@ionite/server 0.0.24-beta.20261005.20 → 0.0.24-beta.20261006.21

package/dist/index.js

@@ -1,5 +1,5 @@
-import{configTrustedClientGrants as Uf,deepEqualPlain as Mf,defaultLogger as Ao,ION_ENDPOINT_PERMISSIONS as Ra,listGenerator as Yt,stableConfigHash as ha,toCodeCatalog as Ta,unionCatalogRead as Wf}from"@ionite/core";import{ciam as qf,configureJwksCache as jf,iam as $f,resolveCacheConfig as Nf,sso as Df}from"@ionite/core/server";import{ACCEPT_JSON as Fa,CONTENT_TYPE_JSON as za,readJsonResponse as Ba,trimTrailingSlash as Ga,unexpectedBodySummary as Ha}from"@ionite/core";function hn(e,t){let r=()=>{if(!e.url)return"destination URL is not configured";if(!t.workload)return"workload identity is not configured";if(typeof t.workload.isReady!=="function"||typeof t.workload.ready!=="function")return"workload handle violates the readiness contract";if(!t.workload.isReady())return"workload module is not ready";if(e.audience){let i=t.workload[e.audience];if(!i)return`outgoing workload client "${e.audience}" is not configured`;if(typeof i.isReady!=="function"||typeof i.ready!=="function")return`outgoing workload client "${e.audience}" violates the readiness contract`;if(!i.isReady())return`outgoing workload client "${e.audience}" is not ready`}return},n=async()=>{let i=t.workload;if(!i)throw Error("AccessRequests: workload identity is not configured");if(e.audience)return i.getToken(e.audience);if(typeof i.getServerToken==="function")return i.getServerToken();return i.getToken()},o=async(i,c)=>{let d=r();if(d)throw Error(`Cannot use AccessRequests: ${d}`);let u=await(t.fetchImpl??fetch)(i,{...c,headers:{...Fa,Authorization:`Bearer ${await n()}`,...c.body?za:{},...c.headers}});if(!u.ok){let l=await Ha(u);throw t.log.warn("AccessRequests destination returned an error",{"ion.operation":"authz.access_request","ion.outcome":"degraded",reason:"destination_error",status:u.status,contentType:l.contentType,excerpt:l.excerpt}),Error(`AccessRequests failed: ${u.status}${l.excerpt?` ${l.excerpt}`:""}`)}return Ba(u,{log:t.log,operation:"authz.access_request"})},s=`${Ga(e.url)}/AccessRequests`;return{notReadyReason:r,submit:(i)=>o(s,{method:"POST",body:JSON.stringify(i)}),get:(i)=>o(`${s}/${encodeURIComponent(i)}`,{method:"GET"})}}function Go(e){let t=new Map,r={ciam:{}},n={channel:(o)=>t.get(o),ciamProviders:()=>[...t.keys()].filter((o)=>o.startsWith("ciam:")).map((o)=>o.slice(5)),describe:()=>structuredClone(r)};return{update(o,s){let i=new Map;if(o.iam)i.set("iam",hn(o.iam,{...s,log:e}));if(o.sso)i.set("sso",hn(o.sso,{...s,log:e}));for(let[c,d]of Object.entries(o.ciam??{}))i.set(`ciam:${c}`,hn(d,{...s,log:e}));t=i,r={...o.iam?{iam:o.iam.url}:{},...o.sso?{sso:o.sso.url}:{},ciam:Object.fromEntries(Object.entries(o.ciam??{}).map(([c,d])=>[c,d.url]))}},handle:()=>n}}import{trimTrailingSlash as Qo}from"@ionite/core";import{accessRefId as ut,accessRootId as Ho,assertRequiredSubjectType as Jo,list as Ja}from"@ionite/core";function vn(e){let{createdAt:t,updatedAt:r,...n}=e;return n}class De{constructor(){this.roots=new Map;this.byTarget=new Map;this.bySubject=new Map}static targetKey(e,t){return`${e}:${t}`}static subjectKey(e,t){return`${e}:${t}`}indexAdd(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}indexRemove(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}deindex(e){this.indexRemove(this.byTarget,De.targetKey(e.targetType,ut(e.target)),e.id),this.indexRemove(this.bySubject,De.subjectKey(e.subjectType,ut(e.subject)),e.id)}index(e){this.indexAdd(this.byTarget,De.targetKey(e.targetType,ut(e.target)),e.id),this.indexAdd(this.bySubject,De.subjectKey(e.subjectType,ut(e.subject)),e.id)}resolve(e,t){if(!e)return[];let r=[];for(let n of e){let o=this.roots.get(n);if(o&&(o.status??"active")==="active"&&t(o))r.push(o)}return r}async grant(e){Jo(e.subjectType,"Access change subjectType");let t=e.id??Ho(e),r=new Date,n=this.roots.get(t);if(n)this.deindex(n);let o={...e,id:t,status:e.status??"active",createdAt:n?.createdAt??r,updatedAt:r};this.roots.set(t,o),this.index(o)}async revoke(e){let t=e.id??Ho(e),r=this.roots.get(t);if(r)this.deindex(r);this.roots.delete(t)}async get(e){let t=this.roots.get(e);return t?vn(t):void 0}async list(e){let t=Array.from(this.roots.values()).filter((r)=>(r.status??"active")==="active");return wn(t,e)}async listByTarget(e,t,r){let n=t.trim(),o=this.byTarget.get(De.targetKey(e,n)),s=this.resolve(o,(i)=>i.targetType===e&&ut(i.target)===n);return wn(s,r)}async listByTargets(e){let t=new Map;for(let{targetType:r,target:n}of e){let o=`${r}:${n}`;if(t.has(o))continue;let s=n.trim(),i=this.byTarget.get(De.targetKey(r,s)),c=this.resolve(i,(d)=>d.targetType===r&&ut(d.target)===s);t.set(o,c.map((d)=>vn(d)))}return t}async listBySubject(e,t,r){Jo(t);let n=ut(e),o=this.bySubject.get(De.subjectKey(t,n)),s=this.resolve(o,(i)=>i.subjectType===t&&ut(i.subject)===n);return wn(s,r)}}function wn(e,t){let r=Math.max(0,t?.start??0),n=t?.limit,o=n!=null?r+n:void 0;return Ja(e.length,e.slice(r,o).map(vn),r,n)}import{assertValidSubjectTypeScoping as Yo,deepEqualPlain as Ya,list as Xo,readyCatalogEntry as Sn}from"@ionite/core";class kr{constructor(){this.listeners=new Set;this.emit=(e)=>{for(let t of this.listeners)t(e)};this.groups=new Sr("group",this.emit);this.roles=new Sr("role",this.emit);this.permissions=new Sr("permission",this.emit)}afterChange(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}}class br{constructor(){this.items=new Map;this.listeners=new Set}async get(e){return this.items.get(e)}async list(e){let t=Array.from(this.items.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=n!=null?r+n:void 0;return Xo(t.length,t.slice(r,o),r,n)}async children(e){return Array.from(this.items.values()).filter((t)=>(typeof t.parent==="string"?t.parent:t.parent?.id)===e)}changed(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}set(e){this.items.set(e.id,e),this.emitChange({id:e.id})}delete(e){if(!this.items.delete(e))return;this.emitChange({id:e,deleted:!0})}emitChange(e){for(let t of this.listeners)t(e)}}class Sr{constructor(e,t){this.kind=e;this.emit=t;this.items=new Map}async get(e){return this.items.get(e)}set(e){Yo(e);let t=this.items.get(e.id),r=!t||!Ya(t,e);if(this.items.set(e.id,e),r)this.emit({op:"set",kind:this.kind,entity:e,previous:t});return Sn(e,Promise.resolve())}insertIfAbsent(e){Yo(e);let t=this.items.get(e.id);if(t)return Sn(t,Promise.resolve());return this.items.set(e.id,e),this.emit({op:"set",kind:this.kind,entity:e,previous:void 0}),Sn(e,Promise.resolve())}async delete(e){let t=this.items.get(e);if(!t)return;this.items.delete(e),this.emit({op:"delete",kind:this.kind,entity:t})}async list(e){let t=Array.from(this.items.values()),r=e?.filter?.requestable;if(r!==void 0)t=t.filter((i)=>Boolean(i.requestable)===r);let n=Math.max(0,e?.start??0),o=e?.limit,s=o!=null?n+o:void 0;return Xo(t.length,t.slice(n,s),n,o)}}import{accessRefId as Ze,assertRequiredSubjectType as At}from"@ionite/core";function Qe(e,t){return`${t}:${e}`}function kn(e,t,r){return`${e}:${t}:${r}`}function Xa(e,t,r,n){return`${kn(e,t,r)}:${n??""}`}class Rr{constructor(){this.rows=new Map;this.byTriple=new Map;this.byRoot=new Map;this.bySubject=new Map;this.edgeMeta=new Map;this.disabledSubjects=new Set}async has(e,t,r,n,o){At(o);let s=Ze(e),i=Ze(r);if(!s||!i)return{allow:!1};if(this.disabledSubjects.has(Qe(s,o)))return{allow:!1,metadata:{reason:"subject_disabled"}};let c=kn(Qe(s,o),t,i),d=n?Ze(n):void 0;if(d===void 0){let w=this.byTriple.get(c);if(w&&w.size>0)return this.allow(s,o,t,i,void 0);return{allow:!1}}let u=`${c}:${d}`,l=`${c}:`;if(this.rows.has(u))return this.allow(s,o,t,i,d);if(this.rows.has(l))return this.allow(s,o,t,i,void 0);return{allow:!1}}async hasGroup(e,t,r,n){return this.has(e,"group",t,r,n)}async hasRole(e,t,r,n){return this.has(e,"role",t,r,n)}async hasPermission(e,t,r,n){return this.has(e,"permission",t,r,n)}async hasAny(e,t,r){for(let n of t){let o=await this.has(e,n.targetType,n.target,n.resource,r);if(o.allow)return o}return{allow:!1}}async hasAll(e,t,r){if(this.disabledSubjects.has(Qe(Ze(e),r)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(t.length===0)return{allow:!0};let n=[];for(let o of t){let s=await this.has(e,o.targetType,o.target,o.resource,r);if(!s.allow)return{allow:!1,matched:n};if(s.matched)n.push(...s.matched)}return{allow:!0,matched:n}}async materialize(e,t){this.removeRoot(e),this.addRootEdges(e,t)}async replaceSubject(e,t,r){let n=Qe(Ze(e),t),o=new Map;for(let s of r){At(s.subjectType,"Effective edge subjectType");let i=Qe(Ze(s.subject),s.subjectType);if(i!==n)throw Error(`AccessIndex.replaceSubject received an edge for ${i}; expected ${n}.`);let c=o.get(s.rootId);if(c)c.push(s);else o.set(s.rootId,[s])}this.clearSubjectEdges(n);for(let[s,i]of o)this.addRootEdges(s,i)}addRootEdges(e,t){let r=new Set;for(let n of t){At(n.subjectType,"Effective edge subjectType");let o=Qe(n.subject,n.subjectType),s=kn(o,n.targetType,n.target),i=Xa(o,n.targetType,n.target,n.resource);this.addToSet(this.rows,i,e),this.addToSet(this.byTriple,s,i),this.addToSet(this.bySubject,o,i),this.edgeMeta.set(i,{triple:s,subjectId:o}),r.add(i)}if(r.size>0)this.byRoot.set(e,r)}async removeByRoot(e){this.removeRoot(e)}removeRoot(e){let t=this.byRoot.get(e);if(!t)return;for(let r of t){let n=this.rows.get(r);if(!n)continue;if(n.delete(e),n.size===0)this.dropEdge(r)}this.byRoot.delete(e)}async listSubjects(){let e=[];for(let[t,r]of this.bySubject){if(r.size===0)continue;let n=t.indexOf(":");if(n<=0)throw Error(`AccessIndex subject key "${t}" is missing a subjectType prefix.`);let o=t.slice(0,n);At(o,"AccessIndex subject key subjectType"),e.push({subjectType:o,subject:t.slice(n+1)})}return e}async setSubjectDisabled(e,t,r){let n=Qe(Ze(e),t);if(r)this.disabledSubjects.add(n);else this.disabledSubjects.delete(n)}async isSubjectDisabled(e,t){return At(t),this.disabledSubjects.has(Qe(Ze(e),t))}async clear(e,t){if(e===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}At(t);let r=Ze(e);this.clearSubjectEdges(Qe(r,t))}clearSubjectEdges(e){let t=this.bySubject.get(e);if(!t)return;for(let r of[...t]){let n=this.rows.get(r);if(n)for(let o of n){let s=this.byRoot.get(o);if(s?.delete(r)&&s.size===0)this.byRoot.delete(o)}this.dropEdge(r)}}allow(e,t,r,n,o){return{allow:!0,matched:[{subject:e,subjectType:t,targetType:r,target:n,resources:o?[o]:void 0}]}}addToSet(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}dropEdge(e){this.rows.delete(e);let t=this.edgeMeta.get(e);if(t)this.removeFromSet(this.byTriple,t.triple,e),this.removeFromSet(this.bySubject,t.subjectId,e);this.edgeMeta.delete(e)}removeFromSet(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}}import{list as Za,matchesListFilter as Qa}from"@ionite/core";class Tr{constructor(){this.customers=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.customers.get(e)}async lookup(e){if(e.id){let t=this.customers.get(e.id);if(t)return t}if(e.userName){let t=this.userNameIndex.get(e.userName.toLowerCase());if(t)return this.customers.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.customers.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n={...e,id:t,createdAt:this.customers.get(t)?.createdAt??e.createdAt??r,updatedAt:r},o=this.customers.get(t);if(o){if(o.userName&&o.userName.toLowerCase()!==n.userName?.toLowerCase())this.userNameIndex.delete(o.userName.toLowerCase());if(o.externalId&&o.externalId!==n.externalId)this.externalIdIndex.delete(o.externalId)}if(this.customers.set(t,n),n.userName)this.userNameIndex.set(n.userName.toLowerCase(),t);if(n.externalId)this.externalIdIndex.set(n.externalId,t);return n}async delete(e){let t=this.customers.get(e);if(t?.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.customers.delete(e),t?1:0}async list(e){let t=Array.from(this.customers.values()).filter((c)=>Qa(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return Za(o,i,r,n)}}class Cr{constructor(){this.magicLinks=new Map}async create(e,t,r){if(this.magicLinks.has(e))throw Error(`Magic link with token ${e} already exists`);let n={token:e,customer:t,createdAt:new Date,expiresAt:r};this.magicLinks.set(e,n)}async get(e){let t=this.magicLinks.get(e);if(!t)return null;if(Date.now()>t.expiresAt.getTime())return this.magicLinks.delete(e),null;return t}async getAndDelete(e){let t=this.magicLinks.get(e);if(this.magicLinks.delete(e),!t)return null;if(Date.now()>t.expiresAt.getTime())return null;return t}async delete(e){this.magicLinks.delete(e)}}function ec(e){let t=e.expiresAt;if(!t)return;let r=t instanceof Date?t.getTime():new Date(t).getTime();return Number.isNaN(r)?void 0:r}class Ir{constructor(){this.capabilities={derivedEntitlements:!0};this.sessions=new Map}async create(e){if(this.sessions.has(e.sid))throw Error(`Session with sid ${e.sid} already exists`);this.sessions.set(e.sid,e)}async get(e){let t=this.sessions.get(e);if(!t)return null;let r=ec(t);if(r!==void 0&&Date.now()>r)return this.sessions.delete(e),null;return t}async update(e,t){let r=this.sessions.get(e);if(!r)throw Error(`Session with sid ${e} not found`);let n={...r,...t};this.sessions.set(e,n)}async delete(e){this.sessions.delete(e)}}import{list as tc,StoreConflictError as rc}from"@ionite/core";class Pr{constructor(){this.users=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.users.get(e)}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.users.get(t):void 0}async lookup(e){return this.users.get(e.id??"")}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r={...e,id:t},n=this.users.get(t),o=r.externalId?this.externalIdIndex.get(r.externalId):void 0;if(o&&o!==t)throw new rc(`externalId "${r.externalId}" is already in use`,"unique_violation","externalId");if(n){if(n.userName&&n.userName.toLowerCase()!==r.userName?.toLowerCase())this.userNameIndex.delete(n.userName.toLowerCase());if(n.externalId&&n.externalId!==r.externalId)this.externalIdIndex.delete(n.externalId)}if(this.users.set(t,r),r.userName)this.userNameIndex.set(r.userName.toLowerCase(),t);if(r.externalId)this.externalIdIndex.set(r.externalId,t);return r}async delete(e){let t=this.users.get(e);if(t){if(t.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t.externalId)this.externalIdIndex.delete(t.externalId)}return this.users.delete(e),t?1:0}async list(e){let t=Array.from(this.users.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return tc(o,i,r,n)}}class gt{constructor(){this.tokens=new Map}async set(e){this.tokens.set(e.workload_id,e)}async get(e){let t=this.tokens.get(e);if(!t)return null;if(Date.now()>t.expires_at.getTime())return this.tokens.delete(e),null;return t}async delete(e){this.tokens.delete(e)}async isValid(e){return await this.get(e)!==null}async cleanup(){let e=Date.now();for(let[t,r]of this.tokens.entries())if(e>r.expires_at.getTime())this.tokens.delete(t)}}function Fe(e){let t=Qo(e||Rn);return{readyzUrl:`${t}/readyz`,capabilitiezUrl:`${t}/capabilitiez`,sso:{loginUrl:`${t}/auth/login`,userUrl:`${t}/auth/user`,logoutUrl:`${t}/auth/logout`,logoutBackChannelUrl:`${t}/auth/logout/backchannel`,refreshUrl:`${t}/auth/refresh`,callbackUrl:`${t}/auth/callback`},workload:{validateUrl:`${t}/workload/validate`,jwksUrl:`${t}/workload/jwks`},iam:{basePath:`${t}/iam`,usersUrl:`${t}/iam/Users`,groupsUrl:`${t}/iam/Groups`,workloadsUrl:`${t}/iam/Workloads`,customersUrl:`${t}/iam/Customers`},ciam:{magicLinkUrl:`${t}/magic-link`,magicLinkLoginUrl:`${t}/magic-link/login`,customerUrl:`${t}/auth/customer`,customerLoginUrl:`${t}/auth/customer/login`,customerCallbackUrl:`${t}/auth/customer/callback`,customerProvidersUrl:`${t}/auth/customer/providers`,logoutUrl:`${t}/auth/customer/logout`}}}function es(e){return`${Qo(e||Rn)}/authz/oaa/sync`}function nc(e,t){if(e===null)return null;let r={validateUrl:t.validateUrl,jwksUrl:t.jwksUrl};if(e&&typeof e==="object"&&(("incoming"in e)||("outgoing"in e))){let n=e;return{...n,incoming:{...n.incoming,...r}}}return{...e??{},...r}}function ts(e,t,r,n){let o={...t},s=Fe(n);if(o.sso!==null)if(e.sso)o.sso={...o.sso,loginUrl:s.sso.loginUrl,userUrl:s.sso.userUrl,logoutUrl:s.sso.logoutUrl,logoutBackChannelUrl:s.sso.logoutBackChannelUrl,refreshUrl:s.sso.refreshUrl,redirectUri:s.sso.callbackUrl,sessionStore:r.sessionStore??o.sso?.sessionStore,userStore:r.userStore??o.sso?.userStore,enableJitUserProvisioning:o.sso?.enableJitUserProvisioning??!0};else o.sso=void 0;if(o.iam!==null)if(e.iam)o.iam={...o.iam,usersUrl:s.iam.usersUrl,groupsUrl:s.iam.groupsUrl,workloadsUrl:s.iam.workloadsUrl,customersUrl:s.iam.customersUrl,userStore:r.userStore??o.iam?.userStore,workloadIdentityStore:r.workloadIdentityStore??o.iam?.workloadIdentityStore,customerStore:r.customerStore??o.iam?.customerStore};else o.iam=void 0;if(o.workload!==null){if(e.workload||o.workload)o.workload=nc(o.workload,s.workload)}if(o.ciam!==null)if(e.ciam)o.ciam={...o.ciam,magicLinkUrl:s.ciam.magicLinkUrl,magicLinkLoginUrl:s.ciam.magicLinkLoginUrl,customerUrl:s.ciam.customerUrl,customerLoginUrl:s.ciam.customerLoginUrl,customerCallbackUrl:s.ciam.customerCallbackUrl,customerProvidersUrl:s.ciam.customerProvidersUrl,logoutUrl:s.ciam.logoutUrl,providers:e.ciam.providers,sessionStore:r.sessionStore??o.ciam?.sessionStore,customerStore:r.customerStore??o.ciam?.customerStore,magicLinkStore:r.magicLinkStore??o.ciam?.magicLinkStore,enableJitUserProvisioning:o.ciam?.enableJitUserProvisioning??!0};else o.ciam=void 0;return o}function Zt(e,t){let r={...e};if(r.sso)r.sso={...r.sso,sessionStore:t.sessionStore??r.sso.sessionStore,userStore:t.userStore??r.sso.userStore};if(r.iam)r.iam={...r.iam,userStore:t.userStore??r.iam.userStore};if(r.workload){let n=r.workload;r.workload={...r.workload,tokenStore:t.workloadTokenStore??n.tokenStore,workloadIdentityStore:t.workloadIdentityStore??n.workloadIdentityStore}}if(r.ciam)r.ciam={...r.ciam,sessionStore:t.sessionStore??r.ciam.sessionStore,customerStore:t.customerStore??r.ciam.customerStore,magicLinkStore:t.magicLinkStore??r.ciam.magicLinkStore};if(r.authz!==null&&(t.accessStore||t.accessIndex||t.catalog||t.catalogStore||t.resources)){let n=r.authz;r.authz={...n,accessStore:t.accessStore??n?.accessStore,accessIndex:t.accessIndex??n?.accessIndex,catalog:t.catalog??n?.catalog,catalogStore:t.catalogStore??n?.catalogStore,resources:t.resources??n?.resources}}return r}var Rn="/api/ionite";function Or(e){return{...e}}function oc(){return{sessionStore:new Ir,userStore:new Pr,customerStore:new Tr,magicLinkStore:new Cr,workloadTokenStore:new gt}}function bn(){return{catalogStore:new kr,accessStore:new De,accessIndex:new Rr,resources:new br}}function sc(){let e=bn(),t=new Map;return(r)=>{if(!r)return e;let n=t.get(r);if(!n)n=bn(),t.set(r,n);return n}}function Zo(e,t){return`${e} is enabled by RemoteConfig but is not served: missing ${t.join(", ")}. Provide durable stores in ionite({ stores }) (e.g. @ionite/redis or app-owned SQL stores), or opt into stores: devInMemoryStores() for prototypes only (state is lost on restart).`}function Tn(e){let t={};if(e.sso&&!e.sso.sessionStore)t.sso=Zo("SSO",["stores.sessionStore"]);if(e.ciam){let r=[];if(!e.ciam.sessionStore)r.push("stores.sessionStore");if(!e.ciam.customerStore)r.push("stores.customerStore");if(r.length>0)t.ciam=Zo("CIAM",r)}return t}function Er(){return Rn}import{AssignmentPolicyError as rr,accessRefId as pt,accessRootId as Ln,assertRequiredSubjectType as Mr,catalogEntityStore as $c,configTrustedClientGrants as Nc,deepEqualPlain as Dc,deprecateRetiredCodeCatalogRows as Kc,getCodeCatalogEntity as Vc,list as Ts,listGenerator as xn,materializeCodeCatalogEntity as Fc,toCodeCatalog as zc,unionCatalogRead as Cs}from"@ionite/core";import{assertSubjectTypeAssignable as Bc,CatalogAdjacencyCache as Gc,expandRoot as Is,reconcileSubjectAccess as Hc}from"@ionite/core/server";var rs=Symbol("ionite.describe.overlay");function ve(e){if(Array.isArray(e))return e.map((t)=>ve(t));if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,ve(r)]))}function ns(e,t,r,n){return ve({...e,...n,active:t.active,ready:t.ready,...r?{urls:r}:{}})}function os(e){return e[rs]}function ze(e,t,r,n){if(!e)return;let o=os(e)??{base:e.describe.bind(e)};o.urls=r,o.extra=n,Object.defineProperty(e,rs,{value:o,enumerable:!1,configurable:!0}),Object.defineProperty(e,"describe",{value:()=>ns(o.base(),t(),o.urls,o.extra?.()),enumerable:!1,configurable:!0})}function Be(e,t){if(!e)return;let r=os(e);return r?ns(r.base(),t,r.urls,r.extra?.()):ve(e.describe())}import{ACCEPT_JSON as us,accessRefId as Oe,accessRootId as ic,CONTENT_TYPE_JSON as ds,customAttributes as Qt,DEFAULT_RISK_LEVEL as On,ION_AUTHZ_GROUP_SCHEMA as ac,ION_SCIM_USER_EXTENSION_URN as ss,KNOWN_ENTITLEMENT_KEYS as er,mergeCodeCatalogEntity as cc}from"@ionite/core";import{baseCustomerToScim as uc,baseUserToScimUser as dc,baseWorkloadToScim as lc,collectReferencedDefinitions as fc}from"@ionite/core/server";function me(e,t,r=(n)=>Error(`${e} ready timed out after ${n}ms`)){let n=!1,o,s,i=()=>{n=!1,s=new Promise((u)=>{o=u})};i();let c=()=>{n=!0,o?.(),o=void 0},d=()=>{if(t()){if(!n)c();return}if(n)i()};return d(),{isReady:()=>t(),ready:(u)=>{if(t())return Promise.resolve();let l=s;if(!u||u<=0)return l;return new Promise((w,p)=>{let k=setTimeout(()=>p(r(u)),u);l.then(()=>{clearTimeout(k),w()},(q)=>{clearTimeout(k),p(q)})})},refresh:d,settle:c}}var ls="App",pc="ionite",fs=104857600,mc=fs,gc=10485760,Cn=3,yc=250,hc={};function ft(e,t){return t.mapGroup?t.mapGroup(e):e}class Ge extends Error{constructor(e,t={}){super(e,{cause:t.cause});this.name="OaaError",this.retryable=t.retryable??!1,this.code=t.code,this.status=t.status,this.warnings=t.warnings,Object.setPrototypeOf(this,Ge.prototype)}}function wc(e){let t=e();return Boolean(t?.url&&t.providerId&&t.datasourceId)}function ps(e,t,r,n=()=>({}),o=()=>{return},s,i){let c=async(u)=>{await cs(e,be(t),u,{mode:"incremental"})},d=me("OAA",()=>wc(t),(u)=>new Ge(`OAA ready timed out after ${u}ms`,{code:"not_ready"}));return{describe:()=>{let u=t();return ve({ready:d.isReady(),url:u?.url,providerId:u?.providerId,datasourceId:u?.datasourceId,applicationName:u?.applicationName,applicationType:u?.applicationType,population:{users:Lt(u,"user"),customers:Lt(u,"customer"),workloads:Lt(u,"workload")},fullSync:u?.fullSync?.enabled===!0})},isReady:d.isReady,ready:d.ready,refreshReadiness:d.refresh,population(u){return Lt(t(),u)},async pushUser(u){let l=be(t);if(!await In(l,"user",Oe(u),o()))return;let w=await gs(u,n());await c(Ie(l,{local_users:[xt(w,"user","modify")]},!0))},async pushCustomer(u){let l=be(t);if(!await In(l,"customer",Oe(u),o()))return;let w=await ys(u,n());await c(Ie(l,{local_users:[xt(w,"customer","modify")]},!0))},async pushWorkload(u){let l=be(t);if(!await In(l,"workload",Oe(u),o()))return;let w=await hs(u,n());await c(Ie(l,{local_users:[xt(w,"workload","modify")]},!0))},async pushGroup(u){let l=be(t),w=r(),p=ft(u,w),k=Lr(p,lt(l),"add"),q=await Pn(p,"group",i?.(),w,l);await c(Ie(l,tr({local_groups:[yt(p,"modify")],identity_to_permissions:k?[k]:[]},q),!0))},async pushRole(u){let l=be(t),w=r(),p=w.mapRole?w.mapRole(u):u,k=await Pn(p,"role",i?.(),w,l);await c(Ie(l,tr({local_roles:[ht(p,"modify")]},k),!0))},async pushPermission(u){let l=be(t);await c(Ie(l,{permissions:[Ut(u,r().mapPermissionTypes,"modify")]},!0))},async pushResource(u){let l=be(t),w=r(),p=w.mapResource?w.mapResource(u):u,k=await Ic(p,i?.(),w);await c(Ie(l,{resources:k},!0))},async grant(u){let l=be(t),w=r(),p=await ms(u,i?.(),w,l);await c(is(l,u,"add",w,p))},async revoke(u){let l=be(t);await c(is(l,u,"delete",r()))},async pushAccessChanges(u){if(u.length===0)return;let l=be(t),w=r(),p=i?.(),k=await Sc(l,u,w,p);await c(k)},async deleteUser(u){let l=be(t);await c(Ie(l,{local_users:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deleteCustomer(u){let l=be(t);await c(Ie(l,{local_users:[as(u,"customer")]},!0))},async deleteWorkload(u){let l=be(t);await c(Ie(l,{local_users:[as(u,"workload")]},!0))},async deleteGroup(u){let l=be(t);await c(Ie(l,{local_groups:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deleteRole(u){let l=be(t);await c(Ie(l,{local_roles:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deletePermission(u){let l=be(t);await c(Ie(l,{permissions:[{name:u,unique_id:u,permission_type:[],operation:"delete"}]},!0))},async deleteResource(u){let l=be(t);await c(Ie(l,{resources:[{name:u,id:u,resource_type:"",operation:"delete"}]},!0))},async sync(u,l){let w=be(t),p=l?.mode==="incremental",k=p?void 0:s?.(),q=await vc(w,u,r(),n(),p,k);return cs(e,w,q,l)}}}function be(e){let t=e();if(!t?.url||!t.providerId||!t.datasourceId)throw new Ge("OAA is not configured",{code:"not_configured"});return t}async function vc(e,t,r,n,o,s){let i=[],c=[],d=[],u=[],l=[],w=[],p=o?"modify":void 0,k=new Set,q=[],_=new Set,b=(a)=>ic(a);for await(let a of dt(t.access))q.push(a),_.add(`${a.subjectType}:${Oe(a.subject)}`);let j=(a,y)=>Lt(e,a)==="all"||Boolean(y&&_.has(`${a}:${y}`));for await(let a of dt(t.users))if(j("user",Oe(a)))i.push(xt(await gs(a,n),"user",p));for await(let a of dt(t.customers))if(j("customer",Oe(a)))i.push(xt(await ys(a,n),"customer",p));for await(let a of dt(t.workloads))if(j("workload",Oe(a)))i.push(xt(await hs(a,n),"workload",p));for await(let a of dt(t.groups)){let y=ft(a,r);c.push(yt(y,p));let S=Lr(y,lt(e),o?"add":void 0);if(S)w.push(S)}for await(let a of dt(t.roles)){let y=r.mapRole?r.mapRole(a):a;l.push(ht(y,p))}for await(let a of dt(t.permissions))u.push(Ut(a,r.mapPermissionTypes,p));let U=[];for await(let a of dt(t.resources)){let y=r.mapResource?r.mapResource(a):a;U.push(y)}d.push(...vs(U,p));for(let a of q)if(k.add(b(a)),_r(a,w,i,lt(e),o?"add":void 0),typeof a.target!=="string")if(a.targetType==="role"){let y=r.mapRole?r.mapRole(a.target):a.target;l.push(ht(y,p))}else if(a.targetType==="permission")u.push(Ut(a.target,r.mapPermissionTypes,p));else{let y=ft(a.target,r);c.push(yt(y,p))}for(let a of s??[]){let y=b(a);if(k.has(y))continue;k.add(y);let S=Oe(a.subject);if(S&&!i.some((M)=>Oe(M.unique_id??M.name)===S))i.push({name:S,unique_id:S,is_active:!0,operation:p,custom_properties:{identity_type:"workload",source:"eci-trusted"}});_r(a,w,i,lt(e),p)}return Ie(e,{local_users:i,local_groups:c,local_roles:l,resources:d,permissions:u,identity_to_permissions:w},o)}function Ie(e,t,r){let n={name:e.applicationName??ls,application_type:e.applicationType??pc,local_users:t.local_users??[],local_groups:t.local_groups??[],local_roles:t.local_roles??[],resources:t.resources??[],custom_properties:{},tags:[]};if(r)n.operation="modify";return Ae({applications:[n],permissions:t.permissions??[],identity_to_permissions:t.identity_to_permissions??[],is_incremental:r?!0:void 0})}function is(e,t,r,n=hc,o){let s=[],i=[],c=[],d=[],u=[];_r(t,s,i,lt(e),r);let l=r==="delete"?"delete":"modify";if(typeof t.target!=="string")if(t.targetType==="role"){let p=n.mapRole?n.mapRole(t.target):t.target;d.push(ht(p,l))}else if(t.targetType==="permission")u.push(Ut(t.target,n.mapPermissionTypes,l));else{let p=ft(t.target,n);c.push(yt(p,l))}let w={local_users:i,local_groups:c,local_roles:d,permissions:u,identity_to_permissions:s};return Ie(e,o?tr(w,o):w,!0)}async function Sc(e,t,r,n){let o=lt(e),s=[],i=[],c=[],d=[],u=[],l=[],w=[],p=[];for(let{change:q,op:_}of t){_r(q,_==="delete"?d:i,_==="delete"?c:s,o,_==="delete"?"delete":"add");let a=_==="delete"?"delete":"modify";if(typeof q.target!=="string")if(q.targetType==="role"){let y=r.mapRole?r.mapRole(q.target):q.target;l.push(ht(y,a))}else if(q.targetType==="permission")w.push(Ut(q.target,r.mapPermissionTypes,a));else{let y=ft(q.target,r);u.push(yt(y,a))}if(_==="add")p.push(await ms(q,n,r,e))}let k={local_users:[...s,...c],local_groups:u,local_roles:l,permissions:w,identity_to_permissions:[...i,...d]};return Ie(e,tr(k,...p),!0)}function tr(...e){let t={},r=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let n of e)for(let o of r){let s=n[o];if(s&&s.length>0)t[o]=[...t[o]??[],...s]}return t}async function Pn(e,t,r,n,o){if(!r)return{};let s=await fc(e,t,{catalog:r.catalog,code:r.code,resources:r.resources,cache:r.cache}),i=[];for(let c of s.groups){let d=ft(c,n),u=Lr(d,lt(o),"add");if(u)i.push(u)}return{local_groups:s.groups.map((c)=>yt(ft(c,n),"modify")),local_roles:s.roles.map((c)=>ht(n.mapRole?n.mapRole(c):c,"modify")),permissions:s.permissions.map((c)=>Ut(c,n.mapPermissionTypes,"modify")),resources:s.resources.map((c)=>xr(n.mapResource?n.mapResource(c):c,"modify")),identity_to_permissions:i}}async function ms(e,t,r,n){if(!t)return{};if(e.targetType!=="group"&&e.targetType!=="role")return{};let o=Oe(e.target);if(!o)return{};let s=typeof e.target==="string"?await kc(e.targetType,o,t):e.target;if(!s)return{};let i={};if(typeof e.target==="string")if(e.targetType==="group"){let d=ft(s,r),u=Lr(d,lt(n),"add");i={local_groups:[yt(d,"modify")],identity_to_permissions:u?[u]:[]}}else{let d=r.mapRole?r.mapRole(s):s;i={local_roles:[ht(d,"modify")]}}let c=await Pn(s,e.targetType,t,r,n);return tr(i,c)}async function kc(e,t,r){if(r.cache)return await r.cache.getNode(e,t);let n=e==="group"?r.code?.groups.get(t):r.code?.roles.get(t),s=await(e==="group"?r.catalog?.groups:r.catalog?.roles)?.get(t);return s&&n?cc(e,n,s):s??n}function _r(e,t,r,n,o){let s=Oe(e.subject),i=Oe(e.target),c=r.find((w)=>Oe(w.unique_id??w.name)===s);if(e.subjectType!=="user")if(c)c.custom_properties={...c.custom_properties,identity_type:e.subjectType};else c={name:s,unique_id:s,custom_properties:{identity_type:e.subjectType},operation:o},r.push(c);if(e.targetType==="group"){if(c){let w=new Set(c.groups??[]);if(w.add(i),c.groups=[...w],o)c.operation=o}else r.push({name:s,unique_id:s,groups:[i],operation:o});return}let d={identity:s,identity_type:"local_user",operation:o},u=e.resources??[],l=e.applyToApplication??u.length===0;if(e.targetType==="role")d.role_assignments=[{application:n,role:i,apply_to_application:l,resources:u,operation:o}];else d.application_permissions=[{application:n,permission:i,apply_to_application:l,resources:u,operation:o}];t.push(d)}async function gs(e,t){let r=await(t.mapUserToScim?.(e)??dc(e));return{...r,id:r.id??e.id}}async function ys(e,t){let r=await(t.mapCustomerToScim?.(e)??uc(e));return{...r,id:r.id??e.id}}async function hs(e,t){let r=await(t.mapWorkloadToScim?.(e)??lc(e));return{...r,id:r.id??e.id}}function xt(e,t,r){let{schemas:n,id:o,displayName:s,userName:i,active:c,emails:d,groups:u,meta:l,attributes:w,...p}=e,k=p[ss];delete p[ss];let q=k&&typeof k==="object"?k.attributes:void 0,_=t==="user"?q:w,b=_t(o)??_t(e.externalId)??_t(i)??"principal";return Ae({name:_t(s)??_t(i)??b,unique_id:b,identities:t==="customer"?void 0:bc(e),groups:t==="user"&&Array.isArray(u)?u.map((j)=>typeof j==="string"?j:ge(j,"value")).filter((j)=>Boolean(j)):void 0,is_active:typeof c==="boolean"?c:void 0,created_at:l&&typeof l==="object"?ge(l,"created"):void 0,custom_properties:Ae({...p,..._&&typeof _==="object"?_:{},ecid:t==="customer"?void 0:ws(e),accountClass:Rc(e),externalId:e.externalId,userName:i,emails:d,identity_type:t==="user"?void 0:t}),tags:[],operation:r})}function bc(e){let t=ws(e),r=e.emails,n=Array.isArray(r)?r.map((s)=>s&&typeof s==="object"?ge(s,"value"):void 0).filter((s)=>Boolean(s)):[],o=[...t?[t]:[],...n];return o.length>0?o:void 0}function ws(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return _t(e.ecid)??(t&&typeof t==="object"?ge(t,"ecid"):void 0)}function Rc(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return t&&typeof t==="object"?ge(t,"accountClass"):void 0}function as(e,t){return{name:e,unique_id:e,custom_properties:{identity_type:t},operation:"delete"}}function yt(e,t){let r=Tc(e),n=ge(e,"id")??ge(e,"name")??ge(e,"displayName"),o=ge(e,"displayName")??ge(e,"name")??n??"group",s=Ar(e,"resources");return Ae({name:o,unique_id:n,custom_properties:Ae({...r?.attributes??Qt(e,er),requestable:r?.requestable??Wc(e,"requestable"),description:r?.description??ge(e,"description"),type:r?.type,resources:s.length>0?s:void 0,riskLevel:r?.riskLevel??ge(e,"riskLevel")??On}),tags:[],operation:t})}function Tc(e){let t=e[ac];if(!t||typeof t!=="object"||Array.isArray(t))return;return t}function Ar(e,t){if(!e||typeof e!=="object")return[];let r=e[t];if(!Array.isArray(r))return[];return r.map(Oe).filter((n)=>n.length>0)}function Cc(e){return ge(e,"id")??ge(e,"name")??ge(e,"displayName")??"group"}function Lr(e,t,r){let n=Ar(e,"resources"),o=n.length>0,s=!o,i=o?n:[],c=Ar(e,"roles").map((u)=>({application:t,role:u,apply_to_application:s,resources:i,operation:r})),d=Ar(e,"permissions").map((u)=>({application:t,permission:u,apply_to_application:s,resources:i,operation:r}));if(c.length===0&&d.length===0)return;return{identity:Cc(e),identity_type:"local_group",role_assignments:c.length>0?c:void 0,application_permissions:d.length>0?d:void 0,operation:r}}function ht(e,t){return Ae({name:e.name,unique_id:e.id,permissions:e.permissions?.map((r)=>typeof r==="string"?r:r.id),custom_properties:Ae({...Qt(e,er),displayName:e.displayName,requestable:e.requestable,riskLevel:e.riskLevel??On}),tags:[],operation:t})}function Ut(e,t,r){return Ae({name:e.name,unique_id:e.id,permission_type:t?.(e)??e.permissionTypes??[e.action??"Uncategorized"],apply_to_sub_resources:e.applyToSubResources,resource_types:e.resourceTypes,custom_properties:{...Qt(e,er),riskLevel:e.riskLevel??On},operation:r})}function xr(e,t,r,n=new Set){let o=e.id;if(o&&n.has(o))return Ae({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,custom_properties:Ae({...Qt(e,er)}),tags:[],operation:t});if(o)n.add(o);let s=[];for(let i of e.resources??[]){let c=typeof i==="string"?r?.get(i):i;if(c)s.push(xr(c,t,r,n))}if(o)n.delete(o);return Ae({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,sub_resources:s.length>0?s:void 0,custom_properties:Ae({...Qt(e,er)}),tags:[],operation:t})}function vs(e,t){if(e.length===0)return[];let r=new Map;for(let d of e)if(d.id)r.set(d.id,d);let n=new Map,o=new Set,s=(d,u)=>{if(!u.id||u.id===d)return;let l=n.get(d)??[];if(!l.some((w)=>w.id===u.id))l.push(u);n.set(d,l),o.add(u.id)};for(let d of e){for(let l of d.resources??[]){let w=typeof l==="string"?r.get(l):l;if(w&&d.id)s(d.id,w)}let u=Oe(d.parent);if(u&&r.has(u)&&d.id)s(u,d)}let i=(d)=>{if(!d.id)return d;let u=n.get(d.id);if(!u||u.length===0)return d;return{...d,resources:u.map(i)}};return e.filter((d)=>!d.id||!o.has(d.id)).map(i).map((d)=>xr(d,t,r))}async function Ic(e,t,r){if(!t)return[xr(e,"modify")];let n=async(l)=>{if(t.cache)return await t.cache.getNode("resource",l);return t.resources?.get(l)},o=async(l)=>{if(t.resources?.children&&l.id&&(!l.resources||l.resources.length===0))return t.resources.children(l.id);let w=[];for(let p of l.resources??[]){let k=typeof p==="string"?await n(p):p;if(k)w.push(k)}return w},s=e,i=new Set;while(!0){let l=Oe(s.parent);if(!l||i.has(l))break;i.add(l);let w=await n(l);if(!w)break;s=w}let c=[],d=[s],u=new Set;while(d.length>0){let l=d.shift();if(!l)break;if(l.id&&u.has(l.id))continue;if(l.id)u.add(l.id);let w=r.mapResource?r.mapResource(l):l;c.push(w);for(let p of await o(l))d.push(p)}if(e.id&&!u.has(e.id))c.push(r.mapResource?r.mapResource(e):e);return vs(c,"modify")}async function cs(e,t,r,n){let o=JSON.stringify(Ae(r)),s=n?.compression??t.compression??"gzip",i=s==="gzip"?await xc(o):o,c=Mc(i),d=n?.maxPayloadBytes??t.maxPayloadBytes??fs,u=n?.multipart??t.multipart??"auto",l=n?.multipartThresholdBytes??t.multipartThresholdBytes??mc;if(c>d&&u==="never")throw new Ge("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(u==="always"||u==="auto"&&c>l)return Oc(e,t,i,s,n);return Pc(t,{id:t.datasourceId,data_source_id:t.datasourceId,json_data:i,compression_type:s==="gzip"?"GZIP":"NONE"})}async function Pc(e,t){let r=`${Rs(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:push`,n=await Ur(r,{method:"POST",headers:{...us,Authorization:`Bearer ${e.apiKey??""}`,...ds},body:JSON.stringify(t)});return ks(n)}async function Oc(e,t,r,n,o){let s=o?.partSizeBytes??t.partSizeBytes??gc,i=await Ec(t,n),c=Uc(r,s);for(let u=0;u<c.length;u++)await Ac(t,i,u+1,c[u]??"");let d=await _c(t,i,c.length);return e.debug("OAA multipart payload pushed",{uploadId:i,parts:c.length}),{...d,uploadId:d.uploadId??i,parts:d.parts??c.length}}async function Ec(e,t){let r=En(e,"multipart/start"),n=await Ur(r,{method:"POST",headers:An(e),body:JSON.stringify({data_source_id:e.datasourceId,compression_type:t==="gzip"?"GZIP":"NONE"})}),o=await _n(n),s=ge(o,"upload_id")??ge(o,"uploadId")??ge(o,"id");if(!s)throw new Ge("OAA multipart start response did not include an upload id",{code:"invalid_response"});return s}async function Ac(e,t,r,n){let o=En(e,`multipart/${encodeURIComponent(t)}/parts/${r}`);await Ur(o,{method:"PUT",headers:An(e),body:JSON.stringify({upload_id:t,sequence:r,data:n})})}async function _c(e,t,r){let n=En(e,`multipart/${encodeURIComponent(t)}/complete`),o=await Ur(n,{method:"POST",headers:An(e),body:JSON.stringify({upload_id:t,parts:r})});return ks(o)}function En(e,t){return`${Rs(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:${t}`}function An(e){return{...us,Authorization:`Bearer ${e.apiKey??""}`,...ds}}async function Ur(e,t){let r;for(let n=0;n<Cn;n++){try{let o=await fetch(e,t);if(!Ss(o.status)||n===Cn-1){if(!o.ok)await Lc(o);return o}r=new Ge(`OAA request failed with retryable status ${o.status}`,{retryable:!0,status:o.status})}catch(o){if(r=o,o instanceof Ge&&!o.retryable)throw o;if(n===Cn-1)break}await jc(yc*2**n)}throw new Ge("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:r})}function Ss(e){return e===429||e>=500}async function Lc(e){let t=await _n(e).catch(()=>{return}),r=ge(t,"message")??ge(t,"error")??`OAA request failed with status ${e.status}`;throw new Ge(r,{code:ge(t,"code")??"http_error",status:e.status,retryable:Ss(e.status),warnings:bs(t?.warnings)})}async function ks(e){let t=await _n(e).catch(()=>{return});return{success:e.ok,syncToken:ge(t,"sync_token")??ge(t,"syncToken"),uploadId:ge(t,"upload_id")??ge(t,"uploadId"),parts:qc(t,"parts"),warnings:bs(t?.warnings),metadata:t}}async function _n(e){let t=await e.text();if(!t)return{};let r=JSON.parse(t);return r&&typeof r==="object"&&!Array.isArray(r)?r:{}}async function xc(e){let t=new Blob([e]).stream().pipeThrough(new CompressionStream("gzip")),r=await new Response(t).arrayBuffer();return Buffer.from(r).toString("base64")}function Uc(e,t){let r=[];for(let n=0;n<e.length;n+=t)r.push(e.slice(n,n+t));return r}function Mc(e){return Buffer.byteLength(e,"utf8")}function ge(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="string"&&r.length>0?r:void 0}function _t(e){return typeof e==="string"&&e.length>0?e:void 0}function Wc(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="boolean"?r:void 0}function qc(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="number"?r:void 0}function bs(e){if(!Array.isArray(e))return;let t=e.filter((r)=>typeof r==="string");return t.length>0?t:void 0}async function*dt(e){if(!e)return;for await(let t of e)yield t}function Ae(e){if(Array.isArray(e))return e.map(Ae).filter((r)=>r!==void 0);if(!e||typeof e!=="object"||e instanceof Date)return e===null?void 0:e;let t=Object.entries(e).map(([r,n])=>[r,Ae(n)]).filter(([,r])=>{if(r===void 0)return!1;if(Array.isArray(r)&&r.length===0)return!1;if(r&&typeof r==="object"&&!Array.isArray(r)&&Object.keys(r).length===0)return!1;return!0});return t.length>0?Object.fromEntries(t):void 0}function Rs(e){return e.replace(/\/+$/,"")}function lt(e){return e.applicationName??ls}function Lt(e,t){if(t==="user")return e?.users?.population??"all";if(t==="customer")return e?.customers?.population??"access";return e?.workloads?.population??"access"}async function In(e,t,r,n){if(Lt(e,t)==="all")return!0;if(!n||!r)return!1;return(await n.listBySubject(r,t,{start:0,limit:1})).items.length>0}function jc(e){return new Promise((t)=>setTimeout(t,e))}function Un(e,t){if(!t)return"app";if(e==="user")return t.users.assignment;if(e==="workload")return t.workloads.assignment;return t.customers.assignment}function Ps(e,t=()=>{return},r=()=>{return},n=()=>{return},o=()=>({})){let s,i=!1,c=(T,g,P)=>{let I=r();if(!I)throw Error("Cannot use AccessRequests: no destination channels are configured.");if(T==="iam-request"){let O=I.channel("iam");if(!O)throw Error("Cannot use AccessRequests: the IAM destination is not configured.");return O}if(T!=="idp")throw new rr(`Cannot use AccessRequests for a "${g}" principal: RemoteConfig assignment policy is "${T}".`,T);if(g==="user"){let O=I.channel("sso");if(!O)throw Error("Cannot use AccessRequests: the SSO destination is not configured.");return O}if(g==="workload")throw new rr('Cannot use AccessRequests with assignment policy "idp" for workloads.',T);let R=I.ciamProviders(),W=P??(R.length===1?R[0]:void 0);if(!W)throw Error(R.length===0?"Cannot use AccessRequests: no CIAM provider destination is configured.":"Cannot use AccessRequests: provider is required when multiple CIAM provider destinations are configured.");let h=I.channel(`ciam:${W}`);if(!h)throw Error(`Cannot use AccessRequests: CIAM provider "${W}" is not configured.`);return h},d,u,l=ps(e,()=>s?.oaa,()=>({mapPermissionTypes:s?.mapPermissionTypes,mapGroup:s?.mapGroup,mapRole:s?.mapRole,mapResource:s?.mapResource}),o,()=>s?.accessStore,()=>Nc(s),()=>w());function w(){let T=s?.catalogStore;return T||d?{catalog:T,code:d,resources:s?.resources,cache:u}:void 0}let p=(T)=>{if(T.op!=="set"||!T.previous)return!1;if(!(T.previous.providerId!==T.entity.providerId||T.previous.requestUrl!==T.entity.requestUrl))return!1;let{providerId:P,requestUrl:I,...R}=T.previous,{providerId:W,requestUrl:h,...O}=T.entity;return Dc(R,O)},k=(T)=>{if(i)return;let{kind:g}=T;if(l.isReady())(T.op==="delete"?g==="role"?l.deleteRole(T.entity.id):g==="permission"?l.deletePermission(T.entity.id):l.deleteGroup(T.entity.id):g==="role"?l.pushRole(T.entity):g==="permission"?l.pushPermission(T.entity):l.pushGroup(T.entity)).catch((W)=>{e.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:T.op,kind:g,error:W})});let P=t();if(!P?.isReady())return;if(T.op==="set"&&T.entity.requestable!==!0){if(T.previous?.requestable===!0)P.onEntitlementDelete(g,T.previous.id).catch((R)=>{e.warn("IAM delta removal of a no-longer-requestable entitlement failed",{"ion.operation":"iam.delta.delete","ion.outcome":"degraded",id:T.entity.id,kind:g,error:R instanceof Error?R.message:String(R)})});return}(T.op==="delete"?P.onEntitlementDelete(g,T.entity.id):P.onEntitlementUpsert(T.entity,g)).catch((R)=>{e.warn("IAM delta projection from catalog change failed; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:T.op,kind:g,error:R instanceof Error?R.message:String(R)})})},q=(T)=>{if(i)return;let g=s?.resources;if(!g)return;if(l.isReady())(async()=>{if(T.deleted){await l.deleteResource(T.id);return}let I=await g.get(T.id);if(!I)return;await l.pushResource(I)})().catch((I)=>{e.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:T.id,deleted:T.deleted===!0,error:I})})},_,b,j,U,a=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),y=!1,S=()=>{let T=s?.accessIndex;if(!T&&!y)y=!0,e.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return T},M=async(T)=>{let g=s?.accessIndex,P=s?.catalogStore;if(!g||!P&&!d)return!1;let I=T.id??Ln(T),R=await Is({...T,id:I},{catalog:P,code:d,resources:s?.resources,cache:u});return await g.materialize(I,R),!0},F=(T,g)=>Hc(T,g,{accessStore:s?.accessStore,accessIndex:s?.accessIndex,catalogStore:s?.catalogStore,code:d,resources:s?.resources},u),Z=async()=>{let T=s?.catalogStore;if(!T)return;await Kc(d,T)},Y=async()=>{let T={subjects:0,roots:0,cleared:0};if(i)return T;await Z();let g=s?.accessIndex,P=s?.catalogStore;if(!g||!P&&!d)return T;let I=new Map,R=(O)=>{let L=pt(O.subject);if(!L)return;let C=O.subjectType;I.set(`${C}:${L}`,{subject:L,subjectType:C})},W=new Set,h=s?.accessStore;if(h)for await(let O of xn((L,C)=>h.list({start:L,limit:C}))){R({subject:pt(O.subject),subjectType:O.subjectType});let L=pt(O.target);if(u&&L&&typeof O.target==="string"){if(!await u.getNode(O.targetType,L))W.add(`${O.targetType}:${L}`)}}if(W.size>0)e.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog or catalog store). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...W].sort()});if(g.listSubjects)for(let O of await g.listSubjects())R(O);for(let O of I.values()){let L=await F(O.subject,O.subjectType);if(T.subjects+=1,T.roots+=L,L===0)T.cleared+=1}return T},ee=()=>{if(i)return Promise.resolve({subjects:0,roots:0,cleared:0});return Y()},ae=Promise.resolve(),oe=!1,K=(T,g)=>{let P=ae.then(async()=>{if(i)return;try{await g()}catch(I){e.warn(`${T} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:T,error:I instanceof Error?I.message:String(I)})}});return ae=P,P},Q=(T)=>{if(oe)return;oe=!0,K(T,async()=>{oe=!1,await Y()})},V=()=>ae,D=(T)=>{if(i)return;let g=s?.accessStore;if(!s?.accessIndex||!s?.catalogStore||!g)return;if(u?.invalidate(T),T.op==="set"){let P=T.kind,I=T.entity.id;K("catalog-change",async()=>{for await(let R of xn((W,h)=>g.listByTarget(P,I,{start:W,limit:h})))await M(R)})}else Q("catalog-delete")},te=(T)=>{if(i)return;if(u?.clear(),!s?.accessIndex||!s?.catalogStore&&!d||!s?.accessStore)return;Q("resource-change")},re={describe:()=>ve({module:"authz",active:s!==void 0,ready:s!==void 0,trustedProvisioningClients:(s?.trustedProvisioningClients??[]).map((T)=>({issuer:T.issuer,audience:T.audience,clientId:T.clientId,permissions:[...T.permissions]})),oaa:s?.oaa?l.describe():void 0,stores:{accessStore:s?.accessStore!==void 0,accessIndex:s?.accessIndex!==void 0,catalogStore:s?.catalogStore!==void 0,resources:s?.resources!==void 0}}),oaa:l,entitlements:{async list(T){let g=Cs(d,s?.catalogStore),P=Math.max(0,T?.start??0),I=T?.limit;if(!g)return Ts(0,[],P,I);let R=[];for(let h of[g.groups,g.roles,g.permissions])for await(let O of xn((L,C)=>h.list({start:L,limit:C,filter:T?.filter})))R.push(O);let W=I==null?void 0:P+I;return Ts(R.length,R.slice(P,W),P,I)}},get catalogStore(){return s?.catalogStore},get accessStore(){return s?.accessStore},get accessIndex(){return s?.accessIndex},has(T,g,P,I,R){let W=S();return W?W.has(T,g,P,I,R):Promise.resolve(a())},hasGroup(T,g,P,I){let R=S();return R?R.hasGroup(T,g,P,I):Promise.resolve(a())},hasRole(T,g,P,I){let R=S();return R?R.hasRole(T,g,P,I):Promise.resolve(a())},hasPermission(T,g,P,I){let R=S();return R?R.hasPermission(T,g,P,I):Promise.resolve(a())},hasAny(T,g,P){let I=S();return I?I.hasAny(T,g,P):Promise.resolve(a())},hasAll(T,g,P){let I=S();return I?I.hasAll(T,g,P):Promise.resolve(a())},reconcile(){return ee()},async grant(T){Mr(T.subjectType);let g=pt(T.target),P=Un(T.subjectType,n());if(P!=="app")throw new rr(P==="iam-request"||P==="idp"?`Cannot grant ${T.targetType} "${g}" to a "${T.subjectType}" principal: RemoteConfig assignment policy is "${P}". Use ion.authz.requestAccess.`:`Cannot grant ${T.targetType} "${g}" to a "${T.subjectType}" principal: RemoteConfig assignment policy is "${P}".`,P,await ie(T));await se(T),await Bc(s?.catalogStore,d,T,u);let I={...T,status:T.status??"active"};I.id=Ln(I);let R=s?.accessStore;if(!R)throw Error("Cannot grant: no AccessAssignmentStore is wired.");if(await R.grant(I),s?.accessIndex&&(s.catalogStore||d)){let W=await Is(I,{catalog:s.catalogStore,code:d,resources:s.resources,cache:u});await s.accessIndex.materialize(I.id,W)}return await ce(I,"grant"),I},async requestAccess(T){Mr(T.subjectType);let g=Un(T.subjectType,n());if(g!=="iam-request"&&g!=="idp")throw new rr(`Cannot request access for a "${T.subjectType}" principal: RemoteConfig assignment policy is "${g}" (use ion.authz.grant when policy is "app").`,g);let P=pt(T.subject),I=pt(T.target);return c(g,T.subjectType,T.provider).submit({subject:P,subjectType:T.subjectType,targetType:T.targetType,target:I,operation:T.operation,justification:T.justification})},async getAccessRequest(T){Mr(T.subjectType);let g=Un(T.subjectType,n());if(g!=="iam-request"&&g!=="idp")throw new rr(`Cannot read an access request for a "${T.subjectType}" principal: RemoteConfig assignment policy is "${g}".`,g);return c(g,T.subjectType,T.provider).get(T.id)},async revoke(T){Mr(T.subjectType);let g={...T,id:T.id??Ln(T)},P=s?.accessStore;if(!P)throw Error("Cannot revoke: no AccessAssignmentStore is wired.");await P.revoke(g),await s?.accessIndex?.removeByRoot(g.id),await ce(g,"revoke")}},ie=async(T)=>{let g=pt(T.target),P=Cs(d,s?.catalogStore);if(P){let I=T.targetType==="role"?await P.roles.get(g):T.targetType==="permission"?await P.permissions.get(g):await P.groups.get(g);if(I?.requestUrl)return I.requestUrl}return(await t()?.getDestinationRef("group",g))?.requestUrl},se=async(T)=>{let g=Vc(d,pt(T.target));if(!g)return;if(g.kind!==T.targetType)throw Error(`Cannot grant ${T.targetType} "${g.entity.id}": code declares that id as ${g.kind}.`);if(!s?.catalogStore)throw Error(`Cannot grant code entitlement "${g.entity.id}": no AccessCatalogStore is wired for materialization.`);await Fc(g.kind,g.entity,$c(s.catalogStore,g.kind))},ce=async(T,g)=>{if(l.isReady())try{if(g==="grant")await l.grant(T);else await l.revoke(T)}catch(I){e.warn("OAA incremental access push failed after ion.authz mutation; full sync will reconcile",{"ion.operation":"authz.oaa.push","ion.outcome":"degraded",op:g,error:I instanceof Error?I.message:String(I)})}let P=t();if(!P?.isReady())return;try{if(g==="grant")await P.onGrant(T);else await P.onRevoke(T)}catch(I){e.warn("IAM delta projection failed after ion.authz mutation; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:g,error:I instanceof Error?I.message:String(I)})}};return{update(T){if(i)return re;let g=T?.catalog?zc(T.catalog):void 0,P=g!==d;d=g,s=T,l.refreshReadiness();let I=T?.catalogStore,R=T?.resources;if(I!==_||R!==j||P)b?.(),U?.(),u=I||d?new Gc(I,R,d):void 0,b=I?.afterChange?I.afterChange((W)=>{if(p(W))return;k(W),D(W)}):void 0,U=R?.changed?R.changed((W)=>{te(W),q(W)}):void 0,_=I,j=R;else if(u)u.clear();return re},settle:V,catalogView:w,close(){if(i)return;i=!0,b?.(),b=void 0,U?.(),U=void 0,_=void 0,j=void 0,u=void 0}}}function Os(e){return e.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+|_+$/g,"")||"EMPTY"}function Jc(e){let t=`${e.clientId}\x00${e.path}`,r=2166136261;for(let n=0;n<t.length;n+=1)r^=t.charCodeAt(n),r=Math.imul(r,16777619);return(r>>>0).toString(36)}function Yc(e){let t=Os(e.clientId),r=Os(e.path);return`LFV_${t}__${r}`}function Mn(e,t){let r=Yc(t);if(!(r in e))return r;let n=`${r}_${Jc(t)}`;if(!(n in e))return n;return`${n}_ALT`}import{defaultLogger as $m}from"@ionite/core";import{ACCEPT_JSON as qt,CONTENT_TYPE_JSON as Ee,defaultLogger as au,readJsonResponse as jt,stableConfigHash as cu}from"@ionite/core";import{verifyLfvSignature as Ms}from"@ionite/core/server";import{DEFAULT_SECRET_MIME_TYPES as Mt}from"@ionite/core";var Xc=new Set(["jsonc","env","text","binary","yaml","toml","xml"]);function Zc(e){let t=e.split(";",1)[0]?.trim().toLowerCase()??"";if(t===Mt.binary)return"binary";if(t===Mt.env)return"env";if(t===Mt.yaml||t.endsWith("+yaml"))return"yaml";if(t===Mt.toml||t.endsWith("+toml"))return"toml";if(t===Mt.xml||t.endsWith("+xml"))return"xml";if(t===Mt.jsonc||t.endsWith("+json"))return"jsonc";return"text"}function Wr(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let t=e,r=typeof t.mimeType==="string"?t.mimeType:typeof t.mime_type==="string"?t.mime_type:void 0;if(!r)return;let n=t.format,o=typeof n==="string"&&Xc.has(n)?n:Zc(r),s=typeof t.schemaUrl==="string"?t.schemaUrl:typeof t.schema_url==="string"?t.schema_url:void 0,i=typeof t.typeId==="string"?t.typeId:typeof t.type_id==="string"?t.type_id:void 0;return{format:o,mimeType:r,...s?{schemaUrl:s}:{},...i?{typeId:i}:{}}}function wt(e){if(!e)return;let t=e.custom_metadata,r=t&&typeof t==="object"&&!Array.isArray(t)?t:void 0;return Wr(e.content_type??e.contentType??r?.content_type)}function qr(e){return{format:e.format,mime_type:e.mimeType,...e.schemaUrl?{schema_url:e.schemaUrl}:{},...e.typeId?{type_id:e.typeId}:{}}}var Wt=new Map;function Qc(e){if(!e)return"/";return e.startsWith("/")?e:`/${e}`}function eu(e){try{let t=new URL(e),r=t.pathname.replace(/\/+$/g,"");return`${t.origin}${r}`}catch{return e.replace(/\/+$/g,"")}}function jr(e){let t=eu(e.lfvServerUrl),r=Qc(e.path);return`${t}|${r}`}function Es(e,t,r){let n=Wt.get(e)??new Map;return n.set(t,r),Wt.set(e,n),()=>{let o=Wt.get(e);if(!o)return;if(o.delete(t),o.size===0)Wt.delete(e)}}async function As(e,t,r,n){let o=Wt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onDelivery)continue;if(await c.onDelivery(t)){s+=1;break}}return s}async function _s(e,t,r,n){let o=Wt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onEvents)continue;s+=1,await c.onEvents(t)}return s}import{defaultSecretContentType as tu,parseJsonc as ru,SecretContentTypeMismatchError as nu}from"@ionite/core";function Ls(e){let t={},r=e.replace(/\r\n?/g,`
+import{configTrustedClientGrants as Uf,deepEqualPlain as Mf,defaultLogger as Ao,ION_ENDPOINT_PERMISSIONS as Ra,listGenerator as Yt,stableConfigHash as ha,toCodeCatalog as Ta,unionCatalogRead as Wf}from"@ionite/core";import{ciam as qf,configureJwksCache as jf,iam as $f,resolveCacheConfig as Nf,sso as Df}from"@ionite/core/server";import{ACCEPT_JSON as Fa,CONTENT_TYPE_JSON as za,readJsonResponse as Ba,trimTrailingSlash as Ga,unexpectedBodySummary as Ha}from"@ionite/core";function hn(e,t){let r=()=>{if(!e.url)return"destination URL is not configured";if(!t.workload)return"workload identity is not configured";if(typeof t.workload.isReady!=="function"||typeof t.workload.ready!=="function")return"workload handle violates the readiness contract";if(!t.workload.isReady())return"workload module is not ready";if(e.audience){let i=t.workload[e.audience];if(!i)return`outgoing workload client "${e.audience}" is not configured`;if(typeof i.isReady!=="function"||typeof i.ready!=="function")return`outgoing workload client "${e.audience}" violates the readiness contract`;if(!i.isReady())return`outgoing workload client "${e.audience}" is not ready`}return},n=async()=>{let i=t.workload;if(!i)throw Error("AccessRequests: workload identity is not configured");if(e.audience)return i.getToken(e.audience);if(typeof i.getServerToken==="function")return i.getServerToken();return i.getToken()},o=async(i,c)=>{let d=r();if(d)throw Error(`Cannot use AccessRequests: ${d}`);let u=await(t.fetchImpl??fetch)(i,{...c,headers:{...Fa,Authorization:`Bearer ${await n()}`,...c.body?za:{},...c.headers}});if(!u.ok){let l=await Ha(u);throw t.log.warn("AccessRequests destination returned an error",{"ion.operation":"authz.access_request","ion.outcome":"degraded",reason:"destination_error",status:u.status,contentType:l.contentType,excerpt:l.excerpt}),Error(`AccessRequests failed: ${u.status}${l.excerpt?` ${l.excerpt}`:""}`)}return Ba(u,{log:t.log,operation:"authz.access_request"})},s=`${Ga(e.url)}/AccessRequests`;return{notReadyReason:r,submit:(i)=>o(s,{method:"POST",body:JSON.stringify(i)}),get:(i)=>o(`${s}/${encodeURIComponent(i)}`,{method:"GET"})}}function Go(e){let t=new Map,r={ciam:{}},n={channel:(o)=>t.get(o),ciamProviders:()=>[...t.keys()].filter((o)=>o.startsWith("ciam:")).map((o)=>o.slice(5)),describe:()=>structuredClone(r)};return{update(o,s){let i=new Map;if(o.iam)i.set("iam",hn(o.iam,{...s,log:e}));if(o.sso)i.set("sso",hn(o.sso,{...s,log:e}));for(let[c,d]of Object.entries(o.ciam??{}))i.set(`ciam:${c}`,hn(d,{...s,log:e}));t=i,r={...o.iam?{iam:o.iam.url}:{},...o.sso?{sso:o.sso.url}:{},ciam:Object.fromEntries(Object.entries(o.ciam??{}).map(([c,d])=>[c,d.url]))}},handle:()=>n}}import{trimTrailingSlash as Qo}from"@ionite/core";import{accessRefId as ut,accessRootId as Ho,assertRequiredSubjectType as Jo,list as Ja}from"@ionite/core";function vn(e){let{createdAt:t,updatedAt:r,...n}=e;return n}class De{constructor(){this.roots=new Map;this.byTarget=new Map;this.bySubject=new Map}static targetKey(e,t){return`${e}:${t}`}static subjectKey(e,t){return`${e}:${t}`}indexAdd(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}indexRemove(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}deindex(e){this.indexRemove(this.byTarget,De.targetKey(e.targetType,ut(e.target)),e.id),this.indexRemove(this.bySubject,De.subjectKey(e.subjectType,ut(e.subject)),e.id)}index(e){this.indexAdd(this.byTarget,De.targetKey(e.targetType,ut(e.target)),e.id),this.indexAdd(this.bySubject,De.subjectKey(e.subjectType,ut(e.subject)),e.id)}resolve(e,t){if(!e)return[];let r=[];for(let n of e){let o=this.roots.get(n);if(o&&(o.status??"active")==="active"&&t(o))r.push(o)}return r}async grant(e){Jo(e.subjectType,"Access change subjectType");let t=e.id??Ho(e),r=new Date,n=this.roots.get(t);if(n)this.deindex(n);let o={...e,id:t,status:e.status??"active",createdAt:n?.createdAt??r,updatedAt:r};this.roots.set(t,o),this.index(o)}async revoke(e){let t=e.id??Ho(e),r=this.roots.get(t);if(r)this.deindex(r);this.roots.delete(t)}async get(e){let t=this.roots.get(e);return t?vn(t):void 0}async list(e){let t=Array.from(this.roots.values()).filter((r)=>(r.status??"active")==="active");return wn(t,e)}async listByTarget(e,t,r){let n=t.trim(),o=this.byTarget.get(De.targetKey(e,n)),s=this.resolve(o,(i)=>i.targetType===e&&ut(i.target)===n);return wn(s,r)}async listByTargets(e){let t=new Map;for(let{targetType:r,target:n}of e){let o=`${r}:${n}`;if(t.has(o))continue;let s=n.trim(),i=this.byTarget.get(De.targetKey(r,s)),c=this.resolve(i,(d)=>d.targetType===r&&ut(d.target)===s);t.set(o,c.map((d)=>vn(d)))}return t}async listBySubject(e,t,r){Jo(t);let n=ut(e),o=this.bySubject.get(De.subjectKey(t,n)),s=this.resolve(o,(i)=>i.subjectType===t&&ut(i.subject)===n);return wn(s,r)}}function wn(e,t){let r=Math.max(0,t?.start??0),n=t?.limit,o=n!=null?r+n:void 0;return Ja(e.length,e.slice(r,o).map(vn),r,n)}import{assertValidSubjectTypeScoping as Yo,deepEqualPlain as Ya,list as Xo,readyCatalogEntry as Sn}from"@ionite/core";class kr{constructor(){this.listeners=new Set;this.emit=(e)=>{for(let t of this.listeners)t(e)};this.groups=new Sr("group",this.emit);this.roles=new Sr("role",this.emit);this.permissions=new Sr("permission",this.emit)}afterChange(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}}class br{constructor(){this.items=new Map;this.listeners=new Set}async get(e){return this.items.get(e)}async list(e){let t=Array.from(this.items.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=n!=null?r+n:void 0;return Xo(t.length,t.slice(r,o),r,n)}async children(e){return Array.from(this.items.values()).filter((t)=>(typeof t.parent==="string"?t.parent:t.parent?.id)===e)}changed(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}set(e){this.items.set(e.id,e),this.emitChange({id:e.id})}delete(e){if(!this.items.delete(e))return;this.emitChange({id:e,deleted:!0})}emitChange(e){for(let t of this.listeners)t(e)}}class Sr{constructor(e,t){this.kind=e;this.emit=t;this.items=new Map}async get(e){return this.items.get(e)}set(e){Yo(e);let t=this.items.get(e.id),r=!t||!Ya(t,e);if(this.items.set(e.id,e),r)this.emit({op:"set",kind:this.kind,entity:e,previous:t});return Sn(e,Promise.resolve())}insertIfAbsent(e){Yo(e);let t=this.items.get(e.id);if(t)return Sn(t,Promise.resolve());return this.items.set(e.id,e),this.emit({op:"set",kind:this.kind,entity:e,previous:void 0}),Sn(e,Promise.resolve())}async delete(e){let t=this.items.get(e);if(!t)return;this.items.delete(e),this.emit({op:"delete",kind:this.kind,entity:t})}async list(e){let t=Array.from(this.items.values()),r=e?.filter?.requestable;if(r!==void 0)t=t.filter((i)=>Boolean(i.requestable)===r);let n=Math.max(0,e?.start??0),o=e?.limit,s=o!=null?n+o:void 0;return Xo(t.length,t.slice(n,s),n,o)}}import{accessRefId as Ze,assertRequiredSubjectType as At}from"@ionite/core";function Qe(e,t){return`${t}:${e}`}function kn(e,t,r){return`${e}:${t}:${r}`}function Xa(e,t,r,n){return`${kn(e,t,r)}:${n??""}`}class Rr{constructor(){this.rows=new Map;this.byTriple=new Map;this.byRoot=new Map;this.bySubject=new Map;this.edgeMeta=new Map;this.disabledSubjects=new Set}async has(e,t,r,n,o){At(o);let s=Ze(e),i=Ze(r);if(!s||!i)return{allow:!1};if(this.disabledSubjects.has(Qe(s,o)))return{allow:!1,metadata:{reason:"subject_disabled"}};let c=kn(Qe(s,o),t,i),d=n?Ze(n):void 0;if(d===void 0){let h=this.byTriple.get(c);if(h&&h.size>0)return this.allow(s,o,t,i,void 0);return{allow:!1}}let u=`${c}:${d}`,l=`${c}:`;if(this.rows.has(u))return this.allow(s,o,t,i,d);if(this.rows.has(l))return this.allow(s,o,t,i,void 0);return{allow:!1}}async hasGroup(e,t,r,n){return this.has(e,"group",t,r,n)}async hasRole(e,t,r,n){return this.has(e,"role",t,r,n)}async hasPermission(e,t,r,n){return this.has(e,"permission",t,r,n)}async hasAny(e,t,r){for(let n of t){let o=await this.has(e,n.targetType,n.target,n.resource,r);if(o.allow)return o}return{allow:!1}}async hasAll(e,t,r){if(this.disabledSubjects.has(Qe(Ze(e),r)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(t.length===0)return{allow:!0};let n=[];for(let o of t){let s=await this.has(e,o.targetType,o.target,o.resource,r);if(!s.allow)return{allow:!1,matched:n};if(s.matched)n.push(...s.matched)}return{allow:!0,matched:n}}async materialize(e,t){this.removeRoot(e),this.addRootEdges(e,t)}async replaceSubject(e,t,r){let n=Qe(Ze(e),t),o=new Map;for(let s of r){At(s.subjectType,"Effective edge subjectType");let i=Qe(Ze(s.subject),s.subjectType);if(i!==n)throw Error(`AccessIndex.replaceSubject received an edge for ${i}; expected ${n}.`);let c=o.get(s.rootId);if(c)c.push(s);else o.set(s.rootId,[s])}this.clearSubjectEdges(n);for(let[s,i]of o)this.addRootEdges(s,i)}addRootEdges(e,t){let r=new Set;for(let n of t){At(n.subjectType,"Effective edge subjectType");let o=Qe(n.subject,n.subjectType),s=kn(o,n.targetType,n.target),i=Xa(o,n.targetType,n.target,n.resource);this.addToSet(this.rows,i,e),this.addToSet(this.byTriple,s,i),this.addToSet(this.bySubject,o,i),this.edgeMeta.set(i,{triple:s,subjectId:o}),r.add(i)}if(r.size>0)this.byRoot.set(e,r)}async removeByRoot(e){this.removeRoot(e)}removeRoot(e){let t=this.byRoot.get(e);if(!t)return;for(let r of t){let n=this.rows.get(r);if(!n)continue;if(n.delete(e),n.size===0)this.dropEdge(r)}this.byRoot.delete(e)}async listSubjects(){let e=[];for(let[t,r]of this.bySubject){if(r.size===0)continue;let n=t.indexOf(":");if(n<=0)throw Error(`AccessIndex subject key "${t}" is missing a subjectType prefix.`);let o=t.slice(0,n);At(o,"AccessIndex subject key subjectType"),e.push({subjectType:o,subject:t.slice(n+1)})}return e}async setSubjectDisabled(e,t,r){let n=Qe(Ze(e),t);if(r)this.disabledSubjects.add(n);else this.disabledSubjects.delete(n)}async isSubjectDisabled(e,t){return At(t),this.disabledSubjects.has(Qe(Ze(e),t))}async clear(e,t){if(e===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}At(t);let r=Ze(e);this.clearSubjectEdges(Qe(r,t))}clearSubjectEdges(e){let t=this.bySubject.get(e);if(!t)return;for(let r of[...t]){let n=this.rows.get(r);if(n)for(let o of n){let s=this.byRoot.get(o);if(s?.delete(r)&&s.size===0)this.byRoot.delete(o)}this.dropEdge(r)}}allow(e,t,r,n,o){return{allow:!0,matched:[{subject:e,subjectType:t,targetType:r,target:n,resources:o?[o]:void 0}]}}addToSet(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}dropEdge(e){this.rows.delete(e);let t=this.edgeMeta.get(e);if(t)this.removeFromSet(this.byTriple,t.triple,e),this.removeFromSet(this.bySubject,t.subjectId,e);this.edgeMeta.delete(e)}removeFromSet(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}}import{list as Za,matchesListFilter as Qa}from"@ionite/core";class Tr{constructor(){this.customers=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.customers.get(e)}async lookup(e){if(e.id){let t=this.customers.get(e.id);if(t)return t}if(e.userName){let t=this.userNameIndex.get(e.userName.toLowerCase());if(t)return this.customers.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.customers.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n={...e,id:t,createdAt:this.customers.get(t)?.createdAt??e.createdAt??r,updatedAt:r},o=this.customers.get(t);if(o){if(o.userName&&o.userName.toLowerCase()!==n.userName?.toLowerCase())this.userNameIndex.delete(o.userName.toLowerCase());if(o.externalId&&o.externalId!==n.externalId)this.externalIdIndex.delete(o.externalId)}if(this.customers.set(t,n),n.userName)this.userNameIndex.set(n.userName.toLowerCase(),t);if(n.externalId)this.externalIdIndex.set(n.externalId,t);return n}async delete(e){let t=this.customers.get(e);if(t?.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.customers.delete(e),t?1:0}async list(e){let t=Array.from(this.customers.values()).filter((c)=>Qa(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return Za(o,i,r,n)}}class Cr{constructor(){this.magicLinks=new Map}async create(e,t,r){if(this.magicLinks.has(e))throw Error(`Magic link with token ${e} already exists`);let n={token:e,customer:t,createdAt:new Date,expiresAt:r};this.magicLinks.set(e,n)}async get(e){let t=this.magicLinks.get(e);if(!t)return null;if(Date.now()>t.expiresAt.getTime())return this.magicLinks.delete(e),null;return t}async getAndDelete(e){let t=this.magicLinks.get(e);if(this.magicLinks.delete(e),!t)return null;if(Date.now()>t.expiresAt.getTime())return null;return t}async delete(e){this.magicLinks.delete(e)}}function ec(e){let t=e.expiresAt;if(!t)return;let r=t instanceof Date?t.getTime():new Date(t).getTime();return Number.isNaN(r)?void 0:r}class Ir{constructor(){this.capabilities={derivedEntitlements:!0};this.sessions=new Map}async create(e){if(this.sessions.has(e.sid))throw Error(`Session with sid ${e.sid} already exists`);this.sessions.set(e.sid,e)}async get(e){let t=this.sessions.get(e);if(!t)return null;let r=ec(t);if(r!==void 0&&Date.now()>r)return this.sessions.delete(e),null;return t}async update(e,t){let r=this.sessions.get(e);if(!r)throw Error(`Session with sid ${e} not found`);let n={...r,...t};this.sessions.set(e,n)}async delete(e){this.sessions.delete(e)}}import{list as tc,StoreConflictError as rc}from"@ionite/core";class Pr{constructor(){this.users=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.users.get(e)}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.users.get(t):void 0}async lookup(e){return this.users.get(e.id??"")}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r={...e,id:t},n=this.users.get(t),o=r.externalId?this.externalIdIndex.get(r.externalId):void 0;if(o&&o!==t)throw new rc(`externalId "${r.externalId}" is already in use`,"unique_violation","externalId");if(n){if(n.userName&&n.userName.toLowerCase()!==r.userName?.toLowerCase())this.userNameIndex.delete(n.userName.toLowerCase());if(n.externalId&&n.externalId!==r.externalId)this.externalIdIndex.delete(n.externalId)}if(this.users.set(t,r),r.userName)this.userNameIndex.set(r.userName.toLowerCase(),t);if(r.externalId)this.externalIdIndex.set(r.externalId,t);return r}async delete(e){let t=this.users.get(e);if(t){if(t.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t.externalId)this.externalIdIndex.delete(t.externalId)}return this.users.delete(e),t?1:0}async list(e){let t=Array.from(this.users.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return tc(o,i,r,n)}}class gt{constructor(){this.tokens=new Map}async set(e){this.tokens.set(e.workload_id,e)}async get(e){let t=this.tokens.get(e);if(!t)return null;if(Date.now()>t.expires_at.getTime())return this.tokens.delete(e),null;return t}async delete(e){this.tokens.delete(e)}async isValid(e){return await this.get(e)!==null}async cleanup(){let e=Date.now();for(let[t,r]of this.tokens.entries())if(e>r.expires_at.getTime())this.tokens.delete(t)}}function Fe(e){let t=Qo(e||Rn);return{readyzUrl:`${t}/readyz`,capabilitiezUrl:`${t}/capabilitiez`,sso:{loginUrl:`${t}/auth/login`,userUrl:`${t}/auth/user`,logoutUrl:`${t}/auth/logout`,logoutBackChannelUrl:`${t}/auth/logout/backchannel`,refreshUrl:`${t}/auth/refresh`,callbackUrl:`${t}/auth/callback`},workload:{validateUrl:`${t}/workload/validate`,jwksUrl:`${t}/workload/jwks`},iam:{basePath:`${t}/iam`,usersUrl:`${t}/iam/Users`,groupsUrl:`${t}/iam/Groups`,workloadsUrl:`${t}/iam/Workloads`,customersUrl:`${t}/iam/Customers`},ciam:{magicLinkUrl:`${t}/magic-link`,magicLinkLoginUrl:`${t}/magic-link/login`,customerUrl:`${t}/auth/customer`,customerLoginUrl:`${t}/auth/customer/login`,customerCallbackUrl:`${t}/auth/customer/callback`,customerProvidersUrl:`${t}/auth/customer/providers`,logoutUrl:`${t}/auth/customer/logout`}}}function es(e){return`${Qo(e||Rn)}/authz/oaa/sync`}function nc(e,t){if(e===null)return null;let r={validateUrl:t.validateUrl,jwksUrl:t.jwksUrl};if(e&&typeof e==="object"&&(("incoming"in e)||("outgoing"in e))){let n=e;return{...n,incoming:{...n.incoming,...r}}}return{...e??{},...r}}function ts(e,t,r,n){let o={...t},s=Fe(n);if(o.sso!==null)if(e.sso)o.sso={...o.sso,loginUrl:s.sso.loginUrl,userUrl:s.sso.userUrl,logoutUrl:s.sso.logoutUrl,logoutBackChannelUrl:s.sso.logoutBackChannelUrl,refreshUrl:s.sso.refreshUrl,redirectUri:s.sso.callbackUrl,sessionStore:r.sessionStore??o.sso?.sessionStore,userStore:r.userStore??o.sso?.userStore,enableJitUserProvisioning:o.sso?.enableJitUserProvisioning??!0};else o.sso=void 0;if(o.iam!==null)if(e.iam)o.iam={...o.iam,usersUrl:s.iam.usersUrl,groupsUrl:s.iam.groupsUrl,workloadsUrl:s.iam.workloadsUrl,customersUrl:s.iam.customersUrl,userStore:r.userStore??o.iam?.userStore,workloadIdentityStore:r.workloadIdentityStore??o.iam?.workloadIdentityStore,customerStore:r.customerStore??o.iam?.customerStore};else o.iam=void 0;if(o.workload!==null){if(e.workload||o.workload)o.workload=nc(o.workload,s.workload)}if(o.ciam!==null)if(e.ciam)o.ciam={...o.ciam,magicLinkUrl:s.ciam.magicLinkUrl,magicLinkLoginUrl:s.ciam.magicLinkLoginUrl,customerUrl:s.ciam.customerUrl,customerLoginUrl:s.ciam.customerLoginUrl,customerCallbackUrl:s.ciam.customerCallbackUrl,customerProvidersUrl:s.ciam.customerProvidersUrl,logoutUrl:s.ciam.logoutUrl,providers:e.ciam.providers,sessionStore:r.sessionStore??o.ciam?.sessionStore,customerStore:r.customerStore??o.ciam?.customerStore,magicLinkStore:r.magicLinkStore??o.ciam?.magicLinkStore,enableJitUserProvisioning:o.ciam?.enableJitUserProvisioning??!0};else o.ciam=void 0;return o}function Zt(e,t){let r={...e};if(r.sso)r.sso={...r.sso,sessionStore:t.sessionStore??r.sso.sessionStore,userStore:t.userStore??r.sso.userStore};if(r.iam)r.iam={...r.iam,userStore:t.userStore??r.iam.userStore};if(r.workload){let n=r.workload;r.workload={...r.workload,tokenStore:t.workloadTokenStore??n.tokenStore,workloadIdentityStore:t.workloadIdentityStore??n.workloadIdentityStore}}if(r.ciam)r.ciam={...r.ciam,sessionStore:t.sessionStore??r.ciam.sessionStore,customerStore:t.customerStore??r.ciam.customerStore,magicLinkStore:t.magicLinkStore??r.ciam.magicLinkStore};if(r.authz!==null&&(t.accessStore||t.accessIndex||t.catalog||t.catalogStore||t.resources)){let n=r.authz;r.authz={...n,accessStore:t.accessStore??n?.accessStore,accessIndex:t.accessIndex??n?.accessIndex,catalog:t.catalog??n?.catalog,catalogStore:t.catalogStore??n?.catalogStore,resources:t.resources??n?.resources}}return r}var Rn="/api/ionite";function Or(e){return{...e}}function oc(){return{sessionStore:new Ir,userStore:new Pr,customerStore:new Tr,magicLinkStore:new Cr,workloadTokenStore:new gt}}function bn(){return{catalogStore:new kr,accessStore:new De,accessIndex:new Rr,resources:new br}}function sc(){let e=bn(),t=new Map;return(r)=>{if(!r)return e;let n=t.get(r);if(!n)n=bn(),t.set(r,n);return n}}function Zo(e,t){return`${e} is enabled by RemoteConfig but is not served: missing ${t.join(", ")}. Provide durable stores in ionite({ stores }) (e.g. @ionite/redis or app-owned SQL stores), or opt into stores: devInMemoryStores() for prototypes only (state is lost on restart).`}function Tn(e){let t={};if(e.sso&&!e.sso.sessionStore)t.sso=Zo("SSO",["stores.sessionStore"]);if(e.ciam){let r=[];if(!e.ciam.sessionStore)r.push("stores.sessionStore");if(!e.ciam.customerStore)r.push("stores.customerStore");if(r.length>0)t.ciam=Zo("CIAM",r)}return t}function Er(){return Rn}import{AssignmentPolicyError as rr,accessRefId as pt,accessRootId as Ln,assertRequiredSubjectType as Mr,catalogEntityStore as $c,configTrustedClientGrants as Nc,deepEqualPlain as Dc,deprecateRetiredCodeCatalogRows as Kc,getCodeCatalogEntity as Vc,list as Ts,listGenerator as xn,materializeCodeCatalogEntity as Fc,toCodeCatalog as zc,unionCatalogRead as Cs}from"@ionite/core";import{assertSubjectTypeAssignable as Bc,CatalogAdjacencyCache as Gc,expandRoot as Is,reconcileSubjectAccess as Hc}from"@ionite/core/server";var rs=Symbol("ionite.describe.overlay");function ve(e){if(Array.isArray(e))return e.map((t)=>ve(t));if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,ve(r)]))}function ns(e,t,r,n){return ve({...e,...n,active:t.active,ready:t.ready,...r?{urls:r}:{}})}function os(e){return e[rs]}function ze(e,t,r,n){if(!e)return;let o=os(e)??{base:e.describe.bind(e)};o.urls=r,o.extra=n,Object.defineProperty(e,rs,{value:o,enumerable:!1,configurable:!0}),Object.defineProperty(e,"describe",{value:()=>ns(o.base(),t(),o.urls,o.extra?.()),enumerable:!1,configurable:!0})}function Be(e,t){if(!e)return;let r=os(e);return r?ns(r.base(),t,r.urls,r.extra?.()):ve(e.describe())}import{ACCEPT_JSON as us,accessRefId as Oe,accessRootId as ic,CONTENT_TYPE_JSON as ds,customAttributes as Qt,DEFAULT_RISK_LEVEL as On,ION_AUTHZ_GROUP_SCHEMA as ac,ION_SCIM_USER_EXTENSION_URN as ss,KNOWN_ENTITLEMENT_KEYS as er,mergeCodeCatalogEntity as cc}from"@ionite/core";import{baseCustomerToScim as uc,baseUserToScimUser as dc,baseWorkloadToScim as lc,collectReferencedDefinitions as fc}from"@ionite/core/server";function me(e,t,r=(n)=>Error(`${e} ready timed out after ${n}ms`)){let n=!1,o,s,i=()=>{n=!1,s=new Promise((u)=>{o=u})};i();let c=()=>{n=!0,o?.(),o=void 0},d=()=>{if(t()){if(!n)c();return}if(n)i()};return d(),{isReady:()=>t(),ready:(u)=>{if(t())return Promise.resolve();let l=s;if(!u||u<=0)return l;return new Promise((h,p)=>{let k=setTimeout(()=>p(r(u)),u);l.then(()=>{clearTimeout(k),h()},(q)=>{clearTimeout(k),p(q)})})},refresh:d,settle:c}}var ls="App",pc="ionite",fs=104857600,mc=fs,gc=10485760,Cn=3,yc=250,hc={};function ft(e,t){return t.mapGroup?t.mapGroup(e):e}class Ge extends Error{constructor(e,t={}){super(e,{cause:t.cause});this.name="OaaError",this.retryable=t.retryable??!1,this.code=t.code,this.status=t.status,this.warnings=t.warnings,Object.setPrototypeOf(this,Ge.prototype)}}function wc(e){let t=e();return Boolean(t?.url&&t.providerId&&t.datasourceId)}function ps(e,t,r,n=()=>({}),o=()=>{return},s,i){let c=async(u)=>{await cs(e,be(t),u,{mode:"incremental"})},d=me("OAA",()=>wc(t),(u)=>new Ge(`OAA ready timed out after ${u}ms`,{code:"not_ready"}));return{describe:()=>{let u=t();return ve({ready:d.isReady(),url:u?.url,providerId:u?.providerId,datasourceId:u?.datasourceId,applicationName:u?.applicationName,applicationType:u?.applicationType,population:{users:Lt(u,"user"),customers:Lt(u,"customer"),workloads:Lt(u,"workload")},fullSync:u?.fullSync?.enabled===!0})},isReady:d.isReady,ready:d.ready,refreshReadiness:d.refresh,population(u){return Lt(t(),u)},async pushUser(u){let l=be(t);if(!await In(l,"user",Oe(u),o()))return;let h=await gs(u,n());await c(Ie(l,{local_users:[xt(h,"user","modify")]},!0))},async pushCustomer(u){let l=be(t);if(!await In(l,"customer",Oe(u),o()))return;let h=await ys(u,n());await c(Ie(l,{local_users:[xt(h,"customer","modify")]},!0))},async pushWorkload(u){let l=be(t);if(!await In(l,"workload",Oe(u),o()))return;let h=await hs(u,n());await c(Ie(l,{local_users:[xt(h,"workload","modify")]},!0))},async pushGroup(u){let l=be(t),h=r(),p=ft(u,h),k=Lr(p,lt(l),"add"),q=await Pn(p,"group",i?.(),h,l);await c(Ie(l,tr({local_groups:[yt(p,"modify")],identity_to_permissions:k?[k]:[]},q),!0))},async pushRole(u){let l=be(t),h=r(),p=h.mapRole?h.mapRole(u):u,k=await Pn(p,"role",i?.(),h,l);await c(Ie(l,tr({local_roles:[ht(p,"modify")]},k),!0))},async pushPermission(u){let l=be(t);await c(Ie(l,{permissions:[Ut(u,r().mapPermissionTypes,"modify")]},!0))},async pushResource(u){let l=be(t),h=r(),p=h.mapResource?h.mapResource(u):u,k=await Ic(p,i?.(),h);await c(Ie(l,{resources:k},!0))},async grant(u){let l=be(t),h=r(),p=await ms(u,i?.(),h,l);await c(is(l,u,"add",h,p))},async revoke(u){let l=be(t);await c(is(l,u,"delete",r()))},async pushAccessChanges(u){if(u.length===0)return;let l=be(t),h=r(),p=i?.(),k=await Sc(l,u,h,p);await c(k)},async deleteUser(u){let l=be(t);await c(Ie(l,{local_users:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deleteCustomer(u){let l=be(t);await c(Ie(l,{local_users:[as(u,"customer")]},!0))},async deleteWorkload(u){let l=be(t);await c(Ie(l,{local_users:[as(u,"workload")]},!0))},async deleteGroup(u){let l=be(t);await c(Ie(l,{local_groups:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deleteRole(u){let l=be(t);await c(Ie(l,{local_roles:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deletePermission(u){let l=be(t);await c(Ie(l,{permissions:[{name:u,unique_id:u,permission_type:[],operation:"delete"}]},!0))},async deleteResource(u){let l=be(t);await c(Ie(l,{resources:[{name:u,id:u,resource_type:"",operation:"delete"}]},!0))},async sync(u,l){let h=be(t),p=l?.mode==="incremental",k=p?void 0:s?.(),q=await vc(h,u,r(),n(),p,k);return cs(e,h,q,l)}}}function be(e){let t=e();if(!t?.url||!t.providerId||!t.datasourceId)throw new Ge("OAA is not configured",{code:"not_configured"});return t}async function vc(e,t,r,n,o,s){let i=[],c=[],d=[],u=[],l=[],h=[],p=o?"modify":void 0,k=new Set,q=[],_=new Set,b=(a)=>ic(a);for await(let a of dt(t.access))q.push(a),_.add(`${a.subjectType}:${Oe(a.subject)}`);let j=(a,w)=>Lt(e,a)==="all"||Boolean(w&&_.has(`${a}:${w}`));for await(let a of dt(t.users))if(j("user",Oe(a)))i.push(xt(await gs(a,n),"user",p));for await(let a of dt(t.customers))if(j("customer",Oe(a)))i.push(xt(await ys(a,n),"customer",p));for await(let a of dt(t.workloads))if(j("workload",Oe(a)))i.push(xt(await hs(a,n),"workload",p));for await(let a of dt(t.groups)){let w=ft(a,r);c.push(yt(w,p));let S=Lr(w,lt(e),o?"add":void 0);if(S)h.push(S)}for await(let a of dt(t.roles)){let w=r.mapRole?r.mapRole(a):a;l.push(ht(w,p))}for await(let a of dt(t.permissions))u.push(Ut(a,r.mapPermissionTypes,p));let U=[];for await(let a of dt(t.resources)){let w=r.mapResource?r.mapResource(a):a;U.push(w)}d.push(...vs(U,p));for(let a of q)if(k.add(b(a)),_r(a,h,i,lt(e),o?"add":void 0),typeof a.target!=="string")if(a.targetType==="role"){let w=r.mapRole?r.mapRole(a.target):a.target;l.push(ht(w,p))}else if(a.targetType==="permission")u.push(Ut(a.target,r.mapPermissionTypes,p));else{let w=ft(a.target,r);c.push(yt(w,p))}for(let a of s??[]){let w=b(a);if(k.has(w))continue;k.add(w);let S=Oe(a.subject);if(S&&!i.some((M)=>Oe(M.unique_id??M.name)===S))i.push({name:S,unique_id:S,is_active:!0,operation:p,custom_properties:{identity_type:"workload",source:"eci-trusted"}});_r(a,h,i,lt(e),p)}return Ie(e,{local_users:i,local_groups:c,local_roles:l,resources:d,permissions:u,identity_to_permissions:h},o)}function Ie(e,t,r){let n={name:e.applicationName??ls,application_type:e.applicationType??pc,local_users:t.local_users??[],local_groups:t.local_groups??[],local_roles:t.local_roles??[],resources:t.resources??[],custom_properties:{},tags:[]};if(r)n.operation="modify";return Ae({applications:[n],permissions:t.permissions??[],identity_to_permissions:t.identity_to_permissions??[],is_incremental:r?!0:void 0})}function is(e,t,r,n=hc,o){let s=[],i=[],c=[],d=[],u=[];_r(t,s,i,lt(e),r);let l=r==="delete"?"delete":"modify";if(typeof t.target!=="string")if(t.targetType==="role"){let p=n.mapRole?n.mapRole(t.target):t.target;d.push(ht(p,l))}else if(t.targetType==="permission")u.push(Ut(t.target,n.mapPermissionTypes,l));else{let p=ft(t.target,n);c.push(yt(p,l))}let h={local_users:i,local_groups:c,local_roles:d,permissions:u,identity_to_permissions:s};return Ie(e,o?tr(h,o):h,!0)}async function Sc(e,t,r,n){let o=lt(e),s=[],i=[],c=[],d=[],u=[],l=[],h=[],p=[];for(let{change:q,op:_}of t){_r(q,_==="delete"?d:i,_==="delete"?c:s,o,_==="delete"?"delete":"add");let a=_==="delete"?"delete":"modify";if(typeof q.target!=="string")if(q.targetType==="role"){let w=r.mapRole?r.mapRole(q.target):q.target;l.push(ht(w,a))}else if(q.targetType==="permission")h.push(Ut(q.target,r.mapPermissionTypes,a));else{let w=ft(q.target,r);u.push(yt(w,a))}if(_==="add")p.push(await ms(q,n,r,e))}let k={local_users:[...s,...c],local_groups:u,local_roles:l,permissions:h,identity_to_permissions:[...i,...d]};return Ie(e,tr(k,...p),!0)}function tr(...e){let t={},r=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let n of e)for(let o of r){let s=n[o];if(s&&s.length>0)t[o]=[...t[o]??[],...s]}return t}async function Pn(e,t,r,n,o){if(!r)return{};let s=await fc(e,t,{catalog:r.catalog,code:r.code,resources:r.resources,cache:r.cache}),i=[];for(let c of s.groups){let d=ft(c,n),u=Lr(d,lt(o),"add");if(u)i.push(u)}return{local_groups:s.groups.map((c)=>yt(ft(c,n),"modify")),local_roles:s.roles.map((c)=>ht(n.mapRole?n.mapRole(c):c,"modify")),permissions:s.permissions.map((c)=>Ut(c,n.mapPermissionTypes,"modify")),resources:s.resources.map((c)=>xr(n.mapResource?n.mapResource(c):c,"modify")),identity_to_permissions:i}}async function ms(e,t,r,n){if(!t)return{};if(e.targetType!=="group"&&e.targetType!=="role")return{};let o=Oe(e.target);if(!o)return{};let s=typeof e.target==="string"?await kc(e.targetType,o,t):e.target;if(!s)return{};let i={};if(typeof e.target==="string")if(e.targetType==="group"){let d=ft(s,r),u=Lr(d,lt(n),"add");i={local_groups:[yt(d,"modify")],identity_to_permissions:u?[u]:[]}}else{let d=r.mapRole?r.mapRole(s):s;i={local_roles:[ht(d,"modify")]}}let c=await Pn(s,e.targetType,t,r,n);return tr(i,c)}async function kc(e,t,r){if(r.cache)return await r.cache.getNode(e,t);let n=e==="group"?r.code?.groups.get(t):r.code?.roles.get(t),s=await(e==="group"?r.catalog?.groups:r.catalog?.roles)?.get(t);return s&&n?cc(e,n,s):s??n}function _r(e,t,r,n,o){let s=Oe(e.subject),i=Oe(e.target),c=r.find((h)=>Oe(h.unique_id??h.name)===s);if(e.subjectType!=="user")if(c)c.custom_properties={...c.custom_properties,identity_type:e.subjectType};else c={name:s,unique_id:s,custom_properties:{identity_type:e.subjectType},operation:o},r.push(c);if(e.targetType==="group"){if(c){let h=new Set(c.groups??[]);if(h.add(i),c.groups=[...h],o)c.operation=o}else r.push({name:s,unique_id:s,groups:[i],operation:o});return}let d={identity:s,identity_type:"local_user",operation:o},u=e.resources??[],l=e.applyToApplication??u.length===0;if(e.targetType==="role")d.role_assignments=[{application:n,role:i,apply_to_application:l,resources:u,operation:o}];else d.application_permissions=[{application:n,permission:i,apply_to_application:l,resources:u,operation:o}];t.push(d)}async function gs(e,t){let r=await(t.mapUserToScim?.(e)??dc(e));return{...r,id:r.id??e.id}}async function ys(e,t){let r=await(t.mapCustomerToScim?.(e)??uc(e));return{...r,id:r.id??e.id}}async function hs(e,t){let r=await(t.mapWorkloadToScim?.(e)??lc(e));return{...r,id:r.id??e.id}}function xt(e,t,r){let{schemas:n,id:o,displayName:s,userName:i,active:c,emails:d,groups:u,meta:l,attributes:h,...p}=e,k=p[ss];delete p[ss];let q=k&&typeof k==="object"?k.attributes:void 0,_=t==="user"?q:h,b=_t(o)??_t(e.externalId)??_t(i)??"principal";return Ae({name:_t(s)??_t(i)??b,unique_id:b,identities:t==="customer"?void 0:bc(e),groups:t==="user"&&Array.isArray(u)?u.map((j)=>typeof j==="string"?j:ge(j,"value")).filter((j)=>Boolean(j)):void 0,is_active:typeof c==="boolean"?c:void 0,created_at:l&&typeof l==="object"?ge(l,"created"):void 0,custom_properties:Ae({...p,..._&&typeof _==="object"?_:{},ecid:t==="customer"?void 0:ws(e),accountClass:Rc(e),externalId:e.externalId,userName:i,emails:d,identity_type:t==="user"?void 0:t}),tags:[],operation:r})}function bc(e){let t=ws(e),r=e.emails,n=Array.isArray(r)?r.map((s)=>s&&typeof s==="object"?ge(s,"value"):void 0).filter((s)=>Boolean(s)):[],o=[...t?[t]:[],...n];return o.length>0?o:void 0}function ws(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return _t(e.ecid)??(t&&typeof t==="object"?ge(t,"ecid"):void 0)}function Rc(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return t&&typeof t==="object"?ge(t,"accountClass"):void 0}function as(e,t){return{name:e,unique_id:e,custom_properties:{identity_type:t},operation:"delete"}}function yt(e,t){let r=Tc(e),n=ge(e,"id")??ge(e,"name")??ge(e,"displayName"),o=ge(e,"displayName")??ge(e,"name")??n??"group",s=Ar(e,"resources");return Ae({name:o,unique_id:n,custom_properties:Ae({...r?.attributes??Qt(e,er),requestable:r?.requestable??Wc(e,"requestable"),description:r?.description??ge(e,"description"),type:r?.type,resources:s.length>0?s:void 0,riskLevel:r?.riskLevel??ge(e,"riskLevel")??On}),tags:[],operation:t})}function Tc(e){let t=e[ac];if(!t||typeof t!=="object"||Array.isArray(t))return;return t}function Ar(e,t){if(!e||typeof e!=="object")return[];let r=e[t];if(!Array.isArray(r))return[];return r.map(Oe).filter((n)=>n.length>0)}function Cc(e){return ge(e,"id")??ge(e,"name")??ge(e,"displayName")??"group"}function Lr(e,t,r){let n=Ar(e,"resources"),o=n.length>0,s=!o,i=o?n:[],c=Ar(e,"roles").map((u)=>({application:t,role:u,apply_to_application:s,resources:i,operation:r})),d=Ar(e,"permissions").map((u)=>({application:t,permission:u,apply_to_application:s,resources:i,operation:r}));if(c.length===0&&d.length===0)return;return{identity:Cc(e),identity_type:"local_group",role_assignments:c.length>0?c:void 0,application_permissions:d.length>0?d:void 0,operation:r}}function ht(e,t){return Ae({name:e.name,unique_id:e.id,permissions:e.permissions?.map((r)=>typeof r==="string"?r:r.id),custom_properties:Ae({...Qt(e,er),displayName:e.displayName,requestable:e.requestable,riskLevel:e.riskLevel??On}),tags:[],operation:t})}function Ut(e,t,r){return Ae({name:e.name,unique_id:e.id,permission_type:t?.(e)??e.permissionTypes??[e.action??"Uncategorized"],apply_to_sub_resources:e.applyToSubResources,resource_types:e.resourceTypes,custom_properties:{...Qt(e,er),riskLevel:e.riskLevel??On},operation:r})}function xr(e,t,r,n=new Set){let o=e.id;if(o&&n.has(o))return Ae({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,custom_properties:Ae({...Qt(e,er)}),tags:[],operation:t});if(o)n.add(o);let s=[];for(let i of e.resources??[]){let c=typeof i==="string"?r?.get(i):i;if(c)s.push(xr(c,t,r,n))}if(o)n.delete(o);return Ae({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,sub_resources:s.length>0?s:void 0,custom_properties:Ae({...Qt(e,er)}),tags:[],operation:t})}function vs(e,t){if(e.length===0)return[];let r=new Map;for(let d of e)if(d.id)r.set(d.id,d);let n=new Map,o=new Set,s=(d,u)=>{if(!u.id||u.id===d)return;let l=n.get(d)??[];if(!l.some((h)=>h.id===u.id))l.push(u);n.set(d,l),o.add(u.id)};for(let d of e){for(let l of d.resources??[]){let h=typeof l==="string"?r.get(l):l;if(h&&d.id)s(d.id,h)}let u=Oe(d.parent);if(u&&r.has(u)&&d.id)s(u,d)}let i=(d)=>{if(!d.id)return d;let u=n.get(d.id);if(!u||u.length===0)return d;return{...d,resources:u.map(i)}};return e.filter((d)=>!d.id||!o.has(d.id)).map(i).map((d)=>xr(d,t,r))}async function Ic(e,t,r){if(!t)return[xr(e,"modify")];let n=async(l)=>{if(t.cache)return await t.cache.getNode("resource",l);return t.resources?.get(l)},o=async(l)=>{if(t.resources?.children&&l.id&&(!l.resources||l.resources.length===0))return t.resources.children(l.id);let h=[];for(let p of l.resources??[]){let k=typeof p==="string"?await n(p):p;if(k)h.push(k)}return h},s=e,i=new Set;while(!0){let l=Oe(s.parent);if(!l||i.has(l))break;i.add(l);let h=await n(l);if(!h)break;s=h}let c=[],d=[s],u=new Set;while(d.length>0){let l=d.shift();if(!l)break;if(l.id&&u.has(l.id))continue;if(l.id)u.add(l.id);let h=r.mapResource?r.mapResource(l):l;c.push(h);for(let p of await o(l))d.push(p)}if(e.id&&!u.has(e.id))c.push(r.mapResource?r.mapResource(e):e);return vs(c,"modify")}async function cs(e,t,r,n){let o=JSON.stringify(Ae(r)),s=n?.compression??t.compression??"gzip",i=s==="gzip"?await xc(o):o,c=Mc(i),d=n?.maxPayloadBytes??t.maxPayloadBytes??fs,u=n?.multipart??t.multipart??"auto",l=n?.multipartThresholdBytes??t.multipartThresholdBytes??mc;if(c>d&&u==="never")throw new Ge("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(u==="always"||u==="auto"&&c>l)return Oc(e,t,i,s,n);return Pc(t,{id:t.datasourceId,data_source_id:t.datasourceId,json_data:i,compression_type:s==="gzip"?"GZIP":"NONE"})}async function Pc(e,t){let r=`${Rs(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:push`,n=await Ur(r,{method:"POST",headers:{...us,Authorization:`Bearer ${e.apiKey??""}`,...ds},body:JSON.stringify(t)});return ks(n)}async function Oc(e,t,r,n,o){let s=o?.partSizeBytes??t.partSizeBytes??gc,i=await Ec(t,n),c=Uc(r,s);for(let u=0;u<c.length;u++)await Ac(t,i,u+1,c[u]??"");let d=await _c(t,i,c.length);return e.debug("OAA multipart payload pushed",{uploadId:i,parts:c.length}),{...d,uploadId:d.uploadId??i,parts:d.parts??c.length}}async function Ec(e,t){let r=En(e,"multipart/start"),n=await Ur(r,{method:"POST",headers:An(e),body:JSON.stringify({data_source_id:e.datasourceId,compression_type:t==="gzip"?"GZIP":"NONE"})}),o=await _n(n),s=ge(o,"upload_id")??ge(o,"uploadId")??ge(o,"id");if(!s)throw new Ge("OAA multipart start response did not include an upload id",{code:"invalid_response"});return s}async function Ac(e,t,r,n){let o=En(e,`multipart/${encodeURIComponent(t)}/parts/${r}`);await Ur(o,{method:"PUT",headers:An(e),body:JSON.stringify({upload_id:t,sequence:r,data:n})})}async function _c(e,t,r){let n=En(e,`multipart/${encodeURIComponent(t)}/complete`),o=await Ur(n,{method:"POST",headers:An(e),body:JSON.stringify({upload_id:t,parts:r})});return ks(o)}function En(e,t){return`${Rs(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:${t}`}function An(e){return{...us,Authorization:`Bearer ${e.apiKey??""}`,...ds}}async function Ur(e,t){let r;for(let n=0;n<Cn;n++){try{let o=await fetch(e,t);if(!Ss(o.status)||n===Cn-1){if(!o.ok)await Lc(o);return o}r=new Ge(`OAA request failed with retryable status ${o.status}`,{retryable:!0,status:o.status})}catch(o){if(r=o,o instanceof Ge&&!o.retryable)throw o;if(n===Cn-1)break}await jc(yc*2**n)}throw new Ge("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:r})}function Ss(e){return e===429||e>=500}async function Lc(e){let t=await _n(e).catch(()=>{return}),r=ge(t,"message")??ge(t,"error")??`OAA request failed with status ${e.status}`;throw new Ge(r,{code:ge(t,"code")??"http_error",status:e.status,retryable:Ss(e.status),warnings:bs(t?.warnings)})}async function ks(e){let t=await _n(e).catch(()=>{return});return{success:e.ok,syncToken:ge(t,"sync_token")??ge(t,"syncToken"),uploadId:ge(t,"upload_id")??ge(t,"uploadId"),parts:qc(t,"parts"),warnings:bs(t?.warnings),metadata:t}}async function _n(e){let t=await e.text();if(!t)return{};let r=JSON.parse(t);return r&&typeof r==="object"&&!Array.isArray(r)?r:{}}async function xc(e){let t=new Blob([e]).stream().pipeThrough(new CompressionStream("gzip")),r=await new Response(t).arrayBuffer();return Buffer.from(r).toString("base64")}function Uc(e,t){let r=[];for(let n=0;n<e.length;n+=t)r.push(e.slice(n,n+t));return r}function Mc(e){return Buffer.byteLength(e,"utf8")}function ge(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="string"&&r.length>0?r:void 0}function _t(e){return typeof e==="string"&&e.length>0?e:void 0}function Wc(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="boolean"?r:void 0}function qc(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="number"?r:void 0}function bs(e){if(!Array.isArray(e))return;let t=e.filter((r)=>typeof r==="string");return t.length>0?t:void 0}async function*dt(e){if(!e)return;for await(let t of e)yield t}function Ae(e){if(Array.isArray(e))return e.map(Ae).filter((r)=>r!==void 0);if(!e||typeof e!=="object"||e instanceof Date)return e===null?void 0:e;let t=Object.entries(e).map(([r,n])=>[r,Ae(n)]).filter(([,r])=>{if(r===void 0)return!1;if(Array.isArray(r)&&r.length===0)return!1;if(r&&typeof r==="object"&&!Array.isArray(r)&&Object.keys(r).length===0)return!1;return!0});return t.length>0?Object.fromEntries(t):void 0}function Rs(e){return e.replace(/\/+$/,"")}function lt(e){return e.applicationName??ls}function Lt(e,t){if(t==="user")return e?.users?.population??"all";if(t==="customer")return e?.customers?.population??"access";return e?.workloads?.population??"access"}async function In(e,t,r,n){if(Lt(e,t)==="all")return!0;if(!n||!r)return!1;return(await n.listBySubject(r,t,{start:0,limit:1})).items.length>0}function jc(e){return new Promise((t)=>setTimeout(t,e))}function Un(e,t){if(!t)return"app";if(e==="user")return t.users.assignment;if(e==="workload")return t.workloads.assignment;return t.customers.assignment}function Ps(e,t=()=>{return},r=()=>{return},n=()=>{return},o=()=>({})){let s,i=!1,c=(T,g,P)=>{let I=r();if(!I)throw Error("Cannot use AccessRequests: no destination channels are configured.");if(T==="iam-request"){let O=I.channel("iam");if(!O)throw Error("Cannot use AccessRequests: the IAM destination is not configured.");return O}if(T!=="idp")throw new rr(`Cannot use AccessRequests for a "${g}" principal: RemoteConfig assignment policy is "${T}".`,T);if(g==="user"){let O=I.channel("sso");if(!O)throw Error("Cannot use AccessRequests: the SSO destination is not configured.");return O}if(g==="workload")throw new rr('Cannot use AccessRequests with assignment policy "idp" for workloads.',T);let R=I.ciamProviders(),W=P??(R.length===1?R[0]:void 0);if(!W)throw Error(R.length===0?"Cannot use AccessRequests: no CIAM provider destination is configured.":"Cannot use AccessRequests: provider is required when multiple CIAM provider destinations are configured.");let y=I.channel(`ciam:${W}`);if(!y)throw Error(`Cannot use AccessRequests: CIAM provider "${W}" is not configured.`);return y},d,u,l=ps(e,()=>s?.oaa,()=>({mapPermissionTypes:s?.mapPermissionTypes,mapGroup:s?.mapGroup,mapRole:s?.mapRole,mapResource:s?.mapResource}),o,()=>s?.accessStore,()=>Nc(s),()=>h());function h(){let T=s?.catalogStore;return T||d?{catalog:T,code:d,resources:s?.resources,cache:u}:void 0}let p=(T)=>{if(T.op!=="set"||!T.previous)return!1;if(!(T.previous.providerId!==T.entity.providerId||T.previous.requestUrl!==T.entity.requestUrl))return!1;let{providerId:P,requestUrl:I,...R}=T.previous,{providerId:W,requestUrl:y,...O}=T.entity;return Dc(R,O)},k=(T)=>{if(i)return;let{kind:g}=T;if(l.isReady())(T.op==="delete"?g==="role"?l.deleteRole(T.entity.id):g==="permission"?l.deletePermission(T.entity.id):l.deleteGroup(T.entity.id):g==="role"?l.pushRole(T.entity):g==="permission"?l.pushPermission(T.entity):l.pushGroup(T.entity)).catch((W)=>{e.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:T.op,kind:g,error:W})});let P=t();if(!P?.isReady())return;if(T.op==="set"&&T.entity.requestable!==!0){if(T.previous?.requestable===!0)P.onEntitlementDelete(g,T.previous.id).catch((R)=>{e.warn("IAM delta removal of a no-longer-requestable entitlement failed",{"ion.operation":"iam.delta.delete","ion.outcome":"degraded",id:T.entity.id,kind:g,error:R instanceof Error?R.message:String(R)})});return}(T.op==="delete"?P.onEntitlementDelete(g,T.entity.id):P.onEntitlementUpsert(T.entity,g)).catch((R)=>{e.warn("IAM delta projection from catalog change failed; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:T.op,kind:g,error:R instanceof Error?R.message:String(R)})})},q=(T)=>{if(i)return;let g=s?.resources;if(!g)return;if(l.isReady())(async()=>{if(T.deleted){await l.deleteResource(T.id);return}let I=await g.get(T.id);if(!I)return;await l.pushResource(I)})().catch((I)=>{e.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:T.id,deleted:T.deleted===!0,error:I})})},_,b,j,U,a=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),w=!1,S=()=>{let T=s?.accessIndex;if(!T&&!w)w=!0,e.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return T},M=async(T)=>{let g=s?.accessIndex,P=s?.catalogStore;if(!g||!P&&!d)return!1;let I=T.id??Ln(T),R=await Is({...T,id:I},{catalog:P,code:d,resources:s?.resources,cache:u});return await g.materialize(I,R),!0},F=(T,g)=>Hc(T,g,{accessStore:s?.accessStore,accessIndex:s?.accessIndex,catalogStore:s?.catalogStore,code:d,resources:s?.resources},u),Z=async()=>{let T=s?.catalogStore;if(!T)return;await Kc(d,T)},Y=async()=>{let T={subjects:0,roots:0,cleared:0};if(i)return T;await Z();let g=s?.accessIndex,P=s?.catalogStore;if(!g||!P&&!d)return T;let I=new Map,R=(O)=>{let L=pt(O.subject);if(!L)return;let C=O.subjectType;I.set(`${C}:${L}`,{subject:L,subjectType:C})},W=new Set,y=s?.accessStore;if(y)for await(let O of xn((L,C)=>y.list({start:L,limit:C}))){R({subject:pt(O.subject),subjectType:O.subjectType});let L=pt(O.target);if(u&&L&&typeof O.target==="string"){if(!await u.getNode(O.targetType,L))W.add(`${O.targetType}:${L}`)}}if(W.size>0)e.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog or catalog store). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...W].sort()});if(g.listSubjects)for(let O of await g.listSubjects())R(O);for(let O of I.values()){let L=await F(O.subject,O.subjectType);if(T.subjects+=1,T.roots+=L,L===0)T.cleared+=1}return T},ee=()=>{if(i)return Promise.resolve({subjects:0,roots:0,cleared:0});return Y()},ae=Promise.resolve(),oe=!1,K=(T,g)=>{let P=ae.then(async()=>{if(i)return;try{await g()}catch(I){e.warn(`${T} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:T,error:I instanceof Error?I.message:String(I)})}});return ae=P,P},Q=(T)=>{if(oe)return;oe=!0,K(T,async()=>{oe=!1,await Y()})},V=()=>ae,D=(T)=>{if(i)return;let g=s?.accessStore;if(!s?.accessIndex||!s?.catalogStore||!g)return;if(u?.invalidate(T),T.op==="set"){let P=T.kind,I=T.entity.id;K("catalog-change",async()=>{for await(let R of xn((W,y)=>g.listByTarget(P,I,{start:W,limit:y})))await M(R)})}else Q("catalog-delete")},te=(T)=>{if(i)return;if(u?.clear(),!s?.accessIndex||!s?.catalogStore&&!d||!s?.accessStore)return;Q("resource-change")},re={describe:()=>ve({module:"authz",active:s!==void 0,ready:s!==void 0,trustedProvisioningClients:(s?.trustedProvisioningClients??[]).map((T)=>({issuer:T.issuer,audience:T.audience,clientId:T.clientId,permissions:[...T.permissions]})),oaa:s?.oaa?l.describe():void 0,inboundEntitlements:s?.onInboundEntitlement!==void 0,stores:{accessStore:s?.accessStore!==void 0,accessIndex:s?.accessIndex!==void 0,catalogStore:s?.catalogStore!==void 0,resources:s?.resources!==void 0}}),oaa:l,entitlements:{async list(T){let g=Cs(d,s?.catalogStore),P=Math.max(0,T?.start??0),I=T?.limit;if(!g)return Ts(0,[],P,I);let R=[];for(let y of[g.groups,g.roles,g.permissions])for await(let O of xn((L,C)=>y.list({start:L,limit:C,filter:T?.filter})))R.push(O);let W=I==null?void 0:P+I;return Ts(R.length,R.slice(P,W),P,I)}},get catalogStore(){return s?.catalogStore},get accessStore(){return s?.accessStore},get accessIndex(){return s?.accessIndex},has(T,g,P,I,R){let W=S();return W?W.has(T,g,P,I,R):Promise.resolve(a())},hasGroup(T,g,P,I){let R=S();return R?R.hasGroup(T,g,P,I):Promise.resolve(a())},hasRole(T,g,P,I){let R=S();return R?R.hasRole(T,g,P,I):Promise.resolve(a())},hasPermission(T,g,P,I){let R=S();return R?R.hasPermission(T,g,P,I):Promise.resolve(a())},hasAny(T,g,P){let I=S();return I?I.hasAny(T,g,P):Promise.resolve(a())},hasAll(T,g,P){let I=S();return I?I.hasAll(T,g,P):Promise.resolve(a())},reconcile(){return ee()},async grant(T){Mr(T.subjectType);let g=pt(T.target),P=Un(T.subjectType,n());if(P!=="app")throw new rr(P==="iam-request"||P==="idp"?`Cannot grant ${T.targetType} "${g}" to a "${T.subjectType}" principal: RemoteConfig assignment policy is "${P}". Use ion.authz.requestAccess.`:`Cannot grant ${T.targetType} "${g}" to a "${T.subjectType}" principal: RemoteConfig assignment policy is "${P}".`,P,await ie(T));await se(T),await Bc(s?.catalogStore,d,T,u);let I={...T,status:T.status??"active"};I.id=Ln(I);let R=s?.accessStore;if(!R)throw Error("Cannot grant: no AccessAssignmentStore is wired.");if(await R.grant(I),s?.accessIndex&&(s.catalogStore||d)){let W=await Is(I,{catalog:s.catalogStore,code:d,resources:s.resources,cache:u});await s.accessIndex.materialize(I.id,W)}return await ce(I,"grant"),I},async requestAccess(T){Mr(T.subjectType);let g=Un(T.subjectType,n());if(g!=="iam-request"&&g!=="idp")throw new rr(`Cannot request access for a "${T.subjectType}" principal: RemoteConfig assignment policy is "${g}" (use ion.authz.grant when policy is "app").`,g);let P=pt(T.subject),I=pt(T.target);return c(g,T.subjectType,T.provider).submit({subject:P,subjectType:T.subjectType,targetType:T.targetType,target:I,operation:T.operation,justification:T.justification})},async getAccessRequest(T){Mr(T.subjectType);let g=Un(T.subjectType,n());if(g!=="iam-request"&&g!=="idp")throw new rr(`Cannot read an access request for a "${T.subjectType}" principal: RemoteConfig assignment policy is "${g}".`,g);return c(g,T.subjectType,T.provider).get(T.id)},async revoke(T){Mr(T.subjectType);let g={...T,id:T.id??Ln(T)},P=s?.accessStore;if(!P)throw Error("Cannot revoke: no AccessAssignmentStore is wired.");await P.revoke(g),await s?.accessIndex?.removeByRoot(g.id),await ce(g,"revoke")}},ie=async(T)=>{let g=pt(T.target),P=Cs(d,s?.catalogStore);if(P){let I=T.targetType==="role"?await P.roles.get(g):T.targetType==="permission"?await P.permissions.get(g):await P.groups.get(g);if(I?.requestUrl)return I.requestUrl}return(await t()?.getDestinationRef("group",g))?.requestUrl},se=async(T)=>{let g=Vc(d,pt(T.target));if(!g)return;if(g.kind!==T.targetType)throw Error(`Cannot grant ${T.targetType} "${g.entity.id}": code declares that id as ${g.kind}.`);if(!s?.catalogStore)throw Error(`Cannot grant code entitlement "${g.entity.id}": no AccessCatalogStore is wired for materialization.`);await Fc(g.kind,g.entity,$c(s.catalogStore,g.kind))},ce=async(T,g)=>{if(l.isReady())try{if(g==="grant")await l.grant(T);else await l.revoke(T)}catch(I){e.warn("OAA incremental access push failed after ion.authz mutation; full sync will reconcile",{"ion.operation":"authz.oaa.push","ion.outcome":"degraded",op:g,error:I instanceof Error?I.message:String(I)})}let P=t();if(!P?.isReady())return;try{if(g==="grant")await P.onGrant(T);else await P.onRevoke(T)}catch(I){e.warn("IAM delta projection failed after ion.authz mutation; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:g,error:I instanceof Error?I.message:String(I)})}};return{update(T){if(i)return re;let g=T?.catalog?zc(T.catalog):void 0,P=g!==d;d=g,s=T,l.refreshReadiness();let I=T?.catalogStore,R=T?.resources;if(I!==_||R!==j||P)b?.(),U?.(),u=I||d?new Gc(I,R,d):void 0,b=I?.afterChange?I.afterChange((W)=>{if(p(W))return;k(W),D(W)}):void 0,U=R?.changed?R.changed((W)=>{te(W),q(W)}):void 0,_=I,j=R;else if(u)u.clear();return re},settle:V,catalogView:h,close(){if(i)return;i=!0,b?.(),b=void 0,U?.(),U=void 0,_=void 0,j=void 0,u=void 0}}}function Os(e){return e.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+|_+$/g,"")||"EMPTY"}function Jc(e){let t=`${e.clientId}\x00${e.path}`,r=2166136261;for(let n=0;n<t.length;n+=1)r^=t.charCodeAt(n),r=Math.imul(r,16777619);return(r>>>0).toString(36)}function Yc(e){let t=Os(e.clientId),r=Os(e.path);return`LFV_${t}__${r}`}function Mn(e,t){let r=Yc(t);if(!(r in e))return r;let n=`${r}_${Jc(t)}`;if(!(n in e))return n;return`${n}_ALT`}import{defaultLogger as $m}from"@ionite/core";import{ACCEPT_JSON as qt,CONTENT_TYPE_JSON as Ee,defaultLogger as au,readJsonResponse as jt,stableConfigHash as cu}from"@ionite/core";import{verifyLfvSignature as Ms}from"@ionite/core/server";import{DEFAULT_SECRET_MIME_TYPES as Mt}from"@ionite/core";var Xc=new Set(["jsonc","env","text","binary","yaml","toml","xml"]);function Zc(e){let t=e.split(";",1)[0]?.trim().toLowerCase()??"";if(t===Mt.binary)return"binary";if(t===Mt.env)return"env";if(t===Mt.yaml||t.endsWith("+yaml"))return"yaml";if(t===Mt.toml||t.endsWith("+toml"))return"toml";if(t===Mt.xml||t.endsWith("+xml"))return"xml";if(t===Mt.jsonc||t.endsWith("+json"))return"jsonc";return"text"}function Wr(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let t=e,r=typeof t.mimeType==="string"?t.mimeType:typeof t.mime_type==="string"?t.mime_type:void 0;if(!r)return;let n=t.format,o=typeof n==="string"&&Xc.has(n)?n:Zc(r),s=typeof t.schemaUrl==="string"?t.schemaUrl:typeof t.schema_url==="string"?t.schema_url:void 0,i=typeof t.typeId==="string"?t.typeId:typeof t.type_id==="string"?t.type_id:void 0;return{format:o,mimeType:r,...s?{schemaUrl:s}:{},...i?{typeId:i}:{}}}function wt(e){if(!e)return;let t=e.custom_metadata,r=t&&typeof t==="object"&&!Array.isArray(t)?t:void 0;return Wr(e.content_type??e.contentType??r?.content_type)}function qr(e){return{format:e.format,mime_type:e.mimeType,...e.schemaUrl?{schema_url:e.schemaUrl}:{},...e.typeId?{type_id:e.typeId}:{}}}var Wt=new Map;function Qc(e){if(!e)return"/";return e.startsWith("/")?e:`/${e}`}function eu(e){try{let t=new URL(e),r=t.pathname.replace(/\/+$/g,"");return`${t.origin}${r}`}catch{return e.replace(/\/+$/g,"")}}function jr(e){let t=eu(e.lfvServerUrl),r=Qc(e.path);return`${t}|${r}`}function Es(e,t,r){let n=Wt.get(e)??new Map;return n.set(t,r),Wt.set(e,n),()=>{let o=Wt.get(e);if(!o)return;if(o.delete(t),o.size===0)Wt.delete(e)}}async function As(e,t,r,n){let o=Wt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onDelivery)continue;if(await c.onDelivery(t)){s+=1;break}}return s}async function _s(e,t,r,n){let o=Wt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onEvents)continue;s+=1,await c.onEvents(t)}return s}import{defaultSecretContentType as tu,parseJsonc as ru,SecretContentTypeMismatchError as nu}from"@ionite/core";function Ls(e){let t={},r=e.replace(/\r\n?/g,`
 `).split(`
-`);for(let n=0;n<r.length;n+=1){let s=(r[n]??"").trim();if(!s||s.startsWith("#"))continue;let i=s.startsWith("export ")?s.slice(7).trimStart():s,c=i.indexOf("=");if(c<=0)throw Error(`Invalid env entry at line ${n+1}: expected KEY=value`);let d=i.slice(0,c).trim();if(!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(d))throw Error(`Invalid env key "${d}" at line ${n+1}`);let u=i.slice(c+1).trim();if(u.length>=2&&(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))){let l=u[0],w=u.slice(1,-1);t[d]=l==='"'?w.replace(/\\(n|r|t|"|\\)/g,(p,k)=>{if(k==="n")return`
-`;if(k==="r")return"\r";if(k==="t")return"\t";return k}):w}else t[d]=u}return t}function xs(e){return Object.entries(e).map(([t,r])=>{let n=String(r??"");if(!n||/[\s#"'\\]/.test(n))return`${t}=${JSON.stringify(n)}`;return`${t}=${n}`}).join(`
-`)}function Us(e){try{let t=atob(e);return Uint8Array.from(t,(r)=>r.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function Nr(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("Secret content is not an object");return e}function nr(e){return e.metadata.contentType??tu()}function Wn(e,t){if(t==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof e.data==="string")return e.data;if(t==="jsonc")return JSON.stringify(e.data,null,2);if(t==="env")return xs(Nr(e.data));let r=Nr(e.data).content;if(typeof r!=="string")throw Error(`Secret ${t} content must contain a string "content" field`);return r}function $r(e,t){if(t==="jsonc")return typeof e.data==="string"?ru(e.data):e.data;if(t==="env")return typeof e.data==="string"?Ls(e.data):Nr(e.data);if(t==="text")return Wn(e,t);if(t==="binary"){let r=Nr(e.data).content_base64;if(typeof r!=="string")throw Error('Binary secret content must contain a "content_base64" string');return Us(r)}throw Error(`Typed ${t} decoding is not supported yet; use text() or bytes()`)}function ou(e){return{format:e.format,mimeType:e.mimeType,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id}}function su(e,t){let r=nr(e);if(r.format!==t.format||r.mimeType!==t.mimeType)throw new nu(ou(t),r)}async function iu(e,t){if(!e.schema)return t;let r=await e.schema["~standard"].validate(t);if(r.issues){let n=r.issues.map((o)=>o.message).join("; ");throw Error(`Secret validation failed for type "${e.id}": ${n}`)}return r.value}function He(e){return{async text(){let t=await e();return Wn(t,nr(t).format)},async json(){let t=await e(),r=nr(t).format;if(r!=="jsonc")throw Error(`json() requires a jsonc secret; received ${r}`);return $r(t,r)},async bytes(){let t=await e(),r=nr(t).format;if(r==="binary")return $r(t,r);return new TextEncoder().encode(Wn(t,r))},async env(){let t=await e(),r=nr(t).format;if(r!=="env")throw Error(`env() requires an env secret; received ${r}`);return $r(t,r)},async metadata(){return(await e()).metadata},async parse(t){let r=await e();return su(r,t),iu(t,$r(r,t.format))}}}function Ws(e){try{return new URL(e).pathname}catch{return e.startsWith("/")?e:`/${e}`}}var uu=1e4,du=1e4,lu=300,qs=100;async function Dn(e){await new Promise((t)=>setTimeout(t,e))}function Me(e){return{startedAt:Date.now(),timeout:typeof e?.timeout==="number"&&e.timeout>0?e.timeout:void 0}}function qn(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function sr(e){if(e.timeout===void 0)return;let t=Date.now()-e.startedAt;return Math.max(0,e.timeout-t)}function tt(e,t,r){return Error(`LFV ${e} timed out after ${r.timeout??0}ms for ${t}`)}async function $t(e,t,r,n,o){let s=sr(r);if(s!==void 0){if(s<=0)throw tt(n,o,r);let i=new AbortController,c=setTimeout(()=>i.abort(),s);try{return await fetch(e,{...t,signal:i.signal})}catch(d){if(d instanceof Error&&d.name==="AbortError")throw tt(n,o,r);throw d}finally{clearTimeout(c)}}return await fetch(e,t)}class _e extends Error{constructor(e){super(`LFV source closed while operating on ${e}`);this.name="LfvSourceClosedError"}}class et extends Error{constructor(e){super(e);this.name="LfvProtocolError"}}class vt extends et{constructor(e,t,r){super(`LFV ${t} failed (${e}) for ${r}`);this.status=e;if(this.name="LfvActionStatusError",e===404)this.code="not_found"}}var fu=new Set([400,401,403,404,409,410]);function js(e){return e instanceof et&&(!(e instanceof vt)||fu.has(e.status))}function Dr(e){return e instanceof _e||e instanceof Error&&e.name==="LfvSourceClosedError"}function pu(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`LFV kms_park returned invalid payload for ${t}`);let r=e;if(typeof r.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${t}`);let n=r.disposition;if(n!==void 0&&n!=="cooldown"&&n!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${t}`);return{parked:r.parked,...r.stale===!0?{stale:!0}:{},...n?{disposition:n}:{}}}function or(e){try{let t=JSON.parse(e);return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:void 0}catch{return}}async function jn(e,t,r,n,o,s,i,c,d,u){let l=0,w=Date.now();for(;;){if(u?.())throw new _e(n);let p=sr(r);if(p!==void 0&&p<=0)throw tt(o,n,r);try{return await e()}catch(k){if(k instanceof _e)throw k;if(u?.())throw new _e(n);if(l+=1,i>0&&Date.now()-w>=i){let _=`Error connecting to the LFV source. Retries: '${l}'`;if(c)c(d,_,{url:t,path:n,operation:o});w=Date.now()}let q=p===void 0?s:Math.min(s,p);if(q<=0)throw tt(o,n,r);if(await Dn(q),u?.())throw new _e(n)}}}function mu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function $n(e){if(typeof e==="number"&&Number.isFinite(e))return e;if(typeof e==="string"&&e.trim()){let t=Date.parse(e.trim());if(!Number.isNaN(t))return t}return}function $s(e){return`[LFV] [${e??"-"}] [${new Date().toISOString()}]: `}function Nn(e,t){if(typeof e!=="string"||e.trim()==="")throw Error(`LFV source requires "${t}"`);return e}function gu(e){return{...e,lfvServerUrl:Nn(e.lfvServerUrl,"lfvServerUrl"),clientId:Nn(e.clientId,"clientId"),path:Nn(e.path,"path")}}function St(e,t,r={}){let n=gu(e),o=n.log??au,s=(v,x,N)=>{let z=$s(v)+x;if(N!==void 0)o.debug(z,N);else o.debug(z)},i=(v,x,N)=>{let z=$s(v)+x;if(N!==void 0)o.warn(z,N);else o.warn(z)},{lfvServerUrl:c,clientId:d,path:u,verifyJwks:l}=n,w=typeof n.deliveryTimeout==="number"&&n.deliveryTimeout>0?n.deliveryTimeout:void 0,p=typeof n.retryInterval==="number"&&n.retryInterval>0?n.retryInterval:uu,k=typeof n.warnInterval==="number"&&n.warnInterval>=0?n.warnInterval:du,q=(typeof n.callbackMaxAgeSeconds==="number"&&n.callbackMaxAgeSeconds>0?n.callbackMaxAgeSeconds:lu)*1000,_=typeof n.cacheMaxAgeSeconds==="number"&&n.cacheMaxAgeSeconds>0?n.cacheMaxAgeSeconds*1000:void 0,b=l?.trim()?cu(l.trim()):void 0,j=Ws(n.deliveryEndpoint),U=Ws(n.eventsEndpoint),a=jr({lfvServerUrl:c,path:u}),y=crypto.randomUUID(),S=new Map,M=new Set,F=new Map,Z=new Map,Y=new Map,ee=new Map,ae=new Map,oe=new Map,K=new Map,Q=(v,x)=>{if(typeof x==="number"&&Number.isInteger(x)&&x>=1){let N=K.get(v)??1,z=Math.max(N,x);return K.set(v,z),z}return K.get(v)},V=(v,x)=>typeof x==="number"&&Number.isInteger(x)&&x>=1&&x>(K.get(v)??1),D=new Map,te=new Map,re=!1,ie,se=new Set,ce=()=>re;function T(v,x){F.set(v,x),Z.set(v,Date.now())}function g(v){F.delete(v),Z.delete(v)}function P(v){let x=F.get(v);if(!x)return;if(_!==void 0){let N=Z.get(v)??0;if(Date.now()-N>_){s(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:v});return}}return x}function I(){return M.size>0||S.size>0||oe.size>0}function R(){if(re){if(ie)ie(),ie=void 0;return}let v=I();if(v&&!ie)ie=Es(a,y,{trustId:b,onDelivery:async(x)=>Ko(x).handled||await Fo(x),onEvents:async(x)=>{zo(x)}});if(!v&&ie)ie(),ie=void 0}async function W(v,x,N,z){if(!t)throw Error("LFV callback transport is not configured");for(;;){if(re)throw new _e(x);if(z())throw new _e(x);let X=await t.take(v);if(X){if(X.key!==a)i(v,"parked OTP callback rejected: callback key mismatch");else if(!await gn(X.rawBody,X.headers)){let pe=or(X.rawBody);if(pe?.type==="otp"&&pe.request_id===v&&typeof pe.otp==="string"&&pe.otp)return pe.otp}}let H=sr(N);if(H!==void 0&&H<=0)throw tt("issueOtp",x,N);await Dn(H===void 0?qs:Math.min(qs,H))}}async function h(v,x){let N=x??crypto.randomUUID(),z={startedAt:Date.now(),timeout:w},X={request_id:N,path:v,action:"read_secret",...qn(Q(v))},H=await jn(()=>$t(`${c.replace(/\/+$/g,"")}/clients/${d}/otp`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":N},body:JSON.stringify(X)},z,"issueOtp",v),c,z,v,"issueOtp",p,k,i,N,ce);if(H.status!==200&&H.status!==202)throw new vt(H.status,"issueOtp",v)}async function O(v,x){let N=te.get(v);if(N)return N;let z=h(v,x);te.set(v,z);try{await z}finally{if(te.get(v)===z)te.delete(v)}}async function L(v,x,N,z){if(re)throw new _e(v);let X=N??crypto.randomUUID(),H=z??Me(),ue=new Promise((Ue,Xt)=>{let Bo={resolve:Ue,reject:Xt},yn=sr(H);if(yn!==void 0){if(yn<=0){Xt(tt("issueOtp",v,H));return}Bo.timer=setTimeout(()=>{oe.delete(X),R(),Xt(tt("issueOtp",v,H))},yn)}oe.set(X,Bo),R()});ue.catch(()=>{});let pe=()=>{let Ue=oe.get(X);if(!Ue)return;if(Ue.timer)clearTimeout(Ue.timer);oe.delete(X),R()},le={request_id:X,path:v,action:x,...qn(Q(v))};s(X,"OTP request",{path:v,action:x});let Se;try{Se=await jn(async()=>await $t(`${c.replace(/\/+$/g,"")}/clients/${d}/otp`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":X},body:JSON.stringify(le)},H,"issueOtp",v),c,H,v,"issueOtp",p,k,i,X,ce)}catch(Ue){throw pe(),Ue}if(Se.status!==200&&Se.status!==202)throw pe(),new vt(Se.status,"issueOtp",v);let Te=!1,ke=t?W(X,v,H,()=>Te):void 0;if(ke)ke.catch(()=>{});try{let Ue=await(ke?Promise.race([ue,ke]):ue);return s(X,"OTP received via signed callback",{path:v,action:x}),Ue}finally{Te=!0,pe()}}async function C(v,x,N,z,X,H,ue){if(re)throw new _e(x);let pe=ue??Me(),le=await jn(async()=>await $t(`${c.replace(/\/+$/g,"")}${v}`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":X},body:JSON.stringify({request_id:X,otp:z,path:x,...qn(Q(x)),...H??{}})},pe,N,x),c,pe,x,N,p,k,i,X,ce);if(le.status!==200&&le.status!==202)throw new vt(le.status,N,x);return s(X,`${N} accepted`,{path:x,status:le.status}),le}async function m(v,x,N,z,X,H){if(re)throw new _e(x);let ue=X??crypto.randomUUID(),pe=H??Me(),le=await L(x,N,ue,pe),Se=await C(v,x,N,le,ue,z,pe);return{requestId:ue,response:Se}}async function f(v,x,N){if(re)throw new _e(v);let z=V(v,N?.kmsSlots);if(Q(v,N?.kmsSlots),z)g(v);let X=P(v);if(X)return X;let H=D.get(v);if(H){if(!z)return H;if(await H.catch(()=>{return}),H=D.get(v),H)return H}let ue=E(v,x,N);D.set(v,ue),ue.catch((pe)=>{if(Dr(pe))s(x,"read aborted: source closed",{path:v})});try{return await ue}finally{D.delete(v)}}async function E(v,x,N){let z=N?.timeout??w,X={startedAt:Date.now(),timeout:typeof z==="number"&&z>0?z:void 0},H=x??crypto.randomUUID();s(H,"read_secret request",{path:v});let ue=0,pe=Date.now();for(;;){if(re)throw new _e(v);try{let{response:le}=await m("/secrets/request",v,"read_secret",void 0,H,X),Se=await A(H,le),Te=B(v,Se);return J(v,Te,Te.metadata.version),s(H,"read_secret completed from action response",{path:v}),Te}catch(le){if(le instanceof _e)throw le;if(js(le))throw le;let Se=sr(X);if(Se!==void 0&&Se<=0)throw tt("read_secret",v,X);if(ue+=1,k>0&&Date.now()-pe>=k)i(H,`read_secret retrying. Retries: '${ue}'`,{path:v}),pe=Date.now();let Te=Se===void 0?p:Math.min(p,Se);if(Te<=0)throw tt("read_secret",v,X);await Dn(Te)}}}async function A(v,x){if(!l?.trim())throw new et("LFV read_secret response verification is not configured");let N=x.headers.get("X-LFV-Request-Id")?.trim(),z=x.headers.get("X-LFV-Key-Id")?.trim(),X=x.headers.get("X-LFV-Signature")?.trim();if(!N||!z||!X)throw new et("LFV read_secret response is missing signature headers");if(N!==v)throw new et("LFV read_secret response request_id header does not match the request");let H=await x.text();if(!await Ms({jwks:l,kid:z,signatureB64Url:X,requestId:v,rawBody:H}))throw new et("LFV read_secret response signature verification failed");let pe=or(H);if(!pe||pe.request_id!==v)throw new et("LFV read_secret response request_id does not match the request");return pe}function B(v,x){if(Do(x)!==v||x.data?.data===void 0)throw new et(`LFV read_secret returned an invalid secret response for ${v}`);let z=x.data.metadata??{},X=typeof z.version==="number"?z.version:0,H=z.created_time??z.created,ue=wt(z);return{data:x.data.data,metadata:{path:v,version:X,created:typeof H==="string"?new Date(H):new Date,...ue?{contentType:ue}:{}}}}function J(v,x,N){if(N!==void 0){let H=ee.get(v);if(H!==void 0&&N<H){s(void 0,"delivery ignored: stale version",{path:v,realVersion:N,lastAccepted:H});return}ee.set(v,N)}T(v,x),se.delete(v);let z=x.metadata.version;if(Y.get(v)===z)return;Y.set(v,z);let X=S.get(v);if(!X)return;for(let H of X)H(x)}async function G(v,x){return await f(v,void 0,x)}async function de(v,x,N){if(!mu(x))throw Error(`putSecret requires an object value for LFV source at path ${v}`);let z=Me(N),X={data:x,content_type:qr(N.contentType)};if(await fe(v,N)){await m("/secrets/update",v,"update_secret",X,void 0,z),g(v);return}await m("/secrets/create",v,"create_secret",X,void 0,z),g(v)}async function ne(v,x){let N=Me(x);await m("/secrets/delete",v,"delete_secret",void 0,void 0,N),g(v)}async function we(v,x){let N=Me(x),z=crypto.randomUUID();s(z,"list_paths request",{path:v});let X=await L(v,"list_paths",z,N),H=await $t(`${c.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":z},body:JSON.stringify({request_id:z,otp:X,path:v})},N,"listPaths",v);if(H.status!==200)throw Error(`LFV listPaths failed (${H.status}) for ${v}`);let ue=await jt(H,{log:o,operation:"lfv.paths.list",redact:!0});if(!Array.isArray(ue.items))throw Error(`LFV listPaths returned invalid payload for ${v}`);return s(z,"list_paths success",{path:v,status:200}),ue.items.filter((pe)=>typeof pe==="string")}async function fe(v,x){let N=Me(x),z=crypto.randomUUID();s(z,"exists request",{path:v});let X=await L(v,"read_metadata",z,N),H=await $t(`${c.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":z},body:JSON.stringify({request_id:z,otp:X,path:v})},N,"exists",v);if(H.status!==200)throw Error(`LFV exists failed (${H.status}) for ${v}`);let ue=await jt(H,{log:o,operation:"lfv.paths.exists",redact:!0});if(typeof ue.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${v}`);return s(z,"exists success",{path:v,status:200,exists:ue.exists}),ue.exists}async function Xe(v,x,N){let z=Me(N);await m("/secrets/rotate/request",v,"request_rotate",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,z)}async function Pe(v,x,N){let z=Me(N);await m("/secrets/revoke/request",v,"request_revoke",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,z)}async function mt(v,x,N){let z=Me(N),{response:X}=await m("/secrets/kms/park",v,"kms_park",{key_id:x.keyId,status:x.status,reason:x.reason},void 0,z);return pu(await jt(X,{log:o,operation:"lfv.kms.park",redact:!0}).catch(()=>null),v)}function La(v,x){if(!v||typeof v!=="object"||Array.isArray(v))throw Error(`LFV kms_add_keys returned invalid payload for ${x}`);let N=v;if(!Array.isArray(N.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${x}`);return{keys:N.keys.map((X,H)=>{if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`LFV kms_add_keys returned invalid keys[${H}] for ${x}`);let ue=X.id;if(typeof ue!=="string"||ue.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${H}].id for ${x}`);return{id:ue}})}}function xa(v,x){if(!v||typeof v!=="object"||Array.isArray(v))throw Error(`LFV kms_revoke_key returned invalid payload for ${x}`);let N=v;if(typeof N.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${x}`);return{revoked:N.revoked}}async function Ua(v,x,N){let z=Me(N),{response:X}=await m("/secrets/kms/add-keys",v,"kms_add_keys",{keys:x.keys},void 0,z);return La(await jt(X,{log:o,operation:"lfv.kms.add_keys",redact:!0}).catch(()=>null),v)}async function Ma(v,x,N){let z=Me(N),{response:X}=await m("/secrets/kms/revoke-key",v,"kms_revoke_key",{key_id:x.keyId,reason:x.reason},void 0,z);return xa(await jt(X,{log:o,operation:"lfv.kms.revoke_key",redact:!0}).catch(()=>null),v)}async function Wa(v,x){let N=Me(x),z=crypto.randomUUID();s(z,"getMetadata request",{path:v});let X=await L(v,"read_metadata",z,N),H=await $t(`${c.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":z},body:JSON.stringify({request_id:z,otp:X,path:v})},N,"getMetadata",v);if(H.status!==200)throw Error(`LFV getMetadata failed (${H.status}) for ${v}`);let ue=await jt(H,{log:o,operation:"lfv.metadata.read",redact:!0});if(!ue.metadata||typeof ue.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${v}`);return s(z,"getMetadata success",{path:v,status:200}),ue.metadata}async function No(v,x,N,z=!0){let X=S.get(v)??new Set,H,ue=(le)=>{if(le.metadata.version===H)return;H=le.metadata.version,x(le)};if(X.add(ue),S.set(v,X),!z)return R(),()=>{let le=S.get(v);if(!le)return;if(le.delete(ue),le.size===0)S.delete(v);R()};let pe=V(v,N?.kmsSlots)?void 0:P(v);if(pe)ue(pe),Y.set(v,pe.metadata.version);else try{ue(await G(v,N))}catch(le){if(X.delete(ue),X.size===0)S.delete(v);throw le}return R(),()=>{let le=S.get(v);if(!le)return;if(le.delete(ue),le.size===0)S.delete(v);R()}}let qa=(v,x)=>No(v,x,void 0,!1);function ja(v){return v.method==="POST"&&new URL(v.url).pathname===j}function $a(v){return v.method==="POST"&&new URL(v.url).pathname===U}function Do(v){let x=v.data?.metadata?.path;if(typeof x==="string"&&x)return x;if(typeof v.path==="string"&&v.path)return v.path;return}function Na(v){let{request_id:x,otp:N}=v;if(typeof x!=="string"||typeof N!=="string"||!N)return{handled:!1};let z=oe.get(x);if(!z)return{handled:!1};if(z.timer)clearTimeout(z.timer);return oe.delete(x),R(),z.resolve(N),{handled:!0}}function Ko(v){return v.type==="otp"?Na(v):{handled:!1}}function ct(v="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:v}),{status:401,headers:Ee})}function Vo(v){return{requestId:v.headers.get("X-LFV-Request-Id")??v.headers.get("x-lfv-request-id")??"",keyId:v.headers.get("X-LFV-Key-Id")??v.headers.get("x-lfv-key-id")??"",signature:v.headers.get("X-LFV-Signature")??v.headers.get("x-lfv-signature")??""}}async function gn(v,x){if(!l?.trim())return i(void 0,"LFV callback rejected: verifyJwks is not configured"),ct("LFV callback verification is not configured");let{requestId:N,keyId:z,signature:X}=x;if(!N.trim()||!z.trim()||!X.trim())return i(N||void 0,"LFV callback rejected: missing signature headers"),ct("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await Ms({jwks:l,kid:z,signatureB64Url:X.trim(),requestId:N.trim(),rawBody:v}))return i(N,"LFV callback rejected: signature verification failed"),ct();let ue=or(v);if(!ue)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:Ee});let pe=ue;if(pe.request_id!==N.trim())return i(N,"LFV callback rejected: request_id header/body mismatch"),ct("X-LFV-Request-Id does not match request_id in body");let le=Date.now(),Se=$n(pe.issued_at);if(Se===void 0)return i(N,"LFV callback rejected: missing or invalid issued_at"),ct("Missing or invalid issued_at");if(le-Se>q)return i(N,"LFV callback rejected: stale (outside freshness window)"),ct("Callback is stale (issued_at outside freshness window)");let Te=$n(pe.expires_at);if(Te!==void 0&&le>Te)return i(N,"LFV callback rejected: expired"),ct("Callback has expired");let ke=X.trim();for(let[Ue,Xt]of ae)if(Xt<=le)ae.delete(Ue);if(ae.has(ke))return i(N,"LFV callback rejected: replayed signature"),ct("Callback signature already processed (replay)");return ae.set(ke,Se+q),null}async function Fo(v){if(!r.selfRedeemReads||v.action!=="read_secret"||typeof v.request_id!=="string"||typeof v.path!=="string"||typeof v.otp!=="string")return!1;let x={startedAt:Date.now(),timeout:w},N=await C("/secrets/request",v.path,"read_secret",v.otp,v.request_id,void 0,x),z=await A(v.request_id,N),X=B(v.path,z);return J(v.path,X,X.metadata.version),!0}async function Da(v){let x=await v.text(),N=Vo(v),z=await gn(x,N);if(z)return z;let X=or(x);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:Ee});let H=X;if(H.type!=="otp"||typeof H.request_id!=="string"||typeof H.otp!=="string"||typeof H.path!=="string"||typeof H.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let ue=Do(H);s(H.request_id,"delivery received",{path:ue});let pe=Ko(H),le=ue?jr({lfvServerUrl:c,path:ue}):a,Se=await As(le,H,y,b),Te=pe.handled||Se>0;if(!Te)try{if(Te=await Fo(H),!Te&&t&&typeof H.request_id==="string"){let ke=$n(H.expires_at),Ue=Math.max(1,(ke??Date.now()+q)-Date.now());await t.put(H.request_id,{kind:"delivery",key:le,rawBody:x,headers:N},Ue),Te=!0}}catch(ke){if(js(ke)){if(!(ke instanceof vt)||ke.status!==409&&ke.status!==410)se.add(H.path);return i(N.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:le,status:ke instanceof vt?ke.status:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:Ee})}return ae.delete(N.signature.trim()),i(N.requestId,"LFV callback handoff failed; callback may be retried",{key:le,error:ke instanceof Error?ke.message:String(ke)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:Ee})}if(!Te)return ae.delete(N.signature.trim()),i(N.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:le}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:Ee});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:Ee})}function zo(v){if(re)return;if(!v?.path||typeof v.path!=="string")return;s(v.request_id,"events payload",{path:v.path,event:v.event});for(let x of M)try{x({path:v.path,event:v.event,requestId:v.request_id,issuedAt:v.issued_at,expiresAt:v.expires_at,...typeof v.key_id==="string"&&v.key_id.length>0?{keyId:v.key_id}:{}})}catch(N){i(v.request_id,"secret event listener failed",{path:v.path,event:v.event,error:N instanceof Error?N.message:String(N)})}if(v.event==="created"||v.event==="updated"||v.event==="rotated")g(v.path),(r.selfRedeemReads?O(v.path,v.request_id):f(v.path,v.request_id).then(()=>{return})).catch((N)=>{if(Dr(N)){s(v.request_id,"event refresh aborted: source closed",{path:v.path});return}se.add(v.path),i(v.request_id,"event-triggered refresh failed; source marked degraded",{path:v.path,event:v.event,error:N instanceof Error?N.message:String(N)})})}async function Ka(v){let x=await v.text(),N=Vo(v),z=await gn(x,N);if(z)return z;let X=or(x);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:Ee});let H=X;if(!H?.path||typeof H.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:Ee});s(H.request_id,"events received",{path:H.path,event:H.event}),zo(H);let ue=jr({lfvServerUrl:c,path:H.path});return await _s(ue,H,y,b),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:Ee})}function Va(){if(re)return;if(re=!0,ie)ie(),ie=void 0;let v=new _e(u);for(let x of oe.values()){if(x.timer)clearTimeout(x.timer);try{x.reject(v)}catch{}}oe.clear(),D.clear(),te.clear(),se.clear(),F.clear(),Z.clear(),Y.clear(),ee.clear(),ae.clear(),S.clear(),M.clear()}return{type:"vault",isAvailable:()=>se.size===0,get:(v,x)=>He(()=>G(v,x)),getFullSecret:G,getSecret:async(v,x)=>(await G(v,x)).data,putSecret:de,deleteSecret:ne,listPaths:we,exists:fe,requestRotate:Xe,requestRevoke:Pe,parkKmsKey:mt,addKmsKeys:Ua,revokeKmsKey:Ma,getMetadata:Wa,subscribe:No,subscribePassive:qa,subscribeEvents:(v)=>(M.add(v),R(),()=>{M.delete(v),R()}),close:Va,isDeliveryRequest:ja,isEventsRequest:$a,handleDelivery:Da,handleEvents:Ka,deliveryPath:j,eventsPath:U,callbackKey:a,trustId:b}}function kt(e,t,r){if(typeof e!=="string"||e.trim()==="")throw Error(`"${t}" is required when using ${r}`);return e}var Nt="__esLfvBootstrap";import{catalogEntityStore as Vr,listGenerator as cr,materializeCodeCatalogEntity as ku,unionCatalogRead as bu}from"@ionite/core";import{baseCustomerToScim as Vs,baseUserToScimUser as Fs,baseWorkloadToScim as zs,entitlementToScimGroup as Fn}from"@ionite/core/server";import{ACCEPT_SCIM as yu,CONTENT_TYPE_SCIM as hu,ION_AUTHZ_GROUP_SCHEMA as Kn,isJsonResponse as Ds,readJsonResponse as Ns,unexpectedBodySummary as Ks}from"@ionite/core";var wu="urn:ietf:params:scim:api:messages:2.0:PatchOp",vu="urn:ietf:params:scim:schemas:core:2.0:User",Su="urn:ietf:params:scim:schemas:core:2.0:Group";async function ir(e){try{if(Ds(e)){let r=(await e.clone().text()).trim();return r?r.slice(0,2000):void 0}let t=await Ks(e.clone());return[t.contentType,t.excerpt].filter(Boolean).join(": ")||void 0}catch{return}}function ar(e){if(e==="user")return"Users";if(e==="workload")return"Workloads";if(e==="customer")return"Customers";return"Groups"}function Vn(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class Kr{constructor(e){this.inflight=new Map;this.memo=new Map;this.writes=new Map;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.getToken=e.getToken,this.receipts=e.receipts,this.log=e.log,this.fetchImpl=e.fetchImpl??((t,r)=>fetch(t,r))}async headers(){let e=await this.getToken();return new Headers({...hu,...yu,Authorization:`Bearer ${e}`})}inflightKey(e,t,r){return`${e}\x00${t}\x00${r?"create":"lookup"}`}receiptKey(e,t){return`${e}\x00${t}`}serializeWrite(e,t,r){let n=`${e}\x00${t}`,s=(this.writes.get(n)??Promise.resolve()).catch(()=>{return}).then(r);this.writes.set(n,s);let i=()=>{if(this.writes.get(n)===s)this.writes.delete(n)};return s.then(i,i),s}async resolveProviderId(e,t,r){let n=this.receiptKey(e,t),o=this.memo.get(n);if(o)return{found:o.providerId,requestUrl:o.requestUrl};let s=await this.receipts.read(e,t);if(s)this.memo.set(n,s);if(s)return{found:s.providerId,requestUrl:s.requestUrl};let i=this.inflightKey(e,t,r!==void 0),c=this.inflight.get(i);if(c)return c;let d=this.resolveUncached(e,t,r).then(async(u)=>{if(typeof u==="object"){let l={providerId:u.found,...u.requestUrl?{requestUrl:u.requestUrl}:{}};await this.receipts.write(e,t,l),this.memo.set(n,l)}return u}).finally(()=>{this.inflight.delete(i)});return this.inflight.set(i,d),d}async resolveUncached(e,t,r){let n=await this.filterByExternalId(e,t);if(n!=="absent")return n;if(!r)return"absent";return this.create(e,t,r)}async filterByExternalId(e,t){let r=encodeURIComponent(`externalId eq "${Vn(t)}"`),n=`${this.baseUrl}/${ar(e)}?filter=${r}`,o=await this.fetchImpl(n,{method:"GET",headers:await this.headers()});if(!o.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:e,status:o.status,detail:await ir(o)}),"error";let i=((await Ns(o,{log:this.log,operation:"iam.delta.resolve"})).Resources??[])[0];return i?.id?{found:i.id,...this.requestUrl(e,i)}:"absent"}async create(e,t,r){let n=`${this.baseUrl}/${ar(e)}`,o=this.writeBody(e,t,r),s=await this.fetchImpl(n,{method:"POST",headers:await this.headers(),body:JSON.stringify(o)});if(!s.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:e,status:s.status,detail:await ir(s)}),"error";let i=await Ns(s,{log:this.log,operation:"iam.delta.create"});return i.id?{found:i.id,...this.requestUrl(e,i),created:!0}:"error"}requestUrl(e,t){if(e!=="group")return{};let r=t[Kn];if(!r||typeof r!=="object")return{};let n=r.requestUrl;return typeof n==="string"&&n?{requestUrl:n}:{}}async captureResponseReference(e,t,r,n,o){if(e.status===204)return;if(!Ds(e)){let s=await Ks(e.clone());if(s.excerpt)this.log.warn("SCIM destination returned a non-JSON body on a successful write",{"ion.operation":"iam.delta.receipt","ion.outcome":"degraded",reason:"non_json_response",status:e.status,contentType:s.contentType,excerpt:s.excerpt});return}try{let s=await e.clone().json(),i=this.requestUrl(t,s).requestUrl;if(!i&&s.id===void 0)return;let c=i??o,d={providerId:s.id??n,...c?{requestUrl:c}:{}};await this.receipts.write(t,r,d),this.memo.set(this.receiptKey(t,r),d)}catch{}}async invalidate(e,t){this.memo.delete(this.receiptKey(e,t)),await this.receipts.clear(e,t)}writeBody(e,t,r){let{id:n,meta:o,...s}=r,i=s,c=i[Kn];if(c&&typeof c==="object"&&!Array.isArray(c)){let{providerId:d,requestUrl:u,...l}=c;i[Kn]=l}return{...i,schemas:(r.schemas?.length??0)>0?r.schemas:[e==="user"?vu:Su],externalId:t}}async upsertResource(e,t,r){return this.serializeWrite(e,t,()=>this.upsertResourceNow(e,t,r))}async upsertResourceNow(e,t,r){let n=async(s)=>{let i=await this.resolveProviderId(e,t,s?r:void 0);if(i==="error")return"error";if(i==="absent")return"skipped";if(i.created)return"pushed";let c=await this.fetchImpl(`${this.baseUrl}/${ar(e)}/${encodeURIComponent(i.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody(e,t,r))});if(c.status===404||c.status===410)return"stale";if(c.ok)return await this.captureResponseReference(c,e,t,i.found,i.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:e,status:c.status,detail:await ir(c)}),"error"},o=await n(!0);if(o==="stale")await this.invalidate(e,t),o=await n(!0);return o==="stale"?"error":o}async deleteResource(e,t){return this.serializeWrite(e,t,()=>this.deleteResourceNow(e,t))}async deleteResourceNow(e,t){let r=async()=>{let o=await this.resolveProviderId(e,t);if(o==="error")return{outcome:"error"};if(o==="absent")return{outcome:"pushed"};let s=await this.fetchImpl(`${this.baseUrl}/${ar(e)}/${encodeURIComponent(o.found)}`,{method:"DELETE",headers:await this.headers()});if(s.status===404||s.status===410)return{outcome:"pushed",stale:!0};if(s.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:e,status:s.status,detail:await ir(s)}),{outcome:"error"}},n=await r();if(n.stale)await this.invalidate(e,t),n=await r();if(n.outcome==="pushed")await this.invalidate(e,t);return n.outcome}async patchGroupMembership(e){return this.serializeWrite("group",e.groupExternalId,()=>this.patchGroupMembershipNow(e))}async patchGroupMembershipNow(e){let{groupExternalId:t,userExternalId:r,op:n}=e,o=e.subjectResourceType??"user",s=await this.resolveProviderId(o,r,n==="add"?e.userCreate:void 0);if(s==="error")return this.log.warn("IAM delta: principal lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,subjectResourceType:o}),"error";if(s==="absent")return this.log.warn("IAM delta: principal not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n,subjectResourceType:o}),"skipped";let i=s.found,c=async(l)=>{let w=await this.resolveProviderId("group",t,n==="add"&&l?e.groupCreate:void 0);if(w==="error")return{kind:"error"};if(w==="absent")return{kind:"absent"};let p=`${this.baseUrl}/${ar("group")}/${encodeURIComponent(w.found)}`,k=n==="add"?[{op:"add",path:"members",value:[{value:i,type:e.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${Vn(i)}"]`}];return{kind:"response",response:await this.fetchImpl(p,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[wu],Operations:k})}),providerId:w.found,requestUrl:w.requestUrl}},d=await c(!0);if(d.kind==="response"&&(d.response.status===404||d.response.status===410))await this.invalidate("group",t),d=await c(!1);if(d.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n}),"error";if(d.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n}),"skipped";let u=d.response;if(!u.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,status:u.status,detail:await ir(u)}),"error";return await this.captureResponseReference(u,"group",t,d.providerId,d.requestUrl),"pushed"}}function Dt(e){if(typeof e==="string")return e;if(e&&typeof e==="object"&&"id"in e)return e.id;return}function ur(e){return e&&typeof e==="object"?e:void 0}function zn(e){let t={},r={},n,o,s,i,c,d,u,l,w,p=()=>t.users==="patch"||t.workloads==="patch"||t.customers==="patch",k=(g)=>{if(g==="user")return t.users==="patch";if(g==="workload")return t.workloads==="patch";return t.customers==="patch"},q=()=>{if(!t.url)return"destination URL is not configured";if(!r.workload)return"workload identity is not configured";if(typeof r.workload.isReady!=="function"||typeof r.workload.ready!=="function")return"workload handle violates the readiness contract";if(!r.workload.isReady())return"workload module is not ready";if(t.audience){let g=r.workload[t.audience];if(!g)return`outgoing workload client "${t.audience}" is not configured`;if(typeof g.isReady!=="function"||typeof g.ready!=="function")return`outgoing workload client "${t.audience}" violates the readiness contract`;if(!g.isReady())return`outgoing workload client "${t.audience}" is not ready`}return},_=()=>{if(!p())return"no principal-kind delta mode is 'patch'";let g=q();if(g)return g;if(t.users==="patch"&&!r.userStore)return"user store is not configured for IAM destination receipts";if(t.workloads==="patch"&&!r.workloadIdentityStore)return"workload identity store is not configured for IAM destination receipts";if(t.customers==="patch"&&!r.customerStore)return"customer store is not configured for IAM destination receipts";if(!r.catalogStore)return"catalog store is not configured for IAM destination receipts";return},b=()=>_()===void 0,j=me("IAM delta",b),U=async()=>{let g=r.workload;if(!g)throw Error("IAM delta: workload identity not configured");if(t.audience&&typeof g.getToken==="function")return g.getToken(t.audience);if(typeof g.getServerToken==="function")return g.getServerToken();return g.getToken()},a=()=>bu(r.codeCatalog,r.catalogStore),y=async(g,P)=>{let I=r.catalogStore;if(!I)return;let R=r.codeCatalog?.groups.get(g)??r.codeCatalog?.roles.get(g)??r.codeCatalog?.permissions.get(g);if(R){let h=r.codeCatalog?.groups.get(R.id)?"group":r.codeCatalog?.roles.get(R.id)?"role":"permission",O=Vr(I,h),L=await O.get(R.id);if(!L&&P)await ku(h,R,O),L=await O.get(R.id);if(L)return{kind:h,entity:L}}let W=[["group",I.groups],["role",I.roles],["permission",I.permissions]];for(let[h,O]of W){let L=await O.get(g);if(L)return{kind:h,entity:L}}return},S=async(g)=>{let P=r.userStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);for await(let I of cr((R,W)=>P.list({start:R,limit:W})))if(I.externalId===g)return I;return},M=(g)=>g?.providerId?{providerId:g.providerId,...g.requestUrl?{requestUrl:g.requestUrl}:{}}:void 0,F=async(g)=>{let P=r.workloadIdentityStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);let I=await P.lookup({id:"",externalId:g});if(I)return I;for await(let R of cr((W,h)=>P.list({start:W,limit:h})))if(R.externalId===g)return R;return},Z=async(g)=>{let P=r.customerStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);let I=await P.lookup({id:"",userName:"",name:"",email:"",externalId:g});if(I)return I;for await(let R of cr((W,h)=>P.list({start:W,limit:h})))if(R.externalId===g)return R;return},Y={async read(g,P){if(g==="user")return M(await S(P));if(g==="workload")return M(await F(P));if(g==="customer")return M(await Z(P));return M((await y(P,!1))?.entity)},async write(g,P,I){if(g==="user"){let h=await S(P);if(!h||h.providerId===I.providerId&&h.requestUrl===I.requestUrl)return;await r.userStore?.upsert({...h,providerId:I.providerId,requestUrl:I.requestUrl});return}if(g==="workload"){let h=await F(P);if(!h||h.providerId===I.providerId&&h.requestUrl===I.requestUrl)return;await r.workloadIdentityStore?.upsert({...h,providerId:I.providerId,requestUrl:I.requestUrl});return}if(g==="customer"){let h=await Z(P);if(!h||h.providerId===I.providerId&&h.requestUrl===I.requestUrl)return;await r.customerStore?.upsert({...h,providerId:I.providerId,requestUrl:I.requestUrl});return}let R=await y(P,!0);if(!R||R.entity.providerId===I.providerId&&R.entity.requestUrl===I.requestUrl)return;await Vr(r.catalogStore,R.kind).set({...R.entity,providerId:I.providerId,requestUrl:I.requestUrl}).ready()},async clear(g,P){if(g==="user"){let L=await S(P);if(!L||L.providerId===void 0&&L.requestUrl===void 0)return;let{providerId:C,requestUrl:m,...f}=L;await r.userStore?.upsert(f);return}if(g==="workload"){let L=await F(P);if(!L||L.providerId===void 0&&L.requestUrl===void 0)return;let{providerId:C,requestUrl:m,...f}=L;await r.workloadIdentityStore?.upsert(f);return}if(g==="customer"){let L=await Z(P);if(!L||L.providerId===void 0&&L.requestUrl===void 0)return;let{providerId:C,requestUrl:m,...f}=L;await r.customerStore?.upsert(f);return}let I=await y(P,!1);if(!I||I.entity.providerId===void 0&&I.entity.requestUrl===void 0)return;let{providerId:R,requestUrl:W,...h}=I.entity;await Vr(r.catalogStore,I.kind).set(h).ready()}},ee=()=>{if(!b()||!t.url)return;let g=t.url;if(n&&o===g&&s===r.catalogStore&&i===r.userStore&&c===r.workloadIdentityStore&&d===r.customerStore&&u===r.codeCatalog&&l===r.fetchImpl)return n;return n=new Kr({baseUrl:t.url,getToken:U,receipts:Y,log:e,fetchImpl:r.fetchImpl}),o=g,s=r.catalogStore,i=r.userStore,c=r.workloadIdentityStore,d=r.customerStore,u=r.codeCatalog,l=r.fetchImpl,n},ae=(g)=>g==="workload"?"Workload":g==="customer"?"Customer":"User",oe=async(g)=>{if(g.subjectType==="workload"){let W=Dt(g.subject),h=ur(g.subject);if(!h&&W)h=await r.workloadIdentityStore?.get(W);let O=h?.externalId??h?.id??W;if(!h||!O)return;return{externalId:O,resourceType:"workload",create:await(r.mapWorkloadToScim?.({...h,externalId:O})??zs({...h,externalId:O}))}}if(g.subjectType==="customer"){let W=Dt(g.subject),h=ur(g.subject);if(!h&&W)h=await r.customerStore?.get(W);let O=h?.externalId??h?.id??W;if(!O)return;let L=h?await(r.mapCustomerToScim?.({...h,externalId:O})??Vs({...h,externalId:O})):{schemas:["urn:ionite:scim:schemas:core:2.0:Customer"],externalId:O,displayName:O,active:!0};return{externalId:O,resourceType:"customer",create:L}}let I=ur(g.subject);if(!I){let W=Dt(g.subject);if(W&&r.userStore)I=await r.userStore.get(W)}let R=I?.externalId;if(!I||!R)return;return{externalId:R,resourceType:"user",create:await(r.mapUserToScim?.(I)??Fs(I))}},K=async(g)=>{let I=ur(g.target);if(!I){let R=Dt(g.target),W=a();if(R&&W)I=g.targetType==="role"?await W.roles.get(R):g.targetType==="permission"?await W.permissions.get(R):await W.groups.get(R)}if(I&&I.requestable!==!0)return"not-requestable";if(!I)return;return{externalId:I.id,create:Fn(I,g.targetType)}},Q=async(g,P)=>{if(!b())return"skipped";if(!k(g.subjectType==="workload"?"workload":g.subjectType==="customer"?"customer":"user"))return"skipped";let I=await oe(g),R=await K(g);if(R==="not-requestable")return"skipped";if(!I||!R)return e.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:P,hasSubject:Boolean(I),hasTarget:Boolean(R),targetType:g.targetType}),"skipped";let W=ee();if(!W)return"skipped";return W.patchGroupMembership({groupExternalId:R.externalId,userExternalId:I.externalId,op:P,groupCreate:R.create,userCreate:I.create,memberType:ae(g.subjectType),subjectResourceType:I.resourceType})},V=async(g,P,I)=>{let R=[],W=new Set,h=(L)=>{let C=`${L.type??"User"}\x00${L.value}`;if(!W.has(C))W.add(C),R.push(L)},O=r.accessStore;if(O)for await(let L of cr((C,m)=>O.listByTarget(P,g.id,{start:C,limit:m}))){let C=await oe(L);if(!C){e.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:g.id,targetType:P});continue}let m=await I.resolveProviderId(C.resourceType,C.externalId,C.create);if(m==="error")throw Error(`IAM delta failed to resolve access subject for ${P}:${g.id}`);if(m==="absent")continue;let f=L.metadata;h({value:m.found,type:ae(L.subjectType),...f?.display?{display:f.display}:{}})}if(P==="group"){let L=a();for(let C of g.groups??[]){let m=Dt(C),f=ur(C);if(!f&&m)f=await L?.groups.get(m);if(f&&f.requestable!==!0)continue;if(!f){e.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:m,target:g.id});continue}let E=await I.resolveProviderId("group",f.id,Fn(f,"group"));if(E==="error")throw Error(`IAM delta failed to resolve nested Group for group:${g.id}`);if(E!=="absent")h({value:E.found,type:"Group"})}}return R.length>0?R:void 0},D=async(g)=>{if(!b()||!k("user"))return"skipped";let P=g.externalId;if(!P)return e.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:g.id,kind:"user"}),"skipped";let I=ee();if(!I)return"skipped";let R=await(r.mapUserToScim?.(g)??Fs(g));return I.upsertResource("user",P,R)},te=async(g)=>{if(!b()||!k("workload"))return"skipped";let P=g.externalId??g.id;if(!P)return"skipped";let I=ee();if(!I)return"skipped";let R=await(r.mapWorkloadToScim?.({...g,externalId:P})??zs({...g,externalId:P}));return I.upsertResource("workload",P,R)},re=async(g)=>{if(!b()||!k("customer"))return"skipped";let P=g.externalId??g.id;if(!P)return"skipped";let I=ee();if(!I)return"skipped";let R=await(r.mapCustomerToScim?.({...g,externalId:P})??Vs({...g,externalId:P}));return I.upsertResource("customer",P,R)},ie=async(g,P,I=!0)=>{if(!b()||!p())return"skipped";let R=a(),h=(R?await Vr(R,P).get(g.id):void 0)??g;if(h.requestable!==!0)return"skipped";let O=ee();if(!O)return"skipped";let L=await V(h,P,O),C=await O.upsertResource("group",h.id,Fn(h,P,L)),m=r.accessStore;if(C!=="pushed"||!I||!m)return C;for await(let f of cr((E,A)=>m.listByTarget(P,g.id,{start:E,limit:A})))if(await Q(f,"add")==="error")throw Error(`IAM delta failed to restore access for ${P}:${g.id}`);return C},se=(g,P)=>{if(g==="error")throw Error(`IAM delta: destination rejected ${P}`)},ce=(g,P,I)=>{if(P==="pushed")g.pushed+=1;else if(P==="skipped")g.skipped+=1;else g.errors.push(`IAM delta: destination rejected ${I}`)},T={async onUserUpsert(g){se(await D(g),"user upsert")},async onUserDelete(g){if(!b()||!k("user"))return;let P=ee();if(!P)return;se(await P.deleteResource("user",g),"user delete")},async onWorkloadUpsert(g){se(await te(g),"workload upsert")},async onWorkloadDelete(g){if(!b()||!k("workload"))return;let P=ee();if(!P)return;se(await P.deleteResource("workload",g),"workload delete")},async onCustomerUpsert(g){se(await re(g),"customer upsert")},async onCustomerDelete(g){if(!b()||!k("customer"))return;let P=ee();if(!P)return;se(await P.deleteResource("customer",g),"customer delete")},async onEntitlementUpsert(g,P){se(await ie(g,P),`${P} upsert`)},async onEntitlementDelete(g,P){if(!b())return;let I=ee();if(!I)return;se(await I.deleteResource("group",P),`${g} delete`)},async onGrant(g){if(!b())return;if(await Q(g,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(g){if(!b())return;if(await Q(g,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async reconcile(g){let P={pushed:0,skipped:0,errors:[]},I=_();if(I)return P.errors.push(`iam delta not ready: ${I}`),P;let R=async(W,h,O)=>{if(!W)return;for await(let L of W)try{ce(P,await h(L),O(L))}catch(C){P.errors.push(C instanceof Error?C.message:String(C))}};return await R(g.groups,(W)=>ie(W,"group",!1),(W)=>`group upsert for ${W.id}`),await R(g.roles,(W)=>ie(W,"role",!1),(W)=>`role upsert for ${W.id}`),await R(g.permissions,(W)=>ie(W,"permission",!1),(W)=>`permission upsert for ${W.id}`),await R(g.users,(W)=>D(W),(W)=>`user upsert for ${W.id??"unknown"}`),await R(g.workloads,(W)=>te(W),(W)=>`workload upsert for ${W.id}`),await R(g.customers,(W)=>re(W),(W)=>`customer upsert for ${W.id??"unknown"}`),await R(g.access,(W)=>Q(W,"add"),(W)=>`membership push for ${Dt(W.target)??"unknown"}`),P},async getDestinationRef(g,P){return Y.read(g,P)},isReady:b,ready:j.ready};return{update(g,P){t=g,r=P,ee(),j.refresh();let I=_();if(!p())w=void 0;else if(I!==w){if(I)e.warn(`IAM delta configured but not ready: ${I}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:I});w=I}return T},handle(){return T}}}var Fr=4,Ru=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"sso.claims_authz",module:"sso",label:"SSO claim-derived entitlements",requires:"sessionStore.capabilities.derivedEntitlements",incapableReason:"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted."},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"ciam.claims_authz",module:"ciam",label:"CIAM claim-derived entitlements",requires:"sessionStore.capabilities.derivedEntitlements",incapableReason:"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted."},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no AccessCatalogStore capability is wired by the application."},{key:"iam.workloads",module:"iam",label:"SCIM Workloads inbound",requires:"workloadIdentityStore",incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."},{key:"iam.customers",module:"iam",label:"SCIM Customers inbound",requires:"customerStore",incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"workload.claims_authz",module:"workload",label:"Workload claim-derived entitlements"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."},{key:"authz.access_requests",module:"authz",label:"IdP access-request lifecycle"},{key:"tm.integration",module:"tm",label:"Tenant Management staged integration and consent",requires:"TenantStore integration methods + onConnectRequest",incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."}];import{IoniteError as Tu}from"@ionite/core";function Cu(e){if(e instanceof Tu)return{status:e.status,statusText:e.statusText};if(typeof e!=="object"||e==null)return;let t=e,r=typeof t.status==="number"?t.status:void 0,n=typeof t.statusText==="string"?t.statusText:void 0;return r!=null||n?{status:r,statusText:n}:void 0}function Kt(e){if(e instanceof Response)return e;let t=Cu(e);if(!t)return Response.json({error:"internal_error"},{status:500});let n={status:t.status??500};if(t.statusText)n.statusText=t.statusText;return Response.json({error:t.statusText??"internal_error"},n)}function ye(){return Response.json({error:"not_found"},{status:404})}function rt(e=["GET"]){return Response.json({error:"method_not_allowed",allow:e},{status:405,headers:{Allow:e.join(", ")}})}import{timingSafeEqual as Iu}from"node:crypto";import{parseKmsPoolDocument as Pu,stableConfigHash as Gs}from"@ionite/core";function Bs(e,t,r){for(let n of e)try{n()}catch(o){t.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:r,error:o instanceof Error?o.message:String(o)})}}function Ke(e,t){let r=new Set,n=new Set;return{beforeChange(o){return r.add(o),()=>{r.delete(o)}},afterChange(o){return n.add(o),()=>{n.delete(o)}},emitBefore(){Bs(r,e,`${t} beforeChange`)},emitAfter(){Bs(n,e,`${t} afterChange`)}}}var Ou=604800000,Eu=2147483647,Au=1;function Xs(e,t){if(!e.value)return!1;if(e.notBefore&&Date.parse(e.notBefore)>t)return!1;if(e.notAfter&&Date.parse(e.notAfter)<=t)return!1;return!0}function We(e,t,r=Date.now()){if(!e)return;let n=e.slots?.[t];if(!n)return;let o=e.keys.find((s)=>s.id===n&&s.state==="active");return o&&Xs(o,r)?o:void 0}function Bn(e,t=Date.now()){if(!e)return[];return e.keys.filter((r)=>(r.state==="active"||r.state==="deprecated")&&Xs(r,t))}function Hs(e){return{...e,...e.meta?{meta:{...e.meta}}:{}}}function zr(e,t,r){if(!t||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>o(Error(r)),t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function Js(e,t){let r=Buffer.from(e),n=Buffer.from(t);return r.length===n.length&&Iu(r,n)}function _u(e){if(!Number.isInteger(e)||e<1)throw Error("KMS unique() requires a positive integer slot count.");return e}var Lu=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function xu(e){return Lu.has(e)}function Ys(e){let t=e.trim().replace(/\/+$/,"");if(!t||t==="/")return"/";return t.startsWith("/")?t:`/${t}`}function Uu(e,t){let r=Ys(e),n=Ys(t);return r===n||r.endsWith(n)}function Mu(e,t,r){let n=Ke(t,`KMS pool "${e}"`),o=new Set,s=!1,i,c,d=0,u,l,w=Au,p,k,q,_=new Map,b=new Set,j,U=()=>i!==void 0&&i.slots===void 0&&i.keys.length>0,a=me(`KMS pool "${e}"`,()=>{if(!s)return!1;if(U())return Bn(i).length>0;return We(i,0)!==void 0}),y=me(`KMS pool "${e}" issuer`,()=>s&&p!==void 0),S=(C)=>C===0?`KMS pool "${e}"`:`KMS pool "${e}" slot ${C}`,M=(C)=>{let m=_.get(C),f=m?.valueWaiter;if(!m||!f)return;if(!s){m.valueWaiter=void 0,f.reject(Error(`${S(C)} is no longer configured.`));return}if(U()){m.valueWaiter=void 0,f.reject(Error(`${S(C)} verifier grant has no slots.`));return}let E=We(i,C);if(E?.value)m.valueWaiter=void 0,f.resolve(E.value)},F=()=>{for(let C of _.keys())M(C)},Z=(C)=>{let m=_.get(C);if(!m)return;let f=We(i,C);for(let E of m.listeners)try{E(f?Hs(f):void 0)}catch(A){t.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:e,slot:C,error:A instanceof Error?A.message:String(A)})}},Y=()=>{for(let C of _.keys())Z(C)},ee=()=>{for(let C of _.values())C.latch.refresh();a.refresh(),y.refresh()},ae=()=>{try{j?.()}catch(C){t.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:e,error:C instanceof Error?C.message:String(C)})}j=void 0},oe=()=>{if(j||b.size===0||!p?.subscribeEvents||!k)return;let C=k;j=p.subscribeEvents((m)=>{if(!xu(m.event)||!Uu(m.path,C))return;let f={path:m.path,event:m.event,...m.requestId===void 0?{}:{requestId:m.requestId},...m.keyId===void 0?{}:{keyId:m.keyId}};for(let E of b)try{E(f)}catch(A){t.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:e,error:A instanceof Error?A.message:String(A)})}})},K=()=>{if(l)clearTimeout(l);l=void 0},Q=()=>{K();let C=Date.now();if(i){for(let f of i.keys){if(!f.notAfter)continue;let E=Date.parse(f.notAfter)-C;if(E>0&&E<=Ou&&(f.state==="active"||f.state==="deprecated")&&!o.has(f.id))o.add(f.id),t.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:e,keyId:f.id,notAfter:f.notAfter})}let m=i.keys.flatMap((f)=>[f.notBefore,f.notAfter]).filter((f)=>Boolean(f)).map((f)=>Date.parse(f)).filter((f)=>f>C).sort((f,E)=>f-E);if(m[0])l=setTimeout(()=>{let f=new Map([..._.keys()].map((E)=>[E,We(i,E)?.id]));ee(),r();for(let E of _.keys())if(f.get(E)!==We(i,E)?.id)Z(E);Q()},Math.min(m[0]-C+1,Eu))}ee(),r(),F()},V=(C)=>{let m=new Map([..._.keys()].map((f)=>{let E=We(i,f);return[f,{id:E?.id,value:E?.value}]}));n.emitBefore();try{i=Pu(C),Q();for(let f of _.keys()){let E=We(i,f),A=m.get(f);if(A?.id!==E?.id||A?.value!==E?.value)Z(f)}}catch(f){i=void 0,Q(),Y(),t.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:e,error:f instanceof Error?f.message:String(f)})}finally{n.emitAfter()}},D=()=>{try{u?.()}catch(C){t.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:e,error:C instanceof Error?C.message:String(C)})}u=void 0},te=(C,m)=>{p=C,k=m,d+=1;let f=d;D(),C.subscribe(m,(E)=>{if(d!==f||!s)return;V(E.data)},{kmsSlots:w}).then((E)=>{if(d!==f||!s){E();return}u=E}).catch((E)=>{if(d!==f||!s)return;i=void 0,Q(),Y(),t.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:e,path:m,error:E instanceof Error?E.message:String(E)})})},re=(C,m)=>{let f=se(C),E=We(i,C);if(!s)return Promise.reject(Error(`${S(C)} is no longer configured.`));if(U())return Promise.reject(Error(`${S(C)} verifier grant has no slots.`));if(E?.value)return Promise.resolve(E.value);if(!f.valueWaiter){let B,J,G=new Promise((de,ne)=>{B=de,J=ne});f.valueWaiter={promise:G,resolve:B,reject:J}}let A=f.valueWaiter.promise;return M(C),zr(A,m,`${S(C)} was not ready within ${m}ms.`)},ie=(C,m)=>{let f=se(C);f.listeners.add(m);let E=We(i,C);return m(E?Hs(E):void 0),()=>f.listeners.delete(m)};function se(C){let m=_.get(C);if(m)return m;let f=me(S(C),()=>s&&We(i,C)!==void 0),E={listeners:new Set,latch:f,api:{value:(A)=>re(C,A),current:()=>We(i,C)?.value,subscribe:(A)=>ie(C,A),park:(A,B)=>g(A,B),isReady:f.isReady,ready:f.ready}};return _.set(C,E),E}let ce=(C)=>{if(U())throw Error(`KMS pool "${e}" verifier grant has no slots.`);let m=_u(C),f=m>w;w=Math.max(w,m);let E=[];for(let A=0;A<m;A+=1)E.push(se(A).api);if(f&&s&&p&&k)te(p,k);return E},T=(C)=>Bn(i).find((m)=>m.value!==void 0&&Js(C,m.value)),g=(C,m)=>{if(!s||!p||!k)return Promise.reject(Error(`KMS pool "${e}" is not configured.`));if(typeof C.value!=="string"||C.value.length===0)return Promise.reject(Error(`KMS pool "${e}" park() requires a non-empty value.`));let f=T(C.value);if(!f)return Promise.resolve({parked:!1,stale:!0});return zr(p.parkKmsKey(k,{keyId:f.id,status:C.status,reason:C.reason},m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" park() did not complete within ${m}ms.`)},P=()=>{if(!s||!p||!k)throw Error(`KMS pool "${e}" is not configured.`);return{source:p,path:k}},I=(C)=>{if(!Array.isArray(C)||C.length===0)throw Error(`KMS pool "${e}" addKeys() requires a non-empty keys array.`);return C.map((m,f)=>{if(!m||typeof m!=="object")throw Error(`KMS pool "${e}" addKeys() keys[${f}] must be an object.`);if(typeof m.value!=="string"||m.value.length===0)throw Error(`KMS pool "${e}" addKeys() keys[${f}].value must be a non-empty string.`);if(m.id!==void 0&&(typeof m.id!=="string"||m.id.length===0))throw Error(`KMS pool "${e}" addKeys() keys[${f}].id must be a non-empty string when present.`);return m})},R=(C,m)=>{try{let{source:f,path:E}=P(),A=I(C);return zr(f.addKmsKeys(E,{keys:A},m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" addKeys() did not complete within ${m}ms.`)}catch(f){return Promise.reject(f)}},W=(C,m)=>{try{let{source:f,path:E}=P();if(typeof C.keyId!=="string"||C.keyId.length===0)throw Error(`KMS pool "${e}" revokeKey() requires a non-empty keyId.`);return zr(f.revokeKmsKey(E,C,m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" revokeKey() did not complete within ${m}ms.`)}catch(f){return Promise.reject(f)}},h=(C)=>{let{source:m}=P();if(!m.subscribeEvents)throw Error(`KMS pool "${e}" events are not supported by this secrets transport.`);return b.add(C),oe(),()=>{b.delete(C)}};se(0);let O={describe:()=>ve({name:e,source:q,path:k??`/kms/${e}`,ready:a.isReady()}),value:(C)=>re(0,C),current:()=>We(i,0)?.value,unique:ce,accepts:(C)=>Bn(i).some((m)=>m.value!==void 0&&Js(C,m.value)),park:g,subscribe:(C)=>ie(0,C),beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:a.isReady,ready:a.ready},L={addKeys:R,revokeKey:W,events:h,isReady:y.isReady,ready:y.ready};return{api:O,issuer:L,update(C,m,f){let E=Gs({config:C,path:f});if(s=!0,q=C.source,c===E){ee();return}c=E,D(),ae(),K(),i=void 0,ee(),r(),Y(),F(),te(m,f),oe()},unavailable(C){s=!0,q=C.source,c=Gs(C),d+=1,p=void 0,k=void 0,ae(),D(),K(),i=void 0,ee(),r(),Y(),F()},remove(){if(!s)return;n.emitBefore(),s=!1,c=void 0,q=void 0,d+=1,p=void 0,k=void 0,ae(),D(),K(),i=void 0,ee(),r(),Y(),F(),n.emitAfter()},close(){s=!1,d+=1,p=void 0,k=void 0,ae(),b.clear(),D(),K();for(let C of _.values())C.listeners.clear();i=void 0,F();for(let C of _.values())C.latch.settle();a.settle(),y.settle()},isConfigured:()=>s}}function Zs(e){let t=new Map,r=new Map,n=Ke(e,"KMS"),o=!1,i=me("KMS module",()=>o&&Array.from(t.values()).every((p)=>!p.isConfigured()||p.api.isReady())),c,d=()=>i.refresh(),u=(p)=>{let k=t.get(p);if(k)return k;let q=Mu(p,e,d);if(t.set(p,q),!(p in c))Object.assign(c,{[p]:q.api});return q},l=(p)=>{let k=t.get(p);if(!k)throw Error(`KMS pool "${p}" is not configured.`);return k.api},w=(p)=>{let k=t.get(p);if(!k)throw Error(`KMS pool "${p}" is not configured.`);return k.issuer};return c={describe:()=>({module:"kms",active:o,ready:i.isReady(),pools:Array.from(r.keys(),(p)=>u(p).api.describe())}),get config(){return Object.fromEntries(r)},beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:i.isReady,ready:i.ready,listPools:()=>Array.from(r.keys()),getPool:l,issuer:w},{handle:()=>c,update(p,k){if(!p&&!o&&t.size===0)return;n.emitBefore(),o=p!==void 0;let q=new Set(Object.keys(p??{}));for(let[_,b]of Object.entries(p??{})){r.set(_,{...b});let j=b.path??`/kms/${_}`;try{u(_).update(b,k(b),j)}catch(U){u(_).unavailable(b),e.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:_,error:U instanceof Error?U.message:String(U)})}}for(let[_,b]of t){if(q.has(_))continue;r.delete(_),b.remove()}return i.refresh(),n.emitAfter(),o||t.size>0?c:void 0},close(){for(let p of t.values())p.close();t.clear(),r.clear(),o=!1,i.settle()}}}import{ACCEPT_JSON as Wu,CONTENT_TYPE_FORM as qu,formatLogLine as ju,readJsonResponse as $u}from"@ionite/core";import{context as Nu,trace as Du}from"@opentelemetry/api";import{logs as Ku,SeverityNumber as Je}from"@opentelemetry/api-logs";import{OTLPLogExporter as Vu}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as Fu}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as zu}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as Bu}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as Gu}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as Hu}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as Ju}from"@opentelemetry/resources";import{BatchLogRecordProcessor as Yu}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as Xu}from"@opentelemetry/sdk-metrics";import{NodeSDK as Zu}from"@opentelemetry/sdk-node";var Qs={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},Qu={trace:!1,debug:!1,info:!0,warn:!0,error:!0},ed={trace:Je.TRACE,debug:Je.DEBUG,info:Je.INFO,warn:Je.WARN,error:Je.ERROR};function Gn(e,t){let r=t[e];if(r===!1)return!1;if(e==="metrics")return r===!0||typeof r==="object";return!0}function Xn(e){return typeof e==="object"&&e!==null?e:void 0}function td(e){return typeof e==="object"&&e!==null?e:void 0}function rd(e,t){let r=e.replace(/\/+$/,"");if(r.endsWith(Qs[t]))return r;return`${r}${Qs[t]}`}function nd(e,t){let r=Xn(e[t]);if(r?.endpoint)return r.endpoint;if(!e.endpoint)return;return rd(e.endpoint,t)}function od(e,t,r){let n=Xn(e[t]),o={...e.headers,...n?.headers??{}};if(r)o.Authorization=`Bearer ${r}`;return o}function Zn(e,t,r){let n=Xn(e[t]);return{url:nd(e,t),headers:od(e,t,r),timeoutMillis:n?.timeoutMillis,concurrencyLimit:n?.concurrencyLimit}}function sd(e,t){let r=Zn(e,"traces",t);return e.protocol==="http/json"?new Gu(r):new Hu(r)}function id(e,t){let r=Zn(e,"metrics",t);return e.protocol==="http/json"?new zu(r):new Bu(r)}function ad(e,t){let r=Zn(e,"logs",t);return e.protocol==="http/json"?new Vu(r):new Fu(r)}function cd(e){return{"service.name":e.name,...e.version?{"service.version":e.version}:{},...e.deploymentEnvironment?{"deployment.environment.name":e.deploymentEnvironment}:{},...e.resourceAttributes??{}}}async function ud(e,t){if(!e.oauth)return;let r=new URLSearchParams({grant_type:"client_credentials",client_id:e.oauth.clientId,client_secret:e.oauth.clientSecret});if(e.oauth.scope)r.set("scope",e.oauth.scope);if(e.oauth.audience)r.set("audience",e.oauth.audience);let n=await fetch(e.oauth.tokenUrl,{method:"POST",headers:{...Wu,...qu,...e.oauth.headers??{}},body:r});if(!n.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${n.status}`);let o=await $u(n,{log:t,operation:"otel.oauth.token",redact:!0});if(typeof o.access_token!=="string"||!o.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return o.access_token}function dd(e,t){return{...Qu,...t?.levels??{},...e.levels??{}}}function dr(e,t="Authorization"){let r={...e.headers??{}};if(!e.apiKey)return r;let n=e.apiKeyHeader??t;return r[n]=n.toLowerCase()==="authorization"?`Bearer ${e.apiKey}`:e.apiKey,r}function ld(e,t){return Object.keys(e).some((r)=>r.toLowerCase()===t.toLowerCase())}function ti(e,t,r){let n=Object.keys(e).find((o)=>o.toLowerCase().startsWith(t.toLowerCase()));if(n)throw Error(`OpenTelemetry provider "${r}" does not support provider-specific header "${n}".`)}function lr(e,t,r,n){return{type:r,name:e.name,version:e.version,protocol:e.protocol??"http/protobuf",endpoint:e.endpoint,headers:n,resourceAttributes:cd(e),levels:dd(e,t),console:e.console??"info",traces:e.traces,metrics:e.metrics,logs:e.logs}}function fd(e,t){return lr(e,t,"otlp",dr(e))}function pd(e,t){return lr(e,t,"grafana-lgtm",dr(e))}function md(e,t){let r=dr(e,"DD-API-KEY");if(!ld(r,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return lr(e,t,"datadog",r)}function gd(e,t){let r=dr(e);return ti(r,"DD-","splunk"),lr(e,t,"splunk",r)}function yd(e,t){let r=dr(e);return ti(r,"DD-","elastic"),lr(e,t,"elastic",r)}function hd(e,t){let r=e.type??"otlp";switch(r){case"otlp":return fd(e,t);case"grafana-lgtm":return pd(e,t);case"datadog":return md(e,t);case"splunk":return gd(e,t);case"elastic":return yd(e,t);default:throw Error(`Unsupported OpenTelemetry provider type: ${r}`)}}function wd(e,t){if(typeof e==="string")return e;if(e instanceof Error)return e.message;if(e!=null)return Jn(e);if(t.length===0)return"";return Jn(t[0])}function Jn(e){if(typeof e==="string")return e;try{return JSON.stringify(e)}catch{return String(e)}}function ei(e,t,r){if(r==null)return;if(typeof r==="string"||typeof r==="number"||typeof r==="boolean"){e[t]=r;return}if(Array.isArray(r)&&r.every((n)=>["string","number","boolean"].includes(typeof n))){e[t]=r;return}if(r instanceof Error){if(e[`${t}.name`]=r.name,e[`${t}.message`]=r.message,r.stack)e[`${t}.stack`]=r.stack;return}e[t]=Jn(r)}function vd(e){let t={};for(let[n,o]of e.entries()){if(o&&typeof o==="object"&&!Array.isArray(o)&&!(o instanceof Error)&&Object.getPrototypeOf(o)===Object.prototype){for(let[s,i]of Object.entries(o))ei(t,s,i);continue}ei(t,`param.${n}`,o)}let r=Du.getSpanContext(Nu.active());if(r)t.trace_id=r.traceId,t.span_id=r.spanId,t.trace_flags=r.traceFlags;return t}function Sd(e){return e}function kd(e,t){globalThis.console[Sd(e)](ju(e,t.body,[t.attributes??{}]))}function bd(e,t,r,n){if(r.console==="off")return;if((t.severityNumber??0)<ed[r.console])return;let o=n?.console;if(o){o(t);return}kd(e,t)}function Rd(e,t){let r=Ku.getLogger(e.name,e.version),n=(o,s,i)=>{if(!e.levels[o])return;let c={severityNumber:s,severityText:o.toUpperCase(),body:wd(i[0],i.slice(1)),attributes:vd(i.slice(1))};try{r.emit(c)}finally{bd(o,c,e,t)}};return{trace:(o,...s)=>n("trace",Je.TRACE,[o,...s]),debug:(o,...s)=>n("debug",Je.DEBUG,[o,...s]),info:(o,...s)=>n("info",Je.INFO,[o,...s]),warn:(o,...s)=>n("warn",Je.WARN,[o,...s]),error:(o,...s)=>n("error",Je.ERROR,[o,...s])}}function Td(e){return e?.current()}function Cd(e,t,r){let n=t;return e.subscribe((o)=>{let s=o?.value;if(s===n)return;n=s,r()})}function Hn(e){if(!e)return{enabled:!1};if(e===!0)return{enabled:!0};return{enabled:!0,endpoint:e.endpoint,timeoutMillis:e.timeoutMillis,concurrencyLimit:e.concurrencyLimit,exportIntervalMillis:e.exportIntervalMillis,exportTimeoutMillis:e.exportTimeoutMillis}}function ri(e,t,r){return()=>ve({module:"otel",active:t,ready:r(),type:e?.type,name:e?.name,endpoint:e?.endpoint,protocol:e?.protocol,apiKeyPool:e?.apiKeyPool,apiKeyHeader:e?.apiKeyHeader,oauth:e?.oauth?{tokenUrl:e.oauth.tokenUrl,clientId:e.oauth.clientId,scope:e.oauth.scope,audience:e.oauth.audience}:void 0,version:e?.version,deploymentEnvironment:e?.deploymentEnvironment,resourceAttributes:e?.resourceAttributes,levels:e?.levels,console:e?.console,signals:{traces:Hn(e?.traces),metrics:Hn(e?.metrics),logs:Hn(e?.logs)}})}function Yn(e,t){return{state:"unavailable",describe:ri(t,t!==void 0,()=>!1),beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:e,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function Qn(e,t,r,n){if(!t&&!r)return;if(!t)return Yn(e);let o=t,s;if(o.apiKeyPool&&n)try{s=n.getPool(o.apiKeyPool)}catch{s=void 0}let i=Td(s),c=()=>Qn(e,o,r,n),d=o.apiKeyPool&&n?(U)=>Cd(n.getPool(o.apiKeyPool),i,U):void 0;if(o.apiKeyPool&&!i){let U=Yn(e,o);return U.onCredentialChange=d,U.rebuild=c,U}let u=i?{...o,apiKey:i}:o,l=hd(u,r),w,p=!1,k=Rd(l,r),q,_,b=new Promise((U,a)=>{q=U,_=a});async function j(){try{let U=await ud(o,e),a={resource:Ju(l.resourceAttributes),instrumentations:r?.instrument};if(r?.sampler)a.sampler=r.sampler;if(r?.textMapPropagator)a.textMapPropagator=r.textMapPropagator;if(r?.contextManager)a.contextManager=r.contextManager;if(r?.spanProcessors)a.spanProcessors=r.spanProcessors;else if(Gn("traces",l))a.traceExporter=sd(l,U);if(r?.metricReaders)a.metricReaders=r.metricReaders;else if(Gn("metrics",l)){let S=td(l.metrics);a.metricReaders=[new Xu({exporter:id(l,U),exportIntervalMillis:S?.exportIntervalMillis,exportTimeoutMillis:S?.exportTimeoutMillis})]}if(r?.logRecordProcessors)a.logRecordProcessors=r.logRecordProcessors;else if(Gn("logs",l))a.logRecordProcessors=[new Yu({exporter:ad(l,U)})];let y=r?.configure?.(a);w=new Zu(y??a),w.start(),p=!0,q?.()}catch(U){p=!1;let a=U instanceof Error?U:Error(String(U));e.error?.("OpenTelemetry startup failed",a),_?.(a)}finally{q=void 0,_=void 0}}return{state:"available",describe:ri(o,!0,()=>p),start:j,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>p,ready:(U)=>{if(!U||U<=0)return b;return Promise.race([b,new Promise((a,y)=>{setTimeout(()=>y(Error(`OpenTelemetry ready timed out after ${U}ms.`)),U)})])},logger:k,forceFlush:async()=>{await w?.forceFlush?.()},shutdown:async()=>{p=!1,await w?.shutdown(),w=void 0},onCredentialChange:d,rebuild:c}}function ni(e){let t,r,n,o=0,s=Promise.resolve(),i=Ke(e,"OpenTelemetry"),c=me("OpenTelemetry module",()=>t?.isReady()===!0),d=Yn(e),u={describe:()=>(t??d).describe(),beforeChange:i.beforeChange,afterChange:i.afterChange,isReady:c.isReady,ready:c.ready,logger:{trace:(p,...k)=>(t?.logger??e).trace(p,...k),debug:(p,...k)=>(t?.logger??e).debug(p,...k),info:(p,...k)=>(t?.logger??e).info(p,...k),warn:(p,...k)=>(t?.logger??e).warn(p,...k),error:(p,...k)=>(t?.logger??e).error(p,...k)},forceFlush:async()=>{await t?.forceFlush()},shutdown:async()=>{await t?.shutdown()}},l=!1,w;return w={update(p){if(!p){if(t||r){let b=t,j=r;o+=1,i.emitBefore(),n?.(),n=void 0,t=void 0,r=void 0,c.refresh(),s=Promise.all([b?.shutdown(),j?.shutdown()]).finally(()=>i.emitAfter()).then(()=>{return},()=>{return})}return l?u:void 0}if(l=!0,p===t||p===r)return u;let k=t,q=r;o+=1;let _=o;return i.emitBefore(),n?.(),n=void 0,t=void 0,r=p,c.refresh(),s=(async()=>{try{if(await Promise.all([k?.shutdown(),q?.shutdown()]),await p.start(),_!==o||r!==p){await p.shutdown();return}t=p,r=void 0,c.refresh(),n=p.onCredentialChange?.(()=>{if(t!==p)return;let b=p.rebuild?.();if(b)w.update(b)})}finally{if(_===o)i.emitAfter()}})().then(()=>{return},()=>{return}),u},settled(){return s},async shutdown(){o+=1;let p=t,k=r;n?.(),n=void 0,t=void 0,r=void 0,c.settle(),await Promise.all([p?.shutdown(),k?.shutdown()])}},w}import{ION_ENDPOINT_PERMISSIONS as Vt,trimTrailingSlash as oi}from"@ionite/core";import{hasPermission as Id}from"@ionite/core/server";async function fr(e,t,r){let n=await Id(e,t,r.permission,void 0,r.subjectType);return n.allow?void 0:n.response()}function Pd(e){let t=oi(e);return{matchesPath:(o)=>{if(!o)return!1;return oi(o)===t},startsWithPath:(o)=>{if(!o)return!1;return e===o||e.startsWith(`${o}/`)}}}function si(e,t,r,n){let o=n??new URL(e.url).pathname,{matchesPath:s,startsWithPath:i}=Pd(o);if(t.sso){let c=t.sso;if(s(r.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(d)=>c.handler(d)};if(s(r.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(d)=>c.logout(d)};if(s(r.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(d)=>c.logoutBackChannel(d)};if(s(r.sso.loginUrl)||s(r.sso.refreshUrl)||s(r.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(d)=>c.handler(d)}}if(t.ciam){let c=t.ciam;if(s(r.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(d)=>c.customerHandler(d)};if(s(r.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(d)=>c.logout(d)}}if(t.iam){let c=t.iam,d=e.method!=="GET"&&e.method!=="HEAD";if(i(r.iam.usersUrl))return{module:"iam",kind:d?"iam.users.write":"iam.read",requiredPermission:Vt[d?"iam.users.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.groupsUrl))return{module:"iam",kind:d?"iam.groups.write":"iam.read",requiredPermission:Vt[d?"iam.groups.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.workloadsUrl))return{module:"iam",kind:d?"iam.workloads.write":"iam.read",requiredPermission:Vt[d?"iam.workloads.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.customersUrl))return{module:"iam",kind:d?"iam.customers.write":"iam.read",requiredPermission:Vt[d?"iam.customers.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(`${r.iam.basePath}/AccessRequests`))return{module:"iam",kind:"iam.access-requests.write",requiredPermission:Vt["iam.access-requests.write"],handler:async(u)=>c.handler(u)};if(i(r.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(u)=>c.handler(u)}}if(t.workload){let c=t.workload;if(s(r.workload.validateUrl)||s(r.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(d)=>c.handler(d)}}if(t.secrets){let c=t.secrets;if(c.isLfvDeliveryRequest?.(e)&&c.handleLfvDelivery){let d=c.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(u)=>d(u)}}if(c.isLfvEventsRequest?.(e)&&c.handleLfvEvents){let d=c.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(u)=>d(u)}}}if(t.ciam){let c=t.ciam;if(s(r.ciam.magicLinkUrl)&&e.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:Vt["ciam.magic-link.create"],handler:async(d)=>c.handler(d)};if(s(r.ciam.magicLinkLoginUrl)&&e.method==="GET"||s(r.ciam.customerProvidersUrl)&&e.method==="GET"||s(r.ciam.customerLoginUrl)&&e.method==="GET"||s(r.ciam.customerCallbackUrl)&&(e.method==="GET"||e.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(d)=>c.handler(d)}}return}async function eo(e,t,r,n){let o=n??Fe(Er()),s=new URL(e.url).pathname;if(r?.filter){let w=await r.filter(e,t);if(w instanceof Response)return w;if(w==="not_handled")return ye()}let i=si(e,t,o,s),d=await r?.resolve?.(e,t,i)??i;if(!d)return ye();let u=d.requiredPermission===void 0?i?.requiredPermission:d.requiredPermission,l=async()=>{if(u){let w=await fr(e,t,u);if(w)return w}return d.handler(e)};if(r?.wrap)return await r.wrap(e,d,l,t);return await l()}import{stableConfigHash as Yd}from"@ionite/core";function Br(){let e=0;return{next:()=>(e+=1,e),isCurrent:(t)=>t===e,current:()=>e}}import{readFile as Fd,stat as zd}from"node:fs/promises";import{ACCEPT_JSON as Bt,CONTENT_TYPE_FORM as Ii,CONTENT_TYPE_JSON as Bd,readJsonResponse as Xr}from"@ionite/core";import{ACCEPT_JSON as io,CONTENT_TYPE_FORM as $d,CONTENT_TYPE_JSON as Ci,readJsonResponse as Rt}from"@ionite/core";class Ft extends Error{constructor(e,t,r){super(e);this.code=t;this.status=r;this.sourceType="vault";this.name="VaultWebSocketCommandError"}}class nt extends Error{constructor(e,t=`Vault secret not found at path ${e}`){super(t);this.path=e;this.sourceType="vault";this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}}class he extends Error{constructor(e,t,r,n,o){super(e,o);this.path=t;this.status=r;this.code=n;this.sourceType="vault";this.name="VaultRequestError"}}class qe extends Error{constructor(e,t,r=`Vault subscribe is not supported for source ${e} at path ${t} without websocket, LFV, or ttl`){super(r);this.sourceType=e;this.path=t;this.name="VaultSubscribeNotSupportedError"}}function ii(e){return e instanceof nt||e instanceof Ft&&(e.code==="not_found"||e.status===404)}import{WebSocket as pr}from"ws";var Od=1000,Ed=30000,ci=30000,ui=ci;function di(e){ui=e>0?e:ci}function li(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Ad(e){let t=Math.min(Ed,Od*2**Math.min(e,16)),r=0.5+Math.random()*0.5;return Math.round(t*r)}var bt=new Map;function _d(e){return e.trim().replace(/\/+$/g,"")}function fi(e,t){let r=typeof t?.version==="number"?t.version:0,n=t?.created_time??t?.created,o=typeof n==="string"?new Date(n):new Date,s=wt(t);return{path:e,version:r,created:o,...s?{contentType:s}:{}}}function Ld(e){return typeof e?.version==="number"?e.version:void 0}function xd(e){let t=e.token?.trim();if(!t)return{};if(e.header==="Authorization")return{Authorization:t.startsWith("Bearer ")?t:`Bearer ${t}`};return{"X-Vault-Token":t}}function mr(e){return{client_id:e.clientId,token:e.token,header:e.header??"X-Vault-Token"}}function ro(e,t){let r=_d(e),n=bt.get(r);if(n){if(t&&!n.log)n.log=t;return n}let o={url:r,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:t};return bt.set(r,o),o}function Ud(e){let t=[...Array.from(e.subs.values(),(o)=>o.creds),...e.eventListeners.values()];if(t.length===0)return e.lastGoodCreds??{url:e.url};let r=e.lastGoodCreds?[e.lastGoodCreds,...t]:t,n=r[e.reconnectCredCursor%r.length]??t[0];return e.reconnectCredCursor+=1,n}function ai(e,t){for(let r of e.subs.values())try{r.onHealth?.(t)}catch(n){e.log?.warn("Vault websocket health hook threw",n)}}function Md(e,t){for(let r of Array.from(e.subs.values())){let n=r.onFirstSecretReject;if(r.onFirstSecret=void 0,r.onFirstSecretReject=void 0,n)try{n(new he(`Vault websocket subscription interrupted (${t})`,r.path,void 0,"connection"))}catch(o){e.log?.warn("Vault websocket first-secret waiter rejection threw",o)}}}function pi(e,t){for(let r of e.pending.values())clearTimeout(r.timer),r.reject(new he(`Vault websocket command interrupted (${t})`,"/",void 0,"connection"));e.pending.clear()}function Gr(e){if(e.disposed)return;if(e.disposed=!0,e.reconnectTimer)clearTimeout(e.reconnectTimer),e.reconnectTimer=void 0;pi(e,"closed"),Md(e,"socket disposed");let t=e.ws;if(e.ws=void 0,e.connectPromise=void 0,e.hasConnected=!1,bt.delete(e.url),t)try{t.removeAllListeners(),t.close()}catch{}}function Hr(e){if(e.subs.size>0||e.pending.size>0||e.eventListeners.size>0)return;Gr(e)}function to(e){return`${e.clientId??""}|${e.token??""}|${e.header??"X-Vault-Token"}`}function mi(e){let t=new Map;for(let r of e.eventListeners.values())t.set(to(r),r);return Array.from(t.values())}function Wd(e,t){if(typeof t.path!=="string"||typeof t.event!=="string")return;let r={path:t.path,event:t.event,...typeof t.request_id==="string"?{requestId:t.request_id}:{},...typeof t.key_id==="string"&&t.key_id.length>0?{keyId:t.key_id}:{}};for(let n of e.eventListeners.keys())try{n(r)}catch(o){e.log?.warn("Vault websocket event listener threw",o)}}function gi(e,t,r,n){if(n!==void 0&&t.lastVersion!==void 0&&n===t.lastVersion)return;if(n!==void 0)t.lastVersion=n;try{t.onChange(r)}catch(s){e.log?.warn("Vault websocket subscription onChange threw",s)}let o=t.onFirstSecret;if(t.onFirstSecret=void 0,t.onFirstSecretReject=void 0,o)try{o()}catch(s){e.log?.warn("Vault websocket subscription onFirstSecret threw",s)}}function qd(e,t){let r=t.subscription_id;if(typeof r!=="string")return;let n=e.subs.get(r);if(!n)return;let o={data:t.data,metadata:fi(typeof t.path==="string"?t.path:n.path,t.metadata)};gi(e,n,o,Ld(t.metadata))}function jd(e,t){let r;try{r=JSON.parse(t.toString())}catch(n){e.log?.warn("Vault websocket message parse failed",n);return}if(r.type==="secret"){qd(e,r);return}if(r.type==="event"){Wd(e,r);return}if(r.type==="command_result"&&typeof r.id==="string"){let n=e.pending.get(r.id);if(!n)return;if(e.pending.delete(r.id),clearTimeout(n.timer),r.ok===!1)n.reject(new Ft(r.error??`Vault websocket command failed for ${r.id}`,r.code,r.status));else n.resolve(r.result);Hr(e)}}function yi(e,t){e.send(JSON.stringify({type:"subscribe",subscription_id:t.subscriptionId,paths:[t.path],...li(t.kmsSlots),...mr(t.creds)}))}function no(e){if(e.disposed||e.reconnectTimer||e.subs.size===0&&e.eventListeners.size===0)return;let t=Ad(e.reconnectAttempts);e.reconnectAttempts+=1,e.reconnectTimer=setTimeout(()=>{if(e.reconnectTimer=void 0,e.disposed)return;if(e.subs.size===0&&e.eventListeners.size===0){Gr(e);return}Jr(e,Ud(e)).catch(()=>{if(e.hasConnected)e.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${t}ms).`);no(e)})},t)}function Jr(e,t){if(e.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if(e.ws&&e.ws.readyState===pr.OPEN)return Promise.resolve(e.ws);if(e.connectPromise)return e.connectPromise;return e.connectPromise=new Promise((r,n)=>{let o=new pr(e.url,{headers:xd(t)}),s=!1,i=e.hasConnected,c=()=>{s=!0,e.hasConnected=!0,e.reconnectAttempts=0,e.reconnectCredCursor=0,e.lastGoodCreds=t,e.ws=o,e.connectPromise=void 0,o.on("message",(l)=>jd(e,l));for(let l of e.subs.values())try{yi(o,l)}catch{}for(let l of mi(e))try{o.send(JSON.stringify({type:"subscribe_events",...mr(l)}))}catch{}if(i)ai(e,!0);r(o)},d=()=>{if(e.ws===o)e.ws=void 0;e.connectPromise=void 0;try{o.removeAllListeners()}catch{}if(pi(e,"socket closed"),e.subs.size>0||e.eventListeners.size>0)ai(e,!1),no(e);else Gr(e)},u=(l)=>{if(e.ws===o)e.ws=void 0;if(!s)s=!0,e.connectPromise=void 0,n(l)};o.once("open",c),o.on("close",d),o.on("error",u)}),e.connectPromise}async function oo(e,t,r,n){let o=ro(e.url,n),s=typeof r.path==="string"?r.path:"/",i=await Jr(o,e),c=crypto.randomUUID();try{return await new Promise((d,u)=>{let l=setTimeout(()=>{if(!o.pending.has(c))return;o.pending.delete(c),u(new he(`Vault websocket command "${t}" timed out`,s,void 0,"timeout"));try{o.ws?.close()}catch{}},ui);o.pending.set(c,{resolve:(w)=>d(w),reject:u,timer:l});try{i.send(JSON.stringify({type:"command",id:c,command:t,...r,...mr(e)}))}catch(w){clearTimeout(l),o.pending.delete(c),u(w)}})}finally{Hr(o)}}async function so(e,t,r,n){let o;try{o=await oo(e,"read_secret",{path:t,...li(n)},r)}catch(s){if(ii(s))throw new nt(t);if(s instanceof Ft||s instanceof he)throw s;throw new he(`Vault websocket read_secret failed for ${t}`,t,void 0,"connection",{cause:s})}if(!o||typeof o!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${t}`);return{data:o.data,metadata:fi(typeof o.path==="string"?o.path:t,o.metadata)}}async function hi(e,t,r,n,o,s){let i=ro(e.url,o),c=crypto.randomUUID(),d={subscriptionId:c,creds:e,path:t,...n?.kmsSlots!==void 0?{kmsSlots:n.kmsSlots}:{},onChange:r,onHealth:s?.onHealth};i.subs.set(c,d);let u=()=>{if(!i.subs.delete(c))return;if(i.ws&&i.ws.readyState===pr.OPEN)try{i.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:c}))}catch{}Hr(i)};try{let l=await Jr(i,e);yi(l,d)}catch(l){if(n?.mode!=="wait")throw u(),l}try{let l=await so(e,t,o,n?.kmsSlots);gi(i,d,l,l.metadata.version)}catch(l){if(n?.mode!=="wait")throw u(),l;await new Promise((w,p)=>{let k,q=(_)=>{if(k)clearTimeout(k);d.onFirstSecret=void 0,d.onFirstSecretReject=void 0,u(),p(_)};if(d.onFirstSecret=()=>{if(k)clearTimeout(k);w()},d.onFirstSecretReject=q,typeof n.timeout==="number"&&n.timeout>0)k=setTimeout(()=>q(l),n.timeout)})}return u}async function wi(e,t,r){let n=ro(e.url,r);n.eventListeners.set(t,e);try{let o=await Jr(n,e);if(o.readyState===pr.OPEN)o.send(JSON.stringify({type:"subscribe_events",...mr(e)}))}catch(o){n.log?.warn("Vault websocket event subscription connect failed; retrying in background",o),no(n)}return()=>{if(!n.eventListeners.delete(t))return;let o=to(e);if(!mi(n).some((i)=>to(i)===o)&&n.ws&&n.ws.readyState===pr.OPEN)try{n.ws.send(JSON.stringify({type:"unsubscribe_events",...mr(e)}))}catch{}Hr(n)}}function vi(){let e=0;for(let t of bt.values())e+=t.subs.size;return{urls:Array.from(bt.keys()),sockets:bt.size,subscriptions:e}}function Si(){for(let e of Array.from(bt.values()))Gr(e)}var Yr=600000;function Tt(e){if(e&&e<Yr)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${Yr} milliseconds (10 minutes), as not to overload the store with polling requests`)}function ot(e,t,r,n,o,s,i){let c=!1,d,u,l,w=(j)=>{try{i?.onHealth?.(j)}catch{}},p=()=>{if(c=!0,d)clearTimeout(d),d=void 0;u?.()},k=(j)=>new Promise((U)=>{let a=setTimeout(()=>{u=void 0,d=void 0,U()},j);d=a,u=()=>{clearTimeout(a),u=void 0,d=void 0,U()}});async function q(){let j=Date.now();for(;;){if(c)return;try{let U=await e.getFullSecret(t,s);return w(!0),U}catch(U){if(w(!1),s?.mode!=="wait")throw U;if(typeof s.timeout==="number"&&s.timeout>0&&Date.now()-j>=s.timeout)throw U;if(c)return;o?.warn(`Error retrieving initial secret from vault. Retrying in ${n} milliseconds`,U),await k(n)}}}async function _(){if(d=void 0,c)return;try{let j=await e.getFullSecret(t,s);if(w(!0),j.metadata.version!==l)l=j.metadata.version,r(j)}catch(j){w(!1),o?.warn(`Error retrieving remote config from vault. Retrying in ${n} milliseconds`,j)}b()}function b(){if(c)return;d=setTimeout(()=>{_()},n)}return q().then((j)=>{if(c||!j)return()=>p();return l=j.metadata.version,r(j),b(),()=>p()})}function Nd(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Dd(e){let t={...io,...Ci};if(e)t["X-Vault-Token"]=e;return t}function Kd(e){return Boolean(e?.idpTokenUrl?.trim()&&e.clientId?.trim()&&e.clientSecret?.trim())}async function ki(e,t,r){let n=Date.now();if(t.token&&t.expiresAt&&t.expiresAt-60000>n)return t.token;let o=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});if(e.scope?.trim())o.set("scope",e.scope.trim());let s=await fetch(e.idpTokenUrl,{method:"POST",headers:{...io,...$d},body:o.toString()});if(!s.ok)throw Error(`Vault workload token request failed (${s.status})`);let i=await Rt(s,{log:r,operation:"vault.workload.token",redact:!0});if(!i.access_token)throw Error("Vault workload token response did not include access_token");return t.token=i.access_token,t.expiresAt=n+Math.max(1,i.expires_in??300)*1000,i.access_token}function Vd(e){return{Authorization:e.startsWith("Bearer ")?e:`Bearer ${e}`}}function gr(e){return e.replace(/\/data\/?$/,"")}function bi(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let n=e;if(typeof n.parked!=="boolean")throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let o=n.disposition;if(o!==void 0&&o!=="cooldown"&&o!=="suspect")throw Error(`Vault ${r} kms_park returned invalid disposition for ${t}`);return{parked:n.parked,...n.stale===!0?{stale:!0}:{},...o?{disposition:o}:{}}}function Ri(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);let n=e;if(!Array.isArray(n.keys))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);return{keys:n.keys.map((s,i)=>{if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}] for ${t}`);let c=s.id;if(typeof c!=="string"||c.length===0)throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}].id for ${t}`);return{id:c}})}}function Ti(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);let n=e;if(typeof n.revoked!=="boolean")throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);return{revoked:n.revoked}}function zt(e,t){let{type:r="vault",url:n,token:o,ttl:s}=e,i=()=>e.log,c=Kd(e.workload)?e.workload:void 0,d={},u=Dd(o),{lfv:l,websocket:w}=e,p=l?St({...l,log:l.log??i(),path:l.path??"/"},t):void 0,k=new Map,q=w?.url?.trim(),_=new Set,b=!1,j=!1;if(!l&&!n&&!q)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(Tt(s),n&&!o&&!c&&!l)i()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function U(){if(c){let h=await ki(c,d,i());return{...io,...Ci,...Vd(h)}}return{...u}}async function a(h){let O=M(h);if(c){let L=await ki(c,d,i());return{url:O,clientId:w?.clientId??c.clientId,token:L,header:"Authorization"}}return{url:O,clientId:w?.clientId,token:w?.token??o,header:w?.header??"X-Vault-Token"}}function y(h){if(!l)throw Error(`Vault LFV capability is not configured for path ${h}`);let O=k.get(h);if(O)return O;let L=St({...l,log:l.log??i(),path:h},t);return k.set(h,L),L}function S(h){if(!n)throw Error(`Vault HTTP capability is not configured for path ${h}`);return n}function M(h){if(!q)throw Error(`Vault websocket capability is not configured for path ${h}`);return q}async function F(h,O){let L=await a(typeof O.path==="string"?O.path:"/");return oo(L,h,O,i())}async function Z(h,O){let L=S(h),C;try{let m=await U(),f=new URL(`${L}/${h}`);if(typeof O?.kmsSlots==="number"&&Number.isInteger(O.kmsSlots)&&O.kmsSlots>=1)f.searchParams.set("kms_slots",String(O.kmsSlots));C=await fetch(f,{headers:m})}catch(m){throw new he(`Vault request failed from URL: ${L}/${h}`,h,void 0,"connection",{cause:m})}if(C.status!==200){if(C.status===404)throw new nt(h);let m=C.status===401||C.status===403,f=m?`Vault returned ${C.status} ${C.statusText} (auth error) from URL: ${L}/${h}`:`Vault returned invalid status, ${C.status}: '${C.statusText}' from URL: ${L}/${h}`;throw new he(f,h,C.status,m?"auth":"invalid_status")}try{let f=(await Rt(C,{log:i(),operation:"vault.secret.read",redact:!0})).data;if(!f?.metadata||!("data"in f))throw Error("Missing vault secret data");let E=f.metadata.created_time??f.metadata.created;return{data:f.data,metadata:{path:typeof f.metadata.path==="string"?f.metadata.path:h,version:typeof f.metadata.version==="number"?f.metadata.version:0,created:E instanceof Date?E:typeof E==="string"?new Date(E):new Date,...wt(f.metadata)?{contentType:wt(f.metadata)}:{}}}}catch(m){throw new he("Error retrieving secret",h,void 0,"invalid_payload",{cause:m})}}async function Y(h,O){let L=await a(h);return so(L,h,i(),O?.kmsSlots)}async function ee(h){let O=S(h),L=`${gr(O)}/metadata/${h}`,C=await U(),m=await fetch(L,{headers:C});if(m.status!==200)throw new he(`Vault getMetadata failed (${m.status}) for ${h}`,h,m.status,"invalid_status");let f=await Rt(m,{log:i(),operation:"vault.metadata.read",redact:!0}).catch(()=>null);if(!f?.metadata||typeof f.metadata!=="object")throw new he(`Vault getMetadata returned invalid payload for ${h}`,h,m.status,"invalid_payload");return f.metadata}async function ae(h,O,L){let C=S(O),m=`${gr(C)}/${h}/${O}`,f=await U(),E=await fetch(m,{method:"POST",headers:f,body:JSON.stringify({reason:L?.reason,severity:L?.severity,incident_ref:L?.incidentRef})});if(E.status!==200&&E.status!==202&&E.status!==204)throw new he(`Vault ${h} failed (${E.status}) for ${O}`,O,E.status,"invalid_status")}async function oe(h,O){if(l)return await y(h).getFullSecret(h,O);if(n)return await Z(h,O);return await Y(h,O)}async function K(h,O,L){if(!Nd(O))throw Error(`putSecret requires an object value for vault source at path ${h}`);if(l){await y(h).putSecret(h,O,L);return}if(n){let C=S(h),m=await U();if(m["X-Ionite-Mime-Type"]=L.contentType.mimeType,m["X-Ionite-Secret-Format"]=L.contentType.format,L.contentType.schemaUrl)m["X-Ionite-Schema-Url"]=L.contentType.schemaUrl;if(L.contentType.typeId)m["X-Ionite-Secret-Type"]=L.contentType.typeId;let f=await fetch(`${C}/${h}`,{method:"POST",headers:m,body:JSON.stringify(O)});if(f.status!==200&&f.status!==201&&f.status!==204)throw new he(`Vault putSecret failed (${f.status}) for ${h}`,h,f.status,"invalid_status");return}await F("put_secret",{path:h,data:O,content_type:qr(L.contentType)})}async function Q(h,O){if(l){await y(h).deleteSecret(h,O);return}if(n){let L=S(h),C=await U(),m=await fetch(`${L}/${h}`,{method:"DELETE",headers:C});if(m.status!==200&&m.status!==202&&m.status!==204)throw new he(`Vault deleteSecret failed (${m.status}) for ${h}`,h,m.status,"invalid_status");return}await F("delete_secret",{path:h})}async function V(h,O){if(l)return await y(h).listPaths(h,O);if(n){let m=`${S(h)}/${h}`,f=async(J)=>{let G=await U();if(J==="LIST")return fetch(m,{method:"LIST",headers:G});let de=m.includes("?")?"&":"?";return fetch(`${m}${de}list=true`,{method:"GET",headers:G})},E=await f("LIST");if(E.status===405||E.status===501)E=await f("GET");if(E.status!==200)throw new he(`Vault listPaths failed (${E.status}) for ${h}`,h,E.status,"invalid_status");let A=await Rt(E,{log:i(),operation:"vault.paths.list",redact:!0}).catch(()=>null),B;if(A&&typeof A==="object"){let J=A,G=J.data;if(G&&typeof G==="object")B=G.keys;else B=J.keys}if(!Array.isArray(B))throw new he(`Vault listPaths returned an unexpected response for ${h}`,h,void 0,"invalid_payload");return B.filter((J)=>typeof J==="string")}let L=await F("list_paths",{path:h});if(!Array.isArray(L.items))throw Error(`Vault websocket list_paths returned invalid payload for ${h}`);return L.items.filter((C)=>typeof C==="string")}async function D(h,O){if(l)return await y(h).exists(h,O);if(n){let C=S(h),m=await U(),f=await fetch(`${C}/${h}`,{headers:m});if(f.status===200)return!0;if(f.status===404)return!1;if(f.status===401||f.status===403)throw new he(`Vault exists failed (${f.status}) for ${h} (auth error)`,h,f.status,"auth");throw new he(`Vault exists failed (${f.status}) for ${h}`,h,f.status,"invalid_status")}let L=await F("exists",{path:h});if(typeof L.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${h}`);return L.exists}async function te(h,O,L){if(l){await y(h).requestRotate(h,O,L);return}if(n){await ae("rotate/request",h,O);return}await F("request_rotate",{path:h,reason:O?.reason,severity:O?.severity,incident_ref:O?.incidentRef})}async function re(h,O,L){if(l){await y(h).requestRevoke(h,O,L);return}if(n){await ae("revoke/request",h,O);return}await F("request_revoke",{path:h,reason:O?.reason,severity:O?.severity,incident_ref:O?.incidentRef})}async function ie(h,O,L){if(l)return await y(h).parkKmsKey(h,O,L);if(n){let m=S(h),f=`${gr(m)}/kms/park/${h}`,E=await U(),A=await fetch(f,{method:"POST",headers:E,body:JSON.stringify({key_id:O.keyId,status:O.status,reason:O.reason})});if(A.status!==200&&A.status!==202)throw new he(`Vault kms/park failed (${A.status}) for ${h}`,h,A.status,"invalid_status");return bi(await Rt(A,{log:i(),operation:"vault.kms.park",redact:!0}).catch(()=>null),h,"http")}let C=await F("kms_park",{path:h,key_id:O.keyId,status:O.status,reason:O.reason});return bi(C,h,"websocket")}async function se(h,O,L){if(l)return await y(h).addKmsKeys(h,O,L);if(n){let m=S(h),f=`${gr(m)}/kms/add-keys/${h}`,E=await U(),A=await fetch(f,{method:"POST",headers:E,body:JSON.stringify({keys:O.keys})});if(A.status!==200&&A.status!==202)throw new he(`Vault kms/add-keys failed (${A.status}) for ${h}`,h,A.status,"invalid_status");return Ri(await Rt(A,{log:i(),operation:"vault.kms.add_keys",redact:!0}).catch(()=>null),h,"http")}let C=await F("kms_add_keys",{path:h,keys:O.keys});return Ri(C,h,"websocket")}async function ce(h,O,L){if(l)return await y(h).revokeKmsKey(h,O,L);if(n){let m=S(h),f=`${gr(m)}/kms/revoke-key/${h}`,E=await U(),A=await fetch(f,{method:"POST",headers:E,body:JSON.stringify({key_id:O.keyId,reason:O.reason})});if(A.status!==200&&A.status!==202)throw new he(`Vault kms/revoke-key failed (${A.status}) for ${h}`,h,A.status,"invalid_status");return Ti(await Rt(A,{log:i(),operation:"vault.kms.revoke_key",redact:!0}).catch(()=>null),h,"http")}let C=await F("kms_revoke_key",{path:h,key_id:O.keyId,reason:O.reason});return Ti(C,h,"websocket")}async function T(h,O){if(l)return await y(h).getMetadata(h,O);if(n)return await ee(h);let L=await F("read_metadata",{path:h});if(!L.metadata||typeof L.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${h}`);return L.metadata}async function g(h,O,L){if(!s)throw new qe(r,h);return ot({getFullSecret:Z},h,O,s,i(),L,{onHealth:(C)=>{b=!C}})}async function P(h,O,L){let C=await a(h);return hi(C,h,O,L,i(),{onHealth:(m)=>{j=!m}})}function I(h){let O=()=>{if(_.delete(O))h()};return _.add(O),O}function R(){if(p?.isAvailable?.()===!1)return!0;for(let h of k.values())if(h.isAvailable?.()===!1)return!0;return!1}let W={type:r,isAvailable:()=>!b&&!j&&!R(),get:(h,O)=>He(()=>oe(h,O)),getFullSecret:oe,getSecret:async(h,O)=>(await oe(h,O)).data,putSecret:K,deleteSecret:Q,listPaths:V,exists:D,requestRotate:te,requestRevoke:re,parkKmsKey:ie,addKmsKeys:se,revokeKmsKey:ce,getMetadata:T,subscribe:async(h,O,L)=>{let C;if(q)C=await P(h,O,L);else if(l)C=await y(h).subscribe(h,O,L);else C=await g(h,O,L);return I(C)},...p?{subscribeEvents:(h)=>I(p.subscribeEvents?.(h)??(()=>{}))}:q?{subscribeEvents:(h)=>{let O,L=!1;return a("/").then((C)=>wi(C,h,i())).then((C)=>{if(L){C();return}O=C}).catch((C)=>{i()?.warn("Vault websocket event subscription failed",C)}),I(()=>{L=!0,O?.()})}}:{},close:()=>{for(let O of Array.from(_))try{O()}catch(L){i()?.warn("Vault source close: failed to release a subscription",L)}_.clear();let h=(O)=>{if(!O?.close)return;try{Promise.resolve(O.close()).catch((L)=>{i()?.warn("Vault source close: LFV close failed",L)})}catch(L){i()?.warn("Vault source close: LFV close failed",L)}};for(let O of k.values())h(O);h(p),k.clear(),d.token=void 0,d.expiresAt=void 0},get log(){return e.log},set log(h){e.log=h}};if(p)W.isDeliveryRequest=(h)=>p.isDeliveryRequest(h),W.isEventsRequest=(h)=>p.isEventsRequest(h),W.handleDelivery=(h)=>p.handleDelivery(h),W.handleEvents=(h)=>p.handleEvents(h),Object.defineProperties(W,{deliveryPath:{value:p.deliveryPath,enumerable:!0},eventsPath:{value:p.eventsPath,enumerable:!0},callbackKey:{value:p.callbackKey,enumerable:!0},trustId:{value:p.trustId,enumerable:!0}});return W}class Qr extends Error{constructor(e,t){super(e);this.name="AzureKeyVaultError",this.status=t,Object.setPrototypeOf(this,Qr.prototype)}}function Zr(e,t){if(!e||e.trim().length===0)throw Error(`Missing required Azure config: ${t}`);return e}function Gd(e){return e.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function ao(e,t){return`${e.replace(/\/+$/g,"")}/${t.replace(/^\/+/g,"")}`}function Hd(e){try{let r=new URL(e).pathname.split("/").filter(Boolean),n=r.indexOf("secrets");if(n===-1)return;return r[n+2]||void 0}catch{return}}function Jd(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function en(e){let t=e.apiVersion??"7.4",r=e.scope??"https://vault.azure.net/.default",n=e.secretNameTransform??Gd,o=e.authMethod,s="/var/run/secrets/azure/tokens/azure-identity-token",i=e.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",c=e.vaultUrl??(e.vaultName?`https://${e.vaultName}.vault.azure.net`:void 0)??void 0,d=Zr(c,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function u(K){try{return await zd(K),!0}catch{return!1}}let l,w,p=!1;async function k(K){let{entraTenantId:Q,clientId:V}=e;if(!Q)throw Error("Workload identity requires entraTenantId");if(!V)throw Error("Workload identity requires clientId");if(!await u(i))throw Error(`Federated token file not found at ${i}`);let D=(await Fd(i,"utf8")).trim();if(!D)throw Error("Federated token file was empty");let te=`https://login.microsoftonline.com/${encodeURIComponent(Q)}/oauth2/v2.0/token`,re=new URLSearchParams({client_id:V,grant_type:"client_credentials",scope:r,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:D}),ie=await fetch(te,{method:"POST",headers:{...Bt,...Ii},body:re});if(ie.status!==200)throw Error(`Azure workload identity token exchange returned ${ie.status} ${ie.statusText}`);let se=await Xr(ie,{redact:!0});if(!se?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:se.access_token,expiresAtMs:K+(se.expires_in??0)*1000},se.access_token}async function q(K){let Q=e.imdsApiVersion??"2018-02-01",V="https://vault.azure.net",D=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(D.searchParams.set("api-version",Q),D.searchParams.set("resource","https://vault.azure.net"),e.managedIdentityClientId)D.searchParams.set("client_id",e.managedIdentityClientId);let te=await fetch(D.toString(),{headers:{Metadata:"true",...Bt}});if(te.status!==200)throw Error(`Azure IMDS token endpoint returned ${te.status} ${te.statusText}`);let re=await Xr(te,{redact:!0});if(!re?.access_token)throw Error("IMDS token response missing access_token");let ie=K+60000;if(re.expires_on){let se=Number.parseInt(re.expires_on,10);if(Number.isFinite(se)&&se>0)ie=se*1000;else{let ce=Date.parse(re.expires_on);if(Number.isFinite(ce))ie=ce}}else if(re.expires_in){let se=Number.parseInt(re.expires_in,10);if(Number.isFinite(se)&&se>0)ie=K+se*1000}return l={accessToken:re.access_token,expiresAtMs:ie},re.access_token}async function _(K){let Q=Zr(e.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),V=Zr(e.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),D=Zr(e.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),te=`https://login.microsoftonline.com/${encodeURIComponent(Q)}/oauth2/v2.0/token`,re=new URLSearchParams({client_id:V,client_secret:D,grant_type:"client_credentials",scope:r}),ie=await fetch(te,{method:"POST",headers:{...Bt,...Ii},body:re});if(ie.status!==200)throw Error(`Azure token endpoint returned ${ie.status} ${ie.statusText}`);let se=await Xr(ie,{redact:!0});if(!se?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:se.access_token,expiresAtMs:K+(se.expires_in??0)*1000},se.access_token}async function b(){let K=Date.now();if(l&&l.expiresAtMs-60000>K)return l.accessToken;if(w)return w;w=(async()=>{if(o==="workload_identity")return await k(K);if(o==="managed_identity")return await q(K);if(o==="client_secret")return await _(K);if(await u(i))try{return await k(K)}catch{}try{return await q(K)}catch{}return await _(K)})();try{return await w}finally{w=void 0}}async function j(K){let Q=await b(),V=ao(d,`/secrets/${encodeURIComponent(K)}?api-version=${encodeURIComponent(t)}`),D=await fetch(V,{headers:{Authorization:`Bearer ${Q}`,...Bt}});if(D.status!==200)throw new Qr(`Key Vault request failed (${D.status})`,D.status);return await Xr(D,{redact:!0})}async function U(K,Q){let V=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${V}`:V,te=await j(D),re=te.value;try{re=JSON.parse(te.value)}catch{}let ie=te.attributes?.created?te.attributes.created*1000:void 0,se=Hd(te.id),ce=te.contentType?Wr({mimeType:te.contentType,format:te.tags?.["ionite-format"],schemaUrl:te.tags?.["ionite-schema-url"],typeId:te.tags?.["ionite-type-id"]}):void 0;return{data:re,metadata:{path:K,version:Number.parseInt(se??"",10)||0,created:ie?new Date(ie):new Date,...ce?{contentType:ce}:{}}}}async function a(K,Q,V){if(!Jd(Q))throw Error(`putSecret requires an object value for azure source at path ${K}`);let D=n(K),te=e.secretNamePrefix?`${e.secretNamePrefix}${D}`:D,re=await b(),ie=ao(d,`/secrets/${encodeURIComponent(te)}?api-version=${encodeURIComponent(t)}`),se=JSON.stringify({value:JSON.stringify(Q),contentType:V.contentType.mimeType,tags:{"ionite-format":V.contentType.format,...V.contentType.schemaUrl?{"ionite-schema-url":V.contentType.schemaUrl}:{},...V.contentType.typeId?{"ionite-type-id":V.contentType.typeId}:{}}}),ce=await fetch(ie,{method:"PUT",headers:{Authorization:`Bearer ${re}`,...Bd,...Bt},body:se});if(ce.status!==200&&ce.status!==201)throw Error(`Key Vault putSecret failed (${ce.status}) for ${K}`)}async function y(K,Q){let V=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${V}`:V,te=await b(),re=ao(d,`/secrets/${encodeURIComponent(D)}?api-version=${encodeURIComponent(t)}`),ie=await fetch(re,{method:"DELETE",headers:{Authorization:`Bearer ${te}`,...Bt}});if(ie.status!==200&&ie.status!==202&&ie.status!==204)throw Error(`Key Vault deleteSecret failed (${ie.status}) for ${K}`)}async function S(K,Q){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${K}`)}async function M(K,Q){try{return await U(K),!0}catch(V){if(V instanceof Qr&&V.status===404)return!1;throw V}}async function F(K,Q,V){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${K}`)}async function Z(K,Q,V){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${K}`)}async function Y(K){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${K}`)}async function ee(K){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${K}`)}async function ae(K){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${K}`)}async function oe(K,Q){let V=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${V}`:V,te=await j(D),re=te.contentType?Wr({mimeType:te.contentType,format:te.tags?.["ionite-format"],schemaUrl:te.tags?.["ionite-schema-url"],typeId:te.tags?.["ionite-type-id"]}):void 0;return{id:te.id,...re?{content_type:re}:{},...te.attributes??{}}}return{type:e.type,isAvailable:()=>!p,get:(K,Q)=>He(()=>U(K,Q)),getFullSecret:U,getSecret:async(K,Q)=>(await U(K,Q)).data,putSecret:a,deleteSecret:y,listPaths:S,exists:M,requestRotate:F,requestRevoke:Z,parkKmsKey:Y,addKmsKeys:ee,revokeKmsKey:ae,getMetadata:oe,subscribe:(K,Q,V)=>{if(!e.ttl)throw new qe("azure",K);return Tt(e.ttl),ot({getFullSecret:U},K,Q,e.ttl,void 0,V,{onHealth:(D)=>{p=!D}})},close:()=>{l=void 0,w=void 0,p=!1}}}var co=Symbol("ion.secretsSourceState");function Xd(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${n}`)};return{type:"dev",get:(r,n)=>He(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[co]:"unavailable"}}function Pi(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${n}`)};return{type:"dev",get:(r,n)=>He(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[co]:"removed"}}function Zd(e){return e.type==="vault"&&e.lfv!=null}function Qd(e,t,r,n){if(!Zd(t))return;if(r||n)return;throw Error(`Secrets source "${e}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function el(e,t,r){if(t.type==="vault")return zt(t,r);if(t.type==="azure")return en(t);if(t.type==="aws"||t.type==="gcp"||t.type==="dev")throw Error(`Secrets source "${e}" uses type "${t.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${e}"`)}function tl(e,t){let r=(n)=>{t.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:n instanceof Error?n.message:String(n)})};try{Promise.resolve(e.close?.()).catch(r)}catch(n){r(n)}}function rl(e){let t=new Map,r=new Map,n=new Map;for(let[o,s]of Object.entries(e)){if(!Oi(s))continue;let i=t.get(s.deliveryPath);if(i)throw Error(`LFV delivery path "${s.deliveryPath}" is claimed by both secrets sources "${i}" and "${o}"; delivery paths must be globally unique.`);t.set(s.deliveryPath,o);let c=r.get(s.eventsPath);if(c)throw Error(`LFV events path "${s.eventsPath}" is claimed by both secrets sources "${c}" and "${o}"; events paths must be globally unique.`);r.set(s.eventsPath,o);let d=n.get(s.callbackKey);if(d&&d.trustId!==s.trustId)throw Error(`LFV callback key "${s.callbackKey}" is claimed by secrets sources "${d.sourceName}" and "${o}" with different verify JWKS; a callback path must use a single trust key.`);if(!d)n.set(s.callbackKey,{sourceName:o,trustId:s.trustId})}}function Oi(e){return typeof e.isDeliveryRequest==="function"&&typeof e.isEventsRequest==="function"&&typeof e.handleDelivery==="function"&&typeof e.handleEvents==="function"}function nl(e,t,r){let n={...t},o=[],s=(c)=>{if(n[c]!==void 0)delete n[c],o.push(c)};s("token"),s("clientSecret"),s("workload");let i=n.websocket;if(i&&typeof i==="object"&&i.token!==void 0){let c={...i};delete c.token,n.websocket=c,o.push("websocket.token")}if(o.length>0)r.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:e,"ion.droppedFields":o});return n}function ol(e,t,r){let n={name:e,type:t.type,ready:t.isReady?.()??!0};if(r?.type==="dev")n.url=r.ioniteUrl;if(r?.type==="vault")n.url=r.url,n.clientId=r.workload?.clientId??r.lfv?.clientId??r.websocket?.clientId;if(r?.type==="aws")n.url=r.webhookUrl;if(r?.type==="azure")n.url=r.vaultUrl,n.clientId=r.clientId??r.managedIdentityClientId,n.authMethod=r.authMethod;return ve(n)}function sl(e,t,r){let n={},o=new Set([...Object.keys(t??{}),...Object.keys(r??{})]);for(let s of o){let i=t?.[s],c=r?.[s],d=c?nl(s,c,e):void 0;n[s]={...i??{},...d??{}}}return n}function tn(e){return e[co]??"available"}function il(e,t,r){let n=t,o=new Set,s=new Set,i=new Set,c=Ke(r,`Secrets source "${e}"`),d=()=>tn(n)==="available",u=me(`Secrets source "${e}"`,d),l=(a,y,S)=>Error(`${a} timed out after ${S}ms waiting for source "${e}" to be configured by the ConfigSource at path ${y}`),w=(a,y)=>Error(`${a} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${y}`),p=(a,y,S)=>{let M=tn(n);if(M==="available")return Promise.resolve(n);if(M==="removed")return Promise.reject(w(a,y));return new Promise((F,Z)=>{let Y={method:a,path:y,resolve:(ae)=>{if(Y.timeout)clearTimeout(Y.timeout);i.delete(Y),F(ae)},reject:(ae)=>{if(Y.timeout)clearTimeout(Y.timeout);i.delete(Y),Z(ae)}},ee=S?.timeout;if(typeof ee==="number"&&ee>0)Y.timeout=setTimeout(()=>{Y.reject(l(a,y,ee))},ee);i.add(Y)})},k=(a)=>{for(let y of Array.from(i))y.resolve(a)},q=()=>{for(let a of Array.from(i))a.reject(w(a.method,a.path))},_=async(a,y=!1)=>{let S=a.guard.next();if(a.unsubscribe?.(),a.unsubscribe=void 0,a.closed)return;if(tn(n)==="unavailable"&&a.options?.mode!=="wait"){if(y)throw Error(`subscribe is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${a.path}`);return}try{let F=await(a.options?.mode==="wait"?await p("subscribe",a.path,a.options):n).subscribe(a.path,(Z)=>{if(!a.closed)a.onChange(Z)},a.options);if(a.closed||!a.guard.isCurrent(S)){F?.();return}a.unsubscribe=F}catch(M){if(y)throw M;if(Dr(M)){r.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:e,path:a.path});return}r.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:e,path:a.path,error:M instanceof Error?M.message:String(M)})}},b=(a,y=!1)=>{if(a.unsubscribe?.(),a.unsubscribe=void 0,a.closed)return;if(!n.subscribeEvents){if(y)throw Error(`Secrets source "${e}" does not support lifecycle event subscriptions`);return}a.unsubscribe=n.subscribeEvents((S)=>{if(!a.closed)a.listener(S)})},j={get type(){return n.type},beforeChange:c.beforeChange,afterChange:c.afterChange,isAvailable:()=>d()&&(n.isAvailable?.()??!0),isReady:u.isReady,ready:u.ready,get:(a,y)=>He(async()=>(await p("get",a,y)).getFullSecret(a,y)),getFullSecret:async(a,y)=>(await p("getFullSecret",a,y)).getFullSecret(a,y),getSecret:async(a,y)=>(await p("getSecret",a,y)).getSecret(a,y),putSecret:async(a,y,S)=>(await p("putSecret",a,S)).putSecret(a,y,S),subscribe:async(a,y,S)=>{let M={path:a,onChange:y,options:S,closed:!1,guard:Br()};o.add(M);try{await _(M,!0)}catch(F){throw o.delete(M),F}return()=>{M.closed=!0,M.guard.next(),o.delete(M),M.unsubscribe?.(),M.unsubscribe=void 0}},subscribeEvents:(a)=>{let y={listener:a,closed:!1};s.add(y);try{b(y,!0)}catch(S){throw s.delete(y),S}return()=>{y.closed=!0,s.delete(y),y.unsubscribe?.(),y.unsubscribe=void 0}},deleteSecret:async(a,y)=>(await p("deleteSecret",a,y)).deleteSecret(a,y),listPaths:async(a,y)=>(await p("listPaths",a,y)).listPaths(a,y),exists:async(a,y)=>(await p("exists",a,y)).exists(a,y),requestRotate:async(a,y,S)=>(await p("requestRotate",a,S)).requestRotate(a,y,S),requestRevoke:async(a,y,S)=>(await p("requestRevoke",a,S)).requestRevoke(a,y,S),parkKmsKey:async(a,y,S)=>(await p("parkKmsKey",a,S)).parkKmsKey(a,y,S),addKmsKeys:async(a,y,S)=>(await p("addKmsKeys",a,S)).addKmsKeys(a,y,S),revokeKmsKey:async(a,y,S)=>(await p("revokeKmsKey",a,S)).revokeKmsKey(a,y,S),getMetadata:async(a,y)=>(await p("getMetadata",a,y)).getMetadata(a,y)},U=(a)=>{try{Promise.resolve(a.close?.()).catch((y)=>{r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:y instanceof Error?y.message:String(y)})})}catch(y){r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:y instanceof Error?y.message:String(y)})}};return{api:j,update(a){if(a===n)return;let y=n;c.emitBefore(),n=a;let S=tn(a);if(S==="available")k(a);else if(S==="removed")q();u.refresh();for(let M of o)_(M);for(let M of s)b(M);U(y),c.emitAfter()},close(){for(let a of o)a.closed=!0,a.guard.next(),a.unsubscribe?.(),a.unsubscribe=void 0;o.clear();for(let a of s)a.closed=!0,a.unsubscribe?.(),a.unsubscribe=void 0;s.clear(),q(),u.settle(),U(n)}}}function Ei(e,t=new Map){let r=new Map,n=new Map,o=new Map,s,i=!1,c=new Map,d=Ke(e,"Secrets"),u=!1,l=()=>{for(let a of r.keys()){let y=c.get(a);if(y&&y.api.isReady?.()===!1)return!1}return!0},w=me("Secrets module",()=>u&&l()),p=(a,y)=>ol(a,y,o.get(a)),k=(a)=>{let y=c.get(a);if(y)return y;let S=il(a,r.get(a)??Pi(a),e);if(Object.defineProperty(S.api,"describe",{value:()=>p(a,S.api),enumerable:!1,configurable:!0}),c.set(a,S),!(a in U))Object.assign(U,{[a]:S.api});return S},q=(a)=>{let y=c.get(a)?.api;if(y)return y;throw e.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:a}),Error(`Secrets source "${a}" is not configured`)},_=()=>Array.from(r.values()).filter(Oi),b=(a)=>_().find((y)=>y.isDeliveryRequest(a)),j=(a)=>_().find((y)=>y.isEventsRequest(a)),U;return U={describe:()=>({module:"secrets",active:u,ready:w.isReady(),sources:Array.from(r.keys(),(a)=>p(a,k(a).api))}),get config(){return Object.fromEntries(Array.from(r.keys(),(a)=>[a,k(a).api]))},beforeChange:d.beforeChange,afterChange:d.afterChange,isReady:w.isReady,isAvailable:()=>{for(let a of c.values()){if(a.api.isReady?.()===!1)continue;if(a.api.isAvailable?.()===!1)return!1}return!0},ready:w.ready,listSecretsSources:()=>Array.from(r.keys()),getSecretsSource:(a)=>r.has(a)?k(a).api:q(a),get:(a,y,S)=>U.getSecretsSource(a).get(y,S),getSecret:(a,y,S)=>U.getSecretsSource(a).getSecret(y,S),getFullSecret:(a,y,S)=>U.getSecretsSource(a).getFullSecret(y,S),putSecret:(a,y,S,M)=>U.getSecretsSource(a).putSecret(y,S,M),deleteSecret:(a,y,S)=>U.getSecretsSource(a).deleteSecret(y,S),listPaths:(a,y,S)=>U.getSecretsSource(a).listPaths(y,S),exists:(a,y,S)=>U.getSecretsSource(a).exists(y,S),requestRotate:(a,y,S,M)=>U.getSecretsSource(a).requestRotate(y,S,M),requestRevoke:(a,y,S,M)=>U.getSecretsSource(a).requestRevoke(y,S,M),parkKmsKey:(a,y,S,M)=>U.getSecretsSource(a).parkKmsKey(y,S,M),addKmsKeys:(a,y,S,M)=>U.getSecretsSource(a).addKmsKeys(y,S,M),revokeKmsKey:(a,y,S,M)=>U.getSecretsSource(a).revokeKmsKey(y,S,M),getMetadata:(a,y,S)=>U.getSecretsSource(a).getMetadata(y,S),subscribe:(a,y,S,M)=>U.getSecretsSource(a).subscribe(y,S,M),isLfvDeliveryRequest:(a)=>b(a)!==void 0,isLfvEventsRequest:(a)=>j(a)!==void 0,handleLfvDelivery:async(a)=>{let y=b(a);if(!y)return ye();return y.handleDelivery(a)},handleLfvEvents:async(a)=>{let y=j(a);if(!y)return ye();return y.handleEvents(a)}},{update(a,y,S,M,F){let Z=a!==void 0||y!==void 0;if(!Z&&!u&&c.size===0)return;let Y=sl(e,a,y),ee=F===!0,ae=M!==s,oe=ee!==i,K=new Map,Q=new Map,V=[];try{for(let[D,te]of Object.entries(Y)){let re=Yd(te),ie=r.get(D);if(ie&&n.get(D)===re&&!ae&&!oe){K.set(D,ie),Q.set(D,re);continue}let se;if(!te.type)se=Xd(D);else{if(S?.validateSourceConfig?.(D,te),t.has(D)&&a?.[D])e.warn(`RemoteConfig secrets source "${D}" is superseded by the framework LFV bootstrap source.`);if(!t.has(D))Qd(D,te,M,ee),se=el(D,te,M),V.push(se);else se=t.get(D)}K.set(D,se),Q.set(D,re)}rl(Object.fromEntries(K))}catch(D){for(let te of V)tl(te,e);throw D}d.emitBefore(),u=Z,s=M,i=ee;for(let[D,te]of K)r.set(D,te),n.set(D,Q.get(D)),o.set(D,Y[D]),k(D).update(te);for(let[D,te]of c){if(K.has(D))continue;r.delete(D),n.delete(D),o.delete(D),te.update(Pi(D))}return w.refresh(),d.emitAfter(),U},close(){for(let a of c.values())a.close();c.clear(),r.clear(),n.clear(),o.clear(),s=void 0,u=!1,w.settle()}}}function uo(e,t){let r=t.ttlMs,n=Math.max(1,Math.floor(t.maxEntries)),o=new Map,s=()=>Date.now();function i(){while(o.size>n){let d=o.keys().next().value;if(d===void 0)break;o.delete(d)}}function c(d,u){o.delete(d),o.set(d,{session:u,expiresAt:s()+r}),i()}return{capabilities:e.capabilities,async create(d){await e.create(d)},async get(d){let u=o.get(d);if(u){if(u.expiresAt>s())return o.delete(d),o.set(d,u),u.session;o.delete(d)}let l=await e.get(d);if(l)c(d,l);return l},async update(d,u){await e.update(d,u),o.delete(d)},async delete(d){await e.delete(d),o.delete(d)}}}import{deepEqualPlain as Ai,IoniteError as Re,trimTrailingSlash as It,validationFailureResponse as al}from"@ionite/core";import{getCachedVerificationKey as cl}from"@ionite/core/server";function Li(){let e,t=me("tm module",()=>e!==void 0),r=()=>{if(!e)throw new Re("Tenant Management is not ready",{status:503});return e},n={describe:()=>e?.describe()??{module:"tm",active:!1,ready:!1,enabled:!1},isReady:t.isReady,ready:t.ready,handler:(o)=>e?e.handler(o):Promise.resolve(Response.json({error:"Tenant Management is not ready"},{status:503})),getTenant:(o)=>r().getTenant(o),recordConsent:(o)=>r().recordConsent(o)};return{handle:n,update(o,s){return e=o,t.refresh(),s?n:void 0}}}var ul=600,dl=30;function xi(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),r=t.padEnd(Math.ceil(t.length/4)*4,"=");return Uint8Array.from(atob(r),(n)=>n.charCodeAt(0)).buffer}function _i(e){return JSON.parse(new TextDecoder().decode(new Uint8Array(xi(e))))}function Ui(e){return Array.isArray(e)&&e.length>0&&e.every((t)=>typeof t==="string")}function ll(e){if(!e||typeof e!=="object")throw new Re("Invalid staged integration handle",{status:400});let t=e;if(typeof t.iss!=="string"||!(typeof t.aud==="string"||Ui(t.aud))||typeof t.iat!=="number"||typeof t.exp!=="number"||typeof t.jti!=="string"||typeof t.integratorTenantId!=="string"||typeof t.productId!=="string"||typeof t.applicationId!=="string")throw new Re("Invalid staged integration claims",{status:400});return t}function fl(e,t){return Array.isArray(e)?e.includes(t):e===t}async function Ct(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return Array.from(new Uint8Array(t),(r)=>r.toString(16).padStart(2,"0")).join("")}async function rn(e,t){let r=await Mi(e,t),n=ll(r),o=Math.floor(Date.now()/1000),s=t.consentTtlSeconds??ul;if(n.iat>o+60||n.exp-n.iat>s)throw new Re("Staged integration handle lifetime is invalid",{status:401});return{handle:e,integrator:t.integrator.id,integratorName:n.integratorName??t.integrator.name,integratorTenantId:n.integratorTenantId,productId:n.productId,applicationId:n.applicationId,issuedAt:new Date(n.iat*1000).toISOString(),expiresAt:new Date(n.exp*1000).toISOString(),requestId:n.jti,tenantHint:n.tenantHint}}async function Mi(e,t){let r=e.split(".");if(r.length!==3)throw new Re("Invalid staged integration handle",{status:400});let n=_i(r[0]);if(!n||typeof n!=="object")throw new Re("Invalid staged integration handle",{status:400});let{alg:o,kid:s}=n;if(o!=="RS256"||typeof s!=="string"||s.length===0)throw new Re("Unsupported staged integration signature",{status:400});let i=_i(r[1]);if(!i||typeof i!=="object")throw new Re("Invalid integrator token claims",{status:400});let c=i,d=await cl(t.integrator.jwksUri,s,"tm:RS256",(p)=>crypto.subtle.importKey("jwk",p,{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"]));if(!await crypto.subtle.verify({name:"RSASSA-PKCS1-v1_5"},d,xi(r[2]),new TextEncoder().encode(`${r[0]}.${r[1]}`)))throw new Re("Invalid staged integration signature",{status:401});let l=Math.floor(Date.now()/1000),w=c.azp??c.client_id;if(typeof c.iss!=="string"||c.iss.replace(/\/+$/,"")!==t.integrator.issuer.replace(/\/+$/,"")||!(typeof c.aud==="string"||Ui(c.aud))||!fl(c.aud,t.integrator.audience)||w!==t.integrator.clientId||typeof c.exp!=="number"||c.exp<=l)throw new Re("Integrator token is not trusted or has expired",{status:401});return c}function Wi(e){try{return It(new URL(e,"http://dummy").pathname)}catch{let t=e.startsWith("/")?e:`/${e}`;return It(t)}}function pl(e,t){let r=new URL(e.url);return new URL(`/${encodeURIComponent(t)}/`,r.origin).toString()}function ml(e,t){let r=Wi(t),n=It(e);if(n===r)return null;if(!n.startsWith(`${r}/`))return null;let o=n.slice(r.length+1);if(!o||o.includes("/"))return null;return decodeURIComponent(o)}function nn(e){return e==="pending"||e==="processing"||e==="completed"||e==="failed"||e==="action_required"}function gl(e){if(!nn(e.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if(e.status==="completed"){if(!e.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:e.tenantUrl,status:"completed"},status:201}}if(e.status==="pending"||e.status==="processing")return{body:{tenantUrl:e.tenantUrl,status:e.status},status:202};if(e.status==="action_required"){if(!e.actionUrl||!e.requestToken||!e.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:e.actionUrl,requestToken:e.requestToken,expiresAt:e.expiresAt},status:200}}return{body:{tenantUrl:e.tenantUrl,status:"failed",error:e.error??"Tenant provisioning failed"},status:409}}function qi(e,t,r){let n=r.validators.tenant.createTenantRequest,o=r.validators.tenant.updateTenantRequest;async function s(a,y){if(!y)return;try{await y()}catch(S){e.log.warn(`Tenant ${a} lifecycle hook failed`,{"ion.operation":`tm.tenant_${a}`,"ion.outcome":"error",error:S instanceof Error?S.message:String(S)})}}async function i(a,y){let{integration:S,configLocator:M}=a;if(S?.status!=="consented"||S.handoverAppliedAt||!M)return a;try{if(!(await r.store.getIon(a.id))?.isReady())return a;return await r.onHandoverApplied?.({tenant:a,previousLocator:y,destinationLocator:M}),await u().setIntegration(a.id,{...S,version:S.version+1,handoverAppliedAt:new Date().toISOString()},{expectedHandleHash:S.handleHash,expectedVersion:S.version})??await r.store.get(a.id)??a}catch(F){return e.log.warn("Tenant config handover observation failed",{"ion.operation":"tm.handover.observe","ion.outcome":"error",tenantId:a.id,error:F instanceof Error?F.message:String(F)},F),a}}function c(a,y){let S=(M)=>new URL(M,y).toString();return{readyzUrl:S(a.readyzUrl),capabilitiezUrl:S(a.capabilitiezUrl),sso:{loginUrl:S(a.sso.loginUrl),userUrl:S(a.sso.userUrl),logoutUrl:S(a.sso.logoutUrl),logoutBackChannelUrl:S(a.sso.logoutBackChannelUrl),refreshUrl:S(a.sso.refreshUrl),callbackUrl:S(a.sso.callbackUrl)},workload:{validateUrl:S(a.workload.validateUrl),jwksUrl:S(a.workload.jwksUrl)},iam:{basePath:S(a.iam.basePath),usersUrl:S(a.iam.usersUrl),groupsUrl:S(a.iam.groupsUrl),workloadsUrl:S(a.iam.workloadsUrl),customersUrl:S(a.iam.customersUrl)},ciam:{magicLinkUrl:S(a.ciam.magicLinkUrl),magicLinkLoginUrl:S(a.ciam.magicLinkLoginUrl),customerUrl:S(a.ciam.customerUrl),customerLoginUrl:S(a.ciam.customerLoginUrl),customerCallbackUrl:S(a.ciam.customerCallbackUrl),customerProvidersUrl:S(a.ciam.customerProvidersUrl),logoutUrl:S(a.ciam.logoutUrl)}}}function d(a,y){let S=r.tenantIonBasePath?.(a);if(!S)return;let M=new URL(y.url).origin,F=c(Fe(S),M);return{callbackUrl:F.sso.callbackUrl,ionUrls:F}}function u(){if(!r.store.setIntegration||!r.store.getByIntegrationHandleHash)throw new Re("Tenant integration requires store.setIntegration and store.getByIntegrationHandleHash",{status:501});return{setIntegration:r.store.setIntegration.bind(r.store),getByIntegrationHandleHash:r.store.getByIntegrationHandleHash.bind(r.store)}}async function l(a){let y=a.headers.get("Authorization");if(!y?.startsWith("Bearer "))return Response.json({error:"Unauthorized"},{status:401});try{await Mi(y.slice(7),t);return}catch{return Response.json({error:"Unauthorized"},{status:401})}}function w(a){let{integration:y,...S}=a;if(!y)return S;return{...S,integration:{integrator:y.integrator,integratorName:y.integratorName,integratorTenantId:y.integratorTenantId,applicationId:y.applicationId,productId:y.productId,status:y.status,expiresAt:y.expiresAt,requestedAt:y.requestedAt,decidedAt:y.decidedAt}}}async function p(a){let y=await a.json();if(!y||typeof y.handle!=="string"||y.handle.length===0)throw new Re("handle is required",{status:400});if(y.authorization!==void 0&&typeof y.authorization!=="string")throw new Re("authorization must be a string",{status:400});return{handle:y.handle,authorization:y.authorization}}async function k(a){if(a.method!=="GET")return rt(["GET"]);if(!r.onConnectRequest)return Response.json({error:"Tenant integration consent is not supported"},{status:501});let y=new URL(a.url).searchParams.get("handle");if(!y)return Response.json({error:"handle is required"},{status:400});let S=await rn(y,t),M=S.tenantHint?await r.store.get(S.tenantHint):void 0;if(S.tenantHint&&!M)return ye();if(M){if(M.integratorTenantId&&M.integratorTenantId!==S.integratorTenantId)return Response.json({error:"Tenant is bound to another integrator tenant"},{status:409});let F=u(),Z=await Ct(y),Y=M.integration;if(Y&&Y.handleHash!==Z&&Date.parse(Y.expiresAt)>Date.now())return Response.json({error:"Tenant already has an active integration request"},{status:409});if(!Y||Y.handleHash!==Z){if(!await F.setIntegration(M.id,{version:(Y?.version??0)+1,integrator:S.integrator,integratorName:S.integratorName,integratorTenantId:S.integratorTenantId,applicationId:S.applicationId,productId:S.productId,handleHash:Z,status:"consent_requested",expiresAt:S.expiresAt,redeemAttempts:0,requestedAt:new Date().toISOString()},{expectedHandleHash:Y?.handleHash??null,expectedVersion:Y?.version}))return Response.json({error:"Integration request changed concurrently"},{status:409})}}return r.onConnectRequest({request:a,ion:e,staged:S,tenant:M})}async function q(a){if(a.method!=="POST")return rt(["POST"]);let y=await l(a);if(y)return y;let{handle:S}=await p(a);await rn(S,t);let M=await Ct(S),F=u(),Z=await F.getByIntegrationHandleHash(M);if(!Z?.integration)return Response.json({status:"pending"},{status:202});let Y=Z.integration;if(Date.parse(Y.expiresAt)<=Date.now())return Response.json({status:"expired"},{status:410});if(Y.status==="consented"&&Y.consentRedeemedAt)return Response.json({status:"consumed"},{status:410});let ee=t.maxRedeemAttempts??dl;if(Y.redeemAttempts>=ee)return Response.json({status:"attempt_limit"},{status:429});let ae={...Y,version:Y.version+1,redeemAttempts:Y.redeemAttempts+1},oe=await F.setIntegration(Z.id,ae,{expectedHandleHash:M,expectedVersion:Y.version});if(!oe?.integration)return Response.json({status:"pending"},{status:409});if(oe.integration.status==="declined")return Response.json({status:"declined"},{status:200});if(oe.integration.status!=="consented")return Response.json({status:"pending"},{status:202});let K=crypto.randomUUID().replace(/-/g,"")+crypto.randomUUID().replace(/-/g,""),Q={...oe.integration,version:oe.integration.version+1,consentRedeemedAt:new Date().toISOString(),exportTokenHash:await Ct(K)};if(!await F.setIntegration(Z.id,Q,{expectedHandleHash:M,expectedVersion:oe.integration.version}))return Response.json({status:"consumed"},{status:409});return Response.json({status:"consented",tenantId:Z.id,authorization:K,expiresAt:Y.expiresAt})}async function _(a){if(a.method!=="POST")return rt(["POST"]);let y=await l(a);if(y)return y;if(!r.exportConfig)return Response.json({error:"Config export is not supported"},{status:501});let{handle:S,authorization:M}=await p(a);if(!M)return Response.json({error:"authorization is required"},{status:400});await rn(S,t);let F=await Ct(S),Z=u(),Y=await Z.getByIntegrationHandleHash(F),ee=Y?.integration;if(!Y||!ee||ee.status!=="consented"||ee.configExportedAt||!ee.exportTokenHash||ee.exportTokenHash!==await Ct(M))return Response.json({error:"Export authorization is invalid or consumed"},{status:401});if(Date.parse(ee.expiresAt)<=Date.now())return Response.json({error:"Export authorization expired"},{status:410});let ae=await r.exportConfig({tenant:Y}),oe={...ee,version:ee.version+1,configExportedAt:new Date().toISOString(),exportTokenHash:void 0};if(!await Z.setIntegration(Y.id,oe,{expectedHandleHash:F,expectedVersion:ee.version}))return Response.json({error:"Export authorization is already consumed"},{status:409});return Response.json(ae)}async function b(a){let y=await rn(a.handle,t),S=await r.store.get(a.tenantId);if(!S)throw new Re("Tenant not found",{status:404});if(y.tenantHint&&y.tenantHint!==S.id)throw new Re("Staged request is bound to another tenant",{status:409});if(S.integratorTenantId&&S.integratorTenantId!==y.integratorTenantId)throw new Re("Tenant is bound to another integrator tenant",{status:409});let M=await Ct(a.handle),F=S.integration;if(F?.status==="consented"&&F.handleHash!==M)throw new Re("A consented tenant cannot be rebound",{status:409});if(F&&F.handleHash!==M&&Date.parse(F.expiresAt)>Date.now())throw new Re("Tenant already has an active integration request",{status:409});let Z=new Date().toISOString(),Y={version:(F?.handleHash===M?F.version:0)+1,integrator:y.integrator,integratorName:y.integratorName,integratorTenantId:y.integratorTenantId,productId:y.productId,applicationId:y.applicationId,handleHash:M,status:a.decision,expiresAt:y.expiresAt,redeemAttempts:F?.handleHash===M?F.redeemAttempts:0,requestedAt:F?.handleHash===M?F.requestedAt:Z,decidedAt:Z,decidedBy:a.decidedBy},ee=await u().setIntegration(S.id,Y,{expectedHandleHash:F?.handleHash??null,expectedVersion:F?.version});if(!ee)throw new Re("Integration request changed; reload and try again",{status:409});return ee}async function j(a){let S=new URL(a.url).pathname,M=Wi(r.basePath),F=`${M}/integrations`;if(It(S)===`${F}/authorize`)return k(a);if(It(S)===`${F}/redeem`)return q(a);if(It(S)===`${F}/config-export`)return _(a);let Z=ml(S,r.basePath),Y=It(S)===M;if(!Y&&!Z)return ye();if(!["GET","PUT","POST","DELETE"].includes(a.method))return rt(["GET","PUT","POST","DELETE"]);if(a.method==="GET"&&Y&&Z==null)return ye();let ee=await l(a);if(ee)return ee;if(a.method==="GET"){if(Z==null)return ye();let ce=await r.store.get(Z),T=ce?await i(ce):void 0;if(!T)return ye();let g=d(T,a),P=w(T);return Response.json(g?{...P,...g}:P,{status:200})}if(a.method==="DELETE"){if(!Z)return ye();let ce=await r.store.get(Z);if(ce)await r.mirror?.purge(ce.id);if(await r.store.delete(Z),ce)await s("deleted",()=>r.onTenantDeleted?.({tenantId:ce.id}));return new Response(null,{status:204})}if(!Z&&a.method!=="POST")return ye();let ae;try{ae=await a.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let oe=a.method==="POST";if(!oe&&ae&&typeof ae==="object"&&Object.hasOwn(ae,"integratorTenantId"))return Response.json({error:"integratorTenantId cannot be changed"},{status:400});let K=oe?await n.validate(ae):await o.validate(ae);if(K.issues)return al(K.issues,oe?"Tenant create validation failed":"Tenant update validation failed");let Q=oe?K.value.id:Z;if(!Q)return ye();if(Z!=null&&K.value.id!=null&&K.value.id!==Z)return Response.json({error:"Path id must match body id"},{status:400});let V;if(oe){let ce=K.value,T=await r.store.getByIntegratorTenantId(ce.integratorTenantId);if(T)Q=T.id,V=T;else if(V=await r.store.get(Q),V)return Response.json({error:"tenant_id_taken",message:"The suggested App tenant id is already in use; retry with another id."},{status:409})}else V=await r.store.get(Q);if(V&&!nn(V.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let D=new Date,te=V??{},re;if(oe){let ce=K.value,T=ce,g=T.status,P=nn(g)?g:V?.status??"completed";re={...te,...ce,id:Q,integratorTenantId:ce.integratorTenantId,companyId:ce.companyId,companyName:ce.companyName,environmentType:ce.environmentType,configLocator:ce.configLocator,email:ce.email??V?.email,webhookUrl:ce.webhookUrl??V?.webhookUrl,callbackUrl:ce.callbackUrl??V?.callbackUrl,tenantUrl:T.tenantUrl??V?.tenantUrl,status:P,error:T.error??V?.error,actionUrl:T.actionUrl??V?.actionUrl,requestToken:T.requestToken??V?.requestToken,expiresAt:T.expiresAt??V?.expiresAt,createdAt:V?.createdAt??D,updatedAt:D}}else{let ce=K.value,T=ce,g=T.status,P=nn(g)?g:V?.status??"completed",{configLocator:I,...R}=ce;re={...te,...R,id:Q,companyId:ce.companyId??V?.companyId??"",companyName:ce.companyName??V?.companyName??"",environmentType:ce.environmentType??V?.environmentType??"DEV",email:ce.email??V?.email,webhookUrl:ce.webhookUrl??V?.webhookUrl,callbackUrl:ce.callbackUrl??V?.callbackUrl,tenantUrl:T.tenantUrl??V?.tenantUrl,status:P,error:T.error??V?.error,actionUrl:T.actionUrl??V?.actionUrl,requestToken:T.requestToken??V?.requestToken,expiresAt:T.expiresAt??V?.expiresAt,configLocator:I??V?.configLocator,createdAt:V?.createdAt??D,updatedAt:D}}if(!re.tenantUrl)re.tenantUrl=pl(a,Q);if(!re.callbackUrl){let ce=d(re,a);if(ce)re.callbackUrl=ce.callbackUrl}if(V?.configLocator&&!Ai(V.configLocator,re.configLocator))await r.mirror?.purge(V.id);let ie=await r.store.upsert(re);if(oe)await s("created",()=>r.onTenantCreated?.({tenant:ie}));if(V?.integration?.status==="consented"&&!Ai(V.configLocator,re.configLocator))ie=await i(ie,V.configLocator);let se=gl(ie);if(se instanceof Response)return se;return Response.json(se.body,{status:se.status})}async function U(a){try{if(!e.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await j(a)}catch(y){return Kt(y)}}return{describe:()=>ve({module:"tm",active:!0,ready:!0,enabled:t.enabled,integrator:t.integrator,consentTtlSeconds:t.consentTtlSeconds,maxRedeemAttempts:t.maxRedeemAttempts}),handler:U,isReady:()=>!0,ready:async()=>{return},recordConsent:b,getTenant:async(a)=>r.store.get(a)}}var on="0.0.24-beta.20261005.20";import{ACCEPT_JSON as lo,assertEcid as ji,CONTENT_TYPE_FORM as fo,CONTENT_TYPE_JSON as yl,JSON_MEDIA_TYPE as sn,jwtAssertionClaimsSchema as hl,must as je,readJsonResponse as $i,workloadTokenResponseSchema as wl}from"@ionite/core";import{deriveClaimsEntitlements as vl,getCachedVerificationKey as Sl,getJwks as kl}from"@ionite/core/server";function Ve(e,t){return t in e&&e[t]!==void 0&&e[t]!==null}function Le(e){if(e===void 0||e===null)return!1;return Ve(e,"workloadId")||Ve(e,"privateKey")}function Ye(e){if(e===void 0||e===null)return!1;let t=Ve(e,"clientId"),r=Ve(e,"clientSecret"),n=Ve(e,"workloadId"),o=Ve(e,"privateKey");return(t||r)&&!n&&!o}function po(e){if(e===void 0||e===null)return!1;let t=Ve(e,"jwksUri"),r=Ve(e,"workloadId"),n=Ve(e,"clientId"),o=Ve(e,"clientSecret"),s=Ve(e,"privateKey");return t&&!r&&!s&&!n&&!o}function Ni(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function bl(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(Ni(t))return!1;let r=Object.entries(t);if(r.length===0)return!1;return r.every(([,n])=>Ni(n))}function zi(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if("incoming"in t||"outgoing"in t){if(t.incoming!==void 0&&(typeof t.incoming!=="object"||t.incoming===null))return!1;if(t.outgoing!==void 0&&(typeof t.outgoing!=="object"||t.outgoing===null||Array.isArray(t.outgoing)))return!1;return!0}return!1}function Bi(e){return zi(e)}function mo(e){if(!e)return;if(Bi(e))return Array.isArray(e.incoming)?void 0:e.incoming;return e}function So(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function Gt(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function Di(e){if(!e)return[];if(Array.isArray(e))return e.filter((t)=>!!t&&typeof t.issuer==="string"&&typeof t.jwksUri==="string").map((t)=>({issuer:t.issuer,jwksUri:t.jwksUri,audience:t.audience,claimsAsEntitlements:t.claimsAsEntitlements}));if(e.issuer&&e.jwksUri)return[{issuer:e.issuer,jwksUri:e.jwksUri,audience:e.audience??[],claimsAsEntitlements:e.claimsAsEntitlements}];return[]}function Rl(e){let t=e[0];if(!t)return;let r=So(t.audience);return{jwksUri:t.jwksUri,issuer:t.issuer,audience:typeof r[0]==="string"?r[0]:void 0}}function Ki(e,t){let r=Gt(t);if(!r)return;return e.find((n)=>Gt(n.issuer)===r)}function an(e,t,r){let n=So(e);if(t.some((o)=>n.includes(o)))return!0;if(typeof r==="string"&&t.includes(r))return!0;return!1}function go(e){if(!e||!Bi(e))return{};return e.outgoing??{}}function cn(e,t,r){return ve({name:e,ready:r,clientId:"clientId"in t?t.clientId:void 0,workloadId:"workloadId"in t?t.workloadId:void 0,idpTokenUrl:t.idpTokenUrl,scope:t.scope,audience:t.audience,authMethod:"clientSecret"in t?"client_secret":("privateKey"in t)?"private_key_jwt":"server_only"})}function Gi(e,t){let[r]=t.describe().outgoing;return{...r??cn(e,{},t.isReady()),name:e}}function yo(e,t){let r=e?.describe();return{module:"workload",active:e!==void 0||Object.keys(t).length>0,ready:e?.isReady()===!0||Object.values(t).some((n)=>n.isReady()),incoming:r?.incoming??{trustedIdps:[]},outgoing:Object.entries(t).map(([n,o])=>Gi(n,o)),urls:r?.urls??{}}}function Tl(e,t){return{describe:()=>Gi(e,t),getToken:t.getToken,refreshToken:t.refreshToken,generateJWTAssertion:t.generateJWTAssertion,revokeToken:t.revokeToken,beforeChange:t.beforeChange,afterChange:t.afterChange,isReady:t.isReady,ready:t.ready}}var ko=Symbol("ion.workloadClientState"),Hi=Symbol("ion.namedWorkloadClients");function Ht(e,t){let r=me(e,t);return{isReady:r.isReady,ready:r.ready}}function Cl(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...Ht(`workload client "${e}"`,()=>!1),describe:()=>cn(e,{},!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[ko]:"unavailable"}}function Vi(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it is no longer configured on this Ionite instance.`)};return{...Ht(`workload client "${e}"`,()=>!1),describe:()=>cn(e,{},!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[ko]:"removed"}}function Il(e){if(!e)return"removed";return e[ko]??"available"}function ho(e,t,r){let n=e,o=n,s=new Set;for(let i of r){if(s.add(i),i in o)continue;let c=t[i];o[i]=c?Tl(i,c):Cl(i)}return Object.defineProperty(o,Hi,{value:s,enumerable:!1,configurable:!0}),n}function Fi(e){if(!e)return[];let t=e[Hi];return t?Array.from(t):[]}function Pl(e,t,r){let n=t,o=Ke(r,`Workload client "${e}"`),s=()=>Il(n)==="available",i=me(`Workload client "${e}"`,s);return{api:{beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:i.isReady,ready:i.ready,describe:()=>n.describe(),getToken:(d)=>n.getToken(d),refreshToken:(d)=>n.refreshToken(d),generateJWTAssertion:(d)=>n.generateJWTAssertion(d),revokeToken:(d)=>n.revokeToken(d)},update(d){if(d===n)return;o.emitBefore(),n=d,i.refresh(),o.emitAfter()}}}function Ji(e){let t,r=!1,n=me("Workload module",()=>r),o=Ke(e,"Workload"),s=new Map,i=new Set,c=new Set(["beforeChange","afterChange","isReady","ready","describe"]),d=(p)=>{if(!t)throw Error(`${p} is unavailable because workload is not configured on this Ionite instance.`);return t},u={beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:n.isReady,ready:n.ready,describe:()=>t?.describe()??{module:"workload",active:!1,ready:!1,incoming:{trustedIdps:[]},outgoing:[],urls:{}},get config(){return t?.config??{}},getToken(...p){return d("getToken").getToken(...p)},refreshToken(p){return d("refreshToken").refreshToken(p)},generateJWTAssertion(p){return d("generateJWTAssertion").generateJWTAssertion(p)},revokeToken(p){return d("revokeToken").revokeToken(p)},validateToken(p){return d("validateToken").validateToken(p)},getWorkloadIdentity(p){return d("getWorkloadIdentity").getWorkloadIdentity(p)},parseJWT(p){return d("parseJWT").parseJWT(p)},handler(p){return d("handler").handler(p)}},l=(p)=>{for(let _ of i)delete u[_];if(i.clear(),!p)return;let k=new Set(Fi(p)),q=new Set([...c,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...k]);for(let[_,b]of Object.entries(p)){if(q.has(_))continue;u[_]=b,i.add(_)}},w=(p)=>{let k=s.get(p);if(k)return k;let q=Pl(p,Vi(p),e);if(s.set(p,q),!(p in u))u[p]=q.api;return q};return{update(p){if(!p&&!r&&s.size===0)return;o.emitBefore(),r=p!==void 0,n.refresh(),t=p;let k=new Set(Fi(p));for(let q of k){let _=p[q];w(q).update(_)}for(let[q,_]of s){if(k.has(q))continue;_.update(Vi(q))}return l(p),o.emitAfter(),u}}}async function wo(e,t,r){if(e===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let n=r[e];if(!n)throw Error(`Unknown workload client: ${e}`);return n.getToken(t)}function vo(e,t){return`${e}|${t??""}`}function st(e,t,r,n,o,s){let i={jwtAssertionClaims:e?.jwtAssertionClaims??hl("server"),tokenResponse:e?.tokenResponse??wl("server")},c=async(m,f)=>{let E=m;if(typeof E.validate==="function")return E.validate(f);return m["~standard"].validate(f)};if(!r&&!n)return;if(r&&zi(r)){let m=r.incoming,f=Di(m),E=Array.isArray(m)?Rl(m):m,A=mo(n),B=go(n),J=E?{...E,...A,jwksUri:E.jwksUri,issuer:E.issuer}:A;if(!J||!J.tokenUrl&&!J.jwksUri)t.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let G=J&&(J.tokenUrl||J.jwksUri)?st(e,t,E??void 0,A,f,s):void 0,de=Array.from(new Set([...Object.keys(r.outgoing??{}),...Object.keys(B)])).map((fe)=>[fe,{...r.outgoing?.[fe]??{},...B[fe]??{}}]),ne={};for(let[fe,Xe]of de){let Pe=st(e,t,Xe,void 0);if(Pe)ne[fe]=Pe}if(!G&&Object.keys(ne).length===0)return;let we={...G?.config??{},config:G?.config??{},describe:()=>yo(G,ne),...Ht("workload",()=>G?.isReady()===!0||Object.values(ne).some((fe)=>fe.isReady())),getToken:async(fe,Xe)=>wo(fe,Xe,ne),getServerToken:async(fe)=>{if(!G)throw Error("No server workload config");return G.getToken(fe)},refreshToken:async(fe)=>{if(!G)throw Error("No default workload config");return G.refreshToken(fe)},generateJWTAssertion:async(fe)=>{if(!G)throw Error("No default workload config");return G.generateJWTAssertion(fe)},revokeToken:async(fe)=>{if(!G)throw Error("No default workload config");return G.revokeToken(fe)},validateToken:async(fe)=>{if(!G)throw Error("No default workload config");return G.validateToken(fe)},getWorkloadIdentity:async(fe)=>{if(!G)return;return G.getWorkloadIdentity(fe)},parseJWT:async(fe)=>{if(!G)throw Error("No default workload config");return G.parseJWT(fe)},handler:async(fe)=>{if(!G)return ye();return G.handler(fe)}};return ho(we,ne,de.map(([fe])=>fe))}if(r&&bl(r)){let m=mo(n),f=go(n),E=r.default,A=E?{...E,...m,jwksUri:E.jwksUri,issuer:E.issuer}:m;if(!A||!A.tokenUrl&&!A.jwksUri)t.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let B=A&&(A.tokenUrl||A.jwksUri)?st(e,t,E??void 0,m):void 0,J=Array.from(new Set([...Object.keys(r).filter((ne)=>ne!=="default"),...Object.keys(f)])).map((ne)=>[ne,{...ne in r?r[ne]:{},...f[ne]??{}}]),G={};for(let[ne,we]of J){let fe=st(e,t,we,void 0);if(fe)G[ne]=fe}if(!B&&Object.keys(G).length===0)return;let de={...B?.config??{},config:B?.config??{},describe:()=>yo(B,G),...Ht("workload",()=>B?.isReady()===!0||Object.values(G).some((ne)=>ne.isReady())),getToken:async(ne,we)=>wo(ne,we,G),getServerToken:async(ne)=>{if(!B)throw Error("No server workload config");return B.getToken(ne)},refreshToken:async(ne)=>{if(!B)throw Error("No default workload config");return B.refreshToken(ne)},generateJWTAssertion:async(ne)=>{if(!B)throw Error("No default workload config");return B.generateJWTAssertion(ne)},revokeToken:async(ne)=>{if(!B)throw Error("No default workload config");return B.revokeToken(ne)},validateToken:async(ne)=>{if(!B)throw Error("No default workload config");return B.validateToken(ne)},getWorkloadIdentity:async(ne)=>{if(!B)return;return B.getWorkloadIdentity(ne)},parseJWT:async(ne)=>{if(!B)throw Error("No default workload config");return B.parseJWT(ne)},handler:async(ne)=>{if(!B)return ye();return B.handler(ne)}};return ho(de,G,J.map(([ne])=>ne))}let d=mo(n),u=go(n);if(!r&&Object.keys(u).length>0){let m={};for(let[A,B]of Object.entries(u)){let J=st(e,t,B,void 0);if(J)m[A]=J}let f=d&&(d.tokenUrl||d.jwksUri)?st(e,t,d,void 0):void 0;if(!f&&Object.keys(m).length===0)return;let E={...f?.config??{},config:f?.config??{},describe:()=>yo(f,m),...Ht("workload",()=>f?.isReady()===!0||Object.values(m).some((A)=>A.isReady())),getToken:async(A,B)=>wo(A,B,m),getServerToken:async(A)=>{if(!f)throw Error("No server workload config");return f.getToken(A)},refreshToken:async(A)=>{if(!f)throw Error("No default workload config");return f.refreshToken(A)},generateJWTAssertion:async(A)=>{if(!f)throw Error("No default workload config");return f.generateJWTAssertion(A)},revokeToken:async(A)=>{if(!f)throw Error("No default workload config");return f.revokeToken(A)},validateToken:async(A)=>{if(!f)throw Error("No default workload config");return f.validateToken(A)},getWorkloadIdentity:async(A)=>{if(!f)return;return f.getWorkloadIdentity(A)},parseJWT:async(A)=>{if(!f)throw Error("No default workload config");return f.parseJWT(A)},handler:async(A)=>{if(!f)return ye();return f.handler(A)}};return ho(E,m,Object.keys(u))}let l=r,w=o??Di(l),p=d?.tokenUrl,k=p?.startsWith("/")?p:void 0,q=l?.idpTokenUrl??d?.idpTokenUrl??(l?.tokenUrl&&(l.tokenUrl.startsWith("http://")||l.tokenUrl.startsWith("https://"))?l.tokenUrl:void 0),_={...l,...d,tokenUrl:k??d?.tokenUrl??l?.tokenUrl,idpTokenUrl:q,jwksUri:l?.jwksUri,issuer:l?.issuer};_._handlerTokenUrl=k;let b,j=_,U=Le(_),a=Ye(_),y=po(_);if(!U&&!a&&!y){if(!l||Object.keys(l).length===0)return;throw t.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(_),clientId:j.clientId,clientSecret:j.clientSecret?"[REDACTED]":void 0,workloadId:j.workloadId,privateKey:j.privateKey?"[REDACTED]":void 0,jwksUri:j.jwksUri,tokenUrl:j.tokenUrl,idpTokenUrl:j.idpTokenUrl,fromVaultKeys:l?Object.keys(l):[],fromCodeKeys:n?Object.keys(n):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(U)b={..._,tokenUrl:_.tokenUrl,idpTokenUrl:je(_.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:je(_.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:je(_.privateKey,"Missing 'privateKey' from Workload Config"),audience:je(_.audience,"Missing 'audience' from Workload Config"),scope:_.scope??"",algorithm:_.algorithm??"RS256",tokenLifetime:_.tokenLifetime??300,refreshThreshold:_.refreshThreshold??60,autoRefresh:_.autoRefresh!==void 0?_.autoRefresh:!0,tokenStore:_.tokenStore??new gt};else if(Ye(_))b={..._,tokenUrl:_.tokenUrl,idpTokenUrl:je(_.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:je(_.clientId,"Missing 'clientId' from Workload Config"),clientSecret:je(_.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:_.scope??"",tokenLifetime:_.tokenLifetime??300,refreshThreshold:_.refreshThreshold??60,autoRefresh:_.autoRefresh!==void 0?_.autoRefresh:!0,tokenStore:_.tokenStore??new gt};else if(po(_))b=_;function S(){let m=new Uint8Array(16);return crypto.getRandomValues(m),Array.from(m,(f)=>f.toString(16).padStart(2,"0")).join("")}function M(m){let f;if(typeof m==="string")f=btoa(m);else f=btoa(String.fromCharCode(...m));return f.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function F(m){let f=m.replace(/-/g,"+").replace(/_/g,"/");while(f.length%4)f+="=";return atob(f)}function Z(m){if(m.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:m==="RS256"?"SHA-256":m==="RS384"?"SHA-384":"SHA-512"};else if(m.startsWith("ION"))return{name:"ECDSA",namedCurve:m==="ES256"?"P-256":m==="ES384"?"P-384":"P-521",hash:m==="ES256"?"SHA-256":m==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${m}`)}async function Y(m,f){let E=m.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),A=Uint8Array.from(atob(E),(J)=>J.charCodeAt(0)),B=Z(f);return crypto.subtle.importKey("pkcs8",A,B,!1,["sign"])}async function ee(m,f,E){let A=await Y(f,E),J=new TextEncoder().encode(m),G=Z(E),de=await crypto.subtle.sign(G,A,J);return M(new Uint8Array(de))}async function ae(m,f=3,E=1000,A=30000){let B=Error("Placeholder Error");for(let J=0;J<=f;J++)try{return await m()}catch(G){if(B=G instanceof Error?G:Error(String(G)),B.message.includes("400")||B.message.includes("401")||B.message.includes("403")||B.message.includes("404"))throw B;if(J<f){let de=Math.min(E*2**J,A),ne=Math.random()*de*0.1;await new Promise((we)=>setTimeout(we,de+ne))}}throw B}async function oe(m){if(!Le(b))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=b,E=Math.floor(Date.now()/1000),A={iss:f.workloadId,sub:f.workloadId,aud:f.audience??"",exp:E+f.tokenLifetime,iat:E,jti:S(),scope:m??f.scope},B={alg:f.algorithm,typ:"JWT",kid:f.keyId},J=M(JSON.stringify(B)),G=M(JSON.stringify(A)),de=`${J}.${G}`,ne=await ee(de,f.privateKey,f.algorithm);return`${de}.${ne}`}async function K(m){if(!Le(b))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=b;return ae(async()=>{let E=f.idpTokenUrl,A=await oe(m),B=new URLSearchParams;if(B.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),B.append("assertion",A),m)B.append("scope",m);let J=await fetch(E,{method:"POST",headers:{...fo,...lo},body:B.toString()}),G=await $i(J,{log:t,operation:"token.acquire"});if(!J.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:G});let ne=G;throw Error(`Token acquisition failed: ${ne.error||J.statusText} - ${ne.error_description||""}`.trim())}let de=await c(i.tokenResponse,G);if(de.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:de.issues}),Error(`Token response validation failed: ${de.issues.map((ne)=>ne.message).join("; ")}`);if(f.tokenStore){let ne=new Date(Date.now()+(de.value.expires_in??300)*1000),we={workload_id:vo(f.workloadId,m),access_token:de.value.access_token,token_type:de.value.token_type,scope:de.value.scope,expires_at:ne,created_at:new Date,refresh_token:de.value.refresh_token};await f.tokenStore.set(we)}return de.value})}async function Q(m){if(!Ye(b))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let f=b;return ae(async()=>{let E=f.idpTokenUrl,A=new URLSearchParams;if(A.append("grant_type","client_credentials"),A.append("client_id",f.clientId),A.append("client_secret",f.clientSecret),m)A.append("scope",m);let B=await fetch(E,{method:"POST",headers:{...fo,...lo},body:A.toString()}),J=await $i(B,{log:t,operation:"token.acquire"});if(!B.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:J});let de=J;throw Error(`Token acquisition failed: ${de.error||B.statusText} - ${de.error_description||""}`.trim())}let G=await c(i.tokenResponse,J);if(G.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:G.issues}),Error(`Token response validation failed: ${G.issues.map((de)=>de.message).join("; ")}`);if(f.tokenStore){let de=new Date(Date.now()+(G.value.expires_in??300)*1000),ne={workload_id:vo(f.clientId,m),access_token:G.value.access_token,token_type:G.value.token_type,scope:G.value.scope,expires_at:de,created_at:new Date,refresh_token:G.value.refresh_token};await f.tokenStore.set(ne)}return G.value})}let V=new Map;function D(m,f){let E=V.get(m);if(E)return E;let A=(async()=>(Le(b)?await K(f??""):await Q(f??"")).access_token)();return V.set(m,A),A.catch(()=>{return}).finally(()=>{if(V.get(m)===A)V.delete(m)}),A}async function te(m){if(!Le(b)&&!Ye(b)){let B=b;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!B.clientId}, hasClientSecret=${!!B.clientSecret}, hasWorkloadId=${!!B.workloadId}, hasPrivateKey=${!!B.privateKey}, hasJwksUri=${!!B.jwksUri}`)}let f=b;m=m??f.scope;let E=Le(b)?b.workloadId:b.clientId,A=vo(E,m);if(f.tokenStore){let B=await f.tokenStore.get(A);if(B){let J=Date.now(),G=B.expires_at.getTime(),de=f.refreshThreshold*1000;if(J+de<G)return B.access_token;if(f.autoRefresh)try{return await D(A,m)}catch(ne){if(J<G)return t.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},ne),B.access_token;throw ne}}}return D(A,m)}async function re(m){if(!Le(b)&&!Ye(b))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=b;return m=m??f.scope,Le(f)?await K(m):await Q(m)}async function ie(m){if(!Le(b)&&!Ye(b))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");try{if(!b.revocationEndpoint)return;let f=new URLSearchParams;if(f.append("token",m),f.append("token_type_hint","access_token"),Le(b)){let A=b;f.append("client_id",A.workloadId)}else if(Ye(b)){let A=b;f.append("client_id",A.clientId),f.append("client_secret",A.clientSecret)}let E=await fetch(b.revocationEndpoint,{method:"POST",headers:{...lo,...fo},body:f.toString()});if(!E.ok)t.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:E.status,statusText:E.statusText});else t.info("Token revoked successfully",{"ion.module":"workload"});if(b.tokenStore){let A;if(Le(b))A=b.workloadId;else if(Ye(b))A=b.clientId;else return;await b.tokenStore.delete(A)}}catch(f){t.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},f)}}async function se(m,f){let E=m??b?.jwksUri;if(!E)throw Error("No JWKS URI configured in Workload Config");return await kl(E,t,f)}async function ce(m,f){let E=f??b?.jwksUri;if(!E)throw Error("No JWKS URI configured in Workload Config");let A=Le(b)?b.algorithm:"RS256";return Sl(E,m,`wl:${A}`,(B)=>{let J=B.alg||A,G=Z(J);return crypto.subtle.importKey("jwk",B,G,!1,["verify"])},t)}function T(m){let f=m.split(".");if(f.length!==3)throw Error("Invalid JWT");return JSON.parse(F(f[1]))}async function g(m,f){try{let E=m.split(".");if(E.length!==3)throw Error("Invalid JWT");let A=JSON.parse(F(E[0])),B=JSON.parse(F(E[1])),J=await ce(A.kid,f),G=E[2],ne=new TextEncoder().encode(`${E[0]}.${E[1]}`),we=Uint8Array.from(F(G),(mt)=>mt.charCodeAt(0)),fe=Z(A.alg);if(!await crypto.subtle.verify(fe,J,we,ne))throw Error("Invalid JWT signature");let Pe=await c(i.jwtAssertionClaims,B);if(Pe.issues)throw t.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:Pe.issues}),Error(`JWT claims validation failed: ${Pe.issues.map((mt)=>mt.message).join("; ")}`);return Pe.value}catch(E){throw t.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},E),E}}async function P(m){if(!Le(b)&&!Ye(b)&&!po(b))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(w.length>0){let A=T(m),B=typeof A.iss==="string"?A.iss:void 0,J=Ki(w,B);if(!J)return{valid:!1,error:"Untrusted token issuer"};let G=await g(m,J.jwksUri),de=Math.floor(Date.now()/1000);if(G.exp&&G.exp<de)return{valid:!1,error:"Token expired"};let ne=So(J.audience);if(ne.length>0&&!an(G.aud,ne,G.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:G,expiresAt:G.exp?new Date(G.exp*1000):void 0}}let f=await g(m),E=Math.floor(Date.now()/1000);if(f.exp&&f.exp<E)return{valid:!1,error:"Token expired"};if(Le(b)){if(b.audience&&!an(f.aud,[b.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else if(Ye(b)){if(b.issuer&&Gt(f.iss)!==Gt(b.issuer))return{valid:!1,error:"Invalid issuer"};if(b.audience&&!an(f.aud,[b.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else{let A=b;if(A.issuer&&Gt(f.iss)!==Gt(A.issuer))return{valid:!1,error:"Invalid issuer"};if(A.audience&&!an(f.aud,[A.audience],f.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:f,expiresAt:f.exp?new Date(f.exp*1000):void 0}}catch(f){return{valid:!1,error:f instanceof Error?f.message:String(f)}}}function I(m,f){let E=m[f];return typeof E==="string"&&E.trim()?E.trim():void 0}function R(m){if(!m)return;return m.startsWith("service-account-")?m.slice(16):m}function W(m){return I(m,"client_id")??I(m,"clientId")??I(m,"azp")??I(m,"appid")??R(I(m,"preferred_username"))}let h=new WeakMap;function O(m){let f=h.get(m);if(f)return f;let E=L(m);return h.set(m,E),E}async function L(m){let f=m.headers.get("Authorization");if(!f?.startsWith("Bearer "))return;let E=f.substring(7),A=await P(E);if(!A.valid||!A.claims)return;let B=w.length>0?Ki(w,A.claims.iss):void 0,J=A.claims.ecid,G=W(A.claims)??A.claims.sub??"",de=B?.claimsAsEntitlements??(w.length===0?l?.claimsAsEntitlements:void 0),ne=de?.claims?.length?await vl({block:de,claims:A.claims,scope:A.claims.scope,subjectType:"workload",subjectId:G||"workload",catalog:s?.(),log:t}):void 0,we={workloadId:A.claims.sub,clientId:W(A.claims),scope:A.claims.scope,...ne?{derivedEntitlements:ne}:{},...J!==void 0&&J!==null?{ecid:ji(J)}:{},claims:A.claims},fe=b?.workloadIdentityStore;if(fe){let Xe=we.clientId??we.workloadId??we.claims.sub,Pe=Xe?await fe.get(Xe):void 0;if(Pe){if(Pe.active===!1)return;if(Pe.scopes?.length){let mt=new Set([...(we.scope??"").split(/\s+/).filter(Boolean),...Pe.scopes]);we.scope=Array.from(mt).join(" ")}if(!we.ecid&&Pe.ecid)we.ecid=ji(Pe.ecid)}}return we}async function C(m){if(!b)throw Error("ionite Workload Manager not initialized");let f=new URL(m.url).pathname,E=(J)=>{if(!J)return;try{return new URL(J).pathname}catch{return J.startsWith("/")?J:`/${J}`}};if(E(b.validateUrl)===f&&m.method==="POST"){let J=m.headers.get("Authorization");if(!J?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type",sn]]});let G=J.substring(7),de=await P(G);if(!de.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type",sn]]});return new Response(JSON.stringify({valid:!0,expiresAt:de.expiresAt}),{status:200,headers:[["Content-Type",sn]]})}if(E(b.jwksUrl)===f&&m.method==="GET"){let J=await se();return new Response(JSON.stringify(J),{headers:[["Content-Type",sn]]})}return ye()}if(!b)throw Error("Workload configuration was not resolved.");return{...b,config:b,...Ht("workload",()=>!0),describe:()=>({module:"workload",active:!0,ready:!0,incoming:{trustedIdps:w.map((m)=>({issuer:m.issuer,jwksUri:m.jwksUri,audience:m.audience,...m.claimsAsEntitlements?.claims?.length?{claimsAsEntitlements:{claims:m.claimsAsEntitlements.claims,expand:m.claimsAsEntitlements.expand===!0,resources:m.claimsAsEntitlements.resources===!0,capable:!0}}:{}}))},outgoing:[cn("default",b,!0)],urls:{validateUrl:b.validateUrl??"",jwksUrl:b.jwksUrl??""}}),getToken:te,refreshToken:re,generateJWTAssertion:oe,revokeToken:ie,validateToken:P,getWorkloadIdentity:O,parseJWT:g,handler:C}}function bo(e){return e=e??"Workload authentication unavailable",new Response(JSON.stringify({error:e}),{status:503,statusText:e,headers:yl})}var un="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",Ol="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function El(e,t){je(t,un);let r=t.workload;if(!r)return;return r.getWorkloadIdentity(e)}async function Al(e,t,r){je(t,un);let n=t.workload;if(!n)throw bo();let o=n;if(typeof o.getServerToken!=="function"||typeof o.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return o.getToken(e,r)}async function _l(e,t){je(t,Ol);let r="validateToken"in t&&typeof t.validateToken==="function"?t:t.workload;if(!r)return{valid:!1,error:"Workload authentication unavailable"};let n=e.headers.get("Authorization");if(!n?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let o=n.substring(7);return r.validateToken(o)}async function Ll(e,t){je(t,un);let r=t.workload;if(!r)throw bo();return r.revokeToken(e)}async function xl(e,t){je(t,un);let r=t.workload;if(!r)throw bo();return r.handler(e)}export*from"@ionite/core";import{AssignmentPolicyError as Kh,generateULID as Vh,IoniteError as Fh,listGenerator as zh}from"@ionite/core";import{allowHosts as Gh,allowOrigins as Hh,allowRelativePaths as Jh,allowSameOrigin as Yh,blockDangerousUrls as Xh,CatalogAdjacencyCache as Zh,callback as Qh,captureRedirect as ew,ciam as tw,collectReferencedDefinitions as rw,defaultRedirectPolicies as nw,discoverSessionRecords as ow,discoverSessions as sw,expandRoot as iw,getCustomer as aw,getOwnedTenantIds as cw,getUser as uw,has as dw,hasAll as lw,hasAllScope as fw,hasAny as pw,hasAnyScope as mw,hasGroup as gw,hasPermission as yw,hasRole as hw,hasScope as ww,InMemoryTenantStore as vw,iam as Sw,initiateLogin as kw,isRedirectAllowed as bw,listSsoClientIdsFromCookies as Rw,planDiscoveredTenantCookies as Tw,reconcileSubjectAccess as Cw,resolveAfterRedirect as Iw,resolveCapturedRedirect as Pw,resolveRedirect as Ow,resolveTenantOwner as Ew,resolveTenantSession as Aw,sameOriginRedirectRules as _w,sendTenantWebhook as Lw,sso as xw,TENANT_OWNER_PERMISSION as Uw,tenantAccessLoginUrl as Mw,tenantOwnerEntitlementId as Ww,tenantOwnerPermission as qw,tenantResourceId as jw,verifyUser as $w,withSetCookies as Nw}from"@ionite/core/server";function Ro(e){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function Ul(e,t){return{...e,subscribe:async(r,n,o)=>{try{return await e.subscribe(r,n,o)}catch(s){if(!(s instanceof qe))throw s;return await ot(e,r,n,t,void 0,o)}}}}function dn(e){let t=kt(e.path,"path","azureConfig");Tt(e.ttl);let r=e.vault??en({type:"azure",authMethod:e.authMethod,entraTenantId:e.entraTenantId,clientId:e.clientId,clientSecret:e.clientSecret,federatedTokenFile:e.federatedTokenFile,managedIdentityClientId:e.managedIdentityClientId,imdsApiVersion:e.imdsApiVersion,vaultUrl:e.vaultUrl,vaultName:e.vaultName,apiVersion:e.apiVersion,secretNameTransform:e.secretNameTransform,secretNamePrefix:e.secretNamePrefix,scope:e.scope,ttl:e.ttl}),n=e.ttl?Ul(r,e.ttl):r;return{load:async()=>{try{return(await n.getFullSecret(t)).data}catch(o){let s=o instanceof Error?o.message:String(o);throw Error(`Error retrieving remote config from Azure Key Vault: ${s}`,{cause:o})}},subscribe:(o,s)=>n.subscribe(t,(i)=>{o(i.data)},s),secret:n}}import{IoniteError as Xl}from"@ionite/core";function To(e){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as $l,remoteConfigSecretType as Nl}from"@ionite/core";import{defaultLogger as Ml,defaultSecretContentType as Wl,stableConfigHash as Yi}from"@ionite/core";var ql=1e4;function jl(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Co(e){if(e.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let t=Array.from(new Set(e.paths.map((b)=>b.trim()).filter(Boolean)));if(t.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let r=e.logger??Ml,n=[],o=Promise.resolve(),s=!1,i=!1,c=!1,d=me("Secrets mirror",()=>s&&!c),u=(b)=>{let j=e.mapPath(b).trim();if(!j)throw Error(`mirrorSecrets mapPath returned an empty target for "${b}"`);return j},l=(b)=>{let j=o.then(b);return o=j.catch((U)=>{i=!0,r.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:U instanceof Error?U.message:String(U)})}),j},w=async(b)=>{if(await e.to.exists(b))await e.to.deleteSecret(b)},p=async(b,j)=>{if(c)return;if(!jl(j.data))throw Error(`mirrorSecrets can only re-store object values (source path "${b}")`);if(e.accept&&!e.accept(j,b))return;let U=u(b);if(await e.to.exists(U)){let a=await e.to.getSecret(U);if(Yi(a)===Yi(j.data)){i=!1;return}}await e.to.putSecret(U,j.data,{contentType:j.metadata.contentType??Wl()}),i=!1},k=async(b)=>{await w(u(b)),i=!1},q=(b)=>{if(b.event!=="path_removed")return t.includes(b.path)?[b.path]:[];let j=`${b.path.replace(/\/+$/g,"")}/`;return t.filter((U)=>U===b.path||U.startsWith(j))},_=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if(e.from.subscribeEvents)n.push(e.from.subscribeEvents((b)=>{if(_.has(b.event)){let j=q(b);if(j.length>0)l(async()=>{for(let U of j)await k(U)})}try{e.onEvent?.(b)}catch(j){r.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:b.path,event:b.event,error:j instanceof Error?j.message:String(j)})}}));return(async()=>{let b=new Set(t);for(;;){try{for(let j of[...b]){let U=await e.from.subscribe(j,(a)=>{l(()=>p(j,a))},e.subscription);if(c){U();return}n.push(U),b.delete(j)}if(await o,c)return;s=!0,d.refresh();return}catch(j){if(c)return;i=!0,r.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:j instanceof Error?j.message:String(j)})}if(await new Promise((j)=>{setTimeout(j,ql).unref?.()}),c)return}})(),{isReady:d.isReady,ready:d.ready,isAvailable:()=>s&&!c&&!i&&(e.from.isAvailable?.()??!0)&&(e.to.isAvailable?.()??!0),async purge(){if(c)throw Error("Secrets mirror is closed");await l(async()=>{for(let b of t)await k(b)})},async close(){if(c)return;c=!0;for(let b of n.splice(0))b();d.refresh(),d.settle(),await o}}}function Jt(e){return typeof e.getFullSecret==="function"}function Io(e){let t=e;return typeof t.handleDelivery==="function"&&typeof t.handleEvents==="function"&&typeof t.isDeliveryRequest==="function"&&typeof t.isEventsRequest==="function"}function Xi(e){return e.type==="vault"&&[e.vaultLfvServerUrl,e.vaultLfvClientId,e.vaultLfvDeliveryEndpoint,e.vaultLfvVerifyJwks,e.vaultLfvEventsEndpoint].some((t)=>t!==void 0)}function xe(e,t){if(!e?.trim())throw Error(`Mirrored LFV config requires ${t}`);return e}function Dl(e,t){if(t?.trim())return t;if(Jt(e))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if(e.type==="vault")return xe(e.vaultLfvPath??e.vaultPath,"an upstream vault path");if(e.type==="azure")return xe(e.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${e.type}" requires an explicit fromPath`)}function Kl(e,t){let r=xe(e.vaultLfvPath??e.vaultPath,"vaultLfvPath or vaultPath");return St({lfvServerUrl:xe(e.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:xe(e.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:xe(e.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:xe(e.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:xe(e.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:r,deliveryTimeout:e.vaultLfvDeliveryTimeout,retryInterval:e.vaultLfvRetryInterval,warnInterval:e.vaultLfvWarnInterval,log:t},void 0,{selfRedeemReads:!0})}function Vl(e){return e.metadata.contentType?.typeId===Nl.id&&typeof e.data.id==="string"&&e.data.id.trim().length>0}function Fl(e,t,r,n){return{...e,close:r,subscribePassive:(o,s)=>t.subscribePassive(o,s),isDeliveryRequest:(o)=>t.isDeliveryRequest(o),isEventsRequest:(o)=>t.isEventsRequest(o),handleDelivery:(o)=>(n(),t.handleDelivery(o)),handleEvents:(o)=>(n(),t.handleEvents(o)),deliveryPath:t.deliveryPath,eventsPath:t.eventsPath,callbackKey:t.callbackKey,trustId:t.trustId}}function yr(e){let t=e.logger??$l,r=Dl(e.from,e.fromPath),n=!Jt(e.from),o=!Jt(e.to),s=Jt(e.from)?e.from:Xi(e.from)?Kl(e.from,t):it(e.from).secret,i=Jt(e.to)?e.to:it(e.to).secret,c=xe(e.path,"path"),d=Po(i,c,{ttl:e.ttl}),u,l=!1,w=!1,p,k=()=>{if(p)return;p=s.getFullSecret(r).then(()=>{return}).catch((a)=>{p=void 0,t.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:a instanceof Error?a.message:String(a)})})},q=(a)=>{if(l)throw Error("Mirrored ConfigSource is closed");if(!u){w=a;let y=!a&&Io(s)?{...s,subscribe:(S,M)=>s.subscribePassive(S,M)}:s;u=Co({from:y,to:i,paths:[r],mapPath:()=>c,accept:Vl,logger:t})}else if(a&&!w)k();return u},_={isReady:()=>u?.isReady()??!1,ready:(a)=>q(!0).ready(a),isAvailable:()=>u?.isAvailable()??!1,purge:()=>q(!1).purge(),close:async()=>{await u?.close()}},b=async()=>{if(l)return;if(l=!0,await u?.close(),n)await s.close?.();if(o)await i.close?.()},j=Io(s)?Fl(i,s,b,()=>{q(!1)}):{...i,close:b},U={load:async()=>{try{let a=await d.load();return q(!1),a}catch(a){throw q(!0),a}},subscribe:(a,y)=>(q(!1),d.subscribe(a,y)),secret:j,mirror:_,async handleCallback(a,y){if(!Io(s))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return q(!1),a==="delivery"?s.handleDelivery(y):s.handleEvents(y)}};if(Object.defineProperties(U,{log:{get:()=>d.log,set:(a)=>{d.log=a},enumerable:!0},validators:{get:()=>d.validators,set:(a)=>{d.validators=a},enumerable:!0}}),!Jt(e.from)&&Xi(e.from)){let a=e.from;U[Nt]={path:r,lfvServerUrl:xe(a.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:xe(a.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:xe(a.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:xe(a.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:xe(a.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:a.vaultLfvDeliveryTimeout,retryInterval:a.vaultLfvRetryInterval,warnInterval:a.vaultLfvWarnInterval}}return U}class Pt extends Error{constructor(e,t=`Waiting for vault config secret at ${e}`){super(t);this.path=e;this.code="not_found";this.sourceType="vault";this.status=404;this.name="VaultConfigWaitingForSecretError"}}function zl(e){return e instanceof Pt}class hr extends Error{constructor(e,t){super(t);this.path=e;this.code="invalid_payload";this.sourceType="vault";this.name="VaultConfigInvalidPayloadError"}}function Bl(e){return e instanceof hr}var ea=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function Zi(e){return ea.some((t)=>(t in e))}function Qi(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw new Pt(t,`Vault config secret at ${t} is missing or not an object`);let r=e;if(!Zi(r)&&Object.keys(r).length===1&&"data"in r){let n=r.data;if(n&&typeof n==="object"&&!Array.isArray(n))r=n}if(Object.keys(r).length===0)throw new Pt(t,`Vault config secret at ${t} is empty`);if(!Zi(r))throw new hr(t,`Vault config secret at ${t} is an invalid payload: not a RemoteConfig (no known keys: ${ea.join("/")})`);return r}function Gl(e,t,r){return{...e,subscribe:async(n,o,s)=>{try{return await e.subscribe(n,o,s)}catch(i){if(!(i instanceof qe))throw i;return await ot(e,n,o,t,r(),s)}}}}function ln(e){let t=kt(e.path,"path","vaultConfig");Tt(e.ttl);let r=e.vault??zt({type:"vault",url:e.url,token:e.token,workload:e.workload,lfv:e.lfv,websocket:e.websocket,ttl:e.ttl,log:e.log}),n=e.vault&&e.ttl?Gl(r,e.ttl,()=>e.log):r,o={get log(){return e.log},set log(s){if(e.log=s,n&&"log"in n)n.log=s},load:async()=>{try{let s=await n.getFullSecret(t);return Qi(s.data,t)}catch(s){if(s instanceof nt)throw new Pt(t);if(s instanceof Pt||s instanceof hr)throw s;throw Error("Error retrieving remote config from vault",{cause:s})}},subscribe:(s,i)=>n.subscribe(t,(c)=>{let d;try{d=Qi(c.data,t)}catch(u){e.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:t,error:u instanceof Error?u.message:String(u)});return}s(d)},i),secret:n};if(e.lfv?.lfvServerUrl&&e.lfv.clientId&&e.lfv.deliveryEndpoint&&e.lfv.eventsEndpoint)o[Nt]={path:e.lfv.path??t,lfvServerUrl:e.lfv.lfvServerUrl,clientId:e.lfv.clientId,deliveryTimeout:e.lfv.deliveryTimeout,retryInterval:e.lfv.retryInterval,warnInterval:e.lfv.warnInterval,deliveryEndpoint:e.lfv.deliveryEndpoint,eventsEndpoint:e.lfv.eventsEndpoint,verifyJwks:e.lfv.verifyJwks};return o}function fn(e){if(e==null)return;if(typeof e==="number")return Number.isFinite(e)?e:void 0;let t=e.trim();if(!t)return;let r=Number.parseInt(t,10);return Number.isFinite(r)?r:void 0}function Hl(e,t){let r=e.vaultLfvServerUrl??t?.lfvServerUrl,n=e.vaultLfvClientId??t?.clientId,o=e.vaultLfvDeliveryEndpoint??t?.deliveryEndpoint,s=e.vaultLfvEventsEndpoint??t?.eventsEndpoint;if(!r||!n||!o||!s)return t;return{...t,lfvServerUrl:r,clientId:n,deliveryEndpoint:o,verifyJwks:e.vaultLfvVerifyJwks??t?.verifyJwks,eventsEndpoint:s,path:e.vaultLfvPath??t?.path,deliveryTimeout:fn(e.vaultLfvDeliveryTimeout)??t?.deliveryTimeout,retryInterval:fn(e.vaultLfvRetryInterval)??t?.retryInterval,warnInterval:fn(e.vaultLfvWarnInterval)??t?.warnInterval}}function Jl(e,t){let r=e.vaultWebsocketUrl??t?.url;if(!r)return t;return{...t,url:r,token:e.vaultWebsocketToken??t?.token,clientId:e.vaultWebsocketClientId??t?.clientId,header:e.vaultWebsocketHeader??t?.header}}function Yl(e,t){let r=e.vaultWorkloadTokenUrl??t?.idpTokenUrl,n=e.vaultWorkloadClientId??t?.clientId,o=e.vaultWorkloadClientSecret??t?.clientSecret;if(!r||!n||!o)return t;return{...t,idpTokenUrl:r,clientId:n,clientSecret:o,scope:e.vaultWorkloadScope??t?.scope}}function ta(e,t){return{...t,url:e.vaultUrl??t?.url,token:e.vaultToken??t?.token,path:e.vaultPath??t?.path,ttl:fn(e.vaultTtl)??t?.ttl,workload:Yl(e,t?.workload),lfv:Hl(e,t?.lfv),websocket:Jl(e,t?.websocket)}}function it(e){switch(e.type){case"vault":return Ql(e);case"azure":return ef(e);case"aws":return tf(e);case"gcp":return rf(e);case"mirror":return Zl(e);default:throw Error(`Unsupported config locator type: ${e.type}`)}}function Zl(e){if(e.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!e.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return yr({from:e.from,to:e.to,path:e.to.vaultPath,ttl:e.to.vaultTtl})}function Ql(e){return ln(ta(e))}function ef(e){return dn({authMethod:e.azureAuthMethod,entraTenantId:e.azureEntraTenantId,clientId:e.azureClientId,clientSecret:e.azureClientSecret,federatedTokenFile:e.azureFederatedTokenFile,managedIdentityClientId:e.azureManagedIdentityClientId,imdsApiVersion:e.azureImdsApiVersion,vaultUrl:e.azureVaultUrl,vaultName:e.azureVaultName,apiVersion:e.azureApiVersion,scope:e.azureScope,secretNamePrefix:e.azureSecretNamePrefix,path:e.azurePath,ttl:e.azureTtl})}function tf(e){return Ro({webhookUrl:e.awsWebhookUrl,ttl:e.awsTtl})}function rf(e){return To({ttl:e.gcpTtl})}function Po(e,t,r={}){switch(e.type){case"vault":return ln({vault:e,path:t,ttl:r.ttl});case"azure":return dn({vault:e,path:t,ttl:r.ttl});default:throw new Xl(`configFromSource is not supported for secrets source type "${e.type}" (path "${t}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function Ot(e){if(!e)return;let t=Number.parseInt(e,10);return Number.isFinite(t)?t:void 0}function pn(e,t){let r=t?.type??e.ION_CONFIG_TYPE;if(!r)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(r==="vault")return{type:"vault",vaultUrl:e.ION_VAULT_URL,vaultToken:e.ION_VAULT_TOKEN,vaultPath:e.ION_VAULT_PATH??"",vaultTtl:Ot(e.ION_VAULT_TTL),vaultWorkloadTokenUrl:e.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:e.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:e.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:e.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:e.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:e.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:e.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:e.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:e.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:e.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:Ot(e.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:Ot(e.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:Ot(e.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:e.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:e.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:e.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:e.ION_VAULT_WEBSOCKET_HEADER};if(r==="azure")return{type:"azure",azurePath:e.ION_AZURE_PATH,azureApiVersion:e.ION_AZURE_API_VERSION,azureScope:e.ION_AZURE_SCOPE,azureSecretNamePrefix:e.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:e.ION_AZURE_AUTH_METHOD,azureEntraTenantId:e.ION_AZURE_TENANT_ID,azureClientId:e.ION_AZURE_CLIENT_ID,azureClientSecret:e.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:e.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:e.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:e.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:e.ION_AZURE_VAULT_URL,azureVaultName:e.ION_AZURE_VAULT_NAME,azureTtl:Ot(e.ION_AZURE_TTL)};if(r==="aws")return{type:"aws",awsWebhookUrl:e.ION_AWS_WEBHOOK_URL??"",awsTtl:Ot(e.ION_AWS_TTL)};if(r==="gcp")return{type:"gcp",gcpTtl:Ot(e.ION_GCP_TTL)};if(r==="mirror"){let n={};for(let[c,d]of Object.entries(e))if(c.startsWith("ION_FROM_"))n[`ION_${c.slice(9)}`]=d;if(n.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let o=pn(n),s=pn(e,{type:"vault"});if(!s.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let i={type:"vault",vaultUrl:s.vaultUrl,vaultToken:s.vaultToken,vaultPath:s.vaultPath,vaultTtl:s.vaultTtl,vaultWorkloadTokenUrl:s.vaultWorkloadTokenUrl,vaultWorkloadClientId:s.vaultWorkloadClientId,vaultWorkloadClientSecret:s.vaultWorkloadClientSecret,vaultWorkloadScope:s.vaultWorkloadScope,vaultWebsocketUrl:s.vaultWebsocketUrl,vaultWebsocketToken:s.vaultWebsocketToken,vaultWebsocketClientId:s.vaultWebsocketClientId,vaultWebsocketHeader:s.vaultWebsocketHeader};return{type:"mirror",from:o,to:i}}throw Error(`ION_CONFIG_TYPE="${r}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function ra(e,t){return it(pn(e,t))}function nf(e){return ra(process.env,e)}var of=1000,sf=30000,na=["vault","azure","aws","gcp"];function oa(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Config locator at ${t} is an invalid payload: expected an object with a "type" field`);let r=e.type;if(typeof r!=="string"||!na.includes(r))throw Error(`Config locator at ${t} is an invalid payload: unknown type "${String(r)}" (expected ${na.join("/")})`)}function sa(e,t){return e.log??=t.log,e.validators??=t.validators,e}function wr(e){if(!e?.secret?.close)return;try{Promise.resolve(e.secret.close()).catch((t)=>{e.log?.warn?.("secretConfigSource: inner source close failed",t)})}catch(t){e.log?.warn?.("secretConfigSource: inner source close failed",t)}}function af(e,t){let r=kt(t,"path","secretConfigSource"),n,o=(i)=>{oa(i,r);let c=JSON.stringify(i);if(n&&n.hash===c)return n.inner;let d=n?.inner,u=sa(it(i),s);if(n={hash:c,inner:u},d&&d!==u)wr(d);return u},s={async load(){let i=await e.getSecret(r);return o(i).load()},async subscribe(i,c){let d,u=!1,l=!1,w,p,k=new Promise((S,M)=>{w=S,p=M}),q=Br(),_,b,j=(S)=>new Promise((M)=>{b=M,_=setTimeout(M,S)}),U=async(S,M)=>{oa(S,r);let F=JSON.stringify(S),Z=n!==void 0&&n.hash===F;if(Z&&d)return;let Y=n?.inner,ee=d,ae=Z&&n?n.inner:sa(it(S),s),oe=!Z,K=()=>{if(oe&&ae!==Y)wr(ae)};try{if(ae.subscribe){let V=await ae.subscribe(i,c)??void 0;if(u||!q.isCurrent(M)){V?.(),K();return}if(d=V,n={hash:F,inner:ae},ee&&ee!==V)ee();if(oe&&Y&&Y!==ae)wr(Y);return}let Q=await ae.load();if(u||!q.isCurrent(M)){K();return}if(n={hash:F,inner:ae},ee)ee(),d=void 0;if(oe&&Y&&Y!==ae)wr(Y);i(Q)}catch(Q){throw K(),Q}},a=async(S)=>{let M=q.next(),F=of;for(;;){if(u||!q.isCurrent(M))return;try{await U(S,M);return}catch(Z){if(u||!q.isCurrent(M))return;s.log?.warn(`secretConfigSource rebind for ${r} failed; keeping last-known-good source and retrying in ${F}ms`,Z),await j(F),F=Math.min(sf,F*2)}}},y=await e.subscribe(r,(S)=>{if(u)return;if(!l){U(S.data,q.next()).then(()=>{l=!0,w()}).catch((M)=>{l=!0,p(M)});return}a(S.data)},c);return await k,()=>{if(u=!0,q.next(),_)clearTimeout(_);b?.(),d?.(),y(),wr(n?.inner),n=void 0}},secret:e};return s}import{compareDisplayExpiryDesc as ia,projectDisplayUser as aa,readDisplayCookies as cf}from"@ionite/core";import{discoverSessions as uf,getCustomer as df,getOwnedTenantIds as lf}from"@ionite/core/server";function mn(e,t){let r=e?.[t];return typeof r==="string"?r:""}function ff(e){if(!e)return;let t=e instanceof Date?e:new Date(e);return Number.isNaN(t.getTime())?void 0:t.toISOString()}function pf(e,t){let r=e.tenantId?.trim();if(!r)return;let n={name:mn(e.claims,"name")||mn(e.claims,"preferred_username"),email:mn(e.claims,"email"),avatar:mn(e.claims,"picture")},o=ff(e.expiresAt);return{tenantId:r,authType:e.authType,source:"session",user:aa(n,t),...o?{expiresAt:o}:{}}}function mf(e){let t=new Map;for(let r of e){let n=typeof r.user.email==="string"?r.user.email:void 0,o=typeof r.user.name==="string"?r.user.name:void 0,s=n||o||r.tenantId,i=t.get(s);if(i){i.tenants.push(r);continue}t.set(s,{...n?{email:n}:{},...o?{name:o}:{},tenants:[r]})}return[...t.values()]}async function gf(e,t){let n=(await uf(e,t.sessionStore,{...t.cookiesPrefix!==void 0?{cookiesPrefix:t.cookiesPrefix}:{}})).map((w)=>pf(w,t.displayUser)).filter((w)=>Boolean(w)).sort((w,p)=>ia(w.expiresAt,p.expiresAt)),o=typeof t.max==="number"&&t.max>=1?Math.floor(t.max):10,s=n.slice(0,o),i=new Set(s.map((w)=>w.tenantId));if(t.ion){let w=await df(e,t.ion);if(w?.id){let p=await lf(t.ion,w.id),k=aa({name:w.name,email:w.email,avatar:w.avatar},t.displayUser);for(let q of p){if(i.has(q))continue;i.add(q),s.push({tenantId:q,authType:"ciam",source:"owner",user:k})}}}let c=Date.now(),d=typeof t.maxDiscovered==="number"&&t.maxDiscovered>=1?Math.floor(t.maxDiscovered):10,u=cf(e.headers.get("cookie")).filter((w)=>w.envelope.kind==="discovered"&&Boolean(w.envelope.tenantId)&&Date.parse(w.envelope.expiresAt)>c).sort((w,p)=>ia(w.envelope.expiresAt,p.envelope.expiresAt)),l=0;for(let w of u){let p=w.envelope.tenantId;if(!p||i.has(p))continue;if(l>=d)break;l+=1,i.add(p),s.push({tenantId:p,authType:w.envelope.authType,source:"discovered",user:w.envelope.user,expiresAt:w.envelope.expiresAt,...w.envelope.tenantName?{tenantName:w.envelope.tenantName}:{}})}if(t.tenantLabel)for(let w of s){let p=await t.tenantLabel(w.tenantId);if(p)w.tenantName=p}return{tenants:s,groups:mf(s)}}import{listGenerator as yf}from"@ionite/core";import{TENANT_OWNER_PERMISSION as hf,tenantOwnerEntitlementId as ca,tenantResourceId as wf}from"@ionite/core/server";async function vf(e,t){let r=e.authz.catalogStore;if(!r)throw Error("Cannot materialize tenant owner entitlement: no AccessCatalogStore is wired.");let n=t.displayName?.trim()||t.tenantId,o={id:ca(t.tenantId),name:`Owner of ${n}`,description:`Administer the ${n} tenant`,source:"app",requestable:!0,riskLevel:"privileged",permissions:[hf],resources:[wf(t.tenantId)],assignableSubjectTypes:["customer"],recommendedSubjectTypes:["customer"]},s=r.groups.insertIfAbsent(o);return await s.ready(),s}async function Sf(e,t){let r=e.authz.catalogStore,n=e.authz.accessStore;if(!r)throw Error("Cannot clean up tenant entitlements: no AccessCatalogStore is wired.");if(!n)throw Error("Cannot clean up tenant entitlements: no AccessAssignmentStore is wired.");let o=ca(t.tenantId),s=[];for await(let c of yf((d,u)=>n.listByTarget("group",o,{start:d,limit:u})))s.push(c);for(let c of s)await e.authz.revoke(c);let i=await r.groups.get(o);if(i)await r.groups.delete(o);return{revoked:s.length,deleted:i?1:0}}function Oo(e){if(Array.isArray(e))return e.map(Oo);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,Oo(r)]));return e}function ua(e){return JSON.stringify(Oo(e))}function kf(e){if(e.type==="vault")return e.vaultLfvPath??e.vaultPath;if(e.type==="azure"&&e.azurePath?.trim())return e.azurePath;throw Error(`Tenant config locator type "${e.type}" does not declare a mirrorable config path`)}function bf(e,t){let r=t.logger??e.log,n=new Map,o=!1,s=async(u)=>{if(u.closed)return;u.closed=!0,u.closeHooks?.(),await u.hookSetup?.catch(()=>{return}),await u.source.secret.close?.()},i=(u)=>{let l=(async()=>{let w=await t.store.get(u);if(!w)throw Error(`Tenant "${u}" was not found`);if(!w.configLocator)throw Error(`Tenant "${u}" has no configLocator`);let p=w.configLocator,k=t.path(w).trim();if(!k)throw Error(`Tenant mirror path is empty for "${u}"`);let q=t.sourceFromLocator?.(p,w)??p,b={source:yr({from:q,fromPath:kf(p),to:t.to,path:k,logger:r}),locatorFingerprint:ua(p),targetPath:k,closed:!1};if(t.hooks?.onRemoteConfigChange)b.hookSetup=t.to.subscribe(k,(j)=>{Promise.resolve(t.hooks?.onRemoteConfigChange?.(w,j.data,j)).catch((U)=>{r.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:u,error:U instanceof Error?U.message:String(U)})})}).then((j)=>{b.closeHooks=j}).catch((j)=>{r.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:u,error:j instanceof Error?j.message:String(j)})});return b})();return n.set(u,l),l.catch(()=>{if(n.get(u)===l)n.delete(u)}),l},c=async(u,l,w)=>{if(n.get(u)===l)n.delete(u);await s(w)},d=async(u)=>{if(o)throw Error("Tenant config mirror is closed");let l=n.get(u);if(!l)return i(u);let w=await l,p=await t.store.get(u);if(!p?.configLocator)throw await c(u,l,w),Error(p?`Tenant "${u}" has no configLocator`:`Tenant "${u}" was not found`);if(ua(p.configLocator)!==w.locatorFingerprint)return await c(u,l,w),n.get(u)??i(u);return w};return{async ensure(u,l){await(await d(u)).source.mirror.ready(l)},async handleCallback(u,l,w){try{return await(await d(u)).source.handleCallback(l,w)}catch(p){let k=p instanceof Error?p.message:String(p),q=k.includes("was not found")?404:503;return r.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:u,kind:l,error:k}),Response.json({error:q===404?"Tenant not found":"Tenant config mirror unavailable"},{status:q})}},async purge(u){let l=n.get(u),w=l?await l:void 0,p=await t.store.get(u),k=w?.targetPath??(p?t.path(p).trim():void 0);if(w&&l)await c(u,l,w);if(k&&await t.to.exists(k))await t.to.deleteSecret(k);if(p)await t.hooks?.onRemoteConfigRevoke?.(p)},async close(){if(o)return;o=!0;let u=[...n.values()];n.clear(),await Promise.all(u.map(async(l)=>{try{await s(await l)}catch{}}))}}}import{buildTenantPath as Rf,DEFAULT_TENANT_API_NAMESPACE as la,DEFAULT_TENANT_UI_NAMESPACE as fa,matchTenantHost as Tf,matchTenantPath as pa,normalizeTenantPathNamespace as da}from"@ionite/core";function Cf(){return Response.json({error:"Tenant not found"},{status:404})}function If(e){return Response.json({error:`Tenant runtime unavailable for ${e}`},{status:503})}function Pf(e,t){let r=!e||e.type===void 0||e.type==="path"?e:void 0;if(t==="api")return da(r?.api??la);return da(r?.ui??fa)}function Of(e){if(e.store)return async(t)=>e.store.getIon(t);return async(t)=>await e.getIon(t)??void 0}async function ma(e,t={}){if(t.custom){let s=await t.custom(e);if(s)return{id:s}}if(t.strategy?.type==="selector")return null;if(t.strategy?.type==="host"){let s=Tf(new URL(e.url).hostname,t.strategy.baseDomain);return s?{id:s.id}:null}let r=t.namespace??"api",n=Pf(t.strategy,r),o=pa(new URL(e.url).pathname,n);if(!o)return null;return{id:o.id,context:{namespace:r,restPath:o.restPath,restSegments:o.restSegments}}}function ga(e,t){let r=new URL(e.url);return r.pathname=t,new Request(r,e)}function Eo(e,t,r,n){let o=pa(new URL(e.url).pathname,r);if(!o||o.id!==t)return e;return ga(e,Rf(t,o.restPath,n))}function Ef(e,t,r={beforeTenantSegments:["api"],afterTenantSegments:[]}){return Eo(e,t,la,r)}function Af(e,t,r={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return Eo(e,t,fa,r)}function _f(e){return async function(r){try{let n=e.resolveTenant?await e.resolveTenant(r):await ma(r),o=typeof n==="string"?{id:n,context:void 0}:n??null;if(!o?.id)return e.onMissingTenant?await e.onMissingTenant(r):Cf();let s=await e.getIon(o.id,r)??null;if(!s)return e.onMissingIonite?await e.onMissingIonite(r,o.id):If(o.id);let i=e.rewriteRequest?await e.rewriteRequest(r,{id:o.id,ion:s,context:o.context}):r;return s.handler(i)}catch(n){return Kt(n)}}}import{list as Lf,matchesListFilter as xf}from"@ionite/core";class ya{constructor(){this.identities=new Map;this.clientIdIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.identities.get(e)}async lookup(e){if(e.id){let t=this.identities.get(e.id);if(t)return t}if(e.clientId){let t=this.clientIdIndex.get(e.clientId);if(t)return this.identities.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.identities.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n=this.identities.get(t),o={...e,id:t,createdAt:n?.createdAt??e.createdAt??r,updatedAt:r};if(n?.clientId&&n.clientId!==o.clientId)this.clientIdIndex.delete(n.clientId);if(n?.externalId&&n.externalId!==o.externalId)this.externalIdIndex.delete(n.externalId);if(this.identities.set(t,o),o.clientId)this.clientIdIndex.set(o.clientId,t);if(o.externalId)this.externalIdIndex.set(o.externalId,t);return o}async delete(e){let t=this.identities.get(e);if(t?.clientId)this.clientIdIndex.delete(t.clientId);if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.identities.delete(e),t?1:0}async list(e){let t=Array.from(this.identities.values()).filter((c)=>xf(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return Lf(o,i,r,n)}}var Kf=30000;function Vf(e){let t=e,r=t.basePath??Er(),n=t.readyTimeoutMs??Kf,o=Or(t.stores),{routing:s,beforeChange:i,afterChange:c,configRetry:d,onConfigLoadError:u}=t;return{frameworkConfig:{log:e.log,validators:e.validators,sso:e.sso,iam:e.iam,workload:e.workload,secrets:e.secrets,lfv:e.lfv,ciam:e.ciam,tm:e.tm,authz:e.authz,otel:e.otel},basePath:r,readyTimeoutMs:n,stores:o,options:{beforeChange:i,afterChange:c,routing:s,configRetry:d,onConfigLoadError:u}}}function Ff(e){let t=e,r={trace:(n,...o)=>t.trace(n,...o),debug:(n,...o)=>t.debug(n,...o),info:(n,...o)=>t.info(n,...o),warn:(n,...o)=>t.warn(n,...o),error:(n,...o)=>t.error(n,...o)};return{logger:r,update(n){return t=n,r}}}function Ca(e,t){let r=e;return r.setStores=(n)=>{t.current=Or(n),Object.assign(r,Zt(r,t.current))},r}function wa(e){let t=e?.replace(/\s+/g," ").trim();return t?t:void 0}function Ia(e){if(typeof e!=="object"||e===null)return;return e.cause}function zf(e){if(!(e instanceof Error))return typeof e==="string"?wa(e):void 0;let t=wa(e.message),r=[],n=e;if(typeof n.code==="string")r.push(`code=${n.code}`);if(typeof n.status==="number")r.push(`status=${n.status}`);if(typeof n.path==="string")r.push(`path=${n.path}`);if(r.length===0)return t;if(!t)return r.join(", ");return`${t} [${r.join(", ")}]`}function Wo(e,t=3){let r=[],n=e,o=0;while(n!=null&&o<t){let s=zf(n);if(s&&!r.includes(s))r.push(s);n=Ia(n),o+=1}return r.length>0?r.join(" <- "):void 0}function Bf(e,t){if(typeof e!=="object"||e===null)return;return e[t]}function $e(e,t){let r=e,n=0;while(r!=null&&n<3){let o=Bf(r,t);if(o!==void 0)return o;r=Ia(r),n+=1}return}var Gf=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function Hf(e){return typeof e==="string"&&Gf.has(e)}function Jf(e){let t=$e(e,"kind");if(Hf(t))return t;let r=$e(e,"status"),n=$e(e,"code"),o=Wo(e)?.toLowerCase()??"";if(r===401||r===403||o.includes("auth error")||o.includes("permission denied"))return"auth";if(n==="not_found"||o.includes("waiting for vault"))return"not_found";if(n==="ECONNREFUSED"||n==="ECONNRESET"||n==="ENOTFOUND"||n==="ETIMEDOUT"||o.includes("connection")||o.includes("fetch failed")||o.includes("network"))return"connection";if(o.includes("timed out"))return"timeout";if(o.includes("invalid status")||typeof r==="number"&&r>=400)return"invalid_status";if(o.includes("invalid payload")||o.includes("invalid json")||o.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function Yf(e){return"validation"}var Xf=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function Zf(e,t){let r=$e(e,"recoverable");if(typeof r==="boolean")return r;if(t==="not_found")return!0;if(t==="auth"||t==="invalid_payload")return!1;let n=$e(e,"status");if(typeof n==="number"&&n>=400&&n<500)return!1;let o=$e(e,"code");if(typeof o==="string"&&(Xf.has(o)||o.startsWith("UND_ERR_")))return!0;return!0}function Qf(e){return{initialDelayMs:Math.max(1,e?.initialDelayMs??2000),maxDelayMs:Math.max(1,e?.maxDelayMs??600000),multiplier:Math.max(1,e?.multiplier??2),jitterRatio:Math.max(0,e?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,e?.loadTimeoutMs??30000)}}function ep(e,t){let r=Math.max(0,e-1),n=Math.min(t.maxDelayMs,t.initialDelayMs*t.multiplier**r);if(t.jitterRatio===0)return Math.round(n);let o=n*t.jitterRatio,s=(Math.random()*2-1)*o;return Math.max(1,Math.round(Math.min(t.maxDelayMs,n+s)))}function tp(e){return(t)=>{let r=t.path?` at ${t.path}`:"",n=t.sourceType?` (${t.sourceType})`:"";e.warn(`Config source${n} unavailable${r}; ionite will retry automatically in ${t.nextDelayMs}ms (attempt ${t.attempt}, ${t.errorKind}: ${t.message}).`)}}async function rp(e,t){for(let r of t)await r(e)}function Ne(e){if(!e)return;try{return new URL(e,"http://dummy").pathname}catch{return e.startsWith("/")?e:`/${e}`}}function np(e,t){let r=t.id;if(typeof r!=="string"||r.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if(e!==void 0&&e!==r)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${e}", received "${r}").`)}function op(e){let t=(r,n)=>{if(r!==void 0&&(typeof r!=="string"||r.length===0))throw Error(`${n}: "clientSecret" must be a non-empty string when present; omit it entirely for a public (PKCE-only) client.`)};t(e.sso?.clientSecret,"sso");for(let[r,n]of Object.entries(e.ciam?.providers??{}))t(n.clientSecret,`ciam.providers.${r}`)}function sp(e){let t=(o,s)=>{if(!o)return;if(typeof o.url!=="string"||o.url.length===0)throw Error(`${s}.url is required and must be a non-empty string.`);if(o.audience!==void 0&&(typeof o.audience!=="string"||o.audience.length===0))throw Error(`${s}.audience must be a non-empty string when present.`)},r=e.sso?.accessRequests;if(t(r,"RemoteConfig.sso.accessRequests"),r&&!at(e.sso?.claimsAsEntitlements))throw Error("RemoteConfig.sso.accessRequests requires sso.claimsAsEntitlements because the provider must carry approved assignments in token claims.");let n=[];for(let[o,s]of Object.entries(e.ciam?.providers??{})){if(t(s.accessRequests,`RemoteConfig.ciam.providers.${o}.accessRequests`),!s.accessRequests)continue;if(s.type==="magic-link")throw Error(`RemoteConfig.ciam.providers.${o}.accessRequests is invalid for a magic-link provider.`);if(!at(s.claimsAsEntitlements))throw Error(`RemoteConfig.ciam.providers.${o}.accessRequests requires claimsAsEntitlements because the provider must carry approved assignments in token claims.`);if(s.enabled!==!1)n.push(o)}if(e.iam?.users?.assignment==="idp"&&!r)throw Error('RemoteConfig.iam.users.assignment "idp" requires sso.accessRequests.');if(e.iam?.customers?.assignment==="idp"&&n.length===0)throw Error('RemoteConfig.iam.customers.assignment "idp" requires an enabled ciam provider with accessRequests.');if(e.iam?.workloads?.assignment==="idp")throw Error('RemoteConfig.iam.workloads.assignment does not support "idp".')}function ip(e){let t=e.kms;if(t)for(let[n,o]of Object.entries(t)){if(n.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!o||typeof o!=="object"||Array.isArray(o))throw Error(`RemoteConfig.kms.${n} must be an object.`);if(o.source!==void 0&&(typeof o.source!=="string"||o.source.length===0))throw Error(`RemoteConfig.kms.${n}.source must be a non-empty string when present.`);if(o.path!==void 0&&(typeof o.path!=="string"||o.path.length===0))throw Error(`RemoteConfig.kms.${n}.path must be a non-empty string when present.`)}let r=e.otel;if(!r)return;if(r.apiKey!==void 0&&r.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(r.apiKeyPool!==void 0){if(typeof r.apiKeyPool!=="string"||r.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!t?.[r.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${r.apiKeyPool}".`)}}function ap(e){let t=e.authz?.trustedProvisioningClients;if(!t)return;t.forEach((r,n)=>{let o=`authz.trustedProvisioningClients[${n}]`;if(typeof r.issuer!=="string"||r.issuer.length===0)throw Error(`${o}: "issuer" is required and must be a non-empty string.`);if(typeof r.clientId!=="string"||r.clientId.length===0)throw Error(`${o}: "clientId" is required and must be a non-empty string.`);let s=Array.isArray(r.audience)?r.audience:[r.audience];if(s.length===0||s.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(r.permissions)||r.permissions.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "permissions" must be an array of non-empty permission ids.`)})}function cp(e){let t=e.tm;if(!t)return;if(t.enabled!==!0)throw Error("RemoteConfig.tm.enabled must be true when tm is present.");for(let r of["id","url","issuer","jwksUri","audience","clientId"])if(typeof t.integrator?.[r]!=="string"||t.integrator[r].length===0)throw Error(`RemoteConfig.tm.integrator.${r} is required and must be a non-empty string.`);if(t.consentTtlSeconds!==void 0&&(!Number.isInteger(t.consentTtlSeconds)||t.consentTtlSeconds<60))throw Error("RemoteConfig.tm.consentTtlSeconds must be an integer of at least 60.");if(t.maxRedeemAttempts!==void 0&&(!Number.isInteger(t.maxRedeemAttempts)||t.maxRedeemAttempts<1))throw Error("RemoteConfig.tm.maxRedeemAttempts must be a positive integer.")}function up(e){let t=Array.isArray(e)?e:[e];return t.length>0&&t.every((r)=>typeof r==="string"&&r.length>0)}function dp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return;let r=t,n=(o,s)=>{if(!up(o.audience))throw Error(`${s}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in r||"outgoing"in r){let o=r.incoming;if(Array.isArray(o))o.forEach((s,i)=>{if(s&&typeof s==="object")n(s,`workload.incoming[${i}]`)});else if(o&&typeof o==="object"&&"jwksUri"in o)n(o,"workload.incoming");return}if(Ea(r)){if("jwksUri"in r&&!("clientId"in r)&&!("workloadId"in r))n(r,"workload (server-only)");return}}function lp(e,t,r){if(e?.sso?.redirectUri&&t.sso?.redirectUri){let n=Ne(e.sso.redirectUri),o=Ne(t.sso.redirectUri);if(n!==o)r.error(`SSO redirectUri path mismatch: the framework derives "${o}" from basePath, but ConfigSource reports "${n}". Register "${o}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function qo(e){let t={};if(!e)return t;for(let[r,n]of Object.entries(e))if(n.type==="vault"&&typeof n.lfv?.deliveryEndpoint==="string"&&typeof n.lfv?.eventsEndpoint==="string")t[r]=n.lfv;return t}function Pa(e){return e[Nt]}function Oa(e,t){let r=qo(e.secrets??void 0),n=Ne(t.deliveryEndpoint),o=Ne(t.eventsEndpoint),s=Ne(t.path);for(let i of Object.values(r)){if(Ne(i.deliveryEndpoint)!==n)continue;if(Ne(i.eventsEndpoint)!==o)continue;let c=i.path?Ne(i.path):void 0;if(s&&c&&s!==c)continue;return!0}return!1}function fp(e,t){let r=Pa(t);if(!r)return e;if(Oa(e,r))return e;let n={type:"vault",lfv:{path:r.path,lfvServerUrl:r.lfvServerUrl,clientId:r.clientId,deliveryTimeout:r.deliveryTimeout,retryInterval:r.retryInterval,warnInterval:r.warnInterval,deliveryEndpoint:r.deliveryEndpoint,eventsEndpoint:r.eventsEndpoint,verifyJwks:r.verifyJwks}},o=e.secrets??{},s=Mn(o,{clientId:r.clientId,path:r.path});return{...e,secrets:{...o,[s]:n}}}function pp(e,t){let r=Pa(t);if(!r||Oa(e,r))return new Map;let n=Mn(e.secrets??{},{clientId:r.clientId,path:r.path});return new Map([[n,t.secret]])}function mp(e,t){let r=qo(e.secrets),n=qo(t.secrets??void 0);for(let[o,s]of Object.entries(n)){let i=r[o];if(!i)continue;let c=Ne(i.deliveryEndpoint),d=Ne(s.deliveryEndpoint);if(c&&d&&c!==d)throw Error(`LFV deliveryEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${c}, framework path: ${d}`);let u=Ne(i.eventsEndpoint),l=Ne(s.eventsEndpoint);if(u&&l&&u!==l)throw Error(`LFV eventsEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${u}, framework path: ${l}`)}}function gp(e){return new Set(Object.keys(e.secrets??{}))}function yp(e){return new Set(Object.keys(e.secrets??{}))}function hp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;if(!("outgoing"in t))return new Set;let r=t.outgoing;if(!r||typeof r!=="object"||Array.isArray(r))return new Set;return new Set(Object.keys(r))}function Ea(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function wp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;let r=t;if("incoming"in r||"outgoing"in r){let n=r.outgoing;if(!n||typeof n!=="object"||Array.isArray(n))return new Set;return new Set(Object.keys(n))}if(Ea(r))return new Set;return new Set(Object.keys(r).filter((n)=>n!=="default"))}function vp(e,t,r,n){let o=t.secrets??{},s=e.secrets??{};for(let[l,w]of Object.entries(o)){let p=s[l];if(!p)continue;if(w.type&&p.type&&w.type!==p.type)throw Error(`Secrets source "${l}" type in framework config must match ConfigSource type. ConfigSource type: ${p.type}, framework type: ${w.type}`)}let i=gp(t),c=yp(e);for(let l of i)if(!c.has(l)&&!n.has(l))r.warn(`Framework config declares secrets source "${l}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let l of c)if(!i.has(l))r.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:l});let d=hp(t),u=wp(e);for(let l of d)if(!u.has(l))r.warn(`Framework config declares outgoing workload client "${l}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(t.otel!==void 0&&t.otel!==null&&e.otel===void 0)r.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function va(e,t){if(t===void 0)return!1;return Mf(e,t)}function Sp(e,t){if(typeof t!=="number"||!Number.isFinite(t)||t<=0)return e;return new Promise((r,n)=>{let o=setTimeout(()=>{n(Error(`Ionite ready() timed out after ${t}ms`))},t);e.then(()=>{clearTimeout(o),r()},(s)=>{clearTimeout(o),n(s)})})}function kp(e,t,r){if(typeof t!=="number"||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>{o(Error(r))},t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function $o(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function vr(e){return e==="/"?e:e.replace(/\/+$/,"")}function _o(e,t){return vr(e)===vr(t)}function Sa(e){return e.method==="GET"||e.method==="HEAD"}function bp(e){if(e.isReady()&&e.config?.readyz?.enabled===!1)return ye();let t=e.readiness();return Response.json(Rp(t),{status:t.ok?200:503})}function Rp(e){let t=e.config.lastError;if(!t)return e;return{...e,config:{...e.config,lastError:{kind:t.kind,phase:t.phase,at:t.at,message:"[redacted]"}}}}var Tp={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","sso.claims_authz":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","ciam.claims_authz":"ciam","iam.users":"iam","iam.groups":"iam","iam.workloads":"iam","iam.customers":"iam","workload.incoming":"workload","workload.outgoing":"workload","workload.claims_authz":"workload","authz.oaa":"authz","authz.access_requests":"authz","tm.integration":"tm"};function Cp(e){let t=e?.providers;if(!t)return!1;return Object.values(t).some((r)=>r.enabled!==!1&&r.type!=="magic-link")}function Ip(e){return Boolean(e?.iam?.users?.assignment==="idp"&&e.sso?.accessRequests&&at(e.sso.claimsAsEntitlements))}function Pp(e){return Boolean(e?.iam?.customers?.assignment==="idp"&&Object.values(e.ciam?.providers??{}).some((t)=>t.enabled!==!1&&t.type!=="magic-link"&&t.accessRequests&&at(t.claimsAsEntitlements)))}function Ce(e,t,r={}){let n=Tp[e],o=t.modules[n],s=r.capable??!0,i=o.active&&o.ready&&s,c=i?void 0:!o.active||!o.ready?o.reason:r.incapableReason??`${e} is not testable by this application wiring`;return{module:n,active:o.active,ready:o.ready,testable:i,...r.urls&&r.urls.length>0?{urls:r.urls}:{},...c?{reason:c}:{}}}function at(e){return Boolean(e?.claims&&e.claims.length>0)}function Op(e){if(!e||typeof e!=="object")return!1;let t=e;if(at(t.claimsAsEntitlements))return!0;let r=t.incoming;if(!r)return!1;if(Array.isArray(r))return r.some((n)=>at(n.claimsAsEntitlements));return at(r.claimsAsEntitlements)}function Lo(e,t,r,n){let o=Ce(e,t,{capable:r&&n,incapableReason:r?"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted.":"claimsAsEntitlements is not configured for this plane."});if(!r)return{...o,active:!1,testable:!1,reason:"claimsAsEntitlements is not configured for this plane."};return o}function Ep(e,t,r){let n=Fe(t),o=e.readiness();return{sdk:{version:on,catalogVersion:Fr},basePath:t,urls:n,modules:o.modules,lfvCallbackTransport:Boolean(r.lfv?.callbackTransport),capabilities:{"sso.login":Ce("sso.login",o,{urls:[n.sso.loginUrl,n.sso.callbackUrl,n.sso.userUrl]}),"sso.jit":Ce("sso.jit",o,{capable:r.sso?.enableJitUserProvisioning!==!1&&Boolean(r.sso?.userStore),incapableReason:r.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":Ce("sso.logout",o,{urls:[n.sso.logoutUrl]}),"sso.back_channel_logout":Ce("sso.back_channel_logout",o,{urls:[n.sso.logoutBackChannelUrl]}),"sso.claims_authz":Lo("sso.claims_authz",o,at(e.config?.sso?.claimsAsEntitlements),r.sso?.sessionStore?.capabilities?.derivedEntitlements===!0),"ciam.magic_link":Ce("ciam.magic_link",o,{capable:Boolean(r.ciam?.magicLinkStore)&&r.ciam?.enableJitUserProvisioning!==!1,urls:[n.ciam.magicLinkUrl,n.ciam.magicLinkLoginUrl],incapableReason:!r.ciam?.magicLinkStore?"CIAM magic-link is enabled but no magicLinkStore capability is wired by the application.":"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":Ce("ciam.oidc_login",o,{capable:Cp(r.ciam),urls:[n.ciam.customerLoginUrl,n.ciam.customerCallbackUrl,n.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":Ce("ciam.customer",o,{urls:[n.ciam.customerUrl]}),"ciam.logout":Ce("ciam.logout",o,{urls:[n.ciam.logoutUrl]}),"ciam.claims_authz":Lo("ciam.claims_authz",o,Object.values(e.config?.ciam?.providers??{}).some((s)=>at(s.claimsAsEntitlements)),r.ciam?.sessionStore?.capabilities?.derivedEntitlements===!0),"iam.users":Ce("iam.users",o,{capable:Boolean(r.iam?.userStore),urls:[n.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":Ce("iam.groups",o,{capable:Boolean(r.authz?.catalogStore||r.authz?.catalog),urls:[n.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"iam.workloads":Ce("iam.workloads",o,{capable:Boolean(r.iam?.workloadIdentityStore),urls:[n.iam.workloadsUrl],incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."}),"iam.customers":Ce("iam.customers",o,{capable:Boolean(r.iam?.customerStore),urls:[n.iam.customersUrl],incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."}),"workload.incoming":Ce("workload.incoming",o,{urls:[n.workload.validateUrl,n.workload.jwksUrl]}),"workload.outgoing":Ce("workload.outgoing",o,{}),"workload.claims_authz":Lo("workload.claims_authz",o,Op(e.config?.workload),!0),"authz.oaa":Ce("authz.oaa",o,{capable:Boolean(r.authz?.accessStore&&(r.authz?.catalogStore||r.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."}),"authz.access_requests":Ce("authz.access_requests",o,{capable:Ip(e.config)||Pp(e.config),incapableReason:"IdP access-request validation requires either iam.users.assignment='idp' with SSO accessRequests and claimsAsEntitlements, or iam.customers.assignment='idp' with an enabled non-magic-link CIAM provider carrying accessRequests and claimsAsEntitlements."}),"tm.integration":Ce("tm.integration",o,{capable:Boolean(r.tm?.onConnectRequest&&r.tm.store.setIntegration&&r.tm.store.getByIntegrationHandleHash),urls:r.tm?[`${vr(r.tm.basePath)}/integrations/authorize`,`${vr(r.tm.basePath)}/integrations/redeem`,`${vr(r.tm.basePath)}/integrations/config-export`]:void 0,incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."})}}}async function Ap(e,t,r){if(!t.isReady())return $o();if(t.config?.capabilitiez!==!0||!r)return ye();let n=await fr(e,t,Ra["capabilitiez.read"]);if(n)return n;return Response.json(r.build(),{status:200})}async function _p(e){if(!e)return[];let t=[];for await(let r of Yt((n,o)=>e.list({start:n,limit:o})))t.push(r);return t}function xo(e,t){return[...new Set(e.filter((r)=>r.subjectType===t).map((r)=>typeof r.subject==="string"?r.subject:r.subject.id).filter((r)=>Boolean(r)))]}function Uo(e,t,r){if(!e)return;if(t==="all")return Yt((n,o)=>e.list({start:n,limit:o}));return async function*(){for(let o of r){let s=await e.get(o);if(s)yield s}}()}async function Lp(e,t,r){if(!t.isReady())return $o();if(t.config?.authz?.oaa?.fullSync?.enabled!==!0)return ye();let n=await fr(e,t,Ra["authz.oaa.sync"]);if(n)return n;let o=t.authz?.oaa;if(!o?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let s=t.authz?await t.authz.reconcile():void 0,i=r.iam?.userStore,c=r.iam?.customerStore??r.ciam?.customerStore,d=r.workload,u=r.iam?.workloadIdentityStore??(d&&"workloadIdentityStore"in d?d.workloadIdentityStore:d&&("incoming"in d)&&d.incoming&&!Array.isArray(d.incoming)&&("workloadIdentityStore"in d.incoming)?d.incoming.workloadIdentityStore:void 0),l=Wf(r.authz?.catalog?Ta(r.authz.catalog):void 0,r.authz?.catalogStore),w=r.authz?.accessStore,p=r.authz?.resources,k=await _p(w),q=await o.sync({users:Uo(i,o.population("user"),xo(k,"user")),customers:Uo(c,o.population("customer"),xo(k,"customer")),workloads:Uo(u,o.population("workload"),xo(k,"workload")),groups:l?Yt((_,b)=>l.groups.list({start:_,limit:b})):void 0,roles:l?Yt((_,b)=>l.roles.list({start:_,limit:b})):void 0,permissions:l?Yt((_,b)=>l.permissions.list({start:_,limit:b})):void 0,resources:p?Yt((_,b)=>p.list({start:_,limit:b})):void 0,access:k},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...q,reconcile:s})}function xp(e,t,r,n,o,s){return async(i)=>{let c=new URL(i.url).pathname;if(_o(c,r)){if(!Sa(i))return rt(["GET"]);return bp(e)}if(_o(c,n)){if(!Sa(i))return rt(["GET"]);return Ap(i,e,o)}if(s&&_o(c,s.url)){if(i.method!=="POST")return rt(["POST"]);return Lp(i,e,s.frameworkConfig)}let d=e.secrets;if(!Boolean(d?.isLfvDeliveryRequest?.(i)||d?.isLfvEventsRequest?.(i))&&!e.isReady())return $o();try{return await t(i)}catch(l){return e.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},l),Kt(l)}}}function ka(e,t,r){if(e)return r&&!e.tenantId?{...e,tenantId:r}:e;if(t&&r)return{tenantId:r};return}function Up(e,t){if(t.authz===null)return;if(!e.authz&&!t.authz)return;return{...e.authz,...t.authz,oaa:e.authz?.oaa||t.authz?.oaa?{...e.authz?.oaa,...t.authz?.oaa}:void 0}}function Mo(e){let t=!1,r=me(`${e} module`,()=>t);return{isReady:r.isReady,ready:r.ready,attach(n){if(t=n!==void 0,r.refresh(),!n)return;return Object.defineProperty(n,"isReady",{value:r.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(n,"ready",{value:r.ready,enumerable:!1,configurable:!0}),n}}}function jo(e){if(!e)return!1;return e.isReady?e.isReady():!1}function Et(e,t,r,n){if(!e)return{active:!1,ready:!1,reason:r};return jo(t)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:n}}function Mp(){let e=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:e(),ciam:e(),iam:e(),workload:e(),otel:e(),secrets:e(),kms:e(),authz:e(),tm:e()}}function Aa(e,t,r){let n=e.isReady(),o=e.config;if(!n||!o)return{ok:!1,applied:n,modules:Mp(),config:{...t}};let s=Tn(r),i=Boolean(o.workload)||Boolean(e.workload),c={sso:Et(Boolean(o.sso),e.sso,"sso not configured (no RemoteConfig.sso)",s.sso??"sso configured but not ready"),ciam:Et(Boolean(o.ciam),e.ciam,"ciam not configured (no RemoteConfig.ciam)",s.ciam??"ciam configured but not ready"),iam:Et(Boolean(o.iam),e.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:Et(i,e.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:Et(Boolean(o.otel),e.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(o.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!jo(e.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return e.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:Et(Boolean(o.kms),e.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(o.authz?.oaa))return{active:!0,ready:!0};let l=e.authz?.oaa;return jo(l)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})(),tm:Et(o.tm?.enabled===!0&&Boolean(r.tm),e.tm,o.tm?.enabled===!0?"tm configured by RemoteConfig but FrameworkConfig.tm is not wired (this instance does not serve tenant management)":"tm not configured (no RemoteConfig.tm)","tm configured but not ready")};return{ok:Object.values(c).every((u)=>!u.active||u.ready),applied:n,modules:c,config:{...t}}}function Wp(e,t){let r=[];for(let n of t){let o=e.modules[n];if(!e.applied){r.push({name:n,reason:"RemoteConfig has not been applied yet"});continue}if(!o?.ready)r.push({name:n,reason:o?.reason??`${n} is not ready`})}return{ok:r.length===0,notReady:r}}function qp(e,t,r,n,o,s,i,c,d,u){let l=t.validators,w=Nf(e.cache);jf(w.jwks);let p=t;if(w.session.read.enabled){let oe=t.sso?.sessionStore??t.ciam?.sessionStore;if(oe){let K=uo(oe,w.session.read);p={...t,sso:t.sso?{...t.sso,sessionStore:K}:t.sso,ciam:t.ciam?{...t.ciam,sessionStore:K}:t.ciam}}}let k={sessionCache:w.session},q=st(l.workload,r,e?.workload,t.workload??void 0,void 0,u),_=t.otel!==null?Qn(r,e?.otel,t.otel??void 0,o):void 0,b=Tn(p);if(Object.keys(e).length>0){if(b.sso)r.error(b.sso);if(b.ciam)r.error(b.ciam)}let j=ka(e?.sso,t.sso,e.id),U=b.sso?void 0:Df(l.sso,r,j,p.sso??void 0,{...k,catalogView:u}),a={...e?.iam,...t.iam},y=t.authz?.catalog?Ta(t.authz.catalog):void 0,S=t.workload,M=S&&"workloadIdentityStore"in S?S.workloadIdentityStore:S&&("incoming"in S)&&S.incoming&&!Array.isArray(S.incoming)&&("workloadIdentityStore"in S.incoming)?S.incoming.workloadIdentityStore:void 0,F=Boolean(a.url||e.sso?.accessRequests||Object.values(e.ciam?.providers??{}).some((oe)=>oe.accessRequests)||a.userStore||t.authz?.catalogStore||y);i.update({...a.url?{iam:{url:a.url,...a.deltaAudience?{audience:a.deltaAudience}:{}}}:{},...e.sso?.accessRequests?{sso:e.sso.accessRequests}:{},ciam:Object.fromEntries(Object.entries(e.ciam?.providers??{}).flatMap(([oe,K])=>K.enabled!==!1&&K.accessRequests?[[oe,K.accessRequests]]:[]))},{workload:q});let Z=c.update({users:e?.iam?.users?.delta,workloads:e?.iam?.workloads?.delta,customers:e?.iam?.customers?.delta,url:a.url,audience:a.deltaAudience},{workload:q,workloadIdentityStore:M,userStore:a.userStore,customerStore:a.customerStore??p.ciam?.customerStore,accessStore:t.authz?.accessStore,catalogStore:t.authz?.catalogStore,codeCatalog:y,mapUserToScim:a.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:a.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:a.inboundWorkloads?.mapBaseWorkloadToScim}),Y;if(F&&!q){if(Object.keys(e).length>0)r.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");Y=void 0}else Y=$f(l.iam,r,q,s,t.authz?.accessStore,t.authz?.accessIndex,t.authz?.catalogStore,y,t.authz?.resources,e?.iam,t.iam??void 0,Z,t.authz?.onAccessMutation,Uf(e.authz),d);let ee=ka(e?.ciam,t.ciam,e.id),ae=b.ciam?void 0:qf(l.ciam,r,ee,p.ciam??void 0,q,{...k,catalogView:u});return{secret:n,workload:q,otel:_,sso:U,iam:Y,ciam:ae}}function _a(e,t,r,n,o,s,i,c){let d=s.authz.update(Up(t,r));e.id=t.id,e.config=t,e.secrets=s.secrets.update(t.secrets,r.secrets??void 0,r.validators.secrets,r.lfv?.callbackTransport,r.lfv?.singleProcess),e.kms=s.kms.update(t.kms,(k)=>{if(!k.source)return o;if(!e.secrets)throw Error(`KMS pool references unavailable secrets source "${k.source}".`);return e.secrets.getSecretsSource(k.source)});let u=qp(t,r,n,o,s.kms.handle(),d,s.accessRequests,s.iamDelta,s.authz.settle,()=>s.authz.catalogView());e.secret=u.secret,e.workload=s.workload.update(u.workload),e.otel=s.otel.update(u.otel),e.authz=d,e.log=s.log.update(e.otel?.logger??n),e.sso=s.sso.attach(u.sso),e.iam=s.iam.attach(u.iam),e.ciam=s.ciam.attach(u.ciam),e.tm=s.tm.update(t.tm?.enabled===!0&&r.tm?qi(e,t.tm,r.tm):void 0,r.tm!==void 0&&r.tm!==null);let l=Fe(i),w=(k)=>()=>Aa(e,e.configStatus,r).modules[k];ze(e.sso,w("sso"),l.sso),ze(e.ciam,w("ciam"),l.ciam),ze(e.iam,w("iam"),l.iam,()=>({accessRequests:s.accessRequests.handle().describe()})),ze(e.workload,w("workload"),l.workload),ze(e.secrets,w("secrets")),ze(e.kms,w("kms")),ze(e.otel,w("otel")),ze(e.authz,w("authz")),ze(e.tm,w("tm"));let p=(k)=>eo(k,e,c?.routing,l);e.handler=xp(e,p,l.readyzUrl,l.capabilitiezUrl,{build:()=>Ep(e,i,r)},{url:es(i),frameworkConfig:r})}function jp(e,t,r,n,o,s,i,c,d){np(e.id,t),op(t),sp(t),ip(t),ap(t),cp(t),dp(t),lp(t,r,n),mp(t,r),vp(t,r,n,c),_a(e,t,r,n,o,s,i,d)}function ba(e){if(!e.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return e.secret}async function $p(e,t,r,n,o,s,i){let c=e,d=ts(e,t,o.current,s);if(n.beforeChange){let u=Ca(d,o);i?.enter();let l;try{l=await n.beforeChange(e,u,r)}finally{i?.exit()}if(l?.config!==void 0)c=l.config;d=l?.frameworkConfig??u}return d=Zt(d,o.current),{effectiveRemoteConfig:c,effectiveFrameworkConfig:d}}function jh(e,t){let r=Vf(t),{frameworkConfig:n,basePath:o,readyTimeoutMs:s,stores:i,options:c}=r,d=pp(n,e),u=new Set(d.keys()),l=Zt(fp(n,e),i),w=l.log||Ao,p={current:i},k={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:l},q=Go(w),_=zn(w),b,j={log:Ff(w),secrets:Ei(w,d),kms:Zs(w),workload:Ji(w),otel:ni(w),authz:Ps(w,()=>_.handle(),()=>q.handle(),()=>b?.iam,()=>({mapUserToScim:k.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:k.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:k.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim})),accessRequests:q,iamDelta:_,sso:Mo("sso"),iam:Mo("iam"),ciam:Mo("ciam"),tm:Li()},U={},a,y,S=new Promise((R,W)=>{a=R,y=W}),M=!1,F,Z,Y=0,ee={enter:()=>{Y+=1},exit:()=>{Y-=1}},ae=Promise.resolve();function oe(R){let W=ae.then(R,R);return ae=W.then(()=>{return},()=>{return}),W}function K(R){if(M)throw Error(`Ionite instance has been closed and cannot call ${R}().`)}function Q(){e.log=k.frameworkConfig.log??Ao,e.validators=k.frameworkConfig.validators}let V={},D={log:w,id:void 0,config:void 0,secret:ba(e),authz:void 0,configStatus:U,handler:async()=>ye(),ready:(R)=>{if(Y>0&&k.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return Sp(S,R??s)},isReady:()=>k.remoteConfig!==void 0,readiness:()=>Aa(D,U,k.frameworkConfig),requireReady:(R)=>Wp(D.readiness(),R),describe:()=>{let R=D.readiness(),W={sso:Be(D.sso,R.modules.sso),ciam:Be(D.ciam,R.modules.ciam),iam:Be(D.iam,R.modules.iam),workload:Be(D.workload,R.modules.workload),otel:Be(D.otel,R.modules.otel),secrets:Be(D.secrets,R.modules.secrets),kms:Be(D.kms,R.modules.kms),authz:Be(D.authz,R.modules.authz),tm:Be(D.tm,R.modules.tm)};return ve({id:D.id,sdk:{version:on,catalogVersion:Fr},basePath:o,urls:Fe(o),ok:R.ok,applied:R.applied,config:{...U},modules:Object.fromEntries(Object.entries(R.modules).map(([h,O])=>[h,{...O,description:W[h]}]))})},close:()=>{if(M)return;if(M=!0,Z)clearTimeout(Z),Z=void 0;F?.(),F=void 0;let R=[()=>j.secrets.close(),()=>j.kms.close(),()=>j.authz.close(),()=>j.otel.shutdown()];for(let W of R)try{Promise.resolve(W()).catch((h)=>{w.warn("Ionite close: module teardown failed",h)})}catch(h){w.warn("Ionite close: module teardown failed",h)}a?.(),a=void 0,y=void 0},setStores:async(R)=>{K("setStores");let W=Or(R);await oe(()=>ce(W))}};b=D,_a(D,V,k.frameworkConfig,w,D.secret,j,o,c),Q();function te(){let R=U.lastError!==void 0;if(U.appliedAt=Date.now(),U.lastError=void 0,R)(D.log??w).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function re(R,W){let h=Wo(W)??(W instanceof Error?W.message:String(W)),O=Yf(W),L=U.lastError===void 0;if(U.lastError={kind:O,message:h,at:Date.now(),phase:R},L)(D.log??w).error(R==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":O,phase:R,error:h})}function ie(R,W,h){(D.log??w).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:R,"ion.config.hash":W,"ion.config.apply_ms":h})}async function se(R,W){if(M)return;let h=ha(R);if(W&&k.remoteConfig!==void 0&&h===k.remoteConfigHash&&va(R,k.remoteConfig))return;let O=k.remoteConfig,L=O===void 0?"initial":"update",C=Date.now(),m,f,E;try{let J=await $p(R,k.frameworkConfig,k.remoteConfig,c,p,o,ee);if(m=J.effectiveRemoteConfig,f=ha(m),E=J.effectiveFrameworkConfig,W&&c.beforeChange===void 0&&k.remoteConfig!==void 0&&f===k.remoteConfigHash&&va(m,k.remoteConfig)&&E===k.frameworkConfig)return;let G=E.log||Ao;jp(D,m,E,G,ba(e),j,o,u,c)}catch(J){throw re(L,J),J}k.remoteConfig=m,k.remoteConfigHash=f,k.frameworkConfig=E,Q(),te(),await j.otel.settled();let A=Ca(k.frameworkConfig,p),B=!1;try{c.afterChange?.(D,m,A,O)}catch(J){if((D.log??w).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:L,error:J instanceof Error?J.message:String(J)}),L==="initial"){B=!0;let G=J instanceof Error?J:Error(`afterChange failed on initial load: ${String(J)}`);re("initial",G),y?.(G),y=void 0,a=void 0}}if(k.frameworkConfig=A,Q(),!B)ie(L,f,Date.now()-C);if(!B&&a)a(),a=void 0}async function ce(R){if(M)return;if(p.current=R,k.remoteConfig===void 0){k.frameworkConfig=Zt(k.frameworkConfig,R),Q();return}await se(k.remoteConfig,!1)}if(e.subscribe)e.subscribe((R)=>{oe(()=>se(R,!0)).catch(()=>{})},{mode:"wait"}).then((R)=>{if(M){R?.();return}F=R}).catch((R)=>{w.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:R instanceof Error?R.message:String(R)})});let T=Qf(c.configRetry),g=[c.onConfigLoadError??tp(w)],P=0;function I(){if(Z=void 0,M)return;if(k.remoteConfig!==void 0)return;kp(e.load(),T.loadTimeoutMs,`ConfigSource initial load timed out after ${T.loadTimeoutMs}ms`).then(async(R)=>{P=0;try{await oe(async()=>{if(k.remoteConfig!==void 0)return;await se(R,!0)})}catch(W){let h=W instanceof Error?W:Error(`Initial RemoteConfig application failed: ${String(W)}`);w.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:h.message}),y?.(h),y=void 0}},async(R)=>{if(M)return;P+=1;let W=ep(P,T),h=Wo(R)??"RemoteConfig load failed",O=Jf(R),L=$e(R,"code"),C=$e(R,"status"),m={attempt:P,error:R,errorKind:O,maxDelayMs:T.maxDelayMs,message:h,nextDelayMs:W,code:typeof L==="string"?L:void 0,status:typeof C==="number"?C:void 0,path:typeof $e(R,"path")==="string"?$e(R,"path"):void 0,sourceType:typeof $e(R,"sourceType")==="string"?$e(R,"sourceType"):void 0};if(!Zf(R,O)){let f=R instanceof Error?R:Error(`ConfigSource initial load failed with unrecoverable ${O}: ${h}`);w.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:O,error:h,code:m.code,status:m.status,path:m.path,sourceType:m.sourceType}),y?.(f),y=void 0;return}try{await rp(m,g)}catch(f){let E=f instanceof Error?f:Error("ConfigSource retry hook stopped RemoteConfig retrying");y?.(E),y=void 0;return}Z=setTimeout(I,W)})}return I(),D}export{Kh as AssignmentPolicyError,Zh as CatalogAdjacencyCache,Ru as ION_CAPABILITY_CATALOG,Fr as ION_CAPABILITY_CATALOG_VERSION,Kf as ION_READY_DEFAULT_TIMEOUT_MS,on as ION_SDK_VERSION,De as InMemoryAccessAssignmentStore,kr as InMemoryAccessCatalogStore,Rr as InMemoryAccessIndex,Tr as InMemoryCustomerStore,Cr as InMemoryMagicLinkStore,br as InMemoryResourceStore,Ir as InMemorySessionStore,vw as InMemoryTenantStore,Pr as InMemoryUserStore,ya as InMemoryWorkloadIdentityStore,gt as InMemoryWorkloadTokenStore,Fh as IoniteError,Kr as ScimOutboundClient,Uw as TENANT_OWNER_PERMISSION,Yr as VAULT_MIN_POLLING_TTL_MS,hr as VaultConfigInvalidPayloadError,Pt as VaultConfigWaitingForSecretError,qe as VaultSubscribeNotSupportedError,Gh as allowHosts,Hh as allowOrigins,Jh as allowRelativePaths,Yh as allowSameOrigin,Ro as awsConfig,dn as azureConfig,Xh as blockDangerousUrls,Qh as callback,ew as captureRedirect,tw as ciam,Si as closeAllVaultSockets,rw as collectReferencedDefinitions,Po as configFromSource,pn as configLocatorFromEnvValues,ra as configSourceFromEnvValues,it as configSourceFromLocator,zn as createManagedIamDelta,me as createReadinessLatch,uo as createSessionReadCache,_f as createTenantIonHandler,Of as createTenantIonResolver,nw as defaultRedirectPolicies,Fe as deriveIonUrls,oc as devInMemoryStores,ow as discoverSessionRecords,sw as discoverSessions,fr as enforceEndpointAuthz,nf as envConfig,Vn as escapeScimFilterValue,iw as expandRoot,To as gcpConfig,Vh as generateULID,aw as getCustomer,cw as getOwnedTenantIds,gf as getSessionEntries,uw as getUser,El as getWorkload,Al as getWorkloadToken,dw as has,lw as hasAll,fw as hasAllScope,pw as hasAny,mw as hasAnyScope,gw as hasGroup,yw as hasPermission,hw as hasRole,ww as hasScope,Ct as hashIntegrationHandle,Sw as iam,sc as inMemoryAuthzDomains,bn as inMemoryAuthzStores,kw as initiateLogin,jh as ionite,bw as isRedirectAllowed,Bl as isVaultConfigInvalidPayloadError,zl as isVaultConfigWaitingForSecretError,St as lfvVault,zh as listGenerator,Rw as listSsoClientIdsFromCookies,vf as materializeTenantOwnerEntitlement,Co as mirrorSecrets,yr as mirroredConfig,Tw as planDiscoveredTenantCookies,Sf as purgeTenantEntitlements,Cw as reconcileSubjectAccess,Iw as resolveAfterRedirect,Pw as resolveCapturedRedirect,si as resolveDefaultRoute,Ow as resolveRedirect,ma as resolveTenantFromRequest,Ew as resolveTenantOwner,Aw as resolveTenantSession,Ll as revokeWorkloadToken,Ef as rewriteRequestForDefaultTenantApi,Af as rewriteRequestForDefaultTenantUi,Eo as rewriteRequestForTenantPath,ga as rewriteRequestPath,eo as routeRequest,_w as sameOriginRedirectRules,af as secretConfigSource,Lw as sendTenantWebhook,di as setVaultWebSocketCommandTimeout,xw as sso,ot as subscribeSecretPathWithHttpPolling,Mw as tenantAccessLoginUrl,bf as tenantMirror,Ww as tenantOwnerEntitlementId,qw as tenantOwnerPermission,jw as tenantResourceId,_l as validateWorkloadToken,zt as vault,ln as vaultConfig,vi as vaultSocketDiagnostics,$w as verifyUser,Nw as withSetCookies,st as workload,xl as workloadHandler};
+`);for(let n=0;n<r.length;n+=1){let s=(r[n]??"").trim();if(!s||s.startsWith("#"))continue;let i=s.startsWith("export ")?s.slice(7).trimStart():s,c=i.indexOf("=");if(c<=0)throw Error(`Invalid env entry at line ${n+1}: expected KEY=value`);let d=i.slice(0,c).trim();if(!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(d))throw Error(`Invalid env key "${d}" at line ${n+1}`);let u=i.slice(c+1).trim();if(u.length>=2&&(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))){let l=u[0],h=u.slice(1,-1);t[d]=l==='"'?h.replace(/\\(n|r|t|"|\\)/g,(p,k)=>{if(k==="n")return`
+`;if(k==="r")return"\r";if(k==="t")return"\t";return k}):h}else t[d]=u}return t}function xs(e){return Object.entries(e).map(([t,r])=>{let n=String(r??"");if(!n||/[\s#"'\\]/.test(n))return`${t}=${JSON.stringify(n)}`;return`${t}=${n}`}).join(`
+`)}function Us(e){try{let t=atob(e);return Uint8Array.from(t,(r)=>r.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function Nr(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("Secret content is not an object");return e}function nr(e){return e.metadata.contentType??tu()}function Wn(e,t){if(t==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof e.data==="string")return e.data;if(t==="jsonc")return JSON.stringify(e.data,null,2);if(t==="env")return xs(Nr(e.data));let r=Nr(e.data).content;if(typeof r!=="string")throw Error(`Secret ${t} content must contain a string "content" field`);return r}function $r(e,t){if(t==="jsonc")return typeof e.data==="string"?ru(e.data):e.data;if(t==="env")return typeof e.data==="string"?Ls(e.data):Nr(e.data);if(t==="text")return Wn(e,t);if(t==="binary"){let r=Nr(e.data).content_base64;if(typeof r!=="string")throw Error('Binary secret content must contain a "content_base64" string');return Us(r)}throw Error(`Typed ${t} decoding is not supported yet; use text() or bytes()`)}function ou(e){return{format:e.format,mimeType:e.mimeType,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id}}function su(e,t){let r=nr(e);if(r.format!==t.format||r.mimeType!==t.mimeType)throw new nu(ou(t),r)}async function iu(e,t){if(!e.schema)return t;let r=await e.schema["~standard"].validate(t);if(r.issues){let n=r.issues.map((o)=>o.message).join("; ");throw Error(`Secret validation failed for type "${e.id}": ${n}`)}return r.value}function He(e){return{async text(){let t=await e();return Wn(t,nr(t).format)},async json(){let t=await e(),r=nr(t).format;if(r!=="jsonc")throw Error(`json() requires a jsonc secret; received ${r}`);return $r(t,r)},async bytes(){let t=await e(),r=nr(t).format;if(r==="binary")return $r(t,r);return new TextEncoder().encode(Wn(t,r))},async env(){let t=await e(),r=nr(t).format;if(r!=="env")throw Error(`env() requires an env secret; received ${r}`);return $r(t,r)},async metadata(){return(await e()).metadata},async parse(t){let r=await e();return su(r,t),iu(t,$r(r,t.format))}}}function Ws(e){try{return new URL(e).pathname}catch{return e.startsWith("/")?e:`/${e}`}}var uu=1e4,du=1e4,lu=300,qs=100;async function Dn(e){await new Promise((t)=>setTimeout(t,e))}function Me(e){return{startedAt:Date.now(),timeout:typeof e?.timeout==="number"&&e.timeout>0?e.timeout:void 0}}function qn(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function sr(e){if(e.timeout===void 0)return;let t=Date.now()-e.startedAt;return Math.max(0,e.timeout-t)}function tt(e,t,r){return Error(`LFV ${e} timed out after ${r.timeout??0}ms for ${t}`)}async function $t(e,t,r,n,o){let s=sr(r);if(s!==void 0){if(s<=0)throw tt(n,o,r);let i=new AbortController,c=setTimeout(()=>i.abort(),s);try{return await fetch(e,{...t,signal:i.signal})}catch(d){if(d instanceof Error&&d.name==="AbortError")throw tt(n,o,r);throw d}finally{clearTimeout(c)}}return await fetch(e,t)}class _e extends Error{constructor(e){super(`LFV source closed while operating on ${e}`);this.name="LfvSourceClosedError"}}class et extends Error{constructor(e){super(e);this.name="LfvProtocolError"}}class vt extends et{constructor(e,t,r){super(`LFV ${t} failed (${e}) for ${r}`);this.status=e;if(this.name="LfvActionStatusError",e===404)this.code="not_found"}}var fu=new Set([400,401,403,404,409,410]);function js(e){return e instanceof et&&(!(e instanceof vt)||fu.has(e.status))}function Dr(e){return e instanceof _e||e instanceof Error&&e.name==="LfvSourceClosedError"}function pu(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`LFV kms_park returned invalid payload for ${t}`);let r=e;if(typeof r.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${t}`);let n=r.disposition;if(n!==void 0&&n!=="cooldown"&&n!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${t}`);return{parked:r.parked,...r.stale===!0?{stale:!0}:{},...n?{disposition:n}:{}}}function or(e){try{let t=JSON.parse(e);return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:void 0}catch{return}}async function jn(e,t,r,n,o,s,i,c,d,u){let l=0,h=Date.now();for(;;){if(u?.())throw new _e(n);let p=sr(r);if(p!==void 0&&p<=0)throw tt(o,n,r);try{return await e()}catch(k){if(k instanceof _e)throw k;if(u?.())throw new _e(n);if(l+=1,i>0&&Date.now()-h>=i){let _=`Error connecting to the LFV source. Retries: '${l}'`;if(c)c(d,_,{url:t,path:n,operation:o});h=Date.now()}let q=p===void 0?s:Math.min(s,p);if(q<=0)throw tt(o,n,r);if(await Dn(q),u?.())throw new _e(n)}}}function mu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function $n(e){if(typeof e==="number"&&Number.isFinite(e))return e;if(typeof e==="string"&&e.trim()){let t=Date.parse(e.trim());if(!Number.isNaN(t))return t}return}function $s(e){return`[LFV] [${e??"-"}] [${new Date().toISOString()}]: `}function Nn(e,t){if(typeof e!=="string"||e.trim()==="")throw Error(`LFV source requires "${t}"`);return e}function gu(e){return{...e,lfvServerUrl:Nn(e.lfvServerUrl,"lfvServerUrl"),clientId:Nn(e.clientId,"clientId"),path:Nn(e.path,"path")}}function St(e,t,r={}){let n=gu(e),o=n.log??au,s=(v,x,N)=>{let z=$s(v)+x;if(N!==void 0)o.debug(z,N);else o.debug(z)},i=(v,x,N)=>{let z=$s(v)+x;if(N!==void 0)o.warn(z,N);else o.warn(z)},{lfvServerUrl:c,clientId:d,path:u,verifyJwks:l}=n,h=typeof n.deliveryTimeout==="number"&&n.deliveryTimeout>0?n.deliveryTimeout:void 0,p=typeof n.retryInterval==="number"&&n.retryInterval>0?n.retryInterval:uu,k=typeof n.warnInterval==="number"&&n.warnInterval>=0?n.warnInterval:du,q=(typeof n.callbackMaxAgeSeconds==="number"&&n.callbackMaxAgeSeconds>0?n.callbackMaxAgeSeconds:lu)*1000,_=typeof n.cacheMaxAgeSeconds==="number"&&n.cacheMaxAgeSeconds>0?n.cacheMaxAgeSeconds*1000:void 0,b=l?.trim()?cu(l.trim()):void 0,j=Ws(n.deliveryEndpoint),U=Ws(n.eventsEndpoint),a=jr({lfvServerUrl:c,path:u}),w=crypto.randomUUID(),S=new Map,M=new Set,F=new Map,Z=new Map,Y=new Map,ee=new Map,ae=new Map,oe=new Map,K=new Map,Q=(v,x)=>{if(typeof x==="number"&&Number.isInteger(x)&&x>=1){let N=K.get(v)??1,z=Math.max(N,x);return K.set(v,z),z}return K.get(v)},V=(v,x)=>typeof x==="number"&&Number.isInteger(x)&&x>=1&&x>(K.get(v)??1),D=new Map,te=new Map,re=!1,ie,se=new Set,ce=()=>re;function T(v,x){F.set(v,x),Z.set(v,Date.now())}function g(v){F.delete(v),Z.delete(v)}function P(v){let x=F.get(v);if(!x)return;if(_!==void 0){let N=Z.get(v)??0;if(Date.now()-N>_){s(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:v});return}}return x}function I(){return M.size>0||S.size>0||oe.size>0}function R(){if(re){if(ie)ie(),ie=void 0;return}let v=I();if(v&&!ie)ie=Es(a,w,{trustId:b,onDelivery:async(x)=>Ko(x).handled||await Fo(x),onEvents:async(x)=>{zo(x)}});if(!v&&ie)ie(),ie=void 0}async function W(v,x,N,z){if(!t)throw Error("LFV callback transport is not configured");for(;;){if(re)throw new _e(x);if(z())throw new _e(x);let X=await t.take(v);if(X){if(X.key!==a)i(v,"parked OTP callback rejected: callback key mismatch");else if(!await gn(X.rawBody,X.headers)){let pe=or(X.rawBody);if(pe?.type==="otp"&&pe.request_id===v&&typeof pe.otp==="string"&&pe.otp)return pe.otp}}let H=sr(N);if(H!==void 0&&H<=0)throw tt("issueOtp",x,N);await Dn(H===void 0?qs:Math.min(qs,H))}}async function y(v,x){let N=x??crypto.randomUUID(),z={startedAt:Date.now(),timeout:h},X={request_id:N,path:v,action:"read_secret",...qn(Q(v))},H=await jn(()=>$t(`${c.replace(/\/+$/g,"")}/clients/${d}/otp`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":N},body:JSON.stringify(X)},z,"issueOtp",v),c,z,v,"issueOtp",p,k,i,N,ce);if(H.status!==200&&H.status!==202)throw new vt(H.status,"issueOtp",v)}async function O(v,x){let N=te.get(v);if(N)return N;let z=y(v,x);te.set(v,z);try{await z}finally{if(te.get(v)===z)te.delete(v)}}async function L(v,x,N,z){if(re)throw new _e(v);let X=N??crypto.randomUUID(),H=z??Me(),ue=new Promise((Ue,Xt)=>{let Bo={resolve:Ue,reject:Xt},yn=sr(H);if(yn!==void 0){if(yn<=0){Xt(tt("issueOtp",v,H));return}Bo.timer=setTimeout(()=>{oe.delete(X),R(),Xt(tt("issueOtp",v,H))},yn)}oe.set(X,Bo),R()});ue.catch(()=>{});let pe=()=>{let Ue=oe.get(X);if(!Ue)return;if(Ue.timer)clearTimeout(Ue.timer);oe.delete(X),R()},le={request_id:X,path:v,action:x,...qn(Q(v))};s(X,"OTP request",{path:v,action:x});let Se;try{Se=await jn(async()=>await $t(`${c.replace(/\/+$/g,"")}/clients/${d}/otp`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":X},body:JSON.stringify(le)},H,"issueOtp",v),c,H,v,"issueOtp",p,k,i,X,ce)}catch(Ue){throw pe(),Ue}if(Se.status!==200&&Se.status!==202)throw pe(),new vt(Se.status,"issueOtp",v);let Ce=!1,ke=t?W(X,v,H,()=>Ce):void 0;if(ke)ke.catch(()=>{});try{let Ue=await(ke?Promise.race([ue,ke]):ue);return s(X,"OTP received via signed callback",{path:v,action:x}),Ue}finally{Ce=!0,pe()}}async function C(v,x,N,z,X,H,ue){if(re)throw new _e(x);let pe=ue??Me(),le=await jn(async()=>await $t(`${c.replace(/\/+$/g,"")}${v}`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":X},body:JSON.stringify({request_id:X,otp:z,path:x,...qn(Q(x)),...H??{}})},pe,N,x),c,pe,x,N,p,k,i,X,ce);if(le.status!==200&&le.status!==202)throw new vt(le.status,N,x);return s(X,`${N} accepted`,{path:x,status:le.status}),le}async function m(v,x,N,z,X,H){if(re)throw new _e(x);let ue=X??crypto.randomUUID(),pe=H??Me(),le=await L(x,N,ue,pe),Se=await C(v,x,N,le,ue,z,pe);return{requestId:ue,response:Se}}async function f(v,x,N){if(re)throw new _e(v);let z=V(v,N?.kmsSlots);if(Q(v,N?.kmsSlots),z)g(v);let X=P(v);if(X)return X;let H=D.get(v);if(H){if(!z)return H;if(await H.catch(()=>{return}),H=D.get(v),H)return H}let ue=E(v,x,N);D.set(v,ue),ue.catch((pe)=>{if(Dr(pe))s(x,"read aborted: source closed",{path:v})});try{return await ue}finally{D.delete(v)}}async function E(v,x,N){let z=N?.timeout??h,X={startedAt:Date.now(),timeout:typeof z==="number"&&z>0?z:void 0},H=x??crypto.randomUUID();s(H,"read_secret request",{path:v});let ue=0,pe=Date.now();for(;;){if(re)throw new _e(v);try{let{response:le}=await m("/secrets/request",v,"read_secret",void 0,H,X),Se=await A(H,le),Ce=B(v,Se);return J(v,Ce,Ce.metadata.version),s(H,"read_secret completed from action response",{path:v}),Ce}catch(le){if(le instanceof _e)throw le;if(js(le))throw le;let Se=sr(X);if(Se!==void 0&&Se<=0)throw tt("read_secret",v,X);if(ue+=1,k>0&&Date.now()-pe>=k)i(H,`read_secret retrying. Retries: '${ue}'`,{path:v}),pe=Date.now();let Ce=Se===void 0?p:Math.min(p,Se);if(Ce<=0)throw tt("read_secret",v,X);await Dn(Ce)}}}async function A(v,x){if(!l?.trim())throw new et("LFV read_secret response verification is not configured");let N=x.headers.get("X-LFV-Request-Id")?.trim(),z=x.headers.get("X-LFV-Key-Id")?.trim(),X=x.headers.get("X-LFV-Signature")?.trim();if(!N||!z||!X)throw new et("LFV read_secret response is missing signature headers");if(N!==v)throw new et("LFV read_secret response request_id header does not match the request");let H=await x.text();if(!await Ms({jwks:l,kid:z,signatureB64Url:X,requestId:v,rawBody:H}))throw new et("LFV read_secret response signature verification failed");let pe=or(H);if(!pe||pe.request_id!==v)throw new et("LFV read_secret response request_id does not match the request");return pe}function B(v,x){if(Do(x)!==v||x.data?.data===void 0)throw new et(`LFV read_secret returned an invalid secret response for ${v}`);let z=x.data.metadata??{},X=typeof z.version==="number"?z.version:0,H=z.created_time??z.created,ue=wt(z);return{data:x.data.data,metadata:{path:v,version:X,created:typeof H==="string"?new Date(H):new Date,...ue?{contentType:ue}:{}}}}function J(v,x,N){if(N!==void 0){let H=ee.get(v);if(H!==void 0&&N<H){s(void 0,"delivery ignored: stale version",{path:v,realVersion:N,lastAccepted:H});return}ee.set(v,N)}T(v,x),se.delete(v);let z=x.metadata.version;if(Y.get(v)===z)return;Y.set(v,z);let X=S.get(v);if(!X)return;for(let H of X)H(x)}async function G(v,x){return await f(v,void 0,x)}async function de(v,x,N){if(!mu(x))throw Error(`putSecret requires an object value for LFV source at path ${v}`);let z=Me(N),X={data:x,content_type:qr(N.contentType)};if(await fe(v,N)){await m("/secrets/update",v,"update_secret",X,void 0,z),g(v);return}await m("/secrets/create",v,"create_secret",X,void 0,z),g(v)}async function ne(v,x){let N=Me(x);await m("/secrets/delete",v,"delete_secret",void 0,void 0,N),g(v)}async function we(v,x){let N=Me(x),z=crypto.randomUUID();s(z,"list_paths request",{path:v});let X=await L(v,"list_paths",z,N),H=await $t(`${c.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":z},body:JSON.stringify({request_id:z,otp:X,path:v})},N,"listPaths",v);if(H.status!==200)throw Error(`LFV listPaths failed (${H.status}) for ${v}`);let ue=await jt(H,{log:o,operation:"lfv.paths.list",redact:!0});if(!Array.isArray(ue.items))throw Error(`LFV listPaths returned invalid payload for ${v}`);return s(z,"list_paths success",{path:v,status:200}),ue.items.filter((pe)=>typeof pe==="string")}async function fe(v,x){let N=Me(x),z=crypto.randomUUID();s(z,"exists request",{path:v});let X=await L(v,"read_metadata",z,N),H=await $t(`${c.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":z},body:JSON.stringify({request_id:z,otp:X,path:v})},N,"exists",v);if(H.status!==200)throw Error(`LFV exists failed (${H.status}) for ${v}`);let ue=await jt(H,{log:o,operation:"lfv.paths.exists",redact:!0});if(typeof ue.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${v}`);return s(z,"exists success",{path:v,status:200,exists:ue.exists}),ue.exists}async function Xe(v,x,N){let z=Me(N);await m("/secrets/rotate/request",v,"request_rotate",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,z)}async function Pe(v,x,N){let z=Me(N);await m("/secrets/revoke/request",v,"request_revoke",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,z)}async function mt(v,x,N){let z=Me(N),{response:X}=await m("/secrets/kms/park",v,"kms_park",{key_id:x.keyId,status:x.status,reason:x.reason},void 0,z);return pu(await jt(X,{log:o,operation:"lfv.kms.park",redact:!0}).catch(()=>null),v)}function La(v,x){if(!v||typeof v!=="object"||Array.isArray(v))throw Error(`LFV kms_add_keys returned invalid payload for ${x}`);let N=v;if(!Array.isArray(N.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${x}`);return{keys:N.keys.map((X,H)=>{if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`LFV kms_add_keys returned invalid keys[${H}] for ${x}`);let ue=X.id;if(typeof ue!=="string"||ue.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${H}].id for ${x}`);return{id:ue}})}}function xa(v,x){if(!v||typeof v!=="object"||Array.isArray(v))throw Error(`LFV kms_revoke_key returned invalid payload for ${x}`);let N=v;if(typeof N.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${x}`);return{revoked:N.revoked}}async function Ua(v,x,N){let z=Me(N),{response:X}=await m("/secrets/kms/add-keys",v,"kms_add_keys",{keys:x.keys},void 0,z);return La(await jt(X,{log:o,operation:"lfv.kms.add_keys",redact:!0}).catch(()=>null),v)}async function Ma(v,x,N){let z=Me(N),{response:X}=await m("/secrets/kms/revoke-key",v,"kms_revoke_key",{key_id:x.keyId,reason:x.reason},void 0,z);return xa(await jt(X,{log:o,operation:"lfv.kms.revoke_key",redact:!0}).catch(()=>null),v)}async function Wa(v,x){let N=Me(x),z=crypto.randomUUID();s(z,"getMetadata request",{path:v});let X=await L(v,"read_metadata",z,N),H=await $t(`${c.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{...qt,...Ee,"X-LFV-Request-Id":z},body:JSON.stringify({request_id:z,otp:X,path:v})},N,"getMetadata",v);if(H.status!==200)throw Error(`LFV getMetadata failed (${H.status}) for ${v}`);let ue=await jt(H,{log:o,operation:"lfv.metadata.read",redact:!0});if(!ue.metadata||typeof ue.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${v}`);return s(z,"getMetadata success",{path:v,status:200}),ue.metadata}async function No(v,x,N,z=!0){let X=S.get(v)??new Set,H,ue=(le)=>{if(le.metadata.version===H)return;H=le.metadata.version,x(le)};if(X.add(ue),S.set(v,X),!z)return R(),()=>{let le=S.get(v);if(!le)return;if(le.delete(ue),le.size===0)S.delete(v);R()};let pe=V(v,N?.kmsSlots)?void 0:P(v);if(pe)ue(pe),Y.set(v,pe.metadata.version);else try{ue(await G(v,N))}catch(le){if(X.delete(ue),X.size===0)S.delete(v);throw le}return R(),()=>{let le=S.get(v);if(!le)return;if(le.delete(ue),le.size===0)S.delete(v);R()}}let qa=(v,x)=>No(v,x,void 0,!1);function ja(v){return v.method==="POST"&&new URL(v.url).pathname===j}function $a(v){return v.method==="POST"&&new URL(v.url).pathname===U}function Do(v){let x=v.data?.metadata?.path;if(typeof x==="string"&&x)return x;if(typeof v.path==="string"&&v.path)return v.path;return}function Na(v){let{request_id:x,otp:N}=v;if(typeof x!=="string"||typeof N!=="string"||!N)return{handled:!1};let z=oe.get(x);if(!z)return{handled:!1};if(z.timer)clearTimeout(z.timer);return oe.delete(x),R(),z.resolve(N),{handled:!0}}function Ko(v){return v.type==="otp"?Na(v):{handled:!1}}function ct(v="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:v}),{status:401,headers:Ee})}function Vo(v){return{requestId:v.headers.get("X-LFV-Request-Id")??v.headers.get("x-lfv-request-id")??"",keyId:v.headers.get("X-LFV-Key-Id")??v.headers.get("x-lfv-key-id")??"",signature:v.headers.get("X-LFV-Signature")??v.headers.get("x-lfv-signature")??""}}async function gn(v,x){if(!l?.trim())return i(void 0,"LFV callback rejected: verifyJwks is not configured"),ct("LFV callback verification is not configured");let{requestId:N,keyId:z,signature:X}=x;if(!N.trim()||!z.trim()||!X.trim())return i(N||void 0,"LFV callback rejected: missing signature headers"),ct("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await Ms({jwks:l,kid:z,signatureB64Url:X.trim(),requestId:N.trim(),rawBody:v}))return i(N,"LFV callback rejected: signature verification failed"),ct();let ue=or(v);if(!ue)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:Ee});let pe=ue;if(pe.request_id!==N.trim())return i(N,"LFV callback rejected: request_id header/body mismatch"),ct("X-LFV-Request-Id does not match request_id in body");let le=Date.now(),Se=$n(pe.issued_at);if(Se===void 0)return i(N,"LFV callback rejected: missing or invalid issued_at"),ct("Missing or invalid issued_at");if(le-Se>q)return i(N,"LFV callback rejected: stale (outside freshness window)"),ct("Callback is stale (issued_at outside freshness window)");let Ce=$n(pe.expires_at);if(Ce!==void 0&&le>Ce)return i(N,"LFV callback rejected: expired"),ct("Callback has expired");let ke=X.trim();for(let[Ue,Xt]of ae)if(Xt<=le)ae.delete(Ue);if(ae.has(ke))return i(N,"LFV callback rejected: replayed signature"),ct("Callback signature already processed (replay)");return ae.set(ke,Se+q),null}async function Fo(v){if(!r.selfRedeemReads||v.action!=="read_secret"||typeof v.request_id!=="string"||typeof v.path!=="string"||typeof v.otp!=="string")return!1;let x={startedAt:Date.now(),timeout:h},N=await C("/secrets/request",v.path,"read_secret",v.otp,v.request_id,void 0,x),z=await A(v.request_id,N),X=B(v.path,z);return J(v.path,X,X.metadata.version),!0}async function Da(v){let x=await v.text(),N=Vo(v),z=await gn(x,N);if(z)return z;let X=or(x);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:Ee});let H=X;if(H.type!=="otp"||typeof H.request_id!=="string"||typeof H.otp!=="string"||typeof H.path!=="string"||typeof H.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let ue=Do(H);s(H.request_id,"delivery received",{path:ue});let pe=Ko(H),le=ue?jr({lfvServerUrl:c,path:ue}):a,Se=await As(le,H,w,b),Ce=pe.handled||Se>0;if(!Ce)try{if(Ce=await Fo(H),!Ce&&t&&typeof H.request_id==="string"){let ke=$n(H.expires_at),Ue=Math.max(1,(ke??Date.now()+q)-Date.now());await t.put(H.request_id,{kind:"delivery",key:le,rawBody:x,headers:N},Ue),Ce=!0}}catch(ke){if(js(ke)){if(!(ke instanceof vt)||ke.status!==409&&ke.status!==410)se.add(H.path);return i(N.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:le,status:ke instanceof vt?ke.status:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:Ee})}return ae.delete(N.signature.trim()),i(N.requestId,"LFV callback handoff failed; callback may be retried",{key:le,error:ke instanceof Error?ke.message:String(ke)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:Ee})}if(!Ce)return ae.delete(N.signature.trim()),i(N.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:le}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:Ee});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:Ee})}function zo(v){if(re)return;if(!v?.path||typeof v.path!=="string")return;s(v.request_id,"events payload",{path:v.path,event:v.event});for(let x of M)try{x({path:v.path,event:v.event,requestId:v.request_id,issuedAt:v.issued_at,expiresAt:v.expires_at,...typeof v.key_id==="string"&&v.key_id.length>0?{keyId:v.key_id}:{}})}catch(N){i(v.request_id,"secret event listener failed",{path:v.path,event:v.event,error:N instanceof Error?N.message:String(N)})}if(v.event==="created"||v.event==="updated"||v.event==="rotated")g(v.path),(r.selfRedeemReads?O(v.path,v.request_id):f(v.path,v.request_id).then(()=>{return})).catch((N)=>{if(Dr(N)){s(v.request_id,"event refresh aborted: source closed",{path:v.path});return}se.add(v.path),i(v.request_id,"event-triggered refresh failed; source marked degraded",{path:v.path,event:v.event,error:N instanceof Error?N.message:String(N)})})}async function Ka(v){let x=await v.text(),N=Vo(v),z=await gn(x,N);if(z)return z;let X=or(x);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:Ee});let H=X;if(!H?.path||typeof H.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:Ee});s(H.request_id,"events received",{path:H.path,event:H.event}),zo(H);let ue=jr({lfvServerUrl:c,path:H.path});return await _s(ue,H,w,b),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:Ee})}function Va(){if(re)return;if(re=!0,ie)ie(),ie=void 0;let v=new _e(u);for(let x of oe.values()){if(x.timer)clearTimeout(x.timer);try{x.reject(v)}catch{}}oe.clear(),D.clear(),te.clear(),se.clear(),F.clear(),Z.clear(),Y.clear(),ee.clear(),ae.clear(),S.clear(),M.clear()}return{type:"vault",isAvailable:()=>se.size===0,get:(v,x)=>He(()=>G(v,x)),getFullSecret:G,getSecret:async(v,x)=>(await G(v,x)).data,putSecret:de,deleteSecret:ne,listPaths:we,exists:fe,requestRotate:Xe,requestRevoke:Pe,parkKmsKey:mt,addKmsKeys:Ua,revokeKmsKey:Ma,getMetadata:Wa,subscribe:No,subscribePassive:qa,subscribeEvents:(v)=>(M.add(v),R(),()=>{M.delete(v),R()}),close:Va,isDeliveryRequest:ja,isEventsRequest:$a,handleDelivery:Da,handleEvents:Ka,deliveryPath:j,eventsPath:U,callbackKey:a,trustId:b}}function kt(e,t,r){if(typeof e!=="string"||e.trim()==="")throw Error(`"${t}" is required when using ${r}`);return e}var Nt="__esLfvBootstrap";import{catalogEntityStore as Vr,listGenerator as cr,materializeCodeCatalogEntity as ku,unionCatalogRead as bu}from"@ionite/core";import{baseCustomerToScim as Vs,baseUserToScimUser as Fs,baseWorkloadToScim as zs,entitlementToScimGroup as Fn}from"@ionite/core/server";import{ACCEPT_SCIM as yu,CONTENT_TYPE_SCIM as hu,ION_AUTHZ_GROUP_SCHEMA as Kn,isJsonResponse as Ds,readJsonResponse as Ns,unexpectedBodySummary as Ks}from"@ionite/core";var wu="urn:ietf:params:scim:api:messages:2.0:PatchOp",vu="urn:ietf:params:scim:schemas:core:2.0:User",Su="urn:ietf:params:scim:schemas:core:2.0:Group";async function ir(e){try{if(Ds(e)){let r=(await e.clone().text()).trim();return r?r.slice(0,2000):void 0}let t=await Ks(e.clone());return[t.contentType,t.excerpt].filter(Boolean).join(": ")||void 0}catch{return}}function ar(e){if(e==="user")return"Users";if(e==="workload")return"Workloads";if(e==="customer")return"Customers";return"Groups"}function Vn(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class Kr{constructor(e){this.inflight=new Map;this.memo=new Map;this.writes=new Map;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.getToken=e.getToken,this.receipts=e.receipts,this.log=e.log,this.fetchImpl=e.fetchImpl??((t,r)=>fetch(t,r))}async headers(){let e=await this.getToken();return new Headers({...hu,...yu,Authorization:`Bearer ${e}`})}inflightKey(e,t,r){return`${e}\x00${t}\x00${r?"create":"lookup"}`}receiptKey(e,t){return`${e}\x00${t}`}serializeWrite(e,t,r){let n=`${e}\x00${t}`,s=(this.writes.get(n)??Promise.resolve()).catch(()=>{return}).then(r);this.writes.set(n,s);let i=()=>{if(this.writes.get(n)===s)this.writes.delete(n)};return s.then(i,i),s}async resolveProviderId(e,t,r){let n=this.receiptKey(e,t),o=this.memo.get(n);if(o)return{found:o.providerId,requestUrl:o.requestUrl};let s=await this.receipts.read(e,t);if(s)this.memo.set(n,s);if(s)return{found:s.providerId,requestUrl:s.requestUrl};let i=this.inflightKey(e,t,r!==void 0),c=this.inflight.get(i);if(c)return c;let d=this.resolveUncached(e,t,r).then(async(u)=>{if(typeof u==="object"){let l={providerId:u.found,...u.requestUrl?{requestUrl:u.requestUrl}:{}};await this.receipts.write(e,t,l),this.memo.set(n,l)}return u}).finally(()=>{this.inflight.delete(i)});return this.inflight.set(i,d),d}async resolveUncached(e,t,r){let n=await this.filterByExternalId(e,t);if(n!=="absent")return n;if(!r)return"absent";return this.create(e,t,r)}async filterByExternalId(e,t){let r=encodeURIComponent(`externalId eq "${Vn(t)}"`),n=`${this.baseUrl}/${ar(e)}?filter=${r}`,o=await this.fetchImpl(n,{method:"GET",headers:await this.headers()});if(!o.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:e,status:o.status,detail:await ir(o)}),"error";let i=((await Ns(o,{log:this.log,operation:"iam.delta.resolve"})).Resources??[])[0];return i?.id?{found:i.id,...this.requestUrl(e,i)}:"absent"}async create(e,t,r){let n=`${this.baseUrl}/${ar(e)}`,o=this.writeBody(e,t,r),s=await this.fetchImpl(n,{method:"POST",headers:await this.headers(),body:JSON.stringify(o)});if(!s.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:e,status:s.status,detail:await ir(s)}),"error";let i=await Ns(s,{log:this.log,operation:"iam.delta.create"});return i.id?{found:i.id,...this.requestUrl(e,i),created:!0}:"error"}requestUrl(e,t){if(e!=="group")return{};let r=t[Kn];if(!r||typeof r!=="object")return{};let n=r.requestUrl;return typeof n==="string"&&n?{requestUrl:n}:{}}async captureResponseReference(e,t,r,n,o){if(e.status===204)return;if(!Ds(e)){let s=await Ks(e.clone());if(s.excerpt)this.log.warn("SCIM destination returned a non-JSON body on a successful write",{"ion.operation":"iam.delta.receipt","ion.outcome":"degraded",reason:"non_json_response",status:e.status,contentType:s.contentType,excerpt:s.excerpt});return}try{let s=await e.clone().json(),i=this.requestUrl(t,s).requestUrl;if(!i&&s.id===void 0)return;let c=i??o,d={providerId:s.id??n,...c?{requestUrl:c}:{}};await this.receipts.write(t,r,d),this.memo.set(this.receiptKey(t,r),d)}catch{}}async invalidate(e,t){this.memo.delete(this.receiptKey(e,t)),await this.receipts.clear(e,t)}writeBody(e,t,r){let{id:n,meta:o,...s}=r,i=s,c=i[Kn];if(c&&typeof c==="object"&&!Array.isArray(c)){let{providerId:d,requestUrl:u,...l}=c;i[Kn]=l}return{...i,schemas:(r.schemas?.length??0)>0?r.schemas:[e==="user"?vu:Su],externalId:t}}async upsertResource(e,t,r){return this.serializeWrite(e,t,()=>this.upsertResourceNow(e,t,r))}async upsertResourceNow(e,t,r){let n=async(s)=>{let i=await this.resolveProviderId(e,t,s?r:void 0);if(i==="error")return"error";if(i==="absent")return"skipped";if(i.created)return"pushed";let c=await this.fetchImpl(`${this.baseUrl}/${ar(e)}/${encodeURIComponent(i.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody(e,t,r))});if(c.status===404||c.status===410)return"stale";if(c.ok)return await this.captureResponseReference(c,e,t,i.found,i.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:e,status:c.status,detail:await ir(c)}),"error"},o=await n(!0);if(o==="stale")await this.invalidate(e,t),o=await n(!0);return o==="stale"?"error":o}async deleteResource(e,t){return this.serializeWrite(e,t,()=>this.deleteResourceNow(e,t))}async deleteResourceNow(e,t){let r=async()=>{let o=await this.resolveProviderId(e,t);if(o==="error")return{outcome:"error"};if(o==="absent")return{outcome:"pushed"};let s=await this.fetchImpl(`${this.baseUrl}/${ar(e)}/${encodeURIComponent(o.found)}`,{method:"DELETE",headers:await this.headers()});if(s.status===404||s.status===410)return{outcome:"pushed",stale:!0};if(s.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:e,status:s.status,detail:await ir(s)}),{outcome:"error"}},n=await r();if(n.stale)await this.invalidate(e,t),n=await r();if(n.outcome==="pushed")await this.invalidate(e,t);return n.outcome}async patchGroupMembership(e){return this.serializeWrite("group",e.groupExternalId,()=>this.patchGroupMembershipNow(e))}async patchGroupMembershipNow(e){let{groupExternalId:t,userExternalId:r,op:n}=e,o=e.subjectResourceType??"user",s=await this.resolveProviderId(o,r,n==="add"?e.userCreate:void 0);if(s==="error")return this.log.warn("IAM delta: principal lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,subjectResourceType:o}),"error";if(s==="absent")return this.log.warn("IAM delta: principal not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n,subjectResourceType:o}),"skipped";let i=s.found,c=async(l)=>{let h=await this.resolveProviderId("group",t,n==="add"&&l?e.groupCreate:void 0);if(h==="error")return{kind:"error"};if(h==="absent")return{kind:"absent"};let p=`${this.baseUrl}/${ar("group")}/${encodeURIComponent(h.found)}`,k=n==="add"?[{op:"add",path:"members",value:[{value:i,type:e.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${Vn(i)}"]`}];return{kind:"response",response:await this.fetchImpl(p,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[wu],Operations:k})}),providerId:h.found,requestUrl:h.requestUrl}},d=await c(!0);if(d.kind==="response"&&(d.response.status===404||d.response.status===410))await this.invalidate("group",t),d=await c(!1);if(d.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n}),"error";if(d.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n}),"skipped";let u=d.response;if(!u.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,status:u.status,detail:await ir(u)}),"error";return await this.captureResponseReference(u,"group",t,d.providerId,d.requestUrl),"pushed"}}function Dt(e){if(typeof e==="string")return e;if(e&&typeof e==="object"&&"id"in e)return e.id;return}function ur(e){return e&&typeof e==="object"?e:void 0}function zn(e){let t={},r={},n,o,s,i,c,d,u,l,h,p=()=>t.users==="patch"||t.workloads==="patch"||t.customers==="patch",k=(g)=>{if(g==="user")return t.users==="patch";if(g==="workload")return t.workloads==="patch";return t.customers==="patch"},q=()=>{if(!t.url)return"destination URL is not configured";if(!r.workload)return"workload identity is not configured";if(typeof r.workload.isReady!=="function"||typeof r.workload.ready!=="function")return"workload handle violates the readiness contract";if(!r.workload.isReady())return"workload module is not ready";if(t.audience){let g=r.workload[t.audience];if(!g)return`outgoing workload client "${t.audience}" is not configured`;if(typeof g.isReady!=="function"||typeof g.ready!=="function")return`outgoing workload client "${t.audience}" violates the readiness contract`;if(!g.isReady())return`outgoing workload client "${t.audience}" is not ready`}return},_=()=>{if(!p())return"no principal-kind delta mode is 'patch'";let g=q();if(g)return g;if(t.users==="patch"&&!r.userStore)return"user store is not configured for IAM destination receipts";if(t.workloads==="patch"&&!r.workloadIdentityStore)return"workload identity store is not configured for IAM destination receipts";if(t.customers==="patch"&&!r.customerStore)return"customer store is not configured for IAM destination receipts";if(!r.catalogStore)return"catalog store is not configured for IAM destination receipts";return},b=()=>_()===void 0,j=me("IAM delta",b),U=async()=>{let g=r.workload;if(!g)throw Error("IAM delta: workload identity not configured");if(t.audience&&typeof g.getToken==="function")return g.getToken(t.audience);if(typeof g.getServerToken==="function")return g.getServerToken();return g.getToken()},a=()=>bu(r.codeCatalog,r.catalogStore),w=async(g,P)=>{let I=r.catalogStore;if(!I)return;let R=r.codeCatalog?.groups.get(g)??r.codeCatalog?.roles.get(g)??r.codeCatalog?.permissions.get(g);if(R){let y=r.codeCatalog?.groups.get(R.id)?"group":r.codeCatalog?.roles.get(R.id)?"role":"permission",O=Vr(I,y),L=await O.get(R.id);if(!L&&P)await ku(y,R,O),L=await O.get(R.id);if(L)return{kind:y,entity:L}}let W=[["group",I.groups],["role",I.roles],["permission",I.permissions]];for(let[y,O]of W){let L=await O.get(g);if(L)return{kind:y,entity:L}}return},S=async(g)=>{let P=r.userStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);for await(let I of cr((R,W)=>P.list({start:R,limit:W})))if(I.externalId===g)return I;return},M=(g)=>g?.providerId?{providerId:g.providerId,...g.requestUrl?{requestUrl:g.requestUrl}:{}}:void 0,F=async(g)=>{let P=r.workloadIdentityStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);let I=await P.lookup({id:"",externalId:g});if(I)return I;for await(let R of cr((W,y)=>P.list({start:W,limit:y})))if(R.externalId===g)return R;return},Z=async(g)=>{let P=r.customerStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);let I=await P.lookup({id:"",userName:"",name:"",email:"",externalId:g});if(I)return I;for await(let R of cr((W,y)=>P.list({start:W,limit:y})))if(R.externalId===g)return R;return},Y={async read(g,P){if(g==="user")return M(await S(P));if(g==="workload")return M(await F(P));if(g==="customer")return M(await Z(P));return M((await w(P,!1))?.entity)},async write(g,P,I){if(g==="user"){let y=await S(P);if(!y||y.providerId===I.providerId&&y.requestUrl===I.requestUrl)return;await r.userStore?.upsert({...y,providerId:I.providerId,requestUrl:I.requestUrl});return}if(g==="workload"){let y=await F(P);if(!y||y.providerId===I.providerId&&y.requestUrl===I.requestUrl)return;await r.workloadIdentityStore?.upsert({...y,providerId:I.providerId,requestUrl:I.requestUrl});return}if(g==="customer"){let y=await Z(P);if(!y||y.providerId===I.providerId&&y.requestUrl===I.requestUrl)return;await r.customerStore?.upsert({...y,providerId:I.providerId,requestUrl:I.requestUrl});return}let R=await w(P,!0);if(!R||R.entity.providerId===I.providerId&&R.entity.requestUrl===I.requestUrl)return;await Vr(r.catalogStore,R.kind).set({...R.entity,providerId:I.providerId,requestUrl:I.requestUrl}).ready()},async clear(g,P){if(g==="user"){let L=await S(P);if(!L||L.providerId===void 0&&L.requestUrl===void 0)return;let{providerId:C,requestUrl:m,...f}=L;await r.userStore?.upsert(f);return}if(g==="workload"){let L=await F(P);if(!L||L.providerId===void 0&&L.requestUrl===void 0)return;let{providerId:C,requestUrl:m,...f}=L;await r.workloadIdentityStore?.upsert(f);return}if(g==="customer"){let L=await Z(P);if(!L||L.providerId===void 0&&L.requestUrl===void 0)return;let{providerId:C,requestUrl:m,...f}=L;await r.customerStore?.upsert(f);return}let I=await w(P,!1);if(!I||I.entity.providerId===void 0&&I.entity.requestUrl===void 0)return;let{providerId:R,requestUrl:W,...y}=I.entity;await Vr(r.catalogStore,I.kind).set(y).ready()}},ee=()=>{if(!b()||!t.url)return;let g=t.url;if(n&&o===g&&s===r.catalogStore&&i===r.userStore&&c===r.workloadIdentityStore&&d===r.customerStore&&u===r.codeCatalog&&l===r.fetchImpl)return n;return n=new Kr({baseUrl:t.url,getToken:U,receipts:Y,log:e,fetchImpl:r.fetchImpl}),o=g,s=r.catalogStore,i=r.userStore,c=r.workloadIdentityStore,d=r.customerStore,u=r.codeCatalog,l=r.fetchImpl,n},ae=(g)=>g==="workload"?"Workload":g==="customer"?"Customer":"User",oe=async(g)=>{if(g.subjectType==="workload"){let W=Dt(g.subject),y=ur(g.subject);if(!y&&W)y=await r.workloadIdentityStore?.get(W);let O=y?.externalId??y?.id??W;if(!y||!O)return;return{externalId:O,resourceType:"workload",create:await(r.mapWorkloadToScim?.({...y,externalId:O})??zs({...y,externalId:O}))}}if(g.subjectType==="customer"){let W=Dt(g.subject),y=ur(g.subject);if(!y&&W)y=await r.customerStore?.get(W);let O=y?.externalId??y?.id??W;if(!O)return;let L=y?await(r.mapCustomerToScim?.({...y,externalId:O})??Vs({...y,externalId:O})):{schemas:["urn:ionite:scim:schemas:core:2.0:Customer"],externalId:O,displayName:O,active:!0};return{externalId:O,resourceType:"customer",create:L}}let I=ur(g.subject);if(!I){let W=Dt(g.subject);if(W&&r.userStore)I=await r.userStore.get(W)}let R=I?.externalId;if(!I||!R)return;return{externalId:R,resourceType:"user",create:await(r.mapUserToScim?.(I)??Fs(I))}},K=async(g)=>{let I=ur(g.target);if(!I){let R=Dt(g.target),W=a();if(R&&W)I=g.targetType==="role"?await W.roles.get(R):g.targetType==="permission"?await W.permissions.get(R):await W.groups.get(R)}if(I&&I.requestable!==!0)return"not-requestable";if(!I)return;return{externalId:I.id,create:Fn(I,g.targetType)}},Q=async(g,P)=>{if(!b())return"skipped";if(!k(g.subjectType==="workload"?"workload":g.subjectType==="customer"?"customer":"user"))return"skipped";let I=await oe(g),R=await K(g);if(R==="not-requestable")return"skipped";if(!I||!R)return e.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:P,hasSubject:Boolean(I),hasTarget:Boolean(R),targetType:g.targetType}),"skipped";let W=ee();if(!W)return"skipped";return W.patchGroupMembership({groupExternalId:R.externalId,userExternalId:I.externalId,op:P,groupCreate:R.create,userCreate:I.create,memberType:ae(g.subjectType),subjectResourceType:I.resourceType})},V=async(g,P,I)=>{let R=[],W=new Set,y=(L)=>{let C=`${L.type??"User"}\x00${L.value}`;if(!W.has(C))W.add(C),R.push(L)},O=r.accessStore;if(O)for await(let L of cr((C,m)=>O.listByTarget(P,g.id,{start:C,limit:m}))){let C=await oe(L);if(!C){e.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:g.id,targetType:P});continue}let m=await I.resolveProviderId(C.resourceType,C.externalId,C.create);if(m==="error")throw Error(`IAM delta failed to resolve access subject for ${P}:${g.id}`);if(m==="absent")continue;let f=L.metadata;y({value:m.found,type:ae(L.subjectType),...f?.display?{display:f.display}:{}})}if(P==="group"){let L=a();for(let C of g.groups??[]){let m=Dt(C),f=ur(C);if(!f&&m)f=await L?.groups.get(m);if(f&&f.requestable!==!0)continue;if(!f){e.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:m,target:g.id});continue}let E=await I.resolveProviderId("group",f.id,Fn(f,"group"));if(E==="error")throw Error(`IAM delta failed to resolve nested Group for group:${g.id}`);if(E!=="absent")y({value:E.found,type:"Group"})}}return R.length>0?R:void 0},D=async(g)=>{if(!b()||!k("user"))return"skipped";let P=g.externalId;if(!P)return e.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:g.id,kind:"user"}),"skipped";let I=ee();if(!I)return"skipped";let R=await(r.mapUserToScim?.(g)??Fs(g));return I.upsertResource("user",P,R)},te=async(g)=>{if(!b()||!k("workload"))return"skipped";let P=g.externalId??g.id;if(!P)return"skipped";let I=ee();if(!I)return"skipped";let R=await(r.mapWorkloadToScim?.({...g,externalId:P})??zs({...g,externalId:P}));return I.upsertResource("workload",P,R)},re=async(g)=>{if(!b()||!k("customer"))return"skipped";let P=g.externalId??g.id;if(!P)return"skipped";let I=ee();if(!I)return"skipped";let R=await(r.mapCustomerToScim?.({...g,externalId:P})??Vs({...g,externalId:P}));return I.upsertResource("customer",P,R)},ie=async(g,P,I=!0)=>{if(!b()||!p())return"skipped";let R=a(),y=(R?await Vr(R,P).get(g.id):void 0)??g;if(y.requestable!==!0)return"skipped";let O=ee();if(!O)return"skipped";let L=await V(y,P,O),C=await O.upsertResource("group",y.id,Fn(y,P,L)),m=r.accessStore;if(C!=="pushed"||!I||!m)return C;for await(let f of cr((E,A)=>m.listByTarget(P,g.id,{start:E,limit:A})))if(await Q(f,"add")==="error")throw Error(`IAM delta failed to restore access for ${P}:${g.id}`);return C},se=(g,P)=>{if(g==="error")throw Error(`IAM delta: destination rejected ${P}`)},ce=(g,P,I)=>{if(P==="pushed")g.pushed+=1;else if(P==="skipped")g.skipped+=1;else g.errors.push(`IAM delta: destination rejected ${I}`)},T={async onUserUpsert(g){se(await D(g),"user upsert")},async onUserDelete(g){if(!b()||!k("user"))return;let P=ee();if(!P)return;se(await P.deleteResource("user",g),"user delete")},async onWorkloadUpsert(g){se(await te(g),"workload upsert")},async onWorkloadDelete(g){if(!b()||!k("workload"))return;let P=ee();if(!P)return;se(await P.deleteResource("workload",g),"workload delete")},async onCustomerUpsert(g){se(await re(g),"customer upsert")},async onCustomerDelete(g){if(!b()||!k("customer"))return;let P=ee();if(!P)return;se(await P.deleteResource("customer",g),"customer delete")},async onEntitlementUpsert(g,P){se(await ie(g,P),`${P} upsert`)},async onEntitlementDelete(g,P){if(!b())return;let I=ee();if(!I)return;se(await I.deleteResource("group",P),`${g} delete`)},async onGrant(g){if(!b())return;if(await Q(g,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(g){if(!b())return;if(await Q(g,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async reconcile(g){let P={pushed:0,skipped:0,errors:[]},I=_();if(I)return P.errors.push(`iam delta not ready: ${I}`),P;let R=async(W,y,O)=>{if(!W)return;for await(let L of W)try{ce(P,await y(L),O(L))}catch(C){P.errors.push(C instanceof Error?C.message:String(C))}};return await R(g.groups,(W)=>ie(W,"group",!1),(W)=>`group upsert for ${W.id}`),await R(g.roles,(W)=>ie(W,"role",!1),(W)=>`role upsert for ${W.id}`),await R(g.permissions,(W)=>ie(W,"permission",!1),(W)=>`permission upsert for ${W.id}`),await R(g.users,(W)=>D(W),(W)=>`user upsert for ${W.id??"unknown"}`),await R(g.workloads,(W)=>te(W),(W)=>`workload upsert for ${W.id}`),await R(g.customers,(W)=>re(W),(W)=>`customer upsert for ${W.id??"unknown"}`),await R(g.access,(W)=>Q(W,"add"),(W)=>`membership push for ${Dt(W.target)??"unknown"}`),P},async getDestinationRef(g,P){return Y.read(g,P)},isReady:b,ready:j.ready};return{update(g,P){t=g,r=P,ee(),j.refresh();let I=_();if(!p())h=void 0;else if(I!==h){if(I)e.warn(`IAM delta configured but not ready: ${I}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:I});h=I}return T},handle(){return T}}}var Fr=4,Ru=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"sso.claims_authz",module:"sso",label:"SSO claim-derived entitlements",requires:"sessionStore.capabilities.derivedEntitlements",incapableReason:"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted."},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"ciam.claims_authz",module:"ciam",label:"CIAM claim-derived entitlements",requires:"sessionStore.capabilities.derivedEntitlements",incapableReason:"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted."},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore or authz.catalog",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability is wired by the application."},{key:"iam.groups.create",module:"iam",label:"IAM-sourced entitlement creation",requires:"AccessCatalogStore + authz.onInboundEntitlement",incapableReason:"The application has not wired durable catalog storage and explicitly opted into IAM-sourced entitlements."},{key:"iam.workloads",module:"iam",label:"SCIM Workloads inbound",requires:"workloadIdentityStore",incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."},{key:"iam.customers",module:"iam",label:"SCIM Customers inbound",requires:"customerStore",incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"workload.claims_authz",module:"workload",label:"Workload claim-derived entitlements"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."},{key:"authz.access_requests",module:"authz",label:"IdP access-request lifecycle"},{key:"tm.integration",module:"tm",label:"Tenant Management staged integration and consent",requires:"TenantStore integration methods + onConnectRequest",incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."}];import{IoniteError as Tu}from"@ionite/core";function Cu(e){if(e instanceof Tu)return{status:e.status,statusText:e.statusText};if(typeof e!=="object"||e==null)return;let t=e,r=typeof t.status==="number"?t.status:void 0,n=typeof t.statusText==="string"?t.statusText:void 0;return r!=null||n?{status:r,statusText:n}:void 0}function Kt(e){if(e instanceof Response)return e;let t=Cu(e);if(!t)return Response.json({error:"internal_error"},{status:500});let n={status:t.status??500};if(t.statusText)n.statusText=t.statusText;return Response.json({error:t.statusText??"internal_error"},n)}function ye(){return Response.json({error:"not_found"},{status:404})}function rt(e=["GET"]){return Response.json({error:"method_not_allowed",allow:e},{status:405,headers:{Allow:e.join(", ")}})}import{timingSafeEqual as Iu}from"node:crypto";import{parseKmsPoolDocument as Pu,stableConfigHash as Gs}from"@ionite/core";function Bs(e,t,r){for(let n of e)try{n()}catch(o){t.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:r,error:o instanceof Error?o.message:String(o)})}}function Ke(e,t){let r=new Set,n=new Set;return{beforeChange(o){return r.add(o),()=>{r.delete(o)}},afterChange(o){return n.add(o),()=>{n.delete(o)}},emitBefore(){Bs(r,e,`${t} beforeChange`)},emitAfter(){Bs(n,e,`${t} afterChange`)}}}var Ou=604800000,Eu=2147483647,Au=1;function Xs(e,t){if(!e.value)return!1;if(e.notBefore&&Date.parse(e.notBefore)>t)return!1;if(e.notAfter&&Date.parse(e.notAfter)<=t)return!1;return!0}function We(e,t,r=Date.now()){if(!e)return;let n=e.slots?.[t];if(!n)return;let o=e.keys.find((s)=>s.id===n&&s.state==="active");return o&&Xs(o,r)?o:void 0}function Bn(e,t=Date.now()){if(!e)return[];return e.keys.filter((r)=>(r.state==="active"||r.state==="deprecated")&&Xs(r,t))}function Hs(e){return{...e,...e.meta?{meta:{...e.meta}}:{}}}function zr(e,t,r){if(!t||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>o(Error(r)),t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function Js(e,t){let r=Buffer.from(e),n=Buffer.from(t);return r.length===n.length&&Iu(r,n)}function _u(e){if(!Number.isInteger(e)||e<1)throw Error("KMS unique() requires a positive integer slot count.");return e}var Lu=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function xu(e){return Lu.has(e)}function Ys(e){let t=e.trim().replace(/\/+$/,"");if(!t||t==="/")return"/";return t.startsWith("/")?t:`/${t}`}function Uu(e,t){let r=Ys(e),n=Ys(t);return r===n||r.endsWith(n)}function Mu(e,t,r){let n=Ke(t,`KMS pool "${e}"`),o=new Set,s=!1,i,c,d=0,u,l,h=Au,p,k,q,_=new Map,b=new Set,j,U=()=>i!==void 0&&i.slots===void 0&&i.keys.length>0,a=me(`KMS pool "${e}"`,()=>{if(!s)return!1;if(U())return Bn(i).length>0;return We(i,0)!==void 0}),w=me(`KMS pool "${e}" issuer`,()=>s&&p!==void 0),S=(C)=>C===0?`KMS pool "${e}"`:`KMS pool "${e}" slot ${C}`,M=(C)=>{let m=_.get(C),f=m?.valueWaiter;if(!m||!f)return;if(!s){m.valueWaiter=void 0,f.reject(Error(`${S(C)} is no longer configured.`));return}if(U()){m.valueWaiter=void 0,f.reject(Error(`${S(C)} verifier grant has no slots.`));return}let E=We(i,C);if(E?.value)m.valueWaiter=void 0,f.resolve(E.value)},F=()=>{for(let C of _.keys())M(C)},Z=(C)=>{let m=_.get(C);if(!m)return;let f=We(i,C);for(let E of m.listeners)try{E(f?Hs(f):void 0)}catch(A){t.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:e,slot:C,error:A instanceof Error?A.message:String(A)})}},Y=()=>{for(let C of _.keys())Z(C)},ee=()=>{for(let C of _.values())C.latch.refresh();a.refresh(),w.refresh()},ae=()=>{try{j?.()}catch(C){t.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:e,error:C instanceof Error?C.message:String(C)})}j=void 0},oe=()=>{if(j||b.size===0||!p?.subscribeEvents||!k)return;let C=k;j=p.subscribeEvents((m)=>{if(!xu(m.event)||!Uu(m.path,C))return;let f={path:m.path,event:m.event,...m.requestId===void 0?{}:{requestId:m.requestId},...m.keyId===void 0?{}:{keyId:m.keyId}};for(let E of b)try{E(f)}catch(A){t.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:e,error:A instanceof Error?A.message:String(A)})}})},K=()=>{if(l)clearTimeout(l);l=void 0},Q=()=>{K();let C=Date.now();if(i){for(let f of i.keys){if(!f.notAfter)continue;let E=Date.parse(f.notAfter)-C;if(E>0&&E<=Ou&&(f.state==="active"||f.state==="deprecated")&&!o.has(f.id))o.add(f.id),t.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:e,keyId:f.id,notAfter:f.notAfter})}let m=i.keys.flatMap((f)=>[f.notBefore,f.notAfter]).filter((f)=>Boolean(f)).map((f)=>Date.parse(f)).filter((f)=>f>C).sort((f,E)=>f-E);if(m[0])l=setTimeout(()=>{let f=new Map([..._.keys()].map((E)=>[E,We(i,E)?.id]));ee(),r();for(let E of _.keys())if(f.get(E)!==We(i,E)?.id)Z(E);Q()},Math.min(m[0]-C+1,Eu))}ee(),r(),F()},V=(C)=>{let m=new Map([..._.keys()].map((f)=>{let E=We(i,f);return[f,{id:E?.id,value:E?.value}]}));n.emitBefore();try{i=Pu(C),Q();for(let f of _.keys()){let E=We(i,f),A=m.get(f);if(A?.id!==E?.id||A?.value!==E?.value)Z(f)}}catch(f){i=void 0,Q(),Y(),t.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:e,error:f instanceof Error?f.message:String(f)})}finally{n.emitAfter()}},D=()=>{try{u?.()}catch(C){t.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:e,error:C instanceof Error?C.message:String(C)})}u=void 0},te=(C,m)=>{p=C,k=m,d+=1;let f=d;D(),C.subscribe(m,(E)=>{if(d!==f||!s)return;V(E.data)},{kmsSlots:h}).then((E)=>{if(d!==f||!s){E();return}u=E}).catch((E)=>{if(d!==f||!s)return;i=void 0,Q(),Y(),t.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:e,path:m,error:E instanceof Error?E.message:String(E)})})},re=(C,m)=>{let f=se(C),E=We(i,C);if(!s)return Promise.reject(Error(`${S(C)} is no longer configured.`));if(U())return Promise.reject(Error(`${S(C)} verifier grant has no slots.`));if(E?.value)return Promise.resolve(E.value);if(!f.valueWaiter){let B,J,G=new Promise((de,ne)=>{B=de,J=ne});f.valueWaiter={promise:G,resolve:B,reject:J}}let A=f.valueWaiter.promise;return M(C),zr(A,m,`${S(C)} was not ready within ${m}ms.`)},ie=(C,m)=>{let f=se(C);f.listeners.add(m);let E=We(i,C);return m(E?Hs(E):void 0),()=>f.listeners.delete(m)};function se(C){let m=_.get(C);if(m)return m;let f=me(S(C),()=>s&&We(i,C)!==void 0),E={listeners:new Set,latch:f,api:{value:(A)=>re(C,A),current:()=>We(i,C)?.value,subscribe:(A)=>ie(C,A),park:(A,B)=>g(A,B),isReady:f.isReady,ready:f.ready}};return _.set(C,E),E}let ce=(C)=>{if(U())throw Error(`KMS pool "${e}" verifier grant has no slots.`);let m=_u(C),f=m>h;h=Math.max(h,m);let E=[];for(let A=0;A<m;A+=1)E.push(se(A).api);if(f&&s&&p&&k)te(p,k);return E},T=(C)=>Bn(i).find((m)=>m.value!==void 0&&Js(C,m.value)),g=(C,m)=>{if(!s||!p||!k)return Promise.reject(Error(`KMS pool "${e}" is not configured.`));if(typeof C.value!=="string"||C.value.length===0)return Promise.reject(Error(`KMS pool "${e}" park() requires a non-empty value.`));let f=T(C.value);if(!f)return Promise.resolve({parked:!1,stale:!0});return zr(p.parkKmsKey(k,{keyId:f.id,status:C.status,reason:C.reason},m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" park() did not complete within ${m}ms.`)},P=()=>{if(!s||!p||!k)throw Error(`KMS pool "${e}" is not configured.`);return{source:p,path:k}},I=(C)=>{if(!Array.isArray(C)||C.length===0)throw Error(`KMS pool "${e}" addKeys() requires a non-empty keys array.`);return C.map((m,f)=>{if(!m||typeof m!=="object")throw Error(`KMS pool "${e}" addKeys() keys[${f}] must be an object.`);if(typeof m.value!=="string"||m.value.length===0)throw Error(`KMS pool "${e}" addKeys() keys[${f}].value must be a non-empty string.`);if(m.id!==void 0&&(typeof m.id!=="string"||m.id.length===0))throw Error(`KMS pool "${e}" addKeys() keys[${f}].id must be a non-empty string when present.`);return m})},R=(C,m)=>{try{let{source:f,path:E}=P(),A=I(C);return zr(f.addKmsKeys(E,{keys:A},m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" addKeys() did not complete within ${m}ms.`)}catch(f){return Promise.reject(f)}},W=(C,m)=>{try{let{source:f,path:E}=P();if(typeof C.keyId!=="string"||C.keyId.length===0)throw Error(`KMS pool "${e}" revokeKey() requires a non-empty keyId.`);return zr(f.revokeKmsKey(E,C,m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" revokeKey() did not complete within ${m}ms.`)}catch(f){return Promise.reject(f)}},y=(C)=>{let{source:m}=P();if(!m.subscribeEvents)throw Error(`KMS pool "${e}" events are not supported by this secrets transport.`);return b.add(C),oe(),()=>{b.delete(C)}};se(0);let O={describe:()=>ve({name:e,source:q,path:k??`/kms/${e}`,ready:a.isReady()}),value:(C)=>re(0,C),current:()=>We(i,0)?.value,unique:ce,accepts:(C)=>Bn(i).some((m)=>m.value!==void 0&&Js(C,m.value)),park:g,subscribe:(C)=>ie(0,C),beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:a.isReady,ready:a.ready},L={addKeys:R,revokeKey:W,events:y,isReady:w.isReady,ready:w.ready};return{api:O,issuer:L,update(C,m,f){let E=Gs({config:C,path:f});if(s=!0,q=C.source,c===E){ee();return}c=E,D(),ae(),K(),i=void 0,ee(),r(),Y(),F(),te(m,f),oe()},unavailable(C){s=!0,q=C.source,c=Gs(C),d+=1,p=void 0,k=void 0,ae(),D(),K(),i=void 0,ee(),r(),Y(),F()},remove(){if(!s)return;n.emitBefore(),s=!1,c=void 0,q=void 0,d+=1,p=void 0,k=void 0,ae(),D(),K(),i=void 0,ee(),r(),Y(),F(),n.emitAfter()},close(){s=!1,d+=1,p=void 0,k=void 0,ae(),b.clear(),D(),K();for(let C of _.values())C.listeners.clear();i=void 0,F();for(let C of _.values())C.latch.settle();a.settle(),w.settle()},isConfigured:()=>s}}function Zs(e){let t=new Map,r=new Map,n=Ke(e,"KMS"),o=!1,i=me("KMS module",()=>o&&Array.from(t.values()).every((p)=>!p.isConfigured()||p.api.isReady())),c,d=()=>i.refresh(),u=(p)=>{let k=t.get(p);if(k)return k;let q=Mu(p,e,d);if(t.set(p,q),!(p in c))Object.assign(c,{[p]:q.api});return q},l=(p)=>{let k=t.get(p);if(!k)throw Error(`KMS pool "${p}" is not configured.`);return k.api},h=(p)=>{let k=t.get(p);if(!k)throw Error(`KMS pool "${p}" is not configured.`);return k.issuer};return c={describe:()=>({module:"kms",active:o,ready:i.isReady(),pools:Array.from(r.keys(),(p)=>u(p).api.describe())}),get config(){return Object.fromEntries(r)},beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:i.isReady,ready:i.ready,listPools:()=>Array.from(r.keys()),getPool:l,issuer:h},{handle:()=>c,update(p,k){if(!p&&!o&&t.size===0)return;n.emitBefore(),o=p!==void 0;let q=new Set(Object.keys(p??{}));for(let[_,b]of Object.entries(p??{})){r.set(_,{...b});let j=b.path??`/kms/${_}`;try{u(_).update(b,k(b),j)}catch(U){u(_).unavailable(b),e.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:_,error:U instanceof Error?U.message:String(U)})}}for(let[_,b]of t){if(q.has(_))continue;r.delete(_),b.remove()}return i.refresh(),n.emitAfter(),o||t.size>0?c:void 0},close(){for(let p of t.values())p.close();t.clear(),r.clear(),o=!1,i.settle()}}}import{ACCEPT_JSON as Wu,CONTENT_TYPE_FORM as qu,formatLogLine as ju,readJsonResponse as $u}from"@ionite/core";import{context as Nu,trace as Du}from"@opentelemetry/api";import{logs as Ku,SeverityNumber as Je}from"@opentelemetry/api-logs";import{OTLPLogExporter as Vu}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as Fu}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as zu}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as Bu}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as Gu}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as Hu}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as Ju}from"@opentelemetry/resources";import{BatchLogRecordProcessor as Yu}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as Xu}from"@opentelemetry/sdk-metrics";import{NodeSDK as Zu}from"@opentelemetry/sdk-node";var Qs={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},Qu={trace:!1,debug:!1,info:!0,warn:!0,error:!0},ed={trace:Je.TRACE,debug:Je.DEBUG,info:Je.INFO,warn:Je.WARN,error:Je.ERROR};function Gn(e,t){let r=t[e];if(r===!1)return!1;if(e==="metrics")return r===!0||typeof r==="object";return!0}function Xn(e){return typeof e==="object"&&e!==null?e:void 0}function td(e){return typeof e==="object"&&e!==null?e:void 0}function rd(e,t){let r=e.replace(/\/+$/,"");if(r.endsWith(Qs[t]))return r;return`${r}${Qs[t]}`}function nd(e,t){let r=Xn(e[t]);if(r?.endpoint)return r.endpoint;if(!e.endpoint)return;return rd(e.endpoint,t)}function od(e,t,r){let n=Xn(e[t]),o={...e.headers,...n?.headers??{}};if(r)o.Authorization=`Bearer ${r}`;return o}function Zn(e,t,r){let n=Xn(e[t]);return{url:nd(e,t),headers:od(e,t,r),timeoutMillis:n?.timeoutMillis,concurrencyLimit:n?.concurrencyLimit}}function sd(e,t){let r=Zn(e,"traces",t);return e.protocol==="http/json"?new Gu(r):new Hu(r)}function id(e,t){let r=Zn(e,"metrics",t);return e.protocol==="http/json"?new zu(r):new Bu(r)}function ad(e,t){let r=Zn(e,"logs",t);return e.protocol==="http/json"?new Vu(r):new Fu(r)}function cd(e){return{"service.name":e.name,...e.version?{"service.version":e.version}:{},...e.deploymentEnvironment?{"deployment.environment.name":e.deploymentEnvironment}:{},...e.resourceAttributes??{}}}async function ud(e,t){if(!e.oauth)return;let r=new URLSearchParams({grant_type:"client_credentials",client_id:e.oauth.clientId,client_secret:e.oauth.clientSecret});if(e.oauth.scope)r.set("scope",e.oauth.scope);if(e.oauth.audience)r.set("audience",e.oauth.audience);let n=await fetch(e.oauth.tokenUrl,{method:"POST",headers:{...Wu,...qu,...e.oauth.headers??{}},body:r});if(!n.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${n.status}`);let o=await $u(n,{log:t,operation:"otel.oauth.token",redact:!0});if(typeof o.access_token!=="string"||!o.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return o.access_token}function dd(e,t){return{...Qu,...t?.levels??{},...e.levels??{}}}function dr(e,t="Authorization"){let r={...e.headers??{}};if(!e.apiKey)return r;let n=e.apiKeyHeader??t;return r[n]=n.toLowerCase()==="authorization"?`Bearer ${e.apiKey}`:e.apiKey,r}function ld(e,t){return Object.keys(e).some((r)=>r.toLowerCase()===t.toLowerCase())}function ti(e,t,r){let n=Object.keys(e).find((o)=>o.toLowerCase().startsWith(t.toLowerCase()));if(n)throw Error(`OpenTelemetry provider "${r}" does not support provider-specific header "${n}".`)}function lr(e,t,r,n){return{type:r,name:e.name,version:e.version,protocol:e.protocol??"http/protobuf",endpoint:e.endpoint,headers:n,resourceAttributes:cd(e),levels:dd(e,t),console:e.console??"info",traces:e.traces,metrics:e.metrics,logs:e.logs}}function fd(e,t){return lr(e,t,"otlp",dr(e))}function pd(e,t){return lr(e,t,"grafana-lgtm",dr(e))}function md(e,t){let r=dr(e,"DD-API-KEY");if(!ld(r,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return lr(e,t,"datadog",r)}function gd(e,t){let r=dr(e);return ti(r,"DD-","splunk"),lr(e,t,"splunk",r)}function yd(e,t){let r=dr(e);return ti(r,"DD-","elastic"),lr(e,t,"elastic",r)}function hd(e,t){let r=e.type??"otlp";switch(r){case"otlp":return fd(e,t);case"grafana-lgtm":return pd(e,t);case"datadog":return md(e,t);case"splunk":return gd(e,t);case"elastic":return yd(e,t);default:throw Error(`Unsupported OpenTelemetry provider type: ${r}`)}}function wd(e,t){if(typeof e==="string")return e;if(e instanceof Error)return e.message;if(e!=null)return Jn(e);if(t.length===0)return"";return Jn(t[0])}function Jn(e){if(typeof e==="string")return e;try{return JSON.stringify(e)}catch{return String(e)}}function ei(e,t,r){if(r==null)return;if(typeof r==="string"||typeof r==="number"||typeof r==="boolean"){e[t]=r;return}if(Array.isArray(r)&&r.every((n)=>["string","number","boolean"].includes(typeof n))){e[t]=r;return}if(r instanceof Error){if(e[`${t}.name`]=r.name,e[`${t}.message`]=r.message,r.stack)e[`${t}.stack`]=r.stack;return}e[t]=Jn(r)}function vd(e){let t={};for(let[n,o]of e.entries()){if(o&&typeof o==="object"&&!Array.isArray(o)&&!(o instanceof Error)&&Object.getPrototypeOf(o)===Object.prototype){for(let[s,i]of Object.entries(o))ei(t,s,i);continue}ei(t,`param.${n}`,o)}let r=Du.getSpanContext(Nu.active());if(r)t.trace_id=r.traceId,t.span_id=r.spanId,t.trace_flags=r.traceFlags;return t}function Sd(e){return e}function kd(e,t){globalThis.console[Sd(e)](ju(e,t.body,[t.attributes??{}]))}function bd(e,t,r,n){if(r.console==="off")return;if((t.severityNumber??0)<ed[r.console])return;let o=n?.console;if(o){o(t);return}kd(e,t)}function Rd(e,t){let r=Ku.getLogger(e.name,e.version),n=(o,s,i)=>{if(!e.levels[o])return;let c={severityNumber:s,severityText:o.toUpperCase(),body:wd(i[0],i.slice(1)),attributes:vd(i.slice(1))};try{r.emit(c)}finally{bd(o,c,e,t)}};return{trace:(o,...s)=>n("trace",Je.TRACE,[o,...s]),debug:(o,...s)=>n("debug",Je.DEBUG,[o,...s]),info:(o,...s)=>n("info",Je.INFO,[o,...s]),warn:(o,...s)=>n("warn",Je.WARN,[o,...s]),error:(o,...s)=>n("error",Je.ERROR,[o,...s])}}function Td(e){return e?.current()}function Cd(e,t,r){let n=t;return e.subscribe((o)=>{let s=o?.value;if(s===n)return;n=s,r()})}function Hn(e){if(!e)return{enabled:!1};if(e===!0)return{enabled:!0};return{enabled:!0,endpoint:e.endpoint,timeoutMillis:e.timeoutMillis,concurrencyLimit:e.concurrencyLimit,exportIntervalMillis:e.exportIntervalMillis,exportTimeoutMillis:e.exportTimeoutMillis}}function ri(e,t,r){return()=>ve({module:"otel",active:t,ready:r(),type:e?.type,name:e?.name,endpoint:e?.endpoint,protocol:e?.protocol,apiKeyPool:e?.apiKeyPool,apiKeyHeader:e?.apiKeyHeader,oauth:e?.oauth?{tokenUrl:e.oauth.tokenUrl,clientId:e.oauth.clientId,scope:e.oauth.scope,audience:e.oauth.audience}:void 0,version:e?.version,deploymentEnvironment:e?.deploymentEnvironment,resourceAttributes:e?.resourceAttributes,levels:e?.levels,console:e?.console,signals:{traces:Hn(e?.traces),metrics:Hn(e?.metrics),logs:Hn(e?.logs)}})}function Yn(e,t){return{state:"unavailable",describe:ri(t,t!==void 0,()=>!1),beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:e,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function Qn(e,t,r,n){if(!t&&!r)return;if(!t)return Yn(e);let o=t,s;if(o.apiKeyPool&&n)try{s=n.getPool(o.apiKeyPool)}catch{s=void 0}let i=Td(s),c=()=>Qn(e,o,r,n),d=o.apiKeyPool&&n?(U)=>Cd(n.getPool(o.apiKeyPool),i,U):void 0;if(o.apiKeyPool&&!i){let U=Yn(e,o);return U.onCredentialChange=d,U.rebuild=c,U}let u=i?{...o,apiKey:i}:o,l=hd(u,r),h,p=!1,k=Rd(l,r),q,_,b=new Promise((U,a)=>{q=U,_=a});async function j(){try{let U=await ud(o,e),a={resource:Ju(l.resourceAttributes),instrumentations:r?.instrument};if(r?.sampler)a.sampler=r.sampler;if(r?.textMapPropagator)a.textMapPropagator=r.textMapPropagator;if(r?.contextManager)a.contextManager=r.contextManager;if(r?.spanProcessors)a.spanProcessors=r.spanProcessors;else if(Gn("traces",l))a.traceExporter=sd(l,U);if(r?.metricReaders)a.metricReaders=r.metricReaders;else if(Gn("metrics",l)){let S=td(l.metrics);a.metricReaders=[new Xu({exporter:id(l,U),exportIntervalMillis:S?.exportIntervalMillis,exportTimeoutMillis:S?.exportTimeoutMillis})]}if(r?.logRecordProcessors)a.logRecordProcessors=r.logRecordProcessors;else if(Gn("logs",l))a.logRecordProcessors=[new Yu({exporter:ad(l,U)})];let w=r?.configure?.(a);h=new Zu(w??a),h.start(),p=!0,q?.()}catch(U){p=!1;let a=U instanceof Error?U:Error(String(U));e.error?.("OpenTelemetry startup failed",a),_?.(a)}finally{q=void 0,_=void 0}}return{state:"available",describe:ri(o,!0,()=>p),start:j,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>p,ready:(U)=>{if(!U||U<=0)return b;return Promise.race([b,new Promise((a,w)=>{setTimeout(()=>w(Error(`OpenTelemetry ready timed out after ${U}ms.`)),U)})])},logger:k,forceFlush:async()=>{await h?.forceFlush?.()},shutdown:async()=>{p=!1,await h?.shutdown(),h=void 0},onCredentialChange:d,rebuild:c}}function ni(e){let t,r,n,o=0,s=Promise.resolve(),i=Ke(e,"OpenTelemetry"),c=me("OpenTelemetry module",()=>t?.isReady()===!0),d=Yn(e),u={describe:()=>(t??d).describe(),beforeChange:i.beforeChange,afterChange:i.afterChange,isReady:c.isReady,ready:c.ready,logger:{trace:(p,...k)=>(t?.logger??e).trace(p,...k),debug:(p,...k)=>(t?.logger??e).debug(p,...k),info:(p,...k)=>(t?.logger??e).info(p,...k),warn:(p,...k)=>(t?.logger??e).warn(p,...k),error:(p,...k)=>(t?.logger??e).error(p,...k)},forceFlush:async()=>{await t?.forceFlush()},shutdown:async()=>{await t?.shutdown()}},l=!1,h;return h={update(p){if(!p){if(t||r){let b=t,j=r;o+=1,i.emitBefore(),n?.(),n=void 0,t=void 0,r=void 0,c.refresh(),s=Promise.all([b?.shutdown(),j?.shutdown()]).finally(()=>i.emitAfter()).then(()=>{return},()=>{return})}return l?u:void 0}if(l=!0,p===t||p===r)return u;let k=t,q=r;o+=1;let _=o;return i.emitBefore(),n?.(),n=void 0,t=void 0,r=p,c.refresh(),s=(async()=>{try{if(await Promise.all([k?.shutdown(),q?.shutdown()]),await p.start(),_!==o||r!==p){await p.shutdown();return}t=p,r=void 0,c.refresh(),n=p.onCredentialChange?.(()=>{if(t!==p)return;let b=p.rebuild?.();if(b)h.update(b)})}finally{if(_===o)i.emitAfter()}})().then(()=>{return},()=>{return}),u},settled(){return s},async shutdown(){o+=1;let p=t,k=r;n?.(),n=void 0,t=void 0,r=void 0,c.settle(),await Promise.all([p?.shutdown(),k?.shutdown()])}},h}import{ION_ENDPOINT_PERMISSIONS as Vt,trimTrailingSlash as oi}from"@ionite/core";import{hasPermission as Id}from"@ionite/core/server";async function fr(e,t,r){let n=await Id(e,t,r.permission,void 0,r.subjectType);return n.allow?void 0:n.response()}function Pd(e){let t=oi(e);return{matchesPath:(o)=>{if(!o)return!1;return oi(o)===t},startsWithPath:(o)=>{if(!o)return!1;return e===o||e.startsWith(`${o}/`)}}}function si(e,t,r,n){let o=n??new URL(e.url).pathname,{matchesPath:s,startsWithPath:i}=Pd(o);if(t.sso){let c=t.sso;if(s(r.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(d)=>c.handler(d)};if(s(r.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(d)=>c.logout(d)};if(s(r.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(d)=>c.logoutBackChannel(d)};if(s(r.sso.loginUrl)||s(r.sso.refreshUrl)||s(r.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(d)=>c.handler(d)}}if(t.ciam){let c=t.ciam;if(s(r.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(d)=>c.customerHandler(d)};if(s(r.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(d)=>c.logout(d)}}if(t.iam){let c=t.iam,d=e.method!=="GET"&&e.method!=="HEAD";if(i(r.iam.usersUrl))return{module:"iam",kind:d?"iam.users.write":"iam.read",requiredPermission:Vt[d?"iam.users.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.groupsUrl))return{module:"iam",kind:d?"iam.groups.write":"iam.read",requiredPermission:Vt[d?"iam.groups.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.workloadsUrl))return{module:"iam",kind:d?"iam.workloads.write":"iam.read",requiredPermission:Vt[d?"iam.workloads.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.customersUrl))return{module:"iam",kind:d?"iam.customers.write":"iam.read",requiredPermission:Vt[d?"iam.customers.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(`${r.iam.basePath}/AccessRequests`))return{module:"iam",kind:"iam.access-requests.write",requiredPermission:Vt["iam.access-requests.write"],handler:async(u)=>c.handler(u)};if(i(r.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(u)=>c.handler(u)}}if(t.workload){let c=t.workload;if(s(r.workload.validateUrl)||s(r.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(d)=>c.handler(d)}}if(t.secrets){let c=t.secrets;if(c.isLfvDeliveryRequest?.(e)&&c.handleLfvDelivery){let d=c.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(u)=>d(u)}}if(c.isLfvEventsRequest?.(e)&&c.handleLfvEvents){let d=c.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(u)=>d(u)}}}if(t.ciam){let c=t.ciam;if(s(r.ciam.magicLinkUrl)&&e.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:Vt["ciam.magic-link.create"],handler:async(d)=>c.handler(d)};if(s(r.ciam.magicLinkLoginUrl)&&e.method==="GET"||s(r.ciam.customerProvidersUrl)&&e.method==="GET"||s(r.ciam.customerLoginUrl)&&e.method==="GET"||s(r.ciam.customerCallbackUrl)&&(e.method==="GET"||e.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(d)=>c.handler(d)}}return}async function eo(e,t,r,n){let o=n??Fe(Er()),s=new URL(e.url).pathname;if(r?.filter){let h=await r.filter(e,t);if(h instanceof Response)return h;if(h==="not_handled")return ye()}let i=si(e,t,o,s),d=await r?.resolve?.(e,t,i)??i;if(!d)return ye();let u=d.requiredPermission===void 0?i?.requiredPermission:d.requiredPermission,l=async()=>{if(u){let h=await fr(e,t,u);if(h)return h}return d.handler(e)};if(r?.wrap)return await r.wrap(e,d,l,t);return await l()}import{stableConfigHash as Yd}from"@ionite/core";function Br(){let e=0;return{next:()=>(e+=1,e),isCurrent:(t)=>t===e,current:()=>e}}import{readFile as Fd,stat as zd}from"node:fs/promises";import{ACCEPT_JSON as Bt,CONTENT_TYPE_FORM as Ii,CONTENT_TYPE_JSON as Bd,readJsonResponse as Xr}from"@ionite/core";import{ACCEPT_JSON as io,CONTENT_TYPE_FORM as $d,CONTENT_TYPE_JSON as Ci,readJsonResponse as Rt}from"@ionite/core";class Ft extends Error{constructor(e,t,r){super(e);this.code=t;this.status=r;this.sourceType="vault";this.name="VaultWebSocketCommandError"}}class nt extends Error{constructor(e,t=`Vault secret not found at path ${e}`){super(t);this.path=e;this.sourceType="vault";this.name="VaultSecretNotFoundError",this.code="not_found",this.status=404}}class he extends Error{constructor(e,t,r,n,o){super(e,o);this.path=t;this.status=r;this.code=n;this.sourceType="vault";this.name="VaultRequestError"}}class qe extends Error{constructor(e,t,r=`Vault subscribe is not supported for source ${e} at path ${t} without websocket, LFV, or ttl`){super(r);this.sourceType=e;this.path=t;this.name="VaultSubscribeNotSupportedError"}}function ii(e){return e instanceof nt||e instanceof Ft&&(e.code==="not_found"||e.status===404)}import{WebSocket as pr}from"ws";var Od=1000,Ed=30000,ci=30000,ui=ci;function di(e){ui=e>0?e:ci}function li(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Ad(e){let t=Math.min(Ed,Od*2**Math.min(e,16)),r=0.5+Math.random()*0.5;return Math.round(t*r)}var bt=new Map;function _d(e){return e.trim().replace(/\/+$/g,"")}function fi(e,t){let r=typeof t?.version==="number"?t.version:0,n=t?.created_time??t?.created,o=typeof n==="string"?new Date(n):new Date,s=wt(t);return{path:e,version:r,created:o,...s?{contentType:s}:{}}}function Ld(e){return typeof e?.version==="number"?e.version:void 0}function xd(e){let t=e.token?.trim();if(!t)return{};if(e.header==="Authorization")return{Authorization:t.startsWith("Bearer ")?t:`Bearer ${t}`};return{"X-Vault-Token":t}}function mr(e){return{client_id:e.clientId,token:e.token,header:e.header??"X-Vault-Token"}}function ro(e,t){let r=_d(e),n=bt.get(r);if(n){if(t&&!n.log)n.log=t;return n}let o={url:r,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:t};return bt.set(r,o),o}function Ud(e){let t=[...Array.from(e.subs.values(),(o)=>o.creds),...e.eventListeners.values()];if(t.length===0)return e.lastGoodCreds??{url:e.url};let r=e.lastGoodCreds?[e.lastGoodCreds,...t]:t,n=r[e.reconnectCredCursor%r.length]??t[0];return e.reconnectCredCursor+=1,n}function ai(e,t){for(let r of e.subs.values())try{r.onHealth?.(t)}catch(n){e.log?.warn("Vault websocket health hook threw",n)}}function Md(e,t){for(let r of Array.from(e.subs.values())){let n=r.onFirstSecretReject;if(r.onFirstSecret=void 0,r.onFirstSecretReject=void 0,n)try{n(new he(`Vault websocket subscription interrupted (${t})`,r.path,void 0,"connection"))}catch(o){e.log?.warn("Vault websocket first-secret waiter rejection threw",o)}}}function pi(e,t){for(let r of e.pending.values())clearTimeout(r.timer),r.reject(new he(`Vault websocket command interrupted (${t})`,"/",void 0,"connection"));e.pending.clear()}function Gr(e){if(e.disposed)return;if(e.disposed=!0,e.reconnectTimer)clearTimeout(e.reconnectTimer),e.reconnectTimer=void 0;pi(e,"closed"),Md(e,"socket disposed");let t=e.ws;if(e.ws=void 0,e.connectPromise=void 0,e.hasConnected=!1,bt.delete(e.url),t)try{t.removeAllListeners(),t.close()}catch{}}function Hr(e){if(e.subs.size>0||e.pending.size>0||e.eventListeners.size>0)return;Gr(e)}function to(e){return`${e.clientId??""}|${e.token??""}|${e.header??"X-Vault-Token"}`}function mi(e){let t=new Map;for(let r of e.eventListeners.values())t.set(to(r),r);return Array.from(t.values())}function Wd(e,t){if(typeof t.path!=="string"||typeof t.event!=="string")return;let r={path:t.path,event:t.event,...typeof t.request_id==="string"?{requestId:t.request_id}:{},...typeof t.key_id==="string"&&t.key_id.length>0?{keyId:t.key_id}:{}};for(let n of e.eventListeners.keys())try{n(r)}catch(o){e.log?.warn("Vault websocket event listener threw",o)}}function gi(e,t,r,n){if(n!==void 0&&t.lastVersion!==void 0&&n===t.lastVersion)return;if(n!==void 0)t.lastVersion=n;try{t.onChange(r)}catch(s){e.log?.warn("Vault websocket subscription onChange threw",s)}let o=t.onFirstSecret;if(t.onFirstSecret=void 0,t.onFirstSecretReject=void 0,o)try{o()}catch(s){e.log?.warn("Vault websocket subscription onFirstSecret threw",s)}}function qd(e,t){let r=t.subscription_id;if(typeof r!=="string")return;let n=e.subs.get(r);if(!n)return;let o={data:t.data,metadata:fi(typeof t.path==="string"?t.path:n.path,t.metadata)};gi(e,n,o,Ld(t.metadata))}function jd(e,t){let r;try{r=JSON.parse(t.toString())}catch(n){e.log?.warn("Vault websocket message parse failed",n);return}if(r.type==="secret"){qd(e,r);return}if(r.type==="event"){Wd(e,r);return}if(r.type==="command_result"&&typeof r.id==="string"){let n=e.pending.get(r.id);if(!n)return;if(e.pending.delete(r.id),clearTimeout(n.timer),r.ok===!1)n.reject(new Ft(r.error??`Vault websocket command failed for ${r.id}`,r.code,r.status));else n.resolve(r.result);Hr(e)}}function yi(e,t){e.send(JSON.stringify({type:"subscribe",subscription_id:t.subscriptionId,paths:[t.path],...li(t.kmsSlots),...mr(t.creds)}))}function no(e){if(e.disposed||e.reconnectTimer||e.subs.size===0&&e.eventListeners.size===0)return;let t=Ad(e.reconnectAttempts);e.reconnectAttempts+=1,e.reconnectTimer=setTimeout(()=>{if(e.reconnectTimer=void 0,e.disposed)return;if(e.subs.size===0&&e.eventListeners.size===0){Gr(e);return}Jr(e,Ud(e)).catch(()=>{if(e.hasConnected)e.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${t}ms).`);no(e)})},t)}function Jr(e,t){if(e.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if(e.ws&&e.ws.readyState===pr.OPEN)return Promise.resolve(e.ws);if(e.connectPromise)return e.connectPromise;return e.connectPromise=new Promise((r,n)=>{let o=new pr(e.url,{headers:xd(t)}),s=!1,i=e.hasConnected,c=()=>{s=!0,e.hasConnected=!0,e.reconnectAttempts=0,e.reconnectCredCursor=0,e.lastGoodCreds=t,e.ws=o,e.connectPromise=void 0,o.on("message",(l)=>jd(e,l));for(let l of e.subs.values())try{yi(o,l)}catch{}for(let l of mi(e))try{o.send(JSON.stringify({type:"subscribe_events",...mr(l)}))}catch{}if(i)ai(e,!0);r(o)},d=()=>{if(e.ws===o)e.ws=void 0;e.connectPromise=void 0;try{o.removeAllListeners()}catch{}if(pi(e,"socket closed"),e.subs.size>0||e.eventListeners.size>0)ai(e,!1),no(e);else Gr(e)},u=(l)=>{if(e.ws===o)e.ws=void 0;if(!s)s=!0,e.connectPromise=void 0,n(l)};o.once("open",c),o.on("close",d),o.on("error",u)}),e.connectPromise}async function oo(e,t,r,n){let o=ro(e.url,n),s=typeof r.path==="string"?r.path:"/",i=await Jr(o,e),c=crypto.randomUUID();try{return await new Promise((d,u)=>{let l=setTimeout(()=>{if(!o.pending.has(c))return;o.pending.delete(c),u(new he(`Vault websocket command "${t}" timed out`,s,void 0,"timeout"));try{o.ws?.close()}catch{}},ui);o.pending.set(c,{resolve:(h)=>d(h),reject:u,timer:l});try{i.send(JSON.stringify({type:"command",id:c,command:t,...r,...mr(e)}))}catch(h){clearTimeout(l),o.pending.delete(c),u(h)}})}finally{Hr(o)}}async function so(e,t,r,n){let o;try{o=await oo(e,"read_secret",{path:t,...li(n)},r)}catch(s){if(ii(s))throw new nt(t);if(s instanceof Ft||s instanceof he)throw s;throw new he(`Vault websocket read_secret failed for ${t}`,t,void 0,"connection",{cause:s})}if(!o||typeof o!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${t}`);return{data:o.data,metadata:fi(typeof o.path==="string"?o.path:t,o.metadata)}}async function hi(e,t,r,n,o,s){let i=ro(e.url,o),c=crypto.randomUUID(),d={subscriptionId:c,creds:e,path:t,...n?.kmsSlots!==void 0?{kmsSlots:n.kmsSlots}:{},onChange:r,onHealth:s?.onHealth};i.subs.set(c,d);let u=()=>{if(!i.subs.delete(c))return;if(i.ws&&i.ws.readyState===pr.OPEN)try{i.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:c}))}catch{}Hr(i)};try{let l=await Jr(i,e);yi(l,d)}catch(l){if(n?.mode!=="wait")throw u(),l}try{let l=await so(e,t,o,n?.kmsSlots);gi(i,d,l,l.metadata.version)}catch(l){if(n?.mode!=="wait")throw u(),l;await new Promise((h,p)=>{let k,q=(_)=>{if(k)clearTimeout(k);d.onFirstSecret=void 0,d.onFirstSecretReject=void 0,u(),p(_)};if(d.onFirstSecret=()=>{if(k)clearTimeout(k);h()},d.onFirstSecretReject=q,typeof n.timeout==="number"&&n.timeout>0)k=setTimeout(()=>q(l),n.timeout)})}return u}async function wi(e,t,r){let n=ro(e.url,r);n.eventListeners.set(t,e);try{let o=await Jr(n,e);if(o.readyState===pr.OPEN)o.send(JSON.stringify({type:"subscribe_events",...mr(e)}))}catch(o){n.log?.warn("Vault websocket event subscription connect failed; retrying in background",o),no(n)}return()=>{if(!n.eventListeners.delete(t))return;let o=to(e);if(!mi(n).some((i)=>to(i)===o)&&n.ws&&n.ws.readyState===pr.OPEN)try{n.ws.send(JSON.stringify({type:"unsubscribe_events",...mr(e)}))}catch{}Hr(n)}}function vi(){let e=0;for(let t of bt.values())e+=t.subs.size;return{urls:Array.from(bt.keys()),sockets:bt.size,subscriptions:e}}function Si(){for(let e of Array.from(bt.values()))Gr(e)}var Yr=600000;function Tt(e){if(e&&e<Yr)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${Yr} milliseconds (10 minutes), as not to overload the store with polling requests`)}function ot(e,t,r,n,o,s,i){let c=!1,d,u,l,h=(j)=>{try{i?.onHealth?.(j)}catch{}},p=()=>{if(c=!0,d)clearTimeout(d),d=void 0;u?.()},k=(j)=>new Promise((U)=>{let a=setTimeout(()=>{u=void 0,d=void 0,U()},j);d=a,u=()=>{clearTimeout(a),u=void 0,d=void 0,U()}});async function q(){let j=Date.now();for(;;){if(c)return;try{let U=await e.getFullSecret(t,s);return h(!0),U}catch(U){if(h(!1),s?.mode!=="wait")throw U;if(typeof s.timeout==="number"&&s.timeout>0&&Date.now()-j>=s.timeout)throw U;if(c)return;o?.warn(`Error retrieving initial secret from vault. Retrying in ${n} milliseconds`,U),await k(n)}}}async function _(){if(d=void 0,c)return;try{let j=await e.getFullSecret(t,s);if(h(!0),j.metadata.version!==l)l=j.metadata.version,r(j)}catch(j){h(!1),o?.warn(`Error retrieving remote config from vault. Retrying in ${n} milliseconds`,j)}b()}function b(){if(c)return;d=setTimeout(()=>{_()},n)}return q().then((j)=>{if(c||!j)return()=>p();return l=j.metadata.version,r(j),b(),()=>p()})}function Nd(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Dd(e){let t={...io,...Ci};if(e)t["X-Vault-Token"]=e;return t}function Kd(e){return Boolean(e?.idpTokenUrl?.trim()&&e.clientId?.trim()&&e.clientSecret?.trim())}async function ki(e,t,r){let n=Date.now();if(t.token&&t.expiresAt&&t.expiresAt-60000>n)return t.token;let o=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});if(e.scope?.trim())o.set("scope",e.scope.trim());let s=await fetch(e.idpTokenUrl,{method:"POST",headers:{...io,...$d},body:o.toString()});if(!s.ok)throw Error(`Vault workload token request failed (${s.status})`);let i=await Rt(s,{log:r,operation:"vault.workload.token",redact:!0});if(!i.access_token)throw Error("Vault workload token response did not include access_token");return t.token=i.access_token,t.expiresAt=n+Math.max(1,i.expires_in??300)*1000,i.access_token}function Vd(e){return{Authorization:e.startsWith("Bearer ")?e:`Bearer ${e}`}}function gr(e){return e.replace(/\/data\/?$/,"")}function bi(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let n=e;if(typeof n.parked!=="boolean")throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let o=n.disposition;if(o!==void 0&&o!=="cooldown"&&o!=="suspect")throw Error(`Vault ${r} kms_park returned invalid disposition for ${t}`);return{parked:n.parked,...n.stale===!0?{stale:!0}:{},...o?{disposition:o}:{}}}function Ri(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);let n=e;if(!Array.isArray(n.keys))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);return{keys:n.keys.map((s,i)=>{if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}] for ${t}`);let c=s.id;if(typeof c!=="string"||c.length===0)throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}].id for ${t}`);return{id:c}})}}function Ti(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);let n=e;if(typeof n.revoked!=="boolean")throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);return{revoked:n.revoked}}function zt(e,t){let{type:r="vault",url:n,token:o,ttl:s}=e,i=()=>e.log,c=Kd(e.workload)?e.workload:void 0,d={},u=Dd(o),{lfv:l,websocket:h}=e,p=l?St({...l,log:l.log??i(),path:l.path??"/"},t):void 0,k=new Map,q=h?.url?.trim(),_=new Set,b=!1,j=!1;if(!l&&!n&&!q)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");if(Tt(s),n&&!o&&!c&&!l)i()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function U(){if(c){let y=await ki(c,d,i());return{...io,...Ci,...Vd(y)}}return{...u}}async function a(y){let O=M(y);if(c){let L=await ki(c,d,i());return{url:O,clientId:h?.clientId??c.clientId,token:L,header:"Authorization"}}return{url:O,clientId:h?.clientId,token:h?.token??o,header:h?.header??"X-Vault-Token"}}function w(y){if(!l)throw Error(`Vault LFV capability is not configured for path ${y}`);let O=k.get(y);if(O)return O;let L=St({...l,log:l.log??i(),path:y},t);return k.set(y,L),L}function S(y){if(!n)throw Error(`Vault HTTP capability is not configured for path ${y}`);return n}function M(y){if(!q)throw Error(`Vault websocket capability is not configured for path ${y}`);return q}async function F(y,O){let L=await a(typeof O.path==="string"?O.path:"/");return oo(L,y,O,i())}async function Z(y,O){let L=S(y),C;try{let m=await U(),f=new URL(`${L}/${y}`);if(typeof O?.kmsSlots==="number"&&Number.isInteger(O.kmsSlots)&&O.kmsSlots>=1)f.searchParams.set("kms_slots",String(O.kmsSlots));C=await fetch(f,{headers:m})}catch(m){throw new he(`Vault request failed from URL: ${L}/${y}`,y,void 0,"connection",{cause:m})}if(C.status!==200){if(C.status===404)throw new nt(y);let m=C.status===401||C.status===403,f=m?`Vault returned ${C.status} ${C.statusText} (auth error) from URL: ${L}/${y}`:`Vault returned invalid status, ${C.status}: '${C.statusText}' from URL: ${L}/${y}`;throw new he(f,y,C.status,m?"auth":"invalid_status")}try{let f=(await Rt(C,{log:i(),operation:"vault.secret.read",redact:!0})).data;if(!f?.metadata||!("data"in f))throw Error("Missing vault secret data");let E=f.metadata.created_time??f.metadata.created;return{data:f.data,metadata:{path:typeof f.metadata.path==="string"?f.metadata.path:y,version:typeof f.metadata.version==="number"?f.metadata.version:0,created:E instanceof Date?E:typeof E==="string"?new Date(E):new Date,...wt(f.metadata)?{contentType:wt(f.metadata)}:{}}}}catch(m){throw new he("Error retrieving secret",y,void 0,"invalid_payload",{cause:m})}}async function Y(y,O){let L=await a(y);return so(L,y,i(),O?.kmsSlots)}async function ee(y){let O=S(y),L=`${gr(O)}/metadata/${y}`,C=await U(),m=await fetch(L,{headers:C});if(m.status!==200)throw new he(`Vault getMetadata failed (${m.status}) for ${y}`,y,m.status,"invalid_status");let f=await Rt(m,{log:i(),operation:"vault.metadata.read",redact:!0}).catch(()=>null);if(!f?.metadata||typeof f.metadata!=="object")throw new he(`Vault getMetadata returned invalid payload for ${y}`,y,m.status,"invalid_payload");return f.metadata}async function ae(y,O,L){let C=S(O),m=`${gr(C)}/${y}/${O}`,f=await U(),E=await fetch(m,{method:"POST",headers:f,body:JSON.stringify({reason:L?.reason,severity:L?.severity,incident_ref:L?.incidentRef})});if(E.status!==200&&E.status!==202&&E.status!==204)throw new he(`Vault ${y} failed (${E.status}) for ${O}`,O,E.status,"invalid_status")}async function oe(y,O){if(l)return await w(y).getFullSecret(y,O);if(n)return await Z(y,O);return await Y(y,O)}async function K(y,O,L){if(!Nd(O))throw Error(`putSecret requires an object value for vault source at path ${y}`);if(l){await w(y).putSecret(y,O,L);return}if(n){let C=S(y),m=await U();if(m["X-Ionite-Mime-Type"]=L.contentType.mimeType,m["X-Ionite-Secret-Format"]=L.contentType.format,L.contentType.schemaUrl)m["X-Ionite-Schema-Url"]=L.contentType.schemaUrl;if(L.contentType.typeId)m["X-Ionite-Secret-Type"]=L.contentType.typeId;let f=await fetch(`${C}/${y}`,{method:"POST",headers:m,body:JSON.stringify(O)});if(f.status!==200&&f.status!==201&&f.status!==204)throw new he(`Vault putSecret failed (${f.status}) for ${y}`,y,f.status,"invalid_status");return}await F("put_secret",{path:y,data:O,content_type:qr(L.contentType)})}async function Q(y,O){if(l){await w(y).deleteSecret(y,O);return}if(n){let L=S(y),C=await U(),m=await fetch(`${L}/${y}`,{method:"DELETE",headers:C});if(m.status!==200&&m.status!==202&&m.status!==204)throw new he(`Vault deleteSecret failed (${m.status}) for ${y}`,y,m.status,"invalid_status");return}await F("delete_secret",{path:y})}async function V(y,O){if(l)return await w(y).listPaths(y,O);if(n){let m=`${S(y)}/${y}`,f=async(J)=>{let G=await U();if(J==="LIST")return fetch(m,{method:"LIST",headers:G});let de=m.includes("?")?"&":"?";return fetch(`${m}${de}list=true`,{method:"GET",headers:G})},E=await f("LIST");if(E.status===405||E.status===501)E=await f("GET");if(E.status!==200)throw new he(`Vault listPaths failed (${E.status}) for ${y}`,y,E.status,"invalid_status");let A=await Rt(E,{log:i(),operation:"vault.paths.list",redact:!0}).catch(()=>null),B;if(A&&typeof A==="object"){let J=A,G=J.data;if(G&&typeof G==="object")B=G.keys;else B=J.keys}if(!Array.isArray(B))throw new he(`Vault listPaths returned an unexpected response for ${y}`,y,void 0,"invalid_payload");return B.filter((J)=>typeof J==="string")}let L=await F("list_paths",{path:y});if(!Array.isArray(L.items))throw Error(`Vault websocket list_paths returned invalid payload for ${y}`);return L.items.filter((C)=>typeof C==="string")}async function D(y,O){if(l)return await w(y).exists(y,O);if(n){let C=S(y),m=await U(),f=await fetch(`${C}/${y}`,{headers:m});if(f.status===200)return!0;if(f.status===404)return!1;if(f.status===401||f.status===403)throw new he(`Vault exists failed (${f.status}) for ${y} (auth error)`,y,f.status,"auth");throw new he(`Vault exists failed (${f.status}) for ${y}`,y,f.status,"invalid_status")}let L=await F("exists",{path:y});if(typeof L.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${y}`);return L.exists}async function te(y,O,L){if(l){await w(y).requestRotate(y,O,L);return}if(n){await ae("rotate/request",y,O);return}await F("request_rotate",{path:y,reason:O?.reason,severity:O?.severity,incident_ref:O?.incidentRef})}async function re(y,O,L){if(l){await w(y).requestRevoke(y,O,L);return}if(n){await ae("revoke/request",y,O);return}await F("request_revoke",{path:y,reason:O?.reason,severity:O?.severity,incident_ref:O?.incidentRef})}async function ie(y,O,L){if(l)return await w(y).parkKmsKey(y,O,L);if(n){let m=S(y),f=`${gr(m)}/kms/park/${y}`,E=await U(),A=await fetch(f,{method:"POST",headers:E,body:JSON.stringify({key_id:O.keyId,status:O.status,reason:O.reason})});if(A.status!==200&&A.status!==202)throw new he(`Vault kms/park failed (${A.status}) for ${y}`,y,A.status,"invalid_status");return bi(await Rt(A,{log:i(),operation:"vault.kms.park",redact:!0}).catch(()=>null),y,"http")}let C=await F("kms_park",{path:y,key_id:O.keyId,status:O.status,reason:O.reason});return bi(C,y,"websocket")}async function se(y,O,L){if(l)return await w(y).addKmsKeys(y,O,L);if(n){let m=S(y),f=`${gr(m)}/kms/add-keys/${y}`,E=await U(),A=await fetch(f,{method:"POST",headers:E,body:JSON.stringify({keys:O.keys})});if(A.status!==200&&A.status!==202)throw new he(`Vault kms/add-keys failed (${A.status}) for ${y}`,y,A.status,"invalid_status");return Ri(await Rt(A,{log:i(),operation:"vault.kms.add_keys",redact:!0}).catch(()=>null),y,"http")}let C=await F("kms_add_keys",{path:y,keys:O.keys});return Ri(C,y,"websocket")}async function ce(y,O,L){if(l)return await w(y).revokeKmsKey(y,O,L);if(n){let m=S(y),f=`${gr(m)}/kms/revoke-key/${y}`,E=await U(),A=await fetch(f,{method:"POST",headers:E,body:JSON.stringify({key_id:O.keyId,reason:O.reason})});if(A.status!==200&&A.status!==202)throw new he(`Vault kms/revoke-key failed (${A.status}) for ${y}`,y,A.status,"invalid_status");return Ti(await Rt(A,{log:i(),operation:"vault.kms.revoke_key",redact:!0}).catch(()=>null),y,"http")}let C=await F("kms_revoke_key",{path:y,key_id:O.keyId,reason:O.reason});return Ti(C,y,"websocket")}async function T(y,O){if(l)return await w(y).getMetadata(y,O);if(n)return await ee(y);let L=await F("read_metadata",{path:y});if(!L.metadata||typeof L.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${y}`);return L.metadata}async function g(y,O,L){if(!s)throw new qe(r,y);return ot({getFullSecret:Z},y,O,s,i(),L,{onHealth:(C)=>{b=!C}})}async function P(y,O,L){let C=await a(y);return hi(C,y,O,L,i(),{onHealth:(m)=>{j=!m}})}function I(y){let O=()=>{if(_.delete(O))y()};return _.add(O),O}function R(){if(p?.isAvailable?.()===!1)return!0;for(let y of k.values())if(y.isAvailable?.()===!1)return!0;return!1}let W={type:r,isAvailable:()=>!b&&!j&&!R(),get:(y,O)=>He(()=>oe(y,O)),getFullSecret:oe,getSecret:async(y,O)=>(await oe(y,O)).data,putSecret:K,deleteSecret:Q,listPaths:V,exists:D,requestRotate:te,requestRevoke:re,parkKmsKey:ie,addKmsKeys:se,revokeKmsKey:ce,getMetadata:T,subscribe:async(y,O,L)=>{let C;if(q)C=await P(y,O,L);else if(l)C=await w(y).subscribe(y,O,L);else C=await g(y,O,L);return I(C)},...p?{subscribeEvents:(y)=>I(p.subscribeEvents?.(y)??(()=>{}))}:q?{subscribeEvents:(y)=>{let O,L=!1;return a("/").then((C)=>wi(C,y,i())).then((C)=>{if(L){C();return}O=C}).catch((C)=>{i()?.warn("Vault websocket event subscription failed",C)}),I(()=>{L=!0,O?.()})}}:{},close:()=>{for(let O of Array.from(_))try{O()}catch(L){i()?.warn("Vault source close: failed to release a subscription",L)}_.clear();let y=(O)=>{if(!O?.close)return;try{Promise.resolve(O.close()).catch((L)=>{i()?.warn("Vault source close: LFV close failed",L)})}catch(L){i()?.warn("Vault source close: LFV close failed",L)}};for(let O of k.values())y(O);y(p),k.clear(),d.token=void 0,d.expiresAt=void 0},get log(){return e.log},set log(y){e.log=y}};if(p)W.isDeliveryRequest=(y)=>p.isDeliveryRequest(y),W.isEventsRequest=(y)=>p.isEventsRequest(y),W.handleDelivery=(y)=>p.handleDelivery(y),W.handleEvents=(y)=>p.handleEvents(y),Object.defineProperties(W,{deliveryPath:{value:p.deliveryPath,enumerable:!0},eventsPath:{value:p.eventsPath,enumerable:!0},callbackKey:{value:p.callbackKey,enumerable:!0},trustId:{value:p.trustId,enumerable:!0}});return W}class Qr extends Error{constructor(e,t){super(e);this.name="AzureKeyVaultError",this.status=t,Object.setPrototypeOf(this,Qr.prototype)}}function Zr(e,t){if(!e||e.trim().length===0)throw Error(`Missing required Azure config: ${t}`);return e}function Gd(e){return e.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function ao(e,t){return`${e.replace(/\/+$/g,"")}/${t.replace(/^\/+/g,"")}`}function Hd(e){try{let r=new URL(e).pathname.split("/").filter(Boolean),n=r.indexOf("secrets");if(n===-1)return;return r[n+2]||void 0}catch{return}}function Jd(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function en(e){let t=e.apiVersion??"7.4",r=e.scope??"https://vault.azure.net/.default",n=e.secretNameTransform??Gd,o=e.authMethod,s="/var/run/secrets/azure/tokens/azure-identity-token",i=e.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",c=e.vaultUrl??(e.vaultName?`https://${e.vaultName}.vault.azure.net`:void 0)??void 0,d=Zr(c,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function u(K){try{return await zd(K),!0}catch{return!1}}let l,h,p=!1;async function k(K){let{entraTenantId:Q,clientId:V}=e;if(!Q)throw Error("Workload identity requires entraTenantId");if(!V)throw Error("Workload identity requires clientId");if(!await u(i))throw Error(`Federated token file not found at ${i}`);let D=(await Fd(i,"utf8")).trim();if(!D)throw Error("Federated token file was empty");let te=`https://login.microsoftonline.com/${encodeURIComponent(Q)}/oauth2/v2.0/token`,re=new URLSearchParams({client_id:V,grant_type:"client_credentials",scope:r,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:D}),ie=await fetch(te,{method:"POST",headers:{...Bt,...Ii},body:re});if(ie.status!==200)throw Error(`Azure workload identity token exchange returned ${ie.status} ${ie.statusText}`);let se=await Xr(ie,{redact:!0});if(!se?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:se.access_token,expiresAtMs:K+(se.expires_in??0)*1000},se.access_token}async function q(K){let Q=e.imdsApiVersion??"2018-02-01",V="https://vault.azure.net",D=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(D.searchParams.set("api-version",Q),D.searchParams.set("resource","https://vault.azure.net"),e.managedIdentityClientId)D.searchParams.set("client_id",e.managedIdentityClientId);let te=await fetch(D.toString(),{headers:{Metadata:"true",...Bt}});if(te.status!==200)throw Error(`Azure IMDS token endpoint returned ${te.status} ${te.statusText}`);let re=await Xr(te,{redact:!0});if(!re?.access_token)throw Error("IMDS token response missing access_token");let ie=K+60000;if(re.expires_on){let se=Number.parseInt(re.expires_on,10);if(Number.isFinite(se)&&se>0)ie=se*1000;else{let ce=Date.parse(re.expires_on);if(Number.isFinite(ce))ie=ce}}else if(re.expires_in){let se=Number.parseInt(re.expires_in,10);if(Number.isFinite(se)&&se>0)ie=K+se*1000}return l={accessToken:re.access_token,expiresAtMs:ie},re.access_token}async function _(K){let Q=Zr(e.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),V=Zr(e.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),D=Zr(e.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),te=`https://login.microsoftonline.com/${encodeURIComponent(Q)}/oauth2/v2.0/token`,re=new URLSearchParams({client_id:V,client_secret:D,grant_type:"client_credentials",scope:r}),ie=await fetch(te,{method:"POST",headers:{...Bt,...Ii},body:re});if(ie.status!==200)throw Error(`Azure token endpoint returned ${ie.status} ${ie.statusText}`);let se=await Xr(ie,{redact:!0});if(!se?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:se.access_token,expiresAtMs:K+(se.expires_in??0)*1000},se.access_token}async function b(){let K=Date.now();if(l&&l.expiresAtMs-60000>K)return l.accessToken;if(h)return h;h=(async()=>{if(o==="workload_identity")return await k(K);if(o==="managed_identity")return await q(K);if(o==="client_secret")return await _(K);if(await u(i))try{return await k(K)}catch{}try{return await q(K)}catch{}return await _(K)})();try{return await h}finally{h=void 0}}async function j(K){let Q=await b(),V=ao(d,`/secrets/${encodeURIComponent(K)}?api-version=${encodeURIComponent(t)}`),D=await fetch(V,{headers:{Authorization:`Bearer ${Q}`,...Bt}});if(D.status!==200)throw new Qr(`Key Vault request failed (${D.status})`,D.status);return await Xr(D,{redact:!0})}async function U(K,Q){let V=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${V}`:V,te=await j(D),re=te.value;try{re=JSON.parse(te.value)}catch{}let ie=te.attributes?.created?te.attributes.created*1000:void 0,se=Hd(te.id),ce=te.contentType?Wr({mimeType:te.contentType,format:te.tags?.["ionite-format"],schemaUrl:te.tags?.["ionite-schema-url"],typeId:te.tags?.["ionite-type-id"]}):void 0;return{data:re,metadata:{path:K,version:Number.parseInt(se??"",10)||0,created:ie?new Date(ie):new Date,...ce?{contentType:ce}:{}}}}async function a(K,Q,V){if(!Jd(Q))throw Error(`putSecret requires an object value for azure source at path ${K}`);let D=n(K),te=e.secretNamePrefix?`${e.secretNamePrefix}${D}`:D,re=await b(),ie=ao(d,`/secrets/${encodeURIComponent(te)}?api-version=${encodeURIComponent(t)}`),se=JSON.stringify({value:JSON.stringify(Q),contentType:V.contentType.mimeType,tags:{"ionite-format":V.contentType.format,...V.contentType.schemaUrl?{"ionite-schema-url":V.contentType.schemaUrl}:{},...V.contentType.typeId?{"ionite-type-id":V.contentType.typeId}:{}}}),ce=await fetch(ie,{method:"PUT",headers:{Authorization:`Bearer ${re}`,...Bd,...Bt},body:se});if(ce.status!==200&&ce.status!==201)throw Error(`Key Vault putSecret failed (${ce.status}) for ${K}`)}async function w(K,Q){let V=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${V}`:V,te=await b(),re=ao(d,`/secrets/${encodeURIComponent(D)}?api-version=${encodeURIComponent(t)}`),ie=await fetch(re,{method:"DELETE",headers:{Authorization:`Bearer ${te}`,...Bt}});if(ie.status!==200&&ie.status!==202&&ie.status!==204)throw Error(`Key Vault deleteSecret failed (${ie.status}) for ${K}`)}async function S(K,Q){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${K}`)}async function M(K,Q){try{return await U(K),!0}catch(V){if(V instanceof Qr&&V.status===404)return!1;throw V}}async function F(K,Q,V){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${K}`)}async function Z(K,Q,V){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${K}`)}async function Y(K){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${K}`)}async function ee(K){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${K}`)}async function ae(K){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${K}`)}async function oe(K,Q){let V=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${V}`:V,te=await j(D),re=te.contentType?Wr({mimeType:te.contentType,format:te.tags?.["ionite-format"],schemaUrl:te.tags?.["ionite-schema-url"],typeId:te.tags?.["ionite-type-id"]}):void 0;return{id:te.id,...re?{content_type:re}:{},...te.attributes??{}}}return{type:e.type,isAvailable:()=>!p,get:(K,Q)=>He(()=>U(K,Q)),getFullSecret:U,getSecret:async(K,Q)=>(await U(K,Q)).data,putSecret:a,deleteSecret:w,listPaths:S,exists:M,requestRotate:F,requestRevoke:Z,parkKmsKey:Y,addKmsKeys:ee,revokeKmsKey:ae,getMetadata:oe,subscribe:(K,Q,V)=>{if(!e.ttl)throw new qe("azure",K);return Tt(e.ttl),ot({getFullSecret:U},K,Q,e.ttl,void 0,V,{onHealth:(D)=>{p=!D}})},close:()=>{l=void 0,h=void 0,p=!1}}}var co=Symbol("ion.secretsSourceState");function Xd(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${n}`)};return{type:"dev",get:(r,n)=>He(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[co]:"unavailable"}}function Pi(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${n}`)};return{type:"dev",get:(r,n)=>He(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[co]:"removed"}}function Zd(e){return e.type==="vault"&&e.lfv!=null}function Qd(e,t,r,n){if(!Zd(t))return;if(r||n)return;throw Error(`Secrets source "${e}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function el(e,t,r){if(t.type==="vault")return zt(t,r);if(t.type==="azure")return en(t);if(t.type==="aws"||t.type==="gcp"||t.type==="dev")throw Error(`Secrets source "${e}" uses type "${t.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${e}"`)}function tl(e,t){let r=(n)=>{t.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:n instanceof Error?n.message:String(n)})};try{Promise.resolve(e.close?.()).catch(r)}catch(n){r(n)}}function rl(e){let t=new Map,r=new Map,n=new Map;for(let[o,s]of Object.entries(e)){if(!Oi(s))continue;let i=t.get(s.deliveryPath);if(i)throw Error(`LFV delivery path "${s.deliveryPath}" is claimed by both secrets sources "${i}" and "${o}"; delivery paths must be globally unique.`);t.set(s.deliveryPath,o);let c=r.get(s.eventsPath);if(c)throw Error(`LFV events path "${s.eventsPath}" is claimed by both secrets sources "${c}" and "${o}"; events paths must be globally unique.`);r.set(s.eventsPath,o);let d=n.get(s.callbackKey);if(d&&d.trustId!==s.trustId)throw Error(`LFV callback key "${s.callbackKey}" is claimed by secrets sources "${d.sourceName}" and "${o}" with different verify JWKS; a callback path must use a single trust key.`);if(!d)n.set(s.callbackKey,{sourceName:o,trustId:s.trustId})}}function Oi(e){return typeof e.isDeliveryRequest==="function"&&typeof e.isEventsRequest==="function"&&typeof e.handleDelivery==="function"&&typeof e.handleEvents==="function"}function nl(e,t,r){let n={...t},o=[],s=(c)=>{if(n[c]!==void 0)delete n[c],o.push(c)};s("token"),s("clientSecret"),s("workload");let i=n.websocket;if(i&&typeof i==="object"&&i.token!==void 0){let c={...i};delete c.token,n.websocket=c,o.push("websocket.token")}if(o.length>0)r.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:e,"ion.droppedFields":o});return n}function ol(e,t,r){let n={name:e,type:t.type,ready:t.isReady?.()??!0};if(r?.type==="dev")n.url=r.ioniteUrl;if(r?.type==="vault")n.url=r.url,n.clientId=r.workload?.clientId??r.lfv?.clientId??r.websocket?.clientId;if(r?.type==="aws")n.url=r.webhookUrl;if(r?.type==="azure")n.url=r.vaultUrl,n.clientId=r.clientId??r.managedIdentityClientId,n.authMethod=r.authMethod;return ve(n)}function sl(e,t,r){let n={},o=new Set([...Object.keys(t??{}),...Object.keys(r??{})]);for(let s of o){let i=t?.[s],c=r?.[s],d=c?nl(s,c,e):void 0;n[s]={...i??{},...d??{}}}return n}function tn(e){return e[co]??"available"}function il(e,t,r){let n=t,o=new Set,s=new Set,i=new Set,c=Ke(r,`Secrets source "${e}"`),d=()=>tn(n)==="available",u=me(`Secrets source "${e}"`,d),l=(a,w,S)=>Error(`${a} timed out after ${S}ms waiting for source "${e}" to be configured by the ConfigSource at path ${w}`),h=(a,w)=>Error(`${a} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${w}`),p=(a,w,S)=>{let M=tn(n);if(M==="available")return Promise.resolve(n);if(M==="removed")return Promise.reject(h(a,w));return new Promise((F,Z)=>{let Y={method:a,path:w,resolve:(ae)=>{if(Y.timeout)clearTimeout(Y.timeout);i.delete(Y),F(ae)},reject:(ae)=>{if(Y.timeout)clearTimeout(Y.timeout);i.delete(Y),Z(ae)}},ee=S?.timeout;if(typeof ee==="number"&&ee>0)Y.timeout=setTimeout(()=>{Y.reject(l(a,w,ee))},ee);i.add(Y)})},k=(a)=>{for(let w of Array.from(i))w.resolve(a)},q=()=>{for(let a of Array.from(i))a.reject(h(a.method,a.path))},_=async(a,w=!1)=>{let S=a.guard.next();if(a.unsubscribe?.(),a.unsubscribe=void 0,a.closed)return;if(tn(n)==="unavailable"&&a.options?.mode!=="wait"){if(w)throw Error(`subscribe is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${a.path}`);return}try{let F=await(a.options?.mode==="wait"?await p("subscribe",a.path,a.options):n).subscribe(a.path,(Z)=>{if(!a.closed)a.onChange(Z)},a.options);if(a.closed||!a.guard.isCurrent(S)){F?.();return}a.unsubscribe=F}catch(M){if(w)throw M;if(Dr(M)){r.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:e,path:a.path});return}r.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:e,path:a.path,error:M instanceof Error?M.message:String(M)})}},b=(a,w=!1)=>{if(a.unsubscribe?.(),a.unsubscribe=void 0,a.closed)return;if(!n.subscribeEvents){if(w)throw Error(`Secrets source "${e}" does not support lifecycle event subscriptions`);return}a.unsubscribe=n.subscribeEvents((S)=>{if(!a.closed)a.listener(S)})},j={get type(){return n.type},beforeChange:c.beforeChange,afterChange:c.afterChange,isAvailable:()=>d()&&(n.isAvailable?.()??!0),isReady:u.isReady,ready:u.ready,get:(a,w)=>He(async()=>(await p("get",a,w)).getFullSecret(a,w)),getFullSecret:async(a,w)=>(await p("getFullSecret",a,w)).getFullSecret(a,w),getSecret:async(a,w)=>(await p("getSecret",a,w)).getSecret(a,w),putSecret:async(a,w,S)=>(await p("putSecret",a,S)).putSecret(a,w,S),subscribe:async(a,w,S)=>{let M={path:a,onChange:w,options:S,closed:!1,guard:Br()};o.add(M);try{await _(M,!0)}catch(F){throw o.delete(M),F}return()=>{M.closed=!0,M.guard.next(),o.delete(M),M.unsubscribe?.(),M.unsubscribe=void 0}},subscribeEvents:(a)=>{let w={listener:a,closed:!1};s.add(w);try{b(w,!0)}catch(S){throw s.delete(w),S}return()=>{w.closed=!0,s.delete(w),w.unsubscribe?.(),w.unsubscribe=void 0}},deleteSecret:async(a,w)=>(await p("deleteSecret",a,w)).deleteSecret(a,w),listPaths:async(a,w)=>(await p("listPaths",a,w)).listPaths(a,w),exists:async(a,w)=>(await p("exists",a,w)).exists(a,w),requestRotate:async(a,w,S)=>(await p("requestRotate",a,S)).requestRotate(a,w,S),requestRevoke:async(a,w,S)=>(await p("requestRevoke",a,S)).requestRevoke(a,w,S),parkKmsKey:async(a,w,S)=>(await p("parkKmsKey",a,S)).parkKmsKey(a,w,S),addKmsKeys:async(a,w,S)=>(await p("addKmsKeys",a,S)).addKmsKeys(a,w,S),revokeKmsKey:async(a,w,S)=>(await p("revokeKmsKey",a,S)).revokeKmsKey(a,w,S),getMetadata:async(a,w)=>(await p("getMetadata",a,w)).getMetadata(a,w)},U=(a)=>{try{Promise.resolve(a.close?.()).catch((w)=>{r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:w instanceof Error?w.message:String(w)})})}catch(w){r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:w instanceof Error?w.message:String(w)})}};return{api:j,update(a){if(a===n)return;let w=n;c.emitBefore(),n=a;let S=tn(a);if(S==="available")k(a);else if(S==="removed")q();u.refresh();for(let M of o)_(M);for(let M of s)b(M);U(w),c.emitAfter()},close(){for(let a of o)a.closed=!0,a.guard.next(),a.unsubscribe?.(),a.unsubscribe=void 0;o.clear();for(let a of s)a.closed=!0,a.unsubscribe?.(),a.unsubscribe=void 0;s.clear(),q(),u.settle(),U(n)}}}function Ei(e,t=new Map){let r=new Map,n=new Map,o=new Map,s,i=!1,c=new Map,d=Ke(e,"Secrets"),u=!1,l=()=>{for(let a of r.keys()){let w=c.get(a);if(w&&w.api.isReady?.()===!1)return!1}return!0},h=me("Secrets module",()=>u&&l()),p=(a,w)=>ol(a,w,o.get(a)),k=(a)=>{let w=c.get(a);if(w)return w;let S=il(a,r.get(a)??Pi(a),e);if(Object.defineProperty(S.api,"describe",{value:()=>p(a,S.api),enumerable:!1,configurable:!0}),c.set(a,S),!(a in U))Object.assign(U,{[a]:S.api});return S},q=(a)=>{let w=c.get(a)?.api;if(w)return w;throw e.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:a}),Error(`Secrets source "${a}" is not configured`)},_=()=>Array.from(r.values()).filter(Oi),b=(a)=>_().find((w)=>w.isDeliveryRequest(a)),j=(a)=>_().find((w)=>w.isEventsRequest(a)),U;return U={describe:()=>({module:"secrets",active:u,ready:h.isReady(),sources:Array.from(r.keys(),(a)=>p(a,k(a).api))}),get config(){return Object.fromEntries(Array.from(r.keys(),(a)=>[a,k(a).api]))},beforeChange:d.beforeChange,afterChange:d.afterChange,isReady:h.isReady,isAvailable:()=>{for(let a of c.values()){if(a.api.isReady?.()===!1)continue;if(a.api.isAvailable?.()===!1)return!1}return!0},ready:h.ready,listSecretsSources:()=>Array.from(r.keys()),getSecretsSource:(a)=>r.has(a)?k(a).api:q(a),get:(a,w,S)=>U.getSecretsSource(a).get(w,S),getSecret:(a,w,S)=>U.getSecretsSource(a).getSecret(w,S),getFullSecret:(a,w,S)=>U.getSecretsSource(a).getFullSecret(w,S),putSecret:(a,w,S,M)=>U.getSecretsSource(a).putSecret(w,S,M),deleteSecret:(a,w,S)=>U.getSecretsSource(a).deleteSecret(w,S),listPaths:(a,w,S)=>U.getSecretsSource(a).listPaths(w,S),exists:(a,w,S)=>U.getSecretsSource(a).exists(w,S),requestRotate:(a,w,S,M)=>U.getSecretsSource(a).requestRotate(w,S,M),requestRevoke:(a,w,S,M)=>U.getSecretsSource(a).requestRevoke(w,S,M),parkKmsKey:(a,w,S,M)=>U.getSecretsSource(a).parkKmsKey(w,S,M),addKmsKeys:(a,w,S,M)=>U.getSecretsSource(a).addKmsKeys(w,S,M),revokeKmsKey:(a,w,S,M)=>U.getSecretsSource(a).revokeKmsKey(w,S,M),getMetadata:(a,w,S)=>U.getSecretsSource(a).getMetadata(w,S),subscribe:(a,w,S,M)=>U.getSecretsSource(a).subscribe(w,S,M),isLfvDeliveryRequest:(a)=>b(a)!==void 0,isLfvEventsRequest:(a)=>j(a)!==void 0,handleLfvDelivery:async(a)=>{let w=b(a);if(!w)return ye();return w.handleDelivery(a)},handleLfvEvents:async(a)=>{let w=j(a);if(!w)return ye();return w.handleEvents(a)}},{update(a,w,S,M,F){let Z=a!==void 0||w!==void 0;if(!Z&&!u&&c.size===0)return;let Y=sl(e,a,w),ee=F===!0,ae=M!==s,oe=ee!==i,K=new Map,Q=new Map,V=[];try{for(let[D,te]of Object.entries(Y)){let re=Yd(te),ie=r.get(D);if(ie&&n.get(D)===re&&!ae&&!oe){K.set(D,ie),Q.set(D,re);continue}let se;if(!te.type)se=Xd(D);else{if(S?.validateSourceConfig?.(D,te),t.has(D)&&a?.[D])e.warn(`RemoteConfig secrets source "${D}" is superseded by the framework LFV bootstrap source.`);if(!t.has(D))Qd(D,te,M,ee),se=el(D,te,M),V.push(se);else se=t.get(D)}K.set(D,se),Q.set(D,re)}rl(Object.fromEntries(K))}catch(D){for(let te of V)tl(te,e);throw D}d.emitBefore(),u=Z,s=M,i=ee;for(let[D,te]of K)r.set(D,te),n.set(D,Q.get(D)),o.set(D,Y[D]),k(D).update(te);for(let[D,te]of c){if(K.has(D))continue;r.delete(D),n.delete(D),o.delete(D),te.update(Pi(D))}return h.refresh(),d.emitAfter(),U},close(){for(let a of c.values())a.close();c.clear(),r.clear(),n.clear(),o.clear(),s=void 0,u=!1,h.settle()}}}function uo(e,t){let r=t.ttlMs,n=Math.max(1,Math.floor(t.maxEntries)),o=new Map,s=()=>Date.now();function i(){while(o.size>n){let d=o.keys().next().value;if(d===void 0)break;o.delete(d)}}function c(d,u){o.delete(d),o.set(d,{session:u,expiresAt:s()+r}),i()}return{capabilities:e.capabilities,async create(d){await e.create(d)},async get(d){let u=o.get(d);if(u){if(u.expiresAt>s())return o.delete(d),o.set(d,u),u.session;o.delete(d)}let l=await e.get(d);if(l)c(d,l);return l},async update(d,u){await e.update(d,u),o.delete(d)},async delete(d){await e.delete(d),o.delete(d)}}}import{deepEqualPlain as Ai,IoniteError as Re,trimTrailingSlash as It,validationFailureResponse as al}from"@ionite/core";import{getCachedVerificationKey as cl}from"@ionite/core/server";function Li(){let e,t=me("tm module",()=>e!==void 0),r=()=>{if(!e)throw new Re("Tenant Management is not ready",{status:503});return e},n={describe:()=>e?.describe()??{module:"tm",active:!1,ready:!1,enabled:!1},isReady:t.isReady,ready:t.ready,handler:(o)=>e?e.handler(o):Promise.resolve(Response.json({error:"Tenant Management is not ready"},{status:503})),getTenant:(o)=>r().getTenant(o),recordConsent:(o)=>r().recordConsent(o)};return{handle:n,update(o,s){return e=o,t.refresh(),s?n:void 0}}}var ul=600,dl=30;function xi(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),r=t.padEnd(Math.ceil(t.length/4)*4,"=");return Uint8Array.from(atob(r),(n)=>n.charCodeAt(0)).buffer}function _i(e){return JSON.parse(new TextDecoder().decode(new Uint8Array(xi(e))))}function Ui(e){return Array.isArray(e)&&e.length>0&&e.every((t)=>typeof t==="string")}function ll(e){if(!e||typeof e!=="object")throw new Re("Invalid staged integration handle",{status:400});let t=e;if(typeof t.iss!=="string"||!(typeof t.aud==="string"||Ui(t.aud))||typeof t.iat!=="number"||typeof t.exp!=="number"||typeof t.jti!=="string"||typeof t.ioniteId!=="string"||typeof t.productId!=="string"||typeof t.applicationId!=="string")throw new Re("Invalid staged integration claims",{status:400});return t}function fl(e,t){return Array.isArray(e)?e.includes(t):e===t}async function Ct(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return Array.from(new Uint8Array(t),(r)=>r.toString(16).padStart(2,"0")).join("")}async function rn(e,t){let r=await Mi(e,t),n=ll(r),o=Math.floor(Date.now()/1000),s=t.consentTtlSeconds??ul;if(n.iat>o+60||n.exp-n.iat>s)throw new Re("Staged integration handle lifetime is invalid",{status:401});return{handle:e,ioniteName:n.ioniteName??t.ionite.name,ioniteId:n.ioniteId,productId:n.productId,applicationId:n.applicationId,issuedAt:new Date(n.iat*1000).toISOString(),expiresAt:new Date(n.exp*1000).toISOString(),requestId:n.jti,tenantHint:n.tenantHint}}async function Mi(e,t){let r=e.split(".");if(r.length!==3)throw new Re("Invalid staged integration handle",{status:400});let n=_i(r[0]);if(!n||typeof n!=="object")throw new Re("Invalid staged integration handle",{status:400});let{alg:o,kid:s}=n;if(o!=="RS256"||typeof s!=="string"||s.length===0)throw new Re("Unsupported staged integration signature",{status:400});let i=_i(r[1]);if(!i||typeof i!=="object")throw new Re("Invalid TM access token claims",{status:400});let c=i,d=await cl(t.ionite.jwksUri,s,"tm:RS256",(p)=>crypto.subtle.importKey("jwk",p,{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"]));if(!await crypto.subtle.verify({name:"RSASSA-PKCS1-v1_5"},d,xi(r[2]),new TextEncoder().encode(`${r[0]}.${r[1]}`)))throw new Re("Invalid staged integration signature",{status:401});let l=Math.floor(Date.now()/1000),h=c.azp??c.client_id;if(typeof c.iss!=="string"||c.iss.replace(/\/+$/,"")!==t.ionite.issuer.replace(/\/+$/,"")||!(typeof c.aud==="string"||Ui(c.aud))||!fl(c.aud,t.ionite.audience)||h!==t.ionite.clientId||typeof c.exp!=="number"||c.exp<=l)throw new Re("TM access token is not trusted or has expired",{status:401});return c}function Wi(e){try{return It(new URL(e,"http://dummy").pathname)}catch{let t=e.startsWith("/")?e:`/${e}`;return It(t)}}function pl(e,t){let r=new URL(e.url);return new URL(`/${encodeURIComponent(t)}/`,r.origin).toString()}function ml(e,t){let r=Wi(t),n=It(e);if(n===r)return null;if(!n.startsWith(`${r}/`))return null;let o=n.slice(r.length+1);if(!o||o.includes("/"))return null;return decodeURIComponent(o)}function nn(e){return e==="pending"||e==="processing"||e==="completed"||e==="failed"||e==="action_required"}function gl(e){if(!nn(e.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if(e.status==="completed"){if(!e.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:e.tenantUrl,status:"completed"},status:201}}if(e.status==="pending"||e.status==="processing")return{body:{tenantUrl:e.tenantUrl,status:e.status},status:202};if(e.status==="action_required"){if(!e.actionUrl||!e.requestToken||!e.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:e.actionUrl,requestToken:e.requestToken,expiresAt:e.expiresAt},status:200}}return{body:{tenantUrl:e.tenantUrl,status:"failed",error:e.error??"Tenant provisioning failed"},status:409}}function qi(e,t,r){let n=r.validators.tenant.createTenantRequest,o=r.validators.tenant.updateTenantRequest;async function s(a,w){if(!w)return;try{await w()}catch(S){e.log.warn(`Tenant ${a} lifecycle hook failed`,{"ion.operation":`tm.tenant_${a}`,"ion.outcome":"error",error:S instanceof Error?S.message:String(S)})}}async function i(a,w){let{integration:S,configLocator:M}=a;if(S?.status!=="consented"||S.handoverAppliedAt||!M)return a;try{if(!(await r.store.getIon(a.id))?.isReady())return a;return await r.onHandoverApplied?.({tenant:a,previousLocator:w,destinationLocator:M}),await u().setIntegration(a.id,{...S,version:S.version+1,handoverAppliedAt:new Date().toISOString()},{expectedHandleHash:S.handleHash,expectedVersion:S.version})??await r.store.get(a.id)??a}catch(F){return e.log.error("Tenant config handover observation failed; the handover stays pending until a later GET succeeds",{"ion.operation":"tm.handover.observe","ion.outcome":"error",tenantId:a.id,error:F instanceof Error?F.message:String(F)},F),a}}function c(a,w){let S=(M)=>new URL(M,w).toString();return{readyzUrl:S(a.readyzUrl),capabilitiezUrl:S(a.capabilitiezUrl),sso:{loginUrl:S(a.sso.loginUrl),userUrl:S(a.sso.userUrl),logoutUrl:S(a.sso.logoutUrl),logoutBackChannelUrl:S(a.sso.logoutBackChannelUrl),refreshUrl:S(a.sso.refreshUrl),callbackUrl:S(a.sso.callbackUrl)},workload:{validateUrl:S(a.workload.validateUrl),jwksUrl:S(a.workload.jwksUrl)},iam:{basePath:S(a.iam.basePath),usersUrl:S(a.iam.usersUrl),groupsUrl:S(a.iam.groupsUrl),workloadsUrl:S(a.iam.workloadsUrl),customersUrl:S(a.iam.customersUrl)},ciam:{magicLinkUrl:S(a.ciam.magicLinkUrl),magicLinkLoginUrl:S(a.ciam.magicLinkLoginUrl),customerUrl:S(a.ciam.customerUrl),customerLoginUrl:S(a.ciam.customerLoginUrl),customerCallbackUrl:S(a.ciam.customerCallbackUrl),customerProvidersUrl:S(a.ciam.customerProvidersUrl),logoutUrl:S(a.ciam.logoutUrl)}}}function d(a,w){let S=r.tenantIonBasePath?.(a);if(!S)return;let M=new URL(w.url).origin,F=c(Fe(S),M);return{callbackUrl:F.sso.callbackUrl,ionUrls:F}}function u(){if(!r.store.setIntegration||!r.store.getByIntegrationHandleHash)throw new Re("Tenant integration requires store.setIntegration and store.getByIntegrationHandleHash",{status:501});return{setIntegration:r.store.setIntegration.bind(r.store),getByIntegrationHandleHash:r.store.getByIntegrationHandleHash.bind(r.store)}}async function l(a){let w=a.headers.get("Authorization");if(!w?.startsWith("Bearer "))return Response.json({error:"Unauthorized"},{status:401});try{await Mi(w.slice(7),t);return}catch{return Response.json({error:"Unauthorized"},{status:401})}}function h(a){let{integration:w,...S}=a;if(!w)return S;return{...S,integration:{ioniteName:w.ioniteName,ioniteId:w.ioniteId,applicationId:w.applicationId,productId:w.productId,status:w.status,expiresAt:w.expiresAt,requestedAt:w.requestedAt,decidedAt:w.decidedAt}}}async function p(a){let w=await a.json();if(!w||typeof w.handle!=="string"||w.handle.length===0)throw new Re("handle is required",{status:400});if(w.authorization!==void 0&&typeof w.authorization!=="string")throw new Re("authorization must be a string",{status:400});return{handle:w.handle,authorization:w.authorization}}async function k(a){if(a.method!=="GET")return rt(["GET"]);if(!r.onConnectRequest)return Response.json({error:"Tenant integration consent is not supported"},{status:501});let w=new URL(a.url).searchParams.get("handle");if(!w)return Response.json({error:"handle is required"},{status:400});let S=await rn(w,t),M=S.tenantHint?await r.store.get(S.tenantHint):void 0;if(S.tenantHint&&!M)return ye();if(M){if(M.ioniteId&&M.ioniteId!==S.ioniteId)return Response.json({error:"Tenant is bound to another ionite id"},{status:409});let F=u(),Z=await Ct(w),Y=M.integration;if(Y&&Y.handleHash!==Z&&Date.parse(Y.expiresAt)>Date.now())return Response.json({error:"Tenant already has an active integration request"},{status:409});if(!Y||Y.handleHash!==Z){if(!await F.setIntegration(M.id,{version:(Y?.version??0)+1,ioniteName:S.ioniteName,ioniteId:S.ioniteId,applicationId:S.applicationId,productId:S.productId,handleHash:Z,status:"consent_requested",expiresAt:S.expiresAt,redeemAttempts:0,requestedAt:new Date().toISOString()},{expectedHandleHash:Y?.handleHash??null,expectedVersion:Y?.version}))return Response.json({error:"Integration request changed concurrently"},{status:409})}}return r.onConnectRequest({request:a,ion:e,staged:S,tenant:M})}async function q(a){if(a.method!=="POST")return rt(["POST"]);let w=await l(a);if(w)return w;let{handle:S}=await p(a);await rn(S,t);let M=await Ct(S),F=u(),Z=await F.getByIntegrationHandleHash(M);if(!Z?.integration)return Response.json({status:"pending"},{status:202});let Y=Z.integration;if(Date.parse(Y.expiresAt)<=Date.now())return Response.json({status:"expired"},{status:410});if(Y.status==="consented"&&Y.consentRedeemedAt)return Response.json({status:"consumed"},{status:410});let ee=t.maxRedeemAttempts??dl;if(Y.redeemAttempts>=ee)return Response.json({status:"attempt_limit"},{status:429});let ae={...Y,version:Y.version+1,redeemAttempts:Y.redeemAttempts+1},oe=await F.setIntegration(Z.id,ae,{expectedHandleHash:M,expectedVersion:Y.version});if(!oe?.integration)return Response.json({status:"pending"},{status:409});if(oe.integration.status==="declined")return Response.json({status:"declined"},{status:200});if(oe.integration.status!=="consented")return Response.json({status:"pending"},{status:202});let K=crypto.randomUUID().replace(/-/g,"")+crypto.randomUUID().replace(/-/g,""),Q={...oe.integration,version:oe.integration.version+1,consentRedeemedAt:new Date().toISOString(),exportTokenHash:await Ct(K)};if(!await F.setIntegration(Z.id,Q,{expectedHandleHash:M,expectedVersion:oe.integration.version}))return Response.json({status:"consumed"},{status:409});return Response.json({status:"consented",tenantId:Z.id,authorization:K,expiresAt:Y.expiresAt})}async function _(a){if(a.method!=="POST")return rt(["POST"]);let w=await l(a);if(w)return w;if(!r.exportConfig)return Response.json({error:"Config export is not supported"},{status:501});let{handle:S,authorization:M}=await p(a);if(!M)return Response.json({error:"authorization is required"},{status:400});await rn(S,t);let F=await Ct(S),Z=u(),Y=await Z.getByIntegrationHandleHash(F),ee=Y?.integration;if(!Y||!ee||ee.status!=="consented"||ee.configExportedAt||!ee.exportTokenHash||ee.exportTokenHash!==await Ct(M))return Response.json({error:"Export authorization is invalid or consumed"},{status:401});if(Date.parse(ee.expiresAt)<=Date.now())return Response.json({error:"Export authorization expired"},{status:410});let ae=await r.exportConfig({tenant:Y}),oe={...ee,version:ee.version+1,configExportedAt:new Date().toISOString(),exportTokenHash:void 0};if(!await Z.setIntegration(Y.id,oe,{expectedHandleHash:F,expectedVersion:ee.version}))return Response.json({error:"Export authorization is already consumed"},{status:409});return Response.json(ae)}async function b(a){let w=await rn(a.handle,t),S=await r.store.get(a.tenantId);if(!S)throw new Re("Tenant not found",{status:404});if(w.tenantHint&&w.tenantHint!==S.id)throw new Re("Staged request is bound to another tenant",{status:409});if(S.ioniteId&&S.ioniteId!==w.ioniteId)throw new Re("Tenant is bound to another ionite id",{status:409});let M=await Ct(a.handle),F=S.integration;if(F?.status==="consented"&&F.handleHash!==M)throw new Re("A consented tenant cannot be rebound",{status:409});if(F&&F.handleHash!==M&&Date.parse(F.expiresAt)>Date.now())throw new Re("Tenant already has an active integration request",{status:409});let Z=new Date().toISOString(),Y={version:(F?.handleHash===M?F.version:0)+1,ioniteName:w.ioniteName,ioniteId:w.ioniteId,productId:w.productId,applicationId:w.applicationId,handleHash:M,status:a.decision,expiresAt:w.expiresAt,redeemAttempts:F?.handleHash===M?F.redeemAttempts:0,requestedAt:F?.handleHash===M?F.requestedAt:Z,decidedAt:Z,decidedBy:a.decidedBy},ee=await u().setIntegration(S.id,Y,{expectedHandleHash:F?.handleHash??null,expectedVersion:F?.version});if(!ee)throw new Re("Integration request changed; reload and try again",{status:409});return ee}async function j(a){let S=new URL(a.url).pathname,M=Wi(r.basePath),F=`${M}/integrations`;if(It(S)===`${F}/authorize`)return k(a);if(It(S)===`${F}/redeem`)return q(a);if(It(S)===`${F}/config-export`)return _(a);let Z=ml(S,r.basePath),Y=It(S)===M;if(!Y&&!Z)return ye();if(!["GET","PUT","POST","DELETE"].includes(a.method))return rt(["GET","PUT","POST","DELETE"]);if(a.method==="GET"&&Y&&Z==null)return ye();let ee=await l(a);if(ee)return ee;if(a.method==="GET"){if(Z==null)return ye();let ce=await r.store.get(Z),T=ce?await i(ce):void 0;if(!T)return ye();let g=d(T,a),P=h(T);return Response.json(g?{...P,...g}:P,{status:200})}if(a.method==="DELETE"){if(!Z)return ye();let ce=await r.store.get(Z);if(ce)await r.mirror?.purge(ce.id);if(await r.store.delete(Z),ce)await s("deleted",()=>r.onTenantDeleted?.({tenantId:ce.id}));return new Response(null,{status:204})}if(!Z&&a.method!=="POST")return ye();let ae;try{ae=await a.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let oe=a.method==="POST";if(!oe&&ae&&typeof ae==="object"&&Object.hasOwn(ae,"ioniteId"))return Response.json({error:"ioniteId cannot be changed"},{status:400});let K=oe?await n.validate(ae):await o.validate(ae);if(K.issues)return al(K.issues,oe?"Tenant create validation failed":"Tenant update validation failed");let Q=oe?K.value.id:Z;if(!Q)return ye();if(Z!=null&&K.value.id!=null&&K.value.id!==Z)return Response.json({error:"Path id must match body id"},{status:400});let V;if(oe){let ce=K.value,T=await r.store.getByIoniteId(ce.ioniteId);if(T)Q=T.id,V=T;else if(V=await r.store.get(Q),V)return Response.json({error:"tenant_id_taken",message:"The suggested App tenant id is already in use; retry with another id."},{status:409})}else V=await r.store.get(Q);if(V&&!nn(V.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let D=new Date,te=V??{},re;if(oe){let ce=K.value,T=ce,g=T.status,P=nn(g)?g:V?.status??"completed";re={...te,...ce,id:Q,ioniteId:ce.ioniteId,companyId:ce.companyId,companyName:ce.companyName,environmentType:ce.environmentType,configLocator:ce.configLocator,email:ce.email??V?.email,webhookUrl:ce.webhookUrl??V?.webhookUrl,callbackUrl:ce.callbackUrl??V?.callbackUrl,tenantUrl:T.tenantUrl??V?.tenantUrl,status:P,error:T.error??V?.error,actionUrl:T.actionUrl??V?.actionUrl,requestToken:T.requestToken??V?.requestToken,expiresAt:T.expiresAt??V?.expiresAt,createdAt:V?.createdAt??D,updatedAt:D}}else{let ce=K.value,T=ce,g=T.status,P=nn(g)?g:V?.status??"completed",{configLocator:I,...R}=ce;re={...te,...R,id:Q,companyId:ce.companyId??V?.companyId??"",companyName:ce.companyName??V?.companyName??"",environmentType:ce.environmentType??V?.environmentType??"DEV",email:ce.email??V?.email,webhookUrl:ce.webhookUrl??V?.webhookUrl,callbackUrl:ce.callbackUrl??V?.callbackUrl,tenantUrl:T.tenantUrl??V?.tenantUrl,status:P,error:T.error??V?.error,actionUrl:T.actionUrl??V?.actionUrl,requestToken:T.requestToken??V?.requestToken,expiresAt:T.expiresAt??V?.expiresAt,configLocator:I??V?.configLocator,createdAt:V?.createdAt??D,updatedAt:D}}if(!re.tenantUrl)re.tenantUrl=pl(a,Q);if(!re.callbackUrl){let ce=d(re,a);if(ce)re.callbackUrl=ce.callbackUrl}if(V?.configLocator&&!Ai(V.configLocator,re.configLocator))await r.mirror?.purge(V.id);let ie=await r.store.upsert(re);if(oe)await s("created",()=>r.onTenantCreated?.({tenant:ie}));if(V?.integration?.status==="consented"&&!Ai(V.configLocator,re.configLocator))ie=await i(ie,V.configLocator);let se=gl(ie);if(se instanceof Response)return se;return Response.json(se.body,{status:se.status})}async function U(a){try{if(!e.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await j(a)}catch(w){return Kt(w)}}return{describe:()=>ve({module:"tm",active:!0,ready:!0,enabled:t.enabled,ionite:t.ionite,consentTtlSeconds:t.consentTtlSeconds,maxRedeemAttempts:t.maxRedeemAttempts}),handler:U,isReady:()=>!0,ready:async()=>{return},recordConsent:b,getTenant:async(a)=>r.store.get(a)}}var on="0.0.24-beta.20261006.21";import{ACCEPT_JSON as lo,assertEcid as ji,CONTENT_TYPE_FORM as fo,CONTENT_TYPE_JSON as yl,JSON_MEDIA_TYPE as sn,jwtAssertionClaimsSchema as hl,must as je,readJsonResponse as $i,workloadTokenResponseSchema as wl}from"@ionite/core";import{deriveClaimsEntitlements as vl,getCachedVerificationKey as Sl,getJwks as kl}from"@ionite/core/server";function Ve(e,t){return t in e&&e[t]!==void 0&&e[t]!==null}function Le(e){if(e===void 0||e===null)return!1;return Ve(e,"workloadId")||Ve(e,"privateKey")}function Ye(e){if(e===void 0||e===null)return!1;let t=Ve(e,"clientId"),r=Ve(e,"clientSecret"),n=Ve(e,"workloadId"),o=Ve(e,"privateKey");return(t||r)&&!n&&!o}function po(e){if(e===void 0||e===null)return!1;let t=Ve(e,"jwksUri"),r=Ve(e,"workloadId"),n=Ve(e,"clientId"),o=Ve(e,"clientSecret"),s=Ve(e,"privateKey");return t&&!r&&!s&&!n&&!o}function Ni(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function bl(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(Ni(t))return!1;let r=Object.entries(t);if(r.length===0)return!1;return r.every(([,n])=>Ni(n))}function zi(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if("incoming"in t||"outgoing"in t){if(t.incoming!==void 0&&(typeof t.incoming!=="object"||t.incoming===null))return!1;if(t.outgoing!==void 0&&(typeof t.outgoing!=="object"||t.outgoing===null||Array.isArray(t.outgoing)))return!1;return!0}return!1}function Bi(e){return zi(e)}function mo(e){if(!e)return;if(Bi(e))return Array.isArray(e.incoming)?void 0:e.incoming;return e}function So(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function Gt(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function Di(e){if(!e)return[];if(Array.isArray(e))return e.filter((t)=>!!t&&typeof t.issuer==="string"&&typeof t.jwksUri==="string").map((t)=>({issuer:t.issuer,jwksUri:t.jwksUri,audience:t.audience,claimsAsEntitlements:t.claimsAsEntitlements}));if(e.issuer&&e.jwksUri)return[{issuer:e.issuer,jwksUri:e.jwksUri,audience:e.audience??[],claimsAsEntitlements:e.claimsAsEntitlements}];return[]}function Rl(e){let t=e[0];if(!t)return;let r=So(t.audience);return{jwksUri:t.jwksUri,issuer:t.issuer,audience:typeof r[0]==="string"?r[0]:void 0}}function Ki(e,t){let r=Gt(t);if(!r)return;return e.find((n)=>Gt(n.issuer)===r)}function an(e,t,r){let n=So(e);if(t.some((o)=>n.includes(o)))return!0;if(typeof r==="string"&&t.includes(r))return!0;return!1}function go(e){if(!e||!Bi(e))return{};return e.outgoing??{}}function cn(e,t,r){return ve({name:e,ready:r,clientId:"clientId"in t?t.clientId:void 0,workloadId:"workloadId"in t?t.workloadId:void 0,idpTokenUrl:t.idpTokenUrl,scope:t.scope,audience:t.audience,authMethod:"clientSecret"in t?"client_secret":("privateKey"in t)?"private_key_jwt":"server_only"})}function Gi(e,t){let[r]=t.describe().outgoing;return{...r??cn(e,{},t.isReady()),name:e}}function yo(e,t){let r=e?.describe();return{module:"workload",active:e!==void 0||Object.keys(t).length>0,ready:e?.isReady()===!0||Object.values(t).some((n)=>n.isReady()),incoming:r?.incoming??{trustedIdps:[]},outgoing:Object.entries(t).map(([n,o])=>Gi(n,o)),urls:r?.urls??{}}}function Tl(e,t){return{describe:()=>Gi(e,t),getToken:t.getToken,refreshToken:t.refreshToken,generateJWTAssertion:t.generateJWTAssertion,revokeToken:t.revokeToken,beforeChange:t.beforeChange,afterChange:t.afterChange,isReady:t.isReady,ready:t.ready}}var ko=Symbol("ion.workloadClientState"),Hi=Symbol("ion.namedWorkloadClients");function Ht(e,t){let r=me(e,t);return{isReady:r.isReady,ready:r.ready}}function Cl(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...Ht(`workload client "${e}"`,()=>!1),describe:()=>cn(e,{},!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[ko]:"unavailable"}}function Vi(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it is no longer configured on this Ionite instance.`)};return{...Ht(`workload client "${e}"`,()=>!1),describe:()=>cn(e,{},!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[ko]:"removed"}}function Il(e){if(!e)return"removed";return e[ko]??"available"}function ho(e,t,r){let n=e,o=n,s=new Set;for(let i of r){if(s.add(i),i in o)continue;let c=t[i];o[i]=c?Tl(i,c):Cl(i)}return Object.defineProperty(o,Hi,{value:s,enumerable:!1,configurable:!0}),n}function Fi(e){if(!e)return[];let t=e[Hi];return t?Array.from(t):[]}function Pl(e,t,r){let n=t,o=Ke(r,`Workload client "${e}"`),s=()=>Il(n)==="available",i=me(`Workload client "${e}"`,s);return{api:{beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:i.isReady,ready:i.ready,describe:()=>n.describe(),getToken:(d)=>n.getToken(d),refreshToken:(d)=>n.refreshToken(d),generateJWTAssertion:(d)=>n.generateJWTAssertion(d),revokeToken:(d)=>n.revokeToken(d)},update(d){if(d===n)return;o.emitBefore(),n=d,i.refresh(),o.emitAfter()}}}function Ji(e){let t,r=!1,n=me("Workload module",()=>r),o=Ke(e,"Workload"),s=new Map,i=new Set,c=new Set(["beforeChange","afterChange","isReady","ready","describe"]),d=(p)=>{if(!t)throw Error(`${p} is unavailable because workload is not configured on this Ionite instance.`);return t},u={beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:n.isReady,ready:n.ready,describe:()=>t?.describe()??{module:"workload",active:!1,ready:!1,incoming:{trustedIdps:[]},outgoing:[],urls:{}},get config(){return t?.config??{}},getToken(...p){return d("getToken").getToken(...p)},refreshToken(p){return d("refreshToken").refreshToken(p)},generateJWTAssertion(p){return d("generateJWTAssertion").generateJWTAssertion(p)},revokeToken(p){return d("revokeToken").revokeToken(p)},validateToken(p){return d("validateToken").validateToken(p)},getWorkloadIdentity(p){return d("getWorkloadIdentity").getWorkloadIdentity(p)},parseJWT(p){return d("parseJWT").parseJWT(p)},handler(p){return d("handler").handler(p)}},l=(p)=>{for(let _ of i)delete u[_];if(i.clear(),!p)return;let k=new Set(Fi(p)),q=new Set([...c,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...k]);for(let[_,b]of Object.entries(p)){if(q.has(_))continue;u[_]=b,i.add(_)}},h=(p)=>{let k=s.get(p);if(k)return k;let q=Pl(p,Vi(p),e);if(s.set(p,q),!(p in u))u[p]=q.api;return q};return{update(p){if(!p&&!r&&s.size===0)return;o.emitBefore(),r=p!==void 0,n.refresh(),t=p;let k=new Set(Fi(p));for(let q of k){let _=p[q];h(q).update(_)}for(let[q,_]of s){if(k.has(q))continue;_.update(Vi(q))}return l(p),o.emitAfter(),u}}}async function wo(e,t,r){if(e===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let n=r[e];if(!n)throw Error(`Unknown workload client: ${e}`);return n.getToken(t)}function vo(e,t){return`${e}|${t??""}`}function st(e,t,r,n,o,s){let i={jwtAssertionClaims:e?.jwtAssertionClaims??hl("server"),tokenResponse:e?.tokenResponse??wl("server")},c=async(m,f)=>{let E=m;if(typeof E.validate==="function")return E.validate(f);return m["~standard"].validate(f)};if(!r&&!n)return;if(r&&zi(r)){let m=r.incoming,f=Di(m),E=Array.isArray(m)?Rl(m):m,A=mo(n),B=go(n),J=E?{...E,...A,jwksUri:E.jwksUri,issuer:E.issuer}:A;if(!J||!J.tokenUrl&&!J.jwksUri)t.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let G=J&&(J.tokenUrl||J.jwksUri)?st(e,t,E??void 0,A,f,s):void 0,de=Array.from(new Set([...Object.keys(r.outgoing??{}),...Object.keys(B)])).map((fe)=>[fe,{...r.outgoing?.[fe]??{},...B[fe]??{}}]),ne={};for(let[fe,Xe]of de){let Pe=st(e,t,Xe,void 0);if(Pe)ne[fe]=Pe}if(!G&&Object.keys(ne).length===0)return;let we={...G?.config??{},config:G?.config??{},describe:()=>yo(G,ne),...Ht("workload",()=>G?.isReady()===!0||Object.values(ne).some((fe)=>fe.isReady())),getToken:async(fe,Xe)=>wo(fe,Xe,ne),getServerToken:async(fe)=>{if(!G)throw Error("No server workload config");return G.getToken(fe)},refreshToken:async(fe)=>{if(!G)throw Error("No default workload config");return G.refreshToken(fe)},generateJWTAssertion:async(fe)=>{if(!G)throw Error("No default workload config");return G.generateJWTAssertion(fe)},revokeToken:async(fe)=>{if(!G)throw Error("No default workload config");return G.revokeToken(fe)},validateToken:async(fe)=>{if(!G)throw Error("No default workload config");return G.validateToken(fe)},getWorkloadIdentity:async(fe)=>{if(!G)return;return G.getWorkloadIdentity(fe)},parseJWT:async(fe)=>{if(!G)throw Error("No default workload config");return G.parseJWT(fe)},handler:async(fe)=>{if(!G)return ye();return G.handler(fe)}};return ho(we,ne,de.map(([fe])=>fe))}if(r&&bl(r)){let m=mo(n),f=go(n),E=r.default,A=E?{...E,...m,jwksUri:E.jwksUri,issuer:E.issuer}:m;if(!A||!A.tokenUrl&&!A.jwksUri)t.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let B=A&&(A.tokenUrl||A.jwksUri)?st(e,t,E??void 0,m):void 0,J=Array.from(new Set([...Object.keys(r).filter((ne)=>ne!=="default"),...Object.keys(f)])).map((ne)=>[ne,{...ne in r?r[ne]:{},...f[ne]??{}}]),G={};for(let[ne,we]of J){let fe=st(e,t,we,void 0);if(fe)G[ne]=fe}if(!B&&Object.keys(G).length===0)return;let de={...B?.config??{},config:B?.config??{},describe:()=>yo(B,G),...Ht("workload",()=>B?.isReady()===!0||Object.values(G).some((ne)=>ne.isReady())),getToken:async(ne,we)=>wo(ne,we,G),getServerToken:async(ne)=>{if(!B)throw Error("No server workload config");return B.getToken(ne)},refreshToken:async(ne)=>{if(!B)throw Error("No default workload config");return B.refreshToken(ne)},generateJWTAssertion:async(ne)=>{if(!B)throw Error("No default workload config");return B.generateJWTAssertion(ne)},revokeToken:async(ne)=>{if(!B)throw Error("No default workload config");return B.revokeToken(ne)},validateToken:async(ne)=>{if(!B)throw Error("No default workload config");return B.validateToken(ne)},getWorkloadIdentity:async(ne)=>{if(!B)return;return B.getWorkloadIdentity(ne)},parseJWT:async(ne)=>{if(!B)throw Error("No default workload config");return B.parseJWT(ne)},handler:async(ne)=>{if(!B)return ye();return B.handler(ne)}};return ho(de,G,J.map(([ne])=>ne))}let d=mo(n),u=go(n);if(!r&&Object.keys(u).length>0){let m={};for(let[A,B]of Object.entries(u)){let J=st(e,t,B,void 0);if(J)m[A]=J}let f=d&&(d.tokenUrl||d.jwksUri)?st(e,t,d,void 0):void 0;if(!f&&Object.keys(m).length===0)return;let E={...f?.config??{},config:f?.config??{},describe:()=>yo(f,m),...Ht("workload",()=>f?.isReady()===!0||Object.values(m).some((A)=>A.isReady())),getToken:async(A,B)=>wo(A,B,m),getServerToken:async(A)=>{if(!f)throw Error("No server workload config");return f.getToken(A)},refreshToken:async(A)=>{if(!f)throw Error("No default workload config");return f.refreshToken(A)},generateJWTAssertion:async(A)=>{if(!f)throw Error("No default workload config");return f.generateJWTAssertion(A)},revokeToken:async(A)=>{if(!f)throw Error("No default workload config");return f.revokeToken(A)},validateToken:async(A)=>{if(!f)throw Error("No default workload config");return f.validateToken(A)},getWorkloadIdentity:async(A)=>{if(!f)return;return f.getWorkloadIdentity(A)},parseJWT:async(A)=>{if(!f)throw Error("No default workload config");return f.parseJWT(A)},handler:async(A)=>{if(!f)return ye();return f.handler(A)}};return ho(E,m,Object.keys(u))}let l=r,h=o??Di(l),p=d?.tokenUrl,k=p?.startsWith("/")?p:void 0,q=l?.idpTokenUrl??d?.idpTokenUrl??(l?.tokenUrl&&(l.tokenUrl.startsWith("http://")||l.tokenUrl.startsWith("https://"))?l.tokenUrl:void 0),_={...l,...d,tokenUrl:k??d?.tokenUrl??l?.tokenUrl,idpTokenUrl:q,jwksUri:l?.jwksUri,issuer:l?.issuer};_._handlerTokenUrl=k;let b,j=_,U=Le(_),a=Ye(_),w=po(_);if(!U&&!a&&!w){if(!l||Object.keys(l).length===0)return;throw t.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(_),clientId:j.clientId,clientSecret:j.clientSecret?"[REDACTED]":void 0,workloadId:j.workloadId,privateKey:j.privateKey?"[REDACTED]":void 0,jwksUri:j.jwksUri,tokenUrl:j.tokenUrl,idpTokenUrl:j.idpTokenUrl,fromVaultKeys:l?Object.keys(l):[],fromCodeKeys:n?Object.keys(n):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(U)b={..._,tokenUrl:_.tokenUrl,idpTokenUrl:je(_.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:je(_.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:je(_.privateKey,"Missing 'privateKey' from Workload Config"),audience:je(_.audience,"Missing 'audience' from Workload Config"),scope:_.scope??"",algorithm:_.algorithm??"RS256",tokenLifetime:_.tokenLifetime??300,refreshThreshold:_.refreshThreshold??60,autoRefresh:_.autoRefresh!==void 0?_.autoRefresh:!0,tokenStore:_.tokenStore??new gt};else if(Ye(_))b={..._,tokenUrl:_.tokenUrl,idpTokenUrl:je(_.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:je(_.clientId,"Missing 'clientId' from Workload Config"),clientSecret:je(_.clientSecret,"Missing 'clientSecret' from Workload Config"),scope:_.scope??"",tokenLifetime:_.tokenLifetime??300,refreshThreshold:_.refreshThreshold??60,autoRefresh:_.autoRefresh!==void 0?_.autoRefresh:!0,tokenStore:_.tokenStore??new gt};else if(po(_))b=_;function S(){let m=new Uint8Array(16);return crypto.getRandomValues(m),Array.from(m,(f)=>f.toString(16).padStart(2,"0")).join("")}function M(m){let f;if(typeof m==="string")f=btoa(m);else f=btoa(String.fromCharCode(...m));return f.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function F(m){let f=m.replace(/-/g,"+").replace(/_/g,"/");while(f.length%4)f+="=";return atob(f)}function Z(m){if(m.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:m==="RS256"?"SHA-256":m==="RS384"?"SHA-384":"SHA-512"};else if(m.startsWith("ION"))return{name:"ECDSA",namedCurve:m==="ES256"?"P-256":m==="ES384"?"P-384":"P-521",hash:m==="ES256"?"SHA-256":m==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${m}`)}async function Y(m,f){let E=m.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),A=Uint8Array.from(atob(E),(J)=>J.charCodeAt(0)),B=Z(f);return crypto.subtle.importKey("pkcs8",A,B,!1,["sign"])}async function ee(m,f,E){let A=await Y(f,E),J=new TextEncoder().encode(m),G=Z(E),de=await crypto.subtle.sign(G,A,J);return M(new Uint8Array(de))}async function ae(m,f=3,E=1000,A=30000){let B=Error("Placeholder Error");for(let J=0;J<=f;J++)try{return await m()}catch(G){if(B=G instanceof Error?G:Error(String(G)),B.message.includes("400")||B.message.includes("401")||B.message.includes("403")||B.message.includes("404"))throw B;if(J<f){let de=Math.min(E*2**J,A),ne=Math.random()*de*0.1;await new Promise((we)=>setTimeout(we,de+ne))}}throw B}async function oe(m){if(!Le(b))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=b,E=Math.floor(Date.now()/1000),A={iss:f.workloadId,sub:f.workloadId,aud:f.audience??"",exp:E+f.tokenLifetime,iat:E,jti:S(),scope:m??f.scope},B={alg:f.algorithm,typ:"JWT",kid:f.keyId},J=M(JSON.stringify(B)),G=M(JSON.stringify(A)),de=`${J}.${G}`,ne=await ee(de,f.privateKey,f.algorithm);return`${de}.${ne}`}async function K(m){if(!Le(b))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=b;return ae(async()=>{let E=f.idpTokenUrl,A=await oe(m),B=new URLSearchParams;if(B.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),B.append("assertion",A),m)B.append("scope",m);let J=await fetch(E,{method:"POST",headers:{...fo,...lo},body:B.toString()}),G=await $i(J,{log:t,operation:"token.acquire"});if(!J.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:G});let ne=G;throw Error(`Token acquisition failed: ${ne.error||J.statusText} - ${ne.error_description||""}`.trim())}let de=await c(i.tokenResponse,G);if(de.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:de.issues}),Error(`Token response validation failed: ${de.issues.map((ne)=>ne.message).join("; ")}`);if(f.tokenStore){let ne=new Date(Date.now()+(de.value.expires_in??300)*1000),we={workload_id:vo(f.workloadId,m),access_token:de.value.access_token,token_type:de.value.token_type,scope:de.value.scope,expires_at:ne,created_at:new Date,refresh_token:de.value.refresh_token};await f.tokenStore.set(we)}return de.value})}async function Q(m){if(!Ye(b))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let f=b;return ae(async()=>{let E=f.idpTokenUrl,A=new URLSearchParams;if(A.append("grant_type","client_credentials"),A.append("client_id",f.clientId),A.append("client_secret",f.clientSecret),m)A.append("scope",m);let B=await fetch(E,{method:"POST",headers:{...fo,...lo},body:A.toString()}),J=await $i(B,{log:t,operation:"token.acquire"});if(!B.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:J});let de=J;throw Error(`Token acquisition failed: ${de.error||B.statusText} - ${de.error_description||""}`.trim())}let G=await c(i.tokenResponse,J);if(G.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:G.issues}),Error(`Token response validation failed: ${G.issues.map((de)=>de.message).join("; ")}`);if(f.tokenStore){let de=new Date(Date.now()+(G.value.expires_in??300)*1000),ne={workload_id:vo(f.clientId,m),access_token:G.value.access_token,token_type:G.value.token_type,scope:G.value.scope,expires_at:de,created_at:new Date,refresh_token:G.value.refresh_token};await f.tokenStore.set(ne)}return G.value})}let V=new Map;function D(m,f){let E=V.get(m);if(E)return E;let A=(async()=>(Le(b)?await K(f??""):await Q(f??"")).access_token)();return V.set(m,A),A.catch(()=>{return}).finally(()=>{if(V.get(m)===A)V.delete(m)}),A}async function te(m){if(!Le(b)&&!Ye(b)){let B=b;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!B.clientId}, hasClientSecret=${!!B.clientSecret}, hasWorkloadId=${!!B.workloadId}, hasPrivateKey=${!!B.privateKey}, hasJwksUri=${!!B.jwksUri}`)}let f=b;m=m??f.scope;let E=Le(b)?b.workloadId:b.clientId,A=vo(E,m);if(f.tokenStore){let B=await f.tokenStore.get(A);if(B){let J=Date.now(),G=B.expires_at.getTime(),de=f.refreshThreshold*1000;if(J+de<G)return B.access_token;if(f.autoRefresh)try{return await D(A,m)}catch(ne){if(J<G)return t.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},ne),B.access_token;throw ne}}}return D(A,m)}async function re(m){if(!Le(b)&&!Ye(b))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=b;return m=m??f.scope,Le(f)?await K(m):await Q(m)}async function ie(m){if(!Le(b)&&!Ye(b))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");try{if(!b.revocationEndpoint)return;let f=new URLSearchParams;if(f.append("token",m),f.append("token_type_hint","access_token"),Le(b)){let A=b;f.append("client_id",A.workloadId)}else if(Ye(b)){let A=b;f.append("client_id",A.clientId),f.append("client_secret",A.clientSecret)}let E=await fetch(b.revocationEndpoint,{method:"POST",headers:{...lo,...fo},body:f.toString()});if(!E.ok)t.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:E.status,statusText:E.statusText});else t.info("Token revoked successfully",{"ion.module":"workload"});if(b.tokenStore){let A;if(Le(b))A=b.workloadId;else if(Ye(b))A=b.clientId;else return;await b.tokenStore.delete(A)}}catch(f){t.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},f)}}async function se(m,f){let E=m??b?.jwksUri;if(!E)throw Error("No JWKS URI configured in Workload Config");return await kl(E,t,f)}async function ce(m,f){let E=f??b?.jwksUri;if(!E)throw Error("No JWKS URI configured in Workload Config");let A=Le(b)?b.algorithm:"RS256";return Sl(E,m,`wl:${A}`,(B)=>{let J=B.alg||A,G=Z(J);return crypto.subtle.importKey("jwk",B,G,!1,["verify"])},t)}function T(m){let f=m.split(".");if(f.length!==3)throw Error("Invalid JWT");return JSON.parse(F(f[1]))}async function g(m,f){try{let E=m.split(".");if(E.length!==3)throw Error("Invalid JWT");let A=JSON.parse(F(E[0])),B=JSON.parse(F(E[1])),J=await ce(A.kid,f),G=E[2],ne=new TextEncoder().encode(`${E[0]}.${E[1]}`),we=Uint8Array.from(F(G),(mt)=>mt.charCodeAt(0)),fe=Z(A.alg);if(!await crypto.subtle.verify(fe,J,we,ne))throw Error("Invalid JWT signature");let Pe=await c(i.jwtAssertionClaims,B);if(Pe.issues)throw t.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:Pe.issues}),Error(`JWT claims validation failed: ${Pe.issues.map((mt)=>mt.message).join("; ")}`);return Pe.value}catch(E){throw t.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},E),E}}async function P(m){if(!Le(b)&&!Ye(b)&&!po(b))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(h.length>0){let A=T(m),B=typeof A.iss==="string"?A.iss:void 0,J=Ki(h,B);if(!J)return{valid:!1,error:"Untrusted token issuer"};let G=await g(m,J.jwksUri),de=Math.floor(Date.now()/1000);if(G.exp&&G.exp<de)return{valid:!1,error:"Token expired"};let ne=So(J.audience);if(ne.length>0&&!an(G.aud,ne,G.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:G,expiresAt:G.exp?new Date(G.exp*1000):void 0}}let f=await g(m),E=Math.floor(Date.now()/1000);if(f.exp&&f.exp<E)return{valid:!1,error:"Token expired"};if(Le(b)){if(b.audience&&!an(f.aud,[b.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else if(Ye(b)){if(b.issuer&&Gt(f.iss)!==Gt(b.issuer))return{valid:!1,error:"Invalid issuer"};if(b.audience&&!an(f.aud,[b.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else{let A=b;if(A.issuer&&Gt(f.iss)!==Gt(A.issuer))return{valid:!1,error:"Invalid issuer"};if(A.audience&&!an(f.aud,[A.audience],f.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:f,expiresAt:f.exp?new Date(f.exp*1000):void 0}}catch(f){return{valid:!1,error:f instanceof Error?f.message:String(f)}}}function I(m,f){let E=m[f];return typeof E==="string"&&E.trim()?E.trim():void 0}function R(m){if(!m)return;return m.startsWith("service-account-")?m.slice(16):m}function W(m){return I(m,"client_id")??I(m,"clientId")??I(m,"azp")??I(m,"appid")??R(I(m,"preferred_username"))}let y=new WeakMap;function O(m){let f=y.get(m);if(f)return f;let E=L(m);return y.set(m,E),E}async function L(m){let f=m.headers.get("Authorization");if(!f?.startsWith("Bearer "))return;let E=f.substring(7),A=await P(E);if(!A.valid||!A.claims)return;let B=h.length>0?Ki(h,A.claims.iss):void 0,J=A.claims.ecid,G=W(A.claims)??A.claims.sub??"",de=B?.claimsAsEntitlements??(h.length===0?l?.claimsAsEntitlements:void 0),ne=de?.claims?.length?await vl({block:de,claims:A.claims,scope:A.claims.scope,subjectType:"workload",subjectId:G||"workload",catalog:s?.(),log:t}):void 0,we={workloadId:A.claims.sub,clientId:W(A.claims),scope:A.claims.scope,...ne?{derivedEntitlements:ne}:{},...J!==void 0&&J!==null?{ecid:ji(J)}:{},claims:A.claims},fe=b?.workloadIdentityStore;if(fe){let Xe=we.clientId??we.workloadId??we.claims.sub,Pe=Xe?await fe.get(Xe):void 0;if(Pe){if(Pe.active===!1)return;if(Pe.scopes?.length){let mt=new Set([...(we.scope??"").split(/\s+/).filter(Boolean),...Pe.scopes]);we.scope=Array.from(mt).join(" ")}if(!we.ecid&&Pe.ecid)we.ecid=ji(Pe.ecid)}}return we}async function C(m){if(!b)throw Error("ionite Workload Manager not initialized");let f=new URL(m.url).pathname,E=(J)=>{if(!J)return;try{return new URL(J).pathname}catch{return J.startsWith("/")?J:`/${J}`}};if(E(b.validateUrl)===f&&m.method==="POST"){let J=m.headers.get("Authorization");if(!J?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type",sn]]});let G=J.substring(7),de=await P(G);if(!de.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type",sn]]});return new Response(JSON.stringify({valid:!0,expiresAt:de.expiresAt}),{status:200,headers:[["Content-Type",sn]]})}if(E(b.jwksUrl)===f&&m.method==="GET"){let J=await se();return new Response(JSON.stringify(J),{headers:[["Content-Type",sn]]})}return ye()}if(!b)throw Error("Workload configuration was not resolved.");return{...b,config:b,...Ht("workload",()=>!0),describe:()=>({module:"workload",active:!0,ready:!0,incoming:{trustedIdps:h.map((m)=>({issuer:m.issuer,jwksUri:m.jwksUri,audience:m.audience,...m.claimsAsEntitlements?.claims?.length?{claimsAsEntitlements:{claims:m.claimsAsEntitlements.claims,expand:m.claimsAsEntitlements.expand===!0,resources:m.claimsAsEntitlements.resources===!0,capable:!0}}:{}}))},outgoing:[cn("default",b,!0)],urls:{validateUrl:b.validateUrl??"",jwksUrl:b.jwksUrl??""}}),getToken:te,refreshToken:re,generateJWTAssertion:oe,revokeToken:ie,validateToken:P,getWorkloadIdentity:O,parseJWT:g,handler:C}}function bo(e){return e=e??"Workload authentication unavailable",new Response(JSON.stringify({error:e}),{status:503,statusText:e,headers:yl})}var un="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",Ol="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function El(e,t){je(t,un);let r=t.workload;if(!r)return;return r.getWorkloadIdentity(e)}async function Al(e,t,r){je(t,un);let n=t.workload;if(!n)throw bo();let o=n;if(typeof o.getServerToken!=="function"||typeof o.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return o.getToken(e,r)}async function _l(e,t){je(t,Ol);let r="validateToken"in t&&typeof t.validateToken==="function"?t:t.workload;if(!r)return{valid:!1,error:"Workload authentication unavailable"};let n=e.headers.get("Authorization");if(!n?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let o=n.substring(7);return r.validateToken(o)}async function Ll(e,t){je(t,un);let r=t.workload;if(!r)throw bo();return r.revokeToken(e)}async function xl(e,t){je(t,un);let r=t.workload;if(!r)throw bo();return r.handler(e)}export*from"@ionite/core";import{AssignmentPolicyError as Kh,generateULID as Vh,IoniteError as Fh,listGenerator as zh}from"@ionite/core";import{allowHosts as Gh,allowOrigins as Hh,allowRelativePaths as Jh,allowSameOrigin as Yh,blockDangerousUrls as Xh,CatalogAdjacencyCache as Zh,callback as Qh,captureRedirect as ew,ciam as tw,collectReferencedDefinitions as rw,defaultRedirectPolicies as nw,discoverSessionRecords as ow,discoverSessions as sw,expandRoot as iw,getCustomer as aw,getOwnedTenantIds as cw,getUser as uw,has as dw,hasAll as lw,hasAllScope as fw,hasAny as pw,hasAnyScope as mw,hasGroup as gw,hasPermission as yw,hasRole as hw,hasScope as ww,InMemoryTenantStore as vw,iam as Sw,initiateLogin as kw,isRedirectAllowed as bw,listSsoClientIdsFromCookies as Rw,planDiscoveredTenantCookies as Tw,reconcileSubjectAccess as Cw,resolveAfterRedirect as Iw,resolveCapturedRedirect as Pw,resolveRedirect as Ow,resolveTenantOwner as Ew,resolveTenantSession as Aw,sameOriginRedirectRules as _w,sendTenantWebhook as Lw,sso as xw,TENANT_OWNER_PERMISSION as Uw,tenantAccessLoginUrl as Mw,tenantOwnerEntitlementId as Ww,tenantOwnerPermission as qw,tenantResourceId as jw,verifyUser as $w,withSetCookies as Nw}from"@ionite/core/server";function Ro(e){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function Ul(e,t){return{...e,subscribe:async(r,n,o)=>{try{return await e.subscribe(r,n,o)}catch(s){if(!(s instanceof qe))throw s;return await ot(e,r,n,t,void 0,o)}}}}function dn(e){let t=kt(e.path,"path","azureConfig");Tt(e.ttl);let r=e.vault??en({type:"azure",authMethod:e.authMethod,entraTenantId:e.entraTenantId,clientId:e.clientId,clientSecret:e.clientSecret,federatedTokenFile:e.federatedTokenFile,managedIdentityClientId:e.managedIdentityClientId,imdsApiVersion:e.imdsApiVersion,vaultUrl:e.vaultUrl,vaultName:e.vaultName,apiVersion:e.apiVersion,secretNameTransform:e.secretNameTransform,secretNamePrefix:e.secretNamePrefix,scope:e.scope,ttl:e.ttl}),n=e.ttl?Ul(r,e.ttl):r;return{load:async()=>{try{return(await n.getFullSecret(t)).data}catch(o){let s=o instanceof Error?o.message:String(o);throw Error(`Error retrieving remote config from Azure Key Vault: ${s}`,{cause:o})}},subscribe:(o,s)=>n.subscribe(t,(i)=>{o(i.data)},s),secret:n}}import{IoniteError as Xl}from"@ionite/core";function To(e){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as $l,remoteConfigSecretType as Nl}from"@ionite/core";import{defaultLogger as Ml,defaultSecretContentType as Wl,stableConfigHash as Yi}from"@ionite/core";var ql=1e4;function jl(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Co(e){if(e.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let t=Array.from(new Set(e.paths.map((b)=>b.trim()).filter(Boolean)));if(t.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let r=e.logger??Ml,n=[],o=Promise.resolve(),s=!1,i=!1,c=!1,d=me("Secrets mirror",()=>s&&!c),u=(b)=>{let j=e.mapPath(b).trim();if(!j)throw Error(`mirrorSecrets mapPath returned an empty target for "${b}"`);return j},l=(b)=>{let j=o.then(b);return o=j.catch((U)=>{i=!0,r.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:U instanceof Error?U.message:String(U)})}),j},h=async(b)=>{if(await e.to.exists(b))await e.to.deleteSecret(b)},p=async(b,j)=>{if(c)return;if(!jl(j.data))throw Error(`mirrorSecrets can only re-store object values (source path "${b}")`);if(e.accept&&!e.accept(j,b))return;let U=u(b);if(await e.to.exists(U)){let a=await e.to.getSecret(U);if(Yi(a)===Yi(j.data)){i=!1;return}}await e.to.putSecret(U,j.data,{contentType:j.metadata.contentType??Wl()}),i=!1},k=async(b)=>{await h(u(b)),i=!1},q=(b)=>{if(b.event!=="path_removed")return t.includes(b.path)?[b.path]:[];let j=`${b.path.replace(/\/+$/g,"")}/`;return t.filter((U)=>U===b.path||U.startsWith(j))},_=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if(e.from.subscribeEvents)n.push(e.from.subscribeEvents((b)=>{if(_.has(b.event)){let j=q(b);if(j.length>0)l(async()=>{for(let U of j)await k(U)})}try{e.onEvent?.(b)}catch(j){r.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:b.path,event:b.event,error:j instanceof Error?j.message:String(j)})}}));return(async()=>{let b=new Set(t);for(;;){try{for(let j of[...b]){let U=await e.from.subscribe(j,(a)=>{l(()=>p(j,a))},e.subscription);if(c){U();return}n.push(U),b.delete(j)}if(await o,c)return;s=!0,d.refresh();return}catch(j){if(c)return;i=!0,r.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:j instanceof Error?j.message:String(j)})}if(await new Promise((j)=>{setTimeout(j,ql).unref?.()}),c)return}})(),{isReady:d.isReady,ready:d.ready,isAvailable:()=>s&&!c&&!i&&(e.from.isAvailable?.()??!0)&&(e.to.isAvailable?.()??!0),async purge(){if(c)throw Error("Secrets mirror is closed");await l(async()=>{for(let b of t)await k(b)})},async close(){if(c)return;c=!0;for(let b of n.splice(0))b();d.refresh(),d.settle(),await o}}}function Jt(e){return typeof e.getFullSecret==="function"}function Io(e){let t=e;return typeof t.handleDelivery==="function"&&typeof t.handleEvents==="function"&&typeof t.isDeliveryRequest==="function"&&typeof t.isEventsRequest==="function"}function Xi(e){return e.type==="vault"&&[e.vaultLfvServerUrl,e.vaultLfvClientId,e.vaultLfvDeliveryEndpoint,e.vaultLfvVerifyJwks,e.vaultLfvEventsEndpoint].some((t)=>t!==void 0)}function xe(e,t){if(!e?.trim())throw Error(`Mirrored LFV config requires ${t}`);return e}function Dl(e,t){if(t?.trim())return t;if(Jt(e))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if(e.type==="vault")return xe(e.vaultLfvPath??e.vaultPath,"an upstream vault path");if(e.type==="azure")return xe(e.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${e.type}" requires an explicit fromPath`)}function Kl(e,t){let r=xe(e.vaultLfvPath??e.vaultPath,"vaultLfvPath or vaultPath");return St({lfvServerUrl:xe(e.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:xe(e.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:xe(e.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:xe(e.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:xe(e.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:r,deliveryTimeout:e.vaultLfvDeliveryTimeout,retryInterval:e.vaultLfvRetryInterval,warnInterval:e.vaultLfvWarnInterval,log:t},void 0,{selfRedeemReads:!0})}function Vl(e){return e.metadata.contentType?.typeId===Nl.id&&typeof e.data.id==="string"&&e.data.id.trim().length>0}function Fl(e,t,r,n){return{...e,close:r,subscribePassive:(o,s)=>t.subscribePassive(o,s),isDeliveryRequest:(o)=>t.isDeliveryRequest(o),isEventsRequest:(o)=>t.isEventsRequest(o),handleDelivery:(o)=>(n(),t.handleDelivery(o)),handleEvents:(o)=>(n(),t.handleEvents(o)),deliveryPath:t.deliveryPath,eventsPath:t.eventsPath,callbackKey:t.callbackKey,trustId:t.trustId}}function yr(e){let t=e.logger??$l,r=Dl(e.from,e.fromPath),n=!Jt(e.from),o=!Jt(e.to),s=Jt(e.from)?e.from:Xi(e.from)?Kl(e.from,t):it(e.from).secret,i=Jt(e.to)?e.to:it(e.to).secret,c=xe(e.path,"path"),d=Po(i,c,{ttl:e.ttl}),u,l=!1,h=!1,p,k=()=>{if(p)return;p=s.getFullSecret(r).then(()=>{return}).catch((a)=>{p=void 0,t.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:a instanceof Error?a.message:String(a)})})},q=(a)=>{if(l)throw Error("Mirrored ConfigSource is closed");if(!u){h=a;let w=!a&&Io(s)?{...s,subscribe:(S,M)=>s.subscribePassive(S,M)}:s;u=Co({from:w,to:i,paths:[r],mapPath:()=>c,accept:Vl,logger:t})}else if(a&&!h)k();return u},_={isReady:()=>u?.isReady()??!1,ready:(a)=>q(!0).ready(a),isAvailable:()=>u?.isAvailable()??!1,purge:()=>q(!1).purge(),close:async()=>{await u?.close()}},b=async()=>{if(l)return;if(l=!0,await u?.close(),n)await s.close?.();if(o)await i.close?.()},j=Io(s)?Fl(i,s,b,()=>{q(!1)}):{...i,close:b},U={load:async()=>{try{let a=await d.load();return q(!1),a}catch(a){throw q(!0),a}},subscribe:(a,w)=>(q(!1),d.subscribe(a,w)),secret:j,mirror:_,async handleCallback(a,w){if(!Io(s))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return q(!1),a==="delivery"?s.handleDelivery(w):s.handleEvents(w)}};if(Object.defineProperties(U,{log:{get:()=>d.log,set:(a)=>{d.log=a},enumerable:!0},validators:{get:()=>d.validators,set:(a)=>{d.validators=a},enumerable:!0}}),!Jt(e.from)&&Xi(e.from)){let a=e.from;U[Nt]={path:r,lfvServerUrl:xe(a.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:xe(a.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:xe(a.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:xe(a.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:xe(a.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:a.vaultLfvDeliveryTimeout,retryInterval:a.vaultLfvRetryInterval,warnInterval:a.vaultLfvWarnInterval}}return U}class Pt extends Error{constructor(e,t=`Waiting for vault config secret at ${e}`){super(t);this.path=e;this.code="not_found";this.sourceType="vault";this.status=404;this.name="VaultConfigWaitingForSecretError"}}function zl(e){return e instanceof Pt}class hr extends Error{constructor(e,t){super(t);this.path=e;this.code="invalid_payload";this.sourceType="vault";this.name="VaultConfigInvalidPayloadError"}}function Bl(e){return e instanceof hr}var ea=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function Zi(e){return ea.some((t)=>(t in e))}function Qi(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw new Pt(t,`Vault config secret at ${t} is missing or not an object`);let r=e;if(!Zi(r)&&Object.keys(r).length===1&&"data"in r){let n=r.data;if(n&&typeof n==="object"&&!Array.isArray(n))r=n}if(Object.keys(r).length===0)throw new Pt(t,`Vault config secret at ${t} is empty`);if(!Zi(r))throw new hr(t,`Vault config secret at ${t} is an invalid payload: not a RemoteConfig (no known keys: ${ea.join("/")})`);return r}function Gl(e,t,r){return{...e,subscribe:async(n,o,s)=>{try{return await e.subscribe(n,o,s)}catch(i){if(!(i instanceof qe))throw i;return await ot(e,n,o,t,r(),s)}}}}function ln(e){let t=kt(e.path,"path","vaultConfig");Tt(e.ttl);let r=e.vault??zt({type:"vault",url:e.url,token:e.token,workload:e.workload,lfv:e.lfv,websocket:e.websocket,ttl:e.ttl,log:e.log}),n=e.vault&&e.ttl?Gl(r,e.ttl,()=>e.log):r,o={get log(){return e.log},set log(s){if(e.log=s,n&&"log"in n)n.log=s},load:async()=>{try{let s=await n.getFullSecret(t);return Qi(s.data,t)}catch(s){if(s instanceof nt)throw new Pt(t);if(s instanceof Pt||s instanceof hr)throw s;throw Error("Error retrieving remote config from vault",{cause:s})}},subscribe:(s,i)=>n.subscribe(t,(c)=>{let d;try{d=Qi(c.data,t)}catch(u){e.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:t,error:u instanceof Error?u.message:String(u)});return}s(d)},i),secret:n};if(e.lfv?.lfvServerUrl&&e.lfv.clientId&&e.lfv.deliveryEndpoint&&e.lfv.eventsEndpoint)o[Nt]={path:e.lfv.path??t,lfvServerUrl:e.lfv.lfvServerUrl,clientId:e.lfv.clientId,deliveryTimeout:e.lfv.deliveryTimeout,retryInterval:e.lfv.retryInterval,warnInterval:e.lfv.warnInterval,deliveryEndpoint:e.lfv.deliveryEndpoint,eventsEndpoint:e.lfv.eventsEndpoint,verifyJwks:e.lfv.verifyJwks};return o}function fn(e){if(e==null)return;if(typeof e==="number")return Number.isFinite(e)?e:void 0;let t=e.trim();if(!t)return;let r=Number.parseInt(t,10);return Number.isFinite(r)?r:void 0}function Hl(e,t){let r=e.vaultLfvServerUrl??t?.lfvServerUrl,n=e.vaultLfvClientId??t?.clientId,o=e.vaultLfvDeliveryEndpoint??t?.deliveryEndpoint,s=e.vaultLfvEventsEndpoint??t?.eventsEndpoint;if(!r||!n||!o||!s)return t;return{...t,lfvServerUrl:r,clientId:n,deliveryEndpoint:o,verifyJwks:e.vaultLfvVerifyJwks??t?.verifyJwks,eventsEndpoint:s,path:e.vaultLfvPath??t?.path,deliveryTimeout:fn(e.vaultLfvDeliveryTimeout)??t?.deliveryTimeout,retryInterval:fn(e.vaultLfvRetryInterval)??t?.retryInterval,warnInterval:fn(e.vaultLfvWarnInterval)??t?.warnInterval}}function Jl(e,t){let r=e.vaultWebsocketUrl??t?.url;if(!r)return t;return{...t,url:r,token:e.vaultWebsocketToken??t?.token,clientId:e.vaultWebsocketClientId??t?.clientId,header:e.vaultWebsocketHeader??t?.header}}function Yl(e,t){let r=e.vaultWorkloadTokenUrl??t?.idpTokenUrl,n=e.vaultWorkloadClientId??t?.clientId,o=e.vaultWorkloadClientSecret??t?.clientSecret;if(!r||!n||!o)return t;return{...t,idpTokenUrl:r,clientId:n,clientSecret:o,scope:e.vaultWorkloadScope??t?.scope}}function ta(e,t){return{...t,url:e.vaultUrl??t?.url,token:e.vaultToken??t?.token,path:e.vaultPath??t?.path,ttl:fn(e.vaultTtl)??t?.ttl,workload:Yl(e,t?.workload),lfv:Hl(e,t?.lfv),websocket:Jl(e,t?.websocket)}}function it(e){switch(e.type){case"vault":return Ql(e);case"azure":return ef(e);case"aws":return tf(e);case"gcp":return rf(e);case"mirror":return Zl(e);default:throw Error(`Unsupported config locator type: ${e.type}`)}}function Zl(e){if(e.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!e.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return yr({from:e.from,to:e.to,path:e.to.vaultPath,ttl:e.to.vaultTtl})}function Ql(e){return ln(ta(e))}function ef(e){return dn({authMethod:e.azureAuthMethod,entraTenantId:e.azureEntraTenantId,clientId:e.azureClientId,clientSecret:e.azureClientSecret,federatedTokenFile:e.azureFederatedTokenFile,managedIdentityClientId:e.azureManagedIdentityClientId,imdsApiVersion:e.azureImdsApiVersion,vaultUrl:e.azureVaultUrl,vaultName:e.azureVaultName,apiVersion:e.azureApiVersion,scope:e.azureScope,secretNamePrefix:e.azureSecretNamePrefix,path:e.azurePath,ttl:e.azureTtl})}function tf(e){return Ro({webhookUrl:e.awsWebhookUrl,ttl:e.awsTtl})}function rf(e){return To({ttl:e.gcpTtl})}function Po(e,t,r={}){switch(e.type){case"vault":return ln({vault:e,path:t,ttl:r.ttl});case"azure":return dn({vault:e,path:t,ttl:r.ttl});default:throw new Xl(`configFromSource is not supported for secrets source type "${e.type}" (path "${t}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function Ot(e){if(!e)return;let t=Number.parseInt(e,10);return Number.isFinite(t)?t:void 0}function pn(e,t){let r=t?.type??e.ION_CONFIG_TYPE;if(!r)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(r==="vault")return{type:"vault",vaultUrl:e.ION_VAULT_URL,vaultToken:e.ION_VAULT_TOKEN,vaultPath:e.ION_VAULT_PATH??"",vaultTtl:Ot(e.ION_VAULT_TTL),vaultWorkloadTokenUrl:e.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:e.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:e.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:e.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:e.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:e.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:e.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:e.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:e.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:e.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:Ot(e.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:Ot(e.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:Ot(e.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:e.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:e.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:e.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:e.ION_VAULT_WEBSOCKET_HEADER};if(r==="azure")return{type:"azure",azurePath:e.ION_AZURE_PATH,azureApiVersion:e.ION_AZURE_API_VERSION,azureScope:e.ION_AZURE_SCOPE,azureSecretNamePrefix:e.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:e.ION_AZURE_AUTH_METHOD,azureEntraTenantId:e.ION_AZURE_TENANT_ID,azureClientId:e.ION_AZURE_CLIENT_ID,azureClientSecret:e.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:e.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:e.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:e.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:e.ION_AZURE_VAULT_URL,azureVaultName:e.ION_AZURE_VAULT_NAME,azureTtl:Ot(e.ION_AZURE_TTL)};if(r==="aws")return{type:"aws",awsWebhookUrl:e.ION_AWS_WEBHOOK_URL??"",awsTtl:Ot(e.ION_AWS_TTL)};if(r==="gcp")return{type:"gcp",gcpTtl:Ot(e.ION_GCP_TTL)};if(r==="mirror"){let n={};for(let[c,d]of Object.entries(e))if(c.startsWith("ION_FROM_"))n[`ION_${c.slice(9)}`]=d;if(n.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let o=pn(n),s=pn(e,{type:"vault"});if(!s.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let i={type:"vault",vaultUrl:s.vaultUrl,vaultToken:s.vaultToken,vaultPath:s.vaultPath,vaultTtl:s.vaultTtl,vaultWorkloadTokenUrl:s.vaultWorkloadTokenUrl,vaultWorkloadClientId:s.vaultWorkloadClientId,vaultWorkloadClientSecret:s.vaultWorkloadClientSecret,vaultWorkloadScope:s.vaultWorkloadScope,vaultWebsocketUrl:s.vaultWebsocketUrl,vaultWebsocketToken:s.vaultWebsocketToken,vaultWebsocketClientId:s.vaultWebsocketClientId,vaultWebsocketHeader:s.vaultWebsocketHeader};return{type:"mirror",from:o,to:i}}throw Error(`ION_CONFIG_TYPE="${r}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function ra(e,t){return it(pn(e,t))}function nf(e){return ra(process.env,e)}var of=1000,sf=30000,na=["vault","azure","aws","gcp"];function oa(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Config locator at ${t} is an invalid payload: expected an object with a "type" field`);let r=e.type;if(typeof r!=="string"||!na.includes(r))throw Error(`Config locator at ${t} is an invalid payload: unknown type "${String(r)}" (expected ${na.join("/")})`)}function sa(e,t){return e.log??=t.log,e.validators??=t.validators,e}function wr(e){if(!e?.secret?.close)return;try{Promise.resolve(e.secret.close()).catch((t)=>{e.log?.warn?.("secretConfigSource: inner source close failed",t)})}catch(t){e.log?.warn?.("secretConfigSource: inner source close failed",t)}}function af(e,t){let r=kt(t,"path","secretConfigSource"),n,o=(i)=>{oa(i,r);let c=JSON.stringify(i);if(n&&n.hash===c)return n.inner;let d=n?.inner,u=sa(it(i),s);if(n={hash:c,inner:u},d&&d!==u)wr(d);return u},s={async load(){let i=await e.getSecret(r);return o(i).load()},async subscribe(i,c){let d,u=!1,l=!1,h,p,k=new Promise((S,M)=>{h=S,p=M}),q=Br(),_,b,j=(S)=>new Promise((M)=>{b=M,_=setTimeout(M,S)}),U=async(S,M)=>{oa(S,r);let F=JSON.stringify(S),Z=n!==void 0&&n.hash===F;if(Z&&d)return;let Y=n?.inner,ee=d,ae=Z&&n?n.inner:sa(it(S),s),oe=!Z,K=()=>{if(oe&&ae!==Y)wr(ae)};try{if(ae.subscribe){let V=await ae.subscribe(i,c)??void 0;if(u||!q.isCurrent(M)){V?.(),K();return}if(d=V,n={hash:F,inner:ae},ee&&ee!==V)ee();if(oe&&Y&&Y!==ae)wr(Y);return}let Q=await ae.load();if(u||!q.isCurrent(M)){K();return}if(n={hash:F,inner:ae},ee)ee(),d=void 0;if(oe&&Y&&Y!==ae)wr(Y);i(Q)}catch(Q){throw K(),Q}},a=async(S)=>{let M=q.next(),F=of;for(;;){if(u||!q.isCurrent(M))return;try{await U(S,M);return}catch(Z){if(u||!q.isCurrent(M))return;s.log?.warn(`secretConfigSource rebind for ${r} failed; keeping last-known-good source and retrying in ${F}ms`,Z),await j(F),F=Math.min(sf,F*2)}}},w=await e.subscribe(r,(S)=>{if(u)return;if(!l){U(S.data,q.next()).then(()=>{l=!0,h()}).catch((M)=>{l=!0,p(M)});return}a(S.data)},c);return await k,()=>{if(u=!0,q.next(),_)clearTimeout(_);b?.(),d?.(),w(),wr(n?.inner),n=void 0}},secret:e};return s}import{compareDisplayExpiryDesc as ia,projectDisplayUser as aa,readDisplayCookies as cf}from"@ionite/core";import{discoverSessions as uf,getCustomer as df,getOwnedTenantIds as lf}from"@ionite/core/server";function mn(e,t){let r=e?.[t];return typeof r==="string"?r:""}function ff(e){if(!e)return;let t=e instanceof Date?e:new Date(e);return Number.isNaN(t.getTime())?void 0:t.toISOString()}function pf(e,t){let r=e.tenantId?.trim();if(!r)return;let n={name:mn(e.claims,"name")||mn(e.claims,"preferred_username"),email:mn(e.claims,"email"),avatar:mn(e.claims,"picture")},o=ff(e.expiresAt);return{tenantId:r,authType:e.authType,source:"session",user:aa(n,t),...o?{expiresAt:o}:{}}}function mf(e){let t=new Map;for(let r of e){let n=typeof r.user.email==="string"?r.user.email:void 0,o=typeof r.user.name==="string"?r.user.name:void 0,s=n||o||r.tenantId,i=t.get(s);if(i){i.tenants.push(r);continue}t.set(s,{...n?{email:n}:{},...o?{name:o}:{},tenants:[r]})}return[...t.values()]}async function gf(e,t){let n=(await uf(e,t.sessionStore,{...t.cookiesPrefix!==void 0?{cookiesPrefix:t.cookiesPrefix}:{}})).map((h)=>pf(h,t.displayUser)).filter((h)=>Boolean(h)).sort((h,p)=>ia(h.expiresAt,p.expiresAt)),o=typeof t.max==="number"&&t.max>=1?Math.floor(t.max):10,s=n.slice(0,o),i=new Set(s.map((h)=>h.tenantId));if(t.ion){let h=await df(e,t.ion);if(h?.id){let p=await lf(t.ion,h.id),k=aa({name:h.name,email:h.email,avatar:h.avatar},t.displayUser);for(let q of p){if(i.has(q))continue;i.add(q),s.push({tenantId:q,authType:"ciam",source:"owner",user:k})}}}let c=Date.now(),d=typeof t.maxDiscovered==="number"&&t.maxDiscovered>=1?Math.floor(t.maxDiscovered):10,u=cf(e.headers.get("cookie")).filter((h)=>h.envelope.kind==="discovered"&&Boolean(h.envelope.tenantId)&&Date.parse(h.envelope.expiresAt)>c).sort((h,p)=>ia(h.envelope.expiresAt,p.envelope.expiresAt)),l=0;for(let h of u){let p=h.envelope.tenantId;if(!p||i.has(p))continue;if(l>=d)break;l+=1,i.add(p),s.push({tenantId:p,authType:h.envelope.authType,source:"discovered",user:h.envelope.user,expiresAt:h.envelope.expiresAt,...h.envelope.tenantName?{tenantName:h.envelope.tenantName}:{}})}if(t.tenantLabel)for(let h of s){let p=await t.tenantLabel(h.tenantId);if(p)h.tenantName=p}return{tenants:s,groups:mf(s)}}import{listGenerator as yf}from"@ionite/core";import{TENANT_OWNER_PERMISSION as hf,tenantOwnerEntitlementId as ca,tenantResourceId as wf}from"@ionite/core/server";async function vf(e,t){let r=e.authz.catalogStore;if(!r)throw Error("Cannot materialize tenant owner entitlement: no AccessCatalogStore is wired.");let n=t.displayName?.trim()||t.tenantId,o={id:ca(t.tenantId),name:`Owner of ${n}`,description:`Administer the ${n} tenant`,source:"app",requestable:!0,riskLevel:"privileged",permissions:[hf],resources:[wf(t.tenantId)],assignableSubjectTypes:["customer"],recommendedSubjectTypes:["customer"]},s=r.groups.insertIfAbsent(o);return await s.ready(),s}async function Sf(e,t){let r=e.authz.catalogStore,n=e.authz.accessStore;if(!r)throw Error("Cannot clean up tenant entitlements: no AccessCatalogStore is wired.");if(!n)throw Error("Cannot clean up tenant entitlements: no AccessAssignmentStore is wired.");let o=ca(t.tenantId),s=[];for await(let c of yf((d,u)=>n.listByTarget("group",o,{start:d,limit:u})))s.push(c);for(let c of s)await e.authz.revoke(c);let i=await r.groups.get(o);if(i)await r.groups.delete(o);return{revoked:s.length,deleted:i?1:0}}function Oo(e){if(Array.isArray(e))return e.map(Oo);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,Oo(r)]));return e}function ua(e){return JSON.stringify(Oo(e))}function kf(e){if(e.type==="vault")return e.vaultLfvPath??e.vaultPath;if(e.type==="azure"&&e.azurePath?.trim())return e.azurePath;throw Error(`Tenant config locator type "${e.type}" does not declare a mirrorable config path`)}function bf(e,t){let r=t.logger??e.log,n=new Map,o=!1,s=async(u)=>{if(u.closed)return;u.closed=!0,u.closeHooks?.(),await u.hookSetup?.catch(()=>{return}),await u.source.secret.close?.()},i=(u)=>{let l=(async()=>{let h=await t.store.get(u);if(!h)throw Error(`Tenant "${u}" was not found`);if(!h.configLocator)throw Error(`Tenant "${u}" has no configLocator`);let p=h.configLocator,k=t.path(h).trim();if(!k)throw Error(`Tenant mirror path is empty for "${u}"`);let q=t.sourceFromLocator?.(p,h)??p,b={source:yr({from:q,fromPath:kf(p),to:t.to,path:k,logger:r}),locatorFingerprint:ua(p),targetPath:k,closed:!1};if(t.hooks?.onRemoteConfigChange)b.hookSetup=t.to.subscribe(k,(j)=>{Promise.resolve(t.hooks?.onRemoteConfigChange?.(h,j.data,j)).catch((U)=>{r.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:u,error:U instanceof Error?U.message:String(U)})})}).then((j)=>{b.closeHooks=j}).catch((j)=>{r.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:u,error:j instanceof Error?j.message:String(j)})});return b})();return n.set(u,l),l.catch(()=>{if(n.get(u)===l)n.delete(u)}),l},c=async(u,l,h)=>{if(n.get(u)===l)n.delete(u);await s(h)},d=async(u)=>{if(o)throw Error("Tenant config mirror is closed");let l=n.get(u);if(!l)return i(u);let h=await l,p=await t.store.get(u);if(!p?.configLocator)throw await c(u,l,h),Error(p?`Tenant "${u}" has no configLocator`:`Tenant "${u}" was not found`);if(ua(p.configLocator)!==h.locatorFingerprint)return await c(u,l,h),n.get(u)??i(u);return h};return{async ensure(u,l){await(await d(u)).source.mirror.ready(l)},async handleCallback(u,l,h){try{return await(await d(u)).source.handleCallback(l,h)}catch(p){let k=p instanceof Error?p.message:String(p),q=k.includes("was not found")?404:503;return r.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:u,kind:l,error:k}),Response.json({error:q===404?"Tenant not found":"Tenant config mirror unavailable"},{status:q})}},async purge(u){let l=n.get(u),h=l?await l:void 0,p=await t.store.get(u),k=h?.targetPath??(p?t.path(p).trim():void 0);if(h&&l)await c(u,l,h);if(k&&await t.to.exists(k))await t.to.deleteSecret(k);if(p)await t.hooks?.onRemoteConfigRevoke?.(p)},async close(){if(o)return;o=!0;let u=[...n.values()];n.clear(),await Promise.all(u.map(async(l)=>{try{await s(await l)}catch{}}))}}}import{buildTenantPath as Rf,DEFAULT_TENANT_API_NAMESPACE as la,DEFAULT_TENANT_UI_NAMESPACE as fa,matchTenantHost as Tf,matchTenantPath as pa,normalizeTenantPathNamespace as da}from"@ionite/core";function Cf(){return Response.json({error:"Tenant not found"},{status:404})}function If(e){return Response.json({error:`Tenant runtime unavailable for ${e}`},{status:503})}function Pf(e,t){let r=!e||e.type===void 0||e.type==="path"?e:void 0;if(t==="api")return da(r?.api??la);return da(r?.ui??fa)}function Of(e){if(e.store)return async(t)=>e.store.getIon(t);return async(t)=>await e.getIon(t)??void 0}async function ma(e,t={}){if(t.custom){let s=await t.custom(e);if(s)return{id:s}}if(t.strategy?.type==="selector")return null;if(t.strategy?.type==="host"){let s=Tf(new URL(e.url).hostname,t.strategy.baseDomain);return s?{id:s.id}:null}let r=t.namespace??"api",n=Pf(t.strategy,r),o=pa(new URL(e.url).pathname,n);if(!o)return null;return{id:o.id,context:{namespace:r,restPath:o.restPath,restSegments:o.restSegments}}}function ga(e,t){let r=new URL(e.url);return r.pathname=t,new Request(r,e)}function Eo(e,t,r,n){let o=pa(new URL(e.url).pathname,r);if(!o||o.id!==t)return e;return ga(e,Rf(t,o.restPath,n))}function Ef(e,t,r={beforeTenantSegments:["api"],afterTenantSegments:[]}){return Eo(e,t,la,r)}function Af(e,t,r={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return Eo(e,t,fa,r)}function _f(e){return async function(r){try{let n=e.resolveTenant?await e.resolveTenant(r):await ma(r),o=typeof n==="string"?{id:n,context:void 0}:n??null;if(!o?.id)return e.onMissingTenant?await e.onMissingTenant(r):Cf();let s=await e.getIon(o.id,r)??null;if(!s)return e.onMissingIonite?await e.onMissingIonite(r,o.id):If(o.id);let i=e.rewriteRequest?await e.rewriteRequest(r,{id:o.id,ion:s,context:o.context}):r;return s.handler(i)}catch(n){return Kt(n)}}}import{list as Lf,matchesListFilter as xf}from"@ionite/core";class ya{constructor(){this.identities=new Map;this.clientIdIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.identities.get(e)}async lookup(e){if(e.id){let t=this.identities.get(e.id);if(t)return t}if(e.clientId){let t=this.clientIdIndex.get(e.clientId);if(t)return this.identities.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.identities.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n=this.identities.get(t),o={...e,id:t,createdAt:n?.createdAt??e.createdAt??r,updatedAt:r};if(n?.clientId&&n.clientId!==o.clientId)this.clientIdIndex.delete(n.clientId);if(n?.externalId&&n.externalId!==o.externalId)this.externalIdIndex.delete(n.externalId);if(this.identities.set(t,o),o.clientId)this.clientIdIndex.set(o.clientId,t);if(o.externalId)this.externalIdIndex.set(o.externalId,t);return o}async delete(e){let t=this.identities.get(e);if(t?.clientId)this.clientIdIndex.delete(t.clientId);if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.identities.delete(e),t?1:0}async list(e){let t=Array.from(this.identities.values()).filter((c)=>xf(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return Lf(o,i,r,n)}}var Kf=30000;function Vf(e){let t=e,r=t.basePath??Er(),n=t.readyTimeoutMs??Kf,o=Or(t.stores),{routing:s,beforeChange:i,afterChange:c,configRetry:d,onConfigLoadError:u}=t;return{frameworkConfig:{log:e.log,validators:e.validators,sso:e.sso,iam:e.iam,workload:e.workload,secrets:e.secrets,lfv:e.lfv,ciam:e.ciam,tm:e.tm,authz:e.authz,otel:e.otel},basePath:r,readyTimeoutMs:n,stores:o,options:{beforeChange:i,afterChange:c,routing:s,configRetry:d,onConfigLoadError:u}}}function Ff(e){let t=e,r={trace:(n,...o)=>t.trace(n,...o),debug:(n,...o)=>t.debug(n,...o),info:(n,...o)=>t.info(n,...o),warn:(n,...o)=>t.warn(n,...o),error:(n,...o)=>t.error(n,...o)};return{logger:r,update(n){return t=n,r}}}function Ca(e,t){let r=e;return r.setStores=(n)=>{t.current=Or(n),Object.assign(r,Zt(r,t.current))},r}function wa(e){let t=e?.replace(/\s+/g," ").trim();return t?t:void 0}function Ia(e){if(typeof e!=="object"||e===null)return;return e.cause}function zf(e){if(!(e instanceof Error))return typeof e==="string"?wa(e):void 0;let t=wa(e.message),r=[],n=e;if(typeof n.code==="string")r.push(`code=${n.code}`);if(typeof n.status==="number")r.push(`status=${n.status}`);if(typeof n.path==="string")r.push(`path=${n.path}`);if(r.length===0)return t;if(!t)return r.join(", ");return`${t} [${r.join(", ")}]`}function Wo(e,t=3){let r=[],n=e,o=0;while(n!=null&&o<t){let s=zf(n);if(s&&!r.includes(s))r.push(s);n=Ia(n),o+=1}return r.length>0?r.join(" <- "):void 0}function Bf(e,t){if(typeof e!=="object"||e===null)return;return e[t]}function $e(e,t){let r=e,n=0;while(r!=null&&n<3){let o=Bf(r,t);if(o!==void 0)return o;r=Ia(r),n+=1}return}var Gf=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function Hf(e){return typeof e==="string"&&Gf.has(e)}function Jf(e){let t=$e(e,"kind");if(Hf(t))return t;let r=$e(e,"status"),n=$e(e,"code"),o=Wo(e)?.toLowerCase()??"";if(r===401||r===403||o.includes("auth error")||o.includes("permission denied"))return"auth";if(n==="not_found"||o.includes("waiting for vault"))return"not_found";if(n==="ECONNREFUSED"||n==="ECONNRESET"||n==="ENOTFOUND"||n==="ETIMEDOUT"||o.includes("connection")||o.includes("fetch failed")||o.includes("network"))return"connection";if(o.includes("timed out"))return"timeout";if(o.includes("invalid status")||typeof r==="number"&&r>=400)return"invalid_status";if(o.includes("invalid payload")||o.includes("invalid json")||o.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function Yf(e){return"validation"}var Xf=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function Zf(e,t){let r=$e(e,"recoverable");if(typeof r==="boolean")return r;if(t==="not_found")return!0;if(t==="auth"||t==="invalid_payload")return!1;let n=$e(e,"status");if(typeof n==="number"&&n>=400&&n<500)return!1;let o=$e(e,"code");if(typeof o==="string"&&(Xf.has(o)||o.startsWith("UND_ERR_")))return!0;return!0}function Qf(e){return{initialDelayMs:Math.max(1,e?.initialDelayMs??2000),maxDelayMs:Math.max(1,e?.maxDelayMs??600000),multiplier:Math.max(1,e?.multiplier??2),jitterRatio:Math.max(0,e?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,e?.loadTimeoutMs??30000)}}function ep(e,t){let r=Math.max(0,e-1),n=Math.min(t.maxDelayMs,t.initialDelayMs*t.multiplier**r);if(t.jitterRatio===0)return Math.round(n);let o=n*t.jitterRatio,s=(Math.random()*2-1)*o;return Math.max(1,Math.round(Math.min(t.maxDelayMs,n+s)))}function tp(e){return(t)=>{let r=t.path?` at ${t.path}`:"",n=t.sourceType?` (${t.sourceType})`:"";e.warn(`Config source${n} unavailable${r}; ionite will retry automatically in ${t.nextDelayMs}ms (attempt ${t.attempt}, ${t.errorKind}: ${t.message}).`)}}async function rp(e,t){for(let r of t)await r(e)}function Ne(e){if(!e)return;try{return new URL(e,"http://dummy").pathname}catch{return e.startsWith("/")?e:`/${e}`}}function np(e,t){let r=t.id;if(typeof r!=="string"||r.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if(e!==void 0&&e!==r)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${e}", received "${r}").`)}function op(e){let t=(r,n)=>{if(r!==void 0&&(typeof r!=="string"||r.length===0))throw Error(`${n}: "clientSecret" must be a non-empty string when present; omit it entirely for a public (PKCE-only) client.`)};t(e.sso?.clientSecret,"sso");for(let[r,n]of Object.entries(e.ciam?.providers??{}))t(n.clientSecret,`ciam.providers.${r}`)}function sp(e){let t=(o,s)=>{if(!o)return;if(typeof o.url!=="string"||o.url.length===0)throw Error(`${s}.url is required and must be a non-empty string.`);if(o.audience!==void 0&&(typeof o.audience!=="string"||o.audience.length===0))throw Error(`${s}.audience must be a non-empty string when present.`)},r=e.sso?.accessRequests;if(t(r,"RemoteConfig.sso.accessRequests"),r&&!at(e.sso?.claimsAsEntitlements))throw Error("RemoteConfig.sso.accessRequests requires sso.claimsAsEntitlements because the provider must carry approved assignments in token claims.");let n=[];for(let[o,s]of Object.entries(e.ciam?.providers??{})){if(t(s.accessRequests,`RemoteConfig.ciam.providers.${o}.accessRequests`),!s.accessRequests)continue;if(s.type==="magic-link")throw Error(`RemoteConfig.ciam.providers.${o}.accessRequests is invalid for a magic-link provider.`);if(!at(s.claimsAsEntitlements))throw Error(`RemoteConfig.ciam.providers.${o}.accessRequests requires claimsAsEntitlements because the provider must carry approved assignments in token claims.`);if(s.enabled!==!1)n.push(o)}if(e.iam?.users?.assignment==="idp"&&!r)throw Error('RemoteConfig.iam.users.assignment "idp" requires sso.accessRequests.');if(e.iam?.customers?.assignment==="idp"&&n.length===0)throw Error('RemoteConfig.iam.customers.assignment "idp" requires an enabled ciam provider with accessRequests.');if(e.iam?.workloads?.assignment==="idp")throw Error('RemoteConfig.iam.workloads.assignment does not support "idp".')}function ip(e){let t=e.kms;if(t)for(let[n,o]of Object.entries(t)){if(n.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!o||typeof o!=="object"||Array.isArray(o))throw Error(`RemoteConfig.kms.${n} must be an object.`);if(o.source!==void 0&&(typeof o.source!=="string"||o.source.length===0))throw Error(`RemoteConfig.kms.${n}.source must be a non-empty string when present.`);if(o.path!==void 0&&(typeof o.path!=="string"||o.path.length===0))throw Error(`RemoteConfig.kms.${n}.path must be a non-empty string when present.`)}let r=e.otel;if(!r)return;if(r.apiKey!==void 0&&r.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(r.apiKeyPool!==void 0){if(typeof r.apiKeyPool!=="string"||r.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!t?.[r.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${r.apiKeyPool}".`)}}function ap(e){let t=e.authz?.trustedProvisioningClients;if(!t)return;t.forEach((r,n)=>{let o=`authz.trustedProvisioningClients[${n}]`;if(typeof r.issuer!=="string"||r.issuer.length===0)throw Error(`${o}: "issuer" is required and must be a non-empty string.`);if(typeof r.clientId!=="string"||r.clientId.length===0)throw Error(`${o}: "clientId" is required and must be a non-empty string.`);let s=Array.isArray(r.audience)?r.audience:[r.audience];if(s.length===0||s.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(r.permissions)||r.permissions.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "permissions" must be an array of non-empty permission ids.`)})}function cp(e){let t=e.tm;if(!t)return;if(t.enabled!==!0)throw Error("RemoteConfig.tm.enabled must be true when tm is present.");for(let r of["id","url","issuer","jwksUri","audience","clientId"])if(typeof t.ionite?.[r]!=="string"||t.ionite[r].length===0)throw Error(`RemoteConfig.tm.ionite.${r} is required and must be a non-empty string.`);if(t.consentTtlSeconds!==void 0&&(!Number.isInteger(t.consentTtlSeconds)||t.consentTtlSeconds<60))throw Error("RemoteConfig.tm.consentTtlSeconds must be an integer of at least 60.");if(t.maxRedeemAttempts!==void 0&&(!Number.isInteger(t.maxRedeemAttempts)||t.maxRedeemAttempts<1))throw Error("RemoteConfig.tm.maxRedeemAttempts must be a positive integer.")}function up(e){let t=Array.isArray(e)?e:[e];return t.length>0&&t.every((r)=>typeof r==="string"&&r.length>0)}function dp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return;let r=t,n=(o,s)=>{if(!up(o.audience))throw Error(`${s}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in r||"outgoing"in r){let o=r.incoming;if(Array.isArray(o))o.forEach((s,i)=>{if(s&&typeof s==="object")n(s,`workload.incoming[${i}]`)});else if(o&&typeof o==="object"&&"jwksUri"in o)n(o,"workload.incoming");return}if(Ea(r)){if("jwksUri"in r&&!("clientId"in r)&&!("workloadId"in r))n(r,"workload (server-only)");return}}function lp(e,t,r){if(e?.sso?.redirectUri&&t.sso?.redirectUri){let n=Ne(e.sso.redirectUri),o=Ne(t.sso.redirectUri);if(n!==o)r.error(`SSO redirectUri path mismatch: the framework derives "${o}" from basePath, but ConfigSource reports "${n}". Register "${o}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function qo(e){let t={};if(!e)return t;for(let[r,n]of Object.entries(e))if(n.type==="vault"&&typeof n.lfv?.deliveryEndpoint==="string"&&typeof n.lfv?.eventsEndpoint==="string")t[r]=n.lfv;return t}function Pa(e){return e[Nt]}function Oa(e,t){let r=qo(e.secrets??void 0),n=Ne(t.deliveryEndpoint),o=Ne(t.eventsEndpoint),s=Ne(t.path);for(let i of Object.values(r)){if(Ne(i.deliveryEndpoint)!==n)continue;if(Ne(i.eventsEndpoint)!==o)continue;let c=i.path?Ne(i.path):void 0;if(s&&c&&s!==c)continue;return!0}return!1}function fp(e,t){let r=Pa(t);if(!r)return e;if(Oa(e,r))return e;let n={type:"vault",lfv:{path:r.path,lfvServerUrl:r.lfvServerUrl,clientId:r.clientId,deliveryTimeout:r.deliveryTimeout,retryInterval:r.retryInterval,warnInterval:r.warnInterval,deliveryEndpoint:r.deliveryEndpoint,eventsEndpoint:r.eventsEndpoint,verifyJwks:r.verifyJwks}},o=e.secrets??{},s=Mn(o,{clientId:r.clientId,path:r.path});return{...e,secrets:{...o,[s]:n}}}function pp(e,t){let r=Pa(t);if(!r||Oa(e,r))return new Map;let n=Mn(e.secrets??{},{clientId:r.clientId,path:r.path});return new Map([[n,t.secret]])}function mp(e,t){let r=qo(e.secrets),n=qo(t.secrets??void 0);for(let[o,s]of Object.entries(n)){let i=r[o];if(!i)continue;let c=Ne(i.deliveryEndpoint),d=Ne(s.deliveryEndpoint);if(c&&d&&c!==d)throw Error(`LFV deliveryEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${c}, framework path: ${d}`);let u=Ne(i.eventsEndpoint),l=Ne(s.eventsEndpoint);if(u&&l&&u!==l)throw Error(`LFV eventsEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${u}, framework path: ${l}`)}}function gp(e){return new Set(Object.keys(e.secrets??{}))}function yp(e){return new Set(Object.keys(e.secrets??{}))}function hp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;if(!("outgoing"in t))return new Set;let r=t.outgoing;if(!r||typeof r!=="object"||Array.isArray(r))return new Set;return new Set(Object.keys(r))}function Ea(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function wp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;let r=t;if("incoming"in r||"outgoing"in r){let n=r.outgoing;if(!n||typeof n!=="object"||Array.isArray(n))return new Set;return new Set(Object.keys(n))}if(Ea(r))return new Set;return new Set(Object.keys(r).filter((n)=>n!=="default"))}function vp(e,t,r,n){let o=t.secrets??{},s=e.secrets??{};for(let[l,h]of Object.entries(o)){let p=s[l];if(!p)continue;if(h.type&&p.type&&h.type!==p.type)throw Error(`Secrets source "${l}" type in framework config must match ConfigSource type. ConfigSource type: ${p.type}, framework type: ${h.type}`)}let i=gp(t),c=yp(e);for(let l of i)if(!c.has(l)&&!n.has(l))r.warn(`Framework config declares secrets source "${l}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let l of c)if(!i.has(l))r.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:l});let d=hp(t),u=wp(e);for(let l of d)if(!u.has(l))r.warn(`Framework config declares outgoing workload client "${l}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(t.otel!==void 0&&t.otel!==null&&e.otel===void 0)r.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function va(e,t){if(t===void 0)return!1;return Mf(e,t)}function Sp(e,t){if(typeof t!=="number"||!Number.isFinite(t)||t<=0)return e;return new Promise((r,n)=>{let o=setTimeout(()=>{n(Error(`Ionite ready() timed out after ${t}ms`))},t);e.then(()=>{clearTimeout(o),r()},(s)=>{clearTimeout(o),n(s)})})}function kp(e,t,r){if(typeof t!=="number"||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>{o(Error(r))},t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function $o(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function vr(e){return e==="/"?e:e.replace(/\/+$/,"")}function _o(e,t){return vr(e)===vr(t)}function Sa(e){return e.method==="GET"||e.method==="HEAD"}function bp(e){if(e.isReady()&&e.config?.readyz?.enabled===!1)return ye();let t=e.readiness();return Response.json(Rp(t),{status:t.ok?200:503})}function Rp(e){let t=e.config.lastError;if(!t)return e;return{...e,config:{...e.config,lastError:{kind:t.kind,phase:t.phase,at:t.at,message:"[redacted]"}}}}var Tp={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","sso.claims_authz":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","ciam.claims_authz":"ciam","iam.users":"iam","iam.groups":"iam","iam.groups.create":"iam","iam.workloads":"iam","iam.customers":"iam","workload.incoming":"workload","workload.outgoing":"workload","workload.claims_authz":"workload","authz.oaa":"authz","authz.access_requests":"authz","tm.integration":"tm"};function Cp(e){let t=e?.providers;if(!t)return!1;return Object.values(t).some((r)=>r.enabled!==!1&&r.type!=="magic-link")}function Ip(e){return Boolean(e?.iam?.users?.assignment==="idp"&&e.sso?.accessRequests&&at(e.sso.claimsAsEntitlements))}function Pp(e){return Boolean(e?.iam?.customers?.assignment==="idp"&&Object.values(e.ciam?.providers??{}).some((t)=>t.enabled!==!1&&t.type!=="magic-link"&&t.accessRequests&&at(t.claimsAsEntitlements)))}function Te(e,t,r={}){let n=Tp[e],o=t.modules[n],s=r.capable??!0,i=o.active&&o.ready&&s,c=i?void 0:!o.active||!o.ready?o.reason:r.incapableReason??`${e} is not testable by this application wiring`;return{module:n,active:o.active,ready:o.ready,testable:i,...r.urls&&r.urls.length>0?{urls:r.urls}:{},...c?{reason:c}:{}}}function at(e){return Boolean(e?.claims&&e.claims.length>0)}function Op(e){if(!e||typeof e!=="object")return!1;let t=e;if(at(t.claimsAsEntitlements))return!0;let r=t.incoming;if(!r)return!1;if(Array.isArray(r))return r.some((n)=>at(n.claimsAsEntitlements));return at(r.claimsAsEntitlements)}function Lo(e,t,r,n){let o=Te(e,t,{capable:r&&n,incapableReason:r?"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted.":"claimsAsEntitlements is not configured for this plane."});if(!r)return{...o,active:!1,testable:!1,reason:"claimsAsEntitlements is not configured for this plane."};return o}function Ep(e,t,r){let n=Fe(t),o=e.readiness();return{sdk:{version:on,catalogVersion:Fr},basePath:t,urls:n,modules:o.modules,lfvCallbackTransport:Boolean(r.lfv?.callbackTransport),capabilities:{"sso.login":Te("sso.login",o,{urls:[n.sso.loginUrl,n.sso.callbackUrl,n.sso.userUrl]}),"sso.jit":Te("sso.jit",o,{capable:r.sso?.enableJitUserProvisioning!==!1&&Boolean(r.sso?.userStore),incapableReason:r.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":Te("sso.logout",o,{urls:[n.sso.logoutUrl]}),"sso.back_channel_logout":Te("sso.back_channel_logout",o,{urls:[n.sso.logoutBackChannelUrl]}),"sso.claims_authz":Lo("sso.claims_authz",o,at(e.config?.sso?.claimsAsEntitlements),r.sso?.sessionStore?.capabilities?.derivedEntitlements===!0),"ciam.magic_link":Te("ciam.magic_link",o,{capable:Boolean(r.ciam?.magicLinkStore)&&r.ciam?.enableJitUserProvisioning!==!1,urls:[n.ciam.magicLinkUrl,n.ciam.magicLinkLoginUrl],incapableReason:!r.ciam?.magicLinkStore?"CIAM magic-link is enabled but no magicLinkStore capability is wired by the application.":"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":Te("ciam.oidc_login",o,{capable:Cp(r.ciam),urls:[n.ciam.customerLoginUrl,n.ciam.customerCallbackUrl,n.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":Te("ciam.customer",o,{urls:[n.ciam.customerUrl]}),"ciam.logout":Te("ciam.logout",o,{urls:[n.ciam.logoutUrl]}),"ciam.claims_authz":Lo("ciam.claims_authz",o,Object.values(e.config?.ciam?.providers??{}).some((s)=>at(s.claimsAsEntitlements)),r.ciam?.sessionStore?.capabilities?.derivedEntitlements===!0),"iam.users":Te("iam.users",o,{capable:Boolean(r.iam?.userStore),urls:[n.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":Te("iam.groups",o,{capable:Boolean(r.authz?.catalogStore||r.authz?.catalog),urls:[n.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"iam.groups.create":Te("iam.groups.create",o,{capable:Boolean(r.authz?.catalogStore&&r.authz?.onInboundEntitlement),urls:[n.iam.groupsUrl],incapableReason:!r.authz?.catalogStore?"IAM-sourced entitlement creation requires an AccessCatalogStore.":"IAM-sourced entitlement creation requires the application to implement authz.onInboundEntitlement."}),"iam.workloads":Te("iam.workloads",o,{capable:Boolean(r.iam?.workloadIdentityStore),urls:[n.iam.workloadsUrl],incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."}),"iam.customers":Te("iam.customers",o,{capable:Boolean(r.iam?.customerStore),urls:[n.iam.customersUrl],incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."}),"workload.incoming":Te("workload.incoming",o,{urls:[n.workload.validateUrl,n.workload.jwksUrl]}),"workload.outgoing":Te("workload.outgoing",o,{}),"workload.claims_authz":Lo("workload.claims_authz",o,Op(e.config?.workload),!0),"authz.oaa":Te("authz.oaa",o,{capable:Boolean(r.authz?.accessStore&&(r.authz?.catalogStore||r.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."}),"authz.access_requests":Te("authz.access_requests",o,{capable:Ip(e.config)||Pp(e.config),incapableReason:"IdP access-request validation requires either iam.users.assignment='idp' with SSO accessRequests and claimsAsEntitlements, or iam.customers.assignment='idp' with an enabled non-magic-link CIAM provider carrying accessRequests and claimsAsEntitlements."}),"tm.integration":Te("tm.integration",o,{capable:Boolean(r.tm?.onConnectRequest&&r.tm.store.setIntegration&&r.tm.store.getByIntegrationHandleHash),urls:r.tm?[`${vr(r.tm.basePath)}/integrations/authorize`,`${vr(r.tm.basePath)}/integrations/redeem`,`${vr(r.tm.basePath)}/integrations/config-export`]:void 0,incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."})}}}async function Ap(e,t,r){if(!t.isReady())return $o();if(t.config?.capabilitiez!==!0||!r)return ye();let n=await fr(e,t,Ra["capabilitiez.read"]);if(n)return n;return Response.json(r.build(),{status:200})}async function _p(e){if(!e)return[];let t=[];for await(let r of Yt((n,o)=>e.list({start:n,limit:o})))t.push(r);return t}function xo(e,t){return[...new Set(e.filter((r)=>r.subjectType===t).map((r)=>typeof r.subject==="string"?r.subject:r.subject.id).filter((r)=>Boolean(r)))]}function Uo(e,t,r){if(!e)return;if(t==="all")return Yt((n,o)=>e.list({start:n,limit:o}));return async function*(){for(let o of r){let s=await e.get(o);if(s)yield s}}()}async function Lp(e,t,r){if(!t.isReady())return $o();if(t.config?.authz?.oaa?.fullSync?.enabled!==!0)return ye();let n=await fr(e,t,Ra["authz.oaa.sync"]);if(n)return n;let o=t.authz?.oaa;if(!o?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let s=t.authz?await t.authz.reconcile():void 0,i=r.iam?.userStore,c=r.iam?.customerStore??r.ciam?.customerStore,d=r.workload,u=r.iam?.workloadIdentityStore??(d&&"workloadIdentityStore"in d?d.workloadIdentityStore:d&&("incoming"in d)&&d.incoming&&!Array.isArray(d.incoming)&&("workloadIdentityStore"in d.incoming)?d.incoming.workloadIdentityStore:void 0),l=Wf(r.authz?.catalog?Ta(r.authz.catalog):void 0,r.authz?.catalogStore),h=r.authz?.accessStore,p=r.authz?.resources,k=await _p(h),q=await o.sync({users:Uo(i,o.population("user"),xo(k,"user")),customers:Uo(c,o.population("customer"),xo(k,"customer")),workloads:Uo(u,o.population("workload"),xo(k,"workload")),groups:l?Yt((_,b)=>l.groups.list({start:_,limit:b})):void 0,roles:l?Yt((_,b)=>l.roles.list({start:_,limit:b})):void 0,permissions:l?Yt((_,b)=>l.permissions.list({start:_,limit:b})):void 0,resources:p?Yt((_,b)=>p.list({start:_,limit:b})):void 0,access:k},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...q,reconcile:s})}function xp(e,t,r,n,o,s){return async(i)=>{let c=new URL(i.url).pathname;if(_o(c,r)){if(!Sa(i))return rt(["GET"]);return bp(e)}if(_o(c,n)){if(!Sa(i))return rt(["GET"]);return Ap(i,e,o)}if(s&&_o(c,s.url)){if(i.method!=="POST")return rt(["POST"]);return Lp(i,e,s.frameworkConfig)}let d=e.secrets;if(!Boolean(d?.isLfvDeliveryRequest?.(i)||d?.isLfvEventsRequest?.(i))&&!e.isReady())return $o();try{return await t(i)}catch(l){return e.log.error("ion.handler.unhandled",{"ion.operation":"handler","ion.outcome":"failure"},l),Kt(l)}}}function ka(e,t,r){if(e)return r&&!e.tenantId?{...e,tenantId:r}:e;if(t&&r)return{tenantId:r};return}function Up(e,t){if(t.authz===null)return;if(!e.authz&&!t.authz)return;return{...e.authz,...t.authz,oaa:e.authz?.oaa||t.authz?.oaa?{...e.authz?.oaa,...t.authz?.oaa}:void 0}}function Mo(e){let t=!1,r=me(`${e} module`,()=>t);return{isReady:r.isReady,ready:r.ready,attach(n){if(t=n!==void 0,r.refresh(),!n)return;return Object.defineProperty(n,"isReady",{value:r.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(n,"ready",{value:r.ready,enumerable:!1,configurable:!0}),n}}}function jo(e){if(!e)return!1;return e.isReady?e.isReady():!1}function Et(e,t,r,n){if(!e)return{active:!1,ready:!1,reason:r};return jo(t)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:n}}function Mp(){let e=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:e(),ciam:e(),iam:e(),workload:e(),otel:e(),secrets:e(),kms:e(),authz:e(),tm:e()}}function Aa(e,t,r){let n=e.isReady(),o=e.config;if(!n||!o)return{ok:!1,applied:n,modules:Mp(),config:{...t}};let s=Tn(r),i=Boolean(o.workload)||Boolean(e.workload),c={sso:Et(Boolean(o.sso),e.sso,"sso not configured (no RemoteConfig.sso)",s.sso??"sso configured but not ready"),ciam:Et(Boolean(o.ciam),e.ciam,"ciam not configured (no RemoteConfig.ciam)",s.ciam??"ciam configured but not ready"),iam:Et(Boolean(o.iam),e.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:Et(i,e.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:Et(Boolean(o.otel),e.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(o.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!jo(e.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return e.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:Et(Boolean(o.kms),e.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(o.authz?.oaa))return{active:!0,ready:!0};let l=e.authz?.oaa;return jo(l)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})(),tm:Et(o.tm?.enabled===!0&&Boolean(r.tm),e.tm,o.tm?.enabled===!0?"tm configured by RemoteConfig but FrameworkConfig.tm is not wired (this instance does not serve tenant management)":"tm not configured (no RemoteConfig.tm)","tm configured but not ready")};return{ok:Object.values(c).every((u)=>!u.active||u.ready),applied:n,modules:c,config:{...t}}}function Wp(e,t){let r=[];for(let n of t){let o=e.modules[n];if(!e.applied){r.push({name:n,reason:"RemoteConfig has not been applied yet"});continue}if(!o?.ready)r.push({name:n,reason:o?.reason??`${n} is not ready`})}return{ok:r.length===0,notReady:r}}function qp(e,t,r,n,o,s,i,c,d,u){let l=t.validators,h=Nf(e.cache);jf(h.jwks);let p=t;if(h.session.read.enabled){let oe=t.sso?.sessionStore??t.ciam?.sessionStore;if(oe){let K=uo(oe,h.session.read);p={...t,sso:t.sso?{...t.sso,sessionStore:K}:t.sso,ciam:t.ciam?{...t.ciam,sessionStore:K}:t.ciam}}}let k={sessionCache:h.session},q=st(l.workload,r,e?.workload,t.workload??void 0,void 0,u),_=t.otel!==null?Qn(r,e?.otel,t.otel??void 0,o):void 0,b=Tn(p);if(Object.keys(e).length>0){if(b.sso)r.error(b.sso);if(b.ciam)r.error(b.ciam)}let j=ka(e?.sso,t.sso,e.id),U=b.sso?void 0:Df(l.sso,r,j,p.sso??void 0,{...k,catalogView:u}),a={...e?.iam,...t.iam},w=t.authz?.catalog?Ta(t.authz.catalog):void 0,S=t.workload,M=S&&"workloadIdentityStore"in S?S.workloadIdentityStore:S&&("incoming"in S)&&S.incoming&&!Array.isArray(S.incoming)&&("workloadIdentityStore"in S.incoming)?S.incoming.workloadIdentityStore:void 0,F=Boolean(a.url||e.sso?.accessRequests||Object.values(e.ciam?.providers??{}).some((oe)=>oe.accessRequests)||a.userStore||t.authz?.catalogStore||w);i.update({...a.url?{iam:{url:a.url,...a.deltaAudience?{audience:a.deltaAudience}:{}}}:{},...e.sso?.accessRequests?{sso:e.sso.accessRequests}:{},ciam:Object.fromEntries(Object.entries(e.ciam?.providers??{}).flatMap(([oe,K])=>K.enabled!==!1&&K.accessRequests?[[oe,K.accessRequests]]:[]))},{workload:q});let Z=c.update({users:e?.iam?.users?.delta,workloads:e?.iam?.workloads?.delta,customers:e?.iam?.customers?.delta,url:a.url,audience:a.deltaAudience},{workload:q,workloadIdentityStore:M,userStore:a.userStore,customerStore:a.customerStore??p.ciam?.customerStore,accessStore:t.authz?.accessStore,catalogStore:t.authz?.catalogStore,codeCatalog:w,mapUserToScim:a.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:a.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:a.inboundWorkloads?.mapBaseWorkloadToScim}),Y;if(F&&!q){if(Object.keys(e).length>0)r.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");Y=void 0}else Y=$f(l.iam,r,q,s,t.authz?.accessStore,t.authz?.accessIndex,t.authz?.catalogStore,w,t.authz?.resources,e?.iam,t.iam??void 0,Z,t.authz?.onAccessMutation,t.authz?.onInboundEntitlement,Uf(e.authz),d);let ee=ka(e?.ciam,t.ciam,e.id),ae=b.ciam?void 0:qf(l.ciam,r,ee,p.ciam??void 0,q,{...k,catalogView:u});return{secret:n,workload:q,otel:_,sso:U,iam:Y,ciam:ae}}function _a(e,t,r,n,o,s,i,c){let d=s.authz.update(Up(t,r));e.id=t.id,e.config=t,e.secrets=s.secrets.update(t.secrets,r.secrets??void 0,r.validators.secrets,r.lfv?.callbackTransport,r.lfv?.singleProcess),e.kms=s.kms.update(t.kms,(k)=>{if(!k.source)return o;if(!e.secrets)throw Error(`KMS pool references unavailable secrets source "${k.source}".`);return e.secrets.getSecretsSource(k.source)});let u=qp(t,r,n,o,s.kms.handle(),d,s.accessRequests,s.iamDelta,s.authz.settle,()=>s.authz.catalogView());e.secret=u.secret,e.workload=s.workload.update(u.workload),e.otel=s.otel.update(u.otel),e.authz=d,e.log=s.log.update(e.otel?.logger??n),e.sso=s.sso.attach(u.sso),e.iam=s.iam.attach(u.iam),e.ciam=s.ciam.attach(u.ciam),e.tm=s.tm.update(t.tm?.enabled===!0&&r.tm?qi(e,t.tm,r.tm):void 0,r.tm!==void 0&&r.tm!==null);let l=Fe(i),h=(k)=>()=>Aa(e,e.configStatus,r).modules[k];ze(e.sso,h("sso"),l.sso),ze(e.ciam,h("ciam"),l.ciam),ze(e.iam,h("iam"),l.iam,()=>({accessRequests:s.accessRequests.handle().describe()})),ze(e.workload,h("workload"),l.workload),ze(e.secrets,h("secrets")),ze(e.kms,h("kms")),ze(e.otel,h("otel")),ze(e.authz,h("authz")),ze(e.tm,h("tm"));let p=(k)=>eo(k,e,c?.routing,l);e.handler=xp(e,p,l.readyzUrl,l.capabilitiezUrl,{build:()=>Ep(e,i,r)},{url:es(i),frameworkConfig:r})}function jp(e,t,r,n,o,s,i,c,d){np(e.id,t),op(t),sp(t),ip(t),ap(t),cp(t),dp(t),lp(t,r,n),mp(t,r),vp(t,r,n,c),_a(e,t,r,n,o,s,i,d)}function ba(e){if(!e.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return e.secret}async function $p(e,t,r,n,o,s,i){let c=e,d=ts(e,t,o.current,s);if(n.beforeChange){let u=Ca(d,o);i?.enter();let l;try{l=await n.beforeChange(e,u,r)}finally{i?.exit()}if(l?.config!==void 0)c=l.config;d=l?.frameworkConfig??u}return d=Zt(d,o.current),{effectiveRemoteConfig:c,effectiveFrameworkConfig:d}}function jh(e,t){let r=Vf(t),{frameworkConfig:n,basePath:o,readyTimeoutMs:s,stores:i,options:c}=r,d=pp(n,e),u=new Set(d.keys()),l=Zt(fp(n,e),i),h=l.log||Ao,p={current:i},k={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:l},q=Go(h),_=zn(h),b,j={log:Ff(h),secrets:Ei(h,d),kms:Zs(h),workload:Ji(h),otel:ni(h),authz:Ps(h,()=>_.handle(),()=>q.handle(),()=>b?.iam,()=>({mapUserToScim:k.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:k.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:k.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim})),accessRequests:q,iamDelta:_,sso:Mo("sso"),iam:Mo("iam"),ciam:Mo("ciam"),tm:Li()},U={},a,w,S=new Promise((R,W)=>{a=R,w=W}),M=!1,F,Z,Y=0,ee={enter:()=>{Y+=1},exit:()=>{Y-=1}},ae=Promise.resolve();function oe(R){let W=ae.then(R,R);return ae=W.then(()=>{return},()=>{return}),W}function K(R){if(M)throw Error(`Ionite instance has been closed and cannot call ${R}().`)}function Q(){e.log=k.frameworkConfig.log??Ao,e.validators=k.frameworkConfig.validators}let V={},D={log:h,id:void 0,config:void 0,secret:ba(e),authz:void 0,configStatus:U,handler:async()=>ye(),ready:(R)=>{if(Y>0&&k.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return Sp(S,R??s)},isReady:()=>k.remoteConfig!==void 0,readiness:()=>Aa(D,U,k.frameworkConfig),requireReady:(R)=>Wp(D.readiness(),R),describe:()=>{let R=D.readiness(),W={sso:Be(D.sso,R.modules.sso),ciam:Be(D.ciam,R.modules.ciam),iam:Be(D.iam,R.modules.iam),workload:Be(D.workload,R.modules.workload),otel:Be(D.otel,R.modules.otel),secrets:Be(D.secrets,R.modules.secrets),kms:Be(D.kms,R.modules.kms),authz:Be(D.authz,R.modules.authz),tm:Be(D.tm,R.modules.tm)};return ve({id:D.id,sdk:{version:on,catalogVersion:Fr},basePath:o,urls:Fe(o),ok:R.ok,applied:R.applied,config:{...U},modules:Object.fromEntries(Object.entries(R.modules).map(([y,O])=>[y,{...O,description:W[y]}]))})},close:()=>{if(M)return;if(M=!0,Z)clearTimeout(Z),Z=void 0;F?.(),F=void 0;let R=[()=>j.secrets.close(),()=>j.kms.close(),()=>j.authz.close(),()=>j.otel.shutdown()];for(let W of R)try{Promise.resolve(W()).catch((y)=>{h.warn("Ionite close: module teardown failed",y)})}catch(y){h.warn("Ionite close: module teardown failed",y)}a?.(),a=void 0,w=void 0},setStores:async(R)=>{K("setStores");let W=Or(R);await oe(()=>ce(W))}};b=D,_a(D,V,k.frameworkConfig,h,D.secret,j,o,c),Q();function te(){let R=U.lastError!==void 0;if(U.appliedAt=Date.now(),U.lastError=void 0,R)(D.log??h).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success"})}function re(R,W){let y=Wo(W)??(W instanceof Error?W.message:String(W)),O=Yf(W),L=U.lastError===void 0;if(U.lastError={kind:O,message:y,at:Date.now(),phase:R},L)(D.log??h).error(R==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":O,phase:R,error:y})}function ie(R,W,y){(D.log??h).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:R,"ion.config.hash":W,"ion.config.apply_ms":y})}async function se(R,W){if(M)return;let y=ha(R);if(W&&k.remoteConfig!==void 0&&y===k.remoteConfigHash&&va(R,k.remoteConfig))return;let O=k.remoteConfig,L=O===void 0?"initial":"update",C=Date.now(),m,f,E;try{let J=await $p(R,k.frameworkConfig,k.remoteConfig,c,p,o,ee);if(m=J.effectiveRemoteConfig,f=ha(m),E=J.effectiveFrameworkConfig,W&&c.beforeChange===void 0&&k.remoteConfig!==void 0&&f===k.remoteConfigHash&&va(m,k.remoteConfig)&&E===k.frameworkConfig)return;let G=E.log||Ao;jp(D,m,E,G,ba(e),j,o,u,c)}catch(J){throw re(L,J),J}k.remoteConfig=m,k.remoteConfigHash=f,k.frameworkConfig=E,Q(),te(),await j.otel.settled();let A=Ca(k.frameworkConfig,p),B=!1;try{c.afterChange?.(D,m,A,O)}catch(J){if((D.log??h).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:L,error:J instanceof Error?J.message:String(J)}),L==="initial"){B=!0;let G=J instanceof Error?J:Error(`afterChange failed on initial load: ${String(J)}`);re("initial",G),w?.(G),w=void 0,a=void 0}}if(k.frameworkConfig=A,Q(),!B)ie(L,f,Date.now()-C);if(!B&&a)a(),a=void 0}async function ce(R){if(M)return;if(p.current=R,k.remoteConfig===void 0){k.frameworkConfig=Zt(k.frameworkConfig,R),Q();return}await se(k.remoteConfig,!1)}if(e.subscribe)e.subscribe((R)=>{oe(()=>se(R,!0)).catch(()=>{})},{mode:"wait"}).then((R)=>{if(M){R?.();return}F=R}).catch((R)=>{h.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:R instanceof Error?R.message:String(R)})});let T=Qf(c.configRetry),g=[c.onConfigLoadError??tp(h)],P=0;function I(){if(Z=void 0,M)return;if(k.remoteConfig!==void 0)return;kp(e.load(),T.loadTimeoutMs,`ConfigSource initial load timed out after ${T.loadTimeoutMs}ms`).then(async(R)=>{P=0;try{await oe(async()=>{if(k.remoteConfig!==void 0)return;await se(R,!0)})}catch(W){let y=W instanceof Error?W:Error(`Initial RemoteConfig application failed: ${String(W)}`);h.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:y.message}),w?.(y),w=void 0}},async(R)=>{if(M)return;P+=1;let W=ep(P,T),y=Wo(R)??"RemoteConfig load failed",O=Jf(R),L=$e(R,"code"),C=$e(R,"status"),m={attempt:P,error:R,errorKind:O,maxDelayMs:T.maxDelayMs,message:y,nextDelayMs:W,code:typeof L==="string"?L:void 0,status:typeof C==="number"?C:void 0,path:typeof $e(R,"path")==="string"?$e(R,"path"):void 0,sourceType:typeof $e(R,"sourceType")==="string"?$e(R,"sourceType"):void 0};if(!Zf(R,O)){let f=R instanceof Error?R:Error(`ConfigSource initial load failed with unrecoverable ${O}: ${y}`);h.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:O,error:y,code:m.code,status:m.status,path:m.path,sourceType:m.sourceType}),w?.(f),w=void 0;return}try{await rp(m,g)}catch(f){let E=f instanceof Error?f:Error("ConfigSource retry hook stopped RemoteConfig retrying");w?.(E),w=void 0;return}Z=setTimeout(I,W)})}return I(),D}export{Kh as AssignmentPolicyError,Zh as CatalogAdjacencyCache,Ru as ION_CAPABILITY_CATALOG,Fr as ION_CAPABILITY_CATALOG_VERSION,Kf as ION_READY_DEFAULT_TIMEOUT_MS,on as ION_SDK_VERSION,De as InMemoryAccessAssignmentStore,kr as InMemoryAccessCatalogStore,Rr as InMemoryAccessIndex,Tr as InMemoryCustomerStore,Cr as InMemoryMagicLinkStore,br as InMemoryResourceStore,Ir as InMemorySessionStore,vw as InMemoryTenantStore,Pr as InMemoryUserStore,ya as InMemoryWorkloadIdentityStore,gt as InMemoryWorkloadTokenStore,Fh as IoniteError,Kr as ScimOutboundClient,Uw as TENANT_OWNER_PERMISSION,Yr as VAULT_MIN_POLLING_TTL_MS,hr as VaultConfigInvalidPayloadError,Pt as VaultConfigWaitingForSecretError,qe as VaultSubscribeNotSupportedError,Gh as allowHosts,Hh as allowOrigins,Jh as allowRelativePaths,Yh as allowSameOrigin,Ro as awsConfig,dn as azureConfig,Xh as blockDangerousUrls,Qh as callback,ew as captureRedirect,tw as ciam,Si as closeAllVaultSockets,rw as collectReferencedDefinitions,Po as configFromSource,pn as configLocatorFromEnvValues,ra as configSourceFromEnvValues,it as configSourceFromLocator,zn as createManagedIamDelta,me as createReadinessLatch,uo as createSessionReadCache,_f as createTenantIonHandler,Of as createTenantIonResolver,nw as defaultRedirectPolicies,Fe as deriveIonUrls,oc as devInMemoryStores,ow as discoverSessionRecords,sw as discoverSessions,fr as enforceEndpointAuthz,nf as envConfig,Vn as escapeScimFilterValue,iw as expandRoot,To as gcpConfig,Vh as generateULID,aw as getCustomer,cw as getOwnedTenantIds,gf as getSessionEntries,uw as getUser,El as getWorkload,Al as getWorkloadToken,dw as has,lw as hasAll,fw as hasAllScope,pw as hasAny,mw as hasAnyScope,gw as hasGroup,yw as hasPermission,hw as hasRole,ww as hasScope,Ct as hashIntegrationHandle,Sw as iam,sc as inMemoryAuthzDomains,bn as inMemoryAuthzStores,kw as initiateLogin,jh as ionite,bw as isRedirectAllowed,Bl as isVaultConfigInvalidPayloadError,zl as isVaultConfigWaitingForSecretError,St as lfvVault,zh as listGenerator,Rw as listSsoClientIdsFromCookies,vf as materializeTenantOwnerEntitlement,Co as mirrorSecrets,yr as mirroredConfig,Tw as planDiscoveredTenantCookies,Sf as purgeTenantEntitlements,Cw as reconcileSubjectAccess,Iw as resolveAfterRedirect,Pw as resolveCapturedRedirect,si as resolveDefaultRoute,Ow as resolveRedirect,ma as resolveTenantFromRequest,Ew as resolveTenantOwner,Aw as resolveTenantSession,Ll as revokeWorkloadToken,Ef as rewriteRequestForDefaultTenantApi,Af as rewriteRequestForDefaultTenantUi,Eo as rewriteRequestForTenantPath,ga as rewriteRequestPath,eo as routeRequest,_w as sameOriginRedirectRules,af as secretConfigSource,Lw as sendTenantWebhook,di as setVaultWebSocketCommandTimeout,xw as sso,ot as subscribeSecretPathWithHttpPolling,Mw as tenantAccessLoginUrl,bf as tenantMirror,Ww as tenantOwnerEntitlementId,qw as tenantOwnerPermission,jw as tenantResourceId,_l as validateWorkloadToken,zt as vault,ln as vaultConfig,vi as vaultSocketDiagnostics,$w as verifyUser,Nw as withSetCookies,st as workload,xl as workloadHandler};