@ionite/server 0.0.24-beta.20260922.10 → 0.0.24-beta.20260922.9

package/dist/index.d.ts

@@ -853,7 +853,7 @@ declare function closeAllVaultSockets(): void;
 *
 * Keep this synchronized with packages/server/package.json via publish.ts.
 */
-declare const ION_SDK_VERSION = "0.0.24-beta.20260922.10";
+declare const ION_SDK_VERSION = "0.0.24-beta.20260922.9";
 import { Workload as CoreWorkload, FrameworkWorkloadConfig, Ionite as Ionite5, JWTAssertionClaims, Logger as Logger7, TokenValidationResult, TrustedIdp, WorkloadConfigMap, WorkloadGetToken, WorkloadIdentityStore as WorkloadIdentityStore2, WorkloadIncomingOutgoing, WorkloadTokenResponse, WorkloadTokenStore } from "@ionite/core";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 /**

package/dist/index.js

@@ -2,4 +2,4 @@ import{configTrustedClientGrants as Sl,deepEqualPlain as kl,defaultLogger as ro,
 `).split(`
 `);for(let n=0;n<r.length;n+=1){let s=(r[n]??"").trim();if(!s||s.startsWith("#"))continue;let i=s.startsWith("export ")?s.slice(7).trimStart():s,a=i.indexOf("=");if(a<=0)throw Error(`Invalid env entry at line ${n+1}: expected KEY=value`);let c=i.slice(0,a).trim();if(!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(c))throw Error(`Invalid env key "${c}" at line ${n+1}`);let u=i.slice(a+1).trim();if(u.length>=2&&(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))){let l=u[0],w=u.slice(1,-1);t[c]=l==='"'?w.replace(/\\(n|r|t|"|\\)/g,(m,T)=>{if(T==="n")return`
 `;if(T==="r")return"\r";if(T==="t")return"\t";return T}):w}else t[c]=u}return t}function Xo(e){return Object.entries(e).map(([t,r])=>{let n=String(r??"");if(!n||/[\s#"'\\]/.test(n))return`${t}=${JSON.stringify(n)}`;return`${t}=${n}`}).join(`
-`)}function Zo(e){try{let t=atob(e);return Uint8Array.from(t,(r)=>r.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function Rr(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("Secret content is not an object");return e}function zt(e){return e.metadata.contentType??cc()}function un(e,t){if(t==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof e.data==="string")return e.data;if(t==="jsonc")return JSON.stringify(e.data,null,2);if(t==="env")return Xo(Rr(e.data));let r=Rr(e.data).content;if(typeof r!=="string")throw Error(`Secret ${t} content must contain a string "content" field`);return r}function br(e,t){if(t==="jsonc")return typeof e.data==="string"?uc(e.data):e.data;if(t==="env")return typeof e.data==="string"?Yo(e.data):Rr(e.data);if(t==="text")return un(e,t);if(t==="binary"){let r=Rr(e.data).content_base64;if(typeof r!=="string")throw Error('Binary secret content must contain a "content_base64" string');return Zo(r)}throw Error(`Typed ${t} decoding is not supported yet; use text() or bytes()`)}function lc(e){return{format:e.format,mimeType:e.mimeType,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id}}function fc(e,t){let r=zt(e);if(r.format!==t.format||r.mimeType!==t.mimeType)throw new dc(lc(t),r)}async function pc(e,t){if(!e.schema)return t;let r=await e.schema["~standard"].validate(t);if(r.issues){let n=r.issues.map((o)=>o.message).join("; ");throw Error(`Secret validation failed for type "${e.id}": ${n}`)}return r.value}function Ne(e){return{async text(){let t=await e();return un(t,zt(t).format)},async json(){let t=await e(),r=zt(t).format;if(r!=="jsonc")throw Error(`json() requires a jsonc secret; received ${r}`);return br(t,r)},async bytes(){let t=await e(),r=zt(t).format;if(r==="binary")return br(t,r);return new TextEncoder().encode(un(t,r))},async env(){let t=await e(),r=zt(t).format;if(r!=="env")throw Error(`env() requires an env secret; received ${r}`);return br(t,r)},async metadata(){return(await e()).metadata},async parse(t){let r=await e();return fc(r,t),pc(t,br(r,t.format))}}}function es(e){try{return new URL(e).pathname}catch{return e.startsWith("/")?e:`/${e}`}}var yc=1e4,hc=1e4,wc=300,ts=100;async function mn(e){await new Promise((t)=>setTimeout(t,e))}function _e(e){return{startedAt:Date.now(),timeout:typeof e?.timeout==="number"&&e.timeout>0?e.timeout:void 0}}function dn(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Gt(e){if(e.timeout===void 0)return;let t=Date.now()-e.startedAt;return Math.max(0,e.timeout-t)}function Be(e,t,r){return Error(`LFV ${e} timed out after ${r.timeout??0}ms for ${t}`)}async function It(e,t,r,n,o){let s=Gt(r);if(s!==void 0){if(s<=0)throw Be(n,o,r);let i=new AbortController,a=setTimeout(()=>i.abort(),s);try{return await fetch(e,{...t,signal:i.signal})}catch(c){if(c instanceof Error&&c.name==="AbortError")throw Be(n,o,r);throw c}finally{clearTimeout(a)}}return await fetch(e,t)}class Ie extends Error{constructor(e){super(`LFV source closed while operating on ${e}`);this.name="LfvSourceClosedError"}}class ze extends Error{constructor(e){super(e);this.name="LfvProtocolError"}}class ft extends ze{constructor(e,t,r){super(`LFV ${t} failed (${e}) for ${r}`);this.status=e;if(this.name="LfvActionStatusError",e===404)this.code="not_found"}}var vc=new Set([400,401,403,404,409,410]);function rs(e){return e instanceof ze&&(!(e instanceof ft)||vc.has(e.status))}function Cr(e){return e instanceof Ie||e instanceof Error&&e.name==="LfvSourceClosedError"}function Sc(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`LFV kms_park returned invalid payload for ${t}`);let r=e;if(typeof r.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${t}`);let n=r.disposition;if(n!==void 0&&n!=="cooldown"&&n!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${t}`);return{parked:r.parked,...r.stale===!0?{stale:!0}:{},...n?{disposition:n}:{}}}function Bt(e){try{let t=JSON.parse(e);return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:void 0}catch{return}}async function ln(e,t,r,n,o,s,i,a,c,u){let l=0,w=Date.now();for(;;){if(u?.())throw new Ie(n);let m=Gt(r);if(m!==void 0&&m<=0)throw Be(o,n,r);try{return await e()}catch(T){if(T instanceof Ie)throw T;if(u?.())throw new Ie(n);if(l+=1,i>0&&Date.now()-w>=i){let O=`Error connecting to the LFV source. Retries: '${l}'`;if(a)a(c,O,{url:t,path:n,operation:o});w=Date.now()}let P=m===void 0?s:Math.min(s,m);if(P<=0)throw Be(o,n,r);if(await mn(P),u?.())throw new Ie(n)}}}function kc(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function fn(e){if(typeof e==="number"&&Number.isFinite(e))return e;if(typeof e==="string"&&e.trim()){let t=Date.parse(e.trim());if(!Number.isNaN(t))return t}return}function ns(e){return`[LFV] [${e??"-"}] [${new Date().toISOString()}]: `}function pn(e,t){if(typeof e!=="string"||e.trim()==="")throw Error(`LFV source requires "${t}"`);return e}function bc(e){return{...e,lfvServerUrl:pn(e.lfvServerUrl,"lfvServerUrl"),clientId:pn(e.clientId,"clientId"),path:pn(e.path,"path")}}function pt(e,t,r={}){let n=bc(e),o=n.log??mc,s=(y,U,q)=>{let D=ns(y)+U;if(q!==void 0)o.debug(D,q);else o.debug(D)},i=(y,U,q)=>{let D=ns(y)+U;if(q!==void 0)o.warn(D,q);else o.warn(D)},{lfvServerUrl:a,clientId:c,path:u,verifyJwks:l}=n,w=typeof n.deliveryTimeout==="number"&&n.deliveryTimeout>0?n.deliveryTimeout:void 0,m=typeof n.retryInterval==="number"&&n.retryInterval>0?n.retryInterval:yc,T=typeof n.warnInterval==="number"&&n.warnInterval>=0?n.warnInterval:hc,P=(typeof n.callbackMaxAgeSeconds==="number"&&n.callbackMaxAgeSeconds>0?n.callbackMaxAgeSeconds:wc)*1000,O=typeof n.cacheMaxAgeSeconds==="number"&&n.cacheMaxAgeSeconds>0?n.cacheMaxAgeSeconds*1000:void 0,E=l?.trim()?gc(l.trim()):void 0,g=es(n.deliveryEndpoint),v=es(n.eventsEndpoint),d=kr({lfvServerUrl:a,path:u}),C=crypto.randomUUID(),_=new Map,N=new Set,B=new Map,ee=new Map,ie=new Map,re=new Map,te=new Map,ue=new Map,W=new Map,J=(y,U)=>{if(typeof U==="number"&&Number.isInteger(U)&&U>=1){let q=W.get(y)??1,D=Math.max(q,U);return W.set(y,D),D}return W.get(y)},Y=(y,U)=>typeof U==="number"&&Number.isInteger(U)&&U>=1&&U>(W.get(y)??1),ne=new Map,se=new Map,oe=!1,S,L=new Set,z=()=>oe;function H(y,U){B.set(y,U),ee.set(y,Date.now())}function k(y){B.delete(y),ee.delete(y)}function M(y){let U=B.get(y);if(!U)return;if(O!==void 0){let q=ee.get(y)??0;if(Date.now()-q>O){s(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:y});return}}return U}function I(){return N.size>0||_.size>0||ue.size>0}function j(){if(oe){if(S)S(),S=void 0;return}let y=I();if(y&&!S)S=Go(d,C,{trustId:E,onDelivery:async(U)=>mo(U).handled||await yo(U),onEvents:async(U)=>{ho(U)}});if(!y&&S)S(),S=void 0}async function K(y,U,q,D){if(!t)throw Error("LFV callback transport is not configured");for(;;){if(oe)throw new Ie(U);if(D())throw new Ie(U);let Z=await t.take(y);if(Z){if(Z.key!==d)i(y,"parked OTP callback rejected: callback key mismatch");else if(!await Br(Z.rawBody,Z.headers)){let fe=Bt(Z.rawBody);if(fe?.type==="otp"&&fe.request_id===y&&typeof fe.otp==="string"&&fe.otp)return fe.otp}}let G=Gt(q);if(G!==void 0&&G<=0)throw Be("issueOtp",U,q);await mn(G===void 0?ts:Math.min(ts,G))}}async function h(y,U){let q=U??crypto.randomUUID(),D={startedAt:Date.now(),timeout:w},Z={request_id:q,path:y,action:"read_secret",...dn(J(y))},G=await ln(()=>It(`${a.replace(/\/+$/g,"")}/clients/${c}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":q},body:JSON.stringify(Z)},D,"issueOtp",y),a,D,y,"issueOtp",m,T,i,q,z);if(G.status!==200&&G.status!==202)throw new ft(G.status,"issueOtp",y)}async function x(y,U){let q=se.get(y);if(q)return q;let D=h(y,U);se.set(y,D);try{await D}finally{if(se.get(y)===D)se.delete(y)}}async function b(y,U,q,D){if(oe)throw new Ie(y);let Z=q??crypto.randomUUID(),G=D??_e(),ce=new Promise((Ae,Nt)=>{let wo={resolve:Ae,reject:Nt},Gr=Gt(G);if(Gr!==void 0){if(Gr<=0){Nt(Be("issueOtp",y,G));return}wo.timer=setTimeout(()=>{ue.delete(Z),j(),Nt(Be("issueOtp",y,G))},Gr)}ue.set(Z,wo),j()});ce.catch(()=>{});let fe=()=>{let Ae=ue.get(Z);if(!Ae)return;if(Ae.timer)clearTimeout(Ae.timer);ue.delete(Z),j()},de={request_id:Z,path:y,action:U,...dn(J(y))};s(Z,"OTP request",{path:y,action:U});let we;try{we=await ln(async()=>await It(`${a.replace(/\/+$/g,"")}/clients/${c}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":Z},body:JSON.stringify(de)},G,"issueOtp",y),a,G,y,"issueOtp",m,T,i,Z,z)}catch(Ae){throw fe(),Ae}if(we.status!==200&&we.status!==202)throw fe(),new ft(we.status,"issueOtp",y);let ke=!1,ve=t?K(Z,y,G,()=>ke):void 0;if(ve)ve.catch(()=>{});try{let Ae=await(ve?Promise.race([ce,ve]):ce);return s(Z,"OTP received via signed callback",{path:y,action:U}),Ae}finally{ke=!0,fe()}}async function p(y,U,q,D,Z,G,ce){if(oe)throw new Ie(U);let fe=ce??_e(),de=await ln(async()=>await It(`${a.replace(/\/+$/g,"")}${y}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":Z},body:JSON.stringify({request_id:Z,otp:D,path:U,...dn(J(U)),...G??{}})},fe,q,U),a,fe,U,q,m,T,i,Z,z);if(de.status!==200&&de.status!==202)throw new ft(de.status,q,U);return s(Z,`${q} accepted`,{path:U,status:de.status}),de}async function f(y,U,q,D,Z,G){if(oe)throw new Ie(U);let ce=Z??crypto.randomUUID(),fe=G??_e(),de=await b(U,q,ce,fe),we=await p(y,U,q,de,ce,D,fe);return{requestId:ce,response:we}}async function R(y,U,q){if(oe)throw new Ie(y);let D=Y(y,q?.kmsSlots);if(J(y,q?.kmsSlots),D)k(y);let Z=M(y);if(Z)return Z;let G=ne.get(y);if(G){if(!D)return G;if(await G.catch(()=>{return}),G=ne.get(y),G)return G}let ce=A(y,U,q);ne.set(y,ce),ce.catch((fe)=>{if(Cr(fe))s(U,"read aborted: source closed",{path:y})});try{return await ce}finally{ne.delete(y)}}async function A(y,U,q){let D=q?.timeout??w,Z={startedAt:Date.now(),timeout:typeof D==="number"&&D>0?D:void 0},G=U??crypto.randomUUID();s(G,"read_secret request",{path:y});let ce=0,fe=Date.now();for(;;){if(oe)throw new Ie(y);try{let{response:de}=await f("/secrets/request",y,"read_secret",void 0,G,Z),we=await V(G,de),ke=X(y,we);return F(y,ke,ke.metadata.version),s(G,"read_secret completed from action response",{path:y}),ke}catch(de){if(de instanceof Ie)throw de;if(rs(de))throw de;let we=Gt(Z);if(we!==void 0&&we<=0)throw Be("read_secret",y,Z);if(ce+=1,T>0&&Date.now()-fe>=T)i(G,`read_secret retrying. Retries: '${ce}'`,{path:y}),fe=Date.now();let ke=we===void 0?m:Math.min(m,we);if(ke<=0)throw Be("read_secret",y,Z);await mn(ke)}}}async function V(y,U){if(!l?.trim())throw new ze("LFV read_secret response verification is not configured");let q=U.headers.get("X-LFV-Request-Id")?.trim(),D=U.headers.get("X-LFV-Key-Id")?.trim(),Z=U.headers.get("X-LFV-Signature")?.trim();if(!q||!D||!Z)throw new ze("LFV read_secret response is missing signature headers");if(q!==y)throw new ze("LFV read_secret response request_id header does not match the request");let G=await U.text();if(!await Qo({jwks:l,kid:D,signatureB64Url:Z,requestId:y,rawBody:G}))throw new ze("LFV read_secret response signature verification failed");let fe=Bt(G);if(!fe||fe.request_id!==y)throw new ze("LFV read_secret response request_id does not match the request");return fe}function X(y,U){if(po(U)!==y||U.data?.data===void 0)throw new ze(`LFV read_secret returned an invalid secret response for ${y}`);let D=U.data.metadata??{},Z=typeof D.version==="number"?D.version:0,G=D.created_time??D.created,ce=lt(D);return{data:U.data.data,metadata:{path:y,version:Z,created:typeof G==="string"?new Date(G):new Date,...ce?{contentType:ce}:{}}}}function F(y,U,q){if(q!==void 0){let G=re.get(y);if(G!==void 0&&q<G){s(void 0,"delivery ignored: stale version",{path:y,realVersion:q,lastAccepted:G});return}re.set(y,q)}H(y,U),L.delete(y);let D=U.metadata.version;if(ie.get(y)===D)return;ie.set(y,D);let Z=_.get(y);if(!Z)return;for(let G of Z)G(U)}async function ae(y,U){return await R(y,void 0,U)}async function Q(y,U,q){if(!kc(U))throw Error(`putSecret requires an object value for LFV source at path ${y}`);let D=_e(q),Z={data:U,content_type:Sr(q.contentType)};if(await at(y,q)){await f("/secrets/update",y,"update_secret",Z,void 0,D),k(y);return}await f("/secrets/create",y,"create_secret",Z,void 0,D),k(y)}async function he(y,U){let q=_e(U);await f("/secrets/delete",y,"delete_secret",void 0,void 0,q),k(y)}async function le(y,U){let q=_e(U),D=crypto.randomUUID();s(D,"list_paths request",{path:y});let Z=await b(y,"list_paths",D,q),G=await It(`${a.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":D},body:JSON.stringify({request_id:D,otp:Z,path:y})},q,"listPaths",y);if(G.status!==200)throw Error(`LFV listPaths failed (${G.status}) for ${y}`);let ce=await G.json();if(!Array.isArray(ce.items))throw Error(`LFV listPaths returned invalid payload for ${y}`);return s(D,"list_paths success",{path:y,status:200}),ce.items.filter((fe)=>typeof fe==="string")}async function at(y,U){let q=_e(U),D=crypto.randomUUID();s(D,"exists request",{path:y});let Z=await b(y,"read_metadata",D,q),G=await It(`${a.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":D},body:JSON.stringify({request_id:D,otp:Z,path:y})},q,"exists",y);if(G.status!==200)throw Error(`LFV exists failed (${G.status}) for ${y}`);let ce=await G.json();if(typeof ce.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${y}`);return s(D,"exists success",{path:y,status:200,exists:ce.exists}),ce.exists}async function Fe(y,U,q){let D=_e(q);await f("/secrets/rotate/request",y,"request_rotate",{reason:U?.reason,severity:U?.severity,incident_ref:U?.incidentRef},void 0,D)}async function qt(y,U,q){let D=_e(q);await f("/secrets/revoke/request",y,"request_revoke",{reason:U?.reason,severity:U?.severity,incident_ref:U?.incidentRef},void 0,D)}async function Gi(y,U,q){let D=_e(q),{response:Z}=await f("/secrets/kms/park",y,"kms_park",{key_id:U.keyId,status:U.status,reason:U.reason},void 0,D);return Sc(await Z.json().catch(()=>null),y)}function Hi(y,U){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_add_keys returned invalid payload for ${U}`);let q=y;if(!Array.isArray(q.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${U}`);return{keys:q.keys.map((Z,G)=>{if(!Z||typeof Z!=="object"||Array.isArray(Z))throw Error(`LFV kms_add_keys returned invalid keys[${G}] for ${U}`);let ce=Z.id;if(typeof ce!=="string"||ce.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${G}].id for ${U}`);return{id:ce}})}}function Ji(y,U){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_revoke_key returned invalid payload for ${U}`);let q=y;if(typeof q.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${U}`);return{revoked:q.revoked}}async function Yi(y,U,q){let D=_e(q),{response:Z}=await f("/secrets/kms/add-keys",y,"kms_add_keys",{keys:U.keys},void 0,D);return Hi(await Z.json().catch(()=>null),y)}async function Xi(y,U,q){let D=_e(q),{response:Z}=await f("/secrets/kms/revoke-key",y,"kms_revoke_key",{key_id:U.keyId,reason:U.reason},void 0,D);return Ji(await Z.json().catch(()=>null),y)}async function Zi(y,U){let q=_e(U),D=crypto.randomUUID();s(D,"getMetadata request",{path:y});let Z=await b(y,"read_metadata",D,q),G=await It(`${a.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":D},body:JSON.stringify({request_id:D,otp:Z,path:y})},q,"getMetadata",y);if(G.status!==200)throw Error(`LFV getMetadata failed (${G.status}) for ${y}`);let ce=await G.json();if(!ce.metadata||typeof ce.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${y}`);return s(D,"getMetadata success",{path:y,status:200}),ce.metadata}async function fo(y,U,q,D=!0){let Z=_.get(y)??new Set,G,ce=(de)=>{if(de.metadata.version===G)return;G=de.metadata.version,U(de)};if(Z.add(ce),_.set(y,Z),!D)return j(),()=>{let de=_.get(y);if(!de)return;if(de.delete(ce),de.size===0)_.delete(y);j()};let fe=Y(y,q?.kmsSlots)?void 0:M(y);if(fe)ce(fe),ie.set(y,fe.metadata.version);else try{ce(await ae(y,q))}catch(de){if(Z.delete(ce),Z.size===0)_.delete(y);throw de}return j(),()=>{let de=_.get(y);if(!de)return;if(de.delete(ce),de.size===0)_.delete(y);j()}}let Qi=(y,U)=>fo(y,U,void 0,!1);function ea(y){return y.method==="POST"&&new URL(y.url).pathname===g}function ta(y){return y.method==="POST"&&new URL(y.url).pathname===v}function po(y){let U=y.data?.metadata?.path;if(typeof U==="string"&&U)return U;if(typeof y.path==="string"&&y.path)return y.path;return}function ra(y){let{request_id:U,otp:q}=y;if(typeof U!=="string"||typeof q!=="string"||!q)return{handled:!1};let D=ue.get(U);if(!D)return{handled:!1};if(D.timer)clearTimeout(D.timer);return ue.delete(U),j(),D.resolve(q),{handled:!0}}function mo(y){return y.type==="otp"?ra(y):{handled:!1}}function tt(y="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:y}),{status:401,headers:{"Content-Type":"application/json"}})}function go(y){return{requestId:y.headers.get("X-LFV-Request-Id")??y.headers.get("x-lfv-request-id")??"",keyId:y.headers.get("X-LFV-Key-Id")??y.headers.get("x-lfv-key-id")??"",signature:y.headers.get("X-LFV-Signature")??y.headers.get("x-lfv-signature")??""}}async function Br(y,U){if(!l?.trim())return i(void 0,"LFV callback rejected: verifyJwks is not configured"),tt("LFV callback verification is not configured");let{requestId:q,keyId:D,signature:Z}=U;if(!q.trim()||!D.trim()||!Z.trim())return i(q||void 0,"LFV callback rejected: missing signature headers"),tt("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await Qo({jwks:l,kid:D,signatureB64Url:Z.trim(),requestId:q.trim(),rawBody:y}))return i(q,"LFV callback rejected: signature verification failed"),tt();let ce=Bt(y);if(!ce)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let fe=ce;if(fe.request_id!==q.trim())return i(q,"LFV callback rejected: request_id header/body mismatch"),tt("X-LFV-Request-Id does not match request_id in body");let de=Date.now(),we=fn(fe.issued_at);if(we===void 0)return i(q,"LFV callback rejected: missing or invalid issued_at"),tt("Missing or invalid issued_at");if(de-we>P)return i(q,"LFV callback rejected: stale (outside freshness window)"),tt("Callback is stale (issued_at outside freshness window)");let ke=fn(fe.expires_at);if(ke!==void 0&&de>ke)return i(q,"LFV callback rejected: expired"),tt("Callback has expired");let ve=Z.trim();for(let[Ae,Nt]of te)if(Nt<=de)te.delete(Ae);if(te.has(ve))return i(q,"LFV callback rejected: replayed signature"),tt("Callback signature already processed (replay)");return te.set(ve,we+P),null}async function yo(y){if(!r.selfRedeemReads||y.action!=="read_secret"||typeof y.request_id!=="string"||typeof y.path!=="string"||typeof y.otp!=="string")return!1;let U={startedAt:Date.now(),timeout:w},q=await p("/secrets/request",y.path,"read_secret",y.otp,y.request_id,void 0,U),D=await V(y.request_id,q),Z=X(y.path,D);return F(y.path,Z,Z.metadata.version),!0}async function na(y){let U=await y.text(),q=go(y),D=await Br(U,q);if(D)return D;let Z=Bt(U);if(!Z)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let G=Z;if(G.type!=="otp"||typeof G.request_id!=="string"||typeof G.otp!=="string"||typeof G.path!=="string"||typeof G.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let ce=po(G);s(G.request_id,"delivery received",{path:ce});let fe=mo(G),de=ce?kr({lfvServerUrl:a,path:ce}):d,we=await Ho(de,G,C,E),ke=fe.handled||we>0;if(!ke)try{if(ke=await yo(G),!ke&&t&&typeof G.request_id==="string"){let ve=fn(G.expires_at),Ae=Math.max(1,(ve??Date.now()+P)-Date.now());await t.put(G.request_id,{kind:"delivery",key:de,rawBody:U,headers:q},Ae),ke=!0}}catch(ve){if(rs(ve)){if(!(ve instanceof ft)||ve.status!==409&&ve.status!==410)L.add(G.path);return i(q.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:de,status:ve instanceof ft?ve.status:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:{"Content-Type":"application/json"}})}return te.delete(q.signature.trim()),i(q.requestId,"LFV callback handoff failed; callback may be retried",{key:de,error:ve instanceof Error?ve.message:String(ve)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(!ke)return te.delete(q.signature.trim()),i(q.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:de}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function ho(y){if(oe)return;if(!y?.path||typeof y.path!=="string")return;s(y.request_id,"events payload",{path:y.path,event:y.event});for(let U of N)try{U({path:y.path,event:y.event,requestId:y.request_id,issuedAt:y.issued_at,expiresAt:y.expires_at,...typeof y.key_id==="string"&&y.key_id.length>0?{keyId:y.key_id}:{}})}catch(q){i(y.request_id,"secret event listener failed",{path:y.path,event:y.event,error:q instanceof Error?q.message:String(q)})}if(y.event==="created"||y.event==="updated"||y.event==="rotated")k(y.path),(r.selfRedeemReads?x(y.path,y.request_id):R(y.path,y.request_id).then(()=>{return})).catch((q)=>{if(Cr(q)){s(y.request_id,"event refresh aborted: source closed",{path:y.path});return}L.add(y.path),i(y.request_id,"event-triggered refresh failed; source marked degraded",{path:y.path,event:y.event,error:q instanceof Error?q.message:String(q)})})}async function oa(y){let U=await y.text(),q=go(y),D=await Br(U,q);if(D)return D;let Z=Bt(U);if(!Z)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let G=Z;if(!G?.path||typeof G.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});s(G.request_id,"events received",{path:G.path,event:G.event}),ho(G);let ce=kr({lfvServerUrl:a,path:G.path});return await Jo(ce,G,C,E),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function sa(){if(oe)return;if(oe=!0,S)S(),S=void 0;let y=new Ie(u);for(let U of ue.values()){if(U.timer)clearTimeout(U.timer);try{U.reject(y)}catch{}}ue.clear(),ne.clear(),se.clear(),L.clear(),B.clear(),ee.clear(),ie.clear(),re.clear(),te.clear(),_.clear(),N.clear()}return{type:"vault",isAvailable:()=>L.size===0,get:(y,U)=>Ne(()=>ae(y,U)),getFullSecret:ae,getSecret:async(y,U)=>(await ae(y,U)).data,putSecret:Q,deleteSecret:he,listPaths:le,exists:at,requestRotate:Fe,requestRevoke:qt,parkKmsKey:Gi,addKmsKeys:Yi,revokeKmsKey:Xi,getMetadata:Zi,subscribe:fo,subscribePassive:Qi,subscribeEvents:(y)=>(N.add(y),j(),()=>{N.delete(y),j()}),close:sa,isDeliveryRequest:ea,isEventsRequest:ta,handleDelivery:na,handleEvents:oa,deliveryPath:g,eventsPath:v,callbackKey:d,trustId:E}}function mt(e,t,r){if(typeof e!=="string"||e.trim()==="")throw Error(`"${t}" is required when using ${r}`);return e}var Ot="__esLfvBootstrap";import{catalogEntityStore as Pr,listGenerator as Yt,materializeCodeCatalogEntity as Pc,trimTrailingSlash as Ic,unionCatalogRead as Oc}from"@ionite/core";import{baseCustomerToScim as ss,baseUserToScimUser as is,baseWorkloadToScim as as,entitlementToScimGroup as hn}from"@ionite/core/server";import{ION_AUTHZ_GROUP_SCHEMA as gn}from"@ionite/core";var os="application/scim+json",Rc="urn:ietf:params:scim:api:messages:2.0:PatchOp",Cc="urn:ietf:params:scim:schemas:core:2.0:User",Tc="urn:ietf:params:scim:schemas:core:2.0:Group";async function Ht(e){try{let t=(await e.clone().text()).trim();return t?t.slice(0,2000):void 0}catch{return}}function Jt(e){if(e==="user")return"Users";if(e==="workload")return"Workloads";if(e==="customer")return"Customers";return"Groups"}function yn(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class Tr{constructor(e){this.inflight=new Map;this.memo=new Map;this.writes=new Map;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.getToken=e.getToken,this.receipts=e.receipts,this.log=e.log,this.fetchImpl=e.fetchImpl??((t,r)=>fetch(t,r))}async headers(){let e=await this.getToken();return new Headers({"Content-Type":os,Accept:os,Authorization:`Bearer ${e}`})}inflightKey(e,t,r){return`${e}\x00${t}\x00${r?"create":"lookup"}`}receiptKey(e,t){return`${e}\x00${t}`}serializeWrite(e,t,r){let n=`${e}\x00${t}`,s=(this.writes.get(n)??Promise.resolve()).catch(()=>{return}).then(r);this.writes.set(n,s);let i=()=>{if(this.writes.get(n)===s)this.writes.delete(n)};return s.then(i,i),s}async resolveProviderId(e,t,r){let n=this.receiptKey(e,t),o=this.memo.get(n);if(o)return{found:o.providerId,requestUrl:o.requestUrl};let s=await this.receipts.read(e,t);if(s)this.memo.set(n,s);if(s)return{found:s.providerId,requestUrl:s.requestUrl};let i=this.inflightKey(e,t,r!==void 0),a=this.inflight.get(i);if(a)return a;let c=this.resolveUncached(e,t,r).then(async(u)=>{if(typeof u==="object"){let l={providerId:u.found,...u.requestUrl?{requestUrl:u.requestUrl}:{}};await this.receipts.write(e,t,l),this.memo.set(n,l)}return u}).finally(()=>{this.inflight.delete(i)});return this.inflight.set(i,c),c}async resolveUncached(e,t,r){let n=await this.filterByExternalId(e,t);if(n!=="absent")return n;if(!r)return"absent";return this.create(e,t,r)}async filterByExternalId(e,t){let r=encodeURIComponent(`externalId eq "${yn(t)}"`),n=`${this.baseUrl}/${Jt(e)}?filter=${r}`,o=await this.fetchImpl(n,{method:"GET",headers:await this.headers()});if(!o.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:e,status:o.status,detail:await Ht(o)}),"error";let i=((await o.json()).Resources??[])[0];return i?.id?{found:i.id,...this.requestUrl(e,i)}:"absent"}async create(e,t,r){let n=`${this.baseUrl}/${Jt(e)}`,o=this.writeBody(e,t,r),s=await this.fetchImpl(n,{method:"POST",headers:await this.headers(),body:JSON.stringify(o)});if(!s.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Ht(s)}),"error";let i=await s.json();return i.id?{found:i.id,...this.requestUrl(e,i),created:!0}:"error"}requestUrl(e,t){if(e!=="group")return{};let r=t[gn];if(!r||typeof r!=="object")return{};let n=r.requestUrl;return typeof n==="string"&&n?{requestUrl:n}:{}}async captureResponseReference(e,t,r,n,o){try{let s=await e.clone().json(),i=this.requestUrl(t,s).requestUrl;if(!i&&s.id===void 0)return;let a=i??o,c={providerId:s.id??n,...a?{requestUrl:a}:{}};await this.receipts.write(t,r,c),this.memo.set(this.receiptKey(t,r),c)}catch{}}async invalidate(e,t){this.memo.delete(this.receiptKey(e,t)),await this.receipts.clear(e,t)}writeBody(e,t,r){let{id:n,meta:o,...s}=r,i=s,a=i[gn];if(a&&typeof a==="object"&&!Array.isArray(a)){let{providerId:c,requestUrl:u,...l}=a;i[gn]=l}return{...i,schemas:(r.schemas?.length??0)>0?r.schemas:[e==="user"?Cc:Tc],externalId:t}}async upsertResource(e,t,r){return this.serializeWrite(e,t,()=>this.upsertResourceNow(e,t,r))}async upsertResourceNow(e,t,r){let n=async(s)=>{let i=await this.resolveProviderId(e,t,s?r:void 0);if(i==="error")return"error";if(i==="absent")return"skipped";if(i.created)return"pushed";let a=await this.fetchImpl(`${this.baseUrl}/${Jt(e)}/${encodeURIComponent(i.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody(e,t,r))});if(a.status===404||a.status===410)return"stale";if(a.ok)return await this.captureResponseReference(a,e,t,i.found,i.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:e,status:a.status,detail:await Ht(a)}),"error"},o=await n(!0);if(o==="stale")await this.invalidate(e,t),o=await n(!0);return o==="stale"?"error":o}async deleteResource(e,t){return this.serializeWrite(e,t,()=>this.deleteResourceNow(e,t))}async deleteResourceNow(e,t){let r=async()=>{let o=await this.resolveProviderId(e,t);if(o==="error")return{outcome:"error"};if(o==="absent")return{outcome:"pushed"};let s=await this.fetchImpl(`${this.baseUrl}/${Jt(e)}/${encodeURIComponent(o.found)}`,{method:"DELETE",headers:await this.headers()});if(s.status===404||s.status===410)return{outcome:"pushed",stale:!0};if(s.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Ht(s)}),{outcome:"error"}},n=await r();if(n.stale)await this.invalidate(e,t),n=await r();if(n.outcome==="pushed")await this.invalidate(e,t);return n.outcome}async patchGroupMembership(e){return this.serializeWrite("group",e.groupExternalId,()=>this.patchGroupMembershipNow(e))}async patchGroupMembershipNow(e){let{groupExternalId:t,userExternalId:r,op:n}=e,o=e.subjectResourceType??"user",s=await this.resolveProviderId(o,r,n==="add"?e.userCreate:void 0);if(s==="error")return this.log.warn("IAM delta: principal lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,subjectResourceType:o}),"error";if(s==="absent")return this.log.warn("IAM delta: principal not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n,subjectResourceType:o}),"skipped";let i=s.found,a=async(l)=>{let w=await this.resolveProviderId("group",t,n==="add"&&l?e.groupCreate:void 0);if(w==="error")return{kind:"error"};if(w==="absent")return{kind:"absent"};let m=`${this.baseUrl}/${Jt("group")}/${encodeURIComponent(w.found)}`,T=n==="add"?[{op:"add",path:"members",value:[{value:i,type:e.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${yn(i)}"]`}];return{kind:"response",response:await this.fetchImpl(m,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[Rc],Operations:T})}),providerId:w.found,requestUrl:w.requestUrl}},c=await a(!0);if(c.kind==="response"&&(c.response.status===404||c.response.status===410))await this.invalidate("group",t),c=await a(!1);if(c.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n}),"error";if(c.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n}),"skipped";let u=c.response;if(!u.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,status:u.status,detail:await Ht(u)}),"error";return await this.captureResponseReference(u,"group",t,c.providerId,c.requestUrl),"pushed"}}function Et(e){if(typeof e==="string")return e;if(e&&typeof e==="object"&&"id"in e)return e.id;return}function Xt(e){return e&&typeof e==="object"?e:void 0}function wn(e){let t={},r={},n,o,s,i,a,c,u,l,w,m=()=>t.users==="patch"||t.workloads==="patch"||t.customers==="patch",T=(k)=>{if(k==="user")return t.users==="patch";if(k==="workload")return t.workloads==="patch";return t.customers==="patch"},P=()=>{if(!t.url)return"destination URL is not configured";if(!r.workload)return"workload identity is not configured";if(typeof r.workload.isReady!=="function"||typeof r.workload.ready!=="function")return"workload handle violates the readiness contract";if(!r.workload.isReady())return"workload module is not ready";if(t.audience){let k=r.workload[t.audience];if(!k)return`outgoing workload client "${t.audience}" is not configured`;if(typeof k.isReady!=="function"||typeof k.ready!=="function")return`outgoing workload client "${t.audience}" violates the readiness contract`;if(!k.isReady())return`outgoing workload client "${t.audience}" is not ready`}return},O=()=>{if(!m())return"no principal-kind delta mode is 'patch'";let k=P();if(k)return k;if(t.users==="patch"&&!r.userStore)return"user store is not configured for IAM destination receipts";if(t.workloads==="patch"&&!r.workloadIdentityStore)return"workload identity store is not configured for IAM destination receipts";if(t.customers==="patch"&&!r.customerStore)return"customer store is not configured for IAM destination receipts";if(!r.catalogStore)return"catalog store is not configured for IAM destination receipts";return},E=()=>O()===void 0,g=ge("IAM delta",E),v=async()=>{let k=r.workload;if(!k)throw Error("IAM delta: workload identity not configured");if(t.audience&&typeof k.getToken==="function")return k.getToken(t.audience);if(typeof k.getServerToken==="function")return k.getServerToken();return k.getToken()},d=()=>Oc(r.codeCatalog,r.catalogStore),C=async(k,M)=>{let I=r.catalogStore;if(!I)return;let j=r.codeCatalog?.groups.get(k)??r.codeCatalog?.roles.get(k)??r.codeCatalog?.permissions.get(k);if(j){let h=r.codeCatalog?.groups.get(j.id)?"group":r.codeCatalog?.roles.get(j.id)?"role":"permission",x=Pr(I,h),b=await x.get(j.id);if(!b&&M)await Pc(h,j,x),b=await x.get(j.id);if(b)return{kind:h,entity:b}}let K=[["group",I.groups],["role",I.roles],["permission",I.permissions]];for(let[h,x]of K){let b=await x.get(k);if(b)return{kind:h,entity:b}}return},_=async(k)=>{let M=r.userStore;if(!M)return;if(M.getByExternalId)return M.getByExternalId(k);for await(let I of Yt((j,K)=>M.list({start:j,limit:K})))if(I.externalId===k)return I;return},N=(k)=>k?.providerId?{providerId:k.providerId,...k.requestUrl?{requestUrl:k.requestUrl}:{}}:void 0,B=async(k)=>{let M=r.workloadIdentityStore;if(!M)return;if(M.getByExternalId)return M.getByExternalId(k);let I=await M.lookup({id:"",externalId:k});if(I)return I;for await(let j of Yt((K,h)=>M.list({start:K,limit:h})))if(j.externalId===k)return j;return},ee=async(k)=>{let M=r.customerStore;if(!M)return;if(M.getByExternalId)return M.getByExternalId(k);let I=await M.lookup({id:"",userName:"",name:"",email:"",externalId:k});if(I)return I;for await(let j of Yt((K,h)=>M.list({start:K,limit:h})))if(j.externalId===k)return j;return},ie={async read(k,M){if(k==="user")return N(await _(M));if(k==="workload")return N(await B(M));if(k==="customer")return N(await ee(M));return N((await C(M,!1))?.entity)},async write(k,M,I){if(k==="user"){let h=await _(M);if(!h||h.providerId===I.providerId&&h.requestUrl===I.requestUrl)return;await r.userStore?.upsert({...h,providerId:I.providerId,requestUrl:I.requestUrl});return}if(k==="workload"){let h=await B(M);if(!h||h.providerId===I.providerId&&h.requestUrl===I.requestUrl)return;await r.workloadIdentityStore?.upsert({...h,providerId:I.providerId,requestUrl:I.requestUrl});return}if(k==="customer"){let h=await ee(M);if(!h||h.providerId===I.providerId&&h.requestUrl===I.requestUrl)return;await r.customerStore?.upsert({...h,providerId:I.providerId,requestUrl:I.requestUrl});return}let j=await C(M,!0);if(!j||j.entity.providerId===I.providerId&&j.entity.requestUrl===I.requestUrl)return;await Pr(r.catalogStore,j.kind).set({...j.entity,providerId:I.providerId,requestUrl:I.requestUrl}).ready()},async clear(k,M){if(k==="user"){let b=await _(M);if(!b||b.providerId===void 0&&b.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...R}=b;await r.userStore?.upsert(R);return}if(k==="workload"){let b=await B(M);if(!b||b.providerId===void 0&&b.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...R}=b;await r.workloadIdentityStore?.upsert(R);return}if(k==="customer"){let b=await ee(M);if(!b||b.providerId===void 0&&b.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...R}=b;await r.customerStore?.upsert(R);return}let I=await C(M,!1);if(!I||I.entity.providerId===void 0&&I.entity.requestUrl===void 0)return;let{providerId:j,requestUrl:K,...h}=I.entity;await Pr(r.catalogStore,I.kind).set(h).ready()}},re=()=>{if(!E()||!t.url)return;let k=t.url;if(n&&o===k&&s===r.catalogStore&&i===r.userStore&&a===r.workloadIdentityStore&&c===r.customerStore&&u===r.codeCatalog&&l===r.fetchImpl)return n;return n=new Tr({baseUrl:t.url,getToken:v,receipts:ie,log:e,fetchImpl:r.fetchImpl}),o=k,s=r.catalogStore,i=r.userStore,a=r.workloadIdentityStore,c=r.customerStore,u=r.codeCatalog,l=r.fetchImpl,n},te=(k)=>k==="workload"?"Workload":k==="customer"?"Customer":"User",ue=async(k)=>{if(k.subjectType==="workload"){let K=Et(k.subject),h=Xt(k.subject);if(!h&&K)h=await r.workloadIdentityStore?.get(K);let x=h?.externalId??h?.id??K;if(!h||!x)return;return{externalId:x,resourceType:"workload",create:await(r.mapWorkloadToScim?.({...h,externalId:x})??as({...h,externalId:x}))}}if(k.subjectType==="customer"){let K=Et(k.subject),h=Xt(k.subject);if(!h&&K)h=await r.customerStore?.get(K);let x=h?.externalId??h?.id??K;if(!x)return;let b=h?await(r.mapCustomerToScim?.({...h,externalId:x})??ss({...h,externalId:x})):{schemas:["urn:ionite:scim:schemas:core:2.0:Customer"],externalId:x,displayName:x,active:!0};return{externalId:x,resourceType:"customer",create:b}}let I=Xt(k.subject);if(!I){let K=Et(k.subject);if(K&&r.userStore)I=await r.userStore.get(K)}let j=I?.externalId;if(!I||!j)return;return{externalId:j,resourceType:"user",create:await(r.mapUserToScim?.(I)??is(I))}},W=async(k)=>{let I=Xt(k.target);if(!I){let j=Et(k.target),K=d();if(j&&K)I=k.targetType==="role"?await K.roles.get(j):k.targetType==="permission"?await K.permissions.get(j):await K.groups.get(j)}if(I&&I.requestable!==!0)return"not-requestable";if(!I)return;return{externalId:I.id,create:hn(I,k.targetType)}},J=async(k,M)=>{if(!E())return"skipped";if(!T(k.subjectType==="workload"?"workload":k.subjectType==="customer"?"customer":"user"))return"skipped";let I=await ue(k),j=await W(k);if(j==="not-requestable")return"skipped";if(!I||!j)return e.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:M,hasSubject:Boolean(I),hasTarget:Boolean(j),targetType:k.targetType}),"skipped";let K=re();if(!K)return"skipped";return K.patchGroupMembership({groupExternalId:j.externalId,userExternalId:I.externalId,op:M,groupCreate:j.create,userCreate:I.create,memberType:te(k.subjectType),subjectResourceType:I.resourceType})},Y=async(k,M,I)=>{let j=[],K=new Set,h=(b)=>{let p=`${b.type??"User"}\x00${b.value}`;if(!K.has(p))K.add(p),j.push(b)},x=r.accessStore;if(x)for await(let b of Yt((p,f)=>x.listByTarget(M,k.id,{start:p,limit:f}))){let p=await ue(b);if(!p){e.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:k.id,targetType:M});continue}let f=await I.resolveProviderId(p.resourceType,p.externalId,p.create);if(f==="error")throw Error(`IAM delta failed to resolve access subject for ${M}:${k.id}`);if(f==="absent")continue;let R=b.metadata;h({value:f.found,type:te(b.subjectType),...R?.display?{display:R.display}:{}})}if(M==="group"){let b=d();for(let p of k.groups??[]){let f=Et(p),R=Xt(p);if(!R&&f)R=await b?.groups.get(f);if(R&&R.requestable!==!0)continue;if(!R){e.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:f,target:k.id});continue}let A=await I.resolveProviderId("group",R.id,hn(R,"group"));if(A==="error")throw Error(`IAM delta failed to resolve nested Group for group:${k.id}`);if(A!=="absent")h({value:A.found,type:"Group"})}}return j.length>0?j:void 0},ne=async(k)=>{if(!E()||!T("user"))return"skipped";let M=k.externalId;if(!M)return e.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:k.id,kind:"user"}),"skipped";let I=re();if(!I)return"skipped";let j=await(r.mapUserToScim?.(k)??is(k));return I.upsertResource("user",M,j)},se=async(k)=>{if(!E()||!T("workload"))return"skipped";let M=k.externalId??k.id;if(!M)return"skipped";let I=re();if(!I)return"skipped";let j=await(r.mapWorkloadToScim?.({...k,externalId:M})??as({...k,externalId:M}));return I.upsertResource("workload",M,j)},oe=async(k)=>{if(!E()||!T("customer"))return"skipped";let M=k.externalId??k.id;if(!M)return"skipped";let I=re();if(!I)return"skipped";let j=await(r.mapCustomerToScim?.({...k,externalId:M})??ss({...k,externalId:M}));return I.upsertResource("customer",M,j)},S=async(k,M,I=!0)=>{if(!E()||!m())return"skipped";let j=d(),h=(j?await Pr(j,M).get(k.id):void 0)??k;if(h.requestable!==!0)return"skipped";let x=re();if(!x)return"skipped";let b=await Y(h,M,x),p=await x.upsertResource("group",h.id,hn(h,M,b)),f=r.accessStore;if(p!=="pushed"||!I||!f)return p;for await(let R of Yt((A,V)=>f.listByTarget(M,k.id,{start:A,limit:V})))if(await J(R,"add")==="error")throw Error(`IAM delta failed to restore access for ${M}:${k.id}`);return p},L=(k,M)=>{if(k==="error")throw Error(`IAM delta: destination rejected ${M}`)},z=(k,M,I)=>{if(M==="pushed")k.pushed+=1;else if(M==="skipped")k.skipped+=1;else k.errors.push(`IAM delta: destination rejected ${I}`)},H={async onUserUpsert(k){L(await ne(k),"user upsert")},async onUserDelete(k){if(!E()||!T("user"))return;let M=re();if(!M)return;L(await M.deleteResource("user",k),"user delete")},async onWorkloadUpsert(k){L(await se(k),"workload upsert")},async onWorkloadDelete(k){if(!E()||!T("workload"))return;let M=re();if(!M)return;L(await M.deleteResource("workload",k),"workload delete")},async onCustomerUpsert(k){L(await oe(k),"customer upsert")},async onCustomerDelete(k){if(!E()||!T("customer"))return;let M=re();if(!M)return;L(await M.deleteResource("customer",k),"customer delete")},async onEntitlementUpsert(k,M){L(await S(k,M),`${M} upsert`)},async onEntitlementDelete(k,M){if(!E())return;let I=re();if(!I)return;L(await I.deleteResource("group",M),`${k} delete`)},async onGrant(k){if(!E())return;if(await J(k,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(k){if(!E())return;if(await J(k,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async requestAccess(k){let M=t.url,I=P();if(I!==void 0||M===void 0)throw Error(`Cannot submit an access request: ${I??"destination URL is not configured"}`);let j=await(r.fetchImpl??fetch)(`${Ic(M)}/AccessRequests`,{method:"POST",headers:{Authorization:`Bearer ${await v()}`,"Content-Type":"application/json"},body:JSON.stringify(k)});if(!j.ok)throw Error(`AccessRequests failed: ${j.status} ${await j.text()}`);return await j.json()},async reconcile(k){let M={pushed:0,skipped:0,errors:[]},I=O();if(I)return M.errors.push(`iam delta not ready: ${I}`),M;let j=async(K,h,x)=>{if(!K)return;for await(let b of K)try{z(M,await h(b),x(b))}catch(p){M.errors.push(p instanceof Error?p.message:String(p))}};return await j(k.groups,(K)=>S(K,"group",!1),(K)=>`group upsert for ${K.id}`),await j(k.roles,(K)=>S(K,"role",!1),(K)=>`role upsert for ${K.id}`),await j(k.permissions,(K)=>S(K,"permission",!1),(K)=>`permission upsert for ${K.id}`),await j(k.users,(K)=>ne(K),(K)=>`user upsert for ${K.id??"unknown"}`),await j(k.workloads,(K)=>se(K),(K)=>`workload upsert for ${K.id}`),await j(k.customers,(K)=>oe(K),(K)=>`customer upsert for ${K.id??"unknown"}`),await j(k.access,(K)=>J(K,"add"),(K)=>`membership push for ${Et(K.target)??"unknown"}`),M},async getDestinationRef(k,M){return ie.read(k,M)},isReady:E,ready:g.ready};return{update(k,M){t=k,r=M,re(),g.refresh();let I=O();if(!m())w=void 0;else if(I!==w){if(I)e.warn(`IAM delta configured but not ready: ${I}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:I});w=I}return H},handle(){return H}}}var vn=2,Ec=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"iam.workloads",module:"iam",label:"SCIM Workloads inbound",requires:"workloadIdentityStore",incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."},{key:"iam.customers",module:"iam",label:"SCIM Customers inbound",requires:"customerStore",incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."},{key:"tm.integration",module:"tm",label:"Tenant Management staged integration and consent",requires:"TenantStore integration methods + onConnectRequest",incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."}];import{IoniteError as Ac}from"@ionite/core";function _c(e){if(e instanceof Ac)return{status:e.status,statusText:e.statusText};if(typeof e!=="object"||e==null)return;let t=e,r=typeof t.status==="number"?t.status:void 0,n=typeof t.statusText==="string"?t.statusText:void 0;return r!=null||n?{status:r,statusText:n}:void 0}function At(e){if(e instanceof Response)return e;let t=_c(e);if(!t)return Response.json({error:"internal_error"},{status:500});let n={status:t.status??500};if(t.statusText)n.statusText=t.statusText;return Response.json({error:t.statusText??"internal_error"},n)}function me(){return Response.json({error:"not_found"},{status:404})}function Ge(e=["GET"]){return Response.json({error:"method_not_allowed",allow:e},{status:405,headers:{Allow:e.join(", ")}})}import{timingSafeEqual as Lc}from"node:crypto";import{parseKmsPoolDocument as xc,stableConfigHash as us}from"@ionite/core";function cs(e,t,r){for(let n of e)try{n()}catch(o){t.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:r,error:o instanceof Error?o.message:String(o)})}}function We(e,t){let r=new Set,n=new Set;return{beforeChange(o){return r.add(o),()=>{r.delete(o)}},afterChange(o){return n.add(o),()=>{n.delete(o)}},emitBefore(){cs(r,e,`${t} beforeChange`)},emitAfter(){cs(n,e,`${t} afterChange`)}}}var Uc=604800000,Mc=2147483647,jc=1;function ps(e,t){if(!e.value)return!1;if(e.notBefore&&Date.parse(e.notBefore)>t)return!1;if(e.notAfter&&Date.parse(e.notAfter)<=t)return!1;return!0}function Le(e,t,r=Date.now()){if(!e)return;let n=e.slots?.[t];if(!n)return;let o=e.keys.find((s)=>s.id===n&&s.state==="active");return o&&ps(o,r)?o:void 0}function Sn(e,t=Date.now()){if(!e)return[];return e.keys.filter((r)=>(r.state==="active"||r.state==="deprecated")&&ps(r,t))}function ds(e){return{...e,...e.meta?{meta:{...e.meta}}:{}}}function Ir(e,t,r){if(!t||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>o(Error(r)),t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function ls(e,t){let r=Buffer.from(e),n=Buffer.from(t);return r.length===n.length&&Lc(r,n)}function Wc(e){if(!Number.isInteger(e)||e<1)throw Error("KMS unique() requires a positive integer slot count.");return e}var $c=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function qc(e){return $c.has(e)}function fs(e){let t=e.trim().replace(/\/+$/,"");if(!t||t==="/")return"/";return t.startsWith("/")?t:`/${t}`}function Nc(e,t){let r=fs(e),n=fs(t);return r===n||r.endsWith(n)}function Kc(e,t,r){let n=We(t,`KMS pool "${e}"`),o=new Set,s=!1,i,a,c=0,u,l,w=jc,m,T,P=new Map,O=new Set,E,g=()=>i!==void 0&&i.slots===void 0&&i.keys.length>0,v=ge(`KMS pool "${e}"`,()=>{if(!s)return!1;if(g())return Sn(i).length>0;return Le(i,0)!==void 0}),d=ge(`KMS pool "${e}" issuer`,()=>s&&m!==void 0),C=(b)=>b===0?`KMS pool "${e}"`:`KMS pool "${e}" slot ${b}`,_=(b)=>{let p=P.get(b),f=p?.valueWaiter;if(!p||!f)return;if(!s){p.valueWaiter=void 0,f.reject(Error(`${C(b)} is no longer configured.`));return}if(g()){p.valueWaiter=void 0,f.reject(Error(`${C(b)} verifier grant has no slots.`));return}let R=Le(i,b);if(R?.value)p.valueWaiter=void 0,f.resolve(R.value)},N=()=>{for(let b of P.keys())_(b)},B=(b)=>{let p=P.get(b);if(!p)return;let f=Le(i,b);for(let R of p.listeners)try{R(f?ds(f):void 0)}catch(A){t.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:e,slot:b,error:A instanceof Error?A.message:String(A)})}},ee=()=>{for(let b of P.keys())B(b)},ie=()=>{for(let b of P.values())b.latch.refresh();v.refresh(),d.refresh()},re=()=>{try{E?.()}catch(b){t.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:e,error:b instanceof Error?b.message:String(b)})}E=void 0},te=()=>{if(E||O.size===0||!m?.subscribeEvents||!T)return;let b=T;E=m.subscribeEvents((p)=>{if(!qc(p.event)||!Nc(p.path,b))return;let f={path:p.path,event:p.event,...p.requestId===void 0?{}:{requestId:p.requestId},...p.keyId===void 0?{}:{keyId:p.keyId}};for(let R of O)try{R(f)}catch(A){t.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:e,error:A instanceof Error?A.message:String(A)})}})},ue=()=>{if(l)clearTimeout(l);l=void 0},W=()=>{ue();let b=Date.now();if(i){for(let f of i.keys){if(!f.notAfter)continue;let R=Date.parse(f.notAfter)-b;if(R>0&&R<=Uc&&(f.state==="active"||f.state==="deprecated")&&!o.has(f.id))o.add(f.id),t.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:e,keyId:f.id,notAfter:f.notAfter})}let p=i.keys.flatMap((f)=>[f.notBefore,f.notAfter]).filter((f)=>Boolean(f)).map((f)=>Date.parse(f)).filter((f)=>f>b).sort((f,R)=>f-R);if(p[0])l=setTimeout(()=>{let f=new Map([...P.keys()].map((R)=>[R,Le(i,R)?.id]));ie(),r();for(let R of P.keys())if(f.get(R)!==Le(i,R)?.id)B(R);W()},Math.min(p[0]-b+1,Mc))}ie(),r(),N()},J=(b)=>{let p=new Map([...P.keys()].map((f)=>{let R=Le(i,f);return[f,{id:R?.id,value:R?.value}]}));n.emitBefore();try{i=xc(b),W();for(let f of P.keys()){let R=Le(i,f),A=p.get(f);if(A?.id!==R?.id||A?.value!==R?.value)B(f)}}catch(f){i=void 0,W(),ee(),t.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:e,error:f instanceof Error?f.message:String(f)})}finally{n.emitAfter()}},Y=()=>{try{u?.()}catch(b){t.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:e,error:b instanceof Error?b.message:String(b)})}u=void 0},ne=(b,p)=>{m=b,T=p,c+=1;let f=c;Y(),b.subscribe(p,(R)=>{if(c!==f||!s)return;J(R.data)},{kmsSlots:w}).then((R)=>{if(c!==f||!s){R();return}u=R}).catch((R)=>{if(c!==f||!s)return;i=void 0,W(),ee(),t.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:e,path:p,error:R instanceof Error?R.message:String(R)})})},se=(b,p)=>{let f=S(b),R=Le(i,b);if(!s)return Promise.reject(Error(`${C(b)} is no longer configured.`));if(g())return Promise.reject(Error(`${C(b)} verifier grant has no slots.`));if(R?.value)return Promise.resolve(R.value);if(!f.valueWaiter){let V,X,F=new Promise((ae,Q)=>{V=ae,X=Q});f.valueWaiter={promise:F,resolve:V,reject:X}}let A=f.valueWaiter.promise;return _(b),Ir(A,p,`${C(b)} was not ready within ${p}ms.`)},oe=(b,p)=>{let f=S(b);f.listeners.add(p);let R=Le(i,b);return p(R?ds(R):void 0),()=>f.listeners.delete(p)};function S(b){let p=P.get(b);if(p)return p;let f=ge(C(b),()=>s&&Le(i,b)!==void 0),R={listeners:new Set,latch:f,api:{value:(A)=>se(b,A),current:()=>Le(i,b)?.value,subscribe:(A)=>oe(b,A),park:(A,V)=>H(A,V),isReady:f.isReady,ready:f.ready}};return P.set(b,R),R}let L=(b)=>{if(g())throw Error(`KMS pool "${e}" verifier grant has no slots.`);let p=Wc(b),f=p>w;w=Math.max(w,p);let R=[];for(let A=0;A<p;A+=1)R.push(S(A).api);if(f&&s&&m&&T)ne(m,T);return R},z=(b)=>Sn(i).find((p)=>p.value!==void 0&&ls(b,p.value)),H=(b,p)=>{if(!s||!m||!T)return Promise.reject(Error(`KMS pool "${e}" is not configured.`));if(typeof b.value!=="string"||b.value.length===0)return Promise.reject(Error(`KMS pool "${e}" park() requires a non-empty value.`));let f=z(b.value);if(!f)return Promise.resolve({parked:!1,stale:!0});return Ir(m.parkKmsKey(T,{keyId:f.id,status:b.status,reason:b.reason},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" park() did not complete within ${p}ms.`)},k=()=>{if(!s||!m||!T)throw Error(`KMS pool "${e}" is not configured.`);return{source:m,path:T}},M=(b)=>{if(!Array.isArray(b)||b.length===0)throw Error(`KMS pool "${e}" addKeys() requires a non-empty keys array.`);return b.map((p,f)=>{if(!p||typeof p!=="object")throw Error(`KMS pool "${e}" addKeys() keys[${f}] must be an object.`);if(typeof p.value!=="string"||p.value.length===0)throw Error(`KMS pool "${e}" addKeys() keys[${f}].value must be a non-empty string.`);if(p.id!==void 0&&(typeof p.id!=="string"||p.id.length===0))throw Error(`KMS pool "${e}" addKeys() keys[${f}].id must be a non-empty string when present.`);return p})},I=(b,p)=>{try{let{source:f,path:R}=k(),A=M(b);return Ir(f.addKmsKeys(R,{keys:A},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" addKeys() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},j=(b,p)=>{try{let{source:f,path:R}=k();if(typeof b.keyId!=="string"||b.keyId.length===0)throw Error(`KMS pool "${e}" revokeKey() requires a non-empty keyId.`);return Ir(f.revokeKmsKey(R,b,p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" revokeKey() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},K=(b)=>{let{source:p}=k();if(!p.subscribeEvents)throw Error(`KMS pool "${e}" events are not supported by this secrets transport.`);return O.add(b),te(),()=>{O.delete(b)}};S(0);let h={value:(b)=>se(0,b),current:()=>Le(i,0)?.value,unique:L,accepts:(b)=>Sn(i).some((p)=>p.value!==void 0&&ls(b,p.value)),park:H,subscribe:(b)=>oe(0,b),beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:v.isReady,ready:v.ready},x={addKeys:I,revokeKey:j,events:K,isReady:d.isReady,ready:d.ready};return{api:h,issuer:x,update(b,p,f){let R=us({config:b,path:f});if(s=!0,a===R){ie();return}a=R,Y(),re(),ue(),i=void 0,ie(),r(),ee(),N(),ne(p,f),te()},unavailable(b){s=!0,a=us(b),c+=1,m=void 0,T=void 0,re(),Y(),ue(),i=void 0,ie(),r(),ee(),N()},remove(){if(!s)return;n.emitBefore(),s=!1,a=void 0,c+=1,m=void 0,T=void 0,re(),Y(),ue(),i=void 0,ie(),r(),ee(),N(),n.emitAfter()},close(){s=!1,c+=1,m=void 0,T=void 0,re(),O.clear(),Y(),ue();for(let b of P.values())b.listeners.clear();i=void 0,N();for(let b of P.values())b.latch.settle();v.settle(),d.settle()},isConfigured:()=>s}}function ms(e){let t=new Map,r=new Map,n=We(e,"KMS"),o=!1,i=ge("KMS module",()=>o&&Array.from(t.values()).every((m)=>!m.isConfigured()||m.api.isReady())),a,c=()=>i.refresh(),u=(m)=>{let T=t.get(m);if(T)return T;let P=Kc(m,e,c);if(t.set(m,P),!(m in a))Object.assign(a,{[m]:P.api});return P},l=(m)=>{let T=t.get(m);if(!T)throw Error(`KMS pool "${m}" is not configured.`);return T.api},w=(m)=>{let T=t.get(m);if(!T)throw Error(`KMS pool "${m}" is not configured.`);return T.issuer};return a={get config(){return Object.fromEntries(r)},beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:i.isReady,ready:i.ready,listPools:()=>Array.from(r.keys()),getPool:l,issuer:w},{handle:()=>a,update(m,T){if(!m&&!o&&t.size===0)return;n.emitBefore(),o=m!==void 0;let P=new Set(Object.keys(m??{}));for(let[O,E]of Object.entries(m??{})){r.set(O,{...E});let g=E.path??`/kms/${O}`;try{u(O).update(E,T(E),g)}catch(v){u(O).unavailable(E),e.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:O,error:v instanceof Error?v.message:String(v)})}}for(let[O,E]of t){if(P.has(O))continue;r.delete(O),E.remove()}return i.refresh(),n.emitAfter(),o||t.size>0?a:void 0},close(){for(let m of t.values())m.close();t.clear(),r.clear(),o=!1,i.settle()}}}import{formatLogLine as Vc}from"@ionite/core";import{context as Fc,trace as Dc}from"@opentelemetry/api";import{logs as zc,SeverityNumber as Ke}from"@opentelemetry/api-logs";import{OTLPLogExporter as Bc}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as Gc}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as Hc}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as Jc}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as Yc}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as Xc}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as Zc}from"@opentelemetry/resources";import{BatchLogRecordProcessor as Qc}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as eu}from"@opentelemetry/sdk-metrics";import{NodeSDK as tu}from"@opentelemetry/sdk-node";var gs={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},ru={trace:!1,debug:!1,info:!0,warn:!0,error:!0},nu={trace:Ke.TRACE,debug:Ke.DEBUG,info:Ke.INFO,warn:Ke.WARN,error:Ke.ERROR};function kn(e,t){let r=t[e];if(r===!1)return!1;if(e==="metrics")return r===!0||typeof r==="object";return!0}function Rn(e){return typeof e==="object"&&e!==null?e:void 0}function ou(e){return typeof e==="object"&&e!==null?e:void 0}function su(e,t){let r=e.replace(/\/+$/,"");if(r.endsWith(gs[t]))return r;return`${r}${gs[t]}`}function iu(e,t){let r=Rn(e[t]);if(r?.endpoint)return r.endpoint;if(!e.endpoint)return;return su(e.endpoint,t)}function au(e,t,r){let n=Rn(e[t]),o={...e.headers,...n?.headers??{}};if(r)o.Authorization=`Bearer ${r}`;return o}function Cn(e,t,r){let n=Rn(e[t]);return{url:iu(e,t),headers:au(e,t,r),timeoutMillis:n?.timeoutMillis,concurrencyLimit:n?.concurrencyLimit}}function cu(e,t){let r=Cn(e,"traces",t);return e.protocol==="http/json"?new Yc(r):new Xc(r)}function uu(e,t){let r=Cn(e,"metrics",t);return e.protocol==="http/json"?new Hc(r):new Jc(r)}function du(e,t){let r=Cn(e,"logs",t);return e.protocol==="http/json"?new Bc(r):new Gc(r)}function lu(e){return{"service.name":e.name,...e.version?{"service.version":e.version}:{},...e.deploymentEnvironment?{"deployment.environment.name":e.deploymentEnvironment}:{},...e.resourceAttributes??{}}}async function fu(e){if(!e.oauth)return;let t=new URLSearchParams({grant_type:"client_credentials",client_id:e.oauth.clientId,client_secret:e.oauth.clientSecret});if(e.oauth.scope)t.set("scope",e.oauth.scope);if(e.oauth.audience)t.set("audience",e.oauth.audience);let r=await fetch(e.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...e.oauth.headers??{}},body:t});if(!r.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${r.status}`);let n=await r.json();if(typeof n.access_token!=="string"||!n.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return n.access_token}function pu(e,t){return{...ru,...t?.levels??{},...e.levels??{}}}function Zt(e,t="Authorization"){let r={...e.headers??{}};if(!e.apiKey)return r;let n=e.apiKeyHeader??t;return r[n]=n.toLowerCase()==="authorization"?`Bearer ${e.apiKey}`:e.apiKey,r}function mu(e,t){return Object.keys(e).some((r)=>r.toLowerCase()===t.toLowerCase())}function ws(e,t,r){let n=Object.keys(e).find((o)=>o.toLowerCase().startsWith(t.toLowerCase()));if(n)throw Error(`OpenTelemetry provider "${r}" does not support provider-specific header "${n}".`)}function Qt(e,t,r,n){return{type:r,name:e.name,version:e.version,protocol:e.protocol??"http/protobuf",endpoint:e.endpoint,headers:n,resourceAttributes:lu(e),levels:pu(e,t),console:e.console??"info",traces:e.traces,metrics:e.metrics,logs:e.logs}}function gu(e,t){return Qt(e,t,"otlp",Zt(e))}function yu(e,t){return Qt(e,t,"grafana-lgtm",Zt(e))}function hu(e,t){let r=Zt(e,"DD-API-KEY");if(!mu(r,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return Qt(e,t,"datadog",r)}function wu(e,t){let r=Zt(e);return ws(r,"DD-","splunk"),Qt(e,t,"splunk",r)}function vu(e,t){let r=Zt(e);return ws(r,"DD-","elastic"),Qt(e,t,"elastic",r)}function Su(e,t){let r=e.type??"otlp";switch(r){case"otlp":return gu(e,t);case"grafana-lgtm":return yu(e,t);case"datadog":return hu(e,t);case"splunk":return wu(e,t);case"elastic":return vu(e,t);default:throw Error(`Unsupported OpenTelemetry provider type: ${r}`)}}function ku(e,t){if(typeof e==="string")return e;if(e instanceof Error)return e.message;if(e!=null)return bn(e);if(t.length===0)return"";return bn(t[0])}function bn(e){if(typeof e==="string")return e;try{return JSON.stringify(e)}catch{return String(e)}}function ys(e,t,r){if(r==null)return;if(typeof r==="string"||typeof r==="number"||typeof r==="boolean"){e[t]=r;return}if(Array.isArray(r)&&r.every((n)=>["string","number","boolean"].includes(typeof n))){e[t]=r;return}if(r instanceof Error){if(e[`${t}.name`]=r.name,e[`${t}.message`]=r.message,r.stack)e[`${t}.stack`]=r.stack;return}e[t]=bn(r)}function bu(e){let t={};for(let[n,o]of e.entries()){if(o&&typeof o==="object"&&!Array.isArray(o)&&!(o instanceof Error)&&Object.getPrototypeOf(o)===Object.prototype){for(let[s,i]of Object.entries(o))ys(t,s,i);continue}ys(t,`param.${n}`,o)}let r=Dc.getSpanContext(Fc.active());if(r)t.trace_id=r.traceId,t.span_id=r.spanId,t.trace_flags=r.traceFlags;return t}function Ru(e){return e}function Cu(e,t){globalThis.console[Ru(e)](Vc(e,t.body,[t.attributes??{}]))}function Tu(e,t,r,n){if(r.console==="off")return;if((t.severityNumber??0)<nu[r.console])return;let o=n?.console;if(o){o(t);return}Cu(e,t)}function Pu(e,t){let r=zc.getLogger(e.name,e.version),n=(o,s,i)=>{if(!e.levels[o])return;let a={severityNumber:s,severityText:o.toUpperCase(),body:ku(i[0],i.slice(1)),attributes:bu(i.slice(1))};try{r.emit(a)}finally{Tu(o,a,e,t)}};return{trace:(o,...s)=>n("trace",Ke.TRACE,[o,...s]),debug:(o,...s)=>n("debug",Ke.DEBUG,[o,...s]),info:(o,...s)=>n("info",Ke.INFO,[o,...s]),warn:(o,...s)=>n("warn",Ke.WARN,[o,...s]),error:(o,...s)=>n("error",Ke.ERROR,[o,...s])}}function Iu(e){return e?.current()}function Ou(e,t,r){let n=t;return e.subscribe((o)=>{let s=o?.value;if(s===n)return;n=s,r()})}function hs(e){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:e,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function Tn(e,t,r,n){if(!t&&!r)return;if(!t)return hs(e);let o=t,s;if(o.apiKeyPool&&n)try{s=n.getPool(o.apiKeyPool)}catch{s=void 0}let i=Iu(s),a=()=>Tn(e,o,r,n),c=o.apiKeyPool&&n?(v)=>Ou(n.getPool(o.apiKeyPool),i,v):void 0;if(o.apiKeyPool&&!i){let v=hs(e);return v.onCredentialChange=c,v.rebuild=a,v}let u=i?{...o,apiKey:i}:o,l=Su(u,r),w,m=!1,T=Pu(l,r),P,O,E=new Promise((v,d)=>{P=v,O=d});async function g(){try{let v=await fu(o),d={resource:Zc(l.resourceAttributes),instrumentations:r?.instrument};if(r?.sampler)d.sampler=r.sampler;if(r?.textMapPropagator)d.textMapPropagator=r.textMapPropagator;if(r?.contextManager)d.contextManager=r.contextManager;if(r?.spanProcessors)d.spanProcessors=r.spanProcessors;else if(kn("traces",l))d.traceExporter=cu(l,v);if(r?.metricReaders)d.metricReaders=r.metricReaders;else if(kn("metrics",l)){let _=ou(l.metrics);d.metricReaders=[new eu({exporter:uu(l,v),exportIntervalMillis:_?.exportIntervalMillis,exportTimeoutMillis:_?.exportTimeoutMillis})]}if(r?.logRecordProcessors)d.logRecordProcessors=r.logRecordProcessors;else if(kn("logs",l))d.logRecordProcessors=[new Qc({exporter:du(l,v)})];let C=r?.configure?.(d);w=new tu(C??d),w.start(),m=!0,P?.()}catch(v){m=!1;let d=v instanceof Error?v:Error(String(v));e.error?.("OpenTelemetry startup failed",d),O?.(d)}finally{P=void 0,O=void 0}}return{state:"available",start:g,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>m,ready:(v)=>{if(!v||v<=0)return E;return Promise.race([E,new Promise((d,C)=>{setTimeout(()=>C(Error(`OpenTelemetry ready timed out after ${v}ms.`)),v)})])},logger:T,forceFlush:async()=>{await w?.forceFlush?.()},shutdown:async()=>{m=!1,await w?.shutdown(),w=void 0},onCredentialChange:c,rebuild:a}}function vs(e){let t,r,n,o=0,s=Promise.resolve(),i=We(e,"OpenTelemetry"),a=ge("OpenTelemetry module",()=>t?.isReady()===!0),c={beforeChange:i.beforeChange,afterChange:i.afterChange,isReady:a.isReady,ready:a.ready,logger:{trace:(w,...m)=>(t?.logger??e).trace(w,...m),debug:(w,...m)=>(t?.logger??e).debug(w,...m),info:(w,...m)=>(t?.logger??e).info(w,...m),warn:(w,...m)=>(t?.logger??e).warn(w,...m),error:(w,...m)=>(t?.logger??e).error(w,...m)},forceFlush:async()=>{await t?.forceFlush()},shutdown:async()=>{await t?.shutdown()}},u=!1,l;return l={update(w){if(!w){if(t||r){let O=t,E=r;o+=1,i.emitBefore(),n?.(),n=void 0,t=void 0,r=void 0,a.refresh(),s=Promise.all([O?.shutdown(),E?.shutdown()]).finally(()=>i.emitAfter()).then(()=>{return},()=>{return})}return u?c:void 0}if(u=!0,w===t||w===r)return c;let m=t,T=r;o+=1;let P=o;return i.emitBefore(),n?.(),n=void 0,t=void 0,r=w,a.refresh(),s=(async()=>{try{if(await Promise.all([m?.shutdown(),T?.shutdown()]),await w.start(),P!==o||r!==w){await w.shutdown();return}t=w,r=void 0,a.refresh(),n=w.onCredentialChange?.(()=>{if(t!==w)return;let O=w.rebuild?.();if(O)l.update(O)})}finally{if(P===o)i.emitAfter()}})().then(()=>{return},()=>{return}),c},settled(){return s},async shutdown(){o+=1;let w=t,m=r;n?.(),n=void 0,t=void 0,r=void 0,a.settle(),await Promise.all([w?.shutdown(),m?.shutdown()])}},l}import{ION_ENDPOINT_PERMISSIONS as _t,trimTrailingSlash as Ss}from"@ionite/core";import{hasPermission as Eu}from"@ionite/core/server";async function er(e,t,r){let n=await Eu(e,t,r.permission,void 0,r.subjectType);return n.allow?void 0:n.response()}function Au(e){let t=Ss(e);return{matchesPath:(o)=>{if(!o)return!1;return Ss(o)===t},startsWithPath:(o)=>{if(!o)return!1;return e===o||e.startsWith(`${o}/`)}}}function ks(e,t,r,n){let o=n??new URL(e.url).pathname,{matchesPath:s,startsWithPath:i}=Au(o);if(t.sso){let a=t.sso;if(s(r.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(c)=>a.handler(c)};if(s(r.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(c)=>a.logout(c)};if(s(r.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(c)=>a.logoutBackChannel(c)};if(s(r.sso.loginUrl)||s(r.sso.refreshUrl)||s(r.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(c)=>a.handler(c)}}if(t.ciam){let a=t.ciam;if(s(r.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(c)=>{let u=await a.resolveCustomer(c);if(u.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(u.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(u.value),{headers:{"Content-Type":"application/json"}})}};if(s(r.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(c)=>a.logout(c)}}if(t.iam){let a=t.iam,c=e.method!=="GET"&&e.method!=="HEAD";if(i(r.iam.usersUrl))return{module:"iam",kind:c?"iam.users.write":"iam.read",requiredPermission:_t[c?"iam.users.write":"iam.read"],handler:async(u)=>a.handler(u)};if(i(r.iam.groupsUrl))return{module:"iam",kind:c?"iam.groups.write":"iam.read",requiredPermission:_t[c?"iam.groups.write":"iam.read"],handler:async(u)=>a.handler(u)};if(i(r.iam.workloadsUrl))return{module:"iam",kind:c?"iam.workloads.write":"iam.read",requiredPermission:_t[c?"iam.workloads.write":"iam.read"],handler:async(u)=>a.handler(u)};if(i(r.iam.customersUrl))return{module:"iam",kind:c?"iam.customers.write":"iam.read",requiredPermission:_t[c?"iam.customers.write":"iam.read"],handler:async(u)=>a.handler(u)};if(i(`${r.iam.basePath}/AccessRequests`))return{module:"iam",kind:"iam.access-requests.write",requiredPermission:_t["iam.access-requests.write"],handler:async(u)=>a.handler(u)};if(i(r.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(u)=>a.handler(u)}}if(t.workload){let a=t.workload;if(s(r.workload.validateUrl)||s(r.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(c)=>a.handler(c)}}if(t.secrets){let a=t.secrets;if(a.isLfvDeliveryRequest?.(e)&&a.handleLfvDelivery){let c=a.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(u)=>c(u)}}if(a.isLfvEventsRequest?.(e)&&a.handleLfvEvents){let c=a.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(u)=>c(u)}}}if(t.ciam){let a=t.ciam;if(s(r.ciam.magicLinkUrl)&&e.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:_t["ciam.magic-link.create"],handler:async(c)=>a.handler(c)};if(s(r.ciam.magicLinkLoginUrl)&&e.method==="GET"||s(r.ciam.customerProvidersUrl)&&e.method==="GET"||s(r.ciam.customerLoginUrl)&&e.method==="GET"||s(r.ciam.customerCallbackUrl)&&(e.method==="GET"||e.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(c)=>a.handler(c)}}return}async function Pn(e,t,r,n){let o=n??De(pr()),s=new URL(e.url).pathname;if(r?.filter){let w=await r.filter(e,t);if(w instanceof Response)return w;if(w==="not_handled")return me()}let i=ks(e,t,o,s),c=await r?.resolve?.(e,t,i)??i;if(!c)return me();let u=c.requiredPermission===void 0?i?.requiredPermission:c.requiredPermission,l=async()=>{if(u){let w=await er(e,t,u);if(w)return w}return c.handler(e)};if(r?.wrap)return await r.wrap(e,c,l,t);return await l()}import{stableConfigHash as Xu}from"@ionite/core";function Or(){let e=0;return{next:()=>(e+=1,e),isCurrent:(t)=>t===e,current:()=>e}}import{readFile as Bu,stat as Gu}from"node:fs/promises";class Lt extends Error{constructor(e,t,r){super(e);this.code=t;this.status=r;this.sourceType="vault";this.name="VaultWebSocketCommandError"}}class He extends Error{constructor(e,t=`Vault secret not found at path ${e}`){super(t);this.path=e;this.sourceType="vault";this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}}class ye extends Error{constructor(e,t,r,n,o){super(e,o);this.path=t;this.status=r;this.code=n;this.sourceType="vault";this.name="VaultRequestError"}}class xe extends Error{constructor(e,t,r=`Vault subscribe is not supported for source ${e} at path ${t} without websocket, LFV, or ttl`){super(r);this.sourceType=e;this.path=t;this.name="VaultSubscribeNotSupportedError"}}function bs(e){return e instanceof He||e instanceof Lt&&(e.code==="not_found"||e.status===404)}import{WebSocket as tr}from"ws";var _u=1000,Lu=30000,Cs=30000,Ts=Cs;function Ps(e){Ts=e>0?e:Cs}function Is(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function xu(e){let t=Math.min(Lu,_u*2**Math.min(e,16)),r=0.5+Math.random()*0.5;return Math.round(t*r)}var gt=new Map;function Uu(e){return e.trim().replace(/\/+$/g,"")}function Os(e,t){let r=typeof t?.version==="number"?t.version:0,n=t?.created_time??t?.created,o=typeof n==="string"?new Date(n):new Date,s=lt(t);return{path:e,version:r,created:o,...s?{contentType:s}:{}}}function Mu(e){return typeof e?.version==="number"?e.version:void 0}function ju(e){let t=e.token?.trim();if(!t)return{};if(e.header==="Authorization")return{Authorization:t.startsWith("Bearer ")?t:`Bearer ${t}`};return{"X-Vault-Token":t}}function rr(e){return{client_id:e.clientId,token:e.token,header:e.header??"X-Vault-Token"}}function On(e,t){let r=Uu(e),n=gt.get(r);if(n){if(t&&!n.log)n.log=t;return n}let o={url:r,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:t};return gt.set(r,o),o}function Wu(e){let t=[...Array.from(e.subs.values(),(o)=>o.creds),...e.eventListeners.values()];if(t.length===0)return e.lastGoodCreds??{url:e.url};let r=e.lastGoodCreds?[e.lastGoodCreds,...t]:t,n=r[e.reconnectCredCursor%r.length]??t[0];return e.reconnectCredCursor+=1,n}function Rs(e,t){for(let r of e.subs.values())try{r.onHealth?.(t)}catch(n){e.log?.warn("Vault websocket health hook threw",n)}}function $u(e,t){for(let r of Array.from(e.subs.values())){let n=r.onFirstSecretReject;if(r.onFirstSecret=void 0,r.onFirstSecretReject=void 0,n)try{n(new ye(`Vault websocket subscription interrupted (${t})`,r.path,void 0,"connection"))}catch(o){e.log?.warn("Vault websocket first-secret waiter rejection threw",o)}}}function Es(e,t){for(let r of e.pending.values())clearTimeout(r.timer),r.reject(new ye(`Vault websocket command interrupted (${t})`,"/",void 0,"connection"));e.pending.clear()}function Er(e){if(e.disposed)return;if(e.disposed=!0,e.reconnectTimer)clearTimeout(e.reconnectTimer),e.reconnectTimer=void 0;Es(e,"closed"),$u(e,"socket disposed");let t=e.ws;if(e.ws=void 0,e.connectPromise=void 0,e.hasConnected=!1,gt.delete(e.url),t)try{t.removeAllListeners(),t.close()}catch{}}function Ar(e){if(e.subs.size>0||e.pending.size>0||e.eventListeners.size>0)return;Er(e)}function In(e){return`${e.clientId??""}|${e.token??""}|${e.header??"X-Vault-Token"}`}function As(e){let t=new Map;for(let r of e.eventListeners.values())t.set(In(r),r);return Array.from(t.values())}function qu(e,t){if(typeof t.path!=="string"||typeof t.event!=="string")return;let r={path:t.path,event:t.event,...typeof t.request_id==="string"?{requestId:t.request_id}:{},...typeof t.key_id==="string"&&t.key_id.length>0?{keyId:t.key_id}:{}};for(let n of e.eventListeners.keys())try{n(r)}catch(o){e.log?.warn("Vault websocket event listener threw",o)}}function _s(e,t,r,n){if(n!==void 0&&t.lastVersion!==void 0&&n===t.lastVersion)return;if(n!==void 0)t.lastVersion=n;try{t.onChange(r)}catch(s){e.log?.warn("Vault websocket subscription onChange threw",s)}let o=t.onFirstSecret;if(t.onFirstSecret=void 0,t.onFirstSecretReject=void 0,o)try{o()}catch(s){e.log?.warn("Vault websocket subscription onFirstSecret threw",s)}}function Nu(e,t){let r=t.subscription_id;if(typeof r!=="string")return;let n=e.subs.get(r);if(!n)return;let o={data:t.data,metadata:Os(typeof t.path==="string"?t.path:n.path,t.metadata)};_s(e,n,o,Mu(t.metadata))}function Ku(e,t){let r;try{r=JSON.parse(t.toString())}catch(n){e.log?.warn("Vault websocket message parse failed",n);return}if(r.type==="secret"){Nu(e,r);return}if(r.type==="event"){qu(e,r);return}if(r.type==="command_result"&&typeof r.id==="string"){let n=e.pending.get(r.id);if(!n)return;if(e.pending.delete(r.id),clearTimeout(n.timer),r.ok===!1)n.reject(new Lt(r.error??`Vault websocket command failed for ${r.id}`,r.code,r.status));else n.resolve(r.result);Ar(e)}}function Ls(e,t){e.send(JSON.stringify({type:"subscribe",subscription_id:t.subscriptionId,paths:[t.path],...Is(t.kmsSlots),...rr(t.creds)}))}function En(e){if(e.disposed||e.reconnectTimer||e.subs.size===0&&e.eventListeners.size===0)return;let t=xu(e.reconnectAttempts);e.reconnectAttempts+=1,e.reconnectTimer=setTimeout(()=>{if(e.reconnectTimer=void 0,e.disposed)return;if(e.subs.size===0&&e.eventListeners.size===0){Er(e);return}_r(e,Wu(e)).catch(()=>{if(e.hasConnected)e.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${t}ms).`);En(e)})},t)}function _r(e,t){if(e.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if(e.ws&&e.ws.readyState===tr.OPEN)return Promise.resolve(e.ws);if(e.connectPromise)return e.connectPromise;return e.connectPromise=new Promise((r,n)=>{let o=new tr(e.url,{headers:ju(t)}),s=!1,i=e.hasConnected,a=()=>{s=!0,e.hasConnected=!0,e.reconnectAttempts=0,e.reconnectCredCursor=0,e.lastGoodCreds=t,e.ws=o,e.connectPromise=void 0,o.on("message",(l)=>Ku(e,l));for(let l of e.subs.values())try{Ls(o,l)}catch{}for(let l of As(e))try{o.send(JSON.stringify({type:"subscribe_events",...rr(l)}))}catch{}if(i)Rs(e,!0);r(o)},c=()=>{if(e.ws===o)e.ws=void 0;e.connectPromise=void 0;try{o.removeAllListeners()}catch{}if(Es(e,"socket closed"),e.subs.size>0||e.eventListeners.size>0)Rs(e,!1),En(e);else Er(e)},u=(l)=>{if(e.ws===o)e.ws=void 0;if(!s)s=!0,e.connectPromise=void 0,n(l)};o.once("open",a),o.on("close",c),o.on("error",u)}),e.connectPromise}async function An(e,t,r,n){let o=On(e.url,n),s=typeof r.path==="string"?r.path:"/",i=await _r(o,e),a=crypto.randomUUID();try{return await new Promise((c,u)=>{let l=setTimeout(()=>{if(!o.pending.has(a))return;o.pending.delete(a),u(new ye(`Vault websocket command "${t}" timed out`,s,void 0,"timeout"));try{o.ws?.close()}catch{}},Ts);o.pending.set(a,{resolve:(w)=>c(w),reject:u,timer:l});try{i.send(JSON.stringify({type:"command",id:a,command:t,...r,...rr(e)}))}catch(w){clearTimeout(l),o.pending.delete(a),u(w)}})}finally{Ar(o)}}async function _n(e,t,r,n){let o;try{o=await An(e,"read_secret",{path:t,...Is(n)},r)}catch(s){if(bs(s))throw new He(t);if(s instanceof Lt||s instanceof ye)throw s;throw new ye(`Vault websocket read_secret failed for ${t}`,t,void 0,"connection",{cause:s})}if(!o||typeof o!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${t}`);return{data:o.data,metadata:Os(typeof o.path==="string"?o.path:t,o.metadata)}}async function xs(e,t,r,n,o,s){let i=On(e.url,o),a=crypto.randomUUID(),c={subscriptionId:a,creds:e,path:t,...n?.kmsSlots!==void 0?{kmsSlots:n.kmsSlots}:{},onChange:r,onHealth:s?.onHealth};i.subs.set(a,c);let u=()=>{if(!i.subs.delete(a))return;if(i.ws&&i.ws.readyState===tr.OPEN)try{i.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:a}))}catch{}Ar(i)};try{let l=await _r(i,e);Ls(l,c)}catch(l){if(n?.mode!=="wait")throw u(),l}try{let l=await _n(e,t,o,n?.kmsSlots);_s(i,c,l,l.metadata.version)}catch(l){if(n?.mode!=="wait")throw u(),l;await new Promise((w,m)=>{let T,P=(O)=>{if(T)clearTimeout(T);c.onFirstSecret=void 0,c.onFirstSecretReject=void 0,u(),m(O)};if(c.onFirstSecret=()=>{if(T)clearTimeout(T);w()},c.onFirstSecretReject=P,typeof n.timeout==="number"&&n.timeout>0)T=setTimeout(()=>P(l),n.timeout)})}return u}async function Us(e,t,r){let n=On(e.url,r);n.eventListeners.set(t,e);try{let o=await _r(n,e);if(o.readyState===tr.OPEN)o.send(JSON.stringify({type:"subscribe_events",...rr(e)}))}catch(o){n.log?.warn("Vault websocket event subscription connect failed; retrying in background",o),En(n)}return()=>{if(!n.eventListeners.delete(t))return;let o=In(e);if(!As(n).some((i)=>In(i)===o)&&n.ws&&n.ws.readyState===tr.OPEN)try{n.ws.send(JSON.stringify({type:"unsubscribe_events",...rr(e)}))}catch{}Ar(n)}}function Ms(){let e=0;for(let t of gt.values())e+=t.subs.size;return{urls:Array.from(gt.keys()),sockets:gt.size,subscriptions:e}}function js(){for(let e of Array.from(gt.values()))Er(e)}var Lr=600000;function yt(e){if(e&&e<Lr)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${Lr} milliseconds (10 minutes), as not to overload the store with polling requests`)}function Je(e,t,r,n,o,s,i){let a=!1,c,u,l,w=(g)=>{try{i?.onHealth?.(g)}catch{}},m=()=>{if(a=!0,c)clearTimeout(c),c=void 0;u?.()},T=(g)=>new Promise((v)=>{let d=setTimeout(()=>{u=void 0,c=void 0,v()},g);c=d,u=()=>{clearTimeout(d),u=void 0,c=void 0,v()}});async function P(){let g=Date.now();for(;;){if(a)return;try{let v=await e.getFullSecret(t,s);return w(!0),v}catch(v){if(w(!1),s?.mode!=="wait")throw v;if(typeof s.timeout==="number"&&s.timeout>0&&Date.now()-g>=s.timeout)throw v;if(a)return;o?.warn(`Error retrieving initial secret from vault. Retrying in ${n} milliseconds`,v),await T(n)}}}async function O(){if(c=void 0,a)return;try{let g=await e.getFullSecret(t,s);if(w(!0),g.metadata.version!==l)l=g.metadata.version,r(g)}catch(g){w(!1),o?.warn(`Error retrieving remote config from vault. Retrying in ${n} milliseconds`,g)}E()}function E(){if(a)return;c=setTimeout(()=>{O()},n)}return P().then((g)=>{if(a||!g)return()=>m();return l=g.metadata.version,r(g),E(),()=>m()})}function Vu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Fu(e){let t={"Content-Type":"application/json"};if(e)t["X-Vault-Token"]=e;return t}function Du(e){return Boolean(e?.idpTokenUrl?.trim()&&e.clientId?.trim()&&e.clientSecret?.trim())}async function Ws(e,t){let r=Date.now();if(t.token&&t.expiresAt&&t.expiresAt-60000>r)return t.token;let n=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});if(e.scope?.trim())n.set("scope",e.scope.trim());let o=await fetch(e.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()});if(!o.ok)throw Error(`Vault workload token request failed (${o.status})`);let s=await o.json();if(!s.access_token)throw Error("Vault workload token response did not include access_token");return t.token=s.access_token,t.expiresAt=r+Math.max(1,s.expires_in??300)*1000,s.access_token}function zu(e){return{Authorization:e.startsWith("Bearer ")?e:`Bearer ${e}`}}function nr(e){return e.replace(/\/data\/?$/,"")}function $s(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let n=e;if(typeof n.parked!=="boolean")throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let o=n.disposition;if(o!==void 0&&o!=="cooldown"&&o!=="suspect")throw Error(`Vault ${r} kms_park returned invalid disposition for ${t}`);return{parked:n.parked,...n.stale===!0?{stale:!0}:{},...o?{disposition:o}:{}}}function qs(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);let n=e;if(!Array.isArray(n.keys))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);return{keys:n.keys.map((s,i)=>{if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}] for ${t}`);let a=s.id;if(typeof a!=="string"||a.length===0)throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}].id for ${t}`);return{id:a}})}}function Ns(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);let n=e;if(typeof n.revoked!=="boolean")throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);return{revoked:n.revoked}}function xt(e,t){let{type:r="vault",url:n,token:o,ttl:s}=e,i=()=>e.log,a=Du(e.workload)?e.workload:void 0,c={},u=Fu(o),{lfv:l,websocket:w}=e,m=l?pt({...l,log:l.log??i(),path:l.path??"/"},t):void 0,T=new Map,P=w?.url?.trim(),O=new Set,E=!1,g=!1;if(!l&&!n&&!P)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(yt(s),n&&!o&&!a&&!l)i()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function v(){if(a){let h=await Ws(a,c);return{"Content-Type":"application/json",...zu(h)}}return{...u}}async function d(h){let x=N(h);if(a){let b=await Ws(a,c);return{url:x,clientId:w?.clientId??a.clientId,token:b,header:"Authorization"}}return{url:x,clientId:w?.clientId,token:w?.token??o,header:w?.header??"X-Vault-Token"}}function C(h){if(!l)throw Error(`Vault LFV capability is not configured for path ${h}`);let x=T.get(h);if(x)return x;let b=pt({...l,log:l.log??i(),path:h},t);return T.set(h,b),b}function _(h){if(!n)throw Error(`Vault HTTP capability is not configured for path ${h}`);return n}function N(h){if(!P)throw Error(`Vault websocket capability is not configured for path ${h}`);return P}async function B(h,x){let b=await d(typeof x.path==="string"?x.path:"/");return An(b,h,x,i())}async function ee(h,x){let b=_(h),p;try{let f=await v(),R=new URL(`${b}/${h}`);if(typeof x?.kmsSlots==="number"&&Number.isInteger(x.kmsSlots)&&x.kmsSlots>=1)R.searchParams.set("kms_slots",String(x.kmsSlots));p=await fetch(R,{headers:f})}catch(f){throw new ye(`Vault request failed from URL: ${b}/${h}`,h,void 0,"connection",{cause:f})}if(p.status!==200){if(p.status===404)throw new He(h);let f=p.status===401||p.status===403,R=f?`Vault returned ${p.status} ${p.statusText} (auth error) from URL: ${b}/${h}`:`Vault returned invalid status, ${p.status}: '${p.statusText}' from URL: ${b}/${h}`;throw new ye(R,h,p.status,f?"auth":"invalid_status")}try{let R=(await p.json()).data;if(!R?.metadata||!("data"in R))throw Error("Missing vault secret data");let A=R.metadata.created_time??R.metadata.created;return{data:R.data,metadata:{path:typeof R.metadata.path==="string"?R.metadata.path:h,version:typeof R.metadata.version==="number"?R.metadata.version:0,created:A instanceof Date?A:typeof A==="string"?new Date(A):new Date,...lt(R.metadata)?{contentType:lt(R.metadata)}:{}}}}catch(f){throw new ye("Error retrieving secret",h,void 0,"invalid_payload",{cause:f})}}async function ie(h,x){let b=await d(h);return _n(b,h,i(),x?.kmsSlots)}async function re(h){let x=_(h),b=`${nr(x)}/metadata/${h}`,p=await v(),f=await fetch(b,{headers:p});if(f.status!==200)throw new ye(`Vault getMetadata failed (${f.status}) for ${h}`,h,f.status,"invalid_status");let R=await f.json().catch(()=>null);if(!R?.metadata||typeof R.metadata!=="object")throw new ye(`Vault getMetadata returned invalid payload for ${h}`,h,f.status,"invalid_payload");return R.metadata}async function te(h,x,b){let p=_(x),f=`${nr(p)}/${h}/${x}`,R=await v(),A=await fetch(f,{method:"POST",headers:R,body:JSON.stringify({reason:b?.reason,severity:b?.severity,incident_ref:b?.incidentRef})});if(A.status!==200&&A.status!==202&&A.status!==204)throw new ye(`Vault ${h} failed (${A.status}) for ${x}`,x,A.status,"invalid_status")}async function ue(h,x){if(l)return await C(h).getFullSecret(h,x);if(n)return await ee(h,x);return await ie(h,x)}async function W(h,x,b){if(!Vu(x))throw Error(`putSecret requires an object value for vault source at path ${h}`);if(l){await C(h).putSecret(h,x,b);return}if(n){let p=_(h),f=await v();if(f["X-Ionite-Mime-Type"]=b.contentType.mimeType,f["X-Ionite-Secret-Format"]=b.contentType.format,b.contentType.schemaUrl)f["X-Ionite-Schema-Url"]=b.contentType.schemaUrl;if(b.contentType.typeId)f["X-Ionite-Secret-Type"]=b.contentType.typeId;let R=await fetch(`${p}/${h}`,{method:"POST",headers:f,body:JSON.stringify(x)});if(R.status!==200&&R.status!==201&&R.status!==204)throw new ye(`Vault putSecret failed (${R.status}) for ${h}`,h,R.status,"invalid_status");return}await B("put_secret",{path:h,data:x,content_type:Sr(b.contentType)})}async function J(h,x){if(l){await C(h).deleteSecret(h,x);return}if(n){let b=_(h),p=await v(),f=await fetch(`${b}/${h}`,{method:"DELETE",headers:p});if(f.status!==200&&f.status!==202&&f.status!==204)throw new ye(`Vault deleteSecret failed (${f.status}) for ${h}`,h,f.status,"invalid_status");return}await B("delete_secret",{path:h})}async function Y(h,x){if(l)return await C(h).listPaths(h,x);if(n){let f=`${_(h)}/${h}`,R=async(F)=>{let ae=await v();if(F==="LIST")return fetch(f,{method:"LIST",headers:ae});let Q=f.includes("?")?"&":"?";return fetch(`${f}${Q}list=true`,{method:"GET",headers:ae})},A=await R("LIST");if(A.status===405||A.status===501)A=await R("GET");if(A.status!==200)throw new ye(`Vault listPaths failed (${A.status}) for ${h}`,h,A.status,"invalid_status");let V=await A.json().catch(()=>null),X;if(V&&typeof V==="object"){let F=V,ae=F.data;if(ae&&typeof ae==="object")X=ae.keys;else X=F.keys}if(!Array.isArray(X))throw new ye(`Vault listPaths returned an unexpected response for ${h}`,h,void 0,"invalid_payload");return X.filter((F)=>typeof F==="string")}let b=await B("list_paths",{path:h});if(!Array.isArray(b.items))throw Error(`Vault websocket list_paths returned invalid payload for ${h}`);return b.items.filter((p)=>typeof p==="string")}async function ne(h,x){if(l)return await C(h).exists(h,x);if(n){let p=_(h),f=await v(),R=await fetch(`${p}/${h}`,{headers:f});if(R.status===200)return!0;if(R.status===404)return!1;if(R.status===401||R.status===403)throw new ye(`Vault exists failed (${R.status}) for ${h} (auth error)`,h,R.status,"auth");throw new ye(`Vault exists failed (${R.status}) for ${h}`,h,R.status,"invalid_status")}let b=await B("exists",{path:h});if(typeof b.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${h}`);return b.exists}async function se(h,x,b){if(l){await C(h).requestRotate(h,x,b);return}if(n){await te("rotate/request",h,x);return}await B("request_rotate",{path:h,reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef})}async function oe(h,x,b){if(l){await C(h).requestRevoke(h,x,b);return}if(n){await te("revoke/request",h,x);return}await B("request_revoke",{path:h,reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef})}async function S(h,x,b){if(l)return await C(h).parkKmsKey(h,x,b);if(n){let f=_(h),R=`${nr(f)}/kms/park/${h}`,A=await v(),V=await fetch(R,{method:"POST",headers:A,body:JSON.stringify({key_id:x.keyId,status:x.status,reason:x.reason})});if(V.status!==200&&V.status!==202)throw new ye(`Vault kms/park failed (${V.status}) for ${h}`,h,V.status,"invalid_status");return $s(await V.json().catch(()=>null),h,"http")}let p=await B("kms_park",{path:h,key_id:x.keyId,status:x.status,reason:x.reason});return $s(p,h,"websocket")}async function L(h,x,b){if(l)return await C(h).addKmsKeys(h,x,b);if(n){let f=_(h),R=`${nr(f)}/kms/add-keys/${h}`,A=await v(),V=await fetch(R,{method:"POST",headers:A,body:JSON.stringify({keys:x.keys})});if(V.status!==200&&V.status!==202)throw new ye(`Vault kms/add-keys failed (${V.status}) for ${h}`,h,V.status,"invalid_status");return qs(await V.json().catch(()=>null),h,"http")}let p=await B("kms_add_keys",{path:h,keys:x.keys});return qs(p,h,"websocket")}async function z(h,x,b){if(l)return await C(h).revokeKmsKey(h,x,b);if(n){let f=_(h),R=`${nr(f)}/kms/revoke-key/${h}`,A=await v(),V=await fetch(R,{method:"POST",headers:A,body:JSON.stringify({key_id:x.keyId,reason:x.reason})});if(V.status!==200&&V.status!==202)throw new ye(`Vault kms/revoke-key failed (${V.status}) for ${h}`,h,V.status,"invalid_status");return Ns(await V.json().catch(()=>null),h,"http")}let p=await B("kms_revoke_key",{path:h,key_id:x.keyId,reason:x.reason});return Ns(p,h,"websocket")}async function H(h,x){if(l)return await C(h).getMetadata(h,x);if(n)return await re(h);let b=await B("read_metadata",{path:h});if(!b.metadata||typeof b.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${h}`);return b.metadata}async function k(h,x,b){if(!s)throw new xe(r,h);return Je({getFullSecret:ee},h,x,s,i(),b,{onHealth:(p)=>{E=!p}})}async function M(h,x,b){let p=await d(h);return xs(p,h,x,b,i(),{onHealth:(f)=>{g=!f}})}function I(h){let x=()=>{if(O.delete(x))h()};return O.add(x),x}function j(){if(m?.isAvailable?.()===!1)return!0;for(let h of T.values())if(h.isAvailable?.()===!1)return!0;return!1}let K={type:r,isAvailable:()=>!E&&!g&&!j(),get:(h,x)=>Ne(()=>ue(h,x)),getFullSecret:ue,getSecret:async(h,x)=>(await ue(h,x)).data,putSecret:W,deleteSecret:J,listPaths:Y,exists:ne,requestRotate:se,requestRevoke:oe,parkKmsKey:S,addKmsKeys:L,revokeKmsKey:z,getMetadata:H,subscribe:async(h,x,b)=>{let p;if(P)p=await M(h,x,b);else if(l)p=await C(h).subscribe(h,x,b);else p=await k(h,x,b);return I(p)},...m?{subscribeEvents:(h)=>I(m.subscribeEvents?.(h)??(()=>{}))}:P?{subscribeEvents:(h)=>{let x,b=!1;return d("/").then((p)=>Us(p,h,i())).then((p)=>{if(b){p();return}x=p}).catch((p)=>{i()?.warn("Vault websocket event subscription failed",p)}),I(()=>{b=!0,x?.()})}}:{},close:()=>{for(let x of Array.from(O))try{x()}catch(b){i()?.warn("Vault source close: failed to release a subscription",b)}O.clear();let h=(x)=>{if(!x?.close)return;try{Promise.resolve(x.close()).catch((b)=>{i()?.warn("Vault source close: LFV close failed",b)})}catch(b){i()?.warn("Vault source close: LFV close failed",b)}};for(let x of T.values())h(x);h(m),T.clear(),c.token=void 0,c.expiresAt=void 0},get log(){return e.log},set log(h){e.log=h}};if(m)K.isDeliveryRequest=(h)=>m.isDeliveryRequest(h),K.isEventsRequest=(h)=>m.isEventsRequest(h),K.handleDelivery=(h)=>m.handleDelivery(h),K.handleEvents=(h)=>m.handleEvents(h),Object.defineProperties(K,{deliveryPath:{value:m.deliveryPath,enumerable:!0},eventsPath:{value:m.eventsPath,enumerable:!0},callbackKey:{value:m.callbackKey,enumerable:!0},trustId:{value:m.trustId,enumerable:!0}});return K}class Ur extends Error{constructor(e,t){super(e);this.name="AzureKeyVaultError",this.status=t,Object.setPrototypeOf(this,Ur.prototype)}}function xr(e,t){if(!e||e.trim().length===0)throw Error(`Missing required Azure config: ${t}`);return e}function Hu(e){return e.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function Ln(e,t){return`${e.replace(/\/+$/g,"")}/${t.replace(/^\/+/g,"")}`}function Ju(e){try{let r=new URL(e).pathname.split("/").filter(Boolean),n=r.indexOf("secrets");if(n===-1)return;return r[n+2]||void 0}catch{return}}function Yu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Mr(e){let t=e.apiVersion??"7.4",r=e.scope??"https://vault.azure.net/.default",n=e.secretNameTransform??Hu,o=e.authMethod,s="/var/run/secrets/azure/tokens/azure-identity-token",i=e.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",a=e.vaultUrl??(e.vaultName?`https://${e.vaultName}.vault.azure.net`:void 0)??void 0,c=xr(a,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function u(W){try{return await Gu(W),!0}catch{return!1}}let l,w,m=!1;async function T(W){let{entraTenantId:J,clientId:Y}=e;if(!J)throw Error("Workload identity requires entraTenantId");if(!Y)throw Error("Workload identity requires clientId");if(!await u(i))throw Error(`Federated token file not found at ${i}`);let ne=(await Bu(i,"utf8")).trim();if(!ne)throw Error("Federated token file was empty");let se=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,oe=new URLSearchParams({client_id:Y,grant_type:"client_credentials",scope:r,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:ne}),S=await fetch(se,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:oe});if(S.status!==200)throw Error(`Azure workload identity token exchange returned ${S.status} ${S.statusText}`);let L=await S.json();if(!L?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:L.access_token,expiresAtMs:W+(L.expires_in??0)*1000},L.access_token}async function P(W){let J=e.imdsApiVersion??"2018-02-01",Y="https://vault.azure.net",ne=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(ne.searchParams.set("api-version",J),ne.searchParams.set("resource","https://vault.azure.net"),e.managedIdentityClientId)ne.searchParams.set("client_id",e.managedIdentityClientId);let se=await fetch(ne.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(se.status!==200)throw Error(`Azure IMDS token endpoint returned ${se.status} ${se.statusText}`);let oe=await se.json();if(!oe?.access_token)throw Error("IMDS token response missing access_token");let S=W+60000;if(oe.expires_on){let L=Number.parseInt(oe.expires_on,10);if(Number.isFinite(L)&&L>0)S=L*1000;else{let z=Date.parse(oe.expires_on);if(Number.isFinite(z))S=z}}else if(oe.expires_in){let L=Number.parseInt(oe.expires_in,10);if(Number.isFinite(L)&&L>0)S=W+L*1000}return l={accessToken:oe.access_token,expiresAtMs:S},oe.access_token}async function O(W){let J=xr(e.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),Y=xr(e.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),ne=xr(e.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),se=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,oe=new URLSearchParams({client_id:Y,client_secret:ne,grant_type:"client_credentials",scope:r}),S=await fetch(se,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:oe});if(S.status!==200)throw Error(`Azure token endpoint returned ${S.status} ${S.statusText}`);let L=await S.json();if(!L?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:L.access_token,expiresAtMs:W+(L.expires_in??0)*1000},L.access_token}async function E(){let W=Date.now();if(l&&l.expiresAtMs-60000>W)return l.accessToken;if(w)return w;w=(async()=>{if(o==="workload_identity")return await T(W);if(o==="managed_identity")return await P(W);if(o==="client_secret")return await O(W);if(await u(i))try{return await T(W)}catch{}try{return await P(W)}catch{}return await O(W)})();try{return await w}finally{w=void 0}}async function g(W){let J=await E(),Y=Ln(c,`/secrets/${encodeURIComponent(W)}?api-version=${encodeURIComponent(t)}`),ne=await fetch(Y,{headers:{Authorization:`Bearer ${J}`,Accept:"application/json"}});if(ne.status!==200)throw new Ur(`Key Vault request failed (${ne.status})`,ne.status);return await ne.json()}async function v(W,J){let Y=n(W),ne=e.secretNamePrefix?`${e.secretNamePrefix}${Y}`:Y,se=await g(ne),oe=se.value;try{oe=JSON.parse(se.value)}catch{}let S=se.attributes?.created?se.attributes.created*1000:void 0,L=Ju(se.id),z=se.contentType?vr({mimeType:se.contentType,format:se.tags?.["ionite-format"],schemaUrl:se.tags?.["ionite-schema-url"],typeId:se.tags?.["ionite-type-id"]}):void 0;return{data:oe,metadata:{path:W,version:Number.parseInt(L??"",10)||0,created:S?new Date(S):new Date,...z?{contentType:z}:{}}}}async function d(W,J,Y){if(!Yu(J))throw Error(`putSecret requires an object value for azure source at path ${W}`);let ne=n(W),se=e.secretNamePrefix?`${e.secretNamePrefix}${ne}`:ne,oe=await E(),S=Ln(c,`/secrets/${encodeURIComponent(se)}?api-version=${encodeURIComponent(t)}`),L=JSON.stringify({value:JSON.stringify(J),contentType:Y.contentType.mimeType,tags:{"ionite-format":Y.contentType.format,...Y.contentType.schemaUrl?{"ionite-schema-url":Y.contentType.schemaUrl}:{},...Y.contentType.typeId?{"ionite-type-id":Y.contentType.typeId}:{}}}),z=await fetch(S,{method:"PUT",headers:{Authorization:`Bearer ${oe}`,"Content-Type":"application/json",Accept:"application/json"},body:L});if(z.status!==200&&z.status!==201)throw Error(`Key Vault putSecret failed (${z.status}) for ${W}`)}async function C(W,J){let Y=n(W),ne=e.secretNamePrefix?`${e.secretNamePrefix}${Y}`:Y,se=await E(),oe=Ln(c,`/secrets/${encodeURIComponent(ne)}?api-version=${encodeURIComponent(t)}`),S=await fetch(oe,{method:"DELETE",headers:{Authorization:`Bearer ${se}`,Accept:"application/json"}});if(S.status!==200&&S.status!==202&&S.status!==204)throw Error(`Key Vault deleteSecret failed (${S.status}) for ${W}`)}async function _(W,J){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${W}`)}async function N(W,J){try{return await v(W),!0}catch(Y){if(Y instanceof Ur&&Y.status===404)return!1;throw Y}}async function B(W,J,Y){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${W}`)}async function ee(W,J,Y){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${W}`)}async function ie(W){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${W}`)}async function re(W){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${W}`)}async function te(W){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${W}`)}async function ue(W,J){let Y=n(W),ne=e.secretNamePrefix?`${e.secretNamePrefix}${Y}`:Y,se=await g(ne),oe=se.contentType?vr({mimeType:se.contentType,format:se.tags?.["ionite-format"],schemaUrl:se.tags?.["ionite-schema-url"],typeId:se.tags?.["ionite-type-id"]}):void 0;return{id:se.id,...oe?{content_type:oe}:{},...se.attributes??{}}}return{type:e.type,isAvailable:()=>!m,get:(W,J)=>Ne(()=>v(W,J)),getFullSecret:v,getSecret:async(W,J)=>(await v(W,J)).data,putSecret:d,deleteSecret:C,listPaths:_,exists:N,requestRotate:B,requestRevoke:ee,parkKmsKey:ie,addKmsKeys:re,revokeKmsKey:te,getMetadata:ue,subscribe:(W,J,Y)=>{if(!e.ttl)throw new xe("azure",W);return yt(e.ttl),Je({getFullSecret:v},W,J,e.ttl,void 0,Y,{onHealth:(ne)=>{m=!ne}})},close:()=>{l=void 0,w=void 0,m=!1}}}var xn=Symbol("ion.secretsSourceState");function Zu(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${n}`)};return{type:"dev",get:(r,n)=>Ne(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[xn]:"unavailable"}}function Ks(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${n}`)};return{type:"dev",get:(r,n)=>Ne(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[xn]:"removed"}}function Qu(e){return e.type==="vault"&&e.lfv!=null}function ed(e,t,r,n){if(!Qu(t))return;if(r||n)return;throw Error(`Secrets source "${e}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function td(e,t,r){if(t.type==="vault")return xt(t,r);if(t.type==="azure")return Mr(t);if(t.type==="aws"||t.type==="gcp"||t.type==="dev")throw Error(`Secrets source "${e}" uses type "${t.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${e}"`)}function rd(e,t){let r=(n)=>{t.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:n instanceof Error?n.message:String(n)})};try{Promise.resolve(e.close?.()).catch(r)}catch(n){r(n)}}function nd(e){let t=new Map,r=new Map,n=new Map;for(let[o,s]of Object.entries(e)){if(!Vs(s))continue;let i=t.get(s.deliveryPath);if(i)throw Error(`LFV delivery path "${s.deliveryPath}" is claimed by both secrets sources "${i}" and "${o}"; delivery paths must be globally unique.`);t.set(s.deliveryPath,o);let a=r.get(s.eventsPath);if(a)throw Error(`LFV events path "${s.eventsPath}" is claimed by both secrets sources "${a}" and "${o}"; events paths must be globally unique.`);r.set(s.eventsPath,o);let c=n.get(s.callbackKey);if(c&&c.trustId!==s.trustId)throw Error(`LFV callback key "${s.callbackKey}" is claimed by secrets sources "${c.sourceName}" and "${o}" with different verify JWKS; a callback path must use a single trust key.`);if(!c)n.set(s.callbackKey,{sourceName:o,trustId:s.trustId})}}function Vs(e){return typeof e.isDeliveryRequest==="function"&&typeof e.isEventsRequest==="function"&&typeof e.handleDelivery==="function"&&typeof e.handleEvents==="function"}function od(e,t,r){let n={...t},o=[],s=(a)=>{if(n[a]!==void 0)delete n[a],o.push(a)};s("token"),s("clientSecret"),s("workload");let i=n.websocket;if(i&&typeof i==="object"&&i.token!==void 0){let a={...i};delete a.token,n.websocket=a,o.push("websocket.token")}if(o.length>0)r.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:e,"ion.droppedFields":o});return n}function sd(e,t,r){let n={},o=new Set([...Object.keys(t??{}),...Object.keys(r??{})]);for(let s of o){let i=t?.[s],a=r?.[s],c=a?od(s,a,e):void 0;n[s]={...i??{},...c??{}}}return n}function jr(e){return e[xn]??"available"}function id(e,t,r){let n=t,o=new Set,s=new Set,i=new Set,a=We(r,`Secrets source "${e}"`),c=()=>jr(n)==="available",u=ge(`Secrets source "${e}"`,c),l=(d,C,_)=>Error(`${d} timed out after ${_}ms waiting for source "${e}" to be configured by the ConfigSource at path ${C}`),w=(d,C)=>Error(`${d} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${C}`),m=(d,C,_)=>{let N=jr(n);if(N==="available")return Promise.resolve(n);if(N==="removed")return Promise.reject(w(d,C));return new Promise((B,ee)=>{let ie={method:d,path:C,resolve:(te)=>{if(ie.timeout)clearTimeout(ie.timeout);i.delete(ie),B(te)},reject:(te)=>{if(ie.timeout)clearTimeout(ie.timeout);i.delete(ie),ee(te)}},re=_?.timeout;if(typeof re==="number"&&re>0)ie.timeout=setTimeout(()=>{ie.reject(l(d,C,re))},re);i.add(ie)})},T=(d)=>{for(let C of Array.from(i))C.resolve(d)},P=()=>{for(let d of Array.from(i))d.reject(w(d.method,d.path))},O=async(d,C=!1)=>{let _=d.guard.next();if(d.unsubscribe?.(),d.unsubscribe=void 0,d.closed)return;if(jr(n)==="unavailable"&&d.options?.mode!=="wait"){if(C)throw Error(`subscribe is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${d.path}`);return}try{let B=await(d.options?.mode==="wait"?await m("subscribe",d.path,d.options):n).subscribe(d.path,(ee)=>{if(!d.closed)d.onChange(ee)},d.options);if(d.closed||!d.guard.isCurrent(_)){B?.();return}d.unsubscribe=B}catch(N){if(C)throw N;if(Cr(N)){r.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:e,path:d.path});return}r.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:e,path:d.path,error:N instanceof Error?N.message:String(N)})}},E=(d,C=!1)=>{if(d.unsubscribe?.(),d.unsubscribe=void 0,d.closed)return;if(!n.subscribeEvents){if(C)throw Error(`Secrets source "${e}" does not support lifecycle event subscriptions`);return}d.unsubscribe=n.subscribeEvents((_)=>{if(!d.closed)d.listener(_)})},g={get type(){return n.type},beforeChange:a.beforeChange,afterChange:a.afterChange,isAvailable:()=>c()&&(n.isAvailable?.()??!0),isReady:u.isReady,ready:u.ready,get:(d,C)=>Ne(async()=>(await m("get",d,C)).getFullSecret(d,C)),getFullSecret:async(d,C)=>(await m("getFullSecret",d,C)).getFullSecret(d,C),getSecret:async(d,C)=>(await m("getSecret",d,C)).getSecret(d,C),putSecret:async(d,C,_)=>(await m("putSecret",d,_)).putSecret(d,C,_),subscribe:async(d,C,_)=>{let N={path:d,onChange:C,options:_,closed:!1,guard:Or()};o.add(N);try{await O(N,!0)}catch(B){throw o.delete(N),B}return()=>{N.closed=!0,N.guard.next(),o.delete(N),N.unsubscribe?.(),N.unsubscribe=void 0}},subscribeEvents:(d)=>{let C={listener:d,closed:!1};s.add(C);try{E(C,!0)}catch(_){throw s.delete(C),_}return()=>{C.closed=!0,s.delete(C),C.unsubscribe?.(),C.unsubscribe=void 0}},deleteSecret:async(d,C)=>(await m("deleteSecret",d,C)).deleteSecret(d,C),listPaths:async(d,C)=>(await m("listPaths",d,C)).listPaths(d,C),exists:async(d,C)=>(await m("exists",d,C)).exists(d,C),requestRotate:async(d,C,_)=>(await m("requestRotate",d,_)).requestRotate(d,C,_),requestRevoke:async(d,C,_)=>(await m("requestRevoke",d,_)).requestRevoke(d,C,_),parkKmsKey:async(d,C,_)=>(await m("parkKmsKey",d,_)).parkKmsKey(d,C,_),addKmsKeys:async(d,C,_)=>(await m("addKmsKeys",d,_)).addKmsKeys(d,C,_),revokeKmsKey:async(d,C,_)=>(await m("revokeKmsKey",d,_)).revokeKmsKey(d,C,_),getMetadata:async(d,C)=>(await m("getMetadata",d,C)).getMetadata(d,C)},v=(d)=>{try{Promise.resolve(d.close?.()).catch((C)=>{r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:C instanceof Error?C.message:String(C)})})}catch(C){r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:C instanceof Error?C.message:String(C)})}};return{api:g,update(d){if(d===n)return;let C=n;a.emitBefore(),n=d;let _=jr(d);if(_==="available")T(d);else if(_==="removed")P();u.refresh();for(let N of o)O(N);for(let N of s)E(N);v(C),a.emitAfter()},close(){for(let d of o)d.closed=!0,d.guard.next(),d.unsubscribe?.(),d.unsubscribe=void 0;o.clear();for(let d of s)d.closed=!0,d.unsubscribe?.(),d.unsubscribe=void 0;s.clear(),P(),u.settle(),v(n)}}}function Fs(e,t=new Map){let r=new Map,n=new Map,o,s=!1,i=new Map,a=We(e,"Secrets"),c=!1,u=()=>{for(let g of r.keys()){let v=i.get(g);if(v&&v.api.isReady?.()===!1)return!1}return!0},l=ge("Secrets module",()=>c&&u()),w=(g)=>{let v=i.get(g);if(v)return v;let d=id(g,r.get(g)??Ks(g),e);if(i.set(g,d),!(g in E))Object.assign(E,{[g]:d.api});return d},m=(g)=>{let v=i.get(g)?.api;if(v)return v;throw e.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:g}),Error(`Secrets source "${g}" is not configured`)},T=()=>Array.from(r.values()).filter(Vs),P=(g)=>T().find((v)=>v.isDeliveryRequest(g)),O=(g)=>T().find((v)=>v.isEventsRequest(g)),E;return E={get config(){return Object.fromEntries(Array.from(r.keys(),(g)=>[g,w(g).api]))},beforeChange:a.beforeChange,afterChange:a.afterChange,isReady:l.isReady,isAvailable:()=>{for(let g of i.values()){if(g.api.isReady?.()===!1)continue;if(g.api.isAvailable?.()===!1)return!1}return!0},ready:l.ready,listSecretsSources:()=>Array.from(r.keys()),getSecretsSource:(g)=>{if(r.has(g))return w(g).api;return m(g)},get:(g,v,d)=>E.getSecretsSource(g).get(v,d),getSecret:(g,v,d)=>E.getSecretsSource(g).getSecret(v,d),getFullSecret:(g,v,d)=>E.getSecretsSource(g).getFullSecret(v,d),putSecret:(g,v,d,C)=>E.getSecretsSource(g).putSecret(v,d,C),deleteSecret:(g,v,d)=>E.getSecretsSource(g).deleteSecret(v,d),listPaths:(g,v,d)=>E.getSecretsSource(g).listPaths(v,d),exists:(g,v,d)=>E.getSecretsSource(g).exists(v,d),requestRotate:(g,v,d,C)=>E.getSecretsSource(g).requestRotate(v,d,C),requestRevoke:(g,v,d,C)=>E.getSecretsSource(g).requestRevoke(v,d,C),parkKmsKey:(g,v,d,C)=>E.getSecretsSource(g).parkKmsKey(v,d,C),addKmsKeys:(g,v,d,C)=>E.getSecretsSource(g).addKmsKeys(v,d,C),revokeKmsKey:(g,v,d,C)=>E.getSecretsSource(g).revokeKmsKey(v,d,C),getMetadata:(g,v,d)=>E.getSecretsSource(g).getMetadata(v,d),subscribe:(g,v,d,C)=>E.getSecretsSource(g).subscribe(v,d,C),isLfvDeliveryRequest:(g)=>P(g)!==void 0,isLfvEventsRequest:(g)=>O(g)!==void 0,handleLfvDelivery:async(g)=>{let v=P(g);if(!v)return me();return v.handleDelivery(g)},handleLfvEvents:async(g)=>{let v=O(g);if(!v)return me();return v.handleEvents(g)}},{update(g,v,d,C,_){let N=g!==void 0||v!==void 0;if(!N&&!c&&i.size===0)return;let B=sd(e,g,v),ee=_===!0,ie=C!==o,re=ee!==s,te=new Map,ue=new Map,W=[];try{for(let[J,Y]of Object.entries(B)){let ne=Xu(Y),se=r.get(J);if(se&&n.get(J)===ne&&!ie&&!re){te.set(J,se),ue.set(J,ne);continue}let oe;if(!Y.type)oe=Zu(J);else{if(d?.validateSourceConfig?.(J,Y),t.has(J)&&g?.[J])e.warn(`RemoteConfig secrets source "${J}" is superseded by the framework LFV bootstrap source.`);if(!t.has(J))ed(J,Y,C,ee),oe=td(J,Y,C),W.push(oe);else oe=t.get(J)}te.set(J,oe),ue.set(J,ne)}nd(Object.fromEntries(te))}catch(J){for(let Y of W)rd(Y,e);throw J}a.emitBefore(),c=N,o=C,s=ee;for(let[J,Y]of te)r.set(J,Y),n.set(J,ue.get(J)),w(J).update(Y);for(let[J,Y]of i){if(te.has(J))continue;r.delete(J),n.delete(J),Y.update(Ks(J))}return l.refresh(),a.emitAfter(),E},close(){for(let g of i.values())g.close();i.clear(),r.clear(),n.clear(),o=void 0,c=!1,l.settle()}}}function Un(e,t){let r=t.ttlMs,n=Math.max(1,Math.floor(t.maxEntries)),o=new Map,s=()=>Date.now();function i(){while(o.size>n){let c=o.keys().next().value;if(c===void 0)break;o.delete(c)}}function a(c,u){o.delete(c),o.set(c,{session:u,expiresAt:s()+r}),i()}return{async create(c){await e.create(c)},async get(c){let u=o.get(c);if(u){if(u.expiresAt>s())return o.delete(c),o.set(c,u),u.session;o.delete(c)}let l=await e.get(c);if(l)a(c,l);return l},async update(c,u){await e.update(c,u),o.delete(c)},async delete(c){await e.delete(c),o.delete(c)}}}import{deepEqualPlain as Ds,IoniteError as be,trimTrailingSlash as wt,validationFailureResponse as ad}from"@ionite/core";import{getCachedVerificationKey as cd}from"@ionite/core/server";function Bs(){let e,t=ge("tm module",()=>e!==void 0),r=()=>{if(!e)throw new be("Tenant Management is not ready",{status:503});return e},n={isReady:t.isReady,ready:t.ready,handler:(o)=>e?e.handler(o):Promise.resolve(Response.json({error:"Tenant Management is not ready"},{status:503})),getTenant:(o)=>r().getTenant(o),recordConsent:(o)=>r().recordConsent(o)};return{handle:n,update(o,s){return e=o,t.refresh(),s?n:void 0}}}var ud=600,dd=30;function Gs(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),r=t.padEnd(Math.ceil(t.length/4)*4,"=");return Uint8Array.from(atob(r),(n)=>n.charCodeAt(0)).buffer}function zs(e){return JSON.parse(new TextDecoder().decode(new Uint8Array(Gs(e))))}function Hs(e){return Array.isArray(e)&&e.length>0&&e.every((t)=>typeof t==="string")}function ld(e){if(!e||typeof e!=="object")throw new be("Invalid staged integration handle",{status:400});let t=e;if(typeof t.iss!=="string"||!(typeof t.aud==="string"||Hs(t.aud))||typeof t.iat!=="number"||typeof t.exp!=="number"||typeof t.jti!=="string"||typeof t.integratorTenantId!=="string"||typeof t.productId!=="string"||typeof t.applicationId!=="string")throw new be("Invalid staged integration claims",{status:400});return t}function fd(e,t){return Array.isArray(e)?e.includes(t):e===t}async function ht(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return Array.from(new Uint8Array(t),(r)=>r.toString(16).padStart(2,"0")).join("")}async function Wr(e,t){let r=await Js(e,t),n=ld(r),o=Math.floor(Date.now()/1000),s=t.consentTtlSeconds??ud;if(n.iat>o+60||n.exp-n.iat>s)throw new be("Staged integration handle lifetime is invalid",{status:401});return{handle:e,integrator:t.integrator.id,integratorName:n.integratorName??t.integrator.name,integratorTenantId:n.integratorTenantId,productId:n.productId,applicationId:n.applicationId,issuedAt:new Date(n.iat*1000).toISOString(),expiresAt:new Date(n.exp*1000).toISOString(),requestId:n.jti,tenantHint:n.tenantHint}}async function Js(e,t){let r=e.split(".");if(r.length!==3)throw new be("Invalid staged integration handle",{status:400});let n=zs(r[0]);if(!n||typeof n!=="object")throw new be("Invalid staged integration handle",{status:400});let{alg:o,kid:s}=n;if(o!=="RS256"||typeof s!=="string"||s.length===0)throw new be("Unsupported staged integration signature",{status:400});let i=zs(r[1]);if(!i||typeof i!=="object")throw new be("Invalid integrator token claims",{status:400});let a=i,c=await cd(t.integrator.jwksUri,s,"tm:RS256",(m)=>crypto.subtle.importKey("jwk",m,{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"]));if(!await crypto.subtle.verify({name:"RSASSA-PKCS1-v1_5"},c,Gs(r[2]),new TextEncoder().encode(`${r[0]}.${r[1]}`)))throw new be("Invalid staged integration signature",{status:401});let l=Math.floor(Date.now()/1000),w=a.azp??a.client_id;if(typeof a.iss!=="string"||a.iss.replace(/\/+$/,"")!==t.integrator.issuer.replace(/\/+$/,"")||!(typeof a.aud==="string"||Hs(a.aud))||!fd(a.aud,t.integrator.audience)||w!==t.integrator.clientId||typeof a.exp!=="number"||a.exp<=l)throw new be("Integrator token is not trusted or has expired",{status:401});return a}function Ys(e){try{return wt(new URL(e,"http://dummy").pathname)}catch{let t=e.startsWith("/")?e:`/${e}`;return wt(t)}}function pd(e,t){let r=new URL(e.url);return new URL(`/${encodeURIComponent(t)}/`,r.origin).toString()}function md(e,t){let r=Ys(t),n=wt(e);if(n===r)return null;if(!n.startsWith(`${r}/`))return null;let o=n.slice(r.length+1);if(!o||o.includes("/"))return null;return decodeURIComponent(o)}function $r(e){return e==="pending"||e==="processing"||e==="completed"||e==="failed"||e==="action_required"}function gd(e){if(!$r(e.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if(e.status==="completed"){if(!e.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:e.tenantUrl,status:"completed"},status:201}}if(e.status==="pending"||e.status==="processing")return{body:{tenantUrl:e.tenantUrl,status:e.status},status:202};if(e.status==="action_required"){if(!e.actionUrl||!e.requestToken||!e.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:e.actionUrl,requestToken:e.requestToken,expiresAt:e.expiresAt},status:200}}return{body:{tenantUrl:e.tenantUrl,status:"failed",error:e.error??"Tenant provisioning failed"},status:409}}function Xs(e,t,r){let n=r.validators.tenant.createTenantRequest,o=r.validators.tenant.updateTenantRequest;function s(g,v){let d=(C)=>new URL(C,v).toString();return{readyzUrl:d(g.readyzUrl),capabilitiezUrl:d(g.capabilitiezUrl),sso:{loginUrl:d(g.sso.loginUrl),userUrl:d(g.sso.userUrl),logoutUrl:d(g.sso.logoutUrl),logoutBackChannelUrl:d(g.sso.logoutBackChannelUrl),refreshUrl:d(g.sso.refreshUrl),callbackUrl:d(g.sso.callbackUrl)},workload:{validateUrl:d(g.workload.validateUrl),jwksUrl:d(g.workload.jwksUrl)},iam:{basePath:d(g.iam.basePath),usersUrl:d(g.iam.usersUrl),groupsUrl:d(g.iam.groupsUrl),workloadsUrl:d(g.iam.workloadsUrl),customersUrl:d(g.iam.customersUrl)},ciam:{magicLinkUrl:d(g.ciam.magicLinkUrl),magicLinkLoginUrl:d(g.ciam.magicLinkLoginUrl),customerUrl:d(g.ciam.customerUrl),customerLoginUrl:d(g.ciam.customerLoginUrl),customerCallbackUrl:d(g.ciam.customerCallbackUrl),customerProvidersUrl:d(g.ciam.customerProvidersUrl),logoutUrl:d(g.ciam.logoutUrl)}}}function i(g,v){let d=r.tenantIonBasePath?.(g);if(!d)return;let C=new URL(v.url).origin,_=s(De(d),C);return{callbackUrl:_.sso.callbackUrl,ionUrls:_}}function a(){if(!r.store.setIntegration||!r.store.getByIntegrationHandleHash)throw new be("Tenant integration requires store.setIntegration and store.getByIntegrationHandleHash",{status:501});return{setIntegration:r.store.setIntegration.bind(r.store),getByIntegrationHandleHash:r.store.getByIntegrationHandleHash.bind(r.store)}}async function c(g){let v=g.headers.get("Authorization");if(!v?.startsWith("Bearer "))return Response.json({error:"Unauthorized"},{status:401});try{await Js(v.slice(7),t);return}catch{return Response.json({error:"Unauthorized"},{status:401})}}function u(g){let{integration:v,...d}=g;if(!v)return d;return{...d,integration:{integrator:v.integrator,integratorName:v.integratorName,integratorTenantId:v.integratorTenantId,applicationId:v.applicationId,productId:v.productId,status:v.status,expiresAt:v.expiresAt,requestedAt:v.requestedAt,decidedAt:v.decidedAt}}}async function l(g){let v=await g.json();if(!v||typeof v.handle!=="string"||v.handle.length===0)throw new be("handle is required",{status:400});if(v.authorization!==void 0&&typeof v.authorization!=="string")throw new be("authorization must be a string",{status:400});return{handle:v.handle,authorization:v.authorization}}async function w(g){if(g.method!=="GET")return Ge(["GET"]);if(!r.onConnectRequest)return Response.json({error:"Tenant integration consent is not supported"},{status:501});let v=new URL(g.url).searchParams.get("handle");if(!v)return Response.json({error:"handle is required"},{status:400});let d=await Wr(v,t),C=d.tenantHint?await r.store.get(d.tenantHint):void 0;if(d.tenantHint&&!C)return me();if(C){let _=a(),N=await ht(v),B=C.integration;if(B&&B.handleHash!==N&&Date.parse(B.expiresAt)>Date.now())return Response.json({error:"Tenant already has an active integration request"},{status:409});if(!B||B.handleHash!==N){if(!await _.setIntegration(C.id,{version:(B?.version??0)+1,integrator:d.integrator,integratorName:d.integratorName,integratorTenantId:d.integratorTenantId,applicationId:d.applicationId,productId:d.productId,handleHash:N,status:"consent_requested",expiresAt:d.expiresAt,redeemAttempts:0,requestedAt:new Date().toISOString()},{expectedHandleHash:B?.handleHash??null,expectedVersion:B?.version}))return Response.json({error:"Integration request changed concurrently"},{status:409})}}return r.onConnectRequest({request:g,ion:e,staged:d,tenant:C})}async function m(g){if(g.method!=="POST")return Ge(["POST"]);let v=await c(g);if(v)return v;let{handle:d}=await l(g);await Wr(d,t);let C=await ht(d),_=a(),N=await _.getByIntegrationHandleHash(C);if(!N?.integration)return Response.json({status:"pending"},{status:202});let B=N.integration;if(Date.parse(B.expiresAt)<=Date.now())return Response.json({status:"expired"},{status:410});if(B.status==="consented"&&B.consentRedeemedAt)return Response.json({status:"consumed"},{status:410});let ee=t.maxRedeemAttempts??dd;if(B.redeemAttempts>=ee)return Response.json({status:"attempt_limit"},{status:429});let ie={...B,version:B.version+1,redeemAttempts:B.redeemAttempts+1},re=await _.setIntegration(N.id,ie,{expectedHandleHash:C,expectedVersion:B.version});if(!re?.integration)return Response.json({status:"pending"},{status:409});if(re.integration.status==="declined")return Response.json({status:"declined"},{status:200});if(re.integration.status!=="consented")return Response.json({status:"pending"},{status:202});let te=crypto.randomUUID().replace(/-/g,"")+crypto.randomUUID().replace(/-/g,""),ue={...re.integration,version:re.integration.version+1,consentRedeemedAt:new Date().toISOString(),exportTokenHash:await ht(te)};if(!await _.setIntegration(N.id,ue,{expectedHandleHash:C,expectedVersion:re.integration.version}))return Response.json({status:"consumed"},{status:409});return Response.json({status:"consented",tenantId:N.id,authorization:te,expiresAt:B.expiresAt})}async function T(g){if(g.method!=="POST")return Ge(["POST"]);let v=await c(g);if(v)return v;if(!r.exportConfig)return Response.json({error:"Config export is not supported"},{status:501});let{handle:d,authorization:C}=await l(g);if(!C)return Response.json({error:"authorization is required"},{status:400});await Wr(d,t);let _=await ht(d),N=a(),B=await N.getByIntegrationHandleHash(_),ee=B?.integration;if(!B||!ee||ee.status!=="consented"||ee.configExportedAt||!ee.exportTokenHash||ee.exportTokenHash!==await ht(C))return Response.json({error:"Export authorization is invalid or consumed"},{status:401});if(Date.parse(ee.expiresAt)<=Date.now())return Response.json({error:"Export authorization expired"},{status:410});let ie=await r.exportConfig({tenant:B}),re={...ee,version:ee.version+1,configExportedAt:new Date().toISOString(),exportTokenHash:void 0};if(!await N.setIntegration(B.id,re,{expectedHandleHash:_,expectedVersion:ee.version}))return Response.json({error:"Export authorization is already consumed"},{status:409});return Response.json(ie)}async function P(g){let v=await Wr(g.handle,t),d=await r.store.get(g.tenantId);if(!d)throw new be("Tenant not found",{status:404});if(v.tenantHint&&v.tenantHint!==d.id)throw new be("Staged request is bound to another tenant",{status:409});let C=await ht(g.handle),_=d.integration;if(_?.status==="consented"&&_.handleHash!==C)throw new be("A consented tenant cannot be rebound",{status:409});if(_&&_.handleHash!==C&&Date.parse(_.expiresAt)>Date.now())throw new be("Tenant already has an active integration request",{status:409});let N=new Date().toISOString(),B={version:(_?.handleHash===C?_.version:0)+1,integrator:v.integrator,integratorName:v.integratorName,integratorTenantId:v.integratorTenantId,productId:v.productId,applicationId:v.applicationId,handleHash:C,status:g.decision,expiresAt:v.expiresAt,redeemAttempts:_?.handleHash===C?_.redeemAttempts:0,requestedAt:_?.handleHash===C?_.requestedAt:N,decidedAt:N,decidedBy:g.decidedBy},ee=await a().setIntegration(d.id,B,{expectedHandleHash:_?.handleHash??null,expectedVersion:_?.version});if(!ee)throw new be("Integration request changed; reload and try again",{status:409});return ee}async function O(g){let d=new URL(g.url).pathname,C=Ys(r.basePath),_=`${C}/integrations`;if(wt(d)===`${_}/authorize`)return w(g);if(wt(d)===`${_}/redeem`)return m(g);if(wt(d)===`${_}/config-export`)return T(g);let N=md(d,r.basePath),B=wt(d)===C;if(!B&&!N)return me();if(!["GET","PUT","POST","DELETE"].includes(g.method))return Ge(["GET","PUT","POST","DELETE"]);if(g.method==="GET"&&B&&N==null)return me();let ee=await c(g);if(ee)return ee;if(g.method==="GET"){if(N==null)return me();let S=await r.store.get(N);if(!S)return me();let L=i(S,g),z=u(S);return Response.json(L?{...z,...L}:z,{status:200})}if(g.method==="DELETE"){if(!N)return me();let S=await r.store.get(N);if(S)await r.mirror?.purge(S.id);return await r.store.delete(N),new Response(null,{status:204})}if(!N&&g.method!=="POST")return me();let ie;try{ie=await g.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let re=g.method==="POST",te=re?await n.validate(ie):await o.validate(ie);if(te.issues)return ad(te.issues,re?"Tenant create validation failed":"Tenant update validation failed");let ue=re?te.value.id:N;if(!ue)return me();if(N!=null&&te.value.id!=null&&te.value.id!==N)return Response.json({error:"Path id must match body id"},{status:400});let W=await r.store.get(ue);if(W&&!$r(W.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let J=new Date,Y=W??{},ne;if(re){let S=te.value,L=S,z=L.status,H=$r(z)?z:W?.status??"completed";ne={...Y,...S,id:ue,companyId:S.companyId,companyName:S.companyName,environmentType:S.environmentType,configLocator:S.configLocator,email:S.email??W?.email,webhookUrl:S.webhookUrl??W?.webhookUrl,callbackUrl:S.callbackUrl??W?.callbackUrl,tenantUrl:L.tenantUrl??W?.tenantUrl,status:H,error:L.error??W?.error,actionUrl:L.actionUrl??W?.actionUrl,requestToken:L.requestToken??W?.requestToken,expiresAt:L.expiresAt??W?.expiresAt,createdAt:W?.createdAt??J,updatedAt:J}}else{let S=te.value,L=S,z=L.status,H=$r(z)?z:W?.status??"completed",{configLocator:k,...M}=S;ne={...Y,...M,id:ue,companyId:S.companyId??W?.companyId??"",companyName:S.companyName??W?.companyName??"",environmentType:S.environmentType??W?.environmentType??"DEV",email:S.email??W?.email,webhookUrl:S.webhookUrl??W?.webhookUrl,callbackUrl:S.callbackUrl??W?.callbackUrl,tenantUrl:L.tenantUrl??W?.tenantUrl,status:H,error:L.error??W?.error,actionUrl:L.actionUrl??W?.actionUrl,requestToken:L.requestToken??W?.requestToken,expiresAt:L.expiresAt??W?.expiresAt,configLocator:k??W?.configLocator,createdAt:W?.createdAt??J,updatedAt:J}}if(!ne.tenantUrl)ne.tenantUrl=pd(g,ue);if(!ne.callbackUrl){let S=i(ne,g);if(S)ne.callbackUrl=S.callbackUrl}if(W?.configLocator&&!Ds(W.configLocator,ne.configLocator))await r.mirror?.purge(W.id);let se=await r.store.upsert(ne);if(W?.integration?.status==="consented"&&ne.configLocator&&!Ds(W.configLocator,ne.configLocator)){await r.onHandoverApplied?.({tenant:se,previousLocator:W.configLocator});let S=a(),L=W.integration;await S.setIntegration(se.id,{...L,version:L.version+1,handoverAppliedAt:new Date().toISOString()},{expectedHandleHash:L.handleHash,expectedVersion:L.version})}let oe=gd(se);if(oe instanceof Response)return oe;return Response.json(oe.body,{status:oe.status})}async function E(g){try{if(!e.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await O(g)}catch(v){return At(v)}}return{handler:E,isReady:()=>!0,ready:async()=>{return},recordConsent:P,getTenant:async(g)=>r.store.get(g)}}var Mn="0.0.24-beta.20260922.10";import{assertEcid as Zs,jwtAssertionClaimsSchema as yd,must as Ue,workloadTokenResponseSchema as hd}from"@ionite/core";import{getCachedVerificationKey as wd,getJwks as vd}from"@ionite/core/server";function $e(e,t){return t in e&&e[t]!==void 0&&e[t]!==null}function Oe(e){if(e===void 0||e===null)return!1;return $e(e,"workloadId")||$e(e,"privateKey")}function Ve(e){if(e===void 0||e===null)return!1;let t=$e(e,"clientId"),r=$e(e,"clientSecret"),n=$e(e,"workloadId"),o=$e(e,"privateKey");return(t||r)&&!n&&!o}function jn(e){if(e===void 0||e===null)return!1;let t=$e(e,"jwksUri"),r=$e(e,"workloadId"),n=$e(e,"clientId"),o=$e(e,"clientSecret"),s=$e(e,"privateKey");return t&&!r&&!s&&!n&&!o}function Qs(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function Sd(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(Qs(t))return!1;let r=Object.entries(t);if(r.length===0)return!1;return r.every(([,n])=>Qs(n))}function oi(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if("incoming"in t||"outgoing"in t){if(t.incoming!==void 0&&(typeof t.incoming!=="object"||t.incoming===null))return!1;if(t.outgoing!==void 0&&(typeof t.outgoing!=="object"||t.outgoing===null||Array.isArray(t.outgoing)))return!1;return!0}return!1}function si(e){return oi(e)}function Wn(e){if(!e)return;if(si(e))return Array.isArray(e.incoming)?void 0:e.incoming;return e}function Vn(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function Ut(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function ei(e){if(!e)return[];if(Array.isArray(e))return e.filter((t)=>!!t&&typeof t.issuer==="string"&&typeof t.jwksUri==="string").map((t)=>({issuer:t.issuer,jwksUri:t.jwksUri,audience:t.audience,scopesAsEntitlements:t.scopesAsEntitlements}));if(e.issuer&&e.jwksUri)return[{issuer:e.issuer,jwksUri:e.jwksUri,audience:e.audience??[],scopesAsEntitlements:e.scopesAsEntitlements}];return[]}function kd(e){let t=e[0];if(!t)return;let r=Vn(t.audience);return{jwksUri:t.jwksUri,issuer:t.issuer,audience:typeof r[0]==="string"?r[0]:void 0}}function ti(e,t){let r=Ut(t);if(!r)return;return e.find((n)=>Ut(n.issuer)===r)}function qr(e,t,r){let n=Vn(e);if(t.some((o)=>n.includes(o)))return!0;if(typeof r==="string"&&t.includes(r))return!0;return!1}function $n(e){if(!e||!si(e))return{};return e.outgoing??{}}function bd(e){return{getToken:e.getToken,refreshToken:e.refreshToken,generateJWTAssertion:e.generateJWTAssertion,revokeToken:e.revokeToken,beforeChange:e.beforeChange,afterChange:e.afterChange,isReady:e.isReady,ready:e.ready}}var Fn=Symbol("ion.workloadClientState"),ii=Symbol("ion.namedWorkloadClients");function Mt(e,t){let r=ge(e,t);return{isReady:r.isReady,ready:r.ready}}function Rd(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...Mt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[Fn]:"unavailable"}}function ri(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it is no longer configured on this Ionite instance.`)};return{...Mt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[Fn]:"removed"}}function Cd(e){if(!e)return"removed";return e[Fn]??"available"}function qn(e,t,r){let n=e,o=n,s=new Set;for(let i of r){if(s.add(i),i in o)continue;let a=t[i];o[i]=a?bd(a):Rd(i)}return Object.defineProperty(o,ii,{value:s,enumerable:!1,configurable:!0}),n}function ni(e){if(!e)return[];let t=e[ii];return t?Array.from(t):[]}function Td(e,t,r){let n=t,o=We(r,`Workload client "${e}"`),s=()=>Cd(n)==="available",i=ge(`Workload client "${e}"`,s);return{api:{beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:i.isReady,ready:i.ready,getToken:(c)=>n.getToken(c),refreshToken:(c)=>n.refreshToken(c),generateJWTAssertion:(c)=>n.generateJWTAssertion(c),revokeToken:(c)=>n.revokeToken(c)},update(c){if(c===n)return;o.emitBefore(),n=c,i.refresh(),o.emitAfter()}}}function ai(e){let t,r=!1,n=ge("Workload module",()=>r),o=We(e,"Workload"),s=new Map,i=new Set,a=new Set(["beforeChange","afterChange","isReady","ready"]),c=(m)=>{if(!t)throw Error(`${m} is unavailable because workload is not configured on this Ionite instance.`);return t},u={beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:n.isReady,ready:n.ready,get config(){return t?.config??{}},getToken(...m){return c("getToken").getToken(...m)},refreshToken(m){return c("refreshToken").refreshToken(m)},generateJWTAssertion(m){return c("generateJWTAssertion").generateJWTAssertion(m)},revokeToken(m){return c("revokeToken").revokeToken(m)},validateToken(m){return c("validateToken").validateToken(m)},getWorkloadIdentity(m){return c("getWorkloadIdentity").getWorkloadIdentity(m)},parseJWT(m){return c("parseJWT").parseJWT(m)},handler(m){return c("handler").handler(m)}},l=(m)=>{for(let O of i)delete u[O];if(i.clear(),!m)return;let T=new Set(ni(m)),P=new Set([...a,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...T]);for(let[O,E]of Object.entries(m)){if(P.has(O))continue;u[O]=E,i.add(O)}},w=(m)=>{let T=s.get(m);if(T)return T;let P=Td(m,ri(m),e);if(s.set(m,P),!(m in u))u[m]=P.api;return P};return{update(m){if(!m&&!r&&s.size===0)return;o.emitBefore(),r=m!==void 0,n.refresh(),t=m;let T=new Set(ni(m));for(let P of T){let O=m[P];w(P).update(O)}for(let[P,O]of s){if(T.has(P))continue;O.update(ri(P))}return l(m),o.emitAfter(),u}}}async function Nn(e,t,r){if(e===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let n=r[e];if(!n)throw Error(`Unknown workload client: ${e}`);return n.getToken(t)}function Kn(e,t){return`${e}|${t??""}`}function Ye(e,t,r,n,o){let s={jwtAssertionClaims:e?.jwtAssertionClaims??yd("server"),tokenResponse:e?.tokenResponse??hd("server")},i=async(p,f)=>{let R=p;if(typeof R.validate==="function")return R.validate(f);return p["~standard"].validate(f)};if(!r&&!n)return;if(r&&oi(r)){let p=r.incoming,f=ei(p),R=Array.isArray(p)?kd(p):p,A=Wn(n),V=$n(n),X=R?{...R,...A,jwksUri:R.jwksUri,issuer:R.issuer}:A;if(!X||!X.tokenUrl&&!X.jwksUri)t.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let F=X&&(X.tokenUrl||X.jwksUri)?Ye(e,t,R??void 0,A,f):void 0,ae=Array.from(new Set([...Object.keys(r.outgoing??{}),...Object.keys(V)])).map((le)=>[le,{...r.outgoing?.[le]??{},...V[le]??{}}]),Q={};for(let[le,at]of ae){let Fe=Ye(e,t,at,void 0);if(Fe)Q[le]=Fe}if(!F&&Object.keys(Q).length===0)return;let he={...F?.config??{},config:F?.config??{},...Mt("workload",()=>F?.isReady()===!0||Object.values(Q).some((le)=>le.isReady())),getToken:async(le,at)=>Nn(le,at,Q),getServerToken:async(le)=>{if(!F)throw Error("No server workload config");return F.getToken(le)},refreshToken:async(le)=>{if(!F)throw Error("No default workload config");return F.refreshToken(le)},generateJWTAssertion:async(le)=>{if(!F)throw Error("No default workload config");return F.generateJWTAssertion(le)},revokeToken:async(le)=>{if(!F)throw Error("No default workload config");return F.revokeToken(le)},validateToken:async(le)=>{if(!F)throw Error("No default workload config");return F.validateToken(le)},getWorkloadIdentity:async(le)=>{if(!F)return;return F.getWorkloadIdentity(le)},parseJWT:async(le)=>{if(!F)throw Error("No default workload config");return F.parseJWT(le)},handler:async(le)=>{if(!F)return me();return F.handler(le)}};return qn(he,Q,ae.map(([le])=>le))}if(r&&Sd(r)){let p=Wn(n),f=$n(n),R=r.default,A=R?{...R,...p,jwksUri:R.jwksUri,issuer:R.issuer}:p;if(!A||!A.tokenUrl&&!A.jwksUri)t.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let V=A&&(A.tokenUrl||A.jwksUri)?Ye(e,t,R??void 0,p):void 0,X=Array.from(new Set([...Object.keys(r).filter((Q)=>Q!=="default"),...Object.keys(f)])).map((Q)=>[Q,{...Q in r?r[Q]:{},...f[Q]??{}}]),F={};for(let[Q,he]of X){let le=Ye(e,t,he,void 0);if(le)F[Q]=le}if(!V&&Object.keys(F).length===0)return;let ae={...V?.config??{},config:V?.config??{},...Mt("workload",()=>V?.isReady()===!0||Object.values(F).some((Q)=>Q.isReady())),getToken:async(Q,he)=>Nn(Q,he,F),getServerToken:async(Q)=>{if(!V)throw Error("No server workload config");return V.getToken(Q)},refreshToken:async(Q)=>{if(!V)throw Error("No default workload config");return V.refreshToken(Q)},generateJWTAssertion:async(Q)=>{if(!V)throw Error("No default workload config");return V.generateJWTAssertion(Q)},revokeToken:async(Q)=>{if(!V)throw Error("No default workload config");return V.revokeToken(Q)},validateToken:async(Q)=>{if(!V)throw Error("No default workload config");return V.validateToken(Q)},getWorkloadIdentity:async(Q)=>{if(!V)return;return V.getWorkloadIdentity(Q)},parseJWT:async(Q)=>{if(!V)throw Error("No default workload config");return V.parseJWT(Q)},handler:async(Q)=>{if(!V)return me();return V.handler(Q)}};return qn(ae,F,X.map(([Q])=>Q))}let a=Wn(n),c=$n(n);if(!r&&Object.keys(c).length>0){let p={};for(let[A,V]of Object.entries(c)){let X=Ye(e,t,V,void 0);if(X)p[A]=X}let f=a&&(a.tokenUrl||a.jwksUri)?Ye(e,t,a,void 0):void 0;if(!f&&Object.keys(p).length===0)return;let R={...f?.config??{},config:f?.config??{},...Mt("workload",()=>f?.isReady()===!0||Object.values(p).some((A)=>A.isReady())),getToken:async(A,V)=>Nn(A,V,p),getServerToken:async(A)=>{if(!f)throw Error("No server workload config");return f.getToken(A)},refreshToken:async(A)=>{if(!f)throw Error("No default workload config");return f.refreshToken(A)},generateJWTAssertion:async(A)=>{if(!f)throw Error("No default workload config");return f.generateJWTAssertion(A)},revokeToken:async(A)=>{if(!f)throw Error("No default workload config");return f.revokeToken(A)},validateToken:async(A)=>{if(!f)throw Error("No default workload config");return f.validateToken(A)},getWorkloadIdentity:async(A)=>{if(!f)return;return f.getWorkloadIdentity(A)},parseJWT:async(A)=>{if(!f)throw Error("No default workload config");return f.parseJWT(A)},handler:async(A)=>{if(!f)return me();return f.handler(A)}};return qn(R,p,Object.keys(c))}let u=r,l=o??ei(u),w=a?.tokenUrl,m=w?.startsWith("/")?w:void 0,T=u?.idpTokenUrl??a?.idpTokenUrl??(u?.tokenUrl&&(u.tokenUrl.startsWith("http://")||u.tokenUrl.startsWith("https://"))?u.tokenUrl:void 0),P={...u,...a,tokenUrl:m??a?.tokenUrl??u?.tokenUrl,idpTokenUrl:T,jwksUri:u?.jwksUri,issuer:u?.issuer};P._handlerTokenUrl=m;let O,E=P,g=Oe(P),v=Ve(P),d=jn(P);if(!g&&!v&&!d){if(!u||Object.keys(u).length===0)return;throw t.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(P),clientId:E.clientId,clientSecret:E.clientSecret?"[REDACTED]":void 0,workloadId:E.workloadId,privateKey:E.privateKey?"[REDACTED]":void 0,jwksUri:E.jwksUri,tokenUrl:E.tokenUrl,idpTokenUrl:E.idpTokenUrl,fromVaultKeys:u?Object.keys(u):[],fromCodeKeys:n?Object.keys(n):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(g)O={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:Ue(P.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:Ue(P.privateKey,"Missing 'privateKey' from Workload Config"),audience:Ue(P.audience,"Missing 'audience' from Workload Config"),scope:P.scope??"",algorithm:P.algorithm??"RS256",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new ct};else if(Ve(P))O={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:Ue(P.clientId,"Missing 'clientId' from Workload Config"),clientSecret:Ue(P.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:P.scope??"",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new ct};else if(jn(P))O=P;function C(){let p=new Uint8Array(16);return crypto.getRandomValues(p),Array.from(p,(f)=>f.toString(16).padStart(2,"0")).join("")}function _(p){let f;if(typeof p==="string")f=btoa(p);else f=btoa(String.fromCharCode(...p));return f.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function N(p){let f=p.replace(/-/g,"+").replace(/_/g,"/");while(f.length%4)f+="=";return atob(f)}function B(p){if(p.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:p==="RS256"?"SHA-256":p==="RS384"?"SHA-384":"SHA-512"};else if(p.startsWith("ION"))return{name:"ECDSA",namedCurve:p==="ES256"?"P-256":p==="ES384"?"P-384":"P-521",hash:p==="ES256"?"SHA-256":p==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${p}`)}async function ee(p,f){let R=p.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),A=Uint8Array.from(atob(R),(X)=>X.charCodeAt(0)),V=B(f);return crypto.subtle.importKey("pkcs8",A,V,!1,["sign"])}async function ie(p,f,R){let A=await ee(f,R),X=new TextEncoder().encode(p),F=B(R),ae=await crypto.subtle.sign(F,A,X);return _(new Uint8Array(ae))}async function re(p,f=3,R=1000,A=30000){let V=Error("Placeholder Error");for(let X=0;X<=f;X++)try{return await p()}catch(F){if(V=F instanceof Error?F:Error(String(F)),V.message.includes("400")||V.message.includes("401")||V.message.includes("403")||V.message.includes("404"))throw V;if(X<f){let ae=Math.min(R*2**X,A),Q=Math.random()*ae*0.1;await new Promise((he)=>setTimeout(he,ae+Q))}}throw V}async function te(p){if(!Oe(O))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=O,R=Math.floor(Date.now()/1000),A={iss:f.workloadId,sub:f.workloadId,aud:f.audience??"",exp:R+f.tokenLifetime,iat:R,jti:C(),scope:p??f.scope},V={alg:f.algorithm,typ:"JWT",kid:f.keyId},X=_(JSON.stringify(V)),F=_(JSON.stringify(A)),ae=`${X}.${F}`,Q=await ie(ae,f.privateKey,f.algorithm);return`${ae}.${Q}`}async function ue(p){if(!Oe(O))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=O;return re(async()=>{let R=f.idpTokenUrl,A=await te(p),V=new URLSearchParams;if(V.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),V.append("assertion",A),p)V.append("scope",p);let X=await fetch(R,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:V.toString()}),F=await X.json();if(!X.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:F});let Q=F;throw Error(`Token acquisition failed: ${Q.error||X.statusText} - ${Q.error_description||""}`.trim())}let ae=await i(s.tokenResponse,F);if(ae.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:ae.issues}),Error(`Token response validation failed: ${ae.issues.map((Q)=>Q.message).join("; ")}`);if(f.tokenStore){let Q=new Date(Date.now()+(ae.value.expires_in??300)*1000),he={workload_id:Kn(f.workloadId,p),access_token:ae.value.access_token,token_type:ae.value.token_type,scope:ae.value.scope,expires_at:Q,created_at:new Date,refresh_token:ae.value.refresh_token};await f.tokenStore.set(he)}return ae.value})}async function W(p){if(!Ve(O))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let f=O;return re(async()=>{let R=f.idpTokenUrl,A=new URLSearchParams;if(A.append("grant_type","client_credentials"),A.append("client_id",f.clientId),A.append("client_secret",f.clientSecret),p)A.append("scope",p);let V=await fetch(R,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:A.toString()}),X=await V.json();if(!V.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:X});let ae=X;throw Error(`Token acquisition failed: ${ae.error||V.statusText} - ${ae.error_description||""}`.trim())}let F=await i(s.tokenResponse,X);if(F.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:F.issues}),Error(`Token response validation failed: ${F.issues.map((ae)=>ae.message).join("; ")}`);if(f.tokenStore){let ae=new Date(Date.now()+(F.value.expires_in??300)*1000),Q={workload_id:Kn(f.clientId,p),access_token:F.value.access_token,token_type:F.value.token_type,scope:F.value.scope,expires_at:ae,created_at:new Date,refresh_token:F.value.refresh_token};await f.tokenStore.set(Q)}return F.value})}let J=new Map;function Y(p,f){let R=J.get(p);if(R)return R;let A=(async()=>(Oe(O)?await ue(f??""):await W(f??"")).access_token)();return J.set(p,A),A.catch(()=>{return}).finally(()=>{if(J.get(p)===A)J.delete(p)}),A}async function ne(p){if(!Oe(O)&&!Ve(O)){let V=O;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!V.clientId}, hasClientSecret=${!!V.clientSecret}, hasWorkloadId=${!!V.workloadId}, hasPrivateKey=${!!V.privateKey}, hasJwksUri=${!!V.jwksUri}`)}let f=O;p=p??f.scope;let R=Oe(O)?O.workloadId:O.clientId,A=Kn(R,p);if(f.tokenStore){let V=await f.tokenStore.get(A);if(V){let X=Date.now(),F=V.expires_at.getTime(),ae=f.refreshThreshold*1000;if(X+ae<F)return V.access_token;if(f.autoRefresh)try{return await Y(A,p)}catch(Q){if(X<F)return t.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},Q),V.access_token;throw Q}}}return Y(A,p)}async function se(p){if(!Oe(O)&&!Ve(O))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=O;return p=p??f.scope,Oe(f)?await ue(p):await W(p)}async function oe(p){if(!Oe(O)&&!Ve(O))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");try{if(!O.revocationEndpoint)return;let f=new URLSearchParams;if(f.append("token",p),f.append("token_type_hint","access_token"),Oe(O)){let A=O;f.append("client_id",A.workloadId)}else if(Ve(O)){let A=O;f.append("client_id",A.clientId),f.append("client_secret",A.clientSecret)}let R=await fetch(O.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:f.toString()});if(!R.ok)t.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:R.status,statusText:R.statusText});else t.info("Token revoked successfully",{"ion.module":"workload"});if(O.tokenStore){let A;if(Oe(O))A=O.workloadId;else if(Ve(O))A=O.clientId;else return;await O.tokenStore.delete(A)}}catch(f){t.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},f)}}async function S(p,f){let R=p??O?.jwksUri;if(!R)throw Error("No JWKS URI configured in Workload Config");return await vd(R,t,f)}async function L(p,f){let R=f??O?.jwksUri;if(!R)throw Error("No JWKS URI configured in Workload Config");let A=Oe(O)?O.algorithm:"RS256";return wd(R,p,`wl:${A}`,(V)=>{let X=V.alg||A,F=B(X);return crypto.subtle.importKey("jwk",V,F,!1,["verify"])},t)}function z(p){let f=p.split(".");if(f.length!==3)throw Error("Invalid JWT");return JSON.parse(N(f[1]))}async function H(p,f){try{let R=p.split(".");if(R.length!==3)throw Error("Invalid JWT");let A=JSON.parse(N(R[0])),V=JSON.parse(N(R[1])),X=await L(A.kid,f),F=R[2],Q=new TextEncoder().encode(`${R[0]}.${R[1]}`),he=Uint8Array.from(N(F),(qt)=>qt.charCodeAt(0)),le=B(A.alg);if(!await crypto.subtle.verify(le,X,he,Q))throw Error("Invalid JWT signature");let Fe=await i(s.jwtAssertionClaims,V);if(Fe.issues)throw t.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:Fe.issues}),Error(`JWT claims validation failed: ${Fe.issues.map((qt)=>qt.message).join("; ")}`);return Fe.value}catch(R){throw t.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},R),R}}async function k(p){if(!Oe(O)&&!Ve(O)&&!jn(O))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(l.length>0){let A=z(p),V=typeof A.iss==="string"?A.iss:void 0,X=ti(l,V);if(!X)return{valid:!1,error:"Untrusted token issuer"};let F=await H(p,X.jwksUri),ae=Math.floor(Date.now()/1000);if(F.exp&&F.exp<ae)return{valid:!1,error:"Token expired"};let Q=Vn(X.audience);if(Q.length>0&&!qr(F.aud,Q,F.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:F,expiresAt:F.exp?new Date(F.exp*1000):void 0}}let f=await H(p),R=Math.floor(Date.now()/1000);if(f.exp&&f.exp<R)return{valid:!1,error:"Token expired"};if(Oe(O)){if(O.audience&&!qr(f.aud,[O.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else if(Ve(O)){if(O.issuer&&Ut(f.iss)!==Ut(O.issuer))return{valid:!1,error:"Invalid issuer"};if(O.audience&&!qr(f.aud,[O.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else{let A=O;if(A.issuer&&Ut(f.iss)!==Ut(A.issuer))return{valid:!1,error:"Invalid issuer"};if(A.audience&&!qr(f.aud,[A.audience],f.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:f,expiresAt:f.exp?new Date(f.exp*1000):void 0}}catch(f){return{valid:!1,error:f instanceof Error?f.message:String(f)}}}function M(p,f){let R=p[f];return typeof R==="string"&&R.trim()?R.trim():void 0}function I(p){if(!p)return;return p.startsWith("service-account-")?p.slice(16):p}function j(p){return M(p,"client_id")??M(p,"clientId")??M(p,"azp")??M(p,"appid")??I(M(p,"preferred_username"))}let K=new WeakMap;function h(p){let f=K.get(p);if(f)return f;let R=x(p);return K.set(p,R),R}async function x(p){let f=p.headers.get("Authorization");if(!f?.startsWith("Bearer "))return;let R=f.substring(7),A=await k(R);if(!A.valid||!A.claims)return;let V=l.length>0?ti(l,A.claims.iss):void 0,X=A.claims.ecid,F={workloadId:A.claims.sub,clientId:j(A.claims),scope:A.claims.scope,scopesAsEntitlements:V?.scopesAsEntitlements,...X!==void 0&&X!==null?{ecid:Zs(X)}:{},claims:A.claims},ae=O?.workloadIdentityStore;if(ae){let Q=F.clientId??F.workloadId??F.claims.sub,he=Q?await ae.get(Q):void 0;if(he){if(he.active===!1)return;if(he.scopes?.length){let le=new Set([...(F.scope??"").split(/\s+/).filter(Boolean),...he.scopes]);F.scope=Array.from(le).join(" ")}if(!F.ecid&&he.ecid)F.ecid=Zs(he.ecid)}}return F}async function b(p){if(!O)throw Error("ionite Workload Manager not initialized");let f=new URL(p.url).pathname,R=(X)=>{if(!X)return;try{return new URL(X).pathname}catch{return X.startsWith("/")?X:`/${X}`}};if(R(O.validateUrl)===f&&p.method==="POST"){let X=p.headers.get("Authorization");if(!X?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let F=X.substring(7),ae=await k(F);if(!ae.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:ae.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(R(O.jwksUrl)===f&&p.method==="GET"){let X=await S();return new Response(JSON.stringify(X),{headers:[["Content-Type","application/json"]]})}return me()}return{...O,...Mt("workload",()=>!0),getToken:ne,refreshToken:se,generateJWTAssertion:te,revokeToken:oe,validateToken:k,getWorkloadIdentity:h,parseJWT:H,handler:b}}function Dn(e){return e=e??"Workload authentication unavailable",new Response(JSON.stringify({error:e}),{status:503,statusText:e,headers:{"Content-Type":"application/json"}})}var Nr="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",Pd="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function Id(e,t){Ue(t,Nr);let r=t.workload;if(!r)return;return r.getWorkloadIdentity(e)}async function Od(e,t,r){Ue(t,Nr);let n=t.workload;if(!n)throw Dn();let o=n;if(typeof o.getServerToken!=="function"||typeof o.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return o.getToken(e,r)}async function Ed(e,t){Ue(t,Pd);let r="validateToken"in t&&typeof t.validateToken==="function"?t:t.workload;if(!r)return{valid:!1,error:"Workload authentication unavailable"};let n=e.headers.get("Authorization");if(!n?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let o=n.substring(7);return r.validateToken(o)}async function Ad(e,t){Ue(t,Nr);let r=t.workload;if(!r)throw Dn();return r.revokeToken(e)}async function _d(e,t){Ue(t,Nr);let r=t.workload;if(!r)throw Dn();return r.handler(e)}export*from"@ionite/core";import{AssignmentPolicyError as ny,generateULID as oy,IoniteError as sy,listGenerator as iy}from"@ionite/core";import{allowHosts as cy,allowOrigins as uy,allowRelativePaths as dy,allowSameOrigin as ly,blockDangerousUrls as fy,CatalogAdjacencyCache as py,callback as my,captureRedirect as gy,ciam as yy,collectReferencedDefinitions as hy,defaultRedirectPolicies as wy,discoverSessionRecords as vy,discoverSessions as Sy,expandRoot as ky,getCustomer as by,getUser as Ry,has as Cy,hasAll as Ty,hasAllScope as Py,hasAny as Iy,hasAnyScope as Oy,hasGroup as Ey,hasPermission as Ay,hasRole as _y,hasScope as Ly,InMemoryTenantStore as xy,iam as Uy,initiateLogin as My,isRedirectAllowed as jy,listSsoClientIdsFromCookies as Wy,reconcileSubjectAccess as $y,resolveAfterRedirect as qy,resolveCapturedRedirect as Ny,resolveRedirect as Ky,sameOriginRedirectRules as Vy,sendTenantWebhook as Fy,sso as Dy,verifyUser as zy,withSetCookies as By}from"@ionite/core/server";import{accessRefId as it,accessRootId as ci,assertRequiredSubjectType as ui,list as Ld}from"@ionite/core";function Bn(e){let{createdAt:t,updatedAt:r,...n}=e;return n}class Xe{constructor(){this.roots=new Map;this.byTarget=new Map;this.bySubject=new Map}static targetKey(e,t){return`${e}:${t}`}static subjectKey(e,t){return`${e}:${t}`}indexAdd(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}indexRemove(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}deindex(e){this.indexRemove(this.byTarget,Xe.targetKey(e.targetType,it(e.target)),e.id),this.indexRemove(this.bySubject,Xe.subjectKey(e.subjectType,it(e.subject)),e.id)}index(e){this.indexAdd(this.byTarget,Xe.targetKey(e.targetType,it(e.target)),e.id),this.indexAdd(this.bySubject,Xe.subjectKey(e.subjectType,it(e.subject)),e.id)}resolve(e,t){if(!e)return[];let r=[];for(let n of e){let o=this.roots.get(n);if(o&&(o.status??"active")==="active"&&t(o))r.push(o)}return r}async grant(e){ui(e.subjectType,"Access change subjectType");let t=e.id??ci(e),r=new Date,n=this.roots.get(t);if(n)this.deindex(n);let o={...e,id:t,status:e.status??"active",createdAt:n?.createdAt??r,updatedAt:r};this.roots.set(t,o),this.index(o)}async revoke(e){let t=e.id??ci(e),r=this.roots.get(t);if(r)this.deindex(r);this.roots.delete(t)}async get(e){let t=this.roots.get(e);return t?Bn(t):void 0}async list(e){let t=Array.from(this.roots.values()).filter((r)=>(r.status??"active")==="active");return zn(t,e)}async listByTarget(e,t,r){let n=t.trim(),o=this.byTarget.get(Xe.targetKey(e,n)),s=this.resolve(o,(i)=>i.targetType===e&&it(i.target)===n);return zn(s,r)}async listByTargets(e){let t=new Map;for(let{targetType:r,target:n}of e){let o=`${r}:${n}`;if(t.has(o))continue;let s=n.trim(),i=this.byTarget.get(Xe.targetKey(r,s)),a=this.resolve(i,(c)=>c.targetType===r&&it(c.target)===s);t.set(o,a.map((c)=>Bn(c)))}return t}async listBySubject(e,t,r){ui(t);let n=it(e),o=this.bySubject.get(Xe.subjectKey(t,n)),s=this.resolve(o,(i)=>i.subjectType===t&&it(i.subject)===n);return zn(s,r)}}function zn(e,t){let r=Math.max(0,t?.start??0),n=t?.limit,o=n!=null?r+n:void 0;return Ld(e.length,e.slice(r,o).map(Bn),r,n)}import{assertValidSubjectTypeScoping as di,deepEqualPlain as xd,list as li,readyCatalogEntry as Gn}from"@ionite/core";class fi{constructor(){this.listeners=new Set;this.emit=(e)=>{for(let t of this.listeners)t(e)};this.groups=new Kr("group",this.emit);this.roles=new Kr("role",this.emit);this.permissions=new Kr("permission",this.emit)}afterChange(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}}class pi{constructor(){this.items=new Map;this.listeners=new Set}async get(e){return this.items.get(e)}async list(e){let t=Array.from(this.items.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=n!=null?r+n:void 0;return li(t.length,t.slice(r,o),r,n)}async children(e){return Array.from(this.items.values()).filter((t)=>(typeof t.parent==="string"?t.parent:t.parent?.id)===e)}changed(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}set(e){this.items.set(e.id,e),this.emitChange({id:e.id})}delete(e){if(!this.items.delete(e))return;this.emitChange({id:e,deleted:!0})}emitChange(e){for(let t of this.listeners)t(e)}}class Kr{constructor(e,t){this.kind=e;this.emit=t;this.items=new Map}async get(e){return this.items.get(e)}set(e){di(e);let t=this.items.get(e.id),r=!t||!xd(t,e);if(this.items.set(e.id,e),r)this.emit({op:"set",kind:this.kind,entity:e,previous:t});return Gn(e,Promise.resolve())}insertIfAbsent(e){di(e);let t=this.items.get(e.id);if(t)return Gn(t,Promise.resolve());return this.items.set(e.id,e),this.emit({op:"set",kind:this.kind,entity:e,previous:void 0}),Gn(e,Promise.resolve())}async delete(e){let t=this.items.get(e);if(!t)return;this.items.delete(e),this.emit({op:"delete",kind:this.kind,entity:t})}async list(e){let t=Array.from(this.items.values()),r=e?.filter?.requestable;if(r!==void 0)t=t.filter((i)=>Boolean(i.requestable)===r);let n=Math.max(0,e?.start??0),o=e?.limit,s=o!=null?n+o:void 0;return li(t.length,t.slice(n,s),n,o)}}import{accessRefId as Ze,assertRequiredSubjectType as jt}from"@ionite/core";function Qe(e,t){return`${t}:${e}`}function Hn(e,t,r){return`${e}:${t}:${r}`}function Ud(e,t,r,n){return`${Hn(e,t,r)}:${n??""}`}class mi{constructor(){this.rows=new Map;this.byTriple=new Map;this.byRoot=new Map;this.bySubject=new Map;this.edgeMeta=new Map;this.disabledSubjects=new Set}async has(e,t,r,n,o){jt(o);let s=Ze(e),i=Ze(r);if(!s||!i)return{allow:!1};if(this.disabledSubjects.has(Qe(s,o)))return{allow:!1,metadata:{reason:"subject_disabled"}};let a=Hn(Qe(s,o),t,i),c=n?Ze(n):void 0;if(c===void 0){let w=this.byTriple.get(a);if(w&&w.size>0)return this.allow(s,o,t,i,void 0);return{allow:!1}}let u=`${a}:${c}`,l=`${a}:`;if(this.rows.has(u))return this.allow(s,o,t,i,c);if(this.rows.has(l))return this.allow(s,o,t,i,void 0);return{allow:!1}}async hasGroup(e,t,r,n){return this.has(e,"group",t,r,n)}async hasRole(e,t,r,n){return this.has(e,"role",t,r,n)}async hasPermission(e,t,r,n){return this.has(e,"permission",t,r,n)}async hasAny(e,t,r){for(let n of t){let o=await this.has(e,n.targetType,n.target,n.resource,r);if(o.allow)return o}return{allow:!1}}async hasAll(e,t,r){if(this.disabledSubjects.has(Qe(Ze(e),r)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(t.length===0)return{allow:!0};let n=[];for(let o of t){let s=await this.has(e,o.targetType,o.target,o.resource,r);if(!s.allow)return{allow:!1,matched:n};if(s.matched)n.push(...s.matched)}return{allow:!0,matched:n}}async materialize(e,t){this.removeRoot(e),this.addRootEdges(e,t)}async replaceSubject(e,t,r){let n=Qe(Ze(e),t),o=new Map;for(let s of r){jt(s.subjectType,"Effective edge subjectType");let i=Qe(Ze(s.subject),s.subjectType);if(i!==n)throw Error(`AccessIndex.replaceSubject received an edge for ${i}; expected ${n}.`);let a=o.get(s.rootId);if(a)a.push(s);else o.set(s.rootId,[s])}this.clearSubjectEdges(n);for(let[s,i]of o)this.addRootEdges(s,i)}addRootEdges(e,t){let r=new Set;for(let n of t){jt(n.subjectType,"Effective edge subjectType");let o=Qe(n.subject,n.subjectType),s=Hn(o,n.targetType,n.target),i=Ud(o,n.targetType,n.target,n.resource);this.addToSet(this.rows,i,e),this.addToSet(this.byTriple,s,i),this.addToSet(this.bySubject,o,i),this.edgeMeta.set(i,{triple:s,subjectId:o}),r.add(i)}if(r.size>0)this.byRoot.set(e,r)}async removeByRoot(e){this.removeRoot(e)}removeRoot(e){let t=this.byRoot.get(e);if(!t)return;for(let r of t){let n=this.rows.get(r);if(!n)continue;if(n.delete(e),n.size===0)this.dropEdge(r)}this.byRoot.delete(e)}async listSubjects(){let e=[];for(let[t,r]of this.bySubject){if(r.size===0)continue;let n=t.indexOf(":");if(n<=0)throw Error(`AccessIndex subject key "${t}" is missing a subjectType prefix.`);let o=t.slice(0,n);jt(o,"AccessIndex subject key subjectType"),e.push({subjectType:o,subject:t.slice(n+1)})}return e}async setSubjectDisabled(e,t,r){let n=Qe(Ze(e),t);if(r)this.disabledSubjects.add(n);else this.disabledSubjects.delete(n)}async isSubjectDisabled(e,t){return jt(t),this.disabledSubjects.has(Qe(Ze(e),t))}async clear(e,t){if(e===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}jt(t);let r=Ze(e);this.clearSubjectEdges(Qe(r,t))}clearSubjectEdges(e){let t=this.bySubject.get(e);if(!t)return;for(let r of[...t]){let n=this.rows.get(r);if(n)for(let o of n){let s=this.byRoot.get(o);if(s?.delete(r)&&s.size===0)this.byRoot.delete(o)}this.dropEdge(r)}}allow(e,t,r,n,o){return{allow:!0,matched:[{subject:e,subjectType:t,targetType:r,target:n,resources:o?[o]:void 0}]}}addToSet(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}dropEdge(e){this.rows.delete(e);let t=this.edgeMeta.get(e);if(t)this.removeFromSet(this.byTriple,t.triple,e),this.removeFromSet(this.bySubject,t.subjectId,e);this.edgeMeta.delete(e)}removeFromSet(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}}function Jn(e){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function Md(e,t){return{...e,subscribe:async(r,n,o)=>{try{return await e.subscribe(r,n,o)}catch(s){if(!(s instanceof xe))throw s;return await Je(e,r,n,t,void 0,o)}}}}function Vr(e){let t=mt(e.path,"path","azureConfig");yt(e.ttl);let r=e.vault??Mr({type:"azure",authMethod:e.authMethod,entraTenantId:e.entraTenantId,clientId:e.clientId,clientSecret:e.clientSecret,federatedTokenFile:e.federatedTokenFile,managedIdentityClientId:e.managedIdentityClientId,imdsApiVersion:e.imdsApiVersion,vaultUrl:e.vaultUrl,vaultName:e.vaultName,apiVersion:e.apiVersion,secretNameTransform:e.secretNameTransform,secretNamePrefix:e.secretNamePrefix,scope:e.scope,ttl:e.ttl}),n=e.ttl?Md(r,e.ttl):r;return{load:async()=>{try{return(await n.getFullSecret(t)).data}catch(o){let s=o instanceof Error?o.message:String(o);throw Error(`Error retrieving remote config from Azure Key Vault: ${s}`,{cause:o})}},subscribe:(o,s)=>n.subscribe(t,(i)=>{o(i.data)},s),secret:n}}import{IoniteError as Zd}from"@ionite/core";function Yn(e){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as Nd,remoteConfigSecretType as Kd}from"@ionite/core";import{defaultLogger as jd,defaultSecretContentType as Wd,stableConfigHash as gi}from"@ionite/core";var $d=1e4;function qd(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Xn(e){if(e.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let t=Array.from(new Set(e.paths.map((E)=>E.trim()).filter(Boolean)));if(t.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let r=e.logger??jd,n=[],o=Promise.resolve(),s=!1,i=!1,a=!1,c=ge("Secrets mirror",()=>s&&!a),u=(E)=>{let g=e.mapPath(E).trim();if(!g)throw Error(`mirrorSecrets mapPath returned an empty target for "${E}"`);return g},l=(E)=>{let g=o.then(E);return o=g.catch((v)=>{i=!0,r.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:v instanceof Error?v.message:String(v)})}),g},w=async(E)=>{if(await e.to.exists(E))await e.to.deleteSecret(E)},m=async(E,g)=>{if(a)return;if(!qd(g.data))throw Error(`mirrorSecrets can only re-store object values (source path "${E}")`);if(e.accept&&!e.accept(g,E))return;let v=u(E);if(await e.to.exists(v)){let d=await e.to.getSecret(v);if(gi(d)===gi(g.data)){i=!1;return}}await e.to.putSecret(v,g.data,{contentType:g.metadata.contentType??Wd()}),i=!1},T=async(E)=>{await w(u(E)),i=!1},P=(E)=>{if(E.event!=="path_removed")return t.includes(E.path)?[E.path]:[];let g=`${E.path.replace(/\/+$/g,"")}/`;return t.filter((v)=>v===E.path||v.startsWith(g))},O=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if(e.from.subscribeEvents)n.push(e.from.subscribeEvents((E)=>{if(O.has(E.event)){let g=P(E);if(g.length>0)l(async()=>{for(let v of g)await T(v)})}try{e.onEvent?.(E)}catch(g){r.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:E.path,event:E.event,error:g instanceof Error?g.message:String(g)})}}));return(async()=>{let E=new Set(t);for(;;){try{for(let g of[...E]){let v=await e.from.subscribe(g,(d)=>{l(()=>m(g,d))},e.subscription);if(a){v();return}n.push(v),E.delete(g)}if(await o,a)return;s=!0,c.refresh();return}catch(g){if(a)return;i=!0,r.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:g instanceof Error?g.message:String(g)})}if(await new Promise((g)=>{setTimeout(g,$d).unref?.()}),a)return}})(),{isReady:c.isReady,ready:c.ready,isAvailable:()=>s&&!a&&!i&&(e.from.isAvailable?.()??!0)&&(e.to.isAvailable?.()??!0),async purge(){if(a)throw Error("Secrets mirror is closed");await l(async()=>{for(let E of t)await T(E)})},async close(){if(a)return;a=!0;for(let E of n.splice(0))E();c.refresh(),c.settle(),await o}}}function Wt(e){return typeof e.getFullSecret==="function"}function Zn(e){let t=e;return typeof t.handleDelivery==="function"&&typeof t.handleEvents==="function"&&typeof t.isDeliveryRequest==="function"&&typeof t.isEventsRequest==="function"}function yi(e){return e.type==="vault"&&[e.vaultLfvServerUrl,e.vaultLfvClientId,e.vaultLfvDeliveryEndpoint,e.vaultLfvVerifyJwks,e.vaultLfvEventsEndpoint].some((t)=>t!==void 0)}function Ee(e,t){if(!e?.trim())throw Error(`Mirrored LFV config requires ${t}`);return e}function Vd(e,t){if(t?.trim())return t;if(Wt(e))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if(e.type==="vault")return Ee(e.vaultLfvPath??e.vaultPath,"an upstream vault path");if(e.type==="azure")return Ee(e.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${e.type}" requires an explicit fromPath`)}function Fd(e,t){let r=Ee(e.vaultLfvPath??e.vaultPath,"vaultLfvPath or vaultPath");return pt({lfvServerUrl:Ee(e.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Ee(e.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Ee(e.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:Ee(e.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:Ee(e.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:r,deliveryTimeout:e.vaultLfvDeliveryTimeout,retryInterval:e.vaultLfvRetryInterval,warnInterval:e.vaultLfvWarnInterval,log:t},void 0,{selfRedeemReads:!0})}function Dd(e){return e.metadata.contentType?.typeId===Kd.id&&typeof e.data.id==="string"&&e.data.id.trim().length>0}function zd(e,t,r,n){return{...e,close:r,subscribePassive:(o,s)=>t.subscribePassive(o,s),isDeliveryRequest:(o)=>t.isDeliveryRequest(o),isEventsRequest:(o)=>t.isEventsRequest(o),handleDelivery:(o)=>(n(),t.handleDelivery(o)),handleEvents:(o)=>(n(),t.handleEvents(o)),deliveryPath:t.deliveryPath,eventsPath:t.eventsPath,callbackKey:t.callbackKey,trustId:t.trustId}}function or(e){let t=e.logger??Nd,r=Vd(e.from,e.fromPath),n=!Wt(e.from),o=!Wt(e.to),s=Wt(e.from)?e.from:yi(e.from)?Fd(e.from,t):et(e.from).secret,i=Wt(e.to)?e.to:et(e.to).secret,a=Ee(e.path,"path"),c=Qn(i,a,{ttl:e.ttl}),u,l=!1,w=!1,m,T=()=>{if(m)return;m=s.getFullSecret(r).then(()=>{return}).catch((d)=>{m=void 0,t.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:d instanceof Error?d.message:String(d)})})},P=(d)=>{if(l)throw Error("Mirrored ConfigSource is closed");if(!u){w=d;let C=!d&&Zn(s)?{...s,subscribe:(_,N)=>s.subscribePassive(_,N)}:s;u=Xn({from:C,to:i,paths:[r],mapPath:()=>a,accept:Dd,logger:t})}else if(d&&!w)T();return u},O={isReady:()=>u?.isReady()??!1,ready:(d)=>P(!0).ready(d),isAvailable:()=>u?.isAvailable()??!1,purge:()=>P(!1).purge(),close:async()=>{await u?.close()}},E=async()=>{if(l)return;if(l=!0,await u?.close(),n)await s.close?.();if(o)await i.close?.()},g=Zn(s)?zd(i,s,E,()=>{P(!1)}):{...i,close:E},v={load:async()=>{try{let d=await c.load();return P(!1),d}catch(d){throw P(!0),d}},subscribe:(d,C)=>(P(!1),c.subscribe(d,C)),secret:g,mirror:O,async handleCallback(d,C){if(!Zn(s))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return P(!1),d==="delivery"?s.handleDelivery(C):s.handleEvents(C)}};if(Object.defineProperties(v,{log:{get:()=>c.log,set:(d)=>{c.log=d},enumerable:!0},validators:{get:()=>c.validators,set:(d)=>{c.validators=d},enumerable:!0}}),!Wt(e.from)&&yi(e.from)){let d=e.from;v[Ot]={path:r,lfvServerUrl:Ee(d.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Ee(d.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Ee(d.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:Ee(d.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:Ee(d.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:d.vaultLfvDeliveryTimeout,retryInterval:d.vaultLfvRetryInterval,warnInterval:d.vaultLfvWarnInterval}}return v}class vt extends Error{constructor(e,t=`Waiting for vault config secret at ${e}`){super(t);this.path=e;this.code="not_found";this.sourceType="vault";this.status=404;this.name="VaultConfigWaitingForSecretError"}}function Bd(e){return e instanceof vt}class sr extends Error{constructor(e,t){super(t);this.path=e;this.code="invalid_payload";this.sourceType="vault";this.name="VaultConfigInvalidPayloadError"}}function Gd(e){return e instanceof sr}var vi=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function hi(e){return vi.some((t)=>(t in e))}function wi(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw new vt(t,`Vault config secret at ${t} is missing or not an object`);let r=e;if(!hi(r)&&Object.keys(r).length===1&&"data"in r){let n=r.data;if(n&&typeof n==="object"&&!Array.isArray(n))r=n}if(Object.keys(r).length===0)throw new vt(t,`Vault config secret at ${t} is empty`);if(!hi(r))throw new sr(t,`Vault config secret at ${t} is an invalid payload: not a RemoteConfig (no known keys: ${vi.join("/")})`);return r}function Hd(e,t,r){return{...e,subscribe:async(n,o,s)=>{try{return await e.subscribe(n,o,s)}catch(i){if(!(i instanceof xe))throw i;return await Je(e,n,o,t,r(),s)}}}}function Fr(e){let t=mt(e.path,"path","vaultConfig");yt(e.ttl);let r=e.vault??xt({type:"vault",url:e.url,token:e.token,workload:e.workload,lfv:e.lfv,websocket:e.websocket,ttl:e.ttl,log:e.log}),n=e.vault&&e.ttl?Hd(r,e.ttl,()=>e.log):r,o={get log(){return e.log},set log(s){if(e.log=s,n&&"log"in n)n.log=s},load:async()=>{try{let s=await n.getFullSecret(t);return wi(s.data,t)}catch(s){if(s instanceof He)throw new vt(t);if(s instanceof vt||s instanceof sr)throw s;throw Error("Error retrieving remote config from vault",{cause:s})}},subscribe:(s,i)=>n.subscribe(t,(a)=>{let c;try{c=wi(a.data,t)}catch(u){e.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:t,error:u instanceof Error?u.message:String(u)});return}s(c)},i),secret:n};if(e.lfv?.lfvServerUrl&&e.lfv.clientId&&e.lfv.deliveryEndpoint&&e.lfv.eventsEndpoint)o[Ot]={path:e.lfv.path??t,lfvServerUrl:e.lfv.lfvServerUrl,clientId:e.lfv.clientId,deliveryTimeout:e.lfv.deliveryTimeout,retryInterval:e.lfv.retryInterval,warnInterval:e.lfv.warnInterval,deliveryEndpoint:e.lfv.deliveryEndpoint,eventsEndpoint:e.lfv.eventsEndpoint,verifyJwks:e.lfv.verifyJwks};return o}function Dr(e){if(e==null)return;if(typeof e==="number")return Number.isFinite(e)?e:void 0;let t=e.trim();if(!t)return;let r=Number.parseInt(t,10);return Number.isFinite(r)?r:void 0}function Jd(e,t){let r=e.vaultLfvServerUrl??t?.lfvServerUrl,n=e.vaultLfvClientId??t?.clientId,o=e.vaultLfvDeliveryEndpoint??t?.deliveryEndpoint,s=e.vaultLfvEventsEndpoint??t?.eventsEndpoint;if(!r||!n||!o||!s)return t;return{...t,lfvServerUrl:r,clientId:n,deliveryEndpoint:o,verifyJwks:e.vaultLfvVerifyJwks??t?.verifyJwks,eventsEndpoint:s,path:e.vaultLfvPath??t?.path,deliveryTimeout:Dr(e.vaultLfvDeliveryTimeout)??t?.deliveryTimeout,retryInterval:Dr(e.vaultLfvRetryInterval)??t?.retryInterval,warnInterval:Dr(e.vaultLfvWarnInterval)??t?.warnInterval}}function Yd(e,t){let r=e.vaultWebsocketUrl??t?.url;if(!r)return t;return{...t,url:r,token:e.vaultWebsocketToken??t?.token,clientId:e.vaultWebsocketClientId??t?.clientId,header:e.vaultWebsocketHeader??t?.header}}function Xd(e,t){let r=e.vaultWorkloadTokenUrl??t?.idpTokenUrl,n=e.vaultWorkloadClientId??t?.clientId,o=e.vaultWorkloadClientSecret??t?.clientSecret;if(!r||!n||!o)return t;return{...t,idpTokenUrl:r,clientId:n,clientSecret:o,scope:e.vaultWorkloadScope??t?.scope}}function Si(e,t){return{...t,url:e.vaultUrl??t?.url,token:e.vaultToken??t?.token,path:e.vaultPath??t?.path,ttl:Dr(e.vaultTtl)??t?.ttl,workload:Xd(e,t?.workload),lfv:Jd(e,t?.lfv),websocket:Yd(e,t?.websocket)}}function et(e){switch(e.type){case"vault":return el(e);case"azure":return tl(e);case"aws":return rl(e);case"gcp":return nl(e);case"mirror":return Qd(e);default:throw Error(`Unsupported config locator type: ${e.type}`)}}function Qd(e){if(e.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!e.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return or({from:e.from,to:e.to,path:e.to.vaultPath,ttl:e.to.vaultTtl})}function el(e){return Fr(Si(e))}function tl(e){return Vr({authMethod:e.azureAuthMethod,entraTenantId:e.azureEntraTenantId,clientId:e.azureClientId,clientSecret:e.azureClientSecret,federatedTokenFile:e.azureFederatedTokenFile,managedIdentityClientId:e.azureManagedIdentityClientId,imdsApiVersion:e.azureImdsApiVersion,vaultUrl:e.azureVaultUrl,vaultName:e.azureVaultName,apiVersion:e.azureApiVersion,scope:e.azureScope,secretNamePrefix:e.azureSecretNamePrefix,path:e.azurePath,ttl:e.azureTtl})}function rl(e){return Jn({webhookUrl:e.awsWebhookUrl,ttl:e.awsTtl})}function nl(e){return Yn({ttl:e.gcpTtl})}function Qn(e,t,r={}){switch(e.type){case"vault":return Fr({vault:e,path:t,ttl:r.ttl});case"azure":return Vr({vault:e,path:t,ttl:r.ttl});default:throw new Zd(`configFromSource is not supported for secrets source type "${e.type}" (path "${t}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function St(e){if(!e)return;let t=Number.parseInt(e,10);return Number.isFinite(t)?t:void 0}function zr(e,t){let r=t?.type??e.ION_CONFIG_TYPE;if(!r)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(r==="vault")return{type:"vault",vaultUrl:e.ION_VAULT_URL,vaultToken:e.ION_VAULT_TOKEN,vaultPath:e.ION_VAULT_PATH??"",vaultTtl:St(e.ION_VAULT_TTL),vaultWorkloadTokenUrl:e.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:e.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:e.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:e.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:e.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:e.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:e.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:e.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:e.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:e.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:St(e.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:St(e.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:St(e.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:e.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:e.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:e.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:e.ION_VAULT_WEBSOCKET_HEADER};if(r==="azure")return{type:"azure",azurePath:e.ION_AZURE_PATH,azureApiVersion:e.ION_AZURE_API_VERSION,azureScope:e.ION_AZURE_SCOPE,azureSecretNamePrefix:e.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:e.ION_AZURE_AUTH_METHOD,azureEntraTenantId:e.ION_AZURE_TENANT_ID,azureClientId:e.ION_AZURE_CLIENT_ID,azureClientSecret:e.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:e.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:e.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:e.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:e.ION_AZURE_VAULT_URL,azureVaultName:e.ION_AZURE_VAULT_NAME,azureTtl:St(e.ION_AZURE_TTL)};if(r==="aws")return{type:"aws",awsWebhookUrl:e.ION_AWS_WEBHOOK_URL??"",awsTtl:St(e.ION_AWS_TTL)};if(r==="gcp")return{type:"gcp",gcpTtl:St(e.ION_GCP_TTL)};if(r==="mirror"){let n={};for(let[a,c]of Object.entries(e))if(a.startsWith("ION_FROM_"))n[`ION_${a.slice(9)}`]=c;if(n.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let o=zr(n),s=zr(e,{type:"vault"});if(!s.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let i={type:"vault",vaultUrl:s.vaultUrl,vaultToken:s.vaultToken,vaultPath:s.vaultPath,vaultTtl:s.vaultTtl,vaultWorkloadTokenUrl:s.vaultWorkloadTokenUrl,vaultWorkloadClientId:s.vaultWorkloadClientId,vaultWorkloadClientSecret:s.vaultWorkloadClientSecret,vaultWorkloadScope:s.vaultWorkloadScope,vaultWebsocketUrl:s.vaultWebsocketUrl,vaultWebsocketToken:s.vaultWebsocketToken,vaultWebsocketClientId:s.vaultWebsocketClientId,vaultWebsocketHeader:s.vaultWebsocketHeader};return{type:"mirror",from:o,to:i}}throw Error(`ION_CONFIG_TYPE="${r}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function ki(e,t){return et(zr(e,t))}function ol(e){return ki(process.env,e)}var sl=1000,il=30000,bi=["vault","azure","aws","gcp"];function Ri(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Config locator at ${t} is an invalid payload: expected an object with a "type" field`);let r=e.type;if(typeof r!=="string"||!bi.includes(r))throw Error(`Config locator at ${t} is an invalid payload: unknown type "${String(r)}" (expected ${bi.join("/")})`)}function Ci(e,t){return e.log??=t.log,e.validators??=t.validators,e}function ir(e){if(!e?.secret?.close)return;try{Promise.resolve(e.secret.close()).catch((t)=>{e.log?.warn?.("secretConfigSource: inner source close failed",t)})}catch(t){e.log?.warn?.("secretConfigSource: inner source close failed",t)}}function al(e,t){let r=mt(t,"path","secretConfigSource"),n,o=(i)=>{Ri(i,r);let a=JSON.stringify(i);if(n&&n.hash===a)return n.inner;let c=n?.inner,u=Ci(et(i),s);if(n={hash:a,inner:u},c&&c!==u)ir(c);return u},s={async load(){let i=await e.getSecret(r);return o(i).load()},async subscribe(i,a){let c,u=!1,l=!1,w,m,T=new Promise((_,N)=>{w=_,m=N}),P=Or(),O,E,g=(_)=>new Promise((N)=>{E=N,O=setTimeout(N,_)}),v=async(_,N)=>{Ri(_,r);let B=JSON.stringify(_),ee=n!==void 0&&n.hash===B;if(ee&&c)return;let ie=n?.inner,re=c,te=ee&&n?n.inner:Ci(et(_),s),ue=!ee,W=()=>{if(ue&&te!==ie)ir(te)};try{if(te.subscribe){let Y=await te.subscribe(i,a)??void 0;if(u||!P.isCurrent(N)){Y?.(),W();return}if(c=Y,n={hash:B,inner:te},re&&re!==Y)re();if(ue&&ie&&ie!==te)ir(ie);return}let J=await te.load();if(u||!P.isCurrent(N)){W();return}if(n={hash:B,inner:te},re)re(),c=void 0;if(ue&&ie&&ie!==te)ir(ie);i(J)}catch(J){throw W(),J}},d=async(_)=>{let N=P.next(),B=sl;for(;;){if(u||!P.isCurrent(N))return;try{await v(_,N);return}catch(ee){if(u||!P.isCurrent(N))return;s.log?.warn(`secretConfigSource rebind for ${r} failed; keeping last-known-good source and retrying in ${B}ms`,ee),await g(B),B=Math.min(il,B*2)}}},C=await e.subscribe(r,(_)=>{if(u)return;if(!l){v(_.data,P.next()).then(()=>{l=!0,w()}).catch((N)=>{l=!0,m(N)});return}d(_.data)},a);return await T,()=>{if(u=!0,P.next(),O)clearTimeout(O);E?.(),c?.(),C(),ir(n?.inner),n=void 0}},secret:e};return s}function eo(e){if(Array.isArray(e))return e.map(eo);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,eo(r)]));return e}function Ti(e){return JSON.stringify(eo(e))}function cl(e){if(e.type==="vault")return e.vaultLfvPath??e.vaultPath;if(e.type==="azure"&&e.azurePath?.trim())return e.azurePath;throw Error(`Tenant config locator type "${e.type}" does not declare a mirrorable config path`)}function ul(e,t){let r=t.logger??e.log,n=new Map,o=!1,s=async(u)=>{if(u.closed)return;u.closed=!0,u.closeHooks?.(),await u.hookSetup?.catch(()=>{return}),await u.source.secret.close?.()},i=(u)=>{let l=(async()=>{let w=await t.store.get(u);if(!w)throw Error(`Tenant "${u}" was not found`);if(!w.configLocator)throw Error(`Tenant "${u}" has no configLocator`);let m=w.configLocator,T=t.path(w).trim();if(!T)throw Error(`Tenant mirror path is empty for "${u}"`);let P=t.sourceFromLocator?.(m,w)??m,E={source:or({from:P,fromPath:cl(m),to:t.to,path:T,logger:r}),locatorFingerprint:Ti(m),targetPath:T,closed:!1};if(t.hooks?.onRemoteConfigChange)E.hookSetup=t.to.subscribe(T,(g)=>{Promise.resolve(t.hooks?.onRemoteConfigChange?.(w,g.data,g)).catch((v)=>{r.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:u,error:v instanceof Error?v.message:String(v)})})}).then((g)=>{E.closeHooks=g}).catch((g)=>{r.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:u,error:g instanceof Error?g.message:String(g)})});return E})();return n.set(u,l),l.catch(()=>{if(n.get(u)===l)n.delete(u)}),l},a=async(u,l,w)=>{if(n.get(u)===l)n.delete(u);await s(w)},c=async(u)=>{if(o)throw Error("Tenant config mirror is closed");let l=n.get(u);if(!l)return i(u);let w=await l,m=await t.store.get(u);if(!m?.configLocator)throw await a(u,l,w),Error(m?`Tenant "${u}" has no configLocator`:`Tenant "${u}" was not found`);if(Ti(m.configLocator)!==w.locatorFingerprint)return await a(u,l,w),n.get(u)??i(u);return w};return{async ensure(u,l){await(await c(u)).source.mirror.ready(l)},async handleCallback(u,l,w){try{return await(await c(u)).source.handleCallback(l,w)}catch(m){let T=m instanceof Error?m.message:String(m),P=T.includes("was not found")?404:503;return r.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:u,kind:l,error:T}),Response.json({error:P===404?"Tenant not found":"Tenant config mirror unavailable"},{status:P})}},async purge(u){let l=n.get(u),w=l?await l:void 0,m=await t.store.get(u),T=w?.targetPath??(m?t.path(m).trim():void 0);if(w&&l)await a(u,l,w);if(T&&await t.to.exists(T))await t.to.deleteSecret(T);if(m)await t.hooks?.onRemoteConfigRevoke?.(m)},async close(){if(o)return;o=!0;let u=[...n.values()];n.clear(),await Promise.all(u.map(async(l)=>{try{await s(await l)}catch{}}))}}}import{buildTenantPath as dl,DEFAULT_TENANT_API_NAMESPACE as Ii,DEFAULT_TENANT_UI_NAMESPACE as Oi,matchTenantPath as Ei,normalizeTenantPathNamespace as Pi}from"@ionite/core";function ll(){return Response.json({error:"Tenant not found"},{status:404})}function fl(e){return Response.json({error:`Tenant runtime unavailable for ${e}`},{status:503})}function pl(e,t){if(t==="api")return Pi(e?.api??Ii);return Pi(e?.ui??Oi)}function ml(e){if(e.store)return async(t)=>e.store.getIon(t);return async(t)=>await e.getIon(t)??void 0}async function Ai(e,t={}){if(t.custom){let s=await t.custom(e);if(s)return{id:s}}let r=t.namespace??"api",n=pl(t.strategy,r),o=Ei(new URL(e.url).pathname,n);if(!o)return null;return{id:o.id,context:{namespace:r,restPath:o.restPath,restSegments:o.restSegments}}}function _i(e,t){let r=new URL(e.url);return r.pathname=t,new Request(r,e)}function to(e,t,r,n){let o=Ei(new URL(e.url).pathname,r);if(!o||o.id!==t)return e;return _i(e,dl(t,o.restPath,n))}function gl(e,t,r={beforeTenantSegments:["api"],afterTenantSegments:[]}){return to(e,t,Ii,r)}function yl(e,t,r={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return to(e,t,Oi,r)}function hl(e){return async function(r){try{let n=e.resolveTenant?await e.resolveTenant(r):await Ai(r),o=typeof n==="string"?{id:n,context:void 0}:n??null;if(!o?.id)return e.onMissingTenant?await e.onMissingTenant(r):ll();let s=await e.getIon(o.id,r)??null;if(!s)return e.onMissingIonite?await e.onMissingIonite(r,o.id):fl(o.id);let i=e.rewriteRequest?await e.rewriteRequest(r,{id:o.id,ion:s,context:o.context}):r;return s.handler(i)}catch(n){return At(n)}}}import{list as wl,matchesListFilter as vl}from"@ionite/core";class Li{constructor(){this.identities=new Map;this.clientIdIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.identities.get(e)}async lookup(e){if(e.id){let t=this.identities.get(e.id);if(t)return t}if(e.clientId){let t=this.clientIdIndex.get(e.clientId);if(t)return this.identities.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.identities.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n=this.identities.get(t),o={...e,id:t,createdAt:n?.createdAt??e.createdAt??r,updatedAt:r};if(n?.clientId&&n.clientId!==o.clientId)this.clientIdIndex.delete(n.clientId);if(n?.externalId&&n.externalId!==o.externalId)this.externalIdIndex.delete(n.externalId);if(this.identities.set(t,o),o.clientId)this.clientIdIndex.set(o.clientId,t);if(o.externalId)this.externalIdIndex.set(o.externalId,t);return o}async delete(e){let t=this.identities.get(e);if(t?.clientId)this.clientIdIndex.delete(t.clientId);if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.identities.delete(e),t?1:0}async list(e){let t=Array.from(this.identities.values()).filter((a)=>vl(a,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return wl(o,i,r,n)}}var Ol=30000;function El(e){let t=e,r=t.basePath??pr(),n=t.readyTimeoutMs??Ol,o=fr(t.stores),{routing:s,beforeChange:i,afterChange:a,configRetry:c,onConfigLoadError:u}=t;return{frameworkConfig:{log:e.log,validators:e.validators,sso:e.sso,iam:e.iam,workload:e.workload,secrets:e.secrets,lfv:e.lfv,ciam:e.ciam,tm:e.tm,authz:e.authz,otel:e.otel},basePath:r,readyTimeoutMs:n,stores:o,options:{beforeChange:i,afterChange:a,routing:s,configRetry:c,onConfigLoadError:u}}}function Al(e){let t=e,r={trace:(n,...o)=>t.trace(n,...o),debug:(n,...o)=>t.debug(n,...o),info:(n,...o)=>t.info(n,...o),warn:(n,...o)=>t.warn(n,...o),error:(n,...o)=>t.error(n,...o)};return{logger:r,update(n){return t=n,r}}}function Ki(e,t){let r=e;return r.setStores=(n)=>{t.current=fr(n),Object.assign(r,Kt(r,t.current))},r}function Ui(e){let t=e?.replace(/\s+/g," ").trim();return t?t:void 0}function Vi(e){if(typeof e!=="object"||e===null)return;return e.cause}function _l(e){if(!(e instanceof Error))return typeof e==="string"?Ui(e):void 0;let t=Ui(e.message),r=[],n=e;if(typeof n.code==="string")r.push(`code=${n.code}`);if(typeof n.status==="number")r.push(`status=${n.status}`);if(typeof n.path==="string")r.push(`path=${n.path}`);if(r.length===0)return t;if(!t)return r.join(", ");return`${t} [${r.join(", ")}]`}function ao(e,t=3){let r=[],n=e,o=0;while(n!=null&&o<t){let s=_l(n);if(s&&!r.includes(s))r.push(s);n=Vi(n),o+=1}return r.length>0?r.join(" <- "):void 0}function Ll(e,t){if(typeof e!=="object"||e===null)return;return e[t]}function Me(e,t){let r=e,n=0;while(r!=null&&n<3){let o=Ll(r,t);if(o!==void 0)return o;r=Vi(r),n+=1}return}var xl=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function Ul(e){return typeof e==="string"&&xl.has(e)}function Ml(e){let t=Me(e,"kind");if(Ul(t))return t;let r=Me(e,"status"),n=Me(e,"code"),o=ao(e)?.toLowerCase()??"";if(r===401||r===403||o.includes("auth error")||o.includes("permission denied"))return"auth";if(n==="not_found"||o.includes("waiting for vault"))return"not_found";if(n==="ECONNREFUSED"||n==="ECONNRESET"||n==="ENOTFOUND"||n==="ETIMEDOUT"||o.includes("connection")||o.includes("fetch failed")||o.includes("network"))return"connection";if(o.includes("timed out"))return"timeout";if(o.includes("invalid status")||typeof r==="number"&&r>=400)return"invalid_status";if(o.includes("invalid payload")||o.includes("invalid json")||o.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function jl(e){return"validation"}var Wl=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function $l(e,t){let r=Me(e,"recoverable");if(typeof r==="boolean")return r;if(t==="not_found")return!0;if(t==="auth"||t==="invalid_payload")return!1;let n=Me(e,"status");if(typeof n==="number"&&n>=400&&n<500)return!1;let o=Me(e,"code");if(typeof o==="string"&&(Wl.has(o)||o.startsWith("UND_ERR_")))return!0;return!0}function ql(e){return{initialDelayMs:Math.max(1,e?.initialDelayMs??2000),maxDelayMs:Math.max(1,e?.maxDelayMs??600000),multiplier:Math.max(1,e?.multiplier??2),jitterRatio:Math.max(0,e?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,e?.loadTimeoutMs??30000)}}function Nl(e,t){let r=Math.max(0,e-1),n=Math.min(t.maxDelayMs,t.initialDelayMs*t.multiplier**r);if(t.jitterRatio===0)return Math.round(n);let o=n*t.jitterRatio,s=(Math.random()*2-1)*o;return Math.max(1,Math.round(Math.min(t.maxDelayMs,n+s)))}function Kl(e){return(t)=>{let r=t.path?` at ${t.path}`:"",n=t.sourceType?` (${t.sourceType})`:"";e.warn(`Config source${n} unavailable${r}; ionite will retry automatically in ${t.nextDelayMs}ms (attempt ${t.attempt}, ${t.errorKind}: ${t.message}).`)}}async function Vl(e,t){for(let r of t)await r(e)}function je(e){if(!e)return;try{return new URL(e,"http://dummy").pathname}catch{return e.startsWith("/")?e:`/${e}`}}function Fl(e,t){let r=t.id;if(typeof r!=="string"||r.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if(e!==void 0&&e!==r)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${e}", received "${r}").`)}function Dl(e){let t=(r,n)=>{if(r!==void 0&&(typeof r!=="string"||r.length===0))throw Error(`${n}: "clientSecret" must be a non-empty string when present; omit it entirely for a public (PKCE-only) client.`)};t(e.sso?.clientSecret,"sso");for(let[r,n]of Object.entries(e.ciam?.providers??{}))t(n.clientSecret,`ciam.providers.${r}`)}function zl(e){let t=e.kms;if(t)for(let[n,o]of Object.entries(t)){if(n.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!o||typeof o!=="object"||Array.isArray(o))throw Error(`RemoteConfig.kms.${n} must be an object.`);if(o.source!==void 0&&(typeof o.source!=="string"||o.source.length===0))throw Error(`RemoteConfig.kms.${n}.source must be a non-empty string when present.`);if(o.path!==void 0&&(typeof o.path!=="string"||o.path.length===0))throw Error(`RemoteConfig.kms.${n}.path must be a non-empty string when present.`)}let r=e.otel;if(!r)return;if(r.apiKey!==void 0&&r.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(r.apiKeyPool!==void 0){if(typeof r.apiKeyPool!=="string"||r.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!t?.[r.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${r.apiKeyPool}".`)}}function Bl(e){let t=e.authz?.trustedProvisioningClients;if(!t)return;t.forEach((r,n)=>{let o=`authz.trustedProvisioningClients[${n}]`;if(typeof r.issuer!=="string"||r.issuer.length===0)throw Error(`${o}: "issuer" is required and must be a non-empty string.`);if(typeof r.clientId!=="string"||r.clientId.length===0)throw Error(`${o}: "clientId" is required and must be a non-empty string.`);let s=Array.isArray(r.audience)?r.audience:[r.audience];if(s.length===0||s.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(r.permissions)||r.permissions.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "permissions" must be an array of non-empty permission ids.`)})}function Gl(e){let t=e.tm;if(!t)return;if(t.enabled!==!0)throw Error("RemoteConfig.tm.enabled must be true when tm is present.");for(let r of["id","url","issuer","jwksUri","audience","clientId"])if(typeof t.integrator?.[r]!=="string"||t.integrator[r].length===0)throw Error(`RemoteConfig.tm.integrator.${r} is required and must be a non-empty string.`);if(t.consentTtlSeconds!==void 0&&(!Number.isInteger(t.consentTtlSeconds)||t.consentTtlSeconds<60))throw Error("RemoteConfig.tm.consentTtlSeconds must be an integer of at least 60.");if(t.maxRedeemAttempts!==void 0&&(!Number.isInteger(t.maxRedeemAttempts)||t.maxRedeemAttempts<1))throw Error("RemoteConfig.tm.maxRedeemAttempts must be a positive integer.")}function Hl(e){let t=Array.isArray(e)?e:[e];return t.length>0&&t.every((r)=>typeof r==="string"&&r.length>0)}function Jl(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return;let r=t,n=(o,s)=>{if(!Hl(o.audience))throw Error(`${s}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in r||"outgoing"in r){let o=r.incoming;if(Array.isArray(o))o.forEach((s,i)=>{if(s&&typeof s==="object")n(s,`workload.incoming[${i}]`)});else if(o&&typeof o==="object"&&"jwksUri"in o)n(o,"workload.incoming");return}if(zi(r)){if("jwksUri"in r&&!("clientId"in r)&&!("workloadId"in r))n(r,"workload (server-only)");return}}function Yl(e,t,r){if(e?.sso?.redirectUri&&t.sso?.redirectUri){let n=je(e.sso.redirectUri),o=je(t.sso.redirectUri);if(n!==o)r.error(`SSO redirectUri path mismatch: the framework derives "${o}" from basePath, but ConfigSource reports "${n}". Register "${o}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function co(e){let t={};if(!e)return t;for(let[r,n]of Object.entries(e))if(n.type==="vault"&&typeof n.lfv?.deliveryEndpoint==="string"&&typeof n.lfv?.eventsEndpoint==="string")t[r]=n.lfv;return t}function Fi(e){return e[Ot]}function Di(e,t){let r=co(e.secrets??void 0),n=je(t.deliveryEndpoint),o=je(t.eventsEndpoint),s=je(t.path);for(let i of Object.values(r)){if(je(i.deliveryEndpoint)!==n)continue;if(je(i.eventsEndpoint)!==o)continue;let a=i.path?je(i.path):void 0;if(s&&a&&s!==a)continue;return!0}return!1}function Xl(e,t){let r=Fi(t);if(!r)return e;if(Di(e,r))return e;let n={type:"vault",lfv:{path:r.path,lfvServerUrl:r.lfvServerUrl,clientId:r.clientId,deliveryTimeout:r.deliveryTimeout,retryInterval:r.retryInterval,warnInterval:r.warnInterval,deliveryEndpoint:r.deliveryEndpoint,eventsEndpoint:r.eventsEndpoint,verifyJwks:r.verifyJwks}},o=e.secrets??{},s=cn(o,{clientId:r.clientId,path:r.path});return{...e,secrets:{...o,[s]:n}}}function Zl(e,t){let r=Fi(t);if(!r||Di(e,r))return new Map;let n=cn(e.secrets??{},{clientId:r.clientId,path:r.path});return new Map([[n,t.secret]])}function Ql(e,t){let r=co(e.secrets),n=co(t.secrets??void 0);for(let[o,s]of Object.entries(n)){let i=r[o];if(!i)continue;let a=je(i.deliveryEndpoint),c=je(s.deliveryEndpoint);if(a&&c&&a!==c)throw Error(`LFV deliveryEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${a}, framework path: ${c}`);let u=je(i.eventsEndpoint),l=je(s.eventsEndpoint);if(u&&l&&u!==l)throw Error(`LFV eventsEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${u}, framework path: ${l}`)}}function ef(e){return new Set(Object.keys(e.secrets??{}))}function tf(e){return new Set(Object.keys(e.secrets??{}))}function rf(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;if(!("outgoing"in t))return new Set;let r=t.outgoing;if(!r||typeof r!=="object"||Array.isArray(r))return new Set;return new Set(Object.keys(r))}function zi(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function nf(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;let r=t;if("incoming"in r||"outgoing"in r){let n=r.outgoing;if(!n||typeof n!=="object"||Array.isArray(n))return new Set;return new Set(Object.keys(n))}if(zi(r))return new Set;return new Set(Object.keys(r).filter((n)=>n!=="default"))}function of(e,t,r,n){let o=t.secrets??{},s=e.secrets??{};for(let[l,w]of Object.entries(o)){let m=s[l];if(!m)continue;if(w.type&&m.type&&w.type!==m.type)throw Error(`Secrets source "${l}" type in framework config must match ConfigSource type. ConfigSource type: ${m.type}, framework type: ${w.type}`)}let i=ef(t),a=tf(e);for(let l of i)if(!a.has(l)&&!n.has(l))r.warn(`Framework config declares secrets source "${l}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let l of a)if(!i.has(l))r.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:l});let c=rf(t),u=nf(e);for(let l of c)if(!u.has(l))r.warn(`Framework config declares outgoing workload client "${l}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(t.otel!==void 0&&t.otel!==null&&e.otel===void 0)r.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function Mi(e,t){if(t===void 0)return!1;return kl(e,t)}function sf(e,t){if(typeof t!=="number"||!Number.isFinite(t)||t<=0)return e;return new Promise((r,n)=>{let o=setTimeout(()=>{n(Error(`Ionite ready() timed out after ${t}ms`))},t);e.then(()=>{clearTimeout(o),r()},(s)=>{clearTimeout(o),n(s)})})}function af(e,t,r){if(typeof t!=="number"||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>{o(Error(r))},t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function lo(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function ar(e){return e==="/"?e:e.replace(/\/+$/,"")}function no(e,t){return ar(e)===ar(t)}function ji(e){return e.method==="GET"||e.method==="HEAD"}function cf(e){if(e.isReady()&&e.config?.readyz?.enabled===!1)return me();let t=e.readiness();return Response.json(uf(t),{status:t.ok?200:503})}function uf(e){let t=e.config.lastError;if(!t)return e;return{...e,config:{...e.config,lastError:{kind:t.kind,phase:t.phase,at:t.at,message:"[redacted]"}}}}var df={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","iam.workloads":"iam","iam.customers":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz","tm.integration":"tm"};function lf(e){let t=e?.providers;if(!t)return!1;return Object.values(t).some((r)=>r.enabled!==!1&&r.type!=="magic-link")}function Te(e,t,r={}){let n=df[e],o=t.modules[n],s=r.capable??!0,i=o.active&&o.ready&&s,a=i?void 0:!o.active||!o.ready?o.reason:r.incapableReason??`${e} is not testable by this application wiring`;return{module:n,active:o.active,ready:o.ready,testable:i,...r.urls&&r.urls.length>0?{urls:r.urls}:{},...a?{reason:a}:{}}}function ff(e,t,r){let n=De(t),o=e.readiness();return{sdk:{version:Mn,catalogVersion:vn},basePath:t,urls:n,modules:o.modules,lfvCallbackTransport:Boolean(r.lfv?.callbackTransport),capabilities:{"sso.login":Te("sso.login",o,{urls:[n.sso.loginUrl,n.sso.callbackUrl,n.sso.userUrl]}),"sso.jit":Te("sso.jit",o,{capable:r.sso?.enableJitUserProvisioning!==!1&&Boolean(r.sso?.userStore),incapableReason:r.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":Te("sso.logout",o,{urls:[n.sso.logoutUrl]}),"sso.back_channel_logout":Te("sso.back_channel_logout",o,{urls:[n.sso.logoutBackChannelUrl]}),"ciam.magic_link":Te("ciam.magic_link",o,{capable:Boolean(r.ciam?.magicLinkStore)&&r.ciam?.enableJitUserProvisioning!==!1,urls:[n.ciam.magicLinkUrl,n.ciam.magicLinkLoginUrl],incapableReason:!r.ciam?.magicLinkStore?"CIAM magic-link is enabled but no magicLinkStore capability is wired by the application.":"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":Te("ciam.oidc_login",o,{capable:lf(r.ciam),urls:[n.ciam.customerLoginUrl,n.ciam.customerCallbackUrl,n.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":Te("ciam.customer",o,{urls:[n.ciam.customerUrl]}),"ciam.logout":Te("ciam.logout",o,{urls:[n.ciam.logoutUrl]}),"iam.users":Te("iam.users",o,{capable:Boolean(r.iam?.userStore),urls:[n.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":Te("iam.groups",o,{capable:Boolean(r.authz?.catalogStore||r.authz?.catalog),urls:[n.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"iam.workloads":Te("iam.workloads",o,{capable:Boolean(r.iam?.workloadIdentityStore),urls:[n.iam.workloadsUrl],incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."}),"iam.customers":Te("iam.customers",o,{capable:Boolean(r.iam?.customerStore),urls:[n.iam.customersUrl],incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."}),"workload.incoming":Te("workload.incoming",o,{urls:[n.workload.validateUrl,n.workload.jwksUrl]}),"workload.outgoing":Te("workload.outgoing",o,{}),"authz.oaa":Te("authz.oaa",o,{capable:Boolean(r.authz?.accessStore&&(r.authz?.catalogStore||r.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."}),"tm.integration":Te("tm.integration",o,{capable:Boolean(r.tm?.onConnectRequest&&r.tm.store.setIntegration&&r.tm.store.getByIntegrationHandleHash),urls:r.tm?[`${ar(r.tm.basePath)}/integrations/authorize`,`${ar(r.tm.basePath)}/integrations/redeem`,`${ar(r.tm.basePath)}/integrations/config-export`]:void 0,incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."})}}}async function pf(e,t,r){if(!t.isReady())return lo();if(t.config?.capabilitiez!==!0||!r)return me();let n=await er(e,t,qi["capabilitiez.read"]);if(n)return n;return Response.json(r.build(),{status:200})}async function mf(e){if(!e)return[];let t=[];for await(let r of $t((n,o)=>e.list({start:n,limit:o})))t.push(r);return t}function oo(e,t){return[...new Set(e.filter((r)=>r.subjectType===t).map((r)=>typeof r.subject==="string"?r.subject:r.subject.id).filter((r)=>Boolean(r)))]}function so(e,t,r){if(!e)return;if(t==="all")return $t((n,o)=>e.list({start:n,limit:o}));return async function*(){for(let o of r){let s=await e.get(o);if(s)yield s}}()}async function gf(e,t,r){if(!t.isReady())return lo();if(t.config?.authz?.oaa?.fullSync?.enabled!==!0)return me();let n=await er(e,t,qi["authz.oaa.sync"]);if(n)return n;let o=t.authz?.oaa;if(!o?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let s=t.authz?await t.authz.reconcile():void 0,i=r.iam?.userStore,a=r.iam?.customerStore??r.ciam?.customerStore,c=r.workload,u=r.iam?.workloadIdentityStore??(c&&"workloadIdentityStore"in c?c.workloadIdentityStore:c&&("incoming"in c)&&c.incoming&&!Array.isArray(c.incoming)&&("workloadIdentityStore"in c.incoming)?c.incoming.workloadIdentityStore:void 0),l=bl(r.authz?.catalog?Ni(r.authz.catalog):void 0,r.authz?.catalogStore),w=r.authz?.accessStore,m=r.authz?.resources,T=await mf(w),P=await o.sync({users:so(i,o.population("user"),oo(T,"user")),customers:so(a,o.population("customer"),oo(T,"customer")),workloads:so(u,o.population("workload"),oo(T,"workload")),groups:l?$t((O,E)=>l.groups.list({start:O,limit:E})):void 0,roles:l?$t((O,E)=>l.roles.list({start:O,limit:E})):void 0,permissions:l?$t((O,E)=>l.permissions.list({start:O,limit:E})):void 0,resources:m?$t((O,E)=>m.list({start:O,limit:E})):void 0,access:T},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...P,reconcile:s})}function yf(e,t,r,n,o,s){return async(i)=>{let a=new URL(i.url).pathname;if(no(a,r)){if(!ji(i))return Ge(["GET"]);return cf(e)}if(no(a,n)){if(!ji(i))return Ge(["GET"]);return pf(i,e,o)}if(s&&no(a,s.url)){if(i.method!=="POST")return Ge(["POST"]);return gf(i,e,s.frameworkConfig)}let c=e.secrets;if(!Boolean(c?.isLfvDeliveryRequest?.(i)||c?.isLfvEventsRequest?.(i))&&!e.isReady())return lo();try{return await t(i)}catch(l){return e.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},l),At(l)}}}function Wi(e,t,r){if(e)return r&&!e.tenantId?{...e,tenantId:r}:e;if(t&&r)return{tenantId:r};return}function hf(e,t){if(t.authz===null)return;if(!e.authz&&!t.authz)return;return{...e.authz,...t.authz,oaa:e.authz?.oaa||t.authz?.oaa?{...e.authz?.oaa,...t.authz?.oaa}:void 0}}function io(e){let t=!1,r=ge(`${e} module`,()=>t);return{isReady:r.isReady,ready:r.ready,attach(n){if(t=n!==void 0,r.refresh(),!n)return;return Object.defineProperty(n,"isReady",{value:r.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(n,"ready",{value:r.ready,enumerable:!1,configurable:!0}),n}}}function uo(e){if(!e)return!1;return e.isReady?e.isReady():!1}function kt(e,t,r,n){if(!e)return{active:!1,ready:!1,reason:r};return uo(t)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:n}}function wf(){let e=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:e(),ciam:e(),iam:e(),workload:e(),otel:e(),secrets:e(),kms:e(),authz:e(),tm:e()}}function vf(e,t,r){let n=e.isReady(),o=e.config;if(!n||!o)return{ok:!1,applied:n,modules:wf(),config:{...t}};let s=Jr(r),i=Boolean(o.workload)||Boolean(e.workload),a={sso:kt(Boolean(o.sso),e.sso,"sso not configured (no RemoteConfig.sso)",s.sso??"sso configured but not ready"),ciam:kt(Boolean(o.ciam),e.ciam,"ciam not configured (no RemoteConfig.ciam)",s.ciam??"ciam configured but not ready"),iam:kt(Boolean(o.iam),e.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:kt(i,e.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:kt(Boolean(o.otel),e.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(o.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!uo(e.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return e.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:kt(Boolean(o.kms),e.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(o.authz?.oaa))return{active:!0,ready:!0};let l=e.authz?.oaa;return uo(l)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})(),tm:kt(o.tm?.enabled===!0&&Boolean(r.tm),e.tm,o.tm?.enabled===!0?"tm configured by RemoteConfig but FrameworkConfig.tm is not wired (this instance does not serve tenant management)":"tm not configured (no RemoteConfig.tm)","tm configured but not ready")};return{ok:Object.values(a).every((u)=>!u.active||u.ready),applied:n,modules:a,config:{...t}}}function Sf(e,t){let r=[];for(let n of t){let o=e.modules[n];if(!e.applied){r.push({name:n,reason:"RemoteConfig has not been applied yet"});continue}if(!o?.ready)r.push({name:n,reason:o?.reason??`${n} is not ready`})}return{ok:r.length===0,notReady:r}}function kf(e,t,r,n,o,s,i,a){let c=t.validators,u=Pl(e.cache);Cl(u.jwks);let l=t;if(u.session.read.enabled){let re=t.sso?.sessionStore??t.ciam?.sessionStore;if(re){let te=Un(re,u.session.read);l={...t,sso:t.sso?{...t.sso,sessionStore:te}:t.sso,ciam:t.ciam?{...t.ciam,sessionStore:te}:t.ciam}}}let w={sessionCache:u.session},m=Ye(c.workload,r,e?.workload,t.workload??void 0),T=t.otel!==null?Tn(r,e?.otel,t.otel??void 0,o):void 0,P=Jr(l);if(Object.keys(e).length>0){if(P.sso)r.error(P.sso);if(P.ciam)r.error(P.ciam)}let O=Wi(e?.sso,t.sso,e.id),E=P.sso?void 0:Il(c.sso,r,O,l.sso??void 0,w),g={...e?.iam,...t.iam},v=t.authz?.catalog?Ni(t.authz.catalog):void 0,d=t.workload,C=d&&"workloadIdentityStore"in d?d.workloadIdentityStore:d&&("incoming"in d)&&d.incoming&&!Array.isArray(d.incoming)&&("workloadIdentityStore"in d.incoming)?d.incoming.workloadIdentityStore:void 0,_=Boolean(g.url||g.userStore||t.authz?.catalogStore||v),N=i.update({users:e?.iam?.users?.delta,workloads:e?.iam?.workloads?.delta,customers:e?.iam?.customers?.delta,url:g.url,audience:g.deltaAudience},{workload:m,workloadIdentityStore:C,userStore:g.userStore,customerStore:g.customerStore??l.ciam?.customerStore,accessStore:t.authz?.accessStore,catalogStore:t.authz?.catalogStore,codeCatalog:v,mapUserToScim:g.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:g.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:g.inboundWorkloads?.mapBaseWorkloadToScim}),B;if(_&&!m){if(Object.keys(e).length>0)r.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");B=void 0}else B=Tl(c.iam,r,m,s,t.authz?.accessStore,t.authz?.accessIndex,t.authz?.catalogStore,v,t.authz?.resources,e?.iam,t.iam??void 0,N,t.authz?.onAccessMutation,Sl(e.authz),a);let ee=Wi(e?.ciam,t.ciam,e.id),ie=P.ciam?void 0:Rl(c.ciam,r,ee,l.ciam??void 0,m,w);return{secret:n,workload:m,otel:T,sso:E,iam:B,ciam:ie}}function Bi(e,t,r,n,o,s,i,a){let c=s.authz.update(hf(t,r));e.id=t.id,e.config=t,e.secrets=s.secrets.update(t.secrets,r.secrets??void 0,r.validators.secrets,r.lfv?.callbackTransport,r.lfv?.singleProcess),e.kms=s.kms.update(t.kms,(m)=>{if(!m.source)return o;if(!e.secrets)throw Error(`KMS pool references unavailable secrets source "${m.source}".`);return e.secrets.getSecretsSource(m.source)});let u=kf(t,r,n,o,s.kms.handle(),c,s.iamDelta,s.authz.settle);e.secret=u.secret,e.workload=s.workload.update(u.workload),e.otel=s.otel.update(u.otel),e.authz=c,e.log=s.log.update(e.otel?.logger??n),e.sso=s.sso.attach(u.sso),e.iam=s.iam.attach(u.iam),e.ciam=s.ciam.attach(u.ciam),e.tm=s.tm.update(t.tm?.enabled===!0&&r.tm?Xs(e,t.tm,r.tm):void 0,r.tm!==void 0&&r.tm!==null);let l=De(i),w=(m)=>Pn(m,e,a?.routing,l);e.handler=yf(e,w,l.readyzUrl,l.capabilitiezUrl,{build:()=>ff(e,i,r)},{url:ko(i),frameworkConfig:r})}function bf(e,t,r,n,o,s,i,a,c){Fl(e.id,t),Dl(t),zl(t),Bl(t),Gl(t),Jl(t),Yl(t,r,n),Ql(t,r),of(t,r,n,a),Bi(e,t,r,n,o,s,i,c)}function $i(e){if(!e.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return e.secret}async function Rf(e,t,r,n,o,s,i){let a=e,c=bo(e,t,o.current,s);if(n.beforeChange){let u=Ki(c,o);i?.enter();let l;try{l=await n.beforeChange(e,u,r)}finally{i?.exit()}if(l?.config!==void 0)a=l.config;c=l?.frameworkConfig??u}return c=Kt(c,o.current),{effectiveRemoteConfig:a,effectiveFrameworkConfig:c}}function Qg(e,t){let r=El(t),{frameworkConfig:n,basePath:o,readyTimeoutMs:s,stores:i,options:a}=r,c=Zl(n,e),u=new Set(c.keys()),l=Kt(Xl(n,e),i),w=l.log||ro,m={current:i},T={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:l},P=wn(w),O,E={log:Al(w),secrets:Fs(w,c),kms:ms(w),workload:ai(w),otel:vs(w),authz:zo(w,()=>P.handle(),()=>O?.iam,()=>({mapUserToScim:T.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:T.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:T.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim})),iamDelta:P,sso:io("sso"),iam:io("iam"),ciam:io("ciam"),tm:Bs()},g={},v,d,C=new Promise((I,j)=>{v=I,d=j}),_=!1,N,B,ee=0,ie={enter:()=>{ee+=1},exit:()=>{ee-=1}},re=Promise.resolve();function te(I){let j=re.then(I,I);return re=j.then(()=>{return},()=>{return}),j}function ue(I){if(_)throw Error(`Ionite instance has been closed and cannot call ${I}().`)}function W(){e.log=T.frameworkConfig.log??ro,e.validators=T.frameworkConfig.validators}let J={},Y={log:w,id:void 0,config:void 0,secret:$i(e),authz:void 0,configStatus:g,handler:async()=>me(),ready:(I)=>{if(ee>0&&T.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return sf(C,I??s)},isReady:()=>T.remoteConfig!==void 0,readiness:()=>vf(Y,g,T.frameworkConfig),requireReady:(I)=>Sf(Y.readiness(),I),close:()=>{if(_)return;if(_=!0,B)clearTimeout(B),B=void 0;N?.(),N=void 0;let I=[()=>E.secrets.close(),()=>E.kms.close(),()=>E.authz.close(),()=>E.otel.shutdown()];for(let j of I)try{Promise.resolve(j()).catch((K)=>{w.warn("Ionite close: module teardown failed",K)})}catch(K){w.warn("Ionite close: module teardown failed",K)}v?.(),v=void 0,d=void 0},setStores:async(I)=>{ue("setStores");let j=fr(I);await te(()=>L(j))}};O=Y,Bi(Y,J,T.frameworkConfig,w,Y.secret,E,o,a),W();function ne(){let I=g.lastError!==void 0;if(g.appliedAt=Date.now(),g.lastError=void 0,I)(Y.log??w).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function se(I,j){let K=ao(j)??(j instanceof Error?j.message:String(j)),h=jl(j),x=g.lastError===void 0;if(g.lastError={kind:h,message:K,at:Date.now(),phase:I},x)(Y.log??w).error(I==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":h,phase:I,error:K})}function oe(I,j,K){(Y.log??w).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:I,"ion.config.hash":j,"ion.config.apply_ms":K})}async function S(I,j){if(_)return;let K=xi(I);if(j&&T.remoteConfig!==void 0&&K===T.remoteConfigHash&&Mi(I,T.remoteConfig))return;let h=T.remoteConfig,x=h===void 0?"initial":"update",b=Date.now(),p,f,R;try{let X=await Rf(I,T.frameworkConfig,T.remoteConfig,a,m,o,ie);if(p=X.effectiveRemoteConfig,f=xi(p),R=X.effectiveFrameworkConfig,j&&a.beforeChange===void 0&&T.remoteConfig!==void 0&&f===T.remoteConfigHash&&Mi(p,T.remoteConfig)&&R===T.frameworkConfig)return;let F=R.log||ro;bf(Y,p,R,F,$i(e),E,o,u,a)}catch(X){throw se(x,X),X}T.remoteConfig=p,T.remoteConfigHash=f,T.frameworkConfig=R,W(),ne(),await E.otel.settled();let A=Ki(T.frameworkConfig,m),V=!1;try{a.afterChange?.(Y,p,A,h)}catch(X){if((Y.log??w).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:x,error:X instanceof Error?X.message:String(X)}),x==="initial"){V=!0;let F=X instanceof Error?X:Error(`afterChange failed on initial load: ${String(X)}`);se("initial",F),d?.(F),d=void 0,v=void 0}}if(T.frameworkConfig=A,W(),!V)oe(x,f,Date.now()-b);if(!V&&v)v(),v=void 0}async function L(I){if(_)return;if(m.current=I,T.remoteConfig===void 0){T.frameworkConfig=Kt(T.frameworkConfig,I),W();return}await S(T.remoteConfig,!1)}if(e.subscribe)e.subscribe((I)=>{te(()=>S(I,!0)).catch(()=>{})},{mode:"wait"}).then((I)=>{if(_){I?.();return}N=I}).catch((I)=>{w.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:I instanceof Error?I.message:String(I)})});let z=ql(a.configRetry),H=[a.onConfigLoadError??Kl(w)],k=0;function M(){if(B=void 0,_)return;if(T.remoteConfig!==void 0)return;af(e.load(),z.loadTimeoutMs,`ConfigSource initial load timed out after ${z.loadTimeoutMs}ms`).then(async(I)=>{k=0;try{await te(async()=>{if(T.remoteConfig!==void 0)return;await S(I,!0)})}catch(j){let K=j instanceof Error?j:Error(`Initial RemoteConfig application failed: ${String(j)}`);w.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:K.message}),d?.(K),d=void 0}},async(I)=>{if(_)return;k+=1;let j=Nl(k,z),K=ao(I)??"RemoteConfig load failed",h=Ml(I),x=Me(I,"code"),b=Me(I,"status"),p={attempt:k,error:I,errorKind:h,maxDelayMs:z.maxDelayMs,message:K,nextDelayMs:j,code:typeof x==="string"?x:void 0,status:typeof b==="number"?b:void 0,path:typeof Me(I,"path")==="string"?Me(I,"path"):void 0,sourceType:typeof Me(I,"sourceType")==="string"?Me(I,"sourceType"):void 0};if(!$l(I,h)){let f=I instanceof Error?I:Error(`ConfigSource initial load failed with unrecoverable ${h}: ${K}`);w.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:h,error:K,code:p.code,status:p.status,path:p.path,sourceType:p.sourceType}),d?.(f),d=void 0;return}try{await Vl(p,H)}catch(f){let R=f instanceof Error?f:Error("ConfigSource retry hook stopped RemoteConfig retrying");d?.(R),d=void 0;return}B=setTimeout(M,j)})}return M(),Y}export{ny as AssignmentPolicyError,py as CatalogAdjacencyCache,Ec as ION_CAPABILITY_CATALOG,vn as ION_CAPABILITY_CATALOG_VERSION,Ol as ION_READY_DEFAULT_TIMEOUT_MS,Mn as ION_SDK_VERSION,Xe as InMemoryAccessAssignmentStore,fi as InMemoryAccessCatalogStore,mi as InMemoryAccessIndex,cr as InMemoryCustomerStore,ur as InMemoryMagicLinkStore,pi as InMemoryResourceStore,dr as InMemorySessionStore,xy as InMemoryTenantStore,lr as InMemoryUserStore,Li as InMemoryWorkloadIdentityStore,ct as InMemoryWorkloadTokenStore,sy as IoniteError,Tr as ScimOutboundClient,Lr as VAULT_MIN_POLLING_TTL_MS,sr as VaultConfigInvalidPayloadError,vt as VaultConfigWaitingForSecretError,xe as VaultSubscribeNotSupportedError,cy as allowHosts,uy as allowOrigins,dy as allowRelativePaths,ly as allowSameOrigin,Jn as awsConfig,Vr as azureConfig,fy as blockDangerousUrls,my as callback,gy as captureRedirect,yy as ciam,js as closeAllVaultSockets,hy as collectReferencedDefinitions,Qn as configFromSource,zr as configLocatorFromEnvValues,ki as configSourceFromEnvValues,et as configSourceFromLocator,wn as createManagedIamDelta,Un as createSessionReadCache,hl as createTenantIonHandler,ml as createTenantIonResolver,wy as defaultRedirectPolicies,De as deriveIonUrls,fa as devInMemoryStores,vy as discoverSessionRecords,Sy as discoverSessions,er as enforceEndpointAuthz,ol as envConfig,yn as escapeScimFilterValue,ky as expandRoot,Yn as gcpConfig,oy as generateULID,by as getCustomer,Ry as getUser,Id as getWorkload,Od as getWorkloadToken,Cy as has,Ty as hasAll,Py as hasAllScope,Iy as hasAny,Oy as hasAnyScope,Ey as hasGroup,Ay as hasPermission,_y as hasRole,Ly as hasScope,ht as hashIntegrationHandle,Uy as iam,My as initiateLogin,Qg as ionite,jy as isRedirectAllowed,Gd as isVaultConfigInvalidPayloadError,Bd as isVaultConfigWaitingForSecretError,pt as lfvVault,iy as listGenerator,Wy as listSsoClientIdsFromCookies,Xn as mirrorSecrets,or as mirroredConfig,$y as reconcileSubjectAccess,qy as resolveAfterRedirect,Ny as resolveCapturedRedirect,ks as resolveDefaultRoute,Ky as resolveRedirect,Ai as resolveTenantFromRequest,Ad as revokeWorkloadToken,gl as rewriteRequestForDefaultTenantApi,yl as rewriteRequestForDefaultTenantUi,to as rewriteRequestForTenantPath,_i as rewriteRequestPath,Pn as routeRequest,Vy as sameOriginRedirectRules,al as secretConfigSource,Fy as sendTenantWebhook,Ps as setVaultWebSocketCommandTimeout,Dy as sso,Je as subscribeSecretPathWithHttpPolling,ul as tenantMirror,Ed as validateWorkloadToken,xt as vault,Fr as vaultConfig,Ms as vaultSocketDiagnostics,zy as verifyUser,By as withSetCookies,Ye as workload,_d as workloadHandler};
+`)}function Zo(e){try{let t=atob(e);return Uint8Array.from(t,(r)=>r.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function Rr(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("Secret content is not an object");return e}function zt(e){return e.metadata.contentType??cc()}function un(e,t){if(t==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof e.data==="string")return e.data;if(t==="jsonc")return JSON.stringify(e.data,null,2);if(t==="env")return Xo(Rr(e.data));let r=Rr(e.data).content;if(typeof r!=="string")throw Error(`Secret ${t} content must contain a string "content" field`);return r}function br(e,t){if(t==="jsonc")return typeof e.data==="string"?uc(e.data):e.data;if(t==="env")return typeof e.data==="string"?Yo(e.data):Rr(e.data);if(t==="text")return un(e,t);if(t==="binary"){let r=Rr(e.data).content_base64;if(typeof r!=="string")throw Error('Binary secret content must contain a "content_base64" string');return Zo(r)}throw Error(`Typed ${t} decoding is not supported yet; use text() or bytes()`)}function lc(e){return{format:e.format,mimeType:e.mimeType,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id}}function fc(e,t){let r=zt(e);if(r.format!==t.format||r.mimeType!==t.mimeType)throw new dc(lc(t),r)}async function pc(e,t){if(!e.schema)return t;let r=await e.schema["~standard"].validate(t);if(r.issues){let n=r.issues.map((o)=>o.message).join("; ");throw Error(`Secret validation failed for type "${e.id}": ${n}`)}return r.value}function Ne(e){return{async text(){let t=await e();return un(t,zt(t).format)},async json(){let t=await e(),r=zt(t).format;if(r!=="jsonc")throw Error(`json() requires a jsonc secret; received ${r}`);return br(t,r)},async bytes(){let t=await e(),r=zt(t).format;if(r==="binary")return br(t,r);return new TextEncoder().encode(un(t,r))},async env(){let t=await e(),r=zt(t).format;if(r!=="env")throw Error(`env() requires an env secret; received ${r}`);return br(t,r)},async metadata(){return(await e()).metadata},async parse(t){let r=await e();return fc(r,t),pc(t,br(r,t.format))}}}function es(e){try{return new URL(e).pathname}catch{return e.startsWith("/")?e:`/${e}`}}var yc=1e4,hc=1e4,wc=300,ts=100;async function mn(e){await new Promise((t)=>setTimeout(t,e))}function _e(e){return{startedAt:Date.now(),timeout:typeof e?.timeout==="number"&&e.timeout>0?e.timeout:void 0}}function dn(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Gt(e){if(e.timeout===void 0)return;let t=Date.now()-e.startedAt;return Math.max(0,e.timeout-t)}function Be(e,t,r){return Error(`LFV ${e} timed out after ${r.timeout??0}ms for ${t}`)}async function It(e,t,r,n,o){let s=Gt(r);if(s!==void 0){if(s<=0)throw Be(n,o,r);let i=new AbortController,a=setTimeout(()=>i.abort(),s);try{return await fetch(e,{...t,signal:i.signal})}catch(c){if(c instanceof Error&&c.name==="AbortError")throw Be(n,o,r);throw c}finally{clearTimeout(a)}}return await fetch(e,t)}class Ie extends Error{constructor(e){super(`LFV source closed while operating on ${e}`);this.name="LfvSourceClosedError"}}class ze extends Error{constructor(e){super(e);this.name="LfvProtocolError"}}class ft extends ze{constructor(e,t,r){super(`LFV ${t} failed (${e}) for ${r}`);this.status=e;if(this.name="LfvActionStatusError",e===404)this.code="not_found"}}var vc=new Set([400,401,403,404,409,410]);function rs(e){return e instanceof ze&&(!(e instanceof ft)||vc.has(e.status))}function Cr(e){return e instanceof Ie||e instanceof Error&&e.name==="LfvSourceClosedError"}function Sc(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`LFV kms_park returned invalid payload for ${t}`);let r=e;if(typeof r.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${t}`);let n=r.disposition;if(n!==void 0&&n!=="cooldown"&&n!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${t}`);return{parked:r.parked,...r.stale===!0?{stale:!0}:{},...n?{disposition:n}:{}}}function Bt(e){try{let t=JSON.parse(e);return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:void 0}catch{return}}async function ln(e,t,r,n,o,s,i,a,c,u){let l=0,w=Date.now();for(;;){if(u?.())throw new Ie(n);let m=Gt(r);if(m!==void 0&&m<=0)throw Be(o,n,r);try{return await e()}catch(T){if(T instanceof Ie)throw T;if(u?.())throw new Ie(n);if(l+=1,i>0&&Date.now()-w>=i){let O=`Error connecting to the LFV source. Retries: '${l}'`;if(a)a(c,O,{url:t,path:n,operation:o});w=Date.now()}let P=m===void 0?s:Math.min(s,m);if(P<=0)throw Be(o,n,r);if(await mn(P),u?.())throw new Ie(n)}}}function kc(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function fn(e){if(typeof e==="number"&&Number.isFinite(e))return e;if(typeof e==="string"&&e.trim()){let t=Date.parse(e.trim());if(!Number.isNaN(t))return t}return}function ns(e){return`[LFV] [${e??"-"}] [${new Date().toISOString()}]: `}function pn(e,t){if(typeof e!=="string"||e.trim()==="")throw Error(`LFV source requires "${t}"`);return e}function bc(e){return{...e,lfvServerUrl:pn(e.lfvServerUrl,"lfvServerUrl"),clientId:pn(e.clientId,"clientId"),path:pn(e.path,"path")}}function pt(e,t,r={}){let n=bc(e),o=n.log??mc,s=(y,U,q)=>{let D=ns(y)+U;if(q!==void 0)o.debug(D,q);else o.debug(D)},i=(y,U,q)=>{let D=ns(y)+U;if(q!==void 0)o.warn(D,q);else o.warn(D)},{lfvServerUrl:a,clientId:c,path:u,verifyJwks:l}=n,w=typeof n.deliveryTimeout==="number"&&n.deliveryTimeout>0?n.deliveryTimeout:void 0,m=typeof n.retryInterval==="number"&&n.retryInterval>0?n.retryInterval:yc,T=typeof n.warnInterval==="number"&&n.warnInterval>=0?n.warnInterval:hc,P=(typeof n.callbackMaxAgeSeconds==="number"&&n.callbackMaxAgeSeconds>0?n.callbackMaxAgeSeconds:wc)*1000,O=typeof n.cacheMaxAgeSeconds==="number"&&n.cacheMaxAgeSeconds>0?n.cacheMaxAgeSeconds*1000:void 0,E=l?.trim()?gc(l.trim()):void 0,g=es(n.deliveryEndpoint),v=es(n.eventsEndpoint),d=kr({lfvServerUrl:a,path:u}),C=crypto.randomUUID(),_=new Map,N=new Set,B=new Map,ee=new Map,ie=new Map,re=new Map,te=new Map,ue=new Map,W=new Map,J=(y,U)=>{if(typeof U==="number"&&Number.isInteger(U)&&U>=1){let q=W.get(y)??1,D=Math.max(q,U);return W.set(y,D),D}return W.get(y)},Y=(y,U)=>typeof U==="number"&&Number.isInteger(U)&&U>=1&&U>(W.get(y)??1),ne=new Map,se=new Map,oe=!1,S,L=new Set,z=()=>oe;function H(y,U){B.set(y,U),ee.set(y,Date.now())}function k(y){B.delete(y),ee.delete(y)}function M(y){let U=B.get(y);if(!U)return;if(O!==void 0){let q=ee.get(y)??0;if(Date.now()-q>O){s(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:y});return}}return U}function I(){return N.size>0||_.size>0||ue.size>0}function j(){if(oe){if(S)S(),S=void 0;return}let y=I();if(y&&!S)S=Go(d,C,{trustId:E,onDelivery:async(U)=>mo(U).handled||await yo(U),onEvents:async(U)=>{ho(U)}});if(!y&&S)S(),S=void 0}async function K(y,U,q,D){if(!t)throw Error("LFV callback transport is not configured");for(;;){if(oe)throw new Ie(U);if(D())throw new Ie(U);let Z=await t.take(y);if(Z){if(Z.key!==d)i(y,"parked OTP callback rejected: callback key mismatch");else if(!await Br(Z.rawBody,Z.headers)){let fe=Bt(Z.rawBody);if(fe?.type==="otp"&&fe.request_id===y&&typeof fe.otp==="string"&&fe.otp)return fe.otp}}let G=Gt(q);if(G!==void 0&&G<=0)throw Be("issueOtp",U,q);await mn(G===void 0?ts:Math.min(ts,G))}}async function h(y,U){let q=U??crypto.randomUUID(),D={startedAt:Date.now(),timeout:w},Z={request_id:q,path:y,action:"read_secret",...dn(J(y))},G=await ln(()=>It(`${a.replace(/\/+$/g,"")}/clients/${c}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":q},body:JSON.stringify(Z)},D,"issueOtp",y),a,D,y,"issueOtp",m,T,i,q,z);if(G.status!==200&&G.status!==202)throw new ft(G.status,"issueOtp",y)}async function x(y,U){let q=se.get(y);if(q)return q;let D=h(y,U);se.set(y,D);try{await D}finally{if(se.get(y)===D)se.delete(y)}}async function b(y,U,q,D){if(oe)throw new Ie(y);let Z=q??crypto.randomUUID(),G=D??_e(),ce=new Promise((Ae,Nt)=>{let wo={resolve:Ae,reject:Nt},Gr=Gt(G);if(Gr!==void 0){if(Gr<=0){Nt(Be("issueOtp",y,G));return}wo.timer=setTimeout(()=>{ue.delete(Z),j(),Nt(Be("issueOtp",y,G))},Gr)}ue.set(Z,wo),j()});ce.catch(()=>{});let fe=()=>{let Ae=ue.get(Z);if(!Ae)return;if(Ae.timer)clearTimeout(Ae.timer);ue.delete(Z),j()},de={request_id:Z,path:y,action:U,...dn(J(y))};s(Z,"OTP request",{path:y,action:U});let we;try{we=await ln(async()=>await It(`${a.replace(/\/+$/g,"")}/clients/${c}/otp`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":Z},body:JSON.stringify(de)},G,"issueOtp",y),a,G,y,"issueOtp",m,T,i,Z,z)}catch(Ae){throw fe(),Ae}if(we.status!==200&&we.status!==202)throw fe(),new ft(we.status,"issueOtp",y);let ke=!1,ve=t?K(Z,y,G,()=>ke):void 0;if(ve)ve.catch(()=>{});try{let Ae=await(ve?Promise.race([ce,ve]):ce);return s(Z,"OTP received via signed callback",{path:y,action:U}),Ae}finally{ke=!0,fe()}}async function p(y,U,q,D,Z,G,ce){if(oe)throw new Ie(U);let fe=ce??_e(),de=await ln(async()=>await It(`${a.replace(/\/+$/g,"")}${y}`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":Z},body:JSON.stringify({request_id:Z,otp:D,path:U,...dn(J(U)),...G??{}})},fe,q,U),a,fe,U,q,m,T,i,Z,z);if(de.status!==200&&de.status!==202)throw new ft(de.status,q,U);return s(Z,`${q} accepted`,{path:U,status:de.status}),de}async function f(y,U,q,D,Z,G){if(oe)throw new Ie(U);let ce=Z??crypto.randomUUID(),fe=G??_e(),de=await b(U,q,ce,fe),we=await p(y,U,q,de,ce,D,fe);return{requestId:ce,response:we}}async function R(y,U,q){if(oe)throw new Ie(y);let D=Y(y,q?.kmsSlots);if(J(y,q?.kmsSlots),D)k(y);let Z=M(y);if(Z)return Z;let G=ne.get(y);if(G){if(!D)return G;if(await G.catch(()=>{return}),G=ne.get(y),G)return G}let ce=A(y,U,q);ne.set(y,ce),ce.catch((fe)=>{if(Cr(fe))s(U,"read aborted: source closed",{path:y})});try{return await ce}finally{ne.delete(y)}}async function A(y,U,q){let D=q?.timeout??w,Z={startedAt:Date.now(),timeout:typeof D==="number"&&D>0?D:void 0},G=U??crypto.randomUUID();s(G,"read_secret request",{path:y});let ce=0,fe=Date.now();for(;;){if(oe)throw new Ie(y);try{let{response:de}=await f("/secrets/request",y,"read_secret",void 0,G,Z),we=await V(G,de),ke=X(y,we);return F(y,ke,ke.metadata.version),s(G,"read_secret completed from action response",{path:y}),ke}catch(de){if(de instanceof Ie)throw de;if(rs(de))throw de;let we=Gt(Z);if(we!==void 0&&we<=0)throw Be("read_secret",y,Z);if(ce+=1,T>0&&Date.now()-fe>=T)i(G,`read_secret retrying. Retries: '${ce}'`,{path:y}),fe=Date.now();let ke=we===void 0?m:Math.min(m,we);if(ke<=0)throw Be("read_secret",y,Z);await mn(ke)}}}async function V(y,U){if(!l?.trim())throw new ze("LFV read_secret response verification is not configured");let q=U.headers.get("X-LFV-Request-Id")?.trim(),D=U.headers.get("X-LFV-Key-Id")?.trim(),Z=U.headers.get("X-LFV-Signature")?.trim();if(!q||!D||!Z)throw new ze("LFV read_secret response is missing signature headers");if(q!==y)throw new ze("LFV read_secret response request_id header does not match the request");let G=await U.text();if(!await Qo({jwks:l,kid:D,signatureB64Url:Z,requestId:y,rawBody:G}))throw new ze("LFV read_secret response signature verification failed");let fe=Bt(G);if(!fe||fe.request_id!==y)throw new ze("LFV read_secret response request_id does not match the request");return fe}function X(y,U){if(po(U)!==y||U.data?.data===void 0)throw new ze(`LFV read_secret returned an invalid secret response for ${y}`);let D=U.data.metadata??{},Z=typeof D.version==="number"?D.version:0,G=D.created_time??D.created,ce=lt(D);return{data:U.data.data,metadata:{path:y,version:Z,created:typeof G==="string"?new Date(G):new Date,...ce?{contentType:ce}:{}}}}function F(y,U,q){if(q!==void 0){let G=re.get(y);if(G!==void 0&&q<G){s(void 0,"delivery ignored: stale version",{path:y,realVersion:q,lastAccepted:G});return}re.set(y,q)}H(y,U),L.delete(y);let D=U.metadata.version;if(ie.get(y)===D)return;ie.set(y,D);let Z=_.get(y);if(!Z)return;for(let G of Z)G(U)}async function ae(y,U){return await R(y,void 0,U)}async function Q(y,U,q){if(!kc(U))throw Error(`putSecret requires an object value for LFV source at path ${y}`);let D=_e(q),Z={data:U,content_type:Sr(q.contentType)};if(await at(y,q)){await f("/secrets/update",y,"update_secret",Z,void 0,D),k(y);return}await f("/secrets/create",y,"create_secret",Z,void 0,D),k(y)}async function he(y,U){let q=_e(U);await f("/secrets/delete",y,"delete_secret",void 0,void 0,q),k(y)}async function le(y,U){let q=_e(U),D=crypto.randomUUID();s(D,"list_paths request",{path:y});let Z=await b(y,"list_paths",D,q),G=await It(`${a.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":D},body:JSON.stringify({request_id:D,otp:Z,path:y})},q,"listPaths",y);if(G.status!==200)throw Error(`LFV listPaths failed (${G.status}) for ${y}`);let ce=await G.json();if(!Array.isArray(ce.items))throw Error(`LFV listPaths returned invalid payload for ${y}`);return s(D,"list_paths success",{path:y,status:200}),ce.items.filter((fe)=>typeof fe==="string")}async function at(y,U){let q=_e(U),D=crypto.randomUUID();s(D,"exists request",{path:y});let Z=await b(y,"read_metadata",D,q),G=await It(`${a.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":D},body:JSON.stringify({request_id:D,otp:Z,path:y})},q,"exists",y);if(G.status!==200)throw Error(`LFV exists failed (${G.status}) for ${y}`);let ce=await G.json();if(typeof ce.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${y}`);return s(D,"exists success",{path:y,status:200,exists:ce.exists}),ce.exists}async function Fe(y,U,q){let D=_e(q);await f("/secrets/rotate/request",y,"request_rotate",{reason:U?.reason,severity:U?.severity,incident_ref:U?.incidentRef},void 0,D)}async function qt(y,U,q){let D=_e(q);await f("/secrets/revoke/request",y,"request_revoke",{reason:U?.reason,severity:U?.severity,incident_ref:U?.incidentRef},void 0,D)}async function Gi(y,U,q){let D=_e(q),{response:Z}=await f("/secrets/kms/park",y,"kms_park",{key_id:U.keyId,status:U.status,reason:U.reason},void 0,D);return Sc(await Z.json().catch(()=>null),y)}function Hi(y,U){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_add_keys returned invalid payload for ${U}`);let q=y;if(!Array.isArray(q.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${U}`);return{keys:q.keys.map((Z,G)=>{if(!Z||typeof Z!=="object"||Array.isArray(Z))throw Error(`LFV kms_add_keys returned invalid keys[${G}] for ${U}`);let ce=Z.id;if(typeof ce!=="string"||ce.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${G}].id for ${U}`);return{id:ce}})}}function Ji(y,U){if(!y||typeof y!=="object"||Array.isArray(y))throw Error(`LFV kms_revoke_key returned invalid payload for ${U}`);let q=y;if(typeof q.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${U}`);return{revoked:q.revoked}}async function Yi(y,U,q){let D=_e(q),{response:Z}=await f("/secrets/kms/add-keys",y,"kms_add_keys",{keys:U.keys},void 0,D);return Hi(await Z.json().catch(()=>null),y)}async function Xi(y,U,q){let D=_e(q),{response:Z}=await f("/secrets/kms/revoke-key",y,"kms_revoke_key",{key_id:U.keyId,reason:U.reason},void 0,D);return Ji(await Z.json().catch(()=>null),y)}async function Zi(y,U){let q=_e(U),D=crypto.randomUUID();s(D,"getMetadata request",{path:y});let Z=await b(y,"read_metadata",D,q),G=await It(`${a.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{"Content-Type":"application/json","X-LFV-Request-Id":D},body:JSON.stringify({request_id:D,otp:Z,path:y})},q,"getMetadata",y);if(G.status!==200)throw Error(`LFV getMetadata failed (${G.status}) for ${y}`);let ce=await G.json();if(!ce.metadata||typeof ce.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${y}`);return s(D,"getMetadata success",{path:y,status:200}),ce.metadata}async function fo(y,U,q,D=!0){let Z=_.get(y)??new Set,G,ce=(de)=>{if(de.metadata.version===G)return;G=de.metadata.version,U(de)};if(Z.add(ce),_.set(y,Z),!D)return j(),()=>{let de=_.get(y);if(!de)return;if(de.delete(ce),de.size===0)_.delete(y);j()};let fe=Y(y,q?.kmsSlots)?void 0:M(y);if(fe)ce(fe),ie.set(y,fe.metadata.version);else try{ce(await ae(y,q))}catch(de){if(Z.delete(ce),Z.size===0)_.delete(y);throw de}return j(),()=>{let de=_.get(y);if(!de)return;if(de.delete(ce),de.size===0)_.delete(y);j()}}let Qi=(y,U)=>fo(y,U,void 0,!1);function ea(y){return y.method==="POST"&&new URL(y.url).pathname===g}function ta(y){return y.method==="POST"&&new URL(y.url).pathname===v}function po(y){let U=y.data?.metadata?.path;if(typeof U==="string"&&U)return U;if(typeof y.path==="string"&&y.path)return y.path;return}function ra(y){let{request_id:U,otp:q}=y;if(typeof U!=="string"||typeof q!=="string"||!q)return{handled:!1};let D=ue.get(U);if(!D)return{handled:!1};if(D.timer)clearTimeout(D.timer);return ue.delete(U),j(),D.resolve(q),{handled:!0}}function mo(y){return y.type==="otp"?ra(y):{handled:!1}}function tt(y="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:y}),{status:401,headers:{"Content-Type":"application/json"}})}function go(y){return{requestId:y.headers.get("X-LFV-Request-Id")??y.headers.get("x-lfv-request-id")??"",keyId:y.headers.get("X-LFV-Key-Id")??y.headers.get("x-lfv-key-id")??"",signature:y.headers.get("X-LFV-Signature")??y.headers.get("x-lfv-signature")??""}}async function Br(y,U){if(!l?.trim())return i(void 0,"LFV callback rejected: verifyJwks is not configured"),tt("LFV callback verification is not configured");let{requestId:q,keyId:D,signature:Z}=U;if(!q.trim()||!D.trim()||!Z.trim())return i(q||void 0,"LFV callback rejected: missing signature headers"),tt("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await Qo({jwks:l,kid:D,signatureB64Url:Z.trim(),requestId:q.trim(),rawBody:y}))return i(q,"LFV callback rejected: signature verification failed"),tt();let ce=Bt(y);if(!ce)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:{"Content-Type":"application/json"}});let fe=ce;if(fe.request_id!==q.trim())return i(q,"LFV callback rejected: request_id header/body mismatch"),tt("X-LFV-Request-Id does not match request_id in body");let de=Date.now(),we=fn(fe.issued_at);if(we===void 0)return i(q,"LFV callback rejected: missing or invalid issued_at"),tt("Missing or invalid issued_at");if(de-we>P)return i(q,"LFV callback rejected: stale (outside freshness window)"),tt("Callback is stale (issued_at outside freshness window)");let ke=fn(fe.expires_at);if(ke!==void 0&&de>ke)return i(q,"LFV callback rejected: expired"),tt("Callback has expired");let ve=Z.trim();for(let[Ae,Nt]of te)if(Nt<=de)te.delete(Ae);if(te.has(ve))return i(q,"LFV callback rejected: replayed signature"),tt("Callback signature already processed (replay)");return te.set(ve,we+P),null}async function yo(y){if(!r.selfRedeemReads||y.action!=="read_secret"||typeof y.request_id!=="string"||typeof y.path!=="string"||typeof y.otp!=="string")return!1;let U={startedAt:Date.now(),timeout:w},q=await p("/secrets/request",y.path,"read_secret",y.otp,y.request_id,void 0,U),D=await V(y.request_id,q),Z=X(y.path,D);return F(y.path,Z,Z.metadata.version),!0}async function na(y){let U=await y.text(),q=go(y),D=await Br(U,q);if(D)return D;let Z=Bt(U);if(!Z)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let G=Z;if(G.type!=="otp"||typeof G.request_id!=="string"||typeof G.otp!=="string"||typeof G.path!=="string"||typeof G.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let ce=po(G);s(G.request_id,"delivery received",{path:ce});let fe=mo(G),de=ce?kr({lfvServerUrl:a,path:ce}):d,we=await Ho(de,G,C,E),ke=fe.handled||we>0;if(!ke)try{if(ke=await yo(G),!ke&&t&&typeof G.request_id==="string"){let ve=fn(G.expires_at),Ae=Math.max(1,(ve??Date.now()+P)-Date.now());await t.put(G.request_id,{kind:"delivery",key:de,rawBody:U,headers:q},Ae),ke=!0}}catch(ve){if(rs(ve)){if(!(ve instanceof ft)||ve.status!==409&&ve.status!==410)L.add(G.path);return i(q.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:de,status:ve instanceof ft?ve.status:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:{"Content-Type":"application/json"}})}return te.delete(q.signature.trim()),i(q.requestId,"LFV callback handoff failed; callback may be retried",{key:de,error:ve instanceof Error?ve.message:String(ve)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}})}if(!ke)return te.delete(q.signature.trim()),i(q.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:de}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function ho(y){if(oe)return;if(!y?.path||typeof y.path!=="string")return;s(y.request_id,"events payload",{path:y.path,event:y.event});for(let U of N)try{U({path:y.path,event:y.event,requestId:y.request_id,issuedAt:y.issued_at,expiresAt:y.expires_at,...typeof y.key_id==="string"&&y.key_id.length>0?{keyId:y.key_id}:{}})}catch(q){i(y.request_id,"secret event listener failed",{path:y.path,event:y.event,error:q instanceof Error?q.message:String(q)})}if(y.event==="created"||y.event==="updated"||y.event==="rotated")k(y.path),(r.selfRedeemReads?x(y.path,y.request_id):R(y.path,y.request_id).then(()=>{return})).catch((q)=>{if(Cr(q)){s(y.request_id,"event refresh aborted: source closed",{path:y.path});return}L.add(y.path),i(y.request_id,"event-triggered refresh failed; source marked degraded",{path:y.path,event:y.event,error:q instanceof Error?q.message:String(q)})})}async function oa(y){let U=await y.text(),q=go(y),D=await Br(U,q);if(D)return D;let Z=Bt(U);if(!Z)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:{"Content-Type":"application/json"}});let G=Z;if(!G?.path||typeof G.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:{"Content-Type":"application/json"}});s(G.request_id,"events received",{path:G.path,event:G.event}),ho(G);let ce=kr({lfvServerUrl:a,path:G.path});return await Jo(ce,G,C,E),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:{"Content-Type":"application/json"}})}function sa(){if(oe)return;if(oe=!0,S)S(),S=void 0;let y=new Ie(u);for(let U of ue.values()){if(U.timer)clearTimeout(U.timer);try{U.reject(y)}catch{}}ue.clear(),ne.clear(),se.clear(),L.clear(),B.clear(),ee.clear(),ie.clear(),re.clear(),te.clear(),_.clear(),N.clear()}return{type:"vault",isAvailable:()=>L.size===0,get:(y,U)=>Ne(()=>ae(y,U)),getFullSecret:ae,getSecret:async(y,U)=>(await ae(y,U)).data,putSecret:Q,deleteSecret:he,listPaths:le,exists:at,requestRotate:Fe,requestRevoke:qt,parkKmsKey:Gi,addKmsKeys:Yi,revokeKmsKey:Xi,getMetadata:Zi,subscribe:fo,subscribePassive:Qi,subscribeEvents:(y)=>(N.add(y),j(),()=>{N.delete(y),j()}),close:sa,isDeliveryRequest:ea,isEventsRequest:ta,handleDelivery:na,handleEvents:oa,deliveryPath:g,eventsPath:v,callbackKey:d,trustId:E}}function mt(e,t,r){if(typeof e!=="string"||e.trim()==="")throw Error(`"${t}" is required when using ${r}`);return e}var Ot="__esLfvBootstrap";import{catalogEntityStore as Pr,listGenerator as Yt,materializeCodeCatalogEntity as Pc,trimTrailingSlash as Ic,unionCatalogRead as Oc}from"@ionite/core";import{baseCustomerToScim as ss,baseUserToScimUser as is,baseWorkloadToScim as as,entitlementToScimGroup as hn}from"@ionite/core/server";import{ION_AUTHZ_GROUP_SCHEMA as gn}from"@ionite/core";var os="application/scim+json",Rc="urn:ietf:params:scim:api:messages:2.0:PatchOp",Cc="urn:ietf:params:scim:schemas:core:2.0:User",Tc="urn:ietf:params:scim:schemas:core:2.0:Group";async function Ht(e){try{let t=(await e.clone().text()).trim();return t?t.slice(0,2000):void 0}catch{return}}function Jt(e){if(e==="user")return"Users";if(e==="workload")return"Workloads";if(e==="customer")return"Customers";return"Groups"}function yn(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class Tr{constructor(e){this.inflight=new Map;this.memo=new Map;this.writes=new Map;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.getToken=e.getToken,this.receipts=e.receipts,this.log=e.log,this.fetchImpl=e.fetchImpl??((t,r)=>fetch(t,r))}async headers(){let e=await this.getToken();return new Headers({"Content-Type":os,Accept:os,Authorization:`Bearer ${e}`})}inflightKey(e,t,r){return`${e}\x00${t}\x00${r?"create":"lookup"}`}receiptKey(e,t){return`${e}\x00${t}`}serializeWrite(e,t,r){let n=`${e}\x00${t}`,s=(this.writes.get(n)??Promise.resolve()).catch(()=>{return}).then(r);this.writes.set(n,s);let i=()=>{if(this.writes.get(n)===s)this.writes.delete(n)};return s.then(i,i),s}async resolveProviderId(e,t,r){let n=this.receiptKey(e,t),o=this.memo.get(n);if(o)return{found:o.providerId,requestUrl:o.requestUrl};let s=await this.receipts.read(e,t);if(s)this.memo.set(n,s);if(s)return{found:s.providerId,requestUrl:s.requestUrl};let i=this.inflightKey(e,t,r!==void 0),a=this.inflight.get(i);if(a)return a;let c=this.resolveUncached(e,t,r).then(async(u)=>{if(typeof u==="object"){let l={providerId:u.found,...u.requestUrl?{requestUrl:u.requestUrl}:{}};await this.receipts.write(e,t,l),this.memo.set(n,l)}return u}).finally(()=>{this.inflight.delete(i)});return this.inflight.set(i,c),c}async resolveUncached(e,t,r){let n=await this.filterByExternalId(e,t);if(n!=="absent")return n;if(!r)return"absent";return this.create(e,t,r)}async filterByExternalId(e,t){let r=encodeURIComponent(`externalId eq "${yn(t)}"`),n=`${this.baseUrl}/${Jt(e)}?filter=${r}`,o=await this.fetchImpl(n,{method:"GET",headers:await this.headers()});if(!o.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:e,status:o.status,detail:await Ht(o)}),"error";let i=((await o.json()).Resources??[])[0];return i?.id?{found:i.id,...this.requestUrl(e,i)}:"absent"}async create(e,t,r){let n=`${this.baseUrl}/${Jt(e)}`,o=this.writeBody(e,t,r),s=await this.fetchImpl(n,{method:"POST",headers:await this.headers(),body:JSON.stringify(o)});if(!s.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Ht(s)}),"error";let i=await s.json();return i.id?{found:i.id,...this.requestUrl(e,i),created:!0}:"error"}requestUrl(e,t){if(e!=="group")return{};let r=t[gn];if(!r||typeof r!=="object")return{};let n=r.requestUrl;return typeof n==="string"&&n?{requestUrl:n}:{}}async captureResponseReference(e,t,r,n,o){try{let s=await e.clone().json(),i=this.requestUrl(t,s).requestUrl;if(!i&&s.id===void 0)return;let a=i??o,c={providerId:s.id??n,...a?{requestUrl:a}:{}};await this.receipts.write(t,r,c),this.memo.set(this.receiptKey(t,r),c)}catch{}}async invalidate(e,t){this.memo.delete(this.receiptKey(e,t)),await this.receipts.clear(e,t)}writeBody(e,t,r){let{id:n,meta:o,...s}=r,i=s,a=i[gn];if(a&&typeof a==="object"&&!Array.isArray(a)){let{providerId:c,requestUrl:u,...l}=a;i[gn]=l}return{...i,schemas:(r.schemas?.length??0)>0?r.schemas:[e==="user"?Cc:Tc],externalId:t}}async upsertResource(e,t,r){return this.serializeWrite(e,t,()=>this.upsertResourceNow(e,t,r))}async upsertResourceNow(e,t,r){let n=async(s)=>{let i=await this.resolveProviderId(e,t,s?r:void 0);if(i==="error")return"error";if(i==="absent")return"skipped";if(i.created)return"pushed";let a=await this.fetchImpl(`${this.baseUrl}/${Jt(e)}/${encodeURIComponent(i.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody(e,t,r))});if(a.status===404||a.status===410)return"stale";if(a.ok)return await this.captureResponseReference(a,e,t,i.found,i.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:e,status:a.status,detail:await Ht(a)}),"error"},o=await n(!0);if(o==="stale")await this.invalidate(e,t),o=await n(!0);return o==="stale"?"error":o}async deleteResource(e,t){return this.serializeWrite(e,t,()=>this.deleteResourceNow(e,t))}async deleteResourceNow(e,t){let r=async()=>{let o=await this.resolveProviderId(e,t);if(o==="error")return{outcome:"error"};if(o==="absent")return{outcome:"pushed"};let s=await this.fetchImpl(`${this.baseUrl}/${Jt(e)}/${encodeURIComponent(o.found)}`,{method:"DELETE",headers:await this.headers()});if(s.status===404||s.status===410)return{outcome:"pushed",stale:!0};if(s.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:e,status:s.status,detail:await Ht(s)}),{outcome:"error"}},n=await r();if(n.stale)await this.invalidate(e,t),n=await r();if(n.outcome==="pushed")await this.invalidate(e,t);return n.outcome}async patchGroupMembership(e){return this.serializeWrite("group",e.groupExternalId,()=>this.patchGroupMembershipNow(e))}async patchGroupMembershipNow(e){let{groupExternalId:t,userExternalId:r,op:n}=e,o=e.subjectResourceType??"user",s=await this.resolveProviderId(o,r,n==="add"?e.userCreate:void 0);if(s==="error")return this.log.warn("IAM delta: principal lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,subjectResourceType:o}),"error";if(s==="absent")return this.log.warn("IAM delta: principal not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n,subjectResourceType:o}),"skipped";let i=s.found,a=async(l)=>{let w=await this.resolveProviderId("group",t,n==="add"&&l?e.groupCreate:void 0);if(w==="error")return{kind:"error"};if(w==="absent")return{kind:"absent"};let m=`${this.baseUrl}/${Jt("group")}/${encodeURIComponent(w.found)}`,T=n==="add"?[{op:"add",path:"members",value:[{value:i,type:e.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${yn(i)}"]`}];return{kind:"response",response:await this.fetchImpl(m,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[Rc],Operations:T})}),providerId:w.found,requestUrl:w.requestUrl}},c=await a(!0);if(c.kind==="response"&&(c.response.status===404||c.response.status===410))await this.invalidate("group",t),c=await a(!1);if(c.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n}),"error";if(c.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n}),"skipped";let u=c.response;if(!u.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,status:u.status,detail:await Ht(u)}),"error";return await this.captureResponseReference(u,"group",t,c.providerId,c.requestUrl),"pushed"}}function Et(e){if(typeof e==="string")return e;if(e&&typeof e==="object"&&"id"in e)return e.id;return}function Xt(e){return e&&typeof e==="object"?e:void 0}function wn(e){let t={},r={},n,o,s,i,a,c,u,l,w,m=()=>t.users==="patch"||t.workloads==="patch"||t.customers==="patch",T=(k)=>{if(k==="user")return t.users==="patch";if(k==="workload")return t.workloads==="patch";return t.customers==="patch"},P=()=>{if(!t.url)return"destination URL is not configured";if(!r.workload)return"workload identity is not configured";if(typeof r.workload.isReady!=="function"||typeof r.workload.ready!=="function")return"workload handle violates the readiness contract";if(!r.workload.isReady())return"workload module is not ready";if(t.audience){let k=r.workload[t.audience];if(!k)return`outgoing workload client "${t.audience}" is not configured`;if(typeof k.isReady!=="function"||typeof k.ready!=="function")return`outgoing workload client "${t.audience}" violates the readiness contract`;if(!k.isReady())return`outgoing workload client "${t.audience}" is not ready`}return},O=()=>{if(!m())return"no principal-kind delta mode is 'patch'";let k=P();if(k)return k;if(t.users==="patch"&&!r.userStore)return"user store is not configured for IAM destination receipts";if(t.workloads==="patch"&&!r.workloadIdentityStore)return"workload identity store is not configured for IAM destination receipts";if(t.customers==="patch"&&!r.customerStore)return"customer store is not configured for IAM destination receipts";if(!r.catalogStore)return"catalog store is not configured for IAM destination receipts";return},E=()=>O()===void 0,g=ge("IAM delta",E),v=async()=>{let k=r.workload;if(!k)throw Error("IAM delta: workload identity not configured");if(t.audience&&typeof k.getToken==="function")return k.getToken(t.audience);if(typeof k.getServerToken==="function")return k.getServerToken();return k.getToken()},d=()=>Oc(r.codeCatalog,r.catalogStore),C=async(k,M)=>{let I=r.catalogStore;if(!I)return;let j=r.codeCatalog?.groups.get(k)??r.codeCatalog?.roles.get(k)??r.codeCatalog?.permissions.get(k);if(j){let h=r.codeCatalog?.groups.get(j.id)?"group":r.codeCatalog?.roles.get(j.id)?"role":"permission",x=Pr(I,h),b=await x.get(j.id);if(!b&&M)await Pc(h,j,x),b=await x.get(j.id);if(b)return{kind:h,entity:b}}let K=[["group",I.groups],["role",I.roles],["permission",I.permissions]];for(let[h,x]of K){let b=await x.get(k);if(b)return{kind:h,entity:b}}return},_=async(k)=>{let M=r.userStore;if(!M)return;if(M.getByExternalId)return M.getByExternalId(k);for await(let I of Yt((j,K)=>M.list({start:j,limit:K})))if(I.externalId===k)return I;return},N=(k)=>k?.providerId?{providerId:k.providerId,...k.requestUrl?{requestUrl:k.requestUrl}:{}}:void 0,B=async(k)=>{let M=r.workloadIdentityStore;if(!M)return;if(M.getByExternalId)return M.getByExternalId(k);let I=await M.lookup({id:"",externalId:k});if(I)return I;for await(let j of Yt((K,h)=>M.list({start:K,limit:h})))if(j.externalId===k)return j;return},ee=async(k)=>{let M=r.customerStore;if(!M)return;if(M.getByExternalId)return M.getByExternalId(k);let I=await M.lookup({id:"",userName:"",name:"",email:"",externalId:k});if(I)return I;for await(let j of Yt((K,h)=>M.list({start:K,limit:h})))if(j.externalId===k)return j;return},ie={async read(k,M){if(k==="user")return N(await _(M));if(k==="workload")return N(await B(M));if(k==="customer")return N(await ee(M));return N((await C(M,!1))?.entity)},async write(k,M,I){if(k==="user"){let h=await _(M);if(!h||h.providerId===I.providerId&&h.requestUrl===I.requestUrl)return;await r.userStore?.upsert({...h,providerId:I.providerId,requestUrl:I.requestUrl});return}if(k==="workload"){let h=await B(M);if(!h||h.providerId===I.providerId&&h.requestUrl===I.requestUrl)return;await r.workloadIdentityStore?.upsert({...h,providerId:I.providerId,requestUrl:I.requestUrl});return}if(k==="customer"){let h=await ee(M);if(!h||h.providerId===I.providerId&&h.requestUrl===I.requestUrl)return;await r.customerStore?.upsert({...h,providerId:I.providerId,requestUrl:I.requestUrl});return}let j=await C(M,!0);if(!j||j.entity.providerId===I.providerId&&j.entity.requestUrl===I.requestUrl)return;await Pr(r.catalogStore,j.kind).set({...j.entity,providerId:I.providerId,requestUrl:I.requestUrl}).ready()},async clear(k,M){if(k==="user"){let b=await _(M);if(!b||b.providerId===void 0&&b.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...R}=b;await r.userStore?.upsert(R);return}if(k==="workload"){let b=await B(M);if(!b||b.providerId===void 0&&b.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...R}=b;await r.workloadIdentityStore?.upsert(R);return}if(k==="customer"){let b=await ee(M);if(!b||b.providerId===void 0&&b.requestUrl===void 0)return;let{providerId:p,requestUrl:f,...R}=b;await r.customerStore?.upsert(R);return}let I=await C(M,!1);if(!I||I.entity.providerId===void 0&&I.entity.requestUrl===void 0)return;let{providerId:j,requestUrl:K,...h}=I.entity;await Pr(r.catalogStore,I.kind).set(h).ready()}},re=()=>{if(!E()||!t.url)return;let k=t.url;if(n&&o===k&&s===r.catalogStore&&i===r.userStore&&a===r.workloadIdentityStore&&c===r.customerStore&&u===r.codeCatalog&&l===r.fetchImpl)return n;return n=new Tr({baseUrl:t.url,getToken:v,receipts:ie,log:e,fetchImpl:r.fetchImpl}),o=k,s=r.catalogStore,i=r.userStore,a=r.workloadIdentityStore,c=r.customerStore,u=r.codeCatalog,l=r.fetchImpl,n},te=(k)=>k==="workload"?"Workload":k==="customer"?"Customer":"User",ue=async(k)=>{if(k.subjectType==="workload"){let K=Et(k.subject),h=Xt(k.subject);if(!h&&K)h=await r.workloadIdentityStore?.get(K);let x=h?.externalId??h?.id??K;if(!h||!x)return;return{externalId:x,resourceType:"workload",create:await(r.mapWorkloadToScim?.({...h,externalId:x})??as({...h,externalId:x}))}}if(k.subjectType==="customer"){let K=Et(k.subject),h=Xt(k.subject);if(!h&&K)h=await r.customerStore?.get(K);let x=h?.externalId??h?.id??K;if(!x)return;let b=h?await(r.mapCustomerToScim?.({...h,externalId:x})??ss({...h,externalId:x})):{schemas:["urn:ionite:scim:schemas:core:2.0:Customer"],externalId:x,displayName:x,active:!0};return{externalId:x,resourceType:"customer",create:b}}let I=Xt(k.subject);if(!I){let K=Et(k.subject);if(K&&r.userStore)I=await r.userStore.get(K)}let j=I?.externalId;if(!I||!j)return;return{externalId:j,resourceType:"user",create:await(r.mapUserToScim?.(I)??is(I))}},W=async(k)=>{let I=Xt(k.target);if(!I){let j=Et(k.target),K=d();if(j&&K)I=k.targetType==="role"?await K.roles.get(j):k.targetType==="permission"?await K.permissions.get(j):await K.groups.get(j)}if(I&&I.requestable!==!0)return"not-requestable";if(!I)return;return{externalId:I.id,create:hn(I,k.targetType)}},J=async(k,M)=>{if(!E())return"skipped";if(!T(k.subjectType==="workload"?"workload":k.subjectType==="customer"?"customer":"user"))return"skipped";let I=await ue(k),j=await W(k);if(j==="not-requestable")return"skipped";if(!I||!j)return e.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:M,hasSubject:Boolean(I),hasTarget:Boolean(j),targetType:k.targetType}),"skipped";let K=re();if(!K)return"skipped";return K.patchGroupMembership({groupExternalId:j.externalId,userExternalId:I.externalId,op:M,groupCreate:j.create,userCreate:I.create,memberType:te(k.subjectType),subjectResourceType:I.resourceType})},Y=async(k,M,I)=>{let j=[],K=new Set,h=(b)=>{let p=`${b.type??"User"}\x00${b.value}`;if(!K.has(p))K.add(p),j.push(b)},x=r.accessStore;if(x)for await(let b of Yt((p,f)=>x.listByTarget(M,k.id,{start:p,limit:f}))){let p=await ue(b);if(!p){e.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:k.id,targetType:M});continue}let f=await I.resolveProviderId(p.resourceType,p.externalId,p.create);if(f==="error")throw Error(`IAM delta failed to resolve access subject for ${M}:${k.id}`);if(f==="absent")continue;let R=b.metadata;h({value:f.found,type:te(b.subjectType),...R?.display?{display:R.display}:{}})}if(M==="group"){let b=d();for(let p of k.groups??[]){let f=Et(p),R=Xt(p);if(!R&&f)R=await b?.groups.get(f);if(R&&R.requestable!==!0)continue;if(!R){e.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:f,target:k.id});continue}let A=await I.resolveProviderId("group",R.id,hn(R,"group"));if(A==="error")throw Error(`IAM delta failed to resolve nested Group for group:${k.id}`);if(A!=="absent")h({value:A.found,type:"Group"})}}return j.length>0?j:void 0},ne=async(k)=>{if(!E()||!T("user"))return"skipped";let M=k.externalId;if(!M)return e.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:k.id,kind:"user"}),"skipped";let I=re();if(!I)return"skipped";let j=await(r.mapUserToScim?.(k)??is(k));return I.upsertResource("user",M,j)},se=async(k)=>{if(!E()||!T("workload"))return"skipped";let M=k.externalId??k.id;if(!M)return"skipped";let I=re();if(!I)return"skipped";let j=await(r.mapWorkloadToScim?.({...k,externalId:M})??as({...k,externalId:M}));return I.upsertResource("workload",M,j)},oe=async(k)=>{if(!E()||!T("customer"))return"skipped";let M=k.externalId??k.id;if(!M)return"skipped";let I=re();if(!I)return"skipped";let j=await(r.mapCustomerToScim?.({...k,externalId:M})??ss({...k,externalId:M}));return I.upsertResource("customer",M,j)},S=async(k,M,I=!0)=>{if(!E()||!m())return"skipped";let j=d(),h=(j?await Pr(j,M).get(k.id):void 0)??k;if(h.requestable!==!0)return"skipped";let x=re();if(!x)return"skipped";let b=await Y(h,M,x),p=await x.upsertResource("group",h.id,hn(h,M,b)),f=r.accessStore;if(p!=="pushed"||!I||!f)return p;for await(let R of Yt((A,V)=>f.listByTarget(M,k.id,{start:A,limit:V})))if(await J(R,"add")==="error")throw Error(`IAM delta failed to restore access for ${M}:${k.id}`);return p},L=(k,M)=>{if(k==="error")throw Error(`IAM delta: destination rejected ${M}`)},z=(k,M,I)=>{if(M==="pushed")k.pushed+=1;else if(M==="skipped")k.skipped+=1;else k.errors.push(`IAM delta: destination rejected ${I}`)},H={async onUserUpsert(k){L(await ne(k),"user upsert")},async onUserDelete(k){if(!E()||!T("user"))return;let M=re();if(!M)return;L(await M.deleteResource("user",k),"user delete")},async onWorkloadUpsert(k){L(await se(k),"workload upsert")},async onWorkloadDelete(k){if(!E()||!T("workload"))return;let M=re();if(!M)return;L(await M.deleteResource("workload",k),"workload delete")},async onCustomerUpsert(k){L(await oe(k),"customer upsert")},async onCustomerDelete(k){if(!E()||!T("customer"))return;let M=re();if(!M)return;L(await M.deleteResource("customer",k),"customer delete")},async onEntitlementUpsert(k,M){L(await S(k,M),`${M} upsert`)},async onEntitlementDelete(k,M){if(!E())return;let I=re();if(!I)return;L(await I.deleteResource("group",M),`${k} delete`)},async onGrant(k){if(!E())return;if(await J(k,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(k){if(!E())return;if(await J(k,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async requestAccess(k){let M=t.url,I=P();if(I!==void 0||M===void 0)throw Error(`Cannot submit an access request: ${I??"destination URL is not configured"}`);let j=await(r.fetchImpl??fetch)(`${Ic(M)}/AccessRequests`,{method:"POST",headers:{Authorization:`Bearer ${await v()}`,"Content-Type":"application/json"},body:JSON.stringify(k)});if(!j.ok)throw Error(`AccessRequests failed: ${j.status} ${await j.text()}`);return await j.json()},async reconcile(k){let M={pushed:0,skipped:0,errors:[]},I=O();if(I)return M.errors.push(`iam delta not ready: ${I}`),M;let j=async(K,h,x)=>{if(!K)return;for await(let b of K)try{z(M,await h(b),x(b))}catch(p){M.errors.push(p instanceof Error?p.message:String(p))}};return await j(k.groups,(K)=>S(K,"group",!1),(K)=>`group upsert for ${K.id}`),await j(k.roles,(K)=>S(K,"role",!1),(K)=>`role upsert for ${K.id}`),await j(k.permissions,(K)=>S(K,"permission",!1),(K)=>`permission upsert for ${K.id}`),await j(k.users,(K)=>ne(K),(K)=>`user upsert for ${K.id??"unknown"}`),await j(k.workloads,(K)=>se(K),(K)=>`workload upsert for ${K.id}`),await j(k.customers,(K)=>oe(K),(K)=>`customer upsert for ${K.id??"unknown"}`),await j(k.access,(K)=>J(K,"add"),(K)=>`membership push for ${Et(K.target)??"unknown"}`),M},async getDestinationRef(k,M){return ie.read(k,M)},isReady:E,ready:g.ready};return{update(k,M){t=k,r=M,re(),g.refresh();let I=O();if(!m())w=void 0;else if(I!==w){if(I)e.warn(`IAM delta configured but not ready: ${I}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:I});w=I}return H},handle(){return H}}}var vn=2,Ec=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"iam.workloads",module:"iam",label:"SCIM Workloads inbound",requires:"workloadIdentityStore",incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."},{key:"iam.customers",module:"iam",label:"SCIM Customers inbound",requires:"customerStore",incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."},{key:"tm.integration",module:"tm",label:"Tenant Management staged integration and consent",requires:"TenantStore integration methods + onConnectRequest",incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."}];import{IoniteError as Ac}from"@ionite/core";function _c(e){if(e instanceof Ac)return{status:e.status,statusText:e.statusText};if(typeof e!=="object"||e==null)return;let t=e,r=typeof t.status==="number"?t.status:void 0,n=typeof t.statusText==="string"?t.statusText:void 0;return r!=null||n?{status:r,statusText:n}:void 0}function At(e){if(e instanceof Response)return e;let t=_c(e);if(!t)return Response.json({error:"internal_error"},{status:500});let n={status:t.status??500};if(t.statusText)n.statusText=t.statusText;return Response.json({error:t.statusText??"internal_error"},n)}function me(){return Response.json({error:"not_found"},{status:404})}function Ge(e=["GET"]){return Response.json({error:"method_not_allowed",allow:e},{status:405,headers:{Allow:e.join(", ")}})}import{timingSafeEqual as Lc}from"node:crypto";import{parseKmsPoolDocument as xc,stableConfigHash as us}from"@ionite/core";function cs(e,t,r){for(let n of e)try{n()}catch(o){t.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:r,error:o instanceof Error?o.message:String(o)})}}function We(e,t){let r=new Set,n=new Set;return{beforeChange(o){return r.add(o),()=>{r.delete(o)}},afterChange(o){return n.add(o),()=>{n.delete(o)}},emitBefore(){cs(r,e,`${t} beforeChange`)},emitAfter(){cs(n,e,`${t} afterChange`)}}}var Uc=604800000,Mc=2147483647,jc=1;function ps(e,t){if(!e.value)return!1;if(e.notBefore&&Date.parse(e.notBefore)>t)return!1;if(e.notAfter&&Date.parse(e.notAfter)<=t)return!1;return!0}function Le(e,t,r=Date.now()){if(!e)return;let n=e.slots?.[t];if(!n)return;let o=e.keys.find((s)=>s.id===n&&s.state==="active");return o&&ps(o,r)?o:void 0}function Sn(e,t=Date.now()){if(!e)return[];return e.keys.filter((r)=>(r.state==="active"||r.state==="deprecated")&&ps(r,t))}function ds(e){return{...e,...e.meta?{meta:{...e.meta}}:{}}}function Ir(e,t,r){if(!t||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>o(Error(r)),t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function ls(e,t){let r=Buffer.from(e),n=Buffer.from(t);return r.length===n.length&&Lc(r,n)}function Wc(e){if(!Number.isInteger(e)||e<1)throw Error("KMS unique() requires a positive integer slot count.");return e}var $c=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function qc(e){return $c.has(e)}function fs(e){let t=e.trim().replace(/\/+$/,"");if(!t||t==="/")return"/";return t.startsWith("/")?t:`/${t}`}function Nc(e,t){let r=fs(e),n=fs(t);return r===n||r.endsWith(n)}function Kc(e,t,r){let n=We(t,`KMS pool "${e}"`),o=new Set,s=!1,i,a,c=0,u,l,w=jc,m,T,P=new Map,O=new Set,E,g=()=>i!==void 0&&i.slots===void 0&&i.keys.length>0,v=ge(`KMS pool "${e}"`,()=>{if(!s)return!1;if(g())return Sn(i).length>0;return Le(i,0)!==void 0}),d=ge(`KMS pool "${e}" issuer`,()=>s&&m!==void 0),C=(b)=>b===0?`KMS pool "${e}"`:`KMS pool "${e}" slot ${b}`,_=(b)=>{let p=P.get(b),f=p?.valueWaiter;if(!p||!f)return;if(!s){p.valueWaiter=void 0,f.reject(Error(`${C(b)} is no longer configured.`));return}if(g()){p.valueWaiter=void 0,f.reject(Error(`${C(b)} verifier grant has no slots.`));return}let R=Le(i,b);if(R?.value)p.valueWaiter=void 0,f.resolve(R.value)},N=()=>{for(let b of P.keys())_(b)},B=(b)=>{let p=P.get(b);if(!p)return;let f=Le(i,b);for(let R of p.listeners)try{R(f?ds(f):void 0)}catch(A){t.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:e,slot:b,error:A instanceof Error?A.message:String(A)})}},ee=()=>{for(let b of P.keys())B(b)},ie=()=>{for(let b of P.values())b.latch.refresh();v.refresh(),d.refresh()},re=()=>{try{E?.()}catch(b){t.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:e,error:b instanceof Error?b.message:String(b)})}E=void 0},te=()=>{if(E||O.size===0||!m?.subscribeEvents||!T)return;let b=T;E=m.subscribeEvents((p)=>{if(!qc(p.event)||!Nc(p.path,b))return;let f={path:p.path,event:p.event,...p.requestId===void 0?{}:{requestId:p.requestId},...p.keyId===void 0?{}:{keyId:p.keyId}};for(let R of O)try{R(f)}catch(A){t.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:e,error:A instanceof Error?A.message:String(A)})}})},ue=()=>{if(l)clearTimeout(l);l=void 0},W=()=>{ue();let b=Date.now();if(i){for(let f of i.keys){if(!f.notAfter)continue;let R=Date.parse(f.notAfter)-b;if(R>0&&R<=Uc&&(f.state==="active"||f.state==="deprecated")&&!o.has(f.id))o.add(f.id),t.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:e,keyId:f.id,notAfter:f.notAfter})}let p=i.keys.flatMap((f)=>[f.notBefore,f.notAfter]).filter((f)=>Boolean(f)).map((f)=>Date.parse(f)).filter((f)=>f>b).sort((f,R)=>f-R);if(p[0])l=setTimeout(()=>{let f=new Map([...P.keys()].map((R)=>[R,Le(i,R)?.id]));ie(),r();for(let R of P.keys())if(f.get(R)!==Le(i,R)?.id)B(R);W()},Math.min(p[0]-b+1,Mc))}ie(),r(),N()},J=(b)=>{let p=new Map([...P.keys()].map((f)=>{let R=Le(i,f);return[f,{id:R?.id,value:R?.value}]}));n.emitBefore();try{i=xc(b),W();for(let f of P.keys()){let R=Le(i,f),A=p.get(f);if(A?.id!==R?.id||A?.value!==R?.value)B(f)}}catch(f){i=void 0,W(),ee(),t.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:e,error:f instanceof Error?f.message:String(f)})}finally{n.emitAfter()}},Y=()=>{try{u?.()}catch(b){t.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:e,error:b instanceof Error?b.message:String(b)})}u=void 0},ne=(b,p)=>{m=b,T=p,c+=1;let f=c;Y(),b.subscribe(p,(R)=>{if(c!==f||!s)return;J(R.data)},{kmsSlots:w}).then((R)=>{if(c!==f||!s){R();return}u=R}).catch((R)=>{if(c!==f||!s)return;i=void 0,W(),ee(),t.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:e,path:p,error:R instanceof Error?R.message:String(R)})})},se=(b,p)=>{let f=S(b),R=Le(i,b);if(!s)return Promise.reject(Error(`${C(b)} is no longer configured.`));if(g())return Promise.reject(Error(`${C(b)} verifier grant has no slots.`));if(R?.value)return Promise.resolve(R.value);if(!f.valueWaiter){let V,X,F=new Promise((ae,Q)=>{V=ae,X=Q});f.valueWaiter={promise:F,resolve:V,reject:X}}let A=f.valueWaiter.promise;return _(b),Ir(A,p,`${C(b)} was not ready within ${p}ms.`)},oe=(b,p)=>{let f=S(b);f.listeners.add(p);let R=Le(i,b);return p(R?ds(R):void 0),()=>f.listeners.delete(p)};function S(b){let p=P.get(b);if(p)return p;let f=ge(C(b),()=>s&&Le(i,b)!==void 0),R={listeners:new Set,latch:f,api:{value:(A)=>se(b,A),current:()=>Le(i,b)?.value,subscribe:(A)=>oe(b,A),park:(A,V)=>H(A,V),isReady:f.isReady,ready:f.ready}};return P.set(b,R),R}let L=(b)=>{if(g())throw Error(`KMS pool "${e}" verifier grant has no slots.`);let p=Wc(b),f=p>w;w=Math.max(w,p);let R=[];for(let A=0;A<p;A+=1)R.push(S(A).api);if(f&&s&&m&&T)ne(m,T);return R},z=(b)=>Sn(i).find((p)=>p.value!==void 0&&ls(b,p.value)),H=(b,p)=>{if(!s||!m||!T)return Promise.reject(Error(`KMS pool "${e}" is not configured.`));if(typeof b.value!=="string"||b.value.length===0)return Promise.reject(Error(`KMS pool "${e}" park() requires a non-empty value.`));let f=z(b.value);if(!f)return Promise.resolve({parked:!1,stale:!0});return Ir(m.parkKmsKey(T,{keyId:f.id,status:b.status,reason:b.reason},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" park() did not complete within ${p}ms.`)},k=()=>{if(!s||!m||!T)throw Error(`KMS pool "${e}" is not configured.`);return{source:m,path:T}},M=(b)=>{if(!Array.isArray(b)||b.length===0)throw Error(`KMS pool "${e}" addKeys() requires a non-empty keys array.`);return b.map((p,f)=>{if(!p||typeof p!=="object")throw Error(`KMS pool "${e}" addKeys() keys[${f}] must be an object.`);if(typeof p.value!=="string"||p.value.length===0)throw Error(`KMS pool "${e}" addKeys() keys[${f}].value must be a non-empty string.`);if(p.id!==void 0&&(typeof p.id!=="string"||p.id.length===0))throw Error(`KMS pool "${e}" addKeys() keys[${f}].id must be a non-empty string when present.`);return p})},I=(b,p)=>{try{let{source:f,path:R}=k(),A=M(b);return Ir(f.addKmsKeys(R,{keys:A},p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" addKeys() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},j=(b,p)=>{try{let{source:f,path:R}=k();if(typeof b.keyId!=="string"||b.keyId.length===0)throw Error(`KMS pool "${e}" revokeKey() requires a non-empty keyId.`);return Ir(f.revokeKmsKey(R,b,p&&p>0?{timeout:p}:void 0),p,`KMS pool "${e}" revokeKey() did not complete within ${p}ms.`)}catch(f){return Promise.reject(f)}},K=(b)=>{let{source:p}=k();if(!p.subscribeEvents)throw Error(`KMS pool "${e}" events are not supported by this secrets transport.`);return O.add(b),te(),()=>{O.delete(b)}};S(0);let h={value:(b)=>se(0,b),current:()=>Le(i,0)?.value,unique:L,accepts:(b)=>Sn(i).some((p)=>p.value!==void 0&&ls(b,p.value)),park:H,subscribe:(b)=>oe(0,b),beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:v.isReady,ready:v.ready},x={addKeys:I,revokeKey:j,events:K,isReady:d.isReady,ready:d.ready};return{api:h,issuer:x,update(b,p,f){let R=us({config:b,path:f});if(s=!0,a===R){ie();return}a=R,Y(),re(),ue(),i=void 0,ie(),r(),ee(),N(),ne(p,f),te()},unavailable(b){s=!0,a=us(b),c+=1,m=void 0,T=void 0,re(),Y(),ue(),i=void 0,ie(),r(),ee(),N()},remove(){if(!s)return;n.emitBefore(),s=!1,a=void 0,c+=1,m=void 0,T=void 0,re(),Y(),ue(),i=void 0,ie(),r(),ee(),N(),n.emitAfter()},close(){s=!1,c+=1,m=void 0,T=void 0,re(),O.clear(),Y(),ue();for(let b of P.values())b.listeners.clear();i=void 0,N();for(let b of P.values())b.latch.settle();v.settle(),d.settle()},isConfigured:()=>s}}function ms(e){let t=new Map,r=new Map,n=We(e,"KMS"),o=!1,i=ge("KMS module",()=>o&&Array.from(t.values()).every((m)=>!m.isConfigured()||m.api.isReady())),a,c=()=>i.refresh(),u=(m)=>{let T=t.get(m);if(T)return T;let P=Kc(m,e,c);if(t.set(m,P),!(m in a))Object.assign(a,{[m]:P.api});return P},l=(m)=>{let T=t.get(m);if(!T)throw Error(`KMS pool "${m}" is not configured.`);return T.api},w=(m)=>{let T=t.get(m);if(!T)throw Error(`KMS pool "${m}" is not configured.`);return T.issuer};return a={get config(){return Object.fromEntries(r)},beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:i.isReady,ready:i.ready,listPools:()=>Array.from(r.keys()),getPool:l,issuer:w},{handle:()=>a,update(m,T){if(!m&&!o&&t.size===0)return;n.emitBefore(),o=m!==void 0;let P=new Set(Object.keys(m??{}));for(let[O,E]of Object.entries(m??{})){r.set(O,{...E});let g=E.path??`/kms/${O}`;try{u(O).update(E,T(E),g)}catch(v){u(O).unavailable(E),e.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:O,error:v instanceof Error?v.message:String(v)})}}for(let[O,E]of t){if(P.has(O))continue;r.delete(O),E.remove()}return i.refresh(),n.emitAfter(),o||t.size>0?a:void 0},close(){for(let m of t.values())m.close();t.clear(),r.clear(),o=!1,i.settle()}}}import{formatLogLine as Vc}from"@ionite/core";import{context as Fc,trace as Dc}from"@opentelemetry/api";import{logs as zc,SeverityNumber as Ke}from"@opentelemetry/api-logs";import{OTLPLogExporter as Bc}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as Gc}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as Hc}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as Jc}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as Yc}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as Xc}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as Zc}from"@opentelemetry/resources";import{BatchLogRecordProcessor as Qc}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as eu}from"@opentelemetry/sdk-metrics";import{NodeSDK as tu}from"@opentelemetry/sdk-node";var gs={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},ru={trace:!1,debug:!1,info:!0,warn:!0,error:!0},nu={trace:Ke.TRACE,debug:Ke.DEBUG,info:Ke.INFO,warn:Ke.WARN,error:Ke.ERROR};function kn(e,t){let r=t[e];if(r===!1)return!1;if(e==="metrics")return r===!0||typeof r==="object";return!0}function Rn(e){return typeof e==="object"&&e!==null?e:void 0}function ou(e){return typeof e==="object"&&e!==null?e:void 0}function su(e,t){let r=e.replace(/\/+$/,"");if(r.endsWith(gs[t]))return r;return`${r}${gs[t]}`}function iu(e,t){let r=Rn(e[t]);if(r?.endpoint)return r.endpoint;if(!e.endpoint)return;return su(e.endpoint,t)}function au(e,t,r){let n=Rn(e[t]),o={...e.headers,...n?.headers??{}};if(r)o.Authorization=`Bearer ${r}`;return o}function Cn(e,t,r){let n=Rn(e[t]);return{url:iu(e,t),headers:au(e,t,r),timeoutMillis:n?.timeoutMillis,concurrencyLimit:n?.concurrencyLimit}}function cu(e,t){let r=Cn(e,"traces",t);return e.protocol==="http/json"?new Yc(r):new Xc(r)}function uu(e,t){let r=Cn(e,"metrics",t);return e.protocol==="http/json"?new Hc(r):new Jc(r)}function du(e,t){let r=Cn(e,"logs",t);return e.protocol==="http/json"?new Bc(r):new Gc(r)}function lu(e){return{"service.name":e.name,...e.version?{"service.version":e.version}:{},...e.deploymentEnvironment?{"deployment.environment.name":e.deploymentEnvironment}:{},...e.resourceAttributes??{}}}async function fu(e){if(!e.oauth)return;let t=new URLSearchParams({grant_type:"client_credentials",client_id:e.oauth.clientId,client_secret:e.oauth.clientSecret});if(e.oauth.scope)t.set("scope",e.oauth.scope);if(e.oauth.audience)t.set("audience",e.oauth.audience);let r=await fetch(e.oauth.tokenUrl,{method:"POST",headers:{"content-type":"application/x-www-form-urlencoded",...e.oauth.headers??{}},body:t});if(!r.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${r.status}`);let n=await r.json();if(typeof n.access_token!=="string"||!n.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return n.access_token}function pu(e,t){return{...ru,...t?.levels??{},...e.levels??{}}}function Zt(e,t="Authorization"){let r={...e.headers??{}};if(!e.apiKey)return r;let n=e.apiKeyHeader??t;return r[n]=n.toLowerCase()==="authorization"?`Bearer ${e.apiKey}`:e.apiKey,r}function mu(e,t){return Object.keys(e).some((r)=>r.toLowerCase()===t.toLowerCase())}function ws(e,t,r){let n=Object.keys(e).find((o)=>o.toLowerCase().startsWith(t.toLowerCase()));if(n)throw Error(`OpenTelemetry provider "${r}" does not support provider-specific header "${n}".`)}function Qt(e,t,r,n){return{type:r,name:e.name,version:e.version,protocol:e.protocol??"http/protobuf",endpoint:e.endpoint,headers:n,resourceAttributes:lu(e),levels:pu(e,t),console:e.console??"info",traces:e.traces,metrics:e.metrics,logs:e.logs}}function gu(e,t){return Qt(e,t,"otlp",Zt(e))}function yu(e,t){return Qt(e,t,"grafana-lgtm",Zt(e))}function hu(e,t){let r=Zt(e,"DD-API-KEY");if(!mu(r,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return Qt(e,t,"datadog",r)}function wu(e,t){let r=Zt(e);return ws(r,"DD-","splunk"),Qt(e,t,"splunk",r)}function vu(e,t){let r=Zt(e);return ws(r,"DD-","elastic"),Qt(e,t,"elastic",r)}function Su(e,t){let r=e.type??"otlp";switch(r){case"otlp":return gu(e,t);case"grafana-lgtm":return yu(e,t);case"datadog":return hu(e,t);case"splunk":return wu(e,t);case"elastic":return vu(e,t);default:throw Error(`Unsupported OpenTelemetry provider type: ${r}`)}}function ku(e,t){if(typeof e==="string")return e;if(e instanceof Error)return e.message;if(e!=null)return bn(e);if(t.length===0)return"";return bn(t[0])}function bn(e){if(typeof e==="string")return e;try{return JSON.stringify(e)}catch{return String(e)}}function ys(e,t,r){if(r==null)return;if(typeof r==="string"||typeof r==="number"||typeof r==="boolean"){e[t]=r;return}if(Array.isArray(r)&&r.every((n)=>["string","number","boolean"].includes(typeof n))){e[t]=r;return}if(r instanceof Error){if(e[`${t}.name`]=r.name,e[`${t}.message`]=r.message,r.stack)e[`${t}.stack`]=r.stack;return}e[t]=bn(r)}function bu(e){let t={};for(let[n,o]of e.entries()){if(o&&typeof o==="object"&&!Array.isArray(o)&&!(o instanceof Error)&&Object.getPrototypeOf(o)===Object.prototype){for(let[s,i]of Object.entries(o))ys(t,s,i);continue}ys(t,`param.${n}`,o)}let r=Dc.getSpanContext(Fc.active());if(r)t.trace_id=r.traceId,t.span_id=r.spanId,t.trace_flags=r.traceFlags;return t}function Ru(e){return e}function Cu(e,t){globalThis.console[Ru(e)](Vc(e,t.body,[t.attributes??{}]))}function Tu(e,t,r,n){if(r.console==="off")return;if((t.severityNumber??0)<nu[r.console])return;let o=n?.console;if(o){o(t);return}Cu(e,t)}function Pu(e,t){let r=zc.getLogger(e.name,e.version),n=(o,s,i)=>{if(!e.levels[o])return;let a={severityNumber:s,severityText:o.toUpperCase(),body:ku(i[0],i.slice(1)),attributes:bu(i.slice(1))};try{r.emit(a)}finally{Tu(o,a,e,t)}};return{trace:(o,...s)=>n("trace",Ke.TRACE,[o,...s]),debug:(o,...s)=>n("debug",Ke.DEBUG,[o,...s]),info:(o,...s)=>n("info",Ke.INFO,[o,...s]),warn:(o,...s)=>n("warn",Ke.WARN,[o,...s]),error:(o,...s)=>n("error",Ke.ERROR,[o,...s])}}function Iu(e){return e?.current()}function Ou(e,t,r){let n=t;return e.subscribe((o)=>{let s=o?.value;if(s===n)return;n=s,r()})}function hs(e){return{state:"unavailable",beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:e,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function Tn(e,t,r,n){if(!t&&!r)return;if(!t)return hs(e);let o=t,s;if(o.apiKeyPool&&n)try{s=n.getPool(o.apiKeyPool)}catch{s=void 0}let i=Iu(s),a=()=>Tn(e,o,r,n),c=o.apiKeyPool&&n?(v)=>Ou(n.getPool(o.apiKeyPool),i,v):void 0;if(o.apiKeyPool&&!i){let v=hs(e);return v.onCredentialChange=c,v.rebuild=a,v}let u=i?{...o,apiKey:i}:o,l=Su(u,r),w,m=!1,T=Pu(l,r),P,O,E=new Promise((v,d)=>{P=v,O=d});async function g(){try{let v=await fu(o),d={resource:Zc(l.resourceAttributes),instrumentations:r?.instrument};if(r?.sampler)d.sampler=r.sampler;if(r?.textMapPropagator)d.textMapPropagator=r.textMapPropagator;if(r?.contextManager)d.contextManager=r.contextManager;if(r?.spanProcessors)d.spanProcessors=r.spanProcessors;else if(kn("traces",l))d.traceExporter=cu(l,v);if(r?.metricReaders)d.metricReaders=r.metricReaders;else if(kn("metrics",l)){let _=ou(l.metrics);d.metricReaders=[new eu({exporter:uu(l,v),exportIntervalMillis:_?.exportIntervalMillis,exportTimeoutMillis:_?.exportTimeoutMillis})]}if(r?.logRecordProcessors)d.logRecordProcessors=r.logRecordProcessors;else if(kn("logs",l))d.logRecordProcessors=[new Qc({exporter:du(l,v)})];let C=r?.configure?.(d);w=new tu(C??d),w.start(),m=!0,P?.()}catch(v){m=!1;let d=v instanceof Error?v:Error(String(v));e.error?.("OpenTelemetry startup failed",d),O?.(d)}finally{P=void 0,O=void 0}}return{state:"available",start:g,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>m,ready:(v)=>{if(!v||v<=0)return E;return Promise.race([E,new Promise((d,C)=>{setTimeout(()=>C(Error(`OpenTelemetry ready timed out after ${v}ms.`)),v)})])},logger:T,forceFlush:async()=>{await w?.forceFlush?.()},shutdown:async()=>{m=!1,await w?.shutdown(),w=void 0},onCredentialChange:c,rebuild:a}}function vs(e){let t,r,n,o=0,s=Promise.resolve(),i=We(e,"OpenTelemetry"),a=ge("OpenTelemetry module",()=>t?.isReady()===!0),c={beforeChange:i.beforeChange,afterChange:i.afterChange,isReady:a.isReady,ready:a.ready,logger:{trace:(w,...m)=>(t?.logger??e).trace(w,...m),debug:(w,...m)=>(t?.logger??e).debug(w,...m),info:(w,...m)=>(t?.logger??e).info(w,...m),warn:(w,...m)=>(t?.logger??e).warn(w,...m),error:(w,...m)=>(t?.logger??e).error(w,...m)},forceFlush:async()=>{await t?.forceFlush()},shutdown:async()=>{await t?.shutdown()}},u=!1,l;return l={update(w){if(!w){if(t||r){let O=t,E=r;o+=1,i.emitBefore(),n?.(),n=void 0,t=void 0,r=void 0,a.refresh(),s=Promise.all([O?.shutdown(),E?.shutdown()]).finally(()=>i.emitAfter()).then(()=>{return},()=>{return})}return u?c:void 0}if(u=!0,w===t||w===r)return c;let m=t,T=r;o+=1;let P=o;return i.emitBefore(),n?.(),n=void 0,t=void 0,r=w,a.refresh(),s=(async()=>{try{if(await Promise.all([m?.shutdown(),T?.shutdown()]),await w.start(),P!==o||r!==w){await w.shutdown();return}t=w,r=void 0,a.refresh(),n=w.onCredentialChange?.(()=>{if(t!==w)return;let O=w.rebuild?.();if(O)l.update(O)})}finally{if(P===o)i.emitAfter()}})().then(()=>{return},()=>{return}),c},settled(){return s},async shutdown(){o+=1;let w=t,m=r;n?.(),n=void 0,t=void 0,r=void 0,a.settle(),await Promise.all([w?.shutdown(),m?.shutdown()])}},l}import{ION_ENDPOINT_PERMISSIONS as _t,trimTrailingSlash as Ss}from"@ionite/core";import{hasPermission as Eu}from"@ionite/core/server";async function er(e,t,r){let n=await Eu(e,t,r.permission,void 0,r.subjectType);return n.allow?void 0:n.response()}function Au(e){let t=Ss(e);return{matchesPath:(o)=>{if(!o)return!1;return Ss(o)===t},startsWithPath:(o)=>{if(!o)return!1;return e===o||e.startsWith(`${o}/`)}}}function ks(e,t,r,n){let o=n??new URL(e.url).pathname,{matchesPath:s,startsWithPath:i}=Au(o);if(t.sso){let a=t.sso;if(s(r.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(c)=>a.handler(c)};if(s(r.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(c)=>a.logout(c)};if(s(r.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(c)=>a.logoutBackChannel(c)};if(s(r.sso.loginUrl)||s(r.sso.refreshUrl)||s(r.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(c)=>a.handler(c)}}if(t.ciam){let a=t.ciam;if(s(r.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(c)=>{let u=await a.resolveCustomer(c);if(u.status==="degraded")return new Response(JSON.stringify({error:"auth_unavailable"}),{status:503,headers:{"Content-Type":"application/json"}});if(u.status==="unauthenticated")return new Response(JSON.stringify({error:"Unauthorized"}),{status:401,headers:{"Content-Type":"application/json"}});return new Response(JSON.stringify(u.value),{headers:{"Content-Type":"application/json"}})}};if(s(r.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(c)=>a.logout(c)}}if(t.iam){let a=t.iam,c=e.method!=="GET"&&e.method!=="HEAD";if(i(r.iam.usersUrl))return{module:"iam",kind:c?"iam.users.write":"iam.read",requiredPermission:_t[c?"iam.users.write":"iam.read"],handler:async(u)=>a.handler(u)};if(i(r.iam.groupsUrl))return{module:"iam",kind:c?"iam.groups.write":"iam.read",requiredPermission:_t[c?"iam.groups.write":"iam.read"],handler:async(u)=>a.handler(u)};if(i(r.iam.workloadsUrl))return{module:"iam",kind:c?"iam.workloads.write":"iam.read",requiredPermission:_t[c?"iam.workloads.write":"iam.read"],handler:async(u)=>a.handler(u)};if(i(r.iam.customersUrl))return{module:"iam",kind:c?"iam.customers.write":"iam.read",requiredPermission:_t[c?"iam.customers.write":"iam.read"],handler:async(u)=>a.handler(u)};if(i(`${r.iam.basePath}/AccessRequests`))return{module:"iam",kind:"iam.access-requests.write",requiredPermission:_t["iam.access-requests.write"],handler:async(u)=>a.handler(u)};if(i(r.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(u)=>a.handler(u)}}if(t.workload){let a=t.workload;if(s(r.workload.validateUrl)||s(r.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(c)=>a.handler(c)}}if(t.secrets){let a=t.secrets;if(a.isLfvDeliveryRequest?.(e)&&a.handleLfvDelivery){let c=a.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(u)=>c(u)}}if(a.isLfvEventsRequest?.(e)&&a.handleLfvEvents){let c=a.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(u)=>c(u)}}}if(t.ciam){let a=t.ciam;if(s(r.ciam.magicLinkUrl)&&e.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:_t["ciam.magic-link.create"],handler:async(c)=>a.handler(c)};if(s(r.ciam.magicLinkLoginUrl)&&e.method==="GET"||s(r.ciam.customerProvidersUrl)&&e.method==="GET"||s(r.ciam.customerLoginUrl)&&e.method==="GET"||s(r.ciam.customerCallbackUrl)&&(e.method==="GET"||e.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(c)=>a.handler(c)}}return}async function Pn(e,t,r,n){let o=n??De(pr()),s=new URL(e.url).pathname;if(r?.filter){let w=await r.filter(e,t);if(w instanceof Response)return w;if(w==="not_handled")return me()}let i=ks(e,t,o,s),c=await r?.resolve?.(e,t,i)??i;if(!c)return me();let u=c.requiredPermission===void 0?i?.requiredPermission:c.requiredPermission,l=async()=>{if(u){let w=await er(e,t,u);if(w)return w}return c.handler(e)};if(r?.wrap)return await r.wrap(e,c,l,t);return await l()}import{stableConfigHash as Xu}from"@ionite/core";function Or(){let e=0;return{next:()=>(e+=1,e),isCurrent:(t)=>t===e,current:()=>e}}import{readFile as Bu,stat as Gu}from"node:fs/promises";class Lt extends Error{constructor(e,t,r){super(e);this.code=t;this.status=r;this.sourceType="vault";this.name="VaultWebSocketCommandError"}}class He extends Error{constructor(e,t=`Vault secret not found at path ${e}`){super(t);this.path=e;this.sourceType="vault";this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}}class ye extends Error{constructor(e,t,r,n,o){super(e,o);this.path=t;this.status=r;this.code=n;this.sourceType="vault";this.name="VaultRequestError"}}class xe extends Error{constructor(e,t,r=`Vault subscribe is not supported for source ${e} at path ${t} without websocket, LFV, or ttl`){super(r);this.sourceType=e;this.path=t;this.name="VaultSubscribeNotSupportedError"}}function bs(e){return e instanceof He||e instanceof Lt&&(e.code==="not_found"||e.status===404)}import{WebSocket as tr}from"ws";var _u=1000,Lu=30000,Cs=30000,Ts=Cs;function Ps(e){Ts=e>0?e:Cs}function Is(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function xu(e){let t=Math.min(Lu,_u*2**Math.min(e,16)),r=0.5+Math.random()*0.5;return Math.round(t*r)}var gt=new Map;function Uu(e){return e.trim().replace(/\/+$/g,"")}function Os(e,t){let r=typeof t?.version==="number"?t.version:0,n=t?.created_time??t?.created,o=typeof n==="string"?new Date(n):new Date,s=lt(t);return{path:e,version:r,created:o,...s?{contentType:s}:{}}}function Mu(e){return typeof e?.version==="number"?e.version:void 0}function ju(e){let t=e.token?.trim();if(!t)return{};if(e.header==="Authorization")return{Authorization:t.startsWith("Bearer ")?t:`Bearer ${t}`};return{"X-Vault-Token":t}}function rr(e){return{client_id:e.clientId,token:e.token,header:e.header??"X-Vault-Token"}}function On(e,t){let r=Uu(e),n=gt.get(r);if(n){if(t&&!n.log)n.log=t;return n}let o={url:r,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:t};return gt.set(r,o),o}function Wu(e){let t=[...Array.from(e.subs.values(),(o)=>o.creds),...e.eventListeners.values()];if(t.length===0)return e.lastGoodCreds??{url:e.url};let r=e.lastGoodCreds?[e.lastGoodCreds,...t]:t,n=r[e.reconnectCredCursor%r.length]??t[0];return e.reconnectCredCursor+=1,n}function Rs(e,t){for(let r of e.subs.values())try{r.onHealth?.(t)}catch(n){e.log?.warn("Vault websocket health hook threw",n)}}function $u(e,t){for(let r of Array.from(e.subs.values())){let n=r.onFirstSecretReject;if(r.onFirstSecret=void 0,r.onFirstSecretReject=void 0,n)try{n(new ye(`Vault websocket subscription interrupted (${t})`,r.path,void 0,"connection"))}catch(o){e.log?.warn("Vault websocket first-secret waiter rejection threw",o)}}}function Es(e,t){for(let r of e.pending.values())clearTimeout(r.timer),r.reject(new ye(`Vault websocket command interrupted (${t})`,"/",void 0,"connection"));e.pending.clear()}function Er(e){if(e.disposed)return;if(e.disposed=!0,e.reconnectTimer)clearTimeout(e.reconnectTimer),e.reconnectTimer=void 0;Es(e,"closed"),$u(e,"socket disposed");let t=e.ws;if(e.ws=void 0,e.connectPromise=void 0,e.hasConnected=!1,gt.delete(e.url),t)try{t.removeAllListeners(),t.close()}catch{}}function Ar(e){if(e.subs.size>0||e.pending.size>0||e.eventListeners.size>0)return;Er(e)}function In(e){return`${e.clientId??""}|${e.token??""}|${e.header??"X-Vault-Token"}`}function As(e){let t=new Map;for(let r of e.eventListeners.values())t.set(In(r),r);return Array.from(t.values())}function qu(e,t){if(typeof t.path!=="string"||typeof t.event!=="string")return;let r={path:t.path,event:t.event,...typeof t.request_id==="string"?{requestId:t.request_id}:{},...typeof t.key_id==="string"&&t.key_id.length>0?{keyId:t.key_id}:{}};for(let n of e.eventListeners.keys())try{n(r)}catch(o){e.log?.warn("Vault websocket event listener threw",o)}}function _s(e,t,r,n){if(n!==void 0&&t.lastVersion!==void 0&&n===t.lastVersion)return;if(n!==void 0)t.lastVersion=n;try{t.onChange(r)}catch(s){e.log?.warn("Vault websocket subscription onChange threw",s)}let o=t.onFirstSecret;if(t.onFirstSecret=void 0,t.onFirstSecretReject=void 0,o)try{o()}catch(s){e.log?.warn("Vault websocket subscription onFirstSecret threw",s)}}function Nu(e,t){let r=t.subscription_id;if(typeof r!=="string")return;let n=e.subs.get(r);if(!n)return;let o={data:t.data,metadata:Os(typeof t.path==="string"?t.path:n.path,t.metadata)};_s(e,n,o,Mu(t.metadata))}function Ku(e,t){let r;try{r=JSON.parse(t.toString())}catch(n){e.log?.warn("Vault websocket message parse failed",n);return}if(r.type==="secret"){Nu(e,r);return}if(r.type==="event"){qu(e,r);return}if(r.type==="command_result"&&typeof r.id==="string"){let n=e.pending.get(r.id);if(!n)return;if(e.pending.delete(r.id),clearTimeout(n.timer),r.ok===!1)n.reject(new Lt(r.error??`Vault websocket command failed for ${r.id}`,r.code,r.status));else n.resolve(r.result);Ar(e)}}function Ls(e,t){e.send(JSON.stringify({type:"subscribe",subscription_id:t.subscriptionId,paths:[t.path],...Is(t.kmsSlots),...rr(t.creds)}))}function En(e){if(e.disposed||e.reconnectTimer||e.subs.size===0&&e.eventListeners.size===0)return;let t=xu(e.reconnectAttempts);e.reconnectAttempts+=1,e.reconnectTimer=setTimeout(()=>{if(e.reconnectTimer=void 0,e.disposed)return;if(e.subs.size===0&&e.eventListeners.size===0){Er(e);return}_r(e,Wu(e)).catch(()=>{if(e.hasConnected)e.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${t}ms).`);En(e)})},t)}function _r(e,t){if(e.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if(e.ws&&e.ws.readyState===tr.OPEN)return Promise.resolve(e.ws);if(e.connectPromise)return e.connectPromise;return e.connectPromise=new Promise((r,n)=>{let o=new tr(e.url,{headers:ju(t)}),s=!1,i=e.hasConnected,a=()=>{s=!0,e.hasConnected=!0,e.reconnectAttempts=0,e.reconnectCredCursor=0,e.lastGoodCreds=t,e.ws=o,e.connectPromise=void 0,o.on("message",(l)=>Ku(e,l));for(let l of e.subs.values())try{Ls(o,l)}catch{}for(let l of As(e))try{o.send(JSON.stringify({type:"subscribe_events",...rr(l)}))}catch{}if(i)Rs(e,!0);r(o)},c=()=>{if(e.ws===o)e.ws=void 0;e.connectPromise=void 0;try{o.removeAllListeners()}catch{}if(Es(e,"socket closed"),e.subs.size>0||e.eventListeners.size>0)Rs(e,!1),En(e);else Er(e)},u=(l)=>{if(e.ws===o)e.ws=void 0;if(!s)s=!0,e.connectPromise=void 0,n(l)};o.once("open",a),o.on("close",c),o.on("error",u)}),e.connectPromise}async function An(e,t,r,n){let o=On(e.url,n),s=typeof r.path==="string"?r.path:"/",i=await _r(o,e),a=crypto.randomUUID();try{return await new Promise((c,u)=>{let l=setTimeout(()=>{if(!o.pending.has(a))return;o.pending.delete(a),u(new ye(`Vault websocket command "${t}" timed out`,s,void 0,"timeout"));try{o.ws?.close()}catch{}},Ts);o.pending.set(a,{resolve:(w)=>c(w),reject:u,timer:l});try{i.send(JSON.stringify({type:"command",id:a,command:t,...r,...rr(e)}))}catch(w){clearTimeout(l),o.pending.delete(a),u(w)}})}finally{Ar(o)}}async function _n(e,t,r,n){let o;try{o=await An(e,"read_secret",{path:t,...Is(n)},r)}catch(s){if(bs(s))throw new He(t);if(s instanceof Lt||s instanceof ye)throw s;throw new ye(`Vault websocket read_secret failed for ${t}`,t,void 0,"connection",{cause:s})}if(!o||typeof o!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${t}`);return{data:o.data,metadata:Os(typeof o.path==="string"?o.path:t,o.metadata)}}async function xs(e,t,r,n,o,s){let i=On(e.url,o),a=crypto.randomUUID(),c={subscriptionId:a,creds:e,path:t,...n?.kmsSlots!==void 0?{kmsSlots:n.kmsSlots}:{},onChange:r,onHealth:s?.onHealth};i.subs.set(a,c);let u=()=>{if(!i.subs.delete(a))return;if(i.ws&&i.ws.readyState===tr.OPEN)try{i.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:a}))}catch{}Ar(i)};try{let l=await _r(i,e);Ls(l,c)}catch(l){if(n?.mode!=="wait")throw u(),l}try{let l=await _n(e,t,o,n?.kmsSlots);_s(i,c,l,l.metadata.version)}catch(l){if(n?.mode!=="wait")throw u(),l;await new Promise((w,m)=>{let T,P=(O)=>{if(T)clearTimeout(T);c.onFirstSecret=void 0,c.onFirstSecretReject=void 0,u(),m(O)};if(c.onFirstSecret=()=>{if(T)clearTimeout(T);w()},c.onFirstSecretReject=P,typeof n.timeout==="number"&&n.timeout>0)T=setTimeout(()=>P(l),n.timeout)})}return u}async function Us(e,t,r){let n=On(e.url,r);n.eventListeners.set(t,e);try{let o=await _r(n,e);if(o.readyState===tr.OPEN)o.send(JSON.stringify({type:"subscribe_events",...rr(e)}))}catch(o){n.log?.warn("Vault websocket event subscription connect failed; retrying in background",o),En(n)}return()=>{if(!n.eventListeners.delete(t))return;let o=In(e);if(!As(n).some((i)=>In(i)===o)&&n.ws&&n.ws.readyState===tr.OPEN)try{n.ws.send(JSON.stringify({type:"unsubscribe_events",...rr(e)}))}catch{}Ar(n)}}function Ms(){let e=0;for(let t of gt.values())e+=t.subs.size;return{urls:Array.from(gt.keys()),sockets:gt.size,subscriptions:e}}function js(){for(let e of Array.from(gt.values()))Er(e)}var Lr=600000;function yt(e){if(e&&e<Lr)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${Lr} milliseconds (10 minutes), as not to overload the store with polling requests`)}function Je(e,t,r,n,o,s,i){let a=!1,c,u,l,w=(g)=>{try{i?.onHealth?.(g)}catch{}},m=()=>{if(a=!0,c)clearTimeout(c),c=void 0;u?.()},T=(g)=>new Promise((v)=>{let d=setTimeout(()=>{u=void 0,c=void 0,v()},g);c=d,u=()=>{clearTimeout(d),u=void 0,c=void 0,v()}});async function P(){let g=Date.now();for(;;){if(a)return;try{let v=await e.getFullSecret(t,s);return w(!0),v}catch(v){if(w(!1),s?.mode!=="wait")throw v;if(typeof s.timeout==="number"&&s.timeout>0&&Date.now()-g>=s.timeout)throw v;if(a)return;o?.warn(`Error retrieving initial secret from vault. Retrying in ${n} milliseconds`,v),await T(n)}}}async function O(){if(c=void 0,a)return;try{let g=await e.getFullSecret(t,s);if(w(!0),g.metadata.version!==l)l=g.metadata.version,r(g)}catch(g){w(!1),o?.warn(`Error retrieving remote config from vault. Retrying in ${n} milliseconds`,g)}E()}function E(){if(a)return;c=setTimeout(()=>{O()},n)}return P().then((g)=>{if(a||!g)return()=>m();return l=g.metadata.version,r(g),E(),()=>m()})}function Vu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Fu(e){let t={"Content-Type":"application/json"};if(e)t["X-Vault-Token"]=e;return t}function Du(e){return Boolean(e?.idpTokenUrl?.trim()&&e.clientId?.trim()&&e.clientSecret?.trim())}async function Ws(e,t){let r=Date.now();if(t.token&&t.expiresAt&&t.expiresAt-60000>r)return t.token;let n=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});if(e.scope?.trim())n.set("scope",e.scope.trim());let o=await fetch(e.idpTokenUrl,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:n.toString()});if(!o.ok)throw Error(`Vault workload token request failed (${o.status})`);let s=await o.json();if(!s.access_token)throw Error("Vault workload token response did not include access_token");return t.token=s.access_token,t.expiresAt=r+Math.max(1,s.expires_in??300)*1000,s.access_token}function zu(e){return{Authorization:e.startsWith("Bearer ")?e:`Bearer ${e}`}}function nr(e){return e.replace(/\/data\/?$/,"")}function $s(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let n=e;if(typeof n.parked!=="boolean")throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let o=n.disposition;if(o!==void 0&&o!=="cooldown"&&o!=="suspect")throw Error(`Vault ${r} kms_park returned invalid disposition for ${t}`);return{parked:n.parked,...n.stale===!0?{stale:!0}:{},...o?{disposition:o}:{}}}function qs(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);let n=e;if(!Array.isArray(n.keys))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);return{keys:n.keys.map((s,i)=>{if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}] for ${t}`);let a=s.id;if(typeof a!=="string"||a.length===0)throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}].id for ${t}`);return{id:a}})}}function Ns(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);let n=e;if(typeof n.revoked!=="boolean")throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);return{revoked:n.revoked}}function xt(e,t){let{type:r="vault",url:n,token:o,ttl:s}=e,i=()=>e.log,a=Du(e.workload)?e.workload:void 0,c={},u=Fu(o),{lfv:l,websocket:w}=e,m=l?pt({...l,log:l.log??i(),path:l.path??"/"},t):void 0,T=new Map,P=w?.url?.trim(),O=new Set,E=!1,g=!1;if(!l&&!n&&!P)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(yt(s),n&&!o&&!a&&!l)i()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function v(){if(a){let h=await Ws(a,c);return{"Content-Type":"application/json",...zu(h)}}return{...u}}async function d(h){let x=N(h);if(a){let b=await Ws(a,c);return{url:x,clientId:w?.clientId??a.clientId,token:b,header:"Authorization"}}return{url:x,clientId:w?.clientId,token:w?.token??o,header:w?.header??"X-Vault-Token"}}function C(h){if(!l)throw Error(`Vault LFV capability is not configured for path ${h}`);let x=T.get(h);if(x)return x;let b=pt({...l,log:l.log??i(),path:h},t);return T.set(h,b),b}function _(h){if(!n)throw Error(`Vault HTTP capability is not configured for path ${h}`);return n}function N(h){if(!P)throw Error(`Vault websocket capability is not configured for path ${h}`);return P}async function B(h,x){let b=await d(typeof x.path==="string"?x.path:"/");return An(b,h,x,i())}async function ee(h,x){let b=_(h),p;try{let f=await v(),R=new URL(`${b}/${h}`);if(typeof x?.kmsSlots==="number"&&Number.isInteger(x.kmsSlots)&&x.kmsSlots>=1)R.searchParams.set("kms_slots",String(x.kmsSlots));p=await fetch(R,{headers:f})}catch(f){throw new ye(`Vault request failed from URL: ${b}/${h}`,h,void 0,"connection",{cause:f})}if(p.status!==200){if(p.status===404)throw new He(h);let f=p.status===401||p.status===403,R=f?`Vault returned ${p.status} ${p.statusText} (auth error) from URL: ${b}/${h}`:`Vault returned invalid status, ${p.status}: '${p.statusText}' from URL: ${b}/${h}`;throw new ye(R,h,p.status,f?"auth":"invalid_status")}try{let R=(await p.json()).data;if(!R?.metadata||!("data"in R))throw Error("Missing vault secret data");let A=R.metadata.created_time??R.metadata.created;return{data:R.data,metadata:{path:typeof R.metadata.path==="string"?R.metadata.path:h,version:typeof R.metadata.version==="number"?R.metadata.version:0,created:A instanceof Date?A:typeof A==="string"?new Date(A):new Date,...lt(R.metadata)?{contentType:lt(R.metadata)}:{}}}}catch(f){throw new ye("Error retrieving secret",h,void 0,"invalid_payload",{cause:f})}}async function ie(h,x){let b=await d(h);return _n(b,h,i(),x?.kmsSlots)}async function re(h){let x=_(h),b=`${nr(x)}/metadata/${h}`,p=await v(),f=await fetch(b,{headers:p});if(f.status!==200)throw new ye(`Vault getMetadata failed (${f.status}) for ${h}`,h,f.status,"invalid_status");let R=await f.json().catch(()=>null);if(!R?.metadata||typeof R.metadata!=="object")throw new ye(`Vault getMetadata returned invalid payload for ${h}`,h,f.status,"invalid_payload");return R.metadata}async function te(h,x,b){let p=_(x),f=`${nr(p)}/${h}/${x}`,R=await v(),A=await fetch(f,{method:"POST",headers:R,body:JSON.stringify({reason:b?.reason,severity:b?.severity,incident_ref:b?.incidentRef})});if(A.status!==200&&A.status!==202&&A.status!==204)throw new ye(`Vault ${h} failed (${A.status}) for ${x}`,x,A.status,"invalid_status")}async function ue(h,x){if(l)return await C(h).getFullSecret(h,x);if(n)return await ee(h,x);return await ie(h,x)}async function W(h,x,b){if(!Vu(x))throw Error(`putSecret requires an object value for vault source at path ${h}`);if(l){await C(h).putSecret(h,x,b);return}if(n){let p=_(h),f=await v();if(f["X-Ionite-Mime-Type"]=b.contentType.mimeType,f["X-Ionite-Secret-Format"]=b.contentType.format,b.contentType.schemaUrl)f["X-Ionite-Schema-Url"]=b.contentType.schemaUrl;if(b.contentType.typeId)f["X-Ionite-Secret-Type"]=b.contentType.typeId;let R=await fetch(`${p}/${h}`,{method:"POST",headers:f,body:JSON.stringify(x)});if(R.status!==200&&R.status!==201&&R.status!==204)throw new ye(`Vault putSecret failed (${R.status}) for ${h}`,h,R.status,"invalid_status");return}await B("put_secret",{path:h,data:x,content_type:Sr(b.contentType)})}async function J(h,x){if(l){await C(h).deleteSecret(h,x);return}if(n){let b=_(h),p=await v(),f=await fetch(`${b}/${h}`,{method:"DELETE",headers:p});if(f.status!==200&&f.status!==202&&f.status!==204)throw new ye(`Vault deleteSecret failed (${f.status}) for ${h}`,h,f.status,"invalid_status");return}await B("delete_secret",{path:h})}async function Y(h,x){if(l)return await C(h).listPaths(h,x);if(n){let f=`${_(h)}/${h}`,R=async(F)=>{let ae=await v();if(F==="LIST")return fetch(f,{method:"LIST",headers:ae});let Q=f.includes("?")?"&":"?";return fetch(`${f}${Q}list=true`,{method:"GET",headers:ae})},A=await R("LIST");if(A.status===405||A.status===501)A=await R("GET");if(A.status!==200)throw new ye(`Vault listPaths failed (${A.status}) for ${h}`,h,A.status,"invalid_status");let V=await A.json().catch(()=>null),X;if(V&&typeof V==="object"){let F=V,ae=F.data;if(ae&&typeof ae==="object")X=ae.keys;else X=F.keys}if(!Array.isArray(X))throw new ye(`Vault listPaths returned an unexpected response for ${h}`,h,void 0,"invalid_payload");return X.filter((F)=>typeof F==="string")}let b=await B("list_paths",{path:h});if(!Array.isArray(b.items))throw Error(`Vault websocket list_paths returned invalid payload for ${h}`);return b.items.filter((p)=>typeof p==="string")}async function ne(h,x){if(l)return await C(h).exists(h,x);if(n){let p=_(h),f=await v(),R=await fetch(`${p}/${h}`,{headers:f});if(R.status===200)return!0;if(R.status===404)return!1;if(R.status===401||R.status===403)throw new ye(`Vault exists failed (${R.status}) for ${h} (auth error)`,h,R.status,"auth");throw new ye(`Vault exists failed (${R.status}) for ${h}`,h,R.status,"invalid_status")}let b=await B("exists",{path:h});if(typeof b.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${h}`);return b.exists}async function se(h,x,b){if(l){await C(h).requestRotate(h,x,b);return}if(n){await te("rotate/request",h,x);return}await B("request_rotate",{path:h,reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef})}async function oe(h,x,b){if(l){await C(h).requestRevoke(h,x,b);return}if(n){await te("revoke/request",h,x);return}await B("request_revoke",{path:h,reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef})}async function S(h,x,b){if(l)return await C(h).parkKmsKey(h,x,b);if(n){let f=_(h),R=`${nr(f)}/kms/park/${h}`,A=await v(),V=await fetch(R,{method:"POST",headers:A,body:JSON.stringify({key_id:x.keyId,status:x.status,reason:x.reason})});if(V.status!==200&&V.status!==202)throw new ye(`Vault kms/park failed (${V.status}) for ${h}`,h,V.status,"invalid_status");return $s(await V.json().catch(()=>null),h,"http")}let p=await B("kms_park",{path:h,key_id:x.keyId,status:x.status,reason:x.reason});return $s(p,h,"websocket")}async function L(h,x,b){if(l)return await C(h).addKmsKeys(h,x,b);if(n){let f=_(h),R=`${nr(f)}/kms/add-keys/${h}`,A=await v(),V=await fetch(R,{method:"POST",headers:A,body:JSON.stringify({keys:x.keys})});if(V.status!==200&&V.status!==202)throw new ye(`Vault kms/add-keys failed (${V.status}) for ${h}`,h,V.status,"invalid_status");return qs(await V.json().catch(()=>null),h,"http")}let p=await B("kms_add_keys",{path:h,keys:x.keys});return qs(p,h,"websocket")}async function z(h,x,b){if(l)return await C(h).revokeKmsKey(h,x,b);if(n){let f=_(h),R=`${nr(f)}/kms/revoke-key/${h}`,A=await v(),V=await fetch(R,{method:"POST",headers:A,body:JSON.stringify({key_id:x.keyId,reason:x.reason})});if(V.status!==200&&V.status!==202)throw new ye(`Vault kms/revoke-key failed (${V.status}) for ${h}`,h,V.status,"invalid_status");return Ns(await V.json().catch(()=>null),h,"http")}let p=await B("kms_revoke_key",{path:h,key_id:x.keyId,reason:x.reason});return Ns(p,h,"websocket")}async function H(h,x){if(l)return await C(h).getMetadata(h,x);if(n)return await re(h);let b=await B("read_metadata",{path:h});if(!b.metadata||typeof b.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${h}`);return b.metadata}async function k(h,x,b){if(!s)throw new xe(r,h);return Je({getFullSecret:ee},h,x,s,i(),b,{onHealth:(p)=>{E=!p}})}async function M(h,x,b){let p=await d(h);return xs(p,h,x,b,i(),{onHealth:(f)=>{g=!f}})}function I(h){let x=()=>{if(O.delete(x))h()};return O.add(x),x}function j(){if(m?.isAvailable?.()===!1)return!0;for(let h of T.values())if(h.isAvailable?.()===!1)return!0;return!1}let K={type:r,isAvailable:()=>!E&&!g&&!j(),get:(h,x)=>Ne(()=>ue(h,x)),getFullSecret:ue,getSecret:async(h,x)=>(await ue(h,x)).data,putSecret:W,deleteSecret:J,listPaths:Y,exists:ne,requestRotate:se,requestRevoke:oe,parkKmsKey:S,addKmsKeys:L,revokeKmsKey:z,getMetadata:H,subscribe:async(h,x,b)=>{let p;if(P)p=await M(h,x,b);else if(l)p=await C(h).subscribe(h,x,b);else p=await k(h,x,b);return I(p)},...m?{subscribeEvents:(h)=>I(m.subscribeEvents?.(h)??(()=>{}))}:P?{subscribeEvents:(h)=>{let x,b=!1;return d("/").then((p)=>Us(p,h,i())).then((p)=>{if(b){p();return}x=p}).catch((p)=>{i()?.warn("Vault websocket event subscription failed",p)}),I(()=>{b=!0,x?.()})}}:{},close:()=>{for(let x of Array.from(O))try{x()}catch(b){i()?.warn("Vault source close: failed to release a subscription",b)}O.clear();let h=(x)=>{if(!x?.close)return;try{Promise.resolve(x.close()).catch((b)=>{i()?.warn("Vault source close: LFV close failed",b)})}catch(b){i()?.warn("Vault source close: LFV close failed",b)}};for(let x of T.values())h(x);h(m),T.clear(),c.token=void 0,c.expiresAt=void 0},get log(){return e.log},set log(h){e.log=h}};if(m)K.isDeliveryRequest=(h)=>m.isDeliveryRequest(h),K.isEventsRequest=(h)=>m.isEventsRequest(h),K.handleDelivery=(h)=>m.handleDelivery(h),K.handleEvents=(h)=>m.handleEvents(h),Object.defineProperties(K,{deliveryPath:{value:m.deliveryPath,enumerable:!0},eventsPath:{value:m.eventsPath,enumerable:!0},callbackKey:{value:m.callbackKey,enumerable:!0},trustId:{value:m.trustId,enumerable:!0}});return K}class Ur extends Error{constructor(e,t){super(e);this.name="AzureKeyVaultError",this.status=t,Object.setPrototypeOf(this,Ur.prototype)}}function xr(e,t){if(!e||e.trim().length===0)throw Error(`Missing required Azure config: ${t}`);return e}function Hu(e){return e.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function Ln(e,t){return`${e.replace(/\/+$/g,"")}/${t.replace(/^\/+/g,"")}`}function Ju(e){try{let r=new URL(e).pathname.split("/").filter(Boolean),n=r.indexOf("secrets");if(n===-1)return;return r[n+2]||void 0}catch{return}}function Yu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Mr(e){let t=e.apiVersion??"7.4",r=e.scope??"https://vault.azure.net/.default",n=e.secretNameTransform??Hu,o=e.authMethod,s="/var/run/secrets/azure/tokens/azure-identity-token",i=e.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",a=e.vaultUrl??(e.vaultName?`https://${e.vaultName}.vault.azure.net`:void 0)??void 0,c=xr(a,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function u(W){try{return await Gu(W),!0}catch{return!1}}let l,w,m=!1;async function T(W){let{entraTenantId:J,clientId:Y}=e;if(!J)throw Error("Workload identity requires entraTenantId");if(!Y)throw Error("Workload identity requires clientId");if(!await u(i))throw Error(`Federated token file not found at ${i}`);let ne=(await Bu(i,"utf8")).trim();if(!ne)throw Error("Federated token file was empty");let se=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,oe=new URLSearchParams({client_id:Y,grant_type:"client_credentials",scope:r,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:ne}),S=await fetch(se,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:oe});if(S.status!==200)throw Error(`Azure workload identity token exchange returned ${S.status} ${S.statusText}`);let L=await S.json();if(!L?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:L.access_token,expiresAtMs:W+(L.expires_in??0)*1000},L.access_token}async function P(W){let J=e.imdsApiVersion??"2018-02-01",Y="https://vault.azure.net",ne=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(ne.searchParams.set("api-version",J),ne.searchParams.set("resource","https://vault.azure.net"),e.managedIdentityClientId)ne.searchParams.set("client_id",e.managedIdentityClientId);let se=await fetch(ne.toString(),{headers:{Metadata:"true",Accept:"application/json"}});if(se.status!==200)throw Error(`Azure IMDS token endpoint returned ${se.status} ${se.statusText}`);let oe=await se.json();if(!oe?.access_token)throw Error("IMDS token response missing access_token");let S=W+60000;if(oe.expires_on){let L=Number.parseInt(oe.expires_on,10);if(Number.isFinite(L)&&L>0)S=L*1000;else{let z=Date.parse(oe.expires_on);if(Number.isFinite(z))S=z}}else if(oe.expires_in){let L=Number.parseInt(oe.expires_in,10);if(Number.isFinite(L)&&L>0)S=W+L*1000}return l={accessToken:oe.access_token,expiresAtMs:S},oe.access_token}async function O(W){let J=xr(e.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),Y=xr(e.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),ne=xr(e.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),se=`https://login.microsoftonline.com/${encodeURIComponent(J)}/oauth2/v2.0/token`,oe=new URLSearchParams({client_id:Y,client_secret:ne,grant_type:"client_credentials",scope:r}),S=await fetch(se,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:oe});if(S.status!==200)throw Error(`Azure token endpoint returned ${S.status} ${S.statusText}`);let L=await S.json();if(!L?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:L.access_token,expiresAtMs:W+(L.expires_in??0)*1000},L.access_token}async function E(){let W=Date.now();if(l&&l.expiresAtMs-60000>W)return l.accessToken;if(w)return w;w=(async()=>{if(o==="workload_identity")return await T(W);if(o==="managed_identity")return await P(W);if(o==="client_secret")return await O(W);if(await u(i))try{return await T(W)}catch{}try{return await P(W)}catch{}return await O(W)})();try{return await w}finally{w=void 0}}async function g(W){let J=await E(),Y=Ln(c,`/secrets/${encodeURIComponent(W)}?api-version=${encodeURIComponent(t)}`),ne=await fetch(Y,{headers:{Authorization:`Bearer ${J}`,Accept:"application/json"}});if(ne.status!==200)throw new Ur(`Key Vault request failed (${ne.status})`,ne.status);return await ne.json()}async function v(W,J){let Y=n(W),ne=e.secretNamePrefix?`${e.secretNamePrefix}${Y}`:Y,se=await g(ne),oe=se.value;try{oe=JSON.parse(se.value)}catch{}let S=se.attributes?.created?se.attributes.created*1000:void 0,L=Ju(se.id),z=se.contentType?vr({mimeType:se.contentType,format:se.tags?.["ionite-format"],schemaUrl:se.tags?.["ionite-schema-url"],typeId:se.tags?.["ionite-type-id"]}):void 0;return{data:oe,metadata:{path:W,version:Number.parseInt(L??"",10)||0,created:S?new Date(S):new Date,...z?{contentType:z}:{}}}}async function d(W,J,Y){if(!Yu(J))throw Error(`putSecret requires an object value for azure source at path ${W}`);let ne=n(W),se=e.secretNamePrefix?`${e.secretNamePrefix}${ne}`:ne,oe=await E(),S=Ln(c,`/secrets/${encodeURIComponent(se)}?api-version=${encodeURIComponent(t)}`),L=JSON.stringify({value:JSON.stringify(J),contentType:Y.contentType.mimeType,tags:{"ionite-format":Y.contentType.format,...Y.contentType.schemaUrl?{"ionite-schema-url":Y.contentType.schemaUrl}:{},...Y.contentType.typeId?{"ionite-type-id":Y.contentType.typeId}:{}}}),z=await fetch(S,{method:"PUT",headers:{Authorization:`Bearer ${oe}`,"Content-Type":"application/json",Accept:"application/json"},body:L});if(z.status!==200&&z.status!==201)throw Error(`Key Vault putSecret failed (${z.status}) for ${W}`)}async function C(W,J){let Y=n(W),ne=e.secretNamePrefix?`${e.secretNamePrefix}${Y}`:Y,se=await E(),oe=Ln(c,`/secrets/${encodeURIComponent(ne)}?api-version=${encodeURIComponent(t)}`),S=await fetch(oe,{method:"DELETE",headers:{Authorization:`Bearer ${se}`,Accept:"application/json"}});if(S.status!==200&&S.status!==202&&S.status!==204)throw Error(`Key Vault deleteSecret failed (${S.status}) for ${W}`)}async function _(W,J){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${W}`)}async function N(W,J){try{return await v(W),!0}catch(Y){if(Y instanceof Ur&&Y.status===404)return!1;throw Y}}async function B(W,J,Y){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${W}`)}async function ee(W,J,Y){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${W}`)}async function ie(W){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${W}`)}async function re(W){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${W}`)}async function te(W){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${W}`)}async function ue(W,J){let Y=n(W),ne=e.secretNamePrefix?`${e.secretNamePrefix}${Y}`:Y,se=await g(ne),oe=se.contentType?vr({mimeType:se.contentType,format:se.tags?.["ionite-format"],schemaUrl:se.tags?.["ionite-schema-url"],typeId:se.tags?.["ionite-type-id"]}):void 0;return{id:se.id,...oe?{content_type:oe}:{},...se.attributes??{}}}return{type:e.type,isAvailable:()=>!m,get:(W,J)=>Ne(()=>v(W,J)),getFullSecret:v,getSecret:async(W,J)=>(await v(W,J)).data,putSecret:d,deleteSecret:C,listPaths:_,exists:N,requestRotate:B,requestRevoke:ee,parkKmsKey:ie,addKmsKeys:re,revokeKmsKey:te,getMetadata:ue,subscribe:(W,J,Y)=>{if(!e.ttl)throw new xe("azure",W);return yt(e.ttl),Je({getFullSecret:v},W,J,e.ttl,void 0,Y,{onHealth:(ne)=>{m=!ne}})},close:()=>{l=void 0,w=void 0,m=!1}}}var xn=Symbol("ion.secretsSourceState");function Zu(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${n}`)};return{type:"dev",get:(r,n)=>Ne(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[xn]:"unavailable"}}function Ks(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${n}`)};return{type:"dev",get:(r,n)=>Ne(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[xn]:"removed"}}function Qu(e){return e.type==="vault"&&e.lfv!=null}function ed(e,t,r,n){if(!Qu(t))return;if(r||n)return;throw Error(`Secrets source "${e}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function td(e,t,r){if(t.type==="vault")return xt(t,r);if(t.type==="azure")return Mr(t);if(t.type==="aws"||t.type==="gcp"||t.type==="dev")throw Error(`Secrets source "${e}" uses type "${t.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${e}"`)}function rd(e,t){let r=(n)=>{t.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:n instanceof Error?n.message:String(n)})};try{Promise.resolve(e.close?.()).catch(r)}catch(n){r(n)}}function nd(e){let t=new Map,r=new Map,n=new Map;for(let[o,s]of Object.entries(e)){if(!Vs(s))continue;let i=t.get(s.deliveryPath);if(i)throw Error(`LFV delivery path "${s.deliveryPath}" is claimed by both secrets sources "${i}" and "${o}"; delivery paths must be globally unique.`);t.set(s.deliveryPath,o);let a=r.get(s.eventsPath);if(a)throw Error(`LFV events path "${s.eventsPath}" is claimed by both secrets sources "${a}" and "${o}"; events paths must be globally unique.`);r.set(s.eventsPath,o);let c=n.get(s.callbackKey);if(c&&c.trustId!==s.trustId)throw Error(`LFV callback key "${s.callbackKey}" is claimed by secrets sources "${c.sourceName}" and "${o}" with different verify JWKS; a callback path must use a single trust key.`);if(!c)n.set(s.callbackKey,{sourceName:o,trustId:s.trustId})}}function Vs(e){return typeof e.isDeliveryRequest==="function"&&typeof e.isEventsRequest==="function"&&typeof e.handleDelivery==="function"&&typeof e.handleEvents==="function"}function od(e,t,r){let n={...t},o=[],s=(a)=>{if(n[a]!==void 0)delete n[a],o.push(a)};s("token"),s("clientSecret"),s("workload");let i=n.websocket;if(i&&typeof i==="object"&&i.token!==void 0){let a={...i};delete a.token,n.websocket=a,o.push("websocket.token")}if(o.length>0)r.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:e,"ion.droppedFields":o});return n}function sd(e,t,r){let n={},o=new Set([...Object.keys(t??{}),...Object.keys(r??{})]);for(let s of o){let i=t?.[s],a=r?.[s],c=a?od(s,a,e):void 0;n[s]={...i??{},...c??{}}}return n}function jr(e){return e[xn]??"available"}function id(e,t,r){let n=t,o=new Set,s=new Set,i=new Set,a=We(r,`Secrets source "${e}"`),c=()=>jr(n)==="available",u=ge(`Secrets source "${e}"`,c),l=(d,C,_)=>Error(`${d} timed out after ${_}ms waiting for source "${e}" to be configured by the ConfigSource at path ${C}`),w=(d,C)=>Error(`${d} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${C}`),m=(d,C,_)=>{let N=jr(n);if(N==="available")return Promise.resolve(n);if(N==="removed")return Promise.reject(w(d,C));return new Promise((B,ee)=>{let ie={method:d,path:C,resolve:(te)=>{if(ie.timeout)clearTimeout(ie.timeout);i.delete(ie),B(te)},reject:(te)=>{if(ie.timeout)clearTimeout(ie.timeout);i.delete(ie),ee(te)}},re=_?.timeout;if(typeof re==="number"&&re>0)ie.timeout=setTimeout(()=>{ie.reject(l(d,C,re))},re);i.add(ie)})},T=(d)=>{for(let C of Array.from(i))C.resolve(d)},P=()=>{for(let d of Array.from(i))d.reject(w(d.method,d.path))},O=async(d,C=!1)=>{let _=d.guard.next();if(d.unsubscribe?.(),d.unsubscribe=void 0,d.closed)return;if(jr(n)==="unavailable"&&d.options?.mode!=="wait"){if(C)throw Error(`subscribe is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${d.path}`);return}try{let B=await(d.options?.mode==="wait"?await m("subscribe",d.path,d.options):n).subscribe(d.path,(ee)=>{if(!d.closed)d.onChange(ee)},d.options);if(d.closed||!d.guard.isCurrent(_)){B?.();return}d.unsubscribe=B}catch(N){if(C)throw N;if(Cr(N)){r.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:e,path:d.path});return}r.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:e,path:d.path,error:N instanceof Error?N.message:String(N)})}},E=(d,C=!1)=>{if(d.unsubscribe?.(),d.unsubscribe=void 0,d.closed)return;if(!n.subscribeEvents){if(C)throw Error(`Secrets source "${e}" does not support lifecycle event subscriptions`);return}d.unsubscribe=n.subscribeEvents((_)=>{if(!d.closed)d.listener(_)})},g={get type(){return n.type},beforeChange:a.beforeChange,afterChange:a.afterChange,isAvailable:()=>c()&&(n.isAvailable?.()??!0),isReady:u.isReady,ready:u.ready,get:(d,C)=>Ne(async()=>(await m("get",d,C)).getFullSecret(d,C)),getFullSecret:async(d,C)=>(await m("getFullSecret",d,C)).getFullSecret(d,C),getSecret:async(d,C)=>(await m("getSecret",d,C)).getSecret(d,C),putSecret:async(d,C,_)=>(await m("putSecret",d,_)).putSecret(d,C,_),subscribe:async(d,C,_)=>{let N={path:d,onChange:C,options:_,closed:!1,guard:Or()};o.add(N);try{await O(N,!0)}catch(B){throw o.delete(N),B}return()=>{N.closed=!0,N.guard.next(),o.delete(N),N.unsubscribe?.(),N.unsubscribe=void 0}},subscribeEvents:(d)=>{let C={listener:d,closed:!1};s.add(C);try{E(C,!0)}catch(_){throw s.delete(C),_}return()=>{C.closed=!0,s.delete(C),C.unsubscribe?.(),C.unsubscribe=void 0}},deleteSecret:async(d,C)=>(await m("deleteSecret",d,C)).deleteSecret(d,C),listPaths:async(d,C)=>(await m("listPaths",d,C)).listPaths(d,C),exists:async(d,C)=>(await m("exists",d,C)).exists(d,C),requestRotate:async(d,C,_)=>(await m("requestRotate",d,_)).requestRotate(d,C,_),requestRevoke:async(d,C,_)=>(await m("requestRevoke",d,_)).requestRevoke(d,C,_),parkKmsKey:async(d,C,_)=>(await m("parkKmsKey",d,_)).parkKmsKey(d,C,_),addKmsKeys:async(d,C,_)=>(await m("addKmsKeys",d,_)).addKmsKeys(d,C,_),revokeKmsKey:async(d,C,_)=>(await m("revokeKmsKey",d,_)).revokeKmsKey(d,C,_),getMetadata:async(d,C)=>(await m("getMetadata",d,C)).getMetadata(d,C)},v=(d)=>{try{Promise.resolve(d.close?.()).catch((C)=>{r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:C instanceof Error?C.message:String(C)})})}catch(C){r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:C instanceof Error?C.message:String(C)})}};return{api:g,update(d){if(d===n)return;let C=n;a.emitBefore(),n=d;let _=jr(d);if(_==="available")T(d);else if(_==="removed")P();u.refresh();for(let N of o)O(N);for(let N of s)E(N);v(C),a.emitAfter()},close(){for(let d of o)d.closed=!0,d.guard.next(),d.unsubscribe?.(),d.unsubscribe=void 0;o.clear();for(let d of s)d.closed=!0,d.unsubscribe?.(),d.unsubscribe=void 0;s.clear(),P(),u.settle(),v(n)}}}function Fs(e,t=new Map){let r=new Map,n=new Map,o,s=!1,i=new Map,a=We(e,"Secrets"),c=!1,u=()=>{for(let g of r.keys()){let v=i.get(g);if(v&&v.api.isReady?.()===!1)return!1}return!0},l=ge("Secrets module",()=>c&&u()),w=(g)=>{let v=i.get(g);if(v)return v;let d=id(g,r.get(g)??Ks(g),e);if(i.set(g,d),!(g in E))Object.assign(E,{[g]:d.api});return d},m=(g)=>{let v=i.get(g)?.api;if(v)return v;throw e.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:g}),Error(`Secrets source "${g}" is not configured`)},T=()=>Array.from(r.values()).filter(Vs),P=(g)=>T().find((v)=>v.isDeliveryRequest(g)),O=(g)=>T().find((v)=>v.isEventsRequest(g)),E;return E={get config(){return Object.fromEntries(Array.from(r.keys(),(g)=>[g,w(g).api]))},beforeChange:a.beforeChange,afterChange:a.afterChange,isReady:l.isReady,isAvailable:()=>{for(let g of i.values()){if(g.api.isReady?.()===!1)continue;if(g.api.isAvailable?.()===!1)return!1}return!0},ready:l.ready,listSecretsSources:()=>Array.from(r.keys()),getSecretsSource:(g)=>{if(r.has(g))return w(g).api;return m(g)},get:(g,v,d)=>E.getSecretsSource(g).get(v,d),getSecret:(g,v,d)=>E.getSecretsSource(g).getSecret(v,d),getFullSecret:(g,v,d)=>E.getSecretsSource(g).getFullSecret(v,d),putSecret:(g,v,d,C)=>E.getSecretsSource(g).putSecret(v,d,C),deleteSecret:(g,v,d)=>E.getSecretsSource(g).deleteSecret(v,d),listPaths:(g,v,d)=>E.getSecretsSource(g).listPaths(v,d),exists:(g,v,d)=>E.getSecretsSource(g).exists(v,d),requestRotate:(g,v,d,C)=>E.getSecretsSource(g).requestRotate(v,d,C),requestRevoke:(g,v,d,C)=>E.getSecretsSource(g).requestRevoke(v,d,C),parkKmsKey:(g,v,d,C)=>E.getSecretsSource(g).parkKmsKey(v,d,C),addKmsKeys:(g,v,d,C)=>E.getSecretsSource(g).addKmsKeys(v,d,C),revokeKmsKey:(g,v,d,C)=>E.getSecretsSource(g).revokeKmsKey(v,d,C),getMetadata:(g,v,d)=>E.getSecretsSource(g).getMetadata(v,d),subscribe:(g,v,d,C)=>E.getSecretsSource(g).subscribe(v,d,C),isLfvDeliveryRequest:(g)=>P(g)!==void 0,isLfvEventsRequest:(g)=>O(g)!==void 0,handleLfvDelivery:async(g)=>{let v=P(g);if(!v)return me();return v.handleDelivery(g)},handleLfvEvents:async(g)=>{let v=O(g);if(!v)return me();return v.handleEvents(g)}},{update(g,v,d,C,_){let N=g!==void 0||v!==void 0;if(!N&&!c&&i.size===0)return;let B=sd(e,g,v),ee=_===!0,ie=C!==o,re=ee!==s,te=new Map,ue=new Map,W=[];try{for(let[J,Y]of Object.entries(B)){let ne=Xu(Y),se=r.get(J);if(se&&n.get(J)===ne&&!ie&&!re){te.set(J,se),ue.set(J,ne);continue}let oe;if(!Y.type)oe=Zu(J);else{if(d?.validateSourceConfig?.(J,Y),t.has(J)&&g?.[J])e.warn(`RemoteConfig secrets source "${J}" is superseded by the framework LFV bootstrap source.`);if(!t.has(J))ed(J,Y,C,ee),oe=td(J,Y,C),W.push(oe);else oe=t.get(J)}te.set(J,oe),ue.set(J,ne)}nd(Object.fromEntries(te))}catch(J){for(let Y of W)rd(Y,e);throw J}a.emitBefore(),c=N,o=C,s=ee;for(let[J,Y]of te)r.set(J,Y),n.set(J,ue.get(J)),w(J).update(Y);for(let[J,Y]of i){if(te.has(J))continue;r.delete(J),n.delete(J),Y.update(Ks(J))}return l.refresh(),a.emitAfter(),E},close(){for(let g of i.values())g.close();i.clear(),r.clear(),n.clear(),o=void 0,c=!1,l.settle()}}}function Un(e,t){let r=t.ttlMs,n=Math.max(1,Math.floor(t.maxEntries)),o=new Map,s=()=>Date.now();function i(){while(o.size>n){let c=o.keys().next().value;if(c===void 0)break;o.delete(c)}}function a(c,u){o.delete(c),o.set(c,{session:u,expiresAt:s()+r}),i()}return{async create(c){await e.create(c)},async get(c){let u=o.get(c);if(u){if(u.expiresAt>s())return o.delete(c),o.set(c,u),u.session;o.delete(c)}let l=await e.get(c);if(l)a(c,l);return l},async update(c,u){await e.update(c,u),o.delete(c)},async delete(c){await e.delete(c),o.delete(c)}}}import{deepEqualPlain as Ds,IoniteError as be,trimTrailingSlash as wt,validationFailureResponse as ad}from"@ionite/core";import{getCachedVerificationKey as cd}from"@ionite/core/server";function Bs(){let e,t=ge("tm module",()=>e!==void 0),r=()=>{if(!e)throw new be("Tenant Management is not ready",{status:503});return e},n={isReady:t.isReady,ready:t.ready,handler:(o)=>e?e.handler(o):Promise.resolve(Response.json({error:"Tenant Management is not ready"},{status:503})),getTenant:(o)=>r().getTenant(o),recordConsent:(o)=>r().recordConsent(o)};return{handle:n,update(o,s){return e=o,t.refresh(),s?n:void 0}}}var ud=600,dd=30;function Gs(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),r=t.padEnd(Math.ceil(t.length/4)*4,"=");return Uint8Array.from(atob(r),(n)=>n.charCodeAt(0)).buffer}function zs(e){return JSON.parse(new TextDecoder().decode(new Uint8Array(Gs(e))))}function Hs(e){return Array.isArray(e)&&e.length>0&&e.every((t)=>typeof t==="string")}function ld(e){if(!e||typeof e!=="object")throw new be("Invalid staged integration handle",{status:400});let t=e;if(typeof t.iss!=="string"||!(typeof t.aud==="string"||Hs(t.aud))||typeof t.iat!=="number"||typeof t.exp!=="number"||typeof t.jti!=="string"||typeof t.integratorTenantId!=="string"||typeof t.productId!=="string"||typeof t.applicationId!=="string")throw new be("Invalid staged integration claims",{status:400});return t}function fd(e,t){return Array.isArray(e)?e.includes(t):e===t}async function ht(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return Array.from(new Uint8Array(t),(r)=>r.toString(16).padStart(2,"0")).join("")}async function Wr(e,t){let r=await Js(e,t),n=ld(r),o=Math.floor(Date.now()/1000),s=t.consentTtlSeconds??ud;if(n.iat>o+60||n.exp-n.iat>s)throw new be("Staged integration handle lifetime is invalid",{status:401});return{handle:e,integrator:t.integrator.id,integratorName:n.integratorName??t.integrator.name,integratorTenantId:n.integratorTenantId,productId:n.productId,applicationId:n.applicationId,issuedAt:new Date(n.iat*1000).toISOString(),expiresAt:new Date(n.exp*1000).toISOString(),requestId:n.jti,tenantHint:n.tenantHint}}async function Js(e,t){let r=e.split(".");if(r.length!==3)throw new be("Invalid staged integration handle",{status:400});let n=zs(r[0]);if(!n||typeof n!=="object")throw new be("Invalid staged integration handle",{status:400});let{alg:o,kid:s}=n;if(o!=="RS256"||typeof s!=="string"||s.length===0)throw new be("Unsupported staged integration signature",{status:400});let i=zs(r[1]);if(!i||typeof i!=="object")throw new be("Invalid integrator token claims",{status:400});let a=i,c=await cd(t.integrator.jwksUri,s,"tm:RS256",(m)=>crypto.subtle.importKey("jwk",m,{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"]));if(!await crypto.subtle.verify({name:"RSASSA-PKCS1-v1_5"},c,Gs(r[2]),new TextEncoder().encode(`${r[0]}.${r[1]}`)))throw new be("Invalid staged integration signature",{status:401});let l=Math.floor(Date.now()/1000),w=a.azp??a.client_id;if(typeof a.iss!=="string"||a.iss.replace(/\/+$/,"")!==t.integrator.issuer.replace(/\/+$/,"")||!(typeof a.aud==="string"||Hs(a.aud))||!fd(a.aud,t.integrator.audience)||w!==t.integrator.clientId||typeof a.exp!=="number"||a.exp<=l)throw new be("Integrator token is not trusted or has expired",{status:401});return a}function Ys(e){try{return wt(new URL(e,"http://dummy").pathname)}catch{let t=e.startsWith("/")?e:`/${e}`;return wt(t)}}function pd(e,t){let r=new URL(e.url);return new URL(`/${encodeURIComponent(t)}/`,r.origin).toString()}function md(e,t){let r=Ys(t),n=wt(e);if(n===r)return null;if(!n.startsWith(`${r}/`))return null;let o=n.slice(r.length+1);if(!o||o.includes("/"))return null;return decodeURIComponent(o)}function $r(e){return e==="pending"||e==="processing"||e==="completed"||e==="failed"||e==="action_required"}function gd(e){if(!$r(e.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if(e.status==="completed"){if(!e.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:e.tenantUrl,status:"completed"},status:201}}if(e.status==="pending"||e.status==="processing")return{body:{tenantUrl:e.tenantUrl,status:e.status},status:202};if(e.status==="action_required"){if(!e.actionUrl||!e.requestToken||!e.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:e.actionUrl,requestToken:e.requestToken,expiresAt:e.expiresAt},status:200}}return{body:{tenantUrl:e.tenantUrl,status:"failed",error:e.error??"Tenant provisioning failed"},status:409}}function Xs(e,t,r){let n=r.validators.tenant.createTenantRequest,o=r.validators.tenant.updateTenantRequest;function s(g,v){let d=(C)=>new URL(C,v).toString();return{readyzUrl:d(g.readyzUrl),capabilitiezUrl:d(g.capabilitiezUrl),sso:{loginUrl:d(g.sso.loginUrl),userUrl:d(g.sso.userUrl),logoutUrl:d(g.sso.logoutUrl),logoutBackChannelUrl:d(g.sso.logoutBackChannelUrl),refreshUrl:d(g.sso.refreshUrl),callbackUrl:d(g.sso.callbackUrl)},workload:{validateUrl:d(g.workload.validateUrl),jwksUrl:d(g.workload.jwksUrl)},iam:{basePath:d(g.iam.basePath),usersUrl:d(g.iam.usersUrl),groupsUrl:d(g.iam.groupsUrl),workloadsUrl:d(g.iam.workloadsUrl),customersUrl:d(g.iam.customersUrl)},ciam:{magicLinkUrl:d(g.ciam.magicLinkUrl),magicLinkLoginUrl:d(g.ciam.magicLinkLoginUrl),customerUrl:d(g.ciam.customerUrl),customerLoginUrl:d(g.ciam.customerLoginUrl),customerCallbackUrl:d(g.ciam.customerCallbackUrl),customerProvidersUrl:d(g.ciam.customerProvidersUrl),logoutUrl:d(g.ciam.logoutUrl)}}}function i(g,v){let d=r.tenantIonBasePath?.(g);if(!d)return;let C=new URL(v.url).origin,_=s(De(d),C);return{callbackUrl:_.sso.callbackUrl,ionUrls:_}}function a(){if(!r.store.setIntegration||!r.store.getByIntegrationHandleHash)throw new be("Tenant integration requires store.setIntegration and store.getByIntegrationHandleHash",{status:501});return{setIntegration:r.store.setIntegration.bind(r.store),getByIntegrationHandleHash:r.store.getByIntegrationHandleHash.bind(r.store)}}async function c(g){let v=g.headers.get("Authorization");if(!v?.startsWith("Bearer "))return Response.json({error:"Unauthorized"},{status:401});try{await Js(v.slice(7),t);return}catch{return Response.json({error:"Unauthorized"},{status:401})}}function u(g){let{integration:v,...d}=g;if(!v)return d;return{...d,integration:{integrator:v.integrator,integratorName:v.integratorName,integratorTenantId:v.integratorTenantId,applicationId:v.applicationId,productId:v.productId,status:v.status,expiresAt:v.expiresAt,requestedAt:v.requestedAt,decidedAt:v.decidedAt}}}async function l(g){let v=await g.json();if(!v||typeof v.handle!=="string"||v.handle.length===0)throw new be("handle is required",{status:400});if(v.authorization!==void 0&&typeof v.authorization!=="string")throw new be("authorization must be a string",{status:400});return{handle:v.handle,authorization:v.authorization}}async function w(g){if(g.method!=="GET")return Ge(["GET"]);if(!r.onConnectRequest)return Response.json({error:"Tenant integration consent is not supported"},{status:501});let v=new URL(g.url).searchParams.get("handle");if(!v)return Response.json({error:"handle is required"},{status:400});let d=await Wr(v,t),C=d.tenantHint?await r.store.get(d.tenantHint):void 0;if(d.tenantHint&&!C)return me();if(C){let _=a(),N=await ht(v),B=C.integration;if(B&&B.handleHash!==N&&Date.parse(B.expiresAt)>Date.now())return Response.json({error:"Tenant already has an active integration request"},{status:409});if(!B||B.handleHash!==N){if(!await _.setIntegration(C.id,{version:(B?.version??0)+1,integrator:d.integrator,integratorName:d.integratorName,integratorTenantId:d.integratorTenantId,applicationId:d.applicationId,productId:d.productId,handleHash:N,status:"consent_requested",expiresAt:d.expiresAt,redeemAttempts:0,requestedAt:new Date().toISOString()},{expectedHandleHash:B?.handleHash??null,expectedVersion:B?.version}))return Response.json({error:"Integration request changed concurrently"},{status:409})}}return r.onConnectRequest({request:g,ion:e,staged:d,tenant:C})}async function m(g){if(g.method!=="POST")return Ge(["POST"]);let v=await c(g);if(v)return v;let{handle:d}=await l(g);await Wr(d,t);let C=await ht(d),_=a(),N=await _.getByIntegrationHandleHash(C);if(!N?.integration)return Response.json({status:"pending"},{status:202});let B=N.integration;if(Date.parse(B.expiresAt)<=Date.now())return Response.json({status:"expired"},{status:410});if(B.status==="consented"&&B.consentRedeemedAt)return Response.json({status:"consumed"},{status:410});let ee=t.maxRedeemAttempts??dd;if(B.redeemAttempts>=ee)return Response.json({status:"attempt_limit"},{status:429});let ie={...B,version:B.version+1,redeemAttempts:B.redeemAttempts+1},re=await _.setIntegration(N.id,ie,{expectedHandleHash:C,expectedVersion:B.version});if(!re?.integration)return Response.json({status:"pending"},{status:409});if(re.integration.status==="declined")return Response.json({status:"declined"},{status:200});if(re.integration.status!=="consented")return Response.json({status:"pending"},{status:202});let te=crypto.randomUUID().replace(/-/g,"")+crypto.randomUUID().replace(/-/g,""),ue={...re.integration,version:re.integration.version+1,consentRedeemedAt:new Date().toISOString(),exportTokenHash:await ht(te)};if(!await _.setIntegration(N.id,ue,{expectedHandleHash:C,expectedVersion:re.integration.version}))return Response.json({status:"consumed"},{status:409});return Response.json({status:"consented",tenantId:N.id,authorization:te,expiresAt:B.expiresAt})}async function T(g){if(g.method!=="POST")return Ge(["POST"]);let v=await c(g);if(v)return v;if(!r.exportConfig)return Response.json({error:"Config export is not supported"},{status:501});let{handle:d,authorization:C}=await l(g);if(!C)return Response.json({error:"authorization is required"},{status:400});await Wr(d,t);let _=await ht(d),N=a(),B=await N.getByIntegrationHandleHash(_),ee=B?.integration;if(!B||!ee||ee.status!=="consented"||ee.configExportedAt||!ee.exportTokenHash||ee.exportTokenHash!==await ht(C))return Response.json({error:"Export authorization is invalid or consumed"},{status:401});if(Date.parse(ee.expiresAt)<=Date.now())return Response.json({error:"Export authorization expired"},{status:410});let ie=await r.exportConfig({tenant:B}),re={...ee,version:ee.version+1,configExportedAt:new Date().toISOString(),exportTokenHash:void 0};if(!await N.setIntegration(B.id,re,{expectedHandleHash:_,expectedVersion:ee.version}))return Response.json({error:"Export authorization is already consumed"},{status:409});return Response.json(ie)}async function P(g){let v=await Wr(g.handle,t),d=await r.store.get(g.tenantId);if(!d)throw new be("Tenant not found",{status:404});if(v.tenantHint&&v.tenantHint!==d.id)throw new be("Staged request is bound to another tenant",{status:409});let C=await ht(g.handle),_=d.integration;if(_?.status==="consented"&&_.handleHash!==C)throw new be("A consented tenant cannot be rebound",{status:409});if(_&&_.handleHash!==C&&Date.parse(_.expiresAt)>Date.now())throw new be("Tenant already has an active integration request",{status:409});let N=new Date().toISOString(),B={version:(_?.handleHash===C?_.version:0)+1,integrator:v.integrator,integratorName:v.integratorName,integratorTenantId:v.integratorTenantId,productId:v.productId,applicationId:v.applicationId,handleHash:C,status:g.decision,expiresAt:v.expiresAt,redeemAttempts:_?.handleHash===C?_.redeemAttempts:0,requestedAt:_?.handleHash===C?_.requestedAt:N,decidedAt:N,decidedBy:g.decidedBy},ee=await a().setIntegration(d.id,B,{expectedHandleHash:_?.handleHash??null,expectedVersion:_?.version});if(!ee)throw new be("Integration request changed; reload and try again",{status:409});return ee}async function O(g){let d=new URL(g.url).pathname,C=Ys(r.basePath),_=`${C}/integrations`;if(wt(d)===`${_}/authorize`)return w(g);if(wt(d)===`${_}/redeem`)return m(g);if(wt(d)===`${_}/config-export`)return T(g);let N=md(d,r.basePath),B=wt(d)===C;if(!B&&!N)return me();if(!["GET","PUT","POST","DELETE"].includes(g.method))return Ge(["GET","PUT","POST","DELETE"]);if(g.method==="GET"&&B&&N==null)return me();let ee=await c(g);if(ee)return ee;if(g.method==="GET"){if(N==null)return me();let S=await r.store.get(N);if(!S)return me();let L=i(S,g),z=u(S);return Response.json(L?{...z,...L}:z,{status:200})}if(g.method==="DELETE"){if(!N)return me();let S=await r.store.get(N);if(S)await r.mirror?.purge(S.id);return await r.store.delete(N),new Response(null,{status:204})}if(!N&&g.method!=="POST")return me();let ie;try{ie=await g.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let re=g.method==="POST",te=re?await n.validate(ie):await o.validate(ie);if(te.issues)return ad(te.issues,re?"Tenant create validation failed":"Tenant update validation failed");let ue=re?te.value.id:N;if(!ue)return me();if(N!=null&&te.value.id!=null&&te.value.id!==N)return Response.json({error:"Path id must match body id"},{status:400});let W=await r.store.get(ue);if(W&&!$r(W.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let J=new Date,Y=W??{},ne;if(re){let S=te.value,L=S,z=L.status,H=$r(z)?z:W?.status??"completed";ne={...Y,...S,id:ue,companyId:S.companyId,companyName:S.companyName,environmentType:S.environmentType,configLocator:S.configLocator,email:S.email??W?.email,webhookUrl:S.webhookUrl??W?.webhookUrl,callbackUrl:S.callbackUrl??W?.callbackUrl,tenantUrl:L.tenantUrl??W?.tenantUrl,status:H,error:L.error??W?.error,actionUrl:L.actionUrl??W?.actionUrl,requestToken:L.requestToken??W?.requestToken,expiresAt:L.expiresAt??W?.expiresAt,createdAt:W?.createdAt??J,updatedAt:J}}else{let S=te.value,L=S,z=L.status,H=$r(z)?z:W?.status??"completed",{configLocator:k,...M}=S;ne={...Y,...M,id:ue,companyId:S.companyId??W?.companyId??"",companyName:S.companyName??W?.companyName??"",environmentType:S.environmentType??W?.environmentType??"DEV",email:S.email??W?.email,webhookUrl:S.webhookUrl??W?.webhookUrl,callbackUrl:S.callbackUrl??W?.callbackUrl,tenantUrl:L.tenantUrl??W?.tenantUrl,status:H,error:L.error??W?.error,actionUrl:L.actionUrl??W?.actionUrl,requestToken:L.requestToken??W?.requestToken,expiresAt:L.expiresAt??W?.expiresAt,configLocator:k??W?.configLocator,createdAt:W?.createdAt??J,updatedAt:J}}if(!ne.tenantUrl)ne.tenantUrl=pd(g,ue);if(!ne.callbackUrl){let S=i(ne,g);if(S)ne.callbackUrl=S.callbackUrl}if(W?.configLocator&&!Ds(W.configLocator,ne.configLocator))await r.mirror?.purge(W.id);let se=await r.store.upsert(ne);if(W?.integration?.status==="consented"&&ne.configLocator&&!Ds(W.configLocator,ne.configLocator)){await r.onHandoverApplied?.({tenant:se,previousLocator:W.configLocator});let S=a(),L=W.integration;await S.setIntegration(se.id,{...L,version:L.version+1,handoverAppliedAt:new Date().toISOString()},{expectedHandleHash:L.handleHash,expectedVersion:L.version})}let oe=gd(se);if(oe instanceof Response)return oe;return Response.json(oe.body,{status:oe.status})}async function E(g){try{if(!e.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await O(g)}catch(v){return At(v)}}return{handler:E,isReady:()=>!0,ready:async()=>{return},recordConsent:P,getTenant:async(g)=>r.store.get(g)}}var Mn="0.0.24-beta.20260922.9";import{assertEcid as Zs,jwtAssertionClaimsSchema as yd,must as Ue,workloadTokenResponseSchema as hd}from"@ionite/core";import{getCachedVerificationKey as wd,getJwks as vd}from"@ionite/core/server";function $e(e,t){return t in e&&e[t]!==void 0&&e[t]!==null}function Oe(e){if(e===void 0||e===null)return!1;return $e(e,"workloadId")||$e(e,"privateKey")}function Ve(e){if(e===void 0||e===null)return!1;let t=$e(e,"clientId"),r=$e(e,"clientSecret"),n=$e(e,"workloadId"),o=$e(e,"privateKey");return(t||r)&&!n&&!o}function jn(e){if(e===void 0||e===null)return!1;let t=$e(e,"jwksUri"),r=$e(e,"workloadId"),n=$e(e,"clientId"),o=$e(e,"clientSecret"),s=$e(e,"privateKey");return t&&!r&&!s&&!n&&!o}function Qs(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function Sd(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(Qs(t))return!1;let r=Object.entries(t);if(r.length===0)return!1;return r.every(([,n])=>Qs(n))}function oi(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if("incoming"in t||"outgoing"in t){if(t.incoming!==void 0&&(typeof t.incoming!=="object"||t.incoming===null))return!1;if(t.outgoing!==void 0&&(typeof t.outgoing!=="object"||t.outgoing===null||Array.isArray(t.outgoing)))return!1;return!0}return!1}function si(e){return oi(e)}function Wn(e){if(!e)return;if(si(e))return Array.isArray(e.incoming)?void 0:e.incoming;return e}function Vn(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function Ut(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function ei(e){if(!e)return[];if(Array.isArray(e))return e.filter((t)=>!!t&&typeof t.issuer==="string"&&typeof t.jwksUri==="string").map((t)=>({issuer:t.issuer,jwksUri:t.jwksUri,audience:t.audience,scopesAsEntitlements:t.scopesAsEntitlements}));if(e.issuer&&e.jwksUri)return[{issuer:e.issuer,jwksUri:e.jwksUri,audience:e.audience??[],scopesAsEntitlements:e.scopesAsEntitlements}];return[]}function kd(e){let t=e[0];if(!t)return;let r=Vn(t.audience);return{jwksUri:t.jwksUri,issuer:t.issuer,audience:typeof r[0]==="string"?r[0]:void 0}}function ti(e,t){let r=Ut(t);if(!r)return;return e.find((n)=>Ut(n.issuer)===r)}function qr(e,t,r){let n=Vn(e);if(t.some((o)=>n.includes(o)))return!0;if(typeof r==="string"&&t.includes(r))return!0;return!1}function $n(e){if(!e||!si(e))return{};return e.outgoing??{}}function bd(e){return{getToken:e.getToken,refreshToken:e.refreshToken,generateJWTAssertion:e.generateJWTAssertion,revokeToken:e.revokeToken,beforeChange:e.beforeChange,afterChange:e.afterChange,isReady:e.isReady,ready:e.ready}}var Fn=Symbol("ion.workloadClientState"),ii=Symbol("ion.namedWorkloadClients");function Mt(e,t){let r=ge(e,t);return{isReady:r.isReady,ready:r.ready}}function Rd(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...Mt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[Fn]:"unavailable"}}function ri(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it is no longer configured on this Ionite instance.`)};return{...Mt(`workload client "${e}"`,()=>!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[Fn]:"removed"}}function Cd(e){if(!e)return"removed";return e[Fn]??"available"}function qn(e,t,r){let n=e,o=n,s=new Set;for(let i of r){if(s.add(i),i in o)continue;let a=t[i];o[i]=a?bd(a):Rd(i)}return Object.defineProperty(o,ii,{value:s,enumerable:!1,configurable:!0}),n}function ni(e){if(!e)return[];let t=e[ii];return t?Array.from(t):[]}function Td(e,t,r){let n=t,o=We(r,`Workload client "${e}"`),s=()=>Cd(n)==="available",i=ge(`Workload client "${e}"`,s);return{api:{beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:i.isReady,ready:i.ready,getToken:(c)=>n.getToken(c),refreshToken:(c)=>n.refreshToken(c),generateJWTAssertion:(c)=>n.generateJWTAssertion(c),revokeToken:(c)=>n.revokeToken(c)},update(c){if(c===n)return;o.emitBefore(),n=c,i.refresh(),o.emitAfter()}}}function ai(e){let t,r=!1,n=ge("Workload module",()=>r),o=We(e,"Workload"),s=new Map,i=new Set,a=new Set(["beforeChange","afterChange","isReady","ready"]),c=(m)=>{if(!t)throw Error(`${m} is unavailable because workload is not configured on this Ionite instance.`);return t},u={beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:n.isReady,ready:n.ready,get config(){return t?.config??{}},getToken(...m){return c("getToken").getToken(...m)},refreshToken(m){return c("refreshToken").refreshToken(m)},generateJWTAssertion(m){return c("generateJWTAssertion").generateJWTAssertion(m)},revokeToken(m){return c("revokeToken").revokeToken(m)},validateToken(m){return c("validateToken").validateToken(m)},getWorkloadIdentity(m){return c("getWorkloadIdentity").getWorkloadIdentity(m)},parseJWT(m){return c("parseJWT").parseJWT(m)},handler(m){return c("handler").handler(m)}},l=(m)=>{for(let O of i)delete u[O];if(i.clear(),!m)return;let T=new Set(ni(m)),P=new Set([...a,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...T]);for(let[O,E]of Object.entries(m)){if(P.has(O))continue;u[O]=E,i.add(O)}},w=(m)=>{let T=s.get(m);if(T)return T;let P=Td(m,ri(m),e);if(s.set(m,P),!(m in u))u[m]=P.api;return P};return{update(m){if(!m&&!r&&s.size===0)return;o.emitBefore(),r=m!==void 0,n.refresh(),t=m;let T=new Set(ni(m));for(let P of T){let O=m[P];w(P).update(O)}for(let[P,O]of s){if(T.has(P))continue;O.update(ri(P))}return l(m),o.emitAfter(),u}}}async function Nn(e,t,r){if(e===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let n=r[e];if(!n)throw Error(`Unknown workload client: ${e}`);return n.getToken(t)}function Kn(e,t){return`${e}|${t??""}`}function Ye(e,t,r,n,o){let s={jwtAssertionClaims:e?.jwtAssertionClaims??yd("server"),tokenResponse:e?.tokenResponse??hd("server")},i=async(p,f)=>{let R=p;if(typeof R.validate==="function")return R.validate(f);return p["~standard"].validate(f)};if(!r&&!n)return;if(r&&oi(r)){let p=r.incoming,f=ei(p),R=Array.isArray(p)?kd(p):p,A=Wn(n),V=$n(n),X=R?{...R,...A,jwksUri:R.jwksUri,issuer:R.issuer}:A;if(!X||!X.tokenUrl&&!X.jwksUri)t.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let F=X&&(X.tokenUrl||X.jwksUri)?Ye(e,t,R??void 0,A,f):void 0,ae=Array.from(new Set([...Object.keys(r.outgoing??{}),...Object.keys(V)])).map((le)=>[le,{...r.outgoing?.[le]??{},...V[le]??{}}]),Q={};for(let[le,at]of ae){let Fe=Ye(e,t,at,void 0);if(Fe)Q[le]=Fe}if(!F&&Object.keys(Q).length===0)return;let he={...F?.config??{},config:F?.config??{},...Mt("workload",()=>F?.isReady()===!0||Object.values(Q).some((le)=>le.isReady())),getToken:async(le,at)=>Nn(le,at,Q),getServerToken:async(le)=>{if(!F)throw Error("No server workload config");return F.getToken(le)},refreshToken:async(le)=>{if(!F)throw Error("No default workload config");return F.refreshToken(le)},generateJWTAssertion:async(le)=>{if(!F)throw Error("No default workload config");return F.generateJWTAssertion(le)},revokeToken:async(le)=>{if(!F)throw Error("No default workload config");return F.revokeToken(le)},validateToken:async(le)=>{if(!F)throw Error("No default workload config");return F.validateToken(le)},getWorkloadIdentity:async(le)=>{if(!F)return;return F.getWorkloadIdentity(le)},parseJWT:async(le)=>{if(!F)throw Error("No default workload config");return F.parseJWT(le)},handler:async(le)=>{if(!F)return me();return F.handler(le)}};return qn(he,Q,ae.map(([le])=>le))}if(r&&Sd(r)){let p=Wn(n),f=$n(n),R=r.default,A=R?{...R,...p,jwksUri:R.jwksUri,issuer:R.issuer}:p;if(!A||!A.tokenUrl&&!A.jwksUri)t.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let V=A&&(A.tokenUrl||A.jwksUri)?Ye(e,t,R??void 0,p):void 0,X=Array.from(new Set([...Object.keys(r).filter((Q)=>Q!=="default"),...Object.keys(f)])).map((Q)=>[Q,{...Q in r?r[Q]:{},...f[Q]??{}}]),F={};for(let[Q,he]of X){let le=Ye(e,t,he,void 0);if(le)F[Q]=le}if(!V&&Object.keys(F).length===0)return;let ae={...V?.config??{},config:V?.config??{},...Mt("workload",()=>V?.isReady()===!0||Object.values(F).some((Q)=>Q.isReady())),getToken:async(Q,he)=>Nn(Q,he,F),getServerToken:async(Q)=>{if(!V)throw Error("No server workload config");return V.getToken(Q)},refreshToken:async(Q)=>{if(!V)throw Error("No default workload config");return V.refreshToken(Q)},generateJWTAssertion:async(Q)=>{if(!V)throw Error("No default workload config");return V.generateJWTAssertion(Q)},revokeToken:async(Q)=>{if(!V)throw Error("No default workload config");return V.revokeToken(Q)},validateToken:async(Q)=>{if(!V)throw Error("No default workload config");return V.validateToken(Q)},getWorkloadIdentity:async(Q)=>{if(!V)return;return V.getWorkloadIdentity(Q)},parseJWT:async(Q)=>{if(!V)throw Error("No default workload config");return V.parseJWT(Q)},handler:async(Q)=>{if(!V)return me();return V.handler(Q)}};return qn(ae,F,X.map(([Q])=>Q))}let a=Wn(n),c=$n(n);if(!r&&Object.keys(c).length>0){let p={};for(let[A,V]of Object.entries(c)){let X=Ye(e,t,V,void 0);if(X)p[A]=X}let f=a&&(a.tokenUrl||a.jwksUri)?Ye(e,t,a,void 0):void 0;if(!f&&Object.keys(p).length===0)return;let R={...f?.config??{},config:f?.config??{},...Mt("workload",()=>f?.isReady()===!0||Object.values(p).some((A)=>A.isReady())),getToken:async(A,V)=>Nn(A,V,p),getServerToken:async(A)=>{if(!f)throw Error("No server workload config");return f.getToken(A)},refreshToken:async(A)=>{if(!f)throw Error("No default workload config");return f.refreshToken(A)},generateJWTAssertion:async(A)=>{if(!f)throw Error("No default workload config");return f.generateJWTAssertion(A)},revokeToken:async(A)=>{if(!f)throw Error("No default workload config");return f.revokeToken(A)},validateToken:async(A)=>{if(!f)throw Error("No default workload config");return f.validateToken(A)},getWorkloadIdentity:async(A)=>{if(!f)return;return f.getWorkloadIdentity(A)},parseJWT:async(A)=>{if(!f)throw Error("No default workload config");return f.parseJWT(A)},handler:async(A)=>{if(!f)return me();return f.handler(A)}};return qn(R,p,Object.keys(c))}let u=r,l=o??ei(u),w=a?.tokenUrl,m=w?.startsWith("/")?w:void 0,T=u?.idpTokenUrl??a?.idpTokenUrl??(u?.tokenUrl&&(u.tokenUrl.startsWith("http://")||u.tokenUrl.startsWith("https://"))?u.tokenUrl:void 0),P={...u,...a,tokenUrl:m??a?.tokenUrl??u?.tokenUrl,idpTokenUrl:T,jwksUri:u?.jwksUri,issuer:u?.issuer};P._handlerTokenUrl=m;let O,E=P,g=Oe(P),v=Ve(P),d=jn(P);if(!g&&!v&&!d){if(!u||Object.keys(u).length===0)return;throw t.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(P),clientId:E.clientId,clientSecret:E.clientSecret?"[REDACTED]":void 0,workloadId:E.workloadId,privateKey:E.privateKey?"[REDACTED]":void 0,jwksUri:E.jwksUri,tokenUrl:E.tokenUrl,idpTokenUrl:E.idpTokenUrl,fromVaultKeys:u?Object.keys(u):[],fromCodeKeys:n?Object.keys(n):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(g)O={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:Ue(P.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:Ue(P.privateKey,"Missing 'privateKey' from Workload Config"),audience:Ue(P.audience,"Missing 'audience' from Workload Config"),scope:P.scope??"",algorithm:P.algorithm??"RS256",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new ct};else if(Ve(P))O={...P,tokenUrl:P.tokenUrl,idpTokenUrl:Ue(P.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:Ue(P.clientId,"Missing 'clientId' from Workload Config"),clientSecret:Ue(P.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:P.scope??"",tokenLifetime:P.tokenLifetime??300,refreshThreshold:P.refreshThreshold??60,autoRefresh:P.autoRefresh!==void 0?P.autoRefresh:!0,tokenStore:P.tokenStore??new ct};else if(jn(P))O=P;function C(){let p=new Uint8Array(16);return crypto.getRandomValues(p),Array.from(p,(f)=>f.toString(16).padStart(2,"0")).join("")}function _(p){let f;if(typeof p==="string")f=btoa(p);else f=btoa(String.fromCharCode(...p));return f.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function N(p){let f=p.replace(/-/g,"+").replace(/_/g,"/");while(f.length%4)f+="=";return atob(f)}function B(p){if(p.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:p==="RS256"?"SHA-256":p==="RS384"?"SHA-384":"SHA-512"};else if(p.startsWith("ION"))return{name:"ECDSA",namedCurve:p==="ES256"?"P-256":p==="ES384"?"P-384":"P-521",hash:p==="ES256"?"SHA-256":p==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${p}`)}async function ee(p,f){let R=p.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),A=Uint8Array.from(atob(R),(X)=>X.charCodeAt(0)),V=B(f);return crypto.subtle.importKey("pkcs8",A,V,!1,["sign"])}async function ie(p,f,R){let A=await ee(f,R),X=new TextEncoder().encode(p),F=B(R),ae=await crypto.subtle.sign(F,A,X);return _(new Uint8Array(ae))}async function re(p,f=3,R=1000,A=30000){let V=Error("Placeholder Error");for(let X=0;X<=f;X++)try{return await p()}catch(F){if(V=F instanceof Error?F:Error(String(F)),V.message.includes("400")||V.message.includes("401")||V.message.includes("403")||V.message.includes("404"))throw V;if(X<f){let ae=Math.min(R*2**X,A),Q=Math.random()*ae*0.1;await new Promise((he)=>setTimeout(he,ae+Q))}}throw V}async function te(p){if(!Oe(O))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=O,R=Math.floor(Date.now()/1000),A={iss:f.workloadId,sub:f.workloadId,aud:f.audience??"",exp:R+f.tokenLifetime,iat:R,jti:C(),scope:p??f.scope},V={alg:f.algorithm,typ:"JWT",kid:f.keyId},X=_(JSON.stringify(V)),F=_(JSON.stringify(A)),ae=`${X}.${F}`,Q=await ie(ae,f.privateKey,f.algorithm);return`${ae}.${Q}`}async function ue(p){if(!Oe(O))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=O;return re(async()=>{let R=f.idpTokenUrl,A=await te(p),V=new URLSearchParams;if(V.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),V.append("assertion",A),p)V.append("scope",p);let X=await fetch(R,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:V.toString()}),F=await X.json();if(!X.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:F});let Q=F;throw Error(`Token acquisition failed: ${Q.error||X.statusText} - ${Q.error_description||""}`.trim())}let ae=await i(s.tokenResponse,F);if(ae.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:ae.issues}),Error(`Token response validation failed: ${ae.issues.map((Q)=>Q.message).join("; ")}`);if(f.tokenStore){let Q=new Date(Date.now()+(ae.value.expires_in??300)*1000),he={workload_id:Kn(f.workloadId,p),access_token:ae.value.access_token,token_type:ae.value.token_type,scope:ae.value.scope,expires_at:Q,created_at:new Date,refresh_token:ae.value.refresh_token};await f.tokenStore.set(he)}return ae.value})}async function W(p){if(!Ve(O))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let f=O;return re(async()=>{let R=f.idpTokenUrl,A=new URLSearchParams;if(A.append("grant_type","client_credentials"),A.append("client_id",f.clientId),A.append("client_secret",f.clientSecret),p)A.append("scope",p);let V=await fetch(R,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json"},body:A.toString()}),X=await V.json();if(!V.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:X});let ae=X;throw Error(`Token acquisition failed: ${ae.error||V.statusText} - ${ae.error_description||""}`.trim())}let F=await i(s.tokenResponse,X);if(F.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:F.issues}),Error(`Token response validation failed: ${F.issues.map((ae)=>ae.message).join("; ")}`);if(f.tokenStore){let ae=new Date(Date.now()+(F.value.expires_in??300)*1000),Q={workload_id:Kn(f.clientId,p),access_token:F.value.access_token,token_type:F.value.token_type,scope:F.value.scope,expires_at:ae,created_at:new Date,refresh_token:F.value.refresh_token};await f.tokenStore.set(Q)}return F.value})}let J=new Map;function Y(p,f){let R=J.get(p);if(R)return R;let A=(async()=>(Oe(O)?await ue(f??""):await W(f??"")).access_token)();return J.set(p,A),A.catch(()=>{return}).finally(()=>{if(J.get(p)===A)J.delete(p)}),A}async function ne(p){if(!Oe(O)&&!Ve(O)){let V=O;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!V.clientId}, hasClientSecret=${!!V.clientSecret}, hasWorkloadId=${!!V.workloadId}, hasPrivateKey=${!!V.privateKey}, hasJwksUri=${!!V.jwksUri}`)}let f=O;p=p??f.scope;let R=Oe(O)?O.workloadId:O.clientId,A=Kn(R,p);if(f.tokenStore){let V=await f.tokenStore.get(A);if(V){let X=Date.now(),F=V.expires_at.getTime(),ae=f.refreshThreshold*1000;if(X+ae<F)return V.access_token;if(f.autoRefresh)try{return await Y(A,p)}catch(Q){if(X<F)return t.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},Q),V.access_token;throw Q}}}return Y(A,p)}async function se(p){if(!Oe(O)&&!Ve(O))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=O;return p=p??f.scope,Oe(f)?await ue(p):await W(p)}async function oe(p){if(!Oe(O)&&!Ve(O))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");try{if(!O.revocationEndpoint)return;let f=new URLSearchParams;if(f.append("token",p),f.append("token_type_hint","access_token"),Oe(O)){let A=O;f.append("client_id",A.workloadId)}else if(Ve(O)){let A=O;f.append("client_id",A.clientId),f.append("client_secret",A.clientSecret)}let R=await fetch(O.revocationEndpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:f.toString()});if(!R.ok)t.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:R.status,statusText:R.statusText});else t.info("Token revoked successfully",{"ion.module":"workload"});if(O.tokenStore){let A;if(Oe(O))A=O.workloadId;else if(Ve(O))A=O.clientId;else return;await O.tokenStore.delete(A)}}catch(f){t.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},f)}}async function S(p,f){let R=p??O?.jwksUri;if(!R)throw Error("No JWKS URI configured in Workload Config");return await vd(R,t,f)}async function L(p,f){let R=f??O?.jwksUri;if(!R)throw Error("No JWKS URI configured in Workload Config");let A=Oe(O)?O.algorithm:"RS256";return wd(R,p,`wl:${A}`,(V)=>{let X=V.alg||A,F=B(X);return crypto.subtle.importKey("jwk",V,F,!1,["verify"])},t)}function z(p){let f=p.split(".");if(f.length!==3)throw Error("Invalid JWT");return JSON.parse(N(f[1]))}async function H(p,f){try{let R=p.split(".");if(R.length!==3)throw Error("Invalid JWT");let A=JSON.parse(N(R[0])),V=JSON.parse(N(R[1])),X=await L(A.kid,f),F=R[2],Q=new TextEncoder().encode(`${R[0]}.${R[1]}`),he=Uint8Array.from(N(F),(qt)=>qt.charCodeAt(0)),le=B(A.alg);if(!await crypto.subtle.verify(le,X,he,Q))throw Error("Invalid JWT signature");let Fe=await i(s.jwtAssertionClaims,V);if(Fe.issues)throw t.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:Fe.issues}),Error(`JWT claims validation failed: ${Fe.issues.map((qt)=>qt.message).join("; ")}`);return Fe.value}catch(R){throw t.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},R),R}}async function k(p){if(!Oe(O)&&!Ve(O)&&!jn(O))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(l.length>0){let A=z(p),V=typeof A.iss==="string"?A.iss:void 0,X=ti(l,V);if(!X)return{valid:!1,error:"Untrusted token issuer"};let F=await H(p,X.jwksUri),ae=Math.floor(Date.now()/1000);if(F.exp&&F.exp<ae)return{valid:!1,error:"Token expired"};let Q=Vn(X.audience);if(Q.length>0&&!qr(F.aud,Q,F.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:F,expiresAt:F.exp?new Date(F.exp*1000):void 0}}let f=await H(p),R=Math.floor(Date.now()/1000);if(f.exp&&f.exp<R)return{valid:!1,error:"Token expired"};if(Oe(O)){if(O.audience&&!qr(f.aud,[O.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else if(Ve(O)){if(O.issuer&&Ut(f.iss)!==Ut(O.issuer))return{valid:!1,error:"Invalid issuer"};if(O.audience&&!qr(f.aud,[O.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else{let A=O;if(A.issuer&&Ut(f.iss)!==Ut(A.issuer))return{valid:!1,error:"Invalid issuer"};if(A.audience&&!qr(f.aud,[A.audience],f.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:f,expiresAt:f.exp?new Date(f.exp*1000):void 0}}catch(f){return{valid:!1,error:f instanceof Error?f.message:String(f)}}}function M(p,f){let R=p[f];return typeof R==="string"&&R.trim()?R.trim():void 0}function I(p){if(!p)return;return p.startsWith("service-account-")?p.slice(16):p}function j(p){return M(p,"client_id")??M(p,"clientId")??M(p,"azp")??M(p,"appid")??I(M(p,"preferred_username"))}let K=new WeakMap;function h(p){let f=K.get(p);if(f)return f;let R=x(p);return K.set(p,R),R}async function x(p){let f=p.headers.get("Authorization");if(!f?.startsWith("Bearer "))return;let R=f.substring(7),A=await k(R);if(!A.valid||!A.claims)return;let V=l.length>0?ti(l,A.claims.iss):void 0,X=A.claims.ecid,F={workloadId:A.claims.sub,clientId:j(A.claims),scope:A.claims.scope,scopesAsEntitlements:V?.scopesAsEntitlements,...X!==void 0&&X!==null?{ecid:Zs(X)}:{},claims:A.claims},ae=O?.workloadIdentityStore;if(ae){let Q=F.clientId??F.workloadId??F.claims.sub,he=Q?await ae.get(Q):void 0;if(he){if(he.active===!1)return;if(he.scopes?.length){let le=new Set([...(F.scope??"").split(/\s+/).filter(Boolean),...he.scopes]);F.scope=Array.from(le).join(" ")}if(!F.ecid&&he.ecid)F.ecid=Zs(he.ecid)}}return F}async function b(p){if(!O)throw Error("ionite Workload Manager not initialized");let f=new URL(p.url).pathname,R=(X)=>{if(!X)return;try{return new URL(X).pathname}catch{return X.startsWith("/")?X:`/${X}`}};if(R(O.validateUrl)===f&&p.method==="POST"){let X=p.headers.get("Authorization");if(!X?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});let F=X.substring(7),ae=await k(F);if(!ae.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type","application/json"]]});return new Response(JSON.stringify({valid:!0,expiresAt:ae.expiresAt}),{status:200,headers:[["Content-Type","application/json"]]})}if(R(O.jwksUrl)===f&&p.method==="GET"){let X=await S();return new Response(JSON.stringify(X),{headers:[["Content-Type","application/json"]]})}return me()}return{...O,...Mt("workload",()=>!0),getToken:ne,refreshToken:se,generateJWTAssertion:te,revokeToken:oe,validateToken:k,getWorkloadIdentity:h,parseJWT:H,handler:b}}function Dn(e){return e=e??"Workload authentication unavailable",new Response(JSON.stringify({error:e}),{status:503,statusText:e,headers:{"Content-Type":"application/json"}})}var Nr="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",Pd="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function Id(e,t){Ue(t,Nr);let r=t.workload;if(!r)return;return r.getWorkloadIdentity(e)}async function Od(e,t,r){Ue(t,Nr);let n=t.workload;if(!n)throw Dn();let o=n;if(typeof o.getServerToken!=="function"||typeof o.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return o.getToken(e,r)}async function Ed(e,t){Ue(t,Pd);let r="validateToken"in t&&typeof t.validateToken==="function"?t:t.workload;if(!r)return{valid:!1,error:"Workload authentication unavailable"};let n=e.headers.get("Authorization");if(!n?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let o=n.substring(7);return r.validateToken(o)}async function Ad(e,t){Ue(t,Nr);let r=t.workload;if(!r)throw Dn();return r.revokeToken(e)}async function _d(e,t){Ue(t,Nr);let r=t.workload;if(!r)throw Dn();return r.handler(e)}export*from"@ionite/core";import{AssignmentPolicyError as ny,generateULID as oy,IoniteError as sy,listGenerator as iy}from"@ionite/core";import{allowHosts as cy,allowOrigins as uy,allowRelativePaths as dy,allowSameOrigin as ly,blockDangerousUrls as fy,CatalogAdjacencyCache as py,callback as my,captureRedirect as gy,ciam as yy,collectReferencedDefinitions as hy,defaultRedirectPolicies as wy,discoverSessionRecords as vy,discoverSessions as Sy,expandRoot as ky,getCustomer as by,getUser as Ry,has as Cy,hasAll as Ty,hasAllScope as Py,hasAny as Iy,hasAnyScope as Oy,hasGroup as Ey,hasPermission as Ay,hasRole as _y,hasScope as Ly,InMemoryTenantStore as xy,iam as Uy,initiateLogin as My,isRedirectAllowed as jy,listSsoClientIdsFromCookies as Wy,reconcileSubjectAccess as $y,resolveAfterRedirect as qy,resolveCapturedRedirect as Ny,resolveRedirect as Ky,sameOriginRedirectRules as Vy,sendTenantWebhook as Fy,sso as Dy,verifyUser as zy,withSetCookies as By}from"@ionite/core/server";import{accessRefId as it,accessRootId as ci,assertRequiredSubjectType as ui,list as Ld}from"@ionite/core";function Bn(e){let{createdAt:t,updatedAt:r,...n}=e;return n}class Xe{constructor(){this.roots=new Map;this.byTarget=new Map;this.bySubject=new Map}static targetKey(e,t){return`${e}:${t}`}static subjectKey(e,t){return`${e}:${t}`}indexAdd(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}indexRemove(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}deindex(e){this.indexRemove(this.byTarget,Xe.targetKey(e.targetType,it(e.target)),e.id),this.indexRemove(this.bySubject,Xe.subjectKey(e.subjectType,it(e.subject)),e.id)}index(e){this.indexAdd(this.byTarget,Xe.targetKey(e.targetType,it(e.target)),e.id),this.indexAdd(this.bySubject,Xe.subjectKey(e.subjectType,it(e.subject)),e.id)}resolve(e,t){if(!e)return[];let r=[];for(let n of e){let o=this.roots.get(n);if(o&&(o.status??"active")==="active"&&t(o))r.push(o)}return r}async grant(e){ui(e.subjectType,"Access change subjectType");let t=e.id??ci(e),r=new Date,n=this.roots.get(t);if(n)this.deindex(n);let o={...e,id:t,status:e.status??"active",createdAt:n?.createdAt??r,updatedAt:r};this.roots.set(t,o),this.index(o)}async revoke(e){let t=e.id??ci(e),r=this.roots.get(t);if(r)this.deindex(r);this.roots.delete(t)}async get(e){let t=this.roots.get(e);return t?Bn(t):void 0}async list(e){let t=Array.from(this.roots.values()).filter((r)=>(r.status??"active")==="active");return zn(t,e)}async listByTarget(e,t,r){let n=t.trim(),o=this.byTarget.get(Xe.targetKey(e,n)),s=this.resolve(o,(i)=>i.targetType===e&&it(i.target)===n);return zn(s,r)}async listByTargets(e){let t=new Map;for(let{targetType:r,target:n}of e){let o=`${r}:${n}`;if(t.has(o))continue;let s=n.trim(),i=this.byTarget.get(Xe.targetKey(r,s)),a=this.resolve(i,(c)=>c.targetType===r&&it(c.target)===s);t.set(o,a.map((c)=>Bn(c)))}return t}async listBySubject(e,t,r){ui(t);let n=it(e),o=this.bySubject.get(Xe.subjectKey(t,n)),s=this.resolve(o,(i)=>i.subjectType===t&&it(i.subject)===n);return zn(s,r)}}function zn(e,t){let r=Math.max(0,t?.start??0),n=t?.limit,o=n!=null?r+n:void 0;return Ld(e.length,e.slice(r,o).map(Bn),r,n)}import{assertValidSubjectTypeScoping as di,deepEqualPlain as xd,list as li,readyCatalogEntry as Gn}from"@ionite/core";class fi{constructor(){this.listeners=new Set;this.emit=(e)=>{for(let t of this.listeners)t(e)};this.groups=new Kr("group",this.emit);this.roles=new Kr("role",this.emit);this.permissions=new Kr("permission",this.emit)}afterChange(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}}class pi{constructor(){this.items=new Map;this.listeners=new Set}async get(e){return this.items.get(e)}async list(e){let t=Array.from(this.items.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=n!=null?r+n:void 0;return li(t.length,t.slice(r,o),r,n)}async children(e){return Array.from(this.items.values()).filter((t)=>(typeof t.parent==="string"?t.parent:t.parent?.id)===e)}changed(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}set(e){this.items.set(e.id,e),this.emitChange({id:e.id})}delete(e){if(!this.items.delete(e))return;this.emitChange({id:e,deleted:!0})}emitChange(e){for(let t of this.listeners)t(e)}}class Kr{constructor(e,t){this.kind=e;this.emit=t;this.items=new Map}async get(e){return this.items.get(e)}set(e){di(e);let t=this.items.get(e.id),r=!t||!xd(t,e);if(this.items.set(e.id,e),r)this.emit({op:"set",kind:this.kind,entity:e,previous:t});return Gn(e,Promise.resolve())}insertIfAbsent(e){di(e);let t=this.items.get(e.id);if(t)return Gn(t,Promise.resolve());return this.items.set(e.id,e),this.emit({op:"set",kind:this.kind,entity:e,previous:void 0}),Gn(e,Promise.resolve())}async delete(e){let t=this.items.get(e);if(!t)return;this.items.delete(e),this.emit({op:"delete",kind:this.kind,entity:t})}async list(e){let t=Array.from(this.items.values()),r=e?.filter?.requestable;if(r!==void 0)t=t.filter((i)=>Boolean(i.requestable)===r);let n=Math.max(0,e?.start??0),o=e?.limit,s=o!=null?n+o:void 0;return li(t.length,t.slice(n,s),n,o)}}import{accessRefId as Ze,assertRequiredSubjectType as jt}from"@ionite/core";function Qe(e,t){return`${t}:${e}`}function Hn(e,t,r){return`${e}:${t}:${r}`}function Ud(e,t,r,n){return`${Hn(e,t,r)}:${n??""}`}class mi{constructor(){this.rows=new Map;this.byTriple=new Map;this.byRoot=new Map;this.bySubject=new Map;this.edgeMeta=new Map;this.disabledSubjects=new Set}async has(e,t,r,n,o){jt(o);let s=Ze(e),i=Ze(r);if(!s||!i)return{allow:!1};if(this.disabledSubjects.has(Qe(s,o)))return{allow:!1,metadata:{reason:"subject_disabled"}};let a=Hn(Qe(s,o),t,i),c=n?Ze(n):void 0;if(c===void 0){let w=this.byTriple.get(a);if(w&&w.size>0)return this.allow(s,o,t,i,void 0);return{allow:!1}}let u=`${a}:${c}`,l=`${a}:`;if(this.rows.has(u))return this.allow(s,o,t,i,c);if(this.rows.has(l))return this.allow(s,o,t,i,void 0);return{allow:!1}}async hasGroup(e,t,r,n){return this.has(e,"group",t,r,n)}async hasRole(e,t,r,n){return this.has(e,"role",t,r,n)}async hasPermission(e,t,r,n){return this.has(e,"permission",t,r,n)}async hasAny(e,t,r){for(let n of t){let o=await this.has(e,n.targetType,n.target,n.resource,r);if(o.allow)return o}return{allow:!1}}async hasAll(e,t,r){if(this.disabledSubjects.has(Qe(Ze(e),r)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(t.length===0)return{allow:!0};let n=[];for(let o of t){let s=await this.has(e,o.targetType,o.target,o.resource,r);if(!s.allow)return{allow:!1,matched:n};if(s.matched)n.push(...s.matched)}return{allow:!0,matched:n}}async materialize(e,t){this.removeRoot(e),this.addRootEdges(e,t)}async replaceSubject(e,t,r){let n=Qe(Ze(e),t),o=new Map;for(let s of r){jt(s.subjectType,"Effective edge subjectType");let i=Qe(Ze(s.subject),s.subjectType);if(i!==n)throw Error(`AccessIndex.replaceSubject received an edge for ${i}; expected ${n}.`);let a=o.get(s.rootId);if(a)a.push(s);else o.set(s.rootId,[s])}this.clearSubjectEdges(n);for(let[s,i]of o)this.addRootEdges(s,i)}addRootEdges(e,t){let r=new Set;for(let n of t){jt(n.subjectType,"Effective edge subjectType");let o=Qe(n.subject,n.subjectType),s=Hn(o,n.targetType,n.target),i=Ud(o,n.targetType,n.target,n.resource);this.addToSet(this.rows,i,e),this.addToSet(this.byTriple,s,i),this.addToSet(this.bySubject,o,i),this.edgeMeta.set(i,{triple:s,subjectId:o}),r.add(i)}if(r.size>0)this.byRoot.set(e,r)}async removeByRoot(e){this.removeRoot(e)}removeRoot(e){let t=this.byRoot.get(e);if(!t)return;for(let r of t){let n=this.rows.get(r);if(!n)continue;if(n.delete(e),n.size===0)this.dropEdge(r)}this.byRoot.delete(e)}async listSubjects(){let e=[];for(let[t,r]of this.bySubject){if(r.size===0)continue;let n=t.indexOf(":");if(n<=0)throw Error(`AccessIndex subject key "${t}" is missing a subjectType prefix.`);let o=t.slice(0,n);jt(o,"AccessIndex subject key subjectType"),e.push({subjectType:o,subject:t.slice(n+1)})}return e}async setSubjectDisabled(e,t,r){let n=Qe(Ze(e),t);if(r)this.disabledSubjects.add(n);else this.disabledSubjects.delete(n)}async isSubjectDisabled(e,t){return jt(t),this.disabledSubjects.has(Qe(Ze(e),t))}async clear(e,t){if(e===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}jt(t);let r=Ze(e);this.clearSubjectEdges(Qe(r,t))}clearSubjectEdges(e){let t=this.bySubject.get(e);if(!t)return;for(let r of[...t]){let n=this.rows.get(r);if(n)for(let o of n){let s=this.byRoot.get(o);if(s?.delete(r)&&s.size===0)this.byRoot.delete(o)}this.dropEdge(r)}}allow(e,t,r,n,o){return{allow:!0,matched:[{subject:e,subjectType:t,targetType:r,target:n,resources:o?[o]:void 0}]}}addToSet(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}dropEdge(e){this.rows.delete(e);let t=this.edgeMeta.get(e);if(t)this.removeFromSet(this.byTriple,t.triple,e),this.removeFromSet(this.bySubject,t.subjectId,e);this.edgeMeta.delete(e)}removeFromSet(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}}function Jn(e){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function Md(e,t){return{...e,subscribe:async(r,n,o)=>{try{return await e.subscribe(r,n,o)}catch(s){if(!(s instanceof xe))throw s;return await Je(e,r,n,t,void 0,o)}}}}function Vr(e){let t=mt(e.path,"path","azureConfig");yt(e.ttl);let r=e.vault??Mr({type:"azure",authMethod:e.authMethod,entraTenantId:e.entraTenantId,clientId:e.clientId,clientSecret:e.clientSecret,federatedTokenFile:e.federatedTokenFile,managedIdentityClientId:e.managedIdentityClientId,imdsApiVersion:e.imdsApiVersion,vaultUrl:e.vaultUrl,vaultName:e.vaultName,apiVersion:e.apiVersion,secretNameTransform:e.secretNameTransform,secretNamePrefix:e.secretNamePrefix,scope:e.scope,ttl:e.ttl}),n=e.ttl?Md(r,e.ttl):r;return{load:async()=>{try{return(await n.getFullSecret(t)).data}catch(o){let s=o instanceof Error?o.message:String(o);throw Error(`Error retrieving remote config from Azure Key Vault: ${s}`,{cause:o})}},subscribe:(o,s)=>n.subscribe(t,(i)=>{o(i.data)},s),secret:n}}import{IoniteError as Zd}from"@ionite/core";function Yn(e){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as Nd,remoteConfigSecretType as Kd}from"@ionite/core";import{defaultLogger as jd,defaultSecretContentType as Wd,stableConfigHash as gi}from"@ionite/core";var $d=1e4;function qd(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Xn(e){if(e.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let t=Array.from(new Set(e.paths.map((E)=>E.trim()).filter(Boolean)));if(t.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let r=e.logger??jd,n=[],o=Promise.resolve(),s=!1,i=!1,a=!1,c=ge("Secrets mirror",()=>s&&!a),u=(E)=>{let g=e.mapPath(E).trim();if(!g)throw Error(`mirrorSecrets mapPath returned an empty target for "${E}"`);return g},l=(E)=>{let g=o.then(E);return o=g.catch((v)=>{i=!0,r.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:v instanceof Error?v.message:String(v)})}),g},w=async(E)=>{if(await e.to.exists(E))await e.to.deleteSecret(E)},m=async(E,g)=>{if(a)return;if(!qd(g.data))throw Error(`mirrorSecrets can only re-store object values (source path "${E}")`);if(e.accept&&!e.accept(g,E))return;let v=u(E);if(await e.to.exists(v)){let d=await e.to.getSecret(v);if(gi(d)===gi(g.data)){i=!1;return}}await e.to.putSecret(v,g.data,{contentType:g.metadata.contentType??Wd()}),i=!1},T=async(E)=>{await w(u(E)),i=!1},P=(E)=>{if(E.event!=="path_removed")return t.includes(E.path)?[E.path]:[];let g=`${E.path.replace(/\/+$/g,"")}/`;return t.filter((v)=>v===E.path||v.startsWith(g))},O=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if(e.from.subscribeEvents)n.push(e.from.subscribeEvents((E)=>{if(O.has(E.event)){let g=P(E);if(g.length>0)l(async()=>{for(let v of g)await T(v)})}try{e.onEvent?.(E)}catch(g){r.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:E.path,event:E.event,error:g instanceof Error?g.message:String(g)})}}));return(async()=>{let E=new Set(t);for(;;){try{for(let g of[...E]){let v=await e.from.subscribe(g,(d)=>{l(()=>m(g,d))},e.subscription);if(a){v();return}n.push(v),E.delete(g)}if(await o,a)return;s=!0,c.refresh();return}catch(g){if(a)return;i=!0,r.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:g instanceof Error?g.message:String(g)})}if(await new Promise((g)=>{setTimeout(g,$d).unref?.()}),a)return}})(),{isReady:c.isReady,ready:c.ready,isAvailable:()=>s&&!a&&!i&&(e.from.isAvailable?.()??!0)&&(e.to.isAvailable?.()??!0),async purge(){if(a)throw Error("Secrets mirror is closed");await l(async()=>{for(let E of t)await T(E)})},async close(){if(a)return;a=!0;for(let E of n.splice(0))E();c.refresh(),c.settle(),await o}}}function Wt(e){return typeof e.getFullSecret==="function"}function Zn(e){let t=e;return typeof t.handleDelivery==="function"&&typeof t.handleEvents==="function"&&typeof t.isDeliveryRequest==="function"&&typeof t.isEventsRequest==="function"}function yi(e){return e.type==="vault"&&[e.vaultLfvServerUrl,e.vaultLfvClientId,e.vaultLfvDeliveryEndpoint,e.vaultLfvVerifyJwks,e.vaultLfvEventsEndpoint].some((t)=>t!==void 0)}function Ee(e,t){if(!e?.trim())throw Error(`Mirrored LFV config requires ${t}`);return e}function Vd(e,t){if(t?.trim())return t;if(Wt(e))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if(e.type==="vault")return Ee(e.vaultLfvPath??e.vaultPath,"an upstream vault path");if(e.type==="azure")return Ee(e.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${e.type}" requires an explicit fromPath`)}function Fd(e,t){let r=Ee(e.vaultLfvPath??e.vaultPath,"vaultLfvPath or vaultPath");return pt({lfvServerUrl:Ee(e.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Ee(e.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Ee(e.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:Ee(e.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:Ee(e.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:r,deliveryTimeout:e.vaultLfvDeliveryTimeout,retryInterval:e.vaultLfvRetryInterval,warnInterval:e.vaultLfvWarnInterval,log:t},void 0,{selfRedeemReads:!0})}function Dd(e){return e.metadata.contentType?.typeId===Kd.id&&typeof e.data.id==="string"&&e.data.id.trim().length>0}function zd(e,t,r,n){return{...e,close:r,subscribePassive:(o,s)=>t.subscribePassive(o,s),isDeliveryRequest:(o)=>t.isDeliveryRequest(o),isEventsRequest:(o)=>t.isEventsRequest(o),handleDelivery:(o)=>(n(),t.handleDelivery(o)),handleEvents:(o)=>(n(),t.handleEvents(o)),deliveryPath:t.deliveryPath,eventsPath:t.eventsPath,callbackKey:t.callbackKey,trustId:t.trustId}}function or(e){let t=e.logger??Nd,r=Vd(e.from,e.fromPath),n=!Wt(e.from),o=!Wt(e.to),s=Wt(e.from)?e.from:yi(e.from)?Fd(e.from,t):et(e.from).secret,i=Wt(e.to)?e.to:et(e.to).secret,a=Ee(e.path,"path"),c=Qn(i,a,{ttl:e.ttl}),u,l=!1,w=!1,m,T=()=>{if(m)return;m=s.getFullSecret(r).then(()=>{return}).catch((d)=>{m=void 0,t.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:d instanceof Error?d.message:String(d)})})},P=(d)=>{if(l)throw Error("Mirrored ConfigSource is closed");if(!u){w=d;let C=!d&&Zn(s)?{...s,subscribe:(_,N)=>s.subscribePassive(_,N)}:s;u=Xn({from:C,to:i,paths:[r],mapPath:()=>a,accept:Dd,logger:t})}else if(d&&!w)T();return u},O={isReady:()=>u?.isReady()??!1,ready:(d)=>P(!0).ready(d),isAvailable:()=>u?.isAvailable()??!1,purge:()=>P(!1).purge(),close:async()=>{await u?.close()}},E=async()=>{if(l)return;if(l=!0,await u?.close(),n)await s.close?.();if(o)await i.close?.()},g=Zn(s)?zd(i,s,E,()=>{P(!1)}):{...i,close:E},v={load:async()=>{try{let d=await c.load();return P(!1),d}catch(d){throw P(!0),d}},subscribe:(d,C)=>(P(!1),c.subscribe(d,C)),secret:g,mirror:O,async handleCallback(d,C){if(!Zn(s))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return P(!1),d==="delivery"?s.handleDelivery(C):s.handleEvents(C)}};if(Object.defineProperties(v,{log:{get:()=>c.log,set:(d)=>{c.log=d},enumerable:!0},validators:{get:()=>c.validators,set:(d)=>{c.validators=d},enumerable:!0}}),!Wt(e.from)&&yi(e.from)){let d=e.from;v[Ot]={path:r,lfvServerUrl:Ee(d.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:Ee(d.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:Ee(d.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:Ee(d.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:Ee(d.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:d.vaultLfvDeliveryTimeout,retryInterval:d.vaultLfvRetryInterval,warnInterval:d.vaultLfvWarnInterval}}return v}class vt extends Error{constructor(e,t=`Waiting for vault config secret at ${e}`){super(t);this.path=e;this.code="not_found";this.sourceType="vault";this.status=404;this.name="VaultConfigWaitingForSecretError"}}function Bd(e){return e instanceof vt}class sr extends Error{constructor(e,t){super(t);this.path=e;this.code="invalid_payload";this.sourceType="vault";this.name="VaultConfigInvalidPayloadError"}}function Gd(e){return e instanceof sr}var vi=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function hi(e){return vi.some((t)=>(t in e))}function wi(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw new vt(t,`Vault config secret at ${t} is missing or not an object`);let r=e;if(!hi(r)&&Object.keys(r).length===1&&"data"in r){let n=r.data;if(n&&typeof n==="object"&&!Array.isArray(n))r=n}if(Object.keys(r).length===0)throw new vt(t,`Vault config secret at ${t} is empty`);if(!hi(r))throw new sr(t,`Vault config secret at ${t} is an invalid payload: not a RemoteConfig (no known keys: ${vi.join("/")})`);return r}function Hd(e,t,r){return{...e,subscribe:async(n,o,s)=>{try{return await e.subscribe(n,o,s)}catch(i){if(!(i instanceof xe))throw i;return await Je(e,n,o,t,r(),s)}}}}function Fr(e){let t=mt(e.path,"path","vaultConfig");yt(e.ttl);let r=e.vault??xt({type:"vault",url:e.url,token:e.token,workload:e.workload,lfv:e.lfv,websocket:e.websocket,ttl:e.ttl,log:e.log}),n=e.vault&&e.ttl?Hd(r,e.ttl,()=>e.log):r,o={get log(){return e.log},set log(s){if(e.log=s,n&&"log"in n)n.log=s},load:async()=>{try{let s=await n.getFullSecret(t);return wi(s.data,t)}catch(s){if(s instanceof He)throw new vt(t);if(s instanceof vt||s instanceof sr)throw s;throw Error("Error retrieving remote config from vault",{cause:s})}},subscribe:(s,i)=>n.subscribe(t,(a)=>{let c;try{c=wi(a.data,t)}catch(u){e.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:t,error:u instanceof Error?u.message:String(u)});return}s(c)},i),secret:n};if(e.lfv?.lfvServerUrl&&e.lfv.clientId&&e.lfv.deliveryEndpoint&&e.lfv.eventsEndpoint)o[Ot]={path:e.lfv.path??t,lfvServerUrl:e.lfv.lfvServerUrl,clientId:e.lfv.clientId,deliveryTimeout:e.lfv.deliveryTimeout,retryInterval:e.lfv.retryInterval,warnInterval:e.lfv.warnInterval,deliveryEndpoint:e.lfv.deliveryEndpoint,eventsEndpoint:e.lfv.eventsEndpoint,verifyJwks:e.lfv.verifyJwks};return o}function Dr(e){if(e==null)return;if(typeof e==="number")return Number.isFinite(e)?e:void 0;let t=e.trim();if(!t)return;let r=Number.parseInt(t,10);return Number.isFinite(r)?r:void 0}function Jd(e,t){let r=e.vaultLfvServerUrl??t?.lfvServerUrl,n=e.vaultLfvClientId??t?.clientId,o=e.vaultLfvDeliveryEndpoint??t?.deliveryEndpoint,s=e.vaultLfvEventsEndpoint??t?.eventsEndpoint;if(!r||!n||!o||!s)return t;return{...t,lfvServerUrl:r,clientId:n,deliveryEndpoint:o,verifyJwks:e.vaultLfvVerifyJwks??t?.verifyJwks,eventsEndpoint:s,path:e.vaultLfvPath??t?.path,deliveryTimeout:Dr(e.vaultLfvDeliveryTimeout)??t?.deliveryTimeout,retryInterval:Dr(e.vaultLfvRetryInterval)??t?.retryInterval,warnInterval:Dr(e.vaultLfvWarnInterval)??t?.warnInterval}}function Yd(e,t){let r=e.vaultWebsocketUrl??t?.url;if(!r)return t;return{...t,url:r,token:e.vaultWebsocketToken??t?.token,clientId:e.vaultWebsocketClientId??t?.clientId,header:e.vaultWebsocketHeader??t?.header}}function Xd(e,t){let r=e.vaultWorkloadTokenUrl??t?.idpTokenUrl,n=e.vaultWorkloadClientId??t?.clientId,o=e.vaultWorkloadClientSecret??t?.clientSecret;if(!r||!n||!o)return t;return{...t,idpTokenUrl:r,clientId:n,clientSecret:o,scope:e.vaultWorkloadScope??t?.scope}}function Si(e,t){return{...t,url:e.vaultUrl??t?.url,token:e.vaultToken??t?.token,path:e.vaultPath??t?.path,ttl:Dr(e.vaultTtl)??t?.ttl,workload:Xd(e,t?.workload),lfv:Jd(e,t?.lfv),websocket:Yd(e,t?.websocket)}}function et(e){switch(e.type){case"vault":return el(e);case"azure":return tl(e);case"aws":return rl(e);case"gcp":return nl(e);case"mirror":return Qd(e);default:throw Error(`Unsupported config locator type: ${e.type}`)}}function Qd(e){if(e.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!e.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return or({from:e.from,to:e.to,path:e.to.vaultPath,ttl:e.to.vaultTtl})}function el(e){return Fr(Si(e))}function tl(e){return Vr({authMethod:e.azureAuthMethod,entraTenantId:e.azureEntraTenantId,clientId:e.azureClientId,clientSecret:e.azureClientSecret,federatedTokenFile:e.azureFederatedTokenFile,managedIdentityClientId:e.azureManagedIdentityClientId,imdsApiVersion:e.azureImdsApiVersion,vaultUrl:e.azureVaultUrl,vaultName:e.azureVaultName,apiVersion:e.azureApiVersion,scope:e.azureScope,secretNamePrefix:e.azureSecretNamePrefix,path:e.azurePath,ttl:e.azureTtl})}function rl(e){return Jn({webhookUrl:e.awsWebhookUrl,ttl:e.awsTtl})}function nl(e){return Yn({ttl:e.gcpTtl})}function Qn(e,t,r={}){switch(e.type){case"vault":return Fr({vault:e,path:t,ttl:r.ttl});case"azure":return Vr({vault:e,path:t,ttl:r.ttl});default:throw new Zd(`configFromSource is not supported for secrets source type "${e.type}" (path "${t}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function St(e){if(!e)return;let t=Number.parseInt(e,10);return Number.isFinite(t)?t:void 0}function zr(e,t){let r=t?.type??e.ION_CONFIG_TYPE;if(!r)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(r==="vault")return{type:"vault",vaultUrl:e.ION_VAULT_URL,vaultToken:e.ION_VAULT_TOKEN,vaultPath:e.ION_VAULT_PATH??"",vaultTtl:St(e.ION_VAULT_TTL),vaultWorkloadTokenUrl:e.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:e.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:e.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:e.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:e.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:e.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:e.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:e.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:e.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:e.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:St(e.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:St(e.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:St(e.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:e.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:e.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:e.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:e.ION_VAULT_WEBSOCKET_HEADER};if(r==="azure")return{type:"azure",azurePath:e.ION_AZURE_PATH,azureApiVersion:e.ION_AZURE_API_VERSION,azureScope:e.ION_AZURE_SCOPE,azureSecretNamePrefix:e.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:e.ION_AZURE_AUTH_METHOD,azureEntraTenantId:e.ION_AZURE_TENANT_ID,azureClientId:e.ION_AZURE_CLIENT_ID,azureClientSecret:e.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:e.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:e.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:e.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:e.ION_AZURE_VAULT_URL,azureVaultName:e.ION_AZURE_VAULT_NAME,azureTtl:St(e.ION_AZURE_TTL)};if(r==="aws")return{type:"aws",awsWebhookUrl:e.ION_AWS_WEBHOOK_URL??"",awsTtl:St(e.ION_AWS_TTL)};if(r==="gcp")return{type:"gcp",gcpTtl:St(e.ION_GCP_TTL)};if(r==="mirror"){let n={};for(let[a,c]of Object.entries(e))if(a.startsWith("ION_FROM_"))n[`ION_${a.slice(9)}`]=c;if(n.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let o=zr(n),s=zr(e,{type:"vault"});if(!s.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let i={type:"vault",vaultUrl:s.vaultUrl,vaultToken:s.vaultToken,vaultPath:s.vaultPath,vaultTtl:s.vaultTtl,vaultWorkloadTokenUrl:s.vaultWorkloadTokenUrl,vaultWorkloadClientId:s.vaultWorkloadClientId,vaultWorkloadClientSecret:s.vaultWorkloadClientSecret,vaultWorkloadScope:s.vaultWorkloadScope,vaultWebsocketUrl:s.vaultWebsocketUrl,vaultWebsocketToken:s.vaultWebsocketToken,vaultWebsocketClientId:s.vaultWebsocketClientId,vaultWebsocketHeader:s.vaultWebsocketHeader};return{type:"mirror",from:o,to:i}}throw Error(`ION_CONFIG_TYPE="${r}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function ki(e,t){return et(zr(e,t))}function ol(e){return ki(process.env,e)}var sl=1000,il=30000,bi=["vault","azure","aws","gcp"];function Ri(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Config locator at ${t} is an invalid payload: expected an object with a "type" field`);let r=e.type;if(typeof r!=="string"||!bi.includes(r))throw Error(`Config locator at ${t} is an invalid payload: unknown type "${String(r)}" (expected ${bi.join("/")})`)}function Ci(e,t){return e.log??=t.log,e.validators??=t.validators,e}function ir(e){if(!e?.secret?.close)return;try{Promise.resolve(e.secret.close()).catch((t)=>{e.log?.warn?.("secretConfigSource: inner source close failed",t)})}catch(t){e.log?.warn?.("secretConfigSource: inner source close failed",t)}}function al(e,t){let r=mt(t,"path","secretConfigSource"),n,o=(i)=>{Ri(i,r);let a=JSON.stringify(i);if(n&&n.hash===a)return n.inner;let c=n?.inner,u=Ci(et(i),s);if(n={hash:a,inner:u},c&&c!==u)ir(c);return u},s={async load(){let i=await e.getSecret(r);return o(i).load()},async subscribe(i,a){let c,u=!1,l=!1,w,m,T=new Promise((_,N)=>{w=_,m=N}),P=Or(),O,E,g=(_)=>new Promise((N)=>{E=N,O=setTimeout(N,_)}),v=async(_,N)=>{Ri(_,r);let B=JSON.stringify(_),ee=n!==void 0&&n.hash===B;if(ee&&c)return;let ie=n?.inner,re=c,te=ee&&n?n.inner:Ci(et(_),s),ue=!ee,W=()=>{if(ue&&te!==ie)ir(te)};try{if(te.subscribe){let Y=await te.subscribe(i,a)??void 0;if(u||!P.isCurrent(N)){Y?.(),W();return}if(c=Y,n={hash:B,inner:te},re&&re!==Y)re();if(ue&&ie&&ie!==te)ir(ie);return}let J=await te.load();if(u||!P.isCurrent(N)){W();return}if(n={hash:B,inner:te},re)re(),c=void 0;if(ue&&ie&&ie!==te)ir(ie);i(J)}catch(J){throw W(),J}},d=async(_)=>{let N=P.next(),B=sl;for(;;){if(u||!P.isCurrent(N))return;try{await v(_,N);return}catch(ee){if(u||!P.isCurrent(N))return;s.log?.warn(`secretConfigSource rebind for ${r} failed; keeping last-known-good source and retrying in ${B}ms`,ee),await g(B),B=Math.min(il,B*2)}}},C=await e.subscribe(r,(_)=>{if(u)return;if(!l){v(_.data,P.next()).then(()=>{l=!0,w()}).catch((N)=>{l=!0,m(N)});return}d(_.data)},a);return await T,()=>{if(u=!0,P.next(),O)clearTimeout(O);E?.(),c?.(),C(),ir(n?.inner),n=void 0}},secret:e};return s}function eo(e){if(Array.isArray(e))return e.map(eo);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,eo(r)]));return e}function Ti(e){return JSON.stringify(eo(e))}function cl(e){if(e.type==="vault")return e.vaultLfvPath??e.vaultPath;if(e.type==="azure"&&e.azurePath?.trim())return e.azurePath;throw Error(`Tenant config locator type "${e.type}" does not declare a mirrorable config path`)}function ul(e,t){let r=t.logger??e.log,n=new Map,o=!1,s=async(u)=>{if(u.closed)return;u.closed=!0,u.closeHooks?.(),await u.hookSetup?.catch(()=>{return}),await u.source.secret.close?.()},i=(u)=>{let l=(async()=>{let w=await t.store.get(u);if(!w)throw Error(`Tenant "${u}" was not found`);if(!w.configLocator)throw Error(`Tenant "${u}" has no configLocator`);let m=w.configLocator,T=t.path(w).trim();if(!T)throw Error(`Tenant mirror path is empty for "${u}"`);let P=t.sourceFromLocator?.(m,w)??m,E={source:or({from:P,fromPath:cl(m),to:t.to,path:T,logger:r}),locatorFingerprint:Ti(m),targetPath:T,closed:!1};if(t.hooks?.onRemoteConfigChange)E.hookSetup=t.to.subscribe(T,(g)=>{Promise.resolve(t.hooks?.onRemoteConfigChange?.(w,g.data,g)).catch((v)=>{r.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:u,error:v instanceof Error?v.message:String(v)})})}).then((g)=>{E.closeHooks=g}).catch((g)=>{r.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:u,error:g instanceof Error?g.message:String(g)})});return E})();return n.set(u,l),l.catch(()=>{if(n.get(u)===l)n.delete(u)}),l},a=async(u,l,w)=>{if(n.get(u)===l)n.delete(u);await s(w)},c=async(u)=>{if(o)throw Error("Tenant config mirror is closed");let l=n.get(u);if(!l)return i(u);let w=await l,m=await t.store.get(u);if(!m?.configLocator)throw await a(u,l,w),Error(m?`Tenant "${u}" has no configLocator`:`Tenant "${u}" was not found`);if(Ti(m.configLocator)!==w.locatorFingerprint)return await a(u,l,w),n.get(u)??i(u);return w};return{async ensure(u,l){await(await c(u)).source.mirror.ready(l)},async handleCallback(u,l,w){try{return await(await c(u)).source.handleCallback(l,w)}catch(m){let T=m instanceof Error?m.message:String(m),P=T.includes("was not found")?404:503;return r.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:u,kind:l,error:T}),Response.json({error:P===404?"Tenant not found":"Tenant config mirror unavailable"},{status:P})}},async purge(u){let l=n.get(u),w=l?await l:void 0,m=await t.store.get(u),T=w?.targetPath??(m?t.path(m).trim():void 0);if(w&&l)await a(u,l,w);if(T&&await t.to.exists(T))await t.to.deleteSecret(T);if(m)await t.hooks?.onRemoteConfigRevoke?.(m)},async close(){if(o)return;o=!0;let u=[...n.values()];n.clear(),await Promise.all(u.map(async(l)=>{try{await s(await l)}catch{}}))}}}import{buildTenantPath as dl,DEFAULT_TENANT_API_NAMESPACE as Ii,DEFAULT_TENANT_UI_NAMESPACE as Oi,matchTenantPath as Ei,normalizeTenantPathNamespace as Pi}from"@ionite/core";function ll(){return Response.json({error:"Tenant not found"},{status:404})}function fl(e){return Response.json({error:`Tenant runtime unavailable for ${e}`},{status:503})}function pl(e,t){if(t==="api")return Pi(e?.api??Ii);return Pi(e?.ui??Oi)}function ml(e){if(e.store)return async(t)=>e.store.getIon(t);return async(t)=>await e.getIon(t)??void 0}async function Ai(e,t={}){if(t.custom){let s=await t.custom(e);if(s)return{id:s}}let r=t.namespace??"api",n=pl(t.strategy,r),o=Ei(new URL(e.url).pathname,n);if(!o)return null;return{id:o.id,context:{namespace:r,restPath:o.restPath,restSegments:o.restSegments}}}function _i(e,t){let r=new URL(e.url);return r.pathname=t,new Request(r,e)}function to(e,t,r,n){let o=Ei(new URL(e.url).pathname,r);if(!o||o.id!==t)return e;return _i(e,dl(t,o.restPath,n))}function gl(e,t,r={beforeTenantSegments:["api"],afterTenantSegments:[]}){return to(e,t,Ii,r)}function yl(e,t,r={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return to(e,t,Oi,r)}function hl(e){return async function(r){try{let n=e.resolveTenant?await e.resolveTenant(r):await Ai(r),o=typeof n==="string"?{id:n,context:void 0}:n??null;if(!o?.id)return e.onMissingTenant?await e.onMissingTenant(r):ll();let s=await e.getIon(o.id,r)??null;if(!s)return e.onMissingIonite?await e.onMissingIonite(r,o.id):fl(o.id);let i=e.rewriteRequest?await e.rewriteRequest(r,{id:o.id,ion:s,context:o.context}):r;return s.handler(i)}catch(n){return At(n)}}}import{list as wl,matchesListFilter as vl}from"@ionite/core";class Li{constructor(){this.identities=new Map;this.clientIdIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.identities.get(e)}async lookup(e){if(e.id){let t=this.identities.get(e.id);if(t)return t}if(e.clientId){let t=this.clientIdIndex.get(e.clientId);if(t)return this.identities.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.identities.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n=this.identities.get(t),o={...e,id:t,createdAt:n?.createdAt??e.createdAt??r,updatedAt:r};if(n?.clientId&&n.clientId!==o.clientId)this.clientIdIndex.delete(n.clientId);if(n?.externalId&&n.externalId!==o.externalId)this.externalIdIndex.delete(n.externalId);if(this.identities.set(t,o),o.clientId)this.clientIdIndex.set(o.clientId,t);if(o.externalId)this.externalIdIndex.set(o.externalId,t);return o}async delete(e){let t=this.identities.get(e);if(t?.clientId)this.clientIdIndex.delete(t.clientId);if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.identities.delete(e),t?1:0}async list(e){let t=Array.from(this.identities.values()).filter((a)=>vl(a,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return wl(o,i,r,n)}}var Ol=30000;function El(e){let t=e,r=t.basePath??pr(),n=t.readyTimeoutMs??Ol,o=fr(t.stores),{routing:s,beforeChange:i,afterChange:a,configRetry:c,onConfigLoadError:u}=t;return{frameworkConfig:{log:e.log,validators:e.validators,sso:e.sso,iam:e.iam,workload:e.workload,secrets:e.secrets,lfv:e.lfv,ciam:e.ciam,tm:e.tm,authz:e.authz,otel:e.otel},basePath:r,readyTimeoutMs:n,stores:o,options:{beforeChange:i,afterChange:a,routing:s,configRetry:c,onConfigLoadError:u}}}function Al(e){let t=e,r={trace:(n,...o)=>t.trace(n,...o),debug:(n,...o)=>t.debug(n,...o),info:(n,...o)=>t.info(n,...o),warn:(n,...o)=>t.warn(n,...o),error:(n,...o)=>t.error(n,...o)};return{logger:r,update(n){return t=n,r}}}function Ki(e,t){let r=e;return r.setStores=(n)=>{t.current=fr(n),Object.assign(r,Kt(r,t.current))},r}function Ui(e){let t=e?.replace(/\s+/g," ").trim();return t?t:void 0}function Vi(e){if(typeof e!=="object"||e===null)return;return e.cause}function _l(e){if(!(e instanceof Error))return typeof e==="string"?Ui(e):void 0;let t=Ui(e.message),r=[],n=e;if(typeof n.code==="string")r.push(`code=${n.code}`);if(typeof n.status==="number")r.push(`status=${n.status}`);if(typeof n.path==="string")r.push(`path=${n.path}`);if(r.length===0)return t;if(!t)return r.join(", ");return`${t} [${r.join(", ")}]`}function ao(e,t=3){let r=[],n=e,o=0;while(n!=null&&o<t){let s=_l(n);if(s&&!r.includes(s))r.push(s);n=Vi(n),o+=1}return r.length>0?r.join(" <- "):void 0}function Ll(e,t){if(typeof e!=="object"||e===null)return;return e[t]}function Me(e,t){let r=e,n=0;while(r!=null&&n<3){let o=Ll(r,t);if(o!==void 0)return o;r=Vi(r),n+=1}return}var xl=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function Ul(e){return typeof e==="string"&&xl.has(e)}function Ml(e){let t=Me(e,"kind");if(Ul(t))return t;let r=Me(e,"status"),n=Me(e,"code"),o=ao(e)?.toLowerCase()??"";if(r===401||r===403||o.includes("auth error")||o.includes("permission denied"))return"auth";if(n==="not_found"||o.includes("waiting for vault"))return"not_found";if(n==="ECONNREFUSED"||n==="ECONNRESET"||n==="ENOTFOUND"||n==="ETIMEDOUT"||o.includes("connection")||o.includes("fetch failed")||o.includes("network"))return"connection";if(o.includes("timed out"))return"timeout";if(o.includes("invalid status")||typeof r==="number"&&r>=400)return"invalid_status";if(o.includes("invalid payload")||o.includes("invalid json")||o.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function jl(e){return"validation"}var Wl=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function $l(e,t){let r=Me(e,"recoverable");if(typeof r==="boolean")return r;if(t==="not_found")return!0;if(t==="auth"||t==="invalid_payload")return!1;let n=Me(e,"status");if(typeof n==="number"&&n>=400&&n<500)return!1;let o=Me(e,"code");if(typeof o==="string"&&(Wl.has(o)||o.startsWith("UND_ERR_")))return!0;return!0}function ql(e){return{initialDelayMs:Math.max(1,e?.initialDelayMs??2000),maxDelayMs:Math.max(1,e?.maxDelayMs??600000),multiplier:Math.max(1,e?.multiplier??2),jitterRatio:Math.max(0,e?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,e?.loadTimeoutMs??30000)}}function Nl(e,t){let r=Math.max(0,e-1),n=Math.min(t.maxDelayMs,t.initialDelayMs*t.multiplier**r);if(t.jitterRatio===0)return Math.round(n);let o=n*t.jitterRatio,s=(Math.random()*2-1)*o;return Math.max(1,Math.round(Math.min(t.maxDelayMs,n+s)))}function Kl(e){return(t)=>{let r=t.path?` at ${t.path}`:"",n=t.sourceType?` (${t.sourceType})`:"";e.warn(`Config source${n} unavailable${r}; ionite will retry automatically in ${t.nextDelayMs}ms (attempt ${t.attempt}, ${t.errorKind}: ${t.message}).`)}}async function Vl(e,t){for(let r of t)await r(e)}function je(e){if(!e)return;try{return new URL(e,"http://dummy").pathname}catch{return e.startsWith("/")?e:`/${e}`}}function Fl(e,t){let r=t.id;if(typeof r!=="string"||r.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if(e!==void 0&&e!==r)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${e}", received "${r}").`)}function Dl(e){let t=(r,n)=>{if(r!==void 0&&(typeof r!=="string"||r.length===0))throw Error(`${n}: "clientSecret" must be a non-empty string when present; omit it entirely for a public (PKCE-only) client.`)};t(e.sso?.clientSecret,"sso");for(let[r,n]of Object.entries(e.ciam?.providers??{}))t(n.clientSecret,`ciam.providers.${r}`)}function zl(e){let t=e.kms;if(t)for(let[n,o]of Object.entries(t)){if(n.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!o||typeof o!=="object"||Array.isArray(o))throw Error(`RemoteConfig.kms.${n} must be an object.`);if(o.source!==void 0&&(typeof o.source!=="string"||o.source.length===0))throw Error(`RemoteConfig.kms.${n}.source must be a non-empty string when present.`);if(o.path!==void 0&&(typeof o.path!=="string"||o.path.length===0))throw Error(`RemoteConfig.kms.${n}.path must be a non-empty string when present.`)}let r=e.otel;if(!r)return;if(r.apiKey!==void 0&&r.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(r.apiKeyPool!==void 0){if(typeof r.apiKeyPool!=="string"||r.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!t?.[r.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${r.apiKeyPool}".`)}}function Bl(e){let t=e.authz?.trustedProvisioningClients;if(!t)return;t.forEach((r,n)=>{let o=`authz.trustedProvisioningClients[${n}]`;if(typeof r.issuer!=="string"||r.issuer.length===0)throw Error(`${o}: "issuer" is required and must be a non-empty string.`);if(typeof r.clientId!=="string"||r.clientId.length===0)throw Error(`${o}: "clientId" is required and must be a non-empty string.`);let s=Array.isArray(r.audience)?r.audience:[r.audience];if(s.length===0||s.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(r.permissions)||r.permissions.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "permissions" must be an array of non-empty permission ids.`)})}function Gl(e){let t=e.tm;if(!t)return;if(t.enabled!==!0)throw Error("RemoteConfig.tm.enabled must be true when tm is present.");for(let r of["id","url","issuer","jwksUri","audience","clientId"])if(typeof t.integrator?.[r]!=="string"||t.integrator[r].length===0)throw Error(`RemoteConfig.tm.integrator.${r} is required and must be a non-empty string.`);if(t.consentTtlSeconds!==void 0&&(!Number.isInteger(t.consentTtlSeconds)||t.consentTtlSeconds<60))throw Error("RemoteConfig.tm.consentTtlSeconds must be an integer of at least 60.");if(t.maxRedeemAttempts!==void 0&&(!Number.isInteger(t.maxRedeemAttempts)||t.maxRedeemAttempts<1))throw Error("RemoteConfig.tm.maxRedeemAttempts must be a positive integer.")}function Hl(e){let t=Array.isArray(e)?e:[e];return t.length>0&&t.every((r)=>typeof r==="string"&&r.length>0)}function Jl(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return;let r=t,n=(o,s)=>{if(!Hl(o.audience))throw Error(`${s}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in r||"outgoing"in r){let o=r.incoming;if(Array.isArray(o))o.forEach((s,i)=>{if(s&&typeof s==="object")n(s,`workload.incoming[${i}]`)});else if(o&&typeof o==="object"&&"jwksUri"in o)n(o,"workload.incoming");return}if(zi(r)){if("jwksUri"in r&&!("clientId"in r)&&!("workloadId"in r))n(r,"workload (server-only)");return}}function Yl(e,t,r){if(e?.sso?.redirectUri&&t.sso?.redirectUri){let n=je(e.sso.redirectUri),o=je(t.sso.redirectUri);if(n!==o)r.error(`SSO redirectUri path mismatch: the framework derives "${o}" from basePath, but ConfigSource reports "${n}". Register "${o}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function co(e){let t={};if(!e)return t;for(let[r,n]of Object.entries(e))if(n.type==="vault"&&typeof n.lfv?.deliveryEndpoint==="string"&&typeof n.lfv?.eventsEndpoint==="string")t[r]=n.lfv;return t}function Fi(e){return e[Ot]}function Di(e,t){let r=co(e.secrets??void 0),n=je(t.deliveryEndpoint),o=je(t.eventsEndpoint),s=je(t.path);for(let i of Object.values(r)){if(je(i.deliveryEndpoint)!==n)continue;if(je(i.eventsEndpoint)!==o)continue;let a=i.path?je(i.path):void 0;if(s&&a&&s!==a)continue;return!0}return!1}function Xl(e,t){let r=Fi(t);if(!r)return e;if(Di(e,r))return e;let n={type:"vault",lfv:{path:r.path,lfvServerUrl:r.lfvServerUrl,clientId:r.clientId,deliveryTimeout:r.deliveryTimeout,retryInterval:r.retryInterval,warnInterval:r.warnInterval,deliveryEndpoint:r.deliveryEndpoint,eventsEndpoint:r.eventsEndpoint,verifyJwks:r.verifyJwks}},o=e.secrets??{},s=cn(o,{clientId:r.clientId,path:r.path});return{...e,secrets:{...o,[s]:n}}}function Zl(e,t){let r=Fi(t);if(!r||Di(e,r))return new Map;let n=cn(e.secrets??{},{clientId:r.clientId,path:r.path});return new Map([[n,t.secret]])}function Ql(e,t){let r=co(e.secrets),n=co(t.secrets??void 0);for(let[o,s]of Object.entries(n)){let i=r[o];if(!i)continue;let a=je(i.deliveryEndpoint),c=je(s.deliveryEndpoint);if(a&&c&&a!==c)throw Error(`LFV deliveryEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${a}, framework path: ${c}`);let u=je(i.eventsEndpoint),l=je(s.eventsEndpoint);if(u&&l&&u!==l)throw Error(`LFV eventsEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${u}, framework path: ${l}`)}}function ef(e){return new Set(Object.keys(e.secrets??{}))}function tf(e){return new Set(Object.keys(e.secrets??{}))}function rf(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;if(!("outgoing"in t))return new Set;let r=t.outgoing;if(!r||typeof r!=="object"||Array.isArray(r))return new Set;return new Set(Object.keys(r))}function zi(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function nf(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;let r=t;if("incoming"in r||"outgoing"in r){let n=r.outgoing;if(!n||typeof n!=="object"||Array.isArray(n))return new Set;return new Set(Object.keys(n))}if(zi(r))return new Set;return new Set(Object.keys(r).filter((n)=>n!=="default"))}function of(e,t,r,n){let o=t.secrets??{},s=e.secrets??{};for(let[l,w]of Object.entries(o)){let m=s[l];if(!m)continue;if(w.type&&m.type&&w.type!==m.type)throw Error(`Secrets source "${l}" type in framework config must match ConfigSource type. ConfigSource type: ${m.type}, framework type: ${w.type}`)}let i=ef(t),a=tf(e);for(let l of i)if(!a.has(l)&&!n.has(l))r.warn(`Framework config declares secrets source "${l}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let l of a)if(!i.has(l))r.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:l});let c=rf(t),u=nf(e);for(let l of c)if(!u.has(l))r.warn(`Framework config declares outgoing workload client "${l}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(t.otel!==void 0&&t.otel!==null&&e.otel===void 0)r.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function Mi(e,t){if(t===void 0)return!1;return kl(e,t)}function sf(e,t){if(typeof t!=="number"||!Number.isFinite(t)||t<=0)return e;return new Promise((r,n)=>{let o=setTimeout(()=>{n(Error(`Ionite ready() timed out after ${t}ms`))},t);e.then(()=>{clearTimeout(o),r()},(s)=>{clearTimeout(o),n(s)})})}function af(e,t,r){if(typeof t!=="number"||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>{o(Error(r))},t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function lo(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function ar(e){return e==="/"?e:e.replace(/\/+$/,"")}function no(e,t){return ar(e)===ar(t)}function ji(e){return e.method==="GET"||e.method==="HEAD"}function cf(e){if(e.isReady()&&e.config?.readyz?.enabled===!1)return me();let t=e.readiness();return Response.json(uf(t),{status:t.ok?200:503})}function uf(e){let t=e.config.lastError;if(!t)return e;return{...e,config:{...e.config,lastError:{kind:t.kind,phase:t.phase,at:t.at,message:"[redacted]"}}}}var df={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","iam.users":"iam","iam.groups":"iam","iam.workloads":"iam","iam.customers":"iam","workload.incoming":"workload","workload.outgoing":"workload","authz.oaa":"authz","tm.integration":"tm"};function lf(e){let t=e?.providers;if(!t)return!1;return Object.values(t).some((r)=>r.enabled!==!1&&r.type!=="magic-link")}function Te(e,t,r={}){let n=df[e],o=t.modules[n],s=r.capable??!0,i=o.active&&o.ready&&s,a=i?void 0:!o.active||!o.ready?o.reason:r.incapableReason??`${e} is not testable by this application wiring`;return{module:n,active:o.active,ready:o.ready,testable:i,...r.urls&&r.urls.length>0?{urls:r.urls}:{},...a?{reason:a}:{}}}function ff(e,t,r){let n=De(t),o=e.readiness();return{sdk:{version:Mn,catalogVersion:vn},basePath:t,urls:n,modules:o.modules,lfvCallbackTransport:Boolean(r.lfv?.callbackTransport),capabilities:{"sso.login":Te("sso.login",o,{urls:[n.sso.loginUrl,n.sso.callbackUrl,n.sso.userUrl]}),"sso.jit":Te("sso.jit",o,{capable:r.sso?.enableJitUserProvisioning!==!1&&Boolean(r.sso?.userStore),incapableReason:r.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":Te("sso.logout",o,{urls:[n.sso.logoutUrl]}),"sso.back_channel_logout":Te("sso.back_channel_logout",o,{urls:[n.sso.logoutBackChannelUrl]}),"ciam.magic_link":Te("ciam.magic_link",o,{capable:Boolean(r.ciam?.magicLinkStore)&&r.ciam?.enableJitUserProvisioning!==!1,urls:[n.ciam.magicLinkUrl,n.ciam.magicLinkLoginUrl],incapableReason:!r.ciam?.magicLinkStore?"CIAM magic-link is enabled but no magicLinkStore capability is wired by the application.":"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":Te("ciam.oidc_login",o,{capable:lf(r.ciam),urls:[n.ciam.customerLoginUrl,n.ciam.customerCallbackUrl,n.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":Te("ciam.customer",o,{urls:[n.ciam.customerUrl]}),"ciam.logout":Te("ciam.logout",o,{urls:[n.ciam.logoutUrl]}),"iam.users":Te("iam.users",o,{capable:Boolean(r.iam?.userStore),urls:[n.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":Te("iam.groups",o,{capable:Boolean(r.authz?.catalogStore||r.authz?.catalog),urls:[n.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"iam.workloads":Te("iam.workloads",o,{capable:Boolean(r.iam?.workloadIdentityStore),urls:[n.iam.workloadsUrl],incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."}),"iam.customers":Te("iam.customers",o,{capable:Boolean(r.iam?.customerStore),urls:[n.iam.customersUrl],incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."}),"workload.incoming":Te("workload.incoming",o,{urls:[n.workload.validateUrl,n.workload.jwksUrl]}),"workload.outgoing":Te("workload.outgoing",o,{}),"authz.oaa":Te("authz.oaa",o,{capable:Boolean(r.authz?.accessStore&&(r.authz?.catalogStore||r.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."}),"tm.integration":Te("tm.integration",o,{capable:Boolean(r.tm?.onConnectRequest&&r.tm.store.setIntegration&&r.tm.store.getByIntegrationHandleHash),urls:r.tm?[`${ar(r.tm.basePath)}/integrations/authorize`,`${ar(r.tm.basePath)}/integrations/redeem`,`${ar(r.tm.basePath)}/integrations/config-export`]:void 0,incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."})}}}async function pf(e,t,r){if(!t.isReady())return lo();if(t.config?.capabilitiez!==!0||!r)return me();let n=await er(e,t,qi["capabilitiez.read"]);if(n)return n;return Response.json(r.build(),{status:200})}async function mf(e){if(!e)return[];let t=[];for await(let r of $t((n,o)=>e.list({start:n,limit:o})))t.push(r);return t}function oo(e,t){return[...new Set(e.filter((r)=>r.subjectType===t).map((r)=>typeof r.subject==="string"?r.subject:r.subject.id).filter((r)=>Boolean(r)))]}function so(e,t,r){if(!e)return;if(t==="all")return $t((n,o)=>e.list({start:n,limit:o}));return async function*(){for(let o of r){let s=await e.get(o);if(s)yield s}}()}async function gf(e,t,r){if(!t.isReady())return lo();if(t.config?.authz?.oaa?.fullSync?.enabled!==!0)return me();let n=await er(e,t,qi["authz.oaa.sync"]);if(n)return n;let o=t.authz?.oaa;if(!o?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let s=t.authz?await t.authz.reconcile():void 0,i=r.iam?.userStore,a=r.iam?.customerStore??r.ciam?.customerStore,c=r.workload,u=r.iam?.workloadIdentityStore??(c&&"workloadIdentityStore"in c?c.workloadIdentityStore:c&&("incoming"in c)&&c.incoming&&!Array.isArray(c.incoming)&&("workloadIdentityStore"in c.incoming)?c.incoming.workloadIdentityStore:void 0),l=bl(r.authz?.catalog?Ni(r.authz.catalog):void 0,r.authz?.catalogStore),w=r.authz?.accessStore,m=r.authz?.resources,T=await mf(w),P=await o.sync({users:so(i,o.population("user"),oo(T,"user")),customers:so(a,o.population("customer"),oo(T,"customer")),workloads:so(u,o.population("workload"),oo(T,"workload")),groups:l?$t((O,E)=>l.groups.list({start:O,limit:E})):void 0,roles:l?$t((O,E)=>l.roles.list({start:O,limit:E})):void 0,permissions:l?$t((O,E)=>l.permissions.list({start:O,limit:E})):void 0,resources:m?$t((O,E)=>m.list({start:O,limit:E})):void 0,access:T},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...P,reconcile:s})}function yf(e,t,r,n,o,s){return async(i)=>{let a=new URL(i.url).pathname;if(no(a,r)){if(!ji(i))return Ge(["GET"]);return cf(e)}if(no(a,n)){if(!ji(i))return Ge(["GET"]);return pf(i,e,o)}if(s&&no(a,s.url)){if(i.method!=="POST")return Ge(["POST"]);return gf(i,e,s.frameworkConfig)}let c=e.secrets;if(!Boolean(c?.isLfvDeliveryRequest?.(i)||c?.isLfvEventsRequest?.(i))&&!e.isReady())return lo();try{return await t(i)}catch(l){return e.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},l),At(l)}}}function Wi(e,t,r){if(e)return r&&!e.tenantId?{...e,tenantId:r}:e;if(t&&r)return{tenantId:r};return}function hf(e,t){if(t.authz===null)return;if(!e.authz&&!t.authz)return;return{...e.authz,...t.authz,oaa:e.authz?.oaa||t.authz?.oaa?{...e.authz?.oaa,...t.authz?.oaa}:void 0}}function io(e){let t=!1,r=ge(`${e} module`,()=>t);return{isReady:r.isReady,ready:r.ready,attach(n){if(t=n!==void 0,r.refresh(),!n)return;return Object.defineProperty(n,"isReady",{value:r.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(n,"ready",{value:r.ready,enumerable:!1,configurable:!0}),n}}}function uo(e){if(!e)return!1;return e.isReady?e.isReady():!1}function kt(e,t,r,n){if(!e)return{active:!1,ready:!1,reason:r};return uo(t)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:n}}function wf(){let e=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:e(),ciam:e(),iam:e(),workload:e(),otel:e(),secrets:e(),kms:e(),authz:e(),tm:e()}}function vf(e,t,r){let n=e.isReady(),o=e.config;if(!n||!o)return{ok:!1,applied:n,modules:wf(),config:{...t}};let s=Jr(r),i=Boolean(o.workload)||Boolean(e.workload),a={sso:kt(Boolean(o.sso),e.sso,"sso not configured (no RemoteConfig.sso)",s.sso??"sso configured but not ready"),ciam:kt(Boolean(o.ciam),e.ciam,"ciam not configured (no RemoteConfig.ciam)",s.ciam??"ciam configured but not ready"),iam:kt(Boolean(o.iam),e.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:kt(i,e.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:kt(Boolean(o.otel),e.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(o.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!uo(e.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return e.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:kt(Boolean(o.kms),e.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(o.authz?.oaa))return{active:!0,ready:!0};let l=e.authz?.oaa;return uo(l)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})(),tm:kt(o.tm?.enabled===!0&&Boolean(r.tm),e.tm,o.tm?.enabled===!0?"tm configured by RemoteConfig but FrameworkConfig.tm is not wired (this instance does not serve tenant management)":"tm not configured (no RemoteConfig.tm)","tm configured but not ready")};return{ok:Object.values(a).every((u)=>!u.active||u.ready),applied:n,modules:a,config:{...t}}}function Sf(e,t){let r=[];for(let n of t){let o=e.modules[n];if(!e.applied){r.push({name:n,reason:"RemoteConfig has not been applied yet"});continue}if(!o?.ready)r.push({name:n,reason:o?.reason??`${n} is not ready`})}return{ok:r.length===0,notReady:r}}function kf(e,t,r,n,o,s,i,a){let c=t.validators,u=Pl(e.cache);Cl(u.jwks);let l=t;if(u.session.read.enabled){let re=t.sso?.sessionStore??t.ciam?.sessionStore;if(re){let te=Un(re,u.session.read);l={...t,sso:t.sso?{...t.sso,sessionStore:te}:t.sso,ciam:t.ciam?{...t.ciam,sessionStore:te}:t.ciam}}}let w={sessionCache:u.session},m=Ye(c.workload,r,e?.workload,t.workload??void 0),T=t.otel!==null?Tn(r,e?.otel,t.otel??void 0,o):void 0,P=Jr(l);if(Object.keys(e).length>0){if(P.sso)r.error(P.sso);if(P.ciam)r.error(P.ciam)}let O=Wi(e?.sso,t.sso,e.id),E=P.sso?void 0:Il(c.sso,r,O,l.sso??void 0,w),g={...e?.iam,...t.iam},v=t.authz?.catalog?Ni(t.authz.catalog):void 0,d=t.workload,C=d&&"workloadIdentityStore"in d?d.workloadIdentityStore:d&&("incoming"in d)&&d.incoming&&!Array.isArray(d.incoming)&&("workloadIdentityStore"in d.incoming)?d.incoming.workloadIdentityStore:void 0,_=Boolean(g.url||g.userStore||t.authz?.catalogStore||v),N=i.update({users:e?.iam?.users?.delta,workloads:e?.iam?.workloads?.delta,customers:e?.iam?.customers?.delta,url:g.url,audience:g.deltaAudience},{workload:m,workloadIdentityStore:C,userStore:g.userStore,customerStore:g.customerStore??l.ciam?.customerStore,accessStore:t.authz?.accessStore,catalogStore:t.authz?.catalogStore,codeCatalog:v,mapUserToScim:g.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:g.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:g.inboundWorkloads?.mapBaseWorkloadToScim}),B;if(_&&!m){if(Object.keys(e).length>0)r.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");B=void 0}else B=Tl(c.iam,r,m,s,t.authz?.accessStore,t.authz?.accessIndex,t.authz?.catalogStore,v,t.authz?.resources,e?.iam,t.iam??void 0,N,t.authz?.onAccessMutation,Sl(e.authz),a);let ee=Wi(e?.ciam,t.ciam,e.id),ie=P.ciam?void 0:Rl(c.ciam,r,ee,l.ciam??void 0,m,w);return{secret:n,workload:m,otel:T,sso:E,iam:B,ciam:ie}}function Bi(e,t,r,n,o,s,i,a){let c=s.authz.update(hf(t,r));e.id=t.id,e.config=t,e.secrets=s.secrets.update(t.secrets,r.secrets??void 0,r.validators.secrets,r.lfv?.callbackTransport,r.lfv?.singleProcess),e.kms=s.kms.update(t.kms,(m)=>{if(!m.source)return o;if(!e.secrets)throw Error(`KMS pool references unavailable secrets source "${m.source}".`);return e.secrets.getSecretsSource(m.source)});let u=kf(t,r,n,o,s.kms.handle(),c,s.iamDelta,s.authz.settle);e.secret=u.secret,e.workload=s.workload.update(u.workload),e.otel=s.otel.update(u.otel),e.authz=c,e.log=s.log.update(e.otel?.logger??n),e.sso=s.sso.attach(u.sso),e.iam=s.iam.attach(u.iam),e.ciam=s.ciam.attach(u.ciam),e.tm=s.tm.update(t.tm?.enabled===!0&&r.tm?Xs(e,t.tm,r.tm):void 0,r.tm!==void 0&&r.tm!==null);let l=De(i),w=(m)=>Pn(m,e,a?.routing,l);e.handler=yf(e,w,l.readyzUrl,l.capabilitiezUrl,{build:()=>ff(e,i,r)},{url:ko(i),frameworkConfig:r})}function bf(e,t,r,n,o,s,i,a,c){Fl(e.id,t),Dl(t),zl(t),Bl(t),Gl(t),Jl(t),Yl(t,r,n),Ql(t,r),of(t,r,n,a),Bi(e,t,r,n,o,s,i,c)}function $i(e){if(!e.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return e.secret}async function Rf(e,t,r,n,o,s,i){let a=e,c=bo(e,t,o.current,s);if(n.beforeChange){let u=Ki(c,o);i?.enter();let l;try{l=await n.beforeChange(e,u,r)}finally{i?.exit()}if(l?.config!==void 0)a=l.config;c=l?.frameworkConfig??u}return c=Kt(c,o.current),{effectiveRemoteConfig:a,effectiveFrameworkConfig:c}}function Qg(e,t){let r=El(t),{frameworkConfig:n,basePath:o,readyTimeoutMs:s,stores:i,options:a}=r,c=Zl(n,e),u=new Set(c.keys()),l=Kt(Xl(n,e),i),w=l.log||ro,m={current:i},T={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:l},P=wn(w),O,E={log:Al(w),secrets:Fs(w,c),kms:ms(w),workload:ai(w),otel:vs(w),authz:zo(w,()=>P.handle(),()=>O?.iam,()=>({mapUserToScim:T.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:T.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:T.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim})),iamDelta:P,sso:io("sso"),iam:io("iam"),ciam:io("ciam"),tm:Bs()},g={},v,d,C=new Promise((I,j)=>{v=I,d=j}),_=!1,N,B,ee=0,ie={enter:()=>{ee+=1},exit:()=>{ee-=1}},re=Promise.resolve();function te(I){let j=re.then(I,I);return re=j.then(()=>{return},()=>{return}),j}function ue(I){if(_)throw Error(`Ionite instance has been closed and cannot call ${I}().`)}function W(){e.log=T.frameworkConfig.log??ro,e.validators=T.frameworkConfig.validators}let J={},Y={log:w,id:void 0,config:void 0,secret:$i(e),authz:void 0,configStatus:g,handler:async()=>me(),ready:(I)=>{if(ee>0&&T.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return sf(C,I??s)},isReady:()=>T.remoteConfig!==void 0,readiness:()=>vf(Y,g,T.frameworkConfig),requireReady:(I)=>Sf(Y.readiness(),I),close:()=>{if(_)return;if(_=!0,B)clearTimeout(B),B=void 0;N?.(),N=void 0;let I=[()=>E.secrets.close(),()=>E.kms.close(),()=>E.authz.close(),()=>E.otel.shutdown()];for(let j of I)try{Promise.resolve(j()).catch((K)=>{w.warn("Ionite close: module teardown failed",K)})}catch(K){w.warn("Ionite close: module teardown failed",K)}v?.(),v=void 0,d=void 0},setStores:async(I)=>{ue("setStores");let j=fr(I);await te(()=>L(j))}};O=Y,Bi(Y,J,T.frameworkConfig,w,Y.secret,E,o,a),W();function ne(){let I=g.lastError!==void 0;if(g.appliedAt=Date.now(),g.lastError=void 0,I)(Y.log??w).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function se(I,j){let K=ao(j)??(j instanceof Error?j.message:String(j)),h=jl(j),x=g.lastError===void 0;if(g.lastError={kind:h,message:K,at:Date.now(),phase:I},x)(Y.log??w).error(I==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":h,phase:I,error:K})}function oe(I,j,K){(Y.log??w).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:I,"ion.config.hash":j,"ion.config.apply_ms":K})}async function S(I,j){if(_)return;let K=xi(I);if(j&&T.remoteConfig!==void 0&&K===T.remoteConfigHash&&Mi(I,T.remoteConfig))return;let h=T.remoteConfig,x=h===void 0?"initial":"update",b=Date.now(),p,f,R;try{let X=await Rf(I,T.frameworkConfig,T.remoteConfig,a,m,o,ie);if(p=X.effectiveRemoteConfig,f=xi(p),R=X.effectiveFrameworkConfig,j&&a.beforeChange===void 0&&T.remoteConfig!==void 0&&f===T.remoteConfigHash&&Mi(p,T.remoteConfig)&&R===T.frameworkConfig)return;let F=R.log||ro;bf(Y,p,R,F,$i(e),E,o,u,a)}catch(X){throw se(x,X),X}T.remoteConfig=p,T.remoteConfigHash=f,T.frameworkConfig=R,W(),ne(),await E.otel.settled();let A=Ki(T.frameworkConfig,m),V=!1;try{a.afterChange?.(Y,p,A,h)}catch(X){if((Y.log??w).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:x,error:X instanceof Error?X.message:String(X)}),x==="initial"){V=!0;let F=X instanceof Error?X:Error(`afterChange failed on initial load: ${String(X)}`);se("initial",F),d?.(F),d=void 0,v=void 0}}if(T.frameworkConfig=A,W(),!V)oe(x,f,Date.now()-b);if(!V&&v)v(),v=void 0}async function L(I){if(_)return;if(m.current=I,T.remoteConfig===void 0){T.frameworkConfig=Kt(T.frameworkConfig,I),W();return}await S(T.remoteConfig,!1)}if(e.subscribe)e.subscribe((I)=>{te(()=>S(I,!0)).catch(()=>{})},{mode:"wait"}).then((I)=>{if(_){I?.();return}N=I}).catch((I)=>{w.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:I instanceof Error?I.message:String(I)})});let z=ql(a.configRetry),H=[a.onConfigLoadError??Kl(w)],k=0;function M(){if(B=void 0,_)return;if(T.remoteConfig!==void 0)return;af(e.load(),z.loadTimeoutMs,`ConfigSource initial load timed out after ${z.loadTimeoutMs}ms`).then(async(I)=>{k=0;try{await te(async()=>{if(T.remoteConfig!==void 0)return;await S(I,!0)})}catch(j){let K=j instanceof Error?j:Error(`Initial RemoteConfig application failed: ${String(j)}`);w.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:K.message}),d?.(K),d=void 0}},async(I)=>{if(_)return;k+=1;let j=Nl(k,z),K=ao(I)??"RemoteConfig load failed",h=Ml(I),x=Me(I,"code"),b=Me(I,"status"),p={attempt:k,error:I,errorKind:h,maxDelayMs:z.maxDelayMs,message:K,nextDelayMs:j,code:typeof x==="string"?x:void 0,status:typeof b==="number"?b:void 0,path:typeof Me(I,"path")==="string"?Me(I,"path"):void 0,sourceType:typeof Me(I,"sourceType")==="string"?Me(I,"sourceType"):void 0};if(!$l(I,h)){let f=I instanceof Error?I:Error(`ConfigSource initial load failed with unrecoverable ${h}: ${K}`);w.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:h,error:K,code:p.code,status:p.status,path:p.path,sourceType:p.sourceType}),d?.(f),d=void 0;return}try{await Vl(p,H)}catch(f){let R=f instanceof Error?f:Error("ConfigSource retry hook stopped RemoteConfig retrying");d?.(R),d=void 0;return}B=setTimeout(M,j)})}return M(),Y}export{ny as AssignmentPolicyError,py as CatalogAdjacencyCache,Ec as ION_CAPABILITY_CATALOG,vn as ION_CAPABILITY_CATALOG_VERSION,Ol as ION_READY_DEFAULT_TIMEOUT_MS,Mn as ION_SDK_VERSION,Xe as InMemoryAccessAssignmentStore,fi as InMemoryAccessCatalogStore,mi as InMemoryAccessIndex,cr as InMemoryCustomerStore,ur as InMemoryMagicLinkStore,pi as InMemoryResourceStore,dr as InMemorySessionStore,xy as InMemoryTenantStore,lr as InMemoryUserStore,Li as InMemoryWorkloadIdentityStore,ct as InMemoryWorkloadTokenStore,sy as IoniteError,Tr as ScimOutboundClient,Lr as VAULT_MIN_POLLING_TTL_MS,sr as VaultConfigInvalidPayloadError,vt as VaultConfigWaitingForSecretError,xe as VaultSubscribeNotSupportedError,cy as allowHosts,uy as allowOrigins,dy as allowRelativePaths,ly as allowSameOrigin,Jn as awsConfig,Vr as azureConfig,fy as blockDangerousUrls,my as callback,gy as captureRedirect,yy as ciam,js as closeAllVaultSockets,hy as collectReferencedDefinitions,Qn as configFromSource,zr as configLocatorFromEnvValues,ki as configSourceFromEnvValues,et as configSourceFromLocator,wn as createManagedIamDelta,Un as createSessionReadCache,hl as createTenantIonHandler,ml as createTenantIonResolver,wy as defaultRedirectPolicies,De as deriveIonUrls,fa as devInMemoryStores,vy as discoverSessionRecords,Sy as discoverSessions,er as enforceEndpointAuthz,ol as envConfig,yn as escapeScimFilterValue,ky as expandRoot,Yn as gcpConfig,oy as generateULID,by as getCustomer,Ry as getUser,Id as getWorkload,Od as getWorkloadToken,Cy as has,Ty as hasAll,Py as hasAllScope,Iy as hasAny,Oy as hasAnyScope,Ey as hasGroup,Ay as hasPermission,_y as hasRole,Ly as hasScope,ht as hashIntegrationHandle,Uy as iam,My as initiateLogin,Qg as ionite,jy as isRedirectAllowed,Gd as isVaultConfigInvalidPayloadError,Bd as isVaultConfigWaitingForSecretError,pt as lfvVault,iy as listGenerator,Wy as listSsoClientIdsFromCookies,Xn as mirrorSecrets,or as mirroredConfig,$y as reconcileSubjectAccess,qy as resolveAfterRedirect,Ny as resolveCapturedRedirect,ks as resolveDefaultRoute,Ky as resolveRedirect,Ai as resolveTenantFromRequest,Ad as revokeWorkloadToken,gl as rewriteRequestForDefaultTenantApi,yl as rewriteRequestForDefaultTenantUi,to as rewriteRequestForTenantPath,_i as rewriteRequestPath,Pn as routeRequest,Vy as sameOriginRedirectRules,al as secretConfigSource,Fy as sendTenantWebhook,Ps as setVaultWebSocketCommandTimeout,Dy as sso,Je as subscribeSecretPathWithHttpPolling,ul as tenantMirror,Ed as validateWorkloadToken,xt as vault,Fr as vaultConfig,Ms as vaultSocketDiagnostics,zy as verifyUser,By as withSetCookies,Ye as workload,_d as workloadHandler};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ionite/server",
-  "version": "0.0.24-beta.20260922.10",
+  "version": "0.0.24-beta.20260922.9",
   "description": "ionite Server (Node/server-only)",
   "private": false,
   "author": "ionite",
@@ -24,7 +24,7 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "@ionite/core": "0.0.24-beta.20260922.10",
+    "@ionite/core": "0.0.24-beta.20260922.9",
     "@opentelemetry/api": "^1.9.1",
     "@opentelemetry/api-logs": "^0.220.0",
     "@opentelemetry/exporter-logs-otlp-http": "^0.220.0",