corsair 0.1.107 → 0.1.109

package/dist/{browser-delivery-ARqe7lph.d.ts → browser-delivery-B7lsTRG3.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-CdzrawUJ.js';
+import { B as BrowserDeliveryPayload } from './index-DnJqGDij.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/chunk-WDF3YE27.js

@@ -0,0 +1 @@
+import{b as D,c as P,d as B,e as R}from"./chunk-IGGCNGU2.js";var L=Symbol.for("corsair:internal"),x=class extends Error{constructor(t="Invalid corsair instance"){super(t),this.name="InvalidCorsairInstanceError"}};function _(e){return typeof e=="object"&&e!==null}function S(e){if(!_(e)||!Array.isArray(e.plugins)||typeof e.kek!="string"||typeof e.multiTenancy!="boolean")return!1;if(e.database===void 0)return!0;if(!_(e.database))return!1;let t=e.database.db;return typeof t=="object"&&t!==null&&typeof t.selectFrom=="function"}function O(e){if(!e||typeof e!="object")return;let r=Object.getOwnPropertyDescriptor(e,L)?.value;return S(r)?r:void 0}function J(e,t){let r=O(e);if(!r)throw t?.()??new x;return r}function v(e,t){return e.plugins.find(r=>r.id===t)}function H(e,t,r){let n=v(e,t);if(!n)throw r(`Plugin '${t}' not found`);return n}function G(e){return"withTenant"in e&&typeof e.withTenant=="function"}function X(e,t){if(!e||typeof e!="object")return;let r=e[t];return typeof r=="function"?(...n)=>Reflect.apply(r,e,n):void 0}var F={oauth_2:{integration:["client_id","client_secret","redirect_url"],account:["access_token","refresh_token","expires_at","scope","webhook_signature"]},api_key:{integration:[],account:["api_key","webhook_signature"]},bot_token:{integration:[],account:["bot_token","webhook_signature"]},managed:{integration:[],account:["access_token","refresh_token","expires_at","scope","webhook_signature"]}};function N(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function Y(e){let t=e.options?.authType;return N(t)?t:void 0}function q(e,t){let r=e.authConfig,n=F[t].account,i=r?.[t]?.account??[];return[...n,...i]}function xe(e,t){let r=e.authConfig,n=F[t].integration,i=r?.[t]?.integration??[];return[...n,...i]}import{v7 as V}from"uuid";function T(){return V()}import{z as C}from"zod";import{sql as w}from"kysely";function k(e){return e.replace(/'/g,"''")}function W(e){let t=k(e);return w`data->>'${w.raw(t)}'`}function j(e){let t=k(e);return w`(data->>'${w.raw(t)}')::numeric`}function K(e){let t=k(e);return w`(data->>'${w.raw(t)}')::boolean`}function U(e){let t=k(e);return w`(data->>'${w.raw(t)}')::timestamptz`}function ee(e){if(typeof e=="string")try{return JSON.parse(e)}catch{return e}return e}function Z(e){let t=e;for(;t;){if(t instanceof C.ZodOptional||t instanceof C.ZodNullable){t=t._def.innerType;continue}if(t instanceof C.ZodDefault){t=t._def.innerType;continue}break}return t}function te(e){let t=Z(e);if(t instanceof C.ZodString)return"string";if(t instanceof C.ZodNumber)return"number";if(t instanceof C.ZodBoolean)return"boolean";if(t instanceof C.ZodDate)return"date"}function ne(e){let t=Z(e);if(!(t instanceof C.ZodObject))return{};let r=t.shape,n={};for(let[i,a]of Object.entries(r)){let u=te(a);u&&(n[i]=u)}return n}function re(e,t,r){if(typeof r=="string")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;"equals"in n&&typeof n.equals=="string"&&(e=e.where(t,"=",n.equals)),"contains"in n&&typeof n.contains=="string"&&(e=e.where(t,"like",`%${n.contains}%`)),"startsWith"in n&&typeof n.startsWith=="string"&&(e=e.where(t,"like",`${n.startsWith}%`)),"endsWith"in n&&typeof n.endsWith=="string"&&(e=e.where(t,"like",`%${n.endsWith}`)),"in"in n&&Array.isArray(n.in)&&(e=e.where(t,"in",n.in))}return e}function ie(e,t,r){if(typeof r=="number")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;typeof n.equals=="number"&&(e=e.where(t,"=",n.equals)),typeof n.gt=="number"&&(e=e.where(t,">",n.gt)),typeof n.gte=="number"&&(e=e.where(t,">=",n.gte)),typeof n.lt=="number"&&(e=e.where(t,"<",n.lt)),typeof n.lte=="number"&&(e=e.where(t,"<=",n.lte)),Array.isArray(n.in)&&(e=e.where(t,"in",n.in))}return e}function oe(e,t,r){if(typeof r=="boolean")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;typeof n.equals=="boolean"&&(e=e.where(t,"=",n.equals))}return e}function se(e,t,r){if(r instanceof Date)return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;if(n.equals instanceof Date&&(e=e.where(t,"=",n.equals)),n.before instanceof Date&&(e=e.where(t,"<",n.before)),n.after instanceof Date&&(e=e.where(t,">",n.after)),Array.isArray(n.between)&&n.between.length===2){let[i,a]=n.between;i instanceof Date&&(e=e.where(t,">=",i)),a instanceof Date&&(e=e.where(t,"<=",a))}}return e}function ae(e,t,r,n){return r==="number"?ie(e,j(t),n):r==="boolean"?oe(e,K(t),n):r==="date"?se(e,U(t),n):re(e,W(t),n)}function ue(e,t,r){if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;return"equals"in n&&(e=e.where(t,"=",n.equals)),"contains"in n&&typeof n.contains=="string"&&(e=e.where(t,"like",`%${n.contains}%`)),"startsWith"in n&&typeof n.startsWith=="string"&&(e=e.where(t,"like",`${n.startsWith}%`)),"endsWith"in n&&typeof n.endsWith=="string"&&(e=e.where(t,"like",`%${n.endsWith}`)),"in"in n&&Array.isArray(n.in)&&(e=e.where(t,"in",n.in)),e}return e.where(t,"=",r)}function ce(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):Number.parseInt(String(e??0),10)}function h(e,t,r){return e.selectFrom("corsair_entities").selectAll().where("account_id","=",t).where("entity_type","=",r)}function $(e,t,r,n,i){let a=ne(i);function u(o){let l=ee(o.data);return{...o,data:i.parse(l)}}return{findByEntityId:async o=>{let l=await t(),c=await h(e,l,r).where("entity_id","=",o).executeTakeFirst();return c?u(c):null},existsByEntityId:async o=>{let l=await t();return await h(e,l,r).select("id").where("entity_id","=",o).executeTakeFirst()!==void 0},findIdByEntityId:async o=>{let l=await t();return(await h(e,l,r).select("id").where("entity_id","=",o).executeTakeFirst())?.id??null},findById:async o=>{let l=await t(),c=await h(e,l,r).where("id","=",o).executeTakeFirst();return c?u(c):null},findManyByEntityIds:async o=>{if(o.length===0)return[];let l=await t();return(await h(e,l,r).where("entity_id","in",o).execute()).map(u)},list:async o=>{let l=await t(),c=h(e,l,r);return typeof o?.limit=="number"&&(c=c.limit(o.limit)),typeof o?.offset=="number"&&(c=c.offset(o.offset)),(await c.execute()).map(u)},search:async o=>{let l=await t(),c=h(e,l,r),d=new Set(["data","limit","offset"]);for(let[y,f]of Object.entries(o))d.has(y)||f===void 0||(c=ue(c,y,f));if(o.data&&typeof o.data=="object")for(let[y,f]of Object.entries(o.data)){if(f===void 0)continue;let g=a[y]??"string";c=ae(c,y,g,f)}return typeof o.limit=="number"&&(c=c.limit(o.limit)),typeof o.offset=="number"&&(c=c.offset(o.offset)),(await c.execute()).map(u)},upsertByEntityId:async(o,l)=>{let c=await t(),d=i.parse(l),s=new Date,y=await h(e,c,r).select("id").where("entity_id","=",o).executeTakeFirst();if(y?.id){await e.updateTable("corsair_entities").set({version:n,data:d,updated_at:s}).where("id","=",y.id).execute();let I=await e.selectFrom("corsair_entities").selectAll().where("id","=",y.id).executeTakeFirst();return u(I)}let f=T();await e.insertInto("corsair_entities").values({id:f,created_at:s,updated_at:s,account_id:c,entity_id:o,entity_type:r,version:n,data:d}).execute();let g=await e.selectFrom("corsair_entities").selectAll().where("id","=",f).executeTakeFirst();return u(g)},deleteById:async o=>{let l=await t(),c=await e.deleteFrom("corsair_entities").where("account_id","=",l).where("entity_type","=",r).where("id","=",o).executeTakeFirst();return Number(c.numDeletedRows)>0},deleteByEntityId:async o=>{let l=await t(),c=await e.deleteFrom("corsair_entities").where("account_id","=",l).where("entity_type","=",r).where("entity_id","=",o).executeTakeFirst();return Number(c.numDeletedRows)>0},count:async()=>{let o=await t(),l=await e.selectFrom("corsair_entities").select(c=>c.fn.countAll().as("count")).where("account_id","=",o).where("entity_type","=",r).executeTakeFirst();return ce(l?.count)}}}var de={corsair_integrations:D,corsair_accounts:P,corsair_entities:B,corsair_events:R};function le(e){return de[e]}function M(e){if(typeof e=="string")try{return JSON.parse(e)}catch{return e}return e}function p(e){if(!e)throw new Error("Corsair database is not configured. Pass `database` to createCorsair(...) to enable ORM.")}function b(e){if(!e)return[];let t=[];for(let r in e){let n=r,i=e[n];if(i!==void 0)if(typeof i=="object"&&i!==null&&!Array.isArray(i)&&!(i instanceof Date)){let a=i;"in"in a&&Array.isArray(a.in)?t.push({field:n,operator:"in",value:a.in}):"like"in a&&typeof a.like=="string"&&t.push({field:n,operator:"like",value:a.like})}else t.push({field:n,value:i})}return t}function m(e,t){if(!t?.length)return e;let r=e;for(let n of t){let i=n.operator??"=";r=r.where(n.field,i,n.value)}return r}function ye(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):Number.parseInt(String(e??0),10)}function A(e,t){let r=le(t),n=()=>(p(e),e),i=()=>n().db.selectFrom(t),a=()=>n().db.insertInto(t),u=()=>n().db.updateTable(t),o=()=>n().db.deleteFrom(t);function l(d){let s={};for(let[y,f]of Object.entries(d))s[y]=M(f);return r.parse(s)}function c(d){let s={};for(let[y,f]of Object.entries(d))s[y]=M(f);return r.parse(s)}return{findById:async d=>{p(e);let s=i().selectAll();s=m(s,[{field:"id",value:d}]);let y=await s.executeTakeFirst();return y?l(y):null},findOne:async d=>{p(e);let s=i().selectAll();s=m(s,b(d));let y=await s.executeTakeFirst();return y?l(y):null},findMany:async d=>{p(e);let s=i().selectAll();return s=m(s,b(d?.where)),typeof d?.limit=="number"&&(s=s.limit(d.limit)),typeof d?.offset=="number"&&(s=s.offset(d.offset)),(await s.execute()).map(f=>l(f))},create:async d=>{p(e);let s=new Date,y={id:d.id??T(),created_at:s,updated_at:s,...d},f=await a().values(y).returningAll().executeTakeFirst();return f?l(f):c(y)},update:async(d,s)=>{p(e);let y={...s,updated_at:new Date},f=u().set(y).returningAll();f=m(f,[{field:"id",value:d}]);let g=await f.executeTakeFirst();return g?l(g):null},updateMany:async(d,s)=>{p(e);let y={...s,updated_at:new Date},f=i().select("id");f=m(f,b(d));let g=await f.execute();for(let I of g){let E=u().set(y);E=m(E,[{field:"id",value:I.id}]),await E.execute()}return g.length},delete:async d=>{p(e);let s=o();s=m(s,[{field:"id",value:d}]);let y=await s.executeTakeFirst();return Number(y?.numDeletedRows??0)>0},deleteMany:async d=>{p(e);let s=o();s=m(s,b(d));let y=await s.executeTakeFirst();return Number(y?.numDeletedRows??0)},count:async d=>{p(e);let s=i().select(f=>f.fn.countAll().as("count"));s=m(s,b(d));let y=await s.executeTakeFirst();return ye(y?.count)}}}function fe(e){let t=A(e,"corsair_integrations");return{...t,findByName:r=>t.findOne({name:r}),upsertByName:async(r,n)=>{let i=await t.findOne({name:r});return i?await t.update(i.id,n):t.create({...n,name:r})}}}function pe(e){let t=A(e,"corsair_accounts");return{...t,findByTenantAndIntegration:async(r,n)=>{p(e);let i=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();return i?t.findOne({tenant_id:r,integration_id:i.id}):null},listByTenant:(r,n)=>t.findMany({where:{tenant_id:r},limit:n?.limit,offset:n?.offset}),upsertByTenantAndIntegration:async(r,n,i)=>{let a=await t.findOne({tenant_id:r,integration_id:n});return a?await t.update(a.id,i):t.create({...i,tenant_id:r,integration_id:n})}}}function ge(e){let t=A(e,"corsair_entities");return{...t,findByEntityId:({accountId:r,entityType:n,entityId:i})=>t.findOne({account_id:r,entity_type:n,entity_id:i}),findManyByEntityIds:async({accountId:r,entityType:n,entityIds:i})=>i.length===0?[]:(p(e),await e.db.selectFrom("corsair_entities").selectAll().where("account_id","=",r).where("entity_type","=",n).where("entity_id","in",i).execute()),listByScope:({accountId:r,entityType:n,limit:i,offset:a})=>t.findMany({where:{account_id:r,entity_type:n},limit:i,offset:a}),searchByEntityId:async({accountId:r,entityType:n,query:i,limit:a,offset:u})=>{p(e);let o=e.db.selectFrom("corsair_entities").selectAll().where("account_id","=",r).where("entity_type","=",n).where("entity_id","like",`%${i}%`);return typeof a=="number"&&(o=o.limit(a)),typeof u=="number"&&(o=o.offset(u)),await o.execute()},upsertByEntityId:async({accountId:r,entityType:n,entityId:i,version:a,data:u})=>{let o=await t.findOne({account_id:r,entity_type:n,entity_id:i});return o?await t.update(o.id,{version:a,data:u}):t.create({account_id:r,entity_type:n,entity_id:i,version:a,data:u})},deleteByEntityId:async({accountId:r,entityType:n,entityId:i})=>{p(e);let a=await e.db.deleteFrom("corsair_entities").where("account_id","=",r).where("entity_type","=",n).where("entity_id","=",i).executeTakeFirst();return Number(a.numDeletedRows)>0}}}function me(e){let t=A(e,"corsair_events");return{...t,listByAccount:(r,n)=>t.findMany({where:{account_id:r},limit:n?.limit,offset:n?.offset}),listByStatus:(r,n)=>{let i={status:r};return n?.accountId&&(i.account_id=n.accountId),t.findMany({where:i,limit:n?.limit,offset:n?.offset})},listPending:r=>{let n={status:"pending"};return r?.accountId&&(n.account_id=r.accountId),t.findMany({where:n,limit:r?.limit??100})},updateStatus:(r,n)=>t.update(r,{status:n})}}function Q(e){return{integrations:fe(e),accounts:pe(e),entities:ge(e),events:me(e)}}function we(e,t,r,n,i){let a=null;async function u(){if(a!==null)return a;p(e);let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",t.integrationName).executeTakeFirst();if(!o)throw new Error(`Integration "${t.integrationName}" not found. Make sure to create the integration first.`);let l=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t.tenantId).where("integration_id","=",o.id).executeTakeFirst();if(!l)throw new Error(`Account not found for tenant "${t.tenantId}" and integration "${t.integrationName}". Make sure to create the account first.`);return a=l.id,a}return p(e),$(e.db,u,r,n,i)}function z(e){let{database:t,integrationName:r,schema:n,tenantId:i}=e,a=Q(t),u={tenantId:i,integrationName:r},o=null;async function l(){if(o!==null)return o;p(t);let d=await t.db.selectFrom("corsair_integrations").selectAll().where("name","=",r).executeTakeFirst();if(!d)throw new Error(`Integration "${r}" not found. Make sure to create the integration first.`);let s=await t.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",i).where("integration_id","=",d.id).executeTakeFirst();if(!s)throw new Error(`Account not found for tenant "${i}" and integration "${r}". Make sure to create the account first.`);return o=s.id,o}let c={};for(let[d,s]of Object.entries(n.entities))c[d]=we(t,u,d,n.version,s);return{...c,$orm:a,$integrationName:r,$tenantId:i,$getAccountId:l}}function Ze(e,t){let r=Q(e);return{$tenantId:t,$orm:r,listAccounts:n=>r.accounts.listByTenant(t,n),findAccountByIntegration:n=>r.accounts.findByTenantAndIntegration(t,n),listEntities:async n=>{p(e);let i=await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).execute();if(i.length===0)return[];let a=i.map(o=>o.id),u=e.db.selectFrom("corsair_entities").selectAll().where("account_id","in",a);return n?.entityType&&(u=u.where("entity_type","=",n.entityType)),typeof n?.limit=="number"&&(u=u.limit(n.limit)),typeof n?.offset=="number"&&(u=u.offset(n.offset)),await u.execute()},listEvents:async n=>{p(e);let i=await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).execute();if(i.length===0)return[];let a=i.map(o=>o.id),u=e.db.selectFrom("corsair_events").selectAll().where("account_id","in",a);return n?.status&&(u=u.where("status","=",n.status)),typeof n?.limit=="number"&&(u=u.limit(n.limit)),typeof n?.offset=="number"&&(u=u.offset(n.offset)),await u.execute()},forIntegration:n=>z({database:e,integrationName:n.integrationName,schema:n.schema,tenantId:t})}}function $e(e,t){return{forTenant:r=>z({database:e,integrationName:t.integrationName,schema:t.schema,tenantId:r})}}export{x as a,_ as b,O as c,J as d,H as e,G as f,X as g,F as h,Y as i,q as j,xe as k,T as l,$ as m,de as n,Q as o,z as p,Ze as q,$e as r};

package/dist/chunk-YKXOTEYL.js

@@ -0,0 +1,61 @@
+import{a as Vr,b as de,c as Yr,d as C,e as U,f as Qr,g as N,h as F,i as I,j as Tn,k as Xr,l as eo,m as Tt,n as no,o as to}from"./chunk-WDF3YE27.js";import{a as zr}from"./chunk-IGGCNGU2.js";import{ZodBoolean as _u,ZodDate as Eu,ZodEnum as Du,ZodNullable as Ou,ZodNumber as Mu,ZodObject as Hu,ZodOptional as Fu,ZodRecord as Uu,ZodString as Bu,ZodType as Lu}from"zod";var vn=["agentql","ahrefs","airtable","algolia","amplitude","asana","bitwarden","bluesky","box","cal","calendly","cloudflare","confluence","cursor","datadog","deepseek","digitalocean","discord","dodopayments","dropbox","exa","figma","firecrawl","fireflies","gemini","github","gitlab","gmail","googlebigquery","googlecalendar","googledocs","googledrive","googlemeet","googlesheets","grafana","hackernews","heygen","hubspot","insightoai","instagram","intercom","jira","linear","linkedin","mailchimp","monday","neon","notion","ollama","onedrive","onepassword","openai","openweathermap","oura","outlook","pagerduty","perplexityai","posthog","razorpay","reddit","resend","retailed","sentry","sharepoint","slack","spotify","strava","stripe","supabase","tally","tavily","teams","telegram","todoist","trello","twilio","twitter","twitterapiio","typeform","vapi","whatsapp","vercel","xquik","youtube","zendesk","zohomail","zoom"],ro={agentql:"AgentQL",ahrefs:"Ahrefs",airtable:"Airtable",algolia:"Algolia",amplitude:"Amplitude",asana:"Asana",bitwarden:"Bitwarden",bluesky:"Bluesky",box:"Box",cal:"Cal",calendly:"Calendly",cloudflare:"Cloudflare",confluence:"Confluence",cursor:"Cursor",datadog:"Datadog",deepseek:"DeepSeek",digitalocean:"DigitalOcean",discord:"Discord",dodopayments:"Dodo Payments",dropbox:"Dropbox",exa:"Exa",figma:"Figma",firecrawl:"Firecrawl",fireflies:"Fireflies",gemini:"Gemini",github:"GitHub",gitlab:"GitLab",gmail:"Gmail",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googledocs:"Google Docs",googledrive:"Google Drive",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",hackernews:"Hacker News",heygen:"HeyGen",hubspot:"HubSpot",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jira:"Jira",linear:"Linear",linkedin:"LinkedIn",mailchimp:"Mailchimp",monday:"Monday",neon:"Neon",notion:"Notion",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",perplexityai:"Perplexity AI",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",resend:"Resend",retailed:"Retailed",sentry:"Sentry",sharepoint:"SharePoint",slack:"Slack",spotify:"Spotify",strava:"Strava",stripe:"Stripe",supabase:"Supabase",tally:"Tally",tavily:"Tavily",teams:"Teams",telegram:"Telegram",todoist:"Todoist",trello:"Trello",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",typeform:"Typeform",vapi:"Vapi",whatsapp:"WhatsApp",vercel:"Vercel",xquik:"XQuik",youtube:"YouTube",zendesk:"Zendesk",zohomail:"Zoho Mail",zoom:"Zoom"};function pe(e){let n=ro[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}import{randomUUID as ss}from"crypto";var es="corsair:client-bridge";function vt(e){return new URL(e).origin}function He(e){let n=JSON.stringify({type:es,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(vt(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var ns=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Pt(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:ns.has(n)}catch{return!1}}function nn(e){return e==="development"?"browser":"server"}function oo(e){return nn(e)==="browser"}function io(e){return Pt(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as is}from"crypto";var ge=60*1e3,Pe=300*1e3;import{createHmac as ts,randomBytes as rs,timingSafeEqual as os}from"crypto";function oe(){return rs(16).toString("base64url")}function tn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return ts("sha256",t).update(e).digest("base64url")}function X(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let s=tn(o,t);try{if(!os(Buffer.from(i,"utf8"),Buffer.from(s,"utf8")))return null}catch{return null}let a;try{a=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return a.exp*1e3<Date.now()?null:a}function Pn(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),s=tn(i,n);return`${i}.${s}`}function rn(e,n,t){let r=Math.floor(Date.now()/1e3);return Pn(e,n,r+Math.floor(t/1e3))}function Ae(e){return decodeURIComponent(e)}function At(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function so(e){let n=e.trim();return n.length>0?n:null}function Fe(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function Ue(e,n){if(!so(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??is(16).toString("base64url"),iat:t,exp:t+Math.floor(ge/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=tn(o,n);return`${o}.${i}`}function fe(e,n){return so(n)?X(e,n):null}function as(e){let n=vt(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function xt(e){let n=Ue(as(e),e.signingSecret);return Fe(e.deliveryUrl,n)}function ao(e){if(nn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=ss(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:xt(r)}}var on="https://auth.corsair.dev";var ie=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}};function An(e){let n=(e.apiUrl?.trim()||on).replace(/\/$/,""),t=e.projectApiKey.trim(),r=e.signingSecret.trim();if(!t||!r)throw new Error("Hub config requires non-empty projectApiKey and signingSecret");return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),allowWorkflowExecution:e.allowWorkflowExecution??!1}}function us(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function M(e){let n=C(e).hub;if(!n||!us(n))throw new ie;return n}function uo(e){return e.replace(/\/$/,"")}function xn(e){return e.oauthCallbackUrl?uo(e.oauthCallbackUrl.trim()):`${uo(e.apiUrl)}/oauth/callback`}function Be(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}function A(e){return typeof e=="string"&&e.length>0}function cs(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function ls(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function In(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!A(n.connectUrl)||!A(n.token)||!A(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:A(n.environmentId)?n.environmentId:n.projectId};return A(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function Sn(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!A(r.tenantId)||!A(r.plugin)||!cs(r.status)||!ls(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:A(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function Rn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!A(n.approvalUrl)||!A(n.token)||!A(n.projectId)||!A(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function _n(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(A(n.access_token))return{access_token:n.access_token,refresh_token:A(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:A(n.scope)?n.scope:void 0};throw new Error(A(n.error)?A(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function ds(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function ps(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;A(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function gs(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function co(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!A(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!A(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",s=ps(o.fields),a=ds(o.missingRequiredFields),u=gs(o.status,o.connected,s,a);t.push({plugin:o.plugin,providerName:A(o.providerName)?o.providerName:o.plugin,authKind:i,status:u,connected:o.connected,fields:s,missingRequiredFields:a})}return{tenantId:n.tenantId,plugins:t}}function En(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}var fs="3000",ys="/api/corsair";function ms(e){return e.replace(/\/$/,"")}function ye(e){let n=e?.deliveryUrl?.trim()||process.env.CORSAIR_DELIVERY_URL?.trim();if(n){let r=/^https?:\/\//i.test(n)?n:`https://${n}`;return ms(r)}return`http://localhost:${process.env.PORT?.trim()||fs}${ys}`}function lo(e){return e.replace(/\/$/,"")}function It(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return ye()}catch{return null}}function po(e){let n=It(e);return n?{"x-corsair-delivery-url":n}:{}}async function go(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function fo(e,n,t){if(n===404&&t)return t;let r=En(e);return r||`Hub API returned HTTP ${n}`}async function H(e){let n=lo(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...po(e.hub)},body:JSON.stringify(e.body)}),r=await go(t);if(!t.ok)throw new Error(fo(r,t.status,e.notFoundMessage));return e.parseResponse(r)}async function xe(e){let n=lo(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...po(e.hub)}}),r=await go(t);if(!t.ok)throw new Error(fo(r,t.status,e.notFoundMessage));return e.parseResponse(r)}import{createCipheriv as yo,createDecipheriv as mo,randomBytes as Dn,scrypt as hs}from"crypto";import{promisify as ks}from"util";var ho=ks(hs),On="aes-256-gcm",ko=12,Mn=16,bs=16,sn=32;function se(){return Dn(sn).toString("base64")}async function ae(e,n){let t=Dn(bs),r=await ho(n,t,sn),o=Dn(ko),i=yo(On,r,o,{authTagLength:Mn}),s=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),a.toString("base64"),s.toString("base64")].join(":")}async function q(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Buffer.from(i,"base64"),c=await ho(n,s,sn),d=mo(On,c,a,{authTagLength:Mn});return d.setAuthTag(u),Buffer.concat([d.update(l),d.final()]).toString("utf8")}function St(e,n){let t=Buffer.from(n,"base64"),r=Dn(ko),o=yo(On,t,r,{authTagLength:Mn}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[r.toString("base64"),s.toString("base64"),i.toString("base64")].join(":")}function an(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=mo(On,i,s,{authTagLength:Mn});return l.setAuthTag(a),Buffer.concat([l.update(u),l.final()]).toString("utf8")}function me(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=St(o,n);return t}function ue(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=an(o,n);return t}function un(e,n,t){let r=ue(e,n);return me(r,t)}function bo(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let s=[null,void 0,""].includes(i)?null:i;await n({[o]:s})};return r}var Rt=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function D(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,s=[...F[n].integration,...i],a=null,u={kek:r,integrationName:t,getIntegration:async()=>{if(a)return a;let m=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!m)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return a={id:m.id,config:Rt(m.config),dek:m.dek??null},a},updateIntegration:async m=>{let h=await u.getIntegration();await o.db.updateTable("corsair_integrations").set({...m.config!==void 0?{config:m.config}:{},...m.dek!==void 0?{dek:m.dek}:{},updated_at:new Date}).where("id","=",h.id).execute(),a=null}},l=null,c=async()=>{if(l)return l;let m=await u.getIntegration();if(!m.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await q(m.dek,r),l},d=async()=>{let m=await u.getIntegration(),h=await c(),b=m.config;return!b||Object.keys(b).length===0?{}:ue(b,h)},p=Promise.resolve(),g=m=>{let h=p.then(()=>f(m));return p=h.catch(()=>{}),h},f=async m=>{let h=await c(),b;try{b=await d()}catch(x){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,x),b={}}let w={...b};for(let[x,_]of Object.entries(m))_===null?delete w[x]:w[x]=_;let R=me(w,h);await u.updateIntegration({config:R})};return{get_dek:c,issue_new_dek:async()=>{let m=await u.getIntegration(),h=se(),b={};if(m.dek){let R=await q(m.dek,r),x=m.config;x&&Object.keys(x).length>0&&(b=un(x,R,h))}let w=await ae(h,r);return await u.updateIntegration({config:b,dek:w}),l=h,h},...bo(d,g,s)}}function E(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:s=[],ensureProvisioned:a}=e,u=[...F[n].account,...s],l=null,c=null,d=async()=>{if(c)return c;let k=!1;for(;;){let T=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!T){if(!k&&a){k=!0,await a();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return c={id:T.id,config:Rt(T.config),dek:T.dek??null},c}},p={kek:o,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(l)return l;let k=!1;for(;;){let T=await d(),v=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",T.id).executeTakeFirst();if(!v){if(!k&&a){k=!0,await a();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return l={id:v.id,config:Rt(v.config),dek:v.dek??null},l}},updateAccount:async k=>{let T=await p.getAccount();await i.db.updateTable("corsair_accounts").set({...k.config!==void 0?{config:k.config}:{},...k.dek!==void 0?{dek:k.dek}:{},updated_at:new Date}).where("id","=",T.id).execute(),l=null}},g=null,f=null,y=async()=>{if(g)return g;let k=await p.getAccount();if(!k.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return g=await q(k.dek,o),g},m=async()=>{if(f)return f;let k=await p.getIntegration();if(!k.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await q(k.dek,o),f},h=async()=>{let k=await p.getAccount(),T=await y(),v=k.config;return!v||Object.keys(v).length===0?{}:ue(v,T)},b=async()=>{let k=await p.getIntegration(),T=await m(),v=k.config;return!v||Object.keys(v).length===0?{}:ue(v,T)},w=Promise.resolve(),R=k=>{let T=w.then(()=>x(k));return w=T.catch(()=>{}),T},x=async k=>{let T=await y(),v;try{v=await h()}catch(P){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,P),v={}}let W={...v};for(let[P,V]of Object.entries(k))V===null?delete W[P]:W[P]=V;let te=me(W,T);await p.updateAccount({config:te})},_={get_dek:y,issue_new_dek:async()=>{let k=await p.getAccount(),T=se(),v={};if(k.dek){let te=await q(k.dek,o),P=k.config;P&&Object.keys(P).length>0&&(v=un(P,te,T))}let W=await ae(T,o);return await p.updateAccount({config:v,dek:W}),g=T,T},...bo(h,R,u)};return n==="oauth_2"&&(_.get_integration_credentials=async()=>{let k=await b();return{...k,client_id:k.client_id||null,client_secret:k.client_secret||null,redirect_url:k.redirect_url??null}}),_}async function Co(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=se(),i=await ae(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function wo(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let s=se(),a=await ae(s,r);return await e.db.updateTable("corsair_accounts").set({dek:a,updated_at:new Date}).where("id","=",i.id).execute(),s}var Cs=new Set(["webhook_signature","expires_at","scope","redirect_url"]);function he(e){return Cs.has(e)}function ws(e,n){return he(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function Ts(e){return!he(e)}function vs(e){switch(e){case"oauth_2":case"managed":return["access_token","refresh_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function Ps(e,n){return vs(e).every(r=>n.find(i=>i.level==="account"&&i.name===r)?.configured??!1)}async function To(e,n){if(!e)return!1;let t=N(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function As(e,n){let r=e.authConfig?.[n]?.integration??[];return[...F[n].integration,...r]}function xs(e,n){let r=e.authConfig?.[n]?.account??[];return[...F[n].account,...r]}function Is(e,n,t){let r=t.filter(a=>a.required&&!a.configured).map(a=>a.name),o=t.filter(a=>a.level==="integration"&&a.required&&!a.configured).map(a=>a.name),i=t.filter(a=>a.level==="account"&&a.required&&a.configured),s;return o.length>0?s="missing_integration":r.length===0?s="ready":i.length>0?s="partial":s="not_started",{plugin:e,authType:n,status:s,connected:Ps(n,t),fields:t,missingRequiredFields:r}}async function Ie(e,n,t){let r=I(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,s=i?.[r]?.integration??[],a=i?.[r]?.account??[],u=D({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:s}),l=E({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:a}),c=As(n,r),d=xs(n,r),p=[];for(let g of c)p.push({name:g,level:"integration",required:ws(r,g),configured:await To(u,g)});for(let g of d)p.push({name:g,level:"account",required:Ts(g),configured:await To(l,g)});return Is(n.id,r,p)}async function cn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let s of e.plugins){if(o&&!o.has(s.id))continue;let a=await Ie(e,s,r);a&&i.push(a)}return i}function Hn(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var vo=Symbol.for("corsair:internal"),Po=new WeakMap,Ao=new WeakMap;function Ss(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function Rs(e){if(e.database){let t=Po.get(e.database);return t||(t=new Map,Po.set(e.database,t)),t}let n=Ao.get(e);return n||(n=new Map,Ao.set(e,n)),n}function _s(e){return e.multiTenancy?{withTenant:()=>({}),[vo]:e}:{[vo]:e}}async function Le(e,n){if(!e.database)return;let t=n.trim()||"default",r=Rs(e),o=Ss(t,e.plugins),i=r.get(o);if(i){await i;return}let s=(async()=>{let{setupCorsair:a}=await import("./setup-M6UN5F6E.js");await a(_s(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,s),await s}import*as ln from"crypto";function ke(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function _t(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function Ne(e,n){let t=ln.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var Et=600*1e3;function Fn(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=ln.createHmac("sha256",n).update(r).digest("base64url"),s=Buffer.from(o,"base64url"),a=Buffer.from(i,"base64url");return s.length!==a.length||!ln.timingSafeEqual(s,a)?null:_t(r,{maxAgeMs:Et})}function xo(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function Io(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function $e(e,n){await H({hub:e,path:"/connections/report",body:xo(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function Es(e,n){try{let t=M(e);H({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof ie)return}}async function Ds(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!I(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ie(n,e.plugin,r);o&&Ro(e.hub,Io({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function So(e,n){Es(e,n)}function Ro(e,n){H({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function dn(e){Ds(e).catch(()=>{})}async function Dt(e,n){let t=C(e);if(!I(n.plugin))return;let o=await Ie(t,n.plugin,n.tenantId);o&&So(e,Io({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function Un(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var _o=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function Os(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function Ms(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await q(n.dek,e.kek),r=_o(n.config),o={};Object.keys(r).length>0&&(o=ue(r,t)),o[e.link.linkType]=e.link.externalId;let i=me(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function We(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:s,extraAccountFields:a=[]}=e,{accountId:u}=await Os({database:n,pluginId:r,tenantId:o}),l=!1;if(s){let c=E({authType:s,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:a}),d=`set_${i.linkType}`,p=c[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await Ms({database:n,kek:t,accountId:u,link:i})}async function Ot(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,s=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let a of s)if(a.dek)try{let u=await q(a.dek,t),c=_o(a.config)[o];if(!c)continue;if(an(c,u)===i)return a}catch{continue}return null}async function Bn(e){return(await Ot(e))?.tenant_id??null}async function Eo(e){return Bn({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as Do from"querystring";function Se(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${Do.stringify(i)}`}async function Oo(e,n){try{return await xe({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function Ln(e,n,t,r){if(!n.subscribe)return;let o=M(e),i=await Oo(o,n.id);if(!i)return;let s=await n.subscribe({keys:r},{webhookUrl:i});s&&await Dt(e,{plugin:n,tenantId:t,verified:!0,webhookLink:s.webhookLink,webhookSecret:s.webhookSecret})}var B=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function Mo(e){let n=e.oauthConfig;if(!n)throw new B("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Hs(e,n,t,r){let o=to(e),i=await o.integrations.findByName(n);if(!i)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.accounts.findOne({tenant_id:t,integration_id:i.id}))return;let a=se(),u=await ae(a,r);await o.accounts.create({tenant_id:t,integration_id:i.id,config:{},dek:u})}async function Mt(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,s=C(e,()=>new B("invalid_corsair_instance","Invalid corsair instance"));if(!s.database)throw new Error("No database configured on corsair instance");let a=U(s,n,p=>new B("plugin_not_found",p)),u=Mo(a),c=await D({authType:"oauth_2",integrationName:n,kek:s.kek,database:s.database}).get_client_id();if(!c)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Se({oauthConfig:u,clientId:c,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=Ne(ke(n,r),s.kek);return{url:Se({oauthConfig:u,clientId:c,redirectUri:o,state:d}),state:d}}async function pn(e,n){let{code:t,state:r,redirectUri:o}=n,i=C(e,()=>new B("invalid_corsair_instance","Invalid corsair instance")),s,a;if(n.trusted){if(!n.plugin||!n.tenantId)throw new B("invalid_state","trusted callback requires plugin and tenantId");s=n.plugin,a=n.tenantId}else{let y=Fn(r,i.kek);if(!y)throw new B("invalid_state","Invalid or tampered state parameter");s=y.plugin,a=y.tenantId}if(!i.database)throw new B("no_database","No database configured on corsair instance");let u=U(i,s,y=>new B("plugin_not_found",y)),l=Mo(u),c=D({authType:"oauth_2",integrationName:s,kek:i.kek,database:i.database}),d=await c.get_client_id(),p=await c.get_client_secret();if(!d||!p)throw new B("credentials_not_configured",`Credentials not configured for '${s}'`);await Hs(i.database,s,a,i.kek);let g=await Nn(t,d,p,l,o);if(!g.access_token)throw new B("no_access_token",`No access_token returned from ${l.providerName}`);let f=E({authType:"oauth_2",integrationName:s,tenantId:a,kek:i.kek,database:i.database,extraAccountFields:[...u.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in));try{let y=await Un(i.plugins,s,g);if(y){try{let m=u.authConfig?.oauth_2?.account??[];await We({database:i.database,kek:i.kek,pluginId:s,tenantId:a,link:y,authType:"oauth_2",extraAccountFields:m})}catch(m){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${a}':`,m)}i.hub&&$e(i.hub,{plugin:s,tenantId:a,link:y,authType:"oauth_2"})}}catch(y){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${a}':`,y)}if(u.subscribe)try{await Ln(e,u,a,f)}catch(y){console.warn(`[corsair:oauth] BYO subscribe failed for '${s}' tenant '${a}':`,y)}return{plugin:s,tenantId:a}}async function Fs(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??Ln,i=[],s=[];if(!t.database)return{renewed:i,failed:s};for(let a of r){let u=t.plugins.find(c=>c.id===a.integrationName);if(!u?.subscribe)continue;let l=`${u.id}/${a.tenantId}`;try{let c=E({authType:"oauth_2",integrationName:u.id,tenantId:a.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...u.authConfig?.oauth_2?.account??[]]}),d=u.keyBuilder;if(d){let p=Object.create(c,{get_expires_at:{value:async()=>"0"}});await d({authType:"oauth_2",keys:p},"endpoint")}await o(n,u,a.tenantId,c),i.push(l)}catch(c){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,c),s.push(l)}}return{renewed:i,failed:s}}async function Ho(e){let n=C(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return Fs({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function Us(e,n={}){let t=!1,r=()=>{t||(t=!0,Ho(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function Fo(e){if(!C(e).database)throw new Error("A database must be configured to provision Corsair integrations");await $n(e,{silent:!0})}async function je(e,n){let t=C(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await Le(t,n)}var Bs=Symbol.for("corsair:internal"),Ls=new Set(["access_token","refresh_token","expires_at","scope"]);function Ns(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function $s(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!he(t)&&!Ls.has(t)):n.filter(t=>!he(t))}function Uo(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function Ws(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function js(e){return{[Bs]:Uo(e)}}async function Wn(e,n,t={}){let r=xn(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,s=Uo(e),a=js(e);for(let u of e.plugins){if(i&&!i.has(u.id))continue;let l=I(u);if(!l)continue;let c=Ns(l),d=t.providerNameOverrides?.[u.id]??pe(u.id),p=await Ie(s,u,n),g=Tn(u,l),f=$s(l,g),y={plugin:u.id,providerName:d,authKind:c,alreadyConfigured:p?.connected??!1};if(f.length>0&&(y.credentialFields=f),c==="oauth"){let h=t.oauthModeOverrides?.[u.id]??(l==="managed"?"managed":"byo");if(y.oauthMode=h,!t.skipOAuthUrlGeneration&&h!=="managed")try{let b=await Mt(a,u.id,{tenantId:n,redirectUri:r,hubConnect:!0});y.oauthUrl=b.url}catch(b){y.setupError=b instanceof Error?b.message:`Could not prepare OAuth for ${u.id}`}}o.push(y)}return o}async function Dl(e,n,t={}){let r=C(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return Wn({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function Bo(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await Le(e.internalConfig??Ws(e),n)}async function Lo(e,n){await je(e,n)}async function No(e,n){let t=Be(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return t==="development"&&(r.deliveryUrl=ye({deliveryUrl:n.deliveryUrl})),H({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:In})}async function Ht(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await Bo(t,n.tenantId);let r=await Wn(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return No(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function jn(e,n){let t=C(e),r=M(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Lo(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,s=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,u=await Wn(o,n.tenantId,{pluginIds:i,oauthModeOverrides:s,providerNameOverrides:a});if(u.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return No(r,{tenantId:n.tenantId,plugins:u,deliveryUrl:n.deliveryUrl})}function $o(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ks(e,n){return n&&!n.has(e.id)?!1:I(e)!==null}async function Wo(e,n,t={}){let r=C(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,s=await cn(r,o,{pluginIds:t.pluginIds}),a=new Map(s.map(l=>[l.plugin,l])),u=r.plugins.filter(l=>Ks(l,i)).map(l=>{let c=I(l),d=a.get(l.id);return d?{plugin:l.id,providerName:pe(l.id),authKind:$o(c),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:pe(l.id),authKind:$o(c),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:u}}async function jo(e,n){let t=M(e);return xe({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:Sn})}function Ke(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var Z=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function qs(e){let n=e.oauthConfig;if(!n)throw new Z("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Ft(e,n){let t=C(e,()=>new Z("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new Z("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new Z("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=Fn(n,t.kek);if(!o)throw new Z("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:s}=o,a=U(t,i,p=>new Z("plugin_not_found",p)),u=qs(a),c=await D({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!c)throw new Z("client_id_not_configured",`client_id not configured for '${i}'`);let d=Se({oauthConfig:u,clientId:c,redirectUri:r,state:n});return{plugin:i,tenantId:s,providerName:u.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as Gs}from"async_hooks";import{randomBytes as Js}from"crypto";import{v4 as zs}from"uuid";async function Kn(e,n){let t=Be(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return t==="development"&&(r.deliveryUrl=ye({deliveryUrl:n.deliveryUrl})),H({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Rn})}function qn(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var Ut="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Lt(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Ko(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Bt(e){return qn(e)}async function Nt(e,n){if(Lt(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Ko(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Kn(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:Zs(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function Zs(e){try{return JSON.parse(e)}catch{return e}}async function Zn(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Nt(e,n);return{...n,approvalUrl:r}}async function $t(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:s,endpoint:a,args:u,tenantId:l,expiresAt:c,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:s,endpoint:a,args:u});let g=await Nt({manual:t,hub:r},{id:o,token:i,plugin:s,endpoint:a,args:JSON.stringify(u),tenant_id:l,expires_at:c});return Lt(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Bt(g):Ut:r?g?Bt(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:Ut}var qe=class extends Error{constructor(n){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError"}};var Zo=new Gs,Gn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function Vs(e){return Zo.run(!0,e)}function Go(){return Zo.getStore()===!0}function Wt(e,n){if(Go()&&n!=="read")throw new Gn(e,n)}var Ys={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function Qs(e,n,t){return t!==void 0?t:Ys[n][e]}function jt(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Jo(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function qo(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function zo(e){let n=Qs(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, update the permission mode or add an override in your corsair config.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),s=e.tenantId??"default",a=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",s).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(a){if(a.status==="approved"){let f=e.db,y=a.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",y).execute()}}}return a.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${a.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?qo(e.db,a.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:a.id,token:a.token,expiresAt:a.expires_at})}let u=zs(),l=Js(32).toString("hex"),c=e.timeoutMs??600*1e3,d=new Date(Date.now()+c).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:u,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:s,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${u}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?qo(e.db,u,c):{result:"blocked",reason:"pending",id:u,token:l,expiresAt:d}}var S=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function O(e,n){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json"}})}function Vo(e){let n={error:e.code,message:e.message,...e.extra};return O(e.status,n)}function be(e){return new S(404,"not_found",e)}function ce(e,n={}){return new S(400,"bad_request",e,n)}function Yo(e,n){return U(e,n,t=>be(t))}async function Qo(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=D({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=F[t].integration,i=r,s;try{s=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{s=o.map(()=>null)}let a=o.filter((l,c)=>s[c]==null),u;return t==="oauth_2"?u=!a.includes("client_id")&&!a.includes("client_secret"):u=a.length===0,{configured:u,missingFields:a}}async function Xo(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await Qo(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Jn(){return{ok:!0}}async function Ze(e){return Promise.all(e.plugins.map(n=>Xo(n,e)))}async function zn(e,n){let t=Yo(e,n);return Xo(t,e)}async function Xs(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function ei(e,n){let t=await Xs(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function Ge(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let s=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:s}),s&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function Vn(e,n){if(!n)throw ce("Tenant id must be a non-empty string");return ei(e,n)}async function Yn(e,n){let t=n?.id?.trim();if(!t)throw ce("Tenant id is required",{missingFields:["id"]});return ei(e,t)}async function Qn(e,n){let t=n?.trim()||"default",r={},o=await cn(e,t);for(let i of o)r[i.plugin]=Hn(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function Kt(e,n){if(!e.database)throw be(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw be(`Permission '${n}' not found`);return Zn(e,t)}function ea(e){if(!e.oauthConfig)throw ce(`Plugin '${e.id}' has no oauthConfig`)}function na(e){if(!e.manual)throw new S(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function qt(e){let n=na(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new S(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function ta(e){let n=!!e.hub,t=Ke(e.manual);if(!n&&!t)throw new S(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function ni(e){if(!e.database||!e.kek)throw new S(500,"database_not_configured","A database and kek are required to issue connect links.")}async function ra(e,n){let t=n?.plugin?.trim();if(!t)throw ce("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=Yo(e,t);ea(o);let i=qt(e);ni(e);let s=await Qo(o,e);if(!s.configured)throw new S(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:s.missingFields});let a=Ne(ke(t,r),e.kek),u;try{u=new URL(i.baseUrl)}catch{throw new S(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return u.searchParams.set("state",a),{connectUrl:u.toString(),expiresAt:new Date(Date.now()+Et).toISOString()}}async function oa(e,n,t){ni(n);let o={tenantId:t.tenantId?.trim()||"default",oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let s=t.providerName?.trim();s&&(o.providerName=s);let a=await jn(e,o);return{connectUrl:a.connectUrl,expiresAt:a.expiresAt}}async function Xn(e,n,t){return ta(n),n.hub?oa(e,n,t):ra(n,t)}async function et(e,n,t){if(n.hub&&!Ke(n.manual))throw new S(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw ce("state is required",{missingFields:["state"]});qt(n);try{return await Ft(e,r)}catch(o){if(o instanceof Z)switch(o.code){case"invalid_state":throw ce("Invalid or expired state");case"client_id_not_configured":throw new S(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new S(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function nt(e,n,t){if(n.hub&&!Ke(n.manual))throw new S(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw ce("Missing required fields",{missingFields:i});let s=qt(n),{processOAuthCallback:a}=await import("./oauth.js");try{return await a(e,{code:r,state:o,redirectUri:s.redirectUri})}catch(u){if(u instanceof Error&&u.name==="OAuthCallbackError")switch(u.code){case"invalid_state":throw ce("Invalid or expired state");case"credentials_not_configured":throw new S(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new S(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function Zt(e,n){if(!e.database)throw be("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw be("Permission not found");return Zn(e,t)}async function ti(e,n){return"id"in n?Kt(e,n.id):Zt(e,n.token)}import{createCipheriv as da,createDecipheriv as Dd,randomBytes as si,scryptSync as pa}from"crypto";import{createHmac as Gt,randomUUID as ia,timingSafeEqual as oi}from"crypto";function Jt(e){return e.run??null}function ii(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function tt(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=Gt("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":ia()}}}function zt(e){let n=e.signingSecret.trim();if(!n)return!1;let t=ii(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>Pe)return!1;let i=Gt("sha256",n).update(e.body).digest("hex");try{return oi(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function Je(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=ii(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>Pe)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=Gt("sha256",n).update(e.body).digest("hex");try{if(!oi(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function ze(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function rt(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function ot(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function gn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function Vt(e){return gn(ze(e))}async function Yt(e){let n=await at({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=ze(n.body),r=rt({httpOk:n.ok,status:n.status,body:t}),o=gn(t);if(!r||!o)throw new Error(st({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function it(e){return ot(ze(e))}function sa(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function ri(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var aa="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",ua="Check the delivery URL configured for this environment.";function ca(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${aa}`}function la(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${ua}`}function fn(e,n){let t=sa(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function st(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:fn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return ca(e);if(e.status===404)return la(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${ri(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${ri(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}async function at(e){let{body:n,headers:t}=tt(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:fn(e.deliveryUrl,r)}}}var ga="aes-256-gcm",fa=12,ya=16,ma=16,ha=32;function ka(e,n){return pa(e.trim(),n,ha)}function Qt(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=si(ma),o=ka(t,r),i=si(fa),s=da(ga,o,i,{authTagLength:ya}),a=JSON.stringify(e),u=Buffer.concat([s.update(a,"utf8"),s.final()]),l=s.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),u.toString("base64")].join(":")}var ba=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function Xt(e){if(e instanceof Vr)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!ba.some(t=>n.includes(t))}function Ca(e){if(!e)return[];let n=I(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!he(r)):[]}async function yn(e,n){let t=C(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await $n(e,{silent:!0});let[r,o]=await Promise.all([Ge(t),Ze(t)]),i={tenants:r.map(s=>({id:s.id})),plugins:o.map(s=>{let a=Ca(t.plugins.find(u=>u.id===s.id));return{id:s.id,authType:s.authType,configured:s.configured,missingFields:s.missingFields,...a.length>0?{integrationCredentialFields:a}:{}}}),syncedAt:new Date().toISOString()};return Qt(i,n)}async function ut(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(s=>s.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=C(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await wa(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function wa(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-VCBAWEPX.js"),{postHubConnectSession:i}=await import("./connect-JHARP4KN.js"),s={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(s,t.tenantId);let a=await r(s,t.tenantId,{pluginIds:t.pluginIds});if(a.length===0)throw new Error("No connectable plugins found for this tenant");let u=a.find(l=>l.setupError);if(u)throw new Error(u.setupError??`Could not prepare connect link for ${u.plugin}`);return i(e,{tenantId:t.tenantId,plugins:a})}var ee=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function ct(e,n){let t=C(e,()=>new ee("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ee("no_database","Database not configured");let r=U(t,n.plugin,c=>new ee("plugin_not_found",c)),o=I(r);if(!o)throw new ee("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new ee("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await je(e,n.tenantId);let i=new Set(Tn(r,o)),a=r.authConfig?.[o]?.account??[],u=E({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:a}),l=0;for(let[c,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(c))throw new ee("invalid_credentials",`Unknown credential field '${c}' for plugin '${n.plugin}'`);let p=N(u,`set_${c}`);if(!p)throw new ee("invalid_credentials",`Cannot set credential field '${c}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ee("invalid_credentials","Provide at least one credential field to save");return{plugin:n.plugin,tenantId:n.tenantId}}var ne=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function er(e,n){let t=C(e,()=>new ne("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ne("no_database","Database not configured");let r=U(t,n.plugin,c=>new ne("plugin_not_found",c)),o=I(r);if(!o)throw new ne("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await Fo(e);let i=new Set(Xr(r,o)),a=r.authConfig?.[o]?.integration??[],u=D({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:a}),l=0;for(let[c,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(c))throw new ne("invalid_credentials",`Unknown integration credential field '${c}' for plugin '${n.plugin}'`);let p=N(u,`set_${c}`);if(!p)throw new ne("invalid_credentials",`Cannot set integration field '${c}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ne("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var lt=new Map;function Ta(e){for(let[n,t]of lt)t<=e&&lt.delete(n)}function dt(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};let r=Date.now();return Ta(r),lt.has(t)?{ok:!1,error:"Delivery request already consumed"}:(lt.set(t,r+n),{ok:!0})}var Ce=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function Ve(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:s,scope:a}=n;if(!o.trim())throw new Ce("no_access_token","Managed OAuth delivery missing access_token");let u=C(e,()=>new Ce("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new Ce("no_database","No database configured on corsair instance");let l=U(u,t,d=>new Ce("plugin_not_found",d));await je(e,r);let c=E({authType:"managed",integrationName:t,tenantId:r,kek:u.kek,database:u.database});await c.set_access_token(o),i&&await c.set_refresh_token(i),s&&await c.set_expires_at(String(Math.floor(Date.now()/1e3)+s)),a&&await c.set_scope(a);try{let d=await Un(u.plugins,t,{access_token:o,refresh_token:i,scope:a});if(d){try{let p=l.authConfig?.managed?.account??[];await We({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:d,authType:"managed",extraAccountFields:p})}catch(p){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,p)}u.hub&&$e(u.hub,{plugin:t,tenantId:r,link:d,authType:"managed"})}}catch(d){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,d)}return{plugin:t,tenantId:r}}function va(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function ai(e,n,t=[]){for(let[r,o]of Object.entries(e))if(va(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=ai(o,n,[...t,r]);if(i)return i}return null}function Pa(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function Aa(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function ui(e,n,t,r,o){let i=Pa(n),s=typeof t=="string"?JSON.parse(t):t;(!s||typeof s=="object"&&Object.keys(s).length===0)&&i["x-goog-resource-uri"]&&(s=Aa(i)||s);let u={headers:i,body:s,...r?{query:r}:{}},l=r?.tenantId||"default",c=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:vn;for(let g of p){let f=c[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(u))continue;let y=ai(f.webhooks,u);if(!y)continue;let m=y.path.join("."),h={payload:s,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{}};try{let b=await y.webhook.handler(h),w=!!Object.keys(b.returnToSender||{})?.length;return{plugin:g,action:m,body:s,response:w?{...b?.returnToSender,success:!0}:{success:!0},...b.responseHeaders&&{responseHeaders:b.responseHeaders}}}catch(b){return console.error(`Error executing webhook handler for ${g}.${m}:`,b),{plugin:g,action:m,body:s,response:{success:!1,error:b instanceof Error?b.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import*as Re from"vm";var ci="__corsairFailedStep",xa=3e4,nr=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function li(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function di(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var pi=new Set(["constructor","prototype","__proto__"]);function _e(e,n){if(e===null)return null;let t=typeof e;return t==="function"?Sa(e,n):t==="object"?Ia(e):e}function Ia(e){return new Proxy(e,{get(n,t){if(!pi.has(t))return _e(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Sa(e,n){return new Proxy(e,{apply:(t,r,o)=>Ra(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!pi.has(r))return _e(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Ra(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>_e(n,void 0),n=>{throw _e(n,void 0)}):_e(e,void 0)}function _a(e){let n=Object.create(null),t=Re.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Re.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),s=Re.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),u=Re.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=_e(e.corsair,void 0),n.__payload=o,n.__step=s,n.__console=u;let l=Re.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let c,d=new Promise((p,g)=>{c=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(c))}async function tr(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(s,a)=>{if(o)throw o;let u=r++;if(Object.hasOwn(n,s))return _e(n[s].output,void 0);try{let l=await a();return t.push({name:s,seq:u,status:"completed",output:l}),l}catch(l){if(li(l))throw l;let c=di(l);t.push({name:s,seq:u,status:"failed",error:c});let d=new Error(c);throw d[ci]=s,d}});i.sleep=async(s,a)=>{if(o)throw o;let u=r++;if(Object.hasOwn(n,s))return;t.push({name:s,seq:u,status:"completed",output:null});let l=Number.isFinite(a)?Math.max(0,a):0;throw o=new nr(Date.now()+l,s),o};try{await _a({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??xa});let s=o;return s?{status:"sleeping",steps:t,sleepUntil:new Date(s.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(s){if(li(s))return{status:"sleeping",steps:t,sleepUntil:new Date(s.wakeAt).toISOString()};let a=di(s),u=s!==null&&typeof s=="object"?s[ci]:void 0;return{status:"failed",steps:t,error:{message:a,...u?{failedStep:u}:{}}}}}function Ee(e){return e.deliveryMode==="auth.credentials"}function mn(e){return e.deliveryMode==="connections.sync"}function pt(e){return e.deliveryMode==="connect.create_link"}function hn(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function kn(e){return e.deliveryMode==="oauth.tokens"}function gt(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!Ee(e)&&!mn(e)&&!pt(e)&&!hn(e)&&!kn(e)}function Ea(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function Da(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await yn(e,n)}}}}}catch(t){return{status:"failed",retryable:Xt(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function Oa(e,n){try{let t=await ut(e,n);return Ea(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function rr(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function Ma(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await Bn({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function Ha(e,n,t){let r=await Ma(e,n,t),o={...t.query??{},...r?{tenantId:r}:{}},i=await ui(e,t.headers,t.body,o,t.plugin?{plugin:t.plugin}:void 0);if(!i.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(i.response&&i.response.success===!1)return{status:"failed",retryable:!1,error:typeof i.response.error=="string"?i.response.error:"Webhook handler failed"};let s=i.response?.returnToSender,a=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(i.response?.data??i.response);return{status:"ok",webhookResponse:{status:i.response?.statusCode??200,body:a,headers:i.responseHeaders}}}async function Fa(e,n){return await pn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function Ua(e,n){return await Ve(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope}),{status:"ok"}}async function ir(e,n,t){let r=await or(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function or(e,n,t){let r=C(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),s=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return s?s.status!=="pending"?{status:"ok"}:s.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",s.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",s.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function Ba(e,n){try{return await ct(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function La(e,n){try{return await er(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function Na(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function $a(e,n){try{let t=Na(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await tr({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function sr(e,n,t={}){let r=C(e),o=rr(n.headers,"x-corsair-signature"),i=rr(n.headers,"x-corsair-timestamp"),s=rr(n.headers,"x-corsair-nonce");if(t.signingSecret?.trim()){let u=Je({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!u.ok)return{status:"failed",retryable:!1,error:u.error};if(!s?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let l=dt(`nonce:${s.trim()}`,Pe);if(!l.ok)return{status:"failed",retryable:!1,error:l.error}}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let a;try{a=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(a.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(a.type){case"webhook":return Ha(e,r,a.payload);case"oauth.callback":return Fa(e,a.payload);case"oauth.tokens":return Ua(e,a.payload);case"permission.approve":return or(e,a.payload,"approved");case"permission.deny":return or(e,a.payload,"denied");case"auth.credentials":return Ba(e,a.payload);case"integration.credentials":return La(e,a.payload);case"connect.create_link":return Oa(e,a.payload);case"connections.sync":{let u=t.signingSecret?.trim();return u?Da(e,u):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?$a(e,a.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(a.type)}`}}}var ar=new Map;function gi(e){let n;try{n=M(e)}catch{return}let t=It(n);t&&ar.get(n.projectApiKey)!==t&&(ar.set(n.projectApiKey,t),H({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{ar.delete(n.projectApiKey)}))}var Wa=[".corsair.dev"];function ja(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function Ka(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:ja(n)?!0:Wa.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function fi(e){return!e||!Ka(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function yi(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function ur(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function cr(e,n){let t=M(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=fe(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let s=dt(`browser:${i.jti}`,ge);if(!s.ok)return{type:"json",status:400,body:{error:s.error}};try{if(mn(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let a=await yn(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:He({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:a}}})}}if(pt(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let a=i.connectLinkPlugins?.filter(Boolean)??[];if(a.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let u=await ut(e,{tenantId:i.tenantId,plugins:a});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:He({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:u.connectUrl,expiresAt:u.expiresAt}})}}if(Ee(i))return i.hubSuccessUrl?i.credentials?(await ct(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:ur(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:ur(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(hn(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await ir(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(kn(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await Ve(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope})}else{if(!gt(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await pn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(a){let u=a instanceof Error?a.message:"Hub delivery failed";return mn(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:He({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:u})}:pt(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:He({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:u})}:Ee(i)&&i.hubSuccessUrl?{type:"redirect",url:ur(i.hubSuccessUrl,{error:u})}:Ee(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:He({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:u})}:{type:"json",status:400,body:{error:u}}}return{type:"redirect",url:i.hubSuccessUrl}}async function lr(e,n){let t=M(e),r=await sr(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,s=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:s}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:s}}function dr(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function pr(e,n){return n.method==="GET"?cr(e,n.url):lr(e,{headers:n.headers,body:n.body??""})}async function gr(e,n){try{let t=await pr(e,n);return dr(t)}catch(t){if(t instanceof ie)return Response.json({error:t.message},{status:503});throw t}}async function De(e,n){gi(e);let t=n.method.toUpperCase(),r=fi(n.headers.get("origin"));if(t==="OPTIONS")return r?new Response(null,{status:204,headers:r}):Response.json({error:"Method not allowed"},{status:405});if(t!=="GET"&&t!=="POST")return Response.json({error:"Method not allowed"},{status:405});let o=await gr(e,{method:t,url:n.url,headers:n.headers,body:t==="POST"?await n.text():void 0});return yi(o,r)}var $=class extends Error{pluginId;authType;constructor(n,t,r){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t}};var mi=300;async function fr(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,s=n?.forceRefresh??!1,[a,u,l]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!a&&!l)throw new $(o,"managed");let c=Math.floor(Date.now()/1e3);if(!s&&a&&u&&Number(u)>c+mi)return{accessToken:a,expiresAt:Number(u),refreshed:!1};if(!l&&a&&!s){let g=u?Number(u):null;if(g===null||g>c+mi)return{accessToken:a,expiresAt:g??c+3600,refreshed:!1}}let d=await Za(r,o,i),p=d.expires_in?c+d.expires_in:u?Number(u):c+3600;return await t.set_access_token(d.access_token),await t.set_expires_at(String(p)),d.refresh_token&&await t.set_refresh_token(d.refresh_token),d.scope&&await t.set_scope(d.scope),{accessToken:d.access_token,expiresAt:p,refreshed:!0}}function qa(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function Za(e,n,t){try{return await H({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t},parseResponse:_n})}catch(r){let o=r instanceof Error?r.message:"";throw qa(o)?new $(n,"managed"):r}}async function hi(e,n){e._refreshAuth=async()=>(await fr(n,{forceRefresh:!0})).accessToken}function ki(e){return{delivery:n=>De(e,n),deliveryOptions:n=>De(e,n)}}var bi=1200*1e3;function yr(){return oe()}function mr(){return bi}function hr(e,n){return rn(e,n,bi)}function kr(e,n){return X(e,n)}function br(e){return Ae(e)}var Ci=600*1e3;function Cr(){return oe()}function wr(){return Ci}function Tr(e,n){return rn(e,n,Ci)}function vr(e,n){return X(e,n)}function Pr(e){return At(e)}function Ar(e){return Ae(e)}function xr(){return oe()}function Ir(e,n,t){return Pn(e,n,Math.floor(t.getTime()/1e3))}function Sr(e,n){return X(e,n)}function Rr(e){return Ae(e)}function wi(e){return e&&typeof e=="object"?e:{}}async function _r(e,n){return H({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>t})}async function Er(e,n){return H({hub:e,path:`/threads/${encodeURIComponent(n.threadId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Thread "${n.threadId}" not found`,parseResponse:t=>t})}async function Dr(e,n){return xe({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=wi(t).threads;return Array.isArray(r)?r:[]}})}async function ft(e,n){return xe({hub:e,path:`/threads/${encodeURIComponent(n.threadId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Thread "${n.threadId}" not found`,parseResponse:t=>{let r=wi(t).messages;return Array.isArray(r)?r:[]}})}function yt(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){let s=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${s?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${sn}`)}})}async function Ga(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function Ti(e){let{integrationId:n,accountId:t}=await Ga(e);return{integrationId:n,accountId:t}}function Or(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function Ja(e,n){let t=e.hub;if(!t||!n.database||!n.kek)return null;try{return(await Ht(t,{tenantId:n.tenantId,plugin:n.plugin,database:n.database,kek:n.kek,plugins:n.plugins,multiTenancy:n.multiTenancy})).connectUrl}catch{return null}}async function za(e){let n=e.hub;if(n&&e.database&&e.kek)try{let r=await Ht(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:r.connectUrl,state:r.token}):Or(e.pluginId,r.connectUrl)}catch{return`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`}let t=await Ja({manual:e.manual,hub:e.hub},{plugin:e.plugin,tenantId:e.tenantId,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return t?Or(e.pluginId,t):`[auth-missing:${e.pluginId}:${e.authType}]`}function Va(e,n,t){let r=Ne(ke(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):Or(e,i)}async function Ya(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.manual&&Ke(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?Va(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?za({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):e.error.message}async function vi(e){let n=await Ya(e);throw new $(e.error.pluginId,e.error.authType,n)}var Qa=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function Pi(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},s=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[s||"DEFAULT"]?.handler||Qa)(e,i)}function Xa(e){return typeof e=="function"}function Mr({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:s=[],keyBuilder:a,permissionsConfig:u,endpointMeta:l,database:c,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:y,kek:m,allPlugins:h,multiTenancy:b}){for(let[w,R]of Object.entries(e)){let x=n?.[w];if(Xa(R)){let _=x,k=[...s,w].join("."),T=async(v={})=>{let W=l?.[k];Wt(k,W?.riskLevel??"write");let te;if(u){let j=W,{result:wn,reason:Y,onComplete:en,token:re,id:ve,expiresAt:K}=await zo({pluginId:o,endpointPath:k,args:v,mode:u.mode,override:u.overrides?.[k],riskLevel:j?.riskLevel??"write",meta:j,db:c,timeoutMs:d?jt(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(wn==="blocked"){let Q;throw Y==="denied"?Q=`Action '${k}' was denied by the user. Await further instructions before proceeding.`:Y==="policy"?Q=`Action '${k}' is blocked by the permission policy. Update the corsair config to allow it.`:Y==="timeout"?Q=`Action '${k}' timed out waiting for approval.`:re&&ve?Q=await $t({permissionsOptions:d,manual:g,hub:f,permissionId:ve,permissionToken:re,plugin:o,endpoint:k,args:v,tenantId:p??"default",expiresAt:K??new Date(Date.now()+(d?jt(d.timeout):600*1e3)).toISOString(),operationPath:k}):Q=`Action '${k}' requires user approval before it can run.`,new qe(Q)}te=en}let P=async(j,wn,Y)=>{try{return await R(wn,Y)}catch(en){if(en instanceof Error){let re=await Pi(en,o,k,typeof Y=="object"&&Y!==null?Y:{args:Y},i);if(j<(re.maxRetries||0)){let ve=j+1;console.log(`Retrying (${ve} / ${re.maxRetries})...`);let K;if(re.headersRetryAfterMs)K=re.headersRetryAfterMs;else switch(re.retryStrategy){case"exponential_backoff":K=Math.pow(2,ve-1)*1e3;break;case"exponential_backoff_jitter":let Q=Math.pow(2,ve-1)*1e3,Xi=(Math.random()-.5)*1e3;K=Math.max(0,Q+Xi);break;case"linear_1s":K=1e3;break;case"linear_2s":K=2e3;break;case"linear_3s":K=3e3;break;case"linear_4s":K=4e3;break;default:K=1e3;break}await new Promise(Q=>setTimeout(Q,K)),await P(ve,wn,Y),console.log(`[corsair:${o}:${k}] Retry strategy:`,re)}}throw en}},V;try{V=a?await a(t,"endpoint"):void 0}catch(j){throw j instanceof $&&(y&&f&&dn({hub:f,database:c,kek:m,plugins:h??[],plugin:y,tenantId:p,verified:!1}),await vi({error:j,manual:g,hub:f,plugin:y,tenantId:p,database:c,kek:m,plugins:h,multiTenancy:b})),j}if(!_?.before&&!_?.after){let j=await P(0,{...t,key:V},v);return await te?.(),y&&f&&dn({hub:f,database:c,kek:m,plugins:h??[],plugin:y,tenantId:p,verified:!0}),j}let Xe={...t,key:V},Te=_.before?await _.before(Xe,v):{ctx:Xe,args:v,continue:!0,passToAfter:void 0};if(Te.continue===!1)return;let Jr=await P(0,Te.ctx,Te.args);return await _.after?.(Te.ctx,Jr,Te.passToAfter),await te?.(),y&&f&&dn({hub:f,database:c,kek:m,plugins:h??[],plugin:y,tenantId:p,verified:!0}),Jr};r[w]=T}else if(R&&typeof R=="object"){let _={};Mr({endpoints:R,hooks:x,ctx:t,tree:_,pluginId:o,errorHandlers:i,currentPath:[...s,w],keyBuilder:a,permissionsConfig:u,endpointMeta:l,database:c,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:y,kek:m,allPlugins:h,multiTenancy:b}),r[w]=_}}}function Ai(e,n){let t=()=>{if(!e)throw new Error("corsair.threads requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o=>({message:i=>Er(t(),{threadId:o,tenantId:n,message:i}),listMessages:()=>ft(t(),{threadId:o,tenantId:n})}));return r.create=o=>_r(t(),{tenantId:n,message:o}),r.list=()=>Dr(t(),{tenantId:n}),r.listMessages=o=>ft(t(),{threadId:o,tenantId:n}),r}function eu(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Hr({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,s]of Object.entries(e)){let a=n?.[i];if(eu(s)){let u=a,l=async c=>{let d=(g,f)=>s.handler(g,f),p=o?await o(t,"webhook"):void 0;return!u?.before&&!u?.after?d({...t,key:p},c):(async()=>{let g={...t,key:p},f=u.before?await u.before(g,c):{ctx:g,args:c,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let y=await d(f.ctx,f.args);return y?.success===!0&&await u.after?.(f.ctx,y,f.passToAfter),y})()};r[i]={match:s.match,handler:l}}else if(s&&typeof s=="object"){let u={};Hr({webhooks:s,hooks:a,ctx:t,webhooksTree:u,keyBuilder:o}),r[i]=u}}}function nu(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await Ti({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function tu(e,n,t,r,o){return e?Tt(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function Fr(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:s,manualConfig:a,hubConfig:u,internalConfig:l}=n,c=r??"default",d=l&&t?()=>Le(l,c):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let y=f.schema,m=nu(t,f.id,c,d);if(y?.entities){let P={};for(let[V,Xe]of Object.entries(y.entities)){let Te=t?Tt(t.db,m,V,y.version,Xe):tu(void 0,m,V,y.version,Xe);P[V]=Te}g[f.id].db=P,p[f.id].db=P}let h=f.options,b=f.authConfig,w;if(t&&o&&h?.authType){let P=b?.[h.authType]?.account??[];w=E({authType:h.authType,integrationName:f.id,tenantId:c,kek:o,database:t,extraAccountFields:P,ensureProvisioned:d}),p[f.id].keys=w}let R={database:t,db:g[f.id]?.db??{},$getAccountId:m,...f.options?{options:f.options}:{},...w?{keys:w,authType:h?.authType}:{},tenantId:c,...u?{hub:u}:{}},x=f.endpoints??{},_=f.hooks,k={...i,...f.errorHandlers},T={},v=f.options?.permissions;Mr({endpoints:x,hooks:_,ctx:R,tree:T,pluginId:f.id,errorHandlers:k,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:v,endpointMeta:f.endpointMeta,database:t,permissionsOptions:s,tenantId:r,manualConfig:a?{...a,oauthConfig:f.oauthConfig,kek:o,tenantId:c}:void 0,hubConfig:u,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy}),Object.keys(T).length>0&&(p[f.id].api=T),R.endpoints=T;let W=f.webhooks??{},te=f.webhookHooks;if(Object.keys(W).length>0){let P={};Hr({webhooks:W,hooks:te,ctx:R,webhooksTree:P,keyBuilder:f.keyBuilder}),p[f.id].webhooks=P,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.threads=Ai(u,c),p}function xi(e,n,t){let r={};for(let o of e){let i=o.options,s=o.authConfig;if(i?.authType){let a=s?.[i.authType]?.integration??[],u=D({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:a});r[o.id]=u}}return r}var ru="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function Ii(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${ru}`),t):n}var Si=[{method:"GET",pattern:"/ok",handler:async()=>O(200,Jn())},{method:"GET",pattern:"/tenants",handler:async({internal:e})=>O(200,await Ge(e))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n})=>O(201,await Yn(e,n))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n})=>O(200,await Vn(e,n.id))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>O(200,await Ze(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>O(200,await zn(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n})=>O(200,await Qn(e,n.tenantId))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n})=>O(200,await Kt(e,n.id))},{method:"POST",pattern:"/permissions/lookup-by-token",handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?O(200,await Zt(e,t)):O(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t})=>O(200,await Xn(e,n,t))},{method:"GET",pattern:"/connect/resolve",handler:async({corsair:e,internal:n,query:t})=>O(200,await et(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",handler:async({corsair:e,internal:n,body:t})=>O(200,await nt(e,n,t))}];(()=>{let e=new Set;for(let n of Si){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function ou(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let s=t[i],a=r[i];if(s.startsWith(":"))o[s.slice(1)]=decodeURIComponent(a);else if(s!==a)return null}return o}function iu(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function su(e){if(!(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json")))try{let t=await e.text();return t?JSON.parse(t):void 0}catch{throw new S(400,"invalid_json","Request body is not valid JSON")}}var au="/api/corsair";function Oe(e,n={}){let t=n.basePath??au,r=C(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async o=>{try{let i=new URL(o.url),s=iu(i.pathname,t),a=o.method.toUpperCase();if(a==="OPTIONS"||s==="/"||s==="")return await De(e,o);if(a!=="GET"&&a!=="POST")return O(405,{error:"method_not_allowed",message:`Method ${a} not allowed`});let u=Object.fromEntries(i.searchParams);for(let l of Si){if(l.method!==a)continue;let c=ou(l.pattern,s);if(!c)continue;let d=await su(o);return await l.handler({corsair:e,internal:r,req:o,params:c,query:u,body:d})}throw be(`No route for ${a} ${s}`)}catch(i){if(n.onError){let a=await n.onError(i,o);if(a)return a}if(i instanceof S)return Vo(i);let s=i instanceof Error?i.message:"Internal server error";return O(500,{error:"internal_error",message:s})}}}function uu(e){let n=e.get?.("host")??"localhost",t=e.protocol??"http",r=e.originalUrl??e.url,o=`${t}://${n}${r}`,i=new Headers;for(let[u,l]of Object.entries(e.headers))if(l!=null)if(Array.isArray(l))for(let c of l)i.append(u,c);else i.set(u,l);let s=e.method!=="GET"&&e.method!=="HEAD",a={method:e.method,headers:i};return s&&e.body!==void 0&&(a.body=typeof e.body=="string"?e.body:JSON.stringify(e.body),i.has("content-type")||i.set("content-type","application/json")),new Request(o,a)}async function cu(e,n){e.status(n.status),n.headers.forEach((r,o)=>e.setHeader(o,r));let t=Buffer.from(await n.arrayBuffer());e.send(t)}function Ri(e,n){let t=Oe(e,n);return async(r,o,i)=>{try{let s=await t(uu(r));await cu(o,s)}catch(s){i(s)}}}function _i(e,n){let t=Oe(e,n);return r=>t(r.req.raw)}function Ei(e,n){let t=Oe(e,n);return{GET:t,POST:t,OPTIONS:t}}function Di(e){let n={[bn]:e};return{ok:Jn,tenants:{list:()=>Ge(e),create:t=>Yn(e,t),get:t=>Vn(e,t)},plugins:{list:()=>Ze(e),get:t=>zn(e,t)},connectionStatus:{get:t=>Qn(e,t?.tenantId)},permissions:{get:t=>ti(e,t)},connect:{createLink:t=>Xn(n,e,t),resolve:t=>et(n,e,t),oauthCallback:t=>nt(n,e,t)}}}async function Oi(e,n,t,r,o="pending"){if(!e)return null;try{let i=eo(),s=new Date;return await e.db.insertInto("corsair_events").values({id:i,created_at:s,updated_at:s,account_id:n,event_type:t,payload:r,status:o}).execute(),i}catch(i){return console.warn("Failed to log event:",i),null}}async function lu(e,n,t,r="pending"){try{let o=await e.$getAccountId();return Oi(e.database,o,n,t,r)}catch(o){return console.warn("Failed to log event:",o),null}}import*as Hi from"https";import*as mt from"querystring";var du=["expires_in","refresh_token_expires_in"];function Mi(e){let n={...e};for(let t of du){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function pu(e){try{return Mi(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=mt.parse(e);return!n.access_token&&!n.error?null:Mi({...n})}function Nn(e,n,t,r,o){let i=new URL(r.tokenUrl),s=r.tokenAuthMethod==="basic";return new Promise((a,u)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};s||(l.client_id=n,l.client_secret=t);let c=mt.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(c).toString()};s&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=Hi.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",y=>{f+=y}),g.on("end",()=>{if(g.statusCode!==200){u(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let y=pu(f);y?a(y):u(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>u(new Error(`Request failed: ${g.message}`))),p.write(c),p.end()})}var Fi="  ";function J(e){let n=e;return n._def??n.def??{}}function z(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function G(e){return e.innerType??e.schema??e.out??e.in}function Bi(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return G(e)}}function Li(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function kt(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Ye(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function Ni(e,n){return e.description??n.description}function gu(e){let n=e;for(;n;){let t=J(n),r=Ni(n,t);if(r)return r;let o=z(t);if($r(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=Bi(t,o);continue}break}}function $r(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function L(e){let n=J(e),t=z(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Ye(n)[0]??"unknown");case"ZodEnum":return Ye(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=G(n);return r?L(r):"unknown"}case"ZodNullable":{let r=G(n);return`${r?L(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=G(n);return r?L(r):"unknown"}case"ZodArray":{let r=Li(n);if(!r)return"unknown[]";let o=J(r),i=z(o)==="ZodUnion",s=L(r);return`${i?`(${s})`:s}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=kt(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([s,a])=>{let u=z(J(a));return`${u==="ZodOptional"||u==="ZodNullable"?s+"?":s}: ${L(a)}`}).join(", ")} }`}case"ZodUnion":return Ye(n).map(r=>L(r)).join(" | ");case"ZodIntersection":return`${L(n.left)} & ${L(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=Bi(n,t);return r?L(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function le(e){let n=J(e),t=z(n),r=Ni(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??Ye(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=Ye(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=G(n),i=o?le(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=G(n),i=o?le(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=G(n);return o?{...le(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=Li(n);return{kind:"array",optional:!1,description:r,items:o?le(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=kt(e,n),i={};for(let[s,a]of Object.entries(o))i[s]=le(a);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=Ye(n);for(let i of o){let s=J(i);if(z(s)==="ZodObject")return{...le(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=G(n);return o?{...le(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function oy(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),s=e.find(c=>c.id===o);if(!s)return null;let a=i;a.startsWith("api.")&&(a=a.slice(4));let u=we(s.endpointMeta,a),l=we(s.endpointSchemas,a);return!u&&!l?null:{input:l?.input?le(l.input):null,output:l?.output?le(l.output):null,description:u?.description}}var Wr=["equals","contains","startsWith","endsWith","in"],fu=["equals","gt","gte","lt","lte","in"],yu=["equals"],mu=["equals","before","after","between"];function $i(e){let n=J(e);switch(z(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=G(n);return r?$i(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function jr(e){let n=J(e),t=z(n);if($r(t)){let i=G(n);return i?jr(i):{}}if(t!=="ZodObject")return{};let r=kt(e,n),o={};for(let[i,s]of Object.entries(r)){let a=$i(s);a==="string"?o[i]={type:"string",operators:Wr}:a==="number"?o[i]={type:"number",operators:fu}:a==="boolean"?o[i]={type:"boolean",operators:yu}:a==="date"&&(o[i]={type:"date",operators:mu})}return o}function Wi(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function Br(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&Br(o,i,t)}}function Lr(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Nr(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];Lr(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&Nr(o,i,t)}}function Kr(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([a])=>a.toLowerCase()===t);if(!o)return null;let[i,s]=o;if(r.length===0)return Lr(s)?[i]:null;if(s!==null&&typeof s=="object"&&!Lr(s)){let a=Kr(s,r);if(a!==null)return[i,...a]}return null}function ji(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let s="    ".repeat(i+2);t.push(`${s}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let s="    ".repeat(i+2);t.push(`${s}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var hu=new Set(vn);function Me(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(a=>a.id===r);if(!i)return hu.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:Me(e);if(t==="webhooks"){if(!i.webhooks)return[];let a=[];return Nr(i.webhooks,[],a),a.map(u=>`${i.id}.webhooks.${u}`)}if(t==="db"){let a=i.schema?.entities;return a?Object.keys(a).map(u=>`${i.id}.db.${u}.search`):[]}if(!i.endpoints)return[];let s=[];return Br(i.endpoints,[],s),s.map(a=>`${i.id}.api.${a}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let s=[];Nr(i.webhooks,[],s),o[i.id]=s.map(a=>`${i.id}.webhooks.${a}`)}else if(t==="db")for(let i of e){let s=i.schema?.entities;s&&(o[i.id]=Object.keys(s).map(a=>`${i.id}.db.${a}.search`))}else for(let i of e){if(!i.endpoints)continue;let s=[];Br(i.endpoints,[],s),o[i.id]=s.map(a=>`${i.id}.api.${a}`)}return o}function we(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function ku(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),s=i.startsWith(".")?i.slice(1):i;return s.startsWith("api.")&&(s=s.slice(4)),{shortPath:s,lookupKey:s}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function Ur(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function iy(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),s=e.find(a=>a.id===o);if(s){if(i.startsWith("db.")){let c=i.slice(3),d=c.lastIndexOf(".");if(d!==-1){let p=c.slice(0,d),g=c.slice(d+1),f=s.schema?.entities;if(g==="search"&&f){let y=Wi(f,p);if(y){let[m,h]=y,b=jr(h),w=[`Search ${o} ${m} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${Wr.join(", ")}]`];for(let[R,x]of Object.entries(b))w.push(`  ${R}?: ${x.type}  [${x.operators.join(", ")}]`);return w.push("}"),w.join(`
+`)}}}return Ur(Me(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let c=i.slice(9);if(s.webhooks){let d=Kr(s.webhooks,c.split("."));if(d!==null){let p=d.join("."),g=we(s.webhookSchemas,p.toLowerCase()),f=g?.response?L(g.response):null,y=[];return g?.description&&y.push(g.description),g?.payload&&y.push(`payload ${ht(Qe(g.payload))}`),f&&y.push(`response: ${f}`),y.push(`usage:
+${ji(o,d)}`),y.join(`
+
+`)}}return Ur(Me(e,{type:"webhooks"}),"Path not found. Available webhooks")}let a=i;a.startsWith("api.")&&(a=a.slice(4));let u=we(s.endpointMeta,a),l=we(s.endpointSchemas,a);if(u||l){let c=[],d=[u?.riskLevel?`[${u.riskLevel}]`:"",u?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[u?.description,d].filter(Boolean).join("  ");return p&&c.push(p),l?.input&&c.push(`input ${ht(Qe(l.input))}`),l?.output&&c.push(`output ${ht(Qe(l.output))}`),c.join(`
+
+`)}}}return Ur(Me(e),"Path not found. Available operations")}function Ui(e){let n=e;for(;;){let t=J(n),r=z(t);if($r(r)){let o=G(t);if(!o)return n;n=o;continue}return n}}function Qe(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=Ui(e),t=J(n);if(z(t)==="ZodObject"){let o=kt(n,t),i=[];for(let[s,a]of Object.entries(o)){let u=J(a),l=z(u),c=l==="ZodOptional"||l==="ZodNullable",d=Ui(a),p=gu(a);i.push({key:s,optional:c,type:L(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:L(n)}}function ht(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=Fi.repeat(n+1),r=Fi.repeat(n);return`{
+${e.fields.map(i=>{let s=i.optional?`${i.key}?`:i.key,a=i.description?`  // ${i.description}`:"";return`${t}${s}: ${i.type}${a}`}).join(`
+`)}
+${r}}`}return"unknown"}function bu(e,n){let t=Me(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(c=>c.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let c of t){let{shortPath:d,lookupKey:p}=ku(c,n),g=we(r.endpointMeta,p),f=we(r.endpointSchemas,p);!g&&!f||o.push({path:c,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Qe(f?.input),output:Qe(f?.output)})}o.sort((c,d)=>c.path.localeCompare(d.path));let i=[],s=Me(e,{plugin:n,type:"webhooks"});if(Array.isArray(s)&&r.webhooks)for(let c of s){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),y=Kr(r.webhooks,f.split("."));if(y===null)continue;let m=y.join("."),h=we(r.webhookSchemas,m.toLowerCase()),b=h?.response?L(h.response):void 0;i.push({path:c,description:h?.description,payload:Qe(h?.payload),responseType:b,usageExample:ji(n,y)})}i.sort((c,d)=>c.path.localeCompare(d.path));let a=[],u=Me(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(u)&&l)for(let c of u){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),y=f.lastIndexOf(".");if(y===-1)continue;let m=f.slice(0,y);if(f.slice(y+1)!=="search")continue;let b=Wi(l,m);if(!b)continue;let[w,R]=b,x=jr(R),_=Object.entries(x).map(([k,T])=>({field:k,type:T.type,operators:T.operators}));a.push({path:c,entityName:w,filters:[{field:"entity_id",type:"string",operators:Wr},..._]})}return a.sort((c,d)=>c.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:a}}}import{randomUUID as Ki}from"crypto";async function Cu(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Ki(),o=Ki(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as wu}from"crypto";var bt="https://graph.microsoft.com/v1.0",qr=2e4,Tu=60;async function vu(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let u=await fetch(`${bt}/subscriptions`,{headers:r,signal:AbortSignal.timeout(qr)});if(u.ok){let{value:l}=await u.json(),c=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(c.map(d=>fetch(`${bt}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(qr)}).catch(()=>{})))}}catch{}let o=wu(),i=new Date(Date.now()+Tu*6e4).toISOString(),s=await fetch(`${bt}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(qr),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!s.ok)throw new Error(`MS Graph subscribe failed (${s.status}): ${await s.text()}`);let a=await s.json();return a.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:a.id},webhookSecret:o}):null}function qi(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function Pu(e,n){let t=qi(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function Au(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function Zi(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function Gi(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function Cn(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function xu(e){return Cn(e.body)}function Ji(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Ct(Array.isArray(r)?r:[r])}function zi(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let u of t){let l=Ct(Array.isArray(u)?u:[u]);if(l)return decodeURIComponent(l)}let r=Ji({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let u of o){let l=n[u],c=Array.isArray(l)?l[0]:l;if(!(!c||typeof c!="string"))try{let p=(c.startsWith("http")?new URL(c):new URL(`https://example.invalid${c.startsWith("/")?c:`/${c}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,s=Cn(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Ct([s?.validationToken])??null}function Iu(e){if(zi(e))return!0;let n=Cn(e.body??e.payload);return Zi(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Ct(e){for(let n of e){let t=Gi(n);if(t)return t}}function Su(e){let t=Cn(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var bn=Symbol.for("corsair:internal");function Vi(e){let n=e.database?zr(e.database):void 0,t=n&&e.kek?xi(e.plugins,n,e.kek):yt(!!n,!!e.kek),r=Ii(e),o={plugins:e.plugins,database:n,kek:e.kek,multiTenancy:!!e.multiTenancy,permissions:r,manual:e.manual,hub:e.hub?An(e.hub):void 0},i=Jo(n),s=Di(o);if(e.multiTenancy)return Object.assign({withTenant:u=>{if(!u)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let l=Fr(e.plugins,{database:n,tenantId:u,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:o.hub,internalConfig:o});return Object.assign(l,{[bn]:o})},keys:t,permissions:i,manage:s},{[bn]:o});let a=Fr(e.plugins,{database:n,tenantId:void 0,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:o.hub,internalConfig:o});return Object.assign({},a,{keys:t,permissions:i,manage:s,[bn]:o})}var Ru={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Zr=Ru;async function $n(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},s=n?.caller??"script",a=Yr(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let u=$u(e,a.plugins,n),l={...a,database:a.database},c=l.database.db;await Ku(c,i);let d=await qu(c,l,u.tenantId,u.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Ju(e,u,n.credentials,l,o,i);let p=await Vu(d,u,o,s);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=Vi({plugins:a.plugins,database:c,kek:a.kek,multiTenancy:!0}).withTenant(u.tenantId);await Yu(g,a.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function Gr(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...F[n][t],...r])}function Nu(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(a=>a.id===t);if(!o)continue;let i=I(o);if(!i)continue;let s=Gr(o,i,"account");for(let a of Object.keys(r))if(s.has(a))return!0}return!1}function $u(e,n,t){let r=Qr(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Nu(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function Qi(e,n){return de(e)?n===0?!0:Object.values(e).every(t=>Qi(t,n-1)):!1}function Wu(e){return Qi(e,4)}var ju={...no};function wt(e){if(e instanceof Hu){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Lu?wt(r):"unknown";return n}return e instanceof Ou?`${wt(e.unwrap())} | null`:e instanceof Fu?`${wt(e.unwrap())} | undefined`:e instanceof Du?e.options.join(" | "):e instanceof Bu?"string":e instanceof Mu?"number":e instanceof _u?"boolean":e instanceof Eu?"date":e instanceof Uu?"jsonb":"unknown"}async function Ku(e,n){let t=await e.introspection.getTables(),r=new Set(t.map(o=>o.name));for(let[o,i]of Object.entries(ju))r.has(o)||n(`[corsair:setup] Table "${o}" does not exist. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(wt(i),null,2)}`)}async function qu(e,n,t,r,o){let i=new Date,s=new Map;for(let a of n.plugins){let u=a.id,l=I(a),c=await e.selectFrom("corsair_integrations").selectAll().where("name","=",u).executeTakeFirst();if(!c){let y=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:y,name:u,config:{},created_at:i,updated_at:i}).execute(),c=await e.selectFrom("corsair_integrations").selectAll().where("id","=",y).executeTakeFirst(),o(`[corsair:setup] Created integration: ${u}`)}let d=l?a.authConfig?.[l]?.integration??[]:[],p=l?a.authConfig?.[l]?.account??[]:[],g=l&&c?D({authType:l,integrationName:u,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(c&&!c.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${u}`)),!c||!l||!g)continue;let f;if(r){let y=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",c.id).executeTakeFirst();if(!y){let m=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:m,tenant_id:t,integration_id:c.id,config:{},created_at:i,updated_at:i}).execute(),y=await e.selectFrom("corsair_accounts").selectAll().where("id","=",m).executeTakeFirst(),o(`[corsair:setup] Created account: ${u}`)}f=y&&E({authType:l,integrationName:u,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),y&&f&&!y.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${u}`))}s.set(u,{pluginId:u,authType:l,integration:g,account:f,integrationFields:[...F[l].integration,...d],accountFields:r?[...F[l].account,...p]:[]})}return s}function Zu(e){if(!de(e))return;let n=e.keys;return de(n)?n:void 0}function Gu(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Ju(e,n,t,r,o,i){let s=Zu(e),a=n.provisionAccounts?Gu(e,n.tenantId):void 0;for(let[u,l]of Object.entries(t)){let c=r.plugins.find(h=>h.id===u);if(!c){i(`[corsair:setup] Unknown plugin '${u}' \u2014 skipping credentials.`);continue}let d=I(c);if(!d){i(`[corsair:setup] Plugin '${u}' has no auth type \u2014 skipping credentials.`);continue}let p=Gr(c,d,"integration"),g=Gr(c,d,"account"),f=s?.[u],y=a?.[u],m=de(y)?y.keys:void 0;for(let[h,b]of Object.entries(l))if(b){if(p.has(h)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${u}.${h}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let w=N(f,`set_${h}`);if(!w){i(`[corsair:setup] Cannot set integration field '${h}' for '${u}'.`);continue}await w(b),o(`[corsair:setup] Set ${u} integration.${h}`);continue}if(g.has(h)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${u}.${h}' on a multi-tenant instance`);let w=N(m,`set_${h}`);if(!w){i(`[corsair:setup] Cannot set account field '${h}' for '${u}'.`);continue}await w(b),o(`[corsair:setup] Set ${u} account.${h} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${h}' for plugin '${u}'.`)}}}var Yi=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function zu(e,n,t,r,o,i,s,a,u){let l=[],c=[];for(let p of o){if(Yi.has(p))continue;let g=N(t,`get_${p}`);if(!g)continue;let f=null;try{let y=await g();f=typeof y=="string"?y:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(Yi.has(p))continue;let g=N(r,`get_${p}`);if(!g)continue;let f=null;try{let y=await g();f=typeof y=="string"?y:null}catch{}f||c.push(p)}let d=l.length===0&&c.length===0;if(d)a(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")a(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...c];if(u==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");a(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of c){let y=s.provisionAccounts?s.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(s.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${y}.keys.set_${f}(value)`)}a(g.join(`
+`))}}return d}async function Vu(e,n,t,r){let o=new Set;for(let i of e.values())await zu(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function Yu(e,n,t,r,o){if(!Wu(Zr)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=Zr,s=new Set(n.map(a=>a.id));for(let[a,u]of Object.entries(i)){if(!s.has(a))continue;if(!t.has(a)){r(`[corsair:setup] Skipping backfill for '${a}' \u2014 auth not configured.`);continue}let l=de(e)?e[a]:void 0,c=de(l)?l.api:void 0;if(c)for(let[d,p]of Object.entries(u))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${a} \u203A ${d}.${g}...`);try{let y=de(c)?c[d]:void 0;await N(y,g)?.(f)}catch(y){o(`[corsair:setup] ${a} \u203A ${d}.${g} failed: `+(y instanceof Error?y.message:String(y)))}}}}export{ro as a,pe as b,Pt as c,nn as d,oo as e,io as f,ge as g,Pe as h,oe as i,Fe as j,Ue as k,fe as l,xt as m,ao as n,on as o,ie as p,An as q,M as r,xn as s,Be as t,In as u,Sn as v,Rn as w,_n as x,co as y,En as z,ye as A,se as B,ae as C,q as D,St as E,an as F,me as G,ue as H,un as I,D as J,E as K,Co as L,wo as M,$n as N,Ju as O,ke as P,_t as Q,$e as R,We as S,Ot as T,Bn as U,Eo as V,Se as W,B as X,Mt as Y,pn as Z,Ho as _,Us as $,Wn as aa,Dl as ba,Bo as ca,Lo as da,No as ea,Ht as fa,jn as ga,Wo as ha,jo as ia,Ft as ja,Kn as ka,qn as la,qe as ma,Gn as na,Vs as oa,Go as pa,Wt as qa,Jt as ra,tt as sa,zt as ta,Je as ua,ze as va,rt as wa,ot as xa,gn as ya,Vt as za,Yt as Aa,it as Ba,fn as Ca,st as Da,at as Ea,Ce as Fa,Ve as Ga,ui as Ha,tr as Ia,Ee as Ja,hn as Ka,kn as La,gt as Ma,ir as Na,sr as Oa,cr as Pa,lr as Qa,dr as Ra,pr as Sa,gr as Ta,De as Ua,$ as Va,fr as Wa,hi as Xa,ki as Ya,yr as Za,mr as _a,hr as $a,kr as ab,br as bb,Cr as cb,wr as db,Tr as eb,vr as fb,Pr as gb,Ar as hb,xr as ib,Ir as jb,Sr as kb,Rr as lb,Oe as mb,Ri as nb,_i as ob,Ei as pb,Oi as qb,lu as rb,Nn as sb,oy as tb,Me as ub,iy as vb,ht as wb,bu as xb,Cu as yb,bt as zb,vu as Ab,qi as Bb,Pu as Cb,Au as Db,Zi as Eb,Gi as Fb,Cn as Gb,xu as Hb,Ji as Ib,zi as Jb,Iu as Kb,Ct as Lb,Su as Mb,bn as Nb,Vi as Ob};

package/dist/client/react/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Tenant, C as CreateTenantInput, P as PluginInfo, a as ConnectionStatus, b as PermissionRecord, c as ConnectLink, d as CreateConnectLinkInput, O as OAuthCallbackResult, e as OAuthCallbackInput } from '../../types-1nBbBn-U.js';
-export { f as PermissionLookupInput } from '../../types-1nBbBn-U.js';
-import { C as CorsairClientOptions, a as CorsairManagementClient } from '../../types-DvDEtIUw.js';
+import { T as Tenant, C as CreateTenantInput, P as PluginInfo, a as ConnectionStatus, b as PermissionRecord, c as ConnectLink, d as CreateConnectLinkInput, O as OAuthCallbackResult, e as OAuthCallbackInput } from '../../types-Bsv_KdHs.js';
+export { f as PermissionLookupInput } from '../../types-Bsv_KdHs.js';
+import { C as CorsairClientOptions, a as CorsairManagementClient } from '../../types-MvrzaDrs.js';
 import '../../index-eydqYIn0.js';
 import 'zod';
 

package/dist/connect-JHARP4KN.js

@@ -0,0 +1 @@
+import{ea as a,fa as b,ga as c}from"./chunk-YKXOTEYL.js";import"./chunk-WDF3YE27.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/core.d.ts

@@ -1,10 +1,10 @@
-export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair } from './index-D7aqzKjb.js';
+export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair } from './index-BpAiZmOk.js';
 import { CorsairDatabase } from './db.js';
-import { A as AccountKeyManagerFor, I as IntegrationKeyManagerFor, f as CorsairPluginSubscribeResult } from './index-DwegPGYj.js';
-export { g as AccountFieldNames, k as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, h as BaseKeyManager, M as BeforeHookResult, n as BindEndpoints, a8 as BindWebhooks, a6 as Bivariant, o as BoundEndpointFn, p as BoundEndpointTree, a9 as BoundWebhook, aa as BoundWebhookTree, m as CorsairClient, q as CorsairContext, r as CorsairEndpoint, t as CorsairErrorHandler, c as CorsairIntegration, N as CorsairKeyBuilder, Q as CorsairKeyBuilderBase, ab as CorsairOAuthWebhookTenantLinkResolver, z as CorsairPermissionsNamespace, C as CorsairPlugin, S as CorsairPluginContext, U as CorsairPluginSubscribe, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, ac as CorsairWebhook, ad as CorsairWebhookHandler, ae as CorsairWebhookMatcher, af as CorsairWebhookTenantMatcher, V as EndpointHooks, X as EndpointMetaEntry, E as EndpointPathsOf, Y as EndpointRiskLevel, s as EndpointTree, D as EnforcePermissionOptions, F as EnforcePermissionResult, u as ErrorContext, v as ErrorHandler, w as ErrorHandlerAndMatchFunction, x as ErrorMatcher, i as IntegrationFieldNames, Z as KeyBuilderContext, j as OAuth2IntegrationCredentials, O as OAuthConfig, _ as PermissionMode, $ as PermissionPolicy, P as PluginAuthConfig, a0 as PluginEndpointMeta, a1 as PluginPermissionsConfig, ag as RawWebhookRequest, K as ReadonlyForbiddenError, a2 as RequiredPluginEndpointMeta, a3 as RequiredPluginEndpointSchemas, a4 as RequiredPluginWebhookSchemas, R as RetryStrategies, y as RetryStrategy, T as TokenResponse, a7 as UnionToIntersection, a5 as WebhookHooks, ah as WebhookPathsOf, ai as WebhookRequest, aj as WebhookResponse, W as WebhookTenantMatch, ak as WebhookTree, G as assertReadonlyAllowed, l as exchangeCodeForTokens, J as isReadonlyScopeActive, L as runReadonly } from './index-DwegPGYj.js';
-export { A as AuthMissingError, D as DocSchemaFieldRow, a as DocSchemaShape, b as DocsApiEndpoint, c as DocsDbEntity, d as DocsDbFilterField, e as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, P as PluginDocsIntrospection, j as PluginWebhookMatchers, R as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, k as asRecord, g as collectPluginWebhookMatchers, l as decodePubSubData, n as extractMicrosoftGraphValidationToken, o as firstString, f as formatDocSchemaShape, p as getHeader, i as introspectPluginForDocs, q as isMicrosoftGraphValidationHandshake, m as matchWebhookPlugin, h as matchWebhookPluginAndTenant, s as readBodyRecord, t as readQueryParam, r as resolveConnectLink, u as toExternalId } from './tenant-match-utils-f49OxmPU.js';
-import { A as AuthTypes } from './types-1nBbBn-U.js';
-export { g as AllProviders, B as BaseProviders, h as PickAuth, j as ProviderDisplayNames, i as formatProviderDisplayName } from './types-1nBbBn-U.js';
+import { A as AccountKeyManagerFor, I as IntegrationKeyManagerFor, f as CorsairPluginSubscribeResult } from './index-bq7b_mHy.js';
+export { g as AccountFieldNames, a6 as AgentReply, k as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, h as BaseKeyManager, M as BeforeHookResult, n as BindEndpoints, ae as BindWebhooks, ac as Bivariant, o as BoundEndpointFn, p as BoundEndpointTree, af as BoundWebhook, ag as BoundWebhookTree, m as CorsairClient, q as CorsairContext, r as CorsairEndpoint, t as CorsairErrorHandler, c as CorsairIntegration, N as CorsairKeyBuilder, Q as CorsairKeyBuilderBase, ah as CorsairOAuthWebhookTenantLinkResolver, z as CorsairPermissionsNamespace, C as CorsairPlugin, S as CorsairPluginContext, U as CorsairPluginSubscribe, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, a7 as CorsairThreadsNamespace, ai as CorsairWebhook, aj as CorsairWebhookHandler, ak as CorsairWebhookMatcher, al as CorsairWebhookTenantMatcher, a8 as CreateThreadResult, V as EndpointHooks, X as EndpointMetaEntry, E as EndpointPathsOf, Y as EndpointRiskLevel, s as EndpointTree, D as EnforcePermissionOptions, F as EnforcePermissionResult, u as ErrorContext, v as ErrorHandler, w as ErrorHandlerAndMatchFunction, x as ErrorMatcher, i as IntegrationFieldNames, Z as KeyBuilderContext, j as OAuth2IntegrationCredentials, O as OAuthConfig, _ as PermissionMode, $ as PermissionPolicy, P as PluginAuthConfig, a0 as PluginEndpointMeta, a1 as PluginPermissionsConfig, am as RawWebhookRequest, K as ReadonlyForbiddenError, a2 as RequiredPluginEndpointMeta, a3 as RequiredPluginEndpointSchemas, a4 as RequiredPluginWebhookSchemas, R as RetryStrategies, y as RetryStrategy, a9 as ThreadHandle, aa as ThreadMessage, ab as ThreadSummary, T as TokenResponse, ad as UnionToIntersection, a5 as WebhookHooks, an as WebhookPathsOf, ao as WebhookRequest, ap as WebhookResponse, W as WebhookTenantMatch, aq as WebhookTree, G as assertReadonlyAllowed, l as exchangeCodeForTokens, J as isReadonlyScopeActive, L as runReadonly } from './index-bq7b_mHy.js';
+export { A as AuthMissingError, D as DocSchemaFieldRow, a as DocSchemaShape, b as DocsApiEndpoint, c as DocsDbEntity, d as DocsDbFilterField, e as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, g as PermissionRequiredError, P as PluginDocsIntrospection, k as PluginWebhookMatchers, R as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, l as asRecord, h as collectPluginWebhookMatchers, n as decodePubSubData, o as extractMicrosoftGraphValidationToken, p as firstString, f as formatDocSchemaShape, q as getHeader, i as introspectPluginForDocs, s as isMicrosoftGraphValidationHandshake, m as matchWebhookPlugin, j as matchWebhookPluginAndTenant, t as readBodyRecord, u as readQueryParam, r as resolveConnectLink, v as toExternalId } from './tenant-match-utils-BEm23hGX.js';
+import { A as AuthTypes } from './types-Bsv_KdHs.js';
+export { g as AllProviders, B as BaseProviders, h as PickAuth, j as ProviderDisplayNames, i as formatProviderDisplayName } from './types-Bsv_KdHs.js';
 import 'kysely';
 import './index-eydqYIn0.js';
 import 'zod';

package/dist/core.js

@@ -1 +1 @@
-import{Ab as F,B as d,Bb as G,C as e,Cb as H,D as f,Db as I,E as g,Eb as J,F as h,Fb as K,G as i,Gb as L,H as j,Hb as M,I as k,Ib as N,J as l,Jb as O,K as m,Kb as P,L as n,Lb as Q,M as o,Sa as u,a,b,ja as p,ma as q,na as r,nb as v,oa as s,ob as w,pa as t,pb as x,tb as y,ub as z,vb as A,wb as B,xb as C,yb as D,zb as E}from"./chunk-6WGGD3SS.js";import{h as c}from"./chunk-BPFUYXOD.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{u as AuthMissingError,c as BASE_AUTH_FIELDS,P as CORSAIR_INTERNAL,B as MS_GRAPH_API_BASE,a as ProviderDisplayNames,q as ReadonlyForbiddenError,I as asRecord,t as assertReadonlyAllowed,F as collectPluginWebhookMatchers,m as createAccountKeyManager,Q as createCorsair,l as createIntegrationKeyManager,O as decodePubSubData,j as decryptConfig,f as decryptDEK,h as decryptWithDEK,i as encryptConfig,e as encryptDEK,g as encryptWithDEK,x as exchangeCodeForTokens,L as extractMicrosoftGraphValidationToken,N as firstString,y as formatDocSchemaShape,b as formatProviderDisplayName,d as generateDEK,G as getHeader,A as googleChannelSubscribe,o as initializeAccountDEK,n as initializeIntegrationDEK,z as introspectPluginForDocs,M as isMicrosoftGraphValidationHandshake,s as isReadonlyScopeActive,v as logEvent,w as logEventFromContext,D as matchWebhookPlugin,E as matchWebhookPluginAndTenant,C as msGraphSubscribe,k as reEncryptConfig,J as readBodyRecord,K as readQueryParam,p as resolveConnectLink,r as runReadonly,H as toExternalId};
+import{Ab as D,B as d,Bb as E,C as e,Cb as F,D as f,Db as G,E as g,Eb as H,F as h,Fb as I,G as i,Gb as J,H as j,Hb as K,I as k,Ib as L,J as l,Jb as M,K as m,Kb as N,L as n,Lb as O,M as o,Mb as P,Nb as Q,Ob as R,Va as v,a,b,ja as p,ma as q,na as r,oa as s,pa as t,qa as u,qb as w,rb as x,sb as y,wb as z,xb as A,yb as B,zb as C}from"./chunk-YKXOTEYL.js";import{h as c}from"./chunk-WDF3YE27.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{v as AuthMissingError,c as BASE_AUTH_FIELDS,Q as CORSAIR_INTERNAL,C as MS_GRAPH_API_BASE,q as PermissionRequiredError,a as ProviderDisplayNames,r as ReadonlyForbiddenError,J as asRecord,u as assertReadonlyAllowed,G as collectPluginWebhookMatchers,m as createAccountKeyManager,R as createCorsair,l as createIntegrationKeyManager,P as decodePubSubData,j as decryptConfig,f as decryptDEK,h as decryptWithDEK,i as encryptConfig,e as encryptDEK,g as encryptWithDEK,y as exchangeCodeForTokens,M as extractMicrosoftGraphValidationToken,O as firstString,z as formatDocSchemaShape,b as formatProviderDisplayName,d as generateDEK,H as getHeader,B as googleChannelSubscribe,o as initializeAccountDEK,n as initializeIntegrationDEK,A as introspectPluginForDocs,N as isMicrosoftGraphValidationHandshake,t as isReadonlyScopeActive,w as logEvent,x as logEventFromContext,E as matchWebhookPlugin,F as matchWebhookPluginAndTenant,D as msGraphSubscribe,k as reEncryptConfig,K as readBodyRecord,L as readQueryParam,p as resolveConnectLink,s as runReadonly,I as toExternalId};

package/dist/hub.d.ts

@@ -1,10 +1,10 @@
-import { A as AuthTypes } from './types-1nBbBn-U.js';
-export { i as formatProviderDisplayName } from './types-1nBbBn-U.js';
-import { am as HubOAuthMode, an as HubConnectSessionResult, ao as HubPermissionSessionResult, H as HubConfig, ap as HubConfigInput, aq as HubConnectSessionInput, ar as HubListProjectConnectionsInput, A as AccountKeyManagerFor, as as HubPermissionSessionInput } from './index-DwegPGYj.js';
-export { at as DEFAULT_HUB_API_URL, au as HubEnvironmentSlug } from './index-DwegPGYj.js';
-import { g as TunnelType, c as ProcessCorsairRequest, h as WebhookTenantLink } from './index-CdzrawUJ.js';
-export { i as BROWSER_DELIVERY_TTL_MS, j as BrowserDeliveryMode, B as BrowserDeliveryPayload, S as SIGNED_TUNNEL_REPLAY_WINDOW_MS, f as TunnelEnvelope } from './index-CdzrawUJ.js';
-export { b as buildBrowserDeliveryRedirectUrl, s as signBrowserDeliveryToken, v as verifyBrowserDeliveryToken } from './browser-delivery-ARqe7lph.js';
+import { A as AuthTypes } from './types-Bsv_KdHs.js';
+export { i as formatProviderDisplayName } from './types-Bsv_KdHs.js';
+import { as as HubOAuthMode, at as HubConnectSessionResult, au as HubPermissionSessionResult, H as HubConfig, av as HubConfigInput, aw as HubConnectSessionInput, ax as HubListProjectConnectionsInput, A as AccountKeyManagerFor, ay as HubPermissionSessionInput } from './index-bq7b_mHy.js';
+export { az as DEFAULT_HUB_API_URL, aA as HubEnvironmentSlug } from './index-bq7b_mHy.js';
+import { j as TunnelType, R as RunResultPayload, f as ProcessCorsairRequest, l as WebhookTenantLink } from './index-DnJqGDij.js';
+export { m as BROWSER_DELIVERY_TTL_MS, n as BrowserDeliveryMode, B as BrowserDeliveryPayload, S as SIGNED_TUNNEL_REPLAY_WINDOW_MS, i as TunnelEnvelope } from './index-DnJqGDij.js';
+export { b as buildBrowserDeliveryRedirectUrl, s as signBrowserDeliveryToken, v as verifyBrowserDeliveryToken } from './browser-delivery-B7lsTRG3.js';
 import './index-eydqYIn0.js';
 import 'zod';
 import './db.js';
@@ -220,7 +220,13 @@ type ServerDeliveryAckBody = {
     sync?: {
         encrypted: string;
     };
+    /** Workflow execution outcome returned by `run` deliveries. */
+    run?: RunResultPayload;
 };
+/**
+ * Reads the workflow run outcome from a parsed delivery ack body.
+ */
+declare function extractRunFromDeliveryAck(body: ServerDeliveryAckBody): RunResultPayload | null;
 /**
  * Signs a tunnel envelope for server POST delivery.
  *
@@ -577,4 +583,4 @@ declare function decodePermissionTokenFromPath(encoded: string): string;
  */
 declare function createSignedTokenJti(): string;
 
-export { type ClientBridgeDeliverySpec, type ClientBridgeTransportResult, type ConnectAuthFieldStatus, type ConnectAuthKind, type ConnectAuthStatusLevel, type ConnectCreateLinkDeliveryResult, type ConnectPluginManifestEntry, type ConnectSessionTokenPayload, type ConnectStatusPluginEntry, type ConnectStatusResponse, type ConnectTokenPayload, type CreateConnectSessionRequestBody, type CreatePermissionSessionRequestBody, type FormatServerDeliveryErrorInput, HubConfig, HubConfigInput, HubConnectSessionInput, HubConnectSessionResult, type HubDeliveryRequest, type HubDeliveryResult, HubListProjectConnectionsInput, HubNotConfiguredError, HubOAuthMode, type HubOAuthRefreshResponse, HubPermissionSessionInput, HubPermissionSessionResult, type HubProjectConnection, type ManagedAccessTokenResult, type ManagedAuthContext, ManagedOAuthDeliveryError, type PermissionTokenPayload, type PrepareClientBridgeDeliveryTransportInput, type ProcessManagedOAuthDeliveryOptions, type ProcessManagedOAuthDeliveryResult, type ServerDeliveryAckBody, type SignedDeliveryHeaders, type SignedEnvelopeDeliveryResult, TunnelType, attachManagedRefreshAuth, buildClientBridgeBrowserDeliveryUrl, createConnectSessionJti, createConnectTokenJti, createHubConnectSession, createHubPermissionSession, createHubRouteHandlers, createPermissionSessionJti, createSignedTokenJti, decodeConnectSessionTokenFromPath, decodeConnectTokenFromPath, decodePermissionTokenFromPath, deliverConnectCreateLink, deliverSignedEnvelope, describeDeliveryNetworkError, encodeConnectTokenForPath, extractConnectLinkFromDeliveryAck, extractSyncFromDeliveryAck, formatHubApprovalMessage, formatServerDeliveryError, getConnectSessionExpiryMs, getConnectStatusForTenant, getConnectTokenExpiryMs, getHubConfig, getManagedAccessToken, handleHubDeliveryGet, handleHubDeliveryPost, handleHubDeliveryRequest, hubDeliveryToResponse, inferHubEnvironmentSlug, isLoopbackUrl, isServerDeliveryAckSuccessful, listHubProjectConnections, normalizeHubConfig, parseConnectLinkFromDeliveryBody, parseConnectSessionResponse, parseConnectStatusResponse, parseHubApiErrorBody, parseOAuthRefreshResponse, parsePermissionSessionResponse, parseProjectConnectionsResponse, parseServerDeliveryAckBody, parseSyncFromDeliveryBody, prepareClientBridgeDeliveryTransport, processManagedOAuthDelivery, registerHubWebhookTenantLink, resolveDeliveryTransport, resolveHubDeliveryUrl, resolveHubOAuthCallbackUrl, respondToHubDelivery, respondToHubDeliveryFromRequest, signConnectSessionToken, signConnectToken, signDeliveryEnvelope, signPermissionToken, usesBrowserDelivery, validateProductionDeliveryUrl, verifyConnectSessionToken, verifyConnectToken, verifyDeliveryEnvelope, verifyPermissionToken, verifySignedTunnelDelivery };
+export { type ClientBridgeDeliverySpec, type ClientBridgeTransportResult, type ConnectAuthFieldStatus, type ConnectAuthKind, type ConnectAuthStatusLevel, type ConnectCreateLinkDeliveryResult, type ConnectPluginManifestEntry, type ConnectSessionTokenPayload, type ConnectStatusPluginEntry, type ConnectStatusResponse, type ConnectTokenPayload, type CreateConnectSessionRequestBody, type CreatePermissionSessionRequestBody, type FormatServerDeliveryErrorInput, HubConfig, HubConfigInput, HubConnectSessionInput, HubConnectSessionResult, type HubDeliveryRequest, type HubDeliveryResult, HubListProjectConnectionsInput, HubNotConfiguredError, HubOAuthMode, type HubOAuthRefreshResponse, HubPermissionSessionInput, HubPermissionSessionResult, type HubProjectConnection, type ManagedAccessTokenResult, type ManagedAuthContext, ManagedOAuthDeliveryError, type PermissionTokenPayload, type PrepareClientBridgeDeliveryTransportInput, type ProcessManagedOAuthDeliveryOptions, type ProcessManagedOAuthDeliveryResult, type ServerDeliveryAckBody, type SignedDeliveryHeaders, type SignedEnvelopeDeliveryResult, TunnelType, attachManagedRefreshAuth, buildClientBridgeBrowserDeliveryUrl, createConnectSessionJti, createConnectTokenJti, createHubConnectSession, createHubPermissionSession, createHubRouteHandlers, createPermissionSessionJti, createSignedTokenJti, decodeConnectSessionTokenFromPath, decodeConnectTokenFromPath, decodePermissionTokenFromPath, deliverConnectCreateLink, deliverSignedEnvelope, describeDeliveryNetworkError, encodeConnectTokenForPath, extractConnectLinkFromDeliveryAck, extractRunFromDeliveryAck, extractSyncFromDeliveryAck, formatHubApprovalMessage, formatServerDeliveryError, getConnectSessionExpiryMs, getConnectStatusForTenant, getConnectTokenExpiryMs, getHubConfig, getManagedAccessToken, handleHubDeliveryGet, handleHubDeliveryPost, handleHubDeliveryRequest, hubDeliveryToResponse, inferHubEnvironmentSlug, isLoopbackUrl, isServerDeliveryAckSuccessful, listHubProjectConnections, normalizeHubConfig, parseConnectLinkFromDeliveryBody, parseConnectSessionResponse, parseConnectStatusResponse, parseHubApiErrorBody, parseOAuthRefreshResponse, parsePermissionSessionResponse, parseProjectConnectionsResponse, parseServerDeliveryAckBody, parseSyncFromDeliveryBody, prepareClientBridgeDeliveryTransport, processManagedOAuthDelivery, registerHubWebhookTenantLink, resolveDeliveryTransport, resolveHubDeliveryUrl, resolveHubOAuthCallbackUrl, respondToHubDelivery, respondToHubDeliveryFromRequest, signConnectSessionToken, signConnectToken, signDeliveryEnvelope, signPermissionToken, usesBrowserDelivery, validateProductionDeliveryUrl, verifyConnectSessionToken, verifyConnectToken, verifyDeliveryEnvelope, verifyPermissionToken, verifySignedTunnelDelivery };

package/dist/hub.js

@@ -1 +1 @@
-import{$a as ha,A as z,Aa as Q,Ba as R,Ca as S,Da as T,Ea as U,Ma as V,Na as W,Oa as X,P as A,Pa as Y,Qa as Z,Ra as _,Ta as $,Ua as aa,Va as ba,Wa as ca,Xa as da,Ya as ea,Za as fa,_a as ga,ab as ia,b as a,bb as ja,c as b,cb as ka,d as c,db as la,e as d,eb as ma,f as e,fb as na,g as f,ga as B,gb as oa,h as g,ha as C,hb as pa,i as h,ia as D,ib as qa,j as i,k as j,ka as E,l as k,la as F,m as l,n as m,o as n,p as o,q as p,qa as G,r as q,ra as H,s as r,sa as I,t as s,ta as J,u as t,ua as K,v as u,va as L,w as v,wa as M,x as w,xa as N,y as x,ya as O,z as y,za as P}from"./chunk-6WGGD3SS.js";import"./chunk-BPFUYXOD.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{f as BROWSER_DELIVERY_TTL_MS,n as DEFAULT_HUB_API_URL,o as HubNotConfiguredError,T as ManagedOAuthDeliveryError,g as SIGNED_TUNNEL_REPLAY_WINDOW_MS,aa as attachManagedRefreshAuth,i as buildBrowserDeliveryRedirectUrl,l as buildClientBridgeBrowserDeliveryUrl,ca as createConnectSessionJti,ha as createConnectTokenJti,B as createHubConnectSession,E as createHubPermissionSession,ba as createHubRouteHandlers,na as createPermissionSessionJti,h as createSignedTokenJti,ga as decodeConnectSessionTokenFromPath,ma as decodeConnectTokenFromPath,qa as decodePermissionTokenFromPath,O as deliverConnectCreateLink,S as deliverSignedEnvelope,Q as describeDeliveryNetworkError,la as encodeConnectTokenForPath,M as extractConnectLinkFromDeliveryAck,L as extractSyncFromDeliveryAck,F as formatHubApprovalMessage,a as formatProviderDisplayName,R as formatServerDeliveryError,da as getConnectSessionExpiryMs,C as getConnectStatusForTenant,ia as getConnectTokenExpiryMs,q as getHubConfig,$ as getManagedAccessToken,V as handleHubDeliveryGet,W as handleHubDeliveryPost,Y as handleHubDeliveryRequest,X as hubDeliveryToResponse,s as inferHubEnvironmentSlug,b as isLoopbackUrl,K as isServerDeliveryAckSuccessful,D as listHubProjectConnections,p as normalizeHubConfig,N as parseConnectLinkFromDeliveryBody,t as parseConnectSessionResponse,x as parseConnectStatusResponse,y as parseHubApiErrorBody,w as parseOAuthRefreshResponse,v as parsePermissionSessionResponse,u as parseProjectConnectionsResponse,J as parseServerDeliveryAckBody,P as parseSyncFromDeliveryBody,m as prepareClientBridgeDeliveryTransport,U as processManagedOAuthDelivery,A as registerHubWebhookTenantLink,c as resolveDeliveryTransport,z as resolveHubDeliveryUrl,r as resolveHubOAuthCallbackUrl,Z as respondToHubDelivery,_ as respondToHubDeliveryFromRequest,j as signBrowserDeliveryToken,ea as signConnectSessionToken,ja as signConnectToken,G as signDeliveryEnvelope,oa as signPermissionToken,d as usesBrowserDelivery,e as validateProductionDeliveryUrl,k as verifyBrowserDeliveryToken,fa as verifyConnectSessionToken,ka as verifyConnectToken,H as verifyDeliveryEnvelope,pa as verifyPermissionToken,I as verifySignedTunnelDelivery};
+import{$a as fa,A as z,Aa as P,Ba as Q,Ca as R,Da as S,Ea as T,Fa as U,Ga as V,Pa as W,Qa as X,R as A,Ra as Y,Sa as Z,Ta as _,Ua as $,Wa as aa,Xa as ba,Ya as ca,Za as da,_a as ea,ab as ga,b as a,bb as ha,c as b,cb as ia,d as c,db as ja,e as d,eb as ka,f as e,fb as la,g as f,ga as B,gb as ma,h as g,ha as C,hb as na,i as h,ia as D,ib as oa,j as i,jb as pa,k as j,ka as E,kb as qa,l as k,la as F,lb as ra,m as l,n as m,o as n,p as o,q as p,r as q,ra as G,s as r,sa as H,t as s,ta as I,u as t,ua as J,v as u,va as K,w as v,wa as L,x as w,xa as M,y as x,ya as N,z as y,za as O}from"./chunk-YKXOTEYL.js";import"./chunk-WDF3YE27.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{f as BROWSER_DELIVERY_TTL_MS,n as DEFAULT_HUB_API_URL,o as HubNotConfiguredError,U as ManagedOAuthDeliveryError,g as SIGNED_TUNNEL_REPLAY_WINDOW_MS,ba as attachManagedRefreshAuth,i as buildBrowserDeliveryRedirectUrl,l as buildClientBridgeBrowserDeliveryUrl,da as createConnectSessionJti,ia as createConnectTokenJti,B as createHubConnectSession,E as createHubPermissionSession,ca as createHubRouteHandlers,oa as createPermissionSessionJti,h as createSignedTokenJti,ha as decodeConnectSessionTokenFromPath,na as decodeConnectTokenFromPath,ra as decodePermissionTokenFromPath,P as deliverConnectCreateLink,T as deliverSignedEnvelope,R as describeDeliveryNetworkError,ma as encodeConnectTokenForPath,N as extractConnectLinkFromDeliveryAck,G as extractRunFromDeliveryAck,M as extractSyncFromDeliveryAck,F as formatHubApprovalMessage,a as formatProviderDisplayName,S as formatServerDeliveryError,ea as getConnectSessionExpiryMs,C as getConnectStatusForTenant,ja as getConnectTokenExpiryMs,q as getHubConfig,aa as getManagedAccessToken,W as handleHubDeliveryGet,X as handleHubDeliveryPost,Z as handleHubDeliveryRequest,Y as hubDeliveryToResponse,s as inferHubEnvironmentSlug,b as isLoopbackUrl,L as isServerDeliveryAckSuccessful,D as listHubProjectConnections,p as normalizeHubConfig,O as parseConnectLinkFromDeliveryBody,t as parseConnectSessionResponse,x as parseConnectStatusResponse,y as parseHubApiErrorBody,w as parseOAuthRefreshResponse,v as parsePermissionSessionResponse,u as parseProjectConnectionsResponse,K as parseServerDeliveryAckBody,Q as parseSyncFromDeliveryBody,m as prepareClientBridgeDeliveryTransport,V as processManagedOAuthDelivery,A as registerHubWebhookTenantLink,c as resolveDeliveryTransport,z as resolveHubDeliveryUrl,r as resolveHubOAuthCallbackUrl,_ as respondToHubDelivery,$ as respondToHubDeliveryFromRequest,j as signBrowserDeliveryToken,fa as signConnectSessionToken,ka as signConnectToken,H as signDeliveryEnvelope,pa as signPermissionToken,d as usesBrowserDelivery,e as validateProductionDeliveryUrl,k as verifyBrowserDeliveryToken,ga as verifyConnectSessionToken,la as verifyConnectToken,I as verifyDeliveryEnvelope,qa as verifyPermissionToken,J as verifySignedTunnelDelivery};

package/dist/{index-D7aqzKjb.d.ts → index-BpAiZmOk.d.ts}

@@ -1,5 +1,5 @@
 import { CorsairDatabase } from './db.js';
-import { C as CorsairPlugin, a as CorsairPermissionsOptions, b as CorsairManualConfig, H as HubConfig, c as CorsairIntegration, d as CorsairTenantWrapper, e as CorsairSingleTenantClient } from './index-DwegPGYj.js';
+import { C as CorsairPlugin, a as CorsairPermissionsOptions, b as CorsairManualConfig, H as HubConfig, c as CorsairIntegration, d as CorsairTenantWrapper, e as CorsairSingleTenantClient } from './index-bq7b_mHy.js';
 
 declare const CORSAIR_INTERNAL: unique symbol;
 type CorsairInternalConfig = {