@ionite/server 0.0.24-beta.20261007.23 → 0.0.24-beta.20261007.24
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +4 -1
- package/dist/index.js +2 -2
- package/package.json +2 -2
package/dist/index.js
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
import{configSourceOriginLogFields as pp,configTrustedClientGrants as mp,deepEqualPlain as gp,defaultLogger as No,ION_ENDPOINT_PERMISSIONS as Da,IoniteError as Ka,listGenerator as Xt,stableConfigHash as Ua,toCodeCatalog as Fa,unionCatalogRead as yp}from"@ionite/core";import{ciam as hp,configureJwksCache as wp,iam as Sp,resolveCacheConfig as vp,sso as kp}from"@ionite/core/server";import{ACCEPT_JSON as cc,CONTENT_TYPE_JSON as uc,IoniteError as bn,readJsonResponse as dc,trimTrailingSlash as lc,unexpectedBodySummary as fc}from"@ionite/core";function Rn(e,t){let r=()=>{if(!e.url)return"destination URL is not configured";if(!t.workload)return"workload identity is not configured";if(typeof t.workload.isReady!=="function"||typeof t.workload.ready!=="function")return"workload handle violates the readiness contract";if(!t.workload.isReady())return"workload module is not ready";if(e.audience){let i=t.workload[e.audience];if(!i)return`outgoing workload client "${e.audience}" is not configured`;if(typeof i.isReady!=="function"||typeof i.ready!=="function")return`outgoing workload client "${e.audience}" violates the readiness contract`;if(!i.isReady())return`outgoing workload client "${e.audience}" is not ready`}return},n=async()=>{let i=t.workload;if(!i)throw new bn("AccessRequests: workload identity is not configured",{status:500});if(e.audience)return i.getToken(e.audience);if(typeof i.getServerToken==="function")return i.getServerToken();return i.getToken()},o=async(i,c)=>{let d=r();if(d)throw new bn(`Cannot use AccessRequests: ${d}`,{status:503});let u=await(t.fetchImpl??fetch)(i,{...c,headers:{...cc,Authorization:`Bearer ${await n()}`,...c.body?uc:{},...c.headers}});if(!u.ok){let l=await fc(u);throw t.log.warn("AccessRequests destination returned an error",{"ion.operation":"authz.access_request","ion.outcome":"degraded",reason:"destination_error",status:u.status,contentType:l.contentType,excerpt:l.excerpt}),new bn(`AccessRequests failed: ${u.status}${l.excerpt?` ${l.excerpt}`:""}`,{status:500})}return dc(u,{log:t.log,operation:"authz.access_request"})},s=`${lc(e.url)}/AccessRequests`;return{notReadyReason:r,submit:(i)=>o(s,{method:"POST",body:JSON.stringify(i)}),get:(i)=>o(`${s}/${encodeURIComponent(i)}`,{method:"GET"})}}function os(e){let t=new Map,r={ciam:{}},n={channel:(o)=>t.get(o),ciamProviders:()=>[...t.keys()].filter((o)=>o.startsWith("ciam:")).map((o)=>o.slice(5)),describe:()=>structuredClone(r)};return{update(o,s){let i=new Map;if(o.iam)i.set("iam",Rn(o.iam,{...s,log:e}));if(o.sso)i.set("sso",Rn(o.sso,{...s,log:e}));for(let[c,d]of Object.entries(o.ciam??{}))i.set(`ciam:${c}`,Rn(d,{...s,log:e}));t=i,r={...o.iam?{iam:o.iam.url}:{},...o.sso?{sso:o.sso.url}:{},ciam:Object.fromEntries(Object.entries(o.ciam??{}).map(([c,d])=>[c,d.url]))}},handle:()=>n}}import{trimTrailingSlash as ds}from"@ionite/core";import{accessRefId as dt,accessRootId as ss,assertRequiredSubjectType as is,list as pc}from"@ionite/core";function Cn(e){let{createdAt:t,updatedAt:r,...n}=e;return n}class $e{constructor(){this.roots=new Map;this.byTarget=new Map;this.bySubject=new Map}static targetKey(e,t){return`${e}:${t}`}static subjectKey(e,t){return`${e}:${t}`}indexAdd(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}indexRemove(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}deindex(e){this.indexRemove(this.byTarget,$e.targetKey(e.targetType,dt(e.target)),e.id),this.indexRemove(this.bySubject,$e.subjectKey(e.subjectType,dt(e.subject)),e.id)}index(e){this.indexAdd(this.byTarget,$e.targetKey(e.targetType,dt(e.target)),e.id),this.indexAdd(this.bySubject,$e.subjectKey(e.subjectType,dt(e.subject)),e.id)}resolve(e,t){if(!e)return[];let r=[];for(let n of e){let o=this.roots.get(n);if(o&&(o.status??"active")==="active"&&t(o))r.push(o)}return r}async grant(e){is(e.subjectType,"Access change subjectType");let t=e.id??ss(e),r=new Date,n=this.roots.get(t);if(n)this.deindex(n);let o={...e,id:t,status:e.status??"active",createdAt:n?.createdAt??r,updatedAt:r};this.roots.set(t,o),this.index(o)}async revoke(e){let t=e.id??ss(e),r=this.roots.get(t);if(r)this.deindex(r);this.roots.delete(t)}async get(e){let t=this.roots.get(e);return t?Cn(t):void 0}async list(e){let t=Array.from(this.roots.values()).filter((r)=>(r.status??"active")==="active");return Tn(t,e)}async listByTarget(e,t,r){let n=t.trim(),o=this.byTarget.get($e.targetKey(e,n)),s=this.resolve(o,(i)=>i.targetType===e&&dt(i.target)===n);return Tn(s,r)}async listByTargets(e){let t=new Map;for(let{targetType:r,target:n}of e){let o=`${r}:${n}`;if(t.has(o))continue;let s=n.trim(),i=this.byTarget.get($e.targetKey(r,s)),c=this.resolve(i,(d)=>d.targetType===r&&dt(d.target)===s);t.set(o,c.map((d)=>Cn(d)))}return t}async listBySubject(e,t,r){is(t);let n=dt(e),o=this.bySubject.get($e.subjectKey(t,n)),s=this.resolve(o,(i)=>i.subjectType===t&&dt(i.subject)===n);return Tn(s,r)}}function Tn(e,t){let r=Math.max(0,t?.start??0),n=t?.limit,o=n!=null?r+n:void 0;return pc(e.length,e.slice(r,o).map(Cn),r,n)}import{assertValidSubjectTypeScoping as as,deepEqualPlain as mc,list as cs,readyCatalogEntry as In}from"@ionite/core";class Cr{constructor(){this.listeners=new Set;this.emit=(e)=>{for(let t of this.listeners)t(e)};this.groups=new Tr("group",this.emit);this.roles=new Tr("role",this.emit);this.permissions=new Tr("permission",this.emit)}afterChange(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}}class Ir{constructor(){this.items=new Map;this.listeners=new Set}async get(e){return this.items.get(e)}async list(e){let t=Array.from(this.items.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=n!=null?r+n:void 0;return cs(t.length,t.slice(r,o),r,n)}async children(e){return Array.from(this.items.values()).filter((t)=>(typeof t.parent==="string"?t.parent:t.parent?.id)===e)}changed(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}set(e){this.items.set(e.id,e),this.emitChange({id:e.id})}delete(e){if(!this.items.delete(e))return;this.emitChange({id:e,deleted:!0})}emitChange(e){for(let t of this.listeners)t(e)}}class Tr{constructor(e,t){this.kind=e;this.emit=t;this.items=new Map}async get(e){return this.items.get(e)}set(e){as(e);let t=this.items.get(e.id),r=!t||!mc(t,e);if(this.items.set(e.id,e),r)this.emit({op:"set",kind:this.kind,entity:e,previous:t});return In(e,Promise.resolve())}insertIfAbsent(e){as(e);let t=this.items.get(e.id);if(t)return In(t,Promise.resolve());return this.items.set(e.id,e),this.emit({op:"set",kind:this.kind,entity:e,previous:void 0}),In(e,Promise.resolve())}async delete(e){let t=this.items.get(e);if(!t)return;this.items.delete(e),this.emit({op:"delete",kind:this.kind,entity:t})}async list(e){let t=Array.from(this.items.values()),r=e?.filter?.requestable;if(r!==void 0)t=t.filter((i)=>Boolean(i.requestable)===r);let n=Math.max(0,e?.start??0),o=e?.limit,s=o!=null?n+o:void 0;return cs(t.length,t.slice(n,s),n,o)}}import{accessRefId as Xe,assertRequiredSubjectType as Lt}from"@ionite/core";function Ze(e,t){return`${t}:${e}`}function Pn(e,t,r){return`${e}:${t}:${r}`}function gc(e,t,r,n){return`${Pn(e,t,r)}:${n??""}`}class Pr{constructor(){this.rows=new Map;this.byTriple=new Map;this.byRoot=new Map;this.bySubject=new Map;this.edgeMeta=new Map;this.disabledSubjects=new Set}async has(e,t,r,n,o){Lt(o);let s=Xe(e),i=Xe(r);if(!s||!i)return{allow:!1};if(this.disabledSubjects.has(Ze(s,o)))return{allow:!1,metadata:{reason:"subject_disabled"}};let c=Pn(Ze(s,o),t,i),d=n?Xe(n):void 0;if(d===void 0){let y=this.byTriple.get(c);if(y&&y.size>0)return this.allow(s,o,t,i,void 0);return{allow:!1}}let u=`${c}:${d}`,l=`${c}:`;if(this.rows.has(u))return this.allow(s,o,t,i,d);if(this.rows.has(l))return this.allow(s,o,t,i,void 0);return{allow:!1}}async hasGroup(e,t,r,n){return this.has(e,"group",t,r,n)}async hasRole(e,t,r,n){return this.has(e,"role",t,r,n)}async hasPermission(e,t,r,n){return this.has(e,"permission",t,r,n)}async hasAny(e,t,r){for(let n of t){let o=await this.has(e,n.targetType,n.target,n.resource,r);if(o.allow)return o}return{allow:!1}}async hasAll(e,t,r){if(this.disabledSubjects.has(Ze(Xe(e),r)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(t.length===0)return{allow:!0};let n=[];for(let o of t){let s=await this.has(e,o.targetType,o.target,o.resource,r);if(!s.allow)return{allow:!1,matched:n};if(s.matched)n.push(...s.matched)}return{allow:!0,matched:n}}async materialize(e,t){this.removeRoot(e),this.addRootEdges(e,t)}async replaceSubject(e,t,r){let n=Ze(Xe(e),t),o=new Map;for(let s of r){Lt(s.subjectType,"Effective edge subjectType");let i=Ze(Xe(s.subject),s.subjectType);if(i!==n)throw Error(`AccessIndex.replaceSubject received an edge for ${i}; expected ${n}.`);let c=o.get(s.rootId);if(c)c.push(s);else o.set(s.rootId,[s])}this.clearSubjectEdges(n);for(let[s,i]of o)this.addRootEdges(s,i)}addRootEdges(e,t){let r=new Set;for(let n of t){Lt(n.subjectType,"Effective edge subjectType");let o=Ze(n.subject,n.subjectType),s=Pn(o,n.targetType,n.target),i=gc(o,n.targetType,n.target,n.resource);this.addToSet(this.rows,i,e),this.addToSet(this.byTriple,s,i),this.addToSet(this.bySubject,o,i),this.edgeMeta.set(i,{triple:s,subjectId:o}),r.add(i)}if(r.size>0)this.byRoot.set(e,r)}async removeByRoot(e){this.removeRoot(e)}removeRoot(e){let t=this.byRoot.get(e);if(!t)return;for(let r of t){let n=this.rows.get(r);if(!n)continue;if(n.delete(e),n.size===0)this.dropEdge(r)}this.byRoot.delete(e)}async listSubjects(){let e=[];for(let[t,r]of this.bySubject){if(r.size===0)continue;let n=t.indexOf(":");if(n<=0)throw Error(`AccessIndex subject key "${t}" is missing a subjectType prefix.`);let o=t.slice(0,n);Lt(o,"AccessIndex subject key subjectType"),e.push({subjectType:o,subject:t.slice(n+1)})}return e}async setSubjectDisabled(e,t,r){let n=Ze(Xe(e),t);if(r)this.disabledSubjects.add(n);else this.disabledSubjects.delete(n)}async isSubjectDisabled(e,t){return Lt(t),this.disabledSubjects.has(Ze(Xe(e),t))}async clear(e,t){if(e===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}Lt(t);let r=Xe(e);this.clearSubjectEdges(Ze(r,t))}clearSubjectEdges(e){let t=this.bySubject.get(e);if(!t)return;for(let r of[...t]){let n=this.rows.get(r);if(n)for(let o of n){let s=this.byRoot.get(o);if(s?.delete(r)&&s.size===0)this.byRoot.delete(o)}this.dropEdge(r)}}allow(e,t,r,n,o){return{allow:!0,matched:[{subject:e,subjectType:t,targetType:r,target:n,resources:o?[o]:void 0}]}}addToSet(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}dropEdge(e){this.rows.delete(e);let t=this.edgeMeta.get(e);if(t)this.removeFromSet(this.byTriple,t.triple,e),this.removeFromSet(this.bySubject,t.subjectId,e);this.edgeMeta.delete(e)}removeFromSet(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}}import{list as yc,matchesListFilter as hc}from"@ionite/core";class Or{constructor(){this.customers=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.customers.get(e)}async lookup(e){if(e.id){let t=this.customers.get(e.id);if(t)return t}if(e.userName){let t=this.userNameIndex.get(e.userName.toLowerCase());if(t)return this.customers.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.customers.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n={...e,id:t,createdAt:this.customers.get(t)?.createdAt??e.createdAt??r,updatedAt:r},o=this.customers.get(t);if(o){if(o.userName&&o.userName.toLowerCase()!==n.userName?.toLowerCase())this.userNameIndex.delete(o.userName.toLowerCase());if(o.externalId&&o.externalId!==n.externalId)this.externalIdIndex.delete(o.externalId)}if(this.customers.set(t,n),n.userName)this.userNameIndex.set(n.userName.toLowerCase(),t);if(n.externalId)this.externalIdIndex.set(n.externalId,t);return n}async delete(e){let t=this.customers.get(e);if(t?.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.customers.delete(e),t?1:0}async list(e){let t=Array.from(this.customers.values()).filter((c)=>hc(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return yc(o,i,r,n)}}class Er{constructor(){this.magicLinks=new Map}async create(e,t,r){if(this.magicLinks.has(e))throw Error(`Magic link with token ${e} already exists`);let n={token:e,customer:t,createdAt:new Date,expiresAt:r};this.magicLinks.set(e,n)}async get(e){let t=this.magicLinks.get(e);if(!t)return null;if(Date.now()>t.expiresAt.getTime())return this.magicLinks.delete(e),null;return t}async getAndDelete(e){let t=this.magicLinks.get(e);if(this.magicLinks.delete(e),!t)return null;if(Date.now()>t.expiresAt.getTime())return null;return t}async delete(e){this.magicLinks.delete(e)}}function wc(e){let t=e.expiresAt;if(!t)return;let r=t instanceof Date?t.getTime():new Date(t).getTime();return Number.isNaN(r)?void 0:r}class Ar{constructor(){this.capabilities={derivedEntitlements:!0};this.sessions=new Map}async create(e){if(this.sessions.has(e.sid))throw Error(`Session with sid ${e.sid} already exists`);this.sessions.set(e.sid,e)}async get(e){let t=this.sessions.get(e);if(!t)return null;let r=wc(t);if(r!==void 0&&Date.now()>r)return this.sessions.delete(e),null;return t}async update(e,t){let r=this.sessions.get(e);if(!r)throw Error(`Session with sid ${e} not found`);let n={...r,...t};this.sessions.set(e,n)}async delete(e){this.sessions.delete(e)}}import{list as Sc,StoreConflictError as vc}from"@ionite/core";class _r{constructor(){this.users=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.users.get(e)}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.users.get(t):void 0}async lookup(e){return this.users.get(e.id??"")}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r={...e,id:t},n=this.users.get(t),o=r.externalId?this.externalIdIndex.get(r.externalId):void 0;if(o&&o!==t)throw new vc(`externalId "${r.externalId}" is already in use`,"unique_violation","externalId");if(n){if(n.userName&&n.userName.toLowerCase()!==r.userName?.toLowerCase())this.userNameIndex.delete(n.userName.toLowerCase());if(n.externalId&&n.externalId!==r.externalId)this.externalIdIndex.delete(n.externalId)}if(this.users.set(t,r),r.userName)this.userNameIndex.set(r.userName.toLowerCase(),t);if(r.externalId)this.externalIdIndex.set(r.externalId,t);return r}async delete(e){let t=this.users.get(e);if(t){if(t.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t.externalId)this.externalIdIndex.delete(t.externalId)}return this.users.delete(e),t?1:0}async list(e){let t=Array.from(this.users.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return Sc(o,i,r,n)}}class yt{constructor(){this.tokens=new Map}async set(e){this.tokens.set(e.workload_id,e)}async get(e){let t=this.tokens.get(e);if(!t)return null;if(Date.now()>t.expires_at.getTime())return this.tokens.delete(e),null;return t}async delete(e){this.tokens.delete(e)}async isValid(e){return await this.get(e)!==null}async cleanup(){let e=Date.now();for(let[t,r]of this.tokens.entries())if(e>r.expires_at.getTime())this.tokens.delete(t)}}function Fe(e){let t=ds(e||En);return{readyzUrl:`${t}/readyz`,capabilitiezUrl:`${t}/capabilitiez`,sso:{loginUrl:`${t}/auth/login`,userUrl:`${t}/auth/user`,logoutUrl:`${t}/auth/logout`,logoutBackChannelUrl:`${t}/auth/logout/backchannel`,refreshUrl:`${t}/auth/refresh`,callbackUrl:`${t}/auth/callback`},workload:{validateUrl:`${t}/workload/validate`,jwksUrl:`${t}/workload/jwks`},iam:{basePath:`${t}/iam`,usersUrl:`${t}/iam/Users`,groupsUrl:`${t}/iam/Groups`,workloadsUrl:`${t}/iam/Workloads`,customersUrl:`${t}/iam/Customers`},ciam:{magicLinkUrl:`${t}/magic-link`,magicLinkLoginUrl:`${t}/magic-link/login`,customerUrl:`${t}/auth/customer`,customerLoginUrl:`${t}/auth/customer/login`,customerCallbackUrl:`${t}/auth/customer/callback`,customerProvidersUrl:`${t}/auth/customer/providers`,logoutUrl:`${t}/auth/customer/logout`}}}function ls(e){return`${ds(e||En)}/authz/oaa/sync`}function kc(e,t){if(e===null)return null;let r={validateUrl:t.validateUrl,jwksUrl:t.jwksUrl};if(e&&typeof e==="object"&&(("incoming"in e)||("outgoing"in e))){let n=e;return{...n,incoming:{...n.incoming,...r}}}return{...e??{},...r}}function fs(e,t,r,n){let o={...t},s=Fe(n);if(o.sso!==null)if(e.sso)o.sso={...o.sso,loginUrl:s.sso.loginUrl,userUrl:s.sso.userUrl,logoutUrl:s.sso.logoutUrl,logoutBackChannelUrl:s.sso.logoutBackChannelUrl,refreshUrl:s.sso.refreshUrl,redirectUri:s.sso.callbackUrl,sessionStore:r.sessionStore??o.sso?.sessionStore,userStore:r.userStore??o.sso?.userStore,enableJitUserProvisioning:o.sso?.enableJitUserProvisioning??!0};else o.sso=void 0;if(o.iam!==null)if(e.iam)o.iam={...o.iam,usersUrl:s.iam.usersUrl,groupsUrl:s.iam.groupsUrl,workloadsUrl:s.iam.workloadsUrl,customersUrl:s.iam.customersUrl,userStore:r.userStore??o.iam?.userStore,workloadIdentityStore:r.workloadIdentityStore??o.iam?.workloadIdentityStore,customerStore:r.customerStore??o.iam?.customerStore};else o.iam=void 0;if(o.workload!==null){if(e.workload||o.workload)o.workload=kc(o.workload,s.workload)}if(o.ciam!==null)if(e.ciam)o.ciam={...o.ciam,magicLinkUrl:s.ciam.magicLinkUrl,magicLinkLoginUrl:s.ciam.magicLinkLoginUrl,customerUrl:s.ciam.customerUrl,customerLoginUrl:s.ciam.customerLoginUrl,customerCallbackUrl:s.ciam.customerCallbackUrl,customerProvidersUrl:s.ciam.customerProvidersUrl,logoutUrl:s.ciam.logoutUrl,providers:e.ciam.providers,sessionStore:r.sessionStore??o.ciam?.sessionStore,customerStore:r.customerStore??o.ciam?.customerStore,magicLinkStore:r.magicLinkStore??o.ciam?.magicLinkStore,enableJitUserProvisioning:o.ciam?.enableJitUserProvisioning??!0};else o.ciam=void 0;return o}function Qt(e,t){let r={...e};if(r.sso)r.sso={...r.sso,sessionStore:t.sessionStore??r.sso.sessionStore,userStore:t.userStore??r.sso.userStore};if(r.iam)r.iam={...r.iam,userStore:t.userStore??r.iam.userStore};if(r.workload){let n=r.workload;r.workload={...r.workload,tokenStore:t.workloadTokenStore??n.tokenStore,workloadIdentityStore:t.workloadIdentityStore??n.workloadIdentityStore}}if(r.ciam)r.ciam={...r.ciam,sessionStore:t.sessionStore??r.ciam.sessionStore,customerStore:t.customerStore??r.ciam.customerStore,magicLinkStore:t.magicLinkStore??r.ciam.magicLinkStore};if(r.authz!==null&&(t.accessStore||t.accessIndex||t.catalog||t.catalogStore||t.resources)){let n=r.authz;r.authz={...n,accessStore:t.accessStore??n?.accessStore,accessIndex:t.accessIndex??n?.accessIndex,catalog:t.catalog??n?.catalog,catalogStore:t.catalogStore??n?.catalogStore,resources:t.resources??n?.resources}}return r}var En="/api/ionite";function Lr(e){return{...e}}function bc(){return{sessionStore:new Ar,userStore:new _r,customerStore:new Or,magicLinkStore:new Er,workloadTokenStore:new yt}}function On(){return{catalogStore:new Cr,accessStore:new $e,accessIndex:new Pr,resources:new Ir}}function Rc(){let e=On(),t=new Map;return(r)=>{if(!r)return e;let n=t.get(r);if(!n)n=On(),t.set(r,n);return n}}function us(e,t){return`${e} is enabled by RemoteConfig but is not served: missing ${t.join(", ")}. Provide durable stores in ionite({ stores }) (e.g. @ionite/redis or app-owned SQL stores), or opt into stores: devInMemoryStores() for prototypes only (state is lost on restart).`}function An(e){let t={};if(e.sso&&!e.sso.sessionStore)t.sso=us("SSO",["stores.sessionStore"]);if(e.ciam){let r=[];if(!e.ciam.sessionStore)r.push("stores.sessionStore");if(!e.ciam.customerStore)r.push("stores.customerStore");if(r.length>0)t.ciam=us("CIAM",r)}return t}function xr(){return En}import{AssignmentPolicyError as nr,accessRefId as mt,accessRootId as jn,assertRequiredSubjectType as $r,catalogEntityStore as su,configTrustedClientGrants as iu,deepEqualPlain as au,deprecateRetiredCodeCatalogRows as cu,getCodeCatalogEntity as uu,IoniteError as tt,list as Ms,listGenerator as Nn,materializeCodeCatalogEntity as du,toCodeCatalog as lu,unionCatalogRead as qs}from"@ionite/core";import{assertSubjectTypeAssignable as fu,CatalogAdjacencyCache as pu,expandRoot as Ws,reconcileSubjectAccess as mu}from"@ionite/core/server";var ps=Symbol("ionite.describe.overlay");function Se(e){if(Array.isArray(e))return e.map((t)=>Se(t));if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,Se(r)]))}function ms(e,t,r,n){return Se({...e,...n,active:t.active,ready:t.ready,...r?{urls:r}:{}})}function gs(e){return e[ps]}function Ve(e,t,r,n){if(!e)return;let o=gs(e)??{base:e.describe.bind(e)};o.urls=r,o.extra=n,Object.defineProperty(e,ps,{value:o,enumerable:!1,configurable:!0}),Object.defineProperty(e,"describe",{value:()=>ms(o.base(),t(),o.urls,o.extra?.()),enumerable:!1,configurable:!0})}function ze(e,t){if(!e)return;let r=gs(e);return r?ms(r.base(),t,r.urls,r.extra?.()):Se(e.describe())}import{ACCEPT_JSON as vs,accessRefId as Oe,accessRootId as Cc,CONTENT_TYPE_JSON as ks,customAttributes as er,DEFAULT_RISK_LEVEL as Un,ION_AUTHZ_GROUP_SCHEMA as Ic,ION_SCIM_USER_EXTENSION_URN as ys,IoniteError as Pc,KNOWN_ENTITLEMENT_KEYS as tr,mergeCodeCatalogEntity as Oc}from"@ionite/core";import{baseCustomerToScim as Ec,baseUserToScimUser as Ac,baseWorkloadToScim as _c,collectReferencedDefinitions as Lc}from"@ionite/core/server";import{IoniteError as Tc}from"@ionite/core";function me(){return Response.json({error:"not_found"},{status:404})}function Be(e=["GET"]){return Response.json({error:"method_not_allowed",allow:e},{status:405,headers:{Allow:e.join(", ")}})}function Qe(e){return e===408||e===429||e===503||e===504?503:500}async function Ur(e,t,r){try{return await r()}catch(n){let o=Tc.from(n,{ionId:e.id,log:e.log}),s={...o.toLogAttributes(),"ion.operation":t,"ion.outcome":"failure"},i=o.log??e.log;if(o.statusText)i.warn("ion.handler.unhandled",s,o);else i.error("ion.handler.unhandled",s,o);return o.response()}}function ye(e,t,r=(n)=>Error(`${e} ready timed out after ${n}ms`)){let n=!1,o,s,i=()=>{n=!1,s=new Promise((u)=>{o=u})};i();let c=()=>{n=!0,o?.(),o=void 0},d=()=>{if(t()){if(!n)c();return}if(n)i()};return d(),{isReady:()=>t(),ready:(u)=>{if(t())return Promise.resolve();let l=s;if(!u||u<=0)return l;return new Promise((y,p)=>{let b=setTimeout(()=>p(r(u)),u);l.then(()=>{clearTimeout(b),y()},(M)=>{clearTimeout(b),p(M)})})},refresh:d,settle:c}}var bs="App",xc="ionite",Rs=104857600,Uc=Rs,Mc=10485760,_n=3,qc=250,Wc={};function pt(e,t){return t.mapGroup?t.mapGroup(e):e}class et extends Pc{constructor(e,t={}){super(e,{cause:t.cause,status:Qe(t.upstreamStatus),upstreamStatus:t.upstreamStatus});this.retryable=t.retryable??!1,this.code=t.code,this.warnings=t.warnings}}function jc(e){let t=e();return Boolean(t?.url&&t.providerId&&t.datasourceId)}function Ts(e,t,r,n=()=>({}),o=()=>{return},s,i){let c=async(u)=>{await Ss(e,be(t),u,{mode:"incremental"})},d=ye("OAA",()=>jc(t),(u)=>new et(`OAA ready timed out after ${u}ms`,{code:"not_ready"}));return{describe:()=>{let u=t();return Se({ready:d.isReady(),url:u?.url,providerId:u?.providerId,datasourceId:u?.datasourceId,applicationName:u?.applicationName,applicationType:u?.applicationType,population:{users:Ut(u,"user"),customers:Ut(u,"customer"),workloads:Ut(u,"workload")},fullSync:u?.fullSync?.enabled===!0})},isReady:d.isReady,ready:d.ready,refreshReadiness:d.refresh,population(u){return Ut(t(),u)},async pushUser(u){let l=be(t);if(!await Ln(l,"user",Oe(u),o()))return;let y=await Is(u,n());await c(Ie(l,{local_users:[Mt(y,"user","modify")]},!0))},async pushCustomer(u){let l=be(t);if(!await Ln(l,"customer",Oe(u),o()))return;let y=await Ps(u,n());await c(Ie(l,{local_users:[Mt(y,"customer","modify")]},!0))},async pushWorkload(u){let l=be(t);if(!await Ln(l,"workload",Oe(u),o()))return;let y=await Os(u,n());await c(Ie(l,{local_users:[Mt(y,"workload","modify")]},!0))},async pushGroup(u){let l=be(t),y=r(),p=pt(u,y),b=Wr(p,ft(l),"add"),M=await xn(p,"group",i?.(),y,l);await c(Ie(l,rr({local_groups:[ht(p,"modify")],identity_to_permissions:b?[b]:[]},M),!0))},async pushRole(u){let l=be(t),y=r(),p=y.mapRole?y.mapRole(u):u,b=await xn(p,"role",i?.(),y,l);await c(Ie(l,rr({local_roles:[wt(p,"modify")]},b),!0))},async pushPermission(u){let l=be(t);await c(Ie(l,{permissions:[qt(u,r().mapPermissionTypes,"modify")]},!0))},async pushResource(u){let l=be(t),y=r(),p=y.mapResource?y.mapResource(u):u,b=await Bc(p,i?.(),y);await c(Ie(l,{resources:b},!0))},async grant(u){let l=be(t),y=r(),p=await Cs(u,i?.(),y,l);await c(hs(l,u,"add",y,p))},async revoke(u){let l=be(t);await c(hs(l,u,"delete",r()))},async pushAccessChanges(u){if(u.length===0)return;let l=be(t),y=r(),p=i?.(),b=await $c(l,u,y,p);await c(b)},async deleteUser(u){let l=be(t);await c(Ie(l,{local_users:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deleteCustomer(u){let l=be(t);await c(Ie(l,{local_users:[ws(u,"customer")]},!0))},async deleteWorkload(u){let l=be(t);await c(Ie(l,{local_users:[ws(u,"workload")]},!0))},async deleteGroup(u){let l=be(t);await c(Ie(l,{local_groups:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deleteRole(u){let l=be(t);await c(Ie(l,{local_roles:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deletePermission(u){let l=be(t);await c(Ie(l,{permissions:[{name:u,unique_id:u,permission_type:[],operation:"delete"}]},!0))},async deleteResource(u){let l=be(t);await c(Ie(l,{resources:[{name:u,id:u,resource_type:"",operation:"delete"}]},!0))},async sync(u,l){let y=be(t),p=l?.mode==="incremental",b=p?void 0:s?.(),M=await Nc(y,u,r(),n(),p,b);return Ss(e,y,M,l)}}}function be(e){let t=e();if(!t?.url||!t.providerId||!t.datasourceId)throw new et("OAA is not configured",{code:"not_configured"});return t}async function Nc(e,t,r,n,o,s){let i=[],c=[],d=[],u=[],l=[],y=[],p=o?"modify":void 0,b=new Set,M=[],_=new Set,R=(a)=>Cc(a);for await(let a of lt(t.access))M.push(a),_.add(`${a.subjectType}:${Oe(a.subject)}`);let W=(a,w)=>Ut(e,a)==="all"||Boolean(w&&_.has(`${a}:${w}`));for await(let a of lt(t.users))if(W("user",Oe(a)))i.push(Mt(await Is(a,n),"user",p));for await(let a of lt(t.customers))if(W("customer",Oe(a)))i.push(Mt(await Ps(a,n),"customer",p));for await(let a of lt(t.workloads))if(W("workload",Oe(a)))i.push(Mt(await Os(a,n),"workload",p));for await(let a of lt(t.groups)){let w=pt(a,r);c.push(ht(w,p));let v=Wr(w,ft(e),o?"add":void 0);if(v)y.push(v)}for await(let a of lt(t.roles)){let w=r.mapRole?r.mapRole(a):a;l.push(wt(w,p))}for await(let a of lt(t.permissions))u.push(qt(a,r.mapPermissionTypes,p));let q=[];for await(let a of lt(t.resources)){let w=r.mapResource?r.mapResource(a):a;q.push(w)}d.push(...As(q,p));for(let a of M)if(b.add(R(a)),qr(a,y,i,ft(e),o?"add":void 0),typeof a.target!=="string")if(a.targetType==="role"){let w=r.mapRole?r.mapRole(a.target):a.target;l.push(wt(w,p))}else if(a.targetType==="permission")u.push(qt(a.target,r.mapPermissionTypes,p));else{let w=pt(a.target,r);c.push(ht(w,p))}for(let a of s??[]){let w=R(a);if(b.has(w))continue;b.add(w);let v=Oe(a.subject);if(v&&!i.some((L)=>Oe(L.unique_id??L.name)===v))i.push({name:v,unique_id:v,is_active:!0,operation:p,custom_properties:{identity_type:"workload",source:"eci-trusted"}});qr(a,y,i,ft(e),p)}return Ie(e,{local_users:i,local_groups:c,local_roles:l,resources:d,permissions:u,identity_to_permissions:y},o)}function Ie(e,t,r){let n={name:e.applicationName??bs,application_type:e.applicationType??xc,local_users:t.local_users??[],local_groups:t.local_groups??[],local_roles:t.local_roles??[],resources:t.resources??[],custom_properties:{},tags:[]};if(r)n.operation="modify";return Ae({applications:[n],permissions:t.permissions??[],identity_to_permissions:t.identity_to_permissions??[],is_incremental:r?!0:void 0})}function hs(e,t,r,n=Wc,o){let s=[],i=[],c=[],d=[],u=[];qr(t,s,i,ft(e),r);let l=r==="delete"?"delete":"modify";if(typeof t.target!=="string")if(t.targetType==="role"){let p=n.mapRole?n.mapRole(t.target):t.target;d.push(wt(p,l))}else if(t.targetType==="permission")u.push(qt(t.target,n.mapPermissionTypes,l));else{let p=pt(t.target,n);c.push(ht(p,l))}let y={local_users:i,local_groups:c,local_roles:d,permissions:u,identity_to_permissions:s};return Ie(e,o?rr(y,o):y,!0)}async function $c(e,t,r,n){let o=ft(e),s=[],i=[],c=[],d=[],u=[],l=[],y=[],p=[];for(let{change:M,op:_}of t){qr(M,_==="delete"?d:i,_==="delete"?c:s,o,_==="delete"?"delete":"add");let a=_==="delete"?"delete":"modify";if(typeof M.target!=="string")if(M.targetType==="role"){let w=r.mapRole?r.mapRole(M.target):M.target;l.push(wt(w,a))}else if(M.targetType==="permission")y.push(qt(M.target,r.mapPermissionTypes,a));else{let w=pt(M.target,r);u.push(ht(w,a))}if(_==="add")p.push(await Cs(M,n,r,e))}let b={local_users:[...s,...c],local_groups:u,local_roles:l,permissions:y,identity_to_permissions:[...i,...d]};return Ie(e,rr(b,...p),!0)}function rr(...e){let t={},r=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let n of e)for(let o of r){let s=n[o];if(s&&s.length>0)t[o]=[...t[o]??[],...s]}return t}async function xn(e,t,r,n,o){if(!r)return{};let s=await Lc(e,t,{catalog:r.catalog,code:r.code,resources:r.resources,cache:r.cache}),i=[];for(let c of s.groups){let d=pt(c,n),u=Wr(d,ft(o),"add");if(u)i.push(u)}return{local_groups:s.groups.map((c)=>ht(pt(c,n),"modify")),local_roles:s.roles.map((c)=>wt(n.mapRole?n.mapRole(c):c,"modify")),permissions:s.permissions.map((c)=>qt(c,n.mapPermissionTypes,"modify")),resources:s.resources.map((c)=>jr(n.mapResource?n.mapResource(c):c,"modify")),identity_to_permissions:i}}async function Cs(e,t,r,n){if(!t)return{};if(e.targetType!=="group"&&e.targetType!=="role")return{};let o=Oe(e.target);if(!o)return{};let s=typeof e.target==="string"?await Dc(e.targetType,o,t):e.target;if(!s)return{};let i={};if(typeof e.target==="string")if(e.targetType==="group"){let d=pt(s,r),u=Wr(d,ft(n),"add");i={local_groups:[ht(d,"modify")],identity_to_permissions:u?[u]:[]}}else{let d=r.mapRole?r.mapRole(s):s;i={local_roles:[wt(d,"modify")]}}let c=await xn(s,e.targetType,t,r,n);return rr(i,c)}async function Dc(e,t,r){if(r.cache)return await r.cache.getNode(e,t);let n=e==="group"?r.code?.groups.get(t):r.code?.roles.get(t),s=await(e==="group"?r.catalog?.groups:r.catalog?.roles)?.get(t);return s&&n?Oc(e,n,s):s??n}function qr(e,t,r,n,o){let s=Oe(e.subject),i=Oe(e.target),c=r.find((y)=>Oe(y.unique_id??y.name)===s);if(e.subjectType!=="user")if(c)c.custom_properties={...c.custom_properties,identity_type:e.subjectType};else c={name:s,unique_id:s,custom_properties:{identity_type:e.subjectType},operation:o},r.push(c);if(e.targetType==="group"){if(c){let y=new Set(c.groups??[]);if(y.add(i),c.groups=[...y],o)c.operation=o}else r.push({name:s,unique_id:s,groups:[i],operation:o});return}let d={identity:s,identity_type:"local_user",operation:o},u=e.resources??[],l=e.applyToApplication??u.length===0;if(e.targetType==="role")d.role_assignments=[{application:n,role:i,apply_to_application:l,resources:u,operation:o}];else d.application_permissions=[{application:n,permission:i,apply_to_application:l,resources:u,operation:o}];t.push(d)}async function Is(e,t){let r=await(t.mapUserToScim?.(e)??Ac(e));return{...r,id:r.id??e.id}}async function Ps(e,t){let r=await(t.mapCustomerToScim?.(e)??Ec(e));return{...r,id:r.id??e.id}}async function Os(e,t){let r=await(t.mapWorkloadToScim?.(e)??_c(e));return{...r,id:r.id??e.id}}function Mt(e,t,r){let{schemas:n,id:o,displayName:s,userName:i,active:c,emails:d,groups:u,meta:l,attributes:y,...p}=e,b=p[ys];delete p[ys];let M=b&&typeof b==="object"?b.attributes:void 0,_=t==="user"?M:y,R=xt(o)??xt(e.externalId)??xt(i)??"principal";return Ae({name:xt(s)??xt(i)??R,unique_id:R,identities:t==="customer"?void 0:Kc(e),groups:t==="user"&&Array.isArray(u)?u.map((W)=>typeof W==="string"?W:he(W,"value")).filter((W)=>Boolean(W)):void 0,is_active:typeof c==="boolean"?c:void 0,created_at:l&&typeof l==="object"?he(l,"created"):void 0,custom_properties:Ae({...p,..._&&typeof _==="object"?_:{},ecid:t==="customer"?void 0:Es(e),accountClass:Fc(e),externalId:e.externalId,userName:i,emails:d,identity_type:t==="user"?void 0:t}),tags:[],operation:r})}function Kc(e){let t=Es(e),r=e.emails,n=Array.isArray(r)?r.map((s)=>s&&typeof s==="object"?he(s,"value"):void 0).filter((s)=>Boolean(s)):[],o=[...t?[t]:[],...n];return o.length>0?o:void 0}function Es(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return xt(e.ecid)??(t&&typeof t==="object"?he(t,"ecid"):void 0)}function Fc(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return t&&typeof t==="object"?he(t,"accountClass"):void 0}function ws(e,t){return{name:e,unique_id:e,custom_properties:{identity_type:t},operation:"delete"}}function ht(e,t){let r=Vc(e),n=he(e,"id")??he(e,"name")??he(e,"displayName"),o=he(e,"displayName")??he(e,"name")??n??"group",s=Mr(e,"resources");return Ae({name:o,unique_id:n,custom_properties:Ae({...r?.attributes??er(e,tr),requestable:r?.requestable??ru(e,"requestable"),description:r?.description??he(e,"description"),type:r?.type,resources:s.length>0?s:void 0,riskLevel:r?.riskLevel??he(e,"riskLevel")??Un}),tags:[],operation:t})}function Vc(e){let t=e[Ic];if(!t||typeof t!=="object"||Array.isArray(t))return;return t}function Mr(e,t){if(!e||typeof e!=="object")return[];let r=e[t];if(!Array.isArray(r))return[];return r.map(Oe).filter((n)=>n.length>0)}function zc(e){return he(e,"id")??he(e,"name")??he(e,"displayName")??"group"}function Wr(e,t,r){let n=Mr(e,"resources"),o=n.length>0,s=!o,i=o?n:[],c=Mr(e,"roles").map((u)=>({application:t,role:u,apply_to_application:s,resources:i,operation:r})),d=Mr(e,"permissions").map((u)=>({application:t,permission:u,apply_to_application:s,resources:i,operation:r}));if(c.length===0&&d.length===0)return;return{identity:zc(e),identity_type:"local_group",role_assignments:c.length>0?c:void 0,application_permissions:d.length>0?d:void 0,operation:r}}function wt(e,t){return Ae({name:e.name,unique_id:e.id,permissions:e.permissions?.map((r)=>typeof r==="string"?r:r.id),custom_properties:Ae({...er(e,tr),displayName:e.displayName,requestable:e.requestable,riskLevel:e.riskLevel??Un}),tags:[],operation:t})}function qt(e,t,r){return Ae({name:e.name,unique_id:e.id,permission_type:t?.(e)??e.permissionTypes??[e.action??"Uncategorized"],apply_to_sub_resources:e.applyToSubResources,resource_types:e.resourceTypes,custom_properties:{...er(e,tr),riskLevel:e.riskLevel??Un},operation:r})}function jr(e,t,r,n=new Set){let o=e.id;if(o&&n.has(o))return Ae({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,custom_properties:Ae({...er(e,tr)}),tags:[],operation:t});if(o)n.add(o);let s=[];for(let i of e.resources??[]){let c=typeof i==="string"?r?.get(i):i;if(c)s.push(jr(c,t,r,n))}if(o)n.delete(o);return Ae({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,sub_resources:s.length>0?s:void 0,custom_properties:Ae({...er(e,tr)}),tags:[],operation:t})}function As(e,t){if(e.length===0)return[];let r=new Map;for(let d of e)if(d.id)r.set(d.id,d);let n=new Map,o=new Set,s=(d,u)=>{if(!u.id||u.id===d)return;let l=n.get(d)??[];if(!l.some((y)=>y.id===u.id))l.push(u);n.set(d,l),o.add(u.id)};for(let d of e){for(let l of d.resources??[]){let y=typeof l==="string"?r.get(l):l;if(y&&d.id)s(d.id,y)}let u=Oe(d.parent);if(u&&r.has(u)&&d.id)s(u,d)}let i=(d)=>{if(!d.id)return d;let u=n.get(d.id);if(!u||u.length===0)return d;return{...d,resources:u.map(i)}};return e.filter((d)=>!d.id||!o.has(d.id)).map(i).map((d)=>jr(d,t,r))}async function Bc(e,t,r){if(!t)return[jr(e,"modify")];let n=async(l)=>{if(t.cache)return await t.cache.getNode("resource",l);return t.resources?.get(l)},o=async(l)=>{if(t.resources?.children&&l.id&&(!l.resources||l.resources.length===0))return t.resources.children(l.id);let y=[];for(let p of l.resources??[]){let b=typeof p==="string"?await n(p):p;if(b)y.push(b)}return y},s=e,i=new Set;while(!0){let l=Oe(s.parent);if(!l||i.has(l))break;i.add(l);let y=await n(l);if(!y)break;s=y}let c=[],d=[s],u=new Set;while(d.length>0){let l=d.shift();if(!l)break;if(l.id&&u.has(l.id))continue;if(l.id)u.add(l.id);let y=r.mapResource?r.mapResource(l):l;c.push(y);for(let p of await o(l))d.push(p)}if(e.id&&!u.has(e.id))c.push(r.mapResource?r.mapResource(e):e);return As(c,"modify")}async function Ss(e,t,r,n){let o=JSON.stringify(Ae(r)),s=n?.compression??t.compression??"gzip",i=s==="gzip"?await Qc(o):o,c=tu(i),d=n?.maxPayloadBytes??t.maxPayloadBytes??Rs,u=n?.multipart??t.multipart??"auto",l=n?.multipartThresholdBytes??t.multipartThresholdBytes??Uc;if(c>d&&u==="never")throw new et("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(u==="always"||u==="auto"&&c>l)return Hc(e,t,i,s,n);return Gc(t,{id:t.datasourceId,data_source_id:t.datasourceId,json_data:i,compression_type:s==="gzip"?"GZIP":"NONE"})}async function Gc(e,t){let r=`${Us(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:push`,n=await Nr(r,{method:"POST",headers:{...vs,Authorization:`Bearer ${e.apiKey??""}`,...ks},body:JSON.stringify(t)});return Ls(n)}async function Hc(e,t,r,n,o){let s=o?.partSizeBytes??t.partSizeBytes??Mc,i=await Jc(t,n),c=eu(r,s);for(let u=0;u<c.length;u++)await Yc(t,i,u+1,c[u]??"");let d=await Xc(t,i,c.length);return e.debug("OAA multipart payload pushed",{uploadId:i,parts:c.length}),{...d,uploadId:d.uploadId??i,parts:d.parts??c.length}}async function Jc(e,t){let r=Mn(e,"multipart/start"),n=await Nr(r,{method:"POST",headers:qn(e),body:JSON.stringify({data_source_id:e.datasourceId,compression_type:t==="gzip"?"GZIP":"NONE"})}),o=await Wn(n),s=he(o,"upload_id")??he(o,"uploadId")??he(o,"id");if(!s)throw new et("OAA multipart start response did not include an upload id",{code:"invalid_response"});return s}async function Yc(e,t,r,n){let o=Mn(e,`multipart/${encodeURIComponent(t)}/parts/${r}`);await Nr(o,{method:"PUT",headers:qn(e),body:JSON.stringify({upload_id:t,sequence:r,data:n})})}async function Xc(e,t,r){let n=Mn(e,`multipart/${encodeURIComponent(t)}/complete`),o=await Nr(n,{method:"POST",headers:qn(e),body:JSON.stringify({upload_id:t,parts:r})});return Ls(o)}function Mn(e,t){return`${Us(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:${t}`}function qn(e){return{...vs,Authorization:`Bearer ${e.apiKey??""}`,...ks}}async function Nr(e,t){let r;for(let n=0;n<_n;n++){try{let o=await fetch(e,t);if(!_s(o.status)||n===_n-1){if(!o.ok)await Zc(o);return o}r=new et(`OAA request failed with retryable status ${o.status}`,{retryable:!0,upstreamStatus:o.status})}catch(o){if(r=o,o instanceof et&&!o.retryable)throw o;if(n===_n-1)break}await ou(qc*2**n)}throw new et("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:r})}function _s(e){return e===429||e>=500}async function Zc(e){let t=await Wn(e).catch(()=>{return}),r=he(t,"message")??he(t,"error")??`OAA request failed with status ${e.status}`;throw new et(r,{code:he(t,"code")??"http_error",upstreamStatus:e.status,retryable:_s(e.status),warnings:xs(t?.warnings)})}async function Ls(e){let t=await Wn(e).catch(()=>{return});return{success:e.ok,syncToken:he(t,"sync_token")??he(t,"syncToken"),uploadId:he(t,"upload_id")??he(t,"uploadId"),parts:nu(t,"parts"),warnings:xs(t?.warnings),metadata:t}}async function Wn(e){let t=await e.text();if(!t)return{};let r=JSON.parse(t);return r&&typeof r==="object"&&!Array.isArray(r)?r:{}}async function Qc(e){let t=new Blob([e]).stream().pipeThrough(new CompressionStream("gzip")),r=await new Response(t).arrayBuffer();return Buffer.from(r).toString("base64")}function eu(e,t){let r=[];for(let n=0;n<e.length;n+=t)r.push(e.slice(n,n+t));return r}function tu(e){return Buffer.byteLength(e,"utf8")}function he(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="string"&&r.length>0?r:void 0}function xt(e){return typeof e==="string"&&e.length>0?e:void 0}function ru(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="boolean"?r:void 0}function nu(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="number"?r:void 0}function xs(e){if(!Array.isArray(e))return;let t=e.filter((r)=>typeof r==="string");return t.length>0?t:void 0}async function*lt(e){if(!e)return;for await(let t of e)yield t}function Ae(e){if(Array.isArray(e))return e.map(Ae).filter((r)=>r!==void 0);if(!e||typeof e!=="object"||e instanceof Date)return e===null?void 0:e;let t=Object.entries(e).map(([r,n])=>[r,Ae(n)]).filter(([,r])=>{if(r===void 0)return!1;if(Array.isArray(r)&&r.length===0)return!1;if(r&&typeof r==="object"&&!Array.isArray(r)&&Object.keys(r).length===0)return!1;return!0});return t.length>0?Object.fromEntries(t):void 0}function Us(e){return e.replace(/\/+$/,"")}function ft(e){return e.applicationName??bs}function Ut(e,t){if(t==="user")return e?.users?.population??"all";if(t==="customer")return e?.customers?.population??"access";return e?.workloads?.population??"access"}async function Ln(e,t,r,n){if(Ut(e,t)==="all")return!0;if(!n||!r)return!1;return(await n.listBySubject(r,t,{start:0,limit:1})).items.length>0}function ou(e){return new Promise((t)=>setTimeout(t,e))}function $n(e,t){if(!t)return"app";if(e==="user")return t.users.assignment;if(e==="workload")return t.workloads.assignment;return t.customers.assignment}function js(e,t=()=>{return},r=()=>{return},n=()=>{return},o=()=>({})){let s,i=!1,c=(C,g,P)=>{let I=r();if(!I)throw new tt("Cannot use AccessRequests: no destination channels are configured.",{status:500});if(C==="iam-request"){let S=I.channel("iam");if(!S)throw new tt("Cannot use AccessRequests: the IAM destination is not configured.",{status:500});return S}if(C!=="idp")throw new nr(`Cannot use AccessRequests for a "${g}" principal: RemoteConfig assignment policy is "${C}".`,C);if(g==="user"){let S=I.channel("sso");if(!S)throw new tt("Cannot use AccessRequests: the SSO destination is not configured.",{status:500});return S}if(g==="workload")throw new nr('Cannot use AccessRequests with assignment policy "idp" for workloads.',C);let U=I.ciamProviders(),E=P??(U.length===1?U[0]:void 0);if(!E)throw new tt(U.length===0?"Cannot use AccessRequests: no CIAM provider destination is configured.":"Cannot use AccessRequests: provider is required when multiple CIAM provider destinations are configured.",{status:U.length===0?500:400,statusText:U.length===0?void 0:"provider_required"});let F=I.channel(`ciam:${E}`);if(!F)throw new tt(`Cannot use AccessRequests: CIAM provider "${E}" is not configured.`,{status:500});return F},d,u,l=Ts(e,()=>s?.oaa,()=>({mapPermissionTypes:s?.mapPermissionTypes,mapGroup:s?.mapGroup,mapRole:s?.mapRole,mapResource:s?.mapResource}),o,()=>s?.accessStore,()=>iu(s),()=>y());function y(){let C=s?.catalogStore;return C||d?{catalog:C,code:d,resources:s?.resources,cache:u}:void 0}let p=(C)=>{if(C.op!=="set"||!C.previous)return!1;if(!(C.previous.providerId!==C.entity.providerId||C.previous.requestUrl!==C.entity.requestUrl))return!1;let{providerId:P,requestUrl:I,...U}=C.previous,{providerId:E,requestUrl:F,...S}=C.entity;return au(U,S)},b=(C)=>{if(i)return;let{kind:g}=C;if(l.isReady())(C.op==="delete"?g==="role"?l.deleteRole(C.entity.id):g==="permission"?l.deletePermission(C.entity.id):l.deleteGroup(C.entity.id):g==="role"?l.pushRole(C.entity):g==="permission"?l.pushPermission(C.entity):l.pushGroup(C.entity)).catch((E)=>{e.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:C.op,kind:g,error:E})});let P=t();if(!P?.isReady())return;if(C.op==="set"&&C.entity.requestable!==!0){if(C.previous?.requestable===!0)P.onEntitlementDelete(g,C.previous.id).catch((U)=>{e.warn("IAM delta removal of a no-longer-requestable entitlement failed",{"ion.operation":"iam.delta.delete","ion.outcome":"degraded",id:C.entity.id,kind:g,error:U instanceof Error?U.message:String(U)})});return}(C.op==="delete"?P.onEntitlementDelete(g,C.entity.id):P.onEntitlementUpsert(C.entity,g)).catch((U)=>{e.warn("IAM delta projection from catalog change failed; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:C.op,kind:g,error:U instanceof Error?U.message:String(U)})})},M=(C)=>{if(i)return;let g=s?.resources;if(!g)return;if(l.isReady())(async()=>{if(C.deleted){await l.deleteResource(C.id);return}let I=await g.get(C.id);if(!I)return;await l.pushResource(I)})().catch((I)=>{e.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:C.id,deleted:C.deleted===!0,error:I})})},_,R,W,q,a=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),w=!1,v=()=>{let C=s?.accessIndex;if(!C&&!w)w=!0,e.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return C},L=async(C)=>{let g=s?.accessIndex,P=s?.catalogStore;if(!g||!P&&!d)return!1;let I=C.id??jn(C),U=await Ws({...C,id:I},{catalog:P,code:d,resources:s?.resources,cache:u});return await g.materialize(I,U),!0},H=(C,g)=>mu(C,g,{accessStore:s?.accessStore,accessIndex:s?.accessIndex,catalogStore:s?.catalogStore,code:d,resources:s?.resources},u),J=async()=>{let C=s?.catalogStore;if(!C)return;await cu(d,C)},Y=async()=>{let C={subjects:0,roots:0,cleared:0};if(i)return C;await J();let g=s?.accessIndex,P=s?.catalogStore;if(!g||!P&&!d)return C;let I=new Map,U=(S)=>{let O=mt(S.subject);if(!O)return;let k=S.subjectType;I.set(`${k}:${O}`,{subject:O,subjectType:k})},E=new Set,F=s?.accessStore;if(F)for await(let S of Nn((O,k)=>F.list({start:O,limit:k}))){U({subject:mt(S.subject),subjectType:S.subjectType});let O=mt(S.target);if(u&&O&&typeof S.target==="string"){if(!await u.getNode(S.targetType,O))E.add(`${S.targetType}:${O}`)}}if(E.size>0)e.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog or catalog store). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...E].sort()});if(g.listSubjects)for(let S of await g.listSubjects())U(S);for(let S of I.values()){let O=await H(S.subject,S.subjectType);if(C.subjects+=1,C.roots+=O,O===0)C.cleared+=1}return C},re=()=>{if(i)return Promise.resolve({subjects:0,roots:0,cleared:0});return Y()},ue=Promise.resolve(),se=!1,K=(C,g)=>{let P=ue.then(async()=>{if(i)return;try{await g()}catch(I){e.warn(`${C} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:C,error:I instanceof Error?I.message:String(I)})}});return ue=P,P},ee=(C)=>{if(se)return;se=!0,K(C,async()=>{se=!1,await Y()})},z=()=>ue,D=(C)=>{if(i)return;let g=s?.accessStore;if(!s?.accessIndex||!s?.catalogStore||!g)return;if(u?.invalidate(C),C.op==="set"){let P=C.kind,I=C.entity.id;K("catalog-change",async()=>{for await(let U of Nn((E,F)=>g.listByTarget(P,I,{start:E,limit:F})))await L(U)})}else ee("catalog-delete")},Q=(C)=>{if(i)return;if(u?.clear(),!s?.accessIndex||!s?.catalogStore&&!d||!s?.accessStore)return;ee("resource-change")},ne={describe:()=>Se({module:"authz",active:s!==void 0,ready:s!==void 0,trustedProvisioningClients:(s?.trustedProvisioningClients??[]).map((C)=>({issuer:C.issuer,audience:C.audience,clientId:C.clientId,permissions:[...C.permissions]})),oaa:s?.oaa?l.describe():void 0,inboundEntitlements:s?.onInboundEntitlement!==void 0,stores:{accessStore:s?.accessStore!==void 0,accessIndex:s?.accessIndex!==void 0,catalogStore:s?.catalogStore!==void 0,resources:s?.resources!==void 0}}),oaa:l,entitlements:{async list(C){let g=qs(d,s?.catalogStore),P=Math.max(0,C?.start??0),I=C?.limit;if(!g)return Ms(0,[],P,I);let U=[];for(let F of[g.groups,g.roles,g.permissions])for await(let S of Nn((O,k)=>F.list({start:O,limit:k,filter:C?.filter})))U.push(S);let E=I==null?void 0:P+I;return Ms(U.length,U.slice(P,E),P,I)}},get catalogStore(){return s?.catalogStore},get accessStore(){return s?.accessStore},get accessIndex(){return s?.accessIndex},has(C,g,P,I,U){let E=v();return E?E.has(C,g,P,I,U):Promise.resolve(a())},hasGroup(C,g,P,I){let U=v();return U?U.hasGroup(C,g,P,I):Promise.resolve(a())},hasRole(C,g,P,I){let U=v();return U?U.hasRole(C,g,P,I):Promise.resolve(a())},hasPermission(C,g,P,I){let U=v();return U?U.hasPermission(C,g,P,I):Promise.resolve(a())},hasAny(C,g,P){let I=v();return I?I.hasAny(C,g,P):Promise.resolve(a())},hasAll(C,g,P){let I=v();return I?I.hasAll(C,g,P):Promise.resolve(a())},reconcile(){return re()},async grant(C){$r(C.subjectType);let g=mt(C.target),P=$n(C.subjectType,n());if(P!=="app")throw new nr(P==="iam-request"||P==="idp"?`Cannot grant ${C.targetType} "${g}" to a "${C.subjectType}" principal: RemoteConfig assignment policy is "${P}". Use ion.authz.requestAccess.`:`Cannot grant ${C.targetType} "${g}" to a "${C.subjectType}" principal: RemoteConfig assignment policy is "${P}".`,P,await ie(C));await ce(C),await fu(s?.catalogStore,d,C,u);let I={...C,status:C.status??"active"};I.id=jn(I);let U=s?.accessStore;if(!U)throw new tt("Cannot grant: no AccessAssignmentStore is wired.",{status:500});if(await U.grant(I),s?.accessIndex&&(s.catalogStore||d)){let E=await Ws(I,{catalog:s.catalogStore,code:d,resources:s.resources,cache:u});await s.accessIndex.materialize(I.id,E)}return await ae(I,"grant"),I},async requestAccess(C){$r(C.subjectType);let g=$n(C.subjectType,n());if(g!=="iam-request"&&g!=="idp")throw new nr(`Cannot request access for a "${C.subjectType}" principal: RemoteConfig assignment policy is "${g}" (use ion.authz.grant when policy is "app").`,g);let P=mt(C.subject),I=mt(C.target);return c(g,C.subjectType,C.provider).submit({subject:P,subjectType:C.subjectType,targetType:C.targetType,target:I,operation:C.operation,justification:C.justification})},async getAccessRequest(C){$r(C.subjectType);let g=$n(C.subjectType,n());if(g!=="iam-request"&&g!=="idp")throw new nr(`Cannot read an access request for a "${C.subjectType}" principal: RemoteConfig assignment policy is "${g}".`,g);return c(g,C.subjectType,C.provider).get(C.id)},async revoke(C){$r(C.subjectType);let g=C,P={...g,id:g.id??jn(g)},I=s?.accessStore;if(!I)throw new tt("Cannot revoke: no AccessAssignmentStore is wired.",{status:500});await I.revoke(P),await s?.accessIndex?.removeByRoot(P.id),await ae(P,"revoke")}},ie=async(C)=>{let g=mt(C.target),P=qs(d,s?.catalogStore);if(P){let I=C.targetType==="role"?await P.roles.get(g):C.targetType==="permission"?await P.permissions.get(g):await P.groups.get(g);if(I?.requestUrl)return I.requestUrl}return(await t()?.getDestinationRef("group",g))?.requestUrl},ce=async(C)=>{let g=uu(d,mt(C.target));if(!g)return;if(g.kind!==C.targetType)throw new tt(`Cannot grant ${C.targetType} "${g.entity.id}": code declares that id as ${g.kind}.`,{status:409,statusText:"entitlement_kind_mismatch"});if(!s?.catalogStore)throw new tt(`Cannot grant code entitlement "${g.entity.id}": no AccessCatalogStore is wired for materialization.`,{status:500});await du(g.kind,g.entity,su(s.catalogStore,g.kind))},ae=async(C,g)=>{if(l.isReady())try{if(g==="grant")await l.grant(C);else await l.revoke(C)}catch(I){e.warn("OAA incremental access push failed after ion.authz mutation; full sync will reconcile",{"ion.operation":"authz.oaa.push","ion.outcome":"degraded",op:g,error:I instanceof Error?I.message:String(I)})}let P=t();if(!P?.isReady())return;try{if(g==="grant")await P.onGrant(C);else await P.onRevoke(C)}catch(I){e.warn("IAM delta projection failed after ion.authz mutation; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:g,error:I instanceof Error?I.message:String(I)})}};return{update(C){if(i)return ne;let g=C?.catalog?lu(C.catalog):void 0,P=g!==d;d=g,s=C,l.refreshReadiness();let I=C?.catalogStore,U=C?.resources;if(I!==_||U!==W||P)R?.(),q?.(),u=I||d?new pu(I,U,d):void 0,R=I?.afterChange?I.afterChange((E)=>{if(p(E))return;b(E),D(E)}):void 0,q=U?.changed?U.changed((E)=>{Q(E),M(E)}):void 0,_=I,W=U;else if(u)u.clear();return ne},settle:z,catalogView:y,close(){if(i)return;i=!0,R?.(),R=void 0,q?.(),q=void 0,_=void 0,W=void 0,u=void 0}}}function Ns(e){return e.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+|_+$/g,"")||"EMPTY"}function gu(e){let t=`${e.clientId}\x00${e.path}`,r=2166136261;for(let n=0;n<t.length;n+=1)r^=t.charCodeAt(n),r=Math.imul(r,16777619);return(r>>>0).toString(36)}function yu(e){let t=Ns(e.clientId),r=Ns(e.path);return`LFV_${t}__${r}`}function Dn(e,t){let r=yu(t);if(!(r in e))return r;let n=`${r}_${gu(t)}`;if(!(n in e))return n;return`${n}_ALT`}import{defaultLogger as Tg,describeOriginUrl as Cg}from"@ionite/core";import{ACCEPT_JSON as Nt,CONTENT_TYPE_JSON as Ee,defaultLogger as Pu,describeOriginUrl as Ou,IoniteError as Xs,readJsonResponse as $t,stableConfigHash as Eu}from"@ionite/core";import{verifyLfvSignature as Bs}from"@ionite/core/server";import{DEFAULT_SECRET_MIME_TYPES as Wt}from"@ionite/core";var hu=new Set(["jsonc","env","text","binary","yaml","toml","xml"]);function wu(e){let t=e.split(";",1)[0]?.trim().toLowerCase()??"";if(t===Wt.binary)return"binary";if(t===Wt.env)return"env";if(t===Wt.yaml||t.endsWith("+yaml"))return"yaml";if(t===Wt.toml||t.endsWith("+toml"))return"toml";if(t===Wt.xml||t.endsWith("+xml"))return"xml";if(t===Wt.jsonc||t.endsWith("+json"))return"jsonc";return"text"}function Dr(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let t=e,r=typeof t.mimeType==="string"?t.mimeType:typeof t.mime_type==="string"?t.mime_type:void 0;if(!r)return;let n=t.format,o=typeof n==="string"&&hu.has(n)?n:wu(r),s=typeof t.schemaUrl==="string"?t.schemaUrl:typeof t.schema_url==="string"?t.schema_url:void 0,i=typeof t.typeId==="string"?t.typeId:typeof t.type_id==="string"?t.type_id:void 0;return{format:o,mimeType:r,...s?{schemaUrl:s}:{},...i?{typeId:i}:{}}}function St(e){if(!e)return;let t=e.custom_metadata,r=t&&typeof t==="object"&&!Array.isArray(t)?t:void 0;return Dr(e.content_type??e.contentType??r?.content_type)}function Kr(e){return{format:e.format,mime_type:e.mimeType,...e.schemaUrl?{schema_url:e.schemaUrl}:{},...e.typeId?{type_id:e.typeId}:{}}}var jt=new Map;function Su(e){if(!e)return"/";return e.startsWith("/")?e:`/${e}`}function vu(e){try{let t=new URL(e),r=t.pathname.replace(/\/+$/g,"");return`${t.origin}${r}`}catch{return e.replace(/\/+$/g,"")}}function Fr(e){let t=vu(e.lfvServerUrl),r=Su(e.path);return`${t}|${r}`}function $s(e,t,r){let n=jt.get(e)??new Map;return n.set(t,r),jt.set(e,n),()=>{let o=jt.get(e);if(!o)return;if(o.delete(t),o.size===0)jt.delete(e)}}async function Ds(e,t,r,n){let o=jt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onDelivery)continue;if(await c.onDelivery(t)){s+=1;break}}return s}async function Ks(e,t,r,n){let o=jt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onEvents)continue;s+=1,await c.onEvents(t)}return s}import{defaultSecretContentType as ku,parseJsonc as bu,SecretContentTypeMismatchError as Ru}from"@ionite/core";function Fs(e){let t={},r=e.replace(/\r\n?/g,`
|
|
1
|
+
import{configSourceOriginLogFields as pp,configTrustedClientGrants as mp,deepEqualPlain as gp,defaultLogger as No,ION_ENDPOINT_PERMISSIONS as Da,IoniteError as Ka,listGenerator as Xt,stableConfigHash as Ua,toCodeCatalog as Fa,unionCatalogRead as yp}from"@ionite/core";import{ciam as hp,configureJwksCache as wp,iam as Sp,resolveCacheConfig as vp,sso as kp}from"@ionite/core/server";import{ACCEPT_JSON as cc,CONTENT_TYPE_JSON as uc,IoniteError as bn,readJsonResponse as dc,trimTrailingSlash as lc,unexpectedBodySummary as fc}from"@ionite/core";function Rn(e,t){let r=()=>{if(!e.url)return"destination URL is not configured";if(!t.workload)return"workload identity is not configured";if(typeof t.workload.isReady!=="function"||typeof t.workload.ready!=="function")return"workload handle violates the readiness contract";if(!t.workload.isReady())return"workload module is not ready";if(e.audience){let i=t.workload[e.audience];if(!i)return`outgoing workload client "${e.audience}" is not configured`;if(typeof i.isReady!=="function"||typeof i.ready!=="function")return`outgoing workload client "${e.audience}" violates the readiness contract`;if(!i.isReady())return`outgoing workload client "${e.audience}" is not ready`}return},n=async()=>{let i=t.workload;if(!i)throw new bn("AccessRequests: workload identity is not configured",{status:500});if(e.audience)return i.getToken(e.audience);if(typeof i.getServerToken==="function")return i.getServerToken();return i.getToken()},o=async(i,c)=>{let d=r();if(d)throw new bn(`Cannot use AccessRequests: ${d}`,{status:503});let u=await(t.fetchImpl??fetch)(i,{...c,headers:{...cc,Authorization:`Bearer ${await n()}`,...c.body?uc:{},...c.headers}});if(!u.ok){let l=await fc(u);throw t.log.warn("AccessRequests destination returned an error",{"ion.operation":"authz.access_request","ion.outcome":"degraded",reason:"destination_error",status:u.status,contentType:l.contentType,excerpt:l.excerpt}),new bn(`AccessRequests failed: ${u.status}${l.excerpt?` ${l.excerpt}`:""}`,{status:500})}return dc(u,{log:t.log,operation:"authz.access_request"})},s=`${lc(e.url)}/AccessRequests`;return{notReadyReason:r,submit:(i)=>o(s,{method:"POST",body:JSON.stringify(i)}),get:(i)=>o(`${s}/${encodeURIComponent(i)}`,{method:"GET"})}}function os(e){let t=new Map,r={ciam:{}},n={channel:(o)=>t.get(o),ciamProviders:()=>[...t.keys()].filter((o)=>o.startsWith("ciam:")).map((o)=>o.slice(5)),describe:()=>structuredClone(r)};return{update(o,s){let i=new Map;if(o.iam)i.set("iam",Rn(o.iam,{...s,log:e}));if(o.sso)i.set("sso",Rn(o.sso,{...s,log:e}));for(let[c,d]of Object.entries(o.ciam??{}))i.set(`ciam:${c}`,Rn(d,{...s,log:e}));t=i,r={...o.iam?{iam:o.iam.url}:{},...o.sso?{sso:o.sso.url}:{},ciam:Object.fromEntries(Object.entries(o.ciam??{}).map(([c,d])=>[c,d.url]))}},handle:()=>n}}import{trimTrailingSlash as ds}from"@ionite/core";import{accessRefId as dt,accessRootId as ss,assertRequiredSubjectType as is,list as pc}from"@ionite/core";function Cn(e){let{createdAt:t,updatedAt:r,...n}=e;return n}class $e{constructor(){this.roots=new Map;this.byTarget=new Map;this.bySubject=new Map}static targetKey(e,t){return`${e}:${t}`}static subjectKey(e,t){return`${e}:${t}`}indexAdd(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}indexRemove(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}deindex(e){this.indexRemove(this.byTarget,$e.targetKey(e.targetType,dt(e.target)),e.id),this.indexRemove(this.bySubject,$e.subjectKey(e.subjectType,dt(e.subject)),e.id)}index(e){this.indexAdd(this.byTarget,$e.targetKey(e.targetType,dt(e.target)),e.id),this.indexAdd(this.bySubject,$e.subjectKey(e.subjectType,dt(e.subject)),e.id)}resolve(e,t){if(!e)return[];let r=[];for(let n of e){let o=this.roots.get(n);if(o&&(o.status??"active")==="active"&&t(o))r.push(o)}return r}async grant(e){is(e.subjectType,"Access change subjectType");let t=e.id??ss(e),r=new Date,n=this.roots.get(t);if(n)this.deindex(n);let o={...e,id:t,status:e.status??"active",createdAt:n?.createdAt??r,updatedAt:r};this.roots.set(t,o),this.index(o)}async revoke(e){let t=e.id??ss(e),r=this.roots.get(t);if(r)this.deindex(r);this.roots.delete(t)}async get(e){let t=this.roots.get(e);return t?Cn(t):void 0}async list(e){let t=Array.from(this.roots.values()).filter((r)=>(r.status??"active")==="active");return Tn(t,e)}async listByTarget(e,t,r){let n=t.trim(),o=this.byTarget.get($e.targetKey(e,n)),s=this.resolve(o,(i)=>i.targetType===e&&dt(i.target)===n);return Tn(s,r)}async listByTargets(e){let t=new Map;for(let{targetType:r,target:n}of e){let o=`${r}:${n}`;if(t.has(o))continue;let s=n.trim(),i=this.byTarget.get($e.targetKey(r,s)),c=this.resolve(i,(d)=>d.targetType===r&&dt(d.target)===s);t.set(o,c.map((d)=>Cn(d)))}return t}async listBySubject(e,t,r){is(t);let n=dt(e),o=this.bySubject.get($e.subjectKey(t,n)),s=this.resolve(o,(i)=>i.subjectType===t&&dt(i.subject)===n);return Tn(s,r)}}function Tn(e,t){let r=Math.max(0,t?.start??0),n=t?.limit,o=n!=null?r+n:void 0;return pc(e.length,e.slice(r,o).map(Cn),r,n)}import{assertValidSubjectTypeScoping as as,deepEqualPlain as mc,list as cs,readyCatalogEntry as In}from"@ionite/core";class Cr{constructor(){this.listeners=new Set;this.emit=(e)=>{for(let t of this.listeners)t(e)};this.groups=new Tr("group",this.emit);this.roles=new Tr("role",this.emit);this.permissions=new Tr("permission",this.emit)}afterChange(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}}class Ir{constructor(){this.items=new Map;this.listeners=new Set}async get(e){return this.items.get(e)}async list(e){let t=Array.from(this.items.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=n!=null?r+n:void 0;return cs(t.length,t.slice(r,o),r,n)}async children(e){return Array.from(this.items.values()).filter((t)=>(typeof t.parent==="string"?t.parent:t.parent?.id)===e)}changed(e){return this.listeners.add(e),()=>{this.listeners.delete(e)}}set(e){this.items.set(e.id,e),this.emitChange({id:e.id})}delete(e){if(!this.items.delete(e))return;this.emitChange({id:e,deleted:!0})}emitChange(e){for(let t of this.listeners)t(e)}}class Tr{constructor(e,t){this.kind=e;this.emit=t;this.items=new Map}async get(e){return this.items.get(e)}set(e){as(e);let t=this.items.get(e.id),r=!t||!mc(t,e);if(this.items.set(e.id,e),r)this.emit({op:"set",kind:this.kind,entity:e,previous:t});return In(e,Promise.resolve())}insertIfAbsent(e){as(e);let t=this.items.get(e.id);if(t)return In(t,Promise.resolve());return this.items.set(e.id,e),this.emit({op:"set",kind:this.kind,entity:e,previous:void 0}),In(e,Promise.resolve())}async delete(e){let t=this.items.get(e);if(!t)return;this.items.delete(e),this.emit({op:"delete",kind:this.kind,entity:t})}async list(e){let t=Array.from(this.items.values()),r=e?.filter?.requestable;if(r!==void 0)t=t.filter((i)=>Boolean(i.requestable)===r);let n=Math.max(0,e?.start??0),o=e?.limit,s=o!=null?n+o:void 0;return cs(t.length,t.slice(n,s),n,o)}}import{accessRefId as Xe,assertRequiredSubjectType as Lt}from"@ionite/core";function Ze(e,t){return`${t}:${e}`}function Pn(e,t,r){return`${e}:${t}:${r}`}function gc(e,t,r,n){return`${Pn(e,t,r)}:${n??""}`}class Pr{constructor(){this.rows=new Map;this.byTriple=new Map;this.byRoot=new Map;this.bySubject=new Map;this.edgeMeta=new Map;this.disabledSubjects=new Set}async has(e,t,r,n,o){Lt(o);let s=Xe(e),i=Xe(r);if(!s||!i)return{allow:!1};if(this.disabledSubjects.has(Ze(s,o)))return{allow:!1,metadata:{reason:"subject_disabled"}};let c=Pn(Ze(s,o),t,i),d=n?Xe(n):void 0;if(d===void 0){let y=this.byTriple.get(c);if(y&&y.size>0)return this.allow(s,o,t,i,void 0);return{allow:!1}}let u=`${c}:${d}`,l=`${c}:`;if(this.rows.has(u))return this.allow(s,o,t,i,d);if(this.rows.has(l))return this.allow(s,o,t,i,void 0);return{allow:!1}}async hasGroup(e,t,r,n){return this.has(e,"group",t,r,n)}async hasRole(e,t,r,n){return this.has(e,"role",t,r,n)}async hasPermission(e,t,r,n){return this.has(e,"permission",t,r,n)}async hasAny(e,t,r){for(let n of t){let o=await this.has(e,n.targetType,n.target,n.resource,r);if(o.allow)return o}return{allow:!1}}async hasAll(e,t,r){if(this.disabledSubjects.has(Ze(Xe(e),r)))return{allow:!1,metadata:{reason:"subject_disabled"}};if(t.length===0)return{allow:!0};let n=[];for(let o of t){let s=await this.has(e,o.targetType,o.target,o.resource,r);if(!s.allow)return{allow:!1,matched:n};if(s.matched)n.push(...s.matched)}return{allow:!0,matched:n}}async materialize(e,t){this.removeRoot(e),this.addRootEdges(e,t)}async replaceSubject(e,t,r){let n=Ze(Xe(e),t),o=new Map;for(let s of r){Lt(s.subjectType,"Effective edge subjectType");let i=Ze(Xe(s.subject),s.subjectType);if(i!==n)throw Error(`AccessIndex.replaceSubject received an edge for ${i}; expected ${n}.`);let c=o.get(s.rootId);if(c)c.push(s);else o.set(s.rootId,[s])}this.clearSubjectEdges(n);for(let[s,i]of o)this.addRootEdges(s,i)}addRootEdges(e,t){let r=new Set;for(let n of t){Lt(n.subjectType,"Effective edge subjectType");let o=Ze(n.subject,n.subjectType),s=Pn(o,n.targetType,n.target),i=gc(o,n.targetType,n.target,n.resource);this.addToSet(this.rows,i,e),this.addToSet(this.byTriple,s,i),this.addToSet(this.bySubject,o,i),this.edgeMeta.set(i,{triple:s,subjectId:o}),r.add(i)}if(r.size>0)this.byRoot.set(e,r)}async removeByRoot(e){this.removeRoot(e)}removeRoot(e){let t=this.byRoot.get(e);if(!t)return;for(let r of t){let n=this.rows.get(r);if(!n)continue;if(n.delete(e),n.size===0)this.dropEdge(r)}this.byRoot.delete(e)}async listSubjects(){let e=[];for(let[t,r]of this.bySubject){if(r.size===0)continue;let n=t.indexOf(":");if(n<=0)throw Error(`AccessIndex subject key "${t}" is missing a subjectType prefix.`);let o=t.slice(0,n);Lt(o,"AccessIndex subject key subjectType"),e.push({subjectType:o,subject:t.slice(n+1)})}return e}async setSubjectDisabled(e,t,r){let n=Ze(Xe(e),t);if(r)this.disabledSubjects.add(n);else this.disabledSubjects.delete(n)}async isSubjectDisabled(e,t){return Lt(t),this.disabledSubjects.has(Ze(Xe(e),t))}async clear(e,t){if(e===void 0){this.rows.clear(),this.byTriple.clear(),this.byRoot.clear(),this.bySubject.clear(),this.edgeMeta.clear();return}Lt(t);let r=Xe(e);this.clearSubjectEdges(Ze(r,t))}clearSubjectEdges(e){let t=this.bySubject.get(e);if(!t)return;for(let r of[...t]){let n=this.rows.get(r);if(n)for(let o of n){let s=this.byRoot.get(o);if(s?.delete(r)&&s.size===0)this.byRoot.delete(o)}this.dropEdge(r)}}allow(e,t,r,n,o){return{allow:!0,matched:[{subject:e,subjectType:t,targetType:r,target:n,resources:o?[o]:void 0}]}}addToSet(e,t,r){let n=e.get(t);if(!n)n=new Set,e.set(t,n);n.add(r)}dropEdge(e){this.rows.delete(e);let t=this.edgeMeta.get(e);if(t)this.removeFromSet(this.byTriple,t.triple,e),this.removeFromSet(this.bySubject,t.subjectId,e);this.edgeMeta.delete(e)}removeFromSet(e,t,r){let n=e.get(t);if(!n)return;if(n.delete(r),n.size===0)e.delete(t)}}import{list as yc,matchesListFilter as hc}from"@ionite/core";class Or{constructor(){this.customers=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.customers.get(e)}async lookup(e){if(e.id){let t=this.customers.get(e.id);if(t)return t}if(e.userName){let t=this.userNameIndex.get(e.userName.toLowerCase());if(t)return this.customers.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.customers.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n={...e,id:t,createdAt:this.customers.get(t)?.createdAt??e.createdAt??r,updatedAt:r},o=this.customers.get(t);if(o){if(o.userName&&o.userName.toLowerCase()!==n.userName?.toLowerCase())this.userNameIndex.delete(o.userName.toLowerCase());if(o.externalId&&o.externalId!==n.externalId)this.externalIdIndex.delete(o.externalId)}if(this.customers.set(t,n),n.userName)this.userNameIndex.set(n.userName.toLowerCase(),t);if(n.externalId)this.externalIdIndex.set(n.externalId,t);return n}async delete(e){let t=this.customers.get(e);if(t?.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.customers.delete(e),t?1:0}async list(e){let t=Array.from(this.customers.values()).filter((c)=>hc(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return yc(o,i,r,n)}}class Er{constructor(){this.magicLinks=new Map}async create(e,t,r){if(this.magicLinks.has(e))throw Error(`Magic link with token ${e} already exists`);let n={token:e,customer:t,createdAt:new Date,expiresAt:r};this.magicLinks.set(e,n)}async get(e){let t=this.magicLinks.get(e);if(!t)return null;if(Date.now()>t.expiresAt.getTime())return this.magicLinks.delete(e),null;return t}async getAndDelete(e){let t=this.magicLinks.get(e);if(this.magicLinks.delete(e),!t)return null;if(Date.now()>t.expiresAt.getTime())return null;return t}async delete(e){this.magicLinks.delete(e)}}function wc(e){let t=e.expiresAt;if(!t)return;let r=t instanceof Date?t.getTime():new Date(t).getTime();return Number.isNaN(r)?void 0:r}class Ar{constructor(){this.capabilities={derivedEntitlements:!0};this.sessions=new Map}async create(e){if(this.sessions.has(e.sid))throw Error(`Session with sid ${e.sid} already exists`);this.sessions.set(e.sid,e)}async get(e){let t=this.sessions.get(e);if(!t)return null;let r=wc(t);if(r!==void 0&&Date.now()>r)return this.sessions.delete(e),null;return t}async update(e,t){let r=this.sessions.get(e);if(!r)throw Error(`Session with sid ${e} not found`);let n={...r,...t};this.sessions.set(e,n)}async delete(e){this.sessions.delete(e)}}import{list as Sc,StoreConflictError as vc}from"@ionite/core";class _r{constructor(){this.users=new Map;this.userNameIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.users.get(e)}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.users.get(t):void 0}async lookup(e){return this.users.get(e.id??"")}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r={...e,id:t},n=this.users.get(t),o=r.externalId?this.externalIdIndex.get(r.externalId):void 0;if(o&&o!==t)throw new vc(`externalId "${r.externalId}" is already in use`,"unique_violation","externalId");if(n){if(n.userName&&n.userName.toLowerCase()!==r.userName?.toLowerCase())this.userNameIndex.delete(n.userName.toLowerCase());if(n.externalId&&n.externalId!==r.externalId)this.externalIdIndex.delete(n.externalId)}if(this.users.set(t,r),r.userName)this.userNameIndex.set(r.userName.toLowerCase(),t);if(r.externalId)this.externalIdIndex.set(r.externalId,t);return r}async delete(e){let t=this.users.get(e);if(t){if(t.userName)this.userNameIndex.delete(t.userName.toLowerCase());if(t.externalId)this.externalIdIndex.delete(t.externalId)}return this.users.delete(e),t?1:0}async list(e){let t=Array.from(this.users.values()),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return Sc(o,i,r,n)}}class yt{constructor(){this.tokens=new Map}async set(e){this.tokens.set(e.workload_id,e)}async get(e){let t=this.tokens.get(e);if(!t)return null;if(Date.now()>t.expires_at.getTime())return this.tokens.delete(e),null;return t}async delete(e){this.tokens.delete(e)}async isValid(e){return await this.get(e)!==null}async cleanup(){let e=Date.now();for(let[t,r]of this.tokens.entries())if(e>r.expires_at.getTime())this.tokens.delete(t)}}function Fe(e){let t=ds(e||En);return{readyzUrl:`${t}/readyz`,capabilitiezUrl:`${t}/capabilitiez`,sso:{loginUrl:`${t}/auth/login`,userUrl:`${t}/auth/user`,logoutUrl:`${t}/auth/logout`,logoutBackChannelUrl:`${t}/auth/logout/backchannel`,refreshUrl:`${t}/auth/refresh`,callbackUrl:`${t}/auth/callback`},workload:{validateUrl:`${t}/workload/validate`,jwksUrl:`${t}/workload/jwks`},iam:{basePath:`${t}/iam`,usersUrl:`${t}/iam/Users`,groupsUrl:`${t}/iam/Groups`,workloadsUrl:`${t}/iam/Workloads`,customersUrl:`${t}/iam/Customers`},ciam:{magicLinkUrl:`${t}/magic-link`,magicLinkLoginUrl:`${t}/magic-link/login`,customerUrl:`${t}/auth/customer`,customerLoginUrl:`${t}/auth/customer/login`,customerCallbackUrl:`${t}/auth/customer/callback`,customerProvidersUrl:`${t}/auth/customer/providers`,logoutUrl:`${t}/auth/customer/logout`}}}function ls(e){return`${ds(e||En)}/authz/oaa/sync`}function kc(e,t){if(e===null)return null;let r={validateUrl:t.validateUrl,jwksUrl:t.jwksUrl};if(e&&typeof e==="object"&&(("incoming"in e)||("outgoing"in e))){let n=e;return{...n,incoming:{...n.incoming,...r}}}return{...e??{},...r}}function fs(e,t,r,n){let o={...t},s=Fe(n);if(o.sso!==null)if(e.sso)o.sso={...o.sso,loginUrl:s.sso.loginUrl,userUrl:s.sso.userUrl,logoutUrl:s.sso.logoutUrl,logoutBackChannelUrl:s.sso.logoutBackChannelUrl,refreshUrl:s.sso.refreshUrl,redirectUri:s.sso.callbackUrl,sessionStore:r.sessionStore??o.sso?.sessionStore,userStore:r.userStore??o.sso?.userStore,enableJitUserProvisioning:o.sso?.enableJitUserProvisioning??!0};else o.sso=void 0;if(o.iam!==null)if(e.iam)o.iam={...o.iam,usersUrl:s.iam.usersUrl,groupsUrl:s.iam.groupsUrl,workloadsUrl:s.iam.workloadsUrl,customersUrl:s.iam.customersUrl,userStore:r.userStore??o.iam?.userStore,workloadIdentityStore:r.workloadIdentityStore??o.iam?.workloadIdentityStore,customerStore:r.customerStore??o.iam?.customerStore};else o.iam=void 0;if(o.workload!==null){if(e.workload||o.workload)o.workload=kc(o.workload,s.workload)}if(o.ciam!==null)if(e.ciam)o.ciam={...o.ciam,magicLinkUrl:s.ciam.magicLinkUrl,magicLinkLoginUrl:s.ciam.magicLinkLoginUrl,customerUrl:s.ciam.customerUrl,customerLoginUrl:s.ciam.customerLoginUrl,customerCallbackUrl:s.ciam.customerCallbackUrl,customerProvidersUrl:s.ciam.customerProvidersUrl,logoutUrl:s.ciam.logoutUrl,providers:e.ciam.providers,sessionStore:r.sessionStore??o.ciam?.sessionStore,customerStore:r.customerStore??o.ciam?.customerStore,magicLinkStore:r.magicLinkStore??o.ciam?.magicLinkStore,enableJitUserProvisioning:o.ciam?.enableJitUserProvisioning??!0};else o.ciam=void 0;return o}function Qt(e,t){let r={...e};if(r.sso)r.sso={...r.sso,sessionStore:t.sessionStore??r.sso.sessionStore,userStore:t.userStore??r.sso.userStore};if(r.iam)r.iam={...r.iam,userStore:t.userStore??r.iam.userStore};if(r.workload){let n=r.workload;r.workload={...r.workload,tokenStore:t.workloadTokenStore??n.tokenStore,workloadIdentityStore:t.workloadIdentityStore??n.workloadIdentityStore}}if(r.ciam)r.ciam={...r.ciam,sessionStore:t.sessionStore??r.ciam.sessionStore,customerStore:t.customerStore??r.ciam.customerStore,magicLinkStore:t.magicLinkStore??r.ciam.magicLinkStore};if(r.authz!==null&&(t.accessStore||t.accessIndex||t.catalog||t.catalogStore||t.resources)){let n=r.authz;r.authz={...n,accessStore:t.accessStore??n?.accessStore,accessIndex:t.accessIndex??n?.accessIndex,catalog:t.catalog??n?.catalog,catalogStore:t.catalogStore??n?.catalogStore,resources:t.resources??n?.resources}}return r}var En="/api/ionite";function Lr(e){return{...e}}function bc(){return{sessionStore:new Ar,userStore:new _r,customerStore:new Or,magicLinkStore:new Er,workloadTokenStore:new yt}}function On(){return{catalogStore:new Cr,accessStore:new $e,accessIndex:new Pr,resources:new Ir}}function Rc(){let e=On(),t=new Map;return(r)=>{if(!r)return e;let n=t.get(r);if(!n)n=On(),t.set(r,n);return n}}function us(e,t){return`${e} is enabled by RemoteConfig but is not served: missing ${t.join(", ")}. Provide durable stores in ionite({ stores }) (e.g. @ionite/redis or app-owned SQL stores), or opt into stores: devInMemoryStores() for prototypes only (state is lost on restart).`}function An(e){let t={};if(e.sso&&!e.sso.sessionStore)t.sso=us("SSO",["stores.sessionStore"]);if(e.ciam){let r=[];if(!e.ciam.sessionStore)r.push("stores.sessionStore");if(!e.ciam.customerStore)r.push("stores.customerStore");if(r.length>0)t.ciam=us("CIAM",r)}return t}function xr(){return En}import{AssignmentPolicyError as nr,accessRefId as mt,accessRootId as jn,assertRequiredSubjectType as $r,catalogEntityStore as su,configTrustedClientGrants as iu,deepEqualPlain as au,deprecateRetiredCodeCatalogRows as cu,getCodeCatalogEntity as uu,IoniteError as tt,list as Ms,listGenerator as Nn,materializeCodeCatalogEntity as du,toCodeCatalog as lu,unionCatalogRead as qs}from"@ionite/core";import{assertSubjectTypeAssignable as fu,CatalogAdjacencyCache as pu,expandRoot as Ws,reconcileSubjectAccess as mu}from"@ionite/core/server";var ps=Symbol("ionite.describe.overlay");function Se(e){if(Array.isArray(e))return e.map((t)=>Se(t));if(!e||typeof e!=="object")return e;return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).map(([t,r])=>[t,Se(r)]))}function ms(e,t,r,n){return Se({...e,...n,active:t.active,ready:t.ready,...r?{urls:r}:{}})}function gs(e){return e[ps]}function Ve(e,t,r,n){if(!e)return;let o=gs(e)??{base:e.describe.bind(e)};o.urls=r,o.extra=n,Object.defineProperty(e,ps,{value:o,enumerable:!1,configurable:!0}),Object.defineProperty(e,"describe",{value:()=>ms(o.base(),t(),o.urls,o.extra?.()),enumerable:!1,configurable:!0})}function ze(e,t){if(!e)return;let r=gs(e);return r?ms(r.base(),t,r.urls,r.extra?.()):Se(e.describe())}import{ACCEPT_JSON as vs,accessRefId as Oe,accessRootId as Cc,CONTENT_TYPE_JSON as ks,customAttributes as er,DEFAULT_RISK_LEVEL as Un,ION_AUTHZ_GROUP_SCHEMA as Ic,ION_SCIM_USER_EXTENSION_URN as ys,IoniteError as Pc,KNOWN_ENTITLEMENT_KEYS as tr,mergeCodeCatalogEntity as Oc}from"@ionite/core";import{baseCustomerToScim as Ec,baseUserToScimUser as Ac,baseWorkloadToScim as _c,collectReferencedDefinitions as Lc}from"@ionite/core/server";import{IoniteError as Tc}from"@ionite/core";function me(){return Response.json({error:"not_found"},{status:404})}function Be(e=["GET"]){return Response.json({error:"method_not_allowed",allow:e},{status:405,headers:{Allow:e.join(", ")}})}function Qe(e){return e===408||e===429||e===503||e===504?503:500}async function Ur(e,t,r){try{return await r()}catch(n){let o=Tc.from(n,{ionId:e.id,log:e.log}),s={...o.toLogAttributes(),"ion.operation":t,"ion.outcome":"failure"},i=o.log??e.log;if(o.statusText)i.warn("ion.handler.unhandled",s,o);else i.error("ion.handler.unhandled",s,o);return o.response()}}function ye(e,t,r=(n)=>Error(`${e} ready timed out after ${n}ms`)){let n=!1,o,s,i=()=>{n=!1,s=new Promise((u)=>{o=u})};i();let c=()=>{n=!0,o?.(),o=void 0},d=()=>{if(t()){if(!n)c();return}if(n)i()};return d(),{isReady:()=>t(),ready:(u)=>{if(t())return Promise.resolve();let l=s;if(!u||u<=0)return l;return new Promise((y,p)=>{let b=setTimeout(()=>p(r(u)),u);l.then(()=>{clearTimeout(b),y()},(M)=>{clearTimeout(b),p(M)})})},refresh:d,settle:c}}var bs="App",xc="ionite",Rs=104857600,Uc=Rs,Mc=10485760,_n=3,qc=250,Wc={};function pt(e,t){return t.mapGroup?t.mapGroup(e):e}class et extends Pc{constructor(e,t={}){super(e,{cause:t.cause,status:Qe(t.upstreamStatus),upstreamStatus:t.upstreamStatus});this.name="OaaError";this.retryable=t.retryable??!1,this.code=t.code,this.warnings=t.warnings}}function jc(e){let t=e();return Boolean(t?.url&&t.providerId&&t.datasourceId)}function Ts(e,t,r,n=()=>({}),o=()=>{return},s,i){let c=async(u)=>{await Ss(e,be(t),u,{mode:"incremental"})},d=ye("OAA",()=>jc(t),(u)=>new et(`OAA ready timed out after ${u}ms`,{code:"not_ready"}));return{describe:()=>{let u=t();return Se({ready:d.isReady(),url:u?.url,providerId:u?.providerId,datasourceId:u?.datasourceId,applicationName:u?.applicationName,applicationType:u?.applicationType,population:{users:Ut(u,"user"),customers:Ut(u,"customer"),workloads:Ut(u,"workload")},fullSync:u?.fullSync?.enabled===!0})},isReady:d.isReady,ready:d.ready,refreshReadiness:d.refresh,population(u){return Ut(t(),u)},async pushUser(u){let l=be(t);if(!await Ln(l,"user",Oe(u),o()))return;let y=await Is(u,n());await c(Ie(l,{local_users:[Mt(y,"user","modify")]},!0))},async pushCustomer(u){let l=be(t);if(!await Ln(l,"customer",Oe(u),o()))return;let y=await Ps(u,n());await c(Ie(l,{local_users:[Mt(y,"customer","modify")]},!0))},async pushWorkload(u){let l=be(t);if(!await Ln(l,"workload",Oe(u),o()))return;let y=await Os(u,n());await c(Ie(l,{local_users:[Mt(y,"workload","modify")]},!0))},async pushGroup(u){let l=be(t),y=r(),p=pt(u,y),b=Wr(p,ft(l),"add"),M=await xn(p,"group",i?.(),y,l);await c(Ie(l,rr({local_groups:[ht(p,"modify")],identity_to_permissions:b?[b]:[]},M),!0))},async pushRole(u){let l=be(t),y=r(),p=y.mapRole?y.mapRole(u):u,b=await xn(p,"role",i?.(),y,l);await c(Ie(l,rr({local_roles:[wt(p,"modify")]},b),!0))},async pushPermission(u){let l=be(t);await c(Ie(l,{permissions:[qt(u,r().mapPermissionTypes,"modify")]},!0))},async pushResource(u){let l=be(t),y=r(),p=y.mapResource?y.mapResource(u):u,b=await Bc(p,i?.(),y);await c(Ie(l,{resources:b},!0))},async grant(u){let l=be(t),y=r(),p=await Cs(u,i?.(),y,l);await c(hs(l,u,"add",y,p))},async revoke(u){let l=be(t);await c(hs(l,u,"delete",r()))},async pushAccessChanges(u){if(u.length===0)return;let l=be(t),y=r(),p=i?.(),b=await $c(l,u,y,p);await c(b)},async deleteUser(u){let l=be(t);await c(Ie(l,{local_users:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deleteCustomer(u){let l=be(t);await c(Ie(l,{local_users:[ws(u,"customer")]},!0))},async deleteWorkload(u){let l=be(t);await c(Ie(l,{local_users:[ws(u,"workload")]},!0))},async deleteGroup(u){let l=be(t);await c(Ie(l,{local_groups:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deleteRole(u){let l=be(t);await c(Ie(l,{local_roles:[{name:u,unique_id:u,operation:"delete"}]},!0))},async deletePermission(u){let l=be(t);await c(Ie(l,{permissions:[{name:u,unique_id:u,permission_type:[],operation:"delete"}]},!0))},async deleteResource(u){let l=be(t);await c(Ie(l,{resources:[{name:u,id:u,resource_type:"",operation:"delete"}]},!0))},async sync(u,l){let y=be(t),p=l?.mode==="incremental",b=p?void 0:s?.(),M=await Nc(y,u,r(),n(),p,b);return Ss(e,y,M,l)}}}function be(e){let t=e();if(!t?.url||!t.providerId||!t.datasourceId)throw new et("OAA is not configured",{code:"not_configured"});return t}async function Nc(e,t,r,n,o,s){let i=[],c=[],d=[],u=[],l=[],y=[],p=o?"modify":void 0,b=new Set,M=[],_=new Set,R=(a)=>Cc(a);for await(let a of lt(t.access))M.push(a),_.add(`${a.subjectType}:${Oe(a.subject)}`);let W=(a,w)=>Ut(e,a)==="all"||Boolean(w&&_.has(`${a}:${w}`));for await(let a of lt(t.users))if(W("user",Oe(a)))i.push(Mt(await Is(a,n),"user",p));for await(let a of lt(t.customers))if(W("customer",Oe(a)))i.push(Mt(await Ps(a,n),"customer",p));for await(let a of lt(t.workloads))if(W("workload",Oe(a)))i.push(Mt(await Os(a,n),"workload",p));for await(let a of lt(t.groups)){let w=pt(a,r);c.push(ht(w,p));let v=Wr(w,ft(e),o?"add":void 0);if(v)y.push(v)}for await(let a of lt(t.roles)){let w=r.mapRole?r.mapRole(a):a;l.push(wt(w,p))}for await(let a of lt(t.permissions))u.push(qt(a,r.mapPermissionTypes,p));let q=[];for await(let a of lt(t.resources)){let w=r.mapResource?r.mapResource(a):a;q.push(w)}d.push(...As(q,p));for(let a of M)if(b.add(R(a)),qr(a,y,i,ft(e),o?"add":void 0),typeof a.target!=="string")if(a.targetType==="role"){let w=r.mapRole?r.mapRole(a.target):a.target;l.push(wt(w,p))}else if(a.targetType==="permission")u.push(qt(a.target,r.mapPermissionTypes,p));else{let w=pt(a.target,r);c.push(ht(w,p))}for(let a of s??[]){let w=R(a);if(b.has(w))continue;b.add(w);let v=Oe(a.subject);if(v&&!i.some((L)=>Oe(L.unique_id??L.name)===v))i.push({name:v,unique_id:v,is_active:!0,operation:p,custom_properties:{identity_type:"workload",source:"eci-trusted"}});qr(a,y,i,ft(e),p)}return Ie(e,{local_users:i,local_groups:c,local_roles:l,resources:d,permissions:u,identity_to_permissions:y},o)}function Ie(e,t,r){let n={name:e.applicationName??bs,application_type:e.applicationType??xc,local_users:t.local_users??[],local_groups:t.local_groups??[],local_roles:t.local_roles??[],resources:t.resources??[],custom_properties:{},tags:[]};if(r)n.operation="modify";return Ae({applications:[n],permissions:t.permissions??[],identity_to_permissions:t.identity_to_permissions??[],is_incremental:r?!0:void 0})}function hs(e,t,r,n=Wc,o){let s=[],i=[],c=[],d=[],u=[];qr(t,s,i,ft(e),r);let l=r==="delete"?"delete":"modify";if(typeof t.target!=="string")if(t.targetType==="role"){let p=n.mapRole?n.mapRole(t.target):t.target;d.push(wt(p,l))}else if(t.targetType==="permission")u.push(qt(t.target,n.mapPermissionTypes,l));else{let p=pt(t.target,n);c.push(ht(p,l))}let y={local_users:i,local_groups:c,local_roles:d,permissions:u,identity_to_permissions:s};return Ie(e,o?rr(y,o):y,!0)}async function $c(e,t,r,n){let o=ft(e),s=[],i=[],c=[],d=[],u=[],l=[],y=[],p=[];for(let{change:M,op:_}of t){qr(M,_==="delete"?d:i,_==="delete"?c:s,o,_==="delete"?"delete":"add");let a=_==="delete"?"delete":"modify";if(typeof M.target!=="string")if(M.targetType==="role"){let w=r.mapRole?r.mapRole(M.target):M.target;l.push(wt(w,a))}else if(M.targetType==="permission")y.push(qt(M.target,r.mapPermissionTypes,a));else{let w=pt(M.target,r);u.push(ht(w,a))}if(_==="add")p.push(await Cs(M,n,r,e))}let b={local_users:[...s,...c],local_groups:u,local_roles:l,permissions:y,identity_to_permissions:[...i,...d]};return Ie(e,rr(b,...p),!0)}function rr(...e){let t={},r=["local_users","local_groups","local_roles","resources","permissions","identity_to_permissions"];for(let n of e)for(let o of r){let s=n[o];if(s&&s.length>0)t[o]=[...t[o]??[],...s]}return t}async function xn(e,t,r,n,o){if(!r)return{};let s=await Lc(e,t,{catalog:r.catalog,code:r.code,resources:r.resources,cache:r.cache}),i=[];for(let c of s.groups){let d=pt(c,n),u=Wr(d,ft(o),"add");if(u)i.push(u)}return{local_groups:s.groups.map((c)=>ht(pt(c,n),"modify")),local_roles:s.roles.map((c)=>wt(n.mapRole?n.mapRole(c):c,"modify")),permissions:s.permissions.map((c)=>qt(c,n.mapPermissionTypes,"modify")),resources:s.resources.map((c)=>jr(n.mapResource?n.mapResource(c):c,"modify")),identity_to_permissions:i}}async function Cs(e,t,r,n){if(!t)return{};if(e.targetType!=="group"&&e.targetType!=="role")return{};let o=Oe(e.target);if(!o)return{};let s=typeof e.target==="string"?await Dc(e.targetType,o,t):e.target;if(!s)return{};let i={};if(typeof e.target==="string")if(e.targetType==="group"){let d=pt(s,r),u=Wr(d,ft(n),"add");i={local_groups:[ht(d,"modify")],identity_to_permissions:u?[u]:[]}}else{let d=r.mapRole?r.mapRole(s):s;i={local_roles:[wt(d,"modify")]}}let c=await xn(s,e.targetType,t,r,n);return rr(i,c)}async function Dc(e,t,r){if(r.cache)return await r.cache.getNode(e,t);let n=e==="group"?r.code?.groups.get(t):r.code?.roles.get(t),s=await(e==="group"?r.catalog?.groups:r.catalog?.roles)?.get(t);return s&&n?Oc(e,n,s):s??n}function qr(e,t,r,n,o){let s=Oe(e.subject),i=Oe(e.target),c=r.find((y)=>Oe(y.unique_id??y.name)===s);if(e.subjectType!=="user")if(c)c.custom_properties={...c.custom_properties,identity_type:e.subjectType};else c={name:s,unique_id:s,custom_properties:{identity_type:e.subjectType},operation:o},r.push(c);if(e.targetType==="group"){if(c){let y=new Set(c.groups??[]);if(y.add(i),c.groups=[...y],o)c.operation=o}else r.push({name:s,unique_id:s,groups:[i],operation:o});return}let d={identity:s,identity_type:"local_user",operation:o},u=e.resources??[],l=e.applyToApplication??u.length===0;if(e.targetType==="role")d.role_assignments=[{application:n,role:i,apply_to_application:l,resources:u,operation:o}];else d.application_permissions=[{application:n,permission:i,apply_to_application:l,resources:u,operation:o}];t.push(d)}async function Is(e,t){let r=await(t.mapUserToScim?.(e)??Ac(e));return{...r,id:r.id??e.id}}async function Ps(e,t){let r=await(t.mapCustomerToScim?.(e)??Ec(e));return{...r,id:r.id??e.id}}async function Os(e,t){let r=await(t.mapWorkloadToScim?.(e)??_c(e));return{...r,id:r.id??e.id}}function Mt(e,t,r){let{schemas:n,id:o,displayName:s,userName:i,active:c,emails:d,groups:u,meta:l,attributes:y,...p}=e,b=p[ys];delete p[ys];let M=b&&typeof b==="object"?b.attributes:void 0,_=t==="user"?M:y,R=xt(o)??xt(e.externalId)??xt(i)??"principal";return Ae({name:xt(s)??xt(i)??R,unique_id:R,identities:t==="customer"?void 0:Kc(e),groups:t==="user"&&Array.isArray(u)?u.map((W)=>typeof W==="string"?W:he(W,"value")).filter((W)=>Boolean(W)):void 0,is_active:typeof c==="boolean"?c:void 0,created_at:l&&typeof l==="object"?he(l,"created"):void 0,custom_properties:Ae({...p,..._&&typeof _==="object"?_:{},ecid:t==="customer"?void 0:Es(e),accountClass:Fc(e),externalId:e.externalId,userName:i,emails:d,identity_type:t==="user"?void 0:t}),tags:[],operation:r})}function Kc(e){let t=Es(e),r=e.emails,n=Array.isArray(r)?r.map((s)=>s&&typeof s==="object"?he(s,"value"):void 0).filter((s)=>Boolean(s)):[],o=[...t?[t]:[],...n];return o.length>0?o:void 0}function Es(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return xt(e.ecid)??(t&&typeof t==="object"?he(t,"ecid"):void 0)}function Fc(e){let t=e["urn:ionite:scim:schemas:extension:ion:2.0:User"];return t&&typeof t==="object"?he(t,"accountClass"):void 0}function ws(e,t){return{name:e,unique_id:e,custom_properties:{identity_type:t},operation:"delete"}}function ht(e,t){let r=Vc(e),n=he(e,"id")??he(e,"name")??he(e,"displayName"),o=he(e,"displayName")??he(e,"name")??n??"group",s=Mr(e,"resources");return Ae({name:o,unique_id:n,custom_properties:Ae({...r?.attributes??er(e,tr),requestable:r?.requestable??ru(e,"requestable"),description:r?.description??he(e,"description"),type:r?.type,resources:s.length>0?s:void 0,riskLevel:r?.riskLevel??he(e,"riskLevel")??Un}),tags:[],operation:t})}function Vc(e){let t=e[Ic];if(!t||typeof t!=="object"||Array.isArray(t))return;return t}function Mr(e,t){if(!e||typeof e!=="object")return[];let r=e[t];if(!Array.isArray(r))return[];return r.map(Oe).filter((n)=>n.length>0)}function zc(e){return he(e,"id")??he(e,"name")??he(e,"displayName")??"group"}function Wr(e,t,r){let n=Mr(e,"resources"),o=n.length>0,s=!o,i=o?n:[],c=Mr(e,"roles").map((u)=>({application:t,role:u,apply_to_application:s,resources:i,operation:r})),d=Mr(e,"permissions").map((u)=>({application:t,permission:u,apply_to_application:s,resources:i,operation:r}));if(c.length===0&&d.length===0)return;return{identity:zc(e),identity_type:"local_group",role_assignments:c.length>0?c:void 0,application_permissions:d.length>0?d:void 0,operation:r}}function wt(e,t){return Ae({name:e.name,unique_id:e.id,permissions:e.permissions?.map((r)=>typeof r==="string"?r:r.id),custom_properties:Ae({...er(e,tr),displayName:e.displayName,requestable:e.requestable,riskLevel:e.riskLevel??Un}),tags:[],operation:t})}function qt(e,t,r){return Ae({name:e.name,unique_id:e.id,permission_type:t?.(e)??e.permissionTypes??[e.action??"Uncategorized"],apply_to_sub_resources:e.applyToSubResources,resource_types:e.resourceTypes,custom_properties:{...er(e,tr),riskLevel:e.riskLevel??Un},operation:r})}function jr(e,t,r,n=new Set){let o=e.id;if(o&&n.has(o))return Ae({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,custom_properties:Ae({...er(e,tr)}),tags:[],operation:t});if(o)n.add(o);let s=[];for(let i of e.resources??[]){let c=typeof i==="string"?r?.get(i):i;if(c)s.push(jr(c,t,r,n))}if(o)n.delete(o);return Ae({name:e.displayName??e.name,id:e.id,resource_type:e.type,description:e.description,sub_resources:s.length>0?s:void 0,custom_properties:Ae({...er(e,tr)}),tags:[],operation:t})}function As(e,t){if(e.length===0)return[];let r=new Map;for(let d of e)if(d.id)r.set(d.id,d);let n=new Map,o=new Set,s=(d,u)=>{if(!u.id||u.id===d)return;let l=n.get(d)??[];if(!l.some((y)=>y.id===u.id))l.push(u);n.set(d,l),o.add(u.id)};for(let d of e){for(let l of d.resources??[]){let y=typeof l==="string"?r.get(l):l;if(y&&d.id)s(d.id,y)}let u=Oe(d.parent);if(u&&r.has(u)&&d.id)s(u,d)}let i=(d)=>{if(!d.id)return d;let u=n.get(d.id);if(!u||u.length===0)return d;return{...d,resources:u.map(i)}};return e.filter((d)=>!d.id||!o.has(d.id)).map(i).map((d)=>jr(d,t,r))}async function Bc(e,t,r){if(!t)return[jr(e,"modify")];let n=async(l)=>{if(t.cache)return await t.cache.getNode("resource",l);return t.resources?.get(l)},o=async(l)=>{if(t.resources?.children&&l.id&&(!l.resources||l.resources.length===0))return t.resources.children(l.id);let y=[];for(let p of l.resources??[]){let b=typeof p==="string"?await n(p):p;if(b)y.push(b)}return y},s=e,i=new Set;while(!0){let l=Oe(s.parent);if(!l||i.has(l))break;i.add(l);let y=await n(l);if(!y)break;s=y}let c=[],d=[s],u=new Set;while(d.length>0){let l=d.shift();if(!l)break;if(l.id&&u.has(l.id))continue;if(l.id)u.add(l.id);let y=r.mapResource?r.mapResource(l):l;c.push(y);for(let p of await o(l))d.push(p)}if(e.id&&!u.has(e.id))c.push(r.mapResource?r.mapResource(e):e);return As(c,"modify")}async function Ss(e,t,r,n){let o=JSON.stringify(Ae(r)),s=n?.compression??t.compression??"gzip",i=s==="gzip"?await Qc(o):o,c=tu(i),d=n?.maxPayloadBytes??t.maxPayloadBytes??Rs,u=n?.multipart??t.multipart??"auto",l=n?.multipartThresholdBytes??t.multipartThresholdBytes??Uc;if(c>d&&u==="never")throw new et("OAA payload exceeds maximum single payload size",{code:"payload_too_large",retryable:!1});if(u==="always"||u==="auto"&&c>l)return Hc(e,t,i,s,n);return Gc(t,{id:t.datasourceId,data_source_id:t.datasourceId,json_data:i,compression_type:s==="gzip"?"GZIP":"NONE"})}async function Gc(e,t){let r=`${Us(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:push`,n=await Nr(r,{method:"POST",headers:{...vs,Authorization:`Bearer ${e.apiKey??""}`,...ks},body:JSON.stringify(t)});return Ls(n)}async function Hc(e,t,r,n,o){let s=o?.partSizeBytes??t.partSizeBytes??Mc,i=await Jc(t,n),c=eu(r,s);for(let u=0;u<c.length;u++)await Yc(t,i,u+1,c[u]??"");let d=await Xc(t,i,c.length);return e.debug("OAA multipart payload pushed",{uploadId:i,parts:c.length}),{...d,uploadId:d.uploadId??i,parts:d.parts??c.length}}async function Jc(e,t){let r=Mn(e,"multipart/start"),n=await Nr(r,{method:"POST",headers:qn(e),body:JSON.stringify({data_source_id:e.datasourceId,compression_type:t==="gzip"?"GZIP":"NONE"})}),o=await Wn(n),s=he(o,"upload_id")??he(o,"uploadId")??he(o,"id");if(!s)throw new et("OAA multipart start response did not include an upload id",{code:"invalid_response"});return s}async function Yc(e,t,r,n){let o=Mn(e,`multipart/${encodeURIComponent(t)}/parts/${r}`);await Nr(o,{method:"PUT",headers:qn(e),body:JSON.stringify({upload_id:t,sequence:r,data:n})})}async function Xc(e,t,r){let n=Mn(e,`multipart/${encodeURIComponent(t)}/complete`),o=await Nr(n,{method:"POST",headers:qn(e),body:JSON.stringify({upload_id:t,parts:r})});return Ls(o)}function Mn(e,t){return`${Us(e.url)}/api/v1/providers/custom/${encodeURIComponent(e.providerId)}/datasources/${encodeURIComponent(e.datasourceId)}:${t}`}function qn(e){return{...vs,Authorization:`Bearer ${e.apiKey??""}`,...ks}}async function Nr(e,t){let r;for(let n=0;n<_n;n++){try{let o=await fetch(e,t);if(!_s(o.status)||n===_n-1){if(!o.ok)await Zc(o);return o}r=new et(`OAA request failed with retryable status ${o.status}`,{retryable:!0,upstreamStatus:o.status})}catch(o){if(r=o,o instanceof et&&!o.retryable)throw o;if(n===_n-1)break}await ou(qc*2**n)}throw new et("OAA request failed after retries",{code:"request_failed",retryable:!0,cause:r})}function _s(e){return e===429||e>=500}async function Zc(e){let t=await Wn(e).catch(()=>{return}),r=he(t,"message")??he(t,"error")??`OAA request failed with status ${e.status}`;throw new et(r,{code:he(t,"code")??"http_error",upstreamStatus:e.status,retryable:_s(e.status),warnings:xs(t?.warnings)})}async function Ls(e){let t=await Wn(e).catch(()=>{return});return{success:e.ok,syncToken:he(t,"sync_token")??he(t,"syncToken"),uploadId:he(t,"upload_id")??he(t,"uploadId"),parts:nu(t,"parts"),warnings:xs(t?.warnings),metadata:t}}async function Wn(e){let t=await e.text();if(!t)return{};let r=JSON.parse(t);return r&&typeof r==="object"&&!Array.isArray(r)?r:{}}async function Qc(e){let t=new Blob([e]).stream().pipeThrough(new CompressionStream("gzip")),r=await new Response(t).arrayBuffer();return Buffer.from(r).toString("base64")}function eu(e,t){let r=[];for(let n=0;n<e.length;n+=t)r.push(e.slice(n,n+t));return r}function tu(e){return Buffer.byteLength(e,"utf8")}function he(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="string"&&r.length>0?r:void 0}function xt(e){return typeof e==="string"&&e.length>0?e:void 0}function ru(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="boolean"?r:void 0}function nu(e,t){if(!e||typeof e!=="object")return;let r=e[t];return typeof r==="number"?r:void 0}function xs(e){if(!Array.isArray(e))return;let t=e.filter((r)=>typeof r==="string");return t.length>0?t:void 0}async function*lt(e){if(!e)return;for await(let t of e)yield t}function Ae(e){if(Array.isArray(e))return e.map(Ae).filter((r)=>r!==void 0);if(!e||typeof e!=="object"||e instanceof Date)return e===null?void 0:e;let t=Object.entries(e).map(([r,n])=>[r,Ae(n)]).filter(([,r])=>{if(r===void 0)return!1;if(Array.isArray(r)&&r.length===0)return!1;if(r&&typeof r==="object"&&!Array.isArray(r)&&Object.keys(r).length===0)return!1;return!0});return t.length>0?Object.fromEntries(t):void 0}function Us(e){return e.replace(/\/+$/,"")}function ft(e){return e.applicationName??bs}function Ut(e,t){if(t==="user")return e?.users?.population??"all";if(t==="customer")return e?.customers?.population??"access";return e?.workloads?.population??"access"}async function Ln(e,t,r,n){if(Ut(e,t)==="all")return!0;if(!n||!r)return!1;return(await n.listBySubject(r,t,{start:0,limit:1})).items.length>0}function ou(e){return new Promise((t)=>setTimeout(t,e))}function $n(e,t){if(!t)return"app";if(e==="user")return t.users.assignment;if(e==="workload")return t.workloads.assignment;return t.customers.assignment}function js(e,t=()=>{return},r=()=>{return},n=()=>{return},o=()=>({})){let s,i=!1,c=(C,g,P)=>{let I=r();if(!I)throw new tt("Cannot use AccessRequests: no destination channels are configured.",{status:500});if(C==="iam-request"){let S=I.channel("iam");if(!S)throw new tt("Cannot use AccessRequests: the IAM destination is not configured.",{status:500});return S}if(C!=="idp")throw new nr(`Cannot use AccessRequests for a "${g}" principal: RemoteConfig assignment policy is "${C}".`,C);if(g==="user"){let S=I.channel("sso");if(!S)throw new tt("Cannot use AccessRequests: the SSO destination is not configured.",{status:500});return S}if(g==="workload")throw new nr('Cannot use AccessRequests with assignment policy "idp" for workloads.',C);let U=I.ciamProviders(),E=P??(U.length===1?U[0]:void 0);if(!E)throw new tt(U.length===0?"Cannot use AccessRequests: no CIAM provider destination is configured.":"Cannot use AccessRequests: provider is required when multiple CIAM provider destinations are configured.",{status:U.length===0?500:400,statusText:U.length===0?void 0:"provider_required"});let F=I.channel(`ciam:${E}`);if(!F)throw new tt(`Cannot use AccessRequests: CIAM provider "${E}" is not configured.`,{status:500});return F},d,u,l=Ts(e,()=>s?.oaa,()=>({mapPermissionTypes:s?.mapPermissionTypes,mapGroup:s?.mapGroup,mapRole:s?.mapRole,mapResource:s?.mapResource}),o,()=>s?.accessStore,()=>iu(s),()=>y());function y(){let C=s?.catalogStore;return C||d?{catalog:C,code:d,resources:s?.resources,cache:u}:void 0}let p=(C)=>{if(C.op!=="set"||!C.previous)return!1;if(!(C.previous.providerId!==C.entity.providerId||C.previous.requestUrl!==C.entity.requestUrl))return!1;let{providerId:P,requestUrl:I,...U}=C.previous,{providerId:E,requestUrl:F,...S}=C.entity;return au(U,S)},b=(C)=>{if(i)return;let{kind:g}=C;if(l.isReady())(C.op==="delete"?g==="role"?l.deleteRole(C.entity.id):g==="permission"?l.deletePermission(C.entity.id):l.deleteGroup(C.entity.id):g==="role"?l.pushRole(C.entity):g==="permission"?l.pushPermission(C.entity):l.pushGroup(C.entity)).catch((E)=>{e.warn("OAA incremental projection from catalog change failed; full sync will reconcile",{op:C.op,kind:g,error:E})});let P=t();if(!P?.isReady())return;if(C.op==="set"&&C.entity.requestable!==!0){if(C.previous?.requestable===!0)P.onEntitlementDelete(g,C.previous.id).catch((U)=>{e.warn("IAM delta removal of a no-longer-requestable entitlement failed",{"ion.operation":"iam.delta.delete","ion.outcome":"degraded",id:C.entity.id,kind:g,error:U instanceof Error?U.message:String(U)})});return}(C.op==="delete"?P.onEntitlementDelete(g,C.entity.id):P.onEntitlementUpsert(C.entity,g)).catch((U)=>{e.warn("IAM delta projection from catalog change failed; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:C.op,kind:g,error:U instanceof Error?U.message:String(U)})})},M=(C)=>{if(i)return;let g=s?.resources;if(!g)return;if(l.isReady())(async()=>{if(C.deleted){await l.deleteResource(C.id);return}let I=await g.get(C.id);if(!I)return;await l.pushResource(I)})().catch((I)=>{e.warn("OAA incremental projection from resource change failed; full sync will reconcile",{id:C.id,deleted:C.deleted===!0,error:I})})},_,R,W,q,a=()=>({allow:!1,metadata:{reason:"access_index_not_configured"}}),w=!1,v=()=>{let C=s?.accessIndex;if(!C&&!w)w=!0,e.warn("ion.authz.has* called but no accessIndex is configured; denying by default");return C},L=async(C)=>{let g=s?.accessIndex,P=s?.catalogStore;if(!g||!P&&!d)return!1;let I=C.id??jn(C),U=await Ws({...C,id:I},{catalog:P,code:d,resources:s?.resources,cache:u});return await g.materialize(I,U),!0},H=(C,g)=>mu(C,g,{accessStore:s?.accessStore,accessIndex:s?.accessIndex,catalogStore:s?.catalogStore,code:d,resources:s?.resources},u),J=async()=>{let C=s?.catalogStore;if(!C)return;await cu(d,C)},Y=async()=>{let C={subjects:0,roots:0,cleared:0};if(i)return C;await J();let g=s?.accessIndex,P=s?.catalogStore;if(!g||!P&&!d)return C;let I=new Map,U=(S)=>{let O=mt(S.subject);if(!O)return;let k=S.subjectType;I.set(`${k}:${O}`,{subject:O,subjectType:k})},E=new Set,F=s?.accessStore;if(F)for await(let S of Nn((O,k)=>F.list({start:O,limit:k}))){U({subject:mt(S.subject),subjectType:S.subjectType});let O=mt(S.target);if(u&&O&&typeof S.target==="string"){if(!await u.getNode(S.targetType,O))E.add(`${S.targetType}:${O}`)}}if(E.size>0)e.warn("Full reconcile found granted roots whose target entitlements no longer resolve in any definition source (code catalog or catalog store). If an entitlement id was renamed in "+"code, migrate the existing grants to the new id — these members currently have NO effective access "+"from those roots.",{"ion.operation":"authz.reconcile.dangling_roots","ion.outcome":"degraded",targets:[...E].sort()});if(g.listSubjects)for(let S of await g.listSubjects())U(S);for(let S of I.values()){let O=await H(S.subject,S.subjectType);if(C.subjects+=1,C.roots+=O,O===0)C.cleared+=1}return C},re=()=>{if(i)return Promise.resolve({subjects:0,roots:0,cleared:0});return Y()},ue=Promise.resolve(),se=!1,K=(C,g)=>{let P=ue.then(async()=>{if(i)return;try{await g()}catch(I){e.warn(`${C} reconcile failed; a later full reconcile will recover`,{"ion.operation":"authz.reconcile.queue","ion.outcome":"degraded",label:C,error:I instanceof Error?I.message:String(I)})}});return ue=P,P},ee=(C)=>{if(se)return;se=!0,K(C,async()=>{se=!1,await Y()})},z=()=>ue,D=(C)=>{if(i)return;let g=s?.accessStore;if(!s?.accessIndex||!s?.catalogStore||!g)return;if(u?.invalidate(C),C.op==="set"){let P=C.kind,I=C.entity.id;K("catalog-change",async()=>{for await(let U of Nn((E,F)=>g.listByTarget(P,I,{start:E,limit:F})))await L(U)})}else ee("catalog-delete")},Q=(C)=>{if(i)return;if(u?.clear(),!s?.accessIndex||!s?.catalogStore&&!d||!s?.accessStore)return;ee("resource-change")},ne={describe:()=>Se({module:"authz",active:s!==void 0,ready:s!==void 0,trustedProvisioningClients:(s?.trustedProvisioningClients??[]).map((C)=>({issuer:C.issuer,audience:C.audience,clientId:C.clientId,permissions:[...C.permissions]})),oaa:s?.oaa?l.describe():void 0,inboundEntitlements:s?.onInboundEntitlement!==void 0,stores:{accessStore:s?.accessStore!==void 0,accessIndex:s?.accessIndex!==void 0,catalogStore:s?.catalogStore!==void 0,resources:s?.resources!==void 0}}),oaa:l,entitlements:{async list(C){let g=qs(d,s?.catalogStore),P=Math.max(0,C?.start??0),I=C?.limit;if(!g)return Ms(0,[],P,I);let U=[];for(let F of[g.groups,g.roles,g.permissions])for await(let S of Nn((O,k)=>F.list({start:O,limit:k,filter:C?.filter})))U.push(S);let E=I==null?void 0:P+I;return Ms(U.length,U.slice(P,E),P,I)}},get catalogStore(){return s?.catalogStore},get accessStore(){return s?.accessStore},get accessIndex(){return s?.accessIndex},has(C,g,P,I,U){let E=v();return E?E.has(C,g,P,I,U):Promise.resolve(a())},hasGroup(C,g,P,I){let U=v();return U?U.hasGroup(C,g,P,I):Promise.resolve(a())},hasRole(C,g,P,I){let U=v();return U?U.hasRole(C,g,P,I):Promise.resolve(a())},hasPermission(C,g,P,I){let U=v();return U?U.hasPermission(C,g,P,I):Promise.resolve(a())},hasAny(C,g,P){let I=v();return I?I.hasAny(C,g,P):Promise.resolve(a())},hasAll(C,g,P){let I=v();return I?I.hasAll(C,g,P):Promise.resolve(a())},reconcile(){return re()},async grant(C){$r(C.subjectType);let g=mt(C.target),P=$n(C.subjectType,n());if(P!=="app")throw new nr(P==="iam-request"||P==="idp"?`Cannot grant ${C.targetType} "${g}" to a "${C.subjectType}" principal: RemoteConfig assignment policy is "${P}". Use ion.authz.requestAccess.`:`Cannot grant ${C.targetType} "${g}" to a "${C.subjectType}" principal: RemoteConfig assignment policy is "${P}".`,P,await ie(C));await ce(C),await fu(s?.catalogStore,d,C,u);let I={...C,status:C.status??"active"};I.id=jn(I);let U=s?.accessStore;if(!U)throw new tt("Cannot grant: no AccessAssignmentStore is wired.",{status:500});if(await U.grant(I),s?.accessIndex&&(s.catalogStore||d)){let E=await Ws(I,{catalog:s.catalogStore,code:d,resources:s.resources,cache:u});await s.accessIndex.materialize(I.id,E)}return await ae(I,"grant"),I},async requestAccess(C){$r(C.subjectType);let g=$n(C.subjectType,n());if(g!=="iam-request"&&g!=="idp")throw new nr(`Cannot request access for a "${C.subjectType}" principal: RemoteConfig assignment policy is "${g}" (use ion.authz.grant when policy is "app").`,g);let P=mt(C.subject),I=mt(C.target);return c(g,C.subjectType,C.provider).submit({subject:P,subjectType:C.subjectType,targetType:C.targetType,target:I,operation:C.operation,justification:C.justification})},async getAccessRequest(C){$r(C.subjectType);let g=$n(C.subjectType,n());if(g!=="iam-request"&&g!=="idp")throw new nr(`Cannot read an access request for a "${C.subjectType}" principal: RemoteConfig assignment policy is "${g}".`,g);return c(g,C.subjectType,C.provider).get(C.id)},async revoke(C){$r(C.subjectType);let g=C,P={...g,id:g.id??jn(g)},I=s?.accessStore;if(!I)throw new tt("Cannot revoke: no AccessAssignmentStore is wired.",{status:500});await I.revoke(P),await s?.accessIndex?.removeByRoot(P.id),await ae(P,"revoke")}},ie=async(C)=>{let g=mt(C.target),P=qs(d,s?.catalogStore);if(P){let I=C.targetType==="role"?await P.roles.get(g):C.targetType==="permission"?await P.permissions.get(g):await P.groups.get(g);if(I?.requestUrl)return I.requestUrl}return(await t()?.getDestinationRef("group",g))?.requestUrl},ce=async(C)=>{let g=uu(d,mt(C.target));if(!g)return;if(g.kind!==C.targetType)throw new tt(`Cannot grant ${C.targetType} "${g.entity.id}": code declares that id as ${g.kind}.`,{status:409,statusText:"entitlement_kind_mismatch"});if(!s?.catalogStore)throw new tt(`Cannot grant code entitlement "${g.entity.id}": no AccessCatalogStore is wired for materialization.`,{status:500});await du(g.kind,g.entity,su(s.catalogStore,g.kind))},ae=async(C,g)=>{if(l.isReady())try{if(g==="grant")await l.grant(C);else await l.revoke(C)}catch(I){e.warn("OAA incremental access push failed after ion.authz mutation; full sync will reconcile",{"ion.operation":"authz.oaa.push","ion.outcome":"degraded",op:g,error:I instanceof Error?I.message:String(I)})}let P=t();if(!P?.isReady())return;try{if(g==="grant")await P.onGrant(C);else await P.onRevoke(C)}catch(I){e.warn("IAM delta projection failed after ion.authz mutation; full aggregation will reconcile",{"ion.operation":"iam.delta.egress","ion.outcome":"degraded",op:g,error:I instanceof Error?I.message:String(I)})}};return{update(C){if(i)return ne;let g=C?.catalog?lu(C.catalog):void 0,P=g!==d;d=g,s=C,l.refreshReadiness();let I=C?.catalogStore,U=C?.resources;if(I!==_||U!==W||P)R?.(),q?.(),u=I||d?new pu(I,U,d):void 0,R=I?.afterChange?I.afterChange((E)=>{if(p(E))return;b(E),D(E)}):void 0,q=U?.changed?U.changed((E)=>{Q(E),M(E)}):void 0,_=I,W=U;else if(u)u.clear();return ne},settle:z,catalogView:y,close(){if(i)return;i=!0,R?.(),R=void 0,q?.(),q=void 0,_=void 0,W=void 0,u=void 0}}}function Ns(e){return e.trim().toUpperCase().replace(/[^A-Z0-9]+/g,"_").replace(/_+/g,"_").replace(/^_+|_+$/g,"")||"EMPTY"}function gu(e){let t=`${e.clientId}\x00${e.path}`,r=2166136261;for(let n=0;n<t.length;n+=1)r^=t.charCodeAt(n),r=Math.imul(r,16777619);return(r>>>0).toString(36)}function yu(e){let t=Ns(e.clientId),r=Ns(e.path);return`LFV_${t}__${r}`}function Dn(e,t){let r=yu(t);if(!(r in e))return r;let n=`${r}_${gu(t)}`;if(!(n in e))return n;return`${n}_ALT`}import{defaultLogger as Tg,describeOriginUrl as Cg}from"@ionite/core";import{ACCEPT_JSON as Nt,CONTENT_TYPE_JSON as Ee,defaultLogger as Pu,describeOriginUrl as Ou,IoniteError as Xs,readJsonResponse as $t,stableConfigHash as Eu}from"@ionite/core";import{verifyLfvSignature as Bs}from"@ionite/core/server";import{DEFAULT_SECRET_MIME_TYPES as Wt}from"@ionite/core";var hu=new Set(["jsonc","env","text","binary","yaml","toml","xml"]);function wu(e){let t=e.split(";",1)[0]?.trim().toLowerCase()??"";if(t===Wt.binary)return"binary";if(t===Wt.env)return"env";if(t===Wt.yaml||t.endsWith("+yaml"))return"yaml";if(t===Wt.toml||t.endsWith("+toml"))return"toml";if(t===Wt.xml||t.endsWith("+xml"))return"xml";if(t===Wt.jsonc||t.endsWith("+json"))return"jsonc";return"text"}function Dr(e){if(!e||typeof e!=="object"||Array.isArray(e))return;let t=e,r=typeof t.mimeType==="string"?t.mimeType:typeof t.mime_type==="string"?t.mime_type:void 0;if(!r)return;let n=t.format,o=typeof n==="string"&&hu.has(n)?n:wu(r),s=typeof t.schemaUrl==="string"?t.schemaUrl:typeof t.schema_url==="string"?t.schema_url:void 0,i=typeof t.typeId==="string"?t.typeId:typeof t.type_id==="string"?t.type_id:void 0;return{format:o,mimeType:r,...s?{schemaUrl:s}:{},...i?{typeId:i}:{}}}function St(e){if(!e)return;let t=e.custom_metadata,r=t&&typeof t==="object"&&!Array.isArray(t)?t:void 0;return Dr(e.content_type??e.contentType??r?.content_type)}function Kr(e){return{format:e.format,mime_type:e.mimeType,...e.schemaUrl?{schema_url:e.schemaUrl}:{},...e.typeId?{type_id:e.typeId}:{}}}var jt=new Map;function Su(e){if(!e)return"/";return e.startsWith("/")?e:`/${e}`}function vu(e){try{let t=new URL(e),r=t.pathname.replace(/\/+$/g,"");return`${t.origin}${r}`}catch{return e.replace(/\/+$/g,"")}}function Fr(e){let t=vu(e.lfvServerUrl),r=Su(e.path);return`${t}|${r}`}function $s(e,t,r){let n=jt.get(e)??new Map;return n.set(t,r),jt.set(e,n),()=>{let o=jt.get(e);if(!o)return;if(o.delete(t),o.size===0)jt.delete(e)}}async function Ds(e,t,r,n){let o=jt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onDelivery)continue;if(await c.onDelivery(t)){s+=1;break}}return s}async function Ks(e,t,r,n){let o=jt.get(e);if(!o)return 0;let s=0;for(let[i,c]of o){if(r&&i===r)continue;if(c.trustId!==n)continue;if(!c.onEvents)continue;s+=1,await c.onEvents(t)}return s}import{defaultSecretContentType as ku,parseJsonc as bu,SecretContentTypeMismatchError as Ru}from"@ionite/core";function Fs(e){let t={},r=e.replace(/\r\n?/g,`
|
|
2
2
|
`).split(`
|
|
3
3
|
`);for(let n=0;n<r.length;n+=1){let s=(r[n]??"").trim();if(!s||s.startsWith("#"))continue;let i=s.startsWith("export ")?s.slice(7).trimStart():s,c=i.indexOf("=");if(c<=0)throw Error(`Invalid env entry at line ${n+1}: expected KEY=value`);let d=i.slice(0,c).trim();if(!/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(d))throw Error(`Invalid env key "${d}" at line ${n+1}`);let u=i.slice(c+1).trim();if(u.length>=2&&(u.startsWith('"')&&u.endsWith('"')||u.startsWith("'")&&u.endsWith("'"))){let l=u[0],y=u.slice(1,-1);t[d]=l==='"'?y.replace(/\\(n|r|t|"|\\)/g,(p,b)=>{if(b==="n")return`
|
|
4
4
|
`;if(b==="r")return"\r";if(b==="t")return"\t";return b}):y}else t[d]=u}return t}function Vs(e){return Object.entries(e).map(([t,r])=>{let n=String(r??"");if(!n||/[\s#"'\\]/.test(n))return`${t}=${JSON.stringify(n)}`;return`${t}=${n}`}).join(`
|
|
5
|
-
`)}function zs(e){try{let t=atob(e);return Uint8Array.from(t,(r)=>r.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function zr(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("Secret content is not an object");return e}function or(e){return e.metadata.contentType??ku()}function Kn(e,t){if(t==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof e.data==="string")return e.data;if(t==="jsonc")return JSON.stringify(e.data,null,2);if(t==="env")return Vs(zr(e.data));let r=zr(e.data).content;if(typeof r!=="string")throw Error(`Secret ${t} content must contain a string "content" field`);return r}function Vr(e,t){if(t==="jsonc")return typeof e.data==="string"?bu(e.data):e.data;if(t==="env")return typeof e.data==="string"?Fs(e.data):zr(e.data);if(t==="text")return Kn(e,t);if(t==="binary"){let r=zr(e.data).content_base64;if(typeof r!=="string")throw Error('Binary secret content must contain a "content_base64" string');return zs(r)}throw Error(`Typed ${t} decoding is not supported yet; use text() or bytes()`)}function Tu(e){return{format:e.format,mimeType:e.mimeType,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id}}function Cu(e,t){let r=or(e);if(r.format!==t.format||r.mimeType!==t.mimeType)throw new Ru(Tu(t),r)}async function Iu(e,t){if(!e.schema)return t;let r=await e.schema["~standard"].validate(t);if(r.issues){let n=r.issues.map((o)=>o.message).join("; ");throw Error(`Secret validation failed for type "${e.id}": ${n}`)}return r.value}function Ge(e){return{async text(){let t=await e();return Kn(t,or(t).format)},async json(){let t=await e(),r=or(t).format;if(r!=="jsonc")throw Error(`json() requires a jsonc secret; received ${r}`);return Vr(t,r)},async bytes(){let t=await e(),r=or(t).format;if(r==="binary")return Vr(t,r);return new TextEncoder().encode(Kn(t,r))},async env(){let t=await e(),r=or(t).format;if(r!=="env")throw Error(`env() requires an env secret; received ${r}`);return Vr(t,r)},async metadata(){return(await e()).metadata},async parse(t){let r=await e();return Cu(r,t),Iu(t,Vr(r,t.format))}}}function Gs(e){try{return new URL(e).pathname}catch{return e.startsWith("/")?e:`/${e}`}}var Au=1e4,_u=1e4,Lu=300,Hs=100;async function Gn(e){await new Promise((t)=>setTimeout(t,e))}function Me(e){return{startedAt:Date.now(),timeout:typeof e?.timeout==="number"&&e.timeout>0?e.timeout:void 0}}function Fn(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function ir(e){if(e.timeout===void 0)return;let t=Date.now()-e.startedAt;return Math.max(0,e.timeout-t)}function nt(e,t,r){return Error(`LFV ${e} timed out after ${r.timeout??0}ms for ${t}`)}async function Dt(e,t,r,n,o){let s=ir(r);if(s!==void 0){if(s<=0)throw nt(n,o,r);let i=new AbortController,c=setTimeout(()=>i.abort(),s);try{return await fetch(e,{...t,signal:i.signal})}catch(d){if(d instanceof Error&&d.name==="AbortError")throw nt(n,o,r);throw d}finally{clearTimeout(c)}}return await fetch(e,t)}class _e extends Xs{constructor(e){super(`LFV source closed while operating on ${e}`,{status:503,statusText:"unavailable"})}}class rt extends Xs{constructor(e,t){super(e,{status:Qe(t),upstreamStatus:t})}}class vt extends rt{constructor(e,t,r){super(`LFV ${t} failed (${e}) for ${r}`,e);if(e===404)this.code="not_found"}}var xu=new Set([400,401,403,404,409,410]);function Js(e){return e instanceof rt&&(!(e instanceof vt)||e.upstreamStatus!==void 0&&xu.has(e.upstreamStatus))}function Br(e){return e instanceof _e||e instanceof Error&&e.name==="LfvSourceClosedError"}function Uu(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`LFV kms_park returned invalid payload for ${t}`);let r=e;if(typeof r.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${t}`);let n=r.disposition;if(n!==void 0&&n!=="cooldown"&&n!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${t}`);return{parked:r.parked,...r.stale===!0?{stale:!0}:{},...n?{disposition:n}:{}}}function sr(e){try{let t=JSON.parse(e);return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:void 0}catch{return}}async function Vn(e,t,r,n,o,s,i,c,d,u){let l=0,y=Date.now();for(;;){if(u?.())throw new _e(n);let p=ir(r);if(p!==void 0&&p<=0)throw nt(o,n,r);try{return await e()}catch(b){if(b instanceof _e)throw b;if(u?.())throw new _e(n);if(l+=1,i>0&&Date.now()-y>=i){let _=`Error connecting to the LFV source. Retries: '${l}'`;if(c)c(d,_,{url:t,path:n,operation:o});y=Date.now()}let M=p===void 0?s:Math.min(s,p);if(M<=0)throw nt(o,n,r);if(await Gn(M),u?.())throw new _e(n)}}}function Mu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function zn(e){if(typeof e==="number"&&Number.isFinite(e))return e;if(typeof e==="string"&&e.trim()){let t=Date.parse(e.trim());if(!Number.isNaN(t))return t}return}function Ys(e){return`[LFV] [${e??"-"}] [${new Date().toISOString()}]: `}function Bn(e,t){if(typeof e!=="string"||e.trim()==="")throw Error(`LFV source requires "${t}"`);return e}function qu(e){return{...e,lfvServerUrl:Bn(e.lfvServerUrl,"lfvServerUrl"),clientId:Bn(e.clientId,"clientId"),path:Bn(e.path,"path")}}function kt(e,t,r={}){let n=qu(e),o=n.log??Pu,s=(h,x,j)=>{let B=Ys(h)+x;if(j!==void 0)o.debug(B,j);else o.debug(B)},i=(h,x,j)=>{let B=Ys(h)+x;if(j!==void 0)o.warn(B,j);else o.warn(B)},{lfvServerUrl:c,clientId:d,path:u,verifyJwks:l}=n,y=typeof n.deliveryTimeout==="number"&&n.deliveryTimeout>0?n.deliveryTimeout:void 0,p=typeof n.retryInterval==="number"&&n.retryInterval>0?n.retryInterval:Au,b=typeof n.warnInterval==="number"&&n.warnInterval>=0?n.warnInterval:_u,M=(typeof n.callbackMaxAgeSeconds==="number"&&n.callbackMaxAgeSeconds>0?n.callbackMaxAgeSeconds:Lu)*1000,_=typeof n.cacheMaxAgeSeconds==="number"&&n.cacheMaxAgeSeconds>0?n.cacheMaxAgeSeconds*1000:void 0,R=l?.trim()?Eu(l.trim()):void 0,W=Gs(n.deliveryEndpoint),q=Gs(n.eventsEndpoint),a=Fr({lfvServerUrl:c,path:u}),w=crypto.randomUUID(),v=new Map,L=new Set,H=new Map,J=new Map,Y=new Map,re=new Map,ue=new Map,se=new Map,K=new Map,ee=(h,x)=>{if(typeof x==="number"&&Number.isInteger(x)&&x>=1){let j=K.get(h)??1,B=Math.max(j,x);return K.set(h,B),B}return K.get(h)},z=(h,x)=>typeof x==="number"&&Number.isInteger(x)&&x>=1&&x>(K.get(h)??1),D=new Map,Q=new Map,ne=!1,ie,ce=new Set,ae=()=>ne;function C(h,x){H.set(h,x),J.set(h,Date.now())}function g(h){H.delete(h),J.delete(h)}function P(h){let x=H.get(h);if(!x)return;if(_!==void 0){let j=J.get(h)??0;if(Date.now()-j>_){s(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:h});return}}return x}function I(){return L.size>0||v.size>0||se.size>0}function U(){if(ne){if(ie)ie(),ie=void 0;return}let h=I();if(h&&!ie)ie=$s(a,w,{trustId:R,onDelivery:async(x)=>Qo(x).handled||await ts(x),onEvents:async(x)=>{rs(x)}});if(!h&&ie)ie(),ie=void 0}async function E(h,x,j,B){if(!t)throw Error("LFV callback transport is not configured");for(;;){if(ne)throw new _e(x);if(B())throw new _e(x);let X=await t.take(h);if(X){if(X.key!==a)i(h,"parked OTP callback rejected: callback key mismatch");else if(!await vn(X.rawBody,X.headers)){let pe=sr(X.rawBody);if(pe?.type==="otp"&&pe.request_id===h&&typeof pe.otp==="string"&&pe.otp)return pe.otp}}let G=ir(j);if(G!==void 0&&G<=0)throw nt("issueOtp",x,j);await Gn(G===void 0?Hs:Math.min(Hs,G))}}async function F(h,x){let j=x??crypto.randomUUID(),B={startedAt:Date.now(),timeout:y},X={request_id:j,path:h,action:"read_secret",...Fn(ee(h))},G=await Vn(()=>Dt(`${c.replace(/\/+$/g,"")}/clients/${d}/otp`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":j},body:JSON.stringify(X)},B,"issueOtp",h),c,B,h,"issueOtp",p,b,i,j,ae);if(G.status!==200&&G.status!==202)throw new vt(G.status,"issueOtp",h)}async function S(h,x){let j=Q.get(h);if(j)return j;let B=F(h,x);Q.set(h,B);try{await B}finally{if(Q.get(h)===B)Q.delete(h)}}async function O(h,x,j,B){if(ne)throw new _e(h);let X=j??crypto.randomUUID(),G=B??Me(),de=new Promise((Ue,Zt)=>{let ns={resolve:Ue,reject:Zt},kn=ir(G);if(kn!==void 0){if(kn<=0){Zt(nt("issueOtp",h,G));return}ns.timer=setTimeout(()=>{se.delete(X),U(),Zt(nt("issueOtp",h,G))},kn)}se.set(X,ns),U()});de.catch(()=>{});let pe=()=>{let Ue=se.get(X);if(!Ue)return;if(Ue.timer)clearTimeout(Ue.timer);se.delete(X),U()},le={request_id:X,path:h,action:x,...Fn(ee(h))};s(X,"OTP request",{path:h,action:x});let ve;try{ve=await Vn(async()=>await Dt(`${c.replace(/\/+$/g,"")}/clients/${d}/otp`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":X},body:JSON.stringify(le)},G,"issueOtp",h),c,G,h,"issueOtp",p,b,i,X,ae)}catch(Ue){throw pe(),Ue}if(ve.status!==200&&ve.status!==202)throw pe(),new vt(ve.status,"issueOtp",h);let Ce=!1,ke=t?E(X,h,G,()=>Ce):void 0;if(ke)ke.catch(()=>{});try{let Ue=await(ke?Promise.race([de,ke]):de);return s(X,"OTP received via signed callback",{path:h,action:x}),Ue}finally{Ce=!0,pe()}}async function k(h,x,j,B,X,G,de){if(ne)throw new _e(x);let pe=de??Me(),le=await Vn(async()=>await Dt(`${c.replace(/\/+$/g,"")}${h}`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":X},body:JSON.stringify({request_id:X,otp:B,path:x,...Fn(ee(x)),...G??{}})},pe,j,x),c,pe,x,j,p,b,i,X,ae);if(le.status!==200&&le.status!==202)throw new vt(le.status,j,x);return s(X,`${j} accepted`,{path:x,status:le.status}),le}async function m(h,x,j,B,X,G){if(ne)throw new _e(x);let de=X??crypto.randomUUID(),pe=G??Me(),le=await O(x,j,de,pe),ve=await k(h,x,j,le,de,B,pe);return{requestId:de,response:ve}}async function f(h,x,j){if(ne)throw new _e(h);let B=z(h,j?.kmsSlots);if(ee(h,j?.kmsSlots),B)g(h);let X=P(h);if(X)return X;let G=D.get(h);if(G){if(!B)return G;if(await G.catch(()=>{return}),G=D.get(h),G)return G}let de=T(h,x,j);D.set(h,de),de.catch((pe)=>{if(Br(pe))s(x,"read aborted: source closed",{path:h})});try{return await de}finally{D.delete(h)}}async function T(h,x,j){let B=j?.timeout??y,X={startedAt:Date.now(),timeout:typeof B==="number"&&B>0?B:void 0},G=x??crypto.randomUUID();s(G,"read_secret request",{path:h});let de=0,pe=Date.now();for(;;){if(ne)throw new _e(h);try{let{response:le}=await m("/secrets/request",h,"read_secret",void 0,G,X),ve=await A(G,le),Ce=N(h,ve);return Z(h,Ce,Ce.metadata.version),s(G,"read_secret completed from action response",{path:h}),Ce}catch(le){if(le instanceof _e)throw le;if(Js(le))throw le;let ve=ir(X);if(ve!==void 0&&ve<=0)throw nt("read_secret",h,X);if(de+=1,b>0&&Date.now()-pe>=b)i(G,`read_secret retrying. Retries: '${de}'`,{path:h}),pe=Date.now();let Ce=ve===void 0?p:Math.min(p,ve);if(Ce<=0)throw nt("read_secret",h,X);await Gn(Ce)}}}async function A(h,x){if(!l?.trim())throw new rt("LFV read_secret response verification is not configured");let j=x.headers.get("X-LFV-Request-Id")?.trim(),B=x.headers.get("X-LFV-Key-Id")?.trim(),X=x.headers.get("X-LFV-Signature")?.trim();if(!j||!B||!X)throw new rt("LFV read_secret response is missing signature headers");if(j!==h)throw new rt("LFV read_secret response request_id header does not match the request");let G=await x.text();if(!await Bs({jwks:l,kid:B,signatureB64Url:X,requestId:h,rawBody:G}))throw new rt("LFV read_secret response signature verification failed");let pe=sr(G);if(!pe||pe.request_id!==h)throw new rt("LFV read_secret response request_id does not match the request");return pe}function N(h,x){if(Zo(x)!==h||x.data?.data===void 0)throw new rt(`LFV read_secret returned an invalid secret response for ${h}`);let B=x.data.metadata??{},X=typeof B.version==="number"?B.version:0,G=B.created_time??B.created,de=St(B);return{data:x.data.data,metadata:{path:h,version:X,created:typeof G==="string"?new Date(G):new Date,...de?{contentType:de}:{}}}}function Z(h,x,j){if(j!==void 0){let G=re.get(h);if(G!==void 0&&j<G){s(void 0,"delivery ignored: stale version",{path:h,realVersion:j,lastAccepted:G});return}re.set(h,j)}C(h,x),ce.delete(h);let B=x.metadata.version;if(Y.get(h)===B)return;Y.set(h,B);let X=v.get(h);if(!X)return;for(let G of X)G(x)}async function V(h,x){return await f(h,void 0,x)}async function oe(h,x,j){if(!Mu(x))throw Error(`putSecret requires an object value for LFV source at path ${h}`);let B=Me(j),X={data:x,content_type:Kr(j.contentType)};if(await fe(h,j)){await m("/secrets/update",h,"update_secret",X,void 0,B),g(h);return}await m("/secrets/create",h,"create_secret",X,void 0,B),g(h)}async function te(h,x){let j=Me(x);await m("/secrets/delete",h,"delete_secret",void 0,void 0,j),g(h)}async function ge(h,x){let j=Me(x),B=crypto.randomUUID();s(B,"list_paths request",{path:h});let X=await O(h,"list_paths",B,j),G=await Dt(`${c.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":B},body:JSON.stringify({request_id:B,otp:X,path:h})},j,"listPaths",h);if(G.status!==200)throw Error(`LFV listPaths failed (${G.status}) for ${h}`);let de=await $t(G,{log:o,operation:"lfv.paths.list",redact:!0});if(!Array.isArray(de.items))throw Error(`LFV listPaths returned invalid payload for ${h}`);return s(B,"list_paths success",{path:h,status:200}),de.items.filter((pe)=>typeof pe==="string")}async function fe(h,x){let j=Me(x),B=crypto.randomUUID();s(B,"exists request",{path:h});let X=await O(h,"read_metadata",B,j),G=await Dt(`${c.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":B},body:JSON.stringify({request_id:B,otp:X,path:h})},j,"exists",h);if(G.status!==200)throw Error(`LFV exists failed (${G.status}) for ${h}`);let de=await $t(G,{log:o,operation:"lfv.paths.exists",redact:!0});if(typeof de.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${h}`);return s(B,"exists success",{path:h,status:200,exists:de.exists}),de.exists}async function Ye(h,x,j){let B=Me(j);await m("/secrets/rotate/request",h,"request_rotate",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,B)}async function Pe(h,x,j){let B=Me(j);await m("/secrets/revoke/request",h,"request_revoke",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,B)}async function gt(h,x,j){let B=Me(j),{response:X}=await m("/secrets/kms/park",h,"kms_park",{key_id:x.keyId,status:x.status,reason:x.reason},void 0,B);return Uu(await $t(X,{log:o,operation:"lfv.kms.park",redact:!0}).catch(()=>null),h)}function Ya(h,x){if(!h||typeof h!=="object"||Array.isArray(h))throw Error(`LFV kms_add_keys returned invalid payload for ${x}`);let j=h;if(!Array.isArray(j.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${x}`);return{keys:j.keys.map((X,G)=>{if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`LFV kms_add_keys returned invalid keys[${G}] for ${x}`);let de=X.id;if(typeof de!=="string"||de.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${G}].id for ${x}`);return{id:de}})}}function Xa(h,x){if(!h||typeof h!=="object"||Array.isArray(h))throw Error(`LFV kms_revoke_key returned invalid payload for ${x}`);let j=h;if(typeof j.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${x}`);return{revoked:j.revoked}}async function Za(h,x,j){let B=Me(j),{response:X}=await m("/secrets/kms/add-keys",h,"kms_add_keys",{keys:x.keys},void 0,B);return Ya(await $t(X,{log:o,operation:"lfv.kms.add_keys",redact:!0}).catch(()=>null),h)}async function Qa(h,x,j){let B=Me(j),{response:X}=await m("/secrets/kms/revoke-key",h,"kms_revoke_key",{key_id:x.keyId,reason:x.reason},void 0,B);return Xa(await $t(X,{log:o,operation:"lfv.kms.revoke_key",redact:!0}).catch(()=>null),h)}async function ec(h,x){let j=Me(x),B=crypto.randomUUID();s(B,"getMetadata request",{path:h});let X=await O(h,"read_metadata",B,j),G=await Dt(`${c.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":B},body:JSON.stringify({request_id:B,otp:X,path:h})},j,"getMetadata",h);if(G.status!==200)throw Error(`LFV getMetadata failed (${G.status}) for ${h}`);let de=await $t(G,{log:o,operation:"lfv.metadata.read",redact:!0});if(!de.metadata||typeof de.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${h}`);return s(B,"getMetadata success",{path:h,status:200}),de.metadata}async function Xo(h,x,j,B=!0){let X=v.get(h)??new Set,G,de=(le)=>{if(le.metadata.version===G)return;G=le.metadata.version,x(le)};if(X.add(de),v.set(h,X),!B)return U(),()=>{let le=v.get(h);if(!le)return;if(le.delete(de),le.size===0)v.delete(h);U()};let pe=z(h,j?.kmsSlots)?void 0:P(h);if(pe)de(pe),Y.set(h,pe.metadata.version);else try{de(await V(h,j))}catch(le){if(X.delete(de),X.size===0)v.delete(h);throw le}return U(),()=>{let le=v.get(h);if(!le)return;if(le.delete(de),le.size===0)v.delete(h);U()}}let tc=(h,x)=>Xo(h,x,void 0,!1);function rc(h){return h.method==="POST"&&new URL(h.url).pathname===W}function nc(h){return h.method==="POST"&&new URL(h.url).pathname===q}function Zo(h){let x=h.data?.metadata?.path;if(typeof x==="string"&&x)return x;if(typeof h.path==="string"&&h.path)return h.path;return}function oc(h){let{request_id:x,otp:j}=h;if(typeof x!=="string"||typeof j!=="string"||!j)return{handled:!1};let B=se.get(x);if(!B)return{handled:!1};if(B.timer)clearTimeout(B.timer);return se.delete(x),U(),B.resolve(j),{handled:!0}}function Qo(h){return h.type==="otp"?oc(h):{handled:!1}}function ut(h="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:h}),{status:401,headers:Ee})}function es(h){return{requestId:h.headers.get("X-LFV-Request-Id")??h.headers.get("x-lfv-request-id")??"",keyId:h.headers.get("X-LFV-Key-Id")??h.headers.get("x-lfv-key-id")??"",signature:h.headers.get("X-LFV-Signature")??h.headers.get("x-lfv-signature")??""}}async function vn(h,x){if(!l?.trim())return i(void 0,"LFV callback rejected: verifyJwks is not configured"),ut("LFV callback verification is not configured");let{requestId:j,keyId:B,signature:X}=x;if(!j.trim()||!B.trim()||!X.trim())return i(j||void 0,"LFV callback rejected: missing signature headers"),ut("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await Bs({jwks:l,kid:B,signatureB64Url:X.trim(),requestId:j.trim(),rawBody:h}))return i(j,"LFV callback rejected: signature verification failed"),ut();let de=sr(h);if(!de)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:Ee});let pe=de;if(pe.request_id!==j.trim())return i(j,"LFV callback rejected: request_id header/body mismatch"),ut("X-LFV-Request-Id does not match request_id in body");let le=Date.now(),ve=zn(pe.issued_at);if(ve===void 0)return i(j,"LFV callback rejected: missing or invalid issued_at"),ut("Missing or invalid issued_at");if(le-ve>M)return i(j,"LFV callback rejected: stale (outside freshness window)"),ut("Callback is stale (issued_at outside freshness window)");let Ce=zn(pe.expires_at);if(Ce!==void 0&&le>Ce)return i(j,"LFV callback rejected: expired"),ut("Callback has expired");let ke=X.trim();for(let[Ue,Zt]of ue)if(Zt<=le)ue.delete(Ue);if(ue.has(ke))return i(j,"LFV callback rejected: replayed signature"),ut("Callback signature already processed (replay)");return ue.set(ke,ve+M),null}async function ts(h){if(!r.selfRedeemReads||h.action!=="read_secret"||typeof h.request_id!=="string"||typeof h.path!=="string"||typeof h.otp!=="string")return!1;let x={startedAt:Date.now(),timeout:y},j=await k("/secrets/request",h.path,"read_secret",h.otp,h.request_id,void 0,x),B=await A(h.request_id,j),X=N(h.path,B);return Z(h.path,X,X.metadata.version),!0}async function sc(h){let x=await h.text(),j=es(h),B=await vn(x,j);if(B)return B;let X=sr(x);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:Ee});let G=X;if(G.type!=="otp"||typeof G.request_id!=="string"||typeof G.otp!=="string"||typeof G.path!=="string"||typeof G.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let de=Zo(G);s(G.request_id,"delivery received",{path:de});let pe=Qo(G),le=de?Fr({lfvServerUrl:c,path:de}):a,ve=await Ds(le,G,w,R),Ce=pe.handled||ve>0;if(!Ce)try{if(Ce=await ts(G),!Ce&&t&&typeof G.request_id==="string"){let ke=zn(G.expires_at),Ue=Math.max(1,(ke??Date.now()+M)-Date.now());await t.put(G.request_id,{kind:"delivery",key:le,rawBody:x,headers:j},Ue),Ce=!0}}catch(ke){if(Js(ke)){if(!(ke instanceof vt)||ke.upstreamStatus!==409&&ke.upstreamStatus!==410)ce.add(G.path);return i(j.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:le,upstreamStatus:ke instanceof vt?ke.upstreamStatus:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:Ee})}return ue.delete(j.signature.trim()),i(j.requestId,"LFV callback handoff failed; callback may be retried",{key:le,error:ke instanceof Error?ke.message:String(ke)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:Ee})}if(!Ce)return ue.delete(j.signature.trim()),i(j.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:le}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:Ee});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:Ee})}function rs(h){if(ne)return;if(!h?.path||typeof h.path!=="string")return;s(h.request_id,"events payload",{path:h.path,event:h.event});for(let x of L)try{x({path:h.path,event:h.event,requestId:h.request_id,issuedAt:h.issued_at,expiresAt:h.expires_at,...typeof h.key_id==="string"&&h.key_id.length>0?{keyId:h.key_id}:{}})}catch(j){i(h.request_id,"secret event listener failed",{path:h.path,event:h.event,error:j instanceof Error?j.message:String(j)})}if(h.event==="created"||h.event==="updated"||h.event==="rotated")g(h.path),(r.selfRedeemReads?S(h.path,h.request_id):f(h.path,h.request_id).then(()=>{return})).catch((j)=>{if(Br(j)){s(h.request_id,"event refresh aborted: source closed",{path:h.path});return}ce.add(h.path),i(h.request_id,"event-triggered refresh failed; source marked degraded",{path:h.path,event:h.event,error:j instanceof Error?j.message:String(j)})})}async function ic(h){let x=await h.text(),j=es(h),B=await vn(x,j);if(B)return B;let X=sr(x);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:Ee});let G=X;if(!G?.path||typeof G.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:Ee});s(G.request_id,"events received",{path:G.path,event:G.event}),rs(G);let de=Fr({lfvServerUrl:c,path:G.path});return await Ks(de,G,w,R),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:Ee})}function ac(){if(ne)return;if(ne=!0,ie)ie(),ie=void 0;let h=new _e(u);for(let x of se.values()){if(x.timer)clearTimeout(x.timer);try{x.reject(h)}catch{}}se.clear(),D.clear(),Q.clear(),ce.clear(),H.clear(),J.clear(),Y.clear(),re.clear(),ue.clear(),v.clear(),L.clear()}return{type:"vault",origin:{transport:"lfv",url:Ou(c)},isAvailable:()=>ce.size===0,get:(h,x)=>Ge(()=>V(h,x)),getFullSecret:V,getSecret:async(h,x)=>(await V(h,x)).data,putSecret:oe,deleteSecret:te,listPaths:ge,exists:fe,requestRotate:Ye,requestRevoke:Pe,parkKmsKey:gt,addKmsKeys:Za,revokeKmsKey:Qa,getMetadata:ec,subscribe:Xo,subscribePassive:tc,subscribeEvents:(h)=>(L.add(h),U(),()=>{L.delete(h),U()}),close:ac,isDeliveryRequest:rc,isEventsRequest:nc,handleDelivery:sc,handleEvents:ic,deliveryPath:W,eventsPath:q,callbackKey:a,trustId:R}}function bt(e,t,r){if(typeof e!=="string"||e.trim()==="")throw Error(`"${t}" is required when using ${r}`);return e}var Kt="__esLfvBootstrap";import{IoniteError as ti}from"@ionite/core";var Wu=new Set(["ready","isReady","describe","close","beforeChange","afterChange","then"]),Zs=new WeakMap,Qs=new WeakMap;function ei(e,t){let r=Qs.get(t);if(!r)r=new WeakMap,Qs.set(t,r);let n=r.get(e);if(n)return n;let o=e.then((s)=>Hn(s)?ar(s,t):s,(s)=>{throw ti.from(s,t())});return r.set(e,o),o}function Hn(e){return typeof e==="object"&&e!==null&&typeof e.isReady==="function"}function ju(e,t,r){return(...n)=>{try{let o=e.apply(t,n);if(o instanceof Promise)return ei(o,r);if(o&&typeof o.then==="function")return ei(Promise.resolve(o),r);return Hn(o)?ar(o,r):o}catch(o){throw ti.from(o,r())}}}function ar(e,t){let r=Zs.get(t);if(!r)r=new WeakMap,Zs.set(t,r);let n=r.get(e);if(n)return n;let o=new WeakMap,s=new Proxy(e,{get(i,c,d){if(typeof c==="symbol")return Reflect.get(i,c,d);let u=Reflect.get(i,c,d);if(typeof u==="function"){if(Wu.has(c))return u;let l=o.get(u);if(!l)l=ju(u,i,t),o.set(u,l);return l}if(Hn(u)&&u!==i)return ar(u,t);return u}});return r.set(e,s),s}import{catalogEntityStore as Hr,listGenerator as dr,materializeCodeCatalogEntity as Vu,unionCatalogRead as zu}from"@ionite/core";import{baseCustomerToScim as si,baseUserToScimUser as ii,baseWorkloadToScim as ai,entitlementToScimGroup as Xn}from"@ionite/core/server";import{ACCEPT_SCIM as Nu,CONTENT_TYPE_SCIM as $u,ION_AUTHZ_GROUP_SCHEMA as Jn,isJsonResponse as ni,readJsonResponse as ri,unexpectedBodySummary as oi}from"@ionite/core";var Du="urn:ietf:params:scim:api:messages:2.0:PatchOp",Ku="urn:ietf:params:scim:schemas:core:2.0:User",Fu="urn:ietf:params:scim:schemas:core:2.0:Group";async function cr(e){try{if(ni(e)){let r=(await e.clone().text()).trim();return r?r.slice(0,2000):void 0}let t=await oi(e.clone());return[t.contentType,t.excerpt].filter(Boolean).join(": ")||void 0}catch{return}}function ur(e){if(e==="user")return"Users";if(e==="workload")return"Workloads";if(e==="customer")return"Customers";return"Groups"}function Yn(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class Gr{constructor(e){this.inflight=new Map;this.memo=new Map;this.writes=new Map;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.getToken=e.getToken,this.receipts=e.receipts,this.log=e.log,this.fetchImpl=e.fetchImpl??((t,r)=>fetch(t,r))}async headers(){let e=await this.getToken();return new Headers({...$u,...Nu,Authorization:`Bearer ${e}`})}inflightKey(e,t,r){return`${e}\x00${t}\x00${r?"create":"lookup"}`}receiptKey(e,t){return`${e}\x00${t}`}serializeWrite(e,t,r){let n=`${e}\x00${t}`,s=(this.writes.get(n)??Promise.resolve()).catch(()=>{return}).then(r);this.writes.set(n,s);let i=()=>{if(this.writes.get(n)===s)this.writes.delete(n)};return s.then(i,i),s}async resolveProviderId(e,t,r){let n=this.receiptKey(e,t),o=this.memo.get(n);if(o)return{found:o.providerId,requestUrl:o.requestUrl};let s=await this.receipts.read(e,t);if(s)this.memo.set(n,s);if(s)return{found:s.providerId,requestUrl:s.requestUrl};let i=this.inflightKey(e,t,r!==void 0),c=this.inflight.get(i);if(c)return c;let d=this.resolveUncached(e,t,r).then(async(u)=>{if(typeof u==="object"){let l={providerId:u.found,...u.requestUrl?{requestUrl:u.requestUrl}:{}};await this.receipts.write(e,t,l),this.memo.set(n,l)}return u}).finally(()=>{this.inflight.delete(i)});return this.inflight.set(i,d),d}async resolveUncached(e,t,r){let n=await this.filterByExternalId(e,t);if(n!=="absent")return n;if(!r)return"absent";return this.create(e,t,r)}async filterByExternalId(e,t){let r=encodeURIComponent(`externalId eq "${Yn(t)}"`),n=`${this.baseUrl}/${ur(e)}?filter=${r}`,o=await this.fetchImpl(n,{method:"GET",headers:await this.headers()});if(!o.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:e,status:o.status,detail:await cr(o)}),"error";let i=((await ri(o,{log:this.log,operation:"iam.delta.resolve"})).Resources??[])[0];return i?.id?{found:i.id,...this.requestUrl(e,i)}:"absent"}async create(e,t,r){let n=`${this.baseUrl}/${ur(e)}`,o=this.writeBody(e,t,r),s=await this.fetchImpl(n,{method:"POST",headers:await this.headers(),body:JSON.stringify(o)});if(!s.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:e,status:s.status,detail:await cr(s)}),"error";let i=await ri(s,{log:this.log,operation:"iam.delta.create"});return i.id?{found:i.id,...this.requestUrl(e,i),created:!0}:"error"}requestUrl(e,t){if(e!=="group")return{};let r=t[Jn];if(!r||typeof r!=="object")return{};let n=r.requestUrl;return typeof n==="string"&&n?{requestUrl:n}:{}}async captureResponseReference(e,t,r,n,o){if(e.status===204)return;if(!ni(e)){let s=await oi(e.clone());if(s.excerpt)this.log.warn("SCIM destination returned a non-JSON body on a successful write",{"ion.operation":"iam.delta.receipt","ion.outcome":"degraded",reason:"non_json_response",status:e.status,contentType:s.contentType,excerpt:s.excerpt});return}try{let s=await e.clone().json(),i=this.requestUrl(t,s).requestUrl;if(!i&&s.id===void 0)return;let c=i??o,d={providerId:s.id??n,...c?{requestUrl:c}:{}};await this.receipts.write(t,r,d),this.memo.set(this.receiptKey(t,r),d)}catch{}}async invalidate(e,t){this.memo.delete(this.receiptKey(e,t)),await this.receipts.clear(e,t)}writeBody(e,t,r){let{id:n,meta:o,...s}=r,i=s,c=i[Jn];if(c&&typeof c==="object"&&!Array.isArray(c)){let{providerId:d,requestUrl:u,...l}=c;i[Jn]=l}return{...i,schemas:(r.schemas?.length??0)>0?r.schemas:[e==="user"?Ku:Fu],externalId:t}}async upsertResource(e,t,r){return this.serializeWrite(e,t,()=>this.upsertResourceNow(e,t,r))}async upsertResourceNow(e,t,r){let n=async(s)=>{let i=await this.resolveProviderId(e,t,s?r:void 0);if(i==="error")return"error";if(i==="absent")return"skipped";if(i.created)return"pushed";let c=await this.fetchImpl(`${this.baseUrl}/${ur(e)}/${encodeURIComponent(i.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody(e,t,r))});if(c.status===404||c.status===410)return"stale";if(c.ok)return await this.captureResponseReference(c,e,t,i.found,i.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:e,status:c.status,detail:await cr(c)}),"error"},o=await n(!0);if(o==="stale")await this.invalidate(e,t),o=await n(!0);return o==="stale"?"error":o}async deleteResource(e,t){return this.serializeWrite(e,t,()=>this.deleteResourceNow(e,t))}async deleteResourceNow(e,t){let r=async()=>{let o=await this.resolveProviderId(e,t);if(o==="error")return{outcome:"error"};if(o==="absent")return{outcome:"pushed"};let s=await this.fetchImpl(`${this.baseUrl}/${ur(e)}/${encodeURIComponent(o.found)}`,{method:"DELETE",headers:await this.headers()});if(s.status===404||s.status===410)return{outcome:"pushed",stale:!0};if(s.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:e,status:s.status,detail:await cr(s)}),{outcome:"error"}},n=await r();if(n.stale)await this.invalidate(e,t),n=await r();if(n.outcome==="pushed")await this.invalidate(e,t);return n.outcome}async patchGroupMembership(e){return this.serializeWrite("group",e.groupExternalId,()=>this.patchGroupMembershipNow(e))}async patchGroupMembershipNow(e){let{groupExternalId:t,userExternalId:r,op:n}=e,o=e.subjectResourceType??"user",s=await this.resolveProviderId(o,r,n==="add"?e.userCreate:void 0);if(s==="error")return this.log.warn("IAM delta: principal lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,subjectResourceType:o}),"error";if(s==="absent")return this.log.warn("IAM delta: principal not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n,subjectResourceType:o}),"skipped";let i=s.found,c=async(l)=>{let y=await this.resolveProviderId("group",t,n==="add"&&l?e.groupCreate:void 0);if(y==="error")return{kind:"error"};if(y==="absent")return{kind:"absent"};let p=`${this.baseUrl}/${ur("group")}/${encodeURIComponent(y.found)}`,b=n==="add"?[{op:"add",path:"members",value:[{value:i,type:e.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${Yn(i)}"]`}];return{kind:"response",response:await this.fetchImpl(p,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[Du],Operations:b})}),providerId:y.found,requestUrl:y.requestUrl}},d=await c(!0);if(d.kind==="response"&&(d.response.status===404||d.response.status===410))await this.invalidate("group",t),d=await c(!1);if(d.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n}),"error";if(d.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n}),"skipped";let u=d.response;if(!u.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,status:u.status,detail:await cr(u)}),"error";return await this.captureResponseReference(u,"group",t,d.providerId,d.requestUrl),"pushed"}}function Ft(e){if(typeof e==="string")return e;if(e&&typeof e==="object"&&"id"in e)return e.id;return}function lr(e){return e&&typeof e==="object"?e:void 0}function Zn(e){let t={},r={},n,o,s,i,c,d,u,l,y,p=()=>t.users==="patch"||t.workloads==="patch"||t.customers==="patch",b=(g)=>{if(g==="user")return t.users==="patch";if(g==="workload")return t.workloads==="patch";return t.customers==="patch"},M=()=>{if(!t.url)return"destination URL is not configured";if(!r.workload)return"workload identity is not configured";if(typeof r.workload.isReady!=="function"||typeof r.workload.ready!=="function")return"workload handle violates the readiness contract";if(!r.workload.isReady())return"workload module is not ready";if(t.audience){let g=r.workload[t.audience];if(!g)return`outgoing workload client "${t.audience}" is not configured`;if(typeof g.isReady!=="function"||typeof g.ready!=="function")return`outgoing workload client "${t.audience}" violates the readiness contract`;if(!g.isReady())return`outgoing workload client "${t.audience}" is not ready`}return},_=()=>{if(!p())return"no principal-kind delta mode is 'patch'";let g=M();if(g)return g;if(t.users==="patch"&&!r.userStore)return"user store is not configured for IAM destination receipts";if(t.workloads==="patch"&&!r.workloadIdentityStore)return"workload identity store is not configured for IAM destination receipts";if(t.customers==="patch"&&!r.customerStore)return"customer store is not configured for IAM destination receipts";if(!r.catalogStore)return"catalog store is not configured for IAM destination receipts";return},R=()=>_()===void 0,W=ye("IAM delta",R),q=async()=>{let g=r.workload;if(!g)throw Error("IAM delta: workload identity not configured");if(t.audience&&typeof g.getToken==="function")return g.getToken(t.audience);if(typeof g.getServerToken==="function")return g.getServerToken();return g.getToken()},a=()=>zu(r.codeCatalog,r.catalogStore),w=async(g,P)=>{let I=r.catalogStore;if(!I)return;let U=r.codeCatalog?.groups.get(g)??r.codeCatalog?.roles.get(g)??r.codeCatalog?.permissions.get(g);if(U){let F=r.codeCatalog?.groups.get(U.id)?"group":r.codeCatalog?.roles.get(U.id)?"role":"permission",S=Hr(I,F),O=await S.get(U.id);if(!O&&P)await Vu(F,U,S),O=await S.get(U.id);if(O)return{kind:F,entity:O}}let E=[["group",I.groups],["role",I.roles],["permission",I.permissions]];for(let[F,S]of E){let O=await S.get(g);if(O)return{kind:F,entity:O}}return},v=async(g)=>{let P=r.userStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);for await(let I of dr((U,E)=>P.list({start:U,limit:E})))if(I.externalId===g)return I;return},L=(g)=>g?.providerId?{providerId:g.providerId,...g.requestUrl?{requestUrl:g.requestUrl}:{}}:void 0,H=async(g)=>{let P=r.workloadIdentityStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);let I=await P.lookup({id:"",externalId:g});if(I)return I;for await(let U of dr((E,F)=>P.list({start:E,limit:F})))if(U.externalId===g)return U;return},J=async(g)=>{let P=r.customerStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);let I=await P.lookup({id:"",userName:"",name:"",email:"",externalId:g});if(I)return I;for await(let U of dr((E,F)=>P.list({start:E,limit:F})))if(U.externalId===g)return U;return},Y={async read(g,P){if(g==="user")return L(await v(P));if(g==="workload")return L(await H(P));if(g==="customer")return L(await J(P));return L((await w(P,!1))?.entity)},async write(g,P,I){if(g==="user"){let F=await v(P);if(!F||F.providerId===I.providerId&&F.requestUrl===I.requestUrl)return;await r.userStore?.upsert({...F,providerId:I.providerId,requestUrl:I.requestUrl});return}if(g==="workload"){let F=await H(P);if(!F||F.providerId===I.providerId&&F.requestUrl===I.requestUrl)return;await r.workloadIdentityStore?.upsert({...F,providerId:I.providerId,requestUrl:I.requestUrl});return}if(g==="customer"){let F=await J(P);if(!F||F.providerId===I.providerId&&F.requestUrl===I.requestUrl)return;await r.customerStore?.upsert({...F,providerId:I.providerId,requestUrl:I.requestUrl});return}let U=await w(P,!0);if(!U||U.entity.providerId===I.providerId&&U.entity.requestUrl===I.requestUrl)return;await Hr(r.catalogStore,U.kind).set({...U.entity,providerId:I.providerId,requestUrl:I.requestUrl}).ready()},async clear(g,P){if(g==="user"){let O=await v(P);if(!O||O.providerId===void 0&&O.requestUrl===void 0)return;let{providerId:k,requestUrl:m,...f}=O;await r.userStore?.upsert(f);return}if(g==="workload"){let O=await H(P);if(!O||O.providerId===void 0&&O.requestUrl===void 0)return;let{providerId:k,requestUrl:m,...f}=O;await r.workloadIdentityStore?.upsert(f);return}if(g==="customer"){let O=await J(P);if(!O||O.providerId===void 0&&O.requestUrl===void 0)return;let{providerId:k,requestUrl:m,...f}=O;await r.customerStore?.upsert(f);return}let I=await w(P,!1);if(!I||I.entity.providerId===void 0&&I.entity.requestUrl===void 0)return;let{providerId:U,requestUrl:E,...F}=I.entity;await Hr(r.catalogStore,I.kind).set(F).ready()}},re=()=>{if(!R()||!t.url)return;let g=t.url;if(n&&o===g&&s===r.catalogStore&&i===r.userStore&&c===r.workloadIdentityStore&&d===r.customerStore&&u===r.codeCatalog&&l===r.fetchImpl)return n;return n=new Gr({baseUrl:t.url,getToken:q,receipts:Y,log:e,fetchImpl:r.fetchImpl}),o=g,s=r.catalogStore,i=r.userStore,c=r.workloadIdentityStore,d=r.customerStore,u=r.codeCatalog,l=r.fetchImpl,n},ue=(g)=>g==="workload"?"Workload":g==="customer"?"Customer":"User",se=async(g)=>{if(g.subjectType==="workload"){let E=Ft(g.subject),F=lr(g.subject);if(!F&&E)F=await r.workloadIdentityStore?.get(E);let S=F?.externalId??F?.id??E;if(!F||!S)return;return{externalId:S,resourceType:"workload",create:await(r.mapWorkloadToScim?.({...F,externalId:S})??ai({...F,externalId:S}))}}if(g.subjectType==="customer"){let E=Ft(g.subject),F=lr(g.subject);if(!F&&E)F=await r.customerStore?.get(E);let S=F?.externalId??F?.id??E;if(!S)return;let O=F?await(r.mapCustomerToScim?.({...F,externalId:S})??si({...F,externalId:S})):{schemas:["urn:ionite:scim:schemas:core:2.0:Customer"],externalId:S,displayName:S,active:!0};return{externalId:S,resourceType:"customer",create:O}}let I=lr(g.subject);if(!I){let E=Ft(g.subject);if(E&&r.userStore)I=await r.userStore.get(E)}let U=I?.externalId;if(!I||!U)return;return{externalId:U,resourceType:"user",create:await(r.mapUserToScim?.(I)??ii(I))}},K=async(g)=>{let I=lr(g.target);if(!I){let U=Ft(g.target),E=a();if(U&&E)I=g.targetType==="role"?await E.roles.get(U):g.targetType==="permission"?await E.permissions.get(U):await E.groups.get(U)}if(I&&I.requestable!==!0)return"not-requestable";if(!I)return;return{externalId:I.id,create:Xn(I,g.targetType)}},ee=async(g,P)=>{if(!R())return"skipped";if(!b(g.subjectType==="workload"?"workload":g.subjectType==="customer"?"customer":"user"))return"skipped";let I=await se(g),U=await K(g);if(U==="not-requestable")return"skipped";if(!I||!U)return e.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:P,hasSubject:Boolean(I),hasTarget:Boolean(U),targetType:g.targetType}),"skipped";let E=re();if(!E)return"skipped";return E.patchGroupMembership({groupExternalId:U.externalId,userExternalId:I.externalId,op:P,groupCreate:U.create,userCreate:I.create,memberType:ue(g.subjectType),subjectResourceType:I.resourceType})},z=async(g,P,I)=>{let U=[],E=new Set,F=(O)=>{let k=`${O.type??"User"}\x00${O.value}`;if(!E.has(k))E.add(k),U.push(O)},S=r.accessStore;if(S)for await(let O of dr((k,m)=>S.listByTarget(P,g.id,{start:k,limit:m}))){let k=await se(O);if(!k){e.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:g.id,targetType:P});continue}let m=await I.resolveProviderId(k.resourceType,k.externalId,k.create);if(m==="error")throw Error(`IAM delta failed to resolve access subject for ${P}:${g.id}`);if(m==="absent")continue;let f=O.metadata;F({value:m.found,type:ue(O.subjectType),...f?.display?{display:f.display}:{}})}if(P==="group"){let O=a();for(let k of g.groups??[]){let m=Ft(k),f=lr(k);if(!f&&m)f=await O?.groups.get(m);if(f&&f.requestable!==!0)continue;if(!f){e.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:m,target:g.id});continue}let T=await I.resolveProviderId("group",f.id,Xn(f,"group"));if(T==="error")throw Error(`IAM delta failed to resolve nested Group for group:${g.id}`);if(T!=="absent")F({value:T.found,type:"Group"})}}return U.length>0?U:void 0},D=async(g)=>{if(!R()||!b("user"))return"skipped";let P=g.externalId;if(!P)return e.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:g.id,kind:"user"}),"skipped";let I=re();if(!I)return"skipped";let U=await(r.mapUserToScim?.(g)??ii(g));return I.upsertResource("user",P,U)},Q=async(g)=>{if(!R()||!b("workload"))return"skipped";let P=g.externalId??g.id;if(!P)return"skipped";let I=re();if(!I)return"skipped";let U=await(r.mapWorkloadToScim?.({...g,externalId:P})??ai({...g,externalId:P}));return I.upsertResource("workload",P,U)},ne=async(g)=>{if(!R()||!b("customer"))return"skipped";let P=g.externalId??g.id;if(!P)return"skipped";let I=re();if(!I)return"skipped";let U=await(r.mapCustomerToScim?.({...g,externalId:P})??si({...g,externalId:P}));return I.upsertResource("customer",P,U)},ie=async(g,P,I=!0)=>{if(!R()||!p())return"skipped";let U=a(),F=(U?await Hr(U,P).get(g.id):void 0)??g;if(F.requestable!==!0)return"skipped";let S=re();if(!S)return"skipped";let O=await z(F,P,S),k=await S.upsertResource("group",F.id,Xn(F,P,O)),m=r.accessStore;if(k!=="pushed"||!I||!m)return k;for await(let f of dr((T,A)=>m.listByTarget(P,g.id,{start:T,limit:A})))if(await ee(f,"add")==="error")throw Error(`IAM delta failed to restore access for ${P}:${g.id}`);return k},ce=(g,P)=>{if(g==="error")throw Error(`IAM delta: destination rejected ${P}`)},ae=(g,P,I)=>{if(P==="pushed")g.pushed+=1;else if(P==="skipped")g.skipped+=1;else g.errors.push(`IAM delta: destination rejected ${I}`)},C={async onUserUpsert(g){ce(await D(g),"user upsert")},async onUserDelete(g){if(!R()||!b("user"))return;let P=re();if(!P)return;ce(await P.deleteResource("user",g),"user delete")},async onWorkloadUpsert(g){ce(await Q(g),"workload upsert")},async onWorkloadDelete(g){if(!R()||!b("workload"))return;let P=re();if(!P)return;ce(await P.deleteResource("workload",g),"workload delete")},async onCustomerUpsert(g){ce(await ne(g),"customer upsert")},async onCustomerDelete(g){if(!R()||!b("customer"))return;let P=re();if(!P)return;ce(await P.deleteResource("customer",g),"customer delete")},async onEntitlementUpsert(g,P){ce(await ie(g,P),`${P} upsert`)},async onEntitlementDelete(g,P){if(!R())return;let I=re();if(!I)return;ce(await I.deleteResource("group",P),`${g} delete`)},async onGrant(g){if(!R())return;if(await ee(g,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(g){if(!R())return;if(await ee(g,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async reconcile(g){let P={pushed:0,skipped:0,errors:[]},I=_();if(I)return P.errors.push(`iam delta not ready: ${I}`),P;let U=async(E,F,S)=>{if(!E)return;for await(let O of E)try{ae(P,await F(O),S(O))}catch(k){P.errors.push(k instanceof Error?k.message:String(k))}};return await U(g.groups,(E)=>ie(E,"group",!1),(E)=>`group upsert for ${E.id}`),await U(g.roles,(E)=>ie(E,"role",!1),(E)=>`role upsert for ${E.id}`),await U(g.permissions,(E)=>ie(E,"permission",!1),(E)=>`permission upsert for ${E.id}`),await U(g.users,(E)=>D(E),(E)=>`user upsert for ${E.id??"unknown"}`),await U(g.workloads,(E)=>Q(E),(E)=>`workload upsert for ${E.id}`),await U(g.customers,(E)=>ne(E),(E)=>`customer upsert for ${E.id??"unknown"}`),await U(g.access,(E)=>ee(E,"add"),(E)=>`membership push for ${Ft(E.target)??"unknown"}`),P},async getDestinationRef(g,P){return Y.read(g,P)},isReady:R,ready:W.ready};return{update(g,P){t=g,r=P,re(),W.refresh();let I=_();if(!p())y=void 0;else if(I!==y){if(I)e.warn(`IAM delta configured but not ready: ${I}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:I});y=I}return C},handle(){return C}}}var Jr=4,Bu=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"sso.claims_authz",module:"sso",label:"SSO claim-derived entitlements",requires:"sessionStore.capabilities.derivedEntitlements",incapableReason:"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted."},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"ciam.claims_authz",module:"ciam",label:"CIAM claim-derived entitlements",requires:"sessionStore.capabilities.derivedEntitlements",incapableReason:"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted."},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore or authz.catalog",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability is wired by the application."},{key:"iam.groups.create",module:"iam",label:"IAM-sourced entitlement creation",requires:"AccessCatalogStore + authz.onInboundEntitlement",incapableReason:"The application has not wired durable catalog storage and explicitly opted into IAM-sourced entitlements."},{key:"iam.workloads",module:"iam",label:"SCIM Workloads inbound",requires:"workloadIdentityStore",incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."},{key:"iam.customers",module:"iam",label:"SCIM Customers inbound",requires:"customerStore",incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"workload.claims_authz",module:"workload",label:"Workload claim-derived entitlements"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."},{key:"authz.access_requests",module:"authz",label:"IdP access-request lifecycle"},{key:"tm.integration",module:"tm",label:"Tenant Management staged integration and consent",requires:"TenantStore integration methods + onConnectRequest",incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."}];import{timingSafeEqual as Gu}from"node:crypto";import{parseKmsPoolDocument as Hu,stableConfigHash as ui}from"@ionite/core";function ci(e,t,r){for(let n of e)try{n()}catch(o){t.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:r,error:o instanceof Error?o.message:String(o)})}}function De(e,t){let r=new Set,n=new Set;return{beforeChange(o){return r.add(o),()=>{r.delete(o)}},afterChange(o){return n.add(o),()=>{n.delete(o)}},emitBefore(){ci(r,e,`${t} beforeChange`)},emitAfter(){ci(n,e,`${t} afterChange`)}}}var Ju=604800000,Yu=2147483647,Xu=1;function pi(e,t){if(!e.value)return!1;if(e.notBefore&&Date.parse(e.notBefore)>t)return!1;if(e.notAfter&&Date.parse(e.notAfter)<=t)return!1;return!0}function We(e,t,r=Date.now()){if(!e)return;let n=e.slots?.[t];if(!n)return;let o=e.keys.find((s)=>s.id===n&&s.state==="active");return o&&pi(o,r)?o:void 0}function Qn(e,t=Date.now()){if(!e)return[];return e.keys.filter((r)=>(r.state==="active"||r.state==="deprecated")&&pi(r,t))}function di(e){return{...e,...e.meta?{meta:{...e.meta}}:{}}}function Yr(e,t,r){if(!t||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>o(Error(r)),t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function li(e,t){let r=Buffer.from(e),n=Buffer.from(t);return r.length===n.length&&Gu(r,n)}function Zu(e){if(!Number.isInteger(e)||e<1)throw Error("KMS unique() requires a positive integer slot count.");return e}var Qu=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function ed(e){return Qu.has(e)}function fi(e){let t=e.trim().replace(/\/+$/,"");if(!t||t==="/")return"/";return t.startsWith("/")?t:`/${t}`}function td(e,t){let r=fi(e),n=fi(t);return r===n||r.endsWith(n)}function rd(e,t,r){let n=De(t,`KMS pool "${e}"`),o=new Set,s=!1,i,c,d=0,u,l,y=Xu,p,b,M,_=new Map,R=new Set,W,q=()=>i!==void 0&&i.slots===void 0&&i.keys.length>0,a=ye(`KMS pool "${e}"`,()=>{if(!s)return!1;if(q())return Qn(i).length>0;return We(i,0)!==void 0}),w=ye(`KMS pool "${e}" issuer`,()=>s&&p!==void 0),v=(k)=>k===0?`KMS pool "${e}"`:`KMS pool "${e}" slot ${k}`,L=(k)=>{let m=_.get(k),f=m?.valueWaiter;if(!m||!f)return;if(!s){m.valueWaiter=void 0,f.reject(Error(`${v(k)} is no longer configured.`));return}if(q()){m.valueWaiter=void 0,f.reject(Error(`${v(k)} verifier grant has no slots.`));return}let T=We(i,k);if(T?.value)m.valueWaiter=void 0,f.resolve(T.value)},H=()=>{for(let k of _.keys())L(k)},J=(k)=>{let m=_.get(k);if(!m)return;let f=We(i,k);for(let T of m.listeners)try{T(f?di(f):void 0)}catch(A){t.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:e,slot:k,error:A instanceof Error?A.message:String(A)})}},Y=()=>{for(let k of _.keys())J(k)},re=()=>{for(let k of _.values())k.latch.refresh();a.refresh(),w.refresh()},ue=()=>{try{W?.()}catch(k){t.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:e,error:k instanceof Error?k.message:String(k)})}W=void 0},se=()=>{if(W||R.size===0||!p?.subscribeEvents||!b)return;let k=b;W=p.subscribeEvents((m)=>{if(!ed(m.event)||!td(m.path,k))return;let f={path:m.path,event:m.event,...m.requestId===void 0?{}:{requestId:m.requestId},...m.keyId===void 0?{}:{keyId:m.keyId}};for(let T of R)try{T(f)}catch(A){t.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:e,error:A instanceof Error?A.message:String(A)})}})},K=()=>{if(l)clearTimeout(l);l=void 0},ee=()=>{K();let k=Date.now();if(i){for(let f of i.keys){if(!f.notAfter)continue;let T=Date.parse(f.notAfter)-k;if(T>0&&T<=Ju&&(f.state==="active"||f.state==="deprecated")&&!o.has(f.id))o.add(f.id),t.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:e,keyId:f.id,notAfter:f.notAfter})}let m=i.keys.flatMap((f)=>[f.notBefore,f.notAfter]).filter((f)=>Boolean(f)).map((f)=>Date.parse(f)).filter((f)=>f>k).sort((f,T)=>f-T);if(m[0])l=setTimeout(()=>{let f=new Map([..._.keys()].map((T)=>[T,We(i,T)?.id]));re(),r();for(let T of _.keys())if(f.get(T)!==We(i,T)?.id)J(T);ee()},Math.min(m[0]-k+1,Yu))}re(),r(),H()},z=(k)=>{let m=new Map([..._.keys()].map((f)=>{let T=We(i,f);return[f,{id:T?.id,value:T?.value}]}));n.emitBefore();try{i=Hu(k),ee();for(let f of _.keys()){let T=We(i,f),A=m.get(f);if(A?.id!==T?.id||A?.value!==T?.value)J(f)}}catch(f){i=void 0,ee(),Y(),t.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:e,error:f instanceof Error?f.message:String(f)})}finally{n.emitAfter()}},D=()=>{try{u?.()}catch(k){t.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:e,error:k instanceof Error?k.message:String(k)})}u=void 0},Q=(k,m)=>{p=k,b=m,d+=1;let f=d;D(),k.subscribe(m,(T)=>{if(d!==f||!s)return;z(T.data)},{kmsSlots:y}).then((T)=>{if(d!==f||!s){T();return}u=T}).catch((T)=>{if(d!==f||!s)return;i=void 0,ee(),Y(),t.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:e,path:m,error:T instanceof Error?T.message:String(T)})})},ne=(k,m)=>{let f=ce(k),T=We(i,k);if(!s)return Promise.reject(Error(`${v(k)} is no longer configured.`));if(q())return Promise.reject(Error(`${v(k)} verifier grant has no slots.`));if(T?.value)return Promise.resolve(T.value);if(!f.valueWaiter){let N,Z,V=new Promise((oe,te)=>{N=oe,Z=te});f.valueWaiter={promise:V,resolve:N,reject:Z}}let A=f.valueWaiter.promise;return L(k),Yr(A,m,`${v(k)} was not ready within ${m}ms.`)},ie=(k,m)=>{let f=ce(k);f.listeners.add(m);let T=We(i,k);return m(T?di(T):void 0),()=>f.listeners.delete(m)};function ce(k){let m=_.get(k);if(m)return m;let f=ye(v(k),()=>s&&We(i,k)!==void 0),T={listeners:new Set,latch:f,api:{value:(A)=>ne(k,A),current:()=>We(i,k)?.value,subscribe:(A)=>ie(k,A),park:(A,N)=>g(A,N),isReady:f.isReady,ready:f.ready}};return _.set(k,T),T}let ae=(k)=>{if(q())throw Error(`KMS pool "${e}" verifier grant has no slots.`);let m=Zu(k),f=m>y;y=Math.max(y,m);let T=[];for(let A=0;A<m;A+=1)T.push(ce(A).api);if(f&&s&&p&&b)Q(p,b);return T},C=(k)=>Qn(i).find((m)=>m.value!==void 0&&li(k,m.value)),g=(k,m)=>{if(!s||!p||!b)return Promise.reject(Error(`KMS pool "${e}" is not configured.`));if(typeof k.value!=="string"||k.value.length===0)return Promise.reject(Error(`KMS pool "${e}" park() requires a non-empty value.`));let f=C(k.value);if(!f)return Promise.resolve({parked:!1,stale:!0});return Yr(p.parkKmsKey(b,{keyId:f.id,status:k.status,reason:k.reason},m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" park() did not complete within ${m}ms.`)},P=()=>{if(!s||!p||!b)throw Error(`KMS pool "${e}" is not configured.`);return{source:p,path:b}},I=(k)=>{if(!Array.isArray(k)||k.length===0)throw Error(`KMS pool "${e}" addKeys() requires a non-empty keys array.`);return k.map((m,f)=>{if(!m||typeof m!=="object")throw Error(`KMS pool "${e}" addKeys() keys[${f}] must be an object.`);if(typeof m.value!=="string"||m.value.length===0)throw Error(`KMS pool "${e}" addKeys() keys[${f}].value must be a non-empty string.`);if(m.id!==void 0&&(typeof m.id!=="string"||m.id.length===0))throw Error(`KMS pool "${e}" addKeys() keys[${f}].id must be a non-empty string when present.`);return m})},U=(k,m)=>{try{let{source:f,path:T}=P(),A=I(k);return Yr(f.addKmsKeys(T,{keys:A},m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" addKeys() did not complete within ${m}ms.`)}catch(f){return Promise.reject(f)}},E=(k,m)=>{try{let{source:f,path:T}=P();if(typeof k.keyId!=="string"||k.keyId.length===0)throw Error(`KMS pool "${e}" revokeKey() requires a non-empty keyId.`);return Yr(f.revokeKmsKey(T,k,m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" revokeKey() did not complete within ${m}ms.`)}catch(f){return Promise.reject(f)}},F=(k)=>{let{source:m}=P();if(!m.subscribeEvents)throw Error(`KMS pool "${e}" events are not supported by this secrets transport.`);return R.add(k),se(),()=>{R.delete(k)}};ce(0);let S={describe:()=>Se({name:e,source:M,path:b??`/kms/${e}`,ready:a.isReady()}),value:(k)=>ne(0,k),current:()=>We(i,0)?.value,unique:ae,accepts:(k)=>Qn(i).some((m)=>m.value!==void 0&&li(k,m.value)),park:g,subscribe:(k)=>ie(0,k),beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:a.isReady,ready:a.ready},O={addKeys:U,revokeKey:E,events:F,isReady:w.isReady,ready:w.ready};return{api:S,issuer:O,update(k,m,f){let T=ui({config:k,path:f});if(s=!0,M=k.source,c===T){re();return}c=T,D(),ue(),K(),i=void 0,re(),r(),Y(),H(),Q(m,f),se()},unavailable(k){s=!0,M=k.source,c=ui(k),d+=1,p=void 0,b=void 0,ue(),D(),K(),i=void 0,re(),r(),Y(),H()},remove(){if(!s)return;n.emitBefore(),s=!1,c=void 0,M=void 0,d+=1,p=void 0,b=void 0,ue(),D(),K(),i=void 0,re(),r(),Y(),H(),n.emitAfter()},close(){s=!1,d+=1,p=void 0,b=void 0,ue(),R.clear(),D(),K();for(let k of _.values())k.listeners.clear();i=void 0,H();for(let k of _.values())k.latch.settle();a.settle(),w.settle()},isConfigured:()=>s}}function mi(e){let t=new Map,r=new Map,n=De(e,"KMS"),o=!1,i=ye("KMS module",()=>o&&Array.from(t.values()).every((p)=>!p.isConfigured()||p.api.isReady())),c,d=()=>i.refresh(),u=(p)=>{let b=t.get(p);if(b)return b;let M=rd(p,e,d);if(t.set(p,M),!(p in c))Object.assign(c,{[p]:M.api});return M},l=(p)=>{let b=t.get(p);if(!b)throw Error(`KMS pool "${p}" is not configured.`);return b.api},y=(p)=>{let b=t.get(p);if(!b)throw Error(`KMS pool "${p}" is not configured.`);return b.issuer};return c={describe:()=>({module:"kms",active:o,ready:i.isReady(),pools:Array.from(r.keys(),(p)=>u(p).api.describe())}),get config(){return Object.fromEntries(r)},beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:i.isReady,ready:i.ready,listPools:()=>Array.from(r.keys()),getPool:l,issuer:y},{handle:()=>c,update(p,b){if(!p&&!o&&t.size===0)return;n.emitBefore(),o=p!==void 0;let M=new Set(Object.keys(p??{}));for(let[_,R]of Object.entries(p??{})){r.set(_,{...R});let W=R.path??`/kms/${_}`;try{u(_).update(R,b(R),W)}catch(q){u(_).unavailable(R),e.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:_,error:q instanceof Error?q.message:String(q)})}}for(let[_,R]of t){if(M.has(_))continue;r.delete(_),R.remove()}return i.refresh(),n.emitAfter(),o||t.size>0?c:void 0},close(){for(let p of t.values())p.close();t.clear(),r.clear(),o=!1,i.settle()}}}import{ACCEPT_JSON as nd,CONTENT_TYPE_FORM as od,errorLogAttributes as sd,formatLogLine as id,readJsonResponse as ad}from"@ionite/core";import{context as cd,trace as ud}from"@opentelemetry/api";import{logs as dd,SeverityNumber as He}from"@opentelemetry/api-logs";import{OTLPLogExporter as ld}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as fd}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as pd}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as md}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as gd}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as yd}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as hd}from"@opentelemetry/resources";import{BatchLogRecordProcessor as wd}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as Sd}from"@opentelemetry/sdk-metrics";import{NodeSDK as vd}from"@opentelemetry/sdk-node";var gi={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},kd={trace:!1,debug:!1,info:!0,warn:!0,error:!0},bd={trace:He.TRACE,debug:He.DEBUG,info:He.INFO,warn:He.WARN,error:He.ERROR};function eo(e,t){let r=t[e];if(r===!1)return!1;if(e==="metrics")return r===!0||typeof r==="object";return!0}function oo(e){return typeof e==="object"&&e!==null?e:void 0}function Rd(e){return typeof e==="object"&&e!==null?e:void 0}function Td(e,t){let r=e.replace(/\/+$/,"");if(r.endsWith(gi[t]))return r;return`${r}${gi[t]}`}function Cd(e,t){let r=oo(e[t]);if(r?.endpoint)return r.endpoint;if(!e.endpoint)return;return Td(e.endpoint,t)}function Id(e,t,r){let n=oo(e[t]),o={...e.headers,...n?.headers??{}};if(r)o.Authorization=`Bearer ${r}`;return o}function so(e,t,r){let n=oo(e[t]);return{url:Cd(e,t),headers:Id(e,t,r),timeoutMillis:n?.timeoutMillis,concurrencyLimit:n?.concurrencyLimit}}function Pd(e,t){let r=so(e,"traces",t);return e.protocol==="http/json"?new gd(r):new yd(r)}function Od(e,t){let r=so(e,"metrics",t);return e.protocol==="http/json"?new pd(r):new md(r)}function Ed(e,t){let r=so(e,"logs",t);return e.protocol==="http/json"?new ld(r):new fd(r)}function Ad(e){return{"service.name":e.name,...e.version?{"service.version":e.version}:{},...e.deploymentEnvironment?{"deployment.environment.name":e.deploymentEnvironment}:{},...e.resourceAttributes??{}}}async function _d(e,t){if(!e.oauth)return;let r=new URLSearchParams({grant_type:"client_credentials",client_id:e.oauth.clientId,client_secret:e.oauth.clientSecret});if(e.oauth.scope)r.set("scope",e.oauth.scope);if(e.oauth.audience)r.set("audience",e.oauth.audience);let n=await fetch(e.oauth.tokenUrl,{method:"POST",headers:{...nd,...od,...e.oauth.headers??{}},body:r});if(!n.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${n.status}`);let o=await ad(n,{log:t,operation:"otel.oauth.token",redact:!0});if(typeof o.access_token!=="string"||!o.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return o.access_token}function Ld(e,t){return{...kd,...t?.levels??{},...e.levels??{}}}function fr(e,t="Authorization"){let r={...e.headers??{}};if(!e.apiKey)return r;let n=e.apiKeyHeader??t;return r[n]=n.toLowerCase()==="authorization"?`Bearer ${e.apiKey}`:e.apiKey,r}function xd(e,t){return Object.keys(e).some((r)=>r.toLowerCase()===t.toLowerCase())}function hi(e,t,r){let n=Object.keys(e).find((o)=>o.toLowerCase().startsWith(t.toLowerCase()));if(n)throw Error(`OpenTelemetry provider "${r}" does not support provider-specific header "${n}".`)}function pr(e,t,r,n){return{type:r,name:e.name,version:e.version,protocol:e.protocol??"http/protobuf",endpoint:e.endpoint,headers:n,resourceAttributes:Ad(e),levels:Ld(e,t),console:e.console??"info",traces:e.traces,metrics:e.metrics,logs:e.logs}}function Ud(e,t){return pr(e,t,"otlp",fr(e))}function Md(e,t){return pr(e,t,"grafana-lgtm",fr(e))}function qd(e,t){let r=fr(e,"DD-API-KEY");if(!xd(r,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return pr(e,t,"datadog",r)}function Wd(e,t){let r=fr(e);return hi(r,"DD-","splunk"),pr(e,t,"splunk",r)}function jd(e,t){let r=fr(e);return hi(r,"DD-","elastic"),pr(e,t,"elastic",r)}function Nd(e,t){let r=e.type??"otlp";switch(r){case"otlp":return Ud(e,t);case"grafana-lgtm":return Md(e,t);case"datadog":return qd(e,t);case"splunk":return Wd(e,t);case"elastic":return jd(e,t);default:throw Error(`Unsupported OpenTelemetry provider type: ${r}`)}}function $d(e,t){if(typeof e==="string")return e;if(e instanceof Error)return e.message;if(e!=null)return ro(e);if(t.length===0)return"";return ro(t[0])}function ro(e){if(typeof e==="string")return e;try{return JSON.stringify(e)}catch{return String(e)}}function yi(e,t,r){if(r==null)return;if(typeof r==="string"||typeof r==="number"||typeof r==="boolean"){e[t]=r;return}if(Array.isArray(r)&&r.every((n)=>["string","number","boolean"].includes(typeof n))){e[t]=r;return}if(r instanceof Error){let n=sd(r);if(n){for(let[o,s]of Object.entries(n))if(s!=null)e[o]=s;return}if(e[`${t}.name`]=r.name,e[`${t}.message`]=r.message,r.stack)e[`${t}.stack`]=r.stack;return}e[t]=ro(r)}function Dd(e){let t={};for(let[n,o]of e.entries()){if(o&&typeof o==="object"&&!Array.isArray(o)&&!(o instanceof Error)&&Object.getPrototypeOf(o)===Object.prototype){for(let[s,i]of Object.entries(o))yi(t,s,i);continue}yi(t,`param.${n}`,o)}let r=ud.getSpanContext(cd.active());if(r)t.trace_id=r.traceId,t.span_id=r.spanId,t.trace_flags=r.traceFlags;return t}function Kd(e){return e}function Fd(e,t){globalThis.console[Kd(e)](id(e,t.body,[t.attributes??{}]))}function Vd(e,t,r,n){if(r.console==="off")return;if((t.severityNumber??0)<bd[r.console])return;let o=n?.console;if(o){o(t);return}Fd(e,t)}function zd(e,t){let r=dd.getLogger(e.name,e.version),n=(o,s,i)=>{if(!e.levels[o])return;let c={severityNumber:s,severityText:o.toUpperCase(),body:$d(i[0],i.slice(1)),attributes:Dd(i.slice(1))};try{r.emit(c)}finally{Vd(o,c,e,t)}};return{trace:(o,...s)=>n("trace",He.TRACE,[o,...s]),debug:(o,...s)=>n("debug",He.DEBUG,[o,...s]),info:(o,...s)=>n("info",He.INFO,[o,...s]),warn:(o,...s)=>n("warn",He.WARN,[o,...s]),error:(o,...s)=>n("error",He.ERROR,[o,...s])}}function Bd(e){return e?.current()}function Gd(e,t,r){let n=t;return e.subscribe((o)=>{let s=o?.value;if(s===n)return;n=s,r()})}function to(e){if(!e)return{enabled:!1};if(e===!0)return{enabled:!0};return{enabled:!0,endpoint:e.endpoint,timeoutMillis:e.timeoutMillis,concurrencyLimit:e.concurrencyLimit,exportIntervalMillis:e.exportIntervalMillis,exportTimeoutMillis:e.exportTimeoutMillis}}function wi(e,t,r){return()=>Se({module:"otel",active:t,ready:r(),type:e?.type,name:e?.name,endpoint:e?.endpoint,protocol:e?.protocol,apiKeyPool:e?.apiKeyPool,apiKeyHeader:e?.apiKeyHeader,oauth:e?.oauth?{tokenUrl:e.oauth.tokenUrl,clientId:e.oauth.clientId,scope:e.oauth.scope,audience:e.oauth.audience}:void 0,version:e?.version,deploymentEnvironment:e?.deploymentEnvironment,resourceAttributes:e?.resourceAttributes,levels:e?.levels,console:e?.console,signals:{traces:to(e?.traces),metrics:to(e?.metrics),logs:to(e?.logs)}})}function no(e,t){return{state:"unavailable",describe:wi(t,t!==void 0,()=>!1),beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:e,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function io(e,t,r,n){if(!t&&!r)return;if(!t)return no(e);let o=t,s;if(o.apiKeyPool&&n)try{s=n.getPool(o.apiKeyPool)}catch{s=void 0}let i=Bd(s),c=()=>io(e,o,r,n),d=o.apiKeyPool&&n?(q)=>Gd(n.getPool(o.apiKeyPool),i,q):void 0;if(o.apiKeyPool&&!i){let q=no(e,o);return q.onCredentialChange=d,q.rebuild=c,q}let u=i?{...o,apiKey:i}:o,l=Nd(u,r),y,p=!1,b=zd(l,r),M,_,R=new Promise((q,a)=>{M=q,_=a});async function W(){try{let q=await _d(o,e),a={resource:hd(l.resourceAttributes),instrumentations:r?.instrument};if(r?.sampler)a.sampler=r.sampler;if(r?.textMapPropagator)a.textMapPropagator=r.textMapPropagator;if(r?.contextManager)a.contextManager=r.contextManager;if(r?.spanProcessors)a.spanProcessors=r.spanProcessors;else if(eo("traces",l))a.traceExporter=Pd(l,q);if(r?.metricReaders)a.metricReaders=r.metricReaders;else if(eo("metrics",l)){let v=Rd(l.metrics);a.metricReaders=[new Sd({exporter:Od(l,q),exportIntervalMillis:v?.exportIntervalMillis,exportTimeoutMillis:v?.exportTimeoutMillis})]}if(r?.logRecordProcessors)a.logRecordProcessors=r.logRecordProcessors;else if(eo("logs",l))a.logRecordProcessors=[new wd({exporter:Ed(l,q)})];let w=r?.configure?.(a);y=new vd(w??a),y.start(),p=!0,M?.()}catch(q){p=!1;let a=q instanceof Error?q:Error(String(q));e.error?.("OpenTelemetry startup failed",a),_?.(a)}finally{M=void 0,_=void 0}}return{state:"available",describe:wi(o,!0,()=>p),start:W,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>p,ready:(q)=>{if(!q||q<=0)return R;return Promise.race([R,new Promise((a,w)=>{setTimeout(()=>w(Error(`OpenTelemetry ready timed out after ${q}ms.`)),q)})])},logger:b,forceFlush:async()=>{await y?.forceFlush?.()},shutdown:async()=>{p=!1,await y?.shutdown(),y=void 0},onCredentialChange:d,rebuild:c}}function Si(e){let t,r,n,o=0,s=Promise.resolve(),i=De(e,"OpenTelemetry"),c=ye("OpenTelemetry module",()=>t?.isReady()===!0),d=no(e),u={describe:()=>(t??d).describe(),beforeChange:i.beforeChange,afterChange:i.afterChange,isReady:c.isReady,ready:c.ready,logger:{trace:(p,...b)=>(t?.logger??e).trace(p,...b),debug:(p,...b)=>(t?.logger??e).debug(p,...b),info:(p,...b)=>(t?.logger??e).info(p,...b),warn:(p,...b)=>(t?.logger??e).warn(p,...b),error:(p,...b)=>(t?.logger??e).error(p,...b)},forceFlush:async()=>{await t?.forceFlush()},shutdown:async()=>{await t?.shutdown()}},l=!1,y;return y={update(p){if(!p){if(t||r){let R=t,W=r;o+=1,i.emitBefore(),n?.(),n=void 0,t=void 0,r=void 0,c.refresh(),s=Promise.all([R?.shutdown(),W?.shutdown()]).finally(()=>i.emitAfter()).then(()=>{return},()=>{return})}return l?u:void 0}if(l=!0,p===t||p===r)return u;let b=t,M=r;o+=1;let _=o;return i.emitBefore(),n?.(),n=void 0,t=void 0,r=p,c.refresh(),s=(async()=>{try{if(await Promise.all([b?.shutdown(),M?.shutdown()]),await p.start(),_!==o||r!==p){await p.shutdown();return}t=p,r=void 0,c.refresh(),n=p.onCredentialChange?.(()=>{if(t!==p)return;let R=p.rebuild?.();if(R)y.update(R)})}finally{if(_===o)i.emitAfter()}})().then(()=>{return},()=>{return}),u},settled(){return s},async shutdown(){o+=1;let p=t,b=r;n?.(),n=void 0,t=void 0,r=void 0,c.settle(),await Promise.all([p?.shutdown(),b?.shutdown()])}},y}import{ION_ENDPOINT_PERMISSIONS as Vt,trimTrailingSlash as vi}from"@ionite/core";import{hasPermission as Hd}from"@ionite/core/server";async function mr(e,t,r){let n=await Hd(e,t,r.permission,void 0,r.subjectType);return n.allow?void 0:n.response()}function Jd(e){let t=vi(e);return{matchesPath:(o)=>{if(!o)return!1;return vi(o)===t},startsWithPath:(o)=>{if(!o)return!1;return e===o||e.startsWith(`${o}/`)}}}function ki(e,t,r,n){let o=n??new URL(e.url).pathname,{matchesPath:s,startsWithPath:i}=Jd(o);if(t.sso){let c=t.sso;if(s(r.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(d)=>c.handler(d)};if(s(r.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(d)=>c.logout(d)};if(s(r.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(d)=>c.logoutBackChannel(d)};if(s(r.sso.loginUrl)||s(r.sso.refreshUrl)||s(r.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(d)=>c.handler(d)}}if(t.ciam){let c=t.ciam;if(s(r.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(d)=>c.customerHandler(d)};if(s(r.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(d)=>c.logout(d)}}if(t.iam){let c=t.iam,d=e.method!=="GET"&&e.method!=="HEAD";if(i(r.iam.usersUrl))return{module:"iam",kind:d?"iam.users.write":"iam.read",requiredPermission:Vt[d?"iam.users.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.groupsUrl))return{module:"iam",kind:d?"iam.groups.write":"iam.read",requiredPermission:Vt[d?"iam.groups.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.workloadsUrl))return{module:"iam",kind:d?"iam.workloads.write":"iam.read",requiredPermission:Vt[d?"iam.workloads.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.customersUrl))return{module:"iam",kind:d?"iam.customers.write":"iam.read",requiredPermission:Vt[d?"iam.customers.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(`${r.iam.basePath}/AccessRequests`))return{module:"iam",kind:"iam.access-requests.write",requiredPermission:Vt["iam.access-requests.write"],handler:async(u)=>c.handler(u)};if(i(r.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(u)=>c.handler(u)}}if(t.workload){let c=t.workload;if(s(r.workload.validateUrl)||s(r.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(d)=>c.handler(d)}}if(t.secrets){let c=t.secrets;if(c.isLfvDeliveryRequest?.(e)&&c.handleLfvDelivery){let d=c.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(u)=>d(u)}}if(c.isLfvEventsRequest?.(e)&&c.handleLfvEvents){let d=c.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(u)=>d(u)}}}if(t.ciam){let c=t.ciam;if(s(r.ciam.magicLinkUrl)&&e.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:Vt["ciam.magic-link.create"],handler:async(d)=>c.handler(d)};if(s(r.ciam.magicLinkLoginUrl)&&e.method==="GET"||s(r.ciam.customerProvidersUrl)&&e.method==="GET"||s(r.ciam.customerLoginUrl)&&e.method==="GET"||s(r.ciam.customerCallbackUrl)&&(e.method==="GET"||e.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(d)=>c.handler(d)}}return}async function ao(e,t,r,n){let o=n??Fe(xr()),s=new URL(e.url).pathname;if(r?.filter){let y=await r.filter(e,t);if(y instanceof Response)return y;if(y==="not_handled")return me()}let i=ki(e,t,o,s),d=await r?.resolve?.(e,t,i)??i;if(!d)return me();let u=d.requiredPermission===void 0?i?.requiredPermission:d.requiredPermission,l=async()=>{if(u){let y=await mr(e,t,u);if(y)return y}return d.handler(e)};if(r?.wrap)return await r.wrap(e,d,l,t);return await l()}import{stableConfigHash as vl}from"@ionite/core";function Xr(){let e=0;return{next:()=>(e+=1,e),isCurrent:(t)=>t===e,current:()=>e}}import{readFile as fl,stat as pl}from"node:fs/promises";import{ACCEPT_JSON as Gt,CONTENT_TYPE_FORM as Ki,CONTENT_TYPE_JSON as ml,describeOriginUrl as gl,IoniteError as yl,readJsonResponse as nn}from"@ionite/core";import{ACCEPT_JSON as go,CONTENT_TYPE_FORM as al,CONTENT_TYPE_JSON as Di,describeOriginUrl as mo,readJsonResponse as Tt}from"@ionite/core";import{IoniteError as Zr}from"@ionite/core";class zt extends Zr{constructor(e,t,r){super(e,{status:Qe(r),upstreamStatus:r});this.sourceType="vault";this.code=t}}class ot extends Zr{constructor(e,t=`Vault secret not found at path ${e}`){super(t,{status:503,upstreamStatus:404});this.code="not_found";this.sourceType="vault";this.path=e}}class we extends Zr{constructor(e,t,r,n,o){super(e,{...o,status:Qe(r),upstreamStatus:r});this.sourceType="vault";this.path=t,this.code=n}}class je extends Zr{constructor(e,t,r=`Vault subscribe is not supported for source ${e} at path ${t} without websocket, LFV, or ttl`){super(r,{status:500});this.sourceType=e,this.path=t}}function bi(e){return e instanceof ot||e instanceof zt&&(e.code==="not_found"||e.upstreamStatus===404)}import{WebSocket as gr}from"ws";var Yd=1000,Xd=30000,Ti=30000,Ci=Ti;function Ii(e){Ci=e>0?e:Ti}function Pi(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Zd(e){let t=Math.min(Xd,Yd*2**Math.min(e,16)),r=0.5+Math.random()*0.5;return Math.round(t*r)}var Rt=new Map;function Qd(e){return e.trim().replace(/\/+$/g,"")}function Oi(e,t){let r=typeof t?.version==="number"?t.version:0,n=t?.created_time??t?.created,o=typeof n==="string"?new Date(n):new Date,s=St(t);return{path:e,version:r,created:o,...s?{contentType:s}:{}}}function el(e){return typeof e?.version==="number"?e.version:void 0}function tl(e){let t=e.token?.trim();if(!t)return{};if(e.header==="Authorization")return{Authorization:t.startsWith("Bearer ")?t:`Bearer ${t}`};return{"X-Vault-Token":t}}function yr(e){return{client_id:e.clientId,token:e.token,header:e.header??"X-Vault-Token"}}function uo(e,t){let r=Qd(e),n=Rt.get(r);if(n){if(t&&!n.log)n.log=t;return n}let o={url:r,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:t};return Rt.set(r,o),o}function rl(e){let t=[...Array.from(e.subs.values(),(o)=>o.creds),...e.eventListeners.values()];if(t.length===0)return e.lastGoodCreds??{url:e.url};let r=e.lastGoodCreds?[e.lastGoodCreds,...t]:t,n=r[e.reconnectCredCursor%r.length]??t[0];return e.reconnectCredCursor+=1,n}function Ri(e,t){for(let r of e.subs.values())try{r.onHealth?.(t)}catch(n){e.log?.warn("Vault websocket health hook threw",n)}}function nl(e,t){for(let r of Array.from(e.subs.values())){let n=r.onFirstSecretReject;if(r.onFirstSecret=void 0,r.onFirstSecretReject=void 0,n)try{n(new we(`Vault websocket subscription interrupted (${t})`,r.path,void 0,"connection"))}catch(o){e.log?.warn("Vault websocket first-secret waiter rejection threw",o)}}}function Ei(e,t){for(let r of e.pending.values())clearTimeout(r.timer),r.reject(new we(`Vault websocket command interrupted (${t})`,"/",void 0,"connection"));e.pending.clear()}function Qr(e){if(e.disposed)return;if(e.disposed=!0,e.reconnectTimer)clearTimeout(e.reconnectTimer),e.reconnectTimer=void 0;Ei(e,"closed"),nl(e,"socket disposed");let t=e.ws;if(e.ws=void 0,e.connectPromise=void 0,e.hasConnected=!1,Rt.delete(e.url),t)try{t.removeAllListeners(),t.close()}catch{}}function en(e){if(e.subs.size>0||e.pending.size>0||e.eventListeners.size>0)return;Qr(e)}function co(e){return`${e.clientId??""}|${e.token??""}|${e.header??"X-Vault-Token"}`}function Ai(e){let t=new Map;for(let r of e.eventListeners.values())t.set(co(r),r);return Array.from(t.values())}function ol(e,t){if(typeof t.path!=="string"||typeof t.event!=="string")return;let r={path:t.path,event:t.event,...typeof t.request_id==="string"?{requestId:t.request_id}:{},...typeof t.key_id==="string"&&t.key_id.length>0?{keyId:t.key_id}:{}};for(let n of e.eventListeners.keys())try{n(r)}catch(o){e.log?.warn("Vault websocket event listener threw",o)}}function _i(e,t,r,n){if(n!==void 0&&t.lastVersion!==void 0&&n===t.lastVersion)return;if(n!==void 0)t.lastVersion=n;try{t.onChange(r)}catch(s){e.log?.warn("Vault websocket subscription onChange threw",s)}let o=t.onFirstSecret;if(t.onFirstSecret=void 0,t.onFirstSecretReject=void 0,o)try{o()}catch(s){e.log?.warn("Vault websocket subscription onFirstSecret threw",s)}}function sl(e,t){let r=t.subscription_id;if(typeof r!=="string")return;let n=e.subs.get(r);if(!n)return;let o={data:t.data,metadata:Oi(typeof t.path==="string"?t.path:n.path,t.metadata)};_i(e,n,o,el(t.metadata))}function il(e,t){let r;try{r=JSON.parse(t.toString())}catch(n){e.log?.warn("Vault websocket message parse failed",n);return}if(r.type==="secret"){sl(e,r);return}if(r.type==="event"){ol(e,r);return}if(r.type==="command_result"&&typeof r.id==="string"){let n=e.pending.get(r.id);if(!n)return;if(e.pending.delete(r.id),clearTimeout(n.timer),r.ok===!1)n.reject(new zt(r.error??`Vault websocket command failed for ${r.id}`,r.code,r.status));else n.resolve(r.result);en(e)}}function Li(e,t){e.send(JSON.stringify({type:"subscribe",subscription_id:t.subscriptionId,paths:[t.path],...Pi(t.kmsSlots),...yr(t.creds)}))}function lo(e){if(e.disposed||e.reconnectTimer||e.subs.size===0&&e.eventListeners.size===0)return;let t=Zd(e.reconnectAttempts);e.reconnectAttempts+=1,e.reconnectTimer=setTimeout(()=>{if(e.reconnectTimer=void 0,e.disposed)return;if(e.subs.size===0&&e.eventListeners.size===0){Qr(e);return}tn(e,rl(e)).catch(()=>{if(e.hasConnected)e.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${t}ms).`);lo(e)})},t)}function tn(e,t){if(e.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if(e.ws&&e.ws.readyState===gr.OPEN)return Promise.resolve(e.ws);if(e.connectPromise)return e.connectPromise;return e.connectPromise=new Promise((r,n)=>{let o=new gr(e.url,{headers:tl(t)}),s=!1,i=e.hasConnected,c=()=>{s=!0,e.hasConnected=!0,e.reconnectAttempts=0,e.reconnectCredCursor=0,e.lastGoodCreds=t,e.ws=o,e.connectPromise=void 0,o.on("message",(l)=>il(e,l));for(let l of e.subs.values())try{Li(o,l)}catch{}for(let l of Ai(e))try{o.send(JSON.stringify({type:"subscribe_events",...yr(l)}))}catch{}if(i)Ri(e,!0);r(o)},d=()=>{if(e.ws===o)e.ws=void 0;e.connectPromise=void 0;try{o.removeAllListeners()}catch{}if(Ei(e,"socket closed"),e.subs.size>0||e.eventListeners.size>0)Ri(e,!1),lo(e);else Qr(e)},u=(l)=>{if(e.ws===o)e.ws=void 0;if(!s)s=!0,e.connectPromise=void 0,n(l)};o.once("open",c),o.on("close",d),o.on("error",u)}),e.connectPromise}async function fo(e,t,r,n){let o=uo(e.url,n),s=typeof r.path==="string"?r.path:"/",i=await tn(o,e),c=crypto.randomUUID();try{return await new Promise((d,u)=>{let l=setTimeout(()=>{if(!o.pending.has(c))return;o.pending.delete(c),u(new we(`Vault websocket command "${t}" timed out`,s,void 0,"timeout"));try{o.ws?.close()}catch{}},Ci);o.pending.set(c,{resolve:(y)=>d(y),reject:u,timer:l});try{i.send(JSON.stringify({type:"command",id:c,command:t,...r,...yr(e)}))}catch(y){clearTimeout(l),o.pending.delete(c),u(y)}})}finally{en(o)}}async function po(e,t,r,n){let o;try{o=await fo(e,"read_secret",{path:t,...Pi(n)},r)}catch(s){if(bi(s))throw new ot(t);if(s instanceof zt||s instanceof we)throw s;throw new we(`Vault websocket read_secret failed for ${t}`,t,void 0,"connection",{cause:s})}if(!o||typeof o!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${t}`);return{data:o.data,metadata:Oi(typeof o.path==="string"?o.path:t,o.metadata)}}async function xi(e,t,r,n,o,s){let i=uo(e.url,o),c=crypto.randomUUID(),d={subscriptionId:c,creds:e,path:t,...n?.kmsSlots!==void 0?{kmsSlots:n.kmsSlots}:{},onChange:r,onHealth:s?.onHealth};i.subs.set(c,d);let u=()=>{if(!i.subs.delete(c))return;if(i.ws&&i.ws.readyState===gr.OPEN)try{i.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:c}))}catch{}en(i)};try{let l=await tn(i,e);Li(l,d)}catch(l){if(n?.mode!=="wait")throw u(),l}try{let l=await po(e,t,o,n?.kmsSlots);_i(i,d,l,l.metadata.version)}catch(l){if(n?.mode!=="wait")throw u(),l;await new Promise((y,p)=>{let b,M=(_)=>{if(b)clearTimeout(b);d.onFirstSecret=void 0,d.onFirstSecretReject=void 0,u(),p(_)};if(d.onFirstSecret=()=>{if(b)clearTimeout(b);y()},d.onFirstSecretReject=M,typeof n.timeout==="number"&&n.timeout>0)b=setTimeout(()=>M(l),n.timeout)})}return u}async function Ui(e,t,r){let n=uo(e.url,r);n.eventListeners.set(t,e);try{let o=await tn(n,e);if(o.readyState===gr.OPEN)o.send(JSON.stringify({type:"subscribe_events",...yr(e)}))}catch(o){n.log?.warn("Vault websocket event subscription connect failed; retrying in background",o),lo(n)}return()=>{if(!n.eventListeners.delete(t))return;let o=co(e);if(!Ai(n).some((i)=>co(i)===o)&&n.ws&&n.ws.readyState===gr.OPEN)try{n.ws.send(JSON.stringify({type:"unsubscribe_events",...yr(e)}))}catch{}en(n)}}function Mi(){let e=0;for(let t of Rt.values())e+=t.subs.size;return{urls:Array.from(Rt.keys()),sockets:Rt.size,subscriptions:e}}function qi(){for(let e of Array.from(Rt.values()))Qr(e)}var rn=600000;function Ct(e){if(e&&e<rn)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${rn} milliseconds (10 minutes), as not to overload the store with polling requests`)}function st(e,t,r,n,o,s,i){let c=!1,d,u,l,y=(W)=>{try{i?.onHealth?.(W)}catch{}},p=()=>{if(c=!0,d)clearTimeout(d),d=void 0;u?.()},b=(W)=>new Promise((q)=>{let a=setTimeout(()=>{u=void 0,d=void 0,q()},W);d=a,u=()=>{clearTimeout(a),u=void 0,d=void 0,q()}});async function M(){let W=Date.now();for(;;){if(c)return;try{let q=await e.getFullSecret(t,s);return y(!0),q}catch(q){if(y(!1),s?.mode!=="wait")throw q;if(typeof s.timeout==="number"&&s.timeout>0&&Date.now()-W>=s.timeout)throw q;if(c)return;o?.warn(`Error retrieving initial secret from vault. Retrying in ${n} milliseconds`,q),await b(n)}}}async function _(){if(d=void 0,c)return;try{let W=await e.getFullSecret(t,s);if(y(!0),W.metadata.version!==l)l=W.metadata.version,r(W)}catch(W){y(!1),o?.warn(`Error retrieving remote config from vault. Retrying in ${n} milliseconds`,W)}R()}function R(){if(c)return;d=setTimeout(()=>{_()},n)}return M().then((W)=>{if(c||!W)return()=>p();return l=W.metadata.version,r(W),R(),()=>p()})}function cl(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function ul(e){let t={...go,...Di};if(e)t["X-Vault-Token"]=e;return t}function dl(e){return Boolean(e?.idpTokenUrl?.trim()&&e.clientId?.trim()&&e.clientSecret?.trim())}async function Wi(e,t,r){let n=Date.now();if(t.token&&t.expiresAt&&t.expiresAt-60000>n)return t.token;let o=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});if(e.scope?.trim())o.set("scope",e.scope.trim());let s=await fetch(e.idpTokenUrl,{method:"POST",headers:{...go,...al},body:o.toString()});if(!s.ok)throw Error(`Vault workload token request failed (${s.status})`);let i=await Tt(s,{log:r,operation:"vault.workload.token",redact:!0});if(!i.access_token)throw Error("Vault workload token response did not include access_token");return t.token=i.access_token,t.expiresAt=n+Math.max(1,i.expires_in??300)*1000,i.access_token}function ll(e){return{Authorization:e.startsWith("Bearer ")?e:`Bearer ${e}`}}function hr(e){return e.replace(/\/data\/?$/,"")}function ji(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let n=e;if(typeof n.parked!=="boolean")throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let o=n.disposition;if(o!==void 0&&o!=="cooldown"&&o!=="suspect")throw Error(`Vault ${r} kms_park returned invalid disposition for ${t}`);return{parked:n.parked,...n.stale===!0?{stale:!0}:{},...o?{disposition:o}:{}}}function Ni(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);let n=e;if(!Array.isArray(n.keys))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);return{keys:n.keys.map((s,i)=>{if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}] for ${t}`);let c=s.id;if(typeof c!=="string"||c.length===0)throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}].id for ${t}`);return{id:c}})}}function $i(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);let n=e;if(typeof n.revoked!=="boolean")throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);return{revoked:n.revoked}}function Bt(e,t){let{type:r="vault",url:n,token:o,ttl:s}=e,i=()=>e.log,c=dl(e.workload)?e.workload:void 0,d={},u=ul(o),{lfv:l,websocket:y}=e,p=l?kt({...l,log:l.log??i(),path:l.path??"/"},t):void 0,b=new Map,M=y?.url?.trim(),_=new Set,R=!1,W=!1;if(!l&&!n&&!M)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");Ct(s);let q=l?{transport:"lfv",url:mo(l.lfvServerUrl)}:n?{transport:"http",url:mo(n)}:{transport:"websocket",url:mo(M)};if(n&&!o&&!c&&!l)i()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function a(){if(c){let S=await Wi(c,d,i());return{...go,...Di,...ll(S)}}return{...u}}async function w(S){let O=H(S);if(c){let k=await Wi(c,d,i());return{url:O,clientId:y?.clientId??c.clientId,token:k,header:"Authorization"}}return{url:O,clientId:y?.clientId,token:y?.token??o,header:y?.header??"X-Vault-Token"}}function v(S){if(!l)throw Error(`Vault LFV capability is not configured for path ${S}`);let O=b.get(S);if(O)return O;let k=kt({...l,log:l.log??i(),path:S},t);return b.set(S,k),k}function L(S){if(!n)throw Error(`Vault HTTP capability is not configured for path ${S}`);return n}function H(S){if(!M)throw Error(`Vault websocket capability is not configured for path ${S}`);return M}async function J(S,O){let k=await w(typeof O.path==="string"?O.path:"/");return fo(k,S,O,i())}async function Y(S,O){let k=L(S),m;try{let f=await a(),T=new URL(`${k}/${S}`);if(typeof O?.kmsSlots==="number"&&Number.isInteger(O.kmsSlots)&&O.kmsSlots>=1)T.searchParams.set("kms_slots",String(O.kmsSlots));m=await fetch(T,{headers:f})}catch(f){throw new we(`Vault request failed from URL: ${k}/${S}`,S,void 0,"connection",{cause:f})}if(m.status!==200){if(m.status===404)throw new ot(S);let f=m.status===401||m.status===403,T=f?`Vault returned ${m.status} ${m.statusText} (auth error) from URL: ${k}/${S}`:`Vault returned invalid status, ${m.status}: '${m.statusText}' from URL: ${k}/${S}`;throw new we(T,S,m.status,f?"auth":"invalid_status")}try{let T=(await Tt(m,{log:i(),operation:"vault.secret.read",redact:!0})).data;if(!T?.metadata||!("data"in T))throw Error("Missing vault secret data");let A=T.metadata.created_time??T.metadata.created;return{data:T.data,metadata:{path:typeof T.metadata.path==="string"?T.metadata.path:S,version:typeof T.metadata.version==="number"?T.metadata.version:0,created:A instanceof Date?A:typeof A==="string"?new Date(A):new Date,...St(T.metadata)?{contentType:St(T.metadata)}:{}}}}catch(f){throw new we("Error retrieving secret",S,void 0,"invalid_payload",{cause:f})}}async function re(S,O){let k=await w(S);return po(k,S,i(),O?.kmsSlots)}async function ue(S){let O=L(S),k=`${hr(O)}/metadata/${S}`,m=await a(),f=await fetch(k,{headers:m});if(f.status!==200)throw new we(`Vault getMetadata failed (${f.status}) for ${S}`,S,f.status,"invalid_status");let T=await Tt(f,{log:i(),operation:"vault.metadata.read",redact:!0}).catch(()=>null);if(!T?.metadata||typeof T.metadata!=="object")throw new we(`Vault getMetadata returned invalid payload for ${S}`,S,f.status,"invalid_payload");return T.metadata}async function se(S,O,k){let m=L(O),f=`${hr(m)}/${S}/${O}`,T=await a(),A=await fetch(f,{method:"POST",headers:T,body:JSON.stringify({reason:k?.reason,severity:k?.severity,incident_ref:k?.incidentRef})});if(A.status!==200&&A.status!==202&&A.status!==204)throw new we(`Vault ${S} failed (${A.status}) for ${O}`,O,A.status,"invalid_status")}async function K(S,O){if(l)return await v(S).getFullSecret(S,O);if(n)return await Y(S,O);return await re(S,O)}async function ee(S,O,k){if(!cl(O))throw Error(`putSecret requires an object value for vault source at path ${S}`);if(l){await v(S).putSecret(S,O,k);return}if(n){let m=L(S),f=await a();if(f["X-Ionite-Mime-Type"]=k.contentType.mimeType,f["X-Ionite-Secret-Format"]=k.contentType.format,k.contentType.schemaUrl)f["X-Ionite-Schema-Url"]=k.contentType.schemaUrl;if(k.contentType.typeId)f["X-Ionite-Secret-Type"]=k.contentType.typeId;let T=await fetch(`${m}/${S}`,{method:"POST",headers:f,body:JSON.stringify(O)});if(T.status!==200&&T.status!==201&&T.status!==204)throw new we(`Vault putSecret failed (${T.status}) for ${S}`,S,T.status,"invalid_status");return}await J("put_secret",{path:S,data:O,content_type:Kr(k.contentType)})}async function z(S,O){if(l){await v(S).deleteSecret(S,O);return}if(n){let k=L(S),m=await a(),f=await fetch(`${k}/${S}`,{method:"DELETE",headers:m});if(f.status!==200&&f.status!==202&&f.status!==204)throw new we(`Vault deleteSecret failed (${f.status}) for ${S}`,S,f.status,"invalid_status");return}await J("delete_secret",{path:S})}async function D(S,O){if(l)return await v(S).listPaths(S,O);if(n){let f=`${L(S)}/${S}`,T=async(V)=>{let oe=await a();if(V==="LIST")return fetch(f,{method:"LIST",headers:oe});let te=f.includes("?")?"&":"?";return fetch(`${f}${te}list=true`,{method:"GET",headers:oe})},A=await T("LIST");if(A.status===405||A.status===501)A=await T("GET");if(A.status!==200)throw new we(`Vault listPaths failed (${A.status}) for ${S}`,S,A.status,"invalid_status");let N=await Tt(A,{log:i(),operation:"vault.paths.list",redact:!0}).catch(()=>null),Z;if(N&&typeof N==="object"){let V=N,oe=V.data;if(oe&&typeof oe==="object")Z=oe.keys;else Z=V.keys}if(!Array.isArray(Z))throw new we(`Vault listPaths returned an unexpected response for ${S}`,S,void 0,"invalid_payload");return Z.filter((V)=>typeof V==="string")}let k=await J("list_paths",{path:S});if(!Array.isArray(k.items))throw Error(`Vault websocket list_paths returned invalid payload for ${S}`);return k.items.filter((m)=>typeof m==="string")}async function Q(S,O){if(l)return await v(S).exists(S,O);if(n){let m=L(S),f=await a(),T=await fetch(`${m}/${S}`,{headers:f});if(T.status===200)return!0;if(T.status===404)return!1;if(T.status===401||T.status===403)throw new we(`Vault exists failed (${T.status}) for ${S} (auth error)`,S,T.status,"auth");throw new we(`Vault exists failed (${T.status}) for ${S}`,S,T.status,"invalid_status")}let k=await J("exists",{path:S});if(typeof k.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${S}`);return k.exists}async function ne(S,O,k){if(l){await v(S).requestRotate(S,O,k);return}if(n){await se("rotate/request",S,O);return}await J("request_rotate",{path:S,reason:O?.reason,severity:O?.severity,incident_ref:O?.incidentRef})}async function ie(S,O,k){if(l){await v(S).requestRevoke(S,O,k);return}if(n){await se("revoke/request",S,O);return}await J("request_revoke",{path:S,reason:O?.reason,severity:O?.severity,incident_ref:O?.incidentRef})}async function ce(S,O,k){if(l)return await v(S).parkKmsKey(S,O,k);if(n){let f=L(S),T=`${hr(f)}/kms/park/${S}`,A=await a(),N=await fetch(T,{method:"POST",headers:A,body:JSON.stringify({key_id:O.keyId,status:O.status,reason:O.reason})});if(N.status!==200&&N.status!==202)throw new we(`Vault kms/park failed (${N.status}) for ${S}`,S,N.status,"invalid_status");return ji(await Tt(N,{log:i(),operation:"vault.kms.park",redact:!0}).catch(()=>null),S,"http")}let m=await J("kms_park",{path:S,key_id:O.keyId,status:O.status,reason:O.reason});return ji(m,S,"websocket")}async function ae(S,O,k){if(l)return await v(S).addKmsKeys(S,O,k);if(n){let f=L(S),T=`${hr(f)}/kms/add-keys/${S}`,A=await a(),N=await fetch(T,{method:"POST",headers:A,body:JSON.stringify({keys:O.keys})});if(N.status!==200&&N.status!==202)throw new we(`Vault kms/add-keys failed (${N.status}) for ${S}`,S,N.status,"invalid_status");return Ni(await Tt(N,{log:i(),operation:"vault.kms.add_keys",redact:!0}).catch(()=>null),S,"http")}let m=await J("kms_add_keys",{path:S,keys:O.keys});return Ni(m,S,"websocket")}async function C(S,O,k){if(l)return await v(S).revokeKmsKey(S,O,k);if(n){let f=L(S),T=`${hr(f)}/kms/revoke-key/${S}`,A=await a(),N=await fetch(T,{method:"POST",headers:A,body:JSON.stringify({key_id:O.keyId,reason:O.reason})});if(N.status!==200&&N.status!==202)throw new we(`Vault kms/revoke-key failed (${N.status}) for ${S}`,S,N.status,"invalid_status");return $i(await Tt(N,{log:i(),operation:"vault.kms.revoke_key",redact:!0}).catch(()=>null),S,"http")}let m=await J("kms_revoke_key",{path:S,key_id:O.keyId,reason:O.reason});return $i(m,S,"websocket")}async function g(S,O){if(l)return await v(S).getMetadata(S,O);if(n)return await ue(S);let k=await J("read_metadata",{path:S});if(!k.metadata||typeof k.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${S}`);return k.metadata}async function P(S,O,k){if(!s)throw new je(r,S);return st({getFullSecret:Y},S,O,s,i(),k,{onHealth:(m)=>{R=!m}})}async function I(S,O,k){let m=await w(S);return xi(m,S,O,k,i(),{onHealth:(f)=>{W=!f}})}function U(S){let O=()=>{if(_.delete(O))S()};return _.add(O),O}function E(){if(p?.isAvailable?.()===!1)return!0;for(let S of b.values())if(S.isAvailable?.()===!1)return!0;return!1}let F={type:r,origin:q,isAvailable:()=>!R&&!W&&!E(),get:(S,O)=>Ge(()=>K(S,O)),getFullSecret:K,getSecret:async(S,O)=>(await K(S,O)).data,putSecret:ee,deleteSecret:z,listPaths:D,exists:Q,requestRotate:ne,requestRevoke:ie,parkKmsKey:ce,addKmsKeys:ae,revokeKmsKey:C,getMetadata:g,subscribe:async(S,O,k)=>{let m;if(M)m=await I(S,O,k);else if(l)m=await v(S).subscribe(S,O,k);else m=await P(S,O,k);return U(m)},...p?{subscribeEvents:(S)=>U(p.subscribeEvents?.(S)??(()=>{}))}:M?{subscribeEvents:(S)=>{let O,k=!1;return w("/").then((m)=>Ui(m,S,i())).then((m)=>{if(k){m();return}O=m}).catch((m)=>{i()?.warn("Vault websocket event subscription failed",m)}),U(()=>{k=!0,O?.()})}}:{},close:()=>{for(let O of Array.from(_))try{O()}catch(k){i()?.warn("Vault source close: failed to release a subscription",k)}_.clear();let S=(O)=>{if(!O?.close)return;try{Promise.resolve(O.close()).catch((k)=>{i()?.warn("Vault source close: LFV close failed",k)})}catch(k){i()?.warn("Vault source close: LFV close failed",k)}};for(let O of b.values())S(O);S(p),b.clear(),d.token=void 0,d.expiresAt=void 0},get log(){return e.log},set log(S){e.log=S}};if(p)F.isDeliveryRequest=(S)=>p.isDeliveryRequest(S),F.isEventsRequest=(S)=>p.isEventsRequest(S),F.handleDelivery=(S)=>p.handleDelivery(S),F.handleEvents=(S)=>p.handleEvents(S),Object.defineProperties(F,{deliveryPath:{value:p.deliveryPath,enumerable:!0},eventsPath:{value:p.eventsPath,enumerable:!0},callbackKey:{value:p.callbackKey,enumerable:!0},trustId:{value:p.trustId,enumerable:!0}});return F}class ho extends yl{constructor(e,t){super(e,{status:Qe(t),upstreamStatus:t})}}function on(e,t){if(!e||e.trim().length===0)throw Error(`Missing required Azure config: ${t}`);return e}function hl(e){return e.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function yo(e,t){return`${e.replace(/\/+$/g,"")}/${t.replace(/^\/+/g,"")}`}function wl(e){try{let r=new URL(e).pathname.split("/").filter(Boolean),n=r.indexOf("secrets");if(n===-1)return;return r[n+2]||void 0}catch{return}}function Sl(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function sn(e){let t=e.apiVersion??"7.4",r=e.scope??"https://vault.azure.net/.default",n=e.secretNameTransform??hl,o=e.authMethod,s="/var/run/secrets/azure/tokens/azure-identity-token",i=e.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",c=e.vaultUrl??(e.vaultName?`https://${e.vaultName}.vault.azure.net`:void 0)??void 0,d=on(c,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function u(K){try{return await pl(K),!0}catch{return!1}}let l,y,p=!1;async function b(K){let{entraTenantId:ee,clientId:z}=e;if(!ee)throw Error("Workload identity requires entraTenantId");if(!z)throw Error("Workload identity requires clientId");if(!await u(i))throw Error(`Federated token file not found at ${i}`);let D=(await fl(i,"utf8")).trim();if(!D)throw Error("Federated token file was empty");let Q=`https://login.microsoftonline.com/${encodeURIComponent(ee)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:z,grant_type:"client_credentials",scope:r,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:D}),ie=await fetch(Q,{method:"POST",headers:{...Gt,...Ki},body:ne});if(ie.status!==200)throw Error(`Azure workload identity token exchange returned ${ie.status} ${ie.statusText}`);let ce=await nn(ie,{redact:!0});if(!ce?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:ce.access_token,expiresAtMs:K+(ce.expires_in??0)*1000},ce.access_token}async function M(K){let ee=e.imdsApiVersion??"2018-02-01",z="https://vault.azure.net",D=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(D.searchParams.set("api-version",ee),D.searchParams.set("resource","https://vault.azure.net"),e.managedIdentityClientId)D.searchParams.set("client_id",e.managedIdentityClientId);let Q=await fetch(D.toString(),{headers:{Metadata:"true",...Gt}});if(Q.status!==200)throw Error(`Azure IMDS token endpoint returned ${Q.status} ${Q.statusText}`);let ne=await nn(Q,{redact:!0});if(!ne?.access_token)throw Error("IMDS token response missing access_token");let ie=K+60000;if(ne.expires_on){let ce=Number.parseInt(ne.expires_on,10);if(Number.isFinite(ce)&&ce>0)ie=ce*1000;else{let ae=Date.parse(ne.expires_on);if(Number.isFinite(ae))ie=ae}}else if(ne.expires_in){let ce=Number.parseInt(ne.expires_in,10);if(Number.isFinite(ce)&&ce>0)ie=K+ce*1000}return l={accessToken:ne.access_token,expiresAtMs:ie},ne.access_token}async function _(K){let ee=on(e.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),z=on(e.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),D=on(e.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),Q=`https://login.microsoftonline.com/${encodeURIComponent(ee)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:z,client_secret:D,grant_type:"client_credentials",scope:r}),ie=await fetch(Q,{method:"POST",headers:{...Gt,...Ki},body:ne});if(ie.status!==200)throw Error(`Azure token endpoint returned ${ie.status} ${ie.statusText}`);let ce=await nn(ie,{redact:!0});if(!ce?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:ce.access_token,expiresAtMs:K+(ce.expires_in??0)*1000},ce.access_token}async function R(){let K=Date.now();if(l&&l.expiresAtMs-60000>K)return l.accessToken;if(y)return y;y=(async()=>{if(o==="workload_identity")return await b(K);if(o==="managed_identity")return await M(K);if(o==="client_secret")return await _(K);if(await u(i))try{return await b(K)}catch{}try{return await M(K)}catch{}return await _(K)})();try{return await y}finally{y=void 0}}async function W(K){let ee=await R(),z=yo(d,`/secrets/${encodeURIComponent(K)}?api-version=${encodeURIComponent(t)}`),D=await fetch(z,{headers:{Authorization:`Bearer ${ee}`,...Gt}});if(D.status!==200)throw new ho(`Key Vault request failed (${D.status})`,D.status);return await nn(D,{redact:!0})}async function q(K,ee){let z=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${z}`:z,Q=await W(D),ne=Q.value;try{ne=JSON.parse(Q.value)}catch{}let ie=Q.attributes?.created?Q.attributes.created*1000:void 0,ce=wl(Q.id),ae=Q.contentType?Dr({mimeType:Q.contentType,format:Q.tags?.["ionite-format"],schemaUrl:Q.tags?.["ionite-schema-url"],typeId:Q.tags?.["ionite-type-id"]}):void 0;return{data:ne,metadata:{path:K,version:Number.parseInt(ce??"",10)||0,created:ie?new Date(ie):new Date,...ae?{contentType:ae}:{}}}}async function a(K,ee,z){if(!Sl(ee))throw Error(`putSecret requires an object value for azure source at path ${K}`);let D=n(K),Q=e.secretNamePrefix?`${e.secretNamePrefix}${D}`:D,ne=await R(),ie=yo(d,`/secrets/${encodeURIComponent(Q)}?api-version=${encodeURIComponent(t)}`),ce=JSON.stringify({value:JSON.stringify(ee),contentType:z.contentType.mimeType,tags:{"ionite-format":z.contentType.format,...z.contentType.schemaUrl?{"ionite-schema-url":z.contentType.schemaUrl}:{},...z.contentType.typeId?{"ionite-type-id":z.contentType.typeId}:{}}}),ae=await fetch(ie,{method:"PUT",headers:{Authorization:`Bearer ${ne}`,...ml,...Gt},body:ce});if(ae.status!==200&&ae.status!==201)throw Error(`Key Vault putSecret failed (${ae.status}) for ${K}`)}async function w(K,ee){let z=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${z}`:z,Q=await R(),ne=yo(d,`/secrets/${encodeURIComponent(D)}?api-version=${encodeURIComponent(t)}`),ie=await fetch(ne,{method:"DELETE",headers:{Authorization:`Bearer ${Q}`,...Gt}});if(ie.status!==200&&ie.status!==202&&ie.status!==204)throw Error(`Key Vault deleteSecret failed (${ie.status}) for ${K}`)}async function v(K,ee){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${K}`)}async function L(K,ee){try{return await q(K),!0}catch(z){if(z instanceof ho&&z.upstreamStatus===404)return!1;throw z}}async function H(K,ee,z){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${K}`)}async function J(K,ee,z){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${K}`)}async function Y(K){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${K}`)}async function re(K){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${K}`)}async function ue(K){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${K}`)}async function se(K,ee){let z=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${z}`:z,Q=await W(D),ne=Q.contentType?Dr({mimeType:Q.contentType,format:Q.tags?.["ionite-format"],schemaUrl:Q.tags?.["ionite-schema-url"],typeId:Q.tags?.["ionite-type-id"]}):void 0;return{id:Q.id,...ne?{content_type:ne}:{},...Q.attributes??{}}}return{type:e.type,origin:{url:gl(d)},isAvailable:()=>!p,get:(K,ee)=>Ge(()=>q(K,ee)),getFullSecret:q,getSecret:async(K,ee)=>(await q(K,ee)).data,putSecret:a,deleteSecret:w,listPaths:v,exists:L,requestRotate:H,requestRevoke:J,parkKmsKey:Y,addKmsKeys:re,revokeKmsKey:ue,getMetadata:se,subscribe:(K,ee,z)=>{if(!e.ttl)throw new je("azure",K);return Ct(e.ttl),st({getFullSecret:q},K,ee,e.ttl,void 0,z,{onHealth:(D)=>{p=!D}})},close:()=>{l=void 0,y=void 0,p=!1}}}var wo=Symbol("ion.secretsSourceState");function kl(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${n}`)};return{type:"dev",get:(r,n)=>Ge(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[wo]:"unavailable"}}function Fi(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${n}`)};return{type:"dev",get:(r,n)=>Ge(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[wo]:"removed"}}function bl(e){return e.type==="vault"&&e.lfv!=null}function Rl(e,t,r,n){if(!bl(t))return;if(r||n)return;throw Error(`Secrets source "${e}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function Tl(e,t,r){if(t.type==="vault")return Bt(t,r);if(t.type==="azure")return sn(t);if(t.type==="aws"||t.type==="gcp"||t.type==="dev")throw Error(`Secrets source "${e}" uses type "${t.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${e}"`)}function Cl(e,t){let r=(n)=>{t.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:n instanceof Error?n.message:String(n)})};try{Promise.resolve(e.close?.()).catch(r)}catch(n){r(n)}}function Il(e){let t=new Map,r=new Map,n=new Map;for(let[o,s]of Object.entries(e)){if(!Vi(s))continue;let i=t.get(s.deliveryPath);if(i)throw Error(`LFV delivery path "${s.deliveryPath}" is claimed by both secrets sources "${i}" and "${o}"; delivery paths must be globally unique.`);t.set(s.deliveryPath,o);let c=r.get(s.eventsPath);if(c)throw Error(`LFV events path "${s.eventsPath}" is claimed by both secrets sources "${c}" and "${o}"; events paths must be globally unique.`);r.set(s.eventsPath,o);let d=n.get(s.callbackKey);if(d&&d.trustId!==s.trustId)throw Error(`LFV callback key "${s.callbackKey}" is claimed by secrets sources "${d.sourceName}" and "${o}" with different verify JWKS; a callback path must use a single trust key.`);if(!d)n.set(s.callbackKey,{sourceName:o,trustId:s.trustId})}}function Vi(e){return typeof e.isDeliveryRequest==="function"&&typeof e.isEventsRequest==="function"&&typeof e.handleDelivery==="function"&&typeof e.handleEvents==="function"}function Pl(e,t,r){let n={...t},o=[],s=(c)=>{if(n[c]!==void 0)delete n[c],o.push(c)};s("token"),s("clientSecret"),s("workload");let i=n.websocket;if(i&&typeof i==="object"&&i.token!==void 0){let c={...i};delete c.token,n.websocket=c,o.push("websocket.token")}if(o.length>0)r.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:e,"ion.droppedFields":o});return n}function Ol(e,t,r){let n={name:e,type:t.type,ready:t.isReady?.()??!0};if(r?.type==="dev")n.url=r.ioniteUrl;if(r?.type==="vault")n.url=r.url,n.clientId=r.workload?.clientId??r.lfv?.clientId??r.websocket?.clientId;if(r?.type==="aws")n.url=r.webhookUrl;if(r?.type==="azure")n.url=r.vaultUrl,n.clientId=r.clientId??r.managedIdentityClientId,n.authMethod=r.authMethod;return Se(n)}function El(e,t,r){let n={},o=new Set([...Object.keys(t??{}),...Object.keys(r??{})]);for(let s of o){let i=t?.[s],c=r?.[s],d=c?Pl(s,c,e):void 0;n[s]={...i??{},...d??{}}}return n}function an(e){return e[wo]??"available"}function Al(e,t,r){let n=t,o=new Set,s=new Set,i=new Set,c=De(r,`Secrets source "${e}"`),d=()=>an(n)==="available",u=ye(`Secrets source "${e}"`,d),l=(a,w,v)=>Error(`${a} timed out after ${v}ms waiting for source "${e}" to be configured by the ConfigSource at path ${w}`),y=(a,w)=>Error(`${a} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${w}`),p=(a,w,v)=>{let L=an(n);if(L==="available")return Promise.resolve(n);if(L==="removed")return Promise.reject(y(a,w));return new Promise((H,J)=>{let Y={method:a,path:w,resolve:(ue)=>{if(Y.timeout)clearTimeout(Y.timeout);i.delete(Y),H(ue)},reject:(ue)=>{if(Y.timeout)clearTimeout(Y.timeout);i.delete(Y),J(ue)}},re=v?.timeout;if(typeof re==="number"&&re>0)Y.timeout=setTimeout(()=>{Y.reject(l(a,w,re))},re);i.add(Y)})},b=(a)=>{for(let w of Array.from(i))w.resolve(a)},M=()=>{for(let a of Array.from(i))a.reject(y(a.method,a.path))},_=async(a,w=!1)=>{let v=a.guard.next();if(a.unsubscribe?.(),a.unsubscribe=void 0,a.closed)return;if(an(n)==="unavailable"&&a.options?.mode!=="wait"){if(w)throw Error(`subscribe is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${a.path}`);return}try{let H=await(a.options?.mode==="wait"?await p("subscribe",a.path,a.options):n).subscribe(a.path,(J)=>{if(!a.closed)a.onChange(J)},a.options);if(a.closed||!a.guard.isCurrent(v)){H?.();return}a.unsubscribe=H}catch(L){if(w)throw L;if(Br(L)){r.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:e,path:a.path});return}r.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:e,path:a.path,error:L instanceof Error?L.message:String(L)})}},R=(a,w=!1)=>{if(a.unsubscribe?.(),a.unsubscribe=void 0,a.closed)return;if(!n.subscribeEvents){if(w)throw Error(`Secrets source "${e}" does not support lifecycle event subscriptions`);return}a.unsubscribe=n.subscribeEvents((v)=>{if(!a.closed)a.listener(v)})},W={get type(){return n.type},get origin(){return n.origin},beforeChange:c.beforeChange,afterChange:c.afterChange,isAvailable:()=>d()&&(n.isAvailable?.()??!0),isReady:u.isReady,ready:u.ready,get:(a,w)=>Ge(async()=>(await p("get",a,w)).getFullSecret(a,w)),getFullSecret:async(a,w)=>(await p("getFullSecret",a,w)).getFullSecret(a,w),getSecret:async(a,w)=>(await p("getSecret",a,w)).getSecret(a,w),putSecret:async(a,w,v)=>(await p("putSecret",a,v)).putSecret(a,w,v),subscribe:async(a,w,v)=>{let L={path:a,onChange:w,options:v,closed:!1,guard:Xr()};o.add(L);try{await _(L,!0)}catch(H){throw o.delete(L),H}return()=>{L.closed=!0,L.guard.next(),o.delete(L),L.unsubscribe?.(),L.unsubscribe=void 0}},subscribeEvents:(a)=>{let w={listener:a,closed:!1};s.add(w);try{R(w,!0)}catch(v){throw s.delete(w),v}return()=>{w.closed=!0,s.delete(w),w.unsubscribe?.(),w.unsubscribe=void 0}},deleteSecret:async(a,w)=>(await p("deleteSecret",a,w)).deleteSecret(a,w),listPaths:async(a,w)=>(await p("listPaths",a,w)).listPaths(a,w),exists:async(a,w)=>(await p("exists",a,w)).exists(a,w),requestRotate:async(a,w,v)=>(await p("requestRotate",a,v)).requestRotate(a,w,v),requestRevoke:async(a,w,v)=>(await p("requestRevoke",a,v)).requestRevoke(a,w,v),parkKmsKey:async(a,w,v)=>(await p("parkKmsKey",a,v)).parkKmsKey(a,w,v),addKmsKeys:async(a,w,v)=>(await p("addKmsKeys",a,v)).addKmsKeys(a,w,v),revokeKmsKey:async(a,w,v)=>(await p("revokeKmsKey",a,v)).revokeKmsKey(a,w,v),getMetadata:async(a,w)=>(await p("getMetadata",a,w)).getMetadata(a,w)},q=(a)=>{try{Promise.resolve(a.close?.()).catch((w)=>{r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:w instanceof Error?w.message:String(w)})})}catch(w){r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:w instanceof Error?w.message:String(w)})}};return{api:W,update(a){if(a===n)return;let w=n;c.emitBefore(),n=a;let v=an(a);if(v==="available")b(a);else if(v==="removed")M();u.refresh();for(let L of o)_(L);for(let L of s)R(L);q(w),c.emitAfter()},close(){for(let a of o)a.closed=!0,a.guard.next(),a.unsubscribe?.(),a.unsubscribe=void 0;o.clear();for(let a of s)a.closed=!0,a.unsubscribe?.(),a.unsubscribe=void 0;s.clear(),M(),u.settle(),q(n)}}}function zi(e,t=new Map){let r=new Map,n=new Map,o=new Map,s,i=!1,c=new Map,d=De(e,"Secrets"),u=!1,l=()=>{for(let a of r.keys()){let w=c.get(a);if(w&&w.api.isReady?.()===!1)return!1}return!0},y=ye("Secrets module",()=>u&&l()),p=(a,w)=>Ol(a,w,o.get(a)),b=(a)=>{let w=c.get(a);if(w)return w;let v=Al(a,r.get(a)??Fi(a),e);if(Object.defineProperty(v.api,"describe",{value:()=>p(a,v.api),enumerable:!1,configurable:!0}),c.set(a,v),!(a in q))Object.assign(q,{[a]:v.api});return v},M=(a)=>{let w=c.get(a)?.api;if(w)return w;throw e.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:a}),Error(`Secrets source "${a}" is not configured`)},_=()=>Array.from(r.values()).filter(Vi),R=(a)=>_().find((w)=>w.isDeliveryRequest(a)),W=(a)=>_().find((w)=>w.isEventsRequest(a)),q;return q={describe:()=>({module:"secrets",active:u,ready:y.isReady(),sources:Array.from(r.keys(),(a)=>p(a,b(a).api))}),get config(){return Object.fromEntries(Array.from(r.keys(),(a)=>[a,b(a).api]))},beforeChange:d.beforeChange,afterChange:d.afterChange,isReady:y.isReady,isAvailable:()=>{for(let a of c.values()){if(a.api.isReady?.()===!1)continue;if(a.api.isAvailable?.()===!1)return!1}return!0},ready:y.ready,listSecretsSources:()=>Array.from(r.keys()),getSecretsSource:(a)=>r.has(a)?b(a).api:M(a),get:(a,w,v)=>q.getSecretsSource(a).get(w,v),getSecret:(a,w,v)=>q.getSecretsSource(a).getSecret(w,v),getFullSecret:(a,w,v)=>q.getSecretsSource(a).getFullSecret(w,v),putSecret:(a,w,v,L)=>q.getSecretsSource(a).putSecret(w,v,L),deleteSecret:(a,w,v)=>q.getSecretsSource(a).deleteSecret(w,v),listPaths:(a,w,v)=>q.getSecretsSource(a).listPaths(w,v),exists:(a,w,v)=>q.getSecretsSource(a).exists(w,v),requestRotate:(a,w,v,L)=>q.getSecretsSource(a).requestRotate(w,v,L),requestRevoke:(a,w,v,L)=>q.getSecretsSource(a).requestRevoke(w,v,L),parkKmsKey:(a,w,v,L)=>q.getSecretsSource(a).parkKmsKey(w,v,L),addKmsKeys:(a,w,v,L)=>q.getSecretsSource(a).addKmsKeys(w,v,L),revokeKmsKey:(a,w,v,L)=>q.getSecretsSource(a).revokeKmsKey(w,v,L),getMetadata:(a,w,v)=>q.getSecretsSource(a).getMetadata(w,v),subscribe:(a,w,v,L)=>q.getSecretsSource(a).subscribe(w,v,L),isLfvDeliveryRequest:(a)=>R(a)!==void 0,isLfvEventsRequest:(a)=>W(a)!==void 0,handleLfvDelivery:async(a)=>{let w=R(a);if(!w)return me();return w.handleDelivery(a)},handleLfvEvents:async(a)=>{let w=W(a);if(!w)return me();return w.handleEvents(a)}},{update(a,w,v,L,H){let J=a!==void 0||w!==void 0;if(!J&&!u&&c.size===0)return;let Y=El(e,a,w),re=H===!0,ue=L!==s,se=re!==i,K=new Map,ee=new Map,z=[];try{for(let[D,Q]of Object.entries(Y)){let ne=vl(Q),ie=r.get(D);if(ie&&n.get(D)===ne&&!ue&&!se){K.set(D,ie),ee.set(D,ne);continue}let ce;if(!Q.type)ce=kl(D);else{if(v?.validateSourceConfig?.(D,Q),t.has(D)&&a?.[D])e.warn(`RemoteConfig secrets source "${D}" is superseded by the framework LFV bootstrap source.`);if(!t.has(D))Rl(D,Q,L,re),ce=Tl(D,Q,L),z.push(ce);else ce=t.get(D)}K.set(D,ce),ee.set(D,ne)}Il(Object.fromEntries(K))}catch(D){for(let Q of z)Cl(Q,e);throw D}d.emitBefore(),u=J,s=L,i=re;for(let[D,Q]of K)r.set(D,Q),n.set(D,ee.get(D)),o.set(D,Y[D]),b(D).update(Q);for(let[D,Q]of c){if(K.has(D))continue;r.delete(D),n.delete(D),o.delete(D),Q.update(Fi(D))}return y.refresh(),d.emitAfter(),q},close(){for(let a of c.values())a.close();c.clear(),r.clear(),n.clear(),o.clear(),s=void 0,u=!1,y.settle()}}}function So(e,t){let r=t.ttlMs,n=Math.max(1,Math.floor(t.maxEntries)),o=new Map,s=()=>Date.now();function i(){while(o.size>n){let d=o.keys().next().value;if(d===void 0)break;o.delete(d)}}function c(d,u){o.delete(d),o.set(d,{session:u,expiresAt:s()+r}),i()}return{capabilities:e.capabilities,async create(d){await e.create(d)},async get(d){let u=o.get(d);if(u){if(u.expiresAt>s())return o.delete(d),o.set(d,u),u.session;o.delete(d)}let l=await e.get(d);if(l)c(d,l);return l},async update(d,u){await e.update(d,u),o.delete(d)},async delete(d){await e.delete(d),o.delete(d)}}}import{deepEqualPlain as Bi,IoniteError as Re,trimTrailingSlash as Pt,validationFailureResponse as xl}from"@ionite/core";import{getCachedVerificationKey as Ul}from"@ionite/core/server";import{randomBytes as _l}from"node:crypto";var wr=3600;function vo(e){let t=e.path.trim();if(!t.startsWith("/")||t.startsWith("//"))throw Error("actionRequired path must be an absolute App path.");let r=e.ttlSeconds??wr;if(!Number.isInteger(r)||r<60)throw Error("actionRequired ttlSeconds must be an integer of at least 60.");let n=_l(24).toString("base64url"),o=new URL(t,e.origin.endsWith("/")?e.origin:`${e.origin}/`);return o.searchParams.set("rt",n),{requestToken:n,actionUrl:o.toString(),expiresAt:new Date((e.now??Date.now())+r*1000).toISOString()}}function Ll(e,t=Date.now()){if(!e)return!0;let r=Date.parse(e);return Number.isNaN(r)||r<=t}function Hi(){let e,t=ye("tm module",()=>e!==void 0),r=()=>{if(!e)throw new Re("Tenant Management is not ready",{status:503});return e},n={describe:()=>e?.describe()??{module:"tm",active:!1,ready:!1,enabled:!1,requestTokenTtlSeconds:wr},isReady:t.isReady,ready:t.ready,handler:(o)=>e?e.handler(o):Promise.resolve(Response.json({error:"Tenant Management is not ready"},{status:503})),getTenant:(o)=>r().getTenant(o),recordConsent:(o)=>r().recordConsent(o),actionRequired:(o)=>r().actionRequired(o)};return{handle:n,update(o,s){return e=o,t.refresh(),s?n:void 0}}}var Ml=600,ql=30;function Ji(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),r=t.padEnd(Math.ceil(t.length/4)*4,"=");return Uint8Array.from(atob(r),(n)=>n.charCodeAt(0)).buffer}function Gi(e){return JSON.parse(new TextDecoder().decode(new Uint8Array(Ji(e))))}function Yi(e){return Array.isArray(e)&&e.length>0&&e.every((t)=>typeof t==="string")}function Wl(e){if(!e||typeof e!=="object")throw new Re("Invalid staged integration handle",{status:400});let t=e;if(typeof t.iss!=="string"||!(typeof t.aud==="string"||Yi(t.aud))||typeof t.iat!=="number"||typeof t.exp!=="number"||typeof t.jti!=="string"||typeof t.ioniteId!=="string"||typeof t.productId!=="string"||typeof t.applicationId!=="string")throw new Re("Invalid staged integration claims",{status:400});return t}function jl(e,t){return Array.isArray(e)?e.includes(t):e===t}async function It(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return Array.from(new Uint8Array(t),(r)=>r.toString(16).padStart(2,"0")).join("")}async function cn(e,t){let r=await Xi(e,t),n=Wl(r),o=Math.floor(Date.now()/1000),s=t.consentTtlSeconds??Ml;if(n.iat>o+60||n.exp-n.iat>s)throw new Re("Staged integration handle lifetime is invalid",{status:401});return{handle:e,ioniteName:n.ioniteName??t.ionite.name,ioniteId:n.ioniteId,productId:n.productId,applicationId:n.applicationId,issuedAt:new Date(n.iat*1000).toISOString(),expiresAt:new Date(n.exp*1000).toISOString(),requestId:n.jti,tenantHint:n.tenantHint}}async function Xi(e,t){let r=e.split(".");if(r.length!==3)throw new Re("Invalid staged integration handle",{status:400});let n=Gi(r[0]);if(!n||typeof n!=="object")throw new Re("Invalid staged integration handle",{status:400});let{alg:o,kid:s}=n;if(o!=="RS256"||typeof s!=="string"||s.length===0)throw new Re("Unsupported staged integration signature",{status:400});let i=Gi(r[1]);if(!i||typeof i!=="object")throw new Re("Invalid TM access token claims",{status:400});let c=i,d=await Ul(t.ionite.jwksUri,s,"tm:RS256",(p)=>crypto.subtle.importKey("jwk",p,{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"]));if(!await crypto.subtle.verify({name:"RSASSA-PKCS1-v1_5"},d,Ji(r[2]),new TextEncoder().encode(`${r[0]}.${r[1]}`)))throw new Re("Invalid staged integration signature",{status:401});let l=Math.floor(Date.now()/1000),y=c.azp??c.client_id;if(typeof c.iss!=="string"||c.iss.replace(/\/+$/,"")!==t.ionite.issuer.replace(/\/+$/,"")||!(typeof c.aud==="string"||Yi(c.aud))||!jl(c.aud,t.ionite.audience)||y!==t.ionite.clientId||typeof c.exp!=="number"||c.exp<=l)throw new Re("TM access token is not trusted or has expired",{status:401});return c}function Zi(e){try{return Pt(new URL(e,"http://dummy").pathname)}catch{let t=e.startsWith("/")?e:`/${e}`;return Pt(t)}}function Nl(e,t){let r=new URL(e.url);return new URL(`/${encodeURIComponent(t)}/`,r.origin).toString()}function $l(e,t){let r=Zi(t),n=Pt(e);if(n===r)return null;if(!n.startsWith(`${r}/`))return null;let o=n.slice(r.length+1);if(!o||o.includes("/"))return null;return decodeURIComponent(o)}function un(e){return e==="pending"||e==="processing"||e==="completed"||e==="failed"||e==="action_required"}function Dl(e){if(!un(e.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if(e.status==="completed"){if(!e.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:e.tenantUrl,status:"completed"},status:201}}if(e.status==="pending"||e.status==="processing")return{body:{tenantUrl:e.tenantUrl,status:e.status},status:202};if(e.status==="action_required"){if(!e.actionUrl||!e.requestToken||!e.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:e.actionUrl,requestToken:e.requestToken,expiresAt:e.expiresAt},status:200}}return{body:{tenantUrl:e.tenantUrl,status:"failed",error:e.error??"Tenant provisioning failed"},status:409}}function Qi(e,t,r){let n=r.validators.tenant.createTenantRequest,o=r.validators.tenant.updateTenantRequest;async function s(a,w){if(!w)return;try{await w()}catch(v){e.log.warn(`Tenant ${a} lifecycle hook failed`,{"ion.operation":`tm.tenant_${a}`,"ion.outcome":"error",error:v instanceof Error?v.message:String(v)})}}async function i(a,w){let{integration:v,configLocator:L}=a;if(v?.status!=="consented"||v.handoverAppliedAt||!L)return a;try{if(!(await r.store.getIon(a.id))?.isReady())return a;return await r.onHandoverApplied?.({tenant:a,previousLocator:w,destinationLocator:L}),await u().setIntegration(a.id,{...v,version:v.version+1,handoverAppliedAt:new Date().toISOString()},{expectedHandleHash:v.handleHash,expectedVersion:v.version})??await r.store.get(a.id)??a}catch(H){return e.log.error("Tenant config handover observation failed; the handover stays pending until a later GET succeeds",{"ion.operation":"tm.handover.observe","ion.outcome":"error",tenantId:a.id,error:H instanceof Error?H.message:String(H)},H),a}}function c(a,w){let v=(L)=>new URL(L,w).toString();return{readyzUrl:v(a.readyzUrl),capabilitiezUrl:v(a.capabilitiezUrl),sso:{loginUrl:v(a.sso.loginUrl),userUrl:v(a.sso.userUrl),logoutUrl:v(a.sso.logoutUrl),logoutBackChannelUrl:v(a.sso.logoutBackChannelUrl),refreshUrl:v(a.sso.refreshUrl),callbackUrl:v(a.sso.callbackUrl)},workload:{validateUrl:v(a.workload.validateUrl),jwksUrl:v(a.workload.jwksUrl)},iam:{basePath:v(a.iam.basePath),usersUrl:v(a.iam.usersUrl),groupsUrl:v(a.iam.groupsUrl),workloadsUrl:v(a.iam.workloadsUrl),customersUrl:v(a.iam.customersUrl)},ciam:{magicLinkUrl:v(a.ciam.magicLinkUrl),magicLinkLoginUrl:v(a.ciam.magicLinkLoginUrl),customerUrl:v(a.ciam.customerUrl),customerLoginUrl:v(a.ciam.customerLoginUrl),customerCallbackUrl:v(a.ciam.customerCallbackUrl),customerProvidersUrl:v(a.ciam.customerProvidersUrl),logoutUrl:v(a.ciam.logoutUrl)}}}function d(a,w){let v=r.tenantIonBasePath?.(a);if(!v)return;let L=new URL(w.url).origin,H=c(Fe(v),L);return{callbackUrl:H.sso.callbackUrl,ionUrls:H}}function u(){if(!r.store.setIntegration||!r.store.getByIntegrationHandleHash)throw new Re("Tenant integration requires store.setIntegration and store.getByIntegrationHandleHash",{status:501});return{setIntegration:r.store.setIntegration.bind(r.store),getByIntegrationHandleHash:r.store.getByIntegrationHandleHash.bind(r.store)}}async function l(a){let w=a.headers.get("Authorization");if(!w?.startsWith("Bearer "))return Response.json({error:"Unauthorized"},{status:401});try{await Xi(w.slice(7),t);return}catch{return Response.json({error:"Unauthorized"},{status:401})}}function y(a){let{integration:w,...v}=a;if(!w)return v;return{...v,integration:{ioniteName:w.ioniteName,ioniteId:w.ioniteId,applicationId:w.applicationId,productId:w.productId,status:w.status,expiresAt:w.expiresAt,requestedAt:w.requestedAt,decidedAt:w.decidedAt}}}async function p(a){let w=await a.json();if(!w||typeof w.handle!=="string"||w.handle.length===0)throw new Re("handle is required",{status:400});if(w.authorization!==void 0&&typeof w.authorization!=="string")throw new Re("authorization must be a string",{status:400});return{handle:w.handle,authorization:w.authorization}}async function b(a){if(a.method!=="GET")return Be(["GET"]);if(!r.onConnectRequest)return Response.json({error:"Tenant integration consent is not supported"},{status:501});let w=new URL(a.url).searchParams.get("handle");if(!w)return Response.json({error:"handle is required"},{status:400});let v=await cn(w,t),L=v.tenantHint?await r.store.get(v.tenantHint):void 0;if(v.tenantHint&&!L)return me();if(L){if(L.ioniteId&&L.ioniteId!==v.ioniteId)return Response.json({error:"Tenant is bound to another ionite id"},{status:409});let H=u(),J=await It(w),Y=L.integration;if(Y&&Y.handleHash!==J&&Date.parse(Y.expiresAt)>Date.now())return Response.json({error:"Tenant already has an active integration request"},{status:409});if(!Y||Y.handleHash!==J){if(!await H.setIntegration(L.id,{version:(Y?.version??0)+1,ioniteName:v.ioniteName,ioniteId:v.ioniteId,applicationId:v.applicationId,productId:v.productId,handleHash:J,status:"consent_requested",expiresAt:v.expiresAt,redeemAttempts:0,requestedAt:new Date().toISOString()},{expectedHandleHash:Y?.handleHash??null,expectedVersion:Y?.version}))return Response.json({error:"Integration request changed concurrently"},{status:409})}}return r.onConnectRequest({request:a,ion:e,staged:v,tenant:L})}async function M(a){if(a.method!=="POST")return Be(["POST"]);let w=await l(a);if(w)return w;let{handle:v}=await p(a);await cn(v,t);let L=await It(v),H=u(),J=await H.getByIntegrationHandleHash(L);if(!J?.integration)return Response.json({status:"pending"},{status:202});let Y=J.integration;if(Date.parse(Y.expiresAt)<=Date.now())return Response.json({status:"expired"},{status:410});if(Y.status==="consented"&&Y.consentRedeemedAt)return Response.json({status:"consumed"},{status:410});let re=t.maxRedeemAttempts??ql;if(Y.redeemAttempts>=re)return Response.json({status:"attempt_limit"},{status:429});let ue={...Y,version:Y.version+1,redeemAttempts:Y.redeemAttempts+1},se=await H.setIntegration(J.id,ue,{expectedHandleHash:L,expectedVersion:Y.version});if(!se?.integration)return Response.json({status:"pending"},{status:409});if(se.integration.status==="declined")return Response.json({status:"declined"},{status:200});if(se.integration.status!=="consented")return Response.json({status:"pending"},{status:202});let K=crypto.randomUUID().replace(/-/g,"")+crypto.randomUUID().replace(/-/g,""),ee={...se.integration,version:se.integration.version+1,consentRedeemedAt:new Date().toISOString(),exportTokenHash:await It(K)};if(!await H.setIntegration(J.id,ee,{expectedHandleHash:L,expectedVersion:se.integration.version}))return Response.json({status:"consumed"},{status:409});return Response.json({status:"consented",tenantId:J.id,authorization:K,expiresAt:Y.expiresAt})}async function _(a){if(a.method!=="POST")return Be(["POST"]);let w=await l(a);if(w)return w;if(!r.exportConfig)return Response.json({error:"Config export is not supported"},{status:501});let{handle:v,authorization:L}=await p(a);if(!L)return Response.json({error:"authorization is required"},{status:400});await cn(v,t);let H=await It(v),J=u(),Y=await J.getByIntegrationHandleHash(H),re=Y?.integration;if(!Y||!re||re.status!=="consented"||re.configExportedAt||!re.exportTokenHash||re.exportTokenHash!==await It(L))return Response.json({error:"Export authorization is invalid or consumed"},{status:401});if(Date.parse(re.expiresAt)<=Date.now())return Response.json({error:"Export authorization expired"},{status:410});let ue=await r.exportConfig({tenant:Y}),se={...re,version:re.version+1,configExportedAt:new Date().toISOString(),exportTokenHash:void 0};if(!await J.setIntegration(Y.id,se,{expectedHandleHash:H,expectedVersion:re.version}))return Response.json({error:"Export authorization is already consumed"},{status:409});return Response.json(ue)}async function R(a){let w=await cn(a.handle,t),v=await r.store.get(a.tenantId);if(!v)throw new Re("Tenant not found",{status:404});if(w.tenantHint&&w.tenantHint!==v.id)throw new Re("Staged request is bound to another tenant",{status:409});if(v.ioniteId&&v.ioniteId!==w.ioniteId)throw new Re("Tenant is bound to another ionite id",{status:409});let L=await It(a.handle),H=v.integration;if(H?.status==="consented"&&H.handleHash!==L)throw new Re("A consented tenant cannot be rebound",{status:409});if(H&&H.handleHash!==L&&Date.parse(H.expiresAt)>Date.now())throw new Re("Tenant already has an active integration request",{status:409});let J=new Date().toISOString(),Y={version:(H?.handleHash===L?H.version:0)+1,ioniteName:w.ioniteName,ioniteId:w.ioniteId,productId:w.productId,applicationId:w.applicationId,handleHash:L,status:a.decision,expiresAt:w.expiresAt,redeemAttempts:H?.handleHash===L?H.redeemAttempts:0,requestedAt:H?.handleHash===L?H.requestedAt:J,decidedAt:J,decidedBy:a.decidedBy},re=await u().setIntegration(v.id,Y,{expectedHandleHash:H?.handleHash??null,expectedVersion:H?.version});if(!re)throw new Re("Integration request changed; reload and try again",{status:409});return re}async function W(a){let v=new URL(a.url).pathname,L=Zi(r.basePath),H=`${L}/integrations`;if(Pt(v)===`${H}/authorize`)return b(a);if(Pt(v)===`${H}/redeem`)return M(a);if(Pt(v)===`${H}/config-export`)return _(a);let J=$l(v,r.basePath),Y=Pt(v)===L;if(!Y&&!J)return me();if(!["GET","PUT","POST","DELETE"].includes(a.method))return Be(["GET","PUT","POST","DELETE"]);if(a.method==="GET"&&Y&&J==null)return me();let re=await l(a);if(re)return re;if(a.method==="GET"){if(J==null)return me();let ae=await r.store.get(J),C=ae?await i(ae):void 0;if(!C)return me();let g=d(C,a),P=y(C);return Response.json(g?{...P,...g}:P,{status:200})}if(a.method==="DELETE"){if(!J)return me();let ae=await r.store.get(J);if(ae)await r.mirror?.purge(ae.id);if(await r.store.delete(J),ae)await s("deleted",()=>r.onTenantDeleted?.({tenantId:ae.id}));return new Response(null,{status:204})}if(!J&&a.method!=="POST")return me();let ue;try{ue=await a.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let se=a.method==="POST";if(!se&&ue&&typeof ue==="object"&&Object.hasOwn(ue,"ioniteId"))return Response.json({error:"ioniteId cannot be changed"},{status:400});let K=se?await n.validate(ue):await o.validate(ue);if(K.issues)return xl(K.issues,se?"Tenant create validation failed":"Tenant update validation failed");let ee=se?K.value.id:J;if(!ee)return me();if(J!=null&&K.value.id!=null&&K.value.id!==J)return Response.json({error:"Path id must match body id"},{status:400});let z;if(se){let ae=K.value,C=await r.store.getByIoniteId(ae.ioniteId);if(C)ee=C.id,z=C;else if(z=await r.store.get(ee),z)return Response.json({error:"tenant_id_taken",message:"The suggested App tenant id is already in use; retry with another id."},{status:409})}else z=await r.store.get(ee);if(z&&!un(z.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let D=new Date,Q=z??{},ne;if(se){let ae=K.value,C=ae,g=C.status,P=un(g)?g:z?.status??"completed";ne={...Q,...ae,id:ee,ioniteId:ae.ioniteId,companyId:ae.companyId,companyName:ae.companyName,environmentType:ae.environmentType,configLocator:ae.configLocator,email:ae.email??z?.email,webhookUrl:ae.webhookUrl??z?.webhookUrl,callbackUrl:ae.callbackUrl??z?.callbackUrl,tenantUrl:C.tenantUrl??z?.tenantUrl,status:P,error:C.error??z?.error,actionUrl:C.actionUrl??z?.actionUrl,requestToken:C.requestToken??z?.requestToken,expiresAt:C.expiresAt??z?.expiresAt,createdAt:z?.createdAt??D,updatedAt:D}}else{let ae=K.value,C=ae,g=C.status,P=un(g)?g:z?.status??"completed",{configLocator:I,...U}=ae;ne={...Q,...U,id:ee,companyId:ae.companyId??z?.companyId??"",companyName:ae.companyName??z?.companyName??"",environmentType:ae.environmentType??z?.environmentType??"DEV",email:ae.email??z?.email,webhookUrl:ae.webhookUrl??z?.webhookUrl,callbackUrl:ae.callbackUrl??z?.callbackUrl,tenantUrl:C.tenantUrl??z?.tenantUrl,status:P,error:C.error??z?.error,actionUrl:C.actionUrl??z?.actionUrl,requestToken:C.requestToken??z?.requestToken,expiresAt:C.expiresAt??z?.expiresAt,configLocator:I??z?.configLocator,createdAt:z?.createdAt??D,updatedAt:D}}if(!ne.tenantUrl)ne.tenantUrl=Nl(a,ee);if(!ne.callbackUrl){let ae=d(ne,a);if(ae)ne.callbackUrl=ae.callbackUrl}if(z?.configLocator&&!Bi(z.configLocator,ne.configLocator))await r.mirror?.purge(z.id);let ie=await r.store.upsert(ne);if(se)await s("created",()=>r.onTenantCreated?.({tenant:ie}));if(z?.integration?.status==="consented"&&!Bi(z.configLocator,ne.configLocator))ie=await i(ie,z.configLocator);let ce=Dl(ie);if(ce instanceof Response)return ce;return Response.json(ce.body,{status:ce.status})}async function q(a){return Ur(e,"tm",async()=>{if(!e.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await W(a)})}return{describe:()=>Se({module:"tm",active:!0,ready:!0,enabled:t.enabled,ionite:t.ionite,consentTtlSeconds:t.consentTtlSeconds,maxRedeemAttempts:t.maxRedeemAttempts,requestTokenTtlSeconds:t.requestTokenTtlSeconds??wr}),handler:q,isReady:()=>!0,ready:async()=>{return},recordConsent:R,actionRequired:(a)=>vo({...a,ttlSeconds:t.requestTokenTtlSeconds}),getTenant:async(a)=>r.store.get(a)}}var dn="0.0.24-beta.20261007.23";import{readFile as Kl}from"node:fs/promises";import{ACCEPT_JSON as Sr,assertEcid as ea,CONTENT_TYPE_FORM as ko,CONTENT_TYPE_JSON as Fl,JSON_MEDIA_TYPE as ln,jwtAssertionClaimsSchema as Vl,must as qe,readJsonResponse as ta,workloadTokenResponseSchema as zl}from"@ionite/core";import{deriveClaimsEntitlements as Bl,getCachedVerificationKey as Gl,getJwks as Hl}from"@ionite/core/server";function Ke(e,t){return t in e&&e[t]!==void 0&&e[t]!==null}function Jl(e){let t=e.trim().replace(/\/\.default$/,"");if(!t||/\s/.test(t))throw Error(`Managed identity workload tokens need a single-resource scope like "<appId>/.default" (got "${e}")`);return t}async function Yl(e,t){let r=Jl(t),n=process.env.IDENTITY_ENDPOINT,o=process.env.IDENTITY_HEADER;if(n&&o){let i=new URL(n);return i.searchParams.set("api-version","2019-08-01"),i.searchParams.set("resource",r),i.searchParams.set("client_id",e),await fetch(i,{headers:{"X-IDENTITY-HEADER":o,...Sr}})}let s=new URL("http://169.254.169.254/metadata/identity/oauth2/token");return s.searchParams.set("api-version","2018-02-01"),s.searchParams.set("resource",r),s.searchParams.set("client_id",e),await fetch(s,{headers:{Metadata:"true",...Sr}})}function Xl(e){if(typeof e!=="object"||e===null)return e;let t=e,r=typeof t.expires_in==="string"?Number.parseInt(t.expires_in,10):t.expires_in;return{access_token:t.access_token,token_type:t.token_type??"Bearer",...typeof r==="number"&&Number.isFinite(r)?{expires_in:r}:{}}}function Le(e){if(e===void 0||e===null)return!1;return Ke(e,"workloadId")||Ke(e,"privateKey")}function Je(e){if(e===void 0||e===null)return!1;let t=Ke(e,"clientId"),r=Ke(e,"clientSecret"),n=Ke(e,"workloadId"),o=Ke(e,"privateKey");return(t||r)&&!n&&!o}function bo(e){if(e===void 0||e===null)return!1;let t=Ke(e,"jwksUri"),r=Ke(e,"workloadId"),n=Ke(e,"clientId"),o=Ke(e,"clientSecret"),s=Ke(e,"privateKey");return t&&!r&&!s&&!n&&!o}function ra(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function Zl(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(ra(t))return!1;let r=Object.entries(t);if(r.length===0)return!1;return r.every(([,n])=>ra(n))}function aa(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if("incoming"in t||"outgoing"in t){if(t.incoming!==void 0&&(typeof t.incoming!=="object"||t.incoming===null))return!1;if(t.outgoing!==void 0&&(typeof t.outgoing!=="object"||t.outgoing===null||Array.isArray(t.outgoing)))return!1;return!0}return!1}function ca(e){return aa(e)}function Ro(e){if(!e)return;if(ca(e))return Array.isArray(e.incoming)?void 0:e.incoming;return e}function Eo(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function Ht(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function na(e){if(!e)return[];if(Array.isArray(e))return e.filter((t)=>!!t&&typeof t.issuer==="string"&&typeof t.jwksUri==="string").map((t)=>({issuer:t.issuer,jwksUri:t.jwksUri,audience:t.audience,claimsAsEntitlements:t.claimsAsEntitlements}));if(e.issuer&&e.jwksUri)return[{issuer:e.issuer,jwksUri:e.jwksUri,audience:e.audience??[],claimsAsEntitlements:e.claimsAsEntitlements}];return[]}function Ql(e){let t=e[0];if(!t)return;let r=Eo(t.audience);return{jwksUri:t.jwksUri,issuer:t.issuer,audience:typeof r[0]==="string"?r[0]:void 0}}function oa(e,t){let r=Ht(t);if(!r)return;return e.find((n)=>Ht(n.issuer)===r)}function fn(e,t,r){let n=Eo(e);if(t.some((o)=>n.includes(o)))return!0;if(typeof r==="string"&&t.includes(r))return!0;return!1}function To(e){if(!e||!ca(e))return{};return e.outgoing??{}}function pn(e,t,r){return Se({name:e,ready:r,clientId:"clientId"in t?t.clientId:void 0,workloadId:"workloadId"in t?t.workloadId:void 0,idpTokenUrl:t.idpTokenUrl,scope:t.scope,audience:t.audience,authMethod:ef(t)})}function ef(e){if("privateKey"in e&&e.privateKey)return"private_key_jwt";if(!("clientId"in e)||!e.clientId)return"server_only";if("authMethod"in e&&e.authMethod==="managed_identity")return"managed_identity";if("clientSecret"in e&&e.clientSecret)return"client_secret";if("federatedTokenFile"in e&&e.federatedTokenFile)return"federated_token";return"client_secret"}function ua(e,t){let[r]=t.describe().outgoing;return{...r??pn(e,{},t.isReady()),name:e}}function Co(e,t){let r=e?.describe();return{module:"workload",active:e!==void 0||Object.keys(t).length>0,ready:e?.isReady()===!0||Object.values(t).some((n)=>n.isReady()),incoming:r?.incoming??{trustedIdps:[]},outgoing:Object.entries(t).map(([n,o])=>ua(n,o)),urls:r?.urls??{}}}function tf(e,t){return{describe:()=>ua(e,t),getToken:t.getToken,refreshToken:t.refreshToken,generateJWTAssertion:t.generateJWTAssertion,revokeToken:t.revokeToken,beforeChange:t.beforeChange,afterChange:t.afterChange,isReady:t.isReady,ready:t.ready}}var Ao=Symbol("ion.workloadClientState"),da=Symbol("ion.namedWorkloadClients");function Jt(e,t){let r=ye(e,t);return{isReady:r.isReady,ready:r.ready}}function rf(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...Jt(`workload client "${e}"`,()=>!1),describe:()=>pn(e,{},!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[Ao]:"unavailable"}}function sa(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it is no longer configured on this Ionite instance.`)};return{...Jt(`workload client "${e}"`,()=>!1),describe:()=>pn(e,{},!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[Ao]:"removed"}}function nf(e){if(!e)return"removed";return e[Ao]??"available"}function Io(e,t,r){let n=e,o=n,s=new Set;for(let i of r){if(s.add(i),i in o)continue;let c=t[i];o[i]=c?tf(i,c):rf(i)}return Object.defineProperty(o,da,{value:s,enumerable:!1,configurable:!0}),n}function ia(e){if(!e)return[];let t=e[da];return t?Array.from(t):[]}function of(e,t,r){let n=t,o=De(r,`Workload client "${e}"`),s=()=>nf(n)==="available",i=ye(`Workload client "${e}"`,s);return{api:{beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:i.isReady,ready:i.ready,describe:()=>n.describe(),getToken:(d)=>n.getToken(d),refreshToken:(d)=>n.refreshToken(d),generateJWTAssertion:(d)=>n.generateJWTAssertion(d),revokeToken:(d)=>n.revokeToken(d)},update(d){if(d===n)return;o.emitBefore(),n=d,i.refresh(),o.emitAfter()}}}function la(e){let t,r=!1,n=ye("Workload module",()=>r),o=De(e,"Workload"),s=new Map,i=new Set,c=new Set(["beforeChange","afterChange","isReady","ready","describe"]),d=(p)=>{if(!t)throw Error(`${p} is unavailable because workload is not configured on this Ionite instance.`);return t},u={beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:n.isReady,ready:n.ready,describe:()=>t?.describe()??{module:"workload",active:!1,ready:!1,incoming:{trustedIdps:[]},outgoing:[],urls:{}},get config(){return t?.config??{}},getToken(...p){return d("getToken").getToken(...p)},refreshToken(p){return d("refreshToken").refreshToken(p)},generateJWTAssertion(p){return d("generateJWTAssertion").generateJWTAssertion(p)},revokeToken(p){return d("revokeToken").revokeToken(p)},validateToken(p){return d("validateToken").validateToken(p)},getWorkloadIdentity(p){return d("getWorkloadIdentity").getWorkloadIdentity(p)},parseJWT(p){return d("parseJWT").parseJWT(p)},handler(p){return d("handler").handler(p)}},l=(p)=>{for(let _ of i)delete u[_];if(i.clear(),!p)return;let b=new Set(ia(p)),M=new Set([...c,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...b]);for(let[_,R]of Object.entries(p)){if(M.has(_))continue;u[_]=R,i.add(_)}},y=(p)=>{let b=s.get(p);if(b)return b;let M=of(p,sa(p),e);if(s.set(p,M),!(p in u))u[p]=M.api;return M};return{update(p){if(!p&&!r&&s.size===0)return;o.emitBefore(),r=p!==void 0,n.refresh(),t=p;let b=new Set(ia(p));for(let M of b){let _=p[M];y(M).update(_)}for(let[M,_]of s){if(b.has(M))continue;_.update(sa(M))}return l(p),o.emitAfter(),u}}}async function Po(e,t,r){if(e===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let n=r[e];if(!n)throw Error(`Unknown workload client: ${e}`);return n.getToken(t)}function Oo(e,t){return`${e}|${t??""}`}function it(e,t,r,n,o,s){let i={jwtAssertionClaims:e?.jwtAssertionClaims??Vl("server"),tokenResponse:e?.tokenResponse??zl("server")},c=async(m,f)=>{let T=m;if(typeof T.validate==="function")return T.validate(f);return m["~standard"].validate(f)};if(!r&&!n)return;if(r&&aa(r)){let m=r.incoming,f=na(m),T=Array.isArray(m)?Ql(m):m,A=Ro(n),N=To(n),Z=T?{...T,...A,jwksUri:T.jwksUri,issuer:T.issuer}:A;if(!Z||!Z.tokenUrl&&!Z.jwksUri)t.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let V=Z&&(Z.tokenUrl||Z.jwksUri)?it(e,t,T??void 0,A,f,s):void 0,oe=Array.from(new Set([...Object.keys(r.outgoing??{}),...Object.keys(N)])).map((fe)=>[fe,{...r.outgoing?.[fe]??{},...N[fe]??{}}]),te={};for(let[fe,Ye]of oe){let Pe=it(e,t,Ye,void 0);if(Pe)te[fe]=Pe}if(!V&&Object.keys(te).length===0)return;let ge={...V?.config??{},config:V?.config??{},describe:()=>Co(V,te),...Jt("workload",()=>V?.isReady()===!0||Object.values(te).some((fe)=>fe.isReady())),getToken:async(fe,Ye)=>Po(fe,Ye,te),getServerToken:async(fe)=>{if(!V)throw Error("No server workload config");return V.getToken(fe)},refreshToken:async(fe)=>{if(!V)throw Error("No default workload config");return V.refreshToken(fe)},generateJWTAssertion:async(fe)=>{if(!V)throw Error("No default workload config");return V.generateJWTAssertion(fe)},revokeToken:async(fe)=>{if(!V)throw Error("No default workload config");return V.revokeToken(fe)},validateToken:async(fe)=>{if(!V)throw Error("No default workload config");return V.validateToken(fe)},getWorkloadIdentity:async(fe)=>{if(!V)return;return V.getWorkloadIdentity(fe)},parseJWT:async(fe)=>{if(!V)throw Error("No default workload config");return V.parseJWT(fe)},handler:async(fe)=>{if(!V)return me();return V.handler(fe)}};return Io(ge,te,oe.map(([fe])=>fe))}if(r&&Zl(r)){let m=Ro(n),f=To(n),T=r.default,A=T?{...T,...m,jwksUri:T.jwksUri,issuer:T.issuer}:m;if(!A||!A.tokenUrl&&!A.jwksUri)t.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let N=A&&(A.tokenUrl||A.jwksUri)?it(e,t,T??void 0,m):void 0,Z=Array.from(new Set([...Object.keys(r).filter((te)=>te!=="default"),...Object.keys(f)])).map((te)=>[te,{...te in r?r[te]:{},...f[te]??{}}]),V={};for(let[te,ge]of Z){let fe=it(e,t,ge,void 0);if(fe)V[te]=fe}if(!N&&Object.keys(V).length===0)return;let oe={...N?.config??{},config:N?.config??{},describe:()=>Co(N,V),...Jt("workload",()=>N?.isReady()===!0||Object.values(V).some((te)=>te.isReady())),getToken:async(te,ge)=>Po(te,ge,V),getServerToken:async(te)=>{if(!N)throw Error("No server workload config");return N.getToken(te)},refreshToken:async(te)=>{if(!N)throw Error("No default workload config");return N.refreshToken(te)},generateJWTAssertion:async(te)=>{if(!N)throw Error("No default workload config");return N.generateJWTAssertion(te)},revokeToken:async(te)=>{if(!N)throw Error("No default workload config");return N.revokeToken(te)},validateToken:async(te)=>{if(!N)throw Error("No default workload config");return N.validateToken(te)},getWorkloadIdentity:async(te)=>{if(!N)return;return N.getWorkloadIdentity(te)},parseJWT:async(te)=>{if(!N)throw Error("No default workload config");return N.parseJWT(te)},handler:async(te)=>{if(!N)return me();return N.handler(te)}};return Io(oe,V,Z.map(([te])=>te))}let d=Ro(n),u=To(n);if(!r&&Object.keys(u).length>0){let m={};for(let[A,N]of Object.entries(u)){let Z=it(e,t,N,void 0);if(Z)m[A]=Z}let f=d&&(d.tokenUrl||d.jwksUri)?it(e,t,d,void 0):void 0;if(!f&&Object.keys(m).length===0)return;let T={...f?.config??{},config:f?.config??{},describe:()=>Co(f,m),...Jt("workload",()=>f?.isReady()===!0||Object.values(m).some((A)=>A.isReady())),getToken:async(A,N)=>Po(A,N,m),getServerToken:async(A)=>{if(!f)throw Error("No server workload config");return f.getToken(A)},refreshToken:async(A)=>{if(!f)throw Error("No default workload config");return f.refreshToken(A)},generateJWTAssertion:async(A)=>{if(!f)throw Error("No default workload config");return f.generateJWTAssertion(A)},revokeToken:async(A)=>{if(!f)throw Error("No default workload config");return f.revokeToken(A)},validateToken:async(A)=>{if(!f)throw Error("No default workload config");return f.validateToken(A)},getWorkloadIdentity:async(A)=>{if(!f)return;return f.getWorkloadIdentity(A)},parseJWT:async(A)=>{if(!f)throw Error("No default workload config");return f.parseJWT(A)},handler:async(A)=>{if(!f)return me();return f.handler(A)}};return Io(T,m,Object.keys(u))}let l=r,y=o??na(l),p=d?.tokenUrl,b=p?.startsWith("/")?p:void 0,M=l?.idpTokenUrl??d?.idpTokenUrl??(l?.tokenUrl&&(l.tokenUrl.startsWith("http://")||l.tokenUrl.startsWith("https://"))?l.tokenUrl:void 0),_={...l,...d,tokenUrl:b??d?.tokenUrl??l?.tokenUrl,idpTokenUrl:M,jwksUri:l?.jwksUri,issuer:l?.issuer};_._handlerTokenUrl=b;let R,W=_,q=Le(_),a=Je(_),w=bo(_);if(!q&&!a&&!w){if(!l||Object.keys(l).length===0)return;throw t.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(_),clientId:W.clientId,clientSecret:W.clientSecret?"[REDACTED]":void 0,workloadId:W.workloadId,privateKey:W.privateKey?"[REDACTED]":void 0,jwksUri:W.jwksUri,tokenUrl:W.tokenUrl,idpTokenUrl:W.idpTokenUrl,fromVaultKeys:l?Object.keys(l):[],fromCodeKeys:n?Object.keys(n):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(q)R={..._,tokenUrl:_.tokenUrl,idpTokenUrl:qe(_.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:qe(_.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:qe(_.privateKey,"Missing 'privateKey' from Workload Config"),audience:qe(_.audience,"Missing 'audience' from Workload Config"),scope:_.scope??"",algorithm:_.algorithm??"RS256",tokenLifetime:_.tokenLifetime??300,refreshThreshold:_.refreshThreshold??60,autoRefresh:_.autoRefresh!==void 0?_.autoRefresh:!0,tokenStore:_.tokenStore??new yt};else if(Je(_)){let m=_.authMethod==="managed_identity",f=m?void 0:_.clientSecret||void 0,T=m||f?void 0:qe(_.federatedTokenFile||process.env.AZURE_FEDERATED_TOKEN_FILE||void 0,"Missing 'clientSecret' from Workload Config (or a federatedTokenFile / AZURE_FEDERATED_TOKEN_FILE, or authMethod 'managed_identity')");R={..._,tokenUrl:_.tokenUrl,idpTokenUrl:m?_.idpTokenUrl??"":qe(_.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:qe(_.clientId,"Missing 'clientId' from Workload Config"),clientSecret:f,federatedTokenFile:T,scope:_.scope??"",tokenLifetime:_.tokenLifetime??300,refreshThreshold:_.refreshThreshold??60,autoRefresh:_.autoRefresh!==void 0?_.autoRefresh:!0,tokenStore:_.tokenStore??new yt}}else if(bo(_))R=_;function v(){let m=new Uint8Array(16);return crypto.getRandomValues(m),Array.from(m,(f)=>f.toString(16).padStart(2,"0")).join("")}function L(m){let f;if(typeof m==="string")f=btoa(m);else f=btoa(String.fromCharCode(...m));return f.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function H(m){let f=m.replace(/-/g,"+").replace(/_/g,"/");while(f.length%4)f+="=";return atob(f)}function J(m){if(m.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:m==="RS256"?"SHA-256":m==="RS384"?"SHA-384":"SHA-512"};else if(m.startsWith("ION"))return{name:"ECDSA",namedCurve:m==="ES256"?"P-256":m==="ES384"?"P-384":"P-521",hash:m==="ES256"?"SHA-256":m==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${m}`)}async function Y(m,f){let T=m.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),A=Uint8Array.from(atob(T),(Z)=>Z.charCodeAt(0)),N=J(f);return crypto.subtle.importKey("pkcs8",A,N,!1,["sign"])}async function re(m,f,T){let A=await Y(f,T),Z=new TextEncoder().encode(m),V=J(T),oe=await crypto.subtle.sign(V,A,Z);return L(new Uint8Array(oe))}async function ue(m,f=3,T=1000,A=30000){let N=Error("Placeholder Error");for(let Z=0;Z<=f;Z++)try{return await m()}catch(V){if(N=V instanceof Error?V:Error(String(V)),N.message.includes("400")||N.message.includes("401")||N.message.includes("403")||N.message.includes("404"))throw N;if(Z<f){let oe=Math.min(T*2**Z,A),te=Math.random()*oe*0.1;await new Promise((ge)=>setTimeout(ge,oe+te))}}throw N}async function se(m){if(!Le(R))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=R,T=Math.floor(Date.now()/1000),A={iss:f.workloadId,sub:f.workloadId,aud:f.audience??"",exp:T+f.tokenLifetime,iat:T,jti:v(),scope:m??f.scope},N={alg:f.algorithm,typ:"JWT",kid:f.keyId},Z=L(JSON.stringify(N)),V=L(JSON.stringify(A)),oe=`${Z}.${V}`,te=await re(oe,f.privateKey,f.algorithm);return`${oe}.${te}`}async function K(m){if(!Le(R))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=R;return ue(async()=>{let T=f.idpTokenUrl,A=await se(m),N=new URLSearchParams;if(N.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),N.append("assertion",A),m)N.append("scope",m);let Z=await fetch(T,{method:"POST",headers:{...ko,...Sr},body:N.toString()}),V=await ta(Z,{log:t,operation:"token.acquire"});if(!Z.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:V});let te=V;throw Error(`Token acquisition failed: ${te.error||Z.statusText} - ${te.error_description||""}`.trim())}let oe=await c(i.tokenResponse,V);if(oe.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:oe.issues}),Error(`Token response validation failed: ${oe.issues.map((te)=>te.message).join("; ")}`);if(f.tokenStore){let te=new Date(Date.now()+(oe.value.expires_in??300)*1000),ge={workload_id:Oo(f.workloadId,m),access_token:oe.value.access_token,token_type:oe.value.token_type,scope:oe.value.scope,expires_at:te,created_at:new Date,refresh_token:oe.value.refresh_token};await f.tokenStore.set(ge)}return oe.value})}async function ee(m){if(!Je(R))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let f=R;return ue(async()=>{let T=f.authMethod==="managed_identity",A;if(T)A=await Yl(f.clientId,m);else{let oe=new URLSearchParams;if(oe.append("grant_type","client_credentials"),oe.append("client_id",f.clientId),f.clientSecret)oe.append("client_secret",f.clientSecret);else{let te=qe(f.federatedTokenFile,"Missing 'federatedTokenFile' from Workload Config"),ge=(await Kl(te,"utf8")).trim();if(!ge)throw Error(`Federated token file was empty: ${te}`);oe.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),oe.append("client_assertion",ge)}if(m)oe.append("scope",m);A=await fetch(f.idpTokenUrl,{method:"POST",headers:{...ko,...Sr},body:oe.toString()})}let N=await ta(A,{log:t,operation:"token.acquire"}),Z=T&&A.ok?Xl(N):N;if(!A.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:Z});let oe=Z;throw Error(`Token acquisition failed: ${oe.error||A.statusText} - ${oe.error_description||""}`.trim())}let V=await c(i.tokenResponse,Z);if(V.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:V.issues}),Error(`Token response validation failed: ${V.issues.map((oe)=>oe.message).join("; ")}`);if(f.tokenStore){let oe=new Date(Date.now()+(V.value.expires_in??300)*1000),te={workload_id:Oo(f.clientId,m),access_token:V.value.access_token,token_type:V.value.token_type,scope:V.value.scope,expires_at:oe,created_at:new Date,refresh_token:V.value.refresh_token};await f.tokenStore.set(te)}return V.value})}let z=new Map;function D(m,f){let T=z.get(m);if(T)return T;let A=(async()=>(Le(R)?await K(f??""):await ee(f??"")).access_token)();return z.set(m,A),A.catch(()=>{return}).finally(()=>{if(z.get(m)===A)z.delete(m)}),A}async function Q(m){if(!Le(R)&&!Je(R)){let N=R;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!N.clientId}, hasClientSecret=${!!N.clientSecret}, hasWorkloadId=${!!N.workloadId}, hasPrivateKey=${!!N.privateKey}, hasJwksUri=${!!N.jwksUri}`)}let f=R;m=m??f.scope;let T=Le(R)?R.workloadId:R.clientId,A=Oo(T,m);if(f.tokenStore){let N=await f.tokenStore.get(A);if(N){let Z=Date.now(),V=N.expires_at.getTime(),oe=f.refreshThreshold*1000;if(Z+oe<V)return N.access_token;if(f.autoRefresh)try{return await D(A,m)}catch(te){if(Z<V)return t.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},te),N.access_token;throw te}}}return D(A,m)}async function ne(m){if(!Le(R)&&!Je(R))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=R;return m=m??f.scope,Le(f)?await K(m):await ee(m)}async function ie(m){if(!Le(R)&&!Je(R))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");try{if(!R.revocationEndpoint)return;let f=new URLSearchParams;if(f.append("token",m),f.append("token_type_hint","access_token"),Le(R)){let A=R;f.append("client_id",A.workloadId)}else if(Je(R)){let A=R;if(f.append("client_id",A.clientId),A.clientSecret)f.append("client_secret",A.clientSecret)}let T=await fetch(R.revocationEndpoint,{method:"POST",headers:{...Sr,...ko},body:f.toString()});if(!T.ok)t.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:T.status,statusText:T.statusText});else t.info("Token revoked successfully",{"ion.module":"workload"});if(R.tokenStore){let A;if(Le(R))A=R.workloadId;else if(Je(R))A=R.clientId;else return;await R.tokenStore.delete(A)}}catch(f){t.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},f)}}async function ce(m,f){let T=m??R?.jwksUri;if(!T)throw Error("No JWKS URI configured in Workload Config");return await Hl(T,t,f)}async function ae(m,f){let T=f??R?.jwksUri;if(!T)throw Error("No JWKS URI configured in Workload Config");let A=Le(R)?R.algorithm:"RS256";return Gl(T,m,`wl:${A}`,(N)=>{let Z=N.alg||A,V=J(Z);return crypto.subtle.importKey("jwk",N,V,!1,["verify"])},t)}function C(m){let f=m.split(".");if(f.length!==3)throw Error("Invalid JWT");return JSON.parse(H(f[1]))}async function g(m,f){try{let T=m.split(".");if(T.length!==3)throw Error("Invalid JWT");let A=JSON.parse(H(T[0])),N=JSON.parse(H(T[1])),Z=await ae(A.kid,f),V=T[2],te=new TextEncoder().encode(`${T[0]}.${T[1]}`),ge=Uint8Array.from(H(V),(gt)=>gt.charCodeAt(0)),fe=J(A.alg);if(!await crypto.subtle.verify(fe,Z,ge,te))throw Error("Invalid JWT signature");let Pe=await c(i.jwtAssertionClaims,N);if(Pe.issues)throw t.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:Pe.issues}),Error(`JWT claims validation failed: ${Pe.issues.map((gt)=>gt.message).join("; ")}`);return Pe.value}catch(T){throw t.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},T),T}}async function P(m){if(!Le(R)&&!Je(R)&&!bo(R))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(y.length>0){let A=C(m),N=typeof A.iss==="string"?A.iss:void 0,Z=oa(y,N);if(!Z)return{valid:!1,error:"Untrusted token issuer"};let V=await g(m,Z.jwksUri),oe=Math.floor(Date.now()/1000);if(V.exp&&V.exp<oe)return{valid:!1,error:"Token expired"};let te=Eo(Z.audience);if(te.length>0&&!fn(V.aud,te,V.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:V,expiresAt:V.exp?new Date(V.exp*1000):void 0}}let f=await g(m),T=Math.floor(Date.now()/1000);if(f.exp&&f.exp<T)return{valid:!1,error:"Token expired"};if(Le(R)){if(R.audience&&!fn(f.aud,[R.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else if(Je(R)){if(R.issuer&&Ht(f.iss)!==Ht(R.issuer))return{valid:!1,error:"Invalid issuer"};if(R.audience&&!fn(f.aud,[R.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else{let A=R;if(A.issuer&&Ht(f.iss)!==Ht(A.issuer))return{valid:!1,error:"Invalid issuer"};if(A.audience&&!fn(f.aud,[A.audience],f.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:f,expiresAt:f.exp?new Date(f.exp*1000):void 0}}catch(f){return{valid:!1,error:f instanceof Error?f.message:String(f)}}}function I(m,f){let T=m[f];return typeof T==="string"&&T.trim()?T.trim():void 0}function U(m){if(!m)return;return m.startsWith("service-account-")?m.slice(16):m}function E(m){return I(m,"client_id")??I(m,"clientId")??I(m,"azp")??I(m,"appid")??U(I(m,"preferred_username"))}let F=new WeakMap;function S(m){let f=F.get(m);if(f)return f;let T=O(m);return F.set(m,T),T}async function O(m){let f=m.headers.get("Authorization");if(!f?.startsWith("Bearer "))return;let T=f.substring(7),A=await P(T);if(!A.valid||!A.claims)return;let N=y.length>0?oa(y,A.claims.iss):void 0,Z=A.claims.ecid,V=E(A.claims)??A.claims.sub??"",oe=N?.claimsAsEntitlements??(y.length===0?l?.claimsAsEntitlements:void 0),te=oe?.claims?.length?await Bl({block:oe,claims:A.claims,scope:A.claims.scope,subjectType:"workload",subjectId:V||"workload",catalog:s?.(),log:t}):void 0,ge={workloadId:A.claims.sub,clientId:E(A.claims),scope:A.claims.scope,...te?{derivedEntitlements:te}:{},...Z!==void 0&&Z!==null?{ecid:ea(Z)}:{},claims:A.claims},fe=R?.workloadIdentityStore;if(fe){let Ye=ge.clientId??ge.workloadId??ge.claims.sub,Pe=Ye?await fe.get(Ye):void 0;if(Pe){if(Pe.active===!1)return;if(Pe.scopes?.length){let gt=new Set([...(ge.scope??"").split(/\s+/).filter(Boolean),...Pe.scopes]);ge.scope=Array.from(gt).join(" ")}if(!ge.ecid&&Pe.ecid)ge.ecid=ea(Pe.ecid)}}return ge}async function k(m){if(!R)throw Error("ionite Workload Manager not initialized");let f=new URL(m.url).pathname,T=(Z)=>{if(!Z)return;try{return new URL(Z).pathname}catch{return Z.startsWith("/")?Z:`/${Z}`}};if(T(R.validateUrl)===f&&m.method==="POST"){let Z=m.headers.get("Authorization");if(!Z?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type",ln]]});let V=Z.substring(7),oe=await P(V);if(!oe.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type",ln]]});return new Response(JSON.stringify({valid:!0,expiresAt:oe.expiresAt}),{status:200,headers:[["Content-Type",ln]]})}if(T(R.jwksUrl)===f&&m.method==="GET"){let Z=await ce();return new Response(JSON.stringify(Z),{headers:[["Content-Type",ln]]})}return me()}if(!R)throw Error("Workload configuration was not resolved.");return{...R,config:R,...Jt("workload",()=>!0),describe:()=>({module:"workload",active:!0,ready:!0,incoming:{trustedIdps:y.map((m)=>({issuer:m.issuer,jwksUri:m.jwksUri,audience:m.audience,...m.claimsAsEntitlements?.claims?.length?{claimsAsEntitlements:{claims:m.claimsAsEntitlements.claims,expand:m.claimsAsEntitlements.expand===!0,resources:m.claimsAsEntitlements.resources===!0,capable:!0}}:{}}))},outgoing:[pn("default",R,!0)],urls:{validateUrl:R.validateUrl??"",jwksUrl:R.jwksUrl??""}}),getToken:Q,refreshToken:ne,generateJWTAssertion:se,revokeToken:ie,validateToken:P,getWorkloadIdentity:S,parseJWT:g,handler:k}}function _o(e){return e=e??"Workload authentication unavailable",new Response(JSON.stringify({error:e}),{status:503,statusText:e,headers:Fl})}var mn="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",sf="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function af(e,t){qe(t,mn);let r=t.workload;if(!r)return;return r.getWorkloadIdentity(e)}async function cf(e,t,r){qe(t,mn);let n=t.workload;if(!n)throw _o();let o=n;if(typeof o.getServerToken!=="function"||typeof o.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return o.getToken(e,r)}async function uf(e,t){qe(t,sf);let r="validateToken"in t&&typeof t.validateToken==="function"?t:t.workload;if(!r)return{valid:!1,error:"Workload authentication unavailable"};let n=e.headers.get("Authorization");if(!n?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let o=n.substring(7);return r.validateToken(o)}async function df(e,t){qe(t,mn);let r=t.workload;if(!r)throw _o();return r.revokeToken(e)}async function lf(e,t){qe(t,mn);let r=t.workload;if(!r)throw _o();return r.handler(e)}export*from"@ionite/core";import{AssignmentPolicyError as qw,generateULID as Ww,IoniteError as jw,listGenerator as Nw}from"@ionite/core";import{allowHosts as Dw,allowOrigins as Kw,allowRelativePaths as Fw,allowSameOrigin as Vw,blockDangerousUrls as zw,CatalogAdjacencyCache as Bw,callback as Gw,captureRedirect as Hw,ciam as Jw,collectReferencedDefinitions as Yw,defaultRedirectPolicies as Xw,discoverSessionRecords as Zw,discoverSessions as Qw,expandRoot as eS,getCustomer as tS,getOwnedTenantIds as rS,getUser as nS,has as oS,hasAll as sS,hasAllScope as iS,hasAny as aS,hasAnyScope as cS,hasGroup as uS,hasPermission as dS,hasRole as lS,hasScope as fS,InMemoryTenantStore as pS,iam as mS,initiateLogin as gS,isRedirectAllowed as yS,listSsoClientIdsFromCookies as hS,planDiscoveredTenantCookies as wS,reconcileSubjectAccess as SS,resolveAfterRedirect as vS,resolveCapturedRedirect as kS,resolveRedirect as bS,resolveTenantOwner as RS,resolveTenantSession as TS,sameOriginRedirectRules as CS,sendTenantWebhook as IS,sso as PS,TENANT_OWNER_PERMISSION as OS,tenantAccessLoginUrl as ES,tenantOwnerEntitlementId as AS,tenantOwnerPermission as _S,tenantResourceId as LS,verifyUser as xS,withSetCookies as US}from"@ionite/core/server";function Lo(e){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function ff(e,t){return{...e,subscribe:async(r,n,o)=>{try{return await e.subscribe(r,n,o)}catch(s){if(!(s instanceof je))throw s;return await st(e,r,n,t,void 0,o)}}}}function gn(e){let t=bt(e.path,"path","azureConfig");Ct(e.ttl);let r=e.vault??sn({type:"azure",authMethod:e.authMethod,entraTenantId:e.entraTenantId,clientId:e.clientId,clientSecret:e.clientSecret,federatedTokenFile:e.federatedTokenFile,managedIdentityClientId:e.managedIdentityClientId,imdsApiVersion:e.imdsApiVersion,vaultUrl:e.vaultUrl,vaultName:e.vaultName,apiVersion:e.apiVersion,secretNameTransform:e.secretNameTransform,secretNamePrefix:e.secretNamePrefix,scope:e.scope,ttl:e.ttl}),n=e.ttl?ff(r,e.ttl):r;return{get origin(){return{type:"azure",...n.origin,path:t}},load:async()=>{try{return(await n.getFullSecret(t)).data}catch(o){let s=o instanceof Error?o.message:String(o);throw Error(`Error retrieving remote config from Azure Key Vault: ${s}`,{cause:o})}},subscribe:(o,s)=>n.subscribe(t,(i)=>{o(i.data)},s),secret:n}}import{IoniteError as _f}from"@ionite/core";function xo(e){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as hf,remoteConfigSecretType as wf}from"@ionite/core";import{defaultLogger as pf,defaultSecretContentType as mf,stableConfigHash as fa}from"@ionite/core";var gf=1e4;function yf(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Uo(e){if(e.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let t=Array.from(new Set(e.paths.map((R)=>R.trim()).filter(Boolean)));if(t.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let r=e.logger??pf,n=[],o=Promise.resolve(),s=!1,i=!1,c=!1,d=ye("Secrets mirror",()=>s&&!c),u=(R)=>{let W=e.mapPath(R).trim();if(!W)throw Error(`mirrorSecrets mapPath returned an empty target for "${R}"`);return W},l=(R)=>{let W=o.then(R);return o=W.catch((q)=>{i=!0,r.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:q instanceof Error?q.message:String(q)})}),W},y=async(R)=>{if(await e.to.exists(R))await e.to.deleteSecret(R)},p=async(R,W)=>{if(c)return;if(!yf(W.data))throw Error(`mirrorSecrets can only re-store object values (source path "${R}")`);if(e.accept&&!e.accept(W,R))return;let q=u(R);if(await e.to.exists(q)){let a=await e.to.getSecret(q);if(fa(a)===fa(W.data)){i=!1;return}}await e.to.putSecret(q,W.data,{contentType:W.metadata.contentType??mf()}),i=!1},b=async(R)=>{await y(u(R)),i=!1},M=(R)=>{if(R.event!=="path_removed")return t.includes(R.path)?[R.path]:[];let W=`${R.path.replace(/\/+$/g,"")}/`;return t.filter((q)=>q===R.path||q.startsWith(W))},_=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if(e.from.subscribeEvents)n.push(e.from.subscribeEvents((R)=>{if(_.has(R.event)){let W=M(R);if(W.length>0)l(async()=>{for(let q of W)await b(q)})}try{e.onEvent?.(R)}catch(W){r.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:R.path,event:R.event,error:W instanceof Error?W.message:String(W)})}}));return(async()=>{let R=new Set(t);for(;;){try{for(let W of[...R]){let q=await e.from.subscribe(W,(a)=>{l(()=>p(W,a))},e.subscription);if(c){q();return}n.push(q),R.delete(W)}if(await o,c)return;s=!0,d.refresh();return}catch(W){if(c)return;i=!0,r.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:W instanceof Error?W.message:String(W)})}if(await new Promise((W)=>{setTimeout(W,gf).unref?.()}),c)return}})(),{isReady:d.isReady,ready:d.ready,isAvailable:()=>s&&!c&&!i&&(e.from.isAvailable?.()??!0)&&(e.to.isAvailable?.()??!0),async purge(){if(c)throw Error("Secrets mirror is closed");await l(async()=>{for(let R of t)await b(R)})},async close(){if(c)return;c=!0;for(let R of n.splice(0))R();d.refresh(),d.settle(),await o}}}function Yt(e){return typeof e.getFullSecret==="function"}function Mo(e){let t=e;return typeof t.handleDelivery==="function"&&typeof t.handleEvents==="function"&&typeof t.isDeliveryRequest==="function"&&typeof t.isEventsRequest==="function"}function pa(e){return e.type==="vault"&&[e.vaultLfvServerUrl,e.vaultLfvClientId,e.vaultLfvDeliveryEndpoint,e.vaultLfvVerifyJwks,e.vaultLfvEventsEndpoint].some((t)=>t!==void 0)}function xe(e,t){if(!e?.trim())throw Error(`Mirrored LFV config requires ${t}`);return e}function Sf(e,t){if(t?.trim())return t;if(Yt(e))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if(e.type==="vault")return xe(e.vaultLfvPath??e.vaultPath,"an upstream vault path");if(e.type==="azure")return xe(e.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${e.type}" requires an explicit fromPath`)}function vf(e,t){let r=xe(e.vaultLfvPath??e.vaultPath,"vaultLfvPath or vaultPath");return kt({lfvServerUrl:xe(e.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:xe(e.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:xe(e.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:xe(e.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:xe(e.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:r,deliveryTimeout:e.vaultLfvDeliveryTimeout,retryInterval:e.vaultLfvRetryInterval,warnInterval:e.vaultLfvWarnInterval,log:t},void 0,{selfRedeemReads:!0})}var kf=new Set(["vault","azure","aws","gcp"]);function bf(e,t,r){if(!kf.has(e.type))return;return{type:e.type,...t.origin,path:r}}function Rf(e){return e.metadata.contentType?.typeId===wf.id&&typeof e.data.id==="string"&&e.data.id.trim().length>0}function Tf(e,t,r,n){return{...e,close:r,subscribePassive:(o,s)=>t.subscribePassive(o,s),isDeliveryRequest:(o)=>t.isDeliveryRequest(o),isEventsRequest:(o)=>t.isEventsRequest(o),handleDelivery:(o)=>(n(),t.handleDelivery(o)),handleEvents:(o)=>(n(),t.handleEvents(o)),deliveryPath:t.deliveryPath,eventsPath:t.eventsPath,callbackKey:t.callbackKey,trustId:t.trustId}}function vr(e){let t=e.logger??hf,r=Sf(e.from,e.fromPath),n=!Yt(e.from),o=!Yt(e.to),s=Yt(e.from)?e.from:pa(e.from)?vf(e.from,t):at(e.from).secret,i=Yt(e.to)?e.to:at(e.to).secret,c=xe(e.path,"path"),d=qo(i,c,{ttl:e.ttl}),u,l=!1,y=!1,p,b=()=>{if(p)return;p=s.getFullSecret(r).then(()=>{return}).catch((a)=>{p=void 0,t.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:a instanceof Error?a.message:String(a)})})},M=(a)=>{if(l)throw Error("Mirrored ConfigSource is closed");if(!u){y=a;let w=!a&&Mo(s)?{...s,subscribe:(v,L)=>s.subscribePassive(v,L)}:s;u=Uo({from:w,to:i,paths:[r],mapPath:()=>c,accept:Rf,logger:t})}else if(a&&!y)b();return u},_={isReady:()=>u?.isReady()??!1,ready:(a)=>M(!0).ready(a),isAvailable:()=>u?.isAvailable()??!1,purge:()=>M(!1).purge(),close:async()=>{await u?.close()}},R=async()=>{if(l)return;if(l=!0,await u?.close(),n)await s.close?.();if(o)await i.close?.()},W=Mo(s)?Tf(i,s,R,()=>{M(!1)}):{...i,close:R},q={get origin(){let a=d.origin;if(!a)return;return{...a,type:"mirror",from:bf(e.from,s,r)}},load:async()=>{try{let a=await d.load();return M(!1),a}catch(a){throw M(!0),a}},subscribe:(a,w)=>(M(!1),d.subscribe(a,w)),secret:W,mirror:_,async handleCallback(a,w){if(!Mo(s))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return M(!1),a==="delivery"?s.handleDelivery(w):s.handleEvents(w)}};if(Object.defineProperties(q,{log:{get:()=>d.log,set:(a)=>{d.log=a},enumerable:!0},validators:{get:()=>d.validators,set:(a)=>{d.validators=a},enumerable:!0}}),!Yt(e.from)&&pa(e.from)){let a=e.from;q[Kt]={path:r,lfvServerUrl:xe(a.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:xe(a.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:xe(a.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:xe(a.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:xe(a.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:a.vaultLfvDeliveryTimeout,retryInterval:a.vaultLfvRetryInterval,warnInterval:a.vaultLfvWarnInterval}}return q}import{IoniteError as ya}from"@ionite/core";class Ot extends ya{constructor(e,t=`Waiting for vault config secret at ${e}`){super(t,{status:503,upstreamStatus:404});this.code="not_found";this.sourceType="vault";this.path=e}}function Cf(e){return e instanceof Ot}class kr extends ya{constructor(e,t){super(t,{status:500});this.code="invalid_payload";this.sourceType="vault";this.path=e}}function If(e){return e instanceof kr}var ha=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function ma(e){return ha.some((t)=>(t in e))}function ga(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw new Ot(t,`Vault config secret at ${t} is missing or not an object`);let r=e;if(!ma(r)&&Object.keys(r).length===1&&"data"in r){let n=r.data;if(n&&typeof n==="object"&&!Array.isArray(n))r=n}if(Object.keys(r).length===0)throw new Ot(t,`Vault config secret at ${t} is empty`);if(!ma(r))throw new kr(t,`Vault config secret at ${t} is an invalid payload: not a RemoteConfig (no known keys: ${ha.join("/")})`);return r}function Pf(e,t,r){return{...e,subscribe:async(n,o,s)=>{try{return await e.subscribe(n,o,s)}catch(i){if(!(i instanceof je))throw i;return await st(e,n,o,t,r(),s)}}}}function yn(e){let t=bt(e.path,"path","vaultConfig");Ct(e.ttl);let r=e.vault??Bt({type:"vault",url:e.url,token:e.token,workload:e.workload,lfv:e.lfv,websocket:e.websocket,ttl:e.ttl,log:e.log}),n=e.vault&&e.ttl?Pf(r,e.ttl,()=>e.log):r,o={get origin(){return{type:"vault",...n.origin,path:t}},get log(){return e.log},set log(s){if(e.log=s,n&&"log"in n)n.log=s},load:async()=>{try{let s=await n.getFullSecret(t);return ga(s.data,t)}catch(s){if(s instanceof ot)throw new Ot(t);if(s instanceof Ot||s instanceof kr)throw s;throw Error("Error retrieving remote config from vault",{cause:s})}},subscribe:(s,i)=>n.subscribe(t,(c)=>{let d;try{d=ga(c.data,t)}catch(u){e.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:t,error:u instanceof Error?u.message:String(u)});return}s(d)},i),secret:n};if(e.lfv?.lfvServerUrl&&e.lfv.clientId&&e.lfv.deliveryEndpoint&&e.lfv.eventsEndpoint)o[Kt]={path:e.lfv.path??t,lfvServerUrl:e.lfv.lfvServerUrl,clientId:e.lfv.clientId,deliveryTimeout:e.lfv.deliveryTimeout,retryInterval:e.lfv.retryInterval,warnInterval:e.lfv.warnInterval,deliveryEndpoint:e.lfv.deliveryEndpoint,eventsEndpoint:e.lfv.eventsEndpoint,verifyJwks:e.lfv.verifyJwks};return o}function hn(e){if(e==null)return;if(typeof e==="number")return Number.isFinite(e)?e:void 0;let t=e.trim();if(!t)return;let r=Number.parseInt(t,10);return Number.isFinite(r)?r:void 0}function Of(e,t){let r=e.vaultLfvServerUrl??t?.lfvServerUrl,n=e.vaultLfvClientId??t?.clientId,o=e.vaultLfvDeliveryEndpoint??t?.deliveryEndpoint,s=e.vaultLfvEventsEndpoint??t?.eventsEndpoint;if(!r||!n||!o||!s)return t;return{...t,lfvServerUrl:r,clientId:n,deliveryEndpoint:o,verifyJwks:e.vaultLfvVerifyJwks??t?.verifyJwks,eventsEndpoint:s,path:e.vaultLfvPath??t?.path,deliveryTimeout:hn(e.vaultLfvDeliveryTimeout)??t?.deliveryTimeout,retryInterval:hn(e.vaultLfvRetryInterval)??t?.retryInterval,warnInterval:hn(e.vaultLfvWarnInterval)??t?.warnInterval}}function Ef(e,t){let r=e.vaultWebsocketUrl??t?.url;if(!r)return t;return{...t,url:r,token:e.vaultWebsocketToken??t?.token,clientId:e.vaultWebsocketClientId??t?.clientId,header:e.vaultWebsocketHeader??t?.header}}function Af(e,t){let r=e.vaultWorkloadTokenUrl??t?.idpTokenUrl,n=e.vaultWorkloadClientId??t?.clientId,o=e.vaultWorkloadClientSecret??t?.clientSecret;if(!r||!n||!o)return t;return{...t,idpTokenUrl:r,clientId:n,clientSecret:o,scope:e.vaultWorkloadScope??t?.scope}}function wa(e,t){return{...t,url:e.vaultUrl??t?.url,token:e.vaultToken??t?.token,path:e.vaultPath??t?.path,ttl:hn(e.vaultTtl)??t?.ttl,workload:Af(e,t?.workload),lfv:Of(e,t?.lfv),websocket:Ef(e,t?.websocket)}}function at(e){switch(e.type){case"vault":return xf(e);case"azure":return Uf(e);case"aws":return Mf(e);case"gcp":return qf(e);case"mirror":return Lf(e);default:throw Error(`Unsupported config locator type: ${e.type}`)}}function Lf(e){if(e.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!e.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return vr({from:e.from,to:e.to,path:e.to.vaultPath,ttl:e.to.vaultTtl})}function xf(e){return yn(wa(e))}function Uf(e){return gn({authMethod:e.azureAuthMethod,entraTenantId:e.azureEntraTenantId,clientId:e.azureClientId,clientSecret:e.azureClientSecret,federatedTokenFile:e.azureFederatedTokenFile,managedIdentityClientId:e.azureManagedIdentityClientId,imdsApiVersion:e.azureImdsApiVersion,vaultUrl:e.azureVaultUrl,vaultName:e.azureVaultName,apiVersion:e.azureApiVersion,scope:e.azureScope,secretNamePrefix:e.azureSecretNamePrefix,path:e.azurePath,ttl:e.azureTtl})}function Mf(e){return Lo({webhookUrl:e.awsWebhookUrl,ttl:e.awsTtl})}function qf(e){return xo({ttl:e.gcpTtl})}function qo(e,t,r={}){switch(e.type){case"vault":return yn({vault:e,path:t,ttl:r.ttl});case"azure":return gn({vault:e,path:t,ttl:r.ttl});default:throw new _f(`configFromSource is not supported for secrets source type "${e.type}" (path "${t}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function Et(e){if(!e)return;let t=Number.parseInt(e,10);return Number.isFinite(t)?t:void 0}function wn(e,t){let r=t?.type??e.ION_CONFIG_TYPE;if(!r)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(r==="vault")return{type:"vault",vaultUrl:e.ION_VAULT_URL,vaultToken:e.ION_VAULT_TOKEN,vaultPath:e.ION_VAULT_PATH??"",vaultTtl:Et(e.ION_VAULT_TTL),vaultWorkloadTokenUrl:e.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:e.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:e.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:e.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:e.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:e.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:e.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:e.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:e.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:e.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:Et(e.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:Et(e.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:Et(e.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:e.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:e.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:e.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:e.ION_VAULT_WEBSOCKET_HEADER};if(r==="azure")return{type:"azure",azurePath:e.ION_AZURE_PATH,azureApiVersion:e.ION_AZURE_API_VERSION,azureScope:e.ION_AZURE_SCOPE,azureSecretNamePrefix:e.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:e.ION_AZURE_AUTH_METHOD,azureEntraTenantId:e.ION_AZURE_TENANT_ID,azureClientId:e.ION_AZURE_CLIENT_ID,azureClientSecret:e.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:e.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:e.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:e.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:e.ION_AZURE_VAULT_URL,azureVaultName:e.ION_AZURE_VAULT_NAME,azureTtl:Et(e.ION_AZURE_TTL)};if(r==="aws")return{type:"aws",awsWebhookUrl:e.ION_AWS_WEBHOOK_URL??"",awsTtl:Et(e.ION_AWS_TTL)};if(r==="gcp")return{type:"gcp",gcpTtl:Et(e.ION_GCP_TTL)};if(r==="mirror"){let n={};for(let[c,d]of Object.entries(e))if(c.startsWith("ION_FROM_"))n[`ION_${c.slice(9)}`]=d;if(n.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let o=wn(n),s=wn(e,{type:"vault"});if(!s.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let i={type:"vault",vaultUrl:s.vaultUrl,vaultToken:s.vaultToken,vaultPath:s.vaultPath,vaultTtl:s.vaultTtl,vaultWorkloadTokenUrl:s.vaultWorkloadTokenUrl,vaultWorkloadClientId:s.vaultWorkloadClientId,vaultWorkloadClientSecret:s.vaultWorkloadClientSecret,vaultWorkloadScope:s.vaultWorkloadScope,vaultWebsocketUrl:s.vaultWebsocketUrl,vaultWebsocketToken:s.vaultWebsocketToken,vaultWebsocketClientId:s.vaultWebsocketClientId,vaultWebsocketHeader:s.vaultWebsocketHeader};return{type:"mirror",from:o,to:i}}throw Error(`ION_CONFIG_TYPE="${r}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function Sa(e,t){return at(wn(e,t))}function Wf(e){return Sa(process.env,e)}var jf=1000,Nf=30000,va=["vault","azure","aws","gcp"];function ka(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Config locator at ${t} is an invalid payload: expected an object with a "type" field`);let r=e.type;if(typeof r!=="string"||!va.includes(r))throw Error(`Config locator at ${t} is an invalid payload: unknown type "${String(r)}" (expected ${va.join("/")})`)}function ba(e,t){return e.log??=t.log,e.validators??=t.validators,e}function br(e){if(!e?.secret?.close)return;try{Promise.resolve(e.secret.close()).catch((t)=>{e.log?.warn?.("secretConfigSource: inner source close failed",t)})}catch(t){e.log?.warn?.("secretConfigSource: inner source close failed",t)}}function $f(e,t){let r=bt(t,"path","secretConfigSource"),n,o=(i)=>{ka(i,r);let c=JSON.stringify(i);if(n&&n.hash===c)return n.inner;let d=n?.inner,u=ba(at(i),s);if(n={hash:c,inner:u},d&&d!==u)br(d);return u},s={get origin(){return n?.inner.origin},async load(){let i=await e.getSecret(r);return o(i).load()},async subscribe(i,c){let d,u=!1,l=!1,y,p,b=new Promise((v,L)=>{y=v,p=L}),M=Xr(),_,R,W=(v)=>new Promise((L)=>{R=L,_=setTimeout(L,v)}),q=async(v,L)=>{ka(v,r);let H=JSON.stringify(v),J=n!==void 0&&n.hash===H;if(J&&d)return;let Y=n?.inner,re=d,ue=J&&n?n.inner:ba(at(v),s),se=!J,K=()=>{if(se&&ue!==Y)br(ue)};try{if(ue.subscribe){let z=await ue.subscribe(i,c)??void 0;if(u||!M.isCurrent(L)){z?.(),K();return}if(d=z,n={hash:H,inner:ue},re&&re!==z)re();if(se&&Y&&Y!==ue)br(Y);return}let ee=await ue.load();if(u||!M.isCurrent(L)){K();return}if(n={hash:H,inner:ue},re)re(),d=void 0;if(se&&Y&&Y!==ue)br(Y);i(ee)}catch(ee){throw K(),ee}},a=async(v)=>{let L=M.next(),H=jf;for(;;){if(u||!M.isCurrent(L))return;try{await q(v,L);return}catch(J){if(u||!M.isCurrent(L))return;s.log?.warn(`secretConfigSource rebind for ${r} failed; keeping last-known-good source and retrying in ${H}ms`,J),await W(H),H=Math.min(Nf,H*2)}}},w=await e.subscribe(r,(v)=>{if(u)return;if(!l){q(v.data,M.next()).then(()=>{l=!0,y()}).catch((L)=>{l=!0,p(L)});return}a(v.data)},c);return await b,()=>{if(u=!0,M.next(),_)clearTimeout(_);R?.(),d?.(),w(),br(n?.inner),n=void 0}},secret:e};return s}import{compareDisplayExpiryDesc as Ra,projectDisplayUser as Ta,readDisplayCookies as Df}from"@ionite/core";import{discoverSessions as Kf,getCustomer as Ff,getOwnedTenantIds as Vf}from"@ionite/core/server";function Sn(e,t){let r=e?.[t];return typeof r==="string"?r:""}function zf(e){if(!e)return;let t=e instanceof Date?e:new Date(e);return Number.isNaN(t.getTime())?void 0:t.toISOString()}function Bf(e,t){let r=e.tenantId?.trim();if(!r)return;let n={name:Sn(e.claims,"name")||Sn(e.claims,"preferred_username"),email:Sn(e.claims,"email"),avatar:Sn(e.claims,"picture")},o=zf(e.expiresAt);return{tenantId:r,authType:e.authType,source:"session",user:Ta(n,t),...o?{expiresAt:o}:{}}}function Gf(e){let t=new Map;for(let r of e){let n=typeof r.user.email==="string"?r.user.email:void 0,o=typeof r.user.name==="string"?r.user.name:void 0,s=n||o||r.tenantId,i=t.get(s);if(i){i.tenants.push(r);continue}t.set(s,{...n?{email:n}:{},...o?{name:o}:{},tenants:[r]})}return[...t.values()]}async function Hf(e,t){let n=(await Kf(e,t.sessionStore,{...t.cookiesPrefix!==void 0?{cookiesPrefix:t.cookiesPrefix}:{}})).map((y)=>Bf(y,t.displayUser)).filter((y)=>Boolean(y)).sort((y,p)=>Ra(y.expiresAt,p.expiresAt)),o=typeof t.max==="number"&&t.max>=1?Math.floor(t.max):10,s=n.slice(0,o),i=new Set(s.map((y)=>y.tenantId));if(t.ion){let y=await Ff(e,t.ion);if(y?.id){let p=await Vf(t.ion,y.id),b=Ta({name:y.name,email:y.email,avatar:y.avatar},t.displayUser);for(let M of p){if(i.has(M))continue;i.add(M),s.push({tenantId:M,authType:"ciam",source:"owner",user:b})}}}let c=Date.now(),d=typeof t.maxDiscovered==="number"&&t.maxDiscovered>=1?Math.floor(t.maxDiscovered):10,u=Df(e.headers.get("cookie")).filter((y)=>y.envelope.kind==="discovered"&&Boolean(y.envelope.tenantId)&&Date.parse(y.envelope.expiresAt)>c).sort((y,p)=>Ra(y.envelope.expiresAt,p.envelope.expiresAt)),l=0;for(let y of u){let p=y.envelope.tenantId;if(!p||i.has(p))continue;if(l>=d)break;l+=1,i.add(p),s.push({tenantId:p,authType:y.envelope.authType,source:"discovered",user:y.envelope.user,expiresAt:y.envelope.expiresAt,...y.envelope.tenantName?{tenantName:y.envelope.tenantName}:{}})}if(t.tenantLabel)for(let y of s){let p=await t.tenantLabel(y.tenantId);if(p)y.tenantName=p}return{tenants:s,groups:Gf(s)}}import{listGenerator as Jf}from"@ionite/core";import{TENANT_OWNER_PERMISSION as Yf,tenantOwnerEntitlementId as Ca,tenantResourceId as Xf}from"@ionite/core/server";async function Zf(e,t){let r=e.authz.catalogStore;if(!r)throw Error("Cannot materialize tenant owner entitlement: no AccessCatalogStore is wired.");let n=t.displayName?.trim()||t.tenantId,o={id:Ca(t.tenantId),name:`Owner of ${n}`,description:`Administer the ${n} tenant`,source:"app",requestable:!0,riskLevel:"privileged",permissions:[Yf],resources:[Xf(t.tenantId)],assignableSubjectTypes:["customer"],recommendedSubjectTypes:["customer"]},s=r.groups.insertIfAbsent(o);return await s.ready(),s}async function Qf(e,t){let r=e.authz.catalogStore,n=e.authz.accessStore;if(!r)throw Error("Cannot clean up tenant entitlements: no AccessCatalogStore is wired.");if(!n)throw Error("Cannot clean up tenant entitlements: no AccessAssignmentStore is wired.");let o=Ca(t.tenantId),s=[];for await(let c of Jf((d,u)=>n.listByTarget("group",o,{start:d,limit:u})))s.push(c);for(let c of s)await e.authz.revoke(c);let i=await r.groups.get(o);if(i)await r.groups.delete(o);return{revoked:s.length,deleted:i?1:0}}function Wo(e){if(Array.isArray(e))return e.map(Wo);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,Wo(r)]));return e}function Ia(e){return JSON.stringify(Wo(e))}function ep(e){if(e.type==="vault")return e.vaultLfvPath??e.vaultPath;if(e.type==="azure"&&e.azurePath?.trim())return e.azurePath;throw Error(`Tenant config locator type "${e.type}" does not declare a mirrorable config path`)}function tp(e,t){let r=t.logger??e.log,n=new Map,o=!1,s=async(u)=>{if(u.closed)return;u.closed=!0,u.closeHooks?.(),await u.hookSetup?.catch(()=>{return}),await u.source.secret.close?.()},i=(u)=>{let l=(async()=>{let y=await t.store.get(u);if(!y)throw Error(`Tenant "${u}" was not found`);if(!y.configLocator)throw Error(`Tenant "${u}" has no configLocator`);let p=y.configLocator,b=t.path(y).trim();if(!b)throw Error(`Tenant mirror path is empty for "${u}"`);let M=t.sourceFromLocator?.(p,y)??p,R={source:vr({from:M,fromPath:ep(p),to:t.to,path:b,logger:r}),locatorFingerprint:Ia(p),targetPath:b,closed:!1};if(t.hooks?.onRemoteConfigChange)R.hookSetup=t.to.subscribe(b,(W)=>{Promise.resolve(t.hooks?.onRemoteConfigChange?.(y,W.data,W)).catch((q)=>{r.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:u,error:q instanceof Error?q.message:String(q)})})}).then((W)=>{R.closeHooks=W}).catch((W)=>{r.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:u,error:W instanceof Error?W.message:String(W)})});return R})();return n.set(u,l),l.catch(()=>{if(n.get(u)===l)n.delete(u)}),l},c=async(u,l,y)=>{if(n.get(u)===l)n.delete(u);await s(y)},d=async(u)=>{if(o)throw Error("Tenant config mirror is closed");let l=n.get(u);if(!l)return i(u);let y=await l,p=await t.store.get(u);if(!p?.configLocator)throw await c(u,l,y),Error(p?`Tenant "${u}" has no configLocator`:`Tenant "${u}" was not found`);if(Ia(p.configLocator)!==y.locatorFingerprint)return await c(u,l,y),n.get(u)??i(u);return y};return{async ensure(u,l){await(await d(u)).source.mirror.ready(l)},async handleCallback(u,l,y){try{return await(await d(u)).source.handleCallback(l,y)}catch(p){let b=p instanceof Error?p.message:String(p),M=b.includes("was not found")?404:503;return r.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:u,kind:l,error:b}),Response.json({error:M===404?"Tenant not found":"Tenant config mirror unavailable"},{status:M})}},async purge(u){let l=n.get(u),y=l?await l:void 0,p=await t.store.get(u),b=y?.targetPath??(p?t.path(p).trim():void 0);if(y&&l)await c(u,l,y);if(b&&await t.to.exists(b))await t.to.deleteSecret(b);if(p)await t.hooks?.onRemoteConfigRevoke?.(p)},async close(){if(o)return;o=!0;let u=[...n.values()];n.clear(),await Promise.all(u.map(async(l)=>{try{await s(await l)}catch{}}))}}}import{buildTenantPath as rp,DEFAULT_TENANT_API_NAMESPACE as Oa,DEFAULT_TENANT_UI_NAMESPACE as Ea,matchTenantHost as np,matchTenantPath as Aa,normalizeTenantPathNamespace as Pa}from"@ionite/core";function op(){return Response.json({error:"Tenant not found"},{status:404})}function sp(e){return Response.json({error:`Tenant runtime unavailable for ${e}`},{status:503})}function ip(e,t){let r=!e||e.type===void 0||e.type==="path"?e:void 0;if(t==="api")return Pa(r?.api??Oa);return Pa(r?.ui??Ea)}function ap(e){if(e.store)return async(t)=>e.store.getIon(t);return async(t)=>await e.getIon(t)??void 0}async function _a(e,t={}){if(t.custom){let s=await t.custom(e);if(s)return{id:s}}if(t.strategy?.type==="selector")return null;if(t.strategy?.type==="host"){let s=np(new URL(e.url).hostname,t.strategy.baseDomain);return s?{id:s.id}:null}let r=t.namespace??"api",n=ip(t.strategy,r),o=Aa(new URL(e.url).pathname,n);if(!o)return null;return{id:o.id,context:{namespace:r,restPath:o.restPath,restSegments:o.restSegments}}}function La(e,t){let r=new URL(e.url);return r.pathname=t,new Request(r,e)}function jo(e,t,r,n){let o=Aa(new URL(e.url).pathname,r);if(!o||o.id!==t)return e;return La(e,rp(t,o.restPath,n))}function cp(e,t,r={beforeTenantSegments:["api"],afterTenantSegments:[]}){return jo(e,t,Oa,r)}function up(e,t,r={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return jo(e,t,Ea,r)}function dp(e){return async function(r){let n=e.resolveTenant?await e.resolveTenant(r):await _a(r),o=typeof n==="string"?{id:n,context:void 0}:n??null;if(!o?.id)return e.onMissingTenant?await e.onMissingTenant(r):op();let s=await e.getIon(o.id,r)??null;if(!s)return e.onMissingIonite?await e.onMissingIonite(r,o.id):sp(o.id);let i=e.rewriteRequest?await e.rewriteRequest(r,{id:o.id,ion:s,context:o.context}):r;return s.handler(i)}}import{list as lp,matchesListFilter as fp}from"@ionite/core";class xa{constructor(){this.identities=new Map;this.clientIdIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.identities.get(e)}async lookup(e){if(e.id){let t=this.identities.get(e.id);if(t)return t}if(e.clientId){let t=this.clientIdIndex.get(e.clientId);if(t)return this.identities.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.identities.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n=this.identities.get(t),o={...e,id:t,createdAt:n?.createdAt??e.createdAt??r,updatedAt:r};if(n?.clientId&&n.clientId!==o.clientId)this.clientIdIndex.delete(n.clientId);if(n?.externalId&&n.externalId!==o.externalId)this.externalIdIndex.delete(n.externalId);if(this.identities.set(t,o),o.clientId)this.clientIdIndex.set(o.clientId,t);if(o.externalId)this.externalIdIndex.set(o.externalId,t);return o}async delete(e){let t=this.identities.get(e);if(t?.clientId)this.clientIdIndex.delete(t.clientId);if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.identities.delete(e),t?1:0}async list(e){let t=Array.from(this.identities.values()).filter((c)=>fp(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return lp(o,i,r,n)}}var bp=30000;function Rp(e){let t=e,r=t.basePath??xr(),n=t.readyTimeoutMs??bp,o=Lr(t.stores),{routing:s,beforeChange:i,afterChange:c,configRetry:d,onConfigLoadError:u}=t;return{frameworkConfig:{log:e.log,validators:e.validators,sso:e.sso,iam:e.iam,workload:e.workload,secrets:e.secrets,lfv:e.lfv,ciam:e.ciam,tm:e.tm,authz:e.authz,otel:e.otel},basePath:r,readyTimeoutMs:n,stores:o,options:{beforeChange:i,afterChange:c,routing:s,configRetry:d,onConfigLoadError:u}}}function Tp(e){let t=e,r={trace:(n,...o)=>t.trace(n,...o),debug:(n,...o)=>t.debug(n,...o),info:(n,...o)=>t.info(n,...o),warn:(n,...o)=>t.warn(n,...o),error:(n,...o)=>t.error(n,...o)};return{logger:r,update(n){return t=n,r}}}function Va(e,t){let r=e;return r.setStores=(n)=>{t.current=Lr(n),Object.assign(r,Qt(r,t.current))},r}function Ma(e){let t=e?.replace(/\s+/g," ").trim();return t?t:void 0}function Ho(e){if(typeof e!=="object"||e===null)return;return e.cause}function Cp(e){if(!(e instanceof Error))return typeof e==="string"?Ma(e):void 0;let t=Ma(e.message),r=[],n=e;if(typeof n.code==="string")r.push(`code=${n.code}`);let o=typeof n.upstreamStatus==="number"?n.upstreamStatus:e instanceof Ka?void 0:n.status;if(typeof o==="number")r.push(`status=${o}`);if(typeof n.path==="string")r.push(`path=${n.path}`);if(r.length===0)return t;if(!t)return r.join(", ");return`${t} [${r.join(", ")}]`}function zo(e,t=3){let r=[],n=e,o=0;while(n!=null&&o<t){let s=Cp(n);if(s&&!r.includes(s))r.push(s);n=Ho(n),o+=1}return r.length>0?r.join(" <- "):void 0}function Jo(e){let t=e,r=0;while(t!=null&&r<3){if(typeof t==="object"&&t!==null){let n=t;if(typeof n.upstreamStatus==="number")return n.upstreamStatus;if(!(t instanceof Ka)&&typeof n.status==="number")return n.status}t=Ho(t),r+=1}return}function Ip(e,t){if(typeof e!=="object"||e===null)return;return e[t]}function _t(e,t){let r=e,n=0;while(r!=null&&n<3){let o=Ip(r,t);if(o!==void 0)return o;r=Ho(r),n+=1}return}var Pp=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function Op(e){return typeof e==="string"&&Pp.has(e)}function Ep(e){let t=_t(e,"kind");if(Op(t))return t;let r=Jo(e),n=_t(e,"code"),o=zo(e)?.toLowerCase()??"";if(r===401||r===403||o.includes("auth error")||o.includes("permission denied"))return"auth";if(n==="not_found"||o.includes("waiting for vault"))return"not_found";if(n==="ECONNREFUSED"||n==="ECONNRESET"||n==="ENOTFOUND"||n==="ETIMEDOUT"||o.includes("connection")||o.includes("fetch failed")||o.includes("network"))return"connection";if(o.includes("timed out"))return"timeout";if(o.includes("invalid status")||typeof r==="number"&&r>=400)return"invalid_status";if(o.includes("invalid payload")||o.includes("invalid json")||o.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function Ap(e){return"validation"}var _p=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function Lp(e,t){let r=_t(e,"recoverable");if(typeof r==="boolean")return r;if(t==="not_found")return!0;if(t==="auth"||t==="invalid_payload")return!1;let n=Jo(e);if(typeof n==="number"&&n>=400&&n<500)return!1;let o=_t(e,"code");if(typeof o==="string"&&(_p.has(o)||o.startsWith("UND_ERR_")))return!0;return!0}function xp(e){return{initialDelayMs:Math.max(1,e?.initialDelayMs??2000),maxDelayMs:Math.max(1,e?.maxDelayMs??600000),multiplier:Math.max(1,e?.multiplier??2),jitterRatio:Math.max(0,e?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,e?.loadTimeoutMs??30000)}}function Up(e,t){let r=Math.max(0,e-1),n=Math.min(t.maxDelayMs,t.initialDelayMs*t.multiplier**r);if(t.jitterRatio===0)return Math.round(n);let o=n*t.jitterRatio,s=(Math.random()*2-1)*o;return Math.max(1,Math.round(Math.min(t.maxDelayMs,n+s)))}function Mp(e){return(t)=>{let r=t.path?` at ${t.path}`:"",n=t.sourceType?` (${t.sourceType})`:"";e.warn(`Config source${n} unavailable${r}; ionite will retry automatically in ${t.nextDelayMs}ms (attempt ${t.attempt}, ${t.errorKind}: ${t.message}).`)}}async function qp(e,t){for(let r of t)await r(e)}function Ne(e){if(!e)return;try{return new URL(e,"http://dummy").pathname}catch{return e.startsWith("/")?e:`/${e}`}}function Wp(e,t){let r=t.id;if(typeof r!=="string"||r.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if(e!==void 0&&e!==r)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${e}", received "${r}").`)}function jp(e){let t=(r,n)=>{if(r!==void 0&&(typeof r!=="string"||r.length===0))throw Error(`${n}: "clientSecret" must be a non-empty string when present; omit it entirely for a public (PKCE-only) client.`)};t(e.sso?.clientSecret,"sso");for(let[r,n]of Object.entries(e.ciam?.providers??{}))t(n.clientSecret,`ciam.providers.${r}`)}function Np(e){let t=(o,s)=>{if(!o)return;if(typeof o.url!=="string"||o.url.length===0)throw Error(`${s}.url is required and must be a non-empty string.`);if(o.audience!==void 0&&(typeof o.audience!=="string"||o.audience.length===0))throw Error(`${s}.audience must be a non-empty string when present.`)},r=e.sso?.accessRequests;if(t(r,"RemoteConfig.sso.accessRequests"),r&&!ct(e.sso?.claimsAsEntitlements))throw Error("RemoteConfig.sso.accessRequests requires sso.claimsAsEntitlements because the provider must carry approved assignments in token claims.");let n=[];for(let[o,s]of Object.entries(e.ciam?.providers??{})){if(t(s.accessRequests,`RemoteConfig.ciam.providers.${o}.accessRequests`),!s.accessRequests)continue;if(s.type==="magic-link")throw Error(`RemoteConfig.ciam.providers.${o}.accessRequests is invalid for a magic-link provider.`);if(!ct(s.claimsAsEntitlements))throw Error(`RemoteConfig.ciam.providers.${o}.accessRequests requires claimsAsEntitlements because the provider must carry approved assignments in token claims.`);if(s.enabled!==!1)n.push(o)}if(e.iam?.users?.assignment==="idp"&&!r)throw Error('RemoteConfig.iam.users.assignment "idp" requires sso.accessRequests.');if(e.iam?.customers?.assignment==="idp"&&n.length===0)throw Error('RemoteConfig.iam.customers.assignment "idp" requires an enabled ciam provider with accessRequests.');if(e.iam?.workloads?.assignment==="idp")throw Error('RemoteConfig.iam.workloads.assignment does not support "idp".')}function $p(e){let t=e.kms;if(t)for(let[n,o]of Object.entries(t)){if(n.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!o||typeof o!=="object"||Array.isArray(o))throw Error(`RemoteConfig.kms.${n} must be an object.`);if(o.source!==void 0&&(typeof o.source!=="string"||o.source.length===0))throw Error(`RemoteConfig.kms.${n}.source must be a non-empty string when present.`);if(o.path!==void 0&&(typeof o.path!=="string"||o.path.length===0))throw Error(`RemoteConfig.kms.${n}.path must be a non-empty string when present.`)}let r=e.otel;if(!r)return;if(r.apiKey!==void 0&&r.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(r.apiKeyPool!==void 0){if(typeof r.apiKeyPool!=="string"||r.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!t?.[r.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${r.apiKeyPool}".`)}}function Dp(e){let t=e.authz?.trustedProvisioningClients;if(!t)return;t.forEach((r,n)=>{let o=`authz.trustedProvisioningClients[${n}]`;if(typeof r.issuer!=="string"||r.issuer.length===0)throw Error(`${o}: "issuer" is required and must be a non-empty string.`);if(typeof r.clientId!=="string"||r.clientId.length===0)throw Error(`${o}: "clientId" is required and must be a non-empty string.`);let s=Array.isArray(r.audience)?r.audience:[r.audience];if(s.length===0||s.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(r.permissions)||r.permissions.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "permissions" must be an array of non-empty permission ids.`)})}function Kp(e){let t=e.tm;if(!t)return;if(t.enabled!==!0)throw Error("RemoteConfig.tm.enabled must be true when tm is present.");for(let r of["id","url","issuer","jwksUri","audience","clientId"])if(typeof t.ionite?.[r]!=="string"||t.ionite[r].length===0)throw Error(`RemoteConfig.tm.ionite.${r} is required and must be a non-empty string.`);if(t.consentTtlSeconds!==void 0&&(!Number.isInteger(t.consentTtlSeconds)||t.consentTtlSeconds<60))throw Error("RemoteConfig.tm.consentTtlSeconds must be an integer of at least 60.");if(t.requestTokenTtlSeconds!==void 0&&(!Number.isInteger(t.requestTokenTtlSeconds)||t.requestTokenTtlSeconds<60))throw Error("RemoteConfig.tm.requestTokenTtlSeconds must be an integer of at least 60.");if(t.maxRedeemAttempts!==void 0&&(!Number.isInteger(t.maxRedeemAttempts)||t.maxRedeemAttempts<1))throw Error("RemoteConfig.tm.maxRedeemAttempts must be a positive integer.")}function Fp(e){let t=Array.isArray(e)?e:[e];return t.length>0&&t.every((r)=>typeof r==="string"&&r.length>0)}function Vp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return;let r=t,n=(o,s)=>{if(!Fp(o.audience))throw Error(`${s}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in r||"outgoing"in r){let o=r.incoming;if(Array.isArray(o))o.forEach((s,i)=>{if(s&&typeof s==="object")n(s,`workload.incoming[${i}]`)});else if(o&&typeof o==="object"&&"jwksUri"in o)n(o,"workload.incoming");return}if(Ga(r)){if("jwksUri"in r&&!("clientId"in r)&&!("workloadId"in r))n(r,"workload (server-only)");return}}function zp(e,t,r){if(e?.sso?.redirectUri&&t.sso?.redirectUri){let n=Ne(e.sso.redirectUri),o=Ne(t.sso.redirectUri);if(n!==o)r.error(`SSO redirectUri path mismatch: the framework derives "${o}" from basePath, but ConfigSource reports "${n}". Register "${o}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function Bo(e){let t={};if(!e)return t;for(let[r,n]of Object.entries(e))if(n.type==="vault"&&typeof n.lfv?.deliveryEndpoint==="string"&&typeof n.lfv?.eventsEndpoint==="string")t[r]=n.lfv;return t}function za(e){return e[Kt]}function Ba(e,t){let r=Bo(e.secrets??void 0),n=Ne(t.deliveryEndpoint),o=Ne(t.eventsEndpoint),s=Ne(t.path);for(let i of Object.values(r)){if(Ne(i.deliveryEndpoint)!==n)continue;if(Ne(i.eventsEndpoint)!==o)continue;let c=i.path?Ne(i.path):void 0;if(s&&c&&s!==c)continue;return!0}return!1}function Bp(e,t){let r=za(t);if(!r)return e;if(Ba(e,r))return e;let n={type:"vault",lfv:{path:r.path,lfvServerUrl:r.lfvServerUrl,clientId:r.clientId,deliveryTimeout:r.deliveryTimeout,retryInterval:r.retryInterval,warnInterval:r.warnInterval,deliveryEndpoint:r.deliveryEndpoint,eventsEndpoint:r.eventsEndpoint,verifyJwks:r.verifyJwks}},o=e.secrets??{},s=Dn(o,{clientId:r.clientId,path:r.path});return{...e,secrets:{...o,[s]:n}}}function Gp(e,t){let r=za(t);if(!r||Ba(e,r))return new Map;let n=Dn(e.secrets??{},{clientId:r.clientId,path:r.path});return new Map([[n,t.secret]])}function Hp(e,t){let r=Bo(e.secrets),n=Bo(t.secrets??void 0);for(let[o,s]of Object.entries(n)){let i=r[o];if(!i)continue;let c=Ne(i.deliveryEndpoint),d=Ne(s.deliveryEndpoint);if(c&&d&&c!==d)throw Error(`LFV deliveryEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${c}, framework path: ${d}`);let u=Ne(i.eventsEndpoint),l=Ne(s.eventsEndpoint);if(u&&l&&u!==l)throw Error(`LFV eventsEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${u}, framework path: ${l}`)}}function Jp(e){return new Set(Object.keys(e.secrets??{}))}function Yp(e){return new Set(Object.keys(e.secrets??{}))}function Xp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;if(!("outgoing"in t))return new Set;let r=t.outgoing;if(!r||typeof r!=="object"||Array.isArray(r))return new Set;return new Set(Object.keys(r))}function Ga(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function Zp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;let r=t;if("incoming"in r||"outgoing"in r){let n=r.outgoing;if(!n||typeof n!=="object"||Array.isArray(n))return new Set;return new Set(Object.keys(n))}if(Ga(r))return new Set;return new Set(Object.keys(r).filter((n)=>n!=="default"))}function Qp(e,t,r,n){let o=t.secrets??{},s=e.secrets??{};for(let[l,y]of Object.entries(o)){let p=s[l];if(!p)continue;if(y.type&&p.type&&y.type!==p.type)throw Error(`Secrets source "${l}" type in framework config must match ConfigSource type. ConfigSource type: ${p.type}, framework type: ${y.type}`)}let i=Jp(t),c=Yp(e);for(let l of i)if(!c.has(l)&&!n.has(l))r.warn(`Framework config declares secrets source "${l}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let l of c)if(!i.has(l))r.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:l});let d=Xp(t),u=Zp(e);for(let l of d)if(!u.has(l))r.warn(`Framework config declares outgoing workload client "${l}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(t.otel!==void 0&&t.otel!==null&&e.otel===void 0)r.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function qa(e,t){if(t===void 0)return!1;return gp(e,t)}function em(e,t){if(typeof t!=="number"||!Number.isFinite(t)||t<=0)return e;return new Promise((r,n)=>{let o=setTimeout(()=>{n(Error(`Ionite ready() timed out after ${t}ms`))},t);e.then(()=>{clearTimeout(o),r()},(s)=>{clearTimeout(o),n(s)})})}function tm(e,t,r){if(typeof t!=="number"||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>{o(Error(r))},t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function Yo(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function Rr(e){return e==="/"?e:e.replace(/\/+$/,"")}function $o(e,t){return Rr(e)===Rr(t)}function Wa(e){return e.method==="GET"||e.method==="HEAD"}function rm(e){if(e.isReady()&&e.config?.readyz?.enabled===!1)return me();let t=e.readiness();return Response.json(nm(t),{status:t.ok?200:503})}function nm(e){let t=e.config.lastError;if(!t)return e;return{...e,config:{...e.config,lastError:{kind:t.kind,phase:t.phase,at:t.at,message:"[redacted]"}}}}var om={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","sso.claims_authz":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","ciam.claims_authz":"ciam","iam.users":"iam","iam.groups":"iam","iam.groups.create":"iam","iam.workloads":"iam","iam.customers":"iam","workload.incoming":"workload","workload.outgoing":"workload","workload.claims_authz":"workload","authz.oaa":"authz","authz.access_requests":"authz","tm.integration":"tm"};function sm(e){let t=e?.providers;if(!t)return!1;return Object.values(t).some((r)=>r.enabled!==!1&&r.type!=="magic-link")}function im(e){return Boolean(e?.iam?.users?.assignment==="idp"&&e.sso?.accessRequests&&ct(e.sso.claimsAsEntitlements))}function am(e){return Boolean(e?.iam?.customers?.assignment==="idp"&&Object.values(e.ciam?.providers??{}).some((t)=>t.enabled!==!1&&t.type!=="magic-link"&&t.accessRequests&&ct(t.claimsAsEntitlements)))}function Te(e,t,r={}){let n=om[e],o=t.modules[n],s=r.capable??!0,i=o.active&&o.ready&&s,c=i?void 0:!o.active||!o.ready?o.reason:r.incapableReason??`${e} is not testable by this application wiring`;return{module:n,active:o.active,ready:o.ready,testable:i,...r.urls&&r.urls.length>0?{urls:r.urls}:{},...c?{reason:c}:{}}}function ct(e){return Boolean(e?.claims&&e.claims.length>0)}function cm(e){if(!e||typeof e!=="object")return!1;let t=e;if(ct(t.claimsAsEntitlements))return!0;let r=t.incoming;if(!r)return!1;if(Array.isArray(r))return r.some((n)=>ct(n.claimsAsEntitlements));return ct(r.claimsAsEntitlements)}function Do(e,t,r,n){let o=Te(e,t,{capable:r&&n,incapableReason:r?"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted.":"claimsAsEntitlements is not configured for this plane."});if(!r)return{...o,active:!1,testable:!1,reason:"claimsAsEntitlements is not configured for this plane."};return o}function um(e,t,r){let n=Fe(t),o=e.readiness();return{sdk:{version:dn,catalogVersion:Jr},basePath:t,urls:n,modules:o.modules,lfvCallbackTransport:Boolean(r.lfv?.callbackTransport),capabilities:{"sso.login":Te("sso.login",o,{urls:[n.sso.loginUrl,n.sso.callbackUrl,n.sso.userUrl]}),"sso.jit":Te("sso.jit",o,{capable:r.sso?.enableJitUserProvisioning!==!1&&Boolean(r.sso?.userStore),incapableReason:r.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":Te("sso.logout",o,{urls:[n.sso.logoutUrl]}),"sso.back_channel_logout":Te("sso.back_channel_logout",o,{urls:[n.sso.logoutBackChannelUrl]}),"sso.claims_authz":Do("sso.claims_authz",o,ct(e.config?.sso?.claimsAsEntitlements),r.sso?.sessionStore?.capabilities?.derivedEntitlements===!0),"ciam.magic_link":Te("ciam.magic_link",o,{capable:Boolean(r.ciam?.magicLinkStore)&&r.ciam?.enableJitUserProvisioning!==!1,urls:[n.ciam.magicLinkUrl,n.ciam.magicLinkLoginUrl],incapableReason:!r.ciam?.magicLinkStore?"CIAM magic-link is enabled but no magicLinkStore capability is wired by the application.":"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":Te("ciam.oidc_login",o,{capable:sm(r.ciam),urls:[n.ciam.customerLoginUrl,n.ciam.customerCallbackUrl,n.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":Te("ciam.customer",o,{urls:[n.ciam.customerUrl]}),"ciam.logout":Te("ciam.logout",o,{urls:[n.ciam.logoutUrl]}),"ciam.claims_authz":Do("ciam.claims_authz",o,Object.values(e.config?.ciam?.providers??{}).some((s)=>ct(s.claimsAsEntitlements)),r.ciam?.sessionStore?.capabilities?.derivedEntitlements===!0),"iam.users":Te("iam.users",o,{capable:Boolean(r.iam?.userStore),urls:[n.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":Te("iam.groups",o,{capable:Boolean(r.authz?.catalogStore||r.authz?.catalog),urls:[n.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"iam.groups.create":Te("iam.groups.create",o,{capable:Boolean(r.authz?.catalogStore&&r.authz?.onInboundEntitlement),urls:[n.iam.groupsUrl],incapableReason:!r.authz?.catalogStore?"IAM-sourced entitlement creation requires an AccessCatalogStore.":"IAM-sourced entitlement creation requires the application to implement authz.onInboundEntitlement."}),"iam.workloads":Te("iam.workloads",o,{capable:Boolean(r.iam?.workloadIdentityStore),urls:[n.iam.workloadsUrl],incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."}),"iam.customers":Te("iam.customers",o,{capable:Boolean(r.iam?.customerStore),urls:[n.iam.customersUrl],incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."}),"workload.incoming":Te("workload.incoming",o,{urls:[n.workload.validateUrl,n.workload.jwksUrl]}),"workload.outgoing":Te("workload.outgoing",o,{}),"workload.claims_authz":Do("workload.claims_authz",o,cm(e.config?.workload),!0),"authz.oaa":Te("authz.oaa",o,{capable:Boolean(r.authz?.accessStore&&(r.authz?.catalogStore||r.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."}),"authz.access_requests":Te("authz.access_requests",o,{capable:im(e.config)||am(e.config),incapableReason:"IdP access-request validation requires either iam.users.assignment='idp' with SSO accessRequests and claimsAsEntitlements, or iam.customers.assignment='idp' with an enabled non-magic-link CIAM provider carrying accessRequests and claimsAsEntitlements."}),"tm.integration":Te("tm.integration",o,{capable:Boolean(r.tm?.onConnectRequest&&r.tm.store.setIntegration&&r.tm.store.getByIntegrationHandleHash),urls:r.tm?[`${Rr(r.tm.basePath)}/integrations/authorize`,`${Rr(r.tm.basePath)}/integrations/redeem`,`${Rr(r.tm.basePath)}/integrations/config-export`]:void 0,incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."})}}}async function dm(e,t,r){if(!t.isReady())return Yo();if(t.config?.capabilitiez!==!0||!r)return me();let n=await mr(e,t,Da["capabilitiez.read"]);if(n)return n;return Response.json(r.build(),{status:200})}async function lm(e){if(!e)return[];let t=[];for await(let r of Xt((n,o)=>e.list({start:n,limit:o})))t.push(r);return t}function Ko(e,t){return[...new Set(e.filter((r)=>r.subjectType===t).map((r)=>typeof r.subject==="string"?r.subject:r.subject.id).filter((r)=>Boolean(r)))]}function Fo(e,t,r){if(!e)return;if(t==="all")return Xt((n,o)=>e.list({start:n,limit:o}));return async function*(){for(let o of r){let s=await e.get(o);if(s)yield s}}()}async function fm(e,t,r){if(!t.isReady())return Yo();if(t.config?.authz?.oaa?.fullSync?.enabled!==!0)return me();let n=await mr(e,t,Da["authz.oaa.sync"]);if(n)return n;let o=t.authz?.oaa;if(!o?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let s=t.authz?await t.authz.reconcile():void 0,i=r.iam?.userStore,c=r.iam?.customerStore??r.ciam?.customerStore,d=r.workload,u=r.iam?.workloadIdentityStore??(d&&"workloadIdentityStore"in d?d.workloadIdentityStore:d&&("incoming"in d)&&d.incoming&&!Array.isArray(d.incoming)&&("workloadIdentityStore"in d.incoming)?d.incoming.workloadIdentityStore:void 0),l=yp(r.authz?.catalog?Fa(r.authz.catalog):void 0,r.authz?.catalogStore),y=r.authz?.accessStore,p=r.authz?.resources,b=await lm(y),M=await o.sync({users:Fo(i,o.population("user"),Ko(b,"user")),customers:Fo(c,o.population("customer"),Ko(b,"customer")),workloads:Fo(u,o.population("workload"),Ko(b,"workload")),groups:l?Xt((_,R)=>l.groups.list({start:_,limit:R})):void 0,roles:l?Xt((_,R)=>l.roles.list({start:_,limit:R})):void 0,permissions:l?Xt((_,R)=>l.permissions.list({start:_,limit:R})):void 0,resources:p?Xt((_,R)=>p.list({start:_,limit:R})):void 0,access:b},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...M,reconcile:s})}function pm(e,t,r,n,o,s){return async(i)=>{let c=new URL(i.url).pathname;if($o(c,r)){if(!Wa(i))return Be(["GET"]);return rm(e)}if($o(c,n)){if(!Wa(i))return Be(["GET"]);return dm(i,e,o)}if(s&&$o(c,s.url)){if(i.method!=="POST")return Be(["POST"]);return fm(i,e,s.frameworkConfig)}let d=e.secrets;if(!Boolean(d?.isLfvDeliveryRequest?.(i)||d?.isLfvEventsRequest?.(i))&&!e.isReady())return Yo();return Ur(e,"handler",()=>t(i))}}function ja(e,t,r){if(e)return r&&!e.tenantId?{...e,tenantId:r}:e;if(t&&r)return{tenantId:r};return}function mm(e,t){if(t.authz===null)return;if(!e.authz&&!t.authz)return;return{...e.authz,...t.authz,oaa:e.authz?.oaa||t.authz?.oaa?{...e.authz?.oaa,...t.authz?.oaa}:void 0}}function Vo(e){let t=!1,r=ye(`${e} module`,()=>t);return{isReady:r.isReady,ready:r.ready,attach(n){if(t=n!==void 0,r.refresh(),!n)return;return Object.defineProperty(n,"isReady",{value:r.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(n,"ready",{value:r.ready,enumerable:!1,configurable:!0}),n}}}function Go(e){if(!e)return!1;return e.isReady?e.isReady():!1}function At(e,t,r,n){if(!e)return{active:!1,ready:!1,reason:r};return Go(t)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:n}}function gm(){let e=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:e(),ciam:e(),iam:e(),workload:e(),otel:e(),secrets:e(),kms:e(),authz:e(),tm:e()}}function Ha(e,t,r){let n=e.isReady(),o=e.config;if(!n||!o)return{ok:!1,applied:n,modules:gm(),config:{...t}};let s=An(r),i=Boolean(o.workload)||Boolean(e.workload),c={sso:At(Boolean(o.sso),e.sso,"sso not configured (no RemoteConfig.sso)",s.sso??"sso configured but not ready"),ciam:At(Boolean(o.ciam),e.ciam,"ciam not configured (no RemoteConfig.ciam)",s.ciam??"ciam configured but not ready"),iam:At(Boolean(o.iam),e.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:At(i,e.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:At(Boolean(o.otel),e.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(o.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!Go(e.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return e.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:At(Boolean(o.kms),e.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(o.authz?.oaa))return{active:!0,ready:!0};let l=e.authz?.oaa;return Go(l)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})(),tm:At(o.tm?.enabled===!0&&Boolean(r.tm),e.tm,o.tm?.enabled===!0?"tm configured by RemoteConfig but FrameworkConfig.tm is not wired (this instance does not serve tenant management)":"tm not configured (no RemoteConfig.tm)","tm configured but not ready")};return{ok:Object.values(c).every((u)=>!u.active||u.ready),applied:n,modules:c,config:{...t}}}function ym(e,t){let r=[];for(let n of t){let o=e.modules[n];if(!e.applied){r.push({name:n,reason:"RemoteConfig has not been applied yet"});continue}if(!o?.ready)r.push({name:n,reason:o?.reason??`${n} is not ready`})}return{ok:r.length===0,notReady:r}}function hm(e,t,r,n,o,s,i,c,d,u){let l=t.validators,y=vp(e.cache);wp(y.jwks);let p=t;if(y.session.read.enabled){let se=t.sso?.sessionStore??t.ciam?.sessionStore;if(se){let K=So(se,y.session.read);p={...t,sso:t.sso?{...t.sso,sessionStore:K}:t.sso,ciam:t.ciam?{...t.ciam,sessionStore:K}:t.ciam}}}let b={sessionCache:y.session},M=it(l.workload,r,e?.workload,t.workload??void 0,void 0,u),_=t.otel!==null?io(r,e?.otel,t.otel??void 0,o):void 0,R=An(p);if(Object.keys(e).length>0){if(R.sso)r.error(R.sso);if(R.ciam)r.error(R.ciam)}let W=ja(e?.sso,t.sso,e.id),q=R.sso?void 0:kp(l.sso,r,W,p.sso??void 0,{...b,catalogView:u}),a={...e?.iam,...t.iam},w=t.authz?.catalog?Fa(t.authz.catalog):void 0,v=t.workload,L=v&&"workloadIdentityStore"in v?v.workloadIdentityStore:v&&("incoming"in v)&&v.incoming&&!Array.isArray(v.incoming)&&("workloadIdentityStore"in v.incoming)?v.incoming.workloadIdentityStore:void 0,H=Boolean(a.url||e.sso?.accessRequests||Object.values(e.ciam?.providers??{}).some((se)=>se.accessRequests)||a.userStore||t.authz?.catalogStore||w);i.update({...a.url?{iam:{url:a.url,...a.deltaAudience?{audience:a.deltaAudience}:{}}}:{},...e.sso?.accessRequests?{sso:e.sso.accessRequests}:{},ciam:Object.fromEntries(Object.entries(e.ciam?.providers??{}).flatMap(([se,K])=>K.enabled!==!1&&K.accessRequests?[[se,K.accessRequests]]:[]))},{workload:M});let J=c.update({users:e?.iam?.users?.delta,workloads:e?.iam?.workloads?.delta,customers:e?.iam?.customers?.delta,url:a.url,audience:a.deltaAudience},{workload:M,workloadIdentityStore:L,userStore:a.userStore,customerStore:a.customerStore??p.ciam?.customerStore,accessStore:t.authz?.accessStore,catalogStore:t.authz?.catalogStore,codeCatalog:w,mapUserToScim:a.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:a.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:a.inboundWorkloads?.mapBaseWorkloadToScim}),Y;if(H&&!M){if(Object.keys(e).length>0)r.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");Y=void 0}else Y=Sp(l.iam,r,M,s,t.authz?.accessStore,t.authz?.accessIndex,t.authz?.catalogStore,w,t.authz?.resources,e?.iam,t.iam??void 0,J,t.authz?.onAccessMutation,t.authz?.onInboundEntitlement,mp(e.authz),d);let re=ja(e?.ciam,t.ciam,e.id),ue=R.ciam?void 0:hp(l.ciam,r,re,p.ciam??void 0,M,{...b,catalogView:u});return{secret:n,workload:M,otel:_,sso:q,iam:Y,ciam:ue}}var Na=new WeakMap;function wm(e){let t=Na.get(e);if(!t)t=()=>({ionId:e.id,log:e.log}),Na.set(e,t);return t}function Ja(e,t,r,n,o,s,i,c){let d=s.authz.update(mm(t,r));e.id=t.id,e.config=t;let u=wm(e),l=(_)=>_?ar(_,u):_;e.secrets=l(s.secrets.update(t.secrets,r.secrets??void 0,r.validators.secrets,r.lfv?.callbackTransport,r.lfv?.singleProcess)),e.kms=l(s.kms.update(t.kms,(_)=>{if(!_.source)return o;if(!e.secrets)throw Error(`KMS pool references unavailable secrets source "${_.source}".`);return e.secrets.getSecretsSource(_.source)}));let y=hm(t,r,n,o,s.kms.handle(),d,s.accessRequests,s.iamDelta,s.authz.settle,()=>s.authz.catalogView());e.secret=y.secret,e.workload=l(s.workload.update(y.workload)),e.otel=l(s.otel.update(y.otel)),e.authz=l(d),e.log=s.log.update(e.otel?.logger??n),e.sso=l(s.sso.attach(y.sso)),e.iam=l(s.iam.attach(y.iam)),e.ciam=l(s.ciam.attach(y.ciam)),e.tm=l(s.tm.update(t.tm?.enabled===!0&&r.tm?Qi(e,t.tm,r.tm):void 0,r.tm!==void 0&&r.tm!==null));let p=Fe(i),b=(_)=>()=>Ha(e,e.configStatus,r).modules[_];Ve(e.sso,b("sso"),p.sso),Ve(e.ciam,b("ciam"),p.ciam),Ve(e.iam,b("iam"),p.iam,()=>({accessRequests:s.accessRequests.handle().describe()})),Ve(e.workload,b("workload"),p.workload),Ve(e.secrets,b("secrets")),Ve(e.kms,b("kms")),Ve(e.otel,b("otel")),Ve(e.authz,b("authz")),Ve(e.tm,b("tm"));let M=(_)=>ao(_,e,c?.routing,p);e.handler=pm(e,M,p.readyzUrl,p.capabilitiezUrl,{build:()=>um(e,i,r)},{url:ls(i),frameworkConfig:r})}function Sm(e,t,r,n,o,s,i,c,d){Wp(e.id,t),jp(t),Np(t),$p(t),Dp(t),Kp(t),Vp(t),zp(t,r,n),Hp(t,r),Qp(t,r,n,c),Ja(e,t,r,n,o,s,i,d)}function $a(e){if(!e.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return e.secret}async function vm(e,t,r,n,o,s,i){let c=e,d=fs(e,t,o.current,s);if(n.beforeChange){let u=Va(d,o);i?.enter();let l;try{l=await n.beforeChange(e,u,r)}finally{i?.exit()}if(l?.config!==void 0)c=l.config;d=l?.frameworkConfig??u}return d=Qt(d,o.current),{effectiveRemoteConfig:c,effectiveFrameworkConfig:d}}function Lw(e,t){let r=Rp(t),{frameworkConfig:n,basePath:o,readyTimeoutMs:s,stores:i,options:c}=r,d=Gp(n,e),u=new Set(d.keys()),l=Qt(Bp(n,e),i),y=l.log||No,p={current:i},b={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:l},M=os(y),_=Zn(y),R,W={log:Tp(y),secrets:zi(y,d),kms:mi(y),workload:la(y),otel:Si(y),authz:js(y,()=>_.handle(),()=>M.handle(),()=>R?.iam,()=>({mapUserToScim:b.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:b.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:b.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim})),accessRequests:M,iamDelta:_,sso:Vo("sso"),iam:Vo("iam"),ciam:Vo("ciam"),tm:Hi()},q={},a,w,v=new Promise((E,F)=>{a=E,w=F}),L=!1,H,J,Y=0,re={enter:()=>{Y+=1},exit:()=>{Y-=1}},ue=Promise.resolve();function se(E){let F=ue.then(E,E);return ue=F.then(()=>{return},()=>{return}),F}function K(E){if(L)throw Error(`Ionite instance has been closed and cannot call ${E}().`)}function ee(){e.log=b.frameworkConfig.log??No,e.validators=b.frameworkConfig.validators}let z={},D={log:y,id:void 0,config:void 0,secret:$a(e),authz:void 0,configStatus:q,handler:async()=>me(),ready:(E)=>{if(Y>0&&b.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return em(v,E??s)},isReady:()=>b.remoteConfig!==void 0,readiness:()=>Ha(D,q,b.frameworkConfig),requireReady:(E)=>ym(D.readiness(),E),describe:()=>{let E=D.readiness(),F={sso:ze(D.sso,E.modules.sso),ciam:ze(D.ciam,E.modules.ciam),iam:ze(D.iam,E.modules.iam),workload:ze(D.workload,E.modules.workload),otel:ze(D.otel,E.modules.otel),secrets:ze(D.secrets,E.modules.secrets),kms:ze(D.kms,E.modules.kms),authz:ze(D.authz,E.modules.authz),tm:ze(D.tm,E.modules.tm)};return Se({id:D.id,sdk:{version:dn,catalogVersion:Jr},basePath:o,urls:Fe(o),ok:E.ok,applied:E.applied,config:{...q},modules:Object.fromEntries(Object.entries(E.modules).map(([S,O])=>[S,{...O,description:F[S]}]))})},close:()=>{if(L)return;if(L=!0,J)clearTimeout(J),J=void 0;H?.(),H=void 0;let E=[()=>W.secrets.close(),()=>W.kms.close(),()=>W.authz.close(),()=>W.otel.shutdown()];for(let F of E)try{Promise.resolve(F()).catch((S)=>{y.warn("Ionite close: module teardown failed",S)})}catch(S){y.warn("Ionite close: module teardown failed",S)}a?.(),a=void 0,w=void 0},setStores:async(E)=>{K("setStores");let F=Lr(E);await se(()=>C(F))}};R=D,Ja(D,z,b.frameworkConfig,y,D.secret,W,o,c),ee();let Q=()=>pp(e.origin);function ne(){let E=q.lastError!==void 0;if(q.appliedAt=Date.now(),q.lastError=void 0,E)(D.log??y).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success",...Q()})}function ie(E,F){let S=zo(F)??(F instanceof Error?F.message:String(F)),O=Ap(F),k=q.lastError===void 0;if(q.lastError={kind:O,message:S,at:Date.now(),phase:E},k)(D.log??y).error(E==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":O,phase:E,error:S,...Q()})}function ce(E,F,S){(D.log??y).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:E,"ion.config.hash":F,"ion.config.apply_ms":S,...Q()})}async function ae(E,F){if(L)return;let S=Ua(E);if(F&&b.remoteConfig!==void 0&&S===b.remoteConfigHash&&qa(E,b.remoteConfig))return;let O=b.remoteConfig,k=O===void 0?"initial":"update",m=Date.now(),f,T,A;try{let V=await vm(E,b.frameworkConfig,b.remoteConfig,c,p,o,re);if(f=V.effectiveRemoteConfig,T=Ua(f),A=V.effectiveFrameworkConfig,F&&c.beforeChange===void 0&&b.remoteConfig!==void 0&&T===b.remoteConfigHash&&qa(f,b.remoteConfig)&&A===b.frameworkConfig)return;let oe=A.log||No;Sm(D,f,A,oe,$a(e),W,o,u,c)}catch(V){throw ie(k,V),V}b.remoteConfig=f,b.remoteConfigHash=T,b.frameworkConfig=A,ee(),ne(),await W.otel.settled();let N=Va(b.frameworkConfig,p),Z=!1;try{c.afterChange?.(D,f,N,O)}catch(V){if((D.log??y).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:k,error:V instanceof Error?V.message:String(V)}),k==="initial"){Z=!0;let oe=V instanceof Error?V:Error(`afterChange failed on initial load: ${String(V)}`);ie("initial",oe),w?.(oe),w=void 0,a=void 0}}if(b.frameworkConfig=N,ee(),!Z)ce(k,T,Date.now()-m);if(!Z&&a)a(),a=void 0}async function C(E){if(L)return;if(p.current=E,b.remoteConfig===void 0){b.frameworkConfig=Qt(b.frameworkConfig,E),ee();return}await ae(b.remoteConfig,!1)}if(e.subscribe)e.subscribe((E)=>{se(()=>ae(E,!0)).catch(()=>{})},{mode:"wait"}).then((E)=>{if(L){E?.();return}H=E}).catch((E)=>{y.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:E instanceof Error?E.message:String(E)})});let g=xp(c.configRetry),P=[c.onConfigLoadError??Mp(y)],I=0;function U(){if(J=void 0,L)return;if(b.remoteConfig!==void 0)return;tm(e.load(),g.loadTimeoutMs,`ConfigSource initial load timed out after ${g.loadTimeoutMs}ms`).then(async(E)=>{I=0;try{await se(async()=>{if(b.remoteConfig!==void 0)return;await ae(E,!0)})}catch(F){let S=F instanceof Error?F:Error(`Initial RemoteConfig application failed: ${String(F)}`);y.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:S.message,...Q()}),w?.(S),w=void 0}},async(E)=>{if(L)return;I+=1;let F=Up(I,g),S=zo(E)??"RemoteConfig load failed",O=Ep(E),k=_t(E,"code"),m=Jo(E),f=_t(E,"path"),T=_t(E,"sourceType"),A=e.origin,N={attempt:I,error:E,errorKind:O,maxDelayMs:g.maxDelayMs,message:S,nextDelayMs:F,code:typeof k==="string"?k:void 0,status:typeof m==="number"?m:void 0,path:typeof f==="string"?f:A?.path,sourceType:typeof T==="string"?T:A?.type};if(!Lp(E,O)){let Z=E instanceof Error?E:Error(`ConfigSource initial load failed with unrecoverable ${O}: ${S}`);y.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:O,error:S,code:N.code,upstreamStatus:N.status,path:N.path,sourceType:N.sourceType,...Q()}),w?.(Z),w=void 0;return}try{await qp(N,P)}catch(Z){let V=Z instanceof Error?Z:Error("ConfigSource retry hook stopped RemoteConfig retrying");w?.(V),w=void 0;return}J=setTimeout(U,F)})}return U(),D}export{qw as AssignmentPolicyError,Bw as CatalogAdjacencyCache,wr as DEFAULT_REQUEST_TOKEN_TTL_SECONDS,Bu as ION_CAPABILITY_CATALOG,Jr as ION_CAPABILITY_CATALOG_VERSION,bp as ION_READY_DEFAULT_TIMEOUT_MS,dn as ION_SDK_VERSION,$e as InMemoryAccessAssignmentStore,Cr as InMemoryAccessCatalogStore,Pr as InMemoryAccessIndex,Or as InMemoryCustomerStore,Er as InMemoryMagicLinkStore,Ir as InMemoryResourceStore,Ar as InMemorySessionStore,pS as InMemoryTenantStore,_r as InMemoryUserStore,xa as InMemoryWorkloadIdentityStore,yt as InMemoryWorkloadTokenStore,jw as IoniteError,Gr as ScimOutboundClient,OS as TENANT_OWNER_PERMISSION,rn as VAULT_MIN_POLLING_TTL_MS,kr as VaultConfigInvalidPayloadError,Ot as VaultConfigWaitingForSecretError,je as VaultSubscribeNotSupportedError,Dw as allowHosts,Kw as allowOrigins,Fw as allowRelativePaths,Vw as allowSameOrigin,Lo as awsConfig,gn as azureConfig,zw as blockDangerousUrls,Gw as callback,Hw as captureRedirect,Jw as ciam,qi as closeAllVaultSockets,Yw as collectReferencedDefinitions,qo as configFromSource,wn as configLocatorFromEnvValues,Sa as configSourceFromEnvValues,at as configSourceFromLocator,Zn as createManagedIamDelta,ye as createReadinessLatch,So as createSessionReadCache,dp as createTenantIonHandler,ap as createTenantIonResolver,Xw as defaultRedirectPolicies,Fe as deriveIonUrls,bc as devInMemoryStores,Zw as discoverSessionRecords,Qw as discoverSessions,mr as enforceEndpointAuthz,Wf as envConfig,Yn as escapeScimFilterValue,eS as expandRoot,xo as gcpConfig,Ww as generateULID,tS as getCustomer,rS as getOwnedTenantIds,Hf as getSessionEntries,nS as getUser,af as getWorkload,cf as getWorkloadToken,oS as has,sS as hasAll,iS as hasAllScope,aS as hasAny,cS as hasAnyScope,uS as hasGroup,dS as hasPermission,lS as hasRole,fS as hasScope,It as hashIntegrationHandle,mS as iam,Rc as inMemoryAuthzDomains,On as inMemoryAuthzStores,gS as initiateLogin,Lw as ionite,yS as isRedirectAllowed,Ll as isRequestTokenExpired,If as isVaultConfigInvalidPayloadError,Cf as isVaultConfigWaitingForSecretError,kt as lfvVault,Nw as listGenerator,hS as listSsoClientIdsFromCookies,Zf as materializeTenantOwnerEntitlement,Be as methodNotAllowedResponse,Uo as mirrorSecrets,vr as mirroredConfig,me as notFoundResponse,vo as planActionRequired,wS as planDiscoveredTenantCookies,Qf as purgeTenantEntitlements,SS as reconcileSubjectAccess,vS as resolveAfterRedirect,kS as resolveCapturedRedirect,ki as resolveDefaultRoute,bS as resolveRedirect,_a as resolveTenantFromRequest,RS as resolveTenantOwner,TS as resolveTenantSession,df as revokeWorkloadToken,cp as rewriteRequestForDefaultTenantApi,up as rewriteRequestForDefaultTenantUi,jo as rewriteRequestForTenantPath,La as rewriteRequestPath,ao as routeRequest,CS as sameOriginRedirectRules,$f as secretConfigSource,IS as sendTenantWebhook,Ii as setVaultWebSocketCommandTimeout,PS as sso,st as subscribeSecretPathWithHttpPolling,ES as tenantAccessLoginUrl,tp as tenantMirror,AS as tenantOwnerEntitlementId,_S as tenantOwnerPermission,LS as tenantResourceId,uf as validateWorkloadToken,Bt as vault,yn as vaultConfig,Mi as vaultSocketDiagnostics,xS as verifyUser,US as withSetCookies,it as workload,lf as workloadHandler};
|
|
5
|
+
`)}function zs(e){try{let t=atob(e);return Uint8Array.from(t,(r)=>r.charCodeAt(0))}catch{throw Error("Invalid base64 secret content")}}function zr(e){if(!e||typeof e!=="object"||Array.isArray(e))throw Error("Secret content is not an object");return e}function or(e){return e.metadata.contentType??ku()}function Kn(e,t){if(t==="binary")throw Error("Binary secrets do not have a text representation; use bytes()");if(typeof e.data==="string")return e.data;if(t==="jsonc")return JSON.stringify(e.data,null,2);if(t==="env")return Vs(zr(e.data));let r=zr(e.data).content;if(typeof r!=="string")throw Error(`Secret ${t} content must contain a string "content" field`);return r}function Vr(e,t){if(t==="jsonc")return typeof e.data==="string"?bu(e.data):e.data;if(t==="env")return typeof e.data==="string"?Fs(e.data):zr(e.data);if(t==="text")return Kn(e,t);if(t==="binary"){let r=zr(e.data).content_base64;if(typeof r!=="string")throw Error('Binary secret content must contain a "content_base64" string');return zs(r)}throw Error(`Typed ${t} decoding is not supported yet; use text() or bytes()`)}function Tu(e){return{format:e.format,mimeType:e.mimeType,...e.schemaUrl?{schemaUrl:e.schemaUrl}:{},typeId:e.id}}function Cu(e,t){let r=or(e);if(r.format!==t.format||r.mimeType!==t.mimeType)throw new Ru(Tu(t),r)}async function Iu(e,t){if(!e.schema)return t;let r=await e.schema["~standard"].validate(t);if(r.issues){let n=r.issues.map((o)=>o.message).join("; ");throw Error(`Secret validation failed for type "${e.id}": ${n}`)}return r.value}function Ge(e){return{async text(){let t=await e();return Kn(t,or(t).format)},async json(){let t=await e(),r=or(t).format;if(r!=="jsonc")throw Error(`json() requires a jsonc secret; received ${r}`);return Vr(t,r)},async bytes(){let t=await e(),r=or(t).format;if(r==="binary")return Vr(t,r);return new TextEncoder().encode(Kn(t,r))},async env(){let t=await e(),r=or(t).format;if(r!=="env")throw Error(`env() requires an env secret; received ${r}`);return Vr(t,r)},async metadata(){return(await e()).metadata},async parse(t){let r=await e();return Cu(r,t),Iu(t,Vr(r,t.format))}}}function Gs(e){try{return new URL(e).pathname}catch{return e.startsWith("/")?e:`/${e}`}}var Au=1e4,_u=1e4,Lu=300,Hs=100;async function Gn(e){await new Promise((t)=>setTimeout(t,e))}function Me(e){return{startedAt:Date.now(),timeout:typeof e?.timeout==="number"&&e.timeout>0?e.timeout:void 0}}function Fn(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function ir(e){if(e.timeout===void 0)return;let t=Date.now()-e.startedAt;return Math.max(0,e.timeout-t)}function nt(e,t,r){return Error(`LFV ${e} timed out after ${r.timeout??0}ms for ${t}`)}async function Dt(e,t,r,n,o){let s=ir(r);if(s!==void 0){if(s<=0)throw nt(n,o,r);let i=new AbortController,c=setTimeout(()=>i.abort(),s);try{return await fetch(e,{...t,signal:i.signal})}catch(d){if(d instanceof Error&&d.name==="AbortError")throw nt(n,o,r);throw d}finally{clearTimeout(c)}}return await fetch(e,t)}class _e extends Xs{constructor(e){super(`LFV source closed while operating on ${e}`,{status:503,statusText:"unavailable"});this.name="LfvSourceClosedError"}}class rt extends Xs{constructor(e,t){super(e,{status:Qe(t),upstreamStatus:t});this.name="LfvProtocolError"}}class vt extends rt{constructor(e,t,r){super(`LFV ${t} failed (${e}) for ${r}`,e);this.name="LfvActionStatusError";if(e===404)this.code="not_found"}}var xu=new Set([400,401,403,404,409,410]);function Js(e){return e instanceof rt&&(!(e instanceof vt)||e.upstreamStatus!==void 0&&xu.has(e.upstreamStatus))}function Br(e){return e instanceof _e||e instanceof Error&&e.name==="LfvSourceClosedError"}function Uu(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`LFV kms_park returned invalid payload for ${t}`);let r=e;if(typeof r.parked!=="boolean")throw Error(`LFV kms_park returned invalid payload for ${t}`);let n=r.disposition;if(n!==void 0&&n!=="cooldown"&&n!=="suspect")throw Error(`LFV kms_park returned invalid disposition for ${t}`);return{parked:r.parked,...r.stale===!0?{stale:!0}:{},...n?{disposition:n}:{}}}function sr(e){try{let t=JSON.parse(e);return typeof t==="object"&&t!==null&&!Array.isArray(t)?t:void 0}catch{return}}async function Vn(e,t,r,n,o,s,i,c,d,u){let l=0,y=Date.now();for(;;){if(u?.())throw new _e(n);let p=ir(r);if(p!==void 0&&p<=0)throw nt(o,n,r);try{return await e()}catch(b){if(b instanceof _e)throw b;if(u?.())throw new _e(n);if(l+=1,i>0&&Date.now()-y>=i){let _=`Error connecting to the LFV source. Retries: '${l}'`;if(c)c(d,_,{url:t,path:n,operation:o});y=Date.now()}let M=p===void 0?s:Math.min(s,p);if(M<=0)throw nt(o,n,r);if(await Gn(M),u?.())throw new _e(n)}}}function Mu(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function zn(e){if(typeof e==="number"&&Number.isFinite(e))return e;if(typeof e==="string"&&e.trim()){let t=Date.parse(e.trim());if(!Number.isNaN(t))return t}return}function Ys(e){return`[LFV] [${e??"-"}] [${new Date().toISOString()}]: `}function Bn(e,t){if(typeof e!=="string"||e.trim()==="")throw Error(`LFV source requires "${t}"`);return e}function qu(e){return{...e,lfvServerUrl:Bn(e.lfvServerUrl,"lfvServerUrl"),clientId:Bn(e.clientId,"clientId"),path:Bn(e.path,"path")}}function kt(e,t,r={}){let n=qu(e),o=n.log??Pu,s=(h,x,j)=>{let B=Ys(h)+x;if(j!==void 0)o.debug(B,j);else o.debug(B)},i=(h,x,j)=>{let B=Ys(h)+x;if(j!==void 0)o.warn(B,j);else o.warn(B)},{lfvServerUrl:c,clientId:d,path:u,verifyJwks:l}=n,y=typeof n.deliveryTimeout==="number"&&n.deliveryTimeout>0?n.deliveryTimeout:void 0,p=typeof n.retryInterval==="number"&&n.retryInterval>0?n.retryInterval:Au,b=typeof n.warnInterval==="number"&&n.warnInterval>=0?n.warnInterval:_u,M=(typeof n.callbackMaxAgeSeconds==="number"&&n.callbackMaxAgeSeconds>0?n.callbackMaxAgeSeconds:Lu)*1000,_=typeof n.cacheMaxAgeSeconds==="number"&&n.cacheMaxAgeSeconds>0?n.cacheMaxAgeSeconds*1000:void 0,R=l?.trim()?Eu(l.trim()):void 0,W=Gs(n.deliveryEndpoint),q=Gs(n.eventsEndpoint),a=Fr({lfvServerUrl:c,path:u}),w=crypto.randomUUID(),v=new Map,L=new Set,H=new Map,J=new Map,Y=new Map,re=new Map,ue=new Map,se=new Map,K=new Map,ee=(h,x)=>{if(typeof x==="number"&&Number.isInteger(x)&&x>=1){let j=K.get(h)??1,B=Math.max(j,x);return K.set(h,B),B}return K.get(h)},z=(h,x)=>typeof x==="number"&&Number.isInteger(x)&&x>=1&&x>(K.get(h)??1),D=new Map,Q=new Map,ne=!1,ie,ce=new Set,ae=()=>ne;function C(h,x){H.set(h,x),J.set(h,Date.now())}function g(h){H.delete(h),J.delete(h)}function P(h){let x=H.get(h);if(!x)return;if(_!==void 0){let j=J.get(h)??0;if(Date.now()-j>_){s(void 0,"cache hit ignored: stale (older than cacheMaxAgeSeconds)",{path:h});return}}return x}function I(){return L.size>0||v.size>0||se.size>0}function U(){if(ne){if(ie)ie(),ie=void 0;return}let h=I();if(h&&!ie)ie=$s(a,w,{trustId:R,onDelivery:async(x)=>Qo(x).handled||await ts(x),onEvents:async(x)=>{rs(x)}});if(!h&&ie)ie(),ie=void 0}async function E(h,x,j,B){if(!t)throw Error("LFV callback transport is not configured");for(;;){if(ne)throw new _e(x);if(B())throw new _e(x);let X=await t.take(h);if(X){if(X.key!==a)i(h,"parked OTP callback rejected: callback key mismatch");else if(!await vn(X.rawBody,X.headers)){let pe=sr(X.rawBody);if(pe?.type==="otp"&&pe.request_id===h&&typeof pe.otp==="string"&&pe.otp)return pe.otp}}let G=ir(j);if(G!==void 0&&G<=0)throw nt("issueOtp",x,j);await Gn(G===void 0?Hs:Math.min(Hs,G))}}async function F(h,x){let j=x??crypto.randomUUID(),B={startedAt:Date.now(),timeout:y},X={request_id:j,path:h,action:"read_secret",...Fn(ee(h))},G=await Vn(()=>Dt(`${c.replace(/\/+$/g,"")}/clients/${d}/otp`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":j},body:JSON.stringify(X)},B,"issueOtp",h),c,B,h,"issueOtp",p,b,i,j,ae);if(G.status!==200&&G.status!==202)throw new vt(G.status,"issueOtp",h)}async function S(h,x){let j=Q.get(h);if(j)return j;let B=F(h,x);Q.set(h,B);try{await B}finally{if(Q.get(h)===B)Q.delete(h)}}async function O(h,x,j,B){if(ne)throw new _e(h);let X=j??crypto.randomUUID(),G=B??Me(),de=new Promise((Ue,Zt)=>{let ns={resolve:Ue,reject:Zt},kn=ir(G);if(kn!==void 0){if(kn<=0){Zt(nt("issueOtp",h,G));return}ns.timer=setTimeout(()=>{se.delete(X),U(),Zt(nt("issueOtp",h,G))},kn)}se.set(X,ns),U()});de.catch(()=>{});let pe=()=>{let Ue=se.get(X);if(!Ue)return;if(Ue.timer)clearTimeout(Ue.timer);se.delete(X),U()},le={request_id:X,path:h,action:x,...Fn(ee(h))};s(X,"OTP request",{path:h,action:x});let ve;try{ve=await Vn(async()=>await Dt(`${c.replace(/\/+$/g,"")}/clients/${d}/otp`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":X},body:JSON.stringify(le)},G,"issueOtp",h),c,G,h,"issueOtp",p,b,i,X,ae)}catch(Ue){throw pe(),Ue}if(ve.status!==200&&ve.status!==202)throw pe(),new vt(ve.status,"issueOtp",h);let Ce=!1,ke=t?E(X,h,G,()=>Ce):void 0;if(ke)ke.catch(()=>{});try{let Ue=await(ke?Promise.race([de,ke]):de);return s(X,"OTP received via signed callback",{path:h,action:x}),Ue}finally{Ce=!0,pe()}}async function k(h,x,j,B,X,G,de){if(ne)throw new _e(x);let pe=de??Me(),le=await Vn(async()=>await Dt(`${c.replace(/\/+$/g,"")}${h}`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":X},body:JSON.stringify({request_id:X,otp:B,path:x,...Fn(ee(x)),...G??{}})},pe,j,x),c,pe,x,j,p,b,i,X,ae);if(le.status!==200&&le.status!==202)throw new vt(le.status,j,x);return s(X,`${j} accepted`,{path:x,status:le.status}),le}async function m(h,x,j,B,X,G){if(ne)throw new _e(x);let de=X??crypto.randomUUID(),pe=G??Me(),le=await O(x,j,de,pe),ve=await k(h,x,j,le,de,B,pe);return{requestId:de,response:ve}}async function f(h,x,j){if(ne)throw new _e(h);let B=z(h,j?.kmsSlots);if(ee(h,j?.kmsSlots),B)g(h);let X=P(h);if(X)return X;let G=D.get(h);if(G){if(!B)return G;if(await G.catch(()=>{return}),G=D.get(h),G)return G}let de=T(h,x,j);D.set(h,de),de.catch((pe)=>{if(Br(pe))s(x,"read aborted: source closed",{path:h})});try{return await de}finally{D.delete(h)}}async function T(h,x,j){let B=j?.timeout??y,X={startedAt:Date.now(),timeout:typeof B==="number"&&B>0?B:void 0},G=x??crypto.randomUUID();s(G,"read_secret request",{path:h});let de=0,pe=Date.now();for(;;){if(ne)throw new _e(h);try{let{response:le}=await m("/secrets/request",h,"read_secret",void 0,G,X),ve=await A(G,le),Ce=N(h,ve);return Z(h,Ce,Ce.metadata.version),s(G,"read_secret completed from action response",{path:h}),Ce}catch(le){if(le instanceof _e)throw le;if(Js(le))throw le;let ve=ir(X);if(ve!==void 0&&ve<=0)throw nt("read_secret",h,X);if(de+=1,b>0&&Date.now()-pe>=b)i(G,`read_secret retrying. Retries: '${de}'`,{path:h}),pe=Date.now();let Ce=ve===void 0?p:Math.min(p,ve);if(Ce<=0)throw nt("read_secret",h,X);await Gn(Ce)}}}async function A(h,x){if(!l?.trim())throw new rt("LFV read_secret response verification is not configured");let j=x.headers.get("X-LFV-Request-Id")?.trim(),B=x.headers.get("X-LFV-Key-Id")?.trim(),X=x.headers.get("X-LFV-Signature")?.trim();if(!j||!B||!X)throw new rt("LFV read_secret response is missing signature headers");if(j!==h)throw new rt("LFV read_secret response request_id header does not match the request");let G=await x.text();if(!await Bs({jwks:l,kid:B,signatureB64Url:X,requestId:h,rawBody:G}))throw new rt("LFV read_secret response signature verification failed");let pe=sr(G);if(!pe||pe.request_id!==h)throw new rt("LFV read_secret response request_id does not match the request");return pe}function N(h,x){if(Zo(x)!==h||x.data?.data===void 0)throw new rt(`LFV read_secret returned an invalid secret response for ${h}`);let B=x.data.metadata??{},X=typeof B.version==="number"?B.version:0,G=B.created_time??B.created,de=St(B);return{data:x.data.data,metadata:{path:h,version:X,created:typeof G==="string"?new Date(G):new Date,...de?{contentType:de}:{}}}}function Z(h,x,j){if(j!==void 0){let G=re.get(h);if(G!==void 0&&j<G){s(void 0,"delivery ignored: stale version",{path:h,realVersion:j,lastAccepted:G});return}re.set(h,j)}C(h,x),ce.delete(h);let B=x.metadata.version;if(Y.get(h)===B)return;Y.set(h,B);let X=v.get(h);if(!X)return;for(let G of X)G(x)}async function V(h,x){return await f(h,void 0,x)}async function oe(h,x,j){if(!Mu(x))throw Error(`putSecret requires an object value for LFV source at path ${h}`);let B=Me(j),X={data:x,content_type:Kr(j.contentType)};if(await fe(h,j)){await m("/secrets/update",h,"update_secret",X,void 0,B),g(h);return}await m("/secrets/create",h,"create_secret",X,void 0,B),g(h)}async function te(h,x){let j=Me(x);await m("/secrets/delete",h,"delete_secret",void 0,void 0,j),g(h)}async function ge(h,x){let j=Me(x),B=crypto.randomUUID();s(B,"list_paths request",{path:h});let X=await O(h,"list_paths",B,j),G=await Dt(`${c.replace(/\/+$/g,"")}/paths/list`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":B},body:JSON.stringify({request_id:B,otp:X,path:h})},j,"listPaths",h);if(G.status!==200)throw Error(`LFV listPaths failed (${G.status}) for ${h}`);let de=await $t(G,{log:o,operation:"lfv.paths.list",redact:!0});if(!Array.isArray(de.items))throw Error(`LFV listPaths returned invalid payload for ${h}`);return s(B,"list_paths success",{path:h,status:200}),de.items.filter((pe)=>typeof pe==="string")}async function fe(h,x){let j=Me(x),B=crypto.randomUUID();s(B,"exists request",{path:h});let X=await O(h,"read_metadata",B,j),G=await Dt(`${c.replace(/\/+$/g,"")}/paths/exists`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":B},body:JSON.stringify({request_id:B,otp:X,path:h})},j,"exists",h);if(G.status!==200)throw Error(`LFV exists failed (${G.status}) for ${h}`);let de=await $t(G,{log:o,operation:"lfv.paths.exists",redact:!0});if(typeof de.exists!=="boolean")throw Error(`LFV exists returned invalid payload for ${h}`);return s(B,"exists success",{path:h,status:200,exists:de.exists}),de.exists}async function Ye(h,x,j){let B=Me(j);await m("/secrets/rotate/request",h,"request_rotate",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,B)}async function Pe(h,x,j){let B=Me(j);await m("/secrets/revoke/request",h,"request_revoke",{reason:x?.reason,severity:x?.severity,incident_ref:x?.incidentRef},void 0,B)}async function gt(h,x,j){let B=Me(j),{response:X}=await m("/secrets/kms/park",h,"kms_park",{key_id:x.keyId,status:x.status,reason:x.reason},void 0,B);return Uu(await $t(X,{log:o,operation:"lfv.kms.park",redact:!0}).catch(()=>null),h)}function Ya(h,x){if(!h||typeof h!=="object"||Array.isArray(h))throw Error(`LFV kms_add_keys returned invalid payload for ${x}`);let j=h;if(!Array.isArray(j.keys))throw Error(`LFV kms_add_keys returned invalid payload for ${x}`);return{keys:j.keys.map((X,G)=>{if(!X||typeof X!=="object"||Array.isArray(X))throw Error(`LFV kms_add_keys returned invalid keys[${G}] for ${x}`);let de=X.id;if(typeof de!=="string"||de.length===0)throw Error(`LFV kms_add_keys returned invalid keys[${G}].id for ${x}`);return{id:de}})}}function Xa(h,x){if(!h||typeof h!=="object"||Array.isArray(h))throw Error(`LFV kms_revoke_key returned invalid payload for ${x}`);let j=h;if(typeof j.revoked!=="boolean")throw Error(`LFV kms_revoke_key returned invalid payload for ${x}`);return{revoked:j.revoked}}async function Za(h,x,j){let B=Me(j),{response:X}=await m("/secrets/kms/add-keys",h,"kms_add_keys",{keys:x.keys},void 0,B);return Ya(await $t(X,{log:o,operation:"lfv.kms.add_keys",redact:!0}).catch(()=>null),h)}async function Qa(h,x,j){let B=Me(j),{response:X}=await m("/secrets/kms/revoke-key",h,"kms_revoke_key",{key_id:x.keyId,reason:x.reason},void 0,B);return Xa(await $t(X,{log:o,operation:"lfv.kms.revoke_key",redact:!0}).catch(()=>null),h)}async function ec(h,x){let j=Me(x),B=crypto.randomUUID();s(B,"getMetadata request",{path:h});let X=await O(h,"read_metadata",B,j),G=await Dt(`${c.replace(/\/+$/g,"")}/paths/metadata/read`,{method:"POST",headers:{...Nt,...Ee,"X-LFV-Request-Id":B},body:JSON.stringify({request_id:B,otp:X,path:h})},j,"getMetadata",h);if(G.status!==200)throw Error(`LFV getMetadata failed (${G.status}) for ${h}`);let de=await $t(G,{log:o,operation:"lfv.metadata.read",redact:!0});if(!de.metadata||typeof de.metadata!=="object")throw Error(`LFV getMetadata returned invalid payload for ${h}`);return s(B,"getMetadata success",{path:h,status:200}),de.metadata}async function Xo(h,x,j,B=!0){let X=v.get(h)??new Set,G,de=(le)=>{if(le.metadata.version===G)return;G=le.metadata.version,x(le)};if(X.add(de),v.set(h,X),!B)return U(),()=>{let le=v.get(h);if(!le)return;if(le.delete(de),le.size===0)v.delete(h);U()};let pe=z(h,j?.kmsSlots)?void 0:P(h);if(pe)de(pe),Y.set(h,pe.metadata.version);else try{de(await V(h,j))}catch(le){if(X.delete(de),X.size===0)v.delete(h);throw le}return U(),()=>{let le=v.get(h);if(!le)return;if(le.delete(de),le.size===0)v.delete(h);U()}}let tc=(h,x)=>Xo(h,x,void 0,!1);function rc(h){return h.method==="POST"&&new URL(h.url).pathname===W}function nc(h){return h.method==="POST"&&new URL(h.url).pathname===q}function Zo(h){let x=h.data?.metadata?.path;if(typeof x==="string"&&x)return x;if(typeof h.path==="string"&&h.path)return h.path;return}function oc(h){let{request_id:x,otp:j}=h;if(typeof x!=="string"||typeof j!=="string"||!j)return{handled:!1};let B=se.get(x);if(!B)return{handled:!1};if(B.timer)clearTimeout(B.timer);return se.delete(x),U(),B.resolve(j),{handled:!0}}function Qo(h){return h.type==="otp"?oc(h):{handled:!1}}function ut(h="Invalid or missing LFV callback signature"){return new Response(JSON.stringify({error:"invalid_signature",message:h}),{status:401,headers:Ee})}function es(h){return{requestId:h.headers.get("X-LFV-Request-Id")??h.headers.get("x-lfv-request-id")??"",keyId:h.headers.get("X-LFV-Key-Id")??h.headers.get("x-lfv-key-id")??"",signature:h.headers.get("X-LFV-Signature")??h.headers.get("x-lfv-signature")??""}}async function vn(h,x){if(!l?.trim())return i(void 0,"LFV callback rejected: verifyJwks is not configured"),ut("LFV callback verification is not configured");let{requestId:j,keyId:B,signature:X}=x;if(!j.trim()||!B.trim()||!X.trim())return i(j||void 0,"LFV callback rejected: missing signature headers"),ut("Missing X-LFV-Request-Id, X-LFV-Key-Id, or X-LFV-Signature");if(!await Bs({jwks:l,kid:B,signatureB64Url:X.trim(),requestId:j.trim(),rawBody:h}))return i(j,"LFV callback rejected: signature verification failed"),ut();let de=sr(h);if(!de)return new Response(JSON.stringify({error:"invalid_request",message:"Invalid JSON body"}),{status:400,headers:Ee});let pe=de;if(pe.request_id!==j.trim())return i(j,"LFV callback rejected: request_id header/body mismatch"),ut("X-LFV-Request-Id does not match request_id in body");let le=Date.now(),ve=zn(pe.issued_at);if(ve===void 0)return i(j,"LFV callback rejected: missing or invalid issued_at"),ut("Missing or invalid issued_at");if(le-ve>M)return i(j,"LFV callback rejected: stale (outside freshness window)"),ut("Callback is stale (issued_at outside freshness window)");let Ce=zn(pe.expires_at);if(Ce!==void 0&&le>Ce)return i(j,"LFV callback rejected: expired"),ut("Callback has expired");let ke=X.trim();for(let[Ue,Zt]of ue)if(Zt<=le)ue.delete(Ue);if(ue.has(ke))return i(j,"LFV callback rejected: replayed signature"),ut("Callback signature already processed (replay)");return ue.set(ke,ve+M),null}async function ts(h){if(!r.selfRedeemReads||h.action!=="read_secret"||typeof h.request_id!=="string"||typeof h.path!=="string"||typeof h.otp!=="string")return!1;let x={startedAt:Date.now(),timeout:y},j=await k("/secrets/request",h.path,"read_secret",h.otp,h.request_id,void 0,x),B=await A(h.request_id,j),X=N(h.path,B);return Z(h.path,X,X.metadata.version),!0}async function sc(h){let x=await h.text(),j=es(h),B=await vn(x,j);if(B)return B;let X=sr(x);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:Ee});let G=X;if(G.type!=="otp"||typeof G.request_id!=="string"||typeof G.otp!=="string"||typeof G.path!=="string"||typeof G.action!=="string")return Response.json({error:"invalid_request",message:"LFV delivery callbacks carry OTP work items only"},{status:400});let de=Zo(G);s(G.request_id,"delivery received",{path:de});let pe=Qo(G),le=de?Fr({lfvServerUrl:c,path:de}):a,ve=await Ds(le,G,w,R),Ce=pe.handled||ve>0;if(!Ce)try{if(Ce=await ts(G),!Ce&&t&&typeof G.request_id==="string"){let ke=zn(G.expires_at),Ue=Math.max(1,(ke??Date.now()+M)-Date.now());await t.put(G.request_id,{kind:"delivery",key:le,rawBody:x,headers:j},Ue),Ce=!0}}catch(ke){if(Js(ke)){if(!(ke instanceof vt)||ke.upstreamStatus!==409&&ke.upstreamStatus!==410)ce.add(G.path);return i(j.requestId,"LFV callback reached a terminal state; callback accepted without retry",{key:le,upstreamStatus:ke instanceof vt?ke.upstreamStatus:void 0}),new Response(JSON.stringify({status:"accepted",note:"terminal_delivery"}),{status:200,headers:Ee})}return ue.delete(j.signature.trim()),i(j.requestId,"LFV callback handoff failed; callback may be retried",{key:le,error:ke instanceof Error?ke.message:String(ke)}),new Response(JSON.stringify({error:"callback_handoff_unavailable"}),{status:503,headers:Ee})}if(!Ce)return ue.delete(j.signature.trim()),i(j.requestId,"LFV OTP callback is unroutable: no local waiter, no in-process owner, and no callback transport",{key:le}),new Response(JSON.stringify({error:"callback_unroutable"}),{status:503,headers:Ee});return new Response(JSON.stringify({status:"accepted"}),{status:200,headers:Ee})}function rs(h){if(ne)return;if(!h?.path||typeof h.path!=="string")return;s(h.request_id,"events payload",{path:h.path,event:h.event});for(let x of L)try{x({path:h.path,event:h.event,requestId:h.request_id,issuedAt:h.issued_at,expiresAt:h.expires_at,...typeof h.key_id==="string"&&h.key_id.length>0?{keyId:h.key_id}:{}})}catch(j){i(h.request_id,"secret event listener failed",{path:h.path,event:h.event,error:j instanceof Error?j.message:String(j)})}if(h.event==="created"||h.event==="updated"||h.event==="rotated")g(h.path),(r.selfRedeemReads?S(h.path,h.request_id):f(h.path,h.request_id).then(()=>{return})).catch((j)=>{if(Br(j)){s(h.request_id,"event refresh aborted: source closed",{path:h.path});return}ce.add(h.path),i(h.request_id,"event-triggered refresh failed; source marked degraded",{path:h.path,event:h.event,error:j instanceof Error?j.message:String(j)})})}async function ic(h){let x=await h.text(),j=es(h),B=await vn(x,j);if(B)return B;let X=sr(x);if(!X)return new Response(JSON.stringify({error:"invalid_request",message:"malformed callback body"}),{status:400,headers:Ee});let G=X;if(!G?.path||typeof G.path!=="string")return new Response(JSON.stringify({error:"invalid_request",message:"path is required"}),{status:400,headers:Ee});s(G.request_id,"events received",{path:G.path,event:G.event}),rs(G);let de=Fr({lfvServerUrl:c,path:G.path});return await Ks(de,G,w,R),new Response(JSON.stringify({status:"accepted"}),{status:200,headers:Ee})}function ac(){if(ne)return;if(ne=!0,ie)ie(),ie=void 0;let h=new _e(u);for(let x of se.values()){if(x.timer)clearTimeout(x.timer);try{x.reject(h)}catch{}}se.clear(),D.clear(),Q.clear(),ce.clear(),H.clear(),J.clear(),Y.clear(),re.clear(),ue.clear(),v.clear(),L.clear()}return{type:"vault",origin:{transport:"lfv",url:Ou(c)},isAvailable:()=>ce.size===0,get:(h,x)=>Ge(()=>V(h,x)),getFullSecret:V,getSecret:async(h,x)=>(await V(h,x)).data,putSecret:oe,deleteSecret:te,listPaths:ge,exists:fe,requestRotate:Ye,requestRevoke:Pe,parkKmsKey:gt,addKmsKeys:Za,revokeKmsKey:Qa,getMetadata:ec,subscribe:Xo,subscribePassive:tc,subscribeEvents:(h)=>(L.add(h),U(),()=>{L.delete(h),U()}),close:ac,isDeliveryRequest:rc,isEventsRequest:nc,handleDelivery:sc,handleEvents:ic,deliveryPath:W,eventsPath:q,callbackKey:a,trustId:R}}function bt(e,t,r){if(typeof e!=="string"||e.trim()==="")throw Error(`"${t}" is required when using ${r}`);return e}var Kt="__esLfvBootstrap";import{IoniteError as ti}from"@ionite/core";var Wu=new Set(["ready","isReady","describe","close","beforeChange","afterChange","then"]),Zs=new WeakMap,Qs=new WeakMap;function ei(e,t){let r=Qs.get(t);if(!r)r=new WeakMap,Qs.set(t,r);let n=r.get(e);if(n)return n;let o=e.then((s)=>Hn(s)?ar(s,t):s,(s)=>{throw ti.from(s,t())});return r.set(e,o),o}function Hn(e){return typeof e==="object"&&e!==null&&typeof e.isReady==="function"}function ju(e,t,r){return(...n)=>{try{let o=e.apply(t,n);if(o instanceof Promise)return ei(o,r);if(o&&typeof o.then==="function")return ei(Promise.resolve(o),r);return Hn(o)?ar(o,r):o}catch(o){throw ti.from(o,r())}}}function ar(e,t){let r=Zs.get(t);if(!r)r=new WeakMap,Zs.set(t,r);let n=r.get(e);if(n)return n;let o=new WeakMap,s=new Proxy(e,{get(i,c,d){if(typeof c==="symbol")return Reflect.get(i,c,d);let u=Reflect.get(i,c,d);if(typeof u==="function"){if(Wu.has(c))return u;let l=o.get(u);if(!l)l=ju(u,i,t),o.set(u,l);return l}if(Hn(u)&&u!==i)return ar(u,t);return u}});return r.set(e,s),s}import{catalogEntityStore as Hr,listGenerator as dr,materializeCodeCatalogEntity as Vu,unionCatalogRead as zu}from"@ionite/core";import{baseCustomerToScim as si,baseUserToScimUser as ii,baseWorkloadToScim as ai,entitlementToScimGroup as Xn}from"@ionite/core/server";import{ACCEPT_SCIM as Nu,CONTENT_TYPE_SCIM as $u,ION_AUTHZ_GROUP_SCHEMA as Jn,isJsonResponse as ni,readJsonResponse as ri,unexpectedBodySummary as oi}from"@ionite/core";var Du="urn:ietf:params:scim:api:messages:2.0:PatchOp",Ku="urn:ietf:params:scim:schemas:core:2.0:User",Fu="urn:ietf:params:scim:schemas:core:2.0:Group";async function cr(e){try{if(ni(e)){let r=(await e.clone().text()).trim();return r?r.slice(0,2000):void 0}let t=await oi(e.clone());return[t.contentType,t.excerpt].filter(Boolean).join(": ")||void 0}catch{return}}function ur(e){if(e==="user")return"Users";if(e==="workload")return"Workloads";if(e==="customer")return"Customers";return"Groups"}function Yn(e){return e.replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}class Gr{constructor(e){this.inflight=new Map;this.memo=new Map;this.writes=new Map;this.baseUrl=e.baseUrl.replace(/\/$/,""),this.getToken=e.getToken,this.receipts=e.receipts,this.log=e.log,this.fetchImpl=e.fetchImpl??((t,r)=>fetch(t,r))}async headers(){let e=await this.getToken();return new Headers({...$u,...Nu,Authorization:`Bearer ${e}`})}inflightKey(e,t,r){return`${e}\x00${t}\x00${r?"create":"lookup"}`}receiptKey(e,t){return`${e}\x00${t}`}serializeWrite(e,t,r){let n=`${e}\x00${t}`,s=(this.writes.get(n)??Promise.resolve()).catch(()=>{return}).then(r);this.writes.set(n,s);let i=()=>{if(this.writes.get(n)===s)this.writes.delete(n)};return s.then(i,i),s}async resolveProviderId(e,t,r){let n=this.receiptKey(e,t),o=this.memo.get(n);if(o)return{found:o.providerId,requestUrl:o.requestUrl};let s=await this.receipts.read(e,t);if(s)this.memo.set(n,s);if(s)return{found:s.providerId,requestUrl:s.requestUrl};let i=this.inflightKey(e,t,r!==void 0),c=this.inflight.get(i);if(c)return c;let d=this.resolveUncached(e,t,r).then(async(u)=>{if(typeof u==="object"){let l={providerId:u.found,...u.requestUrl?{requestUrl:u.requestUrl}:{}};await this.receipts.write(e,t,l),this.memo.set(n,l)}return u}).finally(()=>{this.inflight.delete(i)});return this.inflight.set(i,d),d}async resolveUncached(e,t,r){let n=await this.filterByExternalId(e,t);if(n!=="absent")return n;if(!r)return"absent";return this.create(e,t,r)}async filterByExternalId(e,t){let r=encodeURIComponent(`externalId eq "${Yn(t)}"`),n=`${this.baseUrl}/${ur(e)}?filter=${r}`,o=await this.fetchImpl(n,{method:"GET",headers:await this.headers()});if(!o.ok)return this.log.warn("IAM delta: externalId filter lookup failed",{"ion.operation":"iam.delta.resolve","ion.outcome":"failure",resourceType:e,status:o.status,detail:await cr(o)}),"error";let i=((await ri(o,{log:this.log,operation:"iam.delta.resolve"})).Resources??[])[0];return i?.id?{found:i.id,...this.requestUrl(e,i)}:"absent"}async create(e,t,r){let n=`${this.baseUrl}/${ur(e)}`,o=this.writeBody(e,t,r),s=await this.fetchImpl(n,{method:"POST",headers:await this.headers(),body:JSON.stringify(o)});if(!s.ok)return this.log.warn("IAM delta: create-on-empty failed",{"ion.operation":"iam.delta.create","ion.outcome":"failure",resourceType:e,status:s.status,detail:await cr(s)}),"error";let i=await ri(s,{log:this.log,operation:"iam.delta.create"});return i.id?{found:i.id,...this.requestUrl(e,i),created:!0}:"error"}requestUrl(e,t){if(e!=="group")return{};let r=t[Jn];if(!r||typeof r!=="object")return{};let n=r.requestUrl;return typeof n==="string"&&n?{requestUrl:n}:{}}async captureResponseReference(e,t,r,n,o){if(e.status===204)return;if(!ni(e)){let s=await oi(e.clone());if(s.excerpt)this.log.warn("SCIM destination returned a non-JSON body on a successful write",{"ion.operation":"iam.delta.receipt","ion.outcome":"degraded",reason:"non_json_response",status:e.status,contentType:s.contentType,excerpt:s.excerpt});return}try{let s=await e.clone().json(),i=this.requestUrl(t,s).requestUrl;if(!i&&s.id===void 0)return;let c=i??o,d={providerId:s.id??n,...c?{requestUrl:c}:{}};await this.receipts.write(t,r,d),this.memo.set(this.receiptKey(t,r),d)}catch{}}async invalidate(e,t){this.memo.delete(this.receiptKey(e,t)),await this.receipts.clear(e,t)}writeBody(e,t,r){let{id:n,meta:o,...s}=r,i=s,c=i[Jn];if(c&&typeof c==="object"&&!Array.isArray(c)){let{providerId:d,requestUrl:u,...l}=c;i[Jn]=l}return{...i,schemas:(r.schemas?.length??0)>0?r.schemas:[e==="user"?Ku:Fu],externalId:t}}async upsertResource(e,t,r){return this.serializeWrite(e,t,()=>this.upsertResourceNow(e,t,r))}async upsertResourceNow(e,t,r){let n=async(s)=>{let i=await this.resolveProviderId(e,t,s?r:void 0);if(i==="error")return"error";if(i==="absent")return"skipped";if(i.created)return"pushed";let c=await this.fetchImpl(`${this.baseUrl}/${ur(e)}/${encodeURIComponent(i.found)}`,{method:"PUT",headers:await this.headers(),body:JSON.stringify(this.writeBody(e,t,r))});if(c.status===404||c.status===410)return"stale";if(c.ok)return await this.captureResponseReference(c,e,t,i.found,i.requestUrl),"pushed";return this.log.warn("IAM delta: resource upsert failed",{"ion.operation":"iam.delta.upsert","ion.outcome":"failure",resourceType:e,status:c.status,detail:await cr(c)}),"error"},o=await n(!0);if(o==="stale")await this.invalidate(e,t),o=await n(!0);return o==="stale"?"error":o}async deleteResource(e,t){return this.serializeWrite(e,t,()=>this.deleteResourceNow(e,t))}async deleteResourceNow(e,t){let r=async()=>{let o=await this.resolveProviderId(e,t);if(o==="error")return{outcome:"error"};if(o==="absent")return{outcome:"pushed"};let s=await this.fetchImpl(`${this.baseUrl}/${ur(e)}/${encodeURIComponent(o.found)}`,{method:"DELETE",headers:await this.headers()});if(s.status===404||s.status===410)return{outcome:"pushed",stale:!0};if(s.ok)return{outcome:"pushed"};return this.log.warn("IAM delta: resource delete failed",{"ion.operation":"iam.delta.delete","ion.outcome":"failure",resourceType:e,status:s.status,detail:await cr(s)}),{outcome:"error"}},n=await r();if(n.stale)await this.invalidate(e,t),n=await r();if(n.outcome==="pushed")await this.invalidate(e,t);return n.outcome}async patchGroupMembership(e){return this.serializeWrite("group",e.groupExternalId,()=>this.patchGroupMembershipNow(e))}async patchGroupMembershipNow(e){let{groupExternalId:t,userExternalId:r,op:n}=e,o=e.subjectResourceType??"user",s=await this.resolveProviderId(o,r,n==="add"?e.userCreate:void 0);if(s==="error")return this.log.warn("IAM delta: principal lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,subjectResourceType:o}),"error";if(s==="absent")return this.log.warn("IAM delta: principal not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n,subjectResourceType:o}),"skipped";let i=s.found,c=async(l)=>{let y=await this.resolveProviderId("group",t,n==="add"&&l?e.groupCreate:void 0);if(y==="error")return{kind:"error"};if(y==="absent")return{kind:"absent"};let p=`${this.baseUrl}/${ur("group")}/${encodeURIComponent(y.found)}`,b=n==="add"?[{op:"add",path:"members",value:[{value:i,type:e.memberType??"User"}]}]:[{op:"remove",path:`members[value eq "${Yn(i)}"]`}];return{kind:"response",response:await this.fetchImpl(p,{method:"PATCH",headers:await this.headers(),body:JSON.stringify({schemas:[Du],Operations:b})}),providerId:y.found,requestUrl:y.requestUrl}},d=await c(!0);if(d.kind==="response"&&(d.response.status===404||d.response.status===410))await this.invalidate("group",t),d=await c(!1);if(d.kind==="error")return this.log.warn("IAM delta: group lookup failed at destination; membership patch not attempted",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n}),"error";if(d.kind==="absent")return this.log.warn("IAM delta: group not resolvable at destination by externalId; skipping membership patch",{"ion.operation":"iam.delta.patch","ion.outcome":"skipped",op:n}),"skipped";let u=d.response;if(!u.ok)return this.log.warn("IAM delta: membership patch failed",{"ion.operation":"iam.delta.patch","ion.outcome":"failure",op:n,status:u.status,detail:await cr(u)}),"error";return await this.captureResponseReference(u,"group",t,d.providerId,d.requestUrl),"pushed"}}function Ft(e){if(typeof e==="string")return e;if(e&&typeof e==="object"&&"id"in e)return e.id;return}function lr(e){return e&&typeof e==="object"?e:void 0}function Zn(e){let t={},r={},n,o,s,i,c,d,u,l,y,p=()=>t.users==="patch"||t.workloads==="patch"||t.customers==="patch",b=(g)=>{if(g==="user")return t.users==="patch";if(g==="workload")return t.workloads==="patch";return t.customers==="patch"},M=()=>{if(!t.url)return"destination URL is not configured";if(!r.workload)return"workload identity is not configured";if(typeof r.workload.isReady!=="function"||typeof r.workload.ready!=="function")return"workload handle violates the readiness contract";if(!r.workload.isReady())return"workload module is not ready";if(t.audience){let g=r.workload[t.audience];if(!g)return`outgoing workload client "${t.audience}" is not configured`;if(typeof g.isReady!=="function"||typeof g.ready!=="function")return`outgoing workload client "${t.audience}" violates the readiness contract`;if(!g.isReady())return`outgoing workload client "${t.audience}" is not ready`}return},_=()=>{if(!p())return"no principal-kind delta mode is 'patch'";let g=M();if(g)return g;if(t.users==="patch"&&!r.userStore)return"user store is not configured for IAM destination receipts";if(t.workloads==="patch"&&!r.workloadIdentityStore)return"workload identity store is not configured for IAM destination receipts";if(t.customers==="patch"&&!r.customerStore)return"customer store is not configured for IAM destination receipts";if(!r.catalogStore)return"catalog store is not configured for IAM destination receipts";return},R=()=>_()===void 0,W=ye("IAM delta",R),q=async()=>{let g=r.workload;if(!g)throw Error("IAM delta: workload identity not configured");if(t.audience&&typeof g.getToken==="function")return g.getToken(t.audience);if(typeof g.getServerToken==="function")return g.getServerToken();return g.getToken()},a=()=>zu(r.codeCatalog,r.catalogStore),w=async(g,P)=>{let I=r.catalogStore;if(!I)return;let U=r.codeCatalog?.groups.get(g)??r.codeCatalog?.roles.get(g)??r.codeCatalog?.permissions.get(g);if(U){let F=r.codeCatalog?.groups.get(U.id)?"group":r.codeCatalog?.roles.get(U.id)?"role":"permission",S=Hr(I,F),O=await S.get(U.id);if(!O&&P)await Vu(F,U,S),O=await S.get(U.id);if(O)return{kind:F,entity:O}}let E=[["group",I.groups],["role",I.roles],["permission",I.permissions]];for(let[F,S]of E){let O=await S.get(g);if(O)return{kind:F,entity:O}}return},v=async(g)=>{let P=r.userStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);for await(let I of dr((U,E)=>P.list({start:U,limit:E})))if(I.externalId===g)return I;return},L=(g)=>g?.providerId?{providerId:g.providerId,...g.requestUrl?{requestUrl:g.requestUrl}:{}}:void 0,H=async(g)=>{let P=r.workloadIdentityStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);let I=await P.lookup({id:"",externalId:g});if(I)return I;for await(let U of dr((E,F)=>P.list({start:E,limit:F})))if(U.externalId===g)return U;return},J=async(g)=>{let P=r.customerStore;if(!P)return;if(P.getByExternalId)return P.getByExternalId(g);let I=await P.lookup({id:"",userName:"",name:"",email:"",externalId:g});if(I)return I;for await(let U of dr((E,F)=>P.list({start:E,limit:F})))if(U.externalId===g)return U;return},Y={async read(g,P){if(g==="user")return L(await v(P));if(g==="workload")return L(await H(P));if(g==="customer")return L(await J(P));return L((await w(P,!1))?.entity)},async write(g,P,I){if(g==="user"){let F=await v(P);if(!F||F.providerId===I.providerId&&F.requestUrl===I.requestUrl)return;await r.userStore?.upsert({...F,providerId:I.providerId,requestUrl:I.requestUrl});return}if(g==="workload"){let F=await H(P);if(!F||F.providerId===I.providerId&&F.requestUrl===I.requestUrl)return;await r.workloadIdentityStore?.upsert({...F,providerId:I.providerId,requestUrl:I.requestUrl});return}if(g==="customer"){let F=await J(P);if(!F||F.providerId===I.providerId&&F.requestUrl===I.requestUrl)return;await r.customerStore?.upsert({...F,providerId:I.providerId,requestUrl:I.requestUrl});return}let U=await w(P,!0);if(!U||U.entity.providerId===I.providerId&&U.entity.requestUrl===I.requestUrl)return;await Hr(r.catalogStore,U.kind).set({...U.entity,providerId:I.providerId,requestUrl:I.requestUrl}).ready()},async clear(g,P){if(g==="user"){let O=await v(P);if(!O||O.providerId===void 0&&O.requestUrl===void 0)return;let{providerId:k,requestUrl:m,...f}=O;await r.userStore?.upsert(f);return}if(g==="workload"){let O=await H(P);if(!O||O.providerId===void 0&&O.requestUrl===void 0)return;let{providerId:k,requestUrl:m,...f}=O;await r.workloadIdentityStore?.upsert(f);return}if(g==="customer"){let O=await J(P);if(!O||O.providerId===void 0&&O.requestUrl===void 0)return;let{providerId:k,requestUrl:m,...f}=O;await r.customerStore?.upsert(f);return}let I=await w(P,!1);if(!I||I.entity.providerId===void 0&&I.entity.requestUrl===void 0)return;let{providerId:U,requestUrl:E,...F}=I.entity;await Hr(r.catalogStore,I.kind).set(F).ready()}},re=()=>{if(!R()||!t.url)return;let g=t.url;if(n&&o===g&&s===r.catalogStore&&i===r.userStore&&c===r.workloadIdentityStore&&d===r.customerStore&&u===r.codeCatalog&&l===r.fetchImpl)return n;return n=new Gr({baseUrl:t.url,getToken:q,receipts:Y,log:e,fetchImpl:r.fetchImpl}),o=g,s=r.catalogStore,i=r.userStore,c=r.workloadIdentityStore,d=r.customerStore,u=r.codeCatalog,l=r.fetchImpl,n},ue=(g)=>g==="workload"?"Workload":g==="customer"?"Customer":"User",se=async(g)=>{if(g.subjectType==="workload"){let E=Ft(g.subject),F=lr(g.subject);if(!F&&E)F=await r.workloadIdentityStore?.get(E);let S=F?.externalId??F?.id??E;if(!F||!S)return;return{externalId:S,resourceType:"workload",create:await(r.mapWorkloadToScim?.({...F,externalId:S})??ai({...F,externalId:S}))}}if(g.subjectType==="customer"){let E=Ft(g.subject),F=lr(g.subject);if(!F&&E)F=await r.customerStore?.get(E);let S=F?.externalId??F?.id??E;if(!S)return;let O=F?await(r.mapCustomerToScim?.({...F,externalId:S})??si({...F,externalId:S})):{schemas:["urn:ionite:scim:schemas:core:2.0:Customer"],externalId:S,displayName:S,active:!0};return{externalId:S,resourceType:"customer",create:O}}let I=lr(g.subject);if(!I){let E=Ft(g.subject);if(E&&r.userStore)I=await r.userStore.get(E)}let U=I?.externalId;if(!I||!U)return;return{externalId:U,resourceType:"user",create:await(r.mapUserToScim?.(I)??ii(I))}},K=async(g)=>{let I=lr(g.target);if(!I){let U=Ft(g.target),E=a();if(U&&E)I=g.targetType==="role"?await E.roles.get(U):g.targetType==="permission"?await E.permissions.get(U):await E.groups.get(U)}if(I&&I.requestable!==!0)return"not-requestable";if(!I)return;return{externalId:I.id,create:Xn(I,g.targetType)}},ee=async(g,P)=>{if(!R())return"skipped";if(!b(g.subjectType==="workload"?"workload":g.subjectType==="customer"?"customer":"user"))return"skipped";let I=await se(g),U=await K(g);if(U==="not-requestable")return"skipped";if(!I||!U)return e.warn("IAM delta: subject is missing externalId or target is unresolved; skipping",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",op:P,hasSubject:Boolean(I),hasTarget:Boolean(U),targetType:g.targetType}),"skipped";let E=re();if(!E)return"skipped";return E.patchGroupMembership({groupExternalId:U.externalId,userExternalId:I.externalId,op:P,groupCreate:U.create,userCreate:I.create,memberType:ue(g.subjectType),subjectResourceType:I.resourceType})},z=async(g,P,I)=>{let U=[],E=new Set,F=(O)=>{let k=`${O.type??"User"}\x00${O.value}`;if(!E.has(k))E.add(k),U.push(O)},S=r.accessStore;if(S)for await(let O of dr((k,m)=>S.listByTarget(P,g.id,{start:k,limit:m}))){let k=await se(O);if(!k){e.warn("IAM delta: access subject has no externalId; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",target:g.id,targetType:P});continue}let m=await I.resolveProviderId(k.resourceType,k.externalId,k.create);if(m==="error")throw Error(`IAM delta failed to resolve access subject for ${P}:${g.id}`);if(m==="absent")continue;let f=O.metadata;F({value:m.found,type:ue(O.subjectType),...f?.display?{display:f.display}:{}})}if(P==="group"){let O=a();for(let k of g.groups??[]){let m=Ft(k),f=lr(k);if(!f&&m)f=await O?.groups.get(m);if(f&&f.requestable!==!0)continue;if(!f){e.warn("IAM delta: nested Group is unresolved; omitting it from entitlement PUT",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:m,target:g.id});continue}let T=await I.resolveProviderId("group",f.id,Xn(f,"group"));if(T==="error")throw Error(`IAM delta failed to resolve nested Group for group:${g.id}`);if(T!=="absent")F({value:T.found,type:"Group"})}}return U.length>0?U:void 0},D=async(g)=>{if(!R()||!b("user"))return"skipped";let P=g.externalId;if(!P)return e.warn("IAM delta: User has no externalId; skipping (externalId-only contract)",{"ion.operation":"iam.delta.project","ion.outcome":"skipped",id:g.id,kind:"user"}),"skipped";let I=re();if(!I)return"skipped";let U=await(r.mapUserToScim?.(g)??ii(g));return I.upsertResource("user",P,U)},Q=async(g)=>{if(!R()||!b("workload"))return"skipped";let P=g.externalId??g.id;if(!P)return"skipped";let I=re();if(!I)return"skipped";let U=await(r.mapWorkloadToScim?.({...g,externalId:P})??ai({...g,externalId:P}));return I.upsertResource("workload",P,U)},ne=async(g)=>{if(!R()||!b("customer"))return"skipped";let P=g.externalId??g.id;if(!P)return"skipped";let I=re();if(!I)return"skipped";let U=await(r.mapCustomerToScim?.({...g,externalId:P})??si({...g,externalId:P}));return I.upsertResource("customer",P,U)},ie=async(g,P,I=!0)=>{if(!R()||!p())return"skipped";let U=a(),F=(U?await Hr(U,P).get(g.id):void 0)??g;if(F.requestable!==!0)return"skipped";let S=re();if(!S)return"skipped";let O=await z(F,P,S),k=await S.upsertResource("group",F.id,Xn(F,P,O)),m=r.accessStore;if(k!=="pushed"||!I||!m)return k;for await(let f of dr((T,A)=>m.listByTarget(P,g.id,{start:T,limit:A})))if(await ee(f,"add")==="error")throw Error(`IAM delta failed to restore access for ${P}:${g.id}`);return k},ce=(g,P)=>{if(g==="error")throw Error(`IAM delta: destination rejected ${P}`)},ae=(g,P,I)=>{if(P==="pushed")g.pushed+=1;else if(P==="skipped")g.skipped+=1;else g.errors.push(`IAM delta: destination rejected ${I}`)},C={async onUserUpsert(g){ce(await D(g),"user upsert")},async onUserDelete(g){if(!R()||!b("user"))return;let P=re();if(!P)return;ce(await P.deleteResource("user",g),"user delete")},async onWorkloadUpsert(g){ce(await Q(g),"workload upsert")},async onWorkloadDelete(g){if(!R()||!b("workload"))return;let P=re();if(!P)return;ce(await P.deleteResource("workload",g),"workload delete")},async onCustomerUpsert(g){ce(await ne(g),"customer upsert")},async onCustomerDelete(g){if(!R()||!b("customer"))return;let P=re();if(!P)return;ce(await P.deleteResource("customer",g),"customer delete")},async onEntitlementUpsert(g,P){ce(await ie(g,P),`${P} upsert`)},async onEntitlementDelete(g,P){if(!R())return;let I=re();if(!I)return;ce(await I.deleteResource("group",P),`${g} delete`)},async onGrant(g){if(!R())return;if(await ee(g,"add")==="error")throw Error("IAM delta: destination rejected group membership add")},async onRevoke(g){if(!R())return;if(await ee(g,"remove")==="error")throw Error("IAM delta: destination rejected group membership remove")},async reconcile(g){let P={pushed:0,skipped:0,errors:[]},I=_();if(I)return P.errors.push(`iam delta not ready: ${I}`),P;let U=async(E,F,S)=>{if(!E)return;for await(let O of E)try{ae(P,await F(O),S(O))}catch(k){P.errors.push(k instanceof Error?k.message:String(k))}};return await U(g.groups,(E)=>ie(E,"group",!1),(E)=>`group upsert for ${E.id}`),await U(g.roles,(E)=>ie(E,"role",!1),(E)=>`role upsert for ${E.id}`),await U(g.permissions,(E)=>ie(E,"permission",!1),(E)=>`permission upsert for ${E.id}`),await U(g.users,(E)=>D(E),(E)=>`user upsert for ${E.id??"unknown"}`),await U(g.workloads,(E)=>Q(E),(E)=>`workload upsert for ${E.id}`),await U(g.customers,(E)=>ne(E),(E)=>`customer upsert for ${E.id??"unknown"}`),await U(g.access,(E)=>ee(E,"add"),(E)=>`membership push for ${Ft(E.target)??"unknown"}`),P},async getDestinationRef(g,P){return Y.read(g,P)},isReady:R,ready:W.ready};return{update(g,P){t=g,r=P,re(),W.refresh();let I=_();if(!p())y=void 0;else if(I!==y){if(I)e.warn(`IAM delta configured but not ready: ${I}`,{"ion.operation":"iam.delta.readiness","ion.outcome":"degraded",reason:I});y=I}return C},handle(){return C}}}var Jr=4,Bu=[{key:"sso.login",module:"sso",label:"SSO login (workforce single sign-on)"},{key:"sso.jit",module:"sso",label:"SSO just-in-time user provisioning"},{key:"sso.logout",module:"sso",label:"SSO logout"},{key:"sso.back_channel_logout",module:"sso",label:"SSO back-channel logout"},{key:"sso.claims_authz",module:"sso",label:"SSO claim-derived entitlements",requires:"sessionStore.capabilities.derivedEntitlements",incapableReason:"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted."},{key:"ciam.magic_link",module:"ciam",label:"CIAM magic-link login"},{key:"ciam.oidc_login",module:"ciam",label:"CIAM third-party OIDC login"},{key:"ciam.customer",module:"ciam",label:"CIAM customer profile resolution"},{key:"ciam.logout",module:"ciam",label:"CIAM logout"},{key:"ciam.claims_authz",module:"ciam",label:"CIAM claim-derived entitlements",requires:"sessionStore.capabilities.derivedEntitlements",incapableReason:"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted."},{key:"iam.users",module:"iam",label:"SCIM Users inbound",requires:"userStore",incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."},{key:"iam.groups",module:"iam",label:"SCIM Groups inbound",requires:"AccessCatalogStore or authz.catalog",incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability is wired by the application."},{key:"iam.groups.create",module:"iam",label:"IAM-sourced entitlement creation",requires:"AccessCatalogStore + authz.onInboundEntitlement",incapableReason:"The application has not wired durable catalog storage and explicitly opted into IAM-sourced entitlements."},{key:"iam.workloads",module:"iam",label:"SCIM Workloads inbound",requires:"workloadIdentityStore",incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."},{key:"iam.customers",module:"iam",label:"SCIM Customers inbound",requires:"customerStore",incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."},{key:"workload.incoming",module:"workload",label:"Workload incoming token validation"},{key:"workload.outgoing",module:"workload",label:"Workload outgoing token minting"},{key:"workload.claims_authz",module:"workload",label:"Workload claim-derived entitlements"},{key:"authz.oaa",module:"authz",label:"Authz OAA projection (Veza)",requires:"AccessAssignmentStore + AccessCatalogStore",incapableReason:"OAA projection is configured by RemoteConfig but no access/catalog store capability is wired by the application."},{key:"authz.access_requests",module:"authz",label:"IdP access-request lifecycle"},{key:"tm.integration",module:"tm",label:"Tenant Management staged integration and consent",requires:"TenantStore integration methods + onConnectRequest",incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."}];import{timingSafeEqual as Gu}from"node:crypto";import{parseKmsPoolDocument as Hu,stableConfigHash as ui}from"@ionite/core";function ci(e,t,r){for(let n of e)try{n()}catch(o){t.warn("Change listener failed",{"ion.operation":"reactive.listener.notify","ion.outcome":"degraded",label:r,error:o instanceof Error?o.message:String(o)})}}function De(e,t){let r=new Set,n=new Set;return{beforeChange(o){return r.add(o),()=>{r.delete(o)}},afterChange(o){return n.add(o),()=>{n.delete(o)}},emitBefore(){ci(r,e,`${t} beforeChange`)},emitAfter(){ci(n,e,`${t} afterChange`)}}}var Ju=604800000,Yu=2147483647,Xu=1;function pi(e,t){if(!e.value)return!1;if(e.notBefore&&Date.parse(e.notBefore)>t)return!1;if(e.notAfter&&Date.parse(e.notAfter)<=t)return!1;return!0}function We(e,t,r=Date.now()){if(!e)return;let n=e.slots?.[t];if(!n)return;let o=e.keys.find((s)=>s.id===n&&s.state==="active");return o&&pi(o,r)?o:void 0}function Qn(e,t=Date.now()){if(!e)return[];return e.keys.filter((r)=>(r.state==="active"||r.state==="deprecated")&&pi(r,t))}function di(e){return{...e,...e.meta?{meta:{...e.meta}}:{}}}function Yr(e,t,r){if(!t||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>o(Error(r)),t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function li(e,t){let r=Buffer.from(e),n=Buffer.from(t);return r.length===n.length&&Gu(r,n)}function Zu(e){if(!Number.isInteger(e)||e<1)throw Error("KMS unique() requires a positive integer slot count.");return e}var Qu=new Set(["kms_key_parked","kms_key_expiring","kms_pool_low"]);function ed(e){return Qu.has(e)}function fi(e){let t=e.trim().replace(/\/+$/,"");if(!t||t==="/")return"/";return t.startsWith("/")?t:`/${t}`}function td(e,t){let r=fi(e),n=fi(t);return r===n||r.endsWith(n)}function rd(e,t,r){let n=De(t,`KMS pool "${e}"`),o=new Set,s=!1,i,c,d=0,u,l,y=Xu,p,b,M,_=new Map,R=new Set,W,q=()=>i!==void 0&&i.slots===void 0&&i.keys.length>0,a=ye(`KMS pool "${e}"`,()=>{if(!s)return!1;if(q())return Qn(i).length>0;return We(i,0)!==void 0}),w=ye(`KMS pool "${e}" issuer`,()=>s&&p!==void 0),v=(k)=>k===0?`KMS pool "${e}"`:`KMS pool "${e}" slot ${k}`,L=(k)=>{let m=_.get(k),f=m?.valueWaiter;if(!m||!f)return;if(!s){m.valueWaiter=void 0,f.reject(Error(`${v(k)} is no longer configured.`));return}if(q()){m.valueWaiter=void 0,f.reject(Error(`${v(k)} verifier grant has no slots.`));return}let T=We(i,k);if(T?.value)m.valueWaiter=void 0,f.resolve(T.value)},H=()=>{for(let k of _.keys())L(k)},J=(k)=>{let m=_.get(k);if(!m)return;let f=We(i,k);for(let T of m.listeners)try{T(f?di(f):void 0)}catch(A){t.warn("KMS pool listener failed",{"ion.operation":"kms.pool.listener","ion.outcome":"degraded",pool:e,slot:k,error:A instanceof Error?A.message:String(A)})}},Y=()=>{for(let k of _.keys())J(k)},re=()=>{for(let k of _.values())k.latch.refresh();a.refresh(),w.refresh()},ue=()=>{try{W?.()}catch(k){t.warn("KMS issuer event unsubscribe failed",{"ion.operation":"kms.issuer.events.unsubscribe","ion.outcome":"degraded",pool:e,error:k instanceof Error?k.message:String(k)})}W=void 0},se=()=>{if(W||R.size===0||!p?.subscribeEvents||!b)return;let k=b;W=p.subscribeEvents((m)=>{if(!ed(m.event)||!td(m.path,k))return;let f={path:m.path,event:m.event,...m.requestId===void 0?{}:{requestId:m.requestId},...m.keyId===void 0?{}:{keyId:m.keyId}};for(let T of R)try{T(f)}catch(A){t.warn("KMS issuer event listener failed",{"ion.operation":"kms.issuer.events.listener","ion.outcome":"degraded",pool:e,error:A instanceof Error?A.message:String(A)})}})},K=()=>{if(l)clearTimeout(l);l=void 0},ee=()=>{K();let k=Date.now();if(i){for(let f of i.keys){if(!f.notAfter)continue;let T=Date.parse(f.notAfter)-k;if(T>0&&T<=Ju&&(f.state==="active"||f.state==="deprecated")&&!o.has(f.id))o.add(f.id),t.warn("KMS key is approaching expiry",{"ion.operation":"kms.key.expiry","ion.outcome":"degraded",pool:e,keyId:f.id,notAfter:f.notAfter})}let m=i.keys.flatMap((f)=>[f.notBefore,f.notAfter]).filter((f)=>Boolean(f)).map((f)=>Date.parse(f)).filter((f)=>f>k).sort((f,T)=>f-T);if(m[0])l=setTimeout(()=>{let f=new Map([..._.keys()].map((T)=>[T,We(i,T)?.id]));re(),r();for(let T of _.keys())if(f.get(T)!==We(i,T)?.id)J(T);ee()},Math.min(m[0]-k+1,Yu))}re(),r(),H()},z=(k)=>{let m=new Map([..._.keys()].map((f)=>{let T=We(i,f);return[f,{id:T?.id,value:T?.value}]}));n.emitBefore();try{i=Hu(k),ee();for(let f of _.keys()){let T=We(i,f),A=m.get(f);if(A?.id!==T?.id||A?.value!==T?.value)J(f)}}catch(f){i=void 0,ee(),Y(),t.warn("KMS pool document is invalid",{"ion.operation":"kms.pool.parse","ion.outcome":"failure",pool:e,error:f instanceof Error?f.message:String(f)})}finally{n.emitAfter()}},D=()=>{try{u?.()}catch(k){t.warn("KMS pool unsubscribe failed",{"ion.operation":"kms.pool.unsubscribe","ion.outcome":"degraded",pool:e,error:k instanceof Error?k.message:String(k)})}u=void 0},Q=(k,m)=>{p=k,b=m,d+=1;let f=d;D(),k.subscribe(m,(T)=>{if(d!==f||!s)return;z(T.data)},{kmsSlots:y}).then((T)=>{if(d!==f||!s){T();return}u=T}).catch((T)=>{if(d!==f||!s)return;i=void 0,ee(),Y(),t.warn("KMS pool subscription failed",{"ion.operation":"kms.pool.subscribe","ion.outcome":"failure",pool:e,path:m,error:T instanceof Error?T.message:String(T)})})},ne=(k,m)=>{let f=ce(k),T=We(i,k);if(!s)return Promise.reject(Error(`${v(k)} is no longer configured.`));if(q())return Promise.reject(Error(`${v(k)} verifier grant has no slots.`));if(T?.value)return Promise.resolve(T.value);if(!f.valueWaiter){let N,Z,V=new Promise((oe,te)=>{N=oe,Z=te});f.valueWaiter={promise:V,resolve:N,reject:Z}}let A=f.valueWaiter.promise;return L(k),Yr(A,m,`${v(k)} was not ready within ${m}ms.`)},ie=(k,m)=>{let f=ce(k);f.listeners.add(m);let T=We(i,k);return m(T?di(T):void 0),()=>f.listeners.delete(m)};function ce(k){let m=_.get(k);if(m)return m;let f=ye(v(k),()=>s&&We(i,k)!==void 0),T={listeners:new Set,latch:f,api:{value:(A)=>ne(k,A),current:()=>We(i,k)?.value,subscribe:(A)=>ie(k,A),park:(A,N)=>g(A,N),isReady:f.isReady,ready:f.ready}};return _.set(k,T),T}let ae=(k)=>{if(q())throw Error(`KMS pool "${e}" verifier grant has no slots.`);let m=Zu(k),f=m>y;y=Math.max(y,m);let T=[];for(let A=0;A<m;A+=1)T.push(ce(A).api);if(f&&s&&p&&b)Q(p,b);return T},C=(k)=>Qn(i).find((m)=>m.value!==void 0&&li(k,m.value)),g=(k,m)=>{if(!s||!p||!b)return Promise.reject(Error(`KMS pool "${e}" is not configured.`));if(typeof k.value!=="string"||k.value.length===0)return Promise.reject(Error(`KMS pool "${e}" park() requires a non-empty value.`));let f=C(k.value);if(!f)return Promise.resolve({parked:!1,stale:!0});return Yr(p.parkKmsKey(b,{keyId:f.id,status:k.status,reason:k.reason},m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" park() did not complete within ${m}ms.`)},P=()=>{if(!s||!p||!b)throw Error(`KMS pool "${e}" is not configured.`);return{source:p,path:b}},I=(k)=>{if(!Array.isArray(k)||k.length===0)throw Error(`KMS pool "${e}" addKeys() requires a non-empty keys array.`);return k.map((m,f)=>{if(!m||typeof m!=="object")throw Error(`KMS pool "${e}" addKeys() keys[${f}] must be an object.`);if(typeof m.value!=="string"||m.value.length===0)throw Error(`KMS pool "${e}" addKeys() keys[${f}].value must be a non-empty string.`);if(m.id!==void 0&&(typeof m.id!=="string"||m.id.length===0))throw Error(`KMS pool "${e}" addKeys() keys[${f}].id must be a non-empty string when present.`);return m})},U=(k,m)=>{try{let{source:f,path:T}=P(),A=I(k);return Yr(f.addKmsKeys(T,{keys:A},m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" addKeys() did not complete within ${m}ms.`)}catch(f){return Promise.reject(f)}},E=(k,m)=>{try{let{source:f,path:T}=P();if(typeof k.keyId!=="string"||k.keyId.length===0)throw Error(`KMS pool "${e}" revokeKey() requires a non-empty keyId.`);return Yr(f.revokeKmsKey(T,k,m&&m>0?{timeout:m}:void 0),m,`KMS pool "${e}" revokeKey() did not complete within ${m}ms.`)}catch(f){return Promise.reject(f)}},F=(k)=>{let{source:m}=P();if(!m.subscribeEvents)throw Error(`KMS pool "${e}" events are not supported by this secrets transport.`);return R.add(k),se(),()=>{R.delete(k)}};ce(0);let S={describe:()=>Se({name:e,source:M,path:b??`/kms/${e}`,ready:a.isReady()}),value:(k)=>ne(0,k),current:()=>We(i,0)?.value,unique:ae,accepts:(k)=>Qn(i).some((m)=>m.value!==void 0&&li(k,m.value)),park:g,subscribe:(k)=>ie(0,k),beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:a.isReady,ready:a.ready},O={addKeys:U,revokeKey:E,events:F,isReady:w.isReady,ready:w.ready};return{api:S,issuer:O,update(k,m,f){let T=ui({config:k,path:f});if(s=!0,M=k.source,c===T){re();return}c=T,D(),ue(),K(),i=void 0,re(),r(),Y(),H(),Q(m,f),se()},unavailable(k){s=!0,M=k.source,c=ui(k),d+=1,p=void 0,b=void 0,ue(),D(),K(),i=void 0,re(),r(),Y(),H()},remove(){if(!s)return;n.emitBefore(),s=!1,c=void 0,M=void 0,d+=1,p=void 0,b=void 0,ue(),D(),K(),i=void 0,re(),r(),Y(),H(),n.emitAfter()},close(){s=!1,d+=1,p=void 0,b=void 0,ue(),R.clear(),D(),K();for(let k of _.values())k.listeners.clear();i=void 0,H();for(let k of _.values())k.latch.settle();a.settle(),w.settle()},isConfigured:()=>s}}function mi(e){let t=new Map,r=new Map,n=De(e,"KMS"),o=!1,i=ye("KMS module",()=>o&&Array.from(t.values()).every((p)=>!p.isConfigured()||p.api.isReady())),c,d=()=>i.refresh(),u=(p)=>{let b=t.get(p);if(b)return b;let M=rd(p,e,d);if(t.set(p,M),!(p in c))Object.assign(c,{[p]:M.api});return M},l=(p)=>{let b=t.get(p);if(!b)throw Error(`KMS pool "${p}" is not configured.`);return b.api},y=(p)=>{let b=t.get(p);if(!b)throw Error(`KMS pool "${p}" is not configured.`);return b.issuer};return c={describe:()=>({module:"kms",active:o,ready:i.isReady(),pools:Array.from(r.keys(),(p)=>u(p).api.describe())}),get config(){return Object.fromEntries(r)},beforeChange:n.beforeChange,afterChange:n.afterChange,isReady:i.isReady,ready:i.ready,listPools:()=>Array.from(r.keys()),getPool:l,issuer:y},{handle:()=>c,update(p,b){if(!p&&!o&&t.size===0)return;n.emitBefore(),o=p!==void 0;let M=new Set(Object.keys(p??{}));for(let[_,R]of Object.entries(p??{})){r.set(_,{...R});let W=R.path??`/kms/${_}`;try{u(_).update(R,b(R),W)}catch(q){u(_).unavailable(R),e.warn("KMS pool source could not be resolved",{"ion.operation":"kms.pool.resolve","ion.outcome":"failure",pool:_,error:q instanceof Error?q.message:String(q)})}}for(let[_,R]of t){if(M.has(_))continue;r.delete(_),R.remove()}return i.refresh(),n.emitAfter(),o||t.size>0?c:void 0},close(){for(let p of t.values())p.close();t.clear(),r.clear(),o=!1,i.settle()}}}import{ACCEPT_JSON as nd,CONTENT_TYPE_FORM as od,errorLogAttributes as sd,formatLogLine as id,readJsonResponse as ad}from"@ionite/core";import{context as cd,trace as ud}from"@opentelemetry/api";import{logs as dd,SeverityNumber as He}from"@opentelemetry/api-logs";import{OTLPLogExporter as ld}from"@opentelemetry/exporter-logs-otlp-http";import{OTLPLogExporter as fd}from"@opentelemetry/exporter-logs-otlp-proto";import{OTLPMetricExporter as pd}from"@opentelemetry/exporter-metrics-otlp-http";import{OTLPMetricExporter as md}from"@opentelemetry/exporter-metrics-otlp-proto";import{OTLPTraceExporter as gd}from"@opentelemetry/exporter-trace-otlp-http";import{OTLPTraceExporter as yd}from"@opentelemetry/exporter-trace-otlp-proto";import{resourceFromAttributes as hd}from"@opentelemetry/resources";import{BatchLogRecordProcessor as wd}from"@opentelemetry/sdk-logs";import{PeriodicExportingMetricReader as Sd}from"@opentelemetry/sdk-metrics";import{NodeSDK as vd}from"@opentelemetry/sdk-node";var gi={traces:"/v1/traces",metrics:"/v1/metrics",logs:"/v1/logs"},kd={trace:!1,debug:!1,info:!0,warn:!0,error:!0},bd={trace:He.TRACE,debug:He.DEBUG,info:He.INFO,warn:He.WARN,error:He.ERROR};function eo(e,t){let r=t[e];if(r===!1)return!1;if(e==="metrics")return r===!0||typeof r==="object";return!0}function oo(e){return typeof e==="object"&&e!==null?e:void 0}function Rd(e){return typeof e==="object"&&e!==null?e:void 0}function Td(e,t){let r=e.replace(/\/+$/,"");if(r.endsWith(gi[t]))return r;return`${r}${gi[t]}`}function Cd(e,t){let r=oo(e[t]);if(r?.endpoint)return r.endpoint;if(!e.endpoint)return;return Td(e.endpoint,t)}function Id(e,t,r){let n=oo(e[t]),o={...e.headers,...n?.headers??{}};if(r)o.Authorization=`Bearer ${r}`;return o}function so(e,t,r){let n=oo(e[t]);return{url:Cd(e,t),headers:Id(e,t,r),timeoutMillis:n?.timeoutMillis,concurrencyLimit:n?.concurrencyLimit}}function Pd(e,t){let r=so(e,"traces",t);return e.protocol==="http/json"?new gd(r):new yd(r)}function Od(e,t){let r=so(e,"metrics",t);return e.protocol==="http/json"?new pd(r):new md(r)}function Ed(e,t){let r=so(e,"logs",t);return e.protocol==="http/json"?new ld(r):new fd(r)}function Ad(e){return{"service.name":e.name,...e.version?{"service.version":e.version}:{},...e.deploymentEnvironment?{"deployment.environment.name":e.deploymentEnvironment}:{},...e.resourceAttributes??{}}}async function _d(e,t){if(!e.oauth)return;let r=new URLSearchParams({grant_type:"client_credentials",client_id:e.oauth.clientId,client_secret:e.oauth.clientSecret});if(e.oauth.scope)r.set("scope",e.oauth.scope);if(e.oauth.audience)r.set("audience",e.oauth.audience);let n=await fetch(e.oauth.tokenUrl,{method:"POST",headers:{...nd,...od,...e.oauth.headers??{}},body:r});if(!n.ok)throw Error(`OpenTelemetry OAuth token request failed with status ${n.status}`);let o=await ad(n,{log:t,operation:"otel.oauth.token",redact:!0});if(typeof o.access_token!=="string"||!o.access_token)throw Error("OpenTelemetry OAuth token response did not include access_token");return o.access_token}function Ld(e,t){return{...kd,...t?.levels??{},...e.levels??{}}}function fr(e,t="Authorization"){let r={...e.headers??{}};if(!e.apiKey)return r;let n=e.apiKeyHeader??t;return r[n]=n.toLowerCase()==="authorization"?`Bearer ${e.apiKey}`:e.apiKey,r}function xd(e,t){return Object.keys(e).some((r)=>r.toLowerCase()===t.toLowerCase())}function hi(e,t,r){let n=Object.keys(e).find((o)=>o.toLowerCase().startsWith(t.toLowerCase()));if(n)throw Error(`OpenTelemetry provider "${r}" does not support provider-specific header "${n}".`)}function pr(e,t,r,n){return{type:r,name:e.name,version:e.version,protocol:e.protocol??"http/protobuf",endpoint:e.endpoint,headers:n,resourceAttributes:Ad(e),levels:Ld(e,t),console:e.console??"info",traces:e.traces,metrics:e.metrics,logs:e.logs}}function Ud(e,t){return pr(e,t,"otlp",fr(e))}function Md(e,t){return pr(e,t,"grafana-lgtm",fr(e))}function qd(e,t){let r=fr(e,"DD-API-KEY");if(!xd(r,"DD-API-KEY"))throw Error('OpenTelemetry provider "datadog" requires a DD-API-KEY header or apiKey.');return pr(e,t,"datadog",r)}function Wd(e,t){let r=fr(e);return hi(r,"DD-","splunk"),pr(e,t,"splunk",r)}function jd(e,t){let r=fr(e);return hi(r,"DD-","elastic"),pr(e,t,"elastic",r)}function Nd(e,t){let r=e.type??"otlp";switch(r){case"otlp":return Ud(e,t);case"grafana-lgtm":return Md(e,t);case"datadog":return qd(e,t);case"splunk":return Wd(e,t);case"elastic":return jd(e,t);default:throw Error(`Unsupported OpenTelemetry provider type: ${r}`)}}function $d(e,t){if(typeof e==="string")return e;if(e instanceof Error)return e.message;if(e!=null)return ro(e);if(t.length===0)return"";return ro(t[0])}function ro(e){if(typeof e==="string")return e;try{return JSON.stringify(e)}catch{return String(e)}}function yi(e,t,r){if(r==null)return;if(typeof r==="string"||typeof r==="number"||typeof r==="boolean"){e[t]=r;return}if(Array.isArray(r)&&r.every((n)=>["string","number","boolean"].includes(typeof n))){e[t]=r;return}if(r instanceof Error){let n=sd(r);if(n){for(let[o,s]of Object.entries(n))if(s!=null)e[o]=s;return}if(e[`${t}.name`]=r.name,e[`${t}.message`]=r.message,r.stack)e[`${t}.stack`]=r.stack;return}e[t]=ro(r)}function Dd(e){let t={};for(let[n,o]of e.entries()){if(o&&typeof o==="object"&&!Array.isArray(o)&&!(o instanceof Error)&&Object.getPrototypeOf(o)===Object.prototype){for(let[s,i]of Object.entries(o))yi(t,s,i);continue}yi(t,`param.${n}`,o)}let r=ud.getSpanContext(cd.active());if(r)t.trace_id=r.traceId,t.span_id=r.spanId,t.trace_flags=r.traceFlags;return t}function Kd(e){return e}function Fd(e,t){globalThis.console[Kd(e)](id(e,t.body,[t.attributes??{}]))}function Vd(e,t,r,n){if(r.console==="off")return;if((t.severityNumber??0)<bd[r.console])return;let o=n?.console;if(o){o(t);return}Fd(e,t)}function zd(e,t){let r=dd.getLogger(e.name,e.version),n=(o,s,i)=>{if(!e.levels[o])return;let c={severityNumber:s,severityText:o.toUpperCase(),body:$d(i[0],i.slice(1)),attributes:Dd(i.slice(1))};try{r.emit(c)}finally{Vd(o,c,e,t)}};return{trace:(o,...s)=>n("trace",He.TRACE,[o,...s]),debug:(o,...s)=>n("debug",He.DEBUG,[o,...s]),info:(o,...s)=>n("info",He.INFO,[o,...s]),warn:(o,...s)=>n("warn",He.WARN,[o,...s]),error:(o,...s)=>n("error",He.ERROR,[o,...s])}}function Bd(e){return e?.current()}function Gd(e,t,r){let n=t;return e.subscribe((o)=>{let s=o?.value;if(s===n)return;n=s,r()})}function to(e){if(!e)return{enabled:!1};if(e===!0)return{enabled:!0};return{enabled:!0,endpoint:e.endpoint,timeoutMillis:e.timeoutMillis,concurrencyLimit:e.concurrencyLimit,exportIntervalMillis:e.exportIntervalMillis,exportTimeoutMillis:e.exportTimeoutMillis}}function wi(e,t,r){return()=>Se({module:"otel",active:t,ready:r(),type:e?.type,name:e?.name,endpoint:e?.endpoint,protocol:e?.protocol,apiKeyPool:e?.apiKeyPool,apiKeyHeader:e?.apiKeyHeader,oauth:e?.oauth?{tokenUrl:e.oauth.tokenUrl,clientId:e.oauth.clientId,scope:e.oauth.scope,audience:e.oauth.audience}:void 0,version:e?.version,deploymentEnvironment:e?.deploymentEnvironment,resourceAttributes:e?.resourceAttributes,levels:e?.levels,console:e?.console,signals:{traces:to(e?.traces),metrics:to(e?.metrics),logs:to(e?.logs)}})}function no(e,t){return{state:"unavailable",describe:wi(t,t!==void 0,()=>!1),beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>!1,ready:()=>Promise.reject(Error("OpenTelemetry is not configured by RemoteConfig.")),logger:e,start:async()=>{},forceFlush:async()=>{},shutdown:async()=>{}}}function io(e,t,r,n){if(!t&&!r)return;if(!t)return no(e);let o=t,s;if(o.apiKeyPool&&n)try{s=n.getPool(o.apiKeyPool)}catch{s=void 0}let i=Bd(s),c=()=>io(e,o,r,n),d=o.apiKeyPool&&n?(q)=>Gd(n.getPool(o.apiKeyPool),i,q):void 0;if(o.apiKeyPool&&!i){let q=no(e,o);return q.onCredentialChange=d,q.rebuild=c,q}let u=i?{...o,apiKey:i}:o,l=Nd(u,r),y,p=!1,b=zd(l,r),M,_,R=new Promise((q,a)=>{M=q,_=a});async function W(){try{let q=await _d(o,e),a={resource:hd(l.resourceAttributes),instrumentations:r?.instrument};if(r?.sampler)a.sampler=r.sampler;if(r?.textMapPropagator)a.textMapPropagator=r.textMapPropagator;if(r?.contextManager)a.contextManager=r.contextManager;if(r?.spanProcessors)a.spanProcessors=r.spanProcessors;else if(eo("traces",l))a.traceExporter=Pd(l,q);if(r?.metricReaders)a.metricReaders=r.metricReaders;else if(eo("metrics",l)){let v=Rd(l.metrics);a.metricReaders=[new Sd({exporter:Od(l,q),exportIntervalMillis:v?.exportIntervalMillis,exportTimeoutMillis:v?.exportTimeoutMillis})]}if(r?.logRecordProcessors)a.logRecordProcessors=r.logRecordProcessors;else if(eo("logs",l))a.logRecordProcessors=[new wd({exporter:Ed(l,q)})];let w=r?.configure?.(a);y=new vd(w??a),y.start(),p=!0,M?.()}catch(q){p=!1;let a=q instanceof Error?q:Error(String(q));e.error?.("OpenTelemetry startup failed",a),_?.(a)}finally{M=void 0,_=void 0}}return{state:"available",describe:wi(o,!0,()=>p),start:W,beforeChange:()=>()=>{},afterChange:()=>()=>{},isReady:()=>p,ready:(q)=>{if(!q||q<=0)return R;return Promise.race([R,new Promise((a,w)=>{setTimeout(()=>w(Error(`OpenTelemetry ready timed out after ${q}ms.`)),q)})])},logger:b,forceFlush:async()=>{await y?.forceFlush?.()},shutdown:async()=>{p=!1,await y?.shutdown(),y=void 0},onCredentialChange:d,rebuild:c}}function Si(e){let t,r,n,o=0,s=Promise.resolve(),i=De(e,"OpenTelemetry"),c=ye("OpenTelemetry module",()=>t?.isReady()===!0),d=no(e),u={describe:()=>(t??d).describe(),beforeChange:i.beforeChange,afterChange:i.afterChange,isReady:c.isReady,ready:c.ready,logger:{trace:(p,...b)=>(t?.logger??e).trace(p,...b),debug:(p,...b)=>(t?.logger??e).debug(p,...b),info:(p,...b)=>(t?.logger??e).info(p,...b),warn:(p,...b)=>(t?.logger??e).warn(p,...b),error:(p,...b)=>(t?.logger??e).error(p,...b)},forceFlush:async()=>{await t?.forceFlush()},shutdown:async()=>{await t?.shutdown()}},l=!1,y;return y={update(p){if(!p){if(t||r){let R=t,W=r;o+=1,i.emitBefore(),n?.(),n=void 0,t=void 0,r=void 0,c.refresh(),s=Promise.all([R?.shutdown(),W?.shutdown()]).finally(()=>i.emitAfter()).then(()=>{return},()=>{return})}return l?u:void 0}if(l=!0,p===t||p===r)return u;let b=t,M=r;o+=1;let _=o;return i.emitBefore(),n?.(),n=void 0,t=void 0,r=p,c.refresh(),s=(async()=>{try{if(await Promise.all([b?.shutdown(),M?.shutdown()]),await p.start(),_!==o||r!==p){await p.shutdown();return}t=p,r=void 0,c.refresh(),n=p.onCredentialChange?.(()=>{if(t!==p)return;let R=p.rebuild?.();if(R)y.update(R)})}finally{if(_===o)i.emitAfter()}})().then(()=>{return},()=>{return}),u},settled(){return s},async shutdown(){o+=1;let p=t,b=r;n?.(),n=void 0,t=void 0,r=void 0,c.settle(),await Promise.all([p?.shutdown(),b?.shutdown()])}},y}import{ION_ENDPOINT_PERMISSIONS as Vt,trimTrailingSlash as vi}from"@ionite/core";import{hasPermission as Hd}from"@ionite/core/server";async function mr(e,t,r){let n=await Hd(e,t,r.permission,void 0,r.subjectType);return n.allow?void 0:n.response()}function Jd(e){let t=vi(e);return{matchesPath:(o)=>{if(!o)return!1;return vi(o)===t},startsWithPath:(o)=>{if(!o)return!1;return e===o||e.startsWith(`${o}/`)}}}function ki(e,t,r,n){let o=n??new URL(e.url).pathname,{matchesPath:s,startsWithPath:i}=Jd(o);if(t.sso){let c=t.sso;if(s(r.sso.userUrl))return{module:"sso",kind:"sso.user",handler:async(d)=>c.handler(d)};if(s(r.sso.logoutUrl))return{module:"sso",kind:"sso.logout",handler:async(d)=>c.logout(d)};if(s(r.sso.logoutBackChannelUrl))return{module:"sso",kind:"sso.logout_backchannel",handler:async(d)=>c.logoutBackChannel(d)};if(s(r.sso.loginUrl)||s(r.sso.refreshUrl)||s(r.sso.callbackUrl))return{module:"sso",kind:"sso.handler",handler:async(d)=>c.handler(d)}}if(t.ciam){let c=t.ciam;if(s(r.ciam.customerUrl))return{module:"ciam",kind:"ciam.customer",handler:async(d)=>c.customerHandler(d)};if(s(r.ciam.logoutUrl))return{module:"ciam",kind:"ciam.logout",handler:async(d)=>c.logout(d)}}if(t.iam){let c=t.iam,d=e.method!=="GET"&&e.method!=="HEAD";if(i(r.iam.usersUrl))return{module:"iam",kind:d?"iam.users.write":"iam.read",requiredPermission:Vt[d?"iam.users.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.groupsUrl))return{module:"iam",kind:d?"iam.groups.write":"iam.read",requiredPermission:Vt[d?"iam.groups.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.workloadsUrl))return{module:"iam",kind:d?"iam.workloads.write":"iam.read",requiredPermission:Vt[d?"iam.workloads.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(r.iam.customersUrl))return{module:"iam",kind:d?"iam.customers.write":"iam.read",requiredPermission:Vt[d?"iam.customers.write":"iam.read"],handler:async(u)=>c.handler(u)};if(i(`${r.iam.basePath}/AccessRequests`))return{module:"iam",kind:"iam.access-requests.write",requiredPermission:Vt["iam.access-requests.write"],handler:async(u)=>c.handler(u)};if(i(r.iam.basePath))return{module:"iam",kind:"iam.discovery",handler:async(u)=>c.handler(u)}}if(t.workload){let c=t.workload;if(s(r.workload.validateUrl)||s(r.workload.jwksUrl))return{module:"workload",kind:"workload.handler",handler:async(d)=>c.handler(d)}}if(t.secrets){let c=t.secrets;if(c.isLfvDeliveryRequest?.(e)&&c.handleLfvDelivery){let d=c.handleLfvDelivery;return{module:"secrets",kind:"secrets.lfv_delivery",handler:async(u)=>d(u)}}if(c.isLfvEventsRequest?.(e)&&c.handleLfvEvents){let d=c.handleLfvEvents;return{module:"secrets",kind:"secrets.lfv_events",handler:async(u)=>d(u)}}}if(t.ciam){let c=t.ciam;if(s(r.ciam.magicLinkUrl)&&e.method==="POST")return{module:"ciam",kind:"ciam.magic_link.create",requiredPermission:Vt["ciam.magic-link.create"],handler:async(d)=>c.handler(d)};if(s(r.ciam.magicLinkLoginUrl)&&e.method==="GET"||s(r.ciam.customerProvidersUrl)&&e.method==="GET"||s(r.ciam.customerLoginUrl)&&e.method==="GET"||s(r.ciam.customerCallbackUrl)&&(e.method==="GET"||e.method==="POST"))return{module:"ciam",kind:"ciam.handler",handler:async(d)=>c.handler(d)}}return}async function ao(e,t,r,n){let o=n??Fe(xr()),s=new URL(e.url).pathname;if(r?.filter){let y=await r.filter(e,t);if(y instanceof Response)return y;if(y==="not_handled")return me()}let i=ki(e,t,o,s),d=await r?.resolve?.(e,t,i)??i;if(!d)return me();let u=d.requiredPermission===void 0?i?.requiredPermission:d.requiredPermission,l=async()=>{if(u){let y=await mr(e,t,u);if(y)return y}return d.handler(e)};if(r?.wrap)return await r.wrap(e,d,l,t);return await l()}import{stableConfigHash as vl}from"@ionite/core";function Xr(){let e=0;return{next:()=>(e+=1,e),isCurrent:(t)=>t===e,current:()=>e}}import{readFile as fl,stat as pl}from"node:fs/promises";import{ACCEPT_JSON as Gt,CONTENT_TYPE_FORM as Ki,CONTENT_TYPE_JSON as ml,describeOriginUrl as gl,IoniteError as yl,readJsonResponse as nn}from"@ionite/core";import{ACCEPT_JSON as go,CONTENT_TYPE_FORM as al,CONTENT_TYPE_JSON as Di,describeOriginUrl as mo,readJsonResponse as Tt}from"@ionite/core";import{IoniteError as Zr}from"@ionite/core";class zt extends Zr{constructor(e,t,r){super(e,{status:Qe(r),upstreamStatus:r});this.name="VaultWebSocketCommandError";this.sourceType="vault";this.code=t}}class ot extends Zr{constructor(e,t=`Vault secret not found at path ${e}`){super(t,{status:503,upstreamStatus:404});this.name="VaultSecretNotFoundError";this.code="not_found";this.sourceType="vault";this.path=e}}class we extends Zr{constructor(e,t,r,n,o){super(e,{...o,status:Qe(r),upstreamStatus:r});this.name="VaultRequestError";this.sourceType="vault";this.path=t,this.code=n}}class je extends Zr{constructor(e,t,r=`Vault subscribe is not supported for source ${e} at path ${t} without websocket, LFV, or ttl`){super(r,{status:500});this.name="VaultSubscribeNotSupportedError";this.sourceType=e,this.path=t}}function bi(e){return e instanceof ot||e instanceof zt&&(e.code==="not_found"||e.upstreamStatus===404)}import{WebSocket as gr}from"ws";var Yd=1000,Xd=30000,Ti=30000,Ci=Ti;function Ii(e){Ci=e>0?e:Ti}function Pi(e){return typeof e==="number"&&Number.isInteger(e)&&e>=1?{kms_slots:e}:{}}function Zd(e){let t=Math.min(Xd,Yd*2**Math.min(e,16)),r=0.5+Math.random()*0.5;return Math.round(t*r)}var Rt=new Map;function Qd(e){return e.trim().replace(/\/+$/g,"")}function Oi(e,t){let r=typeof t?.version==="number"?t.version:0,n=t?.created_time??t?.created,o=typeof n==="string"?new Date(n):new Date,s=St(t);return{path:e,version:r,created:o,...s?{contentType:s}:{}}}function el(e){return typeof e?.version==="number"?e.version:void 0}function tl(e){let t=e.token?.trim();if(!t)return{};if(e.header==="Authorization")return{Authorization:t.startsWith("Bearer ")?t:`Bearer ${t}`};return{"X-Vault-Token":t}}function yr(e){return{client_id:e.clientId,token:e.token,header:e.header??"X-Vault-Token"}}function uo(e,t){let r=Qd(e),n=Rt.get(r);if(n){if(t&&!n.log)n.log=t;return n}let o={url:r,reconnectAttempts:0,reconnectCredCursor:0,pending:new Map,subs:new Map,eventListeners:new Map,hasConnected:!1,disposed:!1,log:t};return Rt.set(r,o),o}function rl(e){let t=[...Array.from(e.subs.values(),(o)=>o.creds),...e.eventListeners.values()];if(t.length===0)return e.lastGoodCreds??{url:e.url};let r=e.lastGoodCreds?[e.lastGoodCreds,...t]:t,n=r[e.reconnectCredCursor%r.length]??t[0];return e.reconnectCredCursor+=1,n}function Ri(e,t){for(let r of e.subs.values())try{r.onHealth?.(t)}catch(n){e.log?.warn("Vault websocket health hook threw",n)}}function nl(e,t){for(let r of Array.from(e.subs.values())){let n=r.onFirstSecretReject;if(r.onFirstSecret=void 0,r.onFirstSecretReject=void 0,n)try{n(new we(`Vault websocket subscription interrupted (${t})`,r.path,void 0,"connection"))}catch(o){e.log?.warn("Vault websocket first-secret waiter rejection threw",o)}}}function Ei(e,t){for(let r of e.pending.values())clearTimeout(r.timer),r.reject(new we(`Vault websocket command interrupted (${t})`,"/",void 0,"connection"));e.pending.clear()}function Qr(e){if(e.disposed)return;if(e.disposed=!0,e.reconnectTimer)clearTimeout(e.reconnectTimer),e.reconnectTimer=void 0;Ei(e,"closed"),nl(e,"socket disposed");let t=e.ws;if(e.ws=void 0,e.connectPromise=void 0,e.hasConnected=!1,Rt.delete(e.url),t)try{t.removeAllListeners(),t.close()}catch{}}function en(e){if(e.subs.size>0||e.pending.size>0||e.eventListeners.size>0)return;Qr(e)}function co(e){return`${e.clientId??""}|${e.token??""}|${e.header??"X-Vault-Token"}`}function Ai(e){let t=new Map;for(let r of e.eventListeners.values())t.set(co(r),r);return Array.from(t.values())}function ol(e,t){if(typeof t.path!=="string"||typeof t.event!=="string")return;let r={path:t.path,event:t.event,...typeof t.request_id==="string"?{requestId:t.request_id}:{},...typeof t.key_id==="string"&&t.key_id.length>0?{keyId:t.key_id}:{}};for(let n of e.eventListeners.keys())try{n(r)}catch(o){e.log?.warn("Vault websocket event listener threw",o)}}function _i(e,t,r,n){if(n!==void 0&&t.lastVersion!==void 0&&n===t.lastVersion)return;if(n!==void 0)t.lastVersion=n;try{t.onChange(r)}catch(s){e.log?.warn("Vault websocket subscription onChange threw",s)}let o=t.onFirstSecret;if(t.onFirstSecret=void 0,t.onFirstSecretReject=void 0,o)try{o()}catch(s){e.log?.warn("Vault websocket subscription onFirstSecret threw",s)}}function sl(e,t){let r=t.subscription_id;if(typeof r!=="string")return;let n=e.subs.get(r);if(!n)return;let o={data:t.data,metadata:Oi(typeof t.path==="string"?t.path:n.path,t.metadata)};_i(e,n,o,el(t.metadata))}function il(e,t){let r;try{r=JSON.parse(t.toString())}catch(n){e.log?.warn("Vault websocket message parse failed",n);return}if(r.type==="secret"){sl(e,r);return}if(r.type==="event"){ol(e,r);return}if(r.type==="command_result"&&typeof r.id==="string"){let n=e.pending.get(r.id);if(!n)return;if(e.pending.delete(r.id),clearTimeout(n.timer),r.ok===!1)n.reject(new zt(r.error??`Vault websocket command failed for ${r.id}`,r.code,r.status));else n.resolve(r.result);en(e)}}function Li(e,t){e.send(JSON.stringify({type:"subscribe",subscription_id:t.subscriptionId,paths:[t.path],...Pi(t.kmsSlots),...yr(t.creds)}))}function lo(e){if(e.disposed||e.reconnectTimer||e.subs.size===0&&e.eventListeners.size===0)return;let t=Zd(e.reconnectAttempts);e.reconnectAttempts+=1,e.reconnectTimer=setTimeout(()=>{if(e.reconnectTimer=void 0,e.disposed)return;if(e.subs.size===0&&e.eventListeners.size===0){Qr(e);return}tn(e,rl(e)).catch(()=>{if(e.hasConnected)e.log?.warn(`Vault websocket reconnect failed; retrying automatically with backoff (~${t}ms).`);lo(e)})},t)}function tn(e,t){if(e.disposed)return Promise.reject(Error("Vault websocket connection has been closed"));if(e.ws&&e.ws.readyState===gr.OPEN)return Promise.resolve(e.ws);if(e.connectPromise)return e.connectPromise;return e.connectPromise=new Promise((r,n)=>{let o=new gr(e.url,{headers:tl(t)}),s=!1,i=e.hasConnected,c=()=>{s=!0,e.hasConnected=!0,e.reconnectAttempts=0,e.reconnectCredCursor=0,e.lastGoodCreds=t,e.ws=o,e.connectPromise=void 0,o.on("message",(l)=>il(e,l));for(let l of e.subs.values())try{Li(o,l)}catch{}for(let l of Ai(e))try{o.send(JSON.stringify({type:"subscribe_events",...yr(l)}))}catch{}if(i)Ri(e,!0);r(o)},d=()=>{if(e.ws===o)e.ws=void 0;e.connectPromise=void 0;try{o.removeAllListeners()}catch{}if(Ei(e,"socket closed"),e.subs.size>0||e.eventListeners.size>0)Ri(e,!1),lo(e);else Qr(e)},u=(l)=>{if(e.ws===o)e.ws=void 0;if(!s)s=!0,e.connectPromise=void 0,n(l)};o.once("open",c),o.on("close",d),o.on("error",u)}),e.connectPromise}async function fo(e,t,r,n){let o=uo(e.url,n),s=typeof r.path==="string"?r.path:"/",i=await tn(o,e),c=crypto.randomUUID();try{return await new Promise((d,u)=>{let l=setTimeout(()=>{if(!o.pending.has(c))return;o.pending.delete(c),u(new we(`Vault websocket command "${t}" timed out`,s,void 0,"timeout"));try{o.ws?.close()}catch{}},Ci);o.pending.set(c,{resolve:(y)=>d(y),reject:u,timer:l});try{i.send(JSON.stringify({type:"command",id:c,command:t,...r,...yr(e)}))}catch(y){clearTimeout(l),o.pending.delete(c),u(y)}})}finally{en(o)}}async function po(e,t,r,n){let o;try{o=await fo(e,"read_secret",{path:t,...Pi(n)},r)}catch(s){if(bi(s))throw new ot(t);if(s instanceof zt||s instanceof we)throw s;throw new we(`Vault websocket read_secret failed for ${t}`,t,void 0,"connection",{cause:s})}if(!o||typeof o!=="object")throw Error(`Vault websocket read_secret returned invalid payload for ${t}`);return{data:o.data,metadata:Oi(typeof o.path==="string"?o.path:t,o.metadata)}}async function xi(e,t,r,n,o,s){let i=uo(e.url,o),c=crypto.randomUUID(),d={subscriptionId:c,creds:e,path:t,...n?.kmsSlots!==void 0?{kmsSlots:n.kmsSlots}:{},onChange:r,onHealth:s?.onHealth};i.subs.set(c,d);let u=()=>{if(!i.subs.delete(c))return;if(i.ws&&i.ws.readyState===gr.OPEN)try{i.ws.send(JSON.stringify({type:"unsubscribe",subscription_id:c}))}catch{}en(i)};try{let l=await tn(i,e);Li(l,d)}catch(l){if(n?.mode!=="wait")throw u(),l}try{let l=await po(e,t,o,n?.kmsSlots);_i(i,d,l,l.metadata.version)}catch(l){if(n?.mode!=="wait")throw u(),l;await new Promise((y,p)=>{let b,M=(_)=>{if(b)clearTimeout(b);d.onFirstSecret=void 0,d.onFirstSecretReject=void 0,u(),p(_)};if(d.onFirstSecret=()=>{if(b)clearTimeout(b);y()},d.onFirstSecretReject=M,typeof n.timeout==="number"&&n.timeout>0)b=setTimeout(()=>M(l),n.timeout)})}return u}async function Ui(e,t,r){let n=uo(e.url,r);n.eventListeners.set(t,e);try{let o=await tn(n,e);if(o.readyState===gr.OPEN)o.send(JSON.stringify({type:"subscribe_events",...yr(e)}))}catch(o){n.log?.warn("Vault websocket event subscription connect failed; retrying in background",o),lo(n)}return()=>{if(!n.eventListeners.delete(t))return;let o=co(e);if(!Ai(n).some((i)=>co(i)===o)&&n.ws&&n.ws.readyState===gr.OPEN)try{n.ws.send(JSON.stringify({type:"unsubscribe_events",...yr(e)}))}catch{}en(n)}}function Mi(){let e=0;for(let t of Rt.values())e+=t.subs.size;return{urls:Array.from(Rt.keys()),sockets:Rt.size,subscriptions:e}}function qi(){for(let e of Array.from(Rt.values()))Qr(e)}var rn=600000;function Ct(e){if(e&&e<rn)throw Error(`Vault-compatible secret stores require ttl to be set and greater than ${rn} milliseconds (10 minutes), as not to overload the store with polling requests`)}function st(e,t,r,n,o,s,i){let c=!1,d,u,l,y=(W)=>{try{i?.onHealth?.(W)}catch{}},p=()=>{if(c=!0,d)clearTimeout(d),d=void 0;u?.()},b=(W)=>new Promise((q)=>{let a=setTimeout(()=>{u=void 0,d=void 0,q()},W);d=a,u=()=>{clearTimeout(a),u=void 0,d=void 0,q()}});async function M(){let W=Date.now();for(;;){if(c)return;try{let q=await e.getFullSecret(t,s);return y(!0),q}catch(q){if(y(!1),s?.mode!=="wait")throw q;if(typeof s.timeout==="number"&&s.timeout>0&&Date.now()-W>=s.timeout)throw q;if(c)return;o?.warn(`Error retrieving initial secret from vault. Retrying in ${n} milliseconds`,q),await b(n)}}}async function _(){if(d=void 0,c)return;try{let W=await e.getFullSecret(t,s);if(y(!0),W.metadata.version!==l)l=W.metadata.version,r(W)}catch(W){y(!1),o?.warn(`Error retrieving remote config from vault. Retrying in ${n} milliseconds`,W)}R()}function R(){if(c)return;d=setTimeout(()=>{_()},n)}return M().then((W)=>{if(c||!W)return()=>p();return l=W.metadata.version,r(W),R(),()=>p()})}function cl(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function ul(e){let t={...go,...Di};if(e)t["X-Vault-Token"]=e;return t}function dl(e){return Boolean(e?.idpTokenUrl?.trim()&&e.clientId?.trim()&&e.clientSecret?.trim())}async function Wi(e,t,r){let n=Date.now();if(t.token&&t.expiresAt&&t.expiresAt-60000>n)return t.token;let o=new URLSearchParams({grant_type:"client_credentials",client_id:e.clientId,client_secret:e.clientSecret});if(e.scope?.trim())o.set("scope",e.scope.trim());let s=await fetch(e.idpTokenUrl,{method:"POST",headers:{...go,...al},body:o.toString()});if(!s.ok)throw Error(`Vault workload token request failed (${s.status})`);let i=await Tt(s,{log:r,operation:"vault.workload.token",redact:!0});if(!i.access_token)throw Error("Vault workload token response did not include access_token");return t.token=i.access_token,t.expiresAt=n+Math.max(1,i.expires_in??300)*1000,i.access_token}function ll(e){return{Authorization:e.startsWith("Bearer ")?e:`Bearer ${e}`}}function hr(e){return e.replace(/\/data\/?$/,"")}function ji(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let n=e;if(typeof n.parked!=="boolean")throw Error(`Vault ${r} kms_park returned invalid payload for ${t}`);let o=n.disposition;if(o!==void 0&&o!=="cooldown"&&o!=="suspect")throw Error(`Vault ${r} kms_park returned invalid disposition for ${t}`);return{parked:n.parked,...n.stale===!0?{stale:!0}:{},...o?{disposition:o}:{}}}function Ni(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);let n=e;if(!Array.isArray(n.keys))throw Error(`Vault ${r} kms_add_keys returned invalid payload for ${t}`);return{keys:n.keys.map((s,i)=>{if(!s||typeof s!=="object"||Array.isArray(s))throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}] for ${t}`);let c=s.id;if(typeof c!=="string"||c.length===0)throw Error(`Vault ${r} kms_add_keys returned invalid keys[${i}].id for ${t}`);return{id:c}})}}function $i(e,t,r){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);let n=e;if(typeof n.revoked!=="boolean")throw Error(`Vault ${r} kms_revoke_key returned invalid payload for ${t}`);return{revoked:n.revoked}}function Bt(e,t){let{type:r="vault",url:n,token:o,ttl:s}=e,i=()=>e.log,c=dl(e.workload)?e.workload:void 0,d={},u=ul(o),{lfv:l,websocket:y}=e,p=l?kt({...l,log:l.log??i(),path:l.path??"/"},t):void 0,b=new Map,M=y?.url?.trim(),_=new Set,R=!1,W=!1;if(!l&&!n&&!M)throw Error("Vault-compatible sources require a direct url, websocket capability, or lfv capability configuration");Ct(s);let q=l?{transport:"lfv",url:mo(l.lfvServerUrl)}:n?{transport:"http",url:mo(n)}:{transport:"websocket",url:mo(M)};if(n&&!o&&!c&&!l)i()?.warn("Vault-compatible secret stores usually require a token, but one was not provided. Vault requests may fail.");async function a(){if(c){let S=await Wi(c,d,i());return{...go,...Di,...ll(S)}}return{...u}}async function w(S){let O=H(S);if(c){let k=await Wi(c,d,i());return{url:O,clientId:y?.clientId??c.clientId,token:k,header:"Authorization"}}return{url:O,clientId:y?.clientId,token:y?.token??o,header:y?.header??"X-Vault-Token"}}function v(S){if(!l)throw Error(`Vault LFV capability is not configured for path ${S}`);let O=b.get(S);if(O)return O;let k=kt({...l,log:l.log??i(),path:S},t);return b.set(S,k),k}function L(S){if(!n)throw Error(`Vault HTTP capability is not configured for path ${S}`);return n}function H(S){if(!M)throw Error(`Vault websocket capability is not configured for path ${S}`);return M}async function J(S,O){let k=await w(typeof O.path==="string"?O.path:"/");return fo(k,S,O,i())}async function Y(S,O){let k=L(S),m;try{let f=await a(),T=new URL(`${k}/${S}`);if(typeof O?.kmsSlots==="number"&&Number.isInteger(O.kmsSlots)&&O.kmsSlots>=1)T.searchParams.set("kms_slots",String(O.kmsSlots));m=await fetch(T,{headers:f})}catch(f){throw new we(`Vault request failed from URL: ${k}/${S}`,S,void 0,"connection",{cause:f})}if(m.status!==200){if(m.status===404)throw new ot(S);let f=m.status===401||m.status===403,T=f?`Vault returned ${m.status} ${m.statusText} (auth error) from URL: ${k}/${S}`:`Vault returned invalid status, ${m.status}: '${m.statusText}' from URL: ${k}/${S}`;throw new we(T,S,m.status,f?"auth":"invalid_status")}try{let T=(await Tt(m,{log:i(),operation:"vault.secret.read",redact:!0})).data;if(!T?.metadata||!("data"in T))throw Error("Missing vault secret data");let A=T.metadata.created_time??T.metadata.created;return{data:T.data,metadata:{path:typeof T.metadata.path==="string"?T.metadata.path:S,version:typeof T.metadata.version==="number"?T.metadata.version:0,created:A instanceof Date?A:typeof A==="string"?new Date(A):new Date,...St(T.metadata)?{contentType:St(T.metadata)}:{}}}}catch(f){throw new we("Error retrieving secret",S,void 0,"invalid_payload",{cause:f})}}async function re(S,O){let k=await w(S);return po(k,S,i(),O?.kmsSlots)}async function ue(S){let O=L(S),k=`${hr(O)}/metadata/${S}`,m=await a(),f=await fetch(k,{headers:m});if(f.status!==200)throw new we(`Vault getMetadata failed (${f.status}) for ${S}`,S,f.status,"invalid_status");let T=await Tt(f,{log:i(),operation:"vault.metadata.read",redact:!0}).catch(()=>null);if(!T?.metadata||typeof T.metadata!=="object")throw new we(`Vault getMetadata returned invalid payload for ${S}`,S,f.status,"invalid_payload");return T.metadata}async function se(S,O,k){let m=L(O),f=`${hr(m)}/${S}/${O}`,T=await a(),A=await fetch(f,{method:"POST",headers:T,body:JSON.stringify({reason:k?.reason,severity:k?.severity,incident_ref:k?.incidentRef})});if(A.status!==200&&A.status!==202&&A.status!==204)throw new we(`Vault ${S} failed (${A.status}) for ${O}`,O,A.status,"invalid_status")}async function K(S,O){if(l)return await v(S).getFullSecret(S,O);if(n)return await Y(S,O);return await re(S,O)}async function ee(S,O,k){if(!cl(O))throw Error(`putSecret requires an object value for vault source at path ${S}`);if(l){await v(S).putSecret(S,O,k);return}if(n){let m=L(S),f=await a();if(f["X-Ionite-Mime-Type"]=k.contentType.mimeType,f["X-Ionite-Secret-Format"]=k.contentType.format,k.contentType.schemaUrl)f["X-Ionite-Schema-Url"]=k.contentType.schemaUrl;if(k.contentType.typeId)f["X-Ionite-Secret-Type"]=k.contentType.typeId;let T=await fetch(`${m}/${S}`,{method:"POST",headers:f,body:JSON.stringify(O)});if(T.status!==200&&T.status!==201&&T.status!==204)throw new we(`Vault putSecret failed (${T.status}) for ${S}`,S,T.status,"invalid_status");return}await J("put_secret",{path:S,data:O,content_type:Kr(k.contentType)})}async function z(S,O){if(l){await v(S).deleteSecret(S,O);return}if(n){let k=L(S),m=await a(),f=await fetch(`${k}/${S}`,{method:"DELETE",headers:m});if(f.status!==200&&f.status!==202&&f.status!==204)throw new we(`Vault deleteSecret failed (${f.status}) for ${S}`,S,f.status,"invalid_status");return}await J("delete_secret",{path:S})}async function D(S,O){if(l)return await v(S).listPaths(S,O);if(n){let f=`${L(S)}/${S}`,T=async(V)=>{let oe=await a();if(V==="LIST")return fetch(f,{method:"LIST",headers:oe});let te=f.includes("?")?"&":"?";return fetch(`${f}${te}list=true`,{method:"GET",headers:oe})},A=await T("LIST");if(A.status===405||A.status===501)A=await T("GET");if(A.status!==200)throw new we(`Vault listPaths failed (${A.status}) for ${S}`,S,A.status,"invalid_status");let N=await Tt(A,{log:i(),operation:"vault.paths.list",redact:!0}).catch(()=>null),Z;if(N&&typeof N==="object"){let V=N,oe=V.data;if(oe&&typeof oe==="object")Z=oe.keys;else Z=V.keys}if(!Array.isArray(Z))throw new we(`Vault listPaths returned an unexpected response for ${S}`,S,void 0,"invalid_payload");return Z.filter((V)=>typeof V==="string")}let k=await J("list_paths",{path:S});if(!Array.isArray(k.items))throw Error(`Vault websocket list_paths returned invalid payload for ${S}`);return k.items.filter((m)=>typeof m==="string")}async function Q(S,O){if(l)return await v(S).exists(S,O);if(n){let m=L(S),f=await a(),T=await fetch(`${m}/${S}`,{headers:f});if(T.status===200)return!0;if(T.status===404)return!1;if(T.status===401||T.status===403)throw new we(`Vault exists failed (${T.status}) for ${S} (auth error)`,S,T.status,"auth");throw new we(`Vault exists failed (${T.status}) for ${S}`,S,T.status,"invalid_status")}let k=await J("exists",{path:S});if(typeof k.exists!=="boolean")throw Error(`Vault websocket exists returned invalid payload for ${S}`);return k.exists}async function ne(S,O,k){if(l){await v(S).requestRotate(S,O,k);return}if(n){await se("rotate/request",S,O);return}await J("request_rotate",{path:S,reason:O?.reason,severity:O?.severity,incident_ref:O?.incidentRef})}async function ie(S,O,k){if(l){await v(S).requestRevoke(S,O,k);return}if(n){await se("revoke/request",S,O);return}await J("request_revoke",{path:S,reason:O?.reason,severity:O?.severity,incident_ref:O?.incidentRef})}async function ce(S,O,k){if(l)return await v(S).parkKmsKey(S,O,k);if(n){let f=L(S),T=`${hr(f)}/kms/park/${S}`,A=await a(),N=await fetch(T,{method:"POST",headers:A,body:JSON.stringify({key_id:O.keyId,status:O.status,reason:O.reason})});if(N.status!==200&&N.status!==202)throw new we(`Vault kms/park failed (${N.status}) for ${S}`,S,N.status,"invalid_status");return ji(await Tt(N,{log:i(),operation:"vault.kms.park",redact:!0}).catch(()=>null),S,"http")}let m=await J("kms_park",{path:S,key_id:O.keyId,status:O.status,reason:O.reason});return ji(m,S,"websocket")}async function ae(S,O,k){if(l)return await v(S).addKmsKeys(S,O,k);if(n){let f=L(S),T=`${hr(f)}/kms/add-keys/${S}`,A=await a(),N=await fetch(T,{method:"POST",headers:A,body:JSON.stringify({keys:O.keys})});if(N.status!==200&&N.status!==202)throw new we(`Vault kms/add-keys failed (${N.status}) for ${S}`,S,N.status,"invalid_status");return Ni(await Tt(N,{log:i(),operation:"vault.kms.add_keys",redact:!0}).catch(()=>null),S,"http")}let m=await J("kms_add_keys",{path:S,keys:O.keys});return Ni(m,S,"websocket")}async function C(S,O,k){if(l)return await v(S).revokeKmsKey(S,O,k);if(n){let f=L(S),T=`${hr(f)}/kms/revoke-key/${S}`,A=await a(),N=await fetch(T,{method:"POST",headers:A,body:JSON.stringify({key_id:O.keyId,reason:O.reason})});if(N.status!==200&&N.status!==202)throw new we(`Vault kms/revoke-key failed (${N.status}) for ${S}`,S,N.status,"invalid_status");return $i(await Tt(N,{log:i(),operation:"vault.kms.revoke_key",redact:!0}).catch(()=>null),S,"http")}let m=await J("kms_revoke_key",{path:S,key_id:O.keyId,reason:O.reason});return $i(m,S,"websocket")}async function g(S,O){if(l)return await v(S).getMetadata(S,O);if(n)return await ue(S);let k=await J("read_metadata",{path:S});if(!k.metadata||typeof k.metadata!=="object")throw Error(`Vault websocket read_metadata returned invalid payload for ${S}`);return k.metadata}async function P(S,O,k){if(!s)throw new je(r,S);return st({getFullSecret:Y},S,O,s,i(),k,{onHealth:(m)=>{R=!m}})}async function I(S,O,k){let m=await w(S);return xi(m,S,O,k,i(),{onHealth:(f)=>{W=!f}})}function U(S){let O=()=>{if(_.delete(O))S()};return _.add(O),O}function E(){if(p?.isAvailable?.()===!1)return!0;for(let S of b.values())if(S.isAvailable?.()===!1)return!0;return!1}let F={type:r,origin:q,isAvailable:()=>!R&&!W&&!E(),get:(S,O)=>Ge(()=>K(S,O)),getFullSecret:K,getSecret:async(S,O)=>(await K(S,O)).data,putSecret:ee,deleteSecret:z,listPaths:D,exists:Q,requestRotate:ne,requestRevoke:ie,parkKmsKey:ce,addKmsKeys:ae,revokeKmsKey:C,getMetadata:g,subscribe:async(S,O,k)=>{let m;if(M)m=await I(S,O,k);else if(l)m=await v(S).subscribe(S,O,k);else m=await P(S,O,k);return U(m)},...p?{subscribeEvents:(S)=>U(p.subscribeEvents?.(S)??(()=>{}))}:M?{subscribeEvents:(S)=>{let O,k=!1;return w("/").then((m)=>Ui(m,S,i())).then((m)=>{if(k){m();return}O=m}).catch((m)=>{i()?.warn("Vault websocket event subscription failed",m)}),U(()=>{k=!0,O?.()})}}:{},close:()=>{for(let O of Array.from(_))try{O()}catch(k){i()?.warn("Vault source close: failed to release a subscription",k)}_.clear();let S=(O)=>{if(!O?.close)return;try{Promise.resolve(O.close()).catch((k)=>{i()?.warn("Vault source close: LFV close failed",k)})}catch(k){i()?.warn("Vault source close: LFV close failed",k)}};for(let O of b.values())S(O);S(p),b.clear(),d.token=void 0,d.expiresAt=void 0},get log(){return e.log},set log(S){e.log=S}};if(p)F.isDeliveryRequest=(S)=>p.isDeliveryRequest(S),F.isEventsRequest=(S)=>p.isEventsRequest(S),F.handleDelivery=(S)=>p.handleDelivery(S),F.handleEvents=(S)=>p.handleEvents(S),Object.defineProperties(F,{deliveryPath:{value:p.deliveryPath,enumerable:!0},eventsPath:{value:p.eventsPath,enumerable:!0},callbackKey:{value:p.callbackKey,enumerable:!0},trustId:{value:p.trustId,enumerable:!0}});return F}class ho extends yl{constructor(e,t){super(e,{status:Qe(t),upstreamStatus:t});this.name="AzureKeyVaultError"}}function on(e,t){if(!e||e.trim().length===0)throw Error(`Missing required Azure config: ${t}`);return e}function hl(e){return e.replace(/^\/+|\/+$/g,"").replaceAll("/","-")}function yo(e,t){return`${e.replace(/\/+$/g,"")}/${t.replace(/^\/+/g,"")}`}function wl(e){try{let r=new URL(e).pathname.split("/").filter(Boolean),n=r.indexOf("secrets");if(n===-1)return;return r[n+2]||void 0}catch{return}}function Sl(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function sn(e){let t=e.apiVersion??"7.4",r=e.scope??"https://vault.azure.net/.default",n=e.secretNameTransform??hl,o=e.authMethod,s="/var/run/secrets/azure/tokens/azure-identity-token",i=e.federatedTokenFile??"/var/run/secrets/azure/tokens/azure-identity-token",c=e.vaultUrl??(e.vaultName?`https://${e.vaultName}.vault.azure.net`:void 0)??void 0,d=on(c,"vaultUrl or vaultName (ION_AZURE_KEY_VAULT_URL / ION_AZURE_KEY_VAULT_NAME)");async function u(K){try{return await pl(K),!0}catch{return!1}}let l,y,p=!1;async function b(K){let{entraTenantId:ee,clientId:z}=e;if(!ee)throw Error("Workload identity requires entraTenantId");if(!z)throw Error("Workload identity requires clientId");if(!await u(i))throw Error(`Federated token file not found at ${i}`);let D=(await fl(i,"utf8")).trim();if(!D)throw Error("Federated token file was empty");let Q=`https://login.microsoftonline.com/${encodeURIComponent(ee)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:z,grant_type:"client_credentials",scope:r,client_assertion_type:"urn:ietf:params:oauth:client-assertion-type:jwt-bearer",client_assertion:D}),ie=await fetch(Q,{method:"POST",headers:{...Gt,...Ki},body:ne});if(ie.status!==200)throw Error(`Azure workload identity token exchange returned ${ie.status} ${ie.statusText}`);let ce=await nn(ie,{redact:!0});if(!ce?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:ce.access_token,expiresAtMs:K+(ce.expires_in??0)*1000},ce.access_token}async function M(K){let ee=e.imdsApiVersion??"2018-02-01",z="https://vault.azure.net",D=new URL("http://169.254.169.254/metadata/identity/oauth2/token");if(D.searchParams.set("api-version",ee),D.searchParams.set("resource","https://vault.azure.net"),e.managedIdentityClientId)D.searchParams.set("client_id",e.managedIdentityClientId);let Q=await fetch(D.toString(),{headers:{Metadata:"true",...Gt}});if(Q.status!==200)throw Error(`Azure IMDS token endpoint returned ${Q.status} ${Q.statusText}`);let ne=await nn(Q,{redact:!0});if(!ne?.access_token)throw Error("IMDS token response missing access_token");let ie=K+60000;if(ne.expires_on){let ce=Number.parseInt(ne.expires_on,10);if(Number.isFinite(ce)&&ce>0)ie=ce*1000;else{let ae=Date.parse(ne.expires_on);if(Number.isFinite(ae))ie=ae}}else if(ne.expires_in){let ce=Number.parseInt(ne.expires_in,10);if(Number.isFinite(ce)&&ce>0)ie=K+ce*1000}return l={accessToken:ne.access_token,expiresAtMs:ie},ne.access_token}async function _(K){let ee=on(e.entraTenantId,"entraTenantId (or ION_AZURE_TENANT_ID/AZURE_TENANT_ID)"),z=on(e.clientId,"clientId (or ION_AZURE_CLIENT_ID/AZURE_CLIENT_ID)"),D=on(e.clientSecret,"clientSecret (or ION_AZURE_CLIENT_SECRET)"),Q=`https://login.microsoftonline.com/${encodeURIComponent(ee)}/oauth2/v2.0/token`,ne=new URLSearchParams({client_id:z,client_secret:D,grant_type:"client_credentials",scope:r}),ie=await fetch(Q,{method:"POST",headers:{...Gt,...Ki},body:ne});if(ie.status!==200)throw Error(`Azure token endpoint returned ${ie.status} ${ie.statusText}`);let ce=await nn(ie,{redact:!0});if(!ce?.access_token)throw Error("Azure token response missing access_token");return l={accessToken:ce.access_token,expiresAtMs:K+(ce.expires_in??0)*1000},ce.access_token}async function R(){let K=Date.now();if(l&&l.expiresAtMs-60000>K)return l.accessToken;if(y)return y;y=(async()=>{if(o==="workload_identity")return await b(K);if(o==="managed_identity")return await M(K);if(o==="client_secret")return await _(K);if(await u(i))try{return await b(K)}catch{}try{return await M(K)}catch{}return await _(K)})();try{return await y}finally{y=void 0}}async function W(K){let ee=await R(),z=yo(d,`/secrets/${encodeURIComponent(K)}?api-version=${encodeURIComponent(t)}`),D=await fetch(z,{headers:{Authorization:`Bearer ${ee}`,...Gt}});if(D.status!==200)throw new ho(`Key Vault request failed (${D.status})`,D.status);return await nn(D,{redact:!0})}async function q(K,ee){let z=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${z}`:z,Q=await W(D),ne=Q.value;try{ne=JSON.parse(Q.value)}catch{}let ie=Q.attributes?.created?Q.attributes.created*1000:void 0,ce=wl(Q.id),ae=Q.contentType?Dr({mimeType:Q.contentType,format:Q.tags?.["ionite-format"],schemaUrl:Q.tags?.["ionite-schema-url"],typeId:Q.tags?.["ionite-type-id"]}):void 0;return{data:ne,metadata:{path:K,version:Number.parseInt(ce??"",10)||0,created:ie?new Date(ie):new Date,...ae?{contentType:ae}:{}}}}async function a(K,ee,z){if(!Sl(ee))throw Error(`putSecret requires an object value for azure source at path ${K}`);let D=n(K),Q=e.secretNamePrefix?`${e.secretNamePrefix}${D}`:D,ne=await R(),ie=yo(d,`/secrets/${encodeURIComponent(Q)}?api-version=${encodeURIComponent(t)}`),ce=JSON.stringify({value:JSON.stringify(ee),contentType:z.contentType.mimeType,tags:{"ionite-format":z.contentType.format,...z.contentType.schemaUrl?{"ionite-schema-url":z.contentType.schemaUrl}:{},...z.contentType.typeId?{"ionite-type-id":z.contentType.typeId}:{}}}),ae=await fetch(ie,{method:"PUT",headers:{Authorization:`Bearer ${ne}`,...ml,...Gt},body:ce});if(ae.status!==200&&ae.status!==201)throw Error(`Key Vault putSecret failed (${ae.status}) for ${K}`)}async function w(K,ee){let z=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${z}`:z,Q=await R(),ne=yo(d,`/secrets/${encodeURIComponent(D)}?api-version=${encodeURIComponent(t)}`),ie=await fetch(ne,{method:"DELETE",headers:{Authorization:`Bearer ${Q}`,...Gt}});if(ie.status!==200&&ie.status!==202&&ie.status!==204)throw Error(`Key Vault deleteSecret failed (${ie.status}) for ${K}`)}async function v(K,ee){throw Error(`listPaths is not implemented for Azure Key Vault source at path ${K}`)}async function L(K,ee){try{return await q(K),!0}catch(z){if(z instanceof ho&&z.upstreamStatus===404)return!1;throw z}}async function H(K,ee,z){throw Error(`requestRotate is not implemented for Azure Key Vault source at path ${K}`)}async function J(K,ee,z){throw Error(`requestRevoke is not implemented for Azure Key Vault source at path ${K}`)}async function Y(K){throw Error(`parkKmsKey is not supported for Azure Key Vault source at path ${K}`)}async function re(K){throw Error(`addKmsKeys is not supported for Azure Key Vault source at path ${K}`)}async function ue(K){throw Error(`revokeKmsKey is not supported for Azure Key Vault source at path ${K}`)}async function se(K,ee){let z=n(K),D=e.secretNamePrefix?`${e.secretNamePrefix}${z}`:z,Q=await W(D),ne=Q.contentType?Dr({mimeType:Q.contentType,format:Q.tags?.["ionite-format"],schemaUrl:Q.tags?.["ionite-schema-url"],typeId:Q.tags?.["ionite-type-id"]}):void 0;return{id:Q.id,...ne?{content_type:ne}:{},...Q.attributes??{}}}return{type:e.type,origin:{url:gl(d)},isAvailable:()=>!p,get:(K,ee)=>Ge(()=>q(K,ee)),getFullSecret:q,getSecret:async(K,ee)=>(await q(K,ee)).data,putSecret:a,deleteSecret:w,listPaths:v,exists:L,requestRotate:H,requestRevoke:J,parkKmsKey:Y,addKmsKeys:re,revokeKmsKey:ue,getMetadata:se,subscribe:(K,ee,z)=>{if(!e.ttl)throw new je("azure",K);return Ct(e.ttl),st({getFullSecret:q},K,ee,e.ttl,void 0,z,{onHealth:(D)=>{p=!D}})},close:()=>{l=void 0,y=void 0,p=!1}}}var wo=Symbol("ion.secretsSourceState");function kl(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${n}`)};return{type:"dev",get:(r,n)=>Ge(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[wo]:"unavailable"}}function Fi(e){let t=(r,n)=>{throw Error(`${r} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${n}`)};return{type:"dev",get:(r,n)=>Ge(()=>Promise.reject(t("get",r))),getFullSecret:(r,n)=>Promise.reject(t("getFullSecret",r)),getSecret:(r,n)=>Promise.reject(t("getSecret",r)),putSecret:(r,n,o)=>Promise.reject(t("putSecret",r)),subscribe:async(r,n)=>(t("subscribe",r),()=>{}),deleteSecret:(r,n)=>Promise.reject(t("deleteSecret",r)),listPaths:(r,n)=>Promise.reject(t("listPaths",r)),exists:(r,n)=>Promise.reject(t("exists",r)),requestRotate:(r,n,o)=>Promise.reject(t("requestRotate",r)),requestRevoke:(r,n,o)=>Promise.reject(t("requestRevoke",r)),parkKmsKey:(r,n,o)=>Promise.reject(t("parkKmsKey",r)),addKmsKeys:(r,n,o)=>Promise.reject(t("addKmsKeys",r)),revokeKmsKey:(r,n,o)=>Promise.reject(t("revokeKmsKey",r)),getMetadata:(r,n)=>Promise.reject(t("getMetadata",r)),[wo]:"removed"}}function bl(e){return e.type==="vault"&&e.lfv!=null}function Rl(e,t,r,n){if(!bl(t))return;if(r||n)return;throw Error(`Secrets source "${e}" enables LFV without a FrameworkConfig.lfv.callbackTransport. Wire createRedisLfvTransport(...) as lfv.callbackTransport so OTP callbacks can reach the initiating replica, or set lfv.singleProcess: true to declare this process is the only LFV callback receiver.`)}function Tl(e,t,r){if(t.type==="vault")return Bt(t,r);if(t.type==="azure")return sn(t);if(t.type==="aws"||t.type==="gcp"||t.type==="dev")throw Error(`Secrets source "${e}" uses type "${t.type}", which is not implemented in this build. Use a vault or azure source.`);throw Error(`Unsupported secrets source type for "${e}"`)}function Cl(e,t){let r=(n)=>{t.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",error:n instanceof Error?n.message:String(n)})};try{Promise.resolve(e.close?.()).catch(r)}catch(n){r(n)}}function Il(e){let t=new Map,r=new Map,n=new Map;for(let[o,s]of Object.entries(e)){if(!Vi(s))continue;let i=t.get(s.deliveryPath);if(i)throw Error(`LFV delivery path "${s.deliveryPath}" is claimed by both secrets sources "${i}" and "${o}"; delivery paths must be globally unique.`);t.set(s.deliveryPath,o);let c=r.get(s.eventsPath);if(c)throw Error(`LFV events path "${s.eventsPath}" is claimed by both secrets sources "${c}" and "${o}"; events paths must be globally unique.`);r.set(s.eventsPath,o);let d=n.get(s.callbackKey);if(d&&d.trustId!==s.trustId)throw Error(`LFV callback key "${s.callbackKey}" is claimed by secrets sources "${d.sourceName}" and "${o}" with different verify JWKS; a callback path must use a single trust key.`);if(!d)n.set(s.callbackKey,{sourceName:o,trustId:s.trustId})}}function Vi(e){return typeof e.isDeliveryRequest==="function"&&typeof e.isEventsRequest==="function"&&typeof e.handleDelivery==="function"&&typeof e.handleEvents==="function"}function Pl(e,t,r){let n={...t},o=[],s=(c)=>{if(n[c]!==void 0)delete n[c],o.push(c)};s("token"),s("clientSecret"),s("workload");let i=n.websocket;if(i&&typeof i==="object"&&i.token!==void 0){let c={...i};delete c.token,n.websocket=c,o.push("websocket.token")}if(o.length>0)r.warn("Dropped ConfigSource-owned secrets fields set in framework config",{"ion.operation":"secrets.config.merge","ion.outcome":"degraded",sourceName:e,"ion.droppedFields":o});return n}function Ol(e,t,r){let n={name:e,type:t.type,ready:t.isReady?.()??!0};if(r?.type==="dev")n.url=r.ioniteUrl;if(r?.type==="vault")n.url=r.url,n.clientId=r.workload?.clientId??r.lfv?.clientId??r.websocket?.clientId;if(r?.type==="aws")n.url=r.webhookUrl;if(r?.type==="azure")n.url=r.vaultUrl,n.clientId=r.clientId??r.managedIdentityClientId,n.authMethod=r.authMethod;return Se(n)}function El(e,t,r){let n={},o=new Set([...Object.keys(t??{}),...Object.keys(r??{})]);for(let s of o){let i=t?.[s],c=r?.[s],d=c?Pl(s,c,e):void 0;n[s]={...i??{},...d??{}}}return n}function an(e){return e[wo]??"available"}function Al(e,t,r){let n=t,o=new Set,s=new Set,i=new Set,c=De(r,`Secrets source "${e}"`),d=()=>an(n)==="available",u=ye(`Secrets source "${e}"`,d),l=(a,w,v)=>Error(`${a} timed out after ${v}ms waiting for source "${e}" to be configured by the ConfigSource at path ${w}`),y=(a,w)=>Error(`${a} is unavailable for source "${e}" because it is no longer configured on this Ionite instance at path ${w}`),p=(a,w,v)=>{let L=an(n);if(L==="available")return Promise.resolve(n);if(L==="removed")return Promise.reject(y(a,w));return new Promise((H,J)=>{let Y={method:a,path:w,resolve:(ue)=>{if(Y.timeout)clearTimeout(Y.timeout);i.delete(Y),H(ue)},reject:(ue)=>{if(Y.timeout)clearTimeout(Y.timeout);i.delete(Y),J(ue)}},re=v?.timeout;if(typeof re==="number"&&re>0)Y.timeout=setTimeout(()=>{Y.reject(l(a,w,re))},re);i.add(Y)})},b=(a)=>{for(let w of Array.from(i))w.resolve(a)},M=()=>{for(let a of Array.from(i))a.reject(y(a.method,a.path))},_=async(a,w=!1)=>{let v=a.guard.next();if(a.unsubscribe?.(),a.unsubscribe=void 0,a.closed)return;if(an(n)==="unavailable"&&a.options?.mode!=="wait"){if(w)throw Error(`subscribe is unavailable for source "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet (missing type/details) at path ${a.path}`);return}try{let H=await(a.options?.mode==="wait"?await p("subscribe",a.path,a.options):n).subscribe(a.path,(J)=>{if(!a.closed)a.onChange(J)},a.options);if(a.closed||!a.guard.isCurrent(v)){H?.();return}a.unsubscribe=H}catch(L){if(w)throw L;if(Br(L)){r.debug("Secrets source subscription read aborted by source swap",{"ion.operation":"secrets.subscription.refresh",sourceName:e,path:a.path});return}r.warn("Secrets source subscription refresh failed",{"ion.operation":"secrets.subscription.refresh","ion.outcome":"degraded",sourceName:e,path:a.path,error:L instanceof Error?L.message:String(L)})}},R=(a,w=!1)=>{if(a.unsubscribe?.(),a.unsubscribe=void 0,a.closed)return;if(!n.subscribeEvents){if(w)throw Error(`Secrets source "${e}" does not support lifecycle event subscriptions`);return}a.unsubscribe=n.subscribeEvents((v)=>{if(!a.closed)a.listener(v)})},W={get type(){return n.type},get origin(){return n.origin},beforeChange:c.beforeChange,afterChange:c.afterChange,isAvailable:()=>d()&&(n.isAvailable?.()??!0),isReady:u.isReady,ready:u.ready,get:(a,w)=>Ge(async()=>(await p("get",a,w)).getFullSecret(a,w)),getFullSecret:async(a,w)=>(await p("getFullSecret",a,w)).getFullSecret(a,w),getSecret:async(a,w)=>(await p("getSecret",a,w)).getSecret(a,w),putSecret:async(a,w,v)=>(await p("putSecret",a,v)).putSecret(a,w,v),subscribe:async(a,w,v)=>{let L={path:a,onChange:w,options:v,closed:!1,guard:Xr()};o.add(L);try{await _(L,!0)}catch(H){throw o.delete(L),H}return()=>{L.closed=!0,L.guard.next(),o.delete(L),L.unsubscribe?.(),L.unsubscribe=void 0}},subscribeEvents:(a)=>{let w={listener:a,closed:!1};s.add(w);try{R(w,!0)}catch(v){throw s.delete(w),v}return()=>{w.closed=!0,s.delete(w),w.unsubscribe?.(),w.unsubscribe=void 0}},deleteSecret:async(a,w)=>(await p("deleteSecret",a,w)).deleteSecret(a,w),listPaths:async(a,w)=>(await p("listPaths",a,w)).listPaths(a,w),exists:async(a,w)=>(await p("exists",a,w)).exists(a,w),requestRotate:async(a,w,v)=>(await p("requestRotate",a,v)).requestRotate(a,w,v),requestRevoke:async(a,w,v)=>(await p("requestRevoke",a,v)).requestRevoke(a,w,v),parkKmsKey:async(a,w,v)=>(await p("parkKmsKey",a,v)).parkKmsKey(a,w,v),addKmsKeys:async(a,w,v)=>(await p("addKmsKeys",a,v)).addKmsKeys(a,w,v),revokeKmsKey:async(a,w,v)=>(await p("revokeKmsKey",a,v)).revokeKmsKey(a,w,v),getMetadata:async(a,w)=>(await p("getMetadata",a,w)).getMetadata(a,w)},q=(a)=>{try{Promise.resolve(a.close?.()).catch((w)=>{r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:w instanceof Error?w.message:String(w)})})}catch(w){r.warn("Secrets source close failed",{"ion.operation":"secrets.source.close","ion.outcome":"degraded",sourceName:e,error:w instanceof Error?w.message:String(w)})}};return{api:W,update(a){if(a===n)return;let w=n;c.emitBefore(),n=a;let v=an(a);if(v==="available")b(a);else if(v==="removed")M();u.refresh();for(let L of o)_(L);for(let L of s)R(L);q(w),c.emitAfter()},close(){for(let a of o)a.closed=!0,a.guard.next(),a.unsubscribe?.(),a.unsubscribe=void 0;o.clear();for(let a of s)a.closed=!0,a.unsubscribe?.(),a.unsubscribe=void 0;s.clear(),M(),u.settle(),q(n)}}}function zi(e,t=new Map){let r=new Map,n=new Map,o=new Map,s,i=!1,c=new Map,d=De(e,"Secrets"),u=!1,l=()=>{for(let a of r.keys()){let w=c.get(a);if(w&&w.api.isReady?.()===!1)return!1}return!0},y=ye("Secrets module",()=>u&&l()),p=(a,w)=>Ol(a,w,o.get(a)),b=(a)=>{let w=c.get(a);if(w)return w;let v=Al(a,r.get(a)??Fi(a),e);if(Object.defineProperty(v.api,"describe",{value:()=>p(a,v.api),enumerable:!1,configurable:!0}),c.set(a,v),!(a in q))Object.assign(q,{[a]:v.api});return v},M=(a)=>{let w=c.get(a)?.api;if(w)return w;throw e.warn("Secrets source is not configured",{"ion.operation":"secrets.source.resolve","ion.outcome":"failure",sourceName:a}),Error(`Secrets source "${a}" is not configured`)},_=()=>Array.from(r.values()).filter(Vi),R=(a)=>_().find((w)=>w.isDeliveryRequest(a)),W=(a)=>_().find((w)=>w.isEventsRequest(a)),q;return q={describe:()=>({module:"secrets",active:u,ready:y.isReady(),sources:Array.from(r.keys(),(a)=>p(a,b(a).api))}),get config(){return Object.fromEntries(Array.from(r.keys(),(a)=>[a,b(a).api]))},beforeChange:d.beforeChange,afterChange:d.afterChange,isReady:y.isReady,isAvailable:()=>{for(let a of c.values()){if(a.api.isReady?.()===!1)continue;if(a.api.isAvailable?.()===!1)return!1}return!0},ready:y.ready,listSecretsSources:()=>Array.from(r.keys()),getSecretsSource:(a)=>r.has(a)?b(a).api:M(a),get:(a,w,v)=>q.getSecretsSource(a).get(w,v),getSecret:(a,w,v)=>q.getSecretsSource(a).getSecret(w,v),getFullSecret:(a,w,v)=>q.getSecretsSource(a).getFullSecret(w,v),putSecret:(a,w,v,L)=>q.getSecretsSource(a).putSecret(w,v,L),deleteSecret:(a,w,v)=>q.getSecretsSource(a).deleteSecret(w,v),listPaths:(a,w,v)=>q.getSecretsSource(a).listPaths(w,v),exists:(a,w,v)=>q.getSecretsSource(a).exists(w,v),requestRotate:(a,w,v,L)=>q.getSecretsSource(a).requestRotate(w,v,L),requestRevoke:(a,w,v,L)=>q.getSecretsSource(a).requestRevoke(w,v,L),parkKmsKey:(a,w,v,L)=>q.getSecretsSource(a).parkKmsKey(w,v,L),addKmsKeys:(a,w,v,L)=>q.getSecretsSource(a).addKmsKeys(w,v,L),revokeKmsKey:(a,w,v,L)=>q.getSecretsSource(a).revokeKmsKey(w,v,L),getMetadata:(a,w,v)=>q.getSecretsSource(a).getMetadata(w,v),subscribe:(a,w,v,L)=>q.getSecretsSource(a).subscribe(w,v,L),isLfvDeliveryRequest:(a)=>R(a)!==void 0,isLfvEventsRequest:(a)=>W(a)!==void 0,handleLfvDelivery:async(a)=>{let w=R(a);if(!w)return me();return w.handleDelivery(a)},handleLfvEvents:async(a)=>{let w=W(a);if(!w)return me();return w.handleEvents(a)}},{update(a,w,v,L,H){let J=a!==void 0||w!==void 0;if(!J&&!u&&c.size===0)return;let Y=El(e,a,w),re=H===!0,ue=L!==s,se=re!==i,K=new Map,ee=new Map,z=[];try{for(let[D,Q]of Object.entries(Y)){let ne=vl(Q),ie=r.get(D);if(ie&&n.get(D)===ne&&!ue&&!se){K.set(D,ie),ee.set(D,ne);continue}let ce;if(!Q.type)ce=kl(D);else{if(v?.validateSourceConfig?.(D,Q),t.has(D)&&a?.[D])e.warn(`RemoteConfig secrets source "${D}" is superseded by the framework LFV bootstrap source.`);if(!t.has(D))Rl(D,Q,L,re),ce=Tl(D,Q,L),z.push(ce);else ce=t.get(D)}K.set(D,ce),ee.set(D,ne)}Il(Object.fromEntries(K))}catch(D){for(let Q of z)Cl(Q,e);throw D}d.emitBefore(),u=J,s=L,i=re;for(let[D,Q]of K)r.set(D,Q),n.set(D,ee.get(D)),o.set(D,Y[D]),b(D).update(Q);for(let[D,Q]of c){if(K.has(D))continue;r.delete(D),n.delete(D),o.delete(D),Q.update(Fi(D))}return y.refresh(),d.emitAfter(),q},close(){for(let a of c.values())a.close();c.clear(),r.clear(),n.clear(),o.clear(),s=void 0,u=!1,y.settle()}}}function So(e,t){let r=t.ttlMs,n=Math.max(1,Math.floor(t.maxEntries)),o=new Map,s=()=>Date.now();function i(){while(o.size>n){let d=o.keys().next().value;if(d===void 0)break;o.delete(d)}}function c(d,u){o.delete(d),o.set(d,{session:u,expiresAt:s()+r}),i()}return{capabilities:e.capabilities,async create(d){await e.create(d)},async get(d){let u=o.get(d);if(u){if(u.expiresAt>s())return o.delete(d),o.set(d,u),u.session;o.delete(d)}let l=await e.get(d);if(l)c(d,l);return l},async update(d,u){await e.update(d,u),o.delete(d)},async delete(d){await e.delete(d),o.delete(d)}}}import{deepEqualPlain as Bi,IoniteError as Re,trimTrailingSlash as Pt,validationFailureResponse as xl}from"@ionite/core";import{getCachedVerificationKey as Ul}from"@ionite/core/server";import{randomBytes as _l}from"node:crypto";var wr=3600;function vo(e){let t=e.path.trim();if(!t.startsWith("/")||t.startsWith("//"))throw Error("actionRequired path must be an absolute App path.");let r=e.ttlSeconds??wr;if(!Number.isInteger(r)||r<60)throw Error("actionRequired ttlSeconds must be an integer of at least 60.");let n=_l(24).toString("base64url"),o=new URL(t,e.origin.endsWith("/")?e.origin:`${e.origin}/`);return o.searchParams.set("rt",n),{requestToken:n,actionUrl:o.toString(),expiresAt:new Date((e.now??Date.now())+r*1000).toISOString()}}function Ll(e,t=Date.now()){if(!e)return!0;let r=Date.parse(e);return Number.isNaN(r)||r<=t}function Hi(){let e,t=ye("tm module",()=>e!==void 0),r=()=>{if(!e)throw new Re("Tenant Management is not ready",{status:503});return e},n={describe:()=>e?.describe()??{module:"tm",active:!1,ready:!1,enabled:!1,requestTokenTtlSeconds:wr},isReady:t.isReady,ready:t.ready,handler:(o)=>e?e.handler(o):Promise.resolve(Response.json({error:"Tenant Management is not ready"},{status:503})),getTenant:(o)=>r().getTenant(o),recordConsent:(o)=>r().recordConsent(o),actionRequired:(o)=>r().actionRequired(o)};return{handle:n,update(o,s){return e=o,t.refresh(),s?n:void 0}}}var Ml=600,ql=30;function Ji(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),r=t.padEnd(Math.ceil(t.length/4)*4,"=");return Uint8Array.from(atob(r),(n)=>n.charCodeAt(0)).buffer}function Gi(e){return JSON.parse(new TextDecoder().decode(new Uint8Array(Ji(e))))}function Yi(e){return Array.isArray(e)&&e.length>0&&e.every((t)=>typeof t==="string")}function Wl(e){if(!e||typeof e!=="object")throw new Re("Invalid staged integration handle",{status:400});let t=e;if(typeof t.iss!=="string"||!(typeof t.aud==="string"||Yi(t.aud))||typeof t.iat!=="number"||typeof t.exp!=="number"||typeof t.jti!=="string"||typeof t.ioniteId!=="string"||typeof t.productId!=="string"||typeof t.applicationId!=="string")throw new Re("Invalid staged integration claims",{status:400});return t}function jl(e,t){return Array.isArray(e)?e.includes(t):e===t}async function It(e){let t=await crypto.subtle.digest("SHA-256",new TextEncoder().encode(e));return Array.from(new Uint8Array(t),(r)=>r.toString(16).padStart(2,"0")).join("")}async function cn(e,t){let r=await Xi(e,t),n=Wl(r),o=Math.floor(Date.now()/1000),s=t.consentTtlSeconds??Ml;if(n.iat>o+60||n.exp-n.iat>s)throw new Re("Staged integration handle lifetime is invalid",{status:401});return{handle:e,ioniteName:n.ioniteName??t.ionite.name,ioniteId:n.ioniteId,productId:n.productId,applicationId:n.applicationId,issuedAt:new Date(n.iat*1000).toISOString(),expiresAt:new Date(n.exp*1000).toISOString(),requestId:n.jti,tenantHint:n.tenantHint}}async function Xi(e,t){let r=e.split(".");if(r.length!==3)throw new Re("Invalid staged integration handle",{status:400});let n=Gi(r[0]);if(!n||typeof n!=="object")throw new Re("Invalid staged integration handle",{status:400});let{alg:o,kid:s}=n;if(o!=="RS256"||typeof s!=="string"||s.length===0)throw new Re("Unsupported staged integration signature",{status:400});let i=Gi(r[1]);if(!i||typeof i!=="object")throw new Re("Invalid TM access token claims",{status:400});let c=i,d=await Ul(t.ionite.jwksUri,s,"tm:RS256",(p)=>crypto.subtle.importKey("jwk",p,{name:"RSASSA-PKCS1-v1_5",hash:"SHA-256"},!1,["verify"]));if(!await crypto.subtle.verify({name:"RSASSA-PKCS1-v1_5"},d,Ji(r[2]),new TextEncoder().encode(`${r[0]}.${r[1]}`)))throw new Re("Invalid staged integration signature",{status:401});let l=Math.floor(Date.now()/1000),y=c.azp??c.client_id;if(typeof c.iss!=="string"||c.iss.replace(/\/+$/,"")!==t.ionite.issuer.replace(/\/+$/,"")||!(typeof c.aud==="string"||Yi(c.aud))||!jl(c.aud,t.ionite.audience)||y!==t.ionite.clientId||typeof c.exp!=="number"||c.exp<=l)throw new Re("TM access token is not trusted or has expired",{status:401});return c}function Zi(e){try{return Pt(new URL(e,"http://dummy").pathname)}catch{let t=e.startsWith("/")?e:`/${e}`;return Pt(t)}}function Nl(e,t){let r=new URL(e.url);return new URL(`/${encodeURIComponent(t)}/`,r.origin).toString()}function $l(e,t){let r=Zi(t),n=Pt(e);if(n===r)return null;if(!n.startsWith(`${r}/`))return null;let o=n.slice(r.length+1);if(!o||o.includes("/"))return null;return decodeURIComponent(o)}function un(e){return e==="pending"||e==="processing"||e==="completed"||e==="failed"||e==="action_required"}function Dl(e){if(!un(e.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});if(e.status==="completed"){if(!e.tenantUrl)return Response.json({error:"Tenant store returned completed status without tenantUrl"},{status:500});return{body:{tenantUrl:e.tenantUrl,status:"completed"},status:201}}if(e.status==="pending"||e.status==="processing")return{body:{tenantUrl:e.tenantUrl,status:e.status},status:202};if(e.status==="action_required"){if(!e.actionUrl||!e.requestToken||!e.expiresAt)return Response.json({error:"Tenant store returned action_required status without action fields"},{status:500});return{body:{status:"action_required",actionUrl:e.actionUrl,requestToken:e.requestToken,expiresAt:e.expiresAt},status:200}}return{body:{tenantUrl:e.tenantUrl,status:"failed",error:e.error??"Tenant provisioning failed"},status:409}}function Qi(e,t,r){let n=r.validators.tenant.createTenantRequest,o=r.validators.tenant.updateTenantRequest;async function s(a,w){if(!w)return;try{await w()}catch(v){e.log.warn(`Tenant ${a} lifecycle hook failed`,{"ion.operation":`tm.tenant_${a}`,"ion.outcome":"error",error:v instanceof Error?v.message:String(v)})}}async function i(a,w){let{integration:v,configLocator:L}=a;if(v?.status!=="consented"||v.handoverAppliedAt||!L)return a;try{if(!(await r.store.getIon(a.id))?.isReady())return a;return await r.onHandoverApplied?.({tenant:a,previousLocator:w,destinationLocator:L}),await u().setIntegration(a.id,{...v,version:v.version+1,handoverAppliedAt:new Date().toISOString()},{expectedHandleHash:v.handleHash,expectedVersion:v.version})??await r.store.get(a.id)??a}catch(H){return e.log.error("Tenant config handover observation failed; the handover stays pending until a later GET succeeds",{"ion.operation":"tm.handover.observe","ion.outcome":"error",tenantId:a.id,error:H instanceof Error?H.message:String(H)},H),a}}function c(a,w){let v=(L)=>new URL(L,w).toString();return{readyzUrl:v(a.readyzUrl),capabilitiezUrl:v(a.capabilitiezUrl),sso:{loginUrl:v(a.sso.loginUrl),userUrl:v(a.sso.userUrl),logoutUrl:v(a.sso.logoutUrl),logoutBackChannelUrl:v(a.sso.logoutBackChannelUrl),refreshUrl:v(a.sso.refreshUrl),callbackUrl:v(a.sso.callbackUrl)},workload:{validateUrl:v(a.workload.validateUrl),jwksUrl:v(a.workload.jwksUrl)},iam:{basePath:v(a.iam.basePath),usersUrl:v(a.iam.usersUrl),groupsUrl:v(a.iam.groupsUrl),workloadsUrl:v(a.iam.workloadsUrl),customersUrl:v(a.iam.customersUrl)},ciam:{magicLinkUrl:v(a.ciam.magicLinkUrl),magicLinkLoginUrl:v(a.ciam.magicLinkLoginUrl),customerUrl:v(a.ciam.customerUrl),customerLoginUrl:v(a.ciam.customerLoginUrl),customerCallbackUrl:v(a.ciam.customerCallbackUrl),customerProvidersUrl:v(a.ciam.customerProvidersUrl),logoutUrl:v(a.ciam.logoutUrl)}}}function d(a,w){let v=r.tenantIonBasePath?.(a);if(!v)return;let L=new URL(w.url).origin,H=c(Fe(v),L);return{callbackUrl:H.sso.callbackUrl,ionUrls:H}}function u(){if(!r.store.setIntegration||!r.store.getByIntegrationHandleHash)throw new Re("Tenant integration requires store.setIntegration and store.getByIntegrationHandleHash",{status:501});return{setIntegration:r.store.setIntegration.bind(r.store),getByIntegrationHandleHash:r.store.getByIntegrationHandleHash.bind(r.store)}}async function l(a){let w=a.headers.get("Authorization");if(!w?.startsWith("Bearer "))return Response.json({error:"Unauthorized"},{status:401});try{await Xi(w.slice(7),t);return}catch{return Response.json({error:"Unauthorized"},{status:401})}}function y(a){let{integration:w,...v}=a;if(!w)return v;return{...v,integration:{ioniteName:w.ioniteName,ioniteId:w.ioniteId,applicationId:w.applicationId,productId:w.productId,status:w.status,expiresAt:w.expiresAt,requestedAt:w.requestedAt,decidedAt:w.decidedAt}}}async function p(a){let w=await a.json();if(!w||typeof w.handle!=="string"||w.handle.length===0)throw new Re("handle is required",{status:400});if(w.authorization!==void 0&&typeof w.authorization!=="string")throw new Re("authorization must be a string",{status:400});return{handle:w.handle,authorization:w.authorization}}async function b(a){if(a.method!=="GET")return Be(["GET"]);if(!r.onConnectRequest)return Response.json({error:"Tenant integration consent is not supported"},{status:501});let w=new URL(a.url).searchParams.get("handle");if(!w)return Response.json({error:"handle is required"},{status:400});let v=await cn(w,t),L=v.tenantHint?await r.store.get(v.tenantHint):void 0;if(v.tenantHint&&!L)return me();if(L){if(L.ioniteId&&L.ioniteId!==v.ioniteId)return Response.json({error:"Tenant is bound to another ionite id"},{status:409});let H=u(),J=await It(w),Y=L.integration;if(Y&&Y.handleHash!==J&&Date.parse(Y.expiresAt)>Date.now())return Response.json({error:"Tenant already has an active integration request"},{status:409});if(!Y||Y.handleHash!==J){if(!await H.setIntegration(L.id,{version:(Y?.version??0)+1,ioniteName:v.ioniteName,ioniteId:v.ioniteId,applicationId:v.applicationId,productId:v.productId,handleHash:J,status:"consent_requested",expiresAt:v.expiresAt,redeemAttempts:0,requestedAt:new Date().toISOString()},{expectedHandleHash:Y?.handleHash??null,expectedVersion:Y?.version}))return Response.json({error:"Integration request changed concurrently"},{status:409})}}return r.onConnectRequest({request:a,ion:e,staged:v,tenant:L})}async function M(a){if(a.method!=="POST")return Be(["POST"]);let w=await l(a);if(w)return w;let{handle:v}=await p(a);await cn(v,t);let L=await It(v),H=u(),J=await H.getByIntegrationHandleHash(L);if(!J?.integration)return Response.json({status:"pending"},{status:202});let Y=J.integration;if(Date.parse(Y.expiresAt)<=Date.now())return Response.json({status:"expired"},{status:410});if(Y.status==="consented"&&Y.consentRedeemedAt)return Response.json({status:"consumed"},{status:410});let re=t.maxRedeemAttempts??ql;if(Y.redeemAttempts>=re)return Response.json({status:"attempt_limit"},{status:429});let ue={...Y,version:Y.version+1,redeemAttempts:Y.redeemAttempts+1},se=await H.setIntegration(J.id,ue,{expectedHandleHash:L,expectedVersion:Y.version});if(!se?.integration)return Response.json({status:"pending"},{status:409});if(se.integration.status==="declined")return Response.json({status:"declined"},{status:200});if(se.integration.status!=="consented")return Response.json({status:"pending"},{status:202});let K=crypto.randomUUID().replace(/-/g,"")+crypto.randomUUID().replace(/-/g,""),ee={...se.integration,version:se.integration.version+1,consentRedeemedAt:new Date().toISOString(),exportTokenHash:await It(K)};if(!await H.setIntegration(J.id,ee,{expectedHandleHash:L,expectedVersion:se.integration.version}))return Response.json({status:"consumed"},{status:409});return Response.json({status:"consented",tenantId:J.id,authorization:K,expiresAt:Y.expiresAt})}async function _(a){if(a.method!=="POST")return Be(["POST"]);let w=await l(a);if(w)return w;if(!r.exportConfig)return Response.json({error:"Config export is not supported"},{status:501});let{handle:v,authorization:L}=await p(a);if(!L)return Response.json({error:"authorization is required"},{status:400});await cn(v,t);let H=await It(v),J=u(),Y=await J.getByIntegrationHandleHash(H),re=Y?.integration;if(!Y||!re||re.status!=="consented"||re.configExportedAt||!re.exportTokenHash||re.exportTokenHash!==await It(L))return Response.json({error:"Export authorization is invalid or consumed"},{status:401});if(Date.parse(re.expiresAt)<=Date.now())return Response.json({error:"Export authorization expired"},{status:410});let ue=await r.exportConfig({tenant:Y}),se={...re,version:re.version+1,configExportedAt:new Date().toISOString(),exportTokenHash:void 0};if(!await J.setIntegration(Y.id,se,{expectedHandleHash:H,expectedVersion:re.version}))return Response.json({error:"Export authorization is already consumed"},{status:409});return Response.json(ue)}async function R(a){let w=await cn(a.handle,t),v=await r.store.get(a.tenantId);if(!v)throw new Re("Tenant not found",{status:404});if(w.tenantHint&&w.tenantHint!==v.id)throw new Re("Staged request is bound to another tenant",{status:409});if(v.ioniteId&&v.ioniteId!==w.ioniteId)throw new Re("Tenant is bound to another ionite id",{status:409});let L=await It(a.handle),H=v.integration;if(H?.status==="consented"&&H.handleHash!==L)throw new Re("A consented tenant cannot be rebound",{status:409});if(H&&H.handleHash!==L&&Date.parse(H.expiresAt)>Date.now())throw new Re("Tenant already has an active integration request",{status:409});let J=new Date().toISOString(),Y={version:(H?.handleHash===L?H.version:0)+1,ioniteName:w.ioniteName,ioniteId:w.ioniteId,productId:w.productId,applicationId:w.applicationId,handleHash:L,status:a.decision,expiresAt:w.expiresAt,redeemAttempts:H?.handleHash===L?H.redeemAttempts:0,requestedAt:H?.handleHash===L?H.requestedAt:J,decidedAt:J,decidedBy:a.decidedBy},re=await u().setIntegration(v.id,Y,{expectedHandleHash:H?.handleHash??null,expectedVersion:H?.version});if(!re)throw new Re("Integration request changed; reload and try again",{status:409});return re}async function W(a){let v=new URL(a.url).pathname,L=Zi(r.basePath),H=`${L}/integrations`;if(Pt(v)===`${H}/authorize`)return b(a);if(Pt(v)===`${H}/redeem`)return M(a);if(Pt(v)===`${H}/config-export`)return _(a);let J=$l(v,r.basePath),Y=Pt(v)===L;if(!Y&&!J)return me();if(!["GET","PUT","POST","DELETE"].includes(a.method))return Be(["GET","PUT","POST","DELETE"]);if(a.method==="GET"&&Y&&J==null)return me();let re=await l(a);if(re)return re;if(a.method==="GET"){if(J==null)return me();let ae=await r.store.get(J),C=ae?await i(ae):void 0;if(!C)return me();let g=d(C,a),P=y(C);return Response.json(g?{...P,...g}:P,{status:200})}if(a.method==="DELETE"){if(!J)return me();let ae=await r.store.get(J);if(ae)await r.mirror?.purge(ae.id);if(await r.store.delete(J),ae)await s("deleted",()=>r.onTenantDeleted?.({tenantId:ae.id}));return new Response(null,{status:204})}if(!J&&a.method!=="POST")return me();let ue;try{ue=await a.json()}catch{return Response.json({error:"Invalid JSON in request body"},{status:400})}let se=a.method==="POST";if(!se&&ue&&typeof ue==="object"&&Object.hasOwn(ue,"ioniteId"))return Response.json({error:"ioniteId cannot be changed"},{status:400});let K=se?await n.validate(ue):await o.validate(ue);if(K.issues)return xl(K.issues,se?"Tenant create validation failed":"Tenant update validation failed");let ee=se?K.value.id:J;if(!ee)return me();if(J!=null&&K.value.id!=null&&K.value.id!==J)return Response.json({error:"Path id must match body id"},{status:400});let z;if(se){let ae=K.value,C=await r.store.getByIoniteId(ae.ioniteId);if(C)ee=C.id,z=C;else if(z=await r.store.get(ee),z)return Response.json({error:"tenant_id_taken",message:"The suggested App tenant id is already in use; retry with another id."},{status:409})}else z=await r.store.get(ee);if(z&&!un(z.status))return Response.json({error:"Tenant store returned an invalid status"},{status:500});let D=new Date,Q=z??{},ne;if(se){let ae=K.value,C=ae,g=C.status,P=un(g)?g:z?.status??"completed";ne={...Q,...ae,id:ee,ioniteId:ae.ioniteId,companyId:ae.companyId,companyName:ae.companyName,environmentType:ae.environmentType,configLocator:ae.configLocator,email:ae.email??z?.email,webhookUrl:ae.webhookUrl??z?.webhookUrl,callbackUrl:ae.callbackUrl??z?.callbackUrl,tenantUrl:C.tenantUrl??z?.tenantUrl,status:P,error:C.error??z?.error,actionUrl:C.actionUrl??z?.actionUrl,requestToken:C.requestToken??z?.requestToken,expiresAt:C.expiresAt??z?.expiresAt,createdAt:z?.createdAt??D,updatedAt:D}}else{let ae=K.value,C=ae,g=C.status,P=un(g)?g:z?.status??"completed",{configLocator:I,...U}=ae;ne={...Q,...U,id:ee,companyId:ae.companyId??z?.companyId??"",companyName:ae.companyName??z?.companyName??"",environmentType:ae.environmentType??z?.environmentType??"DEV",email:ae.email??z?.email,webhookUrl:ae.webhookUrl??z?.webhookUrl,callbackUrl:ae.callbackUrl??z?.callbackUrl,tenantUrl:C.tenantUrl??z?.tenantUrl,status:P,error:C.error??z?.error,actionUrl:C.actionUrl??z?.actionUrl,requestToken:C.requestToken??z?.requestToken,expiresAt:C.expiresAt??z?.expiresAt,configLocator:I??z?.configLocator,createdAt:z?.createdAt??D,updatedAt:D}}if(!ne.tenantUrl)ne.tenantUrl=Nl(a,ee);if(!ne.callbackUrl){let ae=d(ne,a);if(ae)ne.callbackUrl=ae.callbackUrl}if(z?.configLocator&&!Bi(z.configLocator,ne.configLocator))await r.mirror?.purge(z.id);let ie=await r.store.upsert(ne);if(se)await s("created",()=>r.onTenantCreated?.({tenant:ie}));if(z?.integration?.status==="consented"&&!Bi(z.configLocator,ne.configLocator))ie=await i(ie,z.configLocator);let ce=Dl(ie);if(ce instanceof Response)return ce;return Response.json(ce.body,{status:ce.status})}async function q(a){return Ur(e,"tm",async()=>{if(!e.isReady())return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503});return await W(a)})}return{describe:()=>Se({module:"tm",active:!0,ready:!0,enabled:t.enabled,ionite:t.ionite,consentTtlSeconds:t.consentTtlSeconds,maxRedeemAttempts:t.maxRedeemAttempts,requestTokenTtlSeconds:t.requestTokenTtlSeconds??wr}),handler:q,isReady:()=>!0,ready:async()=>{return},recordConsent:R,actionRequired:(a)=>vo({...a,ttlSeconds:t.requestTokenTtlSeconds}),getTenant:async(a)=>r.store.get(a)}}var dn="0.0.24-beta.20261007.24";import{readFile as Kl}from"node:fs/promises";import{ACCEPT_JSON as Sr,assertEcid as ea,CONTENT_TYPE_FORM as ko,CONTENT_TYPE_JSON as Fl,JSON_MEDIA_TYPE as ln,jwtAssertionClaimsSchema as Vl,must as qe,readJsonResponse as ta,workloadTokenResponseSchema as zl}from"@ionite/core";import{deriveClaimsEntitlements as Bl,getCachedVerificationKey as Gl,getJwks as Hl}from"@ionite/core/server";function Ke(e,t){return t in e&&e[t]!==void 0&&e[t]!==null}function Jl(e){let t=e.trim().replace(/\/\.default$/,"");if(!t||/\s/.test(t))throw Error(`Managed identity workload tokens need a single-resource scope like "<appId>/.default" (got "${e}")`);return t}async function Yl(e,t){let r=Jl(t),n=process.env.IDENTITY_ENDPOINT,o=process.env.IDENTITY_HEADER;if(n&&o){let i=new URL(n);return i.searchParams.set("api-version","2019-08-01"),i.searchParams.set("resource",r),i.searchParams.set("client_id",e),await fetch(i,{headers:{"X-IDENTITY-HEADER":o,...Sr}})}let s=new URL("http://169.254.169.254/metadata/identity/oauth2/token");return s.searchParams.set("api-version","2018-02-01"),s.searchParams.set("resource",r),s.searchParams.set("client_id",e),await fetch(s,{headers:{Metadata:"true",...Sr}})}function Xl(e){if(typeof e!=="object"||e===null)return e;let t=e,r=typeof t.expires_in==="string"?Number.parseInt(t.expires_in,10):t.expires_in;return{access_token:t.access_token,token_type:t.token_type??"Bearer",...typeof r==="number"&&Number.isFinite(r)?{expires_in:r}:{}}}function Le(e){if(e===void 0||e===null)return!1;return Ke(e,"workloadId")||Ke(e,"privateKey")}function Je(e){if(e===void 0||e===null)return!1;let t=Ke(e,"clientId"),r=Ke(e,"clientSecret"),n=Ke(e,"workloadId"),o=Ke(e,"privateKey");return(t||r)&&!n&&!o}function bo(e){if(e===void 0||e===null)return!1;let t=Ke(e,"jwksUri"),r=Ke(e,"workloadId"),n=Ke(e,"clientId"),o=Ke(e,"clientSecret"),s=Ke(e,"privateKey");return t&&!r&&!s&&!n&&!o}function ra(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function Zl(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if(ra(t))return!1;let r=Object.entries(t);if(r.length===0)return!1;return r.every(([,n])=>ra(n))}function aa(e){if(e===null||typeof e!=="object"||Array.isArray(e))return!1;let t=e;if("incoming"in t||"outgoing"in t){if(t.incoming!==void 0&&(typeof t.incoming!=="object"||t.incoming===null))return!1;if(t.outgoing!==void 0&&(typeof t.outgoing!=="object"||t.outgoing===null||Array.isArray(t.outgoing)))return!1;return!0}return!1}function ca(e){return aa(e)}function Ro(e){if(!e)return;if(ca(e))return Array.isArray(e.incoming)?void 0:e.incoming;return e}function Eo(e){if(e===void 0||e===null)return[];return Array.isArray(e)?e:[e]}function Ht(e){if(typeof e!=="string")return;return e.endsWith("/")?e.slice(0,-1):e}function na(e){if(!e)return[];if(Array.isArray(e))return e.filter((t)=>!!t&&typeof t.issuer==="string"&&typeof t.jwksUri==="string").map((t)=>({issuer:t.issuer,jwksUri:t.jwksUri,audience:t.audience,claimsAsEntitlements:t.claimsAsEntitlements}));if(e.issuer&&e.jwksUri)return[{issuer:e.issuer,jwksUri:e.jwksUri,audience:e.audience??[],claimsAsEntitlements:e.claimsAsEntitlements}];return[]}function Ql(e){let t=e[0];if(!t)return;let r=Eo(t.audience);return{jwksUri:t.jwksUri,issuer:t.issuer,audience:typeof r[0]==="string"?r[0]:void 0}}function oa(e,t){let r=Ht(t);if(!r)return;return e.find((n)=>Ht(n.issuer)===r)}function fn(e,t,r){let n=Eo(e);if(t.some((o)=>n.includes(o)))return!0;if(typeof r==="string"&&t.includes(r))return!0;return!1}function To(e){if(!e||!ca(e))return{};return e.outgoing??{}}function pn(e,t,r){return Se({name:e,ready:r,clientId:"clientId"in t?t.clientId:void 0,workloadId:"workloadId"in t?t.workloadId:void 0,idpTokenUrl:t.idpTokenUrl,scope:t.scope,audience:t.audience,authMethod:ef(t)})}function ef(e){if("privateKey"in e&&e.privateKey)return"private_key_jwt";if(!("clientId"in e)||!e.clientId)return"server_only";if("authMethod"in e&&e.authMethod==="managed_identity")return"managed_identity";if("clientSecret"in e&&e.clientSecret)return"client_secret";if("federatedTokenFile"in e&&e.federatedTokenFile)return"federated_token";return"client_secret"}function ua(e,t){let[r]=t.describe().outgoing;return{...r??pn(e,{},t.isReady()),name:e}}function Co(e,t){let r=e?.describe();return{module:"workload",active:e!==void 0||Object.keys(t).length>0,ready:e?.isReady()===!0||Object.values(t).some((n)=>n.isReady()),incoming:r?.incoming??{trustedIdps:[]},outgoing:Object.entries(t).map(([n,o])=>ua(n,o)),urls:r?.urls??{}}}function tf(e,t){return{describe:()=>ua(e,t),getToken:t.getToken,refreshToken:t.refreshToken,generateJWTAssertion:t.generateJWTAssertion,revokeToken:t.revokeToken,beforeChange:t.beforeChange,afterChange:t.afterChange,isReady:t.isReady,ready:t.ready}}var Ao=Symbol("ion.workloadClientState"),da=Symbol("ion.namedWorkloadClients");function Jt(e,t){let r=ye(e,t);return{isReady:r.isReady,ready:r.ready}}function rf(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it was declared in framework config but is not fully configured by the ConfigSource yet.`)};return{...Jt(`workload client "${e}"`,()=>!1),describe:()=>pn(e,{},!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[Ao]:"unavailable"}}function sa(e){let t=(r)=>{throw Error(`${r} is unavailable for workload client "${e}" because it is no longer configured on this Ionite instance.`)};return{...Jt(`workload client "${e}"`,()=>!1),describe:()=>pn(e,{},!1),getToken:async()=>t("getToken"),refreshToken:async()=>t("refreshToken"),generateJWTAssertion:async()=>t("generateJWTAssertion"),revokeToken:async()=>t("revokeToken"),[Ao]:"removed"}}function nf(e){if(!e)return"removed";return e[Ao]??"available"}function Io(e,t,r){let n=e,o=n,s=new Set;for(let i of r){if(s.add(i),i in o)continue;let c=t[i];o[i]=c?tf(i,c):rf(i)}return Object.defineProperty(o,da,{value:s,enumerable:!1,configurable:!0}),n}function ia(e){if(!e)return[];let t=e[da];return t?Array.from(t):[]}function of(e,t,r){let n=t,o=De(r,`Workload client "${e}"`),s=()=>nf(n)==="available",i=ye(`Workload client "${e}"`,s);return{api:{beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:i.isReady,ready:i.ready,describe:()=>n.describe(),getToken:(d)=>n.getToken(d),refreshToken:(d)=>n.refreshToken(d),generateJWTAssertion:(d)=>n.generateJWTAssertion(d),revokeToken:(d)=>n.revokeToken(d)},update(d){if(d===n)return;o.emitBefore(),n=d,i.refresh(),o.emitAfter()}}}function la(e){let t,r=!1,n=ye("Workload module",()=>r),o=De(e,"Workload"),s=new Map,i=new Set,c=new Set(["beforeChange","afterChange","isReady","ready","describe"]),d=(p)=>{if(!t)throw Error(`${p} is unavailable because workload is not configured on this Ionite instance.`);return t},u={beforeChange:o.beforeChange,afterChange:o.afterChange,isReady:n.isReady,ready:n.ready,describe:()=>t?.describe()??{module:"workload",active:!1,ready:!1,incoming:{trustedIdps:[]},outgoing:[],urls:{}},get config(){return t?.config??{}},getToken(...p){return d("getToken").getToken(...p)},refreshToken(p){return d("refreshToken").refreshToken(p)},generateJWTAssertion(p){return d("generateJWTAssertion").generateJWTAssertion(p)},revokeToken(p){return d("revokeToken").revokeToken(p)},validateToken(p){return d("validateToken").validateToken(p)},getWorkloadIdentity(p){return d("getWorkloadIdentity").getWorkloadIdentity(p)},parseJWT(p){return d("parseJWT").parseJWT(p)},handler(p){return d("handler").handler(p)}},l=(p)=>{for(let _ of i)delete u[_];if(i.clear(),!p)return;let b=new Set(ia(p)),M=new Set([...c,"config","getToken","refreshToken","generateJWTAssertion","revokeToken","validateToken","getWorkloadIdentity","parseJWT","handler",...b]);for(let[_,R]of Object.entries(p)){if(M.has(_))continue;u[_]=R,i.add(_)}},y=(p)=>{let b=s.get(p);if(b)return b;let M=of(p,sa(p),e);if(s.set(p,M),!(p in u))u[p]=M.api;return M};return{update(p){if(!p&&!r&&s.size===0)return;o.emitBefore(),r=p!==void 0,n.refresh(),t=p;let b=new Set(ia(p));for(let M of b){let _=p[M];y(M).update(_)}for(let[M,_]of s){if(b.has(M))continue;_.update(sa(M))}return l(p),o.emitAfter(),u}}}async function Po(e,t,r){if(e===void 0)throw Error("A workload client name is required: call getToken(client, scope?) or use getServerToken().");let n=r[e];if(!n)throw Error(`Unknown workload client: ${e}`);return n.getToken(t)}function Oo(e,t){return`${e}|${t??""}`}function it(e,t,r,n,o,s){let i={jwtAssertionClaims:e?.jwtAssertionClaims??Vl("server"),tokenResponse:e?.tokenResponse??zl("server")},c=async(m,f)=>{let T=m;if(typeof T.validate==="function")return T.validate(f);return m["~standard"].validate(f)};if(!r&&!n)return;if(r&&aa(r)){let m=r.incoming,f=na(m),T=Array.isArray(m)?Ql(m):m,A=Ro(n),N=To(n),Z=T?{...T,...A,jwksUri:T.jwksUri,issuer:T.issuer}:A;if(!Z||!Z.tokenUrl&&!Z.jwksUri)t.warn("Workload vault config has incoming/outgoing but no server config (incoming or framework) with tokenUrl/jwksUri; workload module handler will be unavailable.",{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let V=Z&&(Z.tokenUrl||Z.jwksUri)?it(e,t,T??void 0,A,f,s):void 0,oe=Array.from(new Set([...Object.keys(r.outgoing??{}),...Object.keys(N)])).map((fe)=>[fe,{...r.outgoing?.[fe]??{},...N[fe]??{}}]),te={};for(let[fe,Ye]of oe){let Pe=it(e,t,Ye,void 0);if(Pe)te[fe]=Pe}if(!V&&Object.keys(te).length===0)return;let ge={...V?.config??{},config:V?.config??{},describe:()=>Co(V,te),...Jt("workload",()=>V?.isReady()===!0||Object.values(te).some((fe)=>fe.isReady())),getToken:async(fe,Ye)=>Po(fe,Ye,te),getServerToken:async(fe)=>{if(!V)throw Error("No server workload config");return V.getToken(fe)},refreshToken:async(fe)=>{if(!V)throw Error("No default workload config");return V.refreshToken(fe)},generateJWTAssertion:async(fe)=>{if(!V)throw Error("No default workload config");return V.generateJWTAssertion(fe)},revokeToken:async(fe)=>{if(!V)throw Error("No default workload config");return V.revokeToken(fe)},validateToken:async(fe)=>{if(!V)throw Error("No default workload config");return V.validateToken(fe)},getWorkloadIdentity:async(fe)=>{if(!V)return;return V.getWorkloadIdentity(fe)},parseJWT:async(fe)=>{if(!V)throw Error("No default workload config");return V.parseJWT(fe)},handler:async(fe)=>{if(!V)return me();return V.handler(fe)}};return Io(ge,te,oe.map(([fe])=>fe))}if(r&&Zl(r)){let m=Ro(n),f=To(n),T=r.default,A=T?{...T,...m,jwksUri:T.jwksUri,issuer:T.issuer}:m;if(!A||!A.tokenUrl&&!A.jwksUri)t.warn('Workload vault config is a clients map but no server config (workload["default"] or framework workload) with tokenUrl/jwksUri; workload module handler will be unavailable.',{"ion.operation":"workload.config.validate","ion.outcome":"degraded"});let N=A&&(A.tokenUrl||A.jwksUri)?it(e,t,T??void 0,m):void 0,Z=Array.from(new Set([...Object.keys(r).filter((te)=>te!=="default"),...Object.keys(f)])).map((te)=>[te,{...te in r?r[te]:{},...f[te]??{}}]),V={};for(let[te,ge]of Z){let fe=it(e,t,ge,void 0);if(fe)V[te]=fe}if(!N&&Object.keys(V).length===0)return;let oe={...N?.config??{},config:N?.config??{},describe:()=>Co(N,V),...Jt("workload",()=>N?.isReady()===!0||Object.values(V).some((te)=>te.isReady())),getToken:async(te,ge)=>Po(te,ge,V),getServerToken:async(te)=>{if(!N)throw Error("No server workload config");return N.getToken(te)},refreshToken:async(te)=>{if(!N)throw Error("No default workload config");return N.refreshToken(te)},generateJWTAssertion:async(te)=>{if(!N)throw Error("No default workload config");return N.generateJWTAssertion(te)},revokeToken:async(te)=>{if(!N)throw Error("No default workload config");return N.revokeToken(te)},validateToken:async(te)=>{if(!N)throw Error("No default workload config");return N.validateToken(te)},getWorkloadIdentity:async(te)=>{if(!N)return;return N.getWorkloadIdentity(te)},parseJWT:async(te)=>{if(!N)throw Error("No default workload config");return N.parseJWT(te)},handler:async(te)=>{if(!N)return me();return N.handler(te)}};return Io(oe,V,Z.map(([te])=>te))}let d=Ro(n),u=To(n);if(!r&&Object.keys(u).length>0){let m={};for(let[A,N]of Object.entries(u)){let Z=it(e,t,N,void 0);if(Z)m[A]=Z}let f=d&&(d.tokenUrl||d.jwksUri)?it(e,t,d,void 0):void 0;if(!f&&Object.keys(m).length===0)return;let T={...f?.config??{},config:f?.config??{},describe:()=>Co(f,m),...Jt("workload",()=>f?.isReady()===!0||Object.values(m).some((A)=>A.isReady())),getToken:async(A,N)=>Po(A,N,m),getServerToken:async(A)=>{if(!f)throw Error("No server workload config");return f.getToken(A)},refreshToken:async(A)=>{if(!f)throw Error("No default workload config");return f.refreshToken(A)},generateJWTAssertion:async(A)=>{if(!f)throw Error("No default workload config");return f.generateJWTAssertion(A)},revokeToken:async(A)=>{if(!f)throw Error("No default workload config");return f.revokeToken(A)},validateToken:async(A)=>{if(!f)throw Error("No default workload config");return f.validateToken(A)},getWorkloadIdentity:async(A)=>{if(!f)return;return f.getWorkloadIdentity(A)},parseJWT:async(A)=>{if(!f)throw Error("No default workload config");return f.parseJWT(A)},handler:async(A)=>{if(!f)return me();return f.handler(A)}};return Io(T,m,Object.keys(u))}let l=r,y=o??na(l),p=d?.tokenUrl,b=p?.startsWith("/")?p:void 0,M=l?.idpTokenUrl??d?.idpTokenUrl??(l?.tokenUrl&&(l.tokenUrl.startsWith("http://")||l.tokenUrl.startsWith("https://"))?l.tokenUrl:void 0),_={...l,...d,tokenUrl:b??d?.tokenUrl??l?.tokenUrl,idpTokenUrl:M,jwksUri:l?.jwksUri,issuer:l?.issuer};_._handlerTokenUrl=b;let R,W=_,q=Le(_),a=Je(_),w=bo(_);if(!q&&!a&&!w){if(!l||Object.keys(l).length===0)return;throw t.error("WorkloadConfig validation failed",{"ion.operation":"workload.config.validate","ion.outcome":"failure",keys:Object.keys(_),clientId:W.clientId,clientSecret:W.clientSecret?"[REDACTED]":void 0,workloadId:W.workloadId,privateKey:W.privateKey?"[REDACTED]":void 0,jwksUri:W.jwksUri,tokenUrl:W.tokenUrl,idpTokenUrl:W.idpTokenUrl,fromVaultKeys:l?Object.keys(l):[],fromCodeKeys:n?Object.keys(n):[]}),Error("Invalid WorkloadConfig: must provide the correct config for one of the following modes: JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only")}if(q)R={..._,tokenUrl:_.tokenUrl,idpTokenUrl:qe(_.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),workloadId:qe(_.workloadId,"Missing 'workloadId' from Workload Config"),privateKey:qe(_.privateKey,"Missing 'privateKey' from Workload Config"),audience:qe(_.audience,"Missing 'audience' from Workload Config"),scope:_.scope??"",algorithm:_.algorithm??"RS256",tokenLifetime:_.tokenLifetime??300,refreshThreshold:_.refreshThreshold??60,autoRefresh:_.autoRefresh!==void 0?_.autoRefresh:!0,tokenStore:_.tokenStore??new yt};else if(Je(_)){let m=_.authMethod==="managed_identity",f=m?void 0:_.clientSecret||void 0,T=m||f?void 0:qe(_.federatedTokenFile||process.env.AZURE_FEDERATED_TOKEN_FILE||void 0,"Missing 'clientSecret' from Workload Config (or a federatedTokenFile / AZURE_FEDERATED_TOKEN_FILE, or authMethod 'managed_identity')");R={..._,tokenUrl:_.tokenUrl,idpTokenUrl:m?_.idpTokenUrl??"":qe(_.idpTokenUrl,"Missing 'idpTokenUrl' from Workload Config"),clientId:qe(_.clientId,"Missing 'clientId' from Workload Config"),clientSecret:f,federatedTokenFile:T,scope:_.scope??"",tokenLifetime:_.tokenLifetime??300,refreshThreshold:_.refreshThreshold??60,autoRefresh:_.autoRefresh!==void 0?_.autoRefresh:!0,tokenStore:_.tokenStore??new yt}}else if(bo(_))R=_;function v(){let m=new Uint8Array(16);return crypto.getRandomValues(m),Array.from(m,(f)=>f.toString(16).padStart(2,"0")).join("")}function L(m){let f;if(typeof m==="string")f=btoa(m);else f=btoa(String.fromCharCode(...m));return f.replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function H(m){let f=m.replace(/-/g,"+").replace(/_/g,"/");while(f.length%4)f+="=";return atob(f)}function J(m){if(m.startsWith("RS"))return{name:"RSASSA-PKCS1-v1_5",hash:m==="RS256"?"SHA-256":m==="RS384"?"SHA-384":"SHA-512"};else if(m.startsWith("ION"))return{name:"ECDSA",namedCurve:m==="ES256"?"P-256":m==="ES384"?"P-384":"P-521",hash:m==="ES256"?"SHA-256":m==="ES384"?"SHA-384":"SHA-512"};throw Error(`Unsupported algorithm: ${m}`)}async function Y(m,f){let T=m.replace(/-----BEGIN PRIVATE KEY-----/,"").replace(/-----END PRIVATE KEY-----/,"").replace(/\s/g,""),A=Uint8Array.from(atob(T),(Z)=>Z.charCodeAt(0)),N=J(f);return crypto.subtle.importKey("pkcs8",A,N,!1,["sign"])}async function re(m,f,T){let A=await Y(f,T),Z=new TextEncoder().encode(m),V=J(T),oe=await crypto.subtle.sign(V,A,Z);return L(new Uint8Array(oe))}async function ue(m,f=3,T=1000,A=30000){let N=Error("Placeholder Error");for(let Z=0;Z<=f;Z++)try{return await m()}catch(V){if(N=V instanceof Error?V:Error(String(V)),N.message.includes("400")||N.message.includes("401")||N.message.includes("403")||N.message.includes("404"))throw N;if(Z<f){let oe=Math.min(T*2**Z,A),te=Math.random()*oe*0.1;await new Promise((ge)=>setTimeout(ge,oe+te))}}throw N}async function se(m){if(!Le(R))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=R,T=Math.floor(Date.now()/1000),A={iss:f.workloadId,sub:f.workloadId,aud:f.audience??"",exp:T+f.tokenLifetime,iat:T,jti:v(),scope:m??f.scope},N={alg:f.algorithm,typ:"JWT",kid:f.keyId},Z=L(JSON.stringify(N)),V=L(JSON.stringify(A)),oe=`${Z}.${V}`,te=await re(oe,f.privateKey,f.algorithm);return`${oe}.${te}`}async function K(m){if(!Le(R))throw Error("generateJWTAssertion is only available in JWT Bearer Grant mode");let f=R;return ue(async()=>{let T=f.idpTokenUrl,A=await se(m),N=new URLSearchParams;if(N.append("grant_type","urn:ietf:params:oauth:grant-type:jwt-bearer"),N.append("assertion",A),m)N.append("scope",m);let Z=await fetch(T,{method:"POST",headers:{...ko,...Sr},body:N.toString()}),V=await ta(Z,{log:t,operation:"token.acquire"});if(!Z.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",response:V});let te=V;throw Error(`Token acquisition failed: ${te.error||Z.statusText} - ${te.error_description||""}`.trim())}let oe=await c(i.tokenResponse,V);if(oe.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"jwt_bearer",validationIssues:oe.issues}),Error(`Token response validation failed: ${oe.issues.map((te)=>te.message).join("; ")}`);if(f.tokenStore){let te=new Date(Date.now()+(oe.value.expires_in??300)*1000),ge={workload_id:Oo(f.workloadId,m),access_token:oe.value.access_token,token_type:oe.value.token_type,scope:oe.value.scope,expires_at:te,created_at:new Date,refresh_token:oe.value.refresh_token};await f.tokenStore.set(ge)}return oe.value})}async function ee(m){if(!Je(R))throw Error("acquireTokenClientCredentials is only available in OAuth2 Client Credentials mode");let f=R;return ue(async()=>{let T=f.authMethod==="managed_identity",A;if(T)A=await Yl(f.clientId,m);else{let oe=new URLSearchParams;if(oe.append("grant_type","client_credentials"),oe.append("client_id",f.clientId),f.clientSecret)oe.append("client_secret",f.clientSecret);else{let te=qe(f.federatedTokenFile,"Missing 'federatedTokenFile' from Workload Config"),ge=(await Kl(te,"utf8")).trim();if(!ge)throw Error(`Federated token file was empty: ${te}`);oe.append("client_assertion_type","urn:ietf:params:oauth:client-assertion-type:jwt-bearer"),oe.append("client_assertion",ge)}if(m)oe.append("scope",m);A=await fetch(f.idpTokenUrl,{method:"POST",headers:{...ko,...Sr},body:oe.toString()})}let N=await ta(A,{log:t,operation:"token.acquire"}),Z=T&&A.ok?Xl(N):N;if(!A.ok){t.error("Token acquisition error",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",response:Z});let oe=Z;throw Error(`Token acquisition failed: ${oe.error||A.statusText} - ${oe.error_description||""}`.trim())}let V=await c(i.tokenResponse,Z);if(V.issues)throw t.error("Token response validation failed",{"ion.operation":"token.acquire","ion.outcome":"failure",grantType:"client_credentials",validationIssues:V.issues}),Error(`Token response validation failed: ${V.issues.map((oe)=>oe.message).join("; ")}`);if(f.tokenStore){let oe=new Date(Date.now()+(V.value.expires_in??300)*1000),te={workload_id:Oo(f.clientId,m),access_token:V.value.access_token,token_type:V.value.token_type,scope:V.value.scope,expires_at:oe,created_at:new Date,refresh_token:V.value.refresh_token};await f.tokenStore.set(te)}return V.value})}let z=new Map;function D(m,f){let T=z.get(m);if(T)return T;let A=(async()=>(Le(R)?await K(f??""):await ee(f??"")).access_token)();return z.set(m,A),A.catch(()=>{return}).finally(()=>{if(z.get(m)===A)z.delete(m)}),A}async function Q(m){if(!Le(R)&&!Je(R)){let N=R;throw Error(`Acquiring tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode. Current config: hasClientId=${!!N.clientId}, hasClientSecret=${!!N.clientSecret}, hasWorkloadId=${!!N.workloadId}, hasPrivateKey=${!!N.privateKey}, hasJwksUri=${!!N.jwksUri}`)}let f=R;m=m??f.scope;let T=Le(R)?R.workloadId:R.clientId,A=Oo(T,m);if(f.tokenStore){let N=await f.tokenStore.get(A);if(N){let Z=Date.now(),V=N.expires_at.getTime(),oe=f.refreshThreshold*1000;if(Z+oe<V)return N.access_token;if(f.autoRefresh)try{return await D(A,m)}catch(te){if(Z<V)return t.warn("Token refresh failed, using cached token",{"ion.operation":"token.refresh","ion.outcome":"degraded"},te),N.access_token;throw te}}}return D(A,m)}async function ne(m){if(!Le(R)&&!Je(R))throw Error("Refreshing tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");let f=R;return m=m??f.scope,Le(f)?await K(m):await ee(m)}async function ie(m){if(!Le(R)&&!Je(R))throw Error("Revoking tokens is only available in JWT Bearer Grant or OAuth2 Client Credentials mode");try{if(!R.revocationEndpoint)return;let f=new URLSearchParams;if(f.append("token",m),f.append("token_type_hint","access_token"),Le(R)){let A=R;f.append("client_id",A.workloadId)}else if(Je(R)){let A=R;if(f.append("client_id",A.clientId),A.clientSecret)f.append("client_secret",A.clientSecret)}let T=await fetch(R.revocationEndpoint,{method:"POST",headers:{...Sr,...ko},body:f.toString()});if(!T.ok)t.warn("Token revocation failed",{"ion.operation":"token.revoke","ion.outcome":"degraded",status:T.status,statusText:T.statusText});else t.info("Token revoked successfully",{"ion.module":"workload"});if(R.tokenStore){let A;if(Le(R))A=R.workloadId;else if(Je(R))A=R.clientId;else return;await R.tokenStore.delete(A)}}catch(f){t.warn("Error revoking token",{"ion.operation":"token.revoke","ion.outcome":"degraded"},f)}}async function ce(m,f){let T=m??R?.jwksUri;if(!T)throw Error("No JWKS URI configured in Workload Config");return await Hl(T,t,f)}async function ae(m,f){let T=f??R?.jwksUri;if(!T)throw Error("No JWKS URI configured in Workload Config");let A=Le(R)?R.algorithm:"RS256";return Gl(T,m,`wl:${A}`,(N)=>{let Z=N.alg||A,V=J(Z);return crypto.subtle.importKey("jwk",N,V,!1,["verify"])},t)}function C(m){let f=m.split(".");if(f.length!==3)throw Error("Invalid JWT");return JSON.parse(H(f[1]))}async function g(m,f){try{let T=m.split(".");if(T.length!==3)throw Error("Invalid JWT");let A=JSON.parse(H(T[0])),N=JSON.parse(H(T[1])),Z=await ae(A.kid,f),V=T[2],te=new TextEncoder().encode(`${T[0]}.${T[1]}`),ge=Uint8Array.from(H(V),(gt)=>gt.charCodeAt(0)),fe=J(A.alg);if(!await crypto.subtle.verify(fe,Z,ge,te))throw Error("Invalid JWT signature");let Pe=await c(i.jwtAssertionClaims,N);if(Pe.issues)throw t.error("JWT claims validation failed",{"ion.operation":"jwt.validate","ion.outcome":"failure",validationIssues:Pe.issues}),Error(`JWT claims validation failed: ${Pe.issues.map((gt)=>gt.message).join("; ")}`);return Pe.value}catch(T){throw t.error("Error verifying JWT",{"ion.operation":"jwt.verify","ion.outcome":"failure"},T),T}}async function P(m){if(!Le(R)&&!Je(R)&&!bo(R))throw Error("Validating tokens is only available in JWT Bearer Grant, OAuth2 Client Credentials, or Server-Only mode");try{if(y.length>0){let A=C(m),N=typeof A.iss==="string"?A.iss:void 0,Z=oa(y,N);if(!Z)return{valid:!1,error:"Untrusted token issuer"};let V=await g(m,Z.jwksUri),oe=Math.floor(Date.now()/1000);if(V.exp&&V.exp<oe)return{valid:!1,error:"Token expired"};let te=Eo(Z.audience);if(te.length>0&&!fn(V.aud,te,V.azp))return{valid:!1,error:"Invalid audience"};return{valid:!0,claims:V,expiresAt:V.exp?new Date(V.exp*1000):void 0}}let f=await g(m),T=Math.floor(Date.now()/1000);if(f.exp&&f.exp<T)return{valid:!1,error:"Token expired"};if(Le(R)){if(R.audience&&!fn(f.aud,[R.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else if(Je(R)){if(R.issuer&&Ht(f.iss)!==Ht(R.issuer))return{valid:!1,error:"Invalid issuer"};if(R.audience&&!fn(f.aud,[R.audience],f.azp))return{valid:!1,error:"Invalid audience"}}else{let A=R;if(A.issuer&&Ht(f.iss)!==Ht(A.issuer))return{valid:!1,error:"Invalid issuer"};if(A.audience&&!fn(f.aud,[A.audience],f.azp))return{valid:!1,error:"Invalid audience"}}return{valid:!0,claims:f,expiresAt:f.exp?new Date(f.exp*1000):void 0}}catch(f){return{valid:!1,error:f instanceof Error?f.message:String(f)}}}function I(m,f){let T=m[f];return typeof T==="string"&&T.trim()?T.trim():void 0}function U(m){if(!m)return;return m.startsWith("service-account-")?m.slice(16):m}function E(m){return I(m,"client_id")??I(m,"clientId")??I(m,"azp")??I(m,"appid")??U(I(m,"preferred_username"))}let F=new WeakMap;function S(m){let f=F.get(m);if(f)return f;let T=O(m);return F.set(m,T),T}async function O(m){let f=m.headers.get("Authorization");if(!f?.startsWith("Bearer "))return;let T=f.substring(7),A=await P(T);if(!A.valid||!A.claims)return;let N=y.length>0?oa(y,A.claims.iss):void 0,Z=A.claims.ecid,V=E(A.claims)??A.claims.sub??"",oe=N?.claimsAsEntitlements??(y.length===0?l?.claimsAsEntitlements:void 0),te=oe?.claims?.length?await Bl({block:oe,claims:A.claims,scope:A.claims.scope,subjectType:"workload",subjectId:V||"workload",catalog:s?.(),log:t}):void 0,ge={workloadId:A.claims.sub,clientId:E(A.claims),scope:A.claims.scope,...te?{derivedEntitlements:te}:{},...Z!==void 0&&Z!==null?{ecid:ea(Z)}:{},claims:A.claims},fe=R?.workloadIdentityStore;if(fe){let Ye=ge.clientId??ge.workloadId??ge.claims.sub,Pe=Ye?await fe.get(Ye):void 0;if(Pe){if(Pe.active===!1)return;if(Pe.scopes?.length){let gt=new Set([...(ge.scope??"").split(/\s+/).filter(Boolean),...Pe.scopes]);ge.scope=Array.from(gt).join(" ")}if(!ge.ecid&&Pe.ecid)ge.ecid=ea(Pe.ecid)}}return ge}async function k(m){if(!R)throw Error("ionite Workload Manager not initialized");let f=new URL(m.url).pathname,T=(Z)=>{if(!Z)return;try{return new URL(Z).pathname}catch{return Z.startsWith("/")?Z:`/${Z}`}};if(T(R.validateUrl)===f&&m.method==="POST"){let Z=m.headers.get("Authorization");if(!Z?.startsWith("Bearer "))return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type",ln]]});let V=Z.substring(7),oe=await P(V);if(!oe.valid)return new Response(JSON.stringify({valid:!1,error:"invalid_token"}),{status:401,headers:[["Content-Type",ln]]});return new Response(JSON.stringify({valid:!0,expiresAt:oe.expiresAt}),{status:200,headers:[["Content-Type",ln]]})}if(T(R.jwksUrl)===f&&m.method==="GET"){let Z=await ce();return new Response(JSON.stringify(Z),{headers:[["Content-Type",ln]]})}return me()}if(!R)throw Error("Workload configuration was not resolved.");return{...R,config:R,...Jt("workload",()=>!0),describe:()=>({module:"workload",active:!0,ready:!0,incoming:{trustedIdps:y.map((m)=>({issuer:m.issuer,jwksUri:m.jwksUri,audience:m.audience,...m.claimsAsEntitlements?.claims?.length?{claimsAsEntitlements:{claims:m.claimsAsEntitlements.claims,expand:m.claimsAsEntitlements.expand===!0,resources:m.claimsAsEntitlements.resources===!0,capable:!0}}:{}}))},outgoing:[pn("default",R,!0)],urls:{validateUrl:R.validateUrl??"",jwksUrl:R.jwksUrl??""}}),getToken:Q,refreshToken:ne,generateJWTAssertion:se,revokeToken:ie,validateToken:P,getWorkloadIdentity:S,parseJWT:g,handler:k}}function _o(e){return e=e??"Workload authentication unavailable",new Response(JSON.stringify({error:e}),{status:503,statusText:e,headers:Fl})}var mn="Ionite instance is required. Create one with ionite(source, config) and pass it to this function.",sf="Ionite or Workload instance is required. Create an Ionite with ionite(source, config) or pass a Workload instance.";async function af(e,t){qe(t,mn);let r=t.workload;if(!r)return;return r.getWorkloadIdentity(e)}async function cf(e,t,r){qe(t,mn);let n=t.workload;if(!n)throw _o();let o=n;if(typeof o.getServerToken!=="function"||typeof o.getToken!=="function")throw Error("No outgoing workload clients configured; getWorkloadToken requires workload.outgoing config.");return o.getToken(e,r)}async function uf(e,t){qe(t,sf);let r="validateToken"in t&&typeof t.validateToken==="function"?t:t.workload;if(!r)return{valid:!1,error:"Workload authentication unavailable"};let n=e.headers.get("Authorization");if(!n?.startsWith("Bearer "))return{valid:!1,error:"Missing or invalid Authorization header"};let o=n.substring(7);return r.validateToken(o)}async function df(e,t){qe(t,mn);let r=t.workload;if(!r)throw _o();return r.revokeToken(e)}async function lf(e,t){qe(t,mn);let r=t.workload;if(!r)throw _o();return r.handler(e)}export*from"@ionite/core";import{AssignmentPolicyError as qw,generateULID as Ww,IoniteError as jw,listGenerator as Nw}from"@ionite/core";import{allowHosts as Dw,allowOrigins as Kw,allowRelativePaths as Fw,allowSameOrigin as Vw,blockDangerousUrls as zw,CatalogAdjacencyCache as Bw,callback as Gw,captureRedirect as Hw,ciam as Jw,collectReferencedDefinitions as Yw,defaultRedirectPolicies as Xw,discoverSessionRecords as Zw,discoverSessions as Qw,expandRoot as eS,getCustomer as tS,getOwnedTenantIds as rS,getUser as nS,has as oS,hasAll as sS,hasAllScope as iS,hasAny as aS,hasAnyScope as cS,hasGroup as uS,hasPermission as dS,hasRole as lS,hasScope as fS,InMemoryTenantStore as pS,iam as mS,initiateLogin as gS,isRedirectAllowed as yS,listSsoClientIdsFromCookies as hS,planDiscoveredTenantCookies as wS,reconcileSubjectAccess as SS,resolveAfterRedirect as vS,resolveCapturedRedirect as kS,resolveRedirect as bS,resolveTenantOwner as RS,resolveTenantSession as TS,sameOriginRedirectRules as CS,sendTenantWebhook as IS,sso as PS,TENANT_OWNER_PERMISSION as OS,tenantAccessLoginUrl as ES,tenantOwnerEntitlementId as AS,tenantOwnerPermission as _S,tenantResourceId as LS,verifyUser as xS,withSetCookies as US}from"@ionite/core/server";function Lo(e){throw Error('AWS Secrets Manager config source ("aws") is not implemented in this build. Use a vault or azure config source.')}function ff(e,t){return{...e,subscribe:async(r,n,o)=>{try{return await e.subscribe(r,n,o)}catch(s){if(!(s instanceof je))throw s;return await st(e,r,n,t,void 0,o)}}}}function gn(e){let t=bt(e.path,"path","azureConfig");Ct(e.ttl);let r=e.vault??sn({type:"azure",authMethod:e.authMethod,entraTenantId:e.entraTenantId,clientId:e.clientId,clientSecret:e.clientSecret,federatedTokenFile:e.federatedTokenFile,managedIdentityClientId:e.managedIdentityClientId,imdsApiVersion:e.imdsApiVersion,vaultUrl:e.vaultUrl,vaultName:e.vaultName,apiVersion:e.apiVersion,secretNameTransform:e.secretNameTransform,secretNamePrefix:e.secretNamePrefix,scope:e.scope,ttl:e.ttl}),n=e.ttl?ff(r,e.ttl):r;return{get origin(){return{type:"azure",...n.origin,path:t}},load:async()=>{try{return(await n.getFullSecret(t)).data}catch(o){let s=o instanceof Error?o.message:String(o);throw Error(`Error retrieving remote config from Azure Key Vault: ${s}`,{cause:o})}},subscribe:(o,s)=>n.subscribe(t,(i)=>{o(i.data)},s),secret:n}}import{IoniteError as _f}from"@ionite/core";function xo(e){throw Error('GCP Secret Manager config source ("gcp") is not implemented in this build. Use a vault or azure config source.')}import{defaultLogger as hf,remoteConfigSecretType as wf}from"@ionite/core";import{defaultLogger as pf,defaultSecretContentType as mf,stableConfigHash as fa}from"@ionite/core";var gf=1e4;function yf(e){return typeof e==="object"&&e!==null&&!Array.isArray(e)}function Uo(e){if(e.paths.length===0)throw Error("mirrorSecrets requires at least one source path");let t=Array.from(new Set(e.paths.map((R)=>R.trim()).filter(Boolean)));if(t.length===0)throw Error("mirrorSecrets requires at least one non-empty source path");let r=e.logger??pf,n=[],o=Promise.resolve(),s=!1,i=!1,c=!1,d=ye("Secrets mirror",()=>s&&!c),u=(R)=>{let W=e.mapPath(R).trim();if(!W)throw Error(`mirrorSecrets mapPath returned an empty target for "${R}"`);return W},l=(R)=>{let W=o.then(R);return o=W.catch((q)=>{i=!0,r.warn("Secrets mirror operation failed",{"ion.operation":"secrets.mirror.apply","ion.outcome":"degraded",error:q instanceof Error?q.message:String(q)})}),W},y=async(R)=>{if(await e.to.exists(R))await e.to.deleteSecret(R)},p=async(R,W)=>{if(c)return;if(!yf(W.data))throw Error(`mirrorSecrets can only re-store object values (source path "${R}")`);if(e.accept&&!e.accept(W,R))return;let q=u(R);if(await e.to.exists(q)){let a=await e.to.getSecret(q);if(fa(a)===fa(W.data)){i=!1;return}}await e.to.putSecret(q,W.data,{contentType:W.metadata.contentType??mf()}),i=!1},b=async(R)=>{await y(u(R)),i=!1},M=(R)=>{if(R.event!=="path_removed")return t.includes(R.path)?[R.path]:[];let W=`${R.path.replace(/\/+$/g,"")}/`;return t.filter((q)=>q===R.path||q.startsWith(W))},_=new Set(["revoked","removed","deleted","path_removed","lease_revoked"]);if(e.from.subscribeEvents)n.push(e.from.subscribeEvents((R)=>{if(_.has(R.event)){let W=M(R);if(W.length>0)l(async()=>{for(let q of W)await b(q)})}try{e.onEvent?.(R)}catch(W){r.warn("Secrets mirror event observer failed",{"ion.operation":"secrets.mirror.event","ion.outcome":"degraded",path:R.path,event:R.event,error:W instanceof Error?W.message:String(W)})}}));return(async()=>{let R=new Set(t);for(;;){try{for(let W of[...R]){let q=await e.from.subscribe(W,(a)=>{l(()=>p(W,a))},e.subscription);if(c){q();return}n.push(q),R.delete(W)}if(await o,c)return;s=!0,d.refresh();return}catch(W){if(c)return;i=!0,r.warn("Secrets mirror initialization failed; retrying",{"ion.operation":"secrets.mirror.initialize","ion.outcome":"degraded",error:W instanceof Error?W.message:String(W)})}if(await new Promise((W)=>{setTimeout(W,gf).unref?.()}),c)return}})(),{isReady:d.isReady,ready:d.ready,isAvailable:()=>s&&!c&&!i&&(e.from.isAvailable?.()??!0)&&(e.to.isAvailable?.()??!0),async purge(){if(c)throw Error("Secrets mirror is closed");await l(async()=>{for(let R of t)await b(R)})},async close(){if(c)return;c=!0;for(let R of n.splice(0))R();d.refresh(),d.settle(),await o}}}function Yt(e){return typeof e.getFullSecret==="function"}function Mo(e){let t=e;return typeof t.handleDelivery==="function"&&typeof t.handleEvents==="function"&&typeof t.isDeliveryRequest==="function"&&typeof t.isEventsRequest==="function"}function pa(e){return e.type==="vault"&&[e.vaultLfvServerUrl,e.vaultLfvClientId,e.vaultLfvDeliveryEndpoint,e.vaultLfvVerifyJwks,e.vaultLfvEventsEndpoint].some((t)=>t!==void 0)}function xe(e,t){if(!e?.trim())throw Error(`Mirrored LFV config requires ${t}`);return e}function Sf(e,t){if(t?.trim())return t;if(Yt(e))throw Error("mirroredConfig requires fromPath for a SecretsSource upstream");if(e.type==="vault")return xe(e.vaultLfvPath??e.vaultPath,"an upstream vault path");if(e.type==="azure")return xe(e.azurePath,"an upstream Azure path");throw Error(`Mirroring from config source type "${e.type}" requires an explicit fromPath`)}function vf(e,t){let r=xe(e.vaultLfvPath??e.vaultPath,"vaultLfvPath or vaultPath");return kt({lfvServerUrl:xe(e.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:xe(e.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:xe(e.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),verifyJwks:xe(e.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),eventsEndpoint:xe(e.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),path:r,deliveryTimeout:e.vaultLfvDeliveryTimeout,retryInterval:e.vaultLfvRetryInterval,warnInterval:e.vaultLfvWarnInterval,log:t},void 0,{selfRedeemReads:!0})}var kf=new Set(["vault","azure","aws","gcp"]);function bf(e,t,r){if(!kf.has(e.type))return;return{type:e.type,...t.origin,path:r}}function Rf(e){return e.metadata.contentType?.typeId===wf.id&&typeof e.data.id==="string"&&e.data.id.trim().length>0}function Tf(e,t,r,n){return{...e,close:r,subscribePassive:(o,s)=>t.subscribePassive(o,s),isDeliveryRequest:(o)=>t.isDeliveryRequest(o),isEventsRequest:(o)=>t.isEventsRequest(o),handleDelivery:(o)=>(n(),t.handleDelivery(o)),handleEvents:(o)=>(n(),t.handleEvents(o)),deliveryPath:t.deliveryPath,eventsPath:t.eventsPath,callbackKey:t.callbackKey,trustId:t.trustId}}function vr(e){let t=e.logger??hf,r=Sf(e.from,e.fromPath),n=!Yt(e.from),o=!Yt(e.to),s=Yt(e.from)?e.from:pa(e.from)?vf(e.from,t):at(e.from).secret,i=Yt(e.to)?e.to:at(e.to).secret,c=xe(e.path,"path"),d=qo(i,c,{ttl:e.ttl}),u,l=!1,y=!1,p,b=()=>{if(p)return;p=s.getFullSecret(r).then(()=>{return}).catch((a)=>{p=void 0,t.warn("Mirrored ConfigSource bootstrap read failed",{"ion.operation":"config.mirror.reconcile","ion.outcome":"degraded",error:a instanceof Error?a.message:String(a)})})},M=(a)=>{if(l)throw Error("Mirrored ConfigSource is closed");if(!u){y=a;let w=!a&&Mo(s)?{...s,subscribe:(v,L)=>s.subscribePassive(v,L)}:s;u=Uo({from:w,to:i,paths:[r],mapPath:()=>c,accept:Rf,logger:t})}else if(a&&!y)b();return u},_={isReady:()=>u?.isReady()??!1,ready:(a)=>M(!0).ready(a),isAvailable:()=>u?.isAvailable()??!1,purge:()=>M(!1).purge(),close:async()=>{await u?.close()}},R=async()=>{if(l)return;if(l=!0,await u?.close(),n)await s.close?.();if(o)await i.close?.()},W=Mo(s)?Tf(i,s,R,()=>{M(!1)}):{...i,close:R},q={get origin(){let a=d.origin;if(!a)return;return{...a,type:"mirror",from:bf(e.from,s,r)}},load:async()=>{try{let a=await d.load();return M(!1),a}catch(a){throw M(!0),a}},subscribe:(a,w)=>(M(!1),d.subscribe(a,w)),secret:W,mirror:_,async handleCallback(a,w){if(!Mo(s))return Response.json({error:"Config source is not LFV-enabled"},{status:409});return M(!1),a==="delivery"?s.handleDelivery(w):s.handleEvents(w)}};if(Object.defineProperties(q,{log:{get:()=>d.log,set:(a)=>{d.log=a},enumerable:!0},validators:{get:()=>d.validators,set:(a)=>{d.validators=a},enumerable:!0}}),!Yt(e.from)&&pa(e.from)){let a=e.from;q[Kt]={path:r,lfvServerUrl:xe(a.vaultLfvServerUrl,"vaultLfvServerUrl"),clientId:xe(a.vaultLfvClientId,"vaultLfvClientId"),deliveryEndpoint:xe(a.vaultLfvDeliveryEndpoint,"vaultLfvDeliveryEndpoint"),eventsEndpoint:xe(a.vaultLfvEventsEndpoint,"vaultLfvEventsEndpoint"),verifyJwks:xe(a.vaultLfvVerifyJwks,"vaultLfvVerifyJwks"),deliveryTimeout:a.vaultLfvDeliveryTimeout,retryInterval:a.vaultLfvRetryInterval,warnInterval:a.vaultLfvWarnInterval}}return q}import{IoniteError as ya}from"@ionite/core";class Ot extends ya{constructor(e,t=`Waiting for vault config secret at ${e}`){super(t,{status:503,upstreamStatus:404});this.name="VaultConfigWaitingForSecretError";this.code="not_found";this.sourceType="vault";this.path=e}}function Cf(e){return e instanceof Ot}class kr extends ya{constructor(e,t){super(t,{status:500});this.name="VaultConfigInvalidPayloadError";this.code="invalid_payload";this.sourceType="vault";this.path=e}}function If(e){return e instanceof kr}var ha=["id","sso","iam","workload","secrets","ciam","otel","authz","readyz","capabilitiez"];function ma(e){return ha.some((t)=>(t in e))}function ga(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw new Ot(t,`Vault config secret at ${t} is missing or not an object`);let r=e;if(!ma(r)&&Object.keys(r).length===1&&"data"in r){let n=r.data;if(n&&typeof n==="object"&&!Array.isArray(n))r=n}if(Object.keys(r).length===0)throw new Ot(t,`Vault config secret at ${t} is empty`);if(!ma(r))throw new kr(t,`Vault config secret at ${t} is an invalid payload: not a RemoteConfig (no known keys: ${ha.join("/")})`);return r}function Pf(e,t,r){return{...e,subscribe:async(n,o,s)=>{try{return await e.subscribe(n,o,s)}catch(i){if(!(i instanceof je))throw i;return await st(e,n,o,t,r(),s)}}}}function yn(e){let t=bt(e.path,"path","vaultConfig");Ct(e.ttl);let r=e.vault??Bt({type:"vault",url:e.url,token:e.token,workload:e.workload,lfv:e.lfv,websocket:e.websocket,ttl:e.ttl,log:e.log}),n=e.vault&&e.ttl?Pf(r,e.ttl,()=>e.log):r,o={get origin(){return{type:"vault",...n.origin,path:t}},get log(){return e.log},set log(s){if(e.log=s,n&&"log"in n)n.log=s},load:async()=>{try{let s=await n.getFullSecret(t);return ga(s.data,t)}catch(s){if(s instanceof ot)throw new Ot(t);if(s instanceof Ot||s instanceof kr)throw s;throw Error("Error retrieving remote config from vault",{cause:s})}},subscribe:(s,i)=>n.subscribe(t,(c)=>{let d;try{d=ga(c.data,t)}catch(u){e.log?.warn?.("Ignoring invalid vault config update; keeping last-known-good",{"ion.operation":"config.vault.update","ion.outcome":"degraded",path:t,error:u instanceof Error?u.message:String(u)});return}s(d)},i),secret:n};if(e.lfv?.lfvServerUrl&&e.lfv.clientId&&e.lfv.deliveryEndpoint&&e.lfv.eventsEndpoint)o[Kt]={path:e.lfv.path??t,lfvServerUrl:e.lfv.lfvServerUrl,clientId:e.lfv.clientId,deliveryTimeout:e.lfv.deliveryTimeout,retryInterval:e.lfv.retryInterval,warnInterval:e.lfv.warnInterval,deliveryEndpoint:e.lfv.deliveryEndpoint,eventsEndpoint:e.lfv.eventsEndpoint,verifyJwks:e.lfv.verifyJwks};return o}function hn(e){if(e==null)return;if(typeof e==="number")return Number.isFinite(e)?e:void 0;let t=e.trim();if(!t)return;let r=Number.parseInt(t,10);return Number.isFinite(r)?r:void 0}function Of(e,t){let r=e.vaultLfvServerUrl??t?.lfvServerUrl,n=e.vaultLfvClientId??t?.clientId,o=e.vaultLfvDeliveryEndpoint??t?.deliveryEndpoint,s=e.vaultLfvEventsEndpoint??t?.eventsEndpoint;if(!r||!n||!o||!s)return t;return{...t,lfvServerUrl:r,clientId:n,deliveryEndpoint:o,verifyJwks:e.vaultLfvVerifyJwks??t?.verifyJwks,eventsEndpoint:s,path:e.vaultLfvPath??t?.path,deliveryTimeout:hn(e.vaultLfvDeliveryTimeout)??t?.deliveryTimeout,retryInterval:hn(e.vaultLfvRetryInterval)??t?.retryInterval,warnInterval:hn(e.vaultLfvWarnInterval)??t?.warnInterval}}function Ef(e,t){let r=e.vaultWebsocketUrl??t?.url;if(!r)return t;return{...t,url:r,token:e.vaultWebsocketToken??t?.token,clientId:e.vaultWebsocketClientId??t?.clientId,header:e.vaultWebsocketHeader??t?.header}}function Af(e,t){let r=e.vaultWorkloadTokenUrl??t?.idpTokenUrl,n=e.vaultWorkloadClientId??t?.clientId,o=e.vaultWorkloadClientSecret??t?.clientSecret;if(!r||!n||!o)return t;return{...t,idpTokenUrl:r,clientId:n,clientSecret:o,scope:e.vaultWorkloadScope??t?.scope}}function wa(e,t){return{...t,url:e.vaultUrl??t?.url,token:e.vaultToken??t?.token,path:e.vaultPath??t?.path,ttl:hn(e.vaultTtl)??t?.ttl,workload:Af(e,t?.workload),lfv:Of(e,t?.lfv),websocket:Ef(e,t?.websocket)}}function at(e){switch(e.type){case"vault":return xf(e);case"azure":return Uf(e);case"aws":return Mf(e);case"gcp":return qf(e);case"mirror":return Lf(e);default:throw Error(`Unsupported config locator type: ${e.type}`)}}function Lf(e){if(e.from.type==="mirror")throw Error("Mirror ConfigSource chains are not supported");if(!e.to.vaultPath.trim())throw Error("Mirror ConfigSource requires to.vaultPath");return vr({from:e.from,to:e.to,path:e.to.vaultPath,ttl:e.to.vaultTtl})}function xf(e){return yn(wa(e))}function Uf(e){return gn({authMethod:e.azureAuthMethod,entraTenantId:e.azureEntraTenantId,clientId:e.azureClientId,clientSecret:e.azureClientSecret,federatedTokenFile:e.azureFederatedTokenFile,managedIdentityClientId:e.azureManagedIdentityClientId,imdsApiVersion:e.azureImdsApiVersion,vaultUrl:e.azureVaultUrl,vaultName:e.azureVaultName,apiVersion:e.azureApiVersion,scope:e.azureScope,secretNamePrefix:e.azureSecretNamePrefix,path:e.azurePath,ttl:e.azureTtl})}function Mf(e){return Lo({webhookUrl:e.awsWebhookUrl,ttl:e.awsTtl})}function qf(e){return xo({ttl:e.gcpTtl})}function qo(e,t,r={}){switch(e.type){case"vault":return yn({vault:e,path:t,ttl:r.ttl});case"azure":return gn({vault:e,path:t,ttl:r.ttl});default:throw new _f(`configFromSource is not supported for secrets source type "${e.type}" (path "${t}"). Only "vault" and "azure" sources can currently back a runtime config path.`,{status:500,statusText:"Unsupported config source"})}}function Et(e){if(!e)return;let t=Number.parseInt(e,10);return Number.isFinite(t)?t:void 0}function wn(e,t){let r=t?.type??e.ION_CONFIG_TYPE;if(!r)throw Error("ION_CONFIG_TYPE is required when using envConfig(); supported types are vault, azure, aws, gcp, mirror.");if(r==="vault")return{type:"vault",vaultUrl:e.ION_VAULT_URL,vaultToken:e.ION_VAULT_TOKEN,vaultPath:e.ION_VAULT_PATH??"",vaultTtl:Et(e.ION_VAULT_TTL),vaultWorkloadTokenUrl:e.ION_VAULT_WORKLOAD_TOKEN_URL,vaultWorkloadClientId:e.ION_VAULT_WORKLOAD_CLIENT_ID,vaultWorkloadClientSecret:e.ION_VAULT_WORKLOAD_CLIENT_SECRET,vaultWorkloadScope:e.ION_VAULT_WORKLOAD_SCOPE,vaultLfvServerUrl:e.ION_VAULT_LFV_SERVER_URL,vaultLfvClientId:e.ION_VAULT_LFV_CLIENT_ID,vaultLfvDeliveryEndpoint:e.ION_VAULT_LFV_DELIVERY_ENDPOINT,vaultLfvVerifyJwks:e.ION_VAULT_LFV_VERIFY_JWKS,vaultLfvEventsEndpoint:e.ION_VAULT_LFV_EVENTS_ENDPOINT,vaultLfvPath:e.ION_VAULT_LFV_PATH,vaultLfvDeliveryTimeout:Et(e.ION_VAULT_LFV_DELIVERY_TIMEOUT),vaultLfvRetryInterval:Et(e.ION_VAULT_LFV_RETRY_INTERVAL),vaultLfvWarnInterval:Et(e.ION_VAULT_LFV_WARN_INTERVAL),vaultWebsocketUrl:e.ION_VAULT_WEBSOCKET_URL,vaultWebsocketToken:e.ION_VAULT_WEBSOCKET_TOKEN,vaultWebsocketClientId:e.ION_VAULT_WEBSOCKET_CLIENT_ID,vaultWebsocketHeader:e.ION_VAULT_WEBSOCKET_HEADER};if(r==="azure")return{type:"azure",azurePath:e.ION_AZURE_PATH,azureApiVersion:e.ION_AZURE_API_VERSION,azureScope:e.ION_AZURE_SCOPE,azureSecretNamePrefix:e.ION_AZURE_SECRET_NAME_PREFIX,azureAuthMethod:e.ION_AZURE_AUTH_METHOD,azureEntraTenantId:e.ION_AZURE_TENANT_ID,azureClientId:e.ION_AZURE_CLIENT_ID,azureClientSecret:e.ION_AZURE_CLIENT_SECRET,azureFederatedTokenFile:e.ION_AZURE_FEDERATED_TOKEN_FILE,azureManagedIdentityClientId:e.ION_AZURE_MANAGED_IDENTITY_CLIENT_ID,azureImdsApiVersion:e.ION_AZURE_IMDS_API_VERSION,azureVaultUrl:e.ION_AZURE_VAULT_URL,azureVaultName:e.ION_AZURE_VAULT_NAME,azureTtl:Et(e.ION_AZURE_TTL)};if(r==="aws")return{type:"aws",awsWebhookUrl:e.ION_AWS_WEBHOOK_URL??"",awsTtl:Et(e.ION_AWS_TTL)};if(r==="gcp")return{type:"gcp",gcpTtl:Et(e.ION_GCP_TTL)};if(r==="mirror"){let n={};for(let[c,d]of Object.entries(e))if(c.startsWith("ION_FROM_"))n[`ION_${c.slice(9)}`]=d;if(n.ION_CONFIG_TYPE==="mirror")throw Error('ION_FROM_CONFIG_TYPE cannot be "mirror"; mirror chains are not supported.');let o=wn(n),s=wn(e,{type:"vault"});if(!s.vaultPath.trim())throw Error("ION_VAULT_PATH is required when ION_CONFIG_TYPE=mirror.");let i={type:"vault",vaultUrl:s.vaultUrl,vaultToken:s.vaultToken,vaultPath:s.vaultPath,vaultTtl:s.vaultTtl,vaultWorkloadTokenUrl:s.vaultWorkloadTokenUrl,vaultWorkloadClientId:s.vaultWorkloadClientId,vaultWorkloadClientSecret:s.vaultWorkloadClientSecret,vaultWorkloadScope:s.vaultWorkloadScope,vaultWebsocketUrl:s.vaultWebsocketUrl,vaultWebsocketToken:s.vaultWebsocketToken,vaultWebsocketClientId:s.vaultWebsocketClientId,vaultWebsocketHeader:s.vaultWebsocketHeader};return{type:"mirror",from:o,to:i}}throw Error(`ION_CONFIG_TYPE="${r}" is not valid for envConfig(); supported types are vault, azure, aws, gcp, mirror.`)}function Sa(e,t){return at(wn(e,t))}function Wf(e){return Sa(process.env,e)}var jf=1000,Nf=30000,va=["vault","azure","aws","gcp"];function ka(e,t){if(!e||typeof e!=="object"||Array.isArray(e))throw Error(`Config locator at ${t} is an invalid payload: expected an object with a "type" field`);let r=e.type;if(typeof r!=="string"||!va.includes(r))throw Error(`Config locator at ${t} is an invalid payload: unknown type "${String(r)}" (expected ${va.join("/")})`)}function ba(e,t){return e.log??=t.log,e.validators??=t.validators,e}function br(e){if(!e?.secret?.close)return;try{Promise.resolve(e.secret.close()).catch((t)=>{e.log?.warn?.("secretConfigSource: inner source close failed",t)})}catch(t){e.log?.warn?.("secretConfigSource: inner source close failed",t)}}function $f(e,t){let r=bt(t,"path","secretConfigSource"),n,o=(i)=>{ka(i,r);let c=JSON.stringify(i);if(n&&n.hash===c)return n.inner;let d=n?.inner,u=ba(at(i),s);if(n={hash:c,inner:u},d&&d!==u)br(d);return u},s={get origin(){return n?.inner.origin},async load(){let i=await e.getSecret(r);return o(i).load()},async subscribe(i,c){let d,u=!1,l=!1,y,p,b=new Promise((v,L)=>{y=v,p=L}),M=Xr(),_,R,W=(v)=>new Promise((L)=>{R=L,_=setTimeout(L,v)}),q=async(v,L)=>{ka(v,r);let H=JSON.stringify(v),J=n!==void 0&&n.hash===H;if(J&&d)return;let Y=n?.inner,re=d,ue=J&&n?n.inner:ba(at(v),s),se=!J,K=()=>{if(se&&ue!==Y)br(ue)};try{if(ue.subscribe){let z=await ue.subscribe(i,c)??void 0;if(u||!M.isCurrent(L)){z?.(),K();return}if(d=z,n={hash:H,inner:ue},re&&re!==z)re();if(se&&Y&&Y!==ue)br(Y);return}let ee=await ue.load();if(u||!M.isCurrent(L)){K();return}if(n={hash:H,inner:ue},re)re(),d=void 0;if(se&&Y&&Y!==ue)br(Y);i(ee)}catch(ee){throw K(),ee}},a=async(v)=>{let L=M.next(),H=jf;for(;;){if(u||!M.isCurrent(L))return;try{await q(v,L);return}catch(J){if(u||!M.isCurrent(L))return;s.log?.warn(`secretConfigSource rebind for ${r} failed; keeping last-known-good source and retrying in ${H}ms`,J),await W(H),H=Math.min(Nf,H*2)}}},w=await e.subscribe(r,(v)=>{if(u)return;if(!l){q(v.data,M.next()).then(()=>{l=!0,y()}).catch((L)=>{l=!0,p(L)});return}a(v.data)},c);return await b,()=>{if(u=!0,M.next(),_)clearTimeout(_);R?.(),d?.(),w(),br(n?.inner),n=void 0}},secret:e};return s}import{compareDisplayExpiryDesc as Ra,projectDisplayUser as Ta,readDisplayCookies as Df}from"@ionite/core";import{discoverSessions as Kf,getCustomer as Ff,getOwnedTenantIds as Vf}from"@ionite/core/server";function Sn(e,t){let r=e?.[t];return typeof r==="string"?r:""}function zf(e){if(!e)return;let t=e instanceof Date?e:new Date(e);return Number.isNaN(t.getTime())?void 0:t.toISOString()}function Bf(e,t){let r=e.tenantId?.trim();if(!r)return;let n={name:Sn(e.claims,"name")||Sn(e.claims,"preferred_username"),email:Sn(e.claims,"email"),avatar:Sn(e.claims,"picture")},o=zf(e.expiresAt);return{tenantId:r,authType:e.authType,source:"session",user:Ta(n,t),...o?{expiresAt:o}:{}}}function Gf(e){let t=new Map;for(let r of e){let n=typeof r.user.email==="string"?r.user.email:void 0,o=typeof r.user.name==="string"?r.user.name:void 0,s=n||o||r.tenantId,i=t.get(s);if(i){i.tenants.push(r);continue}t.set(s,{...n?{email:n}:{},...o?{name:o}:{},tenants:[r]})}return[...t.values()]}async function Hf(e,t){let n=(await Kf(e,t.sessionStore,{...t.cookiesPrefix!==void 0?{cookiesPrefix:t.cookiesPrefix}:{}})).map((y)=>Bf(y,t.displayUser)).filter((y)=>Boolean(y)).sort((y,p)=>Ra(y.expiresAt,p.expiresAt)),o=typeof t.max==="number"&&t.max>=1?Math.floor(t.max):10,s=n.slice(0,o),i=new Set(s.map((y)=>y.tenantId));if(t.ion){let y=await Ff(e,t.ion);if(y?.id){let p=await Vf(t.ion,y.id),b=Ta({name:y.name,email:y.email,avatar:y.avatar},t.displayUser);for(let M of p){if(i.has(M))continue;i.add(M),s.push({tenantId:M,authType:"ciam",source:"owner",user:b})}}}let c=Date.now(),d=typeof t.maxDiscovered==="number"&&t.maxDiscovered>=1?Math.floor(t.maxDiscovered):10,u=Df(e.headers.get("cookie")).filter((y)=>y.envelope.kind==="discovered"&&Boolean(y.envelope.tenantId)&&Date.parse(y.envelope.expiresAt)>c).sort((y,p)=>Ra(y.envelope.expiresAt,p.envelope.expiresAt)),l=0;for(let y of u){let p=y.envelope.tenantId;if(!p||i.has(p))continue;if(l>=d)break;l+=1,i.add(p),s.push({tenantId:p,authType:y.envelope.authType,source:"discovered",user:y.envelope.user,expiresAt:y.envelope.expiresAt,...y.envelope.tenantName?{tenantName:y.envelope.tenantName}:{}})}if(t.tenantLabel)for(let y of s){let p=await t.tenantLabel(y.tenantId);if(p)y.tenantName=p}return{tenants:s,groups:Gf(s)}}import{listGenerator as Jf}from"@ionite/core";import{TENANT_OWNER_PERMISSION as Yf,tenantOwnerEntitlementId as Ca,tenantResourceId as Xf}from"@ionite/core/server";async function Zf(e,t){let r=e.authz.catalogStore;if(!r)throw Error("Cannot materialize tenant owner entitlement: no AccessCatalogStore is wired.");let n=t.displayName?.trim()||t.tenantId,o={id:Ca(t.tenantId),name:`Owner of ${n}`,description:`Administer the ${n} tenant`,source:"app",requestable:!0,riskLevel:"privileged",permissions:[Yf],resources:[Xf(t.tenantId)],assignableSubjectTypes:["customer"],recommendedSubjectTypes:["customer"]},s=r.groups.insertIfAbsent(o);return await s.ready(),s}async function Qf(e,t){let r=e.authz.catalogStore,n=e.authz.accessStore;if(!r)throw Error("Cannot clean up tenant entitlements: no AccessCatalogStore is wired.");if(!n)throw Error("Cannot clean up tenant entitlements: no AccessAssignmentStore is wired.");let o=Ca(t.tenantId),s=[];for await(let c of Jf((d,u)=>n.listByTarget("group",o,{start:d,limit:u})))s.push(c);for(let c of s)await e.authz.revoke(c);let i=await r.groups.get(o);if(i)await r.groups.delete(o);return{revoked:s.length,deleted:i?1:0}}function Wo(e){if(Array.isArray(e))return e.map(Wo);if(e&&typeof e==="object")return Object.fromEntries(Object.entries(e).filter(([,t])=>t!==void 0).sort(([t],[r])=>t.localeCompare(r)).map(([t,r])=>[t,Wo(r)]));return e}function Ia(e){return JSON.stringify(Wo(e))}function ep(e){if(e.type==="vault")return e.vaultLfvPath??e.vaultPath;if(e.type==="azure"&&e.azurePath?.trim())return e.azurePath;throw Error(`Tenant config locator type "${e.type}" does not declare a mirrorable config path`)}function tp(e,t){let r=t.logger??e.log,n=new Map,o=!1,s=async(u)=>{if(u.closed)return;u.closed=!0,u.closeHooks?.(),await u.hookSetup?.catch(()=>{return}),await u.source.secret.close?.()},i=(u)=>{let l=(async()=>{let y=await t.store.get(u);if(!y)throw Error(`Tenant "${u}" was not found`);if(!y.configLocator)throw Error(`Tenant "${u}" has no configLocator`);let p=y.configLocator,b=t.path(y).trim();if(!b)throw Error(`Tenant mirror path is empty for "${u}"`);let M=t.sourceFromLocator?.(p,y)??p,R={source:vr({from:M,fromPath:ep(p),to:t.to,path:b,logger:r}),locatorFingerprint:Ia(p),targetPath:b,closed:!1};if(t.hooks?.onRemoteConfigChange)R.hookSetup=t.to.subscribe(b,(W)=>{Promise.resolve(t.hooks?.onRemoteConfigChange?.(y,W.data,W)).catch((q)=>{r.warn("Tenant config mirror hook failed",{"ion.operation":"tenant.config.mirror","ion.outcome":"failure",tenantId:u,error:q instanceof Error?q.message:String(q)})})}).then((W)=>{R.closeHooks=W}).catch((W)=>{r.warn("Tenant config mirror destination subscription failed",{"ion.operation":"tenant.config.mirror.subscribe","ion.outcome":"failure",tenantId:u,error:W instanceof Error?W.message:String(W)})});return R})();return n.set(u,l),l.catch(()=>{if(n.get(u)===l)n.delete(u)}),l},c=async(u,l,y)=>{if(n.get(u)===l)n.delete(u);await s(y)},d=async(u)=>{if(o)throw Error("Tenant config mirror is closed");let l=n.get(u);if(!l)return i(u);let y=await l,p=await t.store.get(u);if(!p?.configLocator)throw await c(u,l,y),Error(p?`Tenant "${u}" has no configLocator`:`Tenant "${u}" was not found`);if(Ia(p.configLocator)!==y.locatorFingerprint)return await c(u,l,y),n.get(u)??i(u);return y};return{async ensure(u,l){await(await d(u)).source.mirror.ready(l)},async handleCallback(u,l,y){try{return await(await d(u)).source.handleCallback(l,y)}catch(p){let b=p instanceof Error?p.message:String(p),M=b.includes("was not found")?404:503;return r.warn("Tenant config mirror callback could not be routed",{"ion.operation":"tenant.config.mirror.callback","ion.outcome":"failure",tenantId:u,kind:l,error:b}),Response.json({error:M===404?"Tenant not found":"Tenant config mirror unavailable"},{status:M})}},async purge(u){let l=n.get(u),y=l?await l:void 0,p=await t.store.get(u),b=y?.targetPath??(p?t.path(p).trim():void 0);if(y&&l)await c(u,l,y);if(b&&await t.to.exists(b))await t.to.deleteSecret(b);if(p)await t.hooks?.onRemoteConfigRevoke?.(p)},async close(){if(o)return;o=!0;let u=[...n.values()];n.clear(),await Promise.all(u.map(async(l)=>{try{await s(await l)}catch{}}))}}}import{buildTenantPath as rp,DEFAULT_TENANT_API_NAMESPACE as Oa,DEFAULT_TENANT_UI_NAMESPACE as Ea,matchTenantHost as np,matchTenantPath as Aa,normalizeTenantPathNamespace as Pa}from"@ionite/core";function op(){return Response.json({error:"Tenant not found"},{status:404})}function sp(e){return Response.json({error:`Tenant runtime unavailable for ${e}`},{status:503})}function ip(e,t){let r=!e||e.type===void 0||e.type==="path"?e:void 0;if(t==="api")return Pa(r?.api??Oa);return Pa(r?.ui??Ea)}function ap(e){if(e.store)return async(t)=>e.store.getIon(t);return async(t)=>await e.getIon(t)??void 0}async function _a(e,t={}){if(t.custom){let s=await t.custom(e);if(s)return{id:s}}if(t.strategy?.type==="selector")return null;if(t.strategy?.type==="host"){let s=np(new URL(e.url).hostname,t.strategy.baseDomain);return s?{id:s.id}:null}let r=t.namespace??"api",n=ip(t.strategy,r),o=Aa(new URL(e.url).pathname,n);if(!o)return null;return{id:o.id,context:{namespace:r,restPath:o.restPath,restSegments:o.restSegments}}}function La(e,t){let r=new URL(e.url);return r.pathname=t,new Request(r,e)}function jo(e,t,r,n){let o=Aa(new URL(e.url).pathname,r);if(!o||o.id!==t)return e;return La(e,rp(t,o.restPath,n))}function cp(e,t,r={beforeTenantSegments:["api"],afterTenantSegments:[]}){return jo(e,t,Oa,r)}function up(e,t,r={beforeTenantSegments:["ui"],afterTenantSegments:[]}){return jo(e,t,Ea,r)}function dp(e){return async function(r){let n=e.resolveTenant?await e.resolveTenant(r):await _a(r),o=typeof n==="string"?{id:n,context:void 0}:n??null;if(!o?.id)return e.onMissingTenant?await e.onMissingTenant(r):op();let s=await e.getIon(o.id,r)??null;if(!s)return e.onMissingIonite?await e.onMissingIonite(r,o.id):sp(o.id);let i=e.rewriteRequest?await e.rewriteRequest(r,{id:o.id,ion:s,context:o.context}):r;return s.handler(i)}}import{list as lp,matchesListFilter as fp}from"@ionite/core";class xa{constructor(){this.identities=new Map;this.clientIdIndex=new Map;this.externalIdIndex=new Map}async get(e){return this.identities.get(e)}async lookup(e){if(e.id){let t=this.identities.get(e.id);if(t)return t}if(e.clientId){let t=this.clientIdIndex.get(e.clientId);if(t)return this.identities.get(t)}if(e.externalId)return this.getByExternalId(e.externalId);return}async getByExternalId(e){let t=this.externalIdIndex.get(e);return t?this.identities.get(t):void 0}async upsert(e){let t=e.id?.trim()||crypto.randomUUID(),r=new Date,n=this.identities.get(t),o={...e,id:t,createdAt:n?.createdAt??e.createdAt??r,updatedAt:r};if(n?.clientId&&n.clientId!==o.clientId)this.clientIdIndex.delete(n.clientId);if(n?.externalId&&n.externalId!==o.externalId)this.externalIdIndex.delete(n.externalId);if(this.identities.set(t,o),o.clientId)this.clientIdIndex.set(o.clientId,t);if(o.externalId)this.externalIdIndex.set(o.externalId,t);return o}async delete(e){let t=this.identities.get(e);if(t?.clientId)this.clientIdIndex.delete(t.clientId);if(t?.externalId)this.externalIdIndex.delete(t.externalId);return this.identities.delete(e),t?1:0}async list(e){let t=Array.from(this.identities.values()).filter((c)=>fp(c,e?.filter)),r=Math.max(0,e?.start??0),n=e?.limit,o=t.length,s=n!=null?r+n:void 0,i=t.slice(r,s);return lp(o,i,r,n)}}var bp=30000;function Rp(e){let t=e,r=t.basePath??xr(),n=t.readyTimeoutMs??bp,o=Lr(t.stores),{routing:s,beforeChange:i,afterChange:c,configRetry:d,onConfigLoadError:u}=t;return{frameworkConfig:{log:e.log,validators:e.validators,sso:e.sso,iam:e.iam,workload:e.workload,secrets:e.secrets,lfv:e.lfv,ciam:e.ciam,tm:e.tm,authz:e.authz,otel:e.otel},basePath:r,readyTimeoutMs:n,stores:o,options:{beforeChange:i,afterChange:c,routing:s,configRetry:d,onConfigLoadError:u}}}function Tp(e){let t=e,r={trace:(n,...o)=>t.trace(n,...o),debug:(n,...o)=>t.debug(n,...o),info:(n,...o)=>t.info(n,...o),warn:(n,...o)=>t.warn(n,...o),error:(n,...o)=>t.error(n,...o)};return{logger:r,update(n){return t=n,r}}}function Va(e,t){let r=e;return r.setStores=(n)=>{t.current=Lr(n),Object.assign(r,Qt(r,t.current))},r}function Ma(e){let t=e?.replace(/\s+/g," ").trim();return t?t:void 0}function Ho(e){if(typeof e!=="object"||e===null)return;return e.cause}function Cp(e){if(!(e instanceof Error))return typeof e==="string"?Ma(e):void 0;let t=Ma(e.message),r=[],n=e;if(typeof n.code==="string")r.push(`code=${n.code}`);let o=typeof n.upstreamStatus==="number"?n.upstreamStatus:e instanceof Ka?void 0:n.status;if(typeof o==="number")r.push(`status=${o}`);if(typeof n.path==="string")r.push(`path=${n.path}`);if(r.length===0)return t;if(!t)return r.join(", ");return`${t} [${r.join(", ")}]`}function zo(e,t=3){let r=[],n=e,o=0;while(n!=null&&o<t){let s=Cp(n);if(s&&!r.includes(s))r.push(s);n=Ho(n),o+=1}return r.length>0?r.join(" <- "):void 0}function Jo(e){let t=e,r=0;while(t!=null&&r<3){if(typeof t==="object"&&t!==null){let n=t;if(typeof n.upstreamStatus==="number")return n.upstreamStatus;if(!(t instanceof Ka)&&typeof n.status==="number")return n.status}t=Ho(t),r+=1}return}function Ip(e,t){if(typeof e!=="object"||e===null)return;return e[t]}function _t(e,t){let r=e,n=0;while(r!=null&&n<3){let o=Ip(r,t);if(o!==void 0)return o;r=Ho(r),n+=1}return}var Pp=new Set(["auth","connection","invalid_payload","invalid_status","not_found","timeout","unknown"]);function Op(e){return typeof e==="string"&&Pp.has(e)}function Ep(e){let t=_t(e,"kind");if(Op(t))return t;let r=Jo(e),n=_t(e,"code"),o=zo(e)?.toLowerCase()??"";if(r===401||r===403||o.includes("auth error")||o.includes("permission denied"))return"auth";if(n==="not_found"||o.includes("waiting for vault"))return"not_found";if(n==="ECONNREFUSED"||n==="ECONNRESET"||n==="ENOTFOUND"||n==="ETIMEDOUT"||o.includes("connection")||o.includes("fetch failed")||o.includes("network"))return"connection";if(o.includes("timed out"))return"timeout";if(o.includes("invalid status")||typeof r==="number"&&r>=400)return"invalid_status";if(o.includes("invalid payload")||o.includes("invalid json")||o.includes("error retrieving secret"))return"invalid_payload";return"unknown"}function Ap(e){return"validation"}var _p=new Set(["ECONNREFUSED","ECONNRESET","ENOTFOUND","ETIMEDOUT","EAI_AGAIN","EHOSTUNREACH","ENETUNREACH","EPIPE","ECONNABORTED"]);function Lp(e,t){let r=_t(e,"recoverable");if(typeof r==="boolean")return r;if(t==="not_found")return!0;if(t==="auth"||t==="invalid_payload")return!1;let n=Jo(e);if(typeof n==="number"&&n>=400&&n<500)return!1;let o=_t(e,"code");if(typeof o==="string"&&(_p.has(o)||o.startsWith("UND_ERR_")))return!0;return!0}function xp(e){return{initialDelayMs:Math.max(1,e?.initialDelayMs??2000),maxDelayMs:Math.max(1,e?.maxDelayMs??600000),multiplier:Math.max(1,e?.multiplier??2),jitterRatio:Math.max(0,e?.jitterRatio??0.2),loadTimeoutMs:Math.max(1,e?.loadTimeoutMs??30000)}}function Up(e,t){let r=Math.max(0,e-1),n=Math.min(t.maxDelayMs,t.initialDelayMs*t.multiplier**r);if(t.jitterRatio===0)return Math.round(n);let o=n*t.jitterRatio,s=(Math.random()*2-1)*o;return Math.max(1,Math.round(Math.min(t.maxDelayMs,n+s)))}function Mp(e){return(t)=>{let r=t.path?` at ${t.path}`:"",n=t.sourceType?` (${t.sourceType})`:"";e.warn(`Config source${n} unavailable${r}; ionite will retry automatically in ${t.nextDelayMs}ms (attempt ${t.attempt}, ${t.errorKind}: ${t.message}).`)}}async function qp(e,t){for(let r of t)await r(e)}function Ne(e){if(!e)return;try{return new URL(e,"http://dummy").pathname}catch{return e.startsWith("/")?e:`/${e}`}}function Wp(e,t){let r=t.id;if(typeof r!=="string"||r.length===0)throw Error("RemoteConfig.id is required and must be a non-empty string.");if(e!==void 0&&e!==r)throw Error(`RemoteConfig.id is immutable once applied and cannot change (applied "${e}", received "${r}").`)}function jp(e){let t=(r,n)=>{if(r!==void 0&&(typeof r!=="string"||r.length===0))throw Error(`${n}: "clientSecret" must be a non-empty string when present; omit it entirely for a public (PKCE-only) client.`)};t(e.sso?.clientSecret,"sso");for(let[r,n]of Object.entries(e.ciam?.providers??{}))t(n.clientSecret,`ciam.providers.${r}`)}function Np(e){let t=(o,s)=>{if(!o)return;if(typeof o.url!=="string"||o.url.length===0)throw Error(`${s}.url is required and must be a non-empty string.`);if(o.audience!==void 0&&(typeof o.audience!=="string"||o.audience.length===0))throw Error(`${s}.audience must be a non-empty string when present.`)},r=e.sso?.accessRequests;if(t(r,"RemoteConfig.sso.accessRequests"),r&&!ct(e.sso?.claimsAsEntitlements))throw Error("RemoteConfig.sso.accessRequests requires sso.claimsAsEntitlements because the provider must carry approved assignments in token claims.");let n=[];for(let[o,s]of Object.entries(e.ciam?.providers??{})){if(t(s.accessRequests,`RemoteConfig.ciam.providers.${o}.accessRequests`),!s.accessRequests)continue;if(s.type==="magic-link")throw Error(`RemoteConfig.ciam.providers.${o}.accessRequests is invalid for a magic-link provider.`);if(!ct(s.claimsAsEntitlements))throw Error(`RemoteConfig.ciam.providers.${o}.accessRequests requires claimsAsEntitlements because the provider must carry approved assignments in token claims.`);if(s.enabled!==!1)n.push(o)}if(e.iam?.users?.assignment==="idp"&&!r)throw Error('RemoteConfig.iam.users.assignment "idp" requires sso.accessRequests.');if(e.iam?.customers?.assignment==="idp"&&n.length===0)throw Error('RemoteConfig.iam.customers.assignment "idp" requires an enabled ciam provider with accessRequests.');if(e.iam?.workloads?.assignment==="idp")throw Error('RemoteConfig.iam.workloads.assignment does not support "idp".')}function $p(e){let t=e.kms;if(t)for(let[n,o]of Object.entries(t)){if(n.length===0)throw Error("RemoteConfig.kms pool names must be non-empty strings.");if(!o||typeof o!=="object"||Array.isArray(o))throw Error(`RemoteConfig.kms.${n} must be an object.`);if(o.source!==void 0&&(typeof o.source!=="string"||o.source.length===0))throw Error(`RemoteConfig.kms.${n}.source must be a non-empty string when present.`);if(o.path!==void 0&&(typeof o.path!=="string"||o.path.length===0))throw Error(`RemoteConfig.kms.${n}.path must be a non-empty string when present.`)}let r=e.otel;if(!r)return;if(r.apiKey!==void 0&&r.apiKeyPool!==void 0)throw Error("RemoteConfig.otel.apiKey and RemoteConfig.otel.apiKeyPool are mutually exclusive.");if(r.apiKeyPool!==void 0){if(typeof r.apiKeyPool!=="string"||r.apiKeyPool.length===0)throw Error("RemoteConfig.otel.apiKeyPool must be a non-empty string.");if(!t?.[r.apiKeyPool])throw Error(`RemoteConfig.otel.apiKeyPool references unknown KMS pool "${r.apiKeyPool}".`)}}function Dp(e){let t=e.authz?.trustedProvisioningClients;if(!t)return;t.forEach((r,n)=>{let o=`authz.trustedProvisioningClients[${n}]`;if(typeof r.issuer!=="string"||r.issuer.length===0)throw Error(`${o}: "issuer" is required and must be a non-empty string.`);if(typeof r.clientId!=="string"||r.clientId.length===0)throw Error(`${o}: "clientId" is required and must be a non-empty string.`);let s=Array.isArray(r.audience)?r.audience:[r.audience];if(s.length===0||s.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less trusted client would grant its permissions to any same-issuer token.`);if(!Array.isArray(r.permissions)||r.permissions.some((i)=>typeof i!=="string"||i.length===0))throw Error(`${o}: "permissions" must be an array of non-empty permission ids.`)})}function Kp(e){let t=e.tm;if(!t)return;if(t.enabled!==!0)throw Error("RemoteConfig.tm.enabled must be true when tm is present.");for(let r of["id","url","issuer","jwksUri","audience","clientId"])if(typeof t.ionite?.[r]!=="string"||t.ionite[r].length===0)throw Error(`RemoteConfig.tm.ionite.${r} is required and must be a non-empty string.`);if(t.consentTtlSeconds!==void 0&&(!Number.isInteger(t.consentTtlSeconds)||t.consentTtlSeconds<60))throw Error("RemoteConfig.tm.consentTtlSeconds must be an integer of at least 60.");if(t.requestTokenTtlSeconds!==void 0&&(!Number.isInteger(t.requestTokenTtlSeconds)||t.requestTokenTtlSeconds<60))throw Error("RemoteConfig.tm.requestTokenTtlSeconds must be an integer of at least 60.");if(t.maxRedeemAttempts!==void 0&&(!Number.isInteger(t.maxRedeemAttempts)||t.maxRedeemAttempts<1))throw Error("RemoteConfig.tm.maxRedeemAttempts must be a positive integer.")}function Fp(e){let t=Array.isArray(e)?e:[e];return t.length>0&&t.every((r)=>typeof r==="string"&&r.length>0)}function Vp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return;let r=t,n=(o,s)=>{if(!Fp(o.audience))throw Error(`${s}: "audience" is required and must be a non-empty string (or array of non-empty strings); an audience-less incoming trust anchor accepts tokens minted for any application on that issuer.`)};if("incoming"in r||"outgoing"in r){let o=r.incoming;if(Array.isArray(o))o.forEach((s,i)=>{if(s&&typeof s==="object")n(s,`workload.incoming[${i}]`)});else if(o&&typeof o==="object"&&"jwksUri"in o)n(o,"workload.incoming");return}if(Ga(r)){if("jwksUri"in r&&!("clientId"in r)&&!("workloadId"in r))n(r,"workload (server-only)");return}}function zp(e,t,r){if(e?.sso?.redirectUri&&t.sso?.redirectUri){let n=Ne(e.sso.redirectUri),o=Ne(t.sso.redirectUri);if(n!==o)r.error(`SSO redirectUri path mismatch: the framework derives "${o}" from basePath, but ConfigSource reports "${n}". Register "${o}" as the callback URL at the IdP.`,{"ion.operation":"sso.redirect_uri.validate","ion.outcome":"failure"})}}function Bo(e){let t={};if(!e)return t;for(let[r,n]of Object.entries(e))if(n.type==="vault"&&typeof n.lfv?.deliveryEndpoint==="string"&&typeof n.lfv?.eventsEndpoint==="string")t[r]=n.lfv;return t}function za(e){return e[Kt]}function Ba(e,t){let r=Bo(e.secrets??void 0),n=Ne(t.deliveryEndpoint),o=Ne(t.eventsEndpoint),s=Ne(t.path);for(let i of Object.values(r)){if(Ne(i.deliveryEndpoint)!==n)continue;if(Ne(i.eventsEndpoint)!==o)continue;let c=i.path?Ne(i.path):void 0;if(s&&c&&s!==c)continue;return!0}return!1}function Bp(e,t){let r=za(t);if(!r)return e;if(Ba(e,r))return e;let n={type:"vault",lfv:{path:r.path,lfvServerUrl:r.lfvServerUrl,clientId:r.clientId,deliveryTimeout:r.deliveryTimeout,retryInterval:r.retryInterval,warnInterval:r.warnInterval,deliveryEndpoint:r.deliveryEndpoint,eventsEndpoint:r.eventsEndpoint,verifyJwks:r.verifyJwks}},o=e.secrets??{},s=Dn(o,{clientId:r.clientId,path:r.path});return{...e,secrets:{...o,[s]:n}}}function Gp(e,t){let r=za(t);if(!r||Ba(e,r))return new Map;let n=Dn(e.secrets??{},{clientId:r.clientId,path:r.path});return new Map([[n,t.secret]])}function Hp(e,t){let r=Bo(e.secrets),n=Bo(t.secrets??void 0);for(let[o,s]of Object.entries(n)){let i=r[o];if(!i)continue;let c=Ne(i.deliveryEndpoint),d=Ne(s.deliveryEndpoint);if(c&&d&&c!==d)throw Error(`LFV deliveryEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${c}, framework path: ${d}`);let u=Ne(i.eventsEndpoint),l=Ne(s.eventsEndpoint);if(u&&l&&u!==l)throw Error(`LFV eventsEndpoint path for secrets source "${o}" in framework config must match ConfigSource path. ConfigSource path: ${u}, framework path: ${l}`)}}function Jp(e){return new Set(Object.keys(e.secrets??{}))}function Yp(e){return new Set(Object.keys(e.secrets??{}))}function Xp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;if(!("outgoing"in t))return new Set;let r=t.outgoing;if(!r||typeof r!=="object"||Array.isArray(r))return new Set;return new Set(Object.keys(r))}function Ga(e){if(!e||typeof e!=="object"||Array.isArray(e))return!1;let t=e;return"clientId"in t||"jwksUri"in t||"workloadId"in t}function Zp(e){let t=e.workload;if(!t||typeof t!=="object"||Array.isArray(t))return new Set;let r=t;if("incoming"in r||"outgoing"in r){let n=r.outgoing;if(!n||typeof n!=="object"||Array.isArray(n))return new Set;return new Set(Object.keys(n))}if(Ga(r))return new Set;return new Set(Object.keys(r).filter((n)=>n!=="default"))}function Qp(e,t,r,n){let o=t.secrets??{},s=e.secrets??{};for(let[l,y]of Object.entries(o)){let p=s[l];if(!p)continue;if(y.type&&p.type&&y.type!==p.type)throw Error(`Secrets source "${l}" type in framework config must match ConfigSource type. ConfigSource type: ${p.type}, framework type: ${y.type}`)}let i=Jp(t),c=Yp(e);for(let l of i)if(!c.has(l)&&!n.has(l))r.warn(`Framework config declares secrets source "${l}" but ConfigSource did not return it; the source may be unavailable until remote config includes it.`);for(let l of c)if(!i.has(l))r.debug("ConfigSource returned a secrets source that is not explicitly declared in framework config.",{sourceName:l});let d=Xp(t),u=Zp(e);for(let l of d)if(!u.has(l))r.warn(`Framework config declares outgoing workload client "${l}" but ConfigSource did not return it; the client may be unavailable until remote config includes it.`);if(t.otel!==void 0&&t.otel!==null&&e.otel===void 0)r.warn("Framework config declares OpenTelemetry, but ConfigSource did not return RemoteConfig.otel; keeping the base logger and leaving ion.otel unavailable until remote config includes it.")}function qa(e,t){if(t===void 0)return!1;return gp(e,t)}function em(e,t){if(typeof t!=="number"||!Number.isFinite(t)||t<=0)return e;return new Promise((r,n)=>{let o=setTimeout(()=>{n(Error(`Ionite ready() timed out after ${t}ms`))},t);e.then(()=>{clearTimeout(o),r()},(s)=>{clearTimeout(o),n(s)})})}function tm(e,t,r){if(typeof t!=="number"||t<=0)return e;return new Promise((n,o)=>{let s=setTimeout(()=>{o(Error(r))},t);e.then((i)=>{clearTimeout(s),n(i)},(i)=>{clearTimeout(s),o(i)})})}function Yo(){return Response.json({error:"ionite is not ready",message:"RemoteConfig has not been applied yet."},{status:503})}function Rr(e){return e==="/"?e:e.replace(/\/+$/,"")}function $o(e,t){return Rr(e)===Rr(t)}function Wa(e){return e.method==="GET"||e.method==="HEAD"}function rm(e){if(e.isReady()&&e.config?.readyz?.enabled===!1)return me();let t=e.readiness();return Response.json(nm(t),{status:t.ok?200:503})}function nm(e){let t=e.config.lastError;if(!t)return e;return{...e,config:{...e.config,lastError:{kind:t.kind,phase:t.phase,at:t.at,message:"[redacted]"}}}}var om={"sso.login":"sso","sso.jit":"sso","sso.logout":"sso","sso.back_channel_logout":"sso","sso.claims_authz":"sso","ciam.magic_link":"ciam","ciam.oidc_login":"ciam","ciam.customer":"ciam","ciam.logout":"ciam","ciam.claims_authz":"ciam","iam.users":"iam","iam.groups":"iam","iam.groups.create":"iam","iam.workloads":"iam","iam.customers":"iam","workload.incoming":"workload","workload.outgoing":"workload","workload.claims_authz":"workload","authz.oaa":"authz","authz.access_requests":"authz","tm.integration":"tm"};function sm(e){let t=e?.providers;if(!t)return!1;return Object.values(t).some((r)=>r.enabled!==!1&&r.type!=="magic-link")}function im(e){return Boolean(e?.iam?.users?.assignment==="idp"&&e.sso?.accessRequests&&ct(e.sso.claimsAsEntitlements))}function am(e){return Boolean(e?.iam?.customers?.assignment==="idp"&&Object.values(e.ciam?.providers??{}).some((t)=>t.enabled!==!1&&t.type!=="magic-link"&&t.accessRequests&&ct(t.claimsAsEntitlements)))}function Te(e,t,r={}){let n=om[e],o=t.modules[n],s=r.capable??!0,i=o.active&&o.ready&&s,c=i?void 0:!o.active||!o.ready?o.reason:r.incapableReason??`${e} is not testable by this application wiring`;return{module:n,active:o.active,ready:o.ready,testable:i,...r.urls&&r.urls.length>0?{urls:r.urls}:{},...c?{reason:c}:{}}}function ct(e){return Boolean(e?.claims&&e.claims.length>0)}function cm(e){if(!e||typeof e!=="object")return!1;let t=e;if(ct(t.claimsAsEntitlements))return!0;let r=t.incoming;if(!r)return!1;if(Array.isArray(r))return r.some((n)=>ct(n.claimsAsEntitlements));return ct(r.claimsAsEntitlements)}function Do(e,t,r,n){let o=Te(e,t,{capable:r&&n,incapableReason:r?"The session store does not declare capabilities.derivedEntitlements, so claim-derived entitlements are not persisted.":"claimsAsEntitlements is not configured for this plane."});if(!r)return{...o,active:!1,testable:!1,reason:"claimsAsEntitlements is not configured for this plane."};return o}function um(e,t,r){let n=Fe(t),o=e.readiness();return{sdk:{version:dn,catalogVersion:Jr},basePath:t,urls:n,modules:o.modules,lfvCallbackTransport:Boolean(r.lfv?.callbackTransport),capabilities:{"sso.login":Te("sso.login",o,{urls:[n.sso.loginUrl,n.sso.callbackUrl,n.sso.userUrl]}),"sso.jit":Te("sso.jit",o,{capable:r.sso?.enableJitUserProvisioning!==!1&&Boolean(r.sso?.userStore),incapableReason:r.sso?.enableJitUserProvisioning===!1?"SSO JIT user provisioning is disabled in FrameworkConfig.":"SSO JIT user provisioning requires a user store (stores.userStore), which the application has not wired."}),"sso.logout":Te("sso.logout",o,{urls:[n.sso.logoutUrl]}),"sso.back_channel_logout":Te("sso.back_channel_logout",o,{urls:[n.sso.logoutBackChannelUrl]}),"sso.claims_authz":Do("sso.claims_authz",o,ct(e.config?.sso?.claimsAsEntitlements),r.sso?.sessionStore?.capabilities?.derivedEntitlements===!0),"ciam.magic_link":Te("ciam.magic_link",o,{capable:Boolean(r.ciam?.magicLinkStore)&&r.ciam?.enableJitUserProvisioning!==!1,urls:[n.ciam.magicLinkUrl,n.ciam.magicLinkLoginUrl],incapableReason:!r.ciam?.magicLinkStore?"CIAM magic-link is enabled but no magicLinkStore capability is wired by the application.":"CIAM magic-link JIT customer provisioning is disabled in FrameworkConfig."}),"ciam.oidc_login":Te("ciam.oidc_login",o,{capable:sm(r.ciam),urls:[n.ciam.customerLoginUrl,n.ciam.customerCallbackUrl,n.ciam.customerProvidersUrl],incapableReason:"CIAM has no enabled third-party (OIDC/OAuth2) providers configured."}),"ciam.customer":Te("ciam.customer",o,{urls:[n.ciam.customerUrl]}),"ciam.logout":Te("ciam.logout",o,{urls:[n.ciam.logoutUrl]}),"ciam.claims_authz":Do("ciam.claims_authz",o,Object.values(e.config?.ciam?.providers??{}).some((s)=>ct(s.claimsAsEntitlements)),r.ciam?.sessionStore?.capabilities?.derivedEntitlements===!0),"iam.users":Te("iam.users",o,{capable:Boolean(r.iam?.userStore),urls:[n.iam.usersUrl],incapableReason:"SCIM Users endpoint is enabled by RemoteConfig but no user store capability is wired by the application."}),"iam.groups":Te("iam.groups",o,{capable:Boolean(r.authz?.catalogStore||r.authz?.catalog),urls:[n.iam.groupsUrl],incapableReason:"SCIM Groups endpoint is enabled by RemoteConfig but no catalog capability (AccessCatalogStore or code-declared authz.catalog) is wired by the application."}),"iam.groups.create":Te("iam.groups.create",o,{capable:Boolean(r.authz?.catalogStore&&r.authz?.onInboundEntitlement),urls:[n.iam.groupsUrl],incapableReason:!r.authz?.catalogStore?"IAM-sourced entitlement creation requires an AccessCatalogStore.":"IAM-sourced entitlement creation requires the application to implement authz.onInboundEntitlement."}),"iam.workloads":Te("iam.workloads",o,{capable:Boolean(r.iam?.workloadIdentityStore),urls:[n.iam.workloadsUrl],incapableReason:"SCIM Workloads endpoint is enabled by RemoteConfig but no workload identity store capability is wired by the application."}),"iam.customers":Te("iam.customers",o,{capable:Boolean(r.iam?.customerStore),urls:[n.iam.customersUrl],incapableReason:"SCIM Customers endpoint is enabled by RemoteConfig but no customer store capability is wired by the application."}),"workload.incoming":Te("workload.incoming",o,{urls:[n.workload.validateUrl,n.workload.jwksUrl]}),"workload.outgoing":Te("workload.outgoing",o,{}),"workload.claims_authz":Do("workload.claims_authz",o,cm(e.config?.workload),!0),"authz.oaa":Te("authz.oaa",o,{capable:Boolean(r.authz?.accessStore&&(r.authz?.catalogStore||r.authz?.catalog)),incapableReason:"OAA projection is configured by RemoteConfig but the application has not wired an authz access store plus a catalog source (AccessCatalogStore or code-declared authz.catalog)."}),"authz.access_requests":Te("authz.access_requests",o,{capable:im(e.config)||am(e.config),incapableReason:"IdP access-request validation requires either iam.users.assignment='idp' with SSO accessRequests and claimsAsEntitlements, or iam.customers.assignment='idp' with an enabled non-magic-link CIAM provider carrying accessRequests and claimsAsEntitlements."}),"tm.integration":Te("tm.integration",o,{capable:Boolean(r.tm?.onConnectRequest&&r.tm.store.setIntegration&&r.tm.store.getByIntegrationHandleHash),urls:r.tm?[`${Rr(r.tm.basePath)}/integrations/authorize`,`${Rr(r.tm.basePath)}/integrations/redeem`,`${Rr(r.tm.basePath)}/integrations/config-export`]:void 0,incapableReason:"TM integration requires setIntegration/getByIntegrationHandleHash and an App-owned consent hook."})}}}async function dm(e,t,r){if(!t.isReady())return Yo();if(t.config?.capabilitiez!==!0||!r)return me();let n=await mr(e,t,Da["capabilitiez.read"]);if(n)return n;return Response.json(r.build(),{status:200})}async function lm(e){if(!e)return[];let t=[];for await(let r of Xt((n,o)=>e.list({start:n,limit:o})))t.push(r);return t}function Ko(e,t){return[...new Set(e.filter((r)=>r.subjectType===t).map((r)=>typeof r.subject==="string"?r.subject:r.subject.id).filter((r)=>Boolean(r)))]}function Fo(e,t,r){if(!e)return;if(t==="all")return Xt((n,o)=>e.list({start:n,limit:o}));return async function*(){for(let o of r){let s=await e.get(o);if(s)yield s}}()}async function fm(e,t,r){if(!t.isReady())return Yo();if(t.config?.authz?.oaa?.fullSync?.enabled!==!0)return me();let n=await mr(e,t,Da["authz.oaa.sync"]);if(n)return n;let o=t.authz?.oaa;if(!o?.isReady())return Response.json({ok:!1,reason:"OAA is not configured"},{status:503});let s=t.authz?await t.authz.reconcile():void 0,i=r.iam?.userStore,c=r.iam?.customerStore??r.ciam?.customerStore,d=r.workload,u=r.iam?.workloadIdentityStore??(d&&"workloadIdentityStore"in d?d.workloadIdentityStore:d&&("incoming"in d)&&d.incoming&&!Array.isArray(d.incoming)&&("workloadIdentityStore"in d.incoming)?d.incoming.workloadIdentityStore:void 0),l=yp(r.authz?.catalog?Fa(r.authz.catalog):void 0,r.authz?.catalogStore),y=r.authz?.accessStore,p=r.authz?.resources,b=await lm(y),M=await o.sync({users:Fo(i,o.population("user"),Ko(b,"user")),customers:Fo(c,o.population("customer"),Ko(b,"customer")),workloads:Fo(u,o.population("workload"),Ko(b,"workload")),groups:l?Xt((_,R)=>l.groups.list({start:_,limit:R})):void 0,roles:l?Xt((_,R)=>l.roles.list({start:_,limit:R})):void 0,permissions:l?Xt((_,R)=>l.permissions.list({start:_,limit:R})):void 0,resources:p?Xt((_,R)=>p.list({start:_,limit:R})):void 0,access:b},{mode:"snapshot",compression:"gzip",multipart:"auto"});return Response.json({...M,reconcile:s})}function pm(e,t,r,n,o,s){return async(i)=>{let c=new URL(i.url).pathname;if($o(c,r)){if(!Wa(i))return Be(["GET"]);return rm(e)}if($o(c,n)){if(!Wa(i))return Be(["GET"]);return dm(i,e,o)}if(s&&$o(c,s.url)){if(i.method!=="POST")return Be(["POST"]);return fm(i,e,s.frameworkConfig)}let d=e.secrets;if(!Boolean(d?.isLfvDeliveryRequest?.(i)||d?.isLfvEventsRequest?.(i))&&!e.isReady())return Yo();return Ur(e,"handler",()=>t(i))}}function ja(e,t,r){if(e)return r&&!e.tenantId?{...e,tenantId:r}:e;if(t&&r)return{tenantId:r};return}function mm(e,t){if(t.authz===null)return;if(!e.authz&&!t.authz)return;return{...e.authz,...t.authz,oaa:e.authz?.oaa||t.authz?.oaa?{...e.authz?.oaa,...t.authz?.oaa}:void 0}}function Vo(e){let t=!1,r=ye(`${e} module`,()=>t);return{isReady:r.isReady,ready:r.ready,attach(n){if(t=n!==void 0,r.refresh(),!n)return;return Object.defineProperty(n,"isReady",{value:r.isReady,enumerable:!1,configurable:!0}),Object.defineProperty(n,"ready",{value:r.ready,enumerable:!1,configurable:!0}),n}}}function Go(e){if(!e)return!1;return e.isReady?e.isReady():!1}function At(e,t,r,n){if(!e)return{active:!1,ready:!1,reason:r};return Go(t)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:n}}function gm(){let e=()=>({active:!1,ready:!1,reason:"not configured"});return{sso:e(),ciam:e(),iam:e(),workload:e(),otel:e(),secrets:e(),kms:e(),authz:e(),tm:e()}}function Ha(e,t,r){let n=e.isReady(),o=e.config;if(!n||!o)return{ok:!1,applied:n,modules:gm(),config:{...t}};let s=An(r),i=Boolean(o.workload)||Boolean(e.workload),c={sso:At(Boolean(o.sso),e.sso,"sso not configured (no RemoteConfig.sso)",s.sso??"sso configured but not ready"),ciam:At(Boolean(o.ciam),e.ciam,"ciam not configured (no RemoteConfig.ciam)",s.ciam??"ciam configured but not ready"),iam:At(Boolean(o.iam),e.iam,"iam not configured (no RemoteConfig.iam)","iam configured but not ready"),workload:At(i,e.workload,"workload not configured (no RemoteConfig.workload or code workload)","workload configured but not ready"),otel:At(Boolean(o.otel),e.otel,"otel not configured (no RemoteConfig.otel)","otel configured but not ready"),secrets:(()=>{if(!Boolean(o.secrets))return{active:!1,ready:!1,reason:"secrets not configured (no RemoteConfig.secrets)"};if(!Go(e.secrets))return{active:!0,ready:!1,reason:"secrets configured but not ready"};return e.secrets.isAvailable?.()??!0?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"secrets degraded: one or more sources are unavailable"}})(),kms:At(Boolean(o.kms),e.kms,"kms not configured (no RemoteConfig.kms)","kms configured but one or more pools have no usable active key"),authz:(()=>{if(!Boolean(o.authz?.oaa))return{active:!0,ready:!0};let l=e.authz?.oaa;return Go(l)?{active:!0,ready:!0}:{active:!0,ready:!1,reason:"authz OAA configured but not ready"}})(),tm:At(o.tm?.enabled===!0&&Boolean(r.tm),e.tm,o.tm?.enabled===!0?"tm configured by RemoteConfig but FrameworkConfig.tm is not wired (this instance does not serve tenant management)":"tm not configured (no RemoteConfig.tm)","tm configured but not ready")};return{ok:Object.values(c).every((u)=>!u.active||u.ready),applied:n,modules:c,config:{...t}}}function ym(e,t){let r=[];for(let n of t){let o=e.modules[n];if(!e.applied){r.push({name:n,reason:"RemoteConfig has not been applied yet"});continue}if(!o?.ready)r.push({name:n,reason:o?.reason??`${n} is not ready`})}return{ok:r.length===0,notReady:r}}function hm(e,t,r,n,o,s,i,c,d,u){let l=t.validators,y=vp(e.cache);wp(y.jwks);let p=t;if(y.session.read.enabled){let se=t.sso?.sessionStore??t.ciam?.sessionStore;if(se){let K=So(se,y.session.read);p={...t,sso:t.sso?{...t.sso,sessionStore:K}:t.sso,ciam:t.ciam?{...t.ciam,sessionStore:K}:t.ciam}}}let b={sessionCache:y.session},M=it(l.workload,r,e?.workload,t.workload??void 0,void 0,u),_=t.otel!==null?io(r,e?.otel,t.otel??void 0,o):void 0,R=An(p);if(Object.keys(e).length>0){if(R.sso)r.error(R.sso);if(R.ciam)r.error(R.ciam)}let W=ja(e?.sso,t.sso,e.id),q=R.sso?void 0:kp(l.sso,r,W,p.sso??void 0,{...b,catalogView:u}),a={...e?.iam,...t.iam},w=t.authz?.catalog?Fa(t.authz.catalog):void 0,v=t.workload,L=v&&"workloadIdentityStore"in v?v.workloadIdentityStore:v&&("incoming"in v)&&v.incoming&&!Array.isArray(v.incoming)&&("workloadIdentityStore"in v.incoming)?v.incoming.workloadIdentityStore:void 0,H=Boolean(a.url||e.sso?.accessRequests||Object.values(e.ciam?.providers??{}).some((se)=>se.accessRequests)||a.userStore||t.authz?.catalogStore||w);i.update({...a.url?{iam:{url:a.url,...a.deltaAudience?{audience:a.deltaAudience}:{}}}:{},...e.sso?.accessRequests?{sso:e.sso.accessRequests}:{},ciam:Object.fromEntries(Object.entries(e.ciam?.providers??{}).flatMap(([se,K])=>K.enabled!==!1&&K.accessRequests?[[se,K.accessRequests]]:[]))},{workload:M});let J=c.update({users:e?.iam?.users?.delta,workloads:e?.iam?.workloads?.delta,customers:e?.iam?.customers?.delta,url:a.url,audience:a.deltaAudience},{workload:M,workloadIdentityStore:L,userStore:a.userStore,customerStore:a.customerStore??p.ciam?.customerStore,accessStore:t.authz?.accessStore,catalogStore:t.authz?.catalogStore,codeCatalog:w,mapUserToScim:a.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:a.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:a.inboundWorkloads?.mapBaseWorkloadToScim}),Y;if(H&&!M){if(Object.keys(e).length>0)r.error("IAM SCIM push/pull requires workload identity; IAM routes are disabled until workload is configured.");Y=void 0}else Y=Sp(l.iam,r,M,s,t.authz?.accessStore,t.authz?.accessIndex,t.authz?.catalogStore,w,t.authz?.resources,e?.iam,t.iam??void 0,J,t.authz?.onAccessMutation,t.authz?.onInboundEntitlement,mp(e.authz),d);let re=ja(e?.ciam,t.ciam,e.id),ue=R.ciam?void 0:hp(l.ciam,r,re,p.ciam??void 0,M,{...b,catalogView:u});return{secret:n,workload:M,otel:_,sso:q,iam:Y,ciam:ue}}var Na=new WeakMap;function wm(e){let t=Na.get(e);if(!t)t=()=>({ionId:e.id,log:e.log}),Na.set(e,t);return t}function Ja(e,t,r,n,o,s,i,c){let d=s.authz.update(mm(t,r));e.id=t.id,e.config=t;let u=wm(e),l=(_)=>_?ar(_,u):_;e.secrets=l(s.secrets.update(t.secrets,r.secrets??void 0,r.validators.secrets,r.lfv?.callbackTransport,r.lfv?.singleProcess)),e.kms=l(s.kms.update(t.kms,(_)=>{if(!_.source)return o;if(!e.secrets)throw Error(`KMS pool references unavailable secrets source "${_.source}".`);return e.secrets.getSecretsSource(_.source)}));let y=hm(t,r,n,o,s.kms.handle(),d,s.accessRequests,s.iamDelta,s.authz.settle,()=>s.authz.catalogView());e.secret=y.secret,e.workload=l(s.workload.update(y.workload)),e.otel=l(s.otel.update(y.otel)),e.authz=l(d),e.log=s.log.update(e.otel?.logger??n),e.sso=l(s.sso.attach(y.sso)),e.iam=l(s.iam.attach(y.iam)),e.ciam=l(s.ciam.attach(y.ciam)),e.tm=l(s.tm.update(t.tm?.enabled===!0&&r.tm?Qi(e,t.tm,r.tm):void 0,r.tm!==void 0&&r.tm!==null));let p=Fe(i),b=(_)=>()=>Ha(e,e.configStatus,r).modules[_];Ve(e.sso,b("sso"),p.sso),Ve(e.ciam,b("ciam"),p.ciam),Ve(e.iam,b("iam"),p.iam,()=>({accessRequests:s.accessRequests.handle().describe()})),Ve(e.workload,b("workload"),p.workload),Ve(e.secrets,b("secrets")),Ve(e.kms,b("kms")),Ve(e.otel,b("otel")),Ve(e.authz,b("authz")),Ve(e.tm,b("tm"));let M=(_)=>ao(_,e,c?.routing,p);e.handler=pm(e,M,p.readyzUrl,p.capabilitiezUrl,{build:()=>um(e,i,r)},{url:ls(i),frameworkConfig:r})}function Sm(e,t,r,n,o,s,i,c,d){Wp(e.id,t),jp(t),Np(t),$p(t),Dp(t),Kp(t),Vp(t),zp(t,r,n),Hp(t,r),Qp(t,r,n,c),Ja(e,t,r,n,o,s,i,d)}function $a(e){if(!e.secret)throw Error("ConfigSource must expose a default secret client on source.secret.");return e.secret}async function vm(e,t,r,n,o,s,i){let c=e,d=fs(e,t,o.current,s);if(n.beforeChange){let u=Va(d,o);i?.enter();let l;try{l=await n.beforeChange(e,u,r)}finally{i?.exit()}if(l?.config!==void 0)c=l.config;d=l?.frameworkConfig??u}return d=Qt(d,o.current),{effectiveRemoteConfig:c,effectiveFrameworkConfig:d}}function Lw(e,t){let r=Rp(t),{frameworkConfig:n,basePath:o,readyTimeoutMs:s,stores:i,options:c}=r,d=Gp(n,e),u=new Set(d.keys()),l=Qt(Bp(n,e),i),y=l.log||No,p={current:i},b={remoteConfig:void 0,remoteConfigHash:void 0,frameworkConfig:l},M=os(y),_=Zn(y),R,W={log:Tp(y),secrets:zi(y,d),kms:mi(y),workload:la(y),otel:Si(y),authz:js(y,()=>_.handle(),()=>M.handle(),()=>R?.iam,()=>({mapUserToScim:b.frameworkConfig.iam?.inboundUsers?.mapBaseUserToScim,mapCustomerToScim:b.frameworkConfig.iam?.inboundCustomers?.mapBaseCustomerToScim,mapWorkloadToScim:b.frameworkConfig.iam?.inboundWorkloads?.mapBaseWorkloadToScim})),accessRequests:M,iamDelta:_,sso:Vo("sso"),iam:Vo("iam"),ciam:Vo("ciam"),tm:Hi()},q={},a,w,v=new Promise((E,F)=>{a=E,w=F}),L=!1,H,J,Y=0,re={enter:()=>{Y+=1},exit:()=>{Y-=1}},ue=Promise.resolve();function se(E){let F=ue.then(E,E);return ue=F.then(()=>{return},()=>{return}),F}function K(E){if(L)throw Error(`Ionite instance has been closed and cannot call ${E}().`)}function ee(){e.log=b.frameworkConfig.log??No,e.validators=b.frameworkConfig.validators}let z={},D={log:y,id:void 0,config:void 0,secret:$a(e),authz:void 0,configStatus:q,handler:async()=>me(),ready:(E)=>{if(Y>0&&b.remoteConfig===void 0)return Promise.reject(Error("ion.ready() was awaited inside beforeChange during the initial config apply, which would deadlock because config has not been applied yet. Do not await ion.ready() or es.<module>.ready() inside beforeChange."));return em(v,E??s)},isReady:()=>b.remoteConfig!==void 0,readiness:()=>Ha(D,q,b.frameworkConfig),requireReady:(E)=>ym(D.readiness(),E),describe:()=>{let E=D.readiness(),F={sso:ze(D.sso,E.modules.sso),ciam:ze(D.ciam,E.modules.ciam),iam:ze(D.iam,E.modules.iam),workload:ze(D.workload,E.modules.workload),otel:ze(D.otel,E.modules.otel),secrets:ze(D.secrets,E.modules.secrets),kms:ze(D.kms,E.modules.kms),authz:ze(D.authz,E.modules.authz),tm:ze(D.tm,E.modules.tm)};return Se({id:D.id,sdk:{version:dn,catalogVersion:Jr},basePath:o,urls:Fe(o),ok:E.ok,applied:E.applied,config:{...q},modules:Object.fromEntries(Object.entries(E.modules).map(([S,O])=>[S,{...O,description:F[S]}]))})},close:()=>{if(L)return;if(L=!0,J)clearTimeout(J),J=void 0;H?.(),H=void 0;let E=[()=>W.secrets.close(),()=>W.kms.close(),()=>W.authz.close(),()=>W.otel.shutdown()];for(let F of E)try{Promise.resolve(F()).catch((S)=>{y.warn("Ionite close: module teardown failed",S)})}catch(S){y.warn("Ionite close: module teardown failed",S)}a?.(),a=void 0,w=void 0},setStores:async(E)=>{K("setStores");let F=Lr(E);await se(()=>C(F))}};R=D,Ja(D,z,b.frameworkConfig,y,D.secret,W,o,c),ee();let Q=()=>pp(e.origin);function ne(){let E=q.lastError!==void 0;if(q.appliedAt=Date.now(),q.lastError=void 0,E)(D.log??y).info("RemoteConfig application recovered; latest config applied successfully.",{"ion.operation":"config.apply","ion.outcome":"success",...Q()})}function ie(E,F){let S=zo(F)??(F instanceof Error?F.message:String(F)),O=Ap(F),k=q.lastError===void 0;if(q.lastError={kind:O,message:S,at:Date.now(),phase:E},k)(D.log??y).error(E==="update"?"RemoteConfig update rejected; keeping last-known-good config.":"Initial RemoteConfig application failed; instance will not become ready.",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":O,phase:E,error:S,...Q()})}function ce(E,F,S){(D.log??y).info("RemoteConfig applied.",{"ion.operation":"config.apply","ion.outcome":"success",phase:E,"ion.config.hash":F,"ion.config.apply_ms":S,...Q()})}async function ae(E,F){if(L)return;let S=Ua(E);if(F&&b.remoteConfig!==void 0&&S===b.remoteConfigHash&&qa(E,b.remoteConfig))return;let O=b.remoteConfig,k=O===void 0?"initial":"update",m=Date.now(),f,T,A;try{let V=await vm(E,b.frameworkConfig,b.remoteConfig,c,p,o,re);if(f=V.effectiveRemoteConfig,T=Ua(f),A=V.effectiveFrameworkConfig,F&&c.beforeChange===void 0&&b.remoteConfig!==void 0&&T===b.remoteConfigHash&&qa(f,b.remoteConfig)&&A===b.frameworkConfig)return;let oe=A.log||No;Sm(D,f,A,oe,$a(e),W,o,u,c)}catch(V){throw ie(k,V),V}b.remoteConfig=f,b.remoteConfigHash=T,b.frameworkConfig=A,ee(),ne(),await W.otel.settled();let N=Va(b.frameworkConfig,p),Z=!1;try{c.afterChange?.(D,f,N,O)}catch(V){if((D.log??y).error("RemoteConfig afterChange hook failed.",{"ion.operation":"config.afterChange","ion.outcome":"failure",phase:k,error:V instanceof Error?V.message:String(V)}),k==="initial"){Z=!0;let oe=V instanceof Error?V:Error(`afterChange failed on initial load: ${String(V)}`);ie("initial",oe),w?.(oe),w=void 0,a=void 0}}if(b.frameworkConfig=N,ee(),!Z)ce(k,T,Date.now()-m);if(!Z&&a)a(),a=void 0}async function C(E){if(L)return;if(p.current=E,b.remoteConfig===void 0){b.frameworkConfig=Qt(b.frameworkConfig,E),ee();return}await ae(b.remoteConfig,!1)}if(e.subscribe)e.subscribe((E)=>{se(()=>ae(E,!0)).catch(()=>{})},{mode:"wait"}).then((E)=>{if(L){E?.();return}H=E}).catch((E)=>{y.warn("ConfigSource subscription failed",{"ion.operation":"config.subscribe","ion.outcome":"degraded",error:E instanceof Error?E.message:String(E)})});let g=xp(c.configRetry),P=[c.onConfigLoadError??Mp(y)],I=0;function U(){if(J=void 0,L)return;if(b.remoteConfig!==void 0)return;tm(e.load(),g.loadTimeoutMs,`ConfigSource initial load timed out after ${g.loadTimeoutMs}ms`).then(async(E)=>{I=0;try{await se(async()=>{if(b.remoteConfig!==void 0)return;await ae(E,!0)})}catch(F){let S=F instanceof Error?F:Error(`Initial RemoteConfig application failed: ${String(F)}`);y.error("Initial RemoteConfig application failed; rejecting ready()",{"ion.operation":"config.apply","ion.outcome":"failure","ion.config.error_kind":"validation",error:S.message,...Q()}),w?.(S),w=void 0}},async(E)=>{if(L)return;I+=1;let F=Up(I,g),S=zo(E)??"RemoteConfig load failed",O=Ep(E),k=_t(E,"code"),m=Jo(E),f=_t(E,"path"),T=_t(E,"sourceType"),A=e.origin,N={attempt:I,error:E,errorKind:O,maxDelayMs:g.maxDelayMs,message:S,nextDelayMs:F,code:typeof k==="string"?k:void 0,status:typeof m==="number"?m:void 0,path:typeof f==="string"?f:A?.path,sourceType:typeof T==="string"?T:A?.type};if(!Lp(E,O)){let Z=E instanceof Error?E:Error(`ConfigSource initial load failed with unrecoverable ${O}: ${S}`);y.error("ConfigSource initial load failed with unrecoverable error",{"ion.operation":"config.load","ion.outcome":"failure",errorKind:O,error:S,code:N.code,upstreamStatus:N.status,path:N.path,sourceType:N.sourceType,...Q()}),w?.(Z),w=void 0;return}try{await qp(N,P)}catch(Z){let V=Z instanceof Error?Z:Error("ConfigSource retry hook stopped RemoteConfig retrying");w?.(V),w=void 0;return}J=setTimeout(U,F)})}return U(),D}export{qw as AssignmentPolicyError,Bw as CatalogAdjacencyCache,wr as DEFAULT_REQUEST_TOKEN_TTL_SECONDS,Bu as ION_CAPABILITY_CATALOG,Jr as ION_CAPABILITY_CATALOG_VERSION,bp as ION_READY_DEFAULT_TIMEOUT_MS,dn as ION_SDK_VERSION,$e as InMemoryAccessAssignmentStore,Cr as InMemoryAccessCatalogStore,Pr as InMemoryAccessIndex,Or as InMemoryCustomerStore,Er as InMemoryMagicLinkStore,Ir as InMemoryResourceStore,Ar as InMemorySessionStore,pS as InMemoryTenantStore,_r as InMemoryUserStore,xa as InMemoryWorkloadIdentityStore,yt as InMemoryWorkloadTokenStore,jw as IoniteError,Gr as ScimOutboundClient,OS as TENANT_OWNER_PERMISSION,rn as VAULT_MIN_POLLING_TTL_MS,kr as VaultConfigInvalidPayloadError,Ot as VaultConfigWaitingForSecretError,je as VaultSubscribeNotSupportedError,Dw as allowHosts,Kw as allowOrigins,Fw as allowRelativePaths,Vw as allowSameOrigin,Lo as awsConfig,gn as azureConfig,zw as blockDangerousUrls,Gw as callback,Hw as captureRedirect,Jw as ciam,qi as closeAllVaultSockets,Yw as collectReferencedDefinitions,qo as configFromSource,wn as configLocatorFromEnvValues,Sa as configSourceFromEnvValues,at as configSourceFromLocator,Zn as createManagedIamDelta,ye as createReadinessLatch,So as createSessionReadCache,dp as createTenantIonHandler,ap as createTenantIonResolver,Xw as defaultRedirectPolicies,Fe as deriveIonUrls,bc as devInMemoryStores,Zw as discoverSessionRecords,Qw as discoverSessions,mr as enforceEndpointAuthz,Wf as envConfig,Yn as escapeScimFilterValue,eS as expandRoot,xo as gcpConfig,Ww as generateULID,tS as getCustomer,rS as getOwnedTenantIds,Hf as getSessionEntries,nS as getUser,af as getWorkload,cf as getWorkloadToken,oS as has,sS as hasAll,iS as hasAllScope,aS as hasAny,cS as hasAnyScope,uS as hasGroup,dS as hasPermission,lS as hasRole,fS as hasScope,It as hashIntegrationHandle,mS as iam,Rc as inMemoryAuthzDomains,On as inMemoryAuthzStores,gS as initiateLogin,Lw as ionite,yS as isRedirectAllowed,Ll as isRequestTokenExpired,If as isVaultConfigInvalidPayloadError,Cf as isVaultConfigWaitingForSecretError,kt as lfvVault,Nw as listGenerator,hS as listSsoClientIdsFromCookies,Zf as materializeTenantOwnerEntitlement,Be as methodNotAllowedResponse,Uo as mirrorSecrets,vr as mirroredConfig,me as notFoundResponse,vo as planActionRequired,wS as planDiscoveredTenantCookies,Qf as purgeTenantEntitlements,SS as reconcileSubjectAccess,vS as resolveAfterRedirect,kS as resolveCapturedRedirect,ki as resolveDefaultRoute,bS as resolveRedirect,_a as resolveTenantFromRequest,RS as resolveTenantOwner,TS as resolveTenantSession,df as revokeWorkloadToken,cp as rewriteRequestForDefaultTenantApi,up as rewriteRequestForDefaultTenantUi,jo as rewriteRequestForTenantPath,La as rewriteRequestPath,ao as routeRequest,CS as sameOriginRedirectRules,$f as secretConfigSource,IS as sendTenantWebhook,Ii as setVaultWebSocketCommandTimeout,PS as sso,st as subscribeSecretPathWithHttpPolling,ES as tenantAccessLoginUrl,tp as tenantMirror,AS as tenantOwnerEntitlementId,_S as tenantOwnerPermission,LS as tenantResourceId,uf as validateWorkloadToken,Bt as vault,yn as vaultConfig,Mi as vaultSocketDiagnostics,xS as verifyUser,US as withSetCookies,it as workload,lf as workloadHandler};
|