npm - @ionite/server - Versions diffs - 0.0.22 → 0.0.23-beta.20260729.1 - Mend

@ionite/server 0.0.22 → 0.0.23-beta.20260729.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/index.d.ts CHANGED Viewed

@@ -5,7 +5,7 @@ import { CapabilityEndpointUrls } from "@ionite/core";
 * Deterministic set of ionite endpoint paths derived from a single `basePath`.
 * These are the only URLs the SDK mounts; application code cannot customize individual paths
 * (only `basePath`). Post-login/logout destinations are NOT here: they are decided by the appdev's
-* `beforeLogin`/`afterLogin`/`beforeLogout`/`afterLogout` hooks (application UI routes), not ES endpoints derivable from `basePath`.
+* `beforeLogin`/`afterLogin`/`beforeLogout`/`afterLogout` hooks (application UI routes), not ionite endpoints derivable from `basePath`.
 */
 type UrlMap = CapabilityEndpointUrls;
 /**
@@ -23,12 +23,12 @@ type TenantManagerOptions<
 	store: TenantStore<TTenant>;
 	workloadAuth?: Workload;
 	/**
-	* Resolve the ionite `basePath` for a given tenant (e.g. `/api/${tenant.id}/es`).
+	* Resolve the ionite `basePath` for a given tenant (e.g. `/api/${tenant.id}/ionite`).
 	* When provided, tenant responses include the derived absolute SSO `callbackUrl` and full `ionUrls`
-	* so the ECI/ConfigSource can register the matching callback path at the IdP. ES endpoint URLs are
+	* so the ECI/ConfigSource can register the matching callback path at the IdP. ionite endpoint URLs are
 	* deterministic from this basePath; they are not configurable per-URL.
 	*/
-	tenantEsBasePath?: (tenant: TTenant) => string | undefined;
+	tenantIonBasePath?: (tenant: TTenant) => string | undefined;
 };
 /** Absolute ionite URL set for a tenant, derived from its basePath and request origin. */
 type TenantIonUrls = {
@@ -615,7 +615,7 @@ type ConfigLocatorAssert = (input: {
 declare function registerConfigLocatorAssert(assert: ConfigLocatorAssert | undefined): void;
 /**
 * Materialize a tenant's {@link ConfigSource} from its {@link TenantConfigLocator}, resolving against
-* the root ES (`ion.secret` / `ion.secrets`). Pass the root `es` (or any {@link ConfigSourceResolver}).
+* the root Ionite (`ion.secret` / `ion.secrets`). Pass the root `ion` (or any {@link ConfigSourceResolver}).
 *
 * This lives in `@ionite/server` (not core) so the materialization can reference the
 * server-only source implementations directly, with no import-time registration side effect — keeping

package/dist/index.js CHANGED Viewed

	@@ -1 +1 @@
1	- import{configTrustedClientGrants as A6,deepEqualPlain as j6,defaultLogger as r4,ION_ENDPOINT_PERMISSIONS as s8,listGenerator as K$,stableConfigHash as g8,toCodeCatalog as a8,unionCatalogRead as t8}from"@ionite/core";import{ciam as E6,configureJwksCache as T6,iam as q6,resolveCacheConfig as R6,sso as P6,withDefaultExternalId as I6}from"@ionite/core/server";import{trimTrailingSlash as Y9}from"@ionite/core";import{list as QZ}from"@ionite/core";class S${customers=new Map;userNameIndex=new Map;async get($){return this.customers.get($)}async lookup($){if($.id){let Z=this.customers.get($.id);if(Z)return Z}if($.userName){let Z=this.userNameIndex.get($.userName.toLowerCase());if(Z)return this.customers.get(Z)}return}async upsert($){let Z=$.id?.trim()\|\|crypto.randomUUID(),Q={...$,id:Z},X=this.customers.get(Z);if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase())}if(this.customers.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);return Q}async delete($){let Z=this.customers.get($);if(Z?.userName)this.userNameIndex.delete(Z.userName.toLowerCase());return this.customers.delete($),Z?1:0}async list($){let Z=Array.from(this.customers.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,_=Z.slice(Q,J);return QZ(Y,_,Q,X)}}class w${magicLinks=new Map;async create($,Z,Q){if(this.magicLinks.has($))throw Error(`Magic link with token ${$} already exists`);let X={token:$,customer:Z,createdAt:new Date,expiresAt:Q};this.magicLinks.set($,X)}async get($){let Z=this.magicLinks.get($);if(!Z)return null;if(Date.now()>Z.expiresAt.getTime())return this.magicLinks.delete($),null;return Z}async getAndDelete($){let Z=this.magicLinks.get($);if(this.magicLinks.delete($),!Z)return null;if(Date.now()>Z.expiresAt.getTime())return null;return Z}async delete($){this.magicLinks.delete($)}}function XZ($){let Z=$.expiresAt;if(!Z)return;let Q=Z instanceof Date?Z.getTime():new Date(Z).getTime();return Number.isNaN(Q)?void 0:Q}class C${sessions=new Map;async create($){if(this.sessions.has($.sid))throw Error(`Session with sid ${$.sid} already exists`);this.sessions.set($.sid,$)}async get($){let Z=this.sessions.get($);if(!Z)return null;let Q=XZ(Z);if(Q!==void 0&&Date.now()>Q)return this.sessions.delete($),null;return Z}async update($,Z){let Q=this.sessions.get($);if(!Q)throw Error(`Session with sid ${$} not found`);let X={...Q,...Z};this.sessions.set($,X)}async delete($){this.sessions.delete($)}}import{list as YZ}from"@ionite/core";class k${users=new Map;userNameIndex=new Map;async get($){return this.users.get($)}async lookup($){return this.users.get($.id??"")}async upsert($){let Z=$.id?.trim()\|\|crypto.randomUUID(),Q={...$,id:Z},X=this.users.get(Z);if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase())}if(this.users.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);return Q}async delete($){let Z=this.users.get($);if(Z){if(Z.userName)this.userNameIndex.delete(Z.userName.toLowerCase())}return this.users.delete($),Z?1:0}async list($){let Z=Array.from(this.users.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,_=Z.slice(Q,J);return YZ(Y,_,Q,X)}}class a0{tokens=new Map;async set($){this.tokens.set($.workload_id,$)}async get($){let Z=this.tokens.get($);if(!Z)return null;if(Date.now()>Z.expires_at.getTime())return this.tokens.delete($),null;return Z}async delete($){this.tokens.delete($)}async isValid($){return await this.get($)!==null}async cleanup(){let $=Date.now();for(let[Z,Q]of this.tokens.entries())if($>Q.expires_at.getTime())this.tokens.delete(Z)}}function v0($){let Z=Y9($\|\|K4);return{readyzUrl:`${Z}/readyz`,capabilitiezUrl:`${Z}/capabilitiez`,sso:{loginUrl:`${Z}/auth/login`,userUrl:`${Z}/auth/user`,logoutUrl:`${Z}/auth/logout`,logoutBackChannelUrl:`${Z}/auth/logout/backchannel`,refreshUrl:`${Z}/auth/refresh`,callbackUrl:`${Z}/auth/callback`},workload:{validateUrl:`${Z}/workload/validate`,jwksUrl:`${Z}/workload/jwks`},iam:{basePath:`${Z}/iam`,usersUrl:`${Z}/iam/Users`,groupsUrl:`${Z}/iam/Groups`},ciam:{magicLinkUrl:`${Z}/magic-link`,magicLinkLoginUrl:`${Z}/magic-link/login`,customerUrl:`${Z}/auth/customer`,customerLoginUrl:`${Z}/auth/customer/login`,customerCallbackUrl:`${Z}/auth/customer/callback`,customerProvidersUrl:`${Z}/auth/customer/providers`,logoutUrl:`${Z}/auth/customer/logout`}}}function J9($){return`${Y9($\|\|K4)}/authz/oaa/sync`}function JZ($,Z){if($===null)return null;let Q={validateUrl:Z.validateUrl,jwksUrl:Z.jwksUrl};if($&&typeof $==="object"&&(("incoming"in $)\|\|("outgoing"in $))){let X=$;return{...X,incoming:{...X.incoming,...Q}}}return{...$??{},...Q}}function G9($,Z,Q,X){let Y={...Z},J=v0(X);if(Y.sso!==null)if($.sso)Y.sso={...Y.sso,loginUrl:J.sso.loginUrl,userUrl:J.sso.userUrl,logoutUrl:J.sso.logoutUrl,logoutBackChannelUrl:J.sso.logoutBackChannelUrl,refreshUrl:J.sso.refreshUrl,redirectUri:J.sso.callbackUrl,sessionStore:Q.sessionStore,userStore:Q.userStore,enableJitUserProvisioning:Y.sso?.enableJitUserProvisioning??!0};else Y.sso=void 0;if(Y.iam!==null)if($.iam)Y.iam={...Y.iam,usersUrl:J.iam.usersUrl,groupsUrl:J.iam.groupsUrl,userStore:Q.userStore};else Y.iam=void 0;if(Y.workload!==null){if($.workload\|\|Y.workload)Y.workload=JZ(Y.workload,J.workload)}if(Y.ciam!==null)if($.ciam)Y.ciam={...Y.ciam,magicLinkUrl:J.ciam.magicLinkUrl,magicLinkLoginUrl:J.ciam.magicLinkLoginUrl,customerUrl:J.ciam.customerUrl,customerLoginUrl:J.ciam.customerLoginUrl,customerCallbackUrl:J.ciam.customerCallbackUrl,customerProvidersUrl:J.ciam.customerProvidersUrl,logoutUrl:J.ciam.logoutUrl,providers:$.ciam.providers,sessionStore:Q.sessionStore,customerStore:Q.customerStore,magicLinkStore:Q.magicLinkStore,enableJitUserProvisioning:Y.ciam?.enableJitUserProvisioning??!0};else Y.ciam=void 0;return Y}function O$($,Z){let Q={...$};if(Q.sso)Q.sso={...Q.sso,sessionStore:Z.sessionStore,userStore:Z.userStore};if(Q.iam)Q.iam={...Q.iam,userStore:Z.userStore,deltaIdMapStore:Z.deltaIdMapStore};if(Q.workload)Q.workload={...Q.workload,tokenStore:Z.workloadTokenStore,workloadIdentityStore:Z.workloadIdentityStore};if(Q.ciam)Q.ciam={...Q.ciam,sessionStore:Z.sessionStore,customerStore:Z.customerStore,magicLinkStore:Z.magicLinkStore};if(Q.authz!==null&&(Z.accessStore\|\|Z.accessIndex\|\|Z.catalog\|\|Z.catalogStore\|\|Z.resources))Q.authz={...Q.authz,accessStore:Z.accessStore,accessIndex:Z.accessIndex,catalog:Z.catalog,catalogStore:Z.catalogStore,resources:Z.resources};return Q}var K4="/api/ionite";function b$($){return{sessionStore:$?.sessionStore??new C$,userStore:$?.userStore??new k$,customerStore:$?.customerStore??new S$,accessStore:$?.accessStore,accessIndex:$?.accessIndex,catalog:$?.catalog,catalogStore:$?.catalogStore,resources:$?.resources,magicLinkStore:$?.magicLinkStore??new w$,workloadTokenStore:$?.workloadTokenStore??new a0,workloadIdentityStore:$?.workloadIdentityStore,deltaIdMapStore:$?.deltaIdMapStore}}function y$(){return K4}import{accessRefId as V4,accessRootId as vZ,configTrustedClientGrants as hZ,listGenerator as O9,toCodeCatalog as fZ}from"@ionite/core";import{CatalogAdjacencyCache as mZ,expandRoot as pZ,reconcileSubjectAccess as gZ,withDefaultExternalId as dZ}from"@ionite/core/server";import{accessRefId as h0,accessRootId as GZ,ION_AUTHZ_GROUP_SCHEMA as KZ}from"@ionite/core";import{collectReferencedDefinitions as zZ,withDefaultExternalId as _Z}from"@ionite/core/server";function q0($,Z,Q=(X)=>Error(`${$} ready timed out after ${X}ms`)){let X=!1,Y,J,_=()=>{X=!1,J=new Promise((K)=>{Y=K})};_();let z=()=>{X=!0,Y?.(),Y=void 0},G=()=>{if(Z()){if(!X)z();return}if(X)_()};return G(),{isReady:()=>Z(),ready:(K)=>{if(Z())return Promise.resolve();let H=J;if(!K\|\|K<=0)return H;return new Promise((V,F)=>{let j=setTimeout(()=>F(Q(K)),K);H.then(()=>{clearTimeout(j),V()},(B)=>{clearTimeout(j),F(B)})})},refresh:G,settle:z}}var _9="App",HZ="enterprise_standard",H9=104857600,BZ=H9,DZ=10485760,z4=3,VZ=250,UZ={};function l0($,Z){return Z.mapGroup?Z.mapGroup($):$}class b0 extends Error{retryable;code;status;warnings;constructor($,Z={}){super($,{cause:Z.cause});this.name="OaaError",this.retryable=Z.retryable??!1,this.code=Z.code,this.status=Z.status,this.warnings=Z.warnings,Object.setPrototypeOf(this,b0.prototype)}}function FZ($){let Z=$();return Boolean(Z?.url&&Z.providerId&&Z.datasourceId)}function B9($,Z,Q,X,Y){let J=async(z)=>{await z9($,W0(Z),z,{mode:"incremental"})},_=q0("OAA",()=>FZ(Z),(z)=>new b0(`OAA ready timed out after ${z}ms`,{code:"not_ready"}));return{isReady:_.isReady,ready:_.ready,refreshReadiness:_.refresh,async pushUser(z){let G=W0(Z);await J(E0(G,{local_users:[V9(z,"modify")]},!0))},async pushGroup(z){let G=W0(Z),K=Q(),H=l0(z,K),V=f$(H,u0(G),"add"),F=await _4(H,"group",Y?.(),K,G);await J(E0(G,N$({local_groups:[t0(H,"modify")],identity_to_permissions:V?[V]:[]},F),!0))},async pushRole(z){let G=W0(Z),K=Q(),H=K.mapRole?K.mapRole(z):z,V=await _4(H,"role",Y?.(),K,G);await J(E0(G,N$({local_roles:[r0(H,"modify")]},V),!0))},async pushPermission(z){let G=W0(Z);await J(E0(G,{permissions:[H$(z,Q().mapPermissionTypes,"modify")]},!0))},async pushResource(z){let G=W0(Z),K=Q(),H=K.mapResource?K.mapResource(z):z,V=await jZ(H,Y?.(),K);await J(E0(G,{resources:V},!0))},async grant(z){let G=W0(Z),K=Q(),H=await D9(z,Y?.(),K,G);await J(K9(G,z,"add",K,H))},async revoke(z){let G=W0(Z);await J(K9(G,z,"delete",Q()))},async pushAccessChanges(z){if(z.length===0)return;let G=W0(Z),K=Q(),H=Y?.(),V=await LZ(G,z,K,H);await J(V)},async deleteUser(z){let G=W0(Z);await J(E0(G,{local_users:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteGroup(z){let G=W0(Z);await J(E0(G,{local_groups:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteRole(z){let G=W0(Z);await J(E0(G,{local_roles:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deletePermission(z){let G=W0(Z);await J(E0(G,{permissions:[{name:z,unique_id:z,permission_type:[],operation:"delete"}]},!0))},async deleteResource(z){let G=W0(Z);await J(E0(G,{resources:[{name:z,id:z,resource_type:"",operation:"delete"}]},!0))},async sync(z,G){let K=W0(Z),H=G?.mode==="incremental",V=H?void 0:X?.(),F=await MZ(K,z,Q(),H,V);return z9($,K,F,G)}}}function W0($){let Z=$();if(!Z?.url\|\|!Z.providerId\|\|!Z.datasourceId)throw new b0("OAA is not configured",{code:"not_configured"});return Z}async function MZ($,Z,Q,X,Y){let J=[],_=[],z=[],G=[],K=[],H=[],V=X?"modify":void 0,F=new Set,j=(D)=>GZ(D);for await(let D of _$(Z.users))J.push(V9(D,V));for await(let D of _$(Z.groups)){let x=l0(D,Q);_.push(t0(x,V));let M=f$(x,u0($),X?"add":void 0);if(M)H.push(M)}for await(let D of _$(Z.roles)){let x=Q.mapRole?Q.mapRole(D):D;K.push(r0(x,V))}for await(let D of _$(Z.permissions))G.push(H$(D,Q.mapPermissionTypes,V));let B=[];for await(let D of _$(Z.resources)){let x=Q.mapResource?Q.mapResource(D):D;B.push(x)}z.push(...U9(B,V));for await(let D of _$(Z.access))if(F.add(j(D)),h$(D,H,J,u0($),X?"add":void 0),typeof D.target!=="string")if(D.targetType==="role"){let x=Q.mapRole?Q.mapRole(D.target):D.target;K.push(r0(x,V))}else if(D.targetType==="permission")G.push(H$(D.target,Q.mapPermissionTypes,V));else{let x=l0(D.target,Q);_.push(t0(x,V))}for(let D of Y??[]){let x=j(D);if(F.has(x))continue;F.add(x);let M=h0(D.subject);if(M&&!J.some((W)=>h0(W.unique_id??W.name)===M))J.push({name:M,unique_id:M,is_active:!0,operation:V,custom_properties:{identity_type:"workload",source:"eci-trusted"}});h$(D,H,J,u0($),V)}return E0($,{local_users:J,local_groups:_,local_roles:K,resources:z,permissions:G,identity_to_permissions:H},X)}function E0($,Z,Q){let X={name:$.applicationName??_9,application_type:$.applicationType??HZ,local_users:Z.local_users??[],local_groups:Z.local_groups??[],local_roles:Z.local_roles??[],resources:Z.resources??[],custom_properties:{},tags:[]};if(Q)X.operation="modify";return O0({applications:[X],permissions:Z.permissions??[],identity_to_permissions:Z.identity_to_permissions??[],is_incremental:Q?!0:void 0})}function K9($,Z,Q,X=UZ,Y){let J=[],_=[],z=[],G=[],K=[];h$(Z,J,_,u0($),Q);let H=Q==="delete"?"delete":"modify";if(typeof Z.target!=="string")if(Z.targetType==="role"){let F=X.mapRole?X.mapRole(Z.target):Z.target;G.push(r0(F,H))}else if(Z.targetType==="permission")K.push(H$(Z.target,X.mapPermissionTypes,H));else{let F=l0(Z.target,X);z.push(t0(F,H))}let V={local_users:_,local_groups:z,local_roles:G,permissions:K,identity_to_permissions:J};return E0($,Y?N$(V,Y):V,!0)}async function LZ($,Z,Q,X){let Y=u0($),J=[],_=[],z=[],G=[],K=[],H=[],V=[],F=[];for(let{change:B,op:D}of Z){h$(B,D==="delete"?G:_,D==="delete"?z:J,Y,D==="delete"?"delete":"add");let q=D==="delete"?"delete":"modify";if(typeof B.target!=="string")if(B.targetType==="role"){let T=Q.mapRole?Q.mapRole(B.target):B.target;H.push(r0(T,q))}else if(B.targetType==="permission")V.push(H$(B.target,Q.mapPermissionTypes,q));else{let T=l0(B.target,Q);K.push(t0(T,q))}if(D==="add")F.push(await D9(B,X,Q,$))}let j={local_users:[...J,...z],local_groups:K,local_roles:H,permissions:V,identity_to_permissions:[..._,...G]};return E0($,N$(j,...F),!0)}function N$(...$){let Z={},Q=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let X of $)for(let Y of Q){let J=X[Y];if(J&&J.length>0)Z[Y]=[...Z[Y]??[],...J]}return Z}async function _4($,Z,Q,X,Y){if(!Q)return{};let J=await zZ($,Z,{catalog:Q.catalog,code:Q.code,resources:Q.resources,cache:Q.cache}),_=[];for(let z of J.groups){let G=l0(z,X),K=f$(G,u0(Y),"add");if(K)_.push(K)}return{local_groups:J.groups.map((z)=>t0(l0(z,X),"modify")),local_roles:J.roles.map((z)=>r0(X.mapRole?X.mapRole(z):z,"modify")),permissions:J.permissions.map((z)=>H$(z,X.mapPermissionTypes,"modify")),resources:J.resources.map((z)=>m$(X.mapResource?X.mapResource(z):z,"modify")),identity_to_permissions:_}}async function D9($,Z,Q,X){if(!Z)return{};if($.targetType!=="group"&&$.targetType!=="role")return{};let Y=h0($.target);if(!Y)return{};let J=typeof $.target==="string"?await WZ($.targetType,Y,Z):$.target;if(!J)return{};let _={};if(typeof $.target==="string")if($.targetType==="group"){let G=l0(J,Q),K=f$(G,u0(X),"add");_={local_groups:[t0(G,"modify")],identity_to_permissions:K?[K]:[]}}else{let G=Q.mapRole?Q.mapRole(J):J;_={local_roles:[r0(G,"modify")]}}let z=await _4(J,$.targetType,Z,Q,X);return N$(_,z)}async function WZ($,Z,Q){if(Q.cache)return await Q.cache.getNode($,Z);let X=$==="group"?Q.code?.groups.get(Z):Q.code?.roles.get(Z);if(X)return X;let J=await($==="group"?Q.catalog?.groups:Q.catalog?.roles)?.get(Z);if(J)return J;if($==="group")return _Z(await Q.resources?.entitlement?.(Z));return}function h$($,Z,Q,X,Y){let J=h0($.subject),_=h0($.target);if($.targetType==="group"){let H=Q.find((V)=>h0(V.unique_id??V.name)===J);if(H){let V=new Set(H.groups??[]);if(V.add(_),H.groups=[...V],Y)H.operation=Y}else Q.push({name:J,unique_id:J,groups:[_],operation:Y});return}let z={identity:J,identity_type:"local_user",operation:Y},G=$.resources??[],K=$.applyToApplication??G.length===0;if($.targetType==="role")z.role_assignments=[{application:X,role:_,apply_to_application:K,resources:G,operation:Y}];else z.application_permissions=[{application:X,permission:_,apply_to_application:K,resources:G,operation:Y}];Z.push(z)}function V9($,Z){return O0({name:$.displayName??$.name??$.userName??$.id,unique_id:$.id,identities:OZ($),groups:$.groups?.map((Q)=>Q.value),is_active:$.active,created_at:CZ($.createdAt),custom_properties:O0({ecid:$.ecid,accountClass:$.accountClass,externalId:$.externalId,userName:$.userName,tenantId:$.tenantId}),tags:[],operation:Z})}function OZ($){let Z=$.email?[$.email]:$.emails?.map((X)=>X.value).filter(Boolean)??[],Q=[...$.ecid?[$.ecid]:[],...Z];return Q.length>0?Q:void 0}function t0($,Z){let Q=NZ($),X=D0($,"id")??D0($,"externalId")??D0($,"name")??D0($,"displayName"),Y=D0($,"displayName")??D0($,"name")??X??"group",J=v$($,"resources");return O0({name:Y,unique_id:X,custom_properties:O0({requestable:Q?.requestable??kZ($,"requestable"),description:Q?.description??D0($,"description"),type:Q?.type,externalId:D0($,"externalId"),resources:J.length>0?J:void 0}),tags:[],operation:Z})}function NZ($){let Z=$[KZ];if(!Z\|\|typeof Z!=="object"\|\|Array.isArray(Z))return;return Z}function v$($,Z){if(!$\|\|typeof $!=="object")return[];let Q=$[Z];if(!Array.isArray(Q))return[];return Q.map(h0).filter((X)=>X.length>0)}function AZ($){return D0($,"id")??D0($,"externalId")??D0($,"name")??D0($,"displayName")??"group"}function f$($,Z,Q){let X=v$($,"resources"),Y=X.length>0,J=!Y,_=Y?X:[],z=v$($,"roles").map((K)=>({application:Z,role:K,apply_to_application:J,resources:_,operation:Q})),G=v$($,"permissions").map((K)=>({application:Z,permission:K,apply_to_application:J,resources:_,operation:Q}));if(z.length===0&&G.length===0)return;return{identity:AZ($),identity_type:"local_group",role_assignments:z.length>0?z:void 0,application_permissions:G.length>0?G:void 0,operation:Q}}function r0($,Z){return O0({name:$.name,unique_id:$.id,permissions:$.permissions?.map((Q)=>typeof Q==="string"?Q:Q.id),custom_properties:O0({displayName:$.displayName,requestable:$.requestable,externalId:$.externalId,...$.metadata}),tags:[],operation:Z})}function H$($,Z,Q){return O0({name:$.name,unique_id:$.id,permission_type:Z?.($)??$.permissionTypes??[$.action??"Uncategorized"],apply_to_sub_resources:$.applyToSubResources,resource_types:$.resourceTypes,operation:Q})}function m$($,Z,Q,X=new Set){let Y=$.id;if(Y&&X.has(Y))return O0({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,custom_properties:O0({externalId:$.externalId,...$.metadata}),tags:[],operation:Z});if(Y)X.add(Y);let J=[];for(let _ of $.resources??[]){let z=typeof _==="string"?Q?.get(_):_;if(z)J.push(m$(z,Z,Q,X))}if(Y)X.delete(Y);return O0({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,sub_resources:J.length>0?J:void 0,custom_properties:O0({externalId:$.externalId,...$.metadata}),tags:[],operation:Z})}function U9($,Z){if($.length===0)return[];let Q=new Map;for(let G of $)if(G.id)Q.set(G.id,G);let X=new Map,Y=new Set,J=(G,K)=>{if(!K.id\|\|K.id===G)return;let H=X.get(G)??[];if(!H.some((V)=>V.id===K.id))H.push(K);X.set(G,H),Y.add(K.id)};for(let G of $){for(let H of G.resources??[]){let V=typeof H==="string"?Q.get(H):H;if(V&&G.id)J(G.id,V)}let K=h0(G.parent);if(K&&Q.has(K)&&G.id)J(K,G)}let _=(G)=>{if(!G.id)return G;let K=X.get(G.id);if(!K\|\|K.length===0)return G;return{...G,resources:K.map(_)}};return $.filter((G)=>!G.id\|\|!Y.has(G.id)).map(_).map((G)=>m$(G,Z,Q))}async function jZ($,Z,Q){if(!Z)return[m$($,"modify")];let X=async(H)=>{if(Z.cache)return await Z.cache.getNode("resource",H);return Z.resources?.get(H)},Y=async(H)=>{if(Z.resources?.children&&H.id&&(!H.resources\|\|H.resources.length===0))return Z.resources.children(H.id);let V=[];for(let F of H.resources??[]){let j=typeof F==="string"?await X(F):F;if(j)V.push(j)}return V},J=$,_=new Set;while(!0){let H=h0(J.parent);if(!H\|\|_.has(H))break;_.add(H);let V=await X(H);if(!V)break;J=V}let z=[],G=[J],K=new Set;while(G.length>0){let H=G.shift();if(!H)break;if(H.id&&K.has(H.id))continue;if(H.id)K.add(H.id);let V=Q.mapResource?Q.mapResource(H):H;z.push(V);for(let F of await Y(H))G.push(F)}if($.id&&!K.has($.id))z.push(Q.mapResource?Q.mapResource($):$);return U9(z,"modify")}async function z9($,Z,Q,X){let Y=JSON.stringify(O0(Q)),J=X?.compression??Z.compression??"gzip",_=J==="gzip"?await xZ(Y):Y,z=wZ(_),G=X?.maxPayloadBytes??Z.maxPayloadBytes??H9,K=X?.multipart??Z.multipart??"auto",H=X?.multipartThresholdBytes??Z.multipartThresholdBytes??BZ;if(z>G&&K==="never")throw new b0("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(K==="always"\|\|K==="auto"&&z>H)return TZ($,Z,_,J,X);return EZ(Z,{id:Z.datasourceId,data_source_id:Z.datasourceId,json_data:_,compression_type:J==="gzip"?"GZIP":"NONE"})}async function EZ($,Z){let Q=`${W9($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:push`,X=await p$(Q,{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"},body:JSON.stringify(Z)});return M9(X)}async function TZ($,Z,Q,X,Y){let J=Y?.partSizeBytes??Z.partSizeBytes??DZ,_=await qZ(Z,X),z=SZ(Q,J);for(let K=0;K<z.length;K++)await RZ(Z,_,K+1,z[K]??"");let G=await PZ(Z,_,z.length);return $.debug("OAA multipart payload pushed",{uploadId:_,parts:z.length}),{...G,uploadId:G.uploadId??_,parts:G.parts??z.length}}async function qZ($,Z){let Q=H4($,"multipart/start"),X=await p$(Q,{method:"POST",headers:B4($),body:JSON.stringify({data_source_id:$.datasourceId,compression_type:Z==="gzip"?"GZIP":"NONE"})}),Y=await D4(X),J=D0(Y,"upload_id")??D0(Y,"uploadId")??D0(Y,"id");if(!J)throw new b0("OAA multipart start response did not include an upload id",{code:"invalid_response"});return J}async function RZ($,Z,Q,X){let Y=H4($,`multipart/${encodeURIComponent(Z)}/parts/${Q}`);await p$(Y,{method:"PUT",headers:B4($),body:JSON.stringify({upload_id:Z,sequence:Q,data:X})})}async function PZ($,Z,Q){let X=H4($,`multipart/${encodeURIComponent(Z)}/complete`),Y=await p$(X,{method:"POST",headers:B4($),body:JSON.stringify({upload_id:Z,parts:Q})});return M9(Y)}function H4($,Z){return`${W9($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:${Z}`}function B4($){return{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"}}async function p$($,Z){let Q;for(let X=0;X<z4;X++){try{let Y=await fetch($,Z);if(!F9(Y.status)\|\|X===z4-1){if(!Y.ok)await IZ(Y);return Y}Q=new b0(`OAA request failed with retryable status ${Y.status}`,{retryable:!0,status:Y.status})}catch(Y){if(Q=Y,Y instanceof b0&&!Y.retryable)throw Y;if(X===z4-1)break}await yZ(VZ2X)}throw new b0("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:Q})}function F9($){return $===429\|\|$>=500}async function IZ($){let Z=await D4($).catch(()=>{return}),Q=D0(Z,"message")??D0(Z,"error")??`OAA request failed with status ${$.status}`;throw new b0(Q,{code:D0(Z,"code")??"http_error",status:$.status,retryable:F9($.status),warnings:L9(Z?.warnings)})}async function M9($){let Z=await D4($).catch(()=>{return});return{success:$.ok,syncToken:D0(Z,"sync_token")??D0(Z,"syncToken"),uploadId:D0(Z,"upload_id")??D0(Z,"uploadId"),parts:bZ(Z,"parts"),warnings:L9(Z?.warnings),metadata:Z}}async function D4($){let Z=await $.text();if(!Z)return{};let Q=JSON.parse(Z);return Q&&typeof Q==="object"&&!Array.isArray(Q)?Q:{}}async function xZ($){let Z=new Blob([$]).stream().pipeThrough(new CompressionStream("gzip")),Q=await new Response(Z).arrayBuffer();return Buffer.from(Q).toString("base64")}function SZ($,Z){let Q=[];for(let X=0;X<$.length;X+=Z)Q.push($.slice(X,X+Z));return Q}function wZ($){return Buffer.byteLength($,"utf8")}function CZ($){if(!$)return;return $ instanceof Date?$.toISOString():$}function D0($,Z){if(!$\|\|typeof $!=="object")return;let Q=$[Z];return typeof Q==="string"&&Q.length>0?Q:void 0}function kZ($,Z){if(!$\|\|typeof $!=="object")return;let Q=$[Z];return typeof Q==="boolean"?Q:void 0}function bZ($,Z){if(!$\|\|typeof $!=="object")return;let Q=$[Z];return typeof Q==="number"?Q:void 0}function L9($){if(!Array.isArray($))return;let Z=$.filter((Q)=>typeof Q==="string");return Z.length>0?Z:void 0}async function_$($){if(!$)return;for await(let Z of $)yield Z}function O0($){if(Array.isArray($))return $.map(O0).filter((Q)=>Q!==void 0);if(!$\|\|typeof $!=="object"\|\|$ instanceof Date)return $===null?void 0:$;let Z=Object.entries($).map(([Q,X])=>[Q,O0(X)]).filter(([,Q])=>{if(Q===void 0)return!1;if(Array.isArray(Q)&&Q.length===0)return!1;if(Q&&typeof Q==="object"&&!Array.isArray(Q)&&Object.keys(Q).length===0)return!1;return!0});return Z.length>0?Object.fromEntries(Z):void 0}function W9($){return $.replace(/\/+$/,"")}function u0($){return $.applicationName??_9}function yZ($){return new Promise((Z)=>setTimeout(Z,$))}function uZ($,Z){if(!$)return;if($.groups.get(Z))return"group";if($.roles.get(Z))return"role";if($.permissions.get(Z))return"permission";return}function lZ($,Z,Q){(async()=>{let X=[],Y=async(J,_)=>{let z=J==="group"?Z.groups:J==="role"?Z.roles:Z.permissions;for(let G of _)if(await z.get(G))X.push(`${J}:${G}`)};if(await Y("group",Q.groups.list().map((J)=>J.id)),await Y("role",Q.roles.list().map((J)=>J.id)),await Y("permission",Q.permissions.list().map((J)=>J.id)),X.length>0)$.warn("Catalog store rows shadow code-declared entitlement ids; the code definitions win on read. Delete the store rows (they are inert) to clear this warning.",{"ion.operation":"authz.catalog.shadowed_rows","ion.outcome":"degraded",ids:X.sort()})})().catch((X)=>{$.debug?.("Shadowed-row catalog scan failed (non-fatal)",{error:X})})}function N9($){let Z,Q=!1,X,Y,J=B9($,()=>Z?.oaa,()=>({mapPermissionTypes:Z?.mapPermissionTypes,mapGroup:Z?.mapGroup,mapRole:Z?.mapRole,mapResource:Z?.mapResource}),()=>hZ(Z),()=>{let N=Z?.catalogStore;return N\|\|X?{catalog:N,code:X,resources:Z?.resources,cache:Y}:void 0}),_=(N)=>{if(Q\|\|!J.isReady())return;let{kind:P}=N;(N.op==="delete"?P==="role"?J.deleteRole(N.id):P==="permission"?J.deletePermission(N.id):J.deleteGroup(N.id):P==="role"?J.pushRole(N.entity):P==="permission"?J.pushPermission(N.entity):J.pushGroup(N.entity)).catch((S)=>{$.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:N.op,kind:P,error:S})})},z=(N)=>{if(Q\|\|!J.isReady())return;let P=Z?.resources;if(!P)return;(async()=>{if(N.deleted){await J.deleteResource(N.id);return}let S=await P.get(N.id);if(!S)return;await J.pushResource(S);for(let d of P.entitlements?.(S)??[])await J.pushGroup(dZ(d))})().catch((S)=>{$.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:N.id,deleted:N.deleted===!0,error:S})})},G,K,H,V,F=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),j=!1,B=()=>{let N=Z?.accessIndex;if(!N&&!j)j=!0,$.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return N},D=async(N)=>{let P=Z?.accessIndex,y=Z?.catalogStore;if(!P\|\|!y&&!X)return!1;let S=N.id??vZ(N),d=await pZ({...N,id:S},{catalog:y,code:X,resources:Z?.resources,cache:Y});return await P.materialize(S,d),!0},x=(N,P)=>gZ(N,P,{accessStore:Z?.accessStore,accessIndex:Z?.accessIndex,catalogStore:Z?.catalogStore,code:X,resources:Z?.resources},Y),M=async()=>{let N={subjects:0,roots:0,cleared:0},P=Z?.accessIndex,y=Z?.catalogStore;if(Q\|\|!P\|\|!y&&!X)return N;let S=new Map,d=(Y0)=>{let K0=V4(Y0.subject);if(!K0)return;let p=Y0.subjectType??"user";S.set(`${p}:${K0}`,{subject:K0,subjectType:p})},i=new Set,e=Z?.accessStore;if(e)for await(let Y0 of O9((K0,p)=>e.list({start:K0,limit:p}))){d({subject:V4(Y0.subject),subjectType:Y0.subjectType});let K0=V4(Y0.target);if(Y&&K0&&typeof Y0.target==="string"){if(!await Y.getNode(Y0.targetType,K0))i.add(`${Y0.targetType}:${K0}`)}}if(i.size>0)$.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog, catalog store, or resource derivation). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...i].sort()});if(P.listSubjects)for(let Y0 of await P.listSubjects())d(Y0);for(let Y0 of S.values()){let K0=await x(Y0.subject,Y0.subjectType??"user");if(N.subjects+=1,N.roots+=K0,K0===0)N.cleared+=1}return N},W=()=>{if(Q)return Promise.resolve({subjects:0,roots:0,cleared:0});return M()},q=Promise.resolve(),T=!1,m=(N,P)=>{let y=q.then(async()=>{if(Q)return;try{await P()}catch(S){$.warn(`${N} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:N,error:S instanceof Error?S.message:String(S)})}});return q=y,y},C=(N)=>{if(T)return;T=!0,m(N,async()=>{T=!1,await M()})},c=()=>q,Z0=(N)=>{if(Q)return;let P=Z?.accessStore;if(!Z?.accessIndex\|\|!Z?.catalogStore\|\|!P)return;if(Y?.invalidate(N),N.op==="set"){let y=N.kind,S=N.entity.id;m("catalog-change",async()=>{for await(let d of O9((i,e)=>P.listByTarget(y,S,{start:i,limit:e})))await D(d)})}else C("catalog-delete")},o=(N)=>{if(Q)return;if(Y?.clear(),!Z?.accessIndex\|\|!Z?.catalogStore&&!X\|\|!Z?.accessStore)return;C("resource-change")},E={oaa:J,get accessIndex(){return Z?.accessIndex},has(N,P,y,S,d){let i=B();return i?i.has(N,P,y,S,d):Promise.resolve(F())},hasGroup(N,P,y,S){let d=B();return d?d.hasGroup(N,P,y,S):Promise.resolve(F())},hasRole(N,P,y,S){let d=B();return d?d.hasRole(N,P,y,S):Promise.resolve(F())},hasPermission(N,P,y,S){let d=B();return d?d.hasPermission(N,P,y,S):Promise.resolve(F())},hasAny(N,P,y){let S=B();return S?S.hasAny(N,P,y):Promise.resolve(F())},hasAll(N,P,y){let S=B();return S?S.hasAll(N,P,y):Promise.resolve(F())},reconcile(){return W()},settle(){return c()}};return{update(N){if(Q)return E;if(N?.resources&&Boolean(N.resources.entitlements)!==Boolean(N.resources.entitlement))throw Error("AuthzConfig.resources: `entitlements(resource)` and `entitlement(id)` must be provided together (the derivation and its reverse resolver are both app-authored).");let P=N?.catalog?fZ(N.catalog):void 0,y=P!==X;X=P,Z=N,J.refreshReadiness();let S=N?.catalogStore,d=N?.resources;if(S!==G\|\|d!==H\|\|y){if(K?.(),V?.(),Y=S\|\|X?new mZ(S,d,X):void 0,K=S?.afterChange?S.afterChange((i)=>{if(i.op==="set"&&uZ(X,i.entity.id))$.warn("Catalog store row shadows a code-declared entitlement id; the code definition wins on read",{"ion.operation":"authz.catalog.shadowed_row","ion.outcome":"degraded",id:i.entity.id,kind:i.kind});_(i),Z0(i)}):void 0,V=d?.changed?d.changed((i)=>{o(i),z(i)}):void 0,G=S,H=d,S&&X)lZ($,S,X)}else if(Y)Y.clear();return E},close(){if(Q)return;Q=!0,K?.(),K=void 0,V?.(),V=void 0,G=void 0,H=void 0,Y=void 0}}}function A9($){return $.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+\|_+$/g,"")\|\|"EMPTY"}function cZ($){let Z=`${$.clientId}\x00${$.path}`,Q=2166136261;for(let X=0;X<Z.length;X+=1)Q^=Z.charCodeAt(X),Q=Math.imul(Q,16777619);return(Q>>>0).toString(36)}function iZ($){let Z=A9($.clientId),Q=A9($.path);return`LFV_${Z}__${Q}`}function j9($,Z){let Q=iZ(Z);if(!(Q in $))return Q;let X=`${Q}_${cZ(Z)}`;if(!(X in $))return X;return`${X}_ALT`}import{defaultLogger as rQ}from"@ionite/core";import{defaultLogger as aZ,stableConfigHash as tZ}from"@ionite/core";import{verifyLfvSignature as rZ}from"@ionite/core/server";var B$=new Map;function nZ($){if(!$)return"/";return $.startsWith("/")?$:`/${$}`}function sZ($){try{let Z=new URL($),Q=Z.pathname.replace(/\/+$/g,"");return`${Z.origin}${Q}`}catch{return $.replace(/\/+$/g,"")}}function g$($){let Z=sZ($.lfvServerUrl),Q=nZ($.path);return`${Z}\|${Q}`}function E9($,Z,Q){let X=B$.get($)??new Map;return X.set(Z,Q),B$.set($,X),()=>{let Y=B$.get($);if(!Y)return;if(Y.delete(Z),Y.size===0)B$.delete($)}}async function T9($,Z,Q,X){let Y=B$.get($);if(!Y)return 0;let J=0;for(let[_,z]of Y){if(Q&&_===Q)continue;if(z.trustId!==X)continue;if(!z.onDelivery)continue;J+=1,await z.onDelivery(Z)}return J}async function q9($,Z,Q,X){let Y=B$.get($);if(!Y)return 0;let J=0;for(let[_,z]of Y){if(Q&&_===Q)continue;if(z.trustId!==X)continue;if(!z.onEvents)continue;J+=1,await z.onEvents(Z)}return J}function R9($){try{return new URL($).pathname}catch{return $.startsWith("/")?$:`/${$}`}}var oZ=1e4,eZ=1e4,$1=300;async function S9($){await new Promise((Z)=>setTimeout(Z,$))}function f0($){return{startedAt:Date.now(),timeout:typeof $?.timeout==="number"&&$.timeout>0?$.timeout:void 0}}function j$($){if($.timeout===void 0)return;let Z=Date.now()-$.startedAt;return Math.max(0,$.timeout-Z)}function c0($,Z,Q){return Error(`LFV ${$} timed out after ${Q.timeout??0}ms for ${Z}`)}async function A$($,Z,Q,X,Y){let J=j$(Q);if(J!==void 0){if(J<=0)throw c0(X,Y,Q);let _=new AbortController,z=setTimeout(()=>_.abort(),J);try{return await fetch($,{...Z,signal:_.signal})}catch(G){if(G instanceof Error&&G.name==="AbortError")throw c0(X,Y,Q);throw G}finally{clearTimeout(z)}}return await fetch($,Z)}class R0 extends Error{constructor($){super(`LFV source closed while operating on ${$}`);this.name="LfvSourceClosedError"}}function d$($){return $ instanceof R0\|\|$ instanceof Error&&$.name==="LfvSourceClosedError"}function U4($){try{let Z=JSON.parse($);return typeof Z==="object"&&Z!==null&&!Array.isArray(Z)?Z:void 0}catch{return}}async function P9($,Z,Q,X,Y,J,_,z,G,K){let H=0,V=Date.now();for(;;){if(K?.())throw new R0(X);let F=j$(Q);if(F!==void 0&&F<=0)throw c0(Y,X,Q);try{return await $()}catch(j){if(j instanceof R0)throw j;if(K?.())throw new R0(X);if(H+=1,_>0&&Date.now()-V>=_){let D=`Error connecting to the LFV source. Retries: '${H}'`;if(z)z(G,D,{url:Z,path:X,operation:Y});V=Date.now()}let B=F===void 0?J:Math.min(J,F);if(B<=0)throw c0(Y,X,Q);if(await S9(B),K?.())throw new R0(X)}}}function Z1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function I9($){if(typeof $==="number"&&Number.isFinite($))return $;if(typeof $==="string"&&$.trim()){let Z=Date.parse($.trim());if(!Number.isNaN(Z))return Z}return}function x9($){return`[LFV] [${$??"-"}] [${new Date().toISOString()}]: `}function F4($,Z){if(typeof $!=="string"\|\|$.trim()==="")throw Error(`LFV source requires "${Z}"`);return $}function Q1($){return{...$,lfvServerUrl:F4($.lfvServerUrl,"lfvServerUrl"),clientId:F4($.clientId,"clientId"),path:F4($.path,"path")}}function E$($){let Z=Q1($),Q=Z.log??aZ,X=(U,R,v)=>{let f=x9(U)+R;if(v!==void 0)Q.debug(f,v);else Q.debug(f)},Y=(U,R,v)=>{let f=x9(U)+R;if(v!==void 0)Q.warn(f,v);else Q.warn(f)},J=Z.lfvServerUrl,_=Z.clientId,z=Z.path,G=Z.verifyJwks,K=typeof Z.deliveryTimeout==="number"&&Z.deliveryTimeout>0?Z.deliveryTimeout:void 0,H=typeof Z.retryInterval==="number"&&Z.retryInterval>0?Z.retryInterval:oZ,V=typeof Z.warnInterval==="number"&&Z.warnInterval>=0?Z.warnInterval:eZ,F=(typeof Z.callbackMaxAgeSeconds==="number"&&Z.callbackMaxAgeSeconds>0?Z.callbackMaxAgeSeconds:$1)1000,j=typeof Z.cacheMaxAgeSeconds==="number"&&Z.cacheMaxAgeSeconds>0?Z.cacheMaxAgeSeconds1000:void 0,B=G?.trim()?tZ(G.trim()):void 0,D=R9(Z.deliveryEndpoint),x=R9(Z.eventsEndpoint),M=g$({lfvServerUrl:J,path:z}),W=crypto.randomUUID(),q=new Map,T=new Map,m=new Map,C=new Map,c=new Map,Z0=new Map,o=new Map,E=new Map,N=new Map,P=!1,y,S=new Set,d=()=>P;function i(U,R){T.set(U,R),m.set(U,Date.now())}function e(U){T.delete(U),m.delete(U)}function Y0(U){let R=T.get(U);if(!R)return;if(j!==void 0){let v=m.get(U)??0;if(Date.now()-v>j){X(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:U});return}}return R}function K0(){if(P){if(y)y(),y=void 0;return}let U=q.size>0,R=o.size>0\|\|E.size>0,v=U\|\|R;if(v&&!y){y=E9(M,W,{trustId:B,onDelivery:async(f)=>{l(f)},onEvents:async(f)=>{C0(f)}});return}if(!v&&y)y(),y=void 0}async function p(U,R,v,f){if(P)throw new R0(U);let n=v??crypto.randomUUID(),s=f??f0(),X0=new Promise((L0,k0)=>{let F0={resolve:L0,reject:k0},j0=j$(s);if(j0!==void 0){if(j0<=0){k0(c0("issueOtp",U,s));return}F0.timer=setTimeout(()=>{E.delete(n),K0(),k0(c0("issueOtp",U,s))},j0)}E.set(n,F0),K0()});X0.catch(()=>{});let G0=()=>{let L0=E.get(n);if(!L0)return;if(L0.timer)clearTimeout(L0.timer);E.delete(n),K0()},N0={request_id:n,path:U,action:R};X(n,"OTP request",{path:U,action:R});let M0;try{M0=await P9(async()=>{return await A$(`${J.replace(/\/+$/g,"")}/clients/${_}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":n},body:JSON.stringify(N0)},s,"issueOtp",U)},J,s,U,"issueOtp",H,V,Y,n,d)}catch(L0){throw G0(),L0}if(M0.status!==200&&M0.status!==202)throw G0(),Error(`LFV OTP request failed (${M0.status}) for ${U}`);try{let L0=await X0;return X(n,"OTP received via signed callback",{path:U,action:R}),L0}finally{G0()}}async function $0(U,R,v,f,n,s){if(P)throw new R0(R);let X0=n??crypto.randomUUID(),G0=s??f0(),N0=await p(R,v,X0,G0),M0=await P9(async()=>{return await A$(`${J.replace(/\/+$/g,"")}${U}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":X0},body:JSON.stringify({request_id:X0,otp:N0,path:R,...f??{}})},G0,v,R)},J,G0,R,v,H,V,Y,X0,d);if(M0.status!==200&&M0.status!==202)throw Error(`LFV ${v} failed (${M0.status}) for ${R}`);return X(X0,`${v} accepted`,{path:R,status:M0.status}),{requestId:X0}}async function _0(U,R,v){if(P)throw new R0(U);let f=Y0(U);if(f)return f;let n=N.get(U);if(n)return n;let s=B0(U,R,v);N.set(U,s),s.catch((X0)=>{if(d$(X0))X(R,"read aborted: source closed",{path:U})});try{return await s}finally{N.delete(U)}}async function B0(U,R,v){let f=v?.timeout??K,n={startedAt:Date.now(),timeout:typeof f==="number"&&f>0?f:void 0},s,X0=new Promise((F0,j0)=>{s={resolve:F0,reject:j0};let s0=o.get(U)??new Set;s0.add(s),o.set(U,s0),K0()});X0.catch(()=>{});let G0=()=>{if(!s)return;let F0=o.get(U);if(F0?.delete(s),F0&&F0.size===0)o.delete(U);K0()},N0=R??crypto.randomUUID();X(N0,"read_secret request",{path:U});let M0=0,L0=Date.now();for(;;){if(P)throw G0(),new R0(U);try{await $0("/secrets/request",U,"read_secret",void 0,N0,n),X(N0,"read_secret accepted, awaiting delivery",{path:U});break}catch(F0){if(F0 instanceof R0)throw G0(),F0;let j0=j$(n);if(j0!==void 0&&j0<=0)throw G0(),c0("read_secret",U,n);if(M0+=1,V>0&&Date.now()-L0>=V)Y(N0,`read_secret retrying. Retries: '${M0}'`,{path:U}),L0=Date.now();let s0=j0===void 0?H:Math.min(H,j0);if(s0<=0)throw G0(),c0("read_secret",U,n);await S9(s0)}}let k0=j$(n);if(k0!==void 0){if(k0<=0)throw G0(),Error(`LFV delivery timed out while reading ${U}`);let F0;try{return await Promise.race([X0,new Promise((j0,s0)=>{F0=setTimeout(()=>{G0(),s0(Error(`LFV delivery timed out while reading ${U}`))},k0)})])}finally{if(F0)clearTimeout(F0)}}return await X0}function L(U,R,v){if(v!==void 0){let s=c.get(U);if(s!==void 0&&v<s){X(void 0,"delivery ignored: stale version",{path:U,realVersion:v,lastAccepted:s});return}c.set(U,v)}i(U,R),S.delete(U);let f=R.metadata.version;if(C.get(U)===f)return;C.set(U,f);let n=q.get(U);if(!n)return;for(let s of n)s(R)}async function b(U,R){return await _0(U,void 0,R)}async function g(U,R,v){if(!Z1(R))throw Error(`putSecret requires an object value for LFV source at path ${U}`);let f=f0(v);if(await J0(U,v)){await $0("/secrets/update",U,"update_secret",{data:R},void 0,f),e(U);return}await $0("/secrets/create",U,"create_secret",{data:R},void 0,f),e(U)}async function a(U,R){let v=f0(R);await $0("/secrets/delete",U,"delete_secret",void 0,void 0,v),e(U)}async function t(U,R){let v=f0(R),f=crypto.randomUUID();X(f,"list_paths request",{path:U});let n=await p(U,"list_paths",f,v),s=await A$(`${J.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":f},body:JSON.stringify({request_id:f,otp:n,path:U})},v,"listPaths",U);if(s.status!==200)throw Error(`LFV listPaths failed (${s.status}) for ${U}`);let X0=await s.json();if(!Array.isArray(X0.items))throw Error(`LFV listPaths returned invalid payload for ${U}`);return X(f,"list_paths success",{path:U,status:200}),X0.items.filter((G0)=>typeof G0==="string")}async function J0(U,R){let v=f0(R),f=crypto.randomUUID();X(f,"exists request",{path:U});let n=await p(U,"read_metadata",f,v),s=await A$(`${J.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":f},body:JSON.stringify({request_id:f,otp:n,path:U})},v,"exists",U);if(s.status!==200)throw Error(`LFV exists failed (${s.status}) for ${U}`);let X0=await s.json();if(typeof X0.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${U}`);return X(f,"exists success",{path:U,status:200,exists:X0.exists}),X0.exists}async function V0(U,R,v){let f=f0(v);await $0("/secrets/rotate/request",U,"request_rotate",{reason:R?.reason,severity:R?.severity,incident_ref:R?.incidentRef},void 0,f)}async function A(U,R,v){let f=f0(v);await $0("/secrets/revoke/request",U,"request_revoke",{reason:R?.reason,severity:R?.severity,incident_ref:R?.incidentRef},void 0,f)}async function O(U,R){let v=f0(R),f=crypto.randomUUID();X(f,"getMetadata request",{path:U});let n=await p(U,"read_metadata",f,v),s=await A$(`${J.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":f},body:JSON.stringify({request_id:f,otp:n,path:U})},v,"getMetadata",U);if(s.status!==200)throw Error(`LFV getMetadata failed (${s.status}) for ${U}`);let X0=await s.json();if(!X0.metadata\|\|typeof X0.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${U}`);return X(f,"getMetadata success",{path:U,status:200}),X0.metadata}async function w(U,R,v){let f=q.get(U)??new Set,n,s=(G0)=>{if(G0.metadata.version===n)return;n=G0.metadata.version,R(G0)};f.add(s),q.set(U,f);let X0=Y0(U);if(X0)s(X0),C.set(U,X0.metadata.version);else try{s(await b(U,v))}catch(G0){if(f.delete(s),f.size===0)q.delete(U);throw G0}return K0(),()=>{let G0=q.get(U);if(!G0)return;if(G0.delete(s),G0.size===0)q.delete(U);K0()}}function I(U){return U.method==="POST"&&new URL(U.url).pathname===D}function k(U){return U.method==="POST"&&new URL(U.url).pathname===x}function u(U){let R=U.data?.metadata?.path;if(typeof R==="string"&&R)return R;if(typeof U.path==="string"&&U.path)return U.path;return}function h(U,R){let v=o.get(U);if(!v\|\|v.size===0)return!1;o.delete(U),K0();for(let f of v)f.resolve(R);return!0}function r(U){let{request_id:R,otp:v}=U;if(typeof R!=="string"\|\|typeof v!=="string"\|\|!v)return{handled:!1};let f=E.get(R);if(!f)return{handled:!1};if(f.timer)clearTimeout(f.timer);return E.delete(R),K0(),f.resolve(v),{handled:!0}}function l(U){if(U.type==="otp")return r(U);let R=u(U);if(!R)return X(U.request_id,"delivery ignored: no path",{}),{handled:!1};let v=U.data?.metadata??{},f=typeof v.version==="number"?v.version:void 0,n={data:U.data?.data??{},metadata:{path:R,version:f??0,created:new Date}};L(R,n,f);let s=h(R,n);return X(U.request_id,"delivery applied",{path:R,handled:s}),{handled:s}}function z0(U="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:U}),{status:401,headers:{"Content-Type":"application/json"}})}async function Q0(U,R){if(!G?.trim())return Y(void 0,"LFV callback rejected: verifyJwks is not configured"),z0("LFV callback verification is not configured");let v=U.headers.get("X-LFV-Request-Id")??U.headers.get("x-lfv-request-id")??"",f=U.headers.get("X-LFV-Key-Id")??U.headers.get("x-lfv-key-id")??"",n=U.headers.get("X-LFV-Signature")??U.headers.get("x-lfv-signature")??"";if(!v.trim()\|\|!f.trim()\|\|!n.trim())return Y(v\|\|void 0,"LFV callback rejected: missing signature headers"),z0("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await rZ({jwks:G,kid:f,signatureB64Url:n.trim(),requestId:v.trim(),rawBody:R}))return Y(v,"LFV callback rejected: signature verification failed"),z0();let X0=U4(R);if(!X0)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let G0=X0;if(G0.request_id!==v.trim())return Y(v,"LFV callback rejected: request_id header/body mismatch"),z0("X-LFV-Request-Id does not match request_id in body");let N0=Date.now(),M0=I9(G0.issued_at);if(M0===void 0)return Y(v,"LFV callback rejected: missing or invalid issued_at"),z0("Missing or invalid issued_at");if(N0-M0>F)return Y(v,"LFV callback rejected: stale (outside freshness window)"),z0("Callback is stale (issued_at outside freshness window)");let L0=I9(G0.expires_at);if(L0!==void 0&&N0>L0)return Y(v,"LFV callback rejected: expired"),z0("Callback has expired");let k0=n.trim();for(let[F0,j0]of Z0)if(j0<=N0)Z0.delete(F0);if(Z0.has(k0))return Y(v,"LFV callback rejected: replayed signature"),z0("Callback signature already processed (replay)");return Z0.set(k0,M0+F),null}async function z$(U){let R=await U.text(),v=await Q0(U,R);if(v)return v;let f=U4(R);if(!f)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let n=f,s=u(n);X(n.request_id,"delivery received",{path:s});let X0=l(n),G0=s?g$({lfvServerUrl:J,path:s}):M,N0=await T9(G0,n,W,B);if(!X0.handled&&N0===0)return new Response(JSON.stringify({status:"accepted",note:"unmapped_delivery"}),{status:200,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function C0(U){if(P)return;if(!U?.path\|\|typeof U.path!=="string")return;if(X(U.request_id,"events payload",{path:U.path,event:U.event}),U.event==="created"\|\|U.event==="updated"\|\|U.event==="rotated"\|\|U.event==="revoked")e(U.path),_0(U.path,U.request_id).catch((R)=>{if(d$(R)){X(U.request_id,"event refresh aborted: source closed",{path:U.path});return}S.add(U.path),Y(U.request_id,"event-triggered refresh failed; source marked degraded",{path:U.path,event:U.event,error:R instanceof Error?R.message:String(R)})})}async function W$(U){let R=await U.text(),v=await Q0(U,R);if(v)return v;let f=U4(R);if(!f)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let n=f;if(!n?.path\|\|typeof n.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});X(n.request_id,"events received",{path:n.path,event:n.event}),C0(n);let s=g$({lfvServerUrl:J,path:n.path});return await q9(s,n,W,B),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function ZZ(){if(P)return;if(P=!0,y)y(),y=void 0;let U=new R0(z);for(let R of o.values())for(let v of R)try{v.reject(U)}catch{}o.clear();for(let R of E.values()){if(R.timer)clearTimeout(R.timer);try{R.reject(U)}catch{}}E.clear(),N.clear(),S.clear(),T.clear(),m.clear(),C.clear(),c.clear(),Z0.clear(),q.clear()}return{type:"vault",isAvailable:()=>S.size===0,getFullSecret:b,getSecret:async(U,R)=>{return(await b(U,R)).data},putSecret:g,deleteSecret:a,listPaths:t,exists:J0,requestRotate:V0,requestRevoke:A,getMetadata:O,subscribe:w,close:ZZ,isDeliveryRequest:I,isEventsRequest:k,handleDelivery:z$,handleEvents:W$,deliveryPath:D,eventsPath:x,callbackKey:M,trustId:B}}function o0($,Z,Q){if(typeof $!=="string"\|\|$.trim()==="")throw Error(`"${Z}" is required when using ${Q}`);return $}var u$="__esLfvBootstrap";import{withDefaultExternalId as X1}from"@ionite/core/server";function l$($){return[$.tenantId??"_",$.destination,$.resourceType,$.externalId].join("\x00")}class c${map=new Map;async get($){return this.map.get(l$($))}async set($,Z){this.map.set(l$($),Z)}async delete($){this.map.delete(l$($))}}function M4($){return $==="user"?"Users":"Groups"}function L4($){return $.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class i${baseUrl;getToken;idMapStore;tenantId;log;fetchImpl;inflight=new Map;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.getToken=$.getToken,this.idMapStore=$.idMapStore,this.tenantId=$.tenantId,this.log=$.log,this.fetchImpl=$.fetchImpl??((Z,Q)=>fetch(Z,Q))}async headers(){let $=await this.getToken();return new Headers({"Content-Type":"application/scim+json",Accept:"application/scim+json",Authorization:`Bearer ${$}`})}inflightKey($,Z){return`${$}\x00${Z}`}async resolveProviderId($,Z,Q){let X={tenantId:this.tenantId,destination:this.baseUrl,resourceType:$,externalId:Z},Y=await this.idMapStore.get(X);if(Y)return{found:Y};let J=this.inflightKey($,Z),_=this.inflight.get(J);if(_)return _;let z=this.resolveUncached($,Z,Q).then(async(G)=>{if(typeof G==="object")await this.idMapStore.set(X,G.found);return G}).finally(()=>{this.inflight.delete(J)});return this.inflight.set(J,z),z}async resolveUncached($,Z,Q){let X=await this.filterByExternalId($,Z);if(X!=="absent")return X;if(!Q)return"absent";return this.create($,Z,Q)}async filterByExternalId($,Z){let Q=encodeURIComponent(`externalId eq "${L4(Z)}"`),X=`${this.baseUrl}/${M4($)}?filter=${Q}`,Y=await this.fetchImpl(X,{method:"GET",headers:await this.headers()});if(!Y.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:$,status:Y.status}),"error";let _=((await Y.json()).Resources??[])[0]?.id;return _?{found:_}:"absent"}async create($,Z,Q){let X=`${this.baseUrl}/${M4($)}`,Y=$==="user"?{schemas:["urn:ietf:params:scim:schemas:core:2.0:User"],userName:Q.userName??Z,externalId:Z,displayName:Q.displayName,active:!0}:{schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:Q.displayName??Z,externalId:Z},J=await this.fetchImpl(X,{method:"POST",headers:await this.headers(),body:JSON.stringify(Y)});if(!J.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:$,status:J.status}),"error";let _=await J.json();return _.id?{found:_.id}:"error"}async invalidate($,Z){await this.idMapStore.delete({tenantId:this.tenantId,destination:this.baseUrl,resourceType:$,externalId:Z})}async patchGroupMembership($){let{groupExternalId:Z,userExternalId:Q,op:X}=$,Y=await this.resolveProviderId("user",Q,X==="add"?$.userCreate:void 0);if(Y==="error")return this.log.warn("IAM delta: user lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(Y==="absent")return this.log.warn("IAM delta: user not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let J=Y.found,_=async(K)=>{let H=await this.resolveProviderId("group",Z,X==="add"&&K?$.groupCreate:void 0);if(H==="error")return{kind:"error"};if(H==="absent")return{kind:"absent"};let V=`${this.baseUrl}/${M4("group")}/${encodeURIComponent(H.found)}`,F=X==="add"?[{op:"add",path:"members",value:[{value:J}]}]:[{op:"remove",path:`members[value eq "${L4(J)}"]`}];return{kind:"response",response:await this.fetchImpl(V,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:PatchOp"],Operations:F})})}},z=await _(!0);if(z.kind==="response"&&(z.response.status===404\|\|z.response.status===410))await this.invalidate("group",Z),z=await _(!1);if(z.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(z.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let G=z.response;if(!G.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X,status:G.status}),"error";return"pushed"}}function W4($){if(typeof $==="string")return $;if($&&typeof $==="object"&&"id"in $)return $.id;return}function w9($){return $&&typeof $==="object"?$:void 0}function O4($){let Z={},Q={},X,Y,J,_,z,G,K=new Promise((W)=>{G=W}),H=()=>{if(!Z.url\|\|!Q.workload)return!1;return Z.mode==="patch"&&Boolean(Q.idMapStore)},V=()=>{if(G&&H())G(),G=void 0},F=async()=>{let W=Q.workload;if(!W)throw Error("IAM delta: workload identity not configured");if(Z.audience&&typeof W.getToken==="function")return W.getToken(Z.audience);if(typeof W.getServerToken==="function")return W.getServerToken();return W.getToken()},j=()=>{if(!H()\|\|!Z.url\|\|!Q.idMapStore)return;let W=`${Z.tenantId??"_"}\x00${Z.url}`;if(X&&Y===W&&J===Q.idMapStore&&_===Q.fetchImpl)return X;return X=new i$({baseUrl:Z.url,getToken:F,idMapStore:Q.idMapStore,tenantId:Z.tenantId,log:$,fetchImpl:Q.fetchImpl}),Y=W,J=Q.idMapStore,_=Q.fetchImpl,X},B=async(W)=>{let T=w9(W.subject);if(!T){let C=W4(W.subject);if(C&&Q.userStore)T=await Q.userStore.get(C)}let m=T?.externalId;if(!m)return;return{externalId:m,create:{userName:T?.userName??m,displayName:T?.displayName??T?.name}}},D=async(W)=>{let T=w9(W.target);if(!T){let C=W4(W.target);if(C&&Q.catalogStore)T=await Q.catalogStore.groups.get(C);if(C&&!T)T=X1(await Q.resources?.entitlement?.(C))}let m=T?.externalId;if(!m)return;return{externalId:m,create:{displayName:T?.displayName??T?.name??m}}},x=async(W,q)=>{if(!H())return"skipped";if(W.targetType!=="group")return $.debug("IAM delta: non-group target skipped (not representable as SCIM membership)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",targetType:W.targetType}),"skipped";let T=await B(W),m=await D(W);if(!T\|\|!m)return $.warn("IAM delta: missing externalId on subject or target; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:q,hasSubject:Boolean(T),hasGroup:Boolean(m)}),"skipped";let C=j();if(!C)return"skipped";return C.patchGroupMembership({groupExternalId:m.externalId,userExternalId:T.externalId,op:q,groupCreate:m.create,userCreate:T.create})},M={async onGrant(W){if(!H())return;if(await x(W,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(W){if(!H())return;if(await x(W,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async reconcile(W){let q={pushed:0,skipped:0,errors:[]};if(!H())return q.errors.push("iam delta not ready"),q;for await(let T of W)try{let m=await x(T,"add");if(m==="pushed")q.pushed+=1;else if(m==="error")q.errors.push(`IAM delta: destination rejected membership push for ${W4(T.target)??"unknown"}`);else q.skipped+=1}catch(m){q.errors.push(m instanceof Error?m.message:String(m))}return q},isReady:H,ready(W){if(H())return Promise.resolve();if(!W\|\|W<=0)return K;return Promise.race([K,new Promise((q,T)=>setTimeout(()=>T(Error("IAM delta readiness timeout")),W))])}};return{update(W,q){if(Z=W,!q.idMapStore)z??=new c$;return Q={...q,idMapStore:q.idMapStore??z},j(),V(),M}}}import{IoniteError as Y1}from"@ionite/core";function J1($){if($ instanceof Y1)return{status:$.status,statusText:$.statusText};if(typeof $!=="object"\|\|$==null)return;let Z=$,Q=typeof Z.status==="number"?Z.status:void 0,X=typeof Z.statusText==="string"?Z.statusText:void 0;return Q!=null\|\|X?{status:Q,statusText:X}:void 0}function D$($){if($ instanceof Response)return $;let Z=J1($);if(!Z)return Response.json({error:"internal_error"},{status:500});let X={status:Z.status??500};if(Z.statusText)X.statusText=Z.statusText;return Response.json({error:Z.statusText??"internal_error"},X)}function H0(){return Response.json({error:"not_found"},{status:404})}function V$($=["GET"]){return Response.json({error:"method_not_allowed",allow:$},{status:405,headers:{Allow:$.join(", ")}})}import{context as G1,trace as K1}from"@opentelemetry/api";import{logs as z1,SeverityNumber as U$}from"@opentelemetry/api-logs";import{OTLPLogExporter as _1}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as H1}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as B1}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as D1}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as V1}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as U1}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as F1}from"@opentelemetry/resources";import{BatchLogRecordProcessor as M1}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as L1}from"@opentelemetry/sdk-metrics";import{NodeSDK as W1}from"@opentelemetry/sdk-node";function C9($,Z,Q){for(let X of $)try{X()}catch(Y){Z.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:Q,error:Y instanceof Error?Y.message:String(Y)})}}function i0($,Z){let Q=new Set,X=new Set;return{beforeChange(Y){return Q.add(Y),()=>{Q.delete(Y)}},afterChange(Y){return X.add(Y),()=>{X.delete(Y)}},emitBefore(){C9(Q,$,`${Z} beforeChange`)},emitAfter(){C9(X,$,`${Z} afterChange`)}}}var k9={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},O1={trace:!1,debug:!1,info:!0,warn:!0,error:!0};function N4($,Z){let Q=Z[$];if(Q===!1)return!1;if($==="metrics")return Q===!0\|\|typeof Q==="object";return!0}function A4($){return typeof $==="object"&&$!==null?$:void 0}function N1($){return typeof $==="object"&&$!==null?$:void 0}function A1($,Z){let Q=$.replace(/\/+$/,"");if(Q.endsWith(k9[Z]))return Q;return`${Q}${k9[Z]}`}function j1($,Z){let Q=A4($[Z]);if(Q?.endpoint)return Q.endpoint;if(!$.endpoint)return;return A1($.endpoint,Z)}function E1($,Z,Q){let X=A4($[Z]),Y={...$.headers,...X?.headers??{}};if(Q)Y.Authorization=`Bearer ${Q}`;return Y}function j4($,Z,Q){let X=A4($[Z]);return{url:j1($,Z),headers:E1($,Z,Q),timeoutMillis:X?.timeoutMillis,concurrencyLimit:X?.concurrencyLimit}}function T1($,Z){let Q=j4($,"traces",Z);return $.protocol==="http/json"?new V1(Q):new U1(Q)}function q1($,Z){let Q=j4($,"metrics",Z);return $.protocol==="http/json"?new B1(Q):new D1(Q)}function R1($,Z){let Q=j4($,"logs",Z);return $.protocol==="http/json"?new _1(Q):new H1(Q)}function P1($){return{"service.name":$.name,...$.version?{"service.version":$.version}:{},...$.deploymentEnvironment?{"deployment.environment.name":$.deploymentEnvironment}:{},...$.resourceAttributes??{}}}async function I1($){if(!$.oauth)return;let Z=new URLSearchParams({grant_type:"client_credentials",client_id:$.oauth.clientId,client_secret:$.oauth.clientSecret});if($.oauth.scope)Z.set("scope",$.oauth.scope);if($.oauth.audience)Z.set("audience",$.oauth.audience);let Q=await fetch($.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...$.oauth.headers??{}},body:Z});if(!Q.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${Q.status}`);let X=await Q.json();if(typeof X.access_token!=="string"\|\|!X.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return X.access_token}function x1($,Z){return{...O1,...Z?.levels??{},...$.levels??{}}}function q$($,Z="Authorization"){let Q={...$.headers??{}};if(!$.apiKey)return Q;let X=$.apiKeyHeader??Z;return Q[X]=X.toLowerCase()==="authorization"?`Bearer ${$.apiKey}`:$.apiKey,Q}function S1($,Z){return Object.keys($).some((Q)=>Q.toLowerCase()===Z.toLowerCase())}function y9($,Z,Q){let X=Object.keys($).find((Y)=>Y.toLowerCase().startsWith(Z.toLowerCase()));if(X)throw Error(`OpenTelemetry provider "${Q}" does not support provider-specific header "${X}".`)}function R$($,Z,Q,X){return{type:Q,name:$.name,version:$.version,protocol:$.protocol??"http/protobuf",endpoint:$.endpoint,headers:X,resourceAttributes:P1($),levels:x1($,Z),traces:$.traces,metrics:$.metrics,logs:$.logs}}function w1($,Z){return R$($,Z,"otlp",q$($))}function C1($,Z){return R$($,Z,"grafana-lgtm",q$($))}function k1($,Z){let Q=q$($,"DD-API-KEY");if(!S1(Q,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return R$($,Z,"datadog",Q)}function b1($,Z){let Q=q$($);return y9(Q,"DD-","splunk"),R$($,Z,"splunk",Q)}function y1($,Z){let Q=q$($);return y9(Q,"DD-","elastic"),R$($,Z,"elastic",Q)}function v1($,Z){let Q=$.type??"otlp";switch(Q){case"otlp":return w1($,Z);case"grafana-lgtm":return C1($,Z);case"datadog":return k1($,Z);case"splunk":return b1($,Z);case"elastic":return y1($,Z);default:throw Error(`Unsupported OpenTelemetry provider type: ${Q}`)}}function h1($,Z){if(typeof $==="string")return $;if($ instanceof Error)return $.message;if($!=null)return T$($);if(Z.length===0)return"";return T$(Z[0])}function T$($){if(typeof $==="string")return $;try{return JSON.stringify($)}catch{return String($)}}function b9($,Z,Q){if(Q==null)return;if(typeof Q==="string"\|\|typeof Q==="number"\|\|typeof Q==="boolean"){$[Z]=Q;return}if(Array.isArray(Q)&&Q.every((X)=>["string","number","boolean"].includes(typeof X))){$[Z]=Q;return}if(Q instanceof Error){if($[`${Z}.name`]=Q.name,$[`${Z}.message`]=Q.message,Q.stack)$[`${Z}.stack`]=Q.stack;return}$[Z]=T$(Q)}function f1($){let Z={};for(let[X,Y]of $.entries()){if(Y&&typeof Y==="object"&&!Array.isArray(Y)&&!(Y instanceof Error)&&Object.getPrototypeOf(Y)===Object.prototype){for(let[J,_]of Object.entries(Y))b9(Z,J,_);continue}b9(Z,`param.${X}`,Y)}let Q=K1.getSpanContext(G1.active());if(Q)Z.trace_id=Q.traceId,Z.span_id=Q.spanId,Z.trace_flags=Q.traceFlags;return Z}function m1($){return $}function p1($){let Z=typeof $.body==="string"?$.body:T$($.body),Q=$.attributes??{};if(Object.keys(Q).length===0)return Z;return`${Z} ${T$(Q)}`}function v9($,Z){globalThis.console[m1($)](p1(Z))}function g1($,Z){if((Z.severityNumber??0)<U$.INFO)return;v9($,Z)}function d1($,Z,Q){let X=Q?.console;if(X===!1)return;if(typeof X==="function"){X(Z);return}if(X===!0){v9($,Z);return}g1($,Z)}function u1($,Z){let Q=z1.getLogger($.name,$.version),X=(Y,J,_)=>{if(!$.levels[Y])return;let z={severityNumber:J,severityText:Y.toUpperCase(),body:h1(_[0],_.slice(1)),attributes:f1(_.slice(1))};try{Q.emit(z)}finally{d1(Y,z,Z)}};return{trace:(Y,...J)=>X("trace",U$.TRACE,[Y,...J]),debug:(Y,...J)=>X("debug",U$.DEBUG,[Y,...J]),info:(Y,...J)=>X("info",U$.INFO,[Y,...J]),warn:(Y,...J)=>X("warn",U$.WARN,[Y,...J]),error:(Y,...J)=>X("error",U$.ERROR,[Y,...J])}}function l1($){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:$,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function h9($,Z,Q){if(!Z&&!Q)return;if(!Z)return l1($);let X=Z,Y=v1(X,Q),J,_=!1,z=u1(Y,Q),G,K,H=new Promise((F,j)=>{G=F,K=j});async function V(){try{let F=await I1(X),j={resource:F1(Y.resourceAttributes),instrumentations:Q?.instrument};if(Q?.sampler)j.sampler=Q.sampler;if(Q?.textMapPropagator)j.textMapPropagator=Q.textMapPropagator;if(Q?.contextManager)j.contextManager=Q.contextManager;if(Q?.spanProcessors)j.spanProcessors=Q.spanProcessors;else if(N4("traces",Y))j.traceExporter=T1(Y,F);if(Q?.metricReaders)j.metricReaders=Q.metricReaders;else if(N4("metrics",Y)){let D=N1(Y.metrics);j.metricReaders=[new L1({exporter:q1(Y,F),exportIntervalMillis:D?.exportIntervalMillis,exportTimeoutMillis:D?.exportTimeoutMillis})]}if(Q?.logRecordProcessors)j.logRecordProcessors=Q.logRecordProcessors;else if(N4("logs",Y))j.logRecordProcessors=[new M1({exporter:R1(Y,F)})];let B=Q?.configure?.(j);J=new W1(B??j),J.start(),_=!0,G?.()}catch(F){_=!1;let j=F instanceof Error?F:Error(String(F));$.error?.("OpenTelemetry startup failed",j),K?.(j)}finally{G=void 0,K=void 0}}return{state:"available",start:V,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>_,ready:(F)=>{if(!F\|\|F<=0)return H;return Promise.race([H,new Promise((j,B)=>{setTimeout(()=>B(Error(`OpenTelemetry ready timed out after ${F}ms.`)),F)})])},logger:z,forceFlush:async()=>{await J?.forceFlush?.()},shutdown:async()=>{_=!1,await J?.shutdown(),J=void 0}}}function f9($){let Z,Q,X=0,Y=Promise.resolve(),J=i0($,"OpenTelemetry"),_=q0("OpenTelemetry module",()=>Z?.isReady()===!0),z={beforeChange:J.beforeChange,afterChange:J.afterChange,isReady:_.isReady,ready:_.ready,logger:{trace:(K,...H)=>(Z?.logger??$).trace(K,...H),debug:(K,...H)=>(Z?.logger??$).debug(K,...H),info:(K,...H)=>(Z?.logger??$).info(K,...H),warn:(K,...H)=>(Z?.logger??$).warn(K,...H),error:(K,...H)=>(Z?.logger??$).error(K,...H)},forceFlush:async()=>{await Z?.forceFlush()},shutdown:async()=>{await Z?.shutdown()}},G=!1;return{update(K){if(!K){if(Z\|\|Q){let j=Z,B=Q;X+=1,J.emitBefore(),Z=void 0,Q=void 0,_.refresh(),Y=Promise.all([j?.shutdown(),B?.shutdown()]).finally(()=>J.emitAfter()).then(()=>{return},()=>{return})}return G?z:void 0}if(G=!0,K===Z\|\|K===Q)return z;let H=Z,V=Q;X+=1;let F=X;return J.emitBefore(),Z=void 0,Q=K,_.refresh(),Y=(async()=>{try{if(await Promise.all([H?.shutdown(),V?.shutdown()]),await K.start(),F!==X\|\|Q!==K){await K.shutdown();return}Z=K,Q=void 0,_.refresh()}finally{if(F===X)J.emitAfter()}})().then(()=>{return},()=>{return}),z},settled(){return Y},async shutdown(){X+=1;let K=Z,H=Q;Z=void 0,Q=void 0,_.settle(),await Promise.all([K?.shutdown(),H?.shutdown()])}}}import{ION_ENDPOINT_PERMISSIONS as E4,trimTrailingSlash as m9}from"@ionite/core";import{hasPermission as c1}from"@ionite/core/server";async function e0($,Z,Q){let X=await c1($,Z,Q.permission,void 0,Q.subjectType);return X.allow?void 0:X.response()}function i1($){let Z=m9($);return{matchesPath:(Y)=>{if(!Y)return!1;return m9(Y)===Z},startsWithPath:(Y)=>{if(!Y)return!1;return $===Y\|\|$.startsWith(`${Y}/`)}}}function p9($,Z,Q,X){let Y=X??new URL($.url).pathname,{matchesPath:J,startsWithPath:_}=i1(Y);if(Z.sso){let z=Z.sso;if(J(Q.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(G)=>z.handler(G)};if(J(Q.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(G)=>z.logout(G)};if(J(Q.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(G)=>z.logoutBackChannel(G)};if(J(Q.sso.loginUrl)\|\|J(Q.sso.refreshUrl)\|\|J(Q.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(G)=>z.handler(G)}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(G)=>{let K=await z.resolveCustomer(G);if(K.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(K.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(K.value),{headers:{"Content-Type":"application/json"}})}};if(J(Q.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(G)=>z.logout(G)}}if(Z.iam){let z=Z.iam,G=$.method!=="GET"&&$.method!=="HEAD";if(_(Q.iam.usersUrl))return{module:"iam",kind:G?"iam.users.write":"iam.read",requiredPermission:E4[G?"iam.users.write":"iam.read"],handler:async(K)=>z.handler(K)};if(_(Q.iam.groupsUrl))return{module:"iam",kind:G?"iam.groups.write":"iam.read",requiredPermission:E4[G?"iam.groups.write":"iam.read"],handler:async(K)=>z.handler(K)};if(_(Q.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(K)=>z.handler(K)}}if(Z.workload){let z=Z.workload;if(J(Q.workload.validateUrl)\|\|J(Q.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(G)=>z.handler(G)}}if(Z.secrets){let z=Z.secrets;if(z.isLfvDeliveryRequest?.($)&&z.handleLfvDelivery){let G=z.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(K)=>G(K)}}if(z.isLfvEventsRequest?.($)&&z.handleLfvEvents){let G=z.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(K)=>G(K)}}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.magicLinkUrl)&&$.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:E4["ciam.magic-link.create"],handler:async(G)=>z.handler(G)};if(J(Q.ciam.magicLinkLoginUrl)&&$.method==="GET"\|\|J(Q.ciam.customerProvidersUrl)&&$.method==="GET"\|\|J(Q.ciam.customerLoginUrl)&&$.method==="GET"\|\|J(Q.ciam.customerCallbackUrl)&&($.method==="GET"\|\|$.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(G)=>z.handler(G)}}return}async function T4($,Z,Q,X){let Y=X??v0(y$()),J=new URL($.url).pathname;if(Q?.filter){let V=await Q.filter($,Z);if(V instanceof Response)return V;if(V==="not_handled")return H0()}let _=p9($,Z,Y,J),G=await Q?.resolve?.($,Z,_)??_;if(!G)return H0();let K=G.requiredPermission===void 0?_?.requiredPermission:G.requiredPermission,H=async()=>{if(K){let V=await e0($,Z,K);if(V)return V}return G.handler($)};if(Q?.wrap)return await Q.wrap($,G,H,Z);return await H()}import{stableConfigHash as D2}from"@ionite/core";function n$(){let $=0;return{next:()=>{return $+=1,$},isCurrent:(Z)=>Z===$,current:()=>$}}import{readFile as K2,stat as z2}from"node:fs/promises";class F$ extends Error{code;status;constructor($,Z,Q){super($);this.code=Z;this.status=Q;this.name="VaultWebSocketCommandError"}sourceType="vault"}class m0 extends Error{path;constructor($,Z=`Vault secret not found at path ${$}`){super(Z);this.path=$;this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}code;status;sourceType="vault"}class U0 extends Error{path;status;code;constructor($,Z,Q,X,Y){super($,Y);this.path=Z;this.status=Q;this.code=X;this.name="VaultRequestError"}sourceType="vault"}class P0 extends Error{sourceType;path;constructor($,Z,Q=`Vault subscribe is not supported for source ${$} at path ${Z} without websocket, LFV, or ttl`){super(Q);this.sourceType=$;this.path=Z;this.name="VaultSubscribeNotSupportedError"}}function g9($){return $ instanceof m0\|\|$ instanceof F$&&($.code==="not_found"\|\|$.status===404)}import{WebSocket as q4}from"ws";var n1=1000,s1=30000,u9=30000,l9=u9;function c9($){l9=$>0?$:u9}function a1($){let Z=Math.min(s1,n12Math.min($,16)),Q=0.5+Math.random()0.5;return Math.round(ZQ)}var $$=new Map;function t1($){return $.trim().replace(/\/+$/g,"")}function i9($,Z){let Q=typeof Z?.version==="number"?Z.version:0,X=Z?.created_time??Z?.created,Y=typeof X==="string"?new Date(X):new Date;return{path:$,version:Q,created:Y}}function r1($){return typeof $?.version==="number"?$.version:void 0}function o1($){let Z=$.token?.trim();if(!Z)return{};if($.header==="Authorization")return{Authorization:Z.startsWith("Bearer ")?Z:`Bearer ${Z}`};return{"X-Vault-Token":Z}}function n9($){return{client_id:$.clientId,token:$.token,header:$.header??"X-Vault-Token"}}function s9($,Z){let Q=t1($),X=$$.get(Q);if(X){if(Z&&!X.log)X.log=Z;return X}let Y={url:Q,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,hasConnected:!1,disposed:!1,log:Z};return $$.set(Q,Y),Y}function e1($){let Z=Array.from($.subs.values(),(Y)=>Y.creds);if(Z.length===0)return $.lastGoodCreds??{url:$.url};let Q=$.lastGoodCreds?[$.lastGoodCreds,...Z]:Z,X=Q[$.reconnectCredCursor%Q.length]??Z[0];return $.reconnectCredCursor+=1,X}function d9($,Z){for(let Q of $.subs.values())try{Q.onHealth?.(Z)}catch(X){$.log?.warn("Vault websocket health hook threw",X)}}function $2($,Z){for(let Q of Array.from($.subs.values())){let X=Q.onFirstSecretReject;if(Q.onFirstSecret=void 0,Q.onFirstSecretReject=void 0,X)try{X(new U0(`Vault websocket subscription interrupted (${Z})`,Q.path,void 0,"connection"))}catch(Y){$.log?.warn("Vault websocket first-secret waiter rejection threw",Y)}}}function a9($,Z){for(let Q of $.pending.values())clearTimeout(Q.timer),Q.reject(new U0(`Vault websocket command interrupted (${Z})`,"/",void 0,"connection"));$.pending.clear()}function s$($){if($.disposed)return;if($.disposed=!0,$.reconnectTimer)clearTimeout($.reconnectTimer),$.reconnectTimer=void 0;a9($,"closed"),$2($,"socket disposed");let Z=$.ws;if($.ws=void 0,$.connectPromise=void 0,$.hasConnected=!1,$$.delete($.url),Z)try{Z.removeAllListeners(),Z.close()}catch{}}function R4($){if($.subs.size>0\|\|$.pending.size>0)return;s$($)}function t9($,Z,Q,X){if(X!==void 0&&Z.lastVersion!==void 0&&X===Z.lastVersion)return;if(X!==void 0)Z.lastVersion=X;try{Z.onChange(Q)}catch(J){$.log?.warn("Vault websocket subscription onChange threw",J)}let Y=Z.onFirstSecret;if(Z.onFirstSecret=void 0,Z.onFirstSecretReject=void 0,Y)try{Y()}catch(J){$.log?.warn("Vault websocket subscription onFirstSecret threw",J)}}function Z2($,Z){let Q=Z.subscription_id;if(typeof Q!=="string")return;let X=$.subs.get(Q);if(!X)return;let Y={data:Z.data,metadata:i9(typeof Z.path==="string"?Z.path:X.path,Z.metadata)};t9($,X,Y,r1(Z.metadata))}function Q2($,Z){let Q;try{Q=JSON.parse(Z.toString())}catch(X){$.log?.warn("Vault websocket message parse failed",X);return}if(Q.type==="secret"){Z2($,Q);return}if(Q.type==="command_result"&&typeof Q.id==="string"){let X=$.pending.get(Q.id);if(!X)return;if($.pending.delete(Q.id),clearTimeout(X.timer),Q.ok===!1)X.reject(new F$(Q.error??`Vault websocket command failed for ${Q.id}`,Q.code,Q.status));else X.resolve(Q.result);R4($)}}function r9($,Z){$.send(JSON.stringify({type:"subscribe",subscription_id:Z.subscriptionId,paths:[Z.path],...n9(Z.creds)}))}function o9($){if($.disposed\|\|$.reconnectTimer\|\|$.subs.size===0)return;let Z=a1($.reconnectAttempts);$.reconnectAttempts+=1,$.reconnectTimer=setTimeout(()=>{if($.reconnectTimer=void 0,$.disposed)return;if($.subs.size===0){s$($);return}P4($,e1($)).catch(()=>{if($.hasConnected)$.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${Z}ms).`);o9($)})},Z)}function P4($,Z){if($.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if($.ws&&$.ws.readyState===q4.OPEN)return Promise.resolve($.ws);if($.connectPromise)return $.connectPromise;return $.connectPromise=new Promise((Q,X)=>{let Y=new q4($.url,{headers:o1(Z)}),J=!1,_=$.hasConnected,z=()=>{J=!0,$.hasConnected=!0,$.reconnectAttempts=0,$.reconnectCredCursor=0,$.lastGoodCreds=Z,$.ws=Y,$.connectPromise=void 0,Y.on("message",(H)=>Q2($,H));for(let H of $.subs.values())try{r9(Y,H)}catch{}if(_)d9($,!0);Q(Y)},G=()=>{if($.ws===Y)$.ws=void 0;$.connectPromise=void 0;try{Y.removeAllListeners()}catch{}if(a9($,"socket closed"),$.subs.size>0)d9($,!1),o9($);else s$($)},K=(H)=>{if($.ws===Y)$.ws=void 0;if(!J)J=!0,$.connectPromise=void 0,X(H)};Y.once("open",z),Y.on("close",G),Y.on("error",K)}),$.connectPromise}async function I4($,Z,Q,X){let Y=s9($.url,X),J=typeof Q.path==="string"?Q.path:"/",_=await P4(Y,$),z=crypto.randomUUID();try{return await new Promise((G,K)=>{let H=setTimeout(()=>{if(!Y.pending.has(z))return;Y.pending.delete(z),K(new U0(`Vault websocket command "${Z}" timed out`,J,void 0,"timeout"));try{Y.ws?.close()}catch{}},l9);Y.pending.set(z,{resolve:(V)=>G(V),reject:K,timer:H});try{_.send(JSON.stringify({type:"command",id:z,command:Z,...Q,...n9($)}))}catch(V){clearTimeout(H),Y.pending.delete(z),K(V)}})}finally{R4(Y)}}async function x4($,Z,Q){let X;try{X=await I4($,"read_secret",{path:Z},Q)}catch(Y){if(g9(Y))throw new m0(Z);if(Y instanceof F$\|\|Y instanceof U0)throw Y;throw new U0(`Vault websocket read_secret failed for ${Z}`,Z,void 0,"connection",{cause:Y})}if(!X\|\|typeof X!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${Z}`);return{data:X.data,metadata:i9(typeof X.path==="string"?X.path:Z,X.metadata)}}async function e9($,Z,Q,X,Y,J){let _=s9($.url,Y),z=crypto.randomUUID(),G={subscriptionId:z,creds:$,path:Z,onChange:Q,onHealth:J?.onHealth};_.subs.set(z,G);let K=()=>{if(!_.subs.delete(z))return;if(_.ws&&_.ws.readyState===q4.OPEN)try{_.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:z}))}catch{}R4(_)};try{let H=await P4(_,$);r9(H,G)}catch(H){if(X?.mode!=="wait")throw K(),H}try{let H=await x4($,Z,Y);t9(_,G,H,H.metadata.version)}catch(H){if(X?.mode!=="wait")throw K(),H;await new Promise((V,F)=>{let j,B=(D)=>{if(j)clearTimeout(j);G.onFirstSecret=void 0,G.onFirstSecretReject=void 0,K(),F(D)};if(G.onFirstSecret=()=>{if(j)clearTimeout(j);V()},G.onFirstSecretReject=B,typeof X.timeout==="number"&&X.timeout>0)j=setTimeout(()=>B(H),X.timeout)})}return K}function $8(){let $=0;for(let Z of $$.values())$+=Z.subs.size;return{urls:Array.from($$.keys()),sockets:$$.size,subscriptions:$}}function Z8(){for(let $ of Array.from($$.values()))s$($)}var a$=600000;function Z$($){if($&&$<a$)throw Error(`OpenBao/Hashicorp compatible vaults require ttl to be set and greater than ${a$} milliseconds (10 minutes), as not to overload the vault with polling requests`)}function p0($,Z,Q,X,Y,J,_){let z=!1,G,K,H,V=(M)=>{try{_?.onHealth?.(M)}catch{}},F=()=>{if(z=!0,G)clearTimeout(G),G=void 0;K?.()},j=(M)=>new Promise((W)=>{let q=setTimeout(()=>{K=void 0,G=void 0,W()},M);G=q,K=()=>{clearTimeout(q),K=void 0,G=void 0,W()}});async function B(){let M=Date.now();for(;;){if(z)return;try{let W=await $.getFullSecret(Z,J);return V(!0),W}catch(W){if(V(!1),J?.mode!=="wait")throw W;if(typeof J.timeout==="number"&&J.timeout>0&&Date.now()-M>=J.timeout)throw W;if(z)return;Y?.warn(`Error retrieving initial secret from vault. Retrying in ${X} milliseconds`,W),await j(X)}}}async function D(){if(G=void 0,z)return;try{let M=await $.getFullSecret(Z);if(V(!0),M.metadata.version!==H)H=M.metadata.version,Q(M)}catch(M){V(!1),Y?.warn(`Error retrieving remote config from vault. Retrying in ${X} milliseconds`,M)}x()}function x(){if(z)return;G=setTimeout(()=>{D()},X)}return B().then((M)=>{if(z\|\|!M)return()=>F();return H=M.metadata.version,Q(M),x(),()=>F()})}function X2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Y2($){let Z={"Content-Type":"application/json"};if($)Z["X-Vault-Token"]=$;return Z}function J2($){return Boolean($?.idpTokenUrl?.trim()&&$.clientId?.trim()&&$.clientSecret?.trim())}async function Q8($,Z){let Q=Date.now();if(Z.token&&Z.expiresAt&&Z.expiresAt-60000>Q)return Z.token;let X=new URLSearchParams({grant_type:"client_credentials",client_id:$.clientId,client_secret:$.clientSecret});if($.scope?.trim())X.set("scope",$.scope.trim());let Y=await fetch($.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:X.toString()});if(!Y.ok)throw Error(`Vault workload token request failed (${Y.status})`);let J=await Y.json();if(!J.access_token)throw Error("Vault workload token response did not include access_token");return Z.token=J.access_token,Z.expiresAt=Q+Math.max(1,J.expires_in??300)1000,J.access_token}function G2($){return{Authorization:$.startsWith("Bearer ")?$:`Bearer ${$}`}}function X8($){return $.replace(/\/data\/?$/,"")}function M$($){let{type:Z="vault",url:Q,token:X,ttl:Y}=$,J=()=>$.log,_=J2($.workload)?$.workload:void 0,z={},G=Y2(X),K=$.lfv,H=$.websocket,V=K?E$({...K,log:K.log??J(),path:K.path??"/"}):void 0,F=new Map,j=H?.url?.trim(),B=new Set,D=!1,x=!1;if(!K&&!Q&&!j)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(Z$(Y),Q&&!X&&!_&&!K)J()?.warn("OpenBao/Hashicorp compatible vaults usually require a token, but one was not provided. Vault requests may fail.");async function M(){if(_){let L=await Q8(_,z);return{"Content-Type":"application/json",...G2(L)}}return{...G}}async function W(L){let b=m(L);if(_){let g=await Q8(_,z);return{url:b,clientId:H?.clientId??_.clientId,token:g,header:"Authorization"}}return{url:b,clientId:H?.clientId,token:H?.token??X,header:H?.header??"X-Vault-Token"}}function q(L){if(!K)throw Error(`Vault LFV capability is not configured for path ${L}`);let b=F.get(L);if(b)return b;let g=E$({...K,log:K.log??J(),path:L});return F.set(L,g),g}function T(L){if(!Q)throw Error(`Vault HTTP capability is not configured for path ${L}`);return Q}function m(L){if(!j)throw Error(`Vault websocket capability is not configured for path ${L}`);return j}async function C(L,b){let g=await W(typeof b.path==="string"?b.path:"/");return I4(g,L,b,J())}async function c(L,b){let g=T(L),a;try{let t=await M();a=await fetch(`${g}/${L}`,{headers:t})}catch(t){throw new U0(`Vault request failed from URL: ${g}/${L}`,L,void 0,"connection",{cause:t})}if(a.status!==200){if(a.status===404)throw new m0(L);let t=a.status===401\|\|a.status===403,J0=t?`Vault returned ${a.status} ${a.statusText} (auth error) from URL: ${g}/${L}`:`Vault returned invalid status, ${a.status}: '${a.statusText}' from URL: ${g}/${L}`;throw new U0(J0,L,a.status,t?"auth":"invalid_status")}try{return(await a.json()).data}catch(t){throw new U0("Error retrieving secret",L,void 0,"invalid_payload",{cause:t})}}async function Z0(L){let b=await W(L);return x4(b,L,J())}async function o(L){let b=T(L),g=`${X8(b)}/metadata/${L}`,a=await M(),t=await fetch(g,{headers:a});if(t.status!==200)throw new U0(`Vault getMetadata failed (${t.status}) for ${L}`,L,t.status,"invalid_status");let J0=await t.json().catch(()=>null);if(!J0?.metadata\|\|typeof J0.metadata!=="object")throw new U0(`Vault getMetadata returned invalid payload for ${L}`,L,t.status,"invalid_payload");return J0.metadata}async function E(L,b,g){let a=T(b),t=`${X8(a)}/${L}/${b}`,J0=await M(),V0=await fetch(t,{method:"POST",headers:J0,body:JSON.stringify({reason:g?.reason,severity:g?.severity,incident_ref:g?.incidentRef})});if(V0.status!==200&&V0.status!==202&&V0.status!==204)throw new U0(`Vault ${L} failed (${V0.status}) for ${b}`,b,V0.status,"invalid_status")}async function N(L,b){if(K)return await q(L).getFullSecret(L,b);if(Q)return await c(L,b);return await Z0(L)}async function P(L,b,g){if(!X2(b))throw Error(`putSecret requires an object value for vault source at path ${L}`);if(K){await q(L).putSecret(L,b,g);return}if(Q){let a=T(L),t=await M(),J0=await fetch(`${a}/${L}`,{method:"POST",headers:t,body:JSON.stringify(b)});if(J0.status!==200&&J0.status!==201&&J0.status!==204)throw new U0(`Vault putSecret failed (${J0.status}) for ${L}`,L,J0.status,"invalid_status");return}await C("put_secret",{path:L,data:b})}async function y(L,b){if(K){await q(L).deleteSecret(L,b);return}if(Q){let g=T(L),a=await M(),t=await fetch(`${g}/${L}`,{method:"DELETE",headers:a});if(t.status!==200&&t.status!==202&&t.status!==204)throw new U0(`Vault deleteSecret failed (${t.status}) for ${L}`,L,t.status,"invalid_status");return}await C("delete_secret",{path:L})}async function S(L,b){if(K)return await q(L).listPaths(L,b);if(Q){let t=`${T(L)}/${L}`,J0=async(w)=>{let I=await M();if(w==="LIST")return fetch(t,{method:"LIST",headers:I});let k=t.includes("?")?"&":"?";return fetch(`${t}${k}list=true`,{method:"GET",headers:I})},V0=await J0("LIST");if(V0.status===405\|\|V0.status===501)V0=await J0("GET");if(V0.status!==200)throw new U0(`Vault listPaths failed (${V0.status}) for ${L}`,L,V0.status,"invalid_status");let A=await V0.json().catch(()=>null),O;if(A&&typeof A==="object"){let w=A,I=w.data;if(I&&typeof I==="object")O=I.keys;else O=w.keys}if(!Array.isArray(O))throw new U0(`Vault listPaths returned an unexpected response for ${L}`,L,void 0,"invalid_payload");return O.filter((w)=>typeof w==="string")}let g=await C("list_paths",{path:L});if(!Array.isArray(g.items))throw Error(`Vault websocket list_paths returned invalid payload for ${L}`);return g.items.filter((a)=>typeof a==="string")}async function d(L,b){if(K)return await q(L).exists(L,b);if(Q){let a=T(L),t=await M(),J0=await fetch(`${a}/${L}`,{headers:t});if(J0.status===200)return!0;if(J0.status===404)return!1;if(J0.status===401\|\|J0.status===403)throw new U0(`Vault exists failed (${J0.status}) for ${L} (auth error)`,L,J0.status,"auth");throw new U0(`Vault exists failed (${J0.status}) for ${L}`,L,J0.status,"invalid_status")}let g=await C("exists",{path:L});if(typeof g.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${L}`);return g.exists}async function i(L,b,g){if(K){await q(L).requestRotate(L,b,g);return}if(Q){await E("rotate/request",L,b);return}await C("request_rotate",{path:L,reason:b?.reason,severity:b?.severity,incident_ref:b?.incidentRef})}async function e(L,b,g){if(K){await q(L).requestRevoke(L,b,g);return}if(Q){await E("revoke/request",L,b);return}await C("request_revoke",{path:L,reason:b?.reason,severity:b?.severity,incident_ref:b?.incidentRef})}async function Y0(L,b){if(K)return await q(L).getMetadata(L,b);if(Q)return await o(L);let g=await C("read_metadata",{path:L});if(!g.metadata\|\|typeof g.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${L}`);return g.metadata}async function K0(L,b,g){if(!Y)throw new P0(Z,L);return p0({getFullSecret:c},L,b,Y,J(),g,{onHealth:(a)=>{D=!a}})}async function p(L,b,g){let a=await W(L);return e9(a,L,b,g,J(),{onHealth:(t)=>{x=!t}})}function $0(L){let b=()=>{if(B.delete(b))L()};return B.add(b),b}function _0(){if(V?.isAvailable?.()===!1)return!0;for(let L of F.values())if(L.isAvailable?.()===!1)return!0;return!1}let B0={type:Z,isAvailable:()=>!D&&!x&&!_0(),getFullSecret:N,getSecret:async(L,b)=>{return(await N(L,b)).data},putSecret:P,deleteSecret:y,listPaths:S,exists:d,requestRotate:i,requestRevoke:e,getMetadata:Y0,subscribe:async(L,b,g)=>{let a;if(j)a=await p(L,b,g);else if(K)a=await q(L).subscribe(L,b,g);else a=await K0(L,b,g);return $0(a)},close:()=>{for(let b of Array.from(B))try{b()}catch(g){J()?.warn("Vault source close: failed to release a subscription",g)}B.clear();let L=(b)=>{if(!b?.close)return;try{Promise.resolve(b.close()).catch((g)=>{J()?.warn("Vault source close: LFV close failed",g)})}catch(g){J()?.warn("Vault source close: LFV close failed",g)}};for(let b of F.values())L(b);L(V),F.clear(),z.token=void 0,z.expiresAt=void 0},get log(){return $.log},set log(L){$.log=L}};if(V)B0.isDeliveryRequest=(L)=>V.isDeliveryRequest(L),B0.isEventsRequest=(L)=>V.isEventsRequest(L),B0.handleDelivery=(L)=>V.handleDelivery(L),B0.handleEvents=(L)=>V.handleEvents(L),Object.defineProperties(B0,{deliveryPath:{value:V.deliveryPath,enumerable:!0},eventsPath:{value:V.eventsPath,enumerable:!0},callbackKey:{value:V.callbackKey,enumerable:!0},trustId:{value:V.trustId,enumerable:!0}});return B0}class r$ extends Error{status;constructor($,Z){super($);this.name="AzureKeyVaultError",this.status=Z,Object.setPrototypeOf(this,r$.prototype)}}function t$($,Z){if(!$\|\|$.trim().length===0)throw Error(`Missing required Azure config: ${Z}`);return $}function _2($){return $.replace(/^\/+\|\/+$/g,"").replaceAll("/","-")}function S4($,Z){return`${$.replace(/\/+$/g,"")}/${Z.replace(/^\/+/g,"")}`}function H2($){try{let Q=new URL($).pathname.split("/").filter(Boolean),X=Q.indexOf("secrets");if(X===-1)return;return Q[X+2]\|\|void 0}catch{return}}function B2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function o$($){let Z=$.apiVersion??"7.4",Q=$.scope??"https://vault.azure.net/.default",X=$.secretNameTransform??_2,Y=$.authMethod,J="/var/run/secrets/azure/tokens/azure-identity-token",_=$.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",z=$.vaultUrl??($.vaultName?`https://${$.vaultName}.vault.azure.net`:void 0)??void 0,G=t$(z,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function K(E){try{return await z2(E),!0}catch{return!1}}let H,V,F=!1;async function j(E){let{entraTenantId:N,clientId:P}=$;if(!N)throw Error("Workload identity requires entraTenantId");if(!P)throw Error("Workload identity requires clientId");if(!await K(_))throw Error(`Federated token file not found at ${_}`);let y=(await K2(_,"utf8")).trim();if(!y)throw Error("Federated token file was empty");let S=`https://login.microsoftonline.com/${encodeURIComponent(N)}/oauth2/v2.0/token`,d=new URLSearchParams({client_id:P,grant_type:"client_credentials",scope:Q,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:y}),i=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:d});if(i.status!==200)throw Error(`Azure workload identity token exchange returned ${i.status} ${i.statusText}`);let e=await i.json();if(!e?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:e.access_token,expiresAtMs:E+(e.expires_in??0)1000},e.access_token}async function B(E){let N=$.imdsApiVersion??"2018-02-01",P="https://vault.azure.net",y=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(y.searchParams.set("api-version",N),y.searchParams.set("resource","https://vault.azure.net"),$.managedIdentityClientId)y.searchParams.set("client_id",$.managedIdentityClientId);let S=await fetch(y.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(S.status!==200)throw Error(`Azure IMDS token endpoint returned ${S.status} ${S.statusText}`);let d=await S.json();if(!d?.access_token)throw Error("IMDS token response missing access_token");let i=E+60000;if(d.expires_on){let e=Number.parseInt(d.expires_on,10);if(Number.isFinite(e)&&e>0)i=e1000;else{let Y0=Date.parse(d.expires_on);if(Number.isFinite(Y0))i=Y0}}else if(d.expires_in){let e=Number.parseInt(d.expires_in,10);if(Number.isFinite(e)&&e>0)i=E+e1000}return H={accessToken:d.access_token,expiresAtMs:i},d.access_token}async function D(E){let N=t$($.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),P=t$($.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),y=t$($.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),S=`https://login.microsoftonline.com/${encodeURIComponent(N)}/oauth2/v2.0/token`,d=new URLSearchParams({client_id:P,client_secret:y,grant_type:"client_credentials",scope:Q}),i=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:d});if(i.status!==200)throw Error(`Azure token endpoint returned ${i.status} ${i.statusText}`);let e=await i.json();if(!e?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:e.access_token,expiresAtMs:E+(e.expires_in??0)1000},e.access_token}async function x(){let E=Date.now();if(H&&H.expiresAtMs-60000>E)return H.accessToken;if(V)return V;V=(async()=>{if(Y==="workload_identity")return await j(E);if(Y==="managed_identity")return await B(E);if(Y==="client_secret")return await D(E);if(await K(_))try{return await j(E)}catch{}try{return await B(E)}catch{}return await D(E)})();try{return await V}finally{V=void 0}}async function M(E){let N=await x(),P=S4(G,`/secrets/${encodeURIComponent(E)}?api-version=${encodeURIComponent(Z)}`),y=await fetch(P,{headers:{Authorization:`Bearer ${N}`,Accept:"application/json"}});if(y.status!==200)throw new r$(`Key Vault request failed (${y.status})`,y.status);return await y.json()}async function W(E,N){let P=X(E),y=$.secretNamePrefix?`${$.secretNamePrefix}${P}`:P,S=await M(y),d=S.value;try{d=JSON.parse(S.value)}catch{}let i=S.attributes?.created?S.attributes.created1000:void 0,e=H2(S.id);return{data:d,metadata:{path:E,version:Number.parseInt(e??"",10)\|\|0,created:i?new Date(i):new Date}}}async function q(E,N,P){if(!B2(N))throw Error(`putSecret requires an object value for azure source at path ${E}`);let y=X(E),S=$.secretNamePrefix?`${$.secretNamePrefix}${y}`:y,d=await x(),i=S4(G,`/secrets/${encodeURIComponent(S)}?api-version=${encodeURIComponent(Z)}`),e=JSON.stringify({value:JSON.stringify(N)}),Y0=await fetch(i,{method:"PUT",headers:{Authorization:`Bearer ${d}`,"Content-Type":"application/json",Accept:"application/json"},body:e});if(Y0.status!==200&&Y0.status!==201)throw Error(`Key Vault putSecret failed (${Y0.status}) for ${E}`)}async function T(E,N){let P=X(E),y=$.secretNamePrefix?`${$.secretNamePrefix}${P}`:P,S=await x(),d=S4(G,`/secrets/${encodeURIComponent(y)}?api-version=${encodeURIComponent(Z)}`),i=await fetch(d,{method:"DELETE",headers:{Authorization:`Bearer ${S}`,Accept:"application/json"}});if(i.status!==200&&i.status!==202&&i.status!==204)throw Error(`Key Vault deleteSecret failed (${i.status}) for ${E}`)}async function m(E,N){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${E}`)}async function C(E,N){try{return await W(E),!0}catch(P){if(P instanceof r$&&P.status===404)return!1;throw P}}async function c(E,N,P){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${E}`)}async function Z0(E,N,P){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${E}`)}async function o(E,N){let P=X(E),y=$.secretNamePrefix?`${$.secretNamePrefix}${P}`:P,S=await M(y);return{id:S.id,...S.attributes??{}}}return{type:$.type,isAvailable:()=>!F,getFullSecret:W,getSecret:async(E,N)=>{return(await W(E,N)).data},putSecret:q,deleteSecret:T,listPaths:m,exists:C,requestRotate:c,requestRevoke:Z0,getMetadata:o,subscribe:(E,N,P)=>{if(!$.ttl)throw new P0("azure",E);return Z$($.ttl),p0({getFullSecret:W},E,N,$.ttl,void 0,P,{onHealth:(y)=>{F=!y}})},close:()=>{H=void 0,V=void 0,F=!1}}}var w4=Symbol("ion.secretsSourceState");function V2($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${X}`)};return{type:"dev",getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[w4]:"unavailable"}}function Y8($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${X}`)};return{type:"dev",getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[w4]:"removed"}}function U2($,Z){if(Z.type==="vault")return M$(Z);if(Z.type==="azure")return o$(Z);if(Z.type==="aws"\|\|Z.type==="gcp"\|\|Z.type==="dev")throw Error(`Secrets source "${$}" uses type "${Z.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${$}"`)}function F2($,Z){let Q=(X)=>{Z.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:X instanceof Error?X.message:String(X)})};try{Promise.resolve($.close?.()).catch(Q)}catch(X){Q(X)}}function M2($){let Z=new Map,Q=new Map,X=new Map;for(let[Y,J]of Object.entries($)){if(!J8(J))continue;let _=Z.get(J.deliveryPath);if(_)throw Error(`LFV delivery path "${J.deliveryPath}" is claimed by both secrets sources "${_}" and "${Y}"; delivery paths must be globally unique.`);Z.set(J.deliveryPath,Y);let z=Q.get(J.eventsPath);if(z)throw Error(`LFV events path "${J.eventsPath}" is claimed by both secrets sources "${z}" and "${Y}"; events paths must be globally unique.`);Q.set(J.eventsPath,Y);let G=X.get(J.callbackKey);if(G&&G.trustId!==J.trustId)throw Error(`LFV callback key "${J.callbackKey}" is claimed by secrets sources "${G.sourceName}" and "${Y}" with different verify JWKS; a callback path must use a single trust key.`);if(!G)X.set(J.callbackKey,{sourceName:Y,trustId:J.trustId})}}function J8($){return typeof $.isDeliveryRequest==="function"&&typeof $.isEventsRequest==="function"&&typeof $.handleDelivery==="function"&&typeof $.handleEvents==="function"}function L2($,Z,Q){let X={...Z},Y=[],J=(z)=>{if(X[z]!==void 0)delete X[z],Y.push(z)};J("token"),J("clientSecret"),J("workload");let _=X.websocket;if(_&&typeof _==="object"&&_.token!==void 0){let z={..._};delete z.token,X.websocket=z,Y.push("websocket.token")}if(Y.length>0)Q.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:$,"ion.droppedFields":Y});return X}function W2($,Z,Q){let X={},Y=new Set([...Object.keys(Z??{}),...Object.keys(Q??{})]);for(let J of Y){let _=Z?.[J],z=Q?.[J],G=z?L2(J,z,$):void 0;X[J]={..._??{},...G??{}}}return X}function e$($){return $[w4]??"available"}function O2($,Z,Q){let X=Z,Y=new Set,J=new Set,_=i0(Q,`Secrets source "${$}"`),z=()=>e$(X)==="available",G=q0(`Secrets source "${$}"`,z),K=(M,W,q)=>{return Error(`${M} timed out after ${q}ms waiting for source "${$}" to be configured by the ConfigSource at path ${W}`)},H=(M,W)=>{return Error(`${M} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${W}`)},V=(M,W,q)=>{let T=e$(X);if(T==="available")return Promise.resolve(X);if(T==="removed")return Promise.reject(H(M,W));return new Promise((m,C)=>{let c={method:M,path:W,resolve:(o)=>{if(c.timeout)clearTimeout(c.timeout);J.delete(c),m(o)},reject:(o)=>{if(c.timeout)clearTimeout(c.timeout);J.delete(c),C(o)}},Z0=q?.timeout;if(typeof Z0==="number"&&Z0>0)c.timeout=setTimeout(()=>{c.reject(K(M,W,Z0))},Z0);J.add(c)})},F=(M)=>{for(let W of Array.from(J))W.resolve(M)},j=()=>{for(let M of Array.from(J))M.reject(H(M.method,M.path))},B=async(M,W=!1)=>{let q=M.guard.next();if(M.unsubscribe?.(),M.unsubscribe=void 0,M.closed)return;if(e$(X)==="unavailable"&&M.options?.mode!=="wait"){if(W)throw Error(`subscribe is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${M.path}`);return}try{let m=await(M.options?.mode==="wait"?await V("subscribe",M.path,M.options):X).subscribe(M.path,(C)=>{if(!M.closed)M.onChange(C)},M.options);if(M.closed\|\|!M.guard.isCurrent(q)){m?.();return}M.unsubscribe=m}catch(T){if(W)throw T;if(d$(T)){Q.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:$,path:M.path});return}Q.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:$,path:M.path,error:T instanceof Error?T.message:String(T)})}},D={get type(){return X.type},beforeChange:_.beforeChange,afterChange:_.afterChange,isAvailable:()=>z()&&(X.isAvailable?.()??!0),isReady:G.isReady,ready:G.ready,getFullSecret:async(M,W)=>{return(await V("getFullSecret",M,W)).getFullSecret(M,W)},getSecret:async(M,W)=>{return(await V("getSecret",M,W)).getSecret(M,W)},putSecret:async(M,W,q)=>{return(await V("putSecret",M,q)).putSecret(M,W,q)},subscribe:async(M,W,q)=>{let T={path:M,onChange:W,options:q,closed:!1,guard:n$()};Y.add(T);try{await B(T,!0)}catch(m){throw Y.delete(T),m}return()=>{T.closed=!0,T.guard.next(),Y.delete(T),T.unsubscribe?.(),T.unsubscribe=void 0}},deleteSecret:async(M,W)=>{return(await V("deleteSecret",M,W)).deleteSecret(M,W)},listPaths:async(M,W)=>{return(await V("listPaths",M,W)).listPaths(M,W)},exists:async(M,W)=>{return(await V("exists",M,W)).exists(M,W)},requestRotate:async(M,W,q)=>{return(await V("requestRotate",M,q)).requestRotate(M,W,q)},requestRevoke:async(M,W,q)=>{return(await V("requestRevoke",M,q)).requestRevoke(M,W,q)},getMetadata:async(M,W)=>{return(await V("getMetadata",M,W)).getMetadata(M,W)}},x=(M)=>{try{Promise.resolve(M.close?.()).catch((W)=>{Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:W instanceof Error?W.message:String(W)})})}catch(W){Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:W instanceof Error?W.message:String(W)})}};return{api:D,update(M){if(M===X)return;let W=X;_.emitBefore(),X=M;let q=e$(M);if(q==="available")F(M);else if(q==="removed")j();G.refresh();for(let T of Y)B(T);x(W),_.emitAfter()},close(){for(let M of Y)M.closed=!0,M.guard.next(),M.unsubscribe?.(),M.unsubscribe=void 0;Y.clear(),j(),G.settle(),x(X)}}}function G8($){let Z=new Map,Q=new Map,X=new Map,Y=i0($,"Secrets"),J=!1,_=()=>{for(let B of Z.keys()){let D=X.get(B);if(D&&D.api.isReady?.()===!1)return!1}return!0},z=q0("Secrets module",()=>J&&_()),G=(B)=>{let D=X.get(B);if(D)return D;let x=O2(B,Z.get(B)??Y8(B),$);if(X.set(B,x),!(B in j))Object.assign(j,{[B]:x.api});return x},K=(B)=>{let D=X.get(B)?.api;if(D)return D;throw $.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:B}),Error(`Secrets source "${B}" is not configured`)},H=()=>{return Array.from(Z.values()).filter(J8)},V=(B)=>{return H().find((D)=>D.isDeliveryRequest(B))},F=(B)=>{return H().find((D)=>D.isEventsRequest(B))},j;return j={get config(){return Object.fromEntries(Array.from(Z.keys(),(B)=>[B,G(B).api]))},beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:z.isReady,isAvailable:()=>{for(let B of X.values()){if(B.api.isReady?.()===!1)continue;if(B.api.isAvailable?.()===!1)return!1}return!0},ready:z.ready,listSecretsSources:()=>Array.from(Z.keys()),getSecretsSource:(B)=>{if(Z.has(B))return G(B).api;return K(B)},getSecret:(B,D,x)=>j.getSecretsSource(B).getSecret(D,x),getFullSecret:(B,D,x)=>j.getSecretsSource(B).getFullSecret(D,x),putSecret:(B,D,x,M)=>j.getSecretsSource(B).putSecret(D,x,M),deleteSecret:(B,D,x)=>j.getSecretsSource(B).deleteSecret(D,x),listPaths:(B,D,x)=>j.getSecretsSource(B).listPaths(D,x),exists:(B,D,x)=>j.getSecretsSource(B).exists(D,x),requestRotate:(B,D,x,M)=>j.getSecretsSource(B).requestRotate(D,x,M),requestRevoke:(B,D,x,M)=>j.getSecretsSource(B).requestRevoke(D,x,M),getMetadata:(B,D,x)=>j.getSecretsSource(B).getMetadata(D,x),subscribe:(B,D,x,M)=>j.getSecretsSource(B).subscribe(D,x,M),isLfvDeliveryRequest:(B)=>V(B)!==void 0,isLfvEventsRequest:(B)=>F(B)!==void 0,handleLfvDelivery:async(B)=>{let D=V(B);if(!D)return H0();return D.handleDelivery(B)},handleLfvEvents:async(B)=>{let D=F(B);if(!D)return H0();return D.handleEvents(B)}},{update(B,D,x){let M=B!==void 0\|\|D!==void 0;if(!M&&!J&&X.size===0)return;let W=W2($,B,D),q=new Map,T=new Map,m=[];try{for(let[C,c]of Object.entries(W)){let Z0=D2(c),o=Z.get(C);if(o&&Q.get(C)===Z0){q.set(C,o),T.set(C,Z0);continue}let E;if(!c.type)E=V2(C);else x?.validateSourceConfig?.(C,c),E=U2(C,c),m.push(E);q.set(C,E),T.set(C,Z0)}M2(Object.fromEntries(q))}catch(C){for(let c of m)F2(c,$);throw C}Y.emitBefore(),J=M;for(let[C,c]of q)Z.set(C,c),Q.set(C,T.get(C)),G(C).update(c);for(let[C,c]of X){if(q.has(C))continue;Z.delete(C),Q.delete(C),c.update(Y8(C))}return z.refresh(),Y.emitAfter(),j},close(){for(let B of X.values())B.close();X.clear(),Z.clear(),Q.clear(),J=!1,z.settle()}}}function C4($,Z){let Q=Z.ttlMs,X=Math.max(1,Math.floor(Z.maxEntries)),Y=new Map,J=()=>Date.now();function _(){while(Y.size>X){let G=Y.keys().next().value;if(G===void 0)break;Y.delete(G)}}function z(G,K){Y.delete(G),Y.set(G,{session:K,expiresAt:J()+Q}),_()}return{async create(G){await $.create(G)},async get(G){let K=Y.get(G);if(K){if(K.expiresAt>J())return Y.delete(G),Y.set(G,K),K.session;Y.delete(G)}let H=await $.get(G);if(H)z(G,H);return H},async update(G,K){await $.update(G,K),Y.delete(G)},async delete(G){await $.delete(G),Y.delete(G)}}}import{ION_ENDPOINT_PERMISSIONS as y2,trimTrailingSlash as X4,validationFailureResponse as v2}from"@ionite/core";import{assertEcid as K8,jwtAssertionClaimsSchema as N2,must as I0,workloadTokenResponseSchema as A2}from"@ionite/core";import{getCachedVerificationKey as j2,getJwks as E2}from"@ionite/core/server";function w0($,Z){return Z in $&&$[Z]!==void 0&&$[Z]!==null}function A0($){if($===void 0\|\|$===null)return!1;return w0($,"workloadId")\|\|w0($,"privateKey")}function y0($){if($===void 0\|\|$===null)return!1;let Z=w0($,"clientId"),Q=w0($,"clientSecret"),X=w0($,"workloadId"),Y=w0($,"privateKey");return(Z\|\|Q)&&!X&&!Y}function k4($){if($===void 0\|\|$===null)return!1;let Z=w0($,"jwksUri"),Q=w0($,"workloadId"),X=w0($,"clientId"),Y=w0($,"clientSecret"),J=w0($,"privateKey");return Z&&!Q&&!J&&!X&&!Y}function z8($){if($===null\|\|typeof $!=="object"\|\|Array.isArray($))return!1;let Z=$;return"clientId"in Z\|\|"jwksUri"in Z\|\|"workloadId"in Z}function T2($){if($===null\|\|typeof $!=="object"\|\|Array.isArray($))return!1;let Z=$;if(z8(Z))return!1;let Q=Object.entries(Z);if(Q.length===0)return!1;return Q.every(([,X])=>z8(X))}function V8($){if($===null\|\|typeof $!=="object"\|\|Array.isArray($))return!1;let Z=$;if("incoming"in Z\|\|"outgoing"in Z){if(Z.incoming!==void 0&&(typeof Z.incoming!=="object"\|\|Z.incoming===null))return!1;if(Z.outgoing!==void 0&&(typeof Z.outgoing!=="object"\|\|Z.outgoing===null\|\|Array.isArray(Z.outgoing)))return!1;return!0}return!1}function U8($){return V8($)}function b4($){if(!$)return;if(U8($))return Array.isArray($.incoming)?void 0:$.incoming;return $}function m4($){if($===void 0\|\|$===null)return[];return Array.isArray($)?$:[$]}function L$($){if(typeof $!=="string")return;return $.endsWith("/")?$.slice(0,-1):$}function _8($){if(!$)return[];if(Array.isArray($))return $.filter((Z)=>!!Z&&typeof Z.issuer==="string"&&typeof Z.jwksUri==="string").map((Z)=>({issuer:Z.issuer,jwksUri:Z.jwksUri,audience:Z.audience,scopesAsEntitlements:Z.scopesAsEntitlements}));if($.issuer&&$.jwksUri)return[{issuer:$.issuer,jwksUri:$.jwksUri,audience:$.audience??[],scopesAsEntitlements:$.scopesAsEntitlements}];return[]}function q2($){let Z=$[0];if(!Z)return;let Q=m4(Z.audience);return{jwksUri:Z.jwksUri,issuer:Z.issuer,audience:typeof Q[0]==="string"?Q[0]:void 0}}function H8($,Z){let Q=L$(Z);if(!Q)return;return $.find((X)=>L$(X.issuer)===Q)}function $4($,Z,Q){let X=m4($);if(Z.some((Y)=>X.includes(Y)))return!0;if(typeof Q==="string"&&Z.includes(Q))return!0;return!1}function y4($){if(!$\|\|!U8($))return{};return $.outgoing??{}}function R2($){return{getToken:$.getToken,refreshToken:$.refreshToken,generateJWTAssertion:$.generateJWTAssertion,revokeToken:$.revokeToken,beforeChange:$.beforeChange,afterChange:$.afterChange,isReady:$.isReady,ready:$.ready}}var p4=Symbol("ion.workloadClientState"),F8=Symbol("ion.namedWorkloadClients");function P2($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[p4]:"unavailable"}}function B8($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it is no longer configured on this Ionite instance.`)};return{getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[p4]:"removed"}}function I2($){if(!$)return"removed";return $[p4]??"available"}function v4($,Z,Q){let X=$,Y=X,J=new Set;for(let _ of Q){if(J.add(_),_ in Y)continue;let z=Z[_];Y[_]=z?R2(z):P2(_)}return Object.defineProperty(Y,F8,{value:J,enumerable:!1,configurable:!0}),X}function D8($){if(!$)return[];let Z=$[F8];return Z?Array.from(Z):[]}function x2($,Z,Q){let X=Z,Y=i0(Q,`Workload client "${$}"`),J=()=>I2(X)==="available",_=q0(`Workload client "${$}"`,J);return{api:{beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:_.isReady,ready:_.ready,getToken:(G)=>X.getToken(G),refreshToken:(G)=>X.refreshToken(G),generateJWTAssertion:(G)=>X.generateJWTAssertion(G),revokeToken:(G)=>X.revokeToken(G)},update(G){if(G===X)return;Y.emitBefore(),X=G,_.refresh(),Y.emitAfter()}}}function M8($){let Z,Q=!1,X=q0("Workload module",()=>Q),Y=i0($,"Workload"),J=new Map,_=new Set,z=new Set(["beforeChange","afterChange","isReady","ready"]),G=(F)=>{if(!Z)throw Error(`${F} is unavailable because workload is not configured on this Ionite instance.`);return Z},K={beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:X.isReady,ready:X.ready,get config(){return Z?.config??{}},getToken(...F){return G("getToken").getToken(...F)},refreshToken(F){return G("refreshToken").refreshToken(F)},generateJWTAssertion(F){return G("generateJWTAssertion").generateJWTAssertion(F)},revokeToken(F){return G("revokeToken").revokeToken(F)},validateToken(F){return G("validateToken").validateToken(F)},getWorkloadIdentity(F){return G("getWorkloadIdentity").getWorkloadIdentity(F)},parseJWT(F){return G("parseJWT").parseJWT(F)},handler(F){return G("handler").handler(F)}},H=(F)=>{for(let D of _)delete K[D];if(_.clear(),!F)return;let j=new Set(D8(F)),B=new Set([...z,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...j]);for(let[D,x]of Object.entries(F)){if(B.has(D))continue;K[D]=x,_.add(D)}},V=(F)=>{let j=J.get(F);if(j)return j;let B=x2(F,B8(F),$);if(J.set(F,B),!(F in K))K[F]=B.api;return B};return{update(F){if(!F&&!Q&&J.size===0)return;Y.emitBefore(),Q=F!==void 0,X.refresh(),Z=F;let j=new Set(D8(F));for(let B of j){let D=F[B];V(B).update(D)}for(let[B,D]of J){if(j.has(B))continue;D.update(B8(B))}return H(F),Y.emitAfter(),K}}}async function h4($,Z,Q){if($===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let X=Q[$];if(!X)throw Error(`Unknown workload client: ${$}`);return X.getToken(Z)}function f4($,Z){return`${$}\|${Z??""}`}function g0($,Z,Q,X,Y){let J={jwtAssertionClaims:$?.jwtAssertionClaims??N2("server"),tokenResponse:$?.tokenResponse??A2("server")},_=async(A,O)=>{let w=A;if(typeof w.validate==="function")return w.validate(O);return A["~standard"].validate(O)};if(!Q&&!X)return;if(Q&&V8(Q)){let A=Q.incoming,O=_8(A),w=Array.isArray(A)?q2(A):A,I=b4(X),k=y4(X),u=w?{...w,...I,jwksUri:w.jwksUri,issuer:w.issuer}:I;if(!u\|\|!u.tokenUrl&&!u.jwksUri)Z.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let h=u&&(u.tokenUrl\|\|u.jwksUri)?g0($,Z,w??void 0,I,O):void 0,r=Array.from(new Set([...Object.keys(Q.outgoing??{}),...Object.keys(k)])).map((Q0)=>[Q0,{...Q.outgoing?.[Q0]??{},...k[Q0]??{}}]),l={};for(let[Q0,z$]of r){let C0=g0($,Z,z$,void 0);if(C0)l[Q0]=C0}if(!h&&Object.keys(l).length===0)return;let z0={...h?.config??{},config:h?.config??{},getToken:async(Q0,z$)=>h4(Q0,z$,l),getServerToken:async(Q0)=>{if(!h)throw Error("No server workload config");return h.getToken(Q0)},refreshToken:async(Q0)=>{if(!h)throw Error("No default workload config");return h.refreshToken(Q0)},generateJWTAssertion:async(Q0)=>{if(!h)throw Error("No default workload config");return h.generateJWTAssertion(Q0)},revokeToken:async(Q0)=>{if(!h)throw Error("No default workload config");return h.revokeToken(Q0)},validateToken:async(Q0)=>{if(!h)throw Error("No default workload config");return h.validateToken(Q0)},getWorkloadIdentity:async(Q0)=>{if(!h)return;return h.getWorkloadIdentity(Q0)},parseJWT:async(Q0)=>{if(!h)throw Error("No default workload config");return h.parseJWT(Q0)},handler:async(Q0)=>{if(!h)return H0();return h.handler(Q0)}};return v4(z0,l,r.map(([Q0])=>Q0))}if(Q&&T2(Q)){let A=b4(X),O=y4(X),w=Q.default,I=w?{...w,...A,jwksUri:w.jwksUri,issuer:w.issuer}:A;if(!I\|\|!I.tokenUrl&&!I.jwksUri)Z.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let k=I&&(I.tokenUrl\|\|I.jwksUri)?g0($,Z,w??void 0,A):void 0,u=Array.from(new Set([...Object.keys(Q).filter((l)=>l!=="default"),...Object.keys(O)])).map((l)=>[l,{...l in Q?Q[l]:{},...O[l]??{}}]),h={};for(let[l,z0]of u){let Q0=g0($,Z,z0,void 0);if(Q0)h[l]=Q0}if(!k&&Object.keys(h).length===0)return;let r={...k?.config??{},config:k?.config??{},getToken:async(l,z0)=>h4(l,z0,h),getServerToken:async(l)=>{if(!k)throw Error("No server workload config");return k.getToken(l)},refreshToken:async(l)=>{if(!k)throw Error("No default workload config");return k.refreshToken(l)},generateJWTAssertion:async(l)=>{if(!k)throw Error("No default workload config");return k.generateJWTAssertion(l)},revokeToken:async(l)=>{if(!k)throw Error("No default workload config");return k.revokeToken(l)},validateToken:async(l)=>{if(!k)throw Error("No default workload config");return k.validateToken(l)},getWorkloadIdentity:async(l)=>{if(!k)return;return k.getWorkloadIdentity(l)},parseJWT:async(l)=>{if(!k)throw Error("No default workload config");return k.parseJWT(l)},handler:async(l)=>{if(!k)return H0();return k.handler(l)}};return v4(r,h,u.map(([l])=>l))}let z=b4(X),G=y4(X);if(!Q&&Object.keys(G).length>0){let A={};for(let[I,k]of Object.entries(G)){let u=g0($,Z,k,void 0);if(u)A[I]=u}let O=z&&(z.tokenUrl\|\|z.jwksUri)?g0($,Z,z,void 0):void 0;if(!O&&Object.keys(A).length===0)return;let w={...O?.config??{},config:O?.config??{},getToken:async(I,k)=>h4(I,k,A),getServerToken:async(I)=>{if(!O)throw Error("No server workload config");return O.getToken(I)},refreshToken:async(I)=>{if(!O)throw Error("No default workload config");return O.refreshToken(I)},generateJWTAssertion:async(I)=>{if(!O)throw Error("No default workload config");return O.generateJWTAssertion(I)},revokeToken:async(I)=>{if(!O)throw Error("No default workload config");return O.revokeToken(I)},validateToken:async(I)=>{if(!O)throw Error("No default workload config");return O.validateToken(I)},getWorkloadIdentity:async(I)=>{if(!O)return;return O.getWorkloadIdentity(I)},parseJWT:async(I)=>{if(!O)throw Error("No default workload config");return O.parseJWT(I)},handler:async(I)=>{if(!O)return H0();return O.handler(I)}};return v4(w,A,Object.keys(G))}let K=Q,H=Y??_8(K),V=z?.tokenUrl,F=V?.startsWith("/")?V:void 0,j=K?.idpTokenUrl??z?.idpTokenUrl??(K?.tokenUrl&&(K.tokenUrl.startsWith("http://")\|\|K.tokenUrl.startsWith("https://"))?K.tokenUrl:void 0),B={...K,...z,tokenUrl:F??z?.tokenUrl??K?.tokenUrl,idpTokenUrl:j,jwksUri:K?.jwksUri,issuer:K?.issuer};B._handlerTokenUrl=F;let D,x=B,M=A0(B),W=y0(B),q=k4(B);if(!M&&!W&&!q){if(!K\|\|Object.keys(K).length===0)return;throw Z.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(B),clientId:x.clientId,clientSecret:x.clientSecret?"[REDACTED]":void 0,workloadId:x.workloadId,privateKey:x.privateKey?"[REDACTED]":void 0,jwksUri:x.jwksUri,tokenUrl:x.tokenUrl,idpTokenUrl:x.idpTokenUrl,fromVaultKeys:K?Object.keys(K):[],fromCodeKeys:X?Object.keys(X):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(M)D={...B,tokenUrl:B.tokenUrl,idpTokenUrl:I0(B.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:I0(B.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:I0(B.privateKey,"Missing 'privateKey' from Workload Config"),audience:I0(B.audience,"Missing 'audience' from Workload Config"),scope:B.scope??"",algorithm:B.algorithm??"RS256",tokenLifetime:B.tokenLifetime??300,refreshThreshold:B.refreshThreshold??60,autoRefresh:B.autoRefresh!==void 0?B.autoRefresh:!0,tokenStore:B.tokenStore??new a0};else if(y0(B))D={...B,tokenUrl:B.tokenUrl,idpTokenUrl:I0(B.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:I0(B.clientId,"Missing 'clientId' from Workload Config"),clientSecret:I0(B.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:B.scope??"",tokenLifetime:B.tokenLifetime??300,refreshThreshold:B.refreshThreshold??60,autoRefresh:B.autoRefresh!==void 0?B.autoRefresh:!0,tokenStore:B.tokenStore??new a0};else if(k4(B))D=B;function T(){let A=new Uint8Array(16);return crypto.getRandomValues(A),Array.from(A,(O)=>O.toString(16).padStart(2,"0")).join("")}function m(A){let O;if(typeof A==="string")O=btoa(A);else O=btoa(String.fromCharCode(...A));return O.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function C(A){let O=A.replace(/-/g,"+").replace(/_/g,"/");while(O.length%4)O+="=";return atob(O)}function c(A){if(A.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:A==="RS256"?"SHA-256":A==="RS384"?"SHA-384":"SHA-512"};else if(A.startsWith("ES"))return{name:"ECDSA",namedCurve:A==="ES256"?"P-256":A==="ES384"?"P-384":"P-521",hash:A==="ES256"?"SHA-256":A==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${A}`)}async function Z0(A,O){let w=A.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),I=Uint8Array.from(atob(w),(u)=>u.charCodeAt(0)),k=c(O);return crypto.subtle.importKey("pkcs8",I,k,!1,["sign"])}async function o(A,O,w){let I=await Z0(O,w),u=new TextEncoder().encode(A),h=c(w),r=await crypto.subtle.sign(h,I,u);return m(new Uint8Array(r))}async function E(A,O=3,w=1000,I=30000){let k=Error("Placeholder Error");for(let u=0;u<=O;u++)try{return await A()}catch(h){if(k=h instanceof Error?h:Error(String(h)),k.message.includes("400")\|\|k.message.includes("401")\|\|k.message.includes("403")\|\|k.message.includes("404"))throw k;if(u<O){let r=Math.min(w2*u,I),l=Math.random()r0.1;await new Promise((z0)=>setTimeout(z0,r+l))}}throw k}async function N(A){if(!A0(D))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let O=D,w=Math.floor(Date.now()/1000),I={iss:O.workloadId,sub:O.workloadId,aud:O.audience??"",exp:w+O.tokenLifetime,iat:w,jti:T(),scope:A??O.scope},k={alg:O.algorithm,typ:"JWT",kid:O.keyId},u=m(JSON.stringify(k)),h=m(JSON.stringify(I)),r=`${u}.${h}`,l=await o(r,O.privateKey,O.algorithm);return`${r}.${l}`}async function P(A){if(!A0(D))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let O=D;return E(async()=>{let w=O.idpTokenUrl,I=await N(A),k=new URLSearchParams;if(k.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),k.append("assertion",I),A)k.append("scope",A);let u=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:k.toString()}),h=await u.json();if(!u.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:h});let l=h;throw Error(`Token acquisition failed: ${l.error\|\|u.statusText} - ${l.error_description\|\|""}`.trim())}let r=await _(J.tokenResponse,h);if(r.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:r.issues}),Error(`Token response validation failed: ${r.issues.map((l)=>l.message).join("; ")}`);if(O.tokenStore){let l=new Date(Date.now()+(r.value.expires_in??300)1000),z0={workload_id:f4(O.workloadId,A),access_token:r.value.access_token,token_type:r.value.token_type,scope:r.value.scope,expires_at:l,created_at:new Date,refresh_token:r.value.refresh_token};await O.tokenStore.set(z0)}return r.value})}async function y(A){if(!y0(D))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let O=D;return E(async()=>{let w=O.idpTokenUrl,I=new URLSearchParams;if(I.append("grant_type","client_credentials"),I.append("client_id",O.clientId),I.append("client_secret",O.clientSecret),A)I.append("scope",A);let k=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:I.toString()}),u=await k.json();if(!k.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:u});let r=u;throw Error(`Token acquisition failed: ${r.error\|\|k.statusText} - ${r.error_description\|\|""}`.trim())}let h=await _(J.tokenResponse,u);if(h.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:h.issues}),Error(`Token response validation failed: ${h.issues.map((r)=>r.message).join("; ")}`);if(O.tokenStore){let r=new Date(Date.now()+(h.value.expires_in??300)1000),l={workload_id:f4(O.clientId,A),access_token:h.value.access_token,token_type:h.value.token_type,scope:h.value.scope,expires_at:r,created_at:new Date,refresh_token:h.value.refresh_token};await O.tokenStore.set(l)}return h.value})}let S=new Map;function d(A,O){let w=S.get(A);if(w)return w;let I=(async()=>{return(A0(D)?await P(O??""):await y(O??"")).access_token})();return S.set(A,I),I.catch(()=>{return}).finally(()=>{if(S.get(A)===I)S.delete(A)}),I}async function i(A){if(!A0(D)&&!y0(D)){let k=D;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!k.clientId}, hasClientSecret=${!!k.clientSecret}, hasWorkloadId=${!!k.workloadId}, hasPrivateKey=${!!k.privateKey}, hasJwksUri=${!!k.jwksUri}`)}let O=D;A=A??O.scope;let w=A0(D)?D.workloadId:D.clientId,I=f4(w,A);if(O.tokenStore){let k=await O.tokenStore.get(I);if(k){let u=Date.now(),h=k.expires_at.getTime(),r=O.refreshThreshold1000;if(u+r<h)return k.access_token;if(O.autoRefresh)try{return await d(I,A)}catch(l){if(u<h)return Z.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},l),k.access_token;throw l}}}return d(I,A)}async function e(A){if(!A0(D)&&!y0(D))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let O=D;return A=A??O.scope,A0(O)?await P(A):await y(A)}async function Y0(A){if(!A0(D)&&!y0(D))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let O=D;try{if(!D.revocationEndpoint)return;let w=new URLSearchParams;if(w.append("token",A),w.append("token_type_hint","access_token"),A0(D)){let k=D;w.append("client_id",k.workloadId)}else if(y0(D)){let k=D;w.append("client_id",k.clientId),w.append("client_secret",k.clientSecret)}let I=await fetch(D.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:w.toString()});if(!I.ok)Z.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:I.status,statusText:I.statusText});else Z.info("Token revoked successfully",{"ion.module":"workload"});if(D.tokenStore){let k;if(A0(D))k=D.workloadId;else if(y0(D))k=D.clientId;else return;await D.tokenStore.delete(k)}}catch(w){Z.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},w)}}async function K0(A,O){let w=A??D?.jwksUri;if(!w)throw Error("No JWKS URI configured in Workload Config");return await E2(w,Z,O)}async function p(A,O){let w=O??D?.jwksUri;if(!w)throw Error("No JWKS URI configured in Workload Config");let I=A0(D)?D.algorithm:"RS256";return j2(w,A,`wl:${I}`,(k)=>{let u=k.alg\|\|I,h=c(u);return crypto.subtle.importKey("jwk",k,h,!1,["verify"])},Z)}function $0(A){let O=A.split(".");if(O.length!==3)throw Error("Invalid JWT");return JSON.parse(C(O[1]))}async function _0(A,O){try{let w=A.split(".");if(w.length!==3)throw Error("Invalid JWT");let I=JSON.parse(C(w[0])),k=JSON.parse(C(w[1])),u=await p(I.kid,O),h=w[2],l=new TextEncoder().encode(`${w[0]}.${w[1]}`),z0=Uint8Array.from(C(h),(W$)=>W$.charCodeAt(0)),Q0=c(I.alg);if(!await crypto.subtle.verify(Q0,u,z0,l))throw Error("Invalid JWT signature");let C0=await _(J.jwtAssertionClaims,k);if(C0.issues)throw Z.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:C0.issues}),Error(`JWT claims validation failed: ${C0.issues.map((W$)=>W$.message).join("; ")}`);return C0.value}catch(w){throw Z.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},w),w}}async function B0(A){if(!A0(D)&&!y0(D)&&!k4(D))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(H.length>0){let I=$0(A),k=typeof I.iss==="string"?I.iss:void 0,u=H8(H,k);if(!u)return{valid:!1,error:"Untrusted token issuer"};let h=await _0(A,u.jwksUri),r=Math.floor(Date.now()/1000);if(h.exp&&h.exp<r)return{valid:!1,error:"Token expired"};let l=m4(u.audience);if(l.length>0&&!$4(h.aud,l,h.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:h,expiresAt:h.exp?new Date(h.exp1000):void 0}}let O=await _0(A),w=Math.floor(Date.now()/1000);if(O.exp&&O.exp<w)return{valid:!1,error:"Token expired"};if(A0(D)){if(D.audience&&!$4(O.aud,[D.audience],O.azp))return{valid:!1,error:"Invalid audience"}}else if(y0(D)){if(D.issuer&&L$(O.iss)!==L$(D.issuer))return{valid:!1,error:"Invalid issuer"};if(D.audience&&!$4(O.aud,[D.audience],O.azp))return{valid:!1,error:"Invalid audience"}}else{let I=D;if(I.issuer&&L$(O.iss)!==L$(I.issuer))return{valid:!1,error:"Invalid issuer"};if(I.audience&&!$4(O.aud,[I.audience],O.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:O,expiresAt:O.exp?new Date(O.exp1000):void 0}}catch(O){return{valid:!1,error:O instanceof Error?O.message:String(O)}}}function L(A,O){let w=A[O];return typeof w==="string"&&w.trim()?w.trim():void 0}function b(A){if(!A)return;return A.startsWith("service-account-")?A.slice(16):A}function g(A){return L(A,"client_id")??L(A,"clientId")??L(A,"azp")??L(A,"appid")??b(L(A,"preferred_username"))}let a=new WeakMap;function t(A){let O=a.get(A);if(O)return O;let w=J0(A);return a.set(A,w),w}async function J0(A){let O=A.headers.get("Authorization");if(!O?.startsWith("Bearer "))return;let w=O.substring(7),I=await B0(w);if(!I.valid\|\|!I.claims)return;let k=H.length>0?H8(H,I.claims.iss):void 0,u=I.claims.ecid,h={workloadId:I.claims.sub,clientId:g(I.claims),scope:I.claims.scope,scopesAsEntitlements:k?.scopesAsEntitlements,...u!==void 0&&u!==null?{ecid:K8(u)}:{},claims:I.claims},r=D?.workloadIdentityStore;if(r){let l=h.clientId??h.workloadId??h.claims.sub,z0=l?await r.get(l):void 0;if(z0){if(z0.active===!1)return;if(z0.scopes?.length){let Q0=new Set([...(h.scope??"").split(/\s+/).filter(Boolean),...z0.scopes]);h.scope=Array.from(Q0).join(" ")}if(!h.ecid&&z0.ecid)h.ecid=K8(z0.ecid)}}return h}async function V0(A){if(!D)throw Error("ionite Workload Manager not initialized");let O=new URL(A.url).pathname,w=(u)=>{if(!u)return;try{return new URL(u).pathname}catch{return u.startsWith("/")?u:`/${u}`}};if(w(D.validateUrl)===O&&A.method==="POST"){let u=A.headers.get("Authorization");if(!u?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let h=u.substring(7),r=await B0(h);if(!r.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:r.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(w(D.jwksUrl)===O&&A.method==="GET"){let u=await K0();return new Response(JSON.stringify(u),{headers:[["Content-Type","application/json"]]})}return H0()}return{...D,getToken:i,refreshToken:e,generateJWTAssertion:N,revokeToken:Y0,validateToken:B0,getWorkloadIdentity:t,parseJWT:_0,handler:V0}}function g4($){return $=$??"Workload authentication unavailable",new Response(JSON.stringify({error:$}),{status:503,statusText:$,headers:{"Content-Type":"application/json"}})}var Z4="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",S2="Ionite or Workload instance is required. Create an ES with ionite(source, config) or pass a Workload instance.";async function w2($,Z){I0(Z,Z4);let Q=Z.workload;if(!Q)return;return Q.getWorkloadIdentity($)}async function C2($,Z,Q){I0(Z,Z4);let X=Z.workload;if(!X)throw g4();let Y=X;if(typeof Y.getServerToken!=="function"\|\|typeof Y.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return Y.getToken($,Q)}async function d4($,Z){I0(Z,S2);let Q="validateToken"in Z&&typeof Z.validateToken==="function"?Z:Z.workload;if(!Q)return{valid:!1,error:"Workload authentication unavailable"};let X=$.headers.get("Authorization");if(!X?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let Y=X.substring(7);return Q.validateToken(Y)}async function k2($,Z){I0(Z,Z4);let Q=Z.workload;if(!Q)throw g4();return Q.revokeToken($)}async function b2($,Z){I0(Z,Z4);let Q=Z.workload;if(!Q)throw g4();return Q.handler($)}function L8($){try{return X4(new URL($,"http://dummy").pathname)}catch{let Z=$.startsWith("/")?$:`/${$}`;return X4(Z)}}function h2($,Z){let Q=new URL($.url);return new URL(`/${encodeURIComponent(Z)}/`,Q.origin).toString()}function f2($,Z){let Q=L8(Z),X=X4($);if(X===Q)return null;if(!X.startsWith(`${Q}/`))return null;let Y=X.slice(Q.length+1);if(!Y\|\|Y.includes("/"))return null;return decodeURIComponent(Y)}function Q4($){return $==="pending"\|\|$==="processing"\|\|$==="completed"\|\|$==="failed"\|\|$==="action_required"}function m2($){if(!Q4($.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if($.status==="completed"){if(!$.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:$.tenantUrl,status:"completed"},status:201}}if($.status==="pending"\|\|$.status==="processing")return{body:{tenantUrl:$.tenantUrl,status:$.status},status:202};if($.status==="action_required"){if(!$.actionUrl\|\|!$.requestToken\|\|!$.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:$.actionUrl,requestToken:$.requestToken,expiresAt:$.expiresAt},status:200}}return{body:{tenantUrl:$.tenantUrl,status:"failed",error:$.error??"Tenant provisioning failed"},status:409}}function p2($,Z){let Q=Z.validators.tenant.createTenantRequest,X=Z.validators.tenant.updateTenantRequest;function Y(K,H){let V=(F)=>new URL(F,H).toString();return{readyzUrl:V(K.readyzUrl),capabilitiezUrl:V(K.capabilitiezUrl),sso:{loginUrl:V(K.sso.loginUrl),userUrl:V(K.sso.userUrl),logoutUrl:V(K.sso.logoutUrl),logoutBackChannelUrl:V(K.sso.logoutBackChannelUrl),refreshUrl:V(K.sso.refreshUrl),callbackUrl:V(K.sso.callbackUrl)},workload:{validateUrl:V(K.workload.validateUrl),jwksUrl:V(K.workload.jwksUrl)},iam:{basePath:V(K.iam.basePath),usersUrl:V(K.iam.usersUrl),groupsUrl:V(K.iam.groupsUrl)},ciam:{magicLinkUrl:V(K.ciam.magicLinkUrl),magicLinkLoginUrl:V(K.ciam.magicLinkLoginUrl),customerUrl:V(K.ciam.customerUrl),customerLoginUrl:V(K.ciam.customerLoginUrl),customerCallbackUrl:V(K.ciam.customerCallbackUrl),customerProvidersUrl:V(K.ciam.customerProvidersUrl),logoutUrl:V(K.ciam.logoutUrl)}}}function J(K,H){let V=Z.tenantEsBasePath?.(K);if(!V)return;let F=new URL(H.url).origin,j=Y(v0(V),F);return{callbackUrl:j.sso.callbackUrl,ionUrls:j}}async function _(K){let H=await d4(K,Z.workloadAuth??$);if(!H.valid)return Response.json({error:H.error??"Unauthorized"},{status:401});return e0(K,$,y2["tenant.manage"])}async function z(K){let V=new URL(K.url).pathname,F=f2(V,Z.basePath),j=L8(Z.basePath),B=X4(V)===j;if(!B&&!F)return H0();if(!["GET","PUT","POST","DELETE"].includes(K.method))return V$(["GET","PUT","POST","DELETE"]);if(K.method==="GET"&&B&&F==null)return H0();let D=await _(K);if(D)return D;if(K.method==="GET"){if(F==null)return H0();let E=await Z.store.get(F);if(!E)return H0();let N=J(E,K);return Response.json(N?{...E,...N}:E,{status:200})}if(K.method==="DELETE"){if(!F)return H0();return await Z.store.delete(F),new Response(null,{status:204})}if(!F&&K.method!=="POST")return H0();let x;try{x=await K.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let M=K.method==="POST",W=M?await Q.validate(x):await X.validate(x);if(W.issues)return v2(W.issues,M?"Tenant create validation failed":"Tenant update validation failed");let q=M?W.value.id:F;if(!q)return H0();if(F!=null&&W.value.id!=null&&W.value.id!==F)return Response.json({error:"Path id must match body id"},{status:400});let T=await Z.store.get(q);if(T&&!Q4(T.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let m=new Date,C=T??{},c;if(M){let E=W.value,N=E,P=N.status,y=Q4(P)?P:T?.status??"completed";c={...C,...E,id:q,companyId:E.companyId,companyName:E.companyName,environmentType:E.environmentType,configLocator:E.configLocator,email:E.email??T?.email,webhookUrl:E.webhookUrl??T?.webhookUrl,callbackUrl:E.callbackUrl??T?.callbackUrl,tenantUrl:N.tenantUrl??T?.tenantUrl,status:y,error:N.error??T?.error,actionUrl:N.actionUrl??T?.actionUrl,requestToken:N.requestToken??T?.requestToken,expiresAt:N.expiresAt??T?.expiresAt,createdAt:T?.createdAt??m,updatedAt:m}}else{let E=W.value,N=E,P=N.status,y=Q4(P)?P:T?.status??"completed",{configLocator:S,...d}=E;c={...C,...d,id:q,companyId:E.companyId??T?.companyId??"",companyName:E.companyName??T?.companyName??"",environmentType:E.environmentType??T?.environmentType??"DEV",email:E.email??T?.email,webhookUrl:E.webhookUrl??T?.webhookUrl,callbackUrl:E.callbackUrl??T?.callbackUrl,tenantUrl:N.tenantUrl??T?.tenantUrl,status:y,error:N.error??T?.error,actionUrl:N.actionUrl??T?.actionUrl,requestToken:N.requestToken??T?.requestToken,expiresAt:N.expiresAt??T?.expiresAt,configLocator:S??T?.configLocator,createdAt:T?.createdAt??m,updatedAt:m}}if(!c.configLocator)return Response.json({error:"validation_failed",message:"Tenant configLocator is required",issues:[{message:"configLocator is required on create or must already exist on the stored tenant"}]},{status:422});if(!c.tenantUrl)c.tenantUrl=h2(K,q);if(!c.callbackUrl){let E=J(c,K);if(E)c.callbackUrl=E.callbackUrl}let Z0=await Z.store.upsert(c),o=m2(Z0);if(o instanceof Response)return o;return Response.json(o.body,{status:o.status})}async function G(K){try{if(!$.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await z(K)}catch(H){return D$(H)}}return{handler:G,getTenant:async(K)=>{return Z.store.get(K)}}}exportfrom"@ionite/core";import{generateULID as O5,IoniteError as N5,listGenerator as A5}from"@ionite/core";import{allowHosts as E5,allowOrigins as T5,allowRelativePaths as q5,allowSameOrigin as R5,blockDangerousUrls as P5,CatalogAdjacencyCache as I5,callback as x5,captureRedirect as S5,ciam as w5,collectReferencedDefinitions as C5,defaultRedirectPolicies as k5,discoverSessionRecords as b5,discoverSessions as y5,expandRoot as v5,getCustomer as h5,getUser as f5,has as m5,hasAll as p5,hasAllScope as g5,hasAny as d5,hasAnyScope as u5,hasGroup as l5,hasPermission as c5,hasRole as i5,hasScope as n5,InMemoryTenantStore as s5,iam as a5,initiateLogin as t5,isRedirectAllowed as r5,listSsoClientIdsFromCookies as o5,reconcileSubjectAccess as e5,resolveAfterRedirect as $7,resolveCapturedRedirect as Z7,resolveRedirect as Q7,sameOriginRedirectRules as X7,sendTenantWebhook as Y7,sso as J7,verifyUser as G7,withDefaultExternalId as K7,withSetCookies as z7}from"@ionite/core/server";import{accessRefId as n0,accessRootId as W8,list as g2}from"@ionite/core";function l4($){let{createdAt:Z,updatedAt:Q,...X}=$;return X}class d0{roots=new Map;byTarget=new Map;bySubject=new Map;static targetKey($,Z){return`${$}:${Z}`}static subjectKey($,Z){return`${$}:${Z}`}indexAdd($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}indexRemove($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}deindex($){this.indexRemove(this.byTarget,d0.targetKey($.targetType,n0($.target)),$.id),this.indexRemove(this.bySubject,d0.subjectKey($.subjectType??"user",n0($.subject)),$.id)}index($){this.indexAdd(this.byTarget,d0.targetKey($.targetType,n0($.target)),$.id),this.indexAdd(this.bySubject,d0.subjectKey($.subjectType??"user",n0($.subject)),$.id)}resolve($,Z){if(!$)return[];let Q=[];for(let X of $){let Y=this.roots.get(X);if(Y&&(Y.status??"active")==="active"&&Z(Y))Q.push(Y)}return Q}async grant($){let Z=$.id??W8($),Q=new Date,X=this.roots.get(Z);if(X)this.deindex(X);let Y={...$,id:Z,status:$.status??"active",createdAt:X?.createdAt??Q,updatedAt:Q};this.roots.set(Z,Y),this.index(Y)}async revoke($){let Z=$.id??W8($),Q=this.roots.get(Z);if(Q)this.deindex(Q);this.roots.delete(Z)}async get($){let Z=this.roots.get($);return Z?l4(Z):void 0}async list($){let Z=Array.from(this.roots.values()).filter((Q)=>(Q.status??"active")==="active");return u4(Z,$)}async listByTarget($,Z,Q){let X=Z.trim(),Y=this.byTarget.get(d0.targetKey($,X)),J=this.resolve(Y,(_)=>_.targetType===$&&n0(_.target)===X);return u4(J,Q)}async listByTargets($){let Z=new Map;for(let{targetType:Q,target:X}of $){let Y=`${Q}:${X}`;if(Z.has(Y))continue;let J=X.trim(),_=this.byTarget.get(d0.targetKey(Q,J)),z=this.resolve(_,(G)=>G.targetType===Q&&n0(G.target)===J);Z.set(Y,z.map((G)=>l4(G)))}return Z}async listBySubject($,Z="user",Q){let X=n0($),Y=this.bySubject.get(d0.subjectKey(Z,X)),J=this.resolve(Y,(_)=>(_.subjectType??"user")===Z&&n0(_.subject)===X);return u4(J,Q)}}function u4($,Z){let Q=Math.max(0,Z?.start??0),X=Z?.limit,Y=X!=null?Q+X:void 0;return g2($.length,$.slice(Q,Y).map(l4),Q,X)}import{assertValidSubjectTypeScoping as d2,list as O8,readyCatalogEntry as u2}from"@ionite/core";class N8{listeners=new Set;emit=($)=>{for(let Z of this.listeners)Z($)};groups=new Y4("group",this.emit);roles=new Y4("role",this.emit);permissions=new Y4("permission",this.emit);afterChange($){return this.listeners.add($),()=>{this.listeners.delete($)}}}class A8{items=new Map;listeners=new Set;constructor($){if($?.deriveEntitlements){let{deriveEntitlements:Z,resolveEntitlement:Q}=$;if(!Q)throw Error("InMemoryResourceStore: resolveEntitlement must be provided with deriveEntitlements.");this.entitlements=(X)=>Z(X),this.entitlement=async(X)=>Q(X,(Y)=>this.items.get(Y))}}entitlements;entitlement;async get($){return this.items.get($)}async list($){let Z=Array.from(this.items.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=X!=null?Q+X:void 0;return O8(Z.length,Z.slice(Q,Y),Q,X)}async children($){return Array.from(this.items.values()).filter((Z)=>{return(typeof Z.parent==="string"?Z.parent:Z.parent?.id)===$})}changed($){return this.listeners.add($),()=>{this.listeners.delete($)}}set($){this.items.set($.id,$),this.emitChange({id:$.id})}delete($){if(!this.items.delete($))return;this.emitChange({id:$,deleted:!0})}emitChange($){for(let Z of this.listeners)Z($)}}class Y4{kind;emit;items=new Map;byExternalId=new Map;constructor($,Z){this.kind=$;this.emit=Z}async get($){return this.items.get($)}async getByExternalId($){let Z=this.byExternalId.get($);return Z===void 0?void 0:this.items.get(Z)}set($){d2($);let Z=this.items.get($.id);if(Z?.externalId&&Z.externalId!==$.externalId){if(this.byExternalId.get(Z.externalId)===$.id)this.byExternalId.delete(Z.externalId)}if(this.items.set($.id,$),$.externalId)this.byExternalId.set($.externalId,$.id);return this.emit({op:"set",kind:this.kind,entity:$}),u2($,Promise.resolve())}async delete($){let Z=this.items.get($);if(Z?.externalId&&this.byExternalId.get(Z.externalId)===$)this.byExternalId.delete(Z.externalId);this.items.delete($),this.emit({op:"delete",kind:this.kind,id:$})}async list($){let Z=Array.from(this.items.values()),Q=$?.filter?.requestable;if(Q!==void 0)Z=Z.filter((_)=>Boolean(_.requestable)===Q);let X=Math.max(0,$?.start??0),Y=$?.limit,J=Y!=null?X+Y:void 0;return O8(Z.length,Z.slice(X,J),X,Y)}}import{accessRefId as Q$}from"@ionite/core";function X$($,Z){return`${Z}:${$}`}function c4($,Z,Q){return`${$}:${Z}:${Q}`}function l2($,Z,Q,X){return`${c4($,Z,Q)}:${X??""}`}class j8{rows=new Map;byTriple=new Map;byRoot=new Map;bySubject=new Map;edgeMeta=new Map;disabledSubjects=new Set;async has($,Z,Q,X,Y="user"){let J=Q$($),_=Q$(Q);if(!J\|\|!_)return{allow:!1};if(this.disabledSubjects.has(X$(J,Y)))return{allow:!1,metadata:{reason:"subject_disabled"}};let z=c4(X$(J,Y),Z,_),G=X?Q$(X):void 0;if(G===void 0){let V=this.byTriple.get(z);if(V&&V.size>0)return this.allow(J,Z,_,void 0);return{allow:!1}}let K=`${z}:${G}`,H=`${z}:`;if(this.rows.has(K))return this.allow(J,Z,_,G);if(this.rows.has(H))return this.allow(J,Z,_,void 0);return{allow:!1}}async hasGroup($,Z,Q,X="user"){return this.has($,"group",Z,Q,X)}async hasRole($,Z,Q,X="user"){return this.has($,"role",Z,Q,X)}async hasPermission($,Z,Q,X="user"){return this.has($,"permission",Z,Q,X)}async hasAny($,Z,Q="user"){for(let X of Z){let Y=await this.has($,X.targetType,X.target,X.resource,Q);if(Y.allow)return Y}return{allow:!1}}async hasAll($,Z,Q="user"){if(this.disabledSubjects.has(X$(Q$($),Q)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(Z.length===0)return{allow:!0};let X=[];for(let Y of Z){let J=await this.has($,Y.targetType,Y.target,Y.resource,Q);if(!J.allow)return{allow:!1,matched:X};if(J.matched)X.push(...J.matched)}return{allow:!0,matched:X}}async materialize($,Z){await this.removeByRoot($);let Q=new Set;for(let X of Z){let Y=X$(X.subject,X.subjectType??"user"),J=c4(Y,X.targetType,X.target),_=l2(Y,X.targetType,X.target,X.resource);this.addToSet(this.rows,_,$),this.addToSet(this.byTriple,J,_),this.addToSet(this.bySubject,Y,_),this.edgeMeta.set(_,{triple:J,subjectId:Y}),Q.add(_)}if(Q.size>0)this.byRoot.set($,Q)}async removeByRoot($){let Z=this.byRoot.get($);if(!Z)return;for(let Q of Z){let X=this.rows.get(Q);if(!X)continue;if(X.delete($),X.size===0)this.dropEdge(Q)}this.byRoot.delete($)}async listSubjects(){let $=[];for(let[Z,Q]of this.bySubject){if(Q.size===0)continue;let X=Z.indexOf(":");if(X<=0){$.push({subject:Z});continue}$.push({subjectType:Z.slice(0,X),subject:Z.slice(X+1)})}return $}async setSubjectDisabled($,Z,Q){let X=X$(Q$($),Z);if(Q)this.disabledSubjects.add(X);else this.disabledSubjects.delete(X)}async isSubjectDisabled($,Z="user"){return this.disabledSubjects.has(X$(Q$($),Z))}async clear($,Z="user"){if($===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}let Q=Q$($),X=this.bySubject.get(X$(Q,Z));if(!X)return;for(let Y of[...X]){let J=this.rows.get(Y);if(J)for(let _ of J){let z=this.byRoot.get(_);if(z?.delete(Y)&&z.size===0)this.byRoot.delete(_)}this.dropEdge(Y)}}allow($,Z,Q,X){return{allow:!0,matched:[{subject:$,targetType:Z,target:Q,resources:X?[X]:void 0}]}}addToSet($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}dropEdge($){this.rows.delete($);let Z=this.edgeMeta.get($);if(Z)this.removeFromSet(this.byTriple,Z.triple,$),this.removeFromSet(this.bySubject,Z.subjectId,$);this.edgeMeta.delete($)}removeFromSet($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}}function i4($){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function c2($,Z){return{...$,subscribe:async(Q,X,Y)=>{try{return await $.subscribe(Q,X,Y)}catch(J){if(!(J instanceof P0))throw J;return await p0($,Q,X,Z,void 0,Y)}}}}function n4($){let Z=o0($.path,"path","azureConfig");Z$($.ttl);let Q=$.vault??o$({type:"azure",authMethod:$.authMethod,entraTenantId:$.entraTenantId,clientId:$.clientId,clientSecret:$.clientSecret,federatedTokenFile:$.federatedTokenFile,managedIdentityClientId:$.managedIdentityClientId,imdsApiVersion:$.imdsApiVersion,vaultUrl:$.vaultUrl,vaultName:$.vaultName,apiVersion:$.apiVersion,secretNameTransform:$.secretNameTransform,secretNamePrefix:$.secretNamePrefix,scope:$.scope,ttl:$.ttl}),X=$.ttl?c2(Q,$.ttl):Q;return{load:async()=>{try{return(await X.getFullSecret(Z)).data}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`Error retrieving remote config from Azure Key Vault: ${J}`,{cause:Y})}},subscribe:(Y,J)=>{return X.subscribe(Z,(_)=>{Y(_.data)},J)},secret:X}}import{IoniteError as a4}from"@ionite/core";function s4($){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}class Y$ extends Error{path;constructor($,Z=`Waiting for vault config secret at ${$}`){super(Z);this.path=$;this.name="VaultConfigWaitingForSecretError"}code="not_found";sourceType="vault";status=404}function i2($){return $ instanceof Y$}class P$ extends Error{path;constructor($,Z){super(Z);this.path=$;this.name="VaultConfigInvalidPayloadError"}code="invalid_payload";sourceType="vault"}function n2($){return $ instanceof P$}var q8=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function E8($){return q8.some((Z)=>(Z in $))}function T8($,Z){if(!$\|\|typeof $!=="object"\|\|Array.isArray($))throw new Y$(Z,`Vault config secret at ${Z} is missing or not an object`);let Q=$;if(!E8(Q)&&Object.keys(Q).length===1&&"data"in Q){let X=Q.data;if(X&&typeof X==="object"&&!Array.isArray(X))Q=X}if(Object.keys(Q).length===0)throw new Y$(Z,`Vault config secret at ${Z} is empty`);if(!E8(Q))throw new P$(Z,`Vault config secret at ${Z} is an invalid payload: not a RemoteConfig (no known keys: ${q8.join("/")})`);return Q}function s2($,Z,Q){return{...$,subscribe:async(X,Y,J)=>{try{return await $.subscribe(X,Y,J)}catch(_){if(!(_ instanceof P0))throw _;return await p0($,X,Y,Z,Q(),J)}}}}function J4($){let Z=o0($.path,"path","vaultConfig");Z$($.ttl);let Q=$.vault??M$({type:"vault",url:$.url,token:$.token,workload:$.workload,lfv:$.lfv,websocket:$.websocket,ttl:$.ttl,log:$.log}),X=$.vault&&$.ttl?s2(Q,$.ttl,()=>$.log):Q,Y={get log(){return $.log},set log(J){if($.log=J,X&&"log"in X)X.log=J},load:async()=>{try{let J=await X.getFullSecret(Z);return T8(J.data,Z)}catch(J){if(J instanceof m0)throw new Y$(Z);if(J instanceof Y$\|\|J instanceof P$)throw J;throw Error("Error retrieving remote config from vault",{cause:J})}},subscribe:(J,_)=>{return X.subscribe(Z,(z)=>{let G;try{G=T8(z.data,Z)}catch(K){$.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:Z,error:K instanceof Error?K.message:String(K)});return}J(G)},_)},secret:X};if($.lfv?.lfvServerUrl&&$.lfv.clientId&&$.lfv.deliveryEndpoint&&$.lfv.eventsEndpoint)Y[u$]={path:$.lfv.path??Z,lfvServerUrl:$.lfv.lfvServerUrl,clientId:$.lfv.clientId,deliveryTimeout:$.lfv.deliveryTimeout,retryInterval:$.lfv.retryInterval,warnInterval:$.lfv.warnInterval,deliveryEndpoint:$.lfv.deliveryEndpoint,eventsEndpoint:$.lfv.eventsEndpoint,verifyJwks:$.lfv.verifyJwks};return Y}function G4($){if($==null)return;if(typeof $==="number")return Number.isFinite($)?$:void 0;let Z=$.trim();if(!Z)return;let Q=Number.parseInt(Z,10);return Number.isFinite(Q)?Q:void 0}function a2($,Z){let Q=$.vaultLfvServerUrl??Z?.lfvServerUrl,X=$.vaultLfvClientId??Z?.clientId,Y=$.vaultLfvDeliveryEndpoint??Z?.deliveryEndpoint,J=$.vaultLfvEventsEndpoint??Z?.eventsEndpoint;if(!Q\|\|!X\|\|!Y\|\|!J)return Z;return{...Z,lfvServerUrl:Q,clientId:X,deliveryEndpoint:Y,verifyJwks:$.vaultLfvVerifyJwks??Z?.verifyJwks,eventsEndpoint:J,path:$.vaultLfvPath??Z?.path,deliveryTimeout:G4($.vaultLfvDeliveryTimeout)??Z?.deliveryTimeout,retryInterval:G4($.vaultLfvRetryInterval)??Z?.retryInterval,warnInterval:G4($.vaultLfvWarnInterval)??Z?.warnInterval}}function t2($,Z){let Q=$.vaultWebsocketUrl??Z?.url;if(!Q)return Z;return{...Z,url:Q,token:$.vaultWebsocketToken??Z?.token,clientId:$.vaultWebsocketClientId??Z?.clientId,header:$.vaultWebsocketHeader??Z?.header}}function r2($,Z){let Q=$.vaultWorkloadTokenUrl??Z?.idpTokenUrl,X=$.vaultWorkloadClientId??Z?.clientId,Y=$.vaultWorkloadClientSecret??Z?.clientSecret;if(!Q\|\|!X\|\|!Y)return Z;return{...Z,idpTokenUrl:Q,clientId:X,clientSecret:Y,scope:$.vaultWorkloadScope??Z?.scope}}function R8($,Z){return{...Z,url:$.vaultUrl??Z?.url,token:$.vaultToken??Z?.token,path:$.vaultPath??Z?.path,ttl:G4($.vaultTtl)??Z?.ttl,workload:r2($,Z?.workload),lfv:a2($,Z?.lfv),websocket:t2($,Z?.websocket)}}function J$($){switch($.type){case"vault":return o2($);case"azure":return e2($);case"aws":return $6($);case"gcp":return Z6($);default:throw Error(`Unsupported config locator type: ${$.type}`)}}function o2($){return J4(R8($))}function e2($){return n4({authMethod:$.azureAuthMethod,entraTenantId:$.azureEntraTenantId,clientId:$.azureClientId,clientSecret:$.azureClientSecret,federatedTokenFile:$.azureFederatedTokenFile,managedIdentityClientId:$.azureManagedIdentityClientId,imdsApiVersion:$.azureImdsApiVersion,vaultUrl:$.azureVaultUrl,vaultName:$.azureVaultName,apiVersion:$.azureApiVersion,scope:$.azureScope,secretNamePrefix:$.azureSecretNamePrefix,path:$.azurePath,ttl:$.azureTtl})}function $6($){return i4({webhookUrl:$.awsWebhookUrl,ttl:$.awsTtl})}function Z6($){return s4({ttl:$.gcpTtl})}function P8($,Z){let Q=Q6($,Z);switch(Q.type){case"vault":return J4({vault:Q,path:$.path,ttl:$.ttl});default:throw new a4(`Tenant config is not supported for secrets source type "${Q.type}" (path "${$.path}"). Only "vault" sources can currently back a tenant configLocator.`,{status:500,statusText:"Unsupported tenant config source"})}}function Q6($,Z){if(!$.source)return Z.secret;if(!Z.secrets)throw new a4(`Tenant configLocator references secrets source "${$.source}" but the root ES has no secrets module configured. Declare it on the root ES (RemoteConfig.secrets) before referencing it.`,{status:500,statusText:"Secrets module not configured"});try{return Z.secrets.getSecretsSource($.source)}catch(Q){let X=Z.secrets.listSecretsSources().join(", ")\|\|"(none)";throw new a4(`Tenant configLocator references unknown secrets source "${$.source}" (path "${$.path}"). Declared sources: ${X}.`,{status:500,statusText:"Unknown secrets source",cause:Q})}}function G$($){if(!$)return;let Z=Number.parseInt($,10);return Number.isFinite(Z)?Z:void 0}function I8($,Z){let Q=Z?.type??$.ION_CONFIG_TYPE;if(!Q)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp.");if(Q==="vault")return{type:"vault",vaultUrl:$.ION_VAULT_URL,vaultToken:$.ION_VAULT_TOKEN,vaultPath:$.ION_VAULT_PATH??"",vaultTtl:G$($.ION_VAULT_TTL),vaultWorkloadTokenUrl:$.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:$.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:$.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:$.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:$.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:$.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:$.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:$.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:$.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvDeliveryTimeout:G$($.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:G$($.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:G$($.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:$.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:$.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:$.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:$.ION_VAULT_WEBSOCKET_HEADER};if(Q==="azure")return{type:"azure",azurePath:$.ION_AZURE_PATH,azureApiVersion:$.ION_AZURE_API_VERSION,azureScope:$.ION_AZURE_SCOPE,azureSecretNamePrefix:$.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:$.ION_AZURE_AUTH_METHOD,azureEntraTenantId:$.ION_AZURE_TENANT_ID,azureClientId:$.ION_AZURE_CLIENT_ID,azureClientSecret:$.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:$.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:$.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:$.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:$.ION_AZURE_VAULT_URL,azureVaultName:$.ION_AZURE_VAULT_NAME,azureTtl:G$($.ION_AZURE_TTL)};if(Q==="aws")return{type:"aws",awsWebhookUrl:$.ION_AWS_WEBHOOK_URL??"",awsTtl:G$($.ION_AWS_TTL)};if(Q==="gcp")return{type:"gcp",gcpTtl:G$($.ION_GCP_TTL)};throw Error(`ION_CONFIG_TYPE="${Q}" is not valid for envConfig(); supported types are vault, azure, aws, gcp.`)}function x8($,Z){return J$(I8($,Z))}function X6($){return x8(process.env,$)}var Y6=1000,J6=30000,S8=["vault","azure","aws","gcp"];function w8($,Z){if(!$\|\|typeof $!=="object"\|\|Array.isArray($))throw Error(`Config locator at ${Z} is an invalid payload: expected an object with a "type" field`);let Q=$.type;if(typeof Q!=="string"\|\|!S8.includes(Q))throw Error(`Config locator at ${Z} is an invalid payload: unknown type "${String(Q)}" (expected ${S8.join("/")})`)}function C8($,Z){return $.log??=Z.log,$.validators??=Z.validators,$}function I$($){if(!$?.secret?.close)return;try{Promise.resolve($.secret.close()).catch((Z)=>{$.log?.warn?.("secretConfigSource: inner source close failed",Z)})}catch(Z){$.log?.warn?.("secretConfigSource: inner source close failed",Z)}}function G6($,Z){let Q=o0(Z,"path","secretConfigSource"),X,Y=(_)=>{w8(_,Q);let z=JSON.stringify(_);if(X&&X.hash===z)return X.inner;let G=X?.inner,K=C8(J$(_),J);if(X={hash:z,inner:K},G&&G!==K)I$(G);return K},J={async load(){let _=await $.getSecret(Q);return Y(_).load()},async subscribe(_,z){let G,K=!1,H=!1,V,F,j=new Promise((m,C)=>{V=m,F=C}),B=n$(),D,x,M=(m)=>new Promise((C)=>{x=C,D=setTimeout(C,m)}),W=async(m,C)=>{w8(m,Q);let c=JSON.stringify(m),Z0=X!==void 0&&X.hash===c;if(Z0&&G)return;let o=X?.inner,E=G,N=Z0&&X?X.inner:C8(J$(m),J),P=!Z0,y=()=>{if(P&&N!==o)I$(N)};try{if(N.subscribe){let d=await N.subscribe(_,z)??void 0;if(K\|\|!B.isCurrent(C)){d?.(),y();return}if(G=d,X={hash:c,inner:N},E&&E!==d)E();if(P&&o&&o!==N)I$(o);return}let S=await N.load();if(K\|\|!B.isCurrent(C)){y();return}if(X={hash:c,inner:N},E)E(),G=void 0;if(P&&o&&o!==N)I$(o);_(S)}catch(S){throw y(),S}},q=async(m)=>{let C=B.next(),c=Y6;for(;;){if(K\|\|!B.isCurrent(C))return;try{await W(m,C);return}catch(Z0){if(K\|\|!B.isCurrent(C))return;J.log?.warn(`secretConfigSource rebind for ${Q} failed; keeping last-known-good source and retrying in ${c}ms`,Z0),await M(c),c=Math.min(J6,c2)}}},T=await $.subscribe(Q,(m)=>{if(K)return;if(!H){W(m.data,B.next()).then(()=>{H=!0,V()}).catch((C)=>{H=!0,F(C)});return}q(m.data)},z);return await j,()=>{if(K=!0,B.next(),D)clearTimeout(D);x?.(),G?.(),T(),I$(X?.inner),X=void 0}},secret:$};return J}var K6=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."}];var k8;function z6($){k8=$}function _6($,Z){return k8?.({locator:$}),P8($,Z)}import{buildTenantPath as H6,DEFAULT_TENANT_API_NAMESPACE as y8,DEFAULT_TENANT_UI_NAMESPACE as v8,matchTenantPath as h8,normalizeTenantPathNamespace as b8,normalizeTenantRoutingStrategy as B6}from"@ionite/core";function D6(){return Response.json({error:"Tenant not found"},{status:404})}function V6($){return Response.json({error:`Tenant runtime not found for ${$}`},{status:404})}function U6($,Z){let Q=B6($);if(Z==="api")return b8(Q.api??y8);return b8(Q.ui??v8)}function F6($){if($.store)return async(Z)=>$.store.getIon(Z);return async(Z)=>await $.getIon(Z)??void 0}async function f8($,Z={}){if(Z.custom){let J=await Z.custom($);if(J)return{id:J}}let Q=Z.namespace??"api",X=U6(Z.strategy,Q),Y=h8(new URL($.url).pathname,X);if(!Y)return null;return{id:Y.id,context:{namespace:Q,restPath:Y.restPath,restSegments:Y.restSegments}}}function m8($,Z){let Q=new URL($.url);return Q.pathname=Z,new Request(Q,$)}function t4($,Z,Q,X){let Y=h8(new URL($.url).pathname,Q);if(!Y\|\|Y.id!==Z)return $;return m8($,H6(Z,Y.restPath,X))}function M6($,Z,Q={beforeTenantSegments:["api"],afterTenantSegments:[]}){return t4($,Z,y8,Q)}function L6($,Z,Q={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return t4($,Z,v8,Q)}function W6($){return async function(Q){try{let X=$.resolveTenant?await $.resolveTenant(Q):await f8(Q),Y=typeof X==="string"?{id:X,context:void 0}:X??null;if(!Y?.id)return $.onMissingTenant?await $.onMissingTenant(Q):D6();let J=await $.getIon(Y.id,Q)??null;if(!J)return $.onMissingIonite?await $.onMissingIonite(Q,Y.id):V6(Y.id);let _=$.rewriteRequest?await $.rewriteRequest(Q,{id:Y.id,ion:J,context:Y.context}):Q;return J.handler(_)}catch(X){return D$(X)}}}function O6($){let{type:Z,...Q}=$;return M$({type:"vault",...Q})}import{list as N6}from"@ionite/core";class p8{identities=new Map;clientIdIndex=new Map;async get($){return this.identities.get($)}async lookup($){if($.id){let Z=this.identities.get($.id);if(Z)return Z}if($.clientId){let Z=this.clientIdIndex.get($.clientId);if(Z)return this.identities.get(Z)}if($.externalId){for(let Z of this.identities.values())if(Z.externalId===$.externalId)return Z}return}async upsert($){let Z=$.id?.trim()\|\|crypto.randomUUID(),Q=new Date,X=this.identities.get(Z),Y={...$,id:Z,createdAt:X?.createdAt??$.createdAt??Q,updatedAt:Q};if(X?.clientId&&X.clientId!==Y.clientId)this.clientIdIndex.delete(X.clientId);if(this.identities.set(Z,Y),Y.clientId)this.clientIdIndex.set(Y.clientId,Z);return Y}async delete($){let Z=this.identities.get($);if(Z?.clientId)this.clientIdIndex.delete(Z.clientId);return this.identities.delete($),Z?1:0}async list($){let Z=Array.from(this.identities.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,_=Z.slice(Q,J);return N6(Y,_,Q,X)}}function x6($){let Z=$,Q=Z.basePath??y$(),X=b$(Z.stores),Y=Z.routing,J=Z.beforeChange,_=Z.afterChange,z=Z.configRetry,G=Z.onConfigLoadError;return{frameworkConfig:{log:$.log,validators:$.validators,sso:$.sso,iam:$.iam,workload:$.workload,secrets:$.secrets,ciam:$.ciam,authz:$.authz,otel:$.otel},basePath:Q,stores:X,options:{beforeChange:J,afterChange:_,routing:Y,configRetry:z,onConfigLoadError:G}}}function S6($){let Z=$,Q={trace:(X,...Y)=>Z.trace(X,...Y),debug:(X,...Y)=>Z.debug(X,...Y),info:(X,...Y)=>Z.info(X,...Y),warn:(X,...Y)=>Z.warn(X,...Y),error:(X,...Y)=>Z.error(X,...Y)};return{logger:Q,update(X){return Z=X,Q}}}function r8($,Z){let Q=$;return Q.setStores=(X)=>{Z.current=b$(X),Object.assign(Q,O$(Q,Z.current))},Q}function d8($){let Z=$?.replace(/\s+/g," ").trim();return Z?Z:void 0}function o8($){if(typeof $!=="object"\|\|$===null)return;return $.cause}function w6($){if(!($ instanceof Error))return typeof $==="string"?d8($):void 0;let Z=d8($.message),Q=[],X=$;if(typeof X.code==="string")Q.push(`code=${X.code}`);if(typeof X.status==="number")Q.push(`status=${X.status}`);if(typeof X.path==="string")Q.push(`path=${X.path}`);if(Q.length===0)return Z;if(!Z)return Q.join(", ");return`${Z} [${Q.join(", ")}]`}function $9($,Z=3){let Q=[],X=$,Y=0;while(X!=null&&Y<Z){let J=w6(X);if(J&&!Q.includes(J))Q.push(J);X=o8(X),Y+=1}return Q.length>0?Q.join(" <- "):void 0}function C6($,Z){if(typeof $!=="object"\|\|$===null)return;return $[Z]}function x0($,Z){let Q=$,X=0;while(Q!=null&&X<3){let Y=C6(Q,Z);if(Y!==void 0)return Y;Q=o8(Q),X+=1}return}var k6=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function b6($){return typeof $==="string"&&k6.has($)}function y6($){let Z=x0($,"kind");if(b6(Z))return Z;let Q=x0($,"status"),X=x0($,"code"),Y=$9($)?.toLowerCase()??"";if(Q===401\|\|Q===403\|\|Y.includes("auth error")\|\|Y.includes("permission denied"))return"auth";if(X==="not_found"\|\|Y.includes("waiting for vault"))return"not_found";if(X==="ECONNREFUSED"\|\|X==="ECONNRESET"\|\|X==="ENOTFOUND"\|\|X==="ETIMEDOUT"\|\|Y.includes("connection")\|\|Y.includes("fetch failed")\|\|Y.includes("network"))return"connection";if(Y.includes("timed out"))return"timeout";if(Y.includes("invalid status")\|\|typeof Q==="number"&&Q>=400)return"invalid_status";if(Y.includes("invalid payload")\|\|Y.includes("invalid json")\|\|Y.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function v6($){return"validation"}var h6=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function f6($,Z){let Q=x0($,"recoverable");if(typeof Q==="boolean")return Q;if(Z==="not_found")return!0;if(Z==="auth"\|\|Z==="invalid_payload")return!1;let X=x0($,"status");if(typeof X==="number"&&X>=400&&X<500)return!1;let Y=x0($,"code");if(typeof Y==="string"&&(h6.has(Y)\|\|Y.startsWith("UND_ERR_")))return!0;return!0}function m6($){return{initialDelayMs:Math.max(1,$?.initialDelayMs??2000),maxDelayMs:Math.max(1,$?.maxDelayMs??600000),multiplier:Math.max(1,$?.multiplier??2),jitterRatio:Math.max(0,$?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,$?.loadTimeoutMs??30000)}}function p6($,Z){let Q=Math.max(0,$-1),X=Math.min(Z.maxDelayMs,Z.initialDelayMsZ.multiplierQ);if(Z.jitterRatio===0)return Math.round(X);let Y=XZ.jitterRatio,J=(Math.random()2-1)Y;return Math.max(1,Math.round(Math.min(Z.maxDelayMs,X+J)))}function g6($){return(Z)=>{let Q=Z.path?` at ${Z.path}`:"",X=Z.sourceType?` (${Z.sourceType})`:"";$.warn(`Config source${X} unavailable${Q}; ionite will retry automatically in ${Z.nextDelayMs}ms (attempt ${Z.attempt}, ${Z.errorKind}: ${Z.message}).`)}}async function d6($,Z){for(let Q of Z)await Q($)}function S0($){if(!$)return;try{return new URL($,"http://dummy").pathname}catch{return $.startsWith("/")?$:`/${$}`}}function u6($,Z){let Q=Z.id;if(typeof Q!=="string"\|\|Q.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if($!==void 0&&$!==Q)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${$}", received "${Q}").`)}function l6($){let Z=$.authz?.trustedProvisioningClients;if(!Z)return;Z.forEach((Q,X)=>{let Y=`authz.trustedProvisioningClients[${X}]`;if(typeof Q.issuer!=="string"\|\|Q.issuer.length===0)throw Error(`${Y}: "issuer" is required and must be a non-empty string.`);if(typeof Q.clientId!=="string"\|\|Q.clientId.length===0)throw Error(`${Y}: "clientId" is required and must be a non-empty string.`);let J=Array.isArray(Q.audience)?Q.audience:[Q.audience];if(J.length===0\|\|J.some((_)=>typeof _!=="string"\|\|_.length===0))throw Error(`${Y}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(Q.permissions)\|\|Q.permissions.some((_)=>typeof _!=="string"\|\|_.length===0))throw Error(`${Y}: "permissions" must be an array of non-empty permission ids.`)})}function c6($){let Z=Array.isArray($)?$:[$];return Z.length>0&&Z.every((Q)=>typeof Q==="string"&&Q.length>0)}function i6($){let Z=$.workload;if(!Z\|\|typeof Z!=="object"\|\|Array.isArray(Z))return;let Q=Z,X=(Y,J)=>{if(!c6(Y.audience))throw Error(`${J}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in Q\|\|"outgoing"in Q){let Y=Q.incoming;if(Array.isArray(Y))Y.forEach((J,_)=>{if(J&&typeof J==="object")X(J,`workload.incoming[${_}]`)});else if(Y&&typeof Y==="object"&&"jwksUri"in Y)X(Y,"workload.incoming");return}if(e8(Q)){if("jwksUri"in Q&&!("clientId"in Q)&&!("workloadId"in Q))X(Q,"workload (server-only)");return}}function n6($,Z,Q){if($?.sso?.redirectUri&&Z.sso?.redirectUri){let X=S0($.sso.redirectUri),Y=S0(Z.sso.redirectUri);if(X!==Y)Q.error(`SSO redirectUri path mismatch: the framework derives "${Y}" from basePath, but ConfigSource reports "${X}". Register "${Y}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function Z9($){let Z={};if(!$)return Z;for(let[Q,X]of Object.entries($))if(X.type==="vault"&&typeof X.lfv?.deliveryEndpoint==="string"&&typeof X.lfv?.eventsEndpoint==="string")Z[Q]=X.lfv;return Z}function s6($){return $[u$]}function a6($,Z){let Q=Z9($.secrets??void 0),X=S0(Z.deliveryEndpoint),Y=S0(Z.eventsEndpoint),J=S0(Z.path);for(let _ of Object.values(Q)){if(S0(_.deliveryEndpoint)!==X)continue;if(S0(_.eventsEndpoint)!==Y)continue;let z=_.path?S0(_.path):void 0;if(J&&z&&J!==z)continue;return!0}return!1}function t6($,Z){let Q=s6(Z);if(!Q)return $;if(a6($,Q))return $;let X={type:"vault",lfv:{path:Q.path,lfvServerUrl:Q.lfvServerUrl,clientId:Q.clientId,deliveryTimeout:Q.deliveryTimeout,retryInterval:Q.retryInterval,warnInterval:Q.warnInterval,deliveryEndpoint:Q.deliveryEndpoint,eventsEndpoint:Q.eventsEndpoint,verifyJwks:Q.verifyJwks}},Y=$.secrets??{},J=j9(Y,{clientId:Q.clientId,path:Q.path});return{...$,secrets:{...Y,[J]:X}}}function r6($,Z){let Q=Z9($.secrets),X=Z9(Z.secrets??void 0);for(let[Y,J]of Object.entries(X)){let _=Q[Y];if(!_)continue;let z=S0(_.deliveryEndpoint),G=S0(J.deliveryEndpoint);if(z&&G&&z!==G)throw Error(`LFV deliveryEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${z}, framework path: ${G}`);let K=S0(_.eventsEndpoint),H=S0(J.eventsEndpoint);if(K&&H&&K!==H)throw Error(`LFV eventsEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${K}, framework path: ${H}`)}}function o6($){return new Set(Object.keys($.secrets??{}))}function e6($){return new Set(Object.keys($.secrets??{}))}function $Q($){let Z=$.workload;if(!Z\|\|typeof Z!=="object"\|\|Array.isArray(Z))return new Set;if(!("outgoing"in Z))return new Set;let Q=Z.outgoing;if(!Q\|\|typeof Q!=="object"\|\|Array.isArray(Q))return new Set;return new Set(Object.keys(Q))}function e8($){if(!$\|\|typeof $!=="object"\|\|Array.isArray($))return!1;let Z=$;return"clientId"in Z\|\|"jwksUri"in Z\|\|"workloadId"in Z}function ZQ($){let Z=$.workload;if(!Z\|\|typeof Z!=="object"\|\|Array.isArray(Z))return new Set;let Q=Z;if("incoming"in Q\|\|"outgoing"in Q){let X=Q.outgoing;if(!X\|\|typeof X!=="object"\|\|Array.isArray(X))return new Set;return new Set(Object.keys(X))}if(e8(Q))return new Set;return new Set(Object.keys(Q).filter((X)=>X!=="default"))}function QQ($,Z,Q){let X=Z.secrets??{},Y=$.secrets??{};for(let[K,H]of Object.entries(X)){let V=Y[K];if(!V)continue;if(H.type&&V.type&&H.type!==V.type)throw Error(`Secrets source "${K}" type in framework config must match ConfigSource type. ConfigSource type: ${V.type}, framework type: ${H.type}`)}let J=o6(Z),_=e6($);for(let K of J)if(!_.has(K))Q.warn(`Framework config declares secrets source "${K}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let K of _)if(!J.has(K))Q.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:K});let z=$Q(Z),G=ZQ($);for(let K of z)if(!G.has(K))Q.warn(`Framework config declares outgoing workload client "${K}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(Z.otel!==void 0&&Z.otel!==null&&$.otel===void 0)Q.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function u8($,Z){if(Z===void 0)return!1;return j6($,Z)}function XQ($,Z){if(typeof Z!=="number"\|\|Z<=0)return $;return new Promise((Q,X)=>{let Y=setTimeout(()=>{X(Error(`Ionite ready() timed out after ${Z}ms`))},Z);$.then(()=>{clearTimeout(Y),Q()},(J)=>{clearTimeout(Y),X(J)})})}function YQ($,Z,Q){if(typeof Z!=="number"\|\|Z<=0)return $;return new Promise((X,Y)=>{let J=setTimeout(()=>{Y(Error(Q))},Z);$.then((_)=>{clearTimeout(J),X(_)},(_)=>{clearTimeout(J),Y(_)})})}function X9(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function l8($){return $==="/"?$:$.replace(/\/+$/,"")}function o4($,Z){return l8($)===l8(Z)}function c8($){return $.method==="GET"\|\|$.method==="HEAD"}function JQ($){if($.isReady()&&$.config?.readyz?.enabled===!1)return H0();let Z=$.readiness();return Response.json(GQ(Z),{status:Z.ok?200:503})}function GQ($){let Z=$.config.lastError;if(!Z)return $;return{...$,config:{...$.config,lastError:{kind:Z.kind,phase:Z.phase,at:Z.at,message:"[redacted]"}}}}var KQ={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz"};function zQ($){let Z=$?.providers;if(!Z)return!1;return Object.values(Z).some((Q)=>Q.enabled!==!1&&Q.type!=="magic-link")}function T0($,Z,Q={}){let X=KQ[$],Y=Z.modules[X],J=Q.capable??!0,_=Y.active&&Y.ready&&J,z=_?void 0:!Y.active\|\|!Y.ready?Y.reason:Q.incapableReason??`${$} is not testable by this application wiring`;return{module:X,active:Y.active,ready:Y.ready,testable:_,...Q.urls&&Q.urls.length>0?{urls:Q.urls}:{},...z?{reason:z}:{}}}function _Q($,Z,Q){let X=v0(Z),Y=$.readiness();return{basePath:Z,urls:X,modules:Y.modules,capabilities:{"sso.login":T0("sso.login",Y,{urls:[X.sso.loginUrl,X.sso.callbackUrl,X.sso.userUrl]}),"sso.jit":T0("sso.jit",Y,{capable:Q.sso?.enableJitUserProvisioning!==!1,incapableReason:"SSO JIT user provisioning is disabled in FrameworkConfig."}),"sso.logout":T0("sso.logout",Y,{urls:[X.sso.logoutUrl]}),"sso.back_channel_logout":T0("sso.back_channel_logout",Y,{urls:[X.sso.logoutBackChannelUrl]}),"ciam.magic_link":T0("ciam.magic_link",Y,{capable:Q.ciam?.enableJitUserProvisioning!==!1,urls:[X.ciam.magicLinkUrl,X.ciam.magicLinkLoginUrl],incapableReason:"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":T0("ciam.oidc_login",Y,{capable:zQ(Q.ciam),urls:[X.ciam.customerLoginUrl,X.ciam.customerCallbackUrl,X.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":T0("ciam.customer",Y,{urls:[X.ciam.customerUrl]}),"ciam.logout":T0("ciam.logout",Y,{urls:[X.ciam.logoutUrl]}),"iam.users":T0("iam.users",Y,{capable:Boolean(Q.iam?.userStore),urls:[X.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":T0("iam.groups",Y,{capable:Boolean(Q.authz?.catalogStore\|\|Q.authz?.catalog),urls:[X.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"workload.incoming":T0("workload.incoming",Y,{urls:[X.workload.validateUrl,X.workload.jwksUrl]}),"workload.outgoing":T0("workload.outgoing",Y,{}),"authz.oaa":T0("authz.oaa",Y,{capable:Boolean(Q.authz?.accessStore&&(Q.authz?.catalogStore\|\|Q.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."})}}}async function HQ($,Z,Q){if(!Z.isReady())return X9();if(Z.config?.capabilitiez!==!0\|\|!Q)return H0();let X=await e0($,Z,s8["capabilitiez.read"]);if(X)return X;return Response.json(Q.build(),{status:200})}async function BQ($,Z,Q){if(!Z.isReady())return X9();if(Z.config?.authz?.oaa?.fullSync?.enabled!==!0)return H0();let X=await e0($,Z,s8["authz.oaa.sync"]);if(X)return X;let Y=Z.authz?.oaa;if(!Y?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let J=Z.authz?await Z.authz.reconcile():void 0,_=Q.iam?.userStore,z=t8(Q.authz?.catalog?a8(Q.authz.catalog):void 0,Q.authz?.catalogStore),G=Q.authz?.accessStore,K=Q.authz?.resources;async functionH(){if(z)yieldK$((F,j)=>z.groups.list({start:F,limit:j}));if(K?.entitlements){let F=K.entitlements.bind(K);for await(let j of K$((B,D)=>K.list({start:B,limit:D})))yield*F(j).map((B)=>I6(B))}}let V=await Y.sync({users:_?K$((F,j)=>_.list({start:F,limit:j})):void 0,groups:z\|\|K?.entitlements?H():void 0,roles:z?K$((F,j)=>z.roles.list({start:F,limit:j})):void 0,permissions:z?K$((F,j)=>z.permissions.list({start:F,limit:j})):void 0,resources:K?K$((F,j)=>K.list({start:F,limit:j})):void 0,access:G?K$((F,j)=>G.list({start:F,limit:j})):void 0},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...V,reconcile:J})}function DQ($,Z,Q,X,Y,J){return async(_)=>{let z=new URL(_.url).pathname;if(o4(z,Q)){if(!c8(_))return V$(["GET"]);return JQ($)}if(o4(z,X)){if(!c8(_))return V$(["GET"]);return HQ(_,$,Y)}if(J&&o4(z,J.url)){if(_.method!=="POST")return V$(["POST"]);return BQ(_,$,J.frameworkConfig)}let G=$.secrets;if(!Boolean(G?.isLfvDeliveryRequest?.(_)\|\|G?.isLfvEventsRequest?.(_))&&!$.isReady())return X9();try{return await Z(_)}catch(H){return $.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},H),D$(H)}}}function i8($,Z,Q){if($)return Q&&!$.tenantId?{...$,tenantId:Q}:$;if(Z&&Q)return{tenantId:Q};return}function VQ($,Z){if(Z.authz===null)return;if(!$.authz&&!Z.authz)return;return{...$.authz,...Z.authz,oaa:$.authz?.oaa\|\|Z.authz?.oaa?{...$.authz?.oaa,...Z.authz?.oaa}:void 0}}function e4($){let Z=!1,Q=q0(`${$} module`,()=>Z);return{isReady:Q.isReady,ready:Q.ready,attach(X){if(Z=X!==void 0,Q.refresh(),!X)return;return Object.defineProperty(X,"isReady",{value:Q.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(X,"ready",{value:Q.ready,enumerable:!1,configurable:!0}),X}}}function Q9($){if(!$)return!1;return $.isReady?$.isReady():!1}function x$($,Z,Q,X){if(!$)return{active:!1,ready:!1,reason:Q};return Q9(Z)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:X}}function UQ(){let $=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:$(),ciam:$(),iam:$(),workload:$(),otel:$(),secrets:$(),authz:$()}}function FQ($,Z){let Q=$.isReady(),X=$.config;if(!Q\|\|!X)return{ok:!1,applied:Q,modules:UQ(),config:{...Z}};let Y=Boolean(X.workload)\|\|Boolean($.workload),J={sso:x$(Boolean(X.sso),$.sso,"sso not configured (no RemoteConfig.sso)","sso configured but not ready"),ciam:x$(Boolean(X.ciam),$.ciam,"ciam not configured (no RemoteConfig.ciam)","ciam configured but not ready"),iam:x$(Boolean(X.iam),$.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:x$(Y,$.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:x$(Boolean(X.otel),$.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(X.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!Q9($.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return $.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),authz:(()=>{if(!Boolean(X.authz?.oaa))return{active:!0,ready:!0};let G=$.authz?.oaa;return Q9(G)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})()};return{ok:Object.values(J).every((z)=>!z.active\|\|z.ready),applied:Q,modules:J,config:{...Z}}}function MQ($,Z){let Q=[];for(let X of Z){let Y=$.modules[X];if(!$.applied){Q.push({name:X,reason:"RemoteConfig has not been applied yet"});continue}if(!Y?.ready)Q.push({name:X,reason:Y?.reason??`${X} is not ready`})}return{ok:Q.length===0,notReady:Q}}function LQ($,Z,Q,X,Y,J){let _=Z.validators,z=R6($.cache);T6(z.jwks);let G=Z;if(z.session.read.enabled){let m=Z.sso?.sessionStore??Z.ciam?.sessionStore;if(m){let C=C4(m,z.session.read);G={...Z,sso:Z.sso?{...Z.sso,sessionStore:C}:Z.sso,ciam:Z.ciam?{...Z.ciam,sessionStore:C}:Z.ciam}}}let K={sessionCache:z.session},H=g0(_.workload,Q,$?.workload,Z.workload??void 0),V=Z.otel!==null?h9(Q,$?.otel,Z.otel??void 0):void 0,F=i8($?.sso,Z.sso,$.id),j=P6(_.sso,Q,F,G.sso??void 0,K),B={...$?.iam,...Z.iam},D=Z.authz?.catalog?a8(Z.authz.catalog):void 0,x=Boolean(B.url\|\|B.userStore\|\|Z.authz?.catalogStore\|\|D),M=J.update({mode:B.delta,url:B.url,audience:B.deltaAudience,tenantId:$.id},{workload:H,userStore:B.userStore,catalogStore:t8(D,Z.authz?.catalogStore),resources:Z.authz?.resources,idMapStore:B.deltaIdMapStore}),W;if(x&&!H){if(Object.keys($).length>0)Q.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");W=void 0}else W=q6(_.iam,Q,H,Y,Z.authz?.accessStore,Z.authz?.accessIndex,Z.authz?.catalogStore,D,Z.authz?.resources,$?.iam,Z.iam??void 0,M,Z.authz?.onAccessMutation,A6($.authz));let q=i8($?.ciam,Z.ciam,$.id),T=E6(_.ciam,Q,q,G.ciam??void 0,H,K);return{secret:X,workload:H,otel:V,sso:j,iam:W,ciam:T}}function $Z($,Z,Q,X,Y,J,_,z){let G=J.authz.update(VQ(Z,Q)),K=LQ(Z,Q,X,Y,G,J.iamDelta);$.id=Z.id,$.config=Z,$.secret=K.secret,$.secrets=J.secrets.update(Z.secrets,Q.secrets??void 0,Q.validators.secrets),$.workload=J.workload.update(K.workload),$.otel=J.otel.update(K.otel),$.authz=G,$.log=J.log.update($.otel?.logger??X),$.sso=J.sso.attach(K.sso),$.iam=J.iam.attach(K.iam),$.ciam=J.ciam.attach(K.ciam);let H=v0(_),V=(F)=>T4(F,$,z?.routing,H);$.handler=DQ($,V,H.readyzUrl,H.capabilitiezUrl,{build:()=>_Q($,_,Q)},{url:J9(_),frameworkConfig:Q})}function WQ($,Z,Q,X,Y,J,_,z){u6($.id,Z),l6(Z),i6(Z),n6(Z,Q,X),r6(Z,Q),QQ(Z,Q,X),$Z($,Z,Q,X,Y,J,_,z)}function n8($){if(!$.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return $.secret}async function OQ($,Z,Q,X,Y,J,_){let z=$,G=G9($,Z,Y.current,J);if(X.beforeChange){let K=r8(G,Y);_?.enter();let H;try{H=await X.beforeChange($,K,Q)}finally{_?.exit()}if(H?.config!==void 0)z=H.config;G=H?.frameworkConfig??K}return G=O$(G,Y.current),{effectiveRemoteConfig:z,effectiveFrameworkConfig:G}}function F5($,Z){let Q=x6(Z),{frameworkConfig:X,basePath:Y,stores:J,options:_}=Q,z=O$(t6(X,$),J),G=z.log\|\|r4,K={current:J},H={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:z},V={log:S6(G),secrets:G8(G),workload:M8(G),otel:f9(G),authz:N9(G),iamDelta:O4(G),sso:e4("sso"),iam:e4("iam"),ciam:e4("ciam")},F={},j,B,D=new Promise((p,$0)=>{j=p,B=$0}),x=!1,M,W,q=0,T={enter:()=>{q+=1},exit:()=>{q-=1}},m=Promise.resolve();function C(p){let $0=m.then(p,p);return m=$0.then(()=>{return},()=>{return}),$0}function c(p){if(x)throw Error(`Ionite instance has been closed and cannot call ${p}().`)}function Z0(){$.log=H.frameworkConfig.log??r4,$.validators=H.frameworkConfig.validators}let o={},E={log:G,id:void 0,config:void 0,secret:n8($),authz:void 0,configStatus:F,handler:async()=>H0(),ready:(p)=>{if(q>0&&H.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return XQ(D,p)},isReady:()=>H.remoteConfig!==void 0,readiness:()=>FQ(E,F),requireReady:(p)=>MQ(E.readiness(),p),close:()=>{if(x)return;if(x=!0,W)clearTimeout(W),W=void 0;M?.(),M=void 0;let p=[()=>V.secrets.close(),()=>V.authz.close(),()=>V.otel.shutdown()];for(let $0 of p)try{Promise.resolve($0()).catch((_0)=>{G.warn("Ionite close: module teardown failed",_0)})}catch(_0){G.warn("Ionite close: module teardown failed",_0)}j?.(),j=void 0,B=void 0},setStores:async(p)=>{c("setStores");let $0=b$(p);await C(()=>d($0))}};$Z(E,o,H.frameworkConfig,G,E.secret,V,Y,_),Z0();function N(){let p=F.lastError!==void 0;if(F.appliedAt=Date.now(),F.lastError=void 0,p)(E.log??G).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function P(p,$0){let _0=$9($0)??($0 instanceof Error?$0.message:String($0)),B0=v6($0),L=F.lastError===void 0;if(F.lastError={kind:B0,message:_0,at:Date.now(),phase:p},L)(E.log??G).error(p==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":B0,phase:p,error:_0})}function y(p,$0,_0){(E.log??G).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:p,"ion.config.hash":$0,"ion.config.apply_ms":_0})}async function S(p,$0){if(x)return;let _0=g8(p);if($0&&H.remoteConfig!==void 0&&_0===H.remoteConfigHash&&u8(p,H.remoteConfig))return;let B0=H.remoteConfig,L=B0===void 0?"initial":"update",b=Date.now(),g,a,t;try{let A=await OQ(p,H.frameworkConfig,H.remoteConfig,_,K,Y,T);if(g=A.effectiveRemoteConfig,a=g8(g),t=A.effectiveFrameworkConfig,$0&&_.beforeChange===void 0&&H.remoteConfig!==void 0&&a===H.remoteConfigHash&&u8(g,H.remoteConfig)&&t===H.frameworkConfig)return;let O=t.log\|\|r4;WQ(E,g,t,O,n8($),V,Y,_)}catch(A){throw P(L,A),A}H.remoteConfig=g,H.remoteConfigHash=a,H.frameworkConfig=t,Z0(),N(),await V.otel.settled();let J0=r8(H.frameworkConfig,K),V0=!1;try{_.afterChange?.(E,g,J0,B0)}catch(A){if((E.log??G).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:L,error:A instanceof Error?A.message:String(A)}),L==="initial"){V0=!0;let O=A instanceof Error?A:Error(`afterChange failed on initial load: ${String(A)}`);P("initial",O),B?.(O),B=void 0,j=void 0}}if(H.frameworkConfig=J0,Z0(),!V0)y(L,a,Date.now()-b);if(!V0&&j)j(),j=void 0}async function d(p){if(x)return;if(K.current=p,H.remoteConfig===void 0){H.frameworkConfig=O$(H.frameworkConfig,p),Z0();return}await S(H.remoteConfig,!1)}if($.subscribe)$.subscribe((p)=>{C(()=>S(p,!0)).catch(()=>{})},{mode:"wait"}).then((p)=>{if(x){p?.();return}M=p}).catch((p)=>{G.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:p instanceof Error?p.message:String(p)})});let i=m6(_.configRetry),e=[_.onConfigLoadError??g6(G)],Y0=0;function K0(){if(W=void 0,x)return;if(H.remoteConfig!==void 0)return;YQ($.load(),i.loadTimeoutMs,`ConfigSource initial load timed out after ${i.loadTimeoutMs}ms`).then(async(p)=>{Y0=0;try{await C(async()=>{if(H.remoteConfig!==void 0)return;await S(p,!0)})}catch($0){let _0=$0 instanceof Error?$0:Error(`Initial RemoteConfig application failed: ${String($0)}`);G.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:_0.message}),B?.(_0),B=void 0}},async(p)=>{if(x)return;Y0+=1;let $0=p6(Y0,i),_0=$9(p)??"RemoteConfig load failed",B0=y6(p),L=x0(p,"code"),b=x0(p,"status"),g={attempt:Y0,error:p,errorKind:B0,maxDelayMs:i.maxDelayMs,message:_0,nextDelayMs:$0,code:typeof L==="string"?L:void 0,status:typeof b==="number"?b:void 0,path:typeof x0(p,"path")==="string"?x0(p,"path"):void 0,sourceType:typeof x0(p,"sourceType")==="string"?x0(p,"sourceType"):void 0};if(!f6(p,B0)){let a=p instanceof Error?p:Error(`ConfigSource initial load failed with unrecoverable ${B0}: ${_0}`);G.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:B0,error:_0,code:g.code,status:g.status,path:g.path,sourceType:g.sourceType}),B?.(a),B=void 0;return}try{await d6(g,e)}catch(a){let t=a instanceof Error?a:Error("ConfigSource retry hook stopped RemoteConfig retrying");B?.(t),B=void 0;return}W=setTimeout(K0,$0)})}return K0(),E}export{b2 as workloadHandler,g0 as workload,z7 as withSetCookies,K7 as withDefaultExternalId,G7 as verifyUser,$8 as vaultSocketDiagnostics,J4 as vaultConfig,d4 as validateWorkloadToken,p2 as tenantManager,_6 as tenantConfigSource,p0 as subscribeSecretPathWithHttpPolling,J7 as sso,c9 as setVaultWebSocketCommandTimeout,Y7 as sendTenantWebhook,G6 as secretConfigSource,X7 as sameOriginRedirectRules,T4 as routeRequest,m8 as rewriteRequestPath,t4 as rewriteRequestForTenantPath,L6 as rewriteRequestForDefaultTenantUi,M6 as rewriteRequestForDefaultTenantApi,k2 as revokeWorkloadToken,f8 as resolveTenantFromRequest,Q7 as resolveRedirect,p9 as resolveDefaultRoute,Z7 as resolveCapturedRedirect,$7 as resolveAfterRedirect,z6 as registerConfigLocatorAssert,e5 as reconcileSubjectAccess,O6 as openbaoVault,o5 as listSsoClientIdsFromCookies,A5 as listGenerator,E$ as lfvVault,i2 as isVaultConfigWaitingForSecretError,n2 as isVaultConfigInvalidPayloadError,r5 as isRedirectAllowed,F5 as ionite,t5 as initiateLogin,l$ as iamDeltaIdMapKey,a5 as iam,n5 as hasScope,i5 as hasRole,c5 as hasPermission,l5 as hasGroup,u5 as hasAnyScope,d5 as hasAny,g5 as hasAllScope,p5 as hasAll,m5 as has,C2 as getWorkloadToken,w2 as getWorkload,f5 as getUser,h5 as getCustomer,O5 as generateULID,s4 as gcpConfig,v5 as expandRoot,L4 as escapeScimFilterValue,X6 as envConfig,e0 as enforceEndpointAuthz,y5 as discoverSessions,b5 as discoverSessionRecords,v0 as deriveIonUrls,k5 as defaultRedirectPolicies,F6 as createTenantIonResolver,W6 as createTenantIonHandler,C4 as createSessionReadCache,O4 as createManagedIamDelta,J$ as configSourceFromLocator,x8 as configSourceFromEnvValues,I8 as configLocatorFromEnvValues,C5 as collectReferencedDefinitions,Z8 as closeAllVaultSockets,w5 as ciam,S5 as captureRedirect,x5 as callback,P5 as blockDangerousUrls,n4 as azureConfig,i4 as awsConfig,R5 as allowSameOrigin,q5 as allowRelativePaths,T5 as allowOrigins,E5 as allowHosts,P0 as VaultSubscribeNotSupportedError,Y$ as VaultConfigWaitingForSecretError,P$ as VaultConfigInvalidPayloadError,a$ as VAULT_MIN_POLLING_TTL_MS,i$ as ScimOutboundClient,N5 as IoniteError,a0 as InMemoryWorkloadTokenStore,p8 as InMemoryWorkloadIdentityStore,k$ as InMemoryUserStore,s5 as InMemoryTenantStore,C$ as InMemorySessionStore,A8 as InMemoryResourceStore,w$ as InMemoryMagicLinkStore,c$ as InMemoryIamDeltaIdMapStore,S$ as InMemoryCustomerStore,j8 as InMemoryAccessIndex,N8 as InMemoryAccessCatalogStore,d0 as InMemoryAccessAssignmentStore,K6 as ION_CAPABILITY_CATALOG,I5 as CatalogAdjacencyCache};
1	+ import{configTrustedClientGrants as A6,deepEqualPlain as E6,defaultLogger as r4,ION_ENDPOINT_PERMISSIONS as s8,listGenerator as K$,stableConfigHash as g8,toCodeCatalog as a8,unionCatalogRead as t8}from"@ionite/core";import{ciam as j6,configureJwksCache as T6,iam as q6,resolveCacheConfig as R6,sso as P6,withDefaultExternalId as I6}from"@ionite/core/server";import{trimTrailingSlash as Y9}from"@ionite/core";import{list as QZ}from"@ionite/core";class S${customers=new Map;userNameIndex=new Map;async get($){return this.customers.get($)}async lookup($){if($.id){let Z=this.customers.get($.id);if(Z)return Z}if($.userName){let Z=this.userNameIndex.get($.userName.toLowerCase());if(Z)return this.customers.get(Z)}return}async upsert($){let Z=$.id?.trim()\|\|crypto.randomUUID(),Q={...$,id:Z},X=this.customers.get(Z);if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase())}if(this.customers.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);return Q}async delete($){let Z=this.customers.get($);if(Z?.userName)this.userNameIndex.delete(Z.userName.toLowerCase());return this.customers.delete($),Z?1:0}async list($){let Z=Array.from(this.customers.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,_=Z.slice(Q,J);return QZ(Y,_,Q,X)}}class w${magicLinks=new Map;async create($,Z,Q){if(this.magicLinks.has($))throw Error(`Magic link with token ${$} already exists`);let X={token:$,customer:Z,createdAt:new Date,expiresAt:Q};this.magicLinks.set($,X)}async get($){let Z=this.magicLinks.get($);if(!Z)return null;if(Date.now()>Z.expiresAt.getTime())return this.magicLinks.delete($),null;return Z}async getAndDelete($){let Z=this.magicLinks.get($);if(this.magicLinks.delete($),!Z)return null;if(Date.now()>Z.expiresAt.getTime())return null;return Z}async delete($){this.magicLinks.delete($)}}function XZ($){let Z=$.expiresAt;if(!Z)return;let Q=Z instanceof Date?Z.getTime():new Date(Z).getTime();return Number.isNaN(Q)?void 0:Q}class C${sessions=new Map;async create($){if(this.sessions.has($.sid))throw Error(`Session with sid ${$.sid} already exists`);this.sessions.set($.sid,$)}async get($){let Z=this.sessions.get($);if(!Z)return null;let Q=XZ(Z);if(Q!==void 0&&Date.now()>Q)return this.sessions.delete($),null;return Z}async update($,Z){let Q=this.sessions.get($);if(!Q)throw Error(`Session with sid ${$} not found`);let X={...Q,...Z};this.sessions.set($,X)}async delete($){this.sessions.delete($)}}import{list as YZ}from"@ionite/core";class k${users=new Map;userNameIndex=new Map;async get($){return this.users.get($)}async lookup($){return this.users.get($.id??"")}async upsert($){let Z=$.id?.trim()\|\|crypto.randomUUID(),Q={...$,id:Z},X=this.users.get(Z);if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase())}if(this.users.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);return Q}async delete($){let Z=this.users.get($);if(Z){if(Z.userName)this.userNameIndex.delete(Z.userName.toLowerCase())}return this.users.delete($),Z?1:0}async list($){let Z=Array.from(this.users.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,_=Z.slice(Q,J);return YZ(Y,_,Q,X)}}class a0{tokens=new Map;async set($){this.tokens.set($.workload_id,$)}async get($){let Z=this.tokens.get($);if(!Z)return null;if(Date.now()>Z.expires_at.getTime())return this.tokens.delete($),null;return Z}async delete($){this.tokens.delete($)}async isValid($){return await this.get($)!==null}async cleanup(){let $=Date.now();for(let[Z,Q]of this.tokens.entries())if($>Q.expires_at.getTime())this.tokens.delete(Z)}}function v0($){let Z=Y9($\|\|z4);return{readyzUrl:`${Z}/readyz`,capabilitiezUrl:`${Z}/capabilitiez`,sso:{loginUrl:`${Z}/auth/login`,userUrl:`${Z}/auth/user`,logoutUrl:`${Z}/auth/logout`,logoutBackChannelUrl:`${Z}/auth/logout/backchannel`,refreshUrl:`${Z}/auth/refresh`,callbackUrl:`${Z}/auth/callback`},workload:{validateUrl:`${Z}/workload/validate`,jwksUrl:`${Z}/workload/jwks`},iam:{basePath:`${Z}/iam`,usersUrl:`${Z}/iam/Users`,groupsUrl:`${Z}/iam/Groups`},ciam:{magicLinkUrl:`${Z}/magic-link`,magicLinkLoginUrl:`${Z}/magic-link/login`,customerUrl:`${Z}/auth/customer`,customerLoginUrl:`${Z}/auth/customer/login`,customerCallbackUrl:`${Z}/auth/customer/callback`,customerProvidersUrl:`${Z}/auth/customer/providers`,logoutUrl:`${Z}/auth/customer/logout`}}}function J9($){return`${Y9($\|\|z4)}/authz/oaa/sync`}function JZ($,Z){if($===null)return null;let Q={validateUrl:Z.validateUrl,jwksUrl:Z.jwksUrl};if($&&typeof $==="object"&&(("incoming"in $)\|\|("outgoing"in $))){let X=$;return{...X,incoming:{...X.incoming,...Q}}}return{...$??{},...Q}}function G9($,Z,Q,X){let Y={...Z},J=v0(X);if(Y.sso!==null)if($.sso)Y.sso={...Y.sso,loginUrl:J.sso.loginUrl,userUrl:J.sso.userUrl,logoutUrl:J.sso.logoutUrl,logoutBackChannelUrl:J.sso.logoutBackChannelUrl,refreshUrl:J.sso.refreshUrl,redirectUri:J.sso.callbackUrl,sessionStore:Q.sessionStore,userStore:Q.userStore,enableJitUserProvisioning:Y.sso?.enableJitUserProvisioning??!0};else Y.sso=void 0;if(Y.iam!==null)if($.iam)Y.iam={...Y.iam,usersUrl:J.iam.usersUrl,groupsUrl:J.iam.groupsUrl,userStore:Q.userStore};else Y.iam=void 0;if(Y.workload!==null){if($.workload\|\|Y.workload)Y.workload=JZ(Y.workload,J.workload)}if(Y.ciam!==null)if($.ciam)Y.ciam={...Y.ciam,magicLinkUrl:J.ciam.magicLinkUrl,magicLinkLoginUrl:J.ciam.magicLinkLoginUrl,customerUrl:J.ciam.customerUrl,customerLoginUrl:J.ciam.customerLoginUrl,customerCallbackUrl:J.ciam.customerCallbackUrl,customerProvidersUrl:J.ciam.customerProvidersUrl,logoutUrl:J.ciam.logoutUrl,providers:$.ciam.providers,sessionStore:Q.sessionStore,customerStore:Q.customerStore,magicLinkStore:Q.magicLinkStore,enableJitUserProvisioning:Y.ciam?.enableJitUserProvisioning??!0};else Y.ciam=void 0;return Y}function O$($,Z){let Q={...$};if(Q.sso)Q.sso={...Q.sso,sessionStore:Z.sessionStore,userStore:Z.userStore};if(Q.iam)Q.iam={...Q.iam,userStore:Z.userStore,deltaIdMapStore:Z.deltaIdMapStore};if(Q.workload)Q.workload={...Q.workload,tokenStore:Z.workloadTokenStore,workloadIdentityStore:Z.workloadIdentityStore};if(Q.ciam)Q.ciam={...Q.ciam,sessionStore:Z.sessionStore,customerStore:Z.customerStore,magicLinkStore:Z.magicLinkStore};if(Q.authz!==null&&(Z.accessStore\|\|Z.accessIndex\|\|Z.catalog\|\|Z.catalogStore\|\|Z.resources))Q.authz={...Q.authz,accessStore:Z.accessStore,accessIndex:Z.accessIndex,catalog:Z.catalog,catalogStore:Z.catalogStore,resources:Z.resources};return Q}var z4="/api/ionite";function b$($){return{sessionStore:$?.sessionStore??new C$,userStore:$?.userStore??new k$,customerStore:$?.customerStore??new S$,accessStore:$?.accessStore,accessIndex:$?.accessIndex,catalog:$?.catalog,catalogStore:$?.catalogStore,resources:$?.resources,magicLinkStore:$?.magicLinkStore??new w$,workloadTokenStore:$?.workloadTokenStore??new a0,workloadIdentityStore:$?.workloadIdentityStore,deltaIdMapStore:$?.deltaIdMapStore}}function y$(){return z4}import{accessRefId as U4,accessRootId as vZ,configTrustedClientGrants as hZ,listGenerator as O9,toCodeCatalog as fZ}from"@ionite/core";import{CatalogAdjacencyCache as mZ,expandRoot as pZ,reconcileSubjectAccess as gZ,withDefaultExternalId as dZ}from"@ionite/core/server";import{accessRefId as h0,accessRootId as GZ,ION_AUTHZ_GROUP_SCHEMA as KZ}from"@ionite/core";import{collectReferencedDefinitions as zZ,withDefaultExternalId as _Z}from"@ionite/core/server";function q0($,Z,Q=(X)=>Error(`${$} ready timed out after ${X}ms`)){let X=!1,Y,J,_=()=>{X=!1,J=new Promise((K)=>{Y=K})};_();let z=()=>{X=!0,Y?.(),Y=void 0},G=()=>{if(Z()){if(!X)z();return}if(X)_()};return G(),{isReady:()=>Z(),ready:(K)=>{if(Z())return Promise.resolve();let H=J;if(!K\|\|K<=0)return H;return new Promise((V,F)=>{let E=setTimeout(()=>F(Q(K)),K);H.then(()=>{clearTimeout(E),V()},(B)=>{clearTimeout(E),F(B)})})},refresh:G,settle:z}}var _9="App",HZ="ionite",H9=104857600,BZ=H9,DZ=10485760,_4=3,VZ=250,UZ={};function l0($,Z){return Z.mapGroup?Z.mapGroup($):$}class b0 extends Error{retryable;code;status;warnings;constructor($,Z={}){super($,{cause:Z.cause});this.name="OaaError",this.retryable=Z.retryable??!1,this.code=Z.code,this.status=Z.status,this.warnings=Z.warnings,Object.setPrototypeOf(this,b0.prototype)}}function FZ($){let Z=$();return Boolean(Z?.url&&Z.providerId&&Z.datasourceId)}function B9($,Z,Q,X,Y){let J=async(z)=>{await z9($,W0(Z),z,{mode:"incremental"})},_=q0("OAA",()=>FZ(Z),(z)=>new b0(`OAA ready timed out after ${z}ms`,{code:"not_ready"}));return{isReady:_.isReady,ready:_.ready,refreshReadiness:_.refresh,async pushUser(z){let G=W0(Z);await J(j0(G,{local_users:[V9(z,"modify")]},!0))},async pushGroup(z){let G=W0(Z),K=Q(),H=l0(z,K),V=f$(H,u0(G),"add"),F=await H4(H,"group",Y?.(),K,G);await J(j0(G,N$({local_groups:[t0(H,"modify")],identity_to_permissions:V?[V]:[]},F),!0))},async pushRole(z){let G=W0(Z),K=Q(),H=K.mapRole?K.mapRole(z):z,V=await H4(H,"role",Y?.(),K,G);await J(j0(G,N$({local_roles:[r0(H,"modify")]},V),!0))},async pushPermission(z){let G=W0(Z);await J(j0(G,{permissions:[H$(z,Q().mapPermissionTypes,"modify")]},!0))},async pushResource(z){let G=W0(Z),K=Q(),H=K.mapResource?K.mapResource(z):z,V=await EZ(H,Y?.(),K);await J(j0(G,{resources:V},!0))},async grant(z){let G=W0(Z),K=Q(),H=await D9(z,Y?.(),K,G);await J(K9(G,z,"add",K,H))},async revoke(z){let G=W0(Z);await J(K9(G,z,"delete",Q()))},async pushAccessChanges(z){if(z.length===0)return;let G=W0(Z),K=Q(),H=Y?.(),V=await LZ(G,z,K,H);await J(V)},async deleteUser(z){let G=W0(Z);await J(j0(G,{local_users:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteGroup(z){let G=W0(Z);await J(j0(G,{local_groups:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteRole(z){let G=W0(Z);await J(j0(G,{local_roles:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deletePermission(z){let G=W0(Z);await J(j0(G,{permissions:[{name:z,unique_id:z,permission_type:[],operation:"delete"}]},!0))},async deleteResource(z){let G=W0(Z);await J(j0(G,{resources:[{name:z,id:z,resource_type:"",operation:"delete"}]},!0))},async sync(z,G){let K=W0(Z),H=G?.mode==="incremental",V=H?void 0:X?.(),F=await MZ(K,z,Q(),H,V);return z9($,K,F,G)}}}function W0($){let Z=$();if(!Z?.url\|\|!Z.providerId\|\|!Z.datasourceId)throw new b0("OAA is not configured",{code:"not_configured"});return Z}async function MZ($,Z,Q,X,Y){let J=[],_=[],z=[],G=[],K=[],H=[],V=X?"modify":void 0,F=new Set,E=(D)=>GZ(D);for await(let D of _$(Z.users))J.push(V9(D,V));for await(let D of _$(Z.groups)){let x=l0(D,Q);_.push(t0(x,V));let M=f$(x,u0($),X?"add":void 0);if(M)H.push(M)}for await(let D of _$(Z.roles)){let x=Q.mapRole?Q.mapRole(D):D;K.push(r0(x,V))}for await(let D of _$(Z.permissions))G.push(H$(D,Q.mapPermissionTypes,V));let B=[];for await(let D of _$(Z.resources)){let x=Q.mapResource?Q.mapResource(D):D;B.push(x)}z.push(...U9(B,V));for await(let D of _$(Z.access))if(F.add(E(D)),h$(D,H,J,u0($),X?"add":void 0),typeof D.target!=="string")if(D.targetType==="role"){let x=Q.mapRole?Q.mapRole(D.target):D.target;K.push(r0(x,V))}else if(D.targetType==="permission")G.push(H$(D.target,Q.mapPermissionTypes,V));else{let x=l0(D.target,Q);_.push(t0(x,V))}for(let D of Y??[]){let x=E(D);if(F.has(x))continue;F.add(x);let M=h0(D.subject);if(M&&!J.some((W)=>h0(W.unique_id??W.name)===M))J.push({name:M,unique_id:M,is_active:!0,operation:V,custom_properties:{identity_type:"workload",source:"eci-trusted"}});h$(D,H,J,u0($),V)}return j0($,{local_users:J,local_groups:_,local_roles:K,resources:z,permissions:G,identity_to_permissions:H},X)}function j0($,Z,Q){let X={name:$.applicationName??_9,application_type:$.applicationType??HZ,local_users:Z.local_users??[],local_groups:Z.local_groups??[],local_roles:Z.local_roles??[],resources:Z.resources??[],custom_properties:{},tags:[]};if(Q)X.operation="modify";return O0({applications:[X],permissions:Z.permissions??[],identity_to_permissions:Z.identity_to_permissions??[],is_incremental:Q?!0:void 0})}function K9($,Z,Q,X=UZ,Y){let J=[],_=[],z=[],G=[],K=[];h$(Z,J,_,u0($),Q);let H=Q==="delete"?"delete":"modify";if(typeof Z.target!=="string")if(Z.targetType==="role"){let F=X.mapRole?X.mapRole(Z.target):Z.target;G.push(r0(F,H))}else if(Z.targetType==="permission")K.push(H$(Z.target,X.mapPermissionTypes,H));else{let F=l0(Z.target,X);z.push(t0(F,H))}let V={local_users:_,local_groups:z,local_roles:G,permissions:K,identity_to_permissions:J};return j0($,Y?N$(V,Y):V,!0)}async function LZ($,Z,Q,X){let Y=u0($),J=[],_=[],z=[],G=[],K=[],H=[],V=[],F=[];for(let{change:B,op:D}of Z){h$(B,D==="delete"?G:_,D==="delete"?z:J,Y,D==="delete"?"delete":"add");let q=D==="delete"?"delete":"modify";if(typeof B.target!=="string")if(B.targetType==="role"){let T=Q.mapRole?Q.mapRole(B.target):B.target;H.push(r0(T,q))}else if(B.targetType==="permission")V.push(H$(B.target,Q.mapPermissionTypes,q));else{let T=l0(B.target,Q);K.push(t0(T,q))}if(D==="add")F.push(await D9(B,X,Q,$))}let E={local_users:[...J,...z],local_groups:K,local_roles:H,permissions:V,identity_to_permissions:[..._,...G]};return j0($,N$(E,...F),!0)}function N$(...$){let Z={},Q=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let X of $)for(let Y of Q){let J=X[Y];if(J&&J.length>0)Z[Y]=[...Z[Y]??[],...J]}return Z}async function H4($,Z,Q,X,Y){if(!Q)return{};let J=await zZ($,Z,{catalog:Q.catalog,code:Q.code,resources:Q.resources,cache:Q.cache}),_=[];for(let z of J.groups){let G=l0(z,X),K=f$(G,u0(Y),"add");if(K)_.push(K)}return{local_groups:J.groups.map((z)=>t0(l0(z,X),"modify")),local_roles:J.roles.map((z)=>r0(X.mapRole?X.mapRole(z):z,"modify")),permissions:J.permissions.map((z)=>H$(z,X.mapPermissionTypes,"modify")),resources:J.resources.map((z)=>m$(X.mapResource?X.mapResource(z):z,"modify")),identity_to_permissions:_}}async function D9($,Z,Q,X){if(!Z)return{};if($.targetType!=="group"&&$.targetType!=="role")return{};let Y=h0($.target);if(!Y)return{};let J=typeof $.target==="string"?await WZ($.targetType,Y,Z):$.target;if(!J)return{};let _={};if(typeof $.target==="string")if($.targetType==="group"){let G=l0(J,Q),K=f$(G,u0(X),"add");_={local_groups:[t0(G,"modify")],identity_to_permissions:K?[K]:[]}}else{let G=Q.mapRole?Q.mapRole(J):J;_={local_roles:[r0(G,"modify")]}}let z=await H4(J,$.targetType,Z,Q,X);return N$(_,z)}async function WZ($,Z,Q){if(Q.cache)return await Q.cache.getNode($,Z);let X=$==="group"?Q.code?.groups.get(Z):Q.code?.roles.get(Z);if(X)return X;let J=await($==="group"?Q.catalog?.groups:Q.catalog?.roles)?.get(Z);if(J)return J;if($==="group")return _Z(await Q.resources?.entitlement?.(Z));return}function h$($,Z,Q,X,Y){let J=h0($.subject),_=h0($.target);if($.targetType==="group"){let H=Q.find((V)=>h0(V.unique_id??V.name)===J);if(H){let V=new Set(H.groups??[]);if(V.add(_),H.groups=[...V],Y)H.operation=Y}else Q.push({name:J,unique_id:J,groups:[_],operation:Y});return}let z={identity:J,identity_type:"local_user",operation:Y},G=$.resources??[],K=$.applyToApplication??G.length===0;if($.targetType==="role")z.role_assignments=[{application:X,role:_,apply_to_application:K,resources:G,operation:Y}];else z.application_permissions=[{application:X,permission:_,apply_to_application:K,resources:G,operation:Y}];Z.push(z)}function V9($,Z){return O0({name:$.displayName??$.name??$.userName??$.id,unique_id:$.id,identities:OZ($),groups:$.groups?.map((Q)=>Q.value),is_active:$.active,created_at:CZ($.createdAt),custom_properties:O0({ecid:$.ecid,accountClass:$.accountClass,externalId:$.externalId,userName:$.userName,tenantId:$.tenantId}),tags:[],operation:Z})}function OZ($){let Z=$.email?[$.email]:$.emails?.map((X)=>X.value).filter(Boolean)??[],Q=[...$.ecid?[$.ecid]:[],...Z];return Q.length>0?Q:void 0}function t0($,Z){let Q=NZ($),X=D0($,"id")??D0($,"externalId")??D0($,"name")??D0($,"displayName"),Y=D0($,"displayName")??D0($,"name")??X??"group",J=v$($,"resources");return O0({name:Y,unique_id:X,custom_properties:O0({requestable:Q?.requestable??kZ($,"requestable"),description:Q?.description??D0($,"description"),type:Q?.type,externalId:D0($,"externalId"),resources:J.length>0?J:void 0}),tags:[],operation:Z})}function NZ($){let Z=$[KZ];if(!Z\|\|typeof Z!=="object"\|\|Array.isArray(Z))return;return Z}function v$($,Z){if(!$\|\|typeof $!=="object")return[];let Q=$[Z];if(!Array.isArray(Q))return[];return Q.map(h0).filter((X)=>X.length>0)}function AZ($){return D0($,"id")??D0($,"externalId")??D0($,"name")??D0($,"displayName")??"group"}function f$($,Z,Q){let X=v$($,"resources"),Y=X.length>0,J=!Y,_=Y?X:[],z=v$($,"roles").map((K)=>({application:Z,role:K,apply_to_application:J,resources:_,operation:Q})),G=v$($,"permissions").map((K)=>({application:Z,permission:K,apply_to_application:J,resources:_,operation:Q}));if(z.length===0&&G.length===0)return;return{identity:AZ($),identity_type:"local_group",role_assignments:z.length>0?z:void 0,application_permissions:G.length>0?G:void 0,operation:Q}}function r0($,Z){return O0({name:$.name,unique_id:$.id,permissions:$.permissions?.map((Q)=>typeof Q==="string"?Q:Q.id),custom_properties:O0({displayName:$.displayName,requestable:$.requestable,externalId:$.externalId,...$.metadata}),tags:[],operation:Z})}function H$($,Z,Q){return O0({name:$.name,unique_id:$.id,permission_type:Z?.($)??$.permissionTypes??[$.action??"Uncategorized"],apply_to_sub_resources:$.applyToSubResources,resource_types:$.resourceTypes,operation:Q})}function m$($,Z,Q,X=new Set){let Y=$.id;if(Y&&X.has(Y))return O0({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,custom_properties:O0({externalId:$.externalId,...$.metadata}),tags:[],operation:Z});if(Y)X.add(Y);let J=[];for(let _ of $.resources??[]){let z=typeof _==="string"?Q?.get(_):_;if(z)J.push(m$(z,Z,Q,X))}if(Y)X.delete(Y);return O0({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,sub_resources:J.length>0?J:void 0,custom_properties:O0({externalId:$.externalId,...$.metadata}),tags:[],operation:Z})}function U9($,Z){if($.length===0)return[];let Q=new Map;for(let G of $)if(G.id)Q.set(G.id,G);let X=new Map,Y=new Set,J=(G,K)=>{if(!K.id\|\|K.id===G)return;let H=X.get(G)??[];if(!H.some((V)=>V.id===K.id))H.push(K);X.set(G,H),Y.add(K.id)};for(let G of $){for(let H of G.resources??[]){let V=typeof H==="string"?Q.get(H):H;if(V&&G.id)J(G.id,V)}let K=h0(G.parent);if(K&&Q.has(K)&&G.id)J(K,G)}let _=(G)=>{if(!G.id)return G;let K=X.get(G.id);if(!K\|\|K.length===0)return G;return{...G,resources:K.map(_)}};return $.filter((G)=>!G.id\|\|!Y.has(G.id)).map(_).map((G)=>m$(G,Z,Q))}async function EZ($,Z,Q){if(!Z)return[m$($,"modify")];let X=async(H)=>{if(Z.cache)return await Z.cache.getNode("resource",H);return Z.resources?.get(H)},Y=async(H)=>{if(Z.resources?.children&&H.id&&(!H.resources\|\|H.resources.length===0))return Z.resources.children(H.id);let V=[];for(let F of H.resources??[]){let E=typeof F==="string"?await X(F):F;if(E)V.push(E)}return V},J=$,_=new Set;while(!0){let H=h0(J.parent);if(!H\|\|_.has(H))break;_.add(H);let V=await X(H);if(!V)break;J=V}let z=[],G=[J],K=new Set;while(G.length>0){let H=G.shift();if(!H)break;if(H.id&&K.has(H.id))continue;if(H.id)K.add(H.id);let V=Q.mapResource?Q.mapResource(H):H;z.push(V);for(let F of await Y(H))G.push(F)}if($.id&&!K.has($.id))z.push(Q.mapResource?Q.mapResource($):$);return U9(z,"modify")}async function z9($,Z,Q,X){let Y=JSON.stringify(O0(Q)),J=X?.compression??Z.compression??"gzip",_=J==="gzip"?await xZ(Y):Y,z=wZ(_),G=X?.maxPayloadBytes??Z.maxPayloadBytes??H9,K=X?.multipart??Z.multipart??"auto",H=X?.multipartThresholdBytes??Z.multipartThresholdBytes??BZ;if(z>G&&K==="never")throw new b0("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(K==="always"\|\|K==="auto"&&z>H)return TZ($,Z,_,J,X);return jZ(Z,{id:Z.datasourceId,data_source_id:Z.datasourceId,json_data:_,compression_type:J==="gzip"?"GZIP":"NONE"})}async function jZ($,Z){let Q=`${W9($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:push`,X=await p$(Q,{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"},body:JSON.stringify(Z)});return M9(X)}async function TZ($,Z,Q,X,Y){let J=Y?.partSizeBytes??Z.partSizeBytes??DZ,_=await qZ(Z,X),z=SZ(Q,J);for(let K=0;K<z.length;K++)await RZ(Z,_,K+1,z[K]??"");let G=await PZ(Z,_,z.length);return $.debug("OAA multipart payload pushed",{uploadId:_,parts:z.length}),{...G,uploadId:G.uploadId??_,parts:G.parts??z.length}}async function qZ($,Z){let Q=B4($,"multipart/start"),X=await p$(Q,{method:"POST",headers:D4($),body:JSON.stringify({data_source_id:$.datasourceId,compression_type:Z==="gzip"?"GZIP":"NONE"})}),Y=await V4(X),J=D0(Y,"upload_id")??D0(Y,"uploadId")??D0(Y,"id");if(!J)throw new b0("OAA multipart start response did not include an upload id",{code:"invalid_response"});return J}async function RZ($,Z,Q,X){let Y=B4($,`multipart/${encodeURIComponent(Z)}/parts/${Q}`);await p$(Y,{method:"PUT",headers:D4($),body:JSON.stringify({upload_id:Z,sequence:Q,data:X})})}async function PZ($,Z,Q){let X=B4($,`multipart/${encodeURIComponent(Z)}/complete`),Y=await p$(X,{method:"POST",headers:D4($),body:JSON.stringify({upload_id:Z,parts:Q})});return M9(Y)}function B4($,Z){return`${W9($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:${Z}`}function D4($){return{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"}}async function p$($,Z){let Q;for(let X=0;X<_4;X++){try{let Y=await fetch($,Z);if(!F9(Y.status)\|\|X===_4-1){if(!Y.ok)await IZ(Y);return Y}Q=new b0(`OAA request failed with retryable status ${Y.status}`,{retryable:!0,status:Y.status})}catch(Y){if(Q=Y,Y instanceof b0&&!Y.retryable)throw Y;if(X===_4-1)break}await yZ(VZ2X)}throw new b0("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:Q})}function F9($){return $===429\|\|$>=500}async function IZ($){let Z=await V4($).catch(()=>{return}),Q=D0(Z,"message")??D0(Z,"error")??`OAA request failed with status ${$.status}`;throw new b0(Q,{code:D0(Z,"code")??"http_error",status:$.status,retryable:F9($.status),warnings:L9(Z?.warnings)})}async function M9($){let Z=await V4($).catch(()=>{return});return{success:$.ok,syncToken:D0(Z,"sync_token")??D0(Z,"syncToken"),uploadId:D0(Z,"upload_id")??D0(Z,"uploadId"),parts:bZ(Z,"parts"),warnings:L9(Z?.warnings),metadata:Z}}async function V4($){let Z=await $.text();if(!Z)return{};let Q=JSON.parse(Z);return Q&&typeof Q==="object"&&!Array.isArray(Q)?Q:{}}async function xZ($){let Z=new Blob([$]).stream().pipeThrough(new CompressionStream("gzip")),Q=await new Response(Z).arrayBuffer();return Buffer.from(Q).toString("base64")}function SZ($,Z){let Q=[];for(let X=0;X<$.length;X+=Z)Q.push($.slice(X,X+Z));return Q}function wZ($){return Buffer.byteLength($,"utf8")}function CZ($){if(!$)return;return $ instanceof Date?$.toISOString():$}function D0($,Z){if(!$\|\|typeof $!=="object")return;let Q=$[Z];return typeof Q==="string"&&Q.length>0?Q:void 0}function kZ($,Z){if(!$\|\|typeof $!=="object")return;let Q=$[Z];return typeof Q==="boolean"?Q:void 0}function bZ($,Z){if(!$\|\|typeof $!=="object")return;let Q=$[Z];return typeof Q==="number"?Q:void 0}function L9($){if(!Array.isArray($))return;let Z=$.filter((Q)=>typeof Q==="string");return Z.length>0?Z:void 0}async function_$($){if(!$)return;for await(let Z of $)yield Z}function O0($){if(Array.isArray($))return $.map(O0).filter((Q)=>Q!==void 0);if(!$\|\|typeof $!=="object"\|\|$ instanceof Date)return $===null?void 0:$;let Z=Object.entries($).map(([Q,X])=>[Q,O0(X)]).filter(([,Q])=>{if(Q===void 0)return!1;if(Array.isArray(Q)&&Q.length===0)return!1;if(Q&&typeof Q==="object"&&!Array.isArray(Q)&&Object.keys(Q).length===0)return!1;return!0});return Z.length>0?Object.fromEntries(Z):void 0}function W9($){return $.replace(/\/+$/,"")}function u0($){return $.applicationName??_9}function yZ($){return new Promise((Z)=>setTimeout(Z,$))}function uZ($,Z){if(!$)return;if($.groups.get(Z))return"group";if($.roles.get(Z))return"role";if($.permissions.get(Z))return"permission";return}function lZ($,Z,Q){(async()=>{let X=[],Y=async(J,_)=>{let z=J==="group"?Z.groups:J==="role"?Z.roles:Z.permissions;for(let G of _)if(await z.get(G))X.push(`${J}:${G}`)};if(await Y("group",Q.groups.list().map((J)=>J.id)),await Y("role",Q.roles.list().map((J)=>J.id)),await Y("permission",Q.permissions.list().map((J)=>J.id)),X.length>0)$.warn("Catalog store rows shadow code-declared entitlement ids; the code definitions win on read. Delete the store rows (they are inert) to clear this warning.",{"ion.operation":"authz.catalog.shadowed_rows","ion.outcome":"degraded",ids:X.sort()})})().catch((X)=>{$.debug?.("Shadowed-row catalog scan failed (non-fatal)",{error:X})})}function N9($){let Z,Q=!1,X,Y,J=B9($,()=>Z?.oaa,()=>({mapPermissionTypes:Z?.mapPermissionTypes,mapGroup:Z?.mapGroup,mapRole:Z?.mapRole,mapResource:Z?.mapResource}),()=>hZ(Z),()=>{let N=Z?.catalogStore;return N\|\|X?{catalog:N,code:X,resources:Z?.resources,cache:Y}:void 0}),_=(N)=>{if(Q\|\|!J.isReady())return;let{kind:P}=N;(N.op==="delete"?P==="role"?J.deleteRole(N.id):P==="permission"?J.deletePermission(N.id):J.deleteGroup(N.id):P==="role"?J.pushRole(N.entity):P==="permission"?J.pushPermission(N.entity):J.pushGroup(N.entity)).catch((S)=>{$.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:N.op,kind:P,error:S})})},z=(N)=>{if(Q\|\|!J.isReady())return;let P=Z?.resources;if(!P)return;(async()=>{if(N.deleted){await J.deleteResource(N.id);return}let S=await P.get(N.id);if(!S)return;await J.pushResource(S);for(let d of P.entitlements?.(S)??[])await J.pushGroup(dZ(d))})().catch((S)=>{$.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:N.id,deleted:N.deleted===!0,error:S})})},G,K,H,V,F=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),E=!1,B=()=>{let N=Z?.accessIndex;if(!N&&!E)E=!0,$.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return N},D=async(N)=>{let P=Z?.accessIndex,y=Z?.catalogStore;if(!P\|\|!y&&!X)return!1;let S=N.id??vZ(N),d=await pZ({...N,id:S},{catalog:y,code:X,resources:Z?.resources,cache:Y});return await P.materialize(S,d),!0},x=(N,P)=>gZ(N,P,{accessStore:Z?.accessStore,accessIndex:Z?.accessIndex,catalogStore:Z?.catalogStore,code:X,resources:Z?.resources},Y),M=async()=>{let N={subjects:0,roots:0,cleared:0},P=Z?.accessIndex,y=Z?.catalogStore;if(Q\|\|!P\|\|!y&&!X)return N;let S=new Map,d=(Y0)=>{let K0=U4(Y0.subject);if(!K0)return;let p=Y0.subjectType??"user";S.set(`${p}:${K0}`,{subject:K0,subjectType:p})},i=new Set,e=Z?.accessStore;if(e)for await(let Y0 of O9((K0,p)=>e.list({start:K0,limit:p}))){d({subject:U4(Y0.subject),subjectType:Y0.subjectType});let K0=U4(Y0.target);if(Y&&K0&&typeof Y0.target==="string"){if(!await Y.getNode(Y0.targetType,K0))i.add(`${Y0.targetType}:${K0}`)}}if(i.size>0)$.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog, catalog store, or resource derivation). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...i].sort()});if(P.listSubjects)for(let Y0 of await P.listSubjects())d(Y0);for(let Y0 of S.values()){let K0=await x(Y0.subject,Y0.subjectType??"user");if(N.subjects+=1,N.roots+=K0,K0===0)N.cleared+=1}return N},W=()=>{if(Q)return Promise.resolve({subjects:0,roots:0,cleared:0});return M()},q=Promise.resolve(),T=!1,m=(N,P)=>{let y=q.then(async()=>{if(Q)return;try{await P()}catch(S){$.warn(`${N} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:N,error:S instanceof Error?S.message:String(S)})}});return q=y,y},C=(N)=>{if(T)return;T=!0,m(N,async()=>{T=!1,await M()})},c=()=>q,Z0=(N)=>{if(Q)return;let P=Z?.accessStore;if(!Z?.accessIndex\|\|!Z?.catalogStore\|\|!P)return;if(Y?.invalidate(N),N.op==="set"){let y=N.kind,S=N.entity.id;m("catalog-change",async()=>{for await(let d of O9((i,e)=>P.listByTarget(y,S,{start:i,limit:e})))await D(d)})}else C("catalog-delete")},o=(N)=>{if(Q)return;if(Y?.clear(),!Z?.accessIndex\|\|!Z?.catalogStore&&!X\|\|!Z?.accessStore)return;C("resource-change")},j={oaa:J,get accessIndex(){return Z?.accessIndex},has(N,P,y,S,d){let i=B();return i?i.has(N,P,y,S,d):Promise.resolve(F())},hasGroup(N,P,y,S){let d=B();return d?d.hasGroup(N,P,y,S):Promise.resolve(F())},hasRole(N,P,y,S){let d=B();return d?d.hasRole(N,P,y,S):Promise.resolve(F())},hasPermission(N,P,y,S){let d=B();return d?d.hasPermission(N,P,y,S):Promise.resolve(F())},hasAny(N,P,y){let S=B();return S?S.hasAny(N,P,y):Promise.resolve(F())},hasAll(N,P,y){let S=B();return S?S.hasAll(N,P,y):Promise.resolve(F())},reconcile(){return W()},settle(){return c()}};return{update(N){if(Q)return j;if(N?.resources&&Boolean(N.resources.entitlements)!==Boolean(N.resources.entitlement))throw Error("AuthzConfig.resources: `entitlements(resource)` and `entitlement(id)` must be provided together (the derivation and its reverse resolver are both app-authored).");let P=N?.catalog?fZ(N.catalog):void 0,y=P!==X;X=P,Z=N,J.refreshReadiness();let S=N?.catalogStore,d=N?.resources;if(S!==G\|\|d!==H\|\|y){if(K?.(),V?.(),Y=S\|\|X?new mZ(S,d,X):void 0,K=S?.afterChange?S.afterChange((i)=>{if(i.op==="set"&&uZ(X,i.entity.id))$.warn("Catalog store row shadows a code-declared entitlement id; the code definition wins on read",{"ion.operation":"authz.catalog.shadowed_row","ion.outcome":"degraded",id:i.entity.id,kind:i.kind});_(i),Z0(i)}):void 0,V=d?.changed?d.changed((i)=>{o(i),z(i)}):void 0,G=S,H=d,S&&X)lZ($,S,X)}else if(Y)Y.clear();return j},close(){if(Q)return;Q=!0,K?.(),K=void 0,V?.(),V=void 0,G=void 0,H=void 0,Y=void 0}}}function A9($){return $.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+\|_+$/g,"")\|\|"EMPTY"}function cZ($){let Z=`${$.clientId}\x00${$.path}`,Q=2166136261;for(let X=0;X<Z.length;X+=1)Q^=Z.charCodeAt(X),Q=Math.imul(Q,16777619);return(Q>>>0).toString(36)}function iZ($){let Z=A9($.clientId),Q=A9($.path);return`LFV_${Z}__${Q}`}function E9($,Z){let Q=iZ(Z);if(!(Q in $))return Q;let X=`${Q}_${cZ(Z)}`;if(!(X in $))return X;return`${X}_ALT`}import{defaultLogger as rQ}from"@ionite/core";import{defaultLogger as aZ,stableConfigHash as tZ}from"@ionite/core";import{verifyLfvSignature as rZ}from"@ionite/core/server";var B$=new Map;function nZ($){if(!$)return"/";return $.startsWith("/")?$:`/${$}`}function sZ($){try{let Z=new URL($),Q=Z.pathname.replace(/\/+$/g,"");return`${Z.origin}${Q}`}catch{return $.replace(/\/+$/g,"")}}function g$($){let Z=sZ($.lfvServerUrl),Q=nZ($.path);return`${Z}\|${Q}`}function j9($,Z,Q){let X=B$.get($)??new Map;return X.set(Z,Q),B$.set($,X),()=>{let Y=B$.get($);if(!Y)return;if(Y.delete(Z),Y.size===0)B$.delete($)}}async function T9($,Z,Q,X){let Y=B$.get($);if(!Y)return 0;let J=0;for(let[_,z]of Y){if(Q&&_===Q)continue;if(z.trustId!==X)continue;if(!z.onDelivery)continue;J+=1,await z.onDelivery(Z)}return J}async function q9($,Z,Q,X){let Y=B$.get($);if(!Y)return 0;let J=0;for(let[_,z]of Y){if(Q&&_===Q)continue;if(z.trustId!==X)continue;if(!z.onEvents)continue;J+=1,await z.onEvents(Z)}return J}function R9($){try{return new URL($).pathname}catch{return $.startsWith("/")?$:`/${$}`}}var oZ=1e4,eZ=1e4,$1=300;async function S9($){await new Promise((Z)=>setTimeout(Z,$))}function f0($){return{startedAt:Date.now(),timeout:typeof $?.timeout==="number"&&$.timeout>0?$.timeout:void 0}}function E$($){if($.timeout===void 0)return;let Z=Date.now()-$.startedAt;return Math.max(0,$.timeout-Z)}function c0($,Z,Q){return Error(`LFV ${$} timed out after ${Q.timeout??0}ms for ${Z}`)}async function A$($,Z,Q,X,Y){let J=E$(Q);if(J!==void 0){if(J<=0)throw c0(X,Y,Q);let _=new AbortController,z=setTimeout(()=>_.abort(),J);try{return await fetch($,{...Z,signal:_.signal})}catch(G){if(G instanceof Error&&G.name==="AbortError")throw c0(X,Y,Q);throw G}finally{clearTimeout(z)}}return await fetch($,Z)}class R0 extends Error{constructor($){super(`LFV source closed while operating on ${$}`);this.name="LfvSourceClosedError"}}function d$($){return $ instanceof R0\|\|$ instanceof Error&&$.name==="LfvSourceClosedError"}function F4($){try{let Z=JSON.parse($);return typeof Z==="object"&&Z!==null&&!Array.isArray(Z)?Z:void 0}catch{return}}async function P9($,Z,Q,X,Y,J,_,z,G,K){let H=0,V=Date.now();for(;;){if(K?.())throw new R0(X);let F=E$(Q);if(F!==void 0&&F<=0)throw c0(Y,X,Q);try{return await $()}catch(E){if(E instanceof R0)throw E;if(K?.())throw new R0(X);if(H+=1,_>0&&Date.now()-V>=_){let D=`Error connecting to the LFV source. Retries: '${H}'`;if(z)z(G,D,{url:Z,path:X,operation:Y});V=Date.now()}let B=F===void 0?J:Math.min(J,F);if(B<=0)throw c0(Y,X,Q);if(await S9(B),K?.())throw new R0(X)}}}function Z1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function I9($){if(typeof $==="number"&&Number.isFinite($))return $;if(typeof $==="string"&&$.trim()){let Z=Date.parse($.trim());if(!Number.isNaN(Z))return Z}return}function x9($){return`[LFV] [${$??"-"}] [${new Date().toISOString()}]: `}function M4($,Z){if(typeof $!=="string"\|\|$.trim()==="")throw Error(`LFV source requires "${Z}"`);return $}function Q1($){return{...$,lfvServerUrl:M4($.lfvServerUrl,"lfvServerUrl"),clientId:M4($.clientId,"clientId"),path:M4($.path,"path")}}function j$($){let Z=Q1($),Q=Z.log??aZ,X=(U,R,v)=>{let f=x9(U)+R;if(v!==void 0)Q.debug(f,v);else Q.debug(f)},Y=(U,R,v)=>{let f=x9(U)+R;if(v!==void 0)Q.warn(f,v);else Q.warn(f)},J=Z.lfvServerUrl,_=Z.clientId,z=Z.path,G=Z.verifyJwks,K=typeof Z.deliveryTimeout==="number"&&Z.deliveryTimeout>0?Z.deliveryTimeout:void 0,H=typeof Z.retryInterval==="number"&&Z.retryInterval>0?Z.retryInterval:oZ,V=typeof Z.warnInterval==="number"&&Z.warnInterval>=0?Z.warnInterval:eZ,F=(typeof Z.callbackMaxAgeSeconds==="number"&&Z.callbackMaxAgeSeconds>0?Z.callbackMaxAgeSeconds:$1)1000,E=typeof Z.cacheMaxAgeSeconds==="number"&&Z.cacheMaxAgeSeconds>0?Z.cacheMaxAgeSeconds1000:void 0,B=G?.trim()?tZ(G.trim()):void 0,D=R9(Z.deliveryEndpoint),x=R9(Z.eventsEndpoint),M=g$({lfvServerUrl:J,path:z}),W=crypto.randomUUID(),q=new Map,T=new Map,m=new Map,C=new Map,c=new Map,Z0=new Map,o=new Map,j=new Map,N=new Map,P=!1,y,S=new Set,d=()=>P;function i(U,R){T.set(U,R),m.set(U,Date.now())}function e(U){T.delete(U),m.delete(U)}function Y0(U){let R=T.get(U);if(!R)return;if(E!==void 0){let v=m.get(U)??0;if(Date.now()-v>E){X(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:U});return}}return R}function K0(){if(P){if(y)y(),y=void 0;return}let U=q.size>0,R=o.size>0\|\|j.size>0,v=U\|\|R;if(v&&!y){y=j9(M,W,{trustId:B,onDelivery:async(f)=>{l(f)},onEvents:async(f)=>{C0(f)}});return}if(!v&&y)y(),y=void 0}async function p(U,R,v,f){if(P)throw new R0(U);let n=v??crypto.randomUUID(),s=f??f0(),X0=new Promise((L0,k0)=>{let F0={resolve:L0,reject:k0},E0=E$(s);if(E0!==void 0){if(E0<=0){k0(c0("issueOtp",U,s));return}F0.timer=setTimeout(()=>{j.delete(n),K0(),k0(c0("issueOtp",U,s))},E0)}j.set(n,F0),K0()});X0.catch(()=>{});let G0=()=>{let L0=j.get(n);if(!L0)return;if(L0.timer)clearTimeout(L0.timer);j.delete(n),K0()},N0={request_id:n,path:U,action:R};X(n,"OTP request",{path:U,action:R});let M0;try{M0=await P9(async()=>{return await A$(`${J.replace(/\/+$/g,"")}/clients/${_}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":n},body:JSON.stringify(N0)},s,"issueOtp",U)},J,s,U,"issueOtp",H,V,Y,n,d)}catch(L0){throw G0(),L0}if(M0.status!==200&&M0.status!==202)throw G0(),Error(`LFV OTP request failed (${M0.status}) for ${U}`);try{let L0=await X0;return X(n,"OTP received via signed callback",{path:U,action:R}),L0}finally{G0()}}async function $0(U,R,v,f,n,s){if(P)throw new R0(R);let X0=n??crypto.randomUUID(),G0=s??f0(),N0=await p(R,v,X0,G0),M0=await P9(async()=>{return await A$(`${J.replace(/\/+$/g,"")}${U}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":X0},body:JSON.stringify({request_id:X0,otp:N0,path:R,...f??{}})},G0,v,R)},J,G0,R,v,H,V,Y,X0,d);if(M0.status!==200&&M0.status!==202)throw Error(`LFV ${v} failed (${M0.status}) for ${R}`);return X(X0,`${v} accepted`,{path:R,status:M0.status}),{requestId:X0}}async function _0(U,R,v){if(P)throw new R0(U);let f=Y0(U);if(f)return f;let n=N.get(U);if(n)return n;let s=B0(U,R,v);N.set(U,s),s.catch((X0)=>{if(d$(X0))X(R,"read aborted: source closed",{path:U})});try{return await s}finally{N.delete(U)}}async function B0(U,R,v){let f=v?.timeout??K,n={startedAt:Date.now(),timeout:typeof f==="number"&&f>0?f:void 0},s,X0=new Promise((F0,E0)=>{s={resolve:F0,reject:E0};let s0=o.get(U)??new Set;s0.add(s),o.set(U,s0),K0()});X0.catch(()=>{});let G0=()=>{if(!s)return;let F0=o.get(U);if(F0?.delete(s),F0&&F0.size===0)o.delete(U);K0()},N0=R??crypto.randomUUID();X(N0,"read_secret request",{path:U});let M0=0,L0=Date.now();for(;;){if(P)throw G0(),new R0(U);try{await $0("/secrets/request",U,"read_secret",void 0,N0,n),X(N0,"read_secret accepted, awaiting delivery",{path:U});break}catch(F0){if(F0 instanceof R0)throw G0(),F0;let E0=E$(n);if(E0!==void 0&&E0<=0)throw G0(),c0("read_secret",U,n);if(M0+=1,V>0&&Date.now()-L0>=V)Y(N0,`read_secret retrying. Retries: '${M0}'`,{path:U}),L0=Date.now();let s0=E0===void 0?H:Math.min(H,E0);if(s0<=0)throw G0(),c0("read_secret",U,n);await S9(s0)}}let k0=E$(n);if(k0!==void 0){if(k0<=0)throw G0(),Error(`LFV delivery timed out while reading ${U}`);let F0;try{return await Promise.race([X0,new Promise((E0,s0)=>{F0=setTimeout(()=>{G0(),s0(Error(`LFV delivery timed out while reading ${U}`))},k0)})])}finally{if(F0)clearTimeout(F0)}}return await X0}function L(U,R,v){if(v!==void 0){let s=c.get(U);if(s!==void 0&&v<s){X(void 0,"delivery ignored: stale version",{path:U,realVersion:v,lastAccepted:s});return}c.set(U,v)}i(U,R),S.delete(U);let f=R.metadata.version;if(C.get(U)===f)return;C.set(U,f);let n=q.get(U);if(!n)return;for(let s of n)s(R)}async function b(U,R){return await _0(U,void 0,R)}async function g(U,R,v){if(!Z1(R))throw Error(`putSecret requires an object value for LFV source at path ${U}`);let f=f0(v);if(await J0(U,v)){await $0("/secrets/update",U,"update_secret",{data:R},void 0,f),e(U);return}await $0("/secrets/create",U,"create_secret",{data:R},void 0,f),e(U)}async function a(U,R){let v=f0(R);await $0("/secrets/delete",U,"delete_secret",void 0,void 0,v),e(U)}async function t(U,R){let v=f0(R),f=crypto.randomUUID();X(f,"list_paths request",{path:U});let n=await p(U,"list_paths",f,v),s=await A$(`${J.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":f},body:JSON.stringify({request_id:f,otp:n,path:U})},v,"listPaths",U);if(s.status!==200)throw Error(`LFV listPaths failed (${s.status}) for ${U}`);let X0=await s.json();if(!Array.isArray(X0.items))throw Error(`LFV listPaths returned invalid payload for ${U}`);return X(f,"list_paths success",{path:U,status:200}),X0.items.filter((G0)=>typeof G0==="string")}async function J0(U,R){let v=f0(R),f=crypto.randomUUID();X(f,"exists request",{path:U});let n=await p(U,"read_metadata",f,v),s=await A$(`${J.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":f},body:JSON.stringify({request_id:f,otp:n,path:U})},v,"exists",U);if(s.status!==200)throw Error(`LFV exists failed (${s.status}) for ${U}`);let X0=await s.json();if(typeof X0.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${U}`);return X(f,"exists success",{path:U,status:200,exists:X0.exists}),X0.exists}async function V0(U,R,v){let f=f0(v);await $0("/secrets/rotate/request",U,"request_rotate",{reason:R?.reason,severity:R?.severity,incident_ref:R?.incidentRef},void 0,f)}async function A(U,R,v){let f=f0(v);await $0("/secrets/revoke/request",U,"request_revoke",{reason:R?.reason,severity:R?.severity,incident_ref:R?.incidentRef},void 0,f)}async function O(U,R){let v=f0(R),f=crypto.randomUUID();X(f,"getMetadata request",{path:U});let n=await p(U,"read_metadata",f,v),s=await A$(`${J.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":f},body:JSON.stringify({request_id:f,otp:n,path:U})},v,"getMetadata",U);if(s.status!==200)throw Error(`LFV getMetadata failed (${s.status}) for ${U}`);let X0=await s.json();if(!X0.metadata\|\|typeof X0.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${U}`);return X(f,"getMetadata success",{path:U,status:200}),X0.metadata}async function w(U,R,v){let f=q.get(U)??new Set,n,s=(G0)=>{if(G0.metadata.version===n)return;n=G0.metadata.version,R(G0)};f.add(s),q.set(U,f);let X0=Y0(U);if(X0)s(X0),C.set(U,X0.metadata.version);else try{s(await b(U,v))}catch(G0){if(f.delete(s),f.size===0)q.delete(U);throw G0}return K0(),()=>{let G0=q.get(U);if(!G0)return;if(G0.delete(s),G0.size===0)q.delete(U);K0()}}function I(U){return U.method==="POST"&&new URL(U.url).pathname===D}function k(U){return U.method==="POST"&&new URL(U.url).pathname===x}function u(U){let R=U.data?.metadata?.path;if(typeof R==="string"&&R)return R;if(typeof U.path==="string"&&U.path)return U.path;return}function h(U,R){let v=o.get(U);if(!v\|\|v.size===0)return!1;o.delete(U),K0();for(let f of v)f.resolve(R);return!0}function r(U){let{request_id:R,otp:v}=U;if(typeof R!=="string"\|\|typeof v!=="string"\|\|!v)return{handled:!1};let f=j.get(R);if(!f)return{handled:!1};if(f.timer)clearTimeout(f.timer);return j.delete(R),K0(),f.resolve(v),{handled:!0}}function l(U){if(U.type==="otp")return r(U);let R=u(U);if(!R)return X(U.request_id,"delivery ignored: no path",{}),{handled:!1};let v=U.data?.metadata??{},f=typeof v.version==="number"?v.version:void 0,n={data:U.data?.data??{},metadata:{path:R,version:f??0,created:new Date}};L(R,n,f);let s=h(R,n);return X(U.request_id,"delivery applied",{path:R,handled:s}),{handled:s}}function z0(U="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:U}),{status:401,headers:{"Content-Type":"application/json"}})}async function Q0(U,R){if(!G?.trim())return Y(void 0,"LFV callback rejected: verifyJwks is not configured"),z0("LFV callback verification is not configured");let v=U.headers.get("X-LFV-Request-Id")??U.headers.get("x-lfv-request-id")??"",f=U.headers.get("X-LFV-Key-Id")??U.headers.get("x-lfv-key-id")??"",n=U.headers.get("X-LFV-Signature")??U.headers.get("x-lfv-signature")??"";if(!v.trim()\|\|!f.trim()\|\|!n.trim())return Y(v\|\|void 0,"LFV callback rejected: missing signature headers"),z0("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await rZ({jwks:G,kid:f,signatureB64Url:n.trim(),requestId:v.trim(),rawBody:R}))return Y(v,"LFV callback rejected: signature verification failed"),z0();let X0=F4(R);if(!X0)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let G0=X0;if(G0.request_id!==v.trim())return Y(v,"LFV callback rejected: request_id header/body mismatch"),z0("X-LFV-Request-Id does not match request_id in body");let N0=Date.now(),M0=I9(G0.issued_at);if(M0===void 0)return Y(v,"LFV callback rejected: missing or invalid issued_at"),z0("Missing or invalid issued_at");if(N0-M0>F)return Y(v,"LFV callback rejected: stale (outside freshness window)"),z0("Callback is stale (issued_at outside freshness window)");let L0=I9(G0.expires_at);if(L0!==void 0&&N0>L0)return Y(v,"LFV callback rejected: expired"),z0("Callback has expired");let k0=n.trim();for(let[F0,E0]of Z0)if(E0<=N0)Z0.delete(F0);if(Z0.has(k0))return Y(v,"LFV callback rejected: replayed signature"),z0("Callback signature already processed (replay)");return Z0.set(k0,M0+F),null}async function z$(U){let R=await U.text(),v=await Q0(U,R);if(v)return v;let f=F4(R);if(!f)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let n=f,s=u(n);X(n.request_id,"delivery received",{path:s});let X0=l(n),G0=s?g$({lfvServerUrl:J,path:s}):M,N0=await T9(G0,n,W,B);if(!X0.handled&&N0===0)return new Response(JSON.stringify({status:"accepted",note:"unmapped_delivery"}),{status:200,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function C0(U){if(P)return;if(!U?.path\|\|typeof U.path!=="string")return;if(X(U.request_id,"events payload",{path:U.path,event:U.event}),U.event==="created"\|\|U.event==="updated"\|\|U.event==="rotated"\|\|U.event==="revoked")e(U.path),_0(U.path,U.request_id).catch((R)=>{if(d$(R)){X(U.request_id,"event refresh aborted: source closed",{path:U.path});return}S.add(U.path),Y(U.request_id,"event-triggered refresh failed; source marked degraded",{path:U.path,event:U.event,error:R instanceof Error?R.message:String(R)})})}async function W$(U){let R=await U.text(),v=await Q0(U,R);if(v)return v;let f=F4(R);if(!f)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let n=f;if(!n?.path\|\|typeof n.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});X(n.request_id,"events received",{path:n.path,event:n.event}),C0(n);let s=g$({lfvServerUrl:J,path:n.path});return await q9(s,n,W,B),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function ZZ(){if(P)return;if(P=!0,y)y(),y=void 0;let U=new R0(z);for(let R of o.values())for(let v of R)try{v.reject(U)}catch{}o.clear();for(let R of j.values()){if(R.timer)clearTimeout(R.timer);try{R.reject(U)}catch{}}j.clear(),N.clear(),S.clear(),T.clear(),m.clear(),C.clear(),c.clear(),Z0.clear(),q.clear()}return{type:"vault",isAvailable:()=>S.size===0,getFullSecret:b,getSecret:async(U,R)=>{return(await b(U,R)).data},putSecret:g,deleteSecret:a,listPaths:t,exists:J0,requestRotate:V0,requestRevoke:A,getMetadata:O,subscribe:w,close:ZZ,isDeliveryRequest:I,isEventsRequest:k,handleDelivery:z$,handleEvents:W$,deliveryPath:D,eventsPath:x,callbackKey:M,trustId:B}}function o0($,Z,Q){if(typeof $!=="string"\|\|$.trim()==="")throw Error(`"${Z}" is required when using ${Q}`);return $}var u$="__esLfvBootstrap";import{withDefaultExternalId as X1}from"@ionite/core/server";function l$($){return[$.tenantId??"_",$.destination,$.resourceType,$.externalId].join("\x00")}class c${map=new Map;async get($){return this.map.get(l$($))}async set($,Z){this.map.set(l$($),Z)}async delete($){this.map.delete(l$($))}}function L4($){return $==="user"?"Users":"Groups"}function W4($){return $.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class i${baseUrl;getToken;idMapStore;tenantId;log;fetchImpl;inflight=new Map;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.getToken=$.getToken,this.idMapStore=$.idMapStore,this.tenantId=$.tenantId,this.log=$.log,this.fetchImpl=$.fetchImpl??((Z,Q)=>fetch(Z,Q))}async headers(){let $=await this.getToken();return new Headers({"Content-Type":"application/scim+json",Accept:"application/scim+json",Authorization:`Bearer ${$}`})}inflightKey($,Z){return`${$}\x00${Z}`}async resolveProviderId($,Z,Q){let X={tenantId:this.tenantId,destination:this.baseUrl,resourceType:$,externalId:Z},Y=await this.idMapStore.get(X);if(Y)return{found:Y};let J=this.inflightKey($,Z),_=this.inflight.get(J);if(_)return _;let z=this.resolveUncached($,Z,Q).then(async(G)=>{if(typeof G==="object")await this.idMapStore.set(X,G.found);return G}).finally(()=>{this.inflight.delete(J)});return this.inflight.set(J,z),z}async resolveUncached($,Z,Q){let X=await this.filterByExternalId($,Z);if(X!=="absent")return X;if(!Q)return"absent";return this.create($,Z,Q)}async filterByExternalId($,Z){let Q=encodeURIComponent(`externalId eq "${W4(Z)}"`),X=`${this.baseUrl}/${L4($)}?filter=${Q}`,Y=await this.fetchImpl(X,{method:"GET",headers:await this.headers()});if(!Y.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:$,status:Y.status}),"error";let _=((await Y.json()).Resources??[])[0]?.id;return _?{found:_}:"absent"}async create($,Z,Q){let X=`${this.baseUrl}/${L4($)}`,Y=$==="user"?{schemas:["urn:ietf:params:scim:schemas:core:2.0:User"],userName:Q.userName??Z,externalId:Z,displayName:Q.displayName,active:!0}:{schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:Q.displayName??Z,externalId:Z},J=await this.fetchImpl(X,{method:"POST",headers:await this.headers(),body:JSON.stringify(Y)});if(!J.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:$,status:J.status}),"error";let _=await J.json();return _.id?{found:_.id}:"error"}async invalidate($,Z){await this.idMapStore.delete({tenantId:this.tenantId,destination:this.baseUrl,resourceType:$,externalId:Z})}async patchGroupMembership($){let{groupExternalId:Z,userExternalId:Q,op:X}=$,Y=await this.resolveProviderId("user",Q,X==="add"?$.userCreate:void 0);if(Y==="error")return this.log.warn("IAM delta: user lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(Y==="absent")return this.log.warn("IAM delta: user not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let J=Y.found,_=async(K)=>{let H=await this.resolveProviderId("group",Z,X==="add"&&K?$.groupCreate:void 0);if(H==="error")return{kind:"error"};if(H==="absent")return{kind:"absent"};let V=`${this.baseUrl}/${L4("group")}/${encodeURIComponent(H.found)}`,F=X==="add"?[{op:"add",path:"members",value:[{value:J}]}]:[{op:"remove",path:`members[value eq "${W4(J)}"]`}];return{kind:"response",response:await this.fetchImpl(V,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:PatchOp"],Operations:F})})}},z=await _(!0);if(z.kind==="response"&&(z.response.status===404\|\|z.response.status===410))await this.invalidate("group",Z),z=await _(!1);if(z.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(z.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let G=z.response;if(!G.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X,status:G.status}),"error";return"pushed"}}function O4($){if(typeof $==="string")return $;if($&&typeof $==="object"&&"id"in $)return $.id;return}function w9($){return $&&typeof $==="object"?$:void 0}function N4($){let Z={},Q={},X,Y,J,_,z,G,K=new Promise((W)=>{G=W}),H=()=>{if(!Z.url\|\|!Q.workload)return!1;return Z.mode==="patch"&&Boolean(Q.idMapStore)},V=()=>{if(G&&H())G(),G=void 0},F=async()=>{let W=Q.workload;if(!W)throw Error("IAM delta: workload identity not configured");if(Z.audience&&typeof W.getToken==="function")return W.getToken(Z.audience);if(typeof W.getServerToken==="function")return W.getServerToken();return W.getToken()},E=()=>{if(!H()\|\|!Z.url\|\|!Q.idMapStore)return;let W=`${Z.tenantId??"_"}\x00${Z.url}`;if(X&&Y===W&&J===Q.idMapStore&&_===Q.fetchImpl)return X;return X=new i$({baseUrl:Z.url,getToken:F,idMapStore:Q.idMapStore,tenantId:Z.tenantId,log:$,fetchImpl:Q.fetchImpl}),Y=W,J=Q.idMapStore,_=Q.fetchImpl,X},B=async(W)=>{let T=w9(W.subject);if(!T){let C=O4(W.subject);if(C&&Q.userStore)T=await Q.userStore.get(C)}let m=T?.externalId;if(!m)return;return{externalId:m,create:{userName:T?.userName??m,displayName:T?.displayName??T?.name}}},D=async(W)=>{let T=w9(W.target);if(!T){let C=O4(W.target);if(C&&Q.catalogStore)T=await Q.catalogStore.groups.get(C);if(C&&!T)T=X1(await Q.resources?.entitlement?.(C))}let m=T?.externalId;if(!m)return;return{externalId:m,create:{displayName:T?.displayName??T?.name??m}}},x=async(W,q)=>{if(!H())return"skipped";if(W.targetType!=="group")return $.debug("IAM delta: non-group target skipped (not representable as SCIM membership)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",targetType:W.targetType}),"skipped";let T=await B(W),m=await D(W);if(!T\|\|!m)return $.warn("IAM delta: missing externalId on subject or target; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:q,hasSubject:Boolean(T),hasGroup:Boolean(m)}),"skipped";let C=E();if(!C)return"skipped";return C.patchGroupMembership({groupExternalId:m.externalId,userExternalId:T.externalId,op:q,groupCreate:m.create,userCreate:T.create})},M={async onGrant(W){if(!H())return;if(await x(W,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(W){if(!H())return;if(await x(W,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async reconcile(W){let q={pushed:0,skipped:0,errors:[]};if(!H())return q.errors.push("iam delta not ready"),q;for await(let T of W)try{let m=await x(T,"add");if(m==="pushed")q.pushed+=1;else if(m==="error")q.errors.push(`IAM delta: destination rejected membership push for ${O4(T.target)??"unknown"}`);else q.skipped+=1}catch(m){q.errors.push(m instanceof Error?m.message:String(m))}return q},isReady:H,ready(W){if(H())return Promise.resolve();if(!W\|\|W<=0)return K;return Promise.race([K,new Promise((q,T)=>setTimeout(()=>T(Error("IAM delta readiness timeout")),W))])}};return{update(W,q){if(Z=W,!q.idMapStore)z??=new c$;return Q={...q,idMapStore:q.idMapStore??z},E(),V(),M}}}import{IoniteError as Y1}from"@ionite/core";function J1($){if($ instanceof Y1)return{status:$.status,statusText:$.statusText};if(typeof $!=="object"\|\|$==null)return;let Z=$,Q=typeof Z.status==="number"?Z.status:void 0,X=typeof Z.statusText==="string"?Z.statusText:void 0;return Q!=null\|\|X?{status:Q,statusText:X}:void 0}function D$($){if($ instanceof Response)return $;let Z=J1($);if(!Z)return Response.json({error:"internal_error"},{status:500});let X={status:Z.status??500};if(Z.statusText)X.statusText=Z.statusText;return Response.json({error:Z.statusText??"internal_error"},X)}function H0(){return Response.json({error:"not_found"},{status:404})}function V$($=["GET"]){return Response.json({error:"method_not_allowed",allow:$},{status:405,headers:{Allow:$.join(", ")}})}import{context as G1,trace as K1}from"@opentelemetry/api";import{logs as z1,SeverityNumber as U$}from"@opentelemetry/api-logs";import{OTLPLogExporter as _1}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as H1}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as B1}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as D1}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as V1}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as U1}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as F1}from"@opentelemetry/resources";import{BatchLogRecordProcessor as M1}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as L1}from"@opentelemetry/sdk-metrics";import{NodeSDK as W1}from"@opentelemetry/sdk-node";function C9($,Z,Q){for(let X of $)try{X()}catch(Y){Z.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:Q,error:Y instanceof Error?Y.message:String(Y)})}}function i0($,Z){let Q=new Set,X=new Set;return{beforeChange(Y){return Q.add(Y),()=>{Q.delete(Y)}},afterChange(Y){return X.add(Y),()=>{X.delete(Y)}},emitBefore(){C9(Q,$,`${Z} beforeChange`)},emitAfter(){C9(X,$,`${Z} afterChange`)}}}var k9={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},O1={trace:!1,debug:!1,info:!0,warn:!0,error:!0};function A4($,Z){let Q=Z[$];if(Q===!1)return!1;if($==="metrics")return Q===!0\|\|typeof Q==="object";return!0}function E4($){return typeof $==="object"&&$!==null?$:void 0}function N1($){return typeof $==="object"&&$!==null?$:void 0}function A1($,Z){let Q=$.replace(/\/+$/,"");if(Q.endsWith(k9[Z]))return Q;return`${Q}${k9[Z]}`}function E1($,Z){let Q=E4($[Z]);if(Q?.endpoint)return Q.endpoint;if(!$.endpoint)return;return A1($.endpoint,Z)}function j1($,Z,Q){let X=E4($[Z]),Y={...$.headers,...X?.headers??{}};if(Q)Y.Authorization=`Bearer ${Q}`;return Y}function j4($,Z,Q){let X=E4($[Z]);return{url:E1($,Z),headers:j1($,Z,Q),timeoutMillis:X?.timeoutMillis,concurrencyLimit:X?.concurrencyLimit}}function T1($,Z){let Q=j4($,"traces",Z);return $.protocol==="http/json"?new V1(Q):new U1(Q)}function q1($,Z){let Q=j4($,"metrics",Z);return $.protocol==="http/json"?new B1(Q):new D1(Q)}function R1($,Z){let Q=j4($,"logs",Z);return $.protocol==="http/json"?new _1(Q):new H1(Q)}function P1($){return{"service.name":$.name,...$.version?{"service.version":$.version}:{},...$.deploymentEnvironment?{"deployment.environment.name":$.deploymentEnvironment}:{},...$.resourceAttributes??{}}}async function I1($){if(!$.oauth)return;let Z=new URLSearchParams({grant_type:"client_credentials",client_id:$.oauth.clientId,client_secret:$.oauth.clientSecret});if($.oauth.scope)Z.set("scope",$.oauth.scope);if($.oauth.audience)Z.set("audience",$.oauth.audience);let Q=await fetch($.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...$.oauth.headers??{}},body:Z});if(!Q.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${Q.status}`);let X=await Q.json();if(typeof X.access_token!=="string"\|\|!X.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return X.access_token}function x1($,Z){return{...O1,...Z?.levels??{},...$.levels??{}}}function q$($,Z="Authorization"){let Q={...$.headers??{}};if(!$.apiKey)return Q;let X=$.apiKeyHeader??Z;return Q[X]=X.toLowerCase()==="authorization"?`Bearer ${$.apiKey}`:$.apiKey,Q}function S1($,Z){return Object.keys($).some((Q)=>Q.toLowerCase()===Z.toLowerCase())}function y9($,Z,Q){let X=Object.keys($).find((Y)=>Y.toLowerCase().startsWith(Z.toLowerCase()));if(X)throw Error(`OpenTelemetry provider "${Q}" does not support provider-specific header "${X}".`)}function R$($,Z,Q,X){return{type:Q,name:$.name,version:$.version,protocol:$.protocol??"http/protobuf",endpoint:$.endpoint,headers:X,resourceAttributes:P1($),levels:x1($,Z),traces:$.traces,metrics:$.metrics,logs:$.logs}}function w1($,Z){return R$($,Z,"otlp",q$($))}function C1($,Z){return R$($,Z,"grafana-lgtm",q$($))}function k1($,Z){let Q=q$($,"DD-API-KEY");if(!S1(Q,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return R$($,Z,"datadog",Q)}function b1($,Z){let Q=q$($);return y9(Q,"DD-","splunk"),R$($,Z,"splunk",Q)}function y1($,Z){let Q=q$($);return y9(Q,"DD-","elastic"),R$($,Z,"elastic",Q)}function v1($,Z){let Q=$.type??"otlp";switch(Q){case"otlp":return w1($,Z);case"grafana-lgtm":return C1($,Z);case"datadog":return k1($,Z);case"splunk":return b1($,Z);case"elastic":return y1($,Z);default:throw Error(`Unsupported OpenTelemetry provider type: ${Q}`)}}function h1($,Z){if(typeof $==="string")return $;if($ instanceof Error)return $.message;if($!=null)return T$($);if(Z.length===0)return"";return T$(Z[0])}function T$($){if(typeof $==="string")return $;try{return JSON.stringify($)}catch{return String($)}}function b9($,Z,Q){if(Q==null)return;if(typeof Q==="string"\|\|typeof Q==="number"\|\|typeof Q==="boolean"){$[Z]=Q;return}if(Array.isArray(Q)&&Q.every((X)=>["string","number","boolean"].includes(typeof X))){$[Z]=Q;return}if(Q instanceof Error){if($[`${Z}.name`]=Q.name,$[`${Z}.message`]=Q.message,Q.stack)$[`${Z}.stack`]=Q.stack;return}$[Z]=T$(Q)}function f1($){let Z={};for(let[X,Y]of $.entries()){if(Y&&typeof Y==="object"&&!Array.isArray(Y)&&!(Y instanceof Error)&&Object.getPrototypeOf(Y)===Object.prototype){for(let[J,_]of Object.entries(Y))b9(Z,J,_);continue}b9(Z,`param.${X}`,Y)}let Q=K1.getSpanContext(G1.active());if(Q)Z.trace_id=Q.traceId,Z.span_id=Q.spanId,Z.trace_flags=Q.traceFlags;return Z}function m1($){return $}function p1($){let Z=typeof $.body==="string"?$.body:T$($.body),Q=$.attributes??{};if(Object.keys(Q).length===0)return Z;return`${Z} ${T$(Q)}`}function v9($,Z){globalThis.console[m1($)](p1(Z))}function g1($,Z){if((Z.severityNumber??0)<U$.INFO)return;v9($,Z)}function d1($,Z,Q){let X=Q?.console;if(X===!1)return;if(typeof X==="function"){X(Z);return}if(X===!0){v9($,Z);return}g1($,Z)}function u1($,Z){let Q=z1.getLogger($.name,$.version),X=(Y,J,_)=>{if(!$.levels[Y])return;let z={severityNumber:J,severityText:Y.toUpperCase(),body:h1(_[0],_.slice(1)),attributes:f1(_.slice(1))};try{Q.emit(z)}finally{d1(Y,z,Z)}};return{trace:(Y,...J)=>X("trace",U$.TRACE,[Y,...J]),debug:(Y,...J)=>X("debug",U$.DEBUG,[Y,...J]),info:(Y,...J)=>X("info",U$.INFO,[Y,...J]),warn:(Y,...J)=>X("warn",U$.WARN,[Y,...J]),error:(Y,...J)=>X("error",U$.ERROR,[Y,...J])}}function l1($){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:$,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function h9($,Z,Q){if(!Z&&!Q)return;if(!Z)return l1($);let X=Z,Y=v1(X,Q),J,_=!1,z=u1(Y,Q),G,K,H=new Promise((F,E)=>{G=F,K=E});async function V(){try{let F=await I1(X),E={resource:F1(Y.resourceAttributes),instrumentations:Q?.instrument};if(Q?.sampler)E.sampler=Q.sampler;if(Q?.textMapPropagator)E.textMapPropagator=Q.textMapPropagator;if(Q?.contextManager)E.contextManager=Q.contextManager;if(Q?.spanProcessors)E.spanProcessors=Q.spanProcessors;else if(A4("traces",Y))E.traceExporter=T1(Y,F);if(Q?.metricReaders)E.metricReaders=Q.metricReaders;else if(A4("metrics",Y)){let D=N1(Y.metrics);E.metricReaders=[new L1({exporter:q1(Y,F),exportIntervalMillis:D?.exportIntervalMillis,exportTimeoutMillis:D?.exportTimeoutMillis})]}if(Q?.logRecordProcessors)E.logRecordProcessors=Q.logRecordProcessors;else if(A4("logs",Y))E.logRecordProcessors=[new M1({exporter:R1(Y,F)})];let B=Q?.configure?.(E);J=new W1(B??E),J.start(),_=!0,G?.()}catch(F){_=!1;let E=F instanceof Error?F:Error(String(F));$.error?.("OpenTelemetry startup failed",E),K?.(E)}finally{G=void 0,K=void 0}}return{state:"available",start:V,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>_,ready:(F)=>{if(!F\|\|F<=0)return H;return Promise.race([H,new Promise((E,B)=>{setTimeout(()=>B(Error(`OpenTelemetry ready timed out after ${F}ms.`)),F)})])},logger:z,forceFlush:async()=>{await J?.forceFlush?.()},shutdown:async()=>{_=!1,await J?.shutdown(),J=void 0}}}function f9($){let Z,Q,X=0,Y=Promise.resolve(),J=i0($,"OpenTelemetry"),_=q0("OpenTelemetry module",()=>Z?.isReady()===!0),z={beforeChange:J.beforeChange,afterChange:J.afterChange,isReady:_.isReady,ready:_.ready,logger:{trace:(K,...H)=>(Z?.logger??$).trace(K,...H),debug:(K,...H)=>(Z?.logger??$).debug(K,...H),info:(K,...H)=>(Z?.logger??$).info(K,...H),warn:(K,...H)=>(Z?.logger??$).warn(K,...H),error:(K,...H)=>(Z?.logger??$).error(K,...H)},forceFlush:async()=>{await Z?.forceFlush()},shutdown:async()=>{await Z?.shutdown()}},G=!1;return{update(K){if(!K){if(Z\|\|Q){let E=Z,B=Q;X+=1,J.emitBefore(),Z=void 0,Q=void 0,_.refresh(),Y=Promise.all([E?.shutdown(),B?.shutdown()]).finally(()=>J.emitAfter()).then(()=>{return},()=>{return})}return G?z:void 0}if(G=!0,K===Z\|\|K===Q)return z;let H=Z,V=Q;X+=1;let F=X;return J.emitBefore(),Z=void 0,Q=K,_.refresh(),Y=(async()=>{try{if(await Promise.all([H?.shutdown(),V?.shutdown()]),await K.start(),F!==X\|\|Q!==K){await K.shutdown();return}Z=K,Q=void 0,_.refresh()}finally{if(F===X)J.emitAfter()}})().then(()=>{return},()=>{return}),z},settled(){return Y},async shutdown(){X+=1;let K=Z,H=Q;Z=void 0,Q=void 0,_.settle(),await Promise.all([K?.shutdown(),H?.shutdown()])}}}import{ION_ENDPOINT_PERMISSIONS as T4,trimTrailingSlash as m9}from"@ionite/core";import{hasPermission as c1}from"@ionite/core/server";async function e0($,Z,Q){let X=await c1($,Z,Q.permission,void 0,Q.subjectType);return X.allow?void 0:X.response()}function i1($){let Z=m9($);return{matchesPath:(Y)=>{if(!Y)return!1;return m9(Y)===Z},startsWithPath:(Y)=>{if(!Y)return!1;return $===Y\|\|$.startsWith(`${Y}/`)}}}function p9($,Z,Q,X){let Y=X??new URL($.url).pathname,{matchesPath:J,startsWithPath:_}=i1(Y);if(Z.sso){let z=Z.sso;if(J(Q.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(G)=>z.handler(G)};if(J(Q.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(G)=>z.logout(G)};if(J(Q.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(G)=>z.logoutBackChannel(G)};if(J(Q.sso.loginUrl)\|\|J(Q.sso.refreshUrl)\|\|J(Q.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(G)=>z.handler(G)}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(G)=>{let K=await z.resolveCustomer(G);if(K.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(K.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(K.value),{headers:{"Content-Type":"application/json"}})}};if(J(Q.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(G)=>z.logout(G)}}if(Z.iam){let z=Z.iam,G=$.method!=="GET"&&$.method!=="HEAD";if(_(Q.iam.usersUrl))return{module:"iam",kind:G?"iam.users.write":"iam.read",requiredPermission:T4[G?"iam.users.write":"iam.read"],handler:async(K)=>z.handler(K)};if(_(Q.iam.groupsUrl))return{module:"iam",kind:G?"iam.groups.write":"iam.read",requiredPermission:T4[G?"iam.groups.write":"iam.read"],handler:async(K)=>z.handler(K)};if(_(Q.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(K)=>z.handler(K)}}if(Z.workload){let z=Z.workload;if(J(Q.workload.validateUrl)\|\|J(Q.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(G)=>z.handler(G)}}if(Z.secrets){let z=Z.secrets;if(z.isLfvDeliveryRequest?.($)&&z.handleLfvDelivery){let G=z.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(K)=>G(K)}}if(z.isLfvEventsRequest?.($)&&z.handleLfvEvents){let G=z.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(K)=>G(K)}}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.magicLinkUrl)&&$.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:T4["ciam.magic-link.create"],handler:async(G)=>z.handler(G)};if(J(Q.ciam.magicLinkLoginUrl)&&$.method==="GET"\|\|J(Q.ciam.customerProvidersUrl)&&$.method==="GET"\|\|J(Q.ciam.customerLoginUrl)&&$.method==="GET"\|\|J(Q.ciam.customerCallbackUrl)&&($.method==="GET"\|\|$.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(G)=>z.handler(G)}}return}async function q4($,Z,Q,X){let Y=X??v0(y$()),J=new URL($.url).pathname;if(Q?.filter){let V=await Q.filter($,Z);if(V instanceof Response)return V;if(V==="not_handled")return H0()}let _=p9($,Z,Y,J),G=await Q?.resolve?.($,Z,_)??_;if(!G)return H0();let K=G.requiredPermission===void 0?_?.requiredPermission:G.requiredPermission,H=async()=>{if(K){let V=await e0($,Z,K);if(V)return V}return G.handler($)};if(Q?.wrap)return await Q.wrap($,G,H,Z);return await H()}import{stableConfigHash as D2}from"@ionite/core";function n$(){let $=0;return{next:()=>{return $+=1,$},isCurrent:(Z)=>Z===$,current:()=>$}}import{readFile as K2,stat as z2}from"node:fs/promises";class F$ extends Error{code;status;constructor($,Z,Q){super($);this.code=Z;this.status=Q;this.name="VaultWebSocketCommandError"}sourceType="vault"}class m0 extends Error{path;constructor($,Z=`Vault secret not found at path ${$}`){super(Z);this.path=$;this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}code;status;sourceType="vault"}class U0 extends Error{path;status;code;constructor($,Z,Q,X,Y){super($,Y);this.path=Z;this.status=Q;this.code=X;this.name="VaultRequestError"}sourceType="vault"}class P0 extends Error{sourceType;path;constructor($,Z,Q=`Vault subscribe is not supported for source ${$} at path ${Z} without websocket, LFV, or ttl`){super(Q);this.sourceType=$;this.path=Z;this.name="VaultSubscribeNotSupportedError"}}function g9($){return $ instanceof m0\|\|$ instanceof F$&&($.code==="not_found"\|\|$.status===404)}import{WebSocket as R4}from"ws";var n1=1000,s1=30000,u9=30000,l9=u9;function c9($){l9=$>0?$:u9}function a1($){let Z=Math.min(s1,n12Math.min($,16)),Q=0.5+Math.random()0.5;return Math.round(ZQ)}var $$=new Map;function t1($){return $.trim().replace(/\/+$/g,"")}function i9($,Z){let Q=typeof Z?.version==="number"?Z.version:0,X=Z?.created_time??Z?.created,Y=typeof X==="string"?new Date(X):new Date;return{path:$,version:Q,created:Y}}function r1($){return typeof $?.version==="number"?$.version:void 0}function o1($){let Z=$.token?.trim();if(!Z)return{};if($.header==="Authorization")return{Authorization:Z.startsWith("Bearer ")?Z:`Bearer ${Z}`};return{"X-Vault-Token":Z}}function n9($){return{client_id:$.clientId,token:$.token,header:$.header??"X-Vault-Token"}}function s9($,Z){let Q=t1($),X=$$.get(Q);if(X){if(Z&&!X.log)X.log=Z;return X}let Y={url:Q,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,hasConnected:!1,disposed:!1,log:Z};return $$.set(Q,Y),Y}function e1($){let Z=Array.from($.subs.values(),(Y)=>Y.creds);if(Z.length===0)return $.lastGoodCreds??{url:$.url};let Q=$.lastGoodCreds?[$.lastGoodCreds,...Z]:Z,X=Q[$.reconnectCredCursor%Q.length]??Z[0];return $.reconnectCredCursor+=1,X}function d9($,Z){for(let Q of $.subs.values())try{Q.onHealth?.(Z)}catch(X){$.log?.warn("Vault websocket health hook threw",X)}}function $2($,Z){for(let Q of Array.from($.subs.values())){let X=Q.onFirstSecretReject;if(Q.onFirstSecret=void 0,Q.onFirstSecretReject=void 0,X)try{X(new U0(`Vault websocket subscription interrupted (${Z})`,Q.path,void 0,"connection"))}catch(Y){$.log?.warn("Vault websocket first-secret waiter rejection threw",Y)}}}function a9($,Z){for(let Q of $.pending.values())clearTimeout(Q.timer),Q.reject(new U0(`Vault websocket command interrupted (${Z})`,"/",void 0,"connection"));$.pending.clear()}function s$($){if($.disposed)return;if($.disposed=!0,$.reconnectTimer)clearTimeout($.reconnectTimer),$.reconnectTimer=void 0;a9($,"closed"),$2($,"socket disposed");let Z=$.ws;if($.ws=void 0,$.connectPromise=void 0,$.hasConnected=!1,$$.delete($.url),Z)try{Z.removeAllListeners(),Z.close()}catch{}}function P4($){if($.subs.size>0\|\|$.pending.size>0)return;s$($)}function t9($,Z,Q,X){if(X!==void 0&&Z.lastVersion!==void 0&&X===Z.lastVersion)return;if(X!==void 0)Z.lastVersion=X;try{Z.onChange(Q)}catch(J){$.log?.warn("Vault websocket subscription onChange threw",J)}let Y=Z.onFirstSecret;if(Z.onFirstSecret=void 0,Z.onFirstSecretReject=void 0,Y)try{Y()}catch(J){$.log?.warn("Vault websocket subscription onFirstSecret threw",J)}}function Z2($,Z){let Q=Z.subscription_id;if(typeof Q!=="string")return;let X=$.subs.get(Q);if(!X)return;let Y={data:Z.data,metadata:i9(typeof Z.path==="string"?Z.path:X.path,Z.metadata)};t9($,X,Y,r1(Z.metadata))}function Q2($,Z){let Q;try{Q=JSON.parse(Z.toString())}catch(X){$.log?.warn("Vault websocket message parse failed",X);return}if(Q.type==="secret"){Z2($,Q);return}if(Q.type==="command_result"&&typeof Q.id==="string"){let X=$.pending.get(Q.id);if(!X)return;if($.pending.delete(Q.id),clearTimeout(X.timer),Q.ok===!1)X.reject(new F$(Q.error??`Vault websocket command failed for ${Q.id}`,Q.code,Q.status));else X.resolve(Q.result);P4($)}}function r9($,Z){$.send(JSON.stringify({type:"subscribe",subscription_id:Z.subscriptionId,paths:[Z.path],...n9(Z.creds)}))}function o9($){if($.disposed\|\|$.reconnectTimer\|\|$.subs.size===0)return;let Z=a1($.reconnectAttempts);$.reconnectAttempts+=1,$.reconnectTimer=setTimeout(()=>{if($.reconnectTimer=void 0,$.disposed)return;if($.subs.size===0){s$($);return}I4($,e1($)).catch(()=>{if($.hasConnected)$.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${Z}ms).`);o9($)})},Z)}function I4($,Z){if($.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if($.ws&&$.ws.readyState===R4.OPEN)return Promise.resolve($.ws);if($.connectPromise)return $.connectPromise;return $.connectPromise=new Promise((Q,X)=>{let Y=new R4($.url,{headers:o1(Z)}),J=!1,_=$.hasConnected,z=()=>{J=!0,$.hasConnected=!0,$.reconnectAttempts=0,$.reconnectCredCursor=0,$.lastGoodCreds=Z,$.ws=Y,$.connectPromise=void 0,Y.on("message",(H)=>Q2($,H));for(let H of $.subs.values())try{r9(Y,H)}catch{}if(_)d9($,!0);Q(Y)},G=()=>{if($.ws===Y)$.ws=void 0;$.connectPromise=void 0;try{Y.removeAllListeners()}catch{}if(a9($,"socket closed"),$.subs.size>0)d9($,!1),o9($);else s$($)},K=(H)=>{if($.ws===Y)$.ws=void 0;if(!J)J=!0,$.connectPromise=void 0,X(H)};Y.once("open",z),Y.on("close",G),Y.on("error",K)}),$.connectPromise}async function x4($,Z,Q,X){let Y=s9($.url,X),J=typeof Q.path==="string"?Q.path:"/",_=await I4(Y,$),z=crypto.randomUUID();try{return await new Promise((G,K)=>{let H=setTimeout(()=>{if(!Y.pending.has(z))return;Y.pending.delete(z),K(new U0(`Vault websocket command "${Z}" timed out`,J,void 0,"timeout"));try{Y.ws?.close()}catch{}},l9);Y.pending.set(z,{resolve:(V)=>G(V),reject:K,timer:H});try{_.send(JSON.stringify({type:"command",id:z,command:Z,...Q,...n9($)}))}catch(V){clearTimeout(H),Y.pending.delete(z),K(V)}})}finally{P4(Y)}}async function S4($,Z,Q){let X;try{X=await x4($,"read_secret",{path:Z},Q)}catch(Y){if(g9(Y))throw new m0(Z);if(Y instanceof F$\|\|Y instanceof U0)throw Y;throw new U0(`Vault websocket read_secret failed for ${Z}`,Z,void 0,"connection",{cause:Y})}if(!X\|\|typeof X!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${Z}`);return{data:X.data,metadata:i9(typeof X.path==="string"?X.path:Z,X.metadata)}}async function e9($,Z,Q,X,Y,J){let _=s9($.url,Y),z=crypto.randomUUID(),G={subscriptionId:z,creds:$,path:Z,onChange:Q,onHealth:J?.onHealth};_.subs.set(z,G);let K=()=>{if(!_.subs.delete(z))return;if(_.ws&&_.ws.readyState===R4.OPEN)try{_.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:z}))}catch{}P4(_)};try{let H=await I4(_,$);r9(H,G)}catch(H){if(X?.mode!=="wait")throw K(),H}try{let H=await S4($,Z,Y);t9(_,G,H,H.metadata.version)}catch(H){if(X?.mode!=="wait")throw K(),H;await new Promise((V,F)=>{let E,B=(D)=>{if(E)clearTimeout(E);G.onFirstSecret=void 0,G.onFirstSecretReject=void 0,K(),F(D)};if(G.onFirstSecret=()=>{if(E)clearTimeout(E);V()},G.onFirstSecretReject=B,typeof X.timeout==="number"&&X.timeout>0)E=setTimeout(()=>B(H),X.timeout)})}return K}function $8(){let $=0;for(let Z of $$.values())$+=Z.subs.size;return{urls:Array.from($$.keys()),sockets:$$.size,subscriptions:$}}function Z8(){for(let $ of Array.from($$.values()))s$($)}var a$=600000;function Z$($){if($&&$<a$)throw Error(`OpenBao/Hashicorp compatible vaults require ttl to be set and greater than ${a$} milliseconds (10 minutes), as not to overload the vault with polling requests`)}function p0($,Z,Q,X,Y,J,_){let z=!1,G,K,H,V=(M)=>{try{_?.onHealth?.(M)}catch{}},F=()=>{if(z=!0,G)clearTimeout(G),G=void 0;K?.()},E=(M)=>new Promise((W)=>{let q=setTimeout(()=>{K=void 0,G=void 0,W()},M);G=q,K=()=>{clearTimeout(q),K=void 0,G=void 0,W()}});async function B(){let M=Date.now();for(;;){if(z)return;try{let W=await $.getFullSecret(Z,J);return V(!0),W}catch(W){if(V(!1),J?.mode!=="wait")throw W;if(typeof J.timeout==="number"&&J.timeout>0&&Date.now()-M>=J.timeout)throw W;if(z)return;Y?.warn(`Error retrieving initial secret from vault. Retrying in ${X} milliseconds`,W),await E(X)}}}async function D(){if(G=void 0,z)return;try{let M=await $.getFullSecret(Z);if(V(!0),M.metadata.version!==H)H=M.metadata.version,Q(M)}catch(M){V(!1),Y?.warn(`Error retrieving remote config from vault. Retrying in ${X} milliseconds`,M)}x()}function x(){if(z)return;G=setTimeout(()=>{D()},X)}return B().then((M)=>{if(z\|\|!M)return()=>F();return H=M.metadata.version,Q(M),x(),()=>F()})}function X2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Y2($){let Z={"Content-Type":"application/json"};if($)Z["X-Vault-Token"]=$;return Z}function J2($){return Boolean($?.idpTokenUrl?.trim()&&$.clientId?.trim()&&$.clientSecret?.trim())}async function Q8($,Z){let Q=Date.now();if(Z.token&&Z.expiresAt&&Z.expiresAt-60000>Q)return Z.token;let X=new URLSearchParams({grant_type:"client_credentials",client_id:$.clientId,client_secret:$.clientSecret});if($.scope?.trim())X.set("scope",$.scope.trim());let Y=await fetch($.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:X.toString()});if(!Y.ok)throw Error(`Vault workload token request failed (${Y.status})`);let J=await Y.json();if(!J.access_token)throw Error("Vault workload token response did not include access_token");return Z.token=J.access_token,Z.expiresAt=Q+Math.max(1,J.expires_in??300)1000,J.access_token}function G2($){return{Authorization:$.startsWith("Bearer ")?$:`Bearer ${$}`}}function X8($){return $.replace(/\/data\/?$/,"")}function M$($){let{type:Z="vault",url:Q,token:X,ttl:Y}=$,J=()=>$.log,_=J2($.workload)?$.workload:void 0,z={},G=Y2(X),K=$.lfv,H=$.websocket,V=K?j$({...K,log:K.log??J(),path:K.path??"/"}):void 0,F=new Map,E=H?.url?.trim(),B=new Set,D=!1,x=!1;if(!K&&!Q&&!E)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(Z$(Y),Q&&!X&&!_&&!K)J()?.warn("OpenBao/Hashicorp compatible vaults usually require a token, but one was not provided. Vault requests may fail.");async function M(){if(_){let L=await Q8(_,z);return{"Content-Type":"application/json",...G2(L)}}return{...G}}async function W(L){let b=m(L);if(_){let g=await Q8(_,z);return{url:b,clientId:H?.clientId??_.clientId,token:g,header:"Authorization"}}return{url:b,clientId:H?.clientId,token:H?.token??X,header:H?.header??"X-Vault-Token"}}function q(L){if(!K)throw Error(`Vault LFV capability is not configured for path ${L}`);let b=F.get(L);if(b)return b;let g=j$({...K,log:K.log??J(),path:L});return F.set(L,g),g}function T(L){if(!Q)throw Error(`Vault HTTP capability is not configured for path ${L}`);return Q}function m(L){if(!E)throw Error(`Vault websocket capability is not configured for path ${L}`);return E}async function C(L,b){let g=await W(typeof b.path==="string"?b.path:"/");return x4(g,L,b,J())}async function c(L,b){let g=T(L),a;try{let t=await M();a=await fetch(`${g}/${L}`,{headers:t})}catch(t){throw new U0(`Vault request failed from URL: ${g}/${L}`,L,void 0,"connection",{cause:t})}if(a.status!==200){if(a.status===404)throw new m0(L);let t=a.status===401\|\|a.status===403,J0=t?`Vault returned ${a.status} ${a.statusText} (auth error) from URL: ${g}/${L}`:`Vault returned invalid status, ${a.status}: '${a.statusText}' from URL: ${g}/${L}`;throw new U0(J0,L,a.status,t?"auth":"invalid_status")}try{return(await a.json()).data}catch(t){throw new U0("Error retrieving secret",L,void 0,"invalid_payload",{cause:t})}}async function Z0(L){let b=await W(L);return S4(b,L,J())}async function o(L){let b=T(L),g=`${X8(b)}/metadata/${L}`,a=await M(),t=await fetch(g,{headers:a});if(t.status!==200)throw new U0(`Vault getMetadata failed (${t.status}) for ${L}`,L,t.status,"invalid_status");let J0=await t.json().catch(()=>null);if(!J0?.metadata\|\|typeof J0.metadata!=="object")throw new U0(`Vault getMetadata returned invalid payload for ${L}`,L,t.status,"invalid_payload");return J0.metadata}async function j(L,b,g){let a=T(b),t=`${X8(a)}/${L}/${b}`,J0=await M(),V0=await fetch(t,{method:"POST",headers:J0,body:JSON.stringify({reason:g?.reason,severity:g?.severity,incident_ref:g?.incidentRef})});if(V0.status!==200&&V0.status!==202&&V0.status!==204)throw new U0(`Vault ${L} failed (${V0.status}) for ${b}`,b,V0.status,"invalid_status")}async function N(L,b){if(K)return await q(L).getFullSecret(L,b);if(Q)return await c(L,b);return await Z0(L)}async function P(L,b,g){if(!X2(b))throw Error(`putSecret requires an object value for vault source at path ${L}`);if(K){await q(L).putSecret(L,b,g);return}if(Q){let a=T(L),t=await M(),J0=await fetch(`${a}/${L}`,{method:"POST",headers:t,body:JSON.stringify(b)});if(J0.status!==200&&J0.status!==201&&J0.status!==204)throw new U0(`Vault putSecret failed (${J0.status}) for ${L}`,L,J0.status,"invalid_status");return}await C("put_secret",{path:L,data:b})}async function y(L,b){if(K){await q(L).deleteSecret(L,b);return}if(Q){let g=T(L),a=await M(),t=await fetch(`${g}/${L}`,{method:"DELETE",headers:a});if(t.status!==200&&t.status!==202&&t.status!==204)throw new U0(`Vault deleteSecret failed (${t.status}) for ${L}`,L,t.status,"invalid_status");return}await C("delete_secret",{path:L})}async function S(L,b){if(K)return await q(L).listPaths(L,b);if(Q){let t=`${T(L)}/${L}`,J0=async(w)=>{let I=await M();if(w==="LIST")return fetch(t,{method:"LIST",headers:I});let k=t.includes("?")?"&":"?";return fetch(`${t}${k}list=true`,{method:"GET",headers:I})},V0=await J0("LIST");if(V0.status===405\|\|V0.status===501)V0=await J0("GET");if(V0.status!==200)throw new U0(`Vault listPaths failed (${V0.status}) for ${L}`,L,V0.status,"invalid_status");let A=await V0.json().catch(()=>null),O;if(A&&typeof A==="object"){let w=A,I=w.data;if(I&&typeof I==="object")O=I.keys;else O=w.keys}if(!Array.isArray(O))throw new U0(`Vault listPaths returned an unexpected response for ${L}`,L,void 0,"invalid_payload");return O.filter((w)=>typeof w==="string")}let g=await C("list_paths",{path:L});if(!Array.isArray(g.items))throw Error(`Vault websocket list_paths returned invalid payload for ${L}`);return g.items.filter((a)=>typeof a==="string")}async function d(L,b){if(K)return await q(L).exists(L,b);if(Q){let a=T(L),t=await M(),J0=await fetch(`${a}/${L}`,{headers:t});if(J0.status===200)return!0;if(J0.status===404)return!1;if(J0.status===401\|\|J0.status===403)throw new U0(`Vault exists failed (${J0.status}) for ${L} (auth error)`,L,J0.status,"auth");throw new U0(`Vault exists failed (${J0.status}) for ${L}`,L,J0.status,"invalid_status")}let g=await C("exists",{path:L});if(typeof g.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${L}`);return g.exists}async function i(L,b,g){if(K){await q(L).requestRotate(L,b,g);return}if(Q){await j("rotate/request",L,b);return}await C("request_rotate",{path:L,reason:b?.reason,severity:b?.severity,incident_ref:b?.incidentRef})}async function e(L,b,g){if(K){await q(L).requestRevoke(L,b,g);return}if(Q){await j("revoke/request",L,b);return}await C("request_revoke",{path:L,reason:b?.reason,severity:b?.severity,incident_ref:b?.incidentRef})}async function Y0(L,b){if(K)return await q(L).getMetadata(L,b);if(Q)return await o(L);let g=await C("read_metadata",{path:L});if(!g.metadata\|\|typeof g.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${L}`);return g.metadata}async function K0(L,b,g){if(!Y)throw new P0(Z,L);return p0({getFullSecret:c},L,b,Y,J(),g,{onHealth:(a)=>{D=!a}})}async function p(L,b,g){let a=await W(L);return e9(a,L,b,g,J(),{onHealth:(t)=>{x=!t}})}function $0(L){let b=()=>{if(B.delete(b))L()};return B.add(b),b}function _0(){if(V?.isAvailable?.()===!1)return!0;for(let L of F.values())if(L.isAvailable?.()===!1)return!0;return!1}let B0={type:Z,isAvailable:()=>!D&&!x&&!_0(),getFullSecret:N,getSecret:async(L,b)=>{return(await N(L,b)).data},putSecret:P,deleteSecret:y,listPaths:S,exists:d,requestRotate:i,requestRevoke:e,getMetadata:Y0,subscribe:async(L,b,g)=>{let a;if(E)a=await p(L,b,g);else if(K)a=await q(L).subscribe(L,b,g);else a=await K0(L,b,g);return $0(a)},close:()=>{for(let b of Array.from(B))try{b()}catch(g){J()?.warn("Vault source close: failed to release a subscription",g)}B.clear();let L=(b)=>{if(!b?.close)return;try{Promise.resolve(b.close()).catch((g)=>{J()?.warn("Vault source close: LFV close failed",g)})}catch(g){J()?.warn("Vault source close: LFV close failed",g)}};for(let b of F.values())L(b);L(V),F.clear(),z.token=void 0,z.expiresAt=void 0},get log(){return $.log},set log(L){$.log=L}};if(V)B0.isDeliveryRequest=(L)=>V.isDeliveryRequest(L),B0.isEventsRequest=(L)=>V.isEventsRequest(L),B0.handleDelivery=(L)=>V.handleDelivery(L),B0.handleEvents=(L)=>V.handleEvents(L),Object.defineProperties(B0,{deliveryPath:{value:V.deliveryPath,enumerable:!0},eventsPath:{value:V.eventsPath,enumerable:!0},callbackKey:{value:V.callbackKey,enumerable:!0},trustId:{value:V.trustId,enumerable:!0}});return B0}class r$ extends Error{status;constructor($,Z){super($);this.name="AzureKeyVaultError",this.status=Z,Object.setPrototypeOf(this,r$.prototype)}}function t$($,Z){if(!$\|\|$.trim().length===0)throw Error(`Missing required Azure config: ${Z}`);return $}function _2($){return $.replace(/^\/+\|\/+$/g,"").replaceAll("/","-")}function w4($,Z){return`${$.replace(/\/+$/g,"")}/${Z.replace(/^\/+/g,"")}`}function H2($){try{let Q=new URL($).pathname.split("/").filter(Boolean),X=Q.indexOf("secrets");if(X===-1)return;return Q[X+2]\|\|void 0}catch{return}}function B2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function o$($){let Z=$.apiVersion??"7.4",Q=$.scope??"https://vault.azure.net/.default",X=$.secretNameTransform??_2,Y=$.authMethod,J="/var/run/secrets/azure/tokens/azure-identity-token",_=$.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",z=$.vaultUrl??($.vaultName?`https://${$.vaultName}.vault.azure.net`:void 0)??void 0,G=t$(z,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function K(j){try{return await z2(j),!0}catch{return!1}}let H,V,F=!1;async function E(j){let{entraTenantId:N,clientId:P}=$;if(!N)throw Error("Workload identity requires entraTenantId");if(!P)throw Error("Workload identity requires clientId");if(!await K(_))throw Error(`Federated token file not found at ${_}`);let y=(await K2(_,"utf8")).trim();if(!y)throw Error("Federated token file was empty");let S=`https://login.microsoftonline.com/${encodeURIComponent(N)}/oauth2/v2.0/token`,d=new URLSearchParams({client_id:P,grant_type:"client_credentials",scope:Q,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:y}),i=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:d});if(i.status!==200)throw Error(`Azure workload identity token exchange returned ${i.status} ${i.statusText}`);let e=await i.json();if(!e?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:e.access_token,expiresAtMs:j+(e.expires_in??0)1000},e.access_token}async function B(j){let N=$.imdsApiVersion??"2018-02-01",P="https://vault.azure.net",y=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(y.searchParams.set("api-version",N),y.searchParams.set("resource","https://vault.azure.net"),$.managedIdentityClientId)y.searchParams.set("client_id",$.managedIdentityClientId);let S=await fetch(y.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(S.status!==200)throw Error(`Azure IMDS token endpoint returned ${S.status} ${S.statusText}`);let d=await S.json();if(!d?.access_token)throw Error("IMDS token response missing access_token");let i=j+60000;if(d.expires_on){let e=Number.parseInt(d.expires_on,10);if(Number.isFinite(e)&&e>0)i=e1000;else{let Y0=Date.parse(d.expires_on);if(Number.isFinite(Y0))i=Y0}}else if(d.expires_in){let e=Number.parseInt(d.expires_in,10);if(Number.isFinite(e)&&e>0)i=j+e1000}return H={accessToken:d.access_token,expiresAtMs:i},d.access_token}async function D(j){let N=t$($.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),P=t$($.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),y=t$($.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),S=`https://login.microsoftonline.com/${encodeURIComponent(N)}/oauth2/v2.0/token`,d=new URLSearchParams({client_id:P,client_secret:y,grant_type:"client_credentials",scope:Q}),i=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:d});if(i.status!==200)throw Error(`Azure token endpoint returned ${i.status} ${i.statusText}`);let e=await i.json();if(!e?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:e.access_token,expiresAtMs:j+(e.expires_in??0)1000},e.access_token}async function x(){let j=Date.now();if(H&&H.expiresAtMs-60000>j)return H.accessToken;if(V)return V;V=(async()=>{if(Y==="workload_identity")return await E(j);if(Y==="managed_identity")return await B(j);if(Y==="client_secret")return await D(j);if(await K(_))try{return await E(j)}catch{}try{return await B(j)}catch{}return await D(j)})();try{return await V}finally{V=void 0}}async function M(j){let N=await x(),P=w4(G,`/secrets/${encodeURIComponent(j)}?api-version=${encodeURIComponent(Z)}`),y=await fetch(P,{headers:{Authorization:`Bearer ${N}`,Accept:"application/json"}});if(y.status!==200)throw new r$(`Key Vault request failed (${y.status})`,y.status);return await y.json()}async function W(j,N){let P=X(j),y=$.secretNamePrefix?`${$.secretNamePrefix}${P}`:P,S=await M(y),d=S.value;try{d=JSON.parse(S.value)}catch{}let i=S.attributes?.created?S.attributes.created1000:void 0,e=H2(S.id);return{data:d,metadata:{path:j,version:Number.parseInt(e??"",10)\|\|0,created:i?new Date(i):new Date}}}async function q(j,N,P){if(!B2(N))throw Error(`putSecret requires an object value for azure source at path ${j}`);let y=X(j),S=$.secretNamePrefix?`${$.secretNamePrefix}${y}`:y,d=await x(),i=w4(G,`/secrets/${encodeURIComponent(S)}?api-version=${encodeURIComponent(Z)}`),e=JSON.stringify({value:JSON.stringify(N)}),Y0=await fetch(i,{method:"PUT",headers:{Authorization:`Bearer ${d}`,"Content-Type":"application/json",Accept:"application/json"},body:e});if(Y0.status!==200&&Y0.status!==201)throw Error(`Key Vault putSecret failed (${Y0.status}) for ${j}`)}async function T(j,N){let P=X(j),y=$.secretNamePrefix?`${$.secretNamePrefix}${P}`:P,S=await x(),d=w4(G,`/secrets/${encodeURIComponent(y)}?api-version=${encodeURIComponent(Z)}`),i=await fetch(d,{method:"DELETE",headers:{Authorization:`Bearer ${S}`,Accept:"application/json"}});if(i.status!==200&&i.status!==202&&i.status!==204)throw Error(`Key Vault deleteSecret failed (${i.status}) for ${j}`)}async function m(j,N){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${j}`)}async function C(j,N){try{return await W(j),!0}catch(P){if(P instanceof r$&&P.status===404)return!1;throw P}}async function c(j,N,P){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${j}`)}async function Z0(j,N,P){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${j}`)}async function o(j,N){let P=X(j),y=$.secretNamePrefix?`${$.secretNamePrefix}${P}`:P,S=await M(y);return{id:S.id,...S.attributes??{}}}return{type:$.type,isAvailable:()=>!F,getFullSecret:W,getSecret:async(j,N)=>{return(await W(j,N)).data},putSecret:q,deleteSecret:T,listPaths:m,exists:C,requestRotate:c,requestRevoke:Z0,getMetadata:o,subscribe:(j,N,P)=>{if(!$.ttl)throw new P0("azure",j);return Z$($.ttl),p0({getFullSecret:W},j,N,$.ttl,void 0,P,{onHealth:(y)=>{F=!y}})},close:()=>{H=void 0,V=void 0,F=!1}}}var C4=Symbol("ion.secretsSourceState");function V2($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${X}`)};return{type:"dev",getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[C4]:"unavailable"}}function Y8($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${X}`)};return{type:"dev",getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[C4]:"removed"}}function U2($,Z){if(Z.type==="vault")return M$(Z);if(Z.type==="azure")return o$(Z);if(Z.type==="aws"\|\|Z.type==="gcp"\|\|Z.type==="dev")throw Error(`Secrets source "${$}" uses type "${Z.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${$}"`)}function F2($,Z){let Q=(X)=>{Z.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:X instanceof Error?X.message:String(X)})};try{Promise.resolve($.close?.()).catch(Q)}catch(X){Q(X)}}function M2($){let Z=new Map,Q=new Map,X=new Map;for(let[Y,J]of Object.entries($)){if(!J8(J))continue;let _=Z.get(J.deliveryPath);if(_)throw Error(`LFV delivery path "${J.deliveryPath}" is claimed by both secrets sources "${_}" and "${Y}"; delivery paths must be globally unique.`);Z.set(J.deliveryPath,Y);let z=Q.get(J.eventsPath);if(z)throw Error(`LFV events path "${J.eventsPath}" is claimed by both secrets sources "${z}" and "${Y}"; events paths must be globally unique.`);Q.set(J.eventsPath,Y);let G=X.get(J.callbackKey);if(G&&G.trustId!==J.trustId)throw Error(`LFV callback key "${J.callbackKey}" is claimed by secrets sources "${G.sourceName}" and "${Y}" with different verify JWKS; a callback path must use a single trust key.`);if(!G)X.set(J.callbackKey,{sourceName:Y,trustId:J.trustId})}}function J8($){return typeof $.isDeliveryRequest==="function"&&typeof $.isEventsRequest==="function"&&typeof $.handleDelivery==="function"&&typeof $.handleEvents==="function"}function L2($,Z,Q){let X={...Z},Y=[],J=(z)=>{if(X[z]!==void 0)delete X[z],Y.push(z)};J("token"),J("clientSecret"),J("workload");let _=X.websocket;if(_&&typeof _==="object"&&_.token!==void 0){let z={..._};delete z.token,X.websocket=z,Y.push("websocket.token")}if(Y.length>0)Q.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:$,"ion.droppedFields":Y});return X}function W2($,Z,Q){let X={},Y=new Set([...Object.keys(Z??{}),...Object.keys(Q??{})]);for(let J of Y){let _=Z?.[J],z=Q?.[J],G=z?L2(J,z,$):void 0;X[J]={..._??{},...G??{}}}return X}function e$($){return $[C4]??"available"}function O2($,Z,Q){let X=Z,Y=new Set,J=new Set,_=i0(Q,`Secrets source "${$}"`),z=()=>e$(X)==="available",G=q0(`Secrets source "${$}"`,z),K=(M,W,q)=>{return Error(`${M} timed out after ${q}ms waiting for source "${$}" to be configured by the ConfigSource at path ${W}`)},H=(M,W)=>{return Error(`${M} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${W}`)},V=(M,W,q)=>{let T=e$(X);if(T==="available")return Promise.resolve(X);if(T==="removed")return Promise.reject(H(M,W));return new Promise((m,C)=>{let c={method:M,path:W,resolve:(o)=>{if(c.timeout)clearTimeout(c.timeout);J.delete(c),m(o)},reject:(o)=>{if(c.timeout)clearTimeout(c.timeout);J.delete(c),C(o)}},Z0=q?.timeout;if(typeof Z0==="number"&&Z0>0)c.timeout=setTimeout(()=>{c.reject(K(M,W,Z0))},Z0);J.add(c)})},F=(M)=>{for(let W of Array.from(J))W.resolve(M)},E=()=>{for(let M of Array.from(J))M.reject(H(M.method,M.path))},B=async(M,W=!1)=>{let q=M.guard.next();if(M.unsubscribe?.(),M.unsubscribe=void 0,M.closed)return;if(e$(X)==="unavailable"&&M.options?.mode!=="wait"){if(W)throw Error(`subscribe is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${M.path}`);return}try{let m=await(M.options?.mode==="wait"?await V("subscribe",M.path,M.options):X).subscribe(M.path,(C)=>{if(!M.closed)M.onChange(C)},M.options);if(M.closed\|\|!M.guard.isCurrent(q)){m?.();return}M.unsubscribe=m}catch(T){if(W)throw T;if(d$(T)){Q.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:$,path:M.path});return}Q.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:$,path:M.path,error:T instanceof Error?T.message:String(T)})}},D={get type(){return X.type},beforeChange:_.beforeChange,afterChange:_.afterChange,isAvailable:()=>z()&&(X.isAvailable?.()??!0),isReady:G.isReady,ready:G.ready,getFullSecret:async(M,W)=>{return(await V("getFullSecret",M,W)).getFullSecret(M,W)},getSecret:async(M,W)=>{return(await V("getSecret",M,W)).getSecret(M,W)},putSecret:async(M,W,q)=>{return(await V("putSecret",M,q)).putSecret(M,W,q)},subscribe:async(M,W,q)=>{let T={path:M,onChange:W,options:q,closed:!1,guard:n$()};Y.add(T);try{await B(T,!0)}catch(m){throw Y.delete(T),m}return()=>{T.closed=!0,T.guard.next(),Y.delete(T),T.unsubscribe?.(),T.unsubscribe=void 0}},deleteSecret:async(M,W)=>{return(await V("deleteSecret",M,W)).deleteSecret(M,W)},listPaths:async(M,W)=>{return(await V("listPaths",M,W)).listPaths(M,W)},exists:async(M,W)=>{return(await V("exists",M,W)).exists(M,W)},requestRotate:async(M,W,q)=>{return(await V("requestRotate",M,q)).requestRotate(M,W,q)},requestRevoke:async(M,W,q)=>{return(await V("requestRevoke",M,q)).requestRevoke(M,W,q)},getMetadata:async(M,W)=>{return(await V("getMetadata",M,W)).getMetadata(M,W)}},x=(M)=>{try{Promise.resolve(M.close?.()).catch((W)=>{Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:W instanceof Error?W.message:String(W)})})}catch(W){Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:W instanceof Error?W.message:String(W)})}};return{api:D,update(M){if(M===X)return;let W=X;_.emitBefore(),X=M;let q=e$(M);if(q==="available")F(M);else if(q==="removed")E();G.refresh();for(let T of Y)B(T);x(W),_.emitAfter()},close(){for(let M of Y)M.closed=!0,M.guard.next(),M.unsubscribe?.(),M.unsubscribe=void 0;Y.clear(),E(),G.settle(),x(X)}}}function G8($){let Z=new Map,Q=new Map,X=new Map,Y=i0($,"Secrets"),J=!1,_=()=>{for(let B of Z.keys()){let D=X.get(B);if(D&&D.api.isReady?.()===!1)return!1}return!0},z=q0("Secrets module",()=>J&&_()),G=(B)=>{let D=X.get(B);if(D)return D;let x=O2(B,Z.get(B)??Y8(B),$);if(X.set(B,x),!(B in E))Object.assign(E,{[B]:x.api});return x},K=(B)=>{let D=X.get(B)?.api;if(D)return D;throw $.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:B}),Error(`Secrets source "${B}" is not configured`)},H=()=>{return Array.from(Z.values()).filter(J8)},V=(B)=>{return H().find((D)=>D.isDeliveryRequest(B))},F=(B)=>{return H().find((D)=>D.isEventsRequest(B))},E;return E={get config(){return Object.fromEntries(Array.from(Z.keys(),(B)=>[B,G(B).api]))},beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:z.isReady,isAvailable:()=>{for(let B of X.values()){if(B.api.isReady?.()===!1)continue;if(B.api.isAvailable?.()===!1)return!1}return!0},ready:z.ready,listSecretsSources:()=>Array.from(Z.keys()),getSecretsSource:(B)=>{if(Z.has(B))return G(B).api;return K(B)},getSecret:(B,D,x)=>E.getSecretsSource(B).getSecret(D,x),getFullSecret:(B,D,x)=>E.getSecretsSource(B).getFullSecret(D,x),putSecret:(B,D,x,M)=>E.getSecretsSource(B).putSecret(D,x,M),deleteSecret:(B,D,x)=>E.getSecretsSource(B).deleteSecret(D,x),listPaths:(B,D,x)=>E.getSecretsSource(B).listPaths(D,x),exists:(B,D,x)=>E.getSecretsSource(B).exists(D,x),requestRotate:(B,D,x,M)=>E.getSecretsSource(B).requestRotate(D,x,M),requestRevoke:(B,D,x,M)=>E.getSecretsSource(B).requestRevoke(D,x,M),getMetadata:(B,D,x)=>E.getSecretsSource(B).getMetadata(D,x),subscribe:(B,D,x,M)=>E.getSecretsSource(B).subscribe(D,x,M),isLfvDeliveryRequest:(B)=>V(B)!==void 0,isLfvEventsRequest:(B)=>F(B)!==void 0,handleLfvDelivery:async(B)=>{let D=V(B);if(!D)return H0();return D.handleDelivery(B)},handleLfvEvents:async(B)=>{let D=F(B);if(!D)return H0();return D.handleEvents(B)}},{update(B,D,x){let M=B!==void 0\|\|D!==void 0;if(!M&&!J&&X.size===0)return;let W=W2($,B,D),q=new Map,T=new Map,m=[];try{for(let[C,c]of Object.entries(W)){let Z0=D2(c),o=Z.get(C);if(o&&Q.get(C)===Z0){q.set(C,o),T.set(C,Z0);continue}let j;if(!c.type)j=V2(C);else x?.validateSourceConfig?.(C,c),j=U2(C,c),m.push(j);q.set(C,j),T.set(C,Z0)}M2(Object.fromEntries(q))}catch(C){for(let c of m)F2(c,$);throw C}Y.emitBefore(),J=M;for(let[C,c]of q)Z.set(C,c),Q.set(C,T.get(C)),G(C).update(c);for(let[C,c]of X){if(q.has(C))continue;Z.delete(C),Q.delete(C),c.update(Y8(C))}return z.refresh(),Y.emitAfter(),E},close(){for(let B of X.values())B.close();X.clear(),Z.clear(),Q.clear(),J=!1,z.settle()}}}function k4($,Z){let Q=Z.ttlMs,X=Math.max(1,Math.floor(Z.maxEntries)),Y=new Map,J=()=>Date.now();function _(){while(Y.size>X){let G=Y.keys().next().value;if(G===void 0)break;Y.delete(G)}}function z(G,K){Y.delete(G),Y.set(G,{session:K,expiresAt:J()+Q}),_()}return{async create(G){await $.create(G)},async get(G){let K=Y.get(G);if(K){if(K.expiresAt>J())return Y.delete(G),Y.set(G,K),K.session;Y.delete(G)}let H=await $.get(G);if(H)z(G,H);return H},async update(G,K){await $.update(G,K),Y.delete(G)},async delete(G){await $.delete(G),Y.delete(G)}}}import{ION_ENDPOINT_PERMISSIONS as y2,trimTrailingSlash as X4,validationFailureResponse as v2}from"@ionite/core";import{assertEcid as K8,jwtAssertionClaimsSchema as N2,must as I0,workloadTokenResponseSchema as A2}from"@ionite/core";import{getCachedVerificationKey as E2,getJwks as j2}from"@ionite/core/server";function w0($,Z){return Z in $&&$[Z]!==void 0&&$[Z]!==null}function A0($){if($===void 0\|\|$===null)return!1;return w0($,"workloadId")\|\|w0($,"privateKey")}function y0($){if($===void 0\|\|$===null)return!1;let Z=w0($,"clientId"),Q=w0($,"clientSecret"),X=w0($,"workloadId"),Y=w0($,"privateKey");return(Z\|\|Q)&&!X&&!Y}function b4($){if($===void 0\|\|$===null)return!1;let Z=w0($,"jwksUri"),Q=w0($,"workloadId"),X=w0($,"clientId"),Y=w0($,"clientSecret"),J=w0($,"privateKey");return Z&&!Q&&!J&&!X&&!Y}function z8($){if($===null\|\|typeof $!=="object"\|\|Array.isArray($))return!1;let Z=$;return"clientId"in Z\|\|"jwksUri"in Z\|\|"workloadId"in Z}function T2($){if($===null\|\|typeof $!=="object"\|\|Array.isArray($))return!1;let Z=$;if(z8(Z))return!1;let Q=Object.entries(Z);if(Q.length===0)return!1;return Q.every(([,X])=>z8(X))}function V8($){if($===null\|\|typeof $!=="object"\|\|Array.isArray($))return!1;let Z=$;if("incoming"in Z\|\|"outgoing"in Z){if(Z.incoming!==void 0&&(typeof Z.incoming!=="object"\|\|Z.incoming===null))return!1;if(Z.outgoing!==void 0&&(typeof Z.outgoing!=="object"\|\|Z.outgoing===null\|\|Array.isArray(Z.outgoing)))return!1;return!0}return!1}function U8($){return V8($)}function y4($){if(!$)return;if(U8($))return Array.isArray($.incoming)?void 0:$.incoming;return $}function p4($){if($===void 0\|\|$===null)return[];return Array.isArray($)?$:[$]}function L$($){if(typeof $!=="string")return;return $.endsWith("/")?$.slice(0,-1):$}function _8($){if(!$)return[];if(Array.isArray($))return $.filter((Z)=>!!Z&&typeof Z.issuer==="string"&&typeof Z.jwksUri==="string").map((Z)=>({issuer:Z.issuer,jwksUri:Z.jwksUri,audience:Z.audience,scopesAsEntitlements:Z.scopesAsEntitlements}));if($.issuer&&$.jwksUri)return[{issuer:$.issuer,jwksUri:$.jwksUri,audience:$.audience??[],scopesAsEntitlements:$.scopesAsEntitlements}];return[]}function q2($){let Z=$[0];if(!Z)return;let Q=p4(Z.audience);return{jwksUri:Z.jwksUri,issuer:Z.issuer,audience:typeof Q[0]==="string"?Q[0]:void 0}}function H8($,Z){let Q=L$(Z);if(!Q)return;return $.find((X)=>L$(X.issuer)===Q)}function $4($,Z,Q){let X=p4($);if(Z.some((Y)=>X.includes(Y)))return!0;if(typeof Q==="string"&&Z.includes(Q))return!0;return!1}function v4($){if(!$\|\|!U8($))return{};return $.outgoing??{}}function R2($){return{getToken:$.getToken,refreshToken:$.refreshToken,generateJWTAssertion:$.generateJWTAssertion,revokeToken:$.revokeToken,beforeChange:$.beforeChange,afterChange:$.afterChange,isReady:$.isReady,ready:$.ready}}var g4=Symbol("ion.workloadClientState"),F8=Symbol("ion.namedWorkloadClients");function P2($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[g4]:"unavailable"}}function B8($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it is no longer configured on this Ionite instance.`)};return{getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[g4]:"removed"}}function I2($){if(!$)return"removed";return $[g4]??"available"}function h4($,Z,Q){let X=$,Y=X,J=new Set;for(let _ of Q){if(J.add(_),_ in Y)continue;let z=Z[_];Y[_]=z?R2(z):P2(_)}return Object.defineProperty(Y,F8,{value:J,enumerable:!1,configurable:!0}),X}function D8($){if(!$)return[];let Z=$[F8];return Z?Array.from(Z):[]}function x2($,Z,Q){let X=Z,Y=i0(Q,`Workload client "${$}"`),J=()=>I2(X)==="available",_=q0(`Workload client "${$}"`,J);return{api:{beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:_.isReady,ready:_.ready,getToken:(G)=>X.getToken(G),refreshToken:(G)=>X.refreshToken(G),generateJWTAssertion:(G)=>X.generateJWTAssertion(G),revokeToken:(G)=>X.revokeToken(G)},update(G){if(G===X)return;Y.emitBefore(),X=G,_.refresh(),Y.emitAfter()}}}function M8($){let Z,Q=!1,X=q0("Workload module",()=>Q),Y=i0($,"Workload"),J=new Map,_=new Set,z=new Set(["beforeChange","afterChange","isReady","ready"]),G=(F)=>{if(!Z)throw Error(`${F} is unavailable because workload is not configured on this Ionite instance.`);return Z},K={beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:X.isReady,ready:X.ready,get config(){return Z?.config??{}},getToken(...F){return G("getToken").getToken(...F)},refreshToken(F){return G("refreshToken").refreshToken(F)},generateJWTAssertion(F){return G("generateJWTAssertion").generateJWTAssertion(F)},revokeToken(F){return G("revokeToken").revokeToken(F)},validateToken(F){return G("validateToken").validateToken(F)},getWorkloadIdentity(F){return G("getWorkloadIdentity").getWorkloadIdentity(F)},parseJWT(F){return G("parseJWT").parseJWT(F)},handler(F){return G("handler").handler(F)}},H=(F)=>{for(let D of _)delete K[D];if(_.clear(),!F)return;let E=new Set(D8(F)),B=new Set([...z,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...E]);for(let[D,x]of Object.entries(F)){if(B.has(D))continue;K[D]=x,_.add(D)}},V=(F)=>{let E=J.get(F);if(E)return E;let B=x2(F,B8(F),$);if(J.set(F,B),!(F in K))K[F]=B.api;return B};return{update(F){if(!F&&!Q&&J.size===0)return;Y.emitBefore(),Q=F!==void 0,X.refresh(),Z=F;let E=new Set(D8(F));for(let B of E){let D=F[B];V(B).update(D)}for(let[B,D]of J){if(E.has(B))continue;D.update(B8(B))}return H(F),Y.emitAfter(),K}}}async function f4($,Z,Q){if($===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let X=Q[$];if(!X)throw Error(`Unknown workload client: ${$}`);return X.getToken(Z)}function m4($,Z){return`${$}\|${Z??""}`}function g0($,Z,Q,X,Y){let J={jwtAssertionClaims:$?.jwtAssertionClaims??N2("server"),tokenResponse:$?.tokenResponse??A2("server")},_=async(A,O)=>{let w=A;if(typeof w.validate==="function")return w.validate(O);return A["~standard"].validate(O)};if(!Q&&!X)return;if(Q&&V8(Q)){let A=Q.incoming,O=_8(A),w=Array.isArray(A)?q2(A):A,I=y4(X),k=v4(X),u=w?{...w,...I,jwksUri:w.jwksUri,issuer:w.issuer}:I;if(!u\|\|!u.tokenUrl&&!u.jwksUri)Z.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let h=u&&(u.tokenUrl\|\|u.jwksUri)?g0($,Z,w??void 0,I,O):void 0,r=Array.from(new Set([...Object.keys(Q.outgoing??{}),...Object.keys(k)])).map((Q0)=>[Q0,{...Q.outgoing?.[Q0]??{},...k[Q0]??{}}]),l={};for(let[Q0,z$]of r){let C0=g0($,Z,z$,void 0);if(C0)l[Q0]=C0}if(!h&&Object.keys(l).length===0)return;let z0={...h?.config??{},config:h?.config??{},getToken:async(Q0,z$)=>f4(Q0,z$,l),getServerToken:async(Q0)=>{if(!h)throw Error("No server workload config");return h.getToken(Q0)},refreshToken:async(Q0)=>{if(!h)throw Error("No default workload config");return h.refreshToken(Q0)},generateJWTAssertion:async(Q0)=>{if(!h)throw Error("No default workload config");return h.generateJWTAssertion(Q0)},revokeToken:async(Q0)=>{if(!h)throw Error("No default workload config");return h.revokeToken(Q0)},validateToken:async(Q0)=>{if(!h)throw Error("No default workload config");return h.validateToken(Q0)},getWorkloadIdentity:async(Q0)=>{if(!h)return;return h.getWorkloadIdentity(Q0)},parseJWT:async(Q0)=>{if(!h)throw Error("No default workload config");return h.parseJWT(Q0)},handler:async(Q0)=>{if(!h)return H0();return h.handler(Q0)}};return h4(z0,l,r.map(([Q0])=>Q0))}if(Q&&T2(Q)){let A=y4(X),O=v4(X),w=Q.default,I=w?{...w,...A,jwksUri:w.jwksUri,issuer:w.issuer}:A;if(!I\|\|!I.tokenUrl&&!I.jwksUri)Z.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let k=I&&(I.tokenUrl\|\|I.jwksUri)?g0($,Z,w??void 0,A):void 0,u=Array.from(new Set([...Object.keys(Q).filter((l)=>l!=="default"),...Object.keys(O)])).map((l)=>[l,{...l in Q?Q[l]:{},...O[l]??{}}]),h={};for(let[l,z0]of u){let Q0=g0($,Z,z0,void 0);if(Q0)h[l]=Q0}if(!k&&Object.keys(h).length===0)return;let r={...k?.config??{},config:k?.config??{},getToken:async(l,z0)=>f4(l,z0,h),getServerToken:async(l)=>{if(!k)throw Error("No server workload config");return k.getToken(l)},refreshToken:async(l)=>{if(!k)throw Error("No default workload config");return k.refreshToken(l)},generateJWTAssertion:async(l)=>{if(!k)throw Error("No default workload config");return k.generateJWTAssertion(l)},revokeToken:async(l)=>{if(!k)throw Error("No default workload config");return k.revokeToken(l)},validateToken:async(l)=>{if(!k)throw Error("No default workload config");return k.validateToken(l)},getWorkloadIdentity:async(l)=>{if(!k)return;return k.getWorkloadIdentity(l)},parseJWT:async(l)=>{if(!k)throw Error("No default workload config");return k.parseJWT(l)},handler:async(l)=>{if(!k)return H0();return k.handler(l)}};return h4(r,h,u.map(([l])=>l))}let z=y4(X),G=v4(X);if(!Q&&Object.keys(G).length>0){let A={};for(let[I,k]of Object.entries(G)){let u=g0($,Z,k,void 0);if(u)A[I]=u}let O=z&&(z.tokenUrl\|\|z.jwksUri)?g0($,Z,z,void 0):void 0;if(!O&&Object.keys(A).length===0)return;let w={...O?.config??{},config:O?.config??{},getToken:async(I,k)=>f4(I,k,A),getServerToken:async(I)=>{if(!O)throw Error("No server workload config");return O.getToken(I)},refreshToken:async(I)=>{if(!O)throw Error("No default workload config");return O.refreshToken(I)},generateJWTAssertion:async(I)=>{if(!O)throw Error("No default workload config");return O.generateJWTAssertion(I)},revokeToken:async(I)=>{if(!O)throw Error("No default workload config");return O.revokeToken(I)},validateToken:async(I)=>{if(!O)throw Error("No default workload config");return O.validateToken(I)},getWorkloadIdentity:async(I)=>{if(!O)return;return O.getWorkloadIdentity(I)},parseJWT:async(I)=>{if(!O)throw Error("No default workload config");return O.parseJWT(I)},handler:async(I)=>{if(!O)return H0();return O.handler(I)}};return h4(w,A,Object.keys(G))}let K=Q,H=Y??_8(K),V=z?.tokenUrl,F=V?.startsWith("/")?V:void 0,E=K?.idpTokenUrl??z?.idpTokenUrl??(K?.tokenUrl&&(K.tokenUrl.startsWith("http://")\|\|K.tokenUrl.startsWith("https://"))?K.tokenUrl:void 0),B={...K,...z,tokenUrl:F??z?.tokenUrl??K?.tokenUrl,idpTokenUrl:E,jwksUri:K?.jwksUri,issuer:K?.issuer};B._handlerTokenUrl=F;let D,x=B,M=A0(B),W=y0(B),q=b4(B);if(!M&&!W&&!q){if(!K\|\|Object.keys(K).length===0)return;throw Z.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(B),clientId:x.clientId,clientSecret:x.clientSecret?"[REDACTED]":void 0,workloadId:x.workloadId,privateKey:x.privateKey?"[REDACTED]":void 0,jwksUri:x.jwksUri,tokenUrl:x.tokenUrl,idpTokenUrl:x.idpTokenUrl,fromVaultKeys:K?Object.keys(K):[],fromCodeKeys:X?Object.keys(X):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(M)D={...B,tokenUrl:B.tokenUrl,idpTokenUrl:I0(B.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:I0(B.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:I0(B.privateKey,"Missing 'privateKey' from Workload Config"),audience:I0(B.audience,"Missing 'audience' from Workload Config"),scope:B.scope??"",algorithm:B.algorithm??"RS256",tokenLifetime:B.tokenLifetime??300,refreshThreshold:B.refreshThreshold??60,autoRefresh:B.autoRefresh!==void 0?B.autoRefresh:!0,tokenStore:B.tokenStore??new a0};else if(y0(B))D={...B,tokenUrl:B.tokenUrl,idpTokenUrl:I0(B.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:I0(B.clientId,"Missing 'clientId' from Workload Config"),clientSecret:I0(B.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:B.scope??"",tokenLifetime:B.tokenLifetime??300,refreshThreshold:B.refreshThreshold??60,autoRefresh:B.autoRefresh!==void 0?B.autoRefresh:!0,tokenStore:B.tokenStore??new a0};else if(b4(B))D=B;function T(){let A=new Uint8Array(16);return crypto.getRandomValues(A),Array.from(A,(O)=>O.toString(16).padStart(2,"0")).join("")}function m(A){let O;if(typeof A==="string")O=btoa(A);else O=btoa(String.fromCharCode(...A));return O.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function C(A){let O=A.replace(/-/g,"+").replace(/_/g,"/");while(O.length%4)O+="=";return atob(O)}function c(A){if(A.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:A==="RS256"?"SHA-256":A==="RS384"?"SHA-384":"SHA-512"};else if(A.startsWith("ION"))return{name:"ECDSA",namedCurve:A==="ES256"?"P-256":A==="ES384"?"P-384":"P-521",hash:A==="ES256"?"SHA-256":A==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${A}`)}async function Z0(A,O){let w=A.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),I=Uint8Array.from(atob(w),(u)=>u.charCodeAt(0)),k=c(O);return crypto.subtle.importKey("pkcs8",I,k,!1,["sign"])}async function o(A,O,w){let I=await Z0(O,w),u=new TextEncoder().encode(A),h=c(w),r=await crypto.subtle.sign(h,I,u);return m(new Uint8Array(r))}async function j(A,O=3,w=1000,I=30000){let k=Error("Placeholder Error");for(let u=0;u<=O;u++)try{return await A()}catch(h){if(k=h instanceof Error?h:Error(String(h)),k.message.includes("400")\|\|k.message.includes("401")\|\|k.message.includes("403")\|\|k.message.includes("404"))throw k;if(u<O){let r=Math.min(w2*u,I),l=Math.random()r0.1;await new Promise((z0)=>setTimeout(z0,r+l))}}throw k}async function N(A){if(!A0(D))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let O=D,w=Math.floor(Date.now()/1000),I={iss:O.workloadId,sub:O.workloadId,aud:O.audience??"",exp:w+O.tokenLifetime,iat:w,jti:T(),scope:A??O.scope},k={alg:O.algorithm,typ:"JWT",kid:O.keyId},u=m(JSON.stringify(k)),h=m(JSON.stringify(I)),r=`${u}.${h}`,l=await o(r,O.privateKey,O.algorithm);return`${r}.${l}`}async function P(A){if(!A0(D))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let O=D;return j(async()=>{let w=O.idpTokenUrl,I=await N(A),k=new URLSearchParams;if(k.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),k.append("assertion",I),A)k.append("scope",A);let u=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:k.toString()}),h=await u.json();if(!u.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:h});let l=h;throw Error(`Token acquisition failed: ${l.error\|\|u.statusText} - ${l.error_description\|\|""}`.trim())}let r=await _(J.tokenResponse,h);if(r.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:r.issues}),Error(`Token response validation failed: ${r.issues.map((l)=>l.message).join("; ")}`);if(O.tokenStore){let l=new Date(Date.now()+(r.value.expires_in??300)1000),z0={workload_id:m4(O.workloadId,A),access_token:r.value.access_token,token_type:r.value.token_type,scope:r.value.scope,expires_at:l,created_at:new Date,refresh_token:r.value.refresh_token};await O.tokenStore.set(z0)}return r.value})}async function y(A){if(!y0(D))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let O=D;return j(async()=>{let w=O.idpTokenUrl,I=new URLSearchParams;if(I.append("grant_type","client_credentials"),I.append("client_id",O.clientId),I.append("client_secret",O.clientSecret),A)I.append("scope",A);let k=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:I.toString()}),u=await k.json();if(!k.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:u});let r=u;throw Error(`Token acquisition failed: ${r.error\|\|k.statusText} - ${r.error_description\|\|""}`.trim())}let h=await _(J.tokenResponse,u);if(h.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:h.issues}),Error(`Token response validation failed: ${h.issues.map((r)=>r.message).join("; ")}`);if(O.tokenStore){let r=new Date(Date.now()+(h.value.expires_in??300)1000),l={workload_id:m4(O.clientId,A),access_token:h.value.access_token,token_type:h.value.token_type,scope:h.value.scope,expires_at:r,created_at:new Date,refresh_token:h.value.refresh_token};await O.tokenStore.set(l)}return h.value})}let S=new Map;function d(A,O){let w=S.get(A);if(w)return w;let I=(async()=>{return(A0(D)?await P(O??""):await y(O??"")).access_token})();return S.set(A,I),I.catch(()=>{return}).finally(()=>{if(S.get(A)===I)S.delete(A)}),I}async function i(A){if(!A0(D)&&!y0(D)){let k=D;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!k.clientId}, hasClientSecret=${!!k.clientSecret}, hasWorkloadId=${!!k.workloadId}, hasPrivateKey=${!!k.privateKey}, hasJwksUri=${!!k.jwksUri}`)}let O=D;A=A??O.scope;let w=A0(D)?D.workloadId:D.clientId,I=m4(w,A);if(O.tokenStore){let k=await O.tokenStore.get(I);if(k){let u=Date.now(),h=k.expires_at.getTime(),r=O.refreshThreshold1000;if(u+r<h)return k.access_token;if(O.autoRefresh)try{return await d(I,A)}catch(l){if(u<h)return Z.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},l),k.access_token;throw l}}}return d(I,A)}async function e(A){if(!A0(D)&&!y0(D))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let O=D;return A=A??O.scope,A0(O)?await P(A):await y(A)}async function Y0(A){if(!A0(D)&&!y0(D))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let O=D;try{if(!D.revocationEndpoint)return;let w=new URLSearchParams;if(w.append("token",A),w.append("token_type_hint","access_token"),A0(D)){let k=D;w.append("client_id",k.workloadId)}else if(y0(D)){let k=D;w.append("client_id",k.clientId),w.append("client_secret",k.clientSecret)}let I=await fetch(D.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:w.toString()});if(!I.ok)Z.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:I.status,statusText:I.statusText});else Z.info("Token revoked successfully",{"ion.module":"workload"});if(D.tokenStore){let k;if(A0(D))k=D.workloadId;else if(y0(D))k=D.clientId;else return;await D.tokenStore.delete(k)}}catch(w){Z.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},w)}}async function K0(A,O){let w=A??D?.jwksUri;if(!w)throw Error("No JWKS URI configured in Workload Config");return await j2(w,Z,O)}async function p(A,O){let w=O??D?.jwksUri;if(!w)throw Error("No JWKS URI configured in Workload Config");let I=A0(D)?D.algorithm:"RS256";return E2(w,A,`wl:${I}`,(k)=>{let u=k.alg\|\|I,h=c(u);return crypto.subtle.importKey("jwk",k,h,!1,["verify"])},Z)}function $0(A){let O=A.split(".");if(O.length!==3)throw Error("Invalid JWT");return JSON.parse(C(O[1]))}async function _0(A,O){try{let w=A.split(".");if(w.length!==3)throw Error("Invalid JWT");let I=JSON.parse(C(w[0])),k=JSON.parse(C(w[1])),u=await p(I.kid,O),h=w[2],l=new TextEncoder().encode(`${w[0]}.${w[1]}`),z0=Uint8Array.from(C(h),(W$)=>W$.charCodeAt(0)),Q0=c(I.alg);if(!await crypto.subtle.verify(Q0,u,z0,l))throw Error("Invalid JWT signature");let C0=await _(J.jwtAssertionClaims,k);if(C0.issues)throw Z.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:C0.issues}),Error(`JWT claims validation failed: ${C0.issues.map((W$)=>W$.message).join("; ")}`);return C0.value}catch(w){throw Z.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},w),w}}async function B0(A){if(!A0(D)&&!y0(D)&&!b4(D))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(H.length>0){let I=$0(A),k=typeof I.iss==="string"?I.iss:void 0,u=H8(H,k);if(!u)return{valid:!1,error:"Untrusted token issuer"};let h=await _0(A,u.jwksUri),r=Math.floor(Date.now()/1000);if(h.exp&&h.exp<r)return{valid:!1,error:"Token expired"};let l=p4(u.audience);if(l.length>0&&!$4(h.aud,l,h.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:h,expiresAt:h.exp?new Date(h.exp1000):void 0}}let O=await _0(A),w=Math.floor(Date.now()/1000);if(O.exp&&O.exp<w)return{valid:!1,error:"Token expired"};if(A0(D)){if(D.audience&&!$4(O.aud,[D.audience],O.azp))return{valid:!1,error:"Invalid audience"}}else if(y0(D)){if(D.issuer&&L$(O.iss)!==L$(D.issuer))return{valid:!1,error:"Invalid issuer"};if(D.audience&&!$4(O.aud,[D.audience],O.azp))return{valid:!1,error:"Invalid audience"}}else{let I=D;if(I.issuer&&L$(O.iss)!==L$(I.issuer))return{valid:!1,error:"Invalid issuer"};if(I.audience&&!$4(O.aud,[I.audience],O.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:O,expiresAt:O.exp?new Date(O.exp1000):void 0}}catch(O){return{valid:!1,error:O instanceof Error?O.message:String(O)}}}function L(A,O){let w=A[O];return typeof w==="string"&&w.trim()?w.trim():void 0}function b(A){if(!A)return;return A.startsWith("service-account-")?A.slice(16):A}function g(A){return L(A,"client_id")??L(A,"clientId")??L(A,"azp")??L(A,"appid")??b(L(A,"preferred_username"))}let a=new WeakMap;function t(A){let O=a.get(A);if(O)return O;let w=J0(A);return a.set(A,w),w}async function J0(A){let O=A.headers.get("Authorization");if(!O?.startsWith("Bearer "))return;let w=O.substring(7),I=await B0(w);if(!I.valid\|\|!I.claims)return;let k=H.length>0?H8(H,I.claims.iss):void 0,u=I.claims.ecid,h={workloadId:I.claims.sub,clientId:g(I.claims),scope:I.claims.scope,scopesAsEntitlements:k?.scopesAsEntitlements,...u!==void 0&&u!==null?{ecid:K8(u)}:{},claims:I.claims},r=D?.workloadIdentityStore;if(r){let l=h.clientId??h.workloadId??h.claims.sub,z0=l?await r.get(l):void 0;if(z0){if(z0.active===!1)return;if(z0.scopes?.length){let Q0=new Set([...(h.scope??"").split(/\s+/).filter(Boolean),...z0.scopes]);h.scope=Array.from(Q0).join(" ")}if(!h.ecid&&z0.ecid)h.ecid=K8(z0.ecid)}}return h}async function V0(A){if(!D)throw Error("ionite Workload Manager not initialized");let O=new URL(A.url).pathname,w=(u)=>{if(!u)return;try{return new URL(u).pathname}catch{return u.startsWith("/")?u:`/${u}`}};if(w(D.validateUrl)===O&&A.method==="POST"){let u=A.headers.get("Authorization");if(!u?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let h=u.substring(7),r=await B0(h);if(!r.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:r.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(w(D.jwksUrl)===O&&A.method==="GET"){let u=await K0();return new Response(JSON.stringify(u),{headers:[["Content-Type","application/json"]]})}return H0()}return{...D,getToken:i,refreshToken:e,generateJWTAssertion:N,revokeToken:Y0,validateToken:B0,getWorkloadIdentity:t,parseJWT:_0,handler:V0}}function d4($){return $=$??"Workload authentication unavailable",new Response(JSON.stringify({error:$}),{status:503,statusText:$,headers:{"Content-Type":"application/json"}})}var Z4="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",S2="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function w2($,Z){I0(Z,Z4);let Q=Z.workload;if(!Q)return;return Q.getWorkloadIdentity($)}async function C2($,Z,Q){I0(Z,Z4);let X=Z.workload;if(!X)throw d4();let Y=X;if(typeof Y.getServerToken!=="function"\|\|typeof Y.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return Y.getToken($,Q)}async function u4($,Z){I0(Z,S2);let Q="validateToken"in Z&&typeof Z.validateToken==="function"?Z:Z.workload;if(!Q)return{valid:!1,error:"Workload authentication unavailable"};let X=$.headers.get("Authorization");if(!X?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let Y=X.substring(7);return Q.validateToken(Y)}async function k2($,Z){I0(Z,Z4);let Q=Z.workload;if(!Q)throw d4();return Q.revokeToken($)}async function b2($,Z){I0(Z,Z4);let Q=Z.workload;if(!Q)throw d4();return Q.handler($)}function L8($){try{return X4(new URL($,"http://dummy").pathname)}catch{let Z=$.startsWith("/")?$:`/${$}`;return X4(Z)}}function h2($,Z){let Q=new URL($.url);return new URL(`/${encodeURIComponent(Z)}/`,Q.origin).toString()}function f2($,Z){let Q=L8(Z),X=X4($);if(X===Q)return null;if(!X.startsWith(`${Q}/`))return null;let Y=X.slice(Q.length+1);if(!Y\|\|Y.includes("/"))return null;return decodeURIComponent(Y)}function Q4($){return $==="pending"\|\|$==="processing"\|\|$==="completed"\|\|$==="failed"\|\|$==="action_required"}function m2($){if(!Q4($.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if($.status==="completed"){if(!$.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:$.tenantUrl,status:"completed"},status:201}}if($.status==="pending"\|\|$.status==="processing")return{body:{tenantUrl:$.tenantUrl,status:$.status},status:202};if($.status==="action_required"){if(!$.actionUrl\|\|!$.requestToken\|\|!$.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:$.actionUrl,requestToken:$.requestToken,expiresAt:$.expiresAt},status:200}}return{body:{tenantUrl:$.tenantUrl,status:"failed",error:$.error??"Tenant provisioning failed"},status:409}}function p2($,Z){let Q=Z.validators.tenant.createTenantRequest,X=Z.validators.tenant.updateTenantRequest;function Y(K,H){let V=(F)=>new URL(F,H).toString();return{readyzUrl:V(K.readyzUrl),capabilitiezUrl:V(K.capabilitiezUrl),sso:{loginUrl:V(K.sso.loginUrl),userUrl:V(K.sso.userUrl),logoutUrl:V(K.sso.logoutUrl),logoutBackChannelUrl:V(K.sso.logoutBackChannelUrl),refreshUrl:V(K.sso.refreshUrl),callbackUrl:V(K.sso.callbackUrl)},workload:{validateUrl:V(K.workload.validateUrl),jwksUrl:V(K.workload.jwksUrl)},iam:{basePath:V(K.iam.basePath),usersUrl:V(K.iam.usersUrl),groupsUrl:V(K.iam.groupsUrl)},ciam:{magicLinkUrl:V(K.ciam.magicLinkUrl),magicLinkLoginUrl:V(K.ciam.magicLinkLoginUrl),customerUrl:V(K.ciam.customerUrl),customerLoginUrl:V(K.ciam.customerLoginUrl),customerCallbackUrl:V(K.ciam.customerCallbackUrl),customerProvidersUrl:V(K.ciam.customerProvidersUrl),logoutUrl:V(K.ciam.logoutUrl)}}}function J(K,H){let V=Z.tenantIonBasePath?.(K);if(!V)return;let F=new URL(H.url).origin,E=Y(v0(V),F);return{callbackUrl:E.sso.callbackUrl,ionUrls:E}}async function _(K){let H=await u4(K,Z.workloadAuth??$);if(!H.valid)return Response.json({error:H.error??"Unauthorized"},{status:401});return e0(K,$,y2["tenant.manage"])}async function z(K){let V=new URL(K.url).pathname,F=f2(V,Z.basePath),E=L8(Z.basePath),B=X4(V)===E;if(!B&&!F)return H0();if(!["GET","PUT","POST","DELETE"].includes(K.method))return V$(["GET","PUT","POST","DELETE"]);if(K.method==="GET"&&B&&F==null)return H0();let D=await _(K);if(D)return D;if(K.method==="GET"){if(F==null)return H0();let j=await Z.store.get(F);if(!j)return H0();let N=J(j,K);return Response.json(N?{...j,...N}:j,{status:200})}if(K.method==="DELETE"){if(!F)return H0();return await Z.store.delete(F),new Response(null,{status:204})}if(!F&&K.method!=="POST")return H0();let x;try{x=await K.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let M=K.method==="POST",W=M?await Q.validate(x):await X.validate(x);if(W.issues)return v2(W.issues,M?"Tenant create validation failed":"Tenant update validation failed");let q=M?W.value.id:F;if(!q)return H0();if(F!=null&&W.value.id!=null&&W.value.id!==F)return Response.json({error:"Path id must match body id"},{status:400});let T=await Z.store.get(q);if(T&&!Q4(T.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let m=new Date,C=T??{},c;if(M){let j=W.value,N=j,P=N.status,y=Q4(P)?P:T?.status??"completed";c={...C,...j,id:q,companyId:j.companyId,companyName:j.companyName,environmentType:j.environmentType,configLocator:j.configLocator,email:j.email??T?.email,webhookUrl:j.webhookUrl??T?.webhookUrl,callbackUrl:j.callbackUrl??T?.callbackUrl,tenantUrl:N.tenantUrl??T?.tenantUrl,status:y,error:N.error??T?.error,actionUrl:N.actionUrl??T?.actionUrl,requestToken:N.requestToken??T?.requestToken,expiresAt:N.expiresAt??T?.expiresAt,createdAt:T?.createdAt??m,updatedAt:m}}else{let j=W.value,N=j,P=N.status,y=Q4(P)?P:T?.status??"completed",{configLocator:S,...d}=j;c={...C,...d,id:q,companyId:j.companyId??T?.companyId??"",companyName:j.companyName??T?.companyName??"",environmentType:j.environmentType??T?.environmentType??"DEV",email:j.email??T?.email,webhookUrl:j.webhookUrl??T?.webhookUrl,callbackUrl:j.callbackUrl??T?.callbackUrl,tenantUrl:N.tenantUrl??T?.tenantUrl,status:y,error:N.error??T?.error,actionUrl:N.actionUrl??T?.actionUrl,requestToken:N.requestToken??T?.requestToken,expiresAt:N.expiresAt??T?.expiresAt,configLocator:S??T?.configLocator,createdAt:T?.createdAt??m,updatedAt:m}}if(!c.configLocator)return Response.json({error:"validation_failed",message:"Tenant configLocator is required",issues:[{message:"configLocator is required on create or must already exist on the stored tenant"}]},{status:422});if(!c.tenantUrl)c.tenantUrl=h2(K,q);if(!c.callbackUrl){let j=J(c,K);if(j)c.callbackUrl=j.callbackUrl}let Z0=await Z.store.upsert(c),o=m2(Z0);if(o instanceof Response)return o;return Response.json(o.body,{status:o.status})}async function G(K){try{if(!$.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await z(K)}catch(H){return D$(H)}}return{handler:G,getTenant:async(K)=>{return Z.store.get(K)}}}exportfrom"@ionite/core";import{generateULID as O5,IoniteError as N5,listGenerator as A5}from"@ionite/core";import{allowHosts as j5,allowOrigins as T5,allowRelativePaths as q5,allowSameOrigin as R5,blockDangerousUrls as P5,CatalogAdjacencyCache as I5,callback as x5,captureRedirect as S5,ciam as w5,collectReferencedDefinitions as C5,defaultRedirectPolicies as k5,discoverSessionRecords as b5,discoverSessions as y5,expandRoot as v5,getCustomer as h5,getUser as f5,has as m5,hasAll as p5,hasAllScope as g5,hasAny as d5,hasAnyScope as u5,hasGroup as l5,hasPermission as c5,hasRole as i5,hasScope as n5,InMemoryTenantStore as s5,iam as a5,initiateLogin as t5,isRedirectAllowed as r5,listSsoClientIdsFromCookies as o5,reconcileSubjectAccess as e5,resolveAfterRedirect as $7,resolveCapturedRedirect as Z7,resolveRedirect as Q7,sameOriginRedirectRules as X7,sendTenantWebhook as Y7,sso as J7,verifyUser as G7,withDefaultExternalId as K7,withSetCookies as z7}from"@ionite/core/server";import{accessRefId as n0,accessRootId as W8,list as g2}from"@ionite/core";function c4($){let{createdAt:Z,updatedAt:Q,...X}=$;return X}class d0{roots=new Map;byTarget=new Map;bySubject=new Map;static targetKey($,Z){return`${$}:${Z}`}static subjectKey($,Z){return`${$}:${Z}`}indexAdd($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}indexRemove($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}deindex($){this.indexRemove(this.byTarget,d0.targetKey($.targetType,n0($.target)),$.id),this.indexRemove(this.bySubject,d0.subjectKey($.subjectType??"user",n0($.subject)),$.id)}index($){this.indexAdd(this.byTarget,d0.targetKey($.targetType,n0($.target)),$.id),this.indexAdd(this.bySubject,d0.subjectKey($.subjectType??"user",n0($.subject)),$.id)}resolve($,Z){if(!$)return[];let Q=[];for(let X of $){let Y=this.roots.get(X);if(Y&&(Y.status??"active")==="active"&&Z(Y))Q.push(Y)}return Q}async grant($){let Z=$.id??W8($),Q=new Date,X=this.roots.get(Z);if(X)this.deindex(X);let Y={...$,id:Z,status:$.status??"active",createdAt:X?.createdAt??Q,updatedAt:Q};this.roots.set(Z,Y),this.index(Y)}async revoke($){let Z=$.id??W8($),Q=this.roots.get(Z);if(Q)this.deindex(Q);this.roots.delete(Z)}async get($){let Z=this.roots.get($);return Z?c4(Z):void 0}async list($){let Z=Array.from(this.roots.values()).filter((Q)=>(Q.status??"active")==="active");return l4(Z,$)}async listByTarget($,Z,Q){let X=Z.trim(),Y=this.byTarget.get(d0.targetKey($,X)),J=this.resolve(Y,(_)=>_.targetType===$&&n0(_.target)===X);return l4(J,Q)}async listByTargets($){let Z=new Map;for(let{targetType:Q,target:X}of $){let Y=`${Q}:${X}`;if(Z.has(Y))continue;let J=X.trim(),_=this.byTarget.get(d0.targetKey(Q,J)),z=this.resolve(_,(G)=>G.targetType===Q&&n0(G.target)===J);Z.set(Y,z.map((G)=>c4(G)))}return Z}async listBySubject($,Z="user",Q){let X=n0($),Y=this.bySubject.get(d0.subjectKey(Z,X)),J=this.resolve(Y,(_)=>(_.subjectType??"user")===Z&&n0(_.subject)===X);return l4(J,Q)}}function l4($,Z){let Q=Math.max(0,Z?.start??0),X=Z?.limit,Y=X!=null?Q+X:void 0;return g2($.length,$.slice(Q,Y).map(c4),Q,X)}import{assertValidSubjectTypeScoping as d2,list as O8,readyCatalogEntry as u2}from"@ionite/core";class N8{listeners=new Set;emit=($)=>{for(let Z of this.listeners)Z($)};groups=new Y4("group",this.emit);roles=new Y4("role",this.emit);permissions=new Y4("permission",this.emit);afterChange($){return this.listeners.add($),()=>{this.listeners.delete($)}}}class A8{items=new Map;listeners=new Set;constructor($){if($?.deriveEntitlements){let{deriveEntitlements:Z,resolveEntitlement:Q}=$;if(!Q)throw Error("InMemoryResourceStore: resolveEntitlement must be provided with deriveEntitlements.");this.entitlements=(X)=>Z(X),this.entitlement=async(X)=>Q(X,(Y)=>this.items.get(Y))}}entitlements;entitlement;async get($){return this.items.get($)}async list($){let Z=Array.from(this.items.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=X!=null?Q+X:void 0;return O8(Z.length,Z.slice(Q,Y),Q,X)}async children($){return Array.from(this.items.values()).filter((Z)=>{return(typeof Z.parent==="string"?Z.parent:Z.parent?.id)===$})}changed($){return this.listeners.add($),()=>{this.listeners.delete($)}}set($){this.items.set($.id,$),this.emitChange({id:$.id})}delete($){if(!this.items.delete($))return;this.emitChange({id:$,deleted:!0})}emitChange($){for(let Z of this.listeners)Z($)}}class Y4{kind;emit;items=new Map;byExternalId=new Map;constructor($,Z){this.kind=$;this.emit=Z}async get($){return this.items.get($)}async getByExternalId($){let Z=this.byExternalId.get($);return Z===void 0?void 0:this.items.get(Z)}set($){d2($);let Z=this.items.get($.id);if(Z?.externalId&&Z.externalId!==$.externalId){if(this.byExternalId.get(Z.externalId)===$.id)this.byExternalId.delete(Z.externalId)}if(this.items.set($.id,$),$.externalId)this.byExternalId.set($.externalId,$.id);return this.emit({op:"set",kind:this.kind,entity:$}),u2($,Promise.resolve())}async delete($){let Z=this.items.get($);if(Z?.externalId&&this.byExternalId.get(Z.externalId)===$)this.byExternalId.delete(Z.externalId);this.items.delete($),this.emit({op:"delete",kind:this.kind,id:$})}async list($){let Z=Array.from(this.items.values()),Q=$?.filter?.requestable;if(Q!==void 0)Z=Z.filter((_)=>Boolean(_.requestable)===Q);let X=Math.max(0,$?.start??0),Y=$?.limit,J=Y!=null?X+Y:void 0;return O8(Z.length,Z.slice(X,J),X,Y)}}import{accessRefId as Q$}from"@ionite/core";function X$($,Z){return`${Z}:${$}`}function i4($,Z,Q){return`${$}:${Z}:${Q}`}function l2($,Z,Q,X){return`${i4($,Z,Q)}:${X??""}`}class E8{rows=new Map;byTriple=new Map;byRoot=new Map;bySubject=new Map;edgeMeta=new Map;disabledSubjects=new Set;async has($,Z,Q,X,Y="user"){let J=Q$($),_=Q$(Q);if(!J\|\|!_)return{allow:!1};if(this.disabledSubjects.has(X$(J,Y)))return{allow:!1,metadata:{reason:"subject_disabled"}};let z=i4(X$(J,Y),Z,_),G=X?Q$(X):void 0;if(G===void 0){let V=this.byTriple.get(z);if(V&&V.size>0)return this.allow(J,Z,_,void 0);return{allow:!1}}let K=`${z}:${G}`,H=`${z}:`;if(this.rows.has(K))return this.allow(J,Z,_,G);if(this.rows.has(H))return this.allow(J,Z,_,void 0);return{allow:!1}}async hasGroup($,Z,Q,X="user"){return this.has($,"group",Z,Q,X)}async hasRole($,Z,Q,X="user"){return this.has($,"role",Z,Q,X)}async hasPermission($,Z,Q,X="user"){return this.has($,"permission",Z,Q,X)}async hasAny($,Z,Q="user"){for(let X of Z){let Y=await this.has($,X.targetType,X.target,X.resource,Q);if(Y.allow)return Y}return{allow:!1}}async hasAll($,Z,Q="user"){if(this.disabledSubjects.has(X$(Q$($),Q)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(Z.length===0)return{allow:!0};let X=[];for(let Y of Z){let J=await this.has($,Y.targetType,Y.target,Y.resource,Q);if(!J.allow)return{allow:!1,matched:X};if(J.matched)X.push(...J.matched)}return{allow:!0,matched:X}}async materialize($,Z){await this.removeByRoot($);let Q=new Set;for(let X of Z){let Y=X$(X.subject,X.subjectType??"user"),J=i4(Y,X.targetType,X.target),_=l2(Y,X.targetType,X.target,X.resource);this.addToSet(this.rows,_,$),this.addToSet(this.byTriple,J,_),this.addToSet(this.bySubject,Y,_),this.edgeMeta.set(_,{triple:J,subjectId:Y}),Q.add(_)}if(Q.size>0)this.byRoot.set($,Q)}async removeByRoot($){let Z=this.byRoot.get($);if(!Z)return;for(let Q of Z){let X=this.rows.get(Q);if(!X)continue;if(X.delete($),X.size===0)this.dropEdge(Q)}this.byRoot.delete($)}async listSubjects(){let $=[];for(let[Z,Q]of this.bySubject){if(Q.size===0)continue;let X=Z.indexOf(":");if(X<=0){$.push({subject:Z});continue}$.push({subjectType:Z.slice(0,X),subject:Z.slice(X+1)})}return $}async setSubjectDisabled($,Z,Q){let X=X$(Q$($),Z);if(Q)this.disabledSubjects.add(X);else this.disabledSubjects.delete(X)}async isSubjectDisabled($,Z="user"){return this.disabledSubjects.has(X$(Q$($),Z))}async clear($,Z="user"){if($===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}let Q=Q$($),X=this.bySubject.get(X$(Q,Z));if(!X)return;for(let Y of[...X]){let J=this.rows.get(Y);if(J)for(let _ of J){let z=this.byRoot.get(_);if(z?.delete(Y)&&z.size===0)this.byRoot.delete(_)}this.dropEdge(Y)}}allow($,Z,Q,X){return{allow:!0,matched:[{subject:$,targetType:Z,target:Q,resources:X?[X]:void 0}]}}addToSet($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}dropEdge($){this.rows.delete($);let Z=this.edgeMeta.get($);if(Z)this.removeFromSet(this.byTriple,Z.triple,$),this.removeFromSet(this.bySubject,Z.subjectId,$);this.edgeMeta.delete($)}removeFromSet($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}}function n4($){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function c2($,Z){return{...$,subscribe:async(Q,X,Y)=>{try{return await $.subscribe(Q,X,Y)}catch(J){if(!(J instanceof P0))throw J;return await p0($,Q,X,Z,void 0,Y)}}}}function J4($){let Z=o0($.path,"path","azureConfig");Z$($.ttl);let Q=$.vault??o$({type:"azure",authMethod:$.authMethod,entraTenantId:$.entraTenantId,clientId:$.clientId,clientSecret:$.clientSecret,federatedTokenFile:$.federatedTokenFile,managedIdentityClientId:$.managedIdentityClientId,imdsApiVersion:$.imdsApiVersion,vaultUrl:$.vaultUrl,vaultName:$.vaultName,apiVersion:$.apiVersion,secretNameTransform:$.secretNameTransform,secretNamePrefix:$.secretNamePrefix,scope:$.scope,ttl:$.ttl}),X=$.ttl?c2(Q,$.ttl):Q;return{load:async()=>{try{return(await X.getFullSecret(Z)).data}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`Error retrieving remote config from Azure Key Vault: ${J}`,{cause:Y})}},subscribe:(Y,J)=>{return X.subscribe(Z,(_)=>{Y(_.data)},J)},secret:X}}import{IoniteError as a4}from"@ionite/core";function s4($){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}class Y$ extends Error{path;constructor($,Z=`Waiting for vault config secret at ${$}`){super(Z);this.path=$;this.name="VaultConfigWaitingForSecretError"}code="not_found";sourceType="vault";status=404}function i2($){return $ instanceof Y$}class P$ extends Error{path;constructor($,Z){super(Z);this.path=$;this.name="VaultConfigInvalidPayloadError"}code="invalid_payload";sourceType="vault"}function n2($){return $ instanceof P$}var q8=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function j8($){return q8.some((Z)=>(Z in $))}function T8($,Z){if(!$\|\|typeof $!=="object"\|\|Array.isArray($))throw new Y$(Z,`Vault config secret at ${Z} is missing or not an object`);let Q=$;if(!j8(Q)&&Object.keys(Q).length===1&&"data"in Q){let X=Q.data;if(X&&typeof X==="object"&&!Array.isArray(X))Q=X}if(Object.keys(Q).length===0)throw new Y$(Z,`Vault config secret at ${Z} is empty`);if(!j8(Q))throw new P$(Z,`Vault config secret at ${Z} is an invalid payload: not a RemoteConfig (no known keys: ${q8.join("/")})`);return Q}function s2($,Z,Q){return{...$,subscribe:async(X,Y,J)=>{try{return await $.subscribe(X,Y,J)}catch(_){if(!(_ instanceof P0))throw _;return await p0($,X,Y,Z,Q(),J)}}}}function G4($){let Z=o0($.path,"path","vaultConfig");Z$($.ttl);let Q=$.vault??M$({type:"vault",url:$.url,token:$.token,workload:$.workload,lfv:$.lfv,websocket:$.websocket,ttl:$.ttl,log:$.log}),X=$.vault&&$.ttl?s2(Q,$.ttl,()=>$.log):Q,Y={get log(){return $.log},set log(J){if($.log=J,X&&"log"in X)X.log=J},load:async()=>{try{let J=await X.getFullSecret(Z);return T8(J.data,Z)}catch(J){if(J instanceof m0)throw new Y$(Z);if(J instanceof Y$\|\|J instanceof P$)throw J;throw Error("Error retrieving remote config from vault",{cause:J})}},subscribe:(J,_)=>{return X.subscribe(Z,(z)=>{let G;try{G=T8(z.data,Z)}catch(K){$.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:Z,error:K instanceof Error?K.message:String(K)});return}J(G)},_)},secret:X};if($.lfv?.lfvServerUrl&&$.lfv.clientId&&$.lfv.deliveryEndpoint&&$.lfv.eventsEndpoint)Y[u$]={path:$.lfv.path??Z,lfvServerUrl:$.lfv.lfvServerUrl,clientId:$.lfv.clientId,deliveryTimeout:$.lfv.deliveryTimeout,retryInterval:$.lfv.retryInterval,warnInterval:$.lfv.warnInterval,deliveryEndpoint:$.lfv.deliveryEndpoint,eventsEndpoint:$.lfv.eventsEndpoint,verifyJwks:$.lfv.verifyJwks};return Y}function K4($){if($==null)return;if(typeof $==="number")return Number.isFinite($)?$:void 0;let Z=$.trim();if(!Z)return;let Q=Number.parseInt(Z,10);return Number.isFinite(Q)?Q:void 0}function a2($,Z){let Q=$.vaultLfvServerUrl??Z?.lfvServerUrl,X=$.vaultLfvClientId??Z?.clientId,Y=$.vaultLfvDeliveryEndpoint??Z?.deliveryEndpoint,J=$.vaultLfvEventsEndpoint??Z?.eventsEndpoint;if(!Q\|\|!X\|\|!Y\|\|!J)return Z;return{...Z,lfvServerUrl:Q,clientId:X,deliveryEndpoint:Y,verifyJwks:$.vaultLfvVerifyJwks??Z?.verifyJwks,eventsEndpoint:J,path:$.vaultLfvPath??Z?.path,deliveryTimeout:K4($.vaultLfvDeliveryTimeout)??Z?.deliveryTimeout,retryInterval:K4($.vaultLfvRetryInterval)??Z?.retryInterval,warnInterval:K4($.vaultLfvWarnInterval)??Z?.warnInterval}}function t2($,Z){let Q=$.vaultWebsocketUrl??Z?.url;if(!Q)return Z;return{...Z,url:Q,token:$.vaultWebsocketToken??Z?.token,clientId:$.vaultWebsocketClientId??Z?.clientId,header:$.vaultWebsocketHeader??Z?.header}}function r2($,Z){let Q=$.vaultWorkloadTokenUrl??Z?.idpTokenUrl,X=$.vaultWorkloadClientId??Z?.clientId,Y=$.vaultWorkloadClientSecret??Z?.clientSecret;if(!Q\|\|!X\|\|!Y)return Z;return{...Z,idpTokenUrl:Q,clientId:X,clientSecret:Y,scope:$.vaultWorkloadScope??Z?.scope}}function R8($,Z){return{...Z,url:$.vaultUrl??Z?.url,token:$.vaultToken??Z?.token,path:$.vaultPath??Z?.path,ttl:K4($.vaultTtl)??Z?.ttl,workload:r2($,Z?.workload),lfv:a2($,Z?.lfv),websocket:t2($,Z?.websocket)}}function J$($){switch($.type){case"vault":return o2($);case"azure":return e2($);case"aws":return $6($);case"gcp":return Z6($);default:throw Error(`Unsupported config locator type: ${$.type}`)}}function o2($){return G4(R8($))}function e2($){return J4({authMethod:$.azureAuthMethod,entraTenantId:$.azureEntraTenantId,clientId:$.azureClientId,clientSecret:$.azureClientSecret,federatedTokenFile:$.azureFederatedTokenFile,managedIdentityClientId:$.azureManagedIdentityClientId,imdsApiVersion:$.azureImdsApiVersion,vaultUrl:$.azureVaultUrl,vaultName:$.azureVaultName,apiVersion:$.azureApiVersion,scope:$.azureScope,secretNamePrefix:$.azureSecretNamePrefix,path:$.azurePath,ttl:$.azureTtl})}function $6($){return n4({webhookUrl:$.awsWebhookUrl,ttl:$.awsTtl})}function Z6($){return s4({ttl:$.gcpTtl})}function P8($,Z){let Q=Q6($,Z);switch(Q.type){case"vault":return G4({vault:Q,path:$.path,ttl:$.ttl});case"azure":return J4({vault:Q,path:$.path,ttl:$.ttl});default:throw new a4(`Tenant config is not supported for secrets source type "${Q.type}" (path "${$.path}"). Only "vault" and "azure" sources can currently back a tenant configLocator.`,{status:500,statusText:"Unsupported tenant config source"})}}function Q6($,Z){if(!$.source)return Z.secret;if(!Z.secrets)throw new a4(`Tenant configLocator references secrets source "${$.source}" but the root Ionite has no secrets module configured. Declare it on the root Ionite (RemoteConfig.secrets) before referencing it.`,{status:500,statusText:"Secrets module not configured"});try{return Z.secrets.getSecretsSource($.source)}catch(Q){let X=Z.secrets.listSecretsSources().join(", ")\|\|"(none)";throw new a4(`Tenant configLocator references unknown secrets source "${$.source}" (path "${$.path}"). Declared sources: ${X}.`,{status:500,statusText:"Unknown secrets source",cause:Q})}}function G$($){if(!$)return;let Z=Number.parseInt($,10);return Number.isFinite(Z)?Z:void 0}function I8($,Z){let Q=Z?.type??$.ION_CONFIG_TYPE;if(!Q)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp.");if(Q==="vault")return{type:"vault",vaultUrl:$.ION_VAULT_URL,vaultToken:$.ION_VAULT_TOKEN,vaultPath:$.ION_VAULT_PATH??"",vaultTtl:G$($.ION_VAULT_TTL),vaultWorkloadTokenUrl:$.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:$.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:$.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:$.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:$.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:$.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:$.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:$.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:$.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvDeliveryTimeout:G$($.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:G$($.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:G$($.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:$.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:$.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:$.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:$.ION_VAULT_WEBSOCKET_HEADER};if(Q==="azure")return{type:"azure",azurePath:$.ION_AZURE_PATH,azureApiVersion:$.ION_AZURE_API_VERSION,azureScope:$.ION_AZURE_SCOPE,azureSecretNamePrefix:$.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:$.ION_AZURE_AUTH_METHOD,azureEntraTenantId:$.ION_AZURE_TENANT_ID,azureClientId:$.ION_AZURE_CLIENT_ID,azureClientSecret:$.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:$.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:$.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:$.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:$.ION_AZURE_VAULT_URL,azureVaultName:$.ION_AZURE_VAULT_NAME,azureTtl:G$($.ION_AZURE_TTL)};if(Q==="aws")return{type:"aws",awsWebhookUrl:$.ION_AWS_WEBHOOK_URL??"",awsTtl:G$($.ION_AWS_TTL)};if(Q==="gcp")return{type:"gcp",gcpTtl:G$($.ION_GCP_TTL)};throw Error(`ION_CONFIG_TYPE="${Q}" is not valid for envConfig(); supported types are vault, azure, aws, gcp.`)}function x8($,Z){return J$(I8($,Z))}function X6($){return x8(process.env,$)}var Y6=1000,J6=30000,S8=["vault","azure","aws","gcp"];function w8($,Z){if(!$\|\|typeof $!=="object"\|\|Array.isArray($))throw Error(`Config locator at ${Z} is an invalid payload: expected an object with a "type" field`);let Q=$.type;if(typeof Q!=="string"\|\|!S8.includes(Q))throw Error(`Config locator at ${Z} is an invalid payload: unknown type "${String(Q)}" (expected ${S8.join("/")})`)}function C8($,Z){return $.log??=Z.log,$.validators??=Z.validators,$}function I$($){if(!$?.secret?.close)return;try{Promise.resolve($.secret.close()).catch((Z)=>{$.log?.warn?.("secretConfigSource: inner source close failed",Z)})}catch(Z){$.log?.warn?.("secretConfigSource: inner source close failed",Z)}}function G6($,Z){let Q=o0(Z,"path","secretConfigSource"),X,Y=(_)=>{w8(_,Q);let z=JSON.stringify(_);if(X&&X.hash===z)return X.inner;let G=X?.inner,K=C8(J$(_),J);if(X={hash:z,inner:K},G&&G!==K)I$(G);return K},J={async load(){let _=await $.getSecret(Q);return Y(_).load()},async subscribe(_,z){let G,K=!1,H=!1,V,F,E=new Promise((m,C)=>{V=m,F=C}),B=n$(),D,x,M=(m)=>new Promise((C)=>{x=C,D=setTimeout(C,m)}),W=async(m,C)=>{w8(m,Q);let c=JSON.stringify(m),Z0=X!==void 0&&X.hash===c;if(Z0&&G)return;let o=X?.inner,j=G,N=Z0&&X?X.inner:C8(J$(m),J),P=!Z0,y=()=>{if(P&&N!==o)I$(N)};try{if(N.subscribe){let d=await N.subscribe(_,z)??void 0;if(K\|\|!B.isCurrent(C)){d?.(),y();return}if(G=d,X={hash:c,inner:N},j&&j!==d)j();if(P&&o&&o!==N)I$(o);return}let S=await N.load();if(K\|\|!B.isCurrent(C)){y();return}if(X={hash:c,inner:N},j)j(),G=void 0;if(P&&o&&o!==N)I$(o);_(S)}catch(S){throw y(),S}},q=async(m)=>{let C=B.next(),c=Y6;for(;;){if(K\|\|!B.isCurrent(C))return;try{await W(m,C);return}catch(Z0){if(K\|\|!B.isCurrent(C))return;J.log?.warn(`secretConfigSource rebind for ${Q} failed; keeping last-known-good source and retrying in ${c}ms`,Z0),await M(c),c=Math.min(J6,c2)}}},T=await $.subscribe(Q,(m)=>{if(K)return;if(!H){W(m.data,B.next()).then(()=>{H=!0,V()}).catch((C)=>{H=!0,F(C)});return}q(m.data)},z);return await E,()=>{if(K=!0,B.next(),D)clearTimeout(D);x?.(),G?.(),T(),I$(X?.inner),X=void 0}},secret:$};return J}var K6=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."}];var k8;function z6($){k8=$}function _6($,Z){return k8?.({locator:$}),P8($,Z)}import{buildTenantPath as H6,DEFAULT_TENANT_API_NAMESPACE as y8,DEFAULT_TENANT_UI_NAMESPACE as v8,matchTenantPath as h8,normalizeTenantPathNamespace as b8,normalizeTenantRoutingStrategy as B6}from"@ionite/core";function D6(){return Response.json({error:"Tenant not found"},{status:404})}function V6($){return Response.json({error:`Tenant runtime not found for ${$}`},{status:404})}function U6($,Z){let Q=B6($);if(Z==="api")return b8(Q.api??y8);return b8(Q.ui??v8)}function F6($){if($.store)return async(Z)=>$.store.getIon(Z);return async(Z)=>await $.getIon(Z)??void 0}async function f8($,Z={}){if(Z.custom){let J=await Z.custom($);if(J)return{id:J}}let Q=Z.namespace??"api",X=U6(Z.strategy,Q),Y=h8(new URL($.url).pathname,X);if(!Y)return null;return{id:Y.id,context:{namespace:Q,restPath:Y.restPath,restSegments:Y.restSegments}}}function m8($,Z){let Q=new URL($.url);return Q.pathname=Z,new Request(Q,$)}function t4($,Z,Q,X){let Y=h8(new URL($.url).pathname,Q);if(!Y\|\|Y.id!==Z)return $;return m8($,H6(Z,Y.restPath,X))}function M6($,Z,Q={beforeTenantSegments:["api"],afterTenantSegments:[]}){return t4($,Z,y8,Q)}function L6($,Z,Q={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return t4($,Z,v8,Q)}function W6($){return async function(Q){try{let X=$.resolveTenant?await $.resolveTenant(Q):await f8(Q),Y=typeof X==="string"?{id:X,context:void 0}:X??null;if(!Y?.id)return $.onMissingTenant?await $.onMissingTenant(Q):D6();let J=await $.getIon(Y.id,Q)??null;if(!J)return $.onMissingIonite?await $.onMissingIonite(Q,Y.id):V6(Y.id);let _=$.rewriteRequest?await $.rewriteRequest(Q,{id:Y.id,ion:J,context:Y.context}):Q;return J.handler(_)}catch(X){return D$(X)}}}function O6($){let{type:Z,...Q}=$;return M$({type:"vault",...Q})}import{list as N6}from"@ionite/core";class p8{identities=new Map;clientIdIndex=new Map;async get($){return this.identities.get($)}async lookup($){if($.id){let Z=this.identities.get($.id);if(Z)return Z}if($.clientId){let Z=this.clientIdIndex.get($.clientId);if(Z)return this.identities.get(Z)}if($.externalId){for(let Z of this.identities.values())if(Z.externalId===$.externalId)return Z}return}async upsert($){let Z=$.id?.trim()\|\|crypto.randomUUID(),Q=new Date,X=this.identities.get(Z),Y={...$,id:Z,createdAt:X?.createdAt??$.createdAt??Q,updatedAt:Q};if(X?.clientId&&X.clientId!==Y.clientId)this.clientIdIndex.delete(X.clientId);if(this.identities.set(Z,Y),Y.clientId)this.clientIdIndex.set(Y.clientId,Z);return Y}async delete($){let Z=this.identities.get($);if(Z?.clientId)this.clientIdIndex.delete(Z.clientId);return this.identities.delete($),Z?1:0}async list($){let Z=Array.from(this.identities.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,_=Z.slice(Q,J);return N6(Y,_,Q,X)}}function x6($){let Z=$,Q=Z.basePath??y$(),X=b$(Z.stores),Y=Z.routing,J=Z.beforeChange,_=Z.afterChange,z=Z.configRetry,G=Z.onConfigLoadError;return{frameworkConfig:{log:$.log,validators:$.validators,sso:$.sso,iam:$.iam,workload:$.workload,secrets:$.secrets,ciam:$.ciam,authz:$.authz,otel:$.otel},basePath:Q,stores:X,options:{beforeChange:J,afterChange:_,routing:Y,configRetry:z,onConfigLoadError:G}}}function S6($){let Z=$,Q={trace:(X,...Y)=>Z.trace(X,...Y),debug:(X,...Y)=>Z.debug(X,...Y),info:(X,...Y)=>Z.info(X,...Y),warn:(X,...Y)=>Z.warn(X,...Y),error:(X,...Y)=>Z.error(X,...Y)};return{logger:Q,update(X){return Z=X,Q}}}function r8($,Z){let Q=$;return Q.setStores=(X)=>{Z.current=b$(X),Object.assign(Q,O$(Q,Z.current))},Q}function d8($){let Z=$?.replace(/\s+/g," ").trim();return Z?Z:void 0}function o8($){if(typeof $!=="object"\|\|$===null)return;return $.cause}function w6($){if(!($ instanceof Error))return typeof $==="string"?d8($):void 0;let Z=d8($.message),Q=[],X=$;if(typeof X.code==="string")Q.push(`code=${X.code}`);if(typeof X.status==="number")Q.push(`status=${X.status}`);if(typeof X.path==="string")Q.push(`path=${X.path}`);if(Q.length===0)return Z;if(!Z)return Q.join(", ");return`${Z} [${Q.join(", ")}]`}function $9($,Z=3){let Q=[],X=$,Y=0;while(X!=null&&Y<Z){let J=w6(X);if(J&&!Q.includes(J))Q.push(J);X=o8(X),Y+=1}return Q.length>0?Q.join(" <- "):void 0}function C6($,Z){if(typeof $!=="object"\|\|$===null)return;return $[Z]}function x0($,Z){let Q=$,X=0;while(Q!=null&&X<3){let Y=C6(Q,Z);if(Y!==void 0)return Y;Q=o8(Q),X+=1}return}var k6=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function b6($){return typeof $==="string"&&k6.has($)}function y6($){let Z=x0($,"kind");if(b6(Z))return Z;let Q=x0($,"status"),X=x0($,"code"),Y=$9($)?.toLowerCase()??"";if(Q===401\|\|Q===403\|\|Y.includes("auth error")\|\|Y.includes("permission denied"))return"auth";if(X==="not_found"\|\|Y.includes("waiting for vault"))return"not_found";if(X==="ECONNREFUSED"\|\|X==="ECONNRESET"\|\|X==="ENOTFOUND"\|\|X==="ETIMEDOUT"\|\|Y.includes("connection")\|\|Y.includes("fetch failed")\|\|Y.includes("network"))return"connection";if(Y.includes("timed out"))return"timeout";if(Y.includes("invalid status")\|\|typeof Q==="number"&&Q>=400)return"invalid_status";if(Y.includes("invalid payload")\|\|Y.includes("invalid json")\|\|Y.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function v6($){return"validation"}var h6=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function f6($,Z){let Q=x0($,"recoverable");if(typeof Q==="boolean")return Q;if(Z==="not_found")return!0;if(Z==="auth"\|\|Z==="invalid_payload")return!1;let X=x0($,"status");if(typeof X==="number"&&X>=400&&X<500)return!1;let Y=x0($,"code");if(typeof Y==="string"&&(h6.has(Y)\|\|Y.startsWith("UND_ERR_")))return!0;return!0}function m6($){return{initialDelayMs:Math.max(1,$?.initialDelayMs??2000),maxDelayMs:Math.max(1,$?.maxDelayMs??600000),multiplier:Math.max(1,$?.multiplier??2),jitterRatio:Math.max(0,$?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,$?.loadTimeoutMs??30000)}}function p6($,Z){let Q=Math.max(0,$-1),X=Math.min(Z.maxDelayMs,Z.initialDelayMsZ.multiplierQ);if(Z.jitterRatio===0)return Math.round(X);let Y=XZ.jitterRatio,J=(Math.random()2-1)Y;return Math.max(1,Math.round(Math.min(Z.maxDelayMs,X+J)))}function g6($){return(Z)=>{let Q=Z.path?` at ${Z.path}`:"",X=Z.sourceType?` (${Z.sourceType})`:"";$.warn(`Config source${X} unavailable${Q}; ionite will retry automatically in ${Z.nextDelayMs}ms (attempt ${Z.attempt}, ${Z.errorKind}: ${Z.message}).`)}}async function d6($,Z){for(let Q of Z)await Q($)}function S0($){if(!$)return;try{return new URL($,"http://dummy").pathname}catch{return $.startsWith("/")?$:`/${$}`}}function u6($,Z){let Q=Z.id;if(typeof Q!=="string"\|\|Q.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if($!==void 0&&$!==Q)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${$}", received "${Q}").`)}function l6($){let Z=$.authz?.trustedProvisioningClients;if(!Z)return;Z.forEach((Q,X)=>{let Y=`authz.trustedProvisioningClients[${X}]`;if(typeof Q.issuer!=="string"\|\|Q.issuer.length===0)throw Error(`${Y}: "issuer" is required and must be a non-empty string.`);if(typeof Q.clientId!=="string"\|\|Q.clientId.length===0)throw Error(`${Y}: "clientId" is required and must be a non-empty string.`);let J=Array.isArray(Q.audience)?Q.audience:[Q.audience];if(J.length===0\|\|J.some((_)=>typeof _!=="string"\|\|_.length===0))throw Error(`${Y}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(Q.permissions)\|\|Q.permissions.some((_)=>typeof _!=="string"\|\|_.length===0))throw Error(`${Y}: "permissions" must be an array of non-empty permission ids.`)})}function c6($){let Z=Array.isArray($)?$:[$];return Z.length>0&&Z.every((Q)=>typeof Q==="string"&&Q.length>0)}function i6($){let Z=$.workload;if(!Z\|\|typeof Z!=="object"\|\|Array.isArray(Z))return;let Q=Z,X=(Y,J)=>{if(!c6(Y.audience))throw Error(`${J}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in Q\|\|"outgoing"in Q){let Y=Q.incoming;if(Array.isArray(Y))Y.forEach((J,_)=>{if(J&&typeof J==="object")X(J,`workload.incoming[${_}]`)});else if(Y&&typeof Y==="object"&&"jwksUri"in Y)X(Y,"workload.incoming");return}if(e8(Q)){if("jwksUri"in Q&&!("clientId"in Q)&&!("workloadId"in Q))X(Q,"workload (server-only)");return}}function n6($,Z,Q){if($?.sso?.redirectUri&&Z.sso?.redirectUri){let X=S0($.sso.redirectUri),Y=S0(Z.sso.redirectUri);if(X!==Y)Q.error(`SSO redirectUri path mismatch: the framework derives "${Y}" from basePath, but ConfigSource reports "${X}". Register "${Y}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function Z9($){let Z={};if(!$)return Z;for(let[Q,X]of Object.entries($))if(X.type==="vault"&&typeof X.lfv?.deliveryEndpoint==="string"&&typeof X.lfv?.eventsEndpoint==="string")Z[Q]=X.lfv;return Z}function s6($){return $[u$]}function a6($,Z){let Q=Z9($.secrets??void 0),X=S0(Z.deliveryEndpoint),Y=S0(Z.eventsEndpoint),J=S0(Z.path);for(let _ of Object.values(Q)){if(S0(_.deliveryEndpoint)!==X)continue;if(S0(_.eventsEndpoint)!==Y)continue;let z=_.path?S0(_.path):void 0;if(J&&z&&J!==z)continue;return!0}return!1}function t6($,Z){let Q=s6(Z);if(!Q)return $;if(a6($,Q))return $;let X={type:"vault",lfv:{path:Q.path,lfvServerUrl:Q.lfvServerUrl,clientId:Q.clientId,deliveryTimeout:Q.deliveryTimeout,retryInterval:Q.retryInterval,warnInterval:Q.warnInterval,deliveryEndpoint:Q.deliveryEndpoint,eventsEndpoint:Q.eventsEndpoint,verifyJwks:Q.verifyJwks}},Y=$.secrets??{},J=E9(Y,{clientId:Q.clientId,path:Q.path});return{...$,secrets:{...Y,[J]:X}}}function r6($,Z){let Q=Z9($.secrets),X=Z9(Z.secrets??void 0);for(let[Y,J]of Object.entries(X)){let _=Q[Y];if(!_)continue;let z=S0(_.deliveryEndpoint),G=S0(J.deliveryEndpoint);if(z&&G&&z!==G)throw Error(`LFV deliveryEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${z}, framework path: ${G}`);let K=S0(_.eventsEndpoint),H=S0(J.eventsEndpoint);if(K&&H&&K!==H)throw Error(`LFV eventsEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${K}, framework path: ${H}`)}}function o6($){return new Set(Object.keys($.secrets??{}))}function e6($){return new Set(Object.keys($.secrets??{}))}function $Q($){let Z=$.workload;if(!Z\|\|typeof Z!=="object"\|\|Array.isArray(Z))return new Set;if(!("outgoing"in Z))return new Set;let Q=Z.outgoing;if(!Q\|\|typeof Q!=="object"\|\|Array.isArray(Q))return new Set;return new Set(Object.keys(Q))}function e8($){if(!$\|\|typeof $!=="object"\|\|Array.isArray($))return!1;let Z=$;return"clientId"in Z\|\|"jwksUri"in Z\|\|"workloadId"in Z}function ZQ($){let Z=$.workload;if(!Z\|\|typeof Z!=="object"\|\|Array.isArray(Z))return new Set;let Q=Z;if("incoming"in Q\|\|"outgoing"in Q){let X=Q.outgoing;if(!X\|\|typeof X!=="object"\|\|Array.isArray(X))return new Set;return new Set(Object.keys(X))}if(e8(Q))return new Set;return new Set(Object.keys(Q).filter((X)=>X!=="default"))}function QQ($,Z,Q){let X=Z.secrets??{},Y=$.secrets??{};for(let[K,H]of Object.entries(X)){let V=Y[K];if(!V)continue;if(H.type&&V.type&&H.type!==V.type)throw Error(`Secrets source "${K}" type in framework config must match ConfigSource type. ConfigSource type: ${V.type}, framework type: ${H.type}`)}let J=o6(Z),_=e6($);for(let K of J)if(!_.has(K))Q.warn(`Framework config declares secrets source "${K}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let K of _)if(!J.has(K))Q.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:K});let z=$Q(Z),G=ZQ($);for(let K of z)if(!G.has(K))Q.warn(`Framework config declares outgoing workload client "${K}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(Z.otel!==void 0&&Z.otel!==null&&$.otel===void 0)Q.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function u8($,Z){if(Z===void 0)return!1;return E6($,Z)}function XQ($,Z){if(typeof Z!=="number"\|\|Z<=0)return $;return new Promise((Q,X)=>{let Y=setTimeout(()=>{X(Error(`Ionite ready() timed out after ${Z}ms`))},Z);$.then(()=>{clearTimeout(Y),Q()},(J)=>{clearTimeout(Y),X(J)})})}function YQ($,Z,Q){if(typeof Z!=="number"\|\|Z<=0)return $;return new Promise((X,Y)=>{let J=setTimeout(()=>{Y(Error(Q))},Z);$.then((_)=>{clearTimeout(J),X(_)},(_)=>{clearTimeout(J),Y(_)})})}function X9(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function l8($){return $==="/"?$:$.replace(/\/+$/,"")}function o4($,Z){return l8($)===l8(Z)}function c8($){return $.method==="GET"\|\|$.method==="HEAD"}function JQ($){if($.isReady()&&$.config?.readyz?.enabled===!1)return H0();let Z=$.readiness();return Response.json(GQ(Z),{status:Z.ok?200:503})}function GQ($){let Z=$.config.lastError;if(!Z)return $;return{...$,config:{...$.config,lastError:{kind:Z.kind,phase:Z.phase,at:Z.at,message:"[redacted]"}}}}var KQ={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz"};function zQ($){let Z=$?.providers;if(!Z)return!1;return Object.values(Z).some((Q)=>Q.enabled!==!1&&Q.type!=="magic-link")}function T0($,Z,Q={}){let X=KQ[$],Y=Z.modules[X],J=Q.capable??!0,_=Y.active&&Y.ready&&J,z=_?void 0:!Y.active\|\|!Y.ready?Y.reason:Q.incapableReason??`${$} is not testable by this application wiring`;return{module:X,active:Y.active,ready:Y.ready,testable:_,...Q.urls&&Q.urls.length>0?{urls:Q.urls}:{},...z?{reason:z}:{}}}function _Q($,Z,Q){let X=v0(Z),Y=$.readiness();return{basePath:Z,urls:X,modules:Y.modules,capabilities:{"sso.login":T0("sso.login",Y,{urls:[X.sso.loginUrl,X.sso.callbackUrl,X.sso.userUrl]}),"sso.jit":T0("sso.jit",Y,{capable:Q.sso?.enableJitUserProvisioning!==!1,incapableReason:"SSO JIT user provisioning is disabled in FrameworkConfig."}),"sso.logout":T0("sso.logout",Y,{urls:[X.sso.logoutUrl]}),"sso.back_channel_logout":T0("sso.back_channel_logout",Y,{urls:[X.sso.logoutBackChannelUrl]}),"ciam.magic_link":T0("ciam.magic_link",Y,{capable:Q.ciam?.enableJitUserProvisioning!==!1,urls:[X.ciam.magicLinkUrl,X.ciam.magicLinkLoginUrl],incapableReason:"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":T0("ciam.oidc_login",Y,{capable:zQ(Q.ciam),urls:[X.ciam.customerLoginUrl,X.ciam.customerCallbackUrl,X.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":T0("ciam.customer",Y,{urls:[X.ciam.customerUrl]}),"ciam.logout":T0("ciam.logout",Y,{urls:[X.ciam.logoutUrl]}),"iam.users":T0("iam.users",Y,{capable:Boolean(Q.iam?.userStore),urls:[X.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":T0("iam.groups",Y,{capable:Boolean(Q.authz?.catalogStore\|\|Q.authz?.catalog),urls:[X.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"workload.incoming":T0("workload.incoming",Y,{urls:[X.workload.validateUrl,X.workload.jwksUrl]}),"workload.outgoing":T0("workload.outgoing",Y,{}),"authz.oaa":T0("authz.oaa",Y,{capable:Boolean(Q.authz?.accessStore&&(Q.authz?.catalogStore\|\|Q.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."})}}}async function HQ($,Z,Q){if(!Z.isReady())return X9();if(Z.config?.capabilitiez!==!0\|\|!Q)return H0();let X=await e0($,Z,s8["capabilitiez.read"]);if(X)return X;return Response.json(Q.build(),{status:200})}async function BQ($,Z,Q){if(!Z.isReady())return X9();if(Z.config?.authz?.oaa?.fullSync?.enabled!==!0)return H0();let X=await e0($,Z,s8["authz.oaa.sync"]);if(X)return X;let Y=Z.authz?.oaa;if(!Y?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let J=Z.authz?await Z.authz.reconcile():void 0,_=Q.iam?.userStore,z=t8(Q.authz?.catalog?a8(Q.authz.catalog):void 0,Q.authz?.catalogStore),G=Q.authz?.accessStore,K=Q.authz?.resources;async functionH(){if(z)yieldK$((F,E)=>z.groups.list({start:F,limit:E}));if(K?.entitlements){let F=K.entitlements.bind(K);for await(let E of K$((B,D)=>K.list({start:B,limit:D})))yield*F(E).map((B)=>I6(B))}}let V=await Y.sync({users:_?K$((F,E)=>_.list({start:F,limit:E})):void 0,groups:z\|\|K?.entitlements?H():void 0,roles:z?K$((F,E)=>z.roles.list({start:F,limit:E})):void 0,permissions:z?K$((F,E)=>z.permissions.list({start:F,limit:E})):void 0,resources:K?K$((F,E)=>K.list({start:F,limit:E})):void 0,access:G?K$((F,E)=>G.list({start:F,limit:E})):void 0},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...V,reconcile:J})}function DQ($,Z,Q,X,Y,J){return async(_)=>{let z=new URL(_.url).pathname;if(o4(z,Q)){if(!c8(_))return V$(["GET"]);return JQ($)}if(o4(z,X)){if(!c8(_))return V$(["GET"]);return HQ(_,$,Y)}if(J&&o4(z,J.url)){if(_.method!=="POST")return V$(["POST"]);return BQ(_,$,J.frameworkConfig)}let G=$.secrets;if(!Boolean(G?.isLfvDeliveryRequest?.(_)\|\|G?.isLfvEventsRequest?.(_))&&!$.isReady())return X9();try{return await Z(_)}catch(H){return $.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},H),D$(H)}}}function i8($,Z,Q){if($)return Q&&!$.tenantId?{...$,tenantId:Q}:$;if(Z&&Q)return{tenantId:Q};return}function VQ($,Z){if(Z.authz===null)return;if(!$.authz&&!Z.authz)return;return{...$.authz,...Z.authz,oaa:$.authz?.oaa\|\|Z.authz?.oaa?{...$.authz?.oaa,...Z.authz?.oaa}:void 0}}function e4($){let Z=!1,Q=q0(`${$} module`,()=>Z);return{isReady:Q.isReady,ready:Q.ready,attach(X){if(Z=X!==void 0,Q.refresh(),!X)return;return Object.defineProperty(X,"isReady",{value:Q.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(X,"ready",{value:Q.ready,enumerable:!1,configurable:!0}),X}}}function Q9($){if(!$)return!1;return $.isReady?$.isReady():!1}function x$($,Z,Q,X){if(!$)return{active:!1,ready:!1,reason:Q};return Q9(Z)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:X}}function UQ(){let $=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:$(),ciam:$(),iam:$(),workload:$(),otel:$(),secrets:$(),authz:$()}}function FQ($,Z){let Q=$.isReady(),X=$.config;if(!Q\|\|!X)return{ok:!1,applied:Q,modules:UQ(),config:{...Z}};let Y=Boolean(X.workload)\|\|Boolean($.workload),J={sso:x$(Boolean(X.sso),$.sso,"sso not configured (no RemoteConfig.sso)","sso configured but not ready"),ciam:x$(Boolean(X.ciam),$.ciam,"ciam not configured (no RemoteConfig.ciam)","ciam configured but not ready"),iam:x$(Boolean(X.iam),$.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:x$(Y,$.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:x$(Boolean(X.otel),$.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(X.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!Q9($.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return $.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),authz:(()=>{if(!Boolean(X.authz?.oaa))return{active:!0,ready:!0};let G=$.authz?.oaa;return Q9(G)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})()};return{ok:Object.values(J).every((z)=>!z.active\|\|z.ready),applied:Q,modules:J,config:{...Z}}}function MQ($,Z){let Q=[];for(let X of Z){let Y=$.modules[X];if(!$.applied){Q.push({name:X,reason:"RemoteConfig has not been applied yet"});continue}if(!Y?.ready)Q.push({name:X,reason:Y?.reason??`${X} is not ready`})}return{ok:Q.length===0,notReady:Q}}function LQ($,Z,Q,X,Y,J){let _=Z.validators,z=R6($.cache);T6(z.jwks);let G=Z;if(z.session.read.enabled){let m=Z.sso?.sessionStore??Z.ciam?.sessionStore;if(m){let C=k4(m,z.session.read);G={...Z,sso:Z.sso?{...Z.sso,sessionStore:C}:Z.sso,ciam:Z.ciam?{...Z.ciam,sessionStore:C}:Z.ciam}}}let K={sessionCache:z.session},H=g0(_.workload,Q,$?.workload,Z.workload??void 0),V=Z.otel!==null?h9(Q,$?.otel,Z.otel??void 0):void 0,F=i8($?.sso,Z.sso,$.id),E=P6(_.sso,Q,F,G.sso??void 0,K),B={...$?.iam,...Z.iam},D=Z.authz?.catalog?a8(Z.authz.catalog):void 0,x=Boolean(B.url\|\|B.userStore\|\|Z.authz?.catalogStore\|\|D),M=J.update({mode:B.delta,url:B.url,audience:B.deltaAudience,tenantId:$.id},{workload:H,userStore:B.userStore,catalogStore:t8(D,Z.authz?.catalogStore),resources:Z.authz?.resources,idMapStore:B.deltaIdMapStore}),W;if(x&&!H){if(Object.keys($).length>0)Q.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");W=void 0}else W=q6(_.iam,Q,H,Y,Z.authz?.accessStore,Z.authz?.accessIndex,Z.authz?.catalogStore,D,Z.authz?.resources,$?.iam,Z.iam??void 0,M,Z.authz?.onAccessMutation,A6($.authz));let q=i8($?.ciam,Z.ciam,$.id),T=j6(_.ciam,Q,q,G.ciam??void 0,H,K);return{secret:X,workload:H,otel:V,sso:E,iam:W,ciam:T}}function $Z($,Z,Q,X,Y,J,_,z){let G=J.authz.update(VQ(Z,Q)),K=LQ(Z,Q,X,Y,G,J.iamDelta);$.id=Z.id,$.config=Z,$.secret=K.secret,$.secrets=J.secrets.update(Z.secrets,Q.secrets??void 0,Q.validators.secrets),$.workload=J.workload.update(K.workload),$.otel=J.otel.update(K.otel),$.authz=G,$.log=J.log.update($.otel?.logger??X),$.sso=J.sso.attach(K.sso),$.iam=J.iam.attach(K.iam),$.ciam=J.ciam.attach(K.ciam);let H=v0(_),V=(F)=>q4(F,$,z?.routing,H);$.handler=DQ($,V,H.readyzUrl,H.capabilitiezUrl,{build:()=>_Q($,_,Q)},{url:J9(_),frameworkConfig:Q})}function WQ($,Z,Q,X,Y,J,_,z){u6($.id,Z),l6(Z),i6(Z),n6(Z,Q,X),r6(Z,Q),QQ(Z,Q,X),$Z($,Z,Q,X,Y,J,_,z)}function n8($){if(!$.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return $.secret}async function OQ($,Z,Q,X,Y,J,_){let z=$,G=G9($,Z,Y.current,J);if(X.beforeChange){let K=r8(G,Y);_?.enter();let H;try{H=await X.beforeChange($,K,Q)}finally{_?.exit()}if(H?.config!==void 0)z=H.config;G=H?.frameworkConfig??K}return G=O$(G,Y.current),{effectiveRemoteConfig:z,effectiveFrameworkConfig:G}}function F5($,Z){let Q=x6(Z),{frameworkConfig:X,basePath:Y,stores:J,options:_}=Q,z=O$(t6(X,$),J),G=z.log\|\|r4,K={current:J},H={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:z},V={log:S6(G),secrets:G8(G),workload:M8(G),otel:f9(G),authz:N9(G),iamDelta:N4(G),sso:e4("sso"),iam:e4("iam"),ciam:e4("ciam")},F={},E,B,D=new Promise((p,$0)=>{E=p,B=$0}),x=!1,M,W,q=0,T={enter:()=>{q+=1},exit:()=>{q-=1}},m=Promise.resolve();function C(p){let $0=m.then(p,p);return m=$0.then(()=>{return},()=>{return}),$0}function c(p){if(x)throw Error(`Ionite instance has been closed and cannot call ${p}().`)}function Z0(){$.log=H.frameworkConfig.log??r4,$.validators=H.frameworkConfig.validators}let o={},j={log:G,id:void 0,config:void 0,secret:n8($),authz:void 0,configStatus:F,handler:async()=>H0(),ready:(p)=>{if(q>0&&H.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return XQ(D,p)},isReady:()=>H.remoteConfig!==void 0,readiness:()=>FQ(j,F),requireReady:(p)=>MQ(j.readiness(),p),close:()=>{if(x)return;if(x=!0,W)clearTimeout(W),W=void 0;M?.(),M=void 0;let p=[()=>V.secrets.close(),()=>V.authz.close(),()=>V.otel.shutdown()];for(let $0 of p)try{Promise.resolve($0()).catch((_0)=>{G.warn("Ionite close: module teardown failed",_0)})}catch(_0){G.warn("Ionite close: module teardown failed",_0)}E?.(),E=void 0,B=void 0},setStores:async(p)=>{c("setStores");let $0=b$(p);await C(()=>d($0))}};$Z(j,o,H.frameworkConfig,G,j.secret,V,Y,_),Z0();function N(){let p=F.lastError!==void 0;if(F.appliedAt=Date.now(),F.lastError=void 0,p)(j.log??G).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function P(p,$0){let _0=$9($0)??($0 instanceof Error?$0.message:String($0)),B0=v6($0),L=F.lastError===void 0;if(F.lastError={kind:B0,message:_0,at:Date.now(),phase:p},L)(j.log??G).error(p==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":B0,phase:p,error:_0})}function y(p,$0,_0){(j.log??G).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:p,"ion.config.hash":$0,"ion.config.apply_ms":_0})}async function S(p,$0){if(x)return;let _0=g8(p);if($0&&H.remoteConfig!==void 0&&_0===H.remoteConfigHash&&u8(p,H.remoteConfig))return;let B0=H.remoteConfig,L=B0===void 0?"initial":"update",b=Date.now(),g,a,t;try{let A=await OQ(p,H.frameworkConfig,H.remoteConfig,_,K,Y,T);if(g=A.effectiveRemoteConfig,a=g8(g),t=A.effectiveFrameworkConfig,$0&&_.beforeChange===void 0&&H.remoteConfig!==void 0&&a===H.remoteConfigHash&&u8(g,H.remoteConfig)&&t===H.frameworkConfig)return;let O=t.log\|\|r4;WQ(j,g,t,O,n8($),V,Y,_)}catch(A){throw P(L,A),A}H.remoteConfig=g,H.remoteConfigHash=a,H.frameworkConfig=t,Z0(),N(),await V.otel.settled();let J0=r8(H.frameworkConfig,K),V0=!1;try{_.afterChange?.(j,g,J0,B0)}catch(A){if((j.log??G).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:L,error:A instanceof Error?A.message:String(A)}),L==="initial"){V0=!0;let O=A instanceof Error?A:Error(`afterChange failed on initial load: ${String(A)}`);P("initial",O),B?.(O),B=void 0,E=void 0}}if(H.frameworkConfig=J0,Z0(),!V0)y(L,a,Date.now()-b);if(!V0&&E)E(),E=void 0}async function d(p){if(x)return;if(K.current=p,H.remoteConfig===void 0){H.frameworkConfig=O$(H.frameworkConfig,p),Z0();return}await S(H.remoteConfig,!1)}if($.subscribe)$.subscribe((p)=>{C(()=>S(p,!0)).catch(()=>{})},{mode:"wait"}).then((p)=>{if(x){p?.();return}M=p}).catch((p)=>{G.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:p instanceof Error?p.message:String(p)})});let i=m6(_.configRetry),e=[_.onConfigLoadError??g6(G)],Y0=0;function K0(){if(W=void 0,x)return;if(H.remoteConfig!==void 0)return;YQ($.load(),i.loadTimeoutMs,`ConfigSource initial load timed out after ${i.loadTimeoutMs}ms`).then(async(p)=>{Y0=0;try{await C(async()=>{if(H.remoteConfig!==void 0)return;await S(p,!0)})}catch($0){let _0=$0 instanceof Error?$0:Error(`Initial RemoteConfig application failed: ${String($0)}`);G.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:_0.message}),B?.(_0),B=void 0}},async(p)=>{if(x)return;Y0+=1;let $0=p6(Y0,i),_0=$9(p)??"RemoteConfig load failed",B0=y6(p),L=x0(p,"code"),b=x0(p,"status"),g={attempt:Y0,error:p,errorKind:B0,maxDelayMs:i.maxDelayMs,message:_0,nextDelayMs:$0,code:typeof L==="string"?L:void 0,status:typeof b==="number"?b:void 0,path:typeof x0(p,"path")==="string"?x0(p,"path"):void 0,sourceType:typeof x0(p,"sourceType")==="string"?x0(p,"sourceType"):void 0};if(!f6(p,B0)){let a=p instanceof Error?p:Error(`ConfigSource initial load failed with unrecoverable ${B0}: ${_0}`);G.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:B0,error:_0,code:g.code,status:g.status,path:g.path,sourceType:g.sourceType}),B?.(a),B=void 0;return}try{await d6(g,e)}catch(a){let t=a instanceof Error?a:Error("ConfigSource retry hook stopped RemoteConfig retrying");B?.(t),B=void 0;return}W=setTimeout(K0,$0)})}return K0(),j}export{b2 as workloadHandler,g0 as workload,z7 as withSetCookies,K7 as withDefaultExternalId,G7 as verifyUser,$8 as vaultSocketDiagnostics,G4 as vaultConfig,u4 as validateWorkloadToken,p2 as tenantManager,_6 as tenantConfigSource,p0 as subscribeSecretPathWithHttpPolling,J7 as sso,c9 as setVaultWebSocketCommandTimeout,Y7 as sendTenantWebhook,G6 as secretConfigSource,X7 as sameOriginRedirectRules,q4 as routeRequest,m8 as rewriteRequestPath,t4 as rewriteRequestForTenantPath,L6 as rewriteRequestForDefaultTenantUi,M6 as rewriteRequestForDefaultTenantApi,k2 as revokeWorkloadToken,f8 as resolveTenantFromRequest,Q7 as resolveRedirect,p9 as resolveDefaultRoute,Z7 as resolveCapturedRedirect,$7 as resolveAfterRedirect,z6 as registerConfigLocatorAssert,e5 as reconcileSubjectAccess,O6 as openbaoVault,o5 as listSsoClientIdsFromCookies,A5 as listGenerator,j$ as lfvVault,i2 as isVaultConfigWaitingForSecretError,n2 as isVaultConfigInvalidPayloadError,r5 as isRedirectAllowed,F5 as ionite,t5 as initiateLogin,l$ as iamDeltaIdMapKey,a5 as iam,n5 as hasScope,i5 as hasRole,c5 as hasPermission,l5 as hasGroup,u5 as hasAnyScope,d5 as hasAny,g5 as hasAllScope,p5 as hasAll,m5 as has,C2 as getWorkloadToken,w2 as getWorkload,f5 as getUser,h5 as getCustomer,O5 as generateULID,s4 as gcpConfig,v5 as expandRoot,W4 as escapeScimFilterValue,X6 as envConfig,e0 as enforceEndpointAuthz,y5 as discoverSessions,b5 as discoverSessionRecords,v0 as deriveIonUrls,k5 as defaultRedirectPolicies,F6 as createTenantIonResolver,W6 as createTenantIonHandler,k4 as createSessionReadCache,N4 as createManagedIamDelta,J$ as configSourceFromLocator,x8 as configSourceFromEnvValues,I8 as configLocatorFromEnvValues,C5 as collectReferencedDefinitions,Z8 as closeAllVaultSockets,w5 as ciam,S5 as captureRedirect,x5 as callback,P5 as blockDangerousUrls,J4 as azureConfig,n4 as awsConfig,R5 as allowSameOrigin,q5 as allowRelativePaths,T5 as allowOrigins,j5 as allowHosts,P0 as VaultSubscribeNotSupportedError,Y$ as VaultConfigWaitingForSecretError,P$ as VaultConfigInvalidPayloadError,a$ as VAULT_MIN_POLLING_TTL_MS,i$ as ScimOutboundClient,N5 as IoniteError,a0 as InMemoryWorkloadTokenStore,p8 as InMemoryWorkloadIdentityStore,k$ as InMemoryUserStore,s5 as InMemoryTenantStore,C$ as InMemorySessionStore,A8 as InMemoryResourceStore,w$ as InMemoryMagicLinkStore,c$ as InMemoryIamDeltaIdMapStore,S$ as InMemoryCustomerStore,E8 as InMemoryAccessIndex,N8 as InMemoryAccessCatalogStore,d0 as InMemoryAccessAssignmentStore,K6 as ION_CAPABILITY_CATALOG,I5 as CatalogAdjacencyCache};

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/server",
-  "version": "0.0.22",
+  "version": "0.0.23-beta.20260729.1",
   "description": "ionite Server (Node/server-only)",
   "private": false,
   "author": "ionite",
@@ -24,7 +24,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@ionite/core": "^0.0.22",
+    "@ionite/core": "0.0.23-beta.20260729.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.220.0",
     "@opentelemetry/exporter-logs-otlp-http": "^0.220.0",