@ionite/server 0.0.24-beta.20260915.2 → 0.0.24-beta.20260917.4

package/dist/index.js

@@ -1,5 +1,5 @@
-import{configTrustedClientGrants as ol,deepEqualPlain as sl,defaultLogger as Yn,ION_ENDPOINT_PERMISSIONS as Pi,listGenerator as Wt,stableConfigHash as vi,toCodeCatalog as Ii,unionCatalogRead as il}from"@ionite/core";import{ciam as al,configureJwksCache as cl,iam as ul,resolveCacheConfig as dl,sso as ll}from"@ionite/core/server";import{trimTrailingSlash as mo}from"@ionite/core";import{list as Gi,matchesListFilter as Ji}from"@ionite/core";class rr{constructor(){this.customers=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.customers.get(e)}async lookup(e){if(e.id){let t=this.customers.get(e.id);if(t)return t}if(e.userName){let t=this.userNameIndex.get(e.userName.toLowerCase());if(t)return this.customers.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.customers.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n={...e,id:t,createdAt:this.customers.get(t)?.createdAt??e.createdAt??r,updatedAt:r},o=this.customers.get(t);if(o){if(o.userName&&o.userName.toLowerCase()!==n.userName?.toLowerCase())this.userNameIndex.delete(o.userName.toLowerCase());if(o.externalId&&o.externalId!==n.externalId)this.externalIdIndex.delete(o.externalId)}if(this.customers.set(t,n),n.userName)this.userNameIndex.set(n.userName.toLowerCase(),t);if(n.externalId)this.externalIdIndex.set(n.externalId,t);return n}async delete(e){let t=this.customers.get(e);if(t?.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.customers.delete(e),t?1:0}async list(e){let t=Array.from(this.customers.values()).filter((c)=>Ji(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return Gi(o,i,r,n)}}class nr{constructor(){this.magicLinks=new Map}async create(e,t,r){if(this.magicLinks.has(e))throw Error(`Magic link with token ${e} already exists`);let n={token:e,customer:t,createdAt:new Date,expiresAt:r};this.magicLinks.set(e,n)}async get(e){let t=this.magicLinks.get(e);if(!t)return null;if(Date.now()>t.expiresAt.getTime())return this.magicLinks.delete(e),null;return t}async getAndDelete(e){let t=this.magicLinks.get(e);if(this.magicLinks.delete(e),!t)return null;if(Date.now()>t.expiresAt.getTime())return null;return t}async delete(e){this.magicLinks.delete(e)}}function Hi(e){let t=e.expiresAt;if(!t)return;let r=t instanceof Date?t.getTime():new Date(t).getTime();return Number.isNaN(r)?void 0:r}class or{constructor(){this.sessions=new Map}async create(e){if(this.sessions.has(e.sid))throw Error(`Session with sid ${e.sid} already exists`);this.sessions.set(e.sid,e)}async get(e){let t=this.sessions.get(e);if(!t)return null;let r=Hi(t);if(r!==void 0&&Date.now()>r)return this.sessions.delete(e),null;return t}async update(e,t){let r=this.sessions.get(e);if(!r)throw Error(`Session with sid ${e} not found`);let n={...r,...t};this.sessions.set(e,n)}async delete(e){this.sessions.delete(e)}}import{list as Yi,StoreConflictError as Xi}from"@ionite/core";class sr{constructor(){this.users=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.users.get(e)}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.users.get(t):void 0}async lookup(e){return this.users.get(e.id??"")}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r={...e,id:t},n=this.users.get(t),o=r.externalId?this.externalIdIndex.get(r.externalId):void 0;if(o&&o!==t)throw new Xi(`externalId "${r.externalId}" is already in use`,"unique_violation","externalId");if(n){if(n.userName&&n.userName.toLowerCase()!==r.userName?.toLowerCase())this.userNameIndex.delete(n.userName.toLowerCase());if(n.externalId&&n.externalId!==r.externalId)this.externalIdIndex.delete(n.externalId)}if(this.users.set(t,r),r.userName)this.userNameIndex.set(r.userName.toLowerCase(),t);if(r.externalId)this.externalIdIndex.set(r.externalId,t);return r}async delete(e){let t=this.users.get(e);if(t){if(t.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t.externalId)this.externalIdIndex.delete(t.externalId)}return this.users.delete(e),t?1:0}async list(e){let t=Array.from(this.users.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return Yi(o,i,r,n)}}class it{constructor(){this.tokens=new Map}async set(e){this.tokens.set(e.workload_id,e)}async get(e){let t=this.tokens.get(e);if(!t)return null;if(Date.now()>t.expires_at.getTime())return this.tokens.delete(e),null;return t}async delete(e){this.tokens.delete(e)}async isValid(e){return await this.get(e)!==null}async cleanup(){let e=Date.now();for(let[t,r]of this.tokens.entries())if(e>r.expires_at.getTime())this.tokens.delete(t)}}function Fe(e){let t=mo(e||Vr);return{readyzUrl:`${t}/readyz`,capabilitiezUrl:`${t}/capabilitiez`,sso:{loginUrl:`${t}/auth/login`,userUrl:`${t}/auth/user`,logoutUrl:`${t}/auth/logout`,logoutBackChannelUrl:`${t}/auth/logout/backchannel`,refreshUrl:`${t}/auth/refresh`,callbackUrl:`${t}/auth/callback`},workload:{validateUrl:`${t}/workload/validate`,jwksUrl:`${t}/workload/jwks`},iam:{basePath:`${t}/iam`,usersUrl:`${t}/iam/Users`,groupsUrl:`${t}/iam/Groups`,workloadsUrl:`${t}/iam/Workloads`,customersUrl:`${t}/iam/Customers`},ciam:{magicLinkUrl:`${t}/magic-link`,magicLinkLoginUrl:`${t}/magic-link/login`,customerUrl:`${t}/auth/customer`,customerLoginUrl:`${t}/auth/customer/login`,customerCallbackUrl:`${t}/auth/customer/callback`,customerProvidersUrl:`${t}/auth/customer/providers`,logoutUrl:`${t}/auth/customer/logout`}}}function go(e){return`${mo(e||Vr)}/authz/oaa/sync`}function Zi(e,t){if(e===null)return null;let r={validateUrl:t.validateUrl,jwksUrl:t.jwksUrl};if(e&&typeof e==="object"&&(("incoming"in e)||("outgoing"in e))){let n=e;return{...n,incoming:{...n.incoming,...r}}}return{...e??{},...r}}function yo(e,t,r,n){let o={...t},s=Fe(n);if(o.sso!==null)if(e.sso)o.sso={...o.sso,loginUrl:s.sso.loginUrl,userUrl:s.sso.userUrl,logoutUrl:s.sso.logoutUrl,logoutBackChannelUrl:s.sso.logoutBackChannelUrl,refreshUrl:s.sso.refreshUrl,redirectUri:s.sso.callbackUrl,sessionStore:r.sessionStore??o.sso?.sessionStore,userStore:r.userStore??o.sso?.userStore,enableJitUserProvisioning:o.sso?.enableJitUserProvisioning??!0};else o.sso=void 0;if(o.iam!==null)if(e.iam)o.iam={...o.iam,usersUrl:s.iam.usersUrl,groupsUrl:s.iam.groupsUrl,workloadsUrl:s.iam.workloadsUrl,customersUrl:s.iam.customersUrl,userStore:r.userStore??o.iam?.userStore,workloadIdentityStore:r.workloadIdentityStore??o.iam?.workloadIdentityStore,customerStore:r.customerStore??o.iam?.customerStore};else o.iam=void 0;if(o.workload!==null){if(e.workload||o.workload)o.workload=Zi(o.workload,s.workload)}if(o.ciam!==null)if(e.ciam)o.ciam={...o.ciam,magicLinkUrl:s.ciam.magicLinkUrl,magicLinkLoginUrl:s.ciam.magicLinkLoginUrl,customerUrl:s.ciam.customerUrl,customerLoginUrl:s.ciam.customerLoginUrl,customerCallbackUrl:s.ciam.customerCallbackUrl,customerProvidersUrl:s.ciam.customerProvidersUrl,logoutUrl:s.ciam.logoutUrl,providers:e.ciam.providers,sessionStore:r.sessionStore??o.ciam?.sessionStore,customerStore:r.customerStore??o.ciam?.customerStore,magicLinkStore:r.magicLinkStore??o.ciam?.magicLinkStore,enableJitUserProvisioning:o.ciam?.enableJitUserProvisioning??!0};else o.ciam=void 0;return o}function qt(e,t){let r={...e};if(r.sso)r.sso={...r.sso,sessionStore:t.sessionStore??r.sso.sessionStore,userStore:t.userStore??r.sso.userStore};if(r.iam)r.iam={...r.iam,userStore:t.userStore??r.iam.userStore};if(r.workload){let n=r.workload;r.workload={...r.workload,tokenStore:t.workloadTokenStore??n.tokenStore,workloadIdentityStore:t.workloadIdentityStore??n.workloadIdentityStore}}if(r.ciam)r.ciam={...r.ciam,sessionStore:t.sessionStore??r.ciam.sessionStore,customerStore:t.customerStore??r.ciam.customerStore,magicLinkStore:t.magicLinkStore??r.ciam.magicLinkStore};if(r.authz!==null&&(t.accessStore||t.accessIndex||t.catalog||t.catalogStore||t.resources))r.authz={...r.authz,accessStore:t.accessStore,accessIndex:t.accessIndex,catalog:t.catalog,catalogStore:t.catalogStore,resources:t.resources};return r}var Vr="/api/ionite";function ir(e){return{...e}}function Qi(){return{sessionStore:new or,userStore:new sr,customerStore:new rr,magicLinkStore:new nr,workloadTokenStore:new it}}function po(e,t){return`${e} is enabled by RemoteConfig but is not served: missing ${t.join(", ")}. Provide durable stores in ionite({ stores }) (e.g. @ionite/redis or app-owned SQL stores), or opt into stores: devInMemoryStores() for prototypes only (state is lost on restart).`}function Fr(e){let t={};if(e.sso&&!e.sso.sessionStore)t.sso=po("SSO",["stores.sessionStore"]);if(e.ciam){let r=[];if(!e.ciam.sessionStore)r.push("stores.sessionStore");if(!e.ciam.customerStore)r.push("stores.customerStore");if(r.length>0)t.ciam=po("CIAM",r)}return t}function ar(){return Vr}import{AssignmentPolicyError as Uo,accessRefId as nt,accessRootId as Xr,assertRequiredSubjectType as Zr,catalogEntityStore as Ua,configTrustedClientGrants as xa,deepEqualPlain as Ma,deprecateRetiredCodeCatalogRows as Wa,getCodeCatalogEntity as ja,list as xo,listGenerator as Qr,materializeCodeCatalogEntity as $a,toCodeCatalog as qa,unionCatalogRead as Mo}from"@ionite/core";import{assertSubjectTypeAssignable as Na,CatalogAdjacencyCache as Ka,expandRoot as Wo,reconcileSubjectAccess as Va}from"@ionite/core/server";import{accessRefId as Re,accessRootId as ea,ION_AUTHZ_GROUP_SCHEMA as ta,mergeCodeCatalogEntity as ra}from"@ionite/core";import{baseCustomerToScim as na,baseUserToScimUser as oa,baseWorkloadToScim as sa,collectReferencedDefinitions as ia}from"@ionite/core/server";function ye(e,t,r=(n)=>Error(`${e} ready timed out after ${n}ms`)){let n=!1,o,s,i=()=>{n=!1,s=new Promise((a)=>{o=a})};i();let c=()=>{n=!0,o?.(),o=void 0},u=()=>{if(t()){if(!n)c();return}if(n)i()};return u(),{isReady:()=>t(),ready:(a)=>{if(t())return Promise.resolve();let d=s;if(!a||a<=0)return d;return new Promise((g,m)=>{let C=setTimeout(()=>m(r(a)),a);d.then(()=>{clearTimeout(C),g()},(P)=>{clearTimeout(C),m(P)})})},refresh:u,settle:c}}var So="App",aa="ionite",ko=104857600,ca=ko,ua=10485760,Dr=3,da=250,la={};function rt(e,t){return t.mapGroup?t.mapGroup(e):e}class $e extends Error{constructor(e,t={}){super(e,{cause:t.cause});this.name="OaaError",this.retryable=t.retryable??!1,this.code=t.code,this.status=t.status,this.warnings=t.warnings,Object.setPrototypeOf(this,$e.prototype)}}function fa(e){let t=e();return Boolean(t?.url&&t.providerId&&t.datasourceId)}function bo(e,t,r,n=()=>({}),o=()=>{return},s,i){let c=async(a)=>{await vo(e,Se(t),a,{mode:"incremental"})},u=ye("OAA",()=>fa(t),(a)=>new $e(`OAA ready timed out after ${a}ms`,{code:"not_ready"}));return{isReady:u.isReady,ready:u.ready,refreshReadiness:u.refresh,population(a){return Yr(t(),a)},async pushUser(a){let d=Se(t);if(!await zr(d,"user",Re(a),o()))return;let g=await Co(a,n());await c(be(d,{local_users:[vt(g,"user","modify")]},!0))},async pushCustomer(a){let d=Se(t);if(!await zr(d,"customer",Re(a),o()))return;let g=await To(a,n());await c(be(d,{local_users:[vt(g,"customer","modify")]},!0))},async pushWorkload(a){let d=Se(t);if(!await zr(d,"workload",Re(a),o()))return;let g=await Po(a,n());await c(be(d,{local_users:[vt(g,"workload","modify")]},!0))},async pushGroup(a){let d=Se(t),g=r(),m=rt(a,g),C=dr(m,tt(d),"add"),P=await Br(m,"group",i?.(),g,d);await c(be(d,Nt({local_groups:[at(m,"modify")],identity_to_permissions:C?[C]:[]},P),!0))},async pushRole(a){let d=Se(t),g=r(),m=g.mapRole?g.mapRole(a):a,C=await Br(m,"role",i?.(),g,d);await c(be(d,Nt({local_roles:[ct(m,"modify")]},C),!0))},async pushPermission(a){let d=Se(t);await c(be(d,{permissions:[St(a,r().mapPermissionTypes,"modify")]},!0))},async pushResource(a){let d=Se(t),g=r(),m=g.mapResource?g.mapResource(a):a,C=await Sa(m,i?.(),g);await c(be(d,{resources:C},!0))},async grant(a){let d=Se(t),g=r(),m=await Ro(a,i?.(),g,d);await c(wo(d,a,"add",g,m))},async revoke(a){let d=Se(t);await c(wo(d,a,"delete",r()))},async pushAccessChanges(a){if(a.length===0)return;let d=Se(t),g=r(),m=i?.(),C=await ma(d,a,g,m);await c(C)},async deleteUser(a){let d=Se(t);await c(be(d,{local_users:[{name:a,unique_id:a,operation:"delete"}]},!0))},async deleteCustomer(a){let d=Se(t);await c(be(d,{local_users:[ho(a,"customer")]},!0))},async deleteWorkload(a){let d=Se(t);await c(be(d,{local_users:[ho(a,"workload")]},!0))},async deleteGroup(a){let d=Se(t);await c(be(d,{local_groups:[{name:a,unique_id:a,operation:"delete"}]},!0))},async deleteRole(a){let d=Se(t);await c(be(d,{local_roles:[{name:a,unique_id:a,operation:"delete"}]},!0))},async deletePermission(a){let d=Se(t);await c(be(d,{permissions:[{name:a,unique_id:a,permission_type:[],operation:"delete"}]},!0))},async deleteResource(a){let d=Se(t);await c(be(d,{resources:[{name:a,id:a,resource_type:"",operation:"delete"}]},!0))},async sync(a,d){let g=Se(t),m=d?.mode==="incremental",C=m?void 0:s?.(),P=await pa(g,a,r(),n(),m,C);return vo(e,g,P,d)}}}function Se(e){let t=e();if(!t?.url||!t.providerId||!t.datasourceId)throw new $e("OAA is not configured",{code:"not_configured"});return t}async function pa(e,t,r,n,o,s){let i=[],c=[],u=[],a=[],d=[],g=[],m=o?"modify":void 0,C=new Set,P=[],E=new Set,O=(l)=>ea(l);for await(let l of et(t.access))P.push(l),E.add(`${l.subjectType}:${Re(l.subject)}`);let b=(l,k)=>Yr(e,l)==="all"||Boolean(k&&E.has(`${l}:${k}`));for await(let l of et(t.users))if(b("user",Re(l)))i.push(vt(await Co(l,n),"user",m));for await(let l of et(t.customers))if(b("customer",Re(l)))i.push(vt(await To(l,n),"customer",m));for await(let l of et(t.workloads))if(b("workload",Re(l)))i.push(vt(await Po(l,n),"workload",m));for await(let l of et(t.groups)){let k=rt(l,r);c.push(at(k,m));let W=dr(k,tt(e),o?"add":void 0);if(W)g.push(W)}for await(let l of et(t.roles)){let k=r.mapRole?r.mapRole(l):l;d.push(ct(k,m))}for await(let l of et(t.permissions))a.push(St(l,r.mapPermissionTypes,m));let T=[];for await(let l of et(t.resources)){let k=r.mapResource?r.mapResource(l):l;T.push(k)}u.push(...Oo(T,m));for(let l of P)if(C.add(O(l)),ur(l,g,i,tt(e),o?"add":void 0),typeof l.target!=="string")if(l.targetType==="role"){let k=r.mapRole?r.mapRole(l.target):l.target;d.push(ct(k,m))}else if(l.targetType==="permission")a.push(St(l.target,r.mapPermissionTypes,m));else{let k=rt(l.target,r);c.push(at(k,m))}for(let l of s??[]){let k=O(l);if(C.has(k))continue;C.add(k);let W=Re(l.subject);if(W&&!i.some((F)=>Re(F.unique_id??F.name)===W))i.push({name:W,unique_id:W,is_active:!0,operation:m,custom_properties:{identity_type:"workload",source:"eci-trusted"}});ur(l,g,i,tt(e),m)}return be(e,{local_users:i,local_groups:c,local_roles:d,resources:u,permissions:a,identity_to_permissions:g},o)}function be(e,t,r){let n={name:e.applicationName??So,application_type:e.applicationType??aa,local_users:t.local_users??[],local_groups:t.local_groups??[],local_roles:t.local_roles??[],resources:t.resources??[],custom_properties:{},tags:[]};if(r)n.operation="modify";return Ce({applications:[n],permissions:t.permissions??[],identity_to_permissions:t.identity_to_permissions??[],is_incremental:r?!0:void 0})}function wo(e,t,r,n=la,o){let s=[],i=[],c=[],u=[],a=[];ur(t,s,i,tt(e),r);let d=r==="delete"?"delete":"modify";if(typeof t.target!=="string")if(t.targetType==="role"){let m=n.mapRole?n.mapRole(t.target):t.target;u.push(ct(m,d))}else if(t.targetType==="permission")a.push(St(t.target,n.mapPermissionTypes,d));else{let m=rt(t.target,n);c.push(at(m,d))}let g={local_users:i,local_groups:c,local_roles:u,permissions:a,identity_to_permissions:s};return be(e,o?Nt(g,o):g,!0)}async function ma(e,t,r,n){let o=tt(e),s=[],i=[],c=[],u=[],a=[],d=[],g=[],m=[];for(let{change:P,op:E}of t){ur(P,E==="delete"?u:i,E==="delete"?c:s,o,E==="delete"?"delete":"add");let l=E==="delete"?"delete":"modify";if(typeof P.target!=="string")if(P.targetType==="role"){let k=r.mapRole?r.mapRole(P.target):P.target;d.push(ct(k,l))}else if(P.targetType==="permission")g.push(St(P.target,r.mapPermissionTypes,l));else{let k=rt(P.target,r);a.push(at(k,l))}if(E==="add")m.push(await Ro(P,n,r,e))}let C={local_users:[...s,...c],local_groups:a,local_roles:d,permissions:g,identity_to_permissions:[...i,...u]};return be(e,Nt(C,...m),!0)}function Nt(...e){let t={},r=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let n of e)for(let o of r){let s=n[o];if(s&&s.length>0)t[o]=[...t[o]??[],...s]}return t}async function Br(e,t,r,n,o){if(!r)return{};let s=await ia(e,t,{catalog:r.catalog,code:r.code,resources:r.resources,cache:r.cache}),i=[];for(let c of s.groups){let u=rt(c,n),a=dr(u,tt(o),"add");if(a)i.push(a)}return{local_groups:s.groups.map((c)=>at(rt(c,n),"modify")),local_roles:s.roles.map((c)=>ct(n.mapRole?n.mapRole(c):c,"modify")),permissions:s.permissions.map((c)=>St(c,n.mapPermissionTypes,"modify")),resources:s.resources.map((c)=>lr(n.mapResource?n.mapResource(c):c,"modify")),identity_to_permissions:i}}async function Ro(e,t,r,n){if(!t)return{};if(e.targetType!=="group"&&e.targetType!=="role")return{};let o=Re(e.target);if(!o)return{};let s=typeof e.target==="string"?await ga(e.targetType,o,t):e.target;if(!s)return{};let i={};if(typeof e.target==="string")if(e.targetType==="group"){let u=rt(s,r),a=dr(u,tt(n),"add");i={local_groups:[at(u,"modify")],identity_to_permissions:a?[a]:[]}}else{let u=r.mapRole?r.mapRole(s):s;i={local_roles:[ct(u,"modify")]}}let c=await Br(s,e.targetType,t,r,n);return Nt(i,c)}async function ga(e,t,r){if(r.cache)return await r.cache.getNode(e,t);let n=e==="group"?r.code?.groups.get(t):r.code?.roles.get(t),s=await(e==="group"?r.catalog?.groups:r.catalog?.roles)?.get(t);return s&&n?ra(e,n,s):s??n}function ur(e,t,r,n,o){let s=Re(e.subject),i=Re(e.target),c=r.find((g)=>Re(g.unique_id??g.name)===s);if(e.subjectType!=="user")if(c)c.custom_properties={...c.custom_properties,identity_type:e.subjectType};else c={name:s,unique_id:s,custom_properties:{identity_type:e.subjectType},operation:o},r.push(c);if(e.targetType==="group"){if(c){let g=new Set(c.groups??[]);if(g.add(i),c.groups=[...g],o)c.operation=o}else r.push({name:s,unique_id:s,groups:[i],operation:o});return}let u={identity:s,identity_type:"local_user",operation:o},a=e.resources??[],d=e.applyToApplication??a.length===0;if(e.targetType==="role")u.role_assignments=[{application:n,role:i,apply_to_application:d,resources:a,operation:o}];else u.application_permissions=[{application:n,permission:i,apply_to_application:d,resources:a,operation:o}];t.push(u)}async function Co(e,t){let r=await(t.mapUserToScim?.(e)??oa(e));return{...r,id:r.id??e.id}}async function To(e,t){let r=await(t.mapCustomerToScim?.(e)??na(e));return{...r,id:r.id??e.id}}async function Po(e,t){let r=await(t.mapWorkloadToScim?.(e)??sa(e));return{...r,id:r.id??e.id}}function vt(e,t,r){let{schemas:n,id:o,displayName:s,userName:i,active:c,emails:u,groups:a,meta:d,...g}=e,m=ht(o)??ht(e.externalId)??ht(i)??"principal";return Ce({name:ht(s)??ht(i)??m,unique_id:m,identities:t==="customer"?void 0:ya(e),groups:t==="user"&&Array.isArray(a)?a.map((C)=>typeof C==="string"?C:pe(C,"value")).filter((C)=>Boolean(C)):void 0,is_active:typeof c==="boolean"?c:void 0,created_at:d&&typeof d==="object"?pe(d,"created"):void 0,custom_properties:Ce({...g,ecid:t==="customer"?void 0:Io(e),accountClass:wa(e),externalId:e.externalId,userName:i,emails:u,identity_type:t==="user"?void 0:t}),tags:[],operation:r})}function ya(e){let t=Io(e),r=e.emails,n=Array.isArray(r)?r.map((s)=>s&&typeof s==="object"?pe(s,"value"):void 0).filter((s)=>Boolean(s)):[],o=[...t?[t]:[],...n];return o.length>0?o:void 0}function Io(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return ht(e.ecid)??(t&&typeof t==="object"?pe(t,"ecid"):void 0)}function wa(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return t&&typeof t==="object"?pe(t,"accountClass"):void 0}function ho(e,t){return{name:e,unique_id:e,custom_properties:{identity_type:t},operation:"delete"}}function at(e,t){let r=ha(e),n=pe(e,"id")??pe(e,"name")??pe(e,"displayName"),o=pe(e,"displayName")??pe(e,"name")??n??"group",s=cr(e,"resources");return Ce({name:o,unique_id:n,custom_properties:Ce({requestable:r?.requestable??Aa(e,"requestable"),description:r?.description??pe(e,"description"),type:r?.type,resources:s.length>0?s:void 0}),tags:[],operation:t})}function ha(e){let t=e[ta];if(!t||typeof t!=="object"||Array.isArray(t))return;return t}function cr(e,t){if(!e||typeof e!=="object")return[];let r=e[t];if(!Array.isArray(r))return[];return r.map(Re).filter((n)=>n.length>0)}function va(e){return pe(e,"id")??pe(e,"name")??pe(e,"displayName")??"group"}function dr(e,t,r){let n=cr(e,"resources"),o=n.length>0,s=!o,i=o?n:[],c=cr(e,"roles").map((a)=>({application:t,role:a,apply_to_application:s,resources:i,operation:r})),u=cr(e,"permissions").map((a)=>({application:t,permission:a,apply_to_application:s,resources:i,operation:r}));if(c.length===0&&u.length===0)return;return{identity:va(e),identity_type:"local_group",role_assignments:c.length>0?c:void 0,application_permissions:u.length>0?u:void 0,operation:r}}function ct(e,t){return Ce({name:e.name,unique_id:e.id,permissions:e.permissions?.map((r)=>typeof r==="string"?r:r.id),custom_properties:Ce({displayName:e.displayName,requestable:e.requestable,...e.metadata}),tags:[],operation:t})}function St(e,t,r){return Ce({name:e.name,unique_id:e.id,permission_type:t?.(e)??e.permissionTypes??[e.action??"Uncategorized"],apply_to_sub_resources:e.applyToSubResources,resource_types:e.resourceTypes,operation:r})}function lr(e,t,r,n=new Set){let o=e.id;if(o&&n.has(o))return Ce({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,custom_properties:Ce({...e.metadata}),tags:[],operation:t});if(o)n.add(o);let s=[];for(let i of e.resources??[]){let c=typeof i==="string"?r?.get(i):i;if(c)s.push(lr(c,t,r,n))}if(o)n.delete(o);return Ce({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,sub_resources:s.length>0?s:void 0,custom_properties:Ce({...e.metadata}),tags:[],operation:t})}function Oo(e,t){if(e.length===0)return[];let r=new Map;for(let u of e)if(u.id)r.set(u.id,u);let n=new Map,o=new Set,s=(u,a)=>{if(!a.id||a.id===u)return;let d=n.get(u)??[];if(!d.some((g)=>g.id===a.id))d.push(a);n.set(u,d),o.add(a.id)};for(let u of e){for(let d of u.resources??[]){let g=typeof d==="string"?r.get(d):d;if(g&&u.id)s(u.id,g)}let a=Re(u.parent);if(a&&r.has(a)&&u.id)s(a,u)}let i=(u)=>{if(!u.id)return u;let a=n.get(u.id);if(!a||a.length===0)return u;return{...u,resources:a.map(i)}};return e.filter((u)=>!u.id||!o.has(u.id)).map(i).map((u)=>lr(u,t,r))}async function Sa(e,t,r){if(!t)return[lr(e,"modify")];let n=async(d)=>{if(t.cache)return await t.cache.getNode("resource",d);return t.resources?.get(d)},o=async(d)=>{if(t.resources?.children&&d.id&&(!d.resources||d.resources.length===0))return t.resources.children(d.id);let g=[];for(let m of d.resources??[]){let C=typeof m==="string"?await n(m):m;if(C)g.push(C)}return g},s=e,i=new Set;while(!0){let d=Re(s.parent);if(!d||i.has(d))break;i.add(d);let g=await n(d);if(!g)break;s=g}let c=[],u=[s],a=new Set;while(u.length>0){let d=u.shift();if(!d)break;if(d.id&&a.has(d.id))continue;if(d.id)a.add(d.id);let g=r.mapResource?r.mapResource(d):d;c.push(g);for(let m of await o(d))u.push(m)}if(e.id&&!a.has(e.id))c.push(r.mapResource?r.mapResource(e):e);return Oo(c,"modify")}async function vo(e,t,r,n){let o=JSON.stringify(Ce(r)),s=n?.compression??t.compression??"gzip",i=s==="gzip"?await Ia(o):o,c=Ea(i),u=n?.maxPayloadBytes??t.maxPayloadBytes??ko,a=n?.multipart??t.multipart??"auto",d=n?.multipartThresholdBytes??t.multipartThresholdBytes??ca;if(c>u&&a==="never")throw new $e("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(a==="always"||a==="auto"&&c>d)return ba(e,t,i,s,n);return ka(t,{id:t.datasourceId,data_source_id:t.datasourceId,json_data:i,compression_type:s==="gzip"?"GZIP":"NONE"})}async function ka(e,t){let r=`${Lo(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:push`,n=await fr(r,{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${e.apiKey??""}`,"content-type":"application/json"},body:JSON.stringify(t)});return Ao(n)}async function ba(e,t,r,n,o){let s=o?.partSizeBytes??t.partSizeBytes??ua,i=await Ra(t,n),c=Oa(r,s);for(let a=0;a<c.length;a++)await Ca(t,i,a+1,c[a]??"");let u=await Ta(t,i,c.length);return e.debug("OAA multipart payload pushed",{uploadId:i,parts:c.length}),{...u,uploadId:u.uploadId??i,parts:u.parts??c.length}}async function Ra(e,t){let r=Gr(e,"multipart/start"),n=await fr(r,{method:"POST",headers:Jr(e),body:JSON.stringify({data_source_id:e.datasourceId,compression_type:t==="gzip"?"GZIP":"NONE"})}),o=await Hr(n),s=pe(o,"upload_id")??pe(o,"uploadId")??pe(o,"id");if(!s)throw new $e("OAA multipart start response did not include an upload id",{code:"invalid_response"});return s}async function Ca(e,t,r,n){let o=Gr(e,`multipart/${encodeURIComponent(t)}/parts/${r}`);await fr(o,{method:"PUT",headers:Jr(e),body:JSON.stringify({upload_id:t,sequence:r,data:n})})}async function Ta(e,t,r){let n=Gr(e,`multipart/${encodeURIComponent(t)}/complete`),o=await fr(n,{method:"POST",headers:Jr(e),body:JSON.stringify({upload_id:t,parts:r})});return Ao(o)}function Gr(e,t){return`${Lo(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:${t}`}function Jr(e){return{accept:"application/json",authorization:`Bearer ${e.apiKey??""}`,"content-type":"application/json"}}async function fr(e,t){let r;for(let n=0;n<Dr;n++){try{let o=await fetch(e,t);if(!Eo(o.status)||n===Dr-1){if(!o.ok)await Pa(o);return o}r=new $e(`OAA request failed with retryable status ${o.status}`,{retryable:!0,status:o.status})}catch(o){if(r=o,o instanceof $e&&!o.retryable)throw o;if(n===Dr-1)break}await La(da*2**n)}throw new $e("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:r})}function Eo(e){return e===429||e>=500}async function Pa(e){let t=await Hr(e).catch(()=>{return}),r=pe(t,"message")??pe(t,"error")??`OAA request failed with status ${e.status}`;throw new $e(r,{code:pe(t,"code")??"http_error",status:e.status,retryable:Eo(e.status),warnings:_o(t?.warnings)})}async function Ao(e){let t=await Hr(e).catch(()=>{return});return{success:e.ok,syncToken:pe(t,"sync_token")??pe(t,"syncToken"),uploadId:pe(t,"upload_id")??pe(t,"uploadId"),parts:_a(t,"parts"),warnings:_o(t?.warnings),metadata:t}}async function Hr(e){let t=await e.text();if(!t)return{};let r=JSON.parse(t);return r&&typeof r==="object"&&!Array.isArray(r)?r:{}}async function Ia(e){let t=new Blob([e]).stream().pipeThrough(new CompressionStream("gzip")),r=await new Response(t).arrayBuffer();return Buffer.from(r).toString("base64")}function Oa(e,t){let r=[];for(let n=0;n<e.length;n+=t)r.push(e.slice(n,n+t));return r}function Ea(e){return Buffer.byteLength(e,"utf8")}function pe(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="string"&&r.length>0?r:void 0}function ht(e){return typeof e==="string"&&e.length>0?e:void 0}function Aa(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="boolean"?r:void 0}function _a(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="number"?r:void 0}function _o(e){if(!Array.isArray(e))return;let t=e.filter((r)=>typeof r==="string");return t.length>0?t:void 0}async function*et(e){if(!e)return;for await(let t of e)yield t}function Ce(e){if(Array.isArray(e))return e.map(Ce).filter((r)=>r!==void 0);if(!e||typeof e!=="object"||e instanceof Date)return e===null?void 0:e;let t=Object.entries(e).map(([r,n])=>[r,Ce(n)]).filter(([,r])=>{if(r===void 0)return!1;if(Array.isArray(r)&&r.length===0)return!1;if(r&&typeof r==="object"&&!Array.isArray(r)&&Object.keys(r).length===0)return!1;return!0});return t.length>0?Object.fromEntries(t):void 0}function Lo(e){return e.replace(/\/+$/,"")}function tt(e){return e.applicationName??So}function Yr(e,t){if(t==="user")return e?.users?.population??"all";if(t==="customer")return e?.customers?.population??"access";return e?.workloads?.population??"access"}async function zr(e,t,r,n){if(Yr(e,t)==="all")return!0;if(!n||!r)return!1;return(await n.listBySubject(r,t,{start:0,limit:1})).items.length>0}function La(e){return new Promise((t)=>setTimeout(t,e))}function jo(e,t){if(!t)return"app";if(e==="user")return t.users.assignment;if(e==="workload")return t.workloads.assignment;return t.customers.assignment}function $o(e,t=()=>{return},r=()=>{return},n=()=>({})){let o,s=!1,i,c,u=bo(e,()=>o?.oaa,()=>({mapPermissionTypes:o?.mapPermissionTypes,mapGroup:o?.mapGroup,mapRole:o?.mapRole,mapResource:o?.mapResource}),n,()=>o?.accessStore,()=>xa(o),()=>{let R=o?.catalogStore;return R||i?{catalog:R,code:i,resources:o?.resources,cache:c}:void 0}),a=(R)=>{if(R.op!=="set"||!R.previous)return!1;if(!(R.previous.providerId!==R.entity.providerId||R.previous.requestUrl!==R.entity.requestUrl))return!1;let{providerId:G,requestUrl:H,...v}=R.previous,{providerId:U,requestUrl:I,...x}=R.entity;return Ma(v,x)},d=(R)=>{if(s)return;let{kind:M}=R;if(u.isReady())(R.op==="delete"?M==="role"?u.deleteRole(R.entity.id):M==="permission"?u.deletePermission(R.entity.id):u.deleteGroup(R.entity.id):M==="role"?u.pushRole(R.entity):M==="permission"?u.pushPermission(R.entity):u.pushGroup(R.entity)).catch((U)=>{e.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:R.op,kind:M,error:U})});let G=t();if(!G?.isReady())return;if(R.op==="set"&&R.entity.requestable!==!0){if(R.previous?.requestable===!0)G.onEntitlementDelete(M,R.previous.id).catch((v)=>{e.warn("IAM delta removal of a no-longer-requestable entitlement failed",{"ion.operation":"iam.delta.delete","ion.outcome":"degraded",id:R.entity.id,kind:M,error:v instanceof Error?v.message:String(v)})});return}(R.op==="delete"?G.onEntitlementDelete(M,R.entity.id):G.onEntitlementUpsert(R.entity,M)).catch((v)=>{e.warn("IAM delta projection from catalog change failed; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:R.op,kind:M,error:v instanceof Error?v.message:String(v)})})},g=(R)=>{if(s)return;let M=o?.resources;if(!M)return;if(u.isReady())(async()=>{if(R.deleted){await u.deleteResource(R.id);return}let H=await M.get(R.id);if(!H)return;await u.pushResource(H)})().catch((H)=>{e.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:R.id,deleted:R.deleted===!0,error:H})})},m,C,P,E,O=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),b=!1,T=()=>{let R=o?.accessIndex;if(!R&&!b)b=!0,e.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return R},l=async(R)=>{let M=o?.accessIndex,G=o?.catalogStore;if(!M||!G&&!i)return!1;let H=R.id??Xr(R),v=await Wo({...R,id:H},{catalog:G,code:i,resources:o?.resources,cache:c});return await M.materialize(H,v),!0},k=(R,M)=>Va(R,M,{accessStore:o?.accessStore,accessIndex:o?.accessIndex,catalogStore:o?.catalogStore,code:i,resources:o?.resources},c),W=async()=>{let R=o?.catalogStore;if(!R)return;await Wa(i,R)},F=async()=>{let R={subjects:0,roots:0,cleared:0};if(s)return R;await W();let M=o?.accessIndex,G=o?.catalogStore;if(!M||!G&&!i)return R;let H=new Map,v=(x)=>{let N=nt(x.subject);if(!N)return;let w=x.subjectType;H.set(`${w}:${N}`,{subject:N,subjectType:w})},U=new Set,I=o?.accessStore;if(I)for await(let x of Qr((N,w)=>I.list({start:N,limit:w}))){v({subject:nt(x.subject),subjectType:x.subjectType});let N=nt(x.target);if(c&&N&&typeof x.target==="string"){if(!await c.getNode(x.targetType,N))U.add(`${x.targetType}:${N}`)}}if(U.size>0)e.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog or catalog store). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...U].sort()});if(M.listSubjects)for(let x of await M.listSubjects())v(x);for(let x of H.values()){let N=await k(x.subject,x.subjectType);if(R.subjects+=1,R.roots+=N,N===0)R.cleared+=1}return R},Q=()=>{if(s)return Promise.resolve({subjects:0,roots:0,cleared:0});return F()},ce=Promise.resolve(),se=!1,Z=(R,M)=>{let G=ce.then(async()=>{if(s)return;try{await M()}catch(H){e.warn(`${R} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:R,error:H instanceof Error?H.message:String(H)})}});return ce=G,G},ee=(R)=>{if(se)return;se=!0,Z(R,async()=>{se=!1,await F()})},ue=()=>ce,z=(R)=>{if(s)return;let M=o?.accessStore;if(!o?.accessIndex||!o?.catalogStore||!M)return;if(c?.invalidate(R),R.op==="set"){let G=R.kind,H=R.entity.id;Z("catalog-change",async()=>{for await(let v of Qr((U,I)=>M.listByTarget(G,H,{start:U,limit:I})))await l(v)})}else ee("catalog-delete")},J=(R)=>{if(s)return;if(c?.clear(),!o?.accessIndex||!o?.catalogStore&&!i||!o?.accessStore)return;ee("resource-change")},B={oaa:u,entitlements:{async list(R){let M=Mo(i,o?.catalogStore),G=Math.max(0,R?.start??0),H=R?.limit;if(!M)return xo(0,[],G,H);let v=[];for(let I of[M.groups,M.roles,M.permissions])for await(let x of Qr((N,w)=>I.list({start:N,limit:w,filter:R?.filter})))v.push(x);let U=H==null?void 0:G+H;return xo(v.length,v.slice(G,U),G,H)}},get accessIndex(){return o?.accessIndex},has(R,M,G,H,v){let U=T();return U?U.has(R,M,G,H,v):Promise.resolve(O())},hasGroup(R,M,G,H){let v=T();return v?v.hasGroup(R,M,G,H):Promise.resolve(O())},hasRole(R,M,G,H){let v=T();return v?v.hasRole(R,M,G,H):Promise.resolve(O())},hasPermission(R,M,G,H){let v=T();return v?v.hasPermission(R,M,G,H):Promise.resolve(O())},hasAny(R,M,G){let H=T();return H?H.hasAny(R,M,G):Promise.resolve(O())},hasAll(R,M,G){let H=T();return H?H.hasAll(R,M,G):Promise.resolve(O())},reconcile(){return Q()},async grant(R){Zr(R.subjectType);let M=nt(R.target),G=jo(R.subjectType,r());if(G!=="app")throw new Uo(G==="iam-request"?`Cannot grant ${R.targetType} "${M}" to a "${R.subjectType}" principal: RemoteConfig assignment policy is "iam-request". Use ion.authz.requestAccess.`:`Cannot grant ${R.targetType} "${M}" to a "${R.subjectType}" principal: RemoteConfig assignment policy is "${G}".`,G,await ae(R));await re(R),await Na(o?.catalogStore,i,R,c);let H={...R,status:R.status??"active"};H.id=Xr(H);let v=o?.accessStore;if(!v)throw Error("Cannot grant: no AccessAssignmentStore is wired.");if(await v.grant(H),o?.accessIndex&&(o.catalogStore||i)){let U=await Wo(H,{catalog:o.catalogStore,code:i,resources:o.resources,cache:c});await o.accessIndex.materialize(H.id,U)}return await ne(H,"grant"),H},async requestAccess(R){Zr(R.subjectType);let M=jo(R.subjectType,r());if(M!=="iam-request")throw new Uo(`Cannot request access for a "${R.subjectType}" principal: RemoteConfig assignment policy is "${M}" (use ion.authz.grant when policy is "app").`,M);let G=t();if(!G)throw Error("Cannot submit an access request: the IAM module is not configured.");let H=nt(R.subject),v=nt(R.target);return G.requestAccess({subject:H,subjectType:R.subjectType,targetType:R.targetType,target:v,justification:R.justification})},async revoke(R){Zr(R.subjectType);let M={...R,id:R.id??Xr(R)},G=o?.accessStore;if(!G)throw Error("Cannot revoke: no AccessAssignmentStore is wired.");await G.revoke(M),await o?.accessIndex?.removeByRoot(M.id),await ne(M,"revoke")}},ae=async(R)=>{let M=nt(R.target),G=Mo(i,o?.catalogStore);if(G){let H=R.targetType==="role"?await G.roles.get(M):R.targetType==="permission"?await G.permissions.get(M):await G.groups.get(M);if(H?.requestUrl)return H.requestUrl}return(await t()?.getDestinationRef("group",M))?.requestUrl},re=async(R)=>{let M=ja(i,nt(R.target));if(!M)return;if(M.kind!==R.targetType)throw Error(`Cannot grant ${R.targetType} "${M.entity.id}": code declares that id as ${M.kind}.`);if(!o?.catalogStore)throw Error(`Cannot grant code entitlement "${M.entity.id}": no AccessCatalogStore is wired for materialization.`);await $a(M.kind,M.entity,Ua(o.catalogStore,M.kind))},ne=async(R,M)=>{if(u.isReady())try{if(M==="grant")await u.grant(R);else await u.revoke(R)}catch(H){e.warn("OAA incremental access push failed after ion.authz mutation; full sync will reconcile",{"ion.operation":"authz.oaa.push","ion.outcome":"degraded",op:M,error:H instanceof Error?H.message:String(H)})}let G=t();if(!G?.isReady())return;try{if(M==="grant")await G.onGrant(R);else await G.onRevoke(R)}catch(H){e.warn("IAM delta projection failed after ion.authz mutation; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:M,error:H instanceof Error?H.message:String(H)})}};return{update(R){if(s)return B;let M=R?.catalog?qa(R.catalog):void 0,G=M!==i;i=M,o=R,u.refreshReadiness();let H=R?.catalogStore,v=R?.resources;if(H!==m||v!==P||G)C?.(),E?.(),c=H||i?new Ka(H,v,i):void 0,C=H?.afterChange?H.afterChange((U)=>{if(a(U))return;d(U),z(U)}):void 0,E=v?.changed?v.changed((U)=>{J(U),g(U)}):void 0,m=H,P=v;else if(c)c.clear();return B},settle:ue,close(){if(s)return;s=!0,C?.(),C=void 0,E?.(),E=void 0,m=void 0,P=void 0,c=void 0}}}function qo(e){return e.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+|_+$/g,"")||"EMPTY"}function Fa(e){let t=`${e.clientId}\x00${e.path}`,r=2166136261;for(let n=0;n<t.length;n+=1)r^=t.charCodeAt(n),r=Math.imul(r,16777619);return(r>>>0).toString(36)}function Da(e){let t=qo(e.clientId),r=qo(e.path);return`LFV_${t}__${r}`}function en(e,t){let r=Da(t);if(!(r in e))return r;let n=`${r}_${Fa(t)}`;if(!(n in e))return n;return`${n}_ALT`}import{defaultLogger as zf}from"@ionite/core";import{defaultLogger as tc,stableConfigHash as rc}from"@ionite/core";import{verifyLfvSignature as Bo}from"@ionite/core/server";import{DEFAULT_SECRET_MIME_TYPES as kt}from"@ionite/core";var za=new Set(["jsonc","env","text","binary","yaml","toml","xml"]);function Ba(e){let t=e.split(";",1)[0]?.trim().toLowerCase()??"";if(t===kt.binary)return"binary";if(t===kt.env)return"env";if(t===kt.yaml||t.endsWith("+yaml"))return"yaml";if(t===kt.toml||t.endsWith("+toml"))return"toml";if(t===kt.xml||t.endsWith("+xml"))return"xml";if(t===kt.jsonc||t.endsWith("+json"))return"jsonc";return"text"}function pr(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let t=e,r=typeof t.mimeType==="string"?t.mimeType:typeof t.mime_type==="string"?t.mime_type:void 0;if(!r)return;let n=t.format,o=typeof n==="string"&&za.has(n)?n:Ba(r),s=typeof t.schemaUrl==="string"?t.schemaUrl:typeof t.schema_url==="string"?t.schema_url:void 0,i=typeof t.typeId==="string"?t.typeId:typeof t.type_id==="string"?t.type_id:void 0;return{format:o,mimeType:r,...s?{schemaUrl:s}:{},...i?{typeId:i}:{}}}function ut(e){if(!e)return;let t=e.custom_metadata,r=t&&typeof t==="object"&&!Array.isArray(t)?t:void 0;return pr(e.content_type??e.contentType??r?.content_type)}function mr(e){return{format:e.format,mime_type:e.mimeType,...e.schemaUrl?{schema_url:e.schemaUrl}:{},...e.typeId?{type_id:e.typeId}:{}}}var bt=new Map;function Ga(e){if(!e)return"/";return e.startsWith("/")?e:`/${e}`}function Ja(e){try{let t=new URL(e),r=t.pathname.replace(/\/+$/g,"");return`${t.origin}${r}`}catch{return e.replace(/\/+$/g,"")}}function gr(e){let t=Ja(e.lfvServerUrl),r=Ga(e.path);return`${t}|${r}`}function No(e,t,r){let n=bt.get(e)??new Map;return n.set(t,r),bt.set(e,n),()=>{let o=bt.get(e);if(!o)return;if(o.delete(t),o.size===0)bt.delete(e)}}async function Ko(e,t,r,n){let o=bt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onDelivery)continue;if(await c.onDelivery(t)){s+=1;break}}return s}async function Vo(e,t,r,n){let o=bt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onEvents)continue;s+=1,await c.onEvents(t)}return s}import{defaultSecretContentType as Ha,parseJsonc as Ya,SecretContentTypeMismatchError as Xa}from"@ionite/core";function Fo(e){let t={},r=e.replace(/\r\n?/g,`
+import{configTrustedClientGrants as cl,deepEqualPlain as ul,defaultLogger as Qn,ION_ENDPOINT_PERMISSIONS as Ai,listGenerator as Wt,stableConfigHash as Ri,toCodeCatalog as _i,unionCatalogRead as dl}from"@ionite/core";import{ciam as ll,configureJwksCache as fl,iam as pl,resolveCacheConfig as ml,sso as gl}from"@ionite/core/server";import{trimTrailingSlash as wo}from"@ionite/core";import{list as Xi,matchesListFilter as Zi}from"@ionite/core";class or{constructor(){this.customers=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.customers.get(e)}async lookup(e){if(e.id){let t=this.customers.get(e.id);if(t)return t}if(e.userName){let t=this.userNameIndex.get(e.userName.toLowerCase());if(t)return this.customers.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.customers.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n={...e,id:t,createdAt:this.customers.get(t)?.createdAt??e.createdAt??r,updatedAt:r},o=this.customers.get(t);if(o){if(o.userName&&o.userName.toLowerCase()!==n.userName?.toLowerCase())this.userNameIndex.delete(o.userName.toLowerCase());if(o.externalId&&o.externalId!==n.externalId)this.externalIdIndex.delete(o.externalId)}if(this.customers.set(t,n),n.userName)this.userNameIndex.set(n.userName.toLowerCase(),t);if(n.externalId)this.externalIdIndex.set(n.externalId,t);return n}async delete(e){let t=this.customers.get(e);if(t?.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.customers.delete(e),t?1:0}async list(e){let t=Array.from(this.customers.values()).filter((c)=>Zi(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return Xi(o,i,r,n)}}class sr{constructor(){this.magicLinks=new Map}async create(e,t,r){if(this.magicLinks.has(e))throw Error(`Magic link with token ${e} already exists`);let n={token:e,customer:t,createdAt:new Date,expiresAt:r};this.magicLinks.set(e,n)}async get(e){let t=this.magicLinks.get(e);if(!t)return null;if(Date.now()>t.expiresAt.getTime())return this.magicLinks.delete(e),null;return t}async getAndDelete(e){let t=this.magicLinks.get(e);if(this.magicLinks.delete(e),!t)return null;if(Date.now()>t.expiresAt.getTime())return null;return t}async delete(e){this.magicLinks.delete(e)}}function Qi(e){let t=e.expiresAt;if(!t)return;let r=t instanceof Date?t.getTime():new Date(t).getTime();return Number.isNaN(r)?void 0:r}class ir{constructor(){this.sessions=new Map}async create(e){if(this.sessions.has(e.sid))throw Error(`Session with sid ${e.sid} already exists`);this.sessions.set(e.sid,e)}async get(e){let t=this.sessions.get(e);if(!t)return null;let r=Qi(t);if(r!==void 0&&Date.now()>r)return this.sessions.delete(e),null;return t}async update(e,t){let r=this.sessions.get(e);if(!r)throw Error(`Session with sid ${e} not found`);let n={...r,...t};this.sessions.set(e,n)}async delete(e){this.sessions.delete(e)}}import{list as ea,StoreConflictError as ta}from"@ionite/core";class ar{constructor(){this.users=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.users.get(e)}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.users.get(t):void 0}async lookup(e){return this.users.get(e.id??"")}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r={...e,id:t},n=this.users.get(t),o=r.externalId?this.externalIdIndex.get(r.externalId):void 0;if(o&&o!==t)throw new ta(`externalId "${r.externalId}" is already in use`,"unique_violation","externalId");if(n){if(n.userName&&n.userName.toLowerCase()!==r.userName?.toLowerCase())this.userNameIndex.delete(n.userName.toLowerCase());if(n.externalId&&n.externalId!==r.externalId)this.externalIdIndex.delete(n.externalId)}if(this.users.set(t,r),r.userName)this.userNameIndex.set(r.userName.toLowerCase(),t);if(r.externalId)this.externalIdIndex.set(r.externalId,t);return r}async delete(e){let t=this.users.get(e);if(t){if(t.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t.externalId)this.externalIdIndex.delete(t.externalId)}return this.users.delete(e),t?1:0}async list(e){let t=Array.from(this.users.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return ea(o,i,r,n)}}class it{constructor(){this.tokens=new Map}async set(e){this.tokens.set(e.workload_id,e)}async get(e){let t=this.tokens.get(e);if(!t)return null;if(Date.now()>t.expires_at.getTime())return this.tokens.delete(e),null;return t}async delete(e){this.tokens.delete(e)}async isValid(e){return await this.get(e)!==null}async cleanup(){let e=Date.now();for(let[t,r]of this.tokens.entries())if(e>r.expires_at.getTime())this.tokens.delete(t)}}function Fe(e){let t=wo(e||Dr);return{readyzUrl:`${t}/readyz`,capabilitiezUrl:`${t}/capabilitiez`,sso:{loginUrl:`${t}/auth/login`,userUrl:`${t}/auth/user`,logoutUrl:`${t}/auth/logout`,logoutBackChannelUrl:`${t}/auth/logout/backchannel`,refreshUrl:`${t}/auth/refresh`,callbackUrl:`${t}/auth/callback`},workload:{validateUrl:`${t}/workload/validate`,jwksUrl:`${t}/workload/jwks`},iam:{basePath:`${t}/iam`,usersUrl:`${t}/iam/Users`,groupsUrl:`${t}/iam/Groups`,workloadsUrl:`${t}/iam/Workloads`,customersUrl:`${t}/iam/Customers`},ciam:{magicLinkUrl:`${t}/magic-link`,magicLinkLoginUrl:`${t}/magic-link/login`,customerUrl:`${t}/auth/customer`,customerLoginUrl:`${t}/auth/customer/login`,customerCallbackUrl:`${t}/auth/customer/callback`,customerProvidersUrl:`${t}/auth/customer/providers`,logoutUrl:`${t}/auth/customer/logout`}}}function ho(e){return`${wo(e||Dr)}/authz/oaa/sync`}function ra(e,t){if(e===null)return null;let r={validateUrl:t.validateUrl,jwksUrl:t.jwksUrl};if(e&&typeof e==="object"&&(("incoming"in e)||("outgoing"in e))){let n=e;return{...n,incoming:{...n.incoming,...r}}}return{...e??{},...r}}function vo(e,t,r,n){let o={...t},s=Fe(n);if(o.sso!==null)if(e.sso)o.sso={...o.sso,loginUrl:s.sso.loginUrl,userUrl:s.sso.userUrl,logoutUrl:s.sso.logoutUrl,logoutBackChannelUrl:s.sso.logoutBackChannelUrl,refreshUrl:s.sso.refreshUrl,redirectUri:s.sso.callbackUrl,sessionStore:r.sessionStore??o.sso?.sessionStore,userStore:r.userStore??o.sso?.userStore,enableJitUserProvisioning:o.sso?.enableJitUserProvisioning??!0};else o.sso=void 0;if(o.iam!==null)if(e.iam)o.iam={...o.iam,usersUrl:s.iam.usersUrl,groupsUrl:s.iam.groupsUrl,workloadsUrl:s.iam.workloadsUrl,customersUrl:s.iam.customersUrl,userStore:r.userStore??o.iam?.userStore,workloadIdentityStore:r.workloadIdentityStore??o.iam?.workloadIdentityStore,customerStore:r.customerStore??o.iam?.customerStore};else o.iam=void 0;if(o.workload!==null){if(e.workload||o.workload)o.workload=ra(o.workload,s.workload)}if(o.ciam!==null)if(e.ciam)o.ciam={...o.ciam,magicLinkUrl:s.ciam.magicLinkUrl,magicLinkLoginUrl:s.ciam.magicLinkLoginUrl,customerUrl:s.ciam.customerUrl,customerLoginUrl:s.ciam.customerLoginUrl,customerCallbackUrl:s.ciam.customerCallbackUrl,customerProvidersUrl:s.ciam.customerProvidersUrl,logoutUrl:s.ciam.logoutUrl,providers:e.ciam.providers,sessionStore:r.sessionStore??o.ciam?.sessionStore,customerStore:r.customerStore??o.ciam?.customerStore,magicLinkStore:r.magicLinkStore??o.ciam?.magicLinkStore,enableJitUserProvisioning:o.ciam?.enableJitUserProvisioning??!0};else o.ciam=void 0;return o}function qt(e,t){let r={...e};if(r.sso)r.sso={...r.sso,sessionStore:t.sessionStore??r.sso.sessionStore,userStore:t.userStore??r.sso.userStore};if(r.iam)r.iam={...r.iam,userStore:t.userStore??r.iam.userStore};if(r.workload){let n=r.workload;r.workload={...r.workload,tokenStore:t.workloadTokenStore??n.tokenStore,workloadIdentityStore:t.workloadIdentityStore??n.workloadIdentityStore}}if(r.ciam)r.ciam={...r.ciam,sessionStore:t.sessionStore??r.ciam.sessionStore,customerStore:t.customerStore??r.ciam.customerStore,magicLinkStore:t.magicLinkStore??r.ciam.magicLinkStore};if(r.authz!==null&&(t.accessStore||t.accessIndex||t.catalog||t.catalogStore||t.resources))r.authz={...r.authz,accessStore:t.accessStore,accessIndex:t.accessIndex,catalog:t.catalog,catalogStore:t.catalogStore,resources:t.resources};return r}var Dr="/api/ionite";function cr(e){return{...e}}function na(){return{sessionStore:new ir,userStore:new ar,customerStore:new or,magicLinkStore:new sr,workloadTokenStore:new it}}function yo(e,t){return`${e} is enabled by RemoteConfig but is not served: missing ${t.join(", ")}. Provide durable stores in ionite({ stores }) (e.g. @ionite/redis or app-owned SQL stores), or opt into stores: devInMemoryStores() for prototypes only (state is lost on restart).`}function zr(e){let t={};if(e.sso&&!e.sso.sessionStore)t.sso=yo("SSO",["stores.sessionStore"]);if(e.ciam){let r=[];if(!e.ciam.sessionStore)r.push("stores.sessionStore");if(!e.ciam.customerStore)r.push("stores.customerStore");if(r.length>0)t.ciam=yo("CIAM",r)}return t}function ur(){return Dr}import{AssignmentPolicyError as jo,accessRefId as nt,accessRootId as en,assertRequiredSubjectType as tn,catalogEntityStore as ja,configTrustedClientGrants as $a,deepEqualPlain as qa,deprecateRetiredCodeCatalogRows as Na,getCodeCatalogEntity as Ka,list as $o,listGenerator as rn,materializeCodeCatalogEntity as Va,toCodeCatalog as Fa,unionCatalogRead as qo}from"@ionite/core";import{assertSubjectTypeAssignable as Da,CatalogAdjacencyCache as za,expandRoot as No,reconcileSubjectAccess as Ba}from"@ionite/core/server";import{accessRefId as Re,accessRootId as oa,customAttributes as Nt,DEFAULT_RISK_LEVEL as Hr,ION_AUTHZ_GROUP_SCHEMA as sa,ION_SCIM_USER_EXTENSION_URN as So,KNOWN_ENTITLEMENT_KEYS as Kt,mergeCodeCatalogEntity as ia}from"@ionite/core";import{baseCustomerToScim as aa,baseUserToScimUser as ca,baseWorkloadToScim as ua,collectReferencedDefinitions as da}from"@ionite/core/server";function ye(e,t,r=(n)=>Error(`${e} ready timed out after ${n}ms`)){let n=!1,o,s,i=()=>{n=!1,s=new Promise((a)=>{o=a})};i();let c=()=>{n=!0,o?.(),o=void 0},u=()=>{if(t()){if(!n)c();return}if(n)i()};return u(),{isReady:()=>t(),ready:(a)=>{if(t())return Promise.resolve();let d=s;if(!a||a<=0)return d;return new Promise((g,m)=>{let C=setTimeout(()=>m(r(a)),a);d.then(()=>{clearTimeout(C),g()},(P)=>{clearTimeout(C),m(P)})})},refresh:u,settle:c}}var Co="App",la="ionite",To=104857600,fa=To,pa=10485760,Br=3,ma=250,ga={};function rt(e,t){return t.mapGroup?t.mapGroup(e):e}class $e extends Error{constructor(e,t={}){super(e,{cause:t.cause});this.name="OaaError",this.retryable=t.retryable??!1,this.code=t.code,this.status=t.status,this.warnings=t.warnings,Object.setPrototypeOf(this,$e.prototype)}}function ya(e){let t=e();return Boolean(t?.url&&t.providerId&&t.datasourceId)}function Po(e,t,r,n=()=>({}),o=()=>{return},s,i){let c=async(a)=>{await Ro(e,Se(t),a,{mode:"incremental"})},u=ye("OAA",()=>ya(t),(a)=>new $e(`OAA ready timed out after ${a}ms`,{code:"not_ready"}));return{isReady:u.isReady,ready:u.ready,refreshReadiness:u.refresh,population(a){return Qr(t(),a)},async pushUser(a){let d=Se(t);if(!await Gr(d,"user",Re(a),o()))return;let g=await Oo(a,n());await c(be(d,{local_users:[vt(g,"user","modify")]},!0))},async pushCustomer(a){let d=Se(t);if(!await Gr(d,"customer",Re(a),o()))return;let g=await Eo(a,n());await c(be(d,{local_users:[vt(g,"customer","modify")]},!0))},async pushWorkload(a){let d=Se(t);if(!await Gr(d,"workload",Re(a),o()))return;let g=await Ao(a,n());await c(be(d,{local_users:[vt(g,"workload","modify")]},!0))},async pushGroup(a){let d=Se(t),g=r(),m=rt(a,g),C=fr(m,tt(d),"add"),P=await Jr(m,"group",i?.(),g,d);await c(be(d,Vt({local_groups:[at(m,"modify")],identity_to_permissions:C?[C]:[]},P),!0))},async pushRole(a){let d=Se(t),g=r(),m=g.mapRole?g.mapRole(a):a,C=await Jr(m,"role",i?.(),g,d);await c(be(d,Vt({local_roles:[ct(m,"modify")]},C),!0))},async pushPermission(a){let d=Se(t);await c(be(d,{permissions:[St(a,r().mapPermissionTypes,"modify")]},!0))},async pushResource(a){let d=Se(t),g=r(),m=g.mapResource?g.mapResource(a):a,C=await Ca(m,i?.(),g);await c(be(d,{resources:C},!0))},async grant(a){let d=Se(t),g=r(),m=await Io(a,i?.(),g,d);await c(ko(d,a,"add",g,m))},async revoke(a){let d=Se(t);await c(ko(d,a,"delete",r()))},async pushAccessChanges(a){if(a.length===0)return;let d=Se(t),g=r(),m=i?.(),C=await ha(d,a,g,m);await c(C)},async deleteUser(a){let d=Se(t);await c(be(d,{local_users:[{name:a,unique_id:a,operation:"delete"}]},!0))},async deleteCustomer(a){let d=Se(t);await c(be(d,{local_users:[bo(a,"customer")]},!0))},async deleteWorkload(a){let d=Se(t);await c(be(d,{local_users:[bo(a,"workload")]},!0))},async deleteGroup(a){let d=Se(t);await c(be(d,{local_groups:[{name:a,unique_id:a,operation:"delete"}]},!0))},async deleteRole(a){let d=Se(t);await c(be(d,{local_roles:[{name:a,unique_id:a,operation:"delete"}]},!0))},async deletePermission(a){let d=Se(t);await c(be(d,{permissions:[{name:a,unique_id:a,permission_type:[],operation:"delete"}]},!0))},async deleteResource(a){let d=Se(t);await c(be(d,{resources:[{name:a,id:a,resource_type:"",operation:"delete"}]},!0))},async sync(a,d){let g=Se(t),m=d?.mode==="incremental",C=m?void 0:s?.(),P=await wa(g,a,r(),n(),m,C);return Ro(e,g,P,d)}}}function Se(e){let t=e();if(!t?.url||!t.providerId||!t.datasourceId)throw new $e("OAA is not configured",{code:"not_configured"});return t}async function wa(e,t,r,n,o,s){let i=[],c=[],u=[],a=[],d=[],g=[],m=o?"modify":void 0,C=new Set,P=[],E=new Set,O=(l)=>oa(l);for await(let l of et(t.access))P.push(l),E.add(`${l.subjectType}:${Re(l.subject)}`);let k=(l,b)=>Qr(e,l)==="all"||Boolean(b&&E.has(`${l}:${b}`));for await(let l of et(t.users))if(k("user",Re(l)))i.push(vt(await Oo(l,n),"user",m));for await(let l of et(t.customers))if(k("customer",Re(l)))i.push(vt(await Eo(l,n),"customer",m));for await(let l of et(t.workloads))if(k("workload",Re(l)))i.push(vt(await Ao(l,n),"workload",m));for await(let l of et(t.groups)){let b=rt(l,r);c.push(at(b,m));let W=fr(b,tt(e),o?"add":void 0);if(W)g.push(W)}for await(let l of et(t.roles)){let b=r.mapRole?r.mapRole(l):l;d.push(ct(b,m))}for await(let l of et(t.permissions))a.push(St(l,r.mapPermissionTypes,m));let T=[];for await(let l of et(t.resources)){let b=r.mapResource?r.mapResource(l):l;T.push(b)}u.push(...Lo(T,m));for(let l of P)if(C.add(O(l)),lr(l,g,i,tt(e),o?"add":void 0),typeof l.target!=="string")if(l.targetType==="role"){let b=r.mapRole?r.mapRole(l.target):l.target;d.push(ct(b,m))}else if(l.targetType==="permission")a.push(St(l.target,r.mapPermissionTypes,m));else{let b=rt(l.target,r);c.push(at(b,m))}for(let l of s??[]){let b=O(l);if(C.has(b))continue;C.add(b);let W=Re(l.subject);if(W&&!i.some((F)=>Re(F.unique_id??F.name)===W))i.push({name:W,unique_id:W,is_active:!0,operation:m,custom_properties:{identity_type:"workload",source:"eci-trusted"}});lr(l,g,i,tt(e),m)}return be(e,{local_users:i,local_groups:c,local_roles:d,resources:u,permissions:a,identity_to_permissions:g},o)}function be(e,t,r){let n={name:e.applicationName??Co,application_type:e.applicationType??la,local_users:t.local_users??[],local_groups:t.local_groups??[],local_roles:t.local_roles??[],resources:t.resources??[],custom_properties:{},tags:[]};if(r)n.operation="modify";return Ce({applications:[n],permissions:t.permissions??[],identity_to_permissions:t.identity_to_permissions??[],is_incremental:r?!0:void 0})}function ko(e,t,r,n=ga,o){let s=[],i=[],c=[],u=[],a=[];lr(t,s,i,tt(e),r);let d=r==="delete"?"delete":"modify";if(typeof t.target!=="string")if(t.targetType==="role"){let m=n.mapRole?n.mapRole(t.target):t.target;u.push(ct(m,d))}else if(t.targetType==="permission")a.push(St(t.target,n.mapPermissionTypes,d));else{let m=rt(t.target,n);c.push(at(m,d))}let g={local_users:i,local_groups:c,local_roles:u,permissions:a,identity_to_permissions:s};return be(e,o?Vt(g,o):g,!0)}async function ha(e,t,r,n){let o=tt(e),s=[],i=[],c=[],u=[],a=[],d=[],g=[],m=[];for(let{change:P,op:E}of t){lr(P,E==="delete"?u:i,E==="delete"?c:s,o,E==="delete"?"delete":"add");let l=E==="delete"?"delete":"modify";if(typeof P.target!=="string")if(P.targetType==="role"){let b=r.mapRole?r.mapRole(P.target):P.target;d.push(ct(b,l))}else if(P.targetType==="permission")g.push(St(P.target,r.mapPermissionTypes,l));else{let b=rt(P.target,r);a.push(at(b,l))}if(E==="add")m.push(await Io(P,n,r,e))}let C={local_users:[...s,...c],local_groups:a,local_roles:d,permissions:g,identity_to_permissions:[...i,...u]};return be(e,Vt(C,...m),!0)}function Vt(...e){let t={},r=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let n of e)for(let o of r){let s=n[o];if(s&&s.length>0)t[o]=[...t[o]??[],...s]}return t}async function Jr(e,t,r,n,o){if(!r)return{};let s=await da(e,t,{catalog:r.catalog,code:r.code,resources:r.resources,cache:r.cache}),i=[];for(let c of s.groups){let u=rt(c,n),a=fr(u,tt(o),"add");if(a)i.push(a)}return{local_groups:s.groups.map((c)=>at(rt(c,n),"modify")),local_roles:s.roles.map((c)=>ct(n.mapRole?n.mapRole(c):c,"modify")),permissions:s.permissions.map((c)=>St(c,n.mapPermissionTypes,"modify")),resources:s.resources.map((c)=>pr(n.mapResource?n.mapResource(c):c,"modify")),identity_to_permissions:i}}async function Io(e,t,r,n){if(!t)return{};if(e.targetType!=="group"&&e.targetType!=="role")return{};let o=Re(e.target);if(!o)return{};let s=typeof e.target==="string"?await va(e.targetType,o,t):e.target;if(!s)return{};let i={};if(typeof e.target==="string")if(e.targetType==="group"){let u=rt(s,r),a=fr(u,tt(n),"add");i={local_groups:[at(u,"modify")],identity_to_permissions:a?[a]:[]}}else{let u=r.mapRole?r.mapRole(s):s;i={local_roles:[ct(u,"modify")]}}let c=await Jr(s,e.targetType,t,r,n);return Vt(i,c)}async function va(e,t,r){if(r.cache)return await r.cache.getNode(e,t);let n=e==="group"?r.code?.groups.get(t):r.code?.roles.get(t),s=await(e==="group"?r.catalog?.groups:r.catalog?.roles)?.get(t);return s&&n?ia(e,n,s):s??n}function lr(e,t,r,n,o){let s=Re(e.subject),i=Re(e.target),c=r.find((g)=>Re(g.unique_id??g.name)===s);if(e.subjectType!=="user")if(c)c.custom_properties={...c.custom_properties,identity_type:e.subjectType};else c={name:s,unique_id:s,custom_properties:{identity_type:e.subjectType},operation:o},r.push(c);if(e.targetType==="group"){if(c){let g=new Set(c.groups??[]);if(g.add(i),c.groups=[...g],o)c.operation=o}else r.push({name:s,unique_id:s,groups:[i],operation:o});return}let u={identity:s,identity_type:"local_user",operation:o},a=e.resources??[],d=e.applyToApplication??a.length===0;if(e.targetType==="role")u.role_assignments=[{application:n,role:i,apply_to_application:d,resources:a,operation:o}];else u.application_permissions=[{application:n,permission:i,apply_to_application:d,resources:a,operation:o}];t.push(u)}async function Oo(e,t){let r=await(t.mapUserToScim?.(e)??ca(e));return{...r,id:r.id??e.id}}async function Eo(e,t){let r=await(t.mapCustomerToScim?.(e)??aa(e));return{...r,id:r.id??e.id}}async function Ao(e,t){let r=await(t.mapWorkloadToScim?.(e)??ua(e));return{...r,id:r.id??e.id}}function vt(e,t,r){let{schemas:n,id:o,displayName:s,userName:i,active:c,emails:u,groups:a,meta:d,attributes:g,...m}=e,C=m[So];delete m[So];let P=C&&typeof C==="object"?C.attributes:void 0,E=t==="user"?P:g,O=ht(o)??ht(e.externalId)??ht(i)??"principal";return Ce({name:ht(s)??ht(i)??O,unique_id:O,identities:t==="customer"?void 0:Sa(e),groups:t==="user"&&Array.isArray(a)?a.map((k)=>typeof k==="string"?k:pe(k,"value")).filter((k)=>Boolean(k)):void 0,is_active:typeof c==="boolean"?c:void 0,created_at:d&&typeof d==="object"?pe(d,"created"):void 0,custom_properties:Ce({...m,...E&&typeof E==="object"?E:{},ecid:t==="customer"?void 0:_o(e),accountClass:ka(e),externalId:e.externalId,userName:i,emails:u,identity_type:t==="user"?void 0:t}),tags:[],operation:r})}function Sa(e){let t=_o(e),r=e.emails,n=Array.isArray(r)?r.map((s)=>s&&typeof s==="object"?pe(s,"value"):void 0).filter((s)=>Boolean(s)):[],o=[...t?[t]:[],...n];return o.length>0?o:void 0}function _o(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return ht(e.ecid)??(t&&typeof t==="object"?pe(t,"ecid"):void 0)}function ka(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return t&&typeof t==="object"?pe(t,"accountClass"):void 0}function bo(e,t){return{name:e,unique_id:e,custom_properties:{identity_type:t},operation:"delete"}}function at(e,t){let r=ba(e),n=pe(e,"id")??pe(e,"name")??pe(e,"displayName"),o=pe(e,"displayName")??pe(e,"name")??n??"group",s=dr(e,"resources");return Ce({name:o,unique_id:n,custom_properties:Ce({...r?.attributes??Nt(e,Kt),requestable:r?.requestable??xa(e,"requestable"),description:r?.description??pe(e,"description"),type:r?.type,resources:s.length>0?s:void 0,riskLevel:r?.riskLevel??pe(e,"riskLevel")??Hr}),tags:[],operation:t})}function ba(e){let t=e[sa];if(!t||typeof t!=="object"||Array.isArray(t))return;return t}function dr(e,t){if(!e||typeof e!=="object")return[];let r=e[t];if(!Array.isArray(r))return[];return r.map(Re).filter((n)=>n.length>0)}function Ra(e){return pe(e,"id")??pe(e,"name")??pe(e,"displayName")??"group"}function fr(e,t,r){let n=dr(e,"resources"),o=n.length>0,s=!o,i=o?n:[],c=dr(e,"roles").map((a)=>({application:t,role:a,apply_to_application:s,resources:i,operation:r})),u=dr(e,"permissions").map((a)=>({application:t,permission:a,apply_to_application:s,resources:i,operation:r}));if(c.length===0&&u.length===0)return;return{identity:Ra(e),identity_type:"local_group",role_assignments:c.length>0?c:void 0,application_permissions:u.length>0?u:void 0,operation:r}}function ct(e,t){return Ce({name:e.name,unique_id:e.id,permissions:e.permissions?.map((r)=>typeof r==="string"?r:r.id),custom_properties:Ce({...Nt(e,Kt),displayName:e.displayName,requestable:e.requestable,riskLevel:e.riskLevel??Hr}),tags:[],operation:t})}function St(e,t,r){return Ce({name:e.name,unique_id:e.id,permission_type:t?.(e)??e.permissionTypes??[e.action??"Uncategorized"],apply_to_sub_resources:e.applyToSubResources,resource_types:e.resourceTypes,custom_properties:{...Nt(e,Kt),riskLevel:e.riskLevel??Hr},operation:r})}function pr(e,t,r,n=new Set){let o=e.id;if(o&&n.has(o))return Ce({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,custom_properties:Ce({...Nt(e,Kt)}),tags:[],operation:t});if(o)n.add(o);let s=[];for(let i of e.resources??[]){let c=typeof i==="string"?r?.get(i):i;if(c)s.push(pr(c,t,r,n))}if(o)n.delete(o);return Ce({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,sub_resources:s.length>0?s:void 0,custom_properties:Ce({...Nt(e,Kt)}),tags:[],operation:t})}function Lo(e,t){if(e.length===0)return[];let r=new Map;for(let u of e)if(u.id)r.set(u.id,u);let n=new Map,o=new Set,s=(u,a)=>{if(!a.id||a.id===u)return;let d=n.get(u)??[];if(!d.some((g)=>g.id===a.id))d.push(a);n.set(u,d),o.add(a.id)};for(let u of e){for(let d of u.resources??[]){let g=typeof d==="string"?r.get(d):d;if(g&&u.id)s(u.id,g)}let a=Re(u.parent);if(a&&r.has(a)&&u.id)s(a,u)}let i=(u)=>{if(!u.id)return u;let a=n.get(u.id);if(!a||a.length===0)return u;return{...u,resources:a.map(i)}};return e.filter((u)=>!u.id||!o.has(u.id)).map(i).map((u)=>pr(u,t,r))}async function Ca(e,t,r){if(!t)return[pr(e,"modify")];let n=async(d)=>{if(t.cache)return await t.cache.getNode("resource",d);return t.resources?.get(d)},o=async(d)=>{if(t.resources?.children&&d.id&&(!d.resources||d.resources.length===0))return t.resources.children(d.id);let g=[];for(let m of d.resources??[]){let C=typeof m==="string"?await n(m):m;if(C)g.push(C)}return g},s=e,i=new Set;while(!0){let d=Re(s.parent);if(!d||i.has(d))break;i.add(d);let g=await n(d);if(!g)break;s=g}let c=[],u=[s],a=new Set;while(u.length>0){let d=u.shift();if(!d)break;if(d.id&&a.has(d.id))continue;if(d.id)a.add(d.id);let g=r.mapResource?r.mapResource(d):d;c.push(g);for(let m of await o(d))u.push(m)}if(e.id&&!a.has(e.id))c.push(r.mapResource?r.mapResource(e):e);return Lo(c,"modify")}async function Ro(e,t,r,n){let o=JSON.stringify(Ce(r)),s=n?.compression??t.compression??"gzip",i=s==="gzip"?await _a(o):o,c=Ua(i),u=n?.maxPayloadBytes??t.maxPayloadBytes??To,a=n?.multipart??t.multipart??"auto",d=n?.multipartThresholdBytes??t.multipartThresholdBytes??fa;if(c>u&&a==="never")throw new $e("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(a==="always"||a==="auto"&&c>d)return Pa(e,t,i,s,n);return Ta(t,{id:t.datasourceId,data_source_id:t.datasourceId,json_data:i,compression_type:s==="gzip"?"GZIP":"NONE"})}async function Ta(e,t){let r=`${Wo(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:push`,n=await mr(r,{method:"POST",headers:{accept:"application/json",authorization:`Bearer ${e.apiKey??""}`,"content-type":"application/json"},body:JSON.stringify(t)});return xo(n)}async function Pa(e,t,r,n,o){let s=o?.partSizeBytes??t.partSizeBytes??pa,i=await Ia(t,n),c=La(r,s);for(let a=0;a<c.length;a++)await Oa(t,i,a+1,c[a]??"");let u=await Ea(t,i,c.length);return e.debug("OAA multipart payload pushed",{uploadId:i,parts:c.length}),{...u,uploadId:u.uploadId??i,parts:u.parts??c.length}}async function Ia(e,t){let r=Yr(e,"multipart/start"),n=await mr(r,{method:"POST",headers:Xr(e),body:JSON.stringify({data_source_id:e.datasourceId,compression_type:t==="gzip"?"GZIP":"NONE"})}),o=await Zr(n),s=pe(o,"upload_id")??pe(o,"uploadId")??pe(o,"id");if(!s)throw new $e("OAA multipart start response did not include an upload id",{code:"invalid_response"});return s}async function Oa(e,t,r,n){let o=Yr(e,`multipart/${encodeURIComponent(t)}/parts/${r}`);await mr(o,{method:"PUT",headers:Xr(e),body:JSON.stringify({upload_id:t,sequence:r,data:n})})}async function Ea(e,t,r){let n=Yr(e,`multipart/${encodeURIComponent(t)}/complete`),o=await mr(n,{method:"POST",headers:Xr(e),body:JSON.stringify({upload_id:t,parts:r})});return xo(o)}function Yr(e,t){return`${Wo(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:${t}`}function Xr(e){return{accept:"application/json",authorization:`Bearer ${e.apiKey??""}`,"content-type":"application/json"}}async function mr(e,t){let r;for(let n=0;n<Br;n++){try{let o=await fetch(e,t);if(!Uo(o.status)||n===Br-1){if(!o.ok)await Aa(o);return o}r=new $e(`OAA request failed with retryable status ${o.status}`,{retryable:!0,status:o.status})}catch(o){if(r=o,o instanceof $e&&!o.retryable)throw o;if(n===Br-1)break}await Wa(ma*2**n)}throw new $e("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:r})}function Uo(e){return e===429||e>=500}async function Aa(e){let t=await Zr(e).catch(()=>{return}),r=pe(t,"message")??pe(t,"error")??`OAA request failed with status ${e.status}`;throw new $e(r,{code:pe(t,"code")??"http_error",status:e.status,retryable:Uo(e.status),warnings:Mo(t?.warnings)})}async function xo(e){let t=await Zr(e).catch(()=>{return});return{success:e.ok,syncToken:pe(t,"sync_token")??pe(t,"syncToken"),uploadId:pe(t,"upload_id")??pe(t,"uploadId"),parts:Ma(t,"parts"),warnings:Mo(t?.warnings),metadata:t}}async function Zr(e){let t=await e.text();if(!t)return{};let r=JSON.parse(t);return r&&typeof r==="object"&&!Array.isArray(r)?r:{}}async function _a(e){let t=new Blob([e]).stream().pipeThrough(new CompressionStream("gzip")),r=await new Response(t).arrayBuffer();return Buffer.from(r).toString("base64")}function La(e,t){let r=[];for(let n=0;n<e.length;n+=t)r.push(e.slice(n,n+t));return r}function Ua(e){return Buffer.byteLength(e,"utf8")}function pe(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="string"&&r.length>0?r:void 0}function ht(e){return typeof e==="string"&&e.length>0?e:void 0}function xa(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="boolean"?r:void 0}function Ma(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="number"?r:void 0}function Mo(e){if(!Array.isArray(e))return;let t=e.filter((r)=>typeof r==="string");return t.length>0?t:void 0}async function*et(e){if(!e)return;for await(let t of e)yield t}function Ce(e){if(Array.isArray(e))return e.map(Ce).filter((r)=>r!==void 0);if(!e||typeof e!=="object"||e instanceof Date)return e===null?void 0:e;let t=Object.entries(e).map(([r,n])=>[r,Ce(n)]).filter(([,r])=>{if(r===void 0)return!1;if(Array.isArray(r)&&r.length===0)return!1;if(r&&typeof r==="object"&&!Array.isArray(r)&&Object.keys(r).length===0)return!1;return!0});return t.length>0?Object.fromEntries(t):void 0}function Wo(e){return e.replace(/\/+$/,"")}function tt(e){return e.applicationName??Co}function Qr(e,t){if(t==="user")return e?.users?.population??"all";if(t==="customer")return e?.customers?.population??"access";return e?.workloads?.population??"access"}async function Gr(e,t,r,n){if(Qr(e,t)==="all")return!0;if(!n||!r)return!1;return(await n.listBySubject(r,t,{start:0,limit:1})).items.length>0}function Wa(e){return new Promise((t)=>setTimeout(t,e))}function Ko(e,t){if(!t)return"app";if(e==="user")return t.users.assignment;if(e==="workload")return t.workloads.assignment;return t.customers.assignment}function Vo(e,t=()=>{return},r=()=>{return},n=()=>({})){let o,s=!1,i,c,u=Po(e,()=>o?.oaa,()=>({mapPermissionTypes:o?.mapPermissionTypes,mapGroup:o?.mapGroup,mapRole:o?.mapRole,mapResource:o?.mapResource}),n,()=>o?.accessStore,()=>$a(o),()=>{let R=o?.catalogStore;return R||i?{catalog:R,code:i,resources:o?.resources,cache:c}:void 0}),a=(R)=>{if(R.op!=="set"||!R.previous)return!1;if(!(R.previous.providerId!==R.entity.providerId||R.previous.requestUrl!==R.entity.requestUrl))return!1;let{providerId:G,requestUrl:H,...v}=R.previous,{providerId:U,requestUrl:I,...x}=R.entity;return qa(v,x)},d=(R)=>{if(s)return;let{kind:M}=R;if(u.isReady())(R.op==="delete"?M==="role"?u.deleteRole(R.entity.id):M==="permission"?u.deletePermission(R.entity.id):u.deleteGroup(R.entity.id):M==="role"?u.pushRole(R.entity):M==="permission"?u.pushPermission(R.entity):u.pushGroup(R.entity)).catch((U)=>{e.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:R.op,kind:M,error:U})});let G=t();if(!G?.isReady())return;if(R.op==="set"&&R.entity.requestable!==!0){if(R.previous?.requestable===!0)G.onEntitlementDelete(M,R.previous.id).catch((v)=>{e.warn("IAM delta removal of a no-longer-requestable entitlement failed",{"ion.operation":"iam.delta.delete","ion.outcome":"degraded",id:R.entity.id,kind:M,error:v instanceof Error?v.message:String(v)})});return}(R.op==="delete"?G.onEntitlementDelete(M,R.entity.id):G.onEntitlementUpsert(R.entity,M)).catch((v)=>{e.warn("IAM delta projection from catalog change failed; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:R.op,kind:M,error:v instanceof Error?v.message:String(v)})})},g=(R)=>{if(s)return;let M=o?.resources;if(!M)return;if(u.isReady())(async()=>{if(R.deleted){await u.deleteResource(R.id);return}let H=await M.get(R.id);if(!H)return;await u.pushResource(H)})().catch((H)=>{e.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:R.id,deleted:R.deleted===!0,error:H})})},m,C,P,E,O=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),k=!1,T=()=>{let R=o?.accessIndex;if(!R&&!k)k=!0,e.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return R},l=async(R)=>{let M=o?.accessIndex,G=o?.catalogStore;if(!M||!G&&!i)return!1;let H=R.id??en(R),v=await No({...R,id:H},{catalog:G,code:i,resources:o?.resources,cache:c});return await M.materialize(H,v),!0},b=(R,M)=>Ba(R,M,{accessStore:o?.accessStore,accessIndex:o?.accessIndex,catalogStore:o?.catalogStore,code:i,resources:o?.resources},c),W=async()=>{let R=o?.catalogStore;if(!R)return;await Na(i,R)},F=async()=>{let R={subjects:0,roots:0,cleared:0};if(s)return R;await W();let M=o?.accessIndex,G=o?.catalogStore;if(!M||!G&&!i)return R;let H=new Map,v=(x)=>{let q=nt(x.subject);if(!q)return;let w=x.subjectType;H.set(`${w}:${q}`,{subject:q,subjectType:w})},U=new Set,I=o?.accessStore;if(I)for await(let x of rn((q,w)=>I.list({start:q,limit:w}))){v({subject:nt(x.subject),subjectType:x.subjectType});let q=nt(x.target);if(c&&q&&typeof x.target==="string"){if(!await c.getNode(x.targetType,q))U.add(`${x.targetType}:${q}`)}}if(U.size>0)e.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog or catalog store). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...U].sort()});if(M.listSubjects)for(let x of await M.listSubjects())v(x);for(let x of H.values()){let q=await b(x.subject,x.subjectType);if(R.subjects+=1,R.roots+=q,q===0)R.cleared+=1}return R},Q=()=>{if(s)return Promise.resolve({subjects:0,roots:0,cleared:0});return F()},ce=Promise.resolve(),se=!1,Z=(R,M)=>{let G=ce.then(async()=>{if(s)return;try{await M()}catch(H){e.warn(`${R} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:R,error:H instanceof Error?H.message:String(H)})}});return ce=G,G},ee=(R)=>{if(se)return;se=!0,Z(R,async()=>{se=!1,await F()})},ue=()=>ce,z=(R)=>{if(s)return;let M=o?.accessStore;if(!o?.accessIndex||!o?.catalogStore||!M)return;if(c?.invalidate(R),R.op==="set"){let G=R.kind,H=R.entity.id;Z("catalog-change",async()=>{for await(let v of rn((U,I)=>M.listByTarget(G,H,{start:U,limit:I})))await l(v)})}else ee("catalog-delete")},J=(R)=>{if(s)return;if(c?.clear(),!o?.accessIndex||!o?.catalogStore&&!i||!o?.accessStore)return;ee("resource-change")},B={oaa:u,entitlements:{async list(R){let M=qo(i,o?.catalogStore),G=Math.max(0,R?.start??0),H=R?.limit;if(!M)return $o(0,[],G,H);let v=[];for(let I of[M.groups,M.roles,M.permissions])for await(let x of rn((q,w)=>I.list({start:q,limit:w,filter:R?.filter})))v.push(x);let U=H==null?void 0:G+H;return $o(v.length,v.slice(G,U),G,H)}},get accessIndex(){return o?.accessIndex},has(R,M,G,H,v){let U=T();return U?U.has(R,M,G,H,v):Promise.resolve(O())},hasGroup(R,M,G,H){let v=T();return v?v.hasGroup(R,M,G,H):Promise.resolve(O())},hasRole(R,M,G,H){let v=T();return v?v.hasRole(R,M,G,H):Promise.resolve(O())},hasPermission(R,M,G,H){let v=T();return v?v.hasPermission(R,M,G,H):Promise.resolve(O())},hasAny(R,M,G){let H=T();return H?H.hasAny(R,M,G):Promise.resolve(O())},hasAll(R,M,G){let H=T();return H?H.hasAll(R,M,G):Promise.resolve(O())},reconcile(){return Q()},async grant(R){tn(R.subjectType);let M=nt(R.target),G=Ko(R.subjectType,r());if(G!=="app")throw new jo(G==="iam-request"?`Cannot grant ${R.targetType} "${M}" to a "${R.subjectType}" principal: RemoteConfig assignment policy is "iam-request". Use ion.authz.requestAccess.`:`Cannot grant ${R.targetType} "${M}" to a "${R.subjectType}" principal: RemoteConfig assignment policy is "${G}".`,G,await ae(R));await re(R),await Da(o?.catalogStore,i,R,c);let H={...R,status:R.status??"active"};H.id=en(H);let v=o?.accessStore;if(!v)throw Error("Cannot grant: no AccessAssignmentStore is wired.");if(await v.grant(H),o?.accessIndex&&(o.catalogStore||i)){let U=await No(H,{catalog:o.catalogStore,code:i,resources:o.resources,cache:c});await o.accessIndex.materialize(H.id,U)}return await ne(H,"grant"),H},async requestAccess(R){tn(R.subjectType);let M=Ko(R.subjectType,r());if(M!=="iam-request")throw new jo(`Cannot request access for a "${R.subjectType}" principal: RemoteConfig assignment policy is "${M}" (use ion.authz.grant when policy is "app").`,M);let G=t();if(!G)throw Error("Cannot submit an access request: the IAM module is not configured.");let H=nt(R.subject),v=nt(R.target);return G.requestAccess({subject:H,subjectType:R.subjectType,targetType:R.targetType,target:v,justification:R.justification})},async revoke(R){tn(R.subjectType);let M={...R,id:R.id??en(R)},G=o?.accessStore;if(!G)throw Error("Cannot revoke: no AccessAssignmentStore is wired.");await G.revoke(M),await o?.accessIndex?.removeByRoot(M.id),await ne(M,"revoke")}},ae=async(R)=>{let M=nt(R.target),G=qo(i,o?.catalogStore);if(G){let H=R.targetType==="role"?await G.roles.get(M):R.targetType==="permission"?await G.permissions.get(M):await G.groups.get(M);if(H?.requestUrl)return H.requestUrl}return(await t()?.getDestinationRef("group",M))?.requestUrl},re=async(R)=>{let M=Ka(i,nt(R.target));if(!M)return;if(M.kind!==R.targetType)throw Error(`Cannot grant ${R.targetType} "${M.entity.id}": code declares that id as ${M.kind}.`);if(!o?.catalogStore)throw Error(`Cannot grant code entitlement "${M.entity.id}": no AccessCatalogStore is wired for materialization.`);await Va(M.kind,M.entity,ja(o.catalogStore,M.kind))},ne=async(R,M)=>{if(u.isReady())try{if(M==="grant")await u.grant(R);else await u.revoke(R)}catch(H){e.warn("OAA incremental access push failed after ion.authz mutation; full sync will reconcile",{"ion.operation":"authz.oaa.push","ion.outcome":"degraded",op:M,error:H instanceof Error?H.message:String(H)})}let G=t();if(!G?.isReady())return;try{if(M==="grant")await G.onGrant(R);else await G.onRevoke(R)}catch(H){e.warn("IAM delta projection failed after ion.authz mutation; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:M,error:H instanceof Error?H.message:String(H)})}};return{update(R){if(s)return B;let M=R?.catalog?Fa(R.catalog):void 0,G=M!==i;i=M,o=R,u.refreshReadiness();let H=R?.catalogStore,v=R?.resources;if(H!==m||v!==P||G)C?.(),E?.(),c=H||i?new za(H,v,i):void 0,C=H?.afterChange?H.afterChange((U)=>{if(a(U))return;d(U),z(U)}):void 0,E=v?.changed?v.changed((U)=>{J(U),g(U)}):void 0,m=H,P=v;else if(c)c.clear();return B},settle:ue,close(){if(s)return;s=!0,C?.(),C=void 0,E?.(),E=void 0,m=void 0,P=void 0,c=void 0}}}function Fo(e){return e.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+|_+$/g,"")||"EMPTY"}function Ga(e){let t=`${e.clientId}\x00${e.path}`,r=2166136261;for(let n=0;n<t.length;n+=1)r^=t.charCodeAt(n),r=Math.imul(r,16777619);return(r>>>0).toString(36)}function Ja(e){let t=Fo(e.clientId),r=Fo(e.path);return`LFV_${t}__${r}`}function nn(e,t){let r=Ja(t);if(!(r in e))return r;let n=`${r}_${Ga(t)}`;if(!(n in e))return n;return`${n}_ALT`}import{defaultLogger as Hf}from"@ionite/core";import{defaultLogger as sc,stableConfigHash as ic}from"@ionite/core";import{verifyLfvSignature as Yo}from"@ionite/core/server";import{DEFAULT_SECRET_MIME_TYPES as kt}from"@ionite/core";var Ha=new Set(["jsonc","env","text","binary","yaml","toml","xml"]);function Ya(e){let t=e.split(";",1)[0]?.trim().toLowerCase()??"";if(t===kt.binary)return"binary";if(t===kt.env)return"env";if(t===kt.yaml||t.endsWith("+yaml"))return"yaml";if(t===kt.toml||t.endsWith("+toml"))return"toml";if(t===kt.xml||t.endsWith("+xml"))return"xml";if(t===kt.jsonc||t.endsWith("+json"))return"jsonc";return"text"}function gr(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let t=e,r=typeof t.mimeType==="string"?t.mimeType:typeof t.mime_type==="string"?t.mime_type:void 0;if(!r)return;let n=t.format,o=typeof n==="string"&&Ha.has(n)?n:Ya(r),s=typeof t.schemaUrl==="string"?t.schemaUrl:typeof t.schema_url==="string"?t.schema_url:void 0,i=typeof t.typeId==="string"?t.typeId:typeof t.type_id==="string"?t.type_id:void 0;return{format:o,mimeType:r,...s?{schemaUrl:s}:{},...i?{typeId:i}:{}}}function ut(e){if(!e)return;let t=e.custom_metadata,r=t&&typeof t==="object"&&!Array.isArray(t)?t:void 0;return gr(e.content_type??e.contentType??r?.content_type)}function yr(e){return{format:e.format,mime_type:e.mimeType,...e.schemaUrl?{schema_url:e.schemaUrl}:{},...e.typeId?{type_id:e.typeId}:{}}}var bt=new Map;function Xa(e){if(!e)return"/";return e.startsWith("/")?e:`/${e}`}function Za(e){try{let t=new URL(e),r=t.pathname.replace(/\/+$/g,"");return`${t.origin}${r}`}catch{return e.replace(/\/+$/g,"")}}function wr(e){let t=Za(e.lfvServerUrl),r=Xa(e.path);return`${t}|${r}`}function Do(e,t,r){let n=bt.get(e)??new Map;return n.set(t,r),bt.set(e,n),()=>{let o=bt.get(e);if(!o)return;if(o.delete(t),o.size===0)bt.delete(e)}}async function zo(e,t,r,n){let o=bt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onDelivery)continue;if(await c.onDelivery(t)){s+=1;break}}return s}async function Bo(e,t,r,n){let o=bt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onEvents)continue;s+=1,await c.onEvents(t)}return s}import{defaultSecretContentType as Qa,parseJsonc as ec,SecretContentTypeMismatchError as tc}from"@ionite/core";function Go(e){let t={},r=e.replace(/\r\n?/g,`
 `).split(`
 `);for(let n=0;n<r.length;n+=1){let s=(r[n]??"").trim();if(!s||s.startsWith("#"))continue;let i=s.startsWith("export ")?s.slice(7).trimStart():s,c=i.indexOf("=");if(c<=0)throw Error(`Invalid env entry at line ${n+1}: expected KEY=value`);let u=i.slice(0,c).trim();if(!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(u))throw Error(`Invalid env key "${u}" at line ${n+1}`);let a=i.slice(c+1).trim();if(a.length>=2&&(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))){let d=a[0],g=a.slice(1,-1);t[u]=d==='"'?g.replace(/\\(n|r|t|"|\\)/g,(m,C)=>{if(C==="n")return`
-`;if(C==="r")return"\r";if(C==="t")return"\t";return C}):g}else t[u]=a}return t}function Do(e){return Object.entries(e).map(([t,r])=>{let n=String(r??"");if(!n||/[\s#"'\\]/.test(n))return`${t}=${JSON.stringify(n)}`;return`${t}=${n}`}).join(`
-`)}function zo(e){try{let t=atob(e);return Uint8Array.from(t,(r)=>r.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function wr(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("Secret content is not an object");return e}function Kt(e){return e.metadata.contentType??Ha()}function tn(e,t){if(t==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof e.data==="string")return e.data;if(t==="jsonc")return JSON.stringify(e.data,null,2);if(t==="env")return Do(wr(e.data));let r=wr(e.data).content;if(typeof r!=="string")throw Error(`Secret ${t} content must contain a string "content" field`);return r}function yr(e,t){if(t==="jsonc")return typeof e.data==="string"?Ya(e.data):e.data;if(t==="env")return typeof e.data==="string"?Fo(e.data):wr(e.data);if(t==="text")return tn(e,t);if(t==="binary"){let r=wr(e.data).content_base64;if(typeof r!=="string")throw Error('Binary secret content must contain a "content_base64" string');return zo(r)}throw Error(`Typed ${t} decoding is not supported yet; use text() or bytes()`)}function Za(e){return{format:e.format,mimeType:e.mimeType,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id}}function Qa(e,t){let r=Kt(e);if(r.format!==t.format||r.mimeType!==t.mimeType)throw new Xa(Za(t),r)}async function ec(e,t){if(!e.schema)return t;let r=await e.schema["~standard"].validate(t);if(r.issues){let n=r.issues.map((o)=>o.message).join("; ");throw Error(`Secret validation failed for type "${e.id}": ${n}`)}return r.value}function qe(e){return{async text(){let t=await e();return tn(t,Kt(t).format)},async json(){let t=await e(),r=Kt(t).format;if(r!=="jsonc")throw Error(`json() requires a jsonc secret; received ${r}`);return yr(t,r)},async bytes(){let t=await e(),r=Kt(t).format;if(r==="binary")return yr(t,r);return new TextEncoder().encode(tn(t,r))},async env(){let t=await e(),r=Kt(t).format;if(r!=="env")throw Error(`env() requires an env secret; received ${r}`);return yr(t,r)},async metadata(){return(await e()).metadata},async parse(t){let r=await e();return Qa(r,t),ec(t,yr(r,t.format))}}}function Go(e){try{return new URL(e).pathname}catch{return e.startsWith("/")?e:`/${e}`}}var nc=1e4,oc=1e4,sc=300,Jo=100;async function an(e){await new Promise((t)=>setTimeout(t,e))}function Ae(e){return{startedAt:Date.now(),timeout:typeof e?.timeout==="number"&&e.timeout>0?e.timeout:void 0}}function rn(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Ft(e){if(e.timeout===void 0)return;let t=Date.now()-e.startedAt;return Math.max(0,e.timeout-t)}function ze(e,t,r){return Error(`LFV ${e} timed out after ${r.timeout??0}ms for ${t}`)}async function Rt(e,t,r,n,o){let s=Ft(r);if(s!==void 0){if(s<=0)throw ze(n,o,r);let i=new AbortController,c=setTimeout(()=>i.abort(),s);try{return await fetch(e,{...t,signal:i.signal})}catch(u){if(u instanceof Error&&u.name==="AbortError")throw ze(n,o,r);throw u}finally{clearTimeout(c)}}return await fetch(e,t)}class Te extends Error{constructor(e){super(`LFV source closed while operating on ${e}`);this.name="LfvSourceClosedError"}}class De extends Error{constructor(e){super(e);this.name="LfvProtocolError"}}class dt extends De{constructor(e,t,r){super(`LFV ${t} failed (${e}) for ${r}`);this.status=e;if(this.name="LfvActionStatusError",e===404)this.code="not_found"}}var ic=new Set([400,401,403,404,409,410]);function Ho(e){return e instanceof De&&(!(e instanceof dt)||ic.has(e.status))}function hr(e){return e instanceof Te||e instanceof Error&&e.name==="LfvSourceClosedError"}function ac(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`LFV kms_park returned invalid payload for ${t}`);let r=e;if(typeof r.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${t}`);let n=r.disposition;if(n!==void 0&&n!=="cooldown"&&n!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${t}`);return{parked:r.parked,...r.stale===!0?{stale:!0}:{},...n?{disposition:n}:{}}}function Vt(e){try{let t=JSON.parse(e);return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:void 0}catch{return}}async function nn(e,t,r,n,o,s,i,c,u,a){let d=0,g=Date.now();for(;;){if(a?.())throw new Te(n);let m=Ft(r);if(m!==void 0&&m<=0)throw ze(o,n,r);try{return await e()}catch(C){if(C instanceof Te)throw C;if(a?.())throw new Te(n);if(d+=1,i>0&&Date.now()-g>=i){let E=`Error connecting to the LFV source. Retries: '${d}'`;if(c)c(u,E,{url:t,path:n,operation:o});g=Date.now()}let P=m===void 0?s:Math.min(s,m);if(P<=0)throw ze(o,n,r);if(await an(P),a?.())throw new Te(n)}}}function cc(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function on(e){if(typeof e==="number"&&Number.isFinite(e))return e;if(typeof e==="string"&&e.trim()){let t=Date.parse(e.trim());if(!Number.isNaN(t))return t}return}function Yo(e){return`[LFV] [${e??"-"}] [${new Date().toISOString()}]: `}function sn(e,t){if(typeof e!=="string"||e.trim()==="")throw Error(`LFV source requires "${t}"`);return e}function uc(e){return{...e,lfvServerUrl:sn(e.lfvServerUrl,"lfvServerUrl"),clientId:sn(e.clientId,"clientId"),path:sn(e.path,"path")}}function lt(e,t,r={}){let n=uc(e),o=n.log??tc,s=(y,L,q)=>{let V=Yo(y)+L;if(q!==void 0)o.debug(V,q);else o.debug(V)},i=(y,L,q)=>{let V=Yo(y)+L;if(q!==void 0)o.warn(V,q);else o.warn(V)},{lfvServerUrl:c,clientId:u,path:a,verifyJwks:d}=n,g=typeof n.deliveryTimeout==="number"&&n.deliveryTimeout>0?n.deliveryTimeout:void 0,m=typeof n.retryInterval==="number"&&n.retryInterval>0?n.retryInterval:nc,C=typeof n.warnInterval==="number"&&n.warnInterval>=0?n.warnInterval:oc,P=(typeof n.callbackMaxAgeSeconds==="number"&&n.callbackMaxAgeSeconds>0?n.callbackMaxAgeSeconds:sc)*1000,E=typeof n.cacheMaxAgeSeconds==="number"&&n.cacheMaxAgeSeconds>0?n.cacheMaxAgeSeconds*1000:void 0,O=d?.trim()?rc(d.trim()):void 0,b=Go(n.deliveryEndpoint),T=Go(n.eventsEndpoint),l=gr({lfvServerUrl:c,path:a}),k=crypto.randomUUID(),W=new Map,F=new Set,Q=new Map,ce=new Map,se=new Map,Z=new Map,ee=new Map,ue=new Map,z=new Map,J=(y,L)=>{if(typeof L==="number"&&Number.isInteger(L)&&L>=1){let q=z.get(y)??1,V=Math.max(q,L);return z.set(y,V),V}return z.get(y)},B=(y,L)=>typeof L==="number"&&Number.isInteger(L)&&L>=1&&L>(z.get(y)??1),ae=new Map,re=new Map,ne=!1,R,M=new Set,G=()=>ne;function H(y,L){Q.set(y,L),ce.set(y,Date.now())}function v(y){Q.delete(y),ce.delete(y)}function U(y){let L=Q.get(y);if(!L)return;if(E!==void 0){let q=ce.get(y)??0;if(Date.now()-q>E){s(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:y});return}}return L}function I(){return F.size>0||W.size>0||ue.size>0}function x(){if(ne){if(R)R(),R=void 0;return}let y=I();if(y&&!R)R=No(l,k,{trustId:O,onDelivery:async(L)=>ao(L).handled||await uo(L),onEvents:async(L)=>{lo(L)}});if(!y&&R)R(),R=void 0}async function N(y,L,q,V){if(!t)throw Error("LFV callback transport is not configured");for(;;){if(ne)throw new Te(L);if(V())throw new Te(L);let X=await t.take(y);if(X){if(X.key!==l)i(y,"parked OTP callback rejected: callback key mismatch");else if(!await Nr(X.rawBody,X.headers)){let fe=Vt(X.rawBody);if(fe?.type==="otp"&&fe.request_id===y&&typeof fe.otp==="string"&&fe.otp)return fe.otp}}let D=Ft(q);if(D!==void 0&&D<=0)throw ze("issueOtp",L,q);await an(D===void 0?Jo:Math.min(Jo,D))}}async function w(y,L){let q=L??crypto.randomUUID(),V={startedAt:Date.now(),timeout:g},X={request_id:q,path:y,action:"read_secret",...rn(J(y))},D=await nn(()=>Rt(`${c.replace(/\/+$/g,"")}/clients/${u}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":q},body:JSON.stringify(X)},V,"issueOtp",y),c,V,y,"issueOtp",m,C,i,q,G);if(D.status!==200&&D.status!==202)throw new dt(D.status,"issueOtp",y)}async function _(y,L){let q=re.get(y);if(q)return q;let V=w(y,L);re.set(y,V);try{await V}finally{if(re.get(y)===V)re.delete(y)}}async function h(y,L,q,V){if(ne)throw new Te(y);let X=q??crypto.randomUUID(),D=V??Ae(),ie=new Promise((Ee,$t)=>{let fo={resolve:Ee,reject:$t},Kr=Ft(D);if(Kr!==void 0){if(Kr<=0){$t(ze("issueOtp",y,D));return}fo.timer=setTimeout(()=>{ue.delete(X),x(),$t(ze("issueOtp",y,D))},Kr)}ue.set(X,fo),x()});ie.catch(()=>{});let fe=()=>{let Ee=ue.get(X);if(!Ee)return;if(Ee.timer)clearTimeout(Ee.timer);ue.delete(X),x()},de={request_id:X,path:y,action:L,...rn(J(y))};s(X,"OTP request",{path:y,action:L});let he;try{he=await nn(async()=>await Rt(`${c.replace(/\/+$/g,"")}/clients/${u}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":X},body:JSON.stringify(de)},D,"issueOtp",y),c,D,y,"issueOtp",m,C,i,X,G)}catch(Ee){throw fe(),Ee}if(he.status!==200&&he.status!==202)throw fe(),new dt(he.status,"issueOtp",y);let ke=!1,ve=t?N(X,y,D,()=>ke):void 0;if(ve)ve.catch(()=>{});try{let Ee=await(ve?Promise.race([ie,ve]):ie);return s(X,"OTP received via signed callback",{path:y,action:L}),Ee}finally{ke=!0,fe()}}async function p(y,L,q,V,X,D,ie){if(ne)throw new Te(L);let fe=ie??Ae(),de=await nn(async()=>await Rt(`${c.replace(/\/+$/g,"")}${y}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":X},body:JSON.stringify({request_id:X,otp:V,path:L,...rn(J(L)),...D??{}})},fe,q,L),c,fe,L,q,m,C,i,X,G);if(de.status!==200&&de.status!==202)throw new dt(de.status,q,L);return s(X,`${q} accepted`,{path:L,status:de.status}),de}async function f(y,L,q,V,X,D){if(ne)throw new Te(L);let ie=X??crypto.randomUUID(),fe=D??Ae(),de=await h(L,q,ie,fe),he=await p(y,L,q,de,ie,V,fe);return{requestId:ie,response:he}}async function S(y,L,q){if(ne)throw new Te(y);let V=B(y,q?.kmsSlots);if(J(y,q?.kmsSlots),V)v(y);let X=U(y);if(X)return X;let D=ae.get(y);if(D){if(!V)return D;if(await D.catch(()=>{return}),D=ae.get(y),D)return D}let ie=A(y,L,q);ae.set(y,ie),ie.catch((fe)=>{if(hr(fe))s(L,"read aborted: source closed",{path:y})});try{return await ie}finally{ae.delete(y)}}async function A(y,L,q){let V=q?.timeout??g,X={startedAt:Date.now(),timeout:typeof V==="number"&&V>0?V:void 0},D=L??crypto.randomUUID();s(D,"read_secret request",{path:y});let ie=0,fe=Date.now();for(;;){if(ne)throw new Te(y);try{let{response:de}=await f("/secrets/request",y,"read_secret",void 0,D,X),he=await j(D,de),ke=Y(y,he);return K(y,ke,ke.metadata.version),s(D,"read_secret completed from action response",{path:y}),ke}catch(de){if(de instanceof Te)throw de;if(Ho(de))throw de;let he=Ft(X);if(he!==void 0&&he<=0)throw ze("read_secret",y,X);if(ie+=1,C>0&&Date.now()-fe>=C)i(D,`read_secret retrying. Retries: '${ie}'`,{path:y}),fe=Date.now();let ke=he===void 0?m:Math.min(m,he);if(ke<=0)throw ze("read_secret",y,X);await an(ke)}}}async function j(y,L){if(!d?.trim())throw new De("LFV read_secret response verification is not configured");let q=L.headers.get("X-LFV-Request-Id")?.trim(),V=L.headers.get("X-LFV-Key-Id")?.trim(),X=L.headers.get("X-LFV-Signature")?.trim();if(!q||!V||!X)throw new De("LFV read_secret response is missing signature headers");if(q!==y)throw new De("LFV read_secret response request_id header does not match the request");let D=await L.text();if(!await Bo({jwks:d,kid:V,signatureB64Url:X,requestId:y,rawBody:D}))throw new De("LFV read_secret response signature verification failed");let fe=Vt(D);if(!fe||fe.request_id!==y)throw new De("LFV read_secret response request_id does not match the request");return fe}function Y(y,L){if(io(L)!==y||L.data?.data===void 0)throw new De(`LFV read_secret returned an invalid secret response for ${y}`);let V=L.data.metadata??{},X=typeof V.version==="number"?V.version:0,D=V.created_time??V.created,ie=ut(V);return{data:L.data.data,metadata:{path:y,version:X,created:typeof D==="string"?new Date(D):new Date,...ie?{contentType:ie}:{}}}}function K(y,L,q){if(q!==void 0){let D=Z.get(y);if(D!==void 0&&q<D){s(void 0,"delivery ignored: stale version",{path:y,realVersion:q,lastAccepted:D});return}Z.set(y,q)}H(y,L),M.delete(y);let V=L.metadata.version;if(se.get(y)===V)return;se.set(y,V);let X=W.get(y);if(!X)return;for(let D of X)D(L)}async function oe(y,L){return await S(y,void 0,L)}async function te(y,L,q){if(!cc(L))throw Error(`putSecret requires an object value for LFV source at path ${y}`);let V=Ae(q),X={data:L,content_type:mr(q.contentType)};if(await st(y,q)){await f("/secrets/update",y,"update_secret",X,void 0,V),v(y);return}await f("/secrets/create",y,"create_secret",X,void 0,V),v(y)}async function we(y,L){let q=Ae(L);await f("/secrets/delete",y,"delete_secret",void 0,void 0,q),v(y)}async function le(y,L){let q=Ae(L),V=crypto.randomUUID();s(V,"list_paths request",{path:y});let X=await h(y,"list_paths",V,q),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},q,"listPaths",y);if(D.status!==200)throw Error(`LFV listPaths failed (${D.status}) for ${y}`);let ie=await D.json();if(!Array.isArray(ie.items))throw Error(`LFV listPaths returned invalid payload for ${y}`);return s(V,"list_paths success",{path:y,status:200}),ie.items.filter((fe)=>typeof fe==="string")}async function st(y,L){let q=Ae(L),V=crypto.randomUUID();s(V,"exists request",{path:y});let X=await h(y,"read_metadata",V,q),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},q,"exists",y);if(D.status!==200)throw Error(`LFV exists failed (${D.status}) for ${y}`);let ie=await D.json();if(typeof ie.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${y}`);return s(V,"exists success",{path:y,status:200,exists:ie.exists}),ie.exists}async function Ve(y,L,q){let V=Ae(q);await f("/secrets/rotate/request",y,"request_rotate",{reason:L?.reason,severity:L?.severity,incident_ref:L?.incidentRef},void 0,V)}async function jt(y,L,q){let V=Ae(q);await f("/secrets/revoke/request",y,"request_revoke",{reason:L?.reason,severity:L?.severity,incident_ref:L?.incidentRef},void 0,V)}async function xi(y,L,q){let V=Ae(q),{response:X}=await f("/secrets/kms/park",y,"kms_park",{key_id:L.keyId,status:L.status,reason:L.reason},void 0,V);return ac(await X.json().catch(()=>null),y)}function Mi(y,L){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_add_keys returned invalid payload for ${L}`);let q=y;if(!Array.isArray(q.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${L}`);return{keys:q.keys.map((X,D)=>{if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`LFV kms_add_keys returned invalid keys[${D}] for ${L}`);let ie=X.id;if(typeof ie!=="string"||ie.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${D}].id for ${L}`);return{id:ie}})}}function Wi(y,L){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_revoke_key returned invalid payload for ${L}`);let q=y;if(typeof q.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${L}`);return{revoked:q.revoked}}async function ji(y,L,q){let V=Ae(q),{response:X}=await f("/secrets/kms/add-keys",y,"kms_add_keys",{keys:L.keys},void 0,V);return Mi(await X.json().catch(()=>null),y)}async function $i(y,L,q){let V=Ae(q),{response:X}=await f("/secrets/kms/revoke-key",y,"kms_revoke_key",{key_id:L.keyId,reason:L.reason},void 0,V);return Wi(await X.json().catch(()=>null),y)}async function qi(y,L){let q=Ae(L),V=crypto.randomUUID();s(V,"getMetadata request",{path:y});let X=await h(y,"read_metadata",V,q),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},q,"getMetadata",y);if(D.status!==200)throw Error(`LFV getMetadata failed (${D.status}) for ${y}`);let ie=await D.json();if(!ie.metadata||typeof ie.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${y}`);return s(V,"getMetadata success",{path:y,status:200}),ie.metadata}async function so(y,L,q,V=!0){let X=W.get(y)??new Set,D,ie=(de)=>{if(de.metadata.version===D)return;D=de.metadata.version,L(de)};if(X.add(ie),W.set(y,X),!V)return x(),()=>{let de=W.get(y);if(!de)return;if(de.delete(ie),de.size===0)W.delete(y);x()};let fe=B(y,q?.kmsSlots)?void 0:U(y);if(fe)ie(fe),se.set(y,fe.metadata.version);else try{ie(await oe(y,q))}catch(de){if(X.delete(ie),X.size===0)W.delete(y);throw de}return x(),()=>{let de=W.get(y);if(!de)return;if(de.delete(ie),de.size===0)W.delete(y);x()}}let Ni=(y,L)=>so(y,L,void 0,!1);function Ki(y){return y.method==="POST"&&new URL(y.url).pathname===b}function Vi(y){return y.method==="POST"&&new URL(y.url).pathname===T}function io(y){let L=y.data?.metadata?.path;if(typeof L==="string"&&L)return L;if(typeof y.path==="string"&&y.path)return y.path;return}function Fi(y){let{request_id:L,otp:q}=y;if(typeof L!=="string"||typeof q!=="string"||!q)return{handled:!1};let V=ue.get(L);if(!V)return{handled:!1};if(V.timer)clearTimeout(V.timer);return ue.delete(L),x(),V.resolve(q),{handled:!0}}function ao(y){return y.type==="otp"?Fi(y):{handled:!1}}function Qe(y="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:y}),{status:401,headers:{"Content-Type":"application/json"}})}function co(y){return{requestId:y.headers.get("X-LFV-Request-Id")??y.headers.get("x-lfv-request-id")??"",keyId:y.headers.get("X-LFV-Key-Id")??y.headers.get("x-lfv-key-id")??"",signature:y.headers.get("X-LFV-Signature")??y.headers.get("x-lfv-signature")??""}}async function Nr(y,L){if(!d?.trim())return i(void 0,"LFV callback rejected: verifyJwks is not configured"),Qe("LFV callback verification is not configured");let{requestId:q,keyId:V,signature:X}=L;if(!q.trim()||!V.trim()||!X.trim())return i(q||void 0,"LFV callback rejected: missing signature headers"),Qe("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await Bo({jwks:d,kid:V,signatureB64Url:X.trim(),requestId:q.trim(),rawBody:y}))return i(q,"LFV callback rejected: signature verification failed"),Qe();let ie=Vt(y);if(!ie)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let fe=ie;if(fe.request_id!==q.trim())return i(q,"LFV callback rejected: request_id header/body mismatch"),Qe("X-LFV-Request-Id does not match request_id in body");let de=Date.now(),he=on(fe.issued_at);if(he===void 0)return i(q,"LFV callback rejected: missing or invalid issued_at"),Qe("Missing or invalid issued_at");if(de-he>P)return i(q,"LFV callback rejected: stale (outside freshness window)"),Qe("Callback is stale (issued_at outside freshness window)");let ke=on(fe.expires_at);if(ke!==void 0&&de>ke)return i(q,"LFV callback rejected: expired"),Qe("Callback has expired");let ve=X.trim();for(let[Ee,$t]of ee)if($t<=de)ee.delete(Ee);if(ee.has(ve))return i(q,"LFV callback rejected: replayed signature"),Qe("Callback signature already processed (replay)");return ee.set(ve,he+P),null}async function uo(y){if(!r.selfRedeemReads||y.action!=="read_secret"||typeof y.request_id!=="string"||typeof y.path!=="string"||typeof y.otp!=="string")return!1;let L={startedAt:Date.now(),timeout:g},q=await p("/secrets/request",y.path,"read_secret",y.otp,y.request_id,void 0,L),V=await j(y.request_id,q),X=Y(y.path,V);return K(y.path,X,X.metadata.version),!0}async function Di(y){let L=await y.text(),q=co(y),V=await Nr(L,q);if(V)return V;let X=Vt(L);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let D=X;if(D.type!=="otp"||typeof D.request_id!=="string"||typeof D.otp!=="string"||typeof D.path!=="string"||typeof D.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let ie=io(D);s(D.request_id,"delivery received",{path:ie});let fe=ao(D),de=ie?gr({lfvServerUrl:c,path:ie}):l,he=await Ko(de,D,k,O),ke=fe.handled||he>0;if(!ke)try{if(ke=await uo(D),!ke&&t&&typeof D.request_id==="string"){let ve=on(D.expires_at),Ee=Math.max(1,(ve??Date.now()+P)-Date.now());await t.put(D.request_id,{kind:"delivery",key:de,rawBody:L,headers:q},Ee),ke=!0}}catch(ve){if(Ho(ve)){if(!(ve instanceof dt)||ve.status!==409&&ve.status!==410)M.add(D.path);return i(q.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:de,status:ve instanceof dt?ve.status:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:{"Content-Type":"application/json"}})}return ee.delete(q.signature.trim()),i(q.requestId,"LFV callback handoff failed; callback may be retried",{key:de,error:ve instanceof Error?ve.message:String(ve)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(!ke)return ee.delete(q.signature.trim()),i(q.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:de}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function lo(y){if(ne)return;if(!y?.path||typeof y.path!=="string")return;s(y.request_id,"events payload",{path:y.path,event:y.event});for(let L of F)try{L({path:y.path,event:y.event,requestId:y.request_id,issuedAt:y.issued_at,expiresAt:y.expires_at,...typeof y.key_id==="string"&&y.key_id.length>0?{keyId:y.key_id}:{}})}catch(q){i(y.request_id,"secret event listener failed",{path:y.path,event:y.event,error:q instanceof Error?q.message:String(q)})}if(y.event==="created"||y.event==="updated"||y.event==="rotated")v(y.path),(r.selfRedeemReads?_(y.path,y.request_id):S(y.path,y.request_id).then(()=>{return})).catch((q)=>{if(hr(q)){s(y.request_id,"event refresh aborted: source closed",{path:y.path});return}M.add(y.path),i(y.request_id,"event-triggered refresh failed; source marked degraded",{path:y.path,event:y.event,error:q instanceof Error?q.message:String(q)})})}async function zi(y){let L=await y.text(),q=co(y),V=await Nr(L,q);if(V)return V;let X=Vt(L);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let D=X;if(!D?.path||typeof D.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});s(D.request_id,"events received",{path:D.path,event:D.event}),lo(D);let ie=gr({lfvServerUrl:c,path:D.path});return await Vo(ie,D,k,O),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function Bi(){if(ne)return;if(ne=!0,R)R(),R=void 0;let y=new Te(a);for(let L of ue.values()){if(L.timer)clearTimeout(L.timer);try{L.reject(y)}catch{}}ue.clear(),ae.clear(),re.clear(),M.clear(),Q.clear(),ce.clear(),se.clear(),Z.clear(),ee.clear(),W.clear(),F.clear()}return{type:"vault",isAvailable:()=>M.size===0,get:(y,L)=>qe(()=>oe(y,L)),getFullSecret:oe,getSecret:async(y,L)=>(await oe(y,L)).data,putSecret:te,deleteSecret:we,listPaths:le,exists:st,requestRotate:Ve,requestRevoke:jt,parkKmsKey:xi,addKmsKeys:ji,revokeKmsKey:$i,getMetadata:qi,subscribe:so,subscribePassive:Ni,subscribeEvents:(y)=>(F.add(y),x(),()=>{F.delete(y),x()}),close:Bi,isDeliveryRequest:Ki,isEventsRequest:Vi,handleDelivery:Di,handleEvents:zi,deliveryPath:b,eventsPath:T,callbackKey:l,trustId:O}}function ft(e,t,r){if(typeof e!=="string"||e.trim()==="")throw Error(`"${t}" is required when using ${r}`);return e}var Ct="__esLfvBootstrap";import{catalogEntityStore as Sr,listGenerator as Bt,materializeCodeCatalogEntity as pc,trimTrailingSlash as mc,unionCatalogRead as gc}from"@ionite/core";import{baseCustomerToScim as Zo,baseUserToScimUser as Qo,baseWorkloadToScim as es,entitlementToScimGroup as dn}from"@ionite/core/server";import{ION_AUTHZ_GROUP_SCHEMA as cn}from"@ionite/core";var Xo="application/scim+json",dc="urn:ietf:params:scim:api:messages:2.0:PatchOp",lc="urn:ietf:params:scim:schemas:core:2.0:User",fc="urn:ietf:params:scim:schemas:core:2.0:Group";async function Dt(e){try{let t=(await e.clone().text()).trim();return t?t.slice(0,2000):void 0}catch{return}}function zt(e){if(e==="user")return"Users";if(e==="workload")return"Workloads";if(e==="customer")return"Customers";return"Groups"}function un(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class vr{constructor(e){this.inflight=new Map;this.memo=new Map;this.writes=new Map;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.getToken=e.getToken,this.receipts=e.receipts,this.log=e.log,this.fetchImpl=e.fetchImpl??((t,r)=>fetch(t,r))}async headers(){let e=await this.getToken();return new Headers({"Content-Type":Xo,Accept:Xo,Authorization:`Bearer ${e}`})}inflightKey(e,t,r){return`${e}\x00${t}\x00${r?"create":"lookup"}`}receiptKey(e,t){return`${e}\x00${t}`}serializeWrite(e,t,r){let n=`${e}\x00${t}`,s=(this.writes.get(n)??Promise.resolve()).catch(()=>{return}).then(r);this.writes.set(n,s);let i=()=>{if(this.writes.get(n)===s)this.writes.delete(n)};return s.then(i,i),s}async resolveProviderId(e,t,r){let n=this.receiptKey(e,t),o=this.memo.get(n);if(o)return{found:o.providerId,requestUrl:o.requestUrl};let s=await this.receipts.read(e,t);if(s)this.memo.set(n,s);if(s)return{found:s.providerId,requestUrl:s.requestUrl};let i=this.inflightKey(e,t,r!==void 0),c=this.inflight.get(i);if(c)return c;let u=this.resolveUncached(e,t,r).then(async(a)=>{if(typeof a==="object"){let d={providerId:a.found,...a.requestUrl?{requestUrl:a.requestUrl}:{}};await this.receipts.write(e,t,d),this.memo.set(n,d)}return a}).finally(()=>{this.inflight.delete(i)});return this.inflight.set(i,u),u}async resolveUncached(e,t,r){let n=await this.filterByExternalId(e,t);if(n!=="absent")return n;if(!r)return"absent";return this.create(e,t,r)}async filterByExternalId(e,t){let r=encodeURIComponent(`externalId eq "${un(t)}"`),n=`${this.baseUrl}/${zt(e)}?filter=${r}`,o=await this.fetchImpl(n,{method:"GET",headers:await this.headers()});if(!o.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:e,status:o.status,detail:await Dt(o)}),"error";let i=((await o.json()).Resources??[])[0];return i?.id?{found:i.id,...this.requestUrl(e,i)}:"absent"}async create(e,t,r){let n=`${this.baseUrl}/${zt(e)}`,o=this.writeBody(e,t,r),s=await this.fetchImpl(n,{method:"POST",headers:await this.headers(),body:JSON.stringify(o)});if(!s.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Dt(s)}),"error";let i=await s.json();return i.id?{found:i.id,...this.requestUrl(e,i),created:!0}:"error"}requestUrl(e,t){if(e!=="group")return{};let r=t[cn];if(!r||typeof r!=="object")return{};let n=r.requestUrl;return typeof n==="string"&&n?{requestUrl:n}:{}}async captureResponseReference(e,t,r,n,o){try{let s=await e.clone().json(),i=this.requestUrl(t,s).requestUrl;if(!i&&s.id===void 0)return;let c=i??o,u={providerId:s.id??n,...c?{requestUrl:c}:{}};await this.receipts.write(t,r,u),this.memo.set(this.receiptKey(t,r),u)}catch{}}async invalidate(e,t){this.memo.delete(this.receiptKey(e,t)),await this.receipts.clear(e,t)}writeBody(e,t,r){let{id:n,meta:o,...s}=r,i=s,c=i[cn];if(c&&typeof c==="object"&&!Array.isArray(c)){let{providerId:u,requestUrl:a,...d}=c;i[cn]=d}return{...s,schemas:(r.schemas?.length??0)>0?r.schemas:[e==="user"?lc:fc],externalId:t}}async upsertResource(e,t,r){return this.serializeWrite(e,t,()=>this.upsertResourceNow(e,t,r))}async upsertResourceNow(e,t,r){let n=async(s)=>{let i=await this.resolveProviderId(e,t,s?r:void 0);if(i==="error")return"error";if(i==="absent")return"skipped";if(i.created)return"pushed";let c=await this.fetchImpl(`${this.baseUrl}/${zt(e)}/${encodeURIComponent(i.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody(e,t,r))});if(c.status===404||c.status===410)return"stale";if(c.ok)return await this.captureResponseReference(c,e,t,i.found,i.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:e,status:c.status,detail:await Dt(c)}),"error"},o=await n(!0);if(o==="stale")await this.invalidate(e,t),o=await n(!0);return o==="stale"?"error":o}async deleteResource(e,t){return this.serializeWrite(e,t,()=>this.deleteResourceNow(e,t))}async deleteResourceNow(e,t){let r=async()=>{let o=await this.resolveProviderId(e,t);if(o==="error")return{outcome:"error"};if(o==="absent")return{outcome:"pushed"};let s=await this.fetchImpl(`${this.baseUrl}/${zt(e)}/${encodeURIComponent(o.found)}`,{method:"DELETE",headers:await this.headers()});if(s.status===404||s.status===410)return{outcome:"pushed",stale:!0};if(s.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Dt(s)}),{outcome:"error"}},n=await r();if(n.stale)await this.invalidate(e,t),n=await r();if(n.outcome==="pushed")await this.invalidate(e,t);return n.outcome}async patchGroupMembership(e){return this.serializeWrite("group",e.groupExternalId,()=>this.patchGroupMembershipNow(e))}async patchGroupMembershipNow(e){let{groupExternalId:t,userExternalId:r,op:n}=e,o=e.subjectResourceType??"user",s=await this.resolveProviderId(o,r,n==="add"?e.userCreate:void 0);if(s==="error")return this.log.warn("IAM delta: principal lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,subjectResourceType:o}),"error";if(s==="absent")return this.log.warn("IAM delta: principal not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n,subjectResourceType:o}),"skipped";let i=s.found,c=async(d)=>{let g=await this.resolveProviderId("group",t,n==="add"&&d?e.groupCreate:void 0);if(g==="error")return{kind:"error"};if(g==="absent")return{kind:"absent"};let m=`${this.baseUrl}/${zt("group")}/${encodeURIComponent(g.found)}`,C=n==="add"?[{op:"add",path:"members",value:[{value:i,type:e.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${un(i)}"]`}];return{kind:"response",response:await this.fetchImpl(m,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[dc],Operations:C})}),providerId:g.found,requestUrl:g.requestUrl}},u=await c(!0);if(u.kind==="response"&&(u.response.status===404||u.response.status===410))await this.invalidate("group",t),u=await c(!1);if(u.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n}),"error";if(u.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n}),"skipped";let a=u.response;if(!a.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,status:a.status,detail:await Dt(a)}),"error";return await this.captureResponseReference(a,"group",t,u.providerId,u.requestUrl),"pushed"}}function Tt(e){if(typeof e==="string")return e;if(e&&typeof e==="object"&&"id"in e)return e.id;return}function Gt(e){return e&&typeof e==="object"?e:void 0}function ln(e){let t={},r={},n,o,s,i,c,u,a,d,g,m=()=>t.users==="patch"||t.workloads==="patch"||t.customers==="patch",C=(v)=>{if(v==="user")return t.users==="patch";if(v==="workload")return t.workloads==="patch";return t.customers==="patch"},P=()=>{if(!t.url)return"destination URL is not configured";if(!r.workload)return"workload identity is not configured";if(typeof r.workload.isReady!=="function"||typeof r.workload.ready!=="function")return"workload handle violates the readiness contract";if(!r.workload.isReady())return"workload module is not ready";if(t.audience){let v=r.workload[t.audience];if(!v)return`outgoing workload client "${t.audience}" is not configured`;if(typeof v.isReady!=="function"||typeof v.ready!=="function")return`outgoing workload client "${t.audience}" violates the readiness contract`;if(!v.isReady())return`outgoing workload client "${t.audience}" is not ready`}return},E=()=>{if(!m())return"no principal-kind delta mode is 'patch'";let v=P();if(v)return v;if(t.users==="patch"&&!r.userStore)return"user store is not configured for IAM destination receipts";if(t.workloads==="patch"&&!r.workloadIdentityStore)return"workload identity store is not configured for IAM destination receipts";if(t.customers==="patch"&&!r.customerStore)return"customer store is not configured for IAM destination receipts";if(!r.catalogStore)return"catalog store is not configured for IAM destination receipts";return},O=()=>E()===void 0,b=ye("IAM delta",O),T=async()=>{let v=r.workload;if(!v)throw Error("IAM delta: workload identity not configured");if(t.audience&&typeof v.getToken==="function")return v.getToken(t.audience);if(typeof v.getServerToken==="function")return v.getServerToken();return v.getToken()},l=()=>gc(r.codeCatalog,r.catalogStore),k=async(v,U)=>{let I=r.catalogStore;if(!I)return;let x=r.codeCatalog?.groups.get(v)??r.codeCatalog?.roles.get(v)??r.codeCatalog?.permissions.get(v);if(x){let w=r.codeCatalog?.groups.get(x.id)?"group":r.codeCatalog?.roles.get(x.id)?"role":"permission",_=Sr(I,w),h=await _.get(x.id);if(!h&&U)await pc(w,x,_),h=await _.get(x.id);if(h)return{kind:w,entity:h}}let N=[["group",I.groups],["role",I.roles],["permission",I.permissions]];for(let[w,_]of N){let h=await _.get(v);if(h)return{kind:w,entity:h}}return},W=async(v)=>{let U=r.userStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);for await(let I of Bt((x,N)=>U.list({start:x,limit:N})))if(I.externalId===v)return I;return},F=(v)=>v?.providerId?{providerId:v.providerId,...v.requestUrl?{requestUrl:v.requestUrl}:{}}:void 0,Q=async(v)=>{let U=r.workloadIdentityStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);let I=await U.lookup({id:"",externalId:v});if(I)return I;for await(let x of Bt((N,w)=>U.list({start:N,limit:w})))if(x.externalId===v)return x;return},ce=async(v)=>{let U=r.customerStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);let I=await U.lookup({id:"",userName:"",name:"",email:"",externalId:v});if(I)return I;for await(let x of Bt((N,w)=>U.list({start:N,limit:w})))if(x.externalId===v)return x;return},se={async read(v,U){if(v==="user")return F(await W(U));if(v==="workload")return F(await Q(U));if(v==="customer")return F(await ce(U));return F((await k(U,!1))?.entity)},async write(v,U,I){if(v==="user"){let w=await W(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.userStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}if(v==="workload"){let w=await Q(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.workloadIdentityStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}if(v==="customer"){let w=await ce(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.customerStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}let x=await k(U,!0);if(!x||x.entity.providerId===I.providerId&&x.entity.requestUrl===I.requestUrl)return;await Sr(r.catalogStore,x.kind).set({...x.entity,providerId:I.providerId,requestUrl:I.requestUrl}).ready()},async clear(v,U){if(v==="user"){let h=await W(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.userStore?.upsert(S);return}if(v==="workload"){let h=await Q(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.workloadIdentityStore?.upsert(S);return}if(v==="customer"){let h=await ce(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.customerStore?.upsert(S);return}let I=await k(U,!1);if(!I||I.entity.providerId===void 0&&I.entity.requestUrl===void 0)return;let{providerId:x,requestUrl:N,...w}=I.entity;await Sr(r.catalogStore,I.kind).set(w).ready()}},Z=()=>{if(!O()||!t.url)return;let v=t.url;if(n&&o===v&&s===r.catalogStore&&i===r.userStore&&c===r.workloadIdentityStore&&u===r.customerStore&&a===r.codeCatalog&&d===r.fetchImpl)return n;return n=new vr({baseUrl:t.url,getToken:T,receipts:se,log:e,fetchImpl:r.fetchImpl}),o=v,s=r.catalogStore,i=r.userStore,c=r.workloadIdentityStore,u=r.customerStore,a=r.codeCatalog,d=r.fetchImpl,n},ee=(v)=>v==="workload"?"Workload":v==="customer"?"Customer":"User",ue=async(v)=>{if(v.subjectType==="workload"){let N=Tt(v.subject),w=Gt(v.subject);if(!w&&N)w=await r.workloadIdentityStore?.get(N);let _=w?.externalId??w?.id??N;if(!w||!_)return;return{externalId:_,resourceType:"workload",create:await(r.mapWorkloadToScim?.({...w,externalId:_})??es({...w,externalId:_}))}}if(v.subjectType==="customer"){let N=Tt(v.subject),w=Gt(v.subject);if(!w&&N)w=await r.customerStore?.get(N);let _=w?.externalId??w?.id??N;if(!_)return;let h=w?await(r.mapCustomerToScim?.({...w,externalId:_})??Zo({...w,externalId:_})):{schemas:["urn:ionite:scim:schemas:core:2.0:Customer"],externalId:_,displayName:_,active:!0};return{externalId:_,resourceType:"customer",create:h}}let I=Gt(v.subject);if(!I){let N=Tt(v.subject);if(N&&r.userStore)I=await r.userStore.get(N)}let x=I?.externalId;if(!I||!x)return;return{externalId:x,resourceType:"user",create:await(r.mapUserToScim?.(I)??Qo(I))}},z=async(v)=>{let I=Gt(v.target);if(!I){let x=Tt(v.target),N=l();if(x&&N)I=v.targetType==="role"?await N.roles.get(x):v.targetType==="permission"?await N.permissions.get(x):await N.groups.get(x)}if(I&&I.requestable!==!0)return"not-requestable";if(!I)return;return{externalId:I.id,create:dn(I,v.targetType)}},J=async(v,U)=>{if(!O())return"skipped";if(!C(v.subjectType==="workload"?"workload":v.subjectType==="customer"?"customer":"user"))return"skipped";let I=await ue(v),x=await z(v);if(x==="not-requestable")return"skipped";if(!I||!x)return e.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:U,hasSubject:Boolean(I),hasTarget:Boolean(x),targetType:v.targetType}),"skipped";let N=Z();if(!N)return"skipped";return N.patchGroupMembership({groupExternalId:x.externalId,userExternalId:I.externalId,op:U,groupCreate:x.create,userCreate:I.create,memberType:ee(v.subjectType),subjectResourceType:I.resourceType})},B=async(v,U,I)=>{let x=[],N=new Set,w=(h)=>{let p=`${h.type??"User"}\x00${h.value}`;if(!N.has(p))N.add(p),x.push(h)},_=r.accessStore;if(_)for await(let h of Bt((p,f)=>_.listByTarget(U,v.id,{start:p,limit:f}))){let p=await ue(h);if(!p){e.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:v.id,targetType:U});continue}let f=await I.resolveProviderId(p.resourceType,p.externalId,p.create);if(f==="error")throw Error(`IAM delta failed to resolve access subject for ${U}:${v.id}`);if(f==="absent")continue;let S=h.metadata;w({value:f.found,type:ee(h.subjectType),...S?.display?{display:S.display}:{}})}if(U==="group"){let h=l();for(let p of v.groups??[]){let f=Tt(p),S=Gt(p);if(!S&&f)S=await h?.groups.get(f);if(S&&S.requestable!==!0)continue;if(!S){e.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:f,target:v.id});continue}let A=await I.resolveProviderId("group",S.id,dn(S,"group"));if(A==="error")throw Error(`IAM delta failed to resolve nested Group for group:${v.id}`);if(A!=="absent")w({value:A.found,type:"Group"})}}return x.length>0?x:void 0},ae=async(v)=>{if(!O()||!C("user"))return"skipped";let U=v.externalId;if(!U)return e.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:v.id,kind:"user"}),"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapUserToScim?.(v)??Qo(v));return I.upsertResource("user",U,x)},re=async(v)=>{if(!O()||!C("workload"))return"skipped";let U=v.externalId??v.id;if(!U)return"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapWorkloadToScim?.({...v,externalId:U})??es({...v,externalId:U}));return I.upsertResource("workload",U,x)},ne=async(v)=>{if(!O()||!C("customer"))return"skipped";let U=v.externalId??v.id;if(!U)return"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapCustomerToScim?.({...v,externalId:U})??Zo({...v,externalId:U}));return I.upsertResource("customer",U,x)},R=async(v,U,I=!0)=>{if(!O()||!m())return"skipped";let x=l(),w=(x?await Sr(x,U).get(v.id):void 0)??v;if(w.requestable!==!0)return"skipped";let _=Z();if(!_)return"skipped";let h=await B(w,U,_),p=await _.upsertResource("group",w.id,dn(w,U,h)),f=r.accessStore;if(p!=="pushed"||!I||!f)return p;for await(let S of Bt((A,j)=>f.listByTarget(U,v.id,{start:A,limit:j})))if(await J(S,"add")==="error")throw Error(`IAM delta failed to restore access for ${U}:${v.id}`);return p},M=(v,U)=>{if(v==="error")throw Error(`IAM delta: destination rejected ${U}`)},G=(v,U,I)=>{if(U==="pushed")v.pushed+=1;else if(U==="skipped")v.skipped+=1;else v.errors.push(`IAM delta: destination rejected ${I}`)},H={async onUserUpsert(v){M(await ae(v),"user upsert")},async onUserDelete(v){if(!O()||!C("user"))return;let U=Z();if(!U)return;M(await U.deleteResource("user",v),"user delete")},async onWorkloadUpsert(v){M(await re(v),"workload upsert")},async onWorkloadDelete(v){if(!O()||!C("workload"))return;let U=Z();if(!U)return;M(await U.deleteResource("workload",v),"workload delete")},async onCustomerUpsert(v){M(await ne(v),"customer upsert")},async onCustomerDelete(v){if(!O()||!C("customer"))return;let U=Z();if(!U)return;M(await U.deleteResource("customer",v),"customer delete")},async onEntitlementUpsert(v,U){M(await R(v,U),`${U} upsert`)},async onEntitlementDelete(v,U){if(!O())return;let I=Z();if(!I)return;M(await I.deleteResource("group",U),`${v} delete`)},async onGrant(v){if(!O())return;if(await J(v,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(v){if(!O())return;if(await J(v,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async requestAccess(v){let U=t.url,I=P();if(I!==void 0||U===void 0)throw Error(`Cannot submit an access request: ${I??"destination URL is not configured"}`);let x=await(r.fetchImpl??fetch)(`${mc(U)}/AccessRequests`,{method:"POST",headers:{Authorization:`Bearer ${await T()}`,"Content-Type":"application/json"},body:JSON.stringify(v)});if(!x.ok)throw Error(`AccessRequests failed: ${x.status} ${await x.text()}`);return await x.json()},async reconcile(v){let U={pushed:0,skipped:0,errors:[]},I=E();if(I)return U.errors.push(`iam delta not ready: ${I}`),U;let x=async(N,w,_)=>{if(!N)return;for await(let h of N)try{G(U,await w(h),_(h))}catch(p){U.errors.push(p instanceof Error?p.message:String(p))}};return await x(v.groups,(N)=>R(N,"group",!1),(N)=>`group upsert for ${N.id}`),await x(v.roles,(N)=>R(N,"role",!1),(N)=>`role upsert for ${N.id}`),await x(v.permissions,(N)=>R(N,"permission",!1),(N)=>`permission upsert for ${N.id}`),await x(v.users,(N)=>ae(N),(N)=>`user upsert for ${N.id??"unknown"}`),await x(v.workloads,(N)=>re(N),(N)=>`workload upsert for ${N.id}`),await x(v.customers,(N)=>ne(N),(N)=>`customer upsert for ${N.id??"unknown"}`),await x(v.access,(N)=>J(N,"add"),(N)=>`membership push for ${Tt(N.target)??"unknown"}`),U},async getDestinationRef(v,U){return se.read(v,U)},isReady:O,ready:b.ready};return{update(v,U){t=v,r=U,Z(),b.refresh();let I=E();if(!m())g=void 0;else if(I!==g){if(I)e.warn(`IAM delta configured but not ready: ${I}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:I});g=I}return H},handle(){return H}}}var fn=2,yc=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"iam.workloads",module:"iam",label:"SCIM Workloads inbound",requires:"workloadIdentityStore",incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."},{key:"iam.customers",module:"iam",label:"SCIM Customers inbound",requires:"customerStore",incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."}];import{IoniteError as wc}from"@ionite/core";function hc(e){if(e instanceof wc)return{status:e.status,statusText:e.statusText};if(typeof e!=="object"||e==null)return;let t=e,r=typeof t.status==="number"?t.status:void 0,n=typeof t.statusText==="string"?t.statusText:void 0;return r!=null||n?{status:r,statusText:n}:void 0}function Pt(e){if(e instanceof Response)return e;let t=hc(e);if(!t)return Response.json({error:"internal_error"},{status:500});let n={status:t.status??500};if(t.statusText)n.statusText=t.statusText;return Response.json({error:t.statusText??"internal_error"},n)}function me(){return Response.json({error:"not_found"},{status:404})}function It(e=["GET"]){return Response.json({error:"method_not_allowed",allow:e},{status:405,headers:{Allow:e.join(", ")}})}import{timingSafeEqual as vc}from"node:crypto";import{parseKmsPoolDocument as Sc,stableConfigHash as rs}from"@ionite/core";function ts(e,t,r){for(let n of e)try{n()}catch(o){t.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:r,error:o instanceof Error?o.message:String(o)})}}function We(e,t){let r=new Set,n=new Set;return{beforeChange(o){return r.add(o),()=>{r.delete(o)}},afterChange(o){return n.add(o),()=>{n.delete(o)}},emitBefore(){ts(r,e,`${t} beforeChange`)},emitAfter(){ts(n,e,`${t} afterChange`)}}}var kc=604800000,bc=2147483647,Rc=1;function is(e,t){if(!e.value)return!1;if(e.notBefore&&Date.parse(e.notBefore)>t)return!1;if(e.notAfter&&Date.parse(e.notAfter)<=t)return!1;return!0}function _e(e,t,r=Date.now()){if(!e)return;let n=e.slots?.[t];if(!n)return;let o=e.keys.find((s)=>s.id===n&&s.state==="active");return o&&is(o,r)?o:void 0}function pn(e,t=Date.now()){if(!e)return[];return e.keys.filter((r)=>(r.state==="active"||r.state==="deprecated")&&is(r,t))}function ns(e){return{...e,...e.meta?{meta:{...e.meta}}:{}}}function kr(e,t,r){if(!t||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>o(Error(r)),t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function os(e,t){let r=Buffer.from(e),n=Buffer.from(t);return r.length===n.length&&vc(r,n)}function Cc(e){if(!Number.isInteger(e)||e<1)throw Error("KMS unique() requires a positive integer slot count.");return e}var Tc=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function Pc(e){return Tc.has(e)}function ss(e){let t=e.trim().replace(/\/+$/,"");if(!t||t==="/")return"/";return t.startsWith("/")?t:`/${t}`}function Ic(e,t){let r=ss(e),n=ss(t);return r===n||r.endsWith(n)}function Oc(e,t,r){let n=We(t,`KMS pool "${e}"`),o=new Set,s=!1,i,c,u=0,a,d,g=Rc,m,C,P=new Map,E=new Set,O,b=()=>i!==void 0&&i.slots===void 0&&i.keys.length>0,T=ye(`KMS pool "${e}"`,()=>{if(!s)return!1;if(b())return pn(i).length>0;return _e(i,0)!==void 0}),l=ye(`KMS pool "${e}" issuer`,()=>s&&m!==void 0),k=(h)=>h===0?`KMS pool "${e}"`:`KMS pool "${e}" slot ${h}`,W=(h)=>{let p=P.get(h),f=p?.valueWaiter;if(!p||!f)return;if(!s){p.valueWaiter=void 0,f.reject(Error(`${k(h)} is no longer configured.`));return}if(b()){p.valueWaiter=void 0,f.reject(Error(`${k(h)} verifier grant has no slots.`));return}let S=_e(i,h);if(S?.value)p.valueWaiter=void 0,f.resolve(S.value)},F=()=>{for(let h of P.keys())W(h)},Q=(h)=>{let p=P.get(h);if(!p)return;let f=_e(i,h);for(let S of p.listeners)try{S(f?ns(f):void 0)}catch(A){t.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:e,slot:h,error:A instanceof Error?A.message:String(A)})}},ce=()=>{for(let h of P.keys())Q(h)},se=()=>{for(let h of P.values())h.latch.refresh();T.refresh(),l.refresh()},Z=()=>{try{O?.()}catch(h){t.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:e,error:h instanceof Error?h.message:String(h)})}O=void 0},ee=()=>{if(O||E.size===0||!m?.subscribeEvents||!C)return;let h=C;O=m.subscribeEvents((p)=>{if(!Pc(p.event)||!Ic(p.path,h))return;let f={path:p.path,event:p.event,...p.requestId===void 0?{}:{requestId:p.requestId},...p.keyId===void 0?{}:{keyId:p.keyId}};for(let S of E)try{S(f)}catch(A){t.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:e,error:A instanceof Error?A.message:String(A)})}})},ue=()=>{if(d)clearTimeout(d);d=void 0},z=()=>{ue();let h=Date.now();if(i){for(let f of i.keys){if(!f.notAfter)continue;let S=Date.parse(f.notAfter)-h;if(S>0&&S<=kc&&(f.state==="active"||f.state==="deprecated")&&!o.has(f.id))o.add(f.id),t.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:e,keyId:f.id,notAfter:f.notAfter})}let p=i.keys.flatMap((f)=>[f.notBefore,f.notAfter]).filter((f)=>Boolean(f)).map((f)=>Date.parse(f)).filter((f)=>f>h).sort((f,S)=>f-S);if(p[0])d=setTimeout(()=>{let f=new Map([...P.keys()].map((S)=>[S,_e(i,S)?.id]));se(),r();for(let S of P.keys())if(f.get(S)!==_e(i,S)?.id)Q(S);z()},Math.min(p[0]-h+1,bc))}se(),r(),F()},J=(h)=>{let p=new Map([...P.keys()].map((f)=>{let S=_e(i,f);return[f,{id:S?.id,value:S?.value}]}));n.emitBefore();try{i=Sc(h),z();for(let f of P.keys()){let S=_e(i,f),A=p.get(f);if(A?.id!==S?.id||A?.value!==S?.value)Q(f)}}catch(f){i=void 0,z(),ce(),t.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:e,error:f instanceof Error?f.message:String(f)})}finally{n.emitAfter()}},B=()=>{try{a?.()}catch(h){t.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:e,error:h instanceof Error?h.message:String(h)})}a=void 0},ae=(h,p)=>{m=h,C=p,u+=1;let f=u;B(),h.subscribe(p,(S)=>{if(u!==f||!s)return;J(S.data)},{kmsSlots:g}).then((S)=>{if(u!==f||!s){S();return}a=S}).catch((S)=>{if(u!==f||!s)return;i=void 0,z(),ce(),t.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:e,path:p,error:S instanceof Error?S.message:String(S)})})},re=(h,p)=>{let f=R(h),S=_e(i,h);if(!s)return Promise.reject(Error(`${k(h)} is no longer configured.`));if(b())return Promise.reject(Error(`${k(h)} verifier grant has no slots.`));if(S?.value)return Promise.resolve(S.value);if(!f.valueWaiter){let j,Y,K=new Promise((oe,te)=>{j=oe,Y=te});f.valueWaiter={promise:K,resolve:j,reject:Y}}let A=f.valueWaiter.promise;return W(h),kr(A,p,`${k(h)} was not ready within ${p}ms.`)},ne=(h,p)=>{let f=R(h);f.listeners.add(p);let S=_e(i,h);return p(S?ns(S):void 0),()=>f.listeners.delete(p)};function R(h){let p=P.get(h);if(p)return p;let f=ye(k(h),()=>s&&_e(i,h)!==void 0),S={listeners:new Set,latch:f,api:{value:(A)=>re(h,A),current:()=>_e(i,h)?.value,subscribe:(A)=>ne(h,A),park:(A,j)=>H(A,j),isReady:f.isReady,ready:f.ready}};return P.set(h,S),S}let M=(h)=>{if(b())throw Error(`KMS pool "${e}" verifier grant has no slots.`);let p=Cc(h),f=p>g;g=Math.max(g,p);let S=[];for(let A=0;A<p;A+=1)S.push(R(A).api);if(f&&s&&m&&C)ae(m,C);return S},G=(h)=>pn(i).find((p)=>p.value!==void 0&&os(h,p.value)),H=(h,p)=>{if(!s||!m||!C)return Promise.reject(Error(`KMS pool "${e}" is not configured.`));if(typeof h.value!=="string"||h.value.length===0)return Promise.reject(Error(`KMS pool "${e}" park() requires a non-empty value.`));let f=G(h.value);if(!f)return Promise.resolve({parked:!1,stale:!0});return kr(m.parkKmsKey(C,{keyId:f.id,status:h.status,reason:h.reason},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" park() did not complete within ${p}ms.`)},v=()=>{if(!s||!m||!C)throw Error(`KMS pool "${e}" is not configured.`);return{source:m,path:C}},U=(h)=>{if(!Array.isArray(h)||h.length===0)throw Error(`KMS pool "${e}" addKeys() requires a non-empty keys array.`);return h.map((p,f)=>{if(!p||typeof p!=="object")throw Error(`KMS pool "${e}" addKeys() keys[${f}] must be an object.`);if(typeof p.value!=="string"||p.value.length===0)throw Error(`KMS pool "${e}" addKeys() keys[${f}].value must be a non-empty string.`);if(p.id!==void 0&&(typeof p.id!=="string"||p.id.length===0))throw Error(`KMS pool "${e}" addKeys() keys[${f}].id must be a non-empty string when present.`);return p})},I=(h,p)=>{try{let{source:f,path:S}=v(),A=U(h);return kr(f.addKmsKeys(S,{keys:A},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" addKeys() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},x=(h,p)=>{try{let{source:f,path:S}=v();if(typeof h.keyId!=="string"||h.keyId.length===0)throw Error(`KMS pool "${e}" revokeKey() requires a non-empty keyId.`);return kr(f.revokeKmsKey(S,h,p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" revokeKey() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},N=(h)=>{let{source:p}=v();if(!p.subscribeEvents)throw Error(`KMS pool "${e}" events are not supported by this secrets transport.`);return E.add(h),ee(),()=>{E.delete(h)}};R(0);let w={value:(h)=>re(0,h),current:()=>_e(i,0)?.value,unique:M,accepts:(h)=>pn(i).some((p)=>p.value!==void 0&&os(h,p.value)),park:H,subscribe:(h)=>ne(0,h),beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:T.isReady,ready:T.ready},_={addKeys:I,revokeKey:x,events:N,isReady:l.isReady,ready:l.ready};return{api:w,issuer:_,update(h,p,f){let S=rs({config:h,path:f});if(s=!0,c===S){se();return}c=S,B(),Z(),ue(),i=void 0,se(),r(),ce(),F(),ae(p,f),ee()},unavailable(h){s=!0,c=rs(h),u+=1,m=void 0,C=void 0,Z(),B(),ue(),i=void 0,se(),r(),ce(),F()},remove(){if(!s)return;n.emitBefore(),s=!1,c=void 0,u+=1,m=void 0,C=void 0,Z(),B(),ue(),i=void 0,se(),r(),ce(),F(),n.emitAfter()},close(){s=!1,u+=1,m=void 0,C=void 0,Z(),E.clear(),B(),ue();for(let h of P.values())h.listeners.clear();i=void 0,F();for(let h of P.values())h.latch.settle();T.settle(),l.settle()},isConfigured:()=>s}}function as(e){let t=new Map,r=new Map,n=We(e,"KMS"),o=!1,i=ye("KMS module",()=>o&&Array.from(t.values()).every((m)=>!m.isConfigured()||m.api.isReady())),c,u=()=>i.refresh(),a=(m)=>{let C=t.get(m);if(C)return C;let P=Oc(m,e,u);if(t.set(m,P),!(m in c))Object.assign(c,{[m]:P.api});return P},d=(m)=>{let C=t.get(m);if(!C)throw Error(`KMS pool "${m}" is not configured.`);return C.api},g=(m)=>{let C=t.get(m);if(!C)throw Error(`KMS pool "${m}" is not configured.`);return C.issuer};return c={get config(){return Object.fromEntries(r)},beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:i.isReady,ready:i.ready,listPools:()=>Array.from(r.keys()),getPool:d,issuer:g},{handle:()=>c,update(m,C){if(!m&&!o&&t.size===0)return;n.emitBefore(),o=m!==void 0;let P=new Set(Object.keys(m??{}));for(let[E,O]of Object.entries(m??{})){r.set(E,{...O});let b=O.path??`/kms/${E}`;try{a(E).update(O,C(O),b)}catch(T){a(E).unavailable(O),e.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:E,error:T instanceof Error?T.message:String(T)})}}for(let[E,O]of t){if(P.has(E))continue;r.delete(E),O.remove()}return i.refresh(),n.emitAfter(),o||t.size>0?c:void 0},close(){for(let m of t.values())m.close();t.clear(),r.clear(),o=!1,i.settle()}}}import{formatLogLine as Ec}from"@ionite/core";import{context as Ac,trace as _c}from"@opentelemetry/api";import{logs as Lc,SeverityNumber as Ne}from"@opentelemetry/api-logs";import{OTLPLogExporter as Uc}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as xc}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as Mc}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as Wc}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as jc}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as $c}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as qc}from"@opentelemetry/resources";import{BatchLogRecordProcessor as Nc}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as Kc}from"@opentelemetry/sdk-metrics";import{NodeSDK as Vc}from"@opentelemetry/sdk-node";var cs={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},Fc={trace:!1,debug:!1,info:!0,warn:!0,error:!0},Dc={trace:Ne.TRACE,debug:Ne.DEBUG,info:Ne.INFO,warn:Ne.WARN,error:Ne.ERROR};function mn(e,t){let r=t[e];if(r===!1)return!1;if(e==="metrics")return r===!0||typeof r==="object";return!0}function yn(e){return typeof e==="object"&&e!==null?e:void 0}function zc(e){return typeof e==="object"&&e!==null?e:void 0}function Bc(e,t){let r=e.replace(/\/+$/,"");if(r.endsWith(cs[t]))return r;return`${r}${cs[t]}`}function Gc(e,t){let r=yn(e[t]);if(r?.endpoint)return r.endpoint;if(!e.endpoint)return;return Bc(e.endpoint,t)}function Jc(e,t,r){let n=yn(e[t]),o={...e.headers,...n?.headers??{}};if(r)o.Authorization=`Bearer ${r}`;return o}function wn(e,t,r){let n=yn(e[t]);return{url:Gc(e,t),headers:Jc(e,t,r),timeoutMillis:n?.timeoutMillis,concurrencyLimit:n?.concurrencyLimit}}function Hc(e,t){let r=wn(e,"traces",t);return e.protocol==="http/json"?new jc(r):new $c(r)}function Yc(e,t){let r=wn(e,"metrics",t);return e.protocol==="http/json"?new Mc(r):new Wc(r)}function Xc(e,t){let r=wn(e,"logs",t);return e.protocol==="http/json"?new Uc(r):new xc(r)}function Zc(e){return{"service.name":e.name,...e.version?{"service.version":e.version}:{},...e.deploymentEnvironment?{"deployment.environment.name":e.deploymentEnvironment}:{},...e.resourceAttributes??{}}}async function Qc(e){if(!e.oauth)return;let t=new URLSearchParams({grant_type:"client_credentials",client_id:e.oauth.clientId,client_secret:e.oauth.clientSecret});if(e.oauth.scope)t.set("scope",e.oauth.scope);if(e.oauth.audience)t.set("audience",e.oauth.audience);let r=await fetch(e.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...e.oauth.headers??{}},body:t});if(!r.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${r.status}`);let n=await r.json();if(typeof n.access_token!=="string"||!n.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return n.access_token}function eu(e,t){return{...Fc,...t?.levels??{},...e.levels??{}}}function Jt(e,t="Authorization"){let r={...e.headers??{}};if(!e.apiKey)return r;let n=e.apiKeyHeader??t;return r[n]=n.toLowerCase()==="authorization"?`Bearer ${e.apiKey}`:e.apiKey,r}function tu(e,t){return Object.keys(e).some((r)=>r.toLowerCase()===t.toLowerCase())}function ls(e,t,r){let n=Object.keys(e).find((o)=>o.toLowerCase().startsWith(t.toLowerCase()));if(n)throw Error(`OpenTelemetry provider "${r}" does not support provider-specific header "${n}".`)}function Ht(e,t,r,n){return{type:r,name:e.name,version:e.version,protocol:e.protocol??"http/protobuf",endpoint:e.endpoint,headers:n,resourceAttributes:Zc(e),levels:eu(e,t),console:e.console??"info",traces:e.traces,metrics:e.metrics,logs:e.logs}}function ru(e,t){return Ht(e,t,"otlp",Jt(e))}function nu(e,t){return Ht(e,t,"grafana-lgtm",Jt(e))}function ou(e,t){let r=Jt(e,"DD-API-KEY");if(!tu(r,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return Ht(e,t,"datadog",r)}function su(e,t){let r=Jt(e);return ls(r,"DD-","splunk"),Ht(e,t,"splunk",r)}function iu(e,t){let r=Jt(e);return ls(r,"DD-","elastic"),Ht(e,t,"elastic",r)}function au(e,t){let r=e.type??"otlp";switch(r){case"otlp":return ru(e,t);case"grafana-lgtm":return nu(e,t);case"datadog":return ou(e,t);case"splunk":return su(e,t);case"elastic":return iu(e,t);default:throw Error(`Unsupported OpenTelemetry provider type: ${r}`)}}function cu(e,t){if(typeof e==="string")return e;if(e instanceof Error)return e.message;if(e!=null)return gn(e);if(t.length===0)return"";return gn(t[0])}function gn(e){if(typeof e==="string")return e;try{return JSON.stringify(e)}catch{return String(e)}}function us(e,t,r){if(r==null)return;if(typeof r==="string"||typeof r==="number"||typeof r==="boolean"){e[t]=r;return}if(Array.isArray(r)&&r.every((n)=>["string","number","boolean"].includes(typeof n))){e[t]=r;return}if(r instanceof Error){if(e[`${t}.name`]=r.name,e[`${t}.message`]=r.message,r.stack)e[`${t}.stack`]=r.stack;return}e[t]=gn(r)}function uu(e){let t={};for(let[n,o]of e.entries()){if(o&&typeof o==="object"&&!Array.isArray(o)&&!(o instanceof Error)&&Object.getPrototypeOf(o)===Object.prototype){for(let[s,i]of Object.entries(o))us(t,s,i);continue}us(t,`param.${n}`,o)}let r=_c.getSpanContext(Ac.active());if(r)t.trace_id=r.traceId,t.span_id=r.spanId,t.trace_flags=r.traceFlags;return t}function du(e){return e}function lu(e,t){globalThis.console[du(e)](Ec(e,t.body,[t.attributes??{}]))}function fu(e,t,r,n){if(r.console==="off")return;if((t.severityNumber??0)<Dc[r.console])return;let o=n?.console;if(o){o(t);return}lu(e,t)}function pu(e,t){let r=Lc.getLogger(e.name,e.version),n=(o,s,i)=>{if(!e.levels[o])return;let c={severityNumber:s,severityText:o.toUpperCase(),body:cu(i[0],i.slice(1)),attributes:uu(i.slice(1))};try{r.emit(c)}finally{fu(o,c,e,t)}};return{trace:(o,...s)=>n("trace",Ne.TRACE,[o,...s]),debug:(o,...s)=>n("debug",Ne.DEBUG,[o,...s]),info:(o,...s)=>n("info",Ne.INFO,[o,...s]),warn:(o,...s)=>n("warn",Ne.WARN,[o,...s]),error:(o,...s)=>n("error",Ne.ERROR,[o,...s])}}function mu(e){return e?.current()}function gu(e,t,r){let n=t;return e.subscribe((o)=>{let s=o?.value;if(s===n)return;n=s,r()})}function ds(e){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:e,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function hn(e,t,r,n){if(!t&&!r)return;if(!t)return ds(e);let o=t,s;if(o.apiKeyPool&&n)try{s=n.getPool(o.apiKeyPool)}catch{s=void 0}let i=mu(s),c=()=>hn(e,o,r,n),u=o.apiKeyPool&&n?(T)=>gu(n.getPool(o.apiKeyPool),i,T):void 0;if(o.apiKeyPool&&!i){let T=ds(e);return T.onCredentialChange=u,T.rebuild=c,T}let a=i?{...o,apiKey:i}:o,d=au(a,r),g,m=!1,C=pu(d,r),P,E,O=new Promise((T,l)=>{P=T,E=l});async function b(){try{let T=await Qc(o),l={resource:qc(d.resourceAttributes),instrumentations:r?.instrument};if(r?.sampler)l.sampler=r.sampler;if(r?.textMapPropagator)l.textMapPropagator=r.textMapPropagator;if(r?.contextManager)l.contextManager=r.contextManager;if(r?.spanProcessors)l.spanProcessors=r.spanProcessors;else if(mn("traces",d))l.traceExporter=Hc(d,T);if(r?.metricReaders)l.metricReaders=r.metricReaders;else if(mn("metrics",d)){let W=zc(d.metrics);l.metricReaders=[new Kc({exporter:Yc(d,T),exportIntervalMillis:W?.exportIntervalMillis,exportTimeoutMillis:W?.exportTimeoutMillis})]}if(r?.logRecordProcessors)l.logRecordProcessors=r.logRecordProcessors;else if(mn("logs",d))l.logRecordProcessors=[new Nc({exporter:Xc(d,T)})];let k=r?.configure?.(l);g=new Vc(k??l),g.start(),m=!0,P?.()}catch(T){m=!1;let l=T instanceof Error?T:Error(String(T));e.error?.("OpenTelemetry startup failed",l),E?.(l)}finally{P=void 0,E=void 0}}return{state:"available",start:b,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>m,ready:(T)=>{if(!T||T<=0)return O;return Promise.race([O,new Promise((l,k)=>{setTimeout(()=>k(Error(`OpenTelemetry ready timed out after ${T}ms.`)),T)})])},logger:C,forceFlush:async()=>{await g?.forceFlush?.()},shutdown:async()=>{m=!1,await g?.shutdown(),g=void 0},onCredentialChange:u,rebuild:c}}function fs(e){let t,r,n,o=0,s=Promise.resolve(),i=We(e,"OpenTelemetry"),c=ye("OpenTelemetry module",()=>t?.isReady()===!0),u={beforeChange:i.beforeChange,afterChange:i.afterChange,isReady:c.isReady,ready:c.ready,logger:{trace:(g,...m)=>(t?.logger??e).trace(g,...m),debug:(g,...m)=>(t?.logger??e).debug(g,...m),info:(g,...m)=>(t?.logger??e).info(g,...m),warn:(g,...m)=>(t?.logger??e).warn(g,...m),error:(g,...m)=>(t?.logger??e).error(g,...m)},forceFlush:async()=>{await t?.forceFlush()},shutdown:async()=>{await t?.shutdown()}},a=!1,d;return d={update(g){if(!g){if(t||r){let E=t,O=r;o+=1,i.emitBefore(),n?.(),n=void 0,t=void 0,r=void 0,c.refresh(),s=Promise.all([E?.shutdown(),O?.shutdown()]).finally(()=>i.emitAfter()).then(()=>{return},()=>{return})}return a?u:void 0}if(a=!0,g===t||g===r)return u;let m=t,C=r;o+=1;let P=o;return i.emitBefore(),n?.(),n=void 0,t=void 0,r=g,c.refresh(),s=(async()=>{try{if(await Promise.all([m?.shutdown(),C?.shutdown()]),await g.start(),P!==o||r!==g){await g.shutdown();return}t=g,r=void 0,c.refresh(),n=g.onCredentialChange?.(()=>{if(t!==g)return;let E=g.rebuild?.();if(E)d.update(E)})}finally{if(P===o)i.emitAfter()}})().then(()=>{return},()=>{return}),u},settled(){return s},async shutdown(){o+=1;let g=t,m=r;n?.(),n=void 0,t=void 0,r=void 0,c.settle(),await Promise.all([g?.shutdown(),m?.shutdown()])}},d}import{ION_ENDPOINT_PERMISSIONS as Ot,trimTrailingSlash as ps}from"@ionite/core";import{hasPermission as yu}from"@ionite/core/server";async function pt(e,t,r){let n=await yu(e,t,r.permission,void 0,r.subjectType);return n.allow?void 0:n.response()}function wu(e){let t=ps(e);return{matchesPath:(o)=>{if(!o)return!1;return ps(o)===t},startsWithPath:(o)=>{if(!o)return!1;return e===o||e.startsWith(`${o}/`)}}}function ms(e,t,r,n){let o=n??new URL(e.url).pathname,{matchesPath:s,startsWithPath:i}=wu(o);if(t.sso){let c=t.sso;if(s(r.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(u)=>c.handler(u)};if(s(r.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(u)=>c.logout(u)};if(s(r.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(u)=>c.logoutBackChannel(u)};if(s(r.sso.loginUrl)||s(r.sso.refreshUrl)||s(r.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(u)=>c.handler(u)}}if(t.ciam){let c=t.ciam;if(s(r.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(u)=>{let a=await c.resolveCustomer(u);if(a.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(a.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(a.value),{headers:{"Content-Type":"application/json"}})}};if(s(r.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(u)=>c.logout(u)}}if(t.iam){let c=t.iam,u=e.method!=="GET"&&e.method!=="HEAD";if(i(r.iam.usersUrl))return{module:"iam",kind:u?"iam.users.write":"iam.read",requiredPermission:Ot[u?"iam.users.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.groupsUrl))return{module:"iam",kind:u?"iam.groups.write":"iam.read",requiredPermission:Ot[u?"iam.groups.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.workloadsUrl))return{module:"iam",kind:u?"iam.workloads.write":"iam.read",requiredPermission:Ot[u?"iam.workloads.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.customersUrl))return{module:"iam",kind:u?"iam.customers.write":"iam.read",requiredPermission:Ot[u?"iam.customers.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(`${r.iam.basePath}/AccessRequests`))return{module:"iam",kind:"iam.access-requests.write",requiredPermission:Ot["iam.access-requests.write"],handler:async(a)=>c.handler(a)};if(i(r.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(a)=>c.handler(a)}}if(t.workload){let c=t.workload;if(s(r.workload.validateUrl)||s(r.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(u)=>c.handler(u)}}if(t.secrets){let c=t.secrets;if(c.isLfvDeliveryRequest?.(e)&&c.handleLfvDelivery){let u=c.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(a)=>u(a)}}if(c.isLfvEventsRequest?.(e)&&c.handleLfvEvents){let u=c.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(a)=>u(a)}}}if(t.ciam){let c=t.ciam;if(s(r.ciam.magicLinkUrl)&&e.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:Ot["ciam.magic-link.create"],handler:async(u)=>c.handler(u)};if(s(r.ciam.magicLinkLoginUrl)&&e.method==="GET"||s(r.ciam.customerProvidersUrl)&&e.method==="GET"||s(r.ciam.customerLoginUrl)&&e.method==="GET"||s(r.ciam.customerCallbackUrl)&&(e.method==="GET"||e.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(u)=>c.handler(u)}}return}async function vn(e,t,r,n){let o=n??Fe(ar()),s=new URL(e.url).pathname;if(r?.filter){let g=await r.filter(e,t);if(g instanceof Response)return g;if(g==="not_handled")return me()}let i=ms(e,t,o,s),u=await r?.resolve?.(e,t,i)??i;if(!u)return me();let a=u.requiredPermission===void 0?i?.requiredPermission:u.requiredPermission,d=async()=>{if(a){let g=await pt(e,t,a);if(g)return g}return u.handler(e)};if(r?.wrap)return await r.wrap(e,u,d,t);return await d()}import{stableConfigHash as $u}from"@ionite/core";function br(){let e=0;return{next:()=>(e+=1,e),isCurrent:(t)=>t===e,current:()=>e}}import{readFile as Uu,stat as xu}from"node:fs/promises";class Et extends Error{constructor(e,t,r){super(e);this.code=t;this.status=r;this.sourceType="vault";this.name="VaultWebSocketCommandError"}}class Be extends Error{constructor(e,t=`Vault secret not found at path ${e}`){super(t);this.path=e;this.sourceType="vault";this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}}class ge extends Error{constructor(e,t,r,n,o){super(e,o);this.path=t;this.status=r;this.code=n;this.sourceType="vault";this.name="VaultRequestError"}}class Le extends Error{constructor(e,t,r=`Vault subscribe is not supported for source ${e} at path ${t} without websocket, LFV, or ttl`){super(r);this.sourceType=e;this.path=t;this.name="VaultSubscribeNotSupportedError"}}function gs(e){return e instanceof Be||e instanceof Et&&(e.code==="not_found"||e.status===404)}import{WebSocket as Yt}from"ws";var hu=1000,vu=30000,ws=30000,hs=ws;function vs(e){hs=e>0?e:ws}function Ss(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Su(e){let t=Math.min(vu,hu*2**Math.min(e,16)),r=0.5+Math.random()*0.5;return Math.round(t*r)}var mt=new Map;function ku(e){return e.trim().replace(/\/+$/g,"")}function ks(e,t){let r=typeof t?.version==="number"?t.version:0,n=t?.created_time??t?.created,o=typeof n==="string"?new Date(n):new Date,s=ut(t);return{path:e,version:r,created:o,...s?{contentType:s}:{}}}function bu(e){return typeof e?.version==="number"?e.version:void 0}function Ru(e){let t=e.token?.trim();if(!t)return{};if(e.header==="Authorization")return{Authorization:t.startsWith("Bearer ")?t:`Bearer ${t}`};return{"X-Vault-Token":t}}function Xt(e){return{client_id:e.clientId,token:e.token,header:e.header??"X-Vault-Token"}}function kn(e,t){let r=ku(e),n=mt.get(r);if(n){if(t&&!n.log)n.log=t;return n}let o={url:r,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:t};return mt.set(r,o),o}function Cu(e){let t=[...Array.from(e.subs.values(),(o)=>o.creds),...e.eventListeners.values()];if(t.length===0)return e.lastGoodCreds??{url:e.url};let r=e.lastGoodCreds?[e.lastGoodCreds,...t]:t,n=r[e.reconnectCredCursor%r.length]??t[0];return e.reconnectCredCursor+=1,n}function ys(e,t){for(let r of e.subs.values())try{r.onHealth?.(t)}catch(n){e.log?.warn("Vault websocket health hook threw",n)}}function Tu(e,t){for(let r of Array.from(e.subs.values())){let n=r.onFirstSecretReject;if(r.onFirstSecret=void 0,r.onFirstSecretReject=void 0,n)try{n(new ge(`Vault websocket subscription interrupted (${t})`,r.path,void 0,"connection"))}catch(o){e.log?.warn("Vault websocket first-secret waiter rejection threw",o)}}}function bs(e,t){for(let r of e.pending.values())clearTimeout(r.timer),r.reject(new ge(`Vault websocket command interrupted (${t})`,"/",void 0,"connection"));e.pending.clear()}function Rr(e){if(e.disposed)return;if(e.disposed=!0,e.reconnectTimer)clearTimeout(e.reconnectTimer),e.reconnectTimer=void 0;bs(e,"closed"),Tu(e,"socket disposed");let t=e.ws;if(e.ws=void 0,e.connectPromise=void 0,e.hasConnected=!1,mt.delete(e.url),t)try{t.removeAllListeners(),t.close()}catch{}}function Cr(e){if(e.subs.size>0||e.pending.size>0||e.eventListeners.size>0)return;Rr(e)}function Sn(e){return`${e.clientId??""}|${e.token??""}|${e.header??"X-Vault-Token"}`}function Rs(e){let t=new Map;for(let r of e.eventListeners.values())t.set(Sn(r),r);return Array.from(t.values())}function Pu(e,t){if(typeof t.path!=="string"||typeof t.event!=="string")return;let r={path:t.path,event:t.event,...typeof t.request_id==="string"?{requestId:t.request_id}:{},...typeof t.key_id==="string"&&t.key_id.length>0?{keyId:t.key_id}:{}};for(let n of e.eventListeners.keys())try{n(r)}catch(o){e.log?.warn("Vault websocket event listener threw",o)}}function Cs(e,t,r,n){if(n!==void 0&&t.lastVersion!==void 0&&n===t.lastVersion)return;if(n!==void 0)t.lastVersion=n;try{t.onChange(r)}catch(s){e.log?.warn("Vault websocket subscription onChange threw",s)}let o=t.onFirstSecret;if(t.onFirstSecret=void 0,t.onFirstSecretReject=void 0,o)try{o()}catch(s){e.log?.warn("Vault websocket subscription onFirstSecret threw",s)}}function Iu(e,t){let r=t.subscription_id;if(typeof r!=="string")return;let n=e.subs.get(r);if(!n)return;let o={data:t.data,metadata:ks(typeof t.path==="string"?t.path:n.path,t.metadata)};Cs(e,n,o,bu(t.metadata))}function Ou(e,t){let r;try{r=JSON.parse(t.toString())}catch(n){e.log?.warn("Vault websocket message parse failed",n);return}if(r.type==="secret"){Iu(e,r);return}if(r.type==="event"){Pu(e,r);return}if(r.type==="command_result"&&typeof r.id==="string"){let n=e.pending.get(r.id);if(!n)return;if(e.pending.delete(r.id),clearTimeout(n.timer),r.ok===!1)n.reject(new Et(r.error??`Vault websocket command failed for ${r.id}`,r.code,r.status));else n.resolve(r.result);Cr(e)}}function Ts(e,t){e.send(JSON.stringify({type:"subscribe",subscription_id:t.subscriptionId,paths:[t.path],...Ss(t.kmsSlots),...Xt(t.creds)}))}function bn(e){if(e.disposed||e.reconnectTimer||e.subs.size===0&&e.eventListeners.size===0)return;let t=Su(e.reconnectAttempts);e.reconnectAttempts+=1,e.reconnectTimer=setTimeout(()=>{if(e.reconnectTimer=void 0,e.disposed)return;if(e.subs.size===0&&e.eventListeners.size===0){Rr(e);return}Tr(e,Cu(e)).catch(()=>{if(e.hasConnected)e.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${t}ms).`);bn(e)})},t)}function Tr(e,t){if(e.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if(e.ws&&e.ws.readyState===Yt.OPEN)return Promise.resolve(e.ws);if(e.connectPromise)return e.connectPromise;return e.connectPromise=new Promise((r,n)=>{let o=new Yt(e.url,{headers:Ru(t)}),s=!1,i=e.hasConnected,c=()=>{s=!0,e.hasConnected=!0,e.reconnectAttempts=0,e.reconnectCredCursor=0,e.lastGoodCreds=t,e.ws=o,e.connectPromise=void 0,o.on("message",(d)=>Ou(e,d));for(let d of e.subs.values())try{Ts(o,d)}catch{}for(let d of Rs(e))try{o.send(JSON.stringify({type:"subscribe_events",...Xt(d)}))}catch{}if(i)ys(e,!0);r(o)},u=()=>{if(e.ws===o)e.ws=void 0;e.connectPromise=void 0;try{o.removeAllListeners()}catch{}if(bs(e,"socket closed"),e.subs.size>0||e.eventListeners.size>0)ys(e,!1),bn(e);else Rr(e)},a=(d)=>{if(e.ws===o)e.ws=void 0;if(!s)s=!0,e.connectPromise=void 0,n(d)};o.once("open",c),o.on("close",u),o.on("error",a)}),e.connectPromise}async function Rn(e,t,r,n){let o=kn(e.url,n),s=typeof r.path==="string"?r.path:"/",i=await Tr(o,e),c=crypto.randomUUID();try{return await new Promise((u,a)=>{let d=setTimeout(()=>{if(!o.pending.has(c))return;o.pending.delete(c),a(new ge(`Vault websocket command "${t}" timed out`,s,void 0,"timeout"));try{o.ws?.close()}catch{}},hs);o.pending.set(c,{resolve:(g)=>u(g),reject:a,timer:d});try{i.send(JSON.stringify({type:"command",id:c,command:t,...r,...Xt(e)}))}catch(g){clearTimeout(d),o.pending.delete(c),a(g)}})}finally{Cr(o)}}async function Cn(e,t,r,n){let o;try{o=await Rn(e,"read_secret",{path:t,...Ss(n)},r)}catch(s){if(gs(s))throw new Be(t);if(s instanceof Et||s instanceof ge)throw s;throw new ge(`Vault websocket read_secret failed for ${t}`,t,void 0,"connection",{cause:s})}if(!o||typeof o!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${t}`);return{data:o.data,metadata:ks(typeof o.path==="string"?o.path:t,o.metadata)}}async function Ps(e,t,r,n,o,s){let i=kn(e.url,o),c=crypto.randomUUID(),u={subscriptionId:c,creds:e,path:t,...n?.kmsSlots!==void 0?{kmsSlots:n.kmsSlots}:{},onChange:r,onHealth:s?.onHealth};i.subs.set(c,u);let a=()=>{if(!i.subs.delete(c))return;if(i.ws&&i.ws.readyState===Yt.OPEN)try{i.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:c}))}catch{}Cr(i)};try{let d=await Tr(i,e);Ts(d,u)}catch(d){if(n?.mode!=="wait")throw a(),d}try{let d=await Cn(e,t,o,n?.kmsSlots);Cs(i,u,d,d.metadata.version)}catch(d){if(n?.mode!=="wait")throw a(),d;await new Promise((g,m)=>{let C,P=(E)=>{if(C)clearTimeout(C);u.onFirstSecret=void 0,u.onFirstSecretReject=void 0,a(),m(E)};if(u.onFirstSecret=()=>{if(C)clearTimeout(C);g()},u.onFirstSecretReject=P,typeof n.timeout==="number"&&n.timeout>0)C=setTimeout(()=>P(d),n.timeout)})}return a}async function Is(e,t,r){let n=kn(e.url,r);n.eventListeners.set(t,e);try{let o=await Tr(n,e);if(o.readyState===Yt.OPEN)o.send(JSON.stringify({type:"subscribe_events",...Xt(e)}))}catch(o){n.log?.warn("Vault websocket event subscription connect failed; retrying in background",o),bn(n)}return()=>{if(!n.eventListeners.delete(t))return;let o=Sn(e);if(!Rs(n).some((i)=>Sn(i)===o)&&n.ws&&n.ws.readyState===Yt.OPEN)try{n.ws.send(JSON.stringify({type:"unsubscribe_events",...Xt(e)}))}catch{}Cr(n)}}function Os(){let e=0;for(let t of mt.values())e+=t.subs.size;return{urls:Array.from(mt.keys()),sockets:mt.size,subscriptions:e}}function Es(){for(let e of Array.from(mt.values()))Rr(e)}var Pr=600000;function gt(e){if(e&&e<Pr)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${Pr} milliseconds (10 minutes), as not to overload the store with polling requests`)}function Ge(e,t,r,n,o,s,i){let c=!1,u,a,d,g=(b)=>{try{i?.onHealth?.(b)}catch{}},m=()=>{if(c=!0,u)clearTimeout(u),u=void 0;a?.()},C=(b)=>new Promise((T)=>{let l=setTimeout(()=>{a=void 0,u=void 0,T()},b);u=l,a=()=>{clearTimeout(l),a=void 0,u=void 0,T()}});async function P(){let b=Date.now();for(;;){if(c)return;try{let T=await e.getFullSecret(t,s);return g(!0),T}catch(T){if(g(!1),s?.mode!=="wait")throw T;if(typeof s.timeout==="number"&&s.timeout>0&&Date.now()-b>=s.timeout)throw T;if(c)return;o?.warn(`Error retrieving initial secret from vault. Retrying in ${n} milliseconds`,T),await C(n)}}}async function E(){if(u=void 0,c)return;try{let b=await e.getFullSecret(t,s);if(g(!0),b.metadata.version!==d)d=b.metadata.version,r(b)}catch(b){g(!1),o?.warn(`Error retrieving remote config from vault. Retrying in ${n} milliseconds`,b)}O()}function O(){if(c)return;u=setTimeout(()=>{E()},n)}return P().then((b)=>{if(c||!b)return()=>m();return d=b.metadata.version,r(b),O(),()=>m()})}function Eu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Au(e){let t={"Content-Type":"application/json"};if(e)t["X-Vault-Token"]=e;return t}function _u(e){return Boolean(e?.idpTokenUrl?.trim()&&e.clientId?.trim()&&e.clientSecret?.trim())}async function As(e,t){let r=Date.now();if(t.token&&t.expiresAt&&t.expiresAt-60000>r)return t.token;let n=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});if(e.scope?.trim())n.set("scope",e.scope.trim());let o=await fetch(e.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()});if(!o.ok)throw Error(`Vault workload token request failed (${o.status})`);let s=await o.json();if(!s.access_token)throw Error("Vault workload token response did not include access_token");return t.token=s.access_token,t.expiresAt=r+Math.max(1,s.expires_in??300)*1000,s.access_token}function Lu(e){return{Authorization:e.startsWith("Bearer ")?e:`Bearer ${e}`}}function Zt(e){return e.replace(/\/data\/?$/,"")}function _s(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let n=e;if(typeof n.parked!=="boolean")throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let o=n.disposition;if(o!==void 0&&o!=="cooldown"&&o!=="suspect")throw Error(`Vault ${r} kms_park returned invalid disposition for ${t}`);return{parked:n.parked,...n.stale===!0?{stale:!0}:{},...o?{disposition:o}:{}}}function Ls(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);let n=e;if(!Array.isArray(n.keys))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);return{keys:n.keys.map((s,i)=>{if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}] for ${t}`);let c=s.id;if(typeof c!=="string"||c.length===0)throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}].id for ${t}`);return{id:c}})}}function Us(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);let n=e;if(typeof n.revoked!=="boolean")throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);return{revoked:n.revoked}}function At(e,t){let{type:r="vault",url:n,token:o,ttl:s}=e,i=()=>e.log,c=_u(e.workload)?e.workload:void 0,u={},a=Au(o),{lfv:d,websocket:g}=e,m=d?lt({...d,log:d.log??i(),path:d.path??"/"},t):void 0,C=new Map,P=g?.url?.trim(),E=new Set,O=!1,b=!1;if(!d&&!n&&!P)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(gt(s),n&&!o&&!c&&!d)i()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function T(){if(c){let w=await As(c,u);return{"Content-Type":"application/json",...Lu(w)}}return{...a}}async function l(w){let _=F(w);if(c){let h=await As(c,u);return{url:_,clientId:g?.clientId??c.clientId,token:h,header:"Authorization"}}return{url:_,clientId:g?.clientId,token:g?.token??o,header:g?.header??"X-Vault-Token"}}function k(w){if(!d)throw Error(`Vault LFV capability is not configured for path ${w}`);let _=C.get(w);if(_)return _;let h=lt({...d,log:d.log??i(),path:w},t);return C.set(w,h),h}function W(w){if(!n)throw Error(`Vault HTTP capability is not configured for path ${w}`);return n}function F(w){if(!P)throw Error(`Vault websocket capability is not configured for path ${w}`);return P}async function Q(w,_){let h=await l(typeof _.path==="string"?_.path:"/");return Rn(h,w,_,i())}async function ce(w,_){let h=W(w),p;try{let f=await T(),S=new URL(`${h}/${w}`);if(typeof _?.kmsSlots==="number"&&Number.isInteger(_.kmsSlots)&&_.kmsSlots>=1)S.searchParams.set("kms_slots",String(_.kmsSlots));p=await fetch(S,{headers:f})}catch(f){throw new ge(`Vault request failed from URL: ${h}/${w}`,w,void 0,"connection",{cause:f})}if(p.status!==200){if(p.status===404)throw new Be(w);let f=p.status===401||p.status===403,S=f?`Vault returned ${p.status} ${p.statusText} (auth error) from URL: ${h}/${w}`:`Vault returned invalid status, ${p.status}: '${p.statusText}' from URL: ${h}/${w}`;throw new ge(S,w,p.status,f?"auth":"invalid_status")}try{let S=(await p.json()).data;if(!S?.metadata||!("data"in S))throw Error("Missing vault secret data");let A=S.metadata.created_time??S.metadata.created;return{data:S.data,metadata:{path:typeof S.metadata.path==="string"?S.metadata.path:w,version:typeof S.metadata.version==="number"?S.metadata.version:0,created:A instanceof Date?A:typeof A==="string"?new Date(A):new Date,...ut(S.metadata)?{contentType:ut(S.metadata)}:{}}}}catch(f){throw new ge("Error retrieving secret",w,void 0,"invalid_payload",{cause:f})}}async function se(w,_){let h=await l(w);return Cn(h,w,i(),_?.kmsSlots)}async function Z(w){let _=W(w),h=`${Zt(_)}/metadata/${w}`,p=await T(),f=await fetch(h,{headers:p});if(f.status!==200)throw new ge(`Vault getMetadata failed (${f.status}) for ${w}`,w,f.status,"invalid_status");let S=await f.json().catch(()=>null);if(!S?.metadata||typeof S.metadata!=="object")throw new ge(`Vault getMetadata returned invalid payload for ${w}`,w,f.status,"invalid_payload");return S.metadata}async function ee(w,_,h){let p=W(_),f=`${Zt(p)}/${w}/${_}`,S=await T(),A=await fetch(f,{method:"POST",headers:S,body:JSON.stringify({reason:h?.reason,severity:h?.severity,incident_ref:h?.incidentRef})});if(A.status!==200&&A.status!==202&&A.status!==204)throw new ge(`Vault ${w} failed (${A.status}) for ${_}`,_,A.status,"invalid_status")}async function ue(w,_){if(d)return await k(w).getFullSecret(w,_);if(n)return await ce(w,_);return await se(w,_)}async function z(w,_,h){if(!Eu(_))throw Error(`putSecret requires an object value for vault source at path ${w}`);if(d){await k(w).putSecret(w,_,h);return}if(n){let p=W(w),f=await T();if(f["X-Ionite-Mime-Type"]=h.contentType.mimeType,f["X-Ionite-Secret-Format"]=h.contentType.format,h.contentType.schemaUrl)f["X-Ionite-Schema-Url"]=h.contentType.schemaUrl;if(h.contentType.typeId)f["X-Ionite-Secret-Type"]=h.contentType.typeId;let S=await fetch(`${p}/${w}`,{method:"POST",headers:f,body:JSON.stringify(_)});if(S.status!==200&&S.status!==201&&S.status!==204)throw new ge(`Vault putSecret failed (${S.status}) for ${w}`,w,S.status,"invalid_status");return}await Q("put_secret",{path:w,data:_,content_type:mr(h.contentType)})}async function J(w,_){if(d){await k(w).deleteSecret(w,_);return}if(n){let h=W(w),p=await T(),f=await fetch(`${h}/${w}`,{method:"DELETE",headers:p});if(f.status!==200&&f.status!==202&&f.status!==204)throw new ge(`Vault deleteSecret failed (${f.status}) for ${w}`,w,f.status,"invalid_status");return}await Q("delete_secret",{path:w})}async function B(w,_){if(d)return await k(w).listPaths(w,_);if(n){let f=`${W(w)}/${w}`,S=async(K)=>{let oe=await T();if(K==="LIST")return fetch(f,{method:"LIST",headers:oe});let te=f.includes("?")?"&":"?";return fetch(`${f}${te}list=true`,{method:"GET",headers:oe})},A=await S("LIST");if(A.status===405||A.status===501)A=await S("GET");if(A.status!==200)throw new ge(`Vault listPaths failed (${A.status}) for ${w}`,w,A.status,"invalid_status");let j=await A.json().catch(()=>null),Y;if(j&&typeof j==="object"){let K=j,oe=K.data;if(oe&&typeof oe==="object")Y=oe.keys;else Y=K.keys}if(!Array.isArray(Y))throw new ge(`Vault listPaths returned an unexpected response for ${w}`,w,void 0,"invalid_payload");return Y.filter((K)=>typeof K==="string")}let h=await Q("list_paths",{path:w});if(!Array.isArray(h.items))throw Error(`Vault websocket list_paths returned invalid payload for ${w}`);return h.items.filter((p)=>typeof p==="string")}async function ae(w,_){if(d)return await k(w).exists(w,_);if(n){let p=W(w),f=await T(),S=await fetch(`${p}/${w}`,{headers:f});if(S.status===200)return!0;if(S.status===404)return!1;if(S.status===401||S.status===403)throw new ge(`Vault exists failed (${S.status}) for ${w} (auth error)`,w,S.status,"auth");throw new ge(`Vault exists failed (${S.status}) for ${w}`,w,S.status,"invalid_status")}let h=await Q("exists",{path:w});if(typeof h.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${w}`);return h.exists}async function re(w,_,h){if(d){await k(w).requestRotate(w,_,h);return}if(n){await ee("rotate/request",w,_);return}await Q("request_rotate",{path:w,reason:_?.reason,severity:_?.severity,incident_ref:_?.incidentRef})}async function ne(w,_,h){if(d){await k(w).requestRevoke(w,_,h);return}if(n){await ee("revoke/request",w,_);return}await Q("request_revoke",{path:w,reason:_?.reason,severity:_?.severity,incident_ref:_?.incidentRef})}async function R(w,_,h){if(d)return await k(w).parkKmsKey(w,_,h);if(n){let f=W(w),S=`${Zt(f)}/kms/park/${w}`,A=await T(),j=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({key_id:_.keyId,status:_.status,reason:_.reason})});if(j.status!==200&&j.status!==202)throw new ge(`Vault kms/park failed (${j.status}) for ${w}`,w,j.status,"invalid_status");return _s(await j.json().catch(()=>null),w,"http")}let p=await Q("kms_park",{path:w,key_id:_.keyId,status:_.status,reason:_.reason});return _s(p,w,"websocket")}async function M(w,_,h){if(d)return await k(w).addKmsKeys(w,_,h);if(n){let f=W(w),S=`${Zt(f)}/kms/add-keys/${w}`,A=await T(),j=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({keys:_.keys})});if(j.status!==200&&j.status!==202)throw new ge(`Vault kms/add-keys failed (${j.status}) for ${w}`,w,j.status,"invalid_status");return Ls(await j.json().catch(()=>null),w,"http")}let p=await Q("kms_add_keys",{path:w,keys:_.keys});return Ls(p,w,"websocket")}async function G(w,_,h){if(d)return await k(w).revokeKmsKey(w,_,h);if(n){let f=W(w),S=`${Zt(f)}/kms/revoke-key/${w}`,A=await T(),j=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({key_id:_.keyId,reason:_.reason})});if(j.status!==200&&j.status!==202)throw new ge(`Vault kms/revoke-key failed (${j.status}) for ${w}`,w,j.status,"invalid_status");return Us(await j.json().catch(()=>null),w,"http")}let p=await Q("kms_revoke_key",{path:w,key_id:_.keyId,reason:_.reason});return Us(p,w,"websocket")}async function H(w,_){if(d)return await k(w).getMetadata(w,_);if(n)return await Z(w);let h=await Q("read_metadata",{path:w});if(!h.metadata||typeof h.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${w}`);return h.metadata}async function v(w,_,h){if(!s)throw new Le(r,w);return Ge({getFullSecret:ce},w,_,s,i(),h,{onHealth:(p)=>{O=!p}})}async function U(w,_,h){let p=await l(w);return Ps(p,w,_,h,i(),{onHealth:(f)=>{b=!f}})}function I(w){let _=()=>{if(E.delete(_))w()};return E.add(_),_}function x(){if(m?.isAvailable?.()===!1)return!0;for(let w of C.values())if(w.isAvailable?.()===!1)return!0;return!1}let N={type:r,isAvailable:()=>!O&&!b&&!x(),get:(w,_)=>qe(()=>ue(w,_)),getFullSecret:ue,getSecret:async(w,_)=>(await ue(w,_)).data,putSecret:z,deleteSecret:J,listPaths:B,exists:ae,requestRotate:re,requestRevoke:ne,parkKmsKey:R,addKmsKeys:M,revokeKmsKey:G,getMetadata:H,subscribe:async(w,_,h)=>{let p;if(P)p=await U(w,_,h);else if(d)p=await k(w).subscribe(w,_,h);else p=await v(w,_,h);return I(p)},...m?{subscribeEvents:(w)=>I(m.subscribeEvents?.(w)??(()=>{}))}:P?{subscribeEvents:(w)=>{let _,h=!1;return l("/").then((p)=>Is(p,w,i())).then((p)=>{if(h){p();return}_=p}).catch((p)=>{i()?.warn("Vault websocket event subscription failed",p)}),I(()=>{h=!0,_?.()})}}:{},close:()=>{for(let _ of Array.from(E))try{_()}catch(h){i()?.warn("Vault source close: failed to release a subscription",h)}E.clear();let w=(_)=>{if(!_?.close)return;try{Promise.resolve(_.close()).catch((h)=>{i()?.warn("Vault source close: LFV close failed",h)})}catch(h){i()?.warn("Vault source close: LFV close failed",h)}};for(let _ of C.values())w(_);w(m),C.clear(),u.token=void 0,u.expiresAt=void 0},get log(){return e.log},set log(w){e.log=w}};if(m)N.isDeliveryRequest=(w)=>m.isDeliveryRequest(w),N.isEventsRequest=(w)=>m.isEventsRequest(w),N.handleDelivery=(w)=>m.handleDelivery(w),N.handleEvents=(w)=>m.handleEvents(w),Object.defineProperties(N,{deliveryPath:{value:m.deliveryPath,enumerable:!0},eventsPath:{value:m.eventsPath,enumerable:!0},callbackKey:{value:m.callbackKey,enumerable:!0},trustId:{value:m.trustId,enumerable:!0}});return N}class Or extends Error{constructor(e,t){super(e);this.name="AzureKeyVaultError",this.status=t,Object.setPrototypeOf(this,Or.prototype)}}function Ir(e,t){if(!e||e.trim().length===0)throw Error(`Missing required Azure config: ${t}`);return e}function Mu(e){return e.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function Tn(e,t){return`${e.replace(/\/+$/g,"")}/${t.replace(/^\/+/g,"")}`}function Wu(e){try{let r=new URL(e).pathname.split("/").filter(Boolean),n=r.indexOf("secrets");if(n===-1)return;return r[n+2]||void 0}catch{return}}function ju(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Er(e){let t=e.apiVersion??"7.4",r=e.scope??"https://vault.azure.net/.default",n=e.secretNameTransform??Mu,o=e.authMethod,s="/var/run/secrets/azure/tokens/azure-identity-token",i=e.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",c=e.vaultUrl??(e.vaultName?`https://${e.vaultName}.vault.azure.net`:void 0)??void 0,u=Ir(c,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function a(z){try{return await xu(z),!0}catch{return!1}}let d,g,m=!1;async function C(z){let{entraTenantId:J,clientId:B}=e;if(!J)throw Error("Workload identity requires entraTenantId");if(!B)throw Error("Workload identity requires clientId");if(!await a(i))throw Error(`Federated token file not found at ${i}`);let ae=(await Uu(i,"utf8")).trim();if(!ae)throw Error("Federated token file was empty");let re=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:B,grant_type:"client_credentials",scope:r,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:ae}),R=await fetch(re,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:ne});if(R.status!==200)throw Error(`Azure workload identity token exchange returned ${R.status} ${R.statusText}`);let M=await R.json();if(!M?.access_token)throw Error("Azure token response missing access_token");return d={accessToken:M.access_token,expiresAtMs:z+(M.expires_in??0)*1000},M.access_token}async function P(z){let J=e.imdsApiVersion??"2018-02-01",B="https://vault.azure.net",ae=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(ae.searchParams.set("api-version",J),ae.searchParams.set("resource","https://vault.azure.net"),e.managedIdentityClientId)ae.searchParams.set("client_id",e.managedIdentityClientId);let re=await fetch(ae.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(re.status!==200)throw Error(`Azure IMDS token endpoint returned ${re.status} ${re.statusText}`);let ne=await re.json();if(!ne?.access_token)throw Error("IMDS token response missing access_token");let R=z+60000;if(ne.expires_on){let M=Number.parseInt(ne.expires_on,10);if(Number.isFinite(M)&&M>0)R=M*1000;else{let G=Date.parse(ne.expires_on);if(Number.isFinite(G))R=G}}else if(ne.expires_in){let M=Number.parseInt(ne.expires_in,10);if(Number.isFinite(M)&&M>0)R=z+M*1000}return d={accessToken:ne.access_token,expiresAtMs:R},ne.access_token}async function E(z){let J=Ir(e.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),B=Ir(e.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),ae=Ir(e.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),re=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:B,client_secret:ae,grant_type:"client_credentials",scope:r}),R=await fetch(re,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:ne});if(R.status!==200)throw Error(`Azure token endpoint returned ${R.status} ${R.statusText}`);let M=await R.json();if(!M?.access_token)throw Error("Azure token response missing access_token");return d={accessToken:M.access_token,expiresAtMs:z+(M.expires_in??0)*1000},M.access_token}async function O(){let z=Date.now();if(d&&d.expiresAtMs-60000>z)return d.accessToken;if(g)return g;g=(async()=>{if(o==="workload_identity")return await C(z);if(o==="managed_identity")return await P(z);if(o==="client_secret")return await E(z);if(await a(i))try{return await C(z)}catch{}try{return await P(z)}catch{}return await E(z)})();try{return await g}finally{g=void 0}}async function b(z){let J=await O(),B=Tn(u,`/secrets/${encodeURIComponent(z)}?api-version=${encodeURIComponent(t)}`),ae=await fetch(B,{headers:{Authorization:`Bearer ${J}`,Accept:"application/json"}});if(ae.status!==200)throw new Or(`Key Vault request failed (${ae.status})`,ae.status);return await ae.json()}async function T(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await b(ae),ne=re.value;try{ne=JSON.parse(re.value)}catch{}let R=re.attributes?.created?re.attributes.created*1000:void 0,M=Wu(re.id),G=re.contentType?pr({mimeType:re.contentType,format:re.tags?.["ionite-format"],schemaUrl:re.tags?.["ionite-schema-url"],typeId:re.tags?.["ionite-type-id"]}):void 0;return{data:ne,metadata:{path:z,version:Number.parseInt(M??"",10)||0,created:R?new Date(R):new Date,...G?{contentType:G}:{}}}}async function l(z,J,B){if(!ju(J))throw Error(`putSecret requires an object value for azure source at path ${z}`);let ae=n(z),re=e.secretNamePrefix?`${e.secretNamePrefix}${ae}`:ae,ne=await O(),R=Tn(u,`/secrets/${encodeURIComponent(re)}?api-version=${encodeURIComponent(t)}`),M=JSON.stringify({value:JSON.stringify(J),contentType:B.contentType.mimeType,tags:{"ionite-format":B.contentType.format,...B.contentType.schemaUrl?{"ionite-schema-url":B.contentType.schemaUrl}:{},...B.contentType.typeId?{"ionite-type-id":B.contentType.typeId}:{}}}),G=await fetch(R,{method:"PUT",headers:{Authorization:`Bearer ${ne}`,"Content-Type":"application/json",Accept:"application/json"},body:M});if(G.status!==200&&G.status!==201)throw Error(`Key Vault putSecret failed (${G.status}) for ${z}`)}async function k(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await O(),ne=Tn(u,`/secrets/${encodeURIComponent(ae)}?api-version=${encodeURIComponent(t)}`),R=await fetch(ne,{method:"DELETE",headers:{Authorization:`Bearer ${re}`,Accept:"application/json"}});if(R.status!==200&&R.status!==202&&R.status!==204)throw Error(`Key Vault deleteSecret failed (${R.status}) for ${z}`)}async function W(z,J){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${z}`)}async function F(z,J){try{return await T(z),!0}catch(B){if(B instanceof Or&&B.status===404)return!1;throw B}}async function Q(z,J,B){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${z}`)}async function ce(z,J,B){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${z}`)}async function se(z){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${z}`)}async function Z(z){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${z}`)}async function ee(z){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${z}`)}async function ue(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await b(ae),ne=re.contentType?pr({mimeType:re.contentType,format:re.tags?.["ionite-format"],schemaUrl:re.tags?.["ionite-schema-url"],typeId:re.tags?.["ionite-type-id"]}):void 0;return{id:re.id,...ne?{content_type:ne}:{},...re.attributes??{}}}return{type:e.type,isAvailable:()=>!m,get:(z,J)=>qe(()=>T(z,J)),getFullSecret:T,getSecret:async(z,J)=>(await T(z,J)).data,putSecret:l,deleteSecret:k,listPaths:W,exists:F,requestRotate:Q,requestRevoke:ce,parkKmsKey:se,addKmsKeys:Z,revokeKmsKey:ee,getMetadata:ue,subscribe:(z,J,B)=>{if(!e.ttl)throw new Le("azure",z);return gt(e.ttl),Ge({getFullSecret:T},z,J,e.ttl,void 0,B,{onHealth:(ae)=>{m=!ae}})},close:()=>{d=void 0,g=void 0,m=!1}}}var Pn=Symbol("ion.secretsSourceState");function qu(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${n}`)};return{type:"dev",get:(r,n)=>qe(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[Pn]:"unavailable"}}function xs(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${n}`)};return{type:"dev",get:(r,n)=>qe(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[Pn]:"removed"}}function Nu(e){return e.type==="vault"&&e.lfv!=null}function Ku(e,t,r,n){if(!Nu(t))return;if(r||n)return;throw Error(`Secrets source "${e}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function Vu(e,t,r){if(t.type==="vault")return At(t,r);if(t.type==="azure")return Er(t);if(t.type==="aws"||t.type==="gcp"||t.type==="dev")throw Error(`Secrets source "${e}" uses type "${t.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${e}"`)}function Fu(e,t){let r=(n)=>{t.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:n instanceof Error?n.message:String(n)})};try{Promise.resolve(e.close?.()).catch(r)}catch(n){r(n)}}function Du(e){let t=new Map,r=new Map,n=new Map;for(let[o,s]of Object.entries(e)){if(!Ms(s))continue;let i=t.get(s.deliveryPath);if(i)throw Error(`LFV delivery path "${s.deliveryPath}" is claimed by both secrets sources "${i}" and "${o}"; delivery paths must be globally unique.`);t.set(s.deliveryPath,o);let c=r.get(s.eventsPath);if(c)throw Error(`LFV events path "${s.eventsPath}" is claimed by both secrets sources "${c}" and "${o}"; events paths must be globally unique.`);r.set(s.eventsPath,o);let u=n.get(s.callbackKey);if(u&&u.trustId!==s.trustId)throw Error(`LFV callback key "${s.callbackKey}" is claimed by secrets sources "${u.sourceName}" and "${o}" with different verify JWKS; a callback path must use a single trust key.`);if(!u)n.set(s.callbackKey,{sourceName:o,trustId:s.trustId})}}function Ms(e){return typeof e.isDeliveryRequest==="function"&&typeof e.isEventsRequest==="function"&&typeof e.handleDelivery==="function"&&typeof e.handleEvents==="function"}function zu(e,t,r){let n={...t},o=[],s=(c)=>{if(n[c]!==void 0)delete n[c],o.push(c)};s("token"),s("clientSecret"),s("workload");let i=n.websocket;if(i&&typeof i==="object"&&i.token!==void 0){let c={...i};delete c.token,n.websocket=c,o.push("websocket.token")}if(o.length>0)r.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:e,"ion.droppedFields":o});return n}function Bu(e,t,r){let n={},o=new Set([...Object.keys(t??{}),...Object.keys(r??{})]);for(let s of o){let i=t?.[s],c=r?.[s],u=c?zu(s,c,e):void 0;n[s]={...i??{},...u??{}}}return n}function Ar(e){return e[Pn]??"available"}function Gu(e,t,r){let n=t,o=new Set,s=new Set,i=new Set,c=We(r,`Secrets source "${e}"`),u=()=>Ar(n)==="available",a=ye(`Secrets source "${e}"`,u),d=(l,k,W)=>Error(`${l} timed out after ${W}ms waiting for source "${e}" to be configured by the ConfigSource at path ${k}`),g=(l,k)=>Error(`${l} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${k}`),m=(l,k,W)=>{let F=Ar(n);if(F==="available")return Promise.resolve(n);if(F==="removed")return Promise.reject(g(l,k));return new Promise((Q,ce)=>{let se={method:l,path:k,resolve:(ee)=>{if(se.timeout)clearTimeout(se.timeout);i.delete(se),Q(ee)},reject:(ee)=>{if(se.timeout)clearTimeout(se.timeout);i.delete(se),ce(ee)}},Z=W?.timeout;if(typeof Z==="number"&&Z>0)se.timeout=setTimeout(()=>{se.reject(d(l,k,Z))},Z);i.add(se)})},C=(l)=>{for(let k of Array.from(i))k.resolve(l)},P=()=>{for(let l of Array.from(i))l.reject(g(l.method,l.path))},E=async(l,k=!1)=>{let W=l.guard.next();if(l.unsubscribe?.(),l.unsubscribe=void 0,l.closed)return;if(Ar(n)==="unavailable"&&l.options?.mode!=="wait"){if(k)throw Error(`subscribe is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${l.path}`);return}try{let Q=await(l.options?.mode==="wait"?await m("subscribe",l.path,l.options):n).subscribe(l.path,(ce)=>{if(!l.closed)l.onChange(ce)},l.options);if(l.closed||!l.guard.isCurrent(W)){Q?.();return}l.unsubscribe=Q}catch(F){if(k)throw F;if(hr(F)){r.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:e,path:l.path});return}r.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:e,path:l.path,error:F instanceof Error?F.message:String(F)})}},O=(l,k=!1)=>{if(l.unsubscribe?.(),l.unsubscribe=void 0,l.closed)return;if(!n.subscribeEvents){if(k)throw Error(`Secrets source "${e}" does not support lifecycle event subscriptions`);return}l.unsubscribe=n.subscribeEvents((W)=>{if(!l.closed)l.listener(W)})},b={get type(){return n.type},beforeChange:c.beforeChange,afterChange:c.afterChange,isAvailable:()=>u()&&(n.isAvailable?.()??!0),isReady:a.isReady,ready:a.ready,get:(l,k)=>qe(async()=>(await m("get",l,k)).getFullSecret(l,k)),getFullSecret:async(l,k)=>(await m("getFullSecret",l,k)).getFullSecret(l,k),getSecret:async(l,k)=>(await m("getSecret",l,k)).getSecret(l,k),putSecret:async(l,k,W)=>(await m("putSecret",l,W)).putSecret(l,k,W),subscribe:async(l,k,W)=>{let F={path:l,onChange:k,options:W,closed:!1,guard:br()};o.add(F);try{await E(F,!0)}catch(Q){throw o.delete(F),Q}return()=>{F.closed=!0,F.guard.next(),o.delete(F),F.unsubscribe?.(),F.unsubscribe=void 0}},subscribeEvents:(l)=>{let k={listener:l,closed:!1};s.add(k);try{O(k,!0)}catch(W){throw s.delete(k),W}return()=>{k.closed=!0,s.delete(k),k.unsubscribe?.(),k.unsubscribe=void 0}},deleteSecret:async(l,k)=>(await m("deleteSecret",l,k)).deleteSecret(l,k),listPaths:async(l,k)=>(await m("listPaths",l,k)).listPaths(l,k),exists:async(l,k)=>(await m("exists",l,k)).exists(l,k),requestRotate:async(l,k,W)=>(await m("requestRotate",l,W)).requestRotate(l,k,W),requestRevoke:async(l,k,W)=>(await m("requestRevoke",l,W)).requestRevoke(l,k,W),parkKmsKey:async(l,k,W)=>(await m("parkKmsKey",l,W)).parkKmsKey(l,k,W),addKmsKeys:async(l,k,W)=>(await m("addKmsKeys",l,W)).addKmsKeys(l,k,W),revokeKmsKey:async(l,k,W)=>(await m("revokeKmsKey",l,W)).revokeKmsKey(l,k,W),getMetadata:async(l,k)=>(await m("getMetadata",l,k)).getMetadata(l,k)},T=(l)=>{try{Promise.resolve(l.close?.()).catch((k)=>{r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:k instanceof Error?k.message:String(k)})})}catch(k){r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:k instanceof Error?k.message:String(k)})}};return{api:b,update(l){if(l===n)return;let k=n;c.emitBefore(),n=l;let W=Ar(l);if(W==="available")C(l);else if(W==="removed")P();a.refresh();for(let F of o)E(F);for(let F of s)O(F);T(k),c.emitAfter()},close(){for(let l of o)l.closed=!0,l.guard.next(),l.unsubscribe?.(),l.unsubscribe=void 0;o.clear();for(let l of s)l.closed=!0,l.unsubscribe?.(),l.unsubscribe=void 0;s.clear(),P(),a.settle(),T(n)}}}function Ws(e,t=new Map){let r=new Map,n=new Map,o,s=!1,i=new Map,c=We(e,"Secrets"),u=!1,a=()=>{for(let b of r.keys()){let T=i.get(b);if(T&&T.api.isReady?.()===!1)return!1}return!0},d=ye("Secrets module",()=>u&&a()),g=(b)=>{let T=i.get(b);if(T)return T;let l=Gu(b,r.get(b)??xs(b),e);if(i.set(b,l),!(b in O))Object.assign(O,{[b]:l.api});return l},m=(b)=>{let T=i.get(b)?.api;if(T)return T;throw e.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:b}),Error(`Secrets source "${b}" is not configured`)},C=()=>Array.from(r.values()).filter(Ms),P=(b)=>C().find((T)=>T.isDeliveryRequest(b)),E=(b)=>C().find((T)=>T.isEventsRequest(b)),O;return O={get config(){return Object.fromEntries(Array.from(r.keys(),(b)=>[b,g(b).api]))},beforeChange:c.beforeChange,afterChange:c.afterChange,isReady:d.isReady,isAvailable:()=>{for(let b of i.values()){if(b.api.isReady?.()===!1)continue;if(b.api.isAvailable?.()===!1)return!1}return!0},ready:d.ready,listSecretsSources:()=>Array.from(r.keys()),getSecretsSource:(b)=>{if(r.has(b))return g(b).api;return m(b)},get:(b,T,l)=>O.getSecretsSource(b).get(T,l),getSecret:(b,T,l)=>O.getSecretsSource(b).getSecret(T,l),getFullSecret:(b,T,l)=>O.getSecretsSource(b).getFullSecret(T,l),putSecret:(b,T,l,k)=>O.getSecretsSource(b).putSecret(T,l,k),deleteSecret:(b,T,l)=>O.getSecretsSource(b).deleteSecret(T,l),listPaths:(b,T,l)=>O.getSecretsSource(b).listPaths(T,l),exists:(b,T,l)=>O.getSecretsSource(b).exists(T,l),requestRotate:(b,T,l,k)=>O.getSecretsSource(b).requestRotate(T,l,k),requestRevoke:(b,T,l,k)=>O.getSecretsSource(b).requestRevoke(T,l,k),parkKmsKey:(b,T,l,k)=>O.getSecretsSource(b).parkKmsKey(T,l,k),addKmsKeys:(b,T,l,k)=>O.getSecretsSource(b).addKmsKeys(T,l,k),revokeKmsKey:(b,T,l,k)=>O.getSecretsSource(b).revokeKmsKey(T,l,k),getMetadata:(b,T,l)=>O.getSecretsSource(b).getMetadata(T,l),subscribe:(b,T,l,k)=>O.getSecretsSource(b).subscribe(T,l,k),isLfvDeliveryRequest:(b)=>P(b)!==void 0,isLfvEventsRequest:(b)=>E(b)!==void 0,handleLfvDelivery:async(b)=>{let T=P(b);if(!T)return me();return T.handleDelivery(b)},handleLfvEvents:async(b)=>{let T=E(b);if(!T)return me();return T.handleEvents(b)}},{update(b,T,l,k,W){let F=b!==void 0||T!==void 0;if(!F&&!u&&i.size===0)return;let Q=Bu(e,b,T),ce=W===!0,se=k!==o,Z=ce!==s,ee=new Map,ue=new Map,z=[];try{for(let[J,B]of Object.entries(Q)){let ae=$u(B),re=r.get(J);if(re&&n.get(J)===ae&&!se&&!Z){ee.set(J,re),ue.set(J,ae);continue}let ne;if(!B.type)ne=qu(J);else{if(l?.validateSourceConfig?.(J,B),t.has(J)&&b?.[J])e.warn(`RemoteConfig secrets source "${J}" is superseded by the framework LFV bootstrap source.`);if(!t.has(J))Ku(J,B,k,ce),ne=Vu(J,B,k),z.push(ne);else ne=t.get(J)}ee.set(J,ne),ue.set(J,ae)}Du(Object.fromEntries(ee))}catch(J){for(let B of z)Fu(B,e);throw J}c.emitBefore(),u=F,o=k,s=ce;for(let[J,B]of ee)r.set(J,B),n.set(J,ue.get(J)),g(J).update(B);for(let[J,B]of i){if(ee.has(J))continue;r.delete(J),n.delete(J),B.update(xs(J))}return d.refresh(),c.emitAfter(),O},close(){for(let b of i.values())b.close();i.clear(),r.clear(),n.clear(),o=void 0,u=!1,d.settle()}}}function In(e,t){let r=t.ttlMs,n=Math.max(1,Math.floor(t.maxEntries)),o=new Map,s=()=>Date.now();function i(){while(o.size>n){let u=o.keys().next().value;if(u===void 0)break;o.delete(u)}}function c(u,a){o.delete(u),o.set(u,{session:a,expiresAt:s()+r}),i()}return{async create(u){await e.create(u)},async get(u){let a=o.get(u);if(a){if(a.expiresAt>s())return o.delete(u),o.set(u,a),a.session;o.delete(u)}let d=await e.get(u);if(d)c(u,d);return d},async update(u,a){await e.update(u,a),o.delete(u)},async delete(u){await e.delete(u),o.delete(u)}}}import{deepEqualPlain as ud,ION_ENDPOINT_PERMISSIONS as dd,trimTrailingSlash as xr,validationFailureResponse as ld}from"@ionite/core";import{assertEcid as js,jwtAssertionClaimsSchema as Ju,must as Ue,workloadTokenResponseSchema as Hu}from"@ionite/core";import{getCachedVerificationKey as Yu,getJwks as Xu}from"@ionite/core/server";function je(e,t){return t in e&&e[t]!==void 0&&e[t]!==null}function Ie(e){if(e===void 0||e===null)return!1;return je(e,"workloadId")||je(e,"privateKey")}function Ke(e){if(e===void 0||e===null)return!1;let t=je(e,"clientId"),r=je(e,"clientSecret"),n=je(e,"workloadId"),o=je(e,"privateKey");return(t||r)&&!n&&!o}function On(e){if(e===void 0||e===null)return!1;let t=je(e,"jwksUri"),r=je(e,"workloadId"),n=je(e,"clientId"),o=je(e,"clientSecret"),s=je(e,"privateKey");return t&&!r&&!s&&!n&&!o}function $s(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function Zu(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if($s(t))return!1;let r=Object.entries(t);if(r.length===0)return!1;return r.every(([,n])=>$s(n))}function Fs(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if("incoming"in t||"outgoing"in t){if(t.incoming!==void 0&&(typeof t.incoming!=="object"||t.incoming===null))return!1;if(t.outgoing!==void 0&&(typeof t.outgoing!=="object"||t.outgoing===null||Array.isArray(t.outgoing)))return!1;return!0}return!1}function Ds(e){return Fs(e)}function En(e){if(!e)return;if(Ds(e))return Array.isArray(e.incoming)?void 0:e.incoming;return e}function xn(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function _t(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function qs(e){if(!e)return[];if(Array.isArray(e))return e.filter((t)=>!!t&&typeof t.issuer==="string"&&typeof t.jwksUri==="string").map((t)=>({issuer:t.issuer,jwksUri:t.jwksUri,audience:t.audience,scopesAsEntitlements:t.scopesAsEntitlements}));if(e.issuer&&e.jwksUri)return[{issuer:e.issuer,jwksUri:e.jwksUri,audience:e.audience??[],scopesAsEntitlements:e.scopesAsEntitlements}];return[]}function Qu(e){let t=e[0];if(!t)return;let r=xn(t.audience);return{jwksUri:t.jwksUri,issuer:t.issuer,audience:typeof r[0]==="string"?r[0]:void 0}}function Ns(e,t){let r=_t(t);if(!r)return;return e.find((n)=>_t(n.issuer)===r)}function _r(e,t,r){let n=xn(e);if(t.some((o)=>n.includes(o)))return!0;if(typeof r==="string"&&t.includes(r))return!0;return!1}function An(e){if(!e||!Ds(e))return{};return e.outgoing??{}}function ed(e){return{getToken:e.getToken,refreshToken:e.refreshToken,generateJWTAssertion:e.generateJWTAssertion,revokeToken:e.revokeToken,beforeChange:e.beforeChange,afterChange:e.afterChange,isReady:e.isReady,ready:e.ready}}var Mn=Symbol("ion.workloadClientState"),zs=Symbol("ion.namedWorkloadClients");function Lt(e,t){let r=ye(e,t);return{isReady:r.isReady,ready:r.ready}}function td(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...Lt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[Mn]:"unavailable"}}function Ks(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it is no longer configured on this Ionite instance.`)};return{...Lt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[Mn]:"removed"}}function rd(e){if(!e)return"removed";return e[Mn]??"available"}function _n(e,t,r){let n=e,o=n,s=new Set;for(let i of r){if(s.add(i),i in o)continue;let c=t[i];o[i]=c?ed(c):td(i)}return Object.defineProperty(o,zs,{value:s,enumerable:!1,configurable:!0}),n}function Vs(e){if(!e)return[];let t=e[zs];return t?Array.from(t):[]}function nd(e,t,r){let n=t,o=We(r,`Workload client "${e}"`),s=()=>rd(n)==="available",i=ye(`Workload client "${e}"`,s);return{api:{beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:i.isReady,ready:i.ready,getToken:(u)=>n.getToken(u),refreshToken:(u)=>n.refreshToken(u),generateJWTAssertion:(u)=>n.generateJWTAssertion(u),revokeToken:(u)=>n.revokeToken(u)},update(u){if(u===n)return;o.emitBefore(),n=u,i.refresh(),o.emitAfter()}}}function Bs(e){let t,r=!1,n=ye("Workload module",()=>r),o=We(e,"Workload"),s=new Map,i=new Set,c=new Set(["beforeChange","afterChange","isReady","ready"]),u=(m)=>{if(!t)throw Error(`${m} is unavailable because workload is not configured on this Ionite instance.`);return t},a={beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:n.isReady,ready:n.ready,get config(){return t?.config??{}},getToken(...m){return u("getToken").getToken(...m)},refreshToken(m){return u("refreshToken").refreshToken(m)},generateJWTAssertion(m){return u("generateJWTAssertion").generateJWTAssertion(m)},revokeToken(m){return u("revokeToken").revokeToken(m)},validateToken(m){return u("validateToken").validateToken(m)},getWorkloadIdentity(m){return u("getWorkloadIdentity").getWorkloadIdentity(m)},parseJWT(m){return u("parseJWT").parseJWT(m)},handler(m){return u("handler").handler(m)}},d=(m)=>{for(let E of i)delete a[E];if(i.clear(),!m)return;let C=new Set(Vs(m)),P=new Set([...c,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...C]);for(let[E,O]of Object.entries(m)){if(P.has(E))continue;a[E]=O,i.add(E)}},g=(m)=>{let C=s.get(m);if(C)return C;let P=nd(m,Ks(m),e);if(s.set(m,P),!(m in a))a[m]=P.api;return P};return{update(m){if(!m&&!r&&s.size===0)return;o.emitBefore(),r=m!==void 0,n.refresh(),t=m;let C=new Set(Vs(m));for(let P of C){let E=m[P];g(P).update(E)}for(let[P,E]of s){if(C.has(P))continue;E.update(Ks(P))}return d(m),o.emitAfter(),a}}}async function Ln(e,t,r){if(e===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let n=r[e];if(!n)throw Error(`Unknown workload client: ${e}`);return n.getToken(t)}function Un(e,t){return`${e}|${t??""}`}function Je(e,t,r,n,o){let s={jwtAssertionClaims:e?.jwtAssertionClaims??Ju("server"),tokenResponse:e?.tokenResponse??Hu("server")},i=async(p,f)=>{let S=p;if(typeof S.validate==="function")return S.validate(f);return p["~standard"].validate(f)};if(!r&&!n)return;if(r&&Fs(r)){let p=r.incoming,f=qs(p),S=Array.isArray(p)?Qu(p):p,A=En(n),j=An(n),Y=S?{...S,...A,jwksUri:S.jwksUri,issuer:S.issuer}:A;if(!Y||!Y.tokenUrl&&!Y.jwksUri)t.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let K=Y&&(Y.tokenUrl||Y.jwksUri)?Je(e,t,S??void 0,A,f):void 0,oe=Array.from(new Set([...Object.keys(r.outgoing??{}),...Object.keys(j)])).map((le)=>[le,{...r.outgoing?.[le]??{},...j[le]??{}}]),te={};for(let[le,st]of oe){let Ve=Je(e,t,st,void 0);if(Ve)te[le]=Ve}if(!K&&Object.keys(te).length===0)return;let we={...K?.config??{},config:K?.config??{},...Lt("workload",()=>K?.isReady()===!0||Object.values(te).some((le)=>le.isReady())),getToken:async(le,st)=>Ln(le,st,te),getServerToken:async(le)=>{if(!K)throw Error("No server workload config");return K.getToken(le)},refreshToken:async(le)=>{if(!K)throw Error("No default workload config");return K.refreshToken(le)},generateJWTAssertion:async(le)=>{if(!K)throw Error("No default workload config");return K.generateJWTAssertion(le)},revokeToken:async(le)=>{if(!K)throw Error("No default workload config");return K.revokeToken(le)},validateToken:async(le)=>{if(!K)throw Error("No default workload config");return K.validateToken(le)},getWorkloadIdentity:async(le)=>{if(!K)return;return K.getWorkloadIdentity(le)},parseJWT:async(le)=>{if(!K)throw Error("No default workload config");return K.parseJWT(le)},handler:async(le)=>{if(!K)return me();return K.handler(le)}};return _n(we,te,oe.map(([le])=>le))}if(r&&Zu(r)){let p=En(n),f=An(n),S=r.default,A=S?{...S,...p,jwksUri:S.jwksUri,issuer:S.issuer}:p;if(!A||!A.tokenUrl&&!A.jwksUri)t.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let j=A&&(A.tokenUrl||A.jwksUri)?Je(e,t,S??void 0,p):void 0,Y=Array.from(new Set([...Object.keys(r).filter((te)=>te!=="default"),...Object.keys(f)])).map((te)=>[te,{...te in r?r[te]:{},...f[te]??{}}]),K={};for(let[te,we]of Y){let le=Je(e,t,we,void 0);if(le)K[te]=le}if(!j&&Object.keys(K).length===0)return;let oe={...j?.config??{},config:j?.config??{},...Lt("workload",()=>j?.isReady()===!0||Object.values(K).some((te)=>te.isReady())),getToken:async(te,we)=>Ln(te,we,K),getServerToken:async(te)=>{if(!j)throw Error("No server workload config");return j.getToken(te)},refreshToken:async(te)=>{if(!j)throw Error("No default workload config");return j.refreshToken(te)},generateJWTAssertion:async(te)=>{if(!j)throw Error("No default workload config");return j.generateJWTAssertion(te)},revokeToken:async(te)=>{if(!j)throw Error("No default workload config");return j.revokeToken(te)},validateToken:async(te)=>{if(!j)throw Error("No default workload config");return j.validateToken(te)},getWorkloadIdentity:async(te)=>{if(!j)return;return j.getWorkloadIdentity(te)},parseJWT:async(te)=>{if(!j)throw Error("No default workload config");return j.parseJWT(te)},handler:async(te)=>{if(!j)return me();return j.handler(te)}};return _n(oe,K,Y.map(([te])=>te))}let c=En(n),u=An(n);if(!r&&Object.keys(u).length>0){let p={};for(let[A,j]of Object.entries(u)){let Y=Je(e,t,j,void 0);if(Y)p[A]=Y}let f=c&&(c.tokenUrl||c.jwksUri)?Je(e,t,c,void 0):void 0;if(!f&&Object.keys(p).length===0)return;let S={...f?.config??{},config:f?.config??{},...Lt("workload",()=>f?.isReady()===!0||Object.values(p).some((A)=>A.isReady())),getToken:async(A,j)=>Ln(A,j,p),getServerToken:async(A)=>{if(!f)throw Error("No server workload config");return f.getToken(A)},refreshToken:async(A)=>{if(!f)throw Error("No default workload config");return f.refreshToken(A)},generateJWTAssertion:async(A)=>{if(!f)throw Error("No default workload config");return f.generateJWTAssertion(A)},revokeToken:async(A)=>{if(!f)throw Error("No default workload config");return f.revokeToken(A)},validateToken:async(A)=>{if(!f)throw Error("No default workload config");return f.validateToken(A)},getWorkloadIdentity:async(A)=>{if(!f)return;return f.getWorkloadIdentity(A)},parseJWT:async(A)=>{if(!f)throw Error("No default workload config");return f.parseJWT(A)},handler:async(A)=>{if(!f)return me();return f.handler(A)}};return _n(S,p,Object.keys(u))}let a=r,d=o??qs(a),g=c?.tokenUrl,m=g?.startsWith("/")?g:void 0,C=a?.idpTokenUrl??c?.idpTokenUrl??(a?.tokenUrl&&(a.tokenUrl.startsWith("http://")||a.tokenUrl.startsWith("https://"))?a.tokenUrl:void 0),P={...a,...c,tokenUrl:m??c?.tokenUrl??a?.tokenUrl,idpTokenUrl:C,jwksUri:a?.jwksUri,issuer:a?.issuer};P._handlerTokenUrl=m;let E,O=P,b=Ie(P),T=Ke(P),l=On(P);if(!b&&!T&&!l){if(!a||Object.keys(a).length===0)return;throw t.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(P),clientId:O.clientId,clientSecret:O.clientSecret?"[REDACTED]":void 0,workloadId:O.workloadId,privateKey:O.privateKey?"[REDACTED]":void 0,jwksUri:O.jwksUri,tokenUrl:O.tokenUrl,idpTokenUrl:O.idpTokenUrl,fromVaultKeys:a?Object.keys(a):[],fromCodeKeys:n?Object.keys(n):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(b)E={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:Ue(P.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:Ue(P.privateKey,"Missing 'privateKey' from Workload Config"),audience:Ue(P.audience,"Missing 'audience' from Workload Config"),scope:P.scope??"",algorithm:P.algorithm??"RS256",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new it};else if(Ke(P))E={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:Ue(P.clientId,"Missing 'clientId' from Workload Config"),clientSecret:Ue(P.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:P.scope??"",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new it};else if(On(P))E=P;function k(){let p=new Uint8Array(16);return crypto.getRandomValues(p),Array.from(p,(f)=>f.toString(16).padStart(2,"0")).join("")}function W(p){let f;if(typeof p==="string")f=btoa(p);else f=btoa(String.fromCharCode(...p));return f.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function F(p){let f=p.replace(/-/g,"+").replace(/_/g,"/");while(f.length%4)f+="=";return atob(f)}function Q(p){if(p.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:p==="RS256"?"SHA-256":p==="RS384"?"SHA-384":"SHA-512"};else if(p.startsWith("ION"))return{name:"ECDSA",namedCurve:p==="ES256"?"P-256":p==="ES384"?"P-384":"P-521",hash:p==="ES256"?"SHA-256":p==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${p}`)}async function ce(p,f){let S=p.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),A=Uint8Array.from(atob(S),(Y)=>Y.charCodeAt(0)),j=Q(f);return crypto.subtle.importKey("pkcs8",A,j,!1,["sign"])}async function se(p,f,S){let A=await ce(f,S),Y=new TextEncoder().encode(p),K=Q(S),oe=await crypto.subtle.sign(K,A,Y);return W(new Uint8Array(oe))}async function Z(p,f=3,S=1000,A=30000){let j=Error("Placeholder Error");for(let Y=0;Y<=f;Y++)try{return await p()}catch(K){if(j=K instanceof Error?K:Error(String(K)),j.message.includes("400")||j.message.includes("401")||j.message.includes("403")||j.message.includes("404"))throw j;if(Y<f){let oe=Math.min(S*2**Y,A),te=Math.random()*oe*0.1;await new Promise((we)=>setTimeout(we,oe+te))}}throw j}async function ee(p){if(!Ie(E))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=E,S=Math.floor(Date.now()/1000),A={iss:f.workloadId,sub:f.workloadId,aud:f.audience??"",exp:S+f.tokenLifetime,iat:S,jti:k(),scope:p??f.scope},j={alg:f.algorithm,typ:"JWT",kid:f.keyId},Y=W(JSON.stringify(j)),K=W(JSON.stringify(A)),oe=`${Y}.${K}`,te=await se(oe,f.privateKey,f.algorithm);return`${oe}.${te}`}async function ue(p){if(!Ie(E))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=E;return Z(async()=>{let S=f.idpTokenUrl,A=await ee(p),j=new URLSearchParams;if(j.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),j.append("assertion",A),p)j.append("scope",p);let Y=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:j.toString()}),K=await Y.json();if(!Y.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:K});let te=K;throw Error(`Token acquisition failed: ${te.error||Y.statusText} - ${te.error_description||""}`.trim())}let oe=await i(s.tokenResponse,K);if(oe.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:oe.issues}),Error(`Token response validation failed: ${oe.issues.map((te)=>te.message).join("; ")}`);if(f.tokenStore){let te=new Date(Date.now()+(oe.value.expires_in??300)*1000),we={workload_id:Un(f.workloadId,p),access_token:oe.value.access_token,token_type:oe.value.token_type,scope:oe.value.scope,expires_at:te,created_at:new Date,refresh_token:oe.value.refresh_token};await f.tokenStore.set(we)}return oe.value})}async function z(p){if(!Ke(E))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let f=E;return Z(async()=>{let S=f.idpTokenUrl,A=new URLSearchParams;if(A.append("grant_type","client_credentials"),A.append("client_id",f.clientId),A.append("client_secret",f.clientSecret),p)A.append("scope",p);let j=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:A.toString()}),Y=await j.json();if(!j.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:Y});let oe=Y;throw Error(`Token acquisition failed: ${oe.error||j.statusText} - ${oe.error_description||""}`.trim())}let K=await i(s.tokenResponse,Y);if(K.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:K.issues}),Error(`Token response validation failed: ${K.issues.map((oe)=>oe.message).join("; ")}`);if(f.tokenStore){let oe=new Date(Date.now()+(K.value.expires_in??300)*1000),te={workload_id:Un(f.clientId,p),access_token:K.value.access_token,token_type:K.value.token_type,scope:K.value.scope,expires_at:oe,created_at:new Date,refresh_token:K.value.refresh_token};await f.tokenStore.set(te)}return K.value})}let J=new Map;function B(p,f){let S=J.get(p);if(S)return S;let A=(async()=>(Ie(E)?await ue(f??""):await z(f??"")).access_token)();return J.set(p,A),A.catch(()=>{return}).finally(()=>{if(J.get(p)===A)J.delete(p)}),A}async function ae(p){if(!Ie(E)&&!Ke(E)){let j=E;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!j.clientId}, hasClientSecret=${!!j.clientSecret}, hasWorkloadId=${!!j.workloadId}, hasPrivateKey=${!!j.privateKey}, hasJwksUri=${!!j.jwksUri}`)}let f=E;p=p??f.scope;let S=Ie(E)?E.workloadId:E.clientId,A=Un(S,p);if(f.tokenStore){let j=await f.tokenStore.get(A);if(j){let Y=Date.now(),K=j.expires_at.getTime(),oe=f.refreshThreshold*1000;if(Y+oe<K)return j.access_token;if(f.autoRefresh)try{return await B(A,p)}catch(te){if(Y<K)return t.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},te),j.access_token;throw te}}}return B(A,p)}async function re(p){if(!Ie(E)&&!Ke(E))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=E;return p=p??f.scope,Ie(f)?await ue(p):await z(p)}async function ne(p){if(!Ie(E)&&!Ke(E))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=E;try{if(!E.revocationEndpoint)return;let S=new URLSearchParams;if(S.append("token",p),S.append("token_type_hint","access_token"),Ie(E)){let j=E;S.append("client_id",j.workloadId)}else if(Ke(E)){let j=E;S.append("client_id",j.clientId),S.append("client_secret",j.clientSecret)}let A=await fetch(E.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:S.toString()});if(!A.ok)t.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:A.status,statusText:A.statusText});else t.info("Token revoked successfully",{"ion.module":"workload"});if(E.tokenStore){let j;if(Ie(E))j=E.workloadId;else if(Ke(E))j=E.clientId;else return;await E.tokenStore.delete(j)}}catch(S){t.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},S)}}async function R(p,f){let S=p??E?.jwksUri;if(!S)throw Error("No JWKS URI configured in Workload Config");return await Xu(S,t,f)}async function M(p,f){let S=f??E?.jwksUri;if(!S)throw Error("No JWKS URI configured in Workload Config");let A=Ie(E)?E.algorithm:"RS256";return Yu(S,p,`wl:${A}`,(j)=>{let Y=j.alg||A,K=Q(Y);return crypto.subtle.importKey("jwk",j,K,!1,["verify"])},t)}function G(p){let f=p.split(".");if(f.length!==3)throw Error("Invalid JWT");return JSON.parse(F(f[1]))}async function H(p,f){try{let S=p.split(".");if(S.length!==3)throw Error("Invalid JWT");let A=JSON.parse(F(S[0])),j=JSON.parse(F(S[1])),Y=await M(A.kid,f),K=S[2],te=new TextEncoder().encode(`${S[0]}.${S[1]}`),we=Uint8Array.from(F(K),(jt)=>jt.charCodeAt(0)),le=Q(A.alg);if(!await crypto.subtle.verify(le,Y,we,te))throw Error("Invalid JWT signature");let Ve=await i(s.jwtAssertionClaims,j);if(Ve.issues)throw t.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:Ve.issues}),Error(`JWT claims validation failed: ${Ve.issues.map((jt)=>jt.message).join("; ")}`);return Ve.value}catch(S){throw t.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},S),S}}async function v(p){if(!Ie(E)&&!Ke(E)&&!On(E))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(d.length>0){let A=G(p),j=typeof A.iss==="string"?A.iss:void 0,Y=Ns(d,j);if(!Y)return{valid:!1,error:"Untrusted token issuer"};let K=await H(p,Y.jwksUri),oe=Math.floor(Date.now()/1000);if(K.exp&&K.exp<oe)return{valid:!1,error:"Token expired"};let te=xn(Y.audience);if(te.length>0&&!_r(K.aud,te,K.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:K,expiresAt:K.exp?new Date(K.exp*1000):void 0}}let f=await H(p),S=Math.floor(Date.now()/1000);if(f.exp&&f.exp<S)return{valid:!1,error:"Token expired"};if(Ie(E)){if(E.audience&&!_r(f.aud,[E.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else if(Ke(E)){if(E.issuer&&_t(f.iss)!==_t(E.issuer))return{valid:!1,error:"Invalid issuer"};if(E.audience&&!_r(f.aud,[E.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else{let A=E;if(A.issuer&&_t(f.iss)!==_t(A.issuer))return{valid:!1,error:"Invalid issuer"};if(A.audience&&!_r(f.aud,[A.audience],f.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:f,expiresAt:f.exp?new Date(f.exp*1000):void 0}}catch(f){return{valid:!1,error:f instanceof Error?f.message:String(f)}}}function U(p,f){let S=p[f];return typeof S==="string"&&S.trim()?S.trim():void 0}function I(p){if(!p)return;return p.startsWith("service-account-")?p.slice(16):p}function x(p){return U(p,"client_id")??U(p,"clientId")??U(p,"azp")??U(p,"appid")??I(U(p,"preferred_username"))}let N=new WeakMap;function w(p){let f=N.get(p);if(f)return f;let S=_(p);return N.set(p,S),S}async function _(p){let f=p.headers.get("Authorization");if(!f?.startsWith("Bearer "))return;let S=f.substring(7),A=await v(S);if(!A.valid||!A.claims)return;let j=d.length>0?Ns(d,A.claims.iss):void 0,Y=A.claims.ecid,K={workloadId:A.claims.sub,clientId:x(A.claims),scope:A.claims.scope,scopesAsEntitlements:j?.scopesAsEntitlements,...Y!==void 0&&Y!==null?{ecid:js(Y)}:{},claims:A.claims},oe=E?.workloadIdentityStore;if(oe){let te=K.clientId??K.workloadId??K.claims.sub,we=te?await oe.get(te):void 0;if(we){if(we.active===!1)return;if(we.scopes?.length){let le=new Set([...(K.scope??"").split(/\s+/).filter(Boolean),...we.scopes]);K.scope=Array.from(le).join(" ")}if(!K.ecid&&we.ecid)K.ecid=js(we.ecid)}}return K}async function h(p){if(!E)throw Error("ionite Workload Manager not initialized");let f=new URL(p.url).pathname,S=(Y)=>{if(!Y)return;try{return new URL(Y).pathname}catch{return Y.startsWith("/")?Y:`/${Y}`}};if(S(E.validateUrl)===f&&p.method==="POST"){let Y=p.headers.get("Authorization");if(!Y?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let K=Y.substring(7),oe=await v(K);if(!oe.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:oe.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(S(E.jwksUrl)===f&&p.method==="GET"){let Y=await R();return new Response(JSON.stringify(Y),{headers:[["Content-Type","application/json"]]})}return me()}return{...E,...Lt("workload",()=>!0),getToken:ae,refreshToken:re,generateJWTAssertion:ee,revokeToken:ne,validateToken:v,getWorkloadIdentity:w,parseJWT:H,handler:h}}function Wn(e){return e=e??"Workload authentication unavailable",new Response(JSON.stringify({error:e}),{status:503,statusText:e,headers:{"Content-Type":"application/json"}})}var Lr="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",od="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function sd(e,t){Ue(t,Lr);let r=t.workload;if(!r)return;return r.getWorkloadIdentity(e)}async function id(e,t,r){Ue(t,Lr);let n=t.workload;if(!n)throw Wn();let o=n;if(typeof o.getServerToken!=="function"||typeof o.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return o.getToken(e,r)}async function jn(e,t){Ue(t,od);let r="validateToken"in t&&typeof t.validateToken==="function"?t:t.workload;if(!r)return{valid:!1,error:"Workload authentication unavailable"};let n=e.headers.get("Authorization");if(!n?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let o=n.substring(7);return r.validateToken(o)}async function ad(e,t){Ue(t,Lr);let r=t.workload;if(!r)throw Wn();return r.revokeToken(e)}async function cd(e,t){Ue(t,Lr);let r=t.workload;if(!r)throw Wn();return r.handler(e)}function Gs(e){try{return xr(new URL(e,"http://dummy").pathname)}catch{let t=e.startsWith("/")?e:`/${e}`;return xr(t)}}function fd(e,t){let r=new URL(e.url);return new URL(`/${encodeURIComponent(t)}/`,r.origin).toString()}function pd(e,t){let r=Gs(t),n=xr(e);if(n===r)return null;if(!n.startsWith(`${r}/`))return null;let o=n.slice(r.length+1);if(!o||o.includes("/"))return null;return decodeURIComponent(o)}function Ur(e){return e==="pending"||e==="processing"||e==="completed"||e==="failed"||e==="action_required"}function md(e){if(!Ur(e.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if(e.status==="completed"){if(!e.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:e.tenantUrl,status:"completed"},status:201}}if(e.status==="pending"||e.status==="processing")return{body:{tenantUrl:e.tenantUrl,status:e.status},status:202};if(e.status==="action_required"){if(!e.actionUrl||!e.requestToken||!e.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:e.actionUrl,requestToken:e.requestToken,expiresAt:e.expiresAt},status:200}}return{body:{tenantUrl:e.tenantUrl,status:"failed",error:e.error??"Tenant provisioning failed"},status:409}}function gd(e,t){let r=t.validators.tenant.createTenantRequest,n=t.validators.tenant.updateTenantRequest;function o(a,d){let g=(m)=>new URL(m,d).toString();return{readyzUrl:g(a.readyzUrl),capabilitiezUrl:g(a.capabilitiezUrl),sso:{loginUrl:g(a.sso.loginUrl),userUrl:g(a.sso.userUrl),logoutUrl:g(a.sso.logoutUrl),logoutBackChannelUrl:g(a.sso.logoutBackChannelUrl),refreshUrl:g(a.sso.refreshUrl),callbackUrl:g(a.sso.callbackUrl)},workload:{validateUrl:g(a.workload.validateUrl),jwksUrl:g(a.workload.jwksUrl)},iam:{basePath:g(a.iam.basePath),usersUrl:g(a.iam.usersUrl),groupsUrl:g(a.iam.groupsUrl),workloadsUrl:g(a.iam.workloadsUrl),customersUrl:g(a.iam.customersUrl)},ciam:{magicLinkUrl:g(a.ciam.magicLinkUrl),magicLinkLoginUrl:g(a.ciam.magicLinkLoginUrl),customerUrl:g(a.ciam.customerUrl),customerLoginUrl:g(a.ciam.customerLoginUrl),customerCallbackUrl:g(a.ciam.customerCallbackUrl),customerProvidersUrl:g(a.ciam.customerProvidersUrl),logoutUrl:g(a.ciam.logoutUrl)}}}function s(a,d){let g=t.tenantIonBasePath?.(a);if(!g)return;let m=new URL(d.url).origin,C=o(Fe(g),m);return{callbackUrl:C.sso.callbackUrl,ionUrls:C}}async function i(a){let d=await jn(a,t.workloadAuth??e);if(!d.valid)return Response.json({error:d.error??"Unauthorized"},{status:401});return pt(a,e,dd["tenant.manage"])}async function c(a){let g=new URL(a.url).pathname,m=pd(g,t.basePath),C=Gs(t.basePath),P=xr(g)===C;if(!P&&!m)return me();if(!["GET","PUT","POST","DELETE"].includes(a.method))return It(["GET","PUT","POST","DELETE"]);if(a.method==="GET"&&P&&m==null)return me();let E=await i(a);if(E)return E;if(a.method==="GET"){if(m==null)return me();let Z=await t.store.get(m);if(!Z)return me();let ee=s(Z,a);return Response.json(ee?{...Z,...ee}:Z,{status:200})}if(a.method==="DELETE"){if(!m)return me();let Z=await t.store.get(m);if(Z)await t.mirror?.purge(Z.id);return await t.store.delete(m),new Response(null,{status:204})}if(!m&&a.method!=="POST")return me();let O;try{O=await a.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let b=a.method==="POST",T=b?await r.validate(O):await n.validate(O);if(T.issues)return ld(T.issues,b?"Tenant create validation failed":"Tenant update validation failed");let l=b?T.value.id:m;if(!l)return me();if(m!=null&&T.value.id!=null&&T.value.id!==m)return Response.json({error:"Path id must match body id"},{status:400});let k=await t.store.get(l);if(k&&!Ur(k.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let W=new Date,F=k??{},Q;if(b){let Z=T.value,ee=Z,ue=ee.status,z=Ur(ue)?ue:k?.status??"completed";Q={...F,...Z,id:l,companyId:Z.companyId,companyName:Z.companyName,environmentType:Z.environmentType,configLocator:Z.configLocator,email:Z.email??k?.email,webhookUrl:Z.webhookUrl??k?.webhookUrl,callbackUrl:Z.callbackUrl??k?.callbackUrl,tenantUrl:ee.tenantUrl??k?.tenantUrl,status:z,error:ee.error??k?.error,actionUrl:ee.actionUrl??k?.actionUrl,requestToken:ee.requestToken??k?.requestToken,expiresAt:ee.expiresAt??k?.expiresAt,createdAt:k?.createdAt??W,updatedAt:W}}else{let Z=T.value,ee=Z,ue=ee.status,z=Ur(ue)?ue:k?.status??"completed",{configLocator:J,...B}=Z;Q={...F,...B,id:l,companyId:Z.companyId??k?.companyId??"",companyName:Z.companyName??k?.companyName??"",environmentType:Z.environmentType??k?.environmentType??"DEV",email:Z.email??k?.email,webhookUrl:Z.webhookUrl??k?.webhookUrl,callbackUrl:Z.callbackUrl??k?.callbackUrl,tenantUrl:ee.tenantUrl??k?.tenantUrl,status:z,error:ee.error??k?.error,actionUrl:ee.actionUrl??k?.actionUrl,requestToken:ee.requestToken??k?.requestToken,expiresAt:ee.expiresAt??k?.expiresAt,configLocator:J??k?.configLocator,createdAt:k?.createdAt??W,updatedAt:W}}if(!Q.tenantUrl)Q.tenantUrl=fd(a,l);if(!Q.callbackUrl){let Z=s(Q,a);if(Z)Q.callbackUrl=Z.callbackUrl}if(k?.configLocator&&!ud(k.configLocator,Q.configLocator))await t.mirror?.purge(k.id);let ce=await t.store.upsert(Q),se=md(ce);if(se instanceof Response)return se;return Response.json(se.body,{status:se.status})}async function u(a){try{if(!e.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await c(a)}catch(d){return Pt(d)}}return{handler:u,getTenant:async(a)=>t.store.get(a)}}var $n="0.0.24-beta.20260915.2";export*from"@ionite/core";import{AssignmentPolicyError as qg,generateULID as Ng,IoniteError as Kg,listGenerator as Vg}from"@ionite/core";import{allowHosts as Dg,allowOrigins as zg,allowRelativePaths as Bg,allowSameOrigin as Gg,blockDangerousUrls as Jg,CatalogAdjacencyCache as Hg,callback as Yg,captureRedirect as Xg,ciam as Zg,collectReferencedDefinitions as Qg,defaultRedirectPolicies as ey,discoverSessionRecords as ty,discoverSessions as ry,expandRoot as ny,getCustomer as oy,getUser as sy,has as iy,hasAll as ay,hasAllScope as cy,hasAny as uy,hasAnyScope as dy,hasGroup as ly,hasPermission as fy,hasRole as py,hasScope as my,InMemoryTenantStore as gy,iam as yy,initiateLogin as wy,isRedirectAllowed as hy,listSsoClientIdsFromCookies as vy,reconcileSubjectAccess as Sy,resolveAfterRedirect as ky,resolveCapturedRedirect as by,resolveRedirect as Ry,sameOriginRedirectRules as Cy,sendTenantWebhook as Ty,sso as Py,verifyUser as Iy,withSetCookies as Oy}from"@ionite/core/server";import{accessRefId as ot,accessRootId as Js,assertRequiredSubjectType as Hs,list as yd}from"@ionite/core";function Nn(e){let{createdAt:t,updatedAt:r,...n}=e;return n}class He{constructor(){this.roots=new Map;this.byTarget=new Map;this.bySubject=new Map}static targetKey(e,t){return`${e}:${t}`}static subjectKey(e,t){return`${e}:${t}`}indexAdd(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}indexRemove(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}deindex(e){this.indexRemove(this.byTarget,He.targetKey(e.targetType,ot(e.target)),e.id),this.indexRemove(this.bySubject,He.subjectKey(e.subjectType,ot(e.subject)),e.id)}index(e){this.indexAdd(this.byTarget,He.targetKey(e.targetType,ot(e.target)),e.id),this.indexAdd(this.bySubject,He.subjectKey(e.subjectType,ot(e.subject)),e.id)}resolve(e,t){if(!e)return[];let r=[];for(let n of e){let o=this.roots.get(n);if(o&&(o.status??"active")==="active"&&t(o))r.push(o)}return r}async grant(e){Hs(e.subjectType,"Access change subjectType");let t=e.id??Js(e),r=new Date,n=this.roots.get(t);if(n)this.deindex(n);let o={...e,id:t,status:e.status??"active",createdAt:n?.createdAt??r,updatedAt:r};this.roots.set(t,o),this.index(o)}async revoke(e){let t=e.id??Js(e),r=this.roots.get(t);if(r)this.deindex(r);this.roots.delete(t)}async get(e){let t=this.roots.get(e);return t?Nn(t):void 0}async list(e){let t=Array.from(this.roots.values()).filter((r)=>(r.status??"active")==="active");return qn(t,e)}async listByTarget(e,t,r){let n=t.trim(),o=this.byTarget.get(He.targetKey(e,n)),s=this.resolve(o,(i)=>i.targetType===e&&ot(i.target)===n);return qn(s,r)}async listByTargets(e){let t=new Map;for(let{targetType:r,target:n}of e){let o=`${r}:${n}`;if(t.has(o))continue;let s=n.trim(),i=this.byTarget.get(He.targetKey(r,s)),c=this.resolve(i,(u)=>u.targetType===r&&ot(u.target)===s);t.set(o,c.map((u)=>Nn(u)))}return t}async listBySubject(e,t,r){Hs(t);let n=ot(e),o=this.bySubject.get(He.subjectKey(t,n)),s=this.resolve(o,(i)=>i.subjectType===t&&ot(i.subject)===n);return qn(s,r)}}function qn(e,t){let r=Math.max(0,t?.start??0),n=t?.limit,o=n!=null?r+n:void 0;return yd(e.length,e.slice(r,o).map(Nn),r,n)}import{assertValidSubjectTypeScoping as Ys,deepEqualPlain as wd,list as Xs,readyCatalogEntry as Kn}from"@ionite/core";class Zs{constructor(){this.listeners=new Set;this.emit=(e)=>{for(let t of this.listeners)t(e)};this.groups=new Mr("group",this.emit);this.roles=new Mr("role",this.emit);this.permissions=new Mr("permission",this.emit)}afterChange(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}}class Qs{constructor(){this.items=new Map;this.listeners=new Set}async get(e){return this.items.get(e)}async list(e){let t=Array.from(this.items.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=n!=null?r+n:void 0;return Xs(t.length,t.slice(r,o),r,n)}async children(e){return Array.from(this.items.values()).filter((t)=>(typeof t.parent==="string"?t.parent:t.parent?.id)===e)}changed(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}set(e){this.items.set(e.id,e),this.emitChange({id:e.id})}delete(e){if(!this.items.delete(e))return;this.emitChange({id:e,deleted:!0})}emitChange(e){for(let t of this.listeners)t(e)}}class Mr{constructor(e,t){this.kind=e;this.emit=t;this.items=new Map}async get(e){return this.items.get(e)}set(e){Ys(e);let t=this.items.get(e.id),r=!t||!wd(t,e);if(this.items.set(e.id,e),r)this.emit({op:"set",kind:this.kind,entity:e,previous:t});return Kn(e,Promise.resolve())}insertIfAbsent(e){Ys(e);let t=this.items.get(e.id);if(t)return Kn(t,Promise.resolve());return this.items.set(e.id,e),this.emit({op:"set",kind:this.kind,entity:e,previous:void 0}),Kn(e,Promise.resolve())}async delete(e){let t=this.items.get(e);if(!t)return;this.items.delete(e),this.emit({op:"delete",kind:this.kind,entity:t})}async list(e){let t=Array.from(this.items.values()),r=e?.filter?.requestable;if(r!==void 0)t=t.filter((i)=>Boolean(i.requestable)===r);let n=Math.max(0,e?.start??0),o=e?.limit,s=o!=null?n+o:void 0;return Xs(t.length,t.slice(n,s),n,o)}}import{accessRefId as Ye,assertRequiredSubjectType as Ut}from"@ionite/core";function Xe(e,t){return`${t}:${e}`}function Vn(e,t,r){return`${e}:${t}:${r}`}function hd(e,t,r,n){return`${Vn(e,t,r)}:${n??""}`}class ei{constructor(){this.rows=new Map;this.byTriple=new Map;this.byRoot=new Map;this.bySubject=new Map;this.edgeMeta=new Map;this.disabledSubjects=new Set}async has(e,t,r,n,o){Ut(o);let s=Ye(e),i=Ye(r);if(!s||!i)return{allow:!1};if(this.disabledSubjects.has(Xe(s,o)))return{allow:!1,metadata:{reason:"subject_disabled"}};let c=Vn(Xe(s,o),t,i),u=n?Ye(n):void 0;if(u===void 0){let g=this.byTriple.get(c);if(g&&g.size>0)return this.allow(s,o,t,i,void 0);return{allow:!1}}let a=`${c}:${u}`,d=`${c}:`;if(this.rows.has(a))return this.allow(s,o,t,i,u);if(this.rows.has(d))return this.allow(s,o,t,i,void 0);return{allow:!1}}async hasGroup(e,t,r,n){return this.has(e,"group",t,r,n)}async hasRole(e,t,r,n){return this.has(e,"role",t,r,n)}async hasPermission(e,t,r,n){return this.has(e,"permission",t,r,n)}async hasAny(e,t,r){for(let n of t){let o=await this.has(e,n.targetType,n.target,n.resource,r);if(o.allow)return o}return{allow:!1}}async hasAll(e,t,r){if(this.disabledSubjects.has(Xe(Ye(e),r)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(t.length===0)return{allow:!0};let n=[];for(let o of t){let s=await this.has(e,o.targetType,o.target,o.resource,r);if(!s.allow)return{allow:!1,matched:n};if(s.matched)n.push(...s.matched)}return{allow:!0,matched:n}}async materialize(e,t){this.removeRoot(e),this.addRootEdges(e,t)}async replaceSubject(e,t,r){let n=Xe(Ye(e),t),o=new Map;for(let s of r){Ut(s.subjectType,"Effective edge subjectType");let i=Xe(Ye(s.subject),s.subjectType);if(i!==n)throw Error(`AccessIndex.replaceSubject received an edge for ${i}; expected ${n}.`);let c=o.get(s.rootId);if(c)c.push(s);else o.set(s.rootId,[s])}this.clearSubjectEdges(n);for(let[s,i]of o)this.addRootEdges(s,i)}addRootEdges(e,t){let r=new Set;for(let n of t){Ut(n.subjectType,"Effective edge subjectType");let o=Xe(n.subject,n.subjectType),s=Vn(o,n.targetType,n.target),i=hd(o,n.targetType,n.target,n.resource);this.addToSet(this.rows,i,e),this.addToSet(this.byTriple,s,i),this.addToSet(this.bySubject,o,i),this.edgeMeta.set(i,{triple:s,subjectId:o}),r.add(i)}if(r.size>0)this.byRoot.set(e,r)}async removeByRoot(e){this.removeRoot(e)}removeRoot(e){let t=this.byRoot.get(e);if(!t)return;for(let r of t){let n=this.rows.get(r);if(!n)continue;if(n.delete(e),n.size===0)this.dropEdge(r)}this.byRoot.delete(e)}async listSubjects(){let e=[];for(let[t,r]of this.bySubject){if(r.size===0)continue;let n=t.indexOf(":");if(n<=0)throw Error(`AccessIndex subject key "${t}" is missing a subjectType prefix.`);let o=t.slice(0,n);Ut(o,"AccessIndex subject key subjectType"),e.push({subjectType:o,subject:t.slice(n+1)})}return e}async setSubjectDisabled(e,t,r){let n=Xe(Ye(e),t);if(r)this.disabledSubjects.add(n);else this.disabledSubjects.delete(n)}async isSubjectDisabled(e,t){return Ut(t),this.disabledSubjects.has(Xe(Ye(e),t))}async clear(e,t){if(e===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}Ut(t);let r=Ye(e);this.clearSubjectEdges(Xe(r,t))}clearSubjectEdges(e){let t=this.bySubject.get(e);if(!t)return;for(let r of[...t]){let n=this.rows.get(r);if(n)for(let o of n){let s=this.byRoot.get(o);if(s?.delete(r)&&s.size===0)this.byRoot.delete(o)}this.dropEdge(r)}}allow(e,t,r,n,o){return{allow:!0,matched:[{subject:e,subjectType:t,targetType:r,target:n,resources:o?[o]:void 0}]}}addToSet(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}dropEdge(e){this.rows.delete(e);let t=this.edgeMeta.get(e);if(t)this.removeFromSet(this.byTriple,t.triple,e),this.removeFromSet(this.bySubject,t.subjectId,e);this.edgeMeta.delete(e)}removeFromSet(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}}function Fn(e){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function vd(e,t){return{...e,subscribe:async(r,n,o)=>{try{return await e.subscribe(r,n,o)}catch(s){if(!(s instanceof Le))throw s;return await Ge(e,r,n,t,void 0,o)}}}}function Wr(e){let t=ft(e.path,"path","azureConfig");gt(e.ttl);let r=e.vault??Er({type:"azure",authMethod:e.authMethod,entraTenantId:e.entraTenantId,clientId:e.clientId,clientSecret:e.clientSecret,federatedTokenFile:e.federatedTokenFile,managedIdentityClientId:e.managedIdentityClientId,imdsApiVersion:e.imdsApiVersion,vaultUrl:e.vaultUrl,vaultName:e.vaultName,apiVersion:e.apiVersion,secretNameTransform:e.secretNameTransform,secretNamePrefix:e.secretNamePrefix,scope:e.scope,ttl:e.ttl}),n=e.ttl?vd(r,e.ttl):r;return{load:async()=>{try{return(await n.getFullSecret(t)).data}catch(o){let s=o instanceof Error?o.message:String(o);throw Error(`Error retrieving remote config from Azure Key Vault: ${s}`,{cause:o})}},subscribe:(o,s)=>n.subscribe(t,(i)=>{o(i.data)},s),secret:n}}import{IoniteError as Wd}from"@ionite/core";function Dn(e){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as Cd,remoteConfigSecretType as Td}from"@ionite/core";import{defaultLogger as Sd,defaultSecretContentType as kd,stableConfigHash as ti}from"@ionite/core";var bd=1e4;function Rd(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function zn(e){if(e.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let t=Array.from(new Set(e.paths.map((O)=>O.trim()).filter(Boolean)));if(t.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let r=e.logger??Sd,n=[],o=Promise.resolve(),s=!1,i=!1,c=!1,u=ye("Secrets mirror",()=>s&&!c),a=(O)=>{let b=e.mapPath(O).trim();if(!b)throw Error(`mirrorSecrets mapPath returned an empty target for "${O}"`);return b},d=(O)=>{let b=o.then(O);return o=b.catch((T)=>{i=!0,r.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:T instanceof Error?T.message:String(T)})}),b},g=async(O)=>{if(await e.to.exists(O))await e.to.deleteSecret(O)},m=async(O,b)=>{if(c)return;if(!Rd(b.data))throw Error(`mirrorSecrets can only re-store object values (source path "${O}")`);if(e.accept&&!e.accept(b,O))return;let T=a(O);if(await e.to.exists(T)){let l=await e.to.getSecret(T);if(ti(l)===ti(b.data)){i=!1;return}}await e.to.putSecret(T,b.data,{contentType:b.metadata.contentType??kd()}),i=!1},C=async(O)=>{await g(a(O)),i=!1},P=(O)=>{if(O.event!=="path_removed")return t.includes(O.path)?[O.path]:[];let b=`${O.path.replace(/\/+$/g,"")}/`;return t.filter((T)=>T===O.path||T.startsWith(b))},E=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if(e.from.subscribeEvents)n.push(e.from.subscribeEvents((O)=>{if(E.has(O.event)){let b=P(O);if(b.length>0)d(async()=>{for(let T of b)await C(T)})}try{e.onEvent?.(O)}catch(b){r.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:O.path,event:O.event,error:b instanceof Error?b.message:String(b)})}}));return(async()=>{let O=new Set(t);for(;;){try{for(let b of[...O]){let T=await e.from.subscribe(b,(l)=>{d(()=>m(b,l))},e.subscription);if(c){T();return}n.push(T),O.delete(b)}if(await o,c)return;s=!0,u.refresh();return}catch(b){if(c)return;i=!0,r.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:b instanceof Error?b.message:String(b)})}if(await new Promise((b)=>{setTimeout(b,bd).unref?.()}),c)return}})(),{isReady:u.isReady,ready:u.ready,isAvailable:()=>s&&!c&&!i&&(e.from.isAvailable?.()??!0)&&(e.to.isAvailable?.()??!0),async purge(){if(c)throw Error("Secrets mirror is closed");await d(async()=>{for(let O of t)await C(O)})},async close(){if(c)return;c=!0;for(let O of n.splice(0))O();u.refresh(),u.settle(),await o}}}function xt(e){return typeof e.getFullSecret==="function"}function Bn(e){let t=e;return typeof t.handleDelivery==="function"&&typeof t.handleEvents==="function"&&typeof t.isDeliveryRequest==="function"&&typeof t.isEventsRequest==="function"}function ri(e){return e.type==="vault"&&[e.vaultLfvServerUrl,e.vaultLfvClientId,e.vaultLfvDeliveryEndpoint,e.vaultLfvVerifyJwks,e.vaultLfvEventsEndpoint].some((t)=>t!==void 0)}function Oe(e,t){if(!e?.trim())throw Error(`Mirrored LFV config requires ${t}`);return e}function Pd(e,t){if(t?.trim())return t;if(xt(e))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if(e.type==="vault")return Oe(e.vaultLfvPath??e.vaultPath,"an upstream vault path");if(e.type==="azure")return Oe(e.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${e.type}" requires an explicit fromPath`)}function Id(e,t){let r=Oe(e.vaultLfvPath??e.vaultPath,"vaultLfvPath or vaultPath");return lt({lfvServerUrl:Oe(e.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Oe(e.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Oe(e.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:Oe(e.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:Oe(e.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:r,deliveryTimeout:e.vaultLfvDeliveryTimeout,retryInterval:e.vaultLfvRetryInterval,warnInterval:e.vaultLfvWarnInterval,log:t},void 0,{selfRedeemReads:!0})}function Od(e){return e.metadata.contentType?.typeId===Td.id&&typeof e.data.id==="string"&&e.data.id.trim().length>0}function Ed(e,t,r,n){return{...e,close:r,subscribePassive:(o,s)=>t.subscribePassive(o,s),isDeliveryRequest:(o)=>t.isDeliveryRequest(o),isEventsRequest:(o)=>t.isEventsRequest(o),handleDelivery:(o)=>(n(),t.handleDelivery(o)),handleEvents:(o)=>(n(),t.handleEvents(o)),deliveryPath:t.deliveryPath,eventsPath:t.eventsPath,callbackKey:t.callbackKey,trustId:t.trustId}}function Qt(e){let t=e.logger??Cd,r=Pd(e.from,e.fromPath),n=!xt(e.from),o=!xt(e.to),s=xt(e.from)?e.from:ri(e.from)?Id(e.from,t):Ze(e.from).secret,i=xt(e.to)?e.to:Ze(e.to).secret,c=Oe(e.path,"path"),u=Gn(i,c,{ttl:e.ttl}),a,d=!1,g=!1,m,C=()=>{if(m)return;m=s.getFullSecret(r).then(()=>{return}).catch((l)=>{m=void 0,t.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:l instanceof Error?l.message:String(l)})})},P=(l)=>{if(d)throw Error("Mirrored ConfigSource is closed");if(!a){g=l;let k=!l&&Bn(s)?{...s,subscribe:(W,F)=>s.subscribePassive(W,F)}:s;a=zn({from:k,to:i,paths:[r],mapPath:()=>c,accept:Od,logger:t})}else if(l&&!g)C();return a},E={isReady:()=>a?.isReady()??!1,ready:(l)=>P(!0).ready(l),isAvailable:()=>a?.isAvailable()??!1,purge:()=>P(!1).purge(),close:async()=>{await a?.close()}},O=async()=>{if(d)return;if(d=!0,await a?.close(),n)await s.close?.();if(o)await i.close?.()},b=Bn(s)?Ed(i,s,O,()=>{P(!1)}):{...i,close:O},T={load:async()=>{try{let l=await u.load();return P(!1),l}catch(l){throw P(!0),l}},subscribe:(l,k)=>(P(!1),u.subscribe(l,k)),secret:b,mirror:E,async handleCallback(l,k){if(!Bn(s))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return P(!1),l==="delivery"?s.handleDelivery(k):s.handleEvents(k)}};if(Object.defineProperties(T,{log:{get:()=>u.log,set:(l)=>{u.log=l},enumerable:!0},validators:{get:()=>u.validators,set:(l)=>{u.validators=l},enumerable:!0}}),!xt(e.from)&&ri(e.from)){let l=e.from;T[Ct]={path:r,lfvServerUrl:Oe(l.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Oe(l.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Oe(l.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:Oe(l.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:Oe(l.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:l.vaultLfvDeliveryTimeout,retryInterval:l.vaultLfvRetryInterval,warnInterval:l.vaultLfvWarnInterval}}return T}class yt extends Error{constructor(e,t=`Waiting for vault config secret at ${e}`){super(t);this.path=e;this.code="not_found";this.sourceType="vault";this.status=404;this.name="VaultConfigWaitingForSecretError"}}function Ad(e){return e instanceof yt}class er extends Error{constructor(e,t){super(t);this.path=e;this.code="invalid_payload";this.sourceType="vault";this.name="VaultConfigInvalidPayloadError"}}function _d(e){return e instanceof er}var si=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function ni(e){return si.some((t)=>(t in e))}function oi(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw new yt(t,`Vault config secret at ${t} is missing or not an object`);let r=e;if(!ni(r)&&Object.keys(r).length===1&&"data"in r){let n=r.data;if(n&&typeof n==="object"&&!Array.isArray(n))r=n}if(Object.keys(r).length===0)throw new yt(t,`Vault config secret at ${t} is empty`);if(!ni(r))throw new er(t,`Vault config secret at ${t} is an invalid payload: not a RemoteConfig (no known keys: ${si.join("/")})`);return r}function Ld(e,t,r){return{...e,subscribe:async(n,o,s)=>{try{return await e.subscribe(n,o,s)}catch(i){if(!(i instanceof Le))throw i;return await Ge(e,n,o,t,r(),s)}}}}function jr(e){let t=ft(e.path,"path","vaultConfig");gt(e.ttl);let r=e.vault??At({type:"vault",url:e.url,token:e.token,workload:e.workload,lfv:e.lfv,websocket:e.websocket,ttl:e.ttl,log:e.log}),n=e.vault&&e.ttl?Ld(r,e.ttl,()=>e.log):r,o={get log(){return e.log},set log(s){if(e.log=s,n&&"log"in n)n.log=s},load:async()=>{try{let s=await n.getFullSecret(t);return oi(s.data,t)}catch(s){if(s instanceof Be)throw new yt(t);if(s instanceof yt||s instanceof er)throw s;throw Error("Error retrieving remote config from vault",{cause:s})}},subscribe:(s,i)=>n.subscribe(t,(c)=>{let u;try{u=oi(c.data,t)}catch(a){e.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:t,error:a instanceof Error?a.message:String(a)});return}s(u)},i),secret:n};if(e.lfv?.lfvServerUrl&&e.lfv.clientId&&e.lfv.deliveryEndpoint&&e.lfv.eventsEndpoint)o[Ct]={path:e.lfv.path??t,lfvServerUrl:e.lfv.lfvServerUrl,clientId:e.lfv.clientId,deliveryTimeout:e.lfv.deliveryTimeout,retryInterval:e.lfv.retryInterval,warnInterval:e.lfv.warnInterval,deliveryEndpoint:e.lfv.deliveryEndpoint,eventsEndpoint:e.lfv.eventsEndpoint,verifyJwks:e.lfv.verifyJwks};return o}function $r(e){if(e==null)return;if(typeof e==="number")return Number.isFinite(e)?e:void 0;let t=e.trim();if(!t)return;let r=Number.parseInt(t,10);return Number.isFinite(r)?r:void 0}function Ud(e,t){let r=e.vaultLfvServerUrl??t?.lfvServerUrl,n=e.vaultLfvClientId??t?.clientId,o=e.vaultLfvDeliveryEndpoint??t?.deliveryEndpoint,s=e.vaultLfvEventsEndpoint??t?.eventsEndpoint;if(!r||!n||!o||!s)return t;return{...t,lfvServerUrl:r,clientId:n,deliveryEndpoint:o,verifyJwks:e.vaultLfvVerifyJwks??t?.verifyJwks,eventsEndpoint:s,path:e.vaultLfvPath??t?.path,deliveryTimeout:$r(e.vaultLfvDeliveryTimeout)??t?.deliveryTimeout,retryInterval:$r(e.vaultLfvRetryInterval)??t?.retryInterval,warnInterval:$r(e.vaultLfvWarnInterval)??t?.warnInterval}}function xd(e,t){let r=e.vaultWebsocketUrl??t?.url;if(!r)return t;return{...t,url:r,token:e.vaultWebsocketToken??t?.token,clientId:e.vaultWebsocketClientId??t?.clientId,header:e.vaultWebsocketHeader??t?.header}}function Md(e,t){let r=e.vaultWorkloadTokenUrl??t?.idpTokenUrl,n=e.vaultWorkloadClientId??t?.clientId,o=e.vaultWorkloadClientSecret??t?.clientSecret;if(!r||!n||!o)return t;return{...t,idpTokenUrl:r,clientId:n,clientSecret:o,scope:e.vaultWorkloadScope??t?.scope}}function ii(e,t){return{...t,url:e.vaultUrl??t?.url,token:e.vaultToken??t?.token,path:e.vaultPath??t?.path,ttl:$r(e.vaultTtl)??t?.ttl,workload:Md(e,t?.workload),lfv:Ud(e,t?.lfv),websocket:xd(e,t?.websocket)}}function Ze(e){switch(e.type){case"vault":return $d(e);case"azure":return qd(e);case"aws":return Nd(e);case"gcp":return Kd(e);case"mirror":return jd(e);default:throw Error(`Unsupported config locator type: ${e.type}`)}}function jd(e){if(e.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!e.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return Qt({from:e.from,to:e.to,path:e.to.vaultPath,ttl:e.to.vaultTtl})}function $d(e){return jr(ii(e))}function qd(e){return Wr({authMethod:e.azureAuthMethod,entraTenantId:e.azureEntraTenantId,clientId:e.azureClientId,clientSecret:e.azureClientSecret,federatedTokenFile:e.azureFederatedTokenFile,managedIdentityClientId:e.azureManagedIdentityClientId,imdsApiVersion:e.azureImdsApiVersion,vaultUrl:e.azureVaultUrl,vaultName:e.azureVaultName,apiVersion:e.azureApiVersion,scope:e.azureScope,secretNamePrefix:e.azureSecretNamePrefix,path:e.azurePath,ttl:e.azureTtl})}function Nd(e){return Fn({webhookUrl:e.awsWebhookUrl,ttl:e.awsTtl})}function Kd(e){return Dn({ttl:e.gcpTtl})}function Gn(e,t,r={}){switch(e.type){case"vault":return jr({vault:e,path:t,ttl:r.ttl});case"azure":return Wr({vault:e,path:t,ttl:r.ttl});default:throw new Wd(`configFromSource is not supported for secrets source type "${e.type}" (path "${t}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function wt(e){if(!e)return;let t=Number.parseInt(e,10);return Number.isFinite(t)?t:void 0}function qr(e,t){let r=t?.type??e.ION_CONFIG_TYPE;if(!r)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(r==="vault")return{type:"vault",vaultUrl:e.ION_VAULT_URL,vaultToken:e.ION_VAULT_TOKEN,vaultPath:e.ION_VAULT_PATH??"",vaultTtl:wt(e.ION_VAULT_TTL),vaultWorkloadTokenUrl:e.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:e.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:e.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:e.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:e.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:e.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:e.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:e.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:e.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:e.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:wt(e.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:wt(e.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:wt(e.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:e.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:e.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:e.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:e.ION_VAULT_WEBSOCKET_HEADER};if(r==="azure")return{type:"azure",azurePath:e.ION_AZURE_PATH,azureApiVersion:e.ION_AZURE_API_VERSION,azureScope:e.ION_AZURE_SCOPE,azureSecretNamePrefix:e.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:e.ION_AZURE_AUTH_METHOD,azureEntraTenantId:e.ION_AZURE_TENANT_ID,azureClientId:e.ION_AZURE_CLIENT_ID,azureClientSecret:e.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:e.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:e.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:e.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:e.ION_AZURE_VAULT_URL,azureVaultName:e.ION_AZURE_VAULT_NAME,azureTtl:wt(e.ION_AZURE_TTL)};if(r==="aws")return{type:"aws",awsWebhookUrl:e.ION_AWS_WEBHOOK_URL??"",awsTtl:wt(e.ION_AWS_TTL)};if(r==="gcp")return{type:"gcp",gcpTtl:wt(e.ION_GCP_TTL)};if(r==="mirror"){let n={};for(let[c,u]of Object.entries(e))if(c.startsWith("ION_FROM_"))n[`ION_${c.slice(9)}`]=u;if(n.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let o=qr(n),s=qr(e,{type:"vault"});if(!s.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let i={type:"vault",vaultUrl:s.vaultUrl,vaultToken:s.vaultToken,vaultPath:s.vaultPath,vaultTtl:s.vaultTtl,vaultWorkloadTokenUrl:s.vaultWorkloadTokenUrl,vaultWorkloadClientId:s.vaultWorkloadClientId,vaultWorkloadClientSecret:s.vaultWorkloadClientSecret,vaultWorkloadScope:s.vaultWorkloadScope,vaultWebsocketUrl:s.vaultWebsocketUrl,vaultWebsocketToken:s.vaultWebsocketToken,vaultWebsocketClientId:s.vaultWebsocketClientId,vaultWebsocketHeader:s.vaultWebsocketHeader};return{type:"mirror",from:o,to:i}}throw Error(`ION_CONFIG_TYPE="${r}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function ai(e,t){return Ze(qr(e,t))}function Vd(e){return ai(process.env,e)}var Fd=1000,Dd=30000,ci=["vault","azure","aws","gcp"];function ui(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Config locator at ${t} is an invalid payload: expected an object with a "type" field`);let r=e.type;if(typeof r!=="string"||!ci.includes(r))throw Error(`Config locator at ${t} is an invalid payload: unknown type "${String(r)}" (expected ${ci.join("/")})`)}function di(e,t){return e.log??=t.log,e.validators??=t.validators,e}function tr(e){if(!e?.secret?.close)return;try{Promise.resolve(e.secret.close()).catch((t)=>{e.log?.warn?.("secretConfigSource: inner source close failed",t)})}catch(t){e.log?.warn?.("secretConfigSource: inner source close failed",t)}}function zd(e,t){let r=ft(t,"path","secretConfigSource"),n,o=(i)=>{ui(i,r);let c=JSON.stringify(i);if(n&&n.hash===c)return n.inner;let u=n?.inner,a=di(Ze(i),s);if(n={hash:c,inner:a},u&&u!==a)tr(u);return a},s={async load(){let i=await e.getSecret(r);return o(i).load()},async subscribe(i,c){let u,a=!1,d=!1,g,m,C=new Promise((W,F)=>{g=W,m=F}),P=br(),E,O,b=(W)=>new Promise((F)=>{O=F,E=setTimeout(F,W)}),T=async(W,F)=>{ui(W,r);let Q=JSON.stringify(W),ce=n!==void 0&&n.hash===Q;if(ce&&u)return;let se=n?.inner,Z=u,ee=ce&&n?n.inner:di(Ze(W),s),ue=!ce,z=()=>{if(ue&&ee!==se)tr(ee)};try{if(ee.subscribe){let B=await ee.subscribe(i,c)??void 0;if(a||!P.isCurrent(F)){B?.(),z();return}if(u=B,n={hash:Q,inner:ee},Z&&Z!==B)Z();if(ue&&se&&se!==ee)tr(se);return}let J=await ee.load();if(a||!P.isCurrent(F)){z();return}if(n={hash:Q,inner:ee},Z)Z(),u=void 0;if(ue&&se&&se!==ee)tr(se);i(J)}catch(J){throw z(),J}},l=async(W)=>{let F=P.next(),Q=Fd;for(;;){if(a||!P.isCurrent(F))return;try{await T(W,F);return}catch(ce){if(a||!P.isCurrent(F))return;s.log?.warn(`secretConfigSource rebind for ${r} failed; keeping last-known-good source and retrying in ${Q}ms`,ce),await b(Q),Q=Math.min(Dd,Q*2)}}},k=await e.subscribe(r,(W)=>{if(a)return;if(!d){T(W.data,P.next()).then(()=>{d=!0,g()}).catch((F)=>{d=!0,m(F)});return}l(W.data)},c);return await C,()=>{if(a=!0,P.next(),E)clearTimeout(E);O?.(),u?.(),k(),tr(n?.inner),n=void 0}},secret:e};return s}function Jn(e){if(Array.isArray(e))return e.map(Jn);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,Jn(r)]));return e}function li(e){return JSON.stringify(Jn(e))}function Bd(e){if(e.type==="vault")return e.vaultLfvPath??e.vaultPath;if(e.type==="azure"&&e.azurePath?.trim())return e.azurePath;throw Error(`Tenant config locator type "${e.type}" does not declare a mirrorable config path`)}function Gd(e,t){let r=t.logger??e.log,n=new Map,o=!1,s=async(a)=>{if(a.closed)return;a.closed=!0,a.closeHooks?.(),await a.hookSetup?.catch(()=>{return}),await a.source.secret.close?.()},i=(a)=>{let d=(async()=>{let g=await t.store.get(a);if(!g)throw Error(`Tenant "${a}" was not found`);if(!g.configLocator)throw Error(`Tenant "${a}" has no configLocator`);let m=g.configLocator,C=t.path(g).trim();if(!C)throw Error(`Tenant mirror path is empty for "${a}"`);let P=t.sourceFromLocator?.(m,g)??m,O={source:Qt({from:P,fromPath:Bd(m),to:t.to,path:C,logger:r}),locatorFingerprint:li(m),targetPath:C,closed:!1};if(t.hooks?.onRemoteConfigChange)O.hookSetup=t.to.subscribe(C,(b)=>{Promise.resolve(t.hooks?.onRemoteConfigChange?.(g,b.data,b)).catch((T)=>{r.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:a,error:T instanceof Error?T.message:String(T)})})}).then((b)=>{O.closeHooks=b}).catch((b)=>{r.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:a,error:b instanceof Error?b.message:String(b)})});return O})();return n.set(a,d),d.catch(()=>{if(n.get(a)===d)n.delete(a)}),d},c=async(a,d,g)=>{if(n.get(a)===d)n.delete(a);await s(g)},u=async(a)=>{if(o)throw Error("Tenant config mirror is closed");let d=n.get(a);if(!d)return i(a);let g=await d,m=await t.store.get(a);if(!m?.configLocator)throw await c(a,d,g),Error(m?`Tenant "${a}" has no configLocator`:`Tenant "${a}" was not found`);if(li(m.configLocator)!==g.locatorFingerprint)return await c(a,d,g),n.get(a)??i(a);return g};return{async ensure(a,d){await(await u(a)).source.mirror.ready(d)},async handleCallback(a,d,g){try{return await(await u(a)).source.handleCallback(d,g)}catch(m){let C=m instanceof Error?m.message:String(m),P=C.includes("was not found")?404:503;return r.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:a,kind:d,error:C}),Response.json({error:P===404?"Tenant not found":"Tenant config mirror unavailable"},{status:P})}},async purge(a){let d=n.get(a),g=d?await d:void 0,m=await t.store.get(a),C=g?.targetPath??(m?t.path(m).trim():void 0);if(g&&d)await c(a,d,g);if(C&&await t.to.exists(C))await t.to.deleteSecret(C);if(m)await t.hooks?.onRemoteConfigRevoke?.(m)},async close(){if(o)return;o=!0;let a=[...n.values()];n.clear(),await Promise.all(a.map(async(d)=>{try{await s(await d)}catch{}}))}}}import{buildTenantPath as Jd,DEFAULT_TENANT_API_NAMESPACE as pi,DEFAULT_TENANT_UI_NAMESPACE as mi,matchTenantPath as gi,normalizeTenantPathNamespace as fi}from"@ionite/core";function Hd(){return Response.json({error:"Tenant not found"},{status:404})}function Yd(e){return Response.json({error:`Tenant runtime unavailable for ${e}`},{status:503})}function Xd(e,t){if(t==="api")return fi(e?.api??pi);return fi(e?.ui??mi)}function Zd(e){if(e.store)return async(t)=>e.store.getIon(t);return async(t)=>await e.getIon(t)??void 0}async function yi(e,t={}){if(t.custom){let s=await t.custom(e);if(s)return{id:s}}let r=t.namespace??"api",n=Xd(t.strategy,r),o=gi(new URL(e.url).pathname,n);if(!o)return null;return{id:o.id,context:{namespace:r,restPath:o.restPath,restSegments:o.restSegments}}}function wi(e,t){let r=new URL(e.url);return r.pathname=t,new Request(r,e)}function Hn(e,t,r,n){let o=gi(new URL(e.url).pathname,r);if(!o||o.id!==t)return e;return wi(e,Jd(t,o.restPath,n))}function Qd(e,t,r={beforeTenantSegments:["api"],afterTenantSegments:[]}){return Hn(e,t,pi,r)}function el(e,t,r={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return Hn(e,t,mi,r)}function tl(e){return async function(r){try{let n=e.resolveTenant?await e.resolveTenant(r):await yi(r),o=typeof n==="string"?{id:n,context:void 0}:n??null;if(!o?.id)return e.onMissingTenant?await e.onMissingTenant(r):Hd();let s=await e.getIon(o.id,r)??null;if(!s)return e.onMissingIonite?await e.onMissingIonite(r,o.id):Yd(o.id);let i=e.rewriteRequest?await e.rewriteRequest(r,{id:o.id,ion:s,context:o.context}):r;return s.handler(i)}catch(n){return Pt(n)}}}import{list as rl,matchesListFilter as nl}from"@ionite/core";class hi{constructor(){this.identities=new Map;this.clientIdIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.identities.get(e)}async lookup(e){if(e.id){let t=this.identities.get(e.id);if(t)return t}if(e.clientId){let t=this.clientIdIndex.get(e.clientId);if(t)return this.identities.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.identities.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n=this.identities.get(t),o={...e,id:t,createdAt:n?.createdAt??e.createdAt??r,updatedAt:r};if(n?.clientId&&n.clientId!==o.clientId)this.clientIdIndex.delete(n.clientId);if(n?.externalId&&n.externalId!==o.externalId)this.externalIdIndex.delete(n.externalId);if(this.identities.set(t,o),o.clientId)this.clientIdIndex.set(o.clientId,t);if(o.externalId)this.externalIdIndex.set(o.externalId,t);return o}async delete(e){let t=this.identities.get(e);if(t?.clientId)this.clientIdIndex.delete(t.clientId);if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.identities.delete(e),t?1:0}async list(e){let t=Array.from(this.identities.values()).filter((c)=>nl(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return rl(o,i,r,n)}}var fl=30000;function pl(e){let t=e,r=t.basePath??ar(),n=t.readyTimeoutMs??fl,o=ir(t.stores),{routing:s,beforeChange:i,afterChange:c,configRetry:u,onConfigLoadError:a}=t;return{frameworkConfig:{log:e.log,validators:e.validators,sso:e.sso,iam:e.iam,workload:e.workload,secrets:e.secrets,lfv:e.lfv,ciam:e.ciam,authz:e.authz,otel:e.otel},basePath:r,readyTimeoutMs:n,stores:o,options:{beforeChange:i,afterChange:c,routing:s,configRetry:u,onConfigLoadError:a}}}function ml(e){let t=e,r={trace:(n,...o)=>t.trace(n,...o),debug:(n,...o)=>t.debug(n,...o),info:(n,...o)=>t.info(n,...o),warn:(n,...o)=>t.warn(n,...o),error:(n,...o)=>t.error(n,...o)};return{logger:r,update(n){return t=n,r}}}function Oi(e,t){let r=e;return r.setStores=(n)=>{t.current=ir(n),Object.assign(r,qt(r,t.current))},r}function Si(e){let t=e?.replace(/\s+/g," ").trim();return t?t:void 0}function Ei(e){if(typeof e!=="object"||e===null)return;return e.cause}function gl(e){if(!(e instanceof Error))return typeof e==="string"?Si(e):void 0;let t=Si(e.message),r=[],n=e;if(typeof n.code==="string")r.push(`code=${n.code}`);if(typeof n.status==="number")r.push(`status=${n.status}`);if(typeof n.path==="string")r.push(`path=${n.path}`);if(r.length===0)return t;if(!t)return r.join(", ");return`${t} [${r.join(", ")}]`}function to(e,t=3){let r=[],n=e,o=0;while(n!=null&&o<t){let s=gl(n);if(s&&!r.includes(s))r.push(s);n=Ei(n),o+=1}return r.length>0?r.join(" <- "):void 0}function yl(e,t){if(typeof e!=="object"||e===null)return;return e[t]}function xe(e,t){let r=e,n=0;while(r!=null&&n<3){let o=yl(r,t);if(o!==void 0)return o;r=Ei(r),n+=1}return}var wl=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function hl(e){return typeof e==="string"&&wl.has(e)}function vl(e){let t=xe(e,"kind");if(hl(t))return t;let r=xe(e,"status"),n=xe(e,"code"),o=to(e)?.toLowerCase()??"";if(r===401||r===403||o.includes("auth error")||o.includes("permission denied"))return"auth";if(n==="not_found"||o.includes("waiting for vault"))return"not_found";if(n==="ECONNREFUSED"||n==="ECONNRESET"||n==="ENOTFOUND"||n==="ETIMEDOUT"||o.includes("connection")||o.includes("fetch failed")||o.includes("network"))return"connection";if(o.includes("timed out"))return"timeout";if(o.includes("invalid status")||typeof r==="number"&&r>=400)return"invalid_status";if(o.includes("invalid payload")||o.includes("invalid json")||o.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function Sl(e){return"validation"}var kl=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function bl(e,t){let r=xe(e,"recoverable");if(typeof r==="boolean")return r;if(t==="not_found")return!0;if(t==="auth"||t==="invalid_payload")return!1;let n=xe(e,"status");if(typeof n==="number"&&n>=400&&n<500)return!1;let o=xe(e,"code");if(typeof o==="string"&&(kl.has(o)||o.startsWith("UND_ERR_")))return!0;return!0}function Rl(e){return{initialDelayMs:Math.max(1,e?.initialDelayMs??2000),maxDelayMs:Math.max(1,e?.maxDelayMs??600000),multiplier:Math.max(1,e?.multiplier??2),jitterRatio:Math.max(0,e?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,e?.loadTimeoutMs??30000)}}function Cl(e,t){let r=Math.max(0,e-1),n=Math.min(t.maxDelayMs,t.initialDelayMs*t.multiplier**r);if(t.jitterRatio===0)return Math.round(n);let o=n*t.jitterRatio,s=(Math.random()*2-1)*o;return Math.max(1,Math.round(Math.min(t.maxDelayMs,n+s)))}function Tl(e){return(t)=>{let r=t.path?` at ${t.path}`:"",n=t.sourceType?` (${t.sourceType})`:"";e.warn(`Config source${n} unavailable${r}; ionite will retry automatically in ${t.nextDelayMs}ms (attempt ${t.attempt}, ${t.errorKind}: ${t.message}).`)}}async function Pl(e,t){for(let r of t)await r(e)}function Me(e){if(!e)return;try{return new URL(e,"http://dummy").pathname}catch{return e.startsWith("/")?e:`/${e}`}}function Il(e,t){let r=t.id;if(typeof r!=="string"||r.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if(e!==void 0&&e!==r)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${e}", received "${r}").`)}function Ol(e){let t=e.kms;if(t)for(let[n,o]of Object.entries(t)){if(n.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!o||typeof o!=="object"||Array.isArray(o))throw Error(`RemoteConfig.kms.${n} must be an object.`);if(o.source!==void 0&&(typeof o.source!=="string"||o.source.length===0))throw Error(`RemoteConfig.kms.${n}.source must be a non-empty string when present.`);if(o.path!==void 0&&(typeof o.path!=="string"||o.path.length===0))throw Error(`RemoteConfig.kms.${n}.path must be a non-empty string when present.`)}let r=e.otel;if(!r)return;if(r.apiKey!==void 0&&r.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(r.apiKeyPool!==void 0){if(typeof r.apiKeyPool!=="string"||r.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!t?.[r.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${r.apiKeyPool}".`)}}function El(e){let t=e.authz?.trustedProvisioningClients;if(!t)return;t.forEach((r,n)=>{let o=`authz.trustedProvisioningClients[${n}]`;if(typeof r.issuer!=="string"||r.issuer.length===0)throw Error(`${o}: "issuer" is required and must be a non-empty string.`);if(typeof r.clientId!=="string"||r.clientId.length===0)throw Error(`${o}: "clientId" is required and must be a non-empty string.`);let s=Array.isArray(r.audience)?r.audience:[r.audience];if(s.length===0||s.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(r.permissions)||r.permissions.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "permissions" must be an array of non-empty permission ids.`)})}function Al(e){let t=Array.isArray(e)?e:[e];return t.length>0&&t.every((r)=>typeof r==="string"&&r.length>0)}function _l(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return;let r=t,n=(o,s)=>{if(!Al(o.audience))throw Error(`${s}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in r||"outgoing"in r){let o=r.incoming;if(Array.isArray(o))o.forEach((s,i)=>{if(s&&typeof s==="object")n(s,`workload.incoming[${i}]`)});else if(o&&typeof o==="object"&&"jwksUri"in o)n(o,"workload.incoming");return}if(Li(r)){if("jwksUri"in r&&!("clientId"in r)&&!("workloadId"in r))n(r,"workload (server-only)");return}}function Ll(e,t,r){if(e?.sso?.redirectUri&&t.sso?.redirectUri){let n=Me(e.sso.redirectUri),o=Me(t.sso.redirectUri);if(n!==o)r.error(`SSO redirectUri path mismatch: the framework derives "${o}" from basePath, but ConfigSource reports "${n}". Register "${o}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function ro(e){let t={};if(!e)return t;for(let[r,n]of Object.entries(e))if(n.type==="vault"&&typeof n.lfv?.deliveryEndpoint==="string"&&typeof n.lfv?.eventsEndpoint==="string")t[r]=n.lfv;return t}function Ai(e){return e[Ct]}function _i(e,t){let r=ro(e.secrets??void 0),n=Me(t.deliveryEndpoint),o=Me(t.eventsEndpoint),s=Me(t.path);for(let i of Object.values(r)){if(Me(i.deliveryEndpoint)!==n)continue;if(Me(i.eventsEndpoint)!==o)continue;let c=i.path?Me(i.path):void 0;if(s&&c&&s!==c)continue;return!0}return!1}function Ul(e,t){let r=Ai(t);if(!r)return e;if(_i(e,r))return e;let n={type:"vault",lfv:{path:r.path,lfvServerUrl:r.lfvServerUrl,clientId:r.clientId,deliveryTimeout:r.deliveryTimeout,retryInterval:r.retryInterval,warnInterval:r.warnInterval,deliveryEndpoint:r.deliveryEndpoint,eventsEndpoint:r.eventsEndpoint,verifyJwks:r.verifyJwks}},o=e.secrets??{},s=en(o,{clientId:r.clientId,path:r.path});return{...e,secrets:{...o,[s]:n}}}function xl(e,t){let r=Ai(t);if(!r||_i(e,r))return new Map;let n=en(e.secrets??{},{clientId:r.clientId,path:r.path});return new Map([[n,t.secret]])}function Ml(e,t){let r=ro(e.secrets),n=ro(t.secrets??void 0);for(let[o,s]of Object.entries(n)){let i=r[o];if(!i)continue;let c=Me(i.deliveryEndpoint),u=Me(s.deliveryEndpoint);if(c&&u&&c!==u)throw Error(`LFV deliveryEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${c}, framework path: ${u}`);let a=Me(i.eventsEndpoint),d=Me(s.eventsEndpoint);if(a&&d&&a!==d)throw Error(`LFV eventsEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${a}, framework path: ${d}`)}}function Wl(e){return new Set(Object.keys(e.secrets??{}))}function jl(e){return new Set(Object.keys(e.secrets??{}))}function $l(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;if(!("outgoing"in t))return new Set;let r=t.outgoing;if(!r||typeof r!=="object"||Array.isArray(r))return new Set;return new Set(Object.keys(r))}function Li(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function ql(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;let r=t;if("incoming"in r||"outgoing"in r){let n=r.outgoing;if(!n||typeof n!=="object"||Array.isArray(n))return new Set;return new Set(Object.keys(n))}if(Li(r))return new Set;return new Set(Object.keys(r).filter((n)=>n!=="default"))}function Nl(e,t,r,n){let o=t.secrets??{},s=e.secrets??{};for(let[d,g]of Object.entries(o)){let m=s[d];if(!m)continue;if(g.type&&m.type&&g.type!==m.type)throw Error(`Secrets source "${d}" type in framework config must match ConfigSource type. ConfigSource type: ${m.type}, framework type: ${g.type}`)}let i=Wl(t),c=jl(e);for(let d of i)if(!c.has(d)&&!n.has(d))r.warn(`Framework config declares secrets source "${d}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let d of c)if(!i.has(d))r.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:d});let u=$l(t),a=ql(e);for(let d of u)if(!a.has(d))r.warn(`Framework config declares outgoing workload client "${d}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(t.otel!==void 0&&t.otel!==null&&e.otel===void 0)r.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function ki(e,t){if(t===void 0)return!1;return sl(e,t)}function Kl(e,t){if(typeof t!=="number"||!Number.isFinite(t)||t<=0)return e;return new Promise((r,n)=>{let o=setTimeout(()=>{n(Error(`Ionite ready() timed out after ${t}ms`))},t);e.then(()=>{clearTimeout(o),r()},(s)=>{clearTimeout(o),n(s)})})}function Vl(e,t,r){if(typeof t!=="number"||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>{o(Error(r))},t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function oo(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function bi(e){return e==="/"?e:e.replace(/\/+$/,"")}function Xn(e,t){return bi(e)===bi(t)}function Ri(e){return e.method==="GET"||e.method==="HEAD"}function Fl(e){if(e.isReady()&&e.config?.readyz?.enabled===!1)return me();let t=e.readiness();return Response.json(Dl(t),{status:t.ok?200:503})}function Dl(e){let t=e.config.lastError;if(!t)return e;return{...e,config:{...e.config,lastError:{kind:t.kind,phase:t.phase,at:t.at,message:"[redacted]"}}}}var zl={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","iam.workloads":"iam","iam.customers":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz"};function Bl(e){let t=e?.providers;if(!t)return!1;return Object.values(t).some((r)=>r.enabled!==!1&&r.type!=="magic-link")}function Pe(e,t,r={}){let n=zl[e],o=t.modules[n],s=r.capable??!0,i=o.active&&o.ready&&s,c=i?void 0:!o.active||!o.ready?o.reason:r.incapableReason??`${e} is not testable by this application wiring`;return{module:n,active:o.active,ready:o.ready,testable:i,...r.urls&&r.urls.length>0?{urls:r.urls}:{},...c?{reason:c}:{}}}function Gl(e,t,r){let n=Fe(t),o=e.readiness();return{sdk:{version:$n,catalogVersion:fn},basePath:t,urls:n,modules:o.modules,lfvCallbackTransport:Boolean(r.lfv?.callbackTransport),capabilities:{"sso.login":Pe("sso.login",o,{urls:[n.sso.loginUrl,n.sso.callbackUrl,n.sso.userUrl]}),"sso.jit":Pe("sso.jit",o,{capable:r.sso?.enableJitUserProvisioning!==!1&&Boolean(r.sso?.userStore),incapableReason:r.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":Pe("sso.logout",o,{urls:[n.sso.logoutUrl]}),"sso.back_channel_logout":Pe("sso.back_channel_logout",o,{urls:[n.sso.logoutBackChannelUrl]}),"ciam.magic_link":Pe("ciam.magic_link",o,{capable:Boolean(r.ciam?.magicLinkStore)&&r.ciam?.enableJitUserProvisioning!==!1,urls:[n.ciam.magicLinkUrl,n.ciam.magicLinkLoginUrl],incapableReason:!r.ciam?.magicLinkStore?"CIAM magic-link is enabled but no magicLinkStore capability is wired by the application.":"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":Pe("ciam.oidc_login",o,{capable:Bl(r.ciam),urls:[n.ciam.customerLoginUrl,n.ciam.customerCallbackUrl,n.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":Pe("ciam.customer",o,{urls:[n.ciam.customerUrl]}),"ciam.logout":Pe("ciam.logout",o,{urls:[n.ciam.logoutUrl]}),"iam.users":Pe("iam.users",o,{capable:Boolean(r.iam?.userStore),urls:[n.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":Pe("iam.groups",o,{capable:Boolean(r.authz?.catalogStore||r.authz?.catalog),urls:[n.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"iam.workloads":Pe("iam.workloads",o,{capable:Boolean(r.iam?.workloadIdentityStore),urls:[n.iam.workloadsUrl],incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."}),"iam.customers":Pe("iam.customers",o,{capable:Boolean(r.iam?.customerStore),urls:[n.iam.customersUrl],incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."}),"workload.incoming":Pe("workload.incoming",o,{urls:[n.workload.validateUrl,n.workload.jwksUrl]}),"workload.outgoing":Pe("workload.outgoing",o,{}),"authz.oaa":Pe("authz.oaa",o,{capable:Boolean(r.authz?.accessStore&&(r.authz?.catalogStore||r.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."})}}}async function Jl(e,t,r){if(!t.isReady())return oo();if(t.config?.capabilitiez!==!0||!r)return me();let n=await pt(e,t,Pi["capabilitiez.read"]);if(n)return n;return Response.json(r.build(),{status:200})}async function Hl(e){if(!e)return[];let t=[];for await(let r of Wt((n,o)=>e.list({start:n,limit:o})))t.push(r);return t}function Zn(e,t){return[...new Set(e.filter((r)=>r.subjectType===t).map((r)=>typeof r.subject==="string"?r.subject:r.subject.id).filter((r)=>Boolean(r)))]}function Qn(e,t,r){if(!e)return;if(t==="all")return Wt((n,o)=>e.list({start:n,limit:o}));return async function*(){for(let o of r){let s=await e.get(o);if(s)yield s}}()}async function Yl(e,t,r){if(!t.isReady())return oo();if(t.config?.authz?.oaa?.fullSync?.enabled!==!0)return me();let n=await pt(e,t,Pi["authz.oaa.sync"]);if(n)return n;let o=t.authz?.oaa;if(!o?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let s=t.authz?await t.authz.reconcile():void 0,i=r.iam?.userStore,c=r.iam?.customerStore??r.ciam?.customerStore,u=r.workload,a=r.iam?.workloadIdentityStore??(u&&"workloadIdentityStore"in u?u.workloadIdentityStore:u&&("incoming"in u)&&u.incoming&&!Array.isArray(u.incoming)&&("workloadIdentityStore"in u.incoming)?u.incoming.workloadIdentityStore:void 0),d=il(r.authz?.catalog?Ii(r.authz.catalog):void 0,r.authz?.catalogStore),g=r.authz?.accessStore,m=r.authz?.resources,C=await Hl(g),P=await o.sync({users:Qn(i,o.population("user"),Zn(C,"user")),customers:Qn(c,o.population("customer"),Zn(C,"customer")),workloads:Qn(a,o.population("workload"),Zn(C,"workload")),groups:d?Wt((E,O)=>d.groups.list({start:E,limit:O})):void 0,roles:d?Wt((E,O)=>d.roles.list({start:E,limit:O})):void 0,permissions:d?Wt((E,O)=>d.permissions.list({start:E,limit:O})):void 0,resources:m?Wt((E,O)=>m.list({start:E,limit:O})):void 0,access:C},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...P,reconcile:s})}function Xl(e,t,r,n,o,s){return async(i)=>{let c=new URL(i.url).pathname;if(Xn(c,r)){if(!Ri(i))return It(["GET"]);return Fl(e)}if(Xn(c,n)){if(!Ri(i))return It(["GET"]);return Jl(i,e,o)}if(s&&Xn(c,s.url)){if(i.method!=="POST")return It(["POST"]);return Yl(i,e,s.frameworkConfig)}let u=e.secrets;if(!Boolean(u?.isLfvDeliveryRequest?.(i)||u?.isLfvEventsRequest?.(i))&&!e.isReady())return oo();try{return await t(i)}catch(d){return e.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},d),Pt(d)}}}function Ci(e,t,r){if(e)return r&&!e.tenantId?{...e,tenantId:r}:e;if(t&&r)return{tenantId:r};return}function Zl(e,t){if(t.authz===null)return;if(!e.authz&&!t.authz)return;return{...e.authz,...t.authz,oaa:e.authz?.oaa||t.authz?.oaa?{...e.authz?.oaa,...t.authz?.oaa}:void 0}}function eo(e){let t=!1,r=ye(`${e} module`,()=>t);return{isReady:r.isReady,ready:r.ready,attach(n){if(t=n!==void 0,r.refresh(),!n)return;return Object.defineProperty(n,"isReady",{value:r.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(n,"ready",{value:r.ready,enumerable:!1,configurable:!0}),n}}}function no(e){if(!e)return!1;return e.isReady?e.isReady():!1}function Mt(e,t,r,n){if(!e)return{active:!1,ready:!1,reason:r};return no(t)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:n}}function Ql(){let e=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:e(),ciam:e(),iam:e(),workload:e(),otel:e(),secrets:e(),kms:e(),authz:e()}}function ef(e,t,r){let n=e.isReady(),o=e.config;if(!n||!o)return{ok:!1,applied:n,modules:Ql(),config:{...t}};let s=Fr(r),i=Boolean(o.workload)||Boolean(e.workload),c={sso:Mt(Boolean(o.sso),e.sso,"sso not configured (no RemoteConfig.sso)",s.sso??"sso configured but not ready"),ciam:Mt(Boolean(o.ciam),e.ciam,"ciam not configured (no RemoteConfig.ciam)",s.ciam??"ciam configured but not ready"),iam:Mt(Boolean(o.iam),e.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:Mt(i,e.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:Mt(Boolean(o.otel),e.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(o.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!no(e.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return e.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:Mt(Boolean(o.kms),e.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(o.authz?.oaa))return{active:!0,ready:!0};let d=e.authz?.oaa;return no(d)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})()};return{ok:Object.values(c).every((a)=>!a.active||a.ready),applied:n,modules:c,config:{...t}}}function tf(e,t){let r=[];for(let n of t){let o=e.modules[n];if(!e.applied){r.push({name:n,reason:"RemoteConfig has not been applied yet"});continue}if(!o?.ready)r.push({name:n,reason:o?.reason??`${n} is not ready`})}return{ok:r.length===0,notReady:r}}function rf(e,t,r,n,o,s,i,c){let u=t.validators,a=dl(e.cache);cl(a.jwks);let d=t;if(a.session.read.enabled){let Z=t.sso?.sessionStore??t.ciam?.sessionStore;if(Z){let ee=In(Z,a.session.read);d={...t,sso:t.sso?{...t.sso,sessionStore:ee}:t.sso,ciam:t.ciam?{...t.ciam,sessionStore:ee}:t.ciam}}}let g={sessionCache:a.session},m=Je(u.workload,r,e?.workload,t.workload??void 0),C=t.otel!==null?hn(r,e?.otel,t.otel??void 0,o):void 0,P=Fr(d);if(Object.keys(e).length>0){if(P.sso)r.error(P.sso);if(P.ciam)r.error(P.ciam)}let E=Ci(e?.sso,t.sso,e.id),O=P.sso?void 0:ll(u.sso,r,E,d.sso??void 0,g),b={...e?.iam,...t.iam},T=t.authz?.catalog?Ii(t.authz.catalog):void 0,l=t.workload,k=l&&"workloadIdentityStore"in l?l.workloadIdentityStore:l&&("incoming"in l)&&l.incoming&&!Array.isArray(l.incoming)&&("workloadIdentityStore"in l.incoming)?l.incoming.workloadIdentityStore:void 0,W=Boolean(b.url||b.userStore||t.authz?.catalogStore||T),F=i.update({users:e?.iam?.users?.delta,workloads:e?.iam?.workloads?.delta,customers:e?.iam?.customers?.delta,url:b.url,audience:b.deltaAudience},{workload:m,workloadIdentityStore:k,userStore:b.userStore,customerStore:b.customerStore??d.ciam?.customerStore,accessStore:t.authz?.accessStore,catalogStore:t.authz?.catalogStore,codeCatalog:T,mapUserToScim:b.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:b.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:b.inboundWorkloads?.mapBaseWorkloadToScim}),Q;if(W&&!m){if(Object.keys(e).length>0)r.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");Q=void 0}else Q=ul(u.iam,r,m,s,t.authz?.accessStore,t.authz?.accessIndex,t.authz?.catalogStore,T,t.authz?.resources,e?.iam,t.iam??void 0,F,t.authz?.onAccessMutation,ol(e.authz),c);let ce=Ci(e?.ciam,t.ciam,e.id),se=P.ciam?void 0:al(u.ciam,r,ce,d.ciam??void 0,m,g);return{secret:n,workload:m,otel:C,sso:O,iam:Q,ciam:se}}function Ui(e,t,r,n,o,s,i,c){let u=s.authz.update(Zl(t,r));e.id=t.id,e.config=t,e.secrets=s.secrets.update(t.secrets,r.secrets??void 0,r.validators.secrets,r.lfv?.callbackTransport,r.lfv?.singleProcess),e.kms=s.kms.update(t.kms,(m)=>{if(!m.source)return o;if(!e.secrets)throw Error(`KMS pool references unavailable secrets source "${m.source}".`);return e.secrets.getSecretsSource(m.source)});let a=rf(t,r,n,o,s.kms.handle(),u,s.iamDelta,s.authz.settle);e.secret=a.secret,e.workload=s.workload.update(a.workload),e.otel=s.otel.update(a.otel),e.authz=u,e.log=s.log.update(e.otel?.logger??n),e.sso=s.sso.attach(a.sso),e.iam=s.iam.attach(a.iam),e.ciam=s.ciam.attach(a.ciam);let d=Fe(i),g=(m)=>vn(m,e,c?.routing,d);e.handler=Xl(e,g,d.readyzUrl,d.capabilitiezUrl,{build:()=>Gl(e,i,r)},{url:go(i),frameworkConfig:r})}function nf(e,t,r,n,o,s,i,c,u){Il(e.id,t),Ol(t),El(t),_l(t),Ll(t,r,n),Ml(t,r),Nl(t,r,n,c),Ui(e,t,r,n,o,s,i,u)}function Ti(e){if(!e.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return e.secret}async function of(e,t,r,n,o,s,i){let c=e,u=yo(e,t,o.current,s);if(n.beforeChange){let a=Oi(u,o);i?.enter();let d;try{d=await n.beforeChange(e,a,r)}finally{i?.exit()}if(d?.config!==void 0)c=d.config;u=d?.frameworkConfig??a}return u=qt(u,o.current),{effectiveRemoteConfig:c,effectiveFrameworkConfig:u}}function Mg(e,t){let r=pl(t),{frameworkConfig:n,basePath:o,readyTimeoutMs:s,stores:i,options:c}=r,u=xl(n,e),a=new Set(u.keys()),d=qt(Ul(n,e),i),g=d.log||Yn,m={current:i},C={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:d},P=ln(g),E,O={log:ml(g),secrets:Ws(g,u),kms:as(g),workload:Bs(g),otel:fs(g),authz:$o(g,()=>P.handle(),()=>E?.iam,()=>({mapUserToScim:C.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:C.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:C.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim})),iamDelta:P,sso:eo("sso"),iam:eo("iam"),ciam:eo("ciam")},b={},T,l,k=new Promise((I,x)=>{T=I,l=x}),W=!1,F,Q,ce=0,se={enter:()=>{ce+=1},exit:()=>{ce-=1}},Z=Promise.resolve();function ee(I){let x=Z.then(I,I);return Z=x.then(()=>{return},()=>{return}),x}function ue(I){if(W)throw Error(`Ionite instance has been closed and cannot call ${I}().`)}function z(){e.log=C.frameworkConfig.log??Yn,e.validators=C.frameworkConfig.validators}let J={},B={log:g,id:void 0,config:void 0,secret:Ti(e),authz:void 0,configStatus:b,handler:async()=>me(),ready:(I)=>{if(ce>0&&C.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return Kl(k,I??s)},isReady:()=>C.remoteConfig!==void 0,readiness:()=>ef(B,b,C.frameworkConfig),requireReady:(I)=>tf(B.readiness(),I),close:()=>{if(W)return;if(W=!0,Q)clearTimeout(Q),Q=void 0;F?.(),F=void 0;let I=[()=>O.secrets.close(),()=>O.kms.close(),()=>O.authz.close(),()=>O.otel.shutdown()];for(let x of I)try{Promise.resolve(x()).catch((N)=>{g.warn("Ionite close: module teardown failed",N)})}catch(N){g.warn("Ionite close: module teardown failed",N)}T?.(),T=void 0,l=void 0},setStores:async(I)=>{ue("setStores");let x=ir(I);await ee(()=>M(x))}};E=B,Ui(B,J,C.frameworkConfig,g,B.secret,O,o,c),z();function ae(){let I=b.lastError!==void 0;if(b.appliedAt=Date.now(),b.lastError=void 0,I)(B.log??g).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function re(I,x){let N=to(x)??(x instanceof Error?x.message:String(x)),w=Sl(x),_=b.lastError===void 0;if(b.lastError={kind:w,message:N,at:Date.now(),phase:I},_)(B.log??g).error(I==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":w,phase:I,error:N})}function ne(I,x,N){(B.log??g).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:I,"ion.config.hash":x,"ion.config.apply_ms":N})}async function R(I,x){if(W)return;let N=vi(I);if(x&&C.remoteConfig!==void 0&&N===C.remoteConfigHash&&ki(I,C.remoteConfig))return;let w=C.remoteConfig,_=w===void 0?"initial":"update",h=Date.now(),p,f,S;try{let Y=await of(I,C.frameworkConfig,C.remoteConfig,c,m,o,se);if(p=Y.effectiveRemoteConfig,f=vi(p),S=Y.effectiveFrameworkConfig,x&&c.beforeChange===void 0&&C.remoteConfig!==void 0&&f===C.remoteConfigHash&&ki(p,C.remoteConfig)&&S===C.frameworkConfig)return;let K=S.log||Yn;nf(B,p,S,K,Ti(e),O,o,a,c)}catch(Y){throw re(_,Y),Y}C.remoteConfig=p,C.remoteConfigHash=f,C.frameworkConfig=S,z(),ae(),await O.otel.settled();let A=Oi(C.frameworkConfig,m),j=!1;try{c.afterChange?.(B,p,A,w)}catch(Y){if((B.log??g).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:_,error:Y instanceof Error?Y.message:String(Y)}),_==="initial"){j=!0;let K=Y instanceof Error?Y:Error(`afterChange failed on initial load: ${String(Y)}`);re("initial",K),l?.(K),l=void 0,T=void 0}}if(C.frameworkConfig=A,z(),!j)ne(_,f,Date.now()-h);if(!j&&T)T(),T=void 0}async function M(I){if(W)return;if(m.current=I,C.remoteConfig===void 0){C.frameworkConfig=qt(C.frameworkConfig,I),z();return}await R(C.remoteConfig,!1)}if(e.subscribe)e.subscribe((I)=>{ee(()=>R(I,!0)).catch(()=>{})},{mode:"wait"}).then((I)=>{if(W){I?.();return}F=I}).catch((I)=>{g.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:I instanceof Error?I.message:String(I)})});let G=Rl(c.configRetry),H=[c.onConfigLoadError??Tl(g)],v=0;function U(){if(Q=void 0,W)return;if(C.remoteConfig!==void 0)return;Vl(e.load(),G.loadTimeoutMs,`ConfigSource initial load timed out after ${G.loadTimeoutMs}ms`).then(async(I)=>{v=0;try{await ee(async()=>{if(C.remoteConfig!==void 0)return;await R(I,!0)})}catch(x){let N=x instanceof Error?x:Error(`Initial RemoteConfig application failed: ${String(x)}`);g.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:N.message}),l?.(N),l=void 0}},async(I)=>{if(W)return;v+=1;let x=Cl(v,G),N=to(I)??"RemoteConfig load failed",w=vl(I),_=xe(I,"code"),h=xe(I,"status"),p={attempt:v,error:I,errorKind:w,maxDelayMs:G.maxDelayMs,message:N,nextDelayMs:x,code:typeof _==="string"?_:void 0,status:typeof h==="number"?h:void 0,path:typeof xe(I,"path")==="string"?xe(I,"path"):void 0,sourceType:typeof xe(I,"sourceType")==="string"?xe(I,"sourceType"):void 0};if(!bl(I,w)){let f=I instanceof Error?I:Error(`ConfigSource initial load failed with unrecoverable ${w}: ${N}`);g.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:w,error:N,code:p.code,status:p.status,path:p.path,sourceType:p.sourceType}),l?.(f),l=void 0;return}try{await Pl(p,H)}catch(f){let S=f instanceof Error?f:Error("ConfigSource retry hook stopped RemoteConfig retrying");l?.(S),l=void 0;return}Q=setTimeout(U,x)})}return U(),B}export{qg as AssignmentPolicyError,Hg as CatalogAdjacencyCache,yc as ION_CAPABILITY_CATALOG,fn as ION_CAPABILITY_CATALOG_VERSION,fl as ION_READY_DEFAULT_TIMEOUT_MS,$n as ION_SDK_VERSION,He as InMemoryAccessAssignmentStore,Zs as InMemoryAccessCatalogStore,ei as InMemoryAccessIndex,rr as InMemoryCustomerStore,nr as InMemoryMagicLinkStore,Qs as InMemoryResourceStore,or as InMemorySessionStore,gy as InMemoryTenantStore,sr as InMemoryUserStore,hi as InMemoryWorkloadIdentityStore,it as InMemoryWorkloadTokenStore,Kg as IoniteError,vr as ScimOutboundClient,Pr as VAULT_MIN_POLLING_TTL_MS,er as VaultConfigInvalidPayloadError,yt as VaultConfigWaitingForSecretError,Le as VaultSubscribeNotSupportedError,Dg as allowHosts,zg as allowOrigins,Bg as allowRelativePaths,Gg as allowSameOrigin,Fn as awsConfig,Wr as azureConfig,Jg as blockDangerousUrls,Yg as callback,Xg as captureRedirect,Zg as ciam,Es as closeAllVaultSockets,Qg as collectReferencedDefinitions,Gn as configFromSource,qr as configLocatorFromEnvValues,ai as configSourceFromEnvValues,Ze as configSourceFromLocator,ln as createManagedIamDelta,In as createSessionReadCache,tl as createTenantIonHandler,Zd as createTenantIonResolver,ey as defaultRedirectPolicies,Fe as deriveIonUrls,Qi as devInMemoryStores,ty as discoverSessionRecords,ry as discoverSessions,pt as enforceEndpointAuthz,Vd as envConfig,un as escapeScimFilterValue,ny as expandRoot,Dn as gcpConfig,Ng as generateULID,oy as getCustomer,sy as getUser,sd as getWorkload,id as getWorkloadToken,iy as has,ay as hasAll,cy as hasAllScope,uy as hasAny,dy as hasAnyScope,ly as hasGroup,fy as hasPermission,py as hasRole,my as hasScope,yy as iam,wy as initiateLogin,Mg as ionite,hy as isRedirectAllowed,_d as isVaultConfigInvalidPayloadError,Ad as isVaultConfigWaitingForSecretError,lt as lfvVault,Vg as listGenerator,vy as listSsoClientIdsFromCookies,zn as mirrorSecrets,Qt as mirroredConfig,Sy as reconcileSubjectAccess,ky as resolveAfterRedirect,by as resolveCapturedRedirect,ms as resolveDefaultRoute,Ry as resolveRedirect,yi as resolveTenantFromRequest,ad as revokeWorkloadToken,Qd as rewriteRequestForDefaultTenantApi,el as rewriteRequestForDefaultTenantUi,Hn as rewriteRequestForTenantPath,wi as rewriteRequestPath,vn as routeRequest,Cy as sameOriginRedirectRules,zd as secretConfigSource,Ty as sendTenantWebhook,vs as setVaultWebSocketCommandTimeout,Py as sso,Ge as subscribeSecretPathWithHttpPolling,gd as tenantManager,Gd as tenantMirror,jn as validateWorkloadToken,At as vault,jr as vaultConfig,Os as vaultSocketDiagnostics,Iy as verifyUser,Oy as withSetCookies,Je as workload,cd as workloadHandler};
+`;if(C==="r")return"\r";if(C==="t")return"\t";return C}):g}else t[u]=a}return t}function Jo(e){return Object.entries(e).map(([t,r])=>{let n=String(r??"");if(!n||/[\s#"'\\]/.test(n))return`${t}=${JSON.stringify(n)}`;return`${t}=${n}`}).join(`
+`)}function Ho(e){try{let t=atob(e);return Uint8Array.from(t,(r)=>r.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function vr(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("Secret content is not an object");return e}function Ft(e){return e.metadata.contentType??Qa()}function on(e,t){if(t==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof e.data==="string")return e.data;if(t==="jsonc")return JSON.stringify(e.data,null,2);if(t==="env")return Jo(vr(e.data));let r=vr(e.data).content;if(typeof r!=="string")throw Error(`Secret ${t} content must contain a string "content" field`);return r}function hr(e,t){if(t==="jsonc")return typeof e.data==="string"?ec(e.data):e.data;if(t==="env")return typeof e.data==="string"?Go(e.data):vr(e.data);if(t==="text")return on(e,t);if(t==="binary"){let r=vr(e.data).content_base64;if(typeof r!=="string")throw Error('Binary secret content must contain a "content_base64" string');return Ho(r)}throw Error(`Typed ${t} decoding is not supported yet; use text() or bytes()`)}function rc(e){return{format:e.format,mimeType:e.mimeType,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id}}function nc(e,t){let r=Ft(e);if(r.format!==t.format||r.mimeType!==t.mimeType)throw new tc(rc(t),r)}async function oc(e,t){if(!e.schema)return t;let r=await e.schema["~standard"].validate(t);if(r.issues){let n=r.issues.map((o)=>o.message).join("; ");throw Error(`Secret validation failed for type "${e.id}": ${n}`)}return r.value}function qe(e){return{async text(){let t=await e();return on(t,Ft(t).format)},async json(){let t=await e(),r=Ft(t).format;if(r!=="jsonc")throw Error(`json() requires a jsonc secret; received ${r}`);return hr(t,r)},async bytes(){let t=await e(),r=Ft(t).format;if(r==="binary")return hr(t,r);return new TextEncoder().encode(on(t,r))},async env(){let t=await e(),r=Ft(t).format;if(r!=="env")throw Error(`env() requires an env secret; received ${r}`);return hr(t,r)},async metadata(){return(await e()).metadata},async parse(t){let r=await e();return nc(r,t),oc(t,hr(r,t.format))}}}function Xo(e){try{return new URL(e).pathname}catch{return e.startsWith("/")?e:`/${e}`}}var ac=1e4,cc=1e4,uc=300,Zo=100;async function dn(e){await new Promise((t)=>setTimeout(t,e))}function Ae(e){return{startedAt:Date.now(),timeout:typeof e?.timeout==="number"&&e.timeout>0?e.timeout:void 0}}function sn(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function zt(e){if(e.timeout===void 0)return;let t=Date.now()-e.startedAt;return Math.max(0,e.timeout-t)}function ze(e,t,r){return Error(`LFV ${e} timed out after ${r.timeout??0}ms for ${t}`)}async function Rt(e,t,r,n,o){let s=zt(r);if(s!==void 0){if(s<=0)throw ze(n,o,r);let i=new AbortController,c=setTimeout(()=>i.abort(),s);try{return await fetch(e,{...t,signal:i.signal})}catch(u){if(u instanceof Error&&u.name==="AbortError")throw ze(n,o,r);throw u}finally{clearTimeout(c)}}return await fetch(e,t)}class Te extends Error{constructor(e){super(`LFV source closed while operating on ${e}`);this.name="LfvSourceClosedError"}}class De extends Error{constructor(e){super(e);this.name="LfvProtocolError"}}class dt extends De{constructor(e,t,r){super(`LFV ${t} failed (${e}) for ${r}`);this.status=e;if(this.name="LfvActionStatusError",e===404)this.code="not_found"}}var dc=new Set([400,401,403,404,409,410]);function Qo(e){return e instanceof De&&(!(e instanceof dt)||dc.has(e.status))}function Sr(e){return e instanceof Te||e instanceof Error&&e.name==="LfvSourceClosedError"}function lc(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`LFV kms_park returned invalid payload for ${t}`);let r=e;if(typeof r.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${t}`);let n=r.disposition;if(n!==void 0&&n!=="cooldown"&&n!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${t}`);return{parked:r.parked,...r.stale===!0?{stale:!0}:{},...n?{disposition:n}:{}}}function Dt(e){try{let t=JSON.parse(e);return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:void 0}catch{return}}async function an(e,t,r,n,o,s,i,c,u,a){let d=0,g=Date.now();for(;;){if(a?.())throw new Te(n);let m=zt(r);if(m!==void 0&&m<=0)throw ze(o,n,r);try{return await e()}catch(C){if(C instanceof Te)throw C;if(a?.())throw new Te(n);if(d+=1,i>0&&Date.now()-g>=i){let E=`Error connecting to the LFV source. Retries: '${d}'`;if(c)c(u,E,{url:t,path:n,operation:o});g=Date.now()}let P=m===void 0?s:Math.min(s,m);if(P<=0)throw ze(o,n,r);if(await dn(P),a?.())throw new Te(n)}}}function fc(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function cn(e){if(typeof e==="number"&&Number.isFinite(e))return e;if(typeof e==="string"&&e.trim()){let t=Date.parse(e.trim());if(!Number.isNaN(t))return t}return}function es(e){return`[LFV] [${e??"-"}] [${new Date().toISOString()}]: `}function un(e,t){if(typeof e!=="string"||e.trim()==="")throw Error(`LFV source requires "${t}"`);return e}function pc(e){return{...e,lfvServerUrl:un(e.lfvServerUrl,"lfvServerUrl"),clientId:un(e.clientId,"clientId"),path:un(e.path,"path")}}function lt(e,t,r={}){let n=pc(e),o=n.log??sc,s=(y,L,j)=>{let V=es(y)+L;if(j!==void 0)o.debug(V,j);else o.debug(V)},i=(y,L,j)=>{let V=es(y)+L;if(j!==void 0)o.warn(V,j);else o.warn(V)},{lfvServerUrl:c,clientId:u,path:a,verifyJwks:d}=n,g=typeof n.deliveryTimeout==="number"&&n.deliveryTimeout>0?n.deliveryTimeout:void 0,m=typeof n.retryInterval==="number"&&n.retryInterval>0?n.retryInterval:ac,C=typeof n.warnInterval==="number"&&n.warnInterval>=0?n.warnInterval:cc,P=(typeof n.callbackMaxAgeSeconds==="number"&&n.callbackMaxAgeSeconds>0?n.callbackMaxAgeSeconds:uc)*1000,E=typeof n.cacheMaxAgeSeconds==="number"&&n.cacheMaxAgeSeconds>0?n.cacheMaxAgeSeconds*1000:void 0,O=d?.trim()?ic(d.trim()):void 0,k=Xo(n.deliveryEndpoint),T=Xo(n.eventsEndpoint),l=wr({lfvServerUrl:c,path:a}),b=crypto.randomUUID(),W=new Map,F=new Set,Q=new Map,ce=new Map,se=new Map,Z=new Map,ee=new Map,ue=new Map,z=new Map,J=(y,L)=>{if(typeof L==="number"&&Number.isInteger(L)&&L>=1){let j=z.get(y)??1,V=Math.max(j,L);return z.set(y,V),V}return z.get(y)},B=(y,L)=>typeof L==="number"&&Number.isInteger(L)&&L>=1&&L>(z.get(y)??1),ae=new Map,re=new Map,ne=!1,R,M=new Set,G=()=>ne;function H(y,L){Q.set(y,L),ce.set(y,Date.now())}function v(y){Q.delete(y),ce.delete(y)}function U(y){let L=Q.get(y);if(!L)return;if(E!==void 0){let j=ce.get(y)??0;if(Date.now()-j>E){s(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:y});return}}return L}function I(){return F.size>0||W.size>0||ue.size>0}function x(){if(ne){if(R)R(),R=void 0;return}let y=I();if(y&&!R)R=Do(l,b,{trustId:O,onDelivery:async(L)=>lo(L).handled||await po(L),onEvents:async(L)=>{mo(L)}});if(!y&&R)R(),R=void 0}async function q(y,L,j,V){if(!t)throw Error("LFV callback transport is not configured");for(;;){if(ne)throw new Te(L);if(V())throw new Te(L);let X=await t.take(y);if(X){if(X.key!==l)i(y,"parked OTP callback rejected: callback key mismatch");else if(!await Vr(X.rawBody,X.headers)){let fe=Dt(X.rawBody);if(fe?.type==="otp"&&fe.request_id===y&&typeof fe.otp==="string"&&fe.otp)return fe.otp}}let D=zt(j);if(D!==void 0&&D<=0)throw ze("issueOtp",L,j);await dn(D===void 0?Zo:Math.min(Zo,D))}}async function w(y,L){let j=L??crypto.randomUUID(),V={startedAt:Date.now(),timeout:g},X={request_id:j,path:y,action:"read_secret",...sn(J(y))},D=await an(()=>Rt(`${c.replace(/\/+$/g,"")}/clients/${u}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":j},body:JSON.stringify(X)},V,"issueOtp",y),c,V,y,"issueOtp",m,C,i,j,G);if(D.status!==200&&D.status!==202)throw new dt(D.status,"issueOtp",y)}async function _(y,L){let j=re.get(y);if(j)return j;let V=w(y,L);re.set(y,V);try{await V}finally{if(re.get(y)===V)re.delete(y)}}async function h(y,L,j,V){if(ne)throw new Te(y);let X=j??crypto.randomUUID(),D=V??Ae(),ie=new Promise((Ee,$t)=>{let go={resolve:Ee,reject:$t},Fr=zt(D);if(Fr!==void 0){if(Fr<=0){$t(ze("issueOtp",y,D));return}go.timer=setTimeout(()=>{ue.delete(X),x(),$t(ze("issueOtp",y,D))},Fr)}ue.set(X,go),x()});ie.catch(()=>{});let fe=()=>{let Ee=ue.get(X);if(!Ee)return;if(Ee.timer)clearTimeout(Ee.timer);ue.delete(X),x()},de={request_id:X,path:y,action:L,...sn(J(y))};s(X,"OTP request",{path:y,action:L});let he;try{he=await an(async()=>await Rt(`${c.replace(/\/+$/g,"")}/clients/${u}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":X},body:JSON.stringify(de)},D,"issueOtp",y),c,D,y,"issueOtp",m,C,i,X,G)}catch(Ee){throw fe(),Ee}if(he.status!==200&&he.status!==202)throw fe(),new dt(he.status,"issueOtp",y);let ke=!1,ve=t?q(X,y,D,()=>ke):void 0;if(ve)ve.catch(()=>{});try{let Ee=await(ve?Promise.race([ie,ve]):ie);return s(X,"OTP received via signed callback",{path:y,action:L}),Ee}finally{ke=!0,fe()}}async function p(y,L,j,V,X,D,ie){if(ne)throw new Te(L);let fe=ie??Ae(),de=await an(async()=>await Rt(`${c.replace(/\/+$/g,"")}${y}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":X},body:JSON.stringify({request_id:X,otp:V,path:L,...sn(J(L)),...D??{}})},fe,j,L),c,fe,L,j,m,C,i,X,G);if(de.status!==200&&de.status!==202)throw new dt(de.status,j,L);return s(X,`${j} accepted`,{path:L,status:de.status}),de}async function f(y,L,j,V,X,D){if(ne)throw new Te(L);let ie=X??crypto.randomUUID(),fe=D??Ae(),de=await h(L,j,ie,fe),he=await p(y,L,j,de,ie,V,fe);return{requestId:ie,response:he}}async function S(y,L,j){if(ne)throw new Te(y);let V=B(y,j?.kmsSlots);if(J(y,j?.kmsSlots),V)v(y);let X=U(y);if(X)return X;let D=ae.get(y);if(D){if(!V)return D;if(await D.catch(()=>{return}),D=ae.get(y),D)return D}let ie=A(y,L,j);ae.set(y,ie),ie.catch((fe)=>{if(Sr(fe))s(L,"read aborted: source closed",{path:y})});try{return await ie}finally{ae.delete(y)}}async function A(y,L,j){let V=j?.timeout??g,X={startedAt:Date.now(),timeout:typeof V==="number"&&V>0?V:void 0},D=L??crypto.randomUUID();s(D,"read_secret request",{path:y});let ie=0,fe=Date.now();for(;;){if(ne)throw new Te(y);try{let{response:de}=await f("/secrets/request",y,"read_secret",void 0,D,X),he=await N(D,de),ke=Y(y,he);return K(y,ke,ke.metadata.version),s(D,"read_secret completed from action response",{path:y}),ke}catch(de){if(de instanceof Te)throw de;if(Qo(de))throw de;let he=zt(X);if(he!==void 0&&he<=0)throw ze("read_secret",y,X);if(ie+=1,C>0&&Date.now()-fe>=C)i(D,`read_secret retrying. Retries: '${ie}'`,{path:y}),fe=Date.now();let ke=he===void 0?m:Math.min(m,he);if(ke<=0)throw ze("read_secret",y,X);await dn(ke)}}}async function N(y,L){if(!d?.trim())throw new De("LFV read_secret response verification is not configured");let j=L.headers.get("X-LFV-Request-Id")?.trim(),V=L.headers.get("X-LFV-Key-Id")?.trim(),X=L.headers.get("X-LFV-Signature")?.trim();if(!j||!V||!X)throw new De("LFV read_secret response is missing signature headers");if(j!==y)throw new De("LFV read_secret response request_id header does not match the request");let D=await L.text();if(!await Yo({jwks:d,kid:V,signatureB64Url:X,requestId:y,rawBody:D}))throw new De("LFV read_secret response signature verification failed");let fe=Dt(D);if(!fe||fe.request_id!==y)throw new De("LFV read_secret response request_id does not match the request");return fe}function Y(y,L){if(uo(L)!==y||L.data?.data===void 0)throw new De(`LFV read_secret returned an invalid secret response for ${y}`);let V=L.data.metadata??{},X=typeof V.version==="number"?V.version:0,D=V.created_time??V.created,ie=ut(V);return{data:L.data.data,metadata:{path:y,version:X,created:typeof D==="string"?new Date(D):new Date,...ie?{contentType:ie}:{}}}}function K(y,L,j){if(j!==void 0){let D=Z.get(y);if(D!==void 0&&j<D){s(void 0,"delivery ignored: stale version",{path:y,realVersion:j,lastAccepted:D});return}Z.set(y,j)}H(y,L),M.delete(y);let V=L.metadata.version;if(se.get(y)===V)return;se.set(y,V);let X=W.get(y);if(!X)return;for(let D of X)D(L)}async function oe(y,L){return await S(y,void 0,L)}async function te(y,L,j){if(!fc(L))throw Error(`putSecret requires an object value for LFV source at path ${y}`);let V=Ae(j),X={data:L,content_type:yr(j.contentType)};if(await st(y,j)){await f("/secrets/update",y,"update_secret",X,void 0,V),v(y);return}await f("/secrets/create",y,"create_secret",X,void 0,V),v(y)}async function we(y,L){let j=Ae(L);await f("/secrets/delete",y,"delete_secret",void 0,void 0,j),v(y)}async function le(y,L){let j=Ae(L),V=crypto.randomUUID();s(V,"list_paths request",{path:y});let X=await h(y,"list_paths",V,j),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},j,"listPaths",y);if(D.status!==200)throw Error(`LFV listPaths failed (${D.status}) for ${y}`);let ie=await D.json();if(!Array.isArray(ie.items))throw Error(`LFV listPaths returned invalid payload for ${y}`);return s(V,"list_paths success",{path:y,status:200}),ie.items.filter((fe)=>typeof fe==="string")}async function st(y,L){let j=Ae(L),V=crypto.randomUUID();s(V,"exists request",{path:y});let X=await h(y,"read_metadata",V,j),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},j,"exists",y);if(D.status!==200)throw Error(`LFV exists failed (${D.status}) for ${y}`);let ie=await D.json();if(typeof ie.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${y}`);return s(V,"exists success",{path:y,status:200,exists:ie.exists}),ie.exists}async function Ve(y,L,j){let V=Ae(j);await f("/secrets/rotate/request",y,"request_rotate",{reason:L?.reason,severity:L?.severity,incident_ref:L?.incidentRef},void 0,V)}async function jt(y,L,j){let V=Ae(j);await f("/secrets/revoke/request",y,"request_revoke",{reason:L?.reason,severity:L?.severity,incident_ref:L?.incidentRef},void 0,V)}async function $i(y,L,j){let V=Ae(j),{response:X}=await f("/secrets/kms/park",y,"kms_park",{key_id:L.keyId,status:L.status,reason:L.reason},void 0,V);return lc(await X.json().catch(()=>null),y)}function qi(y,L){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_add_keys returned invalid payload for ${L}`);let j=y;if(!Array.isArray(j.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${L}`);return{keys:j.keys.map((X,D)=>{if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`LFV kms_add_keys returned invalid keys[${D}] for ${L}`);let ie=X.id;if(typeof ie!=="string"||ie.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${D}].id for ${L}`);return{id:ie}})}}function Ni(y,L){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_revoke_key returned invalid payload for ${L}`);let j=y;if(typeof j.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${L}`);return{revoked:j.revoked}}async function Ki(y,L,j){let V=Ae(j),{response:X}=await f("/secrets/kms/add-keys",y,"kms_add_keys",{keys:L.keys},void 0,V);return qi(await X.json().catch(()=>null),y)}async function Vi(y,L,j){let V=Ae(j),{response:X}=await f("/secrets/kms/revoke-key",y,"kms_revoke_key",{key_id:L.keyId,reason:L.reason},void 0,V);return Ni(await X.json().catch(()=>null),y)}async function Fi(y,L){let j=Ae(L),V=crypto.randomUUID();s(V,"getMetadata request",{path:y});let X=await h(y,"read_metadata",V,j),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},j,"getMetadata",y);if(D.status!==200)throw Error(`LFV getMetadata failed (${D.status}) for ${y}`);let ie=await D.json();if(!ie.metadata||typeof ie.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${y}`);return s(V,"getMetadata success",{path:y,status:200}),ie.metadata}async function co(y,L,j,V=!0){let X=W.get(y)??new Set,D,ie=(de)=>{if(de.metadata.version===D)return;D=de.metadata.version,L(de)};if(X.add(ie),W.set(y,X),!V)return x(),()=>{let de=W.get(y);if(!de)return;if(de.delete(ie),de.size===0)W.delete(y);x()};let fe=B(y,j?.kmsSlots)?void 0:U(y);if(fe)ie(fe),se.set(y,fe.metadata.version);else try{ie(await oe(y,j))}catch(de){if(X.delete(ie),X.size===0)W.delete(y);throw de}return x(),()=>{let de=W.get(y);if(!de)return;if(de.delete(ie),de.size===0)W.delete(y);x()}}let Di=(y,L)=>co(y,L,void 0,!1);function zi(y){return y.method==="POST"&&new URL(y.url).pathname===k}function Bi(y){return y.method==="POST"&&new URL(y.url).pathname===T}function uo(y){let L=y.data?.metadata?.path;if(typeof L==="string"&&L)return L;if(typeof y.path==="string"&&y.path)return y.path;return}function Gi(y){let{request_id:L,otp:j}=y;if(typeof L!=="string"||typeof j!=="string"||!j)return{handled:!1};let V=ue.get(L);if(!V)return{handled:!1};if(V.timer)clearTimeout(V.timer);return ue.delete(L),x(),V.resolve(j),{handled:!0}}function lo(y){return y.type==="otp"?Gi(y):{handled:!1}}function Qe(y="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:y}),{status:401,headers:{"Content-Type":"application/json"}})}function fo(y){return{requestId:y.headers.get("X-LFV-Request-Id")??y.headers.get("x-lfv-request-id")??"",keyId:y.headers.get("X-LFV-Key-Id")??y.headers.get("x-lfv-key-id")??"",signature:y.headers.get("X-LFV-Signature")??y.headers.get("x-lfv-signature")??""}}async function Vr(y,L){if(!d?.trim())return i(void 0,"LFV callback rejected: verifyJwks is not configured"),Qe("LFV callback verification is not configured");let{requestId:j,keyId:V,signature:X}=L;if(!j.trim()||!V.trim()||!X.trim())return i(j||void 0,"LFV callback rejected: missing signature headers"),Qe("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await Yo({jwks:d,kid:V,signatureB64Url:X.trim(),requestId:j.trim(),rawBody:y}))return i(j,"LFV callback rejected: signature verification failed"),Qe();let ie=Dt(y);if(!ie)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let fe=ie;if(fe.request_id!==j.trim())return i(j,"LFV callback rejected: request_id header/body mismatch"),Qe("X-LFV-Request-Id does not match request_id in body");let de=Date.now(),he=cn(fe.issued_at);if(he===void 0)return i(j,"LFV callback rejected: missing or invalid issued_at"),Qe("Missing or invalid issued_at");if(de-he>P)return i(j,"LFV callback rejected: stale (outside freshness window)"),Qe("Callback is stale (issued_at outside freshness window)");let ke=cn(fe.expires_at);if(ke!==void 0&&de>ke)return i(j,"LFV callback rejected: expired"),Qe("Callback has expired");let ve=X.trim();for(let[Ee,$t]of ee)if($t<=de)ee.delete(Ee);if(ee.has(ve))return i(j,"LFV callback rejected: replayed signature"),Qe("Callback signature already processed (replay)");return ee.set(ve,he+P),null}async function po(y){if(!r.selfRedeemReads||y.action!=="read_secret"||typeof y.request_id!=="string"||typeof y.path!=="string"||typeof y.otp!=="string")return!1;let L={startedAt:Date.now(),timeout:g},j=await p("/secrets/request",y.path,"read_secret",y.otp,y.request_id,void 0,L),V=await N(y.request_id,j),X=Y(y.path,V);return K(y.path,X,X.metadata.version),!0}async function Ji(y){let L=await y.text(),j=fo(y),V=await Vr(L,j);if(V)return V;let X=Dt(L);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let D=X;if(D.type!=="otp"||typeof D.request_id!=="string"||typeof D.otp!=="string"||typeof D.path!=="string"||typeof D.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let ie=uo(D);s(D.request_id,"delivery received",{path:ie});let fe=lo(D),de=ie?wr({lfvServerUrl:c,path:ie}):l,he=await zo(de,D,b,O),ke=fe.handled||he>0;if(!ke)try{if(ke=await po(D),!ke&&t&&typeof D.request_id==="string"){let ve=cn(D.expires_at),Ee=Math.max(1,(ve??Date.now()+P)-Date.now());await t.put(D.request_id,{kind:"delivery",key:de,rawBody:L,headers:j},Ee),ke=!0}}catch(ve){if(Qo(ve)){if(!(ve instanceof dt)||ve.status!==409&&ve.status!==410)M.add(D.path);return i(j.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:de,status:ve instanceof dt?ve.status:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:{"Content-Type":"application/json"}})}return ee.delete(j.signature.trim()),i(j.requestId,"LFV callback handoff failed; callback may be retried",{key:de,error:ve instanceof Error?ve.message:String(ve)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(!ke)return ee.delete(j.signature.trim()),i(j.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:de}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function mo(y){if(ne)return;if(!y?.path||typeof y.path!=="string")return;s(y.request_id,"events payload",{path:y.path,event:y.event});for(let L of F)try{L({path:y.path,event:y.event,requestId:y.request_id,issuedAt:y.issued_at,expiresAt:y.expires_at,...typeof y.key_id==="string"&&y.key_id.length>0?{keyId:y.key_id}:{}})}catch(j){i(y.request_id,"secret event listener failed",{path:y.path,event:y.event,error:j instanceof Error?j.message:String(j)})}if(y.event==="created"||y.event==="updated"||y.event==="rotated")v(y.path),(r.selfRedeemReads?_(y.path,y.request_id):S(y.path,y.request_id).then(()=>{return})).catch((j)=>{if(Sr(j)){s(y.request_id,"event refresh aborted: source closed",{path:y.path});return}M.add(y.path),i(y.request_id,"event-triggered refresh failed; source marked degraded",{path:y.path,event:y.event,error:j instanceof Error?j.message:String(j)})})}async function Hi(y){let L=await y.text(),j=fo(y),V=await Vr(L,j);if(V)return V;let X=Dt(L);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let D=X;if(!D?.path||typeof D.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});s(D.request_id,"events received",{path:D.path,event:D.event}),mo(D);let ie=wr({lfvServerUrl:c,path:D.path});return await Bo(ie,D,b,O),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function Yi(){if(ne)return;if(ne=!0,R)R(),R=void 0;let y=new Te(a);for(let L of ue.values()){if(L.timer)clearTimeout(L.timer);try{L.reject(y)}catch{}}ue.clear(),ae.clear(),re.clear(),M.clear(),Q.clear(),ce.clear(),se.clear(),Z.clear(),ee.clear(),W.clear(),F.clear()}return{type:"vault",isAvailable:()=>M.size===0,get:(y,L)=>qe(()=>oe(y,L)),getFullSecret:oe,getSecret:async(y,L)=>(await oe(y,L)).data,putSecret:te,deleteSecret:we,listPaths:le,exists:st,requestRotate:Ve,requestRevoke:jt,parkKmsKey:$i,addKmsKeys:Ki,revokeKmsKey:Vi,getMetadata:Fi,subscribe:co,subscribePassive:Di,subscribeEvents:(y)=>(F.add(y),x(),()=>{F.delete(y),x()}),close:Yi,isDeliveryRequest:zi,isEventsRequest:Bi,handleDelivery:Ji,handleEvents:Hi,deliveryPath:k,eventsPath:T,callbackKey:l,trustId:O}}function ft(e,t,r){if(typeof e!=="string"||e.trim()==="")throw Error(`"${t}" is required when using ${r}`);return e}var Ct="__esLfvBootstrap";import{catalogEntityStore as br,listGenerator as Jt,materializeCodeCatalogEntity as wc,trimTrailingSlash as hc,unionCatalogRead as vc}from"@ionite/core";import{baseCustomerToScim as rs,baseUserToScimUser as ns,baseWorkloadToScim as os,entitlementToScimGroup as pn}from"@ionite/core/server";import{ION_AUTHZ_GROUP_SCHEMA as ln}from"@ionite/core";var ts="application/scim+json",mc="urn:ietf:params:scim:api:messages:2.0:PatchOp",gc="urn:ietf:params:scim:schemas:core:2.0:User",yc="urn:ietf:params:scim:schemas:core:2.0:Group";async function Bt(e){try{let t=(await e.clone().text()).trim();return t?t.slice(0,2000):void 0}catch{return}}function Gt(e){if(e==="user")return"Users";if(e==="workload")return"Workloads";if(e==="customer")return"Customers";return"Groups"}function fn(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class kr{constructor(e){this.inflight=new Map;this.memo=new Map;this.writes=new Map;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.getToken=e.getToken,this.receipts=e.receipts,this.log=e.log,this.fetchImpl=e.fetchImpl??((t,r)=>fetch(t,r))}async headers(){let e=await this.getToken();return new Headers({"Content-Type":ts,Accept:ts,Authorization:`Bearer ${e}`})}inflightKey(e,t,r){return`${e}\x00${t}\x00${r?"create":"lookup"}`}receiptKey(e,t){return`${e}\x00${t}`}serializeWrite(e,t,r){let n=`${e}\x00${t}`,s=(this.writes.get(n)??Promise.resolve()).catch(()=>{return}).then(r);this.writes.set(n,s);let i=()=>{if(this.writes.get(n)===s)this.writes.delete(n)};return s.then(i,i),s}async resolveProviderId(e,t,r){let n=this.receiptKey(e,t),o=this.memo.get(n);if(o)return{found:o.providerId,requestUrl:o.requestUrl};let s=await this.receipts.read(e,t);if(s)this.memo.set(n,s);if(s)return{found:s.providerId,requestUrl:s.requestUrl};let i=this.inflightKey(e,t,r!==void 0),c=this.inflight.get(i);if(c)return c;let u=this.resolveUncached(e,t,r).then(async(a)=>{if(typeof a==="object"){let d={providerId:a.found,...a.requestUrl?{requestUrl:a.requestUrl}:{}};await this.receipts.write(e,t,d),this.memo.set(n,d)}return a}).finally(()=>{this.inflight.delete(i)});return this.inflight.set(i,u),u}async resolveUncached(e,t,r){let n=await this.filterByExternalId(e,t);if(n!=="absent")return n;if(!r)return"absent";return this.create(e,t,r)}async filterByExternalId(e,t){let r=encodeURIComponent(`externalId eq "${fn(t)}"`),n=`${this.baseUrl}/${Gt(e)}?filter=${r}`,o=await this.fetchImpl(n,{method:"GET",headers:await this.headers()});if(!o.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:e,status:o.status,detail:await Bt(o)}),"error";let i=((await o.json()).Resources??[])[0];return i?.id?{found:i.id,...this.requestUrl(e,i)}:"absent"}async create(e,t,r){let n=`${this.baseUrl}/${Gt(e)}`,o=this.writeBody(e,t,r),s=await this.fetchImpl(n,{method:"POST",headers:await this.headers(),body:JSON.stringify(o)});if(!s.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Bt(s)}),"error";let i=await s.json();return i.id?{found:i.id,...this.requestUrl(e,i),created:!0}:"error"}requestUrl(e,t){if(e!=="group")return{};let r=t[ln];if(!r||typeof r!=="object")return{};let n=r.requestUrl;return typeof n==="string"&&n?{requestUrl:n}:{}}async captureResponseReference(e,t,r,n,o){try{let s=await e.clone().json(),i=this.requestUrl(t,s).requestUrl;if(!i&&s.id===void 0)return;let c=i??o,u={providerId:s.id??n,...c?{requestUrl:c}:{}};await this.receipts.write(t,r,u),this.memo.set(this.receiptKey(t,r),u)}catch{}}async invalidate(e,t){this.memo.delete(this.receiptKey(e,t)),await this.receipts.clear(e,t)}writeBody(e,t,r){let{id:n,meta:o,...s}=r,i=s,c=i[ln];if(c&&typeof c==="object"&&!Array.isArray(c)){let{providerId:u,requestUrl:a,...d}=c;i[ln]=d}return{...i,schemas:(r.schemas?.length??0)>0?r.schemas:[e==="user"?gc:yc],externalId:t}}async upsertResource(e,t,r){return this.serializeWrite(e,t,()=>this.upsertResourceNow(e,t,r))}async upsertResourceNow(e,t,r){let n=async(s)=>{let i=await this.resolveProviderId(e,t,s?r:void 0);if(i==="error")return"error";if(i==="absent")return"skipped";if(i.created)return"pushed";let c=await this.fetchImpl(`${this.baseUrl}/${Gt(e)}/${encodeURIComponent(i.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody(e,t,r))});if(c.status===404||c.status===410)return"stale";if(c.ok)return await this.captureResponseReference(c,e,t,i.found,i.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:e,status:c.status,detail:await Bt(c)}),"error"},o=await n(!0);if(o==="stale")await this.invalidate(e,t),o=await n(!0);return o==="stale"?"error":o}async deleteResource(e,t){return this.serializeWrite(e,t,()=>this.deleteResourceNow(e,t))}async deleteResourceNow(e,t){let r=async()=>{let o=await this.resolveProviderId(e,t);if(o==="error")return{outcome:"error"};if(o==="absent")return{outcome:"pushed"};let s=await this.fetchImpl(`${this.baseUrl}/${Gt(e)}/${encodeURIComponent(o.found)}`,{method:"DELETE",headers:await this.headers()});if(s.status===404||s.status===410)return{outcome:"pushed",stale:!0};if(s.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Bt(s)}),{outcome:"error"}},n=await r();if(n.stale)await this.invalidate(e,t),n=await r();if(n.outcome==="pushed")await this.invalidate(e,t);return n.outcome}async patchGroupMembership(e){return this.serializeWrite("group",e.groupExternalId,()=>this.patchGroupMembershipNow(e))}async patchGroupMembershipNow(e){let{groupExternalId:t,userExternalId:r,op:n}=e,o=e.subjectResourceType??"user",s=await this.resolveProviderId(o,r,n==="add"?e.userCreate:void 0);if(s==="error")return this.log.warn("IAM delta: principal lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,subjectResourceType:o}),"error";if(s==="absent")return this.log.warn("IAM delta: principal not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n,subjectResourceType:o}),"skipped";let i=s.found,c=async(d)=>{let g=await this.resolveProviderId("group",t,n==="add"&&d?e.groupCreate:void 0);if(g==="error")return{kind:"error"};if(g==="absent")return{kind:"absent"};let m=`${this.baseUrl}/${Gt("group")}/${encodeURIComponent(g.found)}`,C=n==="add"?[{op:"add",path:"members",value:[{value:i,type:e.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${fn(i)}"]`}];return{kind:"response",response:await this.fetchImpl(m,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[mc],Operations:C})}),providerId:g.found,requestUrl:g.requestUrl}},u=await c(!0);if(u.kind==="response"&&(u.response.status===404||u.response.status===410))await this.invalidate("group",t),u=await c(!1);if(u.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n}),"error";if(u.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n}),"skipped";let a=u.response;if(!a.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,status:a.status,detail:await Bt(a)}),"error";return await this.captureResponseReference(a,"group",t,u.providerId,u.requestUrl),"pushed"}}function Tt(e){if(typeof e==="string")return e;if(e&&typeof e==="object"&&"id"in e)return e.id;return}function Ht(e){return e&&typeof e==="object"?e:void 0}function mn(e){let t={},r={},n,o,s,i,c,u,a,d,g,m=()=>t.users==="patch"||t.workloads==="patch"||t.customers==="patch",C=(v)=>{if(v==="user")return t.users==="patch";if(v==="workload")return t.workloads==="patch";return t.customers==="patch"},P=()=>{if(!t.url)return"destination URL is not configured";if(!r.workload)return"workload identity is not configured";if(typeof r.workload.isReady!=="function"||typeof r.workload.ready!=="function")return"workload handle violates the readiness contract";if(!r.workload.isReady())return"workload module is not ready";if(t.audience){let v=r.workload[t.audience];if(!v)return`outgoing workload client "${t.audience}" is not configured`;if(typeof v.isReady!=="function"||typeof v.ready!=="function")return`outgoing workload client "${t.audience}" violates the readiness contract`;if(!v.isReady())return`outgoing workload client "${t.audience}" is not ready`}return},E=()=>{if(!m())return"no principal-kind delta mode is 'patch'";let v=P();if(v)return v;if(t.users==="patch"&&!r.userStore)return"user store is not configured for IAM destination receipts";if(t.workloads==="patch"&&!r.workloadIdentityStore)return"workload identity store is not configured for IAM destination receipts";if(t.customers==="patch"&&!r.customerStore)return"customer store is not configured for IAM destination receipts";if(!r.catalogStore)return"catalog store is not configured for IAM destination receipts";return},O=()=>E()===void 0,k=ye("IAM delta",O),T=async()=>{let v=r.workload;if(!v)throw Error("IAM delta: workload identity not configured");if(t.audience&&typeof v.getToken==="function")return v.getToken(t.audience);if(typeof v.getServerToken==="function")return v.getServerToken();return v.getToken()},l=()=>vc(r.codeCatalog,r.catalogStore),b=async(v,U)=>{let I=r.catalogStore;if(!I)return;let x=r.codeCatalog?.groups.get(v)??r.codeCatalog?.roles.get(v)??r.codeCatalog?.permissions.get(v);if(x){let w=r.codeCatalog?.groups.get(x.id)?"group":r.codeCatalog?.roles.get(x.id)?"role":"permission",_=br(I,w),h=await _.get(x.id);if(!h&&U)await wc(w,x,_),h=await _.get(x.id);if(h)return{kind:w,entity:h}}let q=[["group",I.groups],["role",I.roles],["permission",I.permissions]];for(let[w,_]of q){let h=await _.get(v);if(h)return{kind:w,entity:h}}return},W=async(v)=>{let U=r.userStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);for await(let I of Jt((x,q)=>U.list({start:x,limit:q})))if(I.externalId===v)return I;return},F=(v)=>v?.providerId?{providerId:v.providerId,...v.requestUrl?{requestUrl:v.requestUrl}:{}}:void 0,Q=async(v)=>{let U=r.workloadIdentityStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);let I=await U.lookup({id:"",externalId:v});if(I)return I;for await(let x of Jt((q,w)=>U.list({start:q,limit:w})))if(x.externalId===v)return x;return},ce=async(v)=>{let U=r.customerStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);let I=await U.lookup({id:"",userName:"",name:"",email:"",externalId:v});if(I)return I;for await(let x of Jt((q,w)=>U.list({start:q,limit:w})))if(x.externalId===v)return x;return},se={async read(v,U){if(v==="user")return F(await W(U));if(v==="workload")return F(await Q(U));if(v==="customer")return F(await ce(U));return F((await b(U,!1))?.entity)},async write(v,U,I){if(v==="user"){let w=await W(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.userStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}if(v==="workload"){let w=await Q(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.workloadIdentityStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}if(v==="customer"){let w=await ce(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.customerStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}let x=await b(U,!0);if(!x||x.entity.providerId===I.providerId&&x.entity.requestUrl===I.requestUrl)return;await br(r.catalogStore,x.kind).set({...x.entity,providerId:I.providerId,requestUrl:I.requestUrl}).ready()},async clear(v,U){if(v==="user"){let h=await W(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.userStore?.upsert(S);return}if(v==="workload"){let h=await Q(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.workloadIdentityStore?.upsert(S);return}if(v==="customer"){let h=await ce(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.customerStore?.upsert(S);return}let I=await b(U,!1);if(!I||I.entity.providerId===void 0&&I.entity.requestUrl===void 0)return;let{providerId:x,requestUrl:q,...w}=I.entity;await br(r.catalogStore,I.kind).set(w).ready()}},Z=()=>{if(!O()||!t.url)return;let v=t.url;if(n&&o===v&&s===r.catalogStore&&i===r.userStore&&c===r.workloadIdentityStore&&u===r.customerStore&&a===r.codeCatalog&&d===r.fetchImpl)return n;return n=new kr({baseUrl:t.url,getToken:T,receipts:se,log:e,fetchImpl:r.fetchImpl}),o=v,s=r.catalogStore,i=r.userStore,c=r.workloadIdentityStore,u=r.customerStore,a=r.codeCatalog,d=r.fetchImpl,n},ee=(v)=>v==="workload"?"Workload":v==="customer"?"Customer":"User",ue=async(v)=>{if(v.subjectType==="workload"){let q=Tt(v.subject),w=Ht(v.subject);if(!w&&q)w=await r.workloadIdentityStore?.get(q);let _=w?.externalId??w?.id??q;if(!w||!_)return;return{externalId:_,resourceType:"workload",create:await(r.mapWorkloadToScim?.({...w,externalId:_})??os({...w,externalId:_}))}}if(v.subjectType==="customer"){let q=Tt(v.subject),w=Ht(v.subject);if(!w&&q)w=await r.customerStore?.get(q);let _=w?.externalId??w?.id??q;if(!_)return;let h=w?await(r.mapCustomerToScim?.({...w,externalId:_})??rs({...w,externalId:_})):{schemas:["urn:ionite:scim:schemas:core:2.0:Customer"],externalId:_,displayName:_,active:!0};return{externalId:_,resourceType:"customer",create:h}}let I=Ht(v.subject);if(!I){let q=Tt(v.subject);if(q&&r.userStore)I=await r.userStore.get(q)}let x=I?.externalId;if(!I||!x)return;return{externalId:x,resourceType:"user",create:await(r.mapUserToScim?.(I)??ns(I))}},z=async(v)=>{let I=Ht(v.target);if(!I){let x=Tt(v.target),q=l();if(x&&q)I=v.targetType==="role"?await q.roles.get(x):v.targetType==="permission"?await q.permissions.get(x):await q.groups.get(x)}if(I&&I.requestable!==!0)return"not-requestable";if(!I)return;return{externalId:I.id,create:pn(I,v.targetType)}},J=async(v,U)=>{if(!O())return"skipped";if(!C(v.subjectType==="workload"?"workload":v.subjectType==="customer"?"customer":"user"))return"skipped";let I=await ue(v),x=await z(v);if(x==="not-requestable")return"skipped";if(!I||!x)return e.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:U,hasSubject:Boolean(I),hasTarget:Boolean(x),targetType:v.targetType}),"skipped";let q=Z();if(!q)return"skipped";return q.patchGroupMembership({groupExternalId:x.externalId,userExternalId:I.externalId,op:U,groupCreate:x.create,userCreate:I.create,memberType:ee(v.subjectType),subjectResourceType:I.resourceType})},B=async(v,U,I)=>{let x=[],q=new Set,w=(h)=>{let p=`${h.type??"User"}\x00${h.value}`;if(!q.has(p))q.add(p),x.push(h)},_=r.accessStore;if(_)for await(let h of Jt((p,f)=>_.listByTarget(U,v.id,{start:p,limit:f}))){let p=await ue(h);if(!p){e.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:v.id,targetType:U});continue}let f=await I.resolveProviderId(p.resourceType,p.externalId,p.create);if(f==="error")throw Error(`IAM delta failed to resolve access subject for ${U}:${v.id}`);if(f==="absent")continue;let S=h.metadata;w({value:f.found,type:ee(h.subjectType),...S?.display?{display:S.display}:{}})}if(U==="group"){let h=l();for(let p of v.groups??[]){let f=Tt(p),S=Ht(p);if(!S&&f)S=await h?.groups.get(f);if(S&&S.requestable!==!0)continue;if(!S){e.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:f,target:v.id});continue}let A=await I.resolveProviderId("group",S.id,pn(S,"group"));if(A==="error")throw Error(`IAM delta failed to resolve nested Group for group:${v.id}`);if(A!=="absent")w({value:A.found,type:"Group"})}}return x.length>0?x:void 0},ae=async(v)=>{if(!O()||!C("user"))return"skipped";let U=v.externalId;if(!U)return e.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:v.id,kind:"user"}),"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapUserToScim?.(v)??ns(v));return I.upsertResource("user",U,x)},re=async(v)=>{if(!O()||!C("workload"))return"skipped";let U=v.externalId??v.id;if(!U)return"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapWorkloadToScim?.({...v,externalId:U})??os({...v,externalId:U}));return I.upsertResource("workload",U,x)},ne=async(v)=>{if(!O()||!C("customer"))return"skipped";let U=v.externalId??v.id;if(!U)return"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapCustomerToScim?.({...v,externalId:U})??rs({...v,externalId:U}));return I.upsertResource("customer",U,x)},R=async(v,U,I=!0)=>{if(!O()||!m())return"skipped";let x=l(),w=(x?await br(x,U).get(v.id):void 0)??v;if(w.requestable!==!0)return"skipped";let _=Z();if(!_)return"skipped";let h=await B(w,U,_),p=await _.upsertResource("group",w.id,pn(w,U,h)),f=r.accessStore;if(p!=="pushed"||!I||!f)return p;for await(let S of Jt((A,N)=>f.listByTarget(U,v.id,{start:A,limit:N})))if(await J(S,"add")==="error")throw Error(`IAM delta failed to restore access for ${U}:${v.id}`);return p},M=(v,U)=>{if(v==="error")throw Error(`IAM delta: destination rejected ${U}`)},G=(v,U,I)=>{if(U==="pushed")v.pushed+=1;else if(U==="skipped")v.skipped+=1;else v.errors.push(`IAM delta: destination rejected ${I}`)},H={async onUserUpsert(v){M(await ae(v),"user upsert")},async onUserDelete(v){if(!O()||!C("user"))return;let U=Z();if(!U)return;M(await U.deleteResource("user",v),"user delete")},async onWorkloadUpsert(v){M(await re(v),"workload upsert")},async onWorkloadDelete(v){if(!O()||!C("workload"))return;let U=Z();if(!U)return;M(await U.deleteResource("workload",v),"workload delete")},async onCustomerUpsert(v){M(await ne(v),"customer upsert")},async onCustomerDelete(v){if(!O()||!C("customer"))return;let U=Z();if(!U)return;M(await U.deleteResource("customer",v),"customer delete")},async onEntitlementUpsert(v,U){M(await R(v,U),`${U} upsert`)},async onEntitlementDelete(v,U){if(!O())return;let I=Z();if(!I)return;M(await I.deleteResource("group",U),`${v} delete`)},async onGrant(v){if(!O())return;if(await J(v,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(v){if(!O())return;if(await J(v,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async requestAccess(v){let U=t.url,I=P();if(I!==void 0||U===void 0)throw Error(`Cannot submit an access request: ${I??"destination URL is not configured"}`);let x=await(r.fetchImpl??fetch)(`${hc(U)}/AccessRequests`,{method:"POST",headers:{Authorization:`Bearer ${await T()}`,"Content-Type":"application/json"},body:JSON.stringify(v)});if(!x.ok)throw Error(`AccessRequests failed: ${x.status} ${await x.text()}`);return await x.json()},async reconcile(v){let U={pushed:0,skipped:0,errors:[]},I=E();if(I)return U.errors.push(`iam delta not ready: ${I}`),U;let x=async(q,w,_)=>{if(!q)return;for await(let h of q)try{G(U,await w(h),_(h))}catch(p){U.errors.push(p instanceof Error?p.message:String(p))}};return await x(v.groups,(q)=>R(q,"group",!1),(q)=>`group upsert for ${q.id}`),await x(v.roles,(q)=>R(q,"role",!1),(q)=>`role upsert for ${q.id}`),await x(v.permissions,(q)=>R(q,"permission",!1),(q)=>`permission upsert for ${q.id}`),await x(v.users,(q)=>ae(q),(q)=>`user upsert for ${q.id??"unknown"}`),await x(v.workloads,(q)=>re(q),(q)=>`workload upsert for ${q.id}`),await x(v.customers,(q)=>ne(q),(q)=>`customer upsert for ${q.id??"unknown"}`),await x(v.access,(q)=>J(q,"add"),(q)=>`membership push for ${Tt(q.target)??"unknown"}`),U},async getDestinationRef(v,U){return se.read(v,U)},isReady:O,ready:k.ready};return{update(v,U){t=v,r=U,Z(),k.refresh();let I=E();if(!m())g=void 0;else if(I!==g){if(I)e.warn(`IAM delta configured but not ready: ${I}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:I});g=I}return H},handle(){return H}}}var gn=2,Sc=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"iam.workloads",module:"iam",label:"SCIM Workloads inbound",requires:"workloadIdentityStore",incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."},{key:"iam.customers",module:"iam",label:"SCIM Customers inbound",requires:"customerStore",incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."}];import{IoniteError as kc}from"@ionite/core";function bc(e){if(e instanceof kc)return{status:e.status,statusText:e.statusText};if(typeof e!=="object"||e==null)return;let t=e,r=typeof t.status==="number"?t.status:void 0,n=typeof t.statusText==="string"?t.statusText:void 0;return r!=null||n?{status:r,statusText:n}:void 0}function Pt(e){if(e instanceof Response)return e;let t=bc(e);if(!t)return Response.json({error:"internal_error"},{status:500});let n={status:t.status??500};if(t.statusText)n.statusText=t.statusText;return Response.json({error:t.statusText??"internal_error"},n)}function me(){return Response.json({error:"not_found"},{status:404})}function It(e=["GET"]){return Response.json({error:"method_not_allowed",allow:e},{status:405,headers:{Allow:e.join(", ")}})}import{timingSafeEqual as Rc}from"node:crypto";import{parseKmsPoolDocument as Cc,stableConfigHash as is}from"@ionite/core";function ss(e,t,r){for(let n of e)try{n()}catch(o){t.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:r,error:o instanceof Error?o.message:String(o)})}}function We(e,t){let r=new Set,n=new Set;return{beforeChange(o){return r.add(o),()=>{r.delete(o)}},afterChange(o){return n.add(o),()=>{n.delete(o)}},emitBefore(){ss(r,e,`${t} beforeChange`)},emitAfter(){ss(n,e,`${t} afterChange`)}}}var Tc=604800000,Pc=2147483647,Ic=1;function ds(e,t){if(!e.value)return!1;if(e.notBefore&&Date.parse(e.notBefore)>t)return!1;if(e.notAfter&&Date.parse(e.notAfter)<=t)return!1;return!0}function _e(e,t,r=Date.now()){if(!e)return;let n=e.slots?.[t];if(!n)return;let o=e.keys.find((s)=>s.id===n&&s.state==="active");return o&&ds(o,r)?o:void 0}function yn(e,t=Date.now()){if(!e)return[];return e.keys.filter((r)=>(r.state==="active"||r.state==="deprecated")&&ds(r,t))}function as(e){return{...e,...e.meta?{meta:{...e.meta}}:{}}}function Rr(e,t,r){if(!t||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>o(Error(r)),t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function cs(e,t){let r=Buffer.from(e),n=Buffer.from(t);return r.length===n.length&&Rc(r,n)}function Oc(e){if(!Number.isInteger(e)||e<1)throw Error("KMS unique() requires a positive integer slot count.");return e}var Ec=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function Ac(e){return Ec.has(e)}function us(e){let t=e.trim().replace(/\/+$/,"");if(!t||t==="/")return"/";return t.startsWith("/")?t:`/${t}`}function _c(e,t){let r=us(e),n=us(t);return r===n||r.endsWith(n)}function Lc(e,t,r){let n=We(t,`KMS pool "${e}"`),o=new Set,s=!1,i,c,u=0,a,d,g=Ic,m,C,P=new Map,E=new Set,O,k=()=>i!==void 0&&i.slots===void 0&&i.keys.length>0,T=ye(`KMS pool "${e}"`,()=>{if(!s)return!1;if(k())return yn(i).length>0;return _e(i,0)!==void 0}),l=ye(`KMS pool "${e}" issuer`,()=>s&&m!==void 0),b=(h)=>h===0?`KMS pool "${e}"`:`KMS pool "${e}" slot ${h}`,W=(h)=>{let p=P.get(h),f=p?.valueWaiter;if(!p||!f)return;if(!s){p.valueWaiter=void 0,f.reject(Error(`${b(h)} is no longer configured.`));return}if(k()){p.valueWaiter=void 0,f.reject(Error(`${b(h)} verifier grant has no slots.`));return}let S=_e(i,h);if(S?.value)p.valueWaiter=void 0,f.resolve(S.value)},F=()=>{for(let h of P.keys())W(h)},Q=(h)=>{let p=P.get(h);if(!p)return;let f=_e(i,h);for(let S of p.listeners)try{S(f?as(f):void 0)}catch(A){t.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:e,slot:h,error:A instanceof Error?A.message:String(A)})}},ce=()=>{for(let h of P.keys())Q(h)},se=()=>{for(let h of P.values())h.latch.refresh();T.refresh(),l.refresh()},Z=()=>{try{O?.()}catch(h){t.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:e,error:h instanceof Error?h.message:String(h)})}O=void 0},ee=()=>{if(O||E.size===0||!m?.subscribeEvents||!C)return;let h=C;O=m.subscribeEvents((p)=>{if(!Ac(p.event)||!_c(p.path,h))return;let f={path:p.path,event:p.event,...p.requestId===void 0?{}:{requestId:p.requestId},...p.keyId===void 0?{}:{keyId:p.keyId}};for(let S of E)try{S(f)}catch(A){t.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:e,error:A instanceof Error?A.message:String(A)})}})},ue=()=>{if(d)clearTimeout(d);d=void 0},z=()=>{ue();let h=Date.now();if(i){for(let f of i.keys){if(!f.notAfter)continue;let S=Date.parse(f.notAfter)-h;if(S>0&&S<=Tc&&(f.state==="active"||f.state==="deprecated")&&!o.has(f.id))o.add(f.id),t.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:e,keyId:f.id,notAfter:f.notAfter})}let p=i.keys.flatMap((f)=>[f.notBefore,f.notAfter]).filter((f)=>Boolean(f)).map((f)=>Date.parse(f)).filter((f)=>f>h).sort((f,S)=>f-S);if(p[0])d=setTimeout(()=>{let f=new Map([...P.keys()].map((S)=>[S,_e(i,S)?.id]));se(),r();for(let S of P.keys())if(f.get(S)!==_e(i,S)?.id)Q(S);z()},Math.min(p[0]-h+1,Pc))}se(),r(),F()},J=(h)=>{let p=new Map([...P.keys()].map((f)=>{let S=_e(i,f);return[f,{id:S?.id,value:S?.value}]}));n.emitBefore();try{i=Cc(h),z();for(let f of P.keys()){let S=_e(i,f),A=p.get(f);if(A?.id!==S?.id||A?.value!==S?.value)Q(f)}}catch(f){i=void 0,z(),ce(),t.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:e,error:f instanceof Error?f.message:String(f)})}finally{n.emitAfter()}},B=()=>{try{a?.()}catch(h){t.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:e,error:h instanceof Error?h.message:String(h)})}a=void 0},ae=(h,p)=>{m=h,C=p,u+=1;let f=u;B(),h.subscribe(p,(S)=>{if(u!==f||!s)return;J(S.data)},{kmsSlots:g}).then((S)=>{if(u!==f||!s){S();return}a=S}).catch((S)=>{if(u!==f||!s)return;i=void 0,z(),ce(),t.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:e,path:p,error:S instanceof Error?S.message:String(S)})})},re=(h,p)=>{let f=R(h),S=_e(i,h);if(!s)return Promise.reject(Error(`${b(h)} is no longer configured.`));if(k())return Promise.reject(Error(`${b(h)} verifier grant has no slots.`));if(S?.value)return Promise.resolve(S.value);if(!f.valueWaiter){let N,Y,K=new Promise((oe,te)=>{N=oe,Y=te});f.valueWaiter={promise:K,resolve:N,reject:Y}}let A=f.valueWaiter.promise;return W(h),Rr(A,p,`${b(h)} was not ready within ${p}ms.`)},ne=(h,p)=>{let f=R(h);f.listeners.add(p);let S=_e(i,h);return p(S?as(S):void 0),()=>f.listeners.delete(p)};function R(h){let p=P.get(h);if(p)return p;let f=ye(b(h),()=>s&&_e(i,h)!==void 0),S={listeners:new Set,latch:f,api:{value:(A)=>re(h,A),current:()=>_e(i,h)?.value,subscribe:(A)=>ne(h,A),park:(A,N)=>H(A,N),isReady:f.isReady,ready:f.ready}};return P.set(h,S),S}let M=(h)=>{if(k())throw Error(`KMS pool "${e}" verifier grant has no slots.`);let p=Oc(h),f=p>g;g=Math.max(g,p);let S=[];for(let A=0;A<p;A+=1)S.push(R(A).api);if(f&&s&&m&&C)ae(m,C);return S},G=(h)=>yn(i).find((p)=>p.value!==void 0&&cs(h,p.value)),H=(h,p)=>{if(!s||!m||!C)return Promise.reject(Error(`KMS pool "${e}" is not configured.`));if(typeof h.value!=="string"||h.value.length===0)return Promise.reject(Error(`KMS pool "${e}" park() requires a non-empty value.`));let f=G(h.value);if(!f)return Promise.resolve({parked:!1,stale:!0});return Rr(m.parkKmsKey(C,{keyId:f.id,status:h.status,reason:h.reason},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" park() did not complete within ${p}ms.`)},v=()=>{if(!s||!m||!C)throw Error(`KMS pool "${e}" is not configured.`);return{source:m,path:C}},U=(h)=>{if(!Array.isArray(h)||h.length===0)throw Error(`KMS pool "${e}" addKeys() requires a non-empty keys array.`);return h.map((p,f)=>{if(!p||typeof p!=="object")throw Error(`KMS pool "${e}" addKeys() keys[${f}] must be an object.`);if(typeof p.value!=="string"||p.value.length===0)throw Error(`KMS pool "${e}" addKeys() keys[${f}].value must be a non-empty string.`);if(p.id!==void 0&&(typeof p.id!=="string"||p.id.length===0))throw Error(`KMS pool "${e}" addKeys() keys[${f}].id must be a non-empty string when present.`);return p})},I=(h,p)=>{try{let{source:f,path:S}=v(),A=U(h);return Rr(f.addKmsKeys(S,{keys:A},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" addKeys() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},x=(h,p)=>{try{let{source:f,path:S}=v();if(typeof h.keyId!=="string"||h.keyId.length===0)throw Error(`KMS pool "${e}" revokeKey() requires a non-empty keyId.`);return Rr(f.revokeKmsKey(S,h,p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" revokeKey() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},q=(h)=>{let{source:p}=v();if(!p.subscribeEvents)throw Error(`KMS pool "${e}" events are not supported by this secrets transport.`);return E.add(h),ee(),()=>{E.delete(h)}};R(0);let w={value:(h)=>re(0,h),current:()=>_e(i,0)?.value,unique:M,accepts:(h)=>yn(i).some((p)=>p.value!==void 0&&cs(h,p.value)),park:H,subscribe:(h)=>ne(0,h),beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:T.isReady,ready:T.ready},_={addKeys:I,revokeKey:x,events:q,isReady:l.isReady,ready:l.ready};return{api:w,issuer:_,update(h,p,f){let S=is({config:h,path:f});if(s=!0,c===S){se();return}c=S,B(),Z(),ue(),i=void 0,se(),r(),ce(),F(),ae(p,f),ee()},unavailable(h){s=!0,c=is(h),u+=1,m=void 0,C=void 0,Z(),B(),ue(),i=void 0,se(),r(),ce(),F()},remove(){if(!s)return;n.emitBefore(),s=!1,c=void 0,u+=1,m=void 0,C=void 0,Z(),B(),ue(),i=void 0,se(),r(),ce(),F(),n.emitAfter()},close(){s=!1,u+=1,m=void 0,C=void 0,Z(),E.clear(),B(),ue();for(let h of P.values())h.listeners.clear();i=void 0,F();for(let h of P.values())h.latch.settle();T.settle(),l.settle()},isConfigured:()=>s}}function ls(e){let t=new Map,r=new Map,n=We(e,"KMS"),o=!1,i=ye("KMS module",()=>o&&Array.from(t.values()).every((m)=>!m.isConfigured()||m.api.isReady())),c,u=()=>i.refresh(),a=(m)=>{let C=t.get(m);if(C)return C;let P=Lc(m,e,u);if(t.set(m,P),!(m in c))Object.assign(c,{[m]:P.api});return P},d=(m)=>{let C=t.get(m);if(!C)throw Error(`KMS pool "${m}" is not configured.`);return C.api},g=(m)=>{let C=t.get(m);if(!C)throw Error(`KMS pool "${m}" is not configured.`);return C.issuer};return c={get config(){return Object.fromEntries(r)},beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:i.isReady,ready:i.ready,listPools:()=>Array.from(r.keys()),getPool:d,issuer:g},{handle:()=>c,update(m,C){if(!m&&!o&&t.size===0)return;n.emitBefore(),o=m!==void 0;let P=new Set(Object.keys(m??{}));for(let[E,O]of Object.entries(m??{})){r.set(E,{...O});let k=O.path??`/kms/${E}`;try{a(E).update(O,C(O),k)}catch(T){a(E).unavailable(O),e.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:E,error:T instanceof Error?T.message:String(T)})}}for(let[E,O]of t){if(P.has(E))continue;r.delete(E),O.remove()}return i.refresh(),n.emitAfter(),o||t.size>0?c:void 0},close(){for(let m of t.values())m.close();t.clear(),r.clear(),o=!1,i.settle()}}}import{formatLogLine as Uc}from"@ionite/core";import{context as xc,trace as Mc}from"@opentelemetry/api";import{logs as Wc,SeverityNumber as Ne}from"@opentelemetry/api-logs";import{OTLPLogExporter as jc}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as $c}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as qc}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as Nc}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as Kc}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as Vc}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as Fc}from"@opentelemetry/resources";import{BatchLogRecordProcessor as Dc}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as zc}from"@opentelemetry/sdk-metrics";import{NodeSDK as Bc}from"@opentelemetry/sdk-node";var fs={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},Gc={trace:!1,debug:!1,info:!0,warn:!0,error:!0},Jc={trace:Ne.TRACE,debug:Ne.DEBUG,info:Ne.INFO,warn:Ne.WARN,error:Ne.ERROR};function wn(e,t){let r=t[e];if(r===!1)return!1;if(e==="metrics")return r===!0||typeof r==="object";return!0}function vn(e){return typeof e==="object"&&e!==null?e:void 0}function Hc(e){return typeof e==="object"&&e!==null?e:void 0}function Yc(e,t){let r=e.replace(/\/+$/,"");if(r.endsWith(fs[t]))return r;return`${r}${fs[t]}`}function Xc(e,t){let r=vn(e[t]);if(r?.endpoint)return r.endpoint;if(!e.endpoint)return;return Yc(e.endpoint,t)}function Zc(e,t,r){let n=vn(e[t]),o={...e.headers,...n?.headers??{}};if(r)o.Authorization=`Bearer ${r}`;return o}function Sn(e,t,r){let n=vn(e[t]);return{url:Xc(e,t),headers:Zc(e,t,r),timeoutMillis:n?.timeoutMillis,concurrencyLimit:n?.concurrencyLimit}}function Qc(e,t){let r=Sn(e,"traces",t);return e.protocol==="http/json"?new Kc(r):new Vc(r)}function eu(e,t){let r=Sn(e,"metrics",t);return e.protocol==="http/json"?new qc(r):new Nc(r)}function tu(e,t){let r=Sn(e,"logs",t);return e.protocol==="http/json"?new jc(r):new $c(r)}function ru(e){return{"service.name":e.name,...e.version?{"service.version":e.version}:{},...e.deploymentEnvironment?{"deployment.environment.name":e.deploymentEnvironment}:{},...e.resourceAttributes??{}}}async function nu(e){if(!e.oauth)return;let t=new URLSearchParams({grant_type:"client_credentials",client_id:e.oauth.clientId,client_secret:e.oauth.clientSecret});if(e.oauth.scope)t.set("scope",e.oauth.scope);if(e.oauth.audience)t.set("audience",e.oauth.audience);let r=await fetch(e.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...e.oauth.headers??{}},body:t});if(!r.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${r.status}`);let n=await r.json();if(typeof n.access_token!=="string"||!n.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return n.access_token}function ou(e,t){return{...Gc,...t?.levels??{},...e.levels??{}}}function Yt(e,t="Authorization"){let r={...e.headers??{}};if(!e.apiKey)return r;let n=e.apiKeyHeader??t;return r[n]=n.toLowerCase()==="authorization"?`Bearer ${e.apiKey}`:e.apiKey,r}function su(e,t){return Object.keys(e).some((r)=>r.toLowerCase()===t.toLowerCase())}function gs(e,t,r){let n=Object.keys(e).find((o)=>o.toLowerCase().startsWith(t.toLowerCase()));if(n)throw Error(`OpenTelemetry provider "${r}" does not support provider-specific header "${n}".`)}function Xt(e,t,r,n){return{type:r,name:e.name,version:e.version,protocol:e.protocol??"http/protobuf",endpoint:e.endpoint,headers:n,resourceAttributes:ru(e),levels:ou(e,t),console:e.console??"info",traces:e.traces,metrics:e.metrics,logs:e.logs}}function iu(e,t){return Xt(e,t,"otlp",Yt(e))}function au(e,t){return Xt(e,t,"grafana-lgtm",Yt(e))}function cu(e,t){let r=Yt(e,"DD-API-KEY");if(!su(r,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return Xt(e,t,"datadog",r)}function uu(e,t){let r=Yt(e);return gs(r,"DD-","splunk"),Xt(e,t,"splunk",r)}function du(e,t){let r=Yt(e);return gs(r,"DD-","elastic"),Xt(e,t,"elastic",r)}function lu(e,t){let r=e.type??"otlp";switch(r){case"otlp":return iu(e,t);case"grafana-lgtm":return au(e,t);case"datadog":return cu(e,t);case"splunk":return uu(e,t);case"elastic":return du(e,t);default:throw Error(`Unsupported OpenTelemetry provider type: ${r}`)}}function fu(e,t){if(typeof e==="string")return e;if(e instanceof Error)return e.message;if(e!=null)return hn(e);if(t.length===0)return"";return hn(t[0])}function hn(e){if(typeof e==="string")return e;try{return JSON.stringify(e)}catch{return String(e)}}function ps(e,t,r){if(r==null)return;if(typeof r==="string"||typeof r==="number"||typeof r==="boolean"){e[t]=r;return}if(Array.isArray(r)&&r.every((n)=>["string","number","boolean"].includes(typeof n))){e[t]=r;return}if(r instanceof Error){if(e[`${t}.name`]=r.name,e[`${t}.message`]=r.message,r.stack)e[`${t}.stack`]=r.stack;return}e[t]=hn(r)}function pu(e){let t={};for(let[n,o]of e.entries()){if(o&&typeof o==="object"&&!Array.isArray(o)&&!(o instanceof Error)&&Object.getPrototypeOf(o)===Object.prototype){for(let[s,i]of Object.entries(o))ps(t,s,i);continue}ps(t,`param.${n}`,o)}let r=Mc.getSpanContext(xc.active());if(r)t.trace_id=r.traceId,t.span_id=r.spanId,t.trace_flags=r.traceFlags;return t}function mu(e){return e}function gu(e,t){globalThis.console[mu(e)](Uc(e,t.body,[t.attributes??{}]))}function yu(e,t,r,n){if(r.console==="off")return;if((t.severityNumber??0)<Jc[r.console])return;let o=n?.console;if(o){o(t);return}gu(e,t)}function wu(e,t){let r=Wc.getLogger(e.name,e.version),n=(o,s,i)=>{if(!e.levels[o])return;let c={severityNumber:s,severityText:o.toUpperCase(),body:fu(i[0],i.slice(1)),attributes:pu(i.slice(1))};try{r.emit(c)}finally{yu(o,c,e,t)}};return{trace:(o,...s)=>n("trace",Ne.TRACE,[o,...s]),debug:(o,...s)=>n("debug",Ne.DEBUG,[o,...s]),info:(o,...s)=>n("info",Ne.INFO,[o,...s]),warn:(o,...s)=>n("warn",Ne.WARN,[o,...s]),error:(o,...s)=>n("error",Ne.ERROR,[o,...s])}}function hu(e){return e?.current()}function vu(e,t,r){let n=t;return e.subscribe((o)=>{let s=o?.value;if(s===n)return;n=s,r()})}function ms(e){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:e,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function kn(e,t,r,n){if(!t&&!r)return;if(!t)return ms(e);let o=t,s;if(o.apiKeyPool&&n)try{s=n.getPool(o.apiKeyPool)}catch{s=void 0}let i=hu(s),c=()=>kn(e,o,r,n),u=o.apiKeyPool&&n?(T)=>vu(n.getPool(o.apiKeyPool),i,T):void 0;if(o.apiKeyPool&&!i){let T=ms(e);return T.onCredentialChange=u,T.rebuild=c,T}let a=i?{...o,apiKey:i}:o,d=lu(a,r),g,m=!1,C=wu(d,r),P,E,O=new Promise((T,l)=>{P=T,E=l});async function k(){try{let T=await nu(o),l={resource:Fc(d.resourceAttributes),instrumentations:r?.instrument};if(r?.sampler)l.sampler=r.sampler;if(r?.textMapPropagator)l.textMapPropagator=r.textMapPropagator;if(r?.contextManager)l.contextManager=r.contextManager;if(r?.spanProcessors)l.spanProcessors=r.spanProcessors;else if(wn("traces",d))l.traceExporter=Qc(d,T);if(r?.metricReaders)l.metricReaders=r.metricReaders;else if(wn("metrics",d)){let W=Hc(d.metrics);l.metricReaders=[new zc({exporter:eu(d,T),exportIntervalMillis:W?.exportIntervalMillis,exportTimeoutMillis:W?.exportTimeoutMillis})]}if(r?.logRecordProcessors)l.logRecordProcessors=r.logRecordProcessors;else if(wn("logs",d))l.logRecordProcessors=[new Dc({exporter:tu(d,T)})];let b=r?.configure?.(l);g=new Bc(b??l),g.start(),m=!0,P?.()}catch(T){m=!1;let l=T instanceof Error?T:Error(String(T));e.error?.("OpenTelemetry startup failed",l),E?.(l)}finally{P=void 0,E=void 0}}return{state:"available",start:k,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>m,ready:(T)=>{if(!T||T<=0)return O;return Promise.race([O,new Promise((l,b)=>{setTimeout(()=>b(Error(`OpenTelemetry ready timed out after ${T}ms.`)),T)})])},logger:C,forceFlush:async()=>{await g?.forceFlush?.()},shutdown:async()=>{m=!1,await g?.shutdown(),g=void 0},onCredentialChange:u,rebuild:c}}function ys(e){let t,r,n,o=0,s=Promise.resolve(),i=We(e,"OpenTelemetry"),c=ye("OpenTelemetry module",()=>t?.isReady()===!0),u={beforeChange:i.beforeChange,afterChange:i.afterChange,isReady:c.isReady,ready:c.ready,logger:{trace:(g,...m)=>(t?.logger??e).trace(g,...m),debug:(g,...m)=>(t?.logger??e).debug(g,...m),info:(g,...m)=>(t?.logger??e).info(g,...m),warn:(g,...m)=>(t?.logger??e).warn(g,...m),error:(g,...m)=>(t?.logger??e).error(g,...m)},forceFlush:async()=>{await t?.forceFlush()},shutdown:async()=>{await t?.shutdown()}},a=!1,d;return d={update(g){if(!g){if(t||r){let E=t,O=r;o+=1,i.emitBefore(),n?.(),n=void 0,t=void 0,r=void 0,c.refresh(),s=Promise.all([E?.shutdown(),O?.shutdown()]).finally(()=>i.emitAfter()).then(()=>{return},()=>{return})}return a?u:void 0}if(a=!0,g===t||g===r)return u;let m=t,C=r;o+=1;let P=o;return i.emitBefore(),n?.(),n=void 0,t=void 0,r=g,c.refresh(),s=(async()=>{try{if(await Promise.all([m?.shutdown(),C?.shutdown()]),await g.start(),P!==o||r!==g){await g.shutdown();return}t=g,r=void 0,c.refresh(),n=g.onCredentialChange?.(()=>{if(t!==g)return;let E=g.rebuild?.();if(E)d.update(E)})}finally{if(P===o)i.emitAfter()}})().then(()=>{return},()=>{return}),u},settled(){return s},async shutdown(){o+=1;let g=t,m=r;n?.(),n=void 0,t=void 0,r=void 0,c.settle(),await Promise.all([g?.shutdown(),m?.shutdown()])}},d}import{ION_ENDPOINT_PERMISSIONS as Ot,trimTrailingSlash as ws}from"@ionite/core";import{hasPermission as Su}from"@ionite/core/server";async function pt(e,t,r){let n=await Su(e,t,r.permission,void 0,r.subjectType);return n.allow?void 0:n.response()}function ku(e){let t=ws(e);return{matchesPath:(o)=>{if(!o)return!1;return ws(o)===t},startsWithPath:(o)=>{if(!o)return!1;return e===o||e.startsWith(`${o}/`)}}}function hs(e,t,r,n){let o=n??new URL(e.url).pathname,{matchesPath:s,startsWithPath:i}=ku(o);if(t.sso){let c=t.sso;if(s(r.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(u)=>c.handler(u)};if(s(r.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(u)=>c.logout(u)};if(s(r.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(u)=>c.logoutBackChannel(u)};if(s(r.sso.loginUrl)||s(r.sso.refreshUrl)||s(r.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(u)=>c.handler(u)}}if(t.ciam){let c=t.ciam;if(s(r.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(u)=>{let a=await c.resolveCustomer(u);if(a.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(a.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(a.value),{headers:{"Content-Type":"application/json"}})}};if(s(r.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(u)=>c.logout(u)}}if(t.iam){let c=t.iam,u=e.method!=="GET"&&e.method!=="HEAD";if(i(r.iam.usersUrl))return{module:"iam",kind:u?"iam.users.write":"iam.read",requiredPermission:Ot[u?"iam.users.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.groupsUrl))return{module:"iam",kind:u?"iam.groups.write":"iam.read",requiredPermission:Ot[u?"iam.groups.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.workloadsUrl))return{module:"iam",kind:u?"iam.workloads.write":"iam.read",requiredPermission:Ot[u?"iam.workloads.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.customersUrl))return{module:"iam",kind:u?"iam.customers.write":"iam.read",requiredPermission:Ot[u?"iam.customers.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(`${r.iam.basePath}/AccessRequests`))return{module:"iam",kind:"iam.access-requests.write",requiredPermission:Ot["iam.access-requests.write"],handler:async(a)=>c.handler(a)};if(i(r.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(a)=>c.handler(a)}}if(t.workload){let c=t.workload;if(s(r.workload.validateUrl)||s(r.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(u)=>c.handler(u)}}if(t.secrets){let c=t.secrets;if(c.isLfvDeliveryRequest?.(e)&&c.handleLfvDelivery){let u=c.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(a)=>u(a)}}if(c.isLfvEventsRequest?.(e)&&c.handleLfvEvents){let u=c.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(a)=>u(a)}}}if(t.ciam){let c=t.ciam;if(s(r.ciam.magicLinkUrl)&&e.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:Ot["ciam.magic-link.create"],handler:async(u)=>c.handler(u)};if(s(r.ciam.magicLinkLoginUrl)&&e.method==="GET"||s(r.ciam.customerProvidersUrl)&&e.method==="GET"||s(r.ciam.customerLoginUrl)&&e.method==="GET"||s(r.ciam.customerCallbackUrl)&&(e.method==="GET"||e.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(u)=>c.handler(u)}}return}async function bn(e,t,r,n){let o=n??Fe(ur()),s=new URL(e.url).pathname;if(r?.filter){let g=await r.filter(e,t);if(g instanceof Response)return g;if(g==="not_handled")return me()}let i=hs(e,t,o,s),u=await r?.resolve?.(e,t,i)??i;if(!u)return me();let a=u.requiredPermission===void 0?i?.requiredPermission:u.requiredPermission,d=async()=>{if(a){let g=await pt(e,t,a);if(g)return g}return u.handler(e)};if(r?.wrap)return await r.wrap(e,u,d,t);return await d()}import{stableConfigHash as Vu}from"@ionite/core";function Cr(){let e=0;return{next:()=>(e+=1,e),isCurrent:(t)=>t===e,current:()=>e}}import{readFile as ju,stat as $u}from"node:fs/promises";class Et extends Error{constructor(e,t,r){super(e);this.code=t;this.status=r;this.sourceType="vault";this.name="VaultWebSocketCommandError"}}class Be extends Error{constructor(e,t=`Vault secret not found at path ${e}`){super(t);this.path=e;this.sourceType="vault";this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}}class ge extends Error{constructor(e,t,r,n,o){super(e,o);this.path=t;this.status=r;this.code=n;this.sourceType="vault";this.name="VaultRequestError"}}class Le extends Error{constructor(e,t,r=`Vault subscribe is not supported for source ${e} at path ${t} without websocket, LFV, or ttl`){super(r);this.sourceType=e;this.path=t;this.name="VaultSubscribeNotSupportedError"}}function vs(e){return e instanceof Be||e instanceof Et&&(e.code==="not_found"||e.status===404)}import{WebSocket as Zt}from"ws";var bu=1000,Ru=30000,ks=30000,bs=ks;function Rs(e){bs=e>0?e:ks}function Cs(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Cu(e){let t=Math.min(Ru,bu*2**Math.min(e,16)),r=0.5+Math.random()*0.5;return Math.round(t*r)}var mt=new Map;function Tu(e){return e.trim().replace(/\/+$/g,"")}function Ts(e,t){let r=typeof t?.version==="number"?t.version:0,n=t?.created_time??t?.created,o=typeof n==="string"?new Date(n):new Date,s=ut(t);return{path:e,version:r,created:o,...s?{contentType:s}:{}}}function Pu(e){return typeof e?.version==="number"?e.version:void 0}function Iu(e){let t=e.token?.trim();if(!t)return{};if(e.header==="Authorization")return{Authorization:t.startsWith("Bearer ")?t:`Bearer ${t}`};return{"X-Vault-Token":t}}function Qt(e){return{client_id:e.clientId,token:e.token,header:e.header??"X-Vault-Token"}}function Cn(e,t){let r=Tu(e),n=mt.get(r);if(n){if(t&&!n.log)n.log=t;return n}let o={url:r,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:t};return mt.set(r,o),o}function Ou(e){let t=[...Array.from(e.subs.values(),(o)=>o.creds),...e.eventListeners.values()];if(t.length===0)return e.lastGoodCreds??{url:e.url};let r=e.lastGoodCreds?[e.lastGoodCreds,...t]:t,n=r[e.reconnectCredCursor%r.length]??t[0];return e.reconnectCredCursor+=1,n}function Ss(e,t){for(let r of e.subs.values())try{r.onHealth?.(t)}catch(n){e.log?.warn("Vault websocket health hook threw",n)}}function Eu(e,t){for(let r of Array.from(e.subs.values())){let n=r.onFirstSecretReject;if(r.onFirstSecret=void 0,r.onFirstSecretReject=void 0,n)try{n(new ge(`Vault websocket subscription interrupted (${t})`,r.path,void 0,"connection"))}catch(o){e.log?.warn("Vault websocket first-secret waiter rejection threw",o)}}}function Ps(e,t){for(let r of e.pending.values())clearTimeout(r.timer),r.reject(new ge(`Vault websocket command interrupted (${t})`,"/",void 0,"connection"));e.pending.clear()}function Tr(e){if(e.disposed)return;if(e.disposed=!0,e.reconnectTimer)clearTimeout(e.reconnectTimer),e.reconnectTimer=void 0;Ps(e,"closed"),Eu(e,"socket disposed");let t=e.ws;if(e.ws=void 0,e.connectPromise=void 0,e.hasConnected=!1,mt.delete(e.url),t)try{t.removeAllListeners(),t.close()}catch{}}function Pr(e){if(e.subs.size>0||e.pending.size>0||e.eventListeners.size>0)return;Tr(e)}function Rn(e){return`${e.clientId??""}|${e.token??""}|${e.header??"X-Vault-Token"}`}function Is(e){let t=new Map;for(let r of e.eventListeners.values())t.set(Rn(r),r);return Array.from(t.values())}function Au(e,t){if(typeof t.path!=="string"||typeof t.event!=="string")return;let r={path:t.path,event:t.event,...typeof t.request_id==="string"?{requestId:t.request_id}:{},...typeof t.key_id==="string"&&t.key_id.length>0?{keyId:t.key_id}:{}};for(let n of e.eventListeners.keys())try{n(r)}catch(o){e.log?.warn("Vault websocket event listener threw",o)}}function Os(e,t,r,n){if(n!==void 0&&t.lastVersion!==void 0&&n===t.lastVersion)return;if(n!==void 0)t.lastVersion=n;try{t.onChange(r)}catch(s){e.log?.warn("Vault websocket subscription onChange threw",s)}let o=t.onFirstSecret;if(t.onFirstSecret=void 0,t.onFirstSecretReject=void 0,o)try{o()}catch(s){e.log?.warn("Vault websocket subscription onFirstSecret threw",s)}}function _u(e,t){let r=t.subscription_id;if(typeof r!=="string")return;let n=e.subs.get(r);if(!n)return;let o={data:t.data,metadata:Ts(typeof t.path==="string"?t.path:n.path,t.metadata)};Os(e,n,o,Pu(t.metadata))}function Lu(e,t){let r;try{r=JSON.parse(t.toString())}catch(n){e.log?.warn("Vault websocket message parse failed",n);return}if(r.type==="secret"){_u(e,r);return}if(r.type==="event"){Au(e,r);return}if(r.type==="command_result"&&typeof r.id==="string"){let n=e.pending.get(r.id);if(!n)return;if(e.pending.delete(r.id),clearTimeout(n.timer),r.ok===!1)n.reject(new Et(r.error??`Vault websocket command failed for ${r.id}`,r.code,r.status));else n.resolve(r.result);Pr(e)}}function Es(e,t){e.send(JSON.stringify({type:"subscribe",subscription_id:t.subscriptionId,paths:[t.path],...Cs(t.kmsSlots),...Qt(t.creds)}))}function Tn(e){if(e.disposed||e.reconnectTimer||e.subs.size===0&&e.eventListeners.size===0)return;let t=Cu(e.reconnectAttempts);e.reconnectAttempts+=1,e.reconnectTimer=setTimeout(()=>{if(e.reconnectTimer=void 0,e.disposed)return;if(e.subs.size===0&&e.eventListeners.size===0){Tr(e);return}Ir(e,Ou(e)).catch(()=>{if(e.hasConnected)e.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${t}ms).`);Tn(e)})},t)}function Ir(e,t){if(e.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if(e.ws&&e.ws.readyState===Zt.OPEN)return Promise.resolve(e.ws);if(e.connectPromise)return e.connectPromise;return e.connectPromise=new Promise((r,n)=>{let o=new Zt(e.url,{headers:Iu(t)}),s=!1,i=e.hasConnected,c=()=>{s=!0,e.hasConnected=!0,e.reconnectAttempts=0,e.reconnectCredCursor=0,e.lastGoodCreds=t,e.ws=o,e.connectPromise=void 0,o.on("message",(d)=>Lu(e,d));for(let d of e.subs.values())try{Es(o,d)}catch{}for(let d of Is(e))try{o.send(JSON.stringify({type:"subscribe_events",...Qt(d)}))}catch{}if(i)Ss(e,!0);r(o)},u=()=>{if(e.ws===o)e.ws=void 0;e.connectPromise=void 0;try{o.removeAllListeners()}catch{}if(Ps(e,"socket closed"),e.subs.size>0||e.eventListeners.size>0)Ss(e,!1),Tn(e);else Tr(e)},a=(d)=>{if(e.ws===o)e.ws=void 0;if(!s)s=!0,e.connectPromise=void 0,n(d)};o.once("open",c),o.on("close",u),o.on("error",a)}),e.connectPromise}async function Pn(e,t,r,n){let o=Cn(e.url,n),s=typeof r.path==="string"?r.path:"/",i=await Ir(o,e),c=crypto.randomUUID();try{return await new Promise((u,a)=>{let d=setTimeout(()=>{if(!o.pending.has(c))return;o.pending.delete(c),a(new ge(`Vault websocket command "${t}" timed out`,s,void 0,"timeout"));try{o.ws?.close()}catch{}},bs);o.pending.set(c,{resolve:(g)=>u(g),reject:a,timer:d});try{i.send(JSON.stringify({type:"command",id:c,command:t,...r,...Qt(e)}))}catch(g){clearTimeout(d),o.pending.delete(c),a(g)}})}finally{Pr(o)}}async function In(e,t,r,n){let o;try{o=await Pn(e,"read_secret",{path:t,...Cs(n)},r)}catch(s){if(vs(s))throw new Be(t);if(s instanceof Et||s instanceof ge)throw s;throw new ge(`Vault websocket read_secret failed for ${t}`,t,void 0,"connection",{cause:s})}if(!o||typeof o!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${t}`);return{data:o.data,metadata:Ts(typeof o.path==="string"?o.path:t,o.metadata)}}async function As(e,t,r,n,o,s){let i=Cn(e.url,o),c=crypto.randomUUID(),u={subscriptionId:c,creds:e,path:t,...n?.kmsSlots!==void 0?{kmsSlots:n.kmsSlots}:{},onChange:r,onHealth:s?.onHealth};i.subs.set(c,u);let a=()=>{if(!i.subs.delete(c))return;if(i.ws&&i.ws.readyState===Zt.OPEN)try{i.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:c}))}catch{}Pr(i)};try{let d=await Ir(i,e);Es(d,u)}catch(d){if(n?.mode!=="wait")throw a(),d}try{let d=await In(e,t,o,n?.kmsSlots);Os(i,u,d,d.metadata.version)}catch(d){if(n?.mode!=="wait")throw a(),d;await new Promise((g,m)=>{let C,P=(E)=>{if(C)clearTimeout(C);u.onFirstSecret=void 0,u.onFirstSecretReject=void 0,a(),m(E)};if(u.onFirstSecret=()=>{if(C)clearTimeout(C);g()},u.onFirstSecretReject=P,typeof n.timeout==="number"&&n.timeout>0)C=setTimeout(()=>P(d),n.timeout)})}return a}async function _s(e,t,r){let n=Cn(e.url,r);n.eventListeners.set(t,e);try{let o=await Ir(n,e);if(o.readyState===Zt.OPEN)o.send(JSON.stringify({type:"subscribe_events",...Qt(e)}))}catch(o){n.log?.warn("Vault websocket event subscription connect failed; retrying in background",o),Tn(n)}return()=>{if(!n.eventListeners.delete(t))return;let o=Rn(e);if(!Is(n).some((i)=>Rn(i)===o)&&n.ws&&n.ws.readyState===Zt.OPEN)try{n.ws.send(JSON.stringify({type:"unsubscribe_events",...Qt(e)}))}catch{}Pr(n)}}function Ls(){let e=0;for(let t of mt.values())e+=t.subs.size;return{urls:Array.from(mt.keys()),sockets:mt.size,subscriptions:e}}function Us(){for(let e of Array.from(mt.values()))Tr(e)}var Or=600000;function gt(e){if(e&&e<Or)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${Or} milliseconds (10 minutes), as not to overload the store with polling requests`)}function Ge(e,t,r,n,o,s,i){let c=!1,u,a,d,g=(k)=>{try{i?.onHealth?.(k)}catch{}},m=()=>{if(c=!0,u)clearTimeout(u),u=void 0;a?.()},C=(k)=>new Promise((T)=>{let l=setTimeout(()=>{a=void 0,u=void 0,T()},k);u=l,a=()=>{clearTimeout(l),a=void 0,u=void 0,T()}});async function P(){let k=Date.now();for(;;){if(c)return;try{let T=await e.getFullSecret(t,s);return g(!0),T}catch(T){if(g(!1),s?.mode!=="wait")throw T;if(typeof s.timeout==="number"&&s.timeout>0&&Date.now()-k>=s.timeout)throw T;if(c)return;o?.warn(`Error retrieving initial secret from vault. Retrying in ${n} milliseconds`,T),await C(n)}}}async function E(){if(u=void 0,c)return;try{let k=await e.getFullSecret(t,s);if(g(!0),k.metadata.version!==d)d=k.metadata.version,r(k)}catch(k){g(!1),o?.warn(`Error retrieving remote config from vault. Retrying in ${n} milliseconds`,k)}O()}function O(){if(c)return;u=setTimeout(()=>{E()},n)}return P().then((k)=>{if(c||!k)return()=>m();return d=k.metadata.version,r(k),O(),()=>m()})}function Uu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function xu(e){let t={"Content-Type":"application/json"};if(e)t["X-Vault-Token"]=e;return t}function Mu(e){return Boolean(e?.idpTokenUrl?.trim()&&e.clientId?.trim()&&e.clientSecret?.trim())}async function xs(e,t){let r=Date.now();if(t.token&&t.expiresAt&&t.expiresAt-60000>r)return t.token;let n=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});if(e.scope?.trim())n.set("scope",e.scope.trim());let o=await fetch(e.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()});if(!o.ok)throw Error(`Vault workload token request failed (${o.status})`);let s=await o.json();if(!s.access_token)throw Error("Vault workload token response did not include access_token");return t.token=s.access_token,t.expiresAt=r+Math.max(1,s.expires_in??300)*1000,s.access_token}function Wu(e){return{Authorization:e.startsWith("Bearer ")?e:`Bearer ${e}`}}function er(e){return e.replace(/\/data\/?$/,"")}function Ms(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let n=e;if(typeof n.parked!=="boolean")throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let o=n.disposition;if(o!==void 0&&o!=="cooldown"&&o!=="suspect")throw Error(`Vault ${r} kms_park returned invalid disposition for ${t}`);return{parked:n.parked,...n.stale===!0?{stale:!0}:{},...o?{disposition:o}:{}}}function Ws(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);let n=e;if(!Array.isArray(n.keys))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);return{keys:n.keys.map((s,i)=>{if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}] for ${t}`);let c=s.id;if(typeof c!=="string"||c.length===0)throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}].id for ${t}`);return{id:c}})}}function js(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);let n=e;if(typeof n.revoked!=="boolean")throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);return{revoked:n.revoked}}function At(e,t){let{type:r="vault",url:n,token:o,ttl:s}=e,i=()=>e.log,c=Mu(e.workload)?e.workload:void 0,u={},a=xu(o),{lfv:d,websocket:g}=e,m=d?lt({...d,log:d.log??i(),path:d.path??"/"},t):void 0,C=new Map,P=g?.url?.trim(),E=new Set,O=!1,k=!1;if(!d&&!n&&!P)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(gt(s),n&&!o&&!c&&!d)i()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function T(){if(c){let w=await xs(c,u);return{"Content-Type":"application/json",...Wu(w)}}return{...a}}async function l(w){let _=F(w);if(c){let h=await xs(c,u);return{url:_,clientId:g?.clientId??c.clientId,token:h,header:"Authorization"}}return{url:_,clientId:g?.clientId,token:g?.token??o,header:g?.header??"X-Vault-Token"}}function b(w){if(!d)throw Error(`Vault LFV capability is not configured for path ${w}`);let _=C.get(w);if(_)return _;let h=lt({...d,log:d.log??i(),path:w},t);return C.set(w,h),h}function W(w){if(!n)throw Error(`Vault HTTP capability is not configured for path ${w}`);return n}function F(w){if(!P)throw Error(`Vault websocket capability is not configured for path ${w}`);return P}async function Q(w,_){let h=await l(typeof _.path==="string"?_.path:"/");return Pn(h,w,_,i())}async function ce(w,_){let h=W(w),p;try{let f=await T(),S=new URL(`${h}/${w}`);if(typeof _?.kmsSlots==="number"&&Number.isInteger(_.kmsSlots)&&_.kmsSlots>=1)S.searchParams.set("kms_slots",String(_.kmsSlots));p=await fetch(S,{headers:f})}catch(f){throw new ge(`Vault request failed from URL: ${h}/${w}`,w,void 0,"connection",{cause:f})}if(p.status!==200){if(p.status===404)throw new Be(w);let f=p.status===401||p.status===403,S=f?`Vault returned ${p.status} ${p.statusText} (auth error) from URL: ${h}/${w}`:`Vault returned invalid status, ${p.status}: '${p.statusText}' from URL: ${h}/${w}`;throw new ge(S,w,p.status,f?"auth":"invalid_status")}try{let S=(await p.json()).data;if(!S?.metadata||!("data"in S))throw Error("Missing vault secret data");let A=S.metadata.created_time??S.metadata.created;return{data:S.data,metadata:{path:typeof S.metadata.path==="string"?S.metadata.path:w,version:typeof S.metadata.version==="number"?S.metadata.version:0,created:A instanceof Date?A:typeof A==="string"?new Date(A):new Date,...ut(S.metadata)?{contentType:ut(S.metadata)}:{}}}}catch(f){throw new ge("Error retrieving secret",w,void 0,"invalid_payload",{cause:f})}}async function se(w,_){let h=await l(w);return In(h,w,i(),_?.kmsSlots)}async function Z(w){let _=W(w),h=`${er(_)}/metadata/${w}`,p=await T(),f=await fetch(h,{headers:p});if(f.status!==200)throw new ge(`Vault getMetadata failed (${f.status}) for ${w}`,w,f.status,"invalid_status");let S=await f.json().catch(()=>null);if(!S?.metadata||typeof S.metadata!=="object")throw new ge(`Vault getMetadata returned invalid payload for ${w}`,w,f.status,"invalid_payload");return S.metadata}async function ee(w,_,h){let p=W(_),f=`${er(p)}/${w}/${_}`,S=await T(),A=await fetch(f,{method:"POST",headers:S,body:JSON.stringify({reason:h?.reason,severity:h?.severity,incident_ref:h?.incidentRef})});if(A.status!==200&&A.status!==202&&A.status!==204)throw new ge(`Vault ${w} failed (${A.status}) for ${_}`,_,A.status,"invalid_status")}async function ue(w,_){if(d)return await b(w).getFullSecret(w,_);if(n)return await ce(w,_);return await se(w,_)}async function z(w,_,h){if(!Uu(_))throw Error(`putSecret requires an object value for vault source at path ${w}`);if(d){await b(w).putSecret(w,_,h);return}if(n){let p=W(w),f=await T();if(f["X-Ionite-Mime-Type"]=h.contentType.mimeType,f["X-Ionite-Secret-Format"]=h.contentType.format,h.contentType.schemaUrl)f["X-Ionite-Schema-Url"]=h.contentType.schemaUrl;if(h.contentType.typeId)f["X-Ionite-Secret-Type"]=h.contentType.typeId;let S=await fetch(`${p}/${w}`,{method:"POST",headers:f,body:JSON.stringify(_)});if(S.status!==200&&S.status!==201&&S.status!==204)throw new ge(`Vault putSecret failed (${S.status}) for ${w}`,w,S.status,"invalid_status");return}await Q("put_secret",{path:w,data:_,content_type:yr(h.contentType)})}async function J(w,_){if(d){await b(w).deleteSecret(w,_);return}if(n){let h=W(w),p=await T(),f=await fetch(`${h}/${w}`,{method:"DELETE",headers:p});if(f.status!==200&&f.status!==202&&f.status!==204)throw new ge(`Vault deleteSecret failed (${f.status}) for ${w}`,w,f.status,"invalid_status");return}await Q("delete_secret",{path:w})}async function B(w,_){if(d)return await b(w).listPaths(w,_);if(n){let f=`${W(w)}/${w}`,S=async(K)=>{let oe=await T();if(K==="LIST")return fetch(f,{method:"LIST",headers:oe});let te=f.includes("?")?"&":"?";return fetch(`${f}${te}list=true`,{method:"GET",headers:oe})},A=await S("LIST");if(A.status===405||A.status===501)A=await S("GET");if(A.status!==200)throw new ge(`Vault listPaths failed (${A.status}) for ${w}`,w,A.status,"invalid_status");let N=await A.json().catch(()=>null),Y;if(N&&typeof N==="object"){let K=N,oe=K.data;if(oe&&typeof oe==="object")Y=oe.keys;else Y=K.keys}if(!Array.isArray(Y))throw new ge(`Vault listPaths returned an unexpected response for ${w}`,w,void 0,"invalid_payload");return Y.filter((K)=>typeof K==="string")}let h=await Q("list_paths",{path:w});if(!Array.isArray(h.items))throw Error(`Vault websocket list_paths returned invalid payload for ${w}`);return h.items.filter((p)=>typeof p==="string")}async function ae(w,_){if(d)return await b(w).exists(w,_);if(n){let p=W(w),f=await T(),S=await fetch(`${p}/${w}`,{headers:f});if(S.status===200)return!0;if(S.status===404)return!1;if(S.status===401||S.status===403)throw new ge(`Vault exists failed (${S.status}) for ${w} (auth error)`,w,S.status,"auth");throw new ge(`Vault exists failed (${S.status}) for ${w}`,w,S.status,"invalid_status")}let h=await Q("exists",{path:w});if(typeof h.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${w}`);return h.exists}async function re(w,_,h){if(d){await b(w).requestRotate(w,_,h);return}if(n){await ee("rotate/request",w,_);return}await Q("request_rotate",{path:w,reason:_?.reason,severity:_?.severity,incident_ref:_?.incidentRef})}async function ne(w,_,h){if(d){await b(w).requestRevoke(w,_,h);return}if(n){await ee("revoke/request",w,_);return}await Q("request_revoke",{path:w,reason:_?.reason,severity:_?.severity,incident_ref:_?.incidentRef})}async function R(w,_,h){if(d)return await b(w).parkKmsKey(w,_,h);if(n){let f=W(w),S=`${er(f)}/kms/park/${w}`,A=await T(),N=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({key_id:_.keyId,status:_.status,reason:_.reason})});if(N.status!==200&&N.status!==202)throw new ge(`Vault kms/park failed (${N.status}) for ${w}`,w,N.status,"invalid_status");return Ms(await N.json().catch(()=>null),w,"http")}let p=await Q("kms_park",{path:w,key_id:_.keyId,status:_.status,reason:_.reason});return Ms(p,w,"websocket")}async function M(w,_,h){if(d)return await b(w).addKmsKeys(w,_,h);if(n){let f=W(w),S=`${er(f)}/kms/add-keys/${w}`,A=await T(),N=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({keys:_.keys})});if(N.status!==200&&N.status!==202)throw new ge(`Vault kms/add-keys failed (${N.status}) for ${w}`,w,N.status,"invalid_status");return Ws(await N.json().catch(()=>null),w,"http")}let p=await Q("kms_add_keys",{path:w,keys:_.keys});return Ws(p,w,"websocket")}async function G(w,_,h){if(d)return await b(w).revokeKmsKey(w,_,h);if(n){let f=W(w),S=`${er(f)}/kms/revoke-key/${w}`,A=await T(),N=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({key_id:_.keyId,reason:_.reason})});if(N.status!==200&&N.status!==202)throw new ge(`Vault kms/revoke-key failed (${N.status}) for ${w}`,w,N.status,"invalid_status");return js(await N.json().catch(()=>null),w,"http")}let p=await Q("kms_revoke_key",{path:w,key_id:_.keyId,reason:_.reason});return js(p,w,"websocket")}async function H(w,_){if(d)return await b(w).getMetadata(w,_);if(n)return await Z(w);let h=await Q("read_metadata",{path:w});if(!h.metadata||typeof h.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${w}`);return h.metadata}async function v(w,_,h){if(!s)throw new Le(r,w);return Ge({getFullSecret:ce},w,_,s,i(),h,{onHealth:(p)=>{O=!p}})}async function U(w,_,h){let p=await l(w);return As(p,w,_,h,i(),{onHealth:(f)=>{k=!f}})}function I(w){let _=()=>{if(E.delete(_))w()};return E.add(_),_}function x(){if(m?.isAvailable?.()===!1)return!0;for(let w of C.values())if(w.isAvailable?.()===!1)return!0;return!1}let q={type:r,isAvailable:()=>!O&&!k&&!x(),get:(w,_)=>qe(()=>ue(w,_)),getFullSecret:ue,getSecret:async(w,_)=>(await ue(w,_)).data,putSecret:z,deleteSecret:J,listPaths:B,exists:ae,requestRotate:re,requestRevoke:ne,parkKmsKey:R,addKmsKeys:M,revokeKmsKey:G,getMetadata:H,subscribe:async(w,_,h)=>{let p;if(P)p=await U(w,_,h);else if(d)p=await b(w).subscribe(w,_,h);else p=await v(w,_,h);return I(p)},...m?{subscribeEvents:(w)=>I(m.subscribeEvents?.(w)??(()=>{}))}:P?{subscribeEvents:(w)=>{let _,h=!1;return l("/").then((p)=>_s(p,w,i())).then((p)=>{if(h){p();return}_=p}).catch((p)=>{i()?.warn("Vault websocket event subscription failed",p)}),I(()=>{h=!0,_?.()})}}:{},close:()=>{for(let _ of Array.from(E))try{_()}catch(h){i()?.warn("Vault source close: failed to release a subscription",h)}E.clear();let w=(_)=>{if(!_?.close)return;try{Promise.resolve(_.close()).catch((h)=>{i()?.warn("Vault source close: LFV close failed",h)})}catch(h){i()?.warn("Vault source close: LFV close failed",h)}};for(let _ of C.values())w(_);w(m),C.clear(),u.token=void 0,u.expiresAt=void 0},get log(){return e.log},set log(w){e.log=w}};if(m)q.isDeliveryRequest=(w)=>m.isDeliveryRequest(w),q.isEventsRequest=(w)=>m.isEventsRequest(w),q.handleDelivery=(w)=>m.handleDelivery(w),q.handleEvents=(w)=>m.handleEvents(w),Object.defineProperties(q,{deliveryPath:{value:m.deliveryPath,enumerable:!0},eventsPath:{value:m.eventsPath,enumerable:!0},callbackKey:{value:m.callbackKey,enumerable:!0},trustId:{value:m.trustId,enumerable:!0}});return q}class Ar extends Error{constructor(e,t){super(e);this.name="AzureKeyVaultError",this.status=t,Object.setPrototypeOf(this,Ar.prototype)}}function Er(e,t){if(!e||e.trim().length===0)throw Error(`Missing required Azure config: ${t}`);return e}function qu(e){return e.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function On(e,t){return`${e.replace(/\/+$/g,"")}/${t.replace(/^\/+/g,"")}`}function Nu(e){try{let r=new URL(e).pathname.split("/").filter(Boolean),n=r.indexOf("secrets");if(n===-1)return;return r[n+2]||void 0}catch{return}}function Ku(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function _r(e){let t=e.apiVersion??"7.4",r=e.scope??"https://vault.azure.net/.default",n=e.secretNameTransform??qu,o=e.authMethod,s="/var/run/secrets/azure/tokens/azure-identity-token",i=e.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",c=e.vaultUrl??(e.vaultName?`https://${e.vaultName}.vault.azure.net`:void 0)??void 0,u=Er(c,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function a(z){try{return await $u(z),!0}catch{return!1}}let d,g,m=!1;async function C(z){let{entraTenantId:J,clientId:B}=e;if(!J)throw Error("Workload identity requires entraTenantId");if(!B)throw Error("Workload identity requires clientId");if(!await a(i))throw Error(`Federated token file not found at ${i}`);let ae=(await ju(i,"utf8")).trim();if(!ae)throw Error("Federated token file was empty");let re=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:B,grant_type:"client_credentials",scope:r,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:ae}),R=await fetch(re,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:ne});if(R.status!==200)throw Error(`Azure workload identity token exchange returned ${R.status} ${R.statusText}`);let M=await R.json();if(!M?.access_token)throw Error("Azure token response missing access_token");return d={accessToken:M.access_token,expiresAtMs:z+(M.expires_in??0)*1000},M.access_token}async function P(z){let J=e.imdsApiVersion??"2018-02-01",B="https://vault.azure.net",ae=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(ae.searchParams.set("api-version",J),ae.searchParams.set("resource","https://vault.azure.net"),e.managedIdentityClientId)ae.searchParams.set("client_id",e.managedIdentityClientId);let re=await fetch(ae.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(re.status!==200)throw Error(`Azure IMDS token endpoint returned ${re.status} ${re.statusText}`);let ne=await re.json();if(!ne?.access_token)throw Error("IMDS token response missing access_token");let R=z+60000;if(ne.expires_on){let M=Number.parseInt(ne.expires_on,10);if(Number.isFinite(M)&&M>0)R=M*1000;else{let G=Date.parse(ne.expires_on);if(Number.isFinite(G))R=G}}else if(ne.expires_in){let M=Number.parseInt(ne.expires_in,10);if(Number.isFinite(M)&&M>0)R=z+M*1000}return d={accessToken:ne.access_token,expiresAtMs:R},ne.access_token}async function E(z){let J=Er(e.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),B=Er(e.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),ae=Er(e.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),re=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:B,client_secret:ae,grant_type:"client_credentials",scope:r}),R=await fetch(re,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:ne});if(R.status!==200)throw Error(`Azure token endpoint returned ${R.status} ${R.statusText}`);let M=await R.json();if(!M?.access_token)throw Error("Azure token response missing access_token");return d={accessToken:M.access_token,expiresAtMs:z+(M.expires_in??0)*1000},M.access_token}async function O(){let z=Date.now();if(d&&d.expiresAtMs-60000>z)return d.accessToken;if(g)return g;g=(async()=>{if(o==="workload_identity")return await C(z);if(o==="managed_identity")return await P(z);if(o==="client_secret")return await E(z);if(await a(i))try{return await C(z)}catch{}try{return await P(z)}catch{}return await E(z)})();try{return await g}finally{g=void 0}}async function k(z){let J=await O(),B=On(u,`/secrets/${encodeURIComponent(z)}?api-version=${encodeURIComponent(t)}`),ae=await fetch(B,{headers:{Authorization:`Bearer ${J}`,Accept:"application/json"}});if(ae.status!==200)throw new Ar(`Key Vault request failed (${ae.status})`,ae.status);return await ae.json()}async function T(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await k(ae),ne=re.value;try{ne=JSON.parse(re.value)}catch{}let R=re.attributes?.created?re.attributes.created*1000:void 0,M=Nu(re.id),G=re.contentType?gr({mimeType:re.contentType,format:re.tags?.["ionite-format"],schemaUrl:re.tags?.["ionite-schema-url"],typeId:re.tags?.["ionite-type-id"]}):void 0;return{data:ne,metadata:{path:z,version:Number.parseInt(M??"",10)||0,created:R?new Date(R):new Date,...G?{contentType:G}:{}}}}async function l(z,J,B){if(!Ku(J))throw Error(`putSecret requires an object value for azure source at path ${z}`);let ae=n(z),re=e.secretNamePrefix?`${e.secretNamePrefix}${ae}`:ae,ne=await O(),R=On(u,`/secrets/${encodeURIComponent(re)}?api-version=${encodeURIComponent(t)}`),M=JSON.stringify({value:JSON.stringify(J),contentType:B.contentType.mimeType,tags:{"ionite-format":B.contentType.format,...B.contentType.schemaUrl?{"ionite-schema-url":B.contentType.schemaUrl}:{},...B.contentType.typeId?{"ionite-type-id":B.contentType.typeId}:{}}}),G=await fetch(R,{method:"PUT",headers:{Authorization:`Bearer ${ne}`,"Content-Type":"application/json",Accept:"application/json"},body:M});if(G.status!==200&&G.status!==201)throw Error(`Key Vault putSecret failed (${G.status}) for ${z}`)}async function b(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await O(),ne=On(u,`/secrets/${encodeURIComponent(ae)}?api-version=${encodeURIComponent(t)}`),R=await fetch(ne,{method:"DELETE",headers:{Authorization:`Bearer ${re}`,Accept:"application/json"}});if(R.status!==200&&R.status!==202&&R.status!==204)throw Error(`Key Vault deleteSecret failed (${R.status}) for ${z}`)}async function W(z,J){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${z}`)}async function F(z,J){try{return await T(z),!0}catch(B){if(B instanceof Ar&&B.status===404)return!1;throw B}}async function Q(z,J,B){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${z}`)}async function ce(z,J,B){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${z}`)}async function se(z){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${z}`)}async function Z(z){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${z}`)}async function ee(z){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${z}`)}async function ue(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await k(ae),ne=re.contentType?gr({mimeType:re.contentType,format:re.tags?.["ionite-format"],schemaUrl:re.tags?.["ionite-schema-url"],typeId:re.tags?.["ionite-type-id"]}):void 0;return{id:re.id,...ne?{content_type:ne}:{},...re.attributes??{}}}return{type:e.type,isAvailable:()=>!m,get:(z,J)=>qe(()=>T(z,J)),getFullSecret:T,getSecret:async(z,J)=>(await T(z,J)).data,putSecret:l,deleteSecret:b,listPaths:W,exists:F,requestRotate:Q,requestRevoke:ce,parkKmsKey:se,addKmsKeys:Z,revokeKmsKey:ee,getMetadata:ue,subscribe:(z,J,B)=>{if(!e.ttl)throw new Le("azure",z);return gt(e.ttl),Ge({getFullSecret:T},z,J,e.ttl,void 0,B,{onHealth:(ae)=>{m=!ae}})},close:()=>{d=void 0,g=void 0,m=!1}}}var En=Symbol("ion.secretsSourceState");function Fu(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${n}`)};return{type:"dev",get:(r,n)=>qe(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[En]:"unavailable"}}function $s(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${n}`)};return{type:"dev",get:(r,n)=>qe(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[En]:"removed"}}function Du(e){return e.type==="vault"&&e.lfv!=null}function zu(e,t,r,n){if(!Du(t))return;if(r||n)return;throw Error(`Secrets source "${e}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function Bu(e,t,r){if(t.type==="vault")return At(t,r);if(t.type==="azure")return _r(t);if(t.type==="aws"||t.type==="gcp"||t.type==="dev")throw Error(`Secrets source "${e}" uses type "${t.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${e}"`)}function Gu(e,t){let r=(n)=>{t.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:n instanceof Error?n.message:String(n)})};try{Promise.resolve(e.close?.()).catch(r)}catch(n){r(n)}}function Ju(e){let t=new Map,r=new Map,n=new Map;for(let[o,s]of Object.entries(e)){if(!qs(s))continue;let i=t.get(s.deliveryPath);if(i)throw Error(`LFV delivery path "${s.deliveryPath}" is claimed by both secrets sources "${i}" and "${o}"; delivery paths must be globally unique.`);t.set(s.deliveryPath,o);let c=r.get(s.eventsPath);if(c)throw Error(`LFV events path "${s.eventsPath}" is claimed by both secrets sources "${c}" and "${o}"; events paths must be globally unique.`);r.set(s.eventsPath,o);let u=n.get(s.callbackKey);if(u&&u.trustId!==s.trustId)throw Error(`LFV callback key "${s.callbackKey}" is claimed by secrets sources "${u.sourceName}" and "${o}" with different verify JWKS; a callback path must use a single trust key.`);if(!u)n.set(s.callbackKey,{sourceName:o,trustId:s.trustId})}}function qs(e){return typeof e.isDeliveryRequest==="function"&&typeof e.isEventsRequest==="function"&&typeof e.handleDelivery==="function"&&typeof e.handleEvents==="function"}function Hu(e,t,r){let n={...t},o=[],s=(c)=>{if(n[c]!==void 0)delete n[c],o.push(c)};s("token"),s("clientSecret"),s("workload");let i=n.websocket;if(i&&typeof i==="object"&&i.token!==void 0){let c={...i};delete c.token,n.websocket=c,o.push("websocket.token")}if(o.length>0)r.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:e,"ion.droppedFields":o});return n}function Yu(e,t,r){let n={},o=new Set([...Object.keys(t??{}),...Object.keys(r??{})]);for(let s of o){let i=t?.[s],c=r?.[s],u=c?Hu(s,c,e):void 0;n[s]={...i??{},...u??{}}}return n}function Lr(e){return e[En]??"available"}function Xu(e,t,r){let n=t,o=new Set,s=new Set,i=new Set,c=We(r,`Secrets source "${e}"`),u=()=>Lr(n)==="available",a=ye(`Secrets source "${e}"`,u),d=(l,b,W)=>Error(`${l} timed out after ${W}ms waiting for source "${e}" to be configured by the ConfigSource at path ${b}`),g=(l,b)=>Error(`${l} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${b}`),m=(l,b,W)=>{let F=Lr(n);if(F==="available")return Promise.resolve(n);if(F==="removed")return Promise.reject(g(l,b));return new Promise((Q,ce)=>{let se={method:l,path:b,resolve:(ee)=>{if(se.timeout)clearTimeout(se.timeout);i.delete(se),Q(ee)},reject:(ee)=>{if(se.timeout)clearTimeout(se.timeout);i.delete(se),ce(ee)}},Z=W?.timeout;if(typeof Z==="number"&&Z>0)se.timeout=setTimeout(()=>{se.reject(d(l,b,Z))},Z);i.add(se)})},C=(l)=>{for(let b of Array.from(i))b.resolve(l)},P=()=>{for(let l of Array.from(i))l.reject(g(l.method,l.path))},E=async(l,b=!1)=>{let W=l.guard.next();if(l.unsubscribe?.(),l.unsubscribe=void 0,l.closed)return;if(Lr(n)==="unavailable"&&l.options?.mode!=="wait"){if(b)throw Error(`subscribe is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${l.path}`);return}try{let Q=await(l.options?.mode==="wait"?await m("subscribe",l.path,l.options):n).subscribe(l.path,(ce)=>{if(!l.closed)l.onChange(ce)},l.options);if(l.closed||!l.guard.isCurrent(W)){Q?.();return}l.unsubscribe=Q}catch(F){if(b)throw F;if(Sr(F)){r.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:e,path:l.path});return}r.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:e,path:l.path,error:F instanceof Error?F.message:String(F)})}},O=(l,b=!1)=>{if(l.unsubscribe?.(),l.unsubscribe=void 0,l.closed)return;if(!n.subscribeEvents){if(b)throw Error(`Secrets source "${e}" does not support lifecycle event subscriptions`);return}l.unsubscribe=n.subscribeEvents((W)=>{if(!l.closed)l.listener(W)})},k={get type(){return n.type},beforeChange:c.beforeChange,afterChange:c.afterChange,isAvailable:()=>u()&&(n.isAvailable?.()??!0),isReady:a.isReady,ready:a.ready,get:(l,b)=>qe(async()=>(await m("get",l,b)).getFullSecret(l,b)),getFullSecret:async(l,b)=>(await m("getFullSecret",l,b)).getFullSecret(l,b),getSecret:async(l,b)=>(await m("getSecret",l,b)).getSecret(l,b),putSecret:async(l,b,W)=>(await m("putSecret",l,W)).putSecret(l,b,W),subscribe:async(l,b,W)=>{let F={path:l,onChange:b,options:W,closed:!1,guard:Cr()};o.add(F);try{await E(F,!0)}catch(Q){throw o.delete(F),Q}return()=>{F.closed=!0,F.guard.next(),o.delete(F),F.unsubscribe?.(),F.unsubscribe=void 0}},subscribeEvents:(l)=>{let b={listener:l,closed:!1};s.add(b);try{O(b,!0)}catch(W){throw s.delete(b),W}return()=>{b.closed=!0,s.delete(b),b.unsubscribe?.(),b.unsubscribe=void 0}},deleteSecret:async(l,b)=>(await m("deleteSecret",l,b)).deleteSecret(l,b),listPaths:async(l,b)=>(await m("listPaths",l,b)).listPaths(l,b),exists:async(l,b)=>(await m("exists",l,b)).exists(l,b),requestRotate:async(l,b,W)=>(await m("requestRotate",l,W)).requestRotate(l,b,W),requestRevoke:async(l,b,W)=>(await m("requestRevoke",l,W)).requestRevoke(l,b,W),parkKmsKey:async(l,b,W)=>(await m("parkKmsKey",l,W)).parkKmsKey(l,b,W),addKmsKeys:async(l,b,W)=>(await m("addKmsKeys",l,W)).addKmsKeys(l,b,W),revokeKmsKey:async(l,b,W)=>(await m("revokeKmsKey",l,W)).revokeKmsKey(l,b,W),getMetadata:async(l,b)=>(await m("getMetadata",l,b)).getMetadata(l,b)},T=(l)=>{try{Promise.resolve(l.close?.()).catch((b)=>{r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:b instanceof Error?b.message:String(b)})})}catch(b){r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:b instanceof Error?b.message:String(b)})}};return{api:k,update(l){if(l===n)return;let b=n;c.emitBefore(),n=l;let W=Lr(l);if(W==="available")C(l);else if(W==="removed")P();a.refresh();for(let F of o)E(F);for(let F of s)O(F);T(b),c.emitAfter()},close(){for(let l of o)l.closed=!0,l.guard.next(),l.unsubscribe?.(),l.unsubscribe=void 0;o.clear();for(let l of s)l.closed=!0,l.unsubscribe?.(),l.unsubscribe=void 0;s.clear(),P(),a.settle(),T(n)}}}function Ns(e,t=new Map){let r=new Map,n=new Map,o,s=!1,i=new Map,c=We(e,"Secrets"),u=!1,a=()=>{for(let k of r.keys()){let T=i.get(k);if(T&&T.api.isReady?.()===!1)return!1}return!0},d=ye("Secrets module",()=>u&&a()),g=(k)=>{let T=i.get(k);if(T)return T;let l=Xu(k,r.get(k)??$s(k),e);if(i.set(k,l),!(k in O))Object.assign(O,{[k]:l.api});return l},m=(k)=>{let T=i.get(k)?.api;if(T)return T;throw e.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:k}),Error(`Secrets source "${k}" is not configured`)},C=()=>Array.from(r.values()).filter(qs),P=(k)=>C().find((T)=>T.isDeliveryRequest(k)),E=(k)=>C().find((T)=>T.isEventsRequest(k)),O;return O={get config(){return Object.fromEntries(Array.from(r.keys(),(k)=>[k,g(k).api]))},beforeChange:c.beforeChange,afterChange:c.afterChange,isReady:d.isReady,isAvailable:()=>{for(let k of i.values()){if(k.api.isReady?.()===!1)continue;if(k.api.isAvailable?.()===!1)return!1}return!0},ready:d.ready,listSecretsSources:()=>Array.from(r.keys()),getSecretsSource:(k)=>{if(r.has(k))return g(k).api;return m(k)},get:(k,T,l)=>O.getSecretsSource(k).get(T,l),getSecret:(k,T,l)=>O.getSecretsSource(k).getSecret(T,l),getFullSecret:(k,T,l)=>O.getSecretsSource(k).getFullSecret(T,l),putSecret:(k,T,l,b)=>O.getSecretsSource(k).putSecret(T,l,b),deleteSecret:(k,T,l)=>O.getSecretsSource(k).deleteSecret(T,l),listPaths:(k,T,l)=>O.getSecretsSource(k).listPaths(T,l),exists:(k,T,l)=>O.getSecretsSource(k).exists(T,l),requestRotate:(k,T,l,b)=>O.getSecretsSource(k).requestRotate(T,l,b),requestRevoke:(k,T,l,b)=>O.getSecretsSource(k).requestRevoke(T,l,b),parkKmsKey:(k,T,l,b)=>O.getSecretsSource(k).parkKmsKey(T,l,b),addKmsKeys:(k,T,l,b)=>O.getSecretsSource(k).addKmsKeys(T,l,b),revokeKmsKey:(k,T,l,b)=>O.getSecretsSource(k).revokeKmsKey(T,l,b),getMetadata:(k,T,l)=>O.getSecretsSource(k).getMetadata(T,l),subscribe:(k,T,l,b)=>O.getSecretsSource(k).subscribe(T,l,b),isLfvDeliveryRequest:(k)=>P(k)!==void 0,isLfvEventsRequest:(k)=>E(k)!==void 0,handleLfvDelivery:async(k)=>{let T=P(k);if(!T)return me();return T.handleDelivery(k)},handleLfvEvents:async(k)=>{let T=E(k);if(!T)return me();return T.handleEvents(k)}},{update(k,T,l,b,W){let F=k!==void 0||T!==void 0;if(!F&&!u&&i.size===0)return;let Q=Yu(e,k,T),ce=W===!0,se=b!==o,Z=ce!==s,ee=new Map,ue=new Map,z=[];try{for(let[J,B]of Object.entries(Q)){let ae=Vu(B),re=r.get(J);if(re&&n.get(J)===ae&&!se&&!Z){ee.set(J,re),ue.set(J,ae);continue}let ne;if(!B.type)ne=Fu(J);else{if(l?.validateSourceConfig?.(J,B),t.has(J)&&k?.[J])e.warn(`RemoteConfig secrets source "${J}" is superseded by the framework LFV bootstrap source.`);if(!t.has(J))zu(J,B,b,ce),ne=Bu(J,B,b),z.push(ne);else ne=t.get(J)}ee.set(J,ne),ue.set(J,ae)}Ju(Object.fromEntries(ee))}catch(J){for(let B of z)Gu(B,e);throw J}c.emitBefore(),u=F,o=b,s=ce;for(let[J,B]of ee)r.set(J,B),n.set(J,ue.get(J)),g(J).update(B);for(let[J,B]of i){if(ee.has(J))continue;r.delete(J),n.delete(J),B.update($s(J))}return d.refresh(),c.emitAfter(),O},close(){for(let k of i.values())k.close();i.clear(),r.clear(),n.clear(),o=void 0,u=!1,d.settle()}}}function An(e,t){let r=t.ttlMs,n=Math.max(1,Math.floor(t.maxEntries)),o=new Map,s=()=>Date.now();function i(){while(o.size>n){let u=o.keys().next().value;if(u===void 0)break;o.delete(u)}}function c(u,a){o.delete(u),o.set(u,{session:a,expiresAt:s()+r}),i()}return{async create(u){await e.create(u)},async get(u){let a=o.get(u);if(a){if(a.expiresAt>s())return o.delete(u),o.set(u,a),a.session;o.delete(u)}let d=await e.get(u);if(d)c(u,d);return d},async update(u,a){await e.update(u,a),o.delete(u)},async delete(u){await e.delete(u),o.delete(u)}}}import{deepEqualPlain as pd,ION_ENDPOINT_PERMISSIONS as md,trimTrailingSlash as Wr,validationFailureResponse as gd}from"@ionite/core";import{assertEcid as Ks,jwtAssertionClaimsSchema as Zu,must as Ue,workloadTokenResponseSchema as Qu}from"@ionite/core";import{getCachedVerificationKey as ed,getJwks as td}from"@ionite/core/server";function je(e,t){return t in e&&e[t]!==void 0&&e[t]!==null}function Ie(e){if(e===void 0||e===null)return!1;return je(e,"workloadId")||je(e,"privateKey")}function Ke(e){if(e===void 0||e===null)return!1;let t=je(e,"clientId"),r=je(e,"clientSecret"),n=je(e,"workloadId"),o=je(e,"privateKey");return(t||r)&&!n&&!o}function _n(e){if(e===void 0||e===null)return!1;let t=je(e,"jwksUri"),r=je(e,"workloadId"),n=je(e,"clientId"),o=je(e,"clientSecret"),s=je(e,"privateKey");return t&&!r&&!s&&!n&&!o}function Vs(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function rd(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(Vs(t))return!1;let r=Object.entries(t);if(r.length===0)return!1;return r.every(([,n])=>Vs(n))}function Gs(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if("incoming"in t||"outgoing"in t){if(t.incoming!==void 0&&(typeof t.incoming!=="object"||t.incoming===null))return!1;if(t.outgoing!==void 0&&(typeof t.outgoing!=="object"||t.outgoing===null||Array.isArray(t.outgoing)))return!1;return!0}return!1}function Js(e){return Gs(e)}function Ln(e){if(!e)return;if(Js(e))return Array.isArray(e.incoming)?void 0:e.incoming;return e}function jn(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function _t(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function Fs(e){if(!e)return[];if(Array.isArray(e))return e.filter((t)=>!!t&&typeof t.issuer==="string"&&typeof t.jwksUri==="string").map((t)=>({issuer:t.issuer,jwksUri:t.jwksUri,audience:t.audience,scopesAsEntitlements:t.scopesAsEntitlements}));if(e.issuer&&e.jwksUri)return[{issuer:e.issuer,jwksUri:e.jwksUri,audience:e.audience??[],scopesAsEntitlements:e.scopesAsEntitlements}];return[]}function nd(e){let t=e[0];if(!t)return;let r=jn(t.audience);return{jwksUri:t.jwksUri,issuer:t.issuer,audience:typeof r[0]==="string"?r[0]:void 0}}function Ds(e,t){let r=_t(t);if(!r)return;return e.find((n)=>_t(n.issuer)===r)}function Ur(e,t,r){let n=jn(e);if(t.some((o)=>n.includes(o)))return!0;if(typeof r==="string"&&t.includes(r))return!0;return!1}function Un(e){if(!e||!Js(e))return{};return e.outgoing??{}}function od(e){return{getToken:e.getToken,refreshToken:e.refreshToken,generateJWTAssertion:e.generateJWTAssertion,revokeToken:e.revokeToken,beforeChange:e.beforeChange,afterChange:e.afterChange,isReady:e.isReady,ready:e.ready}}var $n=Symbol("ion.workloadClientState"),Hs=Symbol("ion.namedWorkloadClients");function Lt(e,t){let r=ye(e,t);return{isReady:r.isReady,ready:r.ready}}function sd(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...Lt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[$n]:"unavailable"}}function zs(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it is no longer configured on this Ionite instance.`)};return{...Lt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[$n]:"removed"}}function id(e){if(!e)return"removed";return e[$n]??"available"}function xn(e,t,r){let n=e,o=n,s=new Set;for(let i of r){if(s.add(i),i in o)continue;let c=t[i];o[i]=c?od(c):sd(i)}return Object.defineProperty(o,Hs,{value:s,enumerable:!1,configurable:!0}),n}function Bs(e){if(!e)return[];let t=e[Hs];return t?Array.from(t):[]}function ad(e,t,r){let n=t,o=We(r,`Workload client "${e}"`),s=()=>id(n)==="available",i=ye(`Workload client "${e}"`,s);return{api:{beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:i.isReady,ready:i.ready,getToken:(u)=>n.getToken(u),refreshToken:(u)=>n.refreshToken(u),generateJWTAssertion:(u)=>n.generateJWTAssertion(u),revokeToken:(u)=>n.revokeToken(u)},update(u){if(u===n)return;o.emitBefore(),n=u,i.refresh(),o.emitAfter()}}}function Ys(e){let t,r=!1,n=ye("Workload module",()=>r),o=We(e,"Workload"),s=new Map,i=new Set,c=new Set(["beforeChange","afterChange","isReady","ready"]),u=(m)=>{if(!t)throw Error(`${m} is unavailable because workload is not configured on this Ionite instance.`);return t},a={beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:n.isReady,ready:n.ready,get config(){return t?.config??{}},getToken(...m){return u("getToken").getToken(...m)},refreshToken(m){return u("refreshToken").refreshToken(m)},generateJWTAssertion(m){return u("generateJWTAssertion").generateJWTAssertion(m)},revokeToken(m){return u("revokeToken").revokeToken(m)},validateToken(m){return u("validateToken").validateToken(m)},getWorkloadIdentity(m){return u("getWorkloadIdentity").getWorkloadIdentity(m)},parseJWT(m){return u("parseJWT").parseJWT(m)},handler(m){return u("handler").handler(m)}},d=(m)=>{for(let E of i)delete a[E];if(i.clear(),!m)return;let C=new Set(Bs(m)),P=new Set([...c,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...C]);for(let[E,O]of Object.entries(m)){if(P.has(E))continue;a[E]=O,i.add(E)}},g=(m)=>{let C=s.get(m);if(C)return C;let P=ad(m,zs(m),e);if(s.set(m,P),!(m in a))a[m]=P.api;return P};return{update(m){if(!m&&!r&&s.size===0)return;o.emitBefore(),r=m!==void 0,n.refresh(),t=m;let C=new Set(Bs(m));for(let P of C){let E=m[P];g(P).update(E)}for(let[P,E]of s){if(C.has(P))continue;E.update(zs(P))}return d(m),o.emitAfter(),a}}}async function Mn(e,t,r){if(e===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let n=r[e];if(!n)throw Error(`Unknown workload client: ${e}`);return n.getToken(t)}function Wn(e,t){return`${e}|${t??""}`}function Je(e,t,r,n,o){let s={jwtAssertionClaims:e?.jwtAssertionClaims??Zu("server"),tokenResponse:e?.tokenResponse??Qu("server")},i=async(p,f)=>{let S=p;if(typeof S.validate==="function")return S.validate(f);return p["~standard"].validate(f)};if(!r&&!n)return;if(r&&Gs(r)){let p=r.incoming,f=Fs(p),S=Array.isArray(p)?nd(p):p,A=Ln(n),N=Un(n),Y=S?{...S,...A,jwksUri:S.jwksUri,issuer:S.issuer}:A;if(!Y||!Y.tokenUrl&&!Y.jwksUri)t.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let K=Y&&(Y.tokenUrl||Y.jwksUri)?Je(e,t,S??void 0,A,f):void 0,oe=Array.from(new Set([...Object.keys(r.outgoing??{}),...Object.keys(N)])).map((le)=>[le,{...r.outgoing?.[le]??{},...N[le]??{}}]),te={};for(let[le,st]of oe){let Ve=Je(e,t,st,void 0);if(Ve)te[le]=Ve}if(!K&&Object.keys(te).length===0)return;let we={...K?.config??{},config:K?.config??{},...Lt("workload",()=>K?.isReady()===!0||Object.values(te).some((le)=>le.isReady())),getToken:async(le,st)=>Mn(le,st,te),getServerToken:async(le)=>{if(!K)throw Error("No server workload config");return K.getToken(le)},refreshToken:async(le)=>{if(!K)throw Error("No default workload config");return K.refreshToken(le)},generateJWTAssertion:async(le)=>{if(!K)throw Error("No default workload config");return K.generateJWTAssertion(le)},revokeToken:async(le)=>{if(!K)throw Error("No default workload config");return K.revokeToken(le)},validateToken:async(le)=>{if(!K)throw Error("No default workload config");return K.validateToken(le)},getWorkloadIdentity:async(le)=>{if(!K)return;return K.getWorkloadIdentity(le)},parseJWT:async(le)=>{if(!K)throw Error("No default workload config");return K.parseJWT(le)},handler:async(le)=>{if(!K)return me();return K.handler(le)}};return xn(we,te,oe.map(([le])=>le))}if(r&&rd(r)){let p=Ln(n),f=Un(n),S=r.default,A=S?{...S,...p,jwksUri:S.jwksUri,issuer:S.issuer}:p;if(!A||!A.tokenUrl&&!A.jwksUri)t.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let N=A&&(A.tokenUrl||A.jwksUri)?Je(e,t,S??void 0,p):void 0,Y=Array.from(new Set([...Object.keys(r).filter((te)=>te!=="default"),...Object.keys(f)])).map((te)=>[te,{...te in r?r[te]:{},...f[te]??{}}]),K={};for(let[te,we]of Y){let le=Je(e,t,we,void 0);if(le)K[te]=le}if(!N&&Object.keys(K).length===0)return;let oe={...N?.config??{},config:N?.config??{},...Lt("workload",()=>N?.isReady()===!0||Object.values(K).some((te)=>te.isReady())),getToken:async(te,we)=>Mn(te,we,K),getServerToken:async(te)=>{if(!N)throw Error("No server workload config");return N.getToken(te)},refreshToken:async(te)=>{if(!N)throw Error("No default workload config");return N.refreshToken(te)},generateJWTAssertion:async(te)=>{if(!N)throw Error("No default workload config");return N.generateJWTAssertion(te)},revokeToken:async(te)=>{if(!N)throw Error("No default workload config");return N.revokeToken(te)},validateToken:async(te)=>{if(!N)throw Error("No default workload config");return N.validateToken(te)},getWorkloadIdentity:async(te)=>{if(!N)return;return N.getWorkloadIdentity(te)},parseJWT:async(te)=>{if(!N)throw Error("No default workload config");return N.parseJWT(te)},handler:async(te)=>{if(!N)return me();return N.handler(te)}};return xn(oe,K,Y.map(([te])=>te))}let c=Ln(n),u=Un(n);if(!r&&Object.keys(u).length>0){let p={};for(let[A,N]of Object.entries(u)){let Y=Je(e,t,N,void 0);if(Y)p[A]=Y}let f=c&&(c.tokenUrl||c.jwksUri)?Je(e,t,c,void 0):void 0;if(!f&&Object.keys(p).length===0)return;let S={...f?.config??{},config:f?.config??{},...Lt("workload",()=>f?.isReady()===!0||Object.values(p).some((A)=>A.isReady())),getToken:async(A,N)=>Mn(A,N,p),getServerToken:async(A)=>{if(!f)throw Error("No server workload config");return f.getToken(A)},refreshToken:async(A)=>{if(!f)throw Error("No default workload config");return f.refreshToken(A)},generateJWTAssertion:async(A)=>{if(!f)throw Error("No default workload config");return f.generateJWTAssertion(A)},revokeToken:async(A)=>{if(!f)throw Error("No default workload config");return f.revokeToken(A)},validateToken:async(A)=>{if(!f)throw Error("No default workload config");return f.validateToken(A)},getWorkloadIdentity:async(A)=>{if(!f)return;return f.getWorkloadIdentity(A)},parseJWT:async(A)=>{if(!f)throw Error("No default workload config");return f.parseJWT(A)},handler:async(A)=>{if(!f)return me();return f.handler(A)}};return xn(S,p,Object.keys(u))}let a=r,d=o??Fs(a),g=c?.tokenUrl,m=g?.startsWith("/")?g:void 0,C=a?.idpTokenUrl??c?.idpTokenUrl??(a?.tokenUrl&&(a.tokenUrl.startsWith("http://")||a.tokenUrl.startsWith("https://"))?a.tokenUrl:void 0),P={...a,...c,tokenUrl:m??c?.tokenUrl??a?.tokenUrl,idpTokenUrl:C,jwksUri:a?.jwksUri,issuer:a?.issuer};P._handlerTokenUrl=m;let E,O=P,k=Ie(P),T=Ke(P),l=_n(P);if(!k&&!T&&!l){if(!a||Object.keys(a).length===0)return;throw t.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(P),clientId:O.clientId,clientSecret:O.clientSecret?"[REDACTED]":void 0,workloadId:O.workloadId,privateKey:O.privateKey?"[REDACTED]":void 0,jwksUri:O.jwksUri,tokenUrl:O.tokenUrl,idpTokenUrl:O.idpTokenUrl,fromVaultKeys:a?Object.keys(a):[],fromCodeKeys:n?Object.keys(n):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(k)E={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:Ue(P.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:Ue(P.privateKey,"Missing 'privateKey' from Workload Config"),audience:Ue(P.audience,"Missing 'audience' from Workload Config"),scope:P.scope??"",algorithm:P.algorithm??"RS256",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new it};else if(Ke(P))E={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:Ue(P.clientId,"Missing 'clientId' from Workload Config"),clientSecret:Ue(P.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:P.scope??"",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new it};else if(_n(P))E=P;function b(){let p=new Uint8Array(16);return crypto.getRandomValues(p),Array.from(p,(f)=>f.toString(16).padStart(2,"0")).join("")}function W(p){let f;if(typeof p==="string")f=btoa(p);else f=btoa(String.fromCharCode(...p));return f.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function F(p){let f=p.replace(/-/g,"+").replace(/_/g,"/");while(f.length%4)f+="=";return atob(f)}function Q(p){if(p.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:p==="RS256"?"SHA-256":p==="RS384"?"SHA-384":"SHA-512"};else if(p.startsWith("ION"))return{name:"ECDSA",namedCurve:p==="ES256"?"P-256":p==="ES384"?"P-384":"P-521",hash:p==="ES256"?"SHA-256":p==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${p}`)}async function ce(p,f){let S=p.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),A=Uint8Array.from(atob(S),(Y)=>Y.charCodeAt(0)),N=Q(f);return crypto.subtle.importKey("pkcs8",A,N,!1,["sign"])}async function se(p,f,S){let A=await ce(f,S),Y=new TextEncoder().encode(p),K=Q(S),oe=await crypto.subtle.sign(K,A,Y);return W(new Uint8Array(oe))}async function Z(p,f=3,S=1000,A=30000){let N=Error("Placeholder Error");for(let Y=0;Y<=f;Y++)try{return await p()}catch(K){if(N=K instanceof Error?K:Error(String(K)),N.message.includes("400")||N.message.includes("401")||N.message.includes("403")||N.message.includes("404"))throw N;if(Y<f){let oe=Math.min(S*2**Y,A),te=Math.random()*oe*0.1;await new Promise((we)=>setTimeout(we,oe+te))}}throw N}async function ee(p){if(!Ie(E))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=E,S=Math.floor(Date.now()/1000),A={iss:f.workloadId,sub:f.workloadId,aud:f.audience??"",exp:S+f.tokenLifetime,iat:S,jti:b(),scope:p??f.scope},N={alg:f.algorithm,typ:"JWT",kid:f.keyId},Y=W(JSON.stringify(N)),K=W(JSON.stringify(A)),oe=`${Y}.${K}`,te=await se(oe,f.privateKey,f.algorithm);return`${oe}.${te}`}async function ue(p){if(!Ie(E))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=E;return Z(async()=>{let S=f.idpTokenUrl,A=await ee(p),N=new URLSearchParams;if(N.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),N.append("assertion",A),p)N.append("scope",p);let Y=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:N.toString()}),K=await Y.json();if(!Y.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:K});let te=K;throw Error(`Token acquisition failed: ${te.error||Y.statusText} - ${te.error_description||""}`.trim())}let oe=await i(s.tokenResponse,K);if(oe.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:oe.issues}),Error(`Token response validation failed: ${oe.issues.map((te)=>te.message).join("; ")}`);if(f.tokenStore){let te=new Date(Date.now()+(oe.value.expires_in??300)*1000),we={workload_id:Wn(f.workloadId,p),access_token:oe.value.access_token,token_type:oe.value.token_type,scope:oe.value.scope,expires_at:te,created_at:new Date,refresh_token:oe.value.refresh_token};await f.tokenStore.set(we)}return oe.value})}async function z(p){if(!Ke(E))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let f=E;return Z(async()=>{let S=f.idpTokenUrl,A=new URLSearchParams;if(A.append("grant_type","client_credentials"),A.append("client_id",f.clientId),A.append("client_secret",f.clientSecret),p)A.append("scope",p);let N=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:A.toString()}),Y=await N.json();if(!N.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:Y});let oe=Y;throw Error(`Token acquisition failed: ${oe.error||N.statusText} - ${oe.error_description||""}`.trim())}let K=await i(s.tokenResponse,Y);if(K.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:K.issues}),Error(`Token response validation failed: ${K.issues.map((oe)=>oe.message).join("; ")}`);if(f.tokenStore){let oe=new Date(Date.now()+(K.value.expires_in??300)*1000),te={workload_id:Wn(f.clientId,p),access_token:K.value.access_token,token_type:K.value.token_type,scope:K.value.scope,expires_at:oe,created_at:new Date,refresh_token:K.value.refresh_token};await f.tokenStore.set(te)}return K.value})}let J=new Map;function B(p,f){let S=J.get(p);if(S)return S;let A=(async()=>(Ie(E)?await ue(f??""):await z(f??"")).access_token)();return J.set(p,A),A.catch(()=>{return}).finally(()=>{if(J.get(p)===A)J.delete(p)}),A}async function ae(p){if(!Ie(E)&&!Ke(E)){let N=E;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!N.clientId}, hasClientSecret=${!!N.clientSecret}, hasWorkloadId=${!!N.workloadId}, hasPrivateKey=${!!N.privateKey}, hasJwksUri=${!!N.jwksUri}`)}let f=E;p=p??f.scope;let S=Ie(E)?E.workloadId:E.clientId,A=Wn(S,p);if(f.tokenStore){let N=await f.tokenStore.get(A);if(N){let Y=Date.now(),K=N.expires_at.getTime(),oe=f.refreshThreshold*1000;if(Y+oe<K)return N.access_token;if(f.autoRefresh)try{return await B(A,p)}catch(te){if(Y<K)return t.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},te),N.access_token;throw te}}}return B(A,p)}async function re(p){if(!Ie(E)&&!Ke(E))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=E;return p=p??f.scope,Ie(f)?await ue(p):await z(p)}async function ne(p){if(!Ie(E)&&!Ke(E))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");try{if(!E.revocationEndpoint)return;let f=new URLSearchParams;if(f.append("token",p),f.append("token_type_hint","access_token"),Ie(E)){let A=E;f.append("client_id",A.workloadId)}else if(Ke(E)){let A=E;f.append("client_id",A.clientId),f.append("client_secret",A.clientSecret)}let S=await fetch(E.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:f.toString()});if(!S.ok)t.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:S.status,statusText:S.statusText});else t.info("Token revoked successfully",{"ion.module":"workload"});if(E.tokenStore){let A;if(Ie(E))A=E.workloadId;else if(Ke(E))A=E.clientId;else return;await E.tokenStore.delete(A)}}catch(f){t.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},f)}}async function R(p,f){let S=p??E?.jwksUri;if(!S)throw Error("No JWKS URI configured in Workload Config");return await td(S,t,f)}async function M(p,f){let S=f??E?.jwksUri;if(!S)throw Error("No JWKS URI configured in Workload Config");let A=Ie(E)?E.algorithm:"RS256";return ed(S,p,`wl:${A}`,(N)=>{let Y=N.alg||A,K=Q(Y);return crypto.subtle.importKey("jwk",N,K,!1,["verify"])},t)}function G(p){let f=p.split(".");if(f.length!==3)throw Error("Invalid JWT");return JSON.parse(F(f[1]))}async function H(p,f){try{let S=p.split(".");if(S.length!==3)throw Error("Invalid JWT");let A=JSON.parse(F(S[0])),N=JSON.parse(F(S[1])),Y=await M(A.kid,f),K=S[2],te=new TextEncoder().encode(`${S[0]}.${S[1]}`),we=Uint8Array.from(F(K),(jt)=>jt.charCodeAt(0)),le=Q(A.alg);if(!await crypto.subtle.verify(le,Y,we,te))throw Error("Invalid JWT signature");let Ve=await i(s.jwtAssertionClaims,N);if(Ve.issues)throw t.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:Ve.issues}),Error(`JWT claims validation failed: ${Ve.issues.map((jt)=>jt.message).join("; ")}`);return Ve.value}catch(S){throw t.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},S),S}}async function v(p){if(!Ie(E)&&!Ke(E)&&!_n(E))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(d.length>0){let A=G(p),N=typeof A.iss==="string"?A.iss:void 0,Y=Ds(d,N);if(!Y)return{valid:!1,error:"Untrusted token issuer"};let K=await H(p,Y.jwksUri),oe=Math.floor(Date.now()/1000);if(K.exp&&K.exp<oe)return{valid:!1,error:"Token expired"};let te=jn(Y.audience);if(te.length>0&&!Ur(K.aud,te,K.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:K,expiresAt:K.exp?new Date(K.exp*1000):void 0}}let f=await H(p),S=Math.floor(Date.now()/1000);if(f.exp&&f.exp<S)return{valid:!1,error:"Token expired"};if(Ie(E)){if(E.audience&&!Ur(f.aud,[E.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else if(Ke(E)){if(E.issuer&&_t(f.iss)!==_t(E.issuer))return{valid:!1,error:"Invalid issuer"};if(E.audience&&!Ur(f.aud,[E.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else{let A=E;if(A.issuer&&_t(f.iss)!==_t(A.issuer))return{valid:!1,error:"Invalid issuer"};if(A.audience&&!Ur(f.aud,[A.audience],f.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:f,expiresAt:f.exp?new Date(f.exp*1000):void 0}}catch(f){return{valid:!1,error:f instanceof Error?f.message:String(f)}}}function U(p,f){let S=p[f];return typeof S==="string"&&S.trim()?S.trim():void 0}function I(p){if(!p)return;return p.startsWith("service-account-")?p.slice(16):p}function x(p){return U(p,"client_id")??U(p,"clientId")??U(p,"azp")??U(p,"appid")??I(U(p,"preferred_username"))}let q=new WeakMap;function w(p){let f=q.get(p);if(f)return f;let S=_(p);return q.set(p,S),S}async function _(p){let f=p.headers.get("Authorization");if(!f?.startsWith("Bearer "))return;let S=f.substring(7),A=await v(S);if(!A.valid||!A.claims)return;let N=d.length>0?Ds(d,A.claims.iss):void 0,Y=A.claims.ecid,K={workloadId:A.claims.sub,clientId:x(A.claims),scope:A.claims.scope,scopesAsEntitlements:N?.scopesAsEntitlements,...Y!==void 0&&Y!==null?{ecid:Ks(Y)}:{},claims:A.claims},oe=E?.workloadIdentityStore;if(oe){let te=K.clientId??K.workloadId??K.claims.sub,we=te?await oe.get(te):void 0;if(we){if(we.active===!1)return;if(we.scopes?.length){let le=new Set([...(K.scope??"").split(/\s+/).filter(Boolean),...we.scopes]);K.scope=Array.from(le).join(" ")}if(!K.ecid&&we.ecid)K.ecid=Ks(we.ecid)}}return K}async function h(p){if(!E)throw Error("ionite Workload Manager not initialized");let f=new URL(p.url).pathname,S=(Y)=>{if(!Y)return;try{return new URL(Y).pathname}catch{return Y.startsWith("/")?Y:`/${Y}`}};if(S(E.validateUrl)===f&&p.method==="POST"){let Y=p.headers.get("Authorization");if(!Y?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let K=Y.substring(7),oe=await v(K);if(!oe.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:oe.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(S(E.jwksUrl)===f&&p.method==="GET"){let Y=await R();return new Response(JSON.stringify(Y),{headers:[["Content-Type","application/json"]]})}return me()}return{...E,...Lt("workload",()=>!0),getToken:ae,refreshToken:re,generateJWTAssertion:ee,revokeToken:ne,validateToken:v,getWorkloadIdentity:w,parseJWT:H,handler:h}}function qn(e){return e=e??"Workload authentication unavailable",new Response(JSON.stringify({error:e}),{status:503,statusText:e,headers:{"Content-Type":"application/json"}})}var xr="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",cd="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function ud(e,t){Ue(t,xr);let r=t.workload;if(!r)return;return r.getWorkloadIdentity(e)}async function dd(e,t,r){Ue(t,xr);let n=t.workload;if(!n)throw qn();let o=n;if(typeof o.getServerToken!=="function"||typeof o.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return o.getToken(e,r)}async function Nn(e,t){Ue(t,cd);let r="validateToken"in t&&typeof t.validateToken==="function"?t:t.workload;if(!r)return{valid:!1,error:"Workload authentication unavailable"};let n=e.headers.get("Authorization");if(!n?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let o=n.substring(7);return r.validateToken(o)}async function ld(e,t){Ue(t,xr);let r=t.workload;if(!r)throw qn();return r.revokeToken(e)}async function fd(e,t){Ue(t,xr);let r=t.workload;if(!r)throw qn();return r.handler(e)}function Xs(e){try{return Wr(new URL(e,"http://dummy").pathname)}catch{let t=e.startsWith("/")?e:`/${e}`;return Wr(t)}}function yd(e,t){let r=new URL(e.url);return new URL(`/${encodeURIComponent(t)}/`,r.origin).toString()}function wd(e,t){let r=Xs(t),n=Wr(e);if(n===r)return null;if(!n.startsWith(`${r}/`))return null;let o=n.slice(r.length+1);if(!o||o.includes("/"))return null;return decodeURIComponent(o)}function Mr(e){return e==="pending"||e==="processing"||e==="completed"||e==="failed"||e==="action_required"}function hd(e){if(!Mr(e.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if(e.status==="completed"){if(!e.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:e.tenantUrl,status:"completed"},status:201}}if(e.status==="pending"||e.status==="processing")return{body:{tenantUrl:e.tenantUrl,status:e.status},status:202};if(e.status==="action_required"){if(!e.actionUrl||!e.requestToken||!e.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:e.actionUrl,requestToken:e.requestToken,expiresAt:e.expiresAt},status:200}}return{body:{tenantUrl:e.tenantUrl,status:"failed",error:e.error??"Tenant provisioning failed"},status:409}}function vd(e,t){let r=t.validators.tenant.createTenantRequest,n=t.validators.tenant.updateTenantRequest;function o(a,d){let g=(m)=>new URL(m,d).toString();return{readyzUrl:g(a.readyzUrl),capabilitiezUrl:g(a.capabilitiezUrl),sso:{loginUrl:g(a.sso.loginUrl),userUrl:g(a.sso.userUrl),logoutUrl:g(a.sso.logoutUrl),logoutBackChannelUrl:g(a.sso.logoutBackChannelUrl),refreshUrl:g(a.sso.refreshUrl),callbackUrl:g(a.sso.callbackUrl)},workload:{validateUrl:g(a.workload.validateUrl),jwksUrl:g(a.workload.jwksUrl)},iam:{basePath:g(a.iam.basePath),usersUrl:g(a.iam.usersUrl),groupsUrl:g(a.iam.groupsUrl),workloadsUrl:g(a.iam.workloadsUrl),customersUrl:g(a.iam.customersUrl)},ciam:{magicLinkUrl:g(a.ciam.magicLinkUrl),magicLinkLoginUrl:g(a.ciam.magicLinkLoginUrl),customerUrl:g(a.ciam.customerUrl),customerLoginUrl:g(a.ciam.customerLoginUrl),customerCallbackUrl:g(a.ciam.customerCallbackUrl),customerProvidersUrl:g(a.ciam.customerProvidersUrl),logoutUrl:g(a.ciam.logoutUrl)}}}function s(a,d){let g=t.tenantIonBasePath?.(a);if(!g)return;let m=new URL(d.url).origin,C=o(Fe(g),m);return{callbackUrl:C.sso.callbackUrl,ionUrls:C}}async function i(a){let d=await Nn(a,t.workloadAuth??e);if(!d.valid)return Response.json({error:d.error??"Unauthorized"},{status:401});return pt(a,e,md["tenant.manage"])}async function c(a){let g=new URL(a.url).pathname,m=wd(g,t.basePath),C=Xs(t.basePath),P=Wr(g)===C;if(!P&&!m)return me();if(!["GET","PUT","POST","DELETE"].includes(a.method))return It(["GET","PUT","POST","DELETE"]);if(a.method==="GET"&&P&&m==null)return me();let E=await i(a);if(E)return E;if(a.method==="GET"){if(m==null)return me();let Z=await t.store.get(m);if(!Z)return me();let ee=s(Z,a);return Response.json(ee?{...Z,...ee}:Z,{status:200})}if(a.method==="DELETE"){if(!m)return me();let Z=await t.store.get(m);if(Z)await t.mirror?.purge(Z.id);return await t.store.delete(m),new Response(null,{status:204})}if(!m&&a.method!=="POST")return me();let O;try{O=await a.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let k=a.method==="POST",T=k?await r.validate(O):await n.validate(O);if(T.issues)return gd(T.issues,k?"Tenant create validation failed":"Tenant update validation failed");let l=k?T.value.id:m;if(!l)return me();if(m!=null&&T.value.id!=null&&T.value.id!==m)return Response.json({error:"Path id must match body id"},{status:400});let b=await t.store.get(l);if(b&&!Mr(b.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let W=new Date,F=b??{},Q;if(k){let Z=T.value,ee=Z,ue=ee.status,z=Mr(ue)?ue:b?.status??"completed";Q={...F,...Z,id:l,companyId:Z.companyId,companyName:Z.companyName,environmentType:Z.environmentType,configLocator:Z.configLocator,email:Z.email??b?.email,webhookUrl:Z.webhookUrl??b?.webhookUrl,callbackUrl:Z.callbackUrl??b?.callbackUrl,tenantUrl:ee.tenantUrl??b?.tenantUrl,status:z,error:ee.error??b?.error,actionUrl:ee.actionUrl??b?.actionUrl,requestToken:ee.requestToken??b?.requestToken,expiresAt:ee.expiresAt??b?.expiresAt,createdAt:b?.createdAt??W,updatedAt:W}}else{let Z=T.value,ee=Z,ue=ee.status,z=Mr(ue)?ue:b?.status??"completed",{configLocator:J,...B}=Z;Q={...F,...B,id:l,companyId:Z.companyId??b?.companyId??"",companyName:Z.companyName??b?.companyName??"",environmentType:Z.environmentType??b?.environmentType??"DEV",email:Z.email??b?.email,webhookUrl:Z.webhookUrl??b?.webhookUrl,callbackUrl:Z.callbackUrl??b?.callbackUrl,tenantUrl:ee.tenantUrl??b?.tenantUrl,status:z,error:ee.error??b?.error,actionUrl:ee.actionUrl??b?.actionUrl,requestToken:ee.requestToken??b?.requestToken,expiresAt:ee.expiresAt??b?.expiresAt,configLocator:J??b?.configLocator,createdAt:b?.createdAt??W,updatedAt:W}}if(!Q.tenantUrl)Q.tenantUrl=yd(a,l);if(!Q.callbackUrl){let Z=s(Q,a);if(Z)Q.callbackUrl=Z.callbackUrl}if(b?.configLocator&&!pd(b.configLocator,Q.configLocator))await t.mirror?.purge(b.id);let ce=await t.store.upsert(Q),se=hd(ce);if(se instanceof Response)return se;return Response.json(se.body,{status:se.status})}async function u(a){try{if(!e.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await c(a)}catch(d){return Pt(d)}}return{handler:u,getTenant:async(a)=>t.store.get(a)}}var Kn="0.0.24-beta.20260917.4";export*from"@ionite/core";import{AssignmentPolicyError as Fg,generateULID as Dg,IoniteError as zg,listGenerator as Bg}from"@ionite/core";import{allowHosts as Jg,allowOrigins as Hg,allowRelativePaths as Yg,allowSameOrigin as Xg,blockDangerousUrls as Zg,CatalogAdjacencyCache as Qg,callback as ey,captureRedirect as ty,ciam as ry,collectReferencedDefinitions as ny,defaultRedirectPolicies as oy,discoverSessionRecords as sy,discoverSessions as iy,expandRoot as ay,getCustomer as cy,getUser as uy,has as dy,hasAll as ly,hasAllScope as fy,hasAny as py,hasAnyScope as my,hasGroup as gy,hasPermission as yy,hasRole as wy,hasScope as hy,InMemoryTenantStore as vy,iam as Sy,initiateLogin as ky,isRedirectAllowed as by,listSsoClientIdsFromCookies as Ry,reconcileSubjectAccess as Cy,resolveAfterRedirect as Ty,resolveCapturedRedirect as Py,resolveRedirect as Iy,sameOriginRedirectRules as Oy,sendTenantWebhook as Ey,sso as Ay,verifyUser as _y,withSetCookies as Ly}from"@ionite/core/server";import{accessRefId as ot,accessRootId as Zs,assertRequiredSubjectType as Qs,list as Sd}from"@ionite/core";function Fn(e){let{createdAt:t,updatedAt:r,...n}=e;return n}class He{constructor(){this.roots=new Map;this.byTarget=new Map;this.bySubject=new Map}static targetKey(e,t){return`${e}:${t}`}static subjectKey(e,t){return`${e}:${t}`}indexAdd(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}indexRemove(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}deindex(e){this.indexRemove(this.byTarget,He.targetKey(e.targetType,ot(e.target)),e.id),this.indexRemove(this.bySubject,He.subjectKey(e.subjectType,ot(e.subject)),e.id)}index(e){this.indexAdd(this.byTarget,He.targetKey(e.targetType,ot(e.target)),e.id),this.indexAdd(this.bySubject,He.subjectKey(e.subjectType,ot(e.subject)),e.id)}resolve(e,t){if(!e)return[];let r=[];for(let n of e){let o=this.roots.get(n);if(o&&(o.status??"active")==="active"&&t(o))r.push(o)}return r}async grant(e){Qs(e.subjectType,"Access change subjectType");let t=e.id??Zs(e),r=new Date,n=this.roots.get(t);if(n)this.deindex(n);let o={...e,id:t,status:e.status??"active",createdAt:n?.createdAt??r,updatedAt:r};this.roots.set(t,o),this.index(o)}async revoke(e){let t=e.id??Zs(e),r=this.roots.get(t);if(r)this.deindex(r);this.roots.delete(t)}async get(e){let t=this.roots.get(e);return t?Fn(t):void 0}async list(e){let t=Array.from(this.roots.values()).filter((r)=>(r.status??"active")==="active");return Vn(t,e)}async listByTarget(e,t,r){let n=t.trim(),o=this.byTarget.get(He.targetKey(e,n)),s=this.resolve(o,(i)=>i.targetType===e&&ot(i.target)===n);return Vn(s,r)}async listByTargets(e){let t=new Map;for(let{targetType:r,target:n}of e){let o=`${r}:${n}`;if(t.has(o))continue;let s=n.trim(),i=this.byTarget.get(He.targetKey(r,s)),c=this.resolve(i,(u)=>u.targetType===r&&ot(u.target)===s);t.set(o,c.map((u)=>Fn(u)))}return t}async listBySubject(e,t,r){Qs(t);let n=ot(e),o=this.bySubject.get(He.subjectKey(t,n)),s=this.resolve(o,(i)=>i.subjectType===t&&ot(i.subject)===n);return Vn(s,r)}}function Vn(e,t){let r=Math.max(0,t?.start??0),n=t?.limit,o=n!=null?r+n:void 0;return Sd(e.length,e.slice(r,o).map(Fn),r,n)}import{assertValidSubjectTypeScoping as ei,deepEqualPlain as kd,list as ti,readyCatalogEntry as Dn}from"@ionite/core";class ri{constructor(){this.listeners=new Set;this.emit=(e)=>{for(let t of this.listeners)t(e)};this.groups=new jr("group",this.emit);this.roles=new jr("role",this.emit);this.permissions=new jr("permission",this.emit)}afterChange(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}}class ni{constructor(){this.items=new Map;this.listeners=new Set}async get(e){return this.items.get(e)}async list(e){let t=Array.from(this.items.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=n!=null?r+n:void 0;return ti(t.length,t.slice(r,o),r,n)}async children(e){return Array.from(this.items.values()).filter((t)=>(typeof t.parent==="string"?t.parent:t.parent?.id)===e)}changed(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}set(e){this.items.set(e.id,e),this.emitChange({id:e.id})}delete(e){if(!this.items.delete(e))return;this.emitChange({id:e,deleted:!0})}emitChange(e){for(let t of this.listeners)t(e)}}class jr{constructor(e,t){this.kind=e;this.emit=t;this.items=new Map}async get(e){return this.items.get(e)}set(e){ei(e);let t=this.items.get(e.id),r=!t||!kd(t,e);if(this.items.set(e.id,e),r)this.emit({op:"set",kind:this.kind,entity:e,previous:t});return Dn(e,Promise.resolve())}insertIfAbsent(e){ei(e);let t=this.items.get(e.id);if(t)return Dn(t,Promise.resolve());return this.items.set(e.id,e),this.emit({op:"set",kind:this.kind,entity:e,previous:void 0}),Dn(e,Promise.resolve())}async delete(e){let t=this.items.get(e);if(!t)return;this.items.delete(e),this.emit({op:"delete",kind:this.kind,entity:t})}async list(e){let t=Array.from(this.items.values()),r=e?.filter?.requestable;if(r!==void 0)t=t.filter((i)=>Boolean(i.requestable)===r);let n=Math.max(0,e?.start??0),o=e?.limit,s=o!=null?n+o:void 0;return ti(t.length,t.slice(n,s),n,o)}}import{accessRefId as Ye,assertRequiredSubjectType as Ut}from"@ionite/core";function Xe(e,t){return`${t}:${e}`}function zn(e,t,r){return`${e}:${t}:${r}`}function bd(e,t,r,n){return`${zn(e,t,r)}:${n??""}`}class oi{constructor(){this.rows=new Map;this.byTriple=new Map;this.byRoot=new Map;this.bySubject=new Map;this.edgeMeta=new Map;this.disabledSubjects=new Set}async has(e,t,r,n,o){Ut(o);let s=Ye(e),i=Ye(r);if(!s||!i)return{allow:!1};if(this.disabledSubjects.has(Xe(s,o)))return{allow:!1,metadata:{reason:"subject_disabled"}};let c=zn(Xe(s,o),t,i),u=n?Ye(n):void 0;if(u===void 0){let g=this.byTriple.get(c);if(g&&g.size>0)return this.allow(s,o,t,i,void 0);return{allow:!1}}let a=`${c}:${u}`,d=`${c}:`;if(this.rows.has(a))return this.allow(s,o,t,i,u);if(this.rows.has(d))return this.allow(s,o,t,i,void 0);return{allow:!1}}async hasGroup(e,t,r,n){return this.has(e,"group",t,r,n)}async hasRole(e,t,r,n){return this.has(e,"role",t,r,n)}async hasPermission(e,t,r,n){return this.has(e,"permission",t,r,n)}async hasAny(e,t,r){for(let n of t){let o=await this.has(e,n.targetType,n.target,n.resource,r);if(o.allow)return o}return{allow:!1}}async hasAll(e,t,r){if(this.disabledSubjects.has(Xe(Ye(e),r)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(t.length===0)return{allow:!0};let n=[];for(let o of t){let s=await this.has(e,o.targetType,o.target,o.resource,r);if(!s.allow)return{allow:!1,matched:n};if(s.matched)n.push(...s.matched)}return{allow:!0,matched:n}}async materialize(e,t){this.removeRoot(e),this.addRootEdges(e,t)}async replaceSubject(e,t,r){let n=Xe(Ye(e),t),o=new Map;for(let s of r){Ut(s.subjectType,"Effective edge subjectType");let i=Xe(Ye(s.subject),s.subjectType);if(i!==n)throw Error(`AccessIndex.replaceSubject received an edge for ${i}; expected ${n}.`);let c=o.get(s.rootId);if(c)c.push(s);else o.set(s.rootId,[s])}this.clearSubjectEdges(n);for(let[s,i]of o)this.addRootEdges(s,i)}addRootEdges(e,t){let r=new Set;for(let n of t){Ut(n.subjectType,"Effective edge subjectType");let o=Xe(n.subject,n.subjectType),s=zn(o,n.targetType,n.target),i=bd(o,n.targetType,n.target,n.resource);this.addToSet(this.rows,i,e),this.addToSet(this.byTriple,s,i),this.addToSet(this.bySubject,o,i),this.edgeMeta.set(i,{triple:s,subjectId:o}),r.add(i)}if(r.size>0)this.byRoot.set(e,r)}async removeByRoot(e){this.removeRoot(e)}removeRoot(e){let t=this.byRoot.get(e);if(!t)return;for(let r of t){let n=this.rows.get(r);if(!n)continue;if(n.delete(e),n.size===0)this.dropEdge(r)}this.byRoot.delete(e)}async listSubjects(){let e=[];for(let[t,r]of this.bySubject){if(r.size===0)continue;let n=t.indexOf(":");if(n<=0)throw Error(`AccessIndex subject key "${t}" is missing a subjectType prefix.`);let o=t.slice(0,n);Ut(o,"AccessIndex subject key subjectType"),e.push({subjectType:o,subject:t.slice(n+1)})}return e}async setSubjectDisabled(e,t,r){let n=Xe(Ye(e),t);if(r)this.disabledSubjects.add(n);else this.disabledSubjects.delete(n)}async isSubjectDisabled(e,t){return Ut(t),this.disabledSubjects.has(Xe(Ye(e),t))}async clear(e,t){if(e===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}Ut(t);let r=Ye(e);this.clearSubjectEdges(Xe(r,t))}clearSubjectEdges(e){let t=this.bySubject.get(e);if(!t)return;for(let r of[...t]){let n=this.rows.get(r);if(n)for(let o of n){let s=this.byRoot.get(o);if(s?.delete(r)&&s.size===0)this.byRoot.delete(o)}this.dropEdge(r)}}allow(e,t,r,n,o){return{allow:!0,matched:[{subject:e,subjectType:t,targetType:r,target:n,resources:o?[o]:void 0}]}}addToSet(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}dropEdge(e){this.rows.delete(e);let t=this.edgeMeta.get(e);if(t)this.removeFromSet(this.byTriple,t.triple,e),this.removeFromSet(this.bySubject,t.subjectId,e);this.edgeMeta.delete(e)}removeFromSet(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}}function Bn(e){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function Rd(e,t){return{...e,subscribe:async(r,n,o)=>{try{return await e.subscribe(r,n,o)}catch(s){if(!(s instanceof Le))throw s;return await Ge(e,r,n,t,void 0,o)}}}}function $r(e){let t=ft(e.path,"path","azureConfig");gt(e.ttl);let r=e.vault??_r({type:"azure",authMethod:e.authMethod,entraTenantId:e.entraTenantId,clientId:e.clientId,clientSecret:e.clientSecret,federatedTokenFile:e.federatedTokenFile,managedIdentityClientId:e.managedIdentityClientId,imdsApiVersion:e.imdsApiVersion,vaultUrl:e.vaultUrl,vaultName:e.vaultName,apiVersion:e.apiVersion,secretNameTransform:e.secretNameTransform,secretNamePrefix:e.secretNamePrefix,scope:e.scope,ttl:e.ttl}),n=e.ttl?Rd(r,e.ttl):r;return{load:async()=>{try{return(await n.getFullSecret(t)).data}catch(o){let s=o instanceof Error?o.message:String(o);throw Error(`Error retrieving remote config from Azure Key Vault: ${s}`,{cause:o})}},subscribe:(o,s)=>n.subscribe(t,(i)=>{o(i.data)},s),secret:n}}import{IoniteError as Nd}from"@ionite/core";function Gn(e){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as Od,remoteConfigSecretType as Ed}from"@ionite/core";import{defaultLogger as Cd,defaultSecretContentType as Td,stableConfigHash as si}from"@ionite/core";var Pd=1e4;function Id(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Jn(e){if(e.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let t=Array.from(new Set(e.paths.map((O)=>O.trim()).filter(Boolean)));if(t.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let r=e.logger??Cd,n=[],o=Promise.resolve(),s=!1,i=!1,c=!1,u=ye("Secrets mirror",()=>s&&!c),a=(O)=>{let k=e.mapPath(O).trim();if(!k)throw Error(`mirrorSecrets mapPath returned an empty target for "${O}"`);return k},d=(O)=>{let k=o.then(O);return o=k.catch((T)=>{i=!0,r.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:T instanceof Error?T.message:String(T)})}),k},g=async(O)=>{if(await e.to.exists(O))await e.to.deleteSecret(O)},m=async(O,k)=>{if(c)return;if(!Id(k.data))throw Error(`mirrorSecrets can only re-store object values (source path "${O}")`);if(e.accept&&!e.accept(k,O))return;let T=a(O);if(await e.to.exists(T)){let l=await e.to.getSecret(T);if(si(l)===si(k.data)){i=!1;return}}await e.to.putSecret(T,k.data,{contentType:k.metadata.contentType??Td()}),i=!1},C=async(O)=>{await g(a(O)),i=!1},P=(O)=>{if(O.event!=="path_removed")return t.includes(O.path)?[O.path]:[];let k=`${O.path.replace(/\/+$/g,"")}/`;return t.filter((T)=>T===O.path||T.startsWith(k))},E=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if(e.from.subscribeEvents)n.push(e.from.subscribeEvents((O)=>{if(E.has(O.event)){let k=P(O);if(k.length>0)d(async()=>{for(let T of k)await C(T)})}try{e.onEvent?.(O)}catch(k){r.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:O.path,event:O.event,error:k instanceof Error?k.message:String(k)})}}));return(async()=>{let O=new Set(t);for(;;){try{for(let k of[...O]){let T=await e.from.subscribe(k,(l)=>{d(()=>m(k,l))},e.subscription);if(c){T();return}n.push(T),O.delete(k)}if(await o,c)return;s=!0,u.refresh();return}catch(k){if(c)return;i=!0,r.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:k instanceof Error?k.message:String(k)})}if(await new Promise((k)=>{setTimeout(k,Pd).unref?.()}),c)return}})(),{isReady:u.isReady,ready:u.ready,isAvailable:()=>s&&!c&&!i&&(e.from.isAvailable?.()??!0)&&(e.to.isAvailable?.()??!0),async purge(){if(c)throw Error("Secrets mirror is closed");await d(async()=>{for(let O of t)await C(O)})},async close(){if(c)return;c=!0;for(let O of n.splice(0))O();u.refresh(),u.settle(),await o}}}function xt(e){return typeof e.getFullSecret==="function"}function Hn(e){let t=e;return typeof t.handleDelivery==="function"&&typeof t.handleEvents==="function"&&typeof t.isDeliveryRequest==="function"&&typeof t.isEventsRequest==="function"}function ii(e){return e.type==="vault"&&[e.vaultLfvServerUrl,e.vaultLfvClientId,e.vaultLfvDeliveryEndpoint,e.vaultLfvVerifyJwks,e.vaultLfvEventsEndpoint].some((t)=>t!==void 0)}function Oe(e,t){if(!e?.trim())throw Error(`Mirrored LFV config requires ${t}`);return e}function Ad(e,t){if(t?.trim())return t;if(xt(e))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if(e.type==="vault")return Oe(e.vaultLfvPath??e.vaultPath,"an upstream vault path");if(e.type==="azure")return Oe(e.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${e.type}" requires an explicit fromPath`)}function _d(e,t){let r=Oe(e.vaultLfvPath??e.vaultPath,"vaultLfvPath or vaultPath");return lt({lfvServerUrl:Oe(e.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Oe(e.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Oe(e.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:Oe(e.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:Oe(e.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:r,deliveryTimeout:e.vaultLfvDeliveryTimeout,retryInterval:e.vaultLfvRetryInterval,warnInterval:e.vaultLfvWarnInterval,log:t},void 0,{selfRedeemReads:!0})}function Ld(e){return e.metadata.contentType?.typeId===Ed.id&&typeof e.data.id==="string"&&e.data.id.trim().length>0}function Ud(e,t,r,n){return{...e,close:r,subscribePassive:(o,s)=>t.subscribePassive(o,s),isDeliveryRequest:(o)=>t.isDeliveryRequest(o),isEventsRequest:(o)=>t.isEventsRequest(o),handleDelivery:(o)=>(n(),t.handleDelivery(o)),handleEvents:(o)=>(n(),t.handleEvents(o)),deliveryPath:t.deliveryPath,eventsPath:t.eventsPath,callbackKey:t.callbackKey,trustId:t.trustId}}function tr(e){let t=e.logger??Od,r=Ad(e.from,e.fromPath),n=!xt(e.from),o=!xt(e.to),s=xt(e.from)?e.from:ii(e.from)?_d(e.from,t):Ze(e.from).secret,i=xt(e.to)?e.to:Ze(e.to).secret,c=Oe(e.path,"path"),u=Yn(i,c,{ttl:e.ttl}),a,d=!1,g=!1,m,C=()=>{if(m)return;m=s.getFullSecret(r).then(()=>{return}).catch((l)=>{m=void 0,t.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:l instanceof Error?l.message:String(l)})})},P=(l)=>{if(d)throw Error("Mirrored ConfigSource is closed");if(!a){g=l;let b=!l&&Hn(s)?{...s,subscribe:(W,F)=>s.subscribePassive(W,F)}:s;a=Jn({from:b,to:i,paths:[r],mapPath:()=>c,accept:Ld,logger:t})}else if(l&&!g)C();return a},E={isReady:()=>a?.isReady()??!1,ready:(l)=>P(!0).ready(l),isAvailable:()=>a?.isAvailable()??!1,purge:()=>P(!1).purge(),close:async()=>{await a?.close()}},O=async()=>{if(d)return;if(d=!0,await a?.close(),n)await s.close?.();if(o)await i.close?.()},k=Hn(s)?Ud(i,s,O,()=>{P(!1)}):{...i,close:O},T={load:async()=>{try{let l=await u.load();return P(!1),l}catch(l){throw P(!0),l}},subscribe:(l,b)=>(P(!1),u.subscribe(l,b)),secret:k,mirror:E,async handleCallback(l,b){if(!Hn(s))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return P(!1),l==="delivery"?s.handleDelivery(b):s.handleEvents(b)}};if(Object.defineProperties(T,{log:{get:()=>u.log,set:(l)=>{u.log=l},enumerable:!0},validators:{get:()=>u.validators,set:(l)=>{u.validators=l},enumerable:!0}}),!xt(e.from)&&ii(e.from)){let l=e.from;T[Ct]={path:r,lfvServerUrl:Oe(l.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Oe(l.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Oe(l.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:Oe(l.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:Oe(l.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:l.vaultLfvDeliveryTimeout,retryInterval:l.vaultLfvRetryInterval,warnInterval:l.vaultLfvWarnInterval}}return T}class yt extends Error{constructor(e,t=`Waiting for vault config secret at ${e}`){super(t);this.path=e;this.code="not_found";this.sourceType="vault";this.status=404;this.name="VaultConfigWaitingForSecretError"}}function xd(e){return e instanceof yt}class rr extends Error{constructor(e,t){super(t);this.path=e;this.code="invalid_payload";this.sourceType="vault";this.name="VaultConfigInvalidPayloadError"}}function Md(e){return e instanceof rr}var ui=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function ai(e){return ui.some((t)=>(t in e))}function ci(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw new yt(t,`Vault config secret at ${t} is missing or not an object`);let r=e;if(!ai(r)&&Object.keys(r).length===1&&"data"in r){let n=r.data;if(n&&typeof n==="object"&&!Array.isArray(n))r=n}if(Object.keys(r).length===0)throw new yt(t,`Vault config secret at ${t} is empty`);if(!ai(r))throw new rr(t,`Vault config secret at ${t} is an invalid payload: not a RemoteConfig (no known keys: ${ui.join("/")})`);return r}function Wd(e,t,r){return{...e,subscribe:async(n,o,s)=>{try{return await e.subscribe(n,o,s)}catch(i){if(!(i instanceof Le))throw i;return await Ge(e,n,o,t,r(),s)}}}}function qr(e){let t=ft(e.path,"path","vaultConfig");gt(e.ttl);let r=e.vault??At({type:"vault",url:e.url,token:e.token,workload:e.workload,lfv:e.lfv,websocket:e.websocket,ttl:e.ttl,log:e.log}),n=e.vault&&e.ttl?Wd(r,e.ttl,()=>e.log):r,o={get log(){return e.log},set log(s){if(e.log=s,n&&"log"in n)n.log=s},load:async()=>{try{let s=await n.getFullSecret(t);return ci(s.data,t)}catch(s){if(s instanceof Be)throw new yt(t);if(s instanceof yt||s instanceof rr)throw s;throw Error("Error retrieving remote config from vault",{cause:s})}},subscribe:(s,i)=>n.subscribe(t,(c)=>{let u;try{u=ci(c.data,t)}catch(a){e.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:t,error:a instanceof Error?a.message:String(a)});return}s(u)},i),secret:n};if(e.lfv?.lfvServerUrl&&e.lfv.clientId&&e.lfv.deliveryEndpoint&&e.lfv.eventsEndpoint)o[Ct]={path:e.lfv.path??t,lfvServerUrl:e.lfv.lfvServerUrl,clientId:e.lfv.clientId,deliveryTimeout:e.lfv.deliveryTimeout,retryInterval:e.lfv.retryInterval,warnInterval:e.lfv.warnInterval,deliveryEndpoint:e.lfv.deliveryEndpoint,eventsEndpoint:e.lfv.eventsEndpoint,verifyJwks:e.lfv.verifyJwks};return o}function Nr(e){if(e==null)return;if(typeof e==="number")return Number.isFinite(e)?e:void 0;let t=e.trim();if(!t)return;let r=Number.parseInt(t,10);return Number.isFinite(r)?r:void 0}function jd(e,t){let r=e.vaultLfvServerUrl??t?.lfvServerUrl,n=e.vaultLfvClientId??t?.clientId,o=e.vaultLfvDeliveryEndpoint??t?.deliveryEndpoint,s=e.vaultLfvEventsEndpoint??t?.eventsEndpoint;if(!r||!n||!o||!s)return t;return{...t,lfvServerUrl:r,clientId:n,deliveryEndpoint:o,verifyJwks:e.vaultLfvVerifyJwks??t?.verifyJwks,eventsEndpoint:s,path:e.vaultLfvPath??t?.path,deliveryTimeout:Nr(e.vaultLfvDeliveryTimeout)??t?.deliveryTimeout,retryInterval:Nr(e.vaultLfvRetryInterval)??t?.retryInterval,warnInterval:Nr(e.vaultLfvWarnInterval)??t?.warnInterval}}function $d(e,t){let r=e.vaultWebsocketUrl??t?.url;if(!r)return t;return{...t,url:r,token:e.vaultWebsocketToken??t?.token,clientId:e.vaultWebsocketClientId??t?.clientId,header:e.vaultWebsocketHeader??t?.header}}function qd(e,t){let r=e.vaultWorkloadTokenUrl??t?.idpTokenUrl,n=e.vaultWorkloadClientId??t?.clientId,o=e.vaultWorkloadClientSecret??t?.clientSecret;if(!r||!n||!o)return t;return{...t,idpTokenUrl:r,clientId:n,clientSecret:o,scope:e.vaultWorkloadScope??t?.scope}}function di(e,t){return{...t,url:e.vaultUrl??t?.url,token:e.vaultToken??t?.token,path:e.vaultPath??t?.path,ttl:Nr(e.vaultTtl)??t?.ttl,workload:qd(e,t?.workload),lfv:jd(e,t?.lfv),websocket:$d(e,t?.websocket)}}function Ze(e){switch(e.type){case"vault":return Vd(e);case"azure":return Fd(e);case"aws":return Dd(e);case"gcp":return zd(e);case"mirror":return Kd(e);default:throw Error(`Unsupported config locator type: ${e.type}`)}}function Kd(e){if(e.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!e.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return tr({from:e.from,to:e.to,path:e.to.vaultPath,ttl:e.to.vaultTtl})}function Vd(e){return qr(di(e))}function Fd(e){return $r({authMethod:e.azureAuthMethod,entraTenantId:e.azureEntraTenantId,clientId:e.azureClientId,clientSecret:e.azureClientSecret,federatedTokenFile:e.azureFederatedTokenFile,managedIdentityClientId:e.azureManagedIdentityClientId,imdsApiVersion:e.azureImdsApiVersion,vaultUrl:e.azureVaultUrl,vaultName:e.azureVaultName,apiVersion:e.azureApiVersion,scope:e.azureScope,secretNamePrefix:e.azureSecretNamePrefix,path:e.azurePath,ttl:e.azureTtl})}function Dd(e){return Bn({webhookUrl:e.awsWebhookUrl,ttl:e.awsTtl})}function zd(e){return Gn({ttl:e.gcpTtl})}function Yn(e,t,r={}){switch(e.type){case"vault":return qr({vault:e,path:t,ttl:r.ttl});case"azure":return $r({vault:e,path:t,ttl:r.ttl});default:throw new Nd(`configFromSource is not supported for secrets source type "${e.type}" (path "${t}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function wt(e){if(!e)return;let t=Number.parseInt(e,10);return Number.isFinite(t)?t:void 0}function Kr(e,t){let r=t?.type??e.ION_CONFIG_TYPE;if(!r)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(r==="vault")return{type:"vault",vaultUrl:e.ION_VAULT_URL,vaultToken:e.ION_VAULT_TOKEN,vaultPath:e.ION_VAULT_PATH??"",vaultTtl:wt(e.ION_VAULT_TTL),vaultWorkloadTokenUrl:e.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:e.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:e.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:e.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:e.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:e.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:e.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:e.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:e.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:e.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:wt(e.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:wt(e.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:wt(e.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:e.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:e.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:e.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:e.ION_VAULT_WEBSOCKET_HEADER};if(r==="azure")return{type:"azure",azurePath:e.ION_AZURE_PATH,azureApiVersion:e.ION_AZURE_API_VERSION,azureScope:e.ION_AZURE_SCOPE,azureSecretNamePrefix:e.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:e.ION_AZURE_AUTH_METHOD,azureEntraTenantId:e.ION_AZURE_TENANT_ID,azureClientId:e.ION_AZURE_CLIENT_ID,azureClientSecret:e.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:e.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:e.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:e.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:e.ION_AZURE_VAULT_URL,azureVaultName:e.ION_AZURE_VAULT_NAME,azureTtl:wt(e.ION_AZURE_TTL)};if(r==="aws")return{type:"aws",awsWebhookUrl:e.ION_AWS_WEBHOOK_URL??"",awsTtl:wt(e.ION_AWS_TTL)};if(r==="gcp")return{type:"gcp",gcpTtl:wt(e.ION_GCP_TTL)};if(r==="mirror"){let n={};for(let[c,u]of Object.entries(e))if(c.startsWith("ION_FROM_"))n[`ION_${c.slice(9)}`]=u;if(n.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let o=Kr(n),s=Kr(e,{type:"vault"});if(!s.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let i={type:"vault",vaultUrl:s.vaultUrl,vaultToken:s.vaultToken,vaultPath:s.vaultPath,vaultTtl:s.vaultTtl,vaultWorkloadTokenUrl:s.vaultWorkloadTokenUrl,vaultWorkloadClientId:s.vaultWorkloadClientId,vaultWorkloadClientSecret:s.vaultWorkloadClientSecret,vaultWorkloadScope:s.vaultWorkloadScope,vaultWebsocketUrl:s.vaultWebsocketUrl,vaultWebsocketToken:s.vaultWebsocketToken,vaultWebsocketClientId:s.vaultWebsocketClientId,vaultWebsocketHeader:s.vaultWebsocketHeader};return{type:"mirror",from:o,to:i}}throw Error(`ION_CONFIG_TYPE="${r}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function li(e,t){return Ze(Kr(e,t))}function Bd(e){return li(process.env,e)}var Gd=1000,Jd=30000,fi=["vault","azure","aws","gcp"];function pi(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Config locator at ${t} is an invalid payload: expected an object with a "type" field`);let r=e.type;if(typeof r!=="string"||!fi.includes(r))throw Error(`Config locator at ${t} is an invalid payload: unknown type "${String(r)}" (expected ${fi.join("/")})`)}function mi(e,t){return e.log??=t.log,e.validators??=t.validators,e}function nr(e){if(!e?.secret?.close)return;try{Promise.resolve(e.secret.close()).catch((t)=>{e.log?.warn?.("secretConfigSource: inner source close failed",t)})}catch(t){e.log?.warn?.("secretConfigSource: inner source close failed",t)}}function Hd(e,t){let r=ft(t,"path","secretConfigSource"),n,o=(i)=>{pi(i,r);let c=JSON.stringify(i);if(n&&n.hash===c)return n.inner;let u=n?.inner,a=mi(Ze(i),s);if(n={hash:c,inner:a},u&&u!==a)nr(u);return a},s={async load(){let i=await e.getSecret(r);return o(i).load()},async subscribe(i,c){let u,a=!1,d=!1,g,m,C=new Promise((W,F)=>{g=W,m=F}),P=Cr(),E,O,k=(W)=>new Promise((F)=>{O=F,E=setTimeout(F,W)}),T=async(W,F)=>{pi(W,r);let Q=JSON.stringify(W),ce=n!==void 0&&n.hash===Q;if(ce&&u)return;let se=n?.inner,Z=u,ee=ce&&n?n.inner:mi(Ze(W),s),ue=!ce,z=()=>{if(ue&&ee!==se)nr(ee)};try{if(ee.subscribe){let B=await ee.subscribe(i,c)??void 0;if(a||!P.isCurrent(F)){B?.(),z();return}if(u=B,n={hash:Q,inner:ee},Z&&Z!==B)Z();if(ue&&se&&se!==ee)nr(se);return}let J=await ee.load();if(a||!P.isCurrent(F)){z();return}if(n={hash:Q,inner:ee},Z)Z(),u=void 0;if(ue&&se&&se!==ee)nr(se);i(J)}catch(J){throw z(),J}},l=async(W)=>{let F=P.next(),Q=Gd;for(;;){if(a||!P.isCurrent(F))return;try{await T(W,F);return}catch(ce){if(a||!P.isCurrent(F))return;s.log?.warn(`secretConfigSource rebind for ${r} failed; keeping last-known-good source and retrying in ${Q}ms`,ce),await k(Q),Q=Math.min(Jd,Q*2)}}},b=await e.subscribe(r,(W)=>{if(a)return;if(!d){T(W.data,P.next()).then(()=>{d=!0,g()}).catch((F)=>{d=!0,m(F)});return}l(W.data)},c);return await C,()=>{if(a=!0,P.next(),E)clearTimeout(E);O?.(),u?.(),b(),nr(n?.inner),n=void 0}},secret:e};return s}function Xn(e){if(Array.isArray(e))return e.map(Xn);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,Xn(r)]));return e}function gi(e){return JSON.stringify(Xn(e))}function Yd(e){if(e.type==="vault")return e.vaultLfvPath??e.vaultPath;if(e.type==="azure"&&e.azurePath?.trim())return e.azurePath;throw Error(`Tenant config locator type "${e.type}" does not declare a mirrorable config path`)}function Xd(e,t){let r=t.logger??e.log,n=new Map,o=!1,s=async(a)=>{if(a.closed)return;a.closed=!0,a.closeHooks?.(),await a.hookSetup?.catch(()=>{return}),await a.source.secret.close?.()},i=(a)=>{let d=(async()=>{let g=await t.store.get(a);if(!g)throw Error(`Tenant "${a}" was not found`);if(!g.configLocator)throw Error(`Tenant "${a}" has no configLocator`);let m=g.configLocator,C=t.path(g).trim();if(!C)throw Error(`Tenant mirror path is empty for "${a}"`);let P=t.sourceFromLocator?.(m,g)??m,O={source:tr({from:P,fromPath:Yd(m),to:t.to,path:C,logger:r}),locatorFingerprint:gi(m),targetPath:C,closed:!1};if(t.hooks?.onRemoteConfigChange)O.hookSetup=t.to.subscribe(C,(k)=>{Promise.resolve(t.hooks?.onRemoteConfigChange?.(g,k.data,k)).catch((T)=>{r.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:a,error:T instanceof Error?T.message:String(T)})})}).then((k)=>{O.closeHooks=k}).catch((k)=>{r.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:a,error:k instanceof Error?k.message:String(k)})});return O})();return n.set(a,d),d.catch(()=>{if(n.get(a)===d)n.delete(a)}),d},c=async(a,d,g)=>{if(n.get(a)===d)n.delete(a);await s(g)},u=async(a)=>{if(o)throw Error("Tenant config mirror is closed");let d=n.get(a);if(!d)return i(a);let g=await d,m=await t.store.get(a);if(!m?.configLocator)throw await c(a,d,g),Error(m?`Tenant "${a}" has no configLocator`:`Tenant "${a}" was not found`);if(gi(m.configLocator)!==g.locatorFingerprint)return await c(a,d,g),n.get(a)??i(a);return g};return{async ensure(a,d){await(await u(a)).source.mirror.ready(d)},async handleCallback(a,d,g){try{return await(await u(a)).source.handleCallback(d,g)}catch(m){let C=m instanceof Error?m.message:String(m),P=C.includes("was not found")?404:503;return r.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:a,kind:d,error:C}),Response.json({error:P===404?"Tenant not found":"Tenant config mirror unavailable"},{status:P})}},async purge(a){let d=n.get(a),g=d?await d:void 0,m=await t.store.get(a),C=g?.targetPath??(m?t.path(m).trim():void 0);if(g&&d)await c(a,d,g);if(C&&await t.to.exists(C))await t.to.deleteSecret(C);if(m)await t.hooks?.onRemoteConfigRevoke?.(m)},async close(){if(o)return;o=!0;let a=[...n.values()];n.clear(),await Promise.all(a.map(async(d)=>{try{await s(await d)}catch{}}))}}}import{buildTenantPath as Zd,DEFAULT_TENANT_API_NAMESPACE as wi,DEFAULT_TENANT_UI_NAMESPACE as hi,matchTenantPath as vi,normalizeTenantPathNamespace as yi}from"@ionite/core";function Qd(){return Response.json({error:"Tenant not found"},{status:404})}function el(e){return Response.json({error:`Tenant runtime unavailable for ${e}`},{status:503})}function tl(e,t){if(t==="api")return yi(e?.api??wi);return yi(e?.ui??hi)}function rl(e){if(e.store)return async(t)=>e.store.getIon(t);return async(t)=>await e.getIon(t)??void 0}async function Si(e,t={}){if(t.custom){let s=await t.custom(e);if(s)return{id:s}}let r=t.namespace??"api",n=tl(t.strategy,r),o=vi(new URL(e.url).pathname,n);if(!o)return null;return{id:o.id,context:{namespace:r,restPath:o.restPath,restSegments:o.restSegments}}}function ki(e,t){let r=new URL(e.url);return r.pathname=t,new Request(r,e)}function Zn(e,t,r,n){let o=vi(new URL(e.url).pathname,r);if(!o||o.id!==t)return e;return ki(e,Zd(t,o.restPath,n))}function nl(e,t,r={beforeTenantSegments:["api"],afterTenantSegments:[]}){return Zn(e,t,wi,r)}function ol(e,t,r={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return Zn(e,t,hi,r)}function sl(e){return async function(r){try{let n=e.resolveTenant?await e.resolveTenant(r):await Si(r),o=typeof n==="string"?{id:n,context:void 0}:n??null;if(!o?.id)return e.onMissingTenant?await e.onMissingTenant(r):Qd();let s=await e.getIon(o.id,r)??null;if(!s)return e.onMissingIonite?await e.onMissingIonite(r,o.id):el(o.id);let i=e.rewriteRequest?await e.rewriteRequest(r,{id:o.id,ion:s,context:o.context}):r;return s.handler(i)}catch(n){return Pt(n)}}}import{list as il,matchesListFilter as al}from"@ionite/core";class bi{constructor(){this.identities=new Map;this.clientIdIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.identities.get(e)}async lookup(e){if(e.id){let t=this.identities.get(e.id);if(t)return t}if(e.clientId){let t=this.clientIdIndex.get(e.clientId);if(t)return this.identities.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.identities.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n=this.identities.get(t),o={...e,id:t,createdAt:n?.createdAt??e.createdAt??r,updatedAt:r};if(n?.clientId&&n.clientId!==o.clientId)this.clientIdIndex.delete(n.clientId);if(n?.externalId&&n.externalId!==o.externalId)this.externalIdIndex.delete(n.externalId);if(this.identities.set(t,o),o.clientId)this.clientIdIndex.set(o.clientId,t);if(o.externalId)this.externalIdIndex.set(o.externalId,t);return o}async delete(e){let t=this.identities.get(e);if(t?.clientId)this.clientIdIndex.delete(t.clientId);if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.identities.delete(e),t?1:0}async list(e){let t=Array.from(this.identities.values()).filter((c)=>al(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return il(o,i,r,n)}}var yl=30000;function wl(e){let t=e,r=t.basePath??ur(),n=t.readyTimeoutMs??yl,o=cr(t.stores),{routing:s,beforeChange:i,afterChange:c,configRetry:u,onConfigLoadError:a}=t;return{frameworkConfig:{log:e.log,validators:e.validators,sso:e.sso,iam:e.iam,workload:e.workload,secrets:e.secrets,lfv:e.lfv,ciam:e.ciam,authz:e.authz,otel:e.otel},basePath:r,readyTimeoutMs:n,stores:o,options:{beforeChange:i,afterChange:c,routing:s,configRetry:u,onConfigLoadError:a}}}function hl(e){let t=e,r={trace:(n,...o)=>t.trace(n,...o),debug:(n,...o)=>t.debug(n,...o),info:(n,...o)=>t.info(n,...o),warn:(n,...o)=>t.warn(n,...o),error:(n,...o)=>t.error(n,...o)};return{logger:r,update(n){return t=n,r}}}function Li(e,t){let r=e;return r.setStores=(n)=>{t.current=cr(n),Object.assign(r,qt(r,t.current))},r}function Ci(e){let t=e?.replace(/\s+/g," ").trim();return t?t:void 0}function Ui(e){if(typeof e!=="object"||e===null)return;return e.cause}function vl(e){if(!(e instanceof Error))return typeof e==="string"?Ci(e):void 0;let t=Ci(e.message),r=[],n=e;if(typeof n.code==="string")r.push(`code=${n.code}`);if(typeof n.status==="number")r.push(`status=${n.status}`);if(typeof n.path==="string")r.push(`path=${n.path}`);if(r.length===0)return t;if(!t)return r.join(", ");return`${t} [${r.join(", ")}]`}function oo(e,t=3){let r=[],n=e,o=0;while(n!=null&&o<t){let s=vl(n);if(s&&!r.includes(s))r.push(s);n=Ui(n),o+=1}return r.length>0?r.join(" <- "):void 0}function Sl(e,t){if(typeof e!=="object"||e===null)return;return e[t]}function xe(e,t){let r=e,n=0;while(r!=null&&n<3){let o=Sl(r,t);if(o!==void 0)return o;r=Ui(r),n+=1}return}var kl=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function bl(e){return typeof e==="string"&&kl.has(e)}function Rl(e){let t=xe(e,"kind");if(bl(t))return t;let r=xe(e,"status"),n=xe(e,"code"),o=oo(e)?.toLowerCase()??"";if(r===401||r===403||o.includes("auth error")||o.includes("permission denied"))return"auth";if(n==="not_found"||o.includes("waiting for vault"))return"not_found";if(n==="ECONNREFUSED"||n==="ECONNRESET"||n==="ENOTFOUND"||n==="ETIMEDOUT"||o.includes("connection")||o.includes("fetch failed")||o.includes("network"))return"connection";if(o.includes("timed out"))return"timeout";if(o.includes("invalid status")||typeof r==="number"&&r>=400)return"invalid_status";if(o.includes("invalid payload")||o.includes("invalid json")||o.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function Cl(e){return"validation"}var Tl=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function Pl(e,t){let r=xe(e,"recoverable");if(typeof r==="boolean")return r;if(t==="not_found")return!0;if(t==="auth"||t==="invalid_payload")return!1;let n=xe(e,"status");if(typeof n==="number"&&n>=400&&n<500)return!1;let o=xe(e,"code");if(typeof o==="string"&&(Tl.has(o)||o.startsWith("UND_ERR_")))return!0;return!0}function Il(e){return{initialDelayMs:Math.max(1,e?.initialDelayMs??2000),maxDelayMs:Math.max(1,e?.maxDelayMs??600000),multiplier:Math.max(1,e?.multiplier??2),jitterRatio:Math.max(0,e?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,e?.loadTimeoutMs??30000)}}function Ol(e,t){let r=Math.max(0,e-1),n=Math.min(t.maxDelayMs,t.initialDelayMs*t.multiplier**r);if(t.jitterRatio===0)return Math.round(n);let o=n*t.jitterRatio,s=(Math.random()*2-1)*o;return Math.max(1,Math.round(Math.min(t.maxDelayMs,n+s)))}function El(e){return(t)=>{let r=t.path?` at ${t.path}`:"",n=t.sourceType?` (${t.sourceType})`:"";e.warn(`Config source${n} unavailable${r}; ionite will retry automatically in ${t.nextDelayMs}ms (attempt ${t.attempt}, ${t.errorKind}: ${t.message}).`)}}async function Al(e,t){for(let r of t)await r(e)}function Me(e){if(!e)return;try{return new URL(e,"http://dummy").pathname}catch{return e.startsWith("/")?e:`/${e}`}}function _l(e,t){let r=t.id;if(typeof r!=="string"||r.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if(e!==void 0&&e!==r)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${e}", received "${r}").`)}function Ll(e){let t=e.kms;if(t)for(let[n,o]of Object.entries(t)){if(n.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!o||typeof o!=="object"||Array.isArray(o))throw Error(`RemoteConfig.kms.${n} must be an object.`);if(o.source!==void 0&&(typeof o.source!=="string"||o.source.length===0))throw Error(`RemoteConfig.kms.${n}.source must be a non-empty string when present.`);if(o.path!==void 0&&(typeof o.path!=="string"||o.path.length===0))throw Error(`RemoteConfig.kms.${n}.path must be a non-empty string when present.`)}let r=e.otel;if(!r)return;if(r.apiKey!==void 0&&r.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(r.apiKeyPool!==void 0){if(typeof r.apiKeyPool!=="string"||r.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!t?.[r.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${r.apiKeyPool}".`)}}function Ul(e){let t=e.authz?.trustedProvisioningClients;if(!t)return;t.forEach((r,n)=>{let o=`authz.trustedProvisioningClients[${n}]`;if(typeof r.issuer!=="string"||r.issuer.length===0)throw Error(`${o}: "issuer" is required and must be a non-empty string.`);if(typeof r.clientId!=="string"||r.clientId.length===0)throw Error(`${o}: "clientId" is required and must be a non-empty string.`);let s=Array.isArray(r.audience)?r.audience:[r.audience];if(s.length===0||s.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(r.permissions)||r.permissions.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "permissions" must be an array of non-empty permission ids.`)})}function xl(e){let t=Array.isArray(e)?e:[e];return t.length>0&&t.every((r)=>typeof r==="string"&&r.length>0)}function Ml(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return;let r=t,n=(o,s)=>{if(!xl(o.audience))throw Error(`${s}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in r||"outgoing"in r){let o=r.incoming;if(Array.isArray(o))o.forEach((s,i)=>{if(s&&typeof s==="object")n(s,`workload.incoming[${i}]`)});else if(o&&typeof o==="object"&&"jwksUri"in o)n(o,"workload.incoming");return}if(Wi(r)){if("jwksUri"in r&&!("clientId"in r)&&!("workloadId"in r))n(r,"workload (server-only)");return}}function Wl(e,t,r){if(e?.sso?.redirectUri&&t.sso?.redirectUri){let n=Me(e.sso.redirectUri),o=Me(t.sso.redirectUri);if(n!==o)r.error(`SSO redirectUri path mismatch: the framework derives "${o}" from basePath, but ConfigSource reports "${n}". Register "${o}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function so(e){let t={};if(!e)return t;for(let[r,n]of Object.entries(e))if(n.type==="vault"&&typeof n.lfv?.deliveryEndpoint==="string"&&typeof n.lfv?.eventsEndpoint==="string")t[r]=n.lfv;return t}function xi(e){return e[Ct]}function Mi(e,t){let r=so(e.secrets??void 0),n=Me(t.deliveryEndpoint),o=Me(t.eventsEndpoint),s=Me(t.path);for(let i of Object.values(r)){if(Me(i.deliveryEndpoint)!==n)continue;if(Me(i.eventsEndpoint)!==o)continue;let c=i.path?Me(i.path):void 0;if(s&&c&&s!==c)continue;return!0}return!1}function jl(e,t){let r=xi(t);if(!r)return e;if(Mi(e,r))return e;let n={type:"vault",lfv:{path:r.path,lfvServerUrl:r.lfvServerUrl,clientId:r.clientId,deliveryTimeout:r.deliveryTimeout,retryInterval:r.retryInterval,warnInterval:r.warnInterval,deliveryEndpoint:r.deliveryEndpoint,eventsEndpoint:r.eventsEndpoint,verifyJwks:r.verifyJwks}},o=e.secrets??{},s=nn(o,{clientId:r.clientId,path:r.path});return{...e,secrets:{...o,[s]:n}}}function $l(e,t){let r=xi(t);if(!r||Mi(e,r))return new Map;let n=nn(e.secrets??{},{clientId:r.clientId,path:r.path});return new Map([[n,t.secret]])}function ql(e,t){let r=so(e.secrets),n=so(t.secrets??void 0);for(let[o,s]of Object.entries(n)){let i=r[o];if(!i)continue;let c=Me(i.deliveryEndpoint),u=Me(s.deliveryEndpoint);if(c&&u&&c!==u)throw Error(`LFV deliveryEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${c}, framework path: ${u}`);let a=Me(i.eventsEndpoint),d=Me(s.eventsEndpoint);if(a&&d&&a!==d)throw Error(`LFV eventsEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${a}, framework path: ${d}`)}}function Nl(e){return new Set(Object.keys(e.secrets??{}))}function Kl(e){return new Set(Object.keys(e.secrets??{}))}function Vl(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;if(!("outgoing"in t))return new Set;let r=t.outgoing;if(!r||typeof r!=="object"||Array.isArray(r))return new Set;return new Set(Object.keys(r))}function Wi(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function Fl(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;let r=t;if("incoming"in r||"outgoing"in r){let n=r.outgoing;if(!n||typeof n!=="object"||Array.isArray(n))return new Set;return new Set(Object.keys(n))}if(Wi(r))return new Set;return new Set(Object.keys(r).filter((n)=>n!=="default"))}function Dl(e,t,r,n){let o=t.secrets??{},s=e.secrets??{};for(let[d,g]of Object.entries(o)){let m=s[d];if(!m)continue;if(g.type&&m.type&&g.type!==m.type)throw Error(`Secrets source "${d}" type in framework config must match ConfigSource type. ConfigSource type: ${m.type}, framework type: ${g.type}`)}let i=Nl(t),c=Kl(e);for(let d of i)if(!c.has(d)&&!n.has(d))r.warn(`Framework config declares secrets source "${d}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let d of c)if(!i.has(d))r.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:d});let u=Vl(t),a=Fl(e);for(let d of u)if(!a.has(d))r.warn(`Framework config declares outgoing workload client "${d}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(t.otel!==void 0&&t.otel!==null&&e.otel===void 0)r.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function Ti(e,t){if(t===void 0)return!1;return ul(e,t)}function zl(e,t){if(typeof t!=="number"||!Number.isFinite(t)||t<=0)return e;return new Promise((r,n)=>{let o=setTimeout(()=>{n(Error(`Ionite ready() timed out after ${t}ms`))},t);e.then(()=>{clearTimeout(o),r()},(s)=>{clearTimeout(o),n(s)})})}function Bl(e,t,r){if(typeof t!=="number"||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>{o(Error(r))},t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function ao(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function Pi(e){return e==="/"?e:e.replace(/\/+$/,"")}function eo(e,t){return Pi(e)===Pi(t)}function Ii(e){return e.method==="GET"||e.method==="HEAD"}function Gl(e){if(e.isReady()&&e.config?.readyz?.enabled===!1)return me();let t=e.readiness();return Response.json(Jl(t),{status:t.ok?200:503})}function Jl(e){let t=e.config.lastError;if(!t)return e;return{...e,config:{...e.config,lastError:{kind:t.kind,phase:t.phase,at:t.at,message:"[redacted]"}}}}var Hl={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","iam.workloads":"iam","iam.customers":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz"};function Yl(e){let t=e?.providers;if(!t)return!1;return Object.values(t).some((r)=>r.enabled!==!1&&r.type!=="magic-link")}function Pe(e,t,r={}){let n=Hl[e],o=t.modules[n],s=r.capable??!0,i=o.active&&o.ready&&s,c=i?void 0:!o.active||!o.ready?o.reason:r.incapableReason??`${e} is not testable by this application wiring`;return{module:n,active:o.active,ready:o.ready,testable:i,...r.urls&&r.urls.length>0?{urls:r.urls}:{},...c?{reason:c}:{}}}function Xl(e,t,r){let n=Fe(t),o=e.readiness();return{sdk:{version:Kn,catalogVersion:gn},basePath:t,urls:n,modules:o.modules,lfvCallbackTransport:Boolean(r.lfv?.callbackTransport),capabilities:{"sso.login":Pe("sso.login",o,{urls:[n.sso.loginUrl,n.sso.callbackUrl,n.sso.userUrl]}),"sso.jit":Pe("sso.jit",o,{capable:r.sso?.enableJitUserProvisioning!==!1&&Boolean(r.sso?.userStore),incapableReason:r.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":Pe("sso.logout",o,{urls:[n.sso.logoutUrl]}),"sso.back_channel_logout":Pe("sso.back_channel_logout",o,{urls:[n.sso.logoutBackChannelUrl]}),"ciam.magic_link":Pe("ciam.magic_link",o,{capable:Boolean(r.ciam?.magicLinkStore)&&r.ciam?.enableJitUserProvisioning!==!1,urls:[n.ciam.magicLinkUrl,n.ciam.magicLinkLoginUrl],incapableReason:!r.ciam?.magicLinkStore?"CIAM magic-link is enabled but no magicLinkStore capability is wired by the application.":"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":Pe("ciam.oidc_login",o,{capable:Yl(r.ciam),urls:[n.ciam.customerLoginUrl,n.ciam.customerCallbackUrl,n.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":Pe("ciam.customer",o,{urls:[n.ciam.customerUrl]}),"ciam.logout":Pe("ciam.logout",o,{urls:[n.ciam.logoutUrl]}),"iam.users":Pe("iam.users",o,{capable:Boolean(r.iam?.userStore),urls:[n.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":Pe("iam.groups",o,{capable:Boolean(r.authz?.catalogStore||r.authz?.catalog),urls:[n.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"iam.workloads":Pe("iam.workloads",o,{capable:Boolean(r.iam?.workloadIdentityStore),urls:[n.iam.workloadsUrl],incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."}),"iam.customers":Pe("iam.customers",o,{capable:Boolean(r.iam?.customerStore),urls:[n.iam.customersUrl],incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."}),"workload.incoming":Pe("workload.incoming",o,{urls:[n.workload.validateUrl,n.workload.jwksUrl]}),"workload.outgoing":Pe("workload.outgoing",o,{}),"authz.oaa":Pe("authz.oaa",o,{capable:Boolean(r.authz?.accessStore&&(r.authz?.catalogStore||r.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."})}}}async function Zl(e,t,r){if(!t.isReady())return ao();if(t.config?.capabilitiez!==!0||!r)return me();let n=await pt(e,t,Ai["capabilitiez.read"]);if(n)return n;return Response.json(r.build(),{status:200})}async function Ql(e){if(!e)return[];let t=[];for await(let r of Wt((n,o)=>e.list({start:n,limit:o})))t.push(r);return t}function to(e,t){return[...new Set(e.filter((r)=>r.subjectType===t).map((r)=>typeof r.subject==="string"?r.subject:r.subject.id).filter((r)=>Boolean(r)))]}function ro(e,t,r){if(!e)return;if(t==="all")return Wt((n,o)=>e.list({start:n,limit:o}));return async function*(){for(let o of r){let s=await e.get(o);if(s)yield s}}()}async function ef(e,t,r){if(!t.isReady())return ao();if(t.config?.authz?.oaa?.fullSync?.enabled!==!0)return me();let n=await pt(e,t,Ai["authz.oaa.sync"]);if(n)return n;let o=t.authz?.oaa;if(!o?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let s=t.authz?await t.authz.reconcile():void 0,i=r.iam?.userStore,c=r.iam?.customerStore??r.ciam?.customerStore,u=r.workload,a=r.iam?.workloadIdentityStore??(u&&"workloadIdentityStore"in u?u.workloadIdentityStore:u&&("incoming"in u)&&u.incoming&&!Array.isArray(u.incoming)&&("workloadIdentityStore"in u.incoming)?u.incoming.workloadIdentityStore:void 0),d=dl(r.authz?.catalog?_i(r.authz.catalog):void 0,r.authz?.catalogStore),g=r.authz?.accessStore,m=r.authz?.resources,C=await Ql(g),P=await o.sync({users:ro(i,o.population("user"),to(C,"user")),customers:ro(c,o.population("customer"),to(C,"customer")),workloads:ro(a,o.population("workload"),to(C,"workload")),groups:d?Wt((E,O)=>d.groups.list({start:E,limit:O})):void 0,roles:d?Wt((E,O)=>d.roles.list({start:E,limit:O})):void 0,permissions:d?Wt((E,O)=>d.permissions.list({start:E,limit:O})):void 0,resources:m?Wt((E,O)=>m.list({start:E,limit:O})):void 0,access:C},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...P,reconcile:s})}function tf(e,t,r,n,o,s){return async(i)=>{let c=new URL(i.url).pathname;if(eo(c,r)){if(!Ii(i))return It(["GET"]);return Gl(e)}if(eo(c,n)){if(!Ii(i))return It(["GET"]);return Zl(i,e,o)}if(s&&eo(c,s.url)){if(i.method!=="POST")return It(["POST"]);return ef(i,e,s.frameworkConfig)}let u=e.secrets;if(!Boolean(u?.isLfvDeliveryRequest?.(i)||u?.isLfvEventsRequest?.(i))&&!e.isReady())return ao();try{return await t(i)}catch(d){return e.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},d),Pt(d)}}}function Oi(e,t,r){if(e)return r&&!e.tenantId?{...e,tenantId:r}:e;if(t&&r)return{tenantId:r};return}function rf(e,t){if(t.authz===null)return;if(!e.authz&&!t.authz)return;return{...e.authz,...t.authz,oaa:e.authz?.oaa||t.authz?.oaa?{...e.authz?.oaa,...t.authz?.oaa}:void 0}}function no(e){let t=!1,r=ye(`${e} module`,()=>t);return{isReady:r.isReady,ready:r.ready,attach(n){if(t=n!==void 0,r.refresh(),!n)return;return Object.defineProperty(n,"isReady",{value:r.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(n,"ready",{value:r.ready,enumerable:!1,configurable:!0}),n}}}function io(e){if(!e)return!1;return e.isReady?e.isReady():!1}function Mt(e,t,r,n){if(!e)return{active:!1,ready:!1,reason:r};return io(t)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:n}}function nf(){let e=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:e(),ciam:e(),iam:e(),workload:e(),otel:e(),secrets:e(),kms:e(),authz:e()}}function of(e,t,r){let n=e.isReady(),o=e.config;if(!n||!o)return{ok:!1,applied:n,modules:nf(),config:{...t}};let s=zr(r),i=Boolean(o.workload)||Boolean(e.workload),c={sso:Mt(Boolean(o.sso),e.sso,"sso not configured (no RemoteConfig.sso)",s.sso??"sso configured but not ready"),ciam:Mt(Boolean(o.ciam),e.ciam,"ciam not configured (no RemoteConfig.ciam)",s.ciam??"ciam configured but not ready"),iam:Mt(Boolean(o.iam),e.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:Mt(i,e.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:Mt(Boolean(o.otel),e.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(o.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!io(e.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return e.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:Mt(Boolean(o.kms),e.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(o.authz?.oaa))return{active:!0,ready:!0};let d=e.authz?.oaa;return io(d)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})()};return{ok:Object.values(c).every((a)=>!a.active||a.ready),applied:n,modules:c,config:{...t}}}function sf(e,t){let r=[];for(let n of t){let o=e.modules[n];if(!e.applied){r.push({name:n,reason:"RemoteConfig has not been applied yet"});continue}if(!o?.ready)r.push({name:n,reason:o?.reason??`${n} is not ready`})}return{ok:r.length===0,notReady:r}}function af(e,t,r,n,o,s,i,c){let u=t.validators,a=ml(e.cache);fl(a.jwks);let d=t;if(a.session.read.enabled){let Z=t.sso?.sessionStore??t.ciam?.sessionStore;if(Z){let ee=An(Z,a.session.read);d={...t,sso:t.sso?{...t.sso,sessionStore:ee}:t.sso,ciam:t.ciam?{...t.ciam,sessionStore:ee}:t.ciam}}}let g={sessionCache:a.session},m=Je(u.workload,r,e?.workload,t.workload??void 0),C=t.otel!==null?kn(r,e?.otel,t.otel??void 0,o):void 0,P=zr(d);if(Object.keys(e).length>0){if(P.sso)r.error(P.sso);if(P.ciam)r.error(P.ciam)}let E=Oi(e?.sso,t.sso,e.id),O=P.sso?void 0:gl(u.sso,r,E,d.sso??void 0,g),k={...e?.iam,...t.iam},T=t.authz?.catalog?_i(t.authz.catalog):void 0,l=t.workload,b=l&&"workloadIdentityStore"in l?l.workloadIdentityStore:l&&("incoming"in l)&&l.incoming&&!Array.isArray(l.incoming)&&("workloadIdentityStore"in l.incoming)?l.incoming.workloadIdentityStore:void 0,W=Boolean(k.url||k.userStore||t.authz?.catalogStore||T),F=i.update({users:e?.iam?.users?.delta,workloads:e?.iam?.workloads?.delta,customers:e?.iam?.customers?.delta,url:k.url,audience:k.deltaAudience},{workload:m,workloadIdentityStore:b,userStore:k.userStore,customerStore:k.customerStore??d.ciam?.customerStore,accessStore:t.authz?.accessStore,catalogStore:t.authz?.catalogStore,codeCatalog:T,mapUserToScim:k.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:k.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:k.inboundWorkloads?.mapBaseWorkloadToScim}),Q;if(W&&!m){if(Object.keys(e).length>0)r.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");Q=void 0}else Q=pl(u.iam,r,m,s,t.authz?.accessStore,t.authz?.accessIndex,t.authz?.catalogStore,T,t.authz?.resources,e?.iam,t.iam??void 0,F,t.authz?.onAccessMutation,cl(e.authz),c);let ce=Oi(e?.ciam,t.ciam,e.id),se=P.ciam?void 0:ll(u.ciam,r,ce,d.ciam??void 0,m,g);return{secret:n,workload:m,otel:C,sso:O,iam:Q,ciam:se}}function ji(e,t,r,n,o,s,i,c){let u=s.authz.update(rf(t,r));e.id=t.id,e.config=t,e.secrets=s.secrets.update(t.secrets,r.secrets??void 0,r.validators.secrets,r.lfv?.callbackTransport,r.lfv?.singleProcess),e.kms=s.kms.update(t.kms,(m)=>{if(!m.source)return o;if(!e.secrets)throw Error(`KMS pool references unavailable secrets source "${m.source}".`);return e.secrets.getSecretsSource(m.source)});let a=af(t,r,n,o,s.kms.handle(),u,s.iamDelta,s.authz.settle);e.secret=a.secret,e.workload=s.workload.update(a.workload),e.otel=s.otel.update(a.otel),e.authz=u,e.log=s.log.update(e.otel?.logger??n),e.sso=s.sso.attach(a.sso),e.iam=s.iam.attach(a.iam),e.ciam=s.ciam.attach(a.ciam);let d=Fe(i),g=(m)=>bn(m,e,c?.routing,d);e.handler=tf(e,g,d.readyzUrl,d.capabilitiezUrl,{build:()=>Xl(e,i,r)},{url:ho(i),frameworkConfig:r})}function cf(e,t,r,n,o,s,i,c,u){_l(e.id,t),Ll(t),Ul(t),Ml(t),Wl(t,r,n),ql(t,r),Dl(t,r,n,c),ji(e,t,r,n,o,s,i,u)}function Ei(e){if(!e.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return e.secret}async function uf(e,t,r,n,o,s,i){let c=e,u=vo(e,t,o.current,s);if(n.beforeChange){let a=Li(u,o);i?.enter();let d;try{d=await n.beforeChange(e,a,r)}finally{i?.exit()}if(d?.config!==void 0)c=d.config;u=d?.frameworkConfig??a}return u=qt(u,o.current),{effectiveRemoteConfig:c,effectiveFrameworkConfig:u}}function qg(e,t){let r=wl(t),{frameworkConfig:n,basePath:o,readyTimeoutMs:s,stores:i,options:c}=r,u=$l(n,e),a=new Set(u.keys()),d=qt(jl(n,e),i),g=d.log||Qn,m={current:i},C={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:d},P=mn(g),E,O={log:hl(g),secrets:Ns(g,u),kms:ls(g),workload:Ys(g),otel:ys(g),authz:Vo(g,()=>P.handle(),()=>E?.iam,()=>({mapUserToScim:C.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:C.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:C.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim})),iamDelta:P,sso:no("sso"),iam:no("iam"),ciam:no("ciam")},k={},T,l,b=new Promise((I,x)=>{T=I,l=x}),W=!1,F,Q,ce=0,se={enter:()=>{ce+=1},exit:()=>{ce-=1}},Z=Promise.resolve();function ee(I){let x=Z.then(I,I);return Z=x.then(()=>{return},()=>{return}),x}function ue(I){if(W)throw Error(`Ionite instance has been closed and cannot call ${I}().`)}function z(){e.log=C.frameworkConfig.log??Qn,e.validators=C.frameworkConfig.validators}let J={},B={log:g,id:void 0,config:void 0,secret:Ei(e),authz:void 0,configStatus:k,handler:async()=>me(),ready:(I)=>{if(ce>0&&C.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return zl(b,I??s)},isReady:()=>C.remoteConfig!==void 0,readiness:()=>of(B,k,C.frameworkConfig),requireReady:(I)=>sf(B.readiness(),I),close:()=>{if(W)return;if(W=!0,Q)clearTimeout(Q),Q=void 0;F?.(),F=void 0;let I=[()=>O.secrets.close(),()=>O.kms.close(),()=>O.authz.close(),()=>O.otel.shutdown()];for(let x of I)try{Promise.resolve(x()).catch((q)=>{g.warn("Ionite close: module teardown failed",q)})}catch(q){g.warn("Ionite close: module teardown failed",q)}T?.(),T=void 0,l=void 0},setStores:async(I)=>{ue("setStores");let x=cr(I);await ee(()=>M(x))}};E=B,ji(B,J,C.frameworkConfig,g,B.secret,O,o,c),z();function ae(){let I=k.lastError!==void 0;if(k.appliedAt=Date.now(),k.lastError=void 0,I)(B.log??g).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function re(I,x){let q=oo(x)??(x instanceof Error?x.message:String(x)),w=Cl(x),_=k.lastError===void 0;if(k.lastError={kind:w,message:q,at:Date.now(),phase:I},_)(B.log??g).error(I==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":w,phase:I,error:q})}function ne(I,x,q){(B.log??g).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:I,"ion.config.hash":x,"ion.config.apply_ms":q})}async function R(I,x){if(W)return;let q=Ri(I);if(x&&C.remoteConfig!==void 0&&q===C.remoteConfigHash&&Ti(I,C.remoteConfig))return;let w=C.remoteConfig,_=w===void 0?"initial":"update",h=Date.now(),p,f,S;try{let Y=await uf(I,C.frameworkConfig,C.remoteConfig,c,m,o,se);if(p=Y.effectiveRemoteConfig,f=Ri(p),S=Y.effectiveFrameworkConfig,x&&c.beforeChange===void 0&&C.remoteConfig!==void 0&&f===C.remoteConfigHash&&Ti(p,C.remoteConfig)&&S===C.frameworkConfig)return;let K=S.log||Qn;cf(B,p,S,K,Ei(e),O,o,a,c)}catch(Y){throw re(_,Y),Y}C.remoteConfig=p,C.remoteConfigHash=f,C.frameworkConfig=S,z(),ae(),await O.otel.settled();let A=Li(C.frameworkConfig,m),N=!1;try{c.afterChange?.(B,p,A,w)}catch(Y){if((B.log??g).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:_,error:Y instanceof Error?Y.message:String(Y)}),_==="initial"){N=!0;let K=Y instanceof Error?Y:Error(`afterChange failed on initial load: ${String(Y)}`);re("initial",K),l?.(K),l=void 0,T=void 0}}if(C.frameworkConfig=A,z(),!N)ne(_,f,Date.now()-h);if(!N&&T)T(),T=void 0}async function M(I){if(W)return;if(m.current=I,C.remoteConfig===void 0){C.frameworkConfig=qt(C.frameworkConfig,I),z();return}await R(C.remoteConfig,!1)}if(e.subscribe)e.subscribe((I)=>{ee(()=>R(I,!0)).catch(()=>{})},{mode:"wait"}).then((I)=>{if(W){I?.();return}F=I}).catch((I)=>{g.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:I instanceof Error?I.message:String(I)})});let G=Il(c.configRetry),H=[c.onConfigLoadError??El(g)],v=0;function U(){if(Q=void 0,W)return;if(C.remoteConfig!==void 0)return;Bl(e.load(),G.loadTimeoutMs,`ConfigSource initial load timed out after ${G.loadTimeoutMs}ms`).then(async(I)=>{v=0;try{await ee(async()=>{if(C.remoteConfig!==void 0)return;await R(I,!0)})}catch(x){let q=x instanceof Error?x:Error(`Initial RemoteConfig application failed: ${String(x)}`);g.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:q.message}),l?.(q),l=void 0}},async(I)=>{if(W)return;v+=1;let x=Ol(v,G),q=oo(I)??"RemoteConfig load failed",w=Rl(I),_=xe(I,"code"),h=xe(I,"status"),p={attempt:v,error:I,errorKind:w,maxDelayMs:G.maxDelayMs,message:q,nextDelayMs:x,code:typeof _==="string"?_:void 0,status:typeof h==="number"?h:void 0,path:typeof xe(I,"path")==="string"?xe(I,"path"):void 0,sourceType:typeof xe(I,"sourceType")==="string"?xe(I,"sourceType"):void 0};if(!Pl(I,w)){let f=I instanceof Error?I:Error(`ConfigSource initial load failed with unrecoverable ${w}: ${q}`);g.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:w,error:q,code:p.code,status:p.status,path:p.path,sourceType:p.sourceType}),l?.(f),l=void 0;return}try{await Al(p,H)}catch(f){let S=f instanceof Error?f:Error("ConfigSource retry hook stopped RemoteConfig retrying");l?.(S),l=void 0;return}Q=setTimeout(U,x)})}return U(),B}export{Fg as AssignmentPolicyError,Qg as CatalogAdjacencyCache,Sc as ION_CAPABILITY_CATALOG,gn as ION_CAPABILITY_CATALOG_VERSION,yl as ION_READY_DEFAULT_TIMEOUT_MS,Kn as ION_SDK_VERSION,He as InMemoryAccessAssignmentStore,ri as InMemoryAccessCatalogStore,oi as InMemoryAccessIndex,or as InMemoryCustomerStore,sr as InMemoryMagicLinkStore,ni as InMemoryResourceStore,ir as InMemorySessionStore,vy as InMemoryTenantStore,ar as InMemoryUserStore,bi as InMemoryWorkloadIdentityStore,it as InMemoryWorkloadTokenStore,zg as IoniteError,kr as ScimOutboundClient,Or as VAULT_MIN_POLLING_TTL_MS,rr as VaultConfigInvalidPayloadError,yt as VaultConfigWaitingForSecretError,Le as VaultSubscribeNotSupportedError,Jg as allowHosts,Hg as allowOrigins,Yg as allowRelativePaths,Xg as allowSameOrigin,Bn as awsConfig,$r as azureConfig,Zg as blockDangerousUrls,ey as callback,ty as captureRedirect,ry as ciam,Us as closeAllVaultSockets,ny as collectReferencedDefinitions,Yn as configFromSource,Kr as configLocatorFromEnvValues,li as configSourceFromEnvValues,Ze as configSourceFromLocator,mn as createManagedIamDelta,An as createSessionReadCache,sl as createTenantIonHandler,rl as createTenantIonResolver,oy as defaultRedirectPolicies,Fe as deriveIonUrls,na as devInMemoryStores,sy as discoverSessionRecords,iy as discoverSessions,pt as enforceEndpointAuthz,Bd as envConfig,fn as escapeScimFilterValue,ay as expandRoot,Gn as gcpConfig,Dg as generateULID,cy as getCustomer,uy as getUser,ud as getWorkload,dd as getWorkloadToken,dy as has,ly as hasAll,fy as hasAllScope,py as hasAny,my as hasAnyScope,gy as hasGroup,yy as hasPermission,wy as hasRole,hy as hasScope,Sy as iam,ky as initiateLogin,qg as ionite,by as isRedirectAllowed,Md as isVaultConfigInvalidPayloadError,xd as isVaultConfigWaitingForSecretError,lt as lfvVault,Bg as listGenerator,Ry as listSsoClientIdsFromCookies,Jn as mirrorSecrets,tr as mirroredConfig,Cy as reconcileSubjectAccess,Ty as resolveAfterRedirect,Py as resolveCapturedRedirect,hs as resolveDefaultRoute,Iy as resolveRedirect,Si as resolveTenantFromRequest,ld as revokeWorkloadToken,nl as rewriteRequestForDefaultTenantApi,ol as rewriteRequestForDefaultTenantUi,Zn as rewriteRequestForTenantPath,ki as rewriteRequestPath,bn as routeRequest,Oy as sameOriginRedirectRules,Hd as secretConfigSource,Ey as sendTenantWebhook,Rs as setVaultWebSocketCommandTimeout,Ay as sso,Ge as subscribeSecretPathWithHttpPolling,vd as tenantManager,Xd as tenantMirror,Nn as validateWorkloadToken,At as vault,qr as vaultConfig,Ls as vaultSocketDiagnostics,_y as verifyUser,Ly as withSetCookies,Je as workload,fd as workloadHandler};