corsair 0.1.128 → 0.1.129

package/dist/{browser-delivery-D8zDl4ZV.d.ts → browser-delivery-BIweOz_D.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-D917Yq9E.js';
+import { B as BrowserDeliveryPayload } from './index-4oKvjBws.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/{chunk-ELMZWIHW.js → chunk-HDOJLIMA.js}

@@ -1,4 +1,4 @@
-import{a as ve,b as Qt,c as Xt}from"./chunk-4OLKWKJG.js";import{a as Fo,b as Te,c as Uo,d as v,e as j,f as No,g as z,h as $,i as I,j as jn,k as Lo,l as ze,m as Yt,n as $o}from"./chunk-7AYINDN2.js";import{a as Bo}from"./chunk-N66TLOH2.js";import{ZodBoolean as vl,ZodDate as Tl,ZodEnum as Pl,ZodNullable as Al,ZodNumber as Rl,ZodObject as xl,ZodOptional as Il,ZodRecord as Sl,ZodString as _l,ZodType as El}from"zod";var qn=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","alchemy","algolia","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","appointo","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beeminder","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bitbucket","bitwarden","blazemeter","blocknative","bluesky","boloforms","boltiot","bonsai","bookingmood","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","browserless","browsertool","bubble","bugsnag","buildkite","cal","calendly","campayn","canva","canvas","capsulecrm","castingwords","cdrplatform","certifier","chatbotkit","chatfai","chmeetings","circleci","clickhouse","clientary","clockify","cloudflare","cloudinary","collegefootballdata","confluence","connecteam","contentfulgraphql","contextsevenmcp","countdownapi","crowterminal","cursor","customgpt","dadataru","databricks","datadog","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","dodopayments","doppler","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","epicgames","exa","facebook","faraday","figma","filloutforms","firecrawl","fireflies","flexisign","formbricks","gemini","github","gitlab","gmail","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","htmltoimage","hubspot","huggingface","imgbb","insightoai","instagram","intercom","jigsawstack","jira","kaggle","linear","linkedin","loyverse","mailboxlayer","mailchimp","mailtrap","marketstack","merriamwebsterdict","monday","neon","nextdns","notion","ocrspace","ocrwebservice","ollama","onedrive","onepassword","openai","openrouter","openweathermap","oura","outlook","pagerduty","parseur","pdfmonkey","perplexityai","pinecone","posthog","razorpay","reddit","removebg","resend","retailed","runpod","salesforce","sapsuccessfactors","scaleai","scrapegraphai","securitytrails","sendgrid","sentry","serpapi","sharepoint","slack","sourcegraph","spotify","strava","streamtime","stripe","studiobyai21labs","supabase","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","timecamp","timelink","tinyurl","tisane","todoist","toggl","trello","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","unione","uniswapapi","uploadcare","vapi","vercel","vestaboard","wakatime","webflow","webvizio","whatsapp","witai","wiza","workday","workiom","worldnewsapi","xquik","youcom","youtube","zendesk","zohoinventory","zohomail","zoom","zoominfo"],Wo={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",alchemy:"Alchemy",algolia:"Algolia",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",appointo:"Appointo",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beeminder:"Beeminder",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",cal:"Cal",calendly:"Calendly",campayn:"Campayn",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",castingwords:"CastingWords",cdrplatform:"CDR Platform",certifier:"Certifier",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chmeetings:"ChMeetings",circleci:"CircleCI",clickhouse:"Clickhouse",clientary:"Clientary",clockify:"Clockify",cloudflare:"Cloudflare",cloudinary:"Cloudinary",collegefootballdata:"College Football Data",confluence:"Confluence",connecteam:"Connecteam",contentfulgraphql:"Contentful GraphQL",contextsevenmcp:"Context7",countdownapi:"Countdown API",crowterminal:"CrowTerminal",cursor:"Cursor",customgpt:"CustomGPT",dadataru:"Dadataru",databricks:"Databricks",datadog:"Datadog",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",dodopayments:"Dodo Payments",doppler:"Doppler",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",epicgames:"Epic Games",exa:"Exa",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",flexisign:"Flexisign",formbricks:"Formbricks",gemini:"Gemini",github:"GitHub",gitlab:"GitLab",gmail:"Gmail",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailboxlayer:"MailboxLayer",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",monday:"Monday",neon:"Neon",nextdns:"NextDNS",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfmonkey:"PDFMonkey",perplexityai:"Perplexity AI",pinecone:"Pinecone",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",removebg:"remove.bg",resend:"Resend",retailed:"Retailed",runpod:"RunPod",salesforce:"Salesforce",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",securitytrails:"SecurityTrails",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",sourcegraph:"Sourcegraph",spotify:"Spotify",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",timecamp:"TimeCamp",timelink:"Timelink",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",trello:"Trello",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",unione:"Unione",uniswapapi:"Uniswap",uploadcare:"Uploadcare",vapi:"Vapi",vercel:"Vercel",vestaboard:"Vestaboard",wakatime:"WakaTime",webflow:"Webflow",webvizio:"Webvizio",whatsapp:"WhatsApp",witai:"WitAi",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Pe(e){let n=Wo[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var pe=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function E(e){return typeof e=="string"&&e.length>0}function Ta(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Pa(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function Kn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!E(n.connectUrl)||!E(n.token)||!E(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:E(n.environmentId)?n.environmentId:n.projectId};return E(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function Zn(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!E(r.tenantId)||!E(r.plugin)||!Ta(r.status)||!Pa(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:E(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function Gn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!E(n.approvalUrl)||!E(n.token)||!E(n.projectId)||!E(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function Je(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(E(n.access_token))return{access_token:n.access_token,refresh_token:E(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:E(n.scope)?n.scope:void 0};throw new Error(E(n.error)?E(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Aa(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Ra(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;E(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function xa(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function jo(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!E(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!E(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",s=Ra(o.fields),a=Aa(o.missingRequiredFields),c=xa(o.status,o.connected,s,a);t.push({plugin:o.plugin,providerName:E(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:s,missingRequiredFields:a})}return{tenantId:n.tenantId,plugins:t}}function zn(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function qo(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}function Ko(e){return e.replace(/\/$/,"")}function er(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return ve()}catch{return null}}function Zo(e){let n=er(e);return n?{"x-corsair-delivery-url":n}:{}}async function Go(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Ia(e,n,t){if(n===404&&t)return t;let r=zn(e);return r||`Hub API returned HTTP ${n}`}function zo(e,n,t){let r=qo(e);throw r?new pe({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(Ia(e,n,t))}async function x(e){let n=Ko(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...Zo(e.hub)},body:JSON.stringify(e.body)}),r=await Go(t);return t.ok||zo(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function W(e){let n=Ko(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...Zo(e.hub)}}),r=await Go(t);return t.ok||zo(r,t.status,e.notFoundMessage),e.parseResponse(r)}function Jn(e){return e&&typeof e=="object"?e:{}}function Jo(e){let n=Jn(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function nr(e,n){return x({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=Jn(t);return{chat:r.thread,reply:Jo(r.reply)}}})}async function tr(e,n){return x({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Jo})}async function rr(e,n){return W({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Jn(t).threads;return Array.isArray(r)?r:[]}})}async function or(e,n){return W({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=Jn(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Ha}from"crypto";var Sa="corsair:client-bridge";function ir(e){return new URL(e).origin}function Ve(e){let n=JSON.stringify({type:Sa,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(ir(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+import{a as ve,b as Qt,c as Xt}from"./chunk-4OLKWKJG.js";import{a as Fo,b as Te,c as Uo,d as v,e as j,f as No,g as z,h as $,i as I,j as jn,k as Lo,l as ze,m as Yt,n as $o}from"./chunk-7AYINDN2.js";import{a as Bo}from"./chunk-N66TLOH2.js";import{ZodBoolean as vl,ZodDate as Tl,ZodEnum as Pl,ZodNullable as Al,ZodNumber as Rl,ZodObject as xl,ZodOptional as Il,ZodRecord as Sl,ZodString as _l,ZodType as El}from"zod";var qn=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","alchemy","algolia","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","appointo","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beeminder","benchmarkemail","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bitbucket","bitwarden","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","browserless","browsertool","bubble","bugsnag","buildkite","bunnycdn","cal","calendly","campayn","canva","canvas","capsulecrm","castingwords","cdrplatform","certifier","chatbotkit","chatfai","chmeetings","circleci","clickhouse","clientary","clockify","cloudflare","cloudinary","collegefootballdata","confluence","connecteam","contentfulgraphql","contextsevenmcp","convoloai","countdownapi","crowterminal","cursor","customgpt","dadataru","databricks","datadog","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","dodopayments","doppler","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","epicgames","exa","exist","facebook","faraday","figma","filloutforms","firecrawl","fireflies","flexisign","formbricks","gemini","github","gitlab","gladia","gmail","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","htmltoimage","hubspot","huggingface","imgbb","insightoai","instagram","intercom","jigsawstack","jira","kaggle","linear","linkedin","loyverse","mailboxlayer","mailchimp","mailtrap","marketstack","merriamwebsterdict","monday","neon","nextdns","notion","ocrspace","ocrwebservice","ollama","onedrive","onepassword","openai","openrouter","openweathermap","oura","outlook","pagerduty","parseur","pdfmonkey","perplexityai","pinecone","posthog","razorpay","reddit","removebg","resend","retailed","runpod","salesforce","sapsuccessfactors","scaleai","scrapegraphai","securitytrails","sendgrid","sentry","serpapi","sharepoint","slack","sourcegraph","spotify","strava","streamtime","stripe","studiobyai21labs","supabase","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","timecamp","timelink","tinyurl","tisane","todoist","toggl","trello","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","unione","uniswapapi","uploadcare","vapi","vercel","vestaboard","wakatime","webflow","webvizio","whatsapp","witai","wix","wiza","workday","workiom","worldnewsapi","xquik","youcom","youtube","zendesk","zohoinventory","zohomail","zoom","zoominfo"],Wo={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",alchemy:"Alchemy",algolia:"Algolia",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",appointo:"Appointo",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",bunnycdn:"Bunnycdn",cal:"Cal",calendly:"Calendly",campayn:"Campayn",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",castingwords:"CastingWords",cdrplatform:"CDR Platform",certifier:"Certifier",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chmeetings:"ChMeetings",circleci:"CircleCI",clickhouse:"Clickhouse",clientary:"Clientary",clockify:"Clockify",cloudflare:"Cloudflare",cloudinary:"Cloudinary",collegefootballdata:"College Football Data",confluence:"Confluence",connecteam:"Connecteam",contentfulgraphql:"Contentful GraphQL",contextsevenmcp:"Context7",convoloai:"ConvoloAi",countdownapi:"Countdown API",crowterminal:"CrowTerminal",cursor:"Cursor",customgpt:"CustomGPT",dadataru:"Dadataru",databricks:"Databricks",datadog:"Datadog",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",dodopayments:"Dodo Payments",doppler:"Doppler",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",epicgames:"Epic Games",exa:"Exa",exist:"Exist",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",flexisign:"Flexisign",formbricks:"Formbricks",gemini:"Gemini",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailboxlayer:"MailboxLayer",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",monday:"Monday",neon:"Neon",nextdns:"NextDNS",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfmonkey:"PDFMonkey",perplexityai:"Perplexity AI",pinecone:"Pinecone",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",removebg:"remove.bg",resend:"Resend",retailed:"Retailed",runpod:"RunPod",salesforce:"Salesforce",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",securitytrails:"SecurityTrails",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",sourcegraph:"Sourcegraph",spotify:"Spotify",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",timecamp:"TimeCamp",timelink:"Timelink",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",trello:"Trello",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",unione:"Unione",uniswapapi:"Uniswap",uploadcare:"Uploadcare",vapi:"Vapi",vercel:"Vercel",vestaboard:"Vestaboard",wakatime:"WakaTime",webflow:"Webflow",webvizio:"Webvizio",whatsapp:"WhatsApp",witai:"WitAi",wix:"Wix",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Pe(e){let n=Wo[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var pe=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function E(e){return typeof e=="string"&&e.length>0}function Ta(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Pa(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function Kn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!E(n.connectUrl)||!E(n.token)||!E(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:E(n.environmentId)?n.environmentId:n.projectId};return E(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function Zn(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!E(r.tenantId)||!E(r.plugin)||!Ta(r.status)||!Pa(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:E(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function Gn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!E(n.approvalUrl)||!E(n.token)||!E(n.projectId)||!E(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function Je(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(E(n.access_token))return{access_token:n.access_token,refresh_token:E(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:E(n.scope)?n.scope:void 0};throw new Error(E(n.error)?E(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Aa(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Ra(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;E(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function xa(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function jo(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!E(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!E(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",s=Ra(o.fields),a=Aa(o.missingRequiredFields),c=xa(o.status,o.connected,s,a);t.push({plugin:o.plugin,providerName:E(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:s,missingRequiredFields:a})}return{tenantId:n.tenantId,plugins:t}}function zn(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function qo(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}function Ko(e){return e.replace(/\/$/,"")}function er(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return ve()}catch{return null}}function Zo(e){let n=er(e);return n?{"x-corsair-delivery-url":n}:{}}async function Go(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Ia(e,n,t){if(n===404&&t)return t;let r=zn(e);return r||`Hub API returned HTTP ${n}`}function zo(e,n,t){let r=qo(e);throw r?new pe({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(Ia(e,n,t))}async function x(e){let n=Ko(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...Zo(e.hub)},body:JSON.stringify(e.body)}),r=await Go(t);return t.ok||zo(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function W(e){let n=Ko(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...Zo(e.hub)}}),r=await Go(t);return t.ok||zo(r,t.status,e.notFoundMessage),e.parseResponse(r)}function Jn(e){return e&&typeof e=="object"?e:{}}function Jo(e){let n=Jn(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function nr(e,n){return x({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=Jn(t);return{chat:r.thread,reply:Jo(r.reply)}}})}async function tr(e,n){return x({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Jo})}async function rr(e,n){return W({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Jn(t).threads;return Array.isArray(r)?r:[]}})}async function or(e,n){return W({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=Jn(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Ha}from"crypto";var Sa="corsair:client-bridge";function ir(e){return new URL(e).origin}function Ve(e){let n=JSON.stringify({type:Sa,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(ir(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
 (function () {
   var message = ${n};
   var targetOrigin = ${t};
@@ -6,7 +6,7 @@ import{a as ve,b as Qt,c as Xt}from"./chunk-4OLKWKJG.js";import{a as Fo,b as Te,
     window.parent.postMessage(message, targetOrigin);
   }
 })();
-</script></body></html>`}var _a=new Set(["localhost","127.0.0.1","[::1]","::1"]);function sr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:_a.has(n)}catch{return!1}}function vn(e){return e==="development"?"browser":"server"}function Vo(e){return vn(e)==="browser"}function Yo(e){return sr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Ma}from"crypto";var Ae=60*1e3,Be=300*1e3;import{createHmac as Ea,randomBytes as Da,timingSafeEqual as Oa}from"crypto";function ge(){return Da(16).toString("base64url")}function Tn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Ea("sha256",t).update(e).digest("base64url")}function ae(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let s=Tn(o,t);try{if(!Oa(Buffer.from(i,"utf8"),Buffer.from(s,"utf8")))return null}catch{return null}let a;try{a=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return a.exp*1e3<Date.now()?null:a}function Vn(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),s=Tn(i,n);return`${i}.${s}`}function Pn(e,n,t){let r=Math.floor(Date.now()/1e3);return Vn(e,n,r+Math.floor(t/1e3))}function Fe(e){return decodeURIComponent(e)}function ar(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function Qo(e){let n=e.trim();return n.length>0?n:null}function Ye(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function Qe(e,n){if(!Qo(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Ma(16).toString("base64url"),iat:t,exp:t+Math.floor(Ae/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=Tn(o,n);return`${o}.${i}`}function Re(e,n){return Qo(n)?ae(e,n):null}function Ba(e){let n=ir(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function cr(e){let n=Qe(Ba(e),e.signingSecret);return Ye(e.deliveryUrl,n)}function Xo(e){if(vn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Ha(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:cr(r)}}var An="https://auth.corsair.dev";var fe=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},Rn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function ur(e){let n=(e.apiUrl?.trim()||An).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"";if(!t||!r)throw new Rn;return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function Yn(e){return ur(e)}function Fa(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function F(e){let n=v(e).hub;if(!n||!Fa(n))throw new fe;return n}function ei(e){return e.replace(/\/$/,"")}function Qn(e){return e.oauthCallbackUrl?ei(e.oauthCallbackUrl.trim()):`${ei(e.apiUrl)}/oauth/callback`}function Xe(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}import{createCipheriv as ni,createDecipheriv as ti,randomBytes as Xn,scrypt as Ua}from"crypto";import{promisify as Na}from"util";var ri=Na(Ua),et="aes-256-gcm",oi=12,nt=16,La=16,Ue=32;function ye(){return Xn(Ue).toString("base64")}async function me(e,n){let t=Xn(La),r=await ri(n,t,Ue),o=Xn(oi),i=ni(et,r,o,{authTagLength:nt}),s=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),a.toString("base64"),s.toString("base64")].join(":")}async function Y(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),l=Buffer.from(i,"base64"),u=await ri(n,s,Ue),d=ti(et,u,a,{authTagLength:nt});return d.setAuthTag(c),Buffer.concat([d.update(l),d.final()]).toString("utf8")}function lr(e,n){let t=Buffer.from(n,"base64"),r=Xn(oi),o=ni(et,t,r,{authTagLength:nt}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[r.toString("base64"),s.toString("base64"),i.toString("base64")].join(":")}function xn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),l=ti(et,i,s,{authTagLength:nt});return l.setAuthTag(a),Buffer.concat([l.update(c),l.final()]).toString("utf8")}function xe(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=lr(o,n);return t}function he(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=xn(o,n);return t}function In(e,n,t){let r=he(e,n);return xe(r,t)}function ii(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let s=[null,void 0,""].includes(i)?null:i;await n({[o]:s})};return r}var dr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function U(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,s=[...$[n].integration,...i],a=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(a)return a;let k=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!k)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return a={id:k.id,config:dr(k.config),dek:k.dek??null},a},updateIntegration:async k=>{let b=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...k.config!==void 0?{config:k.config}:{},...k.dek!==void 0?{dek:k.dek}:{},updated_at:new Date}).where("id","=",b.id).execute(),a=null}},l=null,u=async()=>{if(l)return l;let k=await c.getIntegration();if(!k.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await Y(k.dek,r),l},d=async()=>{let k=await c.getIntegration(),b=await u(),C=k.config;return!C||Object.keys(C).length===0?{}:he(C,b)},p=Promise.resolve(),g=k=>{let b=p.then(()=>f(k));return p=b.catch(()=>{}),b},f=async k=>{let b=await u(),C;try{C=await d()}catch(D){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,D),C={}}let P={...C};for(let[D,H]of Object.entries(k))H===null?delete P[D]:P[D]=H;let O=xe(P,b);await c.updateIntegration({config:O})};return{get_dek:u,issue_new_dek:async()=>{let k=await c.getIntegration(),b=ye(),C={};if(k.dek){let O=await Y(k.dek,r),D=k.config;D&&Object.keys(D).length>0&&(C=In(D,O,b))}let P=await me(b,r);return await c.updateIntegration({config:C,dek:P}),l=b,b},...ii(d,g,s)}}function B(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:s=[],ensureProvisioned:a}=e,c=[...$[n].account,...s],l=null,u=null,d=async()=>{if(u)return u;let w=!1;for(;;){let A=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!A){if(!w&&a){w=!0,await a();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return u={id:A.id,config:dr(A.config),dek:A.dek??null},u}},p={kek:o,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(l)return l;let w=!1;for(;;){let A=await d(),R=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",A.id).executeTakeFirst();if(!R){if(!w&&a){w=!0,await a();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return l={id:R.id,config:dr(R.config),dek:R.dek??null},l}},updateAccount:async w=>{let A=await p.getAccount();await i.db.updateTable("corsair_accounts").set({...w.config!==void 0?{config:w.config}:{},...w.dek!==void 0?{dek:w.dek}:{},updated_at:new Date}).where("id","=",A.id).execute(),l=null}},g=null,f=null,h=async()=>{if(g)return g;let w=await p.getAccount();if(!w.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return g=await Y(w.dek,o),g},k=async()=>{if(f)return f;let w=await p.getIntegration();if(!w.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await Y(w.dek,o),f},b=async()=>{let w=await p.getAccount(),A=await h(),R=w.config;return!R||Object.keys(R).length===0?{}:he(R,A)},C=async()=>{let w=await p.getIntegration(),A=await k(),R=w.config;return!R||Object.keys(R).length===0?{}:he(R,A)},P=Promise.resolve(),O=w=>{let A=P.then(()=>D(w));return P=A.catch(()=>{}),A},D=async w=>{let A=await h(),R;try{R=await b()}catch(_){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,_),R={}}let J={...R};for(let[_,re]of Object.entries(w))re===null?delete J[_]:J[_]=re;let de=xe(J,A);await p.updateAccount({config:de})},H={get_dek:h,issue_new_dek:async()=>{let w=await p.getAccount(),A=ye(),R={};if(w.dek){let de=await Y(w.dek,o),_=w.config;_&&Object.keys(_).length>0&&(R=In(_,de,A))}let J=await me(A,o);return await p.updateAccount({config:R,dek:J}),g=A,A},...ii(b,O,c)};return n==="oauth_2"&&(H.get_integration_credentials=async()=>{let w=await C();return{...w,client_id:w.client_id||null,client_secret:w.client_secret||null,redirect_url:w.redirect_url??null}}),H}async function si(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=ye(),i=await me(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function ai(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let s=ye(),a=await me(s,r);return await e.db.updateTable("corsair_accounts").set({dek:a,updated_at:new Date}).where("id","=",i.id).execute(),s}var $a=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function Ie(e){return $a.has(e)}function Wa(e,n){return Ie(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function ja(e){return!Ie(e)}function qa(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function Ka(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function Za(e,n){let t=i=>n.find(s=>s.level==="account"&&s.name===i);if(!qa(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function ci(e,n){if(!e)return!1;let t=z(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function Ga(e,n){let r=e.authConfig?.[n]?.integration??[];return[...$[n].integration,...r]}function za(e,n){let r=e.authConfig?.[n]?.account??[];return[...$[n].account,...r]}function Ja(e,n,t){let r=t.filter(a=>a.required&&!a.configured).map(a=>a.name),o=t.filter(a=>a.level==="integration"&&a.required&&!a.configured).map(a=>a.name),i=t.filter(a=>a.level==="account"&&a.required&&a.configured),s;return o.length>0?s="missing_integration":r.length===0?s="ready":i.length>0?s="partial":s="not_started",{plugin:e,authType:n,status:s,connected:Za(n,t),fields:t,missingRequiredFields:r}}async function Ne(e,n,t){let r=I(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,s=i?.[r]?.integration??[],a=i?.[r]?.account??[],c=U({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:s}),l=B({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:a}),u=Ga(n,r),d=za(n,r),p=[];for(let g of u)p.push({name:g,level:"integration",required:Wa(r,g),configured:await ci(c,g)});for(let g of d)p.push({name:g,level:"account",required:ja(g),configured:await ci(l,g)});if(Ka(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return Ja(n.id,r,p)}async function Sn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let s of e.plugins){if(o&&!o.has(s.id))continue;let a=await Ne(e,s,r);a&&i.push(a)}return i}function tt(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var ui=Symbol.for("corsair:internal"),li=new WeakMap,di=new WeakMap;function Va(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function Ya(e){if(e.database){let t=li.get(e.database);return t||(t=new Map,li.set(e.database,t)),t}let n=di.get(e);return n||(n=new Map,di.set(e,n)),n}function Qa(e){return e.multiTenancy?{withTenant:()=>({}),[ui]:e}:{[ui]:e}}async function en(e,n){if(!e.database)return;let t=n.trim()||"default",r=Ya(e),o=Va(t,e.plugins),i=r.get(o);if(i){await i;return}let s=(async()=>{let{setupCorsair:a}=await import("./setup-7AOJIAWA.js");await a(Qa(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,s),await s}import*as _n from"crypto";function Se(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function pr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function nn(e,n){let t=_n.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var gr=600*1e3;function rt(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=_n.createHmac("sha256",n).update(r).digest("base64url"),s=Buffer.from(o,"base64url"),a=Buffer.from(i,"base64url");return s.length!==a.length||!_n.timingSafeEqual(s,a)?null:pr(r,{maxAgeMs:gr})}function pi(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function gi(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function tn(e,n){await x({hub:e,path:"/connections/report",body:pi(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function Xa(e,n){try{let t=F(e);x({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof fe)return}}async function ec(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!I(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ne(n,e.plugin,r);o&&yi(e.hub,gi({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function fi(e,n){Xa(e,n)}function yi(e,n){x({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function rn(e){ec(e).catch(()=>{})}async function be(e,n){let t=v(e);if(!I(n.plugin))return;let o=await Ne(t,n.plugin,n.tenantId);o&&fi(e,gi({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function ot(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var mi=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function nc(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function tc(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await Y(n.dek,e.kek),r=mi(n.config),o={};Object.keys(r).length>0&&(o=he(r,t)),o[e.link.linkType]=e.link.externalId;let i=xe(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function on(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:s,extraAccountFields:a=[]}=e,{accountId:c}=await nc({database:n,pluginId:r,tenantId:o}),l=!1;if(s){let u=B({authType:s,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:a}),d=`set_${i.linkType}`,p=u[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await tc({database:n,kek:t,accountId:c,link:i})}async function fr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,s=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let a of s)if(a.dek)try{let c=await Y(a.dek,t),u=mi(a.config)[o];if(!u)continue;if(xn(u,c)===i)return a}catch{continue}return null}async function it(e){return(await fr(e))?.tenant_id??null}async function hi(e){return it({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as bi from"querystring";function Le(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${bi.stringify(i)}`}async function ki(e,n){try{return await W({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function sn(e,n,t,r){if(!n.subscribe)return;let o=F(e),i=await ki(o,n.id);if(!i)return;let s=await n.subscribe({keys:r},{webhookUrl:i});s&&await be(e,{plugin:n,tenantId:t,verified:!0,webhookLink:s.webhookLink,webhookSecret:s.webhookSecret})}var q=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function wi(e){let n=e.oauthConfig;if(!n)throw new q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function rc(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let s=await i.executeTakeFirst();if(!s)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",s.id).executeTakeFirst())return;let c=ye(),l=await me(c,r),u=new Date;await o.insertInto("corsair_accounts").values({id:ze(),created_at:u,updated_at:u,tenant_id:t,integration_id:s.id,config:{},dek:l}).execute()})}async function yr(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,s=v(e,()=>new q("invalid_corsair_instance","Invalid corsair instance"));if(!s.database)throw new Error("No database configured on corsair instance");let a=j(s,n,p=>new q("plugin_not_found",p)),c=wi(a),u=await U({authType:"oauth_2",integrationName:n,kek:s.kek,database:s.database}).get_client_id();if(!u)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Le({oauthConfig:c,clientId:u,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=nn(Se(n,r),s.kek);return{url:Le({oauthConfig:c,clientId:u,redirectUri:o,state:d}),state:d}}function oc(e,n){return{...n??{},...e}}async function En(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new q("invalid_corsair_instance","Invalid corsair instance")),s,a;if(n.trusted){if(!n.plugin||!n.tenantId)throw new q("invalid_state","trusted callback requires plugin and tenantId");s=n.plugin,a=n.tenantId}else{let h=rt(r,i.kek);if(!h)throw new q("invalid_state","Invalid or tampered state parameter");s=h.plugin,a=h.tenantId}if(!i.database)throw new q("no_database","No database configured on corsair instance");let c=j(i,s,h=>new q("plugin_not_found",h)),l=wi(c),u=U({authType:"oauth_2",integrationName:s,kek:i.kek,database:i.database}),d=await u.get_client_id(),p=await u.get_client_secret();if(!d||!p)throw new q("credentials_not_configured",`Credentials not configured for '${s}'`);await rc(i.database,s,a,i.kek);let g=await st(t,d,p,l,o);if(!g.access_token)throw new q("no_access_token",`No access_token returned from ${l.providerName}`);let f=B({authType:"oauth_2",integrationName:s,tenantId:a,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await be(e,{plugin:c,tenantId:a}).catch(()=>{});try{let h=oc(g,n.callbackParams),k=await ot(i.plugins,s,h);if(k){try{let b=c.authConfig?.oauth_2?.account??[];await on({database:i.database,kek:i.kek,pluginId:s,tenantId:a,link:k,authType:"oauth_2",extraAccountFields:b})}catch(b){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${a}':`,b)}i.hub&&tn(i.hub,{plugin:s,tenantId:a,link:k,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${a}':`,h)}if(c.subscribe)try{await sn(e,c,a,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${s}' tenant '${a}':`,h)}return{plugin:s,tenantId:a}}async function ic(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??sn,i=[],s=[];if(!t.database)return{renewed:i,failed:s};for(let a of r){let c=t.plugins.find(u=>u.id===a.integrationName);if(!c?.subscribe)continue;let l=`${c.id}/${a.tenantId}`;try{let u=I(c)??"oauth_2",d=B({authType:u,integrationName:c.id,tenantId:a.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[u]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:u,keys:g,hub:t.hub},"endpoint")}await o(n,c,a.tenantId,d),i.push(l)}catch(u){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,u),s.push(l)}}return{renewed:i,failed:s}}async function Ci(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return ic({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function sc(e,n={}){let t=!1,r=()=>{t||(t=!0,Ci(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function vi(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await at(e,{silent:!0})}async function an(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await en(t,n)}var ac=Symbol.for("corsair:internal"),cc=new Set(["access_token","refresh_token","expires_at","scope"]);function uc(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function lc(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!Ie(t)&&!cc.has(t)):n.filter(t=>!Ie(t))}function Ti(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function dc(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function pc(e){return{[ac]:Ti(e)}}async function ct(e,n,t={}){let r=Qn(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,s=Ti(e),a=pc(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let l=I(c);if(!l)continue;let u=uc(l),d=t.providerNameOverrides?.[c.id]??Pe(c.id),p=await Ne(s,c,n),g=jn(c,l),f=lc(l,g),h={plugin:c.id,providerName:d,authKind:u,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),u==="oauth"){let b=t.oauthModeOverrides?.[c.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=b,!t.skipOAuthUrlGeneration&&b!=="managed")try{let C=await yr(a,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=C.url}catch(C){C instanceof Error&&/client_id not configured/i.test(C.message)||(h.setupError=C instanceof Error?C.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function rg(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return ct({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function Pi(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await en(e.internalConfig??dc(e),n)}async function Ai(e,n){await an(e,n)}async function Ri(e,n){let t=Xe(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=ve({deliveryUrl:n.deliveryUrl})),x({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Kn})}async function xi(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await Pi(t,n.tenantId);let r=await ct(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return Ri(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function ut(e,n){let t=v(e),r=F(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Ai(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,s=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await ct(o,n.tenantId,{pluginIds:i,oauthModeOverrides:s,providerNameOverrides:a});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return Ri(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function lt(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(s=>s.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await gc(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function gc(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-SLWJPWLI.js"),{postHubConnectSession:i}=await import("./connect-PRWU3TDO.js"),s={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(s,t.tenantId);let a=await r(s,t.tenantId,{pluginIds:t.pluginIds});if(a.length===0)throw new Error("No connectable plugins found for this tenant");let c=a.find(l=>l.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:a})}function cn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var Q=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function fc(e){let n=e.oauthConfig;if(!n)throw new Q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function mr(e,n){let t=v(e,()=>new Q("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new Q("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new Q("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=rt(n,t.kek);if(!o)throw new Q("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:s}=o,a=j(t,i,p=>new Q("plugin_not_found",p)),c=fc(a),u=await U({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!u)throw new Q("client_id_not_configured",`client_id not configured for '${i}'`);let d=Le({oauthConfig:c,clientId:u,redirectUri:r,state:n});return{plugin:i,tenantId:s,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as mc}from"async_hooks";import{randomBytes as hc}from"crypto";import{v4 as bc}from"uuid";async function dt(e,n){let t=Xe(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=ve({deliveryUrl:n.deliveryUrl})),x({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Gn})}function pt(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var hr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function kr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Ii(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function br(e){return pt(e)}async function wr(e,n){if(kr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Ii(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await dt(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:yc(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function yc(e){try{return JSON.parse(e)}catch{return e}}async function gt(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await wr(e,n);return{...n,approvalUrl:r}}async function Cr(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:s,endpoint:a,args:c,tenantId:l,expiresAt:u,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:s,endpoint:a,args:c});let g=await wr({manual:t,hub:r},{id:o,token:i,plugin:s,endpoint:a,args:JSON.stringify(c),tenant_id:l,expires_at:u});return kr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):br(g):hr:r?g?br(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:hr}var un=class extends Error{constructor(n){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError"}};var _i=new mc,ft=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function vr(e){return _i.run(!0,e)}function Ei(){return _i.getStore()===!0}function Tr(e,n){if(Ei()&&n!=="read")throw new ft(e,n)}var kc={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function wc(e,n,t){return t!==void 0?t:kc[n][e]}function Pr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Di(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Si(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Oi(e){let n=wc(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+</script></body></html>`}var _a=new Set(["localhost","127.0.0.1","[::1]","::1"]);function sr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:_a.has(n)}catch{return!1}}function vn(e){return e==="development"?"browser":"server"}function Vo(e){return vn(e)==="browser"}function Yo(e){return sr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Ma}from"crypto";var Ae=60*1e3,Be=300*1e3;import{createHmac as Ea,randomBytes as Da,timingSafeEqual as Oa}from"crypto";function ge(){return Da(16).toString("base64url")}function Tn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Ea("sha256",t).update(e).digest("base64url")}function ae(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let s=Tn(o,t);try{if(!Oa(Buffer.from(i,"utf8"),Buffer.from(s,"utf8")))return null}catch{return null}let a;try{a=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return a.exp*1e3<Date.now()?null:a}function Vn(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),s=Tn(i,n);return`${i}.${s}`}function Pn(e,n,t){let r=Math.floor(Date.now()/1e3);return Vn(e,n,r+Math.floor(t/1e3))}function Fe(e){return decodeURIComponent(e)}function ar(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function Qo(e){let n=e.trim();return n.length>0?n:null}function Ye(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function Qe(e,n){if(!Qo(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Ma(16).toString("base64url"),iat:t,exp:t+Math.floor(Ae/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=Tn(o,n);return`${o}.${i}`}function Re(e,n){return Qo(n)?ae(e,n):null}function Ba(e){let n=ir(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function cr(e){let n=Qe(Ba(e),e.signingSecret);return Ye(e.deliveryUrl,n)}function Xo(e){if(vn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Ha(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:cr(r)}}var An="https://auth.corsair.dev";var fe=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},Rn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function ur(e){let n=(e.apiUrl?.trim()||An).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"";if(!t||!r)throw new Rn;return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function Yn(e){return ur(e)}function Fa(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function F(e){let n=v(e).hub;if(!n||!Fa(n))throw new fe;return n}function ei(e){return e.replace(/\/$/,"")}function Qn(e){return e.oauthCallbackUrl?ei(e.oauthCallbackUrl.trim()):`${ei(e.apiUrl)}/oauth/callback`}function Xe(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}import{createCipheriv as ni,createDecipheriv as ti,randomBytes as Xn,scrypt as Ua}from"crypto";import{promisify as Na}from"util";var ri=Na(Ua),et="aes-256-gcm",oi=12,nt=16,La=16,Ue=32;function ye(){return Xn(Ue).toString("base64")}async function me(e,n){let t=Xn(La),r=await ri(n,t,Ue),o=Xn(oi),i=ni(et,r,o,{authTagLength:nt}),s=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),a.toString("base64"),s.toString("base64")].join(":")}async function Y(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),l=Buffer.from(i,"base64"),u=await ri(n,s,Ue),d=ti(et,u,a,{authTagLength:nt});return d.setAuthTag(c),Buffer.concat([d.update(l),d.final()]).toString("utf8")}function lr(e,n){let t=Buffer.from(n,"base64"),r=Xn(oi),o=ni(et,t,r,{authTagLength:nt}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[r.toString("base64"),s.toString("base64"),i.toString("base64")].join(":")}function xn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),l=ti(et,i,s,{authTagLength:nt});return l.setAuthTag(a),Buffer.concat([l.update(c),l.final()]).toString("utf8")}function xe(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=lr(o,n);return t}function he(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=xn(o,n);return t}function In(e,n,t){let r=he(e,n);return xe(r,t)}function ii(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let s=[null,void 0,""].includes(i)?null:i;await n({[o]:s})};return r}var dr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function U(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,s=[...$[n].integration,...i],a=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(a)return a;let k=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!k)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return a={id:k.id,config:dr(k.config),dek:k.dek??null},a},updateIntegration:async k=>{let b=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...k.config!==void 0?{config:k.config}:{},...k.dek!==void 0?{dek:k.dek}:{},updated_at:new Date}).where("id","=",b.id).execute(),a=null}},l=null,u=async()=>{if(l)return l;let k=await c.getIntegration();if(!k.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await Y(k.dek,r),l},d=async()=>{let k=await c.getIntegration(),b=await u(),C=k.config;return!C||Object.keys(C).length===0?{}:he(C,b)},p=Promise.resolve(),g=k=>{let b=p.then(()=>f(k));return p=b.catch(()=>{}),b},f=async k=>{let b=await u(),C;try{C=await d()}catch(D){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,D),C={}}let P={...C};for(let[D,H]of Object.entries(k))H===null?delete P[D]:P[D]=H;let O=xe(P,b);await c.updateIntegration({config:O})};return{get_dek:u,issue_new_dek:async()=>{let k=await c.getIntegration(),b=ye(),C={};if(k.dek){let O=await Y(k.dek,r),D=k.config;D&&Object.keys(D).length>0&&(C=In(D,O,b))}let P=await me(b,r);return await c.updateIntegration({config:C,dek:P}),l=b,b},...ii(d,g,s)}}function B(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:s=[],ensureProvisioned:a}=e,c=[...$[n].account,...s],l=null,u=null,d=async()=>{if(u)return u;let w=!1;for(;;){let A=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!A){if(!w&&a){w=!0,await a();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return u={id:A.id,config:dr(A.config),dek:A.dek??null},u}},p={kek:o,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(l)return l;let w=!1;for(;;){let A=await d(),R=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",A.id).executeTakeFirst();if(!R){if(!w&&a){w=!0,await a();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return l={id:R.id,config:dr(R.config),dek:R.dek??null},l}},updateAccount:async w=>{let A=await p.getAccount();await i.db.updateTable("corsair_accounts").set({...w.config!==void 0?{config:w.config}:{},...w.dek!==void 0?{dek:w.dek}:{},updated_at:new Date}).where("id","=",A.id).execute(),l=null}},g=null,f=null,h=async()=>{if(g)return g;let w=await p.getAccount();if(!w.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return g=await Y(w.dek,o),g},k=async()=>{if(f)return f;let w=await p.getIntegration();if(!w.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await Y(w.dek,o),f},b=async()=>{let w=await p.getAccount(),A=await h(),R=w.config;return!R||Object.keys(R).length===0?{}:he(R,A)},C=async()=>{let w=await p.getIntegration(),A=await k(),R=w.config;return!R||Object.keys(R).length===0?{}:he(R,A)},P=Promise.resolve(),O=w=>{let A=P.then(()=>D(w));return P=A.catch(()=>{}),A},D=async w=>{let A=await h(),R;try{R=await b()}catch(_){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,_),R={}}let J={...R};for(let[_,re]of Object.entries(w))re===null?delete J[_]:J[_]=re;let de=xe(J,A);await p.updateAccount({config:de})},H={get_dek:h,issue_new_dek:async()=>{let w=await p.getAccount(),A=ye(),R={};if(w.dek){let de=await Y(w.dek,o),_=w.config;_&&Object.keys(_).length>0&&(R=In(_,de,A))}let J=await me(A,o);return await p.updateAccount({config:R,dek:J}),g=A,A},...ii(b,O,c)};return n==="oauth_2"&&(H.get_integration_credentials=async()=>{let w=await C();return{...w,client_id:w.client_id||null,client_secret:w.client_secret||null,redirect_url:w.redirect_url??null}}),H}async function si(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=ye(),i=await me(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function ai(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let s=ye(),a=await me(s,r);return await e.db.updateTable("corsair_accounts").set({dek:a,updated_at:new Date}).where("id","=",i.id).execute(),s}var $a=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function Ie(e){return $a.has(e)}function Wa(e,n){return Ie(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function ja(e){return!Ie(e)}function qa(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function Ka(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function Za(e,n){let t=i=>n.find(s=>s.level==="account"&&s.name===i);if(!qa(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function ci(e,n){if(!e)return!1;let t=z(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function Ga(e,n){let r=e.authConfig?.[n]?.integration??[];return[...$[n].integration,...r]}function za(e,n){let r=e.authConfig?.[n]?.account??[];return[...$[n].account,...r]}function Ja(e,n,t){let r=t.filter(a=>a.required&&!a.configured).map(a=>a.name),o=t.filter(a=>a.level==="integration"&&a.required&&!a.configured).map(a=>a.name),i=t.filter(a=>a.level==="account"&&a.required&&a.configured),s;return o.length>0?s="missing_integration":r.length===0?s="ready":i.length>0?s="partial":s="not_started",{plugin:e,authType:n,status:s,connected:Za(n,t),fields:t,missingRequiredFields:r}}async function Ne(e,n,t){let r=I(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,s=i?.[r]?.integration??[],a=i?.[r]?.account??[],c=U({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:s}),l=B({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:a}),u=Ga(n,r),d=za(n,r),p=[];for(let g of u)p.push({name:g,level:"integration",required:Wa(r,g),configured:await ci(c,g)});for(let g of d)p.push({name:g,level:"account",required:ja(g),configured:await ci(l,g)});if(Ka(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return Ja(n.id,r,p)}async function Sn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let s of e.plugins){if(o&&!o.has(s.id))continue;let a=await Ne(e,s,r);a&&i.push(a)}return i}function tt(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var ui=Symbol.for("corsair:internal"),li=new WeakMap,di=new WeakMap;function Va(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function Ya(e){if(e.database){let t=li.get(e.database);return t||(t=new Map,li.set(e.database,t)),t}let n=di.get(e);return n||(n=new Map,di.set(e,n)),n}function Qa(e){return e.multiTenancy?{withTenant:()=>({}),[ui]:e}:{[ui]:e}}async function en(e,n){if(!e.database)return;let t=n.trim()||"default",r=Ya(e),o=Va(t,e.plugins),i=r.get(o);if(i){await i;return}let s=(async()=>{let{setupCorsair:a}=await import("./setup-UE6ZXEGK.js");await a(Qa(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,s),await s}import*as _n from"crypto";function Se(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function pr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function nn(e,n){let t=_n.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var gr=600*1e3;function rt(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=_n.createHmac("sha256",n).update(r).digest("base64url"),s=Buffer.from(o,"base64url"),a=Buffer.from(i,"base64url");return s.length!==a.length||!_n.timingSafeEqual(s,a)?null:pr(r,{maxAgeMs:gr})}function pi(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function gi(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function tn(e,n){await x({hub:e,path:"/connections/report",body:pi(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function Xa(e,n){try{let t=F(e);x({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof fe)return}}async function ec(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!I(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ne(n,e.plugin,r);o&&yi(e.hub,gi({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function fi(e,n){Xa(e,n)}function yi(e,n){x({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function rn(e){ec(e).catch(()=>{})}async function be(e,n){let t=v(e);if(!I(n.plugin))return;let o=await Ne(t,n.plugin,n.tenantId);o&&fi(e,gi({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function ot(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var mi=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function nc(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function tc(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await Y(n.dek,e.kek),r=mi(n.config),o={};Object.keys(r).length>0&&(o=he(r,t)),o[e.link.linkType]=e.link.externalId;let i=xe(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function on(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:s,extraAccountFields:a=[]}=e,{accountId:c}=await nc({database:n,pluginId:r,tenantId:o}),l=!1;if(s){let u=B({authType:s,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:a}),d=`set_${i.linkType}`,p=u[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await tc({database:n,kek:t,accountId:c,link:i})}async function fr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,s=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let a of s)if(a.dek)try{let c=await Y(a.dek,t),u=mi(a.config)[o];if(!u)continue;if(xn(u,c)===i)return a}catch{continue}return null}async function it(e){return(await fr(e))?.tenant_id??null}async function hi(e){return it({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as bi from"querystring";function Le(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${bi.stringify(i)}`}async function ki(e,n){try{return await W({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function sn(e,n,t,r){if(!n.subscribe)return;let o=F(e),i=await ki(o,n.id);if(!i)return;let s=await n.subscribe({keys:r},{webhookUrl:i});s&&await be(e,{plugin:n,tenantId:t,verified:!0,webhookLink:s.webhookLink,webhookSecret:s.webhookSecret})}var q=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function wi(e){let n=e.oauthConfig;if(!n)throw new q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function rc(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let s=await i.executeTakeFirst();if(!s)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",s.id).executeTakeFirst())return;let c=ye(),l=await me(c,r),u=new Date;await o.insertInto("corsair_accounts").values({id:ze(),created_at:u,updated_at:u,tenant_id:t,integration_id:s.id,config:{},dek:l}).execute()})}async function yr(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,s=v(e,()=>new q("invalid_corsair_instance","Invalid corsair instance"));if(!s.database)throw new Error("No database configured on corsair instance");let a=j(s,n,p=>new q("plugin_not_found",p)),c=wi(a),u=await U({authType:"oauth_2",integrationName:n,kek:s.kek,database:s.database}).get_client_id();if(!u)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Le({oauthConfig:c,clientId:u,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=nn(Se(n,r),s.kek);return{url:Le({oauthConfig:c,clientId:u,redirectUri:o,state:d}),state:d}}function oc(e,n){return{...n??{},...e}}async function En(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new q("invalid_corsair_instance","Invalid corsair instance")),s,a;if(n.trusted){if(!n.plugin||!n.tenantId)throw new q("invalid_state","trusted callback requires plugin and tenantId");s=n.plugin,a=n.tenantId}else{let h=rt(r,i.kek);if(!h)throw new q("invalid_state","Invalid or tampered state parameter");s=h.plugin,a=h.tenantId}if(!i.database)throw new q("no_database","No database configured on corsair instance");let c=j(i,s,h=>new q("plugin_not_found",h)),l=wi(c),u=U({authType:"oauth_2",integrationName:s,kek:i.kek,database:i.database}),d=await u.get_client_id(),p=await u.get_client_secret();if(!d||!p)throw new q("credentials_not_configured",`Credentials not configured for '${s}'`);await rc(i.database,s,a,i.kek);let g=await st(t,d,p,l,o);if(!g.access_token)throw new q("no_access_token",`No access_token returned from ${l.providerName}`);let f=B({authType:"oauth_2",integrationName:s,tenantId:a,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await be(e,{plugin:c,tenantId:a}).catch(()=>{});try{let h=oc(g,n.callbackParams),k=await ot(i.plugins,s,h);if(k){try{let b=c.authConfig?.oauth_2?.account??[];await on({database:i.database,kek:i.kek,pluginId:s,tenantId:a,link:k,authType:"oauth_2",extraAccountFields:b})}catch(b){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${a}':`,b)}i.hub&&tn(i.hub,{plugin:s,tenantId:a,link:k,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${a}':`,h)}if(c.subscribe)try{await sn(e,c,a,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${s}' tenant '${a}':`,h)}return{plugin:s,tenantId:a}}async function ic(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??sn,i=[],s=[];if(!t.database)return{renewed:i,failed:s};for(let a of r){let c=t.plugins.find(u=>u.id===a.integrationName);if(!c?.subscribe)continue;let l=`${c.id}/${a.tenantId}`;try{let u=I(c)??"oauth_2",d=B({authType:u,integrationName:c.id,tenantId:a.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[u]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:u,keys:g,hub:t.hub},"endpoint")}await o(n,c,a.tenantId,d),i.push(l)}catch(u){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,u),s.push(l)}}return{renewed:i,failed:s}}async function Ci(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return ic({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function sc(e,n={}){let t=!1,r=()=>{t||(t=!0,Ci(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function vi(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await at(e,{silent:!0})}async function an(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await en(t,n)}var ac=Symbol.for("corsair:internal"),cc=new Set(["access_token","refresh_token","expires_at","scope"]);function uc(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function lc(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!Ie(t)&&!cc.has(t)):n.filter(t=>!Ie(t))}function Ti(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function dc(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function pc(e){return{[ac]:Ti(e)}}async function ct(e,n,t={}){let r=Qn(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,s=Ti(e),a=pc(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let l=I(c);if(!l)continue;let u=uc(l),d=t.providerNameOverrides?.[c.id]??Pe(c.id),p=await Ne(s,c,n),g=jn(c,l),f=lc(l,g),h={plugin:c.id,providerName:d,authKind:u,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),u==="oauth"){let b=t.oauthModeOverrides?.[c.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=b,!t.skipOAuthUrlGeneration&&b!=="managed")try{let C=await yr(a,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=C.url}catch(C){C instanceof Error&&/client_id not configured/i.test(C.message)||(h.setupError=C instanceof Error?C.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function rg(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return ct({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function Pi(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await en(e.internalConfig??dc(e),n)}async function Ai(e,n){await an(e,n)}async function Ri(e,n){let t=Xe(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=ve({deliveryUrl:n.deliveryUrl})),x({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Kn})}async function xi(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await Pi(t,n.tenantId);let r=await ct(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return Ri(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function ut(e,n){let t=v(e),r=F(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Ai(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,s=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await ct(o,n.tenantId,{pluginIds:i,oauthModeOverrides:s,providerNameOverrides:a});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return Ri(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function lt(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(s=>s.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await gc(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function gc(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-QE6ZJWOF.js"),{postHubConnectSession:i}=await import("./connect-2YTVRI7C.js"),s={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(s,t.tenantId);let a=await r(s,t.tenantId,{pluginIds:t.pluginIds});if(a.length===0)throw new Error("No connectable plugins found for this tenant");let c=a.find(l=>l.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:a})}function cn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var Q=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function fc(e){let n=e.oauthConfig;if(!n)throw new Q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function mr(e,n){let t=v(e,()=>new Q("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new Q("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new Q("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=rt(n,t.kek);if(!o)throw new Q("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:s}=o,a=j(t,i,p=>new Q("plugin_not_found",p)),c=fc(a),u=await U({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!u)throw new Q("client_id_not_configured",`client_id not configured for '${i}'`);let d=Le({oauthConfig:c,clientId:u,redirectUri:r,state:n});return{plugin:i,tenantId:s,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as mc}from"async_hooks";import{randomBytes as hc}from"crypto";import{v4 as bc}from"uuid";async function dt(e,n){let t=Xe(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=ve({deliveryUrl:n.deliveryUrl})),x({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Gn})}function pt(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var hr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function kr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Ii(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function br(e){return pt(e)}async function wr(e,n){if(kr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Ii(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await dt(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:yc(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function yc(e){try{return JSON.parse(e)}catch{return e}}async function gt(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await wr(e,n);return{...n,approvalUrl:r}}async function Cr(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:s,endpoint:a,args:c,tenantId:l,expiresAt:u,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:s,endpoint:a,args:c});let g=await wr({manual:t,hub:r},{id:o,token:i,plugin:s,endpoint:a,args:JSON.stringify(c),tenant_id:l,expires_at:u});return kr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):br(g):hr:r?g?br(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:hr}var un=class extends Error{constructor(n){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError"}};var _i=new mc,ft=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function vr(e){return _i.run(!0,e)}function Ei(){return _i.getStore()===!0}function Tr(e,n){if(Ei()&&n!=="read")throw new ft(e,n)}var kc={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function wc(e,n,t){return t!==void 0?t:kc[n][e]}function Pr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Di(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Si(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Oi(e){let n=wc(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
   Action: ${r}`,`
   To allow this, update the permission mode or add an override in your corsair config.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),s=e.tenantId??"default",a=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",s).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(a){if(a.status==="approved"){let f=e.db,h=a.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return a.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
   Action: ${r}`,`
@@ -59,7 +59,7 @@ ${la(o,d)}`),h.join(`
 `)}}}return Po(Ge(e),"Path not found. Available operations")}function oa(e){let n=e;for(;;){let t=ne(n),r=te(t);if(Io(r)){let o=ee(t);if(!o)return n;n=o;continue}return n}}function kn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=oa(e),t=ne(n);if(te(t)==="ZodObject"){let o=Zt(n,t),i=[];for(let[s,a]of Object.entries(o)){let c=ne(a),l=te(c),u=l==="ZodOptional"||l==="ZodNullable",d=oa(a),p=ol(a);i.push({key:s,optional:u,type:G(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:G(n)}}function Kt(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=ra.repeat(n+1),r=ra.repeat(n);return`{
 ${e.fields.map(i=>{let s=i.optional?`${i.key}?`:i.key,a=i.description?`  // ${i.description}`:"";return`${t}${s}: ${i.type}${a}`}).join(`
 `)}
-${r}}`}return"unknown"}function ll(e,n){let t=Ge(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(u=>u.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let u of t){let{shortPath:d,lookupKey:p}=ul(u,n),g=Oe(r.endpointMeta,p),f=Oe(r.endpointSchemas,p);!g&&!f||o.push({path:u,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:kn(f?.input),output:kn(f?.output)})}o.sort((u,d)=>u.path.localeCompare(d.path));let i=[],s=Ge(e,{plugin:n,type:"webhooks"});if(Array.isArray(s)&&r.webhooks)for(let u of s){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=Eo(r.webhooks,f.split("."));if(h===null)continue;let k=h.join("."),b=Oe(r.webhookSchemas,k.toLowerCase()),C=b?.response?G(b.response):void 0;i.push({path:u,description:b?.description,payload:kn(b?.payload),responseType:C,usageExample:la(n,h)})}i.sort((u,d)=>u.path.localeCompare(d.path));let a=[],c=Ge(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(c)&&l)for(let u of c){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let k=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let C=ua(l,k);if(!C)continue;let[P,O]=C,D=_o(O),H=Object.entries(D).map(([w,A])=>({field:w,type:A.type,operators:A.operators}));a.push({path:u,entityName:P,filters:[{field:"entity_id",type:"string",operators:So},...H]})}return a.sort((u,d)=>u.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:a}}}import{randomUUID as da}from"crypto";async function dl(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=da(),o=da(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as pl}from"crypto";var Gt="https://graph.microsoft.com/v1.0",Do=2e4,gl=60;async function fl(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${Gt}/subscriptions`,{headers:r,signal:AbortSignal.timeout(Do)});if(c.ok){let{value:l}=await c.json(),u=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(u.map(d=>fetch(`${Gt}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(Do)}).catch(()=>{})))}}catch{}let o=pl(),i=new Date(Date.now()+gl*6e4).toISOString(),s=await fetch(`${Gt}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(Do),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!s.ok)throw new Error(`MS Graph subscribe failed (${s.status}): ${await s.text()}`);let a=await s.json();return a.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:a.id},webhookSecret:o}):null}function pa(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function yl(e,n){let t=pa(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function ml(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function ga(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function fa(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function Wn(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function hl(e){return Wn(e.body)}function ya(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return zt(Array.isArray(r)?r:[r])}function ma(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let l=zt(Array.isArray(c)?c:[c]);if(l)return decodeURIComponent(l)}let r=ya({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let l=n[c],u=Array.isArray(l)?l[0]:l;if(!(!u||typeof u!="string"))try{let p=(u.startsWith("http")?new URL(u):new URL(`https://example.invalid${u.startsWith("/")?u:`/${u}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,s=Wn(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return zt([s?.validationToken])??null}function bl(e){if(ma(e))return!0;let n=Wn(e.body??e.payload);return ga(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function zt(e){for(let n of e){let t=fa(n);if(t)return t}}function kl(e){let t=Wn(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var $n=Symbol.for("corsair:internal");function ka(e){let n=e.database?Bo(e.database):void 0,t=e.kek,r=n&&t?Ms(e.plugins,n,t):Lt(!!n,!!t),o=Hs(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?Yn(e.hub):void 0},s=Di(n),a=Vs(i);if(e.multiTenancy){let u=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=To(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[$n]:i})},keys:r,permissions:s,manage:a},{[$n]:i});return ha(u,i.hub),ba(u,i.hub),u}let c=To(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},c,{keys:r,permissions:s,manage:a,[$n]:i});return ha(l,i.hub),ba(l,i.hub),l}function ha(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-U76A2EHY.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function wl(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var Jt=globalThis.__corsairTunnels??=new Set;function ba(e,n){if(!wl(n))return;let t=n.projectApiKey;if(Jt.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}Jt.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Qt;import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:()=>Jt.delete(t)})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Xt}`)}).catch(s=>{Jt.delete(t),console.warn(`[corsair] tunnel failed to start: ${s instanceof Error?s.message:String(s)}. Run \`corsair setup\` to enable your dev tunnel.`)})}var Cl={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Oo=Cl;async function at(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},s=n?.caller??"script",a=Uo(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=Ol(e,a.plugins,n),l={...a,database:a.database},u=l.database.db;await Bl(u,i);let d=await Fl(u,l,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Ll(e,c,n.credentials,l,o,i);let p=await Wl(d,c,o,s);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=ka({plugins:a.plugins,database:u,kek:a.kek,multiTenancy:!0}).withTenant(c.tenantId);await jl(g,a.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+${r}}`}return"unknown"}function ll(e,n){let t=Ge(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(u=>u.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let u of t){let{shortPath:d,lookupKey:p}=ul(u,n),g=Oe(r.endpointMeta,p),f=Oe(r.endpointSchemas,p);!g&&!f||o.push({path:u,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:kn(f?.input),output:kn(f?.output)})}o.sort((u,d)=>u.path.localeCompare(d.path));let i=[],s=Ge(e,{plugin:n,type:"webhooks"});if(Array.isArray(s)&&r.webhooks)for(let u of s){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=Eo(r.webhooks,f.split("."));if(h===null)continue;let k=h.join("."),b=Oe(r.webhookSchemas,k.toLowerCase()),C=b?.response?G(b.response):void 0;i.push({path:u,description:b?.description,payload:kn(b?.payload),responseType:C,usageExample:la(n,h)})}i.sort((u,d)=>u.path.localeCompare(d.path));let a=[],c=Ge(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(c)&&l)for(let u of c){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let k=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let C=ua(l,k);if(!C)continue;let[P,O]=C,D=_o(O),H=Object.entries(D).map(([w,A])=>({field:w,type:A.type,operators:A.operators}));a.push({path:u,entityName:P,filters:[{field:"entity_id",type:"string",operators:So},...H]})}return a.sort((u,d)=>u.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:a}}}import{randomUUID as da}from"crypto";async function dl(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=da(),o=da(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as pl}from"crypto";var Gt="https://graph.microsoft.com/v1.0",Do=2e4,gl=60;async function fl(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${Gt}/subscriptions`,{headers:r,signal:AbortSignal.timeout(Do)});if(c.ok){let{value:l}=await c.json(),u=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(u.map(d=>fetch(`${Gt}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(Do)}).catch(()=>{})))}}catch{}let o=pl(),i=new Date(Date.now()+gl*6e4).toISOString(),s=await fetch(`${Gt}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(Do),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!s.ok)throw new Error(`MS Graph subscribe failed (${s.status}): ${await s.text()}`);let a=await s.json();return a.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:a.id},webhookSecret:o}):null}function pa(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function yl(e,n){let t=pa(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function ml(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function ga(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function fa(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function Wn(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function hl(e){return Wn(e.body)}function ya(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return zt(Array.isArray(r)?r:[r])}function ma(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let l=zt(Array.isArray(c)?c:[c]);if(l)return decodeURIComponent(l)}let r=ya({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let l=n[c],u=Array.isArray(l)?l[0]:l;if(!(!u||typeof u!="string"))try{let p=(u.startsWith("http")?new URL(u):new URL(`https://example.invalid${u.startsWith("/")?u:`/${u}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,s=Wn(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return zt([s?.validationToken])??null}function bl(e){if(ma(e))return!0;let n=Wn(e.body??e.payload);return ga(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function zt(e){for(let n of e){let t=fa(n);if(t)return t}}function kl(e){let t=Wn(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var $n=Symbol.for("corsair:internal");function ka(e){let n=e.database?Bo(e.database):void 0,t=e.kek,r=n&&t?Ms(e.plugins,n,t):Lt(!!n,!!t),o=Hs(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?Yn(e.hub):void 0},s=Di(n),a=Vs(i);if(e.multiTenancy){let u=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=To(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[$n]:i})},keys:r,permissions:s,manage:a},{[$n]:i});return ha(u,i.hub),ba(u,i.hub),u}let c=To(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},c,{keys:r,permissions:s,manage:a,[$n]:i});return ha(l,i.hub),ba(l,i.hub),l}function ha(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-W4VG4EZ2.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function wl(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var Jt=globalThis.__corsairTunnels??=new Set;function ba(e,n){if(!wl(n))return;let t=n.projectApiKey;if(Jt.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}Jt.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Qt;import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:()=>Jt.delete(t)})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Xt}`)}).catch(s=>{Jt.delete(t),console.warn(`[corsair] tunnel failed to start: ${s instanceof Error?s.message:String(s)}. Run \`corsair setup\` to enable your dev tunnel.`)})}var Cl={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Oo=Cl;async function at(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},s=n?.caller??"script",a=Uo(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=Ol(e,a.plugins,n),l={...a,database:a.database},u=l.database.db;await Bl(u,i);let d=await Fl(u,l,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Ll(e,c,n.credentials,l,o,i);let p=await Wl(d,c,o,s);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=ka({plugins:a.plugins,database:u,kek:a.kek,multiTenancy:!0}).withTenant(c.tenantId);await jl(g,a.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
 `)}function Mo(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...$[n][t],...r])}function Dl(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(a=>a.id===t);if(!o)continue;let i=I(o);if(!i)continue;let s=Mo(o,i,"account");for(let a of Object.keys(r))if(s.has(a))return!0}return!1}function Ol(e,n,t){let r=No(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Dl(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function Ca(e,n){return Te(e)?n===0?!0:Object.values(e).every(t=>Ca(t,n-1)):!1}function Ml(e){return Ca(e,4)}var Hl=$o;function Vt(e){if(e instanceof xl){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof El?Vt(r):"unknown";return n}return e instanceof Al?`${Vt(e.unwrap())} | null`:e instanceof Il?`${Vt(e.unwrap())} | undefined`:e instanceof Pl?e.options.join(" | "):e instanceof _l?"string":e instanceof Rl?"number":e instanceof vl?"boolean":e instanceof Tl?"date":e instanceof Sl?"jsonb":"unknown"}async function Bl(e,n){let t=await e.introspection.getTables(),r=new Set(t.map(o=>o.name));for(let[o,i]of Object.entries(Hl))r.has(o)||n(`[corsair:setup] Table "${o}" does not exist. Run your database migrations before calling setupCorsair.
 Schema: ${JSON.stringify(Vt(i),null,2)}`)}async function Fl(e,n,t,r,o){let i=new Date,s=new Map;for(let a of n.plugins){let c=a.id,l=I(a),u=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!u){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),u=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=l?a.authConfig?.[l]?.integration??[]:[],p=l?a.authConfig?.[l]?.account??[]:[],g=l&&u?U({authType:l,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(u&&!u.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!u||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",u.id).executeTakeFirst();if(!h){let k=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:k,tenant_id:t,integration_id:u.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",k).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&B({authType:l,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}s.set(c,{pluginId:c,authType:l,integration:g,account:f,integrationFields:[...$[l].integration,...d],accountFields:r?[...$[l].account,...p]:[]})}return s}function Ul(e){if(!Te(e))return;let n=e.keys;return Te(n)?n:void 0}function Nl(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Ll(e,n,t,r,o,i){let s=Ul(e),a=n.provisionAccounts?Nl(e,n.tenantId):void 0;for(let[c,l]of Object.entries(t)){let u=r.plugins.find(b=>b.id===c);if(!u){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=I(u);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=Mo(u,d,"integration"),g=Mo(u,d,"account"),f=s?.[c],h=a?.[c],k=Te(h)?h.keys:void 0;for(let[b,C]of Object.entries(l))if(C){if(p.has(b)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${b}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let P=z(f,`set_${b}`);if(!P){i(`[corsair:setup] Cannot set integration field '${b}' for '${c}'.`);continue}await P(C),o(`[corsair:setup] Set ${c} integration.${b}`);continue}if(g.has(b)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${b}' on a multi-tenant instance`);let P=z(k,`set_${b}`);if(!P){i(`[corsair:setup] Cannot set account field '${b}' for '${c}'.`);continue}await P(C),o(`[corsair:setup] Set ${c} account.${b} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${b}' for plugin '${c}'.`)}}}var wa=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function $l(e,n,t,r,o,i,s,a,c){let l=[],u=[];for(let p of o){if(wa.has(p))continue;let g=z(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(wa.has(p))continue;let g=z(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}let d=l.length===0&&u.length===0;if(d)a(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")a(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...u];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");a(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
   corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of u){let h=s.provisionAccounts?s.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(s.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}a(g.join(`

package/dist/{connect-PRWU3TDO.js → connect-2YTVRI7C.js}

@@ -1 +1 @@
-import{ga as a,ha as b,ia as c}from"./chunk-ELMZWIHW.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};
+import{ga as a,ha as b,ia as c}from"./chunk-HDOJLIMA.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/core.d.ts

@@ -1,8 +1,8 @@
-export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair, s as shouldStartTunnel } from './index-TtbjXHM8.js';
+export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair, s as shouldStartTunnel } from './index-CM92kJI-.js';
 import { CorsairDatabase } from './db.js';
-import { A as AuthTypes, f as AccountKeyManagerFor, I as IntegrationKeyManagerFor, H as HubConfig, g as CorsairPluginSubscribeResult } from './index-C1-IIbw8.js';
-export { h as AccountFieldNames, n as AgentMessageRole, o as AgentReply, v as AllProviders, l as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, i as BaseKeyManager, w as BaseProviders, a2 as BeforeHookResult, D as BindEndpoints, ap as BindWebhooks, an as Bivariant, E as BoundEndpointFn, F as BoundEndpointTree, aq as BoundWebhook, ar as BoundWebhookTree, p as ChatHandle, q as ChatMessage, r as ChatSummary, s as CorsairChatsNamespace, u as CorsairClient, G as CorsairContext, J as CorsairEndpoint, M as CorsairErrorHandler, c as CorsairIntegration, a3 as CorsairKeyBuilder, a4 as CorsairKeyBuilderBase, as as CorsairOAuthWebhookTenantLinkResolver, X as CorsairPermissionsNamespace, C as CorsairPlugin, a5 as CorsairPluginContext, a6 as CorsairPluginSubscribe, aj as CorsairRunsNamespace, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, at as CorsairWebhook, au as CorsairWebhookHandler, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, aC as CorsairWorkflowsNamespace, t as CreateChatResult, a7 as EndpointHooks, a8 as EndpointMetaEntry, K as EndpointPathsOf, a9 as EndpointRiskLevel, L as EndpointTree, Y as EnforcePermissionOptions, Z as EnforcePermissionResult, N as ErrorContext, Q as ErrorHandler, R as ErrorHandlerAndMatchFunction, S as ErrorMatcher, j as IntegrationFieldNames, aa as KeyBuilderContext, k as OAuth2IntegrationCredentials, O as OAuthConfig, ab as PermissionMode, ac as PermissionPolicy, x as PickAuth, P as PluginAuthConfig, ad as PluginEndpointMeta, ae as PluginPermissionsConfig, z as ProviderDisplayNames, ax as RawWebhookRequest, a0 as ReadonlyForbiddenError, af as RequiredPluginEndpointMeta, ag as RequiredPluginEndpointSchemas, ah as RequiredPluginWebhookSchemas, U as RetryStrategies, V as RetryStrategy, T as TokenResponse, aD as TriggerRunResult, ao as UnionToIntersection, ai as WebhookHooks, ay as WebhookPathsOf, az as WebhookRequest, aA as WebhookResponse, W as WebhookTenantMatch, aB as WebhookTree, ak as WorkflowRun, al as WorkflowRunStatus, am as WorkflowRunStep, aE as WorkflowStatus, aF as WorkflowSummary, _ as assertReadonlyAllowed, m as exchangeCodeForTokens, y as formatProviderDisplayName, $ as isReadonlyScopeActive, a1 as runReadonly } from './index-C1-IIbw8.js';
-export { A as AuthMissingError, C as CorsairKekMissingError, D as DocSchemaFieldRow, b as DocSchemaShape, c as DocsApiEndpoint, d as DocsDbEntity, e as DocsDbFilterField, f as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, h as PermissionRequiredError, P as PluginDocsIntrospection, l as PluginWebhookMatchers, R as ReconnectRequiredError, a as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, n as asRecord, j as collectPluginWebhookMatchers, o as decodePubSubData, p as extractMicrosoftGraphValidationToken, q as firstString, g as formatDocSchemaShape, s as getHeader, i as introspectPluginForDocs, t as isMicrosoftGraphValidationHandshake, m as matchWebhookPlugin, k as matchWebhookPluginAndTenant, u as readBodyRecord, v as readQueryParam, r as resolveConnectLink, w as toExternalId } from './tenant-match-utils-CqyYIo4q.js';
+import { A as AuthTypes, f as AccountKeyManagerFor, I as IntegrationKeyManagerFor, H as HubConfig, g as CorsairPluginSubscribeResult } from './index-BzjK9SZA.js';
+export { h as AccountFieldNames, n as AgentMessageRole, o as AgentReply, v as AllProviders, l as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, i as BaseKeyManager, w as BaseProviders, a2 as BeforeHookResult, D as BindEndpoints, ap as BindWebhooks, an as Bivariant, E as BoundEndpointFn, F as BoundEndpointTree, aq as BoundWebhook, ar as BoundWebhookTree, p as ChatHandle, q as ChatMessage, r as ChatSummary, s as CorsairChatsNamespace, u as CorsairClient, G as CorsairContext, J as CorsairEndpoint, M as CorsairErrorHandler, c as CorsairIntegration, a3 as CorsairKeyBuilder, a4 as CorsairKeyBuilderBase, as as CorsairOAuthWebhookTenantLinkResolver, X as CorsairPermissionsNamespace, C as CorsairPlugin, a5 as CorsairPluginContext, a6 as CorsairPluginSubscribe, aj as CorsairRunsNamespace, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, at as CorsairWebhook, au as CorsairWebhookHandler, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, aC as CorsairWorkflowsNamespace, t as CreateChatResult, a7 as EndpointHooks, a8 as EndpointMetaEntry, K as EndpointPathsOf, a9 as EndpointRiskLevel, L as EndpointTree, Y as EnforcePermissionOptions, Z as EnforcePermissionResult, N as ErrorContext, Q as ErrorHandler, R as ErrorHandlerAndMatchFunction, S as ErrorMatcher, j as IntegrationFieldNames, aa as KeyBuilderContext, k as OAuth2IntegrationCredentials, O as OAuthConfig, ab as PermissionMode, ac as PermissionPolicy, x as PickAuth, P as PluginAuthConfig, ad as PluginEndpointMeta, ae as PluginPermissionsConfig, z as ProviderDisplayNames, ax as RawWebhookRequest, a0 as ReadonlyForbiddenError, af as RequiredPluginEndpointMeta, ag as RequiredPluginEndpointSchemas, ah as RequiredPluginWebhookSchemas, U as RetryStrategies, V as RetryStrategy, T as TokenResponse, aD as TriggerRunResult, ao as UnionToIntersection, ai as WebhookHooks, ay as WebhookPathsOf, az as WebhookRequest, aA as WebhookResponse, W as WebhookTenantMatch, aB as WebhookTree, ak as WorkflowRun, al as WorkflowRunStatus, am as WorkflowRunStep, aE as WorkflowStatus, aF as WorkflowSummary, _ as assertReadonlyAllowed, m as exchangeCodeForTokens, y as formatProviderDisplayName, $ as isReadonlyScopeActive, a1 as runReadonly } from './index-BzjK9SZA.js';
+export { A as AuthMissingError, C as CorsairKekMissingError, D as DocSchemaFieldRow, b as DocSchemaShape, c as DocsApiEndpoint, d as DocsDbEntity, e as DocsDbFilterField, f as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, h as PermissionRequiredError, P as PluginDocsIntrospection, l as PluginWebhookMatchers, R as ReconnectRequiredError, a as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, n as asRecord, j as collectPluginWebhookMatchers, o as decodePubSubData, p as extractMicrosoftGraphValidationToken, q as firstString, g as formatDocSchemaShape, s as getHeader, i as introspectPluginForDocs, t as isMicrosoftGraphValidationHandshake, m as matchWebhookPlugin, k as matchWebhookPluginAndTenant, u as readBodyRecord, v as readQueryParam, r as resolveConnectLink, w as toExternalId } from './tenant-match-utils-CQ0UAjUs.js';
 import 'kysely';
 import 'zod';
 import 'pg';

package/dist/core.js

@@ -1 +1 @@
-import{$b as L,D as e,E as f,F as g,G as h,H as i,I as j,J as k,K as l,L as m,Lb as y,M as n,Mb as z,N as o,Nb as A,O as p,Ob as B,Sb as C,Tb as D,Ub as E,Vb as F,Wb as G,Xb as H,Yb as I,Zb as J,_b as K,a,ac as M,b,bc as N,c,cc as O,dc as P,eb as w,ec as Q,fc as R,gc as S,hc as T,ic as U,ja as q,jc as V,ma as r,na as s,oa as t,pa as u,qa as v,xb as x}from"./chunk-ELMZWIHW.js";import"./chunk-4OLKWKJG.js";import{h as d}from"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{w as AuthMissingError,d as BASE_AUTH_FIELDS,T as CORSAIR_INTERNAL,x as CorsairKekMissingError,F as MS_GRAPH_API_BASE,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,M as asRecord,v as assertReadonlyAllowed,J as collectPluginWebhookMatchers,n as createAccountKeyManager,U as createCorsair,m as createIntegrationKeyManager,S as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,A as exchangeCodeForTokens,P as extractMicrosoftGraphValidationToken,R as firstString,C as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,K as getHeader,B as getOAuthAccessToken,E as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,D as introspectPluginForDocs,Q as isMicrosoftGraphValidationHandshake,u as isReadonlyScopeActive,y as logEvent,z as logEventFromContext,H as matchWebhookPlugin,I as matchWebhookPluginAndTenant,G as msGraphSubscribe,l as reEncryptConfig,N as readBodyRecord,O as readQueryParam,q as resolveConnectLink,t as runReadonly,V as shouldStartTunnel,L as toExternalId};
+import{$b as L,D as e,E as f,F as g,G as h,H as i,I as j,J as k,K as l,L as m,Lb as y,M as n,Mb as z,N as o,Nb as A,O as p,Ob as B,Sb as C,Tb as D,Ub as E,Vb as F,Wb as G,Xb as H,Yb as I,Zb as J,_b as K,a,ac as M,b,bc as N,c,cc as O,dc as P,eb as w,ec as Q,fc as R,gc as S,hc as T,ic as U,ja as q,jc as V,ma as r,na as s,oa as t,pa as u,qa as v,xb as x}from"./chunk-HDOJLIMA.js";import"./chunk-4OLKWKJG.js";import{h as d}from"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{w as AuthMissingError,d as BASE_AUTH_FIELDS,T as CORSAIR_INTERNAL,x as CorsairKekMissingError,F as MS_GRAPH_API_BASE,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,M as asRecord,v as assertReadonlyAllowed,J as collectPluginWebhookMatchers,n as createAccountKeyManager,U as createCorsair,m as createIntegrationKeyManager,S as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,A as exchangeCodeForTokens,P as extractMicrosoftGraphValidationToken,R as firstString,C as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,K as getHeader,B as getOAuthAccessToken,E as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,D as introspectPluginForDocs,Q as isMicrosoftGraphValidationHandshake,u as isReadonlyScopeActive,y as logEvent,z as logEventFromContext,H as matchWebhookPlugin,I as matchWebhookPluginAndTenant,G as msGraphSubscribe,l as reEncryptConfig,N as readBodyRecord,O as readQueryParam,q as resolveConnectLink,t as runReadonly,V as shouldStartTunnel,L as toExternalId};

package/dist/hub.d.ts

@@ -1,8 +1,8 @@
-import { aV as HubOAuthMode, A as AuthTypes, aW as HubConnectSessionResult, aX as HubPermissionSessionResult, H as HubConfig, aY as HubConfigInput, aZ as HubConnectSessionInput, a_ as HubListProjectConnectionsInput, f as AccountKeyManagerFor, a$ as HubPermissionSessionInput } from './index-C1-IIbw8.js';
-export { b0 as DEFAULT_HUB_API_URL, b1 as HubEnvironmentSlug, y as formatProviderDisplayName } from './index-C1-IIbw8.js';
-import { k as TunnelType, R as RunResultPayload, P as ProbeResultPayload, g as ProcessCorsairRequest, m as WebhookTenantLink } from './index-D917Yq9E.js';
-export { n as BROWSER_DELIVERY_TTL_MS, o as BrowserDeliveryMode, B as BrowserDeliveryPayload, S as SIGNED_TUNNEL_REPLAY_WINDOW_MS, j as TunnelEnvelope } from './index-D917Yq9E.js';
-export { b as buildBrowserDeliveryRedirectUrl, s as signBrowserDeliveryToken, v as verifyBrowserDeliveryToken } from './browser-delivery-D8zDl4ZV.js';
+import { aV as HubOAuthMode, A as AuthTypes, aW as HubConnectSessionResult, aX as HubPermissionSessionResult, H as HubConfig, aY as HubConfigInput, aZ as HubConnectSessionInput, a_ as HubListProjectConnectionsInput, f as AccountKeyManagerFor, a$ as HubPermissionSessionInput } from './index-BzjK9SZA.js';
+export { b0 as DEFAULT_HUB_API_URL, b1 as HubEnvironmentSlug, y as formatProviderDisplayName } from './index-BzjK9SZA.js';
+import { k as TunnelType, R as RunResultPayload, P as ProbeResultPayload, g as ProcessCorsairRequest, m as WebhookTenantLink } from './index-4oKvjBws.js';
+export { n as BROWSER_DELIVERY_TTL_MS, o as BrowserDeliveryMode, B as BrowserDeliveryPayload, S as SIGNED_TUNNEL_REPLAY_WINDOW_MS, j as TunnelEnvelope } from './index-4oKvjBws.js';
+export { b as buildBrowserDeliveryRedirectUrl, s as signBrowserDeliveryToken, v as verifyBrowserDeliveryToken } from './browser-delivery-BIweOz_D.js';
 import 'zod';
 import './db.js';
 import 'kysely';

package/dist/hub.js

@@ -1 +1 @@
-import{$a as _,A as z,Aa as P,B as A,Ba as Q,C as B,Ca as R,Da as S,Ea as T,Fa as U,Ga as V,Ha as W,T as C,Ua as X,Va as Y,_a as Z,ab as $,b as a,bb as aa,cb as ba,d as b,db as ca,e as c,f as d,fb as da,g as e,gb as ea,h as f,hb as fa,i as g,ia as D,ib as ga,j as i,jb as ha,k as j,ka as E,kb as ia,l as k,la as F,lb as ja,m as l,mb as ka,n as m,nb as la,o as n,ob as ma,p as o,pb as na,q as p,qb as oa,r as q,ra as G,rb as pa,s as r,sa as H,sb as qa,t as s,ta as I,tb as ra,u as t,ua as J,ub as sa,v as u,va as K,vb as ta,w as v,wa as L,wb as ua,x as w,xa as M,y as x,ya as N,z as y,za as O}from"./chunk-ELMZWIHW.js";import{a as h,b as va,c as wa,d as xa,e as ya,f as za}from"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{m as BROWSER_DELIVERY_TTL_MS,wa as CORSAIR_TUNNEL_PATH,va as CORSAIR_TUNNEL_ZONE,u as DEFAULT_HUB_API_URL,xa as FRPC_VERSION,w as HubCredentialsMissingError,v as HubNotConfiguredError,V as ManagedOAuthDeliveryError,n as SIGNED_TUNNEL_REPLAY_WINDOW_MS,ea as attachManagedRefreshAuth,p as buildBrowserDeliveryRedirectUrl,s as buildClientBridgeBrowserDeliveryUrl,ga as createConnectSessionJti,la as createConnectTokenJti,D as createHubConnectSession,E as createHubPermissionSession,fa as createHubRouteHandlers,ra as createPermissionSessionJti,o as createSignedTokenJti,ka as decodeConnectSessionTokenFromPath,qa as decodeConnectTokenFromPath,ua as decodePermissionTokenFromPath,Q as deliverConnectCreateLink,U as deliverSignedEnvelope,S as describeDeliveryNetworkError,pa as encodeConnectTokenForPath,O as extractConnectLinkFromDeliveryAck,H as extractProbeFromDeliveryAck,G as extractRunFromDeliveryAck,N as extractSyncFromDeliveryAck,F as formatHubApprovalMessage,a as formatProviderDisplayName,T as formatServerDeliveryError,ya as frpcPlatformKey,ha as getConnectSessionExpiryMs,X as getConnectStatusForTenant,ma as getConnectTokenExpiryMs,z as getHubConfig,da as getManagedAccessToken,Z as handleHubDeliveryGet,_ as handleHubDeliveryPost,aa as handleHubDeliveryRequest,$ as hubDeliveryToResponse,B as inferHubEnvironmentSlug,i as isLoopbackUrl,M as isServerDeliveryAckSuccessful,Y as listHubProjectConnections,x as normalizeHubConfig,P as parseConnectLinkFromDeliveryBody,b as parseConnectSessionResponse,f as parseConnectStatusResponse,g as parseHubApiErrorBody,e as parseOAuthRefreshResponse,d as parsePermissionSessionResponse,c as parseProjectConnectionsResponse,L as parseServerDeliveryAckBody,R as parseSyncFromDeliveryBody,t as prepareClientBridgeDeliveryTransport,W as processManagedOAuthDelivery,C as registerHubWebhookTenantLink,j as resolveDeliveryTransport,za as resolveFrpcBinary,y as resolveHubConfigInput,h as resolveHubDeliveryUrl,A as resolveHubOAuthCallbackUrl,ba as respondToHubDelivery,ca as respondToHubDeliveryFromRequest,q as signBrowserDeliveryToken,ia as signConnectSessionToken,na as signConnectToken,I as signDeliveryEnvelope,sa as signPermissionToken,k as usesBrowserDelivery,l as validateProductionDeliveryUrl,r as verifyBrowserDeliveryToken,ja as verifyConnectSessionToken,oa as verifyConnectToken,J as verifyDeliveryEnvelope,ta as verifyPermissionToken,K as verifySignedTunnelDelivery};
+import{$a as _,A as z,Aa as P,B as A,Ba as Q,C as B,Ca as R,Da as S,Ea as T,Fa as U,Ga as V,Ha as W,T as C,Ua as X,Va as Y,_a as Z,ab as $,b as a,bb as aa,cb as ba,d as b,db as ca,e as c,f as d,fb as da,g as e,gb as ea,h as f,hb as fa,i as g,ia as D,ib as ga,j as i,jb as ha,k as j,ka as E,kb as ia,l as k,la as F,lb as ja,m as l,mb as ka,n as m,nb as la,o as n,ob as ma,p as o,pb as na,q as p,qb as oa,r as q,ra as G,rb as pa,s as r,sa as H,sb as qa,t as s,ta as I,tb as ra,u as t,ua as J,ub as sa,v as u,va as K,vb as ta,w as v,wa as L,wb as ua,x as w,xa as M,y as x,ya as N,z as y,za as O}from"./chunk-HDOJLIMA.js";import{a as h,b as va,c as wa,d as xa,e as ya,f as za}from"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{m as BROWSER_DELIVERY_TTL_MS,wa as CORSAIR_TUNNEL_PATH,va as CORSAIR_TUNNEL_ZONE,u as DEFAULT_HUB_API_URL,xa as FRPC_VERSION,w as HubCredentialsMissingError,v as HubNotConfiguredError,V as ManagedOAuthDeliveryError,n as SIGNED_TUNNEL_REPLAY_WINDOW_MS,ea as attachManagedRefreshAuth,p as buildBrowserDeliveryRedirectUrl,s as buildClientBridgeBrowserDeliveryUrl,ga as createConnectSessionJti,la as createConnectTokenJti,D as createHubConnectSession,E as createHubPermissionSession,fa as createHubRouteHandlers,ra as createPermissionSessionJti,o as createSignedTokenJti,ka as decodeConnectSessionTokenFromPath,qa as decodeConnectTokenFromPath,ua as decodePermissionTokenFromPath,Q as deliverConnectCreateLink,U as deliverSignedEnvelope,S as describeDeliveryNetworkError,pa as encodeConnectTokenForPath,O as extractConnectLinkFromDeliveryAck,H as extractProbeFromDeliveryAck,G as extractRunFromDeliveryAck,N as extractSyncFromDeliveryAck,F as formatHubApprovalMessage,a as formatProviderDisplayName,T as formatServerDeliveryError,ya as frpcPlatformKey,ha as getConnectSessionExpiryMs,X as getConnectStatusForTenant,ma as getConnectTokenExpiryMs,z as getHubConfig,da as getManagedAccessToken,Z as handleHubDeliveryGet,_ as handleHubDeliveryPost,aa as handleHubDeliveryRequest,$ as hubDeliveryToResponse,B as inferHubEnvironmentSlug,i as isLoopbackUrl,M as isServerDeliveryAckSuccessful,Y as listHubProjectConnections,x as normalizeHubConfig,P as parseConnectLinkFromDeliveryBody,b as parseConnectSessionResponse,f as parseConnectStatusResponse,g as parseHubApiErrorBody,e as parseOAuthRefreshResponse,d as parsePermissionSessionResponse,c as parseProjectConnectionsResponse,L as parseServerDeliveryAckBody,R as parseSyncFromDeliveryBody,t as prepareClientBridgeDeliveryTransport,W as processManagedOAuthDelivery,C as registerHubWebhookTenantLink,j as resolveDeliveryTransport,za as resolveFrpcBinary,y as resolveHubConfigInput,h as resolveHubDeliveryUrl,A as resolveHubOAuthCallbackUrl,ba as respondToHubDelivery,ca as respondToHubDeliveryFromRequest,q as signBrowserDeliveryToken,ia as signConnectSessionToken,na as signConnectToken,I as signDeliveryEnvelope,sa as signPermissionToken,k as usesBrowserDelivery,l as validateProductionDeliveryUrl,r as verifyBrowserDeliveryToken,ja as verifyConnectSessionToken,oa as verifyConnectToken,J as verifyDeliveryEnvelope,ta as verifyPermissionToken,K as verifySignedTunnelDelivery};

package/dist/{index-D917Yq9E.d.ts → index-4oKvjBws.d.ts}

@@ -1,4 +1,4 @@
-import { W as WebhookTenantMatch, A as AuthTypes } from './index-C1-IIbw8.js';
+import { W as WebhookTenantMatch, A as AuthTypes } from './index-BzjK9SZA.js';
 import { CorsairDatabase, CorsairAccount } from './db.js';
 
 /**

package/dist/{index-C1-IIbw8.d.ts → index-BzjK9SZA.d.ts}

@@ -3,7 +3,7 @@ import { CorsairDatabase, CorsairPermission, CorsairDatabaseInput } from './db.j
 import { CorsairPluginSchema, PluginEntityClients } from './orm.js';
 
 type AllErrors = 'RATE_LIMIT_ERROR' | 'AUTH_ERROR' | 'PERMISSION_ERROR' | 'NETWORK_ERROR' | 'TIMEOUT_ERROR' | 'SERVER_ERROR' | 'VALIDATION_ERROR' | 'NOT_FOUND_ERROR' | 'BAD_REQUEST_ERROR' | 'PARSING_ERROR' | 'DEFAULT' | (string & {});
-declare const BaseProviders: readonly ["ably", "abstract", "abuseipdb", "abyssale", "accrediblecertificates", "activecampaign", "activetrail", "addresszen", "aeroleads", "affinda", "agencyzoom", "agentmail", "agentql", "agenty", "agiled", "agilitycms", "ahrefs", "aimlapi", "airtable", "aivoov", "alchemy", "algolia", "allimagesai", "alphavantage", "altoviz", "alttextai", "amara", "ambee", "ambientweather", "amcards", "amplitude", "anchorbrowser", "anonyflow", "anthropicadministrator", "apaleo", "api2pdf", "apibible", "apify", "apilabz", "apininjas", "apipie", "apisports", "appointo", "asana", "ascora", "ashby", "asindataapi", "asticaai", "asyncinterview", "attio", "autom", "ayrshare", "backendless", "bannerbear", "bart", "basecamp", "baselinker", "basin", "beaconstac", "beeminder", "bestbuy", "bettercontact", "betterproposals", "betterstack", "bigdatacloud", "bigmailer", "bigml", "bitbucket", "bitwarden", "blazemeter", "blocknative", "bluesky", "boloforms", "boltiot", "bonsai", "bookingmood", "botbaba", "botpress", "botsonic", "bouncer", "box", "boxhero", "brandfetch", "breathehr", "brevo", "brex", "brightdata", "browseai", "browserless", "browsertool", "bubble", "bugsnag", "buildkite", "cal", "calendly", "campayn", "canva", "canvas", "capsulecrm", "castingwords", "cdrplatform", "certifier", "chatbotkit", "chatfai", "chmeetings", "circleci", "clickhouse", "clientary", "clockify", "cloudflare", "cloudinary", "collegefootballdata", "confluence", "connecteam", "contentfulgraphql", "contextsevenmcp", "countdownapi", "crowterminal", "cursor", "customgpt", "dadataru", "databricks", "datadog", "datarobot", "deepseek", "devinmcp", "diffbot", "digitalocean", "discord", "dockerhub", "dodopayments", "doppler", "dreamstudio", "dripcel", "dropbox", "dropboxsign", "dynapictures", "epicgames", "exa", "facebook", "faraday", "figma", "filloutforms", "firecrawl", "fireflies", "flexisign", "formbricks", "gemini", "github", "gitlab", "gmail", "googleaddressvalidation", "googleanalytics", "googlebigquery", "googlecalendar", "googlecloudvision", "googledocs", "googledrive", "googlemaps", "googlemeet", "googlesheets", "grafana", "groqcloud", "habitica", "hackernews", "harvest", "hashnode", "here", "heygen", "htmltoimage", "hubspot", "huggingface", "imgbb", "insightoai", "instagram", "intercom", "jigsawstack", "jira", "kaggle", "linear", "linkedin", "loyverse", "mailboxlayer", "mailchimp", "mailtrap", "marketstack", "merriamwebsterdict", "monday", "neon", "nextdns", "notion", "ocrspace", "ocrwebservice", "ollama", "onedrive", "onepassword", "openai", "openrouter", "openweathermap", "oura", "outlook", "pagerduty", "parseur", "pdfmonkey", "perplexityai", "pinecone", "posthog", "razorpay", "reddit", "removebg", "resend", "retailed", "runpod", "salesforce", "sapsuccessfactors", "scaleai", "scrapegraphai", "securitytrails", "sendgrid", "sentry", "serpapi", "sharepoint", "slack", "sourcegraph", "spotify", "strava", "streamtime", "stripe", "studiobyai21labs", "supabase", "synthflowai", "tally", "tavily", "tavilymcp", "teams", "telegram", "textrazor", "ticktick", "timecamp", "timelink", "tinyurl", "tisane", "todoist", "toggl", "trello", "twentyonerisk", "twilio", "twitter", "twitterapiio", "twochat", "typeform", "unione", "uniswapapi", "uploadcare", "vapi", "vercel", "vestaboard", "wakatime", "webflow", "webvizio", "whatsapp", "witai", "wiza", "workday", "workiom", "worldnewsapi", "xquik", "youcom", "youtube", "zendesk", "zohoinventory", "zohomail", "zoom", "zoominfo"];
+declare const BaseProviders: readonly ["ably", "abstract", "abuseipdb", "abyssale", "accrediblecertificates", "activecampaign", "activetrail", "addresszen", "aeroleads", "affinda", "agencyzoom", "agentmail", "agentql", "agenty", "agiled", "agilitycms", "ahrefs", "aimlapi", "airtable", "aivoov", "alchemy", "algolia", "allimagesai", "alphavantage", "altoviz", "alttextai", "amara", "ambee", "ambientweather", "amcards", "amplitude", "anchorbrowser", "anonyflow", "anthropicadministrator", "apaleo", "api2pdf", "apibible", "apify", "apilabz", "apininjas", "apipie", "apisports", "appointo", "asana", "ascora", "ashby", "asindataapi", "asticaai", "asyncinterview", "attio", "autom", "ayrshare", "backendless", "bannerbear", "bart", "basecamp", "baselinker", "basin", "beaconstac", "beeminder", "benchmarkemail", "bestbuy", "bettercontact", "betterproposals", "betterstack", "bigdatacloud", "bigmailer", "bigml", "bitbucket", "bitwarden", "blazemeter", "blocknative", "bluesky", "boldsign", "boloforms", "boltiot", "bonsai", "bookingmood", "borneo", "botbaba", "botpress", "botsonic", "bouncer", "box", "boxhero", "brandfetch", "breathehr", "brevo", "brex", "brightdata", "browseai", "browserless", "browsertool", "bubble", "bugsnag", "buildkite", "bunnycdn", "cal", "calendly", "campayn", "canva", "canvas", "capsulecrm", "castingwords", "cdrplatform", "certifier", "chatbotkit", "chatfai", "chmeetings", "circleci", "clickhouse", "clientary", "clockify", "cloudflare", "cloudinary", "collegefootballdata", "confluence", "connecteam", "contentfulgraphql", "contextsevenmcp", "convoloai", "countdownapi", "crowterminal", "cursor", "customgpt", "dadataru", "databricks", "datadog", "datarobot", "deepseek", "devinmcp", "diffbot", "digitalocean", "discord", "dockerhub", "dodopayments", "doppler", "dreamstudio", "dripcel", "dropbox", "dropboxsign", "dynapictures", "epicgames", "exa", "exist", "facebook", "faraday", "figma", "filloutforms", "firecrawl", "fireflies", "flexisign", "formbricks", "gemini", "github", "gitlab", "gladia", "gmail", "googleaddressvalidation", "googleanalytics", "googlebigquery", "googlecalendar", "googlecloudvision", "googledocs", "googledrive", "googlemaps", "googlemeet", "googlesheets", "grafana", "griptape", "groqcloud", "habitica", "hackernews", "harvest", "hashnode", "here", "heygen", "htmltoimage", "hubspot", "huggingface", "imgbb", "insightoai", "instagram", "intercom", "jigsawstack", "jira", "kaggle", "linear", "linkedin", "loyverse", "mailboxlayer", "mailchimp", "mailtrap", "marketstack", "merriamwebsterdict", "monday", "neon", "nextdns", "notion", "ocrspace", "ocrwebservice", "ollama", "onedrive", "onepassword", "openai", "openrouter", "openweathermap", "oura", "outlook", "pagerduty", "parseur", "pdfmonkey", "perplexityai", "pinecone", "posthog", "razorpay", "reddit", "removebg", "resend", "retailed", "runpod", "salesforce", "sapsuccessfactors", "scaleai", "scrapegraphai", "securitytrails", "sendgrid", "sentry", "serpapi", "sharepoint", "slack", "sourcegraph", "spotify", "strava", "streamtime", "stripe", "studiobyai21labs", "supabase", "synthflowai", "tally", "tavily", "tavilymcp", "teams", "telegram", "textrazor", "ticktick", "timecamp", "timelink", "tinyurl", "tisane", "todoist", "toggl", "trello", "twentyonerisk", "twilio", "twitter", "twitterapiio", "twochat", "typeform", "unione", "uniswapapi", "uploadcare", "vapi", "vercel", "vestaboard", "wakatime", "webflow", "webvizio", "whatsapp", "witai", "wix", "wiza", "workday", "workiom", "worldnewsapi", "xquik", "youcom", "youtube", "zendesk", "zohoinventory", "zohomail", "zoom", "zoominfo"];
 declare const ProviderDisplayNames: {
     readonly ably: "Ably";
     readonly abstract: "Abstract";
@@ -65,6 +65,7 @@ declare const ProviderDisplayNames: {
     readonly basin: "Basin";
     readonly beaconstac: "Beaconstac";
     readonly beeminder: "Beeminder";
+    readonly benchmarkemail: "BenchmarkEmail";
     readonly bestbuy: "Best Buy";
     readonly bettercontact: "BetterContact";
     readonly betterproposals: "Better Proposals";
@@ -77,10 +78,12 @@ declare const ProviderDisplayNames: {
     readonly blazemeter: "BlazeMeter";
     readonly blocknative: "Blocknative";
     readonly bluesky: "Bluesky";
+    readonly boldsign: "Boldsign";
     readonly boloforms: "Boloforms";
     readonly boltiot: "Bolt IoT";
     readonly bonsai: "Bonsai";
     readonly bookingmood: "Bookingmood";
+    readonly borneo: "Borneo";
     readonly botbaba: "Botbaba";
     readonly botpress: "Botpress";
     readonly botsonic: "Botsonic";
@@ -98,6 +101,7 @@ declare const ProviderDisplayNames: {
     readonly bubble: "Bubble";
     readonly bugsnag: "BugSnag";
     readonly buildkite: "Buildkite";
+    readonly bunnycdn: "Bunnycdn";
     readonly cal: "Cal";
     readonly calendly: "Calendly";
     readonly campayn: "Campayn";
@@ -121,6 +125,7 @@ declare const ProviderDisplayNames: {
     readonly connecteam: "Connecteam";
     readonly contentfulgraphql: "Contentful GraphQL";
     readonly contextsevenmcp: "Context7";
+    readonly convoloai: "ConvoloAi";
     readonly countdownapi: "Countdown API";
     readonly crowterminal: "CrowTerminal";
     readonly cursor: "Cursor";
@@ -144,6 +149,7 @@ declare const ProviderDisplayNames: {
     readonly dynapictures: "Dynapictures";
     readonly epicgames: "Epic Games";
     readonly exa: "Exa";
+    readonly exist: "Exist";
     readonly facebook: "Facebook";
     readonly faraday: "Faraday";
     readonly figma: "Figma";
@@ -155,6 +161,7 @@ declare const ProviderDisplayNames: {
     readonly gemini: "Gemini";
     readonly github: "GitHub";
     readonly gitlab: "GitLab";
+    readonly gladia: "Gladia";
     readonly gmail: "Gmail";
     readonly googleaddressvalidation: "Google Address Validation";
     readonly googleanalytics: "Google Analytics";
@@ -167,6 +174,7 @@ declare const ProviderDisplayNames: {
     readonly googlemeet: "Google Meet";
     readonly googlesheets: "Google Sheets";
     readonly grafana: "Grafana";
+    readonly griptape: "Griptape";
     readonly groqcloud: "GroqCloud";
     readonly habitica: "Habitica";
     readonly hackernews: "Hacker News";
@@ -267,6 +275,7 @@ declare const ProviderDisplayNames: {
     readonly webvizio: "Webvizio";
     readonly whatsapp: "WhatsApp";
     readonly witai: "WitAi";
+    readonly wix: "Wix";
     readonly wiza: "Wiza";
     readonly workday: "Workday";
     readonly workiom: "Workiom";
@@ -281,7 +290,7 @@ declare const ProviderDisplayNames: {
     readonly zoominfo: "ZoomInfo";
 };
 declare function formatProviderDisplayName(plugin: string): string;
-type AllProviders = 'ably' | 'abstract' | 'abuseipdb' | 'abyssale' | 'accrediblecertificates' | 'activecampaign' | 'activetrail' | 'addresszen' | 'aeroleads' | 'affinda' | 'agencyzoom' | 'agentmail' | 'agentql' | 'agenty' | 'agiled' | 'agilitycms' | 'ahrefs' | 'aimlapi' | 'airtable' | 'aivoov' | 'alchemy' | 'algolia' | 'allimagesai' | 'alphavantage' | 'altoviz' | 'alttextai' | 'amara' | 'ambee' | 'ambientweather' | 'amcards' | 'amplitude' | 'anchorbrowser' | 'anonyflow' | 'anthropicadministrator' | 'apaleo' | 'api2pdf' | 'apibible' | 'apify' | 'apilabz' | 'apininjas' | 'apipie' | 'apisports' | 'appointo' | 'asana' | 'ascora' | 'ashby' | 'asindataapi' | 'asticaai' | 'asyncinterview' | 'attio' | 'autom' | 'ayrshare' | 'backendless' | 'bannerbear' | 'bart' | 'basecamp' | 'baselinker' | 'basin' | 'beaconstac' | 'beeminder' | 'bestbuy' | 'bettercontact' | 'betterproposals' | 'betterstack' | 'bigdatacloud' | 'bigmailer' | 'bigml' | 'bitbucket' | 'bitwarden' | 'blazemeter' | 'blocknative' | 'bluesky' | 'boloforms' | 'boltiot' | 'bonsai' | 'bookingmood' | 'botbaba' | 'botpress' | 'botsonic' | 'bouncer' | 'box' | 'boxhero' | 'brandfetch' | 'breathehr' | 'brevo' | 'brex' | 'brightdata' | 'browseai' | 'browserless' | 'browsertool' | 'bubble' | 'bugsnag' | 'buildkite' | 'cal' | 'calendly' | 'campayn' | 'canva' | 'canvas' | 'capsulecrm' | 'castingwords' | 'cdrplatform' | 'certifier' | 'chatbotkit' | 'chatfai' | 'chmeetings' | 'circleci' | 'clickhouse' | 'clientary' | 'clockify' | 'cloudflare' | 'cloudinary' | 'collegefootballdata' | 'confluence' | 'connecteam' | 'contentfulgraphql' | 'contextsevenmcp' | 'countdownapi' | 'crowterminal' | 'cursor' | 'customgpt' | 'dadataru' | 'databricks' | 'datadog' | 'datarobot' | 'deepseek' | 'devinmcp' | 'diffbot' | 'digitalocean' | 'discord' | 'dockerhub' | 'dodopayments' | 'doppler' | 'dreamstudio' | 'dripcel' | 'dropbox' | 'dropboxsign' | 'dynapictures' | 'epicgames' | 'exa' | 'facebook' | 'faraday' | 'figma' | 'filloutforms' | 'firecrawl' | 'fireflies' | 'flexisign' | 'formbricks' | 'gemini' | 'github' | 'gitlab' | 'gmail' | 'googleaddressvalidation' | 'googleanalytics' | 'googlebigquery' | 'googlecalendar' | 'googlecloudvision' | 'googledocs' | 'googledrive' | 'googlemaps' | 'googlemeet' | 'googlesheets' | 'grafana' | 'groqcloud' | 'habitica' | 'hackernews' | 'harvest' | 'hashnode' | 'here' | 'heygen' | 'htmltoimage' | 'hubspot' | 'huggingface' | 'imgbb' | 'insightoai' | 'instagram' | 'intercom' | 'jigsawstack' | 'jira' | 'kaggle' | 'linear' | 'linkedin' | 'loyverse' | 'mailboxlayer' | 'mailchimp' | 'mailtrap' | 'marketstack' | 'merriamwebsterdict' | 'monday' | 'neon' | 'nextdns' | 'notion' | 'ocrspace' | 'ocrwebservice' | 'ollama' | 'onedrive' | 'onepassword' | 'openai' | 'openrouter' | 'openweathermap' | 'oura' | 'outlook' | 'pagerduty' | 'parseur' | 'pdfmonkey' | 'perplexityai' | 'pinecone' | 'posthog' | 'razorpay' | 'reddit' | 'removebg' | 'resend' | 'retailed' | 'runpod' | 'salesforce' | 'sapsuccessfactors' | 'scaleai' | 'scrapegraphai' | 'securitytrails' | 'sendgrid' | 'sentry' | 'serpapi' | 'sharepoint' | 'slack' | 'sourcegraph' | 'spotify' | 'strava' | 'streamtime' | 'stripe' | 'studiobyai21labs' | 'supabase' | 'synthflowai' | 'tally' | 'tavily' | 'tavilymcp' | 'teams' | 'telegram' | 'textrazor' | 'ticktick' | 'timecamp' | 'timelink' | 'tinyurl' | 'tisane' | 'todoist' | 'toggl' | 'trello' | 'twentyonerisk' | 'twilio' | 'twitter' | 'twitterapiio' | 'twochat' | 'typeform' | 'unione' | 'uniswapapi' | 'uploadcare' | 'vapi' | 'vercel' | 'vestaboard' | 'wakatime' | 'webflow' | 'webvizio' | 'whatsapp' | 'witai' | 'wiza' | 'workday' | 'workiom' | 'worldnewsapi' | 'xquik' | 'youcom' | 'youtube' | 'zendesk' | 'zohoinventory' | 'zohomail' | 'zoom' | 'zoominfo' | (string & {});
+type AllProviders = 'ably' | 'abstract' | 'abuseipdb' | 'abyssale' | 'accrediblecertificates' | 'activecampaign' | 'activetrail' | 'addresszen' | 'aeroleads' | 'affinda' | 'agencyzoom' | 'agentmail' | 'agentql' | 'agenty' | 'agiled' | 'agilitycms' | 'ahrefs' | 'aimlapi' | 'airtable' | 'aivoov' | 'alchemy' | 'algolia' | 'allimagesai' | 'alphavantage' | 'altoviz' | 'alttextai' | 'amara' | 'ambee' | 'ambientweather' | 'amcards' | 'amplitude' | 'anchorbrowser' | 'anonyflow' | 'anthropicadministrator' | 'apaleo' | 'api2pdf' | 'apibible' | 'apify' | 'apilabz' | 'apininjas' | 'apipie' | 'apisports' | 'appointo' | 'asana' | 'ascora' | 'ashby' | 'asindataapi' | 'asticaai' | 'asyncinterview' | 'attio' | 'autom' | 'ayrshare' | 'backendless' | 'bannerbear' | 'bart' | 'basecamp' | 'baselinker' | 'basin' | 'beaconstac' | 'beeminder' | 'benchmarkemail' | 'bestbuy' | 'bettercontact' | 'betterproposals' | 'betterstack' | 'bigdatacloud' | 'bigmailer' | 'bigml' | 'bitbucket' | 'bitwarden' | 'blazemeter' | 'blocknative' | 'bluesky' | 'boldsign' | 'boloforms' | 'boltiot' | 'bonsai' | 'bookingmood' | 'borneo' | 'botbaba' | 'botpress' | 'botsonic' | 'bouncer' | 'box' | 'boxhero' | 'brandfetch' | 'breathehr' | 'brevo' | 'brex' | 'brightdata' | 'browseai' | 'browserless' | 'browsertool' | 'bubble' | 'bugsnag' | 'buildkite' | 'bunnycdn' | 'cal' | 'calendly' | 'campayn' | 'canva' | 'canvas' | 'capsulecrm' | 'castingwords' | 'cdrplatform' | 'certifier' | 'chatbotkit' | 'chatfai' | 'chmeetings' | 'circleci' | 'clickhouse' | 'clientary' | 'clockify' | 'cloudflare' | 'cloudinary' | 'collegefootballdata' | 'confluence' | 'connecteam' | 'contentfulgraphql' | 'contextsevenmcp' | 'convoloai' | 'countdownapi' | 'crowterminal' | 'cursor' | 'customgpt' | 'dadataru' | 'databricks' | 'datadog' | 'datarobot' | 'deepseek' | 'devinmcp' | 'diffbot' | 'digitalocean' | 'discord' | 'dockerhub' | 'dodopayments' | 'doppler' | 'dreamstudio' | 'dripcel' | 'dropbox' | 'dropboxsign' | 'dynapictures' | 'epicgames' | 'exa' | 'exist' | 'facebook' | 'faraday' | 'figma' | 'filloutforms' | 'firecrawl' | 'fireflies' | 'flexisign' | 'formbricks' | 'gemini' | 'github' | 'gitlab' | 'gladia' | 'gmail' | 'googleaddressvalidation' | 'googleanalytics' | 'googlebigquery' | 'googlecalendar' | 'googlecloudvision' | 'googledocs' | 'googledrive' | 'googlemaps' | 'googlemeet' | 'googlesheets' | 'grafana' | 'griptape' | 'groqcloud' | 'habitica' | 'hackernews' | 'harvest' | 'hashnode' | 'here' | 'heygen' | 'htmltoimage' | 'hubspot' | 'huggingface' | 'imgbb' | 'insightoai' | 'instagram' | 'intercom' | 'jigsawstack' | 'jira' | 'kaggle' | 'linear' | 'linkedin' | 'loyverse' | 'mailboxlayer' | 'mailchimp' | 'mailtrap' | 'marketstack' | 'merriamwebsterdict' | 'monday' | 'neon' | 'nextdns' | 'notion' | 'ocrspace' | 'ocrwebservice' | 'ollama' | 'onedrive' | 'onepassword' | 'openai' | 'openrouter' | 'openweathermap' | 'oura' | 'outlook' | 'pagerduty' | 'parseur' | 'pdfmonkey' | 'perplexityai' | 'pinecone' | 'posthog' | 'razorpay' | 'reddit' | 'removebg' | 'resend' | 'retailed' | 'runpod' | 'salesforce' | 'sapsuccessfactors' | 'scaleai' | 'scrapegraphai' | 'securitytrails' | 'sendgrid' | 'sentry' | 'serpapi' | 'sharepoint' | 'slack' | 'sourcegraph' | 'spotify' | 'strava' | 'streamtime' | 'stripe' | 'studiobyai21labs' | 'supabase' | 'synthflowai' | 'tally' | 'tavily' | 'tavilymcp' | 'teams' | 'telegram' | 'textrazor' | 'ticktick' | 'timecamp' | 'timelink' | 'tinyurl' | 'tisane' | 'todoist' | 'toggl' | 'trello' | 'twentyonerisk' | 'twilio' | 'twitter' | 'twitterapiio' | 'twochat' | 'typeform' | 'unione' | 'uniswapapi' | 'uploadcare' | 'vapi' | 'vercel' | 'vestaboard' | 'wakatime' | 'webflow' | 'webvizio' | 'whatsapp' | 'witai' | 'wix' | 'wiza' | 'workday' | 'workiom' | 'worldnewsapi' | 'xquik' | 'youcom' | 'youtube' | 'zendesk' | 'zohoinventory' | 'zohomail' | 'zoom' | 'zoominfo' | (string & {});
 type AuthTypes = 'oauth_2' | 'api_key' | 'bot_token' | 'managed';
 type PickAuth<T extends AuthTypes> = T;
 

package/dist/{index-TtbjXHM8.d.ts → index-CM92kJI-.d.ts}

@@ -1,5 +1,5 @@
 import { CorsairDatabase } from './db.js';
-import { C as CorsairPlugin, a as CorsairPermissionsOptions, b as CorsairManualConfig, H as HubConfig, c as CorsairIntegration, d as CorsairTenantWrapper, e as CorsairSingleTenantClient } from './index-C1-IIbw8.js';
+import { C as CorsairPlugin, a as CorsairPermissionsOptions, b as CorsairManualConfig, H as HubConfig, c as CorsairIntegration, d as CorsairTenantWrapper, e as CorsairSingleTenantClient } from './index-BzjK9SZA.js';
 
 declare const CORSAIR_INTERNAL: unique symbol;
 type CorsairInternalConfig = {

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { aG as ManagementOk, aH as Tenant, aI as CreateTenantInput, aJ as PluginInfo, aK as ConnectionStatus, aL as PermissionLookupInput, aM as PermissionRecord, aN as CreateConnectLinkInput, aO as ConnectLink, aP as ResolvedConnectLink, aQ as OAuthCallbackInput, aR as OAuthCallbackResult, aS as ConnectRequest, e as CorsairSingleTenantClient, C as CorsairPlugin, d as CorsairTenantWrapper, u as CorsairClient, X as CorsairPermissionsNamespace, ar as BoundWebhookTree, ax as RawWebhookRequest, aw as CorsairWebhookTenantMatcher, w as BaseProviders, aA as WebhookResponse } from './index-C1-IIbw8.js';
-export { aT as CorsairManageNamespace, b as CorsairManualConfig, a as CorsairPermissionsOptions, aU as PluginConnectionState, a0 as ReadonlyForbiddenError, a1 as runReadonly } from './index-C1-IIbw8.js';
-export { c as createCorsair } from './index-TtbjXHM8.js';
-import { F as FormFieldSchema, L as ListOperationsOptions } from './tenant-match-utils-CqyYIo4q.js';
-export { A as AuthMissingError, C as CorsairKekMissingError, h as PermissionRequiredError, l as PluginWebhookMatchers, R as ReconnectRequiredError, a as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, n as asRecord, j as collectPluginWebhookMatchers, o as decodePubSubData, q as firstString, g as formatDocSchemaShape, s as getHeader, m as matchWebhookPlugin, k as matchWebhookPluginAndTenant, u as readBodyRecord, r as resolveConnectLink, w as toExternalId } from './tenant-match-utils-CqyYIo4q.js';
+import { ZodTypeAny, z } from 'zod';
+import { e as CorsairSingleTenantClient, d as CorsairTenantWrapper, C as CorsairPlugin, u as CorsairClient, aG as ManagementOk, aH as Tenant, aI as CreateTenantInput, aJ as PluginInfo, aK as ConnectionStatus, aL as PermissionLookupInput, aM as PermissionRecord, aN as CreateConnectLinkInput, aO as ConnectLink, aP as ResolvedConnectLink, aQ as OAuthCallbackInput, aR as OAuthCallbackResult, aS as ConnectRequest, X as CorsairPermissionsNamespace, ar as BoundWebhookTree, ax as RawWebhookRequest, aw as CorsairWebhookTenantMatcher, w as BaseProviders, aA as WebhookResponse } from './index-BzjK9SZA.js';
+export { aT as CorsairManageNamespace, b as CorsairManualConfig, a as CorsairPermissionsOptions, aU as PluginConnectionState, a0 as ReadonlyForbiddenError, a1 as runReadonly } from './index-BzjK9SZA.js';
+import { F as FormFieldSchema, L as ListOperationsOptions } from './tenant-match-utils-CQ0UAjUs.js';
+export { A as AuthMissingError, C as CorsairKekMissingError, h as PermissionRequiredError, l as PluginWebhookMatchers, R as ReconnectRequiredError, a as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, n as asRecord, j as collectPluginWebhookMatchers, o as decodePubSubData, q as firstString, g as formatDocSchemaShape, s as getHeader, m as matchWebhookPlugin, k as matchWebhookPluginAndTenant, u as readBodyRecord, r as resolveConnectLink, w as toExternalId } from './tenant-match-utils-CQ0UAjUs.js';
+export { c as createCorsair } from './index-CM92kJI-.js';
 export { SetupCorsairOptions, setupCorsair } from './setup.js';
-export { O as OAuthCallbackTunnelPayload, f as ProcessCorsairOptions, g as ProcessCorsairRequest, l as ResolveAccountFromWebhookLinkInput, T as TunnelAck, j as TunnelEnvelope, k as TunnelType, m as WebhookTenantLink, W as WebhookTunnelPayload, p as processCorsair, r as resolveAccountFromWebhookLink, h as resolveTenantFromWebhookLink, i as resolveTenantIdFromWebhookLink, s as setWebhookTenantLink } from './index-D917Yq9E.js';
-import 'zod';
+export { O as OAuthCallbackTunnelPayload, f as ProcessCorsairOptions, g as ProcessCorsairRequest, l as ResolveAccountFromWebhookLinkInput, T as TunnelAck, j as TunnelEnvelope, k as TunnelType, m as WebhookTenantLink, W as WebhookTunnelPayload, p as processCorsair, r as resolveAccountFromWebhookLink, h as resolveTenantFromWebhookLink, i as resolveTenantIdFromWebhookLink, s as setWebhookTenantLink } from './index-4oKvjBws.js';
 import './db.js';
 import 'kysely';
 import 'pg';
@@ -262,6 +262,116 @@ declare function resolveMaxBodyBytes(maxBodyBytes?: number): number;
  */
 declare function resolveBodyStallTimeoutMs(bodyStallTimeoutMs?: number): number;
 
+/**
+ * Any form of Corsair instance: single-tenant client (`createCorsair()`),
+ * multi-tenant wrapper (`createCorsair({ multiTenancy: true })`), or tenant-scoped
+ * client (`corsair.withTenant()`).
+ *
+ * Mixed type arguments are deliberate: the two clients are matched structurally
+ * (empty plugin set is their common supertype), while the wrapper is matched by
+ * its plugin tuple and so needs the open array — an empty tuple rejects a real one.
+ */
+type AnyCorsairInstance = CorsairSingleTenantClient<readonly []> | CorsairTenantWrapper<readonly CorsairPlugin[]> | CorsairClient<readonly []>;
+/**
+ * Lists available operations (API endpoints, webhooks, or database entities) for the configured plugins.
+ * Returns a newline-separated string with one operation path per line.
+ *
+ * Accepts single-tenant instances, multi-tenant wrappers, and tenant-scoped clients.
+ *
+ * @example
+ * listOperations(corsair)
+ * // "slack.api.channels.list\nslack.api.messages.post\n..."
+ *
+ * listOperations(corsair, { plugin: 'slack' })
+ * // "slack.api.channels.list\nslack.api.messages.post\n..."
+ *
+ * listOperations(corsair, { plugin: 'slack', type: 'webhooks' })
+ * // "slack.webhooks.messages.message\nslack.webhooks.channels.created\n..."
+ */
+declare function listOperations(corsair: AnyCorsairInstance, options?: ListOperationsOptions): string;
+/**
+ * Returns a plain-text TypeScript-style type declaration for a specific operation path.
+ *
+ * Accepts single-tenant instances, multi-tenant wrappers, and tenant-scoped clients.
+ * Casing is ignored — the path is lowercased before lookup.
+ * If the path is not found, returns a list of available paths for self-correction.
+ *
+ * @example
+ * getSchema(corsair, 'slack.api.messages.post')
+ * // "Post a message to a channel  [write]\n\ninput {\n  channel: string\n  text?: string\n  ..."
+ *
+ * getSchema(corsair, 'slack.api.invalid')
+ * // "Path not found. Available operations:\n  slack: slack.api.channels.list, ..."
+ */
+declare function getSchema(corsair: AnyCorsairInstance, path: string): string;
+/**
+ * Returns a machine-readable, JSON-serializable form schema for a given operation path.
+ * Unlike {@link getSchema} (which returns a TypeScript-style string), this returns
+ * structured field definitions suitable for driving dynamic form UIs.
+ *
+ * Returns `null` if the path does not resolve to a known endpoint.
+ */
+declare function getStructuredSchema(corsair: AnyCorsairInstance, path: string): {
+    input: FormFieldSchema | null;
+    output: FormFieldSchema | null;
+    description?: string;
+} | null;
+/**
+ * Returns the raw Zod input schema for an operation path, preserving its
+ * validation constraints (min/max, regex, refinements). `null` if the path is
+ * not a known endpoint.
+ */
+declare function getInputSchema(corsair: AnyCorsairInstance, path: string): ZodTypeAny | null;
+
+/**
+ * Converts a {@link getStructuredSchema} field into a Zod schema for a tool's
+ * input. LangChain and LlamaIndex both accept a Zod v4 schema directly, so no
+ * JSON Schema conversion is needed.
+ */
+declare function formFieldToZod(field: FormFieldSchema): z.ZodTypeAny;
+/** A Corsair operation as a framework-agnostic tool: a Zod input schema plus a bound `execute`. */
+interface CorsairOperationTool {
+    /**
+     * LLM-facing function name: the operation path with every character outside
+     * `[A-Za-z0-9_-]` replaced by `_`, so it satisfies the OpenAI function-calling
+     * name constraint (dotted paths are rejected there).
+     */
+    name: string;
+    /** The original dotted operation path, e.g. `slack.api.channels.list`. */
+    operation: string;
+    /** The operation's description, falling back to the operation path. */
+    description: string;
+    /** Zod schema for the operation input; an empty object when it takes none. */
+    schema: z.ZodTypeAny;
+    /**
+     * Runs the operation with the given (already parsed) args, returning its raw result.
+     * The result type is `unknown` because each Corsair plugin returns a distinct shape;
+     * adapters serialize it to string for model consumption.
+     */
+    execute: (args: Record<string, unknown>) => Promise<unknown>;
+}
+interface BuildCorsairToolsOptions {
+    /** Restrict discovery to one plugin (toolkit), e.g. `'slack'`. */
+    plugin?: string;
+    /**
+     * Build exactly these dotted operation paths instead of discovering them.
+     * Takes precedence over `plugin`.
+     */
+    operations?: string[];
+    /**
+     * Pin every operation to one Corsair tenant (for multi-tenant instances). The
+     * instance is scoped once via `withTenant`; single-tenant instances ignore it.
+     */
+    tenantId?: string;
+}
+/**
+ * Turns a Corsair instance's API operations into framework-agnostic
+ * {@link CorsairOperationTool}s. Discovery, schema conversion and invocation all
+ * run against the (optionally tenant-scoped) instance, so an adapter only has to
+ * map each result onto its framework's tool primitive.
+ */
+declare function buildCorsairTools(corsair: AnyCorsairInstance, options?: BuildCorsairToolsOptions): CorsairOperationTool[];
+
 type CorsairClientOptions = {
     /** Origin + base path of the mounted handler, e.g. 'https://api.example.com/api/corsair'. */
     baseURL: string;
@@ -315,61 +425,6 @@ declare class CorsairClientError extends Error {
 
 declare function createCorsairClient(opts: CorsairClientOptions): CorsairManagementClient;
 
-type InspectCorsairPlugin = {
-    id: CorsairPlugin['id'];
-};
-/**
- * Any form of Corsair instance:
- * - single-tenant client (`createCorsair({ ... })`)
- * - multi-tenant wrapper (`createCorsair({ multiTenancy: true, ... })`)
- * - tenant-scoped client (`corsair.withTenant("tenant-id")`)
- */
-type AnyCorsairInstance = CorsairSingleTenantClient<readonly InspectCorsairPlugin[]> | CorsairTenantWrapper<readonly InspectCorsairPlugin[]> | CorsairClient<readonly InspectCorsairPlugin[]>;
-/**
- * Lists available operations (API endpoints, webhooks, or database entities) for the configured plugins.
- * Returns a newline-separated string with one operation path per line.
- *
- * Accepts single-tenant instances, multi-tenant wrappers, and tenant-scoped clients.
- *
- * @example
- * listOperations(corsair)
- * // "slack.api.channels.list\nslack.api.messages.post\n..."
- *
- * listOperations(corsair, { plugin: 'slack' })
- * // "slack.api.channels.list\nslack.api.messages.post\n..."
- *
- * listOperations(corsair, { plugin: 'slack', type: 'webhooks' })
- * // "slack.webhooks.messages.message\nslack.webhooks.channels.created\n..."
- */
-declare function listOperations(corsair: AnyCorsairInstance, options?: ListOperationsOptions): string;
-/**
- * Returns a plain-text TypeScript-style type declaration for a specific operation path.
- *
- * Accepts single-tenant instances, multi-tenant wrappers, and tenant-scoped clients.
- * Casing is ignored — the path is lowercased before lookup.
- * If the path is not found, returns a list of available paths for self-correction.
- *
- * @example
- * getSchema(corsair, 'slack.api.messages.post')
- * // "Post a message to a channel  [write]\n\ninput {\n  channel: string\n  text?: string\n  ..."
- *
- * getSchema(corsair, 'slack.api.invalid')
- * // "Path not found. Available operations:\n  slack: slack.api.channels.list, ..."
- */
-declare function getSchema(corsair: AnyCorsairInstance, path: string): string;
-/**
- * Returns a machine-readable, JSON-serializable form schema for a given operation path.
- * Unlike {@link getSchema} (which returns a TypeScript-style string), this returns
- * structured field definitions suitable for driving dynamic form UIs.
- *
- * Returns `null` if the path does not resolve to a known endpoint.
- */
-declare function getStructuredSchema(corsair: AnyCorsairInstance, path: string): {
-    input: FormFieldSchema | null;
-    output: FormFieldSchema | null;
-    description?: string;
-} | null;
-
 /**
  * The corsair instance type for permission execution.
  * Must expose the `permissions` namespace and optionally a `withTenant` method.
@@ -488,4 +543,4 @@ declare function processWebhook(corsair: CorsairInstance, headers: WebhookHeader
     hubVerified?: boolean;
 }): Promise<WebhookFilterResult>;
 
-export { type AnyCorsairInstance, ConnectLink, ConnectionStatus, CorsairClientError, type CorsairClientOptions, type CorsairManagementClient, CreateConnectLinkInput, CreateTenantInput, DEFAULT_BODY_STALL_TIMEOUT_MS, DEFAULT_MAX_BODY_BYTES, type ExpressHandler, type FastifyHandler, FormFieldSchema, type HonoHandler, ListOperationsOptions, type ManagementHandlerOptions, ManagementOk, type NodeHandler, type NodeLikeRequest, type NodeLikeResponse, OAuthCallbackInput, OAuthCallbackResult, type PermissionExecuteResult, PermissionLookupInput, PermissionRecord, PluginInfo, ResolvedConnectLink, Tenant, createCorsairClient, executePermission, getSchema, getStructuredSchema, listOperations, managementHandler, processWebhook, registerCorsairRawBodyParser, resolveBodyStallTimeoutMs, resolveMaxBodyBytes, toAstroHandler, toExpressHandler, toFastifyHandler, toHonoHandler, toNextJsHandler, toNodeHandler, toNuxtHandler, toRemixHandler, toSvelteKitHandler, toTanStackHandler, toWebHandler };
+export { type AnyCorsairInstance, type BuildCorsairToolsOptions, ConnectLink, ConnectionStatus, CorsairClientError, type CorsairClientOptions, type CorsairManagementClient, type CorsairOperationTool, CreateConnectLinkInput, CreateTenantInput, DEFAULT_BODY_STALL_TIMEOUT_MS, DEFAULT_MAX_BODY_BYTES, type ExpressHandler, type FastifyHandler, FormFieldSchema, type HonoHandler, ListOperationsOptions, type ManagementHandlerOptions, ManagementOk, type NodeHandler, type NodeLikeRequest, type NodeLikeResponse, OAuthCallbackInput, OAuthCallbackResult, type PermissionExecuteResult, PermissionLookupInput, PermissionRecord, PluginInfo, ResolvedConnectLink, Tenant, buildCorsairTools, createCorsairClient, executePermission, formFieldToZod, getInputSchema, getSchema, getStructuredSchema, listOperations, managementHandler, processWebhook, registerCorsairRawBodyParser, resolveBodyStallTimeoutMs, resolveMaxBodyBytes, toAstroHandler, toExpressHandler, toFastifyHandler, toHonoHandler, toNextJsHandler, toNodeHandler, toNuxtHandler, toRemixHandler, toSvelteKitHandler, toTanStackHandler, toWebHandler };

package/dist/index.js

@@ -1,3 +1,4 @@
-import{$b as re,Ab as B,Bb as j,Cb as U,Db as J,Eb as Y,Fb as K,Gb as G,Hb as X,Ia as v,Ib as z,Jb as Q,Kb as V,P as I,Pb as C,Qa as M,Qb as f,Rb as k,Sb as y,U as b,V as S,W as T,Wa as _,X as w,Xa as $,Xb as Z,Ya as F,Yb as ee,Za as H,Zb as ne,_b as te,ac as oe,bc as ie,c as x,eb as W,fc as se,gc as ae,hc as h,ic as ue,ja as O,ma as L,na as A,oa as E,xb as q,yb as N,zb as D}from"./chunk-ELMZWIHW.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";var c=class extends Error{status;code;extra;constructor(r,o,e,a={}){super(e),this.name="CorsairClientError",this.status=r,this.code=o,this.extra=a}};function ce(t){return t.endsWith("/")?t.slice(0,-1):t}async function P(t){let r={};try{r=await t.json()}catch{}let o=typeof r.error=="string"?r.error:"request_failed",e=typeof r.message=="string"?r.message:`Request failed (${t.status})`,{error:a,message:p,...n}=r;return new c(t.status,o,e,n)}function pe(t){let r=ce(t.baseURL),o=t.fetch??((...n)=>globalThis.fetch(...n));async function e(n,i){let s=i&&Object.keys(i).length?`?${new URLSearchParams(i).toString()}`:"",u=await o(`${r}${n}${s}`,{method:"GET"});if(!u.ok)throw await P(u);return await u.json()}async function a(n,i){let s=await o(`${r}${n}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(i)});if(!s.ok)throw await P(s);return await s.json()}let p=encodeURIComponent;return{ok:()=>e("/ok"),tenants:{list:()=>e("/tenants"),create:n=>a("/tenants",n),get:n=>e(`/tenants/${p(n)}`)},plugins:{list:()=>e("/plugins"),get:n=>e(`/plugins/${p(n)}`)},connectionStatus:{get:n=>{let i={};return n?.tenantId&&(i.tenantId=n.tenantId),e("/connection-status",i)}},permissions:{get:n=>"id"in n?e(`/permissions/${p(n.id)}`):a("/permissions/lookup-by-token",{token:n.token})},connect:{createLink:n=>a("/connect/links",n),resolve:n=>e("/connect/resolve",{state:n}),oauthCallback:n=>a("/connect/oauth/callback",n)},connectRequest:{get:n=>{let i={};return n?.tenantId&&(i.tenantId=n.tenantId),e("/connect/request",i)},clear:n=>a("/connect/request/clear",n??{})}}}function m(t){let r=t[h];if(!r)throw new Error("listOperations / getSchema: invalid corsair instance. Pass the value returned by createCorsair() or corsair.withTenant().");return r.plugins}function le(t,r){let o=f(m(t),r);return typeof o=="string"?o:Array.isArray(o)?o.join(`
+import{$b as cn,Ab as J,Bb as Y,Cb as K,Db as G,Eb as X,Fb as Q,Gb as V,Hb as nn,Ia as H,Ib as en,Jb as tn,Kb as rn,P as O,Pb as P,Qa as W,Qb as w,Rb as x,Sb as R,U as A,V as L,W as E,Wa as q,X as v,Xa as N,Xb as on,Ya as j,Yb as sn,Za as B,Zb as an,_b as un,ac as pn,bc as ln,c as S,eb as D,fc as dn,gc as mn,hc as T,ic as gn,ja as F,ma as M,na as _,oa as $,xb as U,yb as Z,zb as z}from"./chunk-HDOJLIMA.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";import{z as p}from"zod";function f(e){let t=e[T];if(!t)throw new Error("listOperations / getSchema: invalid corsair instance. Pass the value returned by createCorsair() or corsair.withTenant().");return t.plugins}function y(e,t){let o=w(f(e),t);return typeof o=="string"?o:Array.isArray(o)?o.join(`
 `):Object.values(o).flat().join(`
-`)}function de(t,r){return k(m(t),r)}function me(t,r){return C(m(t),r)}var ge=Symbol.for("corsair:internal");function Ce(t,r){let o=t;for(let e of r){if(!o||typeof o!="object")return null;o=o[e]}return typeof o=="function"?o:null}function R(t){return t[ge]?.database}async function fe(t,r){let o=new Date().toISOString(),e=await t.permissions.find_by_token(r);if(!e)return console.error("executePermission: no permission found for token."),{error:"executePermission: no permission found for token."};if(e.status!=="approved")return console.error(`executePermission: permission '${e.id}' is '${e.status}', expected 'approved'.`),{endpoint:e.endpoint,plugin:e.plugin,result:null,error:`executePermission: permission '${e.id}' is '${e.status}', expected 'approved'.`};if(e.expires_at<o){let s=R(t);return s&&await s.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",e.id).execute(),console.error(`executePermission: permission '${e.id}' has expired.`),{error:`executePermission: permission '${e.id}' has expired.`,endpoint:e.endpoint,plugin:e.plugin,result:null}}let a=e.tenant_id??"default",n=(t.withTenant?t.withTenant(a):t)[e.plugin];if(!n?.api)return console.error(`executePermission: plugin '${e.plugin}' not found or has no API on this corsair instance.`),{error:`executePermission: plugin '${e.plugin}' not found or has no API on this corsair instance.`,plugin:e.plugin,endpoint:e.endpoint,result:null};let i=Ce(n.api,e.endpoint.split("."));if(!i)return console.error(`executePermission: endpoint '${e.endpoint}' not found in plugin '${e.plugin}'.`),{endpoint:e.endpoint,plugin:e.plugin,result:null,error:`executePermission: endpoint '${e.endpoint}' not found in plugin '${e.plugin}'.`};await t.permissions.set_executing(e.id);try{let s=typeof e.args=="string"?JSON.parse(e.args):e.args,u=await i(s);return await t.permissions.set_completed(e.id),{plugin:e.plugin,endpoint:e.endpoint,result:u}}catch(s){let u=s instanceof Error?s.message:String(s),g=R(t);return g&&await g.db.updateTable("corsair_permissions").set({status:"failed",error:u,updated_at:new Date}).where("id","=",e.id).execute(),{plugin:e.plugin,endpoint:e.endpoint,result:null,error:u}}}export{W as AuthMissingError,c as CorsairClientError,q as CorsairKekMissingError,$ as DEFAULT_BODY_STALL_TIMEOUT_MS,_ as DEFAULT_MAX_BODY_BYTES,L as PermissionRequiredError,A as ReadonlyForbiddenError,x as ReconnectRequiredError,oe as asRecord,ne as collectPluginWebhookMatchers,ue as createCorsair,pe as createCorsairClient,ae as decodePubSubData,fe as executePermission,se as firstString,y as formatDocSchemaShape,te as getHeader,de as getSchema,me as getStructuredSchema,le as listOperations,N as managementHandler,Z as matchWebhookPlugin,ee as matchWebhookPluginAndTenant,M as processCorsair,v as processWebhook,ie as readBodyRecord,B as registerCorsairRawBodyParser,S as resolveAccountFromWebhookLink,H as resolveBodyStallTimeoutMs,O as resolveConnectLink,F as resolveMaxBodyBytes,w as resolveTenantFromWebhookLink,T as resolveTenantIdFromWebhookLink,E as runReadonly,b as setWebhookTenantLink,I as setupCorsair,X as toAstroHandler,D as toExpressHandler,re as toExternalId,j as toFastifyHandler,U as toHonoHandler,J as toNextJsHandler,Y as toNodeHandler,Q as toNuxtHandler,G as toRemixHandler,K as toSvelteKitHandler,z as toTanStackHandler,V as toWebHandler};
+`)}function fn(e,t){return x(f(e),t)}function k(e,t){return P(f(e),t)}function h(e,t){let o=f(e),n=t.toLowerCase(),i=n.indexOf(".");if(i===-1)return null;let u=n.slice(0,i),r=n.slice(i+1),s=o.find(c=>c.id===u);if(!s?.endpointSchemas)return null;let a=r;a.startsWith("api.")&&(a=a.slice(4));for(let[c,g]of Object.entries(s.endpointSchemas))if(c.toLowerCase()===a)return g.input??null;return null}function C(e){let t=Cn(e);return e.description&&(t=t.describe(e.description)),e.optional&&(t=t.optional()),t}function Cn(e){switch(e.kind){case"string":return e.enum&&e.enum.length>0?p.enum(e.enum):p.string();case"number":return p.number();case"boolean":return p.boolean();case"literal":return p.literal(e.value);case"object":{let t={};for(let[o,n]of Object.entries(e.fields))t[o]=C(n);return p.object(t)}case"array":return p.array(C(e.items));case"unknown":return p.unknown()}}function yn(e,t){let o=t?.tenantId?Pn(e,t.tenantId):e;return(t?.operations??kn(y(o,{plugin:t?.plugin,type:"api"}))).map(i=>{let u=k(o,i),s=h(o,i)??(u?.input?C(u.input):p.object({}));return{name:hn(i),operation:i,description:u?.description??i,schema:s,execute:a=>wn(o,i,a??{})}})}function kn(e){return e.split(`
+`).map(t=>t.trim()).filter(Boolean)}function hn(e){return e.replace(/[^a-zA-Z0-9_-]/g,"_")}function Pn(e,t){let o=e.withTenant;return typeof o=="function"?o.call(e,t):e}async function wn(e,t,o){let n=t.split("."),i=n.pop();if(!i)throw new Error(`Invalid operation path: ${t}`);let u=e;for(let s of n)if(u=u?.[s],u==null)throw new Error(`Unknown operation path: ${t}`);let r=u[i];if(typeof r!="function")throw new Error(`Operation is not callable: ${t}`);return r.call(u,o)}var l=class extends Error{status;code;extra;constructor(t,o,n,i={}){super(n),this.name="CorsairClientError",this.status=t,this.code=o,this.extra=i}};function xn(e){return e.endsWith("/")?e.slice(0,-1):e}async function I(e){let t={};try{t=await e.json()}catch{}let o=typeof t.error=="string"?t.error:"request_failed",n=typeof t.message=="string"?t.message:`Request failed (${e.status})`,{error:i,message:u,...r}=t;return new l(e.status,o,n,r)}function Rn(e){let t=xn(e.baseURL),o=e.fetch??((...r)=>globalThis.fetch(...r));async function n(r,s){let a=s&&Object.keys(s).length?`?${new URLSearchParams(s).toString()}`:"",c=await o(`${t}${r}${a}`,{method:"GET"});if(!c.ok)throw await I(c);return await c.json()}async function i(r,s){let a=await o(`${t}${r}`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(s)});if(!a.ok)throw await I(a);return await a.json()}let u=encodeURIComponent;return{ok:()=>n("/ok"),tenants:{list:()=>n("/tenants"),create:r=>i("/tenants",r),get:r=>n(`/tenants/${u(r)}`)},plugins:{list:()=>n("/plugins"),get:r=>n(`/plugins/${u(r)}`)},connectionStatus:{get:r=>{let s={};return r?.tenantId&&(s.tenantId=r.tenantId),n("/connection-status",s)}},permissions:{get:r=>"id"in r?n(`/permissions/${u(r.id)}`):i("/permissions/lookup-by-token",{token:r.token})},connect:{createLink:r=>i("/connect/links",r),resolve:r=>n("/connect/resolve",{state:r}),oauthCallback:r=>i("/connect/oauth/callback",r)},connectRequest:{get:r=>{let s={};return r?.tenantId&&(s.tenantId=r.tenantId),n("/connect/request",s)},clear:r=>i("/connect/request/clear",r??{})}}}var Tn=Symbol.for("corsair:internal");function In(e,t){let o=e;for(let n of t){if(!o||typeof o!="object")return null;o=o[n]}return typeof o=="function"?o:null}function b(e){return e[Tn]?.database}async function bn(e,t){let o=new Date().toISOString(),n=await e.permissions.find_by_token(t);if(!n)return console.error("executePermission: no permission found for token."),{error:"executePermission: no permission found for token."};if(n.status!=="approved")return console.error(`executePermission: permission '${n.id}' is '${n.status}', expected 'approved'.`),{endpoint:n.endpoint,plugin:n.plugin,result:null,error:`executePermission: permission '${n.id}' is '${n.status}', expected 'approved'.`};if(n.expires_at<o){let a=b(e);return a&&await a.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",n.id).execute(),console.error(`executePermission: permission '${n.id}' has expired.`),{error:`executePermission: permission '${n.id}' has expired.`,endpoint:n.endpoint,plugin:n.plugin,result:null}}let i=n.tenant_id??"default",r=(e.withTenant?e.withTenant(i):e)[n.plugin];if(!r?.api)return console.error(`executePermission: plugin '${n.plugin}' not found or has no API on this corsair instance.`),{error:`executePermission: plugin '${n.plugin}' not found or has no API on this corsair instance.`,plugin:n.plugin,endpoint:n.endpoint,result:null};let s=In(r.api,n.endpoint.split("."));if(!s)return console.error(`executePermission: endpoint '${n.endpoint}' not found in plugin '${n.plugin}'.`),{endpoint:n.endpoint,plugin:n.plugin,result:null,error:`executePermission: endpoint '${n.endpoint}' not found in plugin '${n.plugin}'.`};await e.permissions.set_executing(n.id);try{let a=typeof n.args=="string"?JSON.parse(n.args):n.args,c=await s(a);return await e.permissions.set_completed(n.id),{plugin:n.plugin,endpoint:n.endpoint,result:c}}catch(a){let c=a instanceof Error?a.message:String(a),g=b(e);return g&&await g.db.updateTable("corsair_permissions").set({status:"failed",error:c,updated_at:new Date}).where("id","=",n.id).execute(),{plugin:n.plugin,endpoint:n.endpoint,result:null,error:c}}}export{D as AuthMissingError,l as CorsairClientError,U as CorsairKekMissingError,N as DEFAULT_BODY_STALL_TIMEOUT_MS,q as DEFAULT_MAX_BODY_BYTES,M as PermissionRequiredError,_ as ReadonlyForbiddenError,S as ReconnectRequiredError,pn as asRecord,yn as buildCorsairTools,an as collectPluginWebhookMatchers,gn as createCorsair,Rn as createCorsairClient,mn as decodePubSubData,bn as executePermission,dn as firstString,C as formFieldToZod,R as formatDocSchemaShape,un as getHeader,h as getInputSchema,fn as getSchema,k as getStructuredSchema,y as listOperations,Z as managementHandler,on as matchWebhookPlugin,sn as matchWebhookPluginAndTenant,W as processCorsair,H as processWebhook,ln as readBodyRecord,J as registerCorsairRawBodyParser,L as resolveAccountFromWebhookLink,B as resolveBodyStallTimeoutMs,F as resolveConnectLink,j as resolveMaxBodyBytes,v as resolveTenantFromWebhookLink,E as resolveTenantIdFromWebhookLink,$ as runReadonly,A as setWebhookTenantLink,O as setupCorsair,nn as toAstroHandler,z as toExpressHandler,cn as toExternalId,Y as toFastifyHandler,K as toHonoHandler,G as toNextJsHandler,X as toNodeHandler,tn as toNuxtHandler,V as toRemixHandler,Q as toSvelteKitHandler,en as toTanStackHandler,rn as toWebHandler};

package/dist/{loop-U76A2EHY.js → loop-W4VG4EZ2.js}

@@ -1 +1 @@
-import{Ra as a,Sa as b,Ta as c}from"./chunk-ELMZWIHW.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{a as deriveAck,b as pollOnce,c as startConnectLoop};
+import{Ra as a,Sa as b,Ta as c}from"./chunk-HDOJLIMA.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{a as deriveAck,b as pollOnce,c as startConnectLoop};

package/dist/oauth.d.ts

@@ -1,4 +1,4 @@
-import { O as OAuthConfig } from './index-C1-IIbw8.js';
+import { O as OAuthConfig } from './index-BzjK9SZA.js';
 import 'zod';
 import './db.js';
 import 'kysely';

package/dist/oauth.js

@@ -1 +1 @@
-import{$ as f,R as a,S as b,Y as c,Z as d,_ as e,aa as g,ba as h}from"./chunk-ELMZWIHW.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{d as OAuthCallbackError,c as buildOAuthAuthorizeUrl,b as decodeOAuthState,a as encodeOAuthState,e as generateOAuthUrl,f as processOAuthCallback,g as renewSubscriptions,h as startSubscriptionRenewal};
+import{$ as f,R as a,S as b,Y as c,Z as d,_ as e,aa as g,ba as h}from"./chunk-HDOJLIMA.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{d as OAuthCallbackError,c as buildOAuthAuthorizeUrl,b as decodeOAuthState,a as encodeOAuthState,e as generateOAuthUrl,f as processOAuthCallback,g as renewSubscriptions,h as startSubscriptionRenewal};

package/dist/{setup-7AOJIAWA.js → setup-UE6ZXEGK.js}

@@ -1 +1 @@
-import{P as a,Q as b}from"./chunk-ELMZWIHW.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};
+import{P as a,Q as b}from"./chunk-HDOJLIMA.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};

package/dist/{setup-introspect-SLWJPWLI.js → setup-introspect-QE6ZJWOF.js}

@@ -1 +1 @@
-import{ca as a,da as b,ea as c,fa as d}from"./chunk-ELMZWIHW.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as buildConnectPluginManifest,a as buildConnectPluginManifestFromContext,d as ensureConnectAccountRows,c as ensureConnectAccountRowsFromContext};
+import{ca as a,da as b,ea as c,fa as d}from"./chunk-HDOJLIMA.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as buildConnectPluginManifest,a as buildConnectPluginManifestFromContext,d as ensureConnectAccountRows,c as ensureConnectAccountRowsFromContext};

package/dist/setup.d.ts

@@ -1,5 +1,5 @@
-import { a as CorsairInternalConfig } from './index-TtbjXHM8.js';
-import { C as CorsairPlugin, e as CorsairSingleTenantClient, d as CorsairTenantWrapper } from './index-C1-IIbw8.js';
+import { a as CorsairInternalConfig } from './index-CM92kJI-.js';
+import { C as CorsairPlugin, e as CorsairSingleTenantClient, d as CorsairTenantWrapper } from './index-BzjK9SZA.js';
 import { CorsairDatabase } from './db.js';
 import 'zod';
 import './orm.js';

package/dist/setup.js

@@ -1 +1 @@
-import{P as a,Q as b}from"./chunk-ELMZWIHW.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};
+import{P as a,Q as b}from"./chunk-HDOJLIMA.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{b as applySetupCredentials,a as setupCorsair};

package/dist/{tenant-match-utils-CqyYIo4q.d.ts → tenant-match-utils-CQ0UAjUs.d.ts}

@@ -1,4 +1,4 @@
-import { a9 as EndpointRiskLevel, C as CorsairPlugin, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, ax as RawWebhookRequest, v as AllProviders, W as WebhookTenantMatch } from './index-C1-IIbw8.js';
+import { a9 as EndpointRiskLevel, C as CorsairPlugin, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, ax as RawWebhookRequest, v as AllProviders, W as WebhookTenantMatch } from './index-BzjK9SZA.js';
 
 /**
  * Error thrown when an endpoint call is blocked pending user approval or by

package/dist/tunnel.d.ts

@@ -1,7 +1,7 @@
-import { B as BrowserDeliveryPayload, R as RunResultPayload, P as ProbeResultPayload } from './index-D917Yq9E.js';
-export { O as OAuthCallbackTunnelPayload, e as OAuthTokensTunnelPayload, f as ProcessCorsairOptions, g as ProcessCorsairRequest, a as RunStepResult, b as RunTriggerType, c as RunTunnelPayload, T as TunnelAck, j as TunnelEnvelope, k as TunnelType, W as WebhookTunnelPayload, d as applyPermissionDecision, p as processCorsair, r as resolveAccountFromWebhookLink, h as resolveTenantFromWebhookLink, i as resolveTenantIdFromWebhookLink, s as setWebhookTenantLink } from './index-D917Yq9E.js';
-export { v as verifyBrowserDeliveryToken } from './browser-delivery-D8zDl4ZV.js';
-import './index-C1-IIbw8.js';
+import { B as BrowserDeliveryPayload, R as RunResultPayload, P as ProbeResultPayload } from './index-4oKvjBws.js';
+export { O as OAuthCallbackTunnelPayload, e as OAuthTokensTunnelPayload, f as ProcessCorsairOptions, g as ProcessCorsairRequest, a as RunStepResult, b as RunTriggerType, c as RunTunnelPayload, T as TunnelAck, j as TunnelEnvelope, k as TunnelType, W as WebhookTunnelPayload, d as applyPermissionDecision, p as processCorsair, r as resolveAccountFromWebhookLink, h as resolveTenantFromWebhookLink, i as resolveTenantIdFromWebhookLink, s as setWebhookTenantLink } from './index-4oKvjBws.js';
+export { v as verifyBrowserDeliveryToken } from './browser-delivery-BIweOz_D.js';
+import './index-BzjK9SZA.js';
 import 'zod';
 import './db.js';
 import 'kysely';

package/dist/tunnel.js

@@ -1 +1 @@
-import{Ja as f,Ka as g,La as h,Ma as i,Na as j,Oa as k,Pa as l,Qa as m,U as b,V as c,W as d,X as e,s as a}from"./chunk-ELMZWIHW.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{l as applyPermissionDecision,f as executeWorkflowRun,h as isAuthCredentialsBrowserDelivery,k as isByoOAuthBrowserDelivery,j as isManagedBrowserDelivery,i as isPermissionBrowserDelivery,m as processCorsair,c as resolveAccountFromWebhookLink,e as resolveTenantFromWebhookLink,d as resolveTenantIdFromWebhookLink,g as runReadonlyProbe,b as setWebhookTenantLink,a as verifyBrowserDeliveryToken};
+import{Ja as f,Ka as g,La as h,Ma as i,Na as j,Oa as k,Pa as l,Qa as m,U as b,V as c,W as d,X as e,s as a}from"./chunk-HDOJLIMA.js";import"./chunk-4OLKWKJG.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{l as applyPermissionDecision,f as executeWorkflowRun,h as isAuthCredentialsBrowserDelivery,k as isByoOAuthBrowserDelivery,j as isManagedBrowserDelivery,i as isPermissionBrowserDelivery,m as processCorsair,c as resolveAccountFromWebhookLink,e as resolveTenantFromWebhookLink,d as resolveTenantIdFromWebhookLink,g as runReadonlyProbe,b as setWebhookTenantLink,a as verifyBrowserDeliveryToken};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "corsair",
-  "version": "0.1.128",
+  "version": "0.1.129",
   "description": "Open-source integration layer for AI agents and apps. Managed OAuth, webhooks, and one API for 200+ integrations, with credentials that stay in your own database.",
   "type": "module",
   "main": "./dist/index.js",
@@ -84,10 +84,10 @@
   },
   "optionalDependencies": {
     "@corsair-dev/frpc-darwin-x64": "0.1.117",
-    "@corsair-dev/frpc-linux-arm64": "0.1.117",
     "@corsair-dev/frpc-darwin-arm64": "0.1.117",
-    "@corsair-dev/frpc-win32-arm64": "0.1.117",
+    "@corsair-dev/frpc-linux-arm64": "0.1.117",
     "@corsair-dev/frpc-linux-x64": "0.1.117",
+    "@corsair-dev/frpc-win32-arm64": "0.1.117",
     "@corsair-dev/frpc-win32-x64": "0.1.117"
   },
   "devDependencies": {