@ionite/server 0.0.23-beta.20260812.6 → 0.0.23-beta.20260814.1

package/dist/index.d.ts

@@ -759,7 +759,7 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.23-beta.20260812.6";
+declare const ION_SDK_VERSION = "0.0.23-beta.20260814.1";
 import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite4, JWTAssertionClaims, Logger as Logger5, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**

package/dist/index.js

@@ -1 +1,5 @@
-import{configTrustedClientGrants as $3,deepEqualPlain as Z3,defaultLogger as K4,ION_ENDPOINT_PERMISSIONS as D9,listGenerator as H$,stableConfigHash as J9,toCodeCatalog as V9,unionCatalogRead as U9}from"@ionite/core";import{ciam as Q3,configureJwksCache as X3,iam as Y3,resolveCacheConfig as J3,sso as G3,withDefaultExternalId as z3}from"@ionite/core/server";import{trimTrailingSlash as M4}from"@ionite/core";import{list as E9}from"@ionite/core";class C${customers=new Map;userNameIndex=new Map;async get($){return this.customers.get($)}async lookup($){if($.id){let Z=this.customers.get($.id);if(Z)return Z}if($.userName){let Z=this.userNameIndex.get($.userName.toLowerCase());if(Z)return this.customers.get(Z)}return}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q={...$,id:Z},X=this.customers.get(Z);if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase())}if(this.customers.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);return Q}async delete($){let Z=this.customers.get($);if(Z?.userName)this.userNameIndex.delete(Z.userName.toLowerCase());return this.customers.delete($),Z?1:0}async list($){let Z=Array.from(this.customers.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,K=Z.slice(Q,J);return E9(Y,K,Q,X)}}class k${magicLinks=new Map;async create($,Z,Q){if(this.magicLinks.has($))throw Error(`Magic link with token ${$} already exists`);let X={token:$,customer:Z,createdAt:new Date,expiresAt:Q};this.magicLinks.set($,X)}async get($){let Z=this.magicLinks.get($);if(!Z)return null;if(Date.now()>Z.expiresAt.getTime())return this.magicLinks.delete($),null;return Z}async getAndDelete($){let Z=this.magicLinks.get($);if(this.magicLinks.delete($),!Z)return null;if(Date.now()>Z.expiresAt.getTime())return null;return Z}async delete($){this.magicLinks.delete($)}}function q9($){let Z=$.expiresAt;if(!Z)return;let Q=Z instanceof Date?Z.getTime():new Date(Z).getTime();return Number.isNaN(Q)?void 0:Q}class b${sessions=new Map;async create($){if(this.sessions.has($.sid))throw Error(`Session with sid ${$.sid} already exists`);this.sessions.set($.sid,$)}async get($){let Z=this.sessions.get($);if(!Z)return null;let Q=q9(Z);if(Q!==void 0&&Date.now()>Q)return this.sessions.delete($),null;return Z}async update($,Z){let Q=this.sessions.get($);if(!Q)throw Error(`Session with sid ${$} not found`);let X={...Q,...Z};this.sessions.set($,X)}async delete($){this.sessions.delete($)}}import{list as R9}from"@ionite/core";class y${users=new Map;userNameIndex=new Map;async get($){return this.users.get($)}async lookup($){return this.users.get($.id??"")}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q={...$,id:Z},X=this.users.get(Z);if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase())}if(this.users.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);return Q}async delete($){let Z=this.users.get($);if(Z){if(Z.userName)this.userNameIndex.delete(Z.userName.toLowerCase())}return this.users.delete($),Z?1:0}async list($){let Z=Array.from(this.users.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,K=Z.slice(Q,J);return R9(Y,K,Q,X)}}class $${tokens=new Map;async set($){this.tokens.set($.workload_id,$)}async get($){let Z=this.tokens.get($);if(!Z)return null;if(Date.now()>Z.expires_at.getTime())return this.tokens.delete($),null;return Z}async delete($){this.tokens.delete($)}async isValid($){return await this.get($)!==null}async cleanup(){let $=Date.now();for(let[Z,Q]of this.tokens.entries())if($>Q.expires_at.getTime())this.tokens.delete(Z)}}function f0($){let Z=M4($||U2);return{readyzUrl:`${Z}/readyz`,capabilitiezUrl:`${Z}/capabilitiez`,sso:{loginUrl:`${Z}/auth/login`,userUrl:`${Z}/auth/user`,logoutUrl:`${Z}/auth/logout`,logoutBackChannelUrl:`${Z}/auth/logout/backchannel`,refreshUrl:`${Z}/auth/refresh`,callbackUrl:`${Z}/auth/callback`},workload:{validateUrl:`${Z}/workload/validate`,jwksUrl:`${Z}/workload/jwks`},iam:{basePath:`${Z}/iam`,usersUrl:`${Z}/iam/Users`,groupsUrl:`${Z}/iam/Groups`},ciam:{magicLinkUrl:`${Z}/magic-link`,magicLinkLoginUrl:`${Z}/magic-link/login`,customerUrl:`${Z}/auth/customer`,customerLoginUrl:`${Z}/auth/customer/login`,customerCallbackUrl:`${Z}/auth/customer/callback`,customerProvidersUrl:`${Z}/auth/customer/providers`,logoutUrl:`${Z}/auth/customer/logout`}}}function L4($){return`${M4($||U2)}/authz/oaa/sync`}function T9($,Z){if($===null)return null;let Q={validateUrl:Z.validateUrl,jwksUrl:Z.jwksUrl};if($&&typeof $==="object"&&(("incoming"in $)||("outgoing"in $))){let X=$;return{...X,incoming:{...X.incoming,...Q}}}return{...$??{},...Q}}function W4($,Z,Q,X){let Y={...Z},J=f0(X);if(Y.sso!==null)if($.sso)Y.sso={...Y.sso,loginUrl:J.sso.loginUrl,userUrl:J.sso.userUrl,logoutUrl:J.sso.logoutUrl,logoutBackChannelUrl:J.sso.logoutBackChannelUrl,refreshUrl:J.sso.refreshUrl,redirectUri:J.sso.callbackUrl,sessionStore:Q.sessionStore,userStore:Q.userStore,enableJitUserProvisioning:Y.sso?.enableJitUserProvisioning??!0};else Y.sso=void 0;if(Y.iam!==null)if($.iam)Y.iam={...Y.iam,usersUrl:J.iam.usersUrl,groupsUrl:J.iam.groupsUrl,userStore:Q.userStore};else Y.iam=void 0;if(Y.workload!==null){if($.workload||Y.workload)Y.workload=T9(Y.workload,J.workload)}if(Y.ciam!==null)if($.ciam)Y.ciam={...Y.ciam,magicLinkUrl:J.ciam.magicLinkUrl,magicLinkLoginUrl:J.ciam.magicLinkLoginUrl,customerUrl:J.ciam.customerUrl,customerLoginUrl:J.ciam.customerLoginUrl,customerCallbackUrl:J.ciam.customerCallbackUrl,customerProvidersUrl:J.ciam.customerProvidersUrl,logoutUrl:J.ciam.logoutUrl,providers:$.ciam.providers,sessionStore:Q.sessionStore,customerStore:Q.customerStore,magicLinkStore:Q.magicLinkStore,enableJitUserProvisioning:Y.ciam?.enableJitUserProvisioning??!0};else Y.ciam=void 0;return Y}function j$($,Z){let Q={...$};if(Q.sso)Q.sso={...Q.sso,sessionStore:Z.sessionStore,userStore:Z.userStore};if(Q.iam)Q.iam={...Q.iam,userStore:Z.userStore,deltaIdMapStore:Z.deltaIdMapStore};if(Q.workload)Q.workload={...Q.workload,tokenStore:Z.workloadTokenStore,workloadIdentityStore:Z.workloadIdentityStore};if(Q.ciam)Q.ciam={...Q.ciam,sessionStore:Z.sessionStore,customerStore:Z.customerStore,magicLinkStore:Z.magicLinkStore};if(Q.authz!==null&&(Z.accessStore||Z.accessIndex||Z.catalog||Z.catalogStore||Z.resources))Q.authz={...Q.authz,accessStore:Z.accessStore,accessIndex:Z.accessIndex,catalog:Z.catalog,catalogStore:Z.catalogStore,resources:Z.resources};return Q}var U2="/api/ionite";function v$($){return{sessionStore:$?.sessionStore??new b$,userStore:$?.userStore??new y$,customerStore:$?.customerStore??new C$,accessStore:$?.accessStore,accessIndex:$?.accessIndex,catalog:$?.catalog,catalogStore:$?.catalogStore,resources:$?.resources,magicLinkStore:$?.magicLinkStore??new k$,workloadTokenStore:$?.workloadTokenStore??new $$,workloadIdentityStore:$?.workloadIdentityStore,deltaIdMapStore:$?.deltaIdMapStore}}function h$(){return U2}import{accessRefId as N2,accessRootId as X6,configTrustedClientGrants as Y6,listGenerator as w4,toCodeCatalog as J6}from"@ionite/core";import{CatalogAdjacencyCache as G6,expandRoot as z6,reconcileSubjectAccess as K6,withDefaultExternalId as _6}from"@ionite/core/server";import{accessRefId as m0,accessRootId as P9,ION_AUTHZ_GROUP_SCHEMA as I9}from"@ionite/core";import{collectReferencedDefinitions as x9,withDefaultExternalId as S9}from"@ionite/core/server";function W0($,Z,Q=(X)=>Error(`${$} ready timed out after ${X}ms`)){let X=!1,Y,J,K=()=>{X=!1,J=new Promise((_)=>{Y=_})};K();let z=()=>{X=!0,Y?.(),Y=void 0},G=()=>{if(Z()){if(!X)z();return}if(X)K()};return G(),{isReady:()=>Z(),ready:(_)=>{if(Z())return Promise.resolve();let H=J;if(!_||_<=0)return H;return new Promise((D,V)=>{let P=setTimeout(()=>V(Q(_)),_);H.then(()=>{clearTimeout(P),D()},(L)=>{clearTimeout(P),V(L)})})},refresh:G,settle:z}}var A4="App",w9="ionite",j4=104857600,C9=j4,k9=10485760,F2=3,b9=250,y9={};function a0($,Z){return Z.mapGroup?Z.mapGroup($):$}class b0 extends Error{retryable;code;status;warnings;constructor($,Z={}){super($,{cause:Z.cause});this.name="OaaError",this.retryable=Z.retryable??!1,this.code=Z.code,this.status=Z.status,this.warnings=Z.warnings,Object.setPrototypeOf(this,b0.prototype)}}function v9($){let Z=$();return Boolean(Z?.url&&Z.providerId&&Z.datasourceId)}function E4($,Z,Q,X,Y){let J=async(z)=>{await N4($,N0(Z),z,{mode:"incremental"})},K=W0("OAA",()=>v9(Z),(z)=>new b0(`OAA ready timed out after ${z}ms`,{code:"not_ready"}));return{isReady:K.isReady,ready:K.ready,refreshReadiness:K.refresh,async pushUser(z){let G=N0(Z);await J(q0(G,{local_users:[R4(z,"modify")]},!0))},async pushGroup(z){let G=N0(Z),_=Q(),H=a0(z,_),D=g$(H,s0(G),"add"),V=await M2(H,"group",Y?.(),_,G);await J(q0(G,E$({local_groups:[Z$(H,"modify")],identity_to_permissions:D?[D]:[]},V),!0))},async pushRole(z){let G=N0(Z),_=Q(),H=_.mapRole?_.mapRole(z):z,D=await M2(H,"role",Y?.(),_,G);await J(q0(G,E$({local_roles:[Q$(H,"modify")]},D),!0))},async pushPermission(z){let G=N0(Z);await J(q0(G,{permissions:[D$(z,Q().mapPermissionTypes,"modify")]},!0))},async pushResource(z){let G=N0(Z),_=Q(),H=_.mapResource?_.mapResource(z):z,D=await u9(H,Y?.(),_);await J(q0(G,{resources:D},!0))},async grant(z){let G=N0(Z),_=Q(),H=await q4(z,Y?.(),_,G);await J(O4(G,z,"add",_,H))},async revoke(z){let G=N0(Z);await J(O4(G,z,"delete",Q()))},async pushAccessChanges(z){if(z.length===0)return;let G=N0(Z),_=Q(),H=Y?.(),D=await f9(G,z,_,H);await J(D)},async deleteUser(z){let G=N0(Z);await J(q0(G,{local_users:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteGroup(z){let G=N0(Z);await J(q0(G,{local_groups:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteRole(z){let G=N0(Z);await J(q0(G,{local_roles:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deletePermission(z){let G=N0(Z);await J(q0(G,{permissions:[{name:z,unique_id:z,permission_type:[],operation:"delete"}]},!0))},async deleteResource(z){let G=N0(Z);await J(q0(G,{resources:[{name:z,id:z,resource_type:"",operation:"delete"}]},!0))},async sync(z,G){let _=N0(Z),H=G?.mode==="incremental",D=H?void 0:X?.(),V=await h9(_,z,Q(),H,D);return N4($,_,V,G)}}}function N0($){let Z=$();if(!Z?.url||!Z.providerId||!Z.datasourceId)throw new b0("OAA is not configured",{code:"not_configured"});return Z}async function h9($,Z,Q,X,Y){let J=[],K=[],z=[],G=[],_=[],H=[],D=X?"modify":void 0,V=new Set,P=(B)=>P9(B);for await(let B of B$(Z.users))J.push(R4(B,D));for await(let B of B$(Z.groups)){let R=a0(B,Q);K.push(Z$(R,D));let A=g$(R,s0($),X?"add":void 0);if(A)H.push(A)}for await(let B of B$(Z.roles)){let R=Q.mapRole?Q.mapRole(B):B;_.push(Q$(R,D))}for await(let B of B$(Z.permissions))G.push(D$(B,Q.mapPermissionTypes,D));let L=[];for await(let B of B$(Z.resources)){let R=Q.mapResource?Q.mapResource(B):B;L.push(R)}z.push(...T4(L,D));for await(let B of B$(Z.access))if(V.add(P(B)),m$(B,H,J,s0($),X?"add":void 0),typeof B.target!=="string")if(B.targetType==="role"){let R=Q.mapRole?Q.mapRole(B.target):B.target;_.push(Q$(R,D))}else if(B.targetType==="permission")G.push(D$(B.target,Q.mapPermissionTypes,D));else{let R=a0(B.target,Q);K.push(Z$(R,D))}for(let B of Y??[]){let R=P(B);if(V.has(R))continue;V.add(R);let A=m0(B.subject);if(A&&!J.some((W)=>m0(W.unique_id??W.name)===A))J.push({name:A,unique_id:A,is_active:!0,operation:D,custom_properties:{identity_type:"workload",source:"eci-trusted"}});m$(B,H,J,s0($),D)}return q0($,{local_users:J,local_groups:K,local_roles:_,resources:z,permissions:G,identity_to_permissions:H},X)}function q0($,Z,Q){let X={name:$.applicationName??A4,application_type:$.applicationType??w9,local_users:Z.local_users??[],local_groups:Z.local_groups??[],local_roles:Z.local_roles??[],resources:Z.resources??[],custom_properties:{},tags:[]};if(Q)X.operation="modify";return A0({applications:[X],permissions:Z.permissions??[],identity_to_permissions:Z.identity_to_permissions??[],is_incremental:Q?!0:void 0})}function O4($,Z,Q,X=y9,Y){let J=[],K=[],z=[],G=[],_=[];m$(Z,J,K,s0($),Q);let H=Q==="delete"?"delete":"modify";if(typeof Z.target!=="string")if(Z.targetType==="role"){let V=X.mapRole?X.mapRole(Z.target):Z.target;G.push(Q$(V,H))}else if(Z.targetType==="permission")_.push(D$(Z.target,X.mapPermissionTypes,H));else{let V=a0(Z.target,X);z.push(Z$(V,H))}let D={local_users:K,local_groups:z,local_roles:G,permissions:_,identity_to_permissions:J};return q0($,Y?E$(D,Y):D,!0)}async function f9($,Z,Q,X){let Y=s0($),J=[],K=[],z=[],G=[],_=[],H=[],D=[],V=[];for(let{change:L,op:B}of Z){m$(L,B==="delete"?G:K,B==="delete"?z:J,Y,B==="delete"?"delete":"add");let F=B==="delete"?"delete":"modify";if(typeof L.target!=="string")if(L.targetType==="role"){let M=Q.mapRole?Q.mapRole(L.target):L.target;H.push(Q$(M,F))}else if(L.targetType==="permission")D.push(D$(L.target,Q.mapPermissionTypes,F));else{let M=a0(L.target,Q);_.push(Z$(M,F))}if(B==="add")V.push(await q4(L,X,Q,$))}let P={local_users:[...J,...z],local_groups:_,local_roles:H,permissions:D,identity_to_permissions:[...K,...G]};return q0($,E$(P,...V),!0)}function E$(...$){let Z={},Q=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let X of $)for(let Y of Q){let J=X[Y];if(J&&J.length>0)Z[Y]=[...Z[Y]??[],...J]}return Z}async function M2($,Z,Q,X,Y){if(!Q)return{};let J=await x9($,Z,{catalog:Q.catalog,code:Q.code,resources:Q.resources,cache:Q.cache}),K=[];for(let z of J.groups){let G=a0(z,X),_=g$(G,s0(Y),"add");if(_)K.push(_)}return{local_groups:J.groups.map((z)=>Z$(a0(z,X),"modify")),local_roles:J.roles.map((z)=>Q$(X.mapRole?X.mapRole(z):z,"modify")),permissions:J.permissions.map((z)=>D$(z,X.mapPermissionTypes,"modify")),resources:J.resources.map((z)=>p$(X.mapResource?X.mapResource(z):z,"modify")),identity_to_permissions:K}}async function q4($,Z,Q,X){if(!Z)return{};if($.targetType!=="group"&&$.targetType!=="role")return{};let Y=m0($.target);if(!Y)return{};let J=typeof $.target==="string"?await m9($.targetType,Y,Z):$.target;if(!J)return{};let K={};if(typeof $.target==="string")if($.targetType==="group"){let G=a0(J,Q),_=g$(G,s0(X),"add");K={local_groups:[Z$(G,"modify")],identity_to_permissions:_?[_]:[]}}else{let G=Q.mapRole?Q.mapRole(J):J;K={local_roles:[Q$(G,"modify")]}}let z=await M2(J,$.targetType,Z,Q,X);return E$(K,z)}async function m9($,Z,Q){if(Q.cache)return await Q.cache.getNode($,Z);let X=$==="group"?Q.code?.groups.get(Z):Q.code?.roles.get(Z);if(X)return X;let J=await($==="group"?Q.catalog?.groups:Q.catalog?.roles)?.get(Z);if(J)return J;if($==="group")return S9(await Q.resources?.entitlement?.(Z));return}function m$($,Z,Q,X,Y){let J=m0($.subject),K=m0($.target),z=Q.find((D)=>m0(D.unique_id??D.name)===J);if($.subjectType==="workload")if(z)z.custom_properties={...z.custom_properties,identity_type:"workload"};else z={name:J,unique_id:J,custom_properties:{identity_type:"workload"},operation:Y},Q.push(z);if($.targetType==="group"){if(z){let D=new Set(z.groups??[]);if(D.add(K),z.groups=[...D],Y)z.operation=Y}else Q.push({name:J,unique_id:J,groups:[K],operation:Y});return}let G={identity:J,identity_type:"local_user",operation:Y},_=$.resources??[],H=$.applyToApplication??_.length===0;if($.targetType==="role")G.role_assignments=[{application:X,role:K,apply_to_application:H,resources:_,operation:Y}];else G.application_permissions=[{application:X,permission:K,apply_to_application:H,resources:_,operation:Y}];Z.push(G)}function R4($,Z){return A0({name:$.displayName??$.name??$.userName??$.id,unique_id:$.id,identities:g9($),groups:$.groups?.map((Q)=>Q.value),is_active:$.active,created_at:e9($.createdAt),custom_properties:A0({ecid:$.ecid,accountClass:$.accountClass,externalId:$.externalId,userName:$.userName,tenantId:$.tenantId}),tags:[],operation:Z})}function g9($){let Z=$.email?[$.email]:$.emails?.map((X)=>X.value).filter(Boolean)??[],Q=[...$.ecid?[$.ecid]:[],...Z];return Q.length>0?Q:void 0}function Z$($,Z){let Q=p9($),X=B0($,"id")??B0($,"externalId")??B0($,"name")??B0($,"displayName"),Y=B0($,"displayName")??B0($,"name")??X??"group",J=f$($,"resources");return A0({name:Y,unique_id:X,custom_properties:A0({requestable:Q?.requestable??$6($,"requestable"),description:Q?.description??B0($,"description"),type:Q?.type,externalId:B0($,"externalId"),resources:J.length>0?J:void 0}),tags:[],operation:Z})}function p9($){let Z=$[I9];if(!Z||typeof Z!=="object"||Array.isArray(Z))return;return Z}function f$($,Z){if(!$||typeof $!=="object")return[];let Q=$[Z];if(!Array.isArray(Q))return[];return Q.map(m0).filter((X)=>X.length>0)}function d9($){return B0($,"id")??B0($,"externalId")??B0($,"name")??B0($,"displayName")??"group"}function g$($,Z,Q){let X=f$($,"resources"),Y=X.length>0,J=!Y,K=Y?X:[],z=f$($,"roles").map((_)=>({application:Z,role:_,apply_to_application:J,resources:K,operation:Q})),G=f$($,"permissions").map((_)=>({application:Z,permission:_,apply_to_application:J,resources:K,operation:Q}));if(z.length===0&&G.length===0)return;return{identity:d9($),identity_type:"local_group",role_assignments:z.length>0?z:void 0,application_permissions:G.length>0?G:void 0,operation:Q}}function Q$($,Z){return A0({name:$.name,unique_id:$.id,permissions:$.permissions?.map((Q)=>typeof Q==="string"?Q:Q.id),custom_properties:A0({displayName:$.displayName,requestable:$.requestable,externalId:$.externalId,...$.metadata}),tags:[],operation:Z})}function D$($,Z,Q){return A0({name:$.name,unique_id:$.id,permission_type:Z?.($)??$.permissionTypes??[$.action??"Uncategorized"],apply_to_sub_resources:$.applyToSubResources,resource_types:$.resourceTypes,operation:Q})}function p$($,Z,Q,X=new Set){let Y=$.id;if(Y&&X.has(Y))return A0({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,custom_properties:A0({externalId:$.externalId,...$.metadata}),tags:[],operation:Z});if(Y)X.add(Y);let J=[];for(let K of $.resources??[]){let z=typeof K==="string"?Q?.get(K):K;if(z)J.push(p$(z,Z,Q,X))}if(Y)X.delete(Y);return A0({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,sub_resources:J.length>0?J:void 0,custom_properties:A0({externalId:$.externalId,...$.metadata}),tags:[],operation:Z})}function T4($,Z){if($.length===0)return[];let Q=new Map;for(let G of $)if(G.id)Q.set(G.id,G);let X=new Map,Y=new Set,J=(G,_)=>{if(!_.id||_.id===G)return;let H=X.get(G)??[];if(!H.some((D)=>D.id===_.id))H.push(_);X.set(G,H),Y.add(_.id)};for(let G of $){for(let H of G.resources??[]){let D=typeof H==="string"?Q.get(H):H;if(D&&G.id)J(G.id,D)}let _=m0(G.parent);if(_&&Q.has(_)&&G.id)J(_,G)}let K=(G)=>{if(!G.id)return G;let _=X.get(G.id);if(!_||_.length===0)return G;return{...G,resources:_.map(K)}};return $.filter((G)=>!G.id||!Y.has(G.id)).map(K).map((G)=>p$(G,Z,Q))}async function u9($,Z,Q){if(!Z)return[p$($,"modify")];let X=async(H)=>{if(Z.cache)return await Z.cache.getNode("resource",H);return Z.resources?.get(H)},Y=async(H)=>{if(Z.resources?.children&&H.id&&(!H.resources||H.resources.length===0))return Z.resources.children(H.id);let D=[];for(let V of H.resources??[]){let P=typeof V==="string"?await X(V):V;if(P)D.push(P)}return D},J=$,K=new Set;while(!0){let H=m0(J.parent);if(!H||K.has(H))break;K.add(H);let D=await X(H);if(!D)break;J=D}let z=[],G=[J],_=new Set;while(G.length>0){let H=G.shift();if(!H)break;if(H.id&&_.has(H.id))continue;if(H.id)_.add(H.id);let D=Q.mapResource?Q.mapResource(H):H;z.push(D);for(let V of await Y(H))G.push(V)}if($.id&&!_.has($.id))z.push(Q.mapResource?Q.mapResource($):$);return T4(z,"modify")}async function N4($,Z,Q,X){let Y=JSON.stringify(A0(Q)),J=X?.compression??Z.compression??"gzip",K=J==="gzip"?await t9(Y):Y,z=o9(K),G=X?.maxPayloadBytes??Z.maxPayloadBytes??j4,_=X?.multipart??Z.multipart??"auto",H=X?.multipartThresholdBytes??Z.multipartThresholdBytes??C9;if(z>G&&_==="never")throw new b0("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(_==="always"||_==="auto"&&z>H)return c9($,Z,K,J,X);return l9(Z,{id:Z.datasourceId,data_source_id:Z.datasourceId,json_data:K,compression_type:J==="gzip"?"GZIP":"NONE"})}async function l9($,Z){let Q=`${S4($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:push`,X=await d$(Q,{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"},body:JSON.stringify(Z)});return I4(X)}async function c9($,Z,Q,X,Y){let J=Y?.partSizeBytes??Z.partSizeBytes??k9,K=await i9(Z,X),z=r9(Q,J);for(let _=0;_<z.length;_++)await n9(Z,K,_+1,z[_]??"");let G=await s9(Z,K,z.length);return $.debug("OAA multipart payload pushed",{uploadId:K,parts:z.length}),{...G,uploadId:G.uploadId??K,parts:G.parts??z.length}}async function i9($,Z){let Q=L2($,"multipart/start"),X=await d$(Q,{method:"POST",headers:W2($),body:JSON.stringify({data_source_id:$.datasourceId,compression_type:Z==="gzip"?"GZIP":"NONE"})}),Y=await O2(X),J=B0(Y,"upload_id")??B0(Y,"uploadId")??B0(Y,"id");if(!J)throw new b0("OAA multipart start response did not include an upload id",{code:"invalid_response"});return J}async function n9($,Z,Q,X){let Y=L2($,`multipart/${encodeURIComponent(Z)}/parts/${Q}`);await d$(Y,{method:"PUT",headers:W2($),body:JSON.stringify({upload_id:Z,sequence:Q,data:X})})}async function s9($,Z,Q){let X=L2($,`multipart/${encodeURIComponent(Z)}/complete`),Y=await d$(X,{method:"POST",headers:W2($),body:JSON.stringify({upload_id:Z,parts:Q})});return I4(Y)}function L2($,Z){return`${S4($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:${Z}`}function W2($){return{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"}}async function d$($,Z){let Q;for(let X=0;X<F2;X++){try{let Y=await fetch($,Z);if(!P4(Y.status)||X===F2-1){if(!Y.ok)await a9(Y);return Y}Q=new b0(`OAA request failed with retryable status ${Y.status}`,{retryable:!0,status:Y.status})}catch(Y){if(Q=Y,Y instanceof b0&&!Y.retryable)throw Y;if(X===F2-1)break}await Q6(b9*2**X)}throw new b0("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:Q})}function P4($){return $===429||$>=500}async function a9($){let Z=await O2($).catch(()=>{return}),Q=B0(Z,"message")??B0(Z,"error")??`OAA request failed with status ${$.status}`;throw new b0(Q,{code:B0(Z,"code")??"http_error",status:$.status,retryable:P4($.status),warnings:x4(Z?.warnings)})}async function I4($){let Z=await O2($).catch(()=>{return});return{success:$.ok,syncToken:B0(Z,"sync_token")??B0(Z,"syncToken"),uploadId:B0(Z,"upload_id")??B0(Z,"uploadId"),parts:Z6(Z,"parts"),warnings:x4(Z?.warnings),metadata:Z}}async function O2($){let Z=await $.text();if(!Z)return{};let Q=JSON.parse(Z);return Q&&typeof Q==="object"&&!Array.isArray(Q)?Q:{}}async function t9($){let Z=new Blob([$]).stream().pipeThrough(new CompressionStream("gzip")),Q=await new Response(Z).arrayBuffer();return Buffer.from(Q).toString("base64")}function r9($,Z){let Q=[];for(let X=0;X<$.length;X+=Z)Q.push($.slice(X,X+Z));return Q}function o9($){return Buffer.byteLength($,"utf8")}function e9($){if(!$)return;return $ instanceof Date?$.toISOString():$}function B0($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="string"&&Q.length>0?Q:void 0}function $6($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="boolean"?Q:void 0}function Z6($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="number"?Q:void 0}function x4($){if(!Array.isArray($))return;let Z=$.filter((Q)=>typeof Q==="string");return Z.length>0?Z:void 0}async function*B$($){if(!$)return;for await(let Z of $)yield Z}function A0($){if(Array.isArray($))return $.map(A0).filter((Q)=>Q!==void 0);if(!$||typeof $!=="object"||$ instanceof Date)return $===null?void 0:$;let Z=Object.entries($).map(([Q,X])=>[Q,A0(X)]).filter(([,Q])=>{if(Q===void 0)return!1;if(Array.isArray(Q)&&Q.length===0)return!1;if(Q&&typeof Q==="object"&&!Array.isArray(Q)&&Object.keys(Q).length===0)return!1;return!0});return Z.length>0?Object.fromEntries(Z):void 0}function S4($){return $.replace(/\/+$/,"")}function s0($){return $.applicationName??A4}function Q6($){return new Promise((Z)=>setTimeout(Z,$))}function H6($,Z){if(!$)return;if($.groups.get(Z))return"group";if($.roles.get(Z))return"role";if($.permissions.get(Z))return"permission";return}function B6($,Z,Q){(async()=>{let X=[],Y=async(J,K)=>{let z=J==="group"?Z.groups:J==="role"?Z.roles:Z.permissions;for(let G of K)if(await z.get(G))X.push(`${J}:${G}`)};if(await Y("group",Q.groups.list().map((J)=>J.id)),await Y("role",Q.roles.list().map((J)=>J.id)),await Y("permission",Q.permissions.list().map((J)=>J.id)),X.length>0)$.warn("Catalog store rows shadow code-declared entitlement ids; the code definitions win on read. Delete the store rows (they are inert) to clear this warning.",{"ion.operation":"authz.catalog.shadowed_rows","ion.outcome":"degraded",ids:X.sort()})})().catch((X)=>{$.debug?.("Shadowed-row catalog scan failed (non-fatal)",{error:X})})}function C4($){let Z,Q=!1,X,Y,J=E4($,()=>Z?.oaa,()=>({mapPermissionTypes:Z?.mapPermissionTypes,mapGroup:Z?.mapGroup,mapRole:Z?.mapRole,mapResource:Z?.mapResource}),()=>Y6(Z),()=>{let O=Z?.catalogStore;return O||X?{catalog:O,code:X,resources:Z?.resources,cache:Y}:void 0}),K=(O)=>{if(Q||!J.isReady())return;let{kind:S}=O;(O.op==="delete"?S==="role"?J.deleteRole(O.id):S==="permission"?J.deletePermission(O.id):J.deleteGroup(O.id):S==="role"?J.pushRole(O.entity):S==="permission"?J.pushPermission(O.entity):J.pushGroup(O.entity)).catch((w)=>{$.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:O.op,kind:S,error:w})})},z=(O)=>{if(Q||!J.isReady())return;let S=Z?.resources;if(!S)return;(async()=>{if(O.deleted){await J.deleteResource(O.id);return}let w=await S.get(O.id);if(!w)return;await J.pushResource(w);for(let u of S.entitlements?.(w)??[])await J.pushGroup(_6(u))})().catch((w)=>{$.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:O.id,deleted:O.deleted===!0,error:w})})},G,_,H,D,V=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),P=!1,L=()=>{let O=Z?.accessIndex;if(!O&&!P)P=!0,$.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return O},B=async(O)=>{let S=Z?.accessIndex,m=Z?.catalogStore;if(!S||!m&&!X)return!1;let w=O.id??X6(O),u=await z6({...O,id:w},{catalog:m,code:X,resources:Z?.resources,cache:Y});return await S.materialize(w,u),!0},R=(O,S)=>K6(O,S,{accessStore:Z?.accessStore,accessIndex:Z?.accessIndex,catalogStore:Z?.catalogStore,code:X,resources:Z?.resources},Y),A=async()=>{let O={subjects:0,roots:0,cleared:0},S=Z?.accessIndex,m=Z?.catalogStore;if(Q||!S||!m&&!X)return O;let w=new Map,u=(X0)=>{let H0=N2(X0.subject);if(!H0)return;let c=X0.subjectType??"user";w.set(`${c}:${H0}`,{subject:H0,subjectType:c})},i=new Set,Z0=Z?.accessStore;if(Z0)for await(let X0 of w4((H0,c)=>Z0.list({start:H0,limit:c}))){u({subject:N2(X0.subject),subjectType:X0.subjectType});let H0=N2(X0.target);if(Y&&H0&&typeof X0.target==="string"){if(!await Y.getNode(X0.targetType,H0))i.add(`${X0.targetType}:${H0}`)}}if(i.size>0)$.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog, catalog store, or resource derivation). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...i].sort()});if(S.listSubjects)for(let X0 of await S.listSubjects())u(X0);for(let X0 of w.values()){let H0=await R(X0.subject,X0.subjectType??"user");if(O.subjects+=1,O.roots+=H0,H0===0)O.cleared+=1}return O},W=()=>{if(Q)return Promise.resolve({subjects:0,roots:0,cleared:0});return A()},F=Promise.resolve(),M=!1,I=(O,S)=>{let m=F.then(async()=>{if(Q)return;try{await S()}catch(w){$.warn(`${O} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:O,error:w instanceof Error?w.message:String(w)})}});return F=m,m},T=(O)=>{if(M)return;M=!0,I(O,async()=>{M=!1,await A()})},f=()=>F,d=(O)=>{if(Q)return;let S=Z?.accessStore;if(!Z?.accessIndex||!Z?.catalogStore||!S)return;if(Y?.invalidate(O),O.op==="set"){let m=O.kind,w=O.entity.id;I("catalog-change",async()=>{for await(let u of w4((i,Z0)=>S.listByTarget(m,w,{start:i,limit:Z0})))await B(u)})}else T("catalog-delete")},h=(O)=>{if(Q)return;if(Y?.clear(),!Z?.accessIndex||!Z?.catalogStore&&!X||!Z?.accessStore)return;T("resource-change")},q={oaa:J,get accessIndex(){return Z?.accessIndex},has(O,S,m,w,u){let i=L();return i?i.has(O,S,m,w,u):Promise.resolve(V())},hasGroup(O,S,m,w){let u=L();return u?u.hasGroup(O,S,m,w):Promise.resolve(V())},hasRole(O,S,m,w){let u=L();return u?u.hasRole(O,S,m,w):Promise.resolve(V())},hasPermission(O,S,m,w){let u=L();return u?u.hasPermission(O,S,m,w):Promise.resolve(V())},hasAny(O,S,m){let w=L();return w?w.hasAny(O,S,m):Promise.resolve(V())},hasAll(O,S,m){let w=L();return w?w.hasAll(O,S,m):Promise.resolve(V())},reconcile(){return W()}};return{update(O){if(Q)return q;if(O?.resources&&Boolean(O.resources.entitlements)!==Boolean(O.resources.entitlement))throw Error("AuthzConfig.resources: `entitlements(resource)` and `entitlement(id)` must be provided together (the derivation and its reverse resolver are both app-authored).");let S=O?.catalog?J6(O.catalog):void 0,m=S!==X;X=S,Z=O,J.refreshReadiness();let w=O?.catalogStore,u=O?.resources;if(w!==G||u!==H||m){if(_?.(),D?.(),Y=w||X?new G6(w,u,X):void 0,_=w?.afterChange?w.afterChange((i)=>{if(i.op==="set"&&H6(X,i.entity.id))$.warn("Catalog store row shadows a code-declared entitlement id; the code definition wins on read",{"ion.operation":"authz.catalog.shadowed_row","ion.outcome":"degraded",id:i.entity.id,kind:i.kind});K(i),d(i)}):void 0,D=u?.changed?u.changed((i)=>{h(i),z(i)}):void 0,G=w,H=u,w&&X)B6($,w,X)}else if(Y)Y.clear();return q},settle:f,close(){if(Q)return;Q=!0,_?.(),_=void 0,D?.(),D=void 0,G=void 0,H=void 0,Y=void 0}}}function k4($){return $.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+|_+$/g,"")||"EMPTY"}function D6($){let Z=`${$.clientId}\x00${$.path}`,Q=2166136261;for(let X=0;X<Z.length;X+=1)Q^=Z.charCodeAt(X),Q=Math.imul(Q,16777619);return(Q>>>0).toString(36)}function V6($){let Z=k4($.clientId),Q=k4($.path);return`LFV_${Z}__${Q}`}function b4($,Z){let Q=V6(Z);if(!(Q in $))return Q;let X=`${Q}_${D6(Z)}`;if(!(X in $))return X;return`${X}_ALT`}import{defaultLogger as wQ}from"@ionite/core";import{defaultLogger as M6,stableConfigHash as L6}from"@ionite/core";import{verifyLfvSignature as W6}from"@ionite/core/server";var V$=new Map;function U6($){if(!$)return"/";return $.startsWith("/")?$:`/${$}`}function F6($){try{let Z=new URL($),Q=Z.pathname.replace(/\/+$/g,"");return`${Z.origin}${Q}`}catch{return $.replace(/\/+$/g,"")}}function u$($){let Z=F6($.lfvServerUrl),Q=U6($.path);return`${Z}|${Q}`}function y4($,Z,Q){let X=V$.get($)??new Map;return X.set(Z,Q),V$.set($,X),()=>{let Y=V$.get($);if(!Y)return;if(Y.delete(Z),Y.size===0)V$.delete($)}}async function A2($,Z,Q,X){let Y=V$.get($);if(!Y)return 0;let J=0;for(let[K,z]of Y){if(Q&&K===Q)continue;if(z.trustId!==X)continue;if(!z.onDelivery)continue;J+=1,await z.onDelivery(Z)}return J}async function j2($,Z,Q,X){let Y=V$.get($);if(!Y)return 0;let J=0;for(let[K,z]of Y){if(Q&&K===Q)continue;if(z.trustId!==X)continue;if(!z.onEvents)continue;J+=1,await z.onEvents(Z)}return J}function v4($){try{return new URL($).pathname}catch{return $.startsWith("/")?$:`/${$}`}}var O6=1e4,N6=1e4,A6=300,E2=crypto.randomUUID();async function g4($){await new Promise((Z)=>setTimeout(Z,$))}function g0($){return{startedAt:Date.now(),timeout:typeof $?.timeout==="number"&&$.timeout>0?$.timeout:void 0}}function R$($){if($.timeout===void 0)return;let Z=Date.now()-$.startedAt;return Math.max(0,$.timeout-Z)}function t0($,Z,Q){return Error(`LFV ${$} timed out after ${Q.timeout??0}ms for ${Z}`)}async function q$($,Z,Q,X,Y){let J=R$(Q);if(J!==void 0){if(J<=0)throw t0(X,Y,Q);let K=new AbortController,z=setTimeout(()=>K.abort(),J);try{return await fetch($,{...Z,signal:K.signal})}catch(G){if(G instanceof Error&&G.name==="AbortError")throw t0(X,Y,Q);throw G}finally{clearTimeout(z)}}return await fetch($,Z)}class T0 extends Error{constructor($){super(`LFV source closed while operating on ${$}`);this.name="LfvSourceClosedError"}}function c$($){return $ instanceof T0||$ instanceof Error&&$.name==="LfvSourceClosedError"}function l$($){try{let Z=JSON.parse($);return typeof Z==="object"&&Z!==null&&!Array.isArray(Z)?Z:void 0}catch{return}}async function h4($,Z,Q,X,Y,J,K,z,G,_){let H=0,D=Date.now();for(;;){if(_?.())throw new T0(X);let V=R$(Q);if(V!==void 0&&V<=0)throw t0(Y,X,Q);try{return await $()}catch(P){if(P instanceof T0)throw P;if(_?.())throw new T0(X);if(H+=1,K>0&&Date.now()-D>=K){let B=`Error connecting to the LFV source. Retries: '${H}'`;if(z)z(G,B,{url:Z,path:X,operation:Y});D=Date.now()}let L=V===void 0?J:Math.min(J,V);if(L<=0)throw t0(Y,X,Q);if(await g4(L),_?.())throw new T0(X)}}}function j6($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function f4($){if(typeof $==="number"&&Number.isFinite($))return $;if(typeof $==="string"&&$.trim()){let Z=Date.parse($.trim());if(!Number.isNaN(Z))return Z}return}function m4($){return`[LFV] [${$??"-"}] [${new Date().toISOString()}]: `}function q2($,Z){if(typeof $!=="string"||$.trim()==="")throw Error(`LFV source requires "${Z}"`);return $}function E6($){return{...$,lfvServerUrl:q2($.lfvServerUrl,"lfvServerUrl"),clientId:q2($.clientId,"clientId"),path:q2($.path,"path")}}function T$($,Z){let Q=E6($),X=Q.log??M6,Y=(U,x,y)=>{let p=m4(U)+x;if(y!==void 0)X.debug(p,y);else X.debug(p)},J=(U,x,y)=>{let p=m4(U)+x;if(y!==void 0)X.warn(p,y);else X.warn(p)},K=Q.lfvServerUrl,z=Q.clientId,G=Q.path,_=Q.verifyJwks,H=typeof Q.deliveryTimeout==="number"&&Q.deliveryTimeout>0?Q.deliveryTimeout:void 0,D=typeof Q.retryInterval==="number"&&Q.retryInterval>0?Q.retryInterval:O6,V=typeof Q.warnInterval==="number"&&Q.warnInterval>=0?Q.warnInterval:N6,P=(typeof Q.callbackMaxAgeSeconds==="number"&&Q.callbackMaxAgeSeconds>0?Q.callbackMaxAgeSeconds:A6)*1000,L=typeof Q.cacheMaxAgeSeconds==="number"&&Q.cacheMaxAgeSeconds>0?Q.cacheMaxAgeSeconds*1000:void 0,B=_?.trim()?L6(_.trim()):void 0,R=v4(Q.deliveryEndpoint),A=v4(Q.eventsEndpoint),W=u$({lfvServerUrl:K,path:G}),F=crypto.randomUUID(),M=new Map,I=new Set,T=new Map,f=new Map,d=new Map,h=new Map,q=new Map,O=new Map,S=new Map,m=new Map,w=!1,u,i,Z0,X0=new Set,H0=()=>w;function c(U,x){T.set(U,x),f.set(U,Date.now())}function Y0(U){T.delete(U),f.delete(U)}function z0(U){let x=T.get(U);if(!x)return;if(L!==void 0){let y=f.get(U)??0;if(Date.now()-y>L){Y(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:U});return}}return x}function U0(){return I.size>0||M.size>0||O.size>0||S.size>0}async function K0(){if(!Z||w||!U0()||i)return;if(Z0)return Z0;return Z0=Z.subscribe(W,async(U)=>{if(w||U.originId===E2||U.key!==W)return;await O9(U)}).then((U)=>{if(w||!U0()){U();return}i=U}).finally(()=>{Z0=void 0}),Z0}function N(){if(w){if(u)u(),u=void 0;if(i)i(),i=void 0;return}let U=U0();if(U&&!u)u=y4(W,F,{trustId:B,onDelivery:async(x)=>{B2(x)},onEvents:async(x)=>{V2(x)}});if(!U&&u)u(),u=void 0;if(U)K0().catch((x)=>{J(void 0,"distributed callback subscription failed",{key:W,error:x instanceof Error?x.message:String(x)})});else if(i)i(),i=void 0}async function b(U,x,y,p){if(w)throw new T0(U);let t=y??crypto.randomUUID(),a=p??g0(),e=new Promise((D0,k0)=>{let L0={resolve:D0,reject:k0},E0=R$(a);if(E0!==void 0){if(E0<=0){k0(t0("issueOtp",U,a));return}L0.timer=setTimeout(()=>{S.delete(t),N(),k0(t0("issueOtp",U,a))},E0)}S.set(t,L0),N()});e.catch(()=>{});let Q0=()=>{let D0=S.get(t);if(!D0)return;if(D0.timer)clearTimeout(D0.timer);S.delete(t),N()};try{await K0()}catch(D0){throw Q0(),D0}let O0={request_id:t,path:U,action:x};Y(t,"OTP request",{path:U,action:x});let M0;try{M0=await h4(async()=>{return await q$(`${K.replace(/\/+$/g,"")}/clients/${z}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":t},body:JSON.stringify(O0)},a,"issueOtp",U)},K,a,U,"issueOtp",D,V,J,t,H0)}catch(D0){throw Q0(),D0}if(M0.status!==200&&M0.status!==202)throw Q0(),Error(`LFV OTP request failed (${M0.status}) for ${U}`);try{let D0=await e;return Y(t,"OTP received via signed callback",{path:U,action:x}),D0}finally{Q0()}}async function l(U,x,y,p,t,a){if(w)throw new T0(x);let e=t??crypto.randomUUID(),Q0=a??g0(),O0=await b(x,y,e,Q0),M0=await h4(async()=>{return await q$(`${K.replace(/\/+$/g,"")}${U}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":e},body:JSON.stringify({request_id:e,otp:O0,path:x,...p??{}})},Q0,y,x)},K,Q0,x,y,D,V,J,e,H0);if(M0.status!==200&&M0.status!==202)throw Error(`LFV ${y} failed (${M0.status}) for ${x}`);return Y(e,`${y} accepted`,{path:x,status:M0.status}),{requestId:e}}async function r(U,x,y){if(w)throw new T0(U);let p=z0(U);if(p)return p;let t=m.get(U);if(t)return t;let a=$0(U,x,y);m.set(U,a),a.catch((e)=>{if(c$(e))Y(x,"read aborted: source closed",{path:U})});try{return await a}finally{m.delete(U)}}async function $0(U,x,y){let p=y?.timeout??H,t={startedAt:Date.now(),timeout:typeof p==="number"&&p>0?p:void 0},a,e=new Promise((L0,E0)=>{a={resolve:L0,reject:E0};let e0=O.get(U)??new Set;e0.add(a),O.set(U,e0),N()});e.catch(()=>{});let Q0=()=>{if(!a)return;let L0=O.get(U);if(L0?.delete(a),L0&&L0.size===0)O.delete(U);N()},O0=x??crypto.randomUUID();Y(O0,"read_secret request",{path:U});let M0=0,D0=Date.now();for(;;){if(w)throw Q0(),new T0(U);try{await l("/secrets/request",U,"read_secret",void 0,O0,t),Y(O0,"read_secret accepted, awaiting delivery",{path:U});break}catch(L0){if(L0 instanceof T0)throw Q0(),L0;let E0=R$(t);if(E0!==void 0&&E0<=0)throw Q0(),t0("read_secret",U,t);if(M0+=1,V>0&&Date.now()-D0>=V)J(O0,`read_secret retrying. Retries: '${M0}'`,{path:U}),D0=Date.now();let e0=E0===void 0?D:Math.min(D,E0);if(e0<=0)throw Q0(),t0("read_secret",U,t);await g4(e0)}}let k0=R$(t);if(k0!==void 0){if(k0<=0)throw Q0(),Error(`LFV delivery timed out while reading ${U}`);let L0;try{return await Promise.race([e,new Promise((E0,e0)=>{L0=setTimeout(()=>{Q0(),e0(Error(`LFV delivery timed out while reading ${U}`))},k0)})])}finally{if(L0)clearTimeout(L0)}}return await e}function G0(U,x,y){if(y!==void 0){let a=h.get(U);if(a!==void 0&&y<a){Y(void 0,"delivery ignored: stale version",{path:U,realVersion:y,lastAccepted:a});return}h.set(U,y)}c(U,x),X0.delete(U);let p=x.metadata.version;if(d.get(U)===p)return;d.set(U,p);let t=M.get(U);if(!t)return;for(let a of t)a(x)}async function j(U,x){return await r(U,void 0,x)}async function E(U,x,y){if(!j6(x))throw Error(`putSecret requires an object value for LFV source at path ${U}`);let p=g0(y);if(await k(U,y)){await l("/secrets/update",U,"update_secret",{data:x},void 0,p),Y0(U);return}await l("/secrets/create",U,"create_secret",{data:x},void 0,p),Y0(U)}async function v(U,x){let y=g0(x);await l("/secrets/delete",U,"delete_secret",void 0,void 0,y),Y0(U)}async function C(U,x){let y=g0(x),p=crypto.randomUUID();Y(p,"list_paths request",{path:U});let t=await b(U,"list_paths",p,y),a=await q$(`${K.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":p},body:JSON.stringify({request_id:p,otp:t,path:U})},y,"listPaths",U);if(a.status!==200)throw Error(`LFV listPaths failed (${a.status}) for ${U}`);let e=await a.json();if(!Array.isArray(e.items))throw Error(`LFV listPaths returned invalid payload for ${U}`);return Y(p,"list_paths success",{path:U,status:200}),e.items.filter((Q0)=>typeof Q0==="string")}async function k(U,x){let y=g0(x),p=crypto.randomUUID();Y(p,"exists request",{path:U});let t=await b(U,"read_metadata",p,y),a=await q$(`${K.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":p},body:JSON.stringify({request_id:p,otp:t,path:U})},y,"exists",U);if(a.status!==200)throw Error(`LFV exists failed (${a.status}) for ${U}`);let e=await a.json();if(typeof e.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${U}`);return Y(p,"exists success",{path:U,status:200,exists:e.exists}),e.exists}async function n(U,x,y){let p=g0(y);await l("/secrets/rotate/request",U,"request_rotate",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,p)}async function g(U,x,y){let p=g0(y);await l("/secrets/revoke/request",U,"request_revoke",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,p)}async function o(U,x){let y=g0(x),p=crypto.randomUUID();Y(p,"getMetadata request",{path:U});let t=await b(U,"read_metadata",p,y),a=await q$(`${K.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":p},body:JSON.stringify({request_id:p,otp:t,path:U})},y,"getMetadata",U);if(a.status!==200)throw Error(`LFV getMetadata failed (${a.status}) for ${U}`);let e=await a.json();if(!e.metadata||typeof e.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${U}`);return Y(p,"getMetadata success",{path:U,status:200}),e.metadata}async function s(U,x,y){let p=M.get(U)??new Set,t,a=(Q0)=>{if(Q0.metadata.version===t)return;t=Q0.metadata.version,x(Q0)};p.add(a),M.set(U,p);let e=z0(U);if(e)a(e),d.set(U,e.metadata.version);else try{a(await j(U,y))}catch(Q0){if(p.delete(a),p.size===0)M.delete(U);throw Q0}return N(),await K0(),()=>{let Q0=M.get(U);if(!Q0)return;if(Q0.delete(a),Q0.size===0)M.delete(U);N()}}function F0(U){return U.method==="POST"&&new URL(U.url).pathname===R}function J0(U){return U.method==="POST"&&new URL(U.url).pathname===A}function o0(U){let x=U.data?.metadata?.path;if(typeof x==="string"&&x)return x;if(typeof U.path==="string"&&U.path)return U.path;return}function h0(U,x){let y=O.get(U);if(!y||y.size===0)return!1;O.delete(U),N();for(let p of y)p.resolve(x);return!0}function A$(U){let{request_id:x,otp:y}=U;if(typeof x!=="string"||typeof y!=="string"||!y)return{handled:!1};let p=S.get(x);if(!p)return{handled:!1};if(p.timer)clearTimeout(p.timer);return S.delete(x),N(),p.resolve(y),{handled:!0}}function B2(U){if(U.type==="otp")return A$(U);let x=o0(U);if(!x)return Y(U.request_id,"delivery ignored: no path",{}),{handled:!1};let y=U.data?.metadata??{},p=typeof y.version==="number"?y.version:void 0,t={data:U.data?.data??{},metadata:{path:x,version:p??0,created:new Date}};G0(x,t,p);let a=h0(x,t);return Y(U.request_id,"delivery applied",{path:x,handled:a}),{handled:a}}function n0(U="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:U}),{status:401,headers:{"Content-Type":"application/json"}})}function F4(U){return{requestId:U.headers.get("X-LFV-Request-Id")??U.headers.get("x-lfv-request-id")??"",keyId:U.headers.get("X-LFV-Key-Id")??U.headers.get("x-lfv-key-id")??"",signature:U.headers.get("X-LFV-Signature")??U.headers.get("x-lfv-signature")??""}}async function D2(U,x){if(!_?.trim())return J(void 0,"LFV callback rejected: verifyJwks is not configured"),n0("LFV callback verification is not configured");let{requestId:y,keyId:p,signature:t}=x;if(!y.trim()||!p.trim()||!t.trim())return J(y||void 0,"LFV callback rejected: missing signature headers"),n0("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await W6({jwks:_,kid:p,signatureB64Url:t.trim(),requestId:y.trim(),rawBody:U}))return J(y,"LFV callback rejected: signature verification failed"),n0();let e=l$(U);if(!e)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let Q0=e;if(Q0.request_id!==y.trim())return J(y,"LFV callback rejected: request_id header/body mismatch"),n0("X-LFV-Request-Id does not match request_id in body");let O0=Date.now(),M0=f4(Q0.issued_at);if(M0===void 0)return J(y,"LFV callback rejected: missing or invalid issued_at"),n0("Missing or invalid issued_at");if(O0-M0>P)return J(y,"LFV callback rejected: stale (outside freshness window)"),n0("Callback is stale (issued_at outside freshness window)");let D0=f4(Q0.expires_at);if(D0!==void 0&&O0>D0)return J(y,"LFV callback rejected: expired"),n0("Callback has expired");let k0=t.trim();for(let[L0,E0]of q)if(E0<=O0)q.delete(L0);if(q.has(k0))return J(y,"LFV callback rejected: replayed signature"),n0("Callback signature already processed (replay)");return q.set(k0,M0+P),null}async function O9(U){let x=await D2(U.rawBody,U.headers);if(x){J(U.headers.requestId,"distributed LFV callback rejected",{key:U.key,status:x.status});return}let y=l$(U.rawBody);if(!y)return;if(U.kind==="delivery"){let t=y;B2(t),await A2(U.key,t,F,B);return}let p=y;if(!p.path||typeof p.path!=="string")return;V2(p),await j2(U.key,p,F,B)}async function N9(U){let x=await U.text(),y=F4(U),p=await D2(x,y);if(p)return p;let t=l$(x);if(!t)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let a=t,e=o0(a);Y(a.request_id,"delivery received",{path:e});let Q0=B2(a),O0=e?u$({lfvServerUrl:K,path:e}):W,M0=await A2(O0,a,F,B);try{await Z?.publish({kind:"delivery",key:O0,originId:E2,rawBody:x,headers:y})}catch(D0){return q.delete(y.signature.trim()),J(y.requestId,"distributed callback publish failed; callback may be retried",{key:O0,error:D0 instanceof Error?D0.message:String(D0)}),new Response(JSON.stringify({error:"callback_transport_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(!Q0.handled&&M0===0)return new Response(JSON.stringify({status:"accepted",note:"unmapped_delivery"}),{status:200,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function V2(U){if(w)return;if(!U?.path||typeof U.path!=="string")return;Y(U.request_id,"events payload",{path:U.path,event:U.event});for(let x of I)try{x({path:U.path,event:U.event,requestId:U.request_id,issuedAt:U.issued_at,expiresAt:U.expires_at})}catch(y){J(U.request_id,"secret event listener failed",{path:U.path,event:U.event,error:y instanceof Error?y.message:String(y)})}if(U.event==="created"||U.event==="updated"||U.event==="rotated"||U.event==="revoked")Y0(U.path),r(U.path,U.request_id).catch((x)=>{if(c$(x)){Y(U.request_id,"event refresh aborted: source closed",{path:U.path});return}X0.add(U.path),J(U.request_id,"event-triggered refresh failed; source marked degraded",{path:U.path,event:U.event,error:x instanceof Error?x.message:String(x)})})}async function A9(U){let x=await U.text(),y=F4(U),p=await D2(x,y);if(p)return p;let t=l$(x);if(!t)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let a=t;if(!a?.path||typeof a.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});Y(a.request_id,"events received",{path:a.path,event:a.event}),V2(a);let e=u$({lfvServerUrl:K,path:a.path});await j2(e,a,F,B);try{await Z?.publish({kind:"events",key:e,originId:E2,rawBody:x,headers:y})}catch(Q0){return q.delete(y.signature.trim()),J(y.requestId,"distributed callback publish failed; callback may be retried",{key:e,error:Q0 instanceof Error?Q0.message:String(Q0)}),new Response(JSON.stringify({error:"callback_transport_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function j9(){if(w)return;if(w=!0,u)u(),u=void 0;if(i)i(),i=void 0;let U=new T0(G);for(let x of O.values())for(let y of x)try{y.reject(U)}catch{}O.clear();for(let x of S.values()){if(x.timer)clearTimeout(x.timer);try{x.reject(U)}catch{}}S.clear(),m.clear(),X0.clear(),T.clear(),f.clear(),d.clear(),h.clear(),q.clear(),M.clear(),I.clear()}return{type:"vault",isAvailable:()=>X0.size===0,getFullSecret:j,getSecret:async(U,x)=>{return(await j(U,x)).data},putSecret:E,deleteSecret:v,listPaths:C,exists:k,requestRotate:n,requestRevoke:g,getMetadata:o,subscribe:s,subscribeEvents:(U)=>{return I.add(U),N(),()=>{I.delete(U),N()}},close:j9,isDeliveryRequest:F0,isEventsRequest:J0,handleDelivery:N9,handleEvents:A9,deliveryPath:R,eventsPath:A,callbackKey:W,trustId:B}}function X$($,Z,Q){if(typeof $!=="string"||$.trim()==="")throw Error(`"${Z}" is required when using ${Q}`);return $}var i$="__esLfvBootstrap";import{withDefaultExternalId as q6}from"@ionite/core/server";function n$($){return[$.tenantId??"_",$.destination,$.resourceType,$.externalId].join("\x00")}class s${map=new Map;async get($){return this.map.get(n$($))}async set($,Z){this.map.set(n$($),Z)}async delete($){this.map.delete(n$($))}}function R2($){return $==="user"?"Users":"Groups"}function T2($){return $.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class a${baseUrl;getToken;idMapStore;tenantId;log;fetchImpl;inflight=new Map;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.getToken=$.getToken,this.idMapStore=$.idMapStore,this.tenantId=$.tenantId,this.log=$.log,this.fetchImpl=$.fetchImpl??((Z,Q)=>fetch(Z,Q))}async headers(){let $=await this.getToken();return new Headers({"Content-Type":"application/scim+json",Accept:"application/scim+json",Authorization:`Bearer ${$}`})}inflightKey($,Z){return`${$}\x00${Z}`}async resolveProviderId($,Z,Q){let X={tenantId:this.tenantId,destination:this.baseUrl,resourceType:$,externalId:Z},Y=await this.idMapStore.get(X);if(Y)return{found:Y};let J=this.inflightKey($,Z),K=this.inflight.get(J);if(K)return K;let z=this.resolveUncached($,Z,Q).then(async(G)=>{if(typeof G==="object")await this.idMapStore.set(X,G.found);return G}).finally(()=>{this.inflight.delete(J)});return this.inflight.set(J,z),z}async resolveUncached($,Z,Q){let X=await this.filterByExternalId($,Z);if(X!=="absent")return X;if(!Q)return"absent";return this.create($,Z,Q)}async filterByExternalId($,Z){let Q=encodeURIComponent(`externalId eq "${T2(Z)}"`),X=`${this.baseUrl}/${R2($)}?filter=${Q}`,Y=await this.fetchImpl(X,{method:"GET",headers:await this.headers()});if(!Y.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:$,status:Y.status}),"error";let K=((await Y.json()).Resources??[])[0]?.id;return K?{found:K}:"absent"}async create($,Z,Q){let X=`${this.baseUrl}/${R2($)}`,Y=$==="user"?{schemas:["urn:ietf:params:scim:schemas:core:2.0:User"],userName:Q.userName??Z,externalId:Z,displayName:Q.displayName,active:!0}:{schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:Q.displayName??Z,externalId:Z},J=await this.fetchImpl(X,{method:"POST",headers:await this.headers(),body:JSON.stringify(Y)});if(!J.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:$,status:J.status}),"error";let K=await J.json();return K.id?{found:K.id}:"error"}async invalidate($,Z){await this.idMapStore.delete({tenantId:this.tenantId,destination:this.baseUrl,resourceType:$,externalId:Z})}async patchGroupMembership($){let{groupExternalId:Z,userExternalId:Q,op:X}=$,Y=await this.resolveProviderId("user",Q,X==="add"?$.userCreate:void 0);if(Y==="error")return this.log.warn("IAM delta: user lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(Y==="absent")return this.log.warn("IAM delta: user not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let J=Y.found,K=async(_)=>{let H=await this.resolveProviderId("group",Z,X==="add"&&_?$.groupCreate:void 0);if(H==="error")return{kind:"error"};if(H==="absent")return{kind:"absent"};let D=`${this.baseUrl}/${R2("group")}/${encodeURIComponent(H.found)}`,V=X==="add"?[{op:"add",path:"members",value:[{value:J}]}]:[{op:"remove",path:`members[value eq "${T2(J)}"]`}];return{kind:"response",response:await this.fetchImpl(D,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:PatchOp"],Operations:V})})}},z=await K(!0);if(z.kind==="response"&&(z.response.status===404||z.response.status===410))await this.invalidate("group",Z),z=await K(!1);if(z.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(z.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let G=z.response;if(!G.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X,status:G.status}),"error";return"pushed"}}function P2($){if(typeof $==="string")return $;if($&&typeof $==="object"&&"id"in $)return $.id;return}function p4($){return $&&typeof $==="object"?$:void 0}function I2($){let Z={},Q={},X,Y,J,K,z,G,_=new Promise((W)=>{G=W}),H=()=>{if(!Z.url||!Q.workload)return!1;return Z.mode==="patch"&&Boolean(Q.idMapStore)},D=()=>{if(G&&H())G(),G=void 0},V=async()=>{let W=Q.workload;if(!W)throw Error("IAM delta: workload identity not configured");if(Z.audience&&typeof W.getToken==="function")return W.getToken(Z.audience);if(typeof W.getServerToken==="function")return W.getServerToken();return W.getToken()},P=()=>{if(!H()||!Z.url||!Q.idMapStore)return;let W=`${Z.tenantId??"_"}\x00${Z.url}`;if(X&&Y===W&&J===Q.idMapStore&&K===Q.fetchImpl)return X;return X=new a$({baseUrl:Z.url,getToken:V,idMapStore:Q.idMapStore,tenantId:Z.tenantId,log:$,fetchImpl:Q.fetchImpl}),Y=W,J=Q.idMapStore,K=Q.fetchImpl,X},L=async(W)=>{let M=p4(W.subject);if(!M){let T=P2(W.subject);if(T&&Q.userStore)M=await Q.userStore.get(T)}let I=M?.externalId;if(!I)return;return{externalId:I,create:{userName:M?.userName??I,displayName:M?.displayName??M?.name}}},B=async(W)=>{let M=p4(W.target);if(!M){let T=P2(W.target);if(T&&Q.catalogStore)M=await Q.catalogStore.groups.get(T);if(T&&!M)M=q6(await Q.resources?.entitlement?.(T))}let I=M?.externalId;if(!I)return;return{externalId:I,create:{displayName:M?.displayName??M?.name??I}}},R=async(W,F)=>{if(!H())return"skipped";if(W.targetType!=="group")return $.debug("IAM delta: non-group target skipped (not representable as SCIM membership)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",targetType:W.targetType}),"skipped";let M=await L(W),I=await B(W);if(!M||!I)return $.warn("IAM delta: missing externalId on subject or target; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:F,hasSubject:Boolean(M),hasGroup:Boolean(I)}),"skipped";let T=P();if(!T)return"skipped";return T.patchGroupMembership({groupExternalId:I.externalId,userExternalId:M.externalId,op:F,groupCreate:I.create,userCreate:M.create})},A={async onGrant(W){if(!H())return;if(await R(W,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(W){if(!H())return;if(await R(W,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async reconcile(W){let F={pushed:0,skipped:0,errors:[]};if(!H())return F.errors.push("iam delta not ready"),F;for await(let M of W)try{let I=await R(M,"add");if(I==="pushed")F.pushed+=1;else if(I==="error")F.errors.push(`IAM delta: destination rejected membership push for ${P2(M.target)??"unknown"}`);else F.skipped+=1}catch(I){F.errors.push(I instanceof Error?I.message:String(I))}return F},isReady:H,ready(W){if(H())return Promise.resolve();if(!W||W<=0)return _;return Promise.race([_,new Promise((F,M)=>setTimeout(()=>M(Error("IAM delta readiness timeout")),W))])}};return{update(W,F){if(Z=W,!F.idMapStore)z??=new s$;return Q={...F,idMapStore:F.idMapStore??z},P(),D(),A}}}var x2=1,R6=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."}];import{IoniteError as T6}from"@ionite/core";function P6($){if($ instanceof T6)return{status:$.status,statusText:$.statusText};if(typeof $!=="object"||$==null)return;let Z=$,Q=typeof Z.status==="number"?Z.status:void 0,X=typeof Z.statusText==="string"?Z.statusText:void 0;return Q!=null||X?{status:Q,statusText:X}:void 0}function U$($){if($ instanceof Response)return $;let Z=P6($);if(!Z)return Response.json({error:"internal_error"},{status:500});let X={status:Z.status??500};if(Z.statusText)X.statusText=Z.statusText;return Response.json({error:Z.statusText??"internal_error"},X)}function _0(){return Response.json({error:"not_found"},{status:404})}function F$($=["GET"]){return Response.json({error:"method_not_allowed",allow:$},{status:405,headers:{Allow:$.join(", ")}})}import{timingSafeEqual as I6}from"node:crypto";import{parseKmsPoolDocument as x6,stableConfigHash as u4}from"@ionite/core";function d4($,Z,Q){for(let X of $)try{X()}catch(Y){Z.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:Q,error:Y instanceof Error?Y.message:String(Y)})}}function w0($,Z){let Q=new Set,X=new Set;return{beforeChange(Y){return Q.add(Y),()=>{Q.delete(Y)}},afterChange(Y){return X.add(Y),()=>{X.delete(Y)}},emitBefore(){d4(Q,$,`${Z} beforeChange`)},emitAfter(){d4(X,$,`${Z} afterChange`)}}}var S6=604800000,w6=5000,C6=2147483647;function i4($,Z){if(!$.value)return!1;if($.notBefore&&Date.parse($.notBefore)>Z)return!1;if($.notAfter&&Date.parse($.notAfter)<=Z)return!1;return!0}function y0($,Z=Date.now()){if(!$)return;let Q=$.keys.find((X)=>X.id===$.active&&X.state==="active");return Q&&i4(Q,Z)?Q:void 0}function k6($,Z=Date.now()){if(!$)return[];return $.keys.filter((Q)=>(Q.state==="active"||Q.state==="deprecated")&&i4(Q,Z))}function l4($){return{...$,...$.meta?{meta:{...$.meta}}:{}}}function c4($,Z=Date.now()){if(!$)return;let Q=$.keys.find((Y)=>Y.id===$.active&&Y.state==="active");if(!Q?.value||!Q.notBefore)return;if(Q.notAfter&&Date.parse(Q.notAfter)<=Z)return;let X=Date.parse(Q.notBefore)-Z;return X>0&&X<=w6?X:void 0}function b6($,Z){let Q=Buffer.from($),X=Buffer.from(Z);return Q.length===X.length&&I6(Q,X)}var n4=new WeakMap;function s4($){return n4.get($)?.()}function y6($,Z,Q){let X=w0(Z,`KMS pool "${$}"`),Y=new Set,J=new Set,K=!1,z,G,_=0,H,D,V,P=W0(`KMS pool "${$}"`,()=>K&&y0(z)!==void 0),L=()=>{let T=y0(z);for(let f of Y)try{f(T?l4(T):void 0)}catch(d){Z.warn("KMS token-pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:$,error:d instanceof Error?d.message:String(d)})}},B=()=>{if(D)clearTimeout(D);D=void 0},R=()=>{V=void 0},A=()=>{let T=V;if(!T)return;if(!K){R(),T.reject(Error(`KMS pool "${$}" is no longer configured.`));return}let f=y0(z);if(f?.value){R(),T.resolve(f.value);return}if(c4(z)===void 0)R(),T.reject(Error(`KMS pool "${$}" has no usable token or imminent scheduled activation.`))},W=()=>{B();let T=Date.now();if(z){for(let d of z.keys){if(!d.notAfter)continue;let h=Date.parse(d.notAfter)-T;if(h>0&&h<=S6&&(d.state==="active"||d.state==="deprecated")&&!J.has(d.id))J.add(d.id),Z.warn("KMS token is approaching expiry",{"ion.operation":"kms.token.expiry","ion.outcome":"degraded",pool:$,keyId:d.id,notAfter:d.notAfter})}let f=z.keys.flatMap((d)=>[d.notBefore,d.notAfter]).filter((d)=>Boolean(d)).map((d)=>Date.parse(d)).filter((d)=>d>T).sort((d,h)=>d-h);if(f[0])D=setTimeout(()=>{let d=y0(z)?.id;P.refresh(),Q();let h=y0(z)?.id;if(d!==h)L();W()},Math.min(f[0]-T+1,C6))}P.refresh(),Q(),A()},F=(T,f)=>{let d=y0(z);X.emitBefore();try{z=x6(T,f??"token"),W();let h=y0(z);if(d?.id!==h?.id||d?.value!==h?.value)L()}catch(h){z=void 0,W(),L(),Z.warn("KMS token-pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:$,error:h instanceof Error?h.message:String(h)})}finally{X.emitAfter()}},M=()=>{try{H?.()}catch(T){Z.warn("KMS token-pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:$,error:T instanceof Error?T.message:String(T)})}H=void 0},I={value(){let T=y0(z);if(!K)return Promise.reject(Error(`KMS pool "${$}" is no longer configured.`));if(T?.value)return Promise.resolve(T.value);if(c4(z)===void 0)return Promise.reject(Error(`KMS pool "${$}" has no usable token or imminent scheduled activation.`));if(V)return V.promise;let f,d,h=new Promise((q,O)=>{f=q,d=O});return V={promise:h,resolve:f,reject:d},A(),h},accepts:(T)=>k6(z).some((f)=>f.value!==void 0&&b6(T,f.value)),subscribe(T){Y.add(T);let f=y0(z);return T(f?l4(f):void 0),()=>Y.delete(T)},beforeChange:X.beforeChange,afterChange:X.afterChange,isReady:P.isReady,ready:P.ready};return n4.set(I,()=>y0(z)?.value),{api:I,update(T,f,d){let h=u4({config:T,path:d});if(K=!0,G===h){P.refresh();return}G=h,_+=1;let q=_;M(),B(),z=void 0,P.refresh(),Q(),L(),A(),f.subscribe(d,(O)=>{if(_!==q||!K)return;F(O.data,T.kind)}).then((O)=>{if(_!==q||!K){O();return}H=O}).catch((O)=>{if(_!==q||!K)return;z=void 0,P.refresh(),Q(),L(),A(),Z.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:$,path:d,error:O instanceof Error?O.message:String(O)})})},unavailable(T){K=!0,G=u4(T),_+=1,M(),B(),z=void 0,P.refresh(),Q(),L(),A()},remove(){if(!K)return;X.emitBefore(),K=!1,G=void 0,_+=1,M(),B(),z=void 0,P.refresh(),Q(),L(),A(),X.emitAfter()},close(){K=!1,_+=1,M(),B(),Y.clear(),z=void 0,A(),P.settle()},isConfigured:()=>K}}function a4($){let Z=new Map,Q=new Map,X=w0($,"KMS"),Y=!1,K=W0("KMS module",()=>Y&&Array.from(Z.values()).every((D)=>!D.isConfigured()||D.api.isReady())),z,G=()=>K.refresh(),_=(D)=>{let V=Z.get(D);if(V)return V;let P=y6(D,$,G);if(Z.set(D,P),!(D in z))Object.assign(z,{[D]:P.api});return P},H=(D)=>{let V=Z.get(D);if(!V)throw Error(`KMS pool "${D}" is not configured.`);return V.api};return z={get config(){return Object.fromEntries(Q)},beforeChange:X.beforeChange,afterChange:X.afterChange,isReady:K.isReady,ready:K.ready,listPools:()=>Array.from(Q.keys()),getPool:H},{handle:()=>z,update(D,V){if(!D&&!Y&&Z.size===0)return;X.emitBefore(),Y=D!==void 0;let P=new Set(Object.keys(D??{}));for(let[L,B]of Object.entries(D??{})){Q.set(L,{...B});let R=B.path??`/kms/${L}`;try{_(L).update(B,V(B),R)}catch(A){_(L).unavailable(B),$.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:L,error:A instanceof Error?A.message:String(A)})}}for(let[L,B]of Z){if(P.has(L))continue;Q.delete(L),B.remove()}return K.refresh(),X.emitAfter(),Y||Z.size>0?z:void 0},close(){for(let D of Z.values())D.close();Z.clear(),Q.clear(),Y=!1,K.settle()}}}import{context as v6,trace as h6}from"@opentelemetry/api";import{logs as f6,SeverityNumber as M$}from"@opentelemetry/api-logs";import{OTLPLogExporter as m6}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as g6}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as p6}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as d6}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as u6}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as l6}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as c6}from"@opentelemetry/resources";import{BatchLogRecordProcessor as i6}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as n6}from"@opentelemetry/sdk-metrics";import{NodeSDK as s6}from"@opentelemetry/sdk-node";var t4={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},a6={trace:!1,debug:!1,info:!0,warn:!0,error:!0};function S2($,Z){let Q=Z[$];if(Q===!1)return!1;if($==="metrics")return Q===!0||typeof Q==="object";return!0}function w2($){return typeof $==="object"&&$!==null?$:void 0}function t6($){return typeof $==="object"&&$!==null?$:void 0}function r6($,Z){let Q=$.replace(/\/+$/,"");if(Q.endsWith(t4[Z]))return Q;return`${Q}${t4[Z]}`}function o6($,Z){let Q=w2($[Z]);if(Q?.endpoint)return Q.endpoint;if(!$.endpoint)return;return r6($.endpoint,Z)}function e6($,Z,Q){let X=w2($[Z]),Y={...$.headers,...X?.headers??{}};if(Q)Y.Authorization=`Bearer ${Q}`;return Y}function C2($,Z,Q){let X=w2($[Z]);return{url:o6($,Z),headers:e6($,Z,Q),timeoutMillis:X?.timeoutMillis,concurrencyLimit:X?.concurrencyLimit}}function $1($,Z){let Q=C2($,"traces",Z);return $.protocol==="http/json"?new u6(Q):new l6(Q)}function Z1($,Z){let Q=C2($,"metrics",Z);return $.protocol==="http/json"?new p6(Q):new d6(Q)}function Q1($,Z){let Q=C2($,"logs",Z);return $.protocol==="http/json"?new m6(Q):new g6(Q)}function X1($){return{"service.name":$.name,...$.version?{"service.version":$.version}:{},...$.deploymentEnvironment?{"deployment.environment.name":$.deploymentEnvironment}:{},...$.resourceAttributes??{}}}async function Y1($){if(!$.oauth)return;let Z=new URLSearchParams({grant_type:"client_credentials",client_id:$.oauth.clientId,client_secret:$.oauth.clientSecret});if($.oauth.scope)Z.set("scope",$.oauth.scope);if($.oauth.audience)Z.set("audience",$.oauth.audience);let Q=await fetch($.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...$.oauth.headers??{}},body:Z});if(!Q.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${Q.status}`);let X=await Q.json();if(typeof X.access_token!=="string"||!X.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return X.access_token}function J1($,Z){return{...a6,...Z?.levels??{},...$.levels??{}}}function I$($,Z="Authorization"){let Q={...$.headers??{}};if(!$.apiKey)return Q;let X=$.apiKeyHeader??Z;return Q[X]=X.toLowerCase()==="authorization"?`Bearer ${$.apiKey}`:$.apiKey,Q}function G1($,Z){return Object.keys($).some((Q)=>Q.toLowerCase()===Z.toLowerCase())}function e4($,Z,Q){let X=Object.keys($).find((Y)=>Y.toLowerCase().startsWith(Z.toLowerCase()));if(X)throw Error(`OpenTelemetry provider "${Q}" does not support provider-specific header "${X}".`)}function x$($,Z,Q,X){return{type:Q,name:$.name,version:$.version,protocol:$.protocol??"http/protobuf",endpoint:$.endpoint,headers:X,resourceAttributes:X1($),levels:J1($,Z),traces:$.traces,metrics:$.metrics,logs:$.logs}}function z1($,Z){return x$($,Z,"otlp",I$($))}function K1($,Z){return x$($,Z,"grafana-lgtm",I$($))}function _1($,Z){let Q=I$($,"DD-API-KEY");if(!G1(Q,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return x$($,Z,"datadog",Q)}function H1($,Z){let Q=I$($);return e4(Q,"DD-","splunk"),x$($,Z,"splunk",Q)}function B1($,Z){let Q=I$($);return e4(Q,"DD-","elastic"),x$($,Z,"elastic",Q)}function D1($,Z){let Q=$.type??"otlp";switch(Q){case"otlp":return z1($,Z);case"grafana-lgtm":return K1($,Z);case"datadog":return _1($,Z);case"splunk":return H1($,Z);case"elastic":return B1($,Z);default:throw Error(`Unsupported OpenTelemetry provider type: ${Q}`)}}function V1($,Z){if(typeof $==="string")return $;if($ instanceof Error)return $.message;if($!=null)return P$($);if(Z.length===0)return"";return P$(Z[0])}function P$($){if(typeof $==="string")return $;try{return JSON.stringify($)}catch{return String($)}}function r4($,Z,Q){if(Q==null)return;if(typeof Q==="string"||typeof Q==="number"||typeof Q==="boolean"){$[Z]=Q;return}if(Array.isArray(Q)&&Q.every((X)=>["string","number","boolean"].includes(typeof X))){$[Z]=Q;return}if(Q instanceof Error){if($[`${Z}.name`]=Q.name,$[`${Z}.message`]=Q.message,Q.stack)$[`${Z}.stack`]=Q.stack;return}$[Z]=P$(Q)}function U1($){let Z={};for(let[X,Y]of $.entries()){if(Y&&typeof Y==="object"&&!Array.isArray(Y)&&!(Y instanceof Error)&&Object.getPrototypeOf(Y)===Object.prototype){for(let[J,K]of Object.entries(Y))r4(Z,J,K);continue}r4(Z,`param.${X}`,Y)}let Q=h6.getSpanContext(v6.active());if(Q)Z.trace_id=Q.traceId,Z.span_id=Q.spanId,Z.trace_flags=Q.traceFlags;return Z}function F1($){return $}function M1($){let Z=typeof $.body==="string"?$.body:P$($.body),Q=$.attributes??{};if(Object.keys(Q).length===0)return Z;return`${Z} ${P$(Q)}`}function $8($,Z){globalThis.console[F1($)](M1(Z))}function L1($,Z){if((Z.severityNumber??0)<M$.INFO)return;$8($,Z)}function W1($,Z,Q){let X=Q?.console;if(X===!1)return;if(typeof X==="function"){X(Z);return}if(X===!0){$8($,Z);return}L1($,Z)}function O1($,Z){let Q=f6.getLogger($.name,$.version),X=(Y,J,K)=>{if(!$.levels[Y])return;let z={severityNumber:J,severityText:Y.toUpperCase(),body:V1(K[0],K.slice(1)),attributes:U1(K.slice(1))};try{Q.emit(z)}finally{W1(Y,z,Z)}};return{trace:(Y,...J)=>X("trace",M$.TRACE,[Y,...J]),debug:(Y,...J)=>X("debug",M$.DEBUG,[Y,...J]),info:(Y,...J)=>X("info",M$.INFO,[Y,...J]),warn:(Y,...J)=>X("warn",M$.WARN,[Y,...J]),error:(Y,...J)=>X("error",M$.ERROR,[Y,...J])}}function N1($){if(!$?.isReady())return;return s4($)}function A1($,Z,Q){let X=Z;return $.subscribe((Y)=>{let J=Y?.value;if(J===X)return;X=J,Q()})}function o4($){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:$,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function k2($,Z,Q,X){if(!Z&&!Q)return;if(!Z)return o4($);let Y=Z,J;if(Y.apiKeyPool&&X)try{J=X.getPool(Y.apiKeyPool)}catch{J=void 0}let K=N1(J),z=()=>k2($,Y,Q,X),G=Y.apiKeyPool&&X?(W)=>A1(X.getPool(Y.apiKeyPool),K,W):void 0;if(Y.apiKeyPool&&!K){let W=o4($);return W.onCredentialChange=G,W.rebuild=z,W}let _=K?{...Y,apiKey:K}:Y,H=D1(_,Q),D,V=!1,P=O1(H,Q),L,B,R=new Promise((W,F)=>{L=W,B=F});async function A(){try{let W=await Y1(Y),F={resource:c6(H.resourceAttributes),instrumentations:Q?.instrument};if(Q?.sampler)F.sampler=Q.sampler;if(Q?.textMapPropagator)F.textMapPropagator=Q.textMapPropagator;if(Q?.contextManager)F.contextManager=Q.contextManager;if(Q?.spanProcessors)F.spanProcessors=Q.spanProcessors;else if(S2("traces",H))F.traceExporter=$1(H,W);if(Q?.metricReaders)F.metricReaders=Q.metricReaders;else if(S2("metrics",H)){let I=t6(H.metrics);F.metricReaders=[new n6({exporter:Z1(H,W),exportIntervalMillis:I?.exportIntervalMillis,exportTimeoutMillis:I?.exportTimeoutMillis})]}if(Q?.logRecordProcessors)F.logRecordProcessors=Q.logRecordProcessors;else if(S2("logs",H))F.logRecordProcessors=[new i6({exporter:Q1(H,W)})];let M=Q?.configure?.(F);D=new s6(M??F),D.start(),V=!0,L?.()}catch(W){V=!1;let F=W instanceof Error?W:Error(String(W));$.error?.("OpenTelemetry startup failed",F),B?.(F)}finally{L=void 0,B=void 0}}return{state:"available",start:A,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>V,ready:(W)=>{if(!W||W<=0)return R;return Promise.race([R,new Promise((F,M)=>{setTimeout(()=>M(Error(`OpenTelemetry ready timed out after ${W}ms.`)),W)})])},logger:P,forceFlush:async()=>{await D?.forceFlush?.()},shutdown:async()=>{V=!1,await D?.shutdown(),D=void 0},onCredentialChange:G,rebuild:z}}function Z8($){let Z,Q,X,Y=0,J=Promise.resolve(),K=w0($,"OpenTelemetry"),z=W0("OpenTelemetry module",()=>Z?.isReady()===!0),G={beforeChange:K.beforeChange,afterChange:K.afterChange,isReady:z.isReady,ready:z.ready,logger:{trace:(D,...V)=>(Z?.logger??$).trace(D,...V),debug:(D,...V)=>(Z?.logger??$).debug(D,...V),info:(D,...V)=>(Z?.logger??$).info(D,...V),warn:(D,...V)=>(Z?.logger??$).warn(D,...V),error:(D,...V)=>(Z?.logger??$).error(D,...V)},forceFlush:async()=>{await Z?.forceFlush()},shutdown:async()=>{await Z?.shutdown()}},_=!1,H;return H={update(D){if(!D){if(Z||Q){let B=Z,R=Q;Y+=1,K.emitBefore(),X?.(),X=void 0,Z=void 0,Q=void 0,z.refresh(),J=Promise.all([B?.shutdown(),R?.shutdown()]).finally(()=>K.emitAfter()).then(()=>{return},()=>{return})}return _?G:void 0}if(_=!0,D===Z||D===Q)return G;let V=Z,P=Q;Y+=1;let L=Y;return K.emitBefore(),X?.(),X=void 0,Z=void 0,Q=D,z.refresh(),J=(async()=>{try{if(await Promise.all([V?.shutdown(),P?.shutdown()]),await D.start(),L!==Y||Q!==D){await D.shutdown();return}Z=D,Q=void 0,z.refresh(),X=D.onCredentialChange?.(()=>{if(Z!==D)return;let B=D.rebuild?.();if(B)H.update(B)})}finally{if(L===Y)K.emitAfter()}})().then(()=>{return},()=>{return}),G},settled(){return J},async shutdown(){Y+=1;let D=Z,V=Q;X?.(),X=void 0,Z=void 0,Q=void 0,z.settle(),await Promise.all([D?.shutdown(),V?.shutdown()])}},H}import{ION_ENDPOINT_PERMISSIONS as b2,trimTrailingSlash as Q8}from"@ionite/core";import{hasPermission as j1}from"@ionite/core/server";async function Y$($,Z,Q){let X=await j1($,Z,Q.permission,void 0,Q.subjectType);return X.allow?void 0:X.response()}function E1($){let Z=Q8($);return{matchesPath:(Y)=>{if(!Y)return!1;return Q8(Y)===Z},startsWithPath:(Y)=>{if(!Y)return!1;return $===Y||$.startsWith(`${Y}/`)}}}function X8($,Z,Q,X){let Y=X??new URL($.url).pathname,{matchesPath:J,startsWithPath:K}=E1(Y);if(Z.sso){let z=Z.sso;if(J(Q.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(G)=>z.handler(G)};if(J(Q.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(G)=>z.logout(G)};if(J(Q.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(G)=>z.logoutBackChannel(G)};if(J(Q.sso.loginUrl)||J(Q.sso.refreshUrl)||J(Q.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(G)=>z.handler(G)}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(G)=>{let _=await z.resolveCustomer(G);if(_.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(_.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(_.value),{headers:{"Content-Type":"application/json"}})}};if(J(Q.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(G)=>z.logout(G)}}if(Z.iam){let z=Z.iam,G=$.method!=="GET"&&$.method!=="HEAD";if(K(Q.iam.usersUrl))return{module:"iam",kind:G?"iam.users.write":"iam.read",requiredPermission:b2[G?"iam.users.write":"iam.read"],handler:async(_)=>z.handler(_)};if(K(Q.iam.groupsUrl))return{module:"iam",kind:G?"iam.groups.write":"iam.read",requiredPermission:b2[G?"iam.groups.write":"iam.read"],handler:async(_)=>z.handler(_)};if(K(Q.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(_)=>z.handler(_)}}if(Z.workload){let z=Z.workload;if(J(Q.workload.validateUrl)||J(Q.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(G)=>z.handler(G)}}if(Z.secrets){let z=Z.secrets;if(z.isLfvDeliveryRequest?.($)&&z.handleLfvDelivery){let G=z.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(_)=>G(_)}}if(z.isLfvEventsRequest?.($)&&z.handleLfvEvents){let G=z.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(_)=>G(_)}}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.magicLinkUrl)&&$.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:b2["ciam.magic-link.create"],handler:async(G)=>z.handler(G)};if(J(Q.ciam.magicLinkLoginUrl)&&$.method==="GET"||J(Q.ciam.customerProvidersUrl)&&$.method==="GET"||J(Q.ciam.customerLoginUrl)&&$.method==="GET"||J(Q.ciam.customerCallbackUrl)&&($.method==="GET"||$.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(G)=>z.handler(G)}}return}async function y2($,Z,Q,X){let Y=X??f0(h$()),J=new URL($.url).pathname;if(Q?.filter){let D=await Q.filter($,Z);if(D instanceof Response)return D;if(D==="not_handled")return _0()}let K=X8($,Z,Y,J),G=await Q?.resolve?.($,Z,K)??K;if(!G)return _0();let _=G.requiredPermission===void 0?K?.requiredPermission:G.requiredPermission,H=async()=>{if(_){let D=await Y$($,Z,_);if(D)return D}return G.handler($)};if(Q?.wrap)return await Q.wrap($,G,H,Z);return await H()}import{stableConfigHash as u1}from"@ionite/core";function t$(){let $=0;return{next:()=>{return $+=1,$},isCurrent:(Z)=>Z===$,current:()=>$}}import{readFile as f1,stat as m1}from"node:fs/promises";class L$ extends Error{code;status;constructor($,Z,Q){super($);this.code=Z;this.status=Q;this.name="VaultWebSocketCommandError"}sourceType="vault"}class p0 extends Error{path;constructor($,Z=`Vault secret not found at path ${$}`){super(Z);this.path=$;this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}code;status;sourceType="vault"}class V0 extends Error{path;status;code;constructor($,Z,Q,X,Y){super($,Y);this.path=Z;this.status=Q;this.code=X;this.name="VaultRequestError"}sourceType="vault"}class P0 extends Error{sourceType;path;constructor($,Z,Q=`Vault subscribe is not supported for source ${$} at path ${Z} without websocket, LFV, or ttl`){super(Q);this.sourceType=$;this.path=Z;this.name="VaultSubscribeNotSupportedError"}}function Y8($){return $ instanceof p0||$ instanceof L$&&($.code==="not_found"||$.status===404)}import{WebSocket as v2}from"ws";var q1=1000,R1=30000,G8=30000,z8=G8;function K8($){z8=$>0?$:G8}function T1($){let Z=Math.min(R1,q1*2**Math.min($,16)),Q=0.5+Math.random()*0.5;return Math.round(Z*Q)}var J$=new Map;function P1($){return $.trim().replace(/\/+$/g,"")}function _8($,Z){let Q=typeof Z?.version==="number"?Z.version:0,X=Z?.created_time??Z?.created,Y=typeof X==="string"?new Date(X):new Date;return{path:$,version:Q,created:Y}}function I1($){return typeof $?.version==="number"?$.version:void 0}function x1($){let Z=$.token?.trim();if(!Z)return{};if($.header==="Authorization")return{Authorization:Z.startsWith("Bearer ")?Z:`Bearer ${Z}`};return{"X-Vault-Token":Z}}function H8($){return{client_id:$.clientId,token:$.token,header:$.header??"X-Vault-Token"}}function B8($,Z){let Q=P1($),X=J$.get(Q);if(X){if(Z&&!X.log)X.log=Z;return X}let Y={url:Q,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,hasConnected:!1,disposed:!1,log:Z};return J$.set(Q,Y),Y}function S1($){let Z=Array.from($.subs.values(),(Y)=>Y.creds);if(Z.length===0)return $.lastGoodCreds??{url:$.url};let Q=$.lastGoodCreds?[$.lastGoodCreds,...Z]:Z,X=Q[$.reconnectCredCursor%Q.length]??Z[0];return $.reconnectCredCursor+=1,X}function J8($,Z){for(let Q of $.subs.values())try{Q.onHealth?.(Z)}catch(X){$.log?.warn("Vault websocket health hook threw",X)}}function w1($,Z){for(let Q of Array.from($.subs.values())){let X=Q.onFirstSecretReject;if(Q.onFirstSecret=void 0,Q.onFirstSecretReject=void 0,X)try{X(new V0(`Vault websocket subscription interrupted (${Z})`,Q.path,void 0,"connection"))}catch(Y){$.log?.warn("Vault websocket first-secret waiter rejection threw",Y)}}}function D8($,Z){for(let Q of $.pending.values())clearTimeout(Q.timer),Q.reject(new V0(`Vault websocket command interrupted (${Z})`,"/",void 0,"connection"));$.pending.clear()}function r$($){if($.disposed)return;if($.disposed=!0,$.reconnectTimer)clearTimeout($.reconnectTimer),$.reconnectTimer=void 0;D8($,"closed"),w1($,"socket disposed");let Z=$.ws;if($.ws=void 0,$.connectPromise=void 0,$.hasConnected=!1,J$.delete($.url),Z)try{Z.removeAllListeners(),Z.close()}catch{}}function h2($){if($.subs.size>0||$.pending.size>0)return;r$($)}function V8($,Z,Q,X){if(X!==void 0&&Z.lastVersion!==void 0&&X===Z.lastVersion)return;if(X!==void 0)Z.lastVersion=X;try{Z.onChange(Q)}catch(J){$.log?.warn("Vault websocket subscription onChange threw",J)}let Y=Z.onFirstSecret;if(Z.onFirstSecret=void 0,Z.onFirstSecretReject=void 0,Y)try{Y()}catch(J){$.log?.warn("Vault websocket subscription onFirstSecret threw",J)}}function C1($,Z){let Q=Z.subscription_id;if(typeof Q!=="string")return;let X=$.subs.get(Q);if(!X)return;let Y={data:Z.data,metadata:_8(typeof Z.path==="string"?Z.path:X.path,Z.metadata)};V8($,X,Y,I1(Z.metadata))}function k1($,Z){let Q;try{Q=JSON.parse(Z.toString())}catch(X){$.log?.warn("Vault websocket message parse failed",X);return}if(Q.type==="secret"){C1($,Q);return}if(Q.type==="command_result"&&typeof Q.id==="string"){let X=$.pending.get(Q.id);if(!X)return;if($.pending.delete(Q.id),clearTimeout(X.timer),Q.ok===!1)X.reject(new L$(Q.error??`Vault websocket command failed for ${Q.id}`,Q.code,Q.status));else X.resolve(Q.result);h2($)}}function U8($,Z){$.send(JSON.stringify({type:"subscribe",subscription_id:Z.subscriptionId,paths:[Z.path],...H8(Z.creds)}))}function F8($){if($.disposed||$.reconnectTimer||$.subs.size===0)return;let Z=T1($.reconnectAttempts);$.reconnectAttempts+=1,$.reconnectTimer=setTimeout(()=>{if($.reconnectTimer=void 0,$.disposed)return;if($.subs.size===0){r$($);return}f2($,S1($)).catch(()=>{if($.hasConnected)$.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${Z}ms).`);F8($)})},Z)}function f2($,Z){if($.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if($.ws&&$.ws.readyState===v2.OPEN)return Promise.resolve($.ws);if($.connectPromise)return $.connectPromise;return $.connectPromise=new Promise((Q,X)=>{let Y=new v2($.url,{headers:x1(Z)}),J=!1,K=$.hasConnected,z=()=>{J=!0,$.hasConnected=!0,$.reconnectAttempts=0,$.reconnectCredCursor=0,$.lastGoodCreds=Z,$.ws=Y,$.connectPromise=void 0,Y.on("message",(H)=>k1($,H));for(let H of $.subs.values())try{U8(Y,H)}catch{}if(K)J8($,!0);Q(Y)},G=()=>{if($.ws===Y)$.ws=void 0;$.connectPromise=void 0;try{Y.removeAllListeners()}catch{}if(D8($,"socket closed"),$.subs.size>0)J8($,!1),F8($);else r$($)},_=(H)=>{if($.ws===Y)$.ws=void 0;if(!J)J=!0,$.connectPromise=void 0,X(H)};Y.once("open",z),Y.on("close",G),Y.on("error",_)}),$.connectPromise}async function m2($,Z,Q,X){let Y=B8($.url,X),J=typeof Q.path==="string"?Q.path:"/",K=await f2(Y,$),z=crypto.randomUUID();try{return await new Promise((G,_)=>{let H=setTimeout(()=>{if(!Y.pending.has(z))return;Y.pending.delete(z),_(new V0(`Vault websocket command "${Z}" timed out`,J,void 0,"timeout"));try{Y.ws?.close()}catch{}},z8);Y.pending.set(z,{resolve:(D)=>G(D),reject:_,timer:H});try{K.send(JSON.stringify({type:"command",id:z,command:Z,...Q,...H8($)}))}catch(D){clearTimeout(H),Y.pending.delete(z),_(D)}})}finally{h2(Y)}}async function g2($,Z,Q){let X;try{X=await m2($,"read_secret",{path:Z},Q)}catch(Y){if(Y8(Y))throw new p0(Z);if(Y instanceof L$||Y instanceof V0)throw Y;throw new V0(`Vault websocket read_secret failed for ${Z}`,Z,void 0,"connection",{cause:Y})}if(!X||typeof X!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${Z}`);return{data:X.data,metadata:_8(typeof X.path==="string"?X.path:Z,X.metadata)}}async function M8($,Z,Q,X,Y,J){let K=B8($.url,Y),z=crypto.randomUUID(),G={subscriptionId:z,creds:$,path:Z,onChange:Q,onHealth:J?.onHealth};K.subs.set(z,G);let _=()=>{if(!K.subs.delete(z))return;if(K.ws&&K.ws.readyState===v2.OPEN)try{K.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:z}))}catch{}h2(K)};try{let H=await f2(K,$);U8(H,G)}catch(H){if(X?.mode!=="wait")throw _(),H}try{let H=await g2($,Z,Y);V8(K,G,H,H.metadata.version)}catch(H){if(X?.mode!=="wait")throw _(),H;await new Promise((D,V)=>{let P,L=(B)=>{if(P)clearTimeout(P);G.onFirstSecret=void 0,G.onFirstSecretReject=void 0,_(),V(B)};if(G.onFirstSecret=()=>{if(P)clearTimeout(P);D()},G.onFirstSecretReject=L,typeof X.timeout==="number"&&X.timeout>0)P=setTimeout(()=>L(H),X.timeout)})}return _}function L8(){let $=0;for(let Z of J$.values())$+=Z.subs.size;return{urls:Array.from(J$.keys()),sockets:J$.size,subscriptions:$}}function W8(){for(let $ of Array.from(J$.values()))r$($)}var o$=600000;function G$($){if($&&$<o$)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${o$} milliseconds (10 minutes), as not to overload the store with polling requests`)}function d0($,Z,Q,X,Y,J,K){let z=!1,G,_,H,D=(A)=>{try{K?.onHealth?.(A)}catch{}},V=()=>{if(z=!0,G)clearTimeout(G),G=void 0;_?.()},P=(A)=>new Promise((W)=>{let F=setTimeout(()=>{_=void 0,G=void 0,W()},A);G=F,_=()=>{clearTimeout(F),_=void 0,G=void 0,W()}});async function L(){let A=Date.now();for(;;){if(z)return;try{let W=await $.getFullSecret(Z,J);return D(!0),W}catch(W){if(D(!1),J?.mode!=="wait")throw W;if(typeof J.timeout==="number"&&J.timeout>0&&Date.now()-A>=J.timeout)throw W;if(z)return;Y?.warn(`Error retrieving initial secret from vault. Retrying in ${X} milliseconds`,W),await P(X)}}}async function B(){if(G=void 0,z)return;try{let A=await $.getFullSecret(Z);if(D(!0),A.metadata.version!==H)H=A.metadata.version,Q(A)}catch(A){D(!1),Y?.warn(`Error retrieving remote config from vault. Retrying in ${X} milliseconds`,A)}R()}function R(){if(z)return;G=setTimeout(()=>{B()},X)}return L().then((A)=>{if(z||!A)return()=>V();return H=A.metadata.version,Q(A),R(),()=>V()})}function b1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function y1($){let Z={"Content-Type":"application/json"};if($)Z["X-Vault-Token"]=$;return Z}function v1($){return Boolean($?.idpTokenUrl?.trim()&&$.clientId?.trim()&&$.clientSecret?.trim())}async function O8($,Z){let Q=Date.now();if(Z.token&&Z.expiresAt&&Z.expiresAt-60000>Q)return Z.token;let X=new URLSearchParams({grant_type:"client_credentials",client_id:$.clientId,client_secret:$.clientSecret});if($.scope?.trim())X.set("scope",$.scope.trim());let Y=await fetch($.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:X.toString()});if(!Y.ok)throw Error(`Vault workload token request failed (${Y.status})`);let J=await Y.json();if(!J.access_token)throw Error("Vault workload token response did not include access_token");return Z.token=J.access_token,Z.expiresAt=Q+Math.max(1,J.expires_in??300)*1000,J.access_token}function h1($){return{Authorization:$.startsWith("Bearer ")?$:`Bearer ${$}`}}function N8($){return $.replace(/\/data\/?$/,"")}function W$($,Z){let{type:Q="vault",url:X,token:Y,ttl:J}=$,K=()=>$.log,z=v1($.workload)?$.workload:void 0,G={},_=y1(Y),H=$.lfv,D=$.websocket,V=H?T$({...H,log:H.log??K(),path:H.path??"/"},Z):void 0,P=new Map,L=D?.url?.trim(),B=new Set,R=!1,A=!1;if(!H&&!X&&!L)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(G$(J),X&&!Y&&!z&&!H)K()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function W(){if(z){let N=await O8(z,G);return{"Content-Type":"application/json",...h1(N)}}return{..._}}async function F(N){let b=T(N);if(z){let l=await O8(z,G);return{url:b,clientId:D?.clientId??z.clientId,token:l,header:"Authorization"}}return{url:b,clientId:D?.clientId,token:D?.token??Y,header:D?.header??"X-Vault-Token"}}function M(N){if(!H)throw Error(`Vault LFV capability is not configured for path ${N}`);let b=P.get(N);if(b)return b;let l=T$({...H,log:H.log??K(),path:N},Z);return P.set(N,l),l}function I(N){if(!X)throw Error(`Vault HTTP capability is not configured for path ${N}`);return X}function T(N){if(!L)throw Error(`Vault websocket capability is not configured for path ${N}`);return L}async function f(N,b){let l=await F(typeof b.path==="string"?b.path:"/");return m2(l,N,b,K())}async function d(N,b){let l=I(N),r;try{let $0=await W();r=await fetch(`${l}/${N}`,{headers:$0})}catch($0){throw new V0(`Vault request failed from URL: ${l}/${N}`,N,void 0,"connection",{cause:$0})}if(r.status!==200){if(r.status===404)throw new p0(N);let $0=r.status===401||r.status===403,G0=$0?`Vault returned ${r.status} ${r.statusText} (auth error) from URL: ${l}/${N}`:`Vault returned invalid status, ${r.status}: '${r.statusText}' from URL: ${l}/${N}`;throw new V0(G0,N,r.status,$0?"auth":"invalid_status")}try{return(await r.json()).data}catch($0){throw new V0("Error retrieving secret",N,void 0,"invalid_payload",{cause:$0})}}async function h(N){let b=await F(N);return g2(b,N,K())}async function q(N){let b=I(N),l=`${N8(b)}/metadata/${N}`,r=await W(),$0=await fetch(l,{headers:r});if($0.status!==200)throw new V0(`Vault getMetadata failed (${$0.status}) for ${N}`,N,$0.status,"invalid_status");let G0=await $0.json().catch(()=>null);if(!G0?.metadata||typeof G0.metadata!=="object")throw new V0(`Vault getMetadata returned invalid payload for ${N}`,N,$0.status,"invalid_payload");return G0.metadata}async function O(N,b,l){let r=I(b),$0=`${N8(r)}/${N}/${b}`,G0=await W(),j=await fetch($0,{method:"POST",headers:G0,body:JSON.stringify({reason:l?.reason,severity:l?.severity,incident_ref:l?.incidentRef})});if(j.status!==200&&j.status!==202&&j.status!==204)throw new V0(`Vault ${N} failed (${j.status}) for ${b}`,b,j.status,"invalid_status")}async function S(N,b){if(H)return await M(N).getFullSecret(N,b);if(X)return await d(N,b);return await h(N)}async function m(N,b,l){if(!b1(b))throw Error(`putSecret requires an object value for vault source at path ${N}`);if(H){await M(N).putSecret(N,b,l);return}if(X){let r=I(N),$0=await W(),G0=await fetch(`${r}/${N}`,{method:"POST",headers:$0,body:JSON.stringify(b)});if(G0.status!==200&&G0.status!==201&&G0.status!==204)throw new V0(`Vault putSecret failed (${G0.status}) for ${N}`,N,G0.status,"invalid_status");return}await f("put_secret",{path:N,data:b})}async function w(N,b){if(H){await M(N).deleteSecret(N,b);return}if(X){let l=I(N),r=await W(),$0=await fetch(`${l}/${N}`,{method:"DELETE",headers:r});if($0.status!==200&&$0.status!==202&&$0.status!==204)throw new V0(`Vault deleteSecret failed (${$0.status}) for ${N}`,N,$0.status,"invalid_status");return}await f("delete_secret",{path:N})}async function u(N,b){if(H)return await M(N).listPaths(N,b);if(X){let $0=`${I(N)}/${N}`,G0=async(C)=>{let k=await W();if(C==="LIST")return fetch($0,{method:"LIST",headers:k});let n=$0.includes("?")?"&":"?";return fetch(`${$0}${n}list=true`,{method:"GET",headers:k})},j=await G0("LIST");if(j.status===405||j.status===501)j=await G0("GET");if(j.status!==200)throw new V0(`Vault listPaths failed (${j.status}) for ${N}`,N,j.status,"invalid_status");let E=await j.json().catch(()=>null),v;if(E&&typeof E==="object"){let C=E,k=C.data;if(k&&typeof k==="object")v=k.keys;else v=C.keys}if(!Array.isArray(v))throw new V0(`Vault listPaths returned an unexpected response for ${N}`,N,void 0,"invalid_payload");return v.filter((C)=>typeof C==="string")}let l=await f("list_paths",{path:N});if(!Array.isArray(l.items))throw Error(`Vault websocket list_paths returned invalid payload for ${N}`);return l.items.filter((r)=>typeof r==="string")}async function i(N,b){if(H)return await M(N).exists(N,b);if(X){let r=I(N),$0=await W(),G0=await fetch(`${r}/${N}`,{headers:$0});if(G0.status===200)return!0;if(G0.status===404)return!1;if(G0.status===401||G0.status===403)throw new V0(`Vault exists failed (${G0.status}) for ${N} (auth error)`,N,G0.status,"auth");throw new V0(`Vault exists failed (${G0.status}) for ${N}`,N,G0.status,"invalid_status")}let l=await f("exists",{path:N});if(typeof l.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${N}`);return l.exists}async function Z0(N,b,l){if(H){await M(N).requestRotate(N,b,l);return}if(X){await O("rotate/request",N,b);return}await f("request_rotate",{path:N,reason:b?.reason,severity:b?.severity,incident_ref:b?.incidentRef})}async function X0(N,b,l){if(H){await M(N).requestRevoke(N,b,l);return}if(X){await O("revoke/request",N,b);return}await f("request_revoke",{path:N,reason:b?.reason,severity:b?.severity,incident_ref:b?.incidentRef})}async function H0(N,b){if(H)return await M(N).getMetadata(N,b);if(X)return await q(N);let l=await f("read_metadata",{path:N});if(!l.metadata||typeof l.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${N}`);return l.metadata}async function c(N,b,l){if(!J)throw new P0(Q,N);return d0({getFullSecret:d},N,b,J,K(),l,{onHealth:(r)=>{R=!r}})}async function Y0(N,b,l){let r=await F(N);return M8(r,N,b,l,K(),{onHealth:($0)=>{A=!$0}})}function z0(N){let b=()=>{if(B.delete(b))N()};return B.add(b),b}function U0(){if(V?.isAvailable?.()===!1)return!0;for(let N of P.values())if(N.isAvailable?.()===!1)return!0;return!1}let K0={type:Q,isAvailable:()=>!R&&!A&&!U0(),getFullSecret:S,getSecret:async(N,b)=>{return(await S(N,b)).data},putSecret:m,deleteSecret:w,listPaths:u,exists:i,requestRotate:Z0,requestRevoke:X0,getMetadata:H0,subscribe:async(N,b,l)=>{let r;if(L)r=await Y0(N,b,l);else if(H)r=await M(N).subscribe(N,b,l);else r=await c(N,b,l);return z0(r)},...V?{subscribeEvents:(N)=>z0(V.subscribeEvents?.(N)??(()=>{}))}:{},close:()=>{for(let b of Array.from(B))try{b()}catch(l){K()?.warn("Vault source close: failed to release a subscription",l)}B.clear();let N=(b)=>{if(!b?.close)return;try{Promise.resolve(b.close()).catch((l)=>{K()?.warn("Vault source close: LFV close failed",l)})}catch(l){K()?.warn("Vault source close: LFV close failed",l)}};for(let b of P.values())N(b);N(V),P.clear(),G.token=void 0,G.expiresAt=void 0},get log(){return $.log},set log(N){$.log=N}};if(V)K0.isDeliveryRequest=(N)=>V.isDeliveryRequest(N),K0.isEventsRequest=(N)=>V.isEventsRequest(N),K0.handleDelivery=(N)=>V.handleDelivery(N),K0.handleEvents=(N)=>V.handleEvents(N),Object.defineProperties(K0,{deliveryPath:{value:V.deliveryPath,enumerable:!0},eventsPath:{value:V.eventsPath,enumerable:!0},callbackKey:{value:V.callbackKey,enumerable:!0},trustId:{value:V.trustId,enumerable:!0}});return K0}class $2 extends Error{status;constructor($,Z){super($);this.name="AzureKeyVaultError",this.status=Z,Object.setPrototypeOf(this,$2.prototype)}}function e$($,Z){if(!$||$.trim().length===0)throw Error(`Missing required Azure config: ${Z}`);return $}function g1($){return $.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function p2($,Z){return`${$.replace(/\/+$/g,"")}/${Z.replace(/^\/+/g,"")}`}function p1($){try{let Q=new URL($).pathname.split("/").filter(Boolean),X=Q.indexOf("secrets");if(X===-1)return;return Q[X+2]||void 0}catch{return}}function d1($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function Z2($){let Z=$.apiVersion??"7.4",Q=$.scope??"https://vault.azure.net/.default",X=$.secretNameTransform??g1,Y=$.authMethod,J="/var/run/secrets/azure/tokens/azure-identity-token",K=$.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",z=$.vaultUrl??($.vaultName?`https://${$.vaultName}.vault.azure.net`:void 0)??void 0,G=e$(z,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function _(q){try{return await m1(q),!0}catch{return!1}}let H,D,V=!1;async function P(q){let{entraTenantId:O,clientId:S}=$;if(!O)throw Error("Workload identity requires entraTenantId");if(!S)throw Error("Workload identity requires clientId");if(!await _(K))throw Error(`Federated token file not found at ${K}`);let m=(await f1(K,"utf8")).trim();if(!m)throw Error("Federated token file was empty");let w=`https://login.microsoftonline.com/${encodeURIComponent(O)}/oauth2/v2.0/token`,u=new URLSearchParams({client_id:S,grant_type:"client_credentials",scope:Q,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:m}),i=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:u});if(i.status!==200)throw Error(`Azure workload identity token exchange returned ${i.status} ${i.statusText}`);let Z0=await i.json();if(!Z0?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:Z0.access_token,expiresAtMs:q+(Z0.expires_in??0)*1000},Z0.access_token}async function L(q){let O=$.imdsApiVersion??"2018-02-01",S="https://vault.azure.net",m=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(m.searchParams.set("api-version",O),m.searchParams.set("resource","https://vault.azure.net"),$.managedIdentityClientId)m.searchParams.set("client_id",$.managedIdentityClientId);let w=await fetch(m.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(w.status!==200)throw Error(`Azure IMDS token endpoint returned ${w.status} ${w.statusText}`);let u=await w.json();if(!u?.access_token)throw Error("IMDS token response missing access_token");let i=q+60000;if(u.expires_on){let Z0=Number.parseInt(u.expires_on,10);if(Number.isFinite(Z0)&&Z0>0)i=Z0*1000;else{let X0=Date.parse(u.expires_on);if(Number.isFinite(X0))i=X0}}else if(u.expires_in){let Z0=Number.parseInt(u.expires_in,10);if(Number.isFinite(Z0)&&Z0>0)i=q+Z0*1000}return H={accessToken:u.access_token,expiresAtMs:i},u.access_token}async function B(q){let O=e$($.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),S=e$($.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),m=e$($.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),w=`https://login.microsoftonline.com/${encodeURIComponent(O)}/oauth2/v2.0/token`,u=new URLSearchParams({client_id:S,client_secret:m,grant_type:"client_credentials",scope:Q}),i=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:u});if(i.status!==200)throw Error(`Azure token endpoint returned ${i.status} ${i.statusText}`);let Z0=await i.json();if(!Z0?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:Z0.access_token,expiresAtMs:q+(Z0.expires_in??0)*1000},Z0.access_token}async function R(){let q=Date.now();if(H&&H.expiresAtMs-60000>q)return H.accessToken;if(D)return D;D=(async()=>{if(Y==="workload_identity")return await P(q);if(Y==="managed_identity")return await L(q);if(Y==="client_secret")return await B(q);if(await _(K))try{return await P(q)}catch{}try{return await L(q)}catch{}return await B(q)})();try{return await D}finally{D=void 0}}async function A(q){let O=await R(),S=p2(G,`/secrets/${encodeURIComponent(q)}?api-version=${encodeURIComponent(Z)}`),m=await fetch(S,{headers:{Authorization:`Bearer ${O}`,Accept:"application/json"}});if(m.status!==200)throw new $2(`Key Vault request failed (${m.status})`,m.status);return await m.json()}async function W(q,O){let S=X(q),m=$.secretNamePrefix?`${$.secretNamePrefix}${S}`:S,w=await A(m),u=w.value;try{u=JSON.parse(w.value)}catch{}let i=w.attributes?.created?w.attributes.created*1000:void 0,Z0=p1(w.id);return{data:u,metadata:{path:q,version:Number.parseInt(Z0??"",10)||0,created:i?new Date(i):new Date}}}async function F(q,O,S){if(!d1(O))throw Error(`putSecret requires an object value for azure source at path ${q}`);let m=X(q),w=$.secretNamePrefix?`${$.secretNamePrefix}${m}`:m,u=await R(),i=p2(G,`/secrets/${encodeURIComponent(w)}?api-version=${encodeURIComponent(Z)}`),Z0=JSON.stringify({value:JSON.stringify(O)}),X0=await fetch(i,{method:"PUT",headers:{Authorization:`Bearer ${u}`,"Content-Type":"application/json",Accept:"application/json"},body:Z0});if(X0.status!==200&&X0.status!==201)throw Error(`Key Vault putSecret failed (${X0.status}) for ${q}`)}async function M(q,O){let S=X(q),m=$.secretNamePrefix?`${$.secretNamePrefix}${S}`:S,w=await R(),u=p2(G,`/secrets/${encodeURIComponent(m)}?api-version=${encodeURIComponent(Z)}`),i=await fetch(u,{method:"DELETE",headers:{Authorization:`Bearer ${w}`,Accept:"application/json"}});if(i.status!==200&&i.status!==202&&i.status!==204)throw Error(`Key Vault deleteSecret failed (${i.status}) for ${q}`)}async function I(q,O){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${q}`)}async function T(q,O){try{return await W(q),!0}catch(S){if(S instanceof $2&&S.status===404)return!1;throw S}}async function f(q,O,S){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${q}`)}async function d(q,O,S){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${q}`)}async function h(q,O){let S=X(q),m=$.secretNamePrefix?`${$.secretNamePrefix}${S}`:S,w=await A(m);return{id:w.id,...w.attributes??{}}}return{type:$.type,isAvailable:()=>!V,getFullSecret:W,getSecret:async(q,O)=>{return(await W(q,O)).data},putSecret:F,deleteSecret:M,listPaths:I,exists:T,requestRotate:f,requestRevoke:d,getMetadata:h,subscribe:(q,O,S)=>{if(!$.ttl)throw new P0("azure",q);return G$($.ttl),d0({getFullSecret:W},q,O,$.ttl,void 0,S,{onHealth:(m)=>{V=!m}})},close:()=>{H=void 0,D=void 0,V=!1}}}var d2=Symbol("ion.secretsSourceState");function l1($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${X}`)};return{type:"dev",getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[d2]:"unavailable"}}function A8($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${X}`)};return{type:"dev",getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[d2]:"removed"}}function c1($,Z,Q){if(Z.type==="vault")return W$(Z,Q);if(Z.type==="azure")return Z2(Z);if(Z.type==="aws"||Z.type==="gcp"||Z.type==="dev")throw Error(`Secrets source "${$}" uses type "${Z.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${$}"`)}function i1($,Z){let Q=(X)=>{Z.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:X instanceof Error?X.message:String(X)})};try{Promise.resolve($.close?.()).catch(Q)}catch(X){Q(X)}}function n1($){let Z=new Map,Q=new Map,X=new Map;for(let[Y,J]of Object.entries($)){if(!j8(J))continue;let K=Z.get(J.deliveryPath);if(K)throw Error(`LFV delivery path "${J.deliveryPath}" is claimed by both secrets sources "${K}" and "${Y}"; delivery paths must be globally unique.`);Z.set(J.deliveryPath,Y);let z=Q.get(J.eventsPath);if(z)throw Error(`LFV events path "${J.eventsPath}" is claimed by both secrets sources "${z}" and "${Y}"; events paths must be globally unique.`);Q.set(J.eventsPath,Y);let G=X.get(J.callbackKey);if(G&&G.trustId!==J.trustId)throw Error(`LFV callback key "${J.callbackKey}" is claimed by secrets sources "${G.sourceName}" and "${Y}" with different verify JWKS; a callback path must use a single trust key.`);if(!G)X.set(J.callbackKey,{sourceName:Y,trustId:J.trustId})}}function j8($){return typeof $.isDeliveryRequest==="function"&&typeof $.isEventsRequest==="function"&&typeof $.handleDelivery==="function"&&typeof $.handleEvents==="function"}function s1($,Z,Q){let X={...Z},Y=[],J=(z)=>{if(X[z]!==void 0)delete X[z],Y.push(z)};J("token"),J("clientSecret"),J("workload");let K=X.websocket;if(K&&typeof K==="object"&&K.token!==void 0){let z={...K};delete z.token,X.websocket=z,Y.push("websocket.token")}if(Y.length>0)Q.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:$,"ion.droppedFields":Y});return X}function a1($,Z,Q){let X={},Y=new Set([...Object.keys(Z??{}),...Object.keys(Q??{})]);for(let J of Y){let K=Z?.[J],z=Q?.[J],G=z?s1(J,z,$):void 0;X[J]={...K??{},...G??{}}}return X}function Q2($){return $[d2]??"available"}function t1($,Z,Q){let X=Z,Y=new Set,J=new Set,K=new Set,z=w0(Q,`Secrets source "${$}"`),G=()=>Q2(X)==="available",_=W0(`Secrets source "${$}"`,G),H=(F,M,I)=>{return Error(`${F} timed out after ${I}ms waiting for source "${$}" to be configured by the ConfigSource at path ${M}`)},D=(F,M)=>{return Error(`${F} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${M}`)},V=(F,M,I)=>{let T=Q2(X);if(T==="available")return Promise.resolve(X);if(T==="removed")return Promise.reject(D(F,M));return new Promise((f,d)=>{let h={method:F,path:M,resolve:(O)=>{if(h.timeout)clearTimeout(h.timeout);K.delete(h),f(O)},reject:(O)=>{if(h.timeout)clearTimeout(h.timeout);K.delete(h),d(O)}},q=I?.timeout;if(typeof q==="number"&&q>0)h.timeout=setTimeout(()=>{h.reject(H(F,M,q))},q);K.add(h)})},P=(F)=>{for(let M of Array.from(K))M.resolve(F)},L=()=>{for(let F of Array.from(K))F.reject(D(F.method,F.path))},B=async(F,M=!1)=>{let I=F.guard.next();if(F.unsubscribe?.(),F.unsubscribe=void 0,F.closed)return;if(Q2(X)==="unavailable"&&F.options?.mode!=="wait"){if(M)throw Error(`subscribe is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${F.path}`);return}try{let f=await(F.options?.mode==="wait"?await V("subscribe",F.path,F.options):X).subscribe(F.path,(d)=>{if(!F.closed)F.onChange(d)},F.options);if(F.closed||!F.guard.isCurrent(I)){f?.();return}F.unsubscribe=f}catch(T){if(M)throw T;if(c$(T)){Q.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:$,path:F.path});return}Q.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:$,path:F.path,error:T instanceof Error?T.message:String(T)})}},R=(F,M=!1)=>{if(F.unsubscribe?.(),F.unsubscribe=void 0,F.closed)return;if(!X.subscribeEvents){if(M)throw Error(`Secrets source "${$}" does not support lifecycle event subscriptions`);return}F.unsubscribe=X.subscribeEvents((I)=>{if(!F.closed)F.listener(I)})},A={get type(){return X.type},beforeChange:z.beforeChange,afterChange:z.afterChange,isAvailable:()=>G()&&(X.isAvailable?.()??!0),isReady:_.isReady,ready:_.ready,getFullSecret:async(F,M)=>{return(await V("getFullSecret",F,M)).getFullSecret(F,M)},getSecret:async(F,M)=>{return(await V("getSecret",F,M)).getSecret(F,M)},putSecret:async(F,M,I)=>{return(await V("putSecret",F,I)).putSecret(F,M,I)},subscribe:async(F,M,I)=>{let T={path:F,onChange:M,options:I,closed:!1,guard:t$()};Y.add(T);try{await B(T,!0)}catch(f){throw Y.delete(T),f}return()=>{T.closed=!0,T.guard.next(),Y.delete(T),T.unsubscribe?.(),T.unsubscribe=void 0}},subscribeEvents:(F)=>{let M={listener:F,closed:!1};J.add(M);try{R(M,!0)}catch(I){throw J.delete(M),I}return()=>{M.closed=!0,J.delete(M),M.unsubscribe?.(),M.unsubscribe=void 0}},deleteSecret:async(F,M)=>{return(await V("deleteSecret",F,M)).deleteSecret(F,M)},listPaths:async(F,M)=>{return(await V("listPaths",F,M)).listPaths(F,M)},exists:async(F,M)=>{return(await V("exists",F,M)).exists(F,M)},requestRotate:async(F,M,I)=>{return(await V("requestRotate",F,I)).requestRotate(F,M,I)},requestRevoke:async(F,M,I)=>{return(await V("requestRevoke",F,I)).requestRevoke(F,M,I)},getMetadata:async(F,M)=>{return(await V("getMetadata",F,M)).getMetadata(F,M)}},W=(F)=>{try{Promise.resolve(F.close?.()).catch((M)=>{Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:M instanceof Error?M.message:String(M)})})}catch(M){Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:M instanceof Error?M.message:String(M)})}};return{api:A,update(F){if(F===X)return;let M=X;z.emitBefore(),X=F;let I=Q2(F);if(I==="available")P(F);else if(I==="removed")L();_.refresh();for(let T of Y)B(T);for(let T of J)R(T);W(M),z.emitAfter()},close(){for(let F of Y)F.closed=!0,F.guard.next(),F.unsubscribe?.(),F.unsubscribe=void 0;Y.clear();for(let F of J)F.closed=!0,F.unsubscribe?.(),F.unsubscribe=void 0;J.clear(),L(),_.settle(),W(X)}}}function E8($){let Z=new Map,Q=new Map,X,Y=new Map,J=w0($,"Secrets"),K=!1,z=()=>{for(let B of Z.keys()){let R=Y.get(B);if(R&&R.api.isReady?.()===!1)return!1}return!0},G=W0("Secrets module",()=>K&&z()),_=(B)=>{let R=Y.get(B);if(R)return R;let A=t1(B,Z.get(B)??A8(B),$);if(Y.set(B,A),!(B in L))Object.assign(L,{[B]:A.api});return A},H=(B)=>{let R=Y.get(B)?.api;if(R)return R;throw $.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:B}),Error(`Secrets source "${B}" is not configured`)},D=()=>{return Array.from(Z.values()).filter(j8)},V=(B)=>{return D().find((R)=>R.isDeliveryRequest(B))},P=(B)=>{return D().find((R)=>R.isEventsRequest(B))},L;return L={get config(){return Object.fromEntries(Array.from(Z.keys(),(B)=>[B,_(B).api]))},beforeChange:J.beforeChange,afterChange:J.afterChange,isReady:G.isReady,isAvailable:()=>{for(let B of Y.values()){if(B.api.isReady?.()===!1)continue;if(B.api.isAvailable?.()===!1)return!1}return!0},ready:G.ready,listSecretsSources:()=>Array.from(Z.keys()),getSecretsSource:(B)=>{if(Z.has(B))return _(B).api;return H(B)},getSecret:(B,R,A)=>L.getSecretsSource(B).getSecret(R,A),getFullSecret:(B,R,A)=>L.getSecretsSource(B).getFullSecret(R,A),putSecret:(B,R,A,W)=>L.getSecretsSource(B).putSecret(R,A,W),deleteSecret:(B,R,A)=>L.getSecretsSource(B).deleteSecret(R,A),listPaths:(B,R,A)=>L.getSecretsSource(B).listPaths(R,A),exists:(B,R,A)=>L.getSecretsSource(B).exists(R,A),requestRotate:(B,R,A,W)=>L.getSecretsSource(B).requestRotate(R,A,W),requestRevoke:(B,R,A,W)=>L.getSecretsSource(B).requestRevoke(R,A,W),getMetadata:(B,R,A)=>L.getSecretsSource(B).getMetadata(R,A),subscribe:(B,R,A,W)=>L.getSecretsSource(B).subscribe(R,A,W),isLfvDeliveryRequest:(B)=>V(B)!==void 0,isLfvEventsRequest:(B)=>P(B)!==void 0,handleLfvDelivery:async(B)=>{let R=V(B);if(!R)return _0();return R.handleDelivery(B)},handleLfvEvents:async(B)=>{let R=P(B);if(!R)return _0();return R.handleEvents(B)}},{update(B,R,A,W){let F=B!==void 0||R!==void 0;if(!F&&!K&&Y.size===0)return;let M=a1($,B,R),I=W!==X,T=new Map,f=new Map,d=[];try{for(let[h,q]of Object.entries(M)){let O=u1(q),S=Z.get(h);if(S&&Q.get(h)===O&&!I){T.set(h,S),f.set(h,O);continue}let m;if(!q.type)m=l1(h);else A?.validateSourceConfig?.(h,q),m=c1(h,q,W),d.push(m);T.set(h,m),f.set(h,O)}n1(Object.fromEntries(T))}catch(h){for(let q of d)i1(q,$);throw h}J.emitBefore(),K=F,X=W;for(let[h,q]of T)Z.set(h,q),Q.set(h,f.get(h)),_(h).update(q);for(let[h,q]of Y){if(T.has(h))continue;Z.delete(h),Q.delete(h),q.update(A8(h))}return G.refresh(),J.emitAfter(),L},close(){for(let B of Y.values())B.close();Y.clear(),Z.clear(),Q.clear(),X=void 0,K=!1,G.settle()}}}function u2($,Z){let Q=Z.ttlMs,X=Math.max(1,Math.floor(Z.maxEntries)),Y=new Map,J=()=>Date.now();function K(){while(Y.size>X){let G=Y.keys().next().value;if(G===void 0)break;Y.delete(G)}}function z(G,_){Y.delete(G),Y.set(G,{session:_,expiresAt:J()+Q}),K()}return{async create(G){await $.create(G)},async get(G){let _=Y.get(G);if(_){if(_.expiresAt>J())return Y.delete(G),Y.set(G,_),_.session;Y.delete(G)}let H=await $.get(G);if(H)z(G,H);return H},async update(G,_){await $.update(G,_),Y.delete(G)},async delete(G){await $.delete(G),Y.delete(G)}}}import{ION_ENDPOINT_PERMISSIONS as DZ,trimTrailingSlash as G2,validationFailureResponse as VZ}from"@ionite/core";import{assertEcid as q8,jwtAssertionClaimsSchema as r1,must as I0,workloadTokenResponseSchema as o1}from"@ionite/core";import{getCachedVerificationKey as e1,getJwks as $Z}from"@ionite/core/server";function C0($,Z){return Z in $&&$[Z]!==void 0&&$[Z]!==null}function j0($){if($===void 0||$===null)return!1;return C0($,"workloadId")||C0($,"privateKey")}function v0($){if($===void 0||$===null)return!1;let Z=C0($,"clientId"),Q=C0($,"clientSecret"),X=C0($,"workloadId"),Y=C0($,"privateKey");return(Z||Q)&&!X&&!Y}function l2($){if($===void 0||$===null)return!1;let Z=C0($,"jwksUri"),Q=C0($,"workloadId"),X=C0($,"clientId"),Y=C0($,"clientSecret"),J=C0($,"privateKey");return Z&&!Q&&!J&&!X&&!Y}function R8($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return"clientId"in Z||"jwksUri"in Z||"workloadId"in Z}function ZZ($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;if(R8(Z))return!1;let Q=Object.entries(Z);if(Q.length===0)return!1;return Q.every(([,X])=>R8(X))}function S8($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;if("incoming"in Z||"outgoing"in Z){if(Z.incoming!==void 0&&(typeof Z.incoming!=="object"||Z.incoming===null))return!1;if(Z.outgoing!==void 0&&(typeof Z.outgoing!=="object"||Z.outgoing===null||Array.isArray(Z.outgoing)))return!1;return!0}return!1}function w8($){return S8($)}function c2($){if(!$)return;if(w8($))return Array.isArray($.incoming)?void 0:$.incoming;return $}function t2($){if($===void 0||$===null)return[];return Array.isArray($)?$:[$]}function O$($){if(typeof $!=="string")return;return $.endsWith("/")?$.slice(0,-1):$}function T8($){if(!$)return[];if(Array.isArray($))return $.filter((Z)=>!!Z&&typeof Z.issuer==="string"&&typeof Z.jwksUri==="string").map((Z)=>({issuer:Z.issuer,jwksUri:Z.jwksUri,audience:Z.audience,scopesAsEntitlements:Z.scopesAsEntitlements}));if($.issuer&&$.jwksUri)return[{issuer:$.issuer,jwksUri:$.jwksUri,audience:$.audience??[],scopesAsEntitlements:$.scopesAsEntitlements}];return[]}function QZ($){let Z=$[0];if(!Z)return;let Q=t2(Z.audience);return{jwksUri:Z.jwksUri,issuer:Z.issuer,audience:typeof Q[0]==="string"?Q[0]:void 0}}function P8($,Z){let Q=O$(Z);if(!Q)return;return $.find((X)=>O$(X.issuer)===Q)}function X2($,Z,Q){let X=t2($);if(Z.some((Y)=>X.includes(Y)))return!0;if(typeof Q==="string"&&Z.includes(Q))return!0;return!1}function i2($){if(!$||!w8($))return{};return $.outgoing??{}}function XZ($){return{getToken:$.getToken,refreshToken:$.refreshToken,generateJWTAssertion:$.generateJWTAssertion,revokeToken:$.revokeToken,beforeChange:$.beforeChange,afterChange:$.afterChange,isReady:$.isReady,ready:$.ready}}var r2=Symbol("ion.workloadClientState"),C8=Symbol("ion.namedWorkloadClients");function YZ($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[r2]:"unavailable"}}function I8($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it is no longer configured on this Ionite instance.`)};return{getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[r2]:"removed"}}function JZ($){if(!$)return"removed";return $[r2]??"available"}function n2($,Z,Q){let X=$,Y=X,J=new Set;for(let K of Q){if(J.add(K),K in Y)continue;let z=Z[K];Y[K]=z?XZ(z):YZ(K)}return Object.defineProperty(Y,C8,{value:J,enumerable:!1,configurable:!0}),X}function x8($){if(!$)return[];let Z=$[C8];return Z?Array.from(Z):[]}function GZ($,Z,Q){let X=Z,Y=w0(Q,`Workload client "${$}"`),J=()=>JZ(X)==="available",K=W0(`Workload client "${$}"`,J);return{api:{beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:K.isReady,ready:K.ready,getToken:(G)=>X.getToken(G),refreshToken:(G)=>X.refreshToken(G),generateJWTAssertion:(G)=>X.generateJWTAssertion(G),revokeToken:(G)=>X.revokeToken(G)},update(G){if(G===X)return;Y.emitBefore(),X=G,K.refresh(),Y.emitAfter()}}}function k8($){let Z,Q=!1,X=W0("Workload module",()=>Q),Y=w0($,"Workload"),J=new Map,K=new Set,z=new Set(["beforeChange","afterChange","isReady","ready"]),G=(V)=>{if(!Z)throw Error(`${V} is unavailable because workload is not configured on this Ionite instance.`);return Z},_={beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:X.isReady,ready:X.ready,get config(){return Z?.config??{}},getToken(...V){return G("getToken").getToken(...V)},refreshToken(V){return G("refreshToken").refreshToken(V)},generateJWTAssertion(V){return G("generateJWTAssertion").generateJWTAssertion(V)},revokeToken(V){return G("revokeToken").revokeToken(V)},validateToken(V){return G("validateToken").validateToken(V)},getWorkloadIdentity(V){return G("getWorkloadIdentity").getWorkloadIdentity(V)},parseJWT(V){return G("parseJWT").parseJWT(V)},handler(V){return G("handler").handler(V)}},H=(V)=>{for(let B of K)delete _[B];if(K.clear(),!V)return;let P=new Set(x8(V)),L=new Set([...z,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...P]);for(let[B,R]of Object.entries(V)){if(L.has(B))continue;_[B]=R,K.add(B)}},D=(V)=>{let P=J.get(V);if(P)return P;let L=GZ(V,I8(V),$);if(J.set(V,L),!(V in _))_[V]=L.api;return L};return{update(V){if(!V&&!Q&&J.size===0)return;Y.emitBefore(),Q=V!==void 0,X.refresh(),Z=V;let P=new Set(x8(V));for(let L of P){let B=V[L];D(L).update(B)}for(let[L,B]of J){if(P.has(L))continue;B.update(I8(L))}return H(V),Y.emitAfter(),_}}}async function s2($,Z,Q){if($===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let X=Q[$];if(!X)throw Error(`Unknown workload client: ${$}`);return X.getToken(Z)}function a2($,Z){return`${$}|${Z??""}`}function u0($,Z,Q,X,Y){let J={jwtAssertionClaims:$?.jwtAssertionClaims??r1("server"),tokenResponse:$?.tokenResponse??o1("server")},K=async(j,E)=>{let v=j;if(typeof v.validate==="function")return v.validate(E);return j["~standard"].validate(E)};if(!Q&&!X)return;if(Q&&S8(Q)){let j=Q.incoming,E=T8(j),v=Array.isArray(j)?QZ(j):j,C=c2(X),k=i2(X),n=v?{...v,...C,jwksUri:v.jwksUri,issuer:v.issuer}:C;if(!n||!n.tokenUrl&&!n.jwksUri)Z.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let g=n&&(n.tokenUrl||n.jwksUri)?u0($,Z,v??void 0,C,E):void 0,o=Array.from(new Set([...Object.keys(Q.outgoing??{}),...Object.keys(k)])).map((J0)=>[J0,{...Q.outgoing?.[J0]??{},...k[J0]??{}}]),s={};for(let[J0,o0]of o){let h0=u0($,Z,o0,void 0);if(h0)s[J0]=h0}if(!g&&Object.keys(s).length===0)return;let F0={...g?.config??{},config:g?.config??{},getToken:async(J0,o0)=>s2(J0,o0,s),getServerToken:async(J0)=>{if(!g)throw Error("No server workload config");return g.getToken(J0)},refreshToken:async(J0)=>{if(!g)throw Error("No default workload config");return g.refreshToken(J0)},generateJWTAssertion:async(J0)=>{if(!g)throw Error("No default workload config");return g.generateJWTAssertion(J0)},revokeToken:async(J0)=>{if(!g)throw Error("No default workload config");return g.revokeToken(J0)},validateToken:async(J0)=>{if(!g)throw Error("No default workload config");return g.validateToken(J0)},getWorkloadIdentity:async(J0)=>{if(!g)return;return g.getWorkloadIdentity(J0)},parseJWT:async(J0)=>{if(!g)throw Error("No default workload config");return g.parseJWT(J0)},handler:async(J0)=>{if(!g)return _0();return g.handler(J0)}};return n2(F0,s,o.map(([J0])=>J0))}if(Q&&ZZ(Q)){let j=c2(X),E=i2(X),v=Q.default,C=v?{...v,...j,jwksUri:v.jwksUri,issuer:v.issuer}:j;if(!C||!C.tokenUrl&&!C.jwksUri)Z.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let k=C&&(C.tokenUrl||C.jwksUri)?u0($,Z,v??void 0,j):void 0,n=Array.from(new Set([...Object.keys(Q).filter((s)=>s!=="default"),...Object.keys(E)])).map((s)=>[s,{...s in Q?Q[s]:{},...E[s]??{}}]),g={};for(let[s,F0]of n){let J0=u0($,Z,F0,void 0);if(J0)g[s]=J0}if(!k&&Object.keys(g).length===0)return;let o={...k?.config??{},config:k?.config??{},getToken:async(s,F0)=>s2(s,F0,g),getServerToken:async(s)=>{if(!k)throw Error("No server workload config");return k.getToken(s)},refreshToken:async(s)=>{if(!k)throw Error("No default workload config");return k.refreshToken(s)},generateJWTAssertion:async(s)=>{if(!k)throw Error("No default workload config");return k.generateJWTAssertion(s)},revokeToken:async(s)=>{if(!k)throw Error("No default workload config");return k.revokeToken(s)},validateToken:async(s)=>{if(!k)throw Error("No default workload config");return k.validateToken(s)},getWorkloadIdentity:async(s)=>{if(!k)return;return k.getWorkloadIdentity(s)},parseJWT:async(s)=>{if(!k)throw Error("No default workload config");return k.parseJWT(s)},handler:async(s)=>{if(!k)return _0();return k.handler(s)}};return n2(o,g,n.map(([s])=>s))}let z=c2(X),G=i2(X);if(!Q&&Object.keys(G).length>0){let j={};for(let[C,k]of Object.entries(G)){let n=u0($,Z,k,void 0);if(n)j[C]=n}let E=z&&(z.tokenUrl||z.jwksUri)?u0($,Z,z,void 0):void 0;if(!E&&Object.keys(j).length===0)return;let v={...E?.config??{},config:E?.config??{},getToken:async(C,k)=>s2(C,k,j),getServerToken:async(C)=>{if(!E)throw Error("No server workload config");return E.getToken(C)},refreshToken:async(C)=>{if(!E)throw Error("No default workload config");return E.refreshToken(C)},generateJWTAssertion:async(C)=>{if(!E)throw Error("No default workload config");return E.generateJWTAssertion(C)},revokeToken:async(C)=>{if(!E)throw Error("No default workload config");return E.revokeToken(C)},validateToken:async(C)=>{if(!E)throw Error("No default workload config");return E.validateToken(C)},getWorkloadIdentity:async(C)=>{if(!E)return;return E.getWorkloadIdentity(C)},parseJWT:async(C)=>{if(!E)throw Error("No default workload config");return E.parseJWT(C)},handler:async(C)=>{if(!E)return _0();return E.handler(C)}};return n2(v,j,Object.keys(G))}let _=Q,H=Y??T8(_),D=z?.tokenUrl,V=D?.startsWith("/")?D:void 0,P=_?.idpTokenUrl??z?.idpTokenUrl??(_?.tokenUrl&&(_.tokenUrl.startsWith("http://")||_.tokenUrl.startsWith("https://"))?_.tokenUrl:void 0),L={..._,...z,tokenUrl:V??z?.tokenUrl??_?.tokenUrl,idpTokenUrl:P,jwksUri:_?.jwksUri,issuer:_?.issuer};L._handlerTokenUrl=V;let B,R=L,A=j0(L),W=v0(L),F=l2(L);if(!A&&!W&&!F){if(!_||Object.keys(_).length===0)return;throw Z.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(L),clientId:R.clientId,clientSecret:R.clientSecret?"[REDACTED]":void 0,workloadId:R.workloadId,privateKey:R.privateKey?"[REDACTED]":void 0,jwksUri:R.jwksUri,tokenUrl:R.tokenUrl,idpTokenUrl:R.idpTokenUrl,fromVaultKeys:_?Object.keys(_):[],fromCodeKeys:X?Object.keys(X):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(A)B={...L,tokenUrl:L.tokenUrl,idpTokenUrl:I0(L.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:I0(L.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:I0(L.privateKey,"Missing 'privateKey' from Workload Config"),audience:I0(L.audience,"Missing 'audience' from Workload Config"),scope:L.scope??"",algorithm:L.algorithm??"RS256",tokenLifetime:L.tokenLifetime??300,refreshThreshold:L.refreshThreshold??60,autoRefresh:L.autoRefresh!==void 0?L.autoRefresh:!0,tokenStore:L.tokenStore??new $$};else if(v0(L))B={...L,tokenUrl:L.tokenUrl,idpTokenUrl:I0(L.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:I0(L.clientId,"Missing 'clientId' from Workload Config"),clientSecret:I0(L.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:L.scope??"",tokenLifetime:L.tokenLifetime??300,refreshThreshold:L.refreshThreshold??60,autoRefresh:L.autoRefresh!==void 0?L.autoRefresh:!0,tokenStore:L.tokenStore??new $$};else if(l2(L))B=L;function M(){let j=new Uint8Array(16);return crypto.getRandomValues(j),Array.from(j,(E)=>E.toString(16).padStart(2,"0")).join("")}function I(j){let E;if(typeof j==="string")E=btoa(j);else E=btoa(String.fromCharCode(...j));return E.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function T(j){let E=j.replace(/-/g,"+").replace(/_/g,"/");while(E.length%4)E+="=";return atob(E)}function f(j){if(j.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:j==="RS256"?"SHA-256":j==="RS384"?"SHA-384":"SHA-512"};else if(j.startsWith("ION"))return{name:"ECDSA",namedCurve:j==="ES256"?"P-256":j==="ES384"?"P-384":"P-521",hash:j==="ES256"?"SHA-256":j==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${j}`)}async function d(j,E){let v=j.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),C=Uint8Array.from(atob(v),(n)=>n.charCodeAt(0)),k=f(E);return crypto.subtle.importKey("pkcs8",C,k,!1,["sign"])}async function h(j,E,v){let C=await d(E,v),n=new TextEncoder().encode(j),g=f(v),o=await crypto.subtle.sign(g,C,n);return I(new Uint8Array(o))}async function q(j,E=3,v=1000,C=30000){let k=Error("Placeholder Error");for(let n=0;n<=E;n++)try{return await j()}catch(g){if(k=g instanceof Error?g:Error(String(g)),k.message.includes("400")||k.message.includes("401")||k.message.includes("403")||k.message.includes("404"))throw k;if(n<E){let o=Math.min(v*2**n,C),s=Math.random()*o*0.1;await new Promise((F0)=>setTimeout(F0,o+s))}}throw k}async function O(j){if(!j0(B))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let E=B,v=Math.floor(Date.now()/1000),C={iss:E.workloadId,sub:E.workloadId,aud:E.audience??"",exp:v+E.tokenLifetime,iat:v,jti:M(),scope:j??E.scope},k={alg:E.algorithm,typ:"JWT",kid:E.keyId},n=I(JSON.stringify(k)),g=I(JSON.stringify(C)),o=`${n}.${g}`,s=await h(o,E.privateKey,E.algorithm);return`${o}.${s}`}async function S(j){if(!j0(B))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let E=B;return q(async()=>{let v=E.idpTokenUrl,C=await O(j),k=new URLSearchParams;if(k.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),k.append("assertion",C),j)k.append("scope",j);let n=await fetch(v,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:k.toString()}),g=await n.json();if(!n.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:g});let s=g;throw Error(`Token acquisition failed: ${s.error||n.statusText} - ${s.error_description||""}`.trim())}let o=await K(J.tokenResponse,g);if(o.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:o.issues}),Error(`Token response validation failed: ${o.issues.map((s)=>s.message).join("; ")}`);if(E.tokenStore){let s=new Date(Date.now()+(o.value.expires_in??300)*1000),F0={workload_id:a2(E.workloadId,j),access_token:o.value.access_token,token_type:o.value.token_type,scope:o.value.scope,expires_at:s,created_at:new Date,refresh_token:o.value.refresh_token};await E.tokenStore.set(F0)}return o.value})}async function m(j){if(!v0(B))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let E=B;return q(async()=>{let v=E.idpTokenUrl,C=new URLSearchParams;if(C.append("grant_type","client_credentials"),C.append("client_id",E.clientId),C.append("client_secret",E.clientSecret),j)C.append("scope",j);let k=await fetch(v,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:C.toString()}),n=await k.json();if(!k.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:n});let o=n;throw Error(`Token acquisition failed: ${o.error||k.statusText} - ${o.error_description||""}`.trim())}let g=await K(J.tokenResponse,n);if(g.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:g.issues}),Error(`Token response validation failed: ${g.issues.map((o)=>o.message).join("; ")}`);if(E.tokenStore){let o=new Date(Date.now()+(g.value.expires_in??300)*1000),s={workload_id:a2(E.clientId,j),access_token:g.value.access_token,token_type:g.value.token_type,scope:g.value.scope,expires_at:o,created_at:new Date,refresh_token:g.value.refresh_token};await E.tokenStore.set(s)}return g.value})}let w=new Map;function u(j,E){let v=w.get(j);if(v)return v;let C=(async()=>{return(j0(B)?await S(E??""):await m(E??"")).access_token})();return w.set(j,C),C.catch(()=>{return}).finally(()=>{if(w.get(j)===C)w.delete(j)}),C}async function i(j){if(!j0(B)&&!v0(B)){let k=B;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!k.clientId}, hasClientSecret=${!!k.clientSecret}, hasWorkloadId=${!!k.workloadId}, hasPrivateKey=${!!k.privateKey}, hasJwksUri=${!!k.jwksUri}`)}let E=B;j=j??E.scope;let v=j0(B)?B.workloadId:B.clientId,C=a2(v,j);if(E.tokenStore){let k=await E.tokenStore.get(C);if(k){let n=Date.now(),g=k.expires_at.getTime(),o=E.refreshThreshold*1000;if(n+o<g)return k.access_token;if(E.autoRefresh)try{return await u(C,j)}catch(s){if(n<g)return Z.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},s),k.access_token;throw s}}}return u(C,j)}async function Z0(j){if(!j0(B)&&!v0(B))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let E=B;return j=j??E.scope,j0(E)?await S(j):await m(j)}async function X0(j){if(!j0(B)&&!v0(B))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let E=B;try{if(!B.revocationEndpoint)return;let v=new URLSearchParams;if(v.append("token",j),v.append("token_type_hint","access_token"),j0(B)){let k=B;v.append("client_id",k.workloadId)}else if(v0(B)){let k=B;v.append("client_id",k.clientId),v.append("client_secret",k.clientSecret)}let C=await fetch(B.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:v.toString()});if(!C.ok)Z.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:C.status,statusText:C.statusText});else Z.info("Token revoked successfully",{"ion.module":"workload"});if(B.tokenStore){let k;if(j0(B))k=B.workloadId;else if(v0(B))k=B.clientId;else return;await B.tokenStore.delete(k)}}catch(v){Z.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},v)}}async function H0(j,E){let v=j??B?.jwksUri;if(!v)throw Error("No JWKS URI configured in Workload Config");return await $Z(v,Z,E)}async function c(j,E){let v=E??B?.jwksUri;if(!v)throw Error("No JWKS URI configured in Workload Config");let C=j0(B)?B.algorithm:"RS256";return e1(v,j,`wl:${C}`,(k)=>{let n=k.alg||C,g=f(n);return crypto.subtle.importKey("jwk",k,g,!1,["verify"])},Z)}function Y0(j){let E=j.split(".");if(E.length!==3)throw Error("Invalid JWT");return JSON.parse(T(E[1]))}async function z0(j,E){try{let v=j.split(".");if(v.length!==3)throw Error("Invalid JWT");let C=JSON.parse(T(v[0])),k=JSON.parse(T(v[1])),n=await c(C.kid,E),g=v[2],s=new TextEncoder().encode(`${v[0]}.${v[1]}`),F0=Uint8Array.from(T(g),(A$)=>A$.charCodeAt(0)),J0=f(C.alg);if(!await crypto.subtle.verify(J0,n,F0,s))throw Error("Invalid JWT signature");let h0=await K(J.jwtAssertionClaims,k);if(h0.issues)throw Z.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:h0.issues}),Error(`JWT claims validation failed: ${h0.issues.map((A$)=>A$.message).join("; ")}`);return h0.value}catch(v){throw Z.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},v),v}}async function U0(j){if(!j0(B)&&!v0(B)&&!l2(B))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(H.length>0){let C=Y0(j),k=typeof C.iss==="string"?C.iss:void 0,n=P8(H,k);if(!n)return{valid:!1,error:"Untrusted token issuer"};let g=await z0(j,n.jwksUri),o=Math.floor(Date.now()/1000);if(g.exp&&g.exp<o)return{valid:!1,error:"Token expired"};let s=t2(n.audience);if(s.length>0&&!X2(g.aud,s,g.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:g,expiresAt:g.exp?new Date(g.exp*1000):void 0}}let E=await z0(j),v=Math.floor(Date.now()/1000);if(E.exp&&E.exp<v)return{valid:!1,error:"Token expired"};if(j0(B)){if(B.audience&&!X2(E.aud,[B.audience],E.azp))return{valid:!1,error:"Invalid audience"}}else if(v0(B)){if(B.issuer&&O$(E.iss)!==O$(B.issuer))return{valid:!1,error:"Invalid issuer"};if(B.audience&&!X2(E.aud,[B.audience],E.azp))return{valid:!1,error:"Invalid audience"}}else{let C=B;if(C.issuer&&O$(E.iss)!==O$(C.issuer))return{valid:!1,error:"Invalid issuer"};if(C.audience&&!X2(E.aud,[C.audience],E.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:E,expiresAt:E.exp?new Date(E.exp*1000):void 0}}catch(E){return{valid:!1,error:E instanceof Error?E.message:String(E)}}}function K0(j,E){let v=j[E];return typeof v==="string"&&v.trim()?v.trim():void 0}function N(j){if(!j)return;return j.startsWith("service-account-")?j.slice(16):j}function b(j){return K0(j,"client_id")??K0(j,"clientId")??K0(j,"azp")??K0(j,"appid")??N(K0(j,"preferred_username"))}let l=new WeakMap;function r(j){let E=l.get(j);if(E)return E;let v=$0(j);return l.set(j,v),v}async function $0(j){let E=j.headers.get("Authorization");if(!E?.startsWith("Bearer "))return;let v=E.substring(7),C=await U0(v);if(!C.valid||!C.claims)return;let k=H.length>0?P8(H,C.claims.iss):void 0,n=C.claims.ecid,g={workloadId:C.claims.sub,clientId:b(C.claims),scope:C.claims.scope,scopesAsEntitlements:k?.scopesAsEntitlements,...n!==void 0&&n!==null?{ecid:q8(n)}:{},claims:C.claims},o=B?.workloadIdentityStore;if(o){let s=g.clientId??g.workloadId??g.claims.sub,F0=s?await o.get(s):void 0;if(F0){if(F0.active===!1)return;if(F0.scopes?.length){let J0=new Set([...(g.scope??"").split(/\s+/).filter(Boolean),...F0.scopes]);g.scope=Array.from(J0).join(" ")}if(!g.ecid&&F0.ecid)g.ecid=q8(F0.ecid)}}return g}async function G0(j){if(!B)throw Error("ionite Workload Manager not initialized");let E=new URL(j.url).pathname,v=(n)=>{if(!n)return;try{return new URL(n).pathname}catch{return n.startsWith("/")?n:`/${n}`}};if(v(B.validateUrl)===E&&j.method==="POST"){let n=j.headers.get("Authorization");if(!n?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let g=n.substring(7),o=await U0(g);if(!o.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:o.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(v(B.jwksUrl)===E&&j.method==="GET"){let n=await H0();return new Response(JSON.stringify(n),{headers:[["Content-Type","application/json"]]})}return _0()}return{...B,getToken:i,refreshToken:Z0,generateJWTAssertion:O,revokeToken:X0,validateToken:U0,getWorkloadIdentity:r,parseJWT:z0,handler:G0}}function o2($){return $=$??"Workload authentication unavailable",new Response(JSON.stringify({error:$}),{status:503,statusText:$,headers:{"Content-Type":"application/json"}})}var Y2="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",zZ="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function KZ($,Z){I0(Z,Y2);let Q=Z.workload;if(!Q)return;return Q.getWorkloadIdentity($)}async function _Z($,Z,Q){I0(Z,Y2);let X=Z.workload;if(!X)throw o2();let Y=X;if(typeof Y.getServerToken!=="function"||typeof Y.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return Y.getToken($,Q)}async function e2($,Z){I0(Z,zZ);let Q="validateToken"in Z&&typeof Z.validateToken==="function"?Z:Z.workload;if(!Q)return{valid:!1,error:"Workload authentication unavailable"};let X=$.headers.get("Authorization");if(!X?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let Y=X.substring(7);return Q.validateToken(Y)}async function HZ($,Z){I0(Z,Y2);let Q=Z.workload;if(!Q)throw o2();return Q.revokeToken($)}async function BZ($,Z){I0(Z,Y2);let Q=Z.workload;if(!Q)throw o2();return Q.handler($)}function b8($){try{return G2(new URL($,"http://dummy").pathname)}catch{let Z=$.startsWith("/")?$:`/${$}`;return G2(Z)}}function UZ($,Z){let Q=new URL($.url);return new URL(`/${encodeURIComponent(Z)}/`,Q.origin).toString()}function FZ($,Z){let Q=b8(Z),X=G2($);if(X===Q)return null;if(!X.startsWith(`${Q}/`))return null;let Y=X.slice(Q.length+1);if(!Y||Y.includes("/"))return null;return decodeURIComponent(Y)}function J2($){return $==="pending"||$==="processing"||$==="completed"||$==="failed"||$==="action_required"}function MZ($){if(!J2($.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if($.status==="completed"){if(!$.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:$.tenantUrl,status:"completed"},status:201}}if($.status==="pending"||$.status==="processing")return{body:{tenantUrl:$.tenantUrl,status:$.status},status:202};if($.status==="action_required"){if(!$.actionUrl||!$.requestToken||!$.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:$.actionUrl,requestToken:$.requestToken,expiresAt:$.expiresAt},status:200}}return{body:{tenantUrl:$.tenantUrl,status:"failed",error:$.error??"Tenant provisioning failed"},status:409}}function LZ($,Z){let Q=Z.validators.tenant.createTenantRequest,X=Z.validators.tenant.updateTenantRequest;function Y(_,H){let D=(V)=>new URL(V,H).toString();return{readyzUrl:D(_.readyzUrl),capabilitiezUrl:D(_.capabilitiezUrl),sso:{loginUrl:D(_.sso.loginUrl),userUrl:D(_.sso.userUrl),logoutUrl:D(_.sso.logoutUrl),logoutBackChannelUrl:D(_.sso.logoutBackChannelUrl),refreshUrl:D(_.sso.refreshUrl),callbackUrl:D(_.sso.callbackUrl)},workload:{validateUrl:D(_.workload.validateUrl),jwksUrl:D(_.workload.jwksUrl)},iam:{basePath:D(_.iam.basePath),usersUrl:D(_.iam.usersUrl),groupsUrl:D(_.iam.groupsUrl)},ciam:{magicLinkUrl:D(_.ciam.magicLinkUrl),magicLinkLoginUrl:D(_.ciam.magicLinkLoginUrl),customerUrl:D(_.ciam.customerUrl),customerLoginUrl:D(_.ciam.customerLoginUrl),customerCallbackUrl:D(_.ciam.customerCallbackUrl),customerProvidersUrl:D(_.ciam.customerProvidersUrl),logoutUrl:D(_.ciam.logoutUrl)}}}function J(_,H){let D=Z.tenantIonBasePath?.(_);if(!D)return;let V=new URL(H.url).origin,P=Y(f0(D),V);return{callbackUrl:P.sso.callbackUrl,ionUrls:P}}async function K(_){let H=await e2(_,Z.workloadAuth??$);if(!H.valid)return Response.json({error:H.error??"Unauthorized"},{status:401});return Y$(_,$,DZ["tenant.manage"])}async function z(_){let D=new URL(_.url).pathname,V=FZ(D,Z.basePath),P=b8(Z.basePath),L=G2(D)===P;if(!L&&!V)return _0();if(!["GET","PUT","POST","DELETE"].includes(_.method))return F$(["GET","PUT","POST","DELETE"]);if(_.method==="GET"&&L&&V==null)return _0();let B=await K(_);if(B)return B;if(_.method==="GET"){if(V==null)return _0();let q=await Z.store.get(V);if(!q)return _0();let O=J(q,_);return Response.json(O?{...q,...O}:q,{status:200})}if(_.method==="DELETE"){if(!V)return _0();return await Z.store.delete(V),new Response(null,{status:204})}if(!V&&_.method!=="POST")return _0();let R;try{R=await _.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let A=_.method==="POST",W=A?await Q.validate(R):await X.validate(R);if(W.issues)return VZ(W.issues,A?"Tenant create validation failed":"Tenant update validation failed");let F=A?W.value.id:V;if(!F)return _0();if(V!=null&&W.value.id!=null&&W.value.id!==V)return Response.json({error:"Path id must match body id"},{status:400});let M=await Z.store.get(F);if(M&&!J2(M.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let I=new Date,T=M??{},f;if(A){let q=W.value,O=q,S=O.status,m=J2(S)?S:M?.status??"completed";f={...T,...q,id:F,companyId:q.companyId,companyName:q.companyName,environmentType:q.environmentType,configLocator:q.configLocator,email:q.email??M?.email,webhookUrl:q.webhookUrl??M?.webhookUrl,callbackUrl:q.callbackUrl??M?.callbackUrl,tenantUrl:O.tenantUrl??M?.tenantUrl,status:m,error:O.error??M?.error,actionUrl:O.actionUrl??M?.actionUrl,requestToken:O.requestToken??M?.requestToken,expiresAt:O.expiresAt??M?.expiresAt,createdAt:M?.createdAt??I,updatedAt:I}}else{let q=W.value,O=q,S=O.status,m=J2(S)?S:M?.status??"completed",{configLocator:w,...u}=q;f={...T,...u,id:F,companyId:q.companyId??M?.companyId??"",companyName:q.companyName??M?.companyName??"",environmentType:q.environmentType??M?.environmentType??"DEV",email:q.email??M?.email,webhookUrl:q.webhookUrl??M?.webhookUrl,callbackUrl:q.callbackUrl??M?.callbackUrl,tenantUrl:O.tenantUrl??M?.tenantUrl,status:m,error:O.error??M?.error,actionUrl:O.actionUrl??M?.actionUrl,requestToken:O.requestToken??M?.requestToken,expiresAt:O.expiresAt??M?.expiresAt,configLocator:w??M?.configLocator,createdAt:M?.createdAt??I,updatedAt:I}}if(!f.configLocator)return Response.json({error:"validation_failed",message:"Tenant configLocator is required",issues:[{message:"configLocator is required on create or must already exist on the stored tenant"}]},{status:422});if(!f.tenantUrl)f.tenantUrl=UZ(_,F);if(!f.callbackUrl){let q=J(f,_);if(q)f.callbackUrl=q.callbackUrl}let d=await Z.store.upsert(f),h=MZ(d);if(h instanceof Response)return h;return Response.json(h.body,{status:h.status})}async function G(_){try{if(!$.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await z(_)}catch(H){return U$(H)}}return{handler:G,getTenant:async(_)=>{return Z.store.get(_)}}}var $4="0.0.23-beta.20260812.6";export*from"@ionite/core";import{generateULID as B7,IoniteError as D7,listGenerator as V7}from"@ionite/core";import{allowHosts as F7,allowOrigins as M7,allowRelativePaths as L7,allowSameOrigin as W7,blockDangerousUrls as O7,CatalogAdjacencyCache as N7,callback as A7,captureRedirect as j7,ciam as E7,collectReferencedDefinitions as q7,defaultRedirectPolicies as R7,discoverSessionRecords as T7,discoverSessions as P7,expandRoot as I7,getCustomer as x7,getUser as S7,has as w7,hasAll as C7,hasAllScope as k7,hasAny as b7,hasAnyScope as y7,hasGroup as v7,hasPermission as h7,hasRole as f7,hasScope as m7,InMemoryTenantStore as g7,iam as p7,initiateLogin as d7,isRedirectAllowed as u7,listSsoClientIdsFromCookies as l7,reconcileSubjectAccess as c7,resolveAfterRedirect as i7,resolveCapturedRedirect as n7,resolveRedirect as s7,sameOriginRedirectRules as a7,sendTenantWebhook as t7,sso as r7,verifyUser as o7,withDefaultExternalId as e7,withSetCookies as $Y}from"@ionite/core/server";import{accessRefId as r0,accessRootId as y8,list as WZ}from"@ionite/core";function Q4($){let{createdAt:Z,updatedAt:Q,...X}=$;return X}class l0{roots=new Map;byTarget=new Map;bySubject=new Map;static targetKey($,Z){return`${$}:${Z}`}static subjectKey($,Z){return`${$}:${Z}`}indexAdd($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}indexRemove($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}deindex($){this.indexRemove(this.byTarget,l0.targetKey($.targetType,r0($.target)),$.id),this.indexRemove(this.bySubject,l0.subjectKey($.subjectType??"user",r0($.subject)),$.id)}index($){this.indexAdd(this.byTarget,l0.targetKey($.targetType,r0($.target)),$.id),this.indexAdd(this.bySubject,l0.subjectKey($.subjectType??"user",r0($.subject)),$.id)}resolve($,Z){if(!$)return[];let Q=[];for(let X of $){let Y=this.roots.get(X);if(Y&&(Y.status??"active")==="active"&&Z(Y))Q.push(Y)}return Q}async grant($){let Z=$.id??y8($),Q=new Date,X=this.roots.get(Z);if(X)this.deindex(X);let Y={...$,id:Z,status:$.status??"active",createdAt:X?.createdAt??Q,updatedAt:Q};this.roots.set(Z,Y),this.index(Y)}async revoke($){let Z=$.id??y8($),Q=this.roots.get(Z);if(Q)this.deindex(Q);this.roots.delete(Z)}async get($){let Z=this.roots.get($);return Z?Q4(Z):void 0}async list($){let Z=Array.from(this.roots.values()).filter((Q)=>(Q.status??"active")==="active");return Z4(Z,$)}async listByTarget($,Z,Q){let X=Z.trim(),Y=this.byTarget.get(l0.targetKey($,X)),J=this.resolve(Y,(K)=>K.targetType===$&&r0(K.target)===X);return Z4(J,Q)}async listByTargets($){let Z=new Map;for(let{targetType:Q,target:X}of $){let Y=`${Q}:${X}`;if(Z.has(Y))continue;let J=X.trim(),K=this.byTarget.get(l0.targetKey(Q,J)),z=this.resolve(K,(G)=>G.targetType===Q&&r0(G.target)===J);Z.set(Y,z.map((G)=>Q4(G)))}return Z}async listBySubject($,Z="user",Q){let X=r0($),Y=this.bySubject.get(l0.subjectKey(Z,X)),J=this.resolve(Y,(K)=>(K.subjectType??"user")===Z&&r0(K.subject)===X);return Z4(J,Q)}}function Z4($,Z){let Q=Math.max(0,Z?.start??0),X=Z?.limit,Y=X!=null?Q+X:void 0;return WZ($.length,$.slice(Q,Y).map(Q4),Q,X)}import{assertValidSubjectTypeScoping as OZ,list as v8,readyCatalogEntry as NZ}from"@ionite/core";class h8{listeners=new Set;emit=($)=>{for(let Z of this.listeners)Z($)};groups=new z2("group",this.emit);roles=new z2("role",this.emit);permissions=new z2("permission",this.emit);afterChange($){return this.listeners.add($),()=>{this.listeners.delete($)}}}class f8{items=new Map;listeners=new Set;constructor($){if($?.deriveEntitlements){let{deriveEntitlements:Z,resolveEntitlement:Q}=$;if(!Q)throw Error("InMemoryResourceStore: resolveEntitlement must be provided with deriveEntitlements.");this.entitlements=(X)=>Z(X),this.entitlement=async(X)=>Q(X,(Y)=>this.items.get(Y))}}entitlements;entitlement;async get($){return this.items.get($)}async list($){let Z=Array.from(this.items.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=X!=null?Q+X:void 0;return v8(Z.length,Z.slice(Q,Y),Q,X)}async children($){return Array.from(this.items.values()).filter((Z)=>{return(typeof Z.parent==="string"?Z.parent:Z.parent?.id)===$})}changed($){return this.listeners.add($),()=>{this.listeners.delete($)}}set($){this.items.set($.id,$),this.emitChange({id:$.id})}delete($){if(!this.items.delete($))return;this.emitChange({id:$,deleted:!0})}emitChange($){for(let Z of this.listeners)Z($)}}class z2{kind;emit;items=new Map;byExternalId=new Map;constructor($,Z){this.kind=$;this.emit=Z}async get($){return this.items.get($)}async getByExternalId($){let Z=this.byExternalId.get($);return Z===void 0?void 0:this.items.get(Z)}set($){OZ($);let Z=this.items.get($.id);if(Z?.externalId&&Z.externalId!==$.externalId){if(this.byExternalId.get(Z.externalId)===$.id)this.byExternalId.delete(Z.externalId)}if(this.items.set($.id,$),$.externalId)this.byExternalId.set($.externalId,$.id);return this.emit({op:"set",kind:this.kind,entity:$}),NZ($,Promise.resolve())}async delete($){let Z=this.items.get($);if(Z?.externalId&&this.byExternalId.get(Z.externalId)===$)this.byExternalId.delete(Z.externalId);this.items.delete($),this.emit({op:"delete",kind:this.kind,id:$})}async list($){let Z=Array.from(this.items.values()),Q=$?.filter?.requestable;if(Q!==void 0)Z=Z.filter((K)=>Boolean(K.requestable)===Q);let X=Math.max(0,$?.start??0),Y=$?.limit,J=Y!=null?X+Y:void 0;return v8(Z.length,Z.slice(X,J),X,Y)}}import{accessRefId as c0}from"@ionite/core";function i0($,Z){return`${Z}:${$}`}function X4($,Z,Q){return`${$}:${Z}:${Q}`}function AZ($,Z,Q,X){return`${X4($,Z,Q)}:${X??""}`}class m8{rows=new Map;byTriple=new Map;byRoot=new Map;bySubject=new Map;edgeMeta=new Map;disabledSubjects=new Set;async has($,Z,Q,X,Y="user"){let J=c0($),K=c0(Q);if(!J||!K)return{allow:!1};if(this.disabledSubjects.has(i0(J,Y)))return{allow:!1,metadata:{reason:"subject_disabled"}};let z=X4(i0(J,Y),Z,K),G=X?c0(X):void 0;if(G===void 0){let D=this.byTriple.get(z);if(D&&D.size>0)return this.allow(J,Z,K,void 0);return{allow:!1}}let _=`${z}:${G}`,H=`${z}:`;if(this.rows.has(_))return this.allow(J,Z,K,G);if(this.rows.has(H))return this.allow(J,Z,K,void 0);return{allow:!1}}async hasGroup($,Z,Q,X="user"){return this.has($,"group",Z,Q,X)}async hasRole($,Z,Q,X="user"){return this.has($,"role",Z,Q,X)}async hasPermission($,Z,Q,X="user"){return this.has($,"permission",Z,Q,X)}async hasAny($,Z,Q="user"){for(let X of Z){let Y=await this.has($,X.targetType,X.target,X.resource,Q);if(Y.allow)return Y}return{allow:!1}}async hasAll($,Z,Q="user"){if(this.disabledSubjects.has(i0(c0($),Q)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(Z.length===0)return{allow:!0};let X=[];for(let Y of Z){let J=await this.has($,Y.targetType,Y.target,Y.resource,Q);if(!J.allow)return{allow:!1,matched:X};if(J.matched)X.push(...J.matched)}return{allow:!0,matched:X}}async materialize($,Z){this.removeRoot($),this.addRootEdges($,Z)}async replaceSubject($,Z,Q){let X=i0(c0($),Z),Y=new Map;for(let J of Q){let K=i0(c0(J.subject),J.subjectType??"user");if(K!==X)throw Error(`AccessIndex.replaceSubject received an edge for ${K}; expected ${X}.`);let z=Y.get(J.rootId);if(z)z.push(J);else Y.set(J.rootId,[J])}this.clearSubjectEdges(X);for(let[J,K]of Y)this.addRootEdges(J,K)}addRootEdges($,Z){let Q=new Set;for(let X of Z){let Y=i0(X.subject,X.subjectType??"user"),J=X4(Y,X.targetType,X.target),K=AZ(Y,X.targetType,X.target,X.resource);this.addToSet(this.rows,K,$),this.addToSet(this.byTriple,J,K),this.addToSet(this.bySubject,Y,K),this.edgeMeta.set(K,{triple:J,subjectId:Y}),Q.add(K)}if(Q.size>0)this.byRoot.set($,Q)}async removeByRoot($){this.removeRoot($)}removeRoot($){let Z=this.byRoot.get($);if(!Z)return;for(let Q of Z){let X=this.rows.get(Q);if(!X)continue;if(X.delete($),X.size===0)this.dropEdge(Q)}this.byRoot.delete($)}async listSubjects(){let $=[];for(let[Z,Q]of this.bySubject){if(Q.size===0)continue;let X=Z.indexOf(":");if(X<=0){$.push({subject:Z});continue}$.push({subjectType:Z.slice(0,X),subject:Z.slice(X+1)})}return $}async setSubjectDisabled($,Z,Q){let X=i0(c0($),Z);if(Q)this.disabledSubjects.add(X);else this.disabledSubjects.delete(X)}async isSubjectDisabled($,Z="user"){return this.disabledSubjects.has(i0(c0($),Z))}async clear($,Z="user"){if($===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}let Q=c0($);this.clearSubjectEdges(i0(Q,Z))}clearSubjectEdges($){let Z=this.bySubject.get($);if(!Z)return;for(let Q of[...Z]){let X=this.rows.get(Q);if(X)for(let Y of X){let J=this.byRoot.get(Y);if(J?.delete(Q)&&J.size===0)this.byRoot.delete(Y)}this.dropEdge(Q)}}allow($,Z,Q,X){return{allow:!0,matched:[{subject:$,targetType:Z,target:Q,resources:X?[X]:void 0}]}}addToSet($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}dropEdge($){this.rows.delete($);let Z=this.edgeMeta.get($);if(Z)this.removeFromSet(this.byTriple,Z.triple,$),this.removeFromSet(this.bySubject,Z.subjectId,$);this.edgeMeta.delete($)}removeFromSet($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}}function Y4($){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function jZ($,Z){return{...$,subscribe:async(Q,X,Y)=>{try{return await $.subscribe(Q,X,Y)}catch(J){if(!(J instanceof P0))throw J;return await d0($,Q,X,Z,void 0,Y)}}}}function K2($){let Z=X$($.path,"path","azureConfig");G$($.ttl);let Q=$.vault??Z2({type:"azure",authMethod:$.authMethod,entraTenantId:$.entraTenantId,clientId:$.clientId,clientSecret:$.clientSecret,federatedTokenFile:$.federatedTokenFile,managedIdentityClientId:$.managedIdentityClientId,imdsApiVersion:$.imdsApiVersion,vaultUrl:$.vaultUrl,vaultName:$.vaultName,apiVersion:$.apiVersion,secretNameTransform:$.secretNameTransform,secretNamePrefix:$.secretNamePrefix,scope:$.scope,ttl:$.ttl}),X=$.ttl?jZ(Q,$.ttl):Q;return{load:async()=>{try{return(await X.getFullSecret(Z)).data}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`Error retrieving remote config from Azure Key Vault: ${J}`,{cause:Y})}},subscribe:(Y,J)=>{return X.subscribe(Z,(K)=>{Y(K.data)},J)},secret:X}}import{IoniteError as G4}from"@ionite/core";function J4($){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}class z$ extends Error{path;constructor($,Z=`Waiting for vault config secret at ${$}`){super(Z);this.path=$;this.name="VaultConfigWaitingForSecretError"}code="not_found";sourceType="vault";status=404}function EZ($){return $ instanceof z$}class S$ extends Error{path;constructor($,Z){super(Z);this.path=$;this.name="VaultConfigInvalidPayloadError"}code="invalid_payload";sourceType="vault"}function qZ($){return $ instanceof S$}var d8=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function g8($){return d8.some((Z)=>(Z in $))}function p8($,Z){if(!$||typeof $!=="object"||Array.isArray($))throw new z$(Z,`Vault config secret at ${Z} is missing or not an object`);let Q=$;if(!g8(Q)&&Object.keys(Q).length===1&&"data"in Q){let X=Q.data;if(X&&typeof X==="object"&&!Array.isArray(X))Q=X}if(Object.keys(Q).length===0)throw new z$(Z,`Vault config secret at ${Z} is empty`);if(!g8(Q))throw new S$(Z,`Vault config secret at ${Z} is an invalid payload: not a RemoteConfig (no known keys: ${d8.join("/")})`);return Q}function RZ($,Z,Q){return{...$,subscribe:async(X,Y,J)=>{try{return await $.subscribe(X,Y,J)}catch(K){if(!(K instanceof P0))throw K;return await d0($,X,Y,Z,Q(),J)}}}}function _2($){let Z=X$($.path,"path","vaultConfig");G$($.ttl);let Q=$.vault??W$({type:"vault",url:$.url,token:$.token,workload:$.workload,lfv:$.lfv,websocket:$.websocket,ttl:$.ttl,log:$.log}),X=$.vault&&$.ttl?RZ(Q,$.ttl,()=>$.log):Q,Y={get log(){return $.log},set log(J){if($.log=J,X&&"log"in X)X.log=J},load:async()=>{try{let J=await X.getFullSecret(Z);return p8(J.data,Z)}catch(J){if(J instanceof p0)throw new z$(Z);if(J instanceof z$||J instanceof S$)throw J;throw Error("Error retrieving remote config from vault",{cause:J})}},subscribe:(J,K)=>{return X.subscribe(Z,(z)=>{let G;try{G=p8(z.data,Z)}catch(_){$.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:Z,error:_ instanceof Error?_.message:String(_)});return}J(G)},K)},secret:X};if($.lfv?.lfvServerUrl&&$.lfv.clientId&&$.lfv.deliveryEndpoint&&$.lfv.eventsEndpoint)Y[i$]={path:$.lfv.path??Z,lfvServerUrl:$.lfv.lfvServerUrl,clientId:$.lfv.clientId,deliveryTimeout:$.lfv.deliveryTimeout,retryInterval:$.lfv.retryInterval,warnInterval:$.lfv.warnInterval,deliveryEndpoint:$.lfv.deliveryEndpoint,eventsEndpoint:$.lfv.eventsEndpoint,verifyJwks:$.lfv.verifyJwks};return Y}function H2($){if($==null)return;if(typeof $==="number")return Number.isFinite($)?$:void 0;let Z=$.trim();if(!Z)return;let Q=Number.parseInt(Z,10);return Number.isFinite(Q)?Q:void 0}function TZ($,Z){let Q=$.vaultLfvServerUrl??Z?.lfvServerUrl,X=$.vaultLfvClientId??Z?.clientId,Y=$.vaultLfvDeliveryEndpoint??Z?.deliveryEndpoint,J=$.vaultLfvEventsEndpoint??Z?.eventsEndpoint;if(!Q||!X||!Y||!J)return Z;return{...Z,lfvServerUrl:Q,clientId:X,deliveryEndpoint:Y,verifyJwks:$.vaultLfvVerifyJwks??Z?.verifyJwks,eventsEndpoint:J,path:$.vaultLfvPath??Z?.path,deliveryTimeout:H2($.vaultLfvDeliveryTimeout)??Z?.deliveryTimeout,retryInterval:H2($.vaultLfvRetryInterval)??Z?.retryInterval,warnInterval:H2($.vaultLfvWarnInterval)??Z?.warnInterval}}function PZ($,Z){let Q=$.vaultWebsocketUrl??Z?.url;if(!Q)return Z;return{...Z,url:Q,token:$.vaultWebsocketToken??Z?.token,clientId:$.vaultWebsocketClientId??Z?.clientId,header:$.vaultWebsocketHeader??Z?.header}}function IZ($,Z){let Q=$.vaultWorkloadTokenUrl??Z?.idpTokenUrl,X=$.vaultWorkloadClientId??Z?.clientId,Y=$.vaultWorkloadClientSecret??Z?.clientSecret;if(!Q||!X||!Y)return Z;return{...Z,idpTokenUrl:Q,clientId:X,clientSecret:Y,scope:$.vaultWorkloadScope??Z?.scope}}function u8($,Z){return{...Z,url:$.vaultUrl??Z?.url,token:$.vaultToken??Z?.token,path:$.vaultPath??Z?.path,ttl:H2($.vaultTtl)??Z?.ttl,workload:IZ($,Z?.workload),lfv:TZ($,Z?.lfv),websocket:PZ($,Z?.websocket)}}function K$($){switch($.type){case"vault":return xZ($);case"azure":return SZ($);case"aws":return wZ($);case"gcp":return CZ($);default:throw Error(`Unsupported config locator type: ${$.type}`)}}function xZ($){return _2(u8($))}function SZ($){return K2({authMethod:$.azureAuthMethod,entraTenantId:$.azureEntraTenantId,clientId:$.azureClientId,clientSecret:$.azureClientSecret,federatedTokenFile:$.azureFederatedTokenFile,managedIdentityClientId:$.azureManagedIdentityClientId,imdsApiVersion:$.azureImdsApiVersion,vaultUrl:$.azureVaultUrl,vaultName:$.azureVaultName,apiVersion:$.azureApiVersion,scope:$.azureScope,secretNamePrefix:$.azureSecretNamePrefix,path:$.azurePath,ttl:$.azureTtl})}function wZ($){return Y4({webhookUrl:$.awsWebhookUrl,ttl:$.awsTtl})}function CZ($){return J4({ttl:$.gcpTtl})}function l8($,Z){let Q=kZ($,Z);switch(Q.type){case"vault":return _2({vault:Q,path:$.path,ttl:$.ttl});case"azure":return K2({vault:Q,path:$.path,ttl:$.ttl});default:throw new G4(`Tenant config is not supported for secrets source type "${Q.type}" (path "${$.path}"). Only "vault" and "azure" sources can currently back a tenant configLocator.`,{status:500,statusText:"Unsupported tenant config source"})}}function kZ($,Z){if(!$.source)return Z.secret;if(!Z.secrets)throw new G4(`Tenant configLocator references secrets source "${$.source}" but the root Ionite has no secrets module configured. Declare it on the root Ionite (RemoteConfig.secrets) before referencing it.`,{status:500,statusText:"Secrets module not configured"});try{return Z.secrets.getSecretsSource($.source)}catch(Q){let X=Z.secrets.listSecretsSources().join(", ")||"(none)";throw new G4(`Tenant configLocator references unknown secrets source "${$.source}" (path "${$.path}"). Declared sources: ${X}.`,{status:500,statusText:"Unknown secrets source",cause:Q})}}function _$($){if(!$)return;let Z=Number.parseInt($,10);return Number.isFinite(Z)?Z:void 0}function c8($,Z){let Q=Z?.type??$.ION_CONFIG_TYPE;if(!Q)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp.");if(Q==="vault")return{type:"vault",vaultUrl:$.ION_VAULT_URL,vaultToken:$.ION_VAULT_TOKEN,vaultPath:$.ION_VAULT_PATH??"",vaultTtl:_$($.ION_VAULT_TTL),vaultWorkloadTokenUrl:$.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:$.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:$.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:$.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:$.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:$.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:$.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:$.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:$.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvDeliveryTimeout:_$($.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:_$($.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:_$($.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:$.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:$.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:$.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:$.ION_VAULT_WEBSOCKET_HEADER};if(Q==="azure")return{type:"azure",azurePath:$.ION_AZURE_PATH,azureApiVersion:$.ION_AZURE_API_VERSION,azureScope:$.ION_AZURE_SCOPE,azureSecretNamePrefix:$.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:$.ION_AZURE_AUTH_METHOD,azureEntraTenantId:$.ION_AZURE_TENANT_ID,azureClientId:$.ION_AZURE_CLIENT_ID,azureClientSecret:$.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:$.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:$.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:$.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:$.ION_AZURE_VAULT_URL,azureVaultName:$.ION_AZURE_VAULT_NAME,azureTtl:_$($.ION_AZURE_TTL)};if(Q==="aws")return{type:"aws",awsWebhookUrl:$.ION_AWS_WEBHOOK_URL??"",awsTtl:_$($.ION_AWS_TTL)};if(Q==="gcp")return{type:"gcp",gcpTtl:_$($.ION_GCP_TTL)};throw Error(`ION_CONFIG_TYPE="${Q}" is not valid for envConfig(); supported types are vault, azure, aws, gcp.`)}function i8($,Z){return K$(c8($,Z))}function bZ($){return i8(process.env,$)}var yZ=1000,vZ=30000,n8=["vault","azure","aws","gcp"];function s8($,Z){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`Config locator at ${Z} is an invalid payload: expected an object with a "type" field`);let Q=$.type;if(typeof Q!=="string"||!n8.includes(Q))throw Error(`Config locator at ${Z} is an invalid payload: unknown type "${String(Q)}" (expected ${n8.join("/")})`)}function a8($,Z){return $.log??=Z.log,$.validators??=Z.validators,$}function w$($){if(!$?.secret?.close)return;try{Promise.resolve($.secret.close()).catch((Z)=>{$.log?.warn?.("secretConfigSource: inner source close failed",Z)})}catch(Z){$.log?.warn?.("secretConfigSource: inner source close failed",Z)}}function hZ($,Z){let Q=X$(Z,"path","secretConfigSource"),X,Y=(K)=>{s8(K,Q);let z=JSON.stringify(K);if(X&&X.hash===z)return X.inner;let G=X?.inner,_=a8(K$(K),J);if(X={hash:z,inner:_},G&&G!==_)w$(G);return _},J={async load(){let K=await $.getSecret(Q);return Y(K).load()},async subscribe(K,z){let G,_=!1,H=!1,D,V,P=new Promise((I,T)=>{D=I,V=T}),L=t$(),B,R,A=(I)=>new Promise((T)=>{R=T,B=setTimeout(T,I)}),W=async(I,T)=>{s8(I,Q);let f=JSON.stringify(I),d=X!==void 0&&X.hash===f;if(d&&G)return;let h=X?.inner,q=G,O=d&&X?X.inner:a8(K$(I),J),S=!d,m=()=>{if(S&&O!==h)w$(O)};try{if(O.subscribe){let u=await O.subscribe(K,z)??void 0;if(_||!L.isCurrent(T)){u?.(),m();return}if(G=u,X={hash:f,inner:O},q&&q!==u)q();if(S&&h&&h!==O)w$(h);return}let w=await O.load();if(_||!L.isCurrent(T)){m();return}if(X={hash:f,inner:O},q)q(),G=void 0;if(S&&h&&h!==O)w$(h);K(w)}catch(w){throw m(),w}},F=async(I)=>{let T=L.next(),f=yZ;for(;;){if(_||!L.isCurrent(T))return;try{await W(I,T);return}catch(d){if(_||!L.isCurrent(T))return;J.log?.warn(`secretConfigSource rebind for ${Q} failed; keeping last-known-good source and retrying in ${f}ms`,d),await A(f),f=Math.min(vZ,f*2)}}},M=await $.subscribe(Q,(I)=>{if(_)return;if(!H){W(I.data,L.next()).then(()=>{H=!0,D()}).catch((T)=>{H=!0,V(T)});return}F(I.data)},z);return await P,()=>{if(_=!0,L.next(),B)clearTimeout(B);R?.(),G?.(),M(),w$(X?.inner),X=void 0}},secret:$};return J}import{defaultLogger as fZ,stableConfigHash as mZ}from"@ionite/core";function t8($){return`${$}.__ionite_mirror`}function gZ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function pZ($){if($.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let Z=Array.from(new Set($.paths.map((A)=>A.trim()).filter(Boolean)));if(Z.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let Q=$.logger??fZ,X=$.sourceId?.trim()||$.from.type,Y=[],J=Promise.resolve(),K=!1,z=!1,G=!1,_=W0("Secrets mirror",()=>K&&!G),H=(A)=>{let W=$.mapPath(A).trim();if(!W)throw Error(`mirrorSecrets mapPath returned an empty target for "${A}"`);return W},D=(A)=>{let W=J.then(A);return J=W.catch((F)=>{z=!0,Q.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:F instanceof Error?F.message:String(F)})}),W},V=async(A)=>{if(await $.to.exists(A))await $.to.deleteSecret(A)},P=async(A,W)=>{if(G)return;if(!gZ(W.data))throw Error(`mirrorSecrets can only re-store object values (source path "${A}")`);let F=H(A),M=t8(F),I={sourceId:X,sourcePath:A,sourceVersion:W.metadata.version,contentHash:mZ(W.data)};if(await $.to.exists(M)){let T=await $.to.getSecret(M);if(T.sourceId===I.sourceId&&T.sourcePath===I.sourcePath&&T.sourceVersion===I.sourceVersion&&T.contentHash===I.contentHash&&await $.to.exists(F)){z=!1;return}}await $.to.putSecret(F,W.data),await $.to.putSecret(M,I),z=!1},L=async(A)=>{let W=H(A);await V(W),await V(t8(W)),z=!1},B=(A)=>{if(A.event!=="path_removed")return Z.includes(A.path)?[A.path]:[];let W=`${A.path.replace(/\/+$/g,"")}/`;return Z.filter((F)=>F===A.path||F.startsWith(W))},R=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if($.from.subscribeEvents)Y.push($.from.subscribeEvents((A)=>{if(R.has(A.event)){let W=B(A);if(W.length>0)D(async()=>{for(let F of W)await L(F)})}try{$.onEvent?.(A)}catch(W){Q.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:A.path,event:A.event,error:W instanceof Error?W.message:String(W)})}}));return(async()=>{try{for(let A of Z){let W=await $.from.subscribe(A,(F)=>{D(()=>P(A,F))},$.subscription);Y.push(W)}if(await J,G)return;K=!0,_.refresh()}catch(A){z=!0,Q.warn("Secrets mirror initialization failed",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:A instanceof Error?A.message:String(A)})}})(),{isReady:_.isReady,ready:_.ready,isAvailable:()=>K&&!G&&!z&&($.from.isAvailable?.()??!0)&&($.to.isAvailable?.()??!0),async purge(){if(G)throw Error("Secrets mirror is closed");await D(async()=>{for(let A of Z)await L(A)})},async close(){if(G)return;G=!0;for(let A of Y.splice(0))A();_.refresh(),_.settle(),await J}}}var r8;function dZ($){r8=$}function uZ($,Z){return r8?.({locator:$}),l8($,Z)}import{buildTenantPath as lZ,DEFAULT_TENANT_API_NAMESPACE as e8,DEFAULT_TENANT_UI_NAMESPACE as $9,matchTenantPath as Z9,normalizeTenantPathNamespace as o8,normalizeTenantRoutingStrategy as cZ}from"@ionite/core";function iZ(){return Response.json({error:"Tenant not found"},{status:404})}function nZ($){return Response.json({error:`Tenant runtime not found for ${$}`},{status:404})}function sZ($,Z){let Q=cZ($);if(Z==="api")return o8(Q.api??e8);return o8(Q.ui??$9)}function aZ($){if($.store)return async(Z)=>$.store.getIon(Z);return async(Z)=>await $.getIon(Z)??void 0}async function Q9($,Z={}){if(Z.custom){let J=await Z.custom($);if(J)return{id:J}}let Q=Z.namespace??"api",X=sZ(Z.strategy,Q),Y=Z9(new URL($.url).pathname,X);if(!Y)return null;return{id:Y.id,context:{namespace:Q,restPath:Y.restPath,restSegments:Y.restSegments}}}function X9($,Z){let Q=new URL($.url);return Q.pathname=Z,new Request(Q,$)}function z4($,Z,Q,X){let Y=Z9(new URL($.url).pathname,Q);if(!Y||Y.id!==Z)return $;return X9($,lZ(Z,Y.restPath,X))}function tZ($,Z,Q={beforeTenantSegments:["api"],afterTenantSegments:[]}){return z4($,Z,e8,Q)}function rZ($,Z,Q={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return z4($,Z,$9,Q)}function oZ($){return async function(Q){try{let X=$.resolveTenant?await $.resolveTenant(Q):await Q9(Q),Y=typeof X==="string"?{id:X,context:void 0}:X??null;if(!Y?.id)return $.onMissingTenant?await $.onMissingTenant(Q):iZ();let J=await $.getIon(Y.id,Q)??null;if(!J)return $.onMissingIonite?await $.onMissingIonite(Q,Y.id):nZ(Y.id);let K=$.rewriteRequest?await $.rewriteRequest(Q,{id:Y.id,ion:J,context:Y.context}):Q;return J.handler(K)}catch(X){return U$(X)}}}import{list as eZ}from"@ionite/core";class Y9{identities=new Map;clientIdIndex=new Map;async get($){return this.identities.get($)}async lookup($){if($.id){let Z=this.identities.get($.id);if(Z)return Z}if($.clientId){let Z=this.clientIdIndex.get($.clientId);if(Z)return this.identities.get(Z)}if($.externalId){for(let Z of this.identities.values())if(Z.externalId===$.externalId)return Z}return}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q=new Date,X=this.identities.get(Z),Y={...$,id:Z,createdAt:X?.createdAt??$.createdAt??Q,updatedAt:Q};if(X?.clientId&&X.clientId!==Y.clientId)this.clientIdIndex.delete(X.clientId);if(this.identities.set(Z,Y),Y.clientId)this.clientIdIndex.set(Y.clientId,Z);return Y}async delete($){let Z=this.identities.get($);if(Z?.clientId)this.clientIdIndex.delete(Z.clientId);return this.identities.delete($),Z?1:0}async list($){let Z=Array.from(this.identities.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,K=Z.slice(Q,J);return eZ(Y,K,Q,X)}}function K3($){let Z=$,Q=Z.basePath??h$(),X=v$(Z.stores),Y=Z.routing,J=Z.beforeChange,K=Z.afterChange,z=Z.configRetry,G=Z.onConfigLoadError;return{frameworkConfig:{log:$.log,validators:$.validators,sso:$.sso,iam:$.iam,workload:$.workload,secrets:$.secrets,lfv:$.lfv,ciam:$.ciam,authz:$.authz,otel:$.otel},basePath:Q,stores:X,options:{beforeChange:J,afterChange:K,routing:Y,configRetry:z,onConfigLoadError:G}}}function _3($){let Z=$,Q={trace:(X,...Y)=>Z.trace(X,...Y),debug:(X,...Y)=>Z.debug(X,...Y),info:(X,...Y)=>Z.info(X,...Y),warn:(X,...Y)=>Z.warn(X,...Y),error:(X,...Y)=>Z.error(X,...Y)};return{logger:Q,update(X){return Z=X,Q}}}function F9($,Z){let Q=$;return Q.setStores=(X)=>{Z.current=v$(X),Object.assign(Q,j$(Q,Z.current))},Q}function G9($){let Z=$?.replace(/\s+/g," ").trim();return Z?Z:void 0}function M9($){if(typeof $!=="object"||$===null)return;return $.cause}function H3($){if(!($ instanceof Error))return typeof $==="string"?G9($):void 0;let Z=G9($.message),Q=[],X=$;if(typeof X.code==="string")Q.push(`code=${X.code}`);if(typeof X.status==="number")Q.push(`status=${X.status}`);if(typeof X.path==="string")Q.push(`path=${X.path}`);if(Q.length===0)return Z;if(!Z)return Q.join(", ");return`${Z} [${Q.join(", ")}]`}function B4($,Z=3){let Q=[],X=$,Y=0;while(X!=null&&Y<Z){let J=H3(X);if(J&&!Q.includes(J))Q.push(J);X=M9(X),Y+=1}return Q.length>0?Q.join(" <- "):void 0}function B3($,Z){if(typeof $!=="object"||$===null)return;return $[Z]}function x0($,Z){let Q=$,X=0;while(Q!=null&&X<3){let Y=B3(Q,Z);if(Y!==void 0)return Y;Q=M9(Q),X+=1}return}var D3=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function V3($){return typeof $==="string"&&D3.has($)}function U3($){let Z=x0($,"kind");if(V3(Z))return Z;let Q=x0($,"status"),X=x0($,"code"),Y=B4($)?.toLowerCase()??"";if(Q===401||Q===403||Y.includes("auth error")||Y.includes("permission denied"))return"auth";if(X==="not_found"||Y.includes("waiting for vault"))return"not_found";if(X==="ECONNREFUSED"||X==="ECONNRESET"||X==="ENOTFOUND"||X==="ETIMEDOUT"||Y.includes("connection")||Y.includes("fetch failed")||Y.includes("network"))return"connection";if(Y.includes("timed out"))return"timeout";if(Y.includes("invalid status")||typeof Q==="number"&&Q>=400)return"invalid_status";if(Y.includes("invalid payload")||Y.includes("invalid json")||Y.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function F3($){return"validation"}var M3=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function L3($,Z){let Q=x0($,"recoverable");if(typeof Q==="boolean")return Q;if(Z==="not_found")return!0;if(Z==="auth"||Z==="invalid_payload")return!1;let X=x0($,"status");if(typeof X==="number"&&X>=400&&X<500)return!1;let Y=x0($,"code");if(typeof Y==="string"&&(M3.has(Y)||Y.startsWith("UND_ERR_")))return!0;return!0}function W3($){return{initialDelayMs:Math.max(1,$?.initialDelayMs??2000),maxDelayMs:Math.max(1,$?.maxDelayMs??600000),multiplier:Math.max(1,$?.multiplier??2),jitterRatio:Math.max(0,$?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,$?.loadTimeoutMs??30000)}}function O3($,Z){let Q=Math.max(0,$-1),X=Math.min(Z.maxDelayMs,Z.initialDelayMs*Z.multiplier**Q);if(Z.jitterRatio===0)return Math.round(X);let Y=X*Z.jitterRatio,J=(Math.random()*2-1)*Y;return Math.max(1,Math.round(Math.min(Z.maxDelayMs,X+J)))}function N3($){return(Z)=>{let Q=Z.path?` at ${Z.path}`:"",X=Z.sourceType?` (${Z.sourceType})`:"";$.warn(`Config source${X} unavailable${Q}; ionite will retry automatically in ${Z.nextDelayMs}ms (attempt ${Z.attempt}, ${Z.errorKind}: ${Z.message}).`)}}async function A3($,Z){for(let Q of Z)await Q($)}function S0($){if(!$)return;try{return new URL($,"http://dummy").pathname}catch{return $.startsWith("/")?$:`/${$}`}}function j3($,Z){let Q=Z.id;if(typeof Q!=="string"||Q.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if($!==void 0&&$!==Q)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${$}", received "${Q}").`)}function E3($){let Z=$.kms;if(Z)for(let[X,Y]of Object.entries(Z)){if(X.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!Y||typeof Y!=="object"||Array.isArray(Y))throw Error(`RemoteConfig.kms.${X} must be an object.`);if(Y.kind!==void 0&&Y.kind!=="token"&&Y.kind!=="allocation")throw Error(`RemoteConfig.kms.${X}.kind must be "token" or "allocation" when present.`);if(Y.source!==void 0&&(typeof Y.source!=="string"||Y.source.length===0))throw Error(`RemoteConfig.kms.${X}.source must be a non-empty string when present.`);if(Y.path!==void 0&&(typeof Y.path!=="string"||Y.path.length===0))throw Error(`RemoteConfig.kms.${X}.path must be a non-empty string when present.`)}let Q=$.otel;if(!Q)return;if(Q.apiKey!==void 0&&Q.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(Q.apiKeyPool!==void 0){if(typeof Q.apiKeyPool!=="string"||Q.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!Z?.[Q.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${Q.apiKeyPool}".`)}}function q3($){let Z=$.authz?.trustedProvisioningClients;if(!Z)return;Z.forEach((Q,X)=>{let Y=`authz.trustedProvisioningClients[${X}]`;if(typeof Q.issuer!=="string"||Q.issuer.length===0)throw Error(`${Y}: "issuer" is required and must be a non-empty string.`);if(typeof Q.clientId!=="string"||Q.clientId.length===0)throw Error(`${Y}: "clientId" is required and must be a non-empty string.`);let J=Array.isArray(Q.audience)?Q.audience:[Q.audience];if(J.length===0||J.some((K)=>typeof K!=="string"||K.length===0))throw Error(`${Y}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(Q.permissions)||Q.permissions.some((K)=>typeof K!=="string"||K.length===0))throw Error(`${Y}: "permissions" must be an array of non-empty permission ids.`)})}function R3($){let Z=Array.isArray($)?$:[$];return Z.length>0&&Z.every((Q)=>typeof Q==="string"&&Q.length>0)}function T3($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return;let Q=Z,X=(Y,J)=>{if(!R3(Y.audience))throw Error(`${J}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in Q||"outgoing"in Q){let Y=Q.incoming;if(Array.isArray(Y))Y.forEach((J,K)=>{if(J&&typeof J==="object")X(J,`workload.incoming[${K}]`)});else if(Y&&typeof Y==="object"&&"jwksUri"in Y)X(Y,"workload.incoming");return}if(L9(Q)){if("jwksUri"in Q&&!("clientId"in Q)&&!("workloadId"in Q))X(Q,"workload (server-only)");return}}function P3($,Z,Q){if($?.sso?.redirectUri&&Z.sso?.redirectUri){let X=S0($.sso.redirectUri),Y=S0(Z.sso.redirectUri);if(X!==Y)Q.error(`SSO redirectUri path mismatch: the framework derives "${Y}" from basePath, but ConfigSource reports "${X}". Register "${Y}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function D4($){let Z={};if(!$)return Z;for(let[Q,X]of Object.entries($))if(X.type==="vault"&&typeof X.lfv?.deliveryEndpoint==="string"&&typeof X.lfv?.eventsEndpoint==="string")Z[Q]=X.lfv;return Z}function I3($){return $[i$]}function x3($,Z){let Q=D4($.secrets??void 0),X=S0(Z.deliveryEndpoint),Y=S0(Z.eventsEndpoint),J=S0(Z.path);for(let K of Object.values(Q)){if(S0(K.deliveryEndpoint)!==X)continue;if(S0(K.eventsEndpoint)!==Y)continue;let z=K.path?S0(K.path):void 0;if(J&&z&&J!==z)continue;return!0}return!1}function S3($,Z){let Q=I3(Z);if(!Q)return $;if(x3($,Q))return $;let X={type:"vault",lfv:{path:Q.path,lfvServerUrl:Q.lfvServerUrl,clientId:Q.clientId,deliveryTimeout:Q.deliveryTimeout,retryInterval:Q.retryInterval,warnInterval:Q.warnInterval,deliveryEndpoint:Q.deliveryEndpoint,eventsEndpoint:Q.eventsEndpoint,verifyJwks:Q.verifyJwks}},Y=$.secrets??{},J=b4(Y,{clientId:Q.clientId,path:Q.path});return{...$,secrets:{...Y,[J]:X}}}function w3($,Z){let Q=D4($.secrets),X=D4(Z.secrets??void 0);for(let[Y,J]of Object.entries(X)){let K=Q[Y];if(!K)continue;let z=S0(K.deliveryEndpoint),G=S0(J.deliveryEndpoint);if(z&&G&&z!==G)throw Error(`LFV deliveryEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${z}, framework path: ${G}`);let _=S0(K.eventsEndpoint),H=S0(J.eventsEndpoint);if(_&&H&&_!==H)throw Error(`LFV eventsEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${_}, framework path: ${H}`)}}function C3($){return new Set(Object.keys($.secrets??{}))}function k3($){return new Set(Object.keys($.secrets??{}))}function b3($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return new Set;if(!("outgoing"in Z))return new Set;let Q=Z.outgoing;if(!Q||typeof Q!=="object"||Array.isArray(Q))return new Set;return new Set(Object.keys(Q))}function L9($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return"clientId"in Z||"jwksUri"in Z||"workloadId"in Z}function y3($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return new Set;let Q=Z;if("incoming"in Q||"outgoing"in Q){let X=Q.outgoing;if(!X||typeof X!=="object"||Array.isArray(X))return new Set;return new Set(Object.keys(X))}if(L9(Q))return new Set;return new Set(Object.keys(Q).filter((X)=>X!=="default"))}function v3($,Z,Q){let X=Z.secrets??{},Y=$.secrets??{};for(let[_,H]of Object.entries(X)){let D=Y[_];if(!D)continue;if(H.type&&D.type&&H.type!==D.type)throw Error(`Secrets source "${_}" type in framework config must match ConfigSource type. ConfigSource type: ${D.type}, framework type: ${H.type}`)}let J=C3(Z),K=k3($);for(let _ of J)if(!K.has(_))Q.warn(`Framework config declares secrets source "${_}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let _ of K)if(!J.has(_))Q.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:_});let z=b3(Z),G=y3($);for(let _ of z)if(!G.has(_))Q.warn(`Framework config declares outgoing workload client "${_}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(Z.otel!==void 0&&Z.otel!==null&&$.otel===void 0)Q.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function z9($,Z){if(Z===void 0)return!1;return Z3($,Z)}function h3($,Z){if(typeof Z!=="number"||Z<=0)return $;return new Promise((Q,X)=>{let Y=setTimeout(()=>{X(Error(`Ionite ready() timed out after ${Z}ms`))},Z);$.then(()=>{clearTimeout(Y),Q()},(J)=>{clearTimeout(Y),X(J)})})}function f3($,Z,Q){if(typeof Z!=="number"||Z<=0)return $;return new Promise((X,Y)=>{let J=setTimeout(()=>{Y(Error(Q))},Z);$.then((K)=>{clearTimeout(J),X(K)},(K)=>{clearTimeout(J),Y(K)})})}function U4(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function K9($){return $==="/"?$:$.replace(/\/+$/,"")}function _4($,Z){return K9($)===K9(Z)}function _9($){return $.method==="GET"||$.method==="HEAD"}function m3($){if($.isReady()&&$.config?.readyz?.enabled===!1)return _0();let Z=$.readiness();return Response.json(g3(Z),{status:Z.ok?200:503})}function g3($){let Z=$.config.lastError;if(!Z)return $;return{...$,config:{...$.config,lastError:{kind:Z.kind,phase:Z.phase,at:Z.at,message:"[redacted]"}}}}var p3={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz"};function d3($){let Z=$?.providers;if(!Z)return!1;return Object.values(Z).some((Q)=>Q.enabled!==!1&&Q.type!=="magic-link")}function R0($,Z,Q={}){let X=p3[$],Y=Z.modules[X],J=Q.capable??!0,K=Y.active&&Y.ready&&J,z=K?void 0:!Y.active||!Y.ready?Y.reason:Q.incapableReason??`${$} is not testable by this application wiring`;return{module:X,active:Y.active,ready:Y.ready,testable:K,...Q.urls&&Q.urls.length>0?{urls:Q.urls}:{},...z?{reason:z}:{}}}function u3($,Z,Q){let X=f0(Z),Y=$.readiness();return{sdk:{version:$4,catalogVersion:x2},basePath:Z,urls:X,modules:Y.modules,capabilities:{"sso.login":R0("sso.login",Y,{urls:[X.sso.loginUrl,X.sso.callbackUrl,X.sso.userUrl]}),"sso.jit":R0("sso.jit",Y,{capable:Q.sso?.enableJitUserProvisioning!==!1,incapableReason:"SSO JIT user provisioning is disabled in FrameworkConfig."}),"sso.logout":R0("sso.logout",Y,{urls:[X.sso.logoutUrl]}),"sso.back_channel_logout":R0("sso.back_channel_logout",Y,{urls:[X.sso.logoutBackChannelUrl]}),"ciam.magic_link":R0("ciam.magic_link",Y,{capable:Q.ciam?.enableJitUserProvisioning!==!1,urls:[X.ciam.magicLinkUrl,X.ciam.magicLinkLoginUrl],incapableReason:"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":R0("ciam.oidc_login",Y,{capable:d3(Q.ciam),urls:[X.ciam.customerLoginUrl,X.ciam.customerCallbackUrl,X.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":R0("ciam.customer",Y,{urls:[X.ciam.customerUrl]}),"ciam.logout":R0("ciam.logout",Y,{urls:[X.ciam.logoutUrl]}),"iam.users":R0("iam.users",Y,{capable:Boolean(Q.iam?.userStore),urls:[X.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":R0("iam.groups",Y,{capable:Boolean(Q.authz?.catalogStore||Q.authz?.catalog),urls:[X.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"workload.incoming":R0("workload.incoming",Y,{urls:[X.workload.validateUrl,X.workload.jwksUrl]}),"workload.outgoing":R0("workload.outgoing",Y,{}),"authz.oaa":R0("authz.oaa",Y,{capable:Boolean(Q.authz?.accessStore&&(Q.authz?.catalogStore||Q.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."})}}}async function l3($,Z,Q){if(!Z.isReady())return U4();if(Z.config?.capabilitiez!==!0||!Q)return _0();let X=await Y$($,Z,D9["capabilitiez.read"]);if(X)return X;return Response.json(Q.build(),{status:200})}async function c3($,Z,Q){if(!Z.isReady())return U4();if(Z.config?.authz?.oaa?.fullSync?.enabled!==!0)return _0();let X=await Y$($,Z,D9["authz.oaa.sync"]);if(X)return X;let Y=Z.authz?.oaa;if(!Y?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let J=Z.authz?await Z.authz.reconcile():void 0,K=Q.iam?.userStore,z=U9(Q.authz?.catalog?V9(Q.authz.catalog):void 0,Q.authz?.catalogStore),G=Q.authz?.accessStore,_=Q.authz?.resources;async function*H(){if(z)yield*H$((V,P)=>z.groups.list({start:V,limit:P}));if(_?.entitlements){let V=_.entitlements.bind(_);for await(let P of H$((L,B)=>_.list({start:L,limit:B})))yield*V(P).map((L)=>z3(L))}}let D=await Y.sync({users:K?H$((V,P)=>K.list({start:V,limit:P})):void 0,groups:z||_?.entitlements?H():void 0,roles:z?H$((V,P)=>z.roles.list({start:V,limit:P})):void 0,permissions:z?H$((V,P)=>z.permissions.list({start:V,limit:P})):void 0,resources:_?H$((V,P)=>_.list({start:V,limit:P})):void 0,access:G?H$((V,P)=>G.list({start:V,limit:P})):void 0},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...D,reconcile:J})}function i3($,Z,Q,X,Y,J){return async(K)=>{let z=new URL(K.url).pathname;if(_4(z,Q)){if(!_9(K))return F$(["GET"]);return m3($)}if(_4(z,X)){if(!_9(K))return F$(["GET"]);return l3(K,$,Y)}if(J&&_4(z,J.url)){if(K.method!=="POST")return F$(["POST"]);return c3(K,$,J.frameworkConfig)}let G=$.secrets;if(!Boolean(G?.isLfvDeliveryRequest?.(K)||G?.isLfvEventsRequest?.(K))&&!$.isReady())return U4();try{return await Z(K)}catch(H){return $.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},H),U$(H)}}}function H9($,Z,Q){if($)return Q&&!$.tenantId?{...$,tenantId:Q}:$;if(Z&&Q)return{tenantId:Q};return}function n3($,Z){if(Z.authz===null)return;if(!$.authz&&!Z.authz)return;return{...$.authz,...Z.authz,oaa:$.authz?.oaa||Z.authz?.oaa?{...$.authz?.oaa,...Z.authz?.oaa}:void 0}}function H4($){let Z=!1,Q=W0(`${$} module`,()=>Z);return{isReady:Q.isReady,ready:Q.ready,attach(X){if(Z=X!==void 0,Q.refresh(),!X)return;return Object.defineProperty(X,"isReady",{value:Q.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(X,"ready",{value:Q.ready,enumerable:!1,configurable:!0}),X}}}function V4($){if(!$)return!1;return $.isReady?$.isReady():!1}function N$($,Z,Q,X){if(!$)return{active:!1,ready:!1,reason:Q};return V4(Z)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:X}}function s3(){let $=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:$(),ciam:$(),iam:$(),workload:$(),otel:$(),secrets:$(),kms:$(),authz:$()}}function a3($,Z){let Q=$.isReady(),X=$.config;if(!Q||!X)return{ok:!1,applied:Q,modules:s3(),config:{...Z}};let Y=Boolean(X.workload)||Boolean($.workload),J={sso:N$(Boolean(X.sso),$.sso,"sso not configured (no RemoteConfig.sso)","sso configured but not ready"),ciam:N$(Boolean(X.ciam),$.ciam,"ciam not configured (no RemoteConfig.ciam)","ciam configured but not ready"),iam:N$(Boolean(X.iam),$.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:N$(Y,$.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:N$(Boolean(X.otel),$.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(X.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!V4($.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return $.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:N$(Boolean(X.kms),$.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active token"),authz:(()=>{if(!Boolean(X.authz?.oaa))return{active:!0,ready:!0};let G=$.authz?.oaa;return V4(G)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})()};return{ok:Object.values(J).every((z)=>!z.active||z.ready),applied:Q,modules:J,config:{...Z}}}function t3($,Z){let Q=[];for(let X of Z){let Y=$.modules[X];if(!$.applied){Q.push({name:X,reason:"RemoteConfig has not been applied yet"});continue}if(!Y?.ready)Q.push({name:X,reason:Y?.reason??`${X} is not ready`})}return{ok:Q.length===0,notReady:Q}}function r3($,Z,Q,X,Y,J,K,z){let G=Z.validators,_=J3($.cache);X3(_.jwks);let H=Z;if(_.session.read.enabled){let f=Z.sso?.sessionStore??Z.ciam?.sessionStore;if(f){let d=u2(f,_.session.read);H={...Z,sso:Z.sso?{...Z.sso,sessionStore:d}:Z.sso,ciam:Z.ciam?{...Z.ciam,sessionStore:d}:Z.ciam}}}let D={sessionCache:_.session},V=u0(G.workload,Q,$?.workload,Z.workload??void 0),P=Z.otel!==null?k2(Q,$?.otel,Z.otel??void 0,Y):void 0,L=H9($?.sso,Z.sso,$.id),B=G3(G.sso,Q,L,H.sso??void 0,D),R={...$?.iam,...Z.iam},A=Z.authz?.catalog?V9(Z.authz.catalog):void 0,W=Boolean(R.url||R.userStore||Z.authz?.catalogStore||A),F=K.update({mode:R.delta,url:R.url,audience:R.deltaAudience,tenantId:$.id},{workload:V,userStore:R.userStore,catalogStore:U9(A,Z.authz?.catalogStore),resources:Z.authz?.resources,idMapStore:R.deltaIdMapStore}),M;if(W&&!V){if(Object.keys($).length>0)Q.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");M=void 0}else M=Y3(G.iam,Q,V,J,Z.authz?.accessStore,Z.authz?.accessIndex,Z.authz?.catalogStore,A,Z.authz?.resources,$?.iam,Z.iam??void 0,F,Z.authz?.onAccessMutation,$3($.authz),z);let I=H9($?.ciam,Z.ciam,$.id),T=Q3(G.ciam,Q,I,H.ciam??void 0,V,D);return{secret:X,workload:V,otel:P,sso:B,iam:M,ciam:T}}function W9($,Z,Q,X,Y,J,K,z){let G=J.authz.update(n3(Z,Q));$.id=Z.id,$.config=Z,$.secrets=J.secrets.update(Z.secrets,Q.secrets??void 0,Q.validators.secrets,Q.lfv?.callbackTransport),$.kms=J.kms.update(Z.kms,(V)=>{if(!V.source)return Y;if(!$.secrets)throw Error(`KMS pool references unavailable secrets source "${V.source}".`);return $.secrets.getSecretsSource(V.source)});let _=r3(Z,Q,X,Y,J.kms.handle(),G,J.iamDelta,J.authz.settle);$.secret=_.secret,$.workload=J.workload.update(_.workload),$.otel=J.otel.update(_.otel),$.authz=G,$.log=J.log.update($.otel?.logger??X),$.sso=J.sso.attach(_.sso),$.iam=J.iam.attach(_.iam),$.ciam=J.ciam.attach(_.ciam);let H=f0(K),D=(V)=>y2(V,$,z?.routing,H);$.handler=i3($,D,H.readyzUrl,H.capabilitiezUrl,{build:()=>u3($,K,Q)},{url:L4(K),frameworkConfig:Q})}function o3($,Z,Q,X,Y,J,K,z){j3($.id,Z),E3(Z),q3(Z),T3(Z),P3(Z,Q,X),w3(Z,Q),v3(Z,Q,X),W9($,Z,Q,X,Y,J,K,z)}function B9($){if(!$.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return $.secret}async function e3($,Z,Q,X,Y,J,K){let z=$,G=W4($,Z,Y.current,J);if(X.beforeChange){let _=F9(G,Y);K?.enter();let H;try{H=await X.beforeChange($,_,Q)}finally{K?.exit()}if(H?.config!==void 0)z=H.config;G=H?.frameworkConfig??_}return G=j$(G,Y.current),{effectiveRemoteConfig:z,effectiveFrameworkConfig:G}}function z7($,Z){let Q=K3(Z),{frameworkConfig:X,basePath:Y,stores:J,options:K}=Q,z=j$(S3(X,$),J),G=z.log||K4,_={current:J},H={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:z},D={log:_3(G),secrets:E8(G),kms:a4(G),workload:k8(G),otel:Z8(G),authz:C4(G),iamDelta:I2(G),sso:H4("sso"),iam:H4("iam"),ciam:H4("ciam")},V={},P,L,B=new Promise((c,Y0)=>{P=c,L=Y0}),R=!1,A,W,F=0,M={enter:()=>{F+=1},exit:()=>{F-=1}},I=Promise.resolve();function T(c){let Y0=I.then(c,c);return I=Y0.then(()=>{return},()=>{return}),Y0}function f(c){if(R)throw Error(`Ionite instance has been closed and cannot call ${c}().`)}function d(){$.log=H.frameworkConfig.log??K4,$.validators=H.frameworkConfig.validators}let h={},q={log:G,id:void 0,config:void 0,secret:B9($),authz:void 0,configStatus:V,handler:async()=>_0(),ready:(c)=>{if(F>0&&H.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return h3(B,c)},isReady:()=>H.remoteConfig!==void 0,readiness:()=>a3(q,V),requireReady:(c)=>t3(q.readiness(),c),close:()=>{if(R)return;if(R=!0,W)clearTimeout(W),W=void 0;A?.(),A=void 0;let c=[()=>D.secrets.close(),()=>D.kms.close(),()=>D.authz.close(),()=>D.otel.shutdown()];for(let Y0 of c)try{Promise.resolve(Y0()).catch((z0)=>{G.warn("Ionite close: module teardown failed",z0)})}catch(z0){G.warn("Ionite close: module teardown failed",z0)}P?.(),P=void 0,L=void 0},setStores:async(c)=>{f("setStores");let Y0=v$(c);await T(()=>u(Y0))}};W9(q,h,H.frameworkConfig,G,q.secret,D,Y,K),d();function O(){let c=V.lastError!==void 0;if(V.appliedAt=Date.now(),V.lastError=void 0,c)(q.log??G).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function S(c,Y0){let z0=B4(Y0)??(Y0 instanceof Error?Y0.message:String(Y0)),U0=F3(Y0),K0=V.lastError===void 0;if(V.lastError={kind:U0,message:z0,at:Date.now(),phase:c},K0)(q.log??G).error(c==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":U0,phase:c,error:z0})}function m(c,Y0,z0){(q.log??G).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:c,"ion.config.hash":Y0,"ion.config.apply_ms":z0})}async function w(c,Y0){if(R)return;let z0=J9(c);if(Y0&&H.remoteConfig!==void 0&&z0===H.remoteConfigHash&&z9(c,H.remoteConfig))return;let U0=H.remoteConfig,K0=U0===void 0?"initial":"update",N=Date.now(),b,l,r;try{let j=await e3(c,H.frameworkConfig,H.remoteConfig,K,_,Y,M);if(b=j.effectiveRemoteConfig,l=J9(b),r=j.effectiveFrameworkConfig,Y0&&K.beforeChange===void 0&&H.remoteConfig!==void 0&&l===H.remoteConfigHash&&z9(b,H.remoteConfig)&&r===H.frameworkConfig)return;let E=r.log||K4;o3(q,b,r,E,B9($),D,Y,K)}catch(j){throw S(K0,j),j}H.remoteConfig=b,H.remoteConfigHash=l,H.frameworkConfig=r,d(),O(),await D.otel.settled();let $0=F9(H.frameworkConfig,_),G0=!1;try{K.afterChange?.(q,b,$0,U0)}catch(j){if((q.log??G).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:K0,error:j instanceof Error?j.message:String(j)}),K0==="initial"){G0=!0;let E=j instanceof Error?j:Error(`afterChange failed on initial load: ${String(j)}`);S("initial",E),L?.(E),L=void 0,P=void 0}}if(H.frameworkConfig=$0,d(),!G0)m(K0,l,Date.now()-N);if(!G0&&P)P(),P=void 0}async function u(c){if(R)return;if(_.current=c,H.remoteConfig===void 0){H.frameworkConfig=j$(H.frameworkConfig,c),d();return}await w(H.remoteConfig,!1)}if($.subscribe)$.subscribe((c)=>{T(()=>w(c,!0)).catch(()=>{})},{mode:"wait"}).then((c)=>{if(R){c?.();return}A=c}).catch((c)=>{G.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:c instanceof Error?c.message:String(c)})});let i=W3(K.configRetry),Z0=[K.onConfigLoadError??N3(G)],X0=0;function H0(){if(W=void 0,R)return;if(H.remoteConfig!==void 0)return;f3($.load(),i.loadTimeoutMs,`ConfigSource initial load timed out after ${i.loadTimeoutMs}ms`).then(async(c)=>{X0=0;try{await T(async()=>{if(H.remoteConfig!==void 0)return;await w(c,!0)})}catch(Y0){let z0=Y0 instanceof Error?Y0:Error(`Initial RemoteConfig application failed: ${String(Y0)}`);G.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:z0.message}),L?.(z0),L=void 0}},async(c)=>{if(R)return;X0+=1;let Y0=O3(X0,i),z0=B4(c)??"RemoteConfig load failed",U0=U3(c),K0=x0(c,"code"),N=x0(c,"status"),b={attempt:X0,error:c,errorKind:U0,maxDelayMs:i.maxDelayMs,message:z0,nextDelayMs:Y0,code:typeof K0==="string"?K0:void 0,status:typeof N==="number"?N:void 0,path:typeof x0(c,"path")==="string"?x0(c,"path"):void 0,sourceType:typeof x0(c,"sourceType")==="string"?x0(c,"sourceType"):void 0};if(!L3(c,U0)){let l=c instanceof Error?c:Error(`ConfigSource initial load failed with unrecoverable ${U0}: ${z0}`);G.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:U0,error:z0,code:b.code,status:b.status,path:b.path,sourceType:b.sourceType}),L?.(l),L=void 0;return}try{await A3(b,Z0)}catch(l){let r=l instanceof Error?l:Error("ConfigSource retry hook stopped RemoteConfig retrying");L?.(r),L=void 0;return}W=setTimeout(H0,Y0)})}return H0(),q}export{BZ as workloadHandler,u0 as workload,$Y as withSetCookies,e7 as withDefaultExternalId,o7 as verifyUser,L8 as vaultSocketDiagnostics,_2 as vaultConfig,W$ as vault,e2 as validateWorkloadToken,LZ as tenantManager,uZ as tenantConfigSource,d0 as subscribeSecretPathWithHttpPolling,r7 as sso,K8 as setVaultWebSocketCommandTimeout,t7 as sendTenantWebhook,hZ as secretConfigSource,a7 as sameOriginRedirectRules,y2 as routeRequest,X9 as rewriteRequestPath,z4 as rewriteRequestForTenantPath,rZ as rewriteRequestForDefaultTenantUi,tZ as rewriteRequestForDefaultTenantApi,HZ as revokeWorkloadToken,Q9 as resolveTenantFromRequest,s7 as resolveRedirect,X8 as resolveDefaultRoute,n7 as resolveCapturedRedirect,i7 as resolveAfterRedirect,dZ as registerConfigLocatorAssert,c7 as reconcileSubjectAccess,pZ as mirrorSecrets,l7 as listSsoClientIdsFromCookies,V7 as listGenerator,T$ as lfvVault,EZ as isVaultConfigWaitingForSecretError,qZ as isVaultConfigInvalidPayloadError,u7 as isRedirectAllowed,z7 as ionite,d7 as initiateLogin,n$ as iamDeltaIdMapKey,p7 as iam,m7 as hasScope,f7 as hasRole,h7 as hasPermission,v7 as hasGroup,y7 as hasAnyScope,b7 as hasAny,k7 as hasAllScope,C7 as hasAll,w7 as has,_Z as getWorkloadToken,KZ as getWorkload,S7 as getUser,x7 as getCustomer,B7 as generateULID,J4 as gcpConfig,I7 as expandRoot,T2 as escapeScimFilterValue,bZ as envConfig,Y$ as enforceEndpointAuthz,P7 as discoverSessions,T7 as discoverSessionRecords,f0 as deriveIonUrls,R7 as defaultRedirectPolicies,aZ as createTenantIonResolver,oZ as createTenantIonHandler,u2 as createSessionReadCache,I2 as createManagedIamDelta,K$ as configSourceFromLocator,i8 as configSourceFromEnvValues,c8 as configLocatorFromEnvValues,q7 as collectReferencedDefinitions,W8 as closeAllVaultSockets,E7 as ciam,j7 as captureRedirect,A7 as callback,O7 as blockDangerousUrls,K2 as azureConfig,Y4 as awsConfig,W7 as allowSameOrigin,L7 as allowRelativePaths,M7 as allowOrigins,F7 as allowHosts,P0 as VaultSubscribeNotSupportedError,z$ as VaultConfigWaitingForSecretError,S$ as VaultConfigInvalidPayloadError,o$ as VAULT_MIN_POLLING_TTL_MS,a$ as ScimOutboundClient,D7 as IoniteError,$$ as InMemoryWorkloadTokenStore,Y9 as InMemoryWorkloadIdentityStore,y$ as InMemoryUserStore,g7 as InMemoryTenantStore,b$ as InMemorySessionStore,f8 as InMemoryResourceStore,k$ as InMemoryMagicLinkStore,s$ as InMemoryIamDeltaIdMapStore,C$ as InMemoryCustomerStore,m8 as InMemoryAccessIndex,h8 as InMemoryAccessCatalogStore,l0 as InMemoryAccessAssignmentStore,$4 as ION_SDK_VERSION,x2 as ION_CAPABILITY_CATALOG_VERSION,R6 as ION_CAPABILITY_CATALOG,N7 as CatalogAdjacencyCache};
+import{configTrustedClientGrants as O3,deepEqualPlain as N3,defaultLogger as L1,ION_ENDPOINT_PERMISSIONS as j8,listGenerator as D0,stableConfigHash as M8,toCodeCatalog as q8,unionCatalogRead as R8}from"@ionite/core";import{ciam as A3,configureJwksCache as E3,iam as j3,resolveCacheConfig as q3,sso as R3,withDefaultExternalId as T3}from"@ionite/core/server";import{trimTrailingSlash as R1}from"@ionite/core";import{list as y8}from"@ionite/core";class v0{customers=new Map;userNameIndex=new Map;async get($){return this.customers.get($)}async lookup($){if($.id){let Z=this.customers.get($.id);if(Z)return Z}if($.userName){let Z=this.userNameIndex.get($.userName.toLowerCase());if(Z)return this.customers.get(Z)}return}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q={...$,id:Z},X=this.customers.get(Z);if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase())}if(this.customers.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);return Q}async delete($){let Z=this.customers.get($);if(Z?.userName)this.userNameIndex.delete(Z.userName.toLowerCase());return this.customers.delete($),Z?1:0}async list($){let Z=Array.from(this.customers.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,_=Z.slice(Q,J);return y8(Y,_,Q,X)}}class h0{magicLinks=new Map;async create($,Z,Q){if(this.magicLinks.has($))throw Error(`Magic link with token ${$} already exists`);let X={token:$,customer:Z,createdAt:new Date,expiresAt:Q};this.magicLinks.set($,X)}async get($){let Z=this.magicLinks.get($);if(!Z)return null;if(Date.now()>Z.expiresAt.getTime())return this.magicLinks.delete($),null;return Z}async getAndDelete($){let Z=this.magicLinks.get($);if(this.magicLinks.delete($),!Z)return null;if(Date.now()>Z.expiresAt.getTime())return null;return Z}async delete($){this.magicLinks.delete($)}}function b8($){let Z=$.expiresAt;if(!Z)return;let Q=Z instanceof Date?Z.getTime():new Date(Z).getTime();return Number.isNaN(Q)?void 0:Q}class f0{sessions=new Map;async create($){if(this.sessions.has($.sid))throw Error(`Session with sid ${$.sid} already exists`);this.sessions.set($.sid,$)}async get($){let Z=this.sessions.get($);if(!Z)return null;let Q=b8(Z);if(Q!==void 0&&Date.now()>Q)return this.sessions.delete($),null;return Z}async update($,Z){let Q=this.sessions.get($);if(!Q)throw Error(`Session with sid ${$} not found`);let X={...Q,...Z};this.sessions.set($,X)}async delete($){this.sessions.delete($)}}import{list as v8}from"@ionite/core";class m0{users=new Map;userNameIndex=new Map;async get($){return this.users.get($)}async lookup($){return this.users.get($.id??"")}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q={...$,id:Z},X=this.users.get(Z);if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase())}if(this.users.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);return Q}async delete($){let Z=this.users.get($);if(Z){if(Z.userName)this.userNameIndex.delete(Z.userName.toLowerCase())}return this.users.delete($),Z?1:0}async list($){let Z=Array.from(this.users.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,_=Z.slice(Q,J);return v8(Y,_,Q,X)}}class Z0{tokens=new Map;async set($){this.tokens.set($.workload_id,$)}async get($){let Z=this.tokens.get($);if(!Z)return null;if(Date.now()>Z.expires_at.getTime())return this.tokens.delete($),null;return Z}async delete($){this.tokens.delete($)}async isValid($){return await this.get($)!==null}async cleanup(){let $=Date.now();for(let[Z,Q]of this.tokens.entries())if($>Q.expires_at.getTime())this.tokens.delete(Z)}}function m$($){let Z=R1($||E4);return{readyzUrl:`${Z}/readyz`,capabilitiezUrl:`${Z}/capabilitiez`,sso:{loginUrl:`${Z}/auth/login`,userUrl:`${Z}/auth/user`,logoutUrl:`${Z}/auth/logout`,logoutBackChannelUrl:`${Z}/auth/logout/backchannel`,refreshUrl:`${Z}/auth/refresh`,callbackUrl:`${Z}/auth/callback`},workload:{validateUrl:`${Z}/workload/validate`,jwksUrl:`${Z}/workload/jwks`},iam:{basePath:`${Z}/iam`,usersUrl:`${Z}/iam/Users`,groupsUrl:`${Z}/iam/Groups`},ciam:{magicLinkUrl:`${Z}/magic-link`,magicLinkLoginUrl:`${Z}/magic-link/login`,customerUrl:`${Z}/auth/customer`,customerLoginUrl:`${Z}/auth/customer/login`,customerCallbackUrl:`${Z}/auth/customer/callback`,customerProvidersUrl:`${Z}/auth/customer/providers`,logoutUrl:`${Z}/auth/customer/logout`}}}function T1($){return`${R1($||E4)}/authz/oaa/sync`}function h8($,Z){if($===null)return null;let Q={validateUrl:Z.validateUrl,jwksUrl:Z.jwksUrl};if($&&typeof $==="object"&&(("incoming"in $)||("outgoing"in $))){let X=$;return{...X,incoming:{...X.incoming,...Q}}}return{...$??{},...Q}}function I1($,Z,Q,X){let Y={...Z},J=m$(X);if(Y.sso!==null)if($.sso)Y.sso={...Y.sso,loginUrl:J.sso.loginUrl,userUrl:J.sso.userUrl,logoutUrl:J.sso.logoutUrl,logoutBackChannelUrl:J.sso.logoutBackChannelUrl,refreshUrl:J.sso.refreshUrl,redirectUri:J.sso.callbackUrl,sessionStore:Q.sessionStore,userStore:Q.userStore,enableJitUserProvisioning:Y.sso?.enableJitUserProvisioning??!0};else Y.sso=void 0;if(Y.iam!==null)if($.iam)Y.iam={...Y.iam,usersUrl:J.iam.usersUrl,groupsUrl:J.iam.groupsUrl,userStore:Q.userStore};else Y.iam=void 0;if(Y.workload!==null){if($.workload||Y.workload)Y.workload=h8(Y.workload,J.workload)}if(Y.ciam!==null)if($.ciam)Y.ciam={...Y.ciam,magicLinkUrl:J.ciam.magicLinkUrl,magicLinkLoginUrl:J.ciam.magicLinkLoginUrl,customerUrl:J.ciam.customerUrl,customerLoginUrl:J.ciam.customerLoginUrl,customerCallbackUrl:J.ciam.customerCallbackUrl,customerProvidersUrl:J.ciam.customerProvidersUrl,logoutUrl:J.ciam.logoutUrl,providers:$.ciam.providers,sessionStore:Q.sessionStore,customerStore:Q.customerStore,magicLinkStore:Q.magicLinkStore,enableJitUserProvisioning:Y.ciam?.enableJitUserProvisioning??!0};else Y.ciam=void 0;return Y}function R0($,Z){let Q={...$};if(Q.sso)Q.sso={...Q.sso,sessionStore:Z.sessionStore,userStore:Z.userStore};if(Q.iam)Q.iam={...Q.iam,userStore:Z.userStore,deltaIdMapStore:Z.deltaIdMapStore};if(Q.workload)Q.workload={...Q.workload,tokenStore:Z.workloadTokenStore,workloadIdentityStore:Z.workloadIdentityStore};if(Q.ciam)Q.ciam={...Q.ciam,sessionStore:Z.sessionStore,customerStore:Z.customerStore,magicLinkStore:Z.magicLinkStore};if(Q.authz!==null&&(Z.accessStore||Z.accessIndex||Z.catalog||Z.catalogStore||Z.resources))Q.authz={...Q.authz,accessStore:Z.accessStore,accessIndex:Z.accessIndex,catalog:Z.catalog,catalogStore:Z.catalogStore,resources:Z.resources};return Q}var E4="/api/ionite";function g0($){return{sessionStore:$?.sessionStore??new f0,userStore:$?.userStore??new m0,customerStore:$?.customerStore??new v0,accessStore:$?.accessStore,accessIndex:$?.accessIndex,catalog:$?.catalog,catalogStore:$?.catalogStore,resources:$?.resources,magicLinkStore:$?.magicLinkStore??new h0,workloadTokenStore:$?.workloadTokenStore??new Z0,workloadIdentityStore:$?.workloadIdentityStore,deltaIdMapStore:$?.deltaIdMapStore}}function p0(){return E4}import{accessRefId as P4,accessRootId as V2,configTrustedClientGrants as F2,listGenerator as g1,toCodeCatalog as M2}from"@ionite/core";import{CatalogAdjacencyCache as L2,expandRoot as W2,reconcileSubjectAccess as O2,withDefaultExternalId as N2}from"@ionite/core/server";import{accessRefId as g$,accessRootId as f8,ION_AUTHZ_GROUP_SCHEMA as m8}from"@ionite/core";import{collectReferencedDefinitions as g8,withDefaultExternalId as p8}from"@ionite/core/server";function W$($,Z,Q=(X)=>Error(`${$} ready timed out after ${X}ms`)){let X=!1,Y,J,_=()=>{X=!1,J=new Promise((K)=>{Y=K})};_();let z=()=>{X=!0,Y?.(),Y=void 0},G=()=>{if(Z()){if(!X)z();return}if(X)_()};return G(),{isReady:()=>Z(),ready:(K)=>{if(Z())return Promise.resolve();let H=J;if(!K||K<=0)return H;return new Promise((D,U)=>{let I=setTimeout(()=>U(Q(K)),K);H.then(()=>{clearTimeout(I),D()},(L)=>{clearTimeout(I),U(L)})})},refresh:G,settle:z}}var S1="App",d8="ionite",w1=104857600,u8=w1,l8=10485760,j4=3,c8=250,i8={};function t$($,Z){return Z.mapGroup?Z.mapGroup($):$}class y$ extends Error{retryable;code;status;warnings;constructor($,Z={}){super($,{cause:Z.cause});this.name="OaaError",this.retryable=Z.retryable??!1,this.code=Z.code,this.status=Z.status,this.warnings=Z.warnings,Object.setPrototypeOf(this,y$.prototype)}}function n8($){let Z=$();return Boolean(Z?.url&&Z.providerId&&Z.datasourceId)}function C1($,Z,Q,X,Y){let J=async(z)=>{await x1($,N$(Z),z,{mode:"incremental"})},_=W$("OAA",()=>n8(Z),(z)=>new y$(`OAA ready timed out after ${z}ms`,{code:"not_ready"}));return{isReady:_.isReady,ready:_.ready,refreshReadiness:_.refresh,async pushUser(z){let G=N$(Z);await J(q$(G,{local_users:[y1(z,"modify")]},!0))},async pushGroup(z){let G=N$(Z),K=Q(),H=t$(z,K),D=l0(H,a$(G),"add"),U=await q4(H,"group",Y?.(),K,G);await J(q$(G,T0({local_groups:[Q0(H,"modify")],identity_to_permissions:D?[D]:[]},U),!0))},async pushRole(z){let G=N$(Z),K=Q(),H=K.mapRole?K.mapRole(z):z,D=await q4(H,"role",Y?.(),K,G);await J(q$(G,T0({local_roles:[X0(H,"modify")]},D),!0))},async pushPermission(z){let G=N$(Z);await J(q$(G,{permissions:[V0(z,Q().mapPermissionTypes,"modify")]},!0))},async pushResource(z){let G=N$(Z),K=Q(),H=K.mapResource?K.mapResource(z):z,D=await $2(H,Y?.(),K);await J(q$(G,{resources:D},!0))},async grant(z){let G=N$(Z),K=Q(),H=await k1(z,Y?.(),K,G);await J(P1(G,z,"add",K,H))},async revoke(z){let G=N$(Z);await J(P1(G,z,"delete",Q()))},async pushAccessChanges(z){if(z.length===0)return;let G=N$(Z),K=Q(),H=Y?.(),D=await a8(G,z,K,H);await J(D)},async deleteUser(z){let G=N$(Z);await J(q$(G,{local_users:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteGroup(z){let G=N$(Z);await J(q$(G,{local_groups:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteRole(z){let G=N$(Z);await J(q$(G,{local_roles:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deletePermission(z){let G=N$(Z);await J(q$(G,{permissions:[{name:z,unique_id:z,permission_type:[],operation:"delete"}]},!0))},async deleteResource(z){let G=N$(Z);await J(q$(G,{resources:[{name:z,id:z,resource_type:"",operation:"delete"}]},!0))},async sync(z,G){let K=N$(Z),H=G?.mode==="incremental",D=H?void 0:X?.(),U=await s8(K,z,Q(),H,D);return x1($,K,U,G)}}}function N$($){let Z=$();if(!Z?.url||!Z.providerId||!Z.datasourceId)throw new y$("OAA is not configured",{code:"not_configured"});return Z}async function s8($,Z,Q,X,Y){let J=[],_=[],z=[],G=[],K=[],H=[],D=X?"modify":void 0,U=new Set,I=(B)=>f8(B);for await(let B of U0(Z.users))J.push(y1(B,D));for await(let B of U0(Z.groups)){let R=t$(B,Q);_.push(Q0(R,D));let E=l0(R,a$($),X?"add":void 0);if(E)H.push(E)}for await(let B of U0(Z.roles)){let R=Q.mapRole?Q.mapRole(B):B;K.push(X0(R,D))}for await(let B of U0(Z.permissions))G.push(V0(B,Q.mapPermissionTypes,D));let L=[];for await(let B of U0(Z.resources)){let R=Q.mapResource?Q.mapResource(B):B;L.push(R)}z.push(...b1(L,D));for await(let B of U0(Z.access))if(U.add(I(B)),u0(B,H,J,a$($),X?"add":void 0),typeof B.target!=="string")if(B.targetType==="role"){let R=Q.mapRole?Q.mapRole(B.target):B.target;K.push(X0(R,D))}else if(B.targetType==="permission")G.push(V0(B.target,Q.mapPermissionTypes,D));else{let R=t$(B.target,Q);_.push(Q0(R,D))}for(let B of Y??[]){let R=I(B);if(U.has(R))continue;U.add(R);let E=g$(B.subject);if(E&&!J.some((W)=>g$(W.unique_id??W.name)===E))J.push({name:E,unique_id:E,is_active:!0,operation:D,custom_properties:{identity_type:"workload",source:"eci-trusted"}});u0(B,H,J,a$($),D)}return q$($,{local_users:J,local_groups:_,local_roles:K,resources:z,permissions:G,identity_to_permissions:H},X)}function q$($,Z,Q){let X={name:$.applicationName??S1,application_type:$.applicationType??d8,local_users:Z.local_users??[],local_groups:Z.local_groups??[],local_roles:Z.local_roles??[],resources:Z.resources??[],custom_properties:{},tags:[]};if(Q)X.operation="modify";return A$({applications:[X],permissions:Z.permissions??[],identity_to_permissions:Z.identity_to_permissions??[],is_incremental:Q?!0:void 0})}function P1($,Z,Q,X=i8,Y){let J=[],_=[],z=[],G=[],K=[];u0(Z,J,_,a$($),Q);let H=Q==="delete"?"delete":"modify";if(typeof Z.target!=="string")if(Z.targetType==="role"){let U=X.mapRole?X.mapRole(Z.target):Z.target;G.push(X0(U,H))}else if(Z.targetType==="permission")K.push(V0(Z.target,X.mapPermissionTypes,H));else{let U=t$(Z.target,X);z.push(Q0(U,H))}let D={local_users:_,local_groups:z,local_roles:G,permissions:K,identity_to_permissions:J};return q$($,Y?T0(D,Y):D,!0)}async function a8($,Z,Q,X){let Y=a$($),J=[],_=[],z=[],G=[],K=[],H=[],D=[],U=[];for(let{change:L,op:B}of Z){u0(L,B==="delete"?G:_,B==="delete"?z:J,Y,B==="delete"?"delete":"add");let F=B==="delete"?"delete":"modify";if(typeof L.target!=="string")if(L.targetType==="role"){let M=Q.mapRole?Q.mapRole(L.target):L.target;H.push(X0(M,F))}else if(L.targetType==="permission")D.push(V0(L.target,Q.mapPermissionTypes,F));else{let M=t$(L.target,Q);K.push(Q0(M,F))}if(B==="add")U.push(await k1(L,X,Q,$))}let I={local_users:[...J,...z],local_groups:K,local_roles:H,permissions:D,identity_to_permissions:[..._,...G]};return q$($,T0(I,...U),!0)}function T0(...$){let Z={},Q=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let X of $)for(let Y of Q){let J=X[Y];if(J&&J.length>0)Z[Y]=[...Z[Y]??[],...J]}return Z}async function q4($,Z,Q,X,Y){if(!Q)return{};let J=await g8($,Z,{catalog:Q.catalog,code:Q.code,resources:Q.resources,cache:Q.cache}),_=[];for(let z of J.groups){let G=t$(z,X),K=l0(G,a$(Y),"add");if(K)_.push(K)}return{local_groups:J.groups.map((z)=>Q0(t$(z,X),"modify")),local_roles:J.roles.map((z)=>X0(X.mapRole?X.mapRole(z):z,"modify")),permissions:J.permissions.map((z)=>V0(z,X.mapPermissionTypes,"modify")),resources:J.resources.map((z)=>c0(X.mapResource?X.mapResource(z):z,"modify")),identity_to_permissions:_}}async function k1($,Z,Q,X){if(!Z)return{};if($.targetType!=="group"&&$.targetType!=="role")return{};let Y=g$($.target);if(!Y)return{};let J=typeof $.target==="string"?await t8($.targetType,Y,Z):$.target;if(!J)return{};let _={};if(typeof $.target==="string")if($.targetType==="group"){let G=t$(J,Q),K=l0(G,a$(X),"add");_={local_groups:[Q0(G,"modify")],identity_to_permissions:K?[K]:[]}}else{let G=Q.mapRole?Q.mapRole(J):J;_={local_roles:[X0(G,"modify")]}}let z=await q4(J,$.targetType,Z,Q,X);return T0(_,z)}async function t8($,Z,Q){if(Q.cache)return await Q.cache.getNode($,Z);let X=$==="group"?Q.code?.groups.get(Z):Q.code?.roles.get(Z);if(X)return X;let J=await($==="group"?Q.catalog?.groups:Q.catalog?.roles)?.get(Z);if(J)return J;if($==="group")return p8(await Q.resources?.entitlement?.(Z));return}function u0($,Z,Q,X,Y){let J=g$($.subject),_=g$($.target),z=Q.find((D)=>g$(D.unique_id??D.name)===J);if($.subjectType==="workload")if(z)z.custom_properties={...z.custom_properties,identity_type:"workload"};else z={name:J,unique_id:J,custom_properties:{identity_type:"workload"},operation:Y},Q.push(z);if($.targetType==="group"){if(z){let D=new Set(z.groups??[]);if(D.add(_),z.groups=[...D],Y)z.operation=Y}else Q.push({name:J,unique_id:J,groups:[_],operation:Y});return}let G={identity:J,identity_type:"local_user",operation:Y},K=$.resources??[],H=$.applyToApplication??K.length===0;if($.targetType==="role")G.role_assignments=[{application:X,role:_,apply_to_application:H,resources:K,operation:Y}];else G.application_permissions=[{application:X,permission:_,apply_to_application:H,resources:K,operation:Y}];Z.push(G)}function y1($,Z){return A$({name:$.displayName??$.name??$.userName??$.id,unique_id:$.id,identities:r8($),groups:$.groups?.map((Q)=>Q.value),is_active:$.active,created_at:H2($.createdAt),custom_properties:A$({ecid:$.ecid,accountClass:$.accountClass,externalId:$.externalId,userName:$.userName,tenantId:$.tenantId}),tags:[],operation:Z})}function r8($){let Z=$.email?[$.email]:$.emails?.map((X)=>X.value).filter(Boolean)??[],Q=[...$.ecid?[$.ecid]:[],...Z];return Q.length>0?Q:void 0}function Q0($,Z){let Q=o8($),X=B$($,"id")??B$($,"externalId")??B$($,"name")??B$($,"displayName"),Y=B$($,"displayName")??B$($,"name")??X??"group",J=d0($,"resources");return A$({name:Y,unique_id:X,custom_properties:A$({requestable:Q?.requestable??B2($,"requestable"),description:Q?.description??B$($,"description"),type:Q?.type,externalId:B$($,"externalId"),resources:J.length>0?J:void 0}),tags:[],operation:Z})}function o8($){let Z=$[m8];if(!Z||typeof Z!=="object"||Array.isArray(Z))return;return Z}function d0($,Z){if(!$||typeof $!=="object")return[];let Q=$[Z];if(!Array.isArray(Q))return[];return Q.map(g$).filter((X)=>X.length>0)}function e8($){return B$($,"id")??B$($,"externalId")??B$($,"name")??B$($,"displayName")??"group"}function l0($,Z,Q){let X=d0($,"resources"),Y=X.length>0,J=!Y,_=Y?X:[],z=d0($,"roles").map((K)=>({application:Z,role:K,apply_to_application:J,resources:_,operation:Q})),G=d0($,"permissions").map((K)=>({application:Z,permission:K,apply_to_application:J,resources:_,operation:Q}));if(z.length===0&&G.length===0)return;return{identity:e8($),identity_type:"local_group",role_assignments:z.length>0?z:void 0,application_permissions:G.length>0?G:void 0,operation:Q}}function X0($,Z){return A$({name:$.name,unique_id:$.id,permissions:$.permissions?.map((Q)=>typeof Q==="string"?Q:Q.id),custom_properties:A$({displayName:$.displayName,requestable:$.requestable,externalId:$.externalId,...$.metadata}),tags:[],operation:Z})}function V0($,Z,Q){return A$({name:$.name,unique_id:$.id,permission_type:Z?.($)??$.permissionTypes??[$.action??"Uncategorized"],apply_to_sub_resources:$.applyToSubResources,resource_types:$.resourceTypes,operation:Q})}function c0($,Z,Q,X=new Set){let Y=$.id;if(Y&&X.has(Y))return A$({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,custom_properties:A$({externalId:$.externalId,...$.metadata}),tags:[],operation:Z});if(Y)X.add(Y);let J=[];for(let _ of $.resources??[]){let z=typeof _==="string"?Q?.get(_):_;if(z)J.push(c0(z,Z,Q,X))}if(Y)X.delete(Y);return A$({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,sub_resources:J.length>0?J:void 0,custom_properties:A$({externalId:$.externalId,...$.metadata}),tags:[],operation:Z})}function b1($,Z){if($.length===0)return[];let Q=new Map;for(let G of $)if(G.id)Q.set(G.id,G);let X=new Map,Y=new Set,J=(G,K)=>{if(!K.id||K.id===G)return;let H=X.get(G)??[];if(!H.some((D)=>D.id===K.id))H.push(K);X.set(G,H),Y.add(K.id)};for(let G of $){for(let H of G.resources??[]){let D=typeof H==="string"?Q.get(H):H;if(D&&G.id)J(G.id,D)}let K=g$(G.parent);if(K&&Q.has(K)&&G.id)J(K,G)}let _=(G)=>{if(!G.id)return G;let K=X.get(G.id);if(!K||K.length===0)return G;return{...G,resources:K.map(_)}};return $.filter((G)=>!G.id||!Y.has(G.id)).map(_).map((G)=>c0(G,Z,Q))}async function $2($,Z,Q){if(!Z)return[c0($,"modify")];let X=async(H)=>{if(Z.cache)return await Z.cache.getNode("resource",H);return Z.resources?.get(H)},Y=async(H)=>{if(Z.resources?.children&&H.id&&(!H.resources||H.resources.length===0))return Z.resources.children(H.id);let D=[];for(let U of H.resources??[]){let I=typeof U==="string"?await X(U):U;if(I)D.push(I)}return D},J=$,_=new Set;while(!0){let H=g$(J.parent);if(!H||_.has(H))break;_.add(H);let D=await X(H);if(!D)break;J=D}let z=[],G=[J],K=new Set;while(G.length>0){let H=G.shift();if(!H)break;if(H.id&&K.has(H.id))continue;if(H.id)K.add(H.id);let D=Q.mapResource?Q.mapResource(H):H;z.push(D);for(let U of await Y(H))G.push(U)}if($.id&&!K.has($.id))z.push(Q.mapResource?Q.mapResource($):$);return b1(z,"modify")}async function x1($,Z,Q,X){let Y=JSON.stringify(A$(Q)),J=X?.compression??Z.compression??"gzip",_=J==="gzip"?await _2(Y):Y,z=K2(_),G=X?.maxPayloadBytes??Z.maxPayloadBytes??w1,K=X?.multipart??Z.multipart??"auto",H=X?.multipartThresholdBytes??Z.multipartThresholdBytes??u8;if(z>G&&K==="never")throw new y$("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(K==="always"||K==="auto"&&z>H)return Q2($,Z,_,J,X);return Z2(Z,{id:Z.datasourceId,data_source_id:Z.datasourceId,json_data:_,compression_type:J==="gzip"?"GZIP":"NONE"})}async function Z2($,Z){let Q=`${m1($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:push`,X=await i0(Q,{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"},body:JSON.stringify(Z)});return h1(X)}async function Q2($,Z,Q,X,Y){let J=Y?.partSizeBytes??Z.partSizeBytes??l8,_=await X2(Z,X),z=z2(Q,J);for(let K=0;K<z.length;K++)await Y2(Z,_,K+1,z[K]??"");let G=await J2(Z,_,z.length);return $.debug("OAA multipart payload pushed",{uploadId:_,parts:z.length}),{...G,uploadId:G.uploadId??_,parts:G.parts??z.length}}async function X2($,Z){let Q=R4($,"multipart/start"),X=await i0(Q,{method:"POST",headers:T4($),body:JSON.stringify({data_source_id:$.datasourceId,compression_type:Z==="gzip"?"GZIP":"NONE"})}),Y=await I4(X),J=B$(Y,"upload_id")??B$(Y,"uploadId")??B$(Y,"id");if(!J)throw new y$("OAA multipart start response did not include an upload id",{code:"invalid_response"});return J}async function Y2($,Z,Q,X){let Y=R4($,`multipart/${encodeURIComponent(Z)}/parts/${Q}`);await i0(Y,{method:"PUT",headers:T4($),body:JSON.stringify({upload_id:Z,sequence:Q,data:X})})}async function J2($,Z,Q){let X=R4($,`multipart/${encodeURIComponent(Z)}/complete`),Y=await i0(X,{method:"POST",headers:T4($),body:JSON.stringify({upload_id:Z,parts:Q})});return h1(Y)}function R4($,Z){return`${m1($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:${Z}`}function T4($){return{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"}}async function i0($,Z){let Q;for(let X=0;X<j4;X++){try{let Y=await fetch($,Z);if(!v1(Y.status)||X===j4-1){if(!Y.ok)await G2(Y);return Y}Q=new y$(`OAA request failed with retryable status ${Y.status}`,{retryable:!0,status:Y.status})}catch(Y){if(Q=Y,Y instanceof y$&&!Y.retryable)throw Y;if(X===j4-1)break}await U2(c8*2**X)}throw new y$("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:Q})}function v1($){return $===429||$>=500}async function G2($){let Z=await I4($).catch(()=>{return}),Q=B$(Z,"message")??B$(Z,"error")??`OAA request failed with status ${$.status}`;throw new y$(Q,{code:B$(Z,"code")??"http_error",status:$.status,retryable:v1($.status),warnings:f1(Z?.warnings)})}async function h1($){let Z=await I4($).catch(()=>{return});return{success:$.ok,syncToken:B$(Z,"sync_token")??B$(Z,"syncToken"),uploadId:B$(Z,"upload_id")??B$(Z,"uploadId"),parts:D2(Z,"parts"),warnings:f1(Z?.warnings),metadata:Z}}async function I4($){let Z=await $.text();if(!Z)return{};let Q=JSON.parse(Z);return Q&&typeof Q==="object"&&!Array.isArray(Q)?Q:{}}async function _2($){let Z=new Blob([$]).stream().pipeThrough(new CompressionStream("gzip")),Q=await new Response(Z).arrayBuffer();return Buffer.from(Q).toString("base64")}function z2($,Z){let Q=[];for(let X=0;X<$.length;X+=Z)Q.push($.slice(X,X+Z));return Q}function K2($){return Buffer.byteLength($,"utf8")}function H2($){if(!$)return;return $ instanceof Date?$.toISOString():$}function B$($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="string"&&Q.length>0?Q:void 0}function B2($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="boolean"?Q:void 0}function D2($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="number"?Q:void 0}function f1($){if(!Array.isArray($))return;let Z=$.filter((Q)=>typeof Q==="string");return Z.length>0?Z:void 0}async function*U0($){if(!$)return;for await(let Z of $)yield Z}function A$($){if(Array.isArray($))return $.map(A$).filter((Q)=>Q!==void 0);if(!$||typeof $!=="object"||$ instanceof Date)return $===null?void 0:$;let Z=Object.entries($).map(([Q,X])=>[Q,A$(X)]).filter(([,Q])=>{if(Q===void 0)return!1;if(Array.isArray(Q)&&Q.length===0)return!1;if(Q&&typeof Q==="object"&&!Array.isArray(Q)&&Object.keys(Q).length===0)return!1;return!0});return Z.length>0?Object.fromEntries(Z):void 0}function m1($){return $.replace(/\/+$/,"")}function a$($){return $.applicationName??S1}function U2($){return new Promise((Z)=>setTimeout(Z,$))}function A2($,Z){if(!$)return;if($.groups.get(Z))return"group";if($.roles.get(Z))return"role";if($.permissions.get(Z))return"permission";return}function E2($,Z,Q){(async()=>{let X=[],Y=async(J,_)=>{let z=J==="group"?Z.groups:J==="role"?Z.roles:Z.permissions;for(let G of _)if(await z.get(G))X.push(`${J}:${G}`)};if(await Y("group",Q.groups.list().map((J)=>J.id)),await Y("role",Q.roles.list().map((J)=>J.id)),await Y("permission",Q.permissions.list().map((J)=>J.id)),X.length>0)$.warn("Catalog store rows shadow code-declared entitlement ids; the code definitions win on read. Delete the store rows (they are inert) to clear this warning.",{"ion.operation":"authz.catalog.shadowed_rows","ion.outcome":"degraded",ids:X.sort()})})().catch((X)=>{$.debug?.("Shadowed-row catalog scan failed (non-fatal)",{error:X})})}function p1($){let Z,Q=!1,X,Y,J=C1($,()=>Z?.oaa,()=>({mapPermissionTypes:Z?.mapPermissionTypes,mapGroup:Z?.mapGroup,mapRole:Z?.mapRole,mapResource:Z?.mapResource}),()=>F2(Z),()=>{let O=Z?.catalogStore;return O||X?{catalog:O,code:X,resources:Z?.resources,cache:Y}:void 0}),_=(O)=>{if(Q||!J.isReady())return;let{kind:S}=O;(O.op==="delete"?S==="role"?J.deleteRole(O.id):S==="permission"?J.deletePermission(O.id):J.deleteGroup(O.id):S==="role"?J.pushRole(O.entity):S==="permission"?J.pushPermission(O.entity):J.pushGroup(O.entity)).catch((w)=>{$.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:O.op,kind:S,error:w})})},z=(O)=>{if(Q||!J.isReady())return;let S=Z?.resources;if(!S)return;(async()=>{if(O.deleted){await J.deleteResource(O.id);return}let w=await S.get(O.id);if(!w)return;await J.pushResource(w);for(let d of S.entitlements?.(w)??[])await J.pushGroup(N2(d))})().catch((w)=>{$.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:O.id,deleted:O.deleted===!0,error:w})})},G,K,H,D,U=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),I=!1,L=()=>{let O=Z?.accessIndex;if(!O&&!I)I=!0,$.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return O},B=async(O)=>{let S=Z?.accessIndex,f=Z?.catalogStore;if(!S||!f&&!X)return!1;let w=O.id??V2(O),d=await W2({...O,id:w},{catalog:f,code:X,resources:Z?.resources,cache:Y});return await S.materialize(w,d),!0},R=(O,S)=>O2(O,S,{accessStore:Z?.accessStore,accessIndex:Z?.accessIndex,catalogStore:Z?.catalogStore,code:X,resources:Z?.resources},Y),E=async()=>{let O={subjects:0,roots:0,cleared:0},S=Z?.accessIndex,f=Z?.catalogStore;if(Q||!S||!f&&!X)return O;let w=new Map,d=(Y$)=>{let H$=P4(Y$.subject);if(!H$)return;let c=Y$.subjectType??"user";w.set(`${c}:${H$}`,{subject:H$,subjectType:c})},i=new Set,X$=Z?.accessStore;if(X$)for await(let Y$ of g1((H$,c)=>X$.list({start:H$,limit:c}))){d({subject:P4(Y$.subject),subjectType:Y$.subjectType});let H$=P4(Y$.target);if(Y&&H$&&typeof Y$.target==="string"){if(!await Y.getNode(Y$.targetType,H$))i.add(`${Y$.targetType}:${H$}`)}}if(i.size>0)$.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog, catalog store, or resource derivation). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...i].sort()});if(S.listSubjects)for(let Y$ of await S.listSubjects())d(Y$);for(let Y$ of w.values()){let H$=await R(Y$.subject,Y$.subjectType??"user");if(O.subjects+=1,O.roots+=H$,H$===0)O.cleared+=1}return O},W=()=>{if(Q)return Promise.resolve({subjects:0,roots:0,cleared:0});return E()},F=Promise.resolve(),M=!1,P=(O,S)=>{let f=F.then(async()=>{if(Q)return;try{await S()}catch(w){$.warn(`${O} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:O,error:w instanceof Error?w.message:String(w)})}});return F=f,f},T=(O)=>{if(M)return;M=!0,P(O,async()=>{M=!1,await E()})},h=()=>F,g=(O)=>{if(Q)return;let S=Z?.accessStore;if(!Z?.accessIndex||!Z?.catalogStore||!S)return;if(Y?.invalidate(O),O.op==="set"){let f=O.kind,w=O.entity.id;P("catalog-change",async()=>{for await(let d of g1((i,X$)=>S.listByTarget(f,w,{start:i,limit:X$})))await B(d)})}else T("catalog-delete")},l=(O)=>{if(Q)return;if(Y?.clear(),!Z?.accessIndex||!Z?.catalogStore&&!X||!Z?.accessStore)return;T("resource-change")},j={oaa:J,get accessIndex(){return Z?.accessIndex},has(O,S,f,w,d){let i=L();return i?i.has(O,S,f,w,d):Promise.resolve(U())},hasGroup(O,S,f,w){let d=L();return d?d.hasGroup(O,S,f,w):Promise.resolve(U())},hasRole(O,S,f,w){let d=L();return d?d.hasRole(O,S,f,w):Promise.resolve(U())},hasPermission(O,S,f,w){let d=L();return d?d.hasPermission(O,S,f,w):Promise.resolve(U())},hasAny(O,S,f){let w=L();return w?w.hasAny(O,S,f):Promise.resolve(U())},hasAll(O,S,f){let w=L();return w?w.hasAll(O,S,f):Promise.resolve(U())},reconcile(){return W()}};return{update(O){if(Q)return j;if(O?.resources&&Boolean(O.resources.entitlements)!==Boolean(O.resources.entitlement))throw Error("AuthzConfig.resources: `entitlements(resource)` and `entitlement(id)` must be provided together (the derivation and its reverse resolver are both app-authored).");let S=O?.catalog?M2(O.catalog):void 0,f=S!==X;X=S,Z=O,J.refreshReadiness();let w=O?.catalogStore,d=O?.resources;if(w!==G||d!==H||f){if(K?.(),D?.(),Y=w||X?new L2(w,d,X):void 0,K=w?.afterChange?w.afterChange((i)=>{if(i.op==="set"&&A2(X,i.entity.id))$.warn("Catalog store row shadows a code-declared entitlement id; the code definition wins on read",{"ion.operation":"authz.catalog.shadowed_row","ion.outcome":"degraded",id:i.entity.id,kind:i.kind});_(i),g(i)}):void 0,D=d?.changed?d.changed((i)=>{l(i),z(i)}):void 0,G=w,H=d,w&&X)E2($,w,X)}else if(Y)Y.clear();return j},settle:h,close(){if(Q)return;Q=!0,K?.(),K=void 0,D?.(),D=void 0,G=void 0,H=void 0,Y=void 0}}}function d1($){return $.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+|_+$/g,"")||"EMPTY"}function j2($){let Z=`${$.clientId}\x00${$.path}`,Q=2166136261;for(let X=0;X<Z.length;X+=1)Q^=Z.charCodeAt(X),Q=Math.imul(Q,16777619);return(Q>>>0).toString(36)}function q2($){let Z=d1($.clientId),Q=d1($.path);return`LFV_${Z}__${Q}`}function u1($,Z){let Q=q2(Z);if(!(Q in $))return Q;let X=`${Q}_${j2(Z)}`;if(!(X in $))return X;return`${X}_ALT`}import{defaultLogger as YX}from"@ionite/core";import{defaultLogger as b2,stableConfigHash as v2}from"@ionite/core";import{verifyLfvSignature as h2}from"@ionite/core/server";import{DEFAULT_SECRET_MIME_TYPES as F0}from"@ionite/core";var R2=new Set(["jsonc","env","text","binary","yaml","toml","xml"]);function T2($){let Z=$.split(";",1)[0]?.trim().toLowerCase()??"";if(Z===F0.binary)return"binary";if(Z===F0.env)return"env";if(Z===F0.yaml||Z.endsWith("+yaml"))return"yaml";if(Z===F0.toml||Z.endsWith("+toml"))return"toml";if(Z===F0.xml||Z.endsWith("+xml"))return"xml";if(Z===F0.jsonc||Z.endsWith("+json"))return"jsonc";return"text"}function n0($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$,Q=typeof Z.mimeType==="string"?Z.mimeType:typeof Z.mime_type==="string"?Z.mime_type:void 0;if(!Q)return;let X=Z.format,Y=typeof X==="string"&&R2.has(X)?X:T2(Q),J=typeof Z.schemaUrl==="string"?Z.schemaUrl:typeof Z.schema_url==="string"?Z.schema_url:void 0,_=typeof Z.typeId==="string"?Z.typeId:typeof Z.type_id==="string"?Z.type_id:void 0;return{format:Y,mimeType:Q,...J?{schemaUrl:J}:{},..._?{typeId:_}:{}}}function Y0($){if(!$)return;let Z=$.custom_metadata,Q=Z&&typeof Z==="object"&&!Array.isArray(Z)?Z:void 0;return n0($.content_type??$.contentType??Q?.content_type)}function s0($){return{format:$.format,mime_type:$.mimeType,...$.schemaUrl?{schema_url:$.schemaUrl}:{},...$.typeId?{type_id:$.typeId}:{}}}var M0=new Map;function I2($){if(!$)return"/";return $.startsWith("/")?$:`/${$}`}function P2($){try{let Z=new URL($),Q=Z.pathname.replace(/\/+$/g,"");return`${Z.origin}${Q}`}catch{return $.replace(/\/+$/g,"")}}function a0($){let Z=P2($.lfvServerUrl),Q=I2($.path);return`${Z}|${Q}`}function l1($,Z,Q){let X=M0.get($)??new Map;return X.set(Z,Q),M0.set($,X),()=>{let Y=M0.get($);if(!Y)return;if(Y.delete(Z),Y.size===0)M0.delete($)}}async function x4($,Z,Q,X){let Y=M0.get($);if(!Y)return 0;let J=0;for(let[_,z]of Y){if(Q&&_===Q)continue;if(z.trustId!==X)continue;if(!z.onDelivery)continue;J+=1,await z.onDelivery(Z)}return J}async function S4($,Z,Q,X){let Y=M0.get($);if(!Y)return 0;let J=0;for(let[_,z]of Y){if(Q&&_===Q)continue;if(z.trustId!==X)continue;if(!z.onEvents)continue;J+=1,await z.onEvents(Z)}return J}import{defaultSecretContentType as x2,parseJsonc as S2,SecretContentTypeMismatchError as w2}from"@ionite/core";function c1($){let Z={},Q=$.replace(/\r\n?/g,`
+`).split(`
+`);for(let X=0;X<Q.length;X+=1){let J=(Q[X]??"").trim();if(!J||J.startsWith("#"))continue;let _=J.startsWith("export ")?J.slice(7).trimStart():J,z=_.indexOf("=");if(z<=0)throw Error(`Invalid env entry at line ${X+1}: expected KEY=value`);let G=_.slice(0,z).trim();if(!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(G))throw Error(`Invalid env key "${G}" at line ${X+1}`);let K=_.slice(z+1).trim();if(K.length>=2&&(K.startsWith('"')&&K.endsWith('"')||K.startsWith("'")&&K.endsWith("'"))){let H=K[0],D=K.slice(1,-1);Z[G]=H==='"'?D.replace(/\\(n|r|t|"|\\)/g,(U,I)=>{if(I==="n")return`
+`;if(I==="r")return"\r";if(I==="t")return"\t";return I}):D}else Z[G]=K}return Z}function i1($){return Object.entries($).map(([Z,Q])=>{let X=String(Q??"");if(!X||/[\s#"'\\]/.test(X))return`${Z}=${JSON.stringify(X)}`;return`${Z}=${X}`}).join(`
+`)}function n1($){try{let Z=atob($);return Uint8Array.from(Z,(Q)=>Q.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function r0($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("Secret content is not an object");return $}function I0($){return $.metadata.contentType??x2()}function w4($,Z){if(Z==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof $.data==="string")return $.data;if(Z==="jsonc")return JSON.stringify($.data,null,2);if(Z==="env")return i1(r0($.data));let Q=r0($.data).content;if(typeof Q!=="string")throw Error(`Secret ${Z} content must contain a string "content" field`);return Q}function t0($,Z){if(Z==="jsonc")return typeof $.data==="string"?S2($.data):$.data;if(Z==="env")return typeof $.data==="string"?c1($.data):r0($.data);if(Z==="text")return w4($,Z);if(Z==="binary"){let Q=r0($.data).content_base64;if(typeof Q!=="string")throw Error('Binary secret content must contain a "content_base64" string');return n1(Q)}throw Error(`Typed ${Z} decoding is not supported yet; use text() or bytes()`)}function C2($){return{format:$.format,mimeType:$.mimeType,...$.schemaUrl?{schemaUrl:$.schemaUrl}:{},typeId:$.id}}function k2($,Z){let Q=I0($);if(Q.format!==Z.format||Q.mimeType!==Z.mimeType)throw new w2(C2(Z),Q)}async function y2($,Z){if(!$.schema)return Z;let Q=await $.schema["~standard"].validate(Z);if(Q.issues){let X=Q.issues.map((Y)=>Y.message).join("; ");throw Error(`Secret validation failed for type "${$.id}": ${X}`)}return Q.value}function b$($){return{async text(){let Z=await $();return w4(Z,I0(Z).format)},async json(){let Z=await $(),Q=I0(Z).format;if(Q!=="jsonc")throw Error(`json() requires a jsonc secret; received ${Q}`);return t0(Z,Q)},async bytes(){let Z=await $(),Q=I0(Z).format;if(Q==="binary")return t0(Z,Q);return new TextEncoder().encode(w4(Z,Q))},async env(){let Z=await $(),Q=I0(Z).format;if(Q!=="env")throw Error(`env() requires an env secret; received ${Q}`);return t0(Z,Q)},async metadata(){return(await $()).metadata},async parse(Z){let Q=await $();return k2(Q,Z),y2(Z,t0(Q,Z.format))}}}function s1($){try{return new URL($).pathname}catch{return $.startsWith("/")?$:`/${$}`}}var f2=1e4,m2=1e4,g2=300,C4=crypto.randomUUID();async function o1($){await new Promise((Z)=>setTimeout(Z,$))}function p$($){return{startedAt:Date.now(),timeout:typeof $?.timeout==="number"&&$.timeout>0?$.timeout:void 0}}function x0($){if($.timeout===void 0)return;let Z=Date.now()-$.startedAt;return Math.max(0,$.timeout-Z)}function r$($,Z,Q){return Error(`LFV ${$} timed out after ${Q.timeout??0}ms for ${Z}`)}async function P0($,Z,Q,X,Y){let J=x0(Q);if(J!==void 0){if(J<=0)throw r$(X,Y,Q);let _=new AbortController,z=setTimeout(()=>_.abort(),J);try{return await fetch($,{...Z,signal:_.signal})}catch(G){if(G instanceof Error&&G.name==="AbortError")throw r$(X,Y,Q);throw G}finally{clearTimeout(z)}}return await fetch($,Z)}class T$ extends Error{constructor($){super(`LFV source closed while operating on ${$}`);this.name="LfvSourceClosedError"}}function e0($){return $ instanceof T$||$ instanceof Error&&$.name==="LfvSourceClosedError"}function o0($){try{let Z=JSON.parse($);return typeof Z==="object"&&Z!==null&&!Array.isArray(Z)?Z:void 0}catch{return}}async function a1($,Z,Q,X,Y,J,_,z,G,K){let H=0,D=Date.now();for(;;){if(K?.())throw new T$(X);let U=x0(Q);if(U!==void 0&&U<=0)throw r$(Y,X,Q);try{return await $()}catch(I){if(I instanceof T$)throw I;if(K?.())throw new T$(X);if(H+=1,_>0&&Date.now()-D>=_){let B=`Error connecting to the LFV source. Retries: '${H}'`;if(z)z(G,B,{url:Z,path:X,operation:Y});D=Date.now()}let L=U===void 0?J:Math.min(J,U);if(L<=0)throw r$(Y,X,Q);if(await o1(L),K?.())throw new T$(X)}}}function p2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function t1($){if(typeof $==="number"&&Number.isFinite($))return $;if(typeof $==="string"&&$.trim()){let Z=Date.parse($.trim());if(!Number.isNaN(Z))return Z}return}function r1($){return`[LFV] [${$??"-"}] [${new Date().toISOString()}]: `}function k4($,Z){if(typeof $!=="string"||$.trim()==="")throw Error(`LFV source requires "${Z}"`);return $}function d2($){return{...$,lfvServerUrl:k4($.lfvServerUrl,"lfvServerUrl"),clientId:k4($.clientId,"clientId"),path:k4($.path,"path")}}function S0($,Z){let Q=d2($),X=Q.log??b2,Y=(V,x,k)=>{let u=r1(V)+x;if(k!==void 0)X.debug(u,k);else X.debug(u)},J=(V,x,k)=>{let u=r1(V)+x;if(k!==void 0)X.warn(u,k);else X.warn(u)},_=Q.lfvServerUrl,z=Q.clientId,G=Q.path,K=Q.verifyJwks,H=typeof Q.deliveryTimeout==="number"&&Q.deliveryTimeout>0?Q.deliveryTimeout:void 0,D=typeof Q.retryInterval==="number"&&Q.retryInterval>0?Q.retryInterval:f2,U=typeof Q.warnInterval==="number"&&Q.warnInterval>=0?Q.warnInterval:m2,I=(typeof Q.callbackMaxAgeSeconds==="number"&&Q.callbackMaxAgeSeconds>0?Q.callbackMaxAgeSeconds:g2)*1000,L=typeof Q.cacheMaxAgeSeconds==="number"&&Q.cacheMaxAgeSeconds>0?Q.cacheMaxAgeSeconds*1000:void 0,B=K?.trim()?v2(K.trim()):void 0,R=s1(Q.deliveryEndpoint),E=s1(Q.eventsEndpoint),W=a0({lfvServerUrl:_,path:G}),F=crypto.randomUUID(),M=new Map,P=new Set,T=new Map,h=new Map,g=new Map,l=new Map,j=new Map,O=new Map,S=new Map,f=new Map,w=!1,d,i,X$,Y$=new Set,H$=()=>w;function c(V,x){T.set(V,x),h.set(V,Date.now())}function J$(V){T.delete(V),h.delete(V)}function _$(V){let x=T.get(V);if(!x)return;if(L!==void 0){let k=h.get(V)??0;if(Date.now()-k>L){Y(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:V});return}}return x}function V$(){return P.size>0||M.size>0||O.size>0||S.size>0}async function z$(){if(!Z||w||!V$()||i)return;if(X$)return X$;return X$=Z.subscribe(W,async(V)=>{if(w||V.originId===C4||V.key!==W)return;await S8(V)}).then((V)=>{if(w||!V$()){V();return}i=V}).finally(()=>{X$=void 0}),X$}function N(){if(w){if(d)d(),d=void 0;if(i)i(),i=void 0;return}let V=V$();if(V&&!d)d=l1(W,F,{trustId:B,onDelivery:async(x)=>{O4(x)},onEvents:async(x)=>{A4(x)}});if(!V&&d)d(),d=void 0;if(V)z$().catch((x)=>{J(void 0,"distributed callback subscription failed",{key:W,error:x instanceof Error?x.message:String(x)})});else if(i)i(),i=void 0}async function y(V,x,k,u){if(w)throw new T$(V);let t=k??crypto.randomUUID(),a=u??p$(),$$=new Promise((D$,k$)=>{let L$={resolve:D$,reject:k$},j$=x0(a);if(j$!==void 0){if(j$<=0){k$(r$("issueOtp",V,a));return}L$.timer=setTimeout(()=>{S.delete(t),N(),k$(r$("issueOtp",V,a))},j$)}S.set(t,L$),N()});$$.catch(()=>{});let Q$=()=>{let D$=S.get(t);if(!D$)return;if(D$.timer)clearTimeout(D$.timer);S.delete(t),N()};try{await z$()}catch(D$){throw Q$(),D$}let O$={request_id:t,path:V,action:x};Y(t,"OTP request",{path:V,action:x});let M$;try{M$=await a1(async()=>{return await P0(`${_.replace(/\/+$/g,"")}/clients/${z}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":t},body:JSON.stringify(O$)},a,"issueOtp",V)},_,a,V,"issueOtp",D,U,J,t,H$)}catch(D$){throw Q$(),D$}if(M$.status!==200&&M$.status!==202)throw Q$(),Error(`LFV OTP request failed (${M$.status}) for ${V}`);try{let D$=await $$;return Y(t,"OTP received via signed callback",{path:V,action:x}),D$}finally{Q$()}}async function m(V,x,k,u,t,a){if(w)throw new T$(x);let $$=t??crypto.randomUUID(),Q$=a??p$(),O$=await y(x,k,$$,Q$),M$=await a1(async()=>{return await P0(`${_.replace(/\/+$/g,"")}${V}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":$$},body:JSON.stringify({request_id:$$,otp:O$,path:x,...u??{}})},Q$,k,x)},_,Q$,x,k,D,U,J,$$,H$);if(M$.status!==200&&M$.status!==202)throw Error(`LFV ${k} failed (${M$.status}) for ${x}`);return Y($$,`${k} accepted`,{path:x,status:M$.status}),{requestId:$$}}async function r(V,x,k){if(w)throw new T$(V);let u=_$(V);if(u)return u;let t=f.get(V);if(t)return t;let a=e(V,x,k);f.set(V,a),a.catch(($$)=>{if(e0($$))Y(x,"read aborted: source closed",{path:V})});try{return await a}finally{f.delete(V)}}async function e(V,x,k){let u=k?.timeout??H,t={startedAt:Date.now(),timeout:typeof u==="number"&&u>0?u:void 0},a,$$=new Promise((L$,j$)=>{a={resolve:L$,reject:j$};let $0=O.get(V)??new Set;$0.add(a),O.set(V,$0),N()});$$.catch(()=>{});let Q$=()=>{if(!a)return;let L$=O.get(V);if(L$?.delete(a),L$&&L$.size===0)O.delete(V);N()},O$=x??crypto.randomUUID();Y(O$,"read_secret request",{path:V});let M$=0,D$=Date.now();for(;;){if(w)throw Q$(),new T$(V);try{await m("/secrets/request",V,"read_secret",void 0,O$,t),Y(O$,"read_secret accepted, awaiting delivery",{path:V});break}catch(L$){if(L$ instanceof T$)throw Q$(),L$;let j$=x0(t);if(j$!==void 0&&j$<=0)throw Q$(),r$("read_secret",V,t);if(M$+=1,U>0&&Date.now()-D$>=U)J(O$,`read_secret retrying. Retries: '${M$}'`,{path:V}),D$=Date.now();let $0=j$===void 0?D:Math.min(D,j$);if($0<=0)throw Q$(),r$("read_secret",V,t);await o1($0)}}let k$=x0(t);if(k$!==void 0){if(k$<=0)throw Q$(),Error(`LFV delivery timed out while reading ${V}`);let L$;try{return await Promise.race([$$,new Promise((j$,$0)=>{L$=setTimeout(()=>{Q$(),$0(Error(`LFV delivery timed out while reading ${V}`))},k$)})])}finally{if(L$)clearTimeout(L$)}}return await $$}function o(V,x,k){if(k!==void 0){let a=l.get(V);if(a!==void 0&&k<a){Y(void 0,"delivery ignored: stale version",{path:V,realVersion:k,lastAccepted:a});return}l.set(V,k)}c(V,x),Y$.delete(V);let u=x.metadata.version;if(g.get(V)===u)return;g.set(V,u);let t=M.get(V);if(!t)return;for(let a of t)a(x)}async function A(V,x){return await r(V,void 0,x)}async function q(V,x,k){if(!p2(x))throw Error(`putSecret requires an object value for LFV source at path ${V}`);let u=p$(k),t={data:x,...k?.contentType?{content_type:s0(k.contentType)}:{}};if(await b(V,k)){await m("/secrets/update",V,"update_secret",t,void 0,u),J$(V);return}await m("/secrets/create",V,"create_secret",t,void 0,u),J$(V)}async function v(V,x){let k=p$(x);await m("/secrets/delete",V,"delete_secret",void 0,void 0,k),J$(V)}async function C(V,x){let k=p$(x),u=crypto.randomUUID();Y(u,"list_paths request",{path:V});let t=await y(V,"list_paths",u,k),a=await P0(`${_.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":u},body:JSON.stringify({request_id:u,otp:t,path:V})},k,"listPaths",V);if(a.status!==200)throw Error(`LFV listPaths failed (${a.status}) for ${V}`);let $$=await a.json();if(!Array.isArray($$.items))throw Error(`LFV listPaths returned invalid payload for ${V}`);return Y(u,"list_paths success",{path:V,status:200}),$$.items.filter((Q$)=>typeof Q$==="string")}async function b(V,x){let k=p$(x),u=crypto.randomUUID();Y(u,"exists request",{path:V});let t=await y(V,"read_metadata",u,k),a=await P0(`${_.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":u},body:JSON.stringify({request_id:u,otp:t,path:V})},k,"exists",V);if(a.status!==200)throw Error(`LFV exists failed (${a.status}) for ${V}`);let $$=await a.json();if(typeof $$.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${V}`);return Y(u,"exists success",{path:V,status:200,exists:$$.exists}),$$.exists}async function n(V,x,k){let u=p$(k);await m("/secrets/rotate/request",V,"request_rotate",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,u)}async function p(V,x,k){let u=p$(k);await m("/secrets/revoke/request",V,"request_revoke",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,u)}async function Z$(V,x){let k=p$(x),u=crypto.randomUUID();Y(u,"getMetadata request",{path:V});let t=await y(V,"read_metadata",u,k),a=await P0(`${_.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":u},body:JSON.stringify({request_id:u,otp:t,path:V})},k,"getMetadata",V);if(a.status!==200)throw Error(`LFV getMetadata failed (${a.status}) for ${V}`);let $$=await a.json();if(!$$.metadata||typeof $$.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${V}`);return Y(u,"getMetadata success",{path:V,status:200}),$$.metadata}async function s(V,x,k){let u=M.get(V)??new Set,t,a=(Q$)=>{if(Q$.metadata.version===t)return;t=Q$.metadata.version,x(Q$)};u.add(a),M.set(V,u);let $$=_$(V);if($$)a($$),g.set(V,$$.metadata.version);else try{a(await A(V,k))}catch(Q$){if(u.delete(a),u.size===0)M.delete(V);throw Q$}return N(),await z$(),()=>{let Q$=M.get(V);if(!Q$)return;if(Q$.delete(a),Q$.size===0)M.delete(V);N()}}function F$(V){return V.method==="POST"&&new URL(V.url).pathname===R}function G$(V){return V.method==="POST"&&new URL(V.url).pathname===E}function e$(V){let x=V.data?.metadata?.path;if(typeof x==="string"&&x)return x;if(typeof V.path==="string"&&V.path)return V.path;return}function f$(V,x){let k=O.get(V);if(!k||k.size===0)return!1;O.delete(V),N();for(let u of k)u.resolve(x);return!0}function q0(V){let{request_id:x,otp:k}=V;if(typeof x!=="string"||typeof k!=="string"||!k)return{handled:!1};let u=S.get(x);if(!u)return{handled:!1};if(u.timer)clearTimeout(u.timer);return S.delete(x),N(),u.resolve(k),{handled:!0}}function O4(V){if(V.type==="otp")return q0(V);let x=e$(V);if(!x)return Y(V.request_id,"delivery ignored: no path",{}),{handled:!1};let k=V.data?.metadata??{},u=typeof k.version==="number"?k.version:void 0,t=Y0(k),a=k.created_time??k.created,$$={data:V.data?.data??{},metadata:{path:x,version:u??0,created:typeof a==="string"?new Date(a):new Date,...t?{contentType:t}:{}}};o(x,$$,u);let Q$=f$(x,$$);return Y(V.request_id,"delivery applied",{path:x,handled:Q$}),{handled:Q$}}function s$(V="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:V}),{status:401,headers:{"Content-Type":"application/json"}})}function q1(V){return{requestId:V.headers.get("X-LFV-Request-Id")??V.headers.get("x-lfv-request-id")??"",keyId:V.headers.get("X-LFV-Key-Id")??V.headers.get("x-lfv-key-id")??"",signature:V.headers.get("X-LFV-Signature")??V.headers.get("x-lfv-signature")??""}}async function N4(V,x){if(!K?.trim())return J(void 0,"LFV callback rejected: verifyJwks is not configured"),s$("LFV callback verification is not configured");let{requestId:k,keyId:u,signature:t}=x;if(!k.trim()||!u.trim()||!t.trim())return J(k||void 0,"LFV callback rejected: missing signature headers"),s$("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await h2({jwks:K,kid:u,signatureB64Url:t.trim(),requestId:k.trim(),rawBody:V}))return J(k,"LFV callback rejected: signature verification failed"),s$();let $$=o0(V);if(!$$)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let Q$=$$;if(Q$.request_id!==k.trim())return J(k,"LFV callback rejected: request_id header/body mismatch"),s$("X-LFV-Request-Id does not match request_id in body");let O$=Date.now(),M$=t1(Q$.issued_at);if(M$===void 0)return J(k,"LFV callback rejected: missing or invalid issued_at"),s$("Missing or invalid issued_at");if(O$-M$>I)return J(k,"LFV callback rejected: stale (outside freshness window)"),s$("Callback is stale (issued_at outside freshness window)");let D$=t1(Q$.expires_at);if(D$!==void 0&&O$>D$)return J(k,"LFV callback rejected: expired"),s$("Callback has expired");let k$=t.trim();for(let[L$,j$]of j)if(j$<=O$)j.delete(L$);if(j.has(k$))return J(k,"LFV callback rejected: replayed signature"),s$("Callback signature already processed (replay)");return j.set(k$,M$+I),null}async function S8(V){let x=await N4(V.rawBody,V.headers);if(x){J(V.headers.requestId,"distributed LFV callback rejected",{key:V.key,status:x.status});return}let k=o0(V.rawBody);if(!k)return;if(V.kind==="delivery"){let t=k;O4(t),await x4(V.key,t,F,B);return}let u=k;if(!u.path||typeof u.path!=="string")return;A4(u),await S4(V.key,u,F,B)}async function w8(V){let x=await V.text(),k=q1(V),u=await N4(x,k);if(u)return u;let t=o0(x);if(!t)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let a=t,$$=e$(a);Y(a.request_id,"delivery received",{path:$$});let Q$=O4(a),O$=$$?a0({lfvServerUrl:_,path:$$}):W,M$=await x4(O$,a,F,B);try{await Z?.publish({kind:"delivery",key:O$,originId:C4,rawBody:x,headers:k})}catch(D$){return j.delete(k.signature.trim()),J(k.requestId,"distributed callback publish failed; callback may be retried",{key:O$,error:D$ instanceof Error?D$.message:String(D$)}),new Response(JSON.stringify({error:"callback_transport_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(!Q$.handled&&M$===0)return new Response(JSON.stringify({status:"accepted",note:"unmapped_delivery"}),{status:200,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function A4(V){if(w)return;if(!V?.path||typeof V.path!=="string")return;Y(V.request_id,"events payload",{path:V.path,event:V.event});for(let x of P)try{x({path:V.path,event:V.event,requestId:V.request_id,issuedAt:V.issued_at,expiresAt:V.expires_at})}catch(k){J(V.request_id,"secret event listener failed",{path:V.path,event:V.event,error:k instanceof Error?k.message:String(k)})}if(V.event==="created"||V.event==="updated"||V.event==="rotated"||V.event==="revoked")J$(V.path),r(V.path,V.request_id).catch((x)=>{if(e0(x)){Y(V.request_id,"event refresh aborted: source closed",{path:V.path});return}Y$.add(V.path),J(V.request_id,"event-triggered refresh failed; source marked degraded",{path:V.path,event:V.event,error:x instanceof Error?x.message:String(x)})})}async function C8(V){let x=await V.text(),k=q1(V),u=await N4(x,k);if(u)return u;let t=o0(x);if(!t)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let a=t;if(!a?.path||typeof a.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});Y(a.request_id,"events received",{path:a.path,event:a.event}),A4(a);let $$=a0({lfvServerUrl:_,path:a.path});await S4($$,a,F,B);try{await Z?.publish({kind:"events",key:$$,originId:C4,rawBody:x,headers:k})}catch(Q$){return j.delete(k.signature.trim()),J(k.requestId,"distributed callback publish failed; callback may be retried",{key:$$,error:Q$ instanceof Error?Q$.message:String(Q$)}),new Response(JSON.stringify({error:"callback_transport_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function k8(){if(w)return;if(w=!0,d)d(),d=void 0;if(i)i(),i=void 0;let V=new T$(G);for(let x of O.values())for(let k of x)try{k.reject(V)}catch{}O.clear();for(let x of S.values()){if(x.timer)clearTimeout(x.timer);try{x.reject(V)}catch{}}S.clear(),f.clear(),Y$.clear(),T.clear(),h.clear(),g.clear(),l.clear(),j.clear(),M.clear(),P.clear()}return{type:"vault",isAvailable:()=>Y$.size===0,get:(V,x)=>b$(()=>A(V,x)),getFullSecret:A,getSecret:async(V,x)=>{return(await A(V,x)).data},putSecret:q,deleteSecret:v,listPaths:C,exists:b,requestRotate:n,requestRevoke:p,getMetadata:Z$,subscribe:s,subscribeEvents:(V)=>{return P.add(V),N(),()=>{P.delete(V),N()}},close:k8,isDeliveryRequest:F$,isEventsRequest:G$,handleDelivery:w8,handleEvents:C8,deliveryPath:R,eventsPath:E,callbackKey:W,trustId:B}}function J0($,Z,Q){if(typeof $!=="string"||$.trim()==="")throw Error(`"${Z}" is required when using ${Q}`);return $}var $4="__esLfvBootstrap";import{withDefaultExternalId as u2}from"@ionite/core/server";function Z4($){return[$.tenantId??"_",$.destination,$.resourceType,$.externalId].join("\x00")}class Q4{map=new Map;async get($){return this.map.get(Z4($))}async set($,Z){this.map.set(Z4($),Z)}async delete($){this.map.delete(Z4($))}}function y4($){return $==="user"?"Users":"Groups"}function b4($){return $.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class X4{baseUrl;getToken;idMapStore;tenantId;log;fetchImpl;inflight=new Map;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.getToken=$.getToken,this.idMapStore=$.idMapStore,this.tenantId=$.tenantId,this.log=$.log,this.fetchImpl=$.fetchImpl??((Z,Q)=>fetch(Z,Q))}async headers(){let $=await this.getToken();return new Headers({"Content-Type":"application/scim+json",Accept:"application/scim+json",Authorization:`Bearer ${$}`})}inflightKey($,Z){return`${$}\x00${Z}`}async resolveProviderId($,Z,Q){let X={tenantId:this.tenantId,destination:this.baseUrl,resourceType:$,externalId:Z},Y=await this.idMapStore.get(X);if(Y)return{found:Y};let J=this.inflightKey($,Z),_=this.inflight.get(J);if(_)return _;let z=this.resolveUncached($,Z,Q).then(async(G)=>{if(typeof G==="object")await this.idMapStore.set(X,G.found);return G}).finally(()=>{this.inflight.delete(J)});return this.inflight.set(J,z),z}async resolveUncached($,Z,Q){let X=await this.filterByExternalId($,Z);if(X!=="absent")return X;if(!Q)return"absent";return this.create($,Z,Q)}async filterByExternalId($,Z){let Q=encodeURIComponent(`externalId eq "${b4(Z)}"`),X=`${this.baseUrl}/${y4($)}?filter=${Q}`,Y=await this.fetchImpl(X,{method:"GET",headers:await this.headers()});if(!Y.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:$,status:Y.status}),"error";let _=((await Y.json()).Resources??[])[0]?.id;return _?{found:_}:"absent"}async create($,Z,Q){let X=`${this.baseUrl}/${y4($)}`,Y=$==="user"?{schemas:["urn:ietf:params:scim:schemas:core:2.0:User"],userName:Q.userName??Z,externalId:Z,displayName:Q.displayName,active:!0}:{schemas:["urn:ietf:params:scim:schemas:core:2.0:Group"],displayName:Q.displayName??Z,externalId:Z},J=await this.fetchImpl(X,{method:"POST",headers:await this.headers(),body:JSON.stringify(Y)});if(!J.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:$,status:J.status}),"error";let _=await J.json();return _.id?{found:_.id}:"error"}async invalidate($,Z){await this.idMapStore.delete({tenantId:this.tenantId,destination:this.baseUrl,resourceType:$,externalId:Z})}async patchGroupMembership($){let{groupExternalId:Z,userExternalId:Q,op:X}=$,Y=await this.resolveProviderId("user",Q,X==="add"?$.userCreate:void 0);if(Y==="error")return this.log.warn("IAM delta: user lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(Y==="absent")return this.log.warn("IAM delta: user not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let J=Y.found,_=async(K)=>{let H=await this.resolveProviderId("group",Z,X==="add"&&K?$.groupCreate:void 0);if(H==="error")return{kind:"error"};if(H==="absent")return{kind:"absent"};let D=`${this.baseUrl}/${y4("group")}/${encodeURIComponent(H.found)}`,U=X==="add"?[{op:"add",path:"members",value:[{value:J}]}]:[{op:"remove",path:`members[value eq "${b4(J)}"]`}];return{kind:"response",response:await this.fetchImpl(D,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:["urn:ietf:params:scim:api:messages:2.0:PatchOp"],Operations:U})})}},z=await _(!0);if(z.kind==="response"&&(z.response.status===404||z.response.status===410))await this.invalidate("group",Z),z=await _(!1);if(z.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(z.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let G=z.response;if(!G.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X,status:G.status}),"error";return"pushed"}}function v4($){if(typeof $==="string")return $;if($&&typeof $==="object"&&"id"in $)return $.id;return}function e1($){return $&&typeof $==="object"?$:void 0}function h4($){let Z={},Q={},X,Y,J,_,z,G,K=new Promise((W)=>{G=W}),H=()=>{if(!Z.url||!Q.workload)return!1;return Z.mode==="patch"&&Boolean(Q.idMapStore)},D=()=>{if(G&&H())G(),G=void 0},U=async()=>{let W=Q.workload;if(!W)throw Error("IAM delta: workload identity not configured");if(Z.audience&&typeof W.getToken==="function")return W.getToken(Z.audience);if(typeof W.getServerToken==="function")return W.getServerToken();return W.getToken()},I=()=>{if(!H()||!Z.url||!Q.idMapStore)return;let W=`${Z.tenantId??"_"}\x00${Z.url}`;if(X&&Y===W&&J===Q.idMapStore&&_===Q.fetchImpl)return X;return X=new X4({baseUrl:Z.url,getToken:U,idMapStore:Q.idMapStore,tenantId:Z.tenantId,log:$,fetchImpl:Q.fetchImpl}),Y=W,J=Q.idMapStore,_=Q.fetchImpl,X},L=async(W)=>{let M=e1(W.subject);if(!M){let T=v4(W.subject);if(T&&Q.userStore)M=await Q.userStore.get(T)}let P=M?.externalId;if(!P)return;return{externalId:P,create:{userName:M?.userName??P,displayName:M?.displayName??M?.name}}},B=async(W)=>{let M=e1(W.target);if(!M){let T=v4(W.target);if(T&&Q.catalogStore)M=await Q.catalogStore.groups.get(T);if(T&&!M)M=u2(await Q.resources?.entitlement?.(T))}let P=M?.externalId;if(!P)return;return{externalId:P,create:{displayName:M?.displayName??M?.name??P}}},R=async(W,F)=>{if(!H())return"skipped";if(W.targetType!=="group")return $.debug("IAM delta: non-group target skipped (not representable as SCIM membership)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",targetType:W.targetType}),"skipped";let M=await L(W),P=await B(W);if(!M||!P)return $.warn("IAM delta: missing externalId on subject or target; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:F,hasSubject:Boolean(M),hasGroup:Boolean(P)}),"skipped";let T=I();if(!T)return"skipped";return T.patchGroupMembership({groupExternalId:P.externalId,userExternalId:M.externalId,op:F,groupCreate:P.create,userCreate:M.create})},E={async onGrant(W){if(!H())return;if(await R(W,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(W){if(!H())return;if(await R(W,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async reconcile(W){let F={pushed:0,skipped:0,errors:[]};if(!H())return F.errors.push("iam delta not ready"),F;for await(let M of W)try{let P=await R(M,"add");if(P==="pushed")F.pushed+=1;else if(P==="error")F.errors.push(`IAM delta: destination rejected membership push for ${v4(M.target)??"unknown"}`);else F.skipped+=1}catch(P){F.errors.push(P instanceof Error?P.message:String(P))}return F},isReady:H,ready(W){if(H())return Promise.resolve();if(!W||W<=0)return K;return Promise.race([K,new Promise((F,M)=>setTimeout(()=>M(Error("IAM delta readiness timeout")),W))])}};return{update(W,F){if(Z=W,!F.idMapStore)z??=new Q4;return Q={...F,idMapStore:F.idMapStore??z},I(),D(),E}}}var f4=1,l2=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."}];import{IoniteError as c2}from"@ionite/core";function i2($){if($ instanceof c2)return{status:$.status,statusText:$.statusText};if(typeof $!=="object"||$==null)return;let Z=$,Q=typeof Z.status==="number"?Z.status:void 0,X=typeof Z.statusText==="string"?Z.statusText:void 0;return Q!=null||X?{status:Q,statusText:X}:void 0}function L0($){if($ instanceof Response)return $;let Z=i2($);if(!Z)return Response.json({error:"internal_error"},{status:500});let X={status:Z.status??500};if(Z.statusText)X.statusText=Z.statusText;return Response.json({error:Z.statusText??"internal_error"},X)}function K$(){return Response.json({error:"not_found"},{status:404})}function W0($=["GET"]){return Response.json({error:"method_not_allowed",allow:$},{status:405,headers:{Allow:$.join(", ")}})}import{timingSafeEqual as n2}from"node:crypto";import{parseKmsPoolDocument as s2,stableConfigHash as Z6}from"@ionite/core";function $6($,Z,Q){for(let X of $)try{X()}catch(Y){Z.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:Q,error:Y instanceof Error?Y.message:String(Y)})}}function w$($,Z){let Q=new Set,X=new Set;return{beforeChange(Y){return Q.add(Y),()=>{Q.delete(Y)}},afterChange(Y){return X.add(Y),()=>{X.delete(Y)}},emitBefore(){$6(Q,$,`${Z} beforeChange`)},emitAfter(){$6(X,$,`${Z} afterChange`)}}}var a2=604800000,t2=2147483647;function X6($,Z){if(!$.value)return!1;if($.notBefore&&Date.parse($.notBefore)>Z)return!1;if($.notAfter&&Date.parse($.notAfter)<=Z)return!1;return!0}function v$($,Z=Date.now()){if(!$)return;let Q=$.keys.find((X)=>X.id===$.active&&X.state==="active");return Q&&X6(Q,Z)?Q:void 0}function r2($,Z=Date.now()){if(!$)return[];return $.keys.filter((Q)=>(Q.state==="active"||Q.state==="deprecated")&&X6(Q,Z))}function Q6($){return{...$,...$.meta?{meta:{...$.meta}}:{}}}function o2($,Z,Q){if(!Z||Z<=0)return $;return new Promise((X,Y)=>{let J=setTimeout(()=>Y(Error(Q)),Z);$.then((_)=>{clearTimeout(J),X(_)},(_)=>{clearTimeout(J),Y(_)})})}function e2($,Z){let Q=Buffer.from($),X=Buffer.from(Z);return Q.length===X.length&&n2(Q,X)}var Y6=new WeakMap;function J6($){return Y6.get($)?.()}function $9($,Z,Q){let X=w$(Z,`KMS pool "${$}"`),Y=new Set,J=new Set,_=!1,z,G,K=0,H,D,U,I=W$(`KMS pool "${$}"`,()=>_&&v$(z)!==void 0),L=()=>{let T=v$(z);for(let h of Y)try{h(T?Q6(T):void 0)}catch(g){Z.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:$,error:g instanceof Error?g.message:String(g)})}},B=()=>{if(D)clearTimeout(D);D=void 0},R=()=>{U=void 0},E=()=>{let T=U;if(!T)return;if(!_){R(),T.reject(Error(`KMS pool "${$}" is no longer configured.`));return}let h=v$(z);if(h?.value){R(),T.resolve(h.value);return}},W=()=>{B();let T=Date.now();if(z){for(let g of z.keys){if(!g.notAfter)continue;let l=Date.parse(g.notAfter)-T;if(l>0&&l<=a2&&(g.state==="active"||g.state==="deprecated")&&!J.has(g.id))J.add(g.id),Z.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:$,keyId:g.id,notAfter:g.notAfter})}let h=z.keys.flatMap((g)=>[g.notBefore,g.notAfter]).filter((g)=>Boolean(g)).map((g)=>Date.parse(g)).filter((g)=>g>T).sort((g,l)=>g-l);if(h[0])D=setTimeout(()=>{let g=v$(z)?.id;I.refresh(),Q();let l=v$(z)?.id;if(g!==l)L();W()},Math.min(h[0]-T+1,t2))}I.refresh(),Q(),E()},F=(T)=>{let h=v$(z);X.emitBefore();try{z=s2(T),W();let g=v$(z);if(h?.id!==g?.id||h?.value!==g?.value)L()}catch(g){z=void 0,W(),L(),Z.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:$,error:g instanceof Error?g.message:String(g)})}finally{X.emitAfter()}},M=()=>{try{H?.()}catch(T){Z.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:$,error:T instanceof Error?T.message:String(T)})}H=void 0},P={value(T){let h=v$(z);if(!_)return Promise.reject(Error(`KMS pool "${$}" is no longer configured.`));if(h?.value)return Promise.resolve(h.value);if(!U){let l,j;U={promise:new Promise((S,f)=>{l=S,j=f}),resolve:l,reject:j}}let g=U.promise;return E(),o2(g,T,`KMS pool "${$}" was not ready within ${T}ms.`)},accepts:(T)=>r2(z).some((h)=>h.value!==void 0&&e2(T,h.value)),subscribe(T){Y.add(T);let h=v$(z);return T(h?Q6(h):void 0),()=>Y.delete(T)},beforeChange:X.beforeChange,afterChange:X.afterChange,isReady:I.isReady,ready:I.ready};return Y6.set(P,()=>v$(z)?.value),{api:P,update(T,h,g){let l=Z6({config:T,path:g});if(_=!0,G===l){I.refresh();return}G=l,K+=1;let j=K;M(),B(),z=void 0,I.refresh(),Q(),L(),E(),h.subscribe(g,(O)=>{if(K!==j||!_)return;F(O.data)}).then((O)=>{if(K!==j||!_){O();return}H=O}).catch((O)=>{if(K!==j||!_)return;z=void 0,I.refresh(),Q(),L(),E(),Z.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:$,path:g,error:O instanceof Error?O.message:String(O)})})},unavailable(T){_=!0,G=Z6(T),K+=1,M(),B(),z=void 0,I.refresh(),Q(),L(),E()},remove(){if(!_)return;X.emitBefore(),_=!1,G=void 0,K+=1,M(),B(),z=void 0,I.refresh(),Q(),L(),E(),X.emitAfter()},close(){_=!1,K+=1,M(),B(),Y.clear(),z=void 0,E(),I.settle()},isConfigured:()=>_}}function G6($){let Z=new Map,Q=new Map,X=w$($,"KMS"),Y=!1,_=W$("KMS module",()=>Y&&Array.from(Z.values()).every((D)=>!D.isConfigured()||D.api.isReady())),z,G=()=>_.refresh(),K=(D)=>{let U=Z.get(D);if(U)return U;let I=$9(D,$,G);if(Z.set(D,I),!(D in z))Object.assign(z,{[D]:I.api});return I},H=(D)=>{let U=Z.get(D);if(!U)throw Error(`KMS pool "${D}" is not configured.`);return U.api};return z={get config(){return Object.fromEntries(Q)},beforeChange:X.beforeChange,afterChange:X.afterChange,isReady:_.isReady,ready:_.ready,listPools:()=>Array.from(Q.keys()),getPool:H},{handle:()=>z,update(D,U){if(!D&&!Y&&Z.size===0)return;X.emitBefore(),Y=D!==void 0;let I=new Set(Object.keys(D??{}));for(let[L,B]of Object.entries(D??{})){Q.set(L,{...B});let R=B.path??`/kms/${L}`;try{K(L).update(B,U(B),R)}catch(E){K(L).unavailable(B),$.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:L,error:E instanceof Error?E.message:String(E)})}}for(let[L,B]of Z){if(I.has(L))continue;Q.delete(L),B.remove()}return _.refresh(),X.emitAfter(),Y||Z.size>0?z:void 0},close(){for(let D of Z.values())D.close();Z.clear(),Q.clear(),Y=!1,_.settle()}}}import{context as Z9,trace as Q9}from"@opentelemetry/api";import{logs as X9,SeverityNumber as O0}from"@opentelemetry/api-logs";import{OTLPLogExporter as Y9}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as J9}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as G9}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as _9}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as z9}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as K9}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as H9}from"@opentelemetry/resources";import{BatchLogRecordProcessor as B9}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as D9}from"@opentelemetry/sdk-metrics";import{NodeSDK as U9}from"@opentelemetry/sdk-node";var _6={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},V9={trace:!1,debug:!1,info:!0,warn:!0,error:!0};function m4($,Z){let Q=Z[$];if(Q===!1)return!1;if($==="metrics")return Q===!0||typeof Q==="object";return!0}function g4($){return typeof $==="object"&&$!==null?$:void 0}function F9($){return typeof $==="object"&&$!==null?$:void 0}function M9($,Z){let Q=$.replace(/\/+$/,"");if(Q.endsWith(_6[Z]))return Q;return`${Q}${_6[Z]}`}function L9($,Z){let Q=g4($[Z]);if(Q?.endpoint)return Q.endpoint;if(!$.endpoint)return;return M9($.endpoint,Z)}function W9($,Z,Q){let X=g4($[Z]),Y={...$.headers,...X?.headers??{}};if(Q)Y.Authorization=`Bearer ${Q}`;return Y}function p4($,Z,Q){let X=g4($[Z]);return{url:L9($,Z),headers:W9($,Z,Q),timeoutMillis:X?.timeoutMillis,concurrencyLimit:X?.concurrencyLimit}}function O9($,Z){let Q=p4($,"traces",Z);return $.protocol==="http/json"?new z9(Q):new K9(Q)}function N9($,Z){let Q=p4($,"metrics",Z);return $.protocol==="http/json"?new G9(Q):new _9(Q)}function A9($,Z){let Q=p4($,"logs",Z);return $.protocol==="http/json"?new Y9(Q):new J9(Q)}function E9($){return{"service.name":$.name,...$.version?{"service.version":$.version}:{},...$.deploymentEnvironment?{"deployment.environment.name":$.deploymentEnvironment}:{},...$.resourceAttributes??{}}}async function j9($){if(!$.oauth)return;let Z=new URLSearchParams({grant_type:"client_credentials",client_id:$.oauth.clientId,client_secret:$.oauth.clientSecret});if($.oauth.scope)Z.set("scope",$.oauth.scope);if($.oauth.audience)Z.set("audience",$.oauth.audience);let Q=await fetch($.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...$.oauth.headers??{}},body:Z});if(!Q.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${Q.status}`);let X=await Q.json();if(typeof X.access_token!=="string"||!X.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return X.access_token}function q9($,Z){return{...V9,...Z?.levels??{},...$.levels??{}}}function C0($,Z="Authorization"){let Q={...$.headers??{}};if(!$.apiKey)return Q;let X=$.apiKeyHeader??Z;return Q[X]=X.toLowerCase()==="authorization"?`Bearer ${$.apiKey}`:$.apiKey,Q}function R9($,Z){return Object.keys($).some((Q)=>Q.toLowerCase()===Z.toLowerCase())}function H6($,Z,Q){let X=Object.keys($).find((Y)=>Y.toLowerCase().startsWith(Z.toLowerCase()));if(X)throw Error(`OpenTelemetry provider "${Q}" does not support provider-specific header "${X}".`)}function k0($,Z,Q,X){return{type:Q,name:$.name,version:$.version,protocol:$.protocol??"http/protobuf",endpoint:$.endpoint,headers:X,resourceAttributes:E9($),levels:q9($,Z),traces:$.traces,metrics:$.metrics,logs:$.logs}}function T9($,Z){return k0($,Z,"otlp",C0($))}function I9($,Z){return k0($,Z,"grafana-lgtm",C0($))}function P9($,Z){let Q=C0($,"DD-API-KEY");if(!R9(Q,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return k0($,Z,"datadog",Q)}function x9($,Z){let Q=C0($);return H6(Q,"DD-","splunk"),k0($,Z,"splunk",Q)}function S9($,Z){let Q=C0($);return H6(Q,"DD-","elastic"),k0($,Z,"elastic",Q)}function w9($,Z){let Q=$.type??"otlp";switch(Q){case"otlp":return T9($,Z);case"grafana-lgtm":return I9($,Z);case"datadog":return P9($,Z);case"splunk":return x9($,Z);case"elastic":return S9($,Z);default:throw Error(`Unsupported OpenTelemetry provider type: ${Q}`)}}function C9($,Z){if(typeof $==="string")return $;if($ instanceof Error)return $.message;if($!=null)return w0($);if(Z.length===0)return"";return w0(Z[0])}function w0($){if(typeof $==="string")return $;try{return JSON.stringify($)}catch{return String($)}}function z6($,Z,Q){if(Q==null)return;if(typeof Q==="string"||typeof Q==="number"||typeof Q==="boolean"){$[Z]=Q;return}if(Array.isArray(Q)&&Q.every((X)=>["string","number","boolean"].includes(typeof X))){$[Z]=Q;return}if(Q instanceof Error){if($[`${Z}.name`]=Q.name,$[`${Z}.message`]=Q.message,Q.stack)$[`${Z}.stack`]=Q.stack;return}$[Z]=w0(Q)}function k9($){let Z={};for(let[X,Y]of $.entries()){if(Y&&typeof Y==="object"&&!Array.isArray(Y)&&!(Y instanceof Error)&&Object.getPrototypeOf(Y)===Object.prototype){for(let[J,_]of Object.entries(Y))z6(Z,J,_);continue}z6(Z,`param.${X}`,Y)}let Q=Q9.getSpanContext(Z9.active());if(Q)Z.trace_id=Q.traceId,Z.span_id=Q.spanId,Z.trace_flags=Q.traceFlags;return Z}function y9($){return $}function b9($){let Z=typeof $.body==="string"?$.body:w0($.body),Q=$.attributes??{};if(Object.keys(Q).length===0)return Z;return`${Z} ${w0(Q)}`}function B6($,Z){globalThis.console[y9($)](b9(Z))}function v9($,Z){if((Z.severityNumber??0)<O0.INFO)return;B6($,Z)}function h9($,Z,Q){let X=Q?.console;if(X===!1)return;if(typeof X==="function"){X(Z);return}if(X===!0){B6($,Z);return}v9($,Z)}function f9($,Z){let Q=X9.getLogger($.name,$.version),X=(Y,J,_)=>{if(!$.levels[Y])return;let z={severityNumber:J,severityText:Y.toUpperCase(),body:C9(_[0],_.slice(1)),attributes:k9(_.slice(1))};try{Q.emit(z)}finally{h9(Y,z,Z)}};return{trace:(Y,...J)=>X("trace",O0.TRACE,[Y,...J]),debug:(Y,...J)=>X("debug",O0.DEBUG,[Y,...J]),info:(Y,...J)=>X("info",O0.INFO,[Y,...J]),warn:(Y,...J)=>X("warn",O0.WARN,[Y,...J]),error:(Y,...J)=>X("error",O0.ERROR,[Y,...J])}}function m9($){if(!$?.isReady())return;return J6($)}function g9($,Z,Q){let X=Z;return $.subscribe((Y)=>{let J=Y?.value;if(J===X)return;X=J,Q()})}function K6($){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:$,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function d4($,Z,Q,X){if(!Z&&!Q)return;if(!Z)return K6($);let Y=Z,J;if(Y.apiKeyPool&&X)try{J=X.getPool(Y.apiKeyPool)}catch{J=void 0}let _=m9(J),z=()=>d4($,Y,Q,X),G=Y.apiKeyPool&&X?(W)=>g9(X.getPool(Y.apiKeyPool),_,W):void 0;if(Y.apiKeyPool&&!_){let W=K6($);return W.onCredentialChange=G,W.rebuild=z,W}let K=_?{...Y,apiKey:_}:Y,H=w9(K,Q),D,U=!1,I=f9(H,Q),L,B,R=new Promise((W,F)=>{L=W,B=F});async function E(){try{let W=await j9(Y),F={resource:H9(H.resourceAttributes),instrumentations:Q?.instrument};if(Q?.sampler)F.sampler=Q.sampler;if(Q?.textMapPropagator)F.textMapPropagator=Q.textMapPropagator;if(Q?.contextManager)F.contextManager=Q.contextManager;if(Q?.spanProcessors)F.spanProcessors=Q.spanProcessors;else if(m4("traces",H))F.traceExporter=O9(H,W);if(Q?.metricReaders)F.metricReaders=Q.metricReaders;else if(m4("metrics",H)){let P=F9(H.metrics);F.metricReaders=[new D9({exporter:N9(H,W),exportIntervalMillis:P?.exportIntervalMillis,exportTimeoutMillis:P?.exportTimeoutMillis})]}if(Q?.logRecordProcessors)F.logRecordProcessors=Q.logRecordProcessors;else if(m4("logs",H))F.logRecordProcessors=[new B9({exporter:A9(H,W)})];let M=Q?.configure?.(F);D=new U9(M??F),D.start(),U=!0,L?.()}catch(W){U=!1;let F=W instanceof Error?W:Error(String(W));$.error?.("OpenTelemetry startup failed",F),B?.(F)}finally{L=void 0,B=void 0}}return{state:"available",start:E,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>U,ready:(W)=>{if(!W||W<=0)return R;return Promise.race([R,new Promise((F,M)=>{setTimeout(()=>M(Error(`OpenTelemetry ready timed out after ${W}ms.`)),W)})])},logger:I,forceFlush:async()=>{await D?.forceFlush?.()},shutdown:async()=>{U=!1,await D?.shutdown(),D=void 0},onCredentialChange:G,rebuild:z}}function D6($){let Z,Q,X,Y=0,J=Promise.resolve(),_=w$($,"OpenTelemetry"),z=W$("OpenTelemetry module",()=>Z?.isReady()===!0),G={beforeChange:_.beforeChange,afterChange:_.afterChange,isReady:z.isReady,ready:z.ready,logger:{trace:(D,...U)=>(Z?.logger??$).trace(D,...U),debug:(D,...U)=>(Z?.logger??$).debug(D,...U),info:(D,...U)=>(Z?.logger??$).info(D,...U),warn:(D,...U)=>(Z?.logger??$).warn(D,...U),error:(D,...U)=>(Z?.logger??$).error(D,...U)},forceFlush:async()=>{await Z?.forceFlush()},shutdown:async()=>{await Z?.shutdown()}},K=!1,H;return H={update(D){if(!D){if(Z||Q){let B=Z,R=Q;Y+=1,_.emitBefore(),X?.(),X=void 0,Z=void 0,Q=void 0,z.refresh(),J=Promise.all([B?.shutdown(),R?.shutdown()]).finally(()=>_.emitAfter()).then(()=>{return},()=>{return})}return K?G:void 0}if(K=!0,D===Z||D===Q)return G;let U=Z,I=Q;Y+=1;let L=Y;return _.emitBefore(),X?.(),X=void 0,Z=void 0,Q=D,z.refresh(),J=(async()=>{try{if(await Promise.all([U?.shutdown(),I?.shutdown()]),await D.start(),L!==Y||Q!==D){await D.shutdown();return}Z=D,Q=void 0,z.refresh(),X=D.onCredentialChange?.(()=>{if(Z!==D)return;let B=D.rebuild?.();if(B)H.update(B)})}finally{if(L===Y)_.emitAfter()}})().then(()=>{return},()=>{return}),G},settled(){return J},async shutdown(){Y+=1;let D=Z,U=Q;X?.(),X=void 0,Z=void 0,Q=void 0,z.settle(),await Promise.all([D?.shutdown(),U?.shutdown()])}},H}import{ION_ENDPOINT_PERMISSIONS as u4,trimTrailingSlash as U6}from"@ionite/core";import{hasPermission as p9}from"@ionite/core/server";async function G0($,Z,Q){let X=await p9($,Z,Q.permission,void 0,Q.subjectType);return X.allow?void 0:X.response()}function d9($){let Z=U6($);return{matchesPath:(Y)=>{if(!Y)return!1;return U6(Y)===Z},startsWithPath:(Y)=>{if(!Y)return!1;return $===Y||$.startsWith(`${Y}/`)}}}function V6($,Z,Q,X){let Y=X??new URL($.url).pathname,{matchesPath:J,startsWithPath:_}=d9(Y);if(Z.sso){let z=Z.sso;if(J(Q.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(G)=>z.handler(G)};if(J(Q.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(G)=>z.logout(G)};if(J(Q.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(G)=>z.logoutBackChannel(G)};if(J(Q.sso.loginUrl)||J(Q.sso.refreshUrl)||J(Q.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(G)=>z.handler(G)}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(G)=>{let K=await z.resolveCustomer(G);if(K.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(K.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(K.value),{headers:{"Content-Type":"application/json"}})}};if(J(Q.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(G)=>z.logout(G)}}if(Z.iam){let z=Z.iam,G=$.method!=="GET"&&$.method!=="HEAD";if(_(Q.iam.usersUrl))return{module:"iam",kind:G?"iam.users.write":"iam.read",requiredPermission:u4[G?"iam.users.write":"iam.read"],handler:async(K)=>z.handler(K)};if(_(Q.iam.groupsUrl))return{module:"iam",kind:G?"iam.groups.write":"iam.read",requiredPermission:u4[G?"iam.groups.write":"iam.read"],handler:async(K)=>z.handler(K)};if(_(Q.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(K)=>z.handler(K)}}if(Z.workload){let z=Z.workload;if(J(Q.workload.validateUrl)||J(Q.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(G)=>z.handler(G)}}if(Z.secrets){let z=Z.secrets;if(z.isLfvDeliveryRequest?.($)&&z.handleLfvDelivery){let G=z.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(K)=>G(K)}}if(z.isLfvEventsRequest?.($)&&z.handleLfvEvents){let G=z.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(K)=>G(K)}}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.magicLinkUrl)&&$.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:u4["ciam.magic-link.create"],handler:async(G)=>z.handler(G)};if(J(Q.ciam.magicLinkLoginUrl)&&$.method==="GET"||J(Q.ciam.customerProvidersUrl)&&$.method==="GET"||J(Q.ciam.customerLoginUrl)&&$.method==="GET"||J(Q.ciam.customerCallbackUrl)&&($.method==="GET"||$.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(G)=>z.handler(G)}}return}async function l4($,Z,Q,X){let Y=X??m$(p0()),J=new URL($.url).pathname;if(Q?.filter){let D=await Q.filter($,Z);if(D instanceof Response)return D;if(D==="not_handled")return K$()}let _=V6($,Z,Y,J),G=await Q?.resolve?.($,Z,_)??_;if(!G)return K$();let K=G.requiredPermission===void 0?_?.requiredPermission:G.requiredPermission,H=async()=>{if(K){let D=await G0($,Z,K);if(D)return D}return G.handler($)};if(Q?.wrap)return await Q.wrap($,G,H,Z);return await H()}import{stableConfigHash as zZ}from"@ionite/core";function Y4(){let $=0;return{next:()=>{return $+=1,$},isCurrent:(Z)=>Z===$,current:()=>$}}import{readFile as XZ,stat as YZ}from"node:fs/promises";class N0 extends Error{code;status;constructor($,Z,Q){super($);this.code=Z;this.status=Q;this.name="VaultWebSocketCommandError"}sourceType="vault"}class d$ extends Error{path;constructor($,Z=`Vault secret not found at path ${$}`){super(Z);this.path=$;this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}code;status;sourceType="vault"}class U$ extends Error{path;status;code;constructor($,Z,Q,X,Y){super($,Y);this.path=Z;this.status=Q;this.code=X;this.name="VaultRequestError"}sourceType="vault"}class I$ extends Error{sourceType;path;constructor($,Z,Q=`Vault subscribe is not supported for source ${$} at path ${Z} without websocket, LFV, or ttl`){super(Q);this.sourceType=$;this.path=Z;this.name="VaultSubscribeNotSupportedError"}}function F6($){return $ instanceof d$||$ instanceof N0&&($.code==="not_found"||$.status===404)}import{WebSocket as c4}from"ws";var u9=1000,l9=30000,L6=30000,W6=L6;function O6($){W6=$>0?$:L6}function c9($){let Z=Math.min(l9,u9*2**Math.min($,16)),Q=0.5+Math.random()*0.5;return Math.round(Z*Q)}var _0=new Map;function i9($){return $.trim().replace(/\/+$/g,"")}function N6($,Z){let Q=typeof Z?.version==="number"?Z.version:0,X=Z?.created_time??Z?.created,Y=typeof X==="string"?new Date(X):new Date,J=Y0(Z);return{path:$,version:Q,created:Y,...J?{contentType:J}:{}}}function n9($){return typeof $?.version==="number"?$.version:void 0}function s9($){let Z=$.token?.trim();if(!Z)return{};if($.header==="Authorization")return{Authorization:Z.startsWith("Bearer ")?Z:`Bearer ${Z}`};return{"X-Vault-Token":Z}}function A6($){return{client_id:$.clientId,token:$.token,header:$.header??"X-Vault-Token"}}function E6($,Z){let Q=i9($),X=_0.get(Q);if(X){if(Z&&!X.log)X.log=Z;return X}let Y={url:Q,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,hasConnected:!1,disposed:!1,log:Z};return _0.set(Q,Y),Y}function a9($){let Z=Array.from($.subs.values(),(Y)=>Y.creds);if(Z.length===0)return $.lastGoodCreds??{url:$.url};let Q=$.lastGoodCreds?[$.lastGoodCreds,...Z]:Z,X=Q[$.reconnectCredCursor%Q.length]??Z[0];return $.reconnectCredCursor+=1,X}function M6($,Z){for(let Q of $.subs.values())try{Q.onHealth?.(Z)}catch(X){$.log?.warn("Vault websocket health hook threw",X)}}function t9($,Z){for(let Q of Array.from($.subs.values())){let X=Q.onFirstSecretReject;if(Q.onFirstSecret=void 0,Q.onFirstSecretReject=void 0,X)try{X(new U$(`Vault websocket subscription interrupted (${Z})`,Q.path,void 0,"connection"))}catch(Y){$.log?.warn("Vault websocket first-secret waiter rejection threw",Y)}}}function j6($,Z){for(let Q of $.pending.values())clearTimeout(Q.timer),Q.reject(new U$(`Vault websocket command interrupted (${Z})`,"/",void 0,"connection"));$.pending.clear()}function J4($){if($.disposed)return;if($.disposed=!0,$.reconnectTimer)clearTimeout($.reconnectTimer),$.reconnectTimer=void 0;j6($,"closed"),t9($,"socket disposed");let Z=$.ws;if($.ws=void 0,$.connectPromise=void 0,$.hasConnected=!1,_0.delete($.url),Z)try{Z.removeAllListeners(),Z.close()}catch{}}function i4($){if($.subs.size>0||$.pending.size>0)return;J4($)}function q6($,Z,Q,X){if(X!==void 0&&Z.lastVersion!==void 0&&X===Z.lastVersion)return;if(X!==void 0)Z.lastVersion=X;try{Z.onChange(Q)}catch(J){$.log?.warn("Vault websocket subscription onChange threw",J)}let Y=Z.onFirstSecret;if(Z.onFirstSecret=void 0,Z.onFirstSecretReject=void 0,Y)try{Y()}catch(J){$.log?.warn("Vault websocket subscription onFirstSecret threw",J)}}function r9($,Z){let Q=Z.subscription_id;if(typeof Q!=="string")return;let X=$.subs.get(Q);if(!X)return;let Y={data:Z.data,metadata:N6(typeof Z.path==="string"?Z.path:X.path,Z.metadata)};q6($,X,Y,n9(Z.metadata))}function o9($,Z){let Q;try{Q=JSON.parse(Z.toString())}catch(X){$.log?.warn("Vault websocket message parse failed",X);return}if(Q.type==="secret"){r9($,Q);return}if(Q.type==="command_result"&&typeof Q.id==="string"){let X=$.pending.get(Q.id);if(!X)return;if($.pending.delete(Q.id),clearTimeout(X.timer),Q.ok===!1)X.reject(new N0(Q.error??`Vault websocket command failed for ${Q.id}`,Q.code,Q.status));else X.resolve(Q.result);i4($)}}function R6($,Z){$.send(JSON.stringify({type:"subscribe",subscription_id:Z.subscriptionId,paths:[Z.path],...A6(Z.creds)}))}function T6($){if($.disposed||$.reconnectTimer||$.subs.size===0)return;let Z=c9($.reconnectAttempts);$.reconnectAttempts+=1,$.reconnectTimer=setTimeout(()=>{if($.reconnectTimer=void 0,$.disposed)return;if($.subs.size===0){J4($);return}n4($,a9($)).catch(()=>{if($.hasConnected)$.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${Z}ms).`);T6($)})},Z)}function n4($,Z){if($.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if($.ws&&$.ws.readyState===c4.OPEN)return Promise.resolve($.ws);if($.connectPromise)return $.connectPromise;return $.connectPromise=new Promise((Q,X)=>{let Y=new c4($.url,{headers:s9(Z)}),J=!1,_=$.hasConnected,z=()=>{J=!0,$.hasConnected=!0,$.reconnectAttempts=0,$.reconnectCredCursor=0,$.lastGoodCreds=Z,$.ws=Y,$.connectPromise=void 0,Y.on("message",(H)=>o9($,H));for(let H of $.subs.values())try{R6(Y,H)}catch{}if(_)M6($,!0);Q(Y)},G=()=>{if($.ws===Y)$.ws=void 0;$.connectPromise=void 0;try{Y.removeAllListeners()}catch{}if(j6($,"socket closed"),$.subs.size>0)M6($,!1),T6($);else J4($)},K=(H)=>{if($.ws===Y)$.ws=void 0;if(!J)J=!0,$.connectPromise=void 0,X(H)};Y.once("open",z),Y.on("close",G),Y.on("error",K)}),$.connectPromise}async function s4($,Z,Q,X){let Y=E6($.url,X),J=typeof Q.path==="string"?Q.path:"/",_=await n4(Y,$),z=crypto.randomUUID();try{return await new Promise((G,K)=>{let H=setTimeout(()=>{if(!Y.pending.has(z))return;Y.pending.delete(z),K(new U$(`Vault websocket command "${Z}" timed out`,J,void 0,"timeout"));try{Y.ws?.close()}catch{}},W6);Y.pending.set(z,{resolve:(D)=>G(D),reject:K,timer:H});try{_.send(JSON.stringify({type:"command",id:z,command:Z,...Q,...A6($)}))}catch(D){clearTimeout(H),Y.pending.delete(z),K(D)}})}finally{i4(Y)}}async function a4($,Z,Q){let X;try{X=await s4($,"read_secret",{path:Z},Q)}catch(Y){if(F6(Y))throw new d$(Z);if(Y instanceof N0||Y instanceof U$)throw Y;throw new U$(`Vault websocket read_secret failed for ${Z}`,Z,void 0,"connection",{cause:Y})}if(!X||typeof X!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${Z}`);return{data:X.data,metadata:N6(typeof X.path==="string"?X.path:Z,X.metadata)}}async function I6($,Z,Q,X,Y,J){let _=E6($.url,Y),z=crypto.randomUUID(),G={subscriptionId:z,creds:$,path:Z,onChange:Q,onHealth:J?.onHealth};_.subs.set(z,G);let K=()=>{if(!_.subs.delete(z))return;if(_.ws&&_.ws.readyState===c4.OPEN)try{_.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:z}))}catch{}i4(_)};try{let H=await n4(_,$);R6(H,G)}catch(H){if(X?.mode!=="wait")throw K(),H}try{let H=await a4($,Z,Y);q6(_,G,H,H.metadata.version)}catch(H){if(X?.mode!=="wait")throw K(),H;await new Promise((D,U)=>{let I,L=(B)=>{if(I)clearTimeout(I);G.onFirstSecret=void 0,G.onFirstSecretReject=void 0,K(),U(B)};if(G.onFirstSecret=()=>{if(I)clearTimeout(I);D()},G.onFirstSecretReject=L,typeof X.timeout==="number"&&X.timeout>0)I=setTimeout(()=>L(H),X.timeout)})}return K}function P6(){let $=0;for(let Z of _0.values())$+=Z.subs.size;return{urls:Array.from(_0.keys()),sockets:_0.size,subscriptions:$}}function x6(){for(let $ of Array.from(_0.values()))J4($)}var G4=600000;function z0($){if($&&$<G4)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${G4} milliseconds (10 minutes), as not to overload the store with polling requests`)}function u$($,Z,Q,X,Y,J,_){let z=!1,G,K,H,D=(E)=>{try{_?.onHealth?.(E)}catch{}},U=()=>{if(z=!0,G)clearTimeout(G),G=void 0;K?.()},I=(E)=>new Promise((W)=>{let F=setTimeout(()=>{K=void 0,G=void 0,W()},E);G=F,K=()=>{clearTimeout(F),K=void 0,G=void 0,W()}});async function L(){let E=Date.now();for(;;){if(z)return;try{let W=await $.getFullSecret(Z,J);return D(!0),W}catch(W){if(D(!1),J?.mode!=="wait")throw W;if(typeof J.timeout==="number"&&J.timeout>0&&Date.now()-E>=J.timeout)throw W;if(z)return;Y?.warn(`Error retrieving initial secret from vault. Retrying in ${X} milliseconds`,W),await I(X)}}}async function B(){if(G=void 0,z)return;try{let E=await $.getFullSecret(Z);if(D(!0),E.metadata.version!==H)H=E.metadata.version,Q(E)}catch(E){D(!1),Y?.warn(`Error retrieving remote config from vault. Retrying in ${X} milliseconds`,E)}R()}function R(){if(z)return;G=setTimeout(()=>{B()},X)}return L().then((E)=>{if(z||!E)return()=>U();return H=E.metadata.version,Q(E),R(),()=>U()})}function e9($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function $Z($){let Z={"Content-Type":"application/json"};if($)Z["X-Vault-Token"]=$;return Z}function ZZ($){return Boolean($?.idpTokenUrl?.trim()&&$.clientId?.trim()&&$.clientSecret?.trim())}async function S6($,Z){let Q=Date.now();if(Z.token&&Z.expiresAt&&Z.expiresAt-60000>Q)return Z.token;let X=new URLSearchParams({grant_type:"client_credentials",client_id:$.clientId,client_secret:$.clientSecret});if($.scope?.trim())X.set("scope",$.scope.trim());let Y=await fetch($.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:X.toString()});if(!Y.ok)throw Error(`Vault workload token request failed (${Y.status})`);let J=await Y.json();if(!J.access_token)throw Error("Vault workload token response did not include access_token");return Z.token=J.access_token,Z.expiresAt=Q+Math.max(1,J.expires_in??300)*1000,J.access_token}function QZ($){return{Authorization:$.startsWith("Bearer ")?$:`Bearer ${$}`}}function w6($){return $.replace(/\/data\/?$/,"")}function A0($,Z){let{type:Q="vault",url:X,token:Y,ttl:J}=$,_=()=>$.log,z=ZZ($.workload)?$.workload:void 0,G={},K=$Z(Y),H=$.lfv,D=$.websocket,U=H?S0({...H,log:H.log??_(),path:H.path??"/"},Z):void 0,I=new Map,L=D?.url?.trim(),B=new Set,R=!1,E=!1;if(!H&&!X&&!L)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(z0(J),X&&!Y&&!z&&!H)_()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function W(){if(z){let N=await S6(z,G);return{"Content-Type":"application/json",...QZ(N)}}return{...K}}async function F(N){let y=T(N);if(z){let m=await S6(z,G);return{url:y,clientId:D?.clientId??z.clientId,token:m,header:"Authorization"}}return{url:y,clientId:D?.clientId,token:D?.token??Y,header:D?.header??"X-Vault-Token"}}function M(N){if(!H)throw Error(`Vault LFV capability is not configured for path ${N}`);let y=I.get(N);if(y)return y;let m=S0({...H,log:H.log??_(),path:N},Z);return I.set(N,m),m}function P(N){if(!X)throw Error(`Vault HTTP capability is not configured for path ${N}`);return X}function T(N){if(!L)throw Error(`Vault websocket capability is not configured for path ${N}`);return L}async function h(N,y){let m=await F(typeof y.path==="string"?y.path:"/");return s4(m,N,y,_())}async function g(N,y){let m=P(N),r;try{let e=await W();r=await fetch(`${m}/${N}`,{headers:e})}catch(e){throw new U$(`Vault request failed from URL: ${m}/${N}`,N,void 0,"connection",{cause:e})}if(r.status!==200){if(r.status===404)throw new d$(N);let e=r.status===401||r.status===403,o=e?`Vault returned ${r.status} ${r.statusText} (auth error) from URL: ${m}/${N}`:`Vault returned invalid status, ${r.status}: '${r.statusText}' from URL: ${m}/${N}`;throw new U$(o,N,r.status,e?"auth":"invalid_status")}try{let o=(await r.json()).data;if(!o?.metadata||!("data"in o))throw Error("Missing vault secret data");let A=o.metadata.created_time??o.metadata.created;return{data:o.data,metadata:{path:typeof o.metadata.path==="string"?o.metadata.path:N,version:typeof o.metadata.version==="number"?o.metadata.version:0,created:A instanceof Date?A:typeof A==="string"?new Date(A):new Date,...Y0(o.metadata)?{contentType:Y0(o.metadata)}:{}}}}catch(e){throw new U$("Error retrieving secret",N,void 0,"invalid_payload",{cause:e})}}async function l(N){let y=await F(N);return a4(y,N,_())}async function j(N){let y=P(N),m=`${w6(y)}/metadata/${N}`,r=await W(),e=await fetch(m,{headers:r});if(e.status!==200)throw new U$(`Vault getMetadata failed (${e.status}) for ${N}`,N,e.status,"invalid_status");let o=await e.json().catch(()=>null);if(!o?.metadata||typeof o.metadata!=="object")throw new U$(`Vault getMetadata returned invalid payload for ${N}`,N,e.status,"invalid_payload");return o.metadata}async function O(N,y,m){let r=P(y),e=`${w6(r)}/${N}/${y}`,o=await W(),A=await fetch(e,{method:"POST",headers:o,body:JSON.stringify({reason:m?.reason,severity:m?.severity,incident_ref:m?.incidentRef})});if(A.status!==200&&A.status!==202&&A.status!==204)throw new U$(`Vault ${N} failed (${A.status}) for ${y}`,y,A.status,"invalid_status")}async function S(N,y){if(H)return await M(N).getFullSecret(N,y);if(X)return await g(N,y);return await l(N)}async function f(N,y,m){if(!e9(y))throw Error(`putSecret requires an object value for vault source at path ${N}`);if(H){await M(N).putSecret(N,y,m);return}if(X){let r=P(N),e=await W();if(m?.contentType){if(e["X-Ionite-Mime-Type"]=m.contentType.mimeType,e["X-Ionite-Secret-Format"]=m.contentType.format,m.contentType.schemaUrl)e["X-Ionite-Schema-Url"]=m.contentType.schemaUrl;if(m.contentType.typeId)e["X-Ionite-Secret-Type"]=m.contentType.typeId}let o=await fetch(`${r}/${N}`,{method:"POST",headers:e,body:JSON.stringify(y)});if(o.status!==200&&o.status!==201&&o.status!==204)throw new U$(`Vault putSecret failed (${o.status}) for ${N}`,N,o.status,"invalid_status");return}await h("put_secret",{path:N,data:y,...m?.contentType?{content_type:s0(m.contentType)}:{}})}async function w(N,y){if(H){await M(N).deleteSecret(N,y);return}if(X){let m=P(N),r=await W(),e=await fetch(`${m}/${N}`,{method:"DELETE",headers:r});if(e.status!==200&&e.status!==202&&e.status!==204)throw new U$(`Vault deleteSecret failed (${e.status}) for ${N}`,N,e.status,"invalid_status");return}await h("delete_secret",{path:N})}async function d(N,y){if(H)return await M(N).listPaths(N,y);if(X){let e=`${P(N)}/${N}`,o=async(C)=>{let b=await W();if(C==="LIST")return fetch(e,{method:"LIST",headers:b});let n=e.includes("?")?"&":"?";return fetch(`${e}${n}list=true`,{method:"GET",headers:b})},A=await o("LIST");if(A.status===405||A.status===501)A=await o("GET");if(A.status!==200)throw new U$(`Vault listPaths failed (${A.status}) for ${N}`,N,A.status,"invalid_status");let q=await A.json().catch(()=>null),v;if(q&&typeof q==="object"){let C=q,b=C.data;if(b&&typeof b==="object")v=b.keys;else v=C.keys}if(!Array.isArray(v))throw new U$(`Vault listPaths returned an unexpected response for ${N}`,N,void 0,"invalid_payload");return v.filter((C)=>typeof C==="string")}let m=await h("list_paths",{path:N});if(!Array.isArray(m.items))throw Error(`Vault websocket list_paths returned invalid payload for ${N}`);return m.items.filter((r)=>typeof r==="string")}async function i(N,y){if(H)return await M(N).exists(N,y);if(X){let r=P(N),e=await W(),o=await fetch(`${r}/${N}`,{headers:e});if(o.status===200)return!0;if(o.status===404)return!1;if(o.status===401||o.status===403)throw new U$(`Vault exists failed (${o.status}) for ${N} (auth error)`,N,o.status,"auth");throw new U$(`Vault exists failed (${o.status}) for ${N}`,N,o.status,"invalid_status")}let m=await h("exists",{path:N});if(typeof m.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${N}`);return m.exists}async function X$(N,y,m){if(H){await M(N).requestRotate(N,y,m);return}if(X){await O("rotate/request",N,y);return}await h("request_rotate",{path:N,reason:y?.reason,severity:y?.severity,incident_ref:y?.incidentRef})}async function Y$(N,y,m){if(H){await M(N).requestRevoke(N,y,m);return}if(X){await O("revoke/request",N,y);return}await h("request_revoke",{path:N,reason:y?.reason,severity:y?.severity,incident_ref:y?.incidentRef})}async function H$(N,y){if(H)return await M(N).getMetadata(N,y);if(X)return await j(N);let m=await h("read_metadata",{path:N});if(!m.metadata||typeof m.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${N}`);return m.metadata}async function c(N,y,m){if(!J)throw new I$(Q,N);return u$({getFullSecret:g},N,y,J,_(),m,{onHealth:(r)=>{R=!r}})}async function J$(N,y,m){let r=await F(N);return I6(r,N,y,m,_(),{onHealth:(e)=>{E=!e}})}function _$(N){let y=()=>{if(B.delete(y))N()};return B.add(y),y}function V$(){if(U?.isAvailable?.()===!1)return!0;for(let N of I.values())if(N.isAvailable?.()===!1)return!0;return!1}let z$={type:Q,isAvailable:()=>!R&&!E&&!V$(),get:(N,y)=>b$(()=>S(N,y)),getFullSecret:S,getSecret:async(N,y)=>{return(await S(N,y)).data},putSecret:f,deleteSecret:w,listPaths:d,exists:i,requestRotate:X$,requestRevoke:Y$,getMetadata:H$,subscribe:async(N,y,m)=>{let r;if(L)r=await J$(N,y,m);else if(H)r=await M(N).subscribe(N,y,m);else r=await c(N,y,m);return _$(r)},...U?{subscribeEvents:(N)=>_$(U.subscribeEvents?.(N)??(()=>{}))}:{},close:()=>{for(let y of Array.from(B))try{y()}catch(m){_()?.warn("Vault source close: failed to release a subscription",m)}B.clear();let N=(y)=>{if(!y?.close)return;try{Promise.resolve(y.close()).catch((m)=>{_()?.warn("Vault source close: LFV close failed",m)})}catch(m){_()?.warn("Vault source close: LFV close failed",m)}};for(let y of I.values())N(y);N(U),I.clear(),G.token=void 0,G.expiresAt=void 0},get log(){return $.log},set log(N){$.log=N}};if(U)z$.isDeliveryRequest=(N)=>U.isDeliveryRequest(N),z$.isEventsRequest=(N)=>U.isEventsRequest(N),z$.handleDelivery=(N)=>U.handleDelivery(N),z$.handleEvents=(N)=>U.handleEvents(N),Object.defineProperties(z$,{deliveryPath:{value:U.deliveryPath,enumerable:!0},eventsPath:{value:U.eventsPath,enumerable:!0},callbackKey:{value:U.callbackKey,enumerable:!0},trustId:{value:U.trustId,enumerable:!0}});return z$}class z4 extends Error{status;constructor($,Z){super($);this.name="AzureKeyVaultError",this.status=Z,Object.setPrototypeOf(this,z4.prototype)}}function _4($,Z){if(!$||$.trim().length===0)throw Error(`Missing required Azure config: ${Z}`);return $}function JZ($){return $.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function t4($,Z){return`${$.replace(/\/+$/g,"")}/${Z.replace(/^\/+/g,"")}`}function GZ($){try{let Q=new URL($).pathname.split("/").filter(Boolean),X=Q.indexOf("secrets");if(X===-1)return;return Q[X+2]||void 0}catch{return}}function _Z($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function K4($){let Z=$.apiVersion??"7.4",Q=$.scope??"https://vault.azure.net/.default",X=$.secretNameTransform??JZ,Y=$.authMethod,J="/var/run/secrets/azure/tokens/azure-identity-token",_=$.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",z=$.vaultUrl??($.vaultName?`https://${$.vaultName}.vault.azure.net`:void 0)??void 0,G=_4(z,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function K(j){try{return await YZ(j),!0}catch{return!1}}let H,D,U=!1;async function I(j){let{entraTenantId:O,clientId:S}=$;if(!O)throw Error("Workload identity requires entraTenantId");if(!S)throw Error("Workload identity requires clientId");if(!await K(_))throw Error(`Federated token file not found at ${_}`);let f=(await XZ(_,"utf8")).trim();if(!f)throw Error("Federated token file was empty");let w=`https://login.microsoftonline.com/${encodeURIComponent(O)}/oauth2/v2.0/token`,d=new URLSearchParams({client_id:S,grant_type:"client_credentials",scope:Q,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:f}),i=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:d});if(i.status!==200)throw Error(`Azure workload identity token exchange returned ${i.status} ${i.statusText}`);let X$=await i.json();if(!X$?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:X$.access_token,expiresAtMs:j+(X$.expires_in??0)*1000},X$.access_token}async function L(j){let O=$.imdsApiVersion??"2018-02-01",S="https://vault.azure.net",f=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(f.searchParams.set("api-version",O),f.searchParams.set("resource","https://vault.azure.net"),$.managedIdentityClientId)f.searchParams.set("client_id",$.managedIdentityClientId);let w=await fetch(f.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(w.status!==200)throw Error(`Azure IMDS token endpoint returned ${w.status} ${w.statusText}`);let d=await w.json();if(!d?.access_token)throw Error("IMDS token response missing access_token");let i=j+60000;if(d.expires_on){let X$=Number.parseInt(d.expires_on,10);if(Number.isFinite(X$)&&X$>0)i=X$*1000;else{let Y$=Date.parse(d.expires_on);if(Number.isFinite(Y$))i=Y$}}else if(d.expires_in){let X$=Number.parseInt(d.expires_in,10);if(Number.isFinite(X$)&&X$>0)i=j+X$*1000}return H={accessToken:d.access_token,expiresAtMs:i},d.access_token}async function B(j){let O=_4($.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),S=_4($.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),f=_4($.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),w=`https://login.microsoftonline.com/${encodeURIComponent(O)}/oauth2/v2.0/token`,d=new URLSearchParams({client_id:S,client_secret:f,grant_type:"client_credentials",scope:Q}),i=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:d});if(i.status!==200)throw Error(`Azure token endpoint returned ${i.status} ${i.statusText}`);let X$=await i.json();if(!X$?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:X$.access_token,expiresAtMs:j+(X$.expires_in??0)*1000},X$.access_token}async function R(){let j=Date.now();if(H&&H.expiresAtMs-60000>j)return H.accessToken;if(D)return D;D=(async()=>{if(Y==="workload_identity")return await I(j);if(Y==="managed_identity")return await L(j);if(Y==="client_secret")return await B(j);if(await K(_))try{return await I(j)}catch{}try{return await L(j)}catch{}return await B(j)})();try{return await D}finally{D=void 0}}async function E(j){let O=await R(),S=t4(G,`/secrets/${encodeURIComponent(j)}?api-version=${encodeURIComponent(Z)}`),f=await fetch(S,{headers:{Authorization:`Bearer ${O}`,Accept:"application/json"}});if(f.status!==200)throw new z4(`Key Vault request failed (${f.status})`,f.status);return await f.json()}async function W(j,O){let S=X(j),f=$.secretNamePrefix?`${$.secretNamePrefix}${S}`:S,w=await E(f),d=w.value;try{d=JSON.parse(w.value)}catch{}let i=w.attributes?.created?w.attributes.created*1000:void 0,X$=GZ(w.id),Y$=w.contentType?n0({mimeType:w.contentType,format:w.tags?.["ionite-format"],schemaUrl:w.tags?.["ionite-schema-url"],typeId:w.tags?.["ionite-type-id"]}):void 0;return{data:d,metadata:{path:j,version:Number.parseInt(X$??"",10)||0,created:i?new Date(i):new Date,...Y$?{contentType:Y$}:{}}}}async function F(j,O,S){if(!_Z(O))throw Error(`putSecret requires an object value for azure source at path ${j}`);let f=X(j),w=$.secretNamePrefix?`${$.secretNamePrefix}${f}`:f,d=await R(),i=t4(G,`/secrets/${encodeURIComponent(w)}?api-version=${encodeURIComponent(Z)}`),X$=JSON.stringify({value:JSON.stringify(O),...S?.contentType?{contentType:S.contentType.mimeType,tags:{"ionite-format":S.contentType.format,...S.contentType.schemaUrl?{"ionite-schema-url":S.contentType.schemaUrl}:{},...S.contentType.typeId?{"ionite-type-id":S.contentType.typeId}:{}}}:{}}),Y$=await fetch(i,{method:"PUT",headers:{Authorization:`Bearer ${d}`,"Content-Type":"application/json",Accept:"application/json"},body:X$});if(Y$.status!==200&&Y$.status!==201)throw Error(`Key Vault putSecret failed (${Y$.status}) for ${j}`)}async function M(j,O){let S=X(j),f=$.secretNamePrefix?`${$.secretNamePrefix}${S}`:S,w=await R(),d=t4(G,`/secrets/${encodeURIComponent(f)}?api-version=${encodeURIComponent(Z)}`),i=await fetch(d,{method:"DELETE",headers:{Authorization:`Bearer ${w}`,Accept:"application/json"}});if(i.status!==200&&i.status!==202&&i.status!==204)throw Error(`Key Vault deleteSecret failed (${i.status}) for ${j}`)}async function P(j,O){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${j}`)}async function T(j,O){try{return await W(j),!0}catch(S){if(S instanceof z4&&S.status===404)return!1;throw S}}async function h(j,O,S){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${j}`)}async function g(j,O,S){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${j}`)}async function l(j,O){let S=X(j),f=$.secretNamePrefix?`${$.secretNamePrefix}${S}`:S,w=await E(f),d=w.contentType?n0({mimeType:w.contentType,format:w.tags?.["ionite-format"],schemaUrl:w.tags?.["ionite-schema-url"],typeId:w.tags?.["ionite-type-id"]}):void 0;return{id:w.id,...d?{content_type:d}:{},...w.attributes??{}}}return{type:$.type,isAvailable:()=>!U,get:(j,O)=>b$(()=>W(j,O)),getFullSecret:W,getSecret:async(j,O)=>{return(await W(j,O)).data},putSecret:F,deleteSecret:M,listPaths:P,exists:T,requestRotate:h,requestRevoke:g,getMetadata:l,subscribe:(j,O,S)=>{if(!$.ttl)throw new I$("azure",j);return z0($.ttl),u$({getFullSecret:W},j,O,$.ttl,void 0,S,{onHealth:(f)=>{U=!f}})},close:()=>{H=void 0,D=void 0,U=!1}}}var r4=Symbol("ion.secretsSourceState");function KZ($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${X}`)};return{type:"dev",get:(Q,X)=>b$(()=>Promise.reject(Z("get",Q))),getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[r4]:"unavailable"}}function C6($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${X}`)};return{type:"dev",get:(Q,X)=>b$(()=>Promise.reject(Z("get",Q))),getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[r4]:"removed"}}function HZ($,Z,Q){if(Z.type==="vault")return A0(Z,Q);if(Z.type==="azure")return K4(Z);if(Z.type==="aws"||Z.type==="gcp"||Z.type==="dev")throw Error(`Secrets source "${$}" uses type "${Z.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${$}"`)}function BZ($,Z){let Q=(X)=>{Z.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:X instanceof Error?X.message:String(X)})};try{Promise.resolve($.close?.()).catch(Q)}catch(X){Q(X)}}function DZ($){let Z=new Map,Q=new Map,X=new Map;for(let[Y,J]of Object.entries($)){if(!k6(J))continue;let _=Z.get(J.deliveryPath);if(_)throw Error(`LFV delivery path "${J.deliveryPath}" is claimed by both secrets sources "${_}" and "${Y}"; delivery paths must be globally unique.`);Z.set(J.deliveryPath,Y);let z=Q.get(J.eventsPath);if(z)throw Error(`LFV events path "${J.eventsPath}" is claimed by both secrets sources "${z}" and "${Y}"; events paths must be globally unique.`);Q.set(J.eventsPath,Y);let G=X.get(J.callbackKey);if(G&&G.trustId!==J.trustId)throw Error(`LFV callback key "${J.callbackKey}" is claimed by secrets sources "${G.sourceName}" and "${Y}" with different verify JWKS; a callback path must use a single trust key.`);if(!G)X.set(J.callbackKey,{sourceName:Y,trustId:J.trustId})}}function k6($){return typeof $.isDeliveryRequest==="function"&&typeof $.isEventsRequest==="function"&&typeof $.handleDelivery==="function"&&typeof $.handleEvents==="function"}function UZ($,Z,Q){let X={...Z},Y=[],J=(z)=>{if(X[z]!==void 0)delete X[z],Y.push(z)};J("token"),J("clientSecret"),J("workload");let _=X.websocket;if(_&&typeof _==="object"&&_.token!==void 0){let z={..._};delete z.token,X.websocket=z,Y.push("websocket.token")}if(Y.length>0)Q.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:$,"ion.droppedFields":Y});return X}function VZ($,Z,Q){let X={},Y=new Set([...Object.keys(Z??{}),...Object.keys(Q??{})]);for(let J of Y){let _=Z?.[J],z=Q?.[J],G=z?UZ(J,z,$):void 0;X[J]={..._??{},...G??{}}}return X}function H4($){return $[r4]??"available"}function FZ($,Z,Q){let X=Z,Y=new Set,J=new Set,_=new Set,z=w$(Q,`Secrets source "${$}"`),G=()=>H4(X)==="available",K=W$(`Secrets source "${$}"`,G),H=(F,M,P)=>{return Error(`${F} timed out after ${P}ms waiting for source "${$}" to be configured by the ConfigSource at path ${M}`)},D=(F,M)=>{return Error(`${F} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${M}`)},U=(F,M,P)=>{let T=H4(X);if(T==="available")return Promise.resolve(X);if(T==="removed")return Promise.reject(D(F,M));return new Promise((h,g)=>{let l={method:F,path:M,resolve:(O)=>{if(l.timeout)clearTimeout(l.timeout);_.delete(l),h(O)},reject:(O)=>{if(l.timeout)clearTimeout(l.timeout);_.delete(l),g(O)}},j=P?.timeout;if(typeof j==="number"&&j>0)l.timeout=setTimeout(()=>{l.reject(H(F,M,j))},j);_.add(l)})},I=(F)=>{for(let M of Array.from(_))M.resolve(F)},L=()=>{for(let F of Array.from(_))F.reject(D(F.method,F.path))},B=async(F,M=!1)=>{let P=F.guard.next();if(F.unsubscribe?.(),F.unsubscribe=void 0,F.closed)return;if(H4(X)==="unavailable"&&F.options?.mode!=="wait"){if(M)throw Error(`subscribe is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${F.path}`);return}try{let h=await(F.options?.mode==="wait"?await U("subscribe",F.path,F.options):X).subscribe(F.path,(g)=>{if(!F.closed)F.onChange(g)},F.options);if(F.closed||!F.guard.isCurrent(P)){h?.();return}F.unsubscribe=h}catch(T){if(M)throw T;if(e0(T)){Q.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:$,path:F.path});return}Q.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:$,path:F.path,error:T instanceof Error?T.message:String(T)})}},R=(F,M=!1)=>{if(F.unsubscribe?.(),F.unsubscribe=void 0,F.closed)return;if(!X.subscribeEvents){if(M)throw Error(`Secrets source "${$}" does not support lifecycle event subscriptions`);return}F.unsubscribe=X.subscribeEvents((P)=>{if(!F.closed)F.listener(P)})},E={get type(){return X.type},beforeChange:z.beforeChange,afterChange:z.afterChange,isAvailable:()=>G()&&(X.isAvailable?.()??!0),isReady:K.isReady,ready:K.ready,get:(F,M)=>b$(async()=>{return(await U("get",F,M)).getFullSecret(F,M)}),getFullSecret:async(F,M)=>{return(await U("getFullSecret",F,M)).getFullSecret(F,M)},getSecret:async(F,M)=>{return(await U("getSecret",F,M)).getSecret(F,M)},putSecret:async(F,M,P)=>{return(await U("putSecret",F,P)).putSecret(F,M,P)},subscribe:async(F,M,P)=>{let T={path:F,onChange:M,options:P,closed:!1,guard:Y4()};Y.add(T);try{await B(T,!0)}catch(h){throw Y.delete(T),h}return()=>{T.closed=!0,T.guard.next(),Y.delete(T),T.unsubscribe?.(),T.unsubscribe=void 0}},subscribeEvents:(F)=>{let M={listener:F,closed:!1};J.add(M);try{R(M,!0)}catch(P){throw J.delete(M),P}return()=>{M.closed=!0,J.delete(M),M.unsubscribe?.(),M.unsubscribe=void 0}},deleteSecret:async(F,M)=>{return(await U("deleteSecret",F,M)).deleteSecret(F,M)},listPaths:async(F,M)=>{return(await U("listPaths",F,M)).listPaths(F,M)},exists:async(F,M)=>{return(await U("exists",F,M)).exists(F,M)},requestRotate:async(F,M,P)=>{return(await U("requestRotate",F,P)).requestRotate(F,M,P)},requestRevoke:async(F,M,P)=>{return(await U("requestRevoke",F,P)).requestRevoke(F,M,P)},getMetadata:async(F,M)=>{return(await U("getMetadata",F,M)).getMetadata(F,M)}},W=(F)=>{try{Promise.resolve(F.close?.()).catch((M)=>{Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:M instanceof Error?M.message:String(M)})})}catch(M){Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:M instanceof Error?M.message:String(M)})}};return{api:E,update(F){if(F===X)return;let M=X;z.emitBefore(),X=F;let P=H4(F);if(P==="available")I(F);else if(P==="removed")L();K.refresh();for(let T of Y)B(T);for(let T of J)R(T);W(M),z.emitAfter()},close(){for(let F of Y)F.closed=!0,F.guard.next(),F.unsubscribe?.(),F.unsubscribe=void 0;Y.clear();for(let F of J)F.closed=!0,F.unsubscribe?.(),F.unsubscribe=void 0;J.clear(),L(),K.settle(),W(X)}}}function y6($){let Z=new Map,Q=new Map,X,Y=new Map,J=w$($,"Secrets"),_=!1,z=()=>{for(let B of Z.keys()){let R=Y.get(B);if(R&&R.api.isReady?.()===!1)return!1}return!0},G=W$("Secrets module",()=>_&&z()),K=(B)=>{let R=Y.get(B);if(R)return R;let E=FZ(B,Z.get(B)??C6(B),$);if(Y.set(B,E),!(B in L))Object.assign(L,{[B]:E.api});return E},H=(B)=>{let R=Y.get(B)?.api;if(R)return R;throw $.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:B}),Error(`Secrets source "${B}" is not configured`)},D=()=>{return Array.from(Z.values()).filter(k6)},U=(B)=>{return D().find((R)=>R.isDeliveryRequest(B))},I=(B)=>{return D().find((R)=>R.isEventsRequest(B))},L;return L={get config(){return Object.fromEntries(Array.from(Z.keys(),(B)=>[B,K(B).api]))},beforeChange:J.beforeChange,afterChange:J.afterChange,isReady:G.isReady,isAvailable:()=>{for(let B of Y.values()){if(B.api.isReady?.()===!1)continue;if(B.api.isAvailable?.()===!1)return!1}return!0},ready:G.ready,listSecretsSources:()=>Array.from(Z.keys()),getSecretsSource:(B)=>{if(Z.has(B))return K(B).api;return H(B)},get:(B,R,E)=>L.getSecretsSource(B).get(R,E),getSecret:(B,R,E)=>L.getSecretsSource(B).getSecret(R,E),getFullSecret:(B,R,E)=>L.getSecretsSource(B).getFullSecret(R,E),putSecret:(B,R,E,W)=>L.getSecretsSource(B).putSecret(R,E,W),deleteSecret:(B,R,E)=>L.getSecretsSource(B).deleteSecret(R,E),listPaths:(B,R,E)=>L.getSecretsSource(B).listPaths(R,E),exists:(B,R,E)=>L.getSecretsSource(B).exists(R,E),requestRotate:(B,R,E,W)=>L.getSecretsSource(B).requestRotate(R,E,W),requestRevoke:(B,R,E,W)=>L.getSecretsSource(B).requestRevoke(R,E,W),getMetadata:(B,R,E)=>L.getSecretsSource(B).getMetadata(R,E),subscribe:(B,R,E,W)=>L.getSecretsSource(B).subscribe(R,E,W),isLfvDeliveryRequest:(B)=>U(B)!==void 0,isLfvEventsRequest:(B)=>I(B)!==void 0,handleLfvDelivery:async(B)=>{let R=U(B);if(!R)return K$();return R.handleDelivery(B)},handleLfvEvents:async(B)=>{let R=I(B);if(!R)return K$();return R.handleEvents(B)}},{update(B,R,E,W){let F=B!==void 0||R!==void 0;if(!F&&!_&&Y.size===0)return;let M=VZ($,B,R),P=W!==X,T=new Map,h=new Map,g=[];try{for(let[l,j]of Object.entries(M)){let O=zZ(j),S=Z.get(l);if(S&&Q.get(l)===O&&!P){T.set(l,S),h.set(l,O);continue}let f;if(!j.type)f=KZ(l);else E?.validateSourceConfig?.(l,j),f=HZ(l,j,W),g.push(f);T.set(l,f),h.set(l,O)}DZ(Object.fromEntries(T))}catch(l){for(let j of g)BZ(j,$);throw l}J.emitBefore(),_=F,X=W;for(let[l,j]of T)Z.set(l,j),Q.set(l,h.get(l)),K(l).update(j);for(let[l,j]of Y){if(T.has(l))continue;Z.delete(l),Q.delete(l),j.update(C6(l))}return G.refresh(),J.emitAfter(),L},close(){for(let B of Y.values())B.close();Y.clear(),Z.clear(),Q.clear(),X=void 0,_=!1,G.settle()}}}function o4($,Z){let Q=Z.ttlMs,X=Math.max(1,Math.floor(Z.maxEntries)),Y=new Map,J=()=>Date.now();function _(){while(Y.size>X){let G=Y.keys().next().value;if(G===void 0)break;Y.delete(G)}}function z(G,K){Y.delete(G),Y.set(G,{session:K,expiresAt:J()+Q}),_()}return{async create(G){await $.create(G)},async get(G){let K=Y.get(G);if(K){if(K.expiresAt>J())return Y.delete(G),Y.set(G,K),K.session;Y.delete(G)}let H=await $.get(G);if(H)z(G,H);return H},async update(G,K){await $.update(G,K),Y.delete(G)},async delete(G){await $.delete(G),Y.delete(G)}}}import{ION_ENDPOINT_PERMISSIONS as wZ,trimTrailingSlash as V4,validationFailureResponse as CZ}from"@ionite/core";import{assertEcid as b6,jwtAssertionClaimsSchema as MZ,must as P$,workloadTokenResponseSchema as LZ}from"@ionite/core";import{getCachedVerificationKey as WZ,getJwks as OZ}from"@ionite/core/server";function C$($,Z){return Z in $&&$[Z]!==void 0&&$[Z]!==null}function E$($){if($===void 0||$===null)return!1;return C$($,"workloadId")||C$($,"privateKey")}function h$($){if($===void 0||$===null)return!1;let Z=C$($,"clientId"),Q=C$($,"clientSecret"),X=C$($,"workloadId"),Y=C$($,"privateKey");return(Z||Q)&&!X&&!Y}function e4($){if($===void 0||$===null)return!1;let Z=C$($,"jwksUri"),Q=C$($,"workloadId"),X=C$($,"clientId"),Y=C$($,"clientSecret"),J=C$($,"privateKey");return Z&&!Q&&!J&&!X&&!Y}function v6($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return"clientId"in Z||"jwksUri"in Z||"workloadId"in Z}function NZ($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;if(v6(Z))return!1;let Q=Object.entries(Z);if(Q.length===0)return!1;return Q.every(([,X])=>v6(X))}function p6($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;if("incoming"in Z||"outgoing"in Z){if(Z.incoming!==void 0&&(typeof Z.incoming!=="object"||Z.incoming===null))return!1;if(Z.outgoing!==void 0&&(typeof Z.outgoing!=="object"||Z.outgoing===null||Array.isArray(Z.outgoing)))return!1;return!0}return!1}function d6($){return p6($)}function $1($){if(!$)return;if(d6($))return Array.isArray($.incoming)?void 0:$.incoming;return $}function J1($){if($===void 0||$===null)return[];return Array.isArray($)?$:[$]}function E0($){if(typeof $!=="string")return;return $.endsWith("/")?$.slice(0,-1):$}function h6($){if(!$)return[];if(Array.isArray($))return $.filter((Z)=>!!Z&&typeof Z.issuer==="string"&&typeof Z.jwksUri==="string").map((Z)=>({issuer:Z.issuer,jwksUri:Z.jwksUri,audience:Z.audience,scopesAsEntitlements:Z.scopesAsEntitlements}));if($.issuer&&$.jwksUri)return[{issuer:$.issuer,jwksUri:$.jwksUri,audience:$.audience??[],scopesAsEntitlements:$.scopesAsEntitlements}];return[]}function AZ($){let Z=$[0];if(!Z)return;let Q=J1(Z.audience);return{jwksUri:Z.jwksUri,issuer:Z.issuer,audience:typeof Q[0]==="string"?Q[0]:void 0}}function f6($,Z){let Q=E0(Z);if(!Q)return;return $.find((X)=>E0(X.issuer)===Q)}function B4($,Z,Q){let X=J1($);if(Z.some((Y)=>X.includes(Y)))return!0;if(typeof Q==="string"&&Z.includes(Q))return!0;return!1}function Z1($){if(!$||!d6($))return{};return $.outgoing??{}}function EZ($){return{getToken:$.getToken,refreshToken:$.refreshToken,generateJWTAssertion:$.generateJWTAssertion,revokeToken:$.revokeToken,beforeChange:$.beforeChange,afterChange:$.afterChange,isReady:$.isReady,ready:$.ready}}var G1=Symbol("ion.workloadClientState"),u6=Symbol("ion.namedWorkloadClients");function jZ($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[G1]:"unavailable"}}function m6($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it is no longer configured on this Ionite instance.`)};return{getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[G1]:"removed"}}function qZ($){if(!$)return"removed";return $[G1]??"available"}function Q1($,Z,Q){let X=$,Y=X,J=new Set;for(let _ of Q){if(J.add(_),_ in Y)continue;let z=Z[_];Y[_]=z?EZ(z):jZ(_)}return Object.defineProperty(Y,u6,{value:J,enumerable:!1,configurable:!0}),X}function g6($){if(!$)return[];let Z=$[u6];return Z?Array.from(Z):[]}function RZ($,Z,Q){let X=Z,Y=w$(Q,`Workload client "${$}"`),J=()=>qZ(X)==="available",_=W$(`Workload client "${$}"`,J);return{api:{beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:_.isReady,ready:_.ready,getToken:(G)=>X.getToken(G),refreshToken:(G)=>X.refreshToken(G),generateJWTAssertion:(G)=>X.generateJWTAssertion(G),revokeToken:(G)=>X.revokeToken(G)},update(G){if(G===X)return;Y.emitBefore(),X=G,_.refresh(),Y.emitAfter()}}}function l6($){let Z,Q=!1,X=W$("Workload module",()=>Q),Y=w$($,"Workload"),J=new Map,_=new Set,z=new Set(["beforeChange","afterChange","isReady","ready"]),G=(U)=>{if(!Z)throw Error(`${U} is unavailable because workload is not configured on this Ionite instance.`);return Z},K={beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:X.isReady,ready:X.ready,get config(){return Z?.config??{}},getToken(...U){return G("getToken").getToken(...U)},refreshToken(U){return G("refreshToken").refreshToken(U)},generateJWTAssertion(U){return G("generateJWTAssertion").generateJWTAssertion(U)},revokeToken(U){return G("revokeToken").revokeToken(U)},validateToken(U){return G("validateToken").validateToken(U)},getWorkloadIdentity(U){return G("getWorkloadIdentity").getWorkloadIdentity(U)},parseJWT(U){return G("parseJWT").parseJWT(U)},handler(U){return G("handler").handler(U)}},H=(U)=>{for(let B of _)delete K[B];if(_.clear(),!U)return;let I=new Set(g6(U)),L=new Set([...z,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...I]);for(let[B,R]of Object.entries(U)){if(L.has(B))continue;K[B]=R,_.add(B)}},D=(U)=>{let I=J.get(U);if(I)return I;let L=RZ(U,m6(U),$);if(J.set(U,L),!(U in K))K[U]=L.api;return L};return{update(U){if(!U&&!Q&&J.size===0)return;Y.emitBefore(),Q=U!==void 0,X.refresh(),Z=U;let I=new Set(g6(U));for(let L of I){let B=U[L];D(L).update(B)}for(let[L,B]of J){if(I.has(L))continue;B.update(m6(L))}return H(U),Y.emitAfter(),K}}}async function X1($,Z,Q){if($===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let X=Q[$];if(!X)throw Error(`Unknown workload client: ${$}`);return X.getToken(Z)}function Y1($,Z){return`${$}|${Z??""}`}function l$($,Z,Q,X,Y){let J={jwtAssertionClaims:$?.jwtAssertionClaims??MZ("server"),tokenResponse:$?.tokenResponse??LZ("server")},_=async(A,q)=>{let v=A;if(typeof v.validate==="function")return v.validate(q);return A["~standard"].validate(q)};if(!Q&&!X)return;if(Q&&p6(Q)){let A=Q.incoming,q=h6(A),v=Array.isArray(A)?AZ(A):A,C=$1(X),b=Z1(X),n=v?{...v,...C,jwksUri:v.jwksUri,issuer:v.issuer}:C;if(!n||!n.tokenUrl&&!n.jwksUri)Z.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let p=n&&(n.tokenUrl||n.jwksUri)?l$($,Z,v??void 0,C,q):void 0,Z$=Array.from(new Set([...Object.keys(Q.outgoing??{}),...Object.keys(b)])).map((G$)=>[G$,{...Q.outgoing?.[G$]??{},...b[G$]??{}}]),s={};for(let[G$,e$]of Z$){let f$=l$($,Z,e$,void 0);if(f$)s[G$]=f$}if(!p&&Object.keys(s).length===0)return;let F$={...p?.config??{},config:p?.config??{},getToken:async(G$,e$)=>X1(G$,e$,s),getServerToken:async(G$)=>{if(!p)throw Error("No server workload config");return p.getToken(G$)},refreshToken:async(G$)=>{if(!p)throw Error("No default workload config");return p.refreshToken(G$)},generateJWTAssertion:async(G$)=>{if(!p)throw Error("No default workload config");return p.generateJWTAssertion(G$)},revokeToken:async(G$)=>{if(!p)throw Error("No default workload config");return p.revokeToken(G$)},validateToken:async(G$)=>{if(!p)throw Error("No default workload config");return p.validateToken(G$)},getWorkloadIdentity:async(G$)=>{if(!p)return;return p.getWorkloadIdentity(G$)},parseJWT:async(G$)=>{if(!p)throw Error("No default workload config");return p.parseJWT(G$)},handler:async(G$)=>{if(!p)return K$();return p.handler(G$)}};return Q1(F$,s,Z$.map(([G$])=>G$))}if(Q&&NZ(Q)){let A=$1(X),q=Z1(X),v=Q.default,C=v?{...v,...A,jwksUri:v.jwksUri,issuer:v.issuer}:A;if(!C||!C.tokenUrl&&!C.jwksUri)Z.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let b=C&&(C.tokenUrl||C.jwksUri)?l$($,Z,v??void 0,A):void 0,n=Array.from(new Set([...Object.keys(Q).filter((s)=>s!=="default"),...Object.keys(q)])).map((s)=>[s,{...s in Q?Q[s]:{},...q[s]??{}}]),p={};for(let[s,F$]of n){let G$=l$($,Z,F$,void 0);if(G$)p[s]=G$}if(!b&&Object.keys(p).length===0)return;let Z$={...b?.config??{},config:b?.config??{},getToken:async(s,F$)=>X1(s,F$,p),getServerToken:async(s)=>{if(!b)throw Error("No server workload config");return b.getToken(s)},refreshToken:async(s)=>{if(!b)throw Error("No default workload config");return b.refreshToken(s)},generateJWTAssertion:async(s)=>{if(!b)throw Error("No default workload config");return b.generateJWTAssertion(s)},revokeToken:async(s)=>{if(!b)throw Error("No default workload config");return b.revokeToken(s)},validateToken:async(s)=>{if(!b)throw Error("No default workload config");return b.validateToken(s)},getWorkloadIdentity:async(s)=>{if(!b)return;return b.getWorkloadIdentity(s)},parseJWT:async(s)=>{if(!b)throw Error("No default workload config");return b.parseJWT(s)},handler:async(s)=>{if(!b)return K$();return b.handler(s)}};return Q1(Z$,p,n.map(([s])=>s))}let z=$1(X),G=Z1(X);if(!Q&&Object.keys(G).length>0){let A={};for(let[C,b]of Object.entries(G)){let n=l$($,Z,b,void 0);if(n)A[C]=n}let q=z&&(z.tokenUrl||z.jwksUri)?l$($,Z,z,void 0):void 0;if(!q&&Object.keys(A).length===0)return;let v={...q?.config??{},config:q?.config??{},getToken:async(C,b)=>X1(C,b,A),getServerToken:async(C)=>{if(!q)throw Error("No server workload config");return q.getToken(C)},refreshToken:async(C)=>{if(!q)throw Error("No default workload config");return q.refreshToken(C)},generateJWTAssertion:async(C)=>{if(!q)throw Error("No default workload config");return q.generateJWTAssertion(C)},revokeToken:async(C)=>{if(!q)throw Error("No default workload config");return q.revokeToken(C)},validateToken:async(C)=>{if(!q)throw Error("No default workload config");return q.validateToken(C)},getWorkloadIdentity:async(C)=>{if(!q)return;return q.getWorkloadIdentity(C)},parseJWT:async(C)=>{if(!q)throw Error("No default workload config");return q.parseJWT(C)},handler:async(C)=>{if(!q)return K$();return q.handler(C)}};return Q1(v,A,Object.keys(G))}let K=Q,H=Y??h6(K),D=z?.tokenUrl,U=D?.startsWith("/")?D:void 0,I=K?.idpTokenUrl??z?.idpTokenUrl??(K?.tokenUrl&&(K.tokenUrl.startsWith("http://")||K.tokenUrl.startsWith("https://"))?K.tokenUrl:void 0),L={...K,...z,tokenUrl:U??z?.tokenUrl??K?.tokenUrl,idpTokenUrl:I,jwksUri:K?.jwksUri,issuer:K?.issuer};L._handlerTokenUrl=U;let B,R=L,E=E$(L),W=h$(L),F=e4(L);if(!E&&!W&&!F){if(!K||Object.keys(K).length===0)return;throw Z.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(L),clientId:R.clientId,clientSecret:R.clientSecret?"[REDACTED]":void 0,workloadId:R.workloadId,privateKey:R.privateKey?"[REDACTED]":void 0,jwksUri:R.jwksUri,tokenUrl:R.tokenUrl,idpTokenUrl:R.idpTokenUrl,fromVaultKeys:K?Object.keys(K):[],fromCodeKeys:X?Object.keys(X):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(E)B={...L,tokenUrl:L.tokenUrl,idpTokenUrl:P$(L.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:P$(L.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:P$(L.privateKey,"Missing 'privateKey' from Workload Config"),audience:P$(L.audience,"Missing 'audience' from Workload Config"),scope:L.scope??"",algorithm:L.algorithm??"RS256",tokenLifetime:L.tokenLifetime??300,refreshThreshold:L.refreshThreshold??60,autoRefresh:L.autoRefresh!==void 0?L.autoRefresh:!0,tokenStore:L.tokenStore??new Z0};else if(h$(L))B={...L,tokenUrl:L.tokenUrl,idpTokenUrl:P$(L.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:P$(L.clientId,"Missing 'clientId' from Workload Config"),clientSecret:P$(L.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:L.scope??"",tokenLifetime:L.tokenLifetime??300,refreshThreshold:L.refreshThreshold??60,autoRefresh:L.autoRefresh!==void 0?L.autoRefresh:!0,tokenStore:L.tokenStore??new Z0};else if(e4(L))B=L;function M(){let A=new Uint8Array(16);return crypto.getRandomValues(A),Array.from(A,(q)=>q.toString(16).padStart(2,"0")).join("")}function P(A){let q;if(typeof A==="string")q=btoa(A);else q=btoa(String.fromCharCode(...A));return q.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function T(A){let q=A.replace(/-/g,"+").replace(/_/g,"/");while(q.length%4)q+="=";return atob(q)}function h(A){if(A.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:A==="RS256"?"SHA-256":A==="RS384"?"SHA-384":"SHA-512"};else if(A.startsWith("ION"))return{name:"ECDSA",namedCurve:A==="ES256"?"P-256":A==="ES384"?"P-384":"P-521",hash:A==="ES256"?"SHA-256":A==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${A}`)}async function g(A,q){let v=A.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),C=Uint8Array.from(atob(v),(n)=>n.charCodeAt(0)),b=h(q);return crypto.subtle.importKey("pkcs8",C,b,!1,["sign"])}async function l(A,q,v){let C=await g(q,v),n=new TextEncoder().encode(A),p=h(v),Z$=await crypto.subtle.sign(p,C,n);return P(new Uint8Array(Z$))}async function j(A,q=3,v=1000,C=30000){let b=Error("Placeholder Error");for(let n=0;n<=q;n++)try{return await A()}catch(p){if(b=p instanceof Error?p:Error(String(p)),b.message.includes("400")||b.message.includes("401")||b.message.includes("403")||b.message.includes("404"))throw b;if(n<q){let Z$=Math.min(v*2**n,C),s=Math.random()*Z$*0.1;await new Promise((F$)=>setTimeout(F$,Z$+s))}}throw b}async function O(A){if(!E$(B))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let q=B,v=Math.floor(Date.now()/1000),C={iss:q.workloadId,sub:q.workloadId,aud:q.audience??"",exp:v+q.tokenLifetime,iat:v,jti:M(),scope:A??q.scope},b={alg:q.algorithm,typ:"JWT",kid:q.keyId},n=P(JSON.stringify(b)),p=P(JSON.stringify(C)),Z$=`${n}.${p}`,s=await l(Z$,q.privateKey,q.algorithm);return`${Z$}.${s}`}async function S(A){if(!E$(B))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let q=B;return j(async()=>{let v=q.idpTokenUrl,C=await O(A),b=new URLSearchParams;if(b.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),b.append("assertion",C),A)b.append("scope",A);let n=await fetch(v,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:b.toString()}),p=await n.json();if(!n.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:p});let s=p;throw Error(`Token acquisition failed: ${s.error||n.statusText} - ${s.error_description||""}`.trim())}let Z$=await _(J.tokenResponse,p);if(Z$.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:Z$.issues}),Error(`Token response validation failed: ${Z$.issues.map((s)=>s.message).join("; ")}`);if(q.tokenStore){let s=new Date(Date.now()+(Z$.value.expires_in??300)*1000),F$={workload_id:Y1(q.workloadId,A),access_token:Z$.value.access_token,token_type:Z$.value.token_type,scope:Z$.value.scope,expires_at:s,created_at:new Date,refresh_token:Z$.value.refresh_token};await q.tokenStore.set(F$)}return Z$.value})}async function f(A){if(!h$(B))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let q=B;return j(async()=>{let v=q.idpTokenUrl,C=new URLSearchParams;if(C.append("grant_type","client_credentials"),C.append("client_id",q.clientId),C.append("client_secret",q.clientSecret),A)C.append("scope",A);let b=await fetch(v,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:C.toString()}),n=await b.json();if(!b.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:n});let Z$=n;throw Error(`Token acquisition failed: ${Z$.error||b.statusText} - ${Z$.error_description||""}`.trim())}let p=await _(J.tokenResponse,n);if(p.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:p.issues}),Error(`Token response validation failed: ${p.issues.map((Z$)=>Z$.message).join("; ")}`);if(q.tokenStore){let Z$=new Date(Date.now()+(p.value.expires_in??300)*1000),s={workload_id:Y1(q.clientId,A),access_token:p.value.access_token,token_type:p.value.token_type,scope:p.value.scope,expires_at:Z$,created_at:new Date,refresh_token:p.value.refresh_token};await q.tokenStore.set(s)}return p.value})}let w=new Map;function d(A,q){let v=w.get(A);if(v)return v;let C=(async()=>{return(E$(B)?await S(q??""):await f(q??"")).access_token})();return w.set(A,C),C.catch(()=>{return}).finally(()=>{if(w.get(A)===C)w.delete(A)}),C}async function i(A){if(!E$(B)&&!h$(B)){let b=B;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!b.clientId}, hasClientSecret=${!!b.clientSecret}, hasWorkloadId=${!!b.workloadId}, hasPrivateKey=${!!b.privateKey}, hasJwksUri=${!!b.jwksUri}`)}let q=B;A=A??q.scope;let v=E$(B)?B.workloadId:B.clientId,C=Y1(v,A);if(q.tokenStore){let b=await q.tokenStore.get(C);if(b){let n=Date.now(),p=b.expires_at.getTime(),Z$=q.refreshThreshold*1000;if(n+Z$<p)return b.access_token;if(q.autoRefresh)try{return await d(C,A)}catch(s){if(n<p)return Z.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},s),b.access_token;throw s}}}return d(C,A)}async function X$(A){if(!E$(B)&&!h$(B))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let q=B;return A=A??q.scope,E$(q)?await S(A):await f(A)}async function Y$(A){if(!E$(B)&&!h$(B))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let q=B;try{if(!B.revocationEndpoint)return;let v=new URLSearchParams;if(v.append("token",A),v.append("token_type_hint","access_token"),E$(B)){let b=B;v.append("client_id",b.workloadId)}else if(h$(B)){let b=B;v.append("client_id",b.clientId),v.append("client_secret",b.clientSecret)}let C=await fetch(B.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:v.toString()});if(!C.ok)Z.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:C.status,statusText:C.statusText});else Z.info("Token revoked successfully",{"ion.module":"workload"});if(B.tokenStore){let b;if(E$(B))b=B.workloadId;else if(h$(B))b=B.clientId;else return;await B.tokenStore.delete(b)}}catch(v){Z.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},v)}}async function H$(A,q){let v=A??B?.jwksUri;if(!v)throw Error("No JWKS URI configured in Workload Config");return await OZ(v,Z,q)}async function c(A,q){let v=q??B?.jwksUri;if(!v)throw Error("No JWKS URI configured in Workload Config");let C=E$(B)?B.algorithm:"RS256";return WZ(v,A,`wl:${C}`,(b)=>{let n=b.alg||C,p=h(n);return crypto.subtle.importKey("jwk",b,p,!1,["verify"])},Z)}function J$(A){let q=A.split(".");if(q.length!==3)throw Error("Invalid JWT");return JSON.parse(T(q[1]))}async function _$(A,q){try{let v=A.split(".");if(v.length!==3)throw Error("Invalid JWT");let C=JSON.parse(T(v[0])),b=JSON.parse(T(v[1])),n=await c(C.kid,q),p=v[2],s=new TextEncoder().encode(`${v[0]}.${v[1]}`),F$=Uint8Array.from(T(p),(q0)=>q0.charCodeAt(0)),G$=h(C.alg);if(!await crypto.subtle.verify(G$,n,F$,s))throw Error("Invalid JWT signature");let f$=await _(J.jwtAssertionClaims,b);if(f$.issues)throw Z.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:f$.issues}),Error(`JWT claims validation failed: ${f$.issues.map((q0)=>q0.message).join("; ")}`);return f$.value}catch(v){throw Z.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},v),v}}async function V$(A){if(!E$(B)&&!h$(B)&&!e4(B))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(H.length>0){let C=J$(A),b=typeof C.iss==="string"?C.iss:void 0,n=f6(H,b);if(!n)return{valid:!1,error:"Untrusted token issuer"};let p=await _$(A,n.jwksUri),Z$=Math.floor(Date.now()/1000);if(p.exp&&p.exp<Z$)return{valid:!1,error:"Token expired"};let s=J1(n.audience);if(s.length>0&&!B4(p.aud,s,p.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:p,expiresAt:p.exp?new Date(p.exp*1000):void 0}}let q=await _$(A),v=Math.floor(Date.now()/1000);if(q.exp&&q.exp<v)return{valid:!1,error:"Token expired"};if(E$(B)){if(B.audience&&!B4(q.aud,[B.audience],q.azp))return{valid:!1,error:"Invalid audience"}}else if(h$(B)){if(B.issuer&&E0(q.iss)!==E0(B.issuer))return{valid:!1,error:"Invalid issuer"};if(B.audience&&!B4(q.aud,[B.audience],q.azp))return{valid:!1,error:"Invalid audience"}}else{let C=B;if(C.issuer&&E0(q.iss)!==E0(C.issuer))return{valid:!1,error:"Invalid issuer"};if(C.audience&&!B4(q.aud,[C.audience],q.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:q,expiresAt:q.exp?new Date(q.exp*1000):void 0}}catch(q){return{valid:!1,error:q instanceof Error?q.message:String(q)}}}function z$(A,q){let v=A[q];return typeof v==="string"&&v.trim()?v.trim():void 0}function N(A){if(!A)return;return A.startsWith("service-account-")?A.slice(16):A}function y(A){return z$(A,"client_id")??z$(A,"clientId")??z$(A,"azp")??z$(A,"appid")??N(z$(A,"preferred_username"))}let m=new WeakMap;function r(A){let q=m.get(A);if(q)return q;let v=e(A);return m.set(A,v),v}async function e(A){let q=A.headers.get("Authorization");if(!q?.startsWith("Bearer "))return;let v=q.substring(7),C=await V$(v);if(!C.valid||!C.claims)return;let b=H.length>0?f6(H,C.claims.iss):void 0,n=C.claims.ecid,p={workloadId:C.claims.sub,clientId:y(C.claims),scope:C.claims.scope,scopesAsEntitlements:b?.scopesAsEntitlements,...n!==void 0&&n!==null?{ecid:b6(n)}:{},claims:C.claims},Z$=B?.workloadIdentityStore;if(Z$){let s=p.clientId??p.workloadId??p.claims.sub,F$=s?await Z$.get(s):void 0;if(F$){if(F$.active===!1)return;if(F$.scopes?.length){let G$=new Set([...(p.scope??"").split(/\s+/).filter(Boolean),...F$.scopes]);p.scope=Array.from(G$).join(" ")}if(!p.ecid&&F$.ecid)p.ecid=b6(F$.ecid)}}return p}async function o(A){if(!B)throw Error("ionite Workload Manager not initialized");let q=new URL(A.url).pathname,v=(n)=>{if(!n)return;try{return new URL(n).pathname}catch{return n.startsWith("/")?n:`/${n}`}};if(v(B.validateUrl)===q&&A.method==="POST"){let n=A.headers.get("Authorization");if(!n?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let p=n.substring(7),Z$=await V$(p);if(!Z$.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:Z$.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(v(B.jwksUrl)===q&&A.method==="GET"){let n=await H$();return new Response(JSON.stringify(n),{headers:[["Content-Type","application/json"]]})}return K$()}return{...B,getToken:i,refreshToken:X$,generateJWTAssertion:O,revokeToken:Y$,validateToken:V$,getWorkloadIdentity:r,parseJWT:_$,handler:o}}function _1($){return $=$??"Workload authentication unavailable",new Response(JSON.stringify({error:$}),{status:503,statusText:$,headers:{"Content-Type":"application/json"}})}var D4="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",TZ="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function IZ($,Z){P$(Z,D4);let Q=Z.workload;if(!Q)return;return Q.getWorkloadIdentity($)}async function PZ($,Z,Q){P$(Z,D4);let X=Z.workload;if(!X)throw _1();let Y=X;if(typeof Y.getServerToken!=="function"||typeof Y.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return Y.getToken($,Q)}async function z1($,Z){P$(Z,TZ);let Q="validateToken"in Z&&typeof Z.validateToken==="function"?Z:Z.workload;if(!Q)return{valid:!1,error:"Workload authentication unavailable"};let X=$.headers.get("Authorization");if(!X?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let Y=X.substring(7);return Q.validateToken(Y)}async function xZ($,Z){P$(Z,D4);let Q=Z.workload;if(!Q)throw _1();return Q.revokeToken($)}async function SZ($,Z){P$(Z,D4);let Q=Z.workload;if(!Q)throw _1();return Q.handler($)}function c6($){try{return V4(new URL($,"http://dummy").pathname)}catch{let Z=$.startsWith("/")?$:`/${$}`;return V4(Z)}}function kZ($,Z){let Q=new URL($.url);return new URL(`/${encodeURIComponent(Z)}/`,Q.origin).toString()}function yZ($,Z){let Q=c6(Z),X=V4($);if(X===Q)return null;if(!X.startsWith(`${Q}/`))return null;let Y=X.slice(Q.length+1);if(!Y||Y.includes("/"))return null;return decodeURIComponent(Y)}function U4($){return $==="pending"||$==="processing"||$==="completed"||$==="failed"||$==="action_required"}function bZ($){if(!U4($.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if($.status==="completed"){if(!$.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:$.tenantUrl,status:"completed"},status:201}}if($.status==="pending"||$.status==="processing")return{body:{tenantUrl:$.tenantUrl,status:$.status},status:202};if($.status==="action_required"){if(!$.actionUrl||!$.requestToken||!$.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:$.actionUrl,requestToken:$.requestToken,expiresAt:$.expiresAt},status:200}}return{body:{tenantUrl:$.tenantUrl,status:"failed",error:$.error??"Tenant provisioning failed"},status:409}}function vZ($,Z){let Q=Z.validators.tenant.createTenantRequest,X=Z.validators.tenant.updateTenantRequest;function Y(K,H){let D=(U)=>new URL(U,H).toString();return{readyzUrl:D(K.readyzUrl),capabilitiezUrl:D(K.capabilitiezUrl),sso:{loginUrl:D(K.sso.loginUrl),userUrl:D(K.sso.userUrl),logoutUrl:D(K.sso.logoutUrl),logoutBackChannelUrl:D(K.sso.logoutBackChannelUrl),refreshUrl:D(K.sso.refreshUrl),callbackUrl:D(K.sso.callbackUrl)},workload:{validateUrl:D(K.workload.validateUrl),jwksUrl:D(K.workload.jwksUrl)},iam:{basePath:D(K.iam.basePath),usersUrl:D(K.iam.usersUrl),groupsUrl:D(K.iam.groupsUrl)},ciam:{magicLinkUrl:D(K.ciam.magicLinkUrl),magicLinkLoginUrl:D(K.ciam.magicLinkLoginUrl),customerUrl:D(K.ciam.customerUrl),customerLoginUrl:D(K.ciam.customerLoginUrl),customerCallbackUrl:D(K.ciam.customerCallbackUrl),customerProvidersUrl:D(K.ciam.customerProvidersUrl),logoutUrl:D(K.ciam.logoutUrl)}}}function J(K,H){let D=Z.tenantIonBasePath?.(K);if(!D)return;let U=new URL(H.url).origin,I=Y(m$(D),U);return{callbackUrl:I.sso.callbackUrl,ionUrls:I}}async function _(K){let H=await z1(K,Z.workloadAuth??$);if(!H.valid)return Response.json({error:H.error??"Unauthorized"},{status:401});return G0(K,$,wZ["tenant.manage"])}async function z(K){let D=new URL(K.url).pathname,U=yZ(D,Z.basePath),I=c6(Z.basePath),L=V4(D)===I;if(!L&&!U)return K$();if(!["GET","PUT","POST","DELETE"].includes(K.method))return W0(["GET","PUT","POST","DELETE"]);if(K.method==="GET"&&L&&U==null)return K$();let B=await _(K);if(B)return B;if(K.method==="GET"){if(U==null)return K$();let j=await Z.store.get(U);if(!j)return K$();let O=J(j,K);return Response.json(O?{...j,...O}:j,{status:200})}if(K.method==="DELETE"){if(!U)return K$();return await Z.store.delete(U),new Response(null,{status:204})}if(!U&&K.method!=="POST")return K$();let R;try{R=await K.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let E=K.method==="POST",W=E?await Q.validate(R):await X.validate(R);if(W.issues)return CZ(W.issues,E?"Tenant create validation failed":"Tenant update validation failed");let F=E?W.value.id:U;if(!F)return K$();if(U!=null&&W.value.id!=null&&W.value.id!==U)return Response.json({error:"Path id must match body id"},{status:400});let M=await Z.store.get(F);if(M&&!U4(M.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let P=new Date,T=M??{},h;if(E){let j=W.value,O=j,S=O.status,f=U4(S)?S:M?.status??"completed";h={...T,...j,id:F,companyId:j.companyId,companyName:j.companyName,environmentType:j.environmentType,configLocator:j.configLocator,email:j.email??M?.email,webhookUrl:j.webhookUrl??M?.webhookUrl,callbackUrl:j.callbackUrl??M?.callbackUrl,tenantUrl:O.tenantUrl??M?.tenantUrl,status:f,error:O.error??M?.error,actionUrl:O.actionUrl??M?.actionUrl,requestToken:O.requestToken??M?.requestToken,expiresAt:O.expiresAt??M?.expiresAt,createdAt:M?.createdAt??P,updatedAt:P}}else{let j=W.value,O=j,S=O.status,f=U4(S)?S:M?.status??"completed",{configLocator:w,...d}=j;h={...T,...d,id:F,companyId:j.companyId??M?.companyId??"",companyName:j.companyName??M?.companyName??"",environmentType:j.environmentType??M?.environmentType??"DEV",email:j.email??M?.email,webhookUrl:j.webhookUrl??M?.webhookUrl,callbackUrl:j.callbackUrl??M?.callbackUrl,tenantUrl:O.tenantUrl??M?.tenantUrl,status:f,error:O.error??M?.error,actionUrl:O.actionUrl??M?.actionUrl,requestToken:O.requestToken??M?.requestToken,expiresAt:O.expiresAt??M?.expiresAt,configLocator:w??M?.configLocator,createdAt:M?.createdAt??P,updatedAt:P}}if(!h.configLocator)return Response.json({error:"validation_failed",message:"Tenant configLocator is required",issues:[{message:"configLocator is required on create or must already exist on the stored tenant"}]},{status:422});if(!h.tenantUrl)h.tenantUrl=kZ(K,F);if(!h.callbackUrl){let j=J(h,K);if(j)h.callbackUrl=j.callbackUrl}let g=await Z.store.upsert(h),l=bZ(g);if(l instanceof Response)return l;return Response.json(l.body,{status:l.status})}async function G(K){try{if(!$.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await z(K)}catch(H){return L0(H)}}return{handler:G,getTenant:async(K)=>{return Z.store.get(K)}}}var K1="0.0.23-beta.20260814.1";export*from"@ionite/core";import{generateULID as l5,IoniteError as c5,listGenerator as i5}from"@ionite/core";import{allowHosts as s5,allowOrigins as a5,allowRelativePaths as t5,allowSameOrigin as r5,blockDangerousUrls as o5,CatalogAdjacencyCache as e5,callback as $Y,captureRedirect as ZY,ciam as QY,collectReferencedDefinitions as XY,defaultRedirectPolicies as YY,discoverSessionRecords as JY,discoverSessions as GY,expandRoot as _Y,getCustomer as zY,getUser as KY,has as HY,hasAll as BY,hasAllScope as DY,hasAny as UY,hasAnyScope as VY,hasGroup as FY,hasPermission as MY,hasRole as LY,hasScope as WY,InMemoryTenantStore as OY,iam as NY,initiateLogin as AY,isRedirectAllowed as EY,listSsoClientIdsFromCookies as jY,reconcileSubjectAccess as qY,resolveAfterRedirect as RY,resolveCapturedRedirect as TY,resolveRedirect as IY,sameOriginRedirectRules as PY,sendTenantWebhook as xY,sso as SY,verifyUser as wY,withDefaultExternalId as CY,withSetCookies as kY}from"@ionite/core/server";import{accessRefId as o$,accessRootId as i6,list as hZ}from"@ionite/core";function B1($){let{createdAt:Z,updatedAt:Q,...X}=$;return X}class c${roots=new Map;byTarget=new Map;bySubject=new Map;static targetKey($,Z){return`${$}:${Z}`}static subjectKey($,Z){return`${$}:${Z}`}indexAdd($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}indexRemove($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}deindex($){this.indexRemove(this.byTarget,c$.targetKey($.targetType,o$($.target)),$.id),this.indexRemove(this.bySubject,c$.subjectKey($.subjectType??"user",o$($.subject)),$.id)}index($){this.indexAdd(this.byTarget,c$.targetKey($.targetType,o$($.target)),$.id),this.indexAdd(this.bySubject,c$.subjectKey($.subjectType??"user",o$($.subject)),$.id)}resolve($,Z){if(!$)return[];let Q=[];for(let X of $){let Y=this.roots.get(X);if(Y&&(Y.status??"active")==="active"&&Z(Y))Q.push(Y)}return Q}async grant($){let Z=$.id??i6($),Q=new Date,X=this.roots.get(Z);if(X)this.deindex(X);let Y={...$,id:Z,status:$.status??"active",createdAt:X?.createdAt??Q,updatedAt:Q};this.roots.set(Z,Y),this.index(Y)}async revoke($){let Z=$.id??i6($),Q=this.roots.get(Z);if(Q)this.deindex(Q);this.roots.delete(Z)}async get($){let Z=this.roots.get($);return Z?B1(Z):void 0}async list($){let Z=Array.from(this.roots.values()).filter((Q)=>(Q.status??"active")==="active");return H1(Z,$)}async listByTarget($,Z,Q){let X=Z.trim(),Y=this.byTarget.get(c$.targetKey($,X)),J=this.resolve(Y,(_)=>_.targetType===$&&o$(_.target)===X);return H1(J,Q)}async listByTargets($){let Z=new Map;for(let{targetType:Q,target:X}of $){let Y=`${Q}:${X}`;if(Z.has(Y))continue;let J=X.trim(),_=this.byTarget.get(c$.targetKey(Q,J)),z=this.resolve(_,(G)=>G.targetType===Q&&o$(G.target)===J);Z.set(Y,z.map((G)=>B1(G)))}return Z}async listBySubject($,Z="user",Q){let X=o$($),Y=this.bySubject.get(c$.subjectKey(Z,X)),J=this.resolve(Y,(_)=>(_.subjectType??"user")===Z&&o$(_.subject)===X);return H1(J,Q)}}function H1($,Z){let Q=Math.max(0,Z?.start??0),X=Z?.limit,Y=X!=null?Q+X:void 0;return hZ($.length,$.slice(Q,Y).map(B1),Q,X)}import{assertValidSubjectTypeScoping as fZ,list as n6,readyCatalogEntry as mZ}from"@ionite/core";class s6{listeners=new Set;emit=($)=>{for(let Z of this.listeners)Z($)};groups=new F4("group",this.emit);roles=new F4("role",this.emit);permissions=new F4("permission",this.emit);afterChange($){return this.listeners.add($),()=>{this.listeners.delete($)}}}class a6{items=new Map;listeners=new Set;constructor($){if($?.deriveEntitlements){let{deriveEntitlements:Z,resolveEntitlement:Q}=$;if(!Q)throw Error("InMemoryResourceStore: resolveEntitlement must be provided with deriveEntitlements.");this.entitlements=(X)=>Z(X),this.entitlement=async(X)=>Q(X,(Y)=>this.items.get(Y))}}entitlements;entitlement;async get($){return this.items.get($)}async list($){let Z=Array.from(this.items.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=X!=null?Q+X:void 0;return n6(Z.length,Z.slice(Q,Y),Q,X)}async children($){return Array.from(this.items.values()).filter((Z)=>{return(typeof Z.parent==="string"?Z.parent:Z.parent?.id)===$})}changed($){return this.listeners.add($),()=>{this.listeners.delete($)}}set($){this.items.set($.id,$),this.emitChange({id:$.id})}delete($){if(!this.items.delete($))return;this.emitChange({id:$,deleted:!0})}emitChange($){for(let Z of this.listeners)Z($)}}class F4{kind;emit;items=new Map;byExternalId=new Map;constructor($,Z){this.kind=$;this.emit=Z}async get($){return this.items.get($)}async getByExternalId($){let Z=this.byExternalId.get($);return Z===void 0?void 0:this.items.get(Z)}set($){fZ($);let Z=this.items.get($.id);if(Z?.externalId&&Z.externalId!==$.externalId){if(this.byExternalId.get(Z.externalId)===$.id)this.byExternalId.delete(Z.externalId)}if(this.items.set($.id,$),$.externalId)this.byExternalId.set($.externalId,$.id);return this.emit({op:"set",kind:this.kind,entity:$}),mZ($,Promise.resolve())}async delete($){let Z=this.items.get($);if(Z?.externalId&&this.byExternalId.get(Z.externalId)===$)this.byExternalId.delete(Z.externalId);this.items.delete($),this.emit({op:"delete",kind:this.kind,id:$})}async list($){let Z=Array.from(this.items.values()),Q=$?.filter?.requestable;if(Q!==void 0)Z=Z.filter((_)=>Boolean(_.requestable)===Q);let X=Math.max(0,$?.start??0),Y=$?.limit,J=Y!=null?X+Y:void 0;return n6(Z.length,Z.slice(X,J),X,Y)}}import{accessRefId as i$}from"@ionite/core";function n$($,Z){return`${Z}:${$}`}function D1($,Z,Q){return`${$}:${Z}:${Q}`}function gZ($,Z,Q,X){return`${D1($,Z,Q)}:${X??""}`}class t6{rows=new Map;byTriple=new Map;byRoot=new Map;bySubject=new Map;edgeMeta=new Map;disabledSubjects=new Set;async has($,Z,Q,X,Y="user"){let J=i$($),_=i$(Q);if(!J||!_)return{allow:!1};if(this.disabledSubjects.has(n$(J,Y)))return{allow:!1,metadata:{reason:"subject_disabled"}};let z=D1(n$(J,Y),Z,_),G=X?i$(X):void 0;if(G===void 0){let D=this.byTriple.get(z);if(D&&D.size>0)return this.allow(J,Z,_,void 0);return{allow:!1}}let K=`${z}:${G}`,H=`${z}:`;if(this.rows.has(K))return this.allow(J,Z,_,G);if(this.rows.has(H))return this.allow(J,Z,_,void 0);return{allow:!1}}async hasGroup($,Z,Q,X="user"){return this.has($,"group",Z,Q,X)}async hasRole($,Z,Q,X="user"){return this.has($,"role",Z,Q,X)}async hasPermission($,Z,Q,X="user"){return this.has($,"permission",Z,Q,X)}async hasAny($,Z,Q="user"){for(let X of Z){let Y=await this.has($,X.targetType,X.target,X.resource,Q);if(Y.allow)return Y}return{allow:!1}}async hasAll($,Z,Q="user"){if(this.disabledSubjects.has(n$(i$($),Q)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(Z.length===0)return{allow:!0};let X=[];for(let Y of Z){let J=await this.has($,Y.targetType,Y.target,Y.resource,Q);if(!J.allow)return{allow:!1,matched:X};if(J.matched)X.push(...J.matched)}return{allow:!0,matched:X}}async materialize($,Z){this.removeRoot($),this.addRootEdges($,Z)}async replaceSubject($,Z,Q){let X=n$(i$($),Z),Y=new Map;for(let J of Q){let _=n$(i$(J.subject),J.subjectType??"user");if(_!==X)throw Error(`AccessIndex.replaceSubject received an edge for ${_}; expected ${X}.`);let z=Y.get(J.rootId);if(z)z.push(J);else Y.set(J.rootId,[J])}this.clearSubjectEdges(X);for(let[J,_]of Y)this.addRootEdges(J,_)}addRootEdges($,Z){let Q=new Set;for(let X of Z){let Y=n$(X.subject,X.subjectType??"user"),J=D1(Y,X.targetType,X.target),_=gZ(Y,X.targetType,X.target,X.resource);this.addToSet(this.rows,_,$),this.addToSet(this.byTriple,J,_),this.addToSet(this.bySubject,Y,_),this.edgeMeta.set(_,{triple:J,subjectId:Y}),Q.add(_)}if(Q.size>0)this.byRoot.set($,Q)}async removeByRoot($){this.removeRoot($)}removeRoot($){let Z=this.byRoot.get($);if(!Z)return;for(let Q of Z){let X=this.rows.get(Q);if(!X)continue;if(X.delete($),X.size===0)this.dropEdge(Q)}this.byRoot.delete($)}async listSubjects(){let $=[];for(let[Z,Q]of this.bySubject){if(Q.size===0)continue;let X=Z.indexOf(":");if(X<=0){$.push({subject:Z});continue}$.push({subjectType:Z.slice(0,X),subject:Z.slice(X+1)})}return $}async setSubjectDisabled($,Z,Q){let X=n$(i$($),Z);if(Q)this.disabledSubjects.add(X);else this.disabledSubjects.delete(X)}async isSubjectDisabled($,Z="user"){return this.disabledSubjects.has(n$(i$($),Z))}async clear($,Z="user"){if($===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}let Q=i$($);this.clearSubjectEdges(n$(Q,Z))}clearSubjectEdges($){let Z=this.bySubject.get($);if(!Z)return;for(let Q of[...Z]){let X=this.rows.get(Q);if(X)for(let Y of X){let J=this.byRoot.get(Y);if(J?.delete(Q)&&J.size===0)this.byRoot.delete(Y)}this.dropEdge(Q)}}allow($,Z,Q,X){return{allow:!0,matched:[{subject:$,targetType:Z,target:Q,resources:X?[X]:void 0}]}}addToSet($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}dropEdge($){this.rows.delete($);let Z=this.edgeMeta.get($);if(Z)this.removeFromSet(this.byTriple,Z.triple,$),this.removeFromSet(this.bySubject,Z.subjectId,$);this.edgeMeta.delete($)}removeFromSet($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}}function U1($){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function pZ($,Z){return{...$,subscribe:async(Q,X,Y)=>{try{return await $.subscribe(Q,X,Y)}catch(J){if(!(J instanceof I$))throw J;return await u$($,Q,X,Z,void 0,Y)}}}}function M4($){let Z=J0($.path,"path","azureConfig");z0($.ttl);let Q=$.vault??K4({type:"azure",authMethod:$.authMethod,entraTenantId:$.entraTenantId,clientId:$.clientId,clientSecret:$.clientSecret,federatedTokenFile:$.federatedTokenFile,managedIdentityClientId:$.managedIdentityClientId,imdsApiVersion:$.imdsApiVersion,vaultUrl:$.vaultUrl,vaultName:$.vaultName,apiVersion:$.apiVersion,secretNameTransform:$.secretNameTransform,secretNamePrefix:$.secretNamePrefix,scope:$.scope,ttl:$.ttl}),X=$.ttl?pZ(Q,$.ttl):Q;return{load:async()=>{try{return(await X.getFullSecret(Z)).data}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`Error retrieving remote config from Azure Key Vault: ${J}`,{cause:Y})}},subscribe:(Y,J)=>{return X.subscribe(Z,(_)=>{Y(_.data)},J)},secret:X}}import{IoniteError as F1}from"@ionite/core";function V1($){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}class K0 extends Error{path;constructor($,Z=`Waiting for vault config secret at ${$}`){super(Z);this.path=$;this.name="VaultConfigWaitingForSecretError"}code="not_found";sourceType="vault";status=404}function dZ($){return $ instanceof K0}class y0 extends Error{path;constructor($,Z){super(Z);this.path=$;this.name="VaultConfigInvalidPayloadError"}code="invalid_payload";sourceType="vault"}function uZ($){return $ instanceof y0}var e6=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function r6($){return e6.some((Z)=>(Z in $))}function o6($,Z){if(!$||typeof $!=="object"||Array.isArray($))throw new K0(Z,`Vault config secret at ${Z} is missing or not an object`);let Q=$;if(!r6(Q)&&Object.keys(Q).length===1&&"data"in Q){let X=Q.data;if(X&&typeof X==="object"&&!Array.isArray(X))Q=X}if(Object.keys(Q).length===0)throw new K0(Z,`Vault config secret at ${Z} is empty`);if(!r6(Q))throw new y0(Z,`Vault config secret at ${Z} is an invalid payload: not a RemoteConfig (no known keys: ${e6.join("/")})`);return Q}function lZ($,Z,Q){return{...$,subscribe:async(X,Y,J)=>{try{return await $.subscribe(X,Y,J)}catch(_){if(!(_ instanceof I$))throw _;return await u$($,X,Y,Z,Q(),J)}}}}function L4($){let Z=J0($.path,"path","vaultConfig");z0($.ttl);let Q=$.vault??A0({type:"vault",url:$.url,token:$.token,workload:$.workload,lfv:$.lfv,websocket:$.websocket,ttl:$.ttl,log:$.log}),X=$.vault&&$.ttl?lZ(Q,$.ttl,()=>$.log):Q,Y={get log(){return $.log},set log(J){if($.log=J,X&&"log"in X)X.log=J},load:async()=>{try{let J=await X.getFullSecret(Z);return o6(J.data,Z)}catch(J){if(J instanceof d$)throw new K0(Z);if(J instanceof K0||J instanceof y0)throw J;throw Error("Error retrieving remote config from vault",{cause:J})}},subscribe:(J,_)=>{return X.subscribe(Z,(z)=>{let G;try{G=o6(z.data,Z)}catch(K){$.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:Z,error:K instanceof Error?K.message:String(K)});return}J(G)},_)},secret:X};if($.lfv?.lfvServerUrl&&$.lfv.clientId&&$.lfv.deliveryEndpoint&&$.lfv.eventsEndpoint)Y[$4]={path:$.lfv.path??Z,lfvServerUrl:$.lfv.lfvServerUrl,clientId:$.lfv.clientId,deliveryTimeout:$.lfv.deliveryTimeout,retryInterval:$.lfv.retryInterval,warnInterval:$.lfv.warnInterval,deliveryEndpoint:$.lfv.deliveryEndpoint,eventsEndpoint:$.lfv.eventsEndpoint,verifyJwks:$.lfv.verifyJwks};return Y}function W4($){if($==null)return;if(typeof $==="number")return Number.isFinite($)?$:void 0;let Z=$.trim();if(!Z)return;let Q=Number.parseInt(Z,10);return Number.isFinite(Q)?Q:void 0}function cZ($,Z){let Q=$.vaultLfvServerUrl??Z?.lfvServerUrl,X=$.vaultLfvClientId??Z?.clientId,Y=$.vaultLfvDeliveryEndpoint??Z?.deliveryEndpoint,J=$.vaultLfvEventsEndpoint??Z?.eventsEndpoint;if(!Q||!X||!Y||!J)return Z;return{...Z,lfvServerUrl:Q,clientId:X,deliveryEndpoint:Y,verifyJwks:$.vaultLfvVerifyJwks??Z?.verifyJwks,eventsEndpoint:J,path:$.vaultLfvPath??Z?.path,deliveryTimeout:W4($.vaultLfvDeliveryTimeout)??Z?.deliveryTimeout,retryInterval:W4($.vaultLfvRetryInterval)??Z?.retryInterval,warnInterval:W4($.vaultLfvWarnInterval)??Z?.warnInterval}}function iZ($,Z){let Q=$.vaultWebsocketUrl??Z?.url;if(!Q)return Z;return{...Z,url:Q,token:$.vaultWebsocketToken??Z?.token,clientId:$.vaultWebsocketClientId??Z?.clientId,header:$.vaultWebsocketHeader??Z?.header}}function nZ($,Z){let Q=$.vaultWorkloadTokenUrl??Z?.idpTokenUrl,X=$.vaultWorkloadClientId??Z?.clientId,Y=$.vaultWorkloadClientSecret??Z?.clientSecret;if(!Q||!X||!Y)return Z;return{...Z,idpTokenUrl:Q,clientId:X,clientSecret:Y,scope:$.vaultWorkloadScope??Z?.scope}}function $8($,Z){return{...Z,url:$.vaultUrl??Z?.url,token:$.vaultToken??Z?.token,path:$.vaultPath??Z?.path,ttl:W4($.vaultTtl)??Z?.ttl,workload:nZ($,Z?.workload),lfv:cZ($,Z?.lfv),websocket:iZ($,Z?.websocket)}}function H0($){switch($.type){case"vault":return sZ($);case"azure":return aZ($);case"aws":return tZ($);case"gcp":return rZ($);default:throw Error(`Unsupported config locator type: ${$.type}`)}}function sZ($){return L4($8($))}function aZ($){return M4({authMethod:$.azureAuthMethod,entraTenantId:$.azureEntraTenantId,clientId:$.azureClientId,clientSecret:$.azureClientSecret,federatedTokenFile:$.azureFederatedTokenFile,managedIdentityClientId:$.azureManagedIdentityClientId,imdsApiVersion:$.azureImdsApiVersion,vaultUrl:$.azureVaultUrl,vaultName:$.azureVaultName,apiVersion:$.azureApiVersion,scope:$.azureScope,secretNamePrefix:$.azureSecretNamePrefix,path:$.azurePath,ttl:$.azureTtl})}function tZ($){return U1({webhookUrl:$.awsWebhookUrl,ttl:$.awsTtl})}function rZ($){return V1({ttl:$.gcpTtl})}function Z8($,Z){let Q=oZ($,Z);switch(Q.type){case"vault":return L4({vault:Q,path:$.path,ttl:$.ttl});case"azure":return M4({vault:Q,path:$.path,ttl:$.ttl});default:throw new F1(`Tenant config is not supported for secrets source type "${Q.type}" (path "${$.path}"). Only "vault" and "azure" sources can currently back a tenant configLocator.`,{status:500,statusText:"Unsupported tenant config source"})}}function oZ($,Z){if(!$.source)return Z.secret;if(!Z.secrets)throw new F1(`Tenant configLocator references secrets source "${$.source}" but the root Ionite has no secrets module configured. Declare it on the root Ionite (RemoteConfig.secrets) before referencing it.`,{status:500,statusText:"Secrets module not configured"});try{return Z.secrets.getSecretsSource($.source)}catch(Q){let X=Z.secrets.listSecretsSources().join(", ")||"(none)";throw new F1(`Tenant configLocator references unknown secrets source "${$.source}" (path "${$.path}"). Declared sources: ${X}.`,{status:500,statusText:"Unknown secrets source",cause:Q})}}function B0($){if(!$)return;let Z=Number.parseInt($,10);return Number.isFinite(Z)?Z:void 0}function Q8($,Z){let Q=Z?.type??$.ION_CONFIG_TYPE;if(!Q)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp.");if(Q==="vault")return{type:"vault",vaultUrl:$.ION_VAULT_URL,vaultToken:$.ION_VAULT_TOKEN,vaultPath:$.ION_VAULT_PATH??"",vaultTtl:B0($.ION_VAULT_TTL),vaultWorkloadTokenUrl:$.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:$.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:$.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:$.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:$.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:$.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:$.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:$.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:$.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvDeliveryTimeout:B0($.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:B0($.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:B0($.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:$.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:$.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:$.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:$.ION_VAULT_WEBSOCKET_HEADER};if(Q==="azure")return{type:"azure",azurePath:$.ION_AZURE_PATH,azureApiVersion:$.ION_AZURE_API_VERSION,azureScope:$.ION_AZURE_SCOPE,azureSecretNamePrefix:$.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:$.ION_AZURE_AUTH_METHOD,azureEntraTenantId:$.ION_AZURE_TENANT_ID,azureClientId:$.ION_AZURE_CLIENT_ID,azureClientSecret:$.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:$.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:$.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:$.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:$.ION_AZURE_VAULT_URL,azureVaultName:$.ION_AZURE_VAULT_NAME,azureTtl:B0($.ION_AZURE_TTL)};if(Q==="aws")return{type:"aws",awsWebhookUrl:$.ION_AWS_WEBHOOK_URL??"",awsTtl:B0($.ION_AWS_TTL)};if(Q==="gcp")return{type:"gcp",gcpTtl:B0($.ION_GCP_TTL)};throw Error(`ION_CONFIG_TYPE="${Q}" is not valid for envConfig(); supported types are vault, azure, aws, gcp.`)}function X8($,Z){return H0(Q8($,Z))}function eZ($){return X8(process.env,$)}var $3=1000,Z3=30000,Y8=["vault","azure","aws","gcp"];function J8($,Z){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`Config locator at ${Z} is an invalid payload: expected an object with a "type" field`);let Q=$.type;if(typeof Q!=="string"||!Y8.includes(Q))throw Error(`Config locator at ${Z} is an invalid payload: unknown type "${String(Q)}" (expected ${Y8.join("/")})`)}function G8($,Z){return $.log??=Z.log,$.validators??=Z.validators,$}function b0($){if(!$?.secret?.close)return;try{Promise.resolve($.secret.close()).catch((Z)=>{$.log?.warn?.("secretConfigSource: inner source close failed",Z)})}catch(Z){$.log?.warn?.("secretConfigSource: inner source close failed",Z)}}function Q3($,Z){let Q=J0(Z,"path","secretConfigSource"),X,Y=(_)=>{J8(_,Q);let z=JSON.stringify(_);if(X&&X.hash===z)return X.inner;let G=X?.inner,K=G8(H0(_),J);if(X={hash:z,inner:K},G&&G!==K)b0(G);return K},J={async load(){let _=await $.getSecret(Q);return Y(_).load()},async subscribe(_,z){let G,K=!1,H=!1,D,U,I=new Promise((P,T)=>{D=P,U=T}),L=Y4(),B,R,E=(P)=>new Promise((T)=>{R=T,B=setTimeout(T,P)}),W=async(P,T)=>{J8(P,Q);let h=JSON.stringify(P),g=X!==void 0&&X.hash===h;if(g&&G)return;let l=X?.inner,j=G,O=g&&X?X.inner:G8(H0(P),J),S=!g,f=()=>{if(S&&O!==l)b0(O)};try{if(O.subscribe){let d=await O.subscribe(_,z)??void 0;if(K||!L.isCurrent(T)){d?.(),f();return}if(G=d,X={hash:h,inner:O},j&&j!==d)j();if(S&&l&&l!==O)b0(l);return}let w=await O.load();if(K||!L.isCurrent(T)){f();return}if(X={hash:h,inner:O},j)j(),G=void 0;if(S&&l&&l!==O)b0(l);_(w)}catch(w){throw f(),w}},F=async(P)=>{let T=L.next(),h=$3;for(;;){if(K||!L.isCurrent(T))return;try{await W(P,T);return}catch(g){if(K||!L.isCurrent(T))return;J.log?.warn(`secretConfigSource rebind for ${Q} failed; keeping last-known-good source and retrying in ${h}ms`,g),await E(h),h=Math.min(Z3,h*2)}}},M=await $.subscribe(Q,(P)=>{if(K)return;if(!H){W(P.data,L.next()).then(()=>{H=!0,D()}).catch((T)=>{H=!0,U(T)});return}F(P.data)},z);return await I,()=>{if(K=!0,L.next(),B)clearTimeout(B);R?.(),G?.(),M(),b0(X?.inner),X=void 0}},secret:$};return J}import{defaultLogger as X3,stableConfigHash as Y3}from"@ionite/core";function _8($){return`${$}.__ionite_mirror`}function J3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function G3($){if($.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let Z=Array.from(new Set($.paths.map((E)=>E.trim()).filter(Boolean)));if(Z.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let Q=$.logger??X3,X=$.sourceId?.trim()||$.from.type,Y=[],J=Promise.resolve(),_=!1,z=!1,G=!1,K=W$("Secrets mirror",()=>_&&!G),H=(E)=>{let W=$.mapPath(E).trim();if(!W)throw Error(`mirrorSecrets mapPath returned an empty target for "${E}"`);return W},D=(E)=>{let W=J.then(E);return J=W.catch((F)=>{z=!0,Q.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:F instanceof Error?F.message:String(F)})}),W},U=async(E)=>{if(await $.to.exists(E))await $.to.deleteSecret(E)},I=async(E,W)=>{if(G)return;if(!J3(W.data))throw Error(`mirrorSecrets can only re-store object values (source path "${E}")`);let F=H(E),M=_8(F),P={sourceId:X,sourcePath:E,sourceVersion:W.metadata.version,contentHash:Y3(W.data)};if(await $.to.exists(M)){let T=await $.to.getSecret(M);if(T.sourceId===P.sourceId&&T.sourcePath===P.sourcePath&&T.sourceVersion===P.sourceVersion&&T.contentHash===P.contentHash&&await $.to.exists(F)){z=!1;return}}await $.to.putSecret(F,W.data,{...W.metadata.contentType?{contentType:W.metadata.contentType}:{}}),await $.to.putSecret(M,P),z=!1},L=async(E)=>{let W=H(E);await U(W),await U(_8(W)),z=!1},B=(E)=>{if(E.event!=="path_removed")return Z.includes(E.path)?[E.path]:[];let W=`${E.path.replace(/\/+$/g,"")}/`;return Z.filter((F)=>F===E.path||F.startsWith(W))},R=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if($.from.subscribeEvents)Y.push($.from.subscribeEvents((E)=>{if(R.has(E.event)){let W=B(E);if(W.length>0)D(async()=>{for(let F of W)await L(F)})}try{$.onEvent?.(E)}catch(W){Q.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:E.path,event:E.event,error:W instanceof Error?W.message:String(W)})}}));return(async()=>{try{for(let E of Z){let W=await $.from.subscribe(E,(F)=>{D(()=>I(E,F))},$.subscription);Y.push(W)}if(await J,G)return;_=!0,K.refresh()}catch(E){z=!0,Q.warn("Secrets mirror initialization failed",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:E instanceof Error?E.message:String(E)})}})(),{isReady:K.isReady,ready:K.ready,isAvailable:()=>_&&!G&&!z&&($.from.isAvailable?.()??!0)&&($.to.isAvailable?.()??!0),async purge(){if(G)throw Error("Secrets mirror is closed");await D(async()=>{for(let E of Z)await L(E)})},async close(){if(G)return;G=!0;for(let E of Y.splice(0))E();K.refresh(),K.settle(),await J}}}var z8;function _3($){z8=$}function z3($,Z){return z8?.({locator:$}),Z8($,Z)}import{buildTenantPath as K3,DEFAULT_TENANT_API_NAMESPACE as H8,DEFAULT_TENANT_UI_NAMESPACE as B8,matchTenantPath as D8,normalizeTenantPathNamespace as K8,normalizeTenantRoutingStrategy as H3}from"@ionite/core";function B3(){return Response.json({error:"Tenant not found"},{status:404})}function D3($){return Response.json({error:`Tenant runtime not found for ${$}`},{status:404})}function U3($,Z){let Q=H3($);if(Z==="api")return K8(Q.api??H8);return K8(Q.ui??B8)}function V3($){if($.store)return async(Z)=>$.store.getIon(Z);return async(Z)=>await $.getIon(Z)??void 0}async function U8($,Z={}){if(Z.custom){let J=await Z.custom($);if(J)return{id:J}}let Q=Z.namespace??"api",X=U3(Z.strategy,Q),Y=D8(new URL($.url).pathname,X);if(!Y)return null;return{id:Y.id,context:{namespace:Q,restPath:Y.restPath,restSegments:Y.restSegments}}}function V8($,Z){let Q=new URL($.url);return Q.pathname=Z,new Request(Q,$)}function M1($,Z,Q,X){let Y=D8(new URL($.url).pathname,Q);if(!Y||Y.id!==Z)return $;return V8($,K3(Z,Y.restPath,X))}function F3($,Z,Q={beforeTenantSegments:["api"],afterTenantSegments:[]}){return M1($,Z,H8,Q)}function M3($,Z,Q={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return M1($,Z,B8,Q)}function L3($){return async function(Q){try{let X=$.resolveTenant?await $.resolveTenant(Q):await U8(Q),Y=typeof X==="string"?{id:X,context:void 0}:X??null;if(!Y?.id)return $.onMissingTenant?await $.onMissingTenant(Q):B3();let J=await $.getIon(Y.id,Q)??null;if(!J)return $.onMissingIonite?await $.onMissingIonite(Q,Y.id):D3(Y.id);let _=$.rewriteRequest?await $.rewriteRequest(Q,{id:Y.id,ion:J,context:Y.context}):Q;return J.handler(_)}catch(X){return L0(X)}}}import{list as W3}from"@ionite/core";class F8{identities=new Map;clientIdIndex=new Map;async get($){return this.identities.get($)}async lookup($){if($.id){let Z=this.identities.get($.id);if(Z)return Z}if($.clientId){let Z=this.clientIdIndex.get($.clientId);if(Z)return this.identities.get(Z)}if($.externalId){for(let Z of this.identities.values())if(Z.externalId===$.externalId)return Z}return}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q=new Date,X=this.identities.get(Z),Y={...$,id:Z,createdAt:X?.createdAt??$.createdAt??Q,updatedAt:Q};if(X?.clientId&&X.clientId!==Y.clientId)this.clientIdIndex.delete(X.clientId);if(this.identities.set(Z,Y),Y.clientId)this.clientIdIndex.set(Y.clientId,Z);return Y}async delete($){let Z=this.identities.get($);if(Z?.clientId)this.clientIdIndex.delete(Z.clientId);return this.identities.delete($),Z?1:0}async list($){let Z=Array.from(this.identities.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,_=Z.slice(Q,J);return W3(Y,_,Q,X)}}function I3($){let Z=$,Q=Z.basePath??p0(),X=g0(Z.stores),Y=Z.routing,J=Z.beforeChange,_=Z.afterChange,z=Z.configRetry,G=Z.onConfigLoadError;return{frameworkConfig:{log:$.log,validators:$.validators,sso:$.sso,iam:$.iam,workload:$.workload,secrets:$.secrets,lfv:$.lfv,ciam:$.ciam,authz:$.authz,otel:$.otel},basePath:Q,stores:X,options:{beforeChange:J,afterChange:_,routing:Y,configRetry:z,onConfigLoadError:G}}}function P3($){let Z=$,Q={trace:(X,...Y)=>Z.trace(X,...Y),debug:(X,...Y)=>Z.debug(X,...Y),info:(X,...Y)=>Z.info(X,...Y),warn:(X,...Y)=>Z.warn(X,...Y),error:(X,...Y)=>Z.error(X,...Y)};return{logger:Q,update(X){return Z=X,Q}}}function T8($,Z){let Q=$;return Q.setStores=(X)=>{Z.current=g0(X),Object.assign(Q,R0(Q,Z.current))},Q}function L8($){let Z=$?.replace(/\s+/g," ").trim();return Z?Z:void 0}function I8($){if(typeof $!=="object"||$===null)return;return $.cause}function x3($){if(!($ instanceof Error))return typeof $==="string"?L8($):void 0;let Z=L8($.message),Q=[],X=$;if(typeof X.code==="string")Q.push(`code=${X.code}`);if(typeof X.status==="number")Q.push(`status=${X.status}`);if(typeof X.path==="string")Q.push(`path=${X.path}`);if(Q.length===0)return Z;if(!Z)return Q.join(", ");return`${Z} [${Q.join(", ")}]`}function N1($,Z=3){let Q=[],X=$,Y=0;while(X!=null&&Y<Z){let J=x3(X);if(J&&!Q.includes(J))Q.push(J);X=I8(X),Y+=1}return Q.length>0?Q.join(" <- "):void 0}function S3($,Z){if(typeof $!=="object"||$===null)return;return $[Z]}function x$($,Z){let Q=$,X=0;while(Q!=null&&X<3){let Y=S3(Q,Z);if(Y!==void 0)return Y;Q=I8(Q),X+=1}return}var w3=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function C3($){return typeof $==="string"&&w3.has($)}function k3($){let Z=x$($,"kind");if(C3(Z))return Z;let Q=x$($,"status"),X=x$($,"code"),Y=N1($)?.toLowerCase()??"";if(Q===401||Q===403||Y.includes("auth error")||Y.includes("permission denied"))return"auth";if(X==="not_found"||Y.includes("waiting for vault"))return"not_found";if(X==="ECONNREFUSED"||X==="ECONNRESET"||X==="ENOTFOUND"||X==="ETIMEDOUT"||Y.includes("connection")||Y.includes("fetch failed")||Y.includes("network"))return"connection";if(Y.includes("timed out"))return"timeout";if(Y.includes("invalid status")||typeof Q==="number"&&Q>=400)return"invalid_status";if(Y.includes("invalid payload")||Y.includes("invalid json")||Y.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function y3($){return"validation"}var b3=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function v3($,Z){let Q=x$($,"recoverable");if(typeof Q==="boolean")return Q;if(Z==="not_found")return!0;if(Z==="auth"||Z==="invalid_payload")return!1;let X=x$($,"status");if(typeof X==="number"&&X>=400&&X<500)return!1;let Y=x$($,"code");if(typeof Y==="string"&&(b3.has(Y)||Y.startsWith("UND_ERR_")))return!0;return!0}function h3($){return{initialDelayMs:Math.max(1,$?.initialDelayMs??2000),maxDelayMs:Math.max(1,$?.maxDelayMs??600000),multiplier:Math.max(1,$?.multiplier??2),jitterRatio:Math.max(0,$?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,$?.loadTimeoutMs??30000)}}function f3($,Z){let Q=Math.max(0,$-1),X=Math.min(Z.maxDelayMs,Z.initialDelayMs*Z.multiplier**Q);if(Z.jitterRatio===0)return Math.round(X);let Y=X*Z.jitterRatio,J=(Math.random()*2-1)*Y;return Math.max(1,Math.round(Math.min(Z.maxDelayMs,X+J)))}function m3($){return(Z)=>{let Q=Z.path?` at ${Z.path}`:"",X=Z.sourceType?` (${Z.sourceType})`:"";$.warn(`Config source${X} unavailable${Q}; ionite will retry automatically in ${Z.nextDelayMs}ms (attempt ${Z.attempt}, ${Z.errorKind}: ${Z.message}).`)}}async function g3($,Z){for(let Q of Z)await Q($)}function S$($){if(!$)return;try{return new URL($,"http://dummy").pathname}catch{return $.startsWith("/")?$:`/${$}`}}function p3($,Z){let Q=Z.id;if(typeof Q!=="string"||Q.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if($!==void 0&&$!==Q)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${$}", received "${Q}").`)}function d3($){let Z=$.kms;if(Z)for(let[X,Y]of Object.entries(Z)){if(X.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!Y||typeof Y!=="object"||Array.isArray(Y))throw Error(`RemoteConfig.kms.${X} must be an object.`);if(Y.source!==void 0&&(typeof Y.source!=="string"||Y.source.length===0))throw Error(`RemoteConfig.kms.${X}.source must be a non-empty string when present.`);if(Y.path!==void 0&&(typeof Y.path!=="string"||Y.path.length===0))throw Error(`RemoteConfig.kms.${X}.path must be a non-empty string when present.`)}let Q=$.otel;if(!Q)return;if(Q.apiKey!==void 0&&Q.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(Q.apiKeyPool!==void 0){if(typeof Q.apiKeyPool!=="string"||Q.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!Z?.[Q.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${Q.apiKeyPool}".`)}}function u3($){let Z=$.authz?.trustedProvisioningClients;if(!Z)return;Z.forEach((Q,X)=>{let Y=`authz.trustedProvisioningClients[${X}]`;if(typeof Q.issuer!=="string"||Q.issuer.length===0)throw Error(`${Y}: "issuer" is required and must be a non-empty string.`);if(typeof Q.clientId!=="string"||Q.clientId.length===0)throw Error(`${Y}: "clientId" is required and must be a non-empty string.`);let J=Array.isArray(Q.audience)?Q.audience:[Q.audience];if(J.length===0||J.some((_)=>typeof _!=="string"||_.length===0))throw Error(`${Y}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(Q.permissions)||Q.permissions.some((_)=>typeof _!=="string"||_.length===0))throw Error(`${Y}: "permissions" must be an array of non-empty permission ids.`)})}function l3($){let Z=Array.isArray($)?$:[$];return Z.length>0&&Z.every((Q)=>typeof Q==="string"&&Q.length>0)}function c3($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return;let Q=Z,X=(Y,J)=>{if(!l3(Y.audience))throw Error(`${J}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in Q||"outgoing"in Q){let Y=Q.incoming;if(Array.isArray(Y))Y.forEach((J,_)=>{if(J&&typeof J==="object")X(J,`workload.incoming[${_}]`)});else if(Y&&typeof Y==="object"&&"jwksUri"in Y)X(Y,"workload.incoming");return}if(P8(Q)){if("jwksUri"in Q&&!("clientId"in Q)&&!("workloadId"in Q))X(Q,"workload (server-only)");return}}function i3($,Z,Q){if($?.sso?.redirectUri&&Z.sso?.redirectUri){let X=S$($.sso.redirectUri),Y=S$(Z.sso.redirectUri);if(X!==Y)Q.error(`SSO redirectUri path mismatch: the framework derives "${Y}" from basePath, but ConfigSource reports "${X}". Register "${Y}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function A1($){let Z={};if(!$)return Z;for(let[Q,X]of Object.entries($))if(X.type==="vault"&&typeof X.lfv?.deliveryEndpoint==="string"&&typeof X.lfv?.eventsEndpoint==="string")Z[Q]=X.lfv;return Z}function n3($){return $[$4]}function s3($,Z){let Q=A1($.secrets??void 0),X=S$(Z.deliveryEndpoint),Y=S$(Z.eventsEndpoint),J=S$(Z.path);for(let _ of Object.values(Q)){if(S$(_.deliveryEndpoint)!==X)continue;if(S$(_.eventsEndpoint)!==Y)continue;let z=_.path?S$(_.path):void 0;if(J&&z&&J!==z)continue;return!0}return!1}function a3($,Z){let Q=n3(Z);if(!Q)return $;if(s3($,Q))return $;let X={type:"vault",lfv:{path:Q.path,lfvServerUrl:Q.lfvServerUrl,clientId:Q.clientId,deliveryTimeout:Q.deliveryTimeout,retryInterval:Q.retryInterval,warnInterval:Q.warnInterval,deliveryEndpoint:Q.deliveryEndpoint,eventsEndpoint:Q.eventsEndpoint,verifyJwks:Q.verifyJwks}},Y=$.secrets??{},J=u1(Y,{clientId:Q.clientId,path:Q.path});return{...$,secrets:{...Y,[J]:X}}}function t3($,Z){let Q=A1($.secrets),X=A1(Z.secrets??void 0);for(let[Y,J]of Object.entries(X)){let _=Q[Y];if(!_)continue;let z=S$(_.deliveryEndpoint),G=S$(J.deliveryEndpoint);if(z&&G&&z!==G)throw Error(`LFV deliveryEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${z}, framework path: ${G}`);let K=S$(_.eventsEndpoint),H=S$(J.eventsEndpoint);if(K&&H&&K!==H)throw Error(`LFV eventsEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${K}, framework path: ${H}`)}}function r3($){return new Set(Object.keys($.secrets??{}))}function o3($){return new Set(Object.keys($.secrets??{}))}function e3($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return new Set;if(!("outgoing"in Z))return new Set;let Q=Z.outgoing;if(!Q||typeof Q!=="object"||Array.isArray(Q))return new Set;return new Set(Object.keys(Q))}function P8($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return"clientId"in Z||"jwksUri"in Z||"workloadId"in Z}function $Q($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return new Set;let Q=Z;if("incoming"in Q||"outgoing"in Q){let X=Q.outgoing;if(!X||typeof X!=="object"||Array.isArray(X))return new Set;return new Set(Object.keys(X))}if(P8(Q))return new Set;return new Set(Object.keys(Q).filter((X)=>X!=="default"))}function ZQ($,Z,Q){let X=Z.secrets??{},Y=$.secrets??{};for(let[K,H]of Object.entries(X)){let D=Y[K];if(!D)continue;if(H.type&&D.type&&H.type!==D.type)throw Error(`Secrets source "${K}" type in framework config must match ConfigSource type. ConfigSource type: ${D.type}, framework type: ${H.type}`)}let J=r3(Z),_=o3($);for(let K of J)if(!_.has(K))Q.warn(`Framework config declares secrets source "${K}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let K of _)if(!J.has(K))Q.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:K});let z=e3(Z),G=$Q($);for(let K of z)if(!G.has(K))Q.warn(`Framework config declares outgoing workload client "${K}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(Z.otel!==void 0&&Z.otel!==null&&$.otel===void 0)Q.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function W8($,Z){if(Z===void 0)return!1;return N3($,Z)}function QQ($,Z){if(typeof Z!=="number"||Z<=0)return $;return new Promise((Q,X)=>{let Y=setTimeout(()=>{X(Error(`Ionite ready() timed out after ${Z}ms`))},Z);$.then(()=>{clearTimeout(Y),Q()},(J)=>{clearTimeout(Y),X(J)})})}function XQ($,Z,Q){if(typeof Z!=="number"||Z<=0)return $;return new Promise((X,Y)=>{let J=setTimeout(()=>{Y(Error(Q))},Z);$.then((_)=>{clearTimeout(J),X(_)},(_)=>{clearTimeout(J),Y(_)})})}function j1(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function O8($){return $==="/"?$:$.replace(/\/+$/,"")}function W1($,Z){return O8($)===O8(Z)}function N8($){return $.method==="GET"||$.method==="HEAD"}function YQ($){if($.isReady()&&$.config?.readyz?.enabled===!1)return K$();let Z=$.readiness();return Response.json(JQ(Z),{status:Z.ok?200:503})}function JQ($){let Z=$.config.lastError;if(!Z)return $;return{...$,config:{...$.config,lastError:{kind:Z.kind,phase:Z.phase,at:Z.at,message:"[redacted]"}}}}var GQ={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz"};function _Q($){let Z=$?.providers;if(!Z)return!1;return Object.values(Z).some((Q)=>Q.enabled!==!1&&Q.type!=="magic-link")}function R$($,Z,Q={}){let X=GQ[$],Y=Z.modules[X],J=Q.capable??!0,_=Y.active&&Y.ready&&J,z=_?void 0:!Y.active||!Y.ready?Y.reason:Q.incapableReason??`${$} is not testable by this application wiring`;return{module:X,active:Y.active,ready:Y.ready,testable:_,...Q.urls&&Q.urls.length>0?{urls:Q.urls}:{},...z?{reason:z}:{}}}function zQ($,Z,Q){let X=m$(Z),Y=$.readiness();return{sdk:{version:K1,catalogVersion:f4},basePath:Z,urls:X,modules:Y.modules,capabilities:{"sso.login":R$("sso.login",Y,{urls:[X.sso.loginUrl,X.sso.callbackUrl,X.sso.userUrl]}),"sso.jit":R$("sso.jit",Y,{capable:Q.sso?.enableJitUserProvisioning!==!1,incapableReason:"SSO JIT user provisioning is disabled in FrameworkConfig."}),"sso.logout":R$("sso.logout",Y,{urls:[X.sso.logoutUrl]}),"sso.back_channel_logout":R$("sso.back_channel_logout",Y,{urls:[X.sso.logoutBackChannelUrl]}),"ciam.magic_link":R$("ciam.magic_link",Y,{capable:Q.ciam?.enableJitUserProvisioning!==!1,urls:[X.ciam.magicLinkUrl,X.ciam.magicLinkLoginUrl],incapableReason:"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":R$("ciam.oidc_login",Y,{capable:_Q(Q.ciam),urls:[X.ciam.customerLoginUrl,X.ciam.customerCallbackUrl,X.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":R$("ciam.customer",Y,{urls:[X.ciam.customerUrl]}),"ciam.logout":R$("ciam.logout",Y,{urls:[X.ciam.logoutUrl]}),"iam.users":R$("iam.users",Y,{capable:Boolean(Q.iam?.userStore),urls:[X.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":R$("iam.groups",Y,{capable:Boolean(Q.authz?.catalogStore||Q.authz?.catalog),urls:[X.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"workload.incoming":R$("workload.incoming",Y,{urls:[X.workload.validateUrl,X.workload.jwksUrl]}),"workload.outgoing":R$("workload.outgoing",Y,{}),"authz.oaa":R$("authz.oaa",Y,{capable:Boolean(Q.authz?.accessStore&&(Q.authz?.catalogStore||Q.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."})}}}async function KQ($,Z,Q){if(!Z.isReady())return j1();if(Z.config?.capabilitiez!==!0||!Q)return K$();let X=await G0($,Z,j8["capabilitiez.read"]);if(X)return X;return Response.json(Q.build(),{status:200})}async function HQ($,Z,Q){if(!Z.isReady())return j1();if(Z.config?.authz?.oaa?.fullSync?.enabled!==!0)return K$();let X=await G0($,Z,j8["authz.oaa.sync"]);if(X)return X;let Y=Z.authz?.oaa;if(!Y?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let J=Z.authz?await Z.authz.reconcile():void 0,_=Q.iam?.userStore,z=R8(Q.authz?.catalog?q8(Q.authz.catalog):void 0,Q.authz?.catalogStore),G=Q.authz?.accessStore,K=Q.authz?.resources;async function*H(){if(z)yield*D0((U,I)=>z.groups.list({start:U,limit:I}));if(K?.entitlements){let U=K.entitlements.bind(K);for await(let I of D0((L,B)=>K.list({start:L,limit:B})))yield*U(I).map((L)=>T3(L))}}let D=await Y.sync({users:_?D0((U,I)=>_.list({start:U,limit:I})):void 0,groups:z||K?.entitlements?H():void 0,roles:z?D0((U,I)=>z.roles.list({start:U,limit:I})):void 0,permissions:z?D0((U,I)=>z.permissions.list({start:U,limit:I})):void 0,resources:K?D0((U,I)=>K.list({start:U,limit:I})):void 0,access:G?D0((U,I)=>G.list({start:U,limit:I})):void 0},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...D,reconcile:J})}function BQ($,Z,Q,X,Y,J){return async(_)=>{let z=new URL(_.url).pathname;if(W1(z,Q)){if(!N8(_))return W0(["GET"]);return YQ($)}if(W1(z,X)){if(!N8(_))return W0(["GET"]);return KQ(_,$,Y)}if(J&&W1(z,J.url)){if(_.method!=="POST")return W0(["POST"]);return HQ(_,$,J.frameworkConfig)}let G=$.secrets;if(!Boolean(G?.isLfvDeliveryRequest?.(_)||G?.isLfvEventsRequest?.(_))&&!$.isReady())return j1();try{return await Z(_)}catch(H){return $.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},H),L0(H)}}}function A8($,Z,Q){if($)return Q&&!$.tenantId?{...$,tenantId:Q}:$;if(Z&&Q)return{tenantId:Q};return}function DQ($,Z){if(Z.authz===null)return;if(!$.authz&&!Z.authz)return;return{...$.authz,...Z.authz,oaa:$.authz?.oaa||Z.authz?.oaa?{...$.authz?.oaa,...Z.authz?.oaa}:void 0}}function O1($){let Z=!1,Q=W$(`${$} module`,()=>Z);return{isReady:Q.isReady,ready:Q.ready,attach(X){if(Z=X!==void 0,Q.refresh(),!X)return;return Object.defineProperty(X,"isReady",{value:Q.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(X,"ready",{value:Q.ready,enumerable:!1,configurable:!0}),X}}}function E1($){if(!$)return!1;return $.isReady?$.isReady():!1}function j0($,Z,Q,X){if(!$)return{active:!1,ready:!1,reason:Q};return E1(Z)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:X}}function UQ(){let $=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:$(),ciam:$(),iam:$(),workload:$(),otel:$(),secrets:$(),kms:$(),authz:$()}}function VQ($,Z){let Q=$.isReady(),X=$.config;if(!Q||!X)return{ok:!1,applied:Q,modules:UQ(),config:{...Z}};let Y=Boolean(X.workload)||Boolean($.workload),J={sso:j0(Boolean(X.sso),$.sso,"sso not configured (no RemoteConfig.sso)","sso configured but not ready"),ciam:j0(Boolean(X.ciam),$.ciam,"ciam not configured (no RemoteConfig.ciam)","ciam configured but not ready"),iam:j0(Boolean(X.iam),$.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:j0(Y,$.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:j0(Boolean(X.otel),$.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(X.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!E1($.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return $.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:j0(Boolean(X.kms),$.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(X.authz?.oaa))return{active:!0,ready:!0};let G=$.authz?.oaa;return E1(G)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})()};return{ok:Object.values(J).every((z)=>!z.active||z.ready),applied:Q,modules:J,config:{...Z}}}function FQ($,Z){let Q=[];for(let X of Z){let Y=$.modules[X];if(!$.applied){Q.push({name:X,reason:"RemoteConfig has not been applied yet"});continue}if(!Y?.ready)Q.push({name:X,reason:Y?.reason??`${X} is not ready`})}return{ok:Q.length===0,notReady:Q}}function MQ($,Z,Q,X,Y,J,_,z){let G=Z.validators,K=q3($.cache);E3(K.jwks);let H=Z;if(K.session.read.enabled){let h=Z.sso?.sessionStore??Z.ciam?.sessionStore;if(h){let g=o4(h,K.session.read);H={...Z,sso:Z.sso?{...Z.sso,sessionStore:g}:Z.sso,ciam:Z.ciam?{...Z.ciam,sessionStore:g}:Z.ciam}}}let D={sessionCache:K.session},U=l$(G.workload,Q,$?.workload,Z.workload??void 0),I=Z.otel!==null?d4(Q,$?.otel,Z.otel??void 0,Y):void 0,L=A8($?.sso,Z.sso,$.id),B=R3(G.sso,Q,L,H.sso??void 0,D),R={...$?.iam,...Z.iam},E=Z.authz?.catalog?q8(Z.authz.catalog):void 0,W=Boolean(R.url||R.userStore||Z.authz?.catalogStore||E),F=_.update({mode:R.delta,url:R.url,audience:R.deltaAudience,tenantId:$.id},{workload:U,userStore:R.userStore,catalogStore:R8(E,Z.authz?.catalogStore),resources:Z.authz?.resources,idMapStore:R.deltaIdMapStore}),M;if(W&&!U){if(Object.keys($).length>0)Q.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");M=void 0}else M=j3(G.iam,Q,U,J,Z.authz?.accessStore,Z.authz?.accessIndex,Z.authz?.catalogStore,E,Z.authz?.resources,$?.iam,Z.iam??void 0,F,Z.authz?.onAccessMutation,O3($.authz),z);let P=A8($?.ciam,Z.ciam,$.id),T=A3(G.ciam,Q,P,H.ciam??void 0,U,D);return{secret:X,workload:U,otel:I,sso:B,iam:M,ciam:T}}function x8($,Z,Q,X,Y,J,_,z){let G=J.authz.update(DQ(Z,Q));$.id=Z.id,$.config=Z,$.secrets=J.secrets.update(Z.secrets,Q.secrets??void 0,Q.validators.secrets,Q.lfv?.callbackTransport),$.kms=J.kms.update(Z.kms,(U)=>{if(!U.source)return Y;if(!$.secrets)throw Error(`KMS pool references unavailable secrets source "${U.source}".`);return $.secrets.getSecretsSource(U.source)});let K=MQ(Z,Q,X,Y,J.kms.handle(),G,J.iamDelta,J.authz.settle);$.secret=K.secret,$.workload=J.workload.update(K.workload),$.otel=J.otel.update(K.otel),$.authz=G,$.log=J.log.update($.otel?.logger??X),$.sso=J.sso.attach(K.sso),$.iam=J.iam.attach(K.iam),$.ciam=J.ciam.attach(K.ciam);let H=m$(_),D=(U)=>l4(U,$,z?.routing,H);$.handler=BQ($,D,H.readyzUrl,H.capabilitiezUrl,{build:()=>zQ($,_,Q)},{url:T1(_),frameworkConfig:Q})}function LQ($,Z,Q,X,Y,J,_,z){p3($.id,Z),d3(Z),u3(Z),c3(Z),i3(Z,Q,X),t3(Z,Q),ZQ(Z,Q,X),x8($,Z,Q,X,Y,J,_,z)}function E8($){if(!$.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return $.secret}async function WQ($,Z,Q,X,Y,J,_){let z=$,G=I1($,Z,Y.current,J);if(X.beforeChange){let K=T8(G,Y);_?.enter();let H;try{H=await X.beforeChange($,K,Q)}finally{_?.exit()}if(H?.config!==void 0)z=H.config;G=H?.frameworkConfig??K}return G=R0(G,Y.current),{effectiveRemoteConfig:z,effectiveFrameworkConfig:G}}function g5($,Z){let Q=I3(Z),{frameworkConfig:X,basePath:Y,stores:J,options:_}=Q,z=R0(a3(X,$),J),G=z.log||L1,K={current:J},H={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:z},D={log:P3(G),secrets:y6(G),kms:G6(G),workload:l6(G),otel:D6(G),authz:p1(G),iamDelta:h4(G),sso:O1("sso"),iam:O1("iam"),ciam:O1("ciam")},U={},I,L,B=new Promise((c,J$)=>{I=c,L=J$}),R=!1,E,W,F=0,M={enter:()=>{F+=1},exit:()=>{F-=1}},P=Promise.resolve();function T(c){let J$=P.then(c,c);return P=J$.then(()=>{return},()=>{return}),J$}function h(c){if(R)throw Error(`Ionite instance has been closed and cannot call ${c}().`)}function g(){$.log=H.frameworkConfig.log??L1,$.validators=H.frameworkConfig.validators}let l={},j={log:G,id:void 0,config:void 0,secret:E8($),authz:void 0,configStatus:U,handler:async()=>K$(),ready:(c)=>{if(F>0&&H.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return QQ(B,c)},isReady:()=>H.remoteConfig!==void 0,readiness:()=>VQ(j,U),requireReady:(c)=>FQ(j.readiness(),c),close:()=>{if(R)return;if(R=!0,W)clearTimeout(W),W=void 0;E?.(),E=void 0;let c=[()=>D.secrets.close(),()=>D.kms.close(),()=>D.authz.close(),()=>D.otel.shutdown()];for(let J$ of c)try{Promise.resolve(J$()).catch((_$)=>{G.warn("Ionite close: module teardown failed",_$)})}catch(_$){G.warn("Ionite close: module teardown failed",_$)}I?.(),I=void 0,L=void 0},setStores:async(c)=>{h("setStores");let J$=g0(c);await T(()=>d(J$))}};x8(j,l,H.frameworkConfig,G,j.secret,D,Y,_),g();function O(){let c=U.lastError!==void 0;if(U.appliedAt=Date.now(),U.lastError=void 0,c)(j.log??G).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function S(c,J$){let _$=N1(J$)??(J$ instanceof Error?J$.message:String(J$)),V$=y3(J$),z$=U.lastError===void 0;if(U.lastError={kind:V$,message:_$,at:Date.now(),phase:c},z$)(j.log??G).error(c==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":V$,phase:c,error:_$})}function f(c,J$,_$){(j.log??G).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:c,"ion.config.hash":J$,"ion.config.apply_ms":_$})}async function w(c,J$){if(R)return;let _$=M8(c);if(J$&&H.remoteConfig!==void 0&&_$===H.remoteConfigHash&&W8(c,H.remoteConfig))return;let V$=H.remoteConfig,z$=V$===void 0?"initial":"update",N=Date.now(),y,m,r;try{let A=await WQ(c,H.frameworkConfig,H.remoteConfig,_,K,Y,M);if(y=A.effectiveRemoteConfig,m=M8(y),r=A.effectiveFrameworkConfig,J$&&_.beforeChange===void 0&&H.remoteConfig!==void 0&&m===H.remoteConfigHash&&W8(y,H.remoteConfig)&&r===H.frameworkConfig)return;let q=r.log||L1;LQ(j,y,r,q,E8($),D,Y,_)}catch(A){throw S(z$,A),A}H.remoteConfig=y,H.remoteConfigHash=m,H.frameworkConfig=r,g(),O(),await D.otel.settled();let e=T8(H.frameworkConfig,K),o=!1;try{_.afterChange?.(j,y,e,V$)}catch(A){if((j.log??G).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:z$,error:A instanceof Error?A.message:String(A)}),z$==="initial"){o=!0;let q=A instanceof Error?A:Error(`afterChange failed on initial load: ${String(A)}`);S("initial",q),L?.(q),L=void 0,I=void 0}}if(H.frameworkConfig=e,g(),!o)f(z$,m,Date.now()-N);if(!o&&I)I(),I=void 0}async function d(c){if(R)return;if(K.current=c,H.remoteConfig===void 0){H.frameworkConfig=R0(H.frameworkConfig,c),g();return}await w(H.remoteConfig,!1)}if($.subscribe)$.subscribe((c)=>{T(()=>w(c,!0)).catch(()=>{})},{mode:"wait"}).then((c)=>{if(R){c?.();return}E=c}).catch((c)=>{G.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:c instanceof Error?c.message:String(c)})});let i=h3(_.configRetry),X$=[_.onConfigLoadError??m3(G)],Y$=0;function H$(){if(W=void 0,R)return;if(H.remoteConfig!==void 0)return;XQ($.load(),i.loadTimeoutMs,`ConfigSource initial load timed out after ${i.loadTimeoutMs}ms`).then(async(c)=>{Y$=0;try{await T(async()=>{if(H.remoteConfig!==void 0)return;await w(c,!0)})}catch(J$){let _$=J$ instanceof Error?J$:Error(`Initial RemoteConfig application failed: ${String(J$)}`);G.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:_$.message}),L?.(_$),L=void 0}},async(c)=>{if(R)return;Y$+=1;let J$=f3(Y$,i),_$=N1(c)??"RemoteConfig load failed",V$=k3(c),z$=x$(c,"code"),N=x$(c,"status"),y={attempt:Y$,error:c,errorKind:V$,maxDelayMs:i.maxDelayMs,message:_$,nextDelayMs:J$,code:typeof z$==="string"?z$:void 0,status:typeof N==="number"?N:void 0,path:typeof x$(c,"path")==="string"?x$(c,"path"):void 0,sourceType:typeof x$(c,"sourceType")==="string"?x$(c,"sourceType"):void 0};if(!v3(c,V$)){let m=c instanceof Error?c:Error(`ConfigSource initial load failed with unrecoverable ${V$}: ${_$}`);G.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:V$,error:_$,code:y.code,status:y.status,path:y.path,sourceType:y.sourceType}),L?.(m),L=void 0;return}try{await g3(y,X$)}catch(m){let r=m instanceof Error?m:Error("ConfigSource retry hook stopped RemoteConfig retrying");L?.(r),L=void 0;return}W=setTimeout(H$,J$)})}return H$(),j}export{SZ as workloadHandler,l$ as workload,kY as withSetCookies,CY as withDefaultExternalId,wY as verifyUser,P6 as vaultSocketDiagnostics,L4 as vaultConfig,A0 as vault,z1 as validateWorkloadToken,vZ as tenantManager,z3 as tenantConfigSource,u$ as subscribeSecretPathWithHttpPolling,SY as sso,O6 as setVaultWebSocketCommandTimeout,xY as sendTenantWebhook,Q3 as secretConfigSource,PY as sameOriginRedirectRules,l4 as routeRequest,V8 as rewriteRequestPath,M1 as rewriteRequestForTenantPath,M3 as rewriteRequestForDefaultTenantUi,F3 as rewriteRequestForDefaultTenantApi,xZ as revokeWorkloadToken,U8 as resolveTenantFromRequest,IY as resolveRedirect,V6 as resolveDefaultRoute,TY as resolveCapturedRedirect,RY as resolveAfterRedirect,_3 as registerConfigLocatorAssert,qY as reconcileSubjectAccess,G3 as mirrorSecrets,jY as listSsoClientIdsFromCookies,i5 as listGenerator,S0 as lfvVault,dZ as isVaultConfigWaitingForSecretError,uZ as isVaultConfigInvalidPayloadError,EY as isRedirectAllowed,g5 as ionite,AY as initiateLogin,Z4 as iamDeltaIdMapKey,NY as iam,WY as hasScope,LY as hasRole,MY as hasPermission,FY as hasGroup,VY as hasAnyScope,UY as hasAny,DY as hasAllScope,BY as hasAll,HY as has,PZ as getWorkloadToken,IZ as getWorkload,KY as getUser,zY as getCustomer,l5 as generateULID,V1 as gcpConfig,_Y as expandRoot,b4 as escapeScimFilterValue,eZ as envConfig,G0 as enforceEndpointAuthz,GY as discoverSessions,JY as discoverSessionRecords,m$ as deriveIonUrls,YY as defaultRedirectPolicies,V3 as createTenantIonResolver,L3 as createTenantIonHandler,o4 as createSessionReadCache,h4 as createManagedIamDelta,H0 as configSourceFromLocator,X8 as configSourceFromEnvValues,Q8 as configLocatorFromEnvValues,XY as collectReferencedDefinitions,x6 as closeAllVaultSockets,QY as ciam,ZY as captureRedirect,$Y as callback,o5 as blockDangerousUrls,M4 as azureConfig,U1 as awsConfig,r5 as allowSameOrigin,t5 as allowRelativePaths,a5 as allowOrigins,s5 as allowHosts,I$ as VaultSubscribeNotSupportedError,K0 as VaultConfigWaitingForSecretError,y0 as VaultConfigInvalidPayloadError,G4 as VAULT_MIN_POLLING_TTL_MS,X4 as ScimOutboundClient,c5 as IoniteError,Z0 as InMemoryWorkloadTokenStore,F8 as InMemoryWorkloadIdentityStore,m0 as InMemoryUserStore,OY as InMemoryTenantStore,f0 as InMemorySessionStore,a6 as InMemoryResourceStore,h0 as InMemoryMagicLinkStore,Q4 as InMemoryIamDeltaIdMapStore,v0 as InMemoryCustomerStore,t6 as InMemoryAccessIndex,s6 as InMemoryAccessCatalogStore,c$ as InMemoryAccessAssignmentStore,K1 as ION_SDK_VERSION,f4 as ION_CAPABILITY_CATALOG_VERSION,l2 as ION_CAPABILITY_CATALOG,e5 as CatalogAdjacencyCache};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/server",
-  "version": "0.0.23-beta.20260812.6",
+  "version": "0.0.23-beta.20260814.1",
   "description": "ionite Server (Node/server-only)",
   "private": false,
   "author": "ionite",
@@ -24,7 +24,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@ionite/core": "0.0.23-beta.20260812.6",
+    "@ionite/core": "0.0.23-beta.20260814.1",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.220.0",
     "@opentelemetry/exporter-logs-otlp-http": "^0.220.0",