corsair 0.1.126 → 0.1.127

package/dist/{browser-delivery-BVsj88up.d.ts → browser-delivery-rAR_m7hR.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-Dp27gGG4.js';
+import { B as BrowserDeliveryPayload } from './index-Be4UHmRU.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/chunk-F2EV3CHK.js

@@ -0,0 +1 @@
+import{a as c}from"./chunk-Z2KT4F2U.js";import{Kysely as o,PostgresDialect as b,SqliteDialect as _}from"kysely";import{PostgresJSDialect as m}from"kysely-postgres-js";function x(t){return typeof t.query=="function"&&typeof t.connect=="function"}function w(t){let r=t;return typeof r.prepare=="function"&&typeof r.exec=="function"&&typeof r.close=="function"&&!("query"in t)}function D(t){return typeof t=="function"&&typeof t.begin=="function"&&typeof t.end=="function"}function p(t,r){return typeof t=="function"?t.bind(r):t}var k=114,S=3802;function I(t){if(typeof t!="object"||t===null||Buffer.isBuffer(t))return!1;if(Array.isArray(t))return!0;let r=Object.getPrototypeOf(t);return r===Object.prototype||r===null}function P(t){return t instanceof Date?t.toISOString():I(t)?JSON.stringify(t):t}function T(t){let r=t.options?.serializers;if(!r)return;let n=a=>a;r[k]=n,r[S]=n}function E(t){return new Proxy(t,{get(r,n,a){return n!=="reserve"?p(Reflect.get(r,n,a),r):async function(){let d=await r.reserve();return new Proxy(d,{get(i,s,u){return s!=="unsafe"?p(Reflect.get(i,s,u),i):function(l,y,g){return i.unsafe(l,y?.map(P),g)}}})}}})}function q(t){return typeof t.selectFrom=="function"}function O(t){if(q(t))return{db:t};if(w(t))return{db:new o({dialect:new _({database:t}),plugins:[new c]})};if(x(t))return{db:new o({dialect:new b({pool:t})})};if(D(t))return T(t),{db:new o({dialect:new m({postgres:E(t)})})};throw new Error("Unsupported database input. Expected a pg Pool, postgres.js Sql, better-sqlite3 Database, or a Kysely instance.")}import{z as e}from"zod";var z=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),name:e.string(),config:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{}),dek:e.string().nullish()}),j=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),tenant_id:e.string(),integration_id:e.string(),config:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{}),dek:e.string().nullish()}),N=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),account_id:e.string(),entity_id:e.string(),entity_type:e.string(),version:e.string(),data:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{})}),B=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),account_id:e.string(),event_type:e.string(),payload:e.record(e.string(),e.unknown()).nullable().transform(t=>t??{}),status:e.enum(["pending","processing","completed","failed"]).optional()}),J=e.object({id:e.string(),created_at:e.coerce.date(),updated_at:e.coerce.date(),token:e.string(),plugin:e.string(),endpoint:e.string(),args:e.string(),tenant_id:e.string(),status:e.enum(["pending","approved","executing","completed","denied","expired","failed"]).default("pending"),expires_at:e.string(),error:e.string().nullable().optional()});export{O as a,z as b,j as c,N as d,B as e,J as f};

package/dist/chunk-SI2MXDD3.js

@@ -0,0 +1 @@
+import{sql as b}from"kysely";export{b as a};

package/dist/{chunk-7Q2WLIJE.js → chunk-VOH7OVWP.js}

@@ -1 +1 @@
-import{b as B,c as R,d as S,e as O}from"./chunk-ZZA3PW24.js";var H=Symbol.for("corsair:internal"),A=class extends Error{constructor(t="Invalid corsair instance"){super(t),this.name="InvalidCorsairInstanceError"}};function D(e){return typeof e=="object"&&e!==null}function v(e){if(!D(e)||!Array.isArray(e.plugins)||typeof e.kek!="string"||typeof e.multiTenancy!="boolean")return!1;if(e.database===void 0)return!0;if(!D(e.database))return!1;let t=e.database.db;return typeof t=="object"&&t!==null&&typeof t.selectFrom=="function"}function N(e){if(!e||typeof e!="object")return;let r=Object.getOwnPropertyDescriptor(e,H)?.value;return v(r)?r:void 0}function G(e,t){let r=N(e);if(!r)throw t?.()??new A;return r}function W(e,t){return e.plugins.find(r=>r.id===t)}function X(e,t,r){let n=W(e,t);if(!n)throw r(`Plugin '${t}' not found`);return n}function Y(e){return"withTenant"in e&&typeof e.withTenant=="function"}function q(e,t){if(!e||typeof e!="object")return;let r=e[t];return typeof r=="function"?(...n)=>Reflect.apply(r,e,n):void 0}var P={oauth_2:{integration:["client_id","client_secret","redirect_url"],account:["access_token","refresh_token","expires_at","scope","webhook_signature"]},api_key:{integration:[],account:["api_key","webhook_signature"]},bot_token:{integration:[],account:["bot_token","webhook_signature"]},managed:{integration:[],account:["access_token","refresh_token","expires_at","scope","webhook_signature"]}};function j(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function V(e){let t=e.options?.authType;return j(t)?t:void 0}function ee(e,t){let r=e.authConfig,n=P[t].account,i=r?.[t]?.account??[];return[...n,...i]}function _e(e,t){let r=e.authConfig,n=P[t].integration,i=r?.[t]?.integration??[];return[...n,...i]}import{v7 as te}from"uuid";function x(){return te()}import{z as b}from"zod";import{sql as C}from"kysely";function I(e){return e.replace(/'/g,"''")}function K(e){let t=I(e);return C`data->>'${C.raw(t)}'`}function U(e){let t=I(e);return C`(data->>'${C.raw(t)}')::numeric`}function Z(e){let t=I(e);return C`(data->>'${C.raw(t)}')::boolean`}function $(e){let t=I(e);return C`(data->>'${C.raw(t)}')::timestamptz`}function ne(e){if(typeof e=="string")try{return JSON.parse(e)}catch{return e}return e}function M(e){let t=e;for(;t;){if(t instanceof b.ZodOptional||t instanceof b.ZodNullable){t=t._def.innerType;continue}if(t instanceof b.ZodDefault){t=t._def.innerType;continue}break}return t}function re(e){let t=M(e);if(t instanceof b.ZodString)return"string";if(t instanceof b.ZodNumber)return"number";if(t instanceof b.ZodBoolean)return"boolean";if(t instanceof b.ZodDate)return"date"}function ie(e){let t=M(e);if(!(t instanceof b.ZodObject))return{};let r=t.shape,n={};for(let[i,a]of Object.entries(r)){let u=re(a);u&&(n[i]=u)}return n}function oe(e,t,r){if(typeof r=="string")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;"equals"in n&&typeof n.equals=="string"&&(e=e.where(t,"=",n.equals)),"contains"in n&&typeof n.contains=="string"&&(e=e.where(t,"like",`%${n.contains}%`)),"startsWith"in n&&typeof n.startsWith=="string"&&(e=e.where(t,"like",`${n.startsWith}%`)),"endsWith"in n&&typeof n.endsWith=="string"&&(e=e.where(t,"like",`%${n.endsWith}`)),"in"in n&&Array.isArray(n.in)&&(e=e.where(t,"in",n.in))}return e}function se(e,t,r){if(typeof r=="number")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;typeof n.equals=="number"&&(e=e.where(t,"=",n.equals)),typeof n.gt=="number"&&(e=e.where(t,">",n.gt)),typeof n.gte=="number"&&(e=e.where(t,">=",n.gte)),typeof n.lt=="number"&&(e=e.where(t,"<",n.lt)),typeof n.lte=="number"&&(e=e.where(t,"<=",n.lte)),Array.isArray(n.in)&&(e=e.where(t,"in",n.in))}return e}function ae(e,t,r){if(typeof r=="boolean")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;typeof n.equals=="boolean"&&(e=e.where(t,"=",n.equals))}return e}function ue(e,t,r){if(r instanceof Date)return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;if(n.equals instanceof Date&&(e=e.where(t,"=",n.equals)),n.before instanceof Date&&(e=e.where(t,"<",n.before)),n.after instanceof Date&&(e=e.where(t,">",n.after)),Array.isArray(n.between)&&n.between.length===2){let[i,a]=n.between;i instanceof Date&&(e=e.where(t,">=",i)),a instanceof Date&&(e=e.where(t,"<=",a))}}return e}function ce(e,t,r,n){return r==="number"?se(e,U(t),n):r==="boolean"?ae(e,Z(t),n):r==="date"?ue(e,$(t),n):oe(e,K(t),n)}function de(e,t,r){if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;return"equals"in n&&(e=e.where(t,"=",n.equals)),"contains"in n&&typeof n.contains=="string"&&(e=e.where(t,"like",`%${n.contains}%`)),"startsWith"in n&&typeof n.startsWith=="string"&&(e=e.where(t,"like",`${n.startsWith}%`)),"endsWith"in n&&typeof n.endsWith=="string"&&(e=e.where(t,"like",`%${n.endsWith}`)),"in"in n&&Array.isArray(n.in)&&(e=e.where(t,"in",n.in)),e}return e.where(t,"=",r)}function le(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):Number.parseInt(String(e??0),10)}function T(e,t,r){return e.selectFrom("corsair_entities").selectAll().where("account_id","=",t).where("entity_type","=",r)}function Q(e,t,r,n,i){let a=ie(i);function u(o){let l=ne(o.data);return{...o,data:i.parse(l)}}return{findByEntityId:async o=>{let l=await t(),c=await T(e,l,r).where("entity_id","=",o).executeTakeFirst();return c?u(c):null},existsByEntityId:async o=>{let l=await t();return await T(e,l,r).select("id").where("entity_id","=",o).executeTakeFirst()!==void 0},findIdByEntityId:async o=>{let l=await t();return(await T(e,l,r).select("id").where("entity_id","=",o).executeTakeFirst())?.id??null},findById:async o=>{let l=await t(),c=await T(e,l,r).where("id","=",o).executeTakeFirst();return c?u(c):null},findManyByEntityIds:async o=>{if(o.length===0)return[];let l=await t();return(await T(e,l,r).where("entity_id","in",o).execute()).map(u)},list:async o=>{let l=await t(),c=T(e,l,r);return typeof o?.limit=="number"&&(c=c.limit(o.limit)),typeof o?.offset=="number"&&(c=c.offset(o.offset)),(await c.execute()).map(u)},search:async o=>{let l=await t(),c=T(e,l,r),d=new Set(["data","limit","offset"]);for(let[y,f]of Object.entries(o))d.has(y)||f===void 0||(c=de(c,y,f));if(o.data&&typeof o.data=="object")for(let[y,f]of Object.entries(o.data)){if(f===void 0)continue;let g=a[y]??"string";c=ce(c,y,g,f)}return typeof o.limit=="number"&&(c=c.limit(o.limit)),typeof o.offset=="number"&&(c=c.offset(o.offset)),(await c.execute()).map(u)},upsertByEntityId:async(o,l)=>{let c=await t(),d=i.parse(l),s=new Date,y=await T(e,c,r).select("id").where("entity_id","=",o).executeTakeFirst();if(y?.id){await e.updateTable("corsair_entities").set({version:n,data:d,updated_at:s}).where("id","=",y.id).execute();let _=await e.selectFrom("corsair_entities").selectAll().where("id","=",y.id).executeTakeFirst();return u(_)}let f=x();await e.insertInto("corsair_entities").values({id:f,created_at:s,updated_at:s,account_id:c,entity_id:o,entity_type:r,version:n,data:d}).execute();let g=await e.selectFrom("corsair_entities").selectAll().where("id","=",f).executeTakeFirst();return u(g)},deleteById:async o=>{let l=await t(),c=await e.deleteFrom("corsair_entities").where("account_id","=",l).where("entity_type","=",r).where("id","=",o).executeTakeFirst();return Number(c.numDeletedRows)>0},deleteByEntityId:async o=>{let l=await t(),c=await e.deleteFrom("corsair_entities").where("account_id","=",l).where("entity_type","=",r).where("entity_id","=",o).executeTakeFirst();return Number(c.numDeletedRows)>0},count:async()=>{let o=await t(),l=await e.selectFrom("corsair_entities").select(c=>c.fn.countAll().as("count")).where("account_id","=",o).where("entity_type","=",r).executeTakeFirst();return le(l?.count)}}}var ye={corsair_integrations:B,corsair_accounts:R,corsair_entities:S,corsair_events:O};function fe(e){return ye[e]}function z(e){if(typeof e=="string")try{return JSON.parse(e)}catch{return e}return e}function p(e){if(!e)throw new Error("Corsair database is not configured. Pass `database` to createCorsair(...) to enable ORM.")}function k(e){if(!e)return[];let t=[];for(let r in e){let n=r,i=e[n];if(i!==void 0)if(typeof i=="object"&&i!==null&&!Array.isArray(i)&&!(i instanceof Date)){let a=i;"in"in a&&Array.isArray(a.in)?t.push({field:n,operator:"in",value:a.in}):"like"in a&&typeof a.like=="string"&&t.push({field:n,operator:"like",value:a.like})}else t.push({field:n,value:i})}return t}function m(e,t){if(!t?.length)return e;let r=e;for(let n of t){let i=n.operator??"=";r=r.where(n.field,i,n.value)}return r}function pe(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):Number.parseInt(String(e??0),10)}function E(e,t){let r=fe(t),n=()=>(p(e),e),i=()=>n().db.selectFrom(t),a=()=>n().db.insertInto(t),u=()=>n().db.updateTable(t),o=()=>n().db.deleteFrom(t);function l(d){let s={};for(let[y,f]of Object.entries(d))s[y]=z(f);return r.parse(s)}function c(d){let s={};for(let[y,f]of Object.entries(d))s[y]=z(f);return r.parse(s)}return{findById:async d=>{p(e);let s=i().selectAll();s=m(s,[{field:"id",value:d}]);let y=await s.executeTakeFirst();return y?l(y):null},findOne:async d=>{p(e);let s=i().selectAll();s=m(s,k(d));let y=await s.executeTakeFirst();return y?l(y):null},findMany:async d=>{p(e);let s=i().selectAll();return s=m(s,k(d?.where)),typeof d?.limit=="number"&&(s=s.limit(d.limit)),typeof d?.offset=="number"&&(s=s.offset(d.offset)),(await s.execute()).map(f=>l(f))},create:async d=>{p(e);let s=new Date,y={id:d.id??x(),created_at:s,updated_at:s,...d},f=await a().values(y).returningAll().executeTakeFirst();return f?l(f):c(y)},update:async(d,s)=>{p(e);let y={...s,updated_at:new Date},f=u().set(y).returningAll();f=m(f,[{field:"id",value:d}]);let g=await f.executeTakeFirst();return g?l(g):null},updateMany:async(d,s)=>{p(e);let y={...s,updated_at:new Date},f=i().select("id");f=m(f,k(d));let g=await f.execute();for(let _ of g){let F=u().set(y);F=m(F,[{field:"id",value:_.id}]),await F.execute()}return g.length},delete:async d=>{p(e);let s=o();s=m(s,[{field:"id",value:d}]);let y=await s.executeTakeFirst();return Number(y?.numDeletedRows??0)>0},deleteMany:async d=>{p(e);let s=o();s=m(s,k(d));let y=await s.executeTakeFirst();return Number(y?.numDeletedRows??0)},count:async d=>{p(e);let s=i().select(f=>f.fn.countAll().as("count"));s=m(s,k(d));let y=await s.executeTakeFirst();return pe(y?.count)}}}function ge(e){let t=E(e,"corsair_integrations");return{...t,findByName:r=>t.findOne({name:r}),upsertByName:async(r,n)=>{let i=await t.findOne({name:r});return i?await t.update(i.id,n):t.create({...n,name:r})}}}function me(e){let t=E(e,"corsair_accounts");return{...t,findByTenantAndIntegration:async(r,n)=>{p(e);let i=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();return i?t.findOne({tenant_id:r,integration_id:i.id}):null},listByTenant:(r,n)=>t.findMany({where:{tenant_id:r},limit:n?.limit,offset:n?.offset}),upsertByTenantAndIntegration:async(r,n,i)=>{let a=await t.findOne({tenant_id:r,integration_id:n});return a?await t.update(a.id,i):t.create({...i,tenant_id:r,integration_id:n})}}}function we(e){let t=E(e,"corsair_entities");return{...t,findByEntityId:({accountId:r,entityType:n,entityId:i})=>t.findOne({account_id:r,entity_type:n,entity_id:i}),findManyByEntityIds:async({accountId:r,entityType:n,entityIds:i})=>i.length===0?[]:(p(e),await e.db.selectFrom("corsair_entities").selectAll().where("account_id","=",r).where("entity_type","=",n).where("entity_id","in",i).execute()),listByScope:({accountId:r,entityType:n,limit:i,offset:a})=>t.findMany({where:{account_id:r,entity_type:n},limit:i,offset:a}),searchByEntityId:async({accountId:r,entityType:n,query:i,limit:a,offset:u})=>{p(e);let o=e.db.selectFrom("corsair_entities").selectAll().where("account_id","=",r).where("entity_type","=",n).where("entity_id","like",`%${i}%`);return typeof a=="number"&&(o=o.limit(a)),typeof u=="number"&&(o=o.offset(u)),await o.execute()},upsertByEntityId:async({accountId:r,entityType:n,entityId:i,version:a,data:u})=>{let o=await t.findOne({account_id:r,entity_type:n,entity_id:i});return o?await t.update(o.id,{version:a,data:u}):t.create({account_id:r,entity_type:n,entity_id:i,version:a,data:u})},deleteByEntityId:async({accountId:r,entityType:n,entityId:i})=>{p(e);let a=await e.db.deleteFrom("corsair_entities").where("account_id","=",r).where("entity_type","=",n).where("entity_id","=",i).executeTakeFirst();return Number(a.numDeletedRows)>0}}}function he(e){let t=E(e,"corsair_events");return{...t,listByAccount:(r,n)=>t.findMany({where:{account_id:r},limit:n?.limit,offset:n?.offset}),listByStatus:(r,n)=>{let i={status:r};return n?.accountId&&(i.account_id=n.accountId),t.findMany({where:i,limit:n?.limit,offset:n?.offset})},listPending:r=>{let n={status:"pending"};return r?.accountId&&(n.account_id=r.accountId),t.findMany({where:n,limit:r?.limit??100})},updateStatus:(r,n)=>t.update(r,{status:n})}}function L(e){return{integrations:ge(e),accounts:me(e),entities:we(e),events:he(e)}}function Ce(e,t,r,n,i){let a=null;async function u(){if(a!==null)return a;p(e);let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",t.integrationName).executeTakeFirst();if(!o)throw new Error(`Integration "${t.integrationName}" not found. Make sure to create the integration first.`);let l=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t.tenantId).where("integration_id","=",o.id).executeTakeFirst();if(!l)throw new Error(`Account not found for tenant "${t.tenantId}" and integration "${t.integrationName}". Make sure to create the account first.`);return a=l.id,a}return p(e),Q(e.db,u,r,n,i)}function J(e){let{database:t,integrationName:r,schema:n,tenantId:i}=e,a=L(t),u={tenantId:i,integrationName:r},o=null;async function l(){if(o!==null)return o;p(t);let d=await t.db.selectFrom("corsair_integrations").selectAll().where("name","=",r).executeTakeFirst();if(!d)throw new Error(`Integration "${r}" not found. Make sure to create the integration first.`);let s=await t.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",i).where("integration_id","=",d.id).executeTakeFirst();if(!s)throw new Error(`Account not found for tenant "${i}" and integration "${r}". Make sure to create the account first.`);return o=s.id,o}let c={};for(let[d,s]of Object.entries(n.entities))c[d]=Ce(t,u,d,n.version,s);return{...c,$orm:a,$integrationName:r,$tenantId:i,$getAccountId:l}}function Ye(e,t){let r=L(e);return{$tenantId:t,$orm:r,listAccounts:n=>r.accounts.listByTenant(t,n),findAccountByIntegration:n=>r.accounts.findByTenantAndIntegration(t,n),listEntities:async n=>{p(e);let i=await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).execute();if(i.length===0)return[];let a=i.map(o=>o.id),u=e.db.selectFrom("corsair_entities").selectAll().where("account_id","in",a);return n?.entityType&&(u=u.where("entity_type","=",n.entityType)),typeof n?.limit=="number"&&(u=u.limit(n.limit)),typeof n?.offset=="number"&&(u=u.offset(n.offset)),await u.execute()},listEvents:async n=>{p(e);let i=await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).execute();if(i.length===0)return[];let a=i.map(o=>o.id),u=e.db.selectFrom("corsair_events").selectAll().where("account_id","in",a);return n?.status&&(u=u.where("status","=",n.status)),typeof n?.limit=="number"&&(u=u.limit(n.limit)),typeof n?.offset=="number"&&(u=u.offset(n.offset)),await u.execute()},forIntegration:n=>J({database:e,integrationName:n.integrationName,schema:n.schema,tenantId:t})}}function qe(e,t){return{forTenant:r=>J({database:e,integrationName:t.integrationName,schema:t.schema,tenantId:r})}}export{A as a,D as b,N as c,G as d,X as e,Y as f,q as g,P as h,V as i,ee as j,_e as k,x as l,Q as m,ye as n,L as o,J as p,Ye as q,qe as r};
+import{b as B,c as R,d as S,e as O}from"./chunk-F2EV3CHK.js";var H=Symbol.for("corsair:internal"),A=class extends Error{constructor(t="Invalid corsair instance"){super(t),this.name="InvalidCorsairInstanceError"}};function D(e){return typeof e=="object"&&e!==null}function v(e){if(!D(e)||!Array.isArray(e.plugins)||typeof e.kek!="string"||typeof e.multiTenancy!="boolean")return!1;if(e.database===void 0)return!0;if(!D(e.database))return!1;let t=e.database.db;return typeof t=="object"&&t!==null&&typeof t.selectFrom=="function"}function N(e){if(!e||typeof e!="object")return;let r=Object.getOwnPropertyDescriptor(e,H)?.value;return v(r)?r:void 0}function G(e,t){let r=N(e);if(!r)throw t?.()??new A;return r}function W(e,t){return e.plugins.find(r=>r.id===t)}function X(e,t,r){let n=W(e,t);if(!n)throw r(`Plugin '${t}' not found`);return n}function Y(e){return"withTenant"in e&&typeof e.withTenant=="function"}function q(e,t){if(!e||typeof e!="object")return;let r=e[t];return typeof r=="function"?(...n)=>Reflect.apply(r,e,n):void 0}var P={oauth_2:{integration:["client_id","client_secret","redirect_url"],account:["access_token","refresh_token","expires_at","scope","webhook_signature"]},api_key:{integration:[],account:["api_key","webhook_signature"]},bot_token:{integration:[],account:["bot_token","webhook_signature"]},managed:{integration:[],account:["access_token","refresh_token","expires_at","scope","webhook_signature"]}};function j(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function V(e){let t=e.options?.authType;return j(t)?t:void 0}function ee(e,t){let r=e.authConfig,n=P[t].account,i=r?.[t]?.account??[];return[...n,...i]}function _e(e,t){let r=e.authConfig,n=P[t].integration,i=r?.[t]?.integration??[];return[...n,...i]}import{v7 as te}from"uuid";function x(){return te()}import{z as b}from"zod";import{sql as C}from"kysely";function I(e){return e.replace(/'/g,"''")}function K(e){let t=I(e);return C`data->>'${C.raw(t)}'`}function U(e){let t=I(e);return C`(data->>'${C.raw(t)}')::numeric`}function Z(e){let t=I(e);return C`(data->>'${C.raw(t)}')::boolean`}function $(e){let t=I(e);return C`(data->>'${C.raw(t)}')::timestamptz`}function ne(e){if(typeof e=="string")try{return JSON.parse(e)}catch{return e}return e}function M(e){let t=e;for(;t;){if(t instanceof b.ZodOptional||t instanceof b.ZodNullable){t=t._def.innerType;continue}if(t instanceof b.ZodDefault){t=t._def.innerType;continue}break}return t}function re(e){let t=M(e);if(t instanceof b.ZodString)return"string";if(t instanceof b.ZodNumber)return"number";if(t instanceof b.ZodBoolean)return"boolean";if(t instanceof b.ZodDate)return"date"}function ie(e){let t=M(e);if(!(t instanceof b.ZodObject))return{};let r=t.shape,n={};for(let[i,a]of Object.entries(r)){let u=re(a);u&&(n[i]=u)}return n}function oe(e,t,r){if(typeof r=="string")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;"equals"in n&&typeof n.equals=="string"&&(e=e.where(t,"=",n.equals)),"contains"in n&&typeof n.contains=="string"&&(e=e.where(t,"like",`%${n.contains}%`)),"startsWith"in n&&typeof n.startsWith=="string"&&(e=e.where(t,"like",`${n.startsWith}%`)),"endsWith"in n&&typeof n.endsWith=="string"&&(e=e.where(t,"like",`%${n.endsWith}`)),"in"in n&&Array.isArray(n.in)&&(e=e.where(t,"in",n.in))}return e}function se(e,t,r){if(typeof r=="number")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;typeof n.equals=="number"&&(e=e.where(t,"=",n.equals)),typeof n.gt=="number"&&(e=e.where(t,">",n.gt)),typeof n.gte=="number"&&(e=e.where(t,">=",n.gte)),typeof n.lt=="number"&&(e=e.where(t,"<",n.lt)),typeof n.lte=="number"&&(e=e.where(t,"<=",n.lte)),Array.isArray(n.in)&&(e=e.where(t,"in",n.in))}return e}function ae(e,t,r){if(typeof r=="boolean")return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;typeof n.equals=="boolean"&&(e=e.where(t,"=",n.equals))}return e}function ue(e,t,r){if(r instanceof Date)return e.where(t,"=",r);if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;if(n.equals instanceof Date&&(e=e.where(t,"=",n.equals)),n.before instanceof Date&&(e=e.where(t,"<",n.before)),n.after instanceof Date&&(e=e.where(t,">",n.after)),Array.isArray(n.between)&&n.between.length===2){let[i,a]=n.between;i instanceof Date&&(e=e.where(t,">=",i)),a instanceof Date&&(e=e.where(t,"<=",a))}}return e}function ce(e,t,r,n){return r==="number"?se(e,U(t),n):r==="boolean"?ae(e,Z(t),n):r==="date"?ue(e,$(t),n):oe(e,K(t),n)}function de(e,t,r){if(typeof r=="object"&&r!==null&&!Array.isArray(r)){let n=r;return"equals"in n&&(e=e.where(t,"=",n.equals)),"contains"in n&&typeof n.contains=="string"&&(e=e.where(t,"like",`%${n.contains}%`)),"startsWith"in n&&typeof n.startsWith=="string"&&(e=e.where(t,"like",`${n.startsWith}%`)),"endsWith"in n&&typeof n.endsWith=="string"&&(e=e.where(t,"like",`%${n.endsWith}`)),"in"in n&&Array.isArray(n.in)&&(e=e.where(t,"in",n.in)),e}return e.where(t,"=",r)}function le(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):Number.parseInt(String(e??0),10)}function T(e,t,r){return e.selectFrom("corsair_entities").selectAll().where("account_id","=",t).where("entity_type","=",r)}function Q(e,t,r,n,i){let a=ie(i);function u(o){let l=ne(o.data);return{...o,data:i.parse(l)}}return{findByEntityId:async o=>{let l=await t(),c=await T(e,l,r).where("entity_id","=",o).executeTakeFirst();return c?u(c):null},existsByEntityId:async o=>{let l=await t();return await T(e,l,r).select("id").where("entity_id","=",o).executeTakeFirst()!==void 0},findIdByEntityId:async o=>{let l=await t();return(await T(e,l,r).select("id").where("entity_id","=",o).executeTakeFirst())?.id??null},findById:async o=>{let l=await t(),c=await T(e,l,r).where("id","=",o).executeTakeFirst();return c?u(c):null},findManyByEntityIds:async o=>{if(o.length===0)return[];let l=await t();return(await T(e,l,r).where("entity_id","in",o).execute()).map(u)},list:async o=>{let l=await t(),c=T(e,l,r);return typeof o?.limit=="number"&&(c=c.limit(o.limit)),typeof o?.offset=="number"&&(c=c.offset(o.offset)),(await c.execute()).map(u)},search:async o=>{let l=await t(),c=T(e,l,r),d=new Set(["data","limit","offset"]);for(let[y,f]of Object.entries(o))d.has(y)||f===void 0||(c=de(c,y,f));if(o.data&&typeof o.data=="object")for(let[y,f]of Object.entries(o.data)){if(f===void 0)continue;let g=a[y]??"string";c=ce(c,y,g,f)}return typeof o.limit=="number"&&(c=c.limit(o.limit)),typeof o.offset=="number"&&(c=c.offset(o.offset)),(await c.execute()).map(u)},upsertByEntityId:async(o,l)=>{let c=await t(),d=i.parse(l),s=new Date,y=await T(e,c,r).select("id").where("entity_id","=",o).executeTakeFirst();if(y?.id){await e.updateTable("corsair_entities").set({version:n,data:d,updated_at:s}).where("id","=",y.id).execute();let _=await e.selectFrom("corsair_entities").selectAll().where("id","=",y.id).executeTakeFirst();return u(_)}let f=x();await e.insertInto("corsair_entities").values({id:f,created_at:s,updated_at:s,account_id:c,entity_id:o,entity_type:r,version:n,data:d}).execute();let g=await e.selectFrom("corsair_entities").selectAll().where("id","=",f).executeTakeFirst();return u(g)},deleteById:async o=>{let l=await t(),c=await e.deleteFrom("corsair_entities").where("account_id","=",l).where("entity_type","=",r).where("id","=",o).executeTakeFirst();return Number(c.numDeletedRows)>0},deleteByEntityId:async o=>{let l=await t(),c=await e.deleteFrom("corsair_entities").where("account_id","=",l).where("entity_type","=",r).where("entity_id","=",o).executeTakeFirst();return Number(c.numDeletedRows)>0},count:async()=>{let o=await t(),l=await e.selectFrom("corsair_entities").select(c=>c.fn.countAll().as("count")).where("account_id","=",o).where("entity_type","=",r).executeTakeFirst();return le(l?.count)}}}var ye={corsair_integrations:B,corsair_accounts:R,corsair_entities:S,corsair_events:O};function fe(e){return ye[e]}function z(e){if(typeof e=="string")try{return JSON.parse(e)}catch{return e}return e}function p(e){if(!e)throw new Error("Corsair database is not configured. Pass `database` to createCorsair(...) to enable ORM.")}function k(e){if(!e)return[];let t=[];for(let r in e){let n=r,i=e[n];if(i!==void 0)if(typeof i=="object"&&i!==null&&!Array.isArray(i)&&!(i instanceof Date)){let a=i;"in"in a&&Array.isArray(a.in)?t.push({field:n,operator:"in",value:a.in}):"like"in a&&typeof a.like=="string"&&t.push({field:n,operator:"like",value:a.like})}else t.push({field:n,value:i})}return t}function m(e,t){if(!t?.length)return e;let r=e;for(let n of t){let i=n.operator??"=";r=r.where(n.field,i,n.value)}return r}function pe(e){return typeof e=="number"?e:typeof e=="bigint"?Number(e):Number.parseInt(String(e??0),10)}function E(e,t){let r=fe(t),n=()=>(p(e),e),i=()=>n().db.selectFrom(t),a=()=>n().db.insertInto(t),u=()=>n().db.updateTable(t),o=()=>n().db.deleteFrom(t);function l(d){let s={};for(let[y,f]of Object.entries(d))s[y]=z(f);return r.parse(s)}function c(d){let s={};for(let[y,f]of Object.entries(d))s[y]=z(f);return r.parse(s)}return{findById:async d=>{p(e);let s=i().selectAll();s=m(s,[{field:"id",value:d}]);let y=await s.executeTakeFirst();return y?l(y):null},findOne:async d=>{p(e);let s=i().selectAll();s=m(s,k(d));let y=await s.executeTakeFirst();return y?l(y):null},findMany:async d=>{p(e);let s=i().selectAll();return s=m(s,k(d?.where)),typeof d?.limit=="number"&&(s=s.limit(d.limit)),typeof d?.offset=="number"&&(s=s.offset(d.offset)),(await s.execute()).map(f=>l(f))},create:async d=>{p(e);let s=new Date,y={id:d.id??x(),created_at:s,updated_at:s,...d},f=await a().values(y).returningAll().executeTakeFirst();return f?l(f):c(y)},update:async(d,s)=>{p(e);let y={...s,updated_at:new Date},f=u().set(y).returningAll();f=m(f,[{field:"id",value:d}]);let g=await f.executeTakeFirst();return g?l(g):null},updateMany:async(d,s)=>{p(e);let y={...s,updated_at:new Date},f=i().select("id");f=m(f,k(d));let g=await f.execute();for(let _ of g){let F=u().set(y);F=m(F,[{field:"id",value:_.id}]),await F.execute()}return g.length},delete:async d=>{p(e);let s=o();s=m(s,[{field:"id",value:d}]);let y=await s.executeTakeFirst();return Number(y?.numDeletedRows??0)>0},deleteMany:async d=>{p(e);let s=o();s=m(s,k(d));let y=await s.executeTakeFirst();return Number(y?.numDeletedRows??0)},count:async d=>{p(e);let s=i().select(f=>f.fn.countAll().as("count"));s=m(s,k(d));let y=await s.executeTakeFirst();return pe(y?.count)}}}function ge(e){let t=E(e,"corsair_integrations");return{...t,findByName:r=>t.findOne({name:r}),upsertByName:async(r,n)=>{let i=await t.findOne({name:r});return i?await t.update(i.id,n):t.create({...n,name:r})}}}function me(e){let t=E(e,"corsair_accounts");return{...t,findByTenantAndIntegration:async(r,n)=>{p(e);let i=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();return i?t.findOne({tenant_id:r,integration_id:i.id}):null},listByTenant:(r,n)=>t.findMany({where:{tenant_id:r},limit:n?.limit,offset:n?.offset}),upsertByTenantAndIntegration:async(r,n,i)=>{let a=await t.findOne({tenant_id:r,integration_id:n});return a?await t.update(a.id,i):t.create({...i,tenant_id:r,integration_id:n})}}}function we(e){let t=E(e,"corsair_entities");return{...t,findByEntityId:({accountId:r,entityType:n,entityId:i})=>t.findOne({account_id:r,entity_type:n,entity_id:i}),findManyByEntityIds:async({accountId:r,entityType:n,entityIds:i})=>i.length===0?[]:(p(e),await e.db.selectFrom("corsair_entities").selectAll().where("account_id","=",r).where("entity_type","=",n).where("entity_id","in",i).execute()),listByScope:({accountId:r,entityType:n,limit:i,offset:a})=>t.findMany({where:{account_id:r,entity_type:n},limit:i,offset:a}),searchByEntityId:async({accountId:r,entityType:n,query:i,limit:a,offset:u})=>{p(e);let o=e.db.selectFrom("corsair_entities").selectAll().where("account_id","=",r).where("entity_type","=",n).where("entity_id","like",`%${i}%`);return typeof a=="number"&&(o=o.limit(a)),typeof u=="number"&&(o=o.offset(u)),await o.execute()},upsertByEntityId:async({accountId:r,entityType:n,entityId:i,version:a,data:u})=>{let o=await t.findOne({account_id:r,entity_type:n,entity_id:i});return o?await t.update(o.id,{version:a,data:u}):t.create({account_id:r,entity_type:n,entity_id:i,version:a,data:u})},deleteByEntityId:async({accountId:r,entityType:n,entityId:i})=>{p(e);let a=await e.db.deleteFrom("corsair_entities").where("account_id","=",r).where("entity_type","=",n).where("entity_id","=",i).executeTakeFirst();return Number(a.numDeletedRows)>0}}}function he(e){let t=E(e,"corsair_events");return{...t,listByAccount:(r,n)=>t.findMany({where:{account_id:r},limit:n?.limit,offset:n?.offset}),listByStatus:(r,n)=>{let i={status:r};return n?.accountId&&(i.account_id=n.accountId),t.findMany({where:i,limit:n?.limit,offset:n?.offset})},listPending:r=>{let n={status:"pending"};return r?.accountId&&(n.account_id=r.accountId),t.findMany({where:n,limit:r?.limit??100})},updateStatus:(r,n)=>t.update(r,{status:n})}}function L(e){return{integrations:ge(e),accounts:me(e),entities:we(e),events:he(e)}}function Ce(e,t,r,n,i){let a=null;async function u(){if(a!==null)return a;p(e);let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",t.integrationName).executeTakeFirst();if(!o)throw new Error(`Integration "${t.integrationName}" not found. Make sure to create the integration first.`);let l=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t.tenantId).where("integration_id","=",o.id).executeTakeFirst();if(!l)throw new Error(`Account not found for tenant "${t.tenantId}" and integration "${t.integrationName}". Make sure to create the account first.`);return a=l.id,a}return p(e),Q(e.db,u,r,n,i)}function J(e){let{database:t,integrationName:r,schema:n,tenantId:i}=e,a=L(t),u={tenantId:i,integrationName:r},o=null;async function l(){if(o!==null)return o;p(t);let d=await t.db.selectFrom("corsair_integrations").selectAll().where("name","=",r).executeTakeFirst();if(!d)throw new Error(`Integration "${r}" not found. Make sure to create the integration first.`);let s=await t.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",i).where("integration_id","=",d.id).executeTakeFirst();if(!s)throw new Error(`Account not found for tenant "${i}" and integration "${r}". Make sure to create the account first.`);return o=s.id,o}let c={};for(let[d,s]of Object.entries(n.entities))c[d]=Ce(t,u,d,n.version,s);return{...c,$orm:a,$integrationName:r,$tenantId:i,$getAccountId:l}}function Ye(e,t){let r=L(e);return{$tenantId:t,$orm:r,listAccounts:n=>r.accounts.listByTenant(t,n),findAccountByIntegration:n=>r.accounts.findByTenantAndIntegration(t,n),listEntities:async n=>{p(e);let i=await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).execute();if(i.length===0)return[];let a=i.map(o=>o.id),u=e.db.selectFrom("corsair_entities").selectAll().where("account_id","in",a);return n?.entityType&&(u=u.where("entity_type","=",n.entityType)),typeof n?.limit=="number"&&(u=u.limit(n.limit)),typeof n?.offset=="number"&&(u=u.offset(n.offset)),await u.execute()},listEvents:async n=>{p(e);let i=await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).execute();if(i.length===0)return[];let a=i.map(o=>o.id),u=e.db.selectFrom("corsair_events").selectAll().where("account_id","in",a);return n?.status&&(u=u.where("status","=",n.status)),typeof n?.limit=="number"&&(u=u.limit(n.limit)),typeof n?.offset=="number"&&(u=u.offset(n.offset)),await u.execute()},forIntegration:n=>J({database:e,integrationName:n.integrationName,schema:n.schema,tenantId:t})}}function qe(e,t){return{forTenant:r=>J({database:e,integrationName:t.integrationName,schema:t.schema,tenantId:r})}}export{A as a,D as b,N as c,G as d,X as e,Y as f,q as g,P as h,V as i,ee as j,_e as k,x as l,Q as m,ye as n,L as o,J as p,Ye as q,qe as r};

package/dist/chunk-WF4PUEHA.js

@@ -0,0 +1,66 @@
+import{a as ve,b as Yt,c as Qt}from"./chunk-4OLKWKJG.js";import{a as Ho,b as Te,c as Bo,d as v,e as j,f as Fo,g as z,h as $,i as I,j as $n,k as Uo,l as Wn,m as Vt,n as No,o as Lo}from"./chunk-VOH7OVWP.js";import{a as Mo}from"./chunk-F2EV3CHK.js";import{ZodBoolean as vl,ZodDate as Tl,ZodEnum as Pl,ZodNullable as Al,ZodNumber as Rl,ZodObject as xl,ZodOptional as Il,ZodRecord as Sl,ZodString as _l,ZodType as El}from"zod";var jn=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agilitycms","ahrefs","aimlapi","airtable","aivoov","alchemy","algolia","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","asana","ascora","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beeminder","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bitbucket","bitwarden","blazemeter","blocknative","bluesky","boloforms","boltiot","bonsai","botbaba","bookingmood","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brex","brightdata","browseai","browserless","browsertool","bubble","bugsnag","buildkite","cal","calendly","canva","canvas","capsulecrm","castingwords","certifier","chatbotkit","chatfai","circleci","clickhouse","clientary","clockify","cloudflare","cloudinary","collegefootballdata","confluence","connecteam","contentfulgraphql","contextsevenmcp","crowterminal","cursor","customgpt","databricks","datadog","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","dodopayments","doppler","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","epicgames","exa","facebook","faraday","figma","filloutforms","firecrawl","fireflies","formbricks","gemini","github","gitlab","gmail","googleaddressvalidation","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","htmltoimage","hubspot","huggingface","imgbb","insightoai","instagram","intercom","jigsawstack","jira","kaggle","linear","linkedin","loyverse","mailboxlayer","mailchimp","mailtrap","marketstack","merriamwebsterdict","monday","neon","nextdns","notion","ocrspace","ocrwebservice","ollama","onedrive","onepassword","openai","openrouter","openweathermap","oura","outlook","pagerduty","parseur","pdfmonkey","perplexityai","pinecone","posthog","razorpay","reddit","removebg","resend","retailed","salesforce","sapsuccessfactors","scaleai","scrapegraphai","securitytrails","sendgrid","sentry","serpapi","sharepoint","slack","sourcegraph","spotify","strava","streamtime","stripe","studiobyai21labs","supabase","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","timecamp","timelink","tinyurl","tisane","todoist","toggl","trello","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","unione","uniswapapi","vapi","vercel","vestaboard","wakatime","webflow","webvizio","whatsapp","witai","worldnewsapi","wiza","workday","workiom","xquik","youcom","youtube","zendesk","zohoinventory","zohomail","zoom","zoominfo"],$o={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",alchemy:"Alchemy",algolia:"Algolia",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",asana:"Asana",ascora:"Ascora",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beeminder:"Beeminder",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",botbaba:"Botbaba",bookingmood:"Bookingmood",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",cal:"Cal",calendly:"Calendly",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",castingwords:"CastingWords",certifier:"Certifier",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",circleci:"CircleCI",clickhouse:"Clickhouse",clientary:"Clientary",clockify:"Clockify",cloudflare:"Cloudflare",cloudinary:"Cloudinary",collegefootballdata:"College Football Data",confluence:"Confluence",connecteam:"Connecteam",contentfulgraphql:"Contentful GraphQL",contextsevenmcp:"Context7",crowterminal:"CrowTerminal",cursor:"Cursor",customgpt:"CustomGPT",databricks:"Databricks",datadog:"Datadog",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",dodopayments:"Dodo Payments",doppler:"Doppler",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",epicgames:"Epic Games",exa:"Exa",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",formbricks:"Formbricks",gemini:"Gemini",github:"GitHub",gitlab:"GitLab",gmail:"Gmail",googleaddressvalidation:"Google Address Validation",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailboxlayer:"MailboxLayer",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",monday:"Monday",neon:"Neon",nextdns:"NextDNS",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfmonkey:"PDFMonkey",perplexityai:"Perplexity AI",pinecone:"Pinecone",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",removebg:"remove.bg",resend:"Resend",retailed:"Retailed",salesforce:"Salesforce",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",securitytrails:"SecurityTrails",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",sourcegraph:"Sourcegraph",spotify:"Spotify",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",timecamp:"TimeCamp",timelink:"Timelink",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",trello:"Trello",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",unione:"Unione",uniswapapi:"Uniswap",vapi:"Vapi",vercel:"Vercel",vestaboard:"Vestaboard",wakatime:"WakaTime",webflow:"Webflow",webvizio:"Webvizio",whatsapp:"WhatsApp",witai:"WitAi",worldnewsapi:"World News API",wiza:"Wiza",workday:"Workday",workiom:"Workiom",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Pe(e){let n=$o[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var de=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function _(e){return typeof e=="string"&&e.length>0}function Ta(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Pa(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function qn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!_(n.connectUrl)||!_(n.token)||!_(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:_(n.environmentId)?n.environmentId:n.projectId};return _(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function Kn(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!_(r.tenantId)||!_(r.plugin)||!Ta(r.status)||!Pa(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:_(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function Zn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!_(n.approvalUrl)||!_(n.token)||!_(n.projectId)||!_(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function ze(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(_(n.access_token))return{access_token:n.access_token,refresh_token:_(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:_(n.scope)?n.scope:void 0};throw new Error(_(n.error)?_(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Aa(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Ra(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;_(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function xa(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function Wo(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!_(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!_(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",s=Ra(o.fields),a=Aa(o.missingRequiredFields),c=xa(o.status,o.connected,s,a);t.push({plugin:o.plugin,providerName:_(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:s,missingRequiredFields:a})}return{tenantId:n.tenantId,plugins:t}}function Gn(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function jo(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}function qo(e){return e.replace(/\/$/,"")}function Xt(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return ve()}catch{return null}}function Ko(e){let n=Xt(e);return n?{"x-corsair-delivery-url":n}:{}}async function Zo(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Ia(e,n,t){if(n===404&&t)return t;let r=Gn(e);return r||`Hub API returned HTTP ${n}`}function Go(e,n,t){let r=jo(e);throw r?new de({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(Ia(e,n,t))}async function x(e){let n=qo(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...Ko(e.hub)},body:JSON.stringify(e.body)}),r=await Zo(t);return t.ok||Go(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function W(e){let n=qo(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...Ko(e.hub)}}),r=await Zo(t);return t.ok||Go(r,t.status,e.notFoundMessage),e.parseResponse(r)}function zn(e){return e&&typeof e=="object"?e:{}}function zo(e){let n=zn(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function er(e,n){return x({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=zn(t);return{chat:r.thread,reply:zo(r.reply)}}})}async function nr(e,n){return x({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:zo})}async function tr(e,n){return W({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=zn(t).threads;return Array.isArray(r)?r:[]}})}async function rr(e,n){return W({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=zn(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Ha}from"crypto";var Sa="corsair:client-bridge";function or(e){return new URL(e).origin}function Je(e){let n=JSON.stringify({type:Sa,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(or(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var _a=new Set(["localhost","127.0.0.1","[::1]","::1"]);function ir(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:_a.has(n)}catch{return!1}}function Cn(e){return e==="development"?"browser":"server"}function Jo(e){return Cn(e)==="browser"}function Vo(e){return ir(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Ma}from"crypto";var Ae=60*1e3,Be=300*1e3;import{createHmac as Ea,randomBytes as Da,timingSafeEqual as Oa}from"crypto";function pe(){return Da(16).toString("base64url")}function vn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Ea("sha256",t).update(e).digest("base64url")}function se(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let s=vn(o,t);try{if(!Oa(Buffer.from(i,"utf8"),Buffer.from(s,"utf8")))return null}catch{return null}let a;try{a=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return a.exp*1e3<Date.now()?null:a}function Jn(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),s=vn(i,n);return`${i}.${s}`}function Tn(e,n,t){let r=Math.floor(Date.now()/1e3);return Jn(e,n,r+Math.floor(t/1e3))}function Fe(e){return decodeURIComponent(e)}function sr(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function Yo(e){let n=e.trim();return n.length>0?n:null}function Ve(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function Ye(e,n){if(!Yo(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Ma(16).toString("base64url"),iat:t,exp:t+Math.floor(Ae/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=vn(o,n);return`${o}.${i}`}function Re(e,n){return Yo(n)?se(e,n):null}function Ba(e){let n=or(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function ar(e){let n=Ye(Ba(e),e.signingSecret);return Ve(e.deliveryUrl,n)}function Qo(e){if(Cn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Ha(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:ar(r)}}var Pn="https://auth.corsair.dev";var ge=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},An=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function cr(e){let n=(e.apiUrl?.trim()||Pn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"";if(!t||!r)throw new An;return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function Vn(e){return cr(e)}function Fa(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function F(e){let n=v(e).hub;if(!n||!Fa(n))throw new ge;return n}function Xo(e){return e.replace(/\/$/,"")}function Yn(e){return e.oauthCallbackUrl?Xo(e.oauthCallbackUrl.trim()):`${Xo(e.apiUrl)}/oauth/callback`}function Qe(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}import{createCipheriv as ei,createDecipheriv as ni,randomBytes as Qn,scrypt as Ua}from"crypto";import{promisify as Na}from"util";var ti=Na(Ua),Xn="aes-256-gcm",ri=12,et=16,La=16,Ue=32;function fe(){return Qn(Ue).toString("base64")}async function ye(e,n){let t=Qn(La),r=await ti(n,t,Ue),o=Qn(ri),i=ei(Xn,r,o,{authTagLength:et}),s=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),a.toString("base64"),s.toString("base64")].join(":")}async function Y(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),l=Buffer.from(i,"base64"),u=await ti(n,s,Ue),d=ni(Xn,u,a,{authTagLength:et});return d.setAuthTag(c),Buffer.concat([d.update(l),d.final()]).toString("utf8")}function ur(e,n){let t=Buffer.from(n,"base64"),r=Qn(ri),o=ei(Xn,t,r,{authTagLength:et}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[r.toString("base64"),s.toString("base64"),i.toString("base64")].join(":")}function Rn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),l=ni(Xn,i,s,{authTagLength:et});return l.setAuthTag(a),Buffer.concat([l.update(c),l.final()]).toString("utf8")}function xe(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=ur(o,n);return t}function me(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=Rn(o,n);return t}function xn(e,n,t){let r=me(e,n);return xe(r,t)}function oi(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let s=[null,void 0,""].includes(i)?null:i;await n({[o]:s})};return r}var lr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function U(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,s=[...$[n].integration,...i],a=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(a)return a;let k=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!k)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return a={id:k.id,config:lr(k.config),dek:k.dek??null},a},updateIntegration:async k=>{let b=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...k.config!==void 0?{config:k.config}:{},...k.dek!==void 0?{dek:k.dek}:{},updated_at:new Date}).where("id","=",b.id).execute(),a=null}},l=null,u=async()=>{if(l)return l;let k=await c.getIntegration();if(!k.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await Y(k.dek,r),l},d=async()=>{let k=await c.getIntegration(),b=await u(),C=k.config;return!C||Object.keys(C).length===0?{}:me(C,b)},p=Promise.resolve(),g=k=>{let b=p.then(()=>f(k));return p=b.catch(()=>{}),b},f=async k=>{let b=await u(),C;try{C=await d()}catch(D){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,D),C={}}let P={...C};for(let[D,H]of Object.entries(k))H===null?delete P[D]:P[D]=H;let O=xe(P,b);await c.updateIntegration({config:O})};return{get_dek:u,issue_new_dek:async()=>{let k=await c.getIntegration(),b=fe(),C={};if(k.dek){let O=await Y(k.dek,r),D=k.config;D&&Object.keys(D).length>0&&(C=xn(D,O,b))}let P=await ye(b,r);return await c.updateIntegration({config:C,dek:P}),l=b,b},...oi(d,g,s)}}function B(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:s=[],ensureProvisioned:a}=e,c=[...$[n].account,...s],l=null,u=null,d=async()=>{if(u)return u;let w=!1;for(;;){let A=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!A){if(!w&&a){w=!0,await a();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return u={id:A.id,config:lr(A.config),dek:A.dek??null},u}},p={kek:o,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(l)return l;let w=!1;for(;;){let A=await d(),R=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",A.id).executeTakeFirst();if(!R){if(!w&&a){w=!0,await a();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return l={id:R.id,config:lr(R.config),dek:R.dek??null},l}},updateAccount:async w=>{let A=await p.getAccount();await i.db.updateTable("corsair_accounts").set({...w.config!==void 0?{config:w.config}:{},...w.dek!==void 0?{dek:w.dek}:{},updated_at:new Date}).where("id","=",A.id).execute(),l=null}},g=null,f=null,h=async()=>{if(g)return g;let w=await p.getAccount();if(!w.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return g=await Y(w.dek,o),g},k=async()=>{if(f)return f;let w=await p.getIntegration();if(!w.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await Y(w.dek,o),f},b=async()=>{let w=await p.getAccount(),A=await h(),R=w.config;return!R||Object.keys(R).length===0?{}:me(R,A)},C=async()=>{let w=await p.getIntegration(),A=await k(),R=w.config;return!R||Object.keys(R).length===0?{}:me(R,A)},P=Promise.resolve(),O=w=>{let A=P.then(()=>D(w));return P=A.catch(()=>{}),A},D=async w=>{let A=await h(),R;try{R=await b()}catch(S){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,S),R={}}let J={...R};for(let[S,te]of Object.entries(w))te===null?delete J[S]:J[S]=te;let le=xe(J,A);await p.updateAccount({config:le})},H={get_dek:h,issue_new_dek:async()=>{let w=await p.getAccount(),A=fe(),R={};if(w.dek){let le=await Y(w.dek,o),S=w.config;S&&Object.keys(S).length>0&&(R=xn(S,le,A))}let J=await ye(A,o);return await p.updateAccount({config:R,dek:J}),g=A,A},...oi(b,O,c)};return n==="oauth_2"&&(H.get_integration_credentials=async()=>{let w=await C();return{...w,client_id:w.client_id||null,client_secret:w.client_secret||null,redirect_url:w.redirect_url??null}}),H}async function ii(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=fe(),i=await ye(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function si(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let s=fe(),a=await ye(s,r);return await e.db.updateTable("corsair_accounts").set({dek:a,updated_at:new Date}).where("id","=",i.id).execute(),s}var $a=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function Ie(e){return $a.has(e)}function Wa(e,n){return Ie(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function ja(e){return!Ie(e)}function qa(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function Ka(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function Za(e,n){let t=i=>n.find(s=>s.level==="account"&&s.name===i);if(!qa(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function ai(e,n){if(!e)return!1;let t=z(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function Ga(e,n){let r=e.authConfig?.[n]?.integration??[];return[...$[n].integration,...r]}function za(e,n){let r=e.authConfig?.[n]?.account??[];return[...$[n].account,...r]}function Ja(e,n,t){let r=t.filter(a=>a.required&&!a.configured).map(a=>a.name),o=t.filter(a=>a.level==="integration"&&a.required&&!a.configured).map(a=>a.name),i=t.filter(a=>a.level==="account"&&a.required&&a.configured),s;return o.length>0?s="missing_integration":r.length===0?s="ready":i.length>0?s="partial":s="not_started",{plugin:e,authType:n,status:s,connected:Za(n,t),fields:t,missingRequiredFields:r}}async function Ne(e,n,t){let r=I(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,s=i?.[r]?.integration??[],a=i?.[r]?.account??[],c=U({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:s}),l=B({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:a}),u=Ga(n,r),d=za(n,r),p=[];for(let g of u)p.push({name:g,level:"integration",required:Wa(r,g),configured:await ai(c,g)});for(let g of d)p.push({name:g,level:"account",required:ja(g),configured:await ai(l,g)});if(Ka(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return Ja(n.id,r,p)}async function In(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let s of e.plugins){if(o&&!o.has(s.id))continue;let a=await Ne(e,s,r);a&&i.push(a)}return i}function nt(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var ci=Symbol.for("corsair:internal"),ui=new WeakMap,li=new WeakMap;function Va(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function Ya(e){if(e.database){let t=ui.get(e.database);return t||(t=new Map,ui.set(e.database,t)),t}let n=li.get(e);return n||(n=new Map,li.set(e,n)),n}function Qa(e){return e.multiTenancy?{withTenant:()=>({}),[ci]:e}:{[ci]:e}}async function Xe(e,n){if(!e.database)return;let t=n.trim()||"default",r=Ya(e),o=Va(t,e.plugins),i=r.get(o);if(i){await i;return}let s=(async()=>{let{setupCorsair:a}=await import("./setup-4T6WNQZO.js");await a(Qa(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,s),await s}import*as Sn from"crypto";function Se(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function dr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function en(e,n){let t=Sn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var pr=600*1e3;function tt(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Sn.createHmac("sha256",n).update(r).digest("base64url"),s=Buffer.from(o,"base64url"),a=Buffer.from(i,"base64url");return s.length!==a.length||!Sn.timingSafeEqual(s,a)?null:dr(r,{maxAgeMs:pr})}function di(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function pi(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function nn(e,n){await x({hub:e,path:"/connections/report",body:di(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function Xa(e,n){try{let t=F(e);x({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof ge)return}}async function ec(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!I(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ne(n,e.plugin,r);o&&fi(e.hub,pi({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function gi(e,n){Xa(e,n)}function fi(e,n){x({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function tn(e){ec(e).catch(()=>{})}async function he(e,n){let t=v(e);if(!I(n.plugin))return;let o=await Ne(t,n.plugin,n.tenantId);o&&gi(e,pi({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function rt(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var yi=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function nc(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function tc(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await Y(n.dek,e.kek),r=yi(n.config),o={};Object.keys(r).length>0&&(o=me(r,t)),o[e.link.linkType]=e.link.externalId;let i=xe(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function rn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:s,extraAccountFields:a=[]}=e,{accountId:c}=await nc({database:n,pluginId:r,tenantId:o}),l=!1;if(s){let u=B({authType:s,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:a}),d=`set_${i.linkType}`,p=u[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await tc({database:n,kek:t,accountId:c,link:i})}async function gr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,s=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let a of s)if(a.dek)try{let c=await Y(a.dek,t),u=yi(a.config)[o];if(!u)continue;if(Rn(u,c)===i)return a}catch{continue}return null}async function ot(e){return(await gr(e))?.tenant_id??null}async function mi(e){return ot({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as hi from"querystring";function Le(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${hi.stringify(i)}`}async function bi(e,n){try{return await W({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function on(e,n,t,r){if(!n.subscribe)return;let o=F(e),i=await bi(o,n.id);if(!i)return;let s=await n.subscribe({keys:r},{webhookUrl:i});s&&await he(e,{plugin:n,tenantId:t,verified:!0,webhookLink:s.webhookLink,webhookSecret:s.webhookSecret})}var q=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function ki(e){let n=e.oauthConfig;if(!n)throw new q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function rc(e,n,t,r){let o=Lo(e),i=await o.integrations.findByName(n);if(!i)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.accounts.findOne({tenant_id:t,integration_id:i.id}))return;let a=fe(),c=await ye(a,r);await o.accounts.create({tenant_id:t,integration_id:i.id,config:{},dek:c})}async function fr(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,s=v(e,()=>new q("invalid_corsair_instance","Invalid corsair instance"));if(!s.database)throw new Error("No database configured on corsair instance");let a=j(s,n,p=>new q("plugin_not_found",p)),c=ki(a),u=await U({authType:"oauth_2",integrationName:n,kek:s.kek,database:s.database}).get_client_id();if(!u)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Le({oauthConfig:c,clientId:u,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=en(Se(n,r),s.kek);return{url:Le({oauthConfig:c,clientId:u,redirectUri:o,state:d}),state:d}}function oc(e,n){return{...n??{},...e}}async function _n(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new q("invalid_corsair_instance","Invalid corsair instance")),s,a;if(n.trusted){if(!n.plugin||!n.tenantId)throw new q("invalid_state","trusted callback requires plugin and tenantId");s=n.plugin,a=n.tenantId}else{let h=tt(r,i.kek);if(!h)throw new q("invalid_state","Invalid or tampered state parameter");s=h.plugin,a=h.tenantId}if(!i.database)throw new q("no_database","No database configured on corsair instance");let c=j(i,s,h=>new q("plugin_not_found",h)),l=ki(c),u=U({authType:"oauth_2",integrationName:s,kek:i.kek,database:i.database}),d=await u.get_client_id(),p=await u.get_client_secret();if(!d||!p)throw new q("credentials_not_configured",`Credentials not configured for '${s}'`);await rc(i.database,s,a,i.kek);let g=await it(t,d,p,l,o);if(!g.access_token)throw new q("no_access_token",`No access_token returned from ${l.providerName}`);let f=B({authType:"oauth_2",integrationName:s,tenantId:a,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await he(e,{plugin:c,tenantId:a}).catch(()=>{});try{let h=oc(g,n.callbackParams),k=await rt(i.plugins,s,h);if(k){try{let b=c.authConfig?.oauth_2?.account??[];await rn({database:i.database,kek:i.kek,pluginId:s,tenantId:a,link:k,authType:"oauth_2",extraAccountFields:b})}catch(b){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${a}':`,b)}i.hub&&nn(i.hub,{plugin:s,tenantId:a,link:k,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${a}':`,h)}if(c.subscribe)try{await on(e,c,a,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${s}' tenant '${a}':`,h)}return{plugin:s,tenantId:a}}async function ic(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??on,i=[],s=[];if(!t.database)return{renewed:i,failed:s};for(let a of r){let c=t.plugins.find(u=>u.id===a.integrationName);if(!c?.subscribe)continue;let l=`${c.id}/${a.tenantId}`;try{let u=I(c)??"oauth_2",d=B({authType:u,integrationName:c.id,tenantId:a.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[u]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:u,keys:g,hub:t.hub},"endpoint")}await o(n,c,a.tenantId,d),i.push(l)}catch(u){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,u),s.push(l)}}return{renewed:i,failed:s}}async function wi(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return ic({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function sc(e,n={}){let t=!1,r=()=>{t||(t=!0,wi(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function Ci(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await st(e,{silent:!0})}async function sn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await Xe(t,n)}var ac=Symbol.for("corsair:internal"),cc=new Set(["access_token","refresh_token","expires_at","scope"]);function uc(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function lc(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!Ie(t)&&!cc.has(t)):n.filter(t=>!Ie(t))}function vi(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function dc(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function pc(e){return{[ac]:vi(e)}}async function at(e,n,t={}){let r=Yn(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,s=vi(e),a=pc(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let l=I(c);if(!l)continue;let u=uc(l),d=t.providerNameOverrides?.[c.id]??Pe(c.id),p=await Ne(s,c,n),g=$n(c,l),f=lc(l,g),h={plugin:c.id,providerName:d,authKind:u,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),u==="oauth"){let b=t.oauthModeOverrides?.[c.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=b,!t.skipOAuthUrlGeneration&&b!=="managed")try{let C=await fr(a,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=C.url}catch(C){C instanceof Error&&/client_id not configured/i.test(C.message)||(h.setupError=C instanceof Error?C.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function rg(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return at({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function Ti(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await Xe(e.internalConfig??dc(e),n)}async function Pi(e,n){await sn(e,n)}async function Ai(e,n){let t=Qe(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=ve({deliveryUrl:n.deliveryUrl})),x({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:qn})}async function Ri(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await Ti(t,n.tenantId);let r=await at(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return Ai(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function ct(e,n){let t=v(e),r=F(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Pi(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,s=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await at(o,n.tenantId,{pluginIds:i,oauthModeOverrides:s,providerNameOverrides:a});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return Ai(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function ut(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(s=>s.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await gc(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function gc(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-RKJGRKPQ.js"),{postHubConnectSession:i}=await import("./connect-NOJMH2UE.js"),s={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(s,t.tenantId);let a=await r(s,t.tenantId,{pluginIds:t.pluginIds});if(a.length===0)throw new Error("No connectable plugins found for this tenant");let c=a.find(l=>l.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:a})}function an(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var Q=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function fc(e){let n=e.oauthConfig;if(!n)throw new Q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function yr(e,n){let t=v(e,()=>new Q("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new Q("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new Q("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=tt(n,t.kek);if(!o)throw new Q("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:s}=o,a=j(t,i,p=>new Q("plugin_not_found",p)),c=fc(a),u=await U({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!u)throw new Q("client_id_not_configured",`client_id not configured for '${i}'`);let d=Le({oauthConfig:c,clientId:u,redirectUri:r,state:n});return{plugin:i,tenantId:s,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as mc}from"async_hooks";import{randomBytes as hc}from"crypto";import{v4 as bc}from"uuid";async function lt(e,n){let t=Qe(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=ve({deliveryUrl:n.deliveryUrl})),x({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Zn})}function dt(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var mr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function br(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function xi(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function hr(e){return dt(e)}async function kr(e,n){if(br(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?xi(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await lt(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:yc(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function yc(e){try{return JSON.parse(e)}catch{return e}}async function pt(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await kr(e,n);return{...n,approvalUrl:r}}async function wr(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:s,endpoint:a,args:c,tenantId:l,expiresAt:u,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:s,endpoint:a,args:c});let g=await kr({manual:t,hub:r},{id:o,token:i,plugin:s,endpoint:a,args:JSON.stringify(c),tenant_id:l,expires_at:u});return br(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):hr(g):mr:r?g?hr(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:mr}var cn=class extends Error{constructor(n){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError"}};var Si=new mc,gt=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function Cr(e){return Si.run(!0,e)}function _i(){return Si.getStore()===!0}function vr(e,n){if(_i()&&n!=="read")throw new gt(e,n)}var kc={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function wc(e,n,t){return t!==void 0?t:kc[n][e]}function Tr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Ei(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Ii(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Di(e){let n=wc(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, update the permission mode or add an override in your corsair config.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),s=e.tenantId??"default",a=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",s).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(a){if(a.status==="approved"){let f=e.db,h=a.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return a.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${a.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Ii(e.db,a.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:a.id,token:a.token,expiresAt:a.expires_at})}let c=bc(),l=hc(32).toString("hex"),u=e.timeoutMs??600*1e3,d=new Date(Date.now()+u).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:c,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:s,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${c}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Ii(e.db,c,u):{result:"blocked",reason:"pending",id:c,token:l,expiresAt:d}}var T=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function E(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function ae(e){let n={error:e.code,message:e.message,...e.extra};return E(e.status,n)}function _e(e){return new T(404,"not_found",e)}function be(e,n={}){return new T(400,"bad_request",e,n)}function Oi(e,n){return j(e,n,t=>_e(t))}async function Mi(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=U({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=$[t].integration,i=r,s;try{s=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{s=o.map(()=>null)}let a=o.filter((l,u)=>s[u]==null),c;return t==="oauth_2"?c=!a.includes("client_id")&&!a.includes("client_secret"):c=a.length===0,{configured:c,missingFields:a}}async function Hi(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await Mi(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function ft(){return{ok:!0}}async function un(e){return Promise.all(e.plugins.map(n=>Hi(n,e)))}async function yt(e,n){let t=Oi(e,n);return Hi(t,e)}async function Cc(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function Bi(e,n){let t=await Cc(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function ln(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let s=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:s}),s&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function mt(e,n){if(!n)throw be("Tenant id must be a non-empty string");return Bi(e,n)}async function ht(e,n){let t=n?.id?.trim();if(!t)throw be("Tenant id is required",{missingFields:["id"]});return Bi(e,t)}async function bt(e,n){let t=n?.trim()||"default",r={},o=await In(e,t);for(let i of o)r[i.plugin]=nt(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function Pr(e,n){if(!e.database)throw _e(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw _e(`Permission '${n}' not found`);return pt(e,t)}function vc(e){if(!e.oauthConfig)throw be(`Plugin '${e.id}' has no oauthConfig`)}function Tc(e){if(!e.manual)throw new T(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function Ar(e){let n=Tc(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new T(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function Pc(e){let n=!!e.hub,t=an(e.manual);if(!n&&!t)throw new T(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function Fi(e){if(!e.database||!e.kek)throw new T(500,"database_not_configured","A database and kek are required to issue connect links.")}async function Ac(e,n){let t=n?.plugin?.trim();if(!t)throw be("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=Oi(e,t);vc(o);let i=Ar(e);Fi(e);let s=await Mi(o,e);if(!s.configured)throw new T(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:s.missingFields});let a=en(Se(t,r),e.kek),c;try{c=new URL(i.baseUrl)}catch{throw new T(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return c.searchParams.set("state",a),{connectUrl:c.toString(),expiresAt:new Date(Date.now()+pr).toISOString(),tenantId:r}}async function Rc(e,n,t){Fi(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let s=t.providerName?.trim();s&&(o.providerName=s);let a=await ct(e,o);return{connectUrl:a.connectUrl,expiresAt:a.expiresAt,tenantId:r}}async function kt(e,n,t){return Pc(n),n.hub?Rc(e,n,t):Ac(n,t)}async function wt(e,n,t){if(n.hub&&!an(n.manual))throw new T(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw be("state is required",{missingFields:["state"]});Ar(n);try{return await yr(e,r)}catch(o){if(o instanceof Q)switch(o.code){case"invalid_state":throw be("Invalid or expired state");case"client_id_not_configured":throw new T(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new T(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function Ct(e,n,t){if(n.hub&&!an(n.manual))throw new T(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw be("Missing required fields",{missingFields:i});let s=Ar(n),{processOAuthCallback:a}=await import("./oauth.js");try{return await a(e,{code:r,state:o,redirectUri:s.redirectUri,callbackParams:t.callbackParams})}catch(c){if(c instanceof Error&&c.name==="OAuthCallbackError")switch(c.code){case"invalid_state":throw be("Invalid or expired state");case"credentials_not_configured":throw new T(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new T(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function Rr(e,n){if(!e.database)throw _e("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw _e("Permission not found");return pt(e,t)}async function Ui(e,n){return"id"in n?Pr(e,n.id):Rr(e,n.token)}import{createCipheriv as Oc,createDecipheriv as uf,randomBytes as Wi,scryptSync as Mc}from"crypto";import{createHmac as xr,randomUUID as xc,timingSafeEqual as Li}from"crypto";function Ir(e){return e.run??null}function Sr(e){return e.probe??null}function $i(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function vt(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=xr("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":xc()}}}function _r(e){let n=e.signingSecret.trim();if(!n)return!1;let t=$i(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>Be)return!1;let i=xr("sha256",n).update(e.body).digest("hex");try{return Li(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function dn(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=$i(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>Be)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=xr("sha256",n).update(e.body).digest("hex");try{if(!Li(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function pn(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function Tt(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function Pt(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function En(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function Er(e){return En(pn(e))}async function Dr(e){let n=await xt({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=pn(n.body),r=Tt({httpOk:n.ok,status:n.status,body:t}),o=En(t);if(!r||!o)throw new Error(Rt({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function At(e){return Pt(pn(e))}function Ic(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function Ni(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var Sc="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",_c="Check the delivery URL configured for this environment.";function Ec(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${Sc}`}function Dc(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${_c}`}function Dn(e,n){let t=Ic(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function Rt(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Dn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return Ec(e);if(e.status===404)return Dc(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${Ni(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${Ni(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}async function xt(e){let{body:n,headers:t}=vt(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Dn(e.deliveryUrl,r)}}}var Hc="aes-256-gcm",Bc=12,Fc=16,Uc=16,Nc=32;function Lc(e,n){return Mc(e.trim(),n,Nc)}function Or(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=Wi(Uc),o=Lc(t,r),i=Wi(Bc),s=Oc(Hc,o,i,{authTagLength:Fc}),a=JSON.stringify(e),c=Buffer.concat([s.update(a,"utf8"),s.final()]),l=s.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),c.toString("base64")].join(":")}var $c=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function Mr(e){if(e instanceof Ho)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!$c.some(t=>n.includes(t))}function Wc(e){if(!e)return[];let n=I(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!Ie(r)):[]}async function On(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await st(e,{silent:!0});let[r,o]=await Promise.all([ln(t),un(t)]),i={tenants:r.map(s=>({id:s.id})),plugins:o.map(s=>{let a=Wc(t.plugins.find(c=>c.id===s.id));return{id:s.id,authType:s.authType,configured:s.configured,missingFields:s.missingFields,...a.length>0?{integrationCredentialFields:a}:{}}}),syncedAt:new Date().toISOString()};return Or(i,n)}var ce=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function It(e,n){let t=v(e,()=>new ce("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ce("no_database","Database not configured");let r=j(t,n.plugin,u=>new ce("plugin_not_found",u)),o=I(r);if(!o)throw new ce("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new ce("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await sn(e,n.tenantId);let i=new Set($n(r,o)),a=r.authConfig?.[o]?.account??[],c=B({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:a}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new ce("invalid_credentials",`Unknown credential field '${u}' for plugin '${n.plugin}'`);let p=z(c,`set_${u}`);if(!p)throw new ce("invalid_credentials",`Cannot set credential field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ce("invalid_credentials","Provide at least one credential field to save");return await he(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var ue=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function Hr(e,n){let t=v(e,()=>new ue("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ue("no_database","Database not configured");let r=j(t,n.plugin,u=>new ue("plugin_not_found",u)),o=I(r);if(!o)throw new ue("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await Ci(e);let i=new Set(Uo(r,o)),a=r.authConfig?.[o]?.integration??[],c=U({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:a}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new ue("invalid_credentials",`Unknown integration credential field '${u}' for plugin '${n.plugin}'`);let p=z(c,`set_${u}`);if(!p)throw new ue("invalid_credentials",`Cannot set integration field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ue("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var St=new Map;function jc(e){for(let[n,t]of St)t<=e&&St.delete(n)}function _t(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();jc(r);let o=St.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(St.set(t,r+n),{ok:!0})}var Ee=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function gn(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:s,scope:a,authType:c="managed",providerData:l}=n;if(!o.trim())throw new Ee("no_access_token","Managed OAuth delivery missing access_token");let u=v(e,()=>new Ee("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new Ee("no_database","No database configured on corsair instance");let d=j(u,t,g=>new Ee("plugin_not_found",g));await sn(e,r);let p=B({authType:c,integrationName:t,tenantId:r,kek:u.kek,database:u.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),s&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+s)),a&&await p.set_scope(a),await he(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await rt(u.plugins,t,{access_token:o,refresh_token:i,scope:a,...l});if(g){try{let f=d.authConfig?.[c]?.account??[];await rn({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:g,authType:c,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}u.hub&&nn(u.hub,{plugin:t,tenantId:r,link:g,authType:c})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await on(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function qc(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function ji(e,n,t=[]){for(let[r,o]of Object.entries(e))if(qc(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=ji(o,n,[...t,r]);if(i)return i}return null}function Kc(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function Zc(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function qi(e,n,t,r,o){let i=Kc(n),s=typeof t=="string"?JSON.parse(t):t;(!s||typeof s=="object"&&Object.keys(s).length===0)&&i["x-goog-resource-uri"]&&(s=Zc(i)||s);let c={headers:i,body:s,...r?{query:r}:{}},l=r?.tenantId||"default",u=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:jn;for(let g of p){let f=u[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(c))continue;let h=ji(f.webhooks,c);if(!h)continue;let k=h.path.join("."),b={payload:s,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let C=await h.webhook.handler(b),P=!!Object.keys(C.returnToSender||{})?.length;return{plugin:g,action:k,body:s,response:P?{...C?.returnToSender,success:!0}:{success:!0},...C.responseHeaders&&{responseHeaders:C.responseHeaders}}}catch(C){return console.error(`Error executing webhook handler for ${g}.${k}:`,C),{plugin:g,action:k,body:s,response:{success:!1,error:C instanceof Error?C.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as Gc}from"crypto";import*as $e from"vm";var Ki="__corsairFailedStep",zc=3e4,Br=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function Zi(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function Gi(e,n){return`st_${Gc("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function Et(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var zi=new Set(["constructor","prototype","__proto__"]);function ke(e,n){if(e===null)return null;let t=typeof e;return t==="function"?Vc(e,n):t==="object"?Jc(e):e}function Jc(e){return new Proxy(e,{get(n,t){if(!zi.has(t))return ke(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Vc(e,n){return new Proxy(e,{apply:(t,r,o)=>Yc(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!zi.has(r))return ke(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Yc(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>ke(n,void 0),n=>{throw ke(n,void 0)}):ke(e,void 0)}function Qc(e){let n=Object.create(null),t=$e.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=$e.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),s=$e.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),c=$e.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=ke(e.corsair,void 0),n.__payload=o,n.__step=s,n.__console=c;let l=$e.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let u,d=new Promise((p,g)=>{u=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(u))}async function Fr(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(s,a)=>{if(o)throw o;let c=r++,l=Gi(s,c);if(Object.hasOwn(n,l))return ke(n[l].output,void 0);try{let u=await a();return t.push({stepId:l,name:s,seq:c,status:"completed",output:u}),u}catch(u){if(Zi(u))throw u;let d=Et(u);t.push({stepId:l,name:s,seq:c,status:"failed",error:d});let p=new Error(d);throw p[Ki]=s,p}});i.sleep=async(s,a)=>{if(o)throw o;let c=r++,l=Gi(s,c);if(Object.hasOwn(n,l))return;t.push({stepId:l,name:s,seq:c,status:"completed",output:null});let u=Number.isFinite(a)?Math.max(0,a):0;throw o=new Br(Date.now()+u,s),o};try{await Qc({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??zc});let s=o;return s?{status:"sleeping",steps:t,sleepUntil:new Date(s.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(s){if(Zi(s))return{status:"sleeping",steps:t,sleepUntil:new Date(s.wakeAt).toISOString()};let a=Et(s),c=s!==null&&typeof s=="object"?s[Ki]:void 0;return{status:"failed",steps:t,error:{message:a,...c?{failedStep:c}:{}}}}}import*as Dt from"vm";var Ji=1e4;async function Ur(e){let n=Object.create(null),t=Dt.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=ke(e.corsair,void 0);let r=eu(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await Cr(()=>{let s=Dt.runInContext(o,t,{filename:"corsair:probe",timeout:r});s.catch(()=>{});let a,c=new Promise((l,u)=>{a=setTimeout(()=>u(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([s,c]).finally(()=>clearTimeout(a))});return{status:"ok",value:Xc(i)}}catch(i){return{status:"error",error:Et(i)}}}function Xc(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function eu(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?Ji:Math.min(e,Ji)}function We(e){return e.deliveryMode==="auth.credentials"}function Mn(e){return e.deliveryMode==="connections.sync"}function Ot(e){return e.deliveryMode==="connect.create_link"}function Hn(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function Bn(e){return e.deliveryMode==="oauth.tokens"}function Mt(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!We(e)&&!Mn(e)&&!Ot(e)&&!Hn(e)&&!Bn(e)}function nu(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function tu(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await On(e,n)}}}}}catch(t){return{status:"failed",retryable:Mr(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function ru(e,n){try{let t=await ut(e,n);return nu(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function Nr(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function ou(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await ot({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function iu(e,n,t,r){let o=await ou(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},s=await qi(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!s.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(s.response&&s.response.success===!1)return{status:"failed",retryable:!1,error:typeof s.response.error=="string"?s.response.error:"Webhook handler failed"};let a=s.response?.returnToSender,c=a&&typeof a=="object"&&typeof a.validationToken=="string"&&Object.keys(a).length===1?a.validationToken:a||(s.response?.data??s.response);return{status:"ok",webhookResponse:{status:s.response?.statusCode??200,body:c,headers:s.responseHeaders}}}async function su(e,n){return await _n(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function au(e,n){return await gn(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function $r(e,n,t){let r=await Lr(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function Lr(e,n,t){let r=v(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),s=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return s?s.status!=="pending"?{status:"ok"}:s.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",s.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",s.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function cu(e,n){try{return await It(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function uu(e,n){try{return await Hr(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function Vi(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function lu(e,n){try{let t=Vi(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await Fr({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function du(e,n){try{let t=Vi(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await Ur({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function Fn(e,n,t={}){let r=v(e),o=Nr(n.headers,"x-corsair-signature"),i=Nr(n.headers,"x-corsair-timestamp"),s=Nr(n.headers,"x-corsair-nonce"),a=!1;if(t.signingSecret?.trim()){let l=dn({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!l.ok)return{status:"failed",retryable:!1,error:l.error};if(!s?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let u=_t(`nonce:${s.trim()}`,Be);if(!u.ok)return{status:"failed",retryable:!1,error:u.error};a=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let c;try{c=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(c.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(c.type){case"webhook":return iu(e,r,c.payload,a);case"oauth.callback":return su(e,c.payload);case"oauth.tokens":return au(e,c.payload);case"permission.approve":return Lr(e,c.payload,"approved");case"permission.deny":return Lr(e,c.payload,"denied");case"auth.credentials":return cu(e,c.payload);case"integration.credentials":return uu(e,c.payload);case"connect.create_link":return ru(e,c.payload);case"connections.sync":{let l=t.signingSecret?.trim();return l?tu(e,l):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?lu(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?du(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(c.type)}`}}}function pu(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var Wr=3,gu=250;function fu(e){return e?.name==="AbortError"}async function yu(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function mu(e,n,t,r,o){for(let i=1;i<=Wr;i++){try{let s=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(s.ok)return await yu(s)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(s){if(fu(s))throw s}i<Wr&&await Qi(gu)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${Wr} attempts; the run may be retried`),!1}async function hu(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:s,body:a,headers:c}=await i.json(),l=await t.process(e,{headers:c,body:a},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:u,body:d}=pu(l);return await mu(n,t,o,{deliveryId:s,status:u,body:d},r)?"handled":"error"}var Yi=1e3,bu=5e3,ku=3e4;function Qi(e){return new Promise(n=>setTimeout(n,e))}var Ht=globalThis.__corsairConnectLoops??=new Map;function wu(e,n={fetch,process:Fn}){let t;try{t=F(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(Ht.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");Ht.set(r,o);let i=()=>{Ht.get(r)===o&&Ht.delete(r)},s=!1,a=null;return(async()=>{let l=Yi,u=!1,d=async p=>{u||(console.warn("[corsair] connect loop error; retrying",p),u=!0),s||await Qi(l),l=Math.min(l*2,bu)};try{for(;!s;){a=new AbortController;let p=setTimeout(()=>a?.abort(),ku);try{await hu(e,t,n,a.signal)==="error"?await d("pull or ack failed"):(u=!1,l=Yi)}catch(g){if(s)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{s=!0,a?.abort(),i()}}}function Xi(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Cu(e,n){return n&&!n.has(e.id)?!1:I(e)!==null}async function es(e,n,t={}){let r=v(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,s=await In(r,o,{pluginIds:t.pluginIds}),a=new Map(s.map(l=>[l.plugin,l])),c=r.plugins.filter(l=>Cu(l,i)).map(l=>{let u=I(l),d=a.get(l.id);return d?{plugin:l.id,providerName:Pe(l.id),authKind:Xi(u),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:Pe(l.id),authKind:Xi(u),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:c}}async function ns(e,n){let t=F(e);return W({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:Kn})}var ts=1024*1024,rs=3e4;function je(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:ts}function qe(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:rs}function fn(e){return new T(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function vu(e){return new T(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function Bt(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o(vu(n)),n)})])}finally{clearTimeout(t)}}async function Ft(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:a,value:c}=await Bt(()=>t.read(),n.bodyStallTimeoutMs);if(a)break;if(o+=c.byteLength,o>n.maxBodyBytes)throw fn(n.maxBodyBytes);r.push(c)}let i=new Uint8Array(o),s=0;for(let a of r)i.set(a,s),s+=a.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var jr=new Map;function os(e){let n;try{n=F(e)}catch{return}let t=Xt(n);t&&jr.get(n.projectApiKey)!==t&&(jr.set(n.projectApiKey,t),x({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{jr.delete(n.projectApiKey)}))}var Tu=[".corsair.dev"];function Pu(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function Au(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Pu(n)?!0:Tu.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function is(e){return!e||!Au(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function ss(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function qr(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function Kr(e,n){let t=F(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=Re(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let s=_t(`browser:${i.jti}`,Ae);if(!s.ok)return{type:"json",status:400,body:{error:s.error}};try{if(Mn(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let a=await On(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:Je({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:a}}})}}if(Ot(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let a=i.connectLinkPlugins?.filter(Boolean)??[];if(a.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let c=await ut(e,{tenantId:i.tenantId,plugins:a});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:Je({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:c.connectUrl,expiresAt:c.expiresAt}})}}if(We(i))return i.hubSuccessUrl?i.credentials?(await It(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:qr(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:qr(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(Hn(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await $r(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(Bn(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await gn(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!Mt(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await _n(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(a){let c=a instanceof Error?a.message:"Hub delivery failed";return Mn(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:Je({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:Ot(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:Je({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:We(i)&&i.hubSuccessUrl?{type:"redirect",url:qr(i.hubSuccessUrl,{error:c})}:We(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:Je({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:{type:"json",status:400,body:{error:c}}}return{type:"redirect",url:i.hubSuccessUrl}}async function Zr(e,n){let t=F(e),r=await Fn(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,s=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:s}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:s}}function Gr(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function zr(e,n){return n.method==="GET"?Kr(e,n.url):Zr(e,{headers:n.headers,body:n.body??""})}async function Jr(e,n){try{let t=await zr(e,n);return Gr(t)}catch(t){if(t instanceof ge)return Response.json({error:t.message},{status:503});throw t}}async function Ke(e,n,t){os(e);let r=n.method.toUpperCase(),o=is(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await Jr(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await Ft(n,{maxBodyBytes:je(t?.maxBodyBytes),bodyStallTimeoutMs:qe(t?.bodyStallTimeoutMs)}):void 0});return ss(i,o)}var M=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function yn(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function mn(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var as=new WeakMap;function Un(e,n,t){let r=as.get(e);r||(r=new Map,as.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var cs=300;async function Vr(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,s=n?.forceRefresh??!1,a=`managed:${o}:${i}`;return Un(t,a,async()=>{let[c,l,u]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!c&&!u)throw new M(o,"managed");let d=Math.floor(Date.now()/1e3);if(!s&&c&&l&&Number(l)>d+cs)return{accessToken:c,expiresAt:Number(l),refreshed:!1};if(!u&&c&&!s){let f=l?Number(l):null;if(f===null||f>d+cs)return{accessToken:c,expiresAt:f??d+3600,refreshed:!1}}if(!u)throw new M(o,"managed");let p=await xu(r,o,i,u),g=await mn(t,p,l);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function Ru(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function xu(e,n,t,r){try{return await x({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:ze})}catch(o){let i=o instanceof Error?o.message:"";throw Ru(i)?new M(n,"managed"):o}}async function us(e,n){e._refreshAuth=async()=>(await Vr(n,{forceRefresh:!0})).accessToken}function ls(e){return{delivery:n=>Ke(e,n),deliveryOptions:n=>Ke(e,n)}}var ds=1200*1e3;function Yr(){return pe()}function Qr(){return ds}function Xr(e,n){return Tn(e,n,ds)}function eo(e,n){return se(e,n)}function no(e){return Fe(e)}var ps=600*1e3;function to(){return pe()}function ro(){return ps}function oo(e,n){return Tn(e,n,ps)}function io(e,n){return se(e,n)}function so(e){return sr(e)}function ao(e){return Fe(e)}function co(){return pe()}function uo(e,n,t){return Jn(e,n,Math.floor(t.getTime()/1e3))}function lo(e,n){return se(e,n)}function po(e){return Fe(e)}var Ze=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${Ue}`),this.name="CorsairKekMissingError"}};function Ut(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new Ze;let s=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${s?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${Ue}`)}})}async function Iu(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function gs(e){let{integrationId:n,accountId:t}=await Iu(e);return{integrationId:n,accountId:t}}function fs(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>er(t(),{tenantId:n,message:r}),list:()=>tr(t(),{tenantId:n}),get:r=>({message:o=>nr(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>rr(t(),{chatId:r,tenantId:n})})}}function ys(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function Su(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await Ri(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):ys(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function _u(e,n,t){let r=en(Se(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):ys(e,i),connectUrl:i}}async function Eu(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.manual&&an(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?_u(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?Su({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function ms(e){let{message:n,connectUrl:t}=await Eu(e);throw new M(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var Nt="connect.request",fo="connect.cleared",Du=600*1e3;async function go(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function Ou(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function Mu(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[Nt,fo]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function hs(e,n,t,r,o){let i=await Mu(e,n,o),s=new Date(i);await e.db.insertInto("corsair_events").values({id:Wn(),created_at:s,updated_at:s,account_id:n,event_type:t,payload:r}).execute()}async function Hu(e,n,t=Date.now()){let r=await go(e,n.tenantId,n.plugin);r&&await hs(e,r,Nt,{plugin:n.plugin,connectUrl:n.connectUrl},t)}async function Bu(e,n,t,r,o){let i=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[Nt,fo]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!i||i.event_type!==Nt)return null;let s=i.created_at instanceof Date?i.created_at.getTime():Date.parse(String(i.created_at));if(r-s>o)return null;let a=typeof i.payload=="string"?JSON.parse(i.payload):i.payload??{},c=a.plugin,l=a.connectUrl;return typeof c!="string"||typeof l!="string"?null:{plugin:c,connectUrl:l,requestedAt:new Date(s).toISOString(),tenantId:t,requestedAtMs:s,accountId:n}}async function yo(e,n,t=Date.now(),r=Du){let o=await Ou(e,n);if(o.length===0)return null;let i=(await Promise.all(o.map(l=>Bu(e,l,n,t,r)))).filter(l=>l!==null);if(i.length===0)return null;i.sort((l,u)=>l.requestedAtMs-u.requestedAtMs||l.accountId.localeCompare(u.accountId));let{requestedAtMs:s,accountId:a,...c}=i[0];return c}async function bs(e,n,t=Date.now(),r){let o;if(r)o=await go(e,n,r);else{let i=await yo(e,n,t);o=i?await go(e,n,i.plugin):null}o&&await hs(e,o,fo,{},t)}async function mo(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await Hu(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl})}catch{}}var Fu=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function ks(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},s=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[s||"DEFAULT"]?.handler||Fu)(e,i)}function Uu(e){return typeof e=="function"}function ho({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:s=[],keyBuilder:a,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:k,allPlugins:b,multiTenancy:C}){for(let[P,O]of Object.entries(e)){let D=n?.[P];if(Uu(O)){let H=D,w=[...s,P].join("."),A=async(R={})=>{let J=l?.[w];vr(w,J?.riskLevel??"write");let le;if(c){let N=J,{result:re,reason:oe,onComplete:wn,token:Ce,id:He,expiresAt:V}=await Di({pluginId:o,endpointPath:w,args:R,mode:c.mode,override:c.overrides?.[w],riskLevel:N?.riskLevel??"write",meta:N,db:u,timeoutMs:d?Tr(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(re==="blocked"){let ie;throw oe==="denied"?ie=`Action '${w}' was denied by the user. Await further instructions before proceeding.`:oe==="policy"?ie=`Action '${w}' is blocked by the permission policy. Update the corsair config to allow it.`:oe==="timeout"?ie=`Action '${w}' timed out waiting for approval.`:Ce&&He?ie=await wr({permissionsOptions:d,manual:g,hub:f,permissionId:He,permissionToken:Ce,plugin:o,endpoint:w,args:R,tenantId:p??"default",expiresAt:V??new Date(Date.now()+(d?Tr(d.timeout):600*1e3)).toISOString(),operationPath:w}):ie=`Action '${w}' requires user approval before it can run.`,new cn(ie)}le=wn}let S=async(N,re,oe)=>{try{return await O(re,oe)}catch(wn){if(wn instanceof Error){let Ce=await ks(wn,o,w,typeof oe=="object"&&oe!==null?oe:{args:oe},i);if(N<(Ce.maxRetries||0)){let He=N+1;console.log(`Retrying (${He} / ${Ce.maxRetries})...`);let V;if(Ce.headersRetryAfterMs)V=Ce.headersRetryAfterMs;else switch(Ce.retryStrategy){case"exponential_backoff":V=Math.pow(2,He-1)*1e3;break;case"exponential_backoff_jitter":let ie=Math.pow(2,He-1)*1e3,va=(Math.random()-.5)*1e3;V=Math.max(0,ie+va);break;case"linear_1s":V=1e3;break;case"linear_2s":V=2e3;break;case"linear_3s":V=3e3;break;case"linear_4s":V=4e3;break;default:V=1e3;break}return await new Promise(ie=>setTimeout(ie,V)),await S(He,re,oe)}}throw wn}},te;try{te=a?await a(t,"endpoint"):void 0}catch(N){if(N instanceof de)throw h&&f&&tn({hub:f,database:u,kek:k,plugins:b??[],plugin:h,tenantId:p,verified:!1}),await mo(u,{tenantId:N.tenantId??p,plugin:N.plugin,connectUrl:N.connectUrl}),N;if(N instanceof M){h&&f&&tn({hub:f,database:u,kek:k,plugins:b??[],plugin:h,tenantId:p,verified:!1});try{await ms({error:N,manual:g,hub:f,plugin:h,tenantId:p,database:u,kek:k,plugins:b,multiTenancy:C})}catch(re){throw re instanceof M&&await mo(u,{tenantId:re.tenantId??p,plugin:re.pluginId,connectUrl:re.connectUrl}),re}}throw N}if(!H?.before&&!H?.after){let N=await S(0,{...t,key:te},R);return await le?.(),h&&f&&tn({hub:f,database:u,kek:k,plugins:b??[],plugin:h,tenantId:p,verified:!0}),N}let kn={...t,key:te},Me=H.before?await H.before(kn,R):{ctx:kn,args:R,continue:!0,passToAfter:void 0};if(Me.continue===!1)return;let Oo=await S(0,Me.ctx,Me.args);return await H.after?.(Me.ctx,Oo,Me.passToAfter),await le?.(),h&&f&&tn({hub:f,database:u,kek:k,plugins:b??[],plugin:h,tenantId:p,verified:!0}),Oo};r[P]=A}else if(O&&typeof O=="object"){let H={};ho({endpoints:O,hooks:D,ctx:t,tree:H,pluginId:o,errorHandlers:i,currentPath:[...s,P],keyBuilder:a,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:k,allPlugins:b,multiTenancy:C}),r[P]=H}}}function Nu(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function bo({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,s]of Object.entries(e)){let a=n?.[i];if(Nu(s)){let c=a,l=async u=>{let d=(g,f)=>s.handler(g,f),p=o&&u?.hubVerified!==!0?await o(t,"webhook"):void 0;return!c?.before&&!c?.after?d({...t,key:p},u):(async()=>{let g={...t,key:p},f=c.before?await c.before(g,u):{ctx:g,args:u,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await c.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:s.match,handler:l}}else if(s&&typeof s=="object"){let c={};bo({webhooks:s,hooks:a,ctx:t,webhooksTree:c,keyBuilder:o}),r[i]=c}}}function ws(e){return e&&typeof e=="object"?e:{}}async function Cs(e,n){return W({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=ws(t).workflows;return Array.isArray(r)?r:[]}})}async function vs(e,n){return W({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>ws(t).workflow})}async function Ts(e,n){await x({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Ps(e,n){await x({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function As(e,n){return x({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function ko(e){return e&&typeof e=="object"?e:{}}async function Rs(e,n){return W({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=ko(t).runs;return Array.isArray(r)?r:[]}})}async function xs(e,n){return W({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=ko(t).runs;return Array.isArray(r)?r:[]}})}async function Is(e,n){return W({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>ko(t).run})}async function wo(e,n,t){await x({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var Ss=(e,n)=>wo(e,"approve",n),_s=(e,n)=>wo(e,"deny",n),Es=(e,n)=>wo(e,"cancel",n);function Ds(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?xs(t(),{workflowId:r.workflowId,tenantId:n}):Rs(t(),{tenantId:n}),get:r=>Is(t(),{runId:r,tenantId:n}),approve:r=>Ss(t(),{runId:r,tenantId:n}),deny:r=>_s(t(),{runId:r,tenantId:n}),cancel:r=>Es(t(),{runId:r,tenantId:n})}}function Os(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>Ts(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>Cs(t(),{tenantId:n}),get:o=>vs(t(),{workflowId:o,tenantId:n}),run:(o,i)=>As(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:Ds(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>Ps(t(),{workflowId:o,tenantId:n,name:i})}}function Lu(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await gs({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function $u(e,n,t,r,o){return e?Vt(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function Co(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:s,manualConfig:a,hubConfig:c,internalConfig:l}=n,u=r??"default",d=l&&t?()=>Xe(l,u):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,k=Lu(t,f.id,u,d);if(h?.entities){let S={};for(let[te,kn]of Object.entries(h.entities)){let Me=t?Vt(t.db,k,te,h.version,kn):$u(void 0,k,te,h.version,kn);S[te]=Me}g[f.id].db=S,p[f.id].db=S}let b=f.options,C=f.authConfig,P;if(t&&o&&b?.authType){let S=C?.[b.authType]?.account??[];P=B({authType:b.authType,integrationName:f.id,tenantId:u,kek:o,database:t,extraAccountFields:S,ensureProvisioned:d}),p[f.id].keys=P}let O={database:t,db:g[f.id]?.db??{},$getAccountId:k,...f.options?{options:f.options}:{},...P?{keys:P,authType:b?.authType}:{},tenantId:u,...c?{hub:c}:{}},D=f.endpoints??{},H=f.hooks,w={...i,...f.errorHandlers},A={},R=f.options?.permissions;ho({endpoints:D,hooks:H,ctx:O,tree:A,pluginId:f.id,errorHandlers:w,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:R,endpointMeta:f.endpointMeta,database:t,permissionsOptions:s,tenantId:r,manualConfig:a?{...a,oauthConfig:f.oauthConfig,kek:o,tenantId:u}:void 0,hubConfig:c,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy}),Object.keys(A).length>0&&(p[f.id].api=A),O.endpoints=A;let J=f.webhooks??{},le=f.webhookHooks;if(Object.keys(J).length>0){let S={};bo({webhooks:J,hooks:le,ctx:O,webhooksTree:S,keyBuilder:f.keyBuilder}),p[f.id].webhooks=S,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=fs(c,u),p.workflows=Os(c,u),p}function Ms(e,n,t){let r={};for(let o of e){let i=o.options,s=o.authConfig;if(i?.authType){let a=s?.[i.authType]?.integration??[],c=U({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:a});r[o.id]=c}}return r}var Wu="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function Hs(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${Wu}`),t):n}function Lt(e,n){if(e===void 0)return n;if(e===null)throw new T(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function $t(e){if(e!==void 0)throw new T(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var Bs=[{method:"GET",pattern:"/ok",handler:async()=>E(200,ft())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>($t(n),E(200,await ln(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>($t(t),E(201,await ht(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>($t(t),E(200,await mt(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>E(200,await un(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>E(200,await yt(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>E(200,await bt(e,Lt(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>($t(t),E(200,await Pr(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?E(200,await Rr(e,t)):E(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=Lt(r,o.tenantId);return E(200,await kt(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",handler:async({corsair:e,internal:n,query:t})=>E(200,await wt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",handler:async({corsair:e,internal:n,body:t})=>E(200,await Ct(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=Lt(t,n.tenantId)??"default",o=e.database?await yo(e.database,r):null;return E(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=Lt(t,r?.tenantId)??"default";return e.database&&await bs(e.database,o,void 0,r?.plugin),E(200,{ok:!0})}}];(()=>{let e=new Set;for(let n of Bs){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function ju(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let s=t[i],a=r[i];if(s.startsWith(":"))o[s.slice(1)]=decodeURIComponent(a);else if(s!==a)return null}return o}function qu(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function Ku(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await Ft(e,n).catch(o=>{throw o instanceof T?o:new T(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new T(400,"invalid_json","Request body is not valid JSON")}}var Zu="/api/corsair";function L(e,n={}){let t=n.basePath??Zu,r=je(n.maxBodyBytes),o=qe(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},s=v(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async a=>{try{let c=a.headers.get("content-length");if(c!==null&&Number(c)>r)throw fn(r);let l=new URL(a.url),u=qu(l.pathname,t),d=a.method.toUpperCase();if(d==="OPTIONS"||u==="/"||u==="")return await Ke(e,a,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return E(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(l.searchParams);for(let g of Bs){if(g.method!==d)continue;let f=ju(g.pattern,u);if(!f)continue;let h=await Ku(a,i),k=n.resolveTenant?await n.resolveTenant(a):void 0;return await g.handler({corsair:e,internal:s,req:a,params:f,query:p,body:h,scopedTenant:k})}throw _e(`No route for ${d} ${u}`)}catch(c){if(n.onError){let u=await n.onError(c,a);if(u)return u}if(c instanceof T)return ae(c);let l=c instanceof Error?c.message:"Internal server error";return E(500,{error:"internal_error",message:l})}}}function Gu(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function zu(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function Ju(e,n,t){let r=[],o=0,i=e();try{let s=await Bt(()=>i.next(),t);for(;s.done!==!0;){let a=zu(s.value);if(o+=a.byteLength,o>n)throw fn(n);r.push(a),s=await Bt(()=>i.next(),t)}return Buffer.concat(r)}catch(s){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw s}}var Fs=!1;function Vu(){Fs||(Fs=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function Yu(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=je(n.maxBodyBytes),o=qe(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(Vu(),i=JSON.stringify(e.body));else{let a=e[Symbol.asyncIterator];if(typeof a!="function")return;let c=await Ju(a.bind(e),r,o);c.length>0&&(i=c)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw fn(r);return typeof i=="string"?i:i}function K(e){e.resume?.()}async function De(e,n={}){let t=Gu(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,s=new Headers;for(let[l,u]of Object.entries(e.headers))if(u!=null&&!Qu.has(l.toLowerCase()))if(Array.isArray(u))for(let d of u)s.append(l,d);else s.set(l,u);let a={method:(e.method??"GET").toUpperCase(),headers:s},c=await Yu(e,n);return c!==void 0&&(a.body=c,s.has("content-type")||s.set("content-type","application/json")),new Request(i,a)}async function Z(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var Qu=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function Us(e,n){let t=L(e,n);return async(r,o,i)=>{try{let s=await t(await De(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Z(o,s)}catch(s){if(s instanceof T&&o.headersSent!==!0){await Z(o,ae(s)),K(r);return}K(r),i(s)}}}function Xu(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function el(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=Xu(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function Ns(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function Ls(e,n){let t=L(e,n);return async(r,o)=>{el(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let s=await t(await De(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await Z(o.raw,s)}catch(s){if(s instanceof T&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await Z(o.raw,ae(s)),K(i);return}throw K(i),s}}}function $s(e,n){let t=L(e,n);return r=>t(r.req.raw)}function Ws(e,n){let t=L(e,n);return{GET:t,POST:t,OPTIONS:t}}function js(e,n){let t=L(e,n);return async(r,o)=>{try{let i=await t(await De(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Z(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),K(r);return}if(i instanceof T){await Z(o,ae(i)),K(r);return}console.error("[corsair] management handler failed:",i),await Z(o,E(500,{error:"internal_error"})),K(r)}}}function Wt(e,n){let t=L(e,n);return r=>t(r.request)}function qs(e,n){let t=Wt(e,n);return{GET:t,POST:t,OPTIONS:t}}function Ks(e,n){let t=Wt(e,n);return{loader:t,action:t}}function Zs(e,n){let t=Wt(e,n);return{GET:t,POST:t,OPTIONS:t}}function Gs(e,n){let t=Wt(e,n);return{GET:t,POST:t,OPTIONS:t}}function zs(e,n){let t=L(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await De(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Z(r.node.res,i)}catch(i){if(i instanceof T&&r.node.res.headersSent!==!0){await Z(r.node.res,ae(i)),K(o);return}throw K(o),i}}}function Js(e,n){return L(e,n)}function Vs(e){let n={[Nn]:e};return{ok:ft,tenants:{list:()=>ln(e),create:t=>ht(e,t),get:t=>mt(e,t)},plugins:{list:()=>un(e),get:t=>yt(e,t)},connectionStatus:{get:t=>bt(e,t?.tenantId)},permissions:{get:t=>Ui(e,t)},connect:{createLink:t=>kt(n,e,t),resolve:t=>wt(n,e,t),oauthCallback:t=>Ct(n,e,t)}}}async function Ys(e,n,t,r,o="pending"){if(!e)return null;try{let i=Wn(),s=new Date;return await e.db.insertInto("corsair_events").values({id:i,created_at:s,updated_at:s,account_id:n,event_type:t,payload:r,status:o}).execute(),i}catch(i){return console.warn("Failed to log event:",i),null}}async function nl(e,n,t,r="pending"){try{let o=await e.$getAccountId();return Ys(e.database,o,n,t,r)}catch(o){return console.warn("Failed to log event:",o),null}}import*as Xs from"https";import*as jt from"querystring";var tl=["expires_in","refresh_token_expires_in"];function Qs(e){let n={...e};for(let t of tl){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function rl(e){try{return Qs(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=jt.parse(e);return!n.access_token&&!n.error?null:Qs({...n})}function it(e,n,t,r,o){let i=new URL(r.tokenUrl),s=r.tokenAuthMethod==="basic";return new Promise((a,c)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};s||(l.client_id=n,l.client_secret=t);let u=jt.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(u).toString()};s&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=Xs.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){c(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=rl(f);h?a(h):c(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>c(new Error(`Request failed: ${g.message}`))),p.write(u),p.end()})}async function ea(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[s,a,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(yn({accessToken:s,expiresAt:a,forceRefresh:n?.forceRefresh}))return{accessToken:s,expiresAt:Number(a),refreshed:!1};if(!c)throw new M(o,"oauth_2");let l=await x({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:c},parseResponse:ze}),u=await mn(t,l,a);return{accessToken:l.access_token,expiresAt:u,refreshed:!0}}async function na(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:s="form",extraParams:a}=e,c={grant_type:"refresh_token",refresh_token:t,...a},l={Accept:"application/json"};i==="basic"?l.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?l.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(c.client_id=o),c.client_secret=r),s==="json"?l["Content-Type"]="application/json":l["Content-Type"]="application/x-www-form-urlencoded";let u=await fetch(n,{method:"POST",headers:l,body:s==="json"?JSON.stringify(c):new URLSearchParams(c)});if(!u.ok)throw new Error(`OAuth token refresh failed (${u.status}): ${await u.text()}`);let d=JSON.parse(await u.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function ta(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new M(n.plugin,"oauth_2");let l={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},u=g=>Un(e.keys,r,async()=>(await ea(l,{forceRefresh:g})).accessToken);e._refreshAuth=()=>u(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return yn({accessToken:d,expiresAt:p})?d:u(!1)}let o=t.client_secret,i=t.client_id,s=l=>Un(e.keys,r,async()=>{let[u,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!l&&yn({accessToken:u,expiresAt:d}))return u;if(!p)throw new M(n.plugin,"oauth_2");let g=await na({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await mn(e.keys,g,d),g.access_token});e._refreshAuth=()=>s(!0);let[a,c]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return yn({accessToken:a,expiresAt:c})?a:s(!1)}var ra="  ";function ee(e){let n=e;return n._def??n.def??{}}function ne(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function X(e){return e.innerType??e.schema??e.out??e.in}function ia(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return X(e)}}function sa(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Kt(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function hn(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function aa(e,n){return e.description??n.description}function ol(e){let n=e;for(;n;){let t=ee(n),r=aa(n,t);if(r)return r;let o=ne(t);if(Ro(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=ia(t,o);continue}break}}function Ro(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function G(e){let n=ee(e),t=ne(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??hn(n)[0]??"unknown");case"ZodEnum":return hn(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=X(n);return r?G(r):"unknown"}case"ZodNullable":{let r=X(n);return`${r?G(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=X(n);return r?G(r):"unknown"}case"ZodArray":{let r=sa(n);if(!r)return"unknown[]";let o=ee(r),i=ne(o)==="ZodUnion",s=G(r);return`${i?`(${s})`:s}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Kt(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([s,a])=>{let c=ne(ee(a));return`${c==="ZodOptional"||c==="ZodNullable"?s+"?":s}: ${G(a)}`}).join(", ")} }`}case"ZodUnion":return hn(n).map(r=>G(r)).join(" | ");case"ZodIntersection":return`${G(n.left)} & ${G(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=ia(n,t);return r?G(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function we(e){let n=ee(e),t=ne(n),r=aa(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??hn(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=hn(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=X(n),i=o?we(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=X(n),i=o?we(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=X(n);return o?{...we(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=sa(n);return{kind:"array",optional:!1,description:r,items:o?we(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=Kt(e,n),i={};for(let[s,a]of Object.entries(o))i[s]=we(a);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=hn(n);for(let i of o){let s=ee(i);if(ne(s)==="ZodObject")return{...we(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=X(n);return o?{...we(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function hw(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),s=e.find(u=>u.id===o);if(!s)return null;let a=i;a.startsWith("api.")&&(a=a.slice(4));let c=Oe(s.endpointMeta,a),l=Oe(s.endpointSchemas,a);return!c&&!l?null:{input:l?.input?we(l.input):null,output:l?.output?we(l.output):null,description:c?.description}}var xo=["equals","contains","startsWith","endsWith","in"],il=["equals","gt","gte","lt","lte","in"],sl=["equals"],al=["equals","before","after","between"];function ca(e){let n=ee(e);switch(ne(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=X(n);return r?ca(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function Io(e){let n=ee(e),t=ne(n);if(Ro(t)){let i=X(n);return i?Io(i):{}}if(t!=="ZodObject")return{};let r=Kt(e,n),o={};for(let[i,s]of Object.entries(r)){let a=ca(s);a==="string"?o[i]={type:"string",operators:xo}:a==="number"?o[i]={type:"number",operators:il}:a==="boolean"?o[i]={type:"boolean",operators:sl}:a==="date"&&(o[i]={type:"date",operators:al})}return o}function ua(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function To(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&To(o,i,t)}}function Po(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Ao(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];Po(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&Ao(o,i,t)}}function So(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([a])=>a.toLowerCase()===t);if(!o)return null;let[i,s]=o;if(r.length===0)return Po(s)?[i]:null;if(s!==null&&typeof s=="object"&&!Po(s)){let a=So(s,r);if(a!==null)return[i,...a]}return null}function la(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let s="    ".repeat(i+2);t.push(`${s}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let s="    ".repeat(i+2);t.push(`${s}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var cl=new Set(jn);function Ge(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(a=>a.id===r);if(!i)return cl.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:Ge(e);if(t==="webhooks"){if(!i.webhooks)return[];let a=[];return Ao(i.webhooks,[],a),a.map(c=>`${i.id}.webhooks.${c}`)}if(t==="db"){let a=i.schema?.entities;return a?Object.keys(a).map(c=>`${i.id}.db.${c}.search`):[]}if(!i.endpoints)return[];let s=[];return To(i.endpoints,[],s),s.map(a=>`${i.id}.api.${a}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let s=[];Ao(i.webhooks,[],s),o[i.id]=s.map(a=>`${i.id}.webhooks.${a}`)}else if(t==="db")for(let i of e){let s=i.schema?.entities;s&&(o[i.id]=Object.keys(s).map(a=>`${i.id}.db.${a}.search`))}else for(let i of e){if(!i.endpoints)continue;let s=[];To(i.endpoints,[],s),o[i.id]=s.map(a=>`${i.id}.api.${a}`)}return o}function Oe(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function ul(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),s=i.startsWith(".")?i.slice(1):i;return s.startsWith("api.")&&(s=s.slice(4)),{shortPath:s,lookupKey:s}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function vo(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function bw(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),s=e.find(a=>a.id===o);if(s){if(i.startsWith("db.")){let u=i.slice(3),d=u.lastIndexOf(".");if(d!==-1){let p=u.slice(0,d),g=u.slice(d+1),f=s.schema?.entities;if(g==="search"&&f){let h=ua(f,p);if(h){let[k,b]=h,C=Io(b),P=[`Search ${o} ${k} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${xo.join(", ")}]`];for(let[O,D]of Object.entries(C))P.push(`  ${O}?: ${D.type}  [${D.operators.join(", ")}]`);return P.push("}"),P.join(`
+`)}}}return vo(Ge(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let u=i.slice(9);if(s.webhooks){let d=So(s.webhooks,u.split("."));if(d!==null){let p=d.join("."),g=Oe(s.webhookSchemas,p.toLowerCase()),f=g?.response?G(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${qt(bn(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${la(o,d)}`),h.join(`
+
+`)}}return vo(Ge(e,{type:"webhooks"}),"Path not found. Available webhooks")}let a=i;a.startsWith("api.")&&(a=a.slice(4));let c=Oe(s.endpointMeta,a),l=Oe(s.endpointSchemas,a);if(c||l){let u=[],d=[c?.riskLevel?`[${c.riskLevel}]`:"",c?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[c?.description,d].filter(Boolean).join("  ");return p&&u.push(p),l?.input&&u.push(`input ${qt(bn(l.input))}`),l?.output&&u.push(`output ${qt(bn(l.output))}`),u.join(`
+
+`)}}}return vo(Ge(e),"Path not found. Available operations")}function oa(e){let n=e;for(;;){let t=ee(n),r=ne(t);if(Ro(r)){let o=X(t);if(!o)return n;n=o;continue}return n}}function bn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=oa(e),t=ee(n);if(ne(t)==="ZodObject"){let o=Kt(n,t),i=[];for(let[s,a]of Object.entries(o)){let c=ee(a),l=ne(c),u=l==="ZodOptional"||l==="ZodNullable",d=oa(a),p=ol(a);i.push({key:s,optional:u,type:G(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:G(n)}}function qt(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=ra.repeat(n+1),r=ra.repeat(n);return`{
+${e.fields.map(i=>{let s=i.optional?`${i.key}?`:i.key,a=i.description?`  // ${i.description}`:"";return`${t}${s}: ${i.type}${a}`}).join(`
+`)}
+${r}}`}return"unknown"}function ll(e,n){let t=Ge(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(u=>u.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let u of t){let{shortPath:d,lookupKey:p}=ul(u,n),g=Oe(r.endpointMeta,p),f=Oe(r.endpointSchemas,p);!g&&!f||o.push({path:u,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:bn(f?.input),output:bn(f?.output)})}o.sort((u,d)=>u.path.localeCompare(d.path));let i=[],s=Ge(e,{plugin:n,type:"webhooks"});if(Array.isArray(s)&&r.webhooks)for(let u of s){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=So(r.webhooks,f.split("."));if(h===null)continue;let k=h.join("."),b=Oe(r.webhookSchemas,k.toLowerCase()),C=b?.response?G(b.response):void 0;i.push({path:u,description:b?.description,payload:bn(b?.payload),responseType:C,usageExample:la(n,h)})}i.sort((u,d)=>u.path.localeCompare(d.path));let a=[],c=Ge(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(c)&&l)for(let u of c){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let k=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let C=ua(l,k);if(!C)continue;let[P,O]=C,D=Io(O),H=Object.entries(D).map(([w,A])=>({field:w,type:A.type,operators:A.operators}));a.push({path:u,entityName:P,filters:[{field:"entity_id",type:"string",operators:xo},...H]})}return a.sort((u,d)=>u.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:a}}}import{randomUUID as da}from"crypto";async function dl(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=da(),o=da(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as pl}from"crypto";var Zt="https://graph.microsoft.com/v1.0",_o=2e4,gl=60;async function fl(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${Zt}/subscriptions`,{headers:r,signal:AbortSignal.timeout(_o)});if(c.ok){let{value:l}=await c.json(),u=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(u.map(d=>fetch(`${Zt}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(_o)}).catch(()=>{})))}}catch{}let o=pl(),i=new Date(Date.now()+gl*6e4).toISOString(),s=await fetch(`${Zt}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(_o),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!s.ok)throw new Error(`MS Graph subscribe failed (${s.status}): ${await s.text()}`);let a=await s.json();return a.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:a.id},webhookSecret:o}):null}function pa(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function yl(e,n){let t=pa(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function ml(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function ga(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function fa(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function Ln(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function hl(e){return Ln(e.body)}function ya(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Gt(Array.isArray(r)?r:[r])}function ma(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let l=Gt(Array.isArray(c)?c:[c]);if(l)return decodeURIComponent(l)}let r=ya({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let l=n[c],u=Array.isArray(l)?l[0]:l;if(!(!u||typeof u!="string"))try{let p=(u.startsWith("http")?new URL(u):new URL(`https://example.invalid${u.startsWith("/")?u:`/${u}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,s=Ln(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Gt([s?.validationToken])??null}function bl(e){if(ma(e))return!0;let n=Ln(e.body??e.payload);return ga(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Gt(e){for(let n of e){let t=fa(n);if(t)return t}}function kl(e){let t=Ln(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var Nn=Symbol.for("corsair:internal");function ka(e){let n=e.database?Mo(e.database):void 0,t=e.kek,r=n&&t?Ms(e.plugins,n,t):Ut(!!n,!!t),o=Hs(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?Vn(e.hub):void 0},s=Ei(n),a=Vs(i);if(e.multiTenancy){let u=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=Co(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[Nn]:i})},keys:r,permissions:s,manage:a},{[Nn]:i});return ha(u,i.hub),ba(u,i.hub),u}let c=Co(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},c,{keys:r,permissions:s,manage:a,[Nn]:i});return ha(l,i.hub),ba(l,i.hub),l}function ha(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-VNG3F5TN.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function wl(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var zt=globalThis.__corsairTunnels??=new Set;function ba(e,n){if(!wl(n))return;let t=n.projectApiKey;if(zt.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}zt.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Yt;import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:()=>zt.delete(t)})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Qt}`)}).catch(s=>{zt.delete(t),console.warn(`[corsair] tunnel failed to start: ${s instanceof Error?s.message:String(s)}. Run \`corsair setup\` to enable your dev tunnel.`)})}var Cl={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Eo=Cl;async function st(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},s=n?.caller??"script",a=Bo(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=Ol(e,a.plugins,n),l={...a,database:a.database},u=l.database.db;await Bl(u,i);let d=await Fl(u,l,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Ll(e,c,n.credentials,l,o,i);let p=await Wl(d,c,o,s);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=ka({plugins:a.plugins,database:u,kek:a.kek,multiTenancy:!0}).withTenant(c.tenantId);await jl(g,a.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function Do(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...$[n][t],...r])}function Dl(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(a=>a.id===t);if(!o)continue;let i=I(o);if(!i)continue;let s=Do(o,i,"account");for(let a of Object.keys(r))if(s.has(a))return!0}return!1}function Ol(e,n,t){let r=Fo(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Dl(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function Ca(e,n){return Te(e)?n===0?!0:Object.values(e).every(t=>Ca(t,n-1)):!1}function Ml(e){return Ca(e,4)}var Hl=No;function Jt(e){if(e instanceof xl){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof El?Jt(r):"unknown";return n}return e instanceof Al?`${Jt(e.unwrap())} | null`:e instanceof Il?`${Jt(e.unwrap())} | undefined`:e instanceof Pl?e.options.join(" | "):e instanceof _l?"string":e instanceof Rl?"number":e instanceof vl?"boolean":e instanceof Tl?"date":e instanceof Sl?"jsonb":"unknown"}async function Bl(e,n){let t=await e.introspection.getTables(),r=new Set(t.map(o=>o.name));for(let[o,i]of Object.entries(Hl))r.has(o)||n(`[corsair:setup] Table "${o}" does not exist. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(Jt(i),null,2)}`)}async function Fl(e,n,t,r,o){let i=new Date,s=new Map;for(let a of n.plugins){let c=a.id,l=I(a),u=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!u){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),u=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=l?a.authConfig?.[l]?.integration??[]:[],p=l?a.authConfig?.[l]?.account??[]:[],g=l&&u?U({authType:l,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(u&&!u.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!u||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",u.id).executeTakeFirst();if(!h){let k=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:k,tenant_id:t,integration_id:u.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",k).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&B({authType:l,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}s.set(c,{pluginId:c,authType:l,integration:g,account:f,integrationFields:[...$[l].integration,...d],accountFields:r?[...$[l].account,...p]:[]})}return s}function Ul(e){if(!Te(e))return;let n=e.keys;return Te(n)?n:void 0}function Nl(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Ll(e,n,t,r,o,i){let s=Ul(e),a=n.provisionAccounts?Nl(e,n.tenantId):void 0;for(let[c,l]of Object.entries(t)){let u=r.plugins.find(b=>b.id===c);if(!u){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=I(u);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=Do(u,d,"integration"),g=Do(u,d,"account"),f=s?.[c],h=a?.[c],k=Te(h)?h.keys:void 0;for(let[b,C]of Object.entries(l))if(C){if(p.has(b)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${b}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let P=z(f,`set_${b}`);if(!P){i(`[corsair:setup] Cannot set integration field '${b}' for '${c}'.`);continue}await P(C),o(`[corsair:setup] Set ${c} integration.${b}`);continue}if(g.has(b)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${b}' on a multi-tenant instance`);let P=z(k,`set_${b}`);if(!P){i(`[corsair:setup] Cannot set account field '${b}' for '${c}'.`);continue}await P(C),o(`[corsair:setup] Set ${c} account.${b} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${b}' for plugin '${c}'.`)}}}var wa=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function $l(e,n,t,r,o,i,s,a,c){let l=[],u=[];for(let p of o){if(wa.has(p))continue;let g=z(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(wa.has(p))continue;let g=z(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}let d=l.length===0&&u.length===0;if(d)a(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")a(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...u];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");a(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of u){let h=s.provisionAccounts?s.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(s.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}a(g.join(`
+`))}}return d}async function Wl(e,n,t,r){let o=new Set;for(let i of e.values())await $l(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function jl(e,n,t,r,o){if(!Ml(Eo)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=Eo,s=new Set(n.map(a=>a.id));for(let[a,c]of Object.entries(i)){if(!s.has(a))continue;if(!t.has(a)){r(`[corsair:setup] Skipping backfill for '${a}' \u2014 auth not configured.`);continue}let l=Te(e)?e[a]:void 0,u=Te(l)?l.api:void 0;if(u)for(let[d,p]of Object.entries(c))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${a} \u203A ${d}.${g}...`);try{let h=Te(u)?u[d]:void 0;await z(h,g)?.(f)}catch(h){o(`[corsair:setup] ${a} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{$o as a,Pe as b,de as c,qn as d,Kn as e,Zn as f,ze as g,Wo as h,Gn as i,ir as j,Cn as k,Jo as l,Vo as m,Ae as n,Be as o,pe as p,Ve as q,Ye as r,Re as s,ar as t,Qo as u,Pn as v,ge as w,An as x,cr as y,Vn as z,F as A,Yn as B,Qe as C,fe as D,ye as E,Y as F,ur as G,Rn as H,xe as I,me as J,xn as K,U as L,B as M,ii as N,si as O,st as P,Ll as Q,Se as R,dr as S,nn as T,rn as U,gr as V,ot as W,mi as X,Le as Y,q as Z,fr as _,_n as $,wi as aa,sc as ba,at as ca,rg as da,Ti as ea,Pi as fa,Ai as ga,Ri as ha,ct as ia,yr as ja,lt as ka,dt as la,cn as ma,gt as na,Cr as oa,_i as pa,vr as qa,Ir as ra,Sr as sa,vt as ta,_r as ua,dn as va,pn as wa,Tt as xa,Pt as ya,En as za,Er as Aa,Dr as Ba,At as Ca,Dn as Da,Rt as Ea,xt as Fa,Ee as Ga,gn as Ha,qi as Ia,Fr as Ja,Ur as Ka,We as La,Hn as Ma,Bn as Na,Mt as Oa,$r as Pa,Fn as Qa,pu as Ra,hu as Sa,wu as Ta,es as Ua,ns as Va,ts as Wa,rs as Xa,je as Ya,qe as Za,Kr as _a,Zr as $a,Gr as ab,zr as bb,Jr as cb,Ke as db,M as eb,Vr as fb,us as gb,ls as hb,Yr as ib,Qr as jb,Xr as kb,eo as lb,no as mb,to as nb,ro as ob,oo as pb,io as qb,so as rb,ao as sb,co as tb,uo as ub,lo as vb,po as wb,Ze as xb,L as yb,Us as zb,Ns as Ab,Ls as Bb,$s as Cb,Ws as Db,js as Eb,qs as Fb,Ks as Gb,Zs as Hb,Gs as Ib,zs as Jb,Js as Kb,Ys as Lb,nl as Mb,it as Nb,ta as Ob,hw as Pb,Ge as Qb,bw as Rb,qt as Sb,ll as Tb,dl as Ub,Zt as Vb,fl as Wb,pa as Xb,yl as Yb,ml as Zb,ga as _b,fa as $b,Ln as ac,hl as bc,ya as cc,ma as dc,bl as ec,Gt as fc,kl as gc,Nn as hc,ka as ic,wl as jc};

package/dist/client/react/index.d.ts

@@ -149,6 +149,7 @@ type CorsairManagementClient = {
         }>;
         clear: (input?: {
             tenantId?: string;
+            plugin?: string;
         }) => Promise<{
             ok: true;
         }>;