@ionite/server 0.0.24-beta.20260917.4 → 0.0.24-beta.20260917.5

package/dist/index.d.ts

@@ -855,7 +855,7 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.24-beta.20260917.4";
+declare const ION_SDK_VERSION = "0.0.24-beta.20260917.5";
 import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite5, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**

package/dist/index.js

@@ -2,4 +2,4 @@ import{configTrustedClientGrants as cl,deepEqualPlain as ul,defaultLogger as Qn,
 `).split(`
 `);for(let n=0;n<r.length;n+=1){let s=(r[n]??"").trim();if(!s||s.startsWith("#"))continue;let i=s.startsWith("export ")?s.slice(7).trimStart():s,c=i.indexOf("=");if(c<=0)throw Error(`Invalid env entry at line ${n+1}: expected KEY=value`);let u=i.slice(0,c).trim();if(!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(u))throw Error(`Invalid env key "${u}" at line ${n+1}`);let a=i.slice(c+1).trim();if(a.length>=2&&(a.startsWith('"')&&a.endsWith('"')||a.startsWith("'")&&a.endsWith("'"))){let d=a[0],g=a.slice(1,-1);t[u]=d==='"'?g.replace(/\\(n|r|t|"|\\)/g,(m,C)=>{if(C==="n")return`
 `;if(C==="r")return"\r";if(C==="t")return"\t";return C}):g}else t[u]=a}return t}function Jo(e){return Object.entries(e).map(([t,r])=>{let n=String(r??"");if(!n||/[\s#"'\\]/.test(n))return`${t}=${JSON.stringify(n)}`;return`${t}=${n}`}).join(`
-`)}function Ho(e){try{let t=atob(e);return Uint8Array.from(t,(r)=>r.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function vr(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("Secret content is not an object");return e}function Ft(e){return e.metadata.contentType??Qa()}function on(e,t){if(t==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof e.data==="string")return e.data;if(t==="jsonc")return JSON.stringify(e.data,null,2);if(t==="env")return Jo(vr(e.data));let r=vr(e.data).content;if(typeof r!=="string")throw Error(`Secret ${t} content must contain a string "content" field`);return r}function hr(e,t){if(t==="jsonc")return typeof e.data==="string"?ec(e.data):e.data;if(t==="env")return typeof e.data==="string"?Go(e.data):vr(e.data);if(t==="text")return on(e,t);if(t==="binary"){let r=vr(e.data).content_base64;if(typeof r!=="string")throw Error('Binary secret content must contain a "content_base64" string');return Ho(r)}throw Error(`Typed ${t} decoding is not supported yet; use text() or bytes()`)}function rc(e){return{format:e.format,mimeType:e.mimeType,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id}}function nc(e,t){let r=Ft(e);if(r.format!==t.format||r.mimeType!==t.mimeType)throw new tc(rc(t),r)}async function oc(e,t){if(!e.schema)return t;let r=await e.schema["~standard"].validate(t);if(r.issues){let n=r.issues.map((o)=>o.message).join("; ");throw Error(`Secret validation failed for type "${e.id}": ${n}`)}return r.value}function qe(e){return{async text(){let t=await e();return on(t,Ft(t).format)},async json(){let t=await e(),r=Ft(t).format;if(r!=="jsonc")throw Error(`json() requires a jsonc secret; received ${r}`);return hr(t,r)},async bytes(){let t=await e(),r=Ft(t).format;if(r==="binary")return hr(t,r);return new TextEncoder().encode(on(t,r))},async env(){let t=await e(),r=Ft(t).format;if(r!=="env")throw Error(`env() requires an env secret; received ${r}`);return hr(t,r)},async metadata(){return(await e()).metadata},async parse(t){let r=await e();return nc(r,t),oc(t,hr(r,t.format))}}}function Xo(e){try{return new URL(e).pathname}catch{return e.startsWith("/")?e:`/${e}`}}var ac=1e4,cc=1e4,uc=300,Zo=100;async function dn(e){await new Promise((t)=>setTimeout(t,e))}function Ae(e){return{startedAt:Date.now(),timeout:typeof e?.timeout==="number"&&e.timeout>0?e.timeout:void 0}}function sn(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function zt(e){if(e.timeout===void 0)return;let t=Date.now()-e.startedAt;return Math.max(0,e.timeout-t)}function ze(e,t,r){return Error(`LFV ${e} timed out after ${r.timeout??0}ms for ${t}`)}async function Rt(e,t,r,n,o){let s=zt(r);if(s!==void 0){if(s<=0)throw ze(n,o,r);let i=new AbortController,c=setTimeout(()=>i.abort(),s);try{return await fetch(e,{...t,signal:i.signal})}catch(u){if(u instanceof Error&&u.name==="AbortError")throw ze(n,o,r);throw u}finally{clearTimeout(c)}}return await fetch(e,t)}class Te extends Error{constructor(e){super(`LFV source closed while operating on ${e}`);this.name="LfvSourceClosedError"}}class De extends Error{constructor(e){super(e);this.name="LfvProtocolError"}}class dt extends De{constructor(e,t,r){super(`LFV ${t} failed (${e}) for ${r}`);this.status=e;if(this.name="LfvActionStatusError",e===404)this.code="not_found"}}var dc=new Set([400,401,403,404,409,410]);function Qo(e){return e instanceof De&&(!(e instanceof dt)||dc.has(e.status))}function Sr(e){return e instanceof Te||e instanceof Error&&e.name==="LfvSourceClosedError"}function lc(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`LFV kms_park returned invalid payload for ${t}`);let r=e;if(typeof r.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${t}`);let n=r.disposition;if(n!==void 0&&n!=="cooldown"&&n!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${t}`);return{parked:r.parked,...r.stale===!0?{stale:!0}:{},...n?{disposition:n}:{}}}function Dt(e){try{let t=JSON.parse(e);return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:void 0}catch{return}}async function an(e,t,r,n,o,s,i,c,u,a){let d=0,g=Date.now();for(;;){if(a?.())throw new Te(n);let m=zt(r);if(m!==void 0&&m<=0)throw ze(o,n,r);try{return await e()}catch(C){if(C instanceof Te)throw C;if(a?.())throw new Te(n);if(d+=1,i>0&&Date.now()-g>=i){let E=`Error connecting to the LFV source. Retries: '${d}'`;if(c)c(u,E,{url:t,path:n,operation:o});g=Date.now()}let P=m===void 0?s:Math.min(s,m);if(P<=0)throw ze(o,n,r);if(await dn(P),a?.())throw new Te(n)}}}function fc(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function cn(e){if(typeof e==="number"&&Number.isFinite(e))return e;if(typeof e==="string"&&e.trim()){let t=Date.parse(e.trim());if(!Number.isNaN(t))return t}return}function es(e){return`[LFV] [${e??"-"}] [${new Date().toISOString()}]: `}function un(e,t){if(typeof e!=="string"||e.trim()==="")throw Error(`LFV source requires "${t}"`);return e}function pc(e){return{...e,lfvServerUrl:un(e.lfvServerUrl,"lfvServerUrl"),clientId:un(e.clientId,"clientId"),path:un(e.path,"path")}}function lt(e,t,r={}){let n=pc(e),o=n.log??sc,s=(y,L,j)=>{let V=es(y)+L;if(j!==void 0)o.debug(V,j);else o.debug(V)},i=(y,L,j)=>{let V=es(y)+L;if(j!==void 0)o.warn(V,j);else o.warn(V)},{lfvServerUrl:c,clientId:u,path:a,verifyJwks:d}=n,g=typeof n.deliveryTimeout==="number"&&n.deliveryTimeout>0?n.deliveryTimeout:void 0,m=typeof n.retryInterval==="number"&&n.retryInterval>0?n.retryInterval:ac,C=typeof n.warnInterval==="number"&&n.warnInterval>=0?n.warnInterval:cc,P=(typeof n.callbackMaxAgeSeconds==="number"&&n.callbackMaxAgeSeconds>0?n.callbackMaxAgeSeconds:uc)*1000,E=typeof n.cacheMaxAgeSeconds==="number"&&n.cacheMaxAgeSeconds>0?n.cacheMaxAgeSeconds*1000:void 0,O=d?.trim()?ic(d.trim()):void 0,k=Xo(n.deliveryEndpoint),T=Xo(n.eventsEndpoint),l=wr({lfvServerUrl:c,path:a}),b=crypto.randomUUID(),W=new Map,F=new Set,Q=new Map,ce=new Map,se=new Map,Z=new Map,ee=new Map,ue=new Map,z=new Map,J=(y,L)=>{if(typeof L==="number"&&Number.isInteger(L)&&L>=1){let j=z.get(y)??1,V=Math.max(j,L);return z.set(y,V),V}return z.get(y)},B=(y,L)=>typeof L==="number"&&Number.isInteger(L)&&L>=1&&L>(z.get(y)??1),ae=new Map,re=new Map,ne=!1,R,M=new Set,G=()=>ne;function H(y,L){Q.set(y,L),ce.set(y,Date.now())}function v(y){Q.delete(y),ce.delete(y)}function U(y){let L=Q.get(y);if(!L)return;if(E!==void 0){let j=ce.get(y)??0;if(Date.now()-j>E){s(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:y});return}}return L}function I(){return F.size>0||W.size>0||ue.size>0}function x(){if(ne){if(R)R(),R=void 0;return}let y=I();if(y&&!R)R=Do(l,b,{trustId:O,onDelivery:async(L)=>lo(L).handled||await po(L),onEvents:async(L)=>{mo(L)}});if(!y&&R)R(),R=void 0}async function q(y,L,j,V){if(!t)throw Error("LFV callback transport is not configured");for(;;){if(ne)throw new Te(L);if(V())throw new Te(L);let X=await t.take(y);if(X){if(X.key!==l)i(y,"parked OTP callback rejected: callback key mismatch");else if(!await Vr(X.rawBody,X.headers)){let fe=Dt(X.rawBody);if(fe?.type==="otp"&&fe.request_id===y&&typeof fe.otp==="string"&&fe.otp)return fe.otp}}let D=zt(j);if(D!==void 0&&D<=0)throw ze("issueOtp",L,j);await dn(D===void 0?Zo:Math.min(Zo,D))}}async function w(y,L){let j=L??crypto.randomUUID(),V={startedAt:Date.now(),timeout:g},X={request_id:j,path:y,action:"read_secret",...sn(J(y))},D=await an(()=>Rt(`${c.replace(/\/+$/g,"")}/clients/${u}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":j},body:JSON.stringify(X)},V,"issueOtp",y),c,V,y,"issueOtp",m,C,i,j,G);if(D.status!==200&&D.status!==202)throw new dt(D.status,"issueOtp",y)}async function _(y,L){let j=re.get(y);if(j)return j;let V=w(y,L);re.set(y,V);try{await V}finally{if(re.get(y)===V)re.delete(y)}}async function h(y,L,j,V){if(ne)throw new Te(y);let X=j??crypto.randomUUID(),D=V??Ae(),ie=new Promise((Ee,$t)=>{let go={resolve:Ee,reject:$t},Fr=zt(D);if(Fr!==void 0){if(Fr<=0){$t(ze("issueOtp",y,D));return}go.timer=setTimeout(()=>{ue.delete(X),x(),$t(ze("issueOtp",y,D))},Fr)}ue.set(X,go),x()});ie.catch(()=>{});let fe=()=>{let Ee=ue.get(X);if(!Ee)return;if(Ee.timer)clearTimeout(Ee.timer);ue.delete(X),x()},de={request_id:X,path:y,action:L,...sn(J(y))};s(X,"OTP request",{path:y,action:L});let he;try{he=await an(async()=>await Rt(`${c.replace(/\/+$/g,"")}/clients/${u}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":X},body:JSON.stringify(de)},D,"issueOtp",y),c,D,y,"issueOtp",m,C,i,X,G)}catch(Ee){throw fe(),Ee}if(he.status!==200&&he.status!==202)throw fe(),new dt(he.status,"issueOtp",y);let ke=!1,ve=t?q(X,y,D,()=>ke):void 0;if(ve)ve.catch(()=>{});try{let Ee=await(ve?Promise.race([ie,ve]):ie);return s(X,"OTP received via signed callback",{path:y,action:L}),Ee}finally{ke=!0,fe()}}async function p(y,L,j,V,X,D,ie){if(ne)throw new Te(L);let fe=ie??Ae(),de=await an(async()=>await Rt(`${c.replace(/\/+$/g,"")}${y}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":X},body:JSON.stringify({request_id:X,otp:V,path:L,...sn(J(L)),...D??{}})},fe,j,L),c,fe,L,j,m,C,i,X,G);if(de.status!==200&&de.status!==202)throw new dt(de.status,j,L);return s(X,`${j} accepted`,{path:L,status:de.status}),de}async function f(y,L,j,V,X,D){if(ne)throw new Te(L);let ie=X??crypto.randomUUID(),fe=D??Ae(),de=await h(L,j,ie,fe),he=await p(y,L,j,de,ie,V,fe);return{requestId:ie,response:he}}async function S(y,L,j){if(ne)throw new Te(y);let V=B(y,j?.kmsSlots);if(J(y,j?.kmsSlots),V)v(y);let X=U(y);if(X)return X;let D=ae.get(y);if(D){if(!V)return D;if(await D.catch(()=>{return}),D=ae.get(y),D)return D}let ie=A(y,L,j);ae.set(y,ie),ie.catch((fe)=>{if(Sr(fe))s(L,"read aborted: source closed",{path:y})});try{return await ie}finally{ae.delete(y)}}async function A(y,L,j){let V=j?.timeout??g,X={startedAt:Date.now(),timeout:typeof V==="number"&&V>0?V:void 0},D=L??crypto.randomUUID();s(D,"read_secret request",{path:y});let ie=0,fe=Date.now();for(;;){if(ne)throw new Te(y);try{let{response:de}=await f("/secrets/request",y,"read_secret",void 0,D,X),he=await N(D,de),ke=Y(y,he);return K(y,ke,ke.metadata.version),s(D,"read_secret completed from action response",{path:y}),ke}catch(de){if(de instanceof Te)throw de;if(Qo(de))throw de;let he=zt(X);if(he!==void 0&&he<=0)throw ze("read_secret",y,X);if(ie+=1,C>0&&Date.now()-fe>=C)i(D,`read_secret retrying. Retries: '${ie}'`,{path:y}),fe=Date.now();let ke=he===void 0?m:Math.min(m,he);if(ke<=0)throw ze("read_secret",y,X);await dn(ke)}}}async function N(y,L){if(!d?.trim())throw new De("LFV read_secret response verification is not configured");let j=L.headers.get("X-LFV-Request-Id")?.trim(),V=L.headers.get("X-LFV-Key-Id")?.trim(),X=L.headers.get("X-LFV-Signature")?.trim();if(!j||!V||!X)throw new De("LFV read_secret response is missing signature headers");if(j!==y)throw new De("LFV read_secret response request_id header does not match the request");let D=await L.text();if(!await Yo({jwks:d,kid:V,signatureB64Url:X,requestId:y,rawBody:D}))throw new De("LFV read_secret response signature verification failed");let fe=Dt(D);if(!fe||fe.request_id!==y)throw new De("LFV read_secret response request_id does not match the request");return fe}function Y(y,L){if(uo(L)!==y||L.data?.data===void 0)throw new De(`LFV read_secret returned an invalid secret response for ${y}`);let V=L.data.metadata??{},X=typeof V.version==="number"?V.version:0,D=V.created_time??V.created,ie=ut(V);return{data:L.data.data,metadata:{path:y,version:X,created:typeof D==="string"?new Date(D):new Date,...ie?{contentType:ie}:{}}}}function K(y,L,j){if(j!==void 0){let D=Z.get(y);if(D!==void 0&&j<D){s(void 0,"delivery ignored: stale version",{path:y,realVersion:j,lastAccepted:D});return}Z.set(y,j)}H(y,L),M.delete(y);let V=L.metadata.version;if(se.get(y)===V)return;se.set(y,V);let X=W.get(y);if(!X)return;for(let D of X)D(L)}async function oe(y,L){return await S(y,void 0,L)}async function te(y,L,j){if(!fc(L))throw Error(`putSecret requires an object value for LFV source at path ${y}`);let V=Ae(j),X={data:L,content_type:yr(j.contentType)};if(await st(y,j)){await f("/secrets/update",y,"update_secret",X,void 0,V),v(y);return}await f("/secrets/create",y,"create_secret",X,void 0,V),v(y)}async function we(y,L){let j=Ae(L);await f("/secrets/delete",y,"delete_secret",void 0,void 0,j),v(y)}async function le(y,L){let j=Ae(L),V=crypto.randomUUID();s(V,"list_paths request",{path:y});let X=await h(y,"list_paths",V,j),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},j,"listPaths",y);if(D.status!==200)throw Error(`LFV listPaths failed (${D.status}) for ${y}`);let ie=await D.json();if(!Array.isArray(ie.items))throw Error(`LFV listPaths returned invalid payload for ${y}`);return s(V,"list_paths success",{path:y,status:200}),ie.items.filter((fe)=>typeof fe==="string")}async function st(y,L){let j=Ae(L),V=crypto.randomUUID();s(V,"exists request",{path:y});let X=await h(y,"read_metadata",V,j),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},j,"exists",y);if(D.status!==200)throw Error(`LFV exists failed (${D.status}) for ${y}`);let ie=await D.json();if(typeof ie.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${y}`);return s(V,"exists success",{path:y,status:200,exists:ie.exists}),ie.exists}async function Ve(y,L,j){let V=Ae(j);await f("/secrets/rotate/request",y,"request_rotate",{reason:L?.reason,severity:L?.severity,incident_ref:L?.incidentRef},void 0,V)}async function jt(y,L,j){let V=Ae(j);await f("/secrets/revoke/request",y,"request_revoke",{reason:L?.reason,severity:L?.severity,incident_ref:L?.incidentRef},void 0,V)}async function $i(y,L,j){let V=Ae(j),{response:X}=await f("/secrets/kms/park",y,"kms_park",{key_id:L.keyId,status:L.status,reason:L.reason},void 0,V);return lc(await X.json().catch(()=>null),y)}function qi(y,L){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_add_keys returned invalid payload for ${L}`);let j=y;if(!Array.isArray(j.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${L}`);return{keys:j.keys.map((X,D)=>{if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`LFV kms_add_keys returned invalid keys[${D}] for ${L}`);let ie=X.id;if(typeof ie!=="string"||ie.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${D}].id for ${L}`);return{id:ie}})}}function Ni(y,L){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_revoke_key returned invalid payload for ${L}`);let j=y;if(typeof j.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${L}`);return{revoked:j.revoked}}async function Ki(y,L,j){let V=Ae(j),{response:X}=await f("/secrets/kms/add-keys",y,"kms_add_keys",{keys:L.keys},void 0,V);return qi(await X.json().catch(()=>null),y)}async function Vi(y,L,j){let V=Ae(j),{response:X}=await f("/secrets/kms/revoke-key",y,"kms_revoke_key",{key_id:L.keyId,reason:L.reason},void 0,V);return Ni(await X.json().catch(()=>null),y)}async function Fi(y,L){let j=Ae(L),V=crypto.randomUUID();s(V,"getMetadata request",{path:y});let X=await h(y,"read_metadata",V,j),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},j,"getMetadata",y);if(D.status!==200)throw Error(`LFV getMetadata failed (${D.status}) for ${y}`);let ie=await D.json();if(!ie.metadata||typeof ie.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${y}`);return s(V,"getMetadata success",{path:y,status:200}),ie.metadata}async function co(y,L,j,V=!0){let X=W.get(y)??new Set,D,ie=(de)=>{if(de.metadata.version===D)return;D=de.metadata.version,L(de)};if(X.add(ie),W.set(y,X),!V)return x(),()=>{let de=W.get(y);if(!de)return;if(de.delete(ie),de.size===0)W.delete(y);x()};let fe=B(y,j?.kmsSlots)?void 0:U(y);if(fe)ie(fe),se.set(y,fe.metadata.version);else try{ie(await oe(y,j))}catch(de){if(X.delete(ie),X.size===0)W.delete(y);throw de}return x(),()=>{let de=W.get(y);if(!de)return;if(de.delete(ie),de.size===0)W.delete(y);x()}}let Di=(y,L)=>co(y,L,void 0,!1);function zi(y){return y.method==="POST"&&new URL(y.url).pathname===k}function Bi(y){return y.method==="POST"&&new URL(y.url).pathname===T}function uo(y){let L=y.data?.metadata?.path;if(typeof L==="string"&&L)return L;if(typeof y.path==="string"&&y.path)return y.path;return}function Gi(y){let{request_id:L,otp:j}=y;if(typeof L!=="string"||typeof j!=="string"||!j)return{handled:!1};let V=ue.get(L);if(!V)return{handled:!1};if(V.timer)clearTimeout(V.timer);return ue.delete(L),x(),V.resolve(j),{handled:!0}}function lo(y){return y.type==="otp"?Gi(y):{handled:!1}}function Qe(y="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:y}),{status:401,headers:{"Content-Type":"application/json"}})}function fo(y){return{requestId:y.headers.get("X-LFV-Request-Id")??y.headers.get("x-lfv-request-id")??"",keyId:y.headers.get("X-LFV-Key-Id")??y.headers.get("x-lfv-key-id")??"",signature:y.headers.get("X-LFV-Signature")??y.headers.get("x-lfv-signature")??""}}async function Vr(y,L){if(!d?.trim())return i(void 0,"LFV callback rejected: verifyJwks is not configured"),Qe("LFV callback verification is not configured");let{requestId:j,keyId:V,signature:X}=L;if(!j.trim()||!V.trim()||!X.trim())return i(j||void 0,"LFV callback rejected: missing signature headers"),Qe("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await Yo({jwks:d,kid:V,signatureB64Url:X.trim(),requestId:j.trim(),rawBody:y}))return i(j,"LFV callback rejected: signature verification failed"),Qe();let ie=Dt(y);if(!ie)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let fe=ie;if(fe.request_id!==j.trim())return i(j,"LFV callback rejected: request_id header/body mismatch"),Qe("X-LFV-Request-Id does not match request_id in body");let de=Date.now(),he=cn(fe.issued_at);if(he===void 0)return i(j,"LFV callback rejected: missing or invalid issued_at"),Qe("Missing or invalid issued_at");if(de-he>P)return i(j,"LFV callback rejected: stale (outside freshness window)"),Qe("Callback is stale (issued_at outside freshness window)");let ke=cn(fe.expires_at);if(ke!==void 0&&de>ke)return i(j,"LFV callback rejected: expired"),Qe("Callback has expired");let ve=X.trim();for(let[Ee,$t]of ee)if($t<=de)ee.delete(Ee);if(ee.has(ve))return i(j,"LFV callback rejected: replayed signature"),Qe("Callback signature already processed (replay)");return ee.set(ve,he+P),null}async function po(y){if(!r.selfRedeemReads||y.action!=="read_secret"||typeof y.request_id!=="string"||typeof y.path!=="string"||typeof y.otp!=="string")return!1;let L={startedAt:Date.now(),timeout:g},j=await p("/secrets/request",y.path,"read_secret",y.otp,y.request_id,void 0,L),V=await N(y.request_id,j),X=Y(y.path,V);return K(y.path,X,X.metadata.version),!0}async function Ji(y){let L=await y.text(),j=fo(y),V=await Vr(L,j);if(V)return V;let X=Dt(L);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let D=X;if(D.type!=="otp"||typeof D.request_id!=="string"||typeof D.otp!=="string"||typeof D.path!=="string"||typeof D.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let ie=uo(D);s(D.request_id,"delivery received",{path:ie});let fe=lo(D),de=ie?wr({lfvServerUrl:c,path:ie}):l,he=await zo(de,D,b,O),ke=fe.handled||he>0;if(!ke)try{if(ke=await po(D),!ke&&t&&typeof D.request_id==="string"){let ve=cn(D.expires_at),Ee=Math.max(1,(ve??Date.now()+P)-Date.now());await t.put(D.request_id,{kind:"delivery",key:de,rawBody:L,headers:j},Ee),ke=!0}}catch(ve){if(Qo(ve)){if(!(ve instanceof dt)||ve.status!==409&&ve.status!==410)M.add(D.path);return i(j.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:de,status:ve instanceof dt?ve.status:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:{"Content-Type":"application/json"}})}return ee.delete(j.signature.trim()),i(j.requestId,"LFV callback handoff failed; callback may be retried",{key:de,error:ve instanceof Error?ve.message:String(ve)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(!ke)return ee.delete(j.signature.trim()),i(j.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:de}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function mo(y){if(ne)return;if(!y?.path||typeof y.path!=="string")return;s(y.request_id,"events payload",{path:y.path,event:y.event});for(let L of F)try{L({path:y.path,event:y.event,requestId:y.request_id,issuedAt:y.issued_at,expiresAt:y.expires_at,...typeof y.key_id==="string"&&y.key_id.length>0?{keyId:y.key_id}:{}})}catch(j){i(y.request_id,"secret event listener failed",{path:y.path,event:y.event,error:j instanceof Error?j.message:String(j)})}if(y.event==="created"||y.event==="updated"||y.event==="rotated")v(y.path),(r.selfRedeemReads?_(y.path,y.request_id):S(y.path,y.request_id).then(()=>{return})).catch((j)=>{if(Sr(j)){s(y.request_id,"event refresh aborted: source closed",{path:y.path});return}M.add(y.path),i(y.request_id,"event-triggered refresh failed; source marked degraded",{path:y.path,event:y.event,error:j instanceof Error?j.message:String(j)})})}async function Hi(y){let L=await y.text(),j=fo(y),V=await Vr(L,j);if(V)return V;let X=Dt(L);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let D=X;if(!D?.path||typeof D.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});s(D.request_id,"events received",{path:D.path,event:D.event}),mo(D);let ie=wr({lfvServerUrl:c,path:D.path});return await Bo(ie,D,b,O),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function Yi(){if(ne)return;if(ne=!0,R)R(),R=void 0;let y=new Te(a);for(let L of ue.values()){if(L.timer)clearTimeout(L.timer);try{L.reject(y)}catch{}}ue.clear(),ae.clear(),re.clear(),M.clear(),Q.clear(),ce.clear(),se.clear(),Z.clear(),ee.clear(),W.clear(),F.clear()}return{type:"vault",isAvailable:()=>M.size===0,get:(y,L)=>qe(()=>oe(y,L)),getFullSecret:oe,getSecret:async(y,L)=>(await oe(y,L)).data,putSecret:te,deleteSecret:we,listPaths:le,exists:st,requestRotate:Ve,requestRevoke:jt,parkKmsKey:$i,addKmsKeys:Ki,revokeKmsKey:Vi,getMetadata:Fi,subscribe:co,subscribePassive:Di,subscribeEvents:(y)=>(F.add(y),x(),()=>{F.delete(y),x()}),close:Yi,isDeliveryRequest:zi,isEventsRequest:Bi,handleDelivery:Ji,handleEvents:Hi,deliveryPath:k,eventsPath:T,callbackKey:l,trustId:O}}function ft(e,t,r){if(typeof e!=="string"||e.trim()==="")throw Error(`"${t}" is required when using ${r}`);return e}var Ct="__esLfvBootstrap";import{catalogEntityStore as br,listGenerator as Jt,materializeCodeCatalogEntity as wc,trimTrailingSlash as hc,unionCatalogRead as vc}from"@ionite/core";import{baseCustomerToScim as rs,baseUserToScimUser as ns,baseWorkloadToScim as os,entitlementToScimGroup as pn}from"@ionite/core/server";import{ION_AUTHZ_GROUP_SCHEMA as ln}from"@ionite/core";var ts="application/scim+json",mc="urn:ietf:params:scim:api:messages:2.0:PatchOp",gc="urn:ietf:params:scim:schemas:core:2.0:User",yc="urn:ietf:params:scim:schemas:core:2.0:Group";async function Bt(e){try{let t=(await e.clone().text()).trim();return t?t.slice(0,2000):void 0}catch{return}}function Gt(e){if(e==="user")return"Users";if(e==="workload")return"Workloads";if(e==="customer")return"Customers";return"Groups"}function fn(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class kr{constructor(e){this.inflight=new Map;this.memo=new Map;this.writes=new Map;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.getToken=e.getToken,this.receipts=e.receipts,this.log=e.log,this.fetchImpl=e.fetchImpl??((t,r)=>fetch(t,r))}async headers(){let e=await this.getToken();return new Headers({"Content-Type":ts,Accept:ts,Authorization:`Bearer ${e}`})}inflightKey(e,t,r){return`${e}\x00${t}\x00${r?"create":"lookup"}`}receiptKey(e,t){return`${e}\x00${t}`}serializeWrite(e,t,r){let n=`${e}\x00${t}`,s=(this.writes.get(n)??Promise.resolve()).catch(()=>{return}).then(r);this.writes.set(n,s);let i=()=>{if(this.writes.get(n)===s)this.writes.delete(n)};return s.then(i,i),s}async resolveProviderId(e,t,r){let n=this.receiptKey(e,t),o=this.memo.get(n);if(o)return{found:o.providerId,requestUrl:o.requestUrl};let s=await this.receipts.read(e,t);if(s)this.memo.set(n,s);if(s)return{found:s.providerId,requestUrl:s.requestUrl};let i=this.inflightKey(e,t,r!==void 0),c=this.inflight.get(i);if(c)return c;let u=this.resolveUncached(e,t,r).then(async(a)=>{if(typeof a==="object"){let d={providerId:a.found,...a.requestUrl?{requestUrl:a.requestUrl}:{}};await this.receipts.write(e,t,d),this.memo.set(n,d)}return a}).finally(()=>{this.inflight.delete(i)});return this.inflight.set(i,u),u}async resolveUncached(e,t,r){let n=await this.filterByExternalId(e,t);if(n!=="absent")return n;if(!r)return"absent";return this.create(e,t,r)}async filterByExternalId(e,t){let r=encodeURIComponent(`externalId eq "${fn(t)}"`),n=`${this.baseUrl}/${Gt(e)}?filter=${r}`,o=await this.fetchImpl(n,{method:"GET",headers:await this.headers()});if(!o.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:e,status:o.status,detail:await Bt(o)}),"error";let i=((await o.json()).Resources??[])[0];return i?.id?{found:i.id,...this.requestUrl(e,i)}:"absent"}async create(e,t,r){let n=`${this.baseUrl}/${Gt(e)}`,o=this.writeBody(e,t,r),s=await this.fetchImpl(n,{method:"POST",headers:await this.headers(),body:JSON.stringify(o)});if(!s.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Bt(s)}),"error";let i=await s.json();return i.id?{found:i.id,...this.requestUrl(e,i),created:!0}:"error"}requestUrl(e,t){if(e!=="group")return{};let r=t[ln];if(!r||typeof r!=="object")return{};let n=r.requestUrl;return typeof n==="string"&&n?{requestUrl:n}:{}}async captureResponseReference(e,t,r,n,o){try{let s=await e.clone().json(),i=this.requestUrl(t,s).requestUrl;if(!i&&s.id===void 0)return;let c=i??o,u={providerId:s.id??n,...c?{requestUrl:c}:{}};await this.receipts.write(t,r,u),this.memo.set(this.receiptKey(t,r),u)}catch{}}async invalidate(e,t){this.memo.delete(this.receiptKey(e,t)),await this.receipts.clear(e,t)}writeBody(e,t,r){let{id:n,meta:o,...s}=r,i=s,c=i[ln];if(c&&typeof c==="object"&&!Array.isArray(c)){let{providerId:u,requestUrl:a,...d}=c;i[ln]=d}return{...i,schemas:(r.schemas?.length??0)>0?r.schemas:[e==="user"?gc:yc],externalId:t}}async upsertResource(e,t,r){return this.serializeWrite(e,t,()=>this.upsertResourceNow(e,t,r))}async upsertResourceNow(e,t,r){let n=async(s)=>{let i=await this.resolveProviderId(e,t,s?r:void 0);if(i==="error")return"error";if(i==="absent")return"skipped";if(i.created)return"pushed";let c=await this.fetchImpl(`${this.baseUrl}/${Gt(e)}/${encodeURIComponent(i.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody(e,t,r))});if(c.status===404||c.status===410)return"stale";if(c.ok)return await this.captureResponseReference(c,e,t,i.found,i.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:e,status:c.status,detail:await Bt(c)}),"error"},o=await n(!0);if(o==="stale")await this.invalidate(e,t),o=await n(!0);return o==="stale"?"error":o}async deleteResource(e,t){return this.serializeWrite(e,t,()=>this.deleteResourceNow(e,t))}async deleteResourceNow(e,t){let r=async()=>{let o=await this.resolveProviderId(e,t);if(o==="error")return{outcome:"error"};if(o==="absent")return{outcome:"pushed"};let s=await this.fetchImpl(`${this.baseUrl}/${Gt(e)}/${encodeURIComponent(o.found)}`,{method:"DELETE",headers:await this.headers()});if(s.status===404||s.status===410)return{outcome:"pushed",stale:!0};if(s.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Bt(s)}),{outcome:"error"}},n=await r();if(n.stale)await this.invalidate(e,t),n=await r();if(n.outcome==="pushed")await this.invalidate(e,t);return n.outcome}async patchGroupMembership(e){return this.serializeWrite("group",e.groupExternalId,()=>this.patchGroupMembershipNow(e))}async patchGroupMembershipNow(e){let{groupExternalId:t,userExternalId:r,op:n}=e,o=e.subjectResourceType??"user",s=await this.resolveProviderId(o,r,n==="add"?e.userCreate:void 0);if(s==="error")return this.log.warn("IAM delta: principal lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,subjectResourceType:o}),"error";if(s==="absent")return this.log.warn("IAM delta: principal not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n,subjectResourceType:o}),"skipped";let i=s.found,c=async(d)=>{let g=await this.resolveProviderId("group",t,n==="add"&&d?e.groupCreate:void 0);if(g==="error")return{kind:"error"};if(g==="absent")return{kind:"absent"};let m=`${this.baseUrl}/${Gt("group")}/${encodeURIComponent(g.found)}`,C=n==="add"?[{op:"add",path:"members",value:[{value:i,type:e.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${fn(i)}"]`}];return{kind:"response",response:await this.fetchImpl(m,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[mc],Operations:C})}),providerId:g.found,requestUrl:g.requestUrl}},u=await c(!0);if(u.kind==="response"&&(u.response.status===404||u.response.status===410))await this.invalidate("group",t),u=await c(!1);if(u.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n}),"error";if(u.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n}),"skipped";let a=u.response;if(!a.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,status:a.status,detail:await Bt(a)}),"error";return await this.captureResponseReference(a,"group",t,u.providerId,u.requestUrl),"pushed"}}function Tt(e){if(typeof e==="string")return e;if(e&&typeof e==="object"&&"id"in e)return e.id;return}function Ht(e){return e&&typeof e==="object"?e:void 0}function mn(e){let t={},r={},n,o,s,i,c,u,a,d,g,m=()=>t.users==="patch"||t.workloads==="patch"||t.customers==="patch",C=(v)=>{if(v==="user")return t.users==="patch";if(v==="workload")return t.workloads==="patch";return t.customers==="patch"},P=()=>{if(!t.url)return"destination URL is not configured";if(!r.workload)return"workload identity is not configured";if(typeof r.workload.isReady!=="function"||typeof r.workload.ready!=="function")return"workload handle violates the readiness contract";if(!r.workload.isReady())return"workload module is not ready";if(t.audience){let v=r.workload[t.audience];if(!v)return`outgoing workload client "${t.audience}" is not configured`;if(typeof v.isReady!=="function"||typeof v.ready!=="function")return`outgoing workload client "${t.audience}" violates the readiness contract`;if(!v.isReady())return`outgoing workload client "${t.audience}" is not ready`}return},E=()=>{if(!m())return"no principal-kind delta mode is 'patch'";let v=P();if(v)return v;if(t.users==="patch"&&!r.userStore)return"user store is not configured for IAM destination receipts";if(t.workloads==="patch"&&!r.workloadIdentityStore)return"workload identity store is not configured for IAM destination receipts";if(t.customers==="patch"&&!r.customerStore)return"customer store is not configured for IAM destination receipts";if(!r.catalogStore)return"catalog store is not configured for IAM destination receipts";return},O=()=>E()===void 0,k=ye("IAM delta",O),T=async()=>{let v=r.workload;if(!v)throw Error("IAM delta: workload identity not configured");if(t.audience&&typeof v.getToken==="function")return v.getToken(t.audience);if(typeof v.getServerToken==="function")return v.getServerToken();return v.getToken()},l=()=>vc(r.codeCatalog,r.catalogStore),b=async(v,U)=>{let I=r.catalogStore;if(!I)return;let x=r.codeCatalog?.groups.get(v)??r.codeCatalog?.roles.get(v)??r.codeCatalog?.permissions.get(v);if(x){let w=r.codeCatalog?.groups.get(x.id)?"group":r.codeCatalog?.roles.get(x.id)?"role":"permission",_=br(I,w),h=await _.get(x.id);if(!h&&U)await wc(w,x,_),h=await _.get(x.id);if(h)return{kind:w,entity:h}}let q=[["group",I.groups],["role",I.roles],["permission",I.permissions]];for(let[w,_]of q){let h=await _.get(v);if(h)return{kind:w,entity:h}}return},W=async(v)=>{let U=r.userStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);for await(let I of Jt((x,q)=>U.list({start:x,limit:q})))if(I.externalId===v)return I;return},F=(v)=>v?.providerId?{providerId:v.providerId,...v.requestUrl?{requestUrl:v.requestUrl}:{}}:void 0,Q=async(v)=>{let U=r.workloadIdentityStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);let I=await U.lookup({id:"",externalId:v});if(I)return I;for await(let x of Jt((q,w)=>U.list({start:q,limit:w})))if(x.externalId===v)return x;return},ce=async(v)=>{let U=r.customerStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);let I=await U.lookup({id:"",userName:"",name:"",email:"",externalId:v});if(I)return I;for await(let x of Jt((q,w)=>U.list({start:q,limit:w})))if(x.externalId===v)return x;return},se={async read(v,U){if(v==="user")return F(await W(U));if(v==="workload")return F(await Q(U));if(v==="customer")return F(await ce(U));return F((await b(U,!1))?.entity)},async write(v,U,I){if(v==="user"){let w=await W(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.userStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}if(v==="workload"){let w=await Q(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.workloadIdentityStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}if(v==="customer"){let w=await ce(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.customerStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}let x=await b(U,!0);if(!x||x.entity.providerId===I.providerId&&x.entity.requestUrl===I.requestUrl)return;await br(r.catalogStore,x.kind).set({...x.entity,providerId:I.providerId,requestUrl:I.requestUrl}).ready()},async clear(v,U){if(v==="user"){let h=await W(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.userStore?.upsert(S);return}if(v==="workload"){let h=await Q(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.workloadIdentityStore?.upsert(S);return}if(v==="customer"){let h=await ce(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.customerStore?.upsert(S);return}let I=await b(U,!1);if(!I||I.entity.providerId===void 0&&I.entity.requestUrl===void 0)return;let{providerId:x,requestUrl:q,...w}=I.entity;await br(r.catalogStore,I.kind).set(w).ready()}},Z=()=>{if(!O()||!t.url)return;let v=t.url;if(n&&o===v&&s===r.catalogStore&&i===r.userStore&&c===r.workloadIdentityStore&&u===r.customerStore&&a===r.codeCatalog&&d===r.fetchImpl)return n;return n=new kr({baseUrl:t.url,getToken:T,receipts:se,log:e,fetchImpl:r.fetchImpl}),o=v,s=r.catalogStore,i=r.userStore,c=r.workloadIdentityStore,u=r.customerStore,a=r.codeCatalog,d=r.fetchImpl,n},ee=(v)=>v==="workload"?"Workload":v==="customer"?"Customer":"User",ue=async(v)=>{if(v.subjectType==="workload"){let q=Tt(v.subject),w=Ht(v.subject);if(!w&&q)w=await r.workloadIdentityStore?.get(q);let _=w?.externalId??w?.id??q;if(!w||!_)return;return{externalId:_,resourceType:"workload",create:await(r.mapWorkloadToScim?.({...w,externalId:_})??os({...w,externalId:_}))}}if(v.subjectType==="customer"){let q=Tt(v.subject),w=Ht(v.subject);if(!w&&q)w=await r.customerStore?.get(q);let _=w?.externalId??w?.id??q;if(!_)return;let h=w?await(r.mapCustomerToScim?.({...w,externalId:_})??rs({...w,externalId:_})):{schemas:["urn:ionite:scim:schemas:core:2.0:Customer"],externalId:_,displayName:_,active:!0};return{externalId:_,resourceType:"customer",create:h}}let I=Ht(v.subject);if(!I){let q=Tt(v.subject);if(q&&r.userStore)I=await r.userStore.get(q)}let x=I?.externalId;if(!I||!x)return;return{externalId:x,resourceType:"user",create:await(r.mapUserToScim?.(I)??ns(I))}},z=async(v)=>{let I=Ht(v.target);if(!I){let x=Tt(v.target),q=l();if(x&&q)I=v.targetType==="role"?await q.roles.get(x):v.targetType==="permission"?await q.permissions.get(x):await q.groups.get(x)}if(I&&I.requestable!==!0)return"not-requestable";if(!I)return;return{externalId:I.id,create:pn(I,v.targetType)}},J=async(v,U)=>{if(!O())return"skipped";if(!C(v.subjectType==="workload"?"workload":v.subjectType==="customer"?"customer":"user"))return"skipped";let I=await ue(v),x=await z(v);if(x==="not-requestable")return"skipped";if(!I||!x)return e.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:U,hasSubject:Boolean(I),hasTarget:Boolean(x),targetType:v.targetType}),"skipped";let q=Z();if(!q)return"skipped";return q.patchGroupMembership({groupExternalId:x.externalId,userExternalId:I.externalId,op:U,groupCreate:x.create,userCreate:I.create,memberType:ee(v.subjectType),subjectResourceType:I.resourceType})},B=async(v,U,I)=>{let x=[],q=new Set,w=(h)=>{let p=`${h.type??"User"}\x00${h.value}`;if(!q.has(p))q.add(p),x.push(h)},_=r.accessStore;if(_)for await(let h of Jt((p,f)=>_.listByTarget(U,v.id,{start:p,limit:f}))){let p=await ue(h);if(!p){e.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:v.id,targetType:U});continue}let f=await I.resolveProviderId(p.resourceType,p.externalId,p.create);if(f==="error")throw Error(`IAM delta failed to resolve access subject for ${U}:${v.id}`);if(f==="absent")continue;let S=h.metadata;w({value:f.found,type:ee(h.subjectType),...S?.display?{display:S.display}:{}})}if(U==="group"){let h=l();for(let p of v.groups??[]){let f=Tt(p),S=Ht(p);if(!S&&f)S=await h?.groups.get(f);if(S&&S.requestable!==!0)continue;if(!S){e.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:f,target:v.id});continue}let A=await I.resolveProviderId("group",S.id,pn(S,"group"));if(A==="error")throw Error(`IAM delta failed to resolve nested Group for group:${v.id}`);if(A!=="absent")w({value:A.found,type:"Group"})}}return x.length>0?x:void 0},ae=async(v)=>{if(!O()||!C("user"))return"skipped";let U=v.externalId;if(!U)return e.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:v.id,kind:"user"}),"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapUserToScim?.(v)??ns(v));return I.upsertResource("user",U,x)},re=async(v)=>{if(!O()||!C("workload"))return"skipped";let U=v.externalId??v.id;if(!U)return"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapWorkloadToScim?.({...v,externalId:U})??os({...v,externalId:U}));return I.upsertResource("workload",U,x)},ne=async(v)=>{if(!O()||!C("customer"))return"skipped";let U=v.externalId??v.id;if(!U)return"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapCustomerToScim?.({...v,externalId:U})??rs({...v,externalId:U}));return I.upsertResource("customer",U,x)},R=async(v,U,I=!0)=>{if(!O()||!m())return"skipped";let x=l(),w=(x?await br(x,U).get(v.id):void 0)??v;if(w.requestable!==!0)return"skipped";let _=Z();if(!_)return"skipped";let h=await B(w,U,_),p=await _.upsertResource("group",w.id,pn(w,U,h)),f=r.accessStore;if(p!=="pushed"||!I||!f)return p;for await(let S of Jt((A,N)=>f.listByTarget(U,v.id,{start:A,limit:N})))if(await J(S,"add")==="error")throw Error(`IAM delta failed to restore access for ${U}:${v.id}`);return p},M=(v,U)=>{if(v==="error")throw Error(`IAM delta: destination rejected ${U}`)},G=(v,U,I)=>{if(U==="pushed")v.pushed+=1;else if(U==="skipped")v.skipped+=1;else v.errors.push(`IAM delta: destination rejected ${I}`)},H={async onUserUpsert(v){M(await ae(v),"user upsert")},async onUserDelete(v){if(!O()||!C("user"))return;let U=Z();if(!U)return;M(await U.deleteResource("user",v),"user delete")},async onWorkloadUpsert(v){M(await re(v),"workload upsert")},async onWorkloadDelete(v){if(!O()||!C("workload"))return;let U=Z();if(!U)return;M(await U.deleteResource("workload",v),"workload delete")},async onCustomerUpsert(v){M(await ne(v),"customer upsert")},async onCustomerDelete(v){if(!O()||!C("customer"))return;let U=Z();if(!U)return;M(await U.deleteResource("customer",v),"customer delete")},async onEntitlementUpsert(v,U){M(await R(v,U),`${U} upsert`)},async onEntitlementDelete(v,U){if(!O())return;let I=Z();if(!I)return;M(await I.deleteResource("group",U),`${v} delete`)},async onGrant(v){if(!O())return;if(await J(v,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(v){if(!O())return;if(await J(v,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async requestAccess(v){let U=t.url,I=P();if(I!==void 0||U===void 0)throw Error(`Cannot submit an access request: ${I??"destination URL is not configured"}`);let x=await(r.fetchImpl??fetch)(`${hc(U)}/AccessRequests`,{method:"POST",headers:{Authorization:`Bearer ${await T()}`,"Content-Type":"application/json"},body:JSON.stringify(v)});if(!x.ok)throw Error(`AccessRequests failed: ${x.status} ${await x.text()}`);return await x.json()},async reconcile(v){let U={pushed:0,skipped:0,errors:[]},I=E();if(I)return U.errors.push(`iam delta not ready: ${I}`),U;let x=async(q,w,_)=>{if(!q)return;for await(let h of q)try{G(U,await w(h),_(h))}catch(p){U.errors.push(p instanceof Error?p.message:String(p))}};return await x(v.groups,(q)=>R(q,"group",!1),(q)=>`group upsert for ${q.id}`),await x(v.roles,(q)=>R(q,"role",!1),(q)=>`role upsert for ${q.id}`),await x(v.permissions,(q)=>R(q,"permission",!1),(q)=>`permission upsert for ${q.id}`),await x(v.users,(q)=>ae(q),(q)=>`user upsert for ${q.id??"unknown"}`),await x(v.workloads,(q)=>re(q),(q)=>`workload upsert for ${q.id}`),await x(v.customers,(q)=>ne(q),(q)=>`customer upsert for ${q.id??"unknown"}`),await x(v.access,(q)=>J(q,"add"),(q)=>`membership push for ${Tt(q.target)??"unknown"}`),U},async getDestinationRef(v,U){return se.read(v,U)},isReady:O,ready:k.ready};return{update(v,U){t=v,r=U,Z(),k.refresh();let I=E();if(!m())g=void 0;else if(I!==g){if(I)e.warn(`IAM delta configured but not ready: ${I}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:I});g=I}return H},handle(){return H}}}var gn=2,Sc=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"iam.workloads",module:"iam",label:"SCIM Workloads inbound",requires:"workloadIdentityStore",incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."},{key:"iam.customers",module:"iam",label:"SCIM Customers inbound",requires:"customerStore",incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."}];import{IoniteError as kc}from"@ionite/core";function bc(e){if(e instanceof kc)return{status:e.status,statusText:e.statusText};if(typeof e!=="object"||e==null)return;let t=e,r=typeof t.status==="number"?t.status:void 0,n=typeof t.statusText==="string"?t.statusText:void 0;return r!=null||n?{status:r,statusText:n}:void 0}function Pt(e){if(e instanceof Response)return e;let t=bc(e);if(!t)return Response.json({error:"internal_error"},{status:500});let n={status:t.status??500};if(t.statusText)n.statusText=t.statusText;return Response.json({error:t.statusText??"internal_error"},n)}function me(){return Response.json({error:"not_found"},{status:404})}function It(e=["GET"]){return Response.json({error:"method_not_allowed",allow:e},{status:405,headers:{Allow:e.join(", ")}})}import{timingSafeEqual as Rc}from"node:crypto";import{parseKmsPoolDocument as Cc,stableConfigHash as is}from"@ionite/core";function ss(e,t,r){for(let n of e)try{n()}catch(o){t.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:r,error:o instanceof Error?o.message:String(o)})}}function We(e,t){let r=new Set,n=new Set;return{beforeChange(o){return r.add(o),()=>{r.delete(o)}},afterChange(o){return n.add(o),()=>{n.delete(o)}},emitBefore(){ss(r,e,`${t} beforeChange`)},emitAfter(){ss(n,e,`${t} afterChange`)}}}var Tc=604800000,Pc=2147483647,Ic=1;function ds(e,t){if(!e.value)return!1;if(e.notBefore&&Date.parse(e.notBefore)>t)return!1;if(e.notAfter&&Date.parse(e.notAfter)<=t)return!1;return!0}function _e(e,t,r=Date.now()){if(!e)return;let n=e.slots?.[t];if(!n)return;let o=e.keys.find((s)=>s.id===n&&s.state==="active");return o&&ds(o,r)?o:void 0}function yn(e,t=Date.now()){if(!e)return[];return e.keys.filter((r)=>(r.state==="active"||r.state==="deprecated")&&ds(r,t))}function as(e){return{...e,...e.meta?{meta:{...e.meta}}:{}}}function Rr(e,t,r){if(!t||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>o(Error(r)),t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function cs(e,t){let r=Buffer.from(e),n=Buffer.from(t);return r.length===n.length&&Rc(r,n)}function Oc(e){if(!Number.isInteger(e)||e<1)throw Error("KMS unique() requires a positive integer slot count.");return e}var Ec=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function Ac(e){return Ec.has(e)}function us(e){let t=e.trim().replace(/\/+$/,"");if(!t||t==="/")return"/";return t.startsWith("/")?t:`/${t}`}function _c(e,t){let r=us(e),n=us(t);return r===n||r.endsWith(n)}function Lc(e,t,r){let n=We(t,`KMS pool "${e}"`),o=new Set,s=!1,i,c,u=0,a,d,g=Ic,m,C,P=new Map,E=new Set,O,k=()=>i!==void 0&&i.slots===void 0&&i.keys.length>0,T=ye(`KMS pool "${e}"`,()=>{if(!s)return!1;if(k())return yn(i).length>0;return _e(i,0)!==void 0}),l=ye(`KMS pool "${e}" issuer`,()=>s&&m!==void 0),b=(h)=>h===0?`KMS pool "${e}"`:`KMS pool "${e}" slot ${h}`,W=(h)=>{let p=P.get(h),f=p?.valueWaiter;if(!p||!f)return;if(!s){p.valueWaiter=void 0,f.reject(Error(`${b(h)} is no longer configured.`));return}if(k()){p.valueWaiter=void 0,f.reject(Error(`${b(h)} verifier grant has no slots.`));return}let S=_e(i,h);if(S?.value)p.valueWaiter=void 0,f.resolve(S.value)},F=()=>{for(let h of P.keys())W(h)},Q=(h)=>{let p=P.get(h);if(!p)return;let f=_e(i,h);for(let S of p.listeners)try{S(f?as(f):void 0)}catch(A){t.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:e,slot:h,error:A instanceof Error?A.message:String(A)})}},ce=()=>{for(let h of P.keys())Q(h)},se=()=>{for(let h of P.values())h.latch.refresh();T.refresh(),l.refresh()},Z=()=>{try{O?.()}catch(h){t.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:e,error:h instanceof Error?h.message:String(h)})}O=void 0},ee=()=>{if(O||E.size===0||!m?.subscribeEvents||!C)return;let h=C;O=m.subscribeEvents((p)=>{if(!Ac(p.event)||!_c(p.path,h))return;let f={path:p.path,event:p.event,...p.requestId===void 0?{}:{requestId:p.requestId},...p.keyId===void 0?{}:{keyId:p.keyId}};for(let S of E)try{S(f)}catch(A){t.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:e,error:A instanceof Error?A.message:String(A)})}})},ue=()=>{if(d)clearTimeout(d);d=void 0},z=()=>{ue();let h=Date.now();if(i){for(let f of i.keys){if(!f.notAfter)continue;let S=Date.parse(f.notAfter)-h;if(S>0&&S<=Tc&&(f.state==="active"||f.state==="deprecated")&&!o.has(f.id))o.add(f.id),t.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:e,keyId:f.id,notAfter:f.notAfter})}let p=i.keys.flatMap((f)=>[f.notBefore,f.notAfter]).filter((f)=>Boolean(f)).map((f)=>Date.parse(f)).filter((f)=>f>h).sort((f,S)=>f-S);if(p[0])d=setTimeout(()=>{let f=new Map([...P.keys()].map((S)=>[S,_e(i,S)?.id]));se(),r();for(let S of P.keys())if(f.get(S)!==_e(i,S)?.id)Q(S);z()},Math.min(p[0]-h+1,Pc))}se(),r(),F()},J=(h)=>{let p=new Map([...P.keys()].map((f)=>{let S=_e(i,f);return[f,{id:S?.id,value:S?.value}]}));n.emitBefore();try{i=Cc(h),z();for(let f of P.keys()){let S=_e(i,f),A=p.get(f);if(A?.id!==S?.id||A?.value!==S?.value)Q(f)}}catch(f){i=void 0,z(),ce(),t.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:e,error:f instanceof Error?f.message:String(f)})}finally{n.emitAfter()}},B=()=>{try{a?.()}catch(h){t.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:e,error:h instanceof Error?h.message:String(h)})}a=void 0},ae=(h,p)=>{m=h,C=p,u+=1;let f=u;B(),h.subscribe(p,(S)=>{if(u!==f||!s)return;J(S.data)},{kmsSlots:g}).then((S)=>{if(u!==f||!s){S();return}a=S}).catch((S)=>{if(u!==f||!s)return;i=void 0,z(),ce(),t.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:e,path:p,error:S instanceof Error?S.message:String(S)})})},re=(h,p)=>{let f=R(h),S=_e(i,h);if(!s)return Promise.reject(Error(`${b(h)} is no longer configured.`));if(k())return Promise.reject(Error(`${b(h)} verifier grant has no slots.`));if(S?.value)return Promise.resolve(S.value);if(!f.valueWaiter){let N,Y,K=new Promise((oe,te)=>{N=oe,Y=te});f.valueWaiter={promise:K,resolve:N,reject:Y}}let A=f.valueWaiter.promise;return W(h),Rr(A,p,`${b(h)} was not ready within ${p}ms.`)},ne=(h,p)=>{let f=R(h);f.listeners.add(p);let S=_e(i,h);return p(S?as(S):void 0),()=>f.listeners.delete(p)};function R(h){let p=P.get(h);if(p)return p;let f=ye(b(h),()=>s&&_e(i,h)!==void 0),S={listeners:new Set,latch:f,api:{value:(A)=>re(h,A),current:()=>_e(i,h)?.value,subscribe:(A)=>ne(h,A),park:(A,N)=>H(A,N),isReady:f.isReady,ready:f.ready}};return P.set(h,S),S}let M=(h)=>{if(k())throw Error(`KMS pool "${e}" verifier grant has no slots.`);let p=Oc(h),f=p>g;g=Math.max(g,p);let S=[];for(let A=0;A<p;A+=1)S.push(R(A).api);if(f&&s&&m&&C)ae(m,C);return S},G=(h)=>yn(i).find((p)=>p.value!==void 0&&cs(h,p.value)),H=(h,p)=>{if(!s||!m||!C)return Promise.reject(Error(`KMS pool "${e}" is not configured.`));if(typeof h.value!=="string"||h.value.length===0)return Promise.reject(Error(`KMS pool "${e}" park() requires a non-empty value.`));let f=G(h.value);if(!f)return Promise.resolve({parked:!1,stale:!0});return Rr(m.parkKmsKey(C,{keyId:f.id,status:h.status,reason:h.reason},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" park() did not complete within ${p}ms.`)},v=()=>{if(!s||!m||!C)throw Error(`KMS pool "${e}" is not configured.`);return{source:m,path:C}},U=(h)=>{if(!Array.isArray(h)||h.length===0)throw Error(`KMS pool "${e}" addKeys() requires a non-empty keys array.`);return h.map((p,f)=>{if(!p||typeof p!=="object")throw Error(`KMS pool "${e}" addKeys() keys[${f}] must be an object.`);if(typeof p.value!=="string"||p.value.length===0)throw Error(`KMS pool "${e}" addKeys() keys[${f}].value must be a non-empty string.`);if(p.id!==void 0&&(typeof p.id!=="string"||p.id.length===0))throw Error(`KMS pool "${e}" addKeys() keys[${f}].id must be a non-empty string when present.`);return p})},I=(h,p)=>{try{let{source:f,path:S}=v(),A=U(h);return Rr(f.addKmsKeys(S,{keys:A},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" addKeys() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},x=(h,p)=>{try{let{source:f,path:S}=v();if(typeof h.keyId!=="string"||h.keyId.length===0)throw Error(`KMS pool "${e}" revokeKey() requires a non-empty keyId.`);return Rr(f.revokeKmsKey(S,h,p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" revokeKey() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},q=(h)=>{let{source:p}=v();if(!p.subscribeEvents)throw Error(`KMS pool "${e}" events are not supported by this secrets transport.`);return E.add(h),ee(),()=>{E.delete(h)}};R(0);let w={value:(h)=>re(0,h),current:()=>_e(i,0)?.value,unique:M,accepts:(h)=>yn(i).some((p)=>p.value!==void 0&&cs(h,p.value)),park:H,subscribe:(h)=>ne(0,h),beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:T.isReady,ready:T.ready},_={addKeys:I,revokeKey:x,events:q,isReady:l.isReady,ready:l.ready};return{api:w,issuer:_,update(h,p,f){let S=is({config:h,path:f});if(s=!0,c===S){se();return}c=S,B(),Z(),ue(),i=void 0,se(),r(),ce(),F(),ae(p,f),ee()},unavailable(h){s=!0,c=is(h),u+=1,m=void 0,C=void 0,Z(),B(),ue(),i=void 0,se(),r(),ce(),F()},remove(){if(!s)return;n.emitBefore(),s=!1,c=void 0,u+=1,m=void 0,C=void 0,Z(),B(),ue(),i=void 0,se(),r(),ce(),F(),n.emitAfter()},close(){s=!1,u+=1,m=void 0,C=void 0,Z(),E.clear(),B(),ue();for(let h of P.values())h.listeners.clear();i=void 0,F();for(let h of P.values())h.latch.settle();T.settle(),l.settle()},isConfigured:()=>s}}function ls(e){let t=new Map,r=new Map,n=We(e,"KMS"),o=!1,i=ye("KMS module",()=>o&&Array.from(t.values()).every((m)=>!m.isConfigured()||m.api.isReady())),c,u=()=>i.refresh(),a=(m)=>{let C=t.get(m);if(C)return C;let P=Lc(m,e,u);if(t.set(m,P),!(m in c))Object.assign(c,{[m]:P.api});return P},d=(m)=>{let C=t.get(m);if(!C)throw Error(`KMS pool "${m}" is not configured.`);return C.api},g=(m)=>{let C=t.get(m);if(!C)throw Error(`KMS pool "${m}" is not configured.`);return C.issuer};return c={get config(){return Object.fromEntries(r)},beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:i.isReady,ready:i.ready,listPools:()=>Array.from(r.keys()),getPool:d,issuer:g},{handle:()=>c,update(m,C){if(!m&&!o&&t.size===0)return;n.emitBefore(),o=m!==void 0;let P=new Set(Object.keys(m??{}));for(let[E,O]of Object.entries(m??{})){r.set(E,{...O});let k=O.path??`/kms/${E}`;try{a(E).update(O,C(O),k)}catch(T){a(E).unavailable(O),e.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:E,error:T instanceof Error?T.message:String(T)})}}for(let[E,O]of t){if(P.has(E))continue;r.delete(E),O.remove()}return i.refresh(),n.emitAfter(),o||t.size>0?c:void 0},close(){for(let m of t.values())m.close();t.clear(),r.clear(),o=!1,i.settle()}}}import{formatLogLine as Uc}from"@ionite/core";import{context as xc,trace as Mc}from"@opentelemetry/api";import{logs as Wc,SeverityNumber as Ne}from"@opentelemetry/api-logs";import{OTLPLogExporter as jc}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as $c}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as qc}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as Nc}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as Kc}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as Vc}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as Fc}from"@opentelemetry/resources";import{BatchLogRecordProcessor as Dc}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as zc}from"@opentelemetry/sdk-metrics";import{NodeSDK as Bc}from"@opentelemetry/sdk-node";var fs={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},Gc={trace:!1,debug:!1,info:!0,warn:!0,error:!0},Jc={trace:Ne.TRACE,debug:Ne.DEBUG,info:Ne.INFO,warn:Ne.WARN,error:Ne.ERROR};function wn(e,t){let r=t[e];if(r===!1)return!1;if(e==="metrics")return r===!0||typeof r==="object";return!0}function vn(e){return typeof e==="object"&&e!==null?e:void 0}function Hc(e){return typeof e==="object"&&e!==null?e:void 0}function Yc(e,t){let r=e.replace(/\/+$/,"");if(r.endsWith(fs[t]))return r;return`${r}${fs[t]}`}function Xc(e,t){let r=vn(e[t]);if(r?.endpoint)return r.endpoint;if(!e.endpoint)return;return Yc(e.endpoint,t)}function Zc(e,t,r){let n=vn(e[t]),o={...e.headers,...n?.headers??{}};if(r)o.Authorization=`Bearer ${r}`;return o}function Sn(e,t,r){let n=vn(e[t]);return{url:Xc(e,t),headers:Zc(e,t,r),timeoutMillis:n?.timeoutMillis,concurrencyLimit:n?.concurrencyLimit}}function Qc(e,t){let r=Sn(e,"traces",t);return e.protocol==="http/json"?new Kc(r):new Vc(r)}function eu(e,t){let r=Sn(e,"metrics",t);return e.protocol==="http/json"?new qc(r):new Nc(r)}function tu(e,t){let r=Sn(e,"logs",t);return e.protocol==="http/json"?new jc(r):new $c(r)}function ru(e){return{"service.name":e.name,...e.version?{"service.version":e.version}:{},...e.deploymentEnvironment?{"deployment.environment.name":e.deploymentEnvironment}:{},...e.resourceAttributes??{}}}async function nu(e){if(!e.oauth)return;let t=new URLSearchParams({grant_type:"client_credentials",client_id:e.oauth.clientId,client_secret:e.oauth.clientSecret});if(e.oauth.scope)t.set("scope",e.oauth.scope);if(e.oauth.audience)t.set("audience",e.oauth.audience);let r=await fetch(e.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...e.oauth.headers??{}},body:t});if(!r.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${r.status}`);let n=await r.json();if(typeof n.access_token!=="string"||!n.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return n.access_token}function ou(e,t){return{...Gc,...t?.levels??{},...e.levels??{}}}function Yt(e,t="Authorization"){let r={...e.headers??{}};if(!e.apiKey)return r;let n=e.apiKeyHeader??t;return r[n]=n.toLowerCase()==="authorization"?`Bearer ${e.apiKey}`:e.apiKey,r}function su(e,t){return Object.keys(e).some((r)=>r.toLowerCase()===t.toLowerCase())}function gs(e,t,r){let n=Object.keys(e).find((o)=>o.toLowerCase().startsWith(t.toLowerCase()));if(n)throw Error(`OpenTelemetry provider "${r}" does not support provider-specific header "${n}".`)}function Xt(e,t,r,n){return{type:r,name:e.name,version:e.version,protocol:e.protocol??"http/protobuf",endpoint:e.endpoint,headers:n,resourceAttributes:ru(e),levels:ou(e,t),console:e.console??"info",traces:e.traces,metrics:e.metrics,logs:e.logs}}function iu(e,t){return Xt(e,t,"otlp",Yt(e))}function au(e,t){return Xt(e,t,"grafana-lgtm",Yt(e))}function cu(e,t){let r=Yt(e,"DD-API-KEY");if(!su(r,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return Xt(e,t,"datadog",r)}function uu(e,t){let r=Yt(e);return gs(r,"DD-","splunk"),Xt(e,t,"splunk",r)}function du(e,t){let r=Yt(e);return gs(r,"DD-","elastic"),Xt(e,t,"elastic",r)}function lu(e,t){let r=e.type??"otlp";switch(r){case"otlp":return iu(e,t);case"grafana-lgtm":return au(e,t);case"datadog":return cu(e,t);case"splunk":return uu(e,t);case"elastic":return du(e,t);default:throw Error(`Unsupported OpenTelemetry provider type: ${r}`)}}function fu(e,t){if(typeof e==="string")return e;if(e instanceof Error)return e.message;if(e!=null)return hn(e);if(t.length===0)return"";return hn(t[0])}function hn(e){if(typeof e==="string")return e;try{return JSON.stringify(e)}catch{return String(e)}}function ps(e,t,r){if(r==null)return;if(typeof r==="string"||typeof r==="number"||typeof r==="boolean"){e[t]=r;return}if(Array.isArray(r)&&r.every((n)=>["string","number","boolean"].includes(typeof n))){e[t]=r;return}if(r instanceof Error){if(e[`${t}.name`]=r.name,e[`${t}.message`]=r.message,r.stack)e[`${t}.stack`]=r.stack;return}e[t]=hn(r)}function pu(e){let t={};for(let[n,o]of e.entries()){if(o&&typeof o==="object"&&!Array.isArray(o)&&!(o instanceof Error)&&Object.getPrototypeOf(o)===Object.prototype){for(let[s,i]of Object.entries(o))ps(t,s,i);continue}ps(t,`param.${n}`,o)}let r=Mc.getSpanContext(xc.active());if(r)t.trace_id=r.traceId,t.span_id=r.spanId,t.trace_flags=r.traceFlags;return t}function mu(e){return e}function gu(e,t){globalThis.console[mu(e)](Uc(e,t.body,[t.attributes??{}]))}function yu(e,t,r,n){if(r.console==="off")return;if((t.severityNumber??0)<Jc[r.console])return;let o=n?.console;if(o){o(t);return}gu(e,t)}function wu(e,t){let r=Wc.getLogger(e.name,e.version),n=(o,s,i)=>{if(!e.levels[o])return;let c={severityNumber:s,severityText:o.toUpperCase(),body:fu(i[0],i.slice(1)),attributes:pu(i.slice(1))};try{r.emit(c)}finally{yu(o,c,e,t)}};return{trace:(o,...s)=>n("trace",Ne.TRACE,[o,...s]),debug:(o,...s)=>n("debug",Ne.DEBUG,[o,...s]),info:(o,...s)=>n("info",Ne.INFO,[o,...s]),warn:(o,...s)=>n("warn",Ne.WARN,[o,...s]),error:(o,...s)=>n("error",Ne.ERROR,[o,...s])}}function hu(e){return e?.current()}function vu(e,t,r){let n=t;return e.subscribe((o)=>{let s=o?.value;if(s===n)return;n=s,r()})}function ms(e){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:e,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function kn(e,t,r,n){if(!t&&!r)return;if(!t)return ms(e);let o=t,s;if(o.apiKeyPool&&n)try{s=n.getPool(o.apiKeyPool)}catch{s=void 0}let i=hu(s),c=()=>kn(e,o,r,n),u=o.apiKeyPool&&n?(T)=>vu(n.getPool(o.apiKeyPool),i,T):void 0;if(o.apiKeyPool&&!i){let T=ms(e);return T.onCredentialChange=u,T.rebuild=c,T}let a=i?{...o,apiKey:i}:o,d=lu(a,r),g,m=!1,C=wu(d,r),P,E,O=new Promise((T,l)=>{P=T,E=l});async function k(){try{let T=await nu(o),l={resource:Fc(d.resourceAttributes),instrumentations:r?.instrument};if(r?.sampler)l.sampler=r.sampler;if(r?.textMapPropagator)l.textMapPropagator=r.textMapPropagator;if(r?.contextManager)l.contextManager=r.contextManager;if(r?.spanProcessors)l.spanProcessors=r.spanProcessors;else if(wn("traces",d))l.traceExporter=Qc(d,T);if(r?.metricReaders)l.metricReaders=r.metricReaders;else if(wn("metrics",d)){let W=Hc(d.metrics);l.metricReaders=[new zc({exporter:eu(d,T),exportIntervalMillis:W?.exportIntervalMillis,exportTimeoutMillis:W?.exportTimeoutMillis})]}if(r?.logRecordProcessors)l.logRecordProcessors=r.logRecordProcessors;else if(wn("logs",d))l.logRecordProcessors=[new Dc({exporter:tu(d,T)})];let b=r?.configure?.(l);g=new Bc(b??l),g.start(),m=!0,P?.()}catch(T){m=!1;let l=T instanceof Error?T:Error(String(T));e.error?.("OpenTelemetry startup failed",l),E?.(l)}finally{P=void 0,E=void 0}}return{state:"available",start:k,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>m,ready:(T)=>{if(!T||T<=0)return O;return Promise.race([O,new Promise((l,b)=>{setTimeout(()=>b(Error(`OpenTelemetry ready timed out after ${T}ms.`)),T)})])},logger:C,forceFlush:async()=>{await g?.forceFlush?.()},shutdown:async()=>{m=!1,await g?.shutdown(),g=void 0},onCredentialChange:u,rebuild:c}}function ys(e){let t,r,n,o=0,s=Promise.resolve(),i=We(e,"OpenTelemetry"),c=ye("OpenTelemetry module",()=>t?.isReady()===!0),u={beforeChange:i.beforeChange,afterChange:i.afterChange,isReady:c.isReady,ready:c.ready,logger:{trace:(g,...m)=>(t?.logger??e).trace(g,...m),debug:(g,...m)=>(t?.logger??e).debug(g,...m),info:(g,...m)=>(t?.logger??e).info(g,...m),warn:(g,...m)=>(t?.logger??e).warn(g,...m),error:(g,...m)=>(t?.logger??e).error(g,...m)},forceFlush:async()=>{await t?.forceFlush()},shutdown:async()=>{await t?.shutdown()}},a=!1,d;return d={update(g){if(!g){if(t||r){let E=t,O=r;o+=1,i.emitBefore(),n?.(),n=void 0,t=void 0,r=void 0,c.refresh(),s=Promise.all([E?.shutdown(),O?.shutdown()]).finally(()=>i.emitAfter()).then(()=>{return},()=>{return})}return a?u:void 0}if(a=!0,g===t||g===r)return u;let m=t,C=r;o+=1;let P=o;return i.emitBefore(),n?.(),n=void 0,t=void 0,r=g,c.refresh(),s=(async()=>{try{if(await Promise.all([m?.shutdown(),C?.shutdown()]),await g.start(),P!==o||r!==g){await g.shutdown();return}t=g,r=void 0,c.refresh(),n=g.onCredentialChange?.(()=>{if(t!==g)return;let E=g.rebuild?.();if(E)d.update(E)})}finally{if(P===o)i.emitAfter()}})().then(()=>{return},()=>{return}),u},settled(){return s},async shutdown(){o+=1;let g=t,m=r;n?.(),n=void 0,t=void 0,r=void 0,c.settle(),await Promise.all([g?.shutdown(),m?.shutdown()])}},d}import{ION_ENDPOINT_PERMISSIONS as Ot,trimTrailingSlash as ws}from"@ionite/core";import{hasPermission as Su}from"@ionite/core/server";async function pt(e,t,r){let n=await Su(e,t,r.permission,void 0,r.subjectType);return n.allow?void 0:n.response()}function ku(e){let t=ws(e);return{matchesPath:(o)=>{if(!o)return!1;return ws(o)===t},startsWithPath:(o)=>{if(!o)return!1;return e===o||e.startsWith(`${o}/`)}}}function hs(e,t,r,n){let o=n??new URL(e.url).pathname,{matchesPath:s,startsWithPath:i}=ku(o);if(t.sso){let c=t.sso;if(s(r.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(u)=>c.handler(u)};if(s(r.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(u)=>c.logout(u)};if(s(r.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(u)=>c.logoutBackChannel(u)};if(s(r.sso.loginUrl)||s(r.sso.refreshUrl)||s(r.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(u)=>c.handler(u)}}if(t.ciam){let c=t.ciam;if(s(r.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(u)=>{let a=await c.resolveCustomer(u);if(a.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(a.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(a.value),{headers:{"Content-Type":"application/json"}})}};if(s(r.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(u)=>c.logout(u)}}if(t.iam){let c=t.iam,u=e.method!=="GET"&&e.method!=="HEAD";if(i(r.iam.usersUrl))return{module:"iam",kind:u?"iam.users.write":"iam.read",requiredPermission:Ot[u?"iam.users.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.groupsUrl))return{module:"iam",kind:u?"iam.groups.write":"iam.read",requiredPermission:Ot[u?"iam.groups.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.workloadsUrl))return{module:"iam",kind:u?"iam.workloads.write":"iam.read",requiredPermission:Ot[u?"iam.workloads.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.customersUrl))return{module:"iam",kind:u?"iam.customers.write":"iam.read",requiredPermission:Ot[u?"iam.customers.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(`${r.iam.basePath}/AccessRequests`))return{module:"iam",kind:"iam.access-requests.write",requiredPermission:Ot["iam.access-requests.write"],handler:async(a)=>c.handler(a)};if(i(r.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(a)=>c.handler(a)}}if(t.workload){let c=t.workload;if(s(r.workload.validateUrl)||s(r.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(u)=>c.handler(u)}}if(t.secrets){let c=t.secrets;if(c.isLfvDeliveryRequest?.(e)&&c.handleLfvDelivery){let u=c.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(a)=>u(a)}}if(c.isLfvEventsRequest?.(e)&&c.handleLfvEvents){let u=c.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(a)=>u(a)}}}if(t.ciam){let c=t.ciam;if(s(r.ciam.magicLinkUrl)&&e.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:Ot["ciam.magic-link.create"],handler:async(u)=>c.handler(u)};if(s(r.ciam.magicLinkLoginUrl)&&e.method==="GET"||s(r.ciam.customerProvidersUrl)&&e.method==="GET"||s(r.ciam.customerLoginUrl)&&e.method==="GET"||s(r.ciam.customerCallbackUrl)&&(e.method==="GET"||e.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(u)=>c.handler(u)}}return}async function bn(e,t,r,n){let o=n??Fe(ur()),s=new URL(e.url).pathname;if(r?.filter){let g=await r.filter(e,t);if(g instanceof Response)return g;if(g==="not_handled")return me()}let i=hs(e,t,o,s),u=await r?.resolve?.(e,t,i)??i;if(!u)return me();let a=u.requiredPermission===void 0?i?.requiredPermission:u.requiredPermission,d=async()=>{if(a){let g=await pt(e,t,a);if(g)return g}return u.handler(e)};if(r?.wrap)return await r.wrap(e,u,d,t);return await d()}import{stableConfigHash as Vu}from"@ionite/core";function Cr(){let e=0;return{next:()=>(e+=1,e),isCurrent:(t)=>t===e,current:()=>e}}import{readFile as ju,stat as $u}from"node:fs/promises";class Et extends Error{constructor(e,t,r){super(e);this.code=t;this.status=r;this.sourceType="vault";this.name="VaultWebSocketCommandError"}}class Be extends Error{constructor(e,t=`Vault secret not found at path ${e}`){super(t);this.path=e;this.sourceType="vault";this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}}class ge extends Error{constructor(e,t,r,n,o){super(e,o);this.path=t;this.status=r;this.code=n;this.sourceType="vault";this.name="VaultRequestError"}}class Le extends Error{constructor(e,t,r=`Vault subscribe is not supported for source ${e} at path ${t} without websocket, LFV, or ttl`){super(r);this.sourceType=e;this.path=t;this.name="VaultSubscribeNotSupportedError"}}function vs(e){return e instanceof Be||e instanceof Et&&(e.code==="not_found"||e.status===404)}import{WebSocket as Zt}from"ws";var bu=1000,Ru=30000,ks=30000,bs=ks;function Rs(e){bs=e>0?e:ks}function Cs(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Cu(e){let t=Math.min(Ru,bu*2**Math.min(e,16)),r=0.5+Math.random()*0.5;return Math.round(t*r)}var mt=new Map;function Tu(e){return e.trim().replace(/\/+$/g,"")}function Ts(e,t){let r=typeof t?.version==="number"?t.version:0,n=t?.created_time??t?.created,o=typeof n==="string"?new Date(n):new Date,s=ut(t);return{path:e,version:r,created:o,...s?{contentType:s}:{}}}function Pu(e){return typeof e?.version==="number"?e.version:void 0}function Iu(e){let t=e.token?.trim();if(!t)return{};if(e.header==="Authorization")return{Authorization:t.startsWith("Bearer ")?t:`Bearer ${t}`};return{"X-Vault-Token":t}}function Qt(e){return{client_id:e.clientId,token:e.token,header:e.header??"X-Vault-Token"}}function Cn(e,t){let r=Tu(e),n=mt.get(r);if(n){if(t&&!n.log)n.log=t;return n}let o={url:r,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:t};return mt.set(r,o),o}function Ou(e){let t=[...Array.from(e.subs.values(),(o)=>o.creds),...e.eventListeners.values()];if(t.length===0)return e.lastGoodCreds??{url:e.url};let r=e.lastGoodCreds?[e.lastGoodCreds,...t]:t,n=r[e.reconnectCredCursor%r.length]??t[0];return e.reconnectCredCursor+=1,n}function Ss(e,t){for(let r of e.subs.values())try{r.onHealth?.(t)}catch(n){e.log?.warn("Vault websocket health hook threw",n)}}function Eu(e,t){for(let r of Array.from(e.subs.values())){let n=r.onFirstSecretReject;if(r.onFirstSecret=void 0,r.onFirstSecretReject=void 0,n)try{n(new ge(`Vault websocket subscription interrupted (${t})`,r.path,void 0,"connection"))}catch(o){e.log?.warn("Vault websocket first-secret waiter rejection threw",o)}}}function Ps(e,t){for(let r of e.pending.values())clearTimeout(r.timer),r.reject(new ge(`Vault websocket command interrupted (${t})`,"/",void 0,"connection"));e.pending.clear()}function Tr(e){if(e.disposed)return;if(e.disposed=!0,e.reconnectTimer)clearTimeout(e.reconnectTimer),e.reconnectTimer=void 0;Ps(e,"closed"),Eu(e,"socket disposed");let t=e.ws;if(e.ws=void 0,e.connectPromise=void 0,e.hasConnected=!1,mt.delete(e.url),t)try{t.removeAllListeners(),t.close()}catch{}}function Pr(e){if(e.subs.size>0||e.pending.size>0||e.eventListeners.size>0)return;Tr(e)}function Rn(e){return`${e.clientId??""}|${e.token??""}|${e.header??"X-Vault-Token"}`}function Is(e){let t=new Map;for(let r of e.eventListeners.values())t.set(Rn(r),r);return Array.from(t.values())}function Au(e,t){if(typeof t.path!=="string"||typeof t.event!=="string")return;let r={path:t.path,event:t.event,...typeof t.request_id==="string"?{requestId:t.request_id}:{},...typeof t.key_id==="string"&&t.key_id.length>0?{keyId:t.key_id}:{}};for(let n of e.eventListeners.keys())try{n(r)}catch(o){e.log?.warn("Vault websocket event listener threw",o)}}function Os(e,t,r,n){if(n!==void 0&&t.lastVersion!==void 0&&n===t.lastVersion)return;if(n!==void 0)t.lastVersion=n;try{t.onChange(r)}catch(s){e.log?.warn("Vault websocket subscription onChange threw",s)}let o=t.onFirstSecret;if(t.onFirstSecret=void 0,t.onFirstSecretReject=void 0,o)try{o()}catch(s){e.log?.warn("Vault websocket subscription onFirstSecret threw",s)}}function _u(e,t){let r=t.subscription_id;if(typeof r!=="string")return;let n=e.subs.get(r);if(!n)return;let o={data:t.data,metadata:Ts(typeof t.path==="string"?t.path:n.path,t.metadata)};Os(e,n,o,Pu(t.metadata))}function Lu(e,t){let r;try{r=JSON.parse(t.toString())}catch(n){e.log?.warn("Vault websocket message parse failed",n);return}if(r.type==="secret"){_u(e,r);return}if(r.type==="event"){Au(e,r);return}if(r.type==="command_result"&&typeof r.id==="string"){let n=e.pending.get(r.id);if(!n)return;if(e.pending.delete(r.id),clearTimeout(n.timer),r.ok===!1)n.reject(new Et(r.error??`Vault websocket command failed for ${r.id}`,r.code,r.status));else n.resolve(r.result);Pr(e)}}function Es(e,t){e.send(JSON.stringify({type:"subscribe",subscription_id:t.subscriptionId,paths:[t.path],...Cs(t.kmsSlots),...Qt(t.creds)}))}function Tn(e){if(e.disposed||e.reconnectTimer||e.subs.size===0&&e.eventListeners.size===0)return;let t=Cu(e.reconnectAttempts);e.reconnectAttempts+=1,e.reconnectTimer=setTimeout(()=>{if(e.reconnectTimer=void 0,e.disposed)return;if(e.subs.size===0&&e.eventListeners.size===0){Tr(e);return}Ir(e,Ou(e)).catch(()=>{if(e.hasConnected)e.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${t}ms).`);Tn(e)})},t)}function Ir(e,t){if(e.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if(e.ws&&e.ws.readyState===Zt.OPEN)return Promise.resolve(e.ws);if(e.connectPromise)return e.connectPromise;return e.connectPromise=new Promise((r,n)=>{let o=new Zt(e.url,{headers:Iu(t)}),s=!1,i=e.hasConnected,c=()=>{s=!0,e.hasConnected=!0,e.reconnectAttempts=0,e.reconnectCredCursor=0,e.lastGoodCreds=t,e.ws=o,e.connectPromise=void 0,o.on("message",(d)=>Lu(e,d));for(let d of e.subs.values())try{Es(o,d)}catch{}for(let d of Is(e))try{o.send(JSON.stringify({type:"subscribe_events",...Qt(d)}))}catch{}if(i)Ss(e,!0);r(o)},u=()=>{if(e.ws===o)e.ws=void 0;e.connectPromise=void 0;try{o.removeAllListeners()}catch{}if(Ps(e,"socket closed"),e.subs.size>0||e.eventListeners.size>0)Ss(e,!1),Tn(e);else Tr(e)},a=(d)=>{if(e.ws===o)e.ws=void 0;if(!s)s=!0,e.connectPromise=void 0,n(d)};o.once("open",c),o.on("close",u),o.on("error",a)}),e.connectPromise}async function Pn(e,t,r,n){let o=Cn(e.url,n),s=typeof r.path==="string"?r.path:"/",i=await Ir(o,e),c=crypto.randomUUID();try{return await new Promise((u,a)=>{let d=setTimeout(()=>{if(!o.pending.has(c))return;o.pending.delete(c),a(new ge(`Vault websocket command "${t}" timed out`,s,void 0,"timeout"));try{o.ws?.close()}catch{}},bs);o.pending.set(c,{resolve:(g)=>u(g),reject:a,timer:d});try{i.send(JSON.stringify({type:"command",id:c,command:t,...r,...Qt(e)}))}catch(g){clearTimeout(d),o.pending.delete(c),a(g)}})}finally{Pr(o)}}async function In(e,t,r,n){let o;try{o=await Pn(e,"read_secret",{path:t,...Cs(n)},r)}catch(s){if(vs(s))throw new Be(t);if(s instanceof Et||s instanceof ge)throw s;throw new ge(`Vault websocket read_secret failed for ${t}`,t,void 0,"connection",{cause:s})}if(!o||typeof o!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${t}`);return{data:o.data,metadata:Ts(typeof o.path==="string"?o.path:t,o.metadata)}}async function As(e,t,r,n,o,s){let i=Cn(e.url,o),c=crypto.randomUUID(),u={subscriptionId:c,creds:e,path:t,...n?.kmsSlots!==void 0?{kmsSlots:n.kmsSlots}:{},onChange:r,onHealth:s?.onHealth};i.subs.set(c,u);let a=()=>{if(!i.subs.delete(c))return;if(i.ws&&i.ws.readyState===Zt.OPEN)try{i.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:c}))}catch{}Pr(i)};try{let d=await Ir(i,e);Es(d,u)}catch(d){if(n?.mode!=="wait")throw a(),d}try{let d=await In(e,t,o,n?.kmsSlots);Os(i,u,d,d.metadata.version)}catch(d){if(n?.mode!=="wait")throw a(),d;await new Promise((g,m)=>{let C,P=(E)=>{if(C)clearTimeout(C);u.onFirstSecret=void 0,u.onFirstSecretReject=void 0,a(),m(E)};if(u.onFirstSecret=()=>{if(C)clearTimeout(C);g()},u.onFirstSecretReject=P,typeof n.timeout==="number"&&n.timeout>0)C=setTimeout(()=>P(d),n.timeout)})}return a}async function _s(e,t,r){let n=Cn(e.url,r);n.eventListeners.set(t,e);try{let o=await Ir(n,e);if(o.readyState===Zt.OPEN)o.send(JSON.stringify({type:"subscribe_events",...Qt(e)}))}catch(o){n.log?.warn("Vault websocket event subscription connect failed; retrying in background",o),Tn(n)}return()=>{if(!n.eventListeners.delete(t))return;let o=Rn(e);if(!Is(n).some((i)=>Rn(i)===o)&&n.ws&&n.ws.readyState===Zt.OPEN)try{n.ws.send(JSON.stringify({type:"unsubscribe_events",...Qt(e)}))}catch{}Pr(n)}}function Ls(){let e=0;for(let t of mt.values())e+=t.subs.size;return{urls:Array.from(mt.keys()),sockets:mt.size,subscriptions:e}}function Us(){for(let e of Array.from(mt.values()))Tr(e)}var Or=600000;function gt(e){if(e&&e<Or)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${Or} milliseconds (10 minutes), as not to overload the store with polling requests`)}function Ge(e,t,r,n,o,s,i){let c=!1,u,a,d,g=(k)=>{try{i?.onHealth?.(k)}catch{}},m=()=>{if(c=!0,u)clearTimeout(u),u=void 0;a?.()},C=(k)=>new Promise((T)=>{let l=setTimeout(()=>{a=void 0,u=void 0,T()},k);u=l,a=()=>{clearTimeout(l),a=void 0,u=void 0,T()}});async function P(){let k=Date.now();for(;;){if(c)return;try{let T=await e.getFullSecret(t,s);return g(!0),T}catch(T){if(g(!1),s?.mode!=="wait")throw T;if(typeof s.timeout==="number"&&s.timeout>0&&Date.now()-k>=s.timeout)throw T;if(c)return;o?.warn(`Error retrieving initial secret from vault. Retrying in ${n} milliseconds`,T),await C(n)}}}async function E(){if(u=void 0,c)return;try{let k=await e.getFullSecret(t,s);if(g(!0),k.metadata.version!==d)d=k.metadata.version,r(k)}catch(k){g(!1),o?.warn(`Error retrieving remote config from vault. Retrying in ${n} milliseconds`,k)}O()}function O(){if(c)return;u=setTimeout(()=>{E()},n)}return P().then((k)=>{if(c||!k)return()=>m();return d=k.metadata.version,r(k),O(),()=>m()})}function Uu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function xu(e){let t={"Content-Type":"application/json"};if(e)t["X-Vault-Token"]=e;return t}function Mu(e){return Boolean(e?.idpTokenUrl?.trim()&&e.clientId?.trim()&&e.clientSecret?.trim())}async function xs(e,t){let r=Date.now();if(t.token&&t.expiresAt&&t.expiresAt-60000>r)return t.token;let n=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});if(e.scope?.trim())n.set("scope",e.scope.trim());let o=await fetch(e.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()});if(!o.ok)throw Error(`Vault workload token request failed (${o.status})`);let s=await o.json();if(!s.access_token)throw Error("Vault workload token response did not include access_token");return t.token=s.access_token,t.expiresAt=r+Math.max(1,s.expires_in??300)*1000,s.access_token}function Wu(e){return{Authorization:e.startsWith("Bearer ")?e:`Bearer ${e}`}}function er(e){return e.replace(/\/data\/?$/,"")}function Ms(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let n=e;if(typeof n.parked!=="boolean")throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let o=n.disposition;if(o!==void 0&&o!=="cooldown"&&o!=="suspect")throw Error(`Vault ${r} kms_park returned invalid disposition for ${t}`);return{parked:n.parked,...n.stale===!0?{stale:!0}:{},...o?{disposition:o}:{}}}function Ws(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);let n=e;if(!Array.isArray(n.keys))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);return{keys:n.keys.map((s,i)=>{if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}] for ${t}`);let c=s.id;if(typeof c!=="string"||c.length===0)throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}].id for ${t}`);return{id:c}})}}function js(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);let n=e;if(typeof n.revoked!=="boolean")throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);return{revoked:n.revoked}}function At(e,t){let{type:r="vault",url:n,token:o,ttl:s}=e,i=()=>e.log,c=Mu(e.workload)?e.workload:void 0,u={},a=xu(o),{lfv:d,websocket:g}=e,m=d?lt({...d,log:d.log??i(),path:d.path??"/"},t):void 0,C=new Map,P=g?.url?.trim(),E=new Set,O=!1,k=!1;if(!d&&!n&&!P)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(gt(s),n&&!o&&!c&&!d)i()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function T(){if(c){let w=await xs(c,u);return{"Content-Type":"application/json",...Wu(w)}}return{...a}}async function l(w){let _=F(w);if(c){let h=await xs(c,u);return{url:_,clientId:g?.clientId??c.clientId,token:h,header:"Authorization"}}return{url:_,clientId:g?.clientId,token:g?.token??o,header:g?.header??"X-Vault-Token"}}function b(w){if(!d)throw Error(`Vault LFV capability is not configured for path ${w}`);let _=C.get(w);if(_)return _;let h=lt({...d,log:d.log??i(),path:w},t);return C.set(w,h),h}function W(w){if(!n)throw Error(`Vault HTTP capability is not configured for path ${w}`);return n}function F(w){if(!P)throw Error(`Vault websocket capability is not configured for path ${w}`);return P}async function Q(w,_){let h=await l(typeof _.path==="string"?_.path:"/");return Pn(h,w,_,i())}async function ce(w,_){let h=W(w),p;try{let f=await T(),S=new URL(`${h}/${w}`);if(typeof _?.kmsSlots==="number"&&Number.isInteger(_.kmsSlots)&&_.kmsSlots>=1)S.searchParams.set("kms_slots",String(_.kmsSlots));p=await fetch(S,{headers:f})}catch(f){throw new ge(`Vault request failed from URL: ${h}/${w}`,w,void 0,"connection",{cause:f})}if(p.status!==200){if(p.status===404)throw new Be(w);let f=p.status===401||p.status===403,S=f?`Vault returned ${p.status} ${p.statusText} (auth error) from URL: ${h}/${w}`:`Vault returned invalid status, ${p.status}: '${p.statusText}' from URL: ${h}/${w}`;throw new ge(S,w,p.status,f?"auth":"invalid_status")}try{let S=(await p.json()).data;if(!S?.metadata||!("data"in S))throw Error("Missing vault secret data");let A=S.metadata.created_time??S.metadata.created;return{data:S.data,metadata:{path:typeof S.metadata.path==="string"?S.metadata.path:w,version:typeof S.metadata.version==="number"?S.metadata.version:0,created:A instanceof Date?A:typeof A==="string"?new Date(A):new Date,...ut(S.metadata)?{contentType:ut(S.metadata)}:{}}}}catch(f){throw new ge("Error retrieving secret",w,void 0,"invalid_payload",{cause:f})}}async function se(w,_){let h=await l(w);return In(h,w,i(),_?.kmsSlots)}async function Z(w){let _=W(w),h=`${er(_)}/metadata/${w}`,p=await T(),f=await fetch(h,{headers:p});if(f.status!==200)throw new ge(`Vault getMetadata failed (${f.status}) for ${w}`,w,f.status,"invalid_status");let S=await f.json().catch(()=>null);if(!S?.metadata||typeof S.metadata!=="object")throw new ge(`Vault getMetadata returned invalid payload for ${w}`,w,f.status,"invalid_payload");return S.metadata}async function ee(w,_,h){let p=W(_),f=`${er(p)}/${w}/${_}`,S=await T(),A=await fetch(f,{method:"POST",headers:S,body:JSON.stringify({reason:h?.reason,severity:h?.severity,incident_ref:h?.incidentRef})});if(A.status!==200&&A.status!==202&&A.status!==204)throw new ge(`Vault ${w} failed (${A.status}) for ${_}`,_,A.status,"invalid_status")}async function ue(w,_){if(d)return await b(w).getFullSecret(w,_);if(n)return await ce(w,_);return await se(w,_)}async function z(w,_,h){if(!Uu(_))throw Error(`putSecret requires an object value for vault source at path ${w}`);if(d){await b(w).putSecret(w,_,h);return}if(n){let p=W(w),f=await T();if(f["X-Ionite-Mime-Type"]=h.contentType.mimeType,f["X-Ionite-Secret-Format"]=h.contentType.format,h.contentType.schemaUrl)f["X-Ionite-Schema-Url"]=h.contentType.schemaUrl;if(h.contentType.typeId)f["X-Ionite-Secret-Type"]=h.contentType.typeId;let S=await fetch(`${p}/${w}`,{method:"POST",headers:f,body:JSON.stringify(_)});if(S.status!==200&&S.status!==201&&S.status!==204)throw new ge(`Vault putSecret failed (${S.status}) for ${w}`,w,S.status,"invalid_status");return}await Q("put_secret",{path:w,data:_,content_type:yr(h.contentType)})}async function J(w,_){if(d){await b(w).deleteSecret(w,_);return}if(n){let h=W(w),p=await T(),f=await fetch(`${h}/${w}`,{method:"DELETE",headers:p});if(f.status!==200&&f.status!==202&&f.status!==204)throw new ge(`Vault deleteSecret failed (${f.status}) for ${w}`,w,f.status,"invalid_status");return}await Q("delete_secret",{path:w})}async function B(w,_){if(d)return await b(w).listPaths(w,_);if(n){let f=`${W(w)}/${w}`,S=async(K)=>{let oe=await T();if(K==="LIST")return fetch(f,{method:"LIST",headers:oe});let te=f.includes("?")?"&":"?";return fetch(`${f}${te}list=true`,{method:"GET",headers:oe})},A=await S("LIST");if(A.status===405||A.status===501)A=await S("GET");if(A.status!==200)throw new ge(`Vault listPaths failed (${A.status}) for ${w}`,w,A.status,"invalid_status");let N=await A.json().catch(()=>null),Y;if(N&&typeof N==="object"){let K=N,oe=K.data;if(oe&&typeof oe==="object")Y=oe.keys;else Y=K.keys}if(!Array.isArray(Y))throw new ge(`Vault listPaths returned an unexpected response for ${w}`,w,void 0,"invalid_payload");return Y.filter((K)=>typeof K==="string")}let h=await Q("list_paths",{path:w});if(!Array.isArray(h.items))throw Error(`Vault websocket list_paths returned invalid payload for ${w}`);return h.items.filter((p)=>typeof p==="string")}async function ae(w,_){if(d)return await b(w).exists(w,_);if(n){let p=W(w),f=await T(),S=await fetch(`${p}/${w}`,{headers:f});if(S.status===200)return!0;if(S.status===404)return!1;if(S.status===401||S.status===403)throw new ge(`Vault exists failed (${S.status}) for ${w} (auth error)`,w,S.status,"auth");throw new ge(`Vault exists failed (${S.status}) for ${w}`,w,S.status,"invalid_status")}let h=await Q("exists",{path:w});if(typeof h.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${w}`);return h.exists}async function re(w,_,h){if(d){await b(w).requestRotate(w,_,h);return}if(n){await ee("rotate/request",w,_);return}await Q("request_rotate",{path:w,reason:_?.reason,severity:_?.severity,incident_ref:_?.incidentRef})}async function ne(w,_,h){if(d){await b(w).requestRevoke(w,_,h);return}if(n){await ee("revoke/request",w,_);return}await Q("request_revoke",{path:w,reason:_?.reason,severity:_?.severity,incident_ref:_?.incidentRef})}async function R(w,_,h){if(d)return await b(w).parkKmsKey(w,_,h);if(n){let f=W(w),S=`${er(f)}/kms/park/${w}`,A=await T(),N=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({key_id:_.keyId,status:_.status,reason:_.reason})});if(N.status!==200&&N.status!==202)throw new ge(`Vault kms/park failed (${N.status}) for ${w}`,w,N.status,"invalid_status");return Ms(await N.json().catch(()=>null),w,"http")}let p=await Q("kms_park",{path:w,key_id:_.keyId,status:_.status,reason:_.reason});return Ms(p,w,"websocket")}async function M(w,_,h){if(d)return await b(w).addKmsKeys(w,_,h);if(n){let f=W(w),S=`${er(f)}/kms/add-keys/${w}`,A=await T(),N=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({keys:_.keys})});if(N.status!==200&&N.status!==202)throw new ge(`Vault kms/add-keys failed (${N.status}) for ${w}`,w,N.status,"invalid_status");return Ws(await N.json().catch(()=>null),w,"http")}let p=await Q("kms_add_keys",{path:w,keys:_.keys});return Ws(p,w,"websocket")}async function G(w,_,h){if(d)return await b(w).revokeKmsKey(w,_,h);if(n){let f=W(w),S=`${er(f)}/kms/revoke-key/${w}`,A=await T(),N=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({key_id:_.keyId,reason:_.reason})});if(N.status!==200&&N.status!==202)throw new ge(`Vault kms/revoke-key failed (${N.status}) for ${w}`,w,N.status,"invalid_status");return js(await N.json().catch(()=>null),w,"http")}let p=await Q("kms_revoke_key",{path:w,key_id:_.keyId,reason:_.reason});return js(p,w,"websocket")}async function H(w,_){if(d)return await b(w).getMetadata(w,_);if(n)return await Z(w);let h=await Q("read_metadata",{path:w});if(!h.metadata||typeof h.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${w}`);return h.metadata}async function v(w,_,h){if(!s)throw new Le(r,w);return Ge({getFullSecret:ce},w,_,s,i(),h,{onHealth:(p)=>{O=!p}})}async function U(w,_,h){let p=await l(w);return As(p,w,_,h,i(),{onHealth:(f)=>{k=!f}})}function I(w){let _=()=>{if(E.delete(_))w()};return E.add(_),_}function x(){if(m?.isAvailable?.()===!1)return!0;for(let w of C.values())if(w.isAvailable?.()===!1)return!0;return!1}let q={type:r,isAvailable:()=>!O&&!k&&!x(),get:(w,_)=>qe(()=>ue(w,_)),getFullSecret:ue,getSecret:async(w,_)=>(await ue(w,_)).data,putSecret:z,deleteSecret:J,listPaths:B,exists:ae,requestRotate:re,requestRevoke:ne,parkKmsKey:R,addKmsKeys:M,revokeKmsKey:G,getMetadata:H,subscribe:async(w,_,h)=>{let p;if(P)p=await U(w,_,h);else if(d)p=await b(w).subscribe(w,_,h);else p=await v(w,_,h);return I(p)},...m?{subscribeEvents:(w)=>I(m.subscribeEvents?.(w)??(()=>{}))}:P?{subscribeEvents:(w)=>{let _,h=!1;return l("/").then((p)=>_s(p,w,i())).then((p)=>{if(h){p();return}_=p}).catch((p)=>{i()?.warn("Vault websocket event subscription failed",p)}),I(()=>{h=!0,_?.()})}}:{},close:()=>{for(let _ of Array.from(E))try{_()}catch(h){i()?.warn("Vault source close: failed to release a subscription",h)}E.clear();let w=(_)=>{if(!_?.close)return;try{Promise.resolve(_.close()).catch((h)=>{i()?.warn("Vault source close: LFV close failed",h)})}catch(h){i()?.warn("Vault source close: LFV close failed",h)}};for(let _ of C.values())w(_);w(m),C.clear(),u.token=void 0,u.expiresAt=void 0},get log(){return e.log},set log(w){e.log=w}};if(m)q.isDeliveryRequest=(w)=>m.isDeliveryRequest(w),q.isEventsRequest=(w)=>m.isEventsRequest(w),q.handleDelivery=(w)=>m.handleDelivery(w),q.handleEvents=(w)=>m.handleEvents(w),Object.defineProperties(q,{deliveryPath:{value:m.deliveryPath,enumerable:!0},eventsPath:{value:m.eventsPath,enumerable:!0},callbackKey:{value:m.callbackKey,enumerable:!0},trustId:{value:m.trustId,enumerable:!0}});return q}class Ar extends Error{constructor(e,t){super(e);this.name="AzureKeyVaultError",this.status=t,Object.setPrototypeOf(this,Ar.prototype)}}function Er(e,t){if(!e||e.trim().length===0)throw Error(`Missing required Azure config: ${t}`);return e}function qu(e){return e.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function On(e,t){return`${e.replace(/\/+$/g,"")}/${t.replace(/^\/+/g,"")}`}function Nu(e){try{let r=new URL(e).pathname.split("/").filter(Boolean),n=r.indexOf("secrets");if(n===-1)return;return r[n+2]||void 0}catch{return}}function Ku(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function _r(e){let t=e.apiVersion??"7.4",r=e.scope??"https://vault.azure.net/.default",n=e.secretNameTransform??qu,o=e.authMethod,s="/var/run/secrets/azure/tokens/azure-identity-token",i=e.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",c=e.vaultUrl??(e.vaultName?`https://${e.vaultName}.vault.azure.net`:void 0)??void 0,u=Er(c,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function a(z){try{return await $u(z),!0}catch{return!1}}let d,g,m=!1;async function C(z){let{entraTenantId:J,clientId:B}=e;if(!J)throw Error("Workload identity requires entraTenantId");if(!B)throw Error("Workload identity requires clientId");if(!await a(i))throw Error(`Federated token file not found at ${i}`);let ae=(await ju(i,"utf8")).trim();if(!ae)throw Error("Federated token file was empty");let re=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:B,grant_type:"client_credentials",scope:r,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:ae}),R=await fetch(re,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:ne});if(R.status!==200)throw Error(`Azure workload identity token exchange returned ${R.status} ${R.statusText}`);let M=await R.json();if(!M?.access_token)throw Error("Azure token response missing access_token");return d={accessToken:M.access_token,expiresAtMs:z+(M.expires_in??0)*1000},M.access_token}async function P(z){let J=e.imdsApiVersion??"2018-02-01",B="https://vault.azure.net",ae=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(ae.searchParams.set("api-version",J),ae.searchParams.set("resource","https://vault.azure.net"),e.managedIdentityClientId)ae.searchParams.set("client_id",e.managedIdentityClientId);let re=await fetch(ae.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(re.status!==200)throw Error(`Azure IMDS token endpoint returned ${re.status} ${re.statusText}`);let ne=await re.json();if(!ne?.access_token)throw Error("IMDS token response missing access_token");let R=z+60000;if(ne.expires_on){let M=Number.parseInt(ne.expires_on,10);if(Number.isFinite(M)&&M>0)R=M*1000;else{let G=Date.parse(ne.expires_on);if(Number.isFinite(G))R=G}}else if(ne.expires_in){let M=Number.parseInt(ne.expires_in,10);if(Number.isFinite(M)&&M>0)R=z+M*1000}return d={accessToken:ne.access_token,expiresAtMs:R},ne.access_token}async function E(z){let J=Er(e.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),B=Er(e.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),ae=Er(e.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),re=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:B,client_secret:ae,grant_type:"client_credentials",scope:r}),R=await fetch(re,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:ne});if(R.status!==200)throw Error(`Azure token endpoint returned ${R.status} ${R.statusText}`);let M=await R.json();if(!M?.access_token)throw Error("Azure token response missing access_token");return d={accessToken:M.access_token,expiresAtMs:z+(M.expires_in??0)*1000},M.access_token}async function O(){let z=Date.now();if(d&&d.expiresAtMs-60000>z)return d.accessToken;if(g)return g;g=(async()=>{if(o==="workload_identity")return await C(z);if(o==="managed_identity")return await P(z);if(o==="client_secret")return await E(z);if(await a(i))try{return await C(z)}catch{}try{return await P(z)}catch{}return await E(z)})();try{return await g}finally{g=void 0}}async function k(z){let J=await O(),B=On(u,`/secrets/${encodeURIComponent(z)}?api-version=${encodeURIComponent(t)}`),ae=await fetch(B,{headers:{Authorization:`Bearer ${J}`,Accept:"application/json"}});if(ae.status!==200)throw new Ar(`Key Vault request failed (${ae.status})`,ae.status);return await ae.json()}async function T(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await k(ae),ne=re.value;try{ne=JSON.parse(re.value)}catch{}let R=re.attributes?.created?re.attributes.created*1000:void 0,M=Nu(re.id),G=re.contentType?gr({mimeType:re.contentType,format:re.tags?.["ionite-format"],schemaUrl:re.tags?.["ionite-schema-url"],typeId:re.tags?.["ionite-type-id"]}):void 0;return{data:ne,metadata:{path:z,version:Number.parseInt(M??"",10)||0,created:R?new Date(R):new Date,...G?{contentType:G}:{}}}}async function l(z,J,B){if(!Ku(J))throw Error(`putSecret requires an object value for azure source at path ${z}`);let ae=n(z),re=e.secretNamePrefix?`${e.secretNamePrefix}${ae}`:ae,ne=await O(),R=On(u,`/secrets/${encodeURIComponent(re)}?api-version=${encodeURIComponent(t)}`),M=JSON.stringify({value:JSON.stringify(J),contentType:B.contentType.mimeType,tags:{"ionite-format":B.contentType.format,...B.contentType.schemaUrl?{"ionite-schema-url":B.contentType.schemaUrl}:{},...B.contentType.typeId?{"ionite-type-id":B.contentType.typeId}:{}}}),G=await fetch(R,{method:"PUT",headers:{Authorization:`Bearer ${ne}`,"Content-Type":"application/json",Accept:"application/json"},body:M});if(G.status!==200&&G.status!==201)throw Error(`Key Vault putSecret failed (${G.status}) for ${z}`)}async function b(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await O(),ne=On(u,`/secrets/${encodeURIComponent(ae)}?api-version=${encodeURIComponent(t)}`),R=await fetch(ne,{method:"DELETE",headers:{Authorization:`Bearer ${re}`,Accept:"application/json"}});if(R.status!==200&&R.status!==202&&R.status!==204)throw Error(`Key Vault deleteSecret failed (${R.status}) for ${z}`)}async function W(z,J){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${z}`)}async function F(z,J){try{return await T(z),!0}catch(B){if(B instanceof Ar&&B.status===404)return!1;throw B}}async function Q(z,J,B){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${z}`)}async function ce(z,J,B){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${z}`)}async function se(z){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${z}`)}async function Z(z){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${z}`)}async function ee(z){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${z}`)}async function ue(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await k(ae),ne=re.contentType?gr({mimeType:re.contentType,format:re.tags?.["ionite-format"],schemaUrl:re.tags?.["ionite-schema-url"],typeId:re.tags?.["ionite-type-id"]}):void 0;return{id:re.id,...ne?{content_type:ne}:{},...re.attributes??{}}}return{type:e.type,isAvailable:()=>!m,get:(z,J)=>qe(()=>T(z,J)),getFullSecret:T,getSecret:async(z,J)=>(await T(z,J)).data,putSecret:l,deleteSecret:b,listPaths:W,exists:F,requestRotate:Q,requestRevoke:ce,parkKmsKey:se,addKmsKeys:Z,revokeKmsKey:ee,getMetadata:ue,subscribe:(z,J,B)=>{if(!e.ttl)throw new Le("azure",z);return gt(e.ttl),Ge({getFullSecret:T},z,J,e.ttl,void 0,B,{onHealth:(ae)=>{m=!ae}})},close:()=>{d=void 0,g=void 0,m=!1}}}var En=Symbol("ion.secretsSourceState");function Fu(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${n}`)};return{type:"dev",get:(r,n)=>qe(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[En]:"unavailable"}}function $s(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${n}`)};return{type:"dev",get:(r,n)=>qe(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[En]:"removed"}}function Du(e){return e.type==="vault"&&e.lfv!=null}function zu(e,t,r,n){if(!Du(t))return;if(r||n)return;throw Error(`Secrets source "${e}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function Bu(e,t,r){if(t.type==="vault")return At(t,r);if(t.type==="azure")return _r(t);if(t.type==="aws"||t.type==="gcp"||t.type==="dev")throw Error(`Secrets source "${e}" uses type "${t.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${e}"`)}function Gu(e,t){let r=(n)=>{t.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:n instanceof Error?n.message:String(n)})};try{Promise.resolve(e.close?.()).catch(r)}catch(n){r(n)}}function Ju(e){let t=new Map,r=new Map,n=new Map;for(let[o,s]of Object.entries(e)){if(!qs(s))continue;let i=t.get(s.deliveryPath);if(i)throw Error(`LFV delivery path "${s.deliveryPath}" is claimed by both secrets sources "${i}" and "${o}"; delivery paths must be globally unique.`);t.set(s.deliveryPath,o);let c=r.get(s.eventsPath);if(c)throw Error(`LFV events path "${s.eventsPath}" is claimed by both secrets sources "${c}" and "${o}"; events paths must be globally unique.`);r.set(s.eventsPath,o);let u=n.get(s.callbackKey);if(u&&u.trustId!==s.trustId)throw Error(`LFV callback key "${s.callbackKey}" is claimed by secrets sources "${u.sourceName}" and "${o}" with different verify JWKS; a callback path must use a single trust key.`);if(!u)n.set(s.callbackKey,{sourceName:o,trustId:s.trustId})}}function qs(e){return typeof e.isDeliveryRequest==="function"&&typeof e.isEventsRequest==="function"&&typeof e.handleDelivery==="function"&&typeof e.handleEvents==="function"}function Hu(e,t,r){let n={...t},o=[],s=(c)=>{if(n[c]!==void 0)delete n[c],o.push(c)};s("token"),s("clientSecret"),s("workload");let i=n.websocket;if(i&&typeof i==="object"&&i.token!==void 0){let c={...i};delete c.token,n.websocket=c,o.push("websocket.token")}if(o.length>0)r.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:e,"ion.droppedFields":o});return n}function Yu(e,t,r){let n={},o=new Set([...Object.keys(t??{}),...Object.keys(r??{})]);for(let s of o){let i=t?.[s],c=r?.[s],u=c?Hu(s,c,e):void 0;n[s]={...i??{},...u??{}}}return n}function Lr(e){return e[En]??"available"}function Xu(e,t,r){let n=t,o=new Set,s=new Set,i=new Set,c=We(r,`Secrets source "${e}"`),u=()=>Lr(n)==="available",a=ye(`Secrets source "${e}"`,u),d=(l,b,W)=>Error(`${l} timed out after ${W}ms waiting for source "${e}" to be configured by the ConfigSource at path ${b}`),g=(l,b)=>Error(`${l} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${b}`),m=(l,b,W)=>{let F=Lr(n);if(F==="available")return Promise.resolve(n);if(F==="removed")return Promise.reject(g(l,b));return new Promise((Q,ce)=>{let se={method:l,path:b,resolve:(ee)=>{if(se.timeout)clearTimeout(se.timeout);i.delete(se),Q(ee)},reject:(ee)=>{if(se.timeout)clearTimeout(se.timeout);i.delete(se),ce(ee)}},Z=W?.timeout;if(typeof Z==="number"&&Z>0)se.timeout=setTimeout(()=>{se.reject(d(l,b,Z))},Z);i.add(se)})},C=(l)=>{for(let b of Array.from(i))b.resolve(l)},P=()=>{for(let l of Array.from(i))l.reject(g(l.method,l.path))},E=async(l,b=!1)=>{let W=l.guard.next();if(l.unsubscribe?.(),l.unsubscribe=void 0,l.closed)return;if(Lr(n)==="unavailable"&&l.options?.mode!=="wait"){if(b)throw Error(`subscribe is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${l.path}`);return}try{let Q=await(l.options?.mode==="wait"?await m("subscribe",l.path,l.options):n).subscribe(l.path,(ce)=>{if(!l.closed)l.onChange(ce)},l.options);if(l.closed||!l.guard.isCurrent(W)){Q?.();return}l.unsubscribe=Q}catch(F){if(b)throw F;if(Sr(F)){r.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:e,path:l.path});return}r.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:e,path:l.path,error:F instanceof Error?F.message:String(F)})}},O=(l,b=!1)=>{if(l.unsubscribe?.(),l.unsubscribe=void 0,l.closed)return;if(!n.subscribeEvents){if(b)throw Error(`Secrets source "${e}" does not support lifecycle event subscriptions`);return}l.unsubscribe=n.subscribeEvents((W)=>{if(!l.closed)l.listener(W)})},k={get type(){return n.type},beforeChange:c.beforeChange,afterChange:c.afterChange,isAvailable:()=>u()&&(n.isAvailable?.()??!0),isReady:a.isReady,ready:a.ready,get:(l,b)=>qe(async()=>(await m("get",l,b)).getFullSecret(l,b)),getFullSecret:async(l,b)=>(await m("getFullSecret",l,b)).getFullSecret(l,b),getSecret:async(l,b)=>(await m("getSecret",l,b)).getSecret(l,b),putSecret:async(l,b,W)=>(await m("putSecret",l,W)).putSecret(l,b,W),subscribe:async(l,b,W)=>{let F={path:l,onChange:b,options:W,closed:!1,guard:Cr()};o.add(F);try{await E(F,!0)}catch(Q){throw o.delete(F),Q}return()=>{F.closed=!0,F.guard.next(),o.delete(F),F.unsubscribe?.(),F.unsubscribe=void 0}},subscribeEvents:(l)=>{let b={listener:l,closed:!1};s.add(b);try{O(b,!0)}catch(W){throw s.delete(b),W}return()=>{b.closed=!0,s.delete(b),b.unsubscribe?.(),b.unsubscribe=void 0}},deleteSecret:async(l,b)=>(await m("deleteSecret",l,b)).deleteSecret(l,b),listPaths:async(l,b)=>(await m("listPaths",l,b)).listPaths(l,b),exists:async(l,b)=>(await m("exists",l,b)).exists(l,b),requestRotate:async(l,b,W)=>(await m("requestRotate",l,W)).requestRotate(l,b,W),requestRevoke:async(l,b,W)=>(await m("requestRevoke",l,W)).requestRevoke(l,b,W),parkKmsKey:async(l,b,W)=>(await m("parkKmsKey",l,W)).parkKmsKey(l,b,W),addKmsKeys:async(l,b,W)=>(await m("addKmsKeys",l,W)).addKmsKeys(l,b,W),revokeKmsKey:async(l,b,W)=>(await m("revokeKmsKey",l,W)).revokeKmsKey(l,b,W),getMetadata:async(l,b)=>(await m("getMetadata",l,b)).getMetadata(l,b)},T=(l)=>{try{Promise.resolve(l.close?.()).catch((b)=>{r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:b instanceof Error?b.message:String(b)})})}catch(b){r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:b instanceof Error?b.message:String(b)})}};return{api:k,update(l){if(l===n)return;let b=n;c.emitBefore(),n=l;let W=Lr(l);if(W==="available")C(l);else if(W==="removed")P();a.refresh();for(let F of o)E(F);for(let F of s)O(F);T(b),c.emitAfter()},close(){for(let l of o)l.closed=!0,l.guard.next(),l.unsubscribe?.(),l.unsubscribe=void 0;o.clear();for(let l of s)l.closed=!0,l.unsubscribe?.(),l.unsubscribe=void 0;s.clear(),P(),a.settle(),T(n)}}}function Ns(e,t=new Map){let r=new Map,n=new Map,o,s=!1,i=new Map,c=We(e,"Secrets"),u=!1,a=()=>{for(let k of r.keys()){let T=i.get(k);if(T&&T.api.isReady?.()===!1)return!1}return!0},d=ye("Secrets module",()=>u&&a()),g=(k)=>{let T=i.get(k);if(T)return T;let l=Xu(k,r.get(k)??$s(k),e);if(i.set(k,l),!(k in O))Object.assign(O,{[k]:l.api});return l},m=(k)=>{let T=i.get(k)?.api;if(T)return T;throw e.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:k}),Error(`Secrets source "${k}" is not configured`)},C=()=>Array.from(r.values()).filter(qs),P=(k)=>C().find((T)=>T.isDeliveryRequest(k)),E=(k)=>C().find((T)=>T.isEventsRequest(k)),O;return O={get config(){return Object.fromEntries(Array.from(r.keys(),(k)=>[k,g(k).api]))},beforeChange:c.beforeChange,afterChange:c.afterChange,isReady:d.isReady,isAvailable:()=>{for(let k of i.values()){if(k.api.isReady?.()===!1)continue;if(k.api.isAvailable?.()===!1)return!1}return!0},ready:d.ready,listSecretsSources:()=>Array.from(r.keys()),getSecretsSource:(k)=>{if(r.has(k))return g(k).api;return m(k)},get:(k,T,l)=>O.getSecretsSource(k).get(T,l),getSecret:(k,T,l)=>O.getSecretsSource(k).getSecret(T,l),getFullSecret:(k,T,l)=>O.getSecretsSource(k).getFullSecret(T,l),putSecret:(k,T,l,b)=>O.getSecretsSource(k).putSecret(T,l,b),deleteSecret:(k,T,l)=>O.getSecretsSource(k).deleteSecret(T,l),listPaths:(k,T,l)=>O.getSecretsSource(k).listPaths(T,l),exists:(k,T,l)=>O.getSecretsSource(k).exists(T,l),requestRotate:(k,T,l,b)=>O.getSecretsSource(k).requestRotate(T,l,b),requestRevoke:(k,T,l,b)=>O.getSecretsSource(k).requestRevoke(T,l,b),parkKmsKey:(k,T,l,b)=>O.getSecretsSource(k).parkKmsKey(T,l,b),addKmsKeys:(k,T,l,b)=>O.getSecretsSource(k).addKmsKeys(T,l,b),revokeKmsKey:(k,T,l,b)=>O.getSecretsSource(k).revokeKmsKey(T,l,b),getMetadata:(k,T,l)=>O.getSecretsSource(k).getMetadata(T,l),subscribe:(k,T,l,b)=>O.getSecretsSource(k).subscribe(T,l,b),isLfvDeliveryRequest:(k)=>P(k)!==void 0,isLfvEventsRequest:(k)=>E(k)!==void 0,handleLfvDelivery:async(k)=>{let T=P(k);if(!T)return me();return T.handleDelivery(k)},handleLfvEvents:async(k)=>{let T=E(k);if(!T)return me();return T.handleEvents(k)}},{update(k,T,l,b,W){let F=k!==void 0||T!==void 0;if(!F&&!u&&i.size===0)return;let Q=Yu(e,k,T),ce=W===!0,se=b!==o,Z=ce!==s,ee=new Map,ue=new Map,z=[];try{for(let[J,B]of Object.entries(Q)){let ae=Vu(B),re=r.get(J);if(re&&n.get(J)===ae&&!se&&!Z){ee.set(J,re),ue.set(J,ae);continue}let ne;if(!B.type)ne=Fu(J);else{if(l?.validateSourceConfig?.(J,B),t.has(J)&&k?.[J])e.warn(`RemoteConfig secrets source "${J}" is superseded by the framework LFV bootstrap source.`);if(!t.has(J))zu(J,B,b,ce),ne=Bu(J,B,b),z.push(ne);else ne=t.get(J)}ee.set(J,ne),ue.set(J,ae)}Ju(Object.fromEntries(ee))}catch(J){for(let B of z)Gu(B,e);throw J}c.emitBefore(),u=F,o=b,s=ce;for(let[J,B]of ee)r.set(J,B),n.set(J,ue.get(J)),g(J).update(B);for(let[J,B]of i){if(ee.has(J))continue;r.delete(J),n.delete(J),B.update($s(J))}return d.refresh(),c.emitAfter(),O},close(){for(let k of i.values())k.close();i.clear(),r.clear(),n.clear(),o=void 0,u=!1,d.settle()}}}function An(e,t){let r=t.ttlMs,n=Math.max(1,Math.floor(t.maxEntries)),o=new Map,s=()=>Date.now();function i(){while(o.size>n){let u=o.keys().next().value;if(u===void 0)break;o.delete(u)}}function c(u,a){o.delete(u),o.set(u,{session:a,expiresAt:s()+r}),i()}return{async create(u){await e.create(u)},async get(u){let a=o.get(u);if(a){if(a.expiresAt>s())return o.delete(u),o.set(u,a),a.session;o.delete(u)}let d=await e.get(u);if(d)c(u,d);return d},async update(u,a){await e.update(u,a),o.delete(u)},async delete(u){await e.delete(u),o.delete(u)}}}import{deepEqualPlain as pd,ION_ENDPOINT_PERMISSIONS as md,trimTrailingSlash as Wr,validationFailureResponse as gd}from"@ionite/core";import{assertEcid as Ks,jwtAssertionClaimsSchema as Zu,must as Ue,workloadTokenResponseSchema as Qu}from"@ionite/core";import{getCachedVerificationKey as ed,getJwks as td}from"@ionite/core/server";function je(e,t){return t in e&&e[t]!==void 0&&e[t]!==null}function Ie(e){if(e===void 0||e===null)return!1;return je(e,"workloadId")||je(e,"privateKey")}function Ke(e){if(e===void 0||e===null)return!1;let t=je(e,"clientId"),r=je(e,"clientSecret"),n=je(e,"workloadId"),o=je(e,"privateKey");return(t||r)&&!n&&!o}function _n(e){if(e===void 0||e===null)return!1;let t=je(e,"jwksUri"),r=je(e,"workloadId"),n=je(e,"clientId"),o=je(e,"clientSecret"),s=je(e,"privateKey");return t&&!r&&!s&&!n&&!o}function Vs(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function rd(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(Vs(t))return!1;let r=Object.entries(t);if(r.length===0)return!1;return r.every(([,n])=>Vs(n))}function Gs(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if("incoming"in t||"outgoing"in t){if(t.incoming!==void 0&&(typeof t.incoming!=="object"||t.incoming===null))return!1;if(t.outgoing!==void 0&&(typeof t.outgoing!=="object"||t.outgoing===null||Array.isArray(t.outgoing)))return!1;return!0}return!1}function Js(e){return Gs(e)}function Ln(e){if(!e)return;if(Js(e))return Array.isArray(e.incoming)?void 0:e.incoming;return e}function jn(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function _t(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function Fs(e){if(!e)return[];if(Array.isArray(e))return e.filter((t)=>!!t&&typeof t.issuer==="string"&&typeof t.jwksUri==="string").map((t)=>({issuer:t.issuer,jwksUri:t.jwksUri,audience:t.audience,scopesAsEntitlements:t.scopesAsEntitlements}));if(e.issuer&&e.jwksUri)return[{issuer:e.issuer,jwksUri:e.jwksUri,audience:e.audience??[],scopesAsEntitlements:e.scopesAsEntitlements}];return[]}function nd(e){let t=e[0];if(!t)return;let r=jn(t.audience);return{jwksUri:t.jwksUri,issuer:t.issuer,audience:typeof r[0]==="string"?r[0]:void 0}}function Ds(e,t){let r=_t(t);if(!r)return;return e.find((n)=>_t(n.issuer)===r)}function Ur(e,t,r){let n=jn(e);if(t.some((o)=>n.includes(o)))return!0;if(typeof r==="string"&&t.includes(r))return!0;return!1}function Un(e){if(!e||!Js(e))return{};return e.outgoing??{}}function od(e){return{getToken:e.getToken,refreshToken:e.refreshToken,generateJWTAssertion:e.generateJWTAssertion,revokeToken:e.revokeToken,beforeChange:e.beforeChange,afterChange:e.afterChange,isReady:e.isReady,ready:e.ready}}var $n=Symbol("ion.workloadClientState"),Hs=Symbol("ion.namedWorkloadClients");function Lt(e,t){let r=ye(e,t);return{isReady:r.isReady,ready:r.ready}}function sd(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...Lt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[$n]:"unavailable"}}function zs(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it is no longer configured on this Ionite instance.`)};return{...Lt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[$n]:"removed"}}function id(e){if(!e)return"removed";return e[$n]??"available"}function xn(e,t,r){let n=e,o=n,s=new Set;for(let i of r){if(s.add(i),i in o)continue;let c=t[i];o[i]=c?od(c):sd(i)}return Object.defineProperty(o,Hs,{value:s,enumerable:!1,configurable:!0}),n}function Bs(e){if(!e)return[];let t=e[Hs];return t?Array.from(t):[]}function ad(e,t,r){let n=t,o=We(r,`Workload client "${e}"`),s=()=>id(n)==="available",i=ye(`Workload client "${e}"`,s);return{api:{beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:i.isReady,ready:i.ready,getToken:(u)=>n.getToken(u),refreshToken:(u)=>n.refreshToken(u),generateJWTAssertion:(u)=>n.generateJWTAssertion(u),revokeToken:(u)=>n.revokeToken(u)},update(u){if(u===n)return;o.emitBefore(),n=u,i.refresh(),o.emitAfter()}}}function Ys(e){let t,r=!1,n=ye("Workload module",()=>r),o=We(e,"Workload"),s=new Map,i=new Set,c=new Set(["beforeChange","afterChange","isReady","ready"]),u=(m)=>{if(!t)throw Error(`${m} is unavailable because workload is not configured on this Ionite instance.`);return t},a={beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:n.isReady,ready:n.ready,get config(){return t?.config??{}},getToken(...m){return u("getToken").getToken(...m)},refreshToken(m){return u("refreshToken").refreshToken(m)},generateJWTAssertion(m){return u("generateJWTAssertion").generateJWTAssertion(m)},revokeToken(m){return u("revokeToken").revokeToken(m)},validateToken(m){return u("validateToken").validateToken(m)},getWorkloadIdentity(m){return u("getWorkloadIdentity").getWorkloadIdentity(m)},parseJWT(m){return u("parseJWT").parseJWT(m)},handler(m){return u("handler").handler(m)}},d=(m)=>{for(let E of i)delete a[E];if(i.clear(),!m)return;let C=new Set(Bs(m)),P=new Set([...c,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...C]);for(let[E,O]of Object.entries(m)){if(P.has(E))continue;a[E]=O,i.add(E)}},g=(m)=>{let C=s.get(m);if(C)return C;let P=ad(m,zs(m),e);if(s.set(m,P),!(m in a))a[m]=P.api;return P};return{update(m){if(!m&&!r&&s.size===0)return;o.emitBefore(),r=m!==void 0,n.refresh(),t=m;let C=new Set(Bs(m));for(let P of C){let E=m[P];g(P).update(E)}for(let[P,E]of s){if(C.has(P))continue;E.update(zs(P))}return d(m),o.emitAfter(),a}}}async function Mn(e,t,r){if(e===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let n=r[e];if(!n)throw Error(`Unknown workload client: ${e}`);return n.getToken(t)}function Wn(e,t){return`${e}|${t??""}`}function Je(e,t,r,n,o){let s={jwtAssertionClaims:e?.jwtAssertionClaims??Zu("server"),tokenResponse:e?.tokenResponse??Qu("server")},i=async(p,f)=>{let S=p;if(typeof S.validate==="function")return S.validate(f);return p["~standard"].validate(f)};if(!r&&!n)return;if(r&&Gs(r)){let p=r.incoming,f=Fs(p),S=Array.isArray(p)?nd(p):p,A=Ln(n),N=Un(n),Y=S?{...S,...A,jwksUri:S.jwksUri,issuer:S.issuer}:A;if(!Y||!Y.tokenUrl&&!Y.jwksUri)t.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let K=Y&&(Y.tokenUrl||Y.jwksUri)?Je(e,t,S??void 0,A,f):void 0,oe=Array.from(new Set([...Object.keys(r.outgoing??{}),...Object.keys(N)])).map((le)=>[le,{...r.outgoing?.[le]??{},...N[le]??{}}]),te={};for(let[le,st]of oe){let Ve=Je(e,t,st,void 0);if(Ve)te[le]=Ve}if(!K&&Object.keys(te).length===0)return;let we={...K?.config??{},config:K?.config??{},...Lt("workload",()=>K?.isReady()===!0||Object.values(te).some((le)=>le.isReady())),getToken:async(le,st)=>Mn(le,st,te),getServerToken:async(le)=>{if(!K)throw Error("No server workload config");return K.getToken(le)},refreshToken:async(le)=>{if(!K)throw Error("No default workload config");return K.refreshToken(le)},generateJWTAssertion:async(le)=>{if(!K)throw Error("No default workload config");return K.generateJWTAssertion(le)},revokeToken:async(le)=>{if(!K)throw Error("No default workload config");return K.revokeToken(le)},validateToken:async(le)=>{if(!K)throw Error("No default workload config");return K.validateToken(le)},getWorkloadIdentity:async(le)=>{if(!K)return;return K.getWorkloadIdentity(le)},parseJWT:async(le)=>{if(!K)throw Error("No default workload config");return K.parseJWT(le)},handler:async(le)=>{if(!K)return me();return K.handler(le)}};return xn(we,te,oe.map(([le])=>le))}if(r&&rd(r)){let p=Ln(n),f=Un(n),S=r.default,A=S?{...S,...p,jwksUri:S.jwksUri,issuer:S.issuer}:p;if(!A||!A.tokenUrl&&!A.jwksUri)t.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let N=A&&(A.tokenUrl||A.jwksUri)?Je(e,t,S??void 0,p):void 0,Y=Array.from(new Set([...Object.keys(r).filter((te)=>te!=="default"),...Object.keys(f)])).map((te)=>[te,{...te in r?r[te]:{},...f[te]??{}}]),K={};for(let[te,we]of Y){let le=Je(e,t,we,void 0);if(le)K[te]=le}if(!N&&Object.keys(K).length===0)return;let oe={...N?.config??{},config:N?.config??{},...Lt("workload",()=>N?.isReady()===!0||Object.values(K).some((te)=>te.isReady())),getToken:async(te,we)=>Mn(te,we,K),getServerToken:async(te)=>{if(!N)throw Error("No server workload config");return N.getToken(te)},refreshToken:async(te)=>{if(!N)throw Error("No default workload config");return N.refreshToken(te)},generateJWTAssertion:async(te)=>{if(!N)throw Error("No default workload config");return N.generateJWTAssertion(te)},revokeToken:async(te)=>{if(!N)throw Error("No default workload config");return N.revokeToken(te)},validateToken:async(te)=>{if(!N)throw Error("No default workload config");return N.validateToken(te)},getWorkloadIdentity:async(te)=>{if(!N)return;return N.getWorkloadIdentity(te)},parseJWT:async(te)=>{if(!N)throw Error("No default workload config");return N.parseJWT(te)},handler:async(te)=>{if(!N)return me();return N.handler(te)}};return xn(oe,K,Y.map(([te])=>te))}let c=Ln(n),u=Un(n);if(!r&&Object.keys(u).length>0){let p={};for(let[A,N]of Object.entries(u)){let Y=Je(e,t,N,void 0);if(Y)p[A]=Y}let f=c&&(c.tokenUrl||c.jwksUri)?Je(e,t,c,void 0):void 0;if(!f&&Object.keys(p).length===0)return;let S={...f?.config??{},config:f?.config??{},...Lt("workload",()=>f?.isReady()===!0||Object.values(p).some((A)=>A.isReady())),getToken:async(A,N)=>Mn(A,N,p),getServerToken:async(A)=>{if(!f)throw Error("No server workload config");return f.getToken(A)},refreshToken:async(A)=>{if(!f)throw Error("No default workload config");return f.refreshToken(A)},generateJWTAssertion:async(A)=>{if(!f)throw Error("No default workload config");return f.generateJWTAssertion(A)},revokeToken:async(A)=>{if(!f)throw Error("No default workload config");return f.revokeToken(A)},validateToken:async(A)=>{if(!f)throw Error("No default workload config");return f.validateToken(A)},getWorkloadIdentity:async(A)=>{if(!f)return;return f.getWorkloadIdentity(A)},parseJWT:async(A)=>{if(!f)throw Error("No default workload config");return f.parseJWT(A)},handler:async(A)=>{if(!f)return me();return f.handler(A)}};return xn(S,p,Object.keys(u))}let a=r,d=o??Fs(a),g=c?.tokenUrl,m=g?.startsWith("/")?g:void 0,C=a?.idpTokenUrl??c?.idpTokenUrl??(a?.tokenUrl&&(a.tokenUrl.startsWith("http://")||a.tokenUrl.startsWith("https://"))?a.tokenUrl:void 0),P={...a,...c,tokenUrl:m??c?.tokenUrl??a?.tokenUrl,idpTokenUrl:C,jwksUri:a?.jwksUri,issuer:a?.issuer};P._handlerTokenUrl=m;let E,O=P,k=Ie(P),T=Ke(P),l=_n(P);if(!k&&!T&&!l){if(!a||Object.keys(a).length===0)return;throw t.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(P),clientId:O.clientId,clientSecret:O.clientSecret?"[REDACTED]":void 0,workloadId:O.workloadId,privateKey:O.privateKey?"[REDACTED]":void 0,jwksUri:O.jwksUri,tokenUrl:O.tokenUrl,idpTokenUrl:O.idpTokenUrl,fromVaultKeys:a?Object.keys(a):[],fromCodeKeys:n?Object.keys(n):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(k)E={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:Ue(P.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:Ue(P.privateKey,"Missing 'privateKey' from Workload Config"),audience:Ue(P.audience,"Missing 'audience' from Workload Config"),scope:P.scope??"",algorithm:P.algorithm??"RS256",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new it};else if(Ke(P))E={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:Ue(P.clientId,"Missing 'clientId' from Workload Config"),clientSecret:Ue(P.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:P.scope??"",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new it};else if(_n(P))E=P;function b(){let p=new Uint8Array(16);return crypto.getRandomValues(p),Array.from(p,(f)=>f.toString(16).padStart(2,"0")).join("")}function W(p){let f;if(typeof p==="string")f=btoa(p);else f=btoa(String.fromCharCode(...p));return f.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function F(p){let f=p.replace(/-/g,"+").replace(/_/g,"/");while(f.length%4)f+="=";return atob(f)}function Q(p){if(p.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:p==="RS256"?"SHA-256":p==="RS384"?"SHA-384":"SHA-512"};else if(p.startsWith("ION"))return{name:"ECDSA",namedCurve:p==="ES256"?"P-256":p==="ES384"?"P-384":"P-521",hash:p==="ES256"?"SHA-256":p==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${p}`)}async function ce(p,f){let S=p.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),A=Uint8Array.from(atob(S),(Y)=>Y.charCodeAt(0)),N=Q(f);return crypto.subtle.importKey("pkcs8",A,N,!1,["sign"])}async function se(p,f,S){let A=await ce(f,S),Y=new TextEncoder().encode(p),K=Q(S),oe=await crypto.subtle.sign(K,A,Y);return W(new Uint8Array(oe))}async function Z(p,f=3,S=1000,A=30000){let N=Error("Placeholder Error");for(let Y=0;Y<=f;Y++)try{return await p()}catch(K){if(N=K instanceof Error?K:Error(String(K)),N.message.includes("400")||N.message.includes("401")||N.message.includes("403")||N.message.includes("404"))throw N;if(Y<f){let oe=Math.min(S*2**Y,A),te=Math.random()*oe*0.1;await new Promise((we)=>setTimeout(we,oe+te))}}throw N}async function ee(p){if(!Ie(E))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=E,S=Math.floor(Date.now()/1000),A={iss:f.workloadId,sub:f.workloadId,aud:f.audience??"",exp:S+f.tokenLifetime,iat:S,jti:b(),scope:p??f.scope},N={alg:f.algorithm,typ:"JWT",kid:f.keyId},Y=W(JSON.stringify(N)),K=W(JSON.stringify(A)),oe=`${Y}.${K}`,te=await se(oe,f.privateKey,f.algorithm);return`${oe}.${te}`}async function ue(p){if(!Ie(E))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=E;return Z(async()=>{let S=f.idpTokenUrl,A=await ee(p),N=new URLSearchParams;if(N.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),N.append("assertion",A),p)N.append("scope",p);let Y=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:N.toString()}),K=await Y.json();if(!Y.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:K});let te=K;throw Error(`Token acquisition failed: ${te.error||Y.statusText} - ${te.error_description||""}`.trim())}let oe=await i(s.tokenResponse,K);if(oe.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:oe.issues}),Error(`Token response validation failed: ${oe.issues.map((te)=>te.message).join("; ")}`);if(f.tokenStore){let te=new Date(Date.now()+(oe.value.expires_in??300)*1000),we={workload_id:Wn(f.workloadId,p),access_token:oe.value.access_token,token_type:oe.value.token_type,scope:oe.value.scope,expires_at:te,created_at:new Date,refresh_token:oe.value.refresh_token};await f.tokenStore.set(we)}return oe.value})}async function z(p){if(!Ke(E))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let f=E;return Z(async()=>{let S=f.idpTokenUrl,A=new URLSearchParams;if(A.append("grant_type","client_credentials"),A.append("client_id",f.clientId),A.append("client_secret",f.clientSecret),p)A.append("scope",p);let N=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:A.toString()}),Y=await N.json();if(!N.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:Y});let oe=Y;throw Error(`Token acquisition failed: ${oe.error||N.statusText} - ${oe.error_description||""}`.trim())}let K=await i(s.tokenResponse,Y);if(K.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:K.issues}),Error(`Token response validation failed: ${K.issues.map((oe)=>oe.message).join("; ")}`);if(f.tokenStore){let oe=new Date(Date.now()+(K.value.expires_in??300)*1000),te={workload_id:Wn(f.clientId,p),access_token:K.value.access_token,token_type:K.value.token_type,scope:K.value.scope,expires_at:oe,created_at:new Date,refresh_token:K.value.refresh_token};await f.tokenStore.set(te)}return K.value})}let J=new Map;function B(p,f){let S=J.get(p);if(S)return S;let A=(async()=>(Ie(E)?await ue(f??""):await z(f??"")).access_token)();return J.set(p,A),A.catch(()=>{return}).finally(()=>{if(J.get(p)===A)J.delete(p)}),A}async function ae(p){if(!Ie(E)&&!Ke(E)){let N=E;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!N.clientId}, hasClientSecret=${!!N.clientSecret}, hasWorkloadId=${!!N.workloadId}, hasPrivateKey=${!!N.privateKey}, hasJwksUri=${!!N.jwksUri}`)}let f=E;p=p??f.scope;let S=Ie(E)?E.workloadId:E.clientId,A=Wn(S,p);if(f.tokenStore){let N=await f.tokenStore.get(A);if(N){let Y=Date.now(),K=N.expires_at.getTime(),oe=f.refreshThreshold*1000;if(Y+oe<K)return N.access_token;if(f.autoRefresh)try{return await B(A,p)}catch(te){if(Y<K)return t.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},te),N.access_token;throw te}}}return B(A,p)}async function re(p){if(!Ie(E)&&!Ke(E))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=E;return p=p??f.scope,Ie(f)?await ue(p):await z(p)}async function ne(p){if(!Ie(E)&&!Ke(E))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");try{if(!E.revocationEndpoint)return;let f=new URLSearchParams;if(f.append("token",p),f.append("token_type_hint","access_token"),Ie(E)){let A=E;f.append("client_id",A.workloadId)}else if(Ke(E)){let A=E;f.append("client_id",A.clientId),f.append("client_secret",A.clientSecret)}let S=await fetch(E.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:f.toString()});if(!S.ok)t.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:S.status,statusText:S.statusText});else t.info("Token revoked successfully",{"ion.module":"workload"});if(E.tokenStore){let A;if(Ie(E))A=E.workloadId;else if(Ke(E))A=E.clientId;else return;await E.tokenStore.delete(A)}}catch(f){t.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},f)}}async function R(p,f){let S=p??E?.jwksUri;if(!S)throw Error("No JWKS URI configured in Workload Config");return await td(S,t,f)}async function M(p,f){let S=f??E?.jwksUri;if(!S)throw Error("No JWKS URI configured in Workload Config");let A=Ie(E)?E.algorithm:"RS256";return ed(S,p,`wl:${A}`,(N)=>{let Y=N.alg||A,K=Q(Y);return crypto.subtle.importKey("jwk",N,K,!1,["verify"])},t)}function G(p){let f=p.split(".");if(f.length!==3)throw Error("Invalid JWT");return JSON.parse(F(f[1]))}async function H(p,f){try{let S=p.split(".");if(S.length!==3)throw Error("Invalid JWT");let A=JSON.parse(F(S[0])),N=JSON.parse(F(S[1])),Y=await M(A.kid,f),K=S[2],te=new TextEncoder().encode(`${S[0]}.${S[1]}`),we=Uint8Array.from(F(K),(jt)=>jt.charCodeAt(0)),le=Q(A.alg);if(!await crypto.subtle.verify(le,Y,we,te))throw Error("Invalid JWT signature");let Ve=await i(s.jwtAssertionClaims,N);if(Ve.issues)throw t.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:Ve.issues}),Error(`JWT claims validation failed: ${Ve.issues.map((jt)=>jt.message).join("; ")}`);return Ve.value}catch(S){throw t.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},S),S}}async function v(p){if(!Ie(E)&&!Ke(E)&&!_n(E))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(d.length>0){let A=G(p),N=typeof A.iss==="string"?A.iss:void 0,Y=Ds(d,N);if(!Y)return{valid:!1,error:"Untrusted token issuer"};let K=await H(p,Y.jwksUri),oe=Math.floor(Date.now()/1000);if(K.exp&&K.exp<oe)return{valid:!1,error:"Token expired"};let te=jn(Y.audience);if(te.length>0&&!Ur(K.aud,te,K.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:K,expiresAt:K.exp?new Date(K.exp*1000):void 0}}let f=await H(p),S=Math.floor(Date.now()/1000);if(f.exp&&f.exp<S)return{valid:!1,error:"Token expired"};if(Ie(E)){if(E.audience&&!Ur(f.aud,[E.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else if(Ke(E)){if(E.issuer&&_t(f.iss)!==_t(E.issuer))return{valid:!1,error:"Invalid issuer"};if(E.audience&&!Ur(f.aud,[E.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else{let A=E;if(A.issuer&&_t(f.iss)!==_t(A.issuer))return{valid:!1,error:"Invalid issuer"};if(A.audience&&!Ur(f.aud,[A.audience],f.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:f,expiresAt:f.exp?new Date(f.exp*1000):void 0}}catch(f){return{valid:!1,error:f instanceof Error?f.message:String(f)}}}function U(p,f){let S=p[f];return typeof S==="string"&&S.trim()?S.trim():void 0}function I(p){if(!p)return;return p.startsWith("service-account-")?p.slice(16):p}function x(p){return U(p,"client_id")??U(p,"clientId")??U(p,"azp")??U(p,"appid")??I(U(p,"preferred_username"))}let q=new WeakMap;function w(p){let f=q.get(p);if(f)return f;let S=_(p);return q.set(p,S),S}async function _(p){let f=p.headers.get("Authorization");if(!f?.startsWith("Bearer "))return;let S=f.substring(7),A=await v(S);if(!A.valid||!A.claims)return;let N=d.length>0?Ds(d,A.claims.iss):void 0,Y=A.claims.ecid,K={workloadId:A.claims.sub,clientId:x(A.claims),scope:A.claims.scope,scopesAsEntitlements:N?.scopesAsEntitlements,...Y!==void 0&&Y!==null?{ecid:Ks(Y)}:{},claims:A.claims},oe=E?.workloadIdentityStore;if(oe){let te=K.clientId??K.workloadId??K.claims.sub,we=te?await oe.get(te):void 0;if(we){if(we.active===!1)return;if(we.scopes?.length){let le=new Set([...(K.scope??"").split(/\s+/).filter(Boolean),...we.scopes]);K.scope=Array.from(le).join(" ")}if(!K.ecid&&we.ecid)K.ecid=Ks(we.ecid)}}return K}async function h(p){if(!E)throw Error("ionite Workload Manager not initialized");let f=new URL(p.url).pathname,S=(Y)=>{if(!Y)return;try{return new URL(Y).pathname}catch{return Y.startsWith("/")?Y:`/${Y}`}};if(S(E.validateUrl)===f&&p.method==="POST"){let Y=p.headers.get("Authorization");if(!Y?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let K=Y.substring(7),oe=await v(K);if(!oe.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:oe.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(S(E.jwksUrl)===f&&p.method==="GET"){let Y=await R();return new Response(JSON.stringify(Y),{headers:[["Content-Type","application/json"]]})}return me()}return{...E,...Lt("workload",()=>!0),getToken:ae,refreshToken:re,generateJWTAssertion:ee,revokeToken:ne,validateToken:v,getWorkloadIdentity:w,parseJWT:H,handler:h}}function qn(e){return e=e??"Workload authentication unavailable",new Response(JSON.stringify({error:e}),{status:503,statusText:e,headers:{"Content-Type":"application/json"}})}var xr="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",cd="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function ud(e,t){Ue(t,xr);let r=t.workload;if(!r)return;return r.getWorkloadIdentity(e)}async function dd(e,t,r){Ue(t,xr);let n=t.workload;if(!n)throw qn();let o=n;if(typeof o.getServerToken!=="function"||typeof o.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return o.getToken(e,r)}async function Nn(e,t){Ue(t,cd);let r="validateToken"in t&&typeof t.validateToken==="function"?t:t.workload;if(!r)return{valid:!1,error:"Workload authentication unavailable"};let n=e.headers.get("Authorization");if(!n?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let o=n.substring(7);return r.validateToken(o)}async function ld(e,t){Ue(t,xr);let r=t.workload;if(!r)throw qn();return r.revokeToken(e)}async function fd(e,t){Ue(t,xr);let r=t.workload;if(!r)throw qn();return r.handler(e)}function Xs(e){try{return Wr(new URL(e,"http://dummy").pathname)}catch{let t=e.startsWith("/")?e:`/${e}`;return Wr(t)}}function yd(e,t){let r=new URL(e.url);return new URL(`/${encodeURIComponent(t)}/`,r.origin).toString()}function wd(e,t){let r=Xs(t),n=Wr(e);if(n===r)return null;if(!n.startsWith(`${r}/`))return null;let o=n.slice(r.length+1);if(!o||o.includes("/"))return null;return decodeURIComponent(o)}function Mr(e){return e==="pending"||e==="processing"||e==="completed"||e==="failed"||e==="action_required"}function hd(e){if(!Mr(e.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if(e.status==="completed"){if(!e.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:e.tenantUrl,status:"completed"},status:201}}if(e.status==="pending"||e.status==="processing")return{body:{tenantUrl:e.tenantUrl,status:e.status},status:202};if(e.status==="action_required"){if(!e.actionUrl||!e.requestToken||!e.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:e.actionUrl,requestToken:e.requestToken,expiresAt:e.expiresAt},status:200}}return{body:{tenantUrl:e.tenantUrl,status:"failed",error:e.error??"Tenant provisioning failed"},status:409}}function vd(e,t){let r=t.validators.tenant.createTenantRequest,n=t.validators.tenant.updateTenantRequest;function o(a,d){let g=(m)=>new URL(m,d).toString();return{readyzUrl:g(a.readyzUrl),capabilitiezUrl:g(a.capabilitiezUrl),sso:{loginUrl:g(a.sso.loginUrl),userUrl:g(a.sso.userUrl),logoutUrl:g(a.sso.logoutUrl),logoutBackChannelUrl:g(a.sso.logoutBackChannelUrl),refreshUrl:g(a.sso.refreshUrl),callbackUrl:g(a.sso.callbackUrl)},workload:{validateUrl:g(a.workload.validateUrl),jwksUrl:g(a.workload.jwksUrl)},iam:{basePath:g(a.iam.basePath),usersUrl:g(a.iam.usersUrl),groupsUrl:g(a.iam.groupsUrl),workloadsUrl:g(a.iam.workloadsUrl),customersUrl:g(a.iam.customersUrl)},ciam:{magicLinkUrl:g(a.ciam.magicLinkUrl),magicLinkLoginUrl:g(a.ciam.magicLinkLoginUrl),customerUrl:g(a.ciam.customerUrl),customerLoginUrl:g(a.ciam.customerLoginUrl),customerCallbackUrl:g(a.ciam.customerCallbackUrl),customerProvidersUrl:g(a.ciam.customerProvidersUrl),logoutUrl:g(a.ciam.logoutUrl)}}}function s(a,d){let g=t.tenantIonBasePath?.(a);if(!g)return;let m=new URL(d.url).origin,C=o(Fe(g),m);return{callbackUrl:C.sso.callbackUrl,ionUrls:C}}async function i(a){let d=await Nn(a,t.workloadAuth??e);if(!d.valid)return Response.json({error:d.error??"Unauthorized"},{status:401});return pt(a,e,md["tenant.manage"])}async function c(a){let g=new URL(a.url).pathname,m=wd(g,t.basePath),C=Xs(t.basePath),P=Wr(g)===C;if(!P&&!m)return me();if(!["GET","PUT","POST","DELETE"].includes(a.method))return It(["GET","PUT","POST","DELETE"]);if(a.method==="GET"&&P&&m==null)return me();let E=await i(a);if(E)return E;if(a.method==="GET"){if(m==null)return me();let Z=await t.store.get(m);if(!Z)return me();let ee=s(Z,a);return Response.json(ee?{...Z,...ee}:Z,{status:200})}if(a.method==="DELETE"){if(!m)return me();let Z=await t.store.get(m);if(Z)await t.mirror?.purge(Z.id);return await t.store.delete(m),new Response(null,{status:204})}if(!m&&a.method!=="POST")return me();let O;try{O=await a.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let k=a.method==="POST",T=k?await r.validate(O):await n.validate(O);if(T.issues)return gd(T.issues,k?"Tenant create validation failed":"Tenant update validation failed");let l=k?T.value.id:m;if(!l)return me();if(m!=null&&T.value.id!=null&&T.value.id!==m)return Response.json({error:"Path id must match body id"},{status:400});let b=await t.store.get(l);if(b&&!Mr(b.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let W=new Date,F=b??{},Q;if(k){let Z=T.value,ee=Z,ue=ee.status,z=Mr(ue)?ue:b?.status??"completed";Q={...F,...Z,id:l,companyId:Z.companyId,companyName:Z.companyName,environmentType:Z.environmentType,configLocator:Z.configLocator,email:Z.email??b?.email,webhookUrl:Z.webhookUrl??b?.webhookUrl,callbackUrl:Z.callbackUrl??b?.callbackUrl,tenantUrl:ee.tenantUrl??b?.tenantUrl,status:z,error:ee.error??b?.error,actionUrl:ee.actionUrl??b?.actionUrl,requestToken:ee.requestToken??b?.requestToken,expiresAt:ee.expiresAt??b?.expiresAt,createdAt:b?.createdAt??W,updatedAt:W}}else{let Z=T.value,ee=Z,ue=ee.status,z=Mr(ue)?ue:b?.status??"completed",{configLocator:J,...B}=Z;Q={...F,...B,id:l,companyId:Z.companyId??b?.companyId??"",companyName:Z.companyName??b?.companyName??"",environmentType:Z.environmentType??b?.environmentType??"DEV",email:Z.email??b?.email,webhookUrl:Z.webhookUrl??b?.webhookUrl,callbackUrl:Z.callbackUrl??b?.callbackUrl,tenantUrl:ee.tenantUrl??b?.tenantUrl,status:z,error:ee.error??b?.error,actionUrl:ee.actionUrl??b?.actionUrl,requestToken:ee.requestToken??b?.requestToken,expiresAt:ee.expiresAt??b?.expiresAt,configLocator:J??b?.configLocator,createdAt:b?.createdAt??W,updatedAt:W}}if(!Q.tenantUrl)Q.tenantUrl=yd(a,l);if(!Q.callbackUrl){let Z=s(Q,a);if(Z)Q.callbackUrl=Z.callbackUrl}if(b?.configLocator&&!pd(b.configLocator,Q.configLocator))await t.mirror?.purge(b.id);let ce=await t.store.upsert(Q),se=hd(ce);if(se instanceof Response)return se;return Response.json(se.body,{status:se.status})}async function u(a){try{if(!e.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await c(a)}catch(d){return Pt(d)}}return{handler:u,getTenant:async(a)=>t.store.get(a)}}var Kn="0.0.24-beta.20260917.4";export*from"@ionite/core";import{AssignmentPolicyError as Fg,generateULID as Dg,IoniteError as zg,listGenerator as Bg}from"@ionite/core";import{allowHosts as Jg,allowOrigins as Hg,allowRelativePaths as Yg,allowSameOrigin as Xg,blockDangerousUrls as Zg,CatalogAdjacencyCache as Qg,callback as ey,captureRedirect as ty,ciam as ry,collectReferencedDefinitions as ny,defaultRedirectPolicies as oy,discoverSessionRecords as sy,discoverSessions as iy,expandRoot as ay,getCustomer as cy,getUser as uy,has as dy,hasAll as ly,hasAllScope as fy,hasAny as py,hasAnyScope as my,hasGroup as gy,hasPermission as yy,hasRole as wy,hasScope as hy,InMemoryTenantStore as vy,iam as Sy,initiateLogin as ky,isRedirectAllowed as by,listSsoClientIdsFromCookies as Ry,reconcileSubjectAccess as Cy,resolveAfterRedirect as Ty,resolveCapturedRedirect as Py,resolveRedirect as Iy,sameOriginRedirectRules as Oy,sendTenantWebhook as Ey,sso as Ay,verifyUser as _y,withSetCookies as Ly}from"@ionite/core/server";import{accessRefId as ot,accessRootId as Zs,assertRequiredSubjectType as Qs,list as Sd}from"@ionite/core";function Fn(e){let{createdAt:t,updatedAt:r,...n}=e;return n}class He{constructor(){this.roots=new Map;this.byTarget=new Map;this.bySubject=new Map}static targetKey(e,t){return`${e}:${t}`}static subjectKey(e,t){return`${e}:${t}`}indexAdd(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}indexRemove(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}deindex(e){this.indexRemove(this.byTarget,He.targetKey(e.targetType,ot(e.target)),e.id),this.indexRemove(this.bySubject,He.subjectKey(e.subjectType,ot(e.subject)),e.id)}index(e){this.indexAdd(this.byTarget,He.targetKey(e.targetType,ot(e.target)),e.id),this.indexAdd(this.bySubject,He.subjectKey(e.subjectType,ot(e.subject)),e.id)}resolve(e,t){if(!e)return[];let r=[];for(let n of e){let o=this.roots.get(n);if(o&&(o.status??"active")==="active"&&t(o))r.push(o)}return r}async grant(e){Qs(e.subjectType,"Access change subjectType");let t=e.id??Zs(e),r=new Date,n=this.roots.get(t);if(n)this.deindex(n);let o={...e,id:t,status:e.status??"active",createdAt:n?.createdAt??r,updatedAt:r};this.roots.set(t,o),this.index(o)}async revoke(e){let t=e.id??Zs(e),r=this.roots.get(t);if(r)this.deindex(r);this.roots.delete(t)}async get(e){let t=this.roots.get(e);return t?Fn(t):void 0}async list(e){let t=Array.from(this.roots.values()).filter((r)=>(r.status??"active")==="active");return Vn(t,e)}async listByTarget(e,t,r){let n=t.trim(),o=this.byTarget.get(He.targetKey(e,n)),s=this.resolve(o,(i)=>i.targetType===e&&ot(i.target)===n);return Vn(s,r)}async listByTargets(e){let t=new Map;for(let{targetType:r,target:n}of e){let o=`${r}:${n}`;if(t.has(o))continue;let s=n.trim(),i=this.byTarget.get(He.targetKey(r,s)),c=this.resolve(i,(u)=>u.targetType===r&&ot(u.target)===s);t.set(o,c.map((u)=>Fn(u)))}return t}async listBySubject(e,t,r){Qs(t);let n=ot(e),o=this.bySubject.get(He.subjectKey(t,n)),s=this.resolve(o,(i)=>i.subjectType===t&&ot(i.subject)===n);return Vn(s,r)}}function Vn(e,t){let r=Math.max(0,t?.start??0),n=t?.limit,o=n!=null?r+n:void 0;return Sd(e.length,e.slice(r,o).map(Fn),r,n)}import{assertValidSubjectTypeScoping as ei,deepEqualPlain as kd,list as ti,readyCatalogEntry as Dn}from"@ionite/core";class ri{constructor(){this.listeners=new Set;this.emit=(e)=>{for(let t of this.listeners)t(e)};this.groups=new jr("group",this.emit);this.roles=new jr("role",this.emit);this.permissions=new jr("permission",this.emit)}afterChange(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}}class ni{constructor(){this.items=new Map;this.listeners=new Set}async get(e){return this.items.get(e)}async list(e){let t=Array.from(this.items.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=n!=null?r+n:void 0;return ti(t.length,t.slice(r,o),r,n)}async children(e){return Array.from(this.items.values()).filter((t)=>(typeof t.parent==="string"?t.parent:t.parent?.id)===e)}changed(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}set(e){this.items.set(e.id,e),this.emitChange({id:e.id})}delete(e){if(!this.items.delete(e))return;this.emitChange({id:e,deleted:!0})}emitChange(e){for(let t of this.listeners)t(e)}}class jr{constructor(e,t){this.kind=e;this.emit=t;this.items=new Map}async get(e){return this.items.get(e)}set(e){ei(e);let t=this.items.get(e.id),r=!t||!kd(t,e);if(this.items.set(e.id,e),r)this.emit({op:"set",kind:this.kind,entity:e,previous:t});return Dn(e,Promise.resolve())}insertIfAbsent(e){ei(e);let t=this.items.get(e.id);if(t)return Dn(t,Promise.resolve());return this.items.set(e.id,e),this.emit({op:"set",kind:this.kind,entity:e,previous:void 0}),Dn(e,Promise.resolve())}async delete(e){let t=this.items.get(e);if(!t)return;this.items.delete(e),this.emit({op:"delete",kind:this.kind,entity:t})}async list(e){let t=Array.from(this.items.values()),r=e?.filter?.requestable;if(r!==void 0)t=t.filter((i)=>Boolean(i.requestable)===r);let n=Math.max(0,e?.start??0),o=e?.limit,s=o!=null?n+o:void 0;return ti(t.length,t.slice(n,s),n,o)}}import{accessRefId as Ye,assertRequiredSubjectType as Ut}from"@ionite/core";function Xe(e,t){return`${t}:${e}`}function zn(e,t,r){return`${e}:${t}:${r}`}function bd(e,t,r,n){return`${zn(e,t,r)}:${n??""}`}class oi{constructor(){this.rows=new Map;this.byTriple=new Map;this.byRoot=new Map;this.bySubject=new Map;this.edgeMeta=new Map;this.disabledSubjects=new Set}async has(e,t,r,n,o){Ut(o);let s=Ye(e),i=Ye(r);if(!s||!i)return{allow:!1};if(this.disabledSubjects.has(Xe(s,o)))return{allow:!1,metadata:{reason:"subject_disabled"}};let c=zn(Xe(s,o),t,i),u=n?Ye(n):void 0;if(u===void 0){let g=this.byTriple.get(c);if(g&&g.size>0)return this.allow(s,o,t,i,void 0);return{allow:!1}}let a=`${c}:${u}`,d=`${c}:`;if(this.rows.has(a))return this.allow(s,o,t,i,u);if(this.rows.has(d))return this.allow(s,o,t,i,void 0);return{allow:!1}}async hasGroup(e,t,r,n){return this.has(e,"group",t,r,n)}async hasRole(e,t,r,n){return this.has(e,"role",t,r,n)}async hasPermission(e,t,r,n){return this.has(e,"permission",t,r,n)}async hasAny(e,t,r){for(let n of t){let o=await this.has(e,n.targetType,n.target,n.resource,r);if(o.allow)return o}return{allow:!1}}async hasAll(e,t,r){if(this.disabledSubjects.has(Xe(Ye(e),r)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(t.length===0)return{allow:!0};let n=[];for(let o of t){let s=await this.has(e,o.targetType,o.target,o.resource,r);if(!s.allow)return{allow:!1,matched:n};if(s.matched)n.push(...s.matched)}return{allow:!0,matched:n}}async materialize(e,t){this.removeRoot(e),this.addRootEdges(e,t)}async replaceSubject(e,t,r){let n=Xe(Ye(e),t),o=new Map;for(let s of r){Ut(s.subjectType,"Effective edge subjectType");let i=Xe(Ye(s.subject),s.subjectType);if(i!==n)throw Error(`AccessIndex.replaceSubject received an edge for ${i}; expected ${n}.`);let c=o.get(s.rootId);if(c)c.push(s);else o.set(s.rootId,[s])}this.clearSubjectEdges(n);for(let[s,i]of o)this.addRootEdges(s,i)}addRootEdges(e,t){let r=new Set;for(let n of t){Ut(n.subjectType,"Effective edge subjectType");let o=Xe(n.subject,n.subjectType),s=zn(o,n.targetType,n.target),i=bd(o,n.targetType,n.target,n.resource);this.addToSet(this.rows,i,e),this.addToSet(this.byTriple,s,i),this.addToSet(this.bySubject,o,i),this.edgeMeta.set(i,{triple:s,subjectId:o}),r.add(i)}if(r.size>0)this.byRoot.set(e,r)}async removeByRoot(e){this.removeRoot(e)}removeRoot(e){let t=this.byRoot.get(e);if(!t)return;for(let r of t){let n=this.rows.get(r);if(!n)continue;if(n.delete(e),n.size===0)this.dropEdge(r)}this.byRoot.delete(e)}async listSubjects(){let e=[];for(let[t,r]of this.bySubject){if(r.size===0)continue;let n=t.indexOf(":");if(n<=0)throw Error(`AccessIndex subject key "${t}" is missing a subjectType prefix.`);let o=t.slice(0,n);Ut(o,"AccessIndex subject key subjectType"),e.push({subjectType:o,subject:t.slice(n+1)})}return e}async setSubjectDisabled(e,t,r){let n=Xe(Ye(e),t);if(r)this.disabledSubjects.add(n);else this.disabledSubjects.delete(n)}async isSubjectDisabled(e,t){return Ut(t),this.disabledSubjects.has(Xe(Ye(e),t))}async clear(e,t){if(e===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}Ut(t);let r=Ye(e);this.clearSubjectEdges(Xe(r,t))}clearSubjectEdges(e){let t=this.bySubject.get(e);if(!t)return;for(let r of[...t]){let n=this.rows.get(r);if(n)for(let o of n){let s=this.byRoot.get(o);if(s?.delete(r)&&s.size===0)this.byRoot.delete(o)}this.dropEdge(r)}}allow(e,t,r,n,o){return{allow:!0,matched:[{subject:e,subjectType:t,targetType:r,target:n,resources:o?[o]:void 0}]}}addToSet(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}dropEdge(e){this.rows.delete(e);let t=this.edgeMeta.get(e);if(t)this.removeFromSet(this.byTriple,t.triple,e),this.removeFromSet(this.bySubject,t.subjectId,e);this.edgeMeta.delete(e)}removeFromSet(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}}function Bn(e){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function Rd(e,t){return{...e,subscribe:async(r,n,o)=>{try{return await e.subscribe(r,n,o)}catch(s){if(!(s instanceof Le))throw s;return await Ge(e,r,n,t,void 0,o)}}}}function $r(e){let t=ft(e.path,"path","azureConfig");gt(e.ttl);let r=e.vault??_r({type:"azure",authMethod:e.authMethod,entraTenantId:e.entraTenantId,clientId:e.clientId,clientSecret:e.clientSecret,federatedTokenFile:e.federatedTokenFile,managedIdentityClientId:e.managedIdentityClientId,imdsApiVersion:e.imdsApiVersion,vaultUrl:e.vaultUrl,vaultName:e.vaultName,apiVersion:e.apiVersion,secretNameTransform:e.secretNameTransform,secretNamePrefix:e.secretNamePrefix,scope:e.scope,ttl:e.ttl}),n=e.ttl?Rd(r,e.ttl):r;return{load:async()=>{try{return(await n.getFullSecret(t)).data}catch(o){let s=o instanceof Error?o.message:String(o);throw Error(`Error retrieving remote config from Azure Key Vault: ${s}`,{cause:o})}},subscribe:(o,s)=>n.subscribe(t,(i)=>{o(i.data)},s),secret:n}}import{IoniteError as Nd}from"@ionite/core";function Gn(e){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as Od,remoteConfigSecretType as Ed}from"@ionite/core";import{defaultLogger as Cd,defaultSecretContentType as Td,stableConfigHash as si}from"@ionite/core";var Pd=1e4;function Id(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Jn(e){if(e.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let t=Array.from(new Set(e.paths.map((O)=>O.trim()).filter(Boolean)));if(t.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let r=e.logger??Cd,n=[],o=Promise.resolve(),s=!1,i=!1,c=!1,u=ye("Secrets mirror",()=>s&&!c),a=(O)=>{let k=e.mapPath(O).trim();if(!k)throw Error(`mirrorSecrets mapPath returned an empty target for "${O}"`);return k},d=(O)=>{let k=o.then(O);return o=k.catch((T)=>{i=!0,r.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:T instanceof Error?T.message:String(T)})}),k},g=async(O)=>{if(await e.to.exists(O))await e.to.deleteSecret(O)},m=async(O,k)=>{if(c)return;if(!Id(k.data))throw Error(`mirrorSecrets can only re-store object values (source path "${O}")`);if(e.accept&&!e.accept(k,O))return;let T=a(O);if(await e.to.exists(T)){let l=await e.to.getSecret(T);if(si(l)===si(k.data)){i=!1;return}}await e.to.putSecret(T,k.data,{contentType:k.metadata.contentType??Td()}),i=!1},C=async(O)=>{await g(a(O)),i=!1},P=(O)=>{if(O.event!=="path_removed")return t.includes(O.path)?[O.path]:[];let k=`${O.path.replace(/\/+$/g,"")}/`;return t.filter((T)=>T===O.path||T.startsWith(k))},E=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if(e.from.subscribeEvents)n.push(e.from.subscribeEvents((O)=>{if(E.has(O.event)){let k=P(O);if(k.length>0)d(async()=>{for(let T of k)await C(T)})}try{e.onEvent?.(O)}catch(k){r.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:O.path,event:O.event,error:k instanceof Error?k.message:String(k)})}}));return(async()=>{let O=new Set(t);for(;;){try{for(let k of[...O]){let T=await e.from.subscribe(k,(l)=>{d(()=>m(k,l))},e.subscription);if(c){T();return}n.push(T),O.delete(k)}if(await o,c)return;s=!0,u.refresh();return}catch(k){if(c)return;i=!0,r.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:k instanceof Error?k.message:String(k)})}if(await new Promise((k)=>{setTimeout(k,Pd).unref?.()}),c)return}})(),{isReady:u.isReady,ready:u.ready,isAvailable:()=>s&&!c&&!i&&(e.from.isAvailable?.()??!0)&&(e.to.isAvailable?.()??!0),async purge(){if(c)throw Error("Secrets mirror is closed");await d(async()=>{for(let O of t)await C(O)})},async close(){if(c)return;c=!0;for(let O of n.splice(0))O();u.refresh(),u.settle(),await o}}}function xt(e){return typeof e.getFullSecret==="function"}function Hn(e){let t=e;return typeof t.handleDelivery==="function"&&typeof t.handleEvents==="function"&&typeof t.isDeliveryRequest==="function"&&typeof t.isEventsRequest==="function"}function ii(e){return e.type==="vault"&&[e.vaultLfvServerUrl,e.vaultLfvClientId,e.vaultLfvDeliveryEndpoint,e.vaultLfvVerifyJwks,e.vaultLfvEventsEndpoint].some((t)=>t!==void 0)}function Oe(e,t){if(!e?.trim())throw Error(`Mirrored LFV config requires ${t}`);return e}function Ad(e,t){if(t?.trim())return t;if(xt(e))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if(e.type==="vault")return Oe(e.vaultLfvPath??e.vaultPath,"an upstream vault path");if(e.type==="azure")return Oe(e.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${e.type}" requires an explicit fromPath`)}function _d(e,t){let r=Oe(e.vaultLfvPath??e.vaultPath,"vaultLfvPath or vaultPath");return lt({lfvServerUrl:Oe(e.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Oe(e.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Oe(e.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:Oe(e.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:Oe(e.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:r,deliveryTimeout:e.vaultLfvDeliveryTimeout,retryInterval:e.vaultLfvRetryInterval,warnInterval:e.vaultLfvWarnInterval,log:t},void 0,{selfRedeemReads:!0})}function Ld(e){return e.metadata.contentType?.typeId===Ed.id&&typeof e.data.id==="string"&&e.data.id.trim().length>0}function Ud(e,t,r,n){return{...e,close:r,subscribePassive:(o,s)=>t.subscribePassive(o,s),isDeliveryRequest:(o)=>t.isDeliveryRequest(o),isEventsRequest:(o)=>t.isEventsRequest(o),handleDelivery:(o)=>(n(),t.handleDelivery(o)),handleEvents:(o)=>(n(),t.handleEvents(o)),deliveryPath:t.deliveryPath,eventsPath:t.eventsPath,callbackKey:t.callbackKey,trustId:t.trustId}}function tr(e){let t=e.logger??Od,r=Ad(e.from,e.fromPath),n=!xt(e.from),o=!xt(e.to),s=xt(e.from)?e.from:ii(e.from)?_d(e.from,t):Ze(e.from).secret,i=xt(e.to)?e.to:Ze(e.to).secret,c=Oe(e.path,"path"),u=Yn(i,c,{ttl:e.ttl}),a,d=!1,g=!1,m,C=()=>{if(m)return;m=s.getFullSecret(r).then(()=>{return}).catch((l)=>{m=void 0,t.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:l instanceof Error?l.message:String(l)})})},P=(l)=>{if(d)throw Error("Mirrored ConfigSource is closed");if(!a){g=l;let b=!l&&Hn(s)?{...s,subscribe:(W,F)=>s.subscribePassive(W,F)}:s;a=Jn({from:b,to:i,paths:[r],mapPath:()=>c,accept:Ld,logger:t})}else if(l&&!g)C();return a},E={isReady:()=>a?.isReady()??!1,ready:(l)=>P(!0).ready(l),isAvailable:()=>a?.isAvailable()??!1,purge:()=>P(!1).purge(),close:async()=>{await a?.close()}},O=async()=>{if(d)return;if(d=!0,await a?.close(),n)await s.close?.();if(o)await i.close?.()},k=Hn(s)?Ud(i,s,O,()=>{P(!1)}):{...i,close:O},T={load:async()=>{try{let l=await u.load();return P(!1),l}catch(l){throw P(!0),l}},subscribe:(l,b)=>(P(!1),u.subscribe(l,b)),secret:k,mirror:E,async handleCallback(l,b){if(!Hn(s))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return P(!1),l==="delivery"?s.handleDelivery(b):s.handleEvents(b)}};if(Object.defineProperties(T,{log:{get:()=>u.log,set:(l)=>{u.log=l},enumerable:!0},validators:{get:()=>u.validators,set:(l)=>{u.validators=l},enumerable:!0}}),!xt(e.from)&&ii(e.from)){let l=e.from;T[Ct]={path:r,lfvServerUrl:Oe(l.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Oe(l.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Oe(l.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:Oe(l.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:Oe(l.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:l.vaultLfvDeliveryTimeout,retryInterval:l.vaultLfvRetryInterval,warnInterval:l.vaultLfvWarnInterval}}return T}class yt extends Error{constructor(e,t=`Waiting for vault config secret at ${e}`){super(t);this.path=e;this.code="not_found";this.sourceType="vault";this.status=404;this.name="VaultConfigWaitingForSecretError"}}function xd(e){return e instanceof yt}class rr extends Error{constructor(e,t){super(t);this.path=e;this.code="invalid_payload";this.sourceType="vault";this.name="VaultConfigInvalidPayloadError"}}function Md(e){return e instanceof rr}var ui=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function ai(e){return ui.some((t)=>(t in e))}function ci(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw new yt(t,`Vault config secret at ${t} is missing or not an object`);let r=e;if(!ai(r)&&Object.keys(r).length===1&&"data"in r){let n=r.data;if(n&&typeof n==="object"&&!Array.isArray(n))r=n}if(Object.keys(r).length===0)throw new yt(t,`Vault config secret at ${t} is empty`);if(!ai(r))throw new rr(t,`Vault config secret at ${t} is an invalid payload: not a RemoteConfig (no known keys: ${ui.join("/")})`);return r}function Wd(e,t,r){return{...e,subscribe:async(n,o,s)=>{try{return await e.subscribe(n,o,s)}catch(i){if(!(i instanceof Le))throw i;return await Ge(e,n,o,t,r(),s)}}}}function qr(e){let t=ft(e.path,"path","vaultConfig");gt(e.ttl);let r=e.vault??At({type:"vault",url:e.url,token:e.token,workload:e.workload,lfv:e.lfv,websocket:e.websocket,ttl:e.ttl,log:e.log}),n=e.vault&&e.ttl?Wd(r,e.ttl,()=>e.log):r,o={get log(){return e.log},set log(s){if(e.log=s,n&&"log"in n)n.log=s},load:async()=>{try{let s=await n.getFullSecret(t);return ci(s.data,t)}catch(s){if(s instanceof Be)throw new yt(t);if(s instanceof yt||s instanceof rr)throw s;throw Error("Error retrieving remote config from vault",{cause:s})}},subscribe:(s,i)=>n.subscribe(t,(c)=>{let u;try{u=ci(c.data,t)}catch(a){e.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:t,error:a instanceof Error?a.message:String(a)});return}s(u)},i),secret:n};if(e.lfv?.lfvServerUrl&&e.lfv.clientId&&e.lfv.deliveryEndpoint&&e.lfv.eventsEndpoint)o[Ct]={path:e.lfv.path??t,lfvServerUrl:e.lfv.lfvServerUrl,clientId:e.lfv.clientId,deliveryTimeout:e.lfv.deliveryTimeout,retryInterval:e.lfv.retryInterval,warnInterval:e.lfv.warnInterval,deliveryEndpoint:e.lfv.deliveryEndpoint,eventsEndpoint:e.lfv.eventsEndpoint,verifyJwks:e.lfv.verifyJwks};return o}function Nr(e){if(e==null)return;if(typeof e==="number")return Number.isFinite(e)?e:void 0;let t=e.trim();if(!t)return;let r=Number.parseInt(t,10);return Number.isFinite(r)?r:void 0}function jd(e,t){let r=e.vaultLfvServerUrl??t?.lfvServerUrl,n=e.vaultLfvClientId??t?.clientId,o=e.vaultLfvDeliveryEndpoint??t?.deliveryEndpoint,s=e.vaultLfvEventsEndpoint??t?.eventsEndpoint;if(!r||!n||!o||!s)return t;return{...t,lfvServerUrl:r,clientId:n,deliveryEndpoint:o,verifyJwks:e.vaultLfvVerifyJwks??t?.verifyJwks,eventsEndpoint:s,path:e.vaultLfvPath??t?.path,deliveryTimeout:Nr(e.vaultLfvDeliveryTimeout)??t?.deliveryTimeout,retryInterval:Nr(e.vaultLfvRetryInterval)??t?.retryInterval,warnInterval:Nr(e.vaultLfvWarnInterval)??t?.warnInterval}}function $d(e,t){let r=e.vaultWebsocketUrl??t?.url;if(!r)return t;return{...t,url:r,token:e.vaultWebsocketToken??t?.token,clientId:e.vaultWebsocketClientId??t?.clientId,header:e.vaultWebsocketHeader??t?.header}}function qd(e,t){let r=e.vaultWorkloadTokenUrl??t?.idpTokenUrl,n=e.vaultWorkloadClientId??t?.clientId,o=e.vaultWorkloadClientSecret??t?.clientSecret;if(!r||!n||!o)return t;return{...t,idpTokenUrl:r,clientId:n,clientSecret:o,scope:e.vaultWorkloadScope??t?.scope}}function di(e,t){return{...t,url:e.vaultUrl??t?.url,token:e.vaultToken??t?.token,path:e.vaultPath??t?.path,ttl:Nr(e.vaultTtl)??t?.ttl,workload:qd(e,t?.workload),lfv:jd(e,t?.lfv),websocket:$d(e,t?.websocket)}}function Ze(e){switch(e.type){case"vault":return Vd(e);case"azure":return Fd(e);case"aws":return Dd(e);case"gcp":return zd(e);case"mirror":return Kd(e);default:throw Error(`Unsupported config locator type: ${e.type}`)}}function Kd(e){if(e.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!e.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return tr({from:e.from,to:e.to,path:e.to.vaultPath,ttl:e.to.vaultTtl})}function Vd(e){return qr(di(e))}function Fd(e){return $r({authMethod:e.azureAuthMethod,entraTenantId:e.azureEntraTenantId,clientId:e.azureClientId,clientSecret:e.azureClientSecret,federatedTokenFile:e.azureFederatedTokenFile,managedIdentityClientId:e.azureManagedIdentityClientId,imdsApiVersion:e.azureImdsApiVersion,vaultUrl:e.azureVaultUrl,vaultName:e.azureVaultName,apiVersion:e.azureApiVersion,scope:e.azureScope,secretNamePrefix:e.azureSecretNamePrefix,path:e.azurePath,ttl:e.azureTtl})}function Dd(e){return Bn({webhookUrl:e.awsWebhookUrl,ttl:e.awsTtl})}function zd(e){return Gn({ttl:e.gcpTtl})}function Yn(e,t,r={}){switch(e.type){case"vault":return qr({vault:e,path:t,ttl:r.ttl});case"azure":return $r({vault:e,path:t,ttl:r.ttl});default:throw new Nd(`configFromSource is not supported for secrets source type "${e.type}" (path "${t}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function wt(e){if(!e)return;let t=Number.parseInt(e,10);return Number.isFinite(t)?t:void 0}function Kr(e,t){let r=t?.type??e.ION_CONFIG_TYPE;if(!r)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(r==="vault")return{type:"vault",vaultUrl:e.ION_VAULT_URL,vaultToken:e.ION_VAULT_TOKEN,vaultPath:e.ION_VAULT_PATH??"",vaultTtl:wt(e.ION_VAULT_TTL),vaultWorkloadTokenUrl:e.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:e.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:e.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:e.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:e.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:e.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:e.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:e.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:e.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:e.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:wt(e.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:wt(e.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:wt(e.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:e.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:e.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:e.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:e.ION_VAULT_WEBSOCKET_HEADER};if(r==="azure")return{type:"azure",azurePath:e.ION_AZURE_PATH,azureApiVersion:e.ION_AZURE_API_VERSION,azureScope:e.ION_AZURE_SCOPE,azureSecretNamePrefix:e.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:e.ION_AZURE_AUTH_METHOD,azureEntraTenantId:e.ION_AZURE_TENANT_ID,azureClientId:e.ION_AZURE_CLIENT_ID,azureClientSecret:e.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:e.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:e.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:e.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:e.ION_AZURE_VAULT_URL,azureVaultName:e.ION_AZURE_VAULT_NAME,azureTtl:wt(e.ION_AZURE_TTL)};if(r==="aws")return{type:"aws",awsWebhookUrl:e.ION_AWS_WEBHOOK_URL??"",awsTtl:wt(e.ION_AWS_TTL)};if(r==="gcp")return{type:"gcp",gcpTtl:wt(e.ION_GCP_TTL)};if(r==="mirror"){let n={};for(let[c,u]of Object.entries(e))if(c.startsWith("ION_FROM_"))n[`ION_${c.slice(9)}`]=u;if(n.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let o=Kr(n),s=Kr(e,{type:"vault"});if(!s.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let i={type:"vault",vaultUrl:s.vaultUrl,vaultToken:s.vaultToken,vaultPath:s.vaultPath,vaultTtl:s.vaultTtl,vaultWorkloadTokenUrl:s.vaultWorkloadTokenUrl,vaultWorkloadClientId:s.vaultWorkloadClientId,vaultWorkloadClientSecret:s.vaultWorkloadClientSecret,vaultWorkloadScope:s.vaultWorkloadScope,vaultWebsocketUrl:s.vaultWebsocketUrl,vaultWebsocketToken:s.vaultWebsocketToken,vaultWebsocketClientId:s.vaultWebsocketClientId,vaultWebsocketHeader:s.vaultWebsocketHeader};return{type:"mirror",from:o,to:i}}throw Error(`ION_CONFIG_TYPE="${r}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function li(e,t){return Ze(Kr(e,t))}function Bd(e){return li(process.env,e)}var Gd=1000,Jd=30000,fi=["vault","azure","aws","gcp"];function pi(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Config locator at ${t} is an invalid payload: expected an object with a "type" field`);let r=e.type;if(typeof r!=="string"||!fi.includes(r))throw Error(`Config locator at ${t} is an invalid payload: unknown type "${String(r)}" (expected ${fi.join("/")})`)}function mi(e,t){return e.log??=t.log,e.validators??=t.validators,e}function nr(e){if(!e?.secret?.close)return;try{Promise.resolve(e.secret.close()).catch((t)=>{e.log?.warn?.("secretConfigSource: inner source close failed",t)})}catch(t){e.log?.warn?.("secretConfigSource: inner source close failed",t)}}function Hd(e,t){let r=ft(t,"path","secretConfigSource"),n,o=(i)=>{pi(i,r);let c=JSON.stringify(i);if(n&&n.hash===c)return n.inner;let u=n?.inner,a=mi(Ze(i),s);if(n={hash:c,inner:a},u&&u!==a)nr(u);return a},s={async load(){let i=await e.getSecret(r);return o(i).load()},async subscribe(i,c){let u,a=!1,d=!1,g,m,C=new Promise((W,F)=>{g=W,m=F}),P=Cr(),E,O,k=(W)=>new Promise((F)=>{O=F,E=setTimeout(F,W)}),T=async(W,F)=>{pi(W,r);let Q=JSON.stringify(W),ce=n!==void 0&&n.hash===Q;if(ce&&u)return;let se=n?.inner,Z=u,ee=ce&&n?n.inner:mi(Ze(W),s),ue=!ce,z=()=>{if(ue&&ee!==se)nr(ee)};try{if(ee.subscribe){let B=await ee.subscribe(i,c)??void 0;if(a||!P.isCurrent(F)){B?.(),z();return}if(u=B,n={hash:Q,inner:ee},Z&&Z!==B)Z();if(ue&&se&&se!==ee)nr(se);return}let J=await ee.load();if(a||!P.isCurrent(F)){z();return}if(n={hash:Q,inner:ee},Z)Z(),u=void 0;if(ue&&se&&se!==ee)nr(se);i(J)}catch(J){throw z(),J}},l=async(W)=>{let F=P.next(),Q=Gd;for(;;){if(a||!P.isCurrent(F))return;try{await T(W,F);return}catch(ce){if(a||!P.isCurrent(F))return;s.log?.warn(`secretConfigSource rebind for ${r} failed; keeping last-known-good source and retrying in ${Q}ms`,ce),await k(Q),Q=Math.min(Jd,Q*2)}}},b=await e.subscribe(r,(W)=>{if(a)return;if(!d){T(W.data,P.next()).then(()=>{d=!0,g()}).catch((F)=>{d=!0,m(F)});return}l(W.data)},c);return await C,()=>{if(a=!0,P.next(),E)clearTimeout(E);O?.(),u?.(),b(),nr(n?.inner),n=void 0}},secret:e};return s}function Xn(e){if(Array.isArray(e))return e.map(Xn);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,Xn(r)]));return e}function gi(e){return JSON.stringify(Xn(e))}function Yd(e){if(e.type==="vault")return e.vaultLfvPath??e.vaultPath;if(e.type==="azure"&&e.azurePath?.trim())return e.azurePath;throw Error(`Tenant config locator type "${e.type}" does not declare a mirrorable config path`)}function Xd(e,t){let r=t.logger??e.log,n=new Map,o=!1,s=async(a)=>{if(a.closed)return;a.closed=!0,a.closeHooks?.(),await a.hookSetup?.catch(()=>{return}),await a.source.secret.close?.()},i=(a)=>{let d=(async()=>{let g=await t.store.get(a);if(!g)throw Error(`Tenant "${a}" was not found`);if(!g.configLocator)throw Error(`Tenant "${a}" has no configLocator`);let m=g.configLocator,C=t.path(g).trim();if(!C)throw Error(`Tenant mirror path is empty for "${a}"`);let P=t.sourceFromLocator?.(m,g)??m,O={source:tr({from:P,fromPath:Yd(m),to:t.to,path:C,logger:r}),locatorFingerprint:gi(m),targetPath:C,closed:!1};if(t.hooks?.onRemoteConfigChange)O.hookSetup=t.to.subscribe(C,(k)=>{Promise.resolve(t.hooks?.onRemoteConfigChange?.(g,k.data,k)).catch((T)=>{r.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:a,error:T instanceof Error?T.message:String(T)})})}).then((k)=>{O.closeHooks=k}).catch((k)=>{r.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:a,error:k instanceof Error?k.message:String(k)})});return O})();return n.set(a,d),d.catch(()=>{if(n.get(a)===d)n.delete(a)}),d},c=async(a,d,g)=>{if(n.get(a)===d)n.delete(a);await s(g)},u=async(a)=>{if(o)throw Error("Tenant config mirror is closed");let d=n.get(a);if(!d)return i(a);let g=await d,m=await t.store.get(a);if(!m?.configLocator)throw await c(a,d,g),Error(m?`Tenant "${a}" has no configLocator`:`Tenant "${a}" was not found`);if(gi(m.configLocator)!==g.locatorFingerprint)return await c(a,d,g),n.get(a)??i(a);return g};return{async ensure(a,d){await(await u(a)).source.mirror.ready(d)},async handleCallback(a,d,g){try{return await(await u(a)).source.handleCallback(d,g)}catch(m){let C=m instanceof Error?m.message:String(m),P=C.includes("was not found")?404:503;return r.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:a,kind:d,error:C}),Response.json({error:P===404?"Tenant not found":"Tenant config mirror unavailable"},{status:P})}},async purge(a){let d=n.get(a),g=d?await d:void 0,m=await t.store.get(a),C=g?.targetPath??(m?t.path(m).trim():void 0);if(g&&d)await c(a,d,g);if(C&&await t.to.exists(C))await t.to.deleteSecret(C);if(m)await t.hooks?.onRemoteConfigRevoke?.(m)},async close(){if(o)return;o=!0;let a=[...n.values()];n.clear(),await Promise.all(a.map(async(d)=>{try{await s(await d)}catch{}}))}}}import{buildTenantPath as Zd,DEFAULT_TENANT_API_NAMESPACE as wi,DEFAULT_TENANT_UI_NAMESPACE as hi,matchTenantPath as vi,normalizeTenantPathNamespace as yi}from"@ionite/core";function Qd(){return Response.json({error:"Tenant not found"},{status:404})}function el(e){return Response.json({error:`Tenant runtime unavailable for ${e}`},{status:503})}function tl(e,t){if(t==="api")return yi(e?.api??wi);return yi(e?.ui??hi)}function rl(e){if(e.store)return async(t)=>e.store.getIon(t);return async(t)=>await e.getIon(t)??void 0}async function Si(e,t={}){if(t.custom){let s=await t.custom(e);if(s)return{id:s}}let r=t.namespace??"api",n=tl(t.strategy,r),o=vi(new URL(e.url).pathname,n);if(!o)return null;return{id:o.id,context:{namespace:r,restPath:o.restPath,restSegments:o.restSegments}}}function ki(e,t){let r=new URL(e.url);return r.pathname=t,new Request(r,e)}function Zn(e,t,r,n){let o=vi(new URL(e.url).pathname,r);if(!o||o.id!==t)return e;return ki(e,Zd(t,o.restPath,n))}function nl(e,t,r={beforeTenantSegments:["api"],afterTenantSegments:[]}){return Zn(e,t,wi,r)}function ol(e,t,r={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return Zn(e,t,hi,r)}function sl(e){return async function(r){try{let n=e.resolveTenant?await e.resolveTenant(r):await Si(r),o=typeof n==="string"?{id:n,context:void 0}:n??null;if(!o?.id)return e.onMissingTenant?await e.onMissingTenant(r):Qd();let s=await e.getIon(o.id,r)??null;if(!s)return e.onMissingIonite?await e.onMissingIonite(r,o.id):el(o.id);let i=e.rewriteRequest?await e.rewriteRequest(r,{id:o.id,ion:s,context:o.context}):r;return s.handler(i)}catch(n){return Pt(n)}}}import{list as il,matchesListFilter as al}from"@ionite/core";class bi{constructor(){this.identities=new Map;this.clientIdIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.identities.get(e)}async lookup(e){if(e.id){let t=this.identities.get(e.id);if(t)return t}if(e.clientId){let t=this.clientIdIndex.get(e.clientId);if(t)return this.identities.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.identities.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n=this.identities.get(t),o={...e,id:t,createdAt:n?.createdAt??e.createdAt??r,updatedAt:r};if(n?.clientId&&n.clientId!==o.clientId)this.clientIdIndex.delete(n.clientId);if(n?.externalId&&n.externalId!==o.externalId)this.externalIdIndex.delete(n.externalId);if(this.identities.set(t,o),o.clientId)this.clientIdIndex.set(o.clientId,t);if(o.externalId)this.externalIdIndex.set(o.externalId,t);return o}async delete(e){let t=this.identities.get(e);if(t?.clientId)this.clientIdIndex.delete(t.clientId);if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.identities.delete(e),t?1:0}async list(e){let t=Array.from(this.identities.values()).filter((c)=>al(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return il(o,i,r,n)}}var yl=30000;function wl(e){let t=e,r=t.basePath??ur(),n=t.readyTimeoutMs??yl,o=cr(t.stores),{routing:s,beforeChange:i,afterChange:c,configRetry:u,onConfigLoadError:a}=t;return{frameworkConfig:{log:e.log,validators:e.validators,sso:e.sso,iam:e.iam,workload:e.workload,secrets:e.secrets,lfv:e.lfv,ciam:e.ciam,authz:e.authz,otel:e.otel},basePath:r,readyTimeoutMs:n,stores:o,options:{beforeChange:i,afterChange:c,routing:s,configRetry:u,onConfigLoadError:a}}}function hl(e){let t=e,r={trace:(n,...o)=>t.trace(n,...o),debug:(n,...o)=>t.debug(n,...o),info:(n,...o)=>t.info(n,...o),warn:(n,...o)=>t.warn(n,...o),error:(n,...o)=>t.error(n,...o)};return{logger:r,update(n){return t=n,r}}}function Li(e,t){let r=e;return r.setStores=(n)=>{t.current=cr(n),Object.assign(r,qt(r,t.current))},r}function Ci(e){let t=e?.replace(/\s+/g," ").trim();return t?t:void 0}function Ui(e){if(typeof e!=="object"||e===null)return;return e.cause}function vl(e){if(!(e instanceof Error))return typeof e==="string"?Ci(e):void 0;let t=Ci(e.message),r=[],n=e;if(typeof n.code==="string")r.push(`code=${n.code}`);if(typeof n.status==="number")r.push(`status=${n.status}`);if(typeof n.path==="string")r.push(`path=${n.path}`);if(r.length===0)return t;if(!t)return r.join(", ");return`${t} [${r.join(", ")}]`}function oo(e,t=3){let r=[],n=e,o=0;while(n!=null&&o<t){let s=vl(n);if(s&&!r.includes(s))r.push(s);n=Ui(n),o+=1}return r.length>0?r.join(" <- "):void 0}function Sl(e,t){if(typeof e!=="object"||e===null)return;return e[t]}function xe(e,t){let r=e,n=0;while(r!=null&&n<3){let o=Sl(r,t);if(o!==void 0)return o;r=Ui(r),n+=1}return}var kl=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function bl(e){return typeof e==="string"&&kl.has(e)}function Rl(e){let t=xe(e,"kind");if(bl(t))return t;let r=xe(e,"status"),n=xe(e,"code"),o=oo(e)?.toLowerCase()??"";if(r===401||r===403||o.includes("auth error")||o.includes("permission denied"))return"auth";if(n==="not_found"||o.includes("waiting for vault"))return"not_found";if(n==="ECONNREFUSED"||n==="ECONNRESET"||n==="ENOTFOUND"||n==="ETIMEDOUT"||o.includes("connection")||o.includes("fetch failed")||o.includes("network"))return"connection";if(o.includes("timed out"))return"timeout";if(o.includes("invalid status")||typeof r==="number"&&r>=400)return"invalid_status";if(o.includes("invalid payload")||o.includes("invalid json")||o.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function Cl(e){return"validation"}var Tl=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function Pl(e,t){let r=xe(e,"recoverable");if(typeof r==="boolean")return r;if(t==="not_found")return!0;if(t==="auth"||t==="invalid_payload")return!1;let n=xe(e,"status");if(typeof n==="number"&&n>=400&&n<500)return!1;let o=xe(e,"code");if(typeof o==="string"&&(Tl.has(o)||o.startsWith("UND_ERR_")))return!0;return!0}function Il(e){return{initialDelayMs:Math.max(1,e?.initialDelayMs??2000),maxDelayMs:Math.max(1,e?.maxDelayMs??600000),multiplier:Math.max(1,e?.multiplier??2),jitterRatio:Math.max(0,e?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,e?.loadTimeoutMs??30000)}}function Ol(e,t){let r=Math.max(0,e-1),n=Math.min(t.maxDelayMs,t.initialDelayMs*t.multiplier**r);if(t.jitterRatio===0)return Math.round(n);let o=n*t.jitterRatio,s=(Math.random()*2-1)*o;return Math.max(1,Math.round(Math.min(t.maxDelayMs,n+s)))}function El(e){return(t)=>{let r=t.path?` at ${t.path}`:"",n=t.sourceType?` (${t.sourceType})`:"";e.warn(`Config source${n} unavailable${r}; ionite will retry automatically in ${t.nextDelayMs}ms (attempt ${t.attempt}, ${t.errorKind}: ${t.message}).`)}}async function Al(e,t){for(let r of t)await r(e)}function Me(e){if(!e)return;try{return new URL(e,"http://dummy").pathname}catch{return e.startsWith("/")?e:`/${e}`}}function _l(e,t){let r=t.id;if(typeof r!=="string"||r.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if(e!==void 0&&e!==r)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${e}", received "${r}").`)}function Ll(e){let t=e.kms;if(t)for(let[n,o]of Object.entries(t)){if(n.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!o||typeof o!=="object"||Array.isArray(o))throw Error(`RemoteConfig.kms.${n} must be an object.`);if(o.source!==void 0&&(typeof o.source!=="string"||o.source.length===0))throw Error(`RemoteConfig.kms.${n}.source must be a non-empty string when present.`);if(o.path!==void 0&&(typeof o.path!=="string"||o.path.length===0))throw Error(`RemoteConfig.kms.${n}.path must be a non-empty string when present.`)}let r=e.otel;if(!r)return;if(r.apiKey!==void 0&&r.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(r.apiKeyPool!==void 0){if(typeof r.apiKeyPool!=="string"||r.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!t?.[r.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${r.apiKeyPool}".`)}}function Ul(e){let t=e.authz?.trustedProvisioningClients;if(!t)return;t.forEach((r,n)=>{let o=`authz.trustedProvisioningClients[${n}]`;if(typeof r.issuer!=="string"||r.issuer.length===0)throw Error(`${o}: "issuer" is required and must be a non-empty string.`);if(typeof r.clientId!=="string"||r.clientId.length===0)throw Error(`${o}: "clientId" is required and must be a non-empty string.`);let s=Array.isArray(r.audience)?r.audience:[r.audience];if(s.length===0||s.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(r.permissions)||r.permissions.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "permissions" must be an array of non-empty permission ids.`)})}function xl(e){let t=Array.isArray(e)?e:[e];return t.length>0&&t.every((r)=>typeof r==="string"&&r.length>0)}function Ml(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return;let r=t,n=(o,s)=>{if(!xl(o.audience))throw Error(`${s}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in r||"outgoing"in r){let o=r.incoming;if(Array.isArray(o))o.forEach((s,i)=>{if(s&&typeof s==="object")n(s,`workload.incoming[${i}]`)});else if(o&&typeof o==="object"&&"jwksUri"in o)n(o,"workload.incoming");return}if(Wi(r)){if("jwksUri"in r&&!("clientId"in r)&&!("workloadId"in r))n(r,"workload (server-only)");return}}function Wl(e,t,r){if(e?.sso?.redirectUri&&t.sso?.redirectUri){let n=Me(e.sso.redirectUri),o=Me(t.sso.redirectUri);if(n!==o)r.error(`SSO redirectUri path mismatch: the framework derives "${o}" from basePath, but ConfigSource reports "${n}". Register "${o}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function so(e){let t={};if(!e)return t;for(let[r,n]of Object.entries(e))if(n.type==="vault"&&typeof n.lfv?.deliveryEndpoint==="string"&&typeof n.lfv?.eventsEndpoint==="string")t[r]=n.lfv;return t}function xi(e){return e[Ct]}function Mi(e,t){let r=so(e.secrets??void 0),n=Me(t.deliveryEndpoint),o=Me(t.eventsEndpoint),s=Me(t.path);for(let i of Object.values(r)){if(Me(i.deliveryEndpoint)!==n)continue;if(Me(i.eventsEndpoint)!==o)continue;let c=i.path?Me(i.path):void 0;if(s&&c&&s!==c)continue;return!0}return!1}function jl(e,t){let r=xi(t);if(!r)return e;if(Mi(e,r))return e;let n={type:"vault",lfv:{path:r.path,lfvServerUrl:r.lfvServerUrl,clientId:r.clientId,deliveryTimeout:r.deliveryTimeout,retryInterval:r.retryInterval,warnInterval:r.warnInterval,deliveryEndpoint:r.deliveryEndpoint,eventsEndpoint:r.eventsEndpoint,verifyJwks:r.verifyJwks}},o=e.secrets??{},s=nn(o,{clientId:r.clientId,path:r.path});return{...e,secrets:{...o,[s]:n}}}function $l(e,t){let r=xi(t);if(!r||Mi(e,r))return new Map;let n=nn(e.secrets??{},{clientId:r.clientId,path:r.path});return new Map([[n,t.secret]])}function ql(e,t){let r=so(e.secrets),n=so(t.secrets??void 0);for(let[o,s]of Object.entries(n)){let i=r[o];if(!i)continue;let c=Me(i.deliveryEndpoint),u=Me(s.deliveryEndpoint);if(c&&u&&c!==u)throw Error(`LFV deliveryEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${c}, framework path: ${u}`);let a=Me(i.eventsEndpoint),d=Me(s.eventsEndpoint);if(a&&d&&a!==d)throw Error(`LFV eventsEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${a}, framework path: ${d}`)}}function Nl(e){return new Set(Object.keys(e.secrets??{}))}function Kl(e){return new Set(Object.keys(e.secrets??{}))}function Vl(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;if(!("outgoing"in t))return new Set;let r=t.outgoing;if(!r||typeof r!=="object"||Array.isArray(r))return new Set;return new Set(Object.keys(r))}function Wi(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function Fl(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;let r=t;if("incoming"in r||"outgoing"in r){let n=r.outgoing;if(!n||typeof n!=="object"||Array.isArray(n))return new Set;return new Set(Object.keys(n))}if(Wi(r))return new Set;return new Set(Object.keys(r).filter((n)=>n!=="default"))}function Dl(e,t,r,n){let o=t.secrets??{},s=e.secrets??{};for(let[d,g]of Object.entries(o)){let m=s[d];if(!m)continue;if(g.type&&m.type&&g.type!==m.type)throw Error(`Secrets source "${d}" type in framework config must match ConfigSource type. ConfigSource type: ${m.type}, framework type: ${g.type}`)}let i=Nl(t),c=Kl(e);for(let d of i)if(!c.has(d)&&!n.has(d))r.warn(`Framework config declares secrets source "${d}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let d of c)if(!i.has(d))r.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:d});let u=Vl(t),a=Fl(e);for(let d of u)if(!a.has(d))r.warn(`Framework config declares outgoing workload client "${d}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(t.otel!==void 0&&t.otel!==null&&e.otel===void 0)r.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function Ti(e,t){if(t===void 0)return!1;return ul(e,t)}function zl(e,t){if(typeof t!=="number"||!Number.isFinite(t)||t<=0)return e;return new Promise((r,n)=>{let o=setTimeout(()=>{n(Error(`Ionite ready() timed out after ${t}ms`))},t);e.then(()=>{clearTimeout(o),r()},(s)=>{clearTimeout(o),n(s)})})}function Bl(e,t,r){if(typeof t!=="number"||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>{o(Error(r))},t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function ao(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function Pi(e){return e==="/"?e:e.replace(/\/+$/,"")}function eo(e,t){return Pi(e)===Pi(t)}function Ii(e){return e.method==="GET"||e.method==="HEAD"}function Gl(e){if(e.isReady()&&e.config?.readyz?.enabled===!1)return me();let t=e.readiness();return Response.json(Jl(t),{status:t.ok?200:503})}function Jl(e){let t=e.config.lastError;if(!t)return e;return{...e,config:{...e.config,lastError:{kind:t.kind,phase:t.phase,at:t.at,message:"[redacted]"}}}}var Hl={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","iam.workloads":"iam","iam.customers":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz"};function Yl(e){let t=e?.providers;if(!t)return!1;return Object.values(t).some((r)=>r.enabled!==!1&&r.type!=="magic-link")}function Pe(e,t,r={}){let n=Hl[e],o=t.modules[n],s=r.capable??!0,i=o.active&&o.ready&&s,c=i?void 0:!o.active||!o.ready?o.reason:r.incapableReason??`${e} is not testable by this application wiring`;return{module:n,active:o.active,ready:o.ready,testable:i,...r.urls&&r.urls.length>0?{urls:r.urls}:{},...c?{reason:c}:{}}}function Xl(e,t,r){let n=Fe(t),o=e.readiness();return{sdk:{version:Kn,catalogVersion:gn},basePath:t,urls:n,modules:o.modules,lfvCallbackTransport:Boolean(r.lfv?.callbackTransport),capabilities:{"sso.login":Pe("sso.login",o,{urls:[n.sso.loginUrl,n.sso.callbackUrl,n.sso.userUrl]}),"sso.jit":Pe("sso.jit",o,{capable:r.sso?.enableJitUserProvisioning!==!1&&Boolean(r.sso?.userStore),incapableReason:r.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":Pe("sso.logout",o,{urls:[n.sso.logoutUrl]}),"sso.back_channel_logout":Pe("sso.back_channel_logout",o,{urls:[n.sso.logoutBackChannelUrl]}),"ciam.magic_link":Pe("ciam.magic_link",o,{capable:Boolean(r.ciam?.magicLinkStore)&&r.ciam?.enableJitUserProvisioning!==!1,urls:[n.ciam.magicLinkUrl,n.ciam.magicLinkLoginUrl],incapableReason:!r.ciam?.magicLinkStore?"CIAM magic-link is enabled but no magicLinkStore capability is wired by the application.":"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":Pe("ciam.oidc_login",o,{capable:Yl(r.ciam),urls:[n.ciam.customerLoginUrl,n.ciam.customerCallbackUrl,n.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":Pe("ciam.customer",o,{urls:[n.ciam.customerUrl]}),"ciam.logout":Pe("ciam.logout",o,{urls:[n.ciam.logoutUrl]}),"iam.users":Pe("iam.users",o,{capable:Boolean(r.iam?.userStore),urls:[n.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":Pe("iam.groups",o,{capable:Boolean(r.authz?.catalogStore||r.authz?.catalog),urls:[n.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"iam.workloads":Pe("iam.workloads",o,{capable:Boolean(r.iam?.workloadIdentityStore),urls:[n.iam.workloadsUrl],incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."}),"iam.customers":Pe("iam.customers",o,{capable:Boolean(r.iam?.customerStore),urls:[n.iam.customersUrl],incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."}),"workload.incoming":Pe("workload.incoming",o,{urls:[n.workload.validateUrl,n.workload.jwksUrl]}),"workload.outgoing":Pe("workload.outgoing",o,{}),"authz.oaa":Pe("authz.oaa",o,{capable:Boolean(r.authz?.accessStore&&(r.authz?.catalogStore||r.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."})}}}async function Zl(e,t,r){if(!t.isReady())return ao();if(t.config?.capabilitiez!==!0||!r)return me();let n=await pt(e,t,Ai["capabilitiez.read"]);if(n)return n;return Response.json(r.build(),{status:200})}async function Ql(e){if(!e)return[];let t=[];for await(let r of Wt((n,o)=>e.list({start:n,limit:o})))t.push(r);return t}function to(e,t){return[...new Set(e.filter((r)=>r.subjectType===t).map((r)=>typeof r.subject==="string"?r.subject:r.subject.id).filter((r)=>Boolean(r)))]}function ro(e,t,r){if(!e)return;if(t==="all")return Wt((n,o)=>e.list({start:n,limit:o}));return async function*(){for(let o of r){let s=await e.get(o);if(s)yield s}}()}async function ef(e,t,r){if(!t.isReady())return ao();if(t.config?.authz?.oaa?.fullSync?.enabled!==!0)return me();let n=await pt(e,t,Ai["authz.oaa.sync"]);if(n)return n;let o=t.authz?.oaa;if(!o?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let s=t.authz?await t.authz.reconcile():void 0,i=r.iam?.userStore,c=r.iam?.customerStore??r.ciam?.customerStore,u=r.workload,a=r.iam?.workloadIdentityStore??(u&&"workloadIdentityStore"in u?u.workloadIdentityStore:u&&("incoming"in u)&&u.incoming&&!Array.isArray(u.incoming)&&("workloadIdentityStore"in u.incoming)?u.incoming.workloadIdentityStore:void 0),d=dl(r.authz?.catalog?_i(r.authz.catalog):void 0,r.authz?.catalogStore),g=r.authz?.accessStore,m=r.authz?.resources,C=await Ql(g),P=await o.sync({users:ro(i,o.population("user"),to(C,"user")),customers:ro(c,o.population("customer"),to(C,"customer")),workloads:ro(a,o.population("workload"),to(C,"workload")),groups:d?Wt((E,O)=>d.groups.list({start:E,limit:O})):void 0,roles:d?Wt((E,O)=>d.roles.list({start:E,limit:O})):void 0,permissions:d?Wt((E,O)=>d.permissions.list({start:E,limit:O})):void 0,resources:m?Wt((E,O)=>m.list({start:E,limit:O})):void 0,access:C},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...P,reconcile:s})}function tf(e,t,r,n,o,s){return async(i)=>{let c=new URL(i.url).pathname;if(eo(c,r)){if(!Ii(i))return It(["GET"]);return Gl(e)}if(eo(c,n)){if(!Ii(i))return It(["GET"]);return Zl(i,e,o)}if(s&&eo(c,s.url)){if(i.method!=="POST")return It(["POST"]);return ef(i,e,s.frameworkConfig)}let u=e.secrets;if(!Boolean(u?.isLfvDeliveryRequest?.(i)||u?.isLfvEventsRequest?.(i))&&!e.isReady())return ao();try{return await t(i)}catch(d){return e.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},d),Pt(d)}}}function Oi(e,t,r){if(e)return r&&!e.tenantId?{...e,tenantId:r}:e;if(t&&r)return{tenantId:r};return}function rf(e,t){if(t.authz===null)return;if(!e.authz&&!t.authz)return;return{...e.authz,...t.authz,oaa:e.authz?.oaa||t.authz?.oaa?{...e.authz?.oaa,...t.authz?.oaa}:void 0}}function no(e){let t=!1,r=ye(`${e} module`,()=>t);return{isReady:r.isReady,ready:r.ready,attach(n){if(t=n!==void 0,r.refresh(),!n)return;return Object.defineProperty(n,"isReady",{value:r.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(n,"ready",{value:r.ready,enumerable:!1,configurable:!0}),n}}}function io(e){if(!e)return!1;return e.isReady?e.isReady():!1}function Mt(e,t,r,n){if(!e)return{active:!1,ready:!1,reason:r};return io(t)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:n}}function nf(){let e=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:e(),ciam:e(),iam:e(),workload:e(),otel:e(),secrets:e(),kms:e(),authz:e()}}function of(e,t,r){let n=e.isReady(),o=e.config;if(!n||!o)return{ok:!1,applied:n,modules:nf(),config:{...t}};let s=zr(r),i=Boolean(o.workload)||Boolean(e.workload),c={sso:Mt(Boolean(o.sso),e.sso,"sso not configured (no RemoteConfig.sso)",s.sso??"sso configured but not ready"),ciam:Mt(Boolean(o.ciam),e.ciam,"ciam not configured (no RemoteConfig.ciam)",s.ciam??"ciam configured but not ready"),iam:Mt(Boolean(o.iam),e.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:Mt(i,e.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:Mt(Boolean(o.otel),e.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(o.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!io(e.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return e.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:Mt(Boolean(o.kms),e.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(o.authz?.oaa))return{active:!0,ready:!0};let d=e.authz?.oaa;return io(d)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})()};return{ok:Object.values(c).every((a)=>!a.active||a.ready),applied:n,modules:c,config:{...t}}}function sf(e,t){let r=[];for(let n of t){let o=e.modules[n];if(!e.applied){r.push({name:n,reason:"RemoteConfig has not been applied yet"});continue}if(!o?.ready)r.push({name:n,reason:o?.reason??`${n} is not ready`})}return{ok:r.length===0,notReady:r}}function af(e,t,r,n,o,s,i,c){let u=t.validators,a=ml(e.cache);fl(a.jwks);let d=t;if(a.session.read.enabled){let Z=t.sso?.sessionStore??t.ciam?.sessionStore;if(Z){let ee=An(Z,a.session.read);d={...t,sso:t.sso?{...t.sso,sessionStore:ee}:t.sso,ciam:t.ciam?{...t.ciam,sessionStore:ee}:t.ciam}}}let g={sessionCache:a.session},m=Je(u.workload,r,e?.workload,t.workload??void 0),C=t.otel!==null?kn(r,e?.otel,t.otel??void 0,o):void 0,P=zr(d);if(Object.keys(e).length>0){if(P.sso)r.error(P.sso);if(P.ciam)r.error(P.ciam)}let E=Oi(e?.sso,t.sso,e.id),O=P.sso?void 0:gl(u.sso,r,E,d.sso??void 0,g),k={...e?.iam,...t.iam},T=t.authz?.catalog?_i(t.authz.catalog):void 0,l=t.workload,b=l&&"workloadIdentityStore"in l?l.workloadIdentityStore:l&&("incoming"in l)&&l.incoming&&!Array.isArray(l.incoming)&&("workloadIdentityStore"in l.incoming)?l.incoming.workloadIdentityStore:void 0,W=Boolean(k.url||k.userStore||t.authz?.catalogStore||T),F=i.update({users:e?.iam?.users?.delta,workloads:e?.iam?.workloads?.delta,customers:e?.iam?.customers?.delta,url:k.url,audience:k.deltaAudience},{workload:m,workloadIdentityStore:b,userStore:k.userStore,customerStore:k.customerStore??d.ciam?.customerStore,accessStore:t.authz?.accessStore,catalogStore:t.authz?.catalogStore,codeCatalog:T,mapUserToScim:k.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:k.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:k.inboundWorkloads?.mapBaseWorkloadToScim}),Q;if(W&&!m){if(Object.keys(e).length>0)r.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");Q=void 0}else Q=pl(u.iam,r,m,s,t.authz?.accessStore,t.authz?.accessIndex,t.authz?.catalogStore,T,t.authz?.resources,e?.iam,t.iam??void 0,F,t.authz?.onAccessMutation,cl(e.authz),c);let ce=Oi(e?.ciam,t.ciam,e.id),se=P.ciam?void 0:ll(u.ciam,r,ce,d.ciam??void 0,m,g);return{secret:n,workload:m,otel:C,sso:O,iam:Q,ciam:se}}function ji(e,t,r,n,o,s,i,c){let u=s.authz.update(rf(t,r));e.id=t.id,e.config=t,e.secrets=s.secrets.update(t.secrets,r.secrets??void 0,r.validators.secrets,r.lfv?.callbackTransport,r.lfv?.singleProcess),e.kms=s.kms.update(t.kms,(m)=>{if(!m.source)return o;if(!e.secrets)throw Error(`KMS pool references unavailable secrets source "${m.source}".`);return e.secrets.getSecretsSource(m.source)});let a=af(t,r,n,o,s.kms.handle(),u,s.iamDelta,s.authz.settle);e.secret=a.secret,e.workload=s.workload.update(a.workload),e.otel=s.otel.update(a.otel),e.authz=u,e.log=s.log.update(e.otel?.logger??n),e.sso=s.sso.attach(a.sso),e.iam=s.iam.attach(a.iam),e.ciam=s.ciam.attach(a.ciam);let d=Fe(i),g=(m)=>bn(m,e,c?.routing,d);e.handler=tf(e,g,d.readyzUrl,d.capabilitiezUrl,{build:()=>Xl(e,i,r)},{url:ho(i),frameworkConfig:r})}function cf(e,t,r,n,o,s,i,c,u){_l(e.id,t),Ll(t),Ul(t),Ml(t),Wl(t,r,n),ql(t,r),Dl(t,r,n,c),ji(e,t,r,n,o,s,i,u)}function Ei(e){if(!e.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return e.secret}async function uf(e,t,r,n,o,s,i){let c=e,u=vo(e,t,o.current,s);if(n.beforeChange){let a=Li(u,o);i?.enter();let d;try{d=await n.beforeChange(e,a,r)}finally{i?.exit()}if(d?.config!==void 0)c=d.config;u=d?.frameworkConfig??a}return u=qt(u,o.current),{effectiveRemoteConfig:c,effectiveFrameworkConfig:u}}function qg(e,t){let r=wl(t),{frameworkConfig:n,basePath:o,readyTimeoutMs:s,stores:i,options:c}=r,u=$l(n,e),a=new Set(u.keys()),d=qt(jl(n,e),i),g=d.log||Qn,m={current:i},C={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:d},P=mn(g),E,O={log:hl(g),secrets:Ns(g,u),kms:ls(g),workload:Ys(g),otel:ys(g),authz:Vo(g,()=>P.handle(),()=>E?.iam,()=>({mapUserToScim:C.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:C.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:C.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim})),iamDelta:P,sso:no("sso"),iam:no("iam"),ciam:no("ciam")},k={},T,l,b=new Promise((I,x)=>{T=I,l=x}),W=!1,F,Q,ce=0,se={enter:()=>{ce+=1},exit:()=>{ce-=1}},Z=Promise.resolve();function ee(I){let x=Z.then(I,I);return Z=x.then(()=>{return},()=>{return}),x}function ue(I){if(W)throw Error(`Ionite instance has been closed and cannot call ${I}().`)}function z(){e.log=C.frameworkConfig.log??Qn,e.validators=C.frameworkConfig.validators}let J={},B={log:g,id:void 0,config:void 0,secret:Ei(e),authz:void 0,configStatus:k,handler:async()=>me(),ready:(I)=>{if(ce>0&&C.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return zl(b,I??s)},isReady:()=>C.remoteConfig!==void 0,readiness:()=>of(B,k,C.frameworkConfig),requireReady:(I)=>sf(B.readiness(),I),close:()=>{if(W)return;if(W=!0,Q)clearTimeout(Q),Q=void 0;F?.(),F=void 0;let I=[()=>O.secrets.close(),()=>O.kms.close(),()=>O.authz.close(),()=>O.otel.shutdown()];for(let x of I)try{Promise.resolve(x()).catch((q)=>{g.warn("Ionite close: module teardown failed",q)})}catch(q){g.warn("Ionite close: module teardown failed",q)}T?.(),T=void 0,l=void 0},setStores:async(I)=>{ue("setStores");let x=cr(I);await ee(()=>M(x))}};E=B,ji(B,J,C.frameworkConfig,g,B.secret,O,o,c),z();function ae(){let I=k.lastError!==void 0;if(k.appliedAt=Date.now(),k.lastError=void 0,I)(B.log??g).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function re(I,x){let q=oo(x)??(x instanceof Error?x.message:String(x)),w=Cl(x),_=k.lastError===void 0;if(k.lastError={kind:w,message:q,at:Date.now(),phase:I},_)(B.log??g).error(I==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":w,phase:I,error:q})}function ne(I,x,q){(B.log??g).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:I,"ion.config.hash":x,"ion.config.apply_ms":q})}async function R(I,x){if(W)return;let q=Ri(I);if(x&&C.remoteConfig!==void 0&&q===C.remoteConfigHash&&Ti(I,C.remoteConfig))return;let w=C.remoteConfig,_=w===void 0?"initial":"update",h=Date.now(),p,f,S;try{let Y=await uf(I,C.frameworkConfig,C.remoteConfig,c,m,o,se);if(p=Y.effectiveRemoteConfig,f=Ri(p),S=Y.effectiveFrameworkConfig,x&&c.beforeChange===void 0&&C.remoteConfig!==void 0&&f===C.remoteConfigHash&&Ti(p,C.remoteConfig)&&S===C.frameworkConfig)return;let K=S.log||Qn;cf(B,p,S,K,Ei(e),O,o,a,c)}catch(Y){throw re(_,Y),Y}C.remoteConfig=p,C.remoteConfigHash=f,C.frameworkConfig=S,z(),ae(),await O.otel.settled();let A=Li(C.frameworkConfig,m),N=!1;try{c.afterChange?.(B,p,A,w)}catch(Y){if((B.log??g).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:_,error:Y instanceof Error?Y.message:String(Y)}),_==="initial"){N=!0;let K=Y instanceof Error?Y:Error(`afterChange failed on initial load: ${String(Y)}`);re("initial",K),l?.(K),l=void 0,T=void 0}}if(C.frameworkConfig=A,z(),!N)ne(_,f,Date.now()-h);if(!N&&T)T(),T=void 0}async function M(I){if(W)return;if(m.current=I,C.remoteConfig===void 0){C.frameworkConfig=qt(C.frameworkConfig,I),z();return}await R(C.remoteConfig,!1)}if(e.subscribe)e.subscribe((I)=>{ee(()=>R(I,!0)).catch(()=>{})},{mode:"wait"}).then((I)=>{if(W){I?.();return}F=I}).catch((I)=>{g.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:I instanceof Error?I.message:String(I)})});let G=Il(c.configRetry),H=[c.onConfigLoadError??El(g)],v=0;function U(){if(Q=void 0,W)return;if(C.remoteConfig!==void 0)return;Bl(e.load(),G.loadTimeoutMs,`ConfigSource initial load timed out after ${G.loadTimeoutMs}ms`).then(async(I)=>{v=0;try{await ee(async()=>{if(C.remoteConfig!==void 0)return;await R(I,!0)})}catch(x){let q=x instanceof Error?x:Error(`Initial RemoteConfig application failed: ${String(x)}`);g.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:q.message}),l?.(q),l=void 0}},async(I)=>{if(W)return;v+=1;let x=Ol(v,G),q=oo(I)??"RemoteConfig load failed",w=Rl(I),_=xe(I,"code"),h=xe(I,"status"),p={attempt:v,error:I,errorKind:w,maxDelayMs:G.maxDelayMs,message:q,nextDelayMs:x,code:typeof _==="string"?_:void 0,status:typeof h==="number"?h:void 0,path:typeof xe(I,"path")==="string"?xe(I,"path"):void 0,sourceType:typeof xe(I,"sourceType")==="string"?xe(I,"sourceType"):void 0};if(!Pl(I,w)){let f=I instanceof Error?I:Error(`ConfigSource initial load failed with unrecoverable ${w}: ${q}`);g.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:w,error:q,code:p.code,status:p.status,path:p.path,sourceType:p.sourceType}),l?.(f),l=void 0;return}try{await Al(p,H)}catch(f){let S=f instanceof Error?f:Error("ConfigSource retry hook stopped RemoteConfig retrying");l?.(S),l=void 0;return}Q=setTimeout(U,x)})}return U(),B}export{Fg as AssignmentPolicyError,Qg as CatalogAdjacencyCache,Sc as ION_CAPABILITY_CATALOG,gn as ION_CAPABILITY_CATALOG_VERSION,yl as ION_READY_DEFAULT_TIMEOUT_MS,Kn as ION_SDK_VERSION,He as InMemoryAccessAssignmentStore,ri as InMemoryAccessCatalogStore,oi as InMemoryAccessIndex,or as InMemoryCustomerStore,sr as InMemoryMagicLinkStore,ni as InMemoryResourceStore,ir as InMemorySessionStore,vy as InMemoryTenantStore,ar as InMemoryUserStore,bi as InMemoryWorkloadIdentityStore,it as InMemoryWorkloadTokenStore,zg as IoniteError,kr as ScimOutboundClient,Or as VAULT_MIN_POLLING_TTL_MS,rr as VaultConfigInvalidPayloadError,yt as VaultConfigWaitingForSecretError,Le as VaultSubscribeNotSupportedError,Jg as allowHosts,Hg as allowOrigins,Yg as allowRelativePaths,Xg as allowSameOrigin,Bn as awsConfig,$r as azureConfig,Zg as blockDangerousUrls,ey as callback,ty as captureRedirect,ry as ciam,Us as closeAllVaultSockets,ny as collectReferencedDefinitions,Yn as configFromSource,Kr as configLocatorFromEnvValues,li as configSourceFromEnvValues,Ze as configSourceFromLocator,mn as createManagedIamDelta,An as createSessionReadCache,sl as createTenantIonHandler,rl as createTenantIonResolver,oy as defaultRedirectPolicies,Fe as deriveIonUrls,na as devInMemoryStores,sy as discoverSessionRecords,iy as discoverSessions,pt as enforceEndpointAuthz,Bd as envConfig,fn as escapeScimFilterValue,ay as expandRoot,Gn as gcpConfig,Dg as generateULID,cy as getCustomer,uy as getUser,ud as getWorkload,dd as getWorkloadToken,dy as has,ly as hasAll,fy as hasAllScope,py as hasAny,my as hasAnyScope,gy as hasGroup,yy as hasPermission,wy as hasRole,hy as hasScope,Sy as iam,ky as initiateLogin,qg as ionite,by as isRedirectAllowed,Md as isVaultConfigInvalidPayloadError,xd as isVaultConfigWaitingForSecretError,lt as lfvVault,Bg as listGenerator,Ry as listSsoClientIdsFromCookies,Jn as mirrorSecrets,tr as mirroredConfig,Cy as reconcileSubjectAccess,Ty as resolveAfterRedirect,Py as resolveCapturedRedirect,hs as resolveDefaultRoute,Iy as resolveRedirect,Si as resolveTenantFromRequest,ld as revokeWorkloadToken,nl as rewriteRequestForDefaultTenantApi,ol as rewriteRequestForDefaultTenantUi,Zn as rewriteRequestForTenantPath,ki as rewriteRequestPath,bn as routeRequest,Oy as sameOriginRedirectRules,Hd as secretConfigSource,Ey as sendTenantWebhook,Rs as setVaultWebSocketCommandTimeout,Ay as sso,Ge as subscribeSecretPathWithHttpPolling,vd as tenantManager,Xd as tenantMirror,Nn as validateWorkloadToken,At as vault,qr as vaultConfig,Ls as vaultSocketDiagnostics,_y as verifyUser,Ly as withSetCookies,Je as workload,fd as workloadHandler};
+`)}function Ho(e){try{let t=atob(e);return Uint8Array.from(t,(r)=>r.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function vr(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("Secret content is not an object");return e}function Ft(e){return e.metadata.contentType??Qa()}function on(e,t){if(t==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof e.data==="string")return e.data;if(t==="jsonc")return JSON.stringify(e.data,null,2);if(t==="env")return Jo(vr(e.data));let r=vr(e.data).content;if(typeof r!=="string")throw Error(`Secret ${t} content must contain a string "content" field`);return r}function hr(e,t){if(t==="jsonc")return typeof e.data==="string"?ec(e.data):e.data;if(t==="env")return typeof e.data==="string"?Go(e.data):vr(e.data);if(t==="text")return on(e,t);if(t==="binary"){let r=vr(e.data).content_base64;if(typeof r!=="string")throw Error('Binary secret content must contain a "content_base64" string');return Ho(r)}throw Error(`Typed ${t} decoding is not supported yet; use text() or bytes()`)}function rc(e){return{format:e.format,mimeType:e.mimeType,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id}}function nc(e,t){let r=Ft(e);if(r.format!==t.format||r.mimeType!==t.mimeType)throw new tc(rc(t),r)}async function oc(e,t){if(!e.schema)return t;let r=await e.schema["~standard"].validate(t);if(r.issues){let n=r.issues.map((o)=>o.message).join("; ");throw Error(`Secret validation failed for type "${e.id}": ${n}`)}return r.value}function qe(e){return{async text(){let t=await e();return on(t,Ft(t).format)},async json(){let t=await e(),r=Ft(t).format;if(r!=="jsonc")throw Error(`json() requires a jsonc secret; received ${r}`);return hr(t,r)},async bytes(){let t=await e(),r=Ft(t).format;if(r==="binary")return hr(t,r);return new TextEncoder().encode(on(t,r))},async env(){let t=await e(),r=Ft(t).format;if(r!=="env")throw Error(`env() requires an env secret; received ${r}`);return hr(t,r)},async metadata(){return(await e()).metadata},async parse(t){let r=await e();return nc(r,t),oc(t,hr(r,t.format))}}}function Xo(e){try{return new URL(e).pathname}catch{return e.startsWith("/")?e:`/${e}`}}var ac=1e4,cc=1e4,uc=300,Zo=100;async function dn(e){await new Promise((t)=>setTimeout(t,e))}function Ae(e){return{startedAt:Date.now(),timeout:typeof e?.timeout==="number"&&e.timeout>0?e.timeout:void 0}}function sn(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function zt(e){if(e.timeout===void 0)return;let t=Date.now()-e.startedAt;return Math.max(0,e.timeout-t)}function ze(e,t,r){return Error(`LFV ${e} timed out after ${r.timeout??0}ms for ${t}`)}async function Rt(e,t,r,n,o){let s=zt(r);if(s!==void 0){if(s<=0)throw ze(n,o,r);let i=new AbortController,c=setTimeout(()=>i.abort(),s);try{return await fetch(e,{...t,signal:i.signal})}catch(u){if(u instanceof Error&&u.name==="AbortError")throw ze(n,o,r);throw u}finally{clearTimeout(c)}}return await fetch(e,t)}class Te extends Error{constructor(e){super(`LFV source closed while operating on ${e}`);this.name="LfvSourceClosedError"}}class De extends Error{constructor(e){super(e);this.name="LfvProtocolError"}}class dt extends De{constructor(e,t,r){super(`LFV ${t} failed (${e}) for ${r}`);this.status=e;if(this.name="LfvActionStatusError",e===404)this.code="not_found"}}var dc=new Set([400,401,403,404,409,410]);function Qo(e){return e instanceof De&&(!(e instanceof dt)||dc.has(e.status))}function Sr(e){return e instanceof Te||e instanceof Error&&e.name==="LfvSourceClosedError"}function lc(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`LFV kms_park returned invalid payload for ${t}`);let r=e;if(typeof r.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${t}`);let n=r.disposition;if(n!==void 0&&n!=="cooldown"&&n!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${t}`);return{parked:r.parked,...r.stale===!0?{stale:!0}:{},...n?{disposition:n}:{}}}function Dt(e){try{let t=JSON.parse(e);return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:void 0}catch{return}}async function an(e,t,r,n,o,s,i,c,u,a){let d=0,g=Date.now();for(;;){if(a?.())throw new Te(n);let m=zt(r);if(m!==void 0&&m<=0)throw ze(o,n,r);try{return await e()}catch(C){if(C instanceof Te)throw C;if(a?.())throw new Te(n);if(d+=1,i>0&&Date.now()-g>=i){let E=`Error connecting to the LFV source. Retries: '${d}'`;if(c)c(u,E,{url:t,path:n,operation:o});g=Date.now()}let P=m===void 0?s:Math.min(s,m);if(P<=0)throw ze(o,n,r);if(await dn(P),a?.())throw new Te(n)}}}function fc(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function cn(e){if(typeof e==="number"&&Number.isFinite(e))return e;if(typeof e==="string"&&e.trim()){let t=Date.parse(e.trim());if(!Number.isNaN(t))return t}return}function es(e){return`[LFV] [${e??"-"}] [${new Date().toISOString()}]: `}function un(e,t){if(typeof e!=="string"||e.trim()==="")throw Error(`LFV source requires "${t}"`);return e}function pc(e){return{...e,lfvServerUrl:un(e.lfvServerUrl,"lfvServerUrl"),clientId:un(e.clientId,"clientId"),path:un(e.path,"path")}}function lt(e,t,r={}){let n=pc(e),o=n.log??sc,s=(y,L,j)=>{let V=es(y)+L;if(j!==void 0)o.debug(V,j);else o.debug(V)},i=(y,L,j)=>{let V=es(y)+L;if(j!==void 0)o.warn(V,j);else o.warn(V)},{lfvServerUrl:c,clientId:u,path:a,verifyJwks:d}=n,g=typeof n.deliveryTimeout==="number"&&n.deliveryTimeout>0?n.deliveryTimeout:void 0,m=typeof n.retryInterval==="number"&&n.retryInterval>0?n.retryInterval:ac,C=typeof n.warnInterval==="number"&&n.warnInterval>=0?n.warnInterval:cc,P=(typeof n.callbackMaxAgeSeconds==="number"&&n.callbackMaxAgeSeconds>0?n.callbackMaxAgeSeconds:uc)*1000,E=typeof n.cacheMaxAgeSeconds==="number"&&n.cacheMaxAgeSeconds>0?n.cacheMaxAgeSeconds*1000:void 0,O=d?.trim()?ic(d.trim()):void 0,k=Xo(n.deliveryEndpoint),T=Xo(n.eventsEndpoint),l=wr({lfvServerUrl:c,path:a}),b=crypto.randomUUID(),W=new Map,F=new Set,Q=new Map,ce=new Map,se=new Map,Z=new Map,ee=new Map,ue=new Map,z=new Map,J=(y,L)=>{if(typeof L==="number"&&Number.isInteger(L)&&L>=1){let j=z.get(y)??1,V=Math.max(j,L);return z.set(y,V),V}return z.get(y)},B=(y,L)=>typeof L==="number"&&Number.isInteger(L)&&L>=1&&L>(z.get(y)??1),ae=new Map,re=new Map,ne=!1,R,M=new Set,G=()=>ne;function H(y,L){Q.set(y,L),ce.set(y,Date.now())}function v(y){Q.delete(y),ce.delete(y)}function U(y){let L=Q.get(y);if(!L)return;if(E!==void 0){let j=ce.get(y)??0;if(Date.now()-j>E){s(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:y});return}}return L}function I(){return F.size>0||W.size>0||ue.size>0}function x(){if(ne){if(R)R(),R=void 0;return}let y=I();if(y&&!R)R=Do(l,b,{trustId:O,onDelivery:async(L)=>lo(L).handled||await po(L),onEvents:async(L)=>{mo(L)}});if(!y&&R)R(),R=void 0}async function q(y,L,j,V){if(!t)throw Error("LFV callback transport is not configured");for(;;){if(ne)throw new Te(L);if(V())throw new Te(L);let X=await t.take(y);if(X){if(X.key!==l)i(y,"parked OTP callback rejected: callback key mismatch");else if(!await Vr(X.rawBody,X.headers)){let fe=Dt(X.rawBody);if(fe?.type==="otp"&&fe.request_id===y&&typeof fe.otp==="string"&&fe.otp)return fe.otp}}let D=zt(j);if(D!==void 0&&D<=0)throw ze("issueOtp",L,j);await dn(D===void 0?Zo:Math.min(Zo,D))}}async function w(y,L){let j=L??crypto.randomUUID(),V={startedAt:Date.now(),timeout:g},X={request_id:j,path:y,action:"read_secret",...sn(J(y))},D=await an(()=>Rt(`${c.replace(/\/+$/g,"")}/clients/${u}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":j},body:JSON.stringify(X)},V,"issueOtp",y),c,V,y,"issueOtp",m,C,i,j,G);if(D.status!==200&&D.status!==202)throw new dt(D.status,"issueOtp",y)}async function _(y,L){let j=re.get(y);if(j)return j;let V=w(y,L);re.set(y,V);try{await V}finally{if(re.get(y)===V)re.delete(y)}}async function h(y,L,j,V){if(ne)throw new Te(y);let X=j??crypto.randomUUID(),D=V??Ae(),ie=new Promise((Ee,$t)=>{let go={resolve:Ee,reject:$t},Fr=zt(D);if(Fr!==void 0){if(Fr<=0){$t(ze("issueOtp",y,D));return}go.timer=setTimeout(()=>{ue.delete(X),x(),$t(ze("issueOtp",y,D))},Fr)}ue.set(X,go),x()});ie.catch(()=>{});let fe=()=>{let Ee=ue.get(X);if(!Ee)return;if(Ee.timer)clearTimeout(Ee.timer);ue.delete(X),x()},de={request_id:X,path:y,action:L,...sn(J(y))};s(X,"OTP request",{path:y,action:L});let he;try{he=await an(async()=>await Rt(`${c.replace(/\/+$/g,"")}/clients/${u}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":X},body:JSON.stringify(de)},D,"issueOtp",y),c,D,y,"issueOtp",m,C,i,X,G)}catch(Ee){throw fe(),Ee}if(he.status!==200&&he.status!==202)throw fe(),new dt(he.status,"issueOtp",y);let ke=!1,ve=t?q(X,y,D,()=>ke):void 0;if(ve)ve.catch(()=>{});try{let Ee=await(ve?Promise.race([ie,ve]):ie);return s(X,"OTP received via signed callback",{path:y,action:L}),Ee}finally{ke=!0,fe()}}async function p(y,L,j,V,X,D,ie){if(ne)throw new Te(L);let fe=ie??Ae(),de=await an(async()=>await Rt(`${c.replace(/\/+$/g,"")}${y}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":X},body:JSON.stringify({request_id:X,otp:V,path:L,...sn(J(L)),...D??{}})},fe,j,L),c,fe,L,j,m,C,i,X,G);if(de.status!==200&&de.status!==202)throw new dt(de.status,j,L);return s(X,`${j} accepted`,{path:L,status:de.status}),de}async function f(y,L,j,V,X,D){if(ne)throw new Te(L);let ie=X??crypto.randomUUID(),fe=D??Ae(),de=await h(L,j,ie,fe),he=await p(y,L,j,de,ie,V,fe);return{requestId:ie,response:he}}async function S(y,L,j){if(ne)throw new Te(y);let V=B(y,j?.kmsSlots);if(J(y,j?.kmsSlots),V)v(y);let X=U(y);if(X)return X;let D=ae.get(y);if(D){if(!V)return D;if(await D.catch(()=>{return}),D=ae.get(y),D)return D}let ie=A(y,L,j);ae.set(y,ie),ie.catch((fe)=>{if(Sr(fe))s(L,"read aborted: source closed",{path:y})});try{return await ie}finally{ae.delete(y)}}async function A(y,L,j){let V=j?.timeout??g,X={startedAt:Date.now(),timeout:typeof V==="number"&&V>0?V:void 0},D=L??crypto.randomUUID();s(D,"read_secret request",{path:y});let ie=0,fe=Date.now();for(;;){if(ne)throw new Te(y);try{let{response:de}=await f("/secrets/request",y,"read_secret",void 0,D,X),he=await N(D,de),ke=Y(y,he);return K(y,ke,ke.metadata.version),s(D,"read_secret completed from action response",{path:y}),ke}catch(de){if(de instanceof Te)throw de;if(Qo(de))throw de;let he=zt(X);if(he!==void 0&&he<=0)throw ze("read_secret",y,X);if(ie+=1,C>0&&Date.now()-fe>=C)i(D,`read_secret retrying. Retries: '${ie}'`,{path:y}),fe=Date.now();let ke=he===void 0?m:Math.min(m,he);if(ke<=0)throw ze("read_secret",y,X);await dn(ke)}}}async function N(y,L){if(!d?.trim())throw new De("LFV read_secret response verification is not configured");let j=L.headers.get("X-LFV-Request-Id")?.trim(),V=L.headers.get("X-LFV-Key-Id")?.trim(),X=L.headers.get("X-LFV-Signature")?.trim();if(!j||!V||!X)throw new De("LFV read_secret response is missing signature headers");if(j!==y)throw new De("LFV read_secret response request_id header does not match the request");let D=await L.text();if(!await Yo({jwks:d,kid:V,signatureB64Url:X,requestId:y,rawBody:D}))throw new De("LFV read_secret response signature verification failed");let fe=Dt(D);if(!fe||fe.request_id!==y)throw new De("LFV read_secret response request_id does not match the request");return fe}function Y(y,L){if(uo(L)!==y||L.data?.data===void 0)throw new De(`LFV read_secret returned an invalid secret response for ${y}`);let V=L.data.metadata??{},X=typeof V.version==="number"?V.version:0,D=V.created_time??V.created,ie=ut(V);return{data:L.data.data,metadata:{path:y,version:X,created:typeof D==="string"?new Date(D):new Date,...ie?{contentType:ie}:{}}}}function K(y,L,j){if(j!==void 0){let D=Z.get(y);if(D!==void 0&&j<D){s(void 0,"delivery ignored: stale version",{path:y,realVersion:j,lastAccepted:D});return}Z.set(y,j)}H(y,L),M.delete(y);let V=L.metadata.version;if(se.get(y)===V)return;se.set(y,V);let X=W.get(y);if(!X)return;for(let D of X)D(L)}async function oe(y,L){return await S(y,void 0,L)}async function te(y,L,j){if(!fc(L))throw Error(`putSecret requires an object value for LFV source at path ${y}`);let V=Ae(j),X={data:L,content_type:yr(j.contentType)};if(await st(y,j)){await f("/secrets/update",y,"update_secret",X,void 0,V),v(y);return}await f("/secrets/create",y,"create_secret",X,void 0,V),v(y)}async function we(y,L){let j=Ae(L);await f("/secrets/delete",y,"delete_secret",void 0,void 0,j),v(y)}async function le(y,L){let j=Ae(L),V=crypto.randomUUID();s(V,"list_paths request",{path:y});let X=await h(y,"list_paths",V,j),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},j,"listPaths",y);if(D.status!==200)throw Error(`LFV listPaths failed (${D.status}) for ${y}`);let ie=await D.json();if(!Array.isArray(ie.items))throw Error(`LFV listPaths returned invalid payload for ${y}`);return s(V,"list_paths success",{path:y,status:200}),ie.items.filter((fe)=>typeof fe==="string")}async function st(y,L){let j=Ae(L),V=crypto.randomUUID();s(V,"exists request",{path:y});let X=await h(y,"read_metadata",V,j),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},j,"exists",y);if(D.status!==200)throw Error(`LFV exists failed (${D.status}) for ${y}`);let ie=await D.json();if(typeof ie.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${y}`);return s(V,"exists success",{path:y,status:200,exists:ie.exists}),ie.exists}async function Ve(y,L,j){let V=Ae(j);await f("/secrets/rotate/request",y,"request_rotate",{reason:L?.reason,severity:L?.severity,incident_ref:L?.incidentRef},void 0,V)}async function jt(y,L,j){let V=Ae(j);await f("/secrets/revoke/request",y,"request_revoke",{reason:L?.reason,severity:L?.severity,incident_ref:L?.incidentRef},void 0,V)}async function $i(y,L,j){let V=Ae(j),{response:X}=await f("/secrets/kms/park",y,"kms_park",{key_id:L.keyId,status:L.status,reason:L.reason},void 0,V);return lc(await X.json().catch(()=>null),y)}function qi(y,L){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_add_keys returned invalid payload for ${L}`);let j=y;if(!Array.isArray(j.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${L}`);return{keys:j.keys.map((X,D)=>{if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`LFV kms_add_keys returned invalid keys[${D}] for ${L}`);let ie=X.id;if(typeof ie!=="string"||ie.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${D}].id for ${L}`);return{id:ie}})}}function Ni(y,L){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_revoke_key returned invalid payload for ${L}`);let j=y;if(typeof j.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${L}`);return{revoked:j.revoked}}async function Ki(y,L,j){let V=Ae(j),{response:X}=await f("/secrets/kms/add-keys",y,"kms_add_keys",{keys:L.keys},void 0,V);return qi(await X.json().catch(()=>null),y)}async function Vi(y,L,j){let V=Ae(j),{response:X}=await f("/secrets/kms/revoke-key",y,"kms_revoke_key",{key_id:L.keyId,reason:L.reason},void 0,V);return Ni(await X.json().catch(()=>null),y)}async function Fi(y,L){let j=Ae(L),V=crypto.randomUUID();s(V,"getMetadata request",{path:y});let X=await h(y,"read_metadata",V,j),D=await Rt(`${c.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":V},body:JSON.stringify({request_id:V,otp:X,path:y})},j,"getMetadata",y);if(D.status!==200)throw Error(`LFV getMetadata failed (${D.status}) for ${y}`);let ie=await D.json();if(!ie.metadata||typeof ie.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${y}`);return s(V,"getMetadata success",{path:y,status:200}),ie.metadata}async function co(y,L,j,V=!0){let X=W.get(y)??new Set,D,ie=(de)=>{if(de.metadata.version===D)return;D=de.metadata.version,L(de)};if(X.add(ie),W.set(y,X),!V)return x(),()=>{let de=W.get(y);if(!de)return;if(de.delete(ie),de.size===0)W.delete(y);x()};let fe=B(y,j?.kmsSlots)?void 0:U(y);if(fe)ie(fe),se.set(y,fe.metadata.version);else try{ie(await oe(y,j))}catch(de){if(X.delete(ie),X.size===0)W.delete(y);throw de}return x(),()=>{let de=W.get(y);if(!de)return;if(de.delete(ie),de.size===0)W.delete(y);x()}}let Di=(y,L)=>co(y,L,void 0,!1);function zi(y){return y.method==="POST"&&new URL(y.url).pathname===k}function Bi(y){return y.method==="POST"&&new URL(y.url).pathname===T}function uo(y){let L=y.data?.metadata?.path;if(typeof L==="string"&&L)return L;if(typeof y.path==="string"&&y.path)return y.path;return}function Gi(y){let{request_id:L,otp:j}=y;if(typeof L!=="string"||typeof j!=="string"||!j)return{handled:!1};let V=ue.get(L);if(!V)return{handled:!1};if(V.timer)clearTimeout(V.timer);return ue.delete(L),x(),V.resolve(j),{handled:!0}}function lo(y){return y.type==="otp"?Gi(y):{handled:!1}}function Qe(y="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:y}),{status:401,headers:{"Content-Type":"application/json"}})}function fo(y){return{requestId:y.headers.get("X-LFV-Request-Id")??y.headers.get("x-lfv-request-id")??"",keyId:y.headers.get("X-LFV-Key-Id")??y.headers.get("x-lfv-key-id")??"",signature:y.headers.get("X-LFV-Signature")??y.headers.get("x-lfv-signature")??""}}async function Vr(y,L){if(!d?.trim())return i(void 0,"LFV callback rejected: verifyJwks is not configured"),Qe("LFV callback verification is not configured");let{requestId:j,keyId:V,signature:X}=L;if(!j.trim()||!V.trim()||!X.trim())return i(j||void 0,"LFV callback rejected: missing signature headers"),Qe("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await Yo({jwks:d,kid:V,signatureB64Url:X.trim(),requestId:j.trim(),rawBody:y}))return i(j,"LFV callback rejected: signature verification failed"),Qe();let ie=Dt(y);if(!ie)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let fe=ie;if(fe.request_id!==j.trim())return i(j,"LFV callback rejected: request_id header/body mismatch"),Qe("X-LFV-Request-Id does not match request_id in body");let de=Date.now(),he=cn(fe.issued_at);if(he===void 0)return i(j,"LFV callback rejected: missing or invalid issued_at"),Qe("Missing or invalid issued_at");if(de-he>P)return i(j,"LFV callback rejected: stale (outside freshness window)"),Qe("Callback is stale (issued_at outside freshness window)");let ke=cn(fe.expires_at);if(ke!==void 0&&de>ke)return i(j,"LFV callback rejected: expired"),Qe("Callback has expired");let ve=X.trim();for(let[Ee,$t]of ee)if($t<=de)ee.delete(Ee);if(ee.has(ve))return i(j,"LFV callback rejected: replayed signature"),Qe("Callback signature already processed (replay)");return ee.set(ve,he+P),null}async function po(y){if(!r.selfRedeemReads||y.action!=="read_secret"||typeof y.request_id!=="string"||typeof y.path!=="string"||typeof y.otp!=="string")return!1;let L={startedAt:Date.now(),timeout:g},j=await p("/secrets/request",y.path,"read_secret",y.otp,y.request_id,void 0,L),V=await N(y.request_id,j),X=Y(y.path,V);return K(y.path,X,X.metadata.version),!0}async function Ji(y){let L=await y.text(),j=fo(y),V=await Vr(L,j);if(V)return V;let X=Dt(L);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let D=X;if(D.type!=="otp"||typeof D.request_id!=="string"||typeof D.otp!=="string"||typeof D.path!=="string"||typeof D.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let ie=uo(D);s(D.request_id,"delivery received",{path:ie});let fe=lo(D),de=ie?wr({lfvServerUrl:c,path:ie}):l,he=await zo(de,D,b,O),ke=fe.handled||he>0;if(!ke)try{if(ke=await po(D),!ke&&t&&typeof D.request_id==="string"){let ve=cn(D.expires_at),Ee=Math.max(1,(ve??Date.now()+P)-Date.now());await t.put(D.request_id,{kind:"delivery",key:de,rawBody:L,headers:j},Ee),ke=!0}}catch(ve){if(Qo(ve)){if(!(ve instanceof dt)||ve.status!==409&&ve.status!==410)M.add(D.path);return i(j.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:de,status:ve instanceof dt?ve.status:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:{"Content-Type":"application/json"}})}return ee.delete(j.signature.trim()),i(j.requestId,"LFV callback handoff failed; callback may be retried",{key:de,error:ve instanceof Error?ve.message:String(ve)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(!ke)return ee.delete(j.signature.trim()),i(j.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:de}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function mo(y){if(ne)return;if(!y?.path||typeof y.path!=="string")return;s(y.request_id,"events payload",{path:y.path,event:y.event});for(let L of F)try{L({path:y.path,event:y.event,requestId:y.request_id,issuedAt:y.issued_at,expiresAt:y.expires_at,...typeof y.key_id==="string"&&y.key_id.length>0?{keyId:y.key_id}:{}})}catch(j){i(y.request_id,"secret event listener failed",{path:y.path,event:y.event,error:j instanceof Error?j.message:String(j)})}if(y.event==="created"||y.event==="updated"||y.event==="rotated")v(y.path),(r.selfRedeemReads?_(y.path,y.request_id):S(y.path,y.request_id).then(()=>{return})).catch((j)=>{if(Sr(j)){s(y.request_id,"event refresh aborted: source closed",{path:y.path});return}M.add(y.path),i(y.request_id,"event-triggered refresh failed; source marked degraded",{path:y.path,event:y.event,error:j instanceof Error?j.message:String(j)})})}async function Hi(y){let L=await y.text(),j=fo(y),V=await Vr(L,j);if(V)return V;let X=Dt(L);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let D=X;if(!D?.path||typeof D.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});s(D.request_id,"events received",{path:D.path,event:D.event}),mo(D);let ie=wr({lfvServerUrl:c,path:D.path});return await Bo(ie,D,b,O),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function Yi(){if(ne)return;if(ne=!0,R)R(),R=void 0;let y=new Te(a);for(let L of ue.values()){if(L.timer)clearTimeout(L.timer);try{L.reject(y)}catch{}}ue.clear(),ae.clear(),re.clear(),M.clear(),Q.clear(),ce.clear(),se.clear(),Z.clear(),ee.clear(),W.clear(),F.clear()}return{type:"vault",isAvailable:()=>M.size===0,get:(y,L)=>qe(()=>oe(y,L)),getFullSecret:oe,getSecret:async(y,L)=>(await oe(y,L)).data,putSecret:te,deleteSecret:we,listPaths:le,exists:st,requestRotate:Ve,requestRevoke:jt,parkKmsKey:$i,addKmsKeys:Ki,revokeKmsKey:Vi,getMetadata:Fi,subscribe:co,subscribePassive:Di,subscribeEvents:(y)=>(F.add(y),x(),()=>{F.delete(y),x()}),close:Yi,isDeliveryRequest:zi,isEventsRequest:Bi,handleDelivery:Ji,handleEvents:Hi,deliveryPath:k,eventsPath:T,callbackKey:l,trustId:O}}function ft(e,t,r){if(typeof e!=="string"||e.trim()==="")throw Error(`"${t}" is required when using ${r}`);return e}var Ct="__esLfvBootstrap";import{catalogEntityStore as br,listGenerator as Jt,materializeCodeCatalogEntity as wc,trimTrailingSlash as hc,unionCatalogRead as vc}from"@ionite/core";import{baseCustomerToScim as rs,baseUserToScimUser as ns,baseWorkloadToScim as os,entitlementToScimGroup as pn}from"@ionite/core/server";import{ION_AUTHZ_GROUP_SCHEMA as ln}from"@ionite/core";var ts="application/scim+json",mc="urn:ietf:params:scim:api:messages:2.0:PatchOp",gc="urn:ietf:params:scim:schemas:core:2.0:User",yc="urn:ietf:params:scim:schemas:core:2.0:Group";async function Bt(e){try{let t=(await e.clone().text()).trim();return t?t.slice(0,2000):void 0}catch{return}}function Gt(e){if(e==="user")return"Users";if(e==="workload")return"Workloads";if(e==="customer")return"Customers";return"Groups"}function fn(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class kr{constructor(e){this.inflight=new Map;this.memo=new Map;this.writes=new Map;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.getToken=e.getToken,this.receipts=e.receipts,this.log=e.log,this.fetchImpl=e.fetchImpl??((t,r)=>fetch(t,r))}async headers(){let e=await this.getToken();return new Headers({"Content-Type":ts,Accept:ts,Authorization:`Bearer ${e}`})}inflightKey(e,t,r){return`${e}\x00${t}\x00${r?"create":"lookup"}`}receiptKey(e,t){return`${e}\x00${t}`}serializeWrite(e,t,r){let n=`${e}\x00${t}`,s=(this.writes.get(n)??Promise.resolve()).catch(()=>{return}).then(r);this.writes.set(n,s);let i=()=>{if(this.writes.get(n)===s)this.writes.delete(n)};return s.then(i,i),s}async resolveProviderId(e,t,r){let n=this.receiptKey(e,t),o=this.memo.get(n);if(o)return{found:o.providerId,requestUrl:o.requestUrl};let s=await this.receipts.read(e,t);if(s)this.memo.set(n,s);if(s)return{found:s.providerId,requestUrl:s.requestUrl};let i=this.inflightKey(e,t,r!==void 0),c=this.inflight.get(i);if(c)return c;let u=this.resolveUncached(e,t,r).then(async(a)=>{if(typeof a==="object"){let d={providerId:a.found,...a.requestUrl?{requestUrl:a.requestUrl}:{}};await this.receipts.write(e,t,d),this.memo.set(n,d)}return a}).finally(()=>{this.inflight.delete(i)});return this.inflight.set(i,u),u}async resolveUncached(e,t,r){let n=await this.filterByExternalId(e,t);if(n!=="absent")return n;if(!r)return"absent";return this.create(e,t,r)}async filterByExternalId(e,t){let r=encodeURIComponent(`externalId eq "${fn(t)}"`),n=`${this.baseUrl}/${Gt(e)}?filter=${r}`,o=await this.fetchImpl(n,{method:"GET",headers:await this.headers()});if(!o.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:e,status:o.status,detail:await Bt(o)}),"error";let i=((await o.json()).Resources??[])[0];return i?.id?{found:i.id,...this.requestUrl(e,i)}:"absent"}async create(e,t,r){let n=`${this.baseUrl}/${Gt(e)}`,o=this.writeBody(e,t,r),s=await this.fetchImpl(n,{method:"POST",headers:await this.headers(),body:JSON.stringify(o)});if(!s.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Bt(s)}),"error";let i=await s.json();return i.id?{found:i.id,...this.requestUrl(e,i),created:!0}:"error"}requestUrl(e,t){if(e!=="group")return{};let r=t[ln];if(!r||typeof r!=="object")return{};let n=r.requestUrl;return typeof n==="string"&&n?{requestUrl:n}:{}}async captureResponseReference(e,t,r,n,o){try{let s=await e.clone().json(),i=this.requestUrl(t,s).requestUrl;if(!i&&s.id===void 0)return;let c=i??o,u={providerId:s.id??n,...c?{requestUrl:c}:{}};await this.receipts.write(t,r,u),this.memo.set(this.receiptKey(t,r),u)}catch{}}async invalidate(e,t){this.memo.delete(this.receiptKey(e,t)),await this.receipts.clear(e,t)}writeBody(e,t,r){let{id:n,meta:o,...s}=r,i=s,c=i[ln];if(c&&typeof c==="object"&&!Array.isArray(c)){let{providerId:u,requestUrl:a,...d}=c;i[ln]=d}return{...i,schemas:(r.schemas?.length??0)>0?r.schemas:[e==="user"?gc:yc],externalId:t}}async upsertResource(e,t,r){return this.serializeWrite(e,t,()=>this.upsertResourceNow(e,t,r))}async upsertResourceNow(e,t,r){let n=async(s)=>{let i=await this.resolveProviderId(e,t,s?r:void 0);if(i==="error")return"error";if(i==="absent")return"skipped";if(i.created)return"pushed";let c=await this.fetchImpl(`${this.baseUrl}/${Gt(e)}/${encodeURIComponent(i.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody(e,t,r))});if(c.status===404||c.status===410)return"stale";if(c.ok)return await this.captureResponseReference(c,e,t,i.found,i.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:e,status:c.status,detail:await Bt(c)}),"error"},o=await n(!0);if(o==="stale")await this.invalidate(e,t),o=await n(!0);return o==="stale"?"error":o}async deleteResource(e,t){return this.serializeWrite(e,t,()=>this.deleteResourceNow(e,t))}async deleteResourceNow(e,t){let r=async()=>{let o=await this.resolveProviderId(e,t);if(o==="error")return{outcome:"error"};if(o==="absent")return{outcome:"pushed"};let s=await this.fetchImpl(`${this.baseUrl}/${Gt(e)}/${encodeURIComponent(o.found)}`,{method:"DELETE",headers:await this.headers()});if(s.status===404||s.status===410)return{outcome:"pushed",stale:!0};if(s.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Bt(s)}),{outcome:"error"}},n=await r();if(n.stale)await this.invalidate(e,t),n=await r();if(n.outcome==="pushed")await this.invalidate(e,t);return n.outcome}async patchGroupMembership(e){return this.serializeWrite("group",e.groupExternalId,()=>this.patchGroupMembershipNow(e))}async patchGroupMembershipNow(e){let{groupExternalId:t,userExternalId:r,op:n}=e,o=e.subjectResourceType??"user",s=await this.resolveProviderId(o,r,n==="add"?e.userCreate:void 0);if(s==="error")return this.log.warn("IAM delta: principal lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,subjectResourceType:o}),"error";if(s==="absent")return this.log.warn("IAM delta: principal not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n,subjectResourceType:o}),"skipped";let i=s.found,c=async(d)=>{let g=await this.resolveProviderId("group",t,n==="add"&&d?e.groupCreate:void 0);if(g==="error")return{kind:"error"};if(g==="absent")return{kind:"absent"};let m=`${this.baseUrl}/${Gt("group")}/${encodeURIComponent(g.found)}`,C=n==="add"?[{op:"add",path:"members",value:[{value:i,type:e.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${fn(i)}"]`}];return{kind:"response",response:await this.fetchImpl(m,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[mc],Operations:C})}),providerId:g.found,requestUrl:g.requestUrl}},u=await c(!0);if(u.kind==="response"&&(u.response.status===404||u.response.status===410))await this.invalidate("group",t),u=await c(!1);if(u.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n}),"error";if(u.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n}),"skipped";let a=u.response;if(!a.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,status:a.status,detail:await Bt(a)}),"error";return await this.captureResponseReference(a,"group",t,u.providerId,u.requestUrl),"pushed"}}function Tt(e){if(typeof e==="string")return e;if(e&&typeof e==="object"&&"id"in e)return e.id;return}function Ht(e){return e&&typeof e==="object"?e:void 0}function mn(e){let t={},r={},n,o,s,i,c,u,a,d,g,m=()=>t.users==="patch"||t.workloads==="patch"||t.customers==="patch",C=(v)=>{if(v==="user")return t.users==="patch";if(v==="workload")return t.workloads==="patch";return t.customers==="patch"},P=()=>{if(!t.url)return"destination URL is not configured";if(!r.workload)return"workload identity is not configured";if(typeof r.workload.isReady!=="function"||typeof r.workload.ready!=="function")return"workload handle violates the readiness contract";if(!r.workload.isReady())return"workload module is not ready";if(t.audience){let v=r.workload[t.audience];if(!v)return`outgoing workload client "${t.audience}" is not configured`;if(typeof v.isReady!=="function"||typeof v.ready!=="function")return`outgoing workload client "${t.audience}" violates the readiness contract`;if(!v.isReady())return`outgoing workload client "${t.audience}" is not ready`}return},E=()=>{if(!m())return"no principal-kind delta mode is 'patch'";let v=P();if(v)return v;if(t.users==="patch"&&!r.userStore)return"user store is not configured for IAM destination receipts";if(t.workloads==="patch"&&!r.workloadIdentityStore)return"workload identity store is not configured for IAM destination receipts";if(t.customers==="patch"&&!r.customerStore)return"customer store is not configured for IAM destination receipts";if(!r.catalogStore)return"catalog store is not configured for IAM destination receipts";return},O=()=>E()===void 0,k=ye("IAM delta",O),T=async()=>{let v=r.workload;if(!v)throw Error("IAM delta: workload identity not configured");if(t.audience&&typeof v.getToken==="function")return v.getToken(t.audience);if(typeof v.getServerToken==="function")return v.getServerToken();return v.getToken()},l=()=>vc(r.codeCatalog,r.catalogStore),b=async(v,U)=>{let I=r.catalogStore;if(!I)return;let x=r.codeCatalog?.groups.get(v)??r.codeCatalog?.roles.get(v)??r.codeCatalog?.permissions.get(v);if(x){let w=r.codeCatalog?.groups.get(x.id)?"group":r.codeCatalog?.roles.get(x.id)?"role":"permission",_=br(I,w),h=await _.get(x.id);if(!h&&U)await wc(w,x,_),h=await _.get(x.id);if(h)return{kind:w,entity:h}}let q=[["group",I.groups],["role",I.roles],["permission",I.permissions]];for(let[w,_]of q){let h=await _.get(v);if(h)return{kind:w,entity:h}}return},W=async(v)=>{let U=r.userStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);for await(let I of Jt((x,q)=>U.list({start:x,limit:q})))if(I.externalId===v)return I;return},F=(v)=>v?.providerId?{providerId:v.providerId,...v.requestUrl?{requestUrl:v.requestUrl}:{}}:void 0,Q=async(v)=>{let U=r.workloadIdentityStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);let I=await U.lookup({id:"",externalId:v});if(I)return I;for await(let x of Jt((q,w)=>U.list({start:q,limit:w})))if(x.externalId===v)return x;return},ce=async(v)=>{let U=r.customerStore;if(!U)return;if(U.getByExternalId)return U.getByExternalId(v);let I=await U.lookup({id:"",userName:"",name:"",email:"",externalId:v});if(I)return I;for await(let x of Jt((q,w)=>U.list({start:q,limit:w})))if(x.externalId===v)return x;return},se={async read(v,U){if(v==="user")return F(await W(U));if(v==="workload")return F(await Q(U));if(v==="customer")return F(await ce(U));return F((await b(U,!1))?.entity)},async write(v,U,I){if(v==="user"){let w=await W(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.userStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}if(v==="workload"){let w=await Q(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.workloadIdentityStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}if(v==="customer"){let w=await ce(U);if(!w||w.providerId===I.providerId&&w.requestUrl===I.requestUrl)return;await r.customerStore?.upsert({...w,providerId:I.providerId,requestUrl:I.requestUrl});return}let x=await b(U,!0);if(!x||x.entity.providerId===I.providerId&&x.entity.requestUrl===I.requestUrl)return;await br(r.catalogStore,x.kind).set({...x.entity,providerId:I.providerId,requestUrl:I.requestUrl}).ready()},async clear(v,U){if(v==="user"){let h=await W(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.userStore?.upsert(S);return}if(v==="workload"){let h=await Q(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.workloadIdentityStore?.upsert(S);return}if(v==="customer"){let h=await ce(U);if(!h||h.providerId===void 0&&h.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...S}=h;await r.customerStore?.upsert(S);return}let I=await b(U,!1);if(!I||I.entity.providerId===void 0&&I.entity.requestUrl===void 0)return;let{providerId:x,requestUrl:q,...w}=I.entity;await br(r.catalogStore,I.kind).set(w).ready()}},Z=()=>{if(!O()||!t.url)return;let v=t.url;if(n&&o===v&&s===r.catalogStore&&i===r.userStore&&c===r.workloadIdentityStore&&u===r.customerStore&&a===r.codeCatalog&&d===r.fetchImpl)return n;return n=new kr({baseUrl:t.url,getToken:T,receipts:se,log:e,fetchImpl:r.fetchImpl}),o=v,s=r.catalogStore,i=r.userStore,c=r.workloadIdentityStore,u=r.customerStore,a=r.codeCatalog,d=r.fetchImpl,n},ee=(v)=>v==="workload"?"Workload":v==="customer"?"Customer":"User",ue=async(v)=>{if(v.subjectType==="workload"){let q=Tt(v.subject),w=Ht(v.subject);if(!w&&q)w=await r.workloadIdentityStore?.get(q);let _=w?.externalId??w?.id??q;if(!w||!_)return;return{externalId:_,resourceType:"workload",create:await(r.mapWorkloadToScim?.({...w,externalId:_})??os({...w,externalId:_}))}}if(v.subjectType==="customer"){let q=Tt(v.subject),w=Ht(v.subject);if(!w&&q)w=await r.customerStore?.get(q);let _=w?.externalId??w?.id??q;if(!_)return;let h=w?await(r.mapCustomerToScim?.({...w,externalId:_})??rs({...w,externalId:_})):{schemas:["urn:ionite:scim:schemas:core:2.0:Customer"],externalId:_,displayName:_,active:!0};return{externalId:_,resourceType:"customer",create:h}}let I=Ht(v.subject);if(!I){let q=Tt(v.subject);if(q&&r.userStore)I=await r.userStore.get(q)}let x=I?.externalId;if(!I||!x)return;return{externalId:x,resourceType:"user",create:await(r.mapUserToScim?.(I)??ns(I))}},z=async(v)=>{let I=Ht(v.target);if(!I){let x=Tt(v.target),q=l();if(x&&q)I=v.targetType==="role"?await q.roles.get(x):v.targetType==="permission"?await q.permissions.get(x):await q.groups.get(x)}if(I&&I.requestable!==!0)return"not-requestable";if(!I)return;return{externalId:I.id,create:pn(I,v.targetType)}},J=async(v,U)=>{if(!O())return"skipped";if(!C(v.subjectType==="workload"?"workload":v.subjectType==="customer"?"customer":"user"))return"skipped";let I=await ue(v),x=await z(v);if(x==="not-requestable")return"skipped";if(!I||!x)return e.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:U,hasSubject:Boolean(I),hasTarget:Boolean(x),targetType:v.targetType}),"skipped";let q=Z();if(!q)return"skipped";return q.patchGroupMembership({groupExternalId:x.externalId,userExternalId:I.externalId,op:U,groupCreate:x.create,userCreate:I.create,memberType:ee(v.subjectType),subjectResourceType:I.resourceType})},B=async(v,U,I)=>{let x=[],q=new Set,w=(h)=>{let p=`${h.type??"User"}\x00${h.value}`;if(!q.has(p))q.add(p),x.push(h)},_=r.accessStore;if(_)for await(let h of Jt((p,f)=>_.listByTarget(U,v.id,{start:p,limit:f}))){let p=await ue(h);if(!p){e.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:v.id,targetType:U});continue}let f=await I.resolveProviderId(p.resourceType,p.externalId,p.create);if(f==="error")throw Error(`IAM delta failed to resolve access subject for ${U}:${v.id}`);if(f==="absent")continue;let S=h.metadata;w({value:f.found,type:ee(h.subjectType),...S?.display?{display:S.display}:{}})}if(U==="group"){let h=l();for(let p of v.groups??[]){let f=Tt(p),S=Ht(p);if(!S&&f)S=await h?.groups.get(f);if(S&&S.requestable!==!0)continue;if(!S){e.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:f,target:v.id});continue}let A=await I.resolveProviderId("group",S.id,pn(S,"group"));if(A==="error")throw Error(`IAM delta failed to resolve nested Group for group:${v.id}`);if(A!=="absent")w({value:A.found,type:"Group"})}}return x.length>0?x:void 0},ae=async(v)=>{if(!O()||!C("user"))return"skipped";let U=v.externalId;if(!U)return e.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:v.id,kind:"user"}),"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapUserToScim?.(v)??ns(v));return I.upsertResource("user",U,x)},re=async(v)=>{if(!O()||!C("workload"))return"skipped";let U=v.externalId??v.id;if(!U)return"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapWorkloadToScim?.({...v,externalId:U})??os({...v,externalId:U}));return I.upsertResource("workload",U,x)},ne=async(v)=>{if(!O()||!C("customer"))return"skipped";let U=v.externalId??v.id;if(!U)return"skipped";let I=Z();if(!I)return"skipped";let x=await(r.mapCustomerToScim?.({...v,externalId:U})??rs({...v,externalId:U}));return I.upsertResource("customer",U,x)},R=async(v,U,I=!0)=>{if(!O()||!m())return"skipped";let x=l(),w=(x?await br(x,U).get(v.id):void 0)??v;if(w.requestable!==!0)return"skipped";let _=Z();if(!_)return"skipped";let h=await B(w,U,_),p=await _.upsertResource("group",w.id,pn(w,U,h)),f=r.accessStore;if(p!=="pushed"||!I||!f)return p;for await(let S of Jt((A,N)=>f.listByTarget(U,v.id,{start:A,limit:N})))if(await J(S,"add")==="error")throw Error(`IAM delta failed to restore access for ${U}:${v.id}`);return p},M=(v,U)=>{if(v==="error")throw Error(`IAM delta: destination rejected ${U}`)},G=(v,U,I)=>{if(U==="pushed")v.pushed+=1;else if(U==="skipped")v.skipped+=1;else v.errors.push(`IAM delta: destination rejected ${I}`)},H={async onUserUpsert(v){M(await ae(v),"user upsert")},async onUserDelete(v){if(!O()||!C("user"))return;let U=Z();if(!U)return;M(await U.deleteResource("user",v),"user delete")},async onWorkloadUpsert(v){M(await re(v),"workload upsert")},async onWorkloadDelete(v){if(!O()||!C("workload"))return;let U=Z();if(!U)return;M(await U.deleteResource("workload",v),"workload delete")},async onCustomerUpsert(v){M(await ne(v),"customer upsert")},async onCustomerDelete(v){if(!O()||!C("customer"))return;let U=Z();if(!U)return;M(await U.deleteResource("customer",v),"customer delete")},async onEntitlementUpsert(v,U){M(await R(v,U),`${U} upsert`)},async onEntitlementDelete(v,U){if(!O())return;let I=Z();if(!I)return;M(await I.deleteResource("group",U),`${v} delete`)},async onGrant(v){if(!O())return;if(await J(v,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(v){if(!O())return;if(await J(v,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async requestAccess(v){let U=t.url,I=P();if(I!==void 0||U===void 0)throw Error(`Cannot submit an access request: ${I??"destination URL is not configured"}`);let x=await(r.fetchImpl??fetch)(`${hc(U)}/AccessRequests`,{method:"POST",headers:{Authorization:`Bearer ${await T()}`,"Content-Type":"application/json"},body:JSON.stringify(v)});if(!x.ok)throw Error(`AccessRequests failed: ${x.status} ${await x.text()}`);return await x.json()},async reconcile(v){let U={pushed:0,skipped:0,errors:[]},I=E();if(I)return U.errors.push(`iam delta not ready: ${I}`),U;let x=async(q,w,_)=>{if(!q)return;for await(let h of q)try{G(U,await w(h),_(h))}catch(p){U.errors.push(p instanceof Error?p.message:String(p))}};return await x(v.groups,(q)=>R(q,"group",!1),(q)=>`group upsert for ${q.id}`),await x(v.roles,(q)=>R(q,"role",!1),(q)=>`role upsert for ${q.id}`),await x(v.permissions,(q)=>R(q,"permission",!1),(q)=>`permission upsert for ${q.id}`),await x(v.users,(q)=>ae(q),(q)=>`user upsert for ${q.id??"unknown"}`),await x(v.workloads,(q)=>re(q),(q)=>`workload upsert for ${q.id}`),await x(v.customers,(q)=>ne(q),(q)=>`customer upsert for ${q.id??"unknown"}`),await x(v.access,(q)=>J(q,"add"),(q)=>`membership push for ${Tt(q.target)??"unknown"}`),U},async getDestinationRef(v,U){return se.read(v,U)},isReady:O,ready:k.ready};return{update(v,U){t=v,r=U,Z(),k.refresh();let I=E();if(!m())g=void 0;else if(I!==g){if(I)e.warn(`IAM delta configured but not ready: ${I}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:I});g=I}return H},handle(){return H}}}var gn=2,Sc=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"iam.workloads",module:"iam",label:"SCIM Workloads inbound",requires:"workloadIdentityStore",incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."},{key:"iam.customers",module:"iam",label:"SCIM Customers inbound",requires:"customerStore",incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."}];import{IoniteError as kc}from"@ionite/core";function bc(e){if(e instanceof kc)return{status:e.status,statusText:e.statusText};if(typeof e!=="object"||e==null)return;let t=e,r=typeof t.status==="number"?t.status:void 0,n=typeof t.statusText==="string"?t.statusText:void 0;return r!=null||n?{status:r,statusText:n}:void 0}function Pt(e){if(e instanceof Response)return e;let t=bc(e);if(!t)return Response.json({error:"internal_error"},{status:500});let n={status:t.status??500};if(t.statusText)n.statusText=t.statusText;return Response.json({error:t.statusText??"internal_error"},n)}function me(){return Response.json({error:"not_found"},{status:404})}function It(e=["GET"]){return Response.json({error:"method_not_allowed",allow:e},{status:405,headers:{Allow:e.join(", ")}})}import{timingSafeEqual as Rc}from"node:crypto";import{parseKmsPoolDocument as Cc,stableConfigHash as is}from"@ionite/core";function ss(e,t,r){for(let n of e)try{n()}catch(o){t.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:r,error:o instanceof Error?o.message:String(o)})}}function We(e,t){let r=new Set,n=new Set;return{beforeChange(o){return r.add(o),()=>{r.delete(o)}},afterChange(o){return n.add(o),()=>{n.delete(o)}},emitBefore(){ss(r,e,`${t} beforeChange`)},emitAfter(){ss(n,e,`${t} afterChange`)}}}var Tc=604800000,Pc=2147483647,Ic=1;function ds(e,t){if(!e.value)return!1;if(e.notBefore&&Date.parse(e.notBefore)>t)return!1;if(e.notAfter&&Date.parse(e.notAfter)<=t)return!1;return!0}function _e(e,t,r=Date.now()){if(!e)return;let n=e.slots?.[t];if(!n)return;let o=e.keys.find((s)=>s.id===n&&s.state==="active");return o&&ds(o,r)?o:void 0}function yn(e,t=Date.now()){if(!e)return[];return e.keys.filter((r)=>(r.state==="active"||r.state==="deprecated")&&ds(r,t))}function as(e){return{...e,...e.meta?{meta:{...e.meta}}:{}}}function Rr(e,t,r){if(!t||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>o(Error(r)),t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function cs(e,t){let r=Buffer.from(e),n=Buffer.from(t);return r.length===n.length&&Rc(r,n)}function Oc(e){if(!Number.isInteger(e)||e<1)throw Error("KMS unique() requires a positive integer slot count.");return e}var Ec=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function Ac(e){return Ec.has(e)}function us(e){let t=e.trim().replace(/\/+$/,"");if(!t||t==="/")return"/";return t.startsWith("/")?t:`/${t}`}function _c(e,t){let r=us(e),n=us(t);return r===n||r.endsWith(n)}function Lc(e,t,r){let n=We(t,`KMS pool "${e}"`),o=new Set,s=!1,i,c,u=0,a,d,g=Ic,m,C,P=new Map,E=new Set,O,k=()=>i!==void 0&&i.slots===void 0&&i.keys.length>0,T=ye(`KMS pool "${e}"`,()=>{if(!s)return!1;if(k())return yn(i).length>0;return _e(i,0)!==void 0}),l=ye(`KMS pool "${e}" issuer`,()=>s&&m!==void 0),b=(h)=>h===0?`KMS pool "${e}"`:`KMS pool "${e}" slot ${h}`,W=(h)=>{let p=P.get(h),f=p?.valueWaiter;if(!p||!f)return;if(!s){p.valueWaiter=void 0,f.reject(Error(`${b(h)} is no longer configured.`));return}if(k()){p.valueWaiter=void 0,f.reject(Error(`${b(h)} verifier grant has no slots.`));return}let S=_e(i,h);if(S?.value)p.valueWaiter=void 0,f.resolve(S.value)},F=()=>{for(let h of P.keys())W(h)},Q=(h)=>{let p=P.get(h);if(!p)return;let f=_e(i,h);for(let S of p.listeners)try{S(f?as(f):void 0)}catch(A){t.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:e,slot:h,error:A instanceof Error?A.message:String(A)})}},ce=()=>{for(let h of P.keys())Q(h)},se=()=>{for(let h of P.values())h.latch.refresh();T.refresh(),l.refresh()},Z=()=>{try{O?.()}catch(h){t.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:e,error:h instanceof Error?h.message:String(h)})}O=void 0},ee=()=>{if(O||E.size===0||!m?.subscribeEvents||!C)return;let h=C;O=m.subscribeEvents((p)=>{if(!Ac(p.event)||!_c(p.path,h))return;let f={path:p.path,event:p.event,...p.requestId===void 0?{}:{requestId:p.requestId},...p.keyId===void 0?{}:{keyId:p.keyId}};for(let S of E)try{S(f)}catch(A){t.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:e,error:A instanceof Error?A.message:String(A)})}})},ue=()=>{if(d)clearTimeout(d);d=void 0},z=()=>{ue();let h=Date.now();if(i){for(let f of i.keys){if(!f.notAfter)continue;let S=Date.parse(f.notAfter)-h;if(S>0&&S<=Tc&&(f.state==="active"||f.state==="deprecated")&&!o.has(f.id))o.add(f.id),t.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:e,keyId:f.id,notAfter:f.notAfter})}let p=i.keys.flatMap((f)=>[f.notBefore,f.notAfter]).filter((f)=>Boolean(f)).map((f)=>Date.parse(f)).filter((f)=>f>h).sort((f,S)=>f-S);if(p[0])d=setTimeout(()=>{let f=new Map([...P.keys()].map((S)=>[S,_e(i,S)?.id]));se(),r();for(let S of P.keys())if(f.get(S)!==_e(i,S)?.id)Q(S);z()},Math.min(p[0]-h+1,Pc))}se(),r(),F()},J=(h)=>{let p=new Map([...P.keys()].map((f)=>{let S=_e(i,f);return[f,{id:S?.id,value:S?.value}]}));n.emitBefore();try{i=Cc(h),z();for(let f of P.keys()){let S=_e(i,f),A=p.get(f);if(A?.id!==S?.id||A?.value!==S?.value)Q(f)}}catch(f){i=void 0,z(),ce(),t.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:e,error:f instanceof Error?f.message:String(f)})}finally{n.emitAfter()}},B=()=>{try{a?.()}catch(h){t.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:e,error:h instanceof Error?h.message:String(h)})}a=void 0},ae=(h,p)=>{m=h,C=p,u+=1;let f=u;B(),h.subscribe(p,(S)=>{if(u!==f||!s)return;J(S.data)},{kmsSlots:g}).then((S)=>{if(u!==f||!s){S();return}a=S}).catch((S)=>{if(u!==f||!s)return;i=void 0,z(),ce(),t.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:e,path:p,error:S instanceof Error?S.message:String(S)})})},re=(h,p)=>{let f=R(h),S=_e(i,h);if(!s)return Promise.reject(Error(`${b(h)} is no longer configured.`));if(k())return Promise.reject(Error(`${b(h)} verifier grant has no slots.`));if(S?.value)return Promise.resolve(S.value);if(!f.valueWaiter){let N,Y,K=new Promise((oe,te)=>{N=oe,Y=te});f.valueWaiter={promise:K,resolve:N,reject:Y}}let A=f.valueWaiter.promise;return W(h),Rr(A,p,`${b(h)} was not ready within ${p}ms.`)},ne=(h,p)=>{let f=R(h);f.listeners.add(p);let S=_e(i,h);return p(S?as(S):void 0),()=>f.listeners.delete(p)};function R(h){let p=P.get(h);if(p)return p;let f=ye(b(h),()=>s&&_e(i,h)!==void 0),S={listeners:new Set,latch:f,api:{value:(A)=>re(h,A),current:()=>_e(i,h)?.value,subscribe:(A)=>ne(h,A),park:(A,N)=>H(A,N),isReady:f.isReady,ready:f.ready}};return P.set(h,S),S}let M=(h)=>{if(k())throw Error(`KMS pool "${e}" verifier grant has no slots.`);let p=Oc(h),f=p>g;g=Math.max(g,p);let S=[];for(let A=0;A<p;A+=1)S.push(R(A).api);if(f&&s&&m&&C)ae(m,C);return S},G=(h)=>yn(i).find((p)=>p.value!==void 0&&cs(h,p.value)),H=(h,p)=>{if(!s||!m||!C)return Promise.reject(Error(`KMS pool "${e}" is not configured.`));if(typeof h.value!=="string"||h.value.length===0)return Promise.reject(Error(`KMS pool "${e}" park() requires a non-empty value.`));let f=G(h.value);if(!f)return Promise.resolve({parked:!1,stale:!0});return Rr(m.parkKmsKey(C,{keyId:f.id,status:h.status,reason:h.reason},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" park() did not complete within ${p}ms.`)},v=()=>{if(!s||!m||!C)throw Error(`KMS pool "${e}" is not configured.`);return{source:m,path:C}},U=(h)=>{if(!Array.isArray(h)||h.length===0)throw Error(`KMS pool "${e}" addKeys() requires a non-empty keys array.`);return h.map((p,f)=>{if(!p||typeof p!=="object")throw Error(`KMS pool "${e}" addKeys() keys[${f}] must be an object.`);if(typeof p.value!=="string"||p.value.length===0)throw Error(`KMS pool "${e}" addKeys() keys[${f}].value must be a non-empty string.`);if(p.id!==void 0&&(typeof p.id!=="string"||p.id.length===0))throw Error(`KMS pool "${e}" addKeys() keys[${f}].id must be a non-empty string when present.`);return p})},I=(h,p)=>{try{let{source:f,path:S}=v(),A=U(h);return Rr(f.addKmsKeys(S,{keys:A},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" addKeys() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},x=(h,p)=>{try{let{source:f,path:S}=v();if(typeof h.keyId!=="string"||h.keyId.length===0)throw Error(`KMS pool "${e}" revokeKey() requires a non-empty keyId.`);return Rr(f.revokeKmsKey(S,h,p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" revokeKey() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},q=(h)=>{let{source:p}=v();if(!p.subscribeEvents)throw Error(`KMS pool "${e}" events are not supported by this secrets transport.`);return E.add(h),ee(),()=>{E.delete(h)}};R(0);let w={value:(h)=>re(0,h),current:()=>_e(i,0)?.value,unique:M,accepts:(h)=>yn(i).some((p)=>p.value!==void 0&&cs(h,p.value)),park:H,subscribe:(h)=>ne(0,h),beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:T.isReady,ready:T.ready},_={addKeys:I,revokeKey:x,events:q,isReady:l.isReady,ready:l.ready};return{api:w,issuer:_,update(h,p,f){let S=is({config:h,path:f});if(s=!0,c===S){se();return}c=S,B(),Z(),ue(),i=void 0,se(),r(),ce(),F(),ae(p,f),ee()},unavailable(h){s=!0,c=is(h),u+=1,m=void 0,C=void 0,Z(),B(),ue(),i=void 0,se(),r(),ce(),F()},remove(){if(!s)return;n.emitBefore(),s=!1,c=void 0,u+=1,m=void 0,C=void 0,Z(),B(),ue(),i=void 0,se(),r(),ce(),F(),n.emitAfter()},close(){s=!1,u+=1,m=void 0,C=void 0,Z(),E.clear(),B(),ue();for(let h of P.values())h.listeners.clear();i=void 0,F();for(let h of P.values())h.latch.settle();T.settle(),l.settle()},isConfigured:()=>s}}function ls(e){let t=new Map,r=new Map,n=We(e,"KMS"),o=!1,i=ye("KMS module",()=>o&&Array.from(t.values()).every((m)=>!m.isConfigured()||m.api.isReady())),c,u=()=>i.refresh(),a=(m)=>{let C=t.get(m);if(C)return C;let P=Lc(m,e,u);if(t.set(m,P),!(m in c))Object.assign(c,{[m]:P.api});return P},d=(m)=>{let C=t.get(m);if(!C)throw Error(`KMS pool "${m}" is not configured.`);return C.api},g=(m)=>{let C=t.get(m);if(!C)throw Error(`KMS pool "${m}" is not configured.`);return C.issuer};return c={get config(){return Object.fromEntries(r)},beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:i.isReady,ready:i.ready,listPools:()=>Array.from(r.keys()),getPool:d,issuer:g},{handle:()=>c,update(m,C){if(!m&&!o&&t.size===0)return;n.emitBefore(),o=m!==void 0;let P=new Set(Object.keys(m??{}));for(let[E,O]of Object.entries(m??{})){r.set(E,{...O});let k=O.path??`/kms/${E}`;try{a(E).update(O,C(O),k)}catch(T){a(E).unavailable(O),e.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:E,error:T instanceof Error?T.message:String(T)})}}for(let[E,O]of t){if(P.has(E))continue;r.delete(E),O.remove()}return i.refresh(),n.emitAfter(),o||t.size>0?c:void 0},close(){for(let m of t.values())m.close();t.clear(),r.clear(),o=!1,i.settle()}}}import{formatLogLine as Uc}from"@ionite/core";import{context as xc,trace as Mc}from"@opentelemetry/api";import{logs as Wc,SeverityNumber as Ne}from"@opentelemetry/api-logs";import{OTLPLogExporter as jc}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as $c}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as qc}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as Nc}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as Kc}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as Vc}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as Fc}from"@opentelemetry/resources";import{BatchLogRecordProcessor as Dc}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as zc}from"@opentelemetry/sdk-metrics";import{NodeSDK as Bc}from"@opentelemetry/sdk-node";var fs={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},Gc={trace:!1,debug:!1,info:!0,warn:!0,error:!0},Jc={trace:Ne.TRACE,debug:Ne.DEBUG,info:Ne.INFO,warn:Ne.WARN,error:Ne.ERROR};function wn(e,t){let r=t[e];if(r===!1)return!1;if(e==="metrics")return r===!0||typeof r==="object";return!0}function vn(e){return typeof e==="object"&&e!==null?e:void 0}function Hc(e){return typeof e==="object"&&e!==null?e:void 0}function Yc(e,t){let r=e.replace(/\/+$/,"");if(r.endsWith(fs[t]))return r;return`${r}${fs[t]}`}function Xc(e,t){let r=vn(e[t]);if(r?.endpoint)return r.endpoint;if(!e.endpoint)return;return Yc(e.endpoint,t)}function Zc(e,t,r){let n=vn(e[t]),o={...e.headers,...n?.headers??{}};if(r)o.Authorization=`Bearer ${r}`;return o}function Sn(e,t,r){let n=vn(e[t]);return{url:Xc(e,t),headers:Zc(e,t,r),timeoutMillis:n?.timeoutMillis,concurrencyLimit:n?.concurrencyLimit}}function Qc(e,t){let r=Sn(e,"traces",t);return e.protocol==="http/json"?new Kc(r):new Vc(r)}function eu(e,t){let r=Sn(e,"metrics",t);return e.protocol==="http/json"?new qc(r):new Nc(r)}function tu(e,t){let r=Sn(e,"logs",t);return e.protocol==="http/json"?new jc(r):new $c(r)}function ru(e){return{"service.name":e.name,...e.version?{"service.version":e.version}:{},...e.deploymentEnvironment?{"deployment.environment.name":e.deploymentEnvironment}:{},...e.resourceAttributes??{}}}async function nu(e){if(!e.oauth)return;let t=new URLSearchParams({grant_type:"client_credentials",client_id:e.oauth.clientId,client_secret:e.oauth.clientSecret});if(e.oauth.scope)t.set("scope",e.oauth.scope);if(e.oauth.audience)t.set("audience",e.oauth.audience);let r=await fetch(e.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...e.oauth.headers??{}},body:t});if(!r.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${r.status}`);let n=await r.json();if(typeof n.access_token!=="string"||!n.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return n.access_token}function ou(e,t){return{...Gc,...t?.levels??{},...e.levels??{}}}function Yt(e,t="Authorization"){let r={...e.headers??{}};if(!e.apiKey)return r;let n=e.apiKeyHeader??t;return r[n]=n.toLowerCase()==="authorization"?`Bearer ${e.apiKey}`:e.apiKey,r}function su(e,t){return Object.keys(e).some((r)=>r.toLowerCase()===t.toLowerCase())}function gs(e,t,r){let n=Object.keys(e).find((o)=>o.toLowerCase().startsWith(t.toLowerCase()));if(n)throw Error(`OpenTelemetry provider "${r}" does not support provider-specific header "${n}".`)}function Xt(e,t,r,n){return{type:r,name:e.name,version:e.version,protocol:e.protocol??"http/protobuf",endpoint:e.endpoint,headers:n,resourceAttributes:ru(e),levels:ou(e,t),console:e.console??"info",traces:e.traces,metrics:e.metrics,logs:e.logs}}function iu(e,t){return Xt(e,t,"otlp",Yt(e))}function au(e,t){return Xt(e,t,"grafana-lgtm",Yt(e))}function cu(e,t){let r=Yt(e,"DD-API-KEY");if(!su(r,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return Xt(e,t,"datadog",r)}function uu(e,t){let r=Yt(e);return gs(r,"DD-","splunk"),Xt(e,t,"splunk",r)}function du(e,t){let r=Yt(e);return gs(r,"DD-","elastic"),Xt(e,t,"elastic",r)}function lu(e,t){let r=e.type??"otlp";switch(r){case"otlp":return iu(e,t);case"grafana-lgtm":return au(e,t);case"datadog":return cu(e,t);case"splunk":return uu(e,t);case"elastic":return du(e,t);default:throw Error(`Unsupported OpenTelemetry provider type: ${r}`)}}function fu(e,t){if(typeof e==="string")return e;if(e instanceof Error)return e.message;if(e!=null)return hn(e);if(t.length===0)return"";return hn(t[0])}function hn(e){if(typeof e==="string")return e;try{return JSON.stringify(e)}catch{return String(e)}}function ps(e,t,r){if(r==null)return;if(typeof r==="string"||typeof r==="number"||typeof r==="boolean"){e[t]=r;return}if(Array.isArray(r)&&r.every((n)=>["string","number","boolean"].includes(typeof n))){e[t]=r;return}if(r instanceof Error){if(e[`${t}.name`]=r.name,e[`${t}.message`]=r.message,r.stack)e[`${t}.stack`]=r.stack;return}e[t]=hn(r)}function pu(e){let t={};for(let[n,o]of e.entries()){if(o&&typeof o==="object"&&!Array.isArray(o)&&!(o instanceof Error)&&Object.getPrototypeOf(o)===Object.prototype){for(let[s,i]of Object.entries(o))ps(t,s,i);continue}ps(t,`param.${n}`,o)}let r=Mc.getSpanContext(xc.active());if(r)t.trace_id=r.traceId,t.span_id=r.spanId,t.trace_flags=r.traceFlags;return t}function mu(e){return e}function gu(e,t){globalThis.console[mu(e)](Uc(e,t.body,[t.attributes??{}]))}function yu(e,t,r,n){if(r.console==="off")return;if((t.severityNumber??0)<Jc[r.console])return;let o=n?.console;if(o){o(t);return}gu(e,t)}function wu(e,t){let r=Wc.getLogger(e.name,e.version),n=(o,s,i)=>{if(!e.levels[o])return;let c={severityNumber:s,severityText:o.toUpperCase(),body:fu(i[0],i.slice(1)),attributes:pu(i.slice(1))};try{r.emit(c)}finally{yu(o,c,e,t)}};return{trace:(o,...s)=>n("trace",Ne.TRACE,[o,...s]),debug:(o,...s)=>n("debug",Ne.DEBUG,[o,...s]),info:(o,...s)=>n("info",Ne.INFO,[o,...s]),warn:(o,...s)=>n("warn",Ne.WARN,[o,...s]),error:(o,...s)=>n("error",Ne.ERROR,[o,...s])}}function hu(e){return e?.current()}function vu(e,t,r){let n=t;return e.subscribe((o)=>{let s=o?.value;if(s===n)return;n=s,r()})}function ms(e){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:e,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function kn(e,t,r,n){if(!t&&!r)return;if(!t)return ms(e);let o=t,s;if(o.apiKeyPool&&n)try{s=n.getPool(o.apiKeyPool)}catch{s=void 0}let i=hu(s),c=()=>kn(e,o,r,n),u=o.apiKeyPool&&n?(T)=>vu(n.getPool(o.apiKeyPool),i,T):void 0;if(o.apiKeyPool&&!i){let T=ms(e);return T.onCredentialChange=u,T.rebuild=c,T}let a=i?{...o,apiKey:i}:o,d=lu(a,r),g,m=!1,C=wu(d,r),P,E,O=new Promise((T,l)=>{P=T,E=l});async function k(){try{let T=await nu(o),l={resource:Fc(d.resourceAttributes),instrumentations:r?.instrument};if(r?.sampler)l.sampler=r.sampler;if(r?.textMapPropagator)l.textMapPropagator=r.textMapPropagator;if(r?.contextManager)l.contextManager=r.contextManager;if(r?.spanProcessors)l.spanProcessors=r.spanProcessors;else if(wn("traces",d))l.traceExporter=Qc(d,T);if(r?.metricReaders)l.metricReaders=r.metricReaders;else if(wn("metrics",d)){let W=Hc(d.metrics);l.metricReaders=[new zc({exporter:eu(d,T),exportIntervalMillis:W?.exportIntervalMillis,exportTimeoutMillis:W?.exportTimeoutMillis})]}if(r?.logRecordProcessors)l.logRecordProcessors=r.logRecordProcessors;else if(wn("logs",d))l.logRecordProcessors=[new Dc({exporter:tu(d,T)})];let b=r?.configure?.(l);g=new Bc(b??l),g.start(),m=!0,P?.()}catch(T){m=!1;let l=T instanceof Error?T:Error(String(T));e.error?.("OpenTelemetry startup failed",l),E?.(l)}finally{P=void 0,E=void 0}}return{state:"available",start:k,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>m,ready:(T)=>{if(!T||T<=0)return O;return Promise.race([O,new Promise((l,b)=>{setTimeout(()=>b(Error(`OpenTelemetry ready timed out after ${T}ms.`)),T)})])},logger:C,forceFlush:async()=>{await g?.forceFlush?.()},shutdown:async()=>{m=!1,await g?.shutdown(),g=void 0},onCredentialChange:u,rebuild:c}}function ys(e){let t,r,n,o=0,s=Promise.resolve(),i=We(e,"OpenTelemetry"),c=ye("OpenTelemetry module",()=>t?.isReady()===!0),u={beforeChange:i.beforeChange,afterChange:i.afterChange,isReady:c.isReady,ready:c.ready,logger:{trace:(g,...m)=>(t?.logger??e).trace(g,...m),debug:(g,...m)=>(t?.logger??e).debug(g,...m),info:(g,...m)=>(t?.logger??e).info(g,...m),warn:(g,...m)=>(t?.logger??e).warn(g,...m),error:(g,...m)=>(t?.logger??e).error(g,...m)},forceFlush:async()=>{await t?.forceFlush()},shutdown:async()=>{await t?.shutdown()}},a=!1,d;return d={update(g){if(!g){if(t||r){let E=t,O=r;o+=1,i.emitBefore(),n?.(),n=void 0,t=void 0,r=void 0,c.refresh(),s=Promise.all([E?.shutdown(),O?.shutdown()]).finally(()=>i.emitAfter()).then(()=>{return},()=>{return})}return a?u:void 0}if(a=!0,g===t||g===r)return u;let m=t,C=r;o+=1;let P=o;return i.emitBefore(),n?.(),n=void 0,t=void 0,r=g,c.refresh(),s=(async()=>{try{if(await Promise.all([m?.shutdown(),C?.shutdown()]),await g.start(),P!==o||r!==g){await g.shutdown();return}t=g,r=void 0,c.refresh(),n=g.onCredentialChange?.(()=>{if(t!==g)return;let E=g.rebuild?.();if(E)d.update(E)})}finally{if(P===o)i.emitAfter()}})().then(()=>{return},()=>{return}),u},settled(){return s},async shutdown(){o+=1;let g=t,m=r;n?.(),n=void 0,t=void 0,r=void 0,c.settle(),await Promise.all([g?.shutdown(),m?.shutdown()])}},d}import{ION_ENDPOINT_PERMISSIONS as Ot,trimTrailingSlash as ws}from"@ionite/core";import{hasPermission as Su}from"@ionite/core/server";async function pt(e,t,r){let n=await Su(e,t,r.permission,void 0,r.subjectType);return n.allow?void 0:n.response()}function ku(e){let t=ws(e);return{matchesPath:(o)=>{if(!o)return!1;return ws(o)===t},startsWithPath:(o)=>{if(!o)return!1;return e===o||e.startsWith(`${o}/`)}}}function hs(e,t,r,n){let o=n??new URL(e.url).pathname,{matchesPath:s,startsWithPath:i}=ku(o);if(t.sso){let c=t.sso;if(s(r.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(u)=>c.handler(u)};if(s(r.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(u)=>c.logout(u)};if(s(r.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(u)=>c.logoutBackChannel(u)};if(s(r.sso.loginUrl)||s(r.sso.refreshUrl)||s(r.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(u)=>c.handler(u)}}if(t.ciam){let c=t.ciam;if(s(r.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(u)=>{let a=await c.resolveCustomer(u);if(a.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(a.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(a.value),{headers:{"Content-Type":"application/json"}})}};if(s(r.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(u)=>c.logout(u)}}if(t.iam){let c=t.iam,u=e.method!=="GET"&&e.method!=="HEAD";if(i(r.iam.usersUrl))return{module:"iam",kind:u?"iam.users.write":"iam.read",requiredPermission:Ot[u?"iam.users.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.groupsUrl))return{module:"iam",kind:u?"iam.groups.write":"iam.read",requiredPermission:Ot[u?"iam.groups.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.workloadsUrl))return{module:"iam",kind:u?"iam.workloads.write":"iam.read",requiredPermission:Ot[u?"iam.workloads.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(r.iam.customersUrl))return{module:"iam",kind:u?"iam.customers.write":"iam.read",requiredPermission:Ot[u?"iam.customers.write":"iam.read"],handler:async(a)=>c.handler(a)};if(i(`${r.iam.basePath}/AccessRequests`))return{module:"iam",kind:"iam.access-requests.write",requiredPermission:Ot["iam.access-requests.write"],handler:async(a)=>c.handler(a)};if(i(r.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(a)=>c.handler(a)}}if(t.workload){let c=t.workload;if(s(r.workload.validateUrl)||s(r.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(u)=>c.handler(u)}}if(t.secrets){let c=t.secrets;if(c.isLfvDeliveryRequest?.(e)&&c.handleLfvDelivery){let u=c.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(a)=>u(a)}}if(c.isLfvEventsRequest?.(e)&&c.handleLfvEvents){let u=c.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(a)=>u(a)}}}if(t.ciam){let c=t.ciam;if(s(r.ciam.magicLinkUrl)&&e.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:Ot["ciam.magic-link.create"],handler:async(u)=>c.handler(u)};if(s(r.ciam.magicLinkLoginUrl)&&e.method==="GET"||s(r.ciam.customerProvidersUrl)&&e.method==="GET"||s(r.ciam.customerLoginUrl)&&e.method==="GET"||s(r.ciam.customerCallbackUrl)&&(e.method==="GET"||e.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(u)=>c.handler(u)}}return}async function bn(e,t,r,n){let o=n??Fe(ur()),s=new URL(e.url).pathname;if(r?.filter){let g=await r.filter(e,t);if(g instanceof Response)return g;if(g==="not_handled")return me()}let i=hs(e,t,o,s),u=await r?.resolve?.(e,t,i)??i;if(!u)return me();let a=u.requiredPermission===void 0?i?.requiredPermission:u.requiredPermission,d=async()=>{if(a){let g=await pt(e,t,a);if(g)return g}return u.handler(e)};if(r?.wrap)return await r.wrap(e,u,d,t);return await d()}import{stableConfigHash as Vu}from"@ionite/core";function Cr(){let e=0;return{next:()=>(e+=1,e),isCurrent:(t)=>t===e,current:()=>e}}import{readFile as ju,stat as $u}from"node:fs/promises";class Et extends Error{constructor(e,t,r){super(e);this.code=t;this.status=r;this.sourceType="vault";this.name="VaultWebSocketCommandError"}}class Be extends Error{constructor(e,t=`Vault secret not found at path ${e}`){super(t);this.path=e;this.sourceType="vault";this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}}class ge extends Error{constructor(e,t,r,n,o){super(e,o);this.path=t;this.status=r;this.code=n;this.sourceType="vault";this.name="VaultRequestError"}}class Le extends Error{constructor(e,t,r=`Vault subscribe is not supported for source ${e} at path ${t} without websocket, LFV, or ttl`){super(r);this.sourceType=e;this.path=t;this.name="VaultSubscribeNotSupportedError"}}function vs(e){return e instanceof Be||e instanceof Et&&(e.code==="not_found"||e.status===404)}import{WebSocket as Zt}from"ws";var bu=1000,Ru=30000,ks=30000,bs=ks;function Rs(e){bs=e>0?e:ks}function Cs(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Cu(e){let t=Math.min(Ru,bu*2**Math.min(e,16)),r=0.5+Math.random()*0.5;return Math.round(t*r)}var mt=new Map;function Tu(e){return e.trim().replace(/\/+$/g,"")}function Ts(e,t){let r=typeof t?.version==="number"?t.version:0,n=t?.created_time??t?.created,o=typeof n==="string"?new Date(n):new Date,s=ut(t);return{path:e,version:r,created:o,...s?{contentType:s}:{}}}function Pu(e){return typeof e?.version==="number"?e.version:void 0}function Iu(e){let t=e.token?.trim();if(!t)return{};if(e.header==="Authorization")return{Authorization:t.startsWith("Bearer ")?t:`Bearer ${t}`};return{"X-Vault-Token":t}}function Qt(e){return{client_id:e.clientId,token:e.token,header:e.header??"X-Vault-Token"}}function Cn(e,t){let r=Tu(e),n=mt.get(r);if(n){if(t&&!n.log)n.log=t;return n}let o={url:r,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:t};return mt.set(r,o),o}function Ou(e){let t=[...Array.from(e.subs.values(),(o)=>o.creds),...e.eventListeners.values()];if(t.length===0)return e.lastGoodCreds??{url:e.url};let r=e.lastGoodCreds?[e.lastGoodCreds,...t]:t,n=r[e.reconnectCredCursor%r.length]??t[0];return e.reconnectCredCursor+=1,n}function Ss(e,t){for(let r of e.subs.values())try{r.onHealth?.(t)}catch(n){e.log?.warn("Vault websocket health hook threw",n)}}function Eu(e,t){for(let r of Array.from(e.subs.values())){let n=r.onFirstSecretReject;if(r.onFirstSecret=void 0,r.onFirstSecretReject=void 0,n)try{n(new ge(`Vault websocket subscription interrupted (${t})`,r.path,void 0,"connection"))}catch(o){e.log?.warn("Vault websocket first-secret waiter rejection threw",o)}}}function Ps(e,t){for(let r of e.pending.values())clearTimeout(r.timer),r.reject(new ge(`Vault websocket command interrupted (${t})`,"/",void 0,"connection"));e.pending.clear()}function Tr(e){if(e.disposed)return;if(e.disposed=!0,e.reconnectTimer)clearTimeout(e.reconnectTimer),e.reconnectTimer=void 0;Ps(e,"closed"),Eu(e,"socket disposed");let t=e.ws;if(e.ws=void 0,e.connectPromise=void 0,e.hasConnected=!1,mt.delete(e.url),t)try{t.removeAllListeners(),t.close()}catch{}}function Pr(e){if(e.subs.size>0||e.pending.size>0||e.eventListeners.size>0)return;Tr(e)}function Rn(e){return`${e.clientId??""}|${e.token??""}|${e.header??"X-Vault-Token"}`}function Is(e){let t=new Map;for(let r of e.eventListeners.values())t.set(Rn(r),r);return Array.from(t.values())}function Au(e,t){if(typeof t.path!=="string"||typeof t.event!=="string")return;let r={path:t.path,event:t.event,...typeof t.request_id==="string"?{requestId:t.request_id}:{},...typeof t.key_id==="string"&&t.key_id.length>0?{keyId:t.key_id}:{}};for(let n of e.eventListeners.keys())try{n(r)}catch(o){e.log?.warn("Vault websocket event listener threw",o)}}function Os(e,t,r,n){if(n!==void 0&&t.lastVersion!==void 0&&n===t.lastVersion)return;if(n!==void 0)t.lastVersion=n;try{t.onChange(r)}catch(s){e.log?.warn("Vault websocket subscription onChange threw",s)}let o=t.onFirstSecret;if(t.onFirstSecret=void 0,t.onFirstSecretReject=void 0,o)try{o()}catch(s){e.log?.warn("Vault websocket subscription onFirstSecret threw",s)}}function _u(e,t){let r=t.subscription_id;if(typeof r!=="string")return;let n=e.subs.get(r);if(!n)return;let o={data:t.data,metadata:Ts(typeof t.path==="string"?t.path:n.path,t.metadata)};Os(e,n,o,Pu(t.metadata))}function Lu(e,t){let r;try{r=JSON.parse(t.toString())}catch(n){e.log?.warn("Vault websocket message parse failed",n);return}if(r.type==="secret"){_u(e,r);return}if(r.type==="event"){Au(e,r);return}if(r.type==="command_result"&&typeof r.id==="string"){let n=e.pending.get(r.id);if(!n)return;if(e.pending.delete(r.id),clearTimeout(n.timer),r.ok===!1)n.reject(new Et(r.error??`Vault websocket command failed for ${r.id}`,r.code,r.status));else n.resolve(r.result);Pr(e)}}function Es(e,t){e.send(JSON.stringify({type:"subscribe",subscription_id:t.subscriptionId,paths:[t.path],...Cs(t.kmsSlots),...Qt(t.creds)}))}function Tn(e){if(e.disposed||e.reconnectTimer||e.subs.size===0&&e.eventListeners.size===0)return;let t=Cu(e.reconnectAttempts);e.reconnectAttempts+=1,e.reconnectTimer=setTimeout(()=>{if(e.reconnectTimer=void 0,e.disposed)return;if(e.subs.size===0&&e.eventListeners.size===0){Tr(e);return}Ir(e,Ou(e)).catch(()=>{if(e.hasConnected)e.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${t}ms).`);Tn(e)})},t)}function Ir(e,t){if(e.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if(e.ws&&e.ws.readyState===Zt.OPEN)return Promise.resolve(e.ws);if(e.connectPromise)return e.connectPromise;return e.connectPromise=new Promise((r,n)=>{let o=new Zt(e.url,{headers:Iu(t)}),s=!1,i=e.hasConnected,c=()=>{s=!0,e.hasConnected=!0,e.reconnectAttempts=0,e.reconnectCredCursor=0,e.lastGoodCreds=t,e.ws=o,e.connectPromise=void 0,o.on("message",(d)=>Lu(e,d));for(let d of e.subs.values())try{Es(o,d)}catch{}for(let d of Is(e))try{o.send(JSON.stringify({type:"subscribe_events",...Qt(d)}))}catch{}if(i)Ss(e,!0);r(o)},u=()=>{if(e.ws===o)e.ws=void 0;e.connectPromise=void 0;try{o.removeAllListeners()}catch{}if(Ps(e,"socket closed"),e.subs.size>0||e.eventListeners.size>0)Ss(e,!1),Tn(e);else Tr(e)},a=(d)=>{if(e.ws===o)e.ws=void 0;if(!s)s=!0,e.connectPromise=void 0,n(d)};o.once("open",c),o.on("close",u),o.on("error",a)}),e.connectPromise}async function Pn(e,t,r,n){let o=Cn(e.url,n),s=typeof r.path==="string"?r.path:"/",i=await Ir(o,e),c=crypto.randomUUID();try{return await new Promise((u,a)=>{let d=setTimeout(()=>{if(!o.pending.has(c))return;o.pending.delete(c),a(new ge(`Vault websocket command "${t}" timed out`,s,void 0,"timeout"));try{o.ws?.close()}catch{}},bs);o.pending.set(c,{resolve:(g)=>u(g),reject:a,timer:d});try{i.send(JSON.stringify({type:"command",id:c,command:t,...r,...Qt(e)}))}catch(g){clearTimeout(d),o.pending.delete(c),a(g)}})}finally{Pr(o)}}async function In(e,t,r,n){let o;try{o=await Pn(e,"read_secret",{path:t,...Cs(n)},r)}catch(s){if(vs(s))throw new Be(t);if(s instanceof Et||s instanceof ge)throw s;throw new ge(`Vault websocket read_secret failed for ${t}`,t,void 0,"connection",{cause:s})}if(!o||typeof o!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${t}`);return{data:o.data,metadata:Ts(typeof o.path==="string"?o.path:t,o.metadata)}}async function As(e,t,r,n,o,s){let i=Cn(e.url,o),c=crypto.randomUUID(),u={subscriptionId:c,creds:e,path:t,...n?.kmsSlots!==void 0?{kmsSlots:n.kmsSlots}:{},onChange:r,onHealth:s?.onHealth};i.subs.set(c,u);let a=()=>{if(!i.subs.delete(c))return;if(i.ws&&i.ws.readyState===Zt.OPEN)try{i.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:c}))}catch{}Pr(i)};try{let d=await Ir(i,e);Es(d,u)}catch(d){if(n?.mode!=="wait")throw a(),d}try{let d=await In(e,t,o,n?.kmsSlots);Os(i,u,d,d.metadata.version)}catch(d){if(n?.mode!=="wait")throw a(),d;await new Promise((g,m)=>{let C,P=(E)=>{if(C)clearTimeout(C);u.onFirstSecret=void 0,u.onFirstSecretReject=void 0,a(),m(E)};if(u.onFirstSecret=()=>{if(C)clearTimeout(C);g()},u.onFirstSecretReject=P,typeof n.timeout==="number"&&n.timeout>0)C=setTimeout(()=>P(d),n.timeout)})}return a}async function _s(e,t,r){let n=Cn(e.url,r);n.eventListeners.set(t,e);try{let o=await Ir(n,e);if(o.readyState===Zt.OPEN)o.send(JSON.stringify({type:"subscribe_events",...Qt(e)}))}catch(o){n.log?.warn("Vault websocket event subscription connect failed; retrying in background",o),Tn(n)}return()=>{if(!n.eventListeners.delete(t))return;let o=Rn(e);if(!Is(n).some((i)=>Rn(i)===o)&&n.ws&&n.ws.readyState===Zt.OPEN)try{n.ws.send(JSON.stringify({type:"unsubscribe_events",...Qt(e)}))}catch{}Pr(n)}}function Ls(){let e=0;for(let t of mt.values())e+=t.subs.size;return{urls:Array.from(mt.keys()),sockets:mt.size,subscriptions:e}}function Us(){for(let e of Array.from(mt.values()))Tr(e)}var Or=600000;function gt(e){if(e&&e<Or)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${Or} milliseconds (10 minutes), as not to overload the store with polling requests`)}function Ge(e,t,r,n,o,s,i){let c=!1,u,a,d,g=(k)=>{try{i?.onHealth?.(k)}catch{}},m=()=>{if(c=!0,u)clearTimeout(u),u=void 0;a?.()},C=(k)=>new Promise((T)=>{let l=setTimeout(()=>{a=void 0,u=void 0,T()},k);u=l,a=()=>{clearTimeout(l),a=void 0,u=void 0,T()}});async function P(){let k=Date.now();for(;;){if(c)return;try{let T=await e.getFullSecret(t,s);return g(!0),T}catch(T){if(g(!1),s?.mode!=="wait")throw T;if(typeof s.timeout==="number"&&s.timeout>0&&Date.now()-k>=s.timeout)throw T;if(c)return;o?.warn(`Error retrieving initial secret from vault. Retrying in ${n} milliseconds`,T),await C(n)}}}async function E(){if(u=void 0,c)return;try{let k=await e.getFullSecret(t,s);if(g(!0),k.metadata.version!==d)d=k.metadata.version,r(k)}catch(k){g(!1),o?.warn(`Error retrieving remote config from vault. Retrying in ${n} milliseconds`,k)}O()}function O(){if(c)return;u=setTimeout(()=>{E()},n)}return P().then((k)=>{if(c||!k)return()=>m();return d=k.metadata.version,r(k),O(),()=>m()})}function Uu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function xu(e){let t={"Content-Type":"application/json"};if(e)t["X-Vault-Token"]=e;return t}function Mu(e){return Boolean(e?.idpTokenUrl?.trim()&&e.clientId?.trim()&&e.clientSecret?.trim())}async function xs(e,t){let r=Date.now();if(t.token&&t.expiresAt&&t.expiresAt-60000>r)return t.token;let n=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});if(e.scope?.trim())n.set("scope",e.scope.trim());let o=await fetch(e.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()});if(!o.ok)throw Error(`Vault workload token request failed (${o.status})`);let s=await o.json();if(!s.access_token)throw Error("Vault workload token response did not include access_token");return t.token=s.access_token,t.expiresAt=r+Math.max(1,s.expires_in??300)*1000,s.access_token}function Wu(e){return{Authorization:e.startsWith("Bearer ")?e:`Bearer ${e}`}}function er(e){return e.replace(/\/data\/?$/,"")}function Ms(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let n=e;if(typeof n.parked!=="boolean")throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let o=n.disposition;if(o!==void 0&&o!=="cooldown"&&o!=="suspect")throw Error(`Vault ${r} kms_park returned invalid disposition for ${t}`);return{parked:n.parked,...n.stale===!0?{stale:!0}:{},...o?{disposition:o}:{}}}function Ws(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);let n=e;if(!Array.isArray(n.keys))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);return{keys:n.keys.map((s,i)=>{if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}] for ${t}`);let c=s.id;if(typeof c!=="string"||c.length===0)throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}].id for ${t}`);return{id:c}})}}function js(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);let n=e;if(typeof n.revoked!=="boolean")throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);return{revoked:n.revoked}}function At(e,t){let{type:r="vault",url:n,token:o,ttl:s}=e,i=()=>e.log,c=Mu(e.workload)?e.workload:void 0,u={},a=xu(o),{lfv:d,websocket:g}=e,m=d?lt({...d,log:d.log??i(),path:d.path??"/"},t):void 0,C=new Map,P=g?.url?.trim(),E=new Set,O=!1,k=!1;if(!d&&!n&&!P)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(gt(s),n&&!o&&!c&&!d)i()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function T(){if(c){let w=await xs(c,u);return{"Content-Type":"application/json",...Wu(w)}}return{...a}}async function l(w){let _=F(w);if(c){let h=await xs(c,u);return{url:_,clientId:g?.clientId??c.clientId,token:h,header:"Authorization"}}return{url:_,clientId:g?.clientId,token:g?.token??o,header:g?.header??"X-Vault-Token"}}function b(w){if(!d)throw Error(`Vault LFV capability is not configured for path ${w}`);let _=C.get(w);if(_)return _;let h=lt({...d,log:d.log??i(),path:w},t);return C.set(w,h),h}function W(w){if(!n)throw Error(`Vault HTTP capability is not configured for path ${w}`);return n}function F(w){if(!P)throw Error(`Vault websocket capability is not configured for path ${w}`);return P}async function Q(w,_){let h=await l(typeof _.path==="string"?_.path:"/");return Pn(h,w,_,i())}async function ce(w,_){let h=W(w),p;try{let f=await T(),S=new URL(`${h}/${w}`);if(typeof _?.kmsSlots==="number"&&Number.isInteger(_.kmsSlots)&&_.kmsSlots>=1)S.searchParams.set("kms_slots",String(_.kmsSlots));p=await fetch(S,{headers:f})}catch(f){throw new ge(`Vault request failed from URL: ${h}/${w}`,w,void 0,"connection",{cause:f})}if(p.status!==200){if(p.status===404)throw new Be(w);let f=p.status===401||p.status===403,S=f?`Vault returned ${p.status} ${p.statusText} (auth error) from URL: ${h}/${w}`:`Vault returned invalid status, ${p.status}: '${p.statusText}' from URL: ${h}/${w}`;throw new ge(S,w,p.status,f?"auth":"invalid_status")}try{let S=(await p.json()).data;if(!S?.metadata||!("data"in S))throw Error("Missing vault secret data");let A=S.metadata.created_time??S.metadata.created;return{data:S.data,metadata:{path:typeof S.metadata.path==="string"?S.metadata.path:w,version:typeof S.metadata.version==="number"?S.metadata.version:0,created:A instanceof Date?A:typeof A==="string"?new Date(A):new Date,...ut(S.metadata)?{contentType:ut(S.metadata)}:{}}}}catch(f){throw new ge("Error retrieving secret",w,void 0,"invalid_payload",{cause:f})}}async function se(w,_){let h=await l(w);return In(h,w,i(),_?.kmsSlots)}async function Z(w){let _=W(w),h=`${er(_)}/metadata/${w}`,p=await T(),f=await fetch(h,{headers:p});if(f.status!==200)throw new ge(`Vault getMetadata failed (${f.status}) for ${w}`,w,f.status,"invalid_status");let S=await f.json().catch(()=>null);if(!S?.metadata||typeof S.metadata!=="object")throw new ge(`Vault getMetadata returned invalid payload for ${w}`,w,f.status,"invalid_payload");return S.metadata}async function ee(w,_,h){let p=W(_),f=`${er(p)}/${w}/${_}`,S=await T(),A=await fetch(f,{method:"POST",headers:S,body:JSON.stringify({reason:h?.reason,severity:h?.severity,incident_ref:h?.incidentRef})});if(A.status!==200&&A.status!==202&&A.status!==204)throw new ge(`Vault ${w} failed (${A.status}) for ${_}`,_,A.status,"invalid_status")}async function ue(w,_){if(d)return await b(w).getFullSecret(w,_);if(n)return await ce(w,_);return await se(w,_)}async function z(w,_,h){if(!Uu(_))throw Error(`putSecret requires an object value for vault source at path ${w}`);if(d){await b(w).putSecret(w,_,h);return}if(n){let p=W(w),f=await T();if(f["X-Ionite-Mime-Type"]=h.contentType.mimeType,f["X-Ionite-Secret-Format"]=h.contentType.format,h.contentType.schemaUrl)f["X-Ionite-Schema-Url"]=h.contentType.schemaUrl;if(h.contentType.typeId)f["X-Ionite-Secret-Type"]=h.contentType.typeId;let S=await fetch(`${p}/${w}`,{method:"POST",headers:f,body:JSON.stringify(_)});if(S.status!==200&&S.status!==201&&S.status!==204)throw new ge(`Vault putSecret failed (${S.status}) for ${w}`,w,S.status,"invalid_status");return}await Q("put_secret",{path:w,data:_,content_type:yr(h.contentType)})}async function J(w,_){if(d){await b(w).deleteSecret(w,_);return}if(n){let h=W(w),p=await T(),f=await fetch(`${h}/${w}`,{method:"DELETE",headers:p});if(f.status!==200&&f.status!==202&&f.status!==204)throw new ge(`Vault deleteSecret failed (${f.status}) for ${w}`,w,f.status,"invalid_status");return}await Q("delete_secret",{path:w})}async function B(w,_){if(d)return await b(w).listPaths(w,_);if(n){let f=`${W(w)}/${w}`,S=async(K)=>{let oe=await T();if(K==="LIST")return fetch(f,{method:"LIST",headers:oe});let te=f.includes("?")?"&":"?";return fetch(`${f}${te}list=true`,{method:"GET",headers:oe})},A=await S("LIST");if(A.status===405||A.status===501)A=await S("GET");if(A.status!==200)throw new ge(`Vault listPaths failed (${A.status}) for ${w}`,w,A.status,"invalid_status");let N=await A.json().catch(()=>null),Y;if(N&&typeof N==="object"){let K=N,oe=K.data;if(oe&&typeof oe==="object")Y=oe.keys;else Y=K.keys}if(!Array.isArray(Y))throw new ge(`Vault listPaths returned an unexpected response for ${w}`,w,void 0,"invalid_payload");return Y.filter((K)=>typeof K==="string")}let h=await Q("list_paths",{path:w});if(!Array.isArray(h.items))throw Error(`Vault websocket list_paths returned invalid payload for ${w}`);return h.items.filter((p)=>typeof p==="string")}async function ae(w,_){if(d)return await b(w).exists(w,_);if(n){let p=W(w),f=await T(),S=await fetch(`${p}/${w}`,{headers:f});if(S.status===200)return!0;if(S.status===404)return!1;if(S.status===401||S.status===403)throw new ge(`Vault exists failed (${S.status}) for ${w} (auth error)`,w,S.status,"auth");throw new ge(`Vault exists failed (${S.status}) for ${w}`,w,S.status,"invalid_status")}let h=await Q("exists",{path:w});if(typeof h.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${w}`);return h.exists}async function re(w,_,h){if(d){await b(w).requestRotate(w,_,h);return}if(n){await ee("rotate/request",w,_);return}await Q("request_rotate",{path:w,reason:_?.reason,severity:_?.severity,incident_ref:_?.incidentRef})}async function ne(w,_,h){if(d){await b(w).requestRevoke(w,_,h);return}if(n){await ee("revoke/request",w,_);return}await Q("request_revoke",{path:w,reason:_?.reason,severity:_?.severity,incident_ref:_?.incidentRef})}async function R(w,_,h){if(d)return await b(w).parkKmsKey(w,_,h);if(n){let f=W(w),S=`${er(f)}/kms/park/${w}`,A=await T(),N=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({key_id:_.keyId,status:_.status,reason:_.reason})});if(N.status!==200&&N.status!==202)throw new ge(`Vault kms/park failed (${N.status}) for ${w}`,w,N.status,"invalid_status");return Ms(await N.json().catch(()=>null),w,"http")}let p=await Q("kms_park",{path:w,key_id:_.keyId,status:_.status,reason:_.reason});return Ms(p,w,"websocket")}async function M(w,_,h){if(d)return await b(w).addKmsKeys(w,_,h);if(n){let f=W(w),S=`${er(f)}/kms/add-keys/${w}`,A=await T(),N=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({keys:_.keys})});if(N.status!==200&&N.status!==202)throw new ge(`Vault kms/add-keys failed (${N.status}) for ${w}`,w,N.status,"invalid_status");return Ws(await N.json().catch(()=>null),w,"http")}let p=await Q("kms_add_keys",{path:w,keys:_.keys});return Ws(p,w,"websocket")}async function G(w,_,h){if(d)return await b(w).revokeKmsKey(w,_,h);if(n){let f=W(w),S=`${er(f)}/kms/revoke-key/${w}`,A=await T(),N=await fetch(S,{method:"POST",headers:A,body:JSON.stringify({key_id:_.keyId,reason:_.reason})});if(N.status!==200&&N.status!==202)throw new ge(`Vault kms/revoke-key failed (${N.status}) for ${w}`,w,N.status,"invalid_status");return js(await N.json().catch(()=>null),w,"http")}let p=await Q("kms_revoke_key",{path:w,key_id:_.keyId,reason:_.reason});return js(p,w,"websocket")}async function H(w,_){if(d)return await b(w).getMetadata(w,_);if(n)return await Z(w);let h=await Q("read_metadata",{path:w});if(!h.metadata||typeof h.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${w}`);return h.metadata}async function v(w,_,h){if(!s)throw new Le(r,w);return Ge({getFullSecret:ce},w,_,s,i(),h,{onHealth:(p)=>{O=!p}})}async function U(w,_,h){let p=await l(w);return As(p,w,_,h,i(),{onHealth:(f)=>{k=!f}})}function I(w){let _=()=>{if(E.delete(_))w()};return E.add(_),_}function x(){if(m?.isAvailable?.()===!1)return!0;for(let w of C.values())if(w.isAvailable?.()===!1)return!0;return!1}let q={type:r,isAvailable:()=>!O&&!k&&!x(),get:(w,_)=>qe(()=>ue(w,_)),getFullSecret:ue,getSecret:async(w,_)=>(await ue(w,_)).data,putSecret:z,deleteSecret:J,listPaths:B,exists:ae,requestRotate:re,requestRevoke:ne,parkKmsKey:R,addKmsKeys:M,revokeKmsKey:G,getMetadata:H,subscribe:async(w,_,h)=>{let p;if(P)p=await U(w,_,h);else if(d)p=await b(w).subscribe(w,_,h);else p=await v(w,_,h);return I(p)},...m?{subscribeEvents:(w)=>I(m.subscribeEvents?.(w)??(()=>{}))}:P?{subscribeEvents:(w)=>{let _,h=!1;return l("/").then((p)=>_s(p,w,i())).then((p)=>{if(h){p();return}_=p}).catch((p)=>{i()?.warn("Vault websocket event subscription failed",p)}),I(()=>{h=!0,_?.()})}}:{},close:()=>{for(let _ of Array.from(E))try{_()}catch(h){i()?.warn("Vault source close: failed to release a subscription",h)}E.clear();let w=(_)=>{if(!_?.close)return;try{Promise.resolve(_.close()).catch((h)=>{i()?.warn("Vault source close: LFV close failed",h)})}catch(h){i()?.warn("Vault source close: LFV close failed",h)}};for(let _ of C.values())w(_);w(m),C.clear(),u.token=void 0,u.expiresAt=void 0},get log(){return e.log},set log(w){e.log=w}};if(m)q.isDeliveryRequest=(w)=>m.isDeliveryRequest(w),q.isEventsRequest=(w)=>m.isEventsRequest(w),q.handleDelivery=(w)=>m.handleDelivery(w),q.handleEvents=(w)=>m.handleEvents(w),Object.defineProperties(q,{deliveryPath:{value:m.deliveryPath,enumerable:!0},eventsPath:{value:m.eventsPath,enumerable:!0},callbackKey:{value:m.callbackKey,enumerable:!0},trustId:{value:m.trustId,enumerable:!0}});return q}class Ar extends Error{constructor(e,t){super(e);this.name="AzureKeyVaultError",this.status=t,Object.setPrototypeOf(this,Ar.prototype)}}function Er(e,t){if(!e||e.trim().length===0)throw Error(`Missing required Azure config: ${t}`);return e}function qu(e){return e.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function On(e,t){return`${e.replace(/\/+$/g,"")}/${t.replace(/^\/+/g,"")}`}function Nu(e){try{let r=new URL(e).pathname.split("/").filter(Boolean),n=r.indexOf("secrets");if(n===-1)return;return r[n+2]||void 0}catch{return}}function Ku(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function _r(e){let t=e.apiVersion??"7.4",r=e.scope??"https://vault.azure.net/.default",n=e.secretNameTransform??qu,o=e.authMethod,s="/var/run/secrets/azure/tokens/azure-identity-token",i=e.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",c=e.vaultUrl??(e.vaultName?`https://${e.vaultName}.vault.azure.net`:void 0)??void 0,u=Er(c,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function a(z){try{return await $u(z),!0}catch{return!1}}let d,g,m=!1;async function C(z){let{entraTenantId:J,clientId:B}=e;if(!J)throw Error("Workload identity requires entraTenantId");if(!B)throw Error("Workload identity requires clientId");if(!await a(i))throw Error(`Federated token file not found at ${i}`);let ae=(await ju(i,"utf8")).trim();if(!ae)throw Error("Federated token file was empty");let re=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:B,grant_type:"client_credentials",scope:r,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:ae}),R=await fetch(re,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:ne});if(R.status!==200)throw Error(`Azure workload identity token exchange returned ${R.status} ${R.statusText}`);let M=await R.json();if(!M?.access_token)throw Error("Azure token response missing access_token");return d={accessToken:M.access_token,expiresAtMs:z+(M.expires_in??0)*1000},M.access_token}async function P(z){let J=e.imdsApiVersion??"2018-02-01",B="https://vault.azure.net",ae=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(ae.searchParams.set("api-version",J),ae.searchParams.set("resource","https://vault.azure.net"),e.managedIdentityClientId)ae.searchParams.set("client_id",e.managedIdentityClientId);let re=await fetch(ae.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(re.status!==200)throw Error(`Azure IMDS token endpoint returned ${re.status} ${re.statusText}`);let ne=await re.json();if(!ne?.access_token)throw Error("IMDS token response missing access_token");let R=z+60000;if(ne.expires_on){let M=Number.parseInt(ne.expires_on,10);if(Number.isFinite(M)&&M>0)R=M*1000;else{let G=Date.parse(ne.expires_on);if(Number.isFinite(G))R=G}}else if(ne.expires_in){let M=Number.parseInt(ne.expires_in,10);if(Number.isFinite(M)&&M>0)R=z+M*1000}return d={accessToken:ne.access_token,expiresAtMs:R},ne.access_token}async function E(z){let J=Er(e.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),B=Er(e.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),ae=Er(e.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),re=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:B,client_secret:ae,grant_type:"client_credentials",scope:r}),R=await fetch(re,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:ne});if(R.status!==200)throw Error(`Azure token endpoint returned ${R.status} ${R.statusText}`);let M=await R.json();if(!M?.access_token)throw Error("Azure token response missing access_token");return d={accessToken:M.access_token,expiresAtMs:z+(M.expires_in??0)*1000},M.access_token}async function O(){let z=Date.now();if(d&&d.expiresAtMs-60000>z)return d.accessToken;if(g)return g;g=(async()=>{if(o==="workload_identity")return await C(z);if(o==="managed_identity")return await P(z);if(o==="client_secret")return await E(z);if(await a(i))try{return await C(z)}catch{}try{return await P(z)}catch{}return await E(z)})();try{return await g}finally{g=void 0}}async function k(z){let J=await O(),B=On(u,`/secrets/${encodeURIComponent(z)}?api-version=${encodeURIComponent(t)}`),ae=await fetch(B,{headers:{Authorization:`Bearer ${J}`,Accept:"application/json"}});if(ae.status!==200)throw new Ar(`Key Vault request failed (${ae.status})`,ae.status);return await ae.json()}async function T(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await k(ae),ne=re.value;try{ne=JSON.parse(re.value)}catch{}let R=re.attributes?.created?re.attributes.created*1000:void 0,M=Nu(re.id),G=re.contentType?gr({mimeType:re.contentType,format:re.tags?.["ionite-format"],schemaUrl:re.tags?.["ionite-schema-url"],typeId:re.tags?.["ionite-type-id"]}):void 0;return{data:ne,metadata:{path:z,version:Number.parseInt(M??"",10)||0,created:R?new Date(R):new Date,...G?{contentType:G}:{}}}}async function l(z,J,B){if(!Ku(J))throw Error(`putSecret requires an object value for azure source at path ${z}`);let ae=n(z),re=e.secretNamePrefix?`${e.secretNamePrefix}${ae}`:ae,ne=await O(),R=On(u,`/secrets/${encodeURIComponent(re)}?api-version=${encodeURIComponent(t)}`),M=JSON.stringify({value:JSON.stringify(J),contentType:B.contentType.mimeType,tags:{"ionite-format":B.contentType.format,...B.contentType.schemaUrl?{"ionite-schema-url":B.contentType.schemaUrl}:{},...B.contentType.typeId?{"ionite-type-id":B.contentType.typeId}:{}}}),G=await fetch(R,{method:"PUT",headers:{Authorization:`Bearer ${ne}`,"Content-Type":"application/json",Accept:"application/json"},body:M});if(G.status!==200&&G.status!==201)throw Error(`Key Vault putSecret failed (${G.status}) for ${z}`)}async function b(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await O(),ne=On(u,`/secrets/${encodeURIComponent(ae)}?api-version=${encodeURIComponent(t)}`),R=await fetch(ne,{method:"DELETE",headers:{Authorization:`Bearer ${re}`,Accept:"application/json"}});if(R.status!==200&&R.status!==202&&R.status!==204)throw Error(`Key Vault deleteSecret failed (${R.status}) for ${z}`)}async function W(z,J){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${z}`)}async function F(z,J){try{return await T(z),!0}catch(B){if(B instanceof Ar&&B.status===404)return!1;throw B}}async function Q(z,J,B){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${z}`)}async function ce(z,J,B){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${z}`)}async function se(z){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${z}`)}async function Z(z){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${z}`)}async function ee(z){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${z}`)}async function ue(z,J){let B=n(z),ae=e.secretNamePrefix?`${e.secretNamePrefix}${B}`:B,re=await k(ae),ne=re.contentType?gr({mimeType:re.contentType,format:re.tags?.["ionite-format"],schemaUrl:re.tags?.["ionite-schema-url"],typeId:re.tags?.["ionite-type-id"]}):void 0;return{id:re.id,...ne?{content_type:ne}:{},...re.attributes??{}}}return{type:e.type,isAvailable:()=>!m,get:(z,J)=>qe(()=>T(z,J)),getFullSecret:T,getSecret:async(z,J)=>(await T(z,J)).data,putSecret:l,deleteSecret:b,listPaths:W,exists:F,requestRotate:Q,requestRevoke:ce,parkKmsKey:se,addKmsKeys:Z,revokeKmsKey:ee,getMetadata:ue,subscribe:(z,J,B)=>{if(!e.ttl)throw new Le("azure",z);return gt(e.ttl),Ge({getFullSecret:T},z,J,e.ttl,void 0,B,{onHealth:(ae)=>{m=!ae}})},close:()=>{d=void 0,g=void 0,m=!1}}}var En=Symbol("ion.secretsSourceState");function Fu(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${n}`)};return{type:"dev",get:(r,n)=>qe(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[En]:"unavailable"}}function $s(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${n}`)};return{type:"dev",get:(r,n)=>qe(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[En]:"removed"}}function Du(e){return e.type==="vault"&&e.lfv!=null}function zu(e,t,r,n){if(!Du(t))return;if(r||n)return;throw Error(`Secrets source "${e}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function Bu(e,t,r){if(t.type==="vault")return At(t,r);if(t.type==="azure")return _r(t);if(t.type==="aws"||t.type==="gcp"||t.type==="dev")throw Error(`Secrets source "${e}" uses type "${t.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${e}"`)}function Gu(e,t){let r=(n)=>{t.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:n instanceof Error?n.message:String(n)})};try{Promise.resolve(e.close?.()).catch(r)}catch(n){r(n)}}function Ju(e){let t=new Map,r=new Map,n=new Map;for(let[o,s]of Object.entries(e)){if(!qs(s))continue;let i=t.get(s.deliveryPath);if(i)throw Error(`LFV delivery path "${s.deliveryPath}" is claimed by both secrets sources "${i}" and "${o}"; delivery paths must be globally unique.`);t.set(s.deliveryPath,o);let c=r.get(s.eventsPath);if(c)throw Error(`LFV events path "${s.eventsPath}" is claimed by both secrets sources "${c}" and "${o}"; events paths must be globally unique.`);r.set(s.eventsPath,o);let u=n.get(s.callbackKey);if(u&&u.trustId!==s.trustId)throw Error(`LFV callback key "${s.callbackKey}" is claimed by secrets sources "${u.sourceName}" and "${o}" with different verify JWKS; a callback path must use a single trust key.`);if(!u)n.set(s.callbackKey,{sourceName:o,trustId:s.trustId})}}function qs(e){return typeof e.isDeliveryRequest==="function"&&typeof e.isEventsRequest==="function"&&typeof e.handleDelivery==="function"&&typeof e.handleEvents==="function"}function Hu(e,t,r){let n={...t},o=[],s=(c)=>{if(n[c]!==void 0)delete n[c],o.push(c)};s("token"),s("clientSecret"),s("workload");let i=n.websocket;if(i&&typeof i==="object"&&i.token!==void 0){let c={...i};delete c.token,n.websocket=c,o.push("websocket.token")}if(o.length>0)r.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:e,"ion.droppedFields":o});return n}function Yu(e,t,r){let n={},o=new Set([...Object.keys(t??{}),...Object.keys(r??{})]);for(let s of o){let i=t?.[s],c=r?.[s],u=c?Hu(s,c,e):void 0;n[s]={...i??{},...u??{}}}return n}function Lr(e){return e[En]??"available"}function Xu(e,t,r){let n=t,o=new Set,s=new Set,i=new Set,c=We(r,`Secrets source "${e}"`),u=()=>Lr(n)==="available",a=ye(`Secrets source "${e}"`,u),d=(l,b,W)=>Error(`${l} timed out after ${W}ms waiting for source "${e}" to be configured by the ConfigSource at path ${b}`),g=(l,b)=>Error(`${l} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${b}`),m=(l,b,W)=>{let F=Lr(n);if(F==="available")return Promise.resolve(n);if(F==="removed")return Promise.reject(g(l,b));return new Promise((Q,ce)=>{let se={method:l,path:b,resolve:(ee)=>{if(se.timeout)clearTimeout(se.timeout);i.delete(se),Q(ee)},reject:(ee)=>{if(se.timeout)clearTimeout(se.timeout);i.delete(se),ce(ee)}},Z=W?.timeout;if(typeof Z==="number"&&Z>0)se.timeout=setTimeout(()=>{se.reject(d(l,b,Z))},Z);i.add(se)})},C=(l)=>{for(let b of Array.from(i))b.resolve(l)},P=()=>{for(let l of Array.from(i))l.reject(g(l.method,l.path))},E=async(l,b=!1)=>{let W=l.guard.next();if(l.unsubscribe?.(),l.unsubscribe=void 0,l.closed)return;if(Lr(n)==="unavailable"&&l.options?.mode!=="wait"){if(b)throw Error(`subscribe is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${l.path}`);return}try{let Q=await(l.options?.mode==="wait"?await m("subscribe",l.path,l.options):n).subscribe(l.path,(ce)=>{if(!l.closed)l.onChange(ce)},l.options);if(l.closed||!l.guard.isCurrent(W)){Q?.();return}l.unsubscribe=Q}catch(F){if(b)throw F;if(Sr(F)){r.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:e,path:l.path});return}r.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:e,path:l.path,error:F instanceof Error?F.message:String(F)})}},O=(l,b=!1)=>{if(l.unsubscribe?.(),l.unsubscribe=void 0,l.closed)return;if(!n.subscribeEvents){if(b)throw Error(`Secrets source "${e}" does not support lifecycle event subscriptions`);return}l.unsubscribe=n.subscribeEvents((W)=>{if(!l.closed)l.listener(W)})},k={get type(){return n.type},beforeChange:c.beforeChange,afterChange:c.afterChange,isAvailable:()=>u()&&(n.isAvailable?.()??!0),isReady:a.isReady,ready:a.ready,get:(l,b)=>qe(async()=>(await m("get",l,b)).getFullSecret(l,b)),getFullSecret:async(l,b)=>(await m("getFullSecret",l,b)).getFullSecret(l,b),getSecret:async(l,b)=>(await m("getSecret",l,b)).getSecret(l,b),putSecret:async(l,b,W)=>(await m("putSecret",l,W)).putSecret(l,b,W),subscribe:async(l,b,W)=>{let F={path:l,onChange:b,options:W,closed:!1,guard:Cr()};o.add(F);try{await E(F,!0)}catch(Q){throw o.delete(F),Q}return()=>{F.closed=!0,F.guard.next(),o.delete(F),F.unsubscribe?.(),F.unsubscribe=void 0}},subscribeEvents:(l)=>{let b={listener:l,closed:!1};s.add(b);try{O(b,!0)}catch(W){throw s.delete(b),W}return()=>{b.closed=!0,s.delete(b),b.unsubscribe?.(),b.unsubscribe=void 0}},deleteSecret:async(l,b)=>(await m("deleteSecret",l,b)).deleteSecret(l,b),listPaths:async(l,b)=>(await m("listPaths",l,b)).listPaths(l,b),exists:async(l,b)=>(await m("exists",l,b)).exists(l,b),requestRotate:async(l,b,W)=>(await m("requestRotate",l,W)).requestRotate(l,b,W),requestRevoke:async(l,b,W)=>(await m("requestRevoke",l,W)).requestRevoke(l,b,W),parkKmsKey:async(l,b,W)=>(await m("parkKmsKey",l,W)).parkKmsKey(l,b,W),addKmsKeys:async(l,b,W)=>(await m("addKmsKeys",l,W)).addKmsKeys(l,b,W),revokeKmsKey:async(l,b,W)=>(await m("revokeKmsKey",l,W)).revokeKmsKey(l,b,W),getMetadata:async(l,b)=>(await m("getMetadata",l,b)).getMetadata(l,b)},T=(l)=>{try{Promise.resolve(l.close?.()).catch((b)=>{r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:b instanceof Error?b.message:String(b)})})}catch(b){r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:b instanceof Error?b.message:String(b)})}};return{api:k,update(l){if(l===n)return;let b=n;c.emitBefore(),n=l;let W=Lr(l);if(W==="available")C(l);else if(W==="removed")P();a.refresh();for(let F of o)E(F);for(let F of s)O(F);T(b),c.emitAfter()},close(){for(let l of o)l.closed=!0,l.guard.next(),l.unsubscribe?.(),l.unsubscribe=void 0;o.clear();for(let l of s)l.closed=!0,l.unsubscribe?.(),l.unsubscribe=void 0;s.clear(),P(),a.settle(),T(n)}}}function Ns(e,t=new Map){let r=new Map,n=new Map,o,s=!1,i=new Map,c=We(e,"Secrets"),u=!1,a=()=>{for(let k of r.keys()){let T=i.get(k);if(T&&T.api.isReady?.()===!1)return!1}return!0},d=ye("Secrets module",()=>u&&a()),g=(k)=>{let T=i.get(k);if(T)return T;let l=Xu(k,r.get(k)??$s(k),e);if(i.set(k,l),!(k in O))Object.assign(O,{[k]:l.api});return l},m=(k)=>{let T=i.get(k)?.api;if(T)return T;throw e.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:k}),Error(`Secrets source "${k}" is not configured`)},C=()=>Array.from(r.values()).filter(qs),P=(k)=>C().find((T)=>T.isDeliveryRequest(k)),E=(k)=>C().find((T)=>T.isEventsRequest(k)),O;return O={get config(){return Object.fromEntries(Array.from(r.keys(),(k)=>[k,g(k).api]))},beforeChange:c.beforeChange,afterChange:c.afterChange,isReady:d.isReady,isAvailable:()=>{for(let k of i.values()){if(k.api.isReady?.()===!1)continue;if(k.api.isAvailable?.()===!1)return!1}return!0},ready:d.ready,listSecretsSources:()=>Array.from(r.keys()),getSecretsSource:(k)=>{if(r.has(k))return g(k).api;return m(k)},get:(k,T,l)=>O.getSecretsSource(k).get(T,l),getSecret:(k,T,l)=>O.getSecretsSource(k).getSecret(T,l),getFullSecret:(k,T,l)=>O.getSecretsSource(k).getFullSecret(T,l),putSecret:(k,T,l,b)=>O.getSecretsSource(k).putSecret(T,l,b),deleteSecret:(k,T,l)=>O.getSecretsSource(k).deleteSecret(T,l),listPaths:(k,T,l)=>O.getSecretsSource(k).listPaths(T,l),exists:(k,T,l)=>O.getSecretsSource(k).exists(T,l),requestRotate:(k,T,l,b)=>O.getSecretsSource(k).requestRotate(T,l,b),requestRevoke:(k,T,l,b)=>O.getSecretsSource(k).requestRevoke(T,l,b),parkKmsKey:(k,T,l,b)=>O.getSecretsSource(k).parkKmsKey(T,l,b),addKmsKeys:(k,T,l,b)=>O.getSecretsSource(k).addKmsKeys(T,l,b),revokeKmsKey:(k,T,l,b)=>O.getSecretsSource(k).revokeKmsKey(T,l,b),getMetadata:(k,T,l)=>O.getSecretsSource(k).getMetadata(T,l),subscribe:(k,T,l,b)=>O.getSecretsSource(k).subscribe(T,l,b),isLfvDeliveryRequest:(k)=>P(k)!==void 0,isLfvEventsRequest:(k)=>E(k)!==void 0,handleLfvDelivery:async(k)=>{let T=P(k);if(!T)return me();return T.handleDelivery(k)},handleLfvEvents:async(k)=>{let T=E(k);if(!T)return me();return T.handleEvents(k)}},{update(k,T,l,b,W){let F=k!==void 0||T!==void 0;if(!F&&!u&&i.size===0)return;let Q=Yu(e,k,T),ce=W===!0,se=b!==o,Z=ce!==s,ee=new Map,ue=new Map,z=[];try{for(let[J,B]of Object.entries(Q)){let ae=Vu(B),re=r.get(J);if(re&&n.get(J)===ae&&!se&&!Z){ee.set(J,re),ue.set(J,ae);continue}let ne;if(!B.type)ne=Fu(J);else{if(l?.validateSourceConfig?.(J,B),t.has(J)&&k?.[J])e.warn(`RemoteConfig secrets source "${J}" is superseded by the framework LFV bootstrap source.`);if(!t.has(J))zu(J,B,b,ce),ne=Bu(J,B,b),z.push(ne);else ne=t.get(J)}ee.set(J,ne),ue.set(J,ae)}Ju(Object.fromEntries(ee))}catch(J){for(let B of z)Gu(B,e);throw J}c.emitBefore(),u=F,o=b,s=ce;for(let[J,B]of ee)r.set(J,B),n.set(J,ue.get(J)),g(J).update(B);for(let[J,B]of i){if(ee.has(J))continue;r.delete(J),n.delete(J),B.update($s(J))}return d.refresh(),c.emitAfter(),O},close(){for(let k of i.values())k.close();i.clear(),r.clear(),n.clear(),o=void 0,u=!1,d.settle()}}}function An(e,t){let r=t.ttlMs,n=Math.max(1,Math.floor(t.maxEntries)),o=new Map,s=()=>Date.now();function i(){while(o.size>n){let u=o.keys().next().value;if(u===void 0)break;o.delete(u)}}function c(u,a){o.delete(u),o.set(u,{session:a,expiresAt:s()+r}),i()}return{async create(u){await e.create(u)},async get(u){let a=o.get(u);if(a){if(a.expiresAt>s())return o.delete(u),o.set(u,a),a.session;o.delete(u)}let d=await e.get(u);if(d)c(u,d);return d},async update(u,a){await e.update(u,a),o.delete(u)},async delete(u){await e.delete(u),o.delete(u)}}}import{deepEqualPlain as pd,ION_ENDPOINT_PERMISSIONS as md,trimTrailingSlash as Wr,validationFailureResponse as gd}from"@ionite/core";import{assertEcid as Ks,jwtAssertionClaimsSchema as Zu,must as Ue,workloadTokenResponseSchema as Qu}from"@ionite/core";import{getCachedVerificationKey as ed,getJwks as td}from"@ionite/core/server";function je(e,t){return t in e&&e[t]!==void 0&&e[t]!==null}function Ie(e){if(e===void 0||e===null)return!1;return je(e,"workloadId")||je(e,"privateKey")}function Ke(e){if(e===void 0||e===null)return!1;let t=je(e,"clientId"),r=je(e,"clientSecret"),n=je(e,"workloadId"),o=je(e,"privateKey");return(t||r)&&!n&&!o}function _n(e){if(e===void 0||e===null)return!1;let t=je(e,"jwksUri"),r=je(e,"workloadId"),n=je(e,"clientId"),o=je(e,"clientSecret"),s=je(e,"privateKey");return t&&!r&&!s&&!n&&!o}function Vs(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function rd(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(Vs(t))return!1;let r=Object.entries(t);if(r.length===0)return!1;return r.every(([,n])=>Vs(n))}function Gs(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if("incoming"in t||"outgoing"in t){if(t.incoming!==void 0&&(typeof t.incoming!=="object"||t.incoming===null))return!1;if(t.outgoing!==void 0&&(typeof t.outgoing!=="object"||t.outgoing===null||Array.isArray(t.outgoing)))return!1;return!0}return!1}function Js(e){return Gs(e)}function Ln(e){if(!e)return;if(Js(e))return Array.isArray(e.incoming)?void 0:e.incoming;return e}function jn(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function _t(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function Fs(e){if(!e)return[];if(Array.isArray(e))return e.filter((t)=>!!t&&typeof t.issuer==="string"&&typeof t.jwksUri==="string").map((t)=>({issuer:t.issuer,jwksUri:t.jwksUri,audience:t.audience,scopesAsEntitlements:t.scopesAsEntitlements}));if(e.issuer&&e.jwksUri)return[{issuer:e.issuer,jwksUri:e.jwksUri,audience:e.audience??[],scopesAsEntitlements:e.scopesAsEntitlements}];return[]}function nd(e){let t=e[0];if(!t)return;let r=jn(t.audience);return{jwksUri:t.jwksUri,issuer:t.issuer,audience:typeof r[0]==="string"?r[0]:void 0}}function Ds(e,t){let r=_t(t);if(!r)return;return e.find((n)=>_t(n.issuer)===r)}function Ur(e,t,r){let n=jn(e);if(t.some((o)=>n.includes(o)))return!0;if(typeof r==="string"&&t.includes(r))return!0;return!1}function Un(e){if(!e||!Js(e))return{};return e.outgoing??{}}function od(e){return{getToken:e.getToken,refreshToken:e.refreshToken,generateJWTAssertion:e.generateJWTAssertion,revokeToken:e.revokeToken,beforeChange:e.beforeChange,afterChange:e.afterChange,isReady:e.isReady,ready:e.ready}}var $n=Symbol("ion.workloadClientState"),Hs=Symbol("ion.namedWorkloadClients");function Lt(e,t){let r=ye(e,t);return{isReady:r.isReady,ready:r.ready}}function sd(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...Lt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[$n]:"unavailable"}}function zs(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it is no longer configured on this Ionite instance.`)};return{...Lt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[$n]:"removed"}}function id(e){if(!e)return"removed";return e[$n]??"available"}function xn(e,t,r){let n=e,o=n,s=new Set;for(let i of r){if(s.add(i),i in o)continue;let c=t[i];o[i]=c?od(c):sd(i)}return Object.defineProperty(o,Hs,{value:s,enumerable:!1,configurable:!0}),n}function Bs(e){if(!e)return[];let t=e[Hs];return t?Array.from(t):[]}function ad(e,t,r){let n=t,o=We(r,`Workload client "${e}"`),s=()=>id(n)==="available",i=ye(`Workload client "${e}"`,s);return{api:{beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:i.isReady,ready:i.ready,getToken:(u)=>n.getToken(u),refreshToken:(u)=>n.refreshToken(u),generateJWTAssertion:(u)=>n.generateJWTAssertion(u),revokeToken:(u)=>n.revokeToken(u)},update(u){if(u===n)return;o.emitBefore(),n=u,i.refresh(),o.emitAfter()}}}function Ys(e){let t,r=!1,n=ye("Workload module",()=>r),o=We(e,"Workload"),s=new Map,i=new Set,c=new Set(["beforeChange","afterChange","isReady","ready"]),u=(m)=>{if(!t)throw Error(`${m} is unavailable because workload is not configured on this Ionite instance.`);return t},a={beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:n.isReady,ready:n.ready,get config(){return t?.config??{}},getToken(...m){return u("getToken").getToken(...m)},refreshToken(m){return u("refreshToken").refreshToken(m)},generateJWTAssertion(m){return u("generateJWTAssertion").generateJWTAssertion(m)},revokeToken(m){return u("revokeToken").revokeToken(m)},validateToken(m){return u("validateToken").validateToken(m)},getWorkloadIdentity(m){return u("getWorkloadIdentity").getWorkloadIdentity(m)},parseJWT(m){return u("parseJWT").parseJWT(m)},handler(m){return u("handler").handler(m)}},d=(m)=>{for(let E of i)delete a[E];if(i.clear(),!m)return;let C=new Set(Bs(m)),P=new Set([...c,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...C]);for(let[E,O]of Object.entries(m)){if(P.has(E))continue;a[E]=O,i.add(E)}},g=(m)=>{let C=s.get(m);if(C)return C;let P=ad(m,zs(m),e);if(s.set(m,P),!(m in a))a[m]=P.api;return P};return{update(m){if(!m&&!r&&s.size===0)return;o.emitBefore(),r=m!==void 0,n.refresh(),t=m;let C=new Set(Bs(m));for(let P of C){let E=m[P];g(P).update(E)}for(let[P,E]of s){if(C.has(P))continue;E.update(zs(P))}return d(m),o.emitAfter(),a}}}async function Mn(e,t,r){if(e===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let n=r[e];if(!n)throw Error(`Unknown workload client: ${e}`);return n.getToken(t)}function Wn(e,t){return`${e}|${t??""}`}function Je(e,t,r,n,o){let s={jwtAssertionClaims:e?.jwtAssertionClaims??Zu("server"),tokenResponse:e?.tokenResponse??Qu("server")},i=async(p,f)=>{let S=p;if(typeof S.validate==="function")return S.validate(f);return p["~standard"].validate(f)};if(!r&&!n)return;if(r&&Gs(r)){let p=r.incoming,f=Fs(p),S=Array.isArray(p)?nd(p):p,A=Ln(n),N=Un(n),Y=S?{...S,...A,jwksUri:S.jwksUri,issuer:S.issuer}:A;if(!Y||!Y.tokenUrl&&!Y.jwksUri)t.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let K=Y&&(Y.tokenUrl||Y.jwksUri)?Je(e,t,S??void 0,A,f):void 0,oe=Array.from(new Set([...Object.keys(r.outgoing??{}),...Object.keys(N)])).map((le)=>[le,{...r.outgoing?.[le]??{},...N[le]??{}}]),te={};for(let[le,st]of oe){let Ve=Je(e,t,st,void 0);if(Ve)te[le]=Ve}if(!K&&Object.keys(te).length===0)return;let we={...K?.config??{},config:K?.config??{},...Lt("workload",()=>K?.isReady()===!0||Object.values(te).some((le)=>le.isReady())),getToken:async(le,st)=>Mn(le,st,te),getServerToken:async(le)=>{if(!K)throw Error("No server workload config");return K.getToken(le)},refreshToken:async(le)=>{if(!K)throw Error("No default workload config");return K.refreshToken(le)},generateJWTAssertion:async(le)=>{if(!K)throw Error("No default workload config");return K.generateJWTAssertion(le)},revokeToken:async(le)=>{if(!K)throw Error("No default workload config");return K.revokeToken(le)},validateToken:async(le)=>{if(!K)throw Error("No default workload config");return K.validateToken(le)},getWorkloadIdentity:async(le)=>{if(!K)return;return K.getWorkloadIdentity(le)},parseJWT:async(le)=>{if(!K)throw Error("No default workload config");return K.parseJWT(le)},handler:async(le)=>{if(!K)return me();return K.handler(le)}};return xn(we,te,oe.map(([le])=>le))}if(r&&rd(r)){let p=Ln(n),f=Un(n),S=r.default,A=S?{...S,...p,jwksUri:S.jwksUri,issuer:S.issuer}:p;if(!A||!A.tokenUrl&&!A.jwksUri)t.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let N=A&&(A.tokenUrl||A.jwksUri)?Je(e,t,S??void 0,p):void 0,Y=Array.from(new Set([...Object.keys(r).filter((te)=>te!=="default"),...Object.keys(f)])).map((te)=>[te,{...te in r?r[te]:{},...f[te]??{}}]),K={};for(let[te,we]of Y){let le=Je(e,t,we,void 0);if(le)K[te]=le}if(!N&&Object.keys(K).length===0)return;let oe={...N?.config??{},config:N?.config??{},...Lt("workload",()=>N?.isReady()===!0||Object.values(K).some((te)=>te.isReady())),getToken:async(te,we)=>Mn(te,we,K),getServerToken:async(te)=>{if(!N)throw Error("No server workload config");return N.getToken(te)},refreshToken:async(te)=>{if(!N)throw Error("No default workload config");return N.refreshToken(te)},generateJWTAssertion:async(te)=>{if(!N)throw Error("No default workload config");return N.generateJWTAssertion(te)},revokeToken:async(te)=>{if(!N)throw Error("No default workload config");return N.revokeToken(te)},validateToken:async(te)=>{if(!N)throw Error("No default workload config");return N.validateToken(te)},getWorkloadIdentity:async(te)=>{if(!N)return;return N.getWorkloadIdentity(te)},parseJWT:async(te)=>{if(!N)throw Error("No default workload config");return N.parseJWT(te)},handler:async(te)=>{if(!N)return me();return N.handler(te)}};return xn(oe,K,Y.map(([te])=>te))}let c=Ln(n),u=Un(n);if(!r&&Object.keys(u).length>0){let p={};for(let[A,N]of Object.entries(u)){let Y=Je(e,t,N,void 0);if(Y)p[A]=Y}let f=c&&(c.tokenUrl||c.jwksUri)?Je(e,t,c,void 0):void 0;if(!f&&Object.keys(p).length===0)return;let S={...f?.config??{},config:f?.config??{},...Lt("workload",()=>f?.isReady()===!0||Object.values(p).some((A)=>A.isReady())),getToken:async(A,N)=>Mn(A,N,p),getServerToken:async(A)=>{if(!f)throw Error("No server workload config");return f.getToken(A)},refreshToken:async(A)=>{if(!f)throw Error("No default workload config");return f.refreshToken(A)},generateJWTAssertion:async(A)=>{if(!f)throw Error("No default workload config");return f.generateJWTAssertion(A)},revokeToken:async(A)=>{if(!f)throw Error("No default workload config");return f.revokeToken(A)},validateToken:async(A)=>{if(!f)throw Error("No default workload config");return f.validateToken(A)},getWorkloadIdentity:async(A)=>{if(!f)return;return f.getWorkloadIdentity(A)},parseJWT:async(A)=>{if(!f)throw Error("No default workload config");return f.parseJWT(A)},handler:async(A)=>{if(!f)return me();return f.handler(A)}};return xn(S,p,Object.keys(u))}let a=r,d=o??Fs(a),g=c?.tokenUrl,m=g?.startsWith("/")?g:void 0,C=a?.idpTokenUrl??c?.idpTokenUrl??(a?.tokenUrl&&(a.tokenUrl.startsWith("http://")||a.tokenUrl.startsWith("https://"))?a.tokenUrl:void 0),P={...a,...c,tokenUrl:m??c?.tokenUrl??a?.tokenUrl,idpTokenUrl:C,jwksUri:a?.jwksUri,issuer:a?.issuer};P._handlerTokenUrl=m;let E,O=P,k=Ie(P),T=Ke(P),l=_n(P);if(!k&&!T&&!l){if(!a||Object.keys(a).length===0)return;throw t.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(P),clientId:O.clientId,clientSecret:O.clientSecret?"[REDACTED]":void 0,workloadId:O.workloadId,privateKey:O.privateKey?"[REDACTED]":void 0,jwksUri:O.jwksUri,tokenUrl:O.tokenUrl,idpTokenUrl:O.idpTokenUrl,fromVaultKeys:a?Object.keys(a):[],fromCodeKeys:n?Object.keys(n):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(k)E={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:Ue(P.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:Ue(P.privateKey,"Missing 'privateKey' from Workload Config"),audience:Ue(P.audience,"Missing 'audience' from Workload Config"),scope:P.scope??"",algorithm:P.algorithm??"RS256",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new it};else if(Ke(P))E={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:Ue(P.clientId,"Missing 'clientId' from Workload Config"),clientSecret:Ue(P.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:P.scope??"",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new it};else if(_n(P))E=P;function b(){let p=new Uint8Array(16);return crypto.getRandomValues(p),Array.from(p,(f)=>f.toString(16).padStart(2,"0")).join("")}function W(p){let f;if(typeof p==="string")f=btoa(p);else f=btoa(String.fromCharCode(...p));return f.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function F(p){let f=p.replace(/-/g,"+").replace(/_/g,"/");while(f.length%4)f+="=";return atob(f)}function Q(p){if(p.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:p==="RS256"?"SHA-256":p==="RS384"?"SHA-384":"SHA-512"};else if(p.startsWith("ION"))return{name:"ECDSA",namedCurve:p==="ES256"?"P-256":p==="ES384"?"P-384":"P-521",hash:p==="ES256"?"SHA-256":p==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${p}`)}async function ce(p,f){let S=p.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),A=Uint8Array.from(atob(S),(Y)=>Y.charCodeAt(0)),N=Q(f);return crypto.subtle.importKey("pkcs8",A,N,!1,["sign"])}async function se(p,f,S){let A=await ce(f,S),Y=new TextEncoder().encode(p),K=Q(S),oe=await crypto.subtle.sign(K,A,Y);return W(new Uint8Array(oe))}async function Z(p,f=3,S=1000,A=30000){let N=Error("Placeholder Error");for(let Y=0;Y<=f;Y++)try{return await p()}catch(K){if(N=K instanceof Error?K:Error(String(K)),N.message.includes("400")||N.message.includes("401")||N.message.includes("403")||N.message.includes("404"))throw N;if(Y<f){let oe=Math.min(S*2**Y,A),te=Math.random()*oe*0.1;await new Promise((we)=>setTimeout(we,oe+te))}}throw N}async function ee(p){if(!Ie(E))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=E,S=Math.floor(Date.now()/1000),A={iss:f.workloadId,sub:f.workloadId,aud:f.audience??"",exp:S+f.tokenLifetime,iat:S,jti:b(),scope:p??f.scope},N={alg:f.algorithm,typ:"JWT",kid:f.keyId},Y=W(JSON.stringify(N)),K=W(JSON.stringify(A)),oe=`${Y}.${K}`,te=await se(oe,f.privateKey,f.algorithm);return`${oe}.${te}`}async function ue(p){if(!Ie(E))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=E;return Z(async()=>{let S=f.idpTokenUrl,A=await ee(p),N=new URLSearchParams;if(N.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),N.append("assertion",A),p)N.append("scope",p);let Y=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:N.toString()}),K=await Y.json();if(!Y.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:K});let te=K;throw Error(`Token acquisition failed: ${te.error||Y.statusText} - ${te.error_description||""}`.trim())}let oe=await i(s.tokenResponse,K);if(oe.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:oe.issues}),Error(`Token response validation failed: ${oe.issues.map((te)=>te.message).join("; ")}`);if(f.tokenStore){let te=new Date(Date.now()+(oe.value.expires_in??300)*1000),we={workload_id:Wn(f.workloadId,p),access_token:oe.value.access_token,token_type:oe.value.token_type,scope:oe.value.scope,expires_at:te,created_at:new Date,refresh_token:oe.value.refresh_token};await f.tokenStore.set(we)}return oe.value})}async function z(p){if(!Ke(E))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let f=E;return Z(async()=>{let S=f.idpTokenUrl,A=new URLSearchParams;if(A.append("grant_type","client_credentials"),A.append("client_id",f.clientId),A.append("client_secret",f.clientSecret),p)A.append("scope",p);let N=await fetch(S,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:A.toString()}),Y=await N.json();if(!N.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:Y});let oe=Y;throw Error(`Token acquisition failed: ${oe.error||N.statusText} - ${oe.error_description||""}`.trim())}let K=await i(s.tokenResponse,Y);if(K.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:K.issues}),Error(`Token response validation failed: ${K.issues.map((oe)=>oe.message).join("; ")}`);if(f.tokenStore){let oe=new Date(Date.now()+(K.value.expires_in??300)*1000),te={workload_id:Wn(f.clientId,p),access_token:K.value.access_token,token_type:K.value.token_type,scope:K.value.scope,expires_at:oe,created_at:new Date,refresh_token:K.value.refresh_token};await f.tokenStore.set(te)}return K.value})}let J=new Map;function B(p,f){let S=J.get(p);if(S)return S;let A=(async()=>(Ie(E)?await ue(f??""):await z(f??"")).access_token)();return J.set(p,A),A.catch(()=>{return}).finally(()=>{if(J.get(p)===A)J.delete(p)}),A}async function ae(p){if(!Ie(E)&&!Ke(E)){let N=E;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!N.clientId}, hasClientSecret=${!!N.clientSecret}, hasWorkloadId=${!!N.workloadId}, hasPrivateKey=${!!N.privateKey}, hasJwksUri=${!!N.jwksUri}`)}let f=E;p=p??f.scope;let S=Ie(E)?E.workloadId:E.clientId,A=Wn(S,p);if(f.tokenStore){let N=await f.tokenStore.get(A);if(N){let Y=Date.now(),K=N.expires_at.getTime(),oe=f.refreshThreshold*1000;if(Y+oe<K)return N.access_token;if(f.autoRefresh)try{return await B(A,p)}catch(te){if(Y<K)return t.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},te),N.access_token;throw te}}}return B(A,p)}async function re(p){if(!Ie(E)&&!Ke(E))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=E;return p=p??f.scope,Ie(f)?await ue(p):await z(p)}async function ne(p){if(!Ie(E)&&!Ke(E))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");try{if(!E.revocationEndpoint)return;let f=new URLSearchParams;if(f.append("token",p),f.append("token_type_hint","access_token"),Ie(E)){let A=E;f.append("client_id",A.workloadId)}else if(Ke(E)){let A=E;f.append("client_id",A.clientId),f.append("client_secret",A.clientSecret)}let S=await fetch(E.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:f.toString()});if(!S.ok)t.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:S.status,statusText:S.statusText});else t.info("Token revoked successfully",{"ion.module":"workload"});if(E.tokenStore){let A;if(Ie(E))A=E.workloadId;else if(Ke(E))A=E.clientId;else return;await E.tokenStore.delete(A)}}catch(f){t.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},f)}}async function R(p,f){let S=p??E?.jwksUri;if(!S)throw Error("No JWKS URI configured in Workload Config");return await td(S,t,f)}async function M(p,f){let S=f??E?.jwksUri;if(!S)throw Error("No JWKS URI configured in Workload Config");let A=Ie(E)?E.algorithm:"RS256";return ed(S,p,`wl:${A}`,(N)=>{let Y=N.alg||A,K=Q(Y);return crypto.subtle.importKey("jwk",N,K,!1,["verify"])},t)}function G(p){let f=p.split(".");if(f.length!==3)throw Error("Invalid JWT");return JSON.parse(F(f[1]))}async function H(p,f){try{let S=p.split(".");if(S.length!==3)throw Error("Invalid JWT");let A=JSON.parse(F(S[0])),N=JSON.parse(F(S[1])),Y=await M(A.kid,f),K=S[2],te=new TextEncoder().encode(`${S[0]}.${S[1]}`),we=Uint8Array.from(F(K),(jt)=>jt.charCodeAt(0)),le=Q(A.alg);if(!await crypto.subtle.verify(le,Y,we,te))throw Error("Invalid JWT signature");let Ve=await i(s.jwtAssertionClaims,N);if(Ve.issues)throw t.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:Ve.issues}),Error(`JWT claims validation failed: ${Ve.issues.map((jt)=>jt.message).join("; ")}`);return Ve.value}catch(S){throw t.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},S),S}}async function v(p){if(!Ie(E)&&!Ke(E)&&!_n(E))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(d.length>0){let A=G(p),N=typeof A.iss==="string"?A.iss:void 0,Y=Ds(d,N);if(!Y)return{valid:!1,error:"Untrusted token issuer"};let K=await H(p,Y.jwksUri),oe=Math.floor(Date.now()/1000);if(K.exp&&K.exp<oe)return{valid:!1,error:"Token expired"};let te=jn(Y.audience);if(te.length>0&&!Ur(K.aud,te,K.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:K,expiresAt:K.exp?new Date(K.exp*1000):void 0}}let f=await H(p),S=Math.floor(Date.now()/1000);if(f.exp&&f.exp<S)return{valid:!1,error:"Token expired"};if(Ie(E)){if(E.audience&&!Ur(f.aud,[E.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else if(Ke(E)){if(E.issuer&&_t(f.iss)!==_t(E.issuer))return{valid:!1,error:"Invalid issuer"};if(E.audience&&!Ur(f.aud,[E.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else{let A=E;if(A.issuer&&_t(f.iss)!==_t(A.issuer))return{valid:!1,error:"Invalid issuer"};if(A.audience&&!Ur(f.aud,[A.audience],f.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:f,expiresAt:f.exp?new Date(f.exp*1000):void 0}}catch(f){return{valid:!1,error:f instanceof Error?f.message:String(f)}}}function U(p,f){let S=p[f];return typeof S==="string"&&S.trim()?S.trim():void 0}function I(p){if(!p)return;return p.startsWith("service-account-")?p.slice(16):p}function x(p){return U(p,"client_id")??U(p,"clientId")??U(p,"azp")??U(p,"appid")??I(U(p,"preferred_username"))}let q=new WeakMap;function w(p){let f=q.get(p);if(f)return f;let S=_(p);return q.set(p,S),S}async function _(p){let f=p.headers.get("Authorization");if(!f?.startsWith("Bearer "))return;let S=f.substring(7),A=await v(S);if(!A.valid||!A.claims)return;let N=d.length>0?Ds(d,A.claims.iss):void 0,Y=A.claims.ecid,K={workloadId:A.claims.sub,clientId:x(A.claims),scope:A.claims.scope,scopesAsEntitlements:N?.scopesAsEntitlements,...Y!==void 0&&Y!==null?{ecid:Ks(Y)}:{},claims:A.claims},oe=E?.workloadIdentityStore;if(oe){let te=K.clientId??K.workloadId??K.claims.sub,we=te?await oe.get(te):void 0;if(we){if(we.active===!1)return;if(we.scopes?.length){let le=new Set([...(K.scope??"").split(/\s+/).filter(Boolean),...we.scopes]);K.scope=Array.from(le).join(" ")}if(!K.ecid&&we.ecid)K.ecid=Ks(we.ecid)}}return K}async function h(p){if(!E)throw Error("ionite Workload Manager not initialized");let f=new URL(p.url).pathname,S=(Y)=>{if(!Y)return;try{return new URL(Y).pathname}catch{return Y.startsWith("/")?Y:`/${Y}`}};if(S(E.validateUrl)===f&&p.method==="POST"){let Y=p.headers.get("Authorization");if(!Y?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let K=Y.substring(7),oe=await v(K);if(!oe.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:oe.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(S(E.jwksUrl)===f&&p.method==="GET"){let Y=await R();return new Response(JSON.stringify(Y),{headers:[["Content-Type","application/json"]]})}return me()}return{...E,...Lt("workload",()=>!0),getToken:ae,refreshToken:re,generateJWTAssertion:ee,revokeToken:ne,validateToken:v,getWorkloadIdentity:w,parseJWT:H,handler:h}}function qn(e){return e=e??"Workload authentication unavailable",new Response(JSON.stringify({error:e}),{status:503,statusText:e,headers:{"Content-Type":"application/json"}})}var xr="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",cd="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function ud(e,t){Ue(t,xr);let r=t.workload;if(!r)return;return r.getWorkloadIdentity(e)}async function dd(e,t,r){Ue(t,xr);let n=t.workload;if(!n)throw qn();let o=n;if(typeof o.getServerToken!=="function"||typeof o.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return o.getToken(e,r)}async function Nn(e,t){Ue(t,cd);let r="validateToken"in t&&typeof t.validateToken==="function"?t:t.workload;if(!r)return{valid:!1,error:"Workload authentication unavailable"};let n=e.headers.get("Authorization");if(!n?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let o=n.substring(7);return r.validateToken(o)}async function ld(e,t){Ue(t,xr);let r=t.workload;if(!r)throw qn();return r.revokeToken(e)}async function fd(e,t){Ue(t,xr);let r=t.workload;if(!r)throw qn();return r.handler(e)}function Xs(e){try{return Wr(new URL(e,"http://dummy").pathname)}catch{let t=e.startsWith("/")?e:`/${e}`;return Wr(t)}}function yd(e,t){let r=new URL(e.url);return new URL(`/${encodeURIComponent(t)}/`,r.origin).toString()}function wd(e,t){let r=Xs(t),n=Wr(e);if(n===r)return null;if(!n.startsWith(`${r}/`))return null;let o=n.slice(r.length+1);if(!o||o.includes("/"))return null;return decodeURIComponent(o)}function Mr(e){return e==="pending"||e==="processing"||e==="completed"||e==="failed"||e==="action_required"}function hd(e){if(!Mr(e.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if(e.status==="completed"){if(!e.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:e.tenantUrl,status:"completed"},status:201}}if(e.status==="pending"||e.status==="processing")return{body:{tenantUrl:e.tenantUrl,status:e.status},status:202};if(e.status==="action_required"){if(!e.actionUrl||!e.requestToken||!e.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:e.actionUrl,requestToken:e.requestToken,expiresAt:e.expiresAt},status:200}}return{body:{tenantUrl:e.tenantUrl,status:"failed",error:e.error??"Tenant provisioning failed"},status:409}}function vd(e,t){let r=t.validators.tenant.createTenantRequest,n=t.validators.tenant.updateTenantRequest;function o(a,d){let g=(m)=>new URL(m,d).toString();return{readyzUrl:g(a.readyzUrl),capabilitiezUrl:g(a.capabilitiezUrl),sso:{loginUrl:g(a.sso.loginUrl),userUrl:g(a.sso.userUrl),logoutUrl:g(a.sso.logoutUrl),logoutBackChannelUrl:g(a.sso.logoutBackChannelUrl),refreshUrl:g(a.sso.refreshUrl),callbackUrl:g(a.sso.callbackUrl)},workload:{validateUrl:g(a.workload.validateUrl),jwksUrl:g(a.workload.jwksUrl)},iam:{basePath:g(a.iam.basePath),usersUrl:g(a.iam.usersUrl),groupsUrl:g(a.iam.groupsUrl),workloadsUrl:g(a.iam.workloadsUrl),customersUrl:g(a.iam.customersUrl)},ciam:{magicLinkUrl:g(a.ciam.magicLinkUrl),magicLinkLoginUrl:g(a.ciam.magicLinkLoginUrl),customerUrl:g(a.ciam.customerUrl),customerLoginUrl:g(a.ciam.customerLoginUrl),customerCallbackUrl:g(a.ciam.customerCallbackUrl),customerProvidersUrl:g(a.ciam.customerProvidersUrl),logoutUrl:g(a.ciam.logoutUrl)}}}function s(a,d){let g=t.tenantIonBasePath?.(a);if(!g)return;let m=new URL(d.url).origin,C=o(Fe(g),m);return{callbackUrl:C.sso.callbackUrl,ionUrls:C}}async function i(a){let d=await Nn(a,t.workloadAuth??e);if(!d.valid)return Response.json({error:d.error??"Unauthorized"},{status:401});return pt(a,e,md["tenant.manage"])}async function c(a){let g=new URL(a.url).pathname,m=wd(g,t.basePath),C=Xs(t.basePath),P=Wr(g)===C;if(!P&&!m)return me();if(!["GET","PUT","POST","DELETE"].includes(a.method))return It(["GET","PUT","POST","DELETE"]);if(a.method==="GET"&&P&&m==null)return me();let E=await i(a);if(E)return E;if(a.method==="GET"){if(m==null)return me();let Z=await t.store.get(m);if(!Z)return me();let ee=s(Z,a);return Response.json(ee?{...Z,...ee}:Z,{status:200})}if(a.method==="DELETE"){if(!m)return me();let Z=await t.store.get(m);if(Z)await t.mirror?.purge(Z.id);return await t.store.delete(m),new Response(null,{status:204})}if(!m&&a.method!=="POST")return me();let O;try{O=await a.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let k=a.method==="POST",T=k?await r.validate(O):await n.validate(O);if(T.issues)return gd(T.issues,k?"Tenant create validation failed":"Tenant update validation failed");let l=k?T.value.id:m;if(!l)return me();if(m!=null&&T.value.id!=null&&T.value.id!==m)return Response.json({error:"Path id must match body id"},{status:400});let b=await t.store.get(l);if(b&&!Mr(b.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let W=new Date,F=b??{},Q;if(k){let Z=T.value,ee=Z,ue=ee.status,z=Mr(ue)?ue:b?.status??"completed";Q={...F,...Z,id:l,companyId:Z.companyId,companyName:Z.companyName,environmentType:Z.environmentType,configLocator:Z.configLocator,email:Z.email??b?.email,webhookUrl:Z.webhookUrl??b?.webhookUrl,callbackUrl:Z.callbackUrl??b?.callbackUrl,tenantUrl:ee.tenantUrl??b?.tenantUrl,status:z,error:ee.error??b?.error,actionUrl:ee.actionUrl??b?.actionUrl,requestToken:ee.requestToken??b?.requestToken,expiresAt:ee.expiresAt??b?.expiresAt,createdAt:b?.createdAt??W,updatedAt:W}}else{let Z=T.value,ee=Z,ue=ee.status,z=Mr(ue)?ue:b?.status??"completed",{configLocator:J,...B}=Z;Q={...F,...B,id:l,companyId:Z.companyId??b?.companyId??"",companyName:Z.companyName??b?.companyName??"",environmentType:Z.environmentType??b?.environmentType??"DEV",email:Z.email??b?.email,webhookUrl:Z.webhookUrl??b?.webhookUrl,callbackUrl:Z.callbackUrl??b?.callbackUrl,tenantUrl:ee.tenantUrl??b?.tenantUrl,status:z,error:ee.error??b?.error,actionUrl:ee.actionUrl??b?.actionUrl,requestToken:ee.requestToken??b?.requestToken,expiresAt:ee.expiresAt??b?.expiresAt,configLocator:J??b?.configLocator,createdAt:b?.createdAt??W,updatedAt:W}}if(!Q.tenantUrl)Q.tenantUrl=yd(a,l);if(!Q.callbackUrl){let Z=s(Q,a);if(Z)Q.callbackUrl=Z.callbackUrl}if(b?.configLocator&&!pd(b.configLocator,Q.configLocator))await t.mirror?.purge(b.id);let ce=await t.store.upsert(Q),se=hd(ce);if(se instanceof Response)return se;return Response.json(se.body,{status:se.status})}async function u(a){try{if(!e.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await c(a)}catch(d){return Pt(d)}}return{handler:u,getTenant:async(a)=>t.store.get(a)}}var Kn="0.0.24-beta.20260917.5";export*from"@ionite/core";import{AssignmentPolicyError as Fg,generateULID as Dg,IoniteError as zg,listGenerator as Bg}from"@ionite/core";import{allowHosts as Jg,allowOrigins as Hg,allowRelativePaths as Yg,allowSameOrigin as Xg,blockDangerousUrls as Zg,CatalogAdjacencyCache as Qg,callback as ey,captureRedirect as ty,ciam as ry,collectReferencedDefinitions as ny,defaultRedirectPolicies as oy,discoverSessionRecords as sy,discoverSessions as iy,expandRoot as ay,getCustomer as cy,getUser as uy,has as dy,hasAll as ly,hasAllScope as fy,hasAny as py,hasAnyScope as my,hasGroup as gy,hasPermission as yy,hasRole as wy,hasScope as hy,InMemoryTenantStore as vy,iam as Sy,initiateLogin as ky,isRedirectAllowed as by,listSsoClientIdsFromCookies as Ry,reconcileSubjectAccess as Cy,resolveAfterRedirect as Ty,resolveCapturedRedirect as Py,resolveRedirect as Iy,sameOriginRedirectRules as Oy,sendTenantWebhook as Ey,sso as Ay,verifyUser as _y,withSetCookies as Ly}from"@ionite/core/server";import{accessRefId as ot,accessRootId as Zs,assertRequiredSubjectType as Qs,list as Sd}from"@ionite/core";function Fn(e){let{createdAt:t,updatedAt:r,...n}=e;return n}class He{constructor(){this.roots=new Map;this.byTarget=new Map;this.bySubject=new Map}static targetKey(e,t){return`${e}:${t}`}static subjectKey(e,t){return`${e}:${t}`}indexAdd(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}indexRemove(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}deindex(e){this.indexRemove(this.byTarget,He.targetKey(e.targetType,ot(e.target)),e.id),this.indexRemove(this.bySubject,He.subjectKey(e.subjectType,ot(e.subject)),e.id)}index(e){this.indexAdd(this.byTarget,He.targetKey(e.targetType,ot(e.target)),e.id),this.indexAdd(this.bySubject,He.subjectKey(e.subjectType,ot(e.subject)),e.id)}resolve(e,t){if(!e)return[];let r=[];for(let n of e){let o=this.roots.get(n);if(o&&(o.status??"active")==="active"&&t(o))r.push(o)}return r}async grant(e){Qs(e.subjectType,"Access change subjectType");let t=e.id??Zs(e),r=new Date,n=this.roots.get(t);if(n)this.deindex(n);let o={...e,id:t,status:e.status??"active",createdAt:n?.createdAt??r,updatedAt:r};this.roots.set(t,o),this.index(o)}async revoke(e){let t=e.id??Zs(e),r=this.roots.get(t);if(r)this.deindex(r);this.roots.delete(t)}async get(e){let t=this.roots.get(e);return t?Fn(t):void 0}async list(e){let t=Array.from(this.roots.values()).filter((r)=>(r.status??"active")==="active");return Vn(t,e)}async listByTarget(e,t,r){let n=t.trim(),o=this.byTarget.get(He.targetKey(e,n)),s=this.resolve(o,(i)=>i.targetType===e&&ot(i.target)===n);return Vn(s,r)}async listByTargets(e){let t=new Map;for(let{targetType:r,target:n}of e){let o=`${r}:${n}`;if(t.has(o))continue;let s=n.trim(),i=this.byTarget.get(He.targetKey(r,s)),c=this.resolve(i,(u)=>u.targetType===r&&ot(u.target)===s);t.set(o,c.map((u)=>Fn(u)))}return t}async listBySubject(e,t,r){Qs(t);let n=ot(e),o=this.bySubject.get(He.subjectKey(t,n)),s=this.resolve(o,(i)=>i.subjectType===t&&ot(i.subject)===n);return Vn(s,r)}}function Vn(e,t){let r=Math.max(0,t?.start??0),n=t?.limit,o=n!=null?r+n:void 0;return Sd(e.length,e.slice(r,o).map(Fn),r,n)}import{assertValidSubjectTypeScoping as ei,deepEqualPlain as kd,list as ti,readyCatalogEntry as Dn}from"@ionite/core";class ri{constructor(){this.listeners=new Set;this.emit=(e)=>{for(let t of this.listeners)t(e)};this.groups=new jr("group",this.emit);this.roles=new jr("role",this.emit);this.permissions=new jr("permission",this.emit)}afterChange(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}}class ni{constructor(){this.items=new Map;this.listeners=new Set}async get(e){return this.items.get(e)}async list(e){let t=Array.from(this.items.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=n!=null?r+n:void 0;return ti(t.length,t.slice(r,o),r,n)}async children(e){return Array.from(this.items.values()).filter((t)=>(typeof t.parent==="string"?t.parent:t.parent?.id)===e)}changed(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}set(e){this.items.set(e.id,e),this.emitChange({id:e.id})}delete(e){if(!this.items.delete(e))return;this.emitChange({id:e,deleted:!0})}emitChange(e){for(let t of this.listeners)t(e)}}class jr{constructor(e,t){this.kind=e;this.emit=t;this.items=new Map}async get(e){return this.items.get(e)}set(e){ei(e);let t=this.items.get(e.id),r=!t||!kd(t,e);if(this.items.set(e.id,e),r)this.emit({op:"set",kind:this.kind,entity:e,previous:t});return Dn(e,Promise.resolve())}insertIfAbsent(e){ei(e);let t=this.items.get(e.id);if(t)return Dn(t,Promise.resolve());return this.items.set(e.id,e),this.emit({op:"set",kind:this.kind,entity:e,previous:void 0}),Dn(e,Promise.resolve())}async delete(e){let t=this.items.get(e);if(!t)return;this.items.delete(e),this.emit({op:"delete",kind:this.kind,entity:t})}async list(e){let t=Array.from(this.items.values()),r=e?.filter?.requestable;if(r!==void 0)t=t.filter((i)=>Boolean(i.requestable)===r);let n=Math.max(0,e?.start??0),o=e?.limit,s=o!=null?n+o:void 0;return ti(t.length,t.slice(n,s),n,o)}}import{accessRefId as Ye,assertRequiredSubjectType as Ut}from"@ionite/core";function Xe(e,t){return`${t}:${e}`}function zn(e,t,r){return`${e}:${t}:${r}`}function bd(e,t,r,n){return`${zn(e,t,r)}:${n??""}`}class oi{constructor(){this.rows=new Map;this.byTriple=new Map;this.byRoot=new Map;this.bySubject=new Map;this.edgeMeta=new Map;this.disabledSubjects=new Set}async has(e,t,r,n,o){Ut(o);let s=Ye(e),i=Ye(r);if(!s||!i)return{allow:!1};if(this.disabledSubjects.has(Xe(s,o)))return{allow:!1,metadata:{reason:"subject_disabled"}};let c=zn(Xe(s,o),t,i),u=n?Ye(n):void 0;if(u===void 0){let g=this.byTriple.get(c);if(g&&g.size>0)return this.allow(s,o,t,i,void 0);return{allow:!1}}let a=`${c}:${u}`,d=`${c}:`;if(this.rows.has(a))return this.allow(s,o,t,i,u);if(this.rows.has(d))return this.allow(s,o,t,i,void 0);return{allow:!1}}async hasGroup(e,t,r,n){return this.has(e,"group",t,r,n)}async hasRole(e,t,r,n){return this.has(e,"role",t,r,n)}async hasPermission(e,t,r,n){return this.has(e,"permission",t,r,n)}async hasAny(e,t,r){for(let n of t){let o=await this.has(e,n.targetType,n.target,n.resource,r);if(o.allow)return o}return{allow:!1}}async hasAll(e,t,r){if(this.disabledSubjects.has(Xe(Ye(e),r)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(t.length===0)return{allow:!0};let n=[];for(let o of t){let s=await this.has(e,o.targetType,o.target,o.resource,r);if(!s.allow)return{allow:!1,matched:n};if(s.matched)n.push(...s.matched)}return{allow:!0,matched:n}}async materialize(e,t){this.removeRoot(e),this.addRootEdges(e,t)}async replaceSubject(e,t,r){let n=Xe(Ye(e),t),o=new Map;for(let s of r){Ut(s.subjectType,"Effective edge subjectType");let i=Xe(Ye(s.subject),s.subjectType);if(i!==n)throw Error(`AccessIndex.replaceSubject received an edge for ${i}; expected ${n}.`);let c=o.get(s.rootId);if(c)c.push(s);else o.set(s.rootId,[s])}this.clearSubjectEdges(n);for(let[s,i]of o)this.addRootEdges(s,i)}addRootEdges(e,t){let r=new Set;for(let n of t){Ut(n.subjectType,"Effective edge subjectType");let o=Xe(n.subject,n.subjectType),s=zn(o,n.targetType,n.target),i=bd(o,n.targetType,n.target,n.resource);this.addToSet(this.rows,i,e),this.addToSet(this.byTriple,s,i),this.addToSet(this.bySubject,o,i),this.edgeMeta.set(i,{triple:s,subjectId:o}),r.add(i)}if(r.size>0)this.byRoot.set(e,r)}async removeByRoot(e){this.removeRoot(e)}removeRoot(e){let t=this.byRoot.get(e);if(!t)return;for(let r of t){let n=this.rows.get(r);if(!n)continue;if(n.delete(e),n.size===0)this.dropEdge(r)}this.byRoot.delete(e)}async listSubjects(){let e=[];for(let[t,r]of this.bySubject){if(r.size===0)continue;let n=t.indexOf(":");if(n<=0)throw Error(`AccessIndex subject key "${t}" is missing a subjectType prefix.`);let o=t.slice(0,n);Ut(o,"AccessIndex subject key subjectType"),e.push({subjectType:o,subject:t.slice(n+1)})}return e}async setSubjectDisabled(e,t,r){let n=Xe(Ye(e),t);if(r)this.disabledSubjects.add(n);else this.disabledSubjects.delete(n)}async isSubjectDisabled(e,t){return Ut(t),this.disabledSubjects.has(Xe(Ye(e),t))}async clear(e,t){if(e===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}Ut(t);let r=Ye(e);this.clearSubjectEdges(Xe(r,t))}clearSubjectEdges(e){let t=this.bySubject.get(e);if(!t)return;for(let r of[...t]){let n=this.rows.get(r);if(n)for(let o of n){let s=this.byRoot.get(o);if(s?.delete(r)&&s.size===0)this.byRoot.delete(o)}this.dropEdge(r)}}allow(e,t,r,n,o){return{allow:!0,matched:[{subject:e,subjectType:t,targetType:r,target:n,resources:o?[o]:void 0}]}}addToSet(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}dropEdge(e){this.rows.delete(e);let t=this.edgeMeta.get(e);if(t)this.removeFromSet(this.byTriple,t.triple,e),this.removeFromSet(this.bySubject,t.subjectId,e);this.edgeMeta.delete(e)}removeFromSet(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}}function Bn(e){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function Rd(e,t){return{...e,subscribe:async(r,n,o)=>{try{return await e.subscribe(r,n,o)}catch(s){if(!(s instanceof Le))throw s;return await Ge(e,r,n,t,void 0,o)}}}}function $r(e){let t=ft(e.path,"path","azureConfig");gt(e.ttl);let r=e.vault??_r({type:"azure",authMethod:e.authMethod,entraTenantId:e.entraTenantId,clientId:e.clientId,clientSecret:e.clientSecret,federatedTokenFile:e.federatedTokenFile,managedIdentityClientId:e.managedIdentityClientId,imdsApiVersion:e.imdsApiVersion,vaultUrl:e.vaultUrl,vaultName:e.vaultName,apiVersion:e.apiVersion,secretNameTransform:e.secretNameTransform,secretNamePrefix:e.secretNamePrefix,scope:e.scope,ttl:e.ttl}),n=e.ttl?Rd(r,e.ttl):r;return{load:async()=>{try{return(await n.getFullSecret(t)).data}catch(o){let s=o instanceof Error?o.message:String(o);throw Error(`Error retrieving remote config from Azure Key Vault: ${s}`,{cause:o})}},subscribe:(o,s)=>n.subscribe(t,(i)=>{o(i.data)},s),secret:n}}import{IoniteError as Nd}from"@ionite/core";function Gn(e){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as Od,remoteConfigSecretType as Ed}from"@ionite/core";import{defaultLogger as Cd,defaultSecretContentType as Td,stableConfigHash as si}from"@ionite/core";var Pd=1e4;function Id(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Jn(e){if(e.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let t=Array.from(new Set(e.paths.map((O)=>O.trim()).filter(Boolean)));if(t.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let r=e.logger??Cd,n=[],o=Promise.resolve(),s=!1,i=!1,c=!1,u=ye("Secrets mirror",()=>s&&!c),a=(O)=>{let k=e.mapPath(O).trim();if(!k)throw Error(`mirrorSecrets mapPath returned an empty target for "${O}"`);return k},d=(O)=>{let k=o.then(O);return o=k.catch((T)=>{i=!0,r.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:T instanceof Error?T.message:String(T)})}),k},g=async(O)=>{if(await e.to.exists(O))await e.to.deleteSecret(O)},m=async(O,k)=>{if(c)return;if(!Id(k.data))throw Error(`mirrorSecrets can only re-store object values (source path "${O}")`);if(e.accept&&!e.accept(k,O))return;let T=a(O);if(await e.to.exists(T)){let l=await e.to.getSecret(T);if(si(l)===si(k.data)){i=!1;return}}await e.to.putSecret(T,k.data,{contentType:k.metadata.contentType??Td()}),i=!1},C=async(O)=>{await g(a(O)),i=!1},P=(O)=>{if(O.event!=="path_removed")return t.includes(O.path)?[O.path]:[];let k=`${O.path.replace(/\/+$/g,"")}/`;return t.filter((T)=>T===O.path||T.startsWith(k))},E=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if(e.from.subscribeEvents)n.push(e.from.subscribeEvents((O)=>{if(E.has(O.event)){let k=P(O);if(k.length>0)d(async()=>{for(let T of k)await C(T)})}try{e.onEvent?.(O)}catch(k){r.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:O.path,event:O.event,error:k instanceof Error?k.message:String(k)})}}));return(async()=>{let O=new Set(t);for(;;){try{for(let k of[...O]){let T=await e.from.subscribe(k,(l)=>{d(()=>m(k,l))},e.subscription);if(c){T();return}n.push(T),O.delete(k)}if(await o,c)return;s=!0,u.refresh();return}catch(k){if(c)return;i=!0,r.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:k instanceof Error?k.message:String(k)})}if(await new Promise((k)=>{setTimeout(k,Pd).unref?.()}),c)return}})(),{isReady:u.isReady,ready:u.ready,isAvailable:()=>s&&!c&&!i&&(e.from.isAvailable?.()??!0)&&(e.to.isAvailable?.()??!0),async purge(){if(c)throw Error("Secrets mirror is closed");await d(async()=>{for(let O of t)await C(O)})},async close(){if(c)return;c=!0;for(let O of n.splice(0))O();u.refresh(),u.settle(),await o}}}function xt(e){return typeof e.getFullSecret==="function"}function Hn(e){let t=e;return typeof t.handleDelivery==="function"&&typeof t.handleEvents==="function"&&typeof t.isDeliveryRequest==="function"&&typeof t.isEventsRequest==="function"}function ii(e){return e.type==="vault"&&[e.vaultLfvServerUrl,e.vaultLfvClientId,e.vaultLfvDeliveryEndpoint,e.vaultLfvVerifyJwks,e.vaultLfvEventsEndpoint].some((t)=>t!==void 0)}function Oe(e,t){if(!e?.trim())throw Error(`Mirrored LFV config requires ${t}`);return e}function Ad(e,t){if(t?.trim())return t;if(xt(e))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if(e.type==="vault")return Oe(e.vaultLfvPath??e.vaultPath,"an upstream vault path");if(e.type==="azure")return Oe(e.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${e.type}" requires an explicit fromPath`)}function _d(e,t){let r=Oe(e.vaultLfvPath??e.vaultPath,"vaultLfvPath or vaultPath");return lt({lfvServerUrl:Oe(e.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Oe(e.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Oe(e.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:Oe(e.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:Oe(e.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:r,deliveryTimeout:e.vaultLfvDeliveryTimeout,retryInterval:e.vaultLfvRetryInterval,warnInterval:e.vaultLfvWarnInterval,log:t},void 0,{selfRedeemReads:!0})}function Ld(e){return e.metadata.contentType?.typeId===Ed.id&&typeof e.data.id==="string"&&e.data.id.trim().length>0}function Ud(e,t,r,n){return{...e,close:r,subscribePassive:(o,s)=>t.subscribePassive(o,s),isDeliveryRequest:(o)=>t.isDeliveryRequest(o),isEventsRequest:(o)=>t.isEventsRequest(o),handleDelivery:(o)=>(n(),t.handleDelivery(o)),handleEvents:(o)=>(n(),t.handleEvents(o)),deliveryPath:t.deliveryPath,eventsPath:t.eventsPath,callbackKey:t.callbackKey,trustId:t.trustId}}function tr(e){let t=e.logger??Od,r=Ad(e.from,e.fromPath),n=!xt(e.from),o=!xt(e.to),s=xt(e.from)?e.from:ii(e.from)?_d(e.from,t):Ze(e.from).secret,i=xt(e.to)?e.to:Ze(e.to).secret,c=Oe(e.path,"path"),u=Yn(i,c,{ttl:e.ttl}),a,d=!1,g=!1,m,C=()=>{if(m)return;m=s.getFullSecret(r).then(()=>{return}).catch((l)=>{m=void 0,t.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:l instanceof Error?l.message:String(l)})})},P=(l)=>{if(d)throw Error("Mirrored ConfigSource is closed");if(!a){g=l;let b=!l&&Hn(s)?{...s,subscribe:(W,F)=>s.subscribePassive(W,F)}:s;a=Jn({from:b,to:i,paths:[r],mapPath:()=>c,accept:Ld,logger:t})}else if(l&&!g)C();return a},E={isReady:()=>a?.isReady()??!1,ready:(l)=>P(!0).ready(l),isAvailable:()=>a?.isAvailable()??!1,purge:()=>P(!1).purge(),close:async()=>{await a?.close()}},O=async()=>{if(d)return;if(d=!0,await a?.close(),n)await s.close?.();if(o)await i.close?.()},k=Hn(s)?Ud(i,s,O,()=>{P(!1)}):{...i,close:O},T={load:async()=>{try{let l=await u.load();return P(!1),l}catch(l){throw P(!0),l}},subscribe:(l,b)=>(P(!1),u.subscribe(l,b)),secret:k,mirror:E,async handleCallback(l,b){if(!Hn(s))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return P(!1),l==="delivery"?s.handleDelivery(b):s.handleEvents(b)}};if(Object.defineProperties(T,{log:{get:()=>u.log,set:(l)=>{u.log=l},enumerable:!0},validators:{get:()=>u.validators,set:(l)=>{u.validators=l},enumerable:!0}}),!xt(e.from)&&ii(e.from)){let l=e.from;T[Ct]={path:r,lfvServerUrl:Oe(l.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Oe(l.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Oe(l.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:Oe(l.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:Oe(l.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:l.vaultLfvDeliveryTimeout,retryInterval:l.vaultLfvRetryInterval,warnInterval:l.vaultLfvWarnInterval}}return T}class yt extends Error{constructor(e,t=`Waiting for vault config secret at ${e}`){super(t);this.path=e;this.code="not_found";this.sourceType="vault";this.status=404;this.name="VaultConfigWaitingForSecretError"}}function xd(e){return e instanceof yt}class rr extends Error{constructor(e,t){super(t);this.path=e;this.code="invalid_payload";this.sourceType="vault";this.name="VaultConfigInvalidPayloadError"}}function Md(e){return e instanceof rr}var ui=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function ai(e){return ui.some((t)=>(t in e))}function ci(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw new yt(t,`Vault config secret at ${t} is missing or not an object`);let r=e;if(!ai(r)&&Object.keys(r).length===1&&"data"in r){let n=r.data;if(n&&typeof n==="object"&&!Array.isArray(n))r=n}if(Object.keys(r).length===0)throw new yt(t,`Vault config secret at ${t} is empty`);if(!ai(r))throw new rr(t,`Vault config secret at ${t} is an invalid payload: not a RemoteConfig (no known keys: ${ui.join("/")})`);return r}function Wd(e,t,r){return{...e,subscribe:async(n,o,s)=>{try{return await e.subscribe(n,o,s)}catch(i){if(!(i instanceof Le))throw i;return await Ge(e,n,o,t,r(),s)}}}}function qr(e){let t=ft(e.path,"path","vaultConfig");gt(e.ttl);let r=e.vault??At({type:"vault",url:e.url,token:e.token,workload:e.workload,lfv:e.lfv,websocket:e.websocket,ttl:e.ttl,log:e.log}),n=e.vault&&e.ttl?Wd(r,e.ttl,()=>e.log):r,o={get log(){return e.log},set log(s){if(e.log=s,n&&"log"in n)n.log=s},load:async()=>{try{let s=await n.getFullSecret(t);return ci(s.data,t)}catch(s){if(s instanceof Be)throw new yt(t);if(s instanceof yt||s instanceof rr)throw s;throw Error("Error retrieving remote config from vault",{cause:s})}},subscribe:(s,i)=>n.subscribe(t,(c)=>{let u;try{u=ci(c.data,t)}catch(a){e.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:t,error:a instanceof Error?a.message:String(a)});return}s(u)},i),secret:n};if(e.lfv?.lfvServerUrl&&e.lfv.clientId&&e.lfv.deliveryEndpoint&&e.lfv.eventsEndpoint)o[Ct]={path:e.lfv.path??t,lfvServerUrl:e.lfv.lfvServerUrl,clientId:e.lfv.clientId,deliveryTimeout:e.lfv.deliveryTimeout,retryInterval:e.lfv.retryInterval,warnInterval:e.lfv.warnInterval,deliveryEndpoint:e.lfv.deliveryEndpoint,eventsEndpoint:e.lfv.eventsEndpoint,verifyJwks:e.lfv.verifyJwks};return o}function Nr(e){if(e==null)return;if(typeof e==="number")return Number.isFinite(e)?e:void 0;let t=e.trim();if(!t)return;let r=Number.parseInt(t,10);return Number.isFinite(r)?r:void 0}function jd(e,t){let r=e.vaultLfvServerUrl??t?.lfvServerUrl,n=e.vaultLfvClientId??t?.clientId,o=e.vaultLfvDeliveryEndpoint??t?.deliveryEndpoint,s=e.vaultLfvEventsEndpoint??t?.eventsEndpoint;if(!r||!n||!o||!s)return t;return{...t,lfvServerUrl:r,clientId:n,deliveryEndpoint:o,verifyJwks:e.vaultLfvVerifyJwks??t?.verifyJwks,eventsEndpoint:s,path:e.vaultLfvPath??t?.path,deliveryTimeout:Nr(e.vaultLfvDeliveryTimeout)??t?.deliveryTimeout,retryInterval:Nr(e.vaultLfvRetryInterval)??t?.retryInterval,warnInterval:Nr(e.vaultLfvWarnInterval)??t?.warnInterval}}function $d(e,t){let r=e.vaultWebsocketUrl??t?.url;if(!r)return t;return{...t,url:r,token:e.vaultWebsocketToken??t?.token,clientId:e.vaultWebsocketClientId??t?.clientId,header:e.vaultWebsocketHeader??t?.header}}function qd(e,t){let r=e.vaultWorkloadTokenUrl??t?.idpTokenUrl,n=e.vaultWorkloadClientId??t?.clientId,o=e.vaultWorkloadClientSecret??t?.clientSecret;if(!r||!n||!o)return t;return{...t,idpTokenUrl:r,clientId:n,clientSecret:o,scope:e.vaultWorkloadScope??t?.scope}}function di(e,t){return{...t,url:e.vaultUrl??t?.url,token:e.vaultToken??t?.token,path:e.vaultPath??t?.path,ttl:Nr(e.vaultTtl)??t?.ttl,workload:qd(e,t?.workload),lfv:jd(e,t?.lfv),websocket:$d(e,t?.websocket)}}function Ze(e){switch(e.type){case"vault":return Vd(e);case"azure":return Fd(e);case"aws":return Dd(e);case"gcp":return zd(e);case"mirror":return Kd(e);default:throw Error(`Unsupported config locator type: ${e.type}`)}}function Kd(e){if(e.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!e.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return tr({from:e.from,to:e.to,path:e.to.vaultPath,ttl:e.to.vaultTtl})}function Vd(e){return qr(di(e))}function Fd(e){return $r({authMethod:e.azureAuthMethod,entraTenantId:e.azureEntraTenantId,clientId:e.azureClientId,clientSecret:e.azureClientSecret,federatedTokenFile:e.azureFederatedTokenFile,managedIdentityClientId:e.azureManagedIdentityClientId,imdsApiVersion:e.azureImdsApiVersion,vaultUrl:e.azureVaultUrl,vaultName:e.azureVaultName,apiVersion:e.azureApiVersion,scope:e.azureScope,secretNamePrefix:e.azureSecretNamePrefix,path:e.azurePath,ttl:e.azureTtl})}function Dd(e){return Bn({webhookUrl:e.awsWebhookUrl,ttl:e.awsTtl})}function zd(e){return Gn({ttl:e.gcpTtl})}function Yn(e,t,r={}){switch(e.type){case"vault":return qr({vault:e,path:t,ttl:r.ttl});case"azure":return $r({vault:e,path:t,ttl:r.ttl});default:throw new Nd(`configFromSource is not supported for secrets source type "${e.type}" (path "${t}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function wt(e){if(!e)return;let t=Number.parseInt(e,10);return Number.isFinite(t)?t:void 0}function Kr(e,t){let r=t?.type??e.ION_CONFIG_TYPE;if(!r)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(r==="vault")return{type:"vault",vaultUrl:e.ION_VAULT_URL,vaultToken:e.ION_VAULT_TOKEN,vaultPath:e.ION_VAULT_PATH??"",vaultTtl:wt(e.ION_VAULT_TTL),vaultWorkloadTokenUrl:e.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:e.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:e.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:e.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:e.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:e.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:e.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:e.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:e.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:e.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:wt(e.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:wt(e.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:wt(e.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:e.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:e.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:e.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:e.ION_VAULT_WEBSOCKET_HEADER};if(r==="azure")return{type:"azure",azurePath:e.ION_AZURE_PATH,azureApiVersion:e.ION_AZURE_API_VERSION,azureScope:e.ION_AZURE_SCOPE,azureSecretNamePrefix:e.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:e.ION_AZURE_AUTH_METHOD,azureEntraTenantId:e.ION_AZURE_TENANT_ID,azureClientId:e.ION_AZURE_CLIENT_ID,azureClientSecret:e.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:e.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:e.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:e.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:e.ION_AZURE_VAULT_URL,azureVaultName:e.ION_AZURE_VAULT_NAME,azureTtl:wt(e.ION_AZURE_TTL)};if(r==="aws")return{type:"aws",awsWebhookUrl:e.ION_AWS_WEBHOOK_URL??"",awsTtl:wt(e.ION_AWS_TTL)};if(r==="gcp")return{type:"gcp",gcpTtl:wt(e.ION_GCP_TTL)};if(r==="mirror"){let n={};for(let[c,u]of Object.entries(e))if(c.startsWith("ION_FROM_"))n[`ION_${c.slice(9)}`]=u;if(n.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let o=Kr(n),s=Kr(e,{type:"vault"});if(!s.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let i={type:"vault",vaultUrl:s.vaultUrl,vaultToken:s.vaultToken,vaultPath:s.vaultPath,vaultTtl:s.vaultTtl,vaultWorkloadTokenUrl:s.vaultWorkloadTokenUrl,vaultWorkloadClientId:s.vaultWorkloadClientId,vaultWorkloadClientSecret:s.vaultWorkloadClientSecret,vaultWorkloadScope:s.vaultWorkloadScope,vaultWebsocketUrl:s.vaultWebsocketUrl,vaultWebsocketToken:s.vaultWebsocketToken,vaultWebsocketClientId:s.vaultWebsocketClientId,vaultWebsocketHeader:s.vaultWebsocketHeader};return{type:"mirror",from:o,to:i}}throw Error(`ION_CONFIG_TYPE="${r}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function li(e,t){return Ze(Kr(e,t))}function Bd(e){return li(process.env,e)}var Gd=1000,Jd=30000,fi=["vault","azure","aws","gcp"];function pi(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Config locator at ${t} is an invalid payload: expected an object with a "type" field`);let r=e.type;if(typeof r!=="string"||!fi.includes(r))throw Error(`Config locator at ${t} is an invalid payload: unknown type "${String(r)}" (expected ${fi.join("/")})`)}function mi(e,t){return e.log??=t.log,e.validators??=t.validators,e}function nr(e){if(!e?.secret?.close)return;try{Promise.resolve(e.secret.close()).catch((t)=>{e.log?.warn?.("secretConfigSource: inner source close failed",t)})}catch(t){e.log?.warn?.("secretConfigSource: inner source close failed",t)}}function Hd(e,t){let r=ft(t,"path","secretConfigSource"),n,o=(i)=>{pi(i,r);let c=JSON.stringify(i);if(n&&n.hash===c)return n.inner;let u=n?.inner,a=mi(Ze(i),s);if(n={hash:c,inner:a},u&&u!==a)nr(u);return a},s={async load(){let i=await e.getSecret(r);return o(i).load()},async subscribe(i,c){let u,a=!1,d=!1,g,m,C=new Promise((W,F)=>{g=W,m=F}),P=Cr(),E,O,k=(W)=>new Promise((F)=>{O=F,E=setTimeout(F,W)}),T=async(W,F)=>{pi(W,r);let Q=JSON.stringify(W),ce=n!==void 0&&n.hash===Q;if(ce&&u)return;let se=n?.inner,Z=u,ee=ce&&n?n.inner:mi(Ze(W),s),ue=!ce,z=()=>{if(ue&&ee!==se)nr(ee)};try{if(ee.subscribe){let B=await ee.subscribe(i,c)??void 0;if(a||!P.isCurrent(F)){B?.(),z();return}if(u=B,n={hash:Q,inner:ee},Z&&Z!==B)Z();if(ue&&se&&se!==ee)nr(se);return}let J=await ee.load();if(a||!P.isCurrent(F)){z();return}if(n={hash:Q,inner:ee},Z)Z(),u=void 0;if(ue&&se&&se!==ee)nr(se);i(J)}catch(J){throw z(),J}},l=async(W)=>{let F=P.next(),Q=Gd;for(;;){if(a||!P.isCurrent(F))return;try{await T(W,F);return}catch(ce){if(a||!P.isCurrent(F))return;s.log?.warn(`secretConfigSource rebind for ${r} failed; keeping last-known-good source and retrying in ${Q}ms`,ce),await k(Q),Q=Math.min(Jd,Q*2)}}},b=await e.subscribe(r,(W)=>{if(a)return;if(!d){T(W.data,P.next()).then(()=>{d=!0,g()}).catch((F)=>{d=!0,m(F)});return}l(W.data)},c);return await C,()=>{if(a=!0,P.next(),E)clearTimeout(E);O?.(),u?.(),b(),nr(n?.inner),n=void 0}},secret:e};return s}function Xn(e){if(Array.isArray(e))return e.map(Xn);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,Xn(r)]));return e}function gi(e){return JSON.stringify(Xn(e))}function Yd(e){if(e.type==="vault")return e.vaultLfvPath??e.vaultPath;if(e.type==="azure"&&e.azurePath?.trim())return e.azurePath;throw Error(`Tenant config locator type "${e.type}" does not declare a mirrorable config path`)}function Xd(e,t){let r=t.logger??e.log,n=new Map,o=!1,s=async(a)=>{if(a.closed)return;a.closed=!0,a.closeHooks?.(),await a.hookSetup?.catch(()=>{return}),await a.source.secret.close?.()},i=(a)=>{let d=(async()=>{let g=await t.store.get(a);if(!g)throw Error(`Tenant "${a}" was not found`);if(!g.configLocator)throw Error(`Tenant "${a}" has no configLocator`);let m=g.configLocator,C=t.path(g).trim();if(!C)throw Error(`Tenant mirror path is empty for "${a}"`);let P=t.sourceFromLocator?.(m,g)??m,O={source:tr({from:P,fromPath:Yd(m),to:t.to,path:C,logger:r}),locatorFingerprint:gi(m),targetPath:C,closed:!1};if(t.hooks?.onRemoteConfigChange)O.hookSetup=t.to.subscribe(C,(k)=>{Promise.resolve(t.hooks?.onRemoteConfigChange?.(g,k.data,k)).catch((T)=>{r.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:a,error:T instanceof Error?T.message:String(T)})})}).then((k)=>{O.closeHooks=k}).catch((k)=>{r.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:a,error:k instanceof Error?k.message:String(k)})});return O})();return n.set(a,d),d.catch(()=>{if(n.get(a)===d)n.delete(a)}),d},c=async(a,d,g)=>{if(n.get(a)===d)n.delete(a);await s(g)},u=async(a)=>{if(o)throw Error("Tenant config mirror is closed");let d=n.get(a);if(!d)return i(a);let g=await d,m=await t.store.get(a);if(!m?.configLocator)throw await c(a,d,g),Error(m?`Tenant "${a}" has no configLocator`:`Tenant "${a}" was not found`);if(gi(m.configLocator)!==g.locatorFingerprint)return await c(a,d,g),n.get(a)??i(a);return g};return{async ensure(a,d){await(await u(a)).source.mirror.ready(d)},async handleCallback(a,d,g){try{return await(await u(a)).source.handleCallback(d,g)}catch(m){let C=m instanceof Error?m.message:String(m),P=C.includes("was not found")?404:503;return r.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:a,kind:d,error:C}),Response.json({error:P===404?"Tenant not found":"Tenant config mirror unavailable"},{status:P})}},async purge(a){let d=n.get(a),g=d?await d:void 0,m=await t.store.get(a),C=g?.targetPath??(m?t.path(m).trim():void 0);if(g&&d)await c(a,d,g);if(C&&await t.to.exists(C))await t.to.deleteSecret(C);if(m)await t.hooks?.onRemoteConfigRevoke?.(m)},async close(){if(o)return;o=!0;let a=[...n.values()];n.clear(),await Promise.all(a.map(async(d)=>{try{await s(await d)}catch{}}))}}}import{buildTenantPath as Zd,DEFAULT_TENANT_API_NAMESPACE as wi,DEFAULT_TENANT_UI_NAMESPACE as hi,matchTenantPath as vi,normalizeTenantPathNamespace as yi}from"@ionite/core";function Qd(){return Response.json({error:"Tenant not found"},{status:404})}function el(e){return Response.json({error:`Tenant runtime unavailable for ${e}`},{status:503})}function tl(e,t){if(t==="api")return yi(e?.api??wi);return yi(e?.ui??hi)}function rl(e){if(e.store)return async(t)=>e.store.getIon(t);return async(t)=>await e.getIon(t)??void 0}async function Si(e,t={}){if(t.custom){let s=await t.custom(e);if(s)return{id:s}}let r=t.namespace??"api",n=tl(t.strategy,r),o=vi(new URL(e.url).pathname,n);if(!o)return null;return{id:o.id,context:{namespace:r,restPath:o.restPath,restSegments:o.restSegments}}}function ki(e,t){let r=new URL(e.url);return r.pathname=t,new Request(r,e)}function Zn(e,t,r,n){let o=vi(new URL(e.url).pathname,r);if(!o||o.id!==t)return e;return ki(e,Zd(t,o.restPath,n))}function nl(e,t,r={beforeTenantSegments:["api"],afterTenantSegments:[]}){return Zn(e,t,wi,r)}function ol(e,t,r={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return Zn(e,t,hi,r)}function sl(e){return async function(r){try{let n=e.resolveTenant?await e.resolveTenant(r):await Si(r),o=typeof n==="string"?{id:n,context:void 0}:n??null;if(!o?.id)return e.onMissingTenant?await e.onMissingTenant(r):Qd();let s=await e.getIon(o.id,r)??null;if(!s)return e.onMissingIonite?await e.onMissingIonite(r,o.id):el(o.id);let i=e.rewriteRequest?await e.rewriteRequest(r,{id:o.id,ion:s,context:o.context}):r;return s.handler(i)}catch(n){return Pt(n)}}}import{list as il,matchesListFilter as al}from"@ionite/core";class bi{constructor(){this.identities=new Map;this.clientIdIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.identities.get(e)}async lookup(e){if(e.id){let t=this.identities.get(e.id);if(t)return t}if(e.clientId){let t=this.clientIdIndex.get(e.clientId);if(t)return this.identities.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.identities.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n=this.identities.get(t),o={...e,id:t,createdAt:n?.createdAt??e.createdAt??r,updatedAt:r};if(n?.clientId&&n.clientId!==o.clientId)this.clientIdIndex.delete(n.clientId);if(n?.externalId&&n.externalId!==o.externalId)this.externalIdIndex.delete(n.externalId);if(this.identities.set(t,o),o.clientId)this.clientIdIndex.set(o.clientId,t);if(o.externalId)this.externalIdIndex.set(o.externalId,t);return o}async delete(e){let t=this.identities.get(e);if(t?.clientId)this.clientIdIndex.delete(t.clientId);if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.identities.delete(e),t?1:0}async list(e){let t=Array.from(this.identities.values()).filter((c)=>al(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return il(o,i,r,n)}}var yl=30000;function wl(e){let t=e,r=t.basePath??ur(),n=t.readyTimeoutMs??yl,o=cr(t.stores),{routing:s,beforeChange:i,afterChange:c,configRetry:u,onConfigLoadError:a}=t;return{frameworkConfig:{log:e.log,validators:e.validators,sso:e.sso,iam:e.iam,workload:e.workload,secrets:e.secrets,lfv:e.lfv,ciam:e.ciam,authz:e.authz,otel:e.otel},basePath:r,readyTimeoutMs:n,stores:o,options:{beforeChange:i,afterChange:c,routing:s,configRetry:u,onConfigLoadError:a}}}function hl(e){let t=e,r={trace:(n,...o)=>t.trace(n,...o),debug:(n,...o)=>t.debug(n,...o),info:(n,...o)=>t.info(n,...o),warn:(n,...o)=>t.warn(n,...o),error:(n,...o)=>t.error(n,...o)};return{logger:r,update(n){return t=n,r}}}function Li(e,t){let r=e;return r.setStores=(n)=>{t.current=cr(n),Object.assign(r,qt(r,t.current))},r}function Ci(e){let t=e?.replace(/\s+/g," ").trim();return t?t:void 0}function Ui(e){if(typeof e!=="object"||e===null)return;return e.cause}function vl(e){if(!(e instanceof Error))return typeof e==="string"?Ci(e):void 0;let t=Ci(e.message),r=[],n=e;if(typeof n.code==="string")r.push(`code=${n.code}`);if(typeof n.status==="number")r.push(`status=${n.status}`);if(typeof n.path==="string")r.push(`path=${n.path}`);if(r.length===0)return t;if(!t)return r.join(", ");return`${t} [${r.join(", ")}]`}function oo(e,t=3){let r=[],n=e,o=0;while(n!=null&&o<t){let s=vl(n);if(s&&!r.includes(s))r.push(s);n=Ui(n),o+=1}return r.length>0?r.join(" <- "):void 0}function Sl(e,t){if(typeof e!=="object"||e===null)return;return e[t]}function xe(e,t){let r=e,n=0;while(r!=null&&n<3){let o=Sl(r,t);if(o!==void 0)return o;r=Ui(r),n+=1}return}var kl=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function bl(e){return typeof e==="string"&&kl.has(e)}function Rl(e){let t=xe(e,"kind");if(bl(t))return t;let r=xe(e,"status"),n=xe(e,"code"),o=oo(e)?.toLowerCase()??"";if(r===401||r===403||o.includes("auth error")||o.includes("permission denied"))return"auth";if(n==="not_found"||o.includes("waiting for vault"))return"not_found";if(n==="ECONNREFUSED"||n==="ECONNRESET"||n==="ENOTFOUND"||n==="ETIMEDOUT"||o.includes("connection")||o.includes("fetch failed")||o.includes("network"))return"connection";if(o.includes("timed out"))return"timeout";if(o.includes("invalid status")||typeof r==="number"&&r>=400)return"invalid_status";if(o.includes("invalid payload")||o.includes("invalid json")||o.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function Cl(e){return"validation"}var Tl=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function Pl(e,t){let r=xe(e,"recoverable");if(typeof r==="boolean")return r;if(t==="not_found")return!0;if(t==="auth"||t==="invalid_payload")return!1;let n=xe(e,"status");if(typeof n==="number"&&n>=400&&n<500)return!1;let o=xe(e,"code");if(typeof o==="string"&&(Tl.has(o)||o.startsWith("UND_ERR_")))return!0;return!0}function Il(e){return{initialDelayMs:Math.max(1,e?.initialDelayMs??2000),maxDelayMs:Math.max(1,e?.maxDelayMs??600000),multiplier:Math.max(1,e?.multiplier??2),jitterRatio:Math.max(0,e?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,e?.loadTimeoutMs??30000)}}function Ol(e,t){let r=Math.max(0,e-1),n=Math.min(t.maxDelayMs,t.initialDelayMs*t.multiplier**r);if(t.jitterRatio===0)return Math.round(n);let o=n*t.jitterRatio,s=(Math.random()*2-1)*o;return Math.max(1,Math.round(Math.min(t.maxDelayMs,n+s)))}function El(e){return(t)=>{let r=t.path?` at ${t.path}`:"",n=t.sourceType?` (${t.sourceType})`:"";e.warn(`Config source${n} unavailable${r}; ionite will retry automatically in ${t.nextDelayMs}ms (attempt ${t.attempt}, ${t.errorKind}: ${t.message}).`)}}async function Al(e,t){for(let r of t)await r(e)}function Me(e){if(!e)return;try{return new URL(e,"http://dummy").pathname}catch{return e.startsWith("/")?e:`/${e}`}}function _l(e,t){let r=t.id;if(typeof r!=="string"||r.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if(e!==void 0&&e!==r)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${e}", received "${r}").`)}function Ll(e){let t=e.kms;if(t)for(let[n,o]of Object.entries(t)){if(n.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!o||typeof o!=="object"||Array.isArray(o))throw Error(`RemoteConfig.kms.${n} must be an object.`);if(o.source!==void 0&&(typeof o.source!=="string"||o.source.length===0))throw Error(`RemoteConfig.kms.${n}.source must be a non-empty string when present.`);if(o.path!==void 0&&(typeof o.path!=="string"||o.path.length===0))throw Error(`RemoteConfig.kms.${n}.path must be a non-empty string when present.`)}let r=e.otel;if(!r)return;if(r.apiKey!==void 0&&r.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(r.apiKeyPool!==void 0){if(typeof r.apiKeyPool!=="string"||r.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!t?.[r.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${r.apiKeyPool}".`)}}function Ul(e){let t=e.authz?.trustedProvisioningClients;if(!t)return;t.forEach((r,n)=>{let o=`authz.trustedProvisioningClients[${n}]`;if(typeof r.issuer!=="string"||r.issuer.length===0)throw Error(`${o}: "issuer" is required and must be a non-empty string.`);if(typeof r.clientId!=="string"||r.clientId.length===0)throw Error(`${o}: "clientId" is required and must be a non-empty string.`);let s=Array.isArray(r.audience)?r.audience:[r.audience];if(s.length===0||s.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(r.permissions)||r.permissions.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "permissions" must be an array of non-empty permission ids.`)})}function xl(e){let t=Array.isArray(e)?e:[e];return t.length>0&&t.every((r)=>typeof r==="string"&&r.length>0)}function Ml(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return;let r=t,n=(o,s)=>{if(!xl(o.audience))throw Error(`${s}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in r||"outgoing"in r){let o=r.incoming;if(Array.isArray(o))o.forEach((s,i)=>{if(s&&typeof s==="object")n(s,`workload.incoming[${i}]`)});else if(o&&typeof o==="object"&&"jwksUri"in o)n(o,"workload.incoming");return}if(Wi(r)){if("jwksUri"in r&&!("clientId"in r)&&!("workloadId"in r))n(r,"workload (server-only)");return}}function Wl(e,t,r){if(e?.sso?.redirectUri&&t.sso?.redirectUri){let n=Me(e.sso.redirectUri),o=Me(t.sso.redirectUri);if(n!==o)r.error(`SSO redirectUri path mismatch: the framework derives "${o}" from basePath, but ConfigSource reports "${n}". Register "${o}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function so(e){let t={};if(!e)return t;for(let[r,n]of Object.entries(e))if(n.type==="vault"&&typeof n.lfv?.deliveryEndpoint==="string"&&typeof n.lfv?.eventsEndpoint==="string")t[r]=n.lfv;return t}function xi(e){return e[Ct]}function Mi(e,t){let r=so(e.secrets??void 0),n=Me(t.deliveryEndpoint),o=Me(t.eventsEndpoint),s=Me(t.path);for(let i of Object.values(r)){if(Me(i.deliveryEndpoint)!==n)continue;if(Me(i.eventsEndpoint)!==o)continue;let c=i.path?Me(i.path):void 0;if(s&&c&&s!==c)continue;return!0}return!1}function jl(e,t){let r=xi(t);if(!r)return e;if(Mi(e,r))return e;let n={type:"vault",lfv:{path:r.path,lfvServerUrl:r.lfvServerUrl,clientId:r.clientId,deliveryTimeout:r.deliveryTimeout,retryInterval:r.retryInterval,warnInterval:r.warnInterval,deliveryEndpoint:r.deliveryEndpoint,eventsEndpoint:r.eventsEndpoint,verifyJwks:r.verifyJwks}},o=e.secrets??{},s=nn(o,{clientId:r.clientId,path:r.path});return{...e,secrets:{...o,[s]:n}}}function $l(e,t){let r=xi(t);if(!r||Mi(e,r))return new Map;let n=nn(e.secrets??{},{clientId:r.clientId,path:r.path});return new Map([[n,t.secret]])}function ql(e,t){let r=so(e.secrets),n=so(t.secrets??void 0);for(let[o,s]of Object.entries(n)){let i=r[o];if(!i)continue;let c=Me(i.deliveryEndpoint),u=Me(s.deliveryEndpoint);if(c&&u&&c!==u)throw Error(`LFV deliveryEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${c}, framework path: ${u}`);let a=Me(i.eventsEndpoint),d=Me(s.eventsEndpoint);if(a&&d&&a!==d)throw Error(`LFV eventsEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${a}, framework path: ${d}`)}}function Nl(e){return new Set(Object.keys(e.secrets??{}))}function Kl(e){return new Set(Object.keys(e.secrets??{}))}function Vl(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;if(!("outgoing"in t))return new Set;let r=t.outgoing;if(!r||typeof r!=="object"||Array.isArray(r))return new Set;return new Set(Object.keys(r))}function Wi(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function Fl(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;let r=t;if("incoming"in r||"outgoing"in r){let n=r.outgoing;if(!n||typeof n!=="object"||Array.isArray(n))return new Set;return new Set(Object.keys(n))}if(Wi(r))return new Set;return new Set(Object.keys(r).filter((n)=>n!=="default"))}function Dl(e,t,r,n){let o=t.secrets??{},s=e.secrets??{};for(let[d,g]of Object.entries(o)){let m=s[d];if(!m)continue;if(g.type&&m.type&&g.type!==m.type)throw Error(`Secrets source "${d}" type in framework config must match ConfigSource type. ConfigSource type: ${m.type}, framework type: ${g.type}`)}let i=Nl(t),c=Kl(e);for(let d of i)if(!c.has(d)&&!n.has(d))r.warn(`Framework config declares secrets source "${d}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let d of c)if(!i.has(d))r.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:d});let u=Vl(t),a=Fl(e);for(let d of u)if(!a.has(d))r.warn(`Framework config declares outgoing workload client "${d}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(t.otel!==void 0&&t.otel!==null&&e.otel===void 0)r.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function Ti(e,t){if(t===void 0)return!1;return ul(e,t)}function zl(e,t){if(typeof t!=="number"||!Number.isFinite(t)||t<=0)return e;return new Promise((r,n)=>{let o=setTimeout(()=>{n(Error(`Ionite ready() timed out after ${t}ms`))},t);e.then(()=>{clearTimeout(o),r()},(s)=>{clearTimeout(o),n(s)})})}function Bl(e,t,r){if(typeof t!=="number"||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>{o(Error(r))},t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function ao(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function Pi(e){return e==="/"?e:e.replace(/\/+$/,"")}function eo(e,t){return Pi(e)===Pi(t)}function Ii(e){return e.method==="GET"||e.method==="HEAD"}function Gl(e){if(e.isReady()&&e.config?.readyz?.enabled===!1)return me();let t=e.readiness();return Response.json(Jl(t),{status:t.ok?200:503})}function Jl(e){let t=e.config.lastError;if(!t)return e;return{...e,config:{...e.config,lastError:{kind:t.kind,phase:t.phase,at:t.at,message:"[redacted]"}}}}var Hl={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","iam.workloads":"iam","iam.customers":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz"};function Yl(e){let t=e?.providers;if(!t)return!1;return Object.values(t).some((r)=>r.enabled!==!1&&r.type!=="magic-link")}function Pe(e,t,r={}){let n=Hl[e],o=t.modules[n],s=r.capable??!0,i=o.active&&o.ready&&s,c=i?void 0:!o.active||!o.ready?o.reason:r.incapableReason??`${e} is not testable by this application wiring`;return{module:n,active:o.active,ready:o.ready,testable:i,...r.urls&&r.urls.length>0?{urls:r.urls}:{},...c?{reason:c}:{}}}function Xl(e,t,r){let n=Fe(t),o=e.readiness();return{sdk:{version:Kn,catalogVersion:gn},basePath:t,urls:n,modules:o.modules,lfvCallbackTransport:Boolean(r.lfv?.callbackTransport),capabilities:{"sso.login":Pe("sso.login",o,{urls:[n.sso.loginUrl,n.sso.callbackUrl,n.sso.userUrl]}),"sso.jit":Pe("sso.jit",o,{capable:r.sso?.enableJitUserProvisioning!==!1&&Boolean(r.sso?.userStore),incapableReason:r.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":Pe("sso.logout",o,{urls:[n.sso.logoutUrl]}),"sso.back_channel_logout":Pe("sso.back_channel_logout",o,{urls:[n.sso.logoutBackChannelUrl]}),"ciam.magic_link":Pe("ciam.magic_link",o,{capable:Boolean(r.ciam?.magicLinkStore)&&r.ciam?.enableJitUserProvisioning!==!1,urls:[n.ciam.magicLinkUrl,n.ciam.magicLinkLoginUrl],incapableReason:!r.ciam?.magicLinkStore?"CIAM magic-link is enabled but no magicLinkStore capability is wired by the application.":"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":Pe("ciam.oidc_login",o,{capable:Yl(r.ciam),urls:[n.ciam.customerLoginUrl,n.ciam.customerCallbackUrl,n.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":Pe("ciam.customer",o,{urls:[n.ciam.customerUrl]}),"ciam.logout":Pe("ciam.logout",o,{urls:[n.ciam.logoutUrl]}),"iam.users":Pe("iam.users",o,{capable:Boolean(r.iam?.userStore),urls:[n.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":Pe("iam.groups",o,{capable:Boolean(r.authz?.catalogStore||r.authz?.catalog),urls:[n.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"iam.workloads":Pe("iam.workloads",o,{capable:Boolean(r.iam?.workloadIdentityStore),urls:[n.iam.workloadsUrl],incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."}),"iam.customers":Pe("iam.customers",o,{capable:Boolean(r.iam?.customerStore),urls:[n.iam.customersUrl],incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."}),"workload.incoming":Pe("workload.incoming",o,{urls:[n.workload.validateUrl,n.workload.jwksUrl]}),"workload.outgoing":Pe("workload.outgoing",o,{}),"authz.oaa":Pe("authz.oaa",o,{capable:Boolean(r.authz?.accessStore&&(r.authz?.catalogStore||r.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."})}}}async function Zl(e,t,r){if(!t.isReady())return ao();if(t.config?.capabilitiez!==!0||!r)return me();let n=await pt(e,t,Ai["capabilitiez.read"]);if(n)return n;return Response.json(r.build(),{status:200})}async function Ql(e){if(!e)return[];let t=[];for await(let r of Wt((n,o)=>e.list({start:n,limit:o})))t.push(r);return t}function to(e,t){return[...new Set(e.filter((r)=>r.subjectType===t).map((r)=>typeof r.subject==="string"?r.subject:r.subject.id).filter((r)=>Boolean(r)))]}function ro(e,t,r){if(!e)return;if(t==="all")return Wt((n,o)=>e.list({start:n,limit:o}));return async function*(){for(let o of r){let s=await e.get(o);if(s)yield s}}()}async function ef(e,t,r){if(!t.isReady())return ao();if(t.config?.authz?.oaa?.fullSync?.enabled!==!0)return me();let n=await pt(e,t,Ai["authz.oaa.sync"]);if(n)return n;let o=t.authz?.oaa;if(!o?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let s=t.authz?await t.authz.reconcile():void 0,i=r.iam?.userStore,c=r.iam?.customerStore??r.ciam?.customerStore,u=r.workload,a=r.iam?.workloadIdentityStore??(u&&"workloadIdentityStore"in u?u.workloadIdentityStore:u&&("incoming"in u)&&u.incoming&&!Array.isArray(u.incoming)&&("workloadIdentityStore"in u.incoming)?u.incoming.workloadIdentityStore:void 0),d=dl(r.authz?.catalog?_i(r.authz.catalog):void 0,r.authz?.catalogStore),g=r.authz?.accessStore,m=r.authz?.resources,C=await Ql(g),P=await o.sync({users:ro(i,o.population("user"),to(C,"user")),customers:ro(c,o.population("customer"),to(C,"customer")),workloads:ro(a,o.population("workload"),to(C,"workload")),groups:d?Wt((E,O)=>d.groups.list({start:E,limit:O})):void 0,roles:d?Wt((E,O)=>d.roles.list({start:E,limit:O})):void 0,permissions:d?Wt((E,O)=>d.permissions.list({start:E,limit:O})):void 0,resources:m?Wt((E,O)=>m.list({start:E,limit:O})):void 0,access:C},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...P,reconcile:s})}function tf(e,t,r,n,o,s){return async(i)=>{let c=new URL(i.url).pathname;if(eo(c,r)){if(!Ii(i))return It(["GET"]);return Gl(e)}if(eo(c,n)){if(!Ii(i))return It(["GET"]);return Zl(i,e,o)}if(s&&eo(c,s.url)){if(i.method!=="POST")return It(["POST"]);return ef(i,e,s.frameworkConfig)}let u=e.secrets;if(!Boolean(u?.isLfvDeliveryRequest?.(i)||u?.isLfvEventsRequest?.(i))&&!e.isReady())return ao();try{return await t(i)}catch(d){return e.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},d),Pt(d)}}}function Oi(e,t,r){if(e)return r&&!e.tenantId?{...e,tenantId:r}:e;if(t&&r)return{tenantId:r};return}function rf(e,t){if(t.authz===null)return;if(!e.authz&&!t.authz)return;return{...e.authz,...t.authz,oaa:e.authz?.oaa||t.authz?.oaa?{...e.authz?.oaa,...t.authz?.oaa}:void 0}}function no(e){let t=!1,r=ye(`${e} module`,()=>t);return{isReady:r.isReady,ready:r.ready,attach(n){if(t=n!==void 0,r.refresh(),!n)return;return Object.defineProperty(n,"isReady",{value:r.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(n,"ready",{value:r.ready,enumerable:!1,configurable:!0}),n}}}function io(e){if(!e)return!1;return e.isReady?e.isReady():!1}function Mt(e,t,r,n){if(!e)return{active:!1,ready:!1,reason:r};return io(t)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:n}}function nf(){let e=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:e(),ciam:e(),iam:e(),workload:e(),otel:e(),secrets:e(),kms:e(),authz:e()}}function of(e,t,r){let n=e.isReady(),o=e.config;if(!n||!o)return{ok:!1,applied:n,modules:nf(),config:{...t}};let s=zr(r),i=Boolean(o.workload)||Boolean(e.workload),c={sso:Mt(Boolean(o.sso),e.sso,"sso not configured (no RemoteConfig.sso)",s.sso??"sso configured but not ready"),ciam:Mt(Boolean(o.ciam),e.ciam,"ciam not configured (no RemoteConfig.ciam)",s.ciam??"ciam configured but not ready"),iam:Mt(Boolean(o.iam),e.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:Mt(i,e.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:Mt(Boolean(o.otel),e.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(o.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!io(e.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return e.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:Mt(Boolean(o.kms),e.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(o.authz?.oaa))return{active:!0,ready:!0};let d=e.authz?.oaa;return io(d)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})()};return{ok:Object.values(c).every((a)=>!a.active||a.ready),applied:n,modules:c,config:{...t}}}function sf(e,t){let r=[];for(let n of t){let o=e.modules[n];if(!e.applied){r.push({name:n,reason:"RemoteConfig has not been applied yet"});continue}if(!o?.ready)r.push({name:n,reason:o?.reason??`${n} is not ready`})}return{ok:r.length===0,notReady:r}}function af(e,t,r,n,o,s,i,c){let u=t.validators,a=ml(e.cache);fl(a.jwks);let d=t;if(a.session.read.enabled){let Z=t.sso?.sessionStore??t.ciam?.sessionStore;if(Z){let ee=An(Z,a.session.read);d={...t,sso:t.sso?{...t.sso,sessionStore:ee}:t.sso,ciam:t.ciam?{...t.ciam,sessionStore:ee}:t.ciam}}}let g={sessionCache:a.session},m=Je(u.workload,r,e?.workload,t.workload??void 0),C=t.otel!==null?kn(r,e?.otel,t.otel??void 0,o):void 0,P=zr(d);if(Object.keys(e).length>0){if(P.sso)r.error(P.sso);if(P.ciam)r.error(P.ciam)}let E=Oi(e?.sso,t.sso,e.id),O=P.sso?void 0:gl(u.sso,r,E,d.sso??void 0,g),k={...e?.iam,...t.iam},T=t.authz?.catalog?_i(t.authz.catalog):void 0,l=t.workload,b=l&&"workloadIdentityStore"in l?l.workloadIdentityStore:l&&("incoming"in l)&&l.incoming&&!Array.isArray(l.incoming)&&("workloadIdentityStore"in l.incoming)?l.incoming.workloadIdentityStore:void 0,W=Boolean(k.url||k.userStore||t.authz?.catalogStore||T),F=i.update({users:e?.iam?.users?.delta,workloads:e?.iam?.workloads?.delta,customers:e?.iam?.customers?.delta,url:k.url,audience:k.deltaAudience},{workload:m,workloadIdentityStore:b,userStore:k.userStore,customerStore:k.customerStore??d.ciam?.customerStore,accessStore:t.authz?.accessStore,catalogStore:t.authz?.catalogStore,codeCatalog:T,mapUserToScim:k.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:k.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:k.inboundWorkloads?.mapBaseWorkloadToScim}),Q;if(W&&!m){if(Object.keys(e).length>0)r.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");Q=void 0}else Q=pl(u.iam,r,m,s,t.authz?.accessStore,t.authz?.accessIndex,t.authz?.catalogStore,T,t.authz?.resources,e?.iam,t.iam??void 0,F,t.authz?.onAccessMutation,cl(e.authz),c);let ce=Oi(e?.ciam,t.ciam,e.id),se=P.ciam?void 0:ll(u.ciam,r,ce,d.ciam??void 0,m,g);return{secret:n,workload:m,otel:C,sso:O,iam:Q,ciam:se}}function ji(e,t,r,n,o,s,i,c){let u=s.authz.update(rf(t,r));e.id=t.id,e.config=t,e.secrets=s.secrets.update(t.secrets,r.secrets??void 0,r.validators.secrets,r.lfv?.callbackTransport,r.lfv?.singleProcess),e.kms=s.kms.update(t.kms,(m)=>{if(!m.source)return o;if(!e.secrets)throw Error(`KMS pool references unavailable secrets source "${m.source}".`);return e.secrets.getSecretsSource(m.source)});let a=af(t,r,n,o,s.kms.handle(),u,s.iamDelta,s.authz.settle);e.secret=a.secret,e.workload=s.workload.update(a.workload),e.otel=s.otel.update(a.otel),e.authz=u,e.log=s.log.update(e.otel?.logger??n),e.sso=s.sso.attach(a.sso),e.iam=s.iam.attach(a.iam),e.ciam=s.ciam.attach(a.ciam);let d=Fe(i),g=(m)=>bn(m,e,c?.routing,d);e.handler=tf(e,g,d.readyzUrl,d.capabilitiezUrl,{build:()=>Xl(e,i,r)},{url:ho(i),frameworkConfig:r})}function cf(e,t,r,n,o,s,i,c,u){_l(e.id,t),Ll(t),Ul(t),Ml(t),Wl(t,r,n),ql(t,r),Dl(t,r,n,c),ji(e,t,r,n,o,s,i,u)}function Ei(e){if(!e.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return e.secret}async function uf(e,t,r,n,o,s,i){let c=e,u=vo(e,t,o.current,s);if(n.beforeChange){let a=Li(u,o);i?.enter();let d;try{d=await n.beforeChange(e,a,r)}finally{i?.exit()}if(d?.config!==void 0)c=d.config;u=d?.frameworkConfig??a}return u=qt(u,o.current),{effectiveRemoteConfig:c,effectiveFrameworkConfig:u}}function qg(e,t){let r=wl(t),{frameworkConfig:n,basePath:o,readyTimeoutMs:s,stores:i,options:c}=r,u=$l(n,e),a=new Set(u.keys()),d=qt(jl(n,e),i),g=d.log||Qn,m={current:i},C={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:d},P=mn(g),E,O={log:hl(g),secrets:Ns(g,u),kms:ls(g),workload:Ys(g),otel:ys(g),authz:Vo(g,()=>P.handle(),()=>E?.iam,()=>({mapUserToScim:C.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:C.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:C.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim})),iamDelta:P,sso:no("sso"),iam:no("iam"),ciam:no("ciam")},k={},T,l,b=new Promise((I,x)=>{T=I,l=x}),W=!1,F,Q,ce=0,se={enter:()=>{ce+=1},exit:()=>{ce-=1}},Z=Promise.resolve();function ee(I){let x=Z.then(I,I);return Z=x.then(()=>{return},()=>{return}),x}function ue(I){if(W)throw Error(`Ionite instance has been closed and cannot call ${I}().`)}function z(){e.log=C.frameworkConfig.log??Qn,e.validators=C.frameworkConfig.validators}let J={},B={log:g,id:void 0,config:void 0,secret:Ei(e),authz:void 0,configStatus:k,handler:async()=>me(),ready:(I)=>{if(ce>0&&C.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return zl(b,I??s)},isReady:()=>C.remoteConfig!==void 0,readiness:()=>of(B,k,C.frameworkConfig),requireReady:(I)=>sf(B.readiness(),I),close:()=>{if(W)return;if(W=!0,Q)clearTimeout(Q),Q=void 0;F?.(),F=void 0;let I=[()=>O.secrets.close(),()=>O.kms.close(),()=>O.authz.close(),()=>O.otel.shutdown()];for(let x of I)try{Promise.resolve(x()).catch((q)=>{g.warn("Ionite close: module teardown failed",q)})}catch(q){g.warn("Ionite close: module teardown failed",q)}T?.(),T=void 0,l=void 0},setStores:async(I)=>{ue("setStores");let x=cr(I);await ee(()=>M(x))}};E=B,ji(B,J,C.frameworkConfig,g,B.secret,O,o,c),z();function ae(){let I=k.lastError!==void 0;if(k.appliedAt=Date.now(),k.lastError=void 0,I)(B.log??g).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function re(I,x){let q=oo(x)??(x instanceof Error?x.message:String(x)),w=Cl(x),_=k.lastError===void 0;if(k.lastError={kind:w,message:q,at:Date.now(),phase:I},_)(B.log??g).error(I==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":w,phase:I,error:q})}function ne(I,x,q){(B.log??g).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:I,"ion.config.hash":x,"ion.config.apply_ms":q})}async function R(I,x){if(W)return;let q=Ri(I);if(x&&C.remoteConfig!==void 0&&q===C.remoteConfigHash&&Ti(I,C.remoteConfig))return;let w=C.remoteConfig,_=w===void 0?"initial":"update",h=Date.now(),p,f,S;try{let Y=await uf(I,C.frameworkConfig,C.remoteConfig,c,m,o,se);if(p=Y.effectiveRemoteConfig,f=Ri(p),S=Y.effectiveFrameworkConfig,x&&c.beforeChange===void 0&&C.remoteConfig!==void 0&&f===C.remoteConfigHash&&Ti(p,C.remoteConfig)&&S===C.frameworkConfig)return;let K=S.log||Qn;cf(B,p,S,K,Ei(e),O,o,a,c)}catch(Y){throw re(_,Y),Y}C.remoteConfig=p,C.remoteConfigHash=f,C.frameworkConfig=S,z(),ae(),await O.otel.settled();let A=Li(C.frameworkConfig,m),N=!1;try{c.afterChange?.(B,p,A,w)}catch(Y){if((B.log??g).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:_,error:Y instanceof Error?Y.message:String(Y)}),_==="initial"){N=!0;let K=Y instanceof Error?Y:Error(`afterChange failed on initial load: ${String(Y)}`);re("initial",K),l?.(K),l=void 0,T=void 0}}if(C.frameworkConfig=A,z(),!N)ne(_,f,Date.now()-h);if(!N&&T)T(),T=void 0}async function M(I){if(W)return;if(m.current=I,C.remoteConfig===void 0){C.frameworkConfig=qt(C.frameworkConfig,I),z();return}await R(C.remoteConfig,!1)}if(e.subscribe)e.subscribe((I)=>{ee(()=>R(I,!0)).catch(()=>{})},{mode:"wait"}).then((I)=>{if(W){I?.();return}F=I}).catch((I)=>{g.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:I instanceof Error?I.message:String(I)})});let G=Il(c.configRetry),H=[c.onConfigLoadError??El(g)],v=0;function U(){if(Q=void 0,W)return;if(C.remoteConfig!==void 0)return;Bl(e.load(),G.loadTimeoutMs,`ConfigSource initial load timed out after ${G.loadTimeoutMs}ms`).then(async(I)=>{v=0;try{await ee(async()=>{if(C.remoteConfig!==void 0)return;await R(I,!0)})}catch(x){let q=x instanceof Error?x:Error(`Initial RemoteConfig application failed: ${String(x)}`);g.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:q.message}),l?.(q),l=void 0}},async(I)=>{if(W)return;v+=1;let x=Ol(v,G),q=oo(I)??"RemoteConfig load failed",w=Rl(I),_=xe(I,"code"),h=xe(I,"status"),p={attempt:v,error:I,errorKind:w,maxDelayMs:G.maxDelayMs,message:q,nextDelayMs:x,code:typeof _==="string"?_:void 0,status:typeof h==="number"?h:void 0,path:typeof xe(I,"path")==="string"?xe(I,"path"):void 0,sourceType:typeof xe(I,"sourceType")==="string"?xe(I,"sourceType"):void 0};if(!Pl(I,w)){let f=I instanceof Error?I:Error(`ConfigSource initial load failed with unrecoverable ${w}: ${q}`);g.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:w,error:q,code:p.code,status:p.status,path:p.path,sourceType:p.sourceType}),l?.(f),l=void 0;return}try{await Al(p,H)}catch(f){let S=f instanceof Error?f:Error("ConfigSource retry hook stopped RemoteConfig retrying");l?.(S),l=void 0;return}Q=setTimeout(U,x)})}return U(),B}export{Fg as AssignmentPolicyError,Qg as CatalogAdjacencyCache,Sc as ION_CAPABILITY_CATALOG,gn as ION_CAPABILITY_CATALOG_VERSION,yl as ION_READY_DEFAULT_TIMEOUT_MS,Kn as ION_SDK_VERSION,He as InMemoryAccessAssignmentStore,ri as InMemoryAccessCatalogStore,oi as InMemoryAccessIndex,or as InMemoryCustomerStore,sr as InMemoryMagicLinkStore,ni as InMemoryResourceStore,ir as InMemorySessionStore,vy as InMemoryTenantStore,ar as InMemoryUserStore,bi as InMemoryWorkloadIdentityStore,it as InMemoryWorkloadTokenStore,zg as IoniteError,kr as ScimOutboundClient,Or as VAULT_MIN_POLLING_TTL_MS,rr as VaultConfigInvalidPayloadError,yt as VaultConfigWaitingForSecretError,Le as VaultSubscribeNotSupportedError,Jg as allowHosts,Hg as allowOrigins,Yg as allowRelativePaths,Xg as allowSameOrigin,Bn as awsConfig,$r as azureConfig,Zg as blockDangerousUrls,ey as callback,ty as captureRedirect,ry as ciam,Us as closeAllVaultSockets,ny as collectReferencedDefinitions,Yn as configFromSource,Kr as configLocatorFromEnvValues,li as configSourceFromEnvValues,Ze as configSourceFromLocator,mn as createManagedIamDelta,An as createSessionReadCache,sl as createTenantIonHandler,rl as createTenantIonResolver,oy as defaultRedirectPolicies,Fe as deriveIonUrls,na as devInMemoryStores,sy as discoverSessionRecords,iy as discoverSessions,pt as enforceEndpointAuthz,Bd as envConfig,fn as escapeScimFilterValue,ay as expandRoot,Gn as gcpConfig,Dg as generateULID,cy as getCustomer,uy as getUser,ud as getWorkload,dd as getWorkloadToken,dy as has,ly as hasAll,fy as hasAllScope,py as hasAny,my as hasAnyScope,gy as hasGroup,yy as hasPermission,wy as hasRole,hy as hasScope,Sy as iam,ky as initiateLogin,qg as ionite,by as isRedirectAllowed,Md as isVaultConfigInvalidPayloadError,xd as isVaultConfigWaitingForSecretError,lt as lfvVault,Bg as listGenerator,Ry as listSsoClientIdsFromCookies,Jn as mirrorSecrets,tr as mirroredConfig,Cy as reconcileSubjectAccess,Ty as resolveAfterRedirect,Py as resolveCapturedRedirect,hs as resolveDefaultRoute,Iy as resolveRedirect,Si as resolveTenantFromRequest,ld as revokeWorkloadToken,nl as rewriteRequestForDefaultTenantApi,ol as rewriteRequestForDefaultTenantUi,Zn as rewriteRequestForTenantPath,ki as rewriteRequestPath,bn as routeRequest,Oy as sameOriginRedirectRules,Hd as secretConfigSource,Ey as sendTenantWebhook,Rs as setVaultWebSocketCommandTimeout,Ay as sso,Ge as subscribeSecretPathWithHttpPolling,vd as tenantManager,Xd as tenantMirror,Nn as validateWorkloadToken,At as vault,qr as vaultConfig,Ls as vaultSocketDiagnostics,_y as verifyUser,Ly as withSetCookies,Je as workload,fd as workloadHandler};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/server",
-  "version": "0.0.24-beta.20260917.4",
+  "version": "0.0.24-beta.20260917.5",
   "description": "ionite Server (Node/server-only)",
   "private": false,
   "author": "ionite",
@@ -24,7 +24,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@ionite/core": "0.0.24-beta.20260917.4",
+    "@ionite/core": "0.0.24-beta.20260917.5",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.220.0",
     "@opentelemetry/exporter-logs-otlp-http": "^0.220.0",