corsair 0.1.125 → 0.1.126

package/README.md

@@ -19,8 +19,8 @@ export const corsair = createCorsair({
   database: db,
   kek: process.env.CORSAIR_KEK!,
   hub: {
-    projectApiKey: process.env.CORSAIR_DEV_API_KEY!,
-    signingSecret: process.env.CORSAIR_DEV_SIGNING_SECRET!,
+    projectApiKey: process.env.CORSAIR_API_KEY!,
+    signingSecret: process.env.CORSAIR_SIGNING_SECRET!,
   },
 });
 ```

package/dist/{browser-delivery-Da29aknX.d.ts → browser-delivery-BVsj88up.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-D-pBLE_N.js';
+import { B as BrowserDeliveryPayload } from './index-Dp27gGG4.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/{chunk-H2PWRKH5.js → chunk-AHWGCIDB.js}

@@ -1,4 +1,4 @@
-import{a as ve,b as Jt,c as Vt}from"./chunk-4OLKWKJG.js";import{a as _o,b as Te,c as Eo,d as v,e as j,f as Do,g as z,h as $,i as I,j as $n,k as Oo,l as Mo,m as zt,n as Bo,o as Fo}from"./chunk-7Q2WLIJE.js";import{a as So,g as Ho}from"./chunk-ZZA3PW24.js";import{ZodBoolean as yl,ZodDate as ml,ZodEnum as hl,ZodNullable as bl,ZodNumber as kl,ZodObject as wl,ZodOptional as Cl,ZodRecord as vl,ZodString as Tl,ZodType as Pl}from"zod";var Wn=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agilitycms","ahrefs","aimlapi","airtable","aivoov","alchemy","algolia","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","asana","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beeminder","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bitbucket","bitwarden","blazemeter","blocknative","bluesky","boloforms","boltiot","bonsai","bookingmood","botpress","botsonic","bouncer","box","boxhero","brandfetch","brex","brightdata","browseai","browserless","bugsnag","buildkite","cal","calendly","canva","canvas","capsulecrm","chatbotkit","chatfai","circleci","clickhouse","clientary","clockify","cloudflare","cloudinary","collegefootballdata","confluence","contentfulgraphql","contextsevenmcp","crowterminal","cursor","customgpt","databricks","datadog","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","dodopayments","doppler","dreamstudio","dripcel","dropbox","dropboxsign","epicgames","exa","facebook","faraday","figma","filloutforms","firecrawl","fireflies","formbricks","gemini","github","gitlab","gmail","googleaddressvalidation","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","htmltoimage","hubspot","huggingface","imgbb","insightoai","instagram","intercom","jigsawstack","jira","kaggle","linear","linkedin","loyverse","mailboxlayer","mailchimp","mailtrap","marketstack","merriamwebsterdict","monday","neon","nextdns","notion","ocrspace","ocrwebservice","ollama","onedrive","onepassword","openai","openrouter","openweathermap","oura","outlook","pagerduty","parseur","pdfmonkey","perplexityai","pinecone","posthog","razorpay","reddit","removebg","resend","retailed","salesforce","scrapegraphai","securitytrails","sendgrid","sentry","serpapi","sharepoint","slack","sourcegraph","spotify","strava","streamtime","stripe","studiobyai21labs","supabase","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","tisane","timecamp","todoist","toggl","trello","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","unione","uniswapapi","vapi","vercel","vestaboard","wakatime","webflow","webvizio","whatsapp","witai","wiza","workday","workiom","xquik","youcom","youtube","zendesk","zohomail","zoom","zoominfo"],Uo={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",alchemy:"Alchemy",algolia:"Algolia",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",asana:"Asana",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beeminder:"Beeminder",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",browserless:"Browserless",bugsnag:"BugSnag",buildkite:"Buildkite",cal:"Cal",calendly:"Calendly",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",circleci:"CircleCI",clickhouse:"Clickhouse",clientary:"Clientary",clockify:"Clockify",cloudflare:"Cloudflare",cloudinary:"Cloudinary",collegefootballdata:"College Football Data",confluence:"Confluence",contentfulgraphql:"Contentful GraphQL",contextsevenmcp:"Context7",crowterminal:"CrowTerminal",cursor:"Cursor",customgpt:"CustomGPT",databricks:"Databricks",datadog:"Datadog",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",dodopayments:"Dodo Payments",doppler:"Doppler",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",epicgames:"Epic Games",exa:"Exa",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",formbricks:"Formbricks",gemini:"Gemini",github:"GitHub",gitlab:"GitLab",gmail:"Gmail",googleaddressvalidation:"Google Address Validation",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailboxlayer:"MailboxLayer",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",monday:"Monday",neon:"Neon",nextdns:"NextDNS",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfmonkey:"PDFMonkey",perplexityai:"Perplexity AI",pinecone:"Pinecone",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",removebg:"remove.bg",resend:"Resend",retailed:"Retailed",salesforce:"Salesforce",scrapegraphai:"ScrapeGraphAI",securitytrails:"SecurityTrails",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",sourcegraph:"Sourcegraph",spotify:"Spotify",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",tisane:"Tisane",timecamp:"TimeCamp",todoist:"Todoist",toggl:"Toggl",trello:"Trello",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",unione:"Unione",uniswapapi:"Uniswap",vapi:"Vapi",vercel:"Vercel",vestaboard:"Vestaboard",wakatime:"WakaTime",webflow:"Webflow",webvizio:"Webvizio",whatsapp:"WhatsApp",witai:"WitAi",wiza:"Wiza",workday:"Workday",workiom:"Workiom",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Pe(e){let n=Uo[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var de=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function _(e){return typeof e=="string"&&e.length>0}function wa(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Ca(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function jn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!_(n.connectUrl)||!_(n.token)||!_(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:_(n.environmentId)?n.environmentId:n.projectId};return _(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function qn(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!_(r.tenantId)||!_(r.plugin)||!wa(r.status)||!Ca(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:_(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function Kn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!_(n.approvalUrl)||!_(n.token)||!_(n.projectId)||!_(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function ze(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(_(n.access_token))return{access_token:n.access_token,refresh_token:_(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:_(n.scope)?n.scope:void 0};throw new Error(_(n.error)?_(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function va(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Ta(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;_(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function Pa(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function No(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!_(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!_(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",s=Ta(o.fields),a=va(o.missingRequiredFields),u=Pa(o.status,o.connected,s,a);t.push({plugin:o.plugin,providerName:_(o.providerName)?o.providerName:o.plugin,authKind:i,status:u,connected:o.connected,fields:s,missingRequiredFields:a})}return{tenantId:n.tenantId,plugins:t}}function Zn(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Lo(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}function $o(e){return e.replace(/\/$/,"")}function Yt(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return ve()}catch{return null}}function Wo(e){let n=Yt(e);return n?{"x-corsair-delivery-url":n}:{}}async function jo(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Aa(e,n,t){if(n===404&&t)return t;let r=Zn(e);return r||`Hub API returned HTTP ${n}`}function qo(e,n,t){let r=Lo(e);throw r?new de({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(Aa(e,n,t))}async function x(e){let n=$o(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...Wo(e.hub)},body:JSON.stringify(e.body)}),r=await jo(t);return t.ok||qo(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function W(e){let n=$o(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...Wo(e.hub)}}),r=await jo(t);return t.ok||qo(r,t.status,e.notFoundMessage),e.parseResponse(r)}function Gn(e){return e&&typeof e=="object"?e:{}}function Ko(e){let n=Gn(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Qt(e,n){return x({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=Gn(t);return{chat:r.thread,reply:Ko(r.reply)}}})}async function Xt(e,n){return x({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Ko})}async function er(e,n){return W({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Gn(t).threads;return Array.isArray(r)?r:[]}})}async function nr(e,n){return W({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=Gn(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Da}from"crypto";var Ra="corsair:client-bridge";function tr(e){return new URL(e).origin}function Je(e){let n=JSON.stringify({type:Ra,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(tr(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+import{a as ve,b as Jt,c as Vt}from"./chunk-4OLKWKJG.js";import{a as _o,b as Te,c as Eo,d as v,e as j,f as Do,g as z,h as $,i as I,j as $n,k as Oo,l as Mo,m as zt,n as Bo,o as Fo}from"./chunk-7Q2WLIJE.js";import{a as So,g as Ho}from"./chunk-ZZA3PW24.js";import{ZodBoolean as yl,ZodDate as ml,ZodEnum as hl,ZodNullable as bl,ZodNumber as kl,ZodObject as wl,ZodOptional as Cl,ZodRecord as vl,ZodString as Tl,ZodType as Pl}from"zod";var Wn=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agilitycms","ahrefs","aimlapi","airtable","aivoov","alchemy","algolia","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","asana","ascora","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beeminder","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bitbucket","bitwarden","blazemeter","blocknative","bluesky","boloforms","boltiot","bonsai","bookingmood","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brex","brightdata","browseai","browserless","bubble","bugsnag","buildkite","cal","calendly","canva","canvas","capsulecrm","chatbotkit","chatfai","circleci","clickhouse","clientary","clockify","cloudflare","cloudinary","collegefootballdata","confluence","connecteam","contentfulgraphql","contextsevenmcp","crowterminal","cursor","customgpt","databricks","datadog","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","dodopayments","doppler","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","epicgames","exa","facebook","faraday","figma","filloutforms","firecrawl","fireflies","formbricks","gemini","github","gitlab","gmail","googleaddressvalidation","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","htmltoimage","hubspot","huggingface","imgbb","insightoai","instagram","intercom","jigsawstack","jira","kaggle","linear","linkedin","loyverse","mailboxlayer","mailchimp","mailtrap","marketstack","merriamwebsterdict","monday","neon","nextdns","notion","ocrspace","ocrwebservice","ollama","onedrive","onepassword","openai","openrouter","openweathermap","oura","outlook","pagerduty","parseur","pdfmonkey","perplexityai","pinecone","posthog","razorpay","reddit","removebg","resend","retailed","salesforce","sapsuccessfactors","scrapegraphai","securitytrails","sendgrid","sentry","serpapi","sharepoint","slack","sourcegraph","spotify","strava","streamtime","stripe","studiobyai21labs","supabase","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","timelink","tisane","timecamp","todoist","toggl","trello","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","unione","uniswapapi","vapi","vercel","vestaboard","wakatime","webflow","webvizio","whatsapp","witai","worldnewsapi","wiza","workday","workiom","xquik","youcom","youtube","zendesk","zohomail","zoom","zoominfo"],Uo={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",alchemy:"Alchemy",algolia:"Algolia",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",asana:"Asana",ascora:"Ascora",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beeminder:"Beeminder",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",browserless:"Browserless",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",cal:"Cal",calendly:"Calendly",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",circleci:"CircleCI",clickhouse:"Clickhouse",clientary:"Clientary",clockify:"Clockify",cloudflare:"Cloudflare",cloudinary:"Cloudinary",collegefootballdata:"College Football Data",confluence:"Confluence",connecteam:"Connecteam",contentfulgraphql:"Contentful GraphQL",contextsevenmcp:"Context7",crowterminal:"CrowTerminal",cursor:"Cursor",customgpt:"CustomGPT",databricks:"Databricks",datadog:"Datadog",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",dodopayments:"Dodo Payments",doppler:"Doppler",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",epicgames:"Epic Games",exa:"Exa",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",formbricks:"Formbricks",gemini:"Gemini",github:"GitHub",gitlab:"GitLab",gmail:"Gmail",googleaddressvalidation:"Google Address Validation",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailboxlayer:"MailboxLayer",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",monday:"Monday",neon:"Neon",nextdns:"NextDNS",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfmonkey:"PDFMonkey",perplexityai:"Perplexity AI",pinecone:"Pinecone",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",removebg:"remove.bg",resend:"Resend",retailed:"Retailed",salesforce:"Salesforce",sapsuccessfactors:"SAP SuccessFactors",scrapegraphai:"ScrapeGraphAI",securitytrails:"SecurityTrails",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",sourcegraph:"Sourcegraph",spotify:"Spotify",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",timelink:"Timelink",tisane:"Tisane",timecamp:"TimeCamp",todoist:"Todoist",toggl:"Toggl",trello:"Trello",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",unione:"Unione",uniswapapi:"Uniswap",vapi:"Vapi",vercel:"Vercel",vestaboard:"Vestaboard",wakatime:"WakaTime",webflow:"Webflow",webvizio:"Webvizio",whatsapp:"WhatsApp",witai:"WitAi",worldnewsapi:"World News API",wiza:"Wiza",workday:"Workday",workiom:"Workiom",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Pe(e){let n=Uo[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var de=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function _(e){return typeof e=="string"&&e.length>0}function wa(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Ca(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function jn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!_(n.connectUrl)||!_(n.token)||!_(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:_(n.environmentId)?n.environmentId:n.projectId};return _(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function qn(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!_(r.tenantId)||!_(r.plugin)||!wa(r.status)||!Ca(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:_(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function Kn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!_(n.approvalUrl)||!_(n.token)||!_(n.projectId)||!_(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function ze(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(_(n.access_token))return{access_token:n.access_token,refresh_token:_(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:_(n.scope)?n.scope:void 0};throw new Error(_(n.error)?_(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function va(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Ta(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;_(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function Pa(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function No(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!_(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!_(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",s=Ta(o.fields),a=va(o.missingRequiredFields),u=Pa(o.status,o.connected,s,a);t.push({plugin:o.plugin,providerName:_(o.providerName)?o.providerName:o.plugin,authKind:i,status:u,connected:o.connected,fields:s,missingRequiredFields:a})}return{tenantId:n.tenantId,plugins:t}}function Zn(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Lo(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}function $o(e){return e.replace(/\/$/,"")}function Yt(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return ve()}catch{return null}}function Wo(e){let n=Yt(e);return n?{"x-corsair-delivery-url":n}:{}}async function jo(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Aa(e,n,t){if(n===404&&t)return t;let r=Zn(e);return r||`Hub API returned HTTP ${n}`}function qo(e,n,t){let r=Lo(e);throw r?new de({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(Aa(e,n,t))}async function x(e){let n=$o(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...Wo(e.hub)},body:JSON.stringify(e.body)}),r=await jo(t);return t.ok||qo(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function W(e){let n=$o(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...Wo(e.hub)}}),r=await jo(t);return t.ok||qo(r,t.status,e.notFoundMessage),e.parseResponse(r)}function Gn(e){return e&&typeof e=="object"?e:{}}function Ko(e){let n=Gn(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Qt(e,n){return x({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=Gn(t);return{chat:r.thread,reply:Ko(r.reply)}}})}async function Xt(e,n){return x({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Ko})}async function er(e,n){return W({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Gn(t).threads;return Array.isArray(r)?r:[]}})}async function nr(e,n){return W({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=Gn(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Da}from"crypto";var Ra="corsair:client-bridge";function tr(e){return new URL(e).origin}function Je(e){let n=JSON.stringify({type:Ra,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(tr(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
 (function () {
   var message = ${n};
   var targetOrigin = ${t};
@@ -6,7 +6,7 @@ import{a as ve,b as Jt,c as Vt}from"./chunk-4OLKWKJG.js";import{a as _o,b as Te,
     window.parent.postMessage(message, targetOrigin);
   }
 })();
-</script></body></html>`}var xa=new Set(["localhost","127.0.0.1","[::1]","::1"]);function rr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:xa.has(n)}catch{return!1}}function Cn(e){return e==="development"?"browser":"server"}function Zo(e){return Cn(e)==="browser"}function Go(e){return rr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Ea}from"crypto";var Ae=60*1e3,Be=300*1e3;import{createHmac as Ia,randomBytes as Sa,timingSafeEqual as _a}from"crypto";function pe(){return Sa(16).toString("base64url")}function vn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Ia("sha256",t).update(e).digest("base64url")}function se(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let s=vn(o,t);try{if(!_a(Buffer.from(i,"utf8"),Buffer.from(s,"utf8")))return null}catch{return null}let a;try{a=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return a.exp*1e3<Date.now()?null:a}function zn(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),s=vn(i,n);return`${i}.${s}`}function Tn(e,n,t){let r=Math.floor(Date.now()/1e3);return zn(e,n,r+Math.floor(t/1e3))}function Fe(e){return decodeURIComponent(e)}function or(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function zo(e){let n=e.trim();return n.length>0?n:null}function Ve(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function Ye(e,n){if(!zo(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Ea(16).toString("base64url"),iat:t,exp:t+Math.floor(Ae/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=vn(o,n);return`${o}.${i}`}function Re(e,n){return zo(n)?se(e,n):null}function Oa(e){let n=tr(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function ir(e){let n=Ye(Oa(e),e.signingSecret);return Ve(e.deliveryUrl,n)}function Jo(e){if(Cn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Da(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:ir(r)}}var Pn="https://auth.corsair.dev";var ge=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},An=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function sr(e){let n=(e.apiUrl?.trim()||Pn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"";if(!t||!r)throw new An;return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function Jn(e){return sr(e)}function Ma(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function F(e){let n=v(e).hub;if(!n||!Ma(n))throw new ge;return n}function Vo(e){return e.replace(/\/$/,"")}function Vn(e){return e.oauthCallbackUrl?Vo(e.oauthCallbackUrl.trim()):`${Vo(e.apiUrl)}/oauth/callback`}function Qe(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}import{createCipheriv as Yo,createDecipheriv as Qo,randomBytes as Yn,scrypt as Ha}from"crypto";import{promisify as Ba}from"util";var Xo=Ba(Ha),Qn="aes-256-gcm",ei=12,Xn=16,Fa=16,Ue=32;function fe(){return Yn(Ue).toString("base64")}async function ye(e,n){let t=Yn(Fa),r=await Xo(n,t,Ue),o=Yn(ei),i=Yo(Qn,r,o,{authTagLength:Xn}),s=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),a.toString("base64"),s.toString("base64")].join(":")}async function Y(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Buffer.from(i,"base64"),c=await Xo(n,s,Ue),d=Qo(Qn,c,a,{authTagLength:Xn});return d.setAuthTag(u),Buffer.concat([d.update(l),d.final()]).toString("utf8")}function ar(e,n){let t=Buffer.from(n,"base64"),r=Yn(ei),o=Yo(Qn,t,r,{authTagLength:Xn}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[r.toString("base64"),s.toString("base64"),i.toString("base64")].join(":")}function Rn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Qo(Qn,i,s,{authTagLength:Xn});return l.setAuthTag(a),Buffer.concat([l.update(u),l.final()]).toString("utf8")}function xe(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=ar(o,n);return t}function me(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=Rn(o,n);return t}function xn(e,n,t){let r=me(e,n);return xe(r,t)}function ni(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let s=[null,void 0,""].includes(i)?null:i;await n({[o]:s})};return r}var ur=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function U(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,s=[...$[n].integration,...i],a=null,u={kek:r,integrationName:t,getIntegration:async()=>{if(a)return a;let k=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!k)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return a={id:k.id,config:ur(k.config),dek:k.dek??null},a},updateIntegration:async k=>{let b=await u.getIntegration();await o.db.updateTable("corsair_integrations").set({...k.config!==void 0?{config:k.config}:{},...k.dek!==void 0?{dek:k.dek}:{},updated_at:new Date}).where("id","=",b.id).execute(),a=null}},l=null,c=async()=>{if(l)return l;let k=await u.getIntegration();if(!k.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await Y(k.dek,r),l},d=async()=>{let k=await u.getIntegration(),b=await c(),C=k.config;return!C||Object.keys(C).length===0?{}:me(C,b)},p=Promise.resolve(),g=k=>{let b=p.then(()=>f(k));return p=b.catch(()=>{}),b},f=async k=>{let b=await c(),C;try{C=await d()}catch(D){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,D),C={}}let P={...C};for(let[D,H]of Object.entries(k))H===null?delete P[D]:P[D]=H;let O=xe(P,b);await u.updateIntegration({config:O})};return{get_dek:c,issue_new_dek:async()=>{let k=await u.getIntegration(),b=fe(),C={};if(k.dek){let O=await Y(k.dek,r),D=k.config;D&&Object.keys(D).length>0&&(C=xn(D,O,b))}let P=await ye(b,r);return await u.updateIntegration({config:C,dek:P}),l=b,b},...ni(d,g,s)}}function B(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:s=[],ensureProvisioned:a}=e,u=[...$[n].account,...s],l=null,c=null,d=async()=>{if(c)return c;let w=!1;for(;;){let A=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!A){if(!w&&a){w=!0,await a();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return c={id:A.id,config:ur(A.config),dek:A.dek??null},c}},p={kek:o,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(l)return l;let w=!1;for(;;){let A=await d(),R=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",A.id).executeTakeFirst();if(!R){if(!w&&a){w=!0,await a();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return l={id:R.id,config:ur(R.config),dek:R.dek??null},l}},updateAccount:async w=>{let A=await p.getAccount();await i.db.updateTable("corsair_accounts").set({...w.config!==void 0?{config:w.config}:{},...w.dek!==void 0?{dek:w.dek}:{},updated_at:new Date}).where("id","=",A.id).execute(),l=null}},g=null,f=null,h=async()=>{if(g)return g;let w=await p.getAccount();if(!w.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return g=await Y(w.dek,o),g},k=async()=>{if(f)return f;let w=await p.getIntegration();if(!w.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await Y(w.dek,o),f},b=async()=>{let w=await p.getAccount(),A=await h(),R=w.config;return!R||Object.keys(R).length===0?{}:me(R,A)},C=async()=>{let w=await p.getIntegration(),A=await k(),R=w.config;return!R||Object.keys(R).length===0?{}:me(R,A)},P=Promise.resolve(),O=w=>{let A=P.then(()=>D(w));return P=A.catch(()=>{}),A},D=async w=>{let A=await h(),R;try{R=await b()}catch(S){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,S),R={}}let J={...R};for(let[S,te]of Object.entries(w))te===null?delete J[S]:J[S]=te;let le=xe(J,A);await p.updateAccount({config:le})},H={get_dek:h,issue_new_dek:async()=>{let w=await p.getAccount(),A=fe(),R={};if(w.dek){let le=await Y(w.dek,o),S=w.config;S&&Object.keys(S).length>0&&(R=xn(S,le,A))}let J=await ye(A,o);return await p.updateAccount({config:R,dek:J}),g=A,A},...ni(b,O,u)};return n==="oauth_2"&&(H.get_integration_credentials=async()=>{let w=await C();return{...w,client_id:w.client_id||null,client_secret:w.client_secret||null,redirect_url:w.redirect_url??null}}),H}async function ti(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=fe(),i=await ye(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function ri(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let s=fe(),a=await ye(s,r);return await e.db.updateTable("corsair_accounts").set({dek:a,updated_at:new Date}).where("id","=",i.id).execute(),s}var Ua=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function Ie(e){return Ua.has(e)}function Na(e,n){return Ie(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function La(e){return!Ie(e)}function $a(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function Wa(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function ja(e,n){let t=i=>n.find(s=>s.level==="account"&&s.name===i);if(!$a(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function oi(e,n){if(!e)return!1;let t=z(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function qa(e,n){let r=e.authConfig?.[n]?.integration??[];return[...$[n].integration,...r]}function Ka(e,n){let r=e.authConfig?.[n]?.account??[];return[...$[n].account,...r]}function Za(e,n,t){let r=t.filter(a=>a.required&&!a.configured).map(a=>a.name),o=t.filter(a=>a.level==="integration"&&a.required&&!a.configured).map(a=>a.name),i=t.filter(a=>a.level==="account"&&a.required&&a.configured),s;return o.length>0?s="missing_integration":r.length===0?s="ready":i.length>0?s="partial":s="not_started",{plugin:e,authType:n,status:s,connected:ja(n,t),fields:t,missingRequiredFields:r}}async function Ne(e,n,t){let r=I(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,s=i?.[r]?.integration??[],a=i?.[r]?.account??[],u=U({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:s}),l=B({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:a}),c=qa(n,r),d=Ka(n,r),p=[];for(let g of c)p.push({name:g,level:"integration",required:Na(r,g),configured:await oi(u,g)});for(let g of d)p.push({name:g,level:"account",required:La(g),configured:await oi(l,g)});if(Wa(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return Za(n.id,r,p)}async function In(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let s of e.plugins){if(o&&!o.has(s.id))continue;let a=await Ne(e,s,r);a&&i.push(a)}return i}function et(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var ii=Symbol.for("corsair:internal"),si=new WeakMap,ai=new WeakMap;function Ga(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function za(e){if(e.database){let t=si.get(e.database);return t||(t=new Map,si.set(e.database,t)),t}let n=ai.get(e);return n||(n=new Map,ai.set(e,n)),n}function Ja(e){return e.multiTenancy?{withTenant:()=>({}),[ii]:e}:{[ii]:e}}async function Xe(e,n){if(!e.database)return;let t=n.trim()||"default",r=za(e),o=Ga(t,e.plugins),i=r.get(o);if(i){await i;return}let s=(async()=>{let{setupCorsair:a}=await import("./setup-A24JSJDG.js");await a(Ja(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,s),await s}import*as Sn from"crypto";function Se(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function cr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function en(e,n){let t=Sn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var lr=600*1e3;function nt(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Sn.createHmac("sha256",n).update(r).digest("base64url"),s=Buffer.from(o,"base64url"),a=Buffer.from(i,"base64url");return s.length!==a.length||!Sn.timingSafeEqual(s,a)?null:cr(r,{maxAgeMs:lr})}function ui(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function ci(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function nn(e,n){await x({hub:e,path:"/connections/report",body:ui(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function Va(e,n){try{let t=F(e);x({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof ge)return}}async function Ya(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!I(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ne(n,e.plugin,r);o&&di(e.hub,ci({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function li(e,n){Va(e,n)}function di(e,n){x({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function tn(e){Ya(e).catch(()=>{})}async function he(e,n){let t=v(e);if(!I(n.plugin))return;let o=await Ne(t,n.plugin,n.tenantId);o&&li(e,ci({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function tt(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var pi=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function Qa(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function Xa(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await Y(n.dek,e.kek),r=pi(n.config),o={};Object.keys(r).length>0&&(o=me(r,t)),o[e.link.linkType]=e.link.externalId;let i=xe(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function rn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:s,extraAccountFields:a=[]}=e,{accountId:u}=await Qa({database:n,pluginId:r,tenantId:o}),l=!1;if(s){let c=B({authType:s,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:a}),d=`set_${i.linkType}`,p=c[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await Xa({database:n,kek:t,accountId:u,link:i})}async function dr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,s=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let a of s)if(a.dek)try{let u=await Y(a.dek,t),c=pi(a.config)[o];if(!c)continue;if(Rn(c,u)===i)return a}catch{continue}return null}async function rt(e){return(await dr(e))?.tenant_id??null}async function gi(e){return rt({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as fi from"querystring";function Le(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${fi.stringify(i)}`}async function yi(e,n){try{return await W({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function on(e,n,t,r){if(!n.subscribe)return;let o=F(e),i=await yi(o,n.id);if(!i)return;let s=await n.subscribe({keys:r},{webhookUrl:i});s&&await he(e,{plugin:n,tenantId:t,verified:!0,webhookLink:s.webhookLink,webhookSecret:s.webhookSecret})}var q=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function mi(e){let n=e.oauthConfig;if(!n)throw new q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function eu(e,n,t,r){let o=Fo(e),i=await o.integrations.findByName(n);if(!i)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.accounts.findOne({tenant_id:t,integration_id:i.id}))return;let a=fe(),u=await ye(a,r);await o.accounts.create({tenant_id:t,integration_id:i.id,config:{},dek:u})}async function pr(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,s=v(e,()=>new q("invalid_corsair_instance","Invalid corsair instance"));if(!s.database)throw new Error("No database configured on corsair instance");let a=j(s,n,p=>new q("plugin_not_found",p)),u=mi(a),c=await U({authType:"oauth_2",integrationName:n,kek:s.kek,database:s.database}).get_client_id();if(!c)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Le({oauthConfig:u,clientId:c,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=en(Se(n,r),s.kek);return{url:Le({oauthConfig:u,clientId:c,redirectUri:o,state:d}),state:d}}function nu(e,n){return{...n??{},...e}}async function _n(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new q("invalid_corsair_instance","Invalid corsair instance")),s,a;if(n.trusted){if(!n.plugin||!n.tenantId)throw new q("invalid_state","trusted callback requires plugin and tenantId");s=n.plugin,a=n.tenantId}else{let h=nt(r,i.kek);if(!h)throw new q("invalid_state","Invalid or tampered state parameter");s=h.plugin,a=h.tenantId}if(!i.database)throw new q("no_database","No database configured on corsair instance");let u=j(i,s,h=>new q("plugin_not_found",h)),l=mi(u),c=U({authType:"oauth_2",integrationName:s,kek:i.kek,database:i.database}),d=await c.get_client_id(),p=await c.get_client_secret();if(!d||!p)throw new q("credentials_not_configured",`Credentials not configured for '${s}'`);await eu(i.database,s,a,i.kek);let g=await ot(t,d,p,l,o);if(!g.access_token)throw new q("no_access_token",`No access_token returned from ${l.providerName}`);let f=B({authType:"oauth_2",integrationName:s,tenantId:a,kek:i.kek,database:i.database,extraAccountFields:[...u.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await he(e,{plugin:u,tenantId:a}).catch(()=>{});try{let h=nu(g,n.callbackParams),k=await tt(i.plugins,s,h);if(k){try{let b=u.authConfig?.oauth_2?.account??[];await rn({database:i.database,kek:i.kek,pluginId:s,tenantId:a,link:k,authType:"oauth_2",extraAccountFields:b})}catch(b){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${a}':`,b)}i.hub&&nn(i.hub,{plugin:s,tenantId:a,link:k,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${a}':`,h)}if(u.subscribe)try{await on(e,u,a,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${s}' tenant '${a}':`,h)}return{plugin:s,tenantId:a}}async function tu(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??on,i=[],s=[];if(!t.database)return{renewed:i,failed:s};for(let a of r){let u=t.plugins.find(c=>c.id===a.integrationName);if(!u?.subscribe)continue;let l=`${u.id}/${a.tenantId}`;try{let c=I(u)??"oauth_2",d=B({authType:c,integrationName:u.id,tenantId:a.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...u.authConfig?.[c]?.account??[]]}),p=u.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:c,keys:g,hub:t.hub},"endpoint")}await o(n,u,a.tenantId,d),i.push(l)}catch(c){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,c),s.push(l)}}return{renewed:i,failed:s}}async function hi(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return tu({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function ru(e,n={}){let t=!1,r=()=>{t||(t=!0,hi(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function bi(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await it(e,{silent:!0})}async function sn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await Xe(t,n)}var ou=Symbol.for("corsair:internal"),iu=new Set(["access_token","refresh_token","expires_at","scope"]);function su(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function au(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!Ie(t)&&!iu.has(t)):n.filter(t=>!Ie(t))}function ki(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function uu(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function cu(e){return{[ou]:ki(e)}}async function st(e,n,t={}){let r=Vn(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,s=ki(e),a=cu(e);for(let u of e.plugins){if(i&&!i.has(u.id))continue;let l=I(u);if(!l)continue;let c=su(l),d=t.providerNameOverrides?.[u.id]??Pe(u.id),p=await Ne(s,u,n),g=$n(u,l),f=au(l,g),h={plugin:u.id,providerName:d,authKind:c,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),c==="oauth"){let b=t.oauthModeOverrides?.[u.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=b,!t.skipOAuthUrlGeneration&&b!=="managed")try{let C=await pr(a,u.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=C.url}catch(C){C instanceof Error&&/client_id not configured/i.test(C.message)||(h.setupError=C instanceof Error?C.message:`Could not prepare OAuth for ${u.id}`)}}o.push(h)}return o}async function Vp(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return st({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function wi(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await Xe(e.internalConfig??uu(e),n)}async function Ci(e,n){await sn(e,n)}async function vi(e,n){let t=Qe(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=ve({deliveryUrl:n.deliveryUrl})),x({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:jn})}async function Ti(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await wi(t,n.tenantId);let r=await st(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return vi(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function at(e,n){let t=v(e),r=F(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Ci(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,s=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,u=await st(o,n.tenantId,{pluginIds:i,oauthModeOverrides:s,providerNameOverrides:a});if(u.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return vi(r,{tenantId:n.tenantId,plugins:u,deliveryUrl:n.deliveryUrl})}async function ut(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(s=>s.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await lu(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function lu(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-7BUMMXZE.js"),{postHubConnectSession:i}=await import("./connect-JGLG3RUJ.js"),s={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(s,t.tenantId);let a=await r(s,t.tenantId,{pluginIds:t.pluginIds});if(a.length===0)throw new Error("No connectable plugins found for this tenant");let u=a.find(l=>l.setupError);if(u)throw new Error(u.setupError??`Could not prepare connect link for ${u.plugin}`);return i(e,{tenantId:t.tenantId,plugins:a})}function an(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var Q=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function du(e){let n=e.oauthConfig;if(!n)throw new Q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function gr(e,n){let t=v(e,()=>new Q("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new Q("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new Q("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=nt(n,t.kek);if(!o)throw new Q("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:s}=o,a=j(t,i,p=>new Q("plugin_not_found",p)),u=du(a),c=await U({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!c)throw new Q("client_id_not_configured",`client_id not configured for '${i}'`);let d=Le({oauthConfig:u,clientId:c,redirectUri:r,state:n});return{plugin:i,tenantId:s,providerName:u.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as gu}from"async_hooks";import{randomBytes as fu}from"crypto";import{v4 as yu}from"uuid";async function ct(e,n){let t=Qe(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=ve({deliveryUrl:n.deliveryUrl})),x({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Kn})}function lt(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var fr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function mr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Pi(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function yr(e){return lt(e)}async function hr(e,n){if(mr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Pi(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await ct(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:pu(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function pu(e){try{return JSON.parse(e)}catch{return e}}async function dt(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await hr(e,n);return{...n,approvalUrl:r}}async function br(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:s,endpoint:a,args:u,tenantId:l,expiresAt:c,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:s,endpoint:a,args:u});let g=await hr({manual:t,hub:r},{id:o,token:i,plugin:s,endpoint:a,args:JSON.stringify(u),tenant_id:l,expires_at:c});return mr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):yr(g):fr:r?g?yr(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:fr}var un=class extends Error{constructor(n){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError"}};var Ri=new gu,pt=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function kr(e){return Ri.run(!0,e)}function xi(){return Ri.getStore()===!0}function wr(e,n){if(xi()&&n!=="read")throw new pt(e,n)}var mu={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function hu(e,n,t){return t!==void 0?t:mu[n][e]}function Cr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Ii(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Ai(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Si(e){let n=hu(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+</script></body></html>`}var xa=new Set(["localhost","127.0.0.1","[::1]","::1"]);function rr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:xa.has(n)}catch{return!1}}function Cn(e){return e==="development"?"browser":"server"}function Zo(e){return Cn(e)==="browser"}function Go(e){return rr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Ea}from"crypto";var Ae=60*1e3,Be=300*1e3;import{createHmac as Ia,randomBytes as Sa,timingSafeEqual as _a}from"crypto";function pe(){return Sa(16).toString("base64url")}function vn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Ia("sha256",t).update(e).digest("base64url")}function se(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let s=vn(o,t);try{if(!_a(Buffer.from(i,"utf8"),Buffer.from(s,"utf8")))return null}catch{return null}let a;try{a=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return a.exp*1e3<Date.now()?null:a}function zn(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),s=vn(i,n);return`${i}.${s}`}function Tn(e,n,t){let r=Math.floor(Date.now()/1e3);return zn(e,n,r+Math.floor(t/1e3))}function Fe(e){return decodeURIComponent(e)}function or(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function zo(e){let n=e.trim();return n.length>0?n:null}function Ve(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function Ye(e,n){if(!zo(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Ea(16).toString("base64url"),iat:t,exp:t+Math.floor(Ae/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=vn(o,n);return`${o}.${i}`}function Re(e,n){return zo(n)?se(e,n):null}function Oa(e){let n=tr(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function ir(e){let n=Ye(Oa(e),e.signingSecret);return Ve(e.deliveryUrl,n)}function Jo(e){if(Cn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Da(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:ir(r)}}var Pn="https://auth.corsair.dev";var ge=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},An=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function sr(e){let n=(e.apiUrl?.trim()||Pn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"";if(!t||!r)throw new An;return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function Jn(e){return sr(e)}function Ma(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function F(e){let n=v(e).hub;if(!n||!Ma(n))throw new ge;return n}function Vo(e){return e.replace(/\/$/,"")}function Vn(e){return e.oauthCallbackUrl?Vo(e.oauthCallbackUrl.trim()):`${Vo(e.apiUrl)}/oauth/callback`}function Qe(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}import{createCipheriv as Yo,createDecipheriv as Qo,randomBytes as Yn,scrypt as Ha}from"crypto";import{promisify as Ba}from"util";var Xo=Ba(Ha),Qn="aes-256-gcm",ei=12,Xn=16,Fa=16,Ue=32;function fe(){return Yn(Ue).toString("base64")}async function ye(e,n){let t=Yn(Fa),r=await Xo(n,t,Ue),o=Yn(ei),i=Yo(Qn,r,o,{authTagLength:Xn}),s=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),a.toString("base64"),s.toString("base64")].join(":")}async function Y(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Buffer.from(i,"base64"),c=await Xo(n,s,Ue),d=Qo(Qn,c,a,{authTagLength:Xn});return d.setAuthTag(u),Buffer.concat([d.update(l),d.final()]).toString("utf8")}function ar(e,n){let t=Buffer.from(n,"base64"),r=Yn(ei),o=Yo(Qn,t,r,{authTagLength:Xn}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[r.toString("base64"),s.toString("base64"),i.toString("base64")].join(":")}function Rn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),u=Buffer.from(o,"base64"),l=Qo(Qn,i,s,{authTagLength:Xn});return l.setAuthTag(a),Buffer.concat([l.update(u),l.final()]).toString("utf8")}function xe(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=ar(o,n);return t}function me(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=Rn(o,n);return t}function xn(e,n,t){let r=me(e,n);return xe(r,t)}function ni(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let s=[null,void 0,""].includes(i)?null:i;await n({[o]:s})};return r}var ur=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function U(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,s=[...$[n].integration,...i],a=null,u={kek:r,integrationName:t,getIntegration:async()=>{if(a)return a;let k=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!k)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return a={id:k.id,config:ur(k.config),dek:k.dek??null},a},updateIntegration:async k=>{let b=await u.getIntegration();await o.db.updateTable("corsair_integrations").set({...k.config!==void 0?{config:k.config}:{},...k.dek!==void 0?{dek:k.dek}:{},updated_at:new Date}).where("id","=",b.id).execute(),a=null}},l=null,c=async()=>{if(l)return l;let k=await u.getIntegration();if(!k.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await Y(k.dek,r),l},d=async()=>{let k=await u.getIntegration(),b=await c(),C=k.config;return!C||Object.keys(C).length===0?{}:me(C,b)},p=Promise.resolve(),g=k=>{let b=p.then(()=>f(k));return p=b.catch(()=>{}),b},f=async k=>{let b=await c(),C;try{C=await d()}catch(D){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,D),C={}}let P={...C};for(let[D,H]of Object.entries(k))H===null?delete P[D]:P[D]=H;let O=xe(P,b);await u.updateIntegration({config:O})};return{get_dek:c,issue_new_dek:async()=>{let k=await u.getIntegration(),b=fe(),C={};if(k.dek){let O=await Y(k.dek,r),D=k.config;D&&Object.keys(D).length>0&&(C=xn(D,O,b))}let P=await ye(b,r);return await u.updateIntegration({config:C,dek:P}),l=b,b},...ni(d,g,s)}}function B(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:s=[],ensureProvisioned:a}=e,u=[...$[n].account,...s],l=null,c=null,d=async()=>{if(c)return c;let w=!1;for(;;){let A=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!A){if(!w&&a){w=!0,await a();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return c={id:A.id,config:ur(A.config),dek:A.dek??null},c}},p={kek:o,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(l)return l;let w=!1;for(;;){let A=await d(),R=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",A.id).executeTakeFirst();if(!R){if(!w&&a){w=!0,await a();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return l={id:R.id,config:ur(R.config),dek:R.dek??null},l}},updateAccount:async w=>{let A=await p.getAccount();await i.db.updateTable("corsair_accounts").set({...w.config!==void 0?{config:w.config}:{},...w.dek!==void 0?{dek:w.dek}:{},updated_at:new Date}).where("id","=",A.id).execute(),l=null}},g=null,f=null,h=async()=>{if(g)return g;let w=await p.getAccount();if(!w.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return g=await Y(w.dek,o),g},k=async()=>{if(f)return f;let w=await p.getIntegration();if(!w.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await Y(w.dek,o),f},b=async()=>{let w=await p.getAccount(),A=await h(),R=w.config;return!R||Object.keys(R).length===0?{}:me(R,A)},C=async()=>{let w=await p.getIntegration(),A=await k(),R=w.config;return!R||Object.keys(R).length===0?{}:me(R,A)},P=Promise.resolve(),O=w=>{let A=P.then(()=>D(w));return P=A.catch(()=>{}),A},D=async w=>{let A=await h(),R;try{R=await b()}catch(S){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,S),R={}}let J={...R};for(let[S,te]of Object.entries(w))te===null?delete J[S]:J[S]=te;let le=xe(J,A);await p.updateAccount({config:le})},H={get_dek:h,issue_new_dek:async()=>{let w=await p.getAccount(),A=fe(),R={};if(w.dek){let le=await Y(w.dek,o),S=w.config;S&&Object.keys(S).length>0&&(R=xn(S,le,A))}let J=await ye(A,o);return await p.updateAccount({config:R,dek:J}),g=A,A},...ni(b,O,u)};return n==="oauth_2"&&(H.get_integration_credentials=async()=>{let w=await C();return{...w,client_id:w.client_id||null,client_secret:w.client_secret||null,redirect_url:w.redirect_url??null}}),H}async function ti(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=fe(),i=await ye(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function ri(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let s=fe(),a=await ye(s,r);return await e.db.updateTable("corsair_accounts").set({dek:a,updated_at:new Date}).where("id","=",i.id).execute(),s}var Ua=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function Ie(e){return Ua.has(e)}function Na(e,n){return Ie(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function La(e){return!Ie(e)}function $a(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function Wa(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function ja(e,n){let t=i=>n.find(s=>s.level==="account"&&s.name===i);if(!$a(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function oi(e,n){if(!e)return!1;let t=z(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function qa(e,n){let r=e.authConfig?.[n]?.integration??[];return[...$[n].integration,...r]}function Ka(e,n){let r=e.authConfig?.[n]?.account??[];return[...$[n].account,...r]}function Za(e,n,t){let r=t.filter(a=>a.required&&!a.configured).map(a=>a.name),o=t.filter(a=>a.level==="integration"&&a.required&&!a.configured).map(a=>a.name),i=t.filter(a=>a.level==="account"&&a.required&&a.configured),s;return o.length>0?s="missing_integration":r.length===0?s="ready":i.length>0?s="partial":s="not_started",{plugin:e,authType:n,status:s,connected:ja(n,t),fields:t,missingRequiredFields:r}}async function Ne(e,n,t){let r=I(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,s=i?.[r]?.integration??[],a=i?.[r]?.account??[],u=U({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:s}),l=B({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:a}),c=qa(n,r),d=Ka(n,r),p=[];for(let g of c)p.push({name:g,level:"integration",required:Na(r,g),configured:await oi(u,g)});for(let g of d)p.push({name:g,level:"account",required:La(g),configured:await oi(l,g)});if(Wa(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return Za(n.id,r,p)}async function In(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let s of e.plugins){if(o&&!o.has(s.id))continue;let a=await Ne(e,s,r);a&&i.push(a)}return i}function et(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var ii=Symbol.for("corsair:internal"),si=new WeakMap,ai=new WeakMap;function Ga(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function za(e){if(e.database){let t=si.get(e.database);return t||(t=new Map,si.set(e.database,t)),t}let n=ai.get(e);return n||(n=new Map,ai.set(e,n)),n}function Ja(e){return e.multiTenancy?{withTenant:()=>({}),[ii]:e}:{[ii]:e}}async function Xe(e,n){if(!e.database)return;let t=n.trim()||"default",r=za(e),o=Ga(t,e.plugins),i=r.get(o);if(i){await i;return}let s=(async()=>{let{setupCorsair:a}=await import("./setup-5MYOZL7R.js");await a(Ja(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,s),await s}import*as Sn from"crypto";function Se(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function cr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function en(e,n){let t=Sn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var lr=600*1e3;function nt(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Sn.createHmac("sha256",n).update(r).digest("base64url"),s=Buffer.from(o,"base64url"),a=Buffer.from(i,"base64url");return s.length!==a.length||!Sn.timingSafeEqual(s,a)?null:cr(r,{maxAgeMs:lr})}function ui(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function ci(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function nn(e,n){await x({hub:e,path:"/connections/report",body:ui(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function Va(e,n){try{let t=F(e);x({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof ge)return}}async function Ya(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!I(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ne(n,e.plugin,r);o&&di(e.hub,ci({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function li(e,n){Va(e,n)}function di(e,n){x({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function tn(e){Ya(e).catch(()=>{})}async function he(e,n){let t=v(e);if(!I(n.plugin))return;let o=await Ne(t,n.plugin,n.tenantId);o&&li(e,ci({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function tt(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var pi=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function Qa(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function Xa(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await Y(n.dek,e.kek),r=pi(n.config),o={};Object.keys(r).length>0&&(o=me(r,t)),o[e.link.linkType]=e.link.externalId;let i=xe(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function rn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:s,extraAccountFields:a=[]}=e,{accountId:u}=await Qa({database:n,pluginId:r,tenantId:o}),l=!1;if(s){let c=B({authType:s,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:a}),d=`set_${i.linkType}`,p=c[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await Xa({database:n,kek:t,accountId:u,link:i})}async function dr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,s=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let a of s)if(a.dek)try{let u=await Y(a.dek,t),c=pi(a.config)[o];if(!c)continue;if(Rn(c,u)===i)return a}catch{continue}return null}async function rt(e){return(await dr(e))?.tenant_id??null}async function gi(e){return rt({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as fi from"querystring";function Le(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${fi.stringify(i)}`}async function yi(e,n){try{return await W({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function on(e,n,t,r){if(!n.subscribe)return;let o=F(e),i=await yi(o,n.id);if(!i)return;let s=await n.subscribe({keys:r},{webhookUrl:i});s&&await he(e,{plugin:n,tenantId:t,verified:!0,webhookLink:s.webhookLink,webhookSecret:s.webhookSecret})}var q=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function mi(e){let n=e.oauthConfig;if(!n)throw new q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function eu(e,n,t,r){let o=Fo(e),i=await o.integrations.findByName(n);if(!i)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.accounts.findOne({tenant_id:t,integration_id:i.id}))return;let a=fe(),u=await ye(a,r);await o.accounts.create({tenant_id:t,integration_id:i.id,config:{},dek:u})}async function pr(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,s=v(e,()=>new q("invalid_corsair_instance","Invalid corsair instance"));if(!s.database)throw new Error("No database configured on corsair instance");let a=j(s,n,p=>new q("plugin_not_found",p)),u=mi(a),c=await U({authType:"oauth_2",integrationName:n,kek:s.kek,database:s.database}).get_client_id();if(!c)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Le({oauthConfig:u,clientId:c,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=en(Se(n,r),s.kek);return{url:Le({oauthConfig:u,clientId:c,redirectUri:o,state:d}),state:d}}function nu(e,n){return{...n??{},...e}}async function _n(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new q("invalid_corsair_instance","Invalid corsair instance")),s,a;if(n.trusted){if(!n.plugin||!n.tenantId)throw new q("invalid_state","trusted callback requires plugin and tenantId");s=n.plugin,a=n.tenantId}else{let h=nt(r,i.kek);if(!h)throw new q("invalid_state","Invalid or tampered state parameter");s=h.plugin,a=h.tenantId}if(!i.database)throw new q("no_database","No database configured on corsair instance");let u=j(i,s,h=>new q("plugin_not_found",h)),l=mi(u),c=U({authType:"oauth_2",integrationName:s,kek:i.kek,database:i.database}),d=await c.get_client_id(),p=await c.get_client_secret();if(!d||!p)throw new q("credentials_not_configured",`Credentials not configured for '${s}'`);await eu(i.database,s,a,i.kek);let g=await ot(t,d,p,l,o);if(!g.access_token)throw new q("no_access_token",`No access_token returned from ${l.providerName}`);let f=B({authType:"oauth_2",integrationName:s,tenantId:a,kek:i.kek,database:i.database,extraAccountFields:[...u.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await he(e,{plugin:u,tenantId:a}).catch(()=>{});try{let h=nu(g,n.callbackParams),k=await tt(i.plugins,s,h);if(k){try{let b=u.authConfig?.oauth_2?.account??[];await rn({database:i.database,kek:i.kek,pluginId:s,tenantId:a,link:k,authType:"oauth_2",extraAccountFields:b})}catch(b){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${a}':`,b)}i.hub&&nn(i.hub,{plugin:s,tenantId:a,link:k,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${a}':`,h)}if(u.subscribe)try{await on(e,u,a,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${s}' tenant '${a}':`,h)}return{plugin:s,tenantId:a}}async function tu(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??on,i=[],s=[];if(!t.database)return{renewed:i,failed:s};for(let a of r){let u=t.plugins.find(c=>c.id===a.integrationName);if(!u?.subscribe)continue;let l=`${u.id}/${a.tenantId}`;try{let c=I(u)??"oauth_2",d=B({authType:c,integrationName:u.id,tenantId:a.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...u.authConfig?.[c]?.account??[]]}),p=u.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:c,keys:g,hub:t.hub},"endpoint")}await o(n,u,a.tenantId,d),i.push(l)}catch(c){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,c),s.push(l)}}return{renewed:i,failed:s}}async function hi(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return tu({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function ru(e,n={}){let t=!1,r=()=>{t||(t=!0,hi(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function bi(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await it(e,{silent:!0})}async function sn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await Xe(t,n)}var ou=Symbol.for("corsair:internal"),iu=new Set(["access_token","refresh_token","expires_at","scope"]);function su(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function au(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!Ie(t)&&!iu.has(t)):n.filter(t=>!Ie(t))}function ki(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function uu(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function cu(e){return{[ou]:ki(e)}}async function st(e,n,t={}){let r=Vn(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,s=ki(e),a=cu(e);for(let u of e.plugins){if(i&&!i.has(u.id))continue;let l=I(u);if(!l)continue;let c=su(l),d=t.providerNameOverrides?.[u.id]??Pe(u.id),p=await Ne(s,u,n),g=$n(u,l),f=au(l,g),h={plugin:u.id,providerName:d,authKind:c,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),c==="oauth"){let b=t.oauthModeOverrides?.[u.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=b,!t.skipOAuthUrlGeneration&&b!=="managed")try{let C=await pr(a,u.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=C.url}catch(C){C instanceof Error&&/client_id not configured/i.test(C.message)||(h.setupError=C instanceof Error?C.message:`Could not prepare OAuth for ${u.id}`)}}o.push(h)}return o}async function Vp(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return st({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function wi(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await Xe(e.internalConfig??uu(e),n)}async function Ci(e,n){await sn(e,n)}async function vi(e,n){let t=Qe(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=ve({deliveryUrl:n.deliveryUrl})),x({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:jn})}async function Ti(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await wi(t,n.tenantId);let r=await st(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return vi(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function at(e,n){let t=v(e),r=F(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Ci(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,s=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,u=await st(o,n.tenantId,{pluginIds:i,oauthModeOverrides:s,providerNameOverrides:a});if(u.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return vi(r,{tenantId:n.tenantId,plugins:u,deliveryUrl:n.deliveryUrl})}async function ut(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(s=>s.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await lu(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function lu(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-XDS2OMYE.js"),{postHubConnectSession:i}=await import("./connect-OKR2XQF6.js"),s={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(s,t.tenantId);let a=await r(s,t.tenantId,{pluginIds:t.pluginIds});if(a.length===0)throw new Error("No connectable plugins found for this tenant");let u=a.find(l=>l.setupError);if(u)throw new Error(u.setupError??`Could not prepare connect link for ${u.plugin}`);return i(e,{tenantId:t.tenantId,plugins:a})}function an(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var Q=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function du(e){let n=e.oauthConfig;if(!n)throw new Q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function gr(e,n){let t=v(e,()=>new Q("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new Q("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new Q("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=nt(n,t.kek);if(!o)throw new Q("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:s}=o,a=j(t,i,p=>new Q("plugin_not_found",p)),u=du(a),c=await U({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!c)throw new Q("client_id_not_configured",`client_id not configured for '${i}'`);let d=Le({oauthConfig:u,clientId:c,redirectUri:r,state:n});return{plugin:i,tenantId:s,providerName:u.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as gu}from"async_hooks";import{randomBytes as fu}from"crypto";import{v4 as yu}from"uuid";async function ct(e,n){let t=Qe(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=ve({deliveryUrl:n.deliveryUrl})),x({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Kn})}function lt(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var fr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function mr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Pi(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function yr(e){return lt(e)}async function hr(e,n){if(mr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Pi(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await ct(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:pu(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function pu(e){try{return JSON.parse(e)}catch{return e}}async function dt(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await hr(e,n);return{...n,approvalUrl:r}}async function br(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:s,endpoint:a,args:u,tenantId:l,expiresAt:c,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:s,endpoint:a,args:u});let g=await hr({manual:t,hub:r},{id:o,token:i,plugin:s,endpoint:a,args:JSON.stringify(u),tenant_id:l,expires_at:c});return mr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):yr(g):fr:r?g?yr(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:fr}var un=class extends Error{constructor(n){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError"}};var Ri=new gu,pt=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function kr(e){return Ri.run(!0,e)}function xi(){return Ri.getStore()===!0}function wr(e,n){if(xi()&&n!=="read")throw new pt(e,n)}var mu={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function hu(e,n,t){return t!==void 0?t:mu[n][e]}function Cr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Ii(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Ai(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Si(e){let n=hu(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
   Action: ${r}`,`
   To allow this, update the permission mode or add an override in your corsair config.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),s=e.tenantId??"default",a=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",s).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(a){if(a.status==="approved"){let f=e.db,h=a.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return a.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
   Action: ${r}`,`
@@ -59,7 +59,7 @@ ${aa(o,d)}`),h.join(`
 `)}}}return ho(Ge(e),"Path not found. Available operations")}function na(e){let n=e;for(;;){let t=ee(n),r=ne(t);if(Co(r)){let o=X(t);if(!o)return n;n=o;continue}return n}}function bn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=na(e),t=ee(n);if(ne(t)==="ZodObject"){let o=jt(n,t),i=[];for(let[s,a]of Object.entries(o)){let u=ee(a),l=ne(u),c=l==="ZodOptional"||l==="ZodNullable",d=na(a),p=Yc(a);i.push({key:s,optional:c,type:G(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:G(n)}}function Wt(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=ea.repeat(n+1),r=ea.repeat(n);return`{
 ${e.fields.map(i=>{let s=i.optional?`${i.key}?`:i.key,a=i.description?`  // ${i.description}`:"";return`${t}${s}: ${i.type}${a}`}).join(`
 `)}
-${r}}`}return"unknown"}function rl(e,n){let t=Ge(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(c=>c.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let c of t){let{shortPath:d,lookupKey:p}=tl(c,n),g=Oe(r.endpointMeta,p),f=Oe(r.endpointSchemas,p);!g&&!f||o.push({path:c,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:bn(f?.input),output:bn(f?.output)})}o.sort((c,d)=>c.path.localeCompare(d.path));let i=[],s=Ge(e,{plugin:n,type:"webhooks"});if(Array.isArray(s)&&r.webhooks)for(let c of s){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=Po(r.webhooks,f.split("."));if(h===null)continue;let k=h.join("."),b=Oe(r.webhookSchemas,k.toLowerCase()),C=b?.response?G(b.response):void 0;i.push({path:c,description:b?.description,payload:bn(b?.payload),responseType:C,usageExample:aa(n,h)})}i.sort((c,d)=>c.path.localeCompare(d.path));let a=[],u=Ge(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(u)&&l)for(let c of u){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let k=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let C=sa(l,k);if(!C)continue;let[P,O]=C,D=To(O),H=Object.entries(D).map(([w,A])=>({field:w,type:A.type,operators:A.operators}));a.push({path:c,entityName:P,filters:[{field:"entity_id",type:"string",operators:vo},...H]})}return a.sort((c,d)=>c.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:a}}}import{randomUUID as ua}from"crypto";async function ol(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=ua(),o=ua(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as il}from"crypto";var qt="https://graph.microsoft.com/v1.0",Ao=2e4,sl=60;async function al(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let u=await fetch(`${qt}/subscriptions`,{headers:r,signal:AbortSignal.timeout(Ao)});if(u.ok){let{value:l}=await u.json(),c=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(c.map(d=>fetch(`${qt}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(Ao)}).catch(()=>{})))}}catch{}let o=il(),i=new Date(Date.now()+sl*6e4).toISOString(),s=await fetch(`${qt}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(Ao),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!s.ok)throw new Error(`MS Graph subscribe failed (${s.status}): ${await s.text()}`);let a=await s.json();return a.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:a.id},webhookSecret:o}):null}function ca(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function ul(e,n){let t=ca(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function cl(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function la(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function da(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function Ln(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function ll(e){return Ln(e.body)}function pa(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Kt(Array.isArray(r)?r:[r])}function ga(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let u of t){let l=Kt(Array.isArray(u)?u:[u]);if(l)return decodeURIComponent(l)}let r=pa({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let u of o){let l=n[u],c=Array.isArray(l)?l[0]:l;if(!(!c||typeof c!="string"))try{let p=(c.startsWith("http")?new URL(c):new URL(`https://example.invalid${c.startsWith("/")?c:`/${c}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,s=Ln(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Kt([s?.validationToken])??null}function dl(e){if(ga(e))return!0;let n=Ln(e.body??e.payload);return la(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Kt(e){for(let n of e){let t=da(n);if(t)return t}}function pl(e){let t=Ln(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var Nn=Symbol.for("corsair:internal");function ma(e){let n=e.database?So(e.database):void 0,t=e.kek,r=n&&t?Es(e.plugins,n,t):Ft(!!n,!!t),o=Ds(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?Jn(e.hub):void 0},s=Ii(n),a=Gs(i);if(e.multiTenancy){let c=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=mo(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[Nn]:i})},keys:r,permissions:s,manage:a},{[Nn]:i});return fa(c,i.hub),ya(c,i.hub),c}let u=mo(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},u,{keys:r,permissions:s,manage:a,[Nn]:i});return fa(l,i.hub),ya(l,i.hub),l}function fa(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-HFBZMTU5.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function gl(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var Zt=globalThis.__corsairTunnels??=new Set;function ya(e,n){if(!gl(n))return;let t=n.projectApiKey;if(Zt.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}Zt.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Jt;import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:()=>Zt.delete(t)})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Vt}`)}).catch(s=>{Zt.delete(t),console.warn(`[corsair] tunnel failed to start: ${s instanceof Error?s.message:String(s)}. Run \`corsair setup\` to enable your dev tunnel.`)})}var fl={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Ro=fl;async function it(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},s=n?.caller??"script",a=Eo(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let u=Rl(e,a.plugins,n),l={...a,database:a.database},c=l.database.db;await Sl(c,i);let d=await _l(c,l,u.tenantId,u.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Ol(e,u,n.credentials,l,o,i);let p=await Hl(d,u,o,s);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=ma({plugins:a.plugins,database:c,kek:a.kek,multiTenancy:!0}).withTenant(u.tenantId);await Bl(g,a.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+${r}}`}return"unknown"}function rl(e,n){let t=Ge(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(c=>c.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let c of t){let{shortPath:d,lookupKey:p}=tl(c,n),g=Oe(r.endpointMeta,p),f=Oe(r.endpointSchemas,p);!g&&!f||o.push({path:c,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:bn(f?.input),output:bn(f?.output)})}o.sort((c,d)=>c.path.localeCompare(d.path));let i=[],s=Ge(e,{plugin:n,type:"webhooks"});if(Array.isArray(s)&&r.webhooks)for(let c of s){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=Po(r.webhooks,f.split("."));if(h===null)continue;let k=h.join("."),b=Oe(r.webhookSchemas,k.toLowerCase()),C=b?.response?G(b.response):void 0;i.push({path:c,description:b?.description,payload:bn(b?.payload),responseType:C,usageExample:aa(n,h)})}i.sort((c,d)=>c.path.localeCompare(d.path));let a=[],u=Ge(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(u)&&l)for(let c of u){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let k=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let C=sa(l,k);if(!C)continue;let[P,O]=C,D=To(O),H=Object.entries(D).map(([w,A])=>({field:w,type:A.type,operators:A.operators}));a.push({path:c,entityName:P,filters:[{field:"entity_id",type:"string",operators:vo},...H]})}return a.sort((c,d)=>c.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:a}}}import{randomUUID as ua}from"crypto";async function ol(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=ua(),o=ua(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as il}from"crypto";var qt="https://graph.microsoft.com/v1.0",Ao=2e4,sl=60;async function al(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let u=await fetch(`${qt}/subscriptions`,{headers:r,signal:AbortSignal.timeout(Ao)});if(u.ok){let{value:l}=await u.json(),c=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(c.map(d=>fetch(`${qt}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(Ao)}).catch(()=>{})))}}catch{}let o=il(),i=new Date(Date.now()+sl*6e4).toISOString(),s=await fetch(`${qt}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(Ao),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!s.ok)throw new Error(`MS Graph subscribe failed (${s.status}): ${await s.text()}`);let a=await s.json();return a.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:a.id},webhookSecret:o}):null}function ca(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function ul(e,n){let t=ca(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function cl(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function la(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function da(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function Ln(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function ll(e){return Ln(e.body)}function pa(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Kt(Array.isArray(r)?r:[r])}function ga(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let u of t){let l=Kt(Array.isArray(u)?u:[u]);if(l)return decodeURIComponent(l)}let r=pa({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let u of o){let l=n[u],c=Array.isArray(l)?l[0]:l;if(!(!c||typeof c!="string"))try{let p=(c.startsWith("http")?new URL(c):new URL(`https://example.invalid${c.startsWith("/")?c:`/${c}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,s=Ln(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Kt([s?.validationToken])??null}function dl(e){if(ga(e))return!0;let n=Ln(e.body??e.payload);return la(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Kt(e){for(let n of e){let t=da(n);if(t)return t}}function pl(e){let t=Ln(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var Nn=Symbol.for("corsair:internal");function ma(e){let n=e.database?So(e.database):void 0,t=e.kek,r=n&&t?Es(e.plugins,n,t):Ft(!!n,!!t),o=Ds(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?Jn(e.hub):void 0},s=Ii(n),a=Gs(i);if(e.multiTenancy){let c=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=mo(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[Nn]:i})},keys:r,permissions:s,manage:a},{[Nn]:i});return fa(c,i.hub),ya(c,i.hub),c}let u=mo(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},u,{keys:r,permissions:s,manage:a,[Nn]:i});return fa(l,i.hub),ya(l,i.hub),l}function fa(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-XIM6TBPK.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function gl(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var Zt=globalThis.__corsairTunnels??=new Set;function ya(e,n){if(!gl(n))return;let t=n.projectApiKey;if(Zt.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}Zt.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Jt;import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:()=>Zt.delete(t)})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Vt}`)}).catch(s=>{Zt.delete(t),console.warn(`[corsair] tunnel failed to start: ${s instanceof Error?s.message:String(s)}. Run \`corsair setup\` to enable your dev tunnel.`)})}var fl={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Ro=fl;async function it(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},s=n?.caller??"script",a=Eo(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let u=Rl(e,a.plugins,n),l={...a,database:a.database},c=l.database.db;await Sl(c,i);let d=await _l(c,l,u.tenantId,u.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Ol(e,u,n.credentials,l,o,i);let p=await Hl(d,u,o,s);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=ma({plugins:a.plugins,database:c,kek:a.kek,multiTenancy:!0}).withTenant(u.tenantId);await Bl(g,a.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
 `)}function xo(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...$[n][t],...r])}function Al(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(a=>a.id===t);if(!o)continue;let i=I(o);if(!i)continue;let s=xo(o,i,"account");for(let a of Object.keys(r))if(s.has(a))return!0}return!1}function Rl(e,n,t){let r=Do(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Al(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function ba(e,n){return Te(e)?n===0?!0:Object.values(e).every(t=>ba(t,n-1)):!1}function xl(e){return ba(e,4)}var Il={...Bo,corsair_connects:Ho};function Gt(e){if(e instanceof wl){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Pl?Gt(r):"unknown";return n}return e instanceof bl?`${Gt(e.unwrap())} | null`:e instanceof Cl?`${Gt(e.unwrap())} | undefined`:e instanceof hl?e.options.join(" | "):e instanceof Tl?"string":e instanceof kl?"number":e instanceof yl?"boolean":e instanceof ml?"date":e instanceof vl?"jsonb":"unknown"}async function Sl(e,n){let t=await e.introspection.getTables(),r=new Set(t.map(o=>o.name));for(let[o,i]of Object.entries(Il))r.has(o)||n(`[corsair:setup] Table "${o}" does not exist. Run your database migrations before calling setupCorsair.
 Schema: ${JSON.stringify(Gt(i),null,2)}`)}async function _l(e,n,t,r,o){let i=new Date,s=new Map;for(let a of n.plugins){let u=a.id,l=I(a),c=await e.selectFrom("corsair_integrations").selectAll().where("name","=",u).executeTakeFirst();if(!c){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:u,config:{},created_at:i,updated_at:i}).execute(),c=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${u}`)}let d=l?a.authConfig?.[l]?.integration??[]:[],p=l?a.authConfig?.[l]?.account??[]:[],g=l&&c?U({authType:l,integrationName:u,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(c&&!c.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${u}`)),!c||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",c.id).executeTakeFirst();if(!h){let k=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:k,tenant_id:t,integration_id:c.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",k).executeTakeFirst(),o(`[corsair:setup] Created account: ${u}`)}f=h&&B({authType:l,integrationName:u,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${u}`))}s.set(u,{pluginId:u,authType:l,integration:g,account:f,integrationFields:[...$[l].integration,...d],accountFields:r?[...$[l].account,...p]:[]})}return s}function El(e){if(!Te(e))return;let n=e.keys;return Te(n)?n:void 0}function Dl(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Ol(e,n,t,r,o,i){let s=El(e),a=n.provisionAccounts?Dl(e,n.tenantId):void 0;for(let[u,l]of Object.entries(t)){let c=r.plugins.find(b=>b.id===u);if(!c){i(`[corsair:setup] Unknown plugin '${u}' \u2014 skipping credentials.`);continue}let d=I(c);if(!d){i(`[corsair:setup] Plugin '${u}' has no auth type \u2014 skipping credentials.`);continue}let p=xo(c,d,"integration"),g=xo(c,d,"account"),f=s?.[u],h=a?.[u],k=Te(h)?h.keys:void 0;for(let[b,C]of Object.entries(l))if(C){if(p.has(b)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${u}.${b}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let P=z(f,`set_${b}`);if(!P){i(`[corsair:setup] Cannot set integration field '${b}' for '${u}'.`);continue}await P(C),o(`[corsair:setup] Set ${u} integration.${b}`);continue}if(g.has(b)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${u}.${b}' on a multi-tenant instance`);let P=z(k,`set_${b}`);if(!P){i(`[corsair:setup] Cannot set account field '${b}' for '${u}'.`);continue}await P(C),o(`[corsair:setup] Set ${u} account.${b} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${b}' for plugin '${u}'.`)}}}var ha=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function Ml(e,n,t,r,o,i,s,a,u){let l=[],c=[];for(let p of o){if(ha.has(p))continue;let g=z(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(ha.has(p))continue;let g=z(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||c.push(p)}let d=l.length===0&&c.length===0;if(d)a(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")a(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...c];if(u==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");a(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
   corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of c){let h=s.provisionAccounts?s.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(s.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}a(g.join(`

package/dist/{connect-JGLG3RUJ.js → connect-OKR2XQF6.js}

@@ -1 +1 @@
-import{ga as a,ha as b,ia as c}from"./chunk-H2PWRKH5.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};
+import{ga as a,ha as b,ia as c}from"./chunk-AHWGCIDB.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/core.d.ts

@@ -1,8 +1,8 @@
-export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair, s as shouldStartTunnel } from './index-DsA-vbJF.js';
+export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair, s as shouldStartTunnel } from './index-BLqi-B6k.js';
 import { CorsairDatabase } from './db.js';
-import { A as AuthTypes, f as AccountKeyManagerFor, I as IntegrationKeyManagerFor, H as HubConfig, g as CorsairPluginSubscribeResult } from './index-DGyng7I6.js';
-export { h as AccountFieldNames, n as AgentMessageRole, o as AgentReply, v as AllProviders, l as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, i as BaseKeyManager, w as BaseProviders, a2 as BeforeHookResult, D as BindEndpoints, ap as BindWebhooks, an as Bivariant, E as BoundEndpointFn, F as BoundEndpointTree, aq as BoundWebhook, ar as BoundWebhookTree, p as ChatHandle, q as ChatMessage, r as ChatSummary, s as CorsairChatsNamespace, u as CorsairClient, G as CorsairContext, J as CorsairEndpoint, M as CorsairErrorHandler, c as CorsairIntegration, a3 as CorsairKeyBuilder, a4 as CorsairKeyBuilderBase, as as CorsairOAuthWebhookTenantLinkResolver, X as CorsairPermissionsNamespace, C as CorsairPlugin, a5 as CorsairPluginContext, a6 as CorsairPluginSubscribe, aj as CorsairRunsNamespace, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, at as CorsairWebhook, au as CorsairWebhookHandler, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, aC as CorsairWorkflowsNamespace, t as CreateChatResult, a7 as EndpointHooks, a8 as EndpointMetaEntry, K as EndpointPathsOf, a9 as EndpointRiskLevel, L as EndpointTree, Y as EnforcePermissionOptions, Z as EnforcePermissionResult, N as ErrorContext, Q as ErrorHandler, R as ErrorHandlerAndMatchFunction, S as ErrorMatcher, j as IntegrationFieldNames, aa as KeyBuilderContext, k as OAuth2IntegrationCredentials, O as OAuthConfig, ab as PermissionMode, ac as PermissionPolicy, x as PickAuth, P as PluginAuthConfig, ad as PluginEndpointMeta, ae as PluginPermissionsConfig, z as ProviderDisplayNames, ax as RawWebhookRequest, a0 as ReadonlyForbiddenError, af as RequiredPluginEndpointMeta, ag as RequiredPluginEndpointSchemas, ah as RequiredPluginWebhookSchemas, U as RetryStrategies, V as RetryStrategy, T as TokenResponse, aD as TriggerRunResult, ao as UnionToIntersection, ai as WebhookHooks, ay as WebhookPathsOf, az as WebhookRequest, aA as WebhookResponse, W as WebhookTenantMatch, aB as WebhookTree, ak as WorkflowRun, al as WorkflowRunStatus, am as WorkflowRunStep, aE as WorkflowStatus, aF as WorkflowSummary, _ as assertReadonlyAllowed, m as exchangeCodeForTokens, y as formatProviderDisplayName, $ as isReadonlyScopeActive, a1 as runReadonly } from './index-DGyng7I6.js';
-export { A as AuthMissingError, C as CorsairKekMissingError, D as DocSchemaFieldRow, b as DocSchemaShape, c as DocsApiEndpoint, d as DocsDbEntity, e as DocsDbFilterField, f as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, h as PermissionRequiredError, P as PluginDocsIntrospection, l as PluginWebhookMatchers, R as ReconnectRequiredError, a as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, n as asRecord, j as collectPluginWebhookMatchers, o as decodePubSubData, p as extractMicrosoftGraphValidationToken, q as firstString, g as formatDocSchemaShape, s as getHeader, i as introspectPluginForDocs, t as isMicrosoftGraphValidationHandshake, m as matchWebhookPlugin, k as matchWebhookPluginAndTenant, u as readBodyRecord, v as readQueryParam, r as resolveConnectLink, w as toExternalId } from './tenant-match-utils-DoYyOmnq.js';
+import { A as AuthTypes, f as AccountKeyManagerFor, I as IntegrationKeyManagerFor, H as HubConfig, g as CorsairPluginSubscribeResult } from './index-CadajNjy.js';
+export { h as AccountFieldNames, n as AgentMessageRole, o as AgentReply, v as AllProviders, l as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, i as BaseKeyManager, w as BaseProviders, a2 as BeforeHookResult, D as BindEndpoints, ap as BindWebhooks, an as Bivariant, E as BoundEndpointFn, F as BoundEndpointTree, aq as BoundWebhook, ar as BoundWebhookTree, p as ChatHandle, q as ChatMessage, r as ChatSummary, s as CorsairChatsNamespace, u as CorsairClient, G as CorsairContext, J as CorsairEndpoint, M as CorsairErrorHandler, c as CorsairIntegration, a3 as CorsairKeyBuilder, a4 as CorsairKeyBuilderBase, as as CorsairOAuthWebhookTenantLinkResolver, X as CorsairPermissionsNamespace, C as CorsairPlugin, a5 as CorsairPluginContext, a6 as CorsairPluginSubscribe, aj as CorsairRunsNamespace, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, at as CorsairWebhook, au as CorsairWebhookHandler, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, aC as CorsairWorkflowsNamespace, t as CreateChatResult, a7 as EndpointHooks, a8 as EndpointMetaEntry, K as EndpointPathsOf, a9 as EndpointRiskLevel, L as EndpointTree, Y as EnforcePermissionOptions, Z as EnforcePermissionResult, N as ErrorContext, Q as ErrorHandler, R as ErrorHandlerAndMatchFunction, S as ErrorMatcher, j as IntegrationFieldNames, aa as KeyBuilderContext, k as OAuth2IntegrationCredentials, O as OAuthConfig, ab as PermissionMode, ac as PermissionPolicy, x as PickAuth, P as PluginAuthConfig, ad as PluginEndpointMeta, ae as PluginPermissionsConfig, z as ProviderDisplayNames, ax as RawWebhookRequest, a0 as ReadonlyForbiddenError, af as RequiredPluginEndpointMeta, ag as RequiredPluginEndpointSchemas, ah as RequiredPluginWebhookSchemas, U as RetryStrategies, V as RetryStrategy, T as TokenResponse, aD as TriggerRunResult, ao as UnionToIntersection, ai as WebhookHooks, ay as WebhookPathsOf, az as WebhookRequest, aA as WebhookResponse, W as WebhookTenantMatch, aB as WebhookTree, ak as WorkflowRun, al as WorkflowRunStatus, am as WorkflowRunStep, aE as WorkflowStatus, aF as WorkflowSummary, _ as assertReadonlyAllowed, m as exchangeCodeForTokens, y as formatProviderDisplayName, $ as isReadonlyScopeActive, a1 as runReadonly } from './index-CadajNjy.js';
+export { A as AuthMissingError, C as CorsairKekMissingError, D as DocSchemaFieldRow, b as DocSchemaShape, c as DocsApiEndpoint, d as DocsDbEntity, e as DocsDbFilterField, f as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, h as PermissionRequiredError, P as PluginDocsIntrospection, l as PluginWebhookMatchers, R as ReconnectRequiredError, a as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, n as asRecord, j as collectPluginWebhookMatchers, o as decodePubSubData, p as extractMicrosoftGraphValidationToken, q as firstString, g as formatDocSchemaShape, s as getHeader, i as introspectPluginForDocs, t as isMicrosoftGraphValidationHandshake, m as matchWebhookPlugin, k as matchWebhookPluginAndTenant, u as readBodyRecord, v as readQueryParam, r as resolveConnectLink, w as toExternalId } from './tenant-match-utils-O8u60d72.js';
 import 'kysely';
 import 'zod';
 import 'pg';

package/dist/core.js

@@ -1 +1 @@
-import{$b as L,D as e,E as f,F as g,G as h,H as i,I as j,J as k,K as l,L as m,Lb as y,M as n,Mb as z,N as o,Nb as A,O as p,Ob as B,Sb as C,Tb as D,Ub as E,Vb as F,Wb as G,Xb as H,Yb as I,Zb as J,_b as K,a,ac as M,b,bc as N,c,cc as O,dc as P,eb as w,ec as Q,fc as R,gc as S,hc as T,ic as U,ja as q,jc as V,ma as r,na as s,oa as t,pa as u,qa as v,xb as x}from"./chunk-H2PWRKH5.js";import"./chunk-4OLKWKJG.js";import{h as d}from"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{w as AuthMissingError,d as BASE_AUTH_FIELDS,T as CORSAIR_INTERNAL,x as CorsairKekMissingError,F as MS_GRAPH_API_BASE,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,M as asRecord,v as assertReadonlyAllowed,J as collectPluginWebhookMatchers,n as createAccountKeyManager,U as createCorsair,m as createIntegrationKeyManager,S as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,A as exchangeCodeForTokens,P as extractMicrosoftGraphValidationToken,R as firstString,C as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,K as getHeader,B as getOAuthAccessToken,E as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,D as introspectPluginForDocs,Q as isMicrosoftGraphValidationHandshake,u as isReadonlyScopeActive,y as logEvent,z as logEventFromContext,H as matchWebhookPlugin,I as matchWebhookPluginAndTenant,G as msGraphSubscribe,l as reEncryptConfig,N as readBodyRecord,O as readQueryParam,q as resolveConnectLink,t as runReadonly,V as shouldStartTunnel,L as toExternalId};
+import{$b as L,D as e,E as f,F as g,G as h,H as i,I as j,J as k,K as l,L as m,Lb as y,M as n,Mb as z,N as o,Nb as A,O as p,Ob as B,Sb as C,Tb as D,Ub as E,Vb as F,Wb as G,Xb as H,Yb as I,Zb as J,_b as K,a,ac as M,b,bc as N,c,cc as O,dc as P,eb as w,ec as Q,fc as R,gc as S,hc as T,ic as U,ja as q,jc as V,ma as r,na as s,oa as t,pa as u,qa as v,xb as x}from"./chunk-AHWGCIDB.js";import"./chunk-4OLKWKJG.js";import{h as d}from"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{w as AuthMissingError,d as BASE_AUTH_FIELDS,T as CORSAIR_INTERNAL,x as CorsairKekMissingError,F as MS_GRAPH_API_BASE,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,M as asRecord,v as assertReadonlyAllowed,J as collectPluginWebhookMatchers,n as createAccountKeyManager,U as createCorsair,m as createIntegrationKeyManager,S as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,A as exchangeCodeForTokens,P as extractMicrosoftGraphValidationToken,R as firstString,C as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,K as getHeader,B as getOAuthAccessToken,E as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,D as introspectPluginForDocs,Q as isMicrosoftGraphValidationHandshake,u as isReadonlyScopeActive,y as logEvent,z as logEventFromContext,H as matchWebhookPlugin,I as matchWebhookPluginAndTenant,G as msGraphSubscribe,l as reEncryptConfig,N as readBodyRecord,O as readQueryParam,q as resolveConnectLink,t as runReadonly,V as shouldStartTunnel,L as toExternalId};

package/dist/hub.d.ts

@@ -1,8 +1,8 @@
-import { aV as HubOAuthMode, A as AuthTypes, aW as HubConnectSessionResult, aX as HubPermissionSessionResult, H as HubConfig, aY as HubConfigInput, aZ as HubConnectSessionInput, a_ as HubListProjectConnectionsInput, f as AccountKeyManagerFor, a$ as HubPermissionSessionInput } from './index-DGyng7I6.js';
-export { b0 as DEFAULT_HUB_API_URL, b1 as HubEnvironmentSlug, y as formatProviderDisplayName } from './index-DGyng7I6.js';
-import { k as TunnelType, R as RunResultPayload, P as ProbeResultPayload, g as ProcessCorsairRequest, m as WebhookTenantLink } from './index-D-pBLE_N.js';
-export { n as BROWSER_DELIVERY_TTL_MS, o as BrowserDeliveryMode, B as BrowserDeliveryPayload, S as SIGNED_TUNNEL_REPLAY_WINDOW_MS, j as TunnelEnvelope } from './index-D-pBLE_N.js';
-export { b as buildBrowserDeliveryRedirectUrl, s as signBrowserDeliveryToken, v as verifyBrowserDeliveryToken } from './browser-delivery-Da29aknX.js';
+import { aV as HubOAuthMode, A as AuthTypes, aW as HubConnectSessionResult, aX as HubPermissionSessionResult, H as HubConfig, aY as HubConfigInput, aZ as HubConnectSessionInput, a_ as HubListProjectConnectionsInput, f as AccountKeyManagerFor, a$ as HubPermissionSessionInput } from './index-CadajNjy.js';
+export { b0 as DEFAULT_HUB_API_URL, b1 as HubEnvironmentSlug, y as formatProviderDisplayName } from './index-CadajNjy.js';
+import { k as TunnelType, R as RunResultPayload, P as ProbeResultPayload, g as ProcessCorsairRequest, m as WebhookTenantLink } from './index-Dp27gGG4.js';
+export { n as BROWSER_DELIVERY_TTL_MS, o as BrowserDeliveryMode, B as BrowserDeliveryPayload, S as SIGNED_TUNNEL_REPLAY_WINDOW_MS, j as TunnelEnvelope } from './index-Dp27gGG4.js';
+export { b as buildBrowserDeliveryRedirectUrl, s as signBrowserDeliveryToken, v as verifyBrowserDeliveryToken } from './browser-delivery-BVsj88up.js';
 import 'zod';
 import './db.js';
 import 'kysely';

package/dist/hub.js

@@ -1 +1 @@
-import{$a as _,A as z,Aa as P,B as A,Ba as Q,C as B,Ca as R,Da as S,Ea as T,Fa as U,Ga as V,Ha as W,T as C,Ua as X,Va as Y,_a as Z,ab as $,b as a,bb as aa,cb as ba,d as b,db as ca,e as c,f as d,fb as da,g as e,gb as ea,h as f,hb as fa,i as g,ia as D,ib as ga,j as i,jb as ha,k as j,ka as E,kb as ia,l as k,la as F,lb as ja,m as l,mb as ka,n as m,nb as la,o as n,ob as ma,p as o,pb as na,q as p,qb as oa,r as q,ra as G,rb as pa,s as r,sa as H,sb as qa,t as s,ta as I,tb as ra,u as t,ua as J,ub as sa,v as u,va as K,vb as ta,w as v,wa as L,wb as ua,x as w,xa as M,y as x,ya as N,z as y,za as O}from"./chunk-H2PWRKH5.js";import{a as h,b as va,c as wa,d as xa,e as ya,f as za}from"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{m as BROWSER_DELIVERY_TTL_MS,wa as CORSAIR_TUNNEL_PATH,va as CORSAIR_TUNNEL_ZONE,u as DEFAULT_HUB_API_URL,xa as FRPC_VERSION,w as HubCredentialsMissingError,v as HubNotConfiguredError,V as ManagedOAuthDeliveryError,n as SIGNED_TUNNEL_REPLAY_WINDOW_MS,ea as attachManagedRefreshAuth,p as buildBrowserDeliveryRedirectUrl,s as buildClientBridgeBrowserDeliveryUrl,ga as createConnectSessionJti,la as createConnectTokenJti,D as createHubConnectSession,E as createHubPermissionSession,fa as createHubRouteHandlers,ra as createPermissionSessionJti,o as createSignedTokenJti,ka as decodeConnectSessionTokenFromPath,qa as decodeConnectTokenFromPath,ua as decodePermissionTokenFromPath,Q as deliverConnectCreateLink,U as deliverSignedEnvelope,S as describeDeliveryNetworkError,pa as encodeConnectTokenForPath,O as extractConnectLinkFromDeliveryAck,H as extractProbeFromDeliveryAck,G as extractRunFromDeliveryAck,N as extractSyncFromDeliveryAck,F as formatHubApprovalMessage,a as formatProviderDisplayName,T as formatServerDeliveryError,ya as frpcPlatformKey,ha as getConnectSessionExpiryMs,X as getConnectStatusForTenant,ma as getConnectTokenExpiryMs,z as getHubConfig,da as getManagedAccessToken,Z as handleHubDeliveryGet,_ as handleHubDeliveryPost,aa as handleHubDeliveryRequest,$ as hubDeliveryToResponse,B as inferHubEnvironmentSlug,i as isLoopbackUrl,M as isServerDeliveryAckSuccessful,Y as listHubProjectConnections,x as normalizeHubConfig,P as parseConnectLinkFromDeliveryBody,b as parseConnectSessionResponse,f as parseConnectStatusResponse,g as parseHubApiErrorBody,e as parseOAuthRefreshResponse,d as parsePermissionSessionResponse,c as parseProjectConnectionsResponse,L as parseServerDeliveryAckBody,R as parseSyncFromDeliveryBody,t as prepareClientBridgeDeliveryTransport,W as processManagedOAuthDelivery,C as registerHubWebhookTenantLink,j as resolveDeliveryTransport,za as resolveFrpcBinary,y as resolveHubConfigInput,h as resolveHubDeliveryUrl,A as resolveHubOAuthCallbackUrl,ba as respondToHubDelivery,ca as respondToHubDeliveryFromRequest,q as signBrowserDeliveryToken,ia as signConnectSessionToken,na as signConnectToken,I as signDeliveryEnvelope,sa as signPermissionToken,k as usesBrowserDelivery,l as validateProductionDeliveryUrl,r as verifyBrowserDeliveryToken,ja as verifyConnectSessionToken,oa as verifyConnectToken,J as verifyDeliveryEnvelope,ta as verifyPermissionToken,K as verifySignedTunnelDelivery};
+import{$a as _,A as z,Aa as P,B as A,Ba as Q,C as B,Ca as R,Da as S,Ea as T,Fa as U,Ga as V,Ha as W,T as C,Ua as X,Va as Y,_a as Z,ab as $,b as a,bb as aa,cb as ba,d as b,db as ca,e as c,f as d,fb as da,g as e,gb as ea,h as f,hb as fa,i as g,ia as D,ib as ga,j as i,jb as ha,k as j,ka as E,kb as ia,l as k,la as F,lb as ja,m as l,mb as ka,n as m,nb as la,o as n,ob as ma,p as o,pb as na,q as p,qb as oa,r as q,ra as G,rb as pa,s as r,sa as H,sb as qa,t as s,ta as I,tb as ra,u as t,ua as J,ub as sa,v as u,va as K,vb as ta,w as v,wa as L,wb as ua,x as w,xa as M,y as x,ya as N,z as y,za as O}from"./chunk-AHWGCIDB.js";import{a as h,b as va,c as wa,d as xa,e as ya,f as za}from"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{m as BROWSER_DELIVERY_TTL_MS,wa as CORSAIR_TUNNEL_PATH,va as CORSAIR_TUNNEL_ZONE,u as DEFAULT_HUB_API_URL,xa as FRPC_VERSION,w as HubCredentialsMissingError,v as HubNotConfiguredError,V as ManagedOAuthDeliveryError,n as SIGNED_TUNNEL_REPLAY_WINDOW_MS,ea as attachManagedRefreshAuth,p as buildBrowserDeliveryRedirectUrl,s as buildClientBridgeBrowserDeliveryUrl,ga as createConnectSessionJti,la as createConnectTokenJti,D as createHubConnectSession,E as createHubPermissionSession,fa as createHubRouteHandlers,ra as createPermissionSessionJti,o as createSignedTokenJti,ka as decodeConnectSessionTokenFromPath,qa as decodeConnectTokenFromPath,ua as decodePermissionTokenFromPath,Q as deliverConnectCreateLink,U as deliverSignedEnvelope,S as describeDeliveryNetworkError,pa as encodeConnectTokenForPath,O as extractConnectLinkFromDeliveryAck,H as extractProbeFromDeliveryAck,G as extractRunFromDeliveryAck,N as extractSyncFromDeliveryAck,F as formatHubApprovalMessage,a as formatProviderDisplayName,T as formatServerDeliveryError,ya as frpcPlatformKey,ha as getConnectSessionExpiryMs,X as getConnectStatusForTenant,ma as getConnectTokenExpiryMs,z as getHubConfig,da as getManagedAccessToken,Z as handleHubDeliveryGet,_ as handleHubDeliveryPost,aa as handleHubDeliveryRequest,$ as hubDeliveryToResponse,B as inferHubEnvironmentSlug,i as isLoopbackUrl,M as isServerDeliveryAckSuccessful,Y as listHubProjectConnections,x as normalizeHubConfig,P as parseConnectLinkFromDeliveryBody,b as parseConnectSessionResponse,f as parseConnectStatusResponse,g as parseHubApiErrorBody,e as parseOAuthRefreshResponse,d as parsePermissionSessionResponse,c as parseProjectConnectionsResponse,L as parseServerDeliveryAckBody,R as parseSyncFromDeliveryBody,t as prepareClientBridgeDeliveryTransport,W as processManagedOAuthDelivery,C as registerHubWebhookTenantLink,j as resolveDeliveryTransport,za as resolveFrpcBinary,y as resolveHubConfigInput,h as resolveHubDeliveryUrl,A as resolveHubOAuthCallbackUrl,ba as respondToHubDelivery,ca as respondToHubDeliveryFromRequest,q as signBrowserDeliveryToken,ia as signConnectSessionToken,na as signConnectToken,I as signDeliveryEnvelope,sa as signPermissionToken,k as usesBrowserDelivery,l as validateProductionDeliveryUrl,r as verifyBrowserDeliveryToken,ja as verifyConnectSessionToken,oa as verifyConnectToken,J as verifyDeliveryEnvelope,ta as verifyPermissionToken,K as verifySignedTunnelDelivery};

package/dist/{index-DsA-vbJF.d.ts → index-BLqi-B6k.d.ts}

@@ -1,5 +1,5 @@
 import { CorsairDatabase } from './db.js';
-import { C as CorsairPlugin, a as CorsairPermissionsOptions, b as CorsairManualConfig, H as HubConfig, c as CorsairIntegration, d as CorsairTenantWrapper, e as CorsairSingleTenantClient } from './index-DGyng7I6.js';
+import { C as CorsairPlugin, a as CorsairPermissionsOptions, b as CorsairManualConfig, H as HubConfig, c as CorsairIntegration, d as CorsairTenantWrapper, e as CorsairSingleTenantClient } from './index-CadajNjy.js';
 
 declare const CORSAIR_INTERNAL: unique symbol;
 type CorsairInternalConfig = {

package/dist/{index-DGyng7I6.d.ts → index-CadajNjy.d.ts}

@@ -3,7 +3,7 @@ import { CorsairDatabase, CorsairPermission, CorsairDatabaseInput } from './db.j
 import { CorsairPluginSchema, PluginEntityClients } from './orm.js';
 
 type AllErrors = 'RATE_LIMIT_ERROR' | 'AUTH_ERROR' | 'PERMISSION_ERROR' | 'NETWORK_ERROR' | 'TIMEOUT_ERROR' | 'SERVER_ERROR' | 'VALIDATION_ERROR' | 'NOT_FOUND_ERROR' | 'BAD_REQUEST_ERROR' | 'PARSING_ERROR' | 'DEFAULT' | (string & {});
-declare const BaseProviders: readonly ["ably", "abstract", "abuseipdb", "abyssale", "accrediblecertificates", "activecampaign", "activetrail", "addresszen", "aeroleads", "affinda", "agencyzoom", "agentmail", "agentql", "agenty", "agilitycms", "ahrefs", "aimlapi", "airtable", "aivoov", "alchemy", "algolia", "allimagesai", "alphavantage", "altoviz", "alttextai", "amara", "ambee", "ambientweather", "amcards", "amplitude", "anchorbrowser", "anonyflow", "anthropicadministrator", "apaleo", "api2pdf", "apibible", "apify", "apilabz", "apininjas", "apipie", "apisports", "asana", "asindataapi", "asticaai", "asyncinterview", "attio", "autom", "ayrshare", "backendless", "bannerbear", "bart", "basecamp", "baselinker", "basin", "beaconstac", "beeminder", "bettercontact", "betterproposals", "betterstack", "bigdatacloud", "bigmailer", "bigml", "bitbucket", "bitwarden", "blazemeter", "blocknative", "bluesky", "boloforms", "boltiot", "bonsai", "bookingmood", "botpress", "botsonic", "bouncer", "box", "boxhero", "brandfetch", "brex", "brightdata", "browseai", "browserless", "bugsnag", "buildkite", "cal", "calendly", "canva", "canvas", "capsulecrm", "chatbotkit", "chatfai", "circleci", "clickhouse", "clientary", "clockify", "cloudflare", "cloudinary", "collegefootballdata", "confluence", "contentfulgraphql", "contextsevenmcp", "crowterminal", "cursor", "customgpt", "databricks", "datadog", "deepseek", "devinmcp", "diffbot", "digitalocean", "discord", "dockerhub", "dodopayments", "doppler", "dreamstudio", "dripcel", "dropbox", "dropboxsign", "epicgames", "exa", "facebook", "faraday", "figma", "filloutforms", "firecrawl", "fireflies", "formbricks", "gemini", "github", "gitlab", "gmail", "googleaddressvalidation", "googlebigquery", "googlecalendar", "googlecloudvision", "googledocs", "googledrive", "googlemaps", "googlemeet", "googlesheets", "grafana", "groqcloud", "habitica", "hackernews", "harvest", "hashnode", "here", "heygen", "htmltoimage", "hubspot", "huggingface", "imgbb", "insightoai", "instagram", "intercom", "jigsawstack", "jira", "kaggle", "linear", "linkedin", "loyverse", "mailboxlayer", "mailchimp", "mailtrap", "marketstack", "merriamwebsterdict", "monday", "neon", "nextdns", "notion", "ocrspace", "ocrwebservice", "ollama", "onedrive", "onepassword", "openai", "openrouter", "openweathermap", "oura", "outlook", "pagerduty", "parseur", "pdfmonkey", "perplexityai", "pinecone", "posthog", "razorpay", "reddit", "removebg", "resend", "retailed", "salesforce", "scrapegraphai", "securitytrails", "sendgrid", "sentry", "serpapi", "sharepoint", "slack", "sourcegraph", "spotify", "strava", "streamtime", "stripe", "studiobyai21labs", "supabase", "synthflowai", "tally", "tavily", "tavilymcp", "teams", "telegram", "textrazor", "ticktick", "tisane", "timecamp", "todoist", "toggl", "trello", "twentyonerisk", "twilio", "twitter", "twitterapiio", "twochat", "typeform", "unione", "uniswapapi", "vapi", "vercel", "vestaboard", "wakatime", "webflow", "webvizio", "whatsapp", "witai", "wiza", "workday", "workiom", "xquik", "youcom", "youtube", "zendesk", "zohomail", "zoom", "zoominfo"];
+declare const BaseProviders: readonly ["ably", "abstract", "abuseipdb", "abyssale", "accrediblecertificates", "activecampaign", "activetrail", "addresszen", "aeroleads", "affinda", "agencyzoom", "agentmail", "agentql", "agenty", "agilitycms", "ahrefs", "aimlapi", "airtable", "aivoov", "alchemy", "algolia", "allimagesai", "alphavantage", "altoviz", "alttextai", "amara", "ambee", "ambientweather", "amcards", "amplitude", "anchorbrowser", "anonyflow", "anthropicadministrator", "apaleo", "api2pdf", "apibible", "apify", "apilabz", "apininjas", "apipie", "apisports", "asana", "ascora", "asindataapi", "asticaai", "asyncinterview", "attio", "autom", "ayrshare", "backendless", "bannerbear", "bart", "basecamp", "baselinker", "basin", "beaconstac", "beeminder", "bettercontact", "betterproposals", "betterstack", "bigdatacloud", "bigmailer", "bigml", "bitbucket", "bitwarden", "blazemeter", "blocknative", "bluesky", "boloforms", "boltiot", "bonsai", "bookingmood", "botpress", "botsonic", "bouncer", "box", "boxhero", "brandfetch", "breathehr", "brex", "brightdata", "browseai", "browserless", "bubble", "bugsnag", "buildkite", "cal", "calendly", "canva", "canvas", "capsulecrm", "chatbotkit", "chatfai", "circleci", "clickhouse", "clientary", "clockify", "cloudflare", "cloudinary", "collegefootballdata", "confluence", "connecteam", "contentfulgraphql", "contextsevenmcp", "crowterminal", "cursor", "customgpt", "databricks", "datadog", "datarobot", "deepseek", "devinmcp", "diffbot", "digitalocean", "discord", "dockerhub", "dodopayments", "doppler", "dreamstudio", "dripcel", "dropbox", "dropboxsign", "dynapictures", "epicgames", "exa", "facebook", "faraday", "figma", "filloutforms", "firecrawl", "fireflies", "formbricks", "gemini", "github", "gitlab", "gmail", "googleaddressvalidation", "googlebigquery", "googlecalendar", "googlecloudvision", "googledocs", "googledrive", "googlemaps", "googlemeet", "googlesheets", "grafana", "groqcloud", "habitica", "hackernews", "harvest", "hashnode", "here", "heygen", "htmltoimage", "hubspot", "huggingface", "imgbb", "insightoai", "instagram", "intercom", "jigsawstack", "jira", "kaggle", "linear", "linkedin", "loyverse", "mailboxlayer", "mailchimp", "mailtrap", "marketstack", "merriamwebsterdict", "monday", "neon", "nextdns", "notion", "ocrspace", "ocrwebservice", "ollama", "onedrive", "onepassword", "openai", "openrouter", "openweathermap", "oura", "outlook", "pagerduty", "parseur", "pdfmonkey", "perplexityai", "pinecone", "posthog", "razorpay", "reddit", "removebg", "resend", "retailed", "salesforce", "sapsuccessfactors", "scrapegraphai", "securitytrails", "sendgrid", "sentry", "serpapi", "sharepoint", "slack", "sourcegraph", "spotify", "strava", "streamtime", "stripe", "studiobyai21labs", "supabase", "synthflowai", "tally", "tavily", "tavilymcp", "teams", "telegram", "textrazor", "ticktick", "timelink", "tisane", "timecamp", "todoist", "toggl", "trello", "twentyonerisk", "twilio", "twitter", "twitterapiio", "twochat", "typeform", "unione", "uniswapapi", "vapi", "vercel", "vestaboard", "wakatime", "webflow", "webvizio", "whatsapp", "witai", "worldnewsapi", "wiza", "workday", "workiom", "xquik", "youcom", "youtube", "zendesk", "zohomail", "zoom", "zoominfo"];
 declare const ProviderDisplayNames: {
     readonly ably: "Ably";
     readonly abstract: "Abstract";
@@ -47,6 +47,7 @@ declare const ProviderDisplayNames: {
     readonly apipie: "APIpie AI";
     readonly apisports: "API-Sports";
     readonly asana: "Asana";
+    readonly ascora: "Ascora";
     readonly asindataapi: "ASIN Data API";
     readonly asticaai: "Astica AI";
     readonly asyncinterview: "Async Interview";
@@ -82,10 +83,12 @@ declare const ProviderDisplayNames: {
     readonly box: "Box";
     readonly boxhero: "BoxHero";
     readonly brandfetch: "Brandfetch";
+    readonly breathehr: "Breathe HR";
     readonly brex: "Brex";
     readonly brightdata: "Bright Data";
     readonly browseai: "Browse AI";
     readonly browserless: "Browserless";
+    readonly bubble: "Bubble";
     readonly bugsnag: "BugSnag";
     readonly buildkite: "Buildkite";
     readonly cal: "Cal";
@@ -103,6 +106,7 @@ declare const ProviderDisplayNames: {
     readonly cloudinary: "Cloudinary";
     readonly collegefootballdata: "College Football Data";
     readonly confluence: "Confluence";
+    readonly connecteam: "Connecteam";
     readonly contentfulgraphql: "Contentful GraphQL";
     readonly contextsevenmcp: "Context7";
     readonly crowterminal: "CrowTerminal";
@@ -110,6 +114,7 @@ declare const ProviderDisplayNames: {
     readonly customgpt: "CustomGPT";
     readonly databricks: "Databricks";
     readonly datadog: "Datadog";
+    readonly datarobot: "DataRobot";
     readonly deepseek: "DeepSeek";
     readonly devinmcp: "Devin MCP";
     readonly diffbot: "Diffbot";
@@ -122,6 +127,7 @@ declare const ProviderDisplayNames: {
     readonly dripcel: "Dripcel";
     readonly dropbox: "Dropbox";
     readonly dropboxsign: "Dropbox Sign";
+    readonly dynapictures: "Dynapictures";
     readonly epicgames: "Epic Games";
     readonly exa: "Exa";
     readonly facebook: "Facebook";
@@ -196,6 +202,7 @@ declare const ProviderDisplayNames: {
     readonly resend: "Resend";
     readonly retailed: "Retailed";
     readonly salesforce: "Salesforce";
+    readonly sapsuccessfactors: "SAP SuccessFactors";
     readonly scrapegraphai: "ScrapeGraphAI";
     readonly securitytrails: "SecurityTrails";
     readonly sendgrid: "SendGrid";
@@ -218,6 +225,7 @@ declare const ProviderDisplayNames: {
     readonly telegram: "Telegram";
     readonly textrazor: "TextRazor";
     readonly ticktick: "TickTick";
+    readonly timelink: "Timelink";
     readonly tisane: "Tisane";
     readonly timecamp: "TimeCamp";
     readonly todoist: "Todoist";
@@ -239,6 +247,7 @@ declare const ProviderDisplayNames: {
     readonly webvizio: "Webvizio";
     readonly whatsapp: "WhatsApp";
     readonly witai: "WitAi";
+    readonly worldnewsapi: "World News API";
     readonly wiza: "Wiza";
     readonly workday: "Workday";
     readonly workiom: "Workiom";
@@ -251,7 +260,7 @@ declare const ProviderDisplayNames: {
     readonly zoominfo: "ZoomInfo";
 };
 declare function formatProviderDisplayName(plugin: string): string;
-type AllProviders = 'ably' | 'abstract' | 'abuseipdb' | 'abyssale' | 'accrediblecertificates' | 'activecampaign' | 'activetrail' | 'addresszen' | 'aeroleads' | 'affinda' | 'agencyzoom' | 'agentmail' | 'agentql' | 'agenty' | 'agilitycms' | 'ahrefs' | 'aimlapi' | 'airtable' | 'aivoov' | 'alchemy' | 'algolia' | 'allimagesai' | 'alphavantage' | 'altoviz' | 'alttextai' | 'amara' | 'ambee' | 'ambientweather' | 'amcards' | 'amplitude' | 'anchorbrowser' | 'anonyflow' | 'anthropicadministrator' | 'apaleo' | 'api2pdf' | 'apibible' | 'apify' | 'apilabz' | 'apininjas' | 'apipie' | 'apisports' | 'asana' | 'asindataapi' | 'asticaai' | 'asyncinterview' | 'attio' | 'autom' | 'ayrshare' | 'backendless' | 'bannerbear' | 'bart' | 'basecamp' | 'baselinker' | 'basin' | 'beaconstac' | 'beeminder' | 'bettercontact' | 'betterproposals' | 'betterstack' | 'bigdatacloud' | 'bigmailer' | 'bigml' | 'bitbucket' | 'bitwarden' | 'blazemeter' | 'blocknative' | 'bluesky' | 'boloforms' | 'boltiot' | 'bonsai' | 'bookingmood' | 'botpress' | 'botsonic' | 'bouncer' | 'box' | 'boxhero' | 'brandfetch' | 'brex' | 'brightdata' | 'browseai' | 'browserless' | 'bugsnag' | 'buildkite' | 'cal' | 'calendly' | 'canva' | 'canvas' | 'capsulecrm' | 'chatbotkit' | 'chatfai' | 'circleci' | 'clickhouse' | 'clientary' | 'clockify' | 'cloudflare' | 'cloudinary' | 'collegefootballdata' | 'confluence' | 'contentfulgraphql' | 'contextsevenmcp' | 'crowterminal' | 'cursor' | 'customgpt' | 'databricks' | 'datadog' | 'deepseek' | 'devinmcp' | 'diffbot' | 'digitalocean' | 'discord' | 'dockerhub' | 'dodopayments' | 'doppler' | 'dreamstudio' | 'dripcel' | 'dropbox' | 'epicgames' | 'exa' | 'facebook' | 'faraday' | 'figma' | 'filloutforms' | 'firecrawl' | 'fireflies' | 'formbricks' | 'gemini' | 'github' | 'gitlab' | 'gmail' | 'googleaddressvalidation' | 'googlebigquery' | 'googlecalendar' | 'googlecloudvision' | 'googledocs' | 'googledrive' | 'googlemaps' | 'googlemeet' | 'googlesheets' | 'grafana' | 'groqcloud' | 'habitica' | 'hackernews' | 'harvest' | 'hashnode' | 'here' | 'heygen' | 'htmltoimage' | 'hubspot' | 'huggingface' | 'imgbb' | 'insightoai' | 'instagram' | 'intercom' | 'jigsawstack' | 'jira' | 'kaggle' | 'linear' | 'linkedin' | 'loyverse' | 'mailboxlayer' | 'mailchimp' | 'mailtrap' | 'marketstack' | 'merriamwebsterdict' | 'monday' | 'neon' | 'nextdns' | 'notion' | 'ocrspace' | 'ocrwebservice' | 'ollama' | 'onedrive' | 'onepassword' | 'openai' | 'openrouter' | 'openweathermap' | 'oura' | 'outlook' | 'pagerduty' | 'parseur' | 'pdfmonkey' | 'perplexityai' | 'pinecone' | 'posthog' | 'razorpay' | 'reddit' | 'removebg' | 'resend' | 'retailed' | 'salesforce' | 'scrapegraphai' | 'securitytrails' | 'sendgrid' | 'sentry' | 'serpapi' | 'sharepoint' | 'slack' | 'sourcegraph' | 'spotify' | 'strava' | 'streamtime' | 'stripe' | 'studiobyai21labs' | 'supabase' | 'synthflowai' | 'tally' | 'tavily' | 'tavilymcp' | 'teams' | 'telegram' | 'textrazor' | 'ticktick' | 'tisane' | 'timecamp' | 'todoist' | 'toggl' | 'trello' | 'twentyonerisk' | 'twilio' | 'twitter' | 'twitterapiio' | 'twochat' | 'typeform' | 'unione' | 'uniswapapi' | 'vapi' | 'vercel' | 'vestaboard' | 'wakatime' | 'webflow' | 'webvizio' | 'whatsapp' | 'witai' | 'wiza' | 'workday' | 'workiom' | 'xquik' | 'youcom' | 'youtube' | 'zendesk' | 'zohomail' | 'zoom' | 'zoominfo' | (string & {});
+type AllProviders = 'ably' | 'abstract' | 'abuseipdb' | 'abyssale' | 'accrediblecertificates' | 'activecampaign' | 'activetrail' | 'addresszen' | 'aeroleads' | 'affinda' | 'agencyzoom' | 'agentmail' | 'agentql' | 'agenty' | 'agilitycms' | 'ahrefs' | 'aimlapi' | 'airtable' | 'aivoov' | 'alchemy' | 'algolia' | 'allimagesai' | 'alphavantage' | 'altoviz' | 'alttextai' | 'amara' | 'ambee' | 'ambientweather' | 'amcards' | 'amplitude' | 'anchorbrowser' | 'anonyflow' | 'anthropicadministrator' | 'apaleo' | 'api2pdf' | 'apibible' | 'apify' | 'apilabz' | 'apininjas' | 'apipie' | 'apisports' | 'asana' | 'ascora' | 'asindataapi' | 'asticaai' | 'asyncinterview' | 'attio' | 'autom' | 'ayrshare' | 'backendless' | 'bannerbear' | 'bart' | 'basecamp' | 'baselinker' | 'basin' | 'beaconstac' | 'beeminder' | 'bettercontact' | 'betterproposals' | 'betterstack' | 'bigdatacloud' | 'bigmailer' | 'bigml' | 'bitbucket' | 'bitwarden' | 'blazemeter' | 'blocknative' | 'bluesky' | 'boloforms' | 'boltiot' | 'bonsai' | 'bookingmood' | 'botpress' | 'botsonic' | 'bouncer' | 'box' | 'boxhero' | 'brandfetch' | 'breathehr' | 'brex' | 'brightdata' | 'browseai' | 'browserless' | 'bubble' | 'bugsnag' | 'buildkite' | 'cal' | 'calendly' | 'canva' | 'canvas' | 'capsulecrm' | 'chatbotkit' | 'chatfai' | 'circleci' | 'clickhouse' | 'clientary' | 'clockify' | 'cloudflare' | 'cloudinary' | 'collegefootballdata' | 'confluence' | 'connecteam' | 'contentfulgraphql' | 'contextsevenmcp' | 'crowterminal' | 'cursor' | 'customgpt' | 'databricks' | 'datadog' | 'datarobot' | 'deepseek' | 'devinmcp' | 'diffbot' | 'digitalocean' | 'discord' | 'dockerhub' | 'dodopayments' | 'doppler' | 'dreamstudio' | 'dripcel' | 'dropbox' | 'dropboxsign' | 'dynapictures' | 'epicgames' | 'exa' | 'facebook' | 'faraday' | 'figma' | 'filloutforms' | 'firecrawl' | 'fireflies' | 'formbricks' | 'gemini' | 'github' | 'gitlab' | 'gmail' | 'googleaddressvalidation' | 'googlebigquery' | 'googlecalendar' | 'googlecloudvision' | 'googledocs' | 'googledrive' | 'googlemaps' | 'googlemeet' | 'googlesheets' | 'grafana' | 'groqcloud' | 'habitica' | 'hackernews' | 'harvest' | 'hashnode' | 'here' | 'heygen' | 'htmltoimage' | 'hubspot' | 'huggingface' | 'imgbb' | 'insightoai' | 'instagram' | 'intercom' | 'jigsawstack' | 'jira' | 'kaggle' | 'linear' | 'linkedin' | 'loyverse' | 'mailboxlayer' | 'mailchimp' | 'mailtrap' | 'marketstack' | 'merriamwebsterdict' | 'monday' | 'neon' | 'nextdns' | 'notion' | 'ocrspace' | 'ocrwebservice' | 'ollama' | 'onedrive' | 'onepassword' | 'openai' | 'openrouter' | 'openweathermap' | 'oura' | 'outlook' | 'pagerduty' | 'parseur' | 'pdfmonkey' | 'perplexityai' | 'pinecone' | 'posthog' | 'razorpay' | 'reddit' | 'removebg' | 'resend' | 'retailed' | 'salesforce' | 'sapsuccessfactors' | 'scrapegraphai' | 'securitytrails' | 'sendgrid' | 'sentry' | 'serpapi' | 'sharepoint' | 'slack' | 'sourcegraph' | 'spotify' | 'strava' | 'streamtime' | 'stripe' | 'studiobyai21labs' | 'supabase' | 'synthflowai' | 'tally' | 'tavily' | 'tavilymcp' | 'teams' | 'telegram' | 'textrazor' | 'ticktick' | 'timelink' | 'tisane' | 'timecamp' | 'todoist' | 'toggl' | 'trello' | 'twentyonerisk' | 'twilio' | 'twitter' | 'twitterapiio' | 'twochat' | 'typeform' | 'unione' | 'uniswapapi' | 'vapi' | 'vercel' | 'vestaboard' | 'wakatime' | 'webflow' | 'webvizio' | 'whatsapp' | 'witai' | 'worldnewsapi' | 'wiza' | 'workday' | 'workiom' | 'xquik' | 'youcom' | 'youtube' | 'zendesk' | 'zohomail' | 'zoom' | 'zoominfo' | (string & {});
 type AuthTypes = 'oauth_2' | 'api_key' | 'bot_token' | 'managed';
 type PickAuth<T extends AuthTypes> = T;
 

package/dist/{index-D-pBLE_N.d.ts → index-Dp27gGG4.d.ts}

@@ -1,4 +1,4 @@
-import { W as WebhookTenantMatch, A as AuthTypes } from './index-DGyng7I6.js';
+import { W as WebhookTenantMatch, A as AuthTypes } from './index-CadajNjy.js';
 import { CorsairDatabase, CorsairAccount } from './db.js';
 
 /**

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { aG as ManagementOk, aH as Tenant, aI as CreateTenantInput, aJ as PluginInfo, aK as ConnectionStatus, aL as PermissionLookupInput, aM as PermissionRecord, aN as CreateConnectLinkInput, aO as ConnectLink, aP as ResolvedConnectLink, aQ as OAuthCallbackInput, aR as OAuthCallbackResult, aS as ConnectRequest, e as CorsairSingleTenantClient, C as CorsairPlugin, d as CorsairTenantWrapper, u as CorsairClient, X as CorsairPermissionsNamespace, ar as BoundWebhookTree, ax as RawWebhookRequest, aw as CorsairWebhookTenantMatcher, w as BaseProviders, aA as WebhookResponse } from './index-DGyng7I6.js';
-export { aT as CorsairManageNamespace, b as CorsairManualConfig, a as CorsairPermissionsOptions, aU as PluginConnectionState, a0 as ReadonlyForbiddenError, a1 as runReadonly } from './index-DGyng7I6.js';
-export { c as createCorsair } from './index-DsA-vbJF.js';
-import { F as FormFieldSchema, L as ListOperationsOptions } from './tenant-match-utils-DoYyOmnq.js';
-export { A as AuthMissingError, C as CorsairKekMissingError, h as PermissionRequiredError, l as PluginWebhookMatchers, R as ReconnectRequiredError, a as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, n as asRecord, j as collectPluginWebhookMatchers, o as decodePubSubData, q as firstString, g as formatDocSchemaShape, s as getHeader, m as matchWebhookPlugin, k as matchWebhookPluginAndTenant, u as readBodyRecord, r as resolveConnectLink, w as toExternalId } from './tenant-match-utils-DoYyOmnq.js';
+import { aG as ManagementOk, aH as Tenant, aI as CreateTenantInput, aJ as PluginInfo, aK as ConnectionStatus, aL as PermissionLookupInput, aM as PermissionRecord, aN as CreateConnectLinkInput, aO as ConnectLink, aP as ResolvedConnectLink, aQ as OAuthCallbackInput, aR as OAuthCallbackResult, aS as ConnectRequest, e as CorsairSingleTenantClient, C as CorsairPlugin, d as CorsairTenantWrapper, u as CorsairClient, X as CorsairPermissionsNamespace, ar as BoundWebhookTree, ax as RawWebhookRequest, aw as CorsairWebhookTenantMatcher, w as BaseProviders, aA as WebhookResponse } from './index-CadajNjy.js';
+export { aT as CorsairManageNamespace, b as CorsairManualConfig, a as CorsairPermissionsOptions, aU as PluginConnectionState, a0 as ReadonlyForbiddenError, a1 as runReadonly } from './index-CadajNjy.js';
+export { c as createCorsair } from './index-BLqi-B6k.js';
+import { F as FormFieldSchema, L as ListOperationsOptions } from './tenant-match-utils-O8u60d72.js';
+export { A as AuthMissingError, C as CorsairKekMissingError, h as PermissionRequiredError, l as PluginWebhookMatchers, R as ReconnectRequiredError, a as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, n as asRecord, j as collectPluginWebhookMatchers, o as decodePubSubData, q as firstString, g as formatDocSchemaShape, s as getHeader, m as matchWebhookPlugin, k as matchWebhookPluginAndTenant, u as readBodyRecord, r as resolveConnectLink, w as toExternalId } from './tenant-match-utils-O8u60d72.js';
 export { SetupCorsairOptions, setupCorsair } from './setup.js';
-export { O as OAuthCallbackTunnelPayload, f as ProcessCorsairOptions, g as ProcessCorsairRequest, l as ResolveAccountFromWebhookLinkInput, T as TunnelAck, j as TunnelEnvelope, k as TunnelType, m as WebhookTenantLink, W as WebhookTunnelPayload, p as processCorsair, r as resolveAccountFromWebhookLink, h as resolveTenantFromWebhookLink, i as resolveTenantIdFromWebhookLink, s as setWebhookTenantLink } from './index-D-pBLE_N.js';
+export { O as OAuthCallbackTunnelPayload, f as ProcessCorsairOptions, g as ProcessCorsairRequest, l as ResolveAccountFromWebhookLinkInput, T as TunnelAck, j as TunnelEnvelope, k as TunnelType, m as WebhookTenantLink, W as WebhookTunnelPayload, p as processCorsair, r as resolveAccountFromWebhookLink, h as resolveTenantFromWebhookLink, i as resolveTenantIdFromWebhookLink, s as setWebhookTenantLink } from './index-Dp27gGG4.js';
 import 'zod';
 import './db.js';
 import 'kysely';

package/dist/index.js

@@ -1,3 +1,3 @@
-import{$b as re,Ab as B,Bb as j,Cb as U,Db as J,Eb as Y,Fb as K,Gb as G,Hb as X,Ia as v,Ib as z,Jb as Q,Kb as V,P as I,Pb as C,Qa as M,Qb as f,Rb as k,Sb as y,U as b,V as S,W as T,Wa as _,X as w,Xa as $,Xb as Z,Ya as F,Yb as ee,Za as H,Zb as ne,_b as te,ac as oe,bc as ie,c as x,eb as W,fc as se,gc as ae,hc as h,ic as ue,ja as O,ma as L,na as A,oa as E,xb as q,yb as N,zb as D}from"./chunk-H2PWRKH5.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";var c=class extends Error{status;code;extra;constructor(r,o,e,a={}){super(e),this.name="CorsairClientError",this.status=r,this.code=o,this.extra=a}};function ce(t){return t.endsWith("/")?t.slice(0,-1):t}async function P(t){let r={};try{r=await t.json()}catch{}let o=typeof r.error=="string"?r.error:"request_failed",e=typeof r.message=="string"?r.message:`Request failed (${t.status})`,{error:a,message:p,...n}=r;return new c(t.status,o,e,n)}function pe(t){let r=ce(t.baseURL),o=t.fetch??((...n)=>globalThis.fetch(...n));async function e(n,i){let s=i&&Object.keys(i).length?`?${new URLSearchParams(i).toString()}`:"",u=await o(`${r}${n}${s}`,{method:"GET"});if(!u.ok)throw await P(u);return await u.json()}async function a(n,i){let s=await o(`${r}${n}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(i)});if(!s.ok)throw await P(s);return await s.json()}let p=encodeURIComponent;return{ok:()=>e("/ok"),tenants:{list:()=>e("/tenants"),create:n=>a("/tenants",n),get:n=>e(`/tenants/${p(n)}`)},plugins:{list:()=>e("/plugins"),get:n=>e(`/plugins/${p(n)}`)},connectionStatus:{get:n=>{let i={};return n?.tenantId&&(i.tenantId=n.tenantId),e("/connection-status",i)}},permissions:{get:n=>"id"in n?e(`/permissions/${p(n.id)}`):a("/permissions/lookup-by-token",{token:n.token})},connect:{createLink:n=>a("/connect/links",n),resolve:n=>e("/connect/resolve",{state:n}),oauthCallback:n=>a("/connect/oauth/callback",n)},connectRequest:{get:n=>{let i={};return n?.tenantId&&(i.tenantId=n.tenantId),e("/connect/request",i)},clear:n=>a("/connect/request/clear",n??{})}}}function m(t){let r=t[h];if(!r)throw new Error("listOperations / getSchema: invalid corsair instance. Pass the value returned by createCorsair() or corsair.withTenant().");return r.plugins}function le(t,r){let o=f(m(t),r);return typeof o=="string"?o:Array.isArray(o)?o.join(`
+import{$b as re,Ab as B,Bb as j,Cb as U,Db as J,Eb as Y,Fb as K,Gb as G,Hb as X,Ia as v,Ib as z,Jb as Q,Kb as V,P as I,Pb as C,Qa as M,Qb as f,Rb as k,Sb as y,U as b,V as S,W as T,Wa as _,X as w,Xa as $,Xb as Z,Ya as F,Yb as ee,Za as H,Zb as ne,_b as te,ac as oe,bc as ie,c as x,eb as W,fc as se,gc as ae,hc as h,ic as ue,ja as O,ma as L,na as A,oa as E,xb as q,yb as N,zb as D}from"./chunk-AHWGCIDB.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";var c=class extends Error{status;code;extra;constructor(r,o,e,a={}){super(e),this.name="CorsairClientError",this.status=r,this.code=o,this.extra=a}};function ce(t){return t.endsWith("/")?t.slice(0,-1):t}async function P(t){let r={};try{r=await t.json()}catch{}let o=typeof r.error=="string"?r.error:"request_failed",e=typeof r.message=="string"?r.message:`Request failed (${t.status})`,{error:a,message:p,...n}=r;return new c(t.status,o,e,n)}function pe(t){let r=ce(t.baseURL),o=t.fetch??((...n)=>globalThis.fetch(...n));async function e(n,i){let s=i&&Object.keys(i).length?`?${new URLSearchParams(i).toString()}`:"",u=await o(`${r}${n}${s}`,{method:"GET"});if(!u.ok)throw await P(u);return await u.json()}async function a(n,i){let s=await o(`${r}${n}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(i)});if(!s.ok)throw await P(s);return await s.json()}let p=encodeURIComponent;return{ok:()=>e("/ok"),tenants:{list:()=>e("/tenants"),create:n=>a("/tenants",n),get:n=>e(`/tenants/${p(n)}`)},plugins:{list:()=>e("/plugins"),get:n=>e(`/plugins/${p(n)}`)},connectionStatus:{get:n=>{let i={};return n?.tenantId&&(i.tenantId=n.tenantId),e("/connection-status",i)}},permissions:{get:n=>"id"in n?e(`/permissions/${p(n.id)}`):a("/permissions/lookup-by-token",{token:n.token})},connect:{createLink:n=>a("/connect/links",n),resolve:n=>e("/connect/resolve",{state:n}),oauthCallback:n=>a("/connect/oauth/callback",n)},connectRequest:{get:n=>{let i={};return n?.tenantId&&(i.tenantId=n.tenantId),e("/connect/request",i)},clear:n=>a("/connect/request/clear",n??{})}}}function m(t){let r=t[h];if(!r)throw new Error("listOperations / getSchema: invalid corsair instance. Pass the value returned by createCorsair() or corsair.withTenant().");return r.plugins}function le(t,r){let o=f(m(t),r);return typeof o=="string"?o:Array.isArray(o)?o.join(`
 `):Object.values(o).flat().join(`
 `)}function de(t,r){return k(m(t),r)}function me(t,r){return C(m(t),r)}var ge=Symbol.for("corsair:internal");function Ce(t,r){let o=t;for(let e of r){if(!o||typeof o!="object")return null;o=o[e]}return typeof o=="function"?o:null}function R(t){return t[ge]?.database}async function fe(t,r){let o=new Date().toISOString(),e=await t.permissions.find_by_token(r);if(!e)return console.error("executePermission: no permission found for token."),{error:"executePermission: no permission found for token."};if(e.status!=="approved")return console.error(`executePermission: permission '${e.id}' is '${e.status}', expected 'approved'.`),{endpoint:e.endpoint,plugin:e.plugin,result:null,error:`executePermission: permission '${e.id}' is '${e.status}', expected 'approved'.`};if(e.expires_at<o){let s=R(t);return s&&await s.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",e.id).execute(),console.error(`executePermission: permission '${e.id}' has expired.`),{error:`executePermission: permission '${e.id}' has expired.`,endpoint:e.endpoint,plugin:e.plugin,result:null}}let a=e.tenant_id??"default",n=(t.withTenant?t.withTenant(a):t)[e.plugin];if(!n?.api)return console.error(`executePermission: plugin '${e.plugin}' not found or has no API on this corsair instance.`),{error:`executePermission: plugin '${e.plugin}' not found or has no API on this corsair instance.`,plugin:e.plugin,endpoint:e.endpoint,result:null};let i=Ce(n.api,e.endpoint.split("."));if(!i)return console.error(`executePermission: endpoint '${e.endpoint}' not found in plugin '${e.plugin}'.`),{endpoint:e.endpoint,plugin:e.plugin,result:null,error:`executePermission: endpoint '${e.endpoint}' not found in plugin '${e.plugin}'.`};await t.permissions.set_executing(e.id);try{let s=typeof e.args=="string"?JSON.parse(e.args):e.args,u=await i(s);return await t.permissions.set_completed(e.id),{plugin:e.plugin,endpoint:e.endpoint,result:u}}catch(s){let u=s instanceof Error?s.message:String(s),g=R(t);return g&&await g.db.updateTable("corsair_permissions").set({status:"failed",error:u,updated_at:new Date}).where("id","=",e.id).execute(),{plugin:e.plugin,endpoint:e.endpoint,result:null,error:u}}}export{W as AuthMissingError,c as CorsairClientError,q as CorsairKekMissingError,$ as DEFAULT_BODY_STALL_TIMEOUT_MS,_ as DEFAULT_MAX_BODY_BYTES,L as PermissionRequiredError,A as ReadonlyForbiddenError,x as ReconnectRequiredError,oe as asRecord,ne as collectPluginWebhookMatchers,ue as createCorsair,pe as createCorsairClient,ae as decodePubSubData,fe as executePermission,se as firstString,y as formatDocSchemaShape,te as getHeader,de as getSchema,me as getStructuredSchema,le as listOperations,N as managementHandler,Z as matchWebhookPlugin,ee as matchWebhookPluginAndTenant,M as processCorsair,v as processWebhook,ie as readBodyRecord,B as registerCorsairRawBodyParser,S as resolveAccountFromWebhookLink,H as resolveBodyStallTimeoutMs,O as resolveConnectLink,F as resolveMaxBodyBytes,w as resolveTenantFromWebhookLink,T as resolveTenantIdFromWebhookLink,E as runReadonly,b as setWebhookTenantLink,I as setupCorsair,X as toAstroHandler,D as toExpressHandler,re as toExternalId,j as toFastifyHandler,U as toHonoHandler,J as toNextJsHandler,Y as toNodeHandler,Q as toNuxtHandler,G as toRemixHandler,K as toSvelteKitHandler,z as toTanStackHandler,V as toWebHandler};

package/dist/{loop-HFBZMTU5.js → loop-XIM6TBPK.js}

@@ -1 +1 @@
-import{Ra as a,Sa as b,Ta as c}from"./chunk-H2PWRKH5.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{a as deriveAck,b as pollOnce,c as startConnectLoop};
+import{Ra as a,Sa as b,Ta as c}from"./chunk-AHWGCIDB.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{a as deriveAck,b as pollOnce,c as startConnectLoop};

package/dist/oauth.d.ts

@@ -1,4 +1,4 @@
-import { O as OAuthConfig } from './index-DGyng7I6.js';
+import { O as OAuthConfig } from './index-CadajNjy.js';
 import 'zod';
 import './db.js';
 import 'kysely';

package/dist/oauth.js

@@ -1 +1 @@
-import{$ as f,R as a,S as b,Y as c,Z as d,_ as e,aa as g,ba as h}from"./chunk-H2PWRKH5.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{d as OAuthCallbackError,c as buildOAuthAuthorizeUrl,b as decodeOAuthState,a as encodeOAuthState,e as generateOAuthUrl,f as processOAuthCallback,g as renewSubscriptions,h as startSubscriptionRenewal};
+import{$ as f,R as a,S as b,Y as c,Z as d,_ as e,aa as g,ba as h}from"./chunk-AHWGCIDB.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{d as OAuthCallbackError,c as buildOAuthAuthorizeUrl,b as decodeOAuthState,a as encodeOAuthState,e as generateOAuthUrl,f as processOAuthCallback,g as renewSubscriptions,h as startSubscriptionRenewal};

package/dist/{setup-A24JSJDG.js → setup-5MYOZL7R.js}

@@ -1 +1 @@
-import{P as a,Q as b}from"./chunk-H2PWRKH5.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};
+import{P as a,Q as b}from"./chunk-AHWGCIDB.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};

package/dist/{setup-introspect-7BUMMXZE.js → setup-introspect-XDS2OMYE.js}

@@ -1 +1 @@
-import{ca as a,da as b,ea as c,fa as d}from"./chunk-H2PWRKH5.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as buildConnectPluginManifest,a as buildConnectPluginManifestFromContext,d as ensureConnectAccountRows,c as ensureConnectAccountRowsFromContext};
+import{ca as a,da as b,ea as c,fa as d}from"./chunk-AHWGCIDB.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as buildConnectPluginManifest,a as buildConnectPluginManifestFromContext,d as ensureConnectAccountRows,c as ensureConnectAccountRowsFromContext};

package/dist/setup.d.ts

@@ -1,5 +1,5 @@
-import { a as CorsairInternalConfig } from './index-DsA-vbJF.js';
-import { C as CorsairPlugin, e as CorsairSingleTenantClient, d as CorsairTenantWrapper } from './index-DGyng7I6.js';
+import { a as CorsairInternalConfig } from './index-BLqi-B6k.js';
+import { C as CorsairPlugin, e as CorsairSingleTenantClient, d as CorsairTenantWrapper } from './index-CadajNjy.js';
 import { CorsairDatabase } from './db.js';
 import 'zod';
 import './orm.js';

package/dist/setup.js

@@ -1 +1 @@
-import{P as a,Q as b}from"./chunk-H2PWRKH5.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};
+import{P as a,Q as b}from"./chunk-AHWGCIDB.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};

package/dist/{tenant-match-utils-DoYyOmnq.d.ts → tenant-match-utils-O8u60d72.d.ts}

@@ -1,4 +1,4 @@
-import { a9 as EndpointRiskLevel, C as CorsairPlugin, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, ax as RawWebhookRequest, v as AllProviders, W as WebhookTenantMatch } from './index-DGyng7I6.js';
+import { a9 as EndpointRiskLevel, C as CorsairPlugin, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, ax as RawWebhookRequest, v as AllProviders, W as WebhookTenantMatch } from './index-CadajNjy.js';
 
 /**
  * Error thrown when an endpoint call is blocked pending user approval or by

package/dist/tunnel.d.ts

@@ -1,7 +1,7 @@
-import { B as BrowserDeliveryPayload, R as RunResultPayload, P as ProbeResultPayload } from './index-D-pBLE_N.js';
-export { O as OAuthCallbackTunnelPayload, e as OAuthTokensTunnelPayload, f as ProcessCorsairOptions, g as ProcessCorsairRequest, a as RunStepResult, b as RunTriggerType, c as RunTunnelPayload, T as TunnelAck, j as TunnelEnvelope, k as TunnelType, W as WebhookTunnelPayload, d as applyPermissionDecision, p as processCorsair, r as resolveAccountFromWebhookLink, h as resolveTenantFromWebhookLink, i as resolveTenantIdFromWebhookLink, s as setWebhookTenantLink } from './index-D-pBLE_N.js';
-export { v as verifyBrowserDeliveryToken } from './browser-delivery-Da29aknX.js';
-import './index-DGyng7I6.js';
+import { B as BrowserDeliveryPayload, R as RunResultPayload, P as ProbeResultPayload } from './index-Dp27gGG4.js';
+export { O as OAuthCallbackTunnelPayload, e as OAuthTokensTunnelPayload, f as ProcessCorsairOptions, g as ProcessCorsairRequest, a as RunStepResult, b as RunTriggerType, c as RunTunnelPayload, T as TunnelAck, j as TunnelEnvelope, k as TunnelType, W as WebhookTunnelPayload, d as applyPermissionDecision, p as processCorsair, r as resolveAccountFromWebhookLink, h as resolveTenantFromWebhookLink, i as resolveTenantIdFromWebhookLink, s as setWebhookTenantLink } from './index-Dp27gGG4.js';
+export { v as verifyBrowserDeliveryToken } from './browser-delivery-BVsj88up.js';
+import './index-CadajNjy.js';
 import 'zod';
 import './db.js';
 import 'kysely';

package/dist/tunnel.js

@@ -1 +1 @@
-import{Ja as f,Ka as g,La as h,Ma as i,Na as j,Oa as k,Pa as l,Qa as m,U as b,V as c,W as d,X as e,s as a}from"./chunk-H2PWRKH5.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{l as applyPermissionDecision,f as executeWorkflowRun,h as isAuthCredentialsBrowserDelivery,k as isByoOAuthBrowserDelivery,j as isManagedBrowserDelivery,i as isPermissionBrowserDelivery,m as processCorsair,c as resolveAccountFromWebhookLink,e as resolveTenantFromWebhookLink,d as resolveTenantIdFromWebhookLink,g as runReadonlyProbe,b as setWebhookTenantLink,a as verifyBrowserDeliveryToken};
+import{Ja as f,Ka as g,La as h,Ma as i,Na as j,Oa as k,Pa as l,Qa as m,U as b,V as c,W as d,X as e,s as a}from"./chunk-AHWGCIDB.js";import"./chunk-4OLKWKJG.js";import"./chunk-7Q2WLIJE.js";import"./chunk-ZZA3PW24.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{l as applyPermissionDecision,f as executeWorkflowRun,h as isAuthCredentialsBrowserDelivery,k as isByoOAuthBrowserDelivery,j as isManagedBrowserDelivery,i as isPermissionBrowserDelivery,m as processCorsair,c as resolveAccountFromWebhookLink,e as resolveTenantFromWebhookLink,d as resolveTenantIdFromWebhookLink,g as runReadonlyProbe,b as setWebhookTenantLink,a as verifyBrowserDeliveryToken};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "corsair",
-  "version": "0.1.125",
-  "description": "",
+  "version": "0.1.126",
+  "description": "Open-source integration layer for AI agents and apps. Managed OAuth, webhooks, and one API for 200+ integrations, with credentials that stay in your own database.",
   "type": "module",
   "main": "./dist/index.js",
   "module": "./dist/index.js",
@@ -83,12 +83,12 @@
     "zod": "^4.1.13"
   },
   "optionalDependencies": {
-    "@corsair-dev/frpc-linux-x64": "0.1.117",
-    "@corsair-dev/frpc-darwin-x64": "0.1.117",
     "@corsair-dev/frpc-linux-arm64": "0.1.117",
+    "@corsair-dev/frpc-darwin-x64": "0.1.117",
+    "@corsair-dev/frpc-linux-x64": "0.1.117",
     "@corsair-dev/frpc-win32-arm64": "0.1.117",
-    "@corsair-dev/frpc-win32-x64": "0.1.117",
-    "@corsair-dev/frpc-darwin-arm64": "0.1.117"
+    "@corsair-dev/frpc-darwin-arm64": "0.1.117",
+    "@corsair-dev/frpc-win32-x64": "0.1.117"
   },
   "devDependencies": {
     "@testing-library/react": "^16.3.2",
@@ -118,9 +118,26 @@
     "tsx": "^4.20.6",
     "typescript": "^5.3.3"
   },
-  "keywords": [],
-  "author": "",
+  "keywords": [
+    "integrations",
+    "oauth",
+    "api",
+    "connectors",
+    "ai-agents",
+    "mcp",
+    "webhooks",
+    "multi-tenant",
+    "self-hosted",
+    "corsair"
+  ],
+  "author": "Corsair (https://corsair.dev)",
   "license": "Apache-2.0",
+  "homepage": "https://corsair.dev",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/corsairdev/corsair.git",
+    "directory": "packages/corsair"
+  },
   "files": [
     "dist",
     "scripts/postinstall-frpc.mjs",