corsair 0.1.118 → 0.1.119

package/dist/chunk-3TC2WIUS.js

@@ -0,0 +1 @@
+import{a as o}from"./chunk-SOY77BN4.js";var u="3000",f="/api/corsair";function m(r){return r.replace(/\/$/,"")}function I(r){let t=r?.deliveryUrl?.trim()||process.env.CORSAIR_DELIVERY_URL?.trim();if(t){let l=/^https?:\/\//i.test(t)?t:`https://${t}`;return m(l)}return`http://localhost:${process.env.PORT?.trim()||u}${f}`}var S="corsair.cloud",$="/api/corsair";import{chmodSync as R,existsSync as s,statSync as h}from"fs";import{createRequire as d}from"module";import{homedir as g}from"os";import{dirname as y,join as i}from"path";var _="0.71.0",v=d(o);function x(){let r=`@corsair-dev/frpc-${process.platform}-${process.arch}`;try{let t=i(y(v.resolve(`${r}/package.json`)),a());return s(t)?t:null}catch{return null}}function p(){return`${process.platform}-${process.arch}`}function a(){return process.platform==="win32"?"frpc.exe":"frpc"}function E(){return i(g(),".cache","corsair","frpc",_,p(),a())}function n(r){if(process.platform==="win32")return r;try{let t=h(r).mode&511,e=t|73;e!==t&&R(r,e)}catch{}return r}function b(){let r=process.env.CORSAIR_FRP_BIN;if(r&&s(r))return n(r);let t=x();if(t)return n(t);let e=E();if(s(e))return n(e);throw new Error(`frpc binary not found for ${p()}. If you use pnpm, run \`pnpm approve-builds corsair\` (or add corsair to onlyBuiltDependencies) and reinstall; otherwise reinstall corsair, or set CORSAIR_FRP_BIN to an frpc path (https://github.com/fatedier/frp/releases).`)}export{I as a,S as b,$ as c,_ as d,p as e,b as f};

package/dist/{chunk-HE4Z5CZQ.js → chunk-RWGMXXPK.js}

@@ -1,4 +1,4 @@
-import{a as me,b as Et,c as Dt}from"./chunk-KL3FGSOP.js";import{a as po,b as he,c as go,d as v,e as N,f as fo,g as j,h as B,i as x,j as Rn,k as yo,l as mo,m as _t,n as ho,o as bo}from"./chunk-VOH7OVWP.js";import{a as lo}from"./chunk-F2EV3CHK.js";import{ZodBoolean as vc,ZodDate as Pc,ZodEnum as Tc,ZodNullable as Ac,ZodNumber as xc,ZodObject as Rc,ZodOptional as Ic,ZodRecord as Sc,ZodString as _c,ZodType as Ec}from"zod";var In=["abstract","activecampaign","activetrail","addresszen","affinda","agencyzoom","agentmail","agentql","agenty","ahrefs","aimlapi","airtable","alchemy","algolia","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","apaleo","apibible","apify","apilabz","apininjas","apisports","asana","asindataapi","asyncinterview","ayrshare","baselinker","betterstack","bigmailer","bigml","bitbucket","bitwarden","blazemeter","bluesky","boloforms","botpress","box","bugsnag","cal","calendly","canvas","canva","circleci","cloudflare","cloudinary","collegefootballdata","confluence","cursor","databricks","datadog","deepseek","digitalocean","discord","dockerhub","dodopayments","doppler","dropbox","epicgames","exa","facebook","figma","firecrawl","fireflies","gemini","github","gitlab","gmail","googlebigquery","googlecalendar","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","habitica","hackernews","harvest","hashnode","heygen","hubspot","huggingface","insightoai","instagram","intercom","jira","linear","linkedin","loyverse","mailchimp","mailtrap","monday","neon","nextdns","notion","ocrspace","ollama","onedrive","onepassword","openai","openweathermap","oura","outlook","pagerduty","perplexityai","posthog","razorpay","reddit","resend","retailed","salesforce","sentry","serpapi","sharepoint","slack","spotify","strava","stripe","supabase","tally","tavily","teams","telegram","todoist","toggl","trello","twilio","twitter","twitterapiio","twochat","typeform","vapi","vercel","webflow","whatsapp","wiza","workday","xquik","youcom","youtube","zendesk","zohomail","zoom"],ko={abstract:"Abstract",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",alchemy:"Alchemy",algolia:"Algolia",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",apaleo:"Apaleo",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apisports:"API-Sports",asana:"Asana",asindataapi:"ASIN Data API",asyncinterview:"Async Interview",ayrshare:"Ayrshare",baselinker:"BaseLinker",betterstack:"Better Stack",bigmailer:"BigMailer",bigml:"BigML",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blazemeter:"BlazeMeter",bluesky:"Bluesky",boloforms:"Boloforms",botpress:"Botpress",box:"Box",bugsnag:"BugSnag",cal:"Cal",calendly:"Calendly",canvas:"Canvas LMS",canva:"Canva",circleci:"CircleCI",cloudflare:"Cloudflare",cloudinary:"Cloudinary",collegefootballdata:"College Football Data",confluence:"Confluence",cursor:"Cursor",databricks:"Databricks",datadog:"Datadog",deepseek:"DeepSeek",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",dodopayments:"Dodo Payments",doppler:"Doppler",dropbox:"Dropbox",epicgames:"Epic Games",exa:"Exa",facebook:"Facebook",figma:"Figma",firecrawl:"Firecrawl",fireflies:"Fireflies",gemini:"Gemini",github:"GitHub",gitlab:"GitLab",gmail:"Gmail",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",heygen:"HeyGen",hubspot:"HubSpot",huggingface:"Hugging Face",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jira:"Jira",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailchimp:"Mailchimp",mailtrap:"Mailtrap",monday:"Monday",neon:"Neon",nextdns:"NextDNS",notion:"Notion",ocrspace:"OCR.space",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",perplexityai:"Perplexity AI",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",resend:"Resend",retailed:"Retailed",salesforce:"Salesforce",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",spotify:"Spotify",strava:"Strava",stripe:"Stripe",supabase:"Supabase",tally:"Tally",tavily:"Tavily",teams:"Teams",telegram:"Telegram",todoist:"Todoist",toggl:"Toggl",trello:"Trello",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",vapi:"Vapi",vercel:"Vercel",webflow:"Webflow",whatsapp:"WhatsApp",wiza:"Wiza",workday:"Workday",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zohomail:"Zoho Mail",zoom:"Zoom"};function be(e){let n=ko[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}function I(e){return typeof e=="string"&&e.length>0}function Hs(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Fs(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function Sn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!I(n.connectUrl)||!I(n.token)||!I(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:I(n.environmentId)?n.environmentId:n.projectId};return I(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function _n(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!I(r.tenantId)||!I(r.plugin)||!Hs(r.status)||!Fs(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:I(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function En(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!I(n.approvalUrl)||!I(n.token)||!I(n.projectId)||!I(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function Dn(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(I(n.access_token))return{access_token:n.access_token,refresh_token:I(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:I(n.scope)?n.scope:void 0};throw new Error(I(n.error)?I(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Us(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Bs(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;I(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function Ls(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function wo(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!I(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!I(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",s=Bs(o.fields),a=Us(o.missingRequiredFields),u=Ls(o.status,o.connected,s,a);t.push({plugin:o.plugin,providerName:I(o.providerName)?o.providerName:o.plugin,authKind:i,status:u,connected:o.connected,fields:s,missingRequiredFields:a})}return{tenantId:n.tenantId,plugins:t}}function On(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Co(e){return e.replace(/\/$/,"")}function Ot(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return me()}catch{return null}}function vo(e){let n=Ot(e);return n?{"x-corsair-delivery-url":n}:{}}async function Po(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function To(e,n,t){if(n===404&&t)return t;let r=On(e);return r||`Hub API returned HTTP ${n}`}async function S(e){let n=Co(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...vo(e.hub)},body:JSON.stringify(e.body)}),r=await Po(t);if(!t.ok)throw new Error(To(r,t.status,e.notFoundMessage));return e.parseResponse(r)}async function L(e){let n=Co(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...vo(e.hub)}}),r=await Po(t);if(!t.ok)throw new Error(To(r,t.status,e.notFoundMessage));return e.parseResponse(r)}function Mn(e){return e&&typeof e=="object"?e:{}}function Ao(e){let n=Mn(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Mt(e,n){return S({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=Mn(t);return{chat:r.thread,reply:Ao(r.reply)}}})}async function Ht(e,n){return S({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Ao})}async function Ft(e,n){return L({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Mn(t).threads;return Array.isArray(r)?r:[]}})}async function Ut(e,n){return L({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=Mn(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Zs}from"crypto";var Ns="corsair:client-bridge";function Bt(e){return new URL(e).origin}function Be(e){let n=JSON.stringify({type:Ns,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Bt(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+import{a as me,b as Et,c as Dt}from"./chunk-3TC2WIUS.js";import{a as po,b as he,c as go,d as v,e as N,f as fo,g as j,h as B,i as x,j as Rn,k as yo,l as mo,m as _t,n as ho,o as bo}from"./chunk-VOH7OVWP.js";import{a as lo}from"./chunk-F2EV3CHK.js";import{ZodBoolean as vc,ZodDate as Pc,ZodEnum as Tc,ZodNullable as Ac,ZodNumber as xc,ZodObject as Rc,ZodOptional as Ic,ZodRecord as Sc,ZodString as _c,ZodType as Ec}from"zod";var In=["abstract","activecampaign","activetrail","addresszen","affinda","agencyzoom","agentmail","agentql","agenty","ahrefs","aimlapi","airtable","alchemy","algolia","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","apaleo","apibible","apify","apilabz","apininjas","apisports","asana","asindataapi","asyncinterview","ayrshare","baselinker","betterstack","bigmailer","bigml","bitbucket","bitwarden","blazemeter","bluesky","boloforms","botpress","box","bugsnag","cal","calendly","canvas","canva","circleci","cloudflare","cloudinary","collegefootballdata","confluence","cursor","databricks","datadog","deepseek","digitalocean","discord","dockerhub","dodopayments","doppler","dropbox","epicgames","exa","facebook","figma","firecrawl","fireflies","gemini","github","gitlab","gmail","googlebigquery","googlecalendar","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","habitica","hackernews","harvest","hashnode","heygen","hubspot","huggingface","insightoai","instagram","intercom","jira","linear","linkedin","loyverse","mailchimp","mailtrap","monday","neon","nextdns","notion","ocrspace","ollama","onedrive","onepassword","openai","openweathermap","oura","outlook","pagerduty","perplexityai","posthog","razorpay","reddit","resend","retailed","salesforce","sentry","serpapi","sharepoint","slack","spotify","strava","stripe","supabase","tally","tavily","teams","telegram","todoist","toggl","trello","twilio","twitter","twitterapiio","twochat","typeform","vapi","vercel","webflow","whatsapp","wiza","workday","xquik","youcom","youtube","zendesk","zohomail","zoom"],ko={abstract:"Abstract",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",alchemy:"Alchemy",algolia:"Algolia",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",apaleo:"Apaleo",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apisports:"API-Sports",asana:"Asana",asindataapi:"ASIN Data API",asyncinterview:"Async Interview",ayrshare:"Ayrshare",baselinker:"BaseLinker",betterstack:"Better Stack",bigmailer:"BigMailer",bigml:"BigML",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blazemeter:"BlazeMeter",bluesky:"Bluesky",boloforms:"Boloforms",botpress:"Botpress",box:"Box",bugsnag:"BugSnag",cal:"Cal",calendly:"Calendly",canvas:"Canvas LMS",canva:"Canva",circleci:"CircleCI",cloudflare:"Cloudflare",cloudinary:"Cloudinary",collegefootballdata:"College Football Data",confluence:"Confluence",cursor:"Cursor",databricks:"Databricks",datadog:"Datadog",deepseek:"DeepSeek",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",dodopayments:"Dodo Payments",doppler:"Doppler",dropbox:"Dropbox",epicgames:"Epic Games",exa:"Exa",facebook:"Facebook",figma:"Figma",firecrawl:"Firecrawl",fireflies:"Fireflies",gemini:"Gemini",github:"GitHub",gitlab:"GitLab",gmail:"Gmail",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",heygen:"HeyGen",hubspot:"HubSpot",huggingface:"Hugging Face",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jira:"Jira",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailchimp:"Mailchimp",mailtrap:"Mailtrap",monday:"Monday",neon:"Neon",nextdns:"NextDNS",notion:"Notion",ocrspace:"OCR.space",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",perplexityai:"Perplexity AI",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",resend:"Resend",retailed:"Retailed",salesforce:"Salesforce",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",spotify:"Spotify",strava:"Strava",stripe:"Stripe",supabase:"Supabase",tally:"Tally",tavily:"Tavily",teams:"Teams",telegram:"Telegram",todoist:"Todoist",toggl:"Toggl",trello:"Trello",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",vapi:"Vapi",vercel:"Vercel",webflow:"Webflow",whatsapp:"WhatsApp",wiza:"Wiza",workday:"Workday",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zohomail:"Zoho Mail",zoom:"Zoom"};function be(e){let n=ko[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}function I(e){return typeof e=="string"&&e.length>0}function Hs(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Fs(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function Sn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!I(n.connectUrl)||!I(n.token)||!I(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:I(n.environmentId)?n.environmentId:n.projectId};return I(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function _n(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!I(r.tenantId)||!I(r.plugin)||!Hs(r.status)||!Fs(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:I(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function En(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!I(n.approvalUrl)||!I(n.token)||!I(n.projectId)||!I(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function Dn(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(I(n.access_token))return{access_token:n.access_token,refresh_token:I(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:I(n.scope)?n.scope:void 0};throw new Error(I(n.error)?I(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Us(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Bs(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;I(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function Ls(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function wo(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!I(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!I(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",s=Bs(o.fields),a=Us(o.missingRequiredFields),u=Ls(o.status,o.connected,s,a);t.push({plugin:o.plugin,providerName:I(o.providerName)?o.providerName:o.plugin,authKind:i,status:u,connected:o.connected,fields:s,missingRequiredFields:a})}return{tenantId:n.tenantId,plugins:t}}function On(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Co(e){return e.replace(/\/$/,"")}function Ot(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return me()}catch{return null}}function vo(e){let n=Ot(e);return n?{"x-corsair-delivery-url":n}:{}}async function Po(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function To(e,n,t){if(n===404&&t)return t;let r=On(e);return r||`Hub API returned HTTP ${n}`}async function S(e){let n=Co(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...vo(e.hub)},body:JSON.stringify(e.body)}),r=await Po(t);if(!t.ok)throw new Error(To(r,t.status,e.notFoundMessage));return e.parseResponse(r)}async function L(e){let n=Co(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...vo(e.hub)}}),r=await Po(t);if(!t.ok)throw new Error(To(r,t.status,e.notFoundMessage));return e.parseResponse(r)}function Mn(e){return e&&typeof e=="object"?e:{}}function Ao(e){let n=Mn(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Mt(e,n){return S({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=Mn(t);return{chat:r.thread,reply:Ao(r.reply)}}})}async function Ht(e,n){return S({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Ao})}async function Ft(e,n){return L({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Mn(t).threads;return Array.isArray(r)?r:[]}})}async function Ut(e,n){return L({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=Mn(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Zs}from"crypto";var Ns="corsair:client-bridge";function Bt(e){return new URL(e).origin}function Be(e){let n=JSON.stringify({type:Ns,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Bt(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
 (function () {
   var message = ${n};
   var targetOrigin = ${t};
@@ -6,7 +6,7 @@ import{a as me,b as Et,c as Dt}from"./chunk-KL3FGSOP.js";import{a as po,b as he,
     window.parent.postMessage(message, targetOrigin);
   }
 })();
-</script></body></html>`}var $s=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Lt(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:$s.has(n)}catch{return!1}}function sn(e){return e==="development"?"browser":"server"}function xo(e){return sn(e)==="browser"}function Ro(e){return Lt(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as qs}from"crypto";var ke=60*1e3,Se=300*1e3;import{createHmac as Ws,randomBytes as js,timingSafeEqual as Ks}from"crypto";function ae(){return js(16).toString("base64url")}function an(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Ws("sha256",t).update(e).digest("base64url")}function te(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let s=an(o,t);try{if(!Ks(Buffer.from(i,"utf8"),Buffer.from(s,"utf8")))return null}catch{return null}let a;try{a=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return a.exp*1e3<Date.now()?null:a}function Hn(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),s=an(i,n);return`${i}.${s}`}function un(e,n,t){let r=Math.floor(Date.now()/1e3);return Hn(e,n,r+Math.floor(t/1e3))}function _e(e){return decodeURIComponent(e)}function Nt(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function Io(e){let n=e.trim();return n.length>0?n:null}function Le(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function Ne(e,n){if(!Io(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??qs(16).toString("base64url"),iat:t,exp:t+Math.floor(ke/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=an(o,n);return`${o}.${i}`}function we(e,n){return Io(n)?te(e,n):null}function Gs(e){let n=Bt(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function $t(e){let n=Ne(Gs(e),e.signingSecret);return Le(e.deliveryUrl,n)}function So(e){if(sn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Zs(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:$t(r)}}var cn="https://auth.corsair.dev";var ue=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}};function Fn(e){let n=(e.apiUrl?.trim()||cn).replace(/\/$/,""),t=e.projectApiKey.trim(),r=e.signingSecret.trim();if(!t||!r)throw new Error("Hub config requires non-empty projectApiKey and signingSecret");return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function zs(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function H(e){let n=v(e).hub;if(!n||!zs(n))throw new ue;return n}function _o(e){return e.replace(/\/$/,"")}function Un(e){return e.oauthCallbackUrl?_o(e.oauthCallbackUrl.trim()):`${_o(e.apiUrl)}/oauth/callback`}function $e(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}import{createCipheriv as Eo,createDecipheriv as Do,randomBytes as Bn,scrypt as Js}from"crypto";import{promisify as Vs}from"util";var Oo=Vs(Js),Ln="aes-256-gcm",Mo=12,Nn=16,Ys=16,ln=32;function ce(){return Bn(ln).toString("base64")}async function le(e,n){let t=Bn(Ys),r=await Oo(n,t,ln),o=Bn(Mo),i=Eo(Ln,r,o,{authTagLength:Nn}),s=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),a.toString("base64"),s.toString("base64")].join(":")}async function z(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Buffer.from(i,"base64"),c=await Oo(n,s,ln),d=Do(Ln,c,a,{authTagLength:Nn});return d.setAuthTag(u),Buffer.concat([d.update(l),d.final()]).toString("utf8")}function Wt(e,n){let t=Buffer.from(n,"base64"),r=Bn(Mo),o=Eo(Ln,t,r,{authTagLength:Nn}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[r.toString("base64"),s.toString("base64"),i.toString("base64")].join(":")}function dn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Do(Ln,i,s,{authTagLength:Nn});return l.setAuthTag(a),Buffer.concat([l.update(u),l.final()]).toString("utf8")}function Ce(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=Wt(o,n);return t}function de(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=dn(o,n);return t}function pn(e,n,t){let r=de(e,n);return Ce(r,t)}function Ho(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let s=[null,void 0,""].includes(i)?null:i;await n({[o]:s})};return r}var jt=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function F(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,s=[...B[n].integration,...i],a=null,u={kek:r,integrationName:t,getIntegration:async()=>{if(a)return a;let k=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!k)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return a={id:k.id,config:jt(k.config),dek:k.dek??null},a},updateIntegration:async k=>{let b=await u.getIntegration();await o.db.updateTable("corsair_integrations").set({...k.config!==void 0?{config:k.config}:{},...k.dek!==void 0?{dek:k.dek}:{},updated_at:new Date}).where("id","=",b.id).execute(),a=null}},l=null,c=async()=>{if(l)return l;let k=await u.getIntegration();if(!k.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await z(k.dek,r),l},d=async()=>{let k=await u.getIntegration(),b=await c(),C=k.config;return!C||Object.keys(C).length===0?{}:de(C,b)},p=Promise.resolve(),g=k=>{let b=p.then(()=>f(k));return p=b.catch(()=>{}),b},f=async k=>{let b=await c(),C;try{C=await d()}catch(_){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,_),C={}}let P={...C};for(let[_,O]of Object.entries(k))O===null?delete P[_]:P[_]=O;let D=Ce(P,b);await u.updateIntegration({config:D})};return{get_dek:c,issue_new_dek:async()=>{let k=await u.getIntegration(),b=ce(),C={};if(k.dek){let D=await z(k.dek,r),_=k.config;_&&Object.keys(_).length>0&&(C=pn(_,D,b))}let P=await le(b,r);return await u.updateIntegration({config:C,dek:P}),l=b,b},...Ho(d,g,s)}}function M(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:s=[],ensureProvisioned:a}=e,u=[...B[n].account,...s],l=null,c=null,d=async()=>{if(c)return c;let w=!1;for(;;){let T=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!T){if(!w&&a){w=!0,await a();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return c={id:T.id,config:jt(T.config),dek:T.dek??null},c}},p={kek:o,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(l)return l;let w=!1;for(;;){let T=await d(),A=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",T.id).executeTakeFirst();if(!A){if(!w&&a){w=!0,await a();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return l={id:A.id,config:jt(A.config),dek:A.dek??null},l}},updateAccount:async w=>{let T=await p.getAccount();await i.db.updateTable("corsair_accounts").set({...w.config!==void 0?{config:w.config}:{},...w.dek!==void 0?{dek:w.dek}:{},updated_at:new Date}).where("id","=",T.id).execute(),l=null}},g=null,f=null,h=async()=>{if(g)return g;let w=await p.getAccount();if(!w.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return g=await z(w.dek,o),g},k=async()=>{if(f)return f;let w=await p.getIntegration();if(!w.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await z(w.dek,o),f},b=async()=>{let w=await p.getAccount(),T=await h(),A=w.config;return!A||Object.keys(A).length===0?{}:de(A,T)},C=async()=>{let w=await p.getIntegration(),T=await k(),A=w.config;return!A||Object.keys(A).length===0?{}:de(A,T)},P=Promise.resolve(),D=w=>{let T=P.then(()=>_(w));return P=T.catch(()=>{}),T},_=async w=>{let T=await h(),A;try{A=await b()}catch(R){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,R),A={}}let q={...A};for(let[R,X]of Object.entries(w))X===null?delete q[R]:q[R]=X;let ie=Ce(q,T);await p.updateAccount({config:ie})},O={get_dek:h,issue_new_dek:async()=>{let w=await p.getAccount(),T=ce(),A={};if(w.dek){let ie=await z(w.dek,o),R=w.config;R&&Object.keys(R).length>0&&(A=pn(R,ie,T))}let q=await le(T,o);return await p.updateAccount({config:A,dek:q}),g=T,T},...Ho(b,D,u)};return n==="oauth_2"&&(O.get_integration_credentials=async()=>{let w=await C();return{...w,client_id:w.client_id||null,client_secret:w.client_secret||null,redirect_url:w.redirect_url??null}}),O}async function Fo(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=ce(),i=await le(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function Uo(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let s=ce(),a=await le(s,r);return await e.db.updateTable("corsair_accounts").set({dek:a,updated_at:new Date}).where("id","=",i.id).execute(),s}var Qs=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function ve(e){return Qs.has(e)}function Xs(e,n){return ve(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function ea(e){return!ve(e)}function na(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function ta(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function ra(e,n){let t=i=>n.find(s=>s.level==="account"&&s.name===i);if(!na(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function Bo(e,n){if(!e)return!1;let t=j(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function oa(e,n){let r=e.authConfig?.[n]?.integration??[];return[...B[n].integration,...r]}function ia(e,n){let r=e.authConfig?.[n]?.account??[];return[...B[n].account,...r]}function sa(e,n,t){let r=t.filter(a=>a.required&&!a.configured).map(a=>a.name),o=t.filter(a=>a.level==="integration"&&a.required&&!a.configured).map(a=>a.name),i=t.filter(a=>a.level==="account"&&a.required&&a.configured),s;return o.length>0?s="missing_integration":r.length===0?s="ready":i.length>0?s="partial":s="not_started",{plugin:e,authType:n,status:s,connected:ra(n,t),fields:t,missingRequiredFields:r}}async function Ee(e,n,t){let r=x(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,s=i?.[r]?.integration??[],a=i?.[r]?.account??[],u=F({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:s}),l=M({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:a}),c=oa(n,r),d=ia(n,r),p=[];for(let g of c)p.push({name:g,level:"integration",required:Xs(r,g),configured:await Bo(u,g)});for(let g of d)p.push({name:g,level:"account",required:ea(g),configured:await Bo(l,g)});if(ta(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return sa(n.id,r,p)}async function gn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let s of e.plugins){if(o&&!o.has(s.id))continue;let a=await Ee(e,s,r);a&&i.push(a)}return i}function $n(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var Lo=Symbol.for("corsair:internal"),No=new WeakMap,$o=new WeakMap;function aa(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function ua(e){if(e.database){let t=No.get(e.database);return t||(t=new Map,No.set(e.database,t)),t}let n=$o.get(e);return n||(n=new Map,$o.set(e,n)),n}function ca(e){return e.multiTenancy?{withTenant:()=>({}),[Lo]:e}:{[Lo]:e}}async function We(e,n){if(!e.database)return;let t=n.trim()||"default",r=ua(e),o=aa(t,e.plugins),i=r.get(o);if(i){await i;return}let s=(async()=>{let{setupCorsair:a}=await import("./setup-J2LPDA5W.js");await a(ca(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,s),await s}import*as fn from"crypto";function Pe(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function Kt(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function je(e,n){let t=fn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var qt=600*1e3;function Wn(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=fn.createHmac("sha256",n).update(r).digest("base64url"),s=Buffer.from(o,"base64url"),a=Buffer.from(i,"base64url");return s.length!==a.length||!fn.timingSafeEqual(s,a)?null:Kt(r,{maxAgeMs:qt})}function Wo(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function jo(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function Ke(e,n){await S({hub:e,path:"/connections/report",body:Wo(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function la(e,n){try{let t=H(e);S({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof ue)return}}async function da(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!x(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ee(n,e.plugin,r);o&&qo(e.hub,jo({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function Ko(e,n){la(e,n)}function qo(e,n){S({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function yn(e){da(e).catch(()=>{})}async function pe(e,n){let t=v(e);if(!x(n.plugin))return;let o=await Ee(t,n.plugin,n.tenantId);o&&Ko(e,jo({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function jn(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var Zo=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function pa(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function ga(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await z(n.dek,e.kek),r=Zo(n.config),o={};Object.keys(r).length>0&&(o=de(r,t)),o[e.link.linkType]=e.link.externalId;let i=Ce(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function qe(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:s,extraAccountFields:a=[]}=e,{accountId:u}=await pa({database:n,pluginId:r,tenantId:o}),l=!1;if(s){let c=M({authType:s,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:a}),d=`set_${i.linkType}`,p=c[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await ga({database:n,kek:t,accountId:u,link:i})}async function Zt(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,s=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let a of s)if(a.dek)try{let u=await z(a.dek,t),c=Zo(a.config)[o];if(!c)continue;if(dn(c,u)===i)return a}catch{continue}return null}async function Kn(e){return(await Zt(e))?.tenant_id??null}async function Go(e){return Kn({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as zo from"querystring";function De(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${zo.stringify(i)}`}async function Jo(e,n){try{return await L({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function Ze(e,n,t,r){if(!n.subscribe)return;let o=H(e),i=await Jo(o,n.id);if(!i)return;let s=await n.subscribe({keys:r},{webhookUrl:i});s&&await pe(e,{plugin:n,tenantId:t,verified:!0,webhookLink:s.webhookLink,webhookSecret:s.webhookSecret})}var $=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function Vo(e){let n=e.oauthConfig;if(!n)throw new $("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function fa(e,n,t,r){let o=bo(e),i=await o.integrations.findByName(n);if(!i)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.accounts.findOne({tenant_id:t,integration_id:i.id}))return;let a=ce(),u=await le(a,r);await o.accounts.create({tenant_id:t,integration_id:i.id,config:{},dek:u})}async function Gt(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,s=v(e,()=>new $("invalid_corsair_instance","Invalid corsair instance"));if(!s.database)throw new Error("No database configured on corsair instance");let a=N(s,n,p=>new $("plugin_not_found",p)),u=Vo(a),c=await F({authType:"oauth_2",integrationName:n,kek:s.kek,database:s.database}).get_client_id();if(!c)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(De({oauthConfig:u,clientId:c,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=je(Pe(n,r),s.kek);return{url:De({oauthConfig:u,clientId:c,redirectUri:o,state:d}),state:d}}function ya(e,n){return{...n??{},...e}}async function mn(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new $("invalid_corsair_instance","Invalid corsair instance")),s,a;if(n.trusted){if(!n.plugin||!n.tenantId)throw new $("invalid_state","trusted callback requires plugin and tenantId");s=n.plugin,a=n.tenantId}else{let h=Wn(r,i.kek);if(!h)throw new $("invalid_state","Invalid or tampered state parameter");s=h.plugin,a=h.tenantId}if(!i.database)throw new $("no_database","No database configured on corsair instance");let u=N(i,s,h=>new $("plugin_not_found",h)),l=Vo(u),c=F({authType:"oauth_2",integrationName:s,kek:i.kek,database:i.database}),d=await c.get_client_id(),p=await c.get_client_secret();if(!d||!p)throw new $("credentials_not_configured",`Credentials not configured for '${s}'`);await fa(i.database,s,a,i.kek);let g=await qn(t,d,p,l,o);if(!g.access_token)throw new $("no_access_token",`No access_token returned from ${l.providerName}`);let f=M({authType:"oauth_2",integrationName:s,tenantId:a,kek:i.kek,database:i.database,extraAccountFields:[...u.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await pe(e,{plugin:u,tenantId:a}).catch(()=>{});try{let h=ya(g,n.callbackParams),k=await jn(i.plugins,s,h);if(k){try{let b=u.authConfig?.oauth_2?.account??[];await qe({database:i.database,kek:i.kek,pluginId:s,tenantId:a,link:k,authType:"oauth_2",extraAccountFields:b})}catch(b){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${a}':`,b)}i.hub&&Ke(i.hub,{plugin:s,tenantId:a,link:k,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${a}':`,h)}if(u.subscribe)try{await Ze(e,u,a,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${s}' tenant '${a}':`,h)}return{plugin:s,tenantId:a}}async function ma(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??Ze,i=[],s=[];if(!t.database)return{renewed:i,failed:s};for(let a of r){let u=t.plugins.find(c=>c.id===a.integrationName);if(!u?.subscribe)continue;let l=`${u.id}/${a.tenantId}`;try{let c=x(u)??"oauth_2",d=M({authType:c,integrationName:u.id,tenantId:a.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...u.authConfig?.[c]?.account??[]]}),p=u.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:c,keys:g,hub:t.hub},"endpoint")}await o(n,u,a.tenantId,d),i.push(l)}catch(c){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,c),s.push(l)}}return{renewed:i,failed:s}}async function Yo(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return ma({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function ha(e,n={}){let t=!1,r=()=>{t||(t=!0,Yo(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function Qo(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await Zn(e,{silent:!0})}async function Ge(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await We(t,n)}var ba=Symbol.for("corsair:internal"),ka=new Set(["access_token","refresh_token","expires_at","scope"]);function wa(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ca(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!ve(t)&&!ka.has(t)):n.filter(t=>!ve(t))}function Xo(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function va(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function Pa(e){return{[ba]:Xo(e)}}async function Gn(e,n,t={}){let r=Un(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,s=Xo(e),a=Pa(e);for(let u of e.plugins){if(i&&!i.has(u.id))continue;let l=x(u);if(!l)continue;let c=wa(l),d=t.providerNameOverrides?.[u.id]??be(u.id),p=await Ee(s,u,n),g=Rn(u,l),f=Ca(l,g),h={plugin:u.id,providerName:d,authKind:c,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),c==="oauth"){let b=t.oauthModeOverrides?.[u.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=b,!t.skipOAuthUrlGeneration&&b!=="managed")try{let C=await Gt(a,u.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=C.url}catch(C){h.setupError=C instanceof Error?C.message:`Could not prepare OAuth for ${u.id}`}}o.push(h)}return o}async function ep(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return Gn({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function ei(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await We(e.internalConfig??va(e),n)}async function ni(e,n){await Ge(e,n)}async function ti(e,n){let t=$e(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=me({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Sn})}async function zt(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await ei(t,n.tenantId);let r=await Gn(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return ti(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function zn(e,n){let t=v(e),r=H(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await ni(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,s=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,u=await Gn(o,n.tenantId,{pluginIds:i,oauthModeOverrides:s,providerNameOverrides:a});if(u.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return ti(r,{tenantId:n.tenantId,plugins:u,deliveryUrl:n.deliveryUrl})}async function Jn(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(s=>s.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await Ta(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function Ta(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-6KUC32UF.js"),{postHubConnectSession:i}=await import("./connect-SH3XOJIW.js"),s={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(s,t.tenantId);let a=await r(s,t.tenantId,{pluginIds:t.pluginIds});if(a.length===0)throw new Error("No connectable plugins found for this tenant");let u=a.find(l=>l.setupError);if(u)throw new Error(u.setupError??`Could not prepare connect link for ${u.plugin}`);return i(e,{tenantId:t.tenantId,plugins:a})}function ze(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var J=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Aa(e){let n=e.oauthConfig;if(!n)throw new J("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Jt(e,n){let t=v(e,()=>new J("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new J("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new J("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=Wn(n,t.kek);if(!o)throw new J("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:s}=o,a=N(t,i,p=>new J("plugin_not_found",p)),u=Aa(a),c=await F({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!c)throw new J("client_id_not_configured",`client_id not configured for '${i}'`);let d=De({oauthConfig:u,clientId:c,redirectUri:r,state:n});return{plugin:i,tenantId:s,providerName:u.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as Ra}from"async_hooks";import{randomBytes as Ia}from"crypto";import{v4 as Sa}from"uuid";async function Vn(e,n){let t=$e(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=me({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:En})}function Yn(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var Vt="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Qt(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function ri(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Yt(e){return Yn(e)}async function Xt(e,n){if(Qt(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?ri(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Vn(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:xa(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function xa(e){try{return JSON.parse(e)}catch{return e}}async function Qn(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Xt(e,n);return{...n,approvalUrl:r}}async function er(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:s,endpoint:a,args:u,tenantId:l,expiresAt:c,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:s,endpoint:a,args:u});let g=await Xt({manual:t,hub:r},{id:o,token:i,plugin:s,endpoint:a,args:JSON.stringify(u),tenant_id:l,expires_at:c});return Qt(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Yt(g):Vt:r?g?Yt(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:Vt}var Je=class extends Error{constructor(n){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError"}};var ii=new Ra,Xn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function nr(e){return ii.run(!0,e)}function si(){return ii.getStore()===!0}function tr(e,n){if(si()&&n!=="read")throw new Xn(e,n)}var _a={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function Ea(e,n,t){return t!==void 0?t:_a[n][e]}function rr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function ai(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function oi(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function ui(e){let n=Ea(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+</script></body></html>`}var $s=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Lt(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:$s.has(n)}catch{return!1}}function sn(e){return e==="development"?"browser":"server"}function xo(e){return sn(e)==="browser"}function Ro(e){return Lt(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as qs}from"crypto";var ke=60*1e3,Se=300*1e3;import{createHmac as Ws,randomBytes as js,timingSafeEqual as Ks}from"crypto";function ae(){return js(16).toString("base64url")}function an(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Ws("sha256",t).update(e).digest("base64url")}function te(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let s=an(o,t);try{if(!Ks(Buffer.from(i,"utf8"),Buffer.from(s,"utf8")))return null}catch{return null}let a;try{a=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return a.exp*1e3<Date.now()?null:a}function Hn(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),s=an(i,n);return`${i}.${s}`}function un(e,n,t){let r=Math.floor(Date.now()/1e3);return Hn(e,n,r+Math.floor(t/1e3))}function _e(e){return decodeURIComponent(e)}function Nt(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function Io(e){let n=e.trim();return n.length>0?n:null}function Le(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function Ne(e,n){if(!Io(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??qs(16).toString("base64url"),iat:t,exp:t+Math.floor(ke/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=an(o,n);return`${o}.${i}`}function we(e,n){return Io(n)?te(e,n):null}function Gs(e){let n=Bt(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function $t(e){let n=Ne(Gs(e),e.signingSecret);return Le(e.deliveryUrl,n)}function So(e){if(sn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Zs(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:$t(r)}}var cn="https://auth.corsair.dev";var ue=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}};function Fn(e){let n=(e.apiUrl?.trim()||cn).replace(/\/$/,""),t=e.projectApiKey.trim(),r=e.signingSecret.trim();if(!t||!r)throw new Error("Hub config requires non-empty projectApiKey and signingSecret");return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function zs(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function H(e){let n=v(e).hub;if(!n||!zs(n))throw new ue;return n}function _o(e){return e.replace(/\/$/,"")}function Un(e){return e.oauthCallbackUrl?_o(e.oauthCallbackUrl.trim()):`${_o(e.apiUrl)}/oauth/callback`}function $e(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}import{createCipheriv as Eo,createDecipheriv as Do,randomBytes as Bn,scrypt as Js}from"crypto";import{promisify as Vs}from"util";var Oo=Vs(Js),Ln="aes-256-gcm",Mo=12,Nn=16,Ys=16,ln=32;function ce(){return Bn(ln).toString("base64")}async function le(e,n){let t=Bn(Ys),r=await Oo(n,t,ln),o=Bn(Mo),i=Eo(Ln,r,o,{authTagLength:Nn}),s=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),a.toString("base64"),s.toString("base64")].join(":")}async function z(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Buffer.from(i,"base64"),c=await Oo(n,s,ln),d=Do(Ln,c,a,{authTagLength:Nn});return d.setAuthTag(u),Buffer.concat([d.update(l),d.final()]).toString("utf8")}function Wt(e,n){let t=Buffer.from(n,"base64"),r=Bn(Mo),o=Eo(Ln,t,r,{authTagLength:Nn}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[r.toString("base64"),s.toString("base64"),i.toString("base64")].join(":")}function dn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Do(Ln,i,s,{authTagLength:Nn});return l.setAuthTag(a),Buffer.concat([l.update(u),l.final()]).toString("utf8")}function Ce(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=Wt(o,n);return t}function de(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=dn(o,n);return t}function pn(e,n,t){let r=de(e,n);return Ce(r,t)}function Ho(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let s=[null,void 0,""].includes(i)?null:i;await n({[o]:s})};return r}var jt=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function F(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,s=[...B[n].integration,...i],a=null,u={kek:r,integrationName:t,getIntegration:async()=>{if(a)return a;let k=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!k)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return a={id:k.id,config:jt(k.config),dek:k.dek??null},a},updateIntegration:async k=>{let b=await u.getIntegration();await o.db.updateTable("corsair_integrations").set({...k.config!==void 0?{config:k.config}:{},...k.dek!==void 0?{dek:k.dek}:{},updated_at:new Date}).where("id","=",b.id).execute(),a=null}},l=null,c=async()=>{if(l)return l;let k=await u.getIntegration();if(!k.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await z(k.dek,r),l},d=async()=>{let k=await u.getIntegration(),b=await c(),C=k.config;return!C||Object.keys(C).length===0?{}:de(C,b)},p=Promise.resolve(),g=k=>{let b=p.then(()=>f(k));return p=b.catch(()=>{}),b},f=async k=>{let b=await c(),C;try{C=await d()}catch(_){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,_),C={}}let P={...C};for(let[_,O]of Object.entries(k))O===null?delete P[_]:P[_]=O;let D=Ce(P,b);await u.updateIntegration({config:D})};return{get_dek:c,issue_new_dek:async()=>{let k=await u.getIntegration(),b=ce(),C={};if(k.dek){let D=await z(k.dek,r),_=k.config;_&&Object.keys(_).length>0&&(C=pn(_,D,b))}let P=await le(b,r);return await u.updateIntegration({config:C,dek:P}),l=b,b},...Ho(d,g,s)}}function M(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:s=[],ensureProvisioned:a}=e,u=[...B[n].account,...s],l=null,c=null,d=async()=>{if(c)return c;let w=!1;for(;;){let T=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!T){if(!w&&a){w=!0,await a();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return c={id:T.id,config:jt(T.config),dek:T.dek??null},c}},p={kek:o,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(l)return l;let w=!1;for(;;){let T=await d(),A=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",T.id).executeTakeFirst();if(!A){if(!w&&a){w=!0,await a();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return l={id:A.id,config:jt(A.config),dek:A.dek??null},l}},updateAccount:async w=>{let T=await p.getAccount();await i.db.updateTable("corsair_accounts").set({...w.config!==void 0?{config:w.config}:{},...w.dek!==void 0?{dek:w.dek}:{},updated_at:new Date}).where("id","=",T.id).execute(),l=null}},g=null,f=null,h=async()=>{if(g)return g;let w=await p.getAccount();if(!w.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return g=await z(w.dek,o),g},k=async()=>{if(f)return f;let w=await p.getIntegration();if(!w.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await z(w.dek,o),f},b=async()=>{let w=await p.getAccount(),T=await h(),A=w.config;return!A||Object.keys(A).length===0?{}:de(A,T)},C=async()=>{let w=await p.getIntegration(),T=await k(),A=w.config;return!A||Object.keys(A).length===0?{}:de(A,T)},P=Promise.resolve(),D=w=>{let T=P.then(()=>_(w));return P=T.catch(()=>{}),T},_=async w=>{let T=await h(),A;try{A=await b()}catch(R){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,R),A={}}let q={...A};for(let[R,X]of Object.entries(w))X===null?delete q[R]:q[R]=X;let ie=Ce(q,T);await p.updateAccount({config:ie})},O={get_dek:h,issue_new_dek:async()=>{let w=await p.getAccount(),T=ce(),A={};if(w.dek){let ie=await z(w.dek,o),R=w.config;R&&Object.keys(R).length>0&&(A=pn(R,ie,T))}let q=await le(T,o);return await p.updateAccount({config:A,dek:q}),g=T,T},...Ho(b,D,u)};return n==="oauth_2"&&(O.get_integration_credentials=async()=>{let w=await C();return{...w,client_id:w.client_id||null,client_secret:w.client_secret||null,redirect_url:w.redirect_url??null}}),O}async function Fo(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=ce(),i=await le(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function Uo(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let s=ce(),a=await le(s,r);return await e.db.updateTable("corsair_accounts").set({dek:a,updated_at:new Date}).where("id","=",i.id).execute(),s}var Qs=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function ve(e){return Qs.has(e)}function Xs(e,n){return ve(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function ea(e){return!ve(e)}function na(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function ta(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function ra(e,n){let t=i=>n.find(s=>s.level==="account"&&s.name===i);if(!na(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function Bo(e,n){if(!e)return!1;let t=j(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function oa(e,n){let r=e.authConfig?.[n]?.integration??[];return[...B[n].integration,...r]}function ia(e,n){let r=e.authConfig?.[n]?.account??[];return[...B[n].account,...r]}function sa(e,n,t){let r=t.filter(a=>a.required&&!a.configured).map(a=>a.name),o=t.filter(a=>a.level==="integration"&&a.required&&!a.configured).map(a=>a.name),i=t.filter(a=>a.level==="account"&&a.required&&a.configured),s;return o.length>0?s="missing_integration":r.length===0?s="ready":i.length>0?s="partial":s="not_started",{plugin:e,authType:n,status:s,connected:ra(n,t),fields:t,missingRequiredFields:r}}async function Ee(e,n,t){let r=x(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,s=i?.[r]?.integration??[],a=i?.[r]?.account??[],u=F({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:s}),l=M({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:a}),c=oa(n,r),d=ia(n,r),p=[];for(let g of c)p.push({name:g,level:"integration",required:Xs(r,g),configured:await Bo(u,g)});for(let g of d)p.push({name:g,level:"account",required:ea(g),configured:await Bo(l,g)});if(ta(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return sa(n.id,r,p)}async function gn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let s of e.plugins){if(o&&!o.has(s.id))continue;let a=await Ee(e,s,r);a&&i.push(a)}return i}function $n(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var Lo=Symbol.for("corsair:internal"),No=new WeakMap,$o=new WeakMap;function aa(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function ua(e){if(e.database){let t=No.get(e.database);return t||(t=new Map,No.set(e.database,t)),t}let n=$o.get(e);return n||(n=new Map,$o.set(e,n)),n}function ca(e){return e.multiTenancy?{withTenant:()=>({}),[Lo]:e}:{[Lo]:e}}async function We(e,n){if(!e.database)return;let t=n.trim()||"default",r=ua(e),o=aa(t,e.plugins),i=r.get(o);if(i){await i;return}let s=(async()=>{let{setupCorsair:a}=await import("./setup-6ORKZHQT.js");await a(ca(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,s),await s}import*as fn from"crypto";function Pe(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function Kt(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function je(e,n){let t=fn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var qt=600*1e3;function Wn(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=fn.createHmac("sha256",n).update(r).digest("base64url"),s=Buffer.from(o,"base64url"),a=Buffer.from(i,"base64url");return s.length!==a.length||!fn.timingSafeEqual(s,a)?null:Kt(r,{maxAgeMs:qt})}function Wo(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function jo(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function Ke(e,n){await S({hub:e,path:"/connections/report",body:Wo(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function la(e,n){try{let t=H(e);S({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof ue)return}}async function da(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!x(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ee(n,e.plugin,r);o&&qo(e.hub,jo({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function Ko(e,n){la(e,n)}function qo(e,n){S({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function yn(e){da(e).catch(()=>{})}async function pe(e,n){let t=v(e);if(!x(n.plugin))return;let o=await Ee(t,n.plugin,n.tenantId);o&&Ko(e,jo({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function jn(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var Zo=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function pa(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function ga(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await z(n.dek,e.kek),r=Zo(n.config),o={};Object.keys(r).length>0&&(o=de(r,t)),o[e.link.linkType]=e.link.externalId;let i=Ce(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function qe(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:s,extraAccountFields:a=[]}=e,{accountId:u}=await pa({database:n,pluginId:r,tenantId:o}),l=!1;if(s){let c=M({authType:s,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:a}),d=`set_${i.linkType}`,p=c[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await ga({database:n,kek:t,accountId:u,link:i})}async function Zt(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,s=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let a of s)if(a.dek)try{let u=await z(a.dek,t),c=Zo(a.config)[o];if(!c)continue;if(dn(c,u)===i)return a}catch{continue}return null}async function Kn(e){return(await Zt(e))?.tenant_id??null}async function Go(e){return Kn({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as zo from"querystring";function De(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${zo.stringify(i)}`}async function Jo(e,n){try{return await L({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function Ze(e,n,t,r){if(!n.subscribe)return;let o=H(e),i=await Jo(o,n.id);if(!i)return;let s=await n.subscribe({keys:r},{webhookUrl:i});s&&await pe(e,{plugin:n,tenantId:t,verified:!0,webhookLink:s.webhookLink,webhookSecret:s.webhookSecret})}var $=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function Vo(e){let n=e.oauthConfig;if(!n)throw new $("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function fa(e,n,t,r){let o=bo(e),i=await o.integrations.findByName(n);if(!i)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.accounts.findOne({tenant_id:t,integration_id:i.id}))return;let a=ce(),u=await le(a,r);await o.accounts.create({tenant_id:t,integration_id:i.id,config:{},dek:u})}async function Gt(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,s=v(e,()=>new $("invalid_corsair_instance","Invalid corsair instance"));if(!s.database)throw new Error("No database configured on corsair instance");let a=N(s,n,p=>new $("plugin_not_found",p)),u=Vo(a),c=await F({authType:"oauth_2",integrationName:n,kek:s.kek,database:s.database}).get_client_id();if(!c)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(De({oauthConfig:u,clientId:c,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=je(Pe(n,r),s.kek);return{url:De({oauthConfig:u,clientId:c,redirectUri:o,state:d}),state:d}}function ya(e,n){return{...n??{},...e}}async function mn(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new $("invalid_corsair_instance","Invalid corsair instance")),s,a;if(n.trusted){if(!n.plugin||!n.tenantId)throw new $("invalid_state","trusted callback requires plugin and tenantId");s=n.plugin,a=n.tenantId}else{let h=Wn(r,i.kek);if(!h)throw new $("invalid_state","Invalid or tampered state parameter");s=h.plugin,a=h.tenantId}if(!i.database)throw new $("no_database","No database configured on corsair instance");let u=N(i,s,h=>new $("plugin_not_found",h)),l=Vo(u),c=F({authType:"oauth_2",integrationName:s,kek:i.kek,database:i.database}),d=await c.get_client_id(),p=await c.get_client_secret();if(!d||!p)throw new $("credentials_not_configured",`Credentials not configured for '${s}'`);await fa(i.database,s,a,i.kek);let g=await qn(t,d,p,l,o);if(!g.access_token)throw new $("no_access_token",`No access_token returned from ${l.providerName}`);let f=M({authType:"oauth_2",integrationName:s,tenantId:a,kek:i.kek,database:i.database,extraAccountFields:[...u.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await pe(e,{plugin:u,tenantId:a}).catch(()=>{});try{let h=ya(g,n.callbackParams),k=await jn(i.plugins,s,h);if(k){try{let b=u.authConfig?.oauth_2?.account??[];await qe({database:i.database,kek:i.kek,pluginId:s,tenantId:a,link:k,authType:"oauth_2",extraAccountFields:b})}catch(b){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${a}':`,b)}i.hub&&Ke(i.hub,{plugin:s,tenantId:a,link:k,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${a}':`,h)}if(u.subscribe)try{await Ze(e,u,a,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${s}' tenant '${a}':`,h)}return{plugin:s,tenantId:a}}async function ma(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??Ze,i=[],s=[];if(!t.database)return{renewed:i,failed:s};for(let a of r){let u=t.plugins.find(c=>c.id===a.integrationName);if(!u?.subscribe)continue;let l=`${u.id}/${a.tenantId}`;try{let c=x(u)??"oauth_2",d=M({authType:c,integrationName:u.id,tenantId:a.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...u.authConfig?.[c]?.account??[]]}),p=u.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:c,keys:g,hub:t.hub},"endpoint")}await o(n,u,a.tenantId,d),i.push(l)}catch(c){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,c),s.push(l)}}return{renewed:i,failed:s}}async function Yo(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return ma({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function ha(e,n={}){let t=!1,r=()=>{t||(t=!0,Yo(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function Qo(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await Zn(e,{silent:!0})}async function Ge(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await We(t,n)}var ba=Symbol.for("corsair:internal"),ka=new Set(["access_token","refresh_token","expires_at","scope"]);function wa(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ca(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!ve(t)&&!ka.has(t)):n.filter(t=>!ve(t))}function Xo(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function va(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function Pa(e){return{[ba]:Xo(e)}}async function Gn(e,n,t={}){let r=Un(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,s=Xo(e),a=Pa(e);for(let u of e.plugins){if(i&&!i.has(u.id))continue;let l=x(u);if(!l)continue;let c=wa(l),d=t.providerNameOverrides?.[u.id]??be(u.id),p=await Ee(s,u,n),g=Rn(u,l),f=Ca(l,g),h={plugin:u.id,providerName:d,authKind:c,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),c==="oauth"){let b=t.oauthModeOverrides?.[u.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=b,!t.skipOAuthUrlGeneration&&b!=="managed")try{let C=await Gt(a,u.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=C.url}catch(C){h.setupError=C instanceof Error?C.message:`Could not prepare OAuth for ${u.id}`}}o.push(h)}return o}async function ep(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return Gn({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function ei(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await We(e.internalConfig??va(e),n)}async function ni(e,n){await Ge(e,n)}async function ti(e,n){let t=$e(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=me({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Sn})}async function zt(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await ei(t,n.tenantId);let r=await Gn(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return ti(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function zn(e,n){let t=v(e),r=H(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await ni(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,s=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,u=await Gn(o,n.tenantId,{pluginIds:i,oauthModeOverrides:s,providerNameOverrides:a});if(u.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return ti(r,{tenantId:n.tenantId,plugins:u,deliveryUrl:n.deliveryUrl})}async function Jn(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(s=>s.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await Ta(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function Ta(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-Y3Z3RUMG.js"),{postHubConnectSession:i}=await import("./connect-TQY3WRT2.js"),s={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(s,t.tenantId);let a=await r(s,t.tenantId,{pluginIds:t.pluginIds});if(a.length===0)throw new Error("No connectable plugins found for this tenant");let u=a.find(l=>l.setupError);if(u)throw new Error(u.setupError??`Could not prepare connect link for ${u.plugin}`);return i(e,{tenantId:t.tenantId,plugins:a})}function ze(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var J=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Aa(e){let n=e.oauthConfig;if(!n)throw new J("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Jt(e,n){let t=v(e,()=>new J("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new J("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new J("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=Wn(n,t.kek);if(!o)throw new J("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:s}=o,a=N(t,i,p=>new J("plugin_not_found",p)),u=Aa(a),c=await F({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!c)throw new J("client_id_not_configured",`client_id not configured for '${i}'`);let d=De({oauthConfig:u,clientId:c,redirectUri:r,state:n});return{plugin:i,tenantId:s,providerName:u.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as Ra}from"async_hooks";import{randomBytes as Ia}from"crypto";import{v4 as Sa}from"uuid";async function Vn(e,n){let t=$e(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=me({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:En})}function Yn(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var Vt="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Qt(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function ri(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Yt(e){return Yn(e)}async function Xt(e,n){if(Qt(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?ri(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Vn(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:xa(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function xa(e){try{return JSON.parse(e)}catch{return e}}async function Qn(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Xt(e,n);return{...n,approvalUrl:r}}async function er(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:s,endpoint:a,args:u,tenantId:l,expiresAt:c,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:s,endpoint:a,args:u});let g=await Xt({manual:t,hub:r},{id:o,token:i,plugin:s,endpoint:a,args:JSON.stringify(u),tenant_id:l,expires_at:c});return Qt(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Yt(g):Vt:r?g?Yt(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:Vt}var Je=class extends Error{constructor(n){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError"}};var ii=new Ra,Xn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function nr(e){return ii.run(!0,e)}function si(){return ii.getStore()===!0}function tr(e,n){if(si()&&n!=="read")throw new Xn(e,n)}var _a={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function Ea(e,n,t){return t!==void 0?t:_a[n][e]}function rr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function ai(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function oi(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function ui(e){let n=Ea(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
   Action: ${r}`,`
   To allow this, update the permission mode or add an override in your corsair config.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),s=e.tenantId??"default",a=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",s).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(a){if(a.status==="approved"){let f=e.db,h=a.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return a.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
   Action: ${r}`,`
@@ -59,7 +59,7 @@ ${vs(o,d)}`),h.join(`
 `)}}}return Qr(Ue(e),"Path not found. Available operations")}function ms(e){let n=e;for(;;){let t=Y(n),r=Q(t);if(to(r)){let o=V(t);if(!o)return n;n=o;continue}return n}}function tn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=ms(e),t=Y(n);if(Q(t)==="ZodObject"){let o=At(n,t),i=[];for(let[s,a]of Object.entries(o)){let u=Y(a),l=Q(u),c=l==="ZodOptional"||l==="ZodNullable",d=ms(a),p=oc(a);i.push({key:s,optional:c,type:W(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:W(n)}}function Tt(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=ys.repeat(n+1),r=ys.repeat(n);return`{
 ${e.fields.map(i=>{let s=i.optional?`${i.key}?`:i.key,a=i.description?`  // ${i.description}`:"";return`${t}${s}: ${i.type}${a}`}).join(`
 `)}
-${r}}`}return"unknown"}function lc(e,n){let t=Ue(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(c=>c.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let c of t){let{shortPath:d,lookupKey:p}=cc(c,n),g=xe(r.endpointMeta,p),f=xe(r.endpointSchemas,p);!g&&!f||o.push({path:c,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:tn(f?.input),output:tn(f?.output)})}o.sort((c,d)=>c.path.localeCompare(d.path));let i=[],s=Ue(e,{plugin:n,type:"webhooks"});if(Array.isArray(s)&&r.webhooks)for(let c of s){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=io(r.webhooks,f.split("."));if(h===null)continue;let k=h.join("."),b=xe(r.webhookSchemas,k.toLowerCase()),C=b?.response?W(b.response):void 0;i.push({path:c,description:b?.description,payload:tn(b?.payload),responseType:C,usageExample:vs(n,h)})}i.sort((c,d)=>c.path.localeCompare(d.path));let a=[],u=Ue(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(u)&&l)for(let c of u){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let k=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let C=Cs(l,k);if(!C)continue;let[P,D]=C,_=oo(D),O=Object.entries(_).map(([w,T])=>({field:w,type:T.type,operators:T.operators}));a.push({path:c,entityName:P,filters:[{field:"entity_id",type:"string",operators:ro},...O]})}return a.sort((c,d)=>c.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:a}}}import{randomUUID as Ps}from"crypto";async function dc(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Ps(),o=Ps(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as pc}from"crypto";var xt="https://graph.microsoft.com/v1.0",so=2e4,gc=60;async function fc(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let u=await fetch(`${xt}/subscriptions`,{headers:r,signal:AbortSignal.timeout(so)});if(u.ok){let{value:l}=await u.json(),c=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(c.map(d=>fetch(`${xt}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(so)}).catch(()=>{})))}}catch{}let o=pc(),i=new Date(Date.now()+gc*6e4).toISOString(),s=await fetch(`${xt}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(so),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!s.ok)throw new Error(`MS Graph subscribe failed (${s.status}): ${await s.text()}`);let a=await s.json();return a.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:a.id},webhookSecret:o}):null}function Ts(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function yc(e,n){let t=Ts(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function mc(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function As(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function xs(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function An(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function hc(e){return An(e.body)}function Rs(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Rt(Array.isArray(r)?r:[r])}function Is(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let u of t){let l=Rt(Array.isArray(u)?u:[u]);if(l)return decodeURIComponent(l)}let r=Rs({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let u of o){let l=n[u],c=Array.isArray(l)?l[0]:l;if(!(!c||typeof c!="string"))try{let p=(c.startsWith("http")?new URL(c):new URL(`https://example.invalid${c.startsWith("/")?c:`/${c}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,s=An(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Rt([s?.validationToken])??null}function bc(e){if(Is(e))return!0;let n=An(e.body??e.payload);return As(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Rt(e){for(let n of e){let t=xs(n);if(t)return t}}function kc(e){let t=An(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var Tn=Symbol.for("corsair:internal");function Es(e){let n=e.database?lo(e.database):void 0,t=n&&e.kek?is(e.plugins,n,e.kek):vt(!!n,!!e.kek),r=ss(e),o={plugins:e.plugins,database:n,kek:e.kek,multiTenancy:!!e.multiTenancy,permissions:r,manual:e.manual,hub:e.hub?Fn(e.hub):void 0},i=ai(n),s=ds(o);if(e.multiTenancy){let l=Object.assign({withTenant:c=>{if(!c)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let d=Yr(e.plugins,{database:n,tenantId:c,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:o.hub,internalConfig:o});return Object.assign(d,{[Tn]:o})},keys:t,permissions:i,manage:s},{[Tn]:o});return Ss(l,o.hub),_s(l,o.hub),l}let a=Yr(e.plugins,{database:n,tenantId:void 0,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:o.hub,internalConfig:o}),u=Object.assign({},a,{keys:t,permissions:i,manage:s,[Tn]:o});return Ss(u,o.hub),_s(u,o.hub),u}function Ss(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-KLFTGQSS.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function wc(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var It=globalThis.__corsairTunnels??=new Set;function _s(e,n){if(!wc(n))return;let t=n.projectApiKey;if(It.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}It.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Et;import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:()=>It.delete(t)})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Dt}`)}).catch(s=>{It.delete(t),console.warn(`[corsair] tunnel failed to start: ${s instanceof Error?s.message:String(s)}. Run \`corsair setup\` to enable your dev tunnel.`)})}var Cc={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},ao=Cc;async function Zn(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},s=n?.caller??"script",a=go(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let u=Oc(e,a.plugins,n),l={...a,database:a.database},c=l.database.db;await Fc(c,i);let d=await Uc(c,l,u.tenantId,u.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Nc(e,u,n.credentials,l,o,i);let p=await Wc(d,u,o,s);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=Es({plugins:a.plugins,database:c,kek:a.kek,multiTenancy:!0}).withTenant(u.tenantId);await jc(g,a.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+${r}}`}return"unknown"}function lc(e,n){let t=Ue(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(c=>c.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let c of t){let{shortPath:d,lookupKey:p}=cc(c,n),g=xe(r.endpointMeta,p),f=xe(r.endpointSchemas,p);!g&&!f||o.push({path:c,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:tn(f?.input),output:tn(f?.output)})}o.sort((c,d)=>c.path.localeCompare(d.path));let i=[],s=Ue(e,{plugin:n,type:"webhooks"});if(Array.isArray(s)&&r.webhooks)for(let c of s){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=io(r.webhooks,f.split("."));if(h===null)continue;let k=h.join("."),b=xe(r.webhookSchemas,k.toLowerCase()),C=b?.response?W(b.response):void 0;i.push({path:c,description:b?.description,payload:tn(b?.payload),responseType:C,usageExample:vs(n,h)})}i.sort((c,d)=>c.path.localeCompare(d.path));let a=[],u=Ue(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(u)&&l)for(let c of u){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let k=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let C=Cs(l,k);if(!C)continue;let[P,D]=C,_=oo(D),O=Object.entries(_).map(([w,T])=>({field:w,type:T.type,operators:T.operators}));a.push({path:c,entityName:P,filters:[{field:"entity_id",type:"string",operators:ro},...O]})}return a.sort((c,d)=>c.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:a}}}import{randomUUID as Ps}from"crypto";async function dc(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Ps(),o=Ps(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as pc}from"crypto";var xt="https://graph.microsoft.com/v1.0",so=2e4,gc=60;async function fc(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let u=await fetch(`${xt}/subscriptions`,{headers:r,signal:AbortSignal.timeout(so)});if(u.ok){let{value:l}=await u.json(),c=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(c.map(d=>fetch(`${xt}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(so)}).catch(()=>{})))}}catch{}let o=pc(),i=new Date(Date.now()+gc*6e4).toISOString(),s=await fetch(`${xt}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(so),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!s.ok)throw new Error(`MS Graph subscribe failed (${s.status}): ${await s.text()}`);let a=await s.json();return a.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:a.id},webhookSecret:o}):null}function Ts(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function yc(e,n){let t=Ts(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function mc(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function As(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function xs(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function An(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function hc(e){return An(e.body)}function Rs(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Rt(Array.isArray(r)?r:[r])}function Is(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let u of t){let l=Rt(Array.isArray(u)?u:[u]);if(l)return decodeURIComponent(l)}let r=Rs({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let u of o){let l=n[u],c=Array.isArray(l)?l[0]:l;if(!(!c||typeof c!="string"))try{let p=(c.startsWith("http")?new URL(c):new URL(`https://example.invalid${c.startsWith("/")?c:`/${c}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,s=An(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Rt([s?.validationToken])??null}function bc(e){if(Is(e))return!0;let n=An(e.body??e.payload);return As(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Rt(e){for(let n of e){let t=xs(n);if(t)return t}}function kc(e){let t=An(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var Tn=Symbol.for("corsair:internal");function Es(e){let n=e.database?lo(e.database):void 0,t=n&&e.kek?is(e.plugins,n,e.kek):vt(!!n,!!e.kek),r=ss(e),o={plugins:e.plugins,database:n,kek:e.kek,multiTenancy:!!e.multiTenancy,permissions:r,manual:e.manual,hub:e.hub?Fn(e.hub):void 0},i=ai(n),s=ds(o);if(e.multiTenancy){let l=Object.assign({withTenant:c=>{if(!c)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let d=Yr(e.plugins,{database:n,tenantId:c,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:o.hub,internalConfig:o});return Object.assign(d,{[Tn]:o})},keys:t,permissions:i,manage:s},{[Tn]:o});return Ss(l,o.hub),_s(l,o.hub),l}let a=Yr(e.plugins,{database:n,tenantId:void 0,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:o.hub,internalConfig:o}),u=Object.assign({},a,{keys:t,permissions:i,manage:s,[Tn]:o});return Ss(u,o.hub),_s(u,o.hub),u}function Ss(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-X6FXSLYX.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function wc(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var It=globalThis.__corsairTunnels??=new Set;function _s(e,n){if(!wc(n))return;let t=n.projectApiKey;if(It.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}It.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Et;import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:()=>It.delete(t)})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Dt}`)}).catch(s=>{It.delete(t),console.warn(`[corsair] tunnel failed to start: ${s instanceof Error?s.message:String(s)}. Run \`corsair setup\` to enable your dev tunnel.`)})}var Cc={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},ao=Cc;async function Zn(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},s=n?.caller??"script",a=go(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let u=Oc(e,a.plugins,n),l={...a,database:a.database},c=l.database.db;await Fc(c,i);let d=await Uc(c,l,u.tenantId,u.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Nc(e,u,n.credentials,l,o,i);let p=await Wc(d,u,o,s);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=Es({plugins:a.plugins,database:c,kek:a.kek,multiTenancy:!0}).withTenant(u.tenantId);await jc(g,a.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
 `)}function uo(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...B[n][t],...r])}function Dc(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(a=>a.id===t);if(!o)continue;let i=x(o);if(!i)continue;let s=uo(o,i,"account");for(let a of Object.keys(r))if(s.has(a))return!0}return!1}function Oc(e,n,t){let r=fo(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Dc(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function Os(e,n){return he(e)?n===0?!0:Object.values(e).every(t=>Os(t,n-1)):!1}function Mc(e){return Os(e,4)}var Hc={...ho};function St(e){if(e instanceof Rc){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Ec?St(r):"unknown";return n}return e instanceof Ac?`${St(e.unwrap())} | null`:e instanceof Ic?`${St(e.unwrap())} | undefined`:e instanceof Tc?e.options.join(" | "):e instanceof _c?"string":e instanceof xc?"number":e instanceof vc?"boolean":e instanceof Pc?"date":e instanceof Sc?"jsonb":"unknown"}async function Fc(e,n){let t=await e.introspection.getTables(),r=new Set(t.map(o=>o.name));for(let[o,i]of Object.entries(Hc))r.has(o)||n(`[corsair:setup] Table "${o}" does not exist. Run your database migrations before calling setupCorsair.
 Schema: ${JSON.stringify(St(i),null,2)}`)}async function Uc(e,n,t,r,o){let i=new Date,s=new Map;for(let a of n.plugins){let u=a.id,l=x(a),c=await e.selectFrom("corsair_integrations").selectAll().where("name","=",u).executeTakeFirst();if(!c){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:u,config:{},created_at:i,updated_at:i}).execute(),c=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${u}`)}let d=l?a.authConfig?.[l]?.integration??[]:[],p=l?a.authConfig?.[l]?.account??[]:[],g=l&&c?F({authType:l,integrationName:u,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(c&&!c.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${u}`)),!c||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",c.id).executeTakeFirst();if(!h){let k=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:k,tenant_id:t,integration_id:c.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",k).executeTakeFirst(),o(`[corsair:setup] Created account: ${u}`)}f=h&&M({authType:l,integrationName:u,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${u}`))}s.set(u,{pluginId:u,authType:l,integration:g,account:f,integrationFields:[...B[l].integration,...d],accountFields:r?[...B[l].account,...p]:[]})}return s}function Bc(e){if(!he(e))return;let n=e.keys;return he(n)?n:void 0}function Lc(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Nc(e,n,t,r,o,i){let s=Bc(e),a=n.provisionAccounts?Lc(e,n.tenantId):void 0;for(let[u,l]of Object.entries(t)){let c=r.plugins.find(b=>b.id===u);if(!c){i(`[corsair:setup] Unknown plugin '${u}' \u2014 skipping credentials.`);continue}let d=x(c);if(!d){i(`[corsair:setup] Plugin '${u}' has no auth type \u2014 skipping credentials.`);continue}let p=uo(c,d,"integration"),g=uo(c,d,"account"),f=s?.[u],h=a?.[u],k=he(h)?h.keys:void 0;for(let[b,C]of Object.entries(l))if(C){if(p.has(b)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${u}.${b}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let P=j(f,`set_${b}`);if(!P){i(`[corsair:setup] Cannot set integration field '${b}' for '${u}'.`);continue}await P(C),o(`[corsair:setup] Set ${u} integration.${b}`);continue}if(g.has(b)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${u}.${b}' on a multi-tenant instance`);let P=j(k,`set_${b}`);if(!P){i(`[corsair:setup] Cannot set account field '${b}' for '${u}'.`);continue}await P(C),o(`[corsair:setup] Set ${u} account.${b} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${b}' for plugin '${u}'.`)}}}var Ds=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function $c(e,n,t,r,o,i,s,a,u){let l=[],c=[];for(let p of o){if(Ds.has(p))continue;let g=j(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(Ds.has(p))continue;let g=j(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||c.push(p)}let d=l.length===0&&c.length===0;if(d)a(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")a(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...c];if(u==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");a(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
   corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of c){let h=s.provisionAccounts?s.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(s.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}a(g.join(`

package/dist/{connect-SH3XOJIW.js → connect-TQY3WRT2.js}

@@ -1 +1 @@
-import{da as a,ea as b,fa as c}from"./chunk-HE4Z5CZQ.js";import"./chunk-KL3FGSOP.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};
+import{da as a,ea as b,fa as c}from"./chunk-RWGMXXPK.js";import"./chunk-3TC2WIUS.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/core.js

@@ -1 +1 @@
-import{A as d,Ab as z,B as e,Bb as A,C as f,Cb as B,D as g,Db as C,E as h,Eb as D,F as i,Fb as E,G as j,Gb as F,H as k,Hb as G,I as l,Ib as H,J as m,Jb as I,K as n,Kb as J,L as o,Lb as K,Mb as L,Nb as M,Ob as N,Pb as O,Qb as P,Rb as Q,Sb as R,Tb as S,Za as v,a,b,ga as p,ja as q,ka as r,la as s,ma as t,na as u,ub as w,vb as x,wb as y}from"./chunk-HE4Z5CZQ.js";import"./chunk-KL3FGSOP.js";import{h as c}from"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{v as AuthMissingError,c as BASE_AUTH_FIELDS,Q as CORSAIR_INTERNAL,C as MS_GRAPH_API_BASE,q as PermissionRequiredError,a as ProviderDisplayNames,r as ReadonlyForbiddenError,J as asRecord,u as assertReadonlyAllowed,G as collectPluginWebhookMatchers,m as createAccountKeyManager,R as createCorsair,l as createIntegrationKeyManager,P as decodePubSubData,j as decryptConfig,f as decryptDEK,h as decryptWithDEK,i as encryptConfig,e as encryptDEK,g as encryptWithDEK,y as exchangeCodeForTokens,M as extractMicrosoftGraphValidationToken,O as firstString,z as formatDocSchemaShape,b as formatProviderDisplayName,d as generateDEK,H as getHeader,B as googleChannelSubscribe,o as initializeAccountDEK,n as initializeIntegrationDEK,A as introspectPluginForDocs,N as isMicrosoftGraphValidationHandshake,t as isReadonlyScopeActive,w as logEvent,x as logEventFromContext,E as matchWebhookPlugin,F as matchWebhookPluginAndTenant,D as msGraphSubscribe,k as reEncryptConfig,K as readBodyRecord,L as readQueryParam,p as resolveConnectLink,s as runReadonly,S as shouldStartTunnel,I as toExternalId};
+import{A as d,Ab as z,B as e,Bb as A,C as f,Cb as B,D as g,Db as C,E as h,Eb as D,F as i,Fb as E,G as j,Gb as F,H as k,Hb as G,I as l,Ib as H,J as m,Jb as I,K as n,Kb as J,L as o,Lb as K,Mb as L,Nb as M,Ob as N,Pb as O,Qb as P,Rb as Q,Sb as R,Tb as S,Za as v,a,b,ga as p,ja as q,ka as r,la as s,ma as t,na as u,ub as w,vb as x,wb as y}from"./chunk-RWGMXXPK.js";import"./chunk-3TC2WIUS.js";import{h as c}from"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{v as AuthMissingError,c as BASE_AUTH_FIELDS,Q as CORSAIR_INTERNAL,C as MS_GRAPH_API_BASE,q as PermissionRequiredError,a as ProviderDisplayNames,r as ReadonlyForbiddenError,J as asRecord,u as assertReadonlyAllowed,G as collectPluginWebhookMatchers,m as createAccountKeyManager,R as createCorsair,l as createIntegrationKeyManager,P as decodePubSubData,j as decryptConfig,f as decryptDEK,h as decryptWithDEK,i as encryptConfig,e as encryptDEK,g as encryptWithDEK,y as exchangeCodeForTokens,M as extractMicrosoftGraphValidationToken,O as firstString,z as formatDocSchemaShape,b as formatProviderDisplayName,d as generateDEK,H as getHeader,B as googleChannelSubscribe,o as initializeAccountDEK,n as initializeIntegrationDEK,A as introspectPluginForDocs,N as isMicrosoftGraphValidationHandshake,t as isReadonlyScopeActive,w as logEvent,x as logEventFromContext,E as matchWebhookPlugin,F as matchWebhookPluginAndTenant,D as msGraphSubscribe,k as reEncryptConfig,K as readBodyRecord,L as readQueryParam,p as resolveConnectLink,s as runReadonly,S as shouldStartTunnel,I as toExternalId};

package/dist/hub/tunnel/run-tunnel.js

@@ -1,4 +1,4 @@
-import{a as x,b as L,c as w,f as O}from"../../chunk-KL3FGSOP.js";import"../../chunk-SOY77BN4.js";import{spawn as X}from"child_process";import{mkdtempSync as rr,rmSync as er,writeFileSync as G}from"fs";import{tmpdir as tr}from"os";import{join as S}from"path";var Q=/^(?:\/[A-Za-z0-9._~-]+)+$/;function F(r){if(!/^[\x20-\x21\x23-\x7E]+$/.test(r.apiKey))throw new Error("apiKey contains invalid characters (quotes, newlines, or control chars)");if(r.deliveryPath&&!Q.test(r.deliveryPath))throw new Error("deliveryPath must be an absolute URL path (e.g. /api/corsair)");let o=[`serverAddr = "${r.serverAddr}"`,`serverPort = ${r.serverPort}`,"loginFailExit = true",`metadatas.token = "${r.apiKey}"`];return r.deliveryPath&&o.push(`metadatas.path = "${r.deliveryPath}"`),r.caCertPath&&o.push("transport.tls.enable = true",`transport.tls.serverName = "${r.serverName??r.serverAddr}"`,`transport.tls.trustedCaFile = "${r.caCertPath}"`),o.push("","[[proxies]]",`name = "corsair-${r.slug}"`,'type = "http"','localIP = "127.0.0.1"',`localPort = ${r.localPort}`,`subdomain = "${r.slug}"`,""),o.join(`
+import{a as x,b as L,c as w,f as O}from"../../chunk-3TC2WIUS.js";import"../../chunk-SOY77BN4.js";import{spawn as X}from"child_process";import{mkdtempSync as rr,rmSync as er,writeFileSync as G}from"fs";import{tmpdir as tr}from"os";import{join as S}from"path";var Q=/^(?:\/[A-Za-z0-9._~-]+)+$/;function F(r){if(!/^[\x20-\x21\x23-\x7E]+$/.test(r.apiKey))throw new Error("apiKey contains invalid characters (quotes, newlines, or control chars)");if(r.deliveryPath&&!Q.test(r.deliveryPath))throw new Error("deliveryPath must be an absolute URL path (e.g. /api/corsair)");let o=[`serverAddr = "${r.serverAddr}"`,`serverPort = ${r.serverPort}`,"loginFailExit = true",`metadatas.token = "${r.apiKey}"`];return r.deliveryPath&&o.push(`metadatas.path = "${r.deliveryPath}"`),r.caCertPath&&o.push("transport.tls.enable = true",`transport.tls.serverName = "${r.serverName??r.serverAddr}"`,`transport.tls.trustedCaFile = "${r.caCertPath}"`),o.push("","[[proxies]]",`name = "corsair-${r.slug}"`,'type = "http"','localIP = "127.0.0.1"',`localPort = ${r.localPort}`,`subdomain = "${r.slug}"`,""),o.join(`
 `)}import K from"http";var Z=3e4,J=new Set(["host","forwarded","x-real-ip"]);function V(r){return J.has(r)||r.startsWith("x-forwarded-")}function M(r,o=w){let n=K.createServer((e,t)=>{let c=e.url??"/",i;try{i=new URL(c,"http://127.0.0.1")}catch{t.statusCode=400,t.end("Bad request");return}if(/%2f|%5c/i.test(i.pathname)){t.statusCode=400,t.end("Bad request");return}if(!(i.pathname===o||i.pathname.startsWith(`${o}/`))){t.statusCode=404,t.end("Not found");return}let P={host:`127.0.0.1:${r}`};for(let[l,u]of Object.entries(e.headers))u!==void 0&&!V(l)&&(P[l]=u);let a=K.request({host:"127.0.0.1",port:r,method:e.method,path:i.pathname+i.search,headers:P,timeout:Z},l=>{let u={};for(let[y,m]of Object.entries(l.headers))m!==void 0&&y!=="set-cookie"&&(u[y]=m);t.writeHead(l.statusCode??502,u),l.pipe(t)});a.on("timeout",()=>a.destroy()),a.on("error",()=>{if(!t.writableEnded){if(t.headersSent){t.destroy();return}t.statusCode=502,t.end("Bad gateway")}}),e.on("error",()=>a.destroy()),t.on("close",()=>{a.destroyed||a.destroy()}),e.pipe(a)});return new Promise((e,t)=>{n.once("error",t),n.listen(0,"127.0.0.1",()=>{let c=n.address(),i=typeof c=="object"&&c?c.port:0;e({port:i,close:()=>new Promise(E=>{n.close(()=>E())})})})})}var D=15e3,nr=/start proxy success/i,z=/start error/i,j=/^[a-z0-9.-]+$/i;async function or(r){let o=r.apiUrl.replace(/\/$/,""),n=await fetch(`${o}/api/dev/tunnel-config`,{headers:{authorization:`Bearer ${r.apiKey}`},signal:AbortSignal.timeout(D)});if(!n.ok)throw new Error(`Hub tunnel-config failed (HTTP ${n.status})`);let e=await n.json();if(!e.slug||!/^[a-z0-9-]+$/.test(e.slug))throw new Error("Hub tunnel-config returned an invalid slug");if(!e.serverAddr||!j.test(e.serverAddr))throw new Error("Hub tunnel-config returned an invalid server address");if(!Number.isInteger(e.serverPort)||e.serverPort<1||e.serverPort>65535)throw new Error("Hub tunnel-config returned an invalid server port");if(e.serverName!==void 0&&!j.test(e.serverName))throw new Error("Hub tunnel-config returned an invalid serverName");let t=e.caCert??null;if(t&&!t.startsWith("-----BEGIN CERTIFICATE-----"))throw new Error('Hub tunnel-config returned a caCert that does not begin with "-----BEGIN CERTIFICATE-----"');return{serverAddr:e.serverAddr,serverPort:e.serverPort,slug:e.slug,caCert:t,serverName:e.serverName}}async function $r(r){let{port:o,apiUrl:n,apiKey:e,shareHost:t=L,timeoutMs:c=2e4,onClose:i}=r,{serverAddr:E,serverPort:P,slug:a,caCert:l,serverName:u}=await or({apiUrl:n,apiKey:e}),y=O(),m=sr(),$=await M(o,m),b,A;try{b=rr(S(tr(),"corsair-frpc-")),A=S(b,"frpc.toml");let f=l?S(b,"ca.crt"):void 0;f&&l&&G(f,l,{mode:384}),G(A,F({serverAddr:E,serverPort:P,apiKey:e,slug:a,localPort:$.port,caCertPath:f,serverName:u,deliveryPath:m}),{mode:384})}catch(f){throw await $.close(),f}let W=`https://${a}.${t}`;return new Promise((f,Y)=>{let h=!1,N=!1,v="",d=X(y,["-c",A],{stdio:["ignore","pipe","pipe"]}),C=()=>{$.close(),er(b,{recursive:!0,force:!0})},_=!1,H=()=>{d.killed||d.kill(),C()};process.once("exit",H);let R=()=>{_||(_=!0,process.removeListener("exit",H),process.removeListener("SIGINT",T),process.removeListener("SIGTERM",T),d.stdout.removeAllListeners("data"),d.stderr.removeAllListeners("data"),d.killed||d.kill(),C())},T=s=>{R(),process.kill(process.pid,s)};process.once("SIGINT",T),process.once("SIGTERM",T);let g=s=>{h||(h=!0,clearTimeout(I),R(),Y(s))},U=async s=>{if(!N){if(v+=s.toString(),z.test(v)){g(new Error(`frpc rejected the tunnel: ${ir(v)}`));return}if(nr.test(v)){N=!0,clearTimeout(I);try{await lr({apiUrl:n,apiKey:e})}catch(p){g(p instanceof Error?p:new Error(String(p)));return}h||(h=!0,f({url:W,stop:R}))}}};d.stdout.on("data",s=>{U(s)}),d.stderr.on("data",s=>{U(s)}),d.on("error",s=>{g(new Error(`Failed to spawn frpc: ${s.message}`))}),d.on("exit",s=>{if(!h){let p=ar(v),q=p?` \u2014 ${p}`:"";g(new Error(`frpc exited early (code ${s??"null"}) before the tunnel came up${q}`));return}process.removeListener("exit",H),C(),i?.()});let I=setTimeout(()=>{g(new Error(`Timed out after ${c}ms waiting for frpc to establish the tunnel`))},c)})}function sr(){try{let r=new URL(x()).pathname.replace(/\/$/,"");return r&&r!=="/"?r:w}catch{return w}}function ir(r){return(r.split(`
 `).find(n=>z.test(n))??"start error").trim()}function ar(r){return r.split(`
 `).filter(n=>n.trim()!=="").at(-1)?.trim()??""}async function lr(r){let o=r.apiUrl.replace(/\/$/,""),n=await fetch(`${o}/api/dev/register`,{method:"POST",headers:{authorization:`Bearer ${r.apiKey}`},signal:AbortSignal.timeout(D)});if(!n.ok)throw new Error(`Hub tunnel-live ping failed (HTTP ${n.status})`)}export{or as fetchTunnelConfig,lr as pingTunnelLive,$r as runTunnel};

package/dist/hub.d.ts

@@ -599,13 +599,6 @@ declare const CORSAIR_TUNNEL_PATH = "/api/corsair";
  *  verify against). This literal is only the runtime cache-path segment. */
 declare const FRPC_VERSION = "0.71.0";
 declare function frpcPlatformKey(): string;
-/**
- * Absolute path to a runnable frpc for this platform. Resolution order: an
- * explicit `CORSAIR_FRP_BIN` override, then this platform's optional-dependency
- * package (the esbuild pattern — no install script, so pnpm never blocks it),
- * then the postinstall download cache as a fallback. Throws with an install hint
- * if none resolves.
- */
 declare function resolveFrpcBinary(): string;
 
 export { CORSAIR_TUNNEL_PATH, CORSAIR_TUNNEL_ZONE, type ClientBridgeDeliverySpec, type ClientBridgeTransportResult, type ConnectAuthFieldStatus, type ConnectAuthKind, type ConnectAuthStatusLevel, type ConnectCreateLinkDeliveryResult, type ConnectPluginManifestEntry, type ConnectSessionTokenPayload, type ConnectStatusPluginEntry, type ConnectStatusResponse, type ConnectTokenPayload, type CreateConnectSessionRequestBody, type CreatePermissionSessionRequestBody, FRPC_VERSION, type FormatServerDeliveryErrorInput, HubConfig, HubConfigInput, HubConnectSessionInput, HubConnectSessionResult, type HubDeliveryRequest, type HubDeliveryResult, HubListProjectConnectionsInput, HubNotConfiguredError, HubOAuthMode, type HubOAuthRefreshResponse, HubPermissionSessionInput, HubPermissionSessionResult, type HubProjectConnection, type ManagedAccessTokenResult, type ManagedAuthContext, ManagedOAuthDeliveryError, type PermissionTokenPayload, type PrepareClientBridgeDeliveryTransportInput, type ProcessManagedOAuthDeliveryOptions, type ProcessManagedOAuthDeliveryResult, type ServerDeliveryAckBody, type SignedDeliveryHeaders, type SignedEnvelopeDeliveryResult, TunnelType, attachManagedRefreshAuth, buildClientBridgeBrowserDeliveryUrl, createConnectSessionJti, createConnectTokenJti, createHubConnectSession, createHubPermissionSession, createHubRouteHandlers, createPermissionSessionJti, createSignedTokenJti, decodeConnectSessionTokenFromPath, decodeConnectTokenFromPath, decodePermissionTokenFromPath, deliverConnectCreateLink, deliverSignedEnvelope, describeDeliveryNetworkError, encodeConnectTokenForPath, extractConnectLinkFromDeliveryAck, extractProbeFromDeliveryAck, extractRunFromDeliveryAck, extractSyncFromDeliveryAck, formatHubApprovalMessage, formatServerDeliveryError, frpcPlatformKey, getConnectSessionExpiryMs, getConnectStatusForTenant, getConnectTokenExpiryMs, getHubConfig, getManagedAccessToken, handleHubDeliveryGet, handleHubDeliveryPost, handleHubDeliveryRequest, hubDeliveryToResponse, inferHubEnvironmentSlug, isLoopbackUrl, isServerDeliveryAckSuccessful, listHubProjectConnections, normalizeHubConfig, parseConnectLinkFromDeliveryBody, parseConnectSessionResponse, parseConnectStatusResponse, parseHubApiErrorBody, parseOAuthRefreshResponse, parsePermissionSessionResponse, parseProjectConnectionsResponse, parseServerDeliveryAckBody, parseSyncFromDeliveryBody, prepareClientBridgeDeliveryTransport, processManagedOAuthDelivery, registerHubWebhookTenantLink, resolveDeliveryTransport, resolveFrpcBinary, resolveHubDeliveryUrl, resolveHubOAuthCallbackUrl, respondToHubDelivery, respondToHubDeliveryFromRequest, signConnectSessionToken, signConnectToken, signDeliveryEnvelope, signPermissionToken, usesBrowserDelivery, validateProductionDeliveryUrl, verifyConnectSessionToken, verifyConnectToken, verifyDeliveryEnvelope, verifyPermissionToken, verifySignedTunnelDelivery };

package/dist/hub.js

@@ -1 +1 @@
-import{$a as ca,Aa as Q,Ba as R,Ca as S,Da as T,Ea as U,Q as A,Ra as V,Sa as W,Ta as X,Ua as Y,Va as Z,Wa as _,Xa as $,Ya as aa,_a as ba,ab as da,b as a,bb as ea,c as b,cb as fa,d as c,db as ga,e as d,eb as ha,f as e,fa as B,fb as ia,g as f,gb as ja,h as g,ha as C,hb as ka,i,ia as D,ib as la,j,jb as ma,k,kb as na,l,lb as oa,m,mb as pa,n,nb as qa,o,oa as E,ob as ra,p,pa as F,pb as sa,q,qa as G,r,ra as H,s,sa as I,t,ta as J,u,ua as K,v,va as L,w,wa as M,x,xa as N,y,ya as O,z,za as P}from"./chunk-HE4Z5CZQ.js";import{a as h,b as ta,c as ua,d as va,e as wa,f as xa}from"./chunk-KL3FGSOP.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{m as BROWSER_DELIVERY_TTL_MS,ua as CORSAIR_TUNNEL_PATH,ta as CORSAIR_TUNNEL_ZONE,u as DEFAULT_HUB_API_URL,va as FRPC_VERSION,v as HubNotConfiguredError,T as ManagedOAuthDeliveryError,n as SIGNED_TUNNEL_REPLAY_WINDOW_MS,ca as attachManagedRefreshAuth,p as buildBrowserDeliveryRedirectUrl,s as buildClientBridgeBrowserDeliveryUrl,ea as createConnectSessionJti,ja as createConnectTokenJti,B as createHubConnectSession,C as createHubPermissionSession,da as createHubRouteHandlers,pa as createPermissionSessionJti,o as createSignedTokenJti,ia as decodeConnectSessionTokenFromPath,oa as decodeConnectTokenFromPath,sa as decodePermissionTokenFromPath,O as deliverConnectCreateLink,S as deliverSignedEnvelope,Q as describeDeliveryNetworkError,na as encodeConnectTokenForPath,M as extractConnectLinkFromDeliveryAck,F as extractProbeFromDeliveryAck,E as extractRunFromDeliveryAck,L as extractSyncFromDeliveryAck,D as formatHubApprovalMessage,a as formatProviderDisplayName,R as formatServerDeliveryError,wa as frpcPlatformKey,fa as getConnectSessionExpiryMs,V as getConnectStatusForTenant,ka as getConnectTokenExpiryMs,x as getHubConfig,ba as getManagedAccessToken,X as handleHubDeliveryGet,Y as handleHubDeliveryPost,_ as handleHubDeliveryRequest,Z as hubDeliveryToResponse,z as inferHubEnvironmentSlug,i as isLoopbackUrl,K as isServerDeliveryAckSuccessful,W as listHubProjectConnections,w as normalizeHubConfig,N as parseConnectLinkFromDeliveryBody,b as parseConnectSessionResponse,f as parseConnectStatusResponse,g as parseHubApiErrorBody,e as parseOAuthRefreshResponse,d as parsePermissionSessionResponse,c as parseProjectConnectionsResponse,J as parseServerDeliveryAckBody,P as parseSyncFromDeliveryBody,t as prepareClientBridgeDeliveryTransport,U as processManagedOAuthDelivery,A as registerHubWebhookTenantLink,j as resolveDeliveryTransport,xa as resolveFrpcBinary,h as resolveHubDeliveryUrl,y as resolveHubOAuthCallbackUrl,$ as respondToHubDelivery,aa as respondToHubDeliveryFromRequest,q as signBrowserDeliveryToken,ga as signConnectSessionToken,la as signConnectToken,G as signDeliveryEnvelope,qa as signPermissionToken,k as usesBrowserDelivery,l as validateProductionDeliveryUrl,r as verifyBrowserDeliveryToken,ha as verifyConnectSessionToken,ma as verifyConnectToken,H as verifyDeliveryEnvelope,ra as verifyPermissionToken,I as verifySignedTunnelDelivery};
+import{$a as ca,Aa as Q,Ba as R,Ca as S,Da as T,Ea as U,Q as A,Ra as V,Sa as W,Ta as X,Ua as Y,Va as Z,Wa as _,Xa as $,Ya as aa,_a as ba,ab as da,b as a,bb as ea,c as b,cb as fa,d as c,db as ga,e as d,eb as ha,f as e,fa as B,fb as ia,g as f,gb as ja,h as g,ha as C,hb as ka,i,ia as D,ib as la,j,jb as ma,k,kb as na,l,lb as oa,m,mb as pa,n,nb as qa,o,oa as E,ob as ra,p,pa as F,pb as sa,q,qa as G,r,ra as H,s,sa as I,t,ta as J,u,ua as K,v,va as L,w,wa as M,x,xa as N,y,ya as O,z,za as P}from"./chunk-RWGMXXPK.js";import{a as h,b as ta,c as ua,d as va,e as wa,f as xa}from"./chunk-3TC2WIUS.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{m as BROWSER_DELIVERY_TTL_MS,ua as CORSAIR_TUNNEL_PATH,ta as CORSAIR_TUNNEL_ZONE,u as DEFAULT_HUB_API_URL,va as FRPC_VERSION,v as HubNotConfiguredError,T as ManagedOAuthDeliveryError,n as SIGNED_TUNNEL_REPLAY_WINDOW_MS,ca as attachManagedRefreshAuth,p as buildBrowserDeliveryRedirectUrl,s as buildClientBridgeBrowserDeliveryUrl,ea as createConnectSessionJti,ja as createConnectTokenJti,B as createHubConnectSession,C as createHubPermissionSession,da as createHubRouteHandlers,pa as createPermissionSessionJti,o as createSignedTokenJti,ia as decodeConnectSessionTokenFromPath,oa as decodeConnectTokenFromPath,sa as decodePermissionTokenFromPath,O as deliverConnectCreateLink,S as deliverSignedEnvelope,Q as describeDeliveryNetworkError,na as encodeConnectTokenForPath,M as extractConnectLinkFromDeliveryAck,F as extractProbeFromDeliveryAck,E as extractRunFromDeliveryAck,L as extractSyncFromDeliveryAck,D as formatHubApprovalMessage,a as formatProviderDisplayName,R as formatServerDeliveryError,wa as frpcPlatformKey,fa as getConnectSessionExpiryMs,V as getConnectStatusForTenant,ka as getConnectTokenExpiryMs,x as getHubConfig,ba as getManagedAccessToken,X as handleHubDeliveryGet,Y as handleHubDeliveryPost,_ as handleHubDeliveryRequest,Z as hubDeliveryToResponse,z as inferHubEnvironmentSlug,i as isLoopbackUrl,K as isServerDeliveryAckSuccessful,W as listHubProjectConnections,w as normalizeHubConfig,N as parseConnectLinkFromDeliveryBody,b as parseConnectSessionResponse,f as parseConnectStatusResponse,g as parseHubApiErrorBody,e as parseOAuthRefreshResponse,d as parsePermissionSessionResponse,c as parseProjectConnectionsResponse,J as parseServerDeliveryAckBody,P as parseSyncFromDeliveryBody,t as prepareClientBridgeDeliveryTransport,U as processManagedOAuthDelivery,A as registerHubWebhookTenantLink,j as resolveDeliveryTransport,xa as resolveFrpcBinary,h as resolveHubDeliveryUrl,y as resolveHubOAuthCallbackUrl,$ as respondToHubDelivery,aa as respondToHubDeliveryFromRequest,q as signBrowserDeliveryToken,ga as signConnectSessionToken,la as signConnectToken,G as signDeliveryEnvelope,qa as signPermissionToken,k as usesBrowserDelivery,l as validateProductionDeliveryUrl,r as verifyBrowserDeliveryToken,ha as verifyConnectSessionToken,ma as verifyConnectToken,H as verifyDeliveryEnvelope,ra as verifyPermissionToken,I as verifySignedTunnelDelivery};

package/dist/index.js

@@ -1,3 +1,3 @@
-import{a as Y,b as z}from"./chunk-RQ5QHONV.js";import{Ab as m,Fa as T,Fb as _,Gb as $,Hb as M,Ib as D,Jb as H,Kb as N,Lb as j,M as k,Na as A,Pb as q,Qb as B,R as x,Rb as g,S as P,Sb as J,T as b,U as S,Za as L,ga as w,ja as I,ka as R,la as O,qb as F,rb as W,sb as E,tb as v,xb as l,yb as c,zb as d}from"./chunk-HE4Z5CZQ.js";import"./chunk-KL3FGSOP.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";function s(n){let t=n[g];if(!t)throw new Error("listOperations / getSchema: invalid corsair instance. Pass the value returned by createCorsair() or corsair.withTenant().");return t.plugins}function G(n,t){let r=c(s(n),t);return typeof r=="string"?r:Array.isArray(r)?r.join(`
+import{a as Y,b as z}from"./chunk-RQ5QHONV.js";import{Ab as m,Fa as T,Fb as _,Gb as $,Hb as M,Ib as D,Jb as H,Kb as N,Lb as j,M as k,Na as A,Pb as q,Qb as B,R as x,Rb as g,S as P,Sb as J,T as b,U as S,Za as L,ga as w,ja as I,ka as R,la as O,qb as F,rb as W,sb as E,tb as v,xb as l,yb as c,zb as d}from"./chunk-RWGMXXPK.js";import"./chunk-3TC2WIUS.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";function s(n){let t=n[g];if(!t)throw new Error("listOperations / getSchema: invalid corsair instance. Pass the value returned by createCorsair() or corsair.withTenant().");return t.plugins}function G(n,t){let r=c(s(n),t);return typeof r=="string"?r:Array.isArray(r)?r.join(`
 `):Object.values(r).flat().join(`
 `)}function K(n,t){return d(s(n),t)}function Q(n,t){return l(s(n),t)}var U=Symbol.for("corsair:internal");function V(n,t){let r=n;for(let e of t){if(!r||typeof r!="object")return null;r=r[e]}return typeof r=="function"?r:null}function y(n){return n[U]?.database}async function X(n,t){let r=new Date().toISOString(),e=await n.permissions.find_by_token(t);if(!e)return console.error("executePermission: no permission found for token."),{error:"executePermission: no permission found for token."};if(e.status!=="approved")return console.error(`executePermission: permission '${e.id}' is '${e.status}', expected 'approved'.`),{endpoint:e.endpoint,plugin:e.plugin,result:null,error:`executePermission: permission '${e.id}' is '${e.status}', expected 'approved'.`};if(e.expires_at<r){let o=y(n);return o&&await o.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",e.id).execute(),console.error(`executePermission: permission '${e.id}' has expired.`),{error:`executePermission: permission '${e.id}' has expired.`,endpoint:e.endpoint,plugin:e.plugin,result:null}}let h=e.tenant_id??"default",a=(n.withTenant?n.withTenant(h):n)[e.plugin];if(!a?.api)return console.error(`executePermission: plugin '${e.plugin}' not found or has no API on this corsair instance.`),{error:`executePermission: plugin '${e.plugin}' not found or has no API on this corsair instance.`,plugin:e.plugin,endpoint:e.endpoint,result:null};let p=V(a.api,e.endpoint.split("."));if(!p)return console.error(`executePermission: endpoint '${e.endpoint}' not found in plugin '${e.plugin}'.`),{endpoint:e.endpoint,plugin:e.plugin,result:null,error:`executePermission: endpoint '${e.endpoint}' not found in plugin '${e.plugin}'.`};await n.permissions.set_executing(e.id);try{let o=typeof e.args=="string"?JSON.parse(e.args):e.args,i=await p(o);return await n.permissions.set_completed(e.id),{plugin:e.plugin,endpoint:e.endpoint,result:i}}catch(o){let i=o instanceof Error?o.message:String(o),u=y(n);return u&&await u.db.updateTable("corsair_permissions").set({status:"failed",error:i,updated_at:new Date}).where("id","=",e.id).execute(),{plugin:e.plugin,endpoint:e.endpoint,result:null,error:i}}}export{L as AuthMissingError,Y as CorsairClientError,I as PermissionRequiredError,R as ReadonlyForbiddenError,N as asRecord,M as collectPluginWebhookMatchers,J as createCorsair,z as createCorsairClient,B as decodePubSubData,X as executePermission,q as firstString,m as formatDocSchemaShape,D as getHeader,K as getSchema,Q as getStructuredSchema,G as listOperations,F as managementHandler,_ as matchWebhookPlugin,$ as matchWebhookPluginAndTenant,A as processCorsair,T as processWebhook,j as readBodyRecord,P as resolveAccountFromWebhookLink,w as resolveConnectLink,S as resolveTenantFromWebhookLink,b as resolveTenantIdFromWebhookLink,O as runReadonly,x as setWebhookTenantLink,k as setupCorsair,W as toExpressHandler,H as toExternalId,E as toHonoHandler,v as toNextJsHandler};

package/dist/{loop-KLFTGQSS.js → loop-X6FXSLYX.js}

@@ -1 +1 @@
-import{Oa as a,Pa as b,Qa as c}from"./chunk-HE4Z5CZQ.js";import"./chunk-KL3FGSOP.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{a as deriveAck,b as pollOnce,c as startConnectLoop};
+import{Oa as a,Pa as b,Qa as c}from"./chunk-RWGMXXPK.js";import"./chunk-3TC2WIUS.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{a as deriveAck,b as pollOnce,c as startConnectLoop};

package/dist/oauth.js

@@ -1 +1 @@
-import{O as a,P as b,V as c,W as d,X as e,Y as f,Z as g,_ as h}from"./chunk-HE4Z5CZQ.js";import"./chunk-KL3FGSOP.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{d as OAuthCallbackError,c as buildOAuthAuthorizeUrl,b as decodeOAuthState,a as encodeOAuthState,e as generateOAuthUrl,f as processOAuthCallback,g as renewSubscriptions,h as startSubscriptionRenewal};
+import{O as a,P as b,V as c,W as d,X as e,Y as f,Z as g,_ as h}from"./chunk-RWGMXXPK.js";import"./chunk-3TC2WIUS.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{d as OAuthCallbackError,c as buildOAuthAuthorizeUrl,b as decodeOAuthState,a as encodeOAuthState,e as generateOAuthUrl,f as processOAuthCallback,g as renewSubscriptions,h as startSubscriptionRenewal};

package/dist/setup-6ORKZHQT.js

@@ -0,0 +1 @@
+import{M as a,N as b}from"./chunk-RWGMXXPK.js";import"./chunk-3TC2WIUS.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};

package/dist/{setup-introspect-6KUC32UF.js → setup-introspect-Y3Z3RUMG.js}

@@ -1 +1 @@
-import{$ as a,aa as b,ba as c,ca as d}from"./chunk-HE4Z5CZQ.js";import"./chunk-KL3FGSOP.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as buildConnectPluginManifest,a as buildConnectPluginManifestFromContext,d as ensureConnectAccountRows,c as ensureConnectAccountRowsFromContext};
+import{$ as a,aa as b,ba as c,ca as d}from"./chunk-RWGMXXPK.js";import"./chunk-3TC2WIUS.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as buildConnectPluginManifest,a as buildConnectPluginManifestFromContext,d as ensureConnectAccountRows,c as ensureConnectAccountRowsFromContext};

package/dist/setup.js

@@ -1 +1 @@
-import{M as a,N as b}from"./chunk-HE4Z5CZQ.js";import"./chunk-KL3FGSOP.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};
+import{M as a,N as b}from"./chunk-RWGMXXPK.js";import"./chunk-3TC2WIUS.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};

package/dist/tunnel.js

@@ -1 +1 @@
-import{Ga as f,Ha as g,Ia as h,Ja as i,Ka as j,La as k,Ma as l,Na as m,R as b,S as c,T as d,U as e,r as a}from"./chunk-HE4Z5CZQ.js";import"./chunk-KL3FGSOP.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{l as applyPermissionDecision,f as executeWorkflowRun,h as isAuthCredentialsBrowserDelivery,k as isByoOAuthBrowserDelivery,j as isManagedBrowserDelivery,i as isPermissionBrowserDelivery,m as processCorsair,c as resolveAccountFromWebhookLink,e as resolveTenantFromWebhookLink,d as resolveTenantIdFromWebhookLink,g as runReadonlyProbe,b as setWebhookTenantLink,a as verifyBrowserDeliveryToken};
+import{Ga as f,Ha as g,Ia as h,Ja as i,Ka as j,La as k,Ma as l,Na as m,R as b,S as c,T as d,U as e,r as a}from"./chunk-RWGMXXPK.js";import"./chunk-3TC2WIUS.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{l as applyPermissionDecision,f as executeWorkflowRun,h as isAuthCredentialsBrowserDelivery,k as isByoOAuthBrowserDelivery,j as isManagedBrowserDelivery,i as isPermissionBrowserDelivery,m as processCorsair,c as resolveAccountFromWebhookLink,e as resolveTenantFromWebhookLink,d as resolveTenantIdFromWebhookLink,g as runReadonlyProbe,b as setWebhookTenantLink,a as verifyBrowserDeliveryToken};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "corsair",
-  "version": "0.1.118",
+  "version": "0.1.119",
   "description": "",
   "type": "module",
   "main": "./dist/index.js",
@@ -85,10 +85,10 @@
   "optionalDependencies": {
     "@corsair-dev/frpc-darwin-arm64": "0.1.117",
     "@corsair-dev/frpc-darwin-x64": "0.1.117",
-    "@corsair-dev/frpc-win32-arm64": "0.1.117",
+    "@corsair-dev/frpc-linux-arm64": "0.1.117",
     "@corsair-dev/frpc-linux-x64": "0.1.117",
-    "@corsair-dev/frpc-win32-x64": "0.1.117",
-    "@corsair-dev/frpc-linux-arm64": "0.1.117"
+    "@corsair-dev/frpc-win32-arm64": "0.1.117",
+    "@corsair-dev/frpc-win32-x64": "0.1.117"
   },
   "devDependencies": {
     "@testing-library/react": "^16.3.2",

package/dist/chunk-KL3FGSOP.js

@@ -1 +0,0 @@
-import{a as e}from"./chunk-SOY77BN4.js";var l="3000",f="/api/corsair";function u(t){return t.replace(/\/$/,"")}function y(t){let r=t?.deliveryUrl?.trim()||process.env.CORSAIR_DELIVERY_URL?.trim();if(r){let a=/^https?:\/\//i.test(r)?r:`https://${r}`;return u(a)}return`http://localhost:${process.env.PORT?.trim()||l}${f}`}var E="corsair.cloud",O="/api/corsair";import{existsSync as n}from"fs";import{createRequire as m}from"module";import{homedir as R}from"os";import{dirname as h,join as i}from"path";var d="0.71.0",g=m(e);function _(){let t=`@corsair-dev/frpc-${process.platform}-${process.arch}`;try{let r=i(h(g.resolve(`${t}/package.json`)),p());return n(r)?r:null}catch{return null}}function c(){return`${process.platform}-${process.arch}`}function p(){return process.platform==="win32"?"frpc.exe":"frpc"}function v(){return i(R(),".cache","corsair","frpc",d,c(),p())}function S(){let t=process.env.CORSAIR_FRP_BIN;if(t&&n(t))return t;let r=_();if(r)return r;let o=v();if(n(o))return o;throw new Error(`frpc binary not found for ${c()}. If you use pnpm, run \`pnpm approve-builds corsair\` (or add corsair to onlyBuiltDependencies) and reinstall; otherwise reinstall corsair, or set CORSAIR_FRP_BIN to an frpc path (https://github.com/fatedier/frp/releases).`)}export{y as a,E as b,O as c,d,c as e,S as f};

package/dist/setup-J2LPDA5W.js

@@ -1 +0,0 @@
-import{M as a,N as b}from"./chunk-HE4Z5CZQ.js";import"./chunk-KL3FGSOP.js";import"./chunk-VOH7OVWP.js";import"./chunk-F2EV3CHK.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};