@ionite/server 0.0.23 → 0.0.24-beta.20260905.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/dist/index.d.ts +31 -19
  2. package/dist/index.js +3 -3
  3. package/package.json +2 -2
package/dist/index.js CHANGED
@@ -1,5 +1,5 @@
1
- import{configTrustedClientGrants as TQ,deepEqualPlain as IQ,defaultLogger as p1,ION_ENDPOINT_PERMISSIONS as Y9,listGenerator as w0,stableConfigHash as r8,toCodeCatalog as J9,unionCatalogRead as xQ}from"@ionite/core";import{ciam as wQ,configureJwksCache as SQ,iam as CQ,resolveCacheConfig as kQ,sso as bQ}from"@ionite/core/server";import{trimTrailingSlash as Z6}from"@ionite/core";import{list as P9}from"@ionite/core";class t0{customers=new Map;userNameIndex=new Map;async get($){return this.customers.get($)}async lookup($){if($.id){let Z=this.customers.get($.id);if(Z)return Z}if($.userName){let Z=this.userNameIndex.get($.userName.toLowerCase());if(Z)return this.customers.get(Z)}return}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q={...$,id:Z},X=this.customers.get(Z);if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase())}if(this.customers.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);return Q}async delete($){let Z=this.customers.get($);if(Z?.userName)this.userNameIndex.delete(Z.userName.toLowerCase());return this.customers.delete($),Z?1:0}async list($){let Z=Array.from(this.customers.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,G=Z.slice(Q,J);return P9(Y,G,Q,X)}}class r0{magicLinks=new Map;async create($,Z,Q){if(this.magicLinks.has($))throw Error(`Magic link with token ${$} already exists`);let X={token:$,customer:Z,createdAt:new Date,expiresAt:Q};this.magicLinks.set($,X)}async get($){let Z=this.magicLinks.get($);if(!Z)return null;if(Date.now()>Z.expiresAt.getTime())return this.magicLinks.delete($),null;return Z}async getAndDelete($){let Z=this.magicLinks.get($);if(this.magicLinks.delete($),!Z)return null;if(Date.now()>Z.expiresAt.getTime())return null;return Z}async delete($){this.magicLinks.delete($)}}function q9($){let Z=$.expiresAt;if(!Z)return;let Q=Z instanceof Date?Z.getTime():new Date(Z).getTime();return Number.isNaN(Q)?void 0:Q}class o0{sessions=new Map;async create($){if(this.sessions.has($.sid))throw Error(`Session with sid ${$.sid} already exists`);this.sessions.set($.sid,$)}async get($){let Z=this.sessions.get($);if(!Z)return null;let Q=q9(Z);if(Q!==void 0&&Date.now()>Q)return this.sessions.delete($),null;return Z}async update($,Z){let Q=this.sessions.get($);if(!Q)throw Error(`Session with sid ${$} not found`);let X={...Q,...Z};this.sessions.set($,X)}async delete($){this.sessions.delete($)}}import{list as T9,StoreConflictError as I9}from"@ionite/core";class e0{users=new Map;userNameIndex=new Map;externalIdIndex=new Map;async get($){return this.users.get($)}async getByExternalId($){let Z=this.externalIdIndex.get($);return Z?this.users.get(Z):void 0}async lookup($){return this.users.get($.id??"")}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q={...$,id:Z},X=this.users.get(Z),Y=Q.externalId?this.externalIdIndex.get(Q.externalId):void 0;if(Y&&Y!==Z)throw new I9(`externalId "${Q.externalId}" is already in use`,"unique_violation","externalId");if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase());if(X.externalId&&X.externalId!==Q.externalId)this.externalIdIndex.delete(X.externalId)}if(this.users.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);if(Q.externalId)this.externalIdIndex.set(Q.externalId,Z);return Q}async delete($){let Z=this.users.get($);if(Z){if(Z.userName)this.userNameIndex.delete(Z.userName.toLowerCase());if(Z.externalId)this.externalIdIndex.delete(Z.externalId)}return this.users.delete($),Z?1:0}async list($){let Z=Array.from(this.users.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,G=Z.slice(Q,J);return T9(Y,G,Q,X)}}class Q0{tokens=new Map;async set($){this.tokens.set($.workload_id,$)}async get($){let Z=this.tokens.get($);if(!Z)return null;if(Date.now()>Z.expires_at.getTime())return this.tokens.delete($),null;return Z}async delete($){this.tokens.delete($)}async isValid($){return await this.get($)!==null}async cleanup(){let $=Date.now();for(let[Z,Q]of this.tokens.entries())if($>Q.expires_at.getTime())this.tokens.delete(Z)}}function g$($){let Z=Z6($||v4);return{readyzUrl:`${Z}/readyz`,capabilitiezUrl:`${Z}/capabilitiez`,sso:{loginUrl:`${Z}/auth/login`,userUrl:`${Z}/auth/user`,logoutUrl:`${Z}/auth/logout`,logoutBackChannelUrl:`${Z}/auth/logout/backchannel`,refreshUrl:`${Z}/auth/refresh`,callbackUrl:`${Z}/auth/callback`},workload:{validateUrl:`${Z}/workload/validate`,jwksUrl:`${Z}/workload/jwks`},iam:{basePath:`${Z}/iam`,usersUrl:`${Z}/iam/Users`,groupsUrl:`${Z}/iam/Groups`},ciam:{magicLinkUrl:`${Z}/magic-link`,magicLinkLoginUrl:`${Z}/magic-link/login`,customerUrl:`${Z}/auth/customer`,customerLoginUrl:`${Z}/auth/customer/login`,customerCallbackUrl:`${Z}/auth/customer/callback`,customerProvidersUrl:`${Z}/auth/customer/providers`,logoutUrl:`${Z}/auth/customer/logout`}}}function Q6($){return`${Z6($||v4)}/authz/oaa/sync`}function x9($,Z){if($===null)return null;let Q={validateUrl:Z.validateUrl,jwksUrl:Z.jwksUrl};if($&&typeof $==="object"&&(("incoming"in $)||("outgoing"in $))){let X=$;return{...X,incoming:{...X.incoming,...Q}}}return{...$??{},...Q}}function X6($,Z,Q,X){let Y={...Z},J=g$(X);if(Y.sso!==null)if($.sso)Y.sso={...Y.sso,loginUrl:J.sso.loginUrl,userUrl:J.sso.userUrl,logoutUrl:J.sso.logoutUrl,logoutBackChannelUrl:J.sso.logoutBackChannelUrl,refreshUrl:J.sso.refreshUrl,redirectUri:J.sso.callbackUrl,sessionStore:Q.sessionStore,userStore:Q.userStore,enableJitUserProvisioning:Y.sso?.enableJitUserProvisioning??!0};else Y.sso=void 0;if(Y.iam!==null)if($.iam)Y.iam={...Y.iam,usersUrl:J.iam.usersUrl,groupsUrl:J.iam.groupsUrl,userStore:Q.userStore};else Y.iam=void 0;if(Y.workload!==null){if($.workload||Y.workload)Y.workload=x9(Y.workload,J.workload)}if(Y.ciam!==null)if($.ciam)Y.ciam={...Y.ciam,magicLinkUrl:J.ciam.magicLinkUrl,magicLinkLoginUrl:J.ciam.magicLinkLoginUrl,customerUrl:J.ciam.customerUrl,customerLoginUrl:J.ciam.customerLoginUrl,customerCallbackUrl:J.ciam.customerCallbackUrl,customerProvidersUrl:J.ciam.customerProvidersUrl,logoutUrl:J.ciam.logoutUrl,providers:$.ciam.providers,sessionStore:Q.sessionStore,customerStore:Q.customerStore,magicLinkStore:Q.magicLinkStore,enableJitUserProvisioning:Y.ciam?.enableJitUserProvisioning??!0};else Y.ciam=void 0;return Y}function b0($,Z){let Q={...$};if(Q.sso)Q.sso={...Q.sso,sessionStore:Z.sessionStore,userStore:Z.userStore};if(Q.iam)Q.iam={...Q.iam,userStore:Z.userStore};if(Q.workload)Q.workload={...Q.workload,tokenStore:Z.workloadTokenStore,workloadIdentityStore:Z.workloadIdentityStore};if(Q.ciam)Q.ciam={...Q.ciam,sessionStore:Z.sessionStore,customerStore:Z.customerStore,magicLinkStore:Z.magicLinkStore};if(Q.authz!==null&&(Z.accessStore||Z.accessIndex||Z.catalog||Z.catalogStore||Z.resources))Q.authz={...Q.authz,accessStore:Z.accessStore,accessIndex:Z.accessIndex,catalog:Z.catalog,catalogStore:Z.catalogStore,resources:Z.resources};return Q}var v4="/api/ionite";function $4($){return{sessionStore:$?.sessionStore??new o0,userStore:$?.userStore??new e0,customerStore:$?.customerStore??new t0,accessStore:$?.accessStore,accessIndex:$?.accessIndex,catalog:$?.catalog,catalogStore:$?.catalogStore,resources:$?.resources,magicLinkStore:$?.magicLinkStore??new r0,workloadTokenStore:$?.workloadTokenStore??new Q0,workloadIdentityStore:$?.workloadIdentityStore}}function Z4(){return v4}import{accessRefId as d4,accessRootId as G2,configTrustedClientGrants as z2,deepEqualPlain as _2,deprecateRetiredCodeCatalogRows as B2,list as M6,listGenerator as u4,toCodeCatalog as H2,unionCatalogRead as K2}from"@ionite/core";import{CatalogAdjacencyCache as D2,expandRoot as V2,reconcileSubjectAccess as U2}from"@ionite/core/server";import{accessRefId as p$,accessRootId as w9,ION_AUTHZ_GROUP_SCHEMA as S9,mergeCodeCatalogEntity as C9}from"@ionite/core";import{collectReferencedDefinitions as k9}from"@ionite/core/server";function U$($,Z,Q=(X)=>Error(`${$} ready timed out after ${X}ms`)){let X=!1,Y,J,G=()=>{X=!1,J=new Promise((B)=>{Y=B})};G();let z=()=>{X=!0,Y?.(),Y=void 0},_=()=>{if(Z()){if(!X)z();return}if(X)G()};return _(),{isReady:()=>Z(),ready:(B)=>{if(Z())return Promise.resolve();let H=J;if(!B||B<=0)return H;return new Promise((D,V)=>{let x=setTimeout(()=>V(Q(B)),B);H.then(()=>{clearTimeout(x),D()},(T)=>{clearTimeout(x),V(T)})})},refresh:_,settle:z}}var G6="App",b9="ionite",z6=104857600,y9=z6,v9=10485760,h4=3,h9=250,f9={};function e$($,Z){return Z.mapGroup?Z.mapGroup($):$}class v$ extends Error{retryable;code;status;warnings;constructor($,Z={}){super($,{cause:Z.cause});this.name="OaaError",this.retryable=Z.retryable??!1,this.code=Z.code,this.status=Z.status,this.warnings=Z.warnings,Object.setPrototypeOf(this,v$.prototype)}}function m9($){let Z=$();return Boolean(Z?.url&&Z.providerId&&Z.datasourceId)}function _6($,Z,Q,X,Y){let J=async(z)=>{await J6($,N$(Z),z,{mode:"incremental"})},G=U$("OAA",()=>m9(Z),(z)=>new v$(`OAA ready timed out after ${z}ms`,{code:"not_ready"}));return{isReady:G.isReady,ready:G.ready,refreshReadiness:G.refresh,async pushUser(z){let _=N$(Z);await J(q$(_,{local_users:[H6(z,"modify")]},!0))},async pushGroup(z){let _=N$(Z),B=Q(),H=e$(z,B),D=Y4(H,o$(_),"add"),V=await f4(H,"group",Y?.(),B,_);await J(q$(_,y0({local_groups:[X0(H,"modify")],identity_to_permissions:D?[D]:[]},V),!0))},async pushRole(z){let _=N$(Z),B=Q(),H=B.mapRole?B.mapRole(z):z,D=await f4(H,"role",Y?.(),B,_);await J(q$(_,y0({local_roles:[Y0(H,"modify")]},D),!0))},async pushPermission(z){let _=N$(Z);await J(q$(_,{permissions:[F0(z,Q().mapPermissionTypes,"modify")]},!0))},async pushResource(z){let _=N$(Z),B=Q(),H=B.mapResource?B.mapResource(z):z,D=await i9(H,Y?.(),B);await J(q$(_,{resources:D},!0))},async grant(z){let _=N$(Z),B=Q(),H=await B6(z,Y?.(),B,_);await J(Y6(_,z,"add",B,H))},async revoke(z){let _=N$(Z);await J(Y6(_,z,"delete",Q()))},async pushAccessChanges(z){if(z.length===0)return;let _=N$(Z),B=Q(),H=Y?.(),D=await p9(_,z,B,H);await J(D)},async deleteUser(z){let _=N$(Z);await J(q$(_,{local_users:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteGroup(z){let _=N$(Z);await J(q$(_,{local_groups:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteRole(z){let _=N$(Z);await J(q$(_,{local_roles:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deletePermission(z){let _=N$(Z);await J(q$(_,{permissions:[{name:z,unique_id:z,permission_type:[],operation:"delete"}]},!0))},async deleteResource(z){let _=N$(Z);await J(q$(_,{resources:[{name:z,id:z,resource_type:"",operation:"delete"}]},!0))},async sync(z,_){let B=N$(Z),H=_?.mode==="incremental",D=H?void 0:X?.(),V=await g9(B,z,Q(),H,D);return J6($,B,V,_)}}}function N$($){let Z=$();if(!Z?.url||!Z.providerId||!Z.datasourceId)throw new v$("OAA is not configured",{code:"not_configured"});return Z}async function g9($,Z,Q,X,Y){let J=[],G=[],z=[],_=[],B=[],H=[],D=X?"modify":void 0,V=new Set,x=(q)=>w9(q);for await(let q of U0(Z.users))J.push(H6(q,D));for await(let q of U0(Z.groups)){let I=e$(q,Q);G.push(X0(I,D));let O=Y4(I,o$($),X?"add":void 0);if(O)H.push(O)}for await(let q of U0(Z.roles)){let I=Q.mapRole?Q.mapRole(q):q;B.push(Y0(I,D))}for await(let q of U0(Z.permissions))_.push(F0(q,Q.mapPermissionTypes,D));let T=[];for await(let q of U0(Z.resources)){let I=Q.mapResource?Q.mapResource(q):q;T.push(I)}z.push(...K6(T,D));for await(let q of U0(Z.access))if(V.add(x(q)),X4(q,H,J,o$($),X?"add":void 0),typeof q.target!=="string")if(q.targetType==="role"){let I=Q.mapRole?Q.mapRole(q.target):q.target;B.push(Y0(I,D))}else if(q.targetType==="permission")_.push(F0(q.target,Q.mapPermissionTypes,D));else{let I=e$(q.target,Q);G.push(X0(I,D))}for(let q of Y??[]){let I=x(q);if(V.has(I))continue;V.add(I);let O=p$(q.subject);if(O&&!J.some((E)=>p$(E.unique_id??E.name)===O))J.push({name:O,unique_id:O,is_active:!0,operation:D,custom_properties:{identity_type:"workload",source:"eci-trusted"}});X4(q,H,J,o$($),D)}return q$($,{local_users:J,local_groups:G,local_roles:B,resources:z,permissions:_,identity_to_permissions:H},X)}function q$($,Z,Q){let X={name:$.applicationName??G6,application_type:$.applicationType??b9,local_users:Z.local_users??[],local_groups:Z.local_groups??[],local_roles:Z.local_roles??[],resources:Z.resources??[],custom_properties:{},tags:[]};if(Q)X.operation="modify";return A$({applications:[X],permissions:Z.permissions??[],identity_to_permissions:Z.identity_to_permissions??[],is_incremental:Q?!0:void 0})}function Y6($,Z,Q,X=f9,Y){let J=[],G=[],z=[],_=[],B=[];X4(Z,J,G,o$($),Q);let H=Q==="delete"?"delete":"modify";if(typeof Z.target!=="string")if(Z.targetType==="role"){let V=X.mapRole?X.mapRole(Z.target):Z.target;_.push(Y0(V,H))}else if(Z.targetType==="permission")B.push(F0(Z.target,X.mapPermissionTypes,H));else{let V=e$(Z.target,X);z.push(X0(V,H))}let D={local_users:G,local_groups:z,local_roles:_,permissions:B,identity_to_permissions:J};return q$($,Y?y0(D,Y):D,!0)}async function p9($,Z,Q,X){let Y=o$($),J=[],G=[],z=[],_=[],B=[],H=[],D=[],V=[];for(let{change:T,op:q}of Z){X4(T,q==="delete"?_:G,q==="delete"?z:J,Y,q==="delete"?"delete":"add");let M=q==="delete"?"delete":"modify";if(typeof T.target!=="string")if(T.targetType==="role"){let R=Q.mapRole?Q.mapRole(T.target):T.target;H.push(Y0(R,M))}else if(T.targetType==="permission")D.push(F0(T.target,Q.mapPermissionTypes,M));else{let R=e$(T.target,Q);B.push(X0(R,M))}if(q==="add")V.push(await B6(T,X,Q,$))}let x={local_users:[...J,...z],local_groups:B,local_roles:H,permissions:D,identity_to_permissions:[...G,..._]};return q$($,y0(x,...V),!0)}function y0(...$){let Z={},Q=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let X of $)for(let Y of Q){let J=X[Y];if(J&&J.length>0)Z[Y]=[...Z[Y]??[],...J]}return Z}async function f4($,Z,Q,X,Y){if(!Q)return{};let J=await k9($,Z,{catalog:Q.catalog,code:Q.code,resources:Q.resources,cache:Q.cache}),G=[];for(let z of J.groups){let _=e$(z,X),B=Y4(_,o$(Y),"add");if(B)G.push(B)}return{local_groups:J.groups.map((z)=>X0(e$(z,X),"modify")),local_roles:J.roles.map((z)=>Y0(X.mapRole?X.mapRole(z):z,"modify")),permissions:J.permissions.map((z)=>F0(z,X.mapPermissionTypes,"modify")),resources:J.resources.map((z)=>J4(X.mapResource?X.mapResource(z):z,"modify")),identity_to_permissions:G}}async function B6($,Z,Q,X){if(!Z)return{};if($.targetType!=="group"&&$.targetType!=="role")return{};let Y=p$($.target);if(!Y)return{};let J=typeof $.target==="string"?await d9($.targetType,Y,Z):$.target;if(!J)return{};let G={};if(typeof $.target==="string")if($.targetType==="group"){let _=e$(J,Q),B=Y4(_,o$(X),"add");G={local_groups:[X0(_,"modify")],identity_to_permissions:B?[B]:[]}}else{let _=Q.mapRole?Q.mapRole(J):J;G={local_roles:[Y0(_,"modify")]}}let z=await f4(J,$.targetType,Z,Q,X);return y0(G,z)}async function d9($,Z,Q){if(Q.cache)return await Q.cache.getNode($,Z);let X=$==="group"?Q.code?.groups.get(Z):Q.code?.roles.get(Z),J=await($==="group"?Q.catalog?.groups:Q.catalog?.roles)?.get(Z);return J&&X?C9($,X,J):J??X}function X4($,Z,Q,X,Y){let J=p$($.subject),G=p$($.target),z=Q.find((D)=>p$(D.unique_id??D.name)===J);if($.subjectType==="workload")if(z)z.custom_properties={...z.custom_properties,identity_type:"workload"};else z={name:J,unique_id:J,custom_properties:{identity_type:"workload"},operation:Y},Q.push(z);if($.targetType==="group"){if(z){let D=new Set(z.groups??[]);if(D.add(G),z.groups=[...D],Y)z.operation=Y}else Q.push({name:J,unique_id:J,groups:[G],operation:Y});return}let _={identity:J,identity_type:"local_user",operation:Y},B=$.resources??[],H=$.applyToApplication??B.length===0;if($.targetType==="role")_.role_assignments=[{application:X,role:G,apply_to_application:H,resources:B,operation:Y}];else _.application_permissions=[{application:X,permission:G,apply_to_application:H,resources:B,operation:Y}];Z.push(_)}function H6($,Z){return A$({name:$.displayName??$.name??$.userName??$.id,unique_id:$.id,identities:u9($),groups:$.groups?.map((Q)=>Q.value),is_active:$.active,created_at:Q2($.createdAt),custom_properties:A$({ecid:$.ecid,accountClass:$.accountClass,externalId:$.externalId,userName:$.userName,tenantId:$.tenantId}),tags:[],operation:Z})}function u9($){let Z=$.email?[$.email]:$.emails?.map((X)=>X.value).filter(Boolean)??[],Q=[...$.ecid?[$.ecid]:[],...Z];return Q.length>0?Q:void 0}function X0($,Z){let Q=l9($),X=O$($,"id")??O$($,"name")??O$($,"displayName"),Y=O$($,"displayName")??O$($,"name")??X??"group",J=Q4($,"resources");return A$({name:Y,unique_id:X,custom_properties:A$({requestable:Q?.requestable??X2($,"requestable"),description:Q?.description??O$($,"description"),type:Q?.type,resources:J.length>0?J:void 0}),tags:[],operation:Z})}function l9($){let Z=$[S9];if(!Z||typeof Z!=="object"||Array.isArray(Z))return;return Z}function Q4($,Z){if(!$||typeof $!=="object")return[];let Q=$[Z];if(!Array.isArray(Q))return[];return Q.map(p$).filter((X)=>X.length>0)}function c9($){return O$($,"id")??O$($,"name")??O$($,"displayName")??"group"}function Y4($,Z,Q){let X=Q4($,"resources"),Y=X.length>0,J=!Y,G=Y?X:[],z=Q4($,"roles").map((B)=>({application:Z,role:B,apply_to_application:J,resources:G,operation:Q})),_=Q4($,"permissions").map((B)=>({application:Z,permission:B,apply_to_application:J,resources:G,operation:Q}));if(z.length===0&&_.length===0)return;return{identity:c9($),identity_type:"local_group",role_assignments:z.length>0?z:void 0,application_permissions:_.length>0?_:void 0,operation:Q}}function Y0($,Z){return A$({name:$.name,unique_id:$.id,permissions:$.permissions?.map((Q)=>typeof Q==="string"?Q:Q.id),custom_properties:A$({displayName:$.displayName,requestable:$.requestable,...$.metadata}),tags:[],operation:Z})}function F0($,Z,Q){return A$({name:$.name,unique_id:$.id,permission_type:Z?.($)??$.permissionTypes??[$.action??"Uncategorized"],apply_to_sub_resources:$.applyToSubResources,resource_types:$.resourceTypes,operation:Q})}function J4($,Z,Q,X=new Set){let Y=$.id;if(Y&&X.has(Y))return A$({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,custom_properties:A$({...$.metadata}),tags:[],operation:Z});if(Y)X.add(Y);let J=[];for(let G of $.resources??[]){let z=typeof G==="string"?Q?.get(G):G;if(z)J.push(J4(z,Z,Q,X))}if(Y)X.delete(Y);return A$({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,sub_resources:J.length>0?J:void 0,custom_properties:A$({...$.metadata}),tags:[],operation:Z})}function K6($,Z){if($.length===0)return[];let Q=new Map;for(let _ of $)if(_.id)Q.set(_.id,_);let X=new Map,Y=new Set,J=(_,B)=>{if(!B.id||B.id===_)return;let H=X.get(_)??[];if(!H.some((D)=>D.id===B.id))H.push(B);X.set(_,H),Y.add(B.id)};for(let _ of $){for(let H of _.resources??[]){let D=typeof H==="string"?Q.get(H):H;if(D&&_.id)J(_.id,D)}let B=p$(_.parent);if(B&&Q.has(B)&&_.id)J(B,_)}let G=(_)=>{if(!_.id)return _;let B=X.get(_.id);if(!B||B.length===0)return _;return{..._,resources:B.map(G)}};return $.filter((_)=>!_.id||!Y.has(_.id)).map(G).map((_)=>J4(_,Z,Q))}async function i9($,Z,Q){if(!Z)return[J4($,"modify")];let X=async(H)=>{if(Z.cache)return await Z.cache.getNode("resource",H);return Z.resources?.get(H)},Y=async(H)=>{if(Z.resources?.children&&H.id&&(!H.resources||H.resources.length===0))return Z.resources.children(H.id);let D=[];for(let V of H.resources??[]){let x=typeof V==="string"?await X(V):V;if(x)D.push(x)}return D},J=$,G=new Set;while(!0){let H=p$(J.parent);if(!H||G.has(H))break;G.add(H);let D=await X(H);if(!D)break;J=D}let z=[],_=[J],B=new Set;while(_.length>0){let H=_.shift();if(!H)break;if(H.id&&B.has(H.id))continue;if(H.id)B.add(H.id);let D=Q.mapResource?Q.mapResource(H):H;z.push(D);for(let V of await Y(H))_.push(V)}if($.id&&!B.has($.id))z.push(Q.mapResource?Q.mapResource($):$);return K6(z,"modify")}async function J6($,Z,Q,X){let Y=JSON.stringify(A$(Q)),J=X?.compression??Z.compression??"gzip",G=J==="gzip"?await e9(Y):Y,z=Z2(G),_=X?.maxPayloadBytes??Z.maxPayloadBytes??z6,B=X?.multipart??Z.multipart??"auto",H=X?.multipartThresholdBytes??Z.multipartThresholdBytes??y9;if(z>_&&B==="never")throw new v$("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(B==="always"||B==="auto"&&z>H)return s9($,Z,G,J,X);return n9(Z,{id:Z.datasourceId,data_source_id:Z.datasourceId,json_data:G,compression_type:J==="gzip"?"GZIP":"NONE"})}async function n9($,Z){let Q=`${F6($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:push`,X=await G4(Q,{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"},body:JSON.stringify(Z)});return V6(X)}async function s9($,Z,Q,X,Y){let J=Y?.partSizeBytes??Z.partSizeBytes??v9,G=await a9(Z,X),z=$2(Q,J);for(let B=0;B<z.length;B++)await t9(Z,G,B+1,z[B]??"");let _=await r9(Z,G,z.length);return $.debug("OAA multipart payload pushed",{uploadId:G,parts:z.length}),{..._,uploadId:_.uploadId??G,parts:_.parts??z.length}}async function a9($,Z){let Q=m4($,"multipart/start"),X=await G4(Q,{method:"POST",headers:g4($),body:JSON.stringify({data_source_id:$.datasourceId,compression_type:Z==="gzip"?"GZIP":"NONE"})}),Y=await p4(X),J=O$(Y,"upload_id")??O$(Y,"uploadId")??O$(Y,"id");if(!J)throw new v$("OAA multipart start response did not include an upload id",{code:"invalid_response"});return J}async function t9($,Z,Q,X){let Y=m4($,`multipart/${encodeURIComponent(Z)}/parts/${Q}`);await G4(Y,{method:"PUT",headers:g4($),body:JSON.stringify({upload_id:Z,sequence:Q,data:X})})}async function r9($,Z,Q){let X=m4($,`multipart/${encodeURIComponent(Z)}/complete`),Y=await G4(X,{method:"POST",headers:g4($),body:JSON.stringify({upload_id:Z,parts:Q})});return V6(Y)}function m4($,Z){return`${F6($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:${Z}`}function g4($){return{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"}}async function G4($,Z){let Q;for(let X=0;X<h4;X++){try{let Y=await fetch($,Z);if(!D6(Y.status)||X===h4-1){if(!Y.ok)await o9(Y);return Y}Q=new v$(`OAA request failed with retryable status ${Y.status}`,{retryable:!0,status:Y.status})}catch(Y){if(Q=Y,Y instanceof v$&&!Y.retryable)throw Y;if(X===h4-1)break}await J2(h9*2**X)}throw new v$("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:Q})}function D6($){return $===429||$>=500}async function o9($){let Z=await p4($).catch(()=>{return}),Q=O$(Z,"message")??O$(Z,"error")??`OAA request failed with status ${$.status}`;throw new v$(Q,{code:O$(Z,"code")??"http_error",status:$.status,retryable:D6($.status),warnings:U6(Z?.warnings)})}async function V6($){let Z=await p4($).catch(()=>{return});return{success:$.ok,syncToken:O$(Z,"sync_token")??O$(Z,"syncToken"),uploadId:O$(Z,"upload_id")??O$(Z,"uploadId"),parts:Y2(Z,"parts"),warnings:U6(Z?.warnings),metadata:Z}}async function p4($){let Z=await $.text();if(!Z)return{};let Q=JSON.parse(Z);return Q&&typeof Q==="object"&&!Array.isArray(Q)?Q:{}}async function e9($){let Z=new Blob([$]).stream().pipeThrough(new CompressionStream("gzip")),Q=await new Response(Z).arrayBuffer();return Buffer.from(Q).toString("base64")}function $2($,Z){let Q=[];for(let X=0;X<$.length;X+=Z)Q.push($.slice(X,X+Z));return Q}function Z2($){return Buffer.byteLength($,"utf8")}function Q2($){if(!$)return;return $ instanceof Date?$.toISOString():$}function O$($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="string"&&Q.length>0?Q:void 0}function X2($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="boolean"?Q:void 0}function Y2($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="number"?Q:void 0}function U6($){if(!Array.isArray($))return;let Z=$.filter((Q)=>typeof Q==="string");return Z.length>0?Z:void 0}async function*U0($){if(!$)return;for await(let Z of $)yield Z}function A$($){if(Array.isArray($))return $.map(A$).filter((Q)=>Q!==void 0);if(!$||typeof $!=="object"||$ instanceof Date)return $===null?void 0:$;let Z=Object.entries($).map(([Q,X])=>[Q,A$(X)]).filter(([,Q])=>{if(Q===void 0)return!1;if(Array.isArray(Q)&&Q.length===0)return!1;if(Q&&typeof Q==="object"&&!Array.isArray(Q)&&Object.keys(Q).length===0)return!1;return!0});return Z.length>0?Object.fromEntries(Z):void 0}function F6($){return $.replace(/\/+$/,"")}function o$($){return $.applicationName??G6}function J2($){return new Promise((Z)=>setTimeout(Z,$))}function W6($,Z=()=>{return}){let Q,X=!1,Y,J,G=_6($,()=>Q?.oaa,()=>({mapPermissionTypes:Q?.mapPermissionTypes,mapGroup:Q?.mapGroup,mapRole:Q?.mapRole,mapResource:Q?.mapResource}),()=>z2(Q),()=>{let W=Q?.catalogStore;return W||Y?{catalog:W,code:Y,resources:Q?.resources,cache:J}:void 0}),z=(W)=>{if(W.op!=="set"||!W.previous)return!1;if(!(W.previous.providerId!==W.entity.providerId||W.previous.requestUrl!==W.entity.requestUrl))return!1;let{providerId:k,requestUrl:w,...b}=W.previous,{providerId:u,requestUrl:c,...o}=W.entity;return _2(b,o)},_=(W)=>{if(X)return;let{kind:L}=W;if(G.isReady())(W.op==="delete"?L==="role"?G.deleteRole(W.entity.id):L==="permission"?G.deletePermission(W.entity.id):G.deleteGroup(W.entity.id):L==="role"?G.pushRole(W.entity):L==="permission"?G.pushPermission(W.entity):G.pushGroup(W.entity)).catch((u)=>{$.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:W.op,kind:L,error:u})});let k=Z();if(!k?.isReady())return;if(W.op==="set"&&W.entity.requestable!==!0){if(W.previous?.requestable===!0)k.onEntitlementDelete(L,W.previous.id).catch((b)=>{$.warn("IAM delta removal of a no-longer-requestable entitlement failed",{"ion.operation":"iam.delta.delete","ion.outcome":"degraded",id:W.entity.id,kind:L,error:b instanceof Error?b.message:String(b)})});return}(W.op==="delete"?k.onEntitlementDelete(L,W.entity.id):k.onEntitlementUpsert(W.entity,L)).catch((b)=>{$.warn("IAM delta projection from catalog change failed; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:W.op,kind:L,error:b instanceof Error?b.message:String(b)})})},B=(W)=>{if(X)return;let L=Q?.resources;if(!L)return;if(G.isReady())(async()=>{if(W.deleted){await G.deleteResource(W.id);return}let w=await L.get(W.id);if(!w)return;await G.pushResource(w)})().catch((w)=>{$.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:W.id,deleted:W.deleted===!0,error:w})})},H,D,V,x,T=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),q=!1,I=()=>{let W=Q?.accessIndex;if(!W&&!q)q=!0,$.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return W},O=async(W)=>{let L=Q?.accessIndex,k=Q?.catalogStore;if(!L||!k&&!Y)return!1;let w=W.id??G2(W),b=await V2({...W,id:w},{catalog:k,code:Y,resources:Q?.resources,cache:J});return await L.materialize(w,b),!0},E=(W,L)=>U2(W,L,{accessStore:Q?.accessStore,accessIndex:Q?.accessIndex,catalogStore:Q?.catalogStore,code:Y,resources:Q?.resources},J),M=async()=>{let W=Q?.catalogStore;if(!W)return;await B2(Y,W)},R=async()=>{let W={subjects:0,roots:0,cleared:0};if(X)return W;await M();let L=Q?.accessIndex,k=Q?.catalogStore;if(!L||!k&&!Y)return W;let w=new Map,b=(o)=>{let Y$=d4(o.subject);if(!Y$)return;let G$=o.subjectType;w.set(`${G$}:${Y$}`,{subject:Y$,subjectType:G$})},u=new Set,c=Q?.accessStore;if(c)for await(let o of u4((Y$,G$)=>c.list({start:Y$,limit:G$}))){b({subject:d4(o.subject),subjectType:o.subjectType});let Y$=d4(o.target);if(J&&Y$&&typeof o.target==="string"){if(!await J.getNode(o.targetType,Y$))u.add(`${o.targetType}:${Y$}`)}}if(u.size>0)$.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog or catalog store). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...u].sort()});if(L.listSubjects)for(let o of await L.listSubjects())b(o);for(let o of w.values()){let Y$=await E(o.subject,o.subjectType);if(W.subjects+=1,W.roots+=Y$,Y$===0)W.cleared+=1}return W},f=()=>{if(X)return Promise.resolve({subjects:0,roots:0,cleared:0});return R()},g=Promise.resolve(),a=!1,X$=(W,L)=>{let k=g.then(async()=>{if(X)return;try{await L()}catch(w){$.warn(`${W} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:W,error:w instanceof Error?w.message:String(w)})}});return g=k,k},e=(W)=>{if(a)return;a=!0,X$(W,async()=>{a=!1,await R()})},n=()=>g,r=(W)=>{if(X)return;let L=Q?.accessStore;if(!Q?.accessIndex||!Q?.catalogStore||!L)return;if(J?.invalidate(W),W.op==="set"){let k=W.kind,w=W.entity.id;X$("catalog-change",async()=>{for await(let b of u4((u,c)=>L.listByTarget(k,w,{start:u,limit:c})))await O(b)})}else e("catalog-delete")},Q$=(W)=>{if(X)return;if(J?.clear(),!Q?.accessIndex||!Q?.catalogStore&&!Y||!Q?.accessStore)return;e("resource-change")},A={oaa:G,entitlements:{async list(W){let L=K2(Y,Q?.catalogStore),k=Math.max(0,W?.start??0),w=W?.limit;if(!L)return M6(0,[],k,w);let b=[];for(let c of[L.groups,L.roles,L.permissions])for await(let o of u4((Y$,G$)=>c.list({start:Y$,limit:G$,filter:W?.filter})))b.push(o);let u=w==null?void 0:k+w;return M6(b.length,b.slice(k,u),k,w)}},get accessIndex(){return Q?.accessIndex},has(W,L,k,w,b){let u=I();return u?u.has(W,L,k,w,b):Promise.resolve(T())},hasGroup(W,L,k,w){let b=I();return b?b.hasGroup(W,L,k,w):Promise.resolve(T())},hasRole(W,L,k,w){let b=I();return b?b.hasRole(W,L,k,w):Promise.resolve(T())},hasPermission(W,L,k,w){let b=I();return b?b.hasPermission(W,L,k,w):Promise.resolve(T())},hasAny(W,L,k){let w=I();return w?w.hasAny(W,L,k):Promise.resolve(T())},hasAll(W,L,k){let w=I();return w?w.hasAll(W,L,k):Promise.resolve(T())},reconcile(){return f()}};return{update(W){if(X)return A;let L=W?.catalog?H2(W.catalog):void 0,k=L!==Y;Y=L,Q=W,G.refreshReadiness();let w=W?.catalogStore,b=W?.resources;if(w!==H||b!==V||k)D?.(),x?.(),J=w||Y?new D2(w,b,Y):void 0,D=w?.afterChange?w.afterChange((u)=>{if(z(u))return;_(u),r(u)}):void 0,x=b?.changed?b.changed((u)=>{Q$(u),B(u)}):void 0,H=w,V=b;else if(J)J.clear();return A},settle:n,close(){if(X)return;X=!0,D?.(),D=void 0,x?.(),x=void 0,H=void 0,V=void 0,J=void 0}}}function O6($){return $.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+|_+$/g,"")||"EMPTY"}function F2($){let Z=`${$.clientId}\x00${$.path}`,Q=2166136261;for(let X=0;X<Z.length;X+=1)Q^=Z.charCodeAt(X),Q=Math.imul(Q,16777619);return(Q>>>0).toString(36)}function M2($){let Z=O6($.clientId),Q=O6($.path);return`LFV_${Z}__${Q}`}function l4($,Z){let Q=M2(Z);if(!(Q in $))return Q;let X=`${Q}_${F2(Z)}`;if(!(X in $))return X;return`${X}_ALT`}import{defaultLogger as D7}from"@ionite/core";import{defaultLogger as T2,stableConfigHash as I2}from"@ionite/core";import{verifyLfvSignature as P6}from"@ionite/core/server";import{DEFAULT_SECRET_MIME_TYPES as M0}from"@ionite/core";var W2=new Set(["jsonc","env","text","binary","yaml","toml","xml"]);function O2($){let Z=$.split(";",1)[0]?.trim().toLowerCase()??"";if(Z===M0.binary)return"binary";if(Z===M0.env)return"env";if(Z===M0.yaml||Z.endsWith("+yaml"))return"yaml";if(Z===M0.toml||Z.endsWith("+toml"))return"toml";if(Z===M0.xml||Z.endsWith("+xml"))return"xml";if(Z===M0.jsonc||Z.endsWith("+json"))return"jsonc";return"text"}function z4($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$,Q=typeof Z.mimeType==="string"?Z.mimeType:typeof Z.mime_type==="string"?Z.mime_type:void 0;if(!Q)return;let X=Z.format,Y=typeof X==="string"&&W2.has(X)?X:O2(Q),J=typeof Z.schemaUrl==="string"?Z.schemaUrl:typeof Z.schema_url==="string"?Z.schema_url:void 0,G=typeof Z.typeId==="string"?Z.typeId:typeof Z.type_id==="string"?Z.type_id:void 0;return{format:Y,mimeType:Q,...J?{schemaUrl:J}:{},...G?{typeId:G}:{}}}function J0($){if(!$)return;let Z=$.custom_metadata,Q=Z&&typeof Z==="object"&&!Array.isArray(Z)?Z:void 0;return z4($.content_type??$.contentType??Q?.content_type)}function _4($){return{format:$.format,mime_type:$.mimeType,...$.schemaUrl?{schema_url:$.schemaUrl}:{},...$.typeId?{type_id:$.typeId}:{}}}var W0=new Map;function L2($){if(!$)return"/";return $.startsWith("/")?$:`/${$}`}function N2($){try{let Z=new URL($),Q=Z.pathname.replace(/\/+$/g,"");return`${Z.origin}${Q}`}catch{return $.replace(/\/+$/g,"")}}function B4($){let Z=N2($.lfvServerUrl),Q=L2($.path);return`${Z}|${Q}`}function L6($,Z,Q){let X=W0.get($)??new Map;return X.set(Z,Q),W0.set($,X),()=>{let Y=W0.get($);if(!Y)return;if(Y.delete(Z),Y.size===0)W0.delete($)}}async function N6($,Z,Q,X){let Y=W0.get($);if(!Y)return 0;let J=0;for(let[G,z]of Y){if(Q&&G===Q)continue;if(z.trustId!==X)continue;if(!z.onDelivery)continue;if(await z.onDelivery(Z)){J+=1;break}}return J}async function A6($,Z,Q,X){let Y=W0.get($);if(!Y)return 0;let J=0;for(let[G,z]of Y){if(Q&&G===Q)continue;if(z.trustId!==X)continue;if(!z.onEvents)continue;J+=1,await z.onEvents(Z)}return J}import{defaultSecretContentType as A2,parseJsonc as j2,SecretContentTypeMismatchError as E2}from"@ionite/core";function j6($){let Z={},Q=$.replace(/\r\n?/g,`
1
+ import{configTrustedClientGrants as wQ,deepEqualPlain as SQ,defaultLogger as d6,ION_ENDPOINT_PERMISSIONS as G2,listGenerator as w0,stableConfigHash as e8,toCodeCatalog as z2,unionCatalogRead as CQ}from"@ionite/core";import{ciam as kQ,configureJwksCache as bQ,iam as vQ,resolveCacheConfig as yQ,sso as hQ}from"@ionite/core/server";import{trimTrailingSlash as X1}from"@ionite/core";import{list as T2}from"@ionite/core";class t0{customers=new Map;userNameIndex=new Map;async get($){return this.customers.get($)}async lookup($){if($.id){let Z=this.customers.get($.id);if(Z)return Z}if($.userName){let Z=this.userNameIndex.get($.userName.toLowerCase());if(Z)return this.customers.get(Z)}return}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q={...$,id:Z},X=this.customers.get(Z);if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase())}if(this.customers.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);return Q}async delete($){let Z=this.customers.get($);if(Z?.userName)this.userNameIndex.delete(Z.userName.toLowerCase());return this.customers.delete($),Z?1:0}async list($){let Z=Array.from(this.customers.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,G=Z.slice(Q,J);return T2(Y,G,Q,X)}}class r0{magicLinks=new Map;async create($,Z,Q){if(this.magicLinks.has($))throw Error(`Magic link with token ${$} already exists`);let X={token:$,customer:Z,createdAt:new Date,expiresAt:Q};this.magicLinks.set($,X)}async get($){let Z=this.magicLinks.get($);if(!Z)return null;if(Date.now()>Z.expiresAt.getTime())return this.magicLinks.delete($),null;return Z}async getAndDelete($){let Z=this.magicLinks.get($);if(this.magicLinks.delete($),!Z)return null;if(Date.now()>Z.expiresAt.getTime())return null;return Z}async delete($){this.magicLinks.delete($)}}function I2($){let Z=$.expiresAt;if(!Z)return;let Q=Z instanceof Date?Z.getTime():new Date(Z).getTime();return Number.isNaN(Q)?void 0:Q}class o0{sessions=new Map;async create($){if(this.sessions.has($.sid))throw Error(`Session with sid ${$.sid} already exists`);this.sessions.set($.sid,$)}async get($){let Z=this.sessions.get($);if(!Z)return null;let Q=I2(Z);if(Q!==void 0&&Date.now()>Q)return this.sessions.delete($),null;return Z}async update($,Z){let Q=this.sessions.get($);if(!Q)throw Error(`Session with sid ${$} not found`);let X={...Q,...Z};this.sessions.set($,X)}async delete($){this.sessions.delete($)}}import{list as x2,StoreConflictError as w2}from"@ionite/core";class e0{users=new Map;userNameIndex=new Map;externalIdIndex=new Map;async get($){return this.users.get($)}async getByExternalId($){let Z=this.externalIdIndex.get($);return Z?this.users.get(Z):void 0}async lookup($){return this.users.get($.id??"")}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q={...$,id:Z},X=this.users.get(Z),Y=Q.externalId?this.externalIdIndex.get(Q.externalId):void 0;if(Y&&Y!==Z)throw new w2(`externalId "${Q.externalId}" is already in use`,"unique_violation","externalId");if(X){if(X.userName&&X.userName.toLowerCase()!==Q.userName?.toLowerCase())this.userNameIndex.delete(X.userName.toLowerCase());if(X.externalId&&X.externalId!==Q.externalId)this.externalIdIndex.delete(X.externalId)}if(this.users.set(Z,Q),Q.userName)this.userNameIndex.set(Q.userName.toLowerCase(),Z);if(Q.externalId)this.externalIdIndex.set(Q.externalId,Z);return Q}async delete($){let Z=this.users.get($);if(Z){if(Z.userName)this.userNameIndex.delete(Z.userName.toLowerCase());if(Z.externalId)this.externalIdIndex.delete(Z.externalId)}return this.users.delete($),Z?1:0}async list($){let Z=Array.from(this.users.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,G=Z.slice(Q,J);return x2(Y,G,Q,X)}}class Q0{tokens=new Map;async set($){this.tokens.set($.workload_id,$)}async get($){let Z=this.tokens.get($);if(!Z)return null;if(Date.now()>Z.expires_at.getTime())return this.tokens.delete($),null;return Z}async delete($){this.tokens.delete($)}async isValid($){return await this.get($)!==null}async cleanup(){let $=Date.now();for(let[Z,Q]of this.tokens.entries())if($>Q.expires_at.getTime())this.tokens.delete(Z)}}function g$($){let Z=X1($||y4);return{readyzUrl:`${Z}/readyz`,capabilitiezUrl:`${Z}/capabilitiez`,sso:{loginUrl:`${Z}/auth/login`,userUrl:`${Z}/auth/user`,logoutUrl:`${Z}/auth/logout`,logoutBackChannelUrl:`${Z}/auth/logout/backchannel`,refreshUrl:`${Z}/auth/refresh`,callbackUrl:`${Z}/auth/callback`},workload:{validateUrl:`${Z}/workload/validate`,jwksUrl:`${Z}/workload/jwks`},iam:{basePath:`${Z}/iam`,usersUrl:`${Z}/iam/Users`,groupsUrl:`${Z}/iam/Groups`},ciam:{magicLinkUrl:`${Z}/magic-link`,magicLinkLoginUrl:`${Z}/magic-link/login`,customerUrl:`${Z}/auth/customer`,customerLoginUrl:`${Z}/auth/customer/login`,customerCallbackUrl:`${Z}/auth/customer/callback`,customerProvidersUrl:`${Z}/auth/customer/providers`,logoutUrl:`${Z}/auth/customer/logout`}}}function Y1($){return`${X1($||y4)}/authz/oaa/sync`}function S2($,Z){if($===null)return null;let Q={validateUrl:Z.validateUrl,jwksUrl:Z.jwksUrl};if($&&typeof $==="object"&&(("incoming"in $)||("outgoing"in $))){let X=$;return{...X,incoming:{...X.incoming,...Q}}}return{...$??{},...Q}}function J1($,Z,Q,X){let Y={...Z},J=g$(X);if(Y.sso!==null)if($.sso)Y.sso={...Y.sso,loginUrl:J.sso.loginUrl,userUrl:J.sso.userUrl,logoutUrl:J.sso.logoutUrl,logoutBackChannelUrl:J.sso.logoutBackChannelUrl,refreshUrl:J.sso.refreshUrl,redirectUri:J.sso.callbackUrl,sessionStore:Q.sessionStore??Y.sso?.sessionStore,userStore:Q.userStore??Y.sso?.userStore,enableJitUserProvisioning:Y.sso?.enableJitUserProvisioning??!0};else Y.sso=void 0;if(Y.iam!==null)if($.iam)Y.iam={...Y.iam,usersUrl:J.iam.usersUrl,groupsUrl:J.iam.groupsUrl,userStore:Q.userStore??Y.iam?.userStore};else Y.iam=void 0;if(Y.workload!==null){if($.workload||Y.workload)Y.workload=S2(Y.workload,J.workload)}if(Y.ciam!==null)if($.ciam)Y.ciam={...Y.ciam,magicLinkUrl:J.ciam.magicLinkUrl,magicLinkLoginUrl:J.ciam.magicLinkLoginUrl,customerUrl:J.ciam.customerUrl,customerLoginUrl:J.ciam.customerLoginUrl,customerCallbackUrl:J.ciam.customerCallbackUrl,customerProvidersUrl:J.ciam.customerProvidersUrl,logoutUrl:J.ciam.logoutUrl,providers:$.ciam.providers,sessionStore:Q.sessionStore??Y.ciam?.sessionStore,customerStore:Q.customerStore??Y.ciam?.customerStore,magicLinkStore:Q.magicLinkStore??Y.ciam?.magicLinkStore,enableJitUserProvisioning:Y.ciam?.enableJitUserProvisioning??!0};else Y.ciam=void 0;return Y}function b0($,Z){let Q={...$};if(Q.sso)Q.sso={...Q.sso,sessionStore:Z.sessionStore??Q.sso.sessionStore,userStore:Z.userStore??Q.sso.userStore};if(Q.iam)Q.iam={...Q.iam,userStore:Z.userStore??Q.iam.userStore};if(Q.workload){let X=Q.workload;Q.workload={...Q.workload,tokenStore:Z.workloadTokenStore??X.tokenStore,workloadIdentityStore:Z.workloadIdentityStore??X.workloadIdentityStore}}if(Q.ciam)Q.ciam={...Q.ciam,sessionStore:Z.sessionStore??Q.ciam.sessionStore,customerStore:Z.customerStore??Q.ciam.customerStore,magicLinkStore:Z.magicLinkStore??Q.ciam.magicLinkStore};if(Q.authz!==null&&(Z.accessStore||Z.accessIndex||Z.catalog||Z.catalogStore||Z.resources))Q.authz={...Q.authz,accessStore:Z.accessStore,accessIndex:Z.accessIndex,catalog:Z.catalog,catalogStore:Z.catalogStore,resources:Z.resources};return Q}var y4="/api/ionite";function $4($){return{...$}}function C2(){return{sessionStore:new o0,userStore:new e0,customerStore:new t0,magicLinkStore:new r0,workloadTokenStore:new Q0}}function Q1($,Z){return`${$} is enabled by RemoteConfig but is not served: missing ${Z.join(", ")}. Provide durable stores in ionite({ stores }) (e.g. @ionite/redis or app-owned SQL stores), or opt into stores: devInMemoryStores() for prototypes only (state is lost on restart).`}function h4($){let Z={};if($.sso&&!$.sso.sessionStore)Z.sso=Q1("SSO",["stores.sessionStore"]);if($.ciam){let Q=[];if(!$.ciam.sessionStore)Q.push("stores.sessionStore");if(!$.ciam.customerStore)Q.push("stores.customerStore");if(!$.ciam.magicLinkStore)Q.push("stores.magicLinkStore");if(Q.length>0)Z.ciam=Q1("CIAM",Q)}return Z}function Z4(){return y4}import{accessRefId as u4,accessRootId as B9,configTrustedClientGrants as H9,deepEqualPlain as K9,deprecateRetiredCodeCatalogRows as D9,list as O1,listGenerator as l4,toCodeCatalog as V9,unionCatalogRead as U9}from"@ionite/core";import{CatalogAdjacencyCache as F9,expandRoot as M9,reconcileSubjectAccess as W9}from"@ionite/core/server";import{accessRefId as p$,accessRootId as k2,ION_AUTHZ_GROUP_SCHEMA as b2,mergeCodeCatalogEntity as v2}from"@ionite/core";import{collectReferencedDefinitions as y2}from"@ionite/core/server";function U$($,Z,Q=(X)=>Error(`${$} ready timed out after ${X}ms`)){let X=!1,Y,J,G=()=>{X=!1,J=new Promise((B)=>{Y=B})};G();let z=()=>{X=!0,Y?.(),Y=void 0},_=()=>{if(Z()){if(!X)z();return}if(X)G()};return _(),{isReady:()=>Z(),ready:(B)=>{if(Z())return Promise.resolve();let H=J;if(!B||B<=0)return H;return new Promise((D,V)=>{let x=setTimeout(()=>V(Q(B)),B);H.then(()=>{clearTimeout(x),D()},(T)=>{clearTimeout(x),V(T)})})},refresh:_,settle:z}}var _1="App",h2="ionite",B1=104857600,f2=B1,m2=10485760,f4=3,g2=250,p2={};function e$($,Z){return Z.mapGroup?Z.mapGroup($):$}class y$ extends Error{retryable;code;status;warnings;constructor($,Z={}){super($,{cause:Z.cause});this.name="OaaError",this.retryable=Z.retryable??!1,this.code=Z.code,this.status=Z.status,this.warnings=Z.warnings,Object.setPrototypeOf(this,y$.prototype)}}function d2($){let Z=$();return Boolean(Z?.url&&Z.providerId&&Z.datasourceId)}function H1($,Z,Q,X,Y){let J=async(z)=>{await z1($,N$(Z),z,{mode:"incremental"})},G=U$("OAA",()=>d2(Z),(z)=>new y$(`OAA ready timed out after ${z}ms`,{code:"not_ready"}));return{isReady:G.isReady,ready:G.ready,refreshReadiness:G.refresh,async pushUser(z){let _=N$(Z);await J(q$(_,{local_users:[D1(z,"modify")]},!0))},async pushGroup(z){let _=N$(Z),B=Q(),H=e$(z,B),D=Y4(H,o$(_),"add"),V=await m4(H,"group",Y?.(),B,_);await J(q$(_,v0({local_groups:[X0(H,"modify")],identity_to_permissions:D?[D]:[]},V),!0))},async pushRole(z){let _=N$(Z),B=Q(),H=B.mapRole?B.mapRole(z):z,D=await m4(H,"role",Y?.(),B,_);await J(q$(_,v0({local_roles:[Y0(H,"modify")]},D),!0))},async pushPermission(z){let _=N$(Z);await J(q$(_,{permissions:[F0(z,Q().mapPermissionTypes,"modify")]},!0))},async pushResource(z){let _=N$(Z),B=Q(),H=B.mapResource?B.mapResource(z):z,D=await a2(H,Y?.(),B);await J(q$(_,{resources:D},!0))},async grant(z){let _=N$(Z),B=Q(),H=await K1(z,Y?.(),B,_);await J(G1(_,z,"add",B,H))},async revoke(z){let _=N$(Z);await J(G1(_,z,"delete",Q()))},async pushAccessChanges(z){if(z.length===0)return;let _=N$(Z),B=Q(),H=Y?.(),D=await l2(_,z,B,H);await J(D)},async deleteUser(z){let _=N$(Z);await J(q$(_,{local_users:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteGroup(z){let _=N$(Z);await J(q$(_,{local_groups:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deleteRole(z){let _=N$(Z);await J(q$(_,{local_roles:[{name:z,unique_id:z,operation:"delete"}]},!0))},async deletePermission(z){let _=N$(Z);await J(q$(_,{permissions:[{name:z,unique_id:z,permission_type:[],operation:"delete"}]},!0))},async deleteResource(z){let _=N$(Z);await J(q$(_,{resources:[{name:z,id:z,resource_type:"",operation:"delete"}]},!0))},async sync(z,_){let B=N$(Z),H=_?.mode==="incremental",D=H?void 0:X?.(),V=await u2(B,z,Q(),H,D);return z1($,B,V,_)}}}function N$($){let Z=$();if(!Z?.url||!Z.providerId||!Z.datasourceId)throw new y$("OAA is not configured",{code:"not_configured"});return Z}async function u2($,Z,Q,X,Y){let J=[],G=[],z=[],_=[],B=[],H=[],D=X?"modify":void 0,V=new Set,x=(P)=>k2(P);for await(let P of U0(Z.users))J.push(D1(P,D));for await(let P of U0(Z.groups)){let I=e$(P,Q);G.push(X0(I,D));let O=Y4(I,o$($),X?"add":void 0);if(O)H.push(O)}for await(let P of U0(Z.roles)){let I=Q.mapRole?Q.mapRole(P):P;B.push(Y0(I,D))}for await(let P of U0(Z.permissions))_.push(F0(P,Q.mapPermissionTypes,D));let T=[];for await(let P of U0(Z.resources)){let I=Q.mapResource?Q.mapResource(P):P;T.push(I)}z.push(...V1(T,D));for await(let P of U0(Z.access))if(V.add(x(P)),X4(P,H,J,o$($),X?"add":void 0),typeof P.target!=="string")if(P.targetType==="role"){let I=Q.mapRole?Q.mapRole(P.target):P.target;B.push(Y0(I,D))}else if(P.targetType==="permission")_.push(F0(P.target,Q.mapPermissionTypes,D));else{let I=e$(P.target,Q);G.push(X0(I,D))}for(let P of Y??[]){let I=x(P);if(V.has(I))continue;V.add(I);let O=p$(P.subject);if(O&&!J.some((q)=>p$(q.unique_id??q.name)===O))J.push({name:O,unique_id:O,is_active:!0,operation:D,custom_properties:{identity_type:"workload",source:"eci-trusted"}});X4(P,H,J,o$($),D)}return q$($,{local_users:J,local_groups:G,local_roles:B,resources:z,permissions:_,identity_to_permissions:H},X)}function q$($,Z,Q){let X={name:$.applicationName??_1,application_type:$.applicationType??h2,local_users:Z.local_users??[],local_groups:Z.local_groups??[],local_roles:Z.local_roles??[],resources:Z.resources??[],custom_properties:{},tags:[]};if(Q)X.operation="modify";return A$({applications:[X],permissions:Z.permissions??[],identity_to_permissions:Z.identity_to_permissions??[],is_incremental:Q?!0:void 0})}function G1($,Z,Q,X=p2,Y){let J=[],G=[],z=[],_=[],B=[];X4(Z,J,G,o$($),Q);let H=Q==="delete"?"delete":"modify";if(typeof Z.target!=="string")if(Z.targetType==="role"){let V=X.mapRole?X.mapRole(Z.target):Z.target;_.push(Y0(V,H))}else if(Z.targetType==="permission")B.push(F0(Z.target,X.mapPermissionTypes,H));else{let V=e$(Z.target,X);z.push(X0(V,H))}let D={local_users:G,local_groups:z,local_roles:_,permissions:B,identity_to_permissions:J};return q$($,Y?v0(D,Y):D,!0)}async function l2($,Z,Q,X){let Y=o$($),J=[],G=[],z=[],_=[],B=[],H=[],D=[],V=[];for(let{change:T,op:P}of Z){X4(T,P==="delete"?_:G,P==="delete"?z:J,Y,P==="delete"?"delete":"add");let M=P==="delete"?"delete":"modify";if(typeof T.target!=="string")if(T.targetType==="role"){let E=Q.mapRole?Q.mapRole(T.target):T.target;H.push(Y0(E,M))}else if(T.targetType==="permission")D.push(F0(T.target,Q.mapPermissionTypes,M));else{let E=e$(T.target,Q);B.push(X0(E,M))}if(P==="add")V.push(await K1(T,X,Q,$))}let x={local_users:[...J,...z],local_groups:B,local_roles:H,permissions:D,identity_to_permissions:[...G,..._]};return q$($,v0(x,...V),!0)}function v0(...$){let Z={},Q=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let X of $)for(let Y of Q){let J=X[Y];if(J&&J.length>0)Z[Y]=[...Z[Y]??[],...J]}return Z}async function m4($,Z,Q,X,Y){if(!Q)return{};let J=await y2($,Z,{catalog:Q.catalog,code:Q.code,resources:Q.resources,cache:Q.cache}),G=[];for(let z of J.groups){let _=e$(z,X),B=Y4(_,o$(Y),"add");if(B)G.push(B)}return{local_groups:J.groups.map((z)=>X0(e$(z,X),"modify")),local_roles:J.roles.map((z)=>Y0(X.mapRole?X.mapRole(z):z,"modify")),permissions:J.permissions.map((z)=>F0(z,X.mapPermissionTypes,"modify")),resources:J.resources.map((z)=>J4(X.mapResource?X.mapResource(z):z,"modify")),identity_to_permissions:G}}async function K1($,Z,Q,X){if(!Z)return{};if($.targetType!=="group"&&$.targetType!=="role")return{};let Y=p$($.target);if(!Y)return{};let J=typeof $.target==="string"?await c2($.targetType,Y,Z):$.target;if(!J)return{};let G={};if(typeof $.target==="string")if($.targetType==="group"){let _=e$(J,Q),B=Y4(_,o$(X),"add");G={local_groups:[X0(_,"modify")],identity_to_permissions:B?[B]:[]}}else{let _=Q.mapRole?Q.mapRole(J):J;G={local_roles:[Y0(_,"modify")]}}let z=await m4(J,$.targetType,Z,Q,X);return v0(G,z)}async function c2($,Z,Q){if(Q.cache)return await Q.cache.getNode($,Z);let X=$==="group"?Q.code?.groups.get(Z):Q.code?.roles.get(Z),J=await($==="group"?Q.catalog?.groups:Q.catalog?.roles)?.get(Z);return J&&X?v2($,X,J):J??X}function X4($,Z,Q,X,Y){let J=p$($.subject),G=p$($.target),z=Q.find((D)=>p$(D.unique_id??D.name)===J);if($.subjectType==="workload")if(z)z.custom_properties={...z.custom_properties,identity_type:"workload"};else z={name:J,unique_id:J,custom_properties:{identity_type:"workload"},operation:Y},Q.push(z);if($.targetType==="group"){if(z){let D=new Set(z.groups??[]);if(D.add(G),z.groups=[...D],Y)z.operation=Y}else Q.push({name:J,unique_id:J,groups:[G],operation:Y});return}let _={identity:J,identity_type:"local_user",operation:Y},B=$.resources??[],H=$.applyToApplication??B.length===0;if($.targetType==="role")_.role_assignments=[{application:X,role:G,apply_to_application:H,resources:B,operation:Y}];else _.application_permissions=[{application:X,permission:G,apply_to_application:H,resources:B,operation:Y}];Z.push(_)}function D1($,Z){return A$({name:$.displayName??$.name??$.userName??$.id,unique_id:$.id,identities:i2($),groups:$.groups?.map((Q)=>Q.value),is_active:$.active,created_at:J9($.createdAt),custom_properties:A$({ecid:$.ecid,accountClass:$.accountClass,externalId:$.externalId,userName:$.userName,tenantId:$.tenantId}),tags:[],operation:Z})}function i2($){let Z=$.email?[$.email]:$.emails?.map((X)=>X.value).filter(Boolean)??[],Q=[...$.ecid?[$.ecid]:[],...Z];return Q.length>0?Q:void 0}function X0($,Z){let Q=n2($),X=O$($,"id")??O$($,"name")??O$($,"displayName"),Y=O$($,"displayName")??O$($,"name")??X??"group",J=Q4($,"resources");return A$({name:Y,unique_id:X,custom_properties:A$({requestable:Q?.requestable??G9($,"requestable"),description:Q?.description??O$($,"description"),type:Q?.type,resources:J.length>0?J:void 0}),tags:[],operation:Z})}function n2($){let Z=$[b2];if(!Z||typeof Z!=="object"||Array.isArray(Z))return;return Z}function Q4($,Z){if(!$||typeof $!=="object")return[];let Q=$[Z];if(!Array.isArray(Q))return[];return Q.map(p$).filter((X)=>X.length>0)}function s2($){return O$($,"id")??O$($,"name")??O$($,"displayName")??"group"}function Y4($,Z,Q){let X=Q4($,"resources"),Y=X.length>0,J=!Y,G=Y?X:[],z=Q4($,"roles").map((B)=>({application:Z,role:B,apply_to_application:J,resources:G,operation:Q})),_=Q4($,"permissions").map((B)=>({application:Z,permission:B,apply_to_application:J,resources:G,operation:Q}));if(z.length===0&&_.length===0)return;return{identity:s2($),identity_type:"local_group",role_assignments:z.length>0?z:void 0,application_permissions:_.length>0?_:void 0,operation:Q}}function Y0($,Z){return A$({name:$.name,unique_id:$.id,permissions:$.permissions?.map((Q)=>typeof Q==="string"?Q:Q.id),custom_properties:A$({displayName:$.displayName,requestable:$.requestable,...$.metadata}),tags:[],operation:Z})}function F0($,Z,Q){return A$({name:$.name,unique_id:$.id,permission_type:Z?.($)??$.permissionTypes??[$.action??"Uncategorized"],apply_to_sub_resources:$.applyToSubResources,resource_types:$.resourceTypes,operation:Q})}function J4($,Z,Q,X=new Set){let Y=$.id;if(Y&&X.has(Y))return A$({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,custom_properties:A$({...$.metadata}),tags:[],operation:Z});if(Y)X.add(Y);let J=[];for(let G of $.resources??[]){let z=typeof G==="string"?Q?.get(G):G;if(z)J.push(J4(z,Z,Q,X))}if(Y)X.delete(Y);return A$({name:$.displayName??$.name,id:$.id,resource_type:$.type,description:$.description,sub_resources:J.length>0?J:void 0,custom_properties:A$({...$.metadata}),tags:[],operation:Z})}function V1($,Z){if($.length===0)return[];let Q=new Map;for(let _ of $)if(_.id)Q.set(_.id,_);let X=new Map,Y=new Set,J=(_,B)=>{if(!B.id||B.id===_)return;let H=X.get(_)??[];if(!H.some((D)=>D.id===B.id))H.push(B);X.set(_,H),Y.add(B.id)};for(let _ of $){for(let H of _.resources??[]){let D=typeof H==="string"?Q.get(H):H;if(D&&_.id)J(_.id,D)}let B=p$(_.parent);if(B&&Q.has(B)&&_.id)J(B,_)}let G=(_)=>{if(!_.id)return _;let B=X.get(_.id);if(!B||B.length===0)return _;return{..._,resources:B.map(G)}};return $.filter((_)=>!_.id||!Y.has(_.id)).map(G).map((_)=>J4(_,Z,Q))}async function a2($,Z,Q){if(!Z)return[J4($,"modify")];let X=async(H)=>{if(Z.cache)return await Z.cache.getNode("resource",H);return Z.resources?.get(H)},Y=async(H)=>{if(Z.resources?.children&&H.id&&(!H.resources||H.resources.length===0))return Z.resources.children(H.id);let D=[];for(let V of H.resources??[]){let x=typeof V==="string"?await X(V):V;if(x)D.push(x)}return D},J=$,G=new Set;while(!0){let H=p$(J.parent);if(!H||G.has(H))break;G.add(H);let D=await X(H);if(!D)break;J=D}let z=[],_=[J],B=new Set;while(_.length>0){let H=_.shift();if(!H)break;if(H.id&&B.has(H.id))continue;if(H.id)B.add(H.id);let D=Q.mapResource?Q.mapResource(H):H;z.push(D);for(let V of await Y(H))_.push(V)}if($.id&&!B.has($.id))z.push(Q.mapResource?Q.mapResource($):$);return V1(z,"modify")}async function z1($,Z,Q,X){let Y=JSON.stringify(A$(Q)),J=X?.compression??Z.compression??"gzip",G=J==="gzip"?await Q9(Y):Y,z=Y9(G),_=X?.maxPayloadBytes??Z.maxPayloadBytes??B1,B=X?.multipart??Z.multipart??"auto",H=X?.multipartThresholdBytes??Z.multipartThresholdBytes??f2;if(z>_&&B==="never")throw new y$("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(B==="always"||B==="auto"&&z>H)return r2($,Z,G,J,X);return t2(Z,{id:Z.datasourceId,data_source_id:Z.datasourceId,json_data:G,compression_type:J==="gzip"?"GZIP":"NONE"})}async function t2($,Z){let Q=`${W1($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:push`,X=await G4(Q,{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"},body:JSON.stringify(Z)});return F1(X)}async function r2($,Z,Q,X,Y){let J=Y?.partSizeBytes??Z.partSizeBytes??m2,G=await o2(Z,X),z=X9(Q,J);for(let B=0;B<z.length;B++)await e2(Z,G,B+1,z[B]??"");let _=await $9(Z,G,z.length);return $.debug("OAA multipart payload pushed",{uploadId:G,parts:z.length}),{..._,uploadId:_.uploadId??G,parts:_.parts??z.length}}async function o2($,Z){let Q=g4($,"multipart/start"),X=await G4(Q,{method:"POST",headers:p4($),body:JSON.stringify({data_source_id:$.datasourceId,compression_type:Z==="gzip"?"GZIP":"NONE"})}),Y=await d4(X),J=O$(Y,"upload_id")??O$(Y,"uploadId")??O$(Y,"id");if(!J)throw new y$("OAA multipart start response did not include an upload id",{code:"invalid_response"});return J}async function e2($,Z,Q,X){let Y=g4($,`multipart/${encodeURIComponent(Z)}/parts/${Q}`);await G4(Y,{method:"PUT",headers:p4($),body:JSON.stringify({upload_id:Z,sequence:Q,data:X})})}async function $9($,Z,Q){let X=g4($,`multipart/${encodeURIComponent(Z)}/complete`),Y=await G4(X,{method:"POST",headers:p4($),body:JSON.stringify({upload_id:Z,parts:Q})});return F1(Y)}function g4($,Z){return`${W1($.url)}/api/v1/providers/custom/${encodeURIComponent($.providerId)}/datasources/${encodeURIComponent($.datasourceId)}:${Z}`}function p4($){return{accept:"application/json",authorization:`Bearer ${$.apiKey??""}`,"content-type":"application/json"}}async function G4($,Z){let Q;for(let X=0;X<f4;X++){try{let Y=await fetch($,Z);if(!U1(Y.status)||X===f4-1){if(!Y.ok)await Z9(Y);return Y}Q=new y$(`OAA request failed with retryable status ${Y.status}`,{retryable:!0,status:Y.status})}catch(Y){if(Q=Y,Y instanceof y$&&!Y.retryable)throw Y;if(X===f4-1)break}await _9(g2*2**X)}throw new y$("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:Q})}function U1($){return $===429||$>=500}async function Z9($){let Z=await d4($).catch(()=>{return}),Q=O$(Z,"message")??O$(Z,"error")??`OAA request failed with status ${$.status}`;throw new y$(Q,{code:O$(Z,"code")??"http_error",status:$.status,retryable:U1($.status),warnings:M1(Z?.warnings)})}async function F1($){let Z=await d4($).catch(()=>{return});return{success:$.ok,syncToken:O$(Z,"sync_token")??O$(Z,"syncToken"),uploadId:O$(Z,"upload_id")??O$(Z,"uploadId"),parts:z9(Z,"parts"),warnings:M1(Z?.warnings),metadata:Z}}async function d4($){let Z=await $.text();if(!Z)return{};let Q=JSON.parse(Z);return Q&&typeof Q==="object"&&!Array.isArray(Q)?Q:{}}async function Q9($){let Z=new Blob([$]).stream().pipeThrough(new CompressionStream("gzip")),Q=await new Response(Z).arrayBuffer();return Buffer.from(Q).toString("base64")}function X9($,Z){let Q=[];for(let X=0;X<$.length;X+=Z)Q.push($.slice(X,X+Z));return Q}function Y9($){return Buffer.byteLength($,"utf8")}function J9($){if(!$)return;return $ instanceof Date?$.toISOString():$}function O$($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="string"&&Q.length>0?Q:void 0}function G9($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="boolean"?Q:void 0}function z9($,Z){if(!$||typeof $!=="object")return;let Q=$[Z];return typeof Q==="number"?Q:void 0}function M1($){if(!Array.isArray($))return;let Z=$.filter((Q)=>typeof Q==="string");return Z.length>0?Z:void 0}async function*U0($){if(!$)return;for await(let Z of $)yield Z}function A$($){if(Array.isArray($))return $.map(A$).filter((Q)=>Q!==void 0);if(!$||typeof $!=="object"||$ instanceof Date)return $===null?void 0:$;let Z=Object.entries($).map(([Q,X])=>[Q,A$(X)]).filter(([,Q])=>{if(Q===void 0)return!1;if(Array.isArray(Q)&&Q.length===0)return!1;if(Q&&typeof Q==="object"&&!Array.isArray(Q)&&Object.keys(Q).length===0)return!1;return!0});return Z.length>0?Object.fromEntries(Z):void 0}function W1($){return $.replace(/\/+$/,"")}function o$($){return $.applicationName??_1}function _9($){return new Promise((Z)=>setTimeout(Z,$))}function L1($,Z=()=>{return}){let Q,X=!1,Y,J,G=H1($,()=>Q?.oaa,()=>({mapPermissionTypes:Q?.mapPermissionTypes,mapGroup:Q?.mapGroup,mapRole:Q?.mapRole,mapResource:Q?.mapResource}),()=>H9(Q),()=>{let W=Q?.catalogStore;return W||Y?{catalog:W,code:Y,resources:Q?.resources,cache:J}:void 0}),z=(W)=>{if(W.op!=="set"||!W.previous)return!1;if(!(W.previous.providerId!==W.entity.providerId||W.previous.requestUrl!==W.entity.requestUrl))return!1;let{providerId:k,requestUrl:w,...b}=W.previous,{providerId:u,requestUrl:c,...o}=W.entity;return K9(b,o)},_=(W)=>{if(X)return;let{kind:L}=W;if(G.isReady())(W.op==="delete"?L==="role"?G.deleteRole(W.entity.id):L==="permission"?G.deletePermission(W.entity.id):G.deleteGroup(W.entity.id):L==="role"?G.pushRole(W.entity):L==="permission"?G.pushPermission(W.entity):G.pushGroup(W.entity)).catch((u)=>{$.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:W.op,kind:L,error:u})});let k=Z();if(!k?.isReady())return;if(W.op==="set"&&W.entity.requestable!==!0){if(W.previous?.requestable===!0)k.onEntitlementDelete(L,W.previous.id).catch((b)=>{$.warn("IAM delta removal of a no-longer-requestable entitlement failed",{"ion.operation":"iam.delta.delete","ion.outcome":"degraded",id:W.entity.id,kind:L,error:b instanceof Error?b.message:String(b)})});return}(W.op==="delete"?k.onEntitlementDelete(L,W.entity.id):k.onEntitlementUpsert(W.entity,L)).catch((b)=>{$.warn("IAM delta projection from catalog change failed; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:W.op,kind:L,error:b instanceof Error?b.message:String(b)})})},B=(W)=>{if(X)return;let L=Q?.resources;if(!L)return;if(G.isReady())(async()=>{if(W.deleted){await G.deleteResource(W.id);return}let w=await L.get(W.id);if(!w)return;await G.pushResource(w)})().catch((w)=>{$.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:W.id,deleted:W.deleted===!0,error:w})})},H,D,V,x,T=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),P=!1,I=()=>{let W=Q?.accessIndex;if(!W&&!P)P=!0,$.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return W},O=async(W)=>{let L=Q?.accessIndex,k=Q?.catalogStore;if(!L||!k&&!Y)return!1;let w=W.id??B9(W),b=await M9({...W,id:w},{catalog:k,code:Y,resources:Q?.resources,cache:J});return await L.materialize(w,b),!0},q=(W,L)=>W9(W,L,{accessStore:Q?.accessStore,accessIndex:Q?.accessIndex,catalogStore:Q?.catalogStore,code:Y,resources:Q?.resources},J),M=async()=>{let W=Q?.catalogStore;if(!W)return;await D9(Y,W)},E=async()=>{let W={subjects:0,roots:0,cleared:0};if(X)return W;await M();let L=Q?.accessIndex,k=Q?.catalogStore;if(!L||!k&&!Y)return W;let w=new Map,b=(o)=>{let Y$=u4(o.subject);if(!Y$)return;let G$=o.subjectType;w.set(`${G$}:${Y$}`,{subject:Y$,subjectType:G$})},u=new Set,c=Q?.accessStore;if(c)for await(let o of l4((Y$,G$)=>c.list({start:Y$,limit:G$}))){b({subject:u4(o.subject),subjectType:o.subjectType});let Y$=u4(o.target);if(J&&Y$&&typeof o.target==="string"){if(!await J.getNode(o.targetType,Y$))u.add(`${o.targetType}:${Y$}`)}}if(u.size>0)$.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog or catalog store). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...u].sort()});if(L.listSubjects)for(let o of await L.listSubjects())b(o);for(let o of w.values()){let Y$=await q(o.subject,o.subjectType);if(W.subjects+=1,W.roots+=Y$,Y$===0)W.cleared+=1}return W},f=()=>{if(X)return Promise.resolve({subjects:0,roots:0,cleared:0});return E()},g=Promise.resolve(),a=!1,X$=(W,L)=>{let k=g.then(async()=>{if(X)return;try{await L()}catch(w){$.warn(`${W} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:W,error:w instanceof Error?w.message:String(w)})}});return g=k,k},e=(W)=>{if(a)return;a=!0,X$(W,async()=>{a=!1,await E()})},n=()=>g,r=(W)=>{if(X)return;let L=Q?.accessStore;if(!Q?.accessIndex||!Q?.catalogStore||!L)return;if(J?.invalidate(W),W.op==="set"){let k=W.kind,w=W.entity.id;X$("catalog-change",async()=>{for await(let b of l4((u,c)=>L.listByTarget(k,w,{start:u,limit:c})))await O(b)})}else e("catalog-delete")},Q$=(W)=>{if(X)return;if(J?.clear(),!Q?.accessIndex||!Q?.catalogStore&&!Y||!Q?.accessStore)return;e("resource-change")},A={oaa:G,entitlements:{async list(W){let L=U9(Y,Q?.catalogStore),k=Math.max(0,W?.start??0),w=W?.limit;if(!L)return O1(0,[],k,w);let b=[];for(let c of[L.groups,L.roles,L.permissions])for await(let o of l4((Y$,G$)=>c.list({start:Y$,limit:G$,filter:W?.filter})))b.push(o);let u=w==null?void 0:k+w;return O1(b.length,b.slice(k,u),k,w)}},get accessIndex(){return Q?.accessIndex},has(W,L,k,w,b){let u=I();return u?u.has(W,L,k,w,b):Promise.resolve(T())},hasGroup(W,L,k,w){let b=I();return b?b.hasGroup(W,L,k,w):Promise.resolve(T())},hasRole(W,L,k,w){let b=I();return b?b.hasRole(W,L,k,w):Promise.resolve(T())},hasPermission(W,L,k,w){let b=I();return b?b.hasPermission(W,L,k,w):Promise.resolve(T())},hasAny(W,L,k){let w=I();return w?w.hasAny(W,L,k):Promise.resolve(T())},hasAll(W,L,k){let w=I();return w?w.hasAll(W,L,k):Promise.resolve(T())},reconcile(){return f()}};return{update(W){if(X)return A;let L=W?.catalog?V9(W.catalog):void 0,k=L!==Y;Y=L,Q=W,G.refreshReadiness();let w=W?.catalogStore,b=W?.resources;if(w!==H||b!==V||k)D?.(),x?.(),J=w||Y?new F9(w,b,Y):void 0,D=w?.afterChange?w.afterChange((u)=>{if(z(u))return;_(u),r(u)}):void 0,x=b?.changed?b.changed((u)=>{Q$(u),B(u)}):void 0,H=w,V=b;else if(J)J.clear();return A},settle:n,close(){if(X)return;X=!0,D?.(),D=void 0,x?.(),x=void 0,H=void 0,V=void 0,J=void 0}}}function N1($){return $.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+|_+$/g,"")||"EMPTY"}function O9($){let Z=`${$.clientId}\x00${$.path}`,Q=2166136261;for(let X=0;X<Z.length;X+=1)Q^=Z.charCodeAt(X),Q=Math.imul(Q,16777619);return(Q>>>0).toString(36)}function L9($){let Z=N1($.clientId),Q=N1($.path);return`LFV_${Z}__${Q}`}function c4($,Z){let Q=L9(Z);if(!(Q in $))return Q;let X=`${Q}_${O9(Z)}`;if(!(X in $))return X;return`${X}_ALT`}import{defaultLogger as F7}from"@ionite/core";import{defaultLogger as w9,stableConfigHash as S9}from"@ionite/core";import{verifyLfvSignature as T1}from"@ionite/core/server";import{DEFAULT_SECRET_MIME_TYPES as M0}from"@ionite/core";var N9=new Set(["jsonc","env","text","binary","yaml","toml","xml"]);function A9($){let Z=$.split(";",1)[0]?.trim().toLowerCase()??"";if(Z===M0.binary)return"binary";if(Z===M0.env)return"env";if(Z===M0.yaml||Z.endsWith("+yaml"))return"yaml";if(Z===M0.toml||Z.endsWith("+toml"))return"toml";if(Z===M0.xml||Z.endsWith("+xml"))return"xml";if(Z===M0.jsonc||Z.endsWith("+json"))return"jsonc";return"text"}function z4($){if(!$||typeof $!=="object"||Array.isArray($))return;let Z=$,Q=typeof Z.mimeType==="string"?Z.mimeType:typeof Z.mime_type==="string"?Z.mime_type:void 0;if(!Q)return;let X=Z.format,Y=typeof X==="string"&&N9.has(X)?X:A9(Q),J=typeof Z.schemaUrl==="string"?Z.schemaUrl:typeof Z.schema_url==="string"?Z.schema_url:void 0,G=typeof Z.typeId==="string"?Z.typeId:typeof Z.type_id==="string"?Z.type_id:void 0;return{format:Y,mimeType:Q,...J?{schemaUrl:J}:{},...G?{typeId:G}:{}}}function J0($){if(!$)return;let Z=$.custom_metadata,Q=Z&&typeof Z==="object"&&!Array.isArray(Z)?Z:void 0;return z4($.content_type??$.contentType??Q?.content_type)}function _4($){return{format:$.format,mime_type:$.mimeType,...$.schemaUrl?{schema_url:$.schemaUrl}:{},...$.typeId?{type_id:$.typeId}:{}}}var W0=new Map;function j9($){if(!$)return"/";return $.startsWith("/")?$:`/${$}`}function E9($){try{let Z=new URL($),Q=Z.pathname.replace(/\/+$/g,"");return`${Z.origin}${Q}`}catch{return $.replace(/\/+$/g,"")}}function B4($){let Z=E9($.lfvServerUrl),Q=j9($.path);return`${Z}|${Q}`}function A1($,Z,Q){let X=W0.get($)??new Map;return X.set(Z,Q),W0.set($,X),()=>{let Y=W0.get($);if(!Y)return;if(Y.delete(Z),Y.size===0)W0.delete($)}}async function j1($,Z,Q,X){let Y=W0.get($);if(!Y)return 0;let J=0;for(let[G,z]of Y){if(Q&&G===Q)continue;if(z.trustId!==X)continue;if(!z.onDelivery)continue;if(await z.onDelivery(Z)){J+=1;break}}return J}async function E1($,Z,Q,X){let Y=W0.get($);if(!Y)return 0;let J=0;for(let[G,z]of Y){if(Q&&G===Q)continue;if(z.trustId!==X)continue;if(!z.onEvents)continue;J+=1,await z.onEvents(Z)}return J}import{defaultSecretContentType as R9,parseJsonc as P9,SecretContentTypeMismatchError as q9}from"@ionite/core";function R1($){let Z={},Q=$.replace(/\r\n?/g,`
2
2
  `).split(`
3
3
  `);for(let X=0;X<Q.length;X+=1){let J=(Q[X]??"").trim();if(!J||J.startsWith("#"))continue;let G=J.startsWith("export ")?J.slice(7).trimStart():J,z=G.indexOf("=");if(z<=0)throw Error(`Invalid env entry at line ${X+1}: expected KEY=value`);let _=G.slice(0,z).trim();if(!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(_))throw Error(`Invalid env key "${_}" at line ${X+1}`);let B=G.slice(z+1).trim();if(B.length>=2&&(B.startsWith('"')&&B.endsWith('"')||B.startsWith("'")&&B.endsWith("'"))){let H=B[0],D=B.slice(1,-1);Z[_]=H==='"'?D.replace(/\\(n|r|t|"|\\)/g,(V,x)=>{if(x==="n")return`
4
- `;if(x==="r")return"\r";if(x==="t")return"\t";return x}):D}else Z[_]=B}return Z}function E6($){return Object.entries($).map(([Z,Q])=>{let X=String(Q??"");if(!X||/[\s#"'\\]/.test(X))return`${Z}=${JSON.stringify(X)}`;return`${Z}=${X}`}).join(`
5
- `)}function R6($){try{let Z=atob($);return Uint8Array.from(Z,(Q)=>Q.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function K4($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("Secret content is not an object");return $}function v0($){return $.metadata.contentType??A2()}function c4($,Z){if(Z==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof $.data==="string")return $.data;if(Z==="jsonc")return JSON.stringify($.data,null,2);if(Z==="env")return E6(K4($.data));let Q=K4($.data).content;if(typeof Q!=="string")throw Error(`Secret ${Z} content must contain a string "content" field`);return Q}function H4($,Z){if(Z==="jsonc")return typeof $.data==="string"?j2($.data):$.data;if(Z==="env")return typeof $.data==="string"?j6($.data):K4($.data);if(Z==="text")return c4($,Z);if(Z==="binary"){let Q=K4($.data).content_base64;if(typeof Q!=="string")throw Error('Binary secret content must contain a "content_base64" string');return R6(Q)}throw Error(`Typed ${Z} decoding is not supported yet; use text() or bytes()`)}function R2($){return{format:$.format,mimeType:$.mimeType,...$.schemaUrl?{schemaUrl:$.schemaUrl}:{},typeId:$.id}}function P2($,Z){let Q=v0($);if(Q.format!==Z.format||Q.mimeType!==Z.mimeType)throw new E2(R2(Z),Q)}async function q2($,Z){if(!$.schema)return Z;let Q=await $.schema["~standard"].validate(Z);if(Q.issues){let X=Q.issues.map((Y)=>Y.message).join("; ");throw Error(`Secret validation failed for type "${$.id}": ${X}`)}return Q.value}function h$($){return{async text(){let Z=await $();return c4(Z,v0(Z).format)},async json(){let Z=await $(),Q=v0(Z).format;if(Q!=="jsonc")throw Error(`json() requires a jsonc secret; received ${Q}`);return H4(Z,Q)},async bytes(){let Z=await $(),Q=v0(Z).format;if(Q==="binary")return H4(Z,Q);return new TextEncoder().encode(c4(Z,Q))},async env(){let Z=await $(),Q=v0(Z).format;if(Q!=="env")throw Error(`env() requires an env secret; received ${Q}`);return H4(Z,Q)},async metadata(){return(await $()).metadata},async parse(Z){let Q=await $();return P2(Q,Z),q2(Z,H4(Q,Z.format))}}}function q6($){try{return new URL($).pathname}catch{return $.startsWith("/")?$:`/${$}`}}var x2=1e4,w2=1e4,S2=300,T6=100;async function t4($){await new Promise((Z)=>setTimeout(Z,$))}function T$($){return{startedAt:Date.now(),timeout:typeof $?.timeout==="number"&&$.timeout>0?$.timeout:void 0}}function i4($){return typeof $==="number"&&Number.isInteger($)&&$>=1?{kms_slots:$}:{}}function f0($){if($.timeout===void 0)return;let Z=Date.now()-$.startedAt;return Math.max(0,$.timeout-Z)}function u$($,Z,Q){return Error(`LFV ${$} timed out after ${Q.timeout??0}ms for ${Z}`)}async function O0($,Z,Q,X,Y){let J=f0(Q);if(J!==void 0){if(J<=0)throw u$(X,Y,Q);let G=new AbortController,z=setTimeout(()=>G.abort(),J);try{return await fetch($,{...Z,signal:G.signal})}catch(_){if(_ instanceof Error&&_.name==="AbortError")throw u$(X,Y,Q);throw _}finally{clearTimeout(z)}}return await fetch($,Z)}class j$ extends Error{constructor($){super(`LFV source closed while operating on ${$}`);this.name="LfvSourceClosedError"}}class d$ extends Error{constructor($){super($);this.name="LfvProtocolError"}}class G0 extends d${status;constructor($,Z,Q){super(`LFV ${Z} failed (${$}) for ${Q}`);this.status=$;if(this.name="LfvActionStatusError",$===404)this.code="not_found"}code}var C2=new Set([400,401,403,404,409,410]);function I6($){return $ instanceof d$&&(!($ instanceof G0)||C2.has($.status))}function D4($){return $ instanceof j$||$ instanceof Error&&$.name==="LfvSourceClosedError"}function k2($,Z){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`LFV kms_park returned invalid payload for ${Z}`);let Q=$;if(typeof Q.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${Z}`);let X=Q.disposition;if(X!==void 0&&X!=="cooldown"&&X!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${Z}`);return{parked:Q.parked,...Q.stale===!0?{stale:!0}:{},...X?{disposition:X}:{}}}function h0($){try{let Z=JSON.parse($);return typeof Z==="object"&&Z!==null&&!Array.isArray(Z)?Z:void 0}catch{return}}async function n4($,Z,Q,X,Y,J,G,z,_,B){let H=0,D=Date.now();for(;;){if(B?.())throw new j$(X);let V=f0(Q);if(V!==void 0&&V<=0)throw u$(Y,X,Q);try{return await $()}catch(x){if(x instanceof j$)throw x;if(B?.())throw new j$(X);if(H+=1,G>0&&Date.now()-D>=G){let q=`Error connecting to the LFV source. Retries: '${H}'`;if(z)z(_,q,{url:Z,path:X,operation:Y});D=Date.now()}let T=V===void 0?J:Math.min(J,V);if(T<=0)throw u$(Y,X,Q);if(await t4(T),B?.())throw new j$(X)}}}function b2($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function s4($){if(typeof $==="number"&&Number.isFinite($))return $;if(typeof $==="string"&&$.trim()){let Z=Date.parse($.trim());if(!Number.isNaN(Z))return Z}return}function x6($){return`[LFV] [${$??"-"}] [${new Date().toISOString()}]: `}function a4($,Z){if(typeof $!=="string"||$.trim()==="")throw Error(`LFV source requires "${Z}"`);return $}function y2($){return{...$,lfvServerUrl:a4($.lfvServerUrl,"lfvServerUrl"),clientId:a4($.clientId,"clientId"),path:a4($.path,"path")}}function z0($,Z,Q={}){let X=y2($),Y=X.log??T2,J=(U,C,v)=>{let m=x6(U)+C;if(v!==void 0)Y.debug(m,v);else Y.debug(m)},G=(U,C,v)=>{let m=x6(U)+C;if(v!==void 0)Y.warn(m,v);else Y.warn(m)},z=X.lfvServerUrl,_=X.clientId,B=X.path,H=X.verifyJwks,D=typeof X.deliveryTimeout==="number"&&X.deliveryTimeout>0?X.deliveryTimeout:void 0,V=typeof X.retryInterval==="number"&&X.retryInterval>0?X.retryInterval:x2,x=typeof X.warnInterval==="number"&&X.warnInterval>=0?X.warnInterval:w2,T=(typeof X.callbackMaxAgeSeconds==="number"&&X.callbackMaxAgeSeconds>0?X.callbackMaxAgeSeconds:S2)*1000,q=typeof X.cacheMaxAgeSeconds==="number"&&X.cacheMaxAgeSeconds>0?X.cacheMaxAgeSeconds*1000:void 0,I=H?.trim()?I2(H.trim()):void 0,O=q6(X.deliveryEndpoint),E=q6(X.eventsEndpoint),M=B4({lfvServerUrl:z,path:B}),R=crypto.randomUUID(),f=new Map,g=new Set,a=new Map,X$=new Map,e=new Map,n=new Map,r=new Map,Q$=new Map,A=new Map,W=(U,C)=>{if(typeof C==="number"&&Number.isInteger(C)&&C>=1){let v=A.get(U)??1,m=Math.max(v,C);return A.set(U,m),m}return A.get(U)},L=(U,C)=>typeof C==="number"&&Number.isInteger(C)&&C>=1&&C>(A.get(U)??1),k=new Map,w=new Map,b=!1,u,c=new Set,o=()=>b;function Y$(U,C){a.set(U,C),X$.set(U,Date.now())}function G$(U){a.delete(U),X$.delete(U)}function s(U){let C=a.get(U);if(!C)return;if(q!==void 0){let v=X$.get(U)??0;if(Date.now()-v>q){J(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:U});return}}return C}function z$(){return g.size>0||f.size>0||Q$.size>0}function H$(){if(b){if(u)u(),u=void 0;return}let U=z$();if(U&&!u)u=L6(M,R,{trustId:I,onDelivery:async(C)=>{return t1(C).handled||await o1(C)},onEvents:async(C)=>{e1(C)}});if(!U&&u)u(),u=void 0}async function K$(U,C,v,m){if(!Z)throw Error("LFV callback transport is not configured");for(;;){if(b)throw new j$(C);if(m())throw new j$(C);let l=await Z.take(U);if(l){if(l.key!==M)G(U,"parked OTP callback rejected: callback key mismatch");else if(!await b4(l.rawBody,l.headers)){let B$=h0(l.rawBody);if(B$?.type==="otp"&&B$.request_id===U&&typeof B$.otp==="string"&&B$.otp)return B$.otp}}let p=f0(v);if(p!==void 0&&p<=0)throw u$("issueOtp",C,v);await t4(p===void 0?T6:Math.min(T6,p))}}async function j(U,C){let v=C??crypto.randomUUID(),m={startedAt:Date.now(),timeout:D},l={request_id:v,path:U,action:"read_secret",...i4(W(U))},p=await n4(()=>O0(`${z.replace(/\/+$/g,"")}/clients/${_}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":v},body:JSON.stringify(l)},m,"issueOtp",U),z,m,U,"issueOtp",V,x,G,v,o);if(p.status!==200&&p.status!==202)throw new G0(p.status,"issueOtp",U)}async function h(U,C){let v=w.get(U);if(v)return v;let m=j(U,C);w.set(U,m);try{await m}finally{if(w.get(U)===m)w.delete(U)}}async function P(U,C,v,m){if(b)throw new j$(U);let l=v??crypto.randomUUID(),p=m??T$(),Z$=new Promise((P$,k0)=>{let $6={resolve:P$,reject:k0},y4=f0(p);if(y4!==void 0){if(y4<=0){k0(u$("issueOtp",U,p));return}$6.timer=setTimeout(()=>{Q$.delete(l),H$(),k0(u$("issueOtp",U,p))},y4)}Q$.set(l,$6),H$()});Z$.catch(()=>{});let B$=()=>{let P$=Q$.get(l);if(!P$)return;if(P$.timer)clearTimeout(P$.timer);Q$.delete(l),H$()},J$={request_id:l,path:U,action:C,...i4(W(U))};J(l,"OTP request",{path:U,action:C});let M$;try{M$=await n4(async()=>{return await O0(`${z.replace(/\/+$/g,"")}/clients/${_}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":l},body:JSON.stringify(J$)},p,"issueOtp",U)},z,p,U,"issueOtp",V,x,G,l,o)}catch(P$){throw B$(),P$}if(M$.status!==200&&M$.status!==202)throw B$(),new G0(M$.status,"issueOtp",U);let L$=!1,W$=Z?K$(l,U,p,()=>L$):void 0;if(W$)W$.catch(()=>{});try{let P$=await(W$?Promise.race([Z$,W$]):Z$);return J(l,"OTP received via signed callback",{path:U,action:C}),P$}finally{L$=!0,B$()}}async function F(U,C,v,m,l,p,Z$){if(b)throw new j$(C);let B$=Z$??T$(),J$=await n4(async()=>{return await O0(`${z.replace(/\/+$/g,"")}${U}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":l},body:JSON.stringify({request_id:l,otp:m,path:C,...i4(W(C)),...p??{}})},B$,v,C)},z,B$,C,v,V,x,G,l,o);if(J$.status!==200&&J$.status!==202)throw new G0(J$.status,v,C);return J(l,`${v} accepted`,{path:C,status:J$.status}),J$}async function K(U,C,v,m,l,p){if(b)throw new j$(C);let Z$=l??crypto.randomUUID(),B$=p??T$(),J$=await P(C,v,Z$,B$),M$=await F(U,C,v,J$,Z$,m,B$);return{requestId:Z$,response:M$}}async function N(U,C,v){if(b)throw new j$(U);let m=L(U,v?.kmsSlots);if(W(U,v?.kmsSlots),m)G$(U);let l=s(U);if(l)return l;let p=k.get(U);if(p){if(!m)return p;if(await p.catch(()=>{return}),p=k.get(U),p)return p}let Z$=S(U,C,v);k.set(U,Z$),Z$.catch((B$)=>{if(D4(B$))J(C,"read aborted: source closed",{path:U})});try{return await Z$}finally{k.delete(U)}}async function S(U,C,v){let m=v?.timeout??D,l={startedAt:Date.now(),timeout:typeof m==="number"&&m>0?m:void 0},p=C??crypto.randomUUID();J(p,"read_secret request",{path:U});let Z$=0,B$=Date.now();for(;;){if(b)throw new j$(U);try{let{response:J$}=await K("/secrets/request",U,"read_secret",void 0,p,l),M$=await y(p,J$),L$=i(U,M$);return d(U,L$,L$.metadata.version),J(p,"read_secret completed from action response",{path:U}),L$}catch(J$){if(J$ instanceof j$)throw J$;if(I6(J$))throw J$;let M$=f0(l);if(M$!==void 0&&M$<=0)throw u$("read_secret",U,l);if(Z$+=1,x>0&&Date.now()-B$>=x)G(p,`read_secret retrying. Retries: '${Z$}'`,{path:U}),B$=Date.now();let L$=M$===void 0?V:Math.min(V,M$);if(L$<=0)throw u$("read_secret",U,l);await t4(L$)}}}async function y(U,C){if(!H?.trim())throw new d$("LFV read_secret response verification is not configured");let v=C.headers.get("X-LFV-Request-Id")?.trim(),m=C.headers.get("X-LFV-Key-Id")?.trim(),l=C.headers.get("X-LFV-Signature")?.trim();if(!v||!m||!l)throw new d$("LFV read_secret response is missing signature headers");if(v!==U)throw new d$("LFV read_secret response request_id header does not match the request");let p=await C.text();if(!await P6({jwks:H,kid:m,signatureB64Url:l,requestId:U,rawBody:p}))throw new d$("LFV read_secret response signature verification failed");let B$=h0(p);if(!B$||B$.request_id!==U)throw new d$("LFV read_secret response request_id does not match the request");return B$}function i(U,C){if(a1(C)!==U||C.data?.data===void 0)throw new d$(`LFV read_secret returned an invalid secret response for ${U}`);let m=C.data.metadata??{},l=typeof m.version==="number"?m.version:0,p=m.created_time??m.created,Z$=J0(m);return{data:C.data.data,metadata:{path:U,version:l,created:typeof p==="string"?new Date(p):new Date,...Z$?{contentType:Z$}:{}}}}function d(U,C,v){if(v!==void 0){let p=n.get(U);if(p!==void 0&&v<p){J(void 0,"delivery ignored: stale version",{path:U,realVersion:v,lastAccepted:p});return}n.set(U,v)}Y$(U,C),c.delete(U);let m=C.metadata.version;if(e.get(U)===m)return;e.set(U,m);let l=f.get(U);if(!l)return;for(let p of l)p(C)}async function $$(U,C){return await N(U,void 0,C)}async function t(U,C,v){if(!b2(C))throw Error(`putSecret requires an object value for LFV source at path ${U}`);let m=T$(v),l={data:C,content_type:_4(v.contentType)};if(await Z0(U,v)){await K("/secrets/update",U,"update_secret",l,void 0,m),G$(U);return}await K("/secrets/create",U,"create_secret",l,void 0,m),G$(U)}async function F$(U,C){let v=T$(C);await K("/secrets/delete",U,"delete_secret",void 0,void 0,v),G$(U)}async function _$(U,C){let v=T$(C),m=crypto.randomUUID();J(m,"list_paths request",{path:U});let l=await P(U,"list_paths",m,v),p=await O0(`${z.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":m},body:JSON.stringify({request_id:m,otp:l,path:U})},v,"listPaths",U);if(p.status!==200)throw Error(`LFV listPaths failed (${p.status}) for ${U}`);let Z$=await p.json();if(!Array.isArray(Z$.items))throw Error(`LFV listPaths returned invalid payload for ${U}`);return J(m,"list_paths success",{path:U,status:200}),Z$.items.filter((B$)=>typeof B$==="string")}async function Z0(U,C){let v=T$(C),m=crypto.randomUUID();J(m,"exists request",{path:U});let l=await P(U,"read_metadata",m,v),p=await O0(`${z.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":m},body:JSON.stringify({request_id:m,otp:l,path:U})},v,"exists",U);if(p.status!==200)throw Error(`LFV exists failed (${p.status}) for ${U}`);let Z$=await p.json();if(typeof Z$.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${U}`);return J(m,"exists success",{path:U,status:200,exists:Z$.exists}),Z$.exists}async function m$(U,C,v){let m=T$(v);await K("/secrets/rotate/request",U,"request_rotate",{reason:C?.reason,severity:C?.severity,incident_ref:C?.incidentRef},void 0,m)}async function C0(U,C,v){let m=T$(v);await K("/secrets/revoke/request",U,"request_revoke",{reason:C?.reason,severity:C?.severity,incident_ref:C?.incidentRef},void 0,m)}async function D9(U,C,v){let m=T$(v),{response:l}=await K("/secrets/kms/park",U,"kms_park",{key_id:C.keyId,status:C.status,reason:C.reason},void 0,m);return k2(await l.json().catch(()=>null),U)}function V9(U,C){if(!U||typeof U!=="object"||Array.isArray(U))throw Error(`LFV kms_add_keys returned invalid payload for ${C}`);let v=U;if(!Array.isArray(v.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${C}`);return{keys:v.keys.map((l,p)=>{if(!l||typeof l!=="object"||Array.isArray(l))throw Error(`LFV kms_add_keys returned invalid keys[${p}] for ${C}`);let Z$=l.id;if(typeof Z$!=="string"||Z$.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${p}].id for ${C}`);return{id:Z$}})}}function U9(U,C){if(!U||typeof U!=="object"||Array.isArray(U))throw Error(`LFV kms_revoke_key returned invalid payload for ${C}`);let v=U;if(typeof v.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${C}`);return{revoked:v.revoked}}async function F9(U,C,v){let m=T$(v),{response:l}=await K("/secrets/kms/add-keys",U,"kms_add_keys",{keys:C.keys},void 0,m);return V9(await l.json().catch(()=>null),U)}async function M9(U,C,v){let m=T$(v),{response:l}=await K("/secrets/kms/revoke-key",U,"kms_revoke_key",{key_id:C.keyId,reason:C.reason},void 0,m);return U9(await l.json().catch(()=>null),U)}async function W9(U,C){let v=T$(C),m=crypto.randomUUID();J(m,"getMetadata request",{path:U});let l=await P(U,"read_metadata",m,v),p=await O0(`${z.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":m},body:JSON.stringify({request_id:m,otp:l,path:U})},v,"getMetadata",U);if(p.status!==200)throw Error(`LFV getMetadata failed (${p.status}) for ${U}`);let Z$=await p.json();if(!Z$.metadata||typeof Z$.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${U}`);return J(m,"getMetadata success",{path:U,status:200}),Z$.metadata}async function s1(U,C,v,m=!0){let l=f.get(U)??new Set,p,Z$=(J$)=>{if(J$.metadata.version===p)return;p=J$.metadata.version,C(J$)};if(l.add(Z$),f.set(U,l),!m)return H$(),()=>{let J$=f.get(U);if(!J$)return;if(J$.delete(Z$),J$.size===0)f.delete(U);H$()};let B$=L(U,v?.kmsSlots)?void 0:s(U);if(B$)Z$(B$),e.set(U,B$.metadata.version);else try{Z$(await $$(U,v))}catch(J$){if(l.delete(Z$),l.size===0)f.delete(U);throw J$}return H$(),()=>{let J$=f.get(U);if(!J$)return;if(J$.delete(Z$),J$.size===0)f.delete(U);H$()}}let O9=(U,C)=>s1(U,C,void 0,!1);function L9(U){return U.method==="POST"&&new URL(U.url).pathname===O}function N9(U){return U.method==="POST"&&new URL(U.url).pathname===E}function a1(U){let C=U.data?.metadata?.path;if(typeof C==="string"&&C)return C;if(typeof U.path==="string"&&U.path)return U.path;return}function A9(U){let{request_id:C,otp:v}=U;if(typeof C!=="string"||typeof v!=="string"||!v)return{handled:!1};let m=Q$.get(C);if(!m)return{handled:!1};if(m.timer)clearTimeout(m.timer);return Q$.delete(C),H$(),m.resolve(v),{handled:!0}}function t1(U){return U.type==="otp"?A9(U):{handled:!1}}function r$(U="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:U}),{status:401,headers:{"Content-Type":"application/json"}})}function r1(U){return{requestId:U.headers.get("X-LFV-Request-Id")??U.headers.get("x-lfv-request-id")??"",keyId:U.headers.get("X-LFV-Key-Id")??U.headers.get("x-lfv-key-id")??"",signature:U.headers.get("X-LFV-Signature")??U.headers.get("x-lfv-signature")??""}}async function b4(U,C){if(!H?.trim())return G(void 0,"LFV callback rejected: verifyJwks is not configured"),r$("LFV callback verification is not configured");let{requestId:v,keyId:m,signature:l}=C;if(!v.trim()||!m.trim()||!l.trim())return G(v||void 0,"LFV callback rejected: missing signature headers"),r$("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await P6({jwks:H,kid:m,signatureB64Url:l.trim(),requestId:v.trim(),rawBody:U}))return G(v,"LFV callback rejected: signature verification failed"),r$();let Z$=h0(U);if(!Z$)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let B$=Z$;if(B$.request_id!==v.trim())return G(v,"LFV callback rejected: request_id header/body mismatch"),r$("X-LFV-Request-Id does not match request_id in body");let J$=Date.now(),M$=s4(B$.issued_at);if(M$===void 0)return G(v,"LFV callback rejected: missing or invalid issued_at"),r$("Missing or invalid issued_at");if(J$-M$>T)return G(v,"LFV callback rejected: stale (outside freshness window)"),r$("Callback is stale (issued_at outside freshness window)");let L$=s4(B$.expires_at);if(L$!==void 0&&J$>L$)return G(v,"LFV callback rejected: expired"),r$("Callback has expired");let W$=l.trim();for(let[P$,k0]of r)if(k0<=J$)r.delete(P$);if(r.has(W$))return G(v,"LFV callback rejected: replayed signature"),r$("Callback signature already processed (replay)");return r.set(W$,M$+T),null}async function o1(U){if(!Q.selfRedeemReads||U.action!=="read_secret"||typeof U.request_id!=="string"||typeof U.path!=="string"||typeof U.otp!=="string")return!1;let C={startedAt:Date.now(),timeout:D},v=await F("/secrets/request",U.path,"read_secret",U.otp,U.request_id,void 0,C),m=await y(U.request_id,v),l=i(U.path,m);return d(U.path,l,l.metadata.version),!0}async function j9(U){let C=await U.text(),v=r1(U),m=await b4(C,v);if(m)return m;let l=h0(C);if(!l)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let p=l;if(p.type!=="otp"||typeof p.request_id!=="string"||typeof p.otp!=="string"||typeof p.path!=="string"||typeof p.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let Z$=a1(p);J(p.request_id,"delivery received",{path:Z$});let B$=t1(p),J$=Z$?B4({lfvServerUrl:z,path:Z$}):M,M$=await N6(J$,p,R,I),L$=B$.handled||M$>0;if(!L$)try{if(L$=await o1(p),!L$&&Z&&typeof p.request_id==="string"){let W$=s4(p.expires_at),P$=Math.max(1,(W$??Date.now()+T)-Date.now());await Z.put(p.request_id,{kind:"delivery",key:J$,rawBody:C,headers:v},P$),L$=!0}}catch(W$){if(I6(W$)){if(!(W$ instanceof G0)||W$.status!==409&&W$.status!==410)c.add(p.path);return G(v.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:J$,status:W$ instanceof G0?W$.status:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:{"Content-Type":"application/json"}})}return r.delete(v.signature.trim()),G(v.requestId,"LFV callback handoff failed; callback may be retried",{key:J$,error:W$ instanceof Error?W$.message:String(W$)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(!L$)return r.delete(v.signature.trim()),G(v.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:J$}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function e1(U){if(b)return;if(!U?.path||typeof U.path!=="string")return;J(U.request_id,"events payload",{path:U.path,event:U.event});for(let C of g)try{C({path:U.path,event:U.event,requestId:U.request_id,issuedAt:U.issued_at,expiresAt:U.expires_at,...typeof U.key_id==="string"&&U.key_id.length>0?{keyId:U.key_id}:{}})}catch(v){G(U.request_id,"secret event listener failed",{path:U.path,event:U.event,error:v instanceof Error?v.message:String(v)})}if(U.event==="created"||U.event==="updated"||U.event==="rotated")G$(U.path),(Q.selfRedeemReads?h(U.path,U.request_id):N(U.path,U.request_id).then(()=>{return})).catch((v)=>{if(D4(v)){J(U.request_id,"event refresh aborted: source closed",{path:U.path});return}c.add(U.path),G(U.request_id,"event-triggered refresh failed; source marked degraded",{path:U.path,event:U.event,error:v instanceof Error?v.message:String(v)})})}async function E9(U){let C=await U.text(),v=r1(U),m=await b4(C,v);if(m)return m;let l=h0(C);if(!l)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let p=l;if(!p?.path||typeof p.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});J(p.request_id,"events received",{path:p.path,event:p.event}),e1(p);let Z$=B4({lfvServerUrl:z,path:p.path});return await A6(Z$,p,R,I),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function R9(){if(b)return;if(b=!0,u)u(),u=void 0;let U=new j$(B);for(let C of Q$.values()){if(C.timer)clearTimeout(C.timer);try{C.reject(U)}catch{}}Q$.clear(),k.clear(),w.clear(),c.clear(),a.clear(),X$.clear(),e.clear(),n.clear(),r.clear(),f.clear(),g.clear()}return{type:"vault",isAvailable:()=>c.size===0,get:(U,C)=>h$(()=>$$(U,C)),getFullSecret:$$,getSecret:async(U,C)=>{return(await $$(U,C)).data},putSecret:t,deleteSecret:F$,listPaths:_$,exists:Z0,requestRotate:m$,requestRevoke:C0,parkKmsKey:D9,addKmsKeys:F9,revokeKmsKey:M9,getMetadata:W9,subscribe:s1,subscribePassive:O9,subscribeEvents:(U)=>{return g.add(U),H$(),()=>{g.delete(U),H$()}},close:R9,isDeliveryRequest:L9,isEventsRequest:N9,handleDelivery:j9,handleEvents:E9,deliveryPath:O,eventsPath:E,callbackKey:M,trustId:I}}function _0($,Z,Q){if(typeof $!=="string"||$.trim()==="")throw Error(`"${Z}" is required when using ${Q}`);return $}var L0="__esLfvBootstrap";import{catalogEntityStore as e4,listGenerator as $1,materializeCodeCatalogEntity as m2,unionCatalogRead as g2}from"@ionite/core";import{baseUserToScimUser as S6,entitlementToScimGroup as Z1}from"@ionite/core/server";import{ION_AUTHZ_GROUP_SCHEMA as r4}from"@ionite/core";var w6="application/scim+json",v2="urn:ietf:params:scim:api:messages:2.0:PatchOp",h2="urn:ietf:params:scim:schemas:core:2.0:User",f2="urn:ietf:params:scim:schemas:core:2.0:Group";async function m0($){try{let Z=(await $.clone().text()).trim();return Z?Z.slice(0,2000):void 0}catch{return}}function g0($){return $==="user"?"Users":"Groups"}function o4($){return $.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class V4{baseUrl;getToken;receipts;log;fetchImpl;inflight=new Map;memo=new Map;writes=new Map;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.getToken=$.getToken,this.receipts=$.receipts,this.log=$.log,this.fetchImpl=$.fetchImpl??((Z,Q)=>fetch(Z,Q))}async headers(){let $=await this.getToken();return new Headers({"Content-Type":w6,Accept:w6,Authorization:`Bearer ${$}`})}inflightKey($,Z,Q){return`${$}\x00${Z}\x00${Q?"create":"lookup"}`}receiptKey($,Z){return`${$}\x00${Z}`}serializeWrite($,Z,Q){let X=`${$}\x00${Z}`,J=(this.writes.get(X)??Promise.resolve()).catch(()=>{return}).then(Q);this.writes.set(X,J);let G=()=>{if(this.writes.get(X)===J)this.writes.delete(X)};return J.then(G,G),J}async resolveProviderId($,Z,Q){let X=this.receiptKey($,Z),Y=this.memo.get(X);if(Y)return{found:Y.providerId,requestUrl:Y.requestUrl};let J=await this.receipts.read($,Z);if(J)this.memo.set(X,J);if(J)return{found:J.providerId,requestUrl:J.requestUrl};let G=this.inflightKey($,Z,Q!==void 0),z=this.inflight.get(G);if(z)return z;let _=this.resolveUncached($,Z,Q).then(async(B)=>{if(typeof B==="object"){let H={providerId:B.found,...B.requestUrl?{requestUrl:B.requestUrl}:{}};await this.receipts.write($,Z,H),this.memo.set(X,H)}return B}).finally(()=>{this.inflight.delete(G)});return this.inflight.set(G,_),_}async resolveUncached($,Z,Q){let X=await this.filterByExternalId($,Z);if(X!=="absent")return X;if(!Q)return"absent";return this.create($,Z,Q)}async filterByExternalId($,Z){let Q=encodeURIComponent(`externalId eq "${o4(Z)}"`),X=`${this.baseUrl}/${g0($)}?filter=${Q}`,Y=await this.fetchImpl(X,{method:"GET",headers:await this.headers()});if(!Y.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:$,status:Y.status,detail:await m0(Y)}),"error";let G=((await Y.json()).Resources??[])[0];return G?.id?{found:G.id,...this.requestUrl($,G)}:"absent"}async create($,Z,Q){let X=`${this.baseUrl}/${g0($)}`,Y=this.writeBody($,Z,Q),J=await this.fetchImpl(X,{method:"POST",headers:await this.headers(),body:JSON.stringify(Y)});if(!J.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:$,status:J.status,detail:await m0(J)}),"error";let G=await J.json();return G.id?{found:G.id,...this.requestUrl($,G),created:!0}:"error"}requestUrl($,Z){if($!=="group")return{};let Q=Z[r4];if(!Q||typeof Q!=="object")return{};let X=Q.requestUrl;return typeof X==="string"&&X?{requestUrl:X}:{}}async captureResponseReference($,Z,Q,X,Y){try{let J=await $.clone().json(),G=this.requestUrl(Z,J).requestUrl;if(!G&&J.id===void 0)return;let z=G??Y,_={providerId:J.id??X,...z?{requestUrl:z}:{}};await this.receipts.write(Z,Q,_),this.memo.set(this.receiptKey(Z,Q),_)}catch{}}async invalidate($,Z){this.memo.delete(this.receiptKey($,Z)),await this.receipts.clear($,Z)}writeBody($,Z,Q){let{id:X,meta:Y,...J}=Q,G=J,z=G[r4];if(z&&typeof z==="object"&&!Array.isArray(z)){let{providerId:_,requestUrl:B,...H}=z;G[r4]=H}return{...J,schemas:(Q.schemas?.length??0)>0?Q.schemas:[$==="user"?h2:f2],externalId:Z}}async upsertResource($,Z,Q){return this.serializeWrite($,Z,()=>this.upsertResourceNow($,Z,Q))}async upsertResourceNow($,Z,Q){let X=async(J)=>{let G=await this.resolveProviderId($,Z,J?Q:void 0);if(G==="error")return"error";if(G==="absent")return"skipped";if(G.created)return"pushed";let z=await this.fetchImpl(`${this.baseUrl}/${g0($)}/${encodeURIComponent(G.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody($,Z,Q))});if(z.status===404||z.status===410)return"stale";if(z.ok)return await this.captureResponseReference(z,$,Z,G.found,G.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:$,status:z.status,detail:await m0(z)}),"error"},Y=await X(!0);if(Y==="stale")await this.invalidate($,Z),Y=await X(!0);return Y==="stale"?"error":Y}async deleteResource($,Z){return this.serializeWrite($,Z,()=>this.deleteResourceNow($,Z))}async deleteResourceNow($,Z){let Q=async()=>{let Y=await this.resolveProviderId($,Z);if(Y==="error")return{outcome:"error"};if(Y==="absent")return{outcome:"pushed"};let J=await this.fetchImpl(`${this.baseUrl}/${g0($)}/${encodeURIComponent(Y.found)}`,{method:"DELETE",headers:await this.headers()});if(J.status===404||J.status===410)return{outcome:"pushed",stale:!0};if(J.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:$,status:J.status,detail:await m0(J)}),{outcome:"error"}},X=await Q();if(X.stale)await this.invalidate($,Z),X=await Q();if(X.outcome==="pushed")await this.invalidate($,Z);return X.outcome}async patchGroupMembership($){return this.serializeWrite("group",$.groupExternalId,()=>this.patchGroupMembershipNow($))}async patchGroupMembershipNow($){let{groupExternalId:Z,userExternalId:Q,op:X}=$,Y=await this.resolveProviderId("user",Q,X==="add"?$.userCreate:void 0);if(Y==="error")return this.log.warn("IAM delta: user lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(Y==="absent")return this.log.warn("IAM delta: user not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let J=Y.found,G=async(B)=>{let H=await this.resolveProviderId("group",Z,X==="add"&&B?$.groupCreate:void 0);if(H==="error")return{kind:"error"};if(H==="absent")return{kind:"absent"};let D=`${this.baseUrl}/${g0("group")}/${encodeURIComponent(H.found)}`,V=X==="add"?[{op:"add",path:"members",value:[{value:J,type:$.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${o4(J)}"]`}];return{kind:"response",response:await this.fetchImpl(D,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[v2],Operations:V})}),providerId:H.found,requestUrl:H.requestUrl}},z=await G(!0);if(z.kind==="response"&&(z.response.status===404||z.response.status===410))await this.invalidate("group",Z),z=await G(!1);if(z.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(z.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let _=z.response;if(!_.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X,status:_.status,detail:await m0(_)}),"error";return await this.captureResponseReference(_,"group",Z,z.providerId,z.requestUrl),"pushed"}}function p0($){if(typeof $==="string")return $;if($&&typeof $==="object"&&"id"in $)return $.id;return}function U4($){return $&&typeof $==="object"?$:void 0}function Q1($){let Z={},Q={},X,Y,J,G,z,_,B,H=()=>{if(Z.mode!=="patch")return"delta mode is not 'patch'";if(!Z.url)return"destination URL is not configured";if(!Q.workload)return"workload identity is not configured";if(typeof Q.workload.isReady!=="function"||typeof Q.workload.ready!=="function")return"workload handle violates the readiness contract";if(!Q.workload.isReady())return"workload module is not ready";if(Z.audience){let A=Q.workload[Z.audience];if(!A)return`outgoing workload client "${Z.audience}" is not configured`;if(typeof A.isReady!=="function"||typeof A.ready!=="function")return`outgoing workload client "${Z.audience}" violates the readiness contract`;if(!A.isReady())return`outgoing workload client "${Z.audience}" is not ready`}if(!Q.userStore)return"user store is not configured for IAM destination receipts";if(!Q.catalogStore)return"catalog store is not configured for IAM destination receipts";return},D=()=>H()===void 0,V=U$("IAM delta",D),x=async()=>{let A=Q.workload;if(!A)throw Error("IAM delta: workload identity not configured");if(Z.audience&&typeof A.getToken==="function")return A.getToken(Z.audience);if(typeof A.getServerToken==="function")return A.getServerToken();return A.getToken()},T=()=>g2(Q.codeCatalog,Q.catalogStore),q=async(A,W)=>{let L=Q.catalogStore;if(!L)return;let k=Q.codeCatalog?.groups.get(A)??Q.codeCatalog?.roles.get(A)??Q.codeCatalog?.permissions.get(A);if(k){let b=Q.codeCatalog?.groups.get(k.id)?"group":Q.codeCatalog?.roles.get(k.id)?"role":"permission",u=e4(L,b),c=await u.get(k.id);if(!c&&W)await m2(b,k,u),c=await u.get(k.id);if(c)return{kind:b,entity:c}}let w=[["group",L.groups],["role",L.roles],["permission",L.permissions]];for(let[b,u]of w){let c=await u.get(A);if(c)return{kind:b,entity:c}}return},I=async(A)=>{let W=Q.userStore;if(!W)return;if(W.getByExternalId)return W.getByExternalId(A);for await(let L of $1((k,w)=>W.list({start:k,limit:w})))if(L.externalId===A)return L;return},O=(A)=>A?.providerId?{providerId:A.providerId,...A.requestUrl?{requestUrl:A.requestUrl}:{}}:void 0,E={async read(A,W){if(A==="user")return O(await I(W));return O((await q(W,!1))?.entity)},async write(A,W,L){if(A==="user"){let b=await I(W);if(!b||b.providerId===L.providerId&&b.requestUrl===L.requestUrl)return;await Q.userStore?.upsert({...b,providerId:L.providerId,requestUrl:L.requestUrl});return}let k=await q(W,!0);if(!k||k.entity.providerId===L.providerId&&k.entity.requestUrl===L.requestUrl)return;await e4(Q.catalogStore,k.kind).set({...k.entity,providerId:L.providerId,requestUrl:L.requestUrl}).ready()},async clear(A,W){if(A==="user"){let c=await I(W);if(!c||c.providerId===void 0&&c.requestUrl===void 0)return;let{providerId:o,requestUrl:Y$,...G$}=c;await Q.userStore?.upsert(G$);return}let L=await q(W,!1);if(!L||L.entity.providerId===void 0&&L.entity.requestUrl===void 0)return;let{providerId:k,requestUrl:w,...b}=L.entity;await e4(Q.catalogStore,L.kind).set(b).ready()}},M=()=>{if(!D()||!Z.url)return;let A=Z.url;if(X&&Y===A&&J===Q.catalogStore&&G===Q.userStore&&z===Q.codeCatalog&&_===Q.fetchImpl)return X;return X=new V4({baseUrl:Z.url,getToken:x,receipts:E,log:$,fetchImpl:Q.fetchImpl}),Y=A,J=Q.catalogStore,G=Q.userStore,z=Q.codeCatalog,_=Q.fetchImpl,X},R=async(A)=>{if(A.subjectType==="workload"){let w=p0(A.subject),b=U4(A.subject);if(!b&&w)b=await Q.workloadIdentityStore?.get(w);if(!b?.externalId)return;return{externalId:b.externalId,create:{schemas:["urn:ietf:params:scim:schemas:core:2.0:User"],externalId:b.externalId,userName:b.clientId??b.id,displayName:b.displayName??b.clientId??b.id,active:b.active??!0}}}let L=U4(A.subject);if(!L){let w=p0(A.subject);if(w&&Q.userStore)L=await Q.userStore.get(w)}let k=L?.externalId;if(!L||!k)return;return{externalId:k,create:await(Q.mapUserToScim?.(L)??S6(L))}},f=async(A)=>{let L=U4(A.target);if(!L){let k=p0(A.target),w=T();if(k&&w)L=A.targetType==="role"?await w.roles.get(k):A.targetType==="permission"?await w.permissions.get(k):await w.groups.get(k)}if(L&&L.requestable!==!0)return"not-requestable";if(!L)return;return{externalId:L.id,create:Z1(L,A.targetType)}},g=async(A,W)=>{if(!D())return"skipped";let L=await R(A),k=await f(A);if(k==="not-requestable")return"skipped";if(!L||!k)return $.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:W,hasSubject:Boolean(L),hasTarget:Boolean(k),targetType:A.targetType}),"skipped";let w=M();if(!w)return"skipped";return w.patchGroupMembership({groupExternalId:k.externalId,userExternalId:L.externalId,op:W,groupCreate:k.create,userCreate:L.create,memberType:A.subjectType==="workload"?"Workload":"User"})},a=async(A,W,L)=>{let k=[],w=new Set,b=(c)=>{let o=`${c.type??"User"}\x00${c.value}`;if(!w.has(o))w.add(o),k.push(c)},u=Q.accessStore;if(u)for await(let c of $1((o,Y$)=>u.listByTarget(W,A.id,{start:o,limit:Y$}))){let o=await R(c);if(!o){$.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:A.id,targetType:W});continue}let Y$=await L.resolveProviderId("user",o.externalId,o.create);if(Y$==="error")throw Error(`IAM delta failed to resolve access subject for ${W}:${A.id}`);if(Y$==="absent")continue;let G$=c.metadata;b({value:Y$.found,type:c.subjectType==="workload"?"Workload":"User",...G$?.display?{display:G$.display}:{}})}if(W==="group"){let c=T();for(let o of A.groups??[]){let Y$=p0(o),G$=U4(o);if(!G$&&Y$)G$=await c?.groups.get(Y$);if(G$&&G$.requestable!==!0)continue;if(!G$){$.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:Y$,target:A.id});continue}let s=await L.resolveProviderId("group",G$.id,Z1(G$,"group"));if(s==="error")throw Error(`IAM delta failed to resolve nested Group for group:${A.id}`);if(s!=="absent")b({value:s.found,type:"Group"})}}return k.length>0?k:void 0},X$=async(A)=>{if(!D())return"skipped";let W=A.externalId;if(!W)return $.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:A.id,kind:"user"}),"skipped";let L=M();if(!L)return"skipped";let k=await(Q.mapUserToScim?.(A)??S6(A));return L.upsertResource("user",W,k)},e=async(A,W,L=!0)=>{if(!D())return"skipped";if(A.requestable!==!0)return"skipped";let k=M();if(!k)return"skipped";let w=await a(A,W,k),b=await k.upsertResource("group",A.id,Z1(A,W,w)),u=Q.accessStore;if(b!=="pushed"||!L||!u)return b;for await(let c of $1((o,Y$)=>u.listByTarget(W,A.id,{start:o,limit:Y$})))if(await g(c,"add")==="error")throw Error(`IAM delta failed to restore access for ${W}:${A.id}`);return b},n=(A,W)=>{if(A==="error")throw Error(`IAM delta: destination rejected ${W}`)},r=(A,W,L)=>{if(W==="pushed")A.pushed+=1;else if(W==="skipped")A.skipped+=1;else A.errors.push(`IAM delta: destination rejected ${L}`)},Q$={async onUserUpsert(A){n(await X$(A),"user upsert")},async onUserDelete(A){if(!D())return;let W=M();if(!W)return;n(await W.deleteResource("user",A),"user delete")},async onEntitlementUpsert(A,W){n(await e(A,W),`${W} upsert`)},async onEntitlementDelete(A,W){if(!D())return;let L=M();if(!L)return;n(await L.deleteResource("group",W),`${A} delete`)},async onGrant(A){if(!D())return;if(await g(A,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(A){if(!D())return;if(await g(A,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async reconcile(A){let W={pushed:0,skipped:0,errors:[]},L=H();if(L)return W.errors.push(`iam delta not ready: ${L}`),W;let k=async(w,b,u)=>{if(!w)return;for await(let c of w)try{r(W,await b(c),u(c))}catch(o){W.errors.push(o instanceof Error?o.message:String(o))}};return await k(A.groups,(w)=>e(w,"group",!1),(w)=>{return`group upsert for ${w.id}`}),await k(A.roles,(w)=>e(w,"role",!1),(w)=>{return`role upsert for ${w.id}`}),await k(A.permissions,(w)=>e(w,"permission",!1),(w)=>{return`permission upsert for ${w.id}`}),await k(A.users,(w)=>X$(w),(w)=>{return`user upsert for ${w.id??"unknown"}`}),await k(A.access,(w)=>g(w,"add"),(w)=>{return`membership push for ${p0(w.target)??"unknown"}`}),W},async getDestinationRef(A,W){return E.read(A,W)},isReady:D,ready:V.ready};return{update(A,W){Z=A,Q=W,M(),V.refresh();let L=H();if(Z.mode!=="patch")B=void 0;else if(L!==B){if(L)$.warn(`IAM delta configured but not ready: ${L}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:L});B=L}return Q$},handle(){return Q$}}}var X1=1,p2=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."}];import{IoniteError as d2}from"@ionite/core";function u2($){if($ instanceof d2)return{status:$.status,statusText:$.statusText};if(typeof $!=="object"||$==null)return;let Z=$,Q=typeof Z.status==="number"?Z.status:void 0,X=typeof Z.statusText==="string"?Z.statusText:void 0;return Q!=null||X?{status:Q,statusText:X}:void 0}function N0($){if($ instanceof Response)return $;let Z=u2($);if(!Z)return Response.json({error:"internal_error"},{status:500});let X={status:Z.status??500};if(Z.statusText)X.statusText=Z.statusText;return Response.json({error:Z.statusText??"internal_error"},X)}function D$(){return Response.json({error:"not_found"},{status:404})}function A0($=["GET"]){return Response.json({error:"method_not_allowed",allow:$},{status:405,headers:{Allow:$.join(", ")}})}import{timingSafeEqual as l2}from"node:crypto";import{parseKmsPoolDocument as c2,stableConfigHash as k6}from"@ionite/core";function C6($,Z,Q){for(let X of $)try{X()}catch(Y){Z.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:Q,error:Y instanceof Error?Y.message:String(Y)})}}function b$($,Z){let Q=new Set,X=new Set;return{beforeChange(Y){return Q.add(Y),()=>{Q.delete(Y)}},afterChange(Y){return X.add(Y),()=>{X.delete(Y)}},emitBefore(){C6(Q,$,`${Z} beforeChange`)},emitAfter(){C6(X,$,`${Z} afterChange`)}}}var i2=604800000,n2=2147483647,s2=1;function h6($,Z){if(!$.value)return!1;if($.notBefore&&Date.parse($.notBefore)>Z)return!1;if($.notAfter&&Date.parse($.notAfter)<=Z)return!1;return!0}function x$($,Z,Q=Date.now()){if(!$)return;let X=$.slots?.[Z];if(!X)return;let Y=$.keys.find((J)=>J.id===X&&J.state==="active");return Y&&h6(Y,Q)?Y:void 0}function Y1($,Z=Date.now()){if(!$)return[];return $.keys.filter((Q)=>(Q.state==="active"||Q.state==="deprecated")&&h6(Q,Z))}function b6($){return{...$,...$.meta?{meta:{...$.meta}}:{}}}function F4($,Z,Q){if(!Z||Z<=0)return $;return new Promise((X,Y)=>{let J=setTimeout(()=>Y(Error(Q)),Z);$.then((G)=>{clearTimeout(J),X(G)},(G)=>{clearTimeout(J),Y(G)})})}function y6($,Z){let Q=Buffer.from($),X=Buffer.from(Z);return Q.length===X.length&&l2(Q,X)}function a2($){if(!Number.isInteger($)||$<1)throw Error("KMS unique() requires a positive integer slot count.");return $}var t2=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function r2($){return t2.has($)}function v6($){let Z=$.trim().replace(/\/+$/,"");if(!Z||Z==="/")return"/";return Z.startsWith("/")?Z:`/${Z}`}function o2($,Z){let Q=v6($),X=v6(Z);return Q===X||Q.endsWith(X)}function e2($,Z,Q){let X=b$(Z,`KMS pool "${$}"`),Y=new Set,J=!1,G,z,_=0,B,H,D=s2,V,x,T=new Map,q=new Set,I,O=()=>G!==void 0&&G.slots===void 0&&G.keys.length>0,E=U$(`KMS pool "${$}"`,()=>{if(!J)return!1;if(O())return Y1(G).length>0;return x$(G,0)!==void 0}),M=U$(`KMS pool "${$}" issuer`,()=>J&&V!==void 0),R=(P)=>P===0?`KMS pool "${$}"`:`KMS pool "${$}" slot ${P}`,f=(P)=>{let F=T.get(P),K=F?.valueWaiter;if(!F||!K)return;if(!J){F.valueWaiter=void 0,K.reject(Error(`${R(P)} is no longer configured.`));return}if(O()){F.valueWaiter=void 0,K.reject(Error(`${R(P)} verifier grant has no slots.`));return}let N=x$(G,P);if(N?.value)F.valueWaiter=void 0,K.resolve(N.value)},g=()=>{for(let P of T.keys())f(P)},a=(P)=>{let F=T.get(P);if(!F)return;let K=x$(G,P);for(let N of F.listeners)try{N(K?b6(K):void 0)}catch(S){Z.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:$,slot:P,error:S instanceof Error?S.message:String(S)})}},X$=()=>{for(let P of T.keys())a(P)},e=()=>{for(let P of T.values())P.latch.refresh();E.refresh(),M.refresh()},n=()=>{try{I?.()}catch(P){Z.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:$,error:P instanceof Error?P.message:String(P)})}I=void 0},r=()=>{if(I||q.size===0||!V?.subscribeEvents||!x)return;let P=x;I=V.subscribeEvents((F)=>{if(!r2(F.event)||!o2(F.path,P))return;let K={path:F.path,event:F.event,...F.requestId===void 0?{}:{requestId:F.requestId},...F.keyId===void 0?{}:{keyId:F.keyId}};for(let N of q)try{N(K)}catch(S){Z.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:$,error:S instanceof Error?S.message:String(S)})}})},Q$=()=>{if(H)clearTimeout(H);H=void 0},A=()=>{Q$();let P=Date.now();if(G){for(let K of G.keys){if(!K.notAfter)continue;let N=Date.parse(K.notAfter)-P;if(N>0&&N<=i2&&(K.state==="active"||K.state==="deprecated")&&!Y.has(K.id))Y.add(K.id),Z.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:$,keyId:K.id,notAfter:K.notAfter})}let F=G.keys.flatMap((K)=>[K.notBefore,K.notAfter]).filter((K)=>Boolean(K)).map((K)=>Date.parse(K)).filter((K)=>K>P).sort((K,N)=>K-N);if(F[0])H=setTimeout(()=>{let K=new Map([...T.keys()].map((N)=>[N,x$(G,N)?.id]));e(),Q();for(let N of T.keys())if(K.get(N)!==x$(G,N)?.id)a(N);A()},Math.min(F[0]-P+1,n2))}e(),Q(),g()},W=(P)=>{let F=new Map([...T.keys()].map((K)=>{let N=x$(G,K);return[K,{id:N?.id,value:N?.value}]}));X.emitBefore();try{G=c2(P),A();for(let K of T.keys()){let N=x$(G,K),S=F.get(K);if(S?.id!==N?.id||S?.value!==N?.value)a(K)}}catch(K){G=void 0,A(),X$(),Z.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:$,error:K instanceof Error?K.message:String(K)})}finally{X.emitAfter()}},L=()=>{try{B?.()}catch(P){Z.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:$,error:P instanceof Error?P.message:String(P)})}B=void 0},k=(P,F)=>{V=P,x=F,_+=1;let K=_;L(),P.subscribe(F,(N)=>{if(_!==K||!J)return;W(N.data)},{kmsSlots:D}).then((N)=>{if(_!==K||!J){N();return}B=N}).catch((N)=>{if(_!==K||!J)return;G=void 0,A(),X$(),Z.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:$,path:F,error:N instanceof Error?N.message:String(N)})})},w=(P,F)=>{let K=u(P),N=x$(G,P);if(!J)return Promise.reject(Error(`${R(P)} is no longer configured.`));if(O())return Promise.reject(Error(`${R(P)} verifier grant has no slots.`));if(N?.value)return Promise.resolve(N.value);if(!K.valueWaiter){let y,i,d=new Promise(($$,t)=>{y=$$,i=t});K.valueWaiter={promise:d,resolve:y,reject:i}}let S=K.valueWaiter.promise;return f(P),F4(S,F,`${R(P)} was not ready within ${F}ms.`)},b=(P,F)=>{let K=u(P);K.listeners.add(F);let N=x$(G,P);return F(N?b6(N):void 0),()=>K.listeners.delete(F)};function u(P){let F=T.get(P);if(F)return F;let K=U$(R(P),()=>J&&x$(G,P)!==void 0),N={listeners:new Set,latch:K,api:{value:(S)=>w(P,S),current:()=>x$(G,P)?.value,subscribe:(S)=>b(P,S),park:(S,y)=>Y$(S,y),isReady:K.isReady,ready:K.ready}};return T.set(P,N),N}let c=(P)=>{if(O())throw Error(`KMS pool "${$}" verifier grant has no slots.`);let F=a2(P),K=F>D;D=Math.max(D,F);let N=[];for(let S=0;S<F;S+=1)N.push(u(S).api);if(K&&J&&V&&x)k(V,x);return N},o=(P)=>Y1(G).find((F)=>F.value!==void 0&&y6(P,F.value)),Y$=(P,F)=>{if(!J||!V||!x)return Promise.reject(Error(`KMS pool "${$}" is not configured.`));if(typeof P.value!=="string"||P.value.length===0)return Promise.reject(Error(`KMS pool "${$}" park() requires a non-empty value.`));let K=o(P.value);if(!K)return Promise.resolve({parked:!1,stale:!0});return F4(V.parkKmsKey(x,{keyId:K.id,status:P.status,reason:P.reason},F&&F>0?{timeout:F}:void 0),F,`KMS pool "${$}" park() did not complete within ${F}ms.`)},G$=()=>{if(!J||!V||!x)throw Error(`KMS pool "${$}" is not configured.`);return{source:V,path:x}},s=(P)=>{if(!Array.isArray(P)||P.length===0)throw Error(`KMS pool "${$}" addKeys() requires a non-empty keys array.`);return P.map((F,K)=>{if(!F||typeof F!=="object")throw Error(`KMS pool "${$}" addKeys() keys[${K}] must be an object.`);if(typeof F.value!=="string"||F.value.length===0)throw Error(`KMS pool "${$}" addKeys() keys[${K}].value must be a non-empty string.`);if(F.id!==void 0&&(typeof F.id!=="string"||F.id.length===0))throw Error(`KMS pool "${$}" addKeys() keys[${K}].id must be a non-empty string when present.`);return F})},z$=(P,F)=>{try{let{source:K,path:N}=G$(),S=s(P);return F4(K.addKmsKeys(N,{keys:S},F&&F>0?{timeout:F}:void 0),F,`KMS pool "${$}" addKeys() did not complete within ${F}ms.`)}catch(K){return Promise.reject(K)}},H$=(P,F)=>{try{let{source:K,path:N}=G$();if(typeof P.keyId!=="string"||P.keyId.length===0)throw Error(`KMS pool "${$}" revokeKey() requires a non-empty keyId.`);return F4(K.revokeKmsKey(N,P,F&&F>0?{timeout:F}:void 0),F,`KMS pool "${$}" revokeKey() did not complete within ${F}ms.`)}catch(K){return Promise.reject(K)}},K$=(P)=>{let{source:F}=G$();if(!F.subscribeEvents)throw Error(`KMS pool "${$}" events are not supported by this secrets transport.`);return q.add(P),r(),()=>{q.delete(P)}};u(0);let j={value:(P)=>w(0,P),current:()=>x$(G,0)?.value,unique:c,accepts:(P)=>Y1(G).some((F)=>F.value!==void 0&&y6(P,F.value)),park:Y$,subscribe:(P)=>b(0,P),beforeChange:X.beforeChange,afterChange:X.afterChange,isReady:E.isReady,ready:E.ready},h={addKeys:z$,revokeKey:H$,events:K$,isReady:M.isReady,ready:M.ready};return{api:j,issuer:h,update(P,F,K){let N=k6({config:P,path:K});if(J=!0,z===N){e();return}z=N,L(),n(),Q$(),G=void 0,e(),Q(),X$(),g(),k(F,K),r()},unavailable(P){J=!0,z=k6(P),_+=1,V=void 0,x=void 0,n(),L(),Q$(),G=void 0,e(),Q(),X$(),g()},remove(){if(!J)return;X.emitBefore(),J=!1,z=void 0,_+=1,V=void 0,x=void 0,n(),L(),Q$(),G=void 0,e(),Q(),X$(),g(),X.emitAfter()},close(){J=!1,_+=1,V=void 0,x=void 0,n(),q.clear(),L(),Q$();for(let P of T.values())P.listeners.clear();G=void 0,g();for(let P of T.values())P.latch.settle();E.settle(),M.settle()},isConfigured:()=>J}}function f6($){let Z=new Map,Q=new Map,X=b$($,"KMS"),Y=!1,G=U$("KMS module",()=>Y&&Array.from(Z.values()).every((V)=>!V.isConfigured()||V.api.isReady())),z,_=()=>G.refresh(),B=(V)=>{let x=Z.get(V);if(x)return x;let T=e2(V,$,_);if(Z.set(V,T),!(V in z))Object.assign(z,{[V]:T.api});return T},H=(V)=>{let x=Z.get(V);if(!x)throw Error(`KMS pool "${V}" is not configured.`);return x.api},D=(V)=>{let x=Z.get(V);if(!x)throw Error(`KMS pool "${V}" is not configured.`);return x.issuer};return z={get config(){return Object.fromEntries(Q)},beforeChange:X.beforeChange,afterChange:X.afterChange,isReady:G.isReady,ready:G.ready,listPools:()=>Array.from(Q.keys()),getPool:H,issuer:D},{handle:()=>z,update(V,x){if(!V&&!Y&&Z.size===0)return;X.emitBefore(),Y=V!==void 0;let T=new Set(Object.keys(V??{}));for(let[q,I]of Object.entries(V??{})){Q.set(q,{...I});let O=I.path??`/kms/${q}`;try{B(q).update(I,x(I),O)}catch(E){B(q).unavailable(I),$.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:q,error:E instanceof Error?E.message:String(E)})}}for(let[q,I]of Z){if(T.has(q))continue;Q.delete(q),I.remove()}return G.refresh(),X.emitAfter(),Y||Z.size>0?z:void 0},close(){for(let V of Z.values())V.close();Z.clear(),Q.clear(),Y=!1,G.settle()}}}import{context as $Z,trace as ZZ}from"@opentelemetry/api";import{logs as QZ,SeverityNumber as j0}from"@opentelemetry/api-logs";import{OTLPLogExporter as XZ}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as YZ}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as JZ}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as GZ}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as zZ}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as _Z}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as BZ}from"@opentelemetry/resources";import{BatchLogRecordProcessor as HZ}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as KZ}from"@opentelemetry/sdk-metrics";import{NodeSDK as DZ}from"@opentelemetry/sdk-node";var m6={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},VZ={trace:!1,debug:!1,info:!0,warn:!0,error:!0};function J1($,Z){let Q=Z[$];if(Q===!1)return!1;if($==="metrics")return Q===!0||typeof Q==="object";return!0}function G1($){return typeof $==="object"&&$!==null?$:void 0}function UZ($){return typeof $==="object"&&$!==null?$:void 0}function FZ($,Z){let Q=$.replace(/\/+$/,"");if(Q.endsWith(m6[Z]))return Q;return`${Q}${m6[Z]}`}function MZ($,Z){let Q=G1($[Z]);if(Q?.endpoint)return Q.endpoint;if(!$.endpoint)return;return FZ($.endpoint,Z)}function WZ($,Z,Q){let X=G1($[Z]),Y={...$.headers,...X?.headers??{}};if(Q)Y.Authorization=`Bearer ${Q}`;return Y}function z1($,Z,Q){let X=G1($[Z]);return{url:MZ($,Z),headers:WZ($,Z,Q),timeoutMillis:X?.timeoutMillis,concurrencyLimit:X?.concurrencyLimit}}function OZ($,Z){let Q=z1($,"traces",Z);return $.protocol==="http/json"?new zZ(Q):new _Z(Q)}function LZ($,Z){let Q=z1($,"metrics",Z);return $.protocol==="http/json"?new JZ(Q):new GZ(Q)}function NZ($,Z){let Q=z1($,"logs",Z);return $.protocol==="http/json"?new XZ(Q):new YZ(Q)}function AZ($){return{"service.name":$.name,...$.version?{"service.version":$.version}:{},...$.deploymentEnvironment?{"deployment.environment.name":$.deploymentEnvironment}:{},...$.resourceAttributes??{}}}async function jZ($){if(!$.oauth)return;let Z=new URLSearchParams({grant_type:"client_credentials",client_id:$.oauth.clientId,client_secret:$.oauth.clientSecret});if($.oauth.scope)Z.set("scope",$.oauth.scope);if($.oauth.audience)Z.set("audience",$.oauth.audience);let Q=await fetch($.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...$.oauth.headers??{}},body:Z});if(!Q.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${Q.status}`);let X=await Q.json();if(typeof X.access_token!=="string"||!X.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return X.access_token}function EZ($,Z){return{...VZ,...Z?.levels??{},...$.levels??{}}}function u0($,Z="Authorization"){let Q={...$.headers??{}};if(!$.apiKey)return Q;let X=$.apiKeyHeader??Z;return Q[X]=X.toLowerCase()==="authorization"?`Bearer ${$.apiKey}`:$.apiKey,Q}function RZ($,Z){return Object.keys($).some((Q)=>Q.toLowerCase()===Z.toLowerCase())}function d6($,Z,Q){let X=Object.keys($).find((Y)=>Y.toLowerCase().startsWith(Z.toLowerCase()));if(X)throw Error(`OpenTelemetry provider "${Q}" does not support provider-specific header "${X}".`)}function l0($,Z,Q,X){return{type:Q,name:$.name,version:$.version,protocol:$.protocol??"http/protobuf",endpoint:$.endpoint,headers:X,resourceAttributes:AZ($),levels:EZ($,Z),traces:$.traces,metrics:$.metrics,logs:$.logs}}function PZ($,Z){return l0($,Z,"otlp",u0($))}function qZ($,Z){return l0($,Z,"grafana-lgtm",u0($))}function TZ($,Z){let Q=u0($,"DD-API-KEY");if(!RZ(Q,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return l0($,Z,"datadog",Q)}function IZ($,Z){let Q=u0($);return d6(Q,"DD-","splunk"),l0($,Z,"splunk",Q)}function xZ($,Z){let Q=u0($);return d6(Q,"DD-","elastic"),l0($,Z,"elastic",Q)}function wZ($,Z){let Q=$.type??"otlp";switch(Q){case"otlp":return PZ($,Z);case"grafana-lgtm":return qZ($,Z);case"datadog":return TZ($,Z);case"splunk":return IZ($,Z);case"elastic":return xZ($,Z);default:throw Error(`Unsupported OpenTelemetry provider type: ${Q}`)}}function SZ($,Z){if(typeof $==="string")return $;if($ instanceof Error)return $.message;if($!=null)return d0($);if(Z.length===0)return"";return d0(Z[0])}function d0($){if(typeof $==="string")return $;try{return JSON.stringify($)}catch{return String($)}}function g6($,Z,Q){if(Q==null)return;if(typeof Q==="string"||typeof Q==="number"||typeof Q==="boolean"){$[Z]=Q;return}if(Array.isArray(Q)&&Q.every((X)=>["string","number","boolean"].includes(typeof X))){$[Z]=Q;return}if(Q instanceof Error){if($[`${Z}.name`]=Q.name,$[`${Z}.message`]=Q.message,Q.stack)$[`${Z}.stack`]=Q.stack;return}$[Z]=d0(Q)}function CZ($){let Z={};for(let[X,Y]of $.entries()){if(Y&&typeof Y==="object"&&!Array.isArray(Y)&&!(Y instanceof Error)&&Object.getPrototypeOf(Y)===Object.prototype){for(let[J,G]of Object.entries(Y))g6(Z,J,G);continue}g6(Z,`param.${X}`,Y)}let Q=ZZ.getSpanContext($Z.active());if(Q)Z.trace_id=Q.traceId,Z.span_id=Q.spanId,Z.trace_flags=Q.traceFlags;return Z}function kZ($){return $}function bZ($){let Z=typeof $.body==="string"?$.body:d0($.body),Q=$.attributes??{};if(Object.keys(Q).length===0)return Z;return`${Z} ${d0(Q)}`}function u6($,Z){globalThis.console[kZ($)](bZ(Z))}function yZ($,Z){if((Z.severityNumber??0)<j0.INFO)return;u6($,Z)}function vZ($,Z,Q){let X=Q?.console;if(X===!1)return;if(typeof X==="function"){X(Z);return}if(X===!0){u6($,Z);return}yZ($,Z)}function hZ($,Z){let Q=QZ.getLogger($.name,$.version),X=(Y,J,G)=>{if(!$.levels[Y])return;let z={severityNumber:J,severityText:Y.toUpperCase(),body:SZ(G[0],G.slice(1)),attributes:CZ(G.slice(1))};try{Q.emit(z)}finally{vZ(Y,z,Z)}};return{trace:(Y,...J)=>X("trace",j0.TRACE,[Y,...J]),debug:(Y,...J)=>X("debug",j0.DEBUG,[Y,...J]),info:(Y,...J)=>X("info",j0.INFO,[Y,...J]),warn:(Y,...J)=>X("warn",j0.WARN,[Y,...J]),error:(Y,...J)=>X("error",j0.ERROR,[Y,...J])}}function fZ($){return $?.current()}function mZ($,Z,Q){let X=Z;return $.subscribe((Y)=>{let J=Y?.value;if(J===X)return;X=J,Q()})}function p6($){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:$,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function _1($,Z,Q,X){if(!Z&&!Q)return;if(!Z)return p6($);let Y=Z,J;if(Y.apiKeyPool&&X)try{J=X.getPool(Y.apiKeyPool)}catch{J=void 0}let G=fZ(J),z=()=>_1($,Y,Q,X),_=Y.apiKeyPool&&X?(E)=>mZ(X.getPool(Y.apiKeyPool),G,E):void 0;if(Y.apiKeyPool&&!G){let E=p6($);return E.onCredentialChange=_,E.rebuild=z,E}let B=G?{...Y,apiKey:G}:Y,H=wZ(B,Q),D,V=!1,x=hZ(H,Q),T,q,I=new Promise((E,M)=>{T=E,q=M});async function O(){try{let E=await jZ(Y),M={resource:BZ(H.resourceAttributes),instrumentations:Q?.instrument};if(Q?.sampler)M.sampler=Q.sampler;if(Q?.textMapPropagator)M.textMapPropagator=Q.textMapPropagator;if(Q?.contextManager)M.contextManager=Q.contextManager;if(Q?.spanProcessors)M.spanProcessors=Q.spanProcessors;else if(J1("traces",H))M.traceExporter=OZ(H,E);if(Q?.metricReaders)M.metricReaders=Q.metricReaders;else if(J1("metrics",H)){let f=UZ(H.metrics);M.metricReaders=[new KZ({exporter:LZ(H,E),exportIntervalMillis:f?.exportIntervalMillis,exportTimeoutMillis:f?.exportTimeoutMillis})]}if(Q?.logRecordProcessors)M.logRecordProcessors=Q.logRecordProcessors;else if(J1("logs",H))M.logRecordProcessors=[new HZ({exporter:NZ(H,E)})];let R=Q?.configure?.(M);D=new DZ(R??M),D.start(),V=!0,T?.()}catch(E){V=!1;let M=E instanceof Error?E:Error(String(E));$.error?.("OpenTelemetry startup failed",M),q?.(M)}finally{T=void 0,q=void 0}}return{state:"available",start:O,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>V,ready:(E)=>{if(!E||E<=0)return I;return Promise.race([I,new Promise((M,R)=>{setTimeout(()=>R(Error(`OpenTelemetry ready timed out after ${E}ms.`)),E)})])},logger:x,forceFlush:async()=>{await D?.forceFlush?.()},shutdown:async()=>{V=!1,await D?.shutdown(),D=void 0},onCredentialChange:_,rebuild:z}}function l6($){let Z,Q,X,Y=0,J=Promise.resolve(),G=b$($,"OpenTelemetry"),z=U$("OpenTelemetry module",()=>Z?.isReady()===!0),_={beforeChange:G.beforeChange,afterChange:G.afterChange,isReady:z.isReady,ready:z.ready,logger:{trace:(D,...V)=>(Z?.logger??$).trace(D,...V),debug:(D,...V)=>(Z?.logger??$).debug(D,...V),info:(D,...V)=>(Z?.logger??$).info(D,...V),warn:(D,...V)=>(Z?.logger??$).warn(D,...V),error:(D,...V)=>(Z?.logger??$).error(D,...V)},forceFlush:async()=>{await Z?.forceFlush()},shutdown:async()=>{await Z?.shutdown()}},B=!1,H;return H={update(D){if(!D){if(Z||Q){let q=Z,I=Q;Y+=1,G.emitBefore(),X?.(),X=void 0,Z=void 0,Q=void 0,z.refresh(),J=Promise.all([q?.shutdown(),I?.shutdown()]).finally(()=>G.emitAfter()).then(()=>{return},()=>{return})}return B?_:void 0}if(B=!0,D===Z||D===Q)return _;let V=Z,x=Q;Y+=1;let T=Y;return G.emitBefore(),X?.(),X=void 0,Z=void 0,Q=D,z.refresh(),J=(async()=>{try{if(await Promise.all([V?.shutdown(),x?.shutdown()]),await D.start(),T!==Y||Q!==D){await D.shutdown();return}Z=D,Q=void 0,z.refresh(),X=D.onCredentialChange?.(()=>{if(Z!==D)return;let q=D.rebuild?.();if(q)H.update(q)})}finally{if(T===Y)G.emitAfter()}})().then(()=>{return},()=>{return}),_},settled(){return J},async shutdown(){Y+=1;let D=Z,V=Q;X?.(),X=void 0,Z=void 0,Q=void 0,z.settle(),await Promise.all([D?.shutdown(),V?.shutdown()])}},H}import{ION_ENDPOINT_PERMISSIONS as B1,trimTrailingSlash as c6}from"@ionite/core";import{hasPermission as gZ}from"@ionite/core/server";async function B0($,Z,Q){let X=await gZ($,Z,Q.permission,void 0,Q.subjectType);return X.allow?void 0:X.response()}function pZ($){let Z=c6($);return{matchesPath:(Y)=>{if(!Y)return!1;return c6(Y)===Z},startsWithPath:(Y)=>{if(!Y)return!1;return $===Y||$.startsWith(`${Y}/`)}}}function i6($,Z,Q,X){let Y=X??new URL($.url).pathname,{matchesPath:J,startsWithPath:G}=pZ(Y);if(Z.sso){let z=Z.sso;if(J(Q.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(_)=>z.handler(_)};if(J(Q.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(_)=>z.logout(_)};if(J(Q.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(_)=>z.logoutBackChannel(_)};if(J(Q.sso.loginUrl)||J(Q.sso.refreshUrl)||J(Q.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(_)=>z.handler(_)}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(_)=>{let B=await z.resolveCustomer(_);if(B.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(B.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(B.value),{headers:{"Content-Type":"application/json"}})}};if(J(Q.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(_)=>z.logout(_)}}if(Z.iam){let z=Z.iam,_=$.method!=="GET"&&$.method!=="HEAD";if(G(Q.iam.usersUrl))return{module:"iam",kind:_?"iam.users.write":"iam.read",requiredPermission:B1[_?"iam.users.write":"iam.read"],handler:async(B)=>z.handler(B)};if(G(Q.iam.groupsUrl))return{module:"iam",kind:_?"iam.groups.write":"iam.read",requiredPermission:B1[_?"iam.groups.write":"iam.read"],handler:async(B)=>z.handler(B)};if(G(Q.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(B)=>z.handler(B)}}if(Z.workload){let z=Z.workload;if(J(Q.workload.validateUrl)||J(Q.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(_)=>z.handler(_)}}if(Z.secrets){let z=Z.secrets;if(z.isLfvDeliveryRequest?.($)&&z.handleLfvDelivery){let _=z.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(B)=>_(B)}}if(z.isLfvEventsRequest?.($)&&z.handleLfvEvents){let _=z.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(B)=>_(B)}}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.magicLinkUrl)&&$.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:B1["ciam.magic-link.create"],handler:async(_)=>z.handler(_)};if(J(Q.ciam.magicLinkLoginUrl)&&$.method==="GET"||J(Q.ciam.customerProvidersUrl)&&$.method==="GET"||J(Q.ciam.customerLoginUrl)&&$.method==="GET"||J(Q.ciam.customerCallbackUrl)&&($.method==="GET"||$.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(_)=>z.handler(_)}}return}async function H1($,Z,Q,X){let Y=X??g$(Z4()),J=new URL($.url).pathname;if(Q?.filter){let D=await Q.filter($,Z);if(D instanceof Response)return D;if(D==="not_handled")return D$()}let G=i6($,Z,Y,J),_=await Q?.resolve?.($,Z,G)??G;if(!_)return D$();let B=_.requiredPermission===void 0?G?.requiredPermission:_.requiredPermission,H=async()=>{if(B){let D=await B0($,Z,B);if(D)return D}return _.handler($)};if(Q?.wrap)return await Q.wrap($,_,H,Z);return await H()}import{stableConfigHash as _3}from"@ionite/core";function M4(){let $=0;return{next:()=>{return $+=1,$},isCurrent:(Z)=>Z===$,current:()=>$}}import{readFile as X3,stat as Y3}from"node:fs/promises";class E0 extends Error{code;status;constructor($,Z,Q){super($);this.code=Z;this.status=Q;this.name="VaultWebSocketCommandError"}sourceType="vault"}class l$ extends Error{path;constructor($,Z=`Vault secret not found at path ${$}`){super(Z);this.path=$;this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}code;status;sourceType="vault"}class V$ extends Error{path;status;code;constructor($,Z,Q,X,Y){super($,Y);this.path=Z;this.status=Q;this.code=X;this.name="VaultRequestError"}sourceType="vault"}class w$ extends Error{sourceType;path;constructor($,Z,Q=`Vault subscribe is not supported for source ${$} at path ${Z} without websocket, LFV, or ttl`){super(Q);this.sourceType=$;this.path=Z;this.name="VaultSubscribeNotSupportedError"}}function n6($){return $ instanceof l$||$ instanceof E0&&($.code==="not_found"||$.status===404)}import{WebSocket as R0}from"ws";var dZ=1000,uZ=30000,a6=30000,t6=a6;function r6($){t6=$>0?$:a6}function o6($){return typeof $==="number"&&Number.isInteger($)&&$>=1?{kms_slots:$}:{}}function lZ($){let Z=Math.min(uZ,dZ*2**Math.min($,16)),Q=0.5+Math.random()*0.5;return Math.round(Z*Q)}var H0=new Map;function cZ($){return $.trim().replace(/\/+$/g,"")}function e6($,Z){let Q=typeof Z?.version==="number"?Z.version:0,X=Z?.created_time??Z?.created,Y=typeof X==="string"?new Date(X):new Date,J=J0(Z);return{path:$,version:Q,created:Y,...J?{contentType:J}:{}}}function iZ($){return typeof $?.version==="number"?$.version:void 0}function nZ($){let Z=$.token?.trim();if(!Z)return{};if($.header==="Authorization")return{Authorization:Z.startsWith("Bearer ")?Z:`Bearer ${Z}`};return{"X-Vault-Token":Z}}function c0($){return{client_id:$.clientId,token:$.token,header:$.header??"X-Vault-Token"}}function D1($,Z){let Q=cZ($),X=H0.get(Q);if(X){if(Z&&!X.log)X.log=Z;return X}let Y={url:Q,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:Z};return H0.set(Q,Y),Y}function sZ($){let Z=[...Array.from($.subs.values(),(Y)=>Y.creds),...$.eventListeners.values()];if(Z.length===0)return $.lastGoodCreds??{url:$.url};let Q=$.lastGoodCreds?[$.lastGoodCreds,...Z]:Z,X=Q[$.reconnectCredCursor%Q.length]??Z[0];return $.reconnectCredCursor+=1,X}function s6($,Z){for(let Q of $.subs.values())try{Q.onHealth?.(Z)}catch(X){$.log?.warn("Vault websocket health hook threw",X)}}function aZ($,Z){for(let Q of Array.from($.subs.values())){let X=Q.onFirstSecretReject;if(Q.onFirstSecret=void 0,Q.onFirstSecretReject=void 0,X)try{X(new V$(`Vault websocket subscription interrupted (${Z})`,Q.path,void 0,"connection"))}catch(Y){$.log?.warn("Vault websocket first-secret waiter rejection threw",Y)}}}function $8($,Z){for(let Q of $.pending.values())clearTimeout(Q.timer),Q.reject(new V$(`Vault websocket command interrupted (${Z})`,"/",void 0,"connection"));$.pending.clear()}function W4($){if($.disposed)return;if($.disposed=!0,$.reconnectTimer)clearTimeout($.reconnectTimer),$.reconnectTimer=void 0;$8($,"closed"),aZ($,"socket disposed");let Z=$.ws;if($.ws=void 0,$.connectPromise=void 0,$.hasConnected=!1,H0.delete($.url),Z)try{Z.removeAllListeners(),Z.close()}catch{}}function O4($){if($.subs.size>0||$.pending.size>0||$.eventListeners.size>0)return;W4($)}function K1($){return`${$.clientId??""}|${$.token??""}|${$.header??"X-Vault-Token"}`}function Z8($){let Z=new Map;for(let Q of $.eventListeners.values())Z.set(K1(Q),Q);return Array.from(Z.values())}function tZ($,Z){if(typeof Z.path!=="string"||typeof Z.event!=="string")return;let Q={path:Z.path,event:Z.event,...typeof Z.request_id==="string"?{requestId:Z.request_id}:{},...typeof Z.key_id==="string"&&Z.key_id.length>0?{keyId:Z.key_id}:{}};for(let X of $.eventListeners.keys())try{X(Q)}catch(Y){$.log?.warn("Vault websocket event listener threw",Y)}}function Q8($,Z,Q,X){if(X!==void 0&&Z.lastVersion!==void 0&&X===Z.lastVersion)return;if(X!==void 0)Z.lastVersion=X;try{Z.onChange(Q)}catch(J){$.log?.warn("Vault websocket subscription onChange threw",J)}let Y=Z.onFirstSecret;if(Z.onFirstSecret=void 0,Z.onFirstSecretReject=void 0,Y)try{Y()}catch(J){$.log?.warn("Vault websocket subscription onFirstSecret threw",J)}}function rZ($,Z){let Q=Z.subscription_id;if(typeof Q!=="string")return;let X=$.subs.get(Q);if(!X)return;let Y={data:Z.data,metadata:e6(typeof Z.path==="string"?Z.path:X.path,Z.metadata)};Q8($,X,Y,iZ(Z.metadata))}function oZ($,Z){let Q;try{Q=JSON.parse(Z.toString())}catch(X){$.log?.warn("Vault websocket message parse failed",X);return}if(Q.type==="secret"){rZ($,Q);return}if(Q.type==="event"){tZ($,Q);return}if(Q.type==="command_result"&&typeof Q.id==="string"){let X=$.pending.get(Q.id);if(!X)return;if($.pending.delete(Q.id),clearTimeout(X.timer),Q.ok===!1)X.reject(new E0(Q.error??`Vault websocket command failed for ${Q.id}`,Q.code,Q.status));else X.resolve(Q.result);O4($)}}function X8($,Z){$.send(JSON.stringify({type:"subscribe",subscription_id:Z.subscriptionId,paths:[Z.path],...o6(Z.kmsSlots),...c0(Z.creds)}))}function V1($){if($.disposed||$.reconnectTimer||$.subs.size===0&&$.eventListeners.size===0)return;let Z=lZ($.reconnectAttempts);$.reconnectAttempts+=1,$.reconnectTimer=setTimeout(()=>{if($.reconnectTimer=void 0,$.disposed)return;if($.subs.size===0&&$.eventListeners.size===0){W4($);return}L4($,sZ($)).catch(()=>{if($.hasConnected)$.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${Z}ms).`);V1($)})},Z)}function L4($,Z){if($.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if($.ws&&$.ws.readyState===R0.OPEN)return Promise.resolve($.ws);if($.connectPromise)return $.connectPromise;return $.connectPromise=new Promise((Q,X)=>{let Y=new R0($.url,{headers:nZ(Z)}),J=!1,G=$.hasConnected,z=()=>{J=!0,$.hasConnected=!0,$.reconnectAttempts=0,$.reconnectCredCursor=0,$.lastGoodCreds=Z,$.ws=Y,$.connectPromise=void 0,Y.on("message",(H)=>oZ($,H));for(let H of $.subs.values())try{X8(Y,H)}catch{}for(let H of Z8($))try{Y.send(JSON.stringify({type:"subscribe_events",...c0(H)}))}catch{}if(G)s6($,!0);Q(Y)},_=()=>{if($.ws===Y)$.ws=void 0;$.connectPromise=void 0;try{Y.removeAllListeners()}catch{}if($8($,"socket closed"),$.subs.size>0||$.eventListeners.size>0)s6($,!1),V1($);else W4($)},B=(H)=>{if($.ws===Y)$.ws=void 0;if(!J)J=!0,$.connectPromise=void 0,X(H)};Y.once("open",z),Y.on("close",_),Y.on("error",B)}),$.connectPromise}async function U1($,Z,Q,X){let Y=D1($.url,X),J=typeof Q.path==="string"?Q.path:"/",G=await L4(Y,$),z=crypto.randomUUID();try{return await new Promise((_,B)=>{let H=setTimeout(()=>{if(!Y.pending.has(z))return;Y.pending.delete(z),B(new V$(`Vault websocket command "${Z}" timed out`,J,void 0,"timeout"));try{Y.ws?.close()}catch{}},t6);Y.pending.set(z,{resolve:(D)=>_(D),reject:B,timer:H});try{G.send(JSON.stringify({type:"command",id:z,command:Z,...Q,...c0($)}))}catch(D){clearTimeout(H),Y.pending.delete(z),B(D)}})}finally{O4(Y)}}async function F1($,Z,Q,X){let Y;try{Y=await U1($,"read_secret",{path:Z,...o6(X)},Q)}catch(J){if(n6(J))throw new l$(Z);if(J instanceof E0||J instanceof V$)throw J;throw new V$(`Vault websocket read_secret failed for ${Z}`,Z,void 0,"connection",{cause:J})}if(!Y||typeof Y!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${Z}`);return{data:Y.data,metadata:e6(typeof Y.path==="string"?Y.path:Z,Y.metadata)}}async function Y8($,Z,Q,X,Y,J){let G=D1($.url,Y),z=crypto.randomUUID(),_={subscriptionId:z,creds:$,path:Z,...X?.kmsSlots!==void 0?{kmsSlots:X.kmsSlots}:{},onChange:Q,onHealth:J?.onHealth};G.subs.set(z,_);let B=()=>{if(!G.subs.delete(z))return;if(G.ws&&G.ws.readyState===R0.OPEN)try{G.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:z}))}catch{}O4(G)};try{let H=await L4(G,$);X8(H,_)}catch(H){if(X?.mode!=="wait")throw B(),H}try{let H=await F1($,Z,Y,X?.kmsSlots);Q8(G,_,H,H.metadata.version)}catch(H){if(X?.mode!=="wait")throw B(),H;await new Promise((D,V)=>{let x,T=(q)=>{if(x)clearTimeout(x);_.onFirstSecret=void 0,_.onFirstSecretReject=void 0,B(),V(q)};if(_.onFirstSecret=()=>{if(x)clearTimeout(x);D()},_.onFirstSecretReject=T,typeof X.timeout==="number"&&X.timeout>0)x=setTimeout(()=>T(H),X.timeout)})}return B}async function J8($,Z,Q){let X=D1($.url,Q);X.eventListeners.set(Z,$);try{let Y=await L4(X,$);if(Y.readyState===R0.OPEN)Y.send(JSON.stringify({type:"subscribe_events",...c0($)}))}catch(Y){X.log?.warn("Vault websocket event subscription connect failed; retrying in background",Y),V1(X)}return()=>{if(!X.eventListeners.delete(Z))return;let Y=K1($);if(!Z8(X).some((G)=>K1(G)===Y)&&X.ws&&X.ws.readyState===R0.OPEN)try{X.ws.send(JSON.stringify({type:"unsubscribe_events",...c0($)}))}catch{}O4(X)}}function G8(){let $=0;for(let Z of H0.values())$+=Z.subs.size;return{urls:Array.from(H0.keys()),sockets:H0.size,subscriptions:$}}function z8(){for(let $ of Array.from(H0.values()))W4($)}var N4=600000;function K0($){if($&&$<N4)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${N4} milliseconds (10 minutes), as not to overload the store with polling requests`)}function c$($,Z,Q,X,Y,J,G){let z=!1,_,B,H,D=(O)=>{try{G?.onHealth?.(O)}catch{}},V=()=>{if(z=!0,_)clearTimeout(_),_=void 0;B?.()},x=(O)=>new Promise((E)=>{let M=setTimeout(()=>{B=void 0,_=void 0,E()},O);_=M,B=()=>{clearTimeout(M),B=void 0,_=void 0,E()}});async function T(){let O=Date.now();for(;;){if(z)return;try{let E=await $.getFullSecret(Z,J);return D(!0),E}catch(E){if(D(!1),J?.mode!=="wait")throw E;if(typeof J.timeout==="number"&&J.timeout>0&&Date.now()-O>=J.timeout)throw E;if(z)return;Y?.warn(`Error retrieving initial secret from vault. Retrying in ${X} milliseconds`,E),await x(X)}}}async function q(){if(_=void 0,z)return;try{let O=await $.getFullSecret(Z,J);if(D(!0),O.metadata.version!==H)H=O.metadata.version,Q(O)}catch(O){D(!1),Y?.warn(`Error retrieving remote config from vault. Retrying in ${X} milliseconds`,O)}I()}function I(){if(z)return;_=setTimeout(()=>{q()},X)}return T().then((O)=>{if(z||!O)return()=>V();return H=O.metadata.version,Q(O),I(),()=>V()})}function eZ($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function $3($){let Z={"Content-Type":"application/json"};if($)Z["X-Vault-Token"]=$;return Z}function Z3($){return Boolean($?.idpTokenUrl?.trim()&&$.clientId?.trim()&&$.clientSecret?.trim())}async function _8($,Z){let Q=Date.now();if(Z.token&&Z.expiresAt&&Z.expiresAt-60000>Q)return Z.token;let X=new URLSearchParams({grant_type:"client_credentials",client_id:$.clientId,client_secret:$.clientSecret});if($.scope?.trim())X.set("scope",$.scope.trim());let Y=await fetch($.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:X.toString()});if(!Y.ok)throw Error(`Vault workload token request failed (${Y.status})`);let J=await Y.json();if(!J.access_token)throw Error("Vault workload token response did not include access_token");return Z.token=J.access_token,Z.expiresAt=Q+Math.max(1,J.expires_in??300)*1000,J.access_token}function Q3($){return{Authorization:$.startsWith("Bearer ")?$:`Bearer ${$}`}}function i0($){return $.replace(/\/data\/?$/,"")}function B8($,Z,Q){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`Vault ${Q} kms_park returned invalid payload for ${Z}`);let X=$;if(typeof X.parked!=="boolean")throw Error(`Vault ${Q} kms_park returned invalid payload for ${Z}`);let Y=X.disposition;if(Y!==void 0&&Y!=="cooldown"&&Y!=="suspect")throw Error(`Vault ${Q} kms_park returned invalid disposition for ${Z}`);return{parked:X.parked,...X.stale===!0?{stale:!0}:{},...Y?{disposition:Y}:{}}}function H8($,Z,Q){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`Vault ${Q} kms_add_keys returned invalid payload for ${Z}`);let X=$;if(!Array.isArray(X.keys))throw Error(`Vault ${Q} kms_add_keys returned invalid payload for ${Z}`);return{keys:X.keys.map((J,G)=>{if(!J||typeof J!=="object"||Array.isArray(J))throw Error(`Vault ${Q} kms_add_keys returned invalid keys[${G}] for ${Z}`);let z=J.id;if(typeof z!=="string"||z.length===0)throw Error(`Vault ${Q} kms_add_keys returned invalid keys[${G}].id for ${Z}`);return{id:z}})}}function K8($,Z,Q){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`Vault ${Q} kms_revoke_key returned invalid payload for ${Z}`);let X=$;if(typeof X.revoked!=="boolean")throw Error(`Vault ${Q} kms_revoke_key returned invalid payload for ${Z}`);return{revoked:X.revoked}}function P0($,Z){let{type:Q="vault",url:X,token:Y,ttl:J}=$,G=()=>$.log,z=Z3($.workload)?$.workload:void 0,_={},B=$3(Y),H=$.lfv,D=$.websocket,V=H?z0({...H,log:H.log??G(),path:H.path??"/"},Z):void 0,x=new Map,T=D?.url?.trim(),q=new Set,I=!1,O=!1;if(!H&&!X&&!T)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(K0(J),X&&!Y&&!z&&!H)G()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function E(){if(z){let j=await _8(z,_);return{"Content-Type":"application/json",...Q3(j)}}return{...B}}async function M(j){let h=g(j);if(z){let P=await _8(z,_);return{url:h,clientId:D?.clientId??z.clientId,token:P,header:"Authorization"}}return{url:h,clientId:D?.clientId,token:D?.token??Y,header:D?.header??"X-Vault-Token"}}function R(j){if(!H)throw Error(`Vault LFV capability is not configured for path ${j}`);let h=x.get(j);if(h)return h;let P=z0({...H,log:H.log??G(),path:j},Z);return x.set(j,P),P}function f(j){if(!X)throw Error(`Vault HTTP capability is not configured for path ${j}`);return X}function g(j){if(!T)throw Error(`Vault websocket capability is not configured for path ${j}`);return T}async function a(j,h){let P=await M(typeof h.path==="string"?h.path:"/");return U1(P,j,h,G())}async function X$(j,h){let P=f(j),F;try{let K=await E(),N=new URL(`${P}/${j}`);if(typeof h?.kmsSlots==="number"&&Number.isInteger(h.kmsSlots)&&h.kmsSlots>=1)N.searchParams.set("kms_slots",String(h.kmsSlots));F=await fetch(N,{headers:K})}catch(K){throw new V$(`Vault request failed from URL: ${P}/${j}`,j,void 0,"connection",{cause:K})}if(F.status!==200){if(F.status===404)throw new l$(j);let K=F.status===401||F.status===403,N=K?`Vault returned ${F.status} ${F.statusText} (auth error) from URL: ${P}/${j}`:`Vault returned invalid status, ${F.status}: '${F.statusText}' from URL: ${P}/${j}`;throw new V$(N,j,F.status,K?"auth":"invalid_status")}try{let N=(await F.json()).data;if(!N?.metadata||!("data"in N))throw Error("Missing vault secret data");let S=N.metadata.created_time??N.metadata.created;return{data:N.data,metadata:{path:typeof N.metadata.path==="string"?N.metadata.path:j,version:typeof N.metadata.version==="number"?N.metadata.version:0,created:S instanceof Date?S:typeof S==="string"?new Date(S):new Date,...J0(N.metadata)?{contentType:J0(N.metadata)}:{}}}}catch(K){throw new V$("Error retrieving secret",j,void 0,"invalid_payload",{cause:K})}}async function e(j,h){let P=await M(j);return F1(P,j,G(),h?.kmsSlots)}async function n(j){let h=f(j),P=`${i0(h)}/metadata/${j}`,F=await E(),K=await fetch(P,{headers:F});if(K.status!==200)throw new V$(`Vault getMetadata failed (${K.status}) for ${j}`,j,K.status,"invalid_status");let N=await K.json().catch(()=>null);if(!N?.metadata||typeof N.metadata!=="object")throw new V$(`Vault getMetadata returned invalid payload for ${j}`,j,K.status,"invalid_payload");return N.metadata}async function r(j,h,P){let F=f(h),K=`${i0(F)}/${j}/${h}`,N=await E(),S=await fetch(K,{method:"POST",headers:N,body:JSON.stringify({reason:P?.reason,severity:P?.severity,incident_ref:P?.incidentRef})});if(S.status!==200&&S.status!==202&&S.status!==204)throw new V$(`Vault ${j} failed (${S.status}) for ${h}`,h,S.status,"invalid_status")}async function Q$(j,h){if(H)return await R(j).getFullSecret(j,h);if(X)return await X$(j,h);return await e(j,h)}async function A(j,h,P){if(!eZ(h))throw Error(`putSecret requires an object value for vault source at path ${j}`);if(H){await R(j).putSecret(j,h,P);return}if(X){let F=f(j),K=await E();if(K["X-Ionite-Mime-Type"]=P.contentType.mimeType,K["X-Ionite-Secret-Format"]=P.contentType.format,P.contentType.schemaUrl)K["X-Ionite-Schema-Url"]=P.contentType.schemaUrl;if(P.contentType.typeId)K["X-Ionite-Secret-Type"]=P.contentType.typeId;let N=await fetch(`${F}/${j}`,{method:"POST",headers:K,body:JSON.stringify(h)});if(N.status!==200&&N.status!==201&&N.status!==204)throw new V$(`Vault putSecret failed (${N.status}) for ${j}`,j,N.status,"invalid_status");return}await a("put_secret",{path:j,data:h,content_type:_4(P.contentType)})}async function W(j,h){if(H){await R(j).deleteSecret(j,h);return}if(X){let P=f(j),F=await E(),K=await fetch(`${P}/${j}`,{method:"DELETE",headers:F});if(K.status!==200&&K.status!==202&&K.status!==204)throw new V$(`Vault deleteSecret failed (${K.status}) for ${j}`,j,K.status,"invalid_status");return}await a("delete_secret",{path:j})}async function L(j,h){if(H)return await R(j).listPaths(j,h);if(X){let K=`${f(j)}/${j}`,N=async(d)=>{let $$=await E();if(d==="LIST")return fetch(K,{method:"LIST",headers:$$});let t=K.includes("?")?"&":"?";return fetch(`${K}${t}list=true`,{method:"GET",headers:$$})},S=await N("LIST");if(S.status===405||S.status===501)S=await N("GET");if(S.status!==200)throw new V$(`Vault listPaths failed (${S.status}) for ${j}`,j,S.status,"invalid_status");let y=await S.json().catch(()=>null),i;if(y&&typeof y==="object"){let d=y,$$=d.data;if($$&&typeof $$==="object")i=$$.keys;else i=d.keys}if(!Array.isArray(i))throw new V$(`Vault listPaths returned an unexpected response for ${j}`,j,void 0,"invalid_payload");return i.filter((d)=>typeof d==="string")}let P=await a("list_paths",{path:j});if(!Array.isArray(P.items))throw Error(`Vault websocket list_paths returned invalid payload for ${j}`);return P.items.filter((F)=>typeof F==="string")}async function k(j,h){if(H)return await R(j).exists(j,h);if(X){let F=f(j),K=await E(),N=await fetch(`${F}/${j}`,{headers:K});if(N.status===200)return!0;if(N.status===404)return!1;if(N.status===401||N.status===403)throw new V$(`Vault exists failed (${N.status}) for ${j} (auth error)`,j,N.status,"auth");throw new V$(`Vault exists failed (${N.status}) for ${j}`,j,N.status,"invalid_status")}let P=await a("exists",{path:j});if(typeof P.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${j}`);return P.exists}async function w(j,h,P){if(H){await R(j).requestRotate(j,h,P);return}if(X){await r("rotate/request",j,h);return}await a("request_rotate",{path:j,reason:h?.reason,severity:h?.severity,incident_ref:h?.incidentRef})}async function b(j,h,P){if(H){await R(j).requestRevoke(j,h,P);return}if(X){await r("revoke/request",j,h);return}await a("request_revoke",{path:j,reason:h?.reason,severity:h?.severity,incident_ref:h?.incidentRef})}async function u(j,h,P){if(H)return await R(j).parkKmsKey(j,h,P);if(X){let K=f(j),N=`${i0(K)}/kms/park/${j}`,S=await E(),y=await fetch(N,{method:"POST",headers:S,body:JSON.stringify({key_id:h.keyId,status:h.status,reason:h.reason})});if(y.status!==200&&y.status!==202)throw new V$(`Vault kms/park failed (${y.status}) for ${j}`,j,y.status,"invalid_status");return B8(await y.json().catch(()=>null),j,"http")}let F=await a("kms_park",{path:j,key_id:h.keyId,status:h.status,reason:h.reason});return B8(F,j,"websocket")}async function c(j,h,P){if(H)return await R(j).addKmsKeys(j,h,P);if(X){let K=f(j),N=`${i0(K)}/kms/add-keys/${j}`,S=await E(),y=await fetch(N,{method:"POST",headers:S,body:JSON.stringify({keys:h.keys})});if(y.status!==200&&y.status!==202)throw new V$(`Vault kms/add-keys failed (${y.status}) for ${j}`,j,y.status,"invalid_status");return H8(await y.json().catch(()=>null),j,"http")}let F=await a("kms_add_keys",{path:j,keys:h.keys});return H8(F,j,"websocket")}async function o(j,h,P){if(H)return await R(j).revokeKmsKey(j,h,P);if(X){let K=f(j),N=`${i0(K)}/kms/revoke-key/${j}`,S=await E(),y=await fetch(N,{method:"POST",headers:S,body:JSON.stringify({key_id:h.keyId,reason:h.reason})});if(y.status!==200&&y.status!==202)throw new V$(`Vault kms/revoke-key failed (${y.status}) for ${j}`,j,y.status,"invalid_status");return K8(await y.json().catch(()=>null),j,"http")}let F=await a("kms_revoke_key",{path:j,key_id:h.keyId,reason:h.reason});return K8(F,j,"websocket")}async function Y$(j,h){if(H)return await R(j).getMetadata(j,h);if(X)return await n(j);let P=await a("read_metadata",{path:j});if(!P.metadata||typeof P.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${j}`);return P.metadata}async function G$(j,h,P){if(!J)throw new w$(Q,j);return c$({getFullSecret:X$},j,h,J,G(),P,{onHealth:(F)=>{I=!F}})}async function s(j,h,P){let F=await M(j);return Y8(F,j,h,P,G(),{onHealth:(K)=>{O=!K}})}function z$(j){let h=()=>{if(q.delete(h))j()};return q.add(h),h}function H$(){if(V?.isAvailable?.()===!1)return!0;for(let j of x.values())if(j.isAvailable?.()===!1)return!0;return!1}let K$={type:Q,isAvailable:()=>!I&&!O&&!H$(),get:(j,h)=>h$(()=>Q$(j,h)),getFullSecret:Q$,getSecret:async(j,h)=>{return(await Q$(j,h)).data},putSecret:A,deleteSecret:W,listPaths:L,exists:k,requestRotate:w,requestRevoke:b,parkKmsKey:u,addKmsKeys:c,revokeKmsKey:o,getMetadata:Y$,subscribe:async(j,h,P)=>{let F;if(T)F=await s(j,h,P);else if(H)F=await R(j).subscribe(j,h,P);else F=await G$(j,h,P);return z$(F)},...V?{subscribeEvents:(j)=>z$(V.subscribeEvents?.(j)??(()=>{}))}:T?{subscribeEvents:(j)=>{let h,P=!1;return M("/").then((F)=>J8(F,j,G())).then((F)=>{if(P){F();return}h=F}).catch((F)=>{G()?.warn("Vault websocket event subscription failed",F)}),z$(()=>{P=!0,h?.()})}}:{},close:()=>{for(let h of Array.from(q))try{h()}catch(P){G()?.warn("Vault source close: failed to release a subscription",P)}q.clear();let j=(h)=>{if(!h?.close)return;try{Promise.resolve(h.close()).catch((P)=>{G()?.warn("Vault source close: LFV close failed",P)})}catch(P){G()?.warn("Vault source close: LFV close failed",P)}};for(let h of x.values())j(h);j(V),x.clear(),_.token=void 0,_.expiresAt=void 0},get log(){return $.log},set log(j){$.log=j}};if(V)K$.isDeliveryRequest=(j)=>V.isDeliveryRequest(j),K$.isEventsRequest=(j)=>V.isEventsRequest(j),K$.handleDelivery=(j)=>V.handleDelivery(j),K$.handleEvents=(j)=>V.handleEvents(j),Object.defineProperties(K$,{deliveryPath:{value:V.deliveryPath,enumerable:!0},eventsPath:{value:V.eventsPath,enumerable:!0},callbackKey:{value:V.callbackKey,enumerable:!0},trustId:{value:V.trustId,enumerable:!0}});return K$}class j4 extends Error{status;constructor($,Z){super($);this.name="AzureKeyVaultError",this.status=Z,Object.setPrototypeOf(this,j4.prototype)}}function A4($,Z){if(!$||$.trim().length===0)throw Error(`Missing required Azure config: ${Z}`);return $}function J3($){return $.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function M1($,Z){return`${$.replace(/\/+$/g,"")}/${Z.replace(/^\/+/g,"")}`}function G3($){try{let Q=new URL($).pathname.split("/").filter(Boolean),X=Q.indexOf("secrets");if(X===-1)return;return Q[X+2]||void 0}catch{return}}function z3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function E4($){let Z=$.apiVersion??"7.4",Q=$.scope??"https://vault.azure.net/.default",X=$.secretNameTransform??J3,Y=$.authMethod,J="/var/run/secrets/azure/tokens/azure-identity-token",G=$.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",z=$.vaultUrl??($.vaultName?`https://${$.vaultName}.vault.azure.net`:void 0)??void 0,_=A4(z,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function B(A){try{return await Y3(A),!0}catch{return!1}}let H,D,V=!1;async function x(A){let{entraTenantId:W,clientId:L}=$;if(!W)throw Error("Workload identity requires entraTenantId");if(!L)throw Error("Workload identity requires clientId");if(!await B(G))throw Error(`Federated token file not found at ${G}`);let k=(await X3(G,"utf8")).trim();if(!k)throw Error("Federated token file was empty");let w=`https://login.microsoftonline.com/${encodeURIComponent(W)}/oauth2/v2.0/token`,b=new URLSearchParams({client_id:L,grant_type:"client_credentials",scope:Q,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:k}),u=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:b});if(u.status!==200)throw Error(`Azure workload identity token exchange returned ${u.status} ${u.statusText}`);let c=await u.json();if(!c?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:c.access_token,expiresAtMs:A+(c.expires_in??0)*1000},c.access_token}async function T(A){let W=$.imdsApiVersion??"2018-02-01",L="https://vault.azure.net",k=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(k.searchParams.set("api-version",W),k.searchParams.set("resource","https://vault.azure.net"),$.managedIdentityClientId)k.searchParams.set("client_id",$.managedIdentityClientId);let w=await fetch(k.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(w.status!==200)throw Error(`Azure IMDS token endpoint returned ${w.status} ${w.statusText}`);let b=await w.json();if(!b?.access_token)throw Error("IMDS token response missing access_token");let u=A+60000;if(b.expires_on){let c=Number.parseInt(b.expires_on,10);if(Number.isFinite(c)&&c>0)u=c*1000;else{let o=Date.parse(b.expires_on);if(Number.isFinite(o))u=o}}else if(b.expires_in){let c=Number.parseInt(b.expires_in,10);if(Number.isFinite(c)&&c>0)u=A+c*1000}return H={accessToken:b.access_token,expiresAtMs:u},b.access_token}async function q(A){let W=A4($.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),L=A4($.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),k=A4($.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),w=`https://login.microsoftonline.com/${encodeURIComponent(W)}/oauth2/v2.0/token`,b=new URLSearchParams({client_id:L,client_secret:k,grant_type:"client_credentials",scope:Q}),u=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:b});if(u.status!==200)throw Error(`Azure token endpoint returned ${u.status} ${u.statusText}`);let c=await u.json();if(!c?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:c.access_token,expiresAtMs:A+(c.expires_in??0)*1000},c.access_token}async function I(){let A=Date.now();if(H&&H.expiresAtMs-60000>A)return H.accessToken;if(D)return D;D=(async()=>{if(Y==="workload_identity")return await x(A);if(Y==="managed_identity")return await T(A);if(Y==="client_secret")return await q(A);if(await B(G))try{return await x(A)}catch{}try{return await T(A)}catch{}return await q(A)})();try{return await D}finally{D=void 0}}async function O(A){let W=await I(),L=M1(_,`/secrets/${encodeURIComponent(A)}?api-version=${encodeURIComponent(Z)}`),k=await fetch(L,{headers:{Authorization:`Bearer ${W}`,Accept:"application/json"}});if(k.status!==200)throw new j4(`Key Vault request failed (${k.status})`,k.status);return await k.json()}async function E(A,W){let L=X(A),k=$.secretNamePrefix?`${$.secretNamePrefix}${L}`:L,w=await O(k),b=w.value;try{b=JSON.parse(w.value)}catch{}let u=w.attributes?.created?w.attributes.created*1000:void 0,c=G3(w.id),o=w.contentType?z4({mimeType:w.contentType,format:w.tags?.["ionite-format"],schemaUrl:w.tags?.["ionite-schema-url"],typeId:w.tags?.["ionite-type-id"]}):void 0;return{data:b,metadata:{path:A,version:Number.parseInt(c??"",10)||0,created:u?new Date(u):new Date,...o?{contentType:o}:{}}}}async function M(A,W,L){if(!z3(W))throw Error(`putSecret requires an object value for azure source at path ${A}`);let k=X(A),w=$.secretNamePrefix?`${$.secretNamePrefix}${k}`:k,b=await I(),u=M1(_,`/secrets/${encodeURIComponent(w)}?api-version=${encodeURIComponent(Z)}`),c=JSON.stringify({value:JSON.stringify(W),contentType:L.contentType.mimeType,tags:{"ionite-format":L.contentType.format,...L.contentType.schemaUrl?{"ionite-schema-url":L.contentType.schemaUrl}:{},...L.contentType.typeId?{"ionite-type-id":L.contentType.typeId}:{}}}),o=await fetch(u,{method:"PUT",headers:{Authorization:`Bearer ${b}`,"Content-Type":"application/json",Accept:"application/json"},body:c});if(o.status!==200&&o.status!==201)throw Error(`Key Vault putSecret failed (${o.status}) for ${A}`)}async function R(A,W){let L=X(A),k=$.secretNamePrefix?`${$.secretNamePrefix}${L}`:L,w=await I(),b=M1(_,`/secrets/${encodeURIComponent(k)}?api-version=${encodeURIComponent(Z)}`),u=await fetch(b,{method:"DELETE",headers:{Authorization:`Bearer ${w}`,Accept:"application/json"}});if(u.status!==200&&u.status!==202&&u.status!==204)throw Error(`Key Vault deleteSecret failed (${u.status}) for ${A}`)}async function f(A,W){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${A}`)}async function g(A,W){try{return await E(A),!0}catch(L){if(L instanceof j4&&L.status===404)return!1;throw L}}async function a(A,W,L){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${A}`)}async function X$(A,W,L){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${A}`)}async function e(A){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${A}`)}async function n(A){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${A}`)}async function r(A){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${A}`)}async function Q$(A,W){let L=X(A),k=$.secretNamePrefix?`${$.secretNamePrefix}${L}`:L,w=await O(k),b=w.contentType?z4({mimeType:w.contentType,format:w.tags?.["ionite-format"],schemaUrl:w.tags?.["ionite-schema-url"],typeId:w.tags?.["ionite-type-id"]}):void 0;return{id:w.id,...b?{content_type:b}:{},...w.attributes??{}}}return{type:$.type,isAvailable:()=>!V,get:(A,W)=>h$(()=>E(A,W)),getFullSecret:E,getSecret:async(A,W)=>{return(await E(A,W)).data},putSecret:M,deleteSecret:R,listPaths:f,exists:g,requestRotate:a,requestRevoke:X$,parkKmsKey:e,addKmsKeys:n,revokeKmsKey:r,getMetadata:Q$,subscribe:(A,W,L)=>{if(!$.ttl)throw new w$("azure",A);return K0($.ttl),c$({getFullSecret:E},A,W,$.ttl,void 0,L,{onHealth:(k)=>{V=!k}})},close:()=>{H=void 0,D=void 0,V=!1}}}var W1=Symbol("ion.secretsSourceState");function B3($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${X}`)};return{type:"dev",get:(Q,X)=>h$(()=>Promise.reject(Z("get",Q))),getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),parkKmsKey:(Q,X,Y)=>Promise.reject(Z("parkKmsKey",Q)),addKmsKeys:(Q,X,Y)=>Promise.reject(Z("addKmsKeys",Q)),revokeKmsKey:(Q,X,Y)=>Promise.reject(Z("revokeKmsKey",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[W1]:"unavailable"}}function D8($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${X}`)};return{type:"dev",get:(Q,X)=>h$(()=>Promise.reject(Z("get",Q))),getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),parkKmsKey:(Q,X,Y)=>Promise.reject(Z("parkKmsKey",Q)),addKmsKeys:(Q,X,Y)=>Promise.reject(Z("addKmsKeys",Q)),revokeKmsKey:(Q,X,Y)=>Promise.reject(Z("revokeKmsKey",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[W1]:"removed"}}function H3($){return $.type==="vault"&&$.lfv!=null}function K3($,Z,Q,X){if(!H3(Z))return;if(Q||X)return;throw Error(`Secrets source "${$}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function D3($,Z,Q){if(Z.type==="vault")return P0(Z,Q);if(Z.type==="azure")return E4(Z);if(Z.type==="aws"||Z.type==="gcp"||Z.type==="dev")throw Error(`Secrets source "${$}" uses type "${Z.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${$}"`)}function V3($,Z){let Q=(X)=>{Z.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:X instanceof Error?X.message:String(X)})};try{Promise.resolve($.close?.()).catch(Q)}catch(X){Q(X)}}function U3($){let Z=new Map,Q=new Map,X=new Map;for(let[Y,J]of Object.entries($)){if(!V8(J))continue;let G=Z.get(J.deliveryPath);if(G)throw Error(`LFV delivery path "${J.deliveryPath}" is claimed by both secrets sources "${G}" and "${Y}"; delivery paths must be globally unique.`);Z.set(J.deliveryPath,Y);let z=Q.get(J.eventsPath);if(z)throw Error(`LFV events path "${J.eventsPath}" is claimed by both secrets sources "${z}" and "${Y}"; events paths must be globally unique.`);Q.set(J.eventsPath,Y);let _=X.get(J.callbackKey);if(_&&_.trustId!==J.trustId)throw Error(`LFV callback key "${J.callbackKey}" is claimed by secrets sources "${_.sourceName}" and "${Y}" with different verify JWKS; a callback path must use a single trust key.`);if(!_)X.set(J.callbackKey,{sourceName:Y,trustId:J.trustId})}}function V8($){return typeof $.isDeliveryRequest==="function"&&typeof $.isEventsRequest==="function"&&typeof $.handleDelivery==="function"&&typeof $.handleEvents==="function"}function F3($,Z,Q){let X={...Z},Y=[],J=(z)=>{if(X[z]!==void 0)delete X[z],Y.push(z)};J("token"),J("clientSecret"),J("workload");let G=X.websocket;if(G&&typeof G==="object"&&G.token!==void 0){let z={...G};delete z.token,X.websocket=z,Y.push("websocket.token")}if(Y.length>0)Q.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:$,"ion.droppedFields":Y});return X}function M3($,Z,Q){let X={},Y=new Set([...Object.keys(Z??{}),...Object.keys(Q??{})]);for(let J of Y){let G=Z?.[J],z=Q?.[J],_=z?F3(J,z,$):void 0;X[J]={...G??{},..._??{}}}return X}function R4($){return $[W1]??"available"}function W3($,Z,Q){let X=Z,Y=new Set,J=new Set,G=new Set,z=b$(Q,`Secrets source "${$}"`),_=()=>R4(X)==="available",B=U$(`Secrets source "${$}"`,_),H=(M,R,f)=>{return Error(`${M} timed out after ${f}ms waiting for source "${$}" to be configured by the ConfigSource at path ${R}`)},D=(M,R)=>{return Error(`${M} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${R}`)},V=(M,R,f)=>{let g=R4(X);if(g==="available")return Promise.resolve(X);if(g==="removed")return Promise.reject(D(M,R));return new Promise((a,X$)=>{let e={method:M,path:R,resolve:(r)=>{if(e.timeout)clearTimeout(e.timeout);G.delete(e),a(r)},reject:(r)=>{if(e.timeout)clearTimeout(e.timeout);G.delete(e),X$(r)}},n=f?.timeout;if(typeof n==="number"&&n>0)e.timeout=setTimeout(()=>{e.reject(H(M,R,n))},n);G.add(e)})},x=(M)=>{for(let R of Array.from(G))R.resolve(M)},T=()=>{for(let M of Array.from(G))M.reject(D(M.method,M.path))},q=async(M,R=!1)=>{let f=M.guard.next();if(M.unsubscribe?.(),M.unsubscribe=void 0,M.closed)return;if(R4(X)==="unavailable"&&M.options?.mode!=="wait"){if(R)throw Error(`subscribe is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${M.path}`);return}try{let a=await(M.options?.mode==="wait"?await V("subscribe",M.path,M.options):X).subscribe(M.path,(X$)=>{if(!M.closed)M.onChange(X$)},M.options);if(M.closed||!M.guard.isCurrent(f)){a?.();return}M.unsubscribe=a}catch(g){if(R)throw g;if(D4(g)){Q.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:$,path:M.path});return}Q.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:$,path:M.path,error:g instanceof Error?g.message:String(g)})}},I=(M,R=!1)=>{if(M.unsubscribe?.(),M.unsubscribe=void 0,M.closed)return;if(!X.subscribeEvents){if(R)throw Error(`Secrets source "${$}" does not support lifecycle event subscriptions`);return}M.unsubscribe=X.subscribeEvents((f)=>{if(!M.closed)M.listener(f)})},O={get type(){return X.type},beforeChange:z.beforeChange,afterChange:z.afterChange,isAvailable:()=>_()&&(X.isAvailable?.()??!0),isReady:B.isReady,ready:B.ready,get:(M,R)=>h$(async()=>{return(await V("get",M,R)).getFullSecret(M,R)}),getFullSecret:async(M,R)=>{return(await V("getFullSecret",M,R)).getFullSecret(M,R)},getSecret:async(M,R)=>{return(await V("getSecret",M,R)).getSecret(M,R)},putSecret:async(M,R,f)=>{return(await V("putSecret",M,f)).putSecret(M,R,f)},subscribe:async(M,R,f)=>{let g={path:M,onChange:R,options:f,closed:!1,guard:M4()};Y.add(g);try{await q(g,!0)}catch(a){throw Y.delete(g),a}return()=>{g.closed=!0,g.guard.next(),Y.delete(g),g.unsubscribe?.(),g.unsubscribe=void 0}},subscribeEvents:(M)=>{let R={listener:M,closed:!1};J.add(R);try{I(R,!0)}catch(f){throw J.delete(R),f}return()=>{R.closed=!0,J.delete(R),R.unsubscribe?.(),R.unsubscribe=void 0}},deleteSecret:async(M,R)=>{return(await V("deleteSecret",M,R)).deleteSecret(M,R)},listPaths:async(M,R)=>{return(await V("listPaths",M,R)).listPaths(M,R)},exists:async(M,R)=>{return(await V("exists",M,R)).exists(M,R)},requestRotate:async(M,R,f)=>{return(await V("requestRotate",M,f)).requestRotate(M,R,f)},requestRevoke:async(M,R,f)=>{return(await V("requestRevoke",M,f)).requestRevoke(M,R,f)},parkKmsKey:async(M,R,f)=>{return(await V("parkKmsKey",M,f)).parkKmsKey(M,R,f)},addKmsKeys:async(M,R,f)=>{return(await V("addKmsKeys",M,f)).addKmsKeys(M,R,f)},revokeKmsKey:async(M,R,f)=>{return(await V("revokeKmsKey",M,f)).revokeKmsKey(M,R,f)},getMetadata:async(M,R)=>{return(await V("getMetadata",M,R)).getMetadata(M,R)}},E=(M)=>{try{Promise.resolve(M.close?.()).catch((R)=>{Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:R instanceof Error?R.message:String(R)})})}catch(R){Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:R instanceof Error?R.message:String(R)})}};return{api:O,update(M){if(M===X)return;let R=X;z.emitBefore(),X=M;let f=R4(M);if(f==="available")x(M);else if(f==="removed")T();B.refresh();for(let g of Y)q(g);for(let g of J)I(g);E(R),z.emitAfter()},close(){for(let M of Y)M.closed=!0,M.guard.next(),M.unsubscribe?.(),M.unsubscribe=void 0;Y.clear();for(let M of J)M.closed=!0,M.unsubscribe?.(),M.unsubscribe=void 0;J.clear(),T(),B.settle(),E(X)}}}function U8($,Z=new Map){let Q=new Map,X=new Map,Y,J=!1,G=new Map,z=b$($,"Secrets"),_=!1,B=()=>{for(let O of Q.keys()){let E=G.get(O);if(E&&E.api.isReady?.()===!1)return!1}return!0},H=U$("Secrets module",()=>_&&B()),D=(O)=>{let E=G.get(O);if(E)return E;let M=W3(O,Q.get(O)??D8(O),$);if(G.set(O,M),!(O in I))Object.assign(I,{[O]:M.api});return M},V=(O)=>{let E=G.get(O)?.api;if(E)return E;throw $.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:O}),Error(`Secrets source "${O}" is not configured`)},x=()=>{return Array.from(Q.values()).filter(V8)},T=(O)=>{return x().find((E)=>E.isDeliveryRequest(O))},q=(O)=>{return x().find((E)=>E.isEventsRequest(O))},I;return I={get config(){return Object.fromEntries(Array.from(Q.keys(),(O)=>[O,D(O).api]))},beforeChange:z.beforeChange,afterChange:z.afterChange,isReady:H.isReady,isAvailable:()=>{for(let O of G.values()){if(O.api.isReady?.()===!1)continue;if(O.api.isAvailable?.()===!1)return!1}return!0},ready:H.ready,listSecretsSources:()=>Array.from(Q.keys()),getSecretsSource:(O)=>{if(Q.has(O))return D(O).api;return V(O)},get:(O,E,M)=>I.getSecretsSource(O).get(E,M),getSecret:(O,E,M)=>I.getSecretsSource(O).getSecret(E,M),getFullSecret:(O,E,M)=>I.getSecretsSource(O).getFullSecret(E,M),putSecret:(O,E,M,R)=>I.getSecretsSource(O).putSecret(E,M,R),deleteSecret:(O,E,M)=>I.getSecretsSource(O).deleteSecret(E,M),listPaths:(O,E,M)=>I.getSecretsSource(O).listPaths(E,M),exists:(O,E,M)=>I.getSecretsSource(O).exists(E,M),requestRotate:(O,E,M,R)=>I.getSecretsSource(O).requestRotate(E,M,R),requestRevoke:(O,E,M,R)=>I.getSecretsSource(O).requestRevoke(E,M,R),parkKmsKey:(O,E,M,R)=>I.getSecretsSource(O).parkKmsKey(E,M,R),addKmsKeys:(O,E,M,R)=>I.getSecretsSource(O).addKmsKeys(E,M,R),revokeKmsKey:(O,E,M,R)=>I.getSecretsSource(O).revokeKmsKey(E,M,R),getMetadata:(O,E,M)=>I.getSecretsSource(O).getMetadata(E,M),subscribe:(O,E,M,R)=>I.getSecretsSource(O).subscribe(E,M,R),isLfvDeliveryRequest:(O)=>T(O)!==void 0,isLfvEventsRequest:(O)=>q(O)!==void 0,handleLfvDelivery:async(O)=>{let E=T(O);if(!E)return D$();return E.handleDelivery(O)},handleLfvEvents:async(O)=>{let E=q(O);if(!E)return D$();return E.handleEvents(O)}},{update(O,E,M,R,f){let g=O!==void 0||E!==void 0;if(!g&&!_&&G.size===0)return;let a=M3($,O,E),X$=f===!0,e=R!==Y,n=X$!==J,r=new Map,Q$=new Map,A=[];try{for(let[W,L]of Object.entries(a)){let k=_3(L),w=Q.get(W);if(w&&X.get(W)===k&&!e&&!n){r.set(W,w),Q$.set(W,k);continue}let b;if(!L.type)b=B3(W);else{if(M?.validateSourceConfig?.(W,L),Z.has(W)&&O?.[W])$.warn(`RemoteConfig secrets source "${W}" is superseded by the framework LFV bootstrap source.`);if(!Z.has(W))K3(W,L,R,X$),b=D3(W,L,R),A.push(b);else b=Z.get(W)}r.set(W,b),Q$.set(W,k)}U3(Object.fromEntries(r))}catch(W){for(let L of A)V3(L,$);throw W}z.emitBefore(),_=g,Y=R,J=X$;for(let[W,L]of r)Q.set(W,L),X.set(W,Q$.get(W)),D(W).update(L);for(let[W,L]of G){if(r.has(W))continue;Q.delete(W),X.delete(W),L.update(D8(W))}return H.refresh(),z.emitAfter(),I},close(){for(let O of G.values())O.close();G.clear(),Q.clear(),X.clear(),Y=void 0,_=!1,H.settle()}}}function O1($,Z){let Q=Z.ttlMs,X=Math.max(1,Math.floor(Z.maxEntries)),Y=new Map,J=()=>Date.now();function G(){while(Y.size>X){let _=Y.keys().next().value;if(_===void 0)break;Y.delete(_)}}function z(_,B){Y.delete(_),Y.set(_,{session:B,expiresAt:J()+Q}),G()}return{async create(_){await $.create(_)},async get(_){let B=Y.get(_);if(B){if(B.expiresAt>J())return Y.delete(_),Y.set(_,B),B.session;Y.delete(_)}let H=await $.get(_);if(H)z(_,H);return H},async update(_,B){await $.update(_,B),Y.delete(_)},async delete(_){await $.delete(_),Y.delete(_)}}}import{deepEqualPlain as k3,ION_ENDPOINT_PERMISSIONS as b3,trimTrailingSlash as I4,validationFailureResponse as y3}from"@ionite/core";import{assertEcid as F8,jwtAssertionClaimsSchema as O3,must as S$,workloadTokenResponseSchema as L3}from"@ionite/core";import{getCachedVerificationKey as N3,getJwks as A3}from"@ionite/core/server";function y$($,Z){return Z in $&&$[Z]!==void 0&&$[Z]!==null}function E$($){if($===void 0||$===null)return!1;return y$($,"workloadId")||y$($,"privateKey")}function f$($){if($===void 0||$===null)return!1;let Z=y$($,"clientId"),Q=y$($,"clientSecret"),X=y$($,"workloadId"),Y=y$($,"privateKey");return(Z||Q)&&!X&&!Y}function L1($){if($===void 0||$===null)return!1;let Z=y$($,"jwksUri"),Q=y$($,"workloadId"),X=y$($,"clientId"),Y=y$($,"clientSecret"),J=y$($,"privateKey");return Z&&!Q&&!J&&!X&&!Y}function M8($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return"clientId"in Z||"jwksUri"in Z||"workloadId"in Z}function j3($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;if(M8(Z))return!1;let Q=Object.entries(Z);if(Q.length===0)return!1;return Q.every(([,X])=>M8(X))}function A8($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;if("incoming"in Z||"outgoing"in Z){if(Z.incoming!==void 0&&(typeof Z.incoming!=="object"||Z.incoming===null))return!1;if(Z.outgoing!==void 0&&(typeof Z.outgoing!=="object"||Z.outgoing===null||Array.isArray(Z.outgoing)))return!1;return!0}return!1}function j8($){return A8($)}function N1($){if(!$)return;if(j8($))return Array.isArray($.incoming)?void 0:$.incoming;return $}function P1($){if($===void 0||$===null)return[];return Array.isArray($)?$:[$]}function q0($){if(typeof $!=="string")return;return $.endsWith("/")?$.slice(0,-1):$}function W8($){if(!$)return[];if(Array.isArray($))return $.filter((Z)=>!!Z&&typeof Z.issuer==="string"&&typeof Z.jwksUri==="string").map((Z)=>({issuer:Z.issuer,jwksUri:Z.jwksUri,audience:Z.audience,scopesAsEntitlements:Z.scopesAsEntitlements}));if($.issuer&&$.jwksUri)return[{issuer:$.issuer,jwksUri:$.jwksUri,audience:$.audience??[],scopesAsEntitlements:$.scopesAsEntitlements}];return[]}function E3($){let Z=$[0];if(!Z)return;let Q=P1(Z.audience);return{jwksUri:Z.jwksUri,issuer:Z.issuer,audience:typeof Q[0]==="string"?Q[0]:void 0}}function O8($,Z){let Q=q0(Z);if(!Q)return;return $.find((X)=>q0(X.issuer)===Q)}function P4($,Z,Q){let X=P1($);if(Z.some((Y)=>X.includes(Y)))return!0;if(typeof Q==="string"&&Z.includes(Q))return!0;return!1}function A1($){if(!$||!j8($))return{};return $.outgoing??{}}function R3($){return{getToken:$.getToken,refreshToken:$.refreshToken,generateJWTAssertion:$.generateJWTAssertion,revokeToken:$.revokeToken,beforeChange:$.beforeChange,afterChange:$.afterChange,isReady:$.isReady,ready:$.ready}}var q1=Symbol("ion.workloadClientState"),E8=Symbol("ion.namedWorkloadClients");function T0($,Z){let Q=U$($,Z);return{isReady:Q.isReady,ready:Q.ready}}function P3($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...T0(`workload client "${$}"`,()=>!1),getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[q1]:"unavailable"}}function L8($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it is no longer configured on this Ionite instance.`)};return{...T0(`workload client "${$}"`,()=>!1),getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[q1]:"removed"}}function q3($){if(!$)return"removed";return $[q1]??"available"}function j1($,Z,Q){let X=$,Y=X,J=new Set;for(let G of Q){if(J.add(G),G in Y)continue;let z=Z[G];Y[G]=z?R3(z):P3(G)}return Object.defineProperty(Y,E8,{value:J,enumerable:!1,configurable:!0}),X}function N8($){if(!$)return[];let Z=$[E8];return Z?Array.from(Z):[]}function T3($,Z,Q){let X=Z,Y=b$(Q,`Workload client "${$}"`),J=()=>q3(X)==="available",G=U$(`Workload client "${$}"`,J);return{api:{beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:G.isReady,ready:G.ready,getToken:(_)=>X.getToken(_),refreshToken:(_)=>X.refreshToken(_),generateJWTAssertion:(_)=>X.generateJWTAssertion(_),revokeToken:(_)=>X.revokeToken(_)},update(_){if(_===X)return;Y.emitBefore(),X=_,G.refresh(),Y.emitAfter()}}}function R8($){let Z,Q=!1,X=U$("Workload module",()=>Q),Y=b$($,"Workload"),J=new Map,G=new Set,z=new Set(["beforeChange","afterChange","isReady","ready"]),_=(V)=>{if(!Z)throw Error(`${V} is unavailable because workload is not configured on this Ionite instance.`);return Z},B={beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:X.isReady,ready:X.ready,get config(){return Z?.config??{}},getToken(...V){return _("getToken").getToken(...V)},refreshToken(V){return _("refreshToken").refreshToken(V)},generateJWTAssertion(V){return _("generateJWTAssertion").generateJWTAssertion(V)},revokeToken(V){return _("revokeToken").revokeToken(V)},validateToken(V){return _("validateToken").validateToken(V)},getWorkloadIdentity(V){return _("getWorkloadIdentity").getWorkloadIdentity(V)},parseJWT(V){return _("parseJWT").parseJWT(V)},handler(V){return _("handler").handler(V)}},H=(V)=>{for(let q of G)delete B[q];if(G.clear(),!V)return;let x=new Set(N8(V)),T=new Set([...z,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...x]);for(let[q,I]of Object.entries(V)){if(T.has(q))continue;B[q]=I,G.add(q)}},D=(V)=>{let x=J.get(V);if(x)return x;let T=T3(V,L8(V),$);if(J.set(V,T),!(V in B))B[V]=T.api;return T};return{update(V){if(!V&&!Q&&J.size===0)return;Y.emitBefore(),Q=V!==void 0,X.refresh(),Z=V;let x=new Set(N8(V));for(let T of x){let q=V[T];D(T).update(q)}for(let[T,q]of J){if(x.has(T))continue;q.update(L8(T))}return H(V),Y.emitAfter(),B}}}async function E1($,Z,Q){if($===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let X=Q[$];if(!X)throw Error(`Unknown workload client: ${$}`);return X.getToken(Z)}function R1($,Z){return`${$}|${Z??""}`}function i$($,Z,Q,X,Y){let J={jwtAssertionClaims:$?.jwtAssertionClaims??O3("server"),tokenResponse:$?.tokenResponse??L3("server")},G=async(F,K)=>{let N=F;if(typeof N.validate==="function")return N.validate(K);return F["~standard"].validate(K)};if(!Q&&!X)return;if(Q&&A8(Q)){let F=Q.incoming,K=W8(F),N=Array.isArray(F)?E3(F):F,S=N1(X),y=A1(X),i=N?{...N,...S,jwksUri:N.jwksUri,issuer:N.issuer}:S;if(!i||!i.tokenUrl&&!i.jwksUri)Z.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let d=i&&(i.tokenUrl||i.jwksUri)?i$($,Z,N??void 0,S,K):void 0,$$=Array.from(new Set([...Object.keys(Q.outgoing??{}),...Object.keys(y)])).map((_$)=>[_$,{...Q.outgoing?.[_$]??{},...y[_$]??{}}]),t={};for(let[_$,Z0]of $$){let m$=i$($,Z,Z0,void 0);if(m$)t[_$]=m$}if(!d&&Object.keys(t).length===0)return;let F$={...d?.config??{},config:d?.config??{},...T0("workload",()=>d?.isReady()===!0||Object.values(t).some((_$)=>_$.isReady())),getToken:async(_$,Z0)=>E1(_$,Z0,t),getServerToken:async(_$)=>{if(!d)throw Error("No server workload config");return d.getToken(_$)},refreshToken:async(_$)=>{if(!d)throw Error("No default workload config");return d.refreshToken(_$)},generateJWTAssertion:async(_$)=>{if(!d)throw Error("No default workload config");return d.generateJWTAssertion(_$)},revokeToken:async(_$)=>{if(!d)throw Error("No default workload config");return d.revokeToken(_$)},validateToken:async(_$)=>{if(!d)throw Error("No default workload config");return d.validateToken(_$)},getWorkloadIdentity:async(_$)=>{if(!d)return;return d.getWorkloadIdentity(_$)},parseJWT:async(_$)=>{if(!d)throw Error("No default workload config");return d.parseJWT(_$)},handler:async(_$)=>{if(!d)return D$();return d.handler(_$)}};return j1(F$,t,$$.map(([_$])=>_$))}if(Q&&j3(Q)){let F=N1(X),K=A1(X),N=Q.default,S=N?{...N,...F,jwksUri:N.jwksUri,issuer:N.issuer}:F;if(!S||!S.tokenUrl&&!S.jwksUri)Z.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let y=S&&(S.tokenUrl||S.jwksUri)?i$($,Z,N??void 0,F):void 0,i=Array.from(new Set([...Object.keys(Q).filter((t)=>t!=="default"),...Object.keys(K)])).map((t)=>[t,{...t in Q?Q[t]:{},...K[t]??{}}]),d={};for(let[t,F$]of i){let _$=i$($,Z,F$,void 0);if(_$)d[t]=_$}if(!y&&Object.keys(d).length===0)return;let $$={...y?.config??{},config:y?.config??{},...T0("workload",()=>y?.isReady()===!0||Object.values(d).some((t)=>t.isReady())),getToken:async(t,F$)=>E1(t,F$,d),getServerToken:async(t)=>{if(!y)throw Error("No server workload config");return y.getToken(t)},refreshToken:async(t)=>{if(!y)throw Error("No default workload config");return y.refreshToken(t)},generateJWTAssertion:async(t)=>{if(!y)throw Error("No default workload config");return y.generateJWTAssertion(t)},revokeToken:async(t)=>{if(!y)throw Error("No default workload config");return y.revokeToken(t)},validateToken:async(t)=>{if(!y)throw Error("No default workload config");return y.validateToken(t)},getWorkloadIdentity:async(t)=>{if(!y)return;return y.getWorkloadIdentity(t)},parseJWT:async(t)=>{if(!y)throw Error("No default workload config");return y.parseJWT(t)},handler:async(t)=>{if(!y)return D$();return y.handler(t)}};return j1($$,d,i.map(([t])=>t))}let z=N1(X),_=A1(X);if(!Q&&Object.keys(_).length>0){let F={};for(let[S,y]of Object.entries(_)){let i=i$($,Z,y,void 0);if(i)F[S]=i}let K=z&&(z.tokenUrl||z.jwksUri)?i$($,Z,z,void 0):void 0;if(!K&&Object.keys(F).length===0)return;let N={...K?.config??{},config:K?.config??{},...T0("workload",()=>K?.isReady()===!0||Object.values(F).some((S)=>S.isReady())),getToken:async(S,y)=>E1(S,y,F),getServerToken:async(S)=>{if(!K)throw Error("No server workload config");return K.getToken(S)},refreshToken:async(S)=>{if(!K)throw Error("No default workload config");return K.refreshToken(S)},generateJWTAssertion:async(S)=>{if(!K)throw Error("No default workload config");return K.generateJWTAssertion(S)},revokeToken:async(S)=>{if(!K)throw Error("No default workload config");return K.revokeToken(S)},validateToken:async(S)=>{if(!K)throw Error("No default workload config");return K.validateToken(S)},getWorkloadIdentity:async(S)=>{if(!K)return;return K.getWorkloadIdentity(S)},parseJWT:async(S)=>{if(!K)throw Error("No default workload config");return K.parseJWT(S)},handler:async(S)=>{if(!K)return D$();return K.handler(S)}};return j1(N,F,Object.keys(_))}let B=Q,H=Y??W8(B),D=z?.tokenUrl,V=D?.startsWith("/")?D:void 0,x=B?.idpTokenUrl??z?.idpTokenUrl??(B?.tokenUrl&&(B.tokenUrl.startsWith("http://")||B.tokenUrl.startsWith("https://"))?B.tokenUrl:void 0),T={...B,...z,tokenUrl:V??z?.tokenUrl??B?.tokenUrl,idpTokenUrl:x,jwksUri:B?.jwksUri,issuer:B?.issuer};T._handlerTokenUrl=V;let q,I=T,O=E$(T),E=f$(T),M=L1(T);if(!O&&!E&&!M){if(!B||Object.keys(B).length===0)return;throw Z.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(T),clientId:I.clientId,clientSecret:I.clientSecret?"[REDACTED]":void 0,workloadId:I.workloadId,privateKey:I.privateKey?"[REDACTED]":void 0,jwksUri:I.jwksUri,tokenUrl:I.tokenUrl,idpTokenUrl:I.idpTokenUrl,fromVaultKeys:B?Object.keys(B):[],fromCodeKeys:X?Object.keys(X):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(O)q={...T,tokenUrl:T.tokenUrl,idpTokenUrl:S$(T.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:S$(T.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:S$(T.privateKey,"Missing 'privateKey' from Workload Config"),audience:S$(T.audience,"Missing 'audience' from Workload Config"),scope:T.scope??"",algorithm:T.algorithm??"RS256",tokenLifetime:T.tokenLifetime??300,refreshThreshold:T.refreshThreshold??60,autoRefresh:T.autoRefresh!==void 0?T.autoRefresh:!0,tokenStore:T.tokenStore??new Q0};else if(f$(T))q={...T,tokenUrl:T.tokenUrl,idpTokenUrl:S$(T.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:S$(T.clientId,"Missing 'clientId' from Workload Config"),clientSecret:S$(T.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:T.scope??"",tokenLifetime:T.tokenLifetime??300,refreshThreshold:T.refreshThreshold??60,autoRefresh:T.autoRefresh!==void 0?T.autoRefresh:!0,tokenStore:T.tokenStore??new Q0};else if(L1(T))q=T;function R(){let F=new Uint8Array(16);return crypto.getRandomValues(F),Array.from(F,(K)=>K.toString(16).padStart(2,"0")).join("")}function f(F){let K;if(typeof F==="string")K=btoa(F);else K=btoa(String.fromCharCode(...F));return K.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function g(F){let K=F.replace(/-/g,"+").replace(/_/g,"/");while(K.length%4)K+="=";return atob(K)}function a(F){if(F.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:F==="RS256"?"SHA-256":F==="RS384"?"SHA-384":"SHA-512"};else if(F.startsWith("ION"))return{name:"ECDSA",namedCurve:F==="ES256"?"P-256":F==="ES384"?"P-384":"P-521",hash:F==="ES256"?"SHA-256":F==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${F}`)}async function X$(F,K){let N=F.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),S=Uint8Array.from(atob(N),(i)=>i.charCodeAt(0)),y=a(K);return crypto.subtle.importKey("pkcs8",S,y,!1,["sign"])}async function e(F,K,N){let S=await X$(K,N),i=new TextEncoder().encode(F),d=a(N),$$=await crypto.subtle.sign(d,S,i);return f(new Uint8Array($$))}async function n(F,K=3,N=1000,S=30000){let y=Error("Placeholder Error");for(let i=0;i<=K;i++)try{return await F()}catch(d){if(y=d instanceof Error?d:Error(String(d)),y.message.includes("400")||y.message.includes("401")||y.message.includes("403")||y.message.includes("404"))throw y;if(i<K){let $$=Math.min(N*2**i,S),t=Math.random()*$$*0.1;await new Promise((F$)=>setTimeout(F$,$$+t))}}throw y}async function r(F){if(!E$(q))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let K=q,N=Math.floor(Date.now()/1000),S={iss:K.workloadId,sub:K.workloadId,aud:K.audience??"",exp:N+K.tokenLifetime,iat:N,jti:R(),scope:F??K.scope},y={alg:K.algorithm,typ:"JWT",kid:K.keyId},i=f(JSON.stringify(y)),d=f(JSON.stringify(S)),$$=`${i}.${d}`,t=await e($$,K.privateKey,K.algorithm);return`${$$}.${t}`}async function Q$(F){if(!E$(q))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let K=q;return n(async()=>{let N=K.idpTokenUrl,S=await r(F),y=new URLSearchParams;if(y.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),y.append("assertion",S),F)y.append("scope",F);let i=await fetch(N,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:y.toString()}),d=await i.json();if(!i.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:d});let t=d;throw Error(`Token acquisition failed: ${t.error||i.statusText} - ${t.error_description||""}`.trim())}let $$=await G(J.tokenResponse,d);if($$.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:$$.issues}),Error(`Token response validation failed: ${$$.issues.map((t)=>t.message).join("; ")}`);if(K.tokenStore){let t=new Date(Date.now()+($$.value.expires_in??300)*1000),F$={workload_id:R1(K.workloadId,F),access_token:$$.value.access_token,token_type:$$.value.token_type,scope:$$.value.scope,expires_at:t,created_at:new Date,refresh_token:$$.value.refresh_token};await K.tokenStore.set(F$)}return $$.value})}async function A(F){if(!f$(q))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let K=q;return n(async()=>{let N=K.idpTokenUrl,S=new URLSearchParams;if(S.append("grant_type","client_credentials"),S.append("client_id",K.clientId),S.append("client_secret",K.clientSecret),F)S.append("scope",F);let y=await fetch(N,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:S.toString()}),i=await y.json();if(!y.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:i});let $$=i;throw Error(`Token acquisition failed: ${$$.error||y.statusText} - ${$$.error_description||""}`.trim())}let d=await G(J.tokenResponse,i);if(d.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:d.issues}),Error(`Token response validation failed: ${d.issues.map(($$)=>$$.message).join("; ")}`);if(K.tokenStore){let $$=new Date(Date.now()+(d.value.expires_in??300)*1000),t={workload_id:R1(K.clientId,F),access_token:d.value.access_token,token_type:d.value.token_type,scope:d.value.scope,expires_at:$$,created_at:new Date,refresh_token:d.value.refresh_token};await K.tokenStore.set(t)}return d.value})}let W=new Map;function L(F,K){let N=W.get(F);if(N)return N;let S=(async()=>{return(E$(q)?await Q$(K??""):await A(K??"")).access_token})();return W.set(F,S),S.catch(()=>{return}).finally(()=>{if(W.get(F)===S)W.delete(F)}),S}async function k(F){if(!E$(q)&&!f$(q)){let y=q;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!y.clientId}, hasClientSecret=${!!y.clientSecret}, hasWorkloadId=${!!y.workloadId}, hasPrivateKey=${!!y.privateKey}, hasJwksUri=${!!y.jwksUri}`)}let K=q;F=F??K.scope;let N=E$(q)?q.workloadId:q.clientId,S=R1(N,F);if(K.tokenStore){let y=await K.tokenStore.get(S);if(y){let i=Date.now(),d=y.expires_at.getTime(),$$=K.refreshThreshold*1000;if(i+$$<d)return y.access_token;if(K.autoRefresh)try{return await L(S,F)}catch(t){if(i<d)return Z.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},t),y.access_token;throw t}}}return L(S,F)}async function w(F){if(!E$(q)&&!f$(q))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let K=q;return F=F??K.scope,E$(K)?await Q$(F):await A(F)}async function b(F){if(!E$(q)&&!f$(q))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let K=q;try{if(!q.revocationEndpoint)return;let N=new URLSearchParams;if(N.append("token",F),N.append("token_type_hint","access_token"),E$(q)){let y=q;N.append("client_id",y.workloadId)}else if(f$(q)){let y=q;N.append("client_id",y.clientId),N.append("client_secret",y.clientSecret)}let S=await fetch(q.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:N.toString()});if(!S.ok)Z.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:S.status,statusText:S.statusText});else Z.info("Token revoked successfully",{"ion.module":"workload"});if(q.tokenStore){let y;if(E$(q))y=q.workloadId;else if(f$(q))y=q.clientId;else return;await q.tokenStore.delete(y)}}catch(N){Z.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},N)}}async function u(F,K){let N=F??q?.jwksUri;if(!N)throw Error("No JWKS URI configured in Workload Config");return await A3(N,Z,K)}async function c(F,K){let N=K??q?.jwksUri;if(!N)throw Error("No JWKS URI configured in Workload Config");let S=E$(q)?q.algorithm:"RS256";return N3(N,F,`wl:${S}`,(y)=>{let i=y.alg||S,d=a(i);return crypto.subtle.importKey("jwk",y,d,!1,["verify"])},Z)}function o(F){let K=F.split(".");if(K.length!==3)throw Error("Invalid JWT");return JSON.parse(g(K[1]))}async function Y$(F,K){try{let N=F.split(".");if(N.length!==3)throw Error("Invalid JWT");let S=JSON.parse(g(N[0])),y=JSON.parse(g(N[1])),i=await c(S.kid,K),d=N[2],t=new TextEncoder().encode(`${N[0]}.${N[1]}`),F$=Uint8Array.from(g(d),(C0)=>C0.charCodeAt(0)),_$=a(S.alg);if(!await crypto.subtle.verify(_$,i,F$,t))throw Error("Invalid JWT signature");let m$=await G(J.jwtAssertionClaims,y);if(m$.issues)throw Z.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:m$.issues}),Error(`JWT claims validation failed: ${m$.issues.map((C0)=>C0.message).join("; ")}`);return m$.value}catch(N){throw Z.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},N),N}}async function G$(F){if(!E$(q)&&!f$(q)&&!L1(q))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(H.length>0){let S=o(F),y=typeof S.iss==="string"?S.iss:void 0,i=O8(H,y);if(!i)return{valid:!1,error:"Untrusted token issuer"};let d=await Y$(F,i.jwksUri),$$=Math.floor(Date.now()/1000);if(d.exp&&d.exp<$$)return{valid:!1,error:"Token expired"};let t=P1(i.audience);if(t.length>0&&!P4(d.aud,t,d.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:d,expiresAt:d.exp?new Date(d.exp*1000):void 0}}let K=await Y$(F),N=Math.floor(Date.now()/1000);if(K.exp&&K.exp<N)return{valid:!1,error:"Token expired"};if(E$(q)){if(q.audience&&!P4(K.aud,[q.audience],K.azp))return{valid:!1,error:"Invalid audience"}}else if(f$(q)){if(q.issuer&&q0(K.iss)!==q0(q.issuer))return{valid:!1,error:"Invalid issuer"};if(q.audience&&!P4(K.aud,[q.audience],K.azp))return{valid:!1,error:"Invalid audience"}}else{let S=q;if(S.issuer&&q0(K.iss)!==q0(S.issuer))return{valid:!1,error:"Invalid issuer"};if(S.audience&&!P4(K.aud,[S.audience],K.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:K,expiresAt:K.exp?new Date(K.exp*1000):void 0}}catch(K){return{valid:!1,error:K instanceof Error?K.message:String(K)}}}function s(F,K){let N=F[K];return typeof N==="string"&&N.trim()?N.trim():void 0}function z$(F){if(!F)return;return F.startsWith("service-account-")?F.slice(16):F}function H$(F){return s(F,"client_id")??s(F,"clientId")??s(F,"azp")??s(F,"appid")??z$(s(F,"preferred_username"))}let K$=new WeakMap;function j(F){let K=K$.get(F);if(K)return K;let N=h(F);return K$.set(F,N),N}async function h(F){let K=F.headers.get("Authorization");if(!K?.startsWith("Bearer "))return;let N=K.substring(7),S=await G$(N);if(!S.valid||!S.claims)return;let y=H.length>0?O8(H,S.claims.iss):void 0,i=S.claims.ecid,d={workloadId:S.claims.sub,clientId:H$(S.claims),scope:S.claims.scope,scopesAsEntitlements:y?.scopesAsEntitlements,...i!==void 0&&i!==null?{ecid:F8(i)}:{},claims:S.claims},$$=q?.workloadIdentityStore;if($$){let t=d.clientId??d.workloadId??d.claims.sub,F$=t?await $$.get(t):void 0;if(F$){if(F$.active===!1)return;if(F$.scopes?.length){let _$=new Set([...(d.scope??"").split(/\s+/).filter(Boolean),...F$.scopes]);d.scope=Array.from(_$).join(" ")}if(!d.ecid&&F$.ecid)d.ecid=F8(F$.ecid)}}return d}async function P(F){if(!q)throw Error("ionite Workload Manager not initialized");let K=new URL(F.url).pathname,N=(i)=>{if(!i)return;try{return new URL(i).pathname}catch{return i.startsWith("/")?i:`/${i}`}};if(N(q.validateUrl)===K&&F.method==="POST"){let i=F.headers.get("Authorization");if(!i?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let d=i.substring(7),$$=await G$(d);if(!$$.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:$$.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(N(q.jwksUrl)===K&&F.method==="GET"){let i=await u();return new Response(JSON.stringify(i),{headers:[["Content-Type","application/json"]]})}return D$()}return{...q,...T0("workload",()=>!0),getToken:k,refreshToken:w,generateJWTAssertion:r,revokeToken:b,validateToken:G$,getWorkloadIdentity:j,parseJWT:Y$,handler:P}}function T1($){return $=$??"Workload authentication unavailable",new Response(JSON.stringify({error:$}),{status:503,statusText:$,headers:{"Content-Type":"application/json"}})}var q4="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",I3="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function x3($,Z){S$(Z,q4);let Q=Z.workload;if(!Q)return;return Q.getWorkloadIdentity($)}async function w3($,Z,Q){S$(Z,q4);let X=Z.workload;if(!X)throw T1();let Y=X;if(typeof Y.getServerToken!=="function"||typeof Y.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return Y.getToken($,Q)}async function I1($,Z){S$(Z,I3);let Q="validateToken"in Z&&typeof Z.validateToken==="function"?Z:Z.workload;if(!Q)return{valid:!1,error:"Workload authentication unavailable"};let X=$.headers.get("Authorization");if(!X?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let Y=X.substring(7);return Q.validateToken(Y)}async function S3($,Z){S$(Z,q4);let Q=Z.workload;if(!Q)throw T1();return Q.revokeToken($)}async function C3($,Z){S$(Z,q4);let Q=Z.workload;if(!Q)throw T1();return Q.handler($)}function P8($){try{return I4(new URL($,"http://dummy").pathname)}catch{let Z=$.startsWith("/")?$:`/${$}`;return I4(Z)}}function v3($,Z){let Q=new URL($.url);return new URL(`/${encodeURIComponent(Z)}/`,Q.origin).toString()}function h3($,Z){let Q=P8(Z),X=I4($);if(X===Q)return null;if(!X.startsWith(`${Q}/`))return null;let Y=X.slice(Q.length+1);if(!Y||Y.includes("/"))return null;return decodeURIComponent(Y)}function T4($){return $==="pending"||$==="processing"||$==="completed"||$==="failed"||$==="action_required"}function f3($){if(!T4($.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if($.status==="completed"){if(!$.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:$.tenantUrl,status:"completed"},status:201}}if($.status==="pending"||$.status==="processing")return{body:{tenantUrl:$.tenantUrl,status:$.status},status:202};if($.status==="action_required"){if(!$.actionUrl||!$.requestToken||!$.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:$.actionUrl,requestToken:$.requestToken,expiresAt:$.expiresAt},status:200}}return{body:{tenantUrl:$.tenantUrl,status:"failed",error:$.error??"Tenant provisioning failed"},status:409}}function m3($,Z){let Q=Z.validators.tenant.createTenantRequest,X=Z.validators.tenant.updateTenantRequest;function Y(B,H){let D=(V)=>new URL(V,H).toString();return{readyzUrl:D(B.readyzUrl),capabilitiezUrl:D(B.capabilitiezUrl),sso:{loginUrl:D(B.sso.loginUrl),userUrl:D(B.sso.userUrl),logoutUrl:D(B.sso.logoutUrl),logoutBackChannelUrl:D(B.sso.logoutBackChannelUrl),refreshUrl:D(B.sso.refreshUrl),callbackUrl:D(B.sso.callbackUrl)},workload:{validateUrl:D(B.workload.validateUrl),jwksUrl:D(B.workload.jwksUrl)},iam:{basePath:D(B.iam.basePath),usersUrl:D(B.iam.usersUrl),groupsUrl:D(B.iam.groupsUrl)},ciam:{magicLinkUrl:D(B.ciam.magicLinkUrl),magicLinkLoginUrl:D(B.ciam.magicLinkLoginUrl),customerUrl:D(B.ciam.customerUrl),customerLoginUrl:D(B.ciam.customerLoginUrl),customerCallbackUrl:D(B.ciam.customerCallbackUrl),customerProvidersUrl:D(B.ciam.customerProvidersUrl),logoutUrl:D(B.ciam.logoutUrl)}}}function J(B,H){let D=Z.tenantIonBasePath?.(B);if(!D)return;let V=new URL(H.url).origin,x=Y(g$(D),V);return{callbackUrl:x.sso.callbackUrl,ionUrls:x}}async function G(B){let H=await I1(B,Z.workloadAuth??$);if(!H.valid)return Response.json({error:H.error??"Unauthorized"},{status:401});return B0(B,$,b3["tenant.manage"])}async function z(B){let D=new URL(B.url).pathname,V=h3(D,Z.basePath),x=P8(Z.basePath),T=I4(D)===x;if(!T&&!V)return D$();if(!["GET","PUT","POST","DELETE"].includes(B.method))return A0(["GET","PUT","POST","DELETE"]);if(B.method==="GET"&&T&&V==null)return D$();let q=await G(B);if(q)return q;if(B.method==="GET"){if(V==null)return D$();let n=await Z.store.get(V);if(!n)return D$();let r=J(n,B);return Response.json(r?{...n,...r}:n,{status:200})}if(B.method==="DELETE"){if(!V)return D$();let n=await Z.store.get(V);if(n)await Z.mirror?.purge(n.id);return await Z.store.delete(V),new Response(null,{status:204})}if(!V&&B.method!=="POST")return D$();let I;try{I=await B.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let O=B.method==="POST",E=O?await Q.validate(I):await X.validate(I);if(E.issues)return y3(E.issues,O?"Tenant create validation failed":"Tenant update validation failed");let M=O?E.value.id:V;if(!M)return D$();if(V!=null&&E.value.id!=null&&E.value.id!==V)return Response.json({error:"Path id must match body id"},{status:400});let R=await Z.store.get(M);if(R&&!T4(R.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let f=new Date,g=R??{},a;if(O){let n=E.value,r=n,Q$=r.status,A=T4(Q$)?Q$:R?.status??"completed";a={...g,...n,id:M,companyId:n.companyId,companyName:n.companyName,environmentType:n.environmentType,configLocator:n.configLocator,email:n.email??R?.email,webhookUrl:n.webhookUrl??R?.webhookUrl,callbackUrl:n.callbackUrl??R?.callbackUrl,tenantUrl:r.tenantUrl??R?.tenantUrl,status:A,error:r.error??R?.error,actionUrl:r.actionUrl??R?.actionUrl,requestToken:r.requestToken??R?.requestToken,expiresAt:r.expiresAt??R?.expiresAt,createdAt:R?.createdAt??f,updatedAt:f}}else{let n=E.value,r=n,Q$=r.status,A=T4(Q$)?Q$:R?.status??"completed",{configLocator:W,...L}=n;a={...g,...L,id:M,companyId:n.companyId??R?.companyId??"",companyName:n.companyName??R?.companyName??"",environmentType:n.environmentType??R?.environmentType??"DEV",email:n.email??R?.email,webhookUrl:n.webhookUrl??R?.webhookUrl,callbackUrl:n.callbackUrl??R?.callbackUrl,tenantUrl:r.tenantUrl??R?.tenantUrl,status:A,error:r.error??R?.error,actionUrl:r.actionUrl??R?.actionUrl,requestToken:r.requestToken??R?.requestToken,expiresAt:r.expiresAt??R?.expiresAt,configLocator:W??R?.configLocator,createdAt:R?.createdAt??f,updatedAt:f}}if(!a.tenantUrl)a.tenantUrl=v3(B,M);if(!a.callbackUrl){let n=J(a,B);if(n)a.callbackUrl=n.callbackUrl}if(R?.configLocator&&!k3(R.configLocator,a.configLocator))await Z.mirror?.purge(R.id);let X$=await Z.store.upsert(a),e=f3(X$);if(e instanceof Response)return e;return Response.json(e.body,{status:e.status})}async function _(B){try{if(!$.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await z(B)}catch(H){return N0(H)}}return{handler:_,getTenant:async(B)=>{return Z.store.get(B)}}}var x1="0.0.23";export*from"@ionite/core";import{generateULID as JJ,IoniteError as GJ,listGenerator as zJ}from"@ionite/core";import{allowHosts as BJ,allowOrigins as HJ,allowRelativePaths as KJ,allowSameOrigin as DJ,blockDangerousUrls as VJ,CatalogAdjacencyCache as UJ,callback as FJ,captureRedirect as MJ,ciam as WJ,collectReferencedDefinitions as OJ,defaultRedirectPolicies as LJ,discoverSessionRecords as NJ,discoverSessions as AJ,expandRoot as jJ,getCustomer as EJ,getUser as RJ,has as PJ,hasAll as qJ,hasAllScope as TJ,hasAny as IJ,hasAnyScope as xJ,hasGroup as wJ,hasPermission as SJ,hasRole as CJ,hasScope as kJ,InMemoryTenantStore as bJ,iam as yJ,initiateLogin as vJ,isRedirectAllowed as hJ,listSsoClientIdsFromCookies as fJ,reconcileSubjectAccess as mJ,resolveAfterRedirect as gJ,resolveCapturedRedirect as pJ,resolveRedirect as dJ,sameOriginRedirectRules as uJ,sendTenantWebhook as lJ,sso as cJ,verifyUser as iJ,withSetCookies as nJ}from"@ionite/core/server";import{accessRefId as $0,accessRootId as q8,assertRequiredSubjectType as T8,list as g3}from"@ionite/core";function S1($){let{createdAt:Z,updatedAt:Q,...X}=$;return X}class n${roots=new Map;byTarget=new Map;bySubject=new Map;static targetKey($,Z){return`${$}:${Z}`}static subjectKey($,Z){return`${$}:${Z}`}indexAdd($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}indexRemove($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}deindex($){this.indexRemove(this.byTarget,n$.targetKey($.targetType,$0($.target)),$.id),this.indexRemove(this.bySubject,n$.subjectKey($.subjectType,$0($.subject)),$.id)}index($){this.indexAdd(this.byTarget,n$.targetKey($.targetType,$0($.target)),$.id),this.indexAdd(this.bySubject,n$.subjectKey($.subjectType,$0($.subject)),$.id)}resolve($,Z){if(!$)return[];let Q=[];for(let X of $){let Y=this.roots.get(X);if(Y&&(Y.status??"active")==="active"&&Z(Y))Q.push(Y)}return Q}async grant($){T8($.subjectType,"Access change subjectType");let Z=$.id??q8($),Q=new Date,X=this.roots.get(Z);if(X)this.deindex(X);let Y={...$,id:Z,status:$.status??"active",createdAt:X?.createdAt??Q,updatedAt:Q};this.roots.set(Z,Y),this.index(Y)}async revoke($){let Z=$.id??q8($),Q=this.roots.get(Z);if(Q)this.deindex(Q);this.roots.delete(Z)}async get($){let Z=this.roots.get($);return Z?S1(Z):void 0}async list($){let Z=Array.from(this.roots.values()).filter((Q)=>(Q.status??"active")==="active");return w1(Z,$)}async listByTarget($,Z,Q){let X=Z.trim(),Y=this.byTarget.get(n$.targetKey($,X)),J=this.resolve(Y,(G)=>G.targetType===$&&$0(G.target)===X);return w1(J,Q)}async listByTargets($){let Z=new Map;for(let{targetType:Q,target:X}of $){let Y=`${Q}:${X}`;if(Z.has(Y))continue;let J=X.trim(),G=this.byTarget.get(n$.targetKey(Q,J)),z=this.resolve(G,(_)=>_.targetType===Q&&$0(_.target)===J);Z.set(Y,z.map((_)=>S1(_)))}return Z}async listBySubject($,Z,Q){T8(Z);let X=$0($),Y=this.bySubject.get(n$.subjectKey(Z,X)),J=this.resolve(Y,(G)=>G.subjectType===Z&&$0(G.subject)===X);return w1(J,Q)}}function w1($,Z){let Q=Math.max(0,Z?.start??0),X=Z?.limit,Y=X!=null?Q+X:void 0;return g3($.length,$.slice(Q,Y).map(S1),Q,X)}import{assertValidSubjectTypeScoping as I8,deepEqualPlain as p3,list as x8,readyCatalogEntry as C1}from"@ionite/core";class w8{listeners=new Set;emit=($)=>{for(let Z of this.listeners)Z($)};groups=new x4("group",this.emit);roles=new x4("role",this.emit);permissions=new x4("permission",this.emit);afterChange($){return this.listeners.add($),()=>{this.listeners.delete($)}}}class S8{items=new Map;listeners=new Set;async get($){return this.items.get($)}async list($){let Z=Array.from(this.items.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=X!=null?Q+X:void 0;return x8(Z.length,Z.slice(Q,Y),Q,X)}async children($){return Array.from(this.items.values()).filter((Z)=>{return(typeof Z.parent==="string"?Z.parent:Z.parent?.id)===$})}changed($){return this.listeners.add($),()=>{this.listeners.delete($)}}set($){this.items.set($.id,$),this.emitChange({id:$.id})}delete($){if(!this.items.delete($))return;this.emitChange({id:$,deleted:!0})}emitChange($){for(let Z of this.listeners)Z($)}}class x4{kind;emit;items=new Map;constructor($,Z){this.kind=$;this.emit=Z}async get($){return this.items.get($)}set($){I8($);let Z=this.items.get($.id),Q=!Z||!p3(Z,$);if(this.items.set($.id,$),Q)this.emit({op:"set",kind:this.kind,entity:$,previous:Z});return C1($,Promise.resolve())}insertIfAbsent($){I8($);let Z=this.items.get($.id);if(Z)return C1(Z,Promise.resolve());return this.items.set($.id,$),this.emit({op:"set",kind:this.kind,entity:$,previous:void 0}),C1($,Promise.resolve())}async delete($){let Z=this.items.get($);if(!Z)return;this.items.delete($),this.emit({op:"delete",kind:this.kind,entity:Z})}async list($){let Z=Array.from(this.items.values()),Q=$?.filter?.requestable;if(Q!==void 0)Z=Z.filter((G)=>Boolean(G.requestable)===Q);let X=Math.max(0,$?.start??0),Y=$?.limit,J=Y!=null?X+Y:void 0;return x8(Z.length,Z.slice(X,J),X,Y)}}import{accessRefId as s$,assertRequiredSubjectType as I0}from"@ionite/core";function a$($,Z){return`${Z}:${$}`}function k1($,Z,Q){return`${$}:${Z}:${Q}`}function d3($,Z,Q,X){return`${k1($,Z,Q)}:${X??""}`}class C8{rows=new Map;byTriple=new Map;byRoot=new Map;bySubject=new Map;edgeMeta=new Map;disabledSubjects=new Set;async has($,Z,Q,X,Y){I0(Y);let J=s$($),G=s$(Q);if(!J||!G)return{allow:!1};if(this.disabledSubjects.has(a$(J,Y)))return{allow:!1,metadata:{reason:"subject_disabled"}};let z=k1(a$(J,Y),Z,G),_=X?s$(X):void 0;if(_===void 0){let D=this.byTriple.get(z);if(D&&D.size>0)return this.allow(J,Y,Z,G,void 0);return{allow:!1}}let B=`${z}:${_}`,H=`${z}:`;if(this.rows.has(B))return this.allow(J,Y,Z,G,_);if(this.rows.has(H))return this.allow(J,Y,Z,G,void 0);return{allow:!1}}async hasGroup($,Z,Q,X){return this.has($,"group",Z,Q,X)}async hasRole($,Z,Q,X){return this.has($,"role",Z,Q,X)}async hasPermission($,Z,Q,X){return this.has($,"permission",Z,Q,X)}async hasAny($,Z,Q){for(let X of Z){let Y=await this.has($,X.targetType,X.target,X.resource,Q);if(Y.allow)return Y}return{allow:!1}}async hasAll($,Z,Q){if(this.disabledSubjects.has(a$(s$($),Q)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(Z.length===0)return{allow:!0};let X=[];for(let Y of Z){let J=await this.has($,Y.targetType,Y.target,Y.resource,Q);if(!J.allow)return{allow:!1,matched:X};if(J.matched)X.push(...J.matched)}return{allow:!0,matched:X}}async materialize($,Z){this.removeRoot($),this.addRootEdges($,Z)}async replaceSubject($,Z,Q){let X=a$(s$($),Z),Y=new Map;for(let J of Q){I0(J.subjectType,"Effective edge subjectType");let G=a$(s$(J.subject),J.subjectType);if(G!==X)throw Error(`AccessIndex.replaceSubject received an edge for ${G}; expected ${X}.`);let z=Y.get(J.rootId);if(z)z.push(J);else Y.set(J.rootId,[J])}this.clearSubjectEdges(X);for(let[J,G]of Y)this.addRootEdges(J,G)}addRootEdges($,Z){let Q=new Set;for(let X of Z){I0(X.subjectType,"Effective edge subjectType");let Y=a$(X.subject,X.subjectType),J=k1(Y,X.targetType,X.target),G=d3(Y,X.targetType,X.target,X.resource);this.addToSet(this.rows,G,$),this.addToSet(this.byTriple,J,G),this.addToSet(this.bySubject,Y,G),this.edgeMeta.set(G,{triple:J,subjectId:Y}),Q.add(G)}if(Q.size>0)this.byRoot.set($,Q)}async removeByRoot($){this.removeRoot($)}removeRoot($){let Z=this.byRoot.get($);if(!Z)return;for(let Q of Z){let X=this.rows.get(Q);if(!X)continue;if(X.delete($),X.size===0)this.dropEdge(Q)}this.byRoot.delete($)}async listSubjects(){let $=[];for(let[Z,Q]of this.bySubject){if(Q.size===0)continue;let X=Z.indexOf(":");if(X<=0)throw Error(`AccessIndex subject key "${Z}" is missing a subjectType prefix.`);let Y=Z.slice(0,X);I0(Y,"AccessIndex subject key subjectType"),$.push({subjectType:Y,subject:Z.slice(X+1)})}return $}async setSubjectDisabled($,Z,Q){let X=a$(s$($),Z);if(Q)this.disabledSubjects.add(X);else this.disabledSubjects.delete(X)}async isSubjectDisabled($,Z){return I0(Z),this.disabledSubjects.has(a$(s$($),Z))}async clear($,Z){if($===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}I0(Z);let Q=s$($);this.clearSubjectEdges(a$(Q,Z))}clearSubjectEdges($){let Z=this.bySubject.get($);if(!Z)return;for(let Q of[...Z]){let X=this.rows.get(Q);if(X)for(let Y of X){let J=this.byRoot.get(Y);if(J?.delete(Q)&&J.size===0)this.byRoot.delete(Y)}this.dropEdge(Q)}}allow($,Z,Q,X,Y){return{allow:!0,matched:[{subject:$,subjectType:Z,targetType:Q,target:X,resources:Y?[Y]:void 0}]}}addToSet($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}dropEdge($){this.rows.delete($);let Z=this.edgeMeta.get($);if(Z)this.removeFromSet(this.byTriple,Z.triple,$),this.removeFromSet(this.bySubject,Z.subjectId,$);this.edgeMeta.delete($)}removeFromSet($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}}function b1($){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function u3($,Z){return{...$,subscribe:async(Q,X,Y)=>{try{return await $.subscribe(Q,X,Y)}catch(J){if(!(J instanceof w$))throw J;return await c$($,Q,X,Z,void 0,Y)}}}}function w4($){let Z=_0($.path,"path","azureConfig");K0($.ttl);let Q=$.vault??E4({type:"azure",authMethod:$.authMethod,entraTenantId:$.entraTenantId,clientId:$.clientId,clientSecret:$.clientSecret,federatedTokenFile:$.federatedTokenFile,managedIdentityClientId:$.managedIdentityClientId,imdsApiVersion:$.imdsApiVersion,vaultUrl:$.vaultUrl,vaultName:$.vaultName,apiVersion:$.apiVersion,secretNameTransform:$.secretNameTransform,secretNamePrefix:$.secretNamePrefix,scope:$.scope,ttl:$.ttl}),X=$.ttl?u3(Q,$.ttl):Q;return{load:async()=>{try{return(await X.getFullSecret(Z)).data}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`Error retrieving remote config from Azure Key Vault: ${J}`,{cause:Y})}},subscribe:(Y,J)=>{return X.subscribe(Z,(G)=>{Y(G.data)},J)},secret:X}}import{IoniteError as GQ}from"@ionite/core";function y1($){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as s3,remoteConfigSecretType as a3}from"@ionite/core";import{defaultLogger as l3,defaultSecretContentType as c3,stableConfigHash as k8}from"@ionite/core";var i3=1e4;function n3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function v1($){if($.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let Z=Array.from(new Set($.paths.map((I)=>I.trim()).filter(Boolean)));if(Z.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let Q=$.logger??l3,X=[],Y=Promise.resolve(),J=!1,G=!1,z=!1,_=U$("Secrets mirror",()=>J&&!z),B=(I)=>{let O=$.mapPath(I).trim();if(!O)throw Error(`mirrorSecrets mapPath returned an empty target for "${I}"`);return O},H=(I)=>{let O=Y.then(I);return Y=O.catch((E)=>{G=!0,Q.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:E instanceof Error?E.message:String(E)})}),O},D=async(I)=>{if(await $.to.exists(I))await $.to.deleteSecret(I)},V=async(I,O)=>{if(z)return;if(!n3(O.data))throw Error(`mirrorSecrets can only re-store object values (source path "${I}")`);if($.accept&&!$.accept(O,I))return;let E=B(I);if(await $.to.exists(E)){let M=await $.to.getSecret(E);if(k8(M)===k8(O.data)){G=!1;return}}await $.to.putSecret(E,O.data,{contentType:O.metadata.contentType??c3()}),G=!1},x=async(I)=>{await D(B(I)),G=!1},T=(I)=>{if(I.event!=="path_removed")return Z.includes(I.path)?[I.path]:[];let O=`${I.path.replace(/\/+$/g,"")}/`;return Z.filter((E)=>E===I.path||E.startsWith(O))},q=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if($.from.subscribeEvents)X.push($.from.subscribeEvents((I)=>{if(q.has(I.event)){let O=T(I);if(O.length>0)H(async()=>{for(let E of O)await x(E)})}try{$.onEvent?.(I)}catch(O){Q.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:I.path,event:I.event,error:O instanceof Error?O.message:String(O)})}}));return(async()=>{let I=new Set(Z);for(;;){try{for(let O of[...I]){let E=await $.from.subscribe(O,(M)=>{H(()=>V(O,M))},$.subscription);if(z){E();return}X.push(E),I.delete(O)}if(await Y,z)return;J=!0,_.refresh();return}catch(O){if(z)return;G=!0,Q.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:O instanceof Error?O.message:String(O)})}if(await new Promise((O)=>{setTimeout(O,i3).unref?.()}),z)return}})(),{isReady:_.isReady,ready:_.ready,isAvailable:()=>J&&!z&&!G&&($.from.isAvailable?.()??!0)&&($.to.isAvailable?.()??!0),async purge(){if(z)throw Error("Secrets mirror is closed");await H(async()=>{for(let I of Z)await x(I)})},async close(){if(z)return;z=!0;for(let I of X.splice(0))I();_.refresh(),_.settle(),await Y}}}function x0($){return typeof $.getFullSecret==="function"}function h1($){let Z=$;return typeof Z.handleDelivery==="function"&&typeof Z.handleEvents==="function"&&typeof Z.isDeliveryRequest==="function"&&typeof Z.isEventsRequest==="function"}function b8($){return $.type==="vault"&&[$.vaultLfvServerUrl,$.vaultLfvClientId,$.vaultLfvDeliveryEndpoint,$.vaultLfvVerifyJwks,$.vaultLfvEventsEndpoint].some((Z)=>Z!==void 0)}function R$($,Z){if(!$?.trim())throw Error(`Mirrored LFV config requires ${Z}`);return $}function t3($,Z){if(Z?.trim())return Z;if(x0($))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if($.type==="vault")return R$($.vaultLfvPath??$.vaultPath,"an upstream vault path");if($.type==="azure")return R$($.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${$.type}" requires an explicit fromPath`)}function r3($,Z){let Q=R$($.vaultLfvPath??$.vaultPath,"vaultLfvPath or vaultPath");return z0({lfvServerUrl:R$($.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:R$($.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:R$($.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:R$($.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:R$($.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:Q,deliveryTimeout:$.vaultLfvDeliveryTimeout,retryInterval:$.vaultLfvRetryInterval,warnInterval:$.vaultLfvWarnInterval,log:Z},void 0,{selfRedeemReads:!0})}function o3($){return $.metadata.contentType?.typeId===a3.id&&typeof $.data.id==="string"&&$.data.id.trim().length>0}function e3($,Z,Q,X){return{...$,close:Q,subscribePassive:(Y,J)=>Z.subscribePassive(Y,J),isDeliveryRequest:(Y)=>Z.isDeliveryRequest(Y),isEventsRequest:(Y)=>Z.isEventsRequest(Y),handleDelivery:(Y)=>{return X(),Z.handleDelivery(Y)},handleEvents:(Y)=>{return X(),Z.handleEvents(Y)},deliveryPath:Z.deliveryPath,eventsPath:Z.eventsPath,callbackKey:Z.callbackKey,trustId:Z.trustId}}function n0($){let Z=$.logger??s3,Q=t3($.from,$.fromPath),X=!x0($.from),Y=!x0($.to),J=x0($.from)?$.from:b8($.from)?r3($.from,Z):t$($.from).secret,G=x0($.to)?$.to:t$($.to).secret,z=R$($.path,"path"),_=f1(G,z,{ttl:$.ttl}),B,H=!1,D=!1,V,x=()=>{if(V)return;V=J.getFullSecret(Q).then(()=>{return}).catch((M)=>{V=void 0,Z.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:M instanceof Error?M.message:String(M)})})},T=(M)=>{if(H)throw Error("Mirrored ConfigSource is closed");if(!B){D=M;let R=!M&&h1(J)?{...J,subscribe:(f,g)=>J.subscribePassive(f,g)}:J;B=v1({from:R,to:G,paths:[Q],mapPath:()=>z,accept:o3,logger:Z})}else if(M&&!D)x();return B},q={isReady:()=>B?.isReady()??!1,ready:(M)=>T(!0).ready(M),isAvailable:()=>B?.isAvailable()??!1,purge:()=>T(!1).purge(),close:async()=>{await B?.close()}},I=async()=>{if(H)return;if(H=!0,await B?.close(),X)await J.close?.();if(Y)await G.close?.()},O=h1(J)?e3(G,J,I,()=>{T(!1)}):{...G,close:I},E={load:async()=>{try{let M=await _.load();return T(!1),M}catch(M){throw T(!0),M}},subscribe:(M,R)=>{return T(!1),_.subscribe(M,R)},secret:O,mirror:q,async handleCallback(M,R){if(!h1(J))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return T(!1),M==="delivery"?J.handleDelivery(R):J.handleEvents(R)}};if(Object.defineProperties(E,{log:{get:()=>_.log,set:(M)=>{_.log=M},enumerable:!0},validators:{get:()=>_.validators,set:(M)=>{_.validators=M},enumerable:!0}}),!x0($.from)&&b8($.from)){let M=$.from;E[L0]={path:Q,lfvServerUrl:R$(M.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:R$(M.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:R$(M.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:R$(M.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:R$(M.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:M.vaultLfvDeliveryTimeout,retryInterval:M.vaultLfvRetryInterval,warnInterval:M.vaultLfvWarnInterval}}return E}class D0 extends Error{path;constructor($,Z=`Waiting for vault config secret at ${$}`){super(Z);this.path=$;this.name="VaultConfigWaitingForSecretError"}code="not_found";sourceType="vault";status=404}function $Q($){return $ instanceof D0}class s0 extends Error{path;constructor($,Z){super(Z);this.path=$;this.name="VaultConfigInvalidPayloadError"}code="invalid_payload";sourceType="vault"}function ZQ($){return $ instanceof s0}var h8=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function y8($){return h8.some((Z)=>(Z in $))}function v8($,Z){if(!$||typeof $!=="object"||Array.isArray($))throw new D0(Z,`Vault config secret at ${Z} is missing or not an object`);let Q=$;if(!y8(Q)&&Object.keys(Q).length===1&&"data"in Q){let X=Q.data;if(X&&typeof X==="object"&&!Array.isArray(X))Q=X}if(Object.keys(Q).length===0)throw new D0(Z,`Vault config secret at ${Z} is empty`);if(!y8(Q))throw new s0(Z,`Vault config secret at ${Z} is an invalid payload: not a RemoteConfig (no known keys: ${h8.join("/")})`);return Q}function QQ($,Z,Q){return{...$,subscribe:async(X,Y,J)=>{try{return await $.subscribe(X,Y,J)}catch(G){if(!(G instanceof w$))throw G;return await c$($,X,Y,Z,Q(),J)}}}}function S4($){let Z=_0($.path,"path","vaultConfig");K0($.ttl);let Q=$.vault??P0({type:"vault",url:$.url,token:$.token,workload:$.workload,lfv:$.lfv,websocket:$.websocket,ttl:$.ttl,log:$.log}),X=$.vault&&$.ttl?QQ(Q,$.ttl,()=>$.log):Q,Y={get log(){return $.log},set log(J){if($.log=J,X&&"log"in X)X.log=J},load:async()=>{try{let J=await X.getFullSecret(Z);return v8(J.data,Z)}catch(J){if(J instanceof l$)throw new D0(Z);if(J instanceof D0||J instanceof s0)throw J;throw Error("Error retrieving remote config from vault",{cause:J})}},subscribe:(J,G)=>{return X.subscribe(Z,(z)=>{let _;try{_=v8(z.data,Z)}catch(B){$.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:Z,error:B instanceof Error?B.message:String(B)});return}J(_)},G)},secret:X};if($.lfv?.lfvServerUrl&&$.lfv.clientId&&$.lfv.deliveryEndpoint&&$.lfv.eventsEndpoint)Y[L0]={path:$.lfv.path??Z,lfvServerUrl:$.lfv.lfvServerUrl,clientId:$.lfv.clientId,deliveryTimeout:$.lfv.deliveryTimeout,retryInterval:$.lfv.retryInterval,warnInterval:$.lfv.warnInterval,deliveryEndpoint:$.lfv.deliveryEndpoint,eventsEndpoint:$.lfv.eventsEndpoint,verifyJwks:$.lfv.verifyJwks};return Y}function C4($){if($==null)return;if(typeof $==="number")return Number.isFinite($)?$:void 0;let Z=$.trim();if(!Z)return;let Q=Number.parseInt(Z,10);return Number.isFinite(Q)?Q:void 0}function XQ($,Z){let Q=$.vaultLfvServerUrl??Z?.lfvServerUrl,X=$.vaultLfvClientId??Z?.clientId,Y=$.vaultLfvDeliveryEndpoint??Z?.deliveryEndpoint,J=$.vaultLfvEventsEndpoint??Z?.eventsEndpoint;if(!Q||!X||!Y||!J)return Z;return{...Z,lfvServerUrl:Q,clientId:X,deliveryEndpoint:Y,verifyJwks:$.vaultLfvVerifyJwks??Z?.verifyJwks,eventsEndpoint:J,path:$.vaultLfvPath??Z?.path,deliveryTimeout:C4($.vaultLfvDeliveryTimeout)??Z?.deliveryTimeout,retryInterval:C4($.vaultLfvRetryInterval)??Z?.retryInterval,warnInterval:C4($.vaultLfvWarnInterval)??Z?.warnInterval}}function YQ($,Z){let Q=$.vaultWebsocketUrl??Z?.url;if(!Q)return Z;return{...Z,url:Q,token:$.vaultWebsocketToken??Z?.token,clientId:$.vaultWebsocketClientId??Z?.clientId,header:$.vaultWebsocketHeader??Z?.header}}function JQ($,Z){let Q=$.vaultWorkloadTokenUrl??Z?.idpTokenUrl,X=$.vaultWorkloadClientId??Z?.clientId,Y=$.vaultWorkloadClientSecret??Z?.clientSecret;if(!Q||!X||!Y)return Z;return{...Z,idpTokenUrl:Q,clientId:X,clientSecret:Y,scope:$.vaultWorkloadScope??Z?.scope}}function f8($,Z){return{...Z,url:$.vaultUrl??Z?.url,token:$.vaultToken??Z?.token,path:$.vaultPath??Z?.path,ttl:C4($.vaultTtl)??Z?.ttl,workload:JQ($,Z?.workload),lfv:XQ($,Z?.lfv),websocket:YQ($,Z?.websocket)}}function t$($){switch($.type){case"vault":return _Q($);case"azure":return BQ($);case"aws":return HQ($);case"gcp":return KQ($);case"mirror":return zQ($);default:throw Error(`Unsupported config locator type: ${$.type}`)}}function zQ($){if($.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!$.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return n0({from:$.from,to:$.to,path:$.to.vaultPath,ttl:$.to.vaultTtl})}function _Q($){return S4(f8($))}function BQ($){return w4({authMethod:$.azureAuthMethod,entraTenantId:$.azureEntraTenantId,clientId:$.azureClientId,clientSecret:$.azureClientSecret,federatedTokenFile:$.azureFederatedTokenFile,managedIdentityClientId:$.azureManagedIdentityClientId,imdsApiVersion:$.azureImdsApiVersion,vaultUrl:$.azureVaultUrl,vaultName:$.azureVaultName,apiVersion:$.azureApiVersion,scope:$.azureScope,secretNamePrefix:$.azureSecretNamePrefix,path:$.azurePath,ttl:$.azureTtl})}function HQ($){return b1({webhookUrl:$.awsWebhookUrl,ttl:$.awsTtl})}function KQ($){return y1({ttl:$.gcpTtl})}function f1($,Z,Q={}){switch($.type){case"vault":return S4({vault:$,path:Z,ttl:Q.ttl});case"azure":return w4({vault:$,path:Z,ttl:Q.ttl});default:throw new GQ(`configFromSource is not supported for secrets source type "${$.type}" (path "${Z}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function V0($){if(!$)return;let Z=Number.parseInt($,10);return Number.isFinite(Z)?Z:void 0}function k4($,Z){let Q=Z?.type??$.ION_CONFIG_TYPE;if(!Q)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(Q==="vault")return{type:"vault",vaultUrl:$.ION_VAULT_URL,vaultToken:$.ION_VAULT_TOKEN,vaultPath:$.ION_VAULT_PATH??"",vaultTtl:V0($.ION_VAULT_TTL),vaultWorkloadTokenUrl:$.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:$.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:$.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:$.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:$.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:$.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:$.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:$.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:$.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:$.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:V0($.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:V0($.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:V0($.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:$.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:$.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:$.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:$.ION_VAULT_WEBSOCKET_HEADER};if(Q==="azure")return{type:"azure",azurePath:$.ION_AZURE_PATH,azureApiVersion:$.ION_AZURE_API_VERSION,azureScope:$.ION_AZURE_SCOPE,azureSecretNamePrefix:$.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:$.ION_AZURE_AUTH_METHOD,azureEntraTenantId:$.ION_AZURE_TENANT_ID,azureClientId:$.ION_AZURE_CLIENT_ID,azureClientSecret:$.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:$.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:$.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:$.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:$.ION_AZURE_VAULT_URL,azureVaultName:$.ION_AZURE_VAULT_NAME,azureTtl:V0($.ION_AZURE_TTL)};if(Q==="aws")return{type:"aws",awsWebhookUrl:$.ION_AWS_WEBHOOK_URL??"",awsTtl:V0($.ION_AWS_TTL)};if(Q==="gcp")return{type:"gcp",gcpTtl:V0($.ION_GCP_TTL)};if(Q==="mirror"){let X={};for(let[z,_]of Object.entries($))if(z.startsWith("ION_FROM_"))X[`ION_${z.slice(9)}`]=_;if(X.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let Y=k4(X),J=k4($,{type:"vault"});if(!J.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let G={type:"vault",vaultUrl:J.vaultUrl,vaultToken:J.vaultToken,vaultPath:J.vaultPath,vaultTtl:J.vaultTtl,vaultWorkloadTokenUrl:J.vaultWorkloadTokenUrl,vaultWorkloadClientId:J.vaultWorkloadClientId,vaultWorkloadClientSecret:J.vaultWorkloadClientSecret,vaultWorkloadScope:J.vaultWorkloadScope,vaultWebsocketUrl:J.vaultWebsocketUrl,vaultWebsocketToken:J.vaultWebsocketToken,vaultWebsocketClientId:J.vaultWebsocketClientId,vaultWebsocketHeader:J.vaultWebsocketHeader};return{type:"mirror",from:Y,to:G}}throw Error(`ION_CONFIG_TYPE="${Q}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function m8($,Z){return t$(k4($,Z))}function DQ($){return m8(process.env,$)}var VQ=1000,UQ=30000,g8=["vault","azure","aws","gcp"];function p8($,Z){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`Config locator at ${Z} is an invalid payload: expected an object with a "type" field`);let Q=$.type;if(typeof Q!=="string"||!g8.includes(Q))throw Error(`Config locator at ${Z} is an invalid payload: unknown type "${String(Q)}" (expected ${g8.join("/")})`)}function d8($,Z){return $.log??=Z.log,$.validators??=Z.validators,$}function a0($){if(!$?.secret?.close)return;try{Promise.resolve($.secret.close()).catch((Z)=>{$.log?.warn?.("secretConfigSource: inner source close failed",Z)})}catch(Z){$.log?.warn?.("secretConfigSource: inner source close failed",Z)}}function FQ($,Z){let Q=_0(Z,"path","secretConfigSource"),X,Y=(G)=>{p8(G,Q);let z=JSON.stringify(G);if(X&&X.hash===z)return X.inner;let _=X?.inner,B=d8(t$(G),J);if(X={hash:z,inner:B},_&&_!==B)a0(_);return B},J={async load(){let G=await $.getSecret(Q);return Y(G).load()},async subscribe(G,z){let _,B=!1,H=!1,D,V,x=new Promise((f,g)=>{D=f,V=g}),T=M4(),q,I,O=(f)=>new Promise((g)=>{I=g,q=setTimeout(g,f)}),E=async(f,g)=>{p8(f,Q);let a=JSON.stringify(f),X$=X!==void 0&&X.hash===a;if(X$&&_)return;let e=X?.inner,n=_,r=X$&&X?X.inner:d8(t$(f),J),Q$=!X$,A=()=>{if(Q$&&r!==e)a0(r)};try{if(r.subscribe){let L=await r.subscribe(G,z)??void 0;if(B||!T.isCurrent(g)){L?.(),A();return}if(_=L,X={hash:a,inner:r},n&&n!==L)n();if(Q$&&e&&e!==r)a0(e);return}let W=await r.load();if(B||!T.isCurrent(g)){A();return}if(X={hash:a,inner:r},n)n(),_=void 0;if(Q$&&e&&e!==r)a0(e);G(W)}catch(W){throw A(),W}},M=async(f)=>{let g=T.next(),a=VQ;for(;;){if(B||!T.isCurrent(g))return;try{await E(f,g);return}catch(X$){if(B||!T.isCurrent(g))return;J.log?.warn(`secretConfigSource rebind for ${Q} failed; keeping last-known-good source and retrying in ${a}ms`,X$),await O(a),a=Math.min(UQ,a*2)}}},R=await $.subscribe(Q,(f)=>{if(B)return;if(!H){E(f.data,T.next()).then(()=>{H=!0,D()}).catch((g)=>{H=!0,V(g)});return}M(f.data)},z);return await x,()=>{if(B=!0,T.next(),q)clearTimeout(q);I?.(),_?.(),R(),a0(X?.inner),X=void 0}},secret:$};return J}function m1($){if(Array.isArray($))return $.map(m1);if($&&typeof $==="object")return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0).sort(([Z],[Q])=>Z.localeCompare(Q)).map(([Z,Q])=>[Z,m1(Q)]));return $}function u8($){return JSON.stringify(m1($))}function MQ($){if($.type==="vault")return $.vaultLfvPath??$.vaultPath;if($.type==="azure"&&$.azurePath?.trim())return $.azurePath;throw Error(`Tenant config locator type "${$.type}" does not declare a mirrorable config path`)}function WQ($,Z){let Q=Z.logger??$.log,X=new Map,Y=!1,J=async(B)=>{if(B.closed)return;B.closed=!0,B.closeHooks?.(),await B.hookSetup?.catch(()=>{return}),await B.source.secret.close?.()},G=(B)=>{let H=(async()=>{let D=await Z.store.get(B);if(!D)throw Error(`Tenant "${B}" was not found`);if(!D.configLocator)throw Error(`Tenant "${B}" has no configLocator`);let V=D.configLocator,x=Z.path(D).trim();if(!x)throw Error(`Tenant mirror path is empty for "${B}"`);let T=Z.sourceFromLocator?.(V,D)??V,I={source:n0({from:T,fromPath:MQ(V),to:Z.to,path:x,logger:Q}),locatorFingerprint:u8(V),targetPath:x,closed:!1};if(Z.hooks?.onRemoteConfigChange)I.hookSetup=Z.to.subscribe(x,(O)=>{Promise.resolve(Z.hooks?.onRemoteConfigChange?.(D,O.data,O)).catch((E)=>{Q.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:B,error:E instanceof Error?E.message:String(E)})})}).then((O)=>{I.closeHooks=O}).catch((O)=>{Q.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:B,error:O instanceof Error?O.message:String(O)})});return I})();return X.set(B,H),H.catch(()=>{if(X.get(B)===H)X.delete(B)}),H},z=async(B,H,D)=>{if(X.get(B)===H)X.delete(B);await J(D)},_=async(B)=>{if(Y)throw Error("Tenant config mirror is closed");let H=X.get(B);if(!H)return G(B);let D=await H,V=await Z.store.get(B);if(!V?.configLocator)throw await z(B,H,D),Error(V?`Tenant "${B}" has no configLocator`:`Tenant "${B}" was not found`);if(u8(V.configLocator)!==D.locatorFingerprint)return await z(B,H,D),X.get(B)??G(B);return D};return{async ensure(B,H){await(await _(B)).source.mirror.ready(H)},async handleCallback(B,H,D){try{return await(await _(B)).source.handleCallback(H,D)}catch(V){let x=V instanceof Error?V.message:String(V),T=x.includes("was not found")?404:503;return Q.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:B,kind:H,error:x}),Response.json({error:T===404?"Tenant not found":"Tenant config mirror unavailable"},{status:T})}},async purge(B){let H=X.get(B),D=H?await H:void 0,V=await Z.store.get(B),x=D?.targetPath??(V?Z.path(V).trim():void 0);if(D&&H)await z(B,H,D);if(x&&await Z.to.exists(x))await Z.to.deleteSecret(x);if(V)await Z.hooks?.onRemoteConfigRevoke?.(V)},async close(){if(Y)return;Y=!0;let B=[...X.values()];X.clear(),await Promise.all(B.map(async(H)=>{try{await J(await H)}catch{}}))}}}import{buildTenantPath as OQ,DEFAULT_TENANT_API_NAMESPACE as c8,DEFAULT_TENANT_UI_NAMESPACE as i8,matchTenantPath as n8,normalizeTenantPathNamespace as l8}from"@ionite/core";function LQ(){return Response.json({error:"Tenant not found"},{status:404})}function NQ($){return Response.json({error:`Tenant runtime unavailable for ${$}`},{status:503})}function AQ($,Z){if(Z==="api")return l8($?.api??c8);return l8($?.ui??i8)}function jQ($){if($.store)return async(Z)=>$.store.getIon(Z);return async(Z)=>await $.getIon(Z)??void 0}async function s8($,Z={}){if(Z.custom){let J=await Z.custom($);if(J)return{id:J}}let Q=Z.namespace??"api",X=AQ(Z.strategy,Q),Y=n8(new URL($.url).pathname,X);if(!Y)return null;return{id:Y.id,context:{namespace:Q,restPath:Y.restPath,restSegments:Y.restSegments}}}function a8($,Z){let Q=new URL($.url);return Q.pathname=Z,new Request(Q,$)}function g1($,Z,Q,X){let Y=n8(new URL($.url).pathname,Q);if(!Y||Y.id!==Z)return $;return a8($,OQ(Z,Y.restPath,X))}function EQ($,Z,Q={beforeTenantSegments:["api"],afterTenantSegments:[]}){return g1($,Z,c8,Q)}function RQ($,Z,Q={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return g1($,Z,i8,Q)}function PQ($){return async function(Q){try{let X=$.resolveTenant?await $.resolveTenant(Q):await s8(Q),Y=typeof X==="string"?{id:X,context:void 0}:X??null;if(!Y?.id)return $.onMissingTenant?await $.onMissingTenant(Q):LQ();let J=await $.getIon(Y.id,Q)??null;if(!J)return $.onMissingIonite?await $.onMissingIonite(Q,Y.id):NQ(Y.id);let G=$.rewriteRequest?await $.rewriteRequest(Q,{id:Y.id,ion:J,context:Y.context}):Q;return J.handler(G)}catch(X){return N0(X)}}}import{list as qQ}from"@ionite/core";class t8{identities=new Map;clientIdIndex=new Map;async get($){return this.identities.get($)}async lookup($){if($.id){let Z=this.identities.get($.id);if(Z)return Z}if($.clientId){let Z=this.clientIdIndex.get($.clientId);if(Z)return this.identities.get(Z)}if($.externalId){for(let Z of this.identities.values())if(Z.externalId===$.externalId)return Z}return}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q=new Date,X=this.identities.get(Z),Y={...$,id:Z,createdAt:X?.createdAt??$.createdAt??Q,updatedAt:Q};if(X?.clientId&&X.clientId!==Y.clientId)this.clientIdIndex.delete(X.clientId);if(this.identities.set(Z,Y),Y.clientId)this.clientIdIndex.set(Y.clientId,Z);return Y}async delete($){let Z=this.identities.get($);if(Z?.clientId)this.clientIdIndex.delete(Z.clientId);return this.identities.delete($),Z?1:0}async list($){let Z=Array.from(this.identities.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,G=Z.slice(Q,J);return qQ(Y,G,Q,X)}}var yQ=30000;function vQ($){let Z=$,Q=Z.basePath??Z4(),X=Z.readyTimeoutMs??yQ,Y=$4(Z.stores),J=Z.routing,G=Z.beforeChange,z=Z.afterChange,_=Z.configRetry,B=Z.onConfigLoadError;return{frameworkConfig:{log:$.log,validators:$.validators,sso:$.sso,iam:$.iam,workload:$.workload,secrets:$.secrets,lfv:$.lfv,ciam:$.ciam,authz:$.authz,otel:$.otel},basePath:Q,readyTimeoutMs:X,stores:Y,options:{beforeChange:G,afterChange:z,routing:J,configRetry:_,onConfigLoadError:B}}}function hQ($){let Z=$,Q={trace:(X,...Y)=>Z.trace(X,...Y),debug:(X,...Y)=>Z.debug(X,...Y),info:(X,...Y)=>Z.info(X,...Y),warn:(X,...Y)=>Z.warn(X,...Y),error:(X,...Y)=>Z.error(X,...Y)};return{logger:Q,update(X){return Z=X,Q}}}function G9($,Z){let Q=$;return Q.setStores=(X)=>{Z.current=$4(X),Object.assign(Q,b0(Q,Z.current))},Q}function o8($){let Z=$?.replace(/\s+/g," ").trim();return Z?Z:void 0}function z9($){if(typeof $!=="object"||$===null)return;return $.cause}function fQ($){if(!($ instanceof Error))return typeof $==="string"?o8($):void 0;let Z=o8($.message),Q=[],X=$;if(typeof X.code==="string")Q.push(`code=${X.code}`);if(typeof X.status==="number")Q.push(`status=${X.status}`);if(typeof X.path==="string")Q.push(`path=${X.path}`);if(Q.length===0)return Z;if(!Z)return Q.join(", ");return`${Z} [${Q.join(", ")}]`}function l1($,Z=3){let Q=[],X=$,Y=0;while(X!=null&&Y<Z){let J=fQ(X);if(J&&!Q.includes(J))Q.push(J);X=z9(X),Y+=1}return Q.length>0?Q.join(" <- "):void 0}function mQ($,Z){if(typeof $!=="object"||$===null)return;return $[Z]}function C$($,Z){let Q=$,X=0;while(Q!=null&&X<3){let Y=mQ(Q,Z);if(Y!==void 0)return Y;Q=z9(Q),X+=1}return}var gQ=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function pQ($){return typeof $==="string"&&gQ.has($)}function dQ($){let Z=C$($,"kind");if(pQ(Z))return Z;let Q=C$($,"status"),X=C$($,"code"),Y=l1($)?.toLowerCase()??"";if(Q===401||Q===403||Y.includes("auth error")||Y.includes("permission denied"))return"auth";if(X==="not_found"||Y.includes("waiting for vault"))return"not_found";if(X==="ECONNREFUSED"||X==="ECONNRESET"||X==="ENOTFOUND"||X==="ETIMEDOUT"||Y.includes("connection")||Y.includes("fetch failed")||Y.includes("network"))return"connection";if(Y.includes("timed out"))return"timeout";if(Y.includes("invalid status")||typeof Q==="number"&&Q>=400)return"invalid_status";if(Y.includes("invalid payload")||Y.includes("invalid json")||Y.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function uQ($){return"validation"}var lQ=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function cQ($,Z){let Q=C$($,"recoverable");if(typeof Q==="boolean")return Q;if(Z==="not_found")return!0;if(Z==="auth"||Z==="invalid_payload")return!1;let X=C$($,"status");if(typeof X==="number"&&X>=400&&X<500)return!1;let Y=C$($,"code");if(typeof Y==="string"&&(lQ.has(Y)||Y.startsWith("UND_ERR_")))return!0;return!0}function iQ($){return{initialDelayMs:Math.max(1,$?.initialDelayMs??2000),maxDelayMs:Math.max(1,$?.maxDelayMs??600000),multiplier:Math.max(1,$?.multiplier??2),jitterRatio:Math.max(0,$?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,$?.loadTimeoutMs??30000)}}function nQ($,Z){let Q=Math.max(0,$-1),X=Math.min(Z.maxDelayMs,Z.initialDelayMs*Z.multiplier**Q);if(Z.jitterRatio===0)return Math.round(X);let Y=X*Z.jitterRatio,J=(Math.random()*2-1)*Y;return Math.max(1,Math.round(Math.min(Z.maxDelayMs,X+J)))}function sQ($){return(Z)=>{let Q=Z.path?` at ${Z.path}`:"",X=Z.sourceType?` (${Z.sourceType})`:"";$.warn(`Config source${X} unavailable${Q}; ionite will retry automatically in ${Z.nextDelayMs}ms (attempt ${Z.attempt}, ${Z.errorKind}: ${Z.message}).`)}}async function aQ($,Z){for(let Q of Z)await Q($)}function k$($){if(!$)return;try{return new URL($,"http://dummy").pathname}catch{return $.startsWith("/")?$:`/${$}`}}function tQ($,Z){let Q=Z.id;if(typeof Q!=="string"||Q.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if($!==void 0&&$!==Q)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${$}", received "${Q}").`)}function rQ($){let Z=$.kms;if(Z)for(let[X,Y]of Object.entries(Z)){if(X.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!Y||typeof Y!=="object"||Array.isArray(Y))throw Error(`RemoteConfig.kms.${X} must be an object.`);if(Y.source!==void 0&&(typeof Y.source!=="string"||Y.source.length===0))throw Error(`RemoteConfig.kms.${X}.source must be a non-empty string when present.`);if(Y.path!==void 0&&(typeof Y.path!=="string"||Y.path.length===0))throw Error(`RemoteConfig.kms.${X}.path must be a non-empty string when present.`)}let Q=$.otel;if(!Q)return;if(Q.apiKey!==void 0&&Q.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(Q.apiKeyPool!==void 0){if(typeof Q.apiKeyPool!=="string"||Q.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!Z?.[Q.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${Q.apiKeyPool}".`)}}function oQ($){let Z=$.authz?.trustedProvisioningClients;if(!Z)return;Z.forEach((Q,X)=>{let Y=`authz.trustedProvisioningClients[${X}]`;if(typeof Q.issuer!=="string"||Q.issuer.length===0)throw Error(`${Y}: "issuer" is required and must be a non-empty string.`);if(typeof Q.clientId!=="string"||Q.clientId.length===0)throw Error(`${Y}: "clientId" is required and must be a non-empty string.`);let J=Array.isArray(Q.audience)?Q.audience:[Q.audience];if(J.length===0||J.some((G)=>typeof G!=="string"||G.length===0))throw Error(`${Y}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(Q.permissions)||Q.permissions.some((G)=>typeof G!=="string"||G.length===0))throw Error(`${Y}: "permissions" must be an array of non-empty permission ids.`)})}function eQ($){let Z=Array.isArray($)?$:[$];return Z.length>0&&Z.every((Q)=>typeof Q==="string"&&Q.length>0)}function $X($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return;let Q=Z,X=(Y,J)=>{if(!eQ(Y.audience))throw Error(`${J}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in Q||"outgoing"in Q){let Y=Q.incoming;if(Array.isArray(Y))Y.forEach((J,G)=>{if(J&&typeof J==="object")X(J,`workload.incoming[${G}]`)});else if(Y&&typeof Y==="object"&&"jwksUri"in Y)X(Y,"workload.incoming");return}if(H9(Q)){if("jwksUri"in Q&&!("clientId"in Q)&&!("workloadId"in Q))X(Q,"workload (server-only)");return}}function ZX($,Z,Q){if($?.sso?.redirectUri&&Z.sso?.redirectUri){let X=k$($.sso.redirectUri),Y=k$(Z.sso.redirectUri);if(X!==Y)Q.error(`SSO redirectUri path mismatch: the framework derives "${Y}" from basePath, but ConfigSource reports "${X}". Register "${Y}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function c1($){let Z={};if(!$)return Z;for(let[Q,X]of Object.entries($))if(X.type==="vault"&&typeof X.lfv?.deliveryEndpoint==="string"&&typeof X.lfv?.eventsEndpoint==="string")Z[Q]=X.lfv;return Z}function _9($){return $[L0]}function B9($,Z){let Q=c1($.secrets??void 0),X=k$(Z.deliveryEndpoint),Y=k$(Z.eventsEndpoint),J=k$(Z.path);for(let G of Object.values(Q)){if(k$(G.deliveryEndpoint)!==X)continue;if(k$(G.eventsEndpoint)!==Y)continue;let z=G.path?k$(G.path):void 0;if(J&&z&&J!==z)continue;return!0}return!1}function QX($,Z){let Q=_9(Z);if(!Q)return $;if(B9($,Q))return $;let X={type:"vault",lfv:{path:Q.path,lfvServerUrl:Q.lfvServerUrl,clientId:Q.clientId,deliveryTimeout:Q.deliveryTimeout,retryInterval:Q.retryInterval,warnInterval:Q.warnInterval,deliveryEndpoint:Q.deliveryEndpoint,eventsEndpoint:Q.eventsEndpoint,verifyJwks:Q.verifyJwks}},Y=$.secrets??{},J=l4(Y,{clientId:Q.clientId,path:Q.path});return{...$,secrets:{...Y,[J]:X}}}function XX($,Z){let Q=_9(Z);if(!Q||B9($,Q))return new Map;let X=l4($.secrets??{},{clientId:Q.clientId,path:Q.path});return new Map([[X,Z.secret]])}function YX($,Z){let Q=c1($.secrets),X=c1(Z.secrets??void 0);for(let[Y,J]of Object.entries(X)){let G=Q[Y];if(!G)continue;let z=k$(G.deliveryEndpoint),_=k$(J.deliveryEndpoint);if(z&&_&&z!==_)throw Error(`LFV deliveryEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${z}, framework path: ${_}`);let B=k$(G.eventsEndpoint),H=k$(J.eventsEndpoint);if(B&&H&&B!==H)throw Error(`LFV eventsEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${B}, framework path: ${H}`)}}function JX($){return new Set(Object.keys($.secrets??{}))}function GX($){return new Set(Object.keys($.secrets??{}))}function zX($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return new Set;if(!("outgoing"in Z))return new Set;let Q=Z.outgoing;if(!Q||typeof Q!=="object"||Array.isArray(Q))return new Set;return new Set(Object.keys(Q))}function H9($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return"clientId"in Z||"jwksUri"in Z||"workloadId"in Z}function _X($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return new Set;let Q=Z;if("incoming"in Q||"outgoing"in Q){let X=Q.outgoing;if(!X||typeof X!=="object"||Array.isArray(X))return new Set;return new Set(Object.keys(X))}if(H9(Q))return new Set;return new Set(Object.keys(Q).filter((X)=>X!=="default"))}function BX($,Z,Q,X){let Y=Z.secrets??{},J=$.secrets??{};for(let[H,D]of Object.entries(Y)){let V=J[H];if(!V)continue;if(D.type&&V.type&&D.type!==V.type)throw Error(`Secrets source "${H}" type in framework config must match ConfigSource type. ConfigSource type: ${V.type}, framework type: ${D.type}`)}let G=JX(Z),z=GX($);for(let H of G)if(!z.has(H)&&!X.has(H))Q.warn(`Framework config declares secrets source "${H}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let H of z)if(!G.has(H))Q.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:H});let _=zX(Z),B=_X($);for(let H of _)if(!B.has(H))Q.warn(`Framework config declares outgoing workload client "${H}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(Z.otel!==void 0&&Z.otel!==null&&$.otel===void 0)Q.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function e8($,Z){if(Z===void 0)return!1;return IQ($,Z)}function HX($,Z){if(typeof Z!=="number"||!Number.isFinite(Z)||Z<=0)return $;return new Promise((Q,X)=>{let Y=setTimeout(()=>{X(Error(`Ionite ready() timed out after ${Z}ms`))},Z);$.then(()=>{clearTimeout(Y),Q()},(J)=>{clearTimeout(Y),X(J)})})}function KX($,Z,Q){if(typeof Z!=="number"||Z<=0)return $;return new Promise((X,Y)=>{let J=setTimeout(()=>{Y(Error(Q))},Z);$.then((G)=>{clearTimeout(J),X(G)},(G)=>{clearTimeout(J),Y(G)})})}function n1(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function $9($){return $==="/"?$:$.replace(/\/+$/,"")}function d1($,Z){return $9($)===$9(Z)}function Z9($){return $.method==="GET"||$.method==="HEAD"}function DX($){if($.isReady()&&$.config?.readyz?.enabled===!1)return D$();let Z=$.readiness();return Response.json(VX(Z),{status:Z.ok?200:503})}function VX($){let Z=$.config.lastError;if(!Z)return $;return{...$,config:{...$.config,lastError:{kind:Z.kind,phase:Z.phase,at:Z.at,message:"[redacted]"}}}}var UX={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz"};function FX($){let Z=$?.providers;if(!Z)return!1;return Object.values(Z).some((Q)=>Q.enabled!==!1&&Q.type!=="magic-link")}function I$($,Z,Q={}){let X=UX[$],Y=Z.modules[X],J=Q.capable??!0,G=Y.active&&Y.ready&&J,z=G?void 0:!Y.active||!Y.ready?Y.reason:Q.incapableReason??`${$} is not testable by this application wiring`;return{module:X,active:Y.active,ready:Y.ready,testable:G,...Q.urls&&Q.urls.length>0?{urls:Q.urls}:{},...z?{reason:z}:{}}}function MX($,Z,Q){let X=g$(Z),Y=$.readiness();return{sdk:{version:x1,catalogVersion:X1},basePath:Z,urls:X,modules:Y.modules,lfvCallbackTransport:Boolean(Q.lfv?.callbackTransport),capabilities:{"sso.login":I$("sso.login",Y,{urls:[X.sso.loginUrl,X.sso.callbackUrl,X.sso.userUrl]}),"sso.jit":I$("sso.jit",Y,{capable:Q.sso?.enableJitUserProvisioning!==!1,incapableReason:"SSO JIT user provisioning is disabled in FrameworkConfig."}),"sso.logout":I$("sso.logout",Y,{urls:[X.sso.logoutUrl]}),"sso.back_channel_logout":I$("sso.back_channel_logout",Y,{urls:[X.sso.logoutBackChannelUrl]}),"ciam.magic_link":I$("ciam.magic_link",Y,{capable:Q.ciam?.enableJitUserProvisioning!==!1,urls:[X.ciam.magicLinkUrl,X.ciam.magicLinkLoginUrl],incapableReason:"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":I$("ciam.oidc_login",Y,{capable:FX(Q.ciam),urls:[X.ciam.customerLoginUrl,X.ciam.customerCallbackUrl,X.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":I$("ciam.customer",Y,{urls:[X.ciam.customerUrl]}),"ciam.logout":I$("ciam.logout",Y,{urls:[X.ciam.logoutUrl]}),"iam.users":I$("iam.users",Y,{capable:Boolean(Q.iam?.userStore),urls:[X.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":I$("iam.groups",Y,{capable:Boolean(Q.authz?.catalogStore||Q.authz?.catalog),urls:[X.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"workload.incoming":I$("workload.incoming",Y,{urls:[X.workload.validateUrl,X.workload.jwksUrl]}),"workload.outgoing":I$("workload.outgoing",Y,{}),"authz.oaa":I$("authz.oaa",Y,{capable:Boolean(Q.authz?.accessStore&&(Q.authz?.catalogStore||Q.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."})}}}async function WX($,Z,Q){if(!Z.isReady())return n1();if(Z.config?.capabilitiez!==!0||!Q)return D$();let X=await B0($,Z,Y9["capabilitiez.read"]);if(X)return X;return Response.json(Q.build(),{status:200})}async function OX($,Z,Q){if(!Z.isReady())return n1();if(Z.config?.authz?.oaa?.fullSync?.enabled!==!0)return D$();let X=await B0($,Z,Y9["authz.oaa.sync"]);if(X)return X;let Y=Z.authz?.oaa;if(!Y?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let J=Z.authz?await Z.authz.reconcile():void 0,G=Q.iam?.userStore,z=xQ(Q.authz?.catalog?J9(Q.authz.catalog):void 0,Q.authz?.catalogStore),_=Q.authz?.accessStore,B=Q.authz?.resources,H=await Y.sync({users:G?w0((D,V)=>G.list({start:D,limit:V})):void 0,groups:z?w0((D,V)=>z.groups.list({start:D,limit:V})):void 0,roles:z?w0((D,V)=>z.roles.list({start:D,limit:V})):void 0,permissions:z?w0((D,V)=>z.permissions.list({start:D,limit:V})):void 0,resources:B?w0((D,V)=>B.list({start:D,limit:V})):void 0,access:_?w0((D,V)=>_.list({start:D,limit:V})):void 0},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...H,reconcile:J})}function LX($,Z,Q,X,Y,J){return async(G)=>{let z=new URL(G.url).pathname;if(d1(z,Q)){if(!Z9(G))return A0(["GET"]);return DX($)}if(d1(z,X)){if(!Z9(G))return A0(["GET"]);return WX(G,$,Y)}if(J&&d1(z,J.url)){if(G.method!=="POST")return A0(["POST"]);return OX(G,$,J.frameworkConfig)}let _=$.secrets;if(!Boolean(_?.isLfvDeliveryRequest?.(G)||_?.isLfvEventsRequest?.(G))&&!$.isReady())return n1();try{return await Z(G)}catch(H){return $.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},H),N0(H)}}}function Q9($,Z,Q){if($)return Q&&!$.tenantId?{...$,tenantId:Q}:$;if(Z&&Q)return{tenantId:Q};return}function NX($,Z){if(Z.authz===null)return;if(!$.authz&&!Z.authz)return;return{...$.authz,...Z.authz,oaa:$.authz?.oaa||Z.authz?.oaa?{...$.authz?.oaa,...Z.authz?.oaa}:void 0}}function u1($){let Z=!1,Q=U$(`${$} module`,()=>Z);return{isReady:Q.isReady,ready:Q.ready,attach(X){if(Z=X!==void 0,Q.refresh(),!X)return;return Object.defineProperty(X,"isReady",{value:Q.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(X,"ready",{value:Q.ready,enumerable:!1,configurable:!0}),X}}}function i1($){if(!$)return!1;return $.isReady?$.isReady():!1}function S0($,Z,Q,X){if(!$)return{active:!1,ready:!1,reason:Q};return i1(Z)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:X}}function AX(){let $=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:$(),ciam:$(),iam:$(),workload:$(),otel:$(),secrets:$(),kms:$(),authz:$()}}function jX($,Z){let Q=$.isReady(),X=$.config;if(!Q||!X)return{ok:!1,applied:Q,modules:AX(),config:{...Z}};let Y=Boolean(X.workload)||Boolean($.workload),J={sso:S0(Boolean(X.sso),$.sso,"sso not configured (no RemoteConfig.sso)","sso configured but not ready"),ciam:S0(Boolean(X.ciam),$.ciam,"ciam not configured (no RemoteConfig.ciam)","ciam configured but not ready"),iam:S0(Boolean(X.iam),$.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:S0(Y,$.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:S0(Boolean(X.otel),$.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(X.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!i1($.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return $.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:S0(Boolean(X.kms),$.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(X.authz?.oaa))return{active:!0,ready:!0};let _=$.authz?.oaa;return i1(_)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})()};return{ok:Object.values(J).every((z)=>!z.active||z.ready),applied:Q,modules:J,config:{...Z}}}function EX($,Z){let Q=[];for(let X of Z){let Y=$.modules[X];if(!$.applied){Q.push({name:X,reason:"RemoteConfig has not been applied yet"});continue}if(!Y?.ready)Q.push({name:X,reason:Y?.reason??`${X} is not ready`})}return{ok:Q.length===0,notReady:Q}}function RX($,Z,Q,X,Y,J,G,z){let _=Z.validators,B=kQ($.cache);SQ(B.jwks);let H=Z;if(B.session.read.enabled){let e=Z.sso?.sessionStore??Z.ciam?.sessionStore;if(e){let n=O1(e,B.session.read);H={...Z,sso:Z.sso?{...Z.sso,sessionStore:n}:Z.sso,ciam:Z.ciam?{...Z.ciam,sessionStore:n}:Z.ciam}}}let D={sessionCache:B.session},V=i$(_.workload,Q,$?.workload,Z.workload??void 0),x=Z.otel!==null?_1(Q,$?.otel,Z.otel??void 0,Y):void 0,T=Q9($?.sso,Z.sso,$.id),q=bQ(_.sso,Q,T,H.sso??void 0,D),I={...$?.iam,...Z.iam},O=Z.authz?.catalog?J9(Z.authz.catalog):void 0,E=Z.workload,M=E&&"workloadIdentityStore"in E?E.workloadIdentityStore:E&&("incoming"in E)&&E.incoming&&!Array.isArray(E.incoming)&&("workloadIdentityStore"in E.incoming)?E.incoming.workloadIdentityStore:void 0,R=Boolean(I.url||I.userStore||Z.authz?.catalogStore||O),f=G.update({mode:I.delta,url:I.url,audience:I.deltaAudience},{workload:V,workloadIdentityStore:M,userStore:I.userStore,accessStore:Z.authz?.accessStore,catalogStore:Z.authz?.catalogStore,codeCatalog:O,mapUserToScim:I.inboundUsers?.mapBaseUserToScim}),g;if(R&&!V){if(Object.keys($).length>0)Q.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");g=void 0}else g=CQ(_.iam,Q,V,J,Z.authz?.accessStore,Z.authz?.accessIndex,Z.authz?.catalogStore,O,Z.authz?.resources,$?.iam,Z.iam??void 0,f,Z.authz?.onAccessMutation,TQ($.authz),z);let a=Q9($?.ciam,Z.ciam,$.id),X$=wQ(_.ciam,Q,a,H.ciam??void 0,V,D);return{secret:X,workload:V,otel:x,sso:q,iam:g,ciam:X$}}function K9($,Z,Q,X,Y,J,G,z){let _=J.authz.update(NX(Z,Q));$.id=Z.id,$.config=Z,$.secrets=J.secrets.update(Z.secrets,Q.secrets??void 0,Q.validators.secrets,Q.lfv?.callbackTransport,Q.lfv?.singleProcess),$.kms=J.kms.update(Z.kms,(V)=>{if(!V.source)return Y;if(!$.secrets)throw Error(`KMS pool references unavailable secrets source "${V.source}".`);return $.secrets.getSecretsSource(V.source)});let B=RX(Z,Q,X,Y,J.kms.handle(),_,J.iamDelta,J.authz.settle);$.secret=B.secret,$.workload=J.workload.update(B.workload),$.otel=J.otel.update(B.otel),$.authz=_,$.log=J.log.update($.otel?.logger??X),$.sso=J.sso.attach(B.sso),$.iam=J.iam.attach(B.iam),$.ciam=J.ciam.attach(B.ciam);let H=g$(G),D=(V)=>H1(V,$,z?.routing,H);$.handler=LX($,D,H.readyzUrl,H.capabilitiezUrl,{build:()=>MX($,G,Q)},{url:Q6(G),frameworkConfig:Q})}function PX($,Z,Q,X,Y,J,G,z,_){tQ($.id,Z),rQ(Z),oQ(Z),$X(Z),ZX(Z,Q,X),YX(Z,Q),BX(Z,Q,X,z),K9($,Z,Q,X,Y,J,G,_)}function X9($){if(!$.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return $.secret}async function qX($,Z,Q,X,Y,J,G){let z=$,_=X6($,Z,Y.current,J);if(X.beforeChange){let B=G9(_,Y);G?.enter();let H;try{H=await X.beforeChange($,B,Q)}finally{G?.exit()}if(H?.config!==void 0)z=H.config;_=H?.frameworkConfig??B}return _=b0(_,Y.current),{effectiveRemoteConfig:z,effectiveFrameworkConfig:_}}function ZJ($,Z){let Q=vQ(Z),{frameworkConfig:X,basePath:Y,readyTimeoutMs:J,stores:G,options:z}=Q,_=XX(X,$),B=new Set(_.keys()),H=b0(QX(X,$),G),D=H.log||p1,V={current:G},x={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:H},T=Q1(D),q={log:hQ(D),secrets:U8(D,_),kms:f6(D),workload:R8(D),otel:l6(D),authz:W6(D,()=>T.handle()),iamDelta:T,sso:u1("sso"),iam:u1("iam"),ciam:u1("ciam")},I={},O,E,M=new Promise((s,z$)=>{O=s,E=z$}),R=!1,f,g,a=0,X$={enter:()=>{a+=1},exit:()=>{a-=1}},e=Promise.resolve();function n(s){let z$=e.then(s,s);return e=z$.then(()=>{return},()=>{return}),z$}function r(s){if(R)throw Error(`Ionite instance has been closed and cannot call ${s}().`)}function Q$(){$.log=x.frameworkConfig.log??p1,$.validators=x.frameworkConfig.validators}let A={},W={log:D,id:void 0,config:void 0,secret:X9($),authz:void 0,configStatus:I,handler:async()=>D$(),ready:(s)=>{if(a>0&&x.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return HX(M,s??J)},isReady:()=>x.remoteConfig!==void 0,readiness:()=>jX(W,I),requireReady:(s)=>EX(W.readiness(),s),close:()=>{if(R)return;if(R=!0,g)clearTimeout(g),g=void 0;f?.(),f=void 0;let s=[()=>q.secrets.close(),()=>q.kms.close(),()=>q.authz.close(),()=>q.otel.shutdown()];for(let z$ of s)try{Promise.resolve(z$()).catch((H$)=>{D.warn("Ionite close: module teardown failed",H$)})}catch(H$){D.warn("Ionite close: module teardown failed",H$)}O?.(),O=void 0,E=void 0},setStores:async(s)=>{r("setStores");let z$=$4(s);await n(()=>u(z$))}};K9(W,A,x.frameworkConfig,D,W.secret,q,Y,z),Q$();function L(){let s=I.lastError!==void 0;if(I.appliedAt=Date.now(),I.lastError=void 0,s)(W.log??D).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function k(s,z$){let H$=l1(z$)??(z$ instanceof Error?z$.message:String(z$)),K$=uQ(z$),j=I.lastError===void 0;if(I.lastError={kind:K$,message:H$,at:Date.now(),phase:s},j)(W.log??D).error(s==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":K$,phase:s,error:H$})}function w(s,z$,H$){(W.log??D).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:s,"ion.config.hash":z$,"ion.config.apply_ms":H$})}async function b(s,z$){if(R)return;let H$=r8(s);if(z$&&x.remoteConfig!==void 0&&H$===x.remoteConfigHash&&e8(s,x.remoteConfig))return;let K$=x.remoteConfig,j=K$===void 0?"initial":"update",h=Date.now(),P,F,K;try{let y=await qX(s,x.frameworkConfig,x.remoteConfig,z,V,Y,X$);if(P=y.effectiveRemoteConfig,F=r8(P),K=y.effectiveFrameworkConfig,z$&&z.beforeChange===void 0&&x.remoteConfig!==void 0&&F===x.remoteConfigHash&&e8(P,x.remoteConfig)&&K===x.frameworkConfig)return;let i=K.log||p1;PX(W,P,K,i,X9($),q,Y,B,z)}catch(y){throw k(j,y),y}x.remoteConfig=P,x.remoteConfigHash=F,x.frameworkConfig=K,Q$(),L(),await q.otel.settled();let N=G9(x.frameworkConfig,V),S=!1;try{z.afterChange?.(W,P,N,K$)}catch(y){if((W.log??D).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:j,error:y instanceof Error?y.message:String(y)}),j==="initial"){S=!0;let i=y instanceof Error?y:Error(`afterChange failed on initial load: ${String(y)}`);k("initial",i),E?.(i),E=void 0,O=void 0}}if(x.frameworkConfig=N,Q$(),!S)w(j,F,Date.now()-h);if(!S&&O)O(),O=void 0}async function u(s){if(R)return;if(V.current=s,x.remoteConfig===void 0){x.frameworkConfig=b0(x.frameworkConfig,s),Q$();return}await b(x.remoteConfig,!1)}if($.subscribe)$.subscribe((s)=>{n(()=>b(s,!0)).catch(()=>{})},{mode:"wait"}).then((s)=>{if(R){s?.();return}f=s}).catch((s)=>{D.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:s instanceof Error?s.message:String(s)})});let c=iQ(z.configRetry),o=[z.onConfigLoadError??sQ(D)],Y$=0;function G$(){if(g=void 0,R)return;if(x.remoteConfig!==void 0)return;KX($.load(),c.loadTimeoutMs,`ConfigSource initial load timed out after ${c.loadTimeoutMs}ms`).then(async(s)=>{Y$=0;try{await n(async()=>{if(x.remoteConfig!==void 0)return;await b(s,!0)})}catch(z$){let H$=z$ instanceof Error?z$:Error(`Initial RemoteConfig application failed: ${String(z$)}`);D.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:H$.message}),E?.(H$),E=void 0}},async(s)=>{if(R)return;Y$+=1;let z$=nQ(Y$,c),H$=l1(s)??"RemoteConfig load failed",K$=dQ(s),j=C$(s,"code"),h=C$(s,"status"),P={attempt:Y$,error:s,errorKind:K$,maxDelayMs:c.maxDelayMs,message:H$,nextDelayMs:z$,code:typeof j==="string"?j:void 0,status:typeof h==="number"?h:void 0,path:typeof C$(s,"path")==="string"?C$(s,"path"):void 0,sourceType:typeof C$(s,"sourceType")==="string"?C$(s,"sourceType"):void 0};if(!cQ(s,K$)){let F=s instanceof Error?s:Error(`ConfigSource initial load failed with unrecoverable ${K$}: ${H$}`);D.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:K$,error:H$,code:P.code,status:P.status,path:P.path,sourceType:P.sourceType}),E?.(F),E=void 0;return}try{await aQ(P,o)}catch(F){let K=F instanceof Error?F:Error("ConfigSource retry hook stopped RemoteConfig retrying");E?.(K),E=void 0;return}g=setTimeout(G$,z$)})}return G$(),W}export{C3 as workloadHandler,i$ as workload,nJ as withSetCookies,iJ as verifyUser,G8 as vaultSocketDiagnostics,S4 as vaultConfig,P0 as vault,I1 as validateWorkloadToken,WQ as tenantMirror,m3 as tenantManager,c$ as subscribeSecretPathWithHttpPolling,cJ as sso,r6 as setVaultWebSocketCommandTimeout,lJ as sendTenantWebhook,FQ as secretConfigSource,uJ as sameOriginRedirectRules,H1 as routeRequest,a8 as rewriteRequestPath,g1 as rewriteRequestForTenantPath,RQ as rewriteRequestForDefaultTenantUi,EQ as rewriteRequestForDefaultTenantApi,S3 as revokeWorkloadToken,s8 as resolveTenantFromRequest,dJ as resolveRedirect,i6 as resolveDefaultRoute,pJ as resolveCapturedRedirect,gJ as resolveAfterRedirect,mJ as reconcileSubjectAccess,n0 as mirroredConfig,v1 as mirrorSecrets,fJ as listSsoClientIdsFromCookies,zJ as listGenerator,z0 as lfvVault,$Q as isVaultConfigWaitingForSecretError,ZQ as isVaultConfigInvalidPayloadError,hJ as isRedirectAllowed,ZJ as ionite,vJ as initiateLogin,yJ as iam,kJ as hasScope,CJ as hasRole,SJ as hasPermission,wJ as hasGroup,xJ as hasAnyScope,IJ as hasAny,TJ as hasAllScope,qJ as hasAll,PJ as has,w3 as getWorkloadToken,x3 as getWorkload,RJ as getUser,EJ as getCustomer,JJ as generateULID,y1 as gcpConfig,jJ as expandRoot,o4 as escapeScimFilterValue,DQ as envConfig,B0 as enforceEndpointAuthz,AJ as discoverSessions,NJ as discoverSessionRecords,g$ as deriveIonUrls,LJ as defaultRedirectPolicies,jQ as createTenantIonResolver,PQ as createTenantIonHandler,O1 as createSessionReadCache,Q1 as createManagedIamDelta,t$ as configSourceFromLocator,m8 as configSourceFromEnvValues,k4 as configLocatorFromEnvValues,f1 as configFromSource,OJ as collectReferencedDefinitions,z8 as closeAllVaultSockets,WJ as ciam,MJ as captureRedirect,FJ as callback,VJ as blockDangerousUrls,w4 as azureConfig,b1 as awsConfig,DJ as allowSameOrigin,KJ as allowRelativePaths,HJ as allowOrigins,BJ as allowHosts,w$ as VaultSubscribeNotSupportedError,D0 as VaultConfigWaitingForSecretError,s0 as VaultConfigInvalidPayloadError,N4 as VAULT_MIN_POLLING_TTL_MS,V4 as ScimOutboundClient,GJ as IoniteError,Q0 as InMemoryWorkloadTokenStore,t8 as InMemoryWorkloadIdentityStore,e0 as InMemoryUserStore,bJ as InMemoryTenantStore,o0 as InMemorySessionStore,S8 as InMemoryResourceStore,r0 as InMemoryMagicLinkStore,t0 as InMemoryCustomerStore,C8 as InMemoryAccessIndex,w8 as InMemoryAccessCatalogStore,n$ as InMemoryAccessAssignmentStore,x1 as ION_SDK_VERSION,yQ as ION_READY_DEFAULT_TIMEOUT_MS,X1 as ION_CAPABILITY_CATALOG_VERSION,p2 as ION_CAPABILITY_CATALOG,UJ as CatalogAdjacencyCache};
4
+ `;if(x==="r")return"\r";if(x==="t")return"\t";return x}):D}else Z[_]=B}return Z}function P1($){return Object.entries($).map(([Z,Q])=>{let X=String(Q??"");if(!X||/[\s#"'\\]/.test(X))return`${Z}=${JSON.stringify(X)}`;return`${Z}=${X}`}).join(`
5
+ `)}function q1($){try{let Z=atob($);return Uint8Array.from(Z,(Q)=>Q.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function K4($){if(!$||typeof $!=="object"||Array.isArray($))throw Error("Secret content is not an object");return $}function y0($){return $.metadata.contentType??R9()}function i4($,Z){if(Z==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof $.data==="string")return $.data;if(Z==="jsonc")return JSON.stringify($.data,null,2);if(Z==="env")return P1(K4($.data));let Q=K4($.data).content;if(typeof Q!=="string")throw Error(`Secret ${Z} content must contain a string "content" field`);return Q}function H4($,Z){if(Z==="jsonc")return typeof $.data==="string"?P9($.data):$.data;if(Z==="env")return typeof $.data==="string"?R1($.data):K4($.data);if(Z==="text")return i4($,Z);if(Z==="binary"){let Q=K4($.data).content_base64;if(typeof Q!=="string")throw Error('Binary secret content must contain a "content_base64" string');return q1(Q)}throw Error(`Typed ${Z} decoding is not supported yet; use text() or bytes()`)}function T9($){return{format:$.format,mimeType:$.mimeType,...$.schemaUrl?{schemaUrl:$.schemaUrl}:{},typeId:$.id}}function I9($,Z){let Q=y0($);if(Q.format!==Z.format||Q.mimeType!==Z.mimeType)throw new q9(T9(Z),Q)}async function x9($,Z){if(!$.schema)return Z;let Q=await $.schema["~standard"].validate(Z);if(Q.issues){let X=Q.issues.map((Y)=>Y.message).join("; ");throw Error(`Secret validation failed for type "${$.id}": ${X}`)}return Q.value}function h$($){return{async text(){let Z=await $();return i4(Z,y0(Z).format)},async json(){let Z=await $(),Q=y0(Z).format;if(Q!=="jsonc")throw Error(`json() requires a jsonc secret; received ${Q}`);return H4(Z,Q)},async bytes(){let Z=await $(),Q=y0(Z).format;if(Q==="binary")return H4(Z,Q);return new TextEncoder().encode(i4(Z,Q))},async env(){let Z=await $(),Q=y0(Z).format;if(Q!=="env")throw Error(`env() requires an env secret; received ${Q}`);return H4(Z,Q)},async metadata(){return(await $()).metadata},async parse(Z){let Q=await $();return I9(Q,Z),x9(Z,H4(Q,Z.format))}}}function I1($){try{return new URL($).pathname}catch{return $.startsWith("/")?$:`/${$}`}}var C9=1e4,k9=1e4,b9=300,x1=100;async function r4($){await new Promise((Z)=>setTimeout(Z,$))}function T$($){return{startedAt:Date.now(),timeout:typeof $?.timeout==="number"&&$.timeout>0?$.timeout:void 0}}function n4($){return typeof $==="number"&&Number.isInteger($)&&$>=1?{kms_slots:$}:{}}function f0($){if($.timeout===void 0)return;let Z=Date.now()-$.startedAt;return Math.max(0,$.timeout-Z)}function u$($,Z,Q){return Error(`LFV ${$} timed out after ${Q.timeout??0}ms for ${Z}`)}async function O0($,Z,Q,X,Y){let J=f0(Q);if(J!==void 0){if(J<=0)throw u$(X,Y,Q);let G=new AbortController,z=setTimeout(()=>G.abort(),J);try{return await fetch($,{...Z,signal:G.signal})}catch(_){if(_ instanceof Error&&_.name==="AbortError")throw u$(X,Y,Q);throw _}finally{clearTimeout(z)}}return await fetch($,Z)}class j$ extends Error{constructor($){super(`LFV source closed while operating on ${$}`);this.name="LfvSourceClosedError"}}class d$ extends Error{constructor($){super($);this.name="LfvProtocolError"}}class G0 extends d${status;constructor($,Z,Q){super(`LFV ${Z} failed (${$}) for ${Q}`);this.status=$;if(this.name="LfvActionStatusError",$===404)this.code="not_found"}code}var v9=new Set([400,401,403,404,409,410]);function w1($){return $ instanceof d$&&(!($ instanceof G0)||v9.has($.status))}function D4($){return $ instanceof j$||$ instanceof Error&&$.name==="LfvSourceClosedError"}function y9($,Z){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`LFV kms_park returned invalid payload for ${Z}`);let Q=$;if(typeof Q.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${Z}`);let X=Q.disposition;if(X!==void 0&&X!=="cooldown"&&X!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${Z}`);return{parked:Q.parked,...Q.stale===!0?{stale:!0}:{},...X?{disposition:X}:{}}}function h0($){try{let Z=JSON.parse($);return typeof Z==="object"&&Z!==null&&!Array.isArray(Z)?Z:void 0}catch{return}}async function s4($,Z,Q,X,Y,J,G,z,_,B){let H=0,D=Date.now();for(;;){if(B?.())throw new j$(X);let V=f0(Q);if(V!==void 0&&V<=0)throw u$(Y,X,Q);try{return await $()}catch(x){if(x instanceof j$)throw x;if(B?.())throw new j$(X);if(H+=1,G>0&&Date.now()-D>=G){let P=`Error connecting to the LFV source. Retries: '${H}'`;if(z)z(_,P,{url:Z,path:X,operation:Y});D=Date.now()}let T=V===void 0?J:Math.min(J,V);if(T<=0)throw u$(Y,X,Q);if(await r4(T),B?.())throw new j$(X)}}}function h9($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function a4($){if(typeof $==="number"&&Number.isFinite($))return $;if(typeof $==="string"&&$.trim()){let Z=Date.parse($.trim());if(!Number.isNaN(Z))return Z}return}function S1($){return`[LFV] [${$??"-"}] [${new Date().toISOString()}]: `}function t4($,Z){if(typeof $!=="string"||$.trim()==="")throw Error(`LFV source requires "${Z}"`);return $}function f9($){return{...$,lfvServerUrl:t4($.lfvServerUrl,"lfvServerUrl"),clientId:t4($.clientId,"clientId"),path:t4($.path,"path")}}function z0($,Z,Q={}){let X=f9($),Y=X.log??w9,J=(U,C,y)=>{let m=S1(U)+C;if(y!==void 0)Y.debug(m,y);else Y.debug(m)},G=(U,C,y)=>{let m=S1(U)+C;if(y!==void 0)Y.warn(m,y);else Y.warn(m)},z=X.lfvServerUrl,_=X.clientId,B=X.path,H=X.verifyJwks,D=typeof X.deliveryTimeout==="number"&&X.deliveryTimeout>0?X.deliveryTimeout:void 0,V=typeof X.retryInterval==="number"&&X.retryInterval>0?X.retryInterval:C9,x=typeof X.warnInterval==="number"&&X.warnInterval>=0?X.warnInterval:k9,T=(typeof X.callbackMaxAgeSeconds==="number"&&X.callbackMaxAgeSeconds>0?X.callbackMaxAgeSeconds:b9)*1000,P=typeof X.cacheMaxAgeSeconds==="number"&&X.cacheMaxAgeSeconds>0?X.cacheMaxAgeSeconds*1000:void 0,I=H?.trim()?S9(H.trim()):void 0,O=I1(X.deliveryEndpoint),q=I1(X.eventsEndpoint),M=B4({lfvServerUrl:z,path:B}),E=crypto.randomUUID(),f=new Map,g=new Set,a=new Map,X$=new Map,e=new Map,n=new Map,r=new Map,Q$=new Map,A=new Map,W=(U,C)=>{if(typeof C==="number"&&Number.isInteger(C)&&C>=1){let y=A.get(U)??1,m=Math.max(y,C);return A.set(U,m),m}return A.get(U)},L=(U,C)=>typeof C==="number"&&Number.isInteger(C)&&C>=1&&C>(A.get(U)??1),k=new Map,w=new Map,b=!1,u,c=new Set,o=()=>b;function Y$(U,C){a.set(U,C),X$.set(U,Date.now())}function G$(U){a.delete(U),X$.delete(U)}function s(U){let C=a.get(U);if(!C)return;if(P!==void 0){let y=X$.get(U)??0;if(Date.now()-y>P){J(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:U});return}}return C}function z$(){return g.size>0||f.size>0||Q$.size>0}function H$(){if(b){if(u)u(),u=void 0;return}let U=z$();if(U&&!u)u=A1(M,E,{trustId:I,onDelivery:async(C)=>{return r6(C).handled||await e6(C)},onEvents:async(C)=>{$1(C)}});if(!U&&u)u(),u=void 0}async function K$(U,C,y,m){if(!Z)throw Error("LFV callback transport is not configured");for(;;){if(b)throw new j$(C);if(m())throw new j$(C);let l=await Z.take(U);if(l){if(l.key!==M)G(U,"parked OTP callback rejected: callback key mismatch");else if(!await b4(l.rawBody,l.headers)){let B$=h0(l.rawBody);if(B$?.type==="otp"&&B$.request_id===U&&typeof B$.otp==="string"&&B$.otp)return B$.otp}}let p=f0(y);if(p!==void 0&&p<=0)throw u$("issueOtp",C,y);await r4(p===void 0?x1:Math.min(x1,p))}}async function j(U,C){let y=C??crypto.randomUUID(),m={startedAt:Date.now(),timeout:D},l={request_id:y,path:U,action:"read_secret",...n4(W(U))},p=await s4(()=>O0(`${z.replace(/\/+$/g,"")}/clients/${_}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":y},body:JSON.stringify(l)},m,"issueOtp",U),z,m,U,"issueOtp",V,x,G,y,o);if(p.status!==200&&p.status!==202)throw new G0(p.status,"issueOtp",U)}async function h(U,C){let y=w.get(U);if(y)return y;let m=j(U,C);w.set(U,m);try{await m}finally{if(w.get(U)===m)w.delete(U)}}async function R(U,C,y,m){if(b)throw new j$(U);let l=y??crypto.randomUUID(),p=m??T$(),Z$=new Promise((P$,k0)=>{let Z1={resolve:P$,reject:k0},v4=f0(p);if(v4!==void 0){if(v4<=0){k0(u$("issueOtp",U,p));return}Z1.timer=setTimeout(()=>{Q$.delete(l),H$(),k0(u$("issueOtp",U,p))},v4)}Q$.set(l,Z1),H$()});Z$.catch(()=>{});let B$=()=>{let P$=Q$.get(l);if(!P$)return;if(P$.timer)clearTimeout(P$.timer);Q$.delete(l),H$()},J$={request_id:l,path:U,action:C,...n4(W(U))};J(l,"OTP request",{path:U,action:C});let M$;try{M$=await s4(async()=>{return await O0(`${z.replace(/\/+$/g,"")}/clients/${_}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":l},body:JSON.stringify(J$)},p,"issueOtp",U)},z,p,U,"issueOtp",V,x,G,l,o)}catch(P$){throw B$(),P$}if(M$.status!==200&&M$.status!==202)throw B$(),new G0(M$.status,"issueOtp",U);let L$=!1,W$=Z?K$(l,U,p,()=>L$):void 0;if(W$)W$.catch(()=>{});try{let P$=await(W$?Promise.race([Z$,W$]):Z$);return J(l,"OTP received via signed callback",{path:U,action:C}),P$}finally{L$=!0,B$()}}async function F(U,C,y,m,l,p,Z$){if(b)throw new j$(C);let B$=Z$??T$(),J$=await s4(async()=>{return await O0(`${z.replace(/\/+$/g,"")}${U}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":l},body:JSON.stringify({request_id:l,otp:m,path:C,...n4(W(C)),...p??{}})},B$,y,C)},z,B$,C,y,V,x,G,l,o);if(J$.status!==200&&J$.status!==202)throw new G0(J$.status,y,C);return J(l,`${y} accepted`,{path:C,status:J$.status}),J$}async function K(U,C,y,m,l,p){if(b)throw new j$(C);let Z$=l??crypto.randomUUID(),B$=p??T$(),J$=await R(C,y,Z$,B$),M$=await F(U,C,y,J$,Z$,m,B$);return{requestId:Z$,response:M$}}async function N(U,C,y){if(b)throw new j$(U);let m=L(U,y?.kmsSlots);if(W(U,y?.kmsSlots),m)G$(U);let l=s(U);if(l)return l;let p=k.get(U);if(p){if(!m)return p;if(await p.catch(()=>{return}),p=k.get(U),p)return p}let Z$=S(U,C,y);k.set(U,Z$),Z$.catch((B$)=>{if(D4(B$))J(C,"read aborted: source closed",{path:U})});try{return await Z$}finally{k.delete(U)}}async function S(U,C,y){let m=y?.timeout??D,l={startedAt:Date.now(),timeout:typeof m==="number"&&m>0?m:void 0},p=C??crypto.randomUUID();J(p,"read_secret request",{path:U});let Z$=0,B$=Date.now();for(;;){if(b)throw new j$(U);try{let{response:J$}=await K("/secrets/request",U,"read_secret",void 0,p,l),M$=await v(p,J$),L$=i(U,M$);return d(U,L$,L$.metadata.version),J(p,"read_secret completed from action response",{path:U}),L$}catch(J$){if(J$ instanceof j$)throw J$;if(w1(J$))throw J$;let M$=f0(l);if(M$!==void 0&&M$<=0)throw u$("read_secret",U,l);if(Z$+=1,x>0&&Date.now()-B$>=x)G(p,`read_secret retrying. Retries: '${Z$}'`,{path:U}),B$=Date.now();let L$=M$===void 0?V:Math.min(V,M$);if(L$<=0)throw u$("read_secret",U,l);await r4(L$)}}}async function v(U,C){if(!H?.trim())throw new d$("LFV read_secret response verification is not configured");let y=C.headers.get("X-LFV-Request-Id")?.trim(),m=C.headers.get("X-LFV-Key-Id")?.trim(),l=C.headers.get("X-LFV-Signature")?.trim();if(!y||!m||!l)throw new d$("LFV read_secret response is missing signature headers");if(y!==U)throw new d$("LFV read_secret response request_id header does not match the request");let p=await C.text();if(!await T1({jwks:H,kid:m,signatureB64Url:l,requestId:U,rawBody:p}))throw new d$("LFV read_secret response signature verification failed");let B$=h0(p);if(!B$||B$.request_id!==U)throw new d$("LFV read_secret response request_id does not match the request");return B$}function i(U,C){if(t6(C)!==U||C.data?.data===void 0)throw new d$(`LFV read_secret returned an invalid secret response for ${U}`);let m=C.data.metadata??{},l=typeof m.version==="number"?m.version:0,p=m.created_time??m.created,Z$=J0(m);return{data:C.data.data,metadata:{path:U,version:l,created:typeof p==="string"?new Date(p):new Date,...Z$?{contentType:Z$}:{}}}}function d(U,C,y){if(y!==void 0){let p=n.get(U);if(p!==void 0&&y<p){J(void 0,"delivery ignored: stale version",{path:U,realVersion:y,lastAccepted:p});return}n.set(U,y)}Y$(U,C),c.delete(U);let m=C.metadata.version;if(e.get(U)===m)return;e.set(U,m);let l=f.get(U);if(!l)return;for(let p of l)p(C)}async function $$(U,C){return await N(U,void 0,C)}async function t(U,C,y){if(!h9(C))throw Error(`putSecret requires an object value for LFV source at path ${U}`);let m=T$(y),l={data:C,content_type:_4(y.contentType)};if(await Z0(U,y)){await K("/secrets/update",U,"update_secret",l,void 0,m),G$(U);return}await K("/secrets/create",U,"create_secret",l,void 0,m),G$(U)}async function F$(U,C){let y=T$(C);await K("/secrets/delete",U,"delete_secret",void 0,void 0,y),G$(U)}async function _$(U,C){let y=T$(C),m=crypto.randomUUID();J(m,"list_paths request",{path:U});let l=await R(U,"list_paths",m,y),p=await O0(`${z.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":m},body:JSON.stringify({request_id:m,otp:l,path:U})},y,"listPaths",U);if(p.status!==200)throw Error(`LFV listPaths failed (${p.status}) for ${U}`);let Z$=await p.json();if(!Array.isArray(Z$.items))throw Error(`LFV listPaths returned invalid payload for ${U}`);return J(m,"list_paths success",{path:U,status:200}),Z$.items.filter((B$)=>typeof B$==="string")}async function Z0(U,C){let y=T$(C),m=crypto.randomUUID();J(m,"exists request",{path:U});let l=await R(U,"read_metadata",m,y),p=await O0(`${z.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":m},body:JSON.stringify({request_id:m,otp:l,path:U})},y,"exists",U);if(p.status!==200)throw Error(`LFV exists failed (${p.status}) for ${U}`);let Z$=await p.json();if(typeof Z$.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${U}`);return J(m,"exists success",{path:U,status:200,exists:Z$.exists}),Z$.exists}async function m$(U,C,y){let m=T$(y);await K("/secrets/rotate/request",U,"request_rotate",{reason:C?.reason,severity:C?.severity,incident_ref:C?.incidentRef},void 0,m)}async function C0(U,C,y){let m=T$(y);await K("/secrets/revoke/request",U,"request_revoke",{reason:C?.reason,severity:C?.severity,incident_ref:C?.incidentRef},void 0,m)}async function U2(U,C,y){let m=T$(y),{response:l}=await K("/secrets/kms/park",U,"kms_park",{key_id:C.keyId,status:C.status,reason:C.reason},void 0,m);return y9(await l.json().catch(()=>null),U)}function F2(U,C){if(!U||typeof U!=="object"||Array.isArray(U))throw Error(`LFV kms_add_keys returned invalid payload for ${C}`);let y=U;if(!Array.isArray(y.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${C}`);return{keys:y.keys.map((l,p)=>{if(!l||typeof l!=="object"||Array.isArray(l))throw Error(`LFV kms_add_keys returned invalid keys[${p}] for ${C}`);let Z$=l.id;if(typeof Z$!=="string"||Z$.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${p}].id for ${C}`);return{id:Z$}})}}function M2(U,C){if(!U||typeof U!=="object"||Array.isArray(U))throw Error(`LFV kms_revoke_key returned invalid payload for ${C}`);let y=U;if(typeof y.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${C}`);return{revoked:y.revoked}}async function W2(U,C,y){let m=T$(y),{response:l}=await K("/secrets/kms/add-keys",U,"kms_add_keys",{keys:C.keys},void 0,m);return F2(await l.json().catch(()=>null),U)}async function O2(U,C,y){let m=T$(y),{response:l}=await K("/secrets/kms/revoke-key",U,"kms_revoke_key",{key_id:C.keyId,reason:C.reason},void 0,m);return M2(await l.json().catch(()=>null),U)}async function L2(U,C){let y=T$(C),m=crypto.randomUUID();J(m,"getMetadata request",{path:U});let l=await R(U,"read_metadata",m,y),p=await O0(`${z.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":m},body:JSON.stringify({request_id:m,otp:l,path:U})},y,"getMetadata",U);if(p.status!==200)throw Error(`LFV getMetadata failed (${p.status}) for ${U}`);let Z$=await p.json();if(!Z$.metadata||typeof Z$.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${U}`);return J(m,"getMetadata success",{path:U,status:200}),Z$.metadata}async function a6(U,C,y,m=!0){let l=f.get(U)??new Set,p,Z$=(J$)=>{if(J$.metadata.version===p)return;p=J$.metadata.version,C(J$)};if(l.add(Z$),f.set(U,l),!m)return H$(),()=>{let J$=f.get(U);if(!J$)return;if(J$.delete(Z$),J$.size===0)f.delete(U);H$()};let B$=L(U,y?.kmsSlots)?void 0:s(U);if(B$)Z$(B$),e.set(U,B$.metadata.version);else try{Z$(await $$(U,y))}catch(J$){if(l.delete(Z$),l.size===0)f.delete(U);throw J$}return H$(),()=>{let J$=f.get(U);if(!J$)return;if(J$.delete(Z$),J$.size===0)f.delete(U);H$()}}let N2=(U,C)=>a6(U,C,void 0,!1);function A2(U){return U.method==="POST"&&new URL(U.url).pathname===O}function j2(U){return U.method==="POST"&&new URL(U.url).pathname===q}function t6(U){let C=U.data?.metadata?.path;if(typeof C==="string"&&C)return C;if(typeof U.path==="string"&&U.path)return U.path;return}function E2(U){let{request_id:C,otp:y}=U;if(typeof C!=="string"||typeof y!=="string"||!y)return{handled:!1};let m=Q$.get(C);if(!m)return{handled:!1};if(m.timer)clearTimeout(m.timer);return Q$.delete(C),H$(),m.resolve(y),{handled:!0}}function r6(U){return U.type==="otp"?E2(U):{handled:!1}}function r$(U="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:U}),{status:401,headers:{"Content-Type":"application/json"}})}function o6(U){return{requestId:U.headers.get("X-LFV-Request-Id")??U.headers.get("x-lfv-request-id")??"",keyId:U.headers.get("X-LFV-Key-Id")??U.headers.get("x-lfv-key-id")??"",signature:U.headers.get("X-LFV-Signature")??U.headers.get("x-lfv-signature")??""}}async function b4(U,C){if(!H?.trim())return G(void 0,"LFV callback rejected: verifyJwks is not configured"),r$("LFV callback verification is not configured");let{requestId:y,keyId:m,signature:l}=C;if(!y.trim()||!m.trim()||!l.trim())return G(y||void 0,"LFV callback rejected: missing signature headers"),r$("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await T1({jwks:H,kid:m,signatureB64Url:l.trim(),requestId:y.trim(),rawBody:U}))return G(y,"LFV callback rejected: signature verification failed"),r$();let Z$=h0(U);if(!Z$)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let B$=Z$;if(B$.request_id!==y.trim())return G(y,"LFV callback rejected: request_id header/body mismatch"),r$("X-LFV-Request-Id does not match request_id in body");let J$=Date.now(),M$=a4(B$.issued_at);if(M$===void 0)return G(y,"LFV callback rejected: missing or invalid issued_at"),r$("Missing or invalid issued_at");if(J$-M$>T)return G(y,"LFV callback rejected: stale (outside freshness window)"),r$("Callback is stale (issued_at outside freshness window)");let L$=a4(B$.expires_at);if(L$!==void 0&&J$>L$)return G(y,"LFV callback rejected: expired"),r$("Callback has expired");let W$=l.trim();for(let[P$,k0]of r)if(k0<=J$)r.delete(P$);if(r.has(W$))return G(y,"LFV callback rejected: replayed signature"),r$("Callback signature already processed (replay)");return r.set(W$,M$+T),null}async function e6(U){if(!Q.selfRedeemReads||U.action!=="read_secret"||typeof U.request_id!=="string"||typeof U.path!=="string"||typeof U.otp!=="string")return!1;let C={startedAt:Date.now(),timeout:D},y=await F("/secrets/request",U.path,"read_secret",U.otp,U.request_id,void 0,C),m=await v(U.request_id,y),l=i(U.path,m);return d(U.path,l,l.metadata.version),!0}async function R2(U){let C=await U.text(),y=o6(U),m=await b4(C,y);if(m)return m;let l=h0(C);if(!l)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let p=l;if(p.type!=="otp"||typeof p.request_id!=="string"||typeof p.otp!=="string"||typeof p.path!=="string"||typeof p.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let Z$=t6(p);J(p.request_id,"delivery received",{path:Z$});let B$=r6(p),J$=Z$?B4({lfvServerUrl:z,path:Z$}):M,M$=await j1(J$,p,E,I),L$=B$.handled||M$>0;if(!L$)try{if(L$=await e6(p),!L$&&Z&&typeof p.request_id==="string"){let W$=a4(p.expires_at),P$=Math.max(1,(W$??Date.now()+T)-Date.now());await Z.put(p.request_id,{kind:"delivery",key:J$,rawBody:C,headers:y},P$),L$=!0}}catch(W$){if(w1(W$)){if(!(W$ instanceof G0)||W$.status!==409&&W$.status!==410)c.add(p.path);return G(y.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:J$,status:W$ instanceof G0?W$.status:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:{"Content-Type":"application/json"}})}return r.delete(y.signature.trim()),G(y.requestId,"LFV callback handoff failed; callback may be retried",{key:J$,error:W$ instanceof Error?W$.message:String(W$)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(!L$)return r.delete(y.signature.trim()),G(y.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:J$}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function $1(U){if(b)return;if(!U?.path||typeof U.path!=="string")return;J(U.request_id,"events payload",{path:U.path,event:U.event});for(let C of g)try{C({path:U.path,event:U.event,requestId:U.request_id,issuedAt:U.issued_at,expiresAt:U.expires_at,...typeof U.key_id==="string"&&U.key_id.length>0?{keyId:U.key_id}:{}})}catch(y){G(U.request_id,"secret event listener failed",{path:U.path,event:U.event,error:y instanceof Error?y.message:String(y)})}if(U.event==="created"||U.event==="updated"||U.event==="rotated")G$(U.path),(Q.selfRedeemReads?h(U.path,U.request_id):N(U.path,U.request_id).then(()=>{return})).catch((y)=>{if(D4(y)){J(U.request_id,"event refresh aborted: source closed",{path:U.path});return}c.add(U.path),G(U.request_id,"event-triggered refresh failed; source marked degraded",{path:U.path,event:U.event,error:y instanceof Error?y.message:String(y)})})}async function P2(U){let C=await U.text(),y=o6(U),m=await b4(C,y);if(m)return m;let l=h0(C);if(!l)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let p=l;if(!p?.path||typeof p.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});J(p.request_id,"events received",{path:p.path,event:p.event}),$1(p);let Z$=B4({lfvServerUrl:z,path:p.path});return await E1(Z$,p,E,I),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function q2(){if(b)return;if(b=!0,u)u(),u=void 0;let U=new j$(B);for(let C of Q$.values()){if(C.timer)clearTimeout(C.timer);try{C.reject(U)}catch{}}Q$.clear(),k.clear(),w.clear(),c.clear(),a.clear(),X$.clear(),e.clear(),n.clear(),r.clear(),f.clear(),g.clear()}return{type:"vault",isAvailable:()=>c.size===0,get:(U,C)=>h$(()=>$$(U,C)),getFullSecret:$$,getSecret:async(U,C)=>{return(await $$(U,C)).data},putSecret:t,deleteSecret:F$,listPaths:_$,exists:Z0,requestRotate:m$,requestRevoke:C0,parkKmsKey:U2,addKmsKeys:W2,revokeKmsKey:O2,getMetadata:L2,subscribe:a6,subscribePassive:N2,subscribeEvents:(U)=>{return g.add(U),H$(),()=>{g.delete(U),H$()}},close:q2,isDeliveryRequest:A2,isEventsRequest:j2,handleDelivery:R2,handleEvents:P2,deliveryPath:O,eventsPath:q,callbackKey:M,trustId:I}}function _0($,Z,Q){if(typeof $!=="string"||$.trim()==="")throw Error(`"${Z}" is required when using ${Q}`);return $}var L0="__esLfvBootstrap";import{catalogEntityStore as $6,listGenerator as Z6,materializeCodeCatalogEntity as d9,unionCatalogRead as u9}from"@ionite/core";import{baseUserToScimUser as k1,entitlementToScimGroup as Q6}from"@ionite/core/server";import{ION_AUTHZ_GROUP_SCHEMA as o4}from"@ionite/core";var C1="application/scim+json",m9="urn:ietf:params:scim:api:messages:2.0:PatchOp",g9="urn:ietf:params:scim:schemas:core:2.0:User",p9="urn:ietf:params:scim:schemas:core:2.0:Group";async function m0($){try{let Z=(await $.clone().text()).trim();return Z?Z.slice(0,2000):void 0}catch{return}}function g0($){return $==="user"?"Users":"Groups"}function e4($){return $.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class V4{baseUrl;getToken;receipts;log;fetchImpl;inflight=new Map;memo=new Map;writes=new Map;constructor($){this.baseUrl=$.baseUrl.replace(/\/$/,""),this.getToken=$.getToken,this.receipts=$.receipts,this.log=$.log,this.fetchImpl=$.fetchImpl??((Z,Q)=>fetch(Z,Q))}async headers(){let $=await this.getToken();return new Headers({"Content-Type":C1,Accept:C1,Authorization:`Bearer ${$}`})}inflightKey($,Z,Q){return`${$}\x00${Z}\x00${Q?"create":"lookup"}`}receiptKey($,Z){return`${$}\x00${Z}`}serializeWrite($,Z,Q){let X=`${$}\x00${Z}`,J=(this.writes.get(X)??Promise.resolve()).catch(()=>{return}).then(Q);this.writes.set(X,J);let G=()=>{if(this.writes.get(X)===J)this.writes.delete(X)};return J.then(G,G),J}async resolveProviderId($,Z,Q){let X=this.receiptKey($,Z),Y=this.memo.get(X);if(Y)return{found:Y.providerId,requestUrl:Y.requestUrl};let J=await this.receipts.read($,Z);if(J)this.memo.set(X,J);if(J)return{found:J.providerId,requestUrl:J.requestUrl};let G=this.inflightKey($,Z,Q!==void 0),z=this.inflight.get(G);if(z)return z;let _=this.resolveUncached($,Z,Q).then(async(B)=>{if(typeof B==="object"){let H={providerId:B.found,...B.requestUrl?{requestUrl:B.requestUrl}:{}};await this.receipts.write($,Z,H),this.memo.set(X,H)}return B}).finally(()=>{this.inflight.delete(G)});return this.inflight.set(G,_),_}async resolveUncached($,Z,Q){let X=await this.filterByExternalId($,Z);if(X!=="absent")return X;if(!Q)return"absent";return this.create($,Z,Q)}async filterByExternalId($,Z){let Q=encodeURIComponent(`externalId eq "${e4(Z)}"`),X=`${this.baseUrl}/${g0($)}?filter=${Q}`,Y=await this.fetchImpl(X,{method:"GET",headers:await this.headers()});if(!Y.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:$,status:Y.status,detail:await m0(Y)}),"error";let G=((await Y.json()).Resources??[])[0];return G?.id?{found:G.id,...this.requestUrl($,G)}:"absent"}async create($,Z,Q){let X=`${this.baseUrl}/${g0($)}`,Y=this.writeBody($,Z,Q),J=await this.fetchImpl(X,{method:"POST",headers:await this.headers(),body:JSON.stringify(Y)});if(!J.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:$,status:J.status,detail:await m0(J)}),"error";let G=await J.json();return G.id?{found:G.id,...this.requestUrl($,G),created:!0}:"error"}requestUrl($,Z){if($!=="group")return{};let Q=Z[o4];if(!Q||typeof Q!=="object")return{};let X=Q.requestUrl;return typeof X==="string"&&X?{requestUrl:X}:{}}async captureResponseReference($,Z,Q,X,Y){try{let J=await $.clone().json(),G=this.requestUrl(Z,J).requestUrl;if(!G&&J.id===void 0)return;let z=G??Y,_={providerId:J.id??X,...z?{requestUrl:z}:{}};await this.receipts.write(Z,Q,_),this.memo.set(this.receiptKey(Z,Q),_)}catch{}}async invalidate($,Z){this.memo.delete(this.receiptKey($,Z)),await this.receipts.clear($,Z)}writeBody($,Z,Q){let{id:X,meta:Y,...J}=Q,G=J,z=G[o4];if(z&&typeof z==="object"&&!Array.isArray(z)){let{providerId:_,requestUrl:B,...H}=z;G[o4]=H}return{...J,schemas:(Q.schemas?.length??0)>0?Q.schemas:[$==="user"?g9:p9],externalId:Z}}async upsertResource($,Z,Q){return this.serializeWrite($,Z,()=>this.upsertResourceNow($,Z,Q))}async upsertResourceNow($,Z,Q){let X=async(J)=>{let G=await this.resolveProviderId($,Z,J?Q:void 0);if(G==="error")return"error";if(G==="absent")return"skipped";if(G.created)return"pushed";let z=await this.fetchImpl(`${this.baseUrl}/${g0($)}/${encodeURIComponent(G.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody($,Z,Q))});if(z.status===404||z.status===410)return"stale";if(z.ok)return await this.captureResponseReference(z,$,Z,G.found,G.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:$,status:z.status,detail:await m0(z)}),"error"},Y=await X(!0);if(Y==="stale")await this.invalidate($,Z),Y=await X(!0);return Y==="stale"?"error":Y}async deleteResource($,Z){return this.serializeWrite($,Z,()=>this.deleteResourceNow($,Z))}async deleteResourceNow($,Z){let Q=async()=>{let Y=await this.resolveProviderId($,Z);if(Y==="error")return{outcome:"error"};if(Y==="absent")return{outcome:"pushed"};let J=await this.fetchImpl(`${this.baseUrl}/${g0($)}/${encodeURIComponent(Y.found)}`,{method:"DELETE",headers:await this.headers()});if(J.status===404||J.status===410)return{outcome:"pushed",stale:!0};if(J.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:$,status:J.status,detail:await m0(J)}),{outcome:"error"}},X=await Q();if(X.stale)await this.invalidate($,Z),X=await Q();if(X.outcome==="pushed")await this.invalidate($,Z);return X.outcome}async patchGroupMembership($){return this.serializeWrite("group",$.groupExternalId,()=>this.patchGroupMembershipNow($))}async patchGroupMembershipNow($){let{groupExternalId:Z,userExternalId:Q,op:X}=$,Y=await this.resolveProviderId("user",Q,X==="add"?$.userCreate:void 0);if(Y==="error")return this.log.warn("IAM delta: user lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(Y==="absent")return this.log.warn("IAM delta: user not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let J=Y.found,G=async(B)=>{let H=await this.resolveProviderId("group",Z,X==="add"&&B?$.groupCreate:void 0);if(H==="error")return{kind:"error"};if(H==="absent")return{kind:"absent"};let D=`${this.baseUrl}/${g0("group")}/${encodeURIComponent(H.found)}`,V=X==="add"?[{op:"add",path:"members",value:[{value:J,type:$.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${e4(J)}"]`}];return{kind:"response",response:await this.fetchImpl(D,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[m9],Operations:V})}),providerId:H.found,requestUrl:H.requestUrl}},z=await G(!0);if(z.kind==="response"&&(z.response.status===404||z.response.status===410))await this.invalidate("group",Z),z=await G(!1);if(z.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X}),"error";if(z.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:X}),"skipped";let _=z.response;if(!_.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:X,status:_.status,detail:await m0(_)}),"error";return await this.captureResponseReference(_,"group",Z,z.providerId,z.requestUrl),"pushed"}}function p0($){if(typeof $==="string")return $;if($&&typeof $==="object"&&"id"in $)return $.id;return}function U4($){return $&&typeof $==="object"?$:void 0}function X6($){let Z={},Q={},X,Y,J,G,z,_,B,H=()=>{if(Z.mode!=="patch")return"delta mode is not 'patch'";if(!Z.url)return"destination URL is not configured";if(!Q.workload)return"workload identity is not configured";if(typeof Q.workload.isReady!=="function"||typeof Q.workload.ready!=="function")return"workload handle violates the readiness contract";if(!Q.workload.isReady())return"workload module is not ready";if(Z.audience){let A=Q.workload[Z.audience];if(!A)return`outgoing workload client "${Z.audience}" is not configured`;if(typeof A.isReady!=="function"||typeof A.ready!=="function")return`outgoing workload client "${Z.audience}" violates the readiness contract`;if(!A.isReady())return`outgoing workload client "${Z.audience}" is not ready`}if(!Q.userStore)return"user store is not configured for IAM destination receipts";if(!Q.catalogStore)return"catalog store is not configured for IAM destination receipts";return},D=()=>H()===void 0,V=U$("IAM delta",D),x=async()=>{let A=Q.workload;if(!A)throw Error("IAM delta: workload identity not configured");if(Z.audience&&typeof A.getToken==="function")return A.getToken(Z.audience);if(typeof A.getServerToken==="function")return A.getServerToken();return A.getToken()},T=()=>u9(Q.codeCatalog,Q.catalogStore),P=async(A,W)=>{let L=Q.catalogStore;if(!L)return;let k=Q.codeCatalog?.groups.get(A)??Q.codeCatalog?.roles.get(A)??Q.codeCatalog?.permissions.get(A);if(k){let b=Q.codeCatalog?.groups.get(k.id)?"group":Q.codeCatalog?.roles.get(k.id)?"role":"permission",u=$6(L,b),c=await u.get(k.id);if(!c&&W)await d9(b,k,u),c=await u.get(k.id);if(c)return{kind:b,entity:c}}let w=[["group",L.groups],["role",L.roles],["permission",L.permissions]];for(let[b,u]of w){let c=await u.get(A);if(c)return{kind:b,entity:c}}return},I=async(A)=>{let W=Q.userStore;if(!W)return;if(W.getByExternalId)return W.getByExternalId(A);for await(let L of Z6((k,w)=>W.list({start:k,limit:w})))if(L.externalId===A)return L;return},O=(A)=>A?.providerId?{providerId:A.providerId,...A.requestUrl?{requestUrl:A.requestUrl}:{}}:void 0,q={async read(A,W){if(A==="user")return O(await I(W));return O((await P(W,!1))?.entity)},async write(A,W,L){if(A==="user"){let b=await I(W);if(!b||b.providerId===L.providerId&&b.requestUrl===L.requestUrl)return;await Q.userStore?.upsert({...b,providerId:L.providerId,requestUrl:L.requestUrl});return}let k=await P(W,!0);if(!k||k.entity.providerId===L.providerId&&k.entity.requestUrl===L.requestUrl)return;await $6(Q.catalogStore,k.kind).set({...k.entity,providerId:L.providerId,requestUrl:L.requestUrl}).ready()},async clear(A,W){if(A==="user"){let c=await I(W);if(!c||c.providerId===void 0&&c.requestUrl===void 0)return;let{providerId:o,requestUrl:Y$,...G$}=c;await Q.userStore?.upsert(G$);return}let L=await P(W,!1);if(!L||L.entity.providerId===void 0&&L.entity.requestUrl===void 0)return;let{providerId:k,requestUrl:w,...b}=L.entity;await $6(Q.catalogStore,L.kind).set(b).ready()}},M=()=>{if(!D()||!Z.url)return;let A=Z.url;if(X&&Y===A&&J===Q.catalogStore&&G===Q.userStore&&z===Q.codeCatalog&&_===Q.fetchImpl)return X;return X=new V4({baseUrl:Z.url,getToken:x,receipts:q,log:$,fetchImpl:Q.fetchImpl}),Y=A,J=Q.catalogStore,G=Q.userStore,z=Q.codeCatalog,_=Q.fetchImpl,X},E=async(A)=>{if(A.subjectType==="workload"){let w=p0(A.subject),b=U4(A.subject);if(!b&&w)b=await Q.workloadIdentityStore?.get(w);if(!b?.externalId)return;return{externalId:b.externalId,create:{schemas:["urn:ietf:params:scim:schemas:core:2.0:User"],externalId:b.externalId,userName:b.clientId??b.id,displayName:b.displayName??b.clientId??b.id,active:b.active??!0}}}let L=U4(A.subject);if(!L){let w=p0(A.subject);if(w&&Q.userStore)L=await Q.userStore.get(w)}let k=L?.externalId;if(!L||!k)return;return{externalId:k,create:await(Q.mapUserToScim?.(L)??k1(L))}},f=async(A)=>{let L=U4(A.target);if(!L){let k=p0(A.target),w=T();if(k&&w)L=A.targetType==="role"?await w.roles.get(k):A.targetType==="permission"?await w.permissions.get(k):await w.groups.get(k)}if(L&&L.requestable!==!0)return"not-requestable";if(!L)return;return{externalId:L.id,create:Q6(L,A.targetType)}},g=async(A,W)=>{if(!D())return"skipped";let L=await E(A),k=await f(A);if(k==="not-requestable")return"skipped";if(!L||!k)return $.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:W,hasSubject:Boolean(L),hasTarget:Boolean(k),targetType:A.targetType}),"skipped";let w=M();if(!w)return"skipped";return w.patchGroupMembership({groupExternalId:k.externalId,userExternalId:L.externalId,op:W,groupCreate:k.create,userCreate:L.create,memberType:A.subjectType==="workload"?"Workload":"User"})},a=async(A,W,L)=>{let k=[],w=new Set,b=(c)=>{let o=`${c.type??"User"}\x00${c.value}`;if(!w.has(o))w.add(o),k.push(c)},u=Q.accessStore;if(u)for await(let c of Z6((o,Y$)=>u.listByTarget(W,A.id,{start:o,limit:Y$}))){let o=await E(c);if(!o){$.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:A.id,targetType:W});continue}let Y$=await L.resolveProviderId("user",o.externalId,o.create);if(Y$==="error")throw Error(`IAM delta failed to resolve access subject for ${W}:${A.id}`);if(Y$==="absent")continue;let G$=c.metadata;b({value:Y$.found,type:c.subjectType==="workload"?"Workload":"User",...G$?.display?{display:G$.display}:{}})}if(W==="group"){let c=T();for(let o of A.groups??[]){let Y$=p0(o),G$=U4(o);if(!G$&&Y$)G$=await c?.groups.get(Y$);if(G$&&G$.requestable!==!0)continue;if(!G$){$.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:Y$,target:A.id});continue}let s=await L.resolveProviderId("group",G$.id,Q6(G$,"group"));if(s==="error")throw Error(`IAM delta failed to resolve nested Group for group:${A.id}`);if(s!=="absent")b({value:s.found,type:"Group"})}}return k.length>0?k:void 0},X$=async(A)=>{if(!D())return"skipped";let W=A.externalId;if(!W)return $.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:A.id,kind:"user"}),"skipped";let L=M();if(!L)return"skipped";let k=await(Q.mapUserToScim?.(A)??k1(A));return L.upsertResource("user",W,k)},e=async(A,W,L=!0)=>{if(!D())return"skipped";if(A.requestable!==!0)return"skipped";let k=M();if(!k)return"skipped";let w=await a(A,W,k),b=await k.upsertResource("group",A.id,Q6(A,W,w)),u=Q.accessStore;if(b!=="pushed"||!L||!u)return b;for await(let c of Z6((o,Y$)=>u.listByTarget(W,A.id,{start:o,limit:Y$})))if(await g(c,"add")==="error")throw Error(`IAM delta failed to restore access for ${W}:${A.id}`);return b},n=(A,W)=>{if(A==="error")throw Error(`IAM delta: destination rejected ${W}`)},r=(A,W,L)=>{if(W==="pushed")A.pushed+=1;else if(W==="skipped")A.skipped+=1;else A.errors.push(`IAM delta: destination rejected ${L}`)},Q$={async onUserUpsert(A){n(await X$(A),"user upsert")},async onUserDelete(A){if(!D())return;let W=M();if(!W)return;n(await W.deleteResource("user",A),"user delete")},async onEntitlementUpsert(A,W){n(await e(A,W),`${W} upsert`)},async onEntitlementDelete(A,W){if(!D())return;let L=M();if(!L)return;n(await L.deleteResource("group",W),`${A} delete`)},async onGrant(A){if(!D())return;if(await g(A,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(A){if(!D())return;if(await g(A,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async reconcile(A){let W={pushed:0,skipped:0,errors:[]},L=H();if(L)return W.errors.push(`iam delta not ready: ${L}`),W;let k=async(w,b,u)=>{if(!w)return;for await(let c of w)try{r(W,await b(c),u(c))}catch(o){W.errors.push(o instanceof Error?o.message:String(o))}};return await k(A.groups,(w)=>e(w,"group",!1),(w)=>{return`group upsert for ${w.id}`}),await k(A.roles,(w)=>e(w,"role",!1),(w)=>{return`role upsert for ${w.id}`}),await k(A.permissions,(w)=>e(w,"permission",!1),(w)=>{return`permission upsert for ${w.id}`}),await k(A.users,(w)=>X$(w),(w)=>{return`user upsert for ${w.id??"unknown"}`}),await k(A.access,(w)=>g(w,"add"),(w)=>{return`membership push for ${p0(w.target)??"unknown"}`}),W},async getDestinationRef(A,W){return q.read(A,W)},isReady:D,ready:V.ready};return{update(A,W){Z=A,Q=W,M(),V.refresh();let L=H();if(Z.mode!=="patch")B=void 0;else if(L!==B){if(L)$.warn(`IAM delta configured but not ready: ${L}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:L});B=L}return Q$},handle(){return Q$}}}var Y6=1,l9=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."}];import{IoniteError as c9}from"@ionite/core";function i9($){if($ instanceof c9)return{status:$.status,statusText:$.statusText};if(typeof $!=="object"||$==null)return;let Z=$,Q=typeof Z.status==="number"?Z.status:void 0,X=typeof Z.statusText==="string"?Z.statusText:void 0;return Q!=null||X?{status:Q,statusText:X}:void 0}function N0($){if($ instanceof Response)return $;let Z=i9($);if(!Z)return Response.json({error:"internal_error"},{status:500});let X={status:Z.status??500};if(Z.statusText)X.statusText=Z.statusText;return Response.json({error:Z.statusText??"internal_error"},X)}function D$(){return Response.json({error:"not_found"},{status:404})}function A0($=["GET"]){return Response.json({error:"method_not_allowed",allow:$},{status:405,headers:{Allow:$.join(", ")}})}import{timingSafeEqual as n9}from"node:crypto";import{parseKmsPoolDocument as s9,stableConfigHash as v1}from"@ionite/core";function b1($,Z,Q){for(let X of $)try{X()}catch(Y){Z.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:Q,error:Y instanceof Error?Y.message:String(Y)})}}function b$($,Z){let Q=new Set,X=new Set;return{beforeChange(Y){return Q.add(Y),()=>{Q.delete(Y)}},afterChange(Y){return X.add(Y),()=>{X.delete(Y)}},emitBefore(){b1(Q,$,`${Z} beforeChange`)},emitAfter(){b1(X,$,`${Z} afterChange`)}}}var a9=604800000,t9=2147483647,r9=1;function m1($,Z){if(!$.value)return!1;if($.notBefore&&Date.parse($.notBefore)>Z)return!1;if($.notAfter&&Date.parse($.notAfter)<=Z)return!1;return!0}function x$($,Z,Q=Date.now()){if(!$)return;let X=$.slots?.[Z];if(!X)return;let Y=$.keys.find((J)=>J.id===X&&J.state==="active");return Y&&m1(Y,Q)?Y:void 0}function J6($,Z=Date.now()){if(!$)return[];return $.keys.filter((Q)=>(Q.state==="active"||Q.state==="deprecated")&&m1(Q,Z))}function y1($){return{...$,...$.meta?{meta:{...$.meta}}:{}}}function F4($,Z,Q){if(!Z||Z<=0)return $;return new Promise((X,Y)=>{let J=setTimeout(()=>Y(Error(Q)),Z);$.then((G)=>{clearTimeout(J),X(G)},(G)=>{clearTimeout(J),Y(G)})})}function h1($,Z){let Q=Buffer.from($),X=Buffer.from(Z);return Q.length===X.length&&n9(Q,X)}function o9($){if(!Number.isInteger($)||$<1)throw Error("KMS unique() requires a positive integer slot count.");return $}var e9=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function $Z($){return e9.has($)}function f1($){let Z=$.trim().replace(/\/+$/,"");if(!Z||Z==="/")return"/";return Z.startsWith("/")?Z:`/${Z}`}function ZZ($,Z){let Q=f1($),X=f1(Z);return Q===X||Q.endsWith(X)}function QZ($,Z,Q){let X=b$(Z,`KMS pool "${$}"`),Y=new Set,J=!1,G,z,_=0,B,H,D=r9,V,x,T=new Map,P=new Set,I,O=()=>G!==void 0&&G.slots===void 0&&G.keys.length>0,q=U$(`KMS pool "${$}"`,()=>{if(!J)return!1;if(O())return J6(G).length>0;return x$(G,0)!==void 0}),M=U$(`KMS pool "${$}" issuer`,()=>J&&V!==void 0),E=(R)=>R===0?`KMS pool "${$}"`:`KMS pool "${$}" slot ${R}`,f=(R)=>{let F=T.get(R),K=F?.valueWaiter;if(!F||!K)return;if(!J){F.valueWaiter=void 0,K.reject(Error(`${E(R)} is no longer configured.`));return}if(O()){F.valueWaiter=void 0,K.reject(Error(`${E(R)} verifier grant has no slots.`));return}let N=x$(G,R);if(N?.value)F.valueWaiter=void 0,K.resolve(N.value)},g=()=>{for(let R of T.keys())f(R)},a=(R)=>{let F=T.get(R);if(!F)return;let K=x$(G,R);for(let N of F.listeners)try{N(K?y1(K):void 0)}catch(S){Z.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:$,slot:R,error:S instanceof Error?S.message:String(S)})}},X$=()=>{for(let R of T.keys())a(R)},e=()=>{for(let R of T.values())R.latch.refresh();q.refresh(),M.refresh()},n=()=>{try{I?.()}catch(R){Z.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:$,error:R instanceof Error?R.message:String(R)})}I=void 0},r=()=>{if(I||P.size===0||!V?.subscribeEvents||!x)return;let R=x;I=V.subscribeEvents((F)=>{if(!$Z(F.event)||!ZZ(F.path,R))return;let K={path:F.path,event:F.event,...F.requestId===void 0?{}:{requestId:F.requestId},...F.keyId===void 0?{}:{keyId:F.keyId}};for(let N of P)try{N(K)}catch(S){Z.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:$,error:S instanceof Error?S.message:String(S)})}})},Q$=()=>{if(H)clearTimeout(H);H=void 0},A=()=>{Q$();let R=Date.now();if(G){for(let K of G.keys){if(!K.notAfter)continue;let N=Date.parse(K.notAfter)-R;if(N>0&&N<=a9&&(K.state==="active"||K.state==="deprecated")&&!Y.has(K.id))Y.add(K.id),Z.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:$,keyId:K.id,notAfter:K.notAfter})}let F=G.keys.flatMap((K)=>[K.notBefore,K.notAfter]).filter((K)=>Boolean(K)).map((K)=>Date.parse(K)).filter((K)=>K>R).sort((K,N)=>K-N);if(F[0])H=setTimeout(()=>{let K=new Map([...T.keys()].map((N)=>[N,x$(G,N)?.id]));e(),Q();for(let N of T.keys())if(K.get(N)!==x$(G,N)?.id)a(N);A()},Math.min(F[0]-R+1,t9))}e(),Q(),g()},W=(R)=>{let F=new Map([...T.keys()].map((K)=>{let N=x$(G,K);return[K,{id:N?.id,value:N?.value}]}));X.emitBefore();try{G=s9(R),A();for(let K of T.keys()){let N=x$(G,K),S=F.get(K);if(S?.id!==N?.id||S?.value!==N?.value)a(K)}}catch(K){G=void 0,A(),X$(),Z.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:$,error:K instanceof Error?K.message:String(K)})}finally{X.emitAfter()}},L=()=>{try{B?.()}catch(R){Z.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:$,error:R instanceof Error?R.message:String(R)})}B=void 0},k=(R,F)=>{V=R,x=F,_+=1;let K=_;L(),R.subscribe(F,(N)=>{if(_!==K||!J)return;W(N.data)},{kmsSlots:D}).then((N)=>{if(_!==K||!J){N();return}B=N}).catch((N)=>{if(_!==K||!J)return;G=void 0,A(),X$(),Z.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:$,path:F,error:N instanceof Error?N.message:String(N)})})},w=(R,F)=>{let K=u(R),N=x$(G,R);if(!J)return Promise.reject(Error(`${E(R)} is no longer configured.`));if(O())return Promise.reject(Error(`${E(R)} verifier grant has no slots.`));if(N?.value)return Promise.resolve(N.value);if(!K.valueWaiter){let v,i,d=new Promise(($$,t)=>{v=$$,i=t});K.valueWaiter={promise:d,resolve:v,reject:i}}let S=K.valueWaiter.promise;return f(R),F4(S,F,`${E(R)} was not ready within ${F}ms.`)},b=(R,F)=>{let K=u(R);K.listeners.add(F);let N=x$(G,R);return F(N?y1(N):void 0),()=>K.listeners.delete(F)};function u(R){let F=T.get(R);if(F)return F;let K=U$(E(R),()=>J&&x$(G,R)!==void 0),N={listeners:new Set,latch:K,api:{value:(S)=>w(R,S),current:()=>x$(G,R)?.value,subscribe:(S)=>b(R,S),park:(S,v)=>Y$(S,v),isReady:K.isReady,ready:K.ready}};return T.set(R,N),N}let c=(R)=>{if(O())throw Error(`KMS pool "${$}" verifier grant has no slots.`);let F=o9(R),K=F>D;D=Math.max(D,F);let N=[];for(let S=0;S<F;S+=1)N.push(u(S).api);if(K&&J&&V&&x)k(V,x);return N},o=(R)=>J6(G).find((F)=>F.value!==void 0&&h1(R,F.value)),Y$=(R,F)=>{if(!J||!V||!x)return Promise.reject(Error(`KMS pool "${$}" is not configured.`));if(typeof R.value!=="string"||R.value.length===0)return Promise.reject(Error(`KMS pool "${$}" park() requires a non-empty value.`));let K=o(R.value);if(!K)return Promise.resolve({parked:!1,stale:!0});return F4(V.parkKmsKey(x,{keyId:K.id,status:R.status,reason:R.reason},F&&F>0?{timeout:F}:void 0),F,`KMS pool "${$}" park() did not complete within ${F}ms.`)},G$=()=>{if(!J||!V||!x)throw Error(`KMS pool "${$}" is not configured.`);return{source:V,path:x}},s=(R)=>{if(!Array.isArray(R)||R.length===0)throw Error(`KMS pool "${$}" addKeys() requires a non-empty keys array.`);return R.map((F,K)=>{if(!F||typeof F!=="object")throw Error(`KMS pool "${$}" addKeys() keys[${K}] must be an object.`);if(typeof F.value!=="string"||F.value.length===0)throw Error(`KMS pool "${$}" addKeys() keys[${K}].value must be a non-empty string.`);if(F.id!==void 0&&(typeof F.id!=="string"||F.id.length===0))throw Error(`KMS pool "${$}" addKeys() keys[${K}].id must be a non-empty string when present.`);return F})},z$=(R,F)=>{try{let{source:K,path:N}=G$(),S=s(R);return F4(K.addKmsKeys(N,{keys:S},F&&F>0?{timeout:F}:void 0),F,`KMS pool "${$}" addKeys() did not complete within ${F}ms.`)}catch(K){return Promise.reject(K)}},H$=(R,F)=>{try{let{source:K,path:N}=G$();if(typeof R.keyId!=="string"||R.keyId.length===0)throw Error(`KMS pool "${$}" revokeKey() requires a non-empty keyId.`);return F4(K.revokeKmsKey(N,R,F&&F>0?{timeout:F}:void 0),F,`KMS pool "${$}" revokeKey() did not complete within ${F}ms.`)}catch(K){return Promise.reject(K)}},K$=(R)=>{let{source:F}=G$();if(!F.subscribeEvents)throw Error(`KMS pool "${$}" events are not supported by this secrets transport.`);return P.add(R),r(),()=>{P.delete(R)}};u(0);let j={value:(R)=>w(0,R),current:()=>x$(G,0)?.value,unique:c,accepts:(R)=>J6(G).some((F)=>F.value!==void 0&&h1(R,F.value)),park:Y$,subscribe:(R)=>b(0,R),beforeChange:X.beforeChange,afterChange:X.afterChange,isReady:q.isReady,ready:q.ready},h={addKeys:z$,revokeKey:H$,events:K$,isReady:M.isReady,ready:M.ready};return{api:j,issuer:h,update(R,F,K){let N=v1({config:R,path:K});if(J=!0,z===N){e();return}z=N,L(),n(),Q$(),G=void 0,e(),Q(),X$(),g(),k(F,K),r()},unavailable(R){J=!0,z=v1(R),_+=1,V=void 0,x=void 0,n(),L(),Q$(),G=void 0,e(),Q(),X$(),g()},remove(){if(!J)return;X.emitBefore(),J=!1,z=void 0,_+=1,V=void 0,x=void 0,n(),L(),Q$(),G=void 0,e(),Q(),X$(),g(),X.emitAfter()},close(){J=!1,_+=1,V=void 0,x=void 0,n(),P.clear(),L(),Q$();for(let R of T.values())R.listeners.clear();G=void 0,g();for(let R of T.values())R.latch.settle();q.settle(),M.settle()},isConfigured:()=>J}}function g1($){let Z=new Map,Q=new Map,X=b$($,"KMS"),Y=!1,G=U$("KMS module",()=>Y&&Array.from(Z.values()).every((V)=>!V.isConfigured()||V.api.isReady())),z,_=()=>G.refresh(),B=(V)=>{let x=Z.get(V);if(x)return x;let T=QZ(V,$,_);if(Z.set(V,T),!(V in z))Object.assign(z,{[V]:T.api});return T},H=(V)=>{let x=Z.get(V);if(!x)throw Error(`KMS pool "${V}" is not configured.`);return x.api},D=(V)=>{let x=Z.get(V);if(!x)throw Error(`KMS pool "${V}" is not configured.`);return x.issuer};return z={get config(){return Object.fromEntries(Q)},beforeChange:X.beforeChange,afterChange:X.afterChange,isReady:G.isReady,ready:G.ready,listPools:()=>Array.from(Q.keys()),getPool:H,issuer:D},{handle:()=>z,update(V,x){if(!V&&!Y&&Z.size===0)return;X.emitBefore(),Y=V!==void 0;let T=new Set(Object.keys(V??{}));for(let[P,I]of Object.entries(V??{})){Q.set(P,{...I});let O=I.path??`/kms/${P}`;try{B(P).update(I,x(I),O)}catch(q){B(P).unavailable(I),$.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:P,error:q instanceof Error?q.message:String(q)})}}for(let[P,I]of Z){if(T.has(P))continue;Q.delete(P),I.remove()}return G.refresh(),X.emitAfter(),Y||Z.size>0?z:void 0},close(){for(let V of Z.values())V.close();Z.clear(),Q.clear(),Y=!1,G.settle()}}}import{context as XZ,trace as YZ}from"@opentelemetry/api";import{logs as JZ,SeverityNumber as j0}from"@opentelemetry/api-logs";import{OTLPLogExporter as GZ}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as zZ}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as _Z}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as BZ}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as HZ}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as KZ}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as DZ}from"@opentelemetry/resources";import{BatchLogRecordProcessor as VZ}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as UZ}from"@opentelemetry/sdk-metrics";import{NodeSDK as FZ}from"@opentelemetry/sdk-node";var p1={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},MZ={trace:!1,debug:!1,info:!0,warn:!0,error:!0};function G6($,Z){let Q=Z[$];if(Q===!1)return!1;if($==="metrics")return Q===!0||typeof Q==="object";return!0}function z6($){return typeof $==="object"&&$!==null?$:void 0}function WZ($){return typeof $==="object"&&$!==null?$:void 0}function OZ($,Z){let Q=$.replace(/\/+$/,"");if(Q.endsWith(p1[Z]))return Q;return`${Q}${p1[Z]}`}function LZ($,Z){let Q=z6($[Z]);if(Q?.endpoint)return Q.endpoint;if(!$.endpoint)return;return OZ($.endpoint,Z)}function NZ($,Z,Q){let X=z6($[Z]),Y={...$.headers,...X?.headers??{}};if(Q)Y.Authorization=`Bearer ${Q}`;return Y}function _6($,Z,Q){let X=z6($[Z]);return{url:LZ($,Z),headers:NZ($,Z,Q),timeoutMillis:X?.timeoutMillis,concurrencyLimit:X?.concurrencyLimit}}function AZ($,Z){let Q=_6($,"traces",Z);return $.protocol==="http/json"?new HZ(Q):new KZ(Q)}function jZ($,Z){let Q=_6($,"metrics",Z);return $.protocol==="http/json"?new _Z(Q):new BZ(Q)}function EZ($,Z){let Q=_6($,"logs",Z);return $.protocol==="http/json"?new GZ(Q):new zZ(Q)}function RZ($){return{"service.name":$.name,...$.version?{"service.version":$.version}:{},...$.deploymentEnvironment?{"deployment.environment.name":$.deploymentEnvironment}:{},...$.resourceAttributes??{}}}async function PZ($){if(!$.oauth)return;let Z=new URLSearchParams({grant_type:"client_credentials",client_id:$.oauth.clientId,client_secret:$.oauth.clientSecret});if($.oauth.scope)Z.set("scope",$.oauth.scope);if($.oauth.audience)Z.set("audience",$.oauth.audience);let Q=await fetch($.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...$.oauth.headers??{}},body:Z});if(!Q.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${Q.status}`);let X=await Q.json();if(typeof X.access_token!=="string"||!X.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return X.access_token}function qZ($,Z){return{...MZ,...Z?.levels??{},...$.levels??{}}}function u0($,Z="Authorization"){let Q={...$.headers??{}};if(!$.apiKey)return Q;let X=$.apiKeyHeader??Z;return Q[X]=X.toLowerCase()==="authorization"?`Bearer ${$.apiKey}`:$.apiKey,Q}function TZ($,Z){return Object.keys($).some((Q)=>Q.toLowerCase()===Z.toLowerCase())}function l1($,Z,Q){let X=Object.keys($).find((Y)=>Y.toLowerCase().startsWith(Z.toLowerCase()));if(X)throw Error(`OpenTelemetry provider "${Q}" does not support provider-specific header "${X}".`)}function l0($,Z,Q,X){return{type:Q,name:$.name,version:$.version,protocol:$.protocol??"http/protobuf",endpoint:$.endpoint,headers:X,resourceAttributes:RZ($),levels:qZ($,Z),traces:$.traces,metrics:$.metrics,logs:$.logs}}function IZ($,Z){return l0($,Z,"otlp",u0($))}function xZ($,Z){return l0($,Z,"grafana-lgtm",u0($))}function wZ($,Z){let Q=u0($,"DD-API-KEY");if(!TZ(Q,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return l0($,Z,"datadog",Q)}function SZ($,Z){let Q=u0($);return l1(Q,"DD-","splunk"),l0($,Z,"splunk",Q)}function CZ($,Z){let Q=u0($);return l1(Q,"DD-","elastic"),l0($,Z,"elastic",Q)}function kZ($,Z){let Q=$.type??"otlp";switch(Q){case"otlp":return IZ($,Z);case"grafana-lgtm":return xZ($,Z);case"datadog":return wZ($,Z);case"splunk":return SZ($,Z);case"elastic":return CZ($,Z);default:throw Error(`Unsupported OpenTelemetry provider type: ${Q}`)}}function bZ($,Z){if(typeof $==="string")return $;if($ instanceof Error)return $.message;if($!=null)return d0($);if(Z.length===0)return"";return d0(Z[0])}function d0($){if(typeof $==="string")return $;try{return JSON.stringify($)}catch{return String($)}}function d1($,Z,Q){if(Q==null)return;if(typeof Q==="string"||typeof Q==="number"||typeof Q==="boolean"){$[Z]=Q;return}if(Array.isArray(Q)&&Q.every((X)=>["string","number","boolean"].includes(typeof X))){$[Z]=Q;return}if(Q instanceof Error){if($[`${Z}.name`]=Q.name,$[`${Z}.message`]=Q.message,Q.stack)$[`${Z}.stack`]=Q.stack;return}$[Z]=d0(Q)}function vZ($){let Z={};for(let[X,Y]of $.entries()){if(Y&&typeof Y==="object"&&!Array.isArray(Y)&&!(Y instanceof Error)&&Object.getPrototypeOf(Y)===Object.prototype){for(let[J,G]of Object.entries(Y))d1(Z,J,G);continue}d1(Z,`param.${X}`,Y)}let Q=YZ.getSpanContext(XZ.active());if(Q)Z.trace_id=Q.traceId,Z.span_id=Q.spanId,Z.trace_flags=Q.traceFlags;return Z}function yZ($){return $}function hZ($){let Z=typeof $.body==="string"?$.body:d0($.body),Q=$.attributes??{};if(Object.keys(Q).length===0)return Z;return`${Z} ${d0(Q)}`}function c1($,Z){globalThis.console[yZ($)](hZ(Z))}function fZ($,Z){if((Z.severityNumber??0)<j0.INFO)return;c1($,Z)}function mZ($,Z,Q){let X=Q?.console;if(X===!1)return;if(typeof X==="function"){X(Z);return}if(X===!0){c1($,Z);return}fZ($,Z)}function gZ($,Z){let Q=JZ.getLogger($.name,$.version),X=(Y,J,G)=>{if(!$.levels[Y])return;let z={severityNumber:J,severityText:Y.toUpperCase(),body:bZ(G[0],G.slice(1)),attributes:vZ(G.slice(1))};try{Q.emit(z)}finally{mZ(Y,z,Z)}};return{trace:(Y,...J)=>X("trace",j0.TRACE,[Y,...J]),debug:(Y,...J)=>X("debug",j0.DEBUG,[Y,...J]),info:(Y,...J)=>X("info",j0.INFO,[Y,...J]),warn:(Y,...J)=>X("warn",j0.WARN,[Y,...J]),error:(Y,...J)=>X("error",j0.ERROR,[Y,...J])}}function pZ($){return $?.current()}function dZ($,Z,Q){let X=Z;return $.subscribe((Y)=>{let J=Y?.value;if(J===X)return;X=J,Q()})}function u1($){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:$,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function B6($,Z,Q,X){if(!Z&&!Q)return;if(!Z)return u1($);let Y=Z,J;if(Y.apiKeyPool&&X)try{J=X.getPool(Y.apiKeyPool)}catch{J=void 0}let G=pZ(J),z=()=>B6($,Y,Q,X),_=Y.apiKeyPool&&X?(q)=>dZ(X.getPool(Y.apiKeyPool),G,q):void 0;if(Y.apiKeyPool&&!G){let q=u1($);return q.onCredentialChange=_,q.rebuild=z,q}let B=G?{...Y,apiKey:G}:Y,H=kZ(B,Q),D,V=!1,x=gZ(H,Q),T,P,I=new Promise((q,M)=>{T=q,P=M});async function O(){try{let q=await PZ(Y),M={resource:DZ(H.resourceAttributes),instrumentations:Q?.instrument};if(Q?.sampler)M.sampler=Q.sampler;if(Q?.textMapPropagator)M.textMapPropagator=Q.textMapPropagator;if(Q?.contextManager)M.contextManager=Q.contextManager;if(Q?.spanProcessors)M.spanProcessors=Q.spanProcessors;else if(G6("traces",H))M.traceExporter=AZ(H,q);if(Q?.metricReaders)M.metricReaders=Q.metricReaders;else if(G6("metrics",H)){let f=WZ(H.metrics);M.metricReaders=[new UZ({exporter:jZ(H,q),exportIntervalMillis:f?.exportIntervalMillis,exportTimeoutMillis:f?.exportTimeoutMillis})]}if(Q?.logRecordProcessors)M.logRecordProcessors=Q.logRecordProcessors;else if(G6("logs",H))M.logRecordProcessors=[new VZ({exporter:EZ(H,q)})];let E=Q?.configure?.(M);D=new FZ(E??M),D.start(),V=!0,T?.()}catch(q){V=!1;let M=q instanceof Error?q:Error(String(q));$.error?.("OpenTelemetry startup failed",M),P?.(M)}finally{T=void 0,P=void 0}}return{state:"available",start:O,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>V,ready:(q)=>{if(!q||q<=0)return I;return Promise.race([I,new Promise((M,E)=>{setTimeout(()=>E(Error(`OpenTelemetry ready timed out after ${q}ms.`)),q)})])},logger:x,forceFlush:async()=>{await D?.forceFlush?.()},shutdown:async()=>{V=!1,await D?.shutdown(),D=void 0},onCredentialChange:_,rebuild:z}}function i1($){let Z,Q,X,Y=0,J=Promise.resolve(),G=b$($,"OpenTelemetry"),z=U$("OpenTelemetry module",()=>Z?.isReady()===!0),_={beforeChange:G.beforeChange,afterChange:G.afterChange,isReady:z.isReady,ready:z.ready,logger:{trace:(D,...V)=>(Z?.logger??$).trace(D,...V),debug:(D,...V)=>(Z?.logger??$).debug(D,...V),info:(D,...V)=>(Z?.logger??$).info(D,...V),warn:(D,...V)=>(Z?.logger??$).warn(D,...V),error:(D,...V)=>(Z?.logger??$).error(D,...V)},forceFlush:async()=>{await Z?.forceFlush()},shutdown:async()=>{await Z?.shutdown()}},B=!1,H;return H={update(D){if(!D){if(Z||Q){let P=Z,I=Q;Y+=1,G.emitBefore(),X?.(),X=void 0,Z=void 0,Q=void 0,z.refresh(),J=Promise.all([P?.shutdown(),I?.shutdown()]).finally(()=>G.emitAfter()).then(()=>{return},()=>{return})}return B?_:void 0}if(B=!0,D===Z||D===Q)return _;let V=Z,x=Q;Y+=1;let T=Y;return G.emitBefore(),X?.(),X=void 0,Z=void 0,Q=D,z.refresh(),J=(async()=>{try{if(await Promise.all([V?.shutdown(),x?.shutdown()]),await D.start(),T!==Y||Q!==D){await D.shutdown();return}Z=D,Q=void 0,z.refresh(),X=D.onCredentialChange?.(()=>{if(Z!==D)return;let P=D.rebuild?.();if(P)H.update(P)})}finally{if(T===Y)G.emitAfter()}})().then(()=>{return},()=>{return}),_},settled(){return J},async shutdown(){Y+=1;let D=Z,V=Q;X?.(),X=void 0,Z=void 0,Q=void 0,z.settle(),await Promise.all([D?.shutdown(),V?.shutdown()])}},H}import{ION_ENDPOINT_PERMISSIONS as H6,trimTrailingSlash as n1}from"@ionite/core";import{hasPermission as uZ}from"@ionite/core/server";async function B0($,Z,Q){let X=await uZ($,Z,Q.permission,void 0,Q.subjectType);return X.allow?void 0:X.response()}function lZ($){let Z=n1($);return{matchesPath:(Y)=>{if(!Y)return!1;return n1(Y)===Z},startsWithPath:(Y)=>{if(!Y)return!1;return $===Y||$.startsWith(`${Y}/`)}}}function s1($,Z,Q,X){let Y=X??new URL($.url).pathname,{matchesPath:J,startsWithPath:G}=lZ(Y);if(Z.sso){let z=Z.sso;if(J(Q.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(_)=>z.handler(_)};if(J(Q.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(_)=>z.logout(_)};if(J(Q.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(_)=>z.logoutBackChannel(_)};if(J(Q.sso.loginUrl)||J(Q.sso.refreshUrl)||J(Q.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(_)=>z.handler(_)}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(_)=>{let B=await z.resolveCustomer(_);if(B.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(B.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(B.value),{headers:{"Content-Type":"application/json"}})}};if(J(Q.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(_)=>z.logout(_)}}if(Z.iam){let z=Z.iam,_=$.method!=="GET"&&$.method!=="HEAD";if(G(Q.iam.usersUrl))return{module:"iam",kind:_?"iam.users.write":"iam.read",requiredPermission:H6[_?"iam.users.write":"iam.read"],handler:async(B)=>z.handler(B)};if(G(Q.iam.groupsUrl))return{module:"iam",kind:_?"iam.groups.write":"iam.read",requiredPermission:H6[_?"iam.groups.write":"iam.read"],handler:async(B)=>z.handler(B)};if(G(Q.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(B)=>z.handler(B)}}if(Z.workload){let z=Z.workload;if(J(Q.workload.validateUrl)||J(Q.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(_)=>z.handler(_)}}if(Z.secrets){let z=Z.secrets;if(z.isLfvDeliveryRequest?.($)&&z.handleLfvDelivery){let _=z.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(B)=>_(B)}}if(z.isLfvEventsRequest?.($)&&z.handleLfvEvents){let _=z.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(B)=>_(B)}}}if(Z.ciam){let z=Z.ciam;if(J(Q.ciam.magicLinkUrl)&&$.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:H6["ciam.magic-link.create"],handler:async(_)=>z.handler(_)};if(J(Q.ciam.magicLinkLoginUrl)&&$.method==="GET"||J(Q.ciam.customerProvidersUrl)&&$.method==="GET"||J(Q.ciam.customerLoginUrl)&&$.method==="GET"||J(Q.ciam.customerCallbackUrl)&&($.method==="GET"||$.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(_)=>z.handler(_)}}return}async function K6($,Z,Q,X){let Y=X??g$(Z4()),J=new URL($.url).pathname;if(Q?.filter){let D=await Q.filter($,Z);if(D instanceof Response)return D;if(D==="not_handled")return D$()}let G=s1($,Z,Y,J),_=await Q?.resolve?.($,Z,G)??G;if(!_)return D$();let B=_.requiredPermission===void 0?G?.requiredPermission:_.requiredPermission,H=async()=>{if(B){let D=await B0($,Z,B);if(D)return D}return _.handler($)};if(Q?.wrap)return await Q.wrap($,_,H,Z);return await H()}import{stableConfigHash as K3}from"@ionite/core";function M4(){let $=0;return{next:()=>{return $+=1,$},isCurrent:(Z)=>Z===$,current:()=>$}}import{readFile as G3,stat as z3}from"node:fs/promises";class E0 extends Error{code;status;constructor($,Z,Q){super($);this.code=Z;this.status=Q;this.name="VaultWebSocketCommandError"}sourceType="vault"}class l$ extends Error{path;constructor($,Z=`Vault secret not found at path ${$}`){super(Z);this.path=$;this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}code;status;sourceType="vault"}class V$ extends Error{path;status;code;constructor($,Z,Q,X,Y){super($,Y);this.path=Z;this.status=Q;this.code=X;this.name="VaultRequestError"}sourceType="vault"}class w$ extends Error{sourceType;path;constructor($,Z,Q=`Vault subscribe is not supported for source ${$} at path ${Z} without websocket, LFV, or ttl`){super(Q);this.sourceType=$;this.path=Z;this.name="VaultSubscribeNotSupportedError"}}function a1($){return $ instanceof l$||$ instanceof E0&&($.code==="not_found"||$.status===404)}import{WebSocket as R0}from"ws";var cZ=1000,iZ=30000,r1=30000,o1=r1;function e1($){o1=$>0?$:r1}function $8($){return typeof $==="number"&&Number.isInteger($)&&$>=1?{kms_slots:$}:{}}function nZ($){let Z=Math.min(iZ,cZ*2**Math.min($,16)),Q=0.5+Math.random()*0.5;return Math.round(Z*Q)}var H0=new Map;function sZ($){return $.trim().replace(/\/+$/g,"")}function Z8($,Z){let Q=typeof Z?.version==="number"?Z.version:0,X=Z?.created_time??Z?.created,Y=typeof X==="string"?new Date(X):new Date,J=J0(Z);return{path:$,version:Q,created:Y,...J?{contentType:J}:{}}}function aZ($){return typeof $?.version==="number"?$.version:void 0}function tZ($){let Z=$.token?.trim();if(!Z)return{};if($.header==="Authorization")return{Authorization:Z.startsWith("Bearer ")?Z:`Bearer ${Z}`};return{"X-Vault-Token":Z}}function c0($){return{client_id:$.clientId,token:$.token,header:$.header??"X-Vault-Token"}}function V6($,Z){let Q=sZ($),X=H0.get(Q);if(X){if(Z&&!X.log)X.log=Z;return X}let Y={url:Q,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:Z};return H0.set(Q,Y),Y}function rZ($){let Z=[...Array.from($.subs.values(),(Y)=>Y.creds),...$.eventListeners.values()];if(Z.length===0)return $.lastGoodCreds??{url:$.url};let Q=$.lastGoodCreds?[$.lastGoodCreds,...Z]:Z,X=Q[$.reconnectCredCursor%Q.length]??Z[0];return $.reconnectCredCursor+=1,X}function t1($,Z){for(let Q of $.subs.values())try{Q.onHealth?.(Z)}catch(X){$.log?.warn("Vault websocket health hook threw",X)}}function oZ($,Z){for(let Q of Array.from($.subs.values())){let X=Q.onFirstSecretReject;if(Q.onFirstSecret=void 0,Q.onFirstSecretReject=void 0,X)try{X(new V$(`Vault websocket subscription interrupted (${Z})`,Q.path,void 0,"connection"))}catch(Y){$.log?.warn("Vault websocket first-secret waiter rejection threw",Y)}}}function Q8($,Z){for(let Q of $.pending.values())clearTimeout(Q.timer),Q.reject(new V$(`Vault websocket command interrupted (${Z})`,"/",void 0,"connection"));$.pending.clear()}function W4($){if($.disposed)return;if($.disposed=!0,$.reconnectTimer)clearTimeout($.reconnectTimer),$.reconnectTimer=void 0;Q8($,"closed"),oZ($,"socket disposed");let Z=$.ws;if($.ws=void 0,$.connectPromise=void 0,$.hasConnected=!1,H0.delete($.url),Z)try{Z.removeAllListeners(),Z.close()}catch{}}function O4($){if($.subs.size>0||$.pending.size>0||$.eventListeners.size>0)return;W4($)}function D6($){return`${$.clientId??""}|${$.token??""}|${$.header??"X-Vault-Token"}`}function X8($){let Z=new Map;for(let Q of $.eventListeners.values())Z.set(D6(Q),Q);return Array.from(Z.values())}function eZ($,Z){if(typeof Z.path!=="string"||typeof Z.event!=="string")return;let Q={path:Z.path,event:Z.event,...typeof Z.request_id==="string"?{requestId:Z.request_id}:{},...typeof Z.key_id==="string"&&Z.key_id.length>0?{keyId:Z.key_id}:{}};for(let X of $.eventListeners.keys())try{X(Q)}catch(Y){$.log?.warn("Vault websocket event listener threw",Y)}}function Y8($,Z,Q,X){if(X!==void 0&&Z.lastVersion!==void 0&&X===Z.lastVersion)return;if(X!==void 0)Z.lastVersion=X;try{Z.onChange(Q)}catch(J){$.log?.warn("Vault websocket subscription onChange threw",J)}let Y=Z.onFirstSecret;if(Z.onFirstSecret=void 0,Z.onFirstSecretReject=void 0,Y)try{Y()}catch(J){$.log?.warn("Vault websocket subscription onFirstSecret threw",J)}}function $3($,Z){let Q=Z.subscription_id;if(typeof Q!=="string")return;let X=$.subs.get(Q);if(!X)return;let Y={data:Z.data,metadata:Z8(typeof Z.path==="string"?Z.path:X.path,Z.metadata)};Y8($,X,Y,aZ(Z.metadata))}function Z3($,Z){let Q;try{Q=JSON.parse(Z.toString())}catch(X){$.log?.warn("Vault websocket message parse failed",X);return}if(Q.type==="secret"){$3($,Q);return}if(Q.type==="event"){eZ($,Q);return}if(Q.type==="command_result"&&typeof Q.id==="string"){let X=$.pending.get(Q.id);if(!X)return;if($.pending.delete(Q.id),clearTimeout(X.timer),Q.ok===!1)X.reject(new E0(Q.error??`Vault websocket command failed for ${Q.id}`,Q.code,Q.status));else X.resolve(Q.result);O4($)}}function J8($,Z){$.send(JSON.stringify({type:"subscribe",subscription_id:Z.subscriptionId,paths:[Z.path],...$8(Z.kmsSlots),...c0(Z.creds)}))}function U6($){if($.disposed||$.reconnectTimer||$.subs.size===0&&$.eventListeners.size===0)return;let Z=nZ($.reconnectAttempts);$.reconnectAttempts+=1,$.reconnectTimer=setTimeout(()=>{if($.reconnectTimer=void 0,$.disposed)return;if($.subs.size===0&&$.eventListeners.size===0){W4($);return}L4($,rZ($)).catch(()=>{if($.hasConnected)$.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${Z}ms).`);U6($)})},Z)}function L4($,Z){if($.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if($.ws&&$.ws.readyState===R0.OPEN)return Promise.resolve($.ws);if($.connectPromise)return $.connectPromise;return $.connectPromise=new Promise((Q,X)=>{let Y=new R0($.url,{headers:tZ(Z)}),J=!1,G=$.hasConnected,z=()=>{J=!0,$.hasConnected=!0,$.reconnectAttempts=0,$.reconnectCredCursor=0,$.lastGoodCreds=Z,$.ws=Y,$.connectPromise=void 0,Y.on("message",(H)=>Z3($,H));for(let H of $.subs.values())try{J8(Y,H)}catch{}for(let H of X8($))try{Y.send(JSON.stringify({type:"subscribe_events",...c0(H)}))}catch{}if(G)t1($,!0);Q(Y)},_=()=>{if($.ws===Y)$.ws=void 0;$.connectPromise=void 0;try{Y.removeAllListeners()}catch{}if(Q8($,"socket closed"),$.subs.size>0||$.eventListeners.size>0)t1($,!1),U6($);else W4($)},B=(H)=>{if($.ws===Y)$.ws=void 0;if(!J)J=!0,$.connectPromise=void 0,X(H)};Y.once("open",z),Y.on("close",_),Y.on("error",B)}),$.connectPromise}async function F6($,Z,Q,X){let Y=V6($.url,X),J=typeof Q.path==="string"?Q.path:"/",G=await L4(Y,$),z=crypto.randomUUID();try{return await new Promise((_,B)=>{let H=setTimeout(()=>{if(!Y.pending.has(z))return;Y.pending.delete(z),B(new V$(`Vault websocket command "${Z}" timed out`,J,void 0,"timeout"));try{Y.ws?.close()}catch{}},o1);Y.pending.set(z,{resolve:(D)=>_(D),reject:B,timer:H});try{G.send(JSON.stringify({type:"command",id:z,command:Z,...Q,...c0($)}))}catch(D){clearTimeout(H),Y.pending.delete(z),B(D)}})}finally{O4(Y)}}async function M6($,Z,Q,X){let Y;try{Y=await F6($,"read_secret",{path:Z,...$8(X)},Q)}catch(J){if(a1(J))throw new l$(Z);if(J instanceof E0||J instanceof V$)throw J;throw new V$(`Vault websocket read_secret failed for ${Z}`,Z,void 0,"connection",{cause:J})}if(!Y||typeof Y!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${Z}`);return{data:Y.data,metadata:Z8(typeof Y.path==="string"?Y.path:Z,Y.metadata)}}async function G8($,Z,Q,X,Y,J){let G=V6($.url,Y),z=crypto.randomUUID(),_={subscriptionId:z,creds:$,path:Z,...X?.kmsSlots!==void 0?{kmsSlots:X.kmsSlots}:{},onChange:Q,onHealth:J?.onHealth};G.subs.set(z,_);let B=()=>{if(!G.subs.delete(z))return;if(G.ws&&G.ws.readyState===R0.OPEN)try{G.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:z}))}catch{}O4(G)};try{let H=await L4(G,$);J8(H,_)}catch(H){if(X?.mode!=="wait")throw B(),H}try{let H=await M6($,Z,Y,X?.kmsSlots);Y8(G,_,H,H.metadata.version)}catch(H){if(X?.mode!=="wait")throw B(),H;await new Promise((D,V)=>{let x,T=(P)=>{if(x)clearTimeout(x);_.onFirstSecret=void 0,_.onFirstSecretReject=void 0,B(),V(P)};if(_.onFirstSecret=()=>{if(x)clearTimeout(x);D()},_.onFirstSecretReject=T,typeof X.timeout==="number"&&X.timeout>0)x=setTimeout(()=>T(H),X.timeout)})}return B}async function z8($,Z,Q){let X=V6($.url,Q);X.eventListeners.set(Z,$);try{let Y=await L4(X,$);if(Y.readyState===R0.OPEN)Y.send(JSON.stringify({type:"subscribe_events",...c0($)}))}catch(Y){X.log?.warn("Vault websocket event subscription connect failed; retrying in background",Y),U6(X)}return()=>{if(!X.eventListeners.delete(Z))return;let Y=D6($);if(!X8(X).some((G)=>D6(G)===Y)&&X.ws&&X.ws.readyState===R0.OPEN)try{X.ws.send(JSON.stringify({type:"unsubscribe_events",...c0($)}))}catch{}O4(X)}}function _8(){let $=0;for(let Z of H0.values())$+=Z.subs.size;return{urls:Array.from(H0.keys()),sockets:H0.size,subscriptions:$}}function B8(){for(let $ of Array.from(H0.values()))W4($)}var N4=600000;function K0($){if($&&$<N4)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${N4} milliseconds (10 minutes), as not to overload the store with polling requests`)}function c$($,Z,Q,X,Y,J,G){let z=!1,_,B,H,D=(O)=>{try{G?.onHealth?.(O)}catch{}},V=()=>{if(z=!0,_)clearTimeout(_),_=void 0;B?.()},x=(O)=>new Promise((q)=>{let M=setTimeout(()=>{B=void 0,_=void 0,q()},O);_=M,B=()=>{clearTimeout(M),B=void 0,_=void 0,q()}});async function T(){let O=Date.now();for(;;){if(z)return;try{let q=await $.getFullSecret(Z,J);return D(!0),q}catch(q){if(D(!1),J?.mode!=="wait")throw q;if(typeof J.timeout==="number"&&J.timeout>0&&Date.now()-O>=J.timeout)throw q;if(z)return;Y?.warn(`Error retrieving initial secret from vault. Retrying in ${X} milliseconds`,q),await x(X)}}}async function P(){if(_=void 0,z)return;try{let O=await $.getFullSecret(Z,J);if(D(!0),O.metadata.version!==H)H=O.metadata.version,Q(O)}catch(O){D(!1),Y?.warn(`Error retrieving remote config from vault. Retrying in ${X} milliseconds`,O)}I()}function I(){if(z)return;_=setTimeout(()=>{P()},X)}return T().then((O)=>{if(z||!O)return()=>V();return H=O.metadata.version,Q(O),I(),()=>V()})}function Q3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function X3($){let Z={"Content-Type":"application/json"};if($)Z["X-Vault-Token"]=$;return Z}function Y3($){return Boolean($?.idpTokenUrl?.trim()&&$.clientId?.trim()&&$.clientSecret?.trim())}async function H8($,Z){let Q=Date.now();if(Z.token&&Z.expiresAt&&Z.expiresAt-60000>Q)return Z.token;let X=new URLSearchParams({grant_type:"client_credentials",client_id:$.clientId,client_secret:$.clientSecret});if($.scope?.trim())X.set("scope",$.scope.trim());let Y=await fetch($.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:X.toString()});if(!Y.ok)throw Error(`Vault workload token request failed (${Y.status})`);let J=await Y.json();if(!J.access_token)throw Error("Vault workload token response did not include access_token");return Z.token=J.access_token,Z.expiresAt=Q+Math.max(1,J.expires_in??300)*1000,J.access_token}function J3($){return{Authorization:$.startsWith("Bearer ")?$:`Bearer ${$}`}}function i0($){return $.replace(/\/data\/?$/,"")}function K8($,Z,Q){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`Vault ${Q} kms_park returned invalid payload for ${Z}`);let X=$;if(typeof X.parked!=="boolean")throw Error(`Vault ${Q} kms_park returned invalid payload for ${Z}`);let Y=X.disposition;if(Y!==void 0&&Y!=="cooldown"&&Y!=="suspect")throw Error(`Vault ${Q} kms_park returned invalid disposition for ${Z}`);return{parked:X.parked,...X.stale===!0?{stale:!0}:{},...Y?{disposition:Y}:{}}}function D8($,Z,Q){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`Vault ${Q} kms_add_keys returned invalid payload for ${Z}`);let X=$;if(!Array.isArray(X.keys))throw Error(`Vault ${Q} kms_add_keys returned invalid payload for ${Z}`);return{keys:X.keys.map((J,G)=>{if(!J||typeof J!=="object"||Array.isArray(J))throw Error(`Vault ${Q} kms_add_keys returned invalid keys[${G}] for ${Z}`);let z=J.id;if(typeof z!=="string"||z.length===0)throw Error(`Vault ${Q} kms_add_keys returned invalid keys[${G}].id for ${Z}`);return{id:z}})}}function V8($,Z,Q){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`Vault ${Q} kms_revoke_key returned invalid payload for ${Z}`);let X=$;if(typeof X.revoked!=="boolean")throw Error(`Vault ${Q} kms_revoke_key returned invalid payload for ${Z}`);return{revoked:X.revoked}}function P0($,Z){let{type:Q="vault",url:X,token:Y,ttl:J}=$,G=()=>$.log,z=Y3($.workload)?$.workload:void 0,_={},B=X3(Y),H=$.lfv,D=$.websocket,V=H?z0({...H,log:H.log??G(),path:H.path??"/"},Z):void 0,x=new Map,T=D?.url?.trim(),P=new Set,I=!1,O=!1;if(!H&&!X&&!T)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(K0(J),X&&!Y&&!z&&!H)G()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function q(){if(z){let j=await H8(z,_);return{"Content-Type":"application/json",...J3(j)}}return{...B}}async function M(j){let h=g(j);if(z){let R=await H8(z,_);return{url:h,clientId:D?.clientId??z.clientId,token:R,header:"Authorization"}}return{url:h,clientId:D?.clientId,token:D?.token??Y,header:D?.header??"X-Vault-Token"}}function E(j){if(!H)throw Error(`Vault LFV capability is not configured for path ${j}`);let h=x.get(j);if(h)return h;let R=z0({...H,log:H.log??G(),path:j},Z);return x.set(j,R),R}function f(j){if(!X)throw Error(`Vault HTTP capability is not configured for path ${j}`);return X}function g(j){if(!T)throw Error(`Vault websocket capability is not configured for path ${j}`);return T}async function a(j,h){let R=await M(typeof h.path==="string"?h.path:"/");return F6(R,j,h,G())}async function X$(j,h){let R=f(j),F;try{let K=await q(),N=new URL(`${R}/${j}`);if(typeof h?.kmsSlots==="number"&&Number.isInteger(h.kmsSlots)&&h.kmsSlots>=1)N.searchParams.set("kms_slots",String(h.kmsSlots));F=await fetch(N,{headers:K})}catch(K){throw new V$(`Vault request failed from URL: ${R}/${j}`,j,void 0,"connection",{cause:K})}if(F.status!==200){if(F.status===404)throw new l$(j);let K=F.status===401||F.status===403,N=K?`Vault returned ${F.status} ${F.statusText} (auth error) from URL: ${R}/${j}`:`Vault returned invalid status, ${F.status}: '${F.statusText}' from URL: ${R}/${j}`;throw new V$(N,j,F.status,K?"auth":"invalid_status")}try{let N=(await F.json()).data;if(!N?.metadata||!("data"in N))throw Error("Missing vault secret data");let S=N.metadata.created_time??N.metadata.created;return{data:N.data,metadata:{path:typeof N.metadata.path==="string"?N.metadata.path:j,version:typeof N.metadata.version==="number"?N.metadata.version:0,created:S instanceof Date?S:typeof S==="string"?new Date(S):new Date,...J0(N.metadata)?{contentType:J0(N.metadata)}:{}}}}catch(K){throw new V$("Error retrieving secret",j,void 0,"invalid_payload",{cause:K})}}async function e(j,h){let R=await M(j);return M6(R,j,G(),h?.kmsSlots)}async function n(j){let h=f(j),R=`${i0(h)}/metadata/${j}`,F=await q(),K=await fetch(R,{headers:F});if(K.status!==200)throw new V$(`Vault getMetadata failed (${K.status}) for ${j}`,j,K.status,"invalid_status");let N=await K.json().catch(()=>null);if(!N?.metadata||typeof N.metadata!=="object")throw new V$(`Vault getMetadata returned invalid payload for ${j}`,j,K.status,"invalid_payload");return N.metadata}async function r(j,h,R){let F=f(h),K=`${i0(F)}/${j}/${h}`,N=await q(),S=await fetch(K,{method:"POST",headers:N,body:JSON.stringify({reason:R?.reason,severity:R?.severity,incident_ref:R?.incidentRef})});if(S.status!==200&&S.status!==202&&S.status!==204)throw new V$(`Vault ${j} failed (${S.status}) for ${h}`,h,S.status,"invalid_status")}async function Q$(j,h){if(H)return await E(j).getFullSecret(j,h);if(X)return await X$(j,h);return await e(j,h)}async function A(j,h,R){if(!Q3(h))throw Error(`putSecret requires an object value for vault source at path ${j}`);if(H){await E(j).putSecret(j,h,R);return}if(X){let F=f(j),K=await q();if(K["X-Ionite-Mime-Type"]=R.contentType.mimeType,K["X-Ionite-Secret-Format"]=R.contentType.format,R.contentType.schemaUrl)K["X-Ionite-Schema-Url"]=R.contentType.schemaUrl;if(R.contentType.typeId)K["X-Ionite-Secret-Type"]=R.contentType.typeId;let N=await fetch(`${F}/${j}`,{method:"POST",headers:K,body:JSON.stringify(h)});if(N.status!==200&&N.status!==201&&N.status!==204)throw new V$(`Vault putSecret failed (${N.status}) for ${j}`,j,N.status,"invalid_status");return}await a("put_secret",{path:j,data:h,content_type:_4(R.contentType)})}async function W(j,h){if(H){await E(j).deleteSecret(j,h);return}if(X){let R=f(j),F=await q(),K=await fetch(`${R}/${j}`,{method:"DELETE",headers:F});if(K.status!==200&&K.status!==202&&K.status!==204)throw new V$(`Vault deleteSecret failed (${K.status}) for ${j}`,j,K.status,"invalid_status");return}await a("delete_secret",{path:j})}async function L(j,h){if(H)return await E(j).listPaths(j,h);if(X){let K=`${f(j)}/${j}`,N=async(d)=>{let $$=await q();if(d==="LIST")return fetch(K,{method:"LIST",headers:$$});let t=K.includes("?")?"&":"?";return fetch(`${K}${t}list=true`,{method:"GET",headers:$$})},S=await N("LIST");if(S.status===405||S.status===501)S=await N("GET");if(S.status!==200)throw new V$(`Vault listPaths failed (${S.status}) for ${j}`,j,S.status,"invalid_status");let v=await S.json().catch(()=>null),i;if(v&&typeof v==="object"){let d=v,$$=d.data;if($$&&typeof $$==="object")i=$$.keys;else i=d.keys}if(!Array.isArray(i))throw new V$(`Vault listPaths returned an unexpected response for ${j}`,j,void 0,"invalid_payload");return i.filter((d)=>typeof d==="string")}let R=await a("list_paths",{path:j});if(!Array.isArray(R.items))throw Error(`Vault websocket list_paths returned invalid payload for ${j}`);return R.items.filter((F)=>typeof F==="string")}async function k(j,h){if(H)return await E(j).exists(j,h);if(X){let F=f(j),K=await q(),N=await fetch(`${F}/${j}`,{headers:K});if(N.status===200)return!0;if(N.status===404)return!1;if(N.status===401||N.status===403)throw new V$(`Vault exists failed (${N.status}) for ${j} (auth error)`,j,N.status,"auth");throw new V$(`Vault exists failed (${N.status}) for ${j}`,j,N.status,"invalid_status")}let R=await a("exists",{path:j});if(typeof R.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${j}`);return R.exists}async function w(j,h,R){if(H){await E(j).requestRotate(j,h,R);return}if(X){await r("rotate/request",j,h);return}await a("request_rotate",{path:j,reason:h?.reason,severity:h?.severity,incident_ref:h?.incidentRef})}async function b(j,h,R){if(H){await E(j).requestRevoke(j,h,R);return}if(X){await r("revoke/request",j,h);return}await a("request_revoke",{path:j,reason:h?.reason,severity:h?.severity,incident_ref:h?.incidentRef})}async function u(j,h,R){if(H)return await E(j).parkKmsKey(j,h,R);if(X){let K=f(j),N=`${i0(K)}/kms/park/${j}`,S=await q(),v=await fetch(N,{method:"POST",headers:S,body:JSON.stringify({key_id:h.keyId,status:h.status,reason:h.reason})});if(v.status!==200&&v.status!==202)throw new V$(`Vault kms/park failed (${v.status}) for ${j}`,j,v.status,"invalid_status");return K8(await v.json().catch(()=>null),j,"http")}let F=await a("kms_park",{path:j,key_id:h.keyId,status:h.status,reason:h.reason});return K8(F,j,"websocket")}async function c(j,h,R){if(H)return await E(j).addKmsKeys(j,h,R);if(X){let K=f(j),N=`${i0(K)}/kms/add-keys/${j}`,S=await q(),v=await fetch(N,{method:"POST",headers:S,body:JSON.stringify({keys:h.keys})});if(v.status!==200&&v.status!==202)throw new V$(`Vault kms/add-keys failed (${v.status}) for ${j}`,j,v.status,"invalid_status");return D8(await v.json().catch(()=>null),j,"http")}let F=await a("kms_add_keys",{path:j,keys:h.keys});return D8(F,j,"websocket")}async function o(j,h,R){if(H)return await E(j).revokeKmsKey(j,h,R);if(X){let K=f(j),N=`${i0(K)}/kms/revoke-key/${j}`,S=await q(),v=await fetch(N,{method:"POST",headers:S,body:JSON.stringify({key_id:h.keyId,reason:h.reason})});if(v.status!==200&&v.status!==202)throw new V$(`Vault kms/revoke-key failed (${v.status}) for ${j}`,j,v.status,"invalid_status");return V8(await v.json().catch(()=>null),j,"http")}let F=await a("kms_revoke_key",{path:j,key_id:h.keyId,reason:h.reason});return V8(F,j,"websocket")}async function Y$(j,h){if(H)return await E(j).getMetadata(j,h);if(X)return await n(j);let R=await a("read_metadata",{path:j});if(!R.metadata||typeof R.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${j}`);return R.metadata}async function G$(j,h,R){if(!J)throw new w$(Q,j);return c$({getFullSecret:X$},j,h,J,G(),R,{onHealth:(F)=>{I=!F}})}async function s(j,h,R){let F=await M(j);return G8(F,j,h,R,G(),{onHealth:(K)=>{O=!K}})}function z$(j){let h=()=>{if(P.delete(h))j()};return P.add(h),h}function H$(){if(V?.isAvailable?.()===!1)return!0;for(let j of x.values())if(j.isAvailable?.()===!1)return!0;return!1}let K$={type:Q,isAvailable:()=>!I&&!O&&!H$(),get:(j,h)=>h$(()=>Q$(j,h)),getFullSecret:Q$,getSecret:async(j,h)=>{return(await Q$(j,h)).data},putSecret:A,deleteSecret:W,listPaths:L,exists:k,requestRotate:w,requestRevoke:b,parkKmsKey:u,addKmsKeys:c,revokeKmsKey:o,getMetadata:Y$,subscribe:async(j,h,R)=>{let F;if(T)F=await s(j,h,R);else if(H)F=await E(j).subscribe(j,h,R);else F=await G$(j,h,R);return z$(F)},...V?{subscribeEvents:(j)=>z$(V.subscribeEvents?.(j)??(()=>{}))}:T?{subscribeEvents:(j)=>{let h,R=!1;return M("/").then((F)=>z8(F,j,G())).then((F)=>{if(R){F();return}h=F}).catch((F)=>{G()?.warn("Vault websocket event subscription failed",F)}),z$(()=>{R=!0,h?.()})}}:{},close:()=>{for(let h of Array.from(P))try{h()}catch(R){G()?.warn("Vault source close: failed to release a subscription",R)}P.clear();let j=(h)=>{if(!h?.close)return;try{Promise.resolve(h.close()).catch((R)=>{G()?.warn("Vault source close: LFV close failed",R)})}catch(R){G()?.warn("Vault source close: LFV close failed",R)}};for(let h of x.values())j(h);j(V),x.clear(),_.token=void 0,_.expiresAt=void 0},get log(){return $.log},set log(j){$.log=j}};if(V)K$.isDeliveryRequest=(j)=>V.isDeliveryRequest(j),K$.isEventsRequest=(j)=>V.isEventsRequest(j),K$.handleDelivery=(j)=>V.handleDelivery(j),K$.handleEvents=(j)=>V.handleEvents(j),Object.defineProperties(K$,{deliveryPath:{value:V.deliveryPath,enumerable:!0},eventsPath:{value:V.eventsPath,enumerable:!0},callbackKey:{value:V.callbackKey,enumerable:!0},trustId:{value:V.trustId,enumerable:!0}});return K$}class j4 extends Error{status;constructor($,Z){super($);this.name="AzureKeyVaultError",this.status=Z,Object.setPrototypeOf(this,j4.prototype)}}function A4($,Z){if(!$||$.trim().length===0)throw Error(`Missing required Azure config: ${Z}`);return $}function _3($){return $.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function W6($,Z){return`${$.replace(/\/+$/g,"")}/${Z.replace(/^\/+/g,"")}`}function B3($){try{let Q=new URL($).pathname.split("/").filter(Boolean),X=Q.indexOf("secrets");if(X===-1)return;return Q[X+2]||void 0}catch{return}}function H3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function E4($){let Z=$.apiVersion??"7.4",Q=$.scope??"https://vault.azure.net/.default",X=$.secretNameTransform??_3,Y=$.authMethod,J="/var/run/secrets/azure/tokens/azure-identity-token",G=$.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",z=$.vaultUrl??($.vaultName?`https://${$.vaultName}.vault.azure.net`:void 0)??void 0,_=A4(z,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function B(A){try{return await z3(A),!0}catch{return!1}}let H,D,V=!1;async function x(A){let{entraTenantId:W,clientId:L}=$;if(!W)throw Error("Workload identity requires entraTenantId");if(!L)throw Error("Workload identity requires clientId");if(!await B(G))throw Error(`Federated token file not found at ${G}`);let k=(await G3(G,"utf8")).trim();if(!k)throw Error("Federated token file was empty");let w=`https://login.microsoftonline.com/${encodeURIComponent(W)}/oauth2/v2.0/token`,b=new URLSearchParams({client_id:L,grant_type:"client_credentials",scope:Q,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:k}),u=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:b});if(u.status!==200)throw Error(`Azure workload identity token exchange returned ${u.status} ${u.statusText}`);let c=await u.json();if(!c?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:c.access_token,expiresAtMs:A+(c.expires_in??0)*1000},c.access_token}async function T(A){let W=$.imdsApiVersion??"2018-02-01",L="https://vault.azure.net",k=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(k.searchParams.set("api-version",W),k.searchParams.set("resource","https://vault.azure.net"),$.managedIdentityClientId)k.searchParams.set("client_id",$.managedIdentityClientId);let w=await fetch(k.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(w.status!==200)throw Error(`Azure IMDS token endpoint returned ${w.status} ${w.statusText}`);let b=await w.json();if(!b?.access_token)throw Error("IMDS token response missing access_token");let u=A+60000;if(b.expires_on){let c=Number.parseInt(b.expires_on,10);if(Number.isFinite(c)&&c>0)u=c*1000;else{let o=Date.parse(b.expires_on);if(Number.isFinite(o))u=o}}else if(b.expires_in){let c=Number.parseInt(b.expires_in,10);if(Number.isFinite(c)&&c>0)u=A+c*1000}return H={accessToken:b.access_token,expiresAtMs:u},b.access_token}async function P(A){let W=A4($.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),L=A4($.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),k=A4($.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),w=`https://login.microsoftonline.com/${encodeURIComponent(W)}/oauth2/v2.0/token`,b=new URLSearchParams({client_id:L,client_secret:k,grant_type:"client_credentials",scope:Q}),u=await fetch(w,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:b});if(u.status!==200)throw Error(`Azure token endpoint returned ${u.status} ${u.statusText}`);let c=await u.json();if(!c?.access_token)throw Error("Azure token response missing access_token");return H={accessToken:c.access_token,expiresAtMs:A+(c.expires_in??0)*1000},c.access_token}async function I(){let A=Date.now();if(H&&H.expiresAtMs-60000>A)return H.accessToken;if(D)return D;D=(async()=>{if(Y==="workload_identity")return await x(A);if(Y==="managed_identity")return await T(A);if(Y==="client_secret")return await P(A);if(await B(G))try{return await x(A)}catch{}try{return await T(A)}catch{}return await P(A)})();try{return await D}finally{D=void 0}}async function O(A){let W=await I(),L=W6(_,`/secrets/${encodeURIComponent(A)}?api-version=${encodeURIComponent(Z)}`),k=await fetch(L,{headers:{Authorization:`Bearer ${W}`,Accept:"application/json"}});if(k.status!==200)throw new j4(`Key Vault request failed (${k.status})`,k.status);return await k.json()}async function q(A,W){let L=X(A),k=$.secretNamePrefix?`${$.secretNamePrefix}${L}`:L,w=await O(k),b=w.value;try{b=JSON.parse(w.value)}catch{}let u=w.attributes?.created?w.attributes.created*1000:void 0,c=B3(w.id),o=w.contentType?z4({mimeType:w.contentType,format:w.tags?.["ionite-format"],schemaUrl:w.tags?.["ionite-schema-url"],typeId:w.tags?.["ionite-type-id"]}):void 0;return{data:b,metadata:{path:A,version:Number.parseInt(c??"",10)||0,created:u?new Date(u):new Date,...o?{contentType:o}:{}}}}async function M(A,W,L){if(!H3(W))throw Error(`putSecret requires an object value for azure source at path ${A}`);let k=X(A),w=$.secretNamePrefix?`${$.secretNamePrefix}${k}`:k,b=await I(),u=W6(_,`/secrets/${encodeURIComponent(w)}?api-version=${encodeURIComponent(Z)}`),c=JSON.stringify({value:JSON.stringify(W),contentType:L.contentType.mimeType,tags:{"ionite-format":L.contentType.format,...L.contentType.schemaUrl?{"ionite-schema-url":L.contentType.schemaUrl}:{},...L.contentType.typeId?{"ionite-type-id":L.contentType.typeId}:{}}}),o=await fetch(u,{method:"PUT",headers:{Authorization:`Bearer ${b}`,"Content-Type":"application/json",Accept:"application/json"},body:c});if(o.status!==200&&o.status!==201)throw Error(`Key Vault putSecret failed (${o.status}) for ${A}`)}async function E(A,W){let L=X(A),k=$.secretNamePrefix?`${$.secretNamePrefix}${L}`:L,w=await I(),b=W6(_,`/secrets/${encodeURIComponent(k)}?api-version=${encodeURIComponent(Z)}`),u=await fetch(b,{method:"DELETE",headers:{Authorization:`Bearer ${w}`,Accept:"application/json"}});if(u.status!==200&&u.status!==202&&u.status!==204)throw Error(`Key Vault deleteSecret failed (${u.status}) for ${A}`)}async function f(A,W){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${A}`)}async function g(A,W){try{return await q(A),!0}catch(L){if(L instanceof j4&&L.status===404)return!1;throw L}}async function a(A,W,L){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${A}`)}async function X$(A,W,L){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${A}`)}async function e(A){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${A}`)}async function n(A){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${A}`)}async function r(A){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${A}`)}async function Q$(A,W){let L=X(A),k=$.secretNamePrefix?`${$.secretNamePrefix}${L}`:L,w=await O(k),b=w.contentType?z4({mimeType:w.contentType,format:w.tags?.["ionite-format"],schemaUrl:w.tags?.["ionite-schema-url"],typeId:w.tags?.["ionite-type-id"]}):void 0;return{id:w.id,...b?{content_type:b}:{},...w.attributes??{}}}return{type:$.type,isAvailable:()=>!V,get:(A,W)=>h$(()=>q(A,W)),getFullSecret:q,getSecret:async(A,W)=>{return(await q(A,W)).data},putSecret:M,deleteSecret:E,listPaths:f,exists:g,requestRotate:a,requestRevoke:X$,parkKmsKey:e,addKmsKeys:n,revokeKmsKey:r,getMetadata:Q$,subscribe:(A,W,L)=>{if(!$.ttl)throw new w$("azure",A);return K0($.ttl),c$({getFullSecret:q},A,W,$.ttl,void 0,L,{onHealth:(k)=>{V=!k}})},close:()=>{H=void 0,D=void 0,V=!1}}}var O6=Symbol("ion.secretsSourceState");function D3($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${X}`)};return{type:"dev",get:(Q,X)=>h$(()=>Promise.reject(Z("get",Q))),getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),parkKmsKey:(Q,X,Y)=>Promise.reject(Z("parkKmsKey",Q)),addKmsKeys:(Q,X,Y)=>Promise.reject(Z("addKmsKeys",Q)),revokeKmsKey:(Q,X,Y)=>Promise.reject(Z("revokeKmsKey",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[O6]:"unavailable"}}function U8($){let Z=(Q,X)=>{throw Error(`${Q} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${X}`)};return{type:"dev",get:(Q,X)=>h$(()=>Promise.reject(Z("get",Q))),getFullSecret:(Q,X)=>Promise.reject(Z("getFullSecret",Q)),getSecret:(Q,X)=>Promise.reject(Z("getSecret",Q)),putSecret:(Q,X,Y)=>Promise.reject(Z("putSecret",Q)),subscribe:async(Q,X)=>{return Z("subscribe",Q),()=>{}},deleteSecret:(Q,X)=>Promise.reject(Z("deleteSecret",Q)),listPaths:(Q,X)=>Promise.reject(Z("listPaths",Q)),exists:(Q,X)=>Promise.reject(Z("exists",Q)),requestRotate:(Q,X,Y)=>Promise.reject(Z("requestRotate",Q)),requestRevoke:(Q,X,Y)=>Promise.reject(Z("requestRevoke",Q)),parkKmsKey:(Q,X,Y)=>Promise.reject(Z("parkKmsKey",Q)),addKmsKeys:(Q,X,Y)=>Promise.reject(Z("addKmsKeys",Q)),revokeKmsKey:(Q,X,Y)=>Promise.reject(Z("revokeKmsKey",Q)),getMetadata:(Q,X)=>Promise.reject(Z("getMetadata",Q)),[O6]:"removed"}}function V3($){return $.type==="vault"&&$.lfv!=null}function U3($,Z,Q,X){if(!V3(Z))return;if(Q||X)return;throw Error(`Secrets source "${$}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function F3($,Z,Q){if(Z.type==="vault")return P0(Z,Q);if(Z.type==="azure")return E4(Z);if(Z.type==="aws"||Z.type==="gcp"||Z.type==="dev")throw Error(`Secrets source "${$}" uses type "${Z.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${$}"`)}function M3($,Z){let Q=(X)=>{Z.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:X instanceof Error?X.message:String(X)})};try{Promise.resolve($.close?.()).catch(Q)}catch(X){Q(X)}}function W3($){let Z=new Map,Q=new Map,X=new Map;for(let[Y,J]of Object.entries($)){if(!F8(J))continue;let G=Z.get(J.deliveryPath);if(G)throw Error(`LFV delivery path "${J.deliveryPath}" is claimed by both secrets sources "${G}" and "${Y}"; delivery paths must be globally unique.`);Z.set(J.deliveryPath,Y);let z=Q.get(J.eventsPath);if(z)throw Error(`LFV events path "${J.eventsPath}" is claimed by both secrets sources "${z}" and "${Y}"; events paths must be globally unique.`);Q.set(J.eventsPath,Y);let _=X.get(J.callbackKey);if(_&&_.trustId!==J.trustId)throw Error(`LFV callback key "${J.callbackKey}" is claimed by secrets sources "${_.sourceName}" and "${Y}" with different verify JWKS; a callback path must use a single trust key.`);if(!_)X.set(J.callbackKey,{sourceName:Y,trustId:J.trustId})}}function F8($){return typeof $.isDeliveryRequest==="function"&&typeof $.isEventsRequest==="function"&&typeof $.handleDelivery==="function"&&typeof $.handleEvents==="function"}function O3($,Z,Q){let X={...Z},Y=[],J=(z)=>{if(X[z]!==void 0)delete X[z],Y.push(z)};J("token"),J("clientSecret"),J("workload");let G=X.websocket;if(G&&typeof G==="object"&&G.token!==void 0){let z={...G};delete z.token,X.websocket=z,Y.push("websocket.token")}if(Y.length>0)Q.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:$,"ion.droppedFields":Y});return X}function L3($,Z,Q){let X={},Y=new Set([...Object.keys(Z??{}),...Object.keys(Q??{})]);for(let J of Y){let G=Z?.[J],z=Q?.[J],_=z?O3(J,z,$):void 0;X[J]={...G??{},..._??{}}}return X}function R4($){return $[O6]??"available"}function N3($,Z,Q){let X=Z,Y=new Set,J=new Set,G=new Set,z=b$(Q,`Secrets source "${$}"`),_=()=>R4(X)==="available",B=U$(`Secrets source "${$}"`,_),H=(M,E,f)=>{return Error(`${M} timed out after ${f}ms waiting for source "${$}" to be configured by the ConfigSource at path ${E}`)},D=(M,E)=>{return Error(`${M} is unavailable for source "${$}" because it is no longer configured on this Ionite instance at path ${E}`)},V=(M,E,f)=>{let g=R4(X);if(g==="available")return Promise.resolve(X);if(g==="removed")return Promise.reject(D(M,E));return new Promise((a,X$)=>{let e={method:M,path:E,resolve:(r)=>{if(e.timeout)clearTimeout(e.timeout);G.delete(e),a(r)},reject:(r)=>{if(e.timeout)clearTimeout(e.timeout);G.delete(e),X$(r)}},n=f?.timeout;if(typeof n==="number"&&n>0)e.timeout=setTimeout(()=>{e.reject(H(M,E,n))},n);G.add(e)})},x=(M)=>{for(let E of Array.from(G))E.resolve(M)},T=()=>{for(let M of Array.from(G))M.reject(D(M.method,M.path))},P=async(M,E=!1)=>{let f=M.guard.next();if(M.unsubscribe?.(),M.unsubscribe=void 0,M.closed)return;if(R4(X)==="unavailable"&&M.options?.mode!=="wait"){if(E)throw Error(`subscribe is unavailable for source "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${M.path}`);return}try{let a=await(M.options?.mode==="wait"?await V("subscribe",M.path,M.options):X).subscribe(M.path,(X$)=>{if(!M.closed)M.onChange(X$)},M.options);if(M.closed||!M.guard.isCurrent(f)){a?.();return}M.unsubscribe=a}catch(g){if(E)throw g;if(D4(g)){Q.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:$,path:M.path});return}Q.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:$,path:M.path,error:g instanceof Error?g.message:String(g)})}},I=(M,E=!1)=>{if(M.unsubscribe?.(),M.unsubscribe=void 0,M.closed)return;if(!X.subscribeEvents){if(E)throw Error(`Secrets source "${$}" does not support lifecycle event subscriptions`);return}M.unsubscribe=X.subscribeEvents((f)=>{if(!M.closed)M.listener(f)})},O={get type(){return X.type},beforeChange:z.beforeChange,afterChange:z.afterChange,isAvailable:()=>_()&&(X.isAvailable?.()??!0),isReady:B.isReady,ready:B.ready,get:(M,E)=>h$(async()=>{return(await V("get",M,E)).getFullSecret(M,E)}),getFullSecret:async(M,E)=>{return(await V("getFullSecret",M,E)).getFullSecret(M,E)},getSecret:async(M,E)=>{return(await V("getSecret",M,E)).getSecret(M,E)},putSecret:async(M,E,f)=>{return(await V("putSecret",M,f)).putSecret(M,E,f)},subscribe:async(M,E,f)=>{let g={path:M,onChange:E,options:f,closed:!1,guard:M4()};Y.add(g);try{await P(g,!0)}catch(a){throw Y.delete(g),a}return()=>{g.closed=!0,g.guard.next(),Y.delete(g),g.unsubscribe?.(),g.unsubscribe=void 0}},subscribeEvents:(M)=>{let E={listener:M,closed:!1};J.add(E);try{I(E,!0)}catch(f){throw J.delete(E),f}return()=>{E.closed=!0,J.delete(E),E.unsubscribe?.(),E.unsubscribe=void 0}},deleteSecret:async(M,E)=>{return(await V("deleteSecret",M,E)).deleteSecret(M,E)},listPaths:async(M,E)=>{return(await V("listPaths",M,E)).listPaths(M,E)},exists:async(M,E)=>{return(await V("exists",M,E)).exists(M,E)},requestRotate:async(M,E,f)=>{return(await V("requestRotate",M,f)).requestRotate(M,E,f)},requestRevoke:async(M,E,f)=>{return(await V("requestRevoke",M,f)).requestRevoke(M,E,f)},parkKmsKey:async(M,E,f)=>{return(await V("parkKmsKey",M,f)).parkKmsKey(M,E,f)},addKmsKeys:async(M,E,f)=>{return(await V("addKmsKeys",M,f)).addKmsKeys(M,E,f)},revokeKmsKey:async(M,E,f)=>{return(await V("revokeKmsKey",M,f)).revokeKmsKey(M,E,f)},getMetadata:async(M,E)=>{return(await V("getMetadata",M,E)).getMetadata(M,E)}},q=(M)=>{try{Promise.resolve(M.close?.()).catch((E)=>{Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:E instanceof Error?E.message:String(E)})})}catch(E){Q.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:$,error:E instanceof Error?E.message:String(E)})}};return{api:O,update(M){if(M===X)return;let E=X;z.emitBefore(),X=M;let f=R4(M);if(f==="available")x(M);else if(f==="removed")T();B.refresh();for(let g of Y)P(g);for(let g of J)I(g);q(E),z.emitAfter()},close(){for(let M of Y)M.closed=!0,M.guard.next(),M.unsubscribe?.(),M.unsubscribe=void 0;Y.clear();for(let M of J)M.closed=!0,M.unsubscribe?.(),M.unsubscribe=void 0;J.clear(),T(),B.settle(),q(X)}}}function M8($,Z=new Map){let Q=new Map,X=new Map,Y,J=!1,G=new Map,z=b$($,"Secrets"),_=!1,B=()=>{for(let O of Q.keys()){let q=G.get(O);if(q&&q.api.isReady?.()===!1)return!1}return!0},H=U$("Secrets module",()=>_&&B()),D=(O)=>{let q=G.get(O);if(q)return q;let M=N3(O,Q.get(O)??U8(O),$);if(G.set(O,M),!(O in I))Object.assign(I,{[O]:M.api});return M},V=(O)=>{let q=G.get(O)?.api;if(q)return q;throw $.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:O}),Error(`Secrets source "${O}" is not configured`)},x=()=>{return Array.from(Q.values()).filter(F8)},T=(O)=>{return x().find((q)=>q.isDeliveryRequest(O))},P=(O)=>{return x().find((q)=>q.isEventsRequest(O))},I;return I={get config(){return Object.fromEntries(Array.from(Q.keys(),(O)=>[O,D(O).api]))},beforeChange:z.beforeChange,afterChange:z.afterChange,isReady:H.isReady,isAvailable:()=>{for(let O of G.values()){if(O.api.isReady?.()===!1)continue;if(O.api.isAvailable?.()===!1)return!1}return!0},ready:H.ready,listSecretsSources:()=>Array.from(Q.keys()),getSecretsSource:(O)=>{if(Q.has(O))return D(O).api;return V(O)},get:(O,q,M)=>I.getSecretsSource(O).get(q,M),getSecret:(O,q,M)=>I.getSecretsSource(O).getSecret(q,M),getFullSecret:(O,q,M)=>I.getSecretsSource(O).getFullSecret(q,M),putSecret:(O,q,M,E)=>I.getSecretsSource(O).putSecret(q,M,E),deleteSecret:(O,q,M)=>I.getSecretsSource(O).deleteSecret(q,M),listPaths:(O,q,M)=>I.getSecretsSource(O).listPaths(q,M),exists:(O,q,M)=>I.getSecretsSource(O).exists(q,M),requestRotate:(O,q,M,E)=>I.getSecretsSource(O).requestRotate(q,M,E),requestRevoke:(O,q,M,E)=>I.getSecretsSource(O).requestRevoke(q,M,E),parkKmsKey:(O,q,M,E)=>I.getSecretsSource(O).parkKmsKey(q,M,E),addKmsKeys:(O,q,M,E)=>I.getSecretsSource(O).addKmsKeys(q,M,E),revokeKmsKey:(O,q,M,E)=>I.getSecretsSource(O).revokeKmsKey(q,M,E),getMetadata:(O,q,M)=>I.getSecretsSource(O).getMetadata(q,M),subscribe:(O,q,M,E)=>I.getSecretsSource(O).subscribe(q,M,E),isLfvDeliveryRequest:(O)=>T(O)!==void 0,isLfvEventsRequest:(O)=>P(O)!==void 0,handleLfvDelivery:async(O)=>{let q=T(O);if(!q)return D$();return q.handleDelivery(O)},handleLfvEvents:async(O)=>{let q=P(O);if(!q)return D$();return q.handleEvents(O)}},{update(O,q,M,E,f){let g=O!==void 0||q!==void 0;if(!g&&!_&&G.size===0)return;let a=L3($,O,q),X$=f===!0,e=E!==Y,n=X$!==J,r=new Map,Q$=new Map,A=[];try{for(let[W,L]of Object.entries(a)){let k=K3(L),w=Q.get(W);if(w&&X.get(W)===k&&!e&&!n){r.set(W,w),Q$.set(W,k);continue}let b;if(!L.type)b=D3(W);else{if(M?.validateSourceConfig?.(W,L),Z.has(W)&&O?.[W])$.warn(`RemoteConfig secrets source "${W}" is superseded by the framework LFV bootstrap source.`);if(!Z.has(W))U3(W,L,E,X$),b=F3(W,L,E),A.push(b);else b=Z.get(W)}r.set(W,b),Q$.set(W,k)}W3(Object.fromEntries(r))}catch(W){for(let L of A)M3(L,$);throw W}z.emitBefore(),_=g,Y=E,J=X$;for(let[W,L]of r)Q.set(W,L),X.set(W,Q$.get(W)),D(W).update(L);for(let[W,L]of G){if(r.has(W))continue;Q.delete(W),X.delete(W),L.update(U8(W))}return H.refresh(),z.emitAfter(),I},close(){for(let O of G.values())O.close();G.clear(),Q.clear(),X.clear(),Y=void 0,_=!1,H.settle()}}}function L6($,Z){let Q=Z.ttlMs,X=Math.max(1,Math.floor(Z.maxEntries)),Y=new Map,J=()=>Date.now();function G(){while(Y.size>X){let _=Y.keys().next().value;if(_===void 0)break;Y.delete(_)}}function z(_,B){Y.delete(_),Y.set(_,{session:B,expiresAt:J()+Q}),G()}return{async create(_){await $.create(_)},async get(_){let B=Y.get(_);if(B){if(B.expiresAt>J())return Y.delete(_),Y.set(_,B),B.session;Y.delete(_)}let H=await $.get(_);if(H)z(_,H);return H},async update(_,B){await $.update(_,B),Y.delete(_)},async delete(_){await $.delete(_),Y.delete(_)}}}import{deepEqualPlain as y3,ION_ENDPOINT_PERMISSIONS as h3,trimTrailingSlash as I4,validationFailureResponse as f3}from"@ionite/core";import{assertEcid as W8,jwtAssertionClaimsSchema as A3,must as S$,workloadTokenResponseSchema as j3}from"@ionite/core";import{getCachedVerificationKey as E3,getJwks as R3}from"@ionite/core/server";function v$($,Z){return Z in $&&$[Z]!==void 0&&$[Z]!==null}function E$($){if($===void 0||$===null)return!1;return v$($,"workloadId")||v$($,"privateKey")}function f$($){if($===void 0||$===null)return!1;let Z=v$($,"clientId"),Q=v$($,"clientSecret"),X=v$($,"workloadId"),Y=v$($,"privateKey");return(Z||Q)&&!X&&!Y}function N6($){if($===void 0||$===null)return!1;let Z=v$($,"jwksUri"),Q=v$($,"workloadId"),X=v$($,"clientId"),Y=v$($,"clientSecret"),J=v$($,"privateKey");return Z&&!Q&&!J&&!X&&!Y}function O8($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return"clientId"in Z||"jwksUri"in Z||"workloadId"in Z}function P3($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;if(O8(Z))return!1;let Q=Object.entries(Z);if(Q.length===0)return!1;return Q.every(([,X])=>O8(X))}function E8($){if($===null||typeof $!=="object"||Array.isArray($))return!1;let Z=$;if("incoming"in Z||"outgoing"in Z){if(Z.incoming!==void 0&&(typeof Z.incoming!=="object"||Z.incoming===null))return!1;if(Z.outgoing!==void 0&&(typeof Z.outgoing!=="object"||Z.outgoing===null||Array.isArray(Z.outgoing)))return!1;return!0}return!1}function R8($){return E8($)}function A6($){if(!$)return;if(R8($))return Array.isArray($.incoming)?void 0:$.incoming;return $}function q6($){if($===void 0||$===null)return[];return Array.isArray($)?$:[$]}function q0($){if(typeof $!=="string")return;return $.endsWith("/")?$.slice(0,-1):$}function L8($){if(!$)return[];if(Array.isArray($))return $.filter((Z)=>!!Z&&typeof Z.issuer==="string"&&typeof Z.jwksUri==="string").map((Z)=>({issuer:Z.issuer,jwksUri:Z.jwksUri,audience:Z.audience,scopesAsEntitlements:Z.scopesAsEntitlements}));if($.issuer&&$.jwksUri)return[{issuer:$.issuer,jwksUri:$.jwksUri,audience:$.audience??[],scopesAsEntitlements:$.scopesAsEntitlements}];return[]}function q3($){let Z=$[0];if(!Z)return;let Q=q6(Z.audience);return{jwksUri:Z.jwksUri,issuer:Z.issuer,audience:typeof Q[0]==="string"?Q[0]:void 0}}function N8($,Z){let Q=q0(Z);if(!Q)return;return $.find((X)=>q0(X.issuer)===Q)}function P4($,Z,Q){let X=q6($);if(Z.some((Y)=>X.includes(Y)))return!0;if(typeof Q==="string"&&Z.includes(Q))return!0;return!1}function j6($){if(!$||!R8($))return{};return $.outgoing??{}}function T3($){return{getToken:$.getToken,refreshToken:$.refreshToken,generateJWTAssertion:$.generateJWTAssertion,revokeToken:$.revokeToken,beforeChange:$.beforeChange,afterChange:$.afterChange,isReady:$.isReady,ready:$.ready}}var T6=Symbol("ion.workloadClientState"),P8=Symbol("ion.namedWorkloadClients");function T0($,Z){let Q=U$($,Z);return{isReady:Q.isReady,ready:Q.ready}}function I3($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...T0(`workload client "${$}"`,()=>!1),getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[T6]:"unavailable"}}function A8($){let Z=(Q)=>{throw Error(`${Q} is unavailable for workload client "${$}" because it is no longer configured on this Ionite instance.`)};return{...T0(`workload client "${$}"`,()=>!1),getToken:async()=>Z("getToken"),refreshToken:async()=>Z("refreshToken"),generateJWTAssertion:async()=>Z("generateJWTAssertion"),revokeToken:async()=>Z("revokeToken"),[T6]:"removed"}}function x3($){if(!$)return"removed";return $[T6]??"available"}function E6($,Z,Q){let X=$,Y=X,J=new Set;for(let G of Q){if(J.add(G),G in Y)continue;let z=Z[G];Y[G]=z?T3(z):I3(G)}return Object.defineProperty(Y,P8,{value:J,enumerable:!1,configurable:!0}),X}function j8($){if(!$)return[];let Z=$[P8];return Z?Array.from(Z):[]}function w3($,Z,Q){let X=Z,Y=b$(Q,`Workload client "${$}"`),J=()=>x3(X)==="available",G=U$(`Workload client "${$}"`,J);return{api:{beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:G.isReady,ready:G.ready,getToken:(_)=>X.getToken(_),refreshToken:(_)=>X.refreshToken(_),generateJWTAssertion:(_)=>X.generateJWTAssertion(_),revokeToken:(_)=>X.revokeToken(_)},update(_){if(_===X)return;Y.emitBefore(),X=_,G.refresh(),Y.emitAfter()}}}function q8($){let Z,Q=!1,X=U$("Workload module",()=>Q),Y=b$($,"Workload"),J=new Map,G=new Set,z=new Set(["beforeChange","afterChange","isReady","ready"]),_=(V)=>{if(!Z)throw Error(`${V} is unavailable because workload is not configured on this Ionite instance.`);return Z},B={beforeChange:Y.beforeChange,afterChange:Y.afterChange,isReady:X.isReady,ready:X.ready,get config(){return Z?.config??{}},getToken(...V){return _("getToken").getToken(...V)},refreshToken(V){return _("refreshToken").refreshToken(V)},generateJWTAssertion(V){return _("generateJWTAssertion").generateJWTAssertion(V)},revokeToken(V){return _("revokeToken").revokeToken(V)},validateToken(V){return _("validateToken").validateToken(V)},getWorkloadIdentity(V){return _("getWorkloadIdentity").getWorkloadIdentity(V)},parseJWT(V){return _("parseJWT").parseJWT(V)},handler(V){return _("handler").handler(V)}},H=(V)=>{for(let P of G)delete B[P];if(G.clear(),!V)return;let x=new Set(j8(V)),T=new Set([...z,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...x]);for(let[P,I]of Object.entries(V)){if(T.has(P))continue;B[P]=I,G.add(P)}},D=(V)=>{let x=J.get(V);if(x)return x;let T=w3(V,A8(V),$);if(J.set(V,T),!(V in B))B[V]=T.api;return T};return{update(V){if(!V&&!Q&&J.size===0)return;Y.emitBefore(),Q=V!==void 0,X.refresh(),Z=V;let x=new Set(j8(V));for(let T of x){let P=V[T];D(T).update(P)}for(let[T,P]of J){if(x.has(T))continue;P.update(A8(T))}return H(V),Y.emitAfter(),B}}}async function R6($,Z,Q){if($===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let X=Q[$];if(!X)throw Error(`Unknown workload client: ${$}`);return X.getToken(Z)}function P6($,Z){return`${$}|${Z??""}`}function i$($,Z,Q,X,Y){let J={jwtAssertionClaims:$?.jwtAssertionClaims??A3("server"),tokenResponse:$?.tokenResponse??j3("server")},G=async(F,K)=>{let N=F;if(typeof N.validate==="function")return N.validate(K);return F["~standard"].validate(K)};if(!Q&&!X)return;if(Q&&E8(Q)){let F=Q.incoming,K=L8(F),N=Array.isArray(F)?q3(F):F,S=A6(X),v=j6(X),i=N?{...N,...S,jwksUri:N.jwksUri,issuer:N.issuer}:S;if(!i||!i.tokenUrl&&!i.jwksUri)Z.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let d=i&&(i.tokenUrl||i.jwksUri)?i$($,Z,N??void 0,S,K):void 0,$$=Array.from(new Set([...Object.keys(Q.outgoing??{}),...Object.keys(v)])).map((_$)=>[_$,{...Q.outgoing?.[_$]??{},...v[_$]??{}}]),t={};for(let[_$,Z0]of $$){let m$=i$($,Z,Z0,void 0);if(m$)t[_$]=m$}if(!d&&Object.keys(t).length===0)return;let F$={...d?.config??{},config:d?.config??{},...T0("workload",()=>d?.isReady()===!0||Object.values(t).some((_$)=>_$.isReady())),getToken:async(_$,Z0)=>R6(_$,Z0,t),getServerToken:async(_$)=>{if(!d)throw Error("No server workload config");return d.getToken(_$)},refreshToken:async(_$)=>{if(!d)throw Error("No default workload config");return d.refreshToken(_$)},generateJWTAssertion:async(_$)=>{if(!d)throw Error("No default workload config");return d.generateJWTAssertion(_$)},revokeToken:async(_$)=>{if(!d)throw Error("No default workload config");return d.revokeToken(_$)},validateToken:async(_$)=>{if(!d)throw Error("No default workload config");return d.validateToken(_$)},getWorkloadIdentity:async(_$)=>{if(!d)return;return d.getWorkloadIdentity(_$)},parseJWT:async(_$)=>{if(!d)throw Error("No default workload config");return d.parseJWT(_$)},handler:async(_$)=>{if(!d)return D$();return d.handler(_$)}};return E6(F$,t,$$.map(([_$])=>_$))}if(Q&&P3(Q)){let F=A6(X),K=j6(X),N=Q.default,S=N?{...N,...F,jwksUri:N.jwksUri,issuer:N.issuer}:F;if(!S||!S.tokenUrl&&!S.jwksUri)Z.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let v=S&&(S.tokenUrl||S.jwksUri)?i$($,Z,N??void 0,F):void 0,i=Array.from(new Set([...Object.keys(Q).filter((t)=>t!=="default"),...Object.keys(K)])).map((t)=>[t,{...t in Q?Q[t]:{},...K[t]??{}}]),d={};for(let[t,F$]of i){let _$=i$($,Z,F$,void 0);if(_$)d[t]=_$}if(!v&&Object.keys(d).length===0)return;let $$={...v?.config??{},config:v?.config??{},...T0("workload",()=>v?.isReady()===!0||Object.values(d).some((t)=>t.isReady())),getToken:async(t,F$)=>R6(t,F$,d),getServerToken:async(t)=>{if(!v)throw Error("No server workload config");return v.getToken(t)},refreshToken:async(t)=>{if(!v)throw Error("No default workload config");return v.refreshToken(t)},generateJWTAssertion:async(t)=>{if(!v)throw Error("No default workload config");return v.generateJWTAssertion(t)},revokeToken:async(t)=>{if(!v)throw Error("No default workload config");return v.revokeToken(t)},validateToken:async(t)=>{if(!v)throw Error("No default workload config");return v.validateToken(t)},getWorkloadIdentity:async(t)=>{if(!v)return;return v.getWorkloadIdentity(t)},parseJWT:async(t)=>{if(!v)throw Error("No default workload config");return v.parseJWT(t)},handler:async(t)=>{if(!v)return D$();return v.handler(t)}};return E6($$,d,i.map(([t])=>t))}let z=A6(X),_=j6(X);if(!Q&&Object.keys(_).length>0){let F={};for(let[S,v]of Object.entries(_)){let i=i$($,Z,v,void 0);if(i)F[S]=i}let K=z&&(z.tokenUrl||z.jwksUri)?i$($,Z,z,void 0):void 0;if(!K&&Object.keys(F).length===0)return;let N={...K?.config??{},config:K?.config??{},...T0("workload",()=>K?.isReady()===!0||Object.values(F).some((S)=>S.isReady())),getToken:async(S,v)=>R6(S,v,F),getServerToken:async(S)=>{if(!K)throw Error("No server workload config");return K.getToken(S)},refreshToken:async(S)=>{if(!K)throw Error("No default workload config");return K.refreshToken(S)},generateJWTAssertion:async(S)=>{if(!K)throw Error("No default workload config");return K.generateJWTAssertion(S)},revokeToken:async(S)=>{if(!K)throw Error("No default workload config");return K.revokeToken(S)},validateToken:async(S)=>{if(!K)throw Error("No default workload config");return K.validateToken(S)},getWorkloadIdentity:async(S)=>{if(!K)return;return K.getWorkloadIdentity(S)},parseJWT:async(S)=>{if(!K)throw Error("No default workload config");return K.parseJWT(S)},handler:async(S)=>{if(!K)return D$();return K.handler(S)}};return E6(N,F,Object.keys(_))}let B=Q,H=Y??L8(B),D=z?.tokenUrl,V=D?.startsWith("/")?D:void 0,x=B?.idpTokenUrl??z?.idpTokenUrl??(B?.tokenUrl&&(B.tokenUrl.startsWith("http://")||B.tokenUrl.startsWith("https://"))?B.tokenUrl:void 0),T={...B,...z,tokenUrl:V??z?.tokenUrl??B?.tokenUrl,idpTokenUrl:x,jwksUri:B?.jwksUri,issuer:B?.issuer};T._handlerTokenUrl=V;let P,I=T,O=E$(T),q=f$(T),M=N6(T);if(!O&&!q&&!M){if(!B||Object.keys(B).length===0)return;throw Z.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(T),clientId:I.clientId,clientSecret:I.clientSecret?"[REDACTED]":void 0,workloadId:I.workloadId,privateKey:I.privateKey?"[REDACTED]":void 0,jwksUri:I.jwksUri,tokenUrl:I.tokenUrl,idpTokenUrl:I.idpTokenUrl,fromVaultKeys:B?Object.keys(B):[],fromCodeKeys:X?Object.keys(X):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(O)P={...T,tokenUrl:T.tokenUrl,idpTokenUrl:S$(T.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:S$(T.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:S$(T.privateKey,"Missing 'privateKey' from Workload Config"),audience:S$(T.audience,"Missing 'audience' from Workload Config"),scope:T.scope??"",algorithm:T.algorithm??"RS256",tokenLifetime:T.tokenLifetime??300,refreshThreshold:T.refreshThreshold??60,autoRefresh:T.autoRefresh!==void 0?T.autoRefresh:!0,tokenStore:T.tokenStore??new Q0};else if(f$(T))P={...T,tokenUrl:T.tokenUrl,idpTokenUrl:S$(T.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:S$(T.clientId,"Missing 'clientId' from Workload Config"),clientSecret:S$(T.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:T.scope??"",tokenLifetime:T.tokenLifetime??300,refreshThreshold:T.refreshThreshold??60,autoRefresh:T.autoRefresh!==void 0?T.autoRefresh:!0,tokenStore:T.tokenStore??new Q0};else if(N6(T))P=T;function E(){let F=new Uint8Array(16);return crypto.getRandomValues(F),Array.from(F,(K)=>K.toString(16).padStart(2,"0")).join("")}function f(F){let K;if(typeof F==="string")K=btoa(F);else K=btoa(String.fromCharCode(...F));return K.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function g(F){let K=F.replace(/-/g,"+").replace(/_/g,"/");while(K.length%4)K+="=";return atob(K)}function a(F){if(F.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:F==="RS256"?"SHA-256":F==="RS384"?"SHA-384":"SHA-512"};else if(F.startsWith("ION"))return{name:"ECDSA",namedCurve:F==="ES256"?"P-256":F==="ES384"?"P-384":"P-521",hash:F==="ES256"?"SHA-256":F==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${F}`)}async function X$(F,K){let N=F.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),S=Uint8Array.from(atob(N),(i)=>i.charCodeAt(0)),v=a(K);return crypto.subtle.importKey("pkcs8",S,v,!1,["sign"])}async function e(F,K,N){let S=await X$(K,N),i=new TextEncoder().encode(F),d=a(N),$$=await crypto.subtle.sign(d,S,i);return f(new Uint8Array($$))}async function n(F,K=3,N=1000,S=30000){let v=Error("Placeholder Error");for(let i=0;i<=K;i++)try{return await F()}catch(d){if(v=d instanceof Error?d:Error(String(d)),v.message.includes("400")||v.message.includes("401")||v.message.includes("403")||v.message.includes("404"))throw v;if(i<K){let $$=Math.min(N*2**i,S),t=Math.random()*$$*0.1;await new Promise((F$)=>setTimeout(F$,$$+t))}}throw v}async function r(F){if(!E$(P))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let K=P,N=Math.floor(Date.now()/1000),S={iss:K.workloadId,sub:K.workloadId,aud:K.audience??"",exp:N+K.tokenLifetime,iat:N,jti:E(),scope:F??K.scope},v={alg:K.algorithm,typ:"JWT",kid:K.keyId},i=f(JSON.stringify(v)),d=f(JSON.stringify(S)),$$=`${i}.${d}`,t=await e($$,K.privateKey,K.algorithm);return`${$$}.${t}`}async function Q$(F){if(!E$(P))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let K=P;return n(async()=>{let N=K.idpTokenUrl,S=await r(F),v=new URLSearchParams;if(v.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),v.append("assertion",S),F)v.append("scope",F);let i=await fetch(N,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:v.toString()}),d=await i.json();if(!i.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:d});let t=d;throw Error(`Token acquisition failed: ${t.error||i.statusText} - ${t.error_description||""}`.trim())}let $$=await G(J.tokenResponse,d);if($$.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:$$.issues}),Error(`Token response validation failed: ${$$.issues.map((t)=>t.message).join("; ")}`);if(K.tokenStore){let t=new Date(Date.now()+($$.value.expires_in??300)*1000),F$={workload_id:P6(K.workloadId,F),access_token:$$.value.access_token,token_type:$$.value.token_type,scope:$$.value.scope,expires_at:t,created_at:new Date,refresh_token:$$.value.refresh_token};await K.tokenStore.set(F$)}return $$.value})}async function A(F){if(!f$(P))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let K=P;return n(async()=>{let N=K.idpTokenUrl,S=new URLSearchParams;if(S.append("grant_type","client_credentials"),S.append("client_id",K.clientId),S.append("client_secret",K.clientSecret),F)S.append("scope",F);let v=await fetch(N,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:S.toString()}),i=await v.json();if(!v.ok){Z.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:i});let $$=i;throw Error(`Token acquisition failed: ${$$.error||v.statusText} - ${$$.error_description||""}`.trim())}let d=await G(J.tokenResponse,i);if(d.issues)throw Z.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:d.issues}),Error(`Token response validation failed: ${d.issues.map(($$)=>$$.message).join("; ")}`);if(K.tokenStore){let $$=new Date(Date.now()+(d.value.expires_in??300)*1000),t={workload_id:P6(K.clientId,F),access_token:d.value.access_token,token_type:d.value.token_type,scope:d.value.scope,expires_at:$$,created_at:new Date,refresh_token:d.value.refresh_token};await K.tokenStore.set(t)}return d.value})}let W=new Map;function L(F,K){let N=W.get(F);if(N)return N;let S=(async()=>{return(E$(P)?await Q$(K??""):await A(K??"")).access_token})();return W.set(F,S),S.catch(()=>{return}).finally(()=>{if(W.get(F)===S)W.delete(F)}),S}async function k(F){if(!E$(P)&&!f$(P)){let v=P;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!v.clientId}, hasClientSecret=${!!v.clientSecret}, hasWorkloadId=${!!v.workloadId}, hasPrivateKey=${!!v.privateKey}, hasJwksUri=${!!v.jwksUri}`)}let K=P;F=F??K.scope;let N=E$(P)?P.workloadId:P.clientId,S=P6(N,F);if(K.tokenStore){let v=await K.tokenStore.get(S);if(v){let i=Date.now(),d=v.expires_at.getTime(),$$=K.refreshThreshold*1000;if(i+$$<d)return v.access_token;if(K.autoRefresh)try{return await L(S,F)}catch(t){if(i<d)return Z.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},t),v.access_token;throw t}}}return L(S,F)}async function w(F){if(!E$(P)&&!f$(P))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let K=P;return F=F??K.scope,E$(K)?await Q$(F):await A(F)}async function b(F){if(!E$(P)&&!f$(P))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let K=P;try{if(!P.revocationEndpoint)return;let N=new URLSearchParams;if(N.append("token",F),N.append("token_type_hint","access_token"),E$(P)){let v=P;N.append("client_id",v.workloadId)}else if(f$(P)){let v=P;N.append("client_id",v.clientId),N.append("client_secret",v.clientSecret)}let S=await fetch(P.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:N.toString()});if(!S.ok)Z.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:S.status,statusText:S.statusText});else Z.info("Token revoked successfully",{"ion.module":"workload"});if(P.tokenStore){let v;if(E$(P))v=P.workloadId;else if(f$(P))v=P.clientId;else return;await P.tokenStore.delete(v)}}catch(N){Z.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},N)}}async function u(F,K){let N=F??P?.jwksUri;if(!N)throw Error("No JWKS URI configured in Workload Config");return await R3(N,Z,K)}async function c(F,K){let N=K??P?.jwksUri;if(!N)throw Error("No JWKS URI configured in Workload Config");let S=E$(P)?P.algorithm:"RS256";return E3(N,F,`wl:${S}`,(v)=>{let i=v.alg||S,d=a(i);return crypto.subtle.importKey("jwk",v,d,!1,["verify"])},Z)}function o(F){let K=F.split(".");if(K.length!==3)throw Error("Invalid JWT");return JSON.parse(g(K[1]))}async function Y$(F,K){try{let N=F.split(".");if(N.length!==3)throw Error("Invalid JWT");let S=JSON.parse(g(N[0])),v=JSON.parse(g(N[1])),i=await c(S.kid,K),d=N[2],t=new TextEncoder().encode(`${N[0]}.${N[1]}`),F$=Uint8Array.from(g(d),(C0)=>C0.charCodeAt(0)),_$=a(S.alg);if(!await crypto.subtle.verify(_$,i,F$,t))throw Error("Invalid JWT signature");let m$=await G(J.jwtAssertionClaims,v);if(m$.issues)throw Z.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:m$.issues}),Error(`JWT claims validation failed: ${m$.issues.map((C0)=>C0.message).join("; ")}`);return m$.value}catch(N){throw Z.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},N),N}}async function G$(F){if(!E$(P)&&!f$(P)&&!N6(P))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(H.length>0){let S=o(F),v=typeof S.iss==="string"?S.iss:void 0,i=N8(H,v);if(!i)return{valid:!1,error:"Untrusted token issuer"};let d=await Y$(F,i.jwksUri),$$=Math.floor(Date.now()/1000);if(d.exp&&d.exp<$$)return{valid:!1,error:"Token expired"};let t=q6(i.audience);if(t.length>0&&!P4(d.aud,t,d.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:d,expiresAt:d.exp?new Date(d.exp*1000):void 0}}let K=await Y$(F),N=Math.floor(Date.now()/1000);if(K.exp&&K.exp<N)return{valid:!1,error:"Token expired"};if(E$(P)){if(P.audience&&!P4(K.aud,[P.audience],K.azp))return{valid:!1,error:"Invalid audience"}}else if(f$(P)){if(P.issuer&&q0(K.iss)!==q0(P.issuer))return{valid:!1,error:"Invalid issuer"};if(P.audience&&!P4(K.aud,[P.audience],K.azp))return{valid:!1,error:"Invalid audience"}}else{let S=P;if(S.issuer&&q0(K.iss)!==q0(S.issuer))return{valid:!1,error:"Invalid issuer"};if(S.audience&&!P4(K.aud,[S.audience],K.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:K,expiresAt:K.exp?new Date(K.exp*1000):void 0}}catch(K){return{valid:!1,error:K instanceof Error?K.message:String(K)}}}function s(F,K){let N=F[K];return typeof N==="string"&&N.trim()?N.trim():void 0}function z$(F){if(!F)return;return F.startsWith("service-account-")?F.slice(16):F}function H$(F){return s(F,"client_id")??s(F,"clientId")??s(F,"azp")??s(F,"appid")??z$(s(F,"preferred_username"))}let K$=new WeakMap;function j(F){let K=K$.get(F);if(K)return K;let N=h(F);return K$.set(F,N),N}async function h(F){let K=F.headers.get("Authorization");if(!K?.startsWith("Bearer "))return;let N=K.substring(7),S=await G$(N);if(!S.valid||!S.claims)return;let v=H.length>0?N8(H,S.claims.iss):void 0,i=S.claims.ecid,d={workloadId:S.claims.sub,clientId:H$(S.claims),scope:S.claims.scope,scopesAsEntitlements:v?.scopesAsEntitlements,...i!==void 0&&i!==null?{ecid:W8(i)}:{},claims:S.claims},$$=P?.workloadIdentityStore;if($$){let t=d.clientId??d.workloadId??d.claims.sub,F$=t?await $$.get(t):void 0;if(F$){if(F$.active===!1)return;if(F$.scopes?.length){let _$=new Set([...(d.scope??"").split(/\s+/).filter(Boolean),...F$.scopes]);d.scope=Array.from(_$).join(" ")}if(!d.ecid&&F$.ecid)d.ecid=W8(F$.ecid)}}return d}async function R(F){if(!P)throw Error("ionite Workload Manager not initialized");let K=new URL(F.url).pathname,N=(i)=>{if(!i)return;try{return new URL(i).pathname}catch{return i.startsWith("/")?i:`/${i}`}};if(N(P.validateUrl)===K&&F.method==="POST"){let i=F.headers.get("Authorization");if(!i?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let d=i.substring(7),$$=await G$(d);if(!$$.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:$$.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(N(P.jwksUrl)===K&&F.method==="GET"){let i=await u();return new Response(JSON.stringify(i),{headers:[["Content-Type","application/json"]]})}return D$()}return{...P,...T0("workload",()=>!0),getToken:k,refreshToken:w,generateJWTAssertion:r,revokeToken:b,validateToken:G$,getWorkloadIdentity:j,parseJWT:Y$,handler:R}}function I6($){return $=$??"Workload authentication unavailable",new Response(JSON.stringify({error:$}),{status:503,statusText:$,headers:{"Content-Type":"application/json"}})}var q4="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",S3="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function C3($,Z){S$(Z,q4);let Q=Z.workload;if(!Q)return;return Q.getWorkloadIdentity($)}async function k3($,Z,Q){S$(Z,q4);let X=Z.workload;if(!X)throw I6();let Y=X;if(typeof Y.getServerToken!=="function"||typeof Y.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return Y.getToken($,Q)}async function x6($,Z){S$(Z,S3);let Q="validateToken"in Z&&typeof Z.validateToken==="function"?Z:Z.workload;if(!Q)return{valid:!1,error:"Workload authentication unavailable"};let X=$.headers.get("Authorization");if(!X?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let Y=X.substring(7);return Q.validateToken(Y)}async function b3($,Z){S$(Z,q4);let Q=Z.workload;if(!Q)throw I6();return Q.revokeToken($)}async function v3($,Z){S$(Z,q4);let Q=Z.workload;if(!Q)throw I6();return Q.handler($)}function T8($){try{return I4(new URL($,"http://dummy").pathname)}catch{let Z=$.startsWith("/")?$:`/${$}`;return I4(Z)}}function m3($,Z){let Q=new URL($.url);return new URL(`/${encodeURIComponent(Z)}/`,Q.origin).toString()}function g3($,Z){let Q=T8(Z),X=I4($);if(X===Q)return null;if(!X.startsWith(`${Q}/`))return null;let Y=X.slice(Q.length+1);if(!Y||Y.includes("/"))return null;return decodeURIComponent(Y)}function T4($){return $==="pending"||$==="processing"||$==="completed"||$==="failed"||$==="action_required"}function p3($){if(!T4($.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if($.status==="completed"){if(!$.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:$.tenantUrl,status:"completed"},status:201}}if($.status==="pending"||$.status==="processing")return{body:{tenantUrl:$.tenantUrl,status:$.status},status:202};if($.status==="action_required"){if(!$.actionUrl||!$.requestToken||!$.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:$.actionUrl,requestToken:$.requestToken,expiresAt:$.expiresAt},status:200}}return{body:{tenantUrl:$.tenantUrl,status:"failed",error:$.error??"Tenant provisioning failed"},status:409}}function d3($,Z){let Q=Z.validators.tenant.createTenantRequest,X=Z.validators.tenant.updateTenantRequest;function Y(B,H){let D=(V)=>new URL(V,H).toString();return{readyzUrl:D(B.readyzUrl),capabilitiezUrl:D(B.capabilitiezUrl),sso:{loginUrl:D(B.sso.loginUrl),userUrl:D(B.sso.userUrl),logoutUrl:D(B.sso.logoutUrl),logoutBackChannelUrl:D(B.sso.logoutBackChannelUrl),refreshUrl:D(B.sso.refreshUrl),callbackUrl:D(B.sso.callbackUrl)},workload:{validateUrl:D(B.workload.validateUrl),jwksUrl:D(B.workload.jwksUrl)},iam:{basePath:D(B.iam.basePath),usersUrl:D(B.iam.usersUrl),groupsUrl:D(B.iam.groupsUrl)},ciam:{magicLinkUrl:D(B.ciam.magicLinkUrl),magicLinkLoginUrl:D(B.ciam.magicLinkLoginUrl),customerUrl:D(B.ciam.customerUrl),customerLoginUrl:D(B.ciam.customerLoginUrl),customerCallbackUrl:D(B.ciam.customerCallbackUrl),customerProvidersUrl:D(B.ciam.customerProvidersUrl),logoutUrl:D(B.ciam.logoutUrl)}}}function J(B,H){let D=Z.tenantIonBasePath?.(B);if(!D)return;let V=new URL(H.url).origin,x=Y(g$(D),V);return{callbackUrl:x.sso.callbackUrl,ionUrls:x}}async function G(B){let H=await x6(B,Z.workloadAuth??$);if(!H.valid)return Response.json({error:H.error??"Unauthorized"},{status:401});return B0(B,$,h3["tenant.manage"])}async function z(B){let D=new URL(B.url).pathname,V=g3(D,Z.basePath),x=T8(Z.basePath),T=I4(D)===x;if(!T&&!V)return D$();if(!["GET","PUT","POST","DELETE"].includes(B.method))return A0(["GET","PUT","POST","DELETE"]);if(B.method==="GET"&&T&&V==null)return D$();let P=await G(B);if(P)return P;if(B.method==="GET"){if(V==null)return D$();let n=await Z.store.get(V);if(!n)return D$();let r=J(n,B);return Response.json(r?{...n,...r}:n,{status:200})}if(B.method==="DELETE"){if(!V)return D$();let n=await Z.store.get(V);if(n)await Z.mirror?.purge(n.id);return await Z.store.delete(V),new Response(null,{status:204})}if(!V&&B.method!=="POST")return D$();let I;try{I=await B.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let O=B.method==="POST",q=O?await Q.validate(I):await X.validate(I);if(q.issues)return f3(q.issues,O?"Tenant create validation failed":"Tenant update validation failed");let M=O?q.value.id:V;if(!M)return D$();if(V!=null&&q.value.id!=null&&q.value.id!==V)return Response.json({error:"Path id must match body id"},{status:400});let E=await Z.store.get(M);if(E&&!T4(E.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let f=new Date,g=E??{},a;if(O){let n=q.value,r=n,Q$=r.status,A=T4(Q$)?Q$:E?.status??"completed";a={...g,...n,id:M,companyId:n.companyId,companyName:n.companyName,environmentType:n.environmentType,configLocator:n.configLocator,email:n.email??E?.email,webhookUrl:n.webhookUrl??E?.webhookUrl,callbackUrl:n.callbackUrl??E?.callbackUrl,tenantUrl:r.tenantUrl??E?.tenantUrl,status:A,error:r.error??E?.error,actionUrl:r.actionUrl??E?.actionUrl,requestToken:r.requestToken??E?.requestToken,expiresAt:r.expiresAt??E?.expiresAt,createdAt:E?.createdAt??f,updatedAt:f}}else{let n=q.value,r=n,Q$=r.status,A=T4(Q$)?Q$:E?.status??"completed",{configLocator:W,...L}=n;a={...g,...L,id:M,companyId:n.companyId??E?.companyId??"",companyName:n.companyName??E?.companyName??"",environmentType:n.environmentType??E?.environmentType??"DEV",email:n.email??E?.email,webhookUrl:n.webhookUrl??E?.webhookUrl,callbackUrl:n.callbackUrl??E?.callbackUrl,tenantUrl:r.tenantUrl??E?.tenantUrl,status:A,error:r.error??E?.error,actionUrl:r.actionUrl??E?.actionUrl,requestToken:r.requestToken??E?.requestToken,expiresAt:r.expiresAt??E?.expiresAt,configLocator:W??E?.configLocator,createdAt:E?.createdAt??f,updatedAt:f}}if(!a.tenantUrl)a.tenantUrl=m3(B,M);if(!a.callbackUrl){let n=J(a,B);if(n)a.callbackUrl=n.callbackUrl}if(E?.configLocator&&!y3(E.configLocator,a.configLocator))await Z.mirror?.purge(E.id);let X$=await Z.store.upsert(a),e=p3(X$);if(e instanceof Response)return e;return Response.json(e.body,{status:e.status})}async function _(B){try{if(!$.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await z(B)}catch(H){return N0(H)}}return{handler:_,getTenant:async(B)=>{return Z.store.get(B)}}}var w6="0.0.24-beta.20260905.1";export*from"@ionite/core";import{generateULID as _J,IoniteError as BJ,listGenerator as HJ}from"@ionite/core";import{allowHosts as DJ,allowOrigins as VJ,allowRelativePaths as UJ,allowSameOrigin as FJ,blockDangerousUrls as MJ,CatalogAdjacencyCache as WJ,callback as OJ,captureRedirect as LJ,ciam as NJ,collectReferencedDefinitions as AJ,defaultRedirectPolicies as jJ,discoverSessionRecords as EJ,discoverSessions as RJ,expandRoot as PJ,getCustomer as qJ,getUser as TJ,has as IJ,hasAll as xJ,hasAllScope as wJ,hasAny as SJ,hasAnyScope as CJ,hasGroup as kJ,hasPermission as bJ,hasRole as vJ,hasScope as yJ,InMemoryTenantStore as hJ,iam as fJ,initiateLogin as mJ,isRedirectAllowed as gJ,listSsoClientIdsFromCookies as pJ,reconcileSubjectAccess as dJ,resolveAfterRedirect as uJ,resolveCapturedRedirect as lJ,resolveRedirect as cJ,sameOriginRedirectRules as iJ,sendTenantWebhook as nJ,sso as sJ,verifyUser as aJ,withSetCookies as tJ}from"@ionite/core/server";import{accessRefId as $0,accessRootId as I8,assertRequiredSubjectType as x8,list as u3}from"@ionite/core";function C6($){let{createdAt:Z,updatedAt:Q,...X}=$;return X}class n${roots=new Map;byTarget=new Map;bySubject=new Map;static targetKey($,Z){return`${$}:${Z}`}static subjectKey($,Z){return`${$}:${Z}`}indexAdd($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}indexRemove($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}deindex($){this.indexRemove(this.byTarget,n$.targetKey($.targetType,$0($.target)),$.id),this.indexRemove(this.bySubject,n$.subjectKey($.subjectType,$0($.subject)),$.id)}index($){this.indexAdd(this.byTarget,n$.targetKey($.targetType,$0($.target)),$.id),this.indexAdd(this.bySubject,n$.subjectKey($.subjectType,$0($.subject)),$.id)}resolve($,Z){if(!$)return[];let Q=[];for(let X of $){let Y=this.roots.get(X);if(Y&&(Y.status??"active")==="active"&&Z(Y))Q.push(Y)}return Q}async grant($){x8($.subjectType,"Access change subjectType");let Z=$.id??I8($),Q=new Date,X=this.roots.get(Z);if(X)this.deindex(X);let Y={...$,id:Z,status:$.status??"active",createdAt:X?.createdAt??Q,updatedAt:Q};this.roots.set(Z,Y),this.index(Y)}async revoke($){let Z=$.id??I8($),Q=this.roots.get(Z);if(Q)this.deindex(Q);this.roots.delete(Z)}async get($){let Z=this.roots.get($);return Z?C6(Z):void 0}async list($){let Z=Array.from(this.roots.values()).filter((Q)=>(Q.status??"active")==="active");return S6(Z,$)}async listByTarget($,Z,Q){let X=Z.trim(),Y=this.byTarget.get(n$.targetKey($,X)),J=this.resolve(Y,(G)=>G.targetType===$&&$0(G.target)===X);return S6(J,Q)}async listByTargets($){let Z=new Map;for(let{targetType:Q,target:X}of $){let Y=`${Q}:${X}`;if(Z.has(Y))continue;let J=X.trim(),G=this.byTarget.get(n$.targetKey(Q,J)),z=this.resolve(G,(_)=>_.targetType===Q&&$0(_.target)===J);Z.set(Y,z.map((_)=>C6(_)))}return Z}async listBySubject($,Z,Q){x8(Z);let X=$0($),Y=this.bySubject.get(n$.subjectKey(Z,X)),J=this.resolve(Y,(G)=>G.subjectType===Z&&$0(G.subject)===X);return S6(J,Q)}}function S6($,Z){let Q=Math.max(0,Z?.start??0),X=Z?.limit,Y=X!=null?Q+X:void 0;return u3($.length,$.slice(Q,Y).map(C6),Q,X)}import{assertValidSubjectTypeScoping as w8,deepEqualPlain as l3,list as S8,readyCatalogEntry as k6}from"@ionite/core";class C8{listeners=new Set;emit=($)=>{for(let Z of this.listeners)Z($)};groups=new x4("group",this.emit);roles=new x4("role",this.emit);permissions=new x4("permission",this.emit);afterChange($){return this.listeners.add($),()=>{this.listeners.delete($)}}}class k8{items=new Map;listeners=new Set;async get($){return this.items.get($)}async list($){let Z=Array.from(this.items.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=X!=null?Q+X:void 0;return S8(Z.length,Z.slice(Q,Y),Q,X)}async children($){return Array.from(this.items.values()).filter((Z)=>{return(typeof Z.parent==="string"?Z.parent:Z.parent?.id)===$})}changed($){return this.listeners.add($),()=>{this.listeners.delete($)}}set($){this.items.set($.id,$),this.emitChange({id:$.id})}delete($){if(!this.items.delete($))return;this.emitChange({id:$,deleted:!0})}emitChange($){for(let Z of this.listeners)Z($)}}class x4{kind;emit;items=new Map;constructor($,Z){this.kind=$;this.emit=Z}async get($){return this.items.get($)}set($){w8($);let Z=this.items.get($.id),Q=!Z||!l3(Z,$);if(this.items.set($.id,$),Q)this.emit({op:"set",kind:this.kind,entity:$,previous:Z});return k6($,Promise.resolve())}insertIfAbsent($){w8($);let Z=this.items.get($.id);if(Z)return k6(Z,Promise.resolve());return this.items.set($.id,$),this.emit({op:"set",kind:this.kind,entity:$,previous:void 0}),k6($,Promise.resolve())}async delete($){let Z=this.items.get($);if(!Z)return;this.items.delete($),this.emit({op:"delete",kind:this.kind,entity:Z})}async list($){let Z=Array.from(this.items.values()),Q=$?.filter?.requestable;if(Q!==void 0)Z=Z.filter((G)=>Boolean(G.requestable)===Q);let X=Math.max(0,$?.start??0),Y=$?.limit,J=Y!=null?X+Y:void 0;return S8(Z.length,Z.slice(X,J),X,Y)}}import{accessRefId as s$,assertRequiredSubjectType as I0}from"@ionite/core";function a$($,Z){return`${Z}:${$}`}function b6($,Z,Q){return`${$}:${Z}:${Q}`}function c3($,Z,Q,X){return`${b6($,Z,Q)}:${X??""}`}class b8{rows=new Map;byTriple=new Map;byRoot=new Map;bySubject=new Map;edgeMeta=new Map;disabledSubjects=new Set;async has($,Z,Q,X,Y){I0(Y);let J=s$($),G=s$(Q);if(!J||!G)return{allow:!1};if(this.disabledSubjects.has(a$(J,Y)))return{allow:!1,metadata:{reason:"subject_disabled"}};let z=b6(a$(J,Y),Z,G),_=X?s$(X):void 0;if(_===void 0){let D=this.byTriple.get(z);if(D&&D.size>0)return this.allow(J,Y,Z,G,void 0);return{allow:!1}}let B=`${z}:${_}`,H=`${z}:`;if(this.rows.has(B))return this.allow(J,Y,Z,G,_);if(this.rows.has(H))return this.allow(J,Y,Z,G,void 0);return{allow:!1}}async hasGroup($,Z,Q,X){return this.has($,"group",Z,Q,X)}async hasRole($,Z,Q,X){return this.has($,"role",Z,Q,X)}async hasPermission($,Z,Q,X){return this.has($,"permission",Z,Q,X)}async hasAny($,Z,Q){for(let X of Z){let Y=await this.has($,X.targetType,X.target,X.resource,Q);if(Y.allow)return Y}return{allow:!1}}async hasAll($,Z,Q){if(this.disabledSubjects.has(a$(s$($),Q)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(Z.length===0)return{allow:!0};let X=[];for(let Y of Z){let J=await this.has($,Y.targetType,Y.target,Y.resource,Q);if(!J.allow)return{allow:!1,matched:X};if(J.matched)X.push(...J.matched)}return{allow:!0,matched:X}}async materialize($,Z){this.removeRoot($),this.addRootEdges($,Z)}async replaceSubject($,Z,Q){let X=a$(s$($),Z),Y=new Map;for(let J of Q){I0(J.subjectType,"Effective edge subjectType");let G=a$(s$(J.subject),J.subjectType);if(G!==X)throw Error(`AccessIndex.replaceSubject received an edge for ${G}; expected ${X}.`);let z=Y.get(J.rootId);if(z)z.push(J);else Y.set(J.rootId,[J])}this.clearSubjectEdges(X);for(let[J,G]of Y)this.addRootEdges(J,G)}addRootEdges($,Z){let Q=new Set;for(let X of Z){I0(X.subjectType,"Effective edge subjectType");let Y=a$(X.subject,X.subjectType),J=b6(Y,X.targetType,X.target),G=c3(Y,X.targetType,X.target,X.resource);this.addToSet(this.rows,G,$),this.addToSet(this.byTriple,J,G),this.addToSet(this.bySubject,Y,G),this.edgeMeta.set(G,{triple:J,subjectId:Y}),Q.add(G)}if(Q.size>0)this.byRoot.set($,Q)}async removeByRoot($){this.removeRoot($)}removeRoot($){let Z=this.byRoot.get($);if(!Z)return;for(let Q of Z){let X=this.rows.get(Q);if(!X)continue;if(X.delete($),X.size===0)this.dropEdge(Q)}this.byRoot.delete($)}async listSubjects(){let $=[];for(let[Z,Q]of this.bySubject){if(Q.size===0)continue;let X=Z.indexOf(":");if(X<=0)throw Error(`AccessIndex subject key "${Z}" is missing a subjectType prefix.`);let Y=Z.slice(0,X);I0(Y,"AccessIndex subject key subjectType"),$.push({subjectType:Y,subject:Z.slice(X+1)})}return $}async setSubjectDisabled($,Z,Q){let X=a$(s$($),Z);if(Q)this.disabledSubjects.add(X);else this.disabledSubjects.delete(X)}async isSubjectDisabled($,Z){return I0(Z),this.disabledSubjects.has(a$(s$($),Z))}async clear($,Z){if($===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}I0(Z);let Q=s$($);this.clearSubjectEdges(a$(Q,Z))}clearSubjectEdges($){let Z=this.bySubject.get($);if(!Z)return;for(let Q of[...Z]){let X=this.rows.get(Q);if(X)for(let Y of X){let J=this.byRoot.get(Y);if(J?.delete(Q)&&J.size===0)this.byRoot.delete(Y)}this.dropEdge(Q)}}allow($,Z,Q,X,Y){return{allow:!0,matched:[{subject:$,subjectType:Z,targetType:Q,target:X,resources:Y?[Y]:void 0}]}}addToSet($,Z,Q){let X=$.get(Z);if(!X)X=new Set,$.set(Z,X);X.add(Q)}dropEdge($){this.rows.delete($);let Z=this.edgeMeta.get($);if(Z)this.removeFromSet(this.byTriple,Z.triple,$),this.removeFromSet(this.bySubject,Z.subjectId,$);this.edgeMeta.delete($)}removeFromSet($,Z,Q){let X=$.get(Z);if(!X)return;if(X.delete(Q),X.size===0)$.delete(Z)}}function v6($){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function i3($,Z){return{...$,subscribe:async(Q,X,Y)=>{try{return await $.subscribe(Q,X,Y)}catch(J){if(!(J instanceof w$))throw J;return await c$($,Q,X,Z,void 0,Y)}}}}function w4($){let Z=_0($.path,"path","azureConfig");K0($.ttl);let Q=$.vault??E4({type:"azure",authMethod:$.authMethod,entraTenantId:$.entraTenantId,clientId:$.clientId,clientSecret:$.clientSecret,federatedTokenFile:$.federatedTokenFile,managedIdentityClientId:$.managedIdentityClientId,imdsApiVersion:$.imdsApiVersion,vaultUrl:$.vaultUrl,vaultName:$.vaultName,apiVersion:$.apiVersion,secretNameTransform:$.secretNameTransform,secretNamePrefix:$.secretNamePrefix,scope:$.scope,ttl:$.ttl}),X=$.ttl?i3(Q,$.ttl):Q;return{load:async()=>{try{return(await X.getFullSecret(Z)).data}catch(Y){let J=Y instanceof Error?Y.message:String(Y);throw Error(`Error retrieving remote config from Azure Key Vault: ${J}`,{cause:Y})}},subscribe:(Y,J)=>{return X.subscribe(Z,(G)=>{Y(G.data)},J)},secret:X}}import{IoniteError as BQ}from"@ionite/core";function y6($){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as r3,remoteConfigSecretType as o3}from"@ionite/core";import{defaultLogger as n3,defaultSecretContentType as s3,stableConfigHash as v8}from"@ionite/core";var a3=1e4;function t3($){return typeof $==="object"&&$!==null&&!Array.isArray($)}function h6($){if($.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let Z=Array.from(new Set($.paths.map((I)=>I.trim()).filter(Boolean)));if(Z.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let Q=$.logger??n3,X=[],Y=Promise.resolve(),J=!1,G=!1,z=!1,_=U$("Secrets mirror",()=>J&&!z),B=(I)=>{let O=$.mapPath(I).trim();if(!O)throw Error(`mirrorSecrets mapPath returned an empty target for "${I}"`);return O},H=(I)=>{let O=Y.then(I);return Y=O.catch((q)=>{G=!0,Q.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:q instanceof Error?q.message:String(q)})}),O},D=async(I)=>{if(await $.to.exists(I))await $.to.deleteSecret(I)},V=async(I,O)=>{if(z)return;if(!t3(O.data))throw Error(`mirrorSecrets can only re-store object values (source path "${I}")`);if($.accept&&!$.accept(O,I))return;let q=B(I);if(await $.to.exists(q)){let M=await $.to.getSecret(q);if(v8(M)===v8(O.data)){G=!1;return}}await $.to.putSecret(q,O.data,{contentType:O.metadata.contentType??s3()}),G=!1},x=async(I)=>{await D(B(I)),G=!1},T=(I)=>{if(I.event!=="path_removed")return Z.includes(I.path)?[I.path]:[];let O=`${I.path.replace(/\/+$/g,"")}/`;return Z.filter((q)=>q===I.path||q.startsWith(O))},P=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if($.from.subscribeEvents)X.push($.from.subscribeEvents((I)=>{if(P.has(I.event)){let O=T(I);if(O.length>0)H(async()=>{for(let q of O)await x(q)})}try{$.onEvent?.(I)}catch(O){Q.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:I.path,event:I.event,error:O instanceof Error?O.message:String(O)})}}));return(async()=>{let I=new Set(Z);for(;;){try{for(let O of[...I]){let q=await $.from.subscribe(O,(M)=>{H(()=>V(O,M))},$.subscription);if(z){q();return}X.push(q),I.delete(O)}if(await Y,z)return;J=!0,_.refresh();return}catch(O){if(z)return;G=!0,Q.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:O instanceof Error?O.message:String(O)})}if(await new Promise((O)=>{setTimeout(O,a3).unref?.()}),z)return}})(),{isReady:_.isReady,ready:_.ready,isAvailable:()=>J&&!z&&!G&&($.from.isAvailable?.()??!0)&&($.to.isAvailable?.()??!0),async purge(){if(z)throw Error("Secrets mirror is closed");await H(async()=>{for(let I of Z)await x(I)})},async close(){if(z)return;z=!0;for(let I of X.splice(0))I();_.refresh(),_.settle(),await Y}}}function x0($){return typeof $.getFullSecret==="function"}function f6($){let Z=$;return typeof Z.handleDelivery==="function"&&typeof Z.handleEvents==="function"&&typeof Z.isDeliveryRequest==="function"&&typeof Z.isEventsRequest==="function"}function y8($){return $.type==="vault"&&[$.vaultLfvServerUrl,$.vaultLfvClientId,$.vaultLfvDeliveryEndpoint,$.vaultLfvVerifyJwks,$.vaultLfvEventsEndpoint].some((Z)=>Z!==void 0)}function R$($,Z){if(!$?.trim())throw Error(`Mirrored LFV config requires ${Z}`);return $}function e3($,Z){if(Z?.trim())return Z;if(x0($))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if($.type==="vault")return R$($.vaultLfvPath??$.vaultPath,"an upstream vault path");if($.type==="azure")return R$($.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${$.type}" requires an explicit fromPath`)}function $Q($,Z){let Q=R$($.vaultLfvPath??$.vaultPath,"vaultLfvPath or vaultPath");return z0({lfvServerUrl:R$($.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:R$($.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:R$($.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:R$($.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:R$($.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:Q,deliveryTimeout:$.vaultLfvDeliveryTimeout,retryInterval:$.vaultLfvRetryInterval,warnInterval:$.vaultLfvWarnInterval,log:Z},void 0,{selfRedeemReads:!0})}function ZQ($){return $.metadata.contentType?.typeId===o3.id&&typeof $.data.id==="string"&&$.data.id.trim().length>0}function QQ($,Z,Q,X){return{...$,close:Q,subscribePassive:(Y,J)=>Z.subscribePassive(Y,J),isDeliveryRequest:(Y)=>Z.isDeliveryRequest(Y),isEventsRequest:(Y)=>Z.isEventsRequest(Y),handleDelivery:(Y)=>{return X(),Z.handleDelivery(Y)},handleEvents:(Y)=>{return X(),Z.handleEvents(Y)},deliveryPath:Z.deliveryPath,eventsPath:Z.eventsPath,callbackKey:Z.callbackKey,trustId:Z.trustId}}function n0($){let Z=$.logger??r3,Q=e3($.from,$.fromPath),X=!x0($.from),Y=!x0($.to),J=x0($.from)?$.from:y8($.from)?$Q($.from,Z):t$($.from).secret,G=x0($.to)?$.to:t$($.to).secret,z=R$($.path,"path"),_=m6(G,z,{ttl:$.ttl}),B,H=!1,D=!1,V,x=()=>{if(V)return;V=J.getFullSecret(Q).then(()=>{return}).catch((M)=>{V=void 0,Z.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:M instanceof Error?M.message:String(M)})})},T=(M)=>{if(H)throw Error("Mirrored ConfigSource is closed");if(!B){D=M;let E=!M&&f6(J)?{...J,subscribe:(f,g)=>J.subscribePassive(f,g)}:J;B=h6({from:E,to:G,paths:[Q],mapPath:()=>z,accept:ZQ,logger:Z})}else if(M&&!D)x();return B},P={isReady:()=>B?.isReady()??!1,ready:(M)=>T(!0).ready(M),isAvailable:()=>B?.isAvailable()??!1,purge:()=>T(!1).purge(),close:async()=>{await B?.close()}},I=async()=>{if(H)return;if(H=!0,await B?.close(),X)await J.close?.();if(Y)await G.close?.()},O=f6(J)?QQ(G,J,I,()=>{T(!1)}):{...G,close:I},q={load:async()=>{try{let M=await _.load();return T(!1),M}catch(M){throw T(!0),M}},subscribe:(M,E)=>{return T(!1),_.subscribe(M,E)},secret:O,mirror:P,async handleCallback(M,E){if(!f6(J))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return T(!1),M==="delivery"?J.handleDelivery(E):J.handleEvents(E)}};if(Object.defineProperties(q,{log:{get:()=>_.log,set:(M)=>{_.log=M},enumerable:!0},validators:{get:()=>_.validators,set:(M)=>{_.validators=M},enumerable:!0}}),!x0($.from)&&y8($.from)){let M=$.from;q[L0]={path:Q,lfvServerUrl:R$(M.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:R$(M.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:R$(M.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:R$(M.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:R$(M.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:M.vaultLfvDeliveryTimeout,retryInterval:M.vaultLfvRetryInterval,warnInterval:M.vaultLfvWarnInterval}}return q}class D0 extends Error{path;constructor($,Z=`Waiting for vault config secret at ${$}`){super(Z);this.path=$;this.name="VaultConfigWaitingForSecretError"}code="not_found";sourceType="vault";status=404}function XQ($){return $ instanceof D0}class s0 extends Error{path;constructor($,Z){super(Z);this.path=$;this.name="VaultConfigInvalidPayloadError"}code="invalid_payload";sourceType="vault"}function YQ($){return $ instanceof s0}var m8=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function h8($){return m8.some((Z)=>(Z in $))}function f8($,Z){if(!$||typeof $!=="object"||Array.isArray($))throw new D0(Z,`Vault config secret at ${Z} is missing or not an object`);let Q=$;if(!h8(Q)&&Object.keys(Q).length===1&&"data"in Q){let X=Q.data;if(X&&typeof X==="object"&&!Array.isArray(X))Q=X}if(Object.keys(Q).length===0)throw new D0(Z,`Vault config secret at ${Z} is empty`);if(!h8(Q))throw new s0(Z,`Vault config secret at ${Z} is an invalid payload: not a RemoteConfig (no known keys: ${m8.join("/")})`);return Q}function JQ($,Z,Q){return{...$,subscribe:async(X,Y,J)=>{try{return await $.subscribe(X,Y,J)}catch(G){if(!(G instanceof w$))throw G;return await c$($,X,Y,Z,Q(),J)}}}}function S4($){let Z=_0($.path,"path","vaultConfig");K0($.ttl);let Q=$.vault??P0({type:"vault",url:$.url,token:$.token,workload:$.workload,lfv:$.lfv,websocket:$.websocket,ttl:$.ttl,log:$.log}),X=$.vault&&$.ttl?JQ(Q,$.ttl,()=>$.log):Q,Y={get log(){return $.log},set log(J){if($.log=J,X&&"log"in X)X.log=J},load:async()=>{try{let J=await X.getFullSecret(Z);return f8(J.data,Z)}catch(J){if(J instanceof l$)throw new D0(Z);if(J instanceof D0||J instanceof s0)throw J;throw Error("Error retrieving remote config from vault",{cause:J})}},subscribe:(J,G)=>{return X.subscribe(Z,(z)=>{let _;try{_=f8(z.data,Z)}catch(B){$.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:Z,error:B instanceof Error?B.message:String(B)});return}J(_)},G)},secret:X};if($.lfv?.lfvServerUrl&&$.lfv.clientId&&$.lfv.deliveryEndpoint&&$.lfv.eventsEndpoint)Y[L0]={path:$.lfv.path??Z,lfvServerUrl:$.lfv.lfvServerUrl,clientId:$.lfv.clientId,deliveryTimeout:$.lfv.deliveryTimeout,retryInterval:$.lfv.retryInterval,warnInterval:$.lfv.warnInterval,deliveryEndpoint:$.lfv.deliveryEndpoint,eventsEndpoint:$.lfv.eventsEndpoint,verifyJwks:$.lfv.verifyJwks};return Y}function C4($){if($==null)return;if(typeof $==="number")return Number.isFinite($)?$:void 0;let Z=$.trim();if(!Z)return;let Q=Number.parseInt(Z,10);return Number.isFinite(Q)?Q:void 0}function GQ($,Z){let Q=$.vaultLfvServerUrl??Z?.lfvServerUrl,X=$.vaultLfvClientId??Z?.clientId,Y=$.vaultLfvDeliveryEndpoint??Z?.deliveryEndpoint,J=$.vaultLfvEventsEndpoint??Z?.eventsEndpoint;if(!Q||!X||!Y||!J)return Z;return{...Z,lfvServerUrl:Q,clientId:X,deliveryEndpoint:Y,verifyJwks:$.vaultLfvVerifyJwks??Z?.verifyJwks,eventsEndpoint:J,path:$.vaultLfvPath??Z?.path,deliveryTimeout:C4($.vaultLfvDeliveryTimeout)??Z?.deliveryTimeout,retryInterval:C4($.vaultLfvRetryInterval)??Z?.retryInterval,warnInterval:C4($.vaultLfvWarnInterval)??Z?.warnInterval}}function zQ($,Z){let Q=$.vaultWebsocketUrl??Z?.url;if(!Q)return Z;return{...Z,url:Q,token:$.vaultWebsocketToken??Z?.token,clientId:$.vaultWebsocketClientId??Z?.clientId,header:$.vaultWebsocketHeader??Z?.header}}function _Q($,Z){let Q=$.vaultWorkloadTokenUrl??Z?.idpTokenUrl,X=$.vaultWorkloadClientId??Z?.clientId,Y=$.vaultWorkloadClientSecret??Z?.clientSecret;if(!Q||!X||!Y)return Z;return{...Z,idpTokenUrl:Q,clientId:X,clientSecret:Y,scope:$.vaultWorkloadScope??Z?.scope}}function g8($,Z){return{...Z,url:$.vaultUrl??Z?.url,token:$.vaultToken??Z?.token,path:$.vaultPath??Z?.path,ttl:C4($.vaultTtl)??Z?.ttl,workload:_Q($,Z?.workload),lfv:GQ($,Z?.lfv),websocket:zQ($,Z?.websocket)}}function t$($){switch($.type){case"vault":return KQ($);case"azure":return DQ($);case"aws":return VQ($);case"gcp":return UQ($);case"mirror":return HQ($);default:throw Error(`Unsupported config locator type: ${$.type}`)}}function HQ($){if($.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!$.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return n0({from:$.from,to:$.to,path:$.to.vaultPath,ttl:$.to.vaultTtl})}function KQ($){return S4(g8($))}function DQ($){return w4({authMethod:$.azureAuthMethod,entraTenantId:$.azureEntraTenantId,clientId:$.azureClientId,clientSecret:$.azureClientSecret,federatedTokenFile:$.azureFederatedTokenFile,managedIdentityClientId:$.azureManagedIdentityClientId,imdsApiVersion:$.azureImdsApiVersion,vaultUrl:$.azureVaultUrl,vaultName:$.azureVaultName,apiVersion:$.azureApiVersion,scope:$.azureScope,secretNamePrefix:$.azureSecretNamePrefix,path:$.azurePath,ttl:$.azureTtl})}function VQ($){return v6({webhookUrl:$.awsWebhookUrl,ttl:$.awsTtl})}function UQ($){return y6({ttl:$.gcpTtl})}function m6($,Z,Q={}){switch($.type){case"vault":return S4({vault:$,path:Z,ttl:Q.ttl});case"azure":return w4({vault:$,path:Z,ttl:Q.ttl});default:throw new BQ(`configFromSource is not supported for secrets source type "${$.type}" (path "${Z}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function V0($){if(!$)return;let Z=Number.parseInt($,10);return Number.isFinite(Z)?Z:void 0}function k4($,Z){let Q=Z?.type??$.ION_CONFIG_TYPE;if(!Q)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(Q==="vault")return{type:"vault",vaultUrl:$.ION_VAULT_URL,vaultToken:$.ION_VAULT_TOKEN,vaultPath:$.ION_VAULT_PATH??"",vaultTtl:V0($.ION_VAULT_TTL),vaultWorkloadTokenUrl:$.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:$.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:$.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:$.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:$.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:$.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:$.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:$.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:$.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:$.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:V0($.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:V0($.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:V0($.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:$.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:$.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:$.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:$.ION_VAULT_WEBSOCKET_HEADER};if(Q==="azure")return{type:"azure",azurePath:$.ION_AZURE_PATH,azureApiVersion:$.ION_AZURE_API_VERSION,azureScope:$.ION_AZURE_SCOPE,azureSecretNamePrefix:$.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:$.ION_AZURE_AUTH_METHOD,azureEntraTenantId:$.ION_AZURE_TENANT_ID,azureClientId:$.ION_AZURE_CLIENT_ID,azureClientSecret:$.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:$.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:$.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:$.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:$.ION_AZURE_VAULT_URL,azureVaultName:$.ION_AZURE_VAULT_NAME,azureTtl:V0($.ION_AZURE_TTL)};if(Q==="aws")return{type:"aws",awsWebhookUrl:$.ION_AWS_WEBHOOK_URL??"",awsTtl:V0($.ION_AWS_TTL)};if(Q==="gcp")return{type:"gcp",gcpTtl:V0($.ION_GCP_TTL)};if(Q==="mirror"){let X={};for(let[z,_]of Object.entries($))if(z.startsWith("ION_FROM_"))X[`ION_${z.slice(9)}`]=_;if(X.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let Y=k4(X),J=k4($,{type:"vault"});if(!J.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let G={type:"vault",vaultUrl:J.vaultUrl,vaultToken:J.vaultToken,vaultPath:J.vaultPath,vaultTtl:J.vaultTtl,vaultWorkloadTokenUrl:J.vaultWorkloadTokenUrl,vaultWorkloadClientId:J.vaultWorkloadClientId,vaultWorkloadClientSecret:J.vaultWorkloadClientSecret,vaultWorkloadScope:J.vaultWorkloadScope,vaultWebsocketUrl:J.vaultWebsocketUrl,vaultWebsocketToken:J.vaultWebsocketToken,vaultWebsocketClientId:J.vaultWebsocketClientId,vaultWebsocketHeader:J.vaultWebsocketHeader};return{type:"mirror",from:Y,to:G}}throw Error(`ION_CONFIG_TYPE="${Q}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function p8($,Z){return t$(k4($,Z))}function FQ($){return p8(process.env,$)}var MQ=1000,WQ=30000,d8=["vault","azure","aws","gcp"];function u8($,Z){if(!$||typeof $!=="object"||Array.isArray($))throw Error(`Config locator at ${Z} is an invalid payload: expected an object with a "type" field`);let Q=$.type;if(typeof Q!=="string"||!d8.includes(Q))throw Error(`Config locator at ${Z} is an invalid payload: unknown type "${String(Q)}" (expected ${d8.join("/")})`)}function l8($,Z){return $.log??=Z.log,$.validators??=Z.validators,$}function a0($){if(!$?.secret?.close)return;try{Promise.resolve($.secret.close()).catch((Z)=>{$.log?.warn?.("secretConfigSource: inner source close failed",Z)})}catch(Z){$.log?.warn?.("secretConfigSource: inner source close failed",Z)}}function OQ($,Z){let Q=_0(Z,"path","secretConfigSource"),X,Y=(G)=>{u8(G,Q);let z=JSON.stringify(G);if(X&&X.hash===z)return X.inner;let _=X?.inner,B=l8(t$(G),J);if(X={hash:z,inner:B},_&&_!==B)a0(_);return B},J={async load(){let G=await $.getSecret(Q);return Y(G).load()},async subscribe(G,z){let _,B=!1,H=!1,D,V,x=new Promise((f,g)=>{D=f,V=g}),T=M4(),P,I,O=(f)=>new Promise((g)=>{I=g,P=setTimeout(g,f)}),q=async(f,g)=>{u8(f,Q);let a=JSON.stringify(f),X$=X!==void 0&&X.hash===a;if(X$&&_)return;let e=X?.inner,n=_,r=X$&&X?X.inner:l8(t$(f),J),Q$=!X$,A=()=>{if(Q$&&r!==e)a0(r)};try{if(r.subscribe){let L=await r.subscribe(G,z)??void 0;if(B||!T.isCurrent(g)){L?.(),A();return}if(_=L,X={hash:a,inner:r},n&&n!==L)n();if(Q$&&e&&e!==r)a0(e);return}let W=await r.load();if(B||!T.isCurrent(g)){A();return}if(X={hash:a,inner:r},n)n(),_=void 0;if(Q$&&e&&e!==r)a0(e);G(W)}catch(W){throw A(),W}},M=async(f)=>{let g=T.next(),a=MQ;for(;;){if(B||!T.isCurrent(g))return;try{await q(f,g);return}catch(X$){if(B||!T.isCurrent(g))return;J.log?.warn(`secretConfigSource rebind for ${Q} failed; keeping last-known-good source and retrying in ${a}ms`,X$),await O(a),a=Math.min(WQ,a*2)}}},E=await $.subscribe(Q,(f)=>{if(B)return;if(!H){q(f.data,T.next()).then(()=>{H=!0,D()}).catch((g)=>{H=!0,V(g)});return}M(f.data)},z);return await x,()=>{if(B=!0,T.next(),P)clearTimeout(P);I?.(),_?.(),E(),a0(X?.inner),X=void 0}},secret:$};return J}function g6($){if(Array.isArray($))return $.map(g6);if($&&typeof $==="object")return Object.fromEntries(Object.entries($).filter(([,Z])=>Z!==void 0).sort(([Z],[Q])=>Z.localeCompare(Q)).map(([Z,Q])=>[Z,g6(Q)]));return $}function c8($){return JSON.stringify(g6($))}function LQ($){if($.type==="vault")return $.vaultLfvPath??$.vaultPath;if($.type==="azure"&&$.azurePath?.trim())return $.azurePath;throw Error(`Tenant config locator type "${$.type}" does not declare a mirrorable config path`)}function NQ($,Z){let Q=Z.logger??$.log,X=new Map,Y=!1,J=async(B)=>{if(B.closed)return;B.closed=!0,B.closeHooks?.(),await B.hookSetup?.catch(()=>{return}),await B.source.secret.close?.()},G=(B)=>{let H=(async()=>{let D=await Z.store.get(B);if(!D)throw Error(`Tenant "${B}" was not found`);if(!D.configLocator)throw Error(`Tenant "${B}" has no configLocator`);let V=D.configLocator,x=Z.path(D).trim();if(!x)throw Error(`Tenant mirror path is empty for "${B}"`);let T=Z.sourceFromLocator?.(V,D)??V,I={source:n0({from:T,fromPath:LQ(V),to:Z.to,path:x,logger:Q}),locatorFingerprint:c8(V),targetPath:x,closed:!1};if(Z.hooks?.onRemoteConfigChange)I.hookSetup=Z.to.subscribe(x,(O)=>{Promise.resolve(Z.hooks?.onRemoteConfigChange?.(D,O.data,O)).catch((q)=>{Q.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:B,error:q instanceof Error?q.message:String(q)})})}).then((O)=>{I.closeHooks=O}).catch((O)=>{Q.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:B,error:O instanceof Error?O.message:String(O)})});return I})();return X.set(B,H),H.catch(()=>{if(X.get(B)===H)X.delete(B)}),H},z=async(B,H,D)=>{if(X.get(B)===H)X.delete(B);await J(D)},_=async(B)=>{if(Y)throw Error("Tenant config mirror is closed");let H=X.get(B);if(!H)return G(B);let D=await H,V=await Z.store.get(B);if(!V?.configLocator)throw await z(B,H,D),Error(V?`Tenant "${B}" has no configLocator`:`Tenant "${B}" was not found`);if(c8(V.configLocator)!==D.locatorFingerprint)return await z(B,H,D),X.get(B)??G(B);return D};return{async ensure(B,H){await(await _(B)).source.mirror.ready(H)},async handleCallback(B,H,D){try{return await(await _(B)).source.handleCallback(H,D)}catch(V){let x=V instanceof Error?V.message:String(V),T=x.includes("was not found")?404:503;return Q.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:B,kind:H,error:x}),Response.json({error:T===404?"Tenant not found":"Tenant config mirror unavailable"},{status:T})}},async purge(B){let H=X.get(B),D=H?await H:void 0,V=await Z.store.get(B),x=D?.targetPath??(V?Z.path(V).trim():void 0);if(D&&H)await z(B,H,D);if(x&&await Z.to.exists(x))await Z.to.deleteSecret(x);if(V)await Z.hooks?.onRemoteConfigRevoke?.(V)},async close(){if(Y)return;Y=!0;let B=[...X.values()];X.clear(),await Promise.all(B.map(async(H)=>{try{await J(await H)}catch{}}))}}}import{buildTenantPath as AQ,DEFAULT_TENANT_API_NAMESPACE as n8,DEFAULT_TENANT_UI_NAMESPACE as s8,matchTenantPath as a8,normalizeTenantPathNamespace as i8}from"@ionite/core";function jQ(){return Response.json({error:"Tenant not found"},{status:404})}function EQ($){return Response.json({error:`Tenant runtime unavailable for ${$}`},{status:503})}function RQ($,Z){if(Z==="api")return i8($?.api??n8);return i8($?.ui??s8)}function PQ($){if($.store)return async(Z)=>$.store.getIon(Z);return async(Z)=>await $.getIon(Z)??void 0}async function t8($,Z={}){if(Z.custom){let J=await Z.custom($);if(J)return{id:J}}let Q=Z.namespace??"api",X=RQ(Z.strategy,Q),Y=a8(new URL($.url).pathname,X);if(!Y)return null;return{id:Y.id,context:{namespace:Q,restPath:Y.restPath,restSegments:Y.restSegments}}}function r8($,Z){let Q=new URL($.url);return Q.pathname=Z,new Request(Q,$)}function p6($,Z,Q,X){let Y=a8(new URL($.url).pathname,Q);if(!Y||Y.id!==Z)return $;return r8($,AQ(Z,Y.restPath,X))}function qQ($,Z,Q={beforeTenantSegments:["api"],afterTenantSegments:[]}){return p6($,Z,n8,Q)}function TQ($,Z,Q={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return p6($,Z,s8,Q)}function IQ($){return async function(Q){try{let X=$.resolveTenant?await $.resolveTenant(Q):await t8(Q),Y=typeof X==="string"?{id:X,context:void 0}:X??null;if(!Y?.id)return $.onMissingTenant?await $.onMissingTenant(Q):jQ();let J=await $.getIon(Y.id,Q)??null;if(!J)return $.onMissingIonite?await $.onMissingIonite(Q,Y.id):EQ(Y.id);let G=$.rewriteRequest?await $.rewriteRequest(Q,{id:Y.id,ion:J,context:Y.context}):Q;return J.handler(G)}catch(X){return N0(X)}}}import{list as xQ}from"@ionite/core";class o8{identities=new Map;clientIdIndex=new Map;async get($){return this.identities.get($)}async lookup($){if($.id){let Z=this.identities.get($.id);if(Z)return Z}if($.clientId){let Z=this.clientIdIndex.get($.clientId);if(Z)return this.identities.get(Z)}if($.externalId){for(let Z of this.identities.values())if(Z.externalId===$.externalId)return Z}return}async upsert($){let Z=$.id?.trim()||crypto.randomUUID(),Q=new Date,X=this.identities.get(Z),Y={...$,id:Z,createdAt:X?.createdAt??$.createdAt??Q,updatedAt:Q};if(X?.clientId&&X.clientId!==Y.clientId)this.clientIdIndex.delete(X.clientId);if(this.identities.set(Z,Y),Y.clientId)this.clientIdIndex.set(Y.clientId,Z);return Y}async delete($){let Z=this.identities.get($);if(Z?.clientId)this.clientIdIndex.delete(Z.clientId);return this.identities.delete($),Z?1:0}async list($){let Z=Array.from(this.identities.values()),Q=Math.max(0,$?.start??0),X=$?.limit,Y=Z.length,J=X!=null?Q+X:void 0,G=Z.slice(Q,J);return xQ(Y,G,Q,X)}}var fQ=30000;function mQ($){let Z=$,Q=Z.basePath??Z4(),X=Z.readyTimeoutMs??fQ,Y=$4(Z.stores),J=Z.routing,G=Z.beforeChange,z=Z.afterChange,_=Z.configRetry,B=Z.onConfigLoadError;return{frameworkConfig:{log:$.log,validators:$.validators,sso:$.sso,iam:$.iam,workload:$.workload,secrets:$.secrets,lfv:$.lfv,ciam:$.ciam,authz:$.authz,otel:$.otel},basePath:Q,readyTimeoutMs:X,stores:Y,options:{beforeChange:G,afterChange:z,routing:J,configRetry:_,onConfigLoadError:B}}}function gQ($){let Z=$,Q={trace:(X,...Y)=>Z.trace(X,...Y),debug:(X,...Y)=>Z.debug(X,...Y),info:(X,...Y)=>Z.info(X,...Y),warn:(X,...Y)=>Z.warn(X,...Y),error:(X,...Y)=>Z.error(X,...Y)};return{logger:Q,update(X){return Z=X,Q}}}function _2($,Z){let Q=$;return Q.setStores=(X)=>{Z.current=$4(X),Object.assign(Q,b0(Q,Z.current))},Q}function $2($){let Z=$?.replace(/\s+/g," ").trim();return Z?Z:void 0}function B2($){if(typeof $!=="object"||$===null)return;return $.cause}function pQ($){if(!($ instanceof Error))return typeof $==="string"?$2($):void 0;let Z=$2($.message),Q=[],X=$;if(typeof X.code==="string")Q.push(`code=${X.code}`);if(typeof X.status==="number")Q.push(`status=${X.status}`);if(typeof X.path==="string")Q.push(`path=${X.path}`);if(Q.length===0)return Z;if(!Z)return Q.join(", ");return`${Z} [${Q.join(", ")}]`}function c6($,Z=3){let Q=[],X=$,Y=0;while(X!=null&&Y<Z){let J=pQ(X);if(J&&!Q.includes(J))Q.push(J);X=B2(X),Y+=1}return Q.length>0?Q.join(" <- "):void 0}function dQ($,Z){if(typeof $!=="object"||$===null)return;return $[Z]}function C$($,Z){let Q=$,X=0;while(Q!=null&&X<3){let Y=dQ(Q,Z);if(Y!==void 0)return Y;Q=B2(Q),X+=1}return}var uQ=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function lQ($){return typeof $==="string"&&uQ.has($)}function cQ($){let Z=C$($,"kind");if(lQ(Z))return Z;let Q=C$($,"status"),X=C$($,"code"),Y=c6($)?.toLowerCase()??"";if(Q===401||Q===403||Y.includes("auth error")||Y.includes("permission denied"))return"auth";if(X==="not_found"||Y.includes("waiting for vault"))return"not_found";if(X==="ECONNREFUSED"||X==="ECONNRESET"||X==="ENOTFOUND"||X==="ETIMEDOUT"||Y.includes("connection")||Y.includes("fetch failed")||Y.includes("network"))return"connection";if(Y.includes("timed out"))return"timeout";if(Y.includes("invalid status")||typeof Q==="number"&&Q>=400)return"invalid_status";if(Y.includes("invalid payload")||Y.includes("invalid json")||Y.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function iQ($){return"validation"}var nQ=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function sQ($,Z){let Q=C$($,"recoverable");if(typeof Q==="boolean")return Q;if(Z==="not_found")return!0;if(Z==="auth"||Z==="invalid_payload")return!1;let X=C$($,"status");if(typeof X==="number"&&X>=400&&X<500)return!1;let Y=C$($,"code");if(typeof Y==="string"&&(nQ.has(Y)||Y.startsWith("UND_ERR_")))return!0;return!0}function aQ($){return{initialDelayMs:Math.max(1,$?.initialDelayMs??2000),maxDelayMs:Math.max(1,$?.maxDelayMs??600000),multiplier:Math.max(1,$?.multiplier??2),jitterRatio:Math.max(0,$?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,$?.loadTimeoutMs??30000)}}function tQ($,Z){let Q=Math.max(0,$-1),X=Math.min(Z.maxDelayMs,Z.initialDelayMs*Z.multiplier**Q);if(Z.jitterRatio===0)return Math.round(X);let Y=X*Z.jitterRatio,J=(Math.random()*2-1)*Y;return Math.max(1,Math.round(Math.min(Z.maxDelayMs,X+J)))}function rQ($){return(Z)=>{let Q=Z.path?` at ${Z.path}`:"",X=Z.sourceType?` (${Z.sourceType})`:"";$.warn(`Config source${X} unavailable${Q}; ionite will retry automatically in ${Z.nextDelayMs}ms (attempt ${Z.attempt}, ${Z.errorKind}: ${Z.message}).`)}}async function oQ($,Z){for(let Q of Z)await Q($)}function k$($){if(!$)return;try{return new URL($,"http://dummy").pathname}catch{return $.startsWith("/")?$:`/${$}`}}function eQ($,Z){let Q=Z.id;if(typeof Q!=="string"||Q.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if($!==void 0&&$!==Q)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${$}", received "${Q}").`)}function $X($){let Z=$.kms;if(Z)for(let[X,Y]of Object.entries(Z)){if(X.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!Y||typeof Y!=="object"||Array.isArray(Y))throw Error(`RemoteConfig.kms.${X} must be an object.`);if(Y.source!==void 0&&(typeof Y.source!=="string"||Y.source.length===0))throw Error(`RemoteConfig.kms.${X}.source must be a non-empty string when present.`);if(Y.path!==void 0&&(typeof Y.path!=="string"||Y.path.length===0))throw Error(`RemoteConfig.kms.${X}.path must be a non-empty string when present.`)}let Q=$.otel;if(!Q)return;if(Q.apiKey!==void 0&&Q.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(Q.apiKeyPool!==void 0){if(typeof Q.apiKeyPool!=="string"||Q.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!Z?.[Q.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${Q.apiKeyPool}".`)}}function ZX($){let Z=$.authz?.trustedProvisioningClients;if(!Z)return;Z.forEach((Q,X)=>{let Y=`authz.trustedProvisioningClients[${X}]`;if(typeof Q.issuer!=="string"||Q.issuer.length===0)throw Error(`${Y}: "issuer" is required and must be a non-empty string.`);if(typeof Q.clientId!=="string"||Q.clientId.length===0)throw Error(`${Y}: "clientId" is required and must be a non-empty string.`);let J=Array.isArray(Q.audience)?Q.audience:[Q.audience];if(J.length===0||J.some((G)=>typeof G!=="string"||G.length===0))throw Error(`${Y}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(Q.permissions)||Q.permissions.some((G)=>typeof G!=="string"||G.length===0))throw Error(`${Y}: "permissions" must be an array of non-empty permission ids.`)})}function QX($){let Z=Array.isArray($)?$:[$];return Z.length>0&&Z.every((Q)=>typeof Q==="string"&&Q.length>0)}function XX($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return;let Q=Z,X=(Y,J)=>{if(!QX(Y.audience))throw Error(`${J}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in Q||"outgoing"in Q){let Y=Q.incoming;if(Array.isArray(Y))Y.forEach((J,G)=>{if(J&&typeof J==="object")X(J,`workload.incoming[${G}]`)});else if(Y&&typeof Y==="object"&&"jwksUri"in Y)X(Y,"workload.incoming");return}if(D2(Q)){if("jwksUri"in Q&&!("clientId"in Q)&&!("workloadId"in Q))X(Q,"workload (server-only)");return}}function YX($,Z,Q){if($?.sso?.redirectUri&&Z.sso?.redirectUri){let X=k$($.sso.redirectUri),Y=k$(Z.sso.redirectUri);if(X!==Y)Q.error(`SSO redirectUri path mismatch: the framework derives "${Y}" from basePath, but ConfigSource reports "${X}". Register "${Y}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function i6($){let Z={};if(!$)return Z;for(let[Q,X]of Object.entries($))if(X.type==="vault"&&typeof X.lfv?.deliveryEndpoint==="string"&&typeof X.lfv?.eventsEndpoint==="string")Z[Q]=X.lfv;return Z}function H2($){return $[L0]}function K2($,Z){let Q=i6($.secrets??void 0),X=k$(Z.deliveryEndpoint),Y=k$(Z.eventsEndpoint),J=k$(Z.path);for(let G of Object.values(Q)){if(k$(G.deliveryEndpoint)!==X)continue;if(k$(G.eventsEndpoint)!==Y)continue;let z=G.path?k$(G.path):void 0;if(J&&z&&J!==z)continue;return!0}return!1}function JX($,Z){let Q=H2(Z);if(!Q)return $;if(K2($,Q))return $;let X={type:"vault",lfv:{path:Q.path,lfvServerUrl:Q.lfvServerUrl,clientId:Q.clientId,deliveryTimeout:Q.deliveryTimeout,retryInterval:Q.retryInterval,warnInterval:Q.warnInterval,deliveryEndpoint:Q.deliveryEndpoint,eventsEndpoint:Q.eventsEndpoint,verifyJwks:Q.verifyJwks}},Y=$.secrets??{},J=c4(Y,{clientId:Q.clientId,path:Q.path});return{...$,secrets:{...Y,[J]:X}}}function GX($,Z){let Q=H2(Z);if(!Q||K2($,Q))return new Map;let X=c4($.secrets??{},{clientId:Q.clientId,path:Q.path});return new Map([[X,Z.secret]])}function zX($,Z){let Q=i6($.secrets),X=i6(Z.secrets??void 0);for(let[Y,J]of Object.entries(X)){let G=Q[Y];if(!G)continue;let z=k$(G.deliveryEndpoint),_=k$(J.deliveryEndpoint);if(z&&_&&z!==_)throw Error(`LFV deliveryEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${z}, framework path: ${_}`);let B=k$(G.eventsEndpoint),H=k$(J.eventsEndpoint);if(B&&H&&B!==H)throw Error(`LFV eventsEndpoint path for secrets source "${Y}" in framework config must match ConfigSource path. ConfigSource path: ${B}, framework path: ${H}`)}}function _X($){return new Set(Object.keys($.secrets??{}))}function BX($){return new Set(Object.keys($.secrets??{}))}function HX($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return new Set;if(!("outgoing"in Z))return new Set;let Q=Z.outgoing;if(!Q||typeof Q!=="object"||Array.isArray(Q))return new Set;return new Set(Object.keys(Q))}function D2($){if(!$||typeof $!=="object"||Array.isArray($))return!1;let Z=$;return"clientId"in Z||"jwksUri"in Z||"workloadId"in Z}function KX($){let Z=$.workload;if(!Z||typeof Z!=="object"||Array.isArray(Z))return new Set;let Q=Z;if("incoming"in Q||"outgoing"in Q){let X=Q.outgoing;if(!X||typeof X!=="object"||Array.isArray(X))return new Set;return new Set(Object.keys(X))}if(D2(Q))return new Set;return new Set(Object.keys(Q).filter((X)=>X!=="default"))}function DX($,Z,Q,X){let Y=Z.secrets??{},J=$.secrets??{};for(let[H,D]of Object.entries(Y)){let V=J[H];if(!V)continue;if(D.type&&V.type&&D.type!==V.type)throw Error(`Secrets source "${H}" type in framework config must match ConfigSource type. ConfigSource type: ${V.type}, framework type: ${D.type}`)}let G=_X(Z),z=BX($);for(let H of G)if(!z.has(H)&&!X.has(H))Q.warn(`Framework config declares secrets source "${H}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let H of z)if(!G.has(H))Q.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:H});let _=HX(Z),B=KX($);for(let H of _)if(!B.has(H))Q.warn(`Framework config declares outgoing workload client "${H}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(Z.otel!==void 0&&Z.otel!==null&&$.otel===void 0)Q.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function Z2($,Z){if(Z===void 0)return!1;return SQ($,Z)}function VX($,Z){if(typeof Z!=="number"||!Number.isFinite(Z)||Z<=0)return $;return new Promise((Q,X)=>{let Y=setTimeout(()=>{X(Error(`Ionite ready() timed out after ${Z}ms`))},Z);$.then(()=>{clearTimeout(Y),Q()},(J)=>{clearTimeout(Y),X(J)})})}function UX($,Z,Q){if(typeof Z!=="number"||Z<=0)return $;return new Promise((X,Y)=>{let J=setTimeout(()=>{Y(Error(Q))},Z);$.then((G)=>{clearTimeout(J),X(G)},(G)=>{clearTimeout(J),Y(G)})})}function s6(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function Q2($){return $==="/"?$:$.replace(/\/+$/,"")}function u6($,Z){return Q2($)===Q2(Z)}function X2($){return $.method==="GET"||$.method==="HEAD"}function FX($){if($.isReady()&&$.config?.readyz?.enabled===!1)return D$();let Z=$.readiness();return Response.json(MX(Z),{status:Z.ok?200:503})}function MX($){let Z=$.config.lastError;if(!Z)return $;return{...$,config:{...$.config,lastError:{kind:Z.kind,phase:Z.phase,at:Z.at,message:"[redacted]"}}}}var WX={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz"};function OX($){let Z=$?.providers;if(!Z)return!1;return Object.values(Z).some((Q)=>Q.enabled!==!1&&Q.type!=="magic-link")}function I$($,Z,Q={}){let X=WX[$],Y=Z.modules[X],J=Q.capable??!0,G=Y.active&&Y.ready&&J,z=G?void 0:!Y.active||!Y.ready?Y.reason:Q.incapableReason??`${$} is not testable by this application wiring`;return{module:X,active:Y.active,ready:Y.ready,testable:G,...Q.urls&&Q.urls.length>0?{urls:Q.urls}:{},...z?{reason:z}:{}}}function LX($,Z,Q){let X=g$(Z),Y=$.readiness();return{sdk:{version:w6,catalogVersion:Y6},basePath:Z,urls:X,modules:Y.modules,lfvCallbackTransport:Boolean(Q.lfv?.callbackTransport),capabilities:{"sso.login":I$("sso.login",Y,{urls:[X.sso.loginUrl,X.sso.callbackUrl,X.sso.userUrl]}),"sso.jit":I$("sso.jit",Y,{capable:Q.sso?.enableJitUserProvisioning!==!1&&Boolean(Q.sso?.userStore),incapableReason:Q.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":I$("sso.logout",Y,{urls:[X.sso.logoutUrl]}),"sso.back_channel_logout":I$("sso.back_channel_logout",Y,{urls:[X.sso.logoutBackChannelUrl]}),"ciam.magic_link":I$("ciam.magic_link",Y,{capable:Q.ciam?.enableJitUserProvisioning!==!1,urls:[X.ciam.magicLinkUrl,X.ciam.magicLinkLoginUrl],incapableReason:"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":I$("ciam.oidc_login",Y,{capable:OX(Q.ciam),urls:[X.ciam.customerLoginUrl,X.ciam.customerCallbackUrl,X.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":I$("ciam.customer",Y,{urls:[X.ciam.customerUrl]}),"ciam.logout":I$("ciam.logout",Y,{urls:[X.ciam.logoutUrl]}),"iam.users":I$("iam.users",Y,{capable:Boolean(Q.iam?.userStore),urls:[X.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":I$("iam.groups",Y,{capable:Boolean(Q.authz?.catalogStore||Q.authz?.catalog),urls:[X.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"workload.incoming":I$("workload.incoming",Y,{urls:[X.workload.validateUrl,X.workload.jwksUrl]}),"workload.outgoing":I$("workload.outgoing",Y,{}),"authz.oaa":I$("authz.oaa",Y,{capable:Boolean(Q.authz?.accessStore&&(Q.authz?.catalogStore||Q.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."})}}}async function NX($,Z,Q){if(!Z.isReady())return s6();if(Z.config?.capabilitiez!==!0||!Q)return D$();let X=await B0($,Z,G2["capabilitiez.read"]);if(X)return X;return Response.json(Q.build(),{status:200})}async function AX($,Z,Q){if(!Z.isReady())return s6();if(Z.config?.authz?.oaa?.fullSync?.enabled!==!0)return D$();let X=await B0($,Z,G2["authz.oaa.sync"]);if(X)return X;let Y=Z.authz?.oaa;if(!Y?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let J=Z.authz?await Z.authz.reconcile():void 0,G=Q.iam?.userStore,z=CQ(Q.authz?.catalog?z2(Q.authz.catalog):void 0,Q.authz?.catalogStore),_=Q.authz?.accessStore,B=Q.authz?.resources,H=await Y.sync({users:G?w0((D,V)=>G.list({start:D,limit:V})):void 0,groups:z?w0((D,V)=>z.groups.list({start:D,limit:V})):void 0,roles:z?w0((D,V)=>z.roles.list({start:D,limit:V})):void 0,permissions:z?w0((D,V)=>z.permissions.list({start:D,limit:V})):void 0,resources:B?w0((D,V)=>B.list({start:D,limit:V})):void 0,access:_?w0((D,V)=>_.list({start:D,limit:V})):void 0},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...H,reconcile:J})}function jX($,Z,Q,X,Y,J){return async(G)=>{let z=new URL(G.url).pathname;if(u6(z,Q)){if(!X2(G))return A0(["GET"]);return FX($)}if(u6(z,X)){if(!X2(G))return A0(["GET"]);return NX(G,$,Y)}if(J&&u6(z,J.url)){if(G.method!=="POST")return A0(["POST"]);return AX(G,$,J.frameworkConfig)}let _=$.secrets;if(!Boolean(_?.isLfvDeliveryRequest?.(G)||_?.isLfvEventsRequest?.(G))&&!$.isReady())return s6();try{return await Z(G)}catch(H){return $.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},H),N0(H)}}}function Y2($,Z,Q){if($)return Q&&!$.tenantId?{...$,tenantId:Q}:$;if(Z&&Q)return{tenantId:Q};return}function EX($,Z){if(Z.authz===null)return;if(!$.authz&&!Z.authz)return;return{...$.authz,...Z.authz,oaa:$.authz?.oaa||Z.authz?.oaa?{...$.authz?.oaa,...Z.authz?.oaa}:void 0}}function l6($){let Z=!1,Q=U$(`${$} module`,()=>Z);return{isReady:Q.isReady,ready:Q.ready,attach(X){if(Z=X!==void 0,Q.refresh(),!X)return;return Object.defineProperty(X,"isReady",{value:Q.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(X,"ready",{value:Q.ready,enumerable:!1,configurable:!0}),X}}}function n6($){if(!$)return!1;return $.isReady?$.isReady():!1}function S0($,Z,Q,X){if(!$)return{active:!1,ready:!1,reason:Q};return n6(Z)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:X}}function RX(){let $=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:$(),ciam:$(),iam:$(),workload:$(),otel:$(),secrets:$(),kms:$(),authz:$()}}function PX($,Z,Q){let X=$.isReady(),Y=$.config;if(!X||!Y)return{ok:!1,applied:X,modules:RX(),config:{...Z}};let J=h4(Q),G=Boolean(Y.workload)||Boolean($.workload),z={sso:S0(Boolean(Y.sso),$.sso,"sso not configured (no RemoteConfig.sso)",J.sso??"sso configured but not ready"),ciam:S0(Boolean(Y.ciam),$.ciam,"ciam not configured (no RemoteConfig.ciam)",J.ciam??"ciam configured but not ready"),iam:S0(Boolean(Y.iam),$.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:S0(G,$.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:S0(Boolean(Y.otel),$.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(Y.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!n6($.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return $.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:S0(Boolean(Y.kms),$.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(Y.authz?.oaa))return{active:!0,ready:!0};let H=$.authz?.oaa;return n6(H)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})()};return{ok:Object.values(z).every((B)=>!B.active||B.ready),applied:X,modules:z,config:{...Z}}}function qX($,Z){let Q=[];for(let X of Z){let Y=$.modules[X];if(!$.applied){Q.push({name:X,reason:"RemoteConfig has not been applied yet"});continue}if(!Y?.ready)Q.push({name:X,reason:Y?.reason??`${X} is not ready`})}return{ok:Q.length===0,notReady:Q}}function TX($,Z,Q,X,Y,J,G,z){let _=Z.validators,B=yQ($.cache);bQ(B.jwks);let H=Z;if(B.session.read.enabled){let n=Z.sso?.sessionStore??Z.ciam?.sessionStore;if(n){let r=L6(n,B.session.read);H={...Z,sso:Z.sso?{...Z.sso,sessionStore:r}:Z.sso,ciam:Z.ciam?{...Z.ciam,sessionStore:r}:Z.ciam}}}let D={sessionCache:B.session},V=i$(_.workload,Q,$?.workload,Z.workload??void 0),x=Z.otel!==null?B6(Q,$?.otel,Z.otel??void 0,Y):void 0,T=h4(H);if(Object.keys($).length>0){if(T.sso)Q.error(T.sso);if(T.ciam)Q.error(T.ciam)}let P=Y2($?.sso,Z.sso,$.id),I=T.sso?void 0:hQ(_.sso,Q,P,H.sso??void 0,D),O={...$?.iam,...Z.iam},q=Z.authz?.catalog?z2(Z.authz.catalog):void 0,M=Z.workload,E=M&&"workloadIdentityStore"in M?M.workloadIdentityStore:M&&("incoming"in M)&&M.incoming&&!Array.isArray(M.incoming)&&("workloadIdentityStore"in M.incoming)?M.incoming.workloadIdentityStore:void 0,f=Boolean(O.url||O.userStore||Z.authz?.catalogStore||q),g=G.update({mode:O.delta,url:O.url,audience:O.deltaAudience},{workload:V,workloadIdentityStore:E,userStore:O.userStore,accessStore:Z.authz?.accessStore,catalogStore:Z.authz?.catalogStore,codeCatalog:q,mapUserToScim:O.inboundUsers?.mapBaseUserToScim}),a;if(f&&!V){if(Object.keys($).length>0)Q.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");a=void 0}else a=vQ(_.iam,Q,V,J,Z.authz?.accessStore,Z.authz?.accessIndex,Z.authz?.catalogStore,q,Z.authz?.resources,$?.iam,Z.iam??void 0,g,Z.authz?.onAccessMutation,wQ($.authz),z);let X$=Y2($?.ciam,Z.ciam,$.id),e=T.ciam?void 0:kQ(_.ciam,Q,X$,H.ciam??void 0,V,D);return{secret:X,workload:V,otel:x,sso:I,iam:a,ciam:e}}function V2($,Z,Q,X,Y,J,G,z){let _=J.authz.update(EX(Z,Q));$.id=Z.id,$.config=Z,$.secrets=J.secrets.update(Z.secrets,Q.secrets??void 0,Q.validators.secrets,Q.lfv?.callbackTransport,Q.lfv?.singleProcess),$.kms=J.kms.update(Z.kms,(V)=>{if(!V.source)return Y;if(!$.secrets)throw Error(`KMS pool references unavailable secrets source "${V.source}".`);return $.secrets.getSecretsSource(V.source)});let B=TX(Z,Q,X,Y,J.kms.handle(),_,J.iamDelta,J.authz.settle);$.secret=B.secret,$.workload=J.workload.update(B.workload),$.otel=J.otel.update(B.otel),$.authz=_,$.log=J.log.update($.otel?.logger??X),$.sso=J.sso.attach(B.sso),$.iam=J.iam.attach(B.iam),$.ciam=J.ciam.attach(B.ciam);let H=g$(G),D=(V)=>K6(V,$,z?.routing,H);$.handler=jX($,D,H.readyzUrl,H.capabilitiezUrl,{build:()=>LX($,G,Q)},{url:Y1(G),frameworkConfig:Q})}function IX($,Z,Q,X,Y,J,G,z,_){eQ($.id,Z),$X(Z),ZX(Z),XX(Z),YX(Z,Q,X),zX(Z,Q),DX(Z,Q,X,z),V2($,Z,Q,X,Y,J,G,_)}function J2($){if(!$.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return $.secret}async function xX($,Z,Q,X,Y,J,G){let z=$,_=J1($,Z,Y.current,J);if(X.beforeChange){let B=_2(_,Y);G?.enter();let H;try{H=await X.beforeChange($,B,Q)}finally{G?.exit()}if(H?.config!==void 0)z=H.config;_=H?.frameworkConfig??B}return _=b0(_,Y.current),{effectiveRemoteConfig:z,effectiveFrameworkConfig:_}}function YJ($,Z){let Q=mQ(Z),{frameworkConfig:X,basePath:Y,readyTimeoutMs:J,stores:G,options:z}=Q,_=GX(X,$),B=new Set(_.keys()),H=b0(JX(X,$),G),D=H.log||d6,V={current:G},x={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:H},T=X6(D),P={log:gQ(D),secrets:M8(D,_),kms:g1(D),workload:q8(D),otel:i1(D),authz:L1(D,()=>T.handle()),iamDelta:T,sso:l6("sso"),iam:l6("iam"),ciam:l6("ciam")},I={},O,q,M=new Promise((s,z$)=>{O=s,q=z$}),E=!1,f,g,a=0,X$={enter:()=>{a+=1},exit:()=>{a-=1}},e=Promise.resolve();function n(s){let z$=e.then(s,s);return e=z$.then(()=>{return},()=>{return}),z$}function r(s){if(E)throw Error(`Ionite instance has been closed and cannot call ${s}().`)}function Q$(){$.log=x.frameworkConfig.log??d6,$.validators=x.frameworkConfig.validators}let A={},W={log:D,id:void 0,config:void 0,secret:J2($),authz:void 0,configStatus:I,handler:async()=>D$(),ready:(s)=>{if(a>0&&x.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return VX(M,s??J)},isReady:()=>x.remoteConfig!==void 0,readiness:()=>PX(W,I,x.frameworkConfig),requireReady:(s)=>qX(W.readiness(),s),close:()=>{if(E)return;if(E=!0,g)clearTimeout(g),g=void 0;f?.(),f=void 0;let s=[()=>P.secrets.close(),()=>P.kms.close(),()=>P.authz.close(),()=>P.otel.shutdown()];for(let z$ of s)try{Promise.resolve(z$()).catch((H$)=>{D.warn("Ionite close: module teardown failed",H$)})}catch(H$){D.warn("Ionite close: module teardown failed",H$)}O?.(),O=void 0,q=void 0},setStores:async(s)=>{r("setStores");let z$=$4(s);await n(()=>u(z$))}};V2(W,A,x.frameworkConfig,D,W.secret,P,Y,z),Q$();function L(){let s=I.lastError!==void 0;if(I.appliedAt=Date.now(),I.lastError=void 0,s)(W.log??D).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function k(s,z$){let H$=c6(z$)??(z$ instanceof Error?z$.message:String(z$)),K$=iQ(z$),j=I.lastError===void 0;if(I.lastError={kind:K$,message:H$,at:Date.now(),phase:s},j)(W.log??D).error(s==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":K$,phase:s,error:H$})}function w(s,z$,H$){(W.log??D).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:s,"ion.config.hash":z$,"ion.config.apply_ms":H$})}async function b(s,z$){if(E)return;let H$=e8(s);if(z$&&x.remoteConfig!==void 0&&H$===x.remoteConfigHash&&Z2(s,x.remoteConfig))return;let K$=x.remoteConfig,j=K$===void 0?"initial":"update",h=Date.now(),R,F,K;try{let v=await xX(s,x.frameworkConfig,x.remoteConfig,z,V,Y,X$);if(R=v.effectiveRemoteConfig,F=e8(R),K=v.effectiveFrameworkConfig,z$&&z.beforeChange===void 0&&x.remoteConfig!==void 0&&F===x.remoteConfigHash&&Z2(R,x.remoteConfig)&&K===x.frameworkConfig)return;let i=K.log||d6;IX(W,R,K,i,J2($),P,Y,B,z)}catch(v){throw k(j,v),v}x.remoteConfig=R,x.remoteConfigHash=F,x.frameworkConfig=K,Q$(),L(),await P.otel.settled();let N=_2(x.frameworkConfig,V),S=!1;try{z.afterChange?.(W,R,N,K$)}catch(v){if((W.log??D).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:j,error:v instanceof Error?v.message:String(v)}),j==="initial"){S=!0;let i=v instanceof Error?v:Error(`afterChange failed on initial load: ${String(v)}`);k("initial",i),q?.(i),q=void 0,O=void 0}}if(x.frameworkConfig=N,Q$(),!S)w(j,F,Date.now()-h);if(!S&&O)O(),O=void 0}async function u(s){if(E)return;if(V.current=s,x.remoteConfig===void 0){x.frameworkConfig=b0(x.frameworkConfig,s),Q$();return}await b(x.remoteConfig,!1)}if($.subscribe)$.subscribe((s)=>{n(()=>b(s,!0)).catch(()=>{})},{mode:"wait"}).then((s)=>{if(E){s?.();return}f=s}).catch((s)=>{D.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:s instanceof Error?s.message:String(s)})});let c=aQ(z.configRetry),o=[z.onConfigLoadError??rQ(D)],Y$=0;function G$(){if(g=void 0,E)return;if(x.remoteConfig!==void 0)return;UX($.load(),c.loadTimeoutMs,`ConfigSource initial load timed out after ${c.loadTimeoutMs}ms`).then(async(s)=>{Y$=0;try{await n(async()=>{if(x.remoteConfig!==void 0)return;await b(s,!0)})}catch(z$){let H$=z$ instanceof Error?z$:Error(`Initial RemoteConfig application failed: ${String(z$)}`);D.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:H$.message}),q?.(H$),q=void 0}},async(s)=>{if(E)return;Y$+=1;let z$=tQ(Y$,c),H$=c6(s)??"RemoteConfig load failed",K$=cQ(s),j=C$(s,"code"),h=C$(s,"status"),R={attempt:Y$,error:s,errorKind:K$,maxDelayMs:c.maxDelayMs,message:H$,nextDelayMs:z$,code:typeof j==="string"?j:void 0,status:typeof h==="number"?h:void 0,path:typeof C$(s,"path")==="string"?C$(s,"path"):void 0,sourceType:typeof C$(s,"sourceType")==="string"?C$(s,"sourceType"):void 0};if(!sQ(s,K$)){let F=s instanceof Error?s:Error(`ConfigSource initial load failed with unrecoverable ${K$}: ${H$}`);D.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:K$,error:H$,code:R.code,status:R.status,path:R.path,sourceType:R.sourceType}),q?.(F),q=void 0;return}try{await oQ(R,o)}catch(F){let K=F instanceof Error?F:Error("ConfigSource retry hook stopped RemoteConfig retrying");q?.(K),q=void 0;return}g=setTimeout(G$,z$)})}return G$(),W}export{v3 as workloadHandler,i$ as workload,tJ as withSetCookies,aJ as verifyUser,_8 as vaultSocketDiagnostics,S4 as vaultConfig,P0 as vault,x6 as validateWorkloadToken,NQ as tenantMirror,d3 as tenantManager,c$ as subscribeSecretPathWithHttpPolling,sJ as sso,e1 as setVaultWebSocketCommandTimeout,nJ as sendTenantWebhook,OQ as secretConfigSource,iJ as sameOriginRedirectRules,K6 as routeRequest,r8 as rewriteRequestPath,p6 as rewriteRequestForTenantPath,TQ as rewriteRequestForDefaultTenantUi,qQ as rewriteRequestForDefaultTenantApi,b3 as revokeWorkloadToken,t8 as resolveTenantFromRequest,cJ as resolveRedirect,s1 as resolveDefaultRoute,lJ as resolveCapturedRedirect,uJ as resolveAfterRedirect,dJ as reconcileSubjectAccess,n0 as mirroredConfig,h6 as mirrorSecrets,pJ as listSsoClientIdsFromCookies,HJ as listGenerator,z0 as lfvVault,XQ as isVaultConfigWaitingForSecretError,YQ as isVaultConfigInvalidPayloadError,gJ as isRedirectAllowed,YJ as ionite,mJ as initiateLogin,fJ as iam,yJ as hasScope,vJ as hasRole,bJ as hasPermission,kJ as hasGroup,CJ as hasAnyScope,SJ as hasAny,wJ as hasAllScope,xJ as hasAll,IJ as has,k3 as getWorkloadToken,C3 as getWorkload,TJ as getUser,qJ as getCustomer,_J as generateULID,y6 as gcpConfig,PJ as expandRoot,e4 as escapeScimFilterValue,FQ as envConfig,B0 as enforceEndpointAuthz,RJ as discoverSessions,EJ as discoverSessionRecords,C2 as devInMemoryStores,g$ as deriveIonUrls,jJ as defaultRedirectPolicies,PQ as createTenantIonResolver,IQ as createTenantIonHandler,L6 as createSessionReadCache,X6 as createManagedIamDelta,t$ as configSourceFromLocator,p8 as configSourceFromEnvValues,k4 as configLocatorFromEnvValues,m6 as configFromSource,AJ as collectReferencedDefinitions,B8 as closeAllVaultSockets,NJ as ciam,LJ as captureRedirect,OJ as callback,MJ as blockDangerousUrls,w4 as azureConfig,v6 as awsConfig,FJ as allowSameOrigin,UJ as allowRelativePaths,VJ as allowOrigins,DJ as allowHosts,w$ as VaultSubscribeNotSupportedError,D0 as VaultConfigWaitingForSecretError,s0 as VaultConfigInvalidPayloadError,N4 as VAULT_MIN_POLLING_TTL_MS,V4 as ScimOutboundClient,BJ as IoniteError,Q0 as InMemoryWorkloadTokenStore,o8 as InMemoryWorkloadIdentityStore,e0 as InMemoryUserStore,hJ as InMemoryTenantStore,o0 as InMemorySessionStore,k8 as InMemoryResourceStore,r0 as InMemoryMagicLinkStore,t0 as InMemoryCustomerStore,b8 as InMemoryAccessIndex,C8 as InMemoryAccessCatalogStore,n$ as InMemoryAccessAssignmentStore,w6 as ION_SDK_VERSION,fQ as ION_READY_DEFAULT_TIMEOUT_MS,Y6 as ION_CAPABILITY_CATALOG_VERSION,l9 as ION_CAPABILITY_CATALOG,WJ as CatalogAdjacencyCache};