corsair 0.1.115 → 0.1.117

package/dist/{browser-delivery-DzIPy41I.d.ts → browser-delivery-Bvf8JqTz.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index--jxBUCjh.js';
+import { B as BrowserDeliveryPayload } from './index-z0tnVuER.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/{chunk-IGGCNGU2.js → chunk-F2EV3CHK.js}

@@ -1 +1 @@
-import{a as c}from"./chunk-QAIKSQAD.js";import{Kysely as o,PostgresDialect as f,SqliteDialect as C}from"kysely";import{PostgresJSDialect as b}from"kysely-postgres-js";function _(t){return typeof t.query=="function"&&typeof t.connect=="function"}function m(t){let r=t;return typeof r.prepare=="function"&&typeof r.exec=="function"&&typeof r.close=="function"&&!("query"in t)}function x(t){return typeof t=="function"&&typeof t.begin=="function"&&typeof t.end=="function"}function p(t,r){return typeof t=="function"?t.bind(r):t}var w=114,D=3802;function k(t){if(typeof t!="object"||t===null||Buffer.isBuffer(t))return!1;if(Array.isArray(t))return!0;let r=Object.getPrototypeOf(t);return r===Object.prototype||r===null}function S(t){return t instanceof Date?t.toISOString():k(t)?JSON.stringify(t):t}function I(t){let r=t.options?.serializers;if(!r)return;let n=a=>a;r[w]=n,r[D]=n}function P(t){return new Proxy(t,{get(r,n,a){return n!=="reserve"?p(Reflect.get(r,n,a),r):async function(){let d=await r.reserve();return new Proxy(d,{get(i,s,u){return s!=="unsafe"?p(Reflect.get(i,s,u),i):function(l,y,g){return i.unsafe(l,y?.map(S),g)}}})}}})}function T(t){return typeof t.selectFrom=="function"}function R(t){if(T(t))return{db:t};if(m(t))return{db:new o({dialect:new C({database:t}),plugins:[new c]})};if(_(t))return{db:new o({dialect:new f({pool:t})})};if(x(t))return I(t),{db:new o({dialect:new b({postgres:P(t)})})};throw new Error("Unsupported database input. Expected a pg Pool, postgres.js Sql, better-sqlite3 Database, or a Kysely instance.")}import{z as e}from"zod";var U=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),name:e.string(),config:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{}),dek:e.string().nullish()}),h=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),tenant_id:e.string(),integration_id:e.string(),config:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{}),dek:e.string().nullish()}),A=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),account_id:e.string(),entity_id:e.string(),entity_type:e.string(),version:e.string(),data:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{})}),z=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),account_id:e.string(),event_type:e.string(),payload:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{}),status:e.enum(["pending","processing","completed","failed"]).optional()}),j=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),token:e.string(),plugin:e.string(),endpoint:e.string(),args:e.string(),tenant_id:e.string(),status:e.enum(["pending","approved","executing","completed","denied","expired","failed"]).default("pending"),expires_at:e.string(),error:e.string().nullable().optional()});export{R as a,U as b,h as c,A as d,z as e,j as f};
+import{a as c}from"./chunk-Z2KT4F2U.js";import{Kysely as o,PostgresDialect as b,SqliteDialect as _}from"kysely";import{PostgresJSDialect as m}from"kysely-postgres-js";function x(t){return typeof t.query=="function"&&typeof t.connect=="function"}function w(t){let r=t;return typeof r.prepare=="function"&&typeof r.exec=="function"&&typeof r.close=="function"&&!("query"in t)}function D(t){return typeof t=="function"&&typeof t.begin=="function"&&typeof t.end=="function"}function p(t,r){return typeof t=="function"?t.bind(r):t}var k=114,S=3802;function I(t){if(typeof t!="object"||t===null||Buffer.isBuffer(t))return!1;if(Array.isArray(t))return!0;let r=Object.getPrototypeOf(t);return r===Object.prototype||r===null}function P(t){return t instanceof Date?t.toISOString():I(t)?JSON.stringify(t):t}function T(t){let r=t.options?.serializers;if(!r)return;let n=a=>a;r[k]=n,r[S]=n}function E(t){return new Proxy(t,{get(r,n,a){return n!=="reserve"?p(Reflect.get(r,n,a),r):async function(){let d=await r.reserve();return new Proxy(d,{get(i,s,u){return s!=="unsafe"?p(Reflect.get(i,s,u),i):function(l,y,g){return i.unsafe(l,y?.map(P),g)}}})}}})}function q(t){return typeof t.selectFrom=="function"}function O(t){if(q(t))return{db:t};if(w(t))return{db:new o({dialect:new _({database:t}),plugins:[new c]})};if(x(t))return{db:new o({dialect:new b({pool:t})})};if(D(t))return T(t),{db:new o({dialect:new m({postgres:E(t)})})};throw new Error("Unsupported database input. Expected a pg Pool, postgres.js Sql, better-sqlite3 Database, or a Kysely instance.")}import{z as e}from"zod";var z=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),name:e.string(),config:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{}),dek:e.string().nullish()}),j=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),tenant_id:e.string(),integration_id:e.string(),config:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{}),dek:e.string().nullish()}),N=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),account_id:e.string(),entity_id:e.string(),entity_type:e.string(),version:e.string(),data:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{})}),B=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),account_id:e.string(),event_type:e.string(),payload:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{}),status:e.enum(["pending","processing","completed","failed"]).optional()}),J=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),token:e.string(),plugin:e.string(),endpoint:e.string(),args:e.string(),tenant_id:e.string(),status:e.enum(["pending","approved","executing","completed","denied","expired","failed"]).default("pending"),expires_at:e.string(),error:e.string().nullable().optional()});export{O as a,z as b,j as c,N as d,B as e,J as f};

package/dist/chunk-KL3FGSOP.js

@@ -0,0 +1 @@
+import{a as e}from"./chunk-SOY77BN4.js";var l="3000",f="/api/corsair";function u(t){return t.replace(/\/$/,"")}function y(t){let r=t?.deliveryUrl?.trim()||process.env.CORSAIR_DELIVERY_URL?.trim();if(r){let a=/^https?:\/\//i.test(r)?r:`https://${r}`;return u(a)}return`http://localhost:${process.env.PORT?.trim()||l}${f}`}var E="corsair.cloud",O="/api/corsair";import{existsSync as n}from"fs";import{createRequire as m}from"module";import{homedir as R}from"os";import{dirname as h,join as i}from"path";var d="0.71.0",g=m(e);function _(){let t=`@corsair-dev/frpc-${process.platform}-${process.arch}`;try{let r=i(h(g.resolve(`${t}/package.json`)),p());return n(r)?r:null}catch{return null}}function c(){return`${process.platform}-${process.arch}`}function p(){return process.platform==="win32"?"frpc.exe":"frpc"}function v(){return i(R(),".cache","corsair","frpc",d,c(),p())}function S(){let t=process.env.CORSAIR_FRP_BIN;if(t&&n(t))return t;let r=_();if(r)return r;let o=v();if(n(o))return o;throw new Error(`frpc binary not found for ${c()}. If you use pnpm, run \`pnpm approve-builds corsair\` (or add corsair to onlyBuiltDependencies) and reinstall; otherwise reinstall corsair, or set CORSAIR_FRP_BIN to an frpc path (https://github.com/fatedier/frp/releases).`)}export{y as a,E as b,O as c,d,c as e,S as f};

package/dist/chunk-RIGD4Y7Y.js

@@ -0,0 +1,66 @@
+import{a as me,b as Et,c as Dt}from"./chunk-KL3FGSOP.js";import{a as po,b as he,c as go,d as v,e as N,f as fo,g as j,h as B,i as x,j as Rn,k as yo,l as mo,m as _t,n as ho,o as ko}from"./chunk-VOH7OVWP.js";import{a as lo}from"./chunk-F2EV3CHK.js";import{ZodBoolean as vc,ZodDate as Pc,ZodEnum as Tc,ZodNullable as Ac,ZodNumber as xc,ZodObject as Rc,ZodOptional as Ic,ZodRecord as Sc,ZodString as _c,ZodType as Ec}from"zod";var In=["abstract","activetrail","addresszen","affinda","agencyzoom","agentmail","agenty","agentql","ahrefs","aimlapi","airtable","alchemy","algolia","alphavantage","alttextai","amara","ambientweather","ambee","amcards","amplitude","apibible","apify","apilabz","apisports","asana","ayrshare","bitwarden","bluesky","boloforms","box","canvas","cal","calendly","canva","cloudflare","cloudinary","confluence","cursor","databricks","datadog","deepseek","digitalocean","discord","dockerhub","dodopayments","dropbox","epicgames","exa","facebook","figma","firecrawl","fireflies","gemini","github","gitlab","gmail","googlebigquery","googlecalendar","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","hackernews","harvest","hashnode","heygen","hubspot","huggingface","insightoai","instagram","intercom","jira","linear","linkedin","loyverse","mailchimp","monday","neon","notion","ocrspace","ollama","onedrive","onepassword","openai","openweathermap","oura","outlook","pagerduty","perplexityai","posthog","razorpay","reddit","resend","retailed","salesforce","sentry","sharepoint","slack","spotify","strava","stripe","supabase","tally","tavily","teams","telegram","todoist","toggl","trello","twilio","twitter","twitterapiio","twochat","typeform","vapi","vercel","whatsapp","wiza","workday","xquik","youcom","youtube","zendesk","zohomail","zoom"],bo={abstract:"Abstract",activetrail:"Active Trail",addresszen:"Addresszen",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agenty:"Agenty",agentql:"AgentQL",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",alchemy:"Alchemy",algolia:"Algolia",alphavantage:"Alpha Vantage",alttextai:"AltText.ai",amara:"Amara",ambientweather:"Ambient Weather",ambee:"Ambee",amcards:"AMcards",amplitude:"Amplitude",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apisports:"API-Sports",asana:"Asana",ayrshare:"Ayrshare",bitwarden:"Bitwarden",bluesky:"Bluesky",boloforms:"Boloforms",box:"Box",canvas:"Canvas LMS",cal:"Cal",calendly:"Calendly",canva:"Canva",cloudflare:"Cloudflare",cloudinary:"Cloudinary",confluence:"Confluence",cursor:"Cursor",databricks:"Databricks",datadog:"Datadog",deepseek:"DeepSeek",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",dodopayments:"Dodo Payments",dropbox:"Dropbox",epicgames:"Epic Games",exa:"Exa",facebook:"Facebook",figma:"Figma",firecrawl:"Firecrawl",fireflies:"Fireflies",gemini:"Gemini",github:"GitHub",gitlab:"GitLab",gmail:"Gmail",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",heygen:"HeyGen",hubspot:"HubSpot",huggingface:"Hugging Face",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jira:"Jira",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailchimp:"Mailchimp",monday:"Monday",neon:"Neon",notion:"Notion",ocrspace:"OCR.space",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",perplexityai:"Perplexity AI",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",resend:"Resend",retailed:"Retailed",salesforce:"Salesforce",sentry:"Sentry",sharepoint:"SharePoint",slack:"Slack",spotify:"Spotify",strava:"Strava",stripe:"Stripe",supabase:"Supabase",tally:"Tally",tavily:"Tavily",teams:"Teams",telegram:"Telegram",todoist:"Todoist",toggl:"Toggl",trello:"Trello",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",vapi:"Vapi",vercel:"Vercel",whatsapp:"WhatsApp",wiza:"Wiza",workday:"Workday",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zohomail:"Zoho Mail",zoom:"Zoom"};function ke(e){let n=bo[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}function I(e){return typeof e=="string"&&e.length>0}function Hs(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Fs(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function Sn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!I(n.connectUrl)||!I(n.token)||!I(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:I(n.environmentId)?n.environmentId:n.projectId};return I(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function _n(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!I(r.tenantId)||!I(r.plugin)||!Hs(r.status)||!Fs(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:I(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function En(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!I(n.approvalUrl)||!I(n.token)||!I(n.projectId)||!I(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function Dn(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(I(n.access_token))return{access_token:n.access_token,refresh_token:I(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:I(n.scope)?n.scope:void 0};throw new Error(I(n.error)?I(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Us(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Bs(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;I(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function Ls(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function wo(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!I(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!I(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",s=Bs(o.fields),a=Us(o.missingRequiredFields),u=Ls(o.status,o.connected,s,a);t.push({plugin:o.plugin,providerName:I(o.providerName)?o.providerName:o.plugin,authKind:i,status:u,connected:o.connected,fields:s,missingRequiredFields:a})}return{tenantId:n.tenantId,plugins:t}}function On(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Co(e){return e.replace(/\/$/,"")}function Ot(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return me()}catch{return null}}function vo(e){let n=Ot(e);return n?{"x-corsair-delivery-url":n}:{}}async function Po(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function To(e,n,t){if(n===404&&t)return t;let r=On(e);return r||`Hub API returned HTTP ${n}`}async function S(e){let n=Co(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...vo(e.hub)},body:JSON.stringify(e.body)}),r=await Po(t);if(!t.ok)throw new Error(To(r,t.status,e.notFoundMessage));return e.parseResponse(r)}async function L(e){let n=Co(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...vo(e.hub)}}),r=await Po(t);if(!t.ok)throw new Error(To(r,t.status,e.notFoundMessage));return e.parseResponse(r)}function Mn(e){return e&&typeof e=="object"?e:{}}function Ao(e){let n=Mn(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Mt(e,n){return S({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=Mn(t);return{chat:r.thread,reply:Ao(r.reply)}}})}async function Ht(e,n){return S({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Ao})}async function Ft(e,n){return L({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Mn(t).threads;return Array.isArray(r)?r:[]}})}async function Ut(e,n){return L({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=Mn(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Zs}from"crypto";var Ns="corsair:client-bridge";function Bt(e){return new URL(e).origin}function Be(e){let n=JSON.stringify({type:Ns,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Bt(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var $s=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Lt(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:$s.has(n)}catch{return!1}}function sn(e){return e==="development"?"browser":"server"}function xo(e){return sn(e)==="browser"}function Ro(e){return Lt(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as qs}from"crypto";var be=60*1e3,Se=300*1e3;import{createHmac as Ws,randomBytes as js,timingSafeEqual as Ks}from"crypto";function ae(){return js(16).toString("base64url")}function an(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Ws("sha256",t).update(e).digest("base64url")}function te(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let s=an(o,t);try{if(!Ks(Buffer.from(i,"utf8"),Buffer.from(s,"utf8")))return null}catch{return null}let a;try{a=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return a.exp*1e3<Date.now()?null:a}function Hn(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),s=an(i,n);return`${i}.${s}`}function un(e,n,t){let r=Math.floor(Date.now()/1e3);return Hn(e,n,r+Math.floor(t/1e3))}function _e(e){return decodeURIComponent(e)}function Nt(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function Io(e){let n=e.trim();return n.length>0?n:null}function Le(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function Ne(e,n){if(!Io(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??qs(16).toString("base64url"),iat:t,exp:t+Math.floor(be/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=an(o,n);return`${o}.${i}`}function we(e,n){return Io(n)?te(e,n):null}function Gs(e){let n=Bt(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function $t(e){let n=Ne(Gs(e),e.signingSecret);return Le(e.deliveryUrl,n)}function So(e){if(sn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Zs(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:$t(r)}}var cn="https://auth.corsair.dev";var ue=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}};function Fn(e){let n=(e.apiUrl?.trim()||cn).replace(/\/$/,""),t=e.projectApiKey.trim(),r=e.signingSecret.trim();if(!t||!r)throw new Error("Hub config requires non-empty projectApiKey and signingSecret");return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function zs(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function H(e){let n=v(e).hub;if(!n||!zs(n))throw new ue;return n}function _o(e){return e.replace(/\/$/,"")}function Un(e){return e.oauthCallbackUrl?_o(e.oauthCallbackUrl.trim()):`${_o(e.apiUrl)}/oauth/callback`}function $e(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}import{createCipheriv as Eo,createDecipheriv as Do,randomBytes as Bn,scrypt as Js}from"crypto";import{promisify as Vs}from"util";var Oo=Vs(Js),Ln="aes-256-gcm",Mo=12,Nn=16,Ys=16,ln=32;function ce(){return Bn(ln).toString("base64")}async function le(e,n){let t=Bn(Ys),r=await Oo(n,t,ln),o=Bn(Mo),i=Eo(Ln,r,o,{authTagLength:Nn}),s=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),a.toString("base64"),s.toString("base64")].join(":")}async function z(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Buffer.from(i,"base64"),c=await Oo(n,s,ln),d=Do(Ln,c,a,{authTagLength:Nn});return d.setAuthTag(u),Buffer.concat([d.update(l),d.final()]).toString("utf8")}function Wt(e,n){let t=Buffer.from(n,"base64"),r=Bn(Mo),o=Eo(Ln,t,r,{authTagLength:Nn}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[r.toString("base64"),s.toString("base64"),i.toString("base64")].join(":")}function dn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Do(Ln,i,s,{authTagLength:Nn});return l.setAuthTag(a),Buffer.concat([l.update(u),l.final()]).toString("utf8")}function Ce(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=Wt(o,n);return t}function de(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=dn(o,n);return t}function pn(e,n,t){let r=de(e,n);return Ce(r,t)}function Ho(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let s=[null,void 0,""].includes(i)?null:i;await n({[o]:s})};return r}var jt=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function F(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,s=[...B[n].integration,...i],a=null,u={kek:r,integrationName:t,getIntegration:async()=>{if(a)return a;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return a={id:b.id,config:jt(b.config),dek:b.dek??null},a},updateIntegration:async b=>{let k=await u.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),a=null}},l=null,c=async()=>{if(l)return l;let b=await u.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await z(b.dek,r),l},d=async()=>{let b=await u.getIntegration(),k=await c(),C=b.config;return!C||Object.keys(C).length===0?{}:de(C,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await c(),C;try{C=await d()}catch(_){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,_),C={}}let P={...C};for(let[_,O]of Object.entries(b))O===null?delete P[_]:P[_]=O;let D=Ce(P,k);await u.updateIntegration({config:D})};return{get_dek:c,issue_new_dek:async()=>{let b=await u.getIntegration(),k=ce(),C={};if(b.dek){let D=await z(b.dek,r),_=b.config;_&&Object.keys(_).length>0&&(C=pn(_,D,k))}let P=await le(k,r);return await u.updateIntegration({config:C,dek:P}),l=k,k},...Ho(d,g,s)}}function M(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:s=[],ensureProvisioned:a}=e,u=[...B[n].account,...s],l=null,c=null,d=async()=>{if(c)return c;let w=!1;for(;;){let T=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!T){if(!w&&a){w=!0,await a();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return c={id:T.id,config:jt(T.config),dek:T.dek??null},c}},p={kek:o,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(l)return l;let w=!1;for(;;){let T=await d(),A=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",T.id).executeTakeFirst();if(!A){if(!w&&a){w=!0,await a();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return l={id:A.id,config:jt(A.config),dek:A.dek??null},l}},updateAccount:async w=>{let T=await p.getAccount();await i.db.updateTable("corsair_accounts").set({...w.config!==void 0?{config:w.config}:{},...w.dek!==void 0?{dek:w.dek}:{},updated_at:new Date}).where("id","=",T.id).execute(),l=null}},g=null,f=null,h=async()=>{if(g)return g;let w=await p.getAccount();if(!w.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return g=await z(w.dek,o),g},b=async()=>{if(f)return f;let w=await p.getIntegration();if(!w.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await z(w.dek,o),f},k=async()=>{let w=await p.getAccount(),T=await h(),A=w.config;return!A||Object.keys(A).length===0?{}:de(A,T)},C=async()=>{let w=await p.getIntegration(),T=await b(),A=w.config;return!A||Object.keys(A).length===0?{}:de(A,T)},P=Promise.resolve(),D=w=>{let T=P.then(()=>_(w));return P=T.catch(()=>{}),T},_=async w=>{let T=await h(),A;try{A=await k()}catch(R){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,R),A={}}let q={...A};for(let[R,X]of Object.entries(w))X===null?delete q[R]:q[R]=X;let ie=Ce(q,T);await p.updateAccount({config:ie})},O={get_dek:h,issue_new_dek:async()=>{let w=await p.getAccount(),T=ce(),A={};if(w.dek){let ie=await z(w.dek,o),R=w.config;R&&Object.keys(R).length>0&&(A=pn(R,ie,T))}let q=await le(T,o);return await p.updateAccount({config:A,dek:q}),g=T,T},...Ho(k,D,u)};return n==="oauth_2"&&(O.get_integration_credentials=async()=>{let w=await C();return{...w,client_id:w.client_id||null,client_secret:w.client_secret||null,redirect_url:w.redirect_url??null}}),O}async function Fo(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=ce(),i=await le(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function Uo(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let s=ce(),a=await le(s,r);return await e.db.updateTable("corsair_accounts").set({dek:a,updated_at:new Date}).where("id","=",i.id).execute(),s}var Qs=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function ve(e){return Qs.has(e)}function Xs(e,n){return ve(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function ea(e){return!ve(e)}function na(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function ta(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function ra(e,n){let t=i=>n.find(s=>s.level==="account"&&s.name===i);if(!na(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function Bo(e,n){if(!e)return!1;let t=j(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function oa(e,n){let r=e.authConfig?.[n]?.integration??[];return[...B[n].integration,...r]}function ia(e,n){let r=e.authConfig?.[n]?.account??[];return[...B[n].account,...r]}function sa(e,n,t){let r=t.filter(a=>a.required&&!a.configured).map(a=>a.name),o=t.filter(a=>a.level==="integration"&&a.required&&!a.configured).map(a=>a.name),i=t.filter(a=>a.level==="account"&&a.required&&a.configured),s;return o.length>0?s="missing_integration":r.length===0?s="ready":i.length>0?s="partial":s="not_started",{plugin:e,authType:n,status:s,connected:ra(n,t),fields:t,missingRequiredFields:r}}async function Ee(e,n,t){let r=x(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,s=i?.[r]?.integration??[],a=i?.[r]?.account??[],u=F({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:s}),l=M({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:a}),c=oa(n,r),d=ia(n,r),p=[];for(let g of c)p.push({name:g,level:"integration",required:Xs(r,g),configured:await Bo(u,g)});for(let g of d)p.push({name:g,level:"account",required:ea(g),configured:await Bo(l,g)});if(ta(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return sa(n.id,r,p)}async function gn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let s of e.plugins){if(o&&!o.has(s.id))continue;let a=await Ee(e,s,r);a&&i.push(a)}return i}function $n(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var Lo=Symbol.for("corsair:internal"),No=new WeakMap,$o=new WeakMap;function aa(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function ua(e){if(e.database){let t=No.get(e.database);return t||(t=new Map,No.set(e.database,t)),t}let n=$o.get(e);return n||(n=new Map,$o.set(e,n)),n}function ca(e){return e.multiTenancy?{withTenant:()=>({}),[Lo]:e}:{[Lo]:e}}async function We(e,n){if(!e.database)return;let t=n.trim()||"default",r=ua(e),o=aa(t,e.plugins),i=r.get(o);if(i){await i;return}let s=(async()=>{let{setupCorsair:a}=await import("./setup-M3URA46K.js");await a(ca(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,s),await s}import*as fn from"crypto";function Pe(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function Kt(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function je(e,n){let t=fn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var qt=600*1e3;function Wn(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=fn.createHmac("sha256",n).update(r).digest("base64url"),s=Buffer.from(o,"base64url"),a=Buffer.from(i,"base64url");return s.length!==a.length||!fn.timingSafeEqual(s,a)?null:Kt(r,{maxAgeMs:qt})}function Wo(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function jo(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function Ke(e,n){await S({hub:e,path:"/connections/report",body:Wo(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function la(e,n){try{let t=H(e);S({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof ue)return}}async function da(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!x(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ee(n,e.plugin,r);o&&qo(e.hub,jo({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function Ko(e,n){la(e,n)}function qo(e,n){S({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function yn(e){da(e).catch(()=>{})}async function pe(e,n){let t=v(e);if(!x(n.plugin))return;let o=await Ee(t,n.plugin,n.tenantId);o&&Ko(e,jo({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function jn(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var Zo=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function pa(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function ga(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await z(n.dek,e.kek),r=Zo(n.config),o={};Object.keys(r).length>0&&(o=de(r,t)),o[e.link.linkType]=e.link.externalId;let i=Ce(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function qe(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:s,extraAccountFields:a=[]}=e,{accountId:u}=await pa({database:n,pluginId:r,tenantId:o}),l=!1;if(s){let c=M({authType:s,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:a}),d=`set_${i.linkType}`,p=c[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await ga({database:n,kek:t,accountId:u,link:i})}async function Zt(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,s=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let a of s)if(a.dek)try{let u=await z(a.dek,t),c=Zo(a.config)[o];if(!c)continue;if(dn(c,u)===i)return a}catch{continue}return null}async function Kn(e){return(await Zt(e))?.tenant_id??null}async function Go(e){return Kn({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as zo from"querystring";function De(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${zo.stringify(i)}`}async function Jo(e,n){try{return await L({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function Ze(e,n,t,r){if(!n.subscribe)return;let o=H(e),i=await Jo(o,n.id);if(!i)return;let s=await n.subscribe({keys:r},{webhookUrl:i});s&&await pe(e,{plugin:n,tenantId:t,verified:!0,webhookLink:s.webhookLink,webhookSecret:s.webhookSecret})}var $=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function Vo(e){let n=e.oauthConfig;if(!n)throw new $("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function fa(e,n,t,r){let o=ko(e),i=await o.integrations.findByName(n);if(!i)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.accounts.findOne({tenant_id:t,integration_id:i.id}))return;let a=ce(),u=await le(a,r);await o.accounts.create({tenant_id:t,integration_id:i.id,config:{},dek:u})}async function Gt(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,s=v(e,()=>new $("invalid_corsair_instance","Invalid corsair instance"));if(!s.database)throw new Error("No database configured on corsair instance");let a=N(s,n,p=>new $("plugin_not_found",p)),u=Vo(a),c=await F({authType:"oauth_2",integrationName:n,kek:s.kek,database:s.database}).get_client_id();if(!c)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(De({oauthConfig:u,clientId:c,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=je(Pe(n,r),s.kek);return{url:De({oauthConfig:u,clientId:c,redirectUri:o,state:d}),state:d}}function ya(e,n){return{...n??{},...e}}async function mn(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new $("invalid_corsair_instance","Invalid corsair instance")),s,a;if(n.trusted){if(!n.plugin||!n.tenantId)throw new $("invalid_state","trusted callback requires plugin and tenantId");s=n.plugin,a=n.tenantId}else{let h=Wn(r,i.kek);if(!h)throw new $("invalid_state","Invalid or tampered state parameter");s=h.plugin,a=h.tenantId}if(!i.database)throw new $("no_database","No database configured on corsair instance");let u=N(i,s,h=>new $("plugin_not_found",h)),l=Vo(u),c=F({authType:"oauth_2",integrationName:s,kek:i.kek,database:i.database}),d=await c.get_client_id(),p=await c.get_client_secret();if(!d||!p)throw new $("credentials_not_configured",`Credentials not configured for '${s}'`);await fa(i.database,s,a,i.kek);let g=await qn(t,d,p,l,o);if(!g.access_token)throw new $("no_access_token",`No access_token returned from ${l.providerName}`);let f=M({authType:"oauth_2",integrationName:s,tenantId:a,kek:i.kek,database:i.database,extraAccountFields:[...u.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await pe(e,{plugin:u,tenantId:a}).catch(()=>{});try{let h=ya(g,n.callbackParams),b=await jn(i.plugins,s,h);if(b){try{let k=u.authConfig?.oauth_2?.account??[];await qe({database:i.database,kek:i.kek,pluginId:s,tenantId:a,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${a}':`,k)}i.hub&&Ke(i.hub,{plugin:s,tenantId:a,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${a}':`,h)}if(u.subscribe)try{await Ze(e,u,a,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${s}' tenant '${a}':`,h)}return{plugin:s,tenantId:a}}async function ma(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??Ze,i=[],s=[];if(!t.database)return{renewed:i,failed:s};for(let a of r){let u=t.plugins.find(c=>c.id===a.integrationName);if(!u?.subscribe)continue;let l=`${u.id}/${a.tenantId}`;try{let c=x(u)??"oauth_2",d=M({authType:c,integrationName:u.id,tenantId:a.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...u.authConfig?.[c]?.account??[]]}),p=u.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:c,keys:g,hub:t.hub},"endpoint")}await o(n,u,a.tenantId,d),i.push(l)}catch(c){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,c),s.push(l)}}return{renewed:i,failed:s}}async function Yo(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return ma({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function ha(e,n={}){let t=!1,r=()=>{t||(t=!0,Yo(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function Qo(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await Zn(e,{silent:!0})}async function Ge(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await We(t,n)}var ka=Symbol.for("corsair:internal"),ba=new Set(["access_token","refresh_token","expires_at","scope"]);function wa(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ca(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!ve(t)&&!ba.has(t)):n.filter(t=>!ve(t))}function Xo(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function va(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function Pa(e){return{[ka]:Xo(e)}}async function Gn(e,n,t={}){let r=Un(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,s=Xo(e),a=Pa(e);for(let u of e.plugins){if(i&&!i.has(u.id))continue;let l=x(u);if(!l)continue;let c=wa(l),d=t.providerNameOverrides?.[u.id]??ke(u.id),p=await Ee(s,u,n),g=Rn(u,l),f=Ca(l,g),h={plugin:u.id,providerName:d,authKind:c,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),c==="oauth"){let k=t.oauthModeOverrides?.[u.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let C=await Gt(a,u.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=C.url}catch(C){h.setupError=C instanceof Error?C.message:`Could not prepare OAuth for ${u.id}`}}o.push(h)}return o}async function ep(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return Gn({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function ei(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await We(e.internalConfig??va(e),n)}async function ni(e,n){await Ge(e,n)}async function ti(e,n){let t=$e(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=me({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Sn})}async function zt(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await ei(t,n.tenantId);let r=await Gn(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return ti(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function zn(e,n){let t=v(e),r=H(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await ni(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,s=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,u=await Gn(o,n.tenantId,{pluginIds:i,oauthModeOverrides:s,providerNameOverrides:a});if(u.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return ti(r,{tenantId:n.tenantId,plugins:u,deliveryUrl:n.deliveryUrl})}async function Jn(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(s=>s.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await Ta(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function Ta(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-ZQHF7CAA.js"),{postHubConnectSession:i}=await import("./connect-6VTU7HBO.js"),s={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(s,t.tenantId);let a=await r(s,t.tenantId,{pluginIds:t.pluginIds});if(a.length===0)throw new Error("No connectable plugins found for this tenant");let u=a.find(l=>l.setupError);if(u)throw new Error(u.setupError??`Could not prepare connect link for ${u.plugin}`);return i(e,{tenantId:t.tenantId,plugins:a})}function ze(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var J=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Aa(e){let n=e.oauthConfig;if(!n)throw new J("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Jt(e,n){let t=v(e,()=>new J("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new J("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new J("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=Wn(n,t.kek);if(!o)throw new J("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:s}=o,a=N(t,i,p=>new J("plugin_not_found",p)),u=Aa(a),c=await F({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!c)throw new J("client_id_not_configured",`client_id not configured for '${i}'`);let d=De({oauthConfig:u,clientId:c,redirectUri:r,state:n});return{plugin:i,tenantId:s,providerName:u.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as Ra}from"async_hooks";import{randomBytes as Ia}from"crypto";import{v4 as Sa}from"uuid";async function Vn(e,n){let t=$e(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=me({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:En})}function Yn(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var Vt="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Qt(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function ri(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Yt(e){return Yn(e)}async function Xt(e,n){if(Qt(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?ri(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Vn(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:xa(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function xa(e){try{return JSON.parse(e)}catch{return e}}async function Qn(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Xt(e,n);return{...n,approvalUrl:r}}async function er(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:s,endpoint:a,args:u,tenantId:l,expiresAt:c,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:s,endpoint:a,args:u});let g=await Xt({manual:t,hub:r},{id:o,token:i,plugin:s,endpoint:a,args:JSON.stringify(u),tenant_id:l,expires_at:c});return Qt(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Yt(g):Vt:r?g?Yt(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:Vt}var Je=class extends Error{constructor(n){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError"}};var ii=new Ra,Xn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function nr(e){return ii.run(!0,e)}function si(){return ii.getStore()===!0}function tr(e,n){if(si()&&n!=="read")throw new Xn(e,n)}var _a={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function Ea(e,n,t){return t!==void 0?t:_a[n][e]}function rr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function ai(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function oi(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function ui(e){let n=Ea(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, update the permission mode or add an override in your corsair config.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),s=e.tenantId??"default",a=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",s).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(a){if(a.status==="approved"){let f=e.db,h=a.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return a.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${a.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?oi(e.db,a.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:a.id,token:a.token,expiresAt:a.expires_at})}let u=Sa(),l=Ia(32).toString("hex"),c=e.timeoutMs??600*1e3,d=new Date(Date.now()+c).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:u,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:s,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${u}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?oi(e.db,u,c):{result:"blocked",reason:"pending",id:u,token:l,expiresAt:d}}var E=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function U(e,n){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json"}})}function ci(e){let n={error:e.code,message:e.message,...e.extra};return U(e.status,n)}function Te(e){return new E(404,"not_found",e)}function ge(e,n={}){return new E(400,"bad_request",e,n)}function li(e,n){return N(e,n,t=>Te(t))}async function di(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=F({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=B[t].integration,i=r,s;try{s=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{s=o.map(()=>null)}let a=o.filter((l,c)=>s[c]==null),u;return t==="oauth_2"?u=!a.includes("client_id")&&!a.includes("client_secret"):u=a.length===0,{configured:u,missingFields:a}}async function pi(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await di(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function et(){return{ok:!0}}async function Ve(e){return Promise.all(e.plugins.map(n=>pi(n,e)))}async function nt(e,n){let t=li(e,n);return pi(t,e)}async function Da(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function gi(e,n){let t=await Da(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function Ye(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let s=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:s}),s&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function tt(e,n){if(!n)throw ge("Tenant id must be a non-empty string");return gi(e,n)}async function rt(e,n){let t=n?.id?.trim();if(!t)throw ge("Tenant id is required",{missingFields:["id"]});return gi(e,t)}async function ot(e,n){let t=n?.trim()||"default",r={},o=await gn(e,t);for(let i of o)r[i.plugin]=$n(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function or(e,n){if(!e.database)throw Te(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw Te(`Permission '${n}' not found`);return Qn(e,t)}function Oa(e){if(!e.oauthConfig)throw ge(`Plugin '${e.id}' has no oauthConfig`)}function Ma(e){if(!e.manual)throw new E(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function ir(e){let n=Ma(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new E(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function Ha(e){let n=!!e.hub,t=ze(e.manual);if(!n&&!t)throw new E(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function fi(e){if(!e.database||!e.kek)throw new E(500,"database_not_configured","A database and kek are required to issue connect links.")}async function Fa(e,n){let t=n?.plugin?.trim();if(!t)throw ge("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=li(e,t);Oa(o);let i=ir(e);fi(e);let s=await di(o,e);if(!s.configured)throw new E(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:s.missingFields});let a=je(Pe(t,r),e.kek),u;try{u=new URL(i.baseUrl)}catch{throw new E(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return u.searchParams.set("state",a),{connectUrl:u.toString(),expiresAt:new Date(Date.now()+qt).toISOString()}}async function Ua(e,n,t){fi(n);let o={tenantId:t.tenantId?.trim()||"default",oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let s=t.providerName?.trim();s&&(o.providerName=s);let a=await zn(e,o);return{connectUrl:a.connectUrl,expiresAt:a.expiresAt}}async function it(e,n,t){return Ha(n),n.hub?Ua(e,n,t):Fa(n,t)}async function st(e,n,t){if(n.hub&&!ze(n.manual))throw new E(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw ge("state is required",{missingFields:["state"]});ir(n);try{return await Jt(e,r)}catch(o){if(o instanceof J)switch(o.code){case"invalid_state":throw ge("Invalid or expired state");case"client_id_not_configured":throw new E(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new E(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function at(e,n,t){if(n.hub&&!ze(n.manual))throw new E(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw ge("Missing required fields",{missingFields:i});let s=ir(n),{processOAuthCallback:a}=await import("./oauth.js");try{return await a(e,{code:r,state:o,redirectUri:s.redirectUri,callbackParams:t.callbackParams})}catch(u){if(u instanceof Error&&u.name==="OAuthCallbackError")switch(u.code){case"invalid_state":throw ge("Invalid or expired state");case"credentials_not_configured":throw new E(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new E(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function sr(e,n){if(!e.database)throw Te("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw Te("Permission not found");return Qn(e,t)}async function yi(e,n){return"id"in n?or(e,n.id):sr(e,n.token)}import{createCipheriv as Ka,createDecipheriv as ig,randomBytes as bi,scryptSync as qa}from"crypto";import{createHmac as ar,randomUUID as Ba,timingSafeEqual as hi}from"crypto";function ur(e){return e.run??null}function cr(e){return e.probe??null}function ki(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function ut(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=ar("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":Ba()}}}function lr(e){let n=e.signingSecret.trim();if(!n)return!1;let t=ki(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>Se)return!1;let i=ar("sha256",n).update(e.body).digest("hex");try{return hi(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function Qe(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=ki(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>Se)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=ar("sha256",n).update(e.body).digest("hex");try{if(!hi(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function Xe(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function ct(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function lt(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function hn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function dr(e){return hn(Xe(e))}async function pr(e){let n=await gt({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=Xe(n.body),r=ct({httpOk:n.ok,status:n.status,body:t}),o=hn(t);if(!r||!o)throw new Error(pt({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function dt(e){return lt(Xe(e))}function La(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function mi(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var Na="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",$a="Check the delivery URL configured for this environment.";function Wa(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${Na}`}function ja(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${$a}`}function kn(e,n){let t=La(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function pt(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:kn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return Wa(e);if(e.status===404)return ja(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${mi(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${mi(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}async function gt(e){let{body:n,headers:t}=ut(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:kn(e.deliveryUrl,r)}}}var Za="aes-256-gcm",Ga=12,za=16,Ja=16,Va=32;function Ya(e,n){return qa(e.trim(),n,Va)}function gr(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=bi(Ja),o=Ya(t,r),i=bi(Ga),s=Ka(Za,o,i,{authTagLength:za}),a=JSON.stringify(e),u=Buffer.concat([s.update(a,"utf8"),s.final()]),l=s.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),u.toString("base64")].join(":")}var Qa=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function fr(e){if(e instanceof po)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!Qa.some(t=>n.includes(t))}function Xa(e){if(!e)return[];let n=x(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!ve(r)):[]}async function bn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await Zn(e,{silent:!0});let[r,o]=await Promise.all([Ye(t),Ve(t)]),i={tenants:r.map(s=>({id:s.id})),plugins:o.map(s=>{let a=Xa(t.plugins.find(u=>u.id===s.id));return{id:s.id,authType:s.authType,configured:s.configured,missingFields:s.missingFields,...a.length>0?{integrationCredentialFields:a}:{}}}),syncedAt:new Date().toISOString()};return gr(i,n)}var re=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function ft(e,n){let t=v(e,()=>new re("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new re("no_database","Database not configured");let r=N(t,n.plugin,c=>new re("plugin_not_found",c)),o=x(r);if(!o)throw new re("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new re("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await Ge(e,n.tenantId);let i=new Set(Rn(r,o)),a=r.authConfig?.[o]?.account??[],u=M({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:a}),l=0;for(let[c,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(c))throw new re("invalid_credentials",`Unknown credential field '${c}' for plugin '${n.plugin}'`);let p=j(u,`set_${c}`);if(!p)throw new re("invalid_credentials",`Cannot set credential field '${c}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new re("invalid_credentials","Provide at least one credential field to save");return await pe(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var oe=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function yr(e,n){let t=v(e,()=>new oe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new oe("no_database","Database not configured");let r=N(t,n.plugin,c=>new oe("plugin_not_found",c)),o=x(r);if(!o)throw new oe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await Qo(e);let i=new Set(yo(r,o)),a=r.authConfig?.[o]?.integration??[],u=F({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:a}),l=0;for(let[c,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(c))throw new oe("invalid_credentials",`Unknown integration credential field '${c}' for plugin '${n.plugin}'`);let p=j(u,`set_${c}`);if(!p)throw new oe("invalid_credentials",`Cannot set integration field '${c}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new oe("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var yt=new Map;function eu(e){for(let[n,t]of yt)t<=e&&yt.delete(n)}function mt(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();eu(r);let o=yt.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(yt.set(t,r+n),{ok:!0})}var Ae=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function en(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:s,scope:a}=n;if(!o.trim())throw new Ae("no_access_token","Managed OAuth delivery missing access_token");let u=v(e,()=>new Ae("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new Ae("no_database","No database configured on corsair instance");let l=N(u,t,d=>new Ae("plugin_not_found",d));await Ge(e,r);let c=M({authType:"managed",integrationName:t,tenantId:r,kek:u.kek,database:u.database});await c.set_access_token(o),i&&await c.set_refresh_token(i),s&&await c.set_expires_at(String(Math.floor(Date.now()/1e3)+s)),a&&await c.set_scope(a),await pe(e,{plugin:l,tenantId:r}).catch(()=>{});try{let d=await jn(u.plugins,t,{access_token:o,refresh_token:i,scope:a});if(d){try{let p=l.authConfig?.managed?.account??[];await qe({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:d,authType:"managed",extraAccountFields:p})}catch(p){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,p)}u.hub&&Ke(u.hub,{plugin:t,tenantId:r,link:d,authType:"managed"})}}catch(d){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,d)}return await Ze(e,l,r,c).catch(d=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,d)}),{plugin:t,tenantId:r}}function nu(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function wi(e,n,t=[]){for(let[r,o]of Object.entries(e))if(nu(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=wi(o,n,[...t,r]);if(i)return i}return null}function tu(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function ru(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function Ci(e,n,t,r,o){let i=tu(n),s=typeof t=="string"?JSON.parse(t):t;(!s||typeof s=="object"&&Object.keys(s).length===0)&&i["x-goog-resource-uri"]&&(s=ru(i)||s);let u={headers:i,body:s,...r?{query:r}:{}},l=r?.tenantId||"default",c=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:In;for(let g of p){let f=c[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(u))continue;let h=wi(f.webhooks,u);if(!h)continue;let b=h.path.join("."),k={payload:s,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{}};try{let C=await h.webhook.handler(k),P=!!Object.keys(C.returnToSender||{})?.length;return{plugin:g,action:b,body:s,response:P?{...C?.returnToSender,success:!0}:{success:!0},...C.responseHeaders&&{responseHeaders:C.responseHeaders}}}catch(C){return console.error(`Error executing webhook handler for ${g}.${b}:`,C),{plugin:g,action:b,body:s,response:{success:!1,error:C instanceof Error?C.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as ou}from"crypto";import*as Oe from"vm";var vi="__corsairFailedStep",iu=3e4,mr=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function Pi(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function Ti(e,n){return`st_${ou("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function ht(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var Ai=new Set(["constructor","prototype","__proto__"]);function fe(e,n){if(e===null)return null;let t=typeof e;return t==="function"?au(e,n):t==="object"?su(e):e}function su(e){return new Proxy(e,{get(n,t){if(!Ai.has(t))return fe(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function au(e,n){return new Proxy(e,{apply:(t,r,o)=>uu(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!Ai.has(r))return fe(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function uu(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>fe(n,void 0),n=>{throw fe(n,void 0)}):fe(e,void 0)}function cu(e){let n=Object.create(null),t=Oe.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Oe.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),s=Oe.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),u=Oe.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=fe(e.corsair,void 0),n.__payload=o,n.__step=s,n.__console=u;let l=Oe.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let c,d=new Promise((p,g)=>{c=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(c))}async function hr(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(s,a)=>{if(o)throw o;let u=r++,l=Ti(s,u);if(Object.hasOwn(n,l))return fe(n[l].output,void 0);try{let c=await a();return t.push({stepId:l,name:s,seq:u,status:"completed",output:c}),c}catch(c){if(Pi(c))throw c;let d=ht(c);t.push({stepId:l,name:s,seq:u,status:"failed",error:d});let p=new Error(d);throw p[vi]=s,p}});i.sleep=async(s,a)=>{if(o)throw o;let u=r++,l=Ti(s,u);if(Object.hasOwn(n,l))return;t.push({stepId:l,name:s,seq:u,status:"completed",output:null});let c=Number.isFinite(a)?Math.max(0,a):0;throw o=new mr(Date.now()+c,s),o};try{await cu({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??iu});let s=o;return s?{status:"sleeping",steps:t,sleepUntil:new Date(s.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(s){if(Pi(s))return{status:"sleeping",steps:t,sleepUntil:new Date(s.wakeAt).toISOString()};let a=ht(s),u=s!==null&&typeof s=="object"?s[vi]:void 0;return{status:"failed",steps:t,error:{message:a,...u?{failedStep:u}:{}}}}}import*as kt from"vm";var xi=1e4;async function kr(e){let n=Object.create(null),t=kt.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=fe(e.corsair,void 0);let r=du(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await nr(()=>{let s=kt.runInContext(o,t,{filename:"corsair:probe",timeout:r});s.catch(()=>{});let a,u=new Promise((l,c)=>{a=setTimeout(()=>c(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([s,u]).finally(()=>clearTimeout(a))});return{status:"ok",value:lu(i)}}catch(i){return{status:"error",error:ht(i)}}}function lu(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function du(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?xi:Math.min(e,xi)}function Me(e){return e.deliveryMode==="auth.credentials"}function wn(e){return e.deliveryMode==="connections.sync"}function bt(e){return e.deliveryMode==="connect.create_link"}function Cn(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function vn(e){return e.deliveryMode==="oauth.tokens"}function wt(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!Me(e)&&!wn(e)&&!bt(e)&&!Cn(e)&&!vn(e)}function pu(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function gu(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await bn(e,n)}}}}}catch(t){return{status:"failed",retryable:fr(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function fu(e,n){try{let t=await Jn(e,n);return pu(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function br(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function yu(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await Kn({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function mu(e,n,t){let r=await yu(e,n,t),o={...t.query??{},...r?{tenantId:r}:{}},i=await Ci(e,t.headers,t.body,o,t.plugin?{plugin:t.plugin}:void 0);if(!i.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(i.response&&i.response.success===!1)return{status:"failed",retryable:!1,error:typeof i.response.error=="string"?i.response.error:"Webhook handler failed"};let s=i.response?.returnToSender,a=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(i.response?.data??i.response);return{status:"ok",webhookResponse:{status:i.response?.statusCode??200,body:a,headers:i.responseHeaders}}}async function hu(e,n){return await mn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function ku(e,n){return await en(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope}),{status:"ok"}}async function Cr(e,n,t){let r=await wr(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function wr(e,n,t){let r=v(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),s=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return s?s.status!=="pending"?{status:"ok"}:s.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",s.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",s.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function bu(e,n){try{return await ft(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function wu(e,n){try{return await yr(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function Ri(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function Cu(e,n){try{let t=Ri(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await hr({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function vu(e,n){try{let t=Ri(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await kr({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function Pn(e,n,t={}){let r=v(e),o=br(n.headers,"x-corsair-signature"),i=br(n.headers,"x-corsair-timestamp"),s=br(n.headers,"x-corsair-nonce");if(t.signingSecret?.trim()){let u=Qe({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!u.ok)return{status:"failed",retryable:!1,error:u.error};if(!s?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let l=mt(`nonce:${s.trim()}`,Se);if(!l.ok)return{status:"failed",retryable:!1,error:l.error}}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let a;try{a=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(a.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(a.type){case"webhook":return mu(e,r,a.payload);case"oauth.callback":return hu(e,a.payload);case"oauth.tokens":return ku(e,a.payload);case"permission.approve":return wr(e,a.payload,"approved");case"permission.deny":return wr(e,a.payload,"denied");case"auth.credentials":return bu(e,a.payload);case"integration.credentials":return wu(e,a.payload);case"connect.create_link":return fu(e,a.payload);case"connections.sync":{let u=t.signingSecret?.trim();return u?gu(e,u):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?Cu(e,a.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?vu(e,a.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(a.type)}`}}}function Pu(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var vr=3,Tu=250;function Au(e){return e?.name==="AbortError"}async function xu(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function Ru(e,n,t,r,o){for(let i=1;i<=vr;i++){try{let s=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(s.ok)return await xu(s)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(s){if(Au(s))throw s}i<vr&&await Si(Tu)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${vr} attempts; the run may be retried`),!1}async function Iu(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:s,body:a,headers:u}=await i.json(),l=await t.process(e,{headers:u,body:a},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:c,body:d}=Pu(l);return await Ru(n,t,o,{deliveryId:s,status:c,body:d},r)?"handled":"error"}var Ii=1e3,Su=5e3,_u=3e4;function Si(e){return new Promise(n=>setTimeout(n,e))}var Ct=globalThis.__corsairConnectLoops??=new Map;function Eu(e,n={fetch,process:Pn}){let t;try{t=H(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(Ct.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");Ct.set(r,o);let i=()=>{Ct.get(r)===o&&Ct.delete(r)},s=!1,a=null;return(async()=>{let l=Ii,c=!1,d=async p=>{c||(console.warn("[corsair] connect loop error; retrying",p),c=!0),s||await Si(l),l=Math.min(l*2,Su)};try{for(;!s;){a=new AbortController;let p=setTimeout(()=>a?.abort(),_u);try{await Iu(e,t,n,a.signal)==="error"?await d("pull or ack failed"):(c=!1,l=Ii)}catch(g){if(s)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{s=!0,a?.abort(),i()}}}function _i(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Du(e,n){return n&&!n.has(e.id)?!1:x(e)!==null}async function Ei(e,n,t={}){let r=v(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,s=await gn(r,o,{pluginIds:t.pluginIds}),a=new Map(s.map(l=>[l.plugin,l])),u=r.plugins.filter(l=>Du(l,i)).map(l=>{let c=x(l),d=a.get(l.id);return d?{plugin:l.id,providerName:ke(l.id),authKind:_i(c),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:ke(l.id),authKind:_i(c),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:u}}async function Di(e,n){let t=H(e);return L({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:_n})}var Pr=new Map;function Oi(e){let n;try{n=H(e)}catch{return}let t=Ot(n);t&&Pr.get(n.projectApiKey)!==t&&(Pr.set(n.projectApiKey,t),S({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{Pr.delete(n.projectApiKey)}))}var Ou=[".corsair.dev"];function Mu(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function Hu(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Mu(n)?!0:Ou.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function Mi(e){return!e||!Hu(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function Hi(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function Tr(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function Ar(e,n){let t=H(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=we(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let s=mt(`browser:${i.jti}`,be);if(!s.ok)return{type:"json",status:400,body:{error:s.error}};try{if(wn(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let a=await bn(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:Be({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:a}}})}}if(bt(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let a=i.connectLinkPlugins?.filter(Boolean)??[];if(a.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let u=await Jn(e,{tenantId:i.tenantId,plugins:a});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:Be({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:u.connectUrl,expiresAt:u.expiresAt}})}}if(Me(i))return i.hubSuccessUrl?i.credentials?(await ft(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:Tr(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:Tr(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(Cn(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await Cr(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(vn(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await en(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope})}else{if(!wt(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await mn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(a){let u=a instanceof Error?a.message:"Hub delivery failed";return wn(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:Be({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:u})}:bt(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:Be({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:u})}:Me(i)&&i.hubSuccessUrl?{type:"redirect",url:Tr(i.hubSuccessUrl,{error:u})}:Me(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:Be({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:u})}:{type:"json",status:400,body:{error:u}}}return{type:"redirect",url:i.hubSuccessUrl}}async function xr(e,n){let t=H(e),r=await Pn(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,s=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:s}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:s}}function Rr(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function Ir(e,n){return n.method==="GET"?Ar(e,n.url):xr(e,{headers:n.headers,body:n.body??""})}async function Sr(e,n){try{let t=await Ir(e,n);return Rr(t)}catch(t){if(t instanceof ue)return Response.json({error:t.message},{status:503});throw t}}async function He(e,n){Oi(e);let t=n.method.toUpperCase(),r=Mi(n.headers.get("origin"));if(t==="OPTIONS")return r?new Response(null,{status:204,headers:r}):Response.json({error:"Method not allowed"},{status:405});if(t!=="GET"&&t!=="POST")return Response.json({error:"Method not allowed"},{status:405});let o=await Sr(e,{method:t,url:n.url,headers:n.headers,body:t==="POST"?await n.text():void 0});return Hi(o,r)}var K=class extends Error{pluginId;authType;constructor(n,t,r){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t}};var Fi=300;async function _r(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,s=n?.forceRefresh??!1,[a,u,l]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!a&&!l)throw new K(o,"managed");let c=Math.floor(Date.now()/1e3);if(!s&&a&&u&&Number(u)>c+Fi)return{accessToken:a,expiresAt:Number(u),refreshed:!1};if(!l&&a&&!s){let g=u?Number(u):null;if(g===null||g>c+Fi)return{accessToken:a,expiresAt:g??c+3600,refreshed:!1}}let d=await Uu(r,o,i),p=d.expires_in?c+d.expires_in:u?Number(u):c+3600;return await t.set_access_token(d.access_token),await t.set_expires_at(String(p)),d.refresh_token&&await t.set_refresh_token(d.refresh_token),d.scope&&await t.set_scope(d.scope),{accessToken:d.access_token,expiresAt:p,refreshed:!0}}function Fu(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function Uu(e,n,t){try{return await S({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t},parseResponse:Dn})}catch(r){let o=r instanceof Error?r.message:"";throw Fu(o)?new K(n,"managed"):r}}async function Ui(e,n){e._refreshAuth=async()=>(await _r(n,{forceRefresh:!0})).accessToken}function Bi(e){return{delivery:n=>He(e,n),deliveryOptions:n=>He(e,n)}}var Li=1200*1e3;function Er(){return ae()}function Dr(){return Li}function Or(e,n){return un(e,n,Li)}function Mr(e,n){return te(e,n)}function Hr(e){return _e(e)}var Ni=600*1e3;function Fr(){return ae()}function Ur(){return Ni}function Br(e,n){return un(e,n,Ni)}function Lr(e,n){return te(e,n)}function Nr(e){return Nt(e)}function $r(e){return _e(e)}function Wr(){return ae()}function jr(e,n,t){return Hn(e,n,Math.floor(t.getTime()/1e3))}function Kr(e,n){return te(e,n)}function qr(e){return _e(e)}function vt(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){let s=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${s?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${ln}`)}})}async function Bu(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function $i(e){let{integrationId:n,accountId:t}=await Bu(e);return{integrationId:n,accountId:t}}function Wi(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>Mt(t(),{tenantId:n,message:r}),list:()=>Ft(t(),{tenantId:n}),get:r=>({message:o=>Ht(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>Ut(t(),{chatId:r,tenantId:n})})}}function Zr(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function Lu(e,n){let t=e.hub;if(!t||!n.database||!n.kek)return null;try{return(await zt(t,{tenantId:n.tenantId,plugin:n.plugin,database:n.database,kek:n.kek,plugins:n.plugins,multiTenancy:n.multiTenancy})).connectUrl}catch{return null}}async function Nu(e){let n=e.hub;if(n&&e.database&&e.kek)try{let r=await zt(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:r.connectUrl,state:r.token}):Zr(e.pluginId,r.connectUrl)}catch{return`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`}let t=await Lu({manual:e.manual,hub:e.hub},{plugin:e.plugin,tenantId:e.tenantId,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return t?Zr(e.pluginId,t):`[auth-missing:${e.pluginId}:${e.authType}]`}function $u(e,n,t){let r=je(Pe(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):Zr(e,i)}async function Wu(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.manual&&ze(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?$u(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?Nu({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):e.error.message}async function ji(e){let n=await Wu(e);throw new K(e.error.pluginId,e.error.authType,n)}var ju=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function Ki(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},s=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[s||"DEFAULT"]?.handler||ju)(e,i)}function Ku(e){return typeof e=="function"}function Gr({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:s=[],keyBuilder:a,permissionsConfig:u,endpointMeta:l,database:c,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:C}){for(let[P,D]of Object.entries(e)){let _=n?.[P];if(Ku(D)){let O=_,w=[...s,P].join("."),T=async(A={})=>{let q=l?.[w];tr(w,q?.riskLevel??"write");let ie;if(u){let Z=q,{result:xn,reason:ee,onComplete:on,token:se,id:Ie,expiresAt:G}=await ui({pluginId:o,endpointPath:w,args:A,mode:u.mode,override:u.overrides?.[w],riskLevel:Z?.riskLevel??"write",meta:Z,db:c,timeoutMs:d?rr(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(xn==="blocked"){let ne;throw ee==="denied"?ne=`Action '${w}' was denied by the user. Await further instructions before proceeding.`:ee==="policy"?ne=`Action '${w}' is blocked by the permission policy. Update the corsair config to allow it.`:ee==="timeout"?ne=`Action '${w}' timed out waiting for approval.`:se&&Ie?ne=await er({permissionsOptions:d,manual:g,hub:f,permissionId:Ie,permissionToken:se,plugin:o,endpoint:w,args:A,tenantId:p??"default",expiresAt:G??new Date(Date.now()+(d?rr(d.timeout):600*1e3)).toISOString(),operationPath:w}):ne=`Action '${w}' requires user approval before it can run.`,new Je(ne)}ie=on}let R=async(Z,xn,ee)=>{try{return await D(xn,ee)}catch(on){if(on instanceof Error){let se=await Ki(on,o,w,typeof ee=="object"&&ee!==null?ee:{args:ee},i);if(Z<(se.maxRetries||0)){let Ie=Z+1;console.log(`Retrying (${Ie} / ${se.maxRetries})...`);let G;if(se.headersRetryAfterMs)G=se.headersRetryAfterMs;else switch(se.retryStrategy){case"exponential_backoff":G=Math.pow(2,Ie-1)*1e3;break;case"exponential_backoff_jitter":let ne=Math.pow(2,Ie-1)*1e3,Ms=(Math.random()-.5)*1e3;G=Math.max(0,ne+Ms);break;case"linear_1s":G=1e3;break;case"linear_2s":G=2e3;break;case"linear_3s":G=3e3;break;case"linear_4s":G=4e3;break;default:G=1e3;break}await new Promise(ne=>setTimeout(ne,G)),await R(Ie,xn,ee),console.log(`[corsair:${o}:${w}] Retry strategy:`,se)}}throw on}},X;try{X=a?await a(t,"endpoint"):void 0}catch(Z){throw Z instanceof K&&(h&&f&&yn({hub:f,database:c,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await ji({error:Z,manual:g,hub:f,plugin:h,tenantId:p,database:c,kek:b,plugins:k,multiTenancy:C})),Z}if(!O?.before&&!O?.after){let Z=await R(0,{...t,key:X},A);return await ie?.(),h&&f&&yn({hub:f,database:c,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),Z}let rn={...t,key:X},Re=O.before?await O.before(rn,A):{ctx:rn,args:A,continue:!0,passToAfter:void 0};if(Re.continue===!1)return;let co=await R(0,Re.ctx,Re.args);return await O.after?.(Re.ctx,co,Re.passToAfter),await ie?.(),h&&f&&yn({hub:f,database:c,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),co};r[P]=T}else if(D&&typeof D=="object"){let O={};Gr({endpoints:D,hooks:_,ctx:t,tree:O,pluginId:o,errorHandlers:i,currentPath:[...s,P],keyBuilder:a,permissionsConfig:u,endpointMeta:l,database:c,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:C}),r[P]=O}}}function qu(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function zr({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,s]of Object.entries(e)){let a=n?.[i];if(qu(s)){let u=a,l=async c=>{let d=(g,f)=>s.handler(g,f),p=o?await o(t,"webhook"):void 0;return!u?.before&&!u?.after?d({...t,key:p},c):(async()=>{let g={...t,key:p},f=u.before?await u.before(g,c):{ctx:g,args:c,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await u.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:s.match,handler:l}}else if(s&&typeof s=="object"){let u={};zr({webhooks:s,hooks:a,ctx:t,webhooksTree:u,keyBuilder:o}),r[i]=u}}}function qi(e){return e&&typeof e=="object"?e:{}}async function Zi(e,n){return L({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=qi(t).workflows;return Array.isArray(r)?r:[]}})}async function Gi(e,n){return L({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>qi(t).workflow})}async function zi(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Ji(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Vi(e,n){return S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function Jr(e){return e&&typeof e=="object"?e:{}}async function Yi(e,n){return L({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Jr(t).runs;return Array.isArray(r)?r:[]}})}async function Qi(e,n){return L({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=Jr(t).runs;return Array.isArray(r)?r:[]}})}async function Xi(e,n){return L({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>Jr(t).run})}async function Vr(e,n,t){await S({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var es=(e,n)=>Vr(e,"approve",n),ns=(e,n)=>Vr(e,"deny",n),ts=(e,n)=>Vr(e,"cancel",n);function rs(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?Qi(t(),{workflowId:r.workflowId,tenantId:n}):Yi(t(),{tenantId:n}),get:r=>Xi(t(),{runId:r,tenantId:n}),approve:r=>es(t(),{runId:r,tenantId:n}),deny:r=>ns(t(),{runId:r,tenantId:n}),cancel:r=>ts(t(),{runId:r,tenantId:n})}}function os(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>zi(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>Zi(t(),{tenantId:n}),get:o=>Gi(t(),{workflowId:o,tenantId:n}),run:(o,i)=>Vi(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:rs(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>Ji(t(),{workflowId:o,tenantId:n,name:i})}}function Zu(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await $i({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function Gu(e,n,t,r,o){return e?_t(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function Yr(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:s,manualConfig:a,hubConfig:u,internalConfig:l}=n,c=r??"default",d=l&&t?()=>We(l,c):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=Zu(t,f.id,c,d);if(h?.entities){let R={};for(let[X,rn]of Object.entries(h.entities)){let Re=t?_t(t.db,b,X,h.version,rn):Gu(void 0,b,X,h.version,rn);R[X]=Re}g[f.id].db=R,p[f.id].db=R}let k=f.options,C=f.authConfig,P;if(t&&o&&k?.authType){let R=C?.[k.authType]?.account??[];P=M({authType:k.authType,integrationName:f.id,tenantId:c,kek:o,database:t,extraAccountFields:R,ensureProvisioned:d}),p[f.id].keys=P}let D={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...P?{keys:P,authType:k?.authType}:{},tenantId:c,...u?{hub:u}:{}},_=f.endpoints??{},O=f.hooks,w={...i,...f.errorHandlers},T={},A=f.options?.permissions;Gr({endpoints:_,hooks:O,ctx:D,tree:T,pluginId:f.id,errorHandlers:w,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:A,endpointMeta:f.endpointMeta,database:t,permissionsOptions:s,tenantId:r,manualConfig:a?{...a,oauthConfig:f.oauthConfig,kek:o,tenantId:c}:void 0,hubConfig:u,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy}),Object.keys(T).length>0&&(p[f.id].api=T),D.endpoints=T;let q=f.webhooks??{},ie=f.webhookHooks;if(Object.keys(q).length>0){let R={};zr({webhooks:q,hooks:ie,ctx:D,webhooksTree:R,keyBuilder:f.keyBuilder}),p[f.id].webhooks=R,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=Wi(u,c),p.workflows=os(u,c),p}function is(e,n,t){let r={};for(let o of e){let i=o.options,s=o.authConfig;if(i?.authType){let a=s?.[i.authType]?.integration??[],u=F({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:a});r[o.id]=u}}return r}var zu="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function ss(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${zu}`),t):n}var as=[{method:"GET",pattern:"/ok",handler:async()=>U(200,et())},{method:"GET",pattern:"/tenants",handler:async({internal:e})=>U(200,await Ye(e))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n})=>U(201,await rt(e,n))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n})=>U(200,await tt(e,n.id))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>U(200,await Ve(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>U(200,await nt(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n})=>U(200,await ot(e,n.tenantId))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n})=>U(200,await or(e,n.id))},{method:"POST",pattern:"/permissions/lookup-by-token",handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?U(200,await sr(e,t)):U(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t})=>U(200,await it(e,n,t))},{method:"GET",pattern:"/connect/resolve",handler:async({corsair:e,internal:n,query:t})=>U(200,await st(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",handler:async({corsair:e,internal:n,body:t})=>U(200,await at(e,n,t))}];(()=>{let e=new Set;for(let n of as){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function Ju(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let s=t[i],a=r[i];if(s.startsWith(":"))o[s.slice(1)]=decodeURIComponent(a);else if(s!==a)return null}return o}function Vu(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function Yu(e){if(!(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json")))try{let t=await e.text();return t?JSON.parse(t):void 0}catch{throw new E(400,"invalid_json","Request body is not valid JSON")}}var Qu="/api/corsair";function Fe(e,n={}){let t=n.basePath??Qu,r=v(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async o=>{try{let i=new URL(o.url),s=Vu(i.pathname,t),a=o.method.toUpperCase();if(a==="OPTIONS"||s==="/"||s==="")return await He(e,o);if(a!=="GET"&&a!=="POST")return U(405,{error:"method_not_allowed",message:`Method ${a} not allowed`});let u=Object.fromEntries(i.searchParams);for(let l of as){if(l.method!==a)continue;let c=Ju(l.pattern,s);if(!c)continue;let d=await Yu(o);return await l.handler({corsair:e,internal:r,req:o,params:c,query:u,body:d})}throw Te(`No route for ${a} ${s}`)}catch(i){if(n.onError){let a=await n.onError(i,o);if(a)return a}if(i instanceof E)return ci(i);let s=i instanceof Error?i.message:"Internal server error";return U(500,{error:"internal_error",message:s})}}}function Xu(e){let n=e.get?.("host")??"localhost",t=e.protocol??"http",r=e.originalUrl??e.url,o=`${t}://${n}${r}`,i=new Headers;for(let[u,l]of Object.entries(e.headers))if(l!=null)if(Array.isArray(l))for(let c of l)i.append(u,c);else i.set(u,l);let s=e.method!=="GET"&&e.method!=="HEAD",a={method:e.method,headers:i};return s&&e.body!==void 0&&(a.body=typeof e.body=="string"?e.body:JSON.stringify(e.body),i.has("content-type")||i.set("content-type","application/json")),new Request(o,a)}async function ec(e,n){e.status(n.status),n.headers.forEach((r,o)=>e.setHeader(o,r));let t=Buffer.from(await n.arrayBuffer());e.send(t)}function us(e,n){let t=Fe(e,n);return async(r,o,i)=>{try{let s=await t(Xu(r));await ec(o,s)}catch(s){i(s)}}}function cs(e,n){let t=Fe(e,n);return r=>t(r.req.raw)}function ls(e,n){let t=Fe(e,n);return{GET:t,POST:t,OPTIONS:t}}function ds(e){let n={[Tn]:e};return{ok:et,tenants:{list:()=>Ye(e),create:t=>rt(e,t),get:t=>tt(e,t)},plugins:{list:()=>Ve(e),get:t=>nt(e,t)},connectionStatus:{get:t=>ot(e,t?.tenantId)},permissions:{get:t=>yi(e,t)},connect:{createLink:t=>it(n,e,t),resolve:t=>st(n,e,t),oauthCallback:t=>at(n,e,t)}}}async function ps(e,n,t,r,o="pending"){if(!e)return null;try{let i=mo(),s=new Date;return await e.db.insertInto("corsair_events").values({id:i,created_at:s,updated_at:s,account_id:n,event_type:t,payload:r,status:o}).execute(),i}catch(i){return console.warn("Failed to log event:",i),null}}async function nc(e,n,t,r="pending"){try{let o=await e.$getAccountId();return ps(e.database,o,n,t,r)}catch(o){return console.warn("Failed to log event:",o),null}}import*as fs from"https";import*as Pt from"querystring";var tc=["expires_in","refresh_token_expires_in"];function gs(e){let n={...e};for(let t of tc){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function rc(e){try{return gs(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=Pt.parse(e);return!n.access_token&&!n.error?null:gs({...n})}function qn(e,n,t,r,o){let i=new URL(r.tokenUrl),s=r.tokenAuthMethod==="basic";return new Promise((a,u)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};s||(l.client_id=n,l.client_secret=t);let c=Pt.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(c).toString()};s&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=fs.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){u(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=rc(f);h?a(h):u(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>u(new Error(`Request failed: ${g.message}`))),p.write(c),p.end()})}var ys="  ";function Y(e){let n=e;return n._def??n.def??{}}function Q(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function V(e){return e.innerType??e.schema??e.out??e.in}function hs(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return V(e)}}function ks(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function At(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function nn(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function bs(e,n){return e.description??n.description}function oc(e){let n=e;for(;n;){let t=Y(n),r=bs(n,t);if(r)return r;let o=Q(t);if(to(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=hs(t,o);continue}break}}function to(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function W(e){let n=Y(e),t=Q(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??nn(n)[0]??"unknown");case"ZodEnum":return nn(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=V(n);return r?W(r):"unknown"}case"ZodNullable":{let r=V(n);return`${r?W(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=V(n);return r?W(r):"unknown"}case"ZodArray":{let r=ks(n);if(!r)return"unknown[]";let o=Y(r),i=Q(o)==="ZodUnion",s=W(r);return`${i?`(${s})`:s}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=At(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([s,a])=>{let u=Q(Y(a));return`${u==="ZodOptional"||u==="ZodNullable"?s+"?":s}: ${W(a)}`}).join(", ")} }`}case"ZodUnion":return nn(n).map(r=>W(r)).join(" | ");case"ZodIntersection":return`${W(n.left)} & ${W(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=hs(n,t);return r?W(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function ye(e){let n=Y(e),t=Q(n),r=bs(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??nn(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=nn(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=V(n),i=o?ye(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=V(n),i=o?ye(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=V(n);return o?{...ye(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=ks(n);return{kind:"array",optional:!1,description:r,items:o?ye(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=At(e,n),i={};for(let[s,a]of Object.entries(o))i[s]=ye(a);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=nn(n);for(let i of o){let s=Y(i);if(Q(s)==="ZodObject")return{...ye(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=V(n);return o?{...ye(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function ik(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),s=e.find(c=>c.id===o);if(!s)return null;let a=i;a.startsWith("api.")&&(a=a.slice(4));let u=xe(s.endpointMeta,a),l=xe(s.endpointSchemas,a);return!u&&!l?null:{input:l?.input?ye(l.input):null,output:l?.output?ye(l.output):null,description:u?.description}}var ro=["equals","contains","startsWith","endsWith","in"],ic=["equals","gt","gte","lt","lte","in"],sc=["equals"],ac=["equals","before","after","between"];function ws(e){let n=Y(e);switch(Q(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=V(n);return r?ws(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function oo(e){let n=Y(e),t=Q(n);if(to(t)){let i=V(n);return i?oo(i):{}}if(t!=="ZodObject")return{};let r=At(e,n),o={};for(let[i,s]of Object.entries(r)){let a=ws(s);a==="string"?o[i]={type:"string",operators:ro}:a==="number"?o[i]={type:"number",operators:ic}:a==="boolean"?o[i]={type:"boolean",operators:sc}:a==="date"&&(o[i]={type:"date",operators:ac})}return o}function Cs(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function Xr(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&Xr(o,i,t)}}function eo(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function no(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];eo(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&no(o,i,t)}}function io(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([a])=>a.toLowerCase()===t);if(!o)return null;let[i,s]=o;if(r.length===0)return eo(s)?[i]:null;if(s!==null&&typeof s=="object"&&!eo(s)){let a=io(s,r);if(a!==null)return[i,...a]}return null}function vs(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let s="    ".repeat(i+2);t.push(`${s}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let s="    ".repeat(i+2);t.push(`${s}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var uc=new Set(In);function Ue(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(a=>a.id===r);if(!i)return uc.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:Ue(e);if(t==="webhooks"){if(!i.webhooks)return[];let a=[];return no(i.webhooks,[],a),a.map(u=>`${i.id}.webhooks.${u}`)}if(t==="db"){let a=i.schema?.entities;return a?Object.keys(a).map(u=>`${i.id}.db.${u}.search`):[]}if(!i.endpoints)return[];let s=[];return Xr(i.endpoints,[],s),s.map(a=>`${i.id}.api.${a}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let s=[];no(i.webhooks,[],s),o[i.id]=s.map(a=>`${i.id}.webhooks.${a}`)}else if(t==="db")for(let i of e){let s=i.schema?.entities;s&&(o[i.id]=Object.keys(s).map(a=>`${i.id}.db.${a}.search`))}else for(let i of e){if(!i.endpoints)continue;let s=[];Xr(i.endpoints,[],s),o[i.id]=s.map(a=>`${i.id}.api.${a}`)}return o}function xe(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function cc(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),s=i.startsWith(".")?i.slice(1):i;return s.startsWith("api.")&&(s=s.slice(4)),{shortPath:s,lookupKey:s}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function Qr(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function sk(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),s=e.find(a=>a.id===o);if(s){if(i.startsWith("db.")){let c=i.slice(3),d=c.lastIndexOf(".");if(d!==-1){let p=c.slice(0,d),g=c.slice(d+1),f=s.schema?.entities;if(g==="search"&&f){let h=Cs(f,p);if(h){let[b,k]=h,C=oo(k),P=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${ro.join(", ")}]`];for(let[D,_]of Object.entries(C))P.push(`  ${D}?: ${_.type}  [${_.operators.join(", ")}]`);return P.push("}"),P.join(`
+`)}}}return Qr(Ue(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let c=i.slice(9);if(s.webhooks){let d=io(s.webhooks,c.split("."));if(d!==null){let p=d.join("."),g=xe(s.webhookSchemas,p.toLowerCase()),f=g?.response?W(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${Tt(tn(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${vs(o,d)}`),h.join(`
+
+`)}}return Qr(Ue(e,{type:"webhooks"}),"Path not found. Available webhooks")}let a=i;a.startsWith("api.")&&(a=a.slice(4));let u=xe(s.endpointMeta,a),l=xe(s.endpointSchemas,a);if(u||l){let c=[],d=[u?.riskLevel?`[${u.riskLevel}]`:"",u?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[u?.description,d].filter(Boolean).join("  ");return p&&c.push(p),l?.input&&c.push(`input ${Tt(tn(l.input))}`),l?.output&&c.push(`output ${Tt(tn(l.output))}`),c.join(`
+
+`)}}}return Qr(Ue(e),"Path not found. Available operations")}function ms(e){let n=e;for(;;){let t=Y(n),r=Q(t);if(to(r)){let o=V(t);if(!o)return n;n=o;continue}return n}}function tn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=ms(e),t=Y(n);if(Q(t)==="ZodObject"){let o=At(n,t),i=[];for(let[s,a]of Object.entries(o)){let u=Y(a),l=Q(u),c=l==="ZodOptional"||l==="ZodNullable",d=ms(a),p=oc(a);i.push({key:s,optional:c,type:W(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:W(n)}}function Tt(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=ys.repeat(n+1),r=ys.repeat(n);return`{
+${e.fields.map(i=>{let s=i.optional?`${i.key}?`:i.key,a=i.description?`  // ${i.description}`:"";return`${t}${s}: ${i.type}${a}`}).join(`
+`)}
+${r}}`}return"unknown"}function lc(e,n){let t=Ue(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(c=>c.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let c of t){let{shortPath:d,lookupKey:p}=cc(c,n),g=xe(r.endpointMeta,p),f=xe(r.endpointSchemas,p);!g&&!f||o.push({path:c,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:tn(f?.input),output:tn(f?.output)})}o.sort((c,d)=>c.path.localeCompare(d.path));let i=[],s=Ue(e,{plugin:n,type:"webhooks"});if(Array.isArray(s)&&r.webhooks)for(let c of s){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=io(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=xe(r.webhookSchemas,b.toLowerCase()),C=k?.response?W(k.response):void 0;i.push({path:c,description:k?.description,payload:tn(k?.payload),responseType:C,usageExample:vs(n,h)})}i.sort((c,d)=>c.path.localeCompare(d.path));let a=[],u=Ue(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(u)&&l)for(let c of u){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let C=Cs(l,b);if(!C)continue;let[P,D]=C,_=oo(D),O=Object.entries(_).map(([w,T])=>({field:w,type:T.type,operators:T.operators}));a.push({path:c,entityName:P,filters:[{field:"entity_id",type:"string",operators:ro},...O]})}return a.sort((c,d)=>c.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:a}}}import{randomUUID as Ps}from"crypto";async function dc(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Ps(),o=Ps(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as pc}from"crypto";var xt="https://graph.microsoft.com/v1.0",so=2e4,gc=60;async function fc(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let u=await fetch(`${xt}/subscriptions`,{headers:r,signal:AbortSignal.timeout(so)});if(u.ok){let{value:l}=await u.json(),c=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(c.map(d=>fetch(`${xt}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(so)}).catch(()=>{})))}}catch{}let o=pc(),i=new Date(Date.now()+gc*6e4).toISOString(),s=await fetch(`${xt}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(so),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!s.ok)throw new Error(`MS Graph subscribe failed (${s.status}): ${await s.text()}`);let a=await s.json();return a.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:a.id},webhookSecret:o}):null}function Ts(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function yc(e,n){let t=Ts(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function mc(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function As(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function xs(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function An(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function hc(e){return An(e.body)}function Rs(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Rt(Array.isArray(r)?r:[r])}function Is(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let u of t){let l=Rt(Array.isArray(u)?u:[u]);if(l)return decodeURIComponent(l)}let r=Rs({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let u of o){let l=n[u],c=Array.isArray(l)?l[0]:l;if(!(!c||typeof c!="string"))try{let p=(c.startsWith("http")?new URL(c):new URL(`https://example.invalid${c.startsWith("/")?c:`/${c}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,s=An(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Rt([s?.validationToken])??null}function kc(e){if(Is(e))return!0;let n=An(e.body??e.payload);return As(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Rt(e){for(let n of e){let t=xs(n);if(t)return t}}function bc(e){let t=An(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var Tn=Symbol.for("corsair:internal");function Es(e){let n=e.database?lo(e.database):void 0,t=n&&e.kek?is(e.plugins,n,e.kek):vt(!!n,!!e.kek),r=ss(e),o={plugins:e.plugins,database:n,kek:e.kek,multiTenancy:!!e.multiTenancy,permissions:r,manual:e.manual,hub:e.hub?Fn(e.hub):void 0},i=ai(n),s=ds(o);if(e.multiTenancy){let l=Object.assign({withTenant:c=>{if(!c)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let d=Yr(e.plugins,{database:n,tenantId:c,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:o.hub,internalConfig:o});return Object.assign(d,{[Tn]:o})},keys:t,permissions:i,manage:s},{[Tn]:o});return Ss(l,o.hub),_s(l,o.hub),l}let a=Yr(e.plugins,{database:n,tenantId:void 0,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:o.hub,internalConfig:o}),u=Object.assign({},a,{keys:t,permissions:i,manage:s,[Tn]:o});return Ss(u,o.hub),_s(u,o.hub),u}function Ss(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-L5YFQ3SF.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function wc(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var It=globalThis.__corsairTunnels??=new Set;function _s(e,n){if(!wc(n))return;let t=n.projectApiKey;if(It.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}It.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Et;import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:()=>It.delete(t)})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Dt}`)}).catch(s=>{It.delete(t),console.warn(`[corsair] tunnel failed to start: ${s instanceof Error?s.message:String(s)}. Run \`corsair setup\` to enable your dev tunnel.`)})}var Cc={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},ao=Cc;async function Zn(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},s=n?.caller??"script",a=go(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let u=Oc(e,a.plugins,n),l={...a,database:a.database},c=l.database.db;await Fc(c,i);let d=await Uc(c,l,u.tenantId,u.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Nc(e,u,n.credentials,l,o,i);let p=await Wc(d,u,o,s);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=Es({plugins:a.plugins,database:c,kek:a.kek,multiTenancy:!0}).withTenant(u.tenantId);await jc(g,a.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function uo(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...B[n][t],...r])}function Dc(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(a=>a.id===t);if(!o)continue;let i=x(o);if(!i)continue;let s=uo(o,i,"account");for(let a of Object.keys(r))if(s.has(a))return!0}return!1}function Oc(e,n,t){let r=fo(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Dc(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function Os(e,n){return he(e)?n===0?!0:Object.values(e).every(t=>Os(t,n-1)):!1}function Mc(e){return Os(e,4)}var Hc={...ho};function St(e){if(e instanceof Rc){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Ec?St(r):"unknown";return n}return e instanceof Ac?`${St(e.unwrap())} | null`:e instanceof Ic?`${St(e.unwrap())} | undefined`:e instanceof Tc?e.options.join(" | "):e instanceof _c?"string":e instanceof xc?"number":e instanceof vc?"boolean":e instanceof Pc?"date":e instanceof Sc?"jsonb":"unknown"}async function Fc(e,n){let t=await e.introspection.getTables(),r=new Set(t.map(o=>o.name));for(let[o,i]of Object.entries(Hc))r.has(o)||n(`[corsair:setup] Table "${o}" does not exist. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(St(i),null,2)}`)}async function Uc(e,n,t,r,o){let i=new Date,s=new Map;for(let a of n.plugins){let u=a.id,l=x(a),c=await e.selectFrom("corsair_integrations").selectAll().where("name","=",u).executeTakeFirst();if(!c){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:u,config:{},created_at:i,updated_at:i}).execute(),c=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${u}`)}let d=l?a.authConfig?.[l]?.integration??[]:[],p=l?a.authConfig?.[l]?.account??[]:[],g=l&&c?F({authType:l,integrationName:u,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(c&&!c.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${u}`)),!c||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",c.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:c.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${u}`)}f=h&&M({authType:l,integrationName:u,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${u}`))}s.set(u,{pluginId:u,authType:l,integration:g,account:f,integrationFields:[...B[l].integration,...d],accountFields:r?[...B[l].account,...p]:[]})}return s}function Bc(e){if(!he(e))return;let n=e.keys;return he(n)?n:void 0}function Lc(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Nc(e,n,t,r,o,i){let s=Bc(e),a=n.provisionAccounts?Lc(e,n.tenantId):void 0;for(let[u,l]of Object.entries(t)){let c=r.plugins.find(k=>k.id===u);if(!c){i(`[corsair:setup] Unknown plugin '${u}' \u2014 skipping credentials.`);continue}let d=x(c);if(!d){i(`[corsair:setup] Plugin '${u}' has no auth type \u2014 skipping credentials.`);continue}let p=uo(c,d,"integration"),g=uo(c,d,"account"),f=s?.[u],h=a?.[u],b=he(h)?h.keys:void 0;for(let[k,C]of Object.entries(l))if(C){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${u}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let P=j(f,`set_${k}`);if(!P){i(`[corsair:setup] Cannot set integration field '${k}' for '${u}'.`);continue}await P(C),o(`[corsair:setup] Set ${u} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${u}.${k}' on a multi-tenant instance`);let P=j(b,`set_${k}`);if(!P){i(`[corsair:setup] Cannot set account field '${k}' for '${u}'.`);continue}await P(C),o(`[corsair:setup] Set ${u} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${u}'.`)}}}var Ds=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function $c(e,n,t,r,o,i,s,a,u){let l=[],c=[];for(let p of o){if(Ds.has(p))continue;let g=j(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(Ds.has(p))continue;let g=j(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||c.push(p)}let d=l.length===0&&c.length===0;if(d)a(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")a(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...c];if(u==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");a(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of c){let h=s.provisionAccounts?s.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(s.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}a(g.join(`
+`))}}return d}async function Wc(e,n,t,r){let o=new Set;for(let i of e.values())await $c(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function jc(e,n,t,r,o){if(!Mc(ao)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=ao,s=new Set(n.map(a=>a.id));for(let[a,u]of Object.entries(i)){if(!s.has(a))continue;if(!t.has(a)){r(`[corsair:setup] Skipping backfill for '${a}' \u2014 auth not configured.`);continue}let l=he(e)?e[a]:void 0,c=he(l)?l.api:void 0;if(c)for(let[d,p]of Object.entries(u))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${a} \u203A ${d}.${g}...`);try{let h=he(c)?c[d]:void 0;await j(h,g)?.(f)}catch(h){o(`[corsair:setup] ${a} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{bo as a,ke as b,Sn as c,_n as d,En as e,Dn as f,wo as g,On as h,Lt as i,sn as j,xo as k,Ro as l,be as m,Se as n,ae as o,Le as p,Ne as q,we as r,$t as s,So as t,cn as u,ue as v,Fn as w,H as x,Un as y,$e as z,ce as A,le as B,z as C,Wt as D,dn as E,Ce as F,de as G,pn as H,F as I,M as J,Fo as K,Uo as L,Zn as M,Nc as N,Pe as O,Kt as P,Ke as Q,qe as R,Zt as S,Kn as T,Go as U,De as V,$ as W,Gt as X,mn as Y,Yo as Z,ha as _,Gn as $,ep as aa,ei as ba,ni as ca,ti as da,zt as ea,zn as fa,Jt as ga,Vn as ha,Yn as ia,Je as ja,Xn as ka,nr as la,si as ma,tr as na,ur as oa,cr as pa,ut as qa,lr as ra,Qe as sa,Xe as ta,ct as ua,lt as va,hn as wa,dr as xa,pr as ya,dt as za,kn as Aa,pt as Ba,gt as Ca,Ae as Da,en as Ea,Ci as Fa,hr as Ga,kr as Ha,Me as Ia,Cn as Ja,vn as Ka,wt as La,Cr as Ma,Pn as Na,Pu as Oa,Iu as Pa,Eu as Qa,Ei as Ra,Di as Sa,Ar as Ta,xr as Ua,Rr as Va,Ir as Wa,Sr as Xa,He as Ya,K as Za,_r as _a,Ui as $a,Bi as ab,Er as bb,Dr as cb,Or as db,Mr as eb,Hr as fb,Fr as gb,Ur as hb,Br as ib,Lr as jb,Nr as kb,$r as lb,Wr as mb,jr as nb,Kr as ob,qr as pb,Fe as qb,us as rb,cs as sb,ls as tb,ps as ub,nc as vb,qn as wb,ik as xb,Ue as yb,sk as zb,Tt as Ab,lc as Bb,dc as Cb,xt as Db,fc as Eb,Ts as Fb,yc as Gb,mc as Hb,As as Ib,xs as Jb,An as Kb,hc as Lb,Rs as Mb,Is as Nb,kc as Ob,Rt as Pb,bc as Qb,Tn as Rb,Es as Sb,wc as Tb};

package/dist/{chunk-XLNT2UI2.js → chunk-RQ5QHONV.js}

@@ -1 +1 @@
-var c=class extends Error{status;code;extra;constructor(o,i,t,r={}){super(t),this.name="CorsairClientError",this.status=o,this.code=i,this.extra=r}};function g(e){return e.endsWith("/")?e.slice(0,-1):e}async function m(e){let o={};try{o=await e.json()}catch{}let i=typeof o.error=="string"?o.error:"request_failed",t=typeof o.message=="string"?o.message:`Request failed (${e.status})`,{error:r,message:u,...n}=o;return new c(e.status,i,t,n)}function k(e){let o=g(e.baseURL),i=e.fetch??((...n)=>globalThis.fetch(...n));async function t(n,s){let a=s&&Object.keys(s).length?`?${new URLSearchParams(s).toString()}`:"",l=await i(`${o}${n}${a}`,{method:"GET"});if(!l.ok)throw await m(l);return await l.json()}async function r(n,s){let a=await i(`${o}${n}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(s)});if(!a.ok)throw await m(a);return await a.json()}let u=encodeURIComponent;return{ok:()=>t("/ok"),tenants:{list:()=>t("/tenants"),create:n=>r("/tenants",n),get:n=>t(`/tenants/${u(n)}`)},plugins:{list:()=>t("/plugins"),get:n=>t(`/plugins/${u(n)}`)},connectionStatus:{get:n=>{let s={};return n?.tenantId&&(s.tenantId=n.tenantId),t("/connection-status",s)}},permissions:{get:n=>"id"in n?t(`/permissions/${u(n.id)}`):r("/permissions/lookup-by-token",{token:n.token})},connect:{createLink:n=>r("/connect/links",n),resolve:n=>t("/connect/resolve",{state:n}),oauthCallback:n=>r("/connect/oauth/callback",n)}}}export{c as a,k as b};
+var c=class extends Error{status;code;extra;constructor(o,i,t,r={}){super(t),this.name="CorsairClientError",this.status=o,this.code=i,this.extra=r}};function C(e){return e.endsWith("/")?e.slice(0,-1):e}async function m(e){let o={};try{o=await e.json()}catch{}let i=typeof o.error=="string"?o.error:"request_failed",t=typeof o.message=="string"?o.message:`Request failed (${e.status})`,{error:r,message:u,...n}=o;return new c(e.status,i,t,n)}function h(e){let o=C(e.baseURL),i=e.fetch??((...n)=>globalThis.fetch(...n));async function t(n,s){let a=s&&Object.keys(s).length?`?${new URLSearchParams(s).toString()}`:"",l=await i(`${o}${n}${a}`,{method:"GET"});if(!l.ok)throw await m(l);return await l.json()}async function r(n,s){let a=await i(`${o}${n}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(s)});if(!a.ok)throw await m(a);return await a.json()}let u=encodeURIComponent;return{ok:()=>t("/ok"),tenants:{list:()=>t("/tenants"),create:n=>r("/tenants",n),get:n=>t(`/tenants/${u(n)}`)},plugins:{list:()=>t("/plugins"),get:n=>t(`/plugins/${u(n)}`)},connectionStatus:{get:n=>{let s={};return n?.tenantId&&(s.tenantId=n.tenantId),t("/connection-status",s)}},permissions:{get:n=>"id"in n?t(`/permissions/${u(n.id)}`):r("/permissions/lookup-by-token",{token:n.token})},connect:{createLink:n=>r("/connect/links",n),resolve:n=>t("/connect/resolve",{state:n}),oauthCallback:n=>r("/connect/oauth/callback",n)}}}export{c as a,h as b};

package/dist/chunk-SI2MXDD3.js

@@ -0,0 +1 @@
+import{sql as b}from"kysely";export{b as a};

package/dist/chunk-SOY77BN4.js

@@ -0,0 +1 @@
+import m from"path";import{fileURLToPath as t}from"url";var e=()=>t(import.meta.url);var i=e();export{i as a};

package/dist/chunk-VOH7OVWP.js

@@ -0,0 +1 @@
+import{b as B,c as R,d as S,e as O}from"./chunk-F2EV3CHK.js";var H=Symbol.for("corsair:internal"),A=class extends Error{constructor(t="Invalid corsair instance"){super(t),this.name="InvalidCorsairInstanceError"}};function D(e){return typeof e=="object"&&e!==null}function v(e){if(!D(e)||!Array.isArray(e.plugins)||typeof e.kek!="string"||typeof e.multiTenancy!="boolean")return!1;if(e.database===void 0)return!0;if(!D(e.database))return!1;let t=e.database.db;return typeof t=="object"&&t!==null&&typeof t.selectFrom=="function"}function N(e){if(!e||typeof e!="object")return;let r=Object.getOwnPropertyDescriptor(e,H)?.value;return v(r)?r:void 0}function G(e,t){let r=N(e);if(!r)throw t?.()??new A;return r}function W(e,t){return e.plugins.find(r=>r.id===t)}function X(e,t,r){let n=W(e,t);if(!n)throw r(`Plugin '${t}' not found`);return n}function Y(e){return"withTenant"in e&&typeof e.withTenant=="function"}function q(e,t){if(!e||typeof e!="object")return;let r=e[t];return typeof r=="function"?(...n)=>Reflect.apply(r,e,n):void 0}var P={oauth_2:{integration:["client_id","client_secret","redirect_url"],account:["access_token","refresh_token","expires_at","scope","webhook_signature"]},api_key:{integration:[],account:["api_key","webhook_signature"]},bot_token:{integration:[],account:["bot_token","webhook_signature"]},managed:{integration:[],account:["access_token","refresh_token","expires_at","scope","webhook_signature"]}};function j(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function V(e){let t=e.options?.authType;return j(t)?t:void 0}function ee(e,t){let r=e.authConfig,n=P[t].account,i=r?.[t]?.account??[];return[...n,...i]}function _e(e,t){let r=e.authConfig,n=P[t].integration,i=r?.[t]?.integration??[];return[...n,...i]}import{v7 as te}from"uuid";function x(){return te()}import{z as b}from"zod";import{sql as C}from"kysely";function I(e){return e.replace(/'/g,"''")}function K(e){let t=I(e);return C`data->>'${C.raw(t)}'`}function U(e){let t=I(e);return C`(data->>'${C.raw(t)}')::numeric`}function Z(e){let t=I(e);return C`(data->>'${C.raw(t)}')::boolean`}function $(e){let t=I(e);return C`(data->>'${C.raw(t)}')::timestamptz`}function ne(e){if(typeof e=="string")try{return JSON.parse(e)}catch{return e}return e}function M(e){let t=e;for(;t;){if(t instanceof b.ZodOptional||t instanceof b.ZodNullable){t=t._def.innerType;continue}if(t instanceof b.ZodDefault){t=t._def.innerType;continue}break}return t}function re(e){let t=M(e);if(t instanceof b.ZodString)return"string";if(t instanceof b.ZodNumber)return"number";if(t instanceof b.ZodBoolean)return"boolean";if(t instanceof b.ZodDate)return"date"}function ie(e){let t=M(e);if(!(t instanceof b.ZodObject))return{};let r=t.shape,n={};for(let[i,a]of Object.entries(r)){let u=re(a);u&&(n[i]=u)}return n}function oe(e,t,r){if(typeof r=="string")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;"equals"in n&&typeof n.equals=="string"&&(e=e.where(t,"=",n.equals)),"contains"in n&&typeof n.contains=="string"&&(e=e.where(t,"like",`%${n.contains}%`)),"startsWith"in n&&typeof n.startsWith=="string"&&(e=e.where(t,"like",`${n.startsWith}%`)),"endsWith"in n&&typeof n.endsWith=="string"&&(e=e.where(t,"like",`%${n.endsWith}`)),"in"in n&&Array.isArray(n.in)&&(e=e.where(t,"in",n.in))}return e}function se(e,t,r){if(typeof r=="number")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;typeof n.equals=="number"&&(e=e.where(t,"=",n.equals)),typeof n.gt=="number"&&(e=e.where(t,">",n.gt)),typeof n.gte=="number"&&(e=e.where(t,">=",n.gte)),typeof n.lt=="number"&&(e=e.where(t,"<",n.lt)),typeof n.lte=="number"&&(e=e.where(t,"<=",n.lte)),Array.isArray(n.in)&&(e=e.where(t,"in",n.in))}return e}function ae(e,t,r){if(typeof r=="boolean")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;typeof n.equals=="boolean"&&(e=e.where(t,"=",n.equals))}return e}function ue(e,t,r){if(r instanceof Date)return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;if(n.equals instanceof Date&&(e=e.where(t,"=",n.equals)),n.before instanceof Date&&(e=e.where(t,"<",n.before)),n.after instanceof Date&&(e=e.where(t,">",n.after)),Array.isArray(n.between)&&n.between.length===2){let[i,a]=n.between;i instanceof Date&&(e=e.where(t,">=",i)),a instanceof Date&&(e=e.where(t,"<=",a))}}return e}function ce(e,t,r,n){return r==="number"?se(e,U(t),n):r==="boolean"?ae(e,Z(t),n):r==="date"?ue(e,$(t),n):oe(e,K(t),n)}function de(e,t,r){if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;return"equals"in n&&(e=e.where(t,"=",n.equals)),"contains"in n&&typeof n.contains=="string"&&(e=e.where(t,"like",`%${n.contains}%`)),"startsWith"in n&&typeof n.startsWith=="string"&&(e=e.where(t,"like",`${n.startsWith}%`)),"endsWith"in n&&typeof n.endsWith=="string"&&(e=e.where(t,"like",`%${n.endsWith}`)),"in"in n&&Array.isArray(n.in)&&(e=e.where(t,"in",n.in)),e}return e.where(t,"=",r)}function le(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):Number.parseInt(String(e??0),10)}function T(e,t,r){return e.selectFrom("corsair_entities").selectAll().where("account_id","=",t).where("entity_type","=",r)}function Q(e,t,r,n,i){let a=ie(i);function u(o){let l=ne(o.data);return{...o,data:i.parse(l)}}return{findByEntityId:async o=>{let l=await t(),c=await T(e,l,r).where("entity_id","=",o).executeTakeFirst();return c?u(c):null},existsByEntityId:async o=>{let l=await t();return await T(e,l,r).select("id").where("entity_id","=",o).executeTakeFirst()!==void 0},findIdByEntityId:async o=>{let l=await t();return(await T(e,l,r).select("id").where("entity_id","=",o).executeTakeFirst())?.id??null},findById:async o=>{let l=await t(),c=await T(e,l,r).where("id","=",o).executeTakeFirst();return c?u(c):null},findManyByEntityIds:async o=>{if(o.length===0)return[];let l=await t();return(await T(e,l,r).where("entity_id","in",o).execute()).map(u)},list:async o=>{let l=await t(),c=T(e,l,r);return typeof o?.limit=="number"&&(c=c.limit(o.limit)),typeof o?.offset=="number"&&(c=c.offset(o.offset)),(await c.execute()).map(u)},search:async o=>{let l=await t(),c=T(e,l,r),d=new Set(["data","limit","offset"]);for(let[y,f]of Object.entries(o))d.has(y)||f===void 0||(c=de(c,y,f));if(o.data&&typeof o.data=="object")for(let[y,f]of Object.entries(o.data)){if(f===void 0)continue;let g=a[y]??"string";c=ce(c,y,g,f)}return typeof o.limit=="number"&&(c=c.limit(o.limit)),typeof o.offset=="number"&&(c=c.offset(o.offset)),(await c.execute()).map(u)},upsertByEntityId:async(o,l)=>{let c=await t(),d=i.parse(l),s=new Date,y=await T(e,c,r).select("id").where("entity_id","=",o).executeTakeFirst();if(y?.id){await e.updateTable("corsair_entities").set({version:n,data:d,updated_at:s}).where("id","=",y.id).execute();let _=await e.selectFrom("corsair_entities").selectAll().where("id","=",y.id).executeTakeFirst();return u(_)}let f=x();await e.insertInto("corsair_entities").values({id:f,created_at:s,updated_at:s,account_id:c,entity_id:o,entity_type:r,version:n,data:d}).execute();let g=await e.selectFrom("corsair_entities").selectAll().where("id","=",f).executeTakeFirst();return u(g)},deleteById:async o=>{let l=await t(),c=await e.deleteFrom("corsair_entities").where("account_id","=",l).where("entity_type","=",r).where("id","=",o).executeTakeFirst();return Number(c.numDeletedRows)>0},deleteByEntityId:async o=>{let l=await t(),c=await e.deleteFrom("corsair_entities").where("account_id","=",l).where("entity_type","=",r).where("entity_id","=",o).executeTakeFirst();return Number(c.numDeletedRows)>0},count:async()=>{let o=await t(),l=await e.selectFrom("corsair_entities").select(c=>c.fn.countAll().as("count")).where("account_id","=",o).where("entity_type","=",r).executeTakeFirst();return le(l?.count)}}}var ye={corsair_integrations:B,corsair_accounts:R,corsair_entities:S,corsair_events:O};function fe(e){return ye[e]}function z(e){if(typeof e=="string")try{return JSON.parse(e)}catch{return e}return e}function p(e){if(!e)throw new Error("Corsair database is not configured. Pass `database` to createCorsair(...) to enable ORM.")}function k(e){if(!e)return[];let t=[];for(let r in e){let n=r,i=e[n];if(i!==void 0)if(typeof i=="object"&&i!==null&&!Array.isArray(i)&&!(i instanceof Date)){let a=i;"in"in a&&Array.isArray(a.in)?t.push({field:n,operator:"in",value:a.in}):"like"in a&&typeof a.like=="string"&&t.push({field:n,operator:"like",value:a.like})}else t.push({field:n,value:i})}return t}function m(e,t){if(!t?.length)return e;let r=e;for(let n of t){let i=n.operator??"=";r=r.where(n.field,i,n.value)}return r}function pe(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):Number.parseInt(String(e??0),10)}function E(e,t){let r=fe(t),n=()=>(p(e),e),i=()=>n().db.selectFrom(t),a=()=>n().db.insertInto(t),u=()=>n().db.updateTable(t),o=()=>n().db.deleteFrom(t);function l(d){let s={};for(let[y,f]of Object.entries(d))s[y]=z(f);return r.parse(s)}function c(d){let s={};for(let[y,f]of Object.entries(d))s[y]=z(f);return r.parse(s)}return{findById:async d=>{p(e);let s=i().selectAll();s=m(s,[{field:"id",value:d}]);let y=await s.executeTakeFirst();return y?l(y):null},findOne:async d=>{p(e);let s=i().selectAll();s=m(s,k(d));let y=await s.executeTakeFirst();return y?l(y):null},findMany:async d=>{p(e);let s=i().selectAll();return s=m(s,k(d?.where)),typeof d?.limit=="number"&&(s=s.limit(d.limit)),typeof d?.offset=="number"&&(s=s.offset(d.offset)),(await s.execute()).map(f=>l(f))},create:async d=>{p(e);let s=new Date,y={id:d.id??x(),created_at:s,updated_at:s,...d},f=await a().values(y).returningAll().executeTakeFirst();return f?l(f):c(y)},update:async(d,s)=>{p(e);let y={...s,updated_at:new Date},f=u().set(y).returningAll();f=m(f,[{field:"id",value:d}]);let g=await f.executeTakeFirst();return g?l(g):null},updateMany:async(d,s)=>{p(e);let y={...s,updated_at:new Date},f=i().select("id");f=m(f,k(d));let g=await f.execute();for(let _ of g){let F=u().set(y);F=m(F,[{field:"id",value:_.id}]),await F.execute()}return g.length},delete:async d=>{p(e);let s=o();s=m(s,[{field:"id",value:d}]);let y=await s.executeTakeFirst();return Number(y?.numDeletedRows??0)>0},deleteMany:async d=>{p(e);let s=o();s=m(s,k(d));let y=await s.executeTakeFirst();return Number(y?.numDeletedRows??0)},count:async d=>{p(e);let s=i().select(f=>f.fn.countAll().as("count"));s=m(s,k(d));let y=await s.executeTakeFirst();return pe(y?.count)}}}function ge(e){let t=E(e,"corsair_integrations");return{...t,findByName:r=>t.findOne({name:r}),upsertByName:async(r,n)=>{let i=await t.findOne({name:r});return i?await t.update(i.id,n):t.create({...n,name:r})}}}function me(e){let t=E(e,"corsair_accounts");return{...t,findByTenantAndIntegration:async(r,n)=>{p(e);let i=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();return i?t.findOne({tenant_id:r,integration_id:i.id}):null},listByTenant:(r,n)=>t.findMany({where:{tenant_id:r},limit:n?.limit,offset:n?.offset}),upsertByTenantAndIntegration:async(r,n,i)=>{let a=await t.findOne({tenant_id:r,integration_id:n});return a?await t.update(a.id,i):t.create({...i,tenant_id:r,integration_id:n})}}}function we(e){let t=E(e,"corsair_entities");return{...t,findByEntityId:({accountId:r,entityType:n,entityId:i})=>t.findOne({account_id:r,entity_type:n,entity_id:i}),findManyByEntityIds:async({accountId:r,entityType:n,entityIds:i})=>i.length===0?[]:(p(e),await e.db.selectFrom("corsair_entities").selectAll().where("account_id","=",r).where("entity_type","=",n).where("entity_id","in",i).execute()),listByScope:({accountId:r,entityType:n,limit:i,offset:a})=>t.findMany({where:{account_id:r,entity_type:n},limit:i,offset:a}),searchByEntityId:async({accountId:r,entityType:n,query:i,limit:a,offset:u})=>{p(e);let o=e.db.selectFrom("corsair_entities").selectAll().where("account_id","=",r).where("entity_type","=",n).where("entity_id","like",`%${i}%`);return typeof a=="number"&&(o=o.limit(a)),typeof u=="number"&&(o=o.offset(u)),await o.execute()},upsertByEntityId:async({accountId:r,entityType:n,entityId:i,version:a,data:u})=>{let o=await t.findOne({account_id:r,entity_type:n,entity_id:i});return o?await t.update(o.id,{version:a,data:u}):t.create({account_id:r,entity_type:n,entity_id:i,version:a,data:u})},deleteByEntityId:async({accountId:r,entityType:n,entityId:i})=>{p(e);let a=await e.db.deleteFrom("corsair_entities").where("account_id","=",r).where("entity_type","=",n).where("entity_id","=",i).executeTakeFirst();return Number(a.numDeletedRows)>0}}}function he(e){let t=E(e,"corsair_events");return{...t,listByAccount:(r,n)=>t.findMany({where:{account_id:r},limit:n?.limit,offset:n?.offset}),listByStatus:(r,n)=>{let i={status:r};return n?.accountId&&(i.account_id=n.accountId),t.findMany({where:i,limit:n?.limit,offset:n?.offset})},listPending:r=>{let n={status:"pending"};return r?.accountId&&(n.account_id=r.accountId),t.findMany({where:n,limit:r?.limit??100})},updateStatus:(r,n)=>t.update(r,{status:n})}}function L(e){return{integrations:ge(e),accounts:me(e),entities:we(e),events:he(e)}}function Ce(e,t,r,n,i){let a=null;async function u(){if(a!==null)return a;p(e);let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",t.integrationName).executeTakeFirst();if(!o)throw new Error(`Integration "${t.integrationName}" not found. Make sure to create the integration first.`);let l=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t.tenantId).where("integration_id","=",o.id).executeTakeFirst();if(!l)throw new Error(`Account not found for tenant "${t.tenantId}" and integration "${t.integrationName}". Make sure to create the account first.`);return a=l.id,a}return p(e),Q(e.db,u,r,n,i)}function J(e){let{database:t,integrationName:r,schema:n,tenantId:i}=e,a=L(t),u={tenantId:i,integrationName:r},o=null;async function l(){if(o!==null)return o;p(t);let d=await t.db.selectFrom("corsair_integrations").selectAll().where("name","=",r).executeTakeFirst();if(!d)throw new Error(`Integration "${r}" not found. Make sure to create the integration first.`);let s=await t.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",i).where("integration_id","=",d.id).executeTakeFirst();if(!s)throw new Error(`Account not found for tenant "${i}" and integration "${r}". Make sure to create the account first.`);return o=s.id,o}let c={};for(let[d,s]of Object.entries(n.entities))c[d]=Ce(t,u,d,n.version,s);return{...c,$orm:a,$integrationName:r,$tenantId:i,$getAccountId:l}}function Ye(e,t){let r=L(e);return{$tenantId:t,$orm:r,listAccounts:n=>r.accounts.listByTenant(t,n),findAccountByIntegration:n=>r.accounts.findByTenantAndIntegration(t,n),listEntities:async n=>{p(e);let i=await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).execute();if(i.length===0)return[];let a=i.map(o=>o.id),u=e.db.selectFrom("corsair_entities").selectAll().where("account_id","in",a);return n?.entityType&&(u=u.where("entity_type","=",n.entityType)),typeof n?.limit=="number"&&(u=u.limit(n.limit)),typeof n?.offset=="number"&&(u=u.offset(n.offset)),await u.execute()},listEvents:async n=>{p(e);let i=await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).execute();if(i.length===0)return[];let a=i.map(o=>o.id),u=e.db.selectFrom("corsair_events").selectAll().where("account_id","in",a);return n?.status&&(u=u.where("status","=",n.status)),typeof n?.limit=="number"&&(u=u.limit(n.limit)),typeof n?.offset=="number"&&(u=u.offset(n.offset)),await u.execute()},forIntegration:n=>J({database:e,integrationName:n.integrationName,schema:n.schema,tenantId:t})}}function qe(e,t){return{forTenant:r=>J({database:e,integrationName:t.integrationName,schema:t.schema,tenantId:r})}}export{A as a,D as b,N as c,G as d,X as e,Y as f,q as g,P as h,V as i,ee as j,_e as k,x as l,Q as m,ye as n,L as o,J as p,Ye as q,qe as r};

package/dist/client/react/index.js

@@ -1 +1 @@
-import{b as C}from"../../chunk-XLNT2UI2.js";import{useCallback as d,useEffect as m,useReducer as y,useRef as T}from"react";function R(r,t){switch(t.type){case"FETCH":return{status:"loading",data:null,error:null,loading:!0};case"SUCCESS":return{status:"success",data:t.data,error:null,loading:!1};case"ERROR":return{status:"error",data:null,error:t.error,loading:!1};case"RESET":return{status:"idle",data:null,error:null,loading:!1}}}var f={status:"idle",data:null,error:null,loading:!1};function l(r,t){let[a,s]=y(R,f),i=T(r);i.current=r;let e=T(0),u=d(()=>{let c=++e.current;s({type:"FETCH"}),i.current().then(o=>{c===e.current&&s({type:"SUCCESS",data:o})}).catch(o=>{c===e.current&&s({type:"ERROR",error:o instanceof Error?o:new Error(String(o))})})},[]);return m(()=>(u(),()=>{e.current++}),t),{...a,refetch:u}}function p(r){let[t,a]=y(R,f),s=d(async i=>{a({type:"FETCH"});try{let e=await r(i);return a({type:"SUCCESS",data:e}),e}catch(e){let u=e instanceof Error?e:new Error(String(e));throw a({type:"ERROR",error:u}),u}},[]);return{data:t.data,loading:t.loading,error:t.error,mutate:s}}function I(r){let t=C(r);function a(){return l(()=>t.tenants.list(),[])}function s(n){return l(()=>t.tenants.get(n),[n])}function i(){return p(n=>t.tenants.create(n))}function e(){return l(()=>t.plugins.list(),[])}function u(n){return l(()=>t.plugins.get(n),[n])}function c(n){return l(()=>t.connectionStatus.get(n),[n?.tenantId])}function o(n){let A="id"in n?n.id:n.token;return l(()=>t.permissions.get(n),[A])}function g(){return p(n=>t.connect.createLink(n))}function S(){return p(n=>t.connect.oauthCallback(n))}return{client:t,useTenants:a,useTenant:s,useCreateTenant:i,usePlugins:e,usePlugin:u,useConnectionStatus:c,usePermission:o,useCreateConnectLink:g,useOAuthCallback:S}}export{I as createCorsairReactClient};
+import{b as C}from"../../chunk-RQ5QHONV.js";import"../../chunk-SOY77BN4.js";import{useCallback as d,useEffect as m,useReducer as y,useRef as T}from"react";function R(r,t){switch(t.type){case"FETCH":return{status:"loading",data:null,error:null,loading:!0};case"SUCCESS":return{status:"success",data:t.data,error:null,loading:!1};case"ERROR":return{status:"error",data:null,error:t.error,loading:!1};case"RESET":return{status:"idle",data:null,error:null,loading:!1}}}var f={status:"idle",data:null,error:null,loading:!1};function l(r,t){let[a,s]=y(R,f),i=T(r);i.current=r;let e=T(0),u=d(()=>{let c=++e.current;s({type:"FETCH"}),i.current().then(o=>{c===e.current&&s({type:"SUCCESS",data:o})}).catch(o=>{c===e.current&&s({type:"ERROR",error:o instanceof Error?o:new Error(String(o))})})},[]);return m(()=>(u(),()=>{e.current++}),t),{...a,refetch:u}}function p(r){let[t,a]=y(R,f),s=d(async i=>{a({type:"FETCH"});try{let e=await r(i);return a({type:"SUCCESS",data:e}),e}catch(e){let u=e instanceof Error?e:new Error(String(e));throw a({type:"ERROR",error:u}),u}},[]);return{data:t.data,loading:t.loading,error:t.error,mutate:s}}function O(r){let t=C(r);function a(){return l(()=>t.tenants.list(),[])}function s(n){return l(()=>t.tenants.get(n),[n])}function i(){return p(n=>t.tenants.create(n))}function e(){return l(()=>t.plugins.list(),[])}function u(n){return l(()=>t.plugins.get(n),[n])}function c(n){return l(()=>t.connectionStatus.get(n),[n?.tenantId])}function o(n){let A="id"in n?n.id:n.token;return l(()=>t.permissions.get(n),[A])}function g(){return p(n=>t.connect.createLink(n))}function S(){return p(n=>t.connect.oauthCallback(n))}return{client:t,useTenants:a,useTenant:s,useCreateTenant:i,usePlugins:e,usePlugin:u,useConnectionStatus:c,usePermission:o,useCreateConnectLink:g,useOAuthCallback:S}}export{O as createCorsairReactClient};

package/dist/connect-6VTU7HBO.js

@@ -0,0 +1 @@
+import{da as a,ea as b,fa as c}from"./chunk-RIGD4Y7Y.js";import"./chunk-KL3FGSOP.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/core.d.ts

@@ -1,8 +1,8 @@
-export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair, s as shouldStartTunnel } from './index-BjzfHSPn.js';
+export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair, s as shouldStartTunnel } from './index-B2XsUjnW.js';
 import { CorsairDatabase } from './db.js';
-import { A as AccountKeyManagerFor, I as IntegrationKeyManagerFor, f as CorsairPluginSubscribeResult } from './index-By4SUsQO.js';
-export { g as AccountFieldNames, a6 as AgentReply, k as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, h as BaseKeyManager, M as BeforeHookResult, n as BindEndpoints, ae as BindWebhooks, ac as Bivariant, o as BoundEndpointFn, p as BoundEndpointTree, af as BoundWebhook, ag as BoundWebhookTree, m as CorsairClient, q as CorsairContext, r as CorsairEndpoint, t as CorsairErrorHandler, c as CorsairIntegration, N as CorsairKeyBuilder, Q as CorsairKeyBuilderBase, ah as CorsairOAuthWebhookTenantLinkResolver, z as CorsairPermissionsNamespace, C as CorsairPlugin, S as CorsairPluginContext, U as CorsairPluginSubscribe, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, a7 as CorsairThreadsNamespace, ai as CorsairWebhook, aj as CorsairWebhookHandler, ak as CorsairWebhookMatcher, al as CorsairWebhookTenantMatcher, a8 as CreateThreadResult, V as EndpointHooks, X as EndpointMetaEntry, E as EndpointPathsOf, Y as EndpointRiskLevel, s as EndpointTree, D as EnforcePermissionOptions, F as EnforcePermissionResult, u as ErrorContext, v as ErrorHandler, w as ErrorHandlerAndMatchFunction, x as ErrorMatcher, i as IntegrationFieldNames, Z as KeyBuilderContext, j as OAuth2IntegrationCredentials, O as OAuthConfig, _ as PermissionMode, $ as PermissionPolicy, P as PluginAuthConfig, a0 as PluginEndpointMeta, a1 as PluginPermissionsConfig, am as RawWebhookRequest, K as ReadonlyForbiddenError, a2 as RequiredPluginEndpointMeta, a3 as RequiredPluginEndpointSchemas, a4 as RequiredPluginWebhookSchemas, R as RetryStrategies, y as RetryStrategy, a9 as ThreadHandle, aa as ThreadMessage, ab as ThreadSummary, T as TokenResponse, ad as UnionToIntersection, a5 as WebhookHooks, an as WebhookPathsOf, ao as WebhookRequest, ap as WebhookResponse, W as WebhookTenantMatch, aq as WebhookTree, G as assertReadonlyAllowed, l as exchangeCodeForTokens, J as isReadonlyScopeActive, L as runReadonly } from './index-By4SUsQO.js';
-export { A as AuthMissingError, D as DocSchemaFieldRow, a as DocSchemaShape, b as DocsApiEndpoint, c as DocsDbEntity, d as DocsDbFilterField, e as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, g as PermissionRequiredError, P as PluginDocsIntrospection, k as PluginWebhookMatchers, R as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, l as asRecord, h as collectPluginWebhookMatchers, n as decodePubSubData, o as extractMicrosoftGraphValidationToken, p as firstString, f as formatDocSchemaShape, q as getHeader, i as introspectPluginForDocs, s as isMicrosoftGraphValidationHandshake, m as matchWebhookPlugin, j as matchWebhookPluginAndTenant, t as readBodyRecord, u as readQueryParam, r as resolveConnectLink, v as toExternalId } from './tenant-match-utils-B-L5MHWg.js';
+import { A as AccountKeyManagerFor, I as IntegrationKeyManagerFor, f as CorsairPluginSubscribeResult } from './index-B-FvI2-D.js';
+export { g as AccountFieldNames, m as AgentMessageRole, n as AgentReply, k as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, h as BaseKeyManager, Y as BeforeHookResult, u as BindEndpoints, aj as BindWebhooks, ah as Bivariant, v as BoundEndpointFn, w as BoundEndpointTree, ak as BoundWebhook, al as BoundWebhookTree, o as ChatHandle, p as ChatMessage, q as ChatSummary, r as CorsairChatsNamespace, t as CorsairClient, x as CorsairContext, y as CorsairEndpoint, D as CorsairErrorHandler, c as CorsairIntegration, Z as CorsairKeyBuilder, _ as CorsairKeyBuilderBase, am as CorsairOAuthWebhookTenantLinkResolver, M as CorsairPermissionsNamespace, C as CorsairPlugin, $ as CorsairPluginContext, a0 as CorsairPluginSubscribe, ad as CorsairRunsNamespace, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, an as CorsairWebhook, ao as CorsairWebhookHandler, ap as CorsairWebhookMatcher, aq as CorsairWebhookTenantMatcher, aw as CorsairWorkflowsNamespace, s as CreateChatResult, a1 as EndpointHooks, a2 as EndpointMetaEntry, E as EndpointPathsOf, a3 as EndpointRiskLevel, z as EndpointTree, N as EnforcePermissionOptions, Q as EnforcePermissionResult, F as ErrorContext, G as ErrorHandler, J as ErrorHandlerAndMatchFunction, K as ErrorMatcher, i as IntegrationFieldNames, a4 as KeyBuilderContext, j as OAuth2IntegrationCredentials, O as OAuthConfig, a5 as PermissionMode, a6 as PermissionPolicy, P as PluginAuthConfig, a7 as PluginEndpointMeta, a8 as PluginPermissionsConfig, ar as RawWebhookRequest, V as ReadonlyForbiddenError, a9 as RequiredPluginEndpointMeta, aa as RequiredPluginEndpointSchemas, ab as RequiredPluginWebhookSchemas, R as RetryStrategies, L as RetryStrategy, T as TokenResponse, ax as TriggerRunResult, ai as UnionToIntersection, ac as WebhookHooks, as as WebhookPathsOf, at as WebhookRequest, au as WebhookResponse, W as WebhookTenantMatch, av as WebhookTree, ae as WorkflowRun, af as WorkflowRunStatus, ag as WorkflowRunStep, ay as WorkflowStatus, az as WorkflowSummary, S as assertReadonlyAllowed, l as exchangeCodeForTokens, U as isReadonlyScopeActive, X as runReadonly } from './index-B-FvI2-D.js';
+export { A as AuthMissingError, D as DocSchemaFieldRow, a as DocSchemaShape, b as DocsApiEndpoint, c as DocsDbEntity, d as DocsDbFilterField, e as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, g as PermissionRequiredError, P as PluginDocsIntrospection, k as PluginWebhookMatchers, R as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, l as asRecord, h as collectPluginWebhookMatchers, n as decodePubSubData, o as extractMicrosoftGraphValidationToken, p as firstString, f as formatDocSchemaShape, q as getHeader, i as introspectPluginForDocs, s as isMicrosoftGraphValidationHandshake, m as matchWebhookPlugin, j as matchWebhookPluginAndTenant, t as readBodyRecord, u as readQueryParam, r as resolveConnectLink, v as toExternalId } from './tenant-match-utils-Bu6w6L7r.js';
 import { A as AuthTypes } from './types-3hs1SH6L.js';
 export { g as AllProviders, B as BaseProviders, h as PickAuth, j as ProviderDisplayNames, i as formatProviderDisplayName } from './types-3hs1SH6L.js';
 import 'kysely';

package/dist/core.js

@@ -1 +1 @@
-import{A as d,Ab as z,B as e,Bb as A,C as f,Cb as B,D as g,Db as C,E as h,Eb as D,F as i,Fb as E,G as j,Gb as F,H as k,Hb as G,I as l,Ib as H,J as m,Jb as I,K as n,Kb as J,L as o,Lb as K,Mb as L,Nb as M,Ob as N,Pb as O,Qb as P,Rb as Q,Sb as R,Tb as S,Za as v,a,b,ga as p,ja as q,ka as r,la as s,ma as t,na as u,ub as w,vb as x,wb as y}from"./chunk-YDI4KN5B.js";import"./chunk-3EPM4FJ3.js";import{h as c}from"./chunk-WDF3YE27.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{v as AuthMissingError,c as BASE_AUTH_FIELDS,Q as CORSAIR_INTERNAL,C as MS_GRAPH_API_BASE,q as PermissionRequiredError,a as ProviderDisplayNames,r as ReadonlyForbiddenError,J as asRecord,u as assertReadonlyAllowed,G as collectPluginWebhookMatchers,m as createAccountKeyManager,R as createCorsair,l as createIntegrationKeyManager,P as decodePubSubData,j as decryptConfig,f as decryptDEK,h as decryptWithDEK,i as encryptConfig,e as encryptDEK,g as encryptWithDEK,y as exchangeCodeForTokens,M as extractMicrosoftGraphValidationToken,O as firstString,z as formatDocSchemaShape,b as formatProviderDisplayName,d as generateDEK,H as getHeader,B as googleChannelSubscribe,o as initializeAccountDEK,n as initializeIntegrationDEK,A as introspectPluginForDocs,N as isMicrosoftGraphValidationHandshake,t as isReadonlyScopeActive,w as logEvent,x as logEventFromContext,E as matchWebhookPlugin,F as matchWebhookPluginAndTenant,D as msGraphSubscribe,k as reEncryptConfig,K as readBodyRecord,L as readQueryParam,p as resolveConnectLink,s as runReadonly,S as shouldStartTunnel,I as toExternalId};
+import{A as d,Ab as z,B as e,Bb as A,C as f,Cb as B,D as g,Db as C,E as h,Eb as D,F as i,Fb as E,G as j,Gb as F,H as k,Hb as G,I as l,Ib as H,J as m,Jb as I,K as n,Kb as J,L as o,Lb as K,Mb as L,Nb as M,Ob as N,Pb as O,Qb as P,Rb as Q,Sb as R,Tb as S,Za as v,a,b,ga as p,ja as q,ka as r,la as s,ma as t,na as u,ub as w,vb as x,wb as y}from"./chunk-RIGD4Y7Y.js";import"./chunk-KL3FGSOP.js";import{h as c}from"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{v as AuthMissingError,c as BASE_AUTH_FIELDS,Q as CORSAIR_INTERNAL,C as MS_GRAPH_API_BASE,q as PermissionRequiredError,a as ProviderDisplayNames,r as ReadonlyForbiddenError,J as asRecord,u as assertReadonlyAllowed,G as collectPluginWebhookMatchers,m as createAccountKeyManager,R as createCorsair,l as createIntegrationKeyManager,P as decodePubSubData,j as decryptConfig,f as decryptDEK,h as decryptWithDEK,i as encryptConfig,e as encryptDEK,g as encryptWithDEK,y as exchangeCodeForTokens,M as extractMicrosoftGraphValidationToken,O as firstString,z as formatDocSchemaShape,b as formatProviderDisplayName,d as generateDEK,H as getHeader,B as googleChannelSubscribe,o as initializeAccountDEK,n as initializeIntegrationDEK,A as introspectPluginForDocs,N as isMicrosoftGraphValidationHandshake,t as isReadonlyScopeActive,w as logEvent,x as logEventFromContext,E as matchWebhookPlugin,F as matchWebhookPluginAndTenant,D as msGraphSubscribe,k as reEncryptConfig,K as readBodyRecord,L as readQueryParam,p as resolveConnectLink,s as runReadonly,S as shouldStartTunnel,I as toExternalId};

package/dist/db.js

@@ -1 +1 @@
-import{a as g}from"./chunk-N2XRSSRL.js";import{a,b,c,d,e,f}from"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{c as CorsairAccountsSchema,d as CorsairEntitiesSchema,e as CorsairEventsSchema,b as CorsairIntegrationsSchema,f as CorsairPermissionsSchema,a as createCorsairDatabase,g as sql};
+import{a as g}from"./chunk-SI2MXDD3.js";import{a,b,c,d,e,f}from"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as CorsairAccountsSchema,d as CorsairEntitiesSchema,e as CorsairEventsSchema,b as CorsairIntegrationsSchema,f as CorsairPermissionsSchema,a as createCorsairDatabase,g as sql};