issues)}),Error(`Token refresh response validation failed: ${Ue.issues}`);return Ue.value},void 0,void 0,void 0,M)}async function Cn(xe){try{if(!be)throw Error("ionite SSO Manager not initialized");if(!be.revocationEndpoint)return;let Pe=e(be.clientId,"Missing 'clientId' from SSO Config"),_e=new URLSearchParams;if(_e.append("token",xe),_e.append("token_type_hint","refresh_token"),_e.append("client_id",Pe),be.clientSecret)_e.append("client_secret",be.clientSecret);let re=await fetch(be.revocationEndpoint,{method:"POST",headers:{...l,...w},body:_e.toString()});if(!re.ok)M.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:re.status,statusText:re.statusText});else M.info("Token revoked successfully",{"ion.module":"sso"})}catch(Pe){M.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},Pe)}}async function pn(){if(!be)throw Error("ionite SSO Manager not initialized");let xe=be.authority;if(!be.jwksUri&&!xe)throw Error("Missing 'jwksUri' or 'authority' from SSO Config. OIDC configuration is required for this operation.");let Pe=be.jwksUri||`${xe}/protocol/openid-connect/certs`;return Wn(Pe,M)}async function nn(xe,Pe){let _e=Date.now(),re=e(be.authority,"Missing 'authority' from SSO Config. OIDC configuration is required to verify ID tokens."),Re=e(be.clientId,"Missing 'clientId' from SSO Config. OIDC configuration is required to verify ID tokens."),De=be.jwksUri||`${re}/protocol/openid-connect/certs`;M.debug("SSO ID token verification started",{"ion.event":"ion.sso.id_token.verify_started","ion.module":"sso","ion.operation":"id_token.verify",...mr(De,"oidc.jwks_uri")});let Ue;try{Ue=await on({idToken:xe,jwksUri:De,issuer:re,audience:Re,expectedNonce:Pe,log:M})}catch(We){throw M.error("SSO ID token verification failed",{"ion.event":"ion.sso.id_token.verify_failed","ion.module":"sso","ion.operation":"id_token.verify","ion.outcome":"failure","duration.ms":Pt(_e)},We),We}M.debug("SSO ID token signature verified",{"ion.event":"ion.sso.id_token.signature_verified","ion.module":"sso","ion.operation":"id_token.verify","duration.ms":Pt(_e)});let Me=await A.idTokenClaims.validate(Ue);if(Me.issues)throw M.error("ID token claims validation failed",{"ion.event":"ion.sso.id_token.validation_failed","ion.operation":"id_token.validate","ion.outcome":"failure","duration.ms":Pt(_e),"validation.issues":fr(Me.issues)}),Error(`ID token claims validation failed: ${Me.issues}`);return M.debug("SSO ID token claims validated",{"ion.event":"ion.sso.id_token.claims_validated","ion.module":"sso","ion.operation":"id_token.validate","ion.outcome":"success","duration.ms":Pt(_e),"user.id":Me.value.sub,hasIssuer:Boolean(Me.value.iss),hasAudience:Boolean(Me.value.aud)}),Me.value}function Mt(xe="SSO sessionStore is required for opaque session cookies."){if(!be.sessionStore)throw Error(xe);return be.sessionStore}let mn=!1;async function fn(xe,Pe,_e,re){let Re=be.claimsAsEntitlements;if(!Re?.claims?.length)return xe;if(be.sessionStore?.capabilities?.derivedEntitlements!==!0){if(!mn)mn=!0,M.warn("SSO claims entitlements are configured but the session store does not persist them",{"ion.event":"ion.sso.claims.incapable","ion.module":"sso","ion.outcome":"degraded"});return xe}let De=await On({block:Re,claims:_e,accessClaims:In(re?.access_token),scope:re?.scope,subjectType:"user",subjectId:Pe,catalog:te?.catalogView?.(),log:M});return{...xe,entitlements:De}}async function vn(xe,Pe){try{await xe.create(Pe)}catch(_e){if(!await xe.get(Pe.sid))throw _e;await xe.update(Pe.sid,Pe)}}function Lt(xe){if(!xe)return;if(xe instanceof Date)return xe;let Pe=new Date(xe);return Number.isNaN(Pe.getTime())?void 0:Pe}function Dn(xe){let Pe=xe.tokens;if(!Pe?.access_token||!Pe.id_token||!Pe.token_type)return;return Pe}async function Rn(xe,Pe=!1){let _e=Mt(),re=_t("session",xe);if(!re)return{tokens:void 0,refreshHeaders:[]};let Re=await _e.get(re);if(Re&&be.tenantId&&Re.tenantId&&Re.tenantId!==be.tenantId)return{tokens:void 0,refreshHeaders:Ot(),sid:re};if(Re?.authType!=="sso")return{tokens:void 0,refreshHeaders:Ot(),sid:re};let De=Dn(Re);if(!De)return{tokens:void 0,refreshHeaders:Ot(),sid:re};let Ue=Lt(Re.expiresAt);if(Ue?Date.now()>Ue.getTime():!1)return await _e.delete(re),{tokens:void 0,sid:re,refreshHeaders:Ot()};let We=Lt(De.expires),$e=We?Date.now()>We.getTime():!0;if((Pe||$e)&&De.refresh_token)return Gt(xe,re,Re,De);return{tokens:De,sid:re,session:Re,refreshHeaders:Zt(xe)}}function Gt(xe,Pe,_e,re){let Re=Te.get(Pe);if(Re)return Re;let De=Mt(),Ue=(async()=>{let Me=await En(re.refresh_token),{tokenExpiresAt:We,sessionExpiresAt:$e}=St(Me);Me.expires=We.toISOString();let ze=await bt(Me,void 0,$e),Ve=ze.sso.profile,rt=zt(32),ut=await fn({..._e,sid:rt,tokens:Me,claims:Ve,expiresAt:$e,createdAt:new Date},_e.sub,Ve,Me);await vn(De,ut);try{if(He<=0)await De.delete(Pe);else{let{refresh_token:Oe,...Ee}=re;await De.update(Pe,{tokens:Ee,expiresAt:new Date(Date.now()+He)})}}catch(Oe){M.warn("Failed to retire rotated SSO session record",{"ion.operation":"session.rotate","ion.outcome":"degraded"},Oe)}return{tokens:Me,sid:rt,session:ut,refreshedUser:ze,refreshHeaders:[["Set-Cookie",Xt("session",rt,$e)],...await Kt(xe,ze,$e)]}})();return Te.set(Pe,Ue),Ue.finally(()=>{Te.delete(Pe)})}async function Wt(xe,Pe=!1){return Rn(xe,Pe)}async function gn(xe){let{tokens:Pe}=await Wt(xe);if(!Pe)return;return Pe.access_token}function Xt(xe,Pe,_e,re=be.cookiesSameSite??"Strict"){if(!be)throw Error("ionite SSO Manager not initialized");if(xe=`${be.cookiesPrefix}.${xe}`,typeof Pe!=="string")Pe=btoa(JSON.stringify(Pe));let Re;if(_e instanceof Date)Re=`Expires=${_e.toUTCString()}`;else if(typeof _e==="number")Re=`Max-Age=${_e}`;else throw Error("Invalid expires type",_e);if(Pe.length>4000)throw Error(`Error setting cookie: ${xe}. Cookie length is: ${Pe.length}`);return`${xe}=${Pe}; ${Re}; Path=${be.cookiesPath};${sn(be.cookiesDomain)} HttpOnly;${be.cookiesSecure?" Secure;":""} SameSite=${re};`}function $t(xe){if(!be)throw Error("ionite SSO Manager not initialized");return`${be.cookiesPrefix}.${xe}=; Max-Age=0; Path=${be.cookiesPath};${sn(be.cookiesDomain)} HttpOnly;${be.cookiesSecure?" Secure;":""} SameSite=${be.cookiesSameSite};`}function Dt(){return{path:be.cookiesPath??"/",domain:be.cookiesDomain,secure:be.cookiesSecure!==!1,sameSite:be.cookiesSameSite??"Strict"}}function Ot(){return[["Set-Cookie",$t("session")],["Set-Cookie",en(`${be.cookiesPrefix}.profile`,Dt())]]}function Zt(xe){if(be.displayCookie?.enabled===!0)return[];return xn(xe.headers.get("cookie"),be.cookiesPrefix??"ion.sso",Dt()).map((Pe)=>["Set-Cookie",Pe])}async function Kt(xe,Pe,_e){return(await Nn({cookieHeader:xe.headers.get("cookie"),sessionStore:be.sessionStore,cookiesPrefix:be.cookiesPrefix??"ion.sso",authType:"sso",tenantId:be.tenantId,expiresAt:_e,user:Pe,projector:be.displayUser,displayCookie:be.displayCookie,trim:be.trimDisplayCookies,attr:Dt()})).map((Re)=>["Set-Cookie",Re])}function _t(xe,Pe,_e=!1){if(!be)throw Error("ionite SSO Manager not initialized");let re=Pe.headers.get("cookie");if(!re)return null;let Re=`${be.cookiesPrefix}.${xe}`,De=re.split(";").find(($e)=>$e.trim().startsWith(`${Re}=`));if(!De)return null;let Ue=De.indexOf("="),Me=De.slice(Ue+1).trim();if(!_e)return Me;let We=atob(Me);return JSON.parse(We)}function rn(xe){return`state_${xe}`}async function yn(xe,Pe){if(!be)throw Error("ionite SSO Manager not initialized");let{loginUrl:_e,userUrl:re,tokenUrl:Re,refreshUrl:De,logoutUrl:Ue,logoutBackChannelUrl:Me,jwksUrl:We,redirectUri:$e}={...be,...Pe},ze=new URL(xe.url).pathname;if($e){let Ve;try{Ve=new URL($e).pathname}catch{try{let rt=new URL(xe.url),ut=$e.startsWith("//")?$e.slice(1):$e;Ve=new URL(ut,rt.origin).pathname}catch{Ve=$e.startsWith("/")?$e:`/${$e}`}}if(Ve===ze)return ft(xe)}if(_e===ze)return ct(xe);if(re===ze){if((be.userEndpoint??"full")==="off")return new Response("Not Found",{status:404,headers:Zt(xe)});try{let{tokens:Ve,session:rt,refreshedUser:ut,refreshHeaders:Oe}=await Wt(xe);if(!Ve)return new Response("User not logged in",{status:401,headers:Oe});let Ee=ut??(rt?.claims?Ut(rt.claims,Ve,Lt(rt.expiresAt)):void 0);if(!Ee)return new Response("User not logged in",{status:401,headers:Oe});let Be=await Ft(Ee),Le=`${be.cookiesPrefix}.profile`,qe=Lt(rt?.expiresAt),Fe=be.displayCookie?.enabled===!0&&qe&&!_t("profile",xe)&&!Oe.some(([,it])=>it.startsWith(`${Le}=`))?await Kt(xe,Be,qe):[],tt=be.userEndpoint==="display"?g(Be,be.displayUser):Be;return new Response(JSON.stringify(tt),{headers:[["Content-Type",a],...Oe,...Fe]})}catch(Ve){if(fi(Ve))return new Response("User not logged in",{status:401});return M.error("Error resolving SSO user",{"ion.operation":"sso.user","ion.outcome":"degraded"},Ve),new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:i})}}if(Re===ze){let{tokens:Ve,refreshHeaders:rt}=await Wt(xe);if(!Ve)return new Response("User not logged in",{status:401,headers:rt});return new Response(JSON.stringify({token:Ve.access_token,expires:Ve.expires}),{headers:[["Content-Type",a],...rt]})}if(De===ze){let{tokens:Ve,refreshHeaders:rt}=await Wt(xe,!0);if(!Ve)return new Response("User not logged in",{status:401});return new Response("Refresh Complete",{status:200,headers:rt})}if(Ue===ze)return lt(xe);if(Me===ze)return Ne(xe);if(We===ze){let Ve=await pn();return new Response(JSON.stringify(Ve),{headers:[["Content-Type",a]]})}return new Response("Not Found",{status:404})}let Je;return Je={...be,describe:()=>({module:"sso",active:!0,ready:Je.isReady?.()??!0,authority:be.authority,tokenUrl:be.tokenUrl,authorizationUrl:be.authorizationUrl,clientId:be.clientId,redirectUri:be.redirectUri,responseType:be.responseType,scope:be.scope,silentRedirectUri:be.silentRedirectUri,jwksUri:be.jwksUri,endSessionEndpoint:be.endSessionEndpoint,revocationEndpoint:be.revocationEndpoint,cookies:{prefix:be.cookiesPrefix,path:be.cookiesPath,secure:be.cookiesSecure,sameSite:be.cookiesSameSite,domain:be.cookiesDomain},loginStateTtl:be.loginStateTtl,rotationGraceSeconds:be.rotationGraceSeconds,sessionWindowSeconds:be.sessionWindowSeconds,displayCookie:be.displayCookie,jit:{enabled:be.enableJitUserProvisioning===!0,userStore:be.userStore!==void 0},sessionStore:be.sessionStore!==void 0,...be.claimsAsEntitlements?.claims?.length?{claimsAsEntitlements:{claims:[...be.claimsAsEntitlements.claims],expand:be.claimsAsEntitlements.expand===!0,resources:be.claimsAsEntitlements.expand===!0&&be.claimsAsEntitlements.resources===!0,capable:be.sessionStore?.capabilities?.derivedEntitlements===!0}}:{},urls:{loginUrl:be.loginUrl??"",userUrl:be.userUrl??"",logoutUrl:be.logoutUrl??"",logoutBackChannelUrl:be.logoutBackChannelUrl??"",refreshUrl:be.refreshUrl??"",callbackUrl:be.redirectUri??""}}),getUser:ot,resolveUser:Ke,getJwt:gn,initiateLogin:ct,logout:lt,logoutBackChannel:Ne,callbackHandler:ft,handler:yn},Je}function Wa(A){let M={},N=A.split(";");for(let K of N){let te=K.trim();if(!te)continue;let Ie=te.indexOf("=");if(Ie===-1)continue;let Te=te.slice(0,Ie).trim(),ve=te.slice(Ie+1).trim();M[Te]=ve}return M}function fi(A){if(!(A instanceof Error))return!1;return["Public key not found","Invalid JWT","Invalid JWT signature","ID token expired","ID token issuer mismatch","ID token audience mismatch","ID token nonce mismatch","ID token missing exp","invalid_grant"].some((M)=>A.message.includes(M))}function gi(A){return A=A??"SSO Unavailable",new Response(JSON.stringify({error:A}),{status:503,statusText:A,headers:i})}var gr="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.";async function $a(A,M){if(e(M,gr),M.delegate.hasCredential(A)){let N=await M.delegate.resolve(A);return N&&Qn(N)}return M.sso?.getUser(A)}async function ms(A,M){if(e(M,gr),M.delegate.hasCredential(A))return jn(M.delegate,A,Qn);return await M.sso?.resolveUser(A)??{status:"unauthenticated"}}async function Va(A,M){e(M,gr);let N=M.sso;if(!N)return gi();return N.initiateLogin(A)}async function qa(A,M){e(M,gr);let N=M.sso;if(!N)return gi();return N.callbackHandler(A)}var gs="tenant.owner",fs="tenant.owner.",za="tenant:";function Ba(A){return{id:gs,name:"Tenant owner",description:"Administer one tenant resource",requestable:!1,permissionTypes:["Admin"],resourceTypes:["tenant"],assignableSubjectTypes:["customer"],...A}}function ys(A){let M=A.trim();if(!M)throw Error("tenantId is required");return`${za}${M}`}function Ga(A){let M=A.trim();if(!M)throw Error("tenantId is required");return`${fs}${M}`}function At(A){return{allow:!1,reason:A,response(){if(A==="not_found")return Response.json({error:"Not Found"},{status:404});if(A==="forbidden")return Response.json({error:"Forbidden"},{status:403});if(A==="unavailable")return Response.json({error:"Tenant runtime unavailable"},{status:503});return Response.json({error:"Unauthorized"},{status:401})}}}function yr(A,M){if(!A.id)return At("unavailable");return{allow:!0,session:{id:A.id,email:A.email,name:A.name,kind:M,...A.delegate?{delegate:A.delegate}:{}}}}function yi(A){return A==="access_index_not_configured"||A==="error"}async function hi(A,M){let N;try{N=await or(A,M.rootIon)}catch{return At("unavailable")}if(N.status==="degraded")return At("unavailable");if(N.status==="unauthenticated")return At("unauthenticated");if(!N.value.id)return At("unavailable");try{let K=await M.rootIon.authz.hasPermission(N.value,M.ownerPermission??gs,ys(M.tenantId),"customer");if(K.allow)return yr(N.value,"owner");return At(yi(K.metadata?.reason)?"unavailable":"forbidden")}catch{return At("unavailable")}}async function Ka(A,M){let{tenantIon:N}=M;if(!N)return At("not_found");if(N.isReady()){let te;try{te=await ms(A,N)}catch{return At("unavailable")}if(te.status==="degraded")return At("unavailable");if(te.status==="authenticated"){if(!te.value.id)return At("unavailable");if(!M.permission)return te.value.delegate?At("forbidden"):yr(te.value,"sso");try{let Ie=await N.authz.hasPermission(te.value,M.permission,void 0,"user");if(Ie.allow)return yr(te.value,"sso");return At(yi(Ie.metadata?.reason)?"unavailable":"forbidden")}catch{return At("unavailable")}}if(M.allowTenantCustomer){let Ie;try{Ie=await or(A,N)}catch{return At("unavailable")}if(Ie.status==="degraded")return At("unavailable");if(Ie.status==="authenticated"&&!Ie.value.delegate){if(!Ie.value.id)return At("unavailable");return yr(Ie.value,"customer")}}}let K=await hi(A,M);if(K.allow||K.reason==="unavailable")return K;if(!N.isReady())return At("unavailable");return At("unauthenticated")}async function Ha(A,M){let N=A.authz.accessStore;if(!N)throw Error("Cannot list owned tenants: no AccessAssignmentStore is wired.");let K=new Set;for await(let te of u((Ie,Te)=>N.listBySubject(M,"customer",{start:Ie,limit:Te}))){let Ie=typeof te.target==="string"?te.target:te.target.id;if(te.targetType!=="group"||!Ie.startsWith(fs))continue;let Te=Ie.slice(fs.length);if(!Te||!te.resources?.includes(ys(Te)))continue;K.add(Te)}return[...K].sort()}function Ja(A,M){let N=M.redirectTo.trim()||"/",K=M.tenantIon?.sso?.isReady?.()===!0?`${M.tenantIonBasePath?.(A)??`/api/${encodeURIComponent(A)}/ionite`}/auth/login`:M.fallbackPath,te=new URL(K,"http://localhost");return te.searchParams.set("redirect",N),`${te.pathname}${te.search}`}export{Jn as CACHE_BOUNDS,Cs as CIAM_PROVIDER_PRESETS,oe as CatalogAdjacencyCache,br as DEFAULT_DELEGATE_LAST_USED_WINDOW_SECONDS,wr as DELEGATE_TOKEN_PREFIX,Ge as InMemoryTenantStore,Lr as MICROSOFT_CONSUMERS_TENANT_ID,s as ScimPatchError,gs as TENANT_OWNER_PERMISSION,bo as allowHosts,wo as allowOrigins,$s as allowRelativePaths,Vs as allowSameOrigin,X as applyScimPatchOperation,Qs as assertSubjectTypeAssignable,js as assertTrustedIdTokenClaims,Xr as baseCustomerToScim,Zr as baseDelegateToScim,Fr as baseUserToScimUser,Yr as baseWorkloadToScim,Ws as blockDangerousUrls,$r as buildAuthorizationUrl,ls as buildLfvSigningInput,qa as callback,vo as captureRedirect,To as ciam,go as clearDiscoveryCache,no as clearJwksCache,Xe as collectReferencedDefinitions,Xi as configureJwksCache,Pi as createDelegateResolver,In as decodeUnverifiedJwtPayload,Co as defaultRedirectPolicies,Bs as delegateOwnerToScim,Sr as delegateTokenFromRequest,On as deriveClaimsEntitlements,kr as derivedEntitlementsFor,sr as discoverOidcEndpoints,mi as discoverSessionRecords,pi as discoverSessions,Jr as entitlementToScimGroup,Vr as exchangeAuthorizationCode,U as expandRoot,Br as fetchUserInfo,en as formatDisplayClearCookie,Pr as formatDisplaySetCookie,Gr as generateAppleClientSecret,xi as generateDelegateToken,ka as generateLfvEd25519KeyPair,jr as getCachedVerificationKey,xo as getCustomer,Da as getDiscoveredSessionUsers,Wn as getJwks,Ha as getOwnedTenantIds,Rr as getProviderPreset,io as getPublicKeyForKid,so as getPublicKeyFromJwks,$a as getUser,Nr as getVerificationKeyForKid,Ni as has,qi as hasAll,Gi as hasAllScope,Vi as hasAny,Bi as hasAnyScope,$i as hasGroup,Li as hasPermission,Wi as hasRole,zi as hasScope,ks as hashDelegateToken,da as iam,we as inboundCallerId,Va as initiateLogin,qr as isMicrosoftMultiTenantAuthority,qs as isRedirectAllowed,Na as listSsoClientIdsFromCookies,_s as matchesMicrosoftIssuer,rr as microsoftIssuerTenantId,hn as normalizeOidcIssuer,Ar as orderedEnabledProviders,ni as parseLfvJwks,de as parseScimPatchPath,er as pickDelegateCustomer,Qn as pickDelegateUser,Ki as pickDelegateWorkload,Vn as pkceChallengeFromVerifier,Yi as planDiscoveredTenantCookies,xn as planDisplayCookieClear,Nn as planDisplayCookieHeaders,ke as reconcileSubjectAccess,_n as rememberDerivedEntitlements,an as resolveAfterRedirect,Sa as resolveCacheConfig,Ro as resolveCapturedRedirect,Zn as resolveCiamProvider,or as resolveCustomer,jn as resolveDelegateIdentity,Ce as resolveIamProvider,ro as resolveJwkForKid,ri as resolveJwksCacheConfig,Ir as resolveProviderBranding,Hr as resolveRedirect,si as resolveSessionCacheConfig,hi as resolveTenantOwner,Ka as resolveTenantSession,ms as resolveUser,Kr as sameOriginRedirectRules,Is as selectDisplayCookies,fo as setDiscoveryClock,Zi as setJwksClock,Qi as setJwksRetry,va as signCompactJwt,ha as signLfvPayload,La as sso,Ca as staticSigningKeyRing,ma as stringifyLfvJwks,Ja as tenantAccessLoginUrl,Ga as tenantOwnerEntitlementId,Ba as tenantOwnerPermission,ys as tenantResourceId,Ra as verifyCompactJwt,on as verifyIdToken,ya as verifyLfvSignature,zr as verifyLogoutToken,_a as verifyUser,kn as withSetCookies};