corsair 0.1.134 → 0.1.136

package/dist/{browser-delivery-lY7x4meY.d.ts → browser-delivery-5Lt0P6ay.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-DUHdJscv.js';
+import { B as BrowserDeliveryPayload } from './index-CkaSwl1Q.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/chunk-IKQU6YIZ.js

@@ -0,0 +1,66 @@
+import{a as Ae,b as nr,c as tr}from"./chunk-6IURNA4L.js";import{a as jo,b as xe,c as qo,d as T,e as K,f as Ko,g as Q,h as j,i as S,j as Gn,k as Zo,l as Xe,m as er,n as Go}from"./chunk-7AYINDN2.js";import{a as Wo}from"./chunk-N66TLOH2.js";import{ZodBoolean as fd,ZodDate as yd,ZodEnum as md,ZodNullable as hd,ZodNumber as bd,ZodObject as kd,ZodOptional as wd,ZodRecord as Cd,ZodString as vd,ZodType as Td}from"zod";var zn=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","alchemy","algolia","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","appointo","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beeminder","benchmarkemail","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bitbucket","bitwarden","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","browserless","browsertool","bubble","bugsnag","buildkite","bunnycdn","cal","calendly","campayn","canva","canvas","capsulecrm","castingwords","cdrplatform","certifier","chatbotkit","chatfai","chmeetings","circleci","clickhouse","clientary","clockify","cloudflare","cloudinary","collegefootballdata","confluence","connecteam","contentfulgraphql","contextsevenmcp","convoloai","countdownapi","crowterminal","cursor","customgpt","dadataru","databricks","datadog","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","dodopayments","doppler","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","emelia","epicgames","exa","exist","facebook","faraday","figma","filloutforms","firecrawl","fireflies","flexisign","formbricks","gemini","github","gitlab","gladia","gmail","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","htmltoimage","hubspot","huggingface","imgbb","insightoai","instagram","intercom","jigsawstack","jira","kaggle","kibana","linear","linkedin","loyverse","mailboxlayer","mailchimp","mailtrap","marketstack","merriamwebsterdict","monday","neon","nextdns","notion","ocrspace","ocrwebservice","ollama","onedrive","onepassword","openai","openrouter","openweathermap","oura","outlook","pagerduty","parseur","pdfmonkey","perplexityai","pinecone","posthog","razorpay","reddit","removebg","resend","retailed","runpod","salesforce","sapsuccessfactors","scaleai","scrapegraphai","securitytrails","sendgrid","sentry","serpapi","sharepoint","slack","sourcegraph","spotify","strava","streamtime","stripe","studiobyai21labs","supabase","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","timecamp","timelink","tinyurl","tisane","todoist","toggl","trello","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","unione","uniswapapi","uploadcare","vapi","vercel","veriphone","vestaboard","wakatime","webflow","webvizio","whatsapp","witai","wix","wiza","workday","workiom","worldnewsapi","xquik","youcom","youtube","zendesk","zohoinventory","zohomail","zoom","zoominfo"],zo={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",alchemy:"Alchemy",algolia:"Algolia",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",appointo:"Appointo",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",bunnycdn:"Bunnycdn",cal:"Cal",calendly:"Calendly",campayn:"Campayn",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",castingwords:"CastingWords",cdrplatform:"CDR Platform",certifier:"Certifier",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chmeetings:"ChMeetings",circleci:"CircleCI",clickhouse:"Clickhouse",clientary:"Clientary",clockify:"Clockify",cloudflare:"Cloudflare",cloudinary:"Cloudinary",collegefootballdata:"College Football Data",confluence:"Confluence",connecteam:"Connecteam",contentfulgraphql:"Contentful GraphQL",contextsevenmcp:"Context7",convoloai:"ConvoloAi",countdownapi:"Countdown API",crowterminal:"CrowTerminal",cursor:"Cursor",customgpt:"CustomGPT",dadataru:"Dadataru",databricks:"Databricks",datadog:"Datadog",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",dodopayments:"Dodo Payments",doppler:"Doppler",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",emelia:"Emelia",epicgames:"Epic Games",exa:"Exa",exist:"Exist",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",flexisign:"Flexisign",formbricks:"Formbricks",gemini:"Gemini",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",kibana:"Kibana",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailboxlayer:"MailboxLayer",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",monday:"Monday",neon:"Neon",nextdns:"NextDNS",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfmonkey:"PDFMonkey",perplexityai:"Perplexity AI",pinecone:"Pinecone",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",removebg:"remove.bg",resend:"Resend",retailed:"Retailed",runpod:"RunPod",salesforce:"Salesforce",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",securitytrails:"SecurityTrails",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",sourcegraph:"Sourcegraph",spotify:"Spotify",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",timecamp:"TimeCamp",timelink:"Timelink",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",trello:"Trello",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",unione:"Unione",uniswapapi:"Uniswap",uploadcare:"Uploadcare",vapi:"Vapi",vercel:"Vercel",veriphone:"Veriphone",vestaboard:"Vestaboard",wakatime:"WakaTime",webflow:"Webflow",webvizio:"Webvizio",whatsapp:"WhatsApp",witai:"WitAi",wix:"Wix",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Ie(e){let n=zo[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var fe=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function _(e){return typeof e=="string"&&e.length>0}function ja(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function qa(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"}function Jn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!_(n.connectUrl)||!_(n.token)||!_(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:_(n.environmentId)?n.environmentId:n.projectId};return _(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function Vn(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!_(r.tenantId)||!_(r.plugin)||!ja(r.status)||!qa(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:_(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function Yn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!_(n.approvalUrl)||!_(n.token)||!_(n.projectId)||!_(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function en(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(_(n.access_token))return{access_token:n.access_token,refresh_token:_(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:_(n.scope)?n.scope:void 0};throw new Error(_(n.error)?_(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Ka(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Za(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;_(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function Ga(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function Jo(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!_(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!_(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",s=Za(o.fields),a=Ka(o.missingRequiredFields),c=Ga(o.status,o.connected,s,a);t.push({plugin:o.plugin,providerName:_(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:s,missingRequiredFields:a})}return{tenantId:n.tenantId,plugins:t}}function Qn(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Vo(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}function Yo(e){return e.replace(/\/$/,"")}function rr(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return Ae()}catch{return null}}function Qo(e){let n=rr(e);return n?{"x-corsair-delivery-url":n}:{}}async function Xo(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function za(e,n,t){if(n===404&&t)return t;let r=Qn(e);return r||`Hub API returned HTTP ${n}`}function ei(e,n,t){let r=Vo(e);throw r?new fe({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(za(e,n,t))}async function I(e){let n=Yo(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...Qo(e.hub)},body:JSON.stringify(e.body)}),r=await Xo(t);return t.ok||ei(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function q(e){let n=Yo(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...Qo(e.hub)}}),r=await Xo(t);return t.ok||ei(r,t.status,e.notFoundMessage),e.parseResponse(r)}function Xn(e){return e&&typeof e=="object"?e:{}}function ni(e){let n=Xn(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function or(e,n){return I({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=Xn(t);return{chat:r.thread,reply:ni(r.reply)}}})}async function ir(e,n){return I({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:ni})}async function sr(e,n){return q({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Xn(t).threads;return Array.isArray(r)?r:[]}})}async function ar(e,n){return q({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=Xn(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as nc}from"crypto";var Ja="corsair:client-bridge";function cr(e){return new URL(e).origin}function nn(e){let n=JSON.stringify({type:Ja,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(cr(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var Va=new Set(["localhost","127.0.0.1","[::1]","::1"]);function ur(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Va.has(n)}catch{return!1}}function xn(e){return e==="development"?"browser":"server"}function ti(e){return xn(e)==="browser"}function ri(e){return ur(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as ec}from"crypto";var Se=60*1e3,$e=300*1e3;import{createHmac as Ya,randomBytes as Qa,timingSafeEqual as Xa}from"crypto";function ye(){return Qa(16).toString("base64url")}function In(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Ya("sha256",t).update(e).digest("base64url")}function ce(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let s=In(o,t);try{if(!Xa(Buffer.from(i,"utf8"),Buffer.from(s,"utf8")))return null}catch{return null}let a;try{a=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return a.exp*1e3<Date.now()?null:a}function et(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),s=In(i,n);return`${i}.${s}`}function Sn(e,n,t){let r=Math.floor(Date.now()/1e3);return et(e,n,r+Math.floor(t/1e3))}function We(e){return decodeURIComponent(e)}function lr(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function oi(e){let n=e.trim();return n.length>0?n:null}function tn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function rn(e,n){if(!oi(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??ec(16).toString("base64url"),iat:t,exp:t+Math.floor(Se/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=In(o,n);return`${o}.${i}`}function _e(e,n){return oi(n)?ce(e,n):null}function tc(e){let n=cr(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function dr(e){let n=rn(tc(e),e.signingSecret);return tn(e.deliveryUrl,n)}function ii(e){if(xn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=nc(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:dr(r)}}var _n="https://auth.corsair.dev";var me=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},En=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function pr(e){let n=(e.apiUrl?.trim()||_n).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"",o=t.startsWith("ck_cloud_");if(!t||!r&&!o)throw new En;return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function nt(e){return pr(e)}function rc(e){let n=e.projectApiKey.startsWith("ck_cloud_");return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&(n||e.signingSecret.trim().length>0)}function U(e){let n=T(e).hub;if(!n||!rc(n))throw new me;return n}function si(e){return e.replace(/\/$/,"")}function tt(e){return e.oauthCallbackUrl?si(e.oauthCallbackUrl.trim()):`${si(e.apiUrl)}/oauth/callback`}function on(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";if(e.startsWith("ck_cloud_"))return"cloud";throw new Error("Hub API key must start with ck_dev_ (development), ck_prod_ (production), or ck_cloud_ (cloud)")}import{createCipheriv as ai,createDecipheriv as ci,randomBytes as rt,scrypt as oc}from"crypto";import{promisify as ic}from"util";var ui=ic(oc),ot="aes-256-gcm",li=12,it=16,sc=16,je=32;function he(){return rt(je).toString("base64")}async function be(e,n){let t=rt(sc),r=await ui(n,t,je),o=rt(li),i=ai(ot,r,o,{authTagLength:it}),s=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),a.toString("base64"),s.toString("base64")].join(":")}async function X(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),l=Buffer.from(i,"base64"),u=await ui(n,s,je),d=ci(ot,u,a,{authTagLength:it});return d.setAuthTag(c),Buffer.concat([d.update(l),d.final()]).toString("utf8")}function gr(e,n){let t=Buffer.from(n,"base64"),r=rt(li),o=ai(ot,t,r,{authTagLength:it}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[r.toString("base64"),s.toString("base64"),i.toString("base64")].join(":")}function Dn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),s=Buffer.from(t,"base64"),a=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),l=ci(ot,i,s,{authTagLength:it});return l.setAuthTag(a),Buffer.concat([l.update(c),l.final()]).toString("utf8")}function Ee(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=gr(o,n);return t}function ue(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=Dn(o,n);return t}function On(e,n,t){let r=ue(e,n);return Ee(r,t)}function di(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let s=[null,void 0,""].includes(i)?null:i;await n({[o]:s})};return r}var fr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function F(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,s=[...j[n].integration,...i],a=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(a)return a;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return a={id:b.id,config:fr(b.config),dek:b.dek??null},a},updateIntegration:async b=>{let k=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),a=null}},l=null,u=async()=>{if(l)return l;let b=await c.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await X(b.dek,r),l},d=async()=>{let b=await c.getIntegration(),k=await u(),v=b.config;return!v||Object.keys(v).length===0?{}:ue(v,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await u(),v;try{v=await d()}catch(D){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,D),v={}}let P={...v};for(let[D,M]of Object.entries(b))M===null?delete P[D]:P[D]=M;let O=Ee(P,k);await c.updateIntegration({config:O})};return{get_dek:u,issue_new_dek:async()=>{let b=await c.getIntegration(),k=he(),v={};if(b.dek){let O=await X(b.dek,r),D=b.config;D&&Object.keys(D).length>0&&(v=On(D,O,k))}let P=await be(k,r);return await c.updateIntegration({config:v,dek:P}),l=k,k},...di(d,g,s)}}function B(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:s=[],ensureProvisioned:a}=e,c=[...j[n].account,...s],l=null,u=async()=>{if(l)return l;let w=!1;for(;;){let R=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!R){if(!w&&a){w=!0,await a();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return l={id:R.id,config:fr(R.config),dek:R.dek??null},l}},d={kek:o,integrationName:t,tenantId:r,getIntegration:u,getAccount:async()=>{let w=!1;for(;;){let R=await u(),A=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",R.id).executeTakeFirst();if(!A){if(!w&&a){w=!0,await a();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return{id:A.id,config:fr(A.config),dek:A.dek??null}}},updateAccount:async w=>{let R=await d.getAccount();await i.db.updateTable("corsair_accounts").set({...w.config!==void 0?{config:w.config}:{},...w.dek!==void 0?{dek:w.dek}:{},updated_at:new Date}).where("id","=",R.id).execute()}},p=null,g=null,f=null,h=async()=>{let w=await d.getAccount();if(!w.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p&&g===w.dek||(p=await X(w.dek,o),g=w.dek),p},b=async()=>{if(f)return f;let w=await d.getIntegration();if(!w.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await X(w.dek,o),f},k=async()=>{let w=await d.getAccount(),R=await h(),A=w.config;return!A||Object.keys(A).length===0?{}:ue(A,R)},v=async()=>{let w=await d.getIntegration(),R=await b(),A=w.config;return!A||Object.keys(A).length===0?{}:ue(A,R)},P=Promise.resolve(),O=w=>{let R=P.then(()=>D(w));return P=R.catch(()=>{}),R},D=async w=>{let R=await d.getAccount();if(!R.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);let A=await X(R.dek,o),Y;try{let L=R.config;Y=!L||Object.keys(L).length===0?{}:ue(L,A)}catch(L){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,L),Y={}}let ee={...Y};for(let[L,Pe]of Object.entries(w))Pe===null?delete ee[L]:ee[L]=Pe;let H=Ee(ee,A);await d.updateAccount({config:H})},M={get_dek:h,issue_new_dek:async()=>{let w=await d.getAccount(),R=he(),A={};if(w.dek){let ee=await X(w.dek,o),H=w.config;H&&Object.keys(H).length>0&&(A=On(H,ee,R))}let Y=await be(R,o);return await d.updateAccount({config:A,dek:Y}),p=R,g=Y,R},...di(k,O,c)};return n==="oauth_2"&&(M.get_integration_credentials=async()=>{let w=await v();return{...w,client_id:w.client_id||null,client_secret:w.client_secret||null,redirect_url:w.redirect_url??null}}),M}async function pi(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=he(),i=await be(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function gi(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let s=he(),a=await be(s,r);return await e.db.updateTable("corsair_accounts").set({dek:a,updated_at:new Date}).where("id","=",i.id).execute(),s}var ac=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function De(e){return ac.has(e)}function cc(e,n){return De(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function uc(e){return!De(e)}function lc(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function dc(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function pc(e,n){let t=i=>n.find(s=>s.level==="account"&&s.name===i);if(!lc(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function fi(e,n){if(!e)return!1;let t=Q(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function gc(e,n){let r=e.authConfig?.[n]?.integration??[];return[...j[n].integration,...r]}function fc(e,n){let r=e.authConfig?.[n]?.account??[];return[...j[n].account,...r]}function yc(e,n,t){let r=t.filter(a=>a.required&&!a.configured).map(a=>a.name),o=t.filter(a=>a.level==="integration"&&a.required&&!a.configured).map(a=>a.name),i=t.filter(a=>a.level==="account"&&a.required&&a.configured),s;return o.length>0?s="missing_integration":r.length===0?s="ready":i.length>0?s="partial":s="not_started",{plugin:e,authType:n,status:s,connected:pc(n,t),fields:t,missingRequiredFields:r}}async function qe(e,n,t){let r=S(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,s=i?.[r]?.integration??[],a=i?.[r]?.account??[],c=F({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:s}),l=B({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:a}),u=gc(n,r),d=fc(n,r),p=[];for(let g of u)p.push({name:g,level:"integration",required:cc(r,g),configured:await fi(c,g)});for(let g of d)p.push({name:g,level:"account",required:uc(g),configured:await fi(l,g)});if(dc(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return yc(n.id,r,p)}async function Mn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let s of e.plugins){if(o&&!o.has(s.id))continue;let a=await qe(e,s,r);a&&i.push(a)}return i}function st(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var yi=Symbol.for("corsair:internal"),mi=new WeakMap,hi=new WeakMap;function mc(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function hc(e){if(e.database){let t=mi.get(e.database);return t||(t=new Map,mi.set(e.database,t)),t}let n=hi.get(e);return n||(n=new Map,hi.set(e,n)),n}function bc(e){return e.multiTenancy?{withTenant:()=>({}),[yi]:e}:{[yi]:e}}async function sn(e,n){if(!e.database)return;let t=n.trim()||"default",r=hc(e),o=mc(t,e.plugins),i=r.get(o);if(i){await i;return}let s=(async()=>{let{setupCorsair:a}=await import("./setup-G23JJ5MM.js");await a(bc(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,s),await s}import*as Hn from"crypto";function Oe(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function yr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function an(e,n){if(!n)throw new Error("OAuth state signing requires a configured kek. Pass kek to createCorsair().");let t=Hn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var mr=600*1e3;function at(e,n){if(!n)return null;let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Hn.createHmac("sha256",n).update(r).digest("base64url"),s=Buffer.from(o,"base64url"),a=Buffer.from(i,"base64url");return s.length!==a.length||!Hn.timingSafeEqual(s,a)?null:yr(r,{maxAgeMs:mr})}function bi(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function ki(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function cn(e,n){await I({hub:e,path:"/connections/report",body:bi(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function kc(e,n){try{let t=U(e);I({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof me)return}}async function wc(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!S(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await qe(n,e.plugin,r);o&&Ci(e.hub,ki({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function wi(e,n){kc(e,n)}function Ci(e,n){I({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function un(e){wc(e).catch(()=>{})}async function ke(e,n){let t=T(e);if(!S(n.plugin))return;let o=await qe(t,n.plugin,n.tenantId);o&&wi(e,ki({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function ct(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var vi=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function Cc(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function vc(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await X(n.dek,e.kek),r=vi(n.config),o={};Object.keys(r).length>0&&(o=ue(r,t)),o[e.link.linkType]=e.link.externalId;let i=Ee(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function ln(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:s,extraAccountFields:a=[]}=e,{accountId:c}=await Cc({database:n,pluginId:r,tenantId:o}),l=!1;if(s){let u=B({authType:s,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:a}),d=`set_${i.linkType}`,p=u[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await vc({database:n,kek:t,accountId:c,link:i})}async function hr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,s=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let a of s)if(a.dek)try{let c=await X(a.dek,t),u=vi(a.config)[o];if(!u)continue;if(Dn(u,c)===i)return a}catch{continue}return null}async function ut(e){return(await hr(e))?.tenant_id??null}async function Ti(e){return ut({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as Pi from"querystring";function Ke(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${Pi.stringify(i)}`}async function Ri(e,n){try{return await q({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function dn(e,n,t,r){if(!n.subscribe)return;let o=U(e),i=await Ri(o,n.id);if(!i)return;let s=await n.subscribe({keys:r},{webhookUrl:i});s&&await ke(e,{plugin:n,tenantId:t,verified:!0,webhookLink:s.webhookLink,webhookSecret:s.webhookSecret})}var Z=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function Ai(e){let n=e.oauthConfig;if(!n)throw new Z("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Tc(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let s=await i.executeTakeFirst();if(!s)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",s.id).executeTakeFirst())return;let c=he(),l=await be(c,r),u=new Date;await o.insertInto("corsair_accounts").values({id:Xe(),created_at:u,updated_at:u,tenant_id:t,integration_id:s.id,config:{},dek:l}).execute()})}async function br(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,s=T(e,()=>new Z("invalid_corsair_instance","Invalid corsair instance"));if(!s.database)throw new Error("No database configured on corsair instance");let a=K(s,n,p=>new Z("plugin_not_found",p)),c=Ai(a),u=await F({authType:"oauth_2",integrationName:n,kek:s.kek,database:s.database}).get_client_id();if(!u)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Ke({oauthConfig:c,clientId:u,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=an(Oe(n,r),s.kek);return{url:Ke({oauthConfig:c,clientId:u,redirectUri:o,state:d}),state:d}}function Pc(e,n){return{...n??{},...e}}async function Bn(e,n){let{code:t,state:r,redirectUri:o}=n,i=T(e,()=>new Z("invalid_corsair_instance","Invalid corsair instance")),s,a;if(n.trusted){if(!n.plugin||!n.tenantId)throw new Z("invalid_state","trusted callback requires plugin and tenantId");s=n.plugin,a=n.tenantId}else{let h=at(r,i.kek);if(!h)throw new Z("invalid_state","Invalid or tampered state parameter");s=h.plugin,a=h.tenantId}if(!i.database)throw new Z("no_database","No database configured on corsair instance");let c=K(i,s,h=>new Z("plugin_not_found",h)),l=Ai(c),u=F({authType:"oauth_2",integrationName:s,kek:i.kek,database:i.database}),d=await u.get_client_id(),p=await u.get_client_secret();if(!d||!p)throw new Z("credentials_not_configured",`Credentials not configured for '${s}'`);await Tc(i.database,s,a,i.kek);let g=await lt(t,d,p,l,o);if(!g.access_token)throw new Z("no_access_token",`No access_token returned from ${l.providerName}`);let f=B({authType:"oauth_2",integrationName:s,tenantId:a,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await ke(e,{plugin:c,tenantId:a}).catch(()=>{});try{let h=Pc(g,n.callbackParams),b=await ct(i.plugins,s,h);if(b){try{let k=c.authConfig?.oauth_2?.account??[];await ln({database:i.database,kek:i.kek,pluginId:s,tenantId:a,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${a}':`,k)}i.hub&&cn(i.hub,{plugin:s,tenantId:a,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${a}':`,h)}if(c.subscribe)try{await dn(e,c,a,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${s}' tenant '${a}':`,h)}return{plugin:s,tenantId:a}}async function Rc(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??dn,i=[],s=[];if(!t.database)return{renewed:i,failed:s};for(let a of r){let c=t.plugins.find(u=>u.id===a.integrationName);if(!c?.subscribe)continue;let l=`${c.id}/${a.tenantId}`;try{let u=S(c)??"oauth_2",d=B({authType:u,integrationName:c.id,tenantId:a.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[u]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:u,keys:g,hub:t.hub},"endpoint")}await o(n,c,a.tenantId,d),i.push(l)}catch(u){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,u),s.push(l)}}return{renewed:i,failed:s}}async function xi(e){let n=T(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return Rc({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function Ac(e,n={}){let t=!1,r=()=>{t||(t=!0,xi(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function Ii(e){if(!T(e).database)throw new Error("A database must be configured to provision Corsair integrations");await dt(e,{silent:!0})}async function pn(e,n){let t=T(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await sn(t,n)}var xc=Symbol.for("corsair:internal"),Ic=new Set(["access_token","refresh_token","expires_at","scope"]);function Sc(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function _c(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!De(t)&&!Ic.has(t)):n.filter(t=>!De(t))}function Si(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function Ec(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function Dc(e){return{[xc]:Si(e)}}async function pt(e,n,t={}){let r=tt(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,s=Si(e),a=Dc(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let l=S(c);if(!l)continue;let u=Sc(l),d=t.providerNameOverrides?.[c.id]??Ie(c.id),p=await qe(s,c,n),g=Gn(c,l),f=_c(l,g),h={plugin:c.id,providerName:d,authKind:u,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),u==="oauth"){let k=t.oauthModeOverrides?.[c.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let v=await br(a,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=v.url}catch(v){v instanceof Error&&/client_id not configured/i.test(v.message)||(h.setupError=v instanceof Error?v.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function Jg(e,n,t={}){let r=T(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return pt({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function _i(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await sn(e.internalConfig??Ec(e),n)}async function Ei(e,n){await pn(e,n)}async function Di(e,n){let t=on(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Ae({deliveryUrl:n.deliveryUrl})),I({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Jn})}async function Oi(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await _i(t,n.tenantId);let r=await pt(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return Di(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function gt(e,n){let t=T(e),r=U(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Ei(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,s=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await pt(o,n.tenantId,{pluginIds:i,oauthModeOverrides:s,providerNameOverrides:a});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return Di(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function ft(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(s=>s.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=T(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await Oc(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function Oc(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-MRN3CJR3.js"),{postHubConnectSession:i}=await import("./connect-JKEAFJMP.js"),s={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(s,t.tenantId);let a=await r(s,t.tenantId,{pluginIds:t.pluginIds});if(a.length===0)throw new Error("No connectable plugins found for this tenant");let c=a.find(l=>l.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:a})}function gn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var te=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Mc(e){let n=e.oauthConfig;if(!n)throw new te("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function kr(e,n){let t=T(e,()=>new te("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new te("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new te("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=at(n,t.kek);if(!o)throw new te("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:s}=o,a=K(t,i,p=>new te("plugin_not_found",p)),c=Mc(a),u=await F({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!u)throw new te("client_id_not_configured",`client_id not configured for '${i}'`);let d=Ke({oauthConfig:c,clientId:u,redirectUri:r,state:n});return{plugin:i,tenantId:s,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as Bc}from"async_hooks";import{randomBytes as Uc}from"crypto";import{v4 as Fc}from"uuid";async function yt(e,n){let t=on(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Ae({deliveryUrl:n.deliveryUrl})),I({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Yn})}function mt(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var wr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function vr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Mi(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Cr(e){return mt(e)}async function Tr(e,n){if(vr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Mi(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await yt(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:Hc(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function Hc(e){try{return JSON.parse(e)}catch{return e}}async function ht(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Tr(e,n);return{...n,approvalUrl:r}}async function Pr(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:s,endpoint:a,args:c,tenantId:l,expiresAt:u,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:s,endpoint:a,args:c});let g=await Tr({manual:t,hub:r},{id:o,token:i,plugin:s,endpoint:a,args:JSON.stringify(c),tenant_id:l,expires_at:u});return vr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Cr(g):wr:r?g?Cr(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:wr}var Me=class extends Error{reason;constructor(n,t="pending"){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError",this.reason=t}};var Bi=new Bc,fn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function Rr(e){return Bi.run(!0,e)}function Ui(){return Bi.getStore()===!0}function Ar(e,n){if(Ui()&&n!=="read")throw new fn(e,n)}var Lc={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function Nc(e,n,t){return t!==void 0?t:Lc[n][e]}function xr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Fi(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Hi(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Li(e){let n=Nc(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, update the permission mode or add an override in your corsair config.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),s=e.tenantId??"default",a=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",s).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(a){if(a.status==="approved"){let f=e.db,h=a.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return a.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${a.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Hi(e.db,a.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:a.id,token:a.token,expiresAt:a.expires_at})}let c=Fc(),l=Uc(32).toString("hex"),u=e.timeoutMs??600*1e3,d=new Date(Date.now()+u).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:c,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:s,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${c}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Hi(e.db,c,u):{result:"blocked",reason:"pending",id:c,token:l,expiresAt:d}}var C=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function x(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function le(e){let n={error:e.code,message:e.message,...e.extra};return x(e.status,n)}function He(e){return new C(404,"not_found",e)}function G(e,n={}){return new C(400,"bad_request",e,n)}function Ir(e,n){return K(e,n,t=>He(t))}async function Ni(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=F({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=j[t].integration,i=r,s;try{s=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{s=o.map(()=>null)}let a=o.filter((l,u)=>s[u]==null),c;return t==="oauth_2"?c=!a.includes("client_id")&&!a.includes("client_secret"):c=a.length===0,{configured:c,missingFields:a}}async function $i(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await Ni(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function bt(){return{ok:!0}}async function yn(e){return Promise.all(e.plugins.map(n=>$i(n,e)))}async function kt(e,n){let t=Ir(e,n);return $i(t,e)}async function $c(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function Wi(e,n){let t=await $c(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function mn(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let s=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:s}),s&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function wt(e,n){if(!n)throw G("Tenant id must be a non-empty string");return Wi(e,n)}async function Ct(e,n){let t=n?.id?.trim();if(!t)throw G("Tenant id is required",{missingFields:["id"]});return Wi(e,t)}async function vt(e,n){let t=n?.trim()||"default",r={},o=await Mn(e,t);for(let i of o)r[i.plugin]=st(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function Tt(e,n){let t=n?.plugin;if(typeof t!="string"||!t.trim())throw G("plugin is required",{missingFields:["plugin"]});let r=t.trim();Ir(e,r);let o=n?.tenantId;if(o!=null&&typeof o!="string")throw G("tenantId must be a string");let i=o?.trim()||"default";if(!e.database)return{ok:!0,disconnected:!1};let s=e.database.db,a=await s.selectFrom("corsair_integrations").select(["id"]).where("name","=",r).executeTakeFirst();if(!a)return{ok:!0,disconnected:!1};let c=!1;return await s.transaction().execute(async l=>{e.database?.isPg===!0&&await l.selectFrom("corsair_integrations").select("id").where("name","=",r).forUpdate().execute();let u=l.selectFrom("corsair_accounts").select("id").where("tenant_id","=",i).where("integration_id","=",a.id);await l.deleteFrom("corsair_events").where("account_id","in",u).execute(),await l.deleteFrom("corsair_entities").where("account_id","in",u).execute(),c=((await l.deleteFrom("corsair_accounts").where("tenant_id","=",i).where("integration_id","=",a.id).executeTakeFirst()).numDeletedRows??0n)>0n}),{ok:!0,disconnected:c}}async function Sr(e,n){if(!e.database)throw He(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw He(`Permission '${n}' not found`);return ht(e,t)}function Wc(e){if(!e.oauthConfig)throw G(`Plugin '${e.id}' has no oauthConfig`)}function jc(e){if(!e.manual)throw new C(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function _r(e){let n=jc(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new C(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function qc(e){let n=!!e.hub,t=gn(e.manual);if(!n&&!t)throw new C(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function ji(e){if(!e.database||!e.kek)throw new C(500,"database_not_configured","A database and kek are required to issue connect links.")}async function Kc(e,n){let t=n?.plugin?.trim();if(!t)throw G("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=Ir(e,t);Wc(o);let i=_r(e);ji(e);let s=await Ni(o,e);if(!s.configured)throw new C(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:s.missingFields});let a=an(Oe(t,r),e.kek),c;try{c=new URL(i.baseUrl)}catch{throw new C(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return c.searchParams.set("state",a),{connectUrl:c.toString(),expiresAt:new Date(Date.now()+mr).toISOString(),tenantId:r}}async function Zc(e,n,t){ji(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let s=t.providerName?.trim();s&&(o.providerName=s);let a=await gt(e,o);return{connectUrl:a.connectUrl,expiresAt:a.expiresAt,tenantId:r}}async function Pt(e,n,t){return qc(n),n.hub?Zc(e,n,t):Kc(n,t)}async function Rt(e,n,t){if(n.hub&&!gn(n.manual))throw new C(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw G("state is required",{missingFields:["state"]});_r(n);try{return await kr(e,r)}catch(o){if(o instanceof te)switch(o.code){case"invalid_state":throw G("Invalid or expired state");case"client_id_not_configured":throw new C(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new C(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function At(e,n,t){if(n.hub&&!gn(n.manual))throw new C(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw G("Missing required fields",{missingFields:i});let s=_r(n),{processOAuthCallback:a}=await import("./oauth.js");try{return await a(e,{code:r,state:o,redirectUri:s.redirectUri,callbackParams:t.callbackParams})}catch(c){if(c instanceof Error&&c.name==="OAuthCallbackError")switch(c.code){case"invalid_state":throw G("Invalid or expired state");case"credentials_not_configured":throw new C(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new C(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function Er(e,n){if(!e.database)throw He("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw He("Permission not found");return ht(e,t)}async function qi(e,n){return"id"in n?Sr(e,n.id):Er(e,n.token)}import{createCipheriv as eu,createDecipheriv as ny,randomBytes as zi,scryptSync as nu}from"crypto";import{createHmac as Dr,randomUUID as Gc,timingSafeEqual as Zi}from"crypto";function Or(e){return e.run??null}function Mr(e){return e.probe??null}function Gi(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function xt(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=Dr("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":Gc()}}}function Hr(e){let n=e.signingSecret.trim();if(!n)return!1;let t=Gi(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>$e)return!1;let i=Dr("sha256",n).update(e.body).digest("hex");try{return Zi(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function hn(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=Gi(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>$e)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=Dr("sha256",n).update(e.body).digest("hex");try{if(!Zi(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function bn(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function It(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function St(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function Un(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function Br(e){return Un(bn(e))}async function Ur(e){let n=await Dt({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=bn(n.body),r=It({httpOk:n.ok,status:n.status,body:t}),o=Un(t);if(!r||!o)throw new Error(Et({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function _t(e){return St(bn(e))}function zc(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function Ki(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var Jc="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",Vc="Check the delivery URL configured for this environment.";function Yc(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${Jc}`}function Qc(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${Vc}`}function Fn(e,n){let t=zc(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function Et(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Fn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return Yc(e);if(e.status===404)return Qc(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${Ki(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${Ki(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}var Xc=15e3;async function Dt(e){let{body:n,headers:t}=xt(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n,signal:AbortSignal.timeout(Xc)}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Fn(e.deliveryUrl,r)}}}var tu="aes-256-gcm",ru=12,ou=16,iu=16,su=32;function au(e,n){return nu(e.trim(),n,su)}function Fr(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=zi(iu),o=au(t,r),i=zi(ru),s=eu(tu,o,i,{authTagLength:ou}),a=JSON.stringify(e),c=Buffer.concat([s.update(a,"utf8"),s.final()]),l=s.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),c.toString("base64")].join(":")}var cu=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function Lr(e){if(e instanceof jo)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!cu.some(t=>n.includes(t))}function uu(e){if(!e)return[];let n=S(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!De(r)):[]}async function Ln(e,n){let t=T(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await dt(e,{silent:!0});let[r,o]=await Promise.all([mn(t),yn(t)]),i={tenants:r.map(s=>({id:s.id})),plugins:o.map(s=>{let a=uu(t.plugins.find(c=>c.id===s.id));return{id:s.id,authType:s.authType,configured:s.configured,missingFields:s.missingFields,...a.length>0?{integrationCredentialFields:a}:{}}}),syncedAt:new Date().toISOString()};return Fr(i,n)}var de=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function Ot(e,n){let t=T(e,()=>new de("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new de("no_database","Database not configured");let r=K(t,n.plugin,u=>new de("plugin_not_found",u)),o=S(r);if(!o)throw new de("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new de("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await pn(e,n.tenantId);let i=new Set(Gn(r,o)),a=r.authConfig?.[o]?.account??[],c=B({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:a}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new de("invalid_credentials",`Unknown credential field '${u}' for plugin '${n.plugin}'`);let p=Q(c,`set_${u}`);if(!p)throw new de("invalid_credentials",`Cannot set credential field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new de("invalid_credentials","Provide at least one credential field to save");return await ke(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var pe=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function Nr(e,n){let t=T(e,()=>new pe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new pe("no_database","Database not configured");let r=K(t,n.plugin,u=>new pe("plugin_not_found",u)),o=S(r);if(!o)throw new pe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await Ii(e);let i=new Set(Zo(r,o)),a=r.authConfig?.[o]?.integration??[],c=F({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:a}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new pe("invalid_credentials",`Unknown integration credential field '${u}' for plugin '${n.plugin}'`);let p=Q(c,`set_${u}`);if(!p)throw new pe("invalid_credentials",`Cannot set integration field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new pe("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var Mt=new Map;function lu(e){for(let[n,t]of Mt)t<=e&&Mt.delete(n)}function Ht(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();lu(r);let o=Mt.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(Mt.set(t,r+n),{ok:!0})}var Be=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function kn(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:s,scope:a,authType:c="managed",providerData:l}=n;if(!o.trim())throw new Be("no_access_token","Managed OAuth delivery missing access_token");let u=T(e,()=>new Be("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new Be("no_database","No database configured on corsair instance");let d=K(u,t,g=>new Be("plugin_not_found",g));await pn(e,r);let p=B({authType:c,integrationName:t,tenantId:r,kek:u.kek,database:u.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),s&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+s)),a&&await p.set_scope(a),await ke(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await ct(u.plugins,t,{access_token:o,refresh_token:i,scope:a,...l});if(g){try{let f=d.authConfig?.[c]?.account??[];await ln({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:g,authType:c,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}u.hub&&cn(u.hub,{plugin:t,tenantId:r,link:g,authType:c})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await dn(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function du(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Ji(e,n,t=[]){for(let[r,o]of Object.entries(e))if(du(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=Ji(o,n,[...t,r]);if(i)return i}return null}function pu(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function gu(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function Vi(e,n,t,r,o){let i=pu(n),s=typeof t=="string"?JSON.parse(t):t;(!s||typeof s=="object"&&Object.keys(s).length===0)&&i["x-goog-resource-uri"]&&(s=gu(i)||s);let c={headers:i,body:s,...r?{query:r}:{}},l=r?.tenantId||"default",u=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:zn;for(let g of p){let f=u[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(c))continue;let h=Ji(f.webhooks,c);if(!h)continue;let b=h.path.join("."),k={payload:s,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let v=await h.webhook.handler(k),P=!!Object.keys(v.returnToSender||{})?.length;return{plugin:g,action:b,body:s,response:P?{...v?.returnToSender,success:!0}:{success:!0},...v.responseHeaders&&{responseHeaders:v.responseHeaders}}}catch(v){return console.error(`Error executing webhook handler for ${g}.${b}:`,v),{plugin:g,action:b,body:s,response:{success:!1,error:v instanceof Error?v.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as fu}from"crypto";import*as Ze from"vm";var Yi="__corsairFailedStep",yu=3e4,$r=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function Qi(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function Xi(e,n){return`st_${fu("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function Bt(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var es=new Set(["constructor","prototype","__proto__"]);function we(e,n){if(e===null)return null;let t=typeof e;return t==="function"?hu(e,n):t==="object"?mu(e):e}function mu(e){return new Proxy(e,{get(n,t){if(!es.has(t))return we(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function hu(e,n){return new Proxy(e,{apply:(t,r,o)=>bu(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!es.has(r))return we(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function bu(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>we(n,void 0),n=>{throw we(n,void 0)}):we(e,void 0)}function ku(e){let n=Object.create(null),t=Ze.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Ze.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),s=Ze.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),c=Ze.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=we(e.corsair,void 0),n.__payload=o,n.__step=s,n.__console=c;let l=Ze.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let u,d=new Promise((p,g)=>{u=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(u))}async function Wr(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(s,a)=>{if(o)throw o;let c=r++,l=Xi(s,c);if(Object.hasOwn(n,l))return we(n[l].output,void 0);try{let u=await a();return t.push({stepId:l,name:s,seq:c,status:"completed",output:u}),u}catch(u){if(Qi(u))throw u;let d=Bt(u);t.push({stepId:l,name:s,seq:c,status:"failed",error:d});let p=new Error(d);throw p[Yi]=s,p}});i.sleep=async(s,a)=>{if(o)throw o;let c=r++,l=Xi(s,c);if(Object.hasOwn(n,l))return;t.push({stepId:l,name:s,seq:c,status:"completed",output:null});let u=Number.isFinite(a)?Math.max(0,a):0;throw o=new $r(Date.now()+u,s),o};try{await ku({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??yu});let s=o;return s?{status:"sleeping",steps:t,sleepUntil:new Date(s.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(s){if(Qi(s))return{status:"sleeping",steps:t,sleepUntil:new Date(s.wakeAt).toISOString()};let a=Bt(s),c=s!==null&&typeof s=="object"?s[Yi]:void 0;return{status:"failed",steps:t,error:{message:a,...c?{failedStep:c}:{}}}}}import*as Ut from"vm";var ns=1e4;async function jr(e){let n=Object.create(null),t=Ut.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=we(e.corsair,void 0);let r=Cu(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await Rr(()=>{let s=Ut.runInContext(o,t,{filename:"corsair:probe",timeout:r});s.catch(()=>{});let a,c=new Promise((l,u)=>{a=setTimeout(()=>u(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([s,c]).finally(()=>clearTimeout(a))});return{status:"ok",value:wu(i)}}catch(i){return{status:"error",error:Bt(i)}}}function wu(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function Cu(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?ns:Math.min(e,ns)}function Ge(e){return e.deliveryMode==="auth.credentials"}function Nn(e){return e.deliveryMode==="connections.sync"}function Ft(e){return e.deliveryMode==="connect.create_link"}function $n(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function Wn(e){return e.deliveryMode==="oauth.tokens"}function Lt(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!Ge(e)&&!Nn(e)&&!Ft(e)&&!$n(e)&&!Wn(e)}function vu(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function Tu(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await Ln(e,n)}}}}}catch(t){return{status:"failed",retryable:Lr(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function Pu(e,n){try{let t=await ft(e,n);return vu(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function qr(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function Ru(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await ut({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function Au(e,n,t,r){let o=await Ru(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},s=await Vi(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!s.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(s.response&&s.response.success===!1)return{status:"failed",retryable:!1,error:typeof s.response.error=="string"?s.response.error:"Webhook handler failed"};let a=s.response?.returnToSender,c=a&&typeof a=="object"&&typeof a.validationToken=="string"&&Object.keys(a).length===1?a.validationToken:a||(s.response?.data??s.response);return{status:"ok",webhookResponse:{status:s.response?.statusCode??200,body:c,headers:s.responseHeaders}}}async function xu(e,n){return await Bn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function Iu(e,n){return await kn(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function Zr(e,n,t){let r=await Kr(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function Kr(e,n,t){let r=T(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),s=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return s?s.status!=="pending"?{status:"ok"}:s.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",s.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",s.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function Su(e,n){try{return await Ot(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function _u(e,n){try{return await Nr(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function ts(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function Eu(e,n){try{let t=ts(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await Wr({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function Du(e,n){try{let t=ts(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await jr({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function jn(e,n,t={}){let r=T(e),o=qr(n.headers,"x-corsair-signature"),i=qr(n.headers,"x-corsair-timestamp"),s=qr(n.headers,"x-corsair-nonce"),a=!1;if(t.signingSecret?.trim()){let l=hn({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!l.ok)return{status:"failed",retryable:!1,error:l.error};if(!s?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let u=Ht(`nonce:${s.trim()}`,$e);if(!u.ok)return{status:"failed",retryable:!1,error:u.error};a=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let c;try{c=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(c.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(c.type){case"webhook":return Au(e,r,c.payload,a);case"oauth.callback":return xu(e,c.payload);case"oauth.tokens":return Iu(e,c.payload);case"permission.approve":return Kr(e,c.payload,"approved");case"permission.deny":return Kr(e,c.payload,"denied");case"auth.credentials":return Su(e,c.payload);case"integration.credentials":return _u(e,c.payload);case"connect.create_link":return Pu(e,c.payload);case"connections.sync":{let l=t.signingSecret?.trim();return l?Tu(e,l):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?Eu(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?Du(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(c.type)}`}}}function Ou(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var Gr=3,Mu=250;function Hu(e){return e?.name==="AbortError"}async function Bu(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function Uu(e,n,t,r,o){for(let i=1;i<=Gr;i++){try{let s=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(s.ok)return await Bu(s)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(s){if(Hu(s))throw s}i<Gr&&await os(Mu)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${Gr} attempts; the run may be retried`),!1}async function Fu(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:s,body:a,headers:c}=await i.json(),l=await t.process(e,{headers:c,body:a},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:u,body:d}=Ou(l);return await Uu(n,t,o,{deliveryId:s,status:u,body:d},r)?"handled":"error"}var rs=1e3,Lu=5e3,Nu=3e4;function os(e){return new Promise(n=>setTimeout(n,e))}var Nt=globalThis.__corsairConnectLoops??=new Map;function $u(e,n={fetch,process:jn}){let t;try{t=U(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(Nt.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");Nt.set(r,o);let i=()=>{Nt.get(r)===o&&Nt.delete(r)},s=!1,a=null;return(async()=>{let l=rs,u=!1,d=async p=>{u||(console.warn("[corsair] connect loop error; retrying",p),u=!0),s||await os(l),l=Math.min(l*2,Lu)};try{for(;!s;){a=new AbortController;let p=setTimeout(()=>a?.abort(),Nu);try{await Fu(e,t,n,a.signal)==="error"?await d("pull or ack failed"):(u=!1,l=rs)}catch(g){if(s)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{s=!0,a?.abort(),i()}}}function is(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Wu(e,n){return n&&!n.has(e.id)?!1:S(e)!==null}async function ss(e,n,t={}){let r=T(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,s=await Mn(r,o,{pluginIds:t.pluginIds}),a=new Map(s.map(l=>[l.plugin,l])),c=r.plugins.filter(l=>Wu(l,i)).map(l=>{let u=S(l),d=a.get(l.id);return d?{plugin:l.id,providerName:Ie(l.id),authKind:is(u),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:Ie(l.id),authKind:is(u),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:c}}async function as(e,n){let t=U(e);return q({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:Vn})}var cs=1024*1024,us=3e4;function ze(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:cs}function Je(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:us}function wn(e){return new C(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function ju(e){return new C(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function $t(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o(ju(n)),n)})])}finally{clearTimeout(t)}}async function Wt(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:a,value:c}=await $t(()=>t.read(),n.bodyStallTimeoutMs);if(a)break;if(o+=c.byteLength,o>n.maxBodyBytes)throw wn(n.maxBodyBytes);r.push(c)}let i=new Uint8Array(o),s=0;for(let a of r)i.set(a,s),s+=a.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var zr=new Map;function ls(e){let n;try{n=U(e)}catch{return}let t=rr(n);t&&zr.get(n.projectApiKey)!==t&&(zr.set(n.projectApiKey,t),I({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{zr.delete(n.projectApiKey)}))}var qu=[".corsair.dev"];function Ku(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function Zu(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Ku(n)?!0:qu.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function ds(e){return!e||!Zu(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function ps(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function Jr(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function Vr(e,n){let t=U(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=_e(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let s=Ht(`browser:${i.jti}`,Se);if(!s.ok)return{type:"json",status:400,body:{error:s.error}};try{if(Nn(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let a=await Ln(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:nn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:a}}})}}if(Ft(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let a=i.connectLinkPlugins?.filter(Boolean)??[];if(a.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let c=await ft(e,{tenantId:i.tenantId,plugins:a});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:nn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:c.connectUrl,expiresAt:c.expiresAt}})}}if(Ge(i))return i.hubSuccessUrl?i.credentials?(await Ot(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:Jr(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:Jr(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if($n(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await Zr(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(Wn(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await kn(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!Lt(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await Bn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(a){let c=a instanceof Error?a.message:"Hub delivery failed";return Nn(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:nn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:Ft(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:nn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:Ge(i)&&i.hubSuccessUrl?{type:"redirect",url:Jr(i.hubSuccessUrl,{error:c})}:Ge(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:nn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:{type:"json",status:400,body:{error:c}}}return{type:"redirect",url:i.hubSuccessUrl}}async function Yr(e,n){let t=U(e),r=await jn(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,s=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:s}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:s}}function Qr(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function Xr(e,n){return n.method==="GET"?Vr(e,n.url):Yr(e,{headers:n.headers,body:n.body??""})}async function eo(e,n){try{let t=await Xr(e,n);return Qr(t)}catch(t){if(t instanceof me)return Response.json({error:t.message},{status:503});throw t}}async function Ve(e,n,t){ls(e);let r=n.method.toUpperCase(),o=ds(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await eo(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await Wt(n,{maxBodyBytes:ze(t?.maxBodyBytes),bodyStallTimeoutMs:Je(t?.bodyStallTimeoutMs)}):void 0});return ps(i,o)}var E=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function Cn(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function vn(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var gs=new WeakMap;function qn(e,n,t){let r=gs.get(e);r||(r=new Map,gs.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var fs=300;async function no(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,s=n?.forceRefresh??!1,a=`managed:${o}:${i}`;return qn(t,a,async()=>{let[c,l,u]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!c&&!u)throw new E(o,"managed");let d=Math.floor(Date.now()/1e3);if(!s&&c&&l&&Number(l)>d+fs)return{accessToken:c,expiresAt:Number(l),refreshed:!1};if(!u&&c&&!s){let f=l?Number(l):null;if(f===null||f>d+fs)return{accessToken:c,expiresAt:f??d+3600,refreshed:!1}}if(!u)throw new E(o,"managed");let p=await zu(r,o,i,u),g=await vn(t,p,l);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function Gu(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function zu(e,n,t,r){try{return await I({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:en})}catch(o){let i=o instanceof Error?o.message:"";throw Gu(i)?new E(n,"managed"):o}}async function ys(e,n){e._refreshAuth=async()=>(await no(n,{forceRefresh:!0})).accessToken}function ms(e){return{delivery:n=>Ve(e,n),deliveryOptions:n=>Ve(e,n)}}var hs=1200*1e3;function to(){return ye()}function ro(){return hs}function oo(e,n){return Sn(e,n,hs)}function io(e,n){return ce(e,n)}function so(e){return We(e)}var bs=600*1e3;function ao(){return ye()}function co(){return bs}function uo(e,n){return Sn(e,n,bs)}function lo(e,n){return ce(e,n)}function po(e){return lr(e)}function go(e){return We(e)}function fo(){return ye()}function yo(e,n,t){return et(e,n,Math.floor(t.getTime()/1e3))}function mo(e,n){return ce(e,n)}function ho(e){return We(e)}var Ye=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${je}`),this.name="CorsairKekMissingError"}};function jt(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new Ye;let s=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${s?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${je}`)}})}async function Ju(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function ks(e){let{integrationId:n,accountId:t}=await Ju(e);return{integrationId:n,accountId:t}}function ws(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>or(t(),{tenantId:n,message:r}),list:()=>sr(t(),{tenantId:n}),get:r=>({message:o=>ir(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>ar(t(),{chatId:r,tenantId:n})})}}function Cs(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function Vu(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await Oi(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):Cs(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function Yu(e,n,t){let r=an(Oe(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):Cs(e,i),connectUrl:i}}async function Qu(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.manual&&gn(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?Yu(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?Vu({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function vs(e){let{message:n,connectUrl:t}=await Qu(e);throw new E(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var qt="connect.request",ko="connect.cleared",Xu=600*1e3;async function bo(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function el(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function nl(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[qt,ko]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function Ts(e,n,t,r,o){let i=await nl(e,n,o),s=new Date(i);await e.db.insertInto("corsair_events").values({id:Xe(),created_at:s,updated_at:s,account_id:n,event_type:t,payload:r}).execute()}async function tl(e,n,t=Date.now()){let r=await bo(e,n.tenantId,n.plugin);r&&await Ts(e,r,qt,{plugin:n.plugin,connectUrl:n.connectUrl},t)}async function rl(e,n,t,r,o){let i=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[qt,ko]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!i||i.event_type!==qt)return null;let s=i.created_at instanceof Date?i.created_at.getTime():Date.parse(String(i.created_at));if(r-s>o)return null;let a=typeof i.payload=="string"?JSON.parse(i.payload):i.payload??{},c=a.plugin,l=a.connectUrl;return typeof c!="string"||typeof l!="string"?null:{plugin:c,connectUrl:l,requestedAt:new Date(s).toISOString(),tenantId:t,requestedAtMs:s,accountId:n}}async function wo(e,n,t=Date.now(),r=Xu){let o=await el(e,n);if(o.length===0)return null;let i=(await Promise.all(o.map(l=>rl(e,l,n,t,r)))).filter(l=>l!==null);if(i.length===0)return null;i.sort((l,u)=>l.requestedAtMs-u.requestedAtMs||l.accountId.localeCompare(u.accountId));let{requestedAtMs:s,accountId:a,...c}=i[0];return c}async function Ps(e,n,t=Date.now(),r){let o;if(r)o=await bo(e,n,r);else{let i=await wo(e,n,t);o=i?await bo(e,n,i.plugin):null}o&&await Ts(e,o,ko,{},t)}async function Co(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await tl(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl})}catch{}}var ol=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function Rs(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},s=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[s||"DEFAULT"]?.handler||ol)(e,i)}function il(e){return typeof e=="function"}function vo({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:s=[],keyBuilder:a,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:v}){for(let[P,O]of Object.entries(e)){let D=n?.[P];if(il(O)){let M=D,w=[...s,P].join("."),R=async(A={})=>{let Y=l?.[w];Ar(w,Y?.riskLevel??"write");let ee;if(c){let N=Y,{result:se,reason:W,onComplete:An,token:Re,id:Ne,expiresAt:ne}=await Li({pluginId:o,endpointPath:w,args:A,mode:c.mode,override:c.overrides?.[w],riskLevel:N?.riskLevel??"write",meta:N,db:u,timeoutMs:d?xr(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(se==="blocked"){let ae;W==="denied"?ae=`Action '${w}' was denied by the user. Await further instructions before proceeding.`:W==="policy"?ae=`Action '${w}' is blocked by the permission policy. Update the corsair config to allow it.`:W==="timeout"?ae=`Action '${w}' timed out waiting for approval.`:Re&&Ne?ae=await Pr({permissionsOptions:d,manual:g,hub:f,permissionId:Ne,permissionToken:Re,plugin:o,endpoint:w,args:A,tenantId:p??"default",expiresAt:ne??new Date(Date.now()+(d?xr(d.timeout):600*1e3)).toISOString(),operationPath:w}):ae=`Action '${w}' requires user approval before it can run.`;let Xt=W==="denied"||W==="policy"||W==="timeout"?W:"pending";throw new Me(ae,Xt)}ee=An}let H=async(N,se,W)=>{try{return await O(se,W)}catch(An){if(An instanceof Error){let Re=await Rs(An,o,w,typeof W=="object"&&W!==null?W:{args:W},i);if(N<(Re.maxRetries||0)){let Ne=N+1;console.log(`Retrying (${Ne} / ${Re.maxRetries})...`);let ne;if(Re.headersRetryAfterMs)ne=Re.headersRetryAfterMs;else switch(Re.retryStrategy){case"exponential_backoff":ne=Math.pow(2,Ne-1)*1e3;break;case"exponential_backoff_jitter":let ae=Math.pow(2,Ne-1)*1e3,Xt=(Math.random()-.5)*1e3;ne=Math.max(0,ae+Xt);break;case"linear_1s":ne=1e3;break;case"linear_2s":ne=2e3;break;case"linear_3s":ne=3e3;break;case"linear_4s":ne=4e3;break;default:ne=1e3;break}return await new Promise(ae=>setTimeout(ae,ne)),await H(Ne,se,W)}}throw An}},L;try{L=a?await a(t,"endpoint"):void 0}catch(N){if(N instanceof fe)throw h&&f&&un({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await Co(u,{tenantId:N.tenantId??p,plugin:N.plugin,connectUrl:N.connectUrl}),N;if(N instanceof E){h&&f&&un({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1});try{await vs({error:N,manual:g,hub:f,plugin:h,tenantId:p,database:u,kek:b,plugins:k,multiTenancy:v})}catch(se){throw se instanceof E&&await Co(u,{tenantId:se.tenantId??p,plugin:se.pluginId,connectUrl:se.connectUrl}),se}}throw N}if(!M?.before&&!M?.after){let N=await H(0,{...t,key:L},A);return await ee?.(),h&&f&&un({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),N}let Pe={...t,key:L},Le=M.before?await M.before(Pe,A):{ctx:Pe,args:A,continue:!0,passToAfter:void 0};if(Le.continue===!1)return;let $o=await H(0,Le.ctx,Le.args);return await M.after?.(Le.ctx,$o,Le.passToAfter),await ee?.(),h&&f&&un({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),$o};r[P]=R}else if(O&&typeof O=="object"){let M={};vo({endpoints:O,hooks:D,ctx:t,tree:M,pluginId:o,errorHandlers:i,currentPath:[...s,P],keyBuilder:a,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:v}),r[P]=M}}}function sl(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function To({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,s]of Object.entries(e)){let a=n?.[i];if(sl(s)){let c=a,l=async u=>{let d=(g,f)=>s.handler(g,f),p=o&&u?.hubVerified!==!0?await o(t,"webhook"):void 0;return!c?.before&&!c?.after?d({...t,key:p},u):(async()=>{let g={...t,key:p},f=c.before?await c.before(g,u):{ctx:g,args:u,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await c.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:s.match,handler:l}}else if(s&&typeof s=="object"){let c={};To({webhooks:s,hooks:a,ctx:t,webhooksTree:c,keyBuilder:o}),r[i]=c}}}function As(e){return e&&typeof e=="object"?e:{}}async function xs(e,n){return q({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=As(t).workflows;return Array.isArray(r)?r:[]}})}async function Is(e,n){return q({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>As(t).workflow})}async function Ss(e,n){await I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function _s(e,n){await I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Es(e,n){return I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function Po(e){return e&&typeof e=="object"?e:{}}async function Ds(e,n){return q({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Po(t).runs;return Array.isArray(r)?r:[]}})}async function Os(e,n){return q({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=Po(t).runs;return Array.isArray(r)?r:[]}})}async function Ms(e,n){return q({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>Po(t).run})}async function Ro(e,n,t){await I({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var Hs=(e,n)=>Ro(e,"approve",n),Bs=(e,n)=>Ro(e,"deny",n),Us=(e,n)=>Ro(e,"cancel",n);function Fs(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?Os(t(),{workflowId:r.workflowId,tenantId:n}):Ds(t(),{tenantId:n}),get:r=>Ms(t(),{runId:r,tenantId:n}),approve:r=>Hs(t(),{runId:r,tenantId:n}),deny:r=>Bs(t(),{runId:r,tenantId:n}),cancel:r=>Us(t(),{runId:r,tenantId:n})}}function Ls(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>Ss(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>xs(t(),{tenantId:n}),get:o=>Is(t(),{workflowId:o,tenantId:n}),run:(o,i)=>Es(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:Fs(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>_s(t(),{workflowId:o,tenantId:n,name:i})}}function al(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await ks({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function cl(e,n,t,r,o){return e?er(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function Ao(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:s,manualConfig:a,hubConfig:c,internalConfig:l}=n,u=r??"default",d=l&&t?()=>sn(l,u):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=al(t,f.id,u,d);if(h?.entities){let H={};for(let[L,Pe]of Object.entries(h.entities)){let Le=t?er(t.db,b,L,h.version,Pe):cl(void 0,b,L,h.version,Pe);H[L]=Le}g[f.id].db=H,p[f.id].db=H}let k=f.options,v=f.authConfig,P;if(t&&o&&k?.authType){let H=v?.[k.authType]?.account??[];P=B({authType:k.authType,integrationName:f.id,tenantId:u,kek:o,database:t,extraAccountFields:H,ensureProvisioned:d}),p[f.id].keys=P}let O={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...P?{keys:P,authType:k?.authType}:{},tenantId:u,...c?{hub:c}:{}},D=f.endpoints??{},M=f.hooks,w={...i,...f.errorHandlers},R={},A=f.options?.permissions;vo({endpoints:D,hooks:M,ctx:O,tree:R,pluginId:f.id,errorHandlers:w,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:A,endpointMeta:f.endpointMeta,database:t,permissionsOptions:s,tenantId:r,manualConfig:a?{...a,oauthConfig:f.oauthConfig,kek:o,tenantId:u}:void 0,hubConfig:c,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy}),Object.keys(R).length>0&&(p[f.id].api=R),O.endpoints=R;let Y=f.webhooks??{},ee=f.webhookHooks;if(Object.keys(Y).length>0){let H={};To({webhooks:Y,hooks:ee,ctx:O,webhooksTree:H,keyBuilder:f.keyBuilder}),p[f.id].webhooks=H,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=ws(c,u),p.workflows=Ls(c,u),p}function Ns(e,n,t){let r={};for(let o of e){let i=o.options,s=o.authConfig;if(i?.authType){let a=s?.[i.authType]?.integration??[],c=F({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:a});r[o.id]=c}}return r}var ul=3e4;function ll(e){let n=e.length;for(;n>0&&e[n-1]==="/";)n--;return e.slice(0,n)}function dl(e){let n=0;for(;n<e.length&&e[n]==="/";)n++;return e.slice(n)}function pl(e,n){return`${ll(e)}/${dl(n)}`}function gl(e,n){let t=n??{},{error:r,message:o,...i}=t;return typeof r!="string"?new C(e,"internal_error","Internal error"):new C(e,r,o,i)}var xo=Symbol("cloudRequestTimeout");async function Ce(e,n,t,r){let o=e.fetch??globalThis.fetch,i=e.timeoutMs??ul,s=new AbortController,a,c=new Promise(p=>{a=setTimeout(()=>{s.abort(),p(xo)},i)}),l;try{let p=o(pl(e.baseUrl,t),{method:n,headers:{authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"},body:r===void 0?void 0:JSON.stringify(r),signal:s.signal}).catch(f=>{if(s.signal.aborted)return xo;throw f}),g=await Promise.race([p,c]);if(g===xo)throw new C(0,"internal_error","Cloud request timed out");l=g}finally{clearTimeout(a)}let u=await l.text(),d;try{d=u?JSON.parse(u):void 0}catch{d=void 0}if(!l.ok)throw gl(l.status,d);if(d===void 0)throw new C(l.status,"internal_error","Invalid or empty response body from runtime");return d}var ve={invoke:"/:tenant/:plugin/call/:op",connectLinks:"/connect/links",tenants:"/tenants",tenant:"/tenants/:id",connectionStatus:"/connection-status",disconnect:"/disconnect"};var fl=new Set(["db","keys","webhooks"]),yl=new Set(["chats","workflows"]),$s=new Set(["then","catch","finally"]);function Ws(e,n,t,r){let o=(...i)=>Ce(e,"POST",ve.invoke.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":op",r.map(encodeURIComponent).join(".")),{args:i[0]}).then(s=>s.data);return new Proxy(o,{get(i,s){if(!(typeof s!="string"||$s.has(s)))return Ws(e,n,t,[...r,s])}})}function Io(e,n){let t=e?new Set(e.map(r=>r.id)):null;return new Proxy({},{get(r,o){if(!(typeof o!="string"||$s.has(o))){if(yl.has(o))throw new Error(`"${o}" is not available in cloud mode (deferred)`);if(t&&!t.has(o))throw new Error(`Unknown plugin "${o}"`);return new Proxy({},{get(i,s){if(s==="api")return Ws(n.transport,n.tenantId,o,[]);if(typeof s=="string"&&fl.has(s))throw new Error(`"${s}" is not available in cloud mode (deferred)`)}})}}})}function js(e){return{connect:{createLink:n=>{if(!n.plugin||!n.tenantId)throw new Error('connect.createLink requires both "plugin" and "tenantId" in cloud mode');return Ce(e,"POST",ve.connectLinks,n)}},tenants:{create:n=>Ce(e,"POST",ve.tenants,n),list:()=>Ce(e,"GET",ve.tenants),get:n=>Ce(e,"GET",ve.tenant.replace(":id",encodeURIComponent(n)))},connectionStatus:{get:n=>Ce(e,"GET",`${ve.connectionStatus}?tenantId=${encodeURIComponent(n.tenantId)}`)},disconnect:n=>Ce(e,"POST",ve.disconnect,n)}}var qs="default";function ge(e){throw new Error(`"${e}" is not available in cloud mode (deferred)`)}var ml=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Ks(e){let n;try{n=new URL(e)}catch{throw new Error(`Cloud base URL is not a valid URL: "${e}"`)}if(n.protocol!=="https:"&&!(n.protocol==="http:"&&ml.has(n.hostname)))throw new Error(`Cloud mode requires an https:// base URL (got "${e}") \u2014 http:// is only allowed for localhost/127.0.0.1, since the project key is sent as a bearer token.`)}function hl(e){let n=e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim();if(!n)throw new Error("Cloud mode (ck_cloud_ key) requires a base URL \u2014 set hub.baseUrl or CORSAIR_CLOUD_URL.");return Ks(n),n}function Zs(e){return!!(e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim())}function bl(e,n){let t=js(e);return{ok:()=>ge("manage.ok"),tenants:t.tenants,plugins:{list:()=>ge("manage.plugins.list"),get:()=>ge("manage.plugins.get")},connectionStatus:{get:r=>{let o=r?.tenantId||void 0;if(!o&&n)throw new Error("connectionStatus.get requires a tenantId in multi-tenant mode");return t.connectionStatus.get({tenantId:o??qs})}},permissions:{get:()=>ge("manage.permissions")},connect:{createLink:t.connect.createLink,resolve:()=>ge("manage.connect.resolve"),oauthCallback:()=>ge("manage.connect.oauthCallback")},disconnect:t.disconnect}}function Gs(e,n){let t=bl(e,n.multiTenancy);if(n.multiTenancy)return{withTenant:s=>{if(!s)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return Io(n.plugins,{transport:e,tenantId:s})},get keys(){return ge("keys")},get permissions(){return ge("permissions")},manage:t};let r=Io(n.plugins,{transport:e,tenantId:qs}),o={manage:t,get keys(){return ge("keys")},get permissions(){return ge("permissions")}};return new Proxy(r,{get(s,a,c){return typeof a=="string"&&a in o?Reflect.get(o,a,c):Reflect.get(s,a,c)}})}function zs(e){return Gs({baseUrl:hl(e.hub),apiKey:e.hub.projectApiKey},{multiTenancy:!!e.multiTenancy,plugins:e.plugins})}function kl(e){let n=e.apiKey?.trim();if(!n)throw new Error("createCorsairCloud: apiKey is required");let t=e.url?.trim();if(!t)throw new Error("createCorsairCloud: url is required");return Ks(t),Gs({baseUrl:t,apiKey:n},{multiTenancy:!0})}var wl="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function Js(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${wl}`),t):n}var Cl=e=>new C(404,"unknown_plugin",`Plugin '${e}' is not registered.`),vl=(e,n)=>new C(404,"unknown_op",`Operation '${n}' not found on plugin '${e}'.`),So=()=>new C(403,"call_disabled","The /call route is disabled. Construct managementHandler with { unsafeAllowUnauthenticated: true } to enable it \u2014 only when your own backend fronts the handler."),Tl=e=>new C(401,"not_connected",`Tenant is not connected for plugin '${e}'. Reconnect and retry.`),Vs=e=>new C(403,"permission_denied",`The call was blocked (${e}).`,{reason:e}),Pl=()=>new C(403,"approval_required","This action needs human approval before it can run. Approval is not resumable over HTTP in this version.",{reason:"pending"}),Rl=(e,n)=>new C(502,"provider_error","The provider returned an error.",{providerStatus:e,body:n});function Al(e,n){if(e instanceof C)return e;if(e instanceof E)return Tl(e.pluginId||n);if(e instanceof fn)return Vs("readonly");if(e instanceof Me)return e.reason==="pending"?Pl():Vs(e.reason);if(e instanceof Error&&e.name==="ApiError"){let t=e;return Rl(typeof t.status=="number"?t.status:502,t.body)}return console.error("[corsair] unhandled error in call operation",e),new C(500,"internal_error","Internal error")}var xl=new WeakMap,Ys=new WeakMap,Il=512;function Qs(e,n){let t=e.get(n);return t||(t=new Map,e.set(n,t)),t}function Sl(e,n,t){if(n.size<=Il)return;let r=Ys.get(e);for(let o of n.keys())if(o!==t&&(r?.get(o)??0)===0){n.delete(o);return}}function _l(e,n,t){if(!n.multiTenancy)return{client:e};let r=typeof t=="string"?t.trim():"";if(!r)throw G("tenant is required for a multi-tenant runtime",{missingFields:["tenant"]});let o=Qs(xl,e),i=o.get(r);if(i)return o.delete(r),o.set(r,i),{client:i,tenantId:r};let s=e.withTenant(r);return o.set(r,s),Sl(e,o,r),{client:s,tenantId:r}}function El(e,n){let t=e;for(let r of n.split(".")){if(t==null||typeof t!="object"||!Object.prototype.hasOwnProperty.call(t,r))return null;t=t[r]}return typeof t=="function"?t:null}function Xs(e,n=[]){let t=[];for(let[r,o]of Object.entries(e??{}))typeof o=="function"?t.push([...n,r].join(".")):o&&typeof o=="object"&&t.push(...Xs(o,[...n,r]));return t}function ea(e){let n={};for(let t of e.plugins)n[t.id]=Xs(t.endpoints??{});return n}async function na(e,n,{plugin:t,op:r,tenant:o,args:i}){if(!n.plugins.some(d=>d.id===t))throw Cl(t);let{client:s,tenantId:a}=_l(e,n,o),c=s[t],l=El(c?.api,r);if(!l)throw vl(t,r);let u=a?Qs(Ys,e):null;u&&a&&u.set(a,(u.get(a)??0)+1);try{return await l(i??{})}catch(d){throw Al(d,t)}finally{if(u&&a){let d=(u.get(a)??1)-1;d<=0?u.delete(a):u.set(a,d)}}}function Tn(e,n){if(e===void 0)return n;if(e===null)throw new C(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function Kt(e){if(e!==void 0)throw new C(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var ta=[{method:"GET",pattern:"/ok",public:!0,handler:async()=>x(200,bt())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>(Kt(n),x(200,await mn(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>(Kt(t),x(201,await Ct(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(Kt(t),x(200,await wt(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>x(200,await yn(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>x(200,await kt(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>x(200,await vt(e,Tn(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(Kt(t),x(200,await Sr(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",public:!0,handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?x(200,await Er(e,t)):x(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=Tn(r,o.tenantId);return x(200,await Pt(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",public:!0,handler:async({corsair:e,internal:n,query:t})=>x(200,await Rt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",public:!0,handler:async({corsair:e,internal:n,body:t})=>x(200,await At(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=Tn(t,n.tenantId)??"default",o=e.database?await wo(e.database,r):null;return x(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=Tn(t,r?.tenantId)??"default";return e.database&&await Ps(e.database,o,void 0,r?.plugin),x(200,{ok:!0})}},{method:"POST",pattern:"/disconnect",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n??{},o=Tn(t,r.tenantId);return x(200,await Tt(e,{...r,tenantId:o}))}},{method:"GET",pattern:"/call",handler:async({internal:e,allowCall:n})=>{if(!n)throw So();return x(200,{plugins:ea(e)})}},{method:"POST",pattern:"/:tenant/:plugin/call/:op",handler:async({corsair:e,internal:n,params:t,body:r,scopedTenant:o,allowCall:i})=>{if(!i)throw So();let s=r??{},a=Tn(o,t.tenant),c=await na(e,n,{plugin:t.plugin,op:t.op,tenant:a,args:s.args});return x(200,{data:c})}}];(()=>{let e=new Set;for(let n of ta){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function Dl(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let s=t[i],a=r[i];if(s.startsWith(":"))o[s.slice(1)]=decodeURIComponent(a);else if(s!==a)return null}return o}function Ol(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function Ml(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await Wt(e,n).catch(o=>{throw o instanceof C?o:new C(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new C(400,"invalid_json","Request body is not valid JSON")}}var Hl="/api/corsair";function $(e,n={}){let t=n.basePath??Hl,r=ze(n.maxBodyBytes),o=Je(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},s=T(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async a=>{try{let c=a.headers.get("content-length");if(c!==null&&Number(c)>r)throw wn(r);let l=new URL(a.url),u=Ol(l.pathname,t),d=a.method.toUpperCase();if(d==="OPTIONS"||u==="/"||u==="")return await Ve(e,a,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return x(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(l.searchParams);for(let g of ta){if(g.method!==d)continue;let f=Dl(g.pattern,u);if(!f)continue;if(!g.public&&n.authenticate&&!await n.authenticate(a))return x(401,{error:"unauthorized",message:"invalid or missing credentials"});let h=await Ml(a,i),b=n.resolveTenant?await n.resolveTenant(a):void 0;return await g.handler({corsair:e,internal:s,req:a,params:f,query:p,body:h,scopedTenant:b,allowCall:(n.unsafeAllowUnauthenticated??!1)||!!n.authenticate})}throw He(`No route for ${d} ${u}`)}catch(c){if(n.onError){let u=await n.onError(c,a);if(u)return u}if(c instanceof C)return le(c);let l=c instanceof Error?c.message:"Internal server error";return x(500,{error:"internal_error",message:l})}}}function Bl(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function Ul(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function Fl(e,n,t){let r=[],o=0,i=e();try{let s=await $t(()=>i.next(),t);for(;s.done!==!0;){let a=Ul(s.value);if(o+=a.byteLength,o>n)throw wn(n);r.push(a),s=await $t(()=>i.next(),t)}return Buffer.concat(r)}catch(s){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw s}}var ra=!1;function Ll(){ra||(ra=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function Nl(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=ze(n.maxBodyBytes),o=Je(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(Ll(),i=JSON.stringify(e.body));else{let a=e[Symbol.asyncIterator];if(typeof a!="function")return;let c=await Fl(a.bind(e),r,o);c.length>0&&(i=c)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw wn(r);return typeof i=="string"?i:i}function z(e){e.resume?.()}async function Ue(e,n={}){let t=Bl(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,s=new Headers;for(let[l,u]of Object.entries(e.headers))if(u!=null&&!$l.has(l.toLowerCase()))if(Array.isArray(u))for(let d of u)s.append(l,d);else s.set(l,u);let a={method:(e.method??"GET").toUpperCase(),headers:s},c=await Nl(e,n);return c!==void 0&&(a.body=c,s.has("content-type")||s.set("content-type","application/json")),new Request(i,a)}async function J(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var $l=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function oa(e,n){let t=$(e,n);return async(r,o,i)=>{try{let s=await t(await Ue(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await J(o,s)}catch(s){if(s instanceof C&&o.headersSent!==!0){await J(o,le(s)),z(r);return}z(r),i(s)}}}function Wl(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function jl(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=Wl(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function ia(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function sa(e,n){let t=$(e,n);return async(r,o)=>{jl(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let s=await t(await Ue(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await J(o.raw,s)}catch(s){if(s instanceof C&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await J(o.raw,le(s)),z(i);return}throw z(i),s}}}function aa(e,n){let t=$(e,n);return r=>t(r.req.raw)}function ca(e,n){let t=$(e,n);return{GET:t,POST:t,OPTIONS:t}}function ua(e,n){let t=$(e,n);return async(r,o)=>{try{let i=await t(await Ue(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await J(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),z(r);return}if(i instanceof C){await J(o,le(i)),z(r);return}console.error("[corsair] management handler failed:",i),await J(o,x(500,{error:"internal_error"})),z(r)}}}function Zt(e,n){let t=$(e,n);return r=>t(r.request)}function la(e,n){let t=Zt(e,n);return{GET:t,POST:t,OPTIONS:t}}function da(e,n){let t=Zt(e,n);return{loader:t,action:t}}function pa(e,n){let t=Zt(e,n);return{GET:t,POST:t,OPTIONS:t}}function ga(e,n){let t=Zt(e,n);return{GET:t,POST:t,OPTIONS:t}}function fa(e,n){let t=$(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await Ue(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await J(r.node.res,i)}catch(i){if(i instanceof C&&r.node.res.headersSent!==!0){await J(r.node.res,le(i)),z(o);return}throw z(o),i}}}function ya(e,n){return $(e,n)}function ma(e){let n={[Kn]:e};return{ok:bt,tenants:{list:()=>mn(e),create:t=>Ct(e,t),get:t=>wt(e,t)},plugins:{list:()=>yn(e),get:t=>kt(e,t)},connectionStatus:{get:t=>vt(e,t?.tenantId)},permissions:{get:t=>qi(e,t)},connect:{createLink:t=>Pt(n,e,t),resolve:t=>Rt(n,e,t),oauthCallback:t=>At(n,e,t)},disconnect:t=>Tt(e,t)}}async function ha(e,n,t,r,o="pending"){if(!e)return null;try{let i=Xe(),s=new Date;return await e.db.insertInto("corsair_events").values({id:i,created_at:s,updated_at:s,account_id:n,event_type:t,payload:r,status:o}).execute(),i}catch(i){return console.warn("Failed to log event:",i),null}}async function ql(e,n,t,r="pending"){try{let o=await e.$getAccountId();return ha(e.database,o,n,t,r)}catch(o){return console.warn("Failed to log event:",o),null}}import*as ka from"https";import*as Gt from"querystring";var Kl=["expires_in","refresh_token_expires_in"];function ba(e){let n={...e};for(let t of Kl){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function Zl(e){try{return ba(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=Gt.parse(e);return!n.access_token&&!n.error?null:ba({...n})}function lt(e,n,t,r,o){let i=new URL(r.tokenUrl),s=r.tokenAuthMethod==="basic";return new Promise((a,c)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};s||(l.client_id=n,l.client_secret=t);let u=Gt.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(u).toString()};s&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=ka.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){c(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=Zl(f);h?a(h):c(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>c(new Error(`Request failed: ${g.message}`))),p.write(u),p.end()})}async function wa(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[s,a,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(Cn({accessToken:s,expiresAt:a,forceRefresh:n?.forceRefresh}))return{accessToken:s,expiresAt:Number(a),refreshed:!1};if(!c)throw new E(o,"oauth_2");let l=await I({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:c},parseResponse:en}),u=await vn(t,l,a);return{accessToken:l.access_token,expiresAt:u,refreshed:!0}}async function Ca(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:s="form",extraParams:a}=e,c={grant_type:"refresh_token",refresh_token:t,...a},l={Accept:"application/json"};i==="basic"?l.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?l.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(c.client_id=o),c.client_secret=r),s==="json"?l["Content-Type"]="application/json":l["Content-Type"]="application/x-www-form-urlencoded";let u=await fetch(n,{method:"POST",headers:l,body:s==="json"?JSON.stringify(c):new URLSearchParams(c)});if(!u.ok)throw new Error(`OAuth token refresh failed (${u.status}): ${await u.text()}`);let d=JSON.parse(await u.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function va(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new E(n.plugin,"oauth_2");let l={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},u=g=>qn(e.keys,r,async()=>(await wa(l,{forceRefresh:g})).accessToken);e._refreshAuth=()=>u(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return Cn({accessToken:d,expiresAt:p})?d:u(!1)}let o=t.client_secret,i=t.client_id,s=l=>qn(e.keys,r,async()=>{let[u,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!l&&Cn({accessToken:u,expiresAt:d}))return u;if(!p)throw new E(n.plugin,"oauth_2");let g=await Ca({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await vn(e.keys,g,d),g.access_token});e._refreshAuth=()=>s(!0);let[a,c]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return Cn({accessToken:a,expiresAt:c})?a:s(!1)}var Ta="  ";function oe(e){let n=e;return n._def??n.def??{}}function ie(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function re(e){return e.innerType??e.schema??e.out??e.in}function Ra(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return re(e)}}function Aa(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Jt(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Pn(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function xa(e,n){return e.description??n.description}function Gl(e){let n=e;for(;n;){let t=oe(n),r=xa(n,t);if(r)return r;let o=ie(t);if(Mo(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=Ra(t,o);continue}break}}function Mo(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function V(e){let n=oe(e),t=ie(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Pn(n)[0]??"unknown");case"ZodEnum":return Pn(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=re(n);return r?V(r):"unknown"}case"ZodNullable":{let r=re(n);return`${r?V(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=re(n);return r?V(r):"unknown"}case"ZodArray":{let r=Aa(n);if(!r)return"unknown[]";let o=oe(r),i=ie(o)==="ZodUnion",s=V(r);return`${i?`(${s})`:s}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Jt(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([s,a])=>{let c=ie(oe(a));return`${c==="ZodOptional"||c==="ZodNullable"?s+"?":s}: ${V(a)}`}).join(", ")} }`}case"ZodUnion":return Pn(n).map(r=>V(r)).join(" | ");case"ZodIntersection":return`${V(n.left)} & ${V(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=Ra(n,t);return r?V(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function Te(e){let n=oe(e),t=ie(n),r=xa(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??Pn(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=Pn(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=re(n),i=o?Te(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=re(n),i=o?Te(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=re(n);return o?{...Te(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=Aa(n);return{kind:"array",optional:!1,description:r,items:o?Te(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=Jt(e,n),i={};for(let[s,a]of Object.entries(o))i[s]=Te(a);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=Pn(n);for(let i of o){let s=oe(i);if(ie(s)==="ZodObject")return{...Te(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=re(n);return o?{...Te(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function DC(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),s=e.find(u=>u.id===o);if(!s)return null;let a=i;a.startsWith("api.")&&(a=a.slice(4));let c=Fe(s.endpointMeta,a),l=Fe(s.endpointSchemas,a);return!c&&!l?null:{input:l?.input?Te(l.input):null,output:l?.output?Te(l.output):null,description:c?.description}}var Ho=["equals","contains","startsWith","endsWith","in"],zl=["equals","gt","gte","lt","lte","in"],Jl=["equals"],Vl=["equals","before","after","between"];function Ia(e){let n=oe(e);switch(ie(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=re(n);return r?Ia(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function Bo(e){let n=oe(e),t=ie(n);if(Mo(t)){let i=re(n);return i?Bo(i):{}}if(t!=="ZodObject")return{};let r=Jt(e,n),o={};for(let[i,s]of Object.entries(r)){let a=Ia(s);a==="string"?o[i]={type:"string",operators:Ho}:a==="number"?o[i]={type:"number",operators:zl}:a==="boolean"?o[i]={type:"boolean",operators:Jl}:a==="date"&&(o[i]={type:"date",operators:Vl})}return o}function Sa(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function Eo(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&Eo(o,i,t)}}function Do(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Oo(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];Do(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&Oo(o,i,t)}}function Uo(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([a])=>a.toLowerCase()===t);if(!o)return null;let[i,s]=o;if(r.length===0)return Do(s)?[i]:null;if(s!==null&&typeof s=="object"&&!Do(s)){let a=Uo(s,r);if(a!==null)return[i,...a]}return null}function _a(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let s="    ".repeat(i+2);t.push(`${s}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let s="    ".repeat(i+2);t.push(`${s}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var Yl=new Set(zn);function Qe(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(a=>a.id===r);if(!i)return Yl.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:Qe(e);if(t==="webhooks"){if(!i.webhooks)return[];let a=[];return Oo(i.webhooks,[],a),a.map(c=>`${i.id}.webhooks.${c}`)}if(t==="db"){let a=i.schema?.entities;return a?Object.keys(a).map(c=>`${i.id}.db.${c}.search`):[]}if(!i.endpoints)return[];let s=[];return Eo(i.endpoints,[],s),s.map(a=>`${i.id}.api.${a}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let s=[];Oo(i.webhooks,[],s),o[i.id]=s.map(a=>`${i.id}.webhooks.${a}`)}else if(t==="db")for(let i of e){let s=i.schema?.entities;s&&(o[i.id]=Object.keys(s).map(a=>`${i.id}.db.${a}.search`))}else for(let i of e){if(!i.endpoints)continue;let s=[];Eo(i.endpoints,[],s),o[i.id]=s.map(a=>`${i.id}.api.${a}`)}return o}function Fe(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function Ql(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),s=i.startsWith(".")?i.slice(1):i;return s.startsWith("api.")&&(s=s.slice(4)),{shortPath:s,lookupKey:s}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function _o(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function OC(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),s=e.find(a=>a.id===o);if(s){if(i.startsWith("db.")){let u=i.slice(3),d=u.lastIndexOf(".");if(d!==-1){let p=u.slice(0,d),g=u.slice(d+1),f=s.schema?.entities;if(g==="search"&&f){let h=Sa(f,p);if(h){let[b,k]=h,v=Bo(k),P=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${Ho.join(", ")}]`];for(let[O,D]of Object.entries(v))P.push(`  ${O}?: ${D.type}  [${D.operators.join(", ")}]`);return P.push("}"),P.join(`
+`)}}}return _o(Qe(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let u=i.slice(9);if(s.webhooks){let d=Uo(s.webhooks,u.split("."));if(d!==null){let p=d.join("."),g=Fe(s.webhookSchemas,p.toLowerCase()),f=g?.response?V(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${zt(Rn(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${_a(o,d)}`),h.join(`
+
+`)}}return _o(Qe(e,{type:"webhooks"}),"Path not found. Available webhooks")}let a=i;a.startsWith("api.")&&(a=a.slice(4));let c=Fe(s.endpointMeta,a),l=Fe(s.endpointSchemas,a);if(c||l){let u=[],d=[c?.riskLevel?`[${c.riskLevel}]`:"",c?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[c?.description,d].filter(Boolean).join("  ");return p&&u.push(p),l?.input&&u.push(`input ${zt(Rn(l.input))}`),l?.output&&u.push(`output ${zt(Rn(l.output))}`),u.join(`
+
+`)}}}return _o(Qe(e),"Path not found. Available operations")}function Pa(e){let n=e;for(;;){let t=oe(n),r=ie(t);if(Mo(r)){let o=re(t);if(!o)return n;n=o;continue}return n}}function Rn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=Pa(e),t=oe(n);if(ie(t)==="ZodObject"){let o=Jt(n,t),i=[];for(let[s,a]of Object.entries(o)){let c=oe(a),l=ie(c),u=l==="ZodOptional"||l==="ZodNullable",d=Pa(a),p=Gl(a);i.push({key:s,optional:u,type:V(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:V(n)}}function zt(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=Ta.repeat(n+1),r=Ta.repeat(n);return`{
+${e.fields.map(i=>{let s=i.optional?`${i.key}?`:i.key,a=i.description?`  // ${i.description}`:"";return`${t}${s}: ${i.type}${a}`}).join(`
+`)}
+${r}}`}return"unknown"}function Xl(e,n){let t=Qe(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(u=>u.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let u of t){let{shortPath:d,lookupKey:p}=Ql(u,n),g=Fe(r.endpointMeta,p),f=Fe(r.endpointSchemas,p);!g&&!f||o.push({path:u,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Rn(f?.input),output:Rn(f?.output)})}o.sort((u,d)=>u.path.localeCompare(d.path));let i=[],s=Qe(e,{plugin:n,type:"webhooks"});if(Array.isArray(s)&&r.webhooks)for(let u of s){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=Uo(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=Fe(r.webhookSchemas,b.toLowerCase()),v=k?.response?V(k.response):void 0;i.push({path:u,description:k?.description,payload:Rn(k?.payload),responseType:v,usageExample:_a(n,h)})}i.sort((u,d)=>u.path.localeCompare(d.path));let a=[],c=Qe(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(c)&&l)for(let u of c){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let v=Sa(l,b);if(!v)continue;let[P,O]=v,D=Bo(O),M=Object.entries(D).map(([w,R])=>({field:w,type:R.type,operators:R.operators}));a.push({path:u,entityName:P,filters:[{field:"entity_id",type:"string",operators:Ho},...M]})}return a.sort((u,d)=>u.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:a}}}import{randomUUID as Ea}from"crypto";async function ed(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Ea(),o=Ea(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as nd}from"crypto";var Vt="https://graph.microsoft.com/v1.0",Fo=2e4,td=60;async function rd(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${Vt}/subscriptions`,{headers:r,signal:AbortSignal.timeout(Fo)});if(c.ok){let{value:l}=await c.json(),u=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(u.map(d=>fetch(`${Vt}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(Fo)}).catch(()=>{})))}}catch{}let o=nd(),i=new Date(Date.now()+td*6e4).toISOString(),s=await fetch(`${Vt}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(Fo),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!s.ok)throw new Error(`MS Graph subscribe failed (${s.status}): ${await s.text()}`);let a=await s.json();return a.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:a.id},webhookSecret:o}):null}function Da(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function od(e,n){let t=Da(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function id(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function Oa(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function Ma(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function Zn(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function sd(e){return Zn(e.body)}function Ha(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Yt(Array.isArray(r)?r:[r])}function Ba(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let l=Yt(Array.isArray(c)?c:[c]);if(l)return decodeURIComponent(l)}let r=Ha({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let l=n[c],u=Array.isArray(l)?l[0]:l;if(!(!u||typeof u!="string"))try{let p=(u.startsWith("http")?new URL(u):new URL(`https://example.invalid${u.startsWith("/")?u:`/${u}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,s=Zn(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Yt([s?.validationToken])??null}function ad(e){if(Ba(e))return!0;let n=Zn(e.body??e.payload);return Oa(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Yt(e){for(let n of e){let t=Ma(n);if(t)return t}}function cd(e){let t=Zn(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var Kn=Symbol.for("corsair:internal");function Na(e){if(e.hub?.projectApiKey?.startsWith("ck_cloud_")&&Zs(e.hub))return zs(e);let n=e.database?Wo(e.database):void 0,t=e.kek??"",r=n&&t?Ns(e.plugins,n,t):jt(!!n,!!t),o=Js(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?nt(e.hub):void 0},s=Fi(n),a=ma(i);if(e.multiTenancy){let u=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=Ao(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[Kn]:i})},keys:r,permissions:s,manage:a},{[Kn]:i});return Ua(u,i.hub),La(u,i.hub),u}let c=Ao(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},c,{keys:r,permissions:s,manage:a,[Kn]:i});return Ua(l,i.hub),La(l,i.hub),l}function Ua(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-SWONOQNY.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function ud(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var Fa=globalThis.__corsairTunnels??=new Set,ld=1e3,dd=3e4;function pd(e){let n=e.schedule??((s,a)=>void setTimeout(s,a).unref?.()),t=e.minDelayMs??ld,r=e.maxDelayMs??dd,o=t,i=()=>{let s=!1,a=()=>{s||(s=!0,n(i,o),o=Math.min(o*2,r))};e.start(a).then(()=>{o=t}).catch(a)};i()}function La(e,n){if(!ud(n))return;let t=n.projectApiKey;if(Fa.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}Fa.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??nr;pd({start:s=>import("./hub/tunnel/run-tunnel.js").then(a=>a.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:s})).then(({url:a})=>{console.log(`[corsair] tunnel active: ${a}${tr}`)}).catch(a=>{throw console.warn(`[corsair] tunnel down: ${a instanceof Error?a.message:String(a)}. Retrying \u2014 run \`corsair setup\` if it doesn't recover.`),a})})}var gd={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Lo=gd;async function dt(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},s=n?.caller??"script",a=qo(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=Rd(e,a.plugins,n),l={...a,database:a.database},u=l.database.db;await Id(u,i);let d=await Sd(u,l,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Dd(e,c,n.credentials,l,o,i);let p=await Md(d,c,o,s);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=Na({plugins:a.plugins,database:u,kek:a.kek,multiTenancy:!0}).withTenant(c.tenantId);await Hd(g,a.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function No(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...j[n][t],...r])}function Pd(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(a=>a.id===t);if(!o)continue;let i=S(o);if(!i)continue;let s=No(o,i,"account");for(let a of Object.keys(r))if(s.has(a))return!0}return!1}function Rd(e,n,t){let r=Ko(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Pd(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function Wa(e,n){return xe(e)?n===0?!0:Object.values(e).every(t=>Wa(t,n-1)):!1}function Ad(e){return Wa(e,4)}var xd=Go;function Qt(e){if(e instanceof kd){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Td?Qt(r):"unknown";return n}return e instanceof hd?`${Qt(e.unwrap())} | null`:e instanceof wd?`${Qt(e.unwrap())} | undefined`:e instanceof md?e.options.join(" | "):e instanceof vd?"string":e instanceof bd?"number":e instanceof fd?"boolean":e instanceof yd?"date":e instanceof Cd?"jsonb":"unknown"}async function Id(e,n){let t=await e.introspection.getTables(),r=new Set(t.map(o=>o.name));for(let[o,i]of Object.entries(xd))r.has(o)||n(`[corsair:setup] Table "${o}" does not exist. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(Qt(i),null,2)}`)}async function Sd(e,n,t,r,o){let i=new Date,s=new Map;for(let a of n.plugins){let c=a.id,l=S(a),u=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!u){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),u=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=l?a.authConfig?.[l]?.integration??[]:[],p=l?a.authConfig?.[l]?.account??[]:[],g=l&&u?F({authType:l,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(u&&!u.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!u||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",u.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:u.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&B({authType:l,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}s.set(c,{pluginId:c,authType:l,integration:g,account:f,integrationFields:[...j[l].integration,...d],accountFields:r?[...j[l].account,...p]:[]})}return s}function _d(e){if(!xe(e))return;let n=e.keys;return xe(n)?n:void 0}function Ed(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Dd(e,n,t,r,o,i){let s=_d(e),a=n.provisionAccounts?Ed(e,n.tenantId):void 0;for(let[c,l]of Object.entries(t)){let u=r.plugins.find(k=>k.id===c);if(!u){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=S(u);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=No(u,d,"integration"),g=No(u,d,"account"),f=s?.[c],h=a?.[c],b=xe(h)?h.keys:void 0;for(let[k,v]of Object.entries(l))if(v){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let P=Q(f,`set_${k}`);if(!P){i(`[corsair:setup] Cannot set integration field '${k}' for '${c}'.`);continue}await P(v),o(`[corsair:setup] Set ${c} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${k}' on a multi-tenant instance`);let P=Q(b,`set_${k}`);if(!P){i(`[corsair:setup] Cannot set account field '${k}' for '${c}'.`);continue}await P(v),o(`[corsair:setup] Set ${c} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${c}'.`)}}}var $a=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function Od(e,n,t,r,o,i,s,a,c){let l=[],u=[];for(let p of o){if($a.has(p))continue;let g=Q(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if($a.has(p))continue;let g=Q(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}let d=l.length===0&&u.length===0;if(d)a(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")a(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...u];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");a(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of u){let h=s.provisionAccounts?s.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(s.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}a(g.join(`
+`))}}return d}async function Md(e,n,t,r){let o=new Set;for(let i of e.values())await Od(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function Hd(e,n,t,r,o){if(!Ad(Lo)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=Lo,s=new Set(n.map(a=>a.id));for(let[a,c]of Object.entries(i)){if(!s.has(a))continue;if(!t.has(a)){r(`[corsair:setup] Skipping backfill for '${a}' \u2014 auth not configured.`);continue}let l=xe(e)?e[a]:void 0,u=xe(l)?l.api:void 0;if(u)for(let[d,p]of Object.entries(c))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${a} \u203A ${d}.${g}...`);try{let h=xe(u)?u[d]:void 0;await Q(h,g)?.(f)}catch(h){o(`[corsair:setup] ${a} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{zo as a,Ie as b,fe as c,Jn as d,Vn as e,Yn as f,en as g,Jo as h,Qn as i,ur as j,xn as k,ti as l,ri as m,Se as n,$e as o,ye as p,tn as q,rn as r,_e as s,dr as t,ii as u,_n as v,me as w,En as x,pr as y,nt as z,U as A,tt as B,on as C,he as D,be as E,X as F,gr as G,Dn as H,Ee as I,ue as J,On as K,F as L,B as M,pi as N,gi as O,dt as P,Dd as Q,Oe as R,yr as S,cn as T,ln as U,hr as V,ut as W,Ti as X,Ke as Y,Z,br as _,Bn as $,xi as aa,Ac as ba,pt as ca,Jg as da,_i as ea,Ei as fa,Di as ga,Oi as ha,gt as ia,kr as ja,yt as ka,mt as la,Me as ma,fn as na,Rr as oa,Ui as pa,Ar as qa,Or as ra,Mr as sa,xt as ta,Hr as ua,hn as va,bn as wa,It as xa,St as ya,Un as za,Br as Aa,Ur as Ba,_t as Ca,Fn as Da,Et as Ea,Dt as Fa,Be as Ga,kn as Ha,Vi as Ia,Wr as Ja,jr as Ka,Ge as La,$n as Ma,Wn as Na,Lt as Oa,Zr as Pa,jn as Qa,Ou as Ra,Fu as Sa,$u as Ta,ss as Ua,as as Va,cs as Wa,us as Xa,ze as Ya,Je as Za,Vr as _a,Yr as $a,Qr as ab,Xr as bb,eo as cb,Ve as db,E as eb,no as fb,ys as gb,ms as hb,to as ib,ro as jb,oo as kb,io as lb,so as mb,ao as nb,co as ob,uo as pb,lo as qb,po as rb,go as sb,fo as tb,yo as ub,mo as vb,ho as wb,Ye as xb,kl as yb,$ as zb,oa as Ab,ia as Bb,sa as Cb,aa as Db,ca as Eb,ua as Fb,la as Gb,da as Hb,pa as Ib,ga as Jb,fa as Kb,ya as Lb,ha as Mb,ql as Nb,lt as Ob,va as Pb,DC as Qb,Qe as Rb,OC as Sb,zt as Tb,Xl as Ub,ed as Vb,Vt as Wb,rd as Xb,Da as Yb,od as Zb,id as _b,Oa as $b,Ma as ac,Zn as bc,sd as cc,Ha as dc,Ba as ec,ad as fc,Yt as gc,cd as hc,Kn as ic,Na as jc,ud as kc,pd as lc};

package/dist/{connect-KHX6PKUD.js → connect-JKEAFJMP.js}

@@ -1 +1 @@
-import{ga as a,ha as b,ia as c}from"./chunk-XQZJJTZ7.js";import"./chunk-6IURNA4L.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};
+import{ga as a,ha as b,ia as c}from"./chunk-IKQU6YIZ.js";import"./chunk-6IURNA4L.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/core.d.ts

@@ -1,8 +1,8 @@
-export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair, s as shouldStartTunnel, b as superviseTunnel } from './index-PD73vqiL.js';
+export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair, s as shouldStartTunnel, b as superviseTunnel } from './index-CjQxK4YA.js';
 import { CorsairDatabase } from './db.js';
-import { A as AuthTypes, f as AccountKeyManagerFor, I as IntegrationKeyManagerFor, H as HubConfig, g as CorsairPluginSubscribeResult } from './index-CkxZbZgd.js';
-export { h as AccountFieldNames, n as AgentMessageRole, o as AgentReply, v as AllProviders, l as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, i as BaseKeyManager, w as BaseProviders, a2 as BeforeHookResult, D as BindEndpoints, ap as BindWebhooks, an as Bivariant, E as BoundEndpointFn, F as BoundEndpointTree, aq as BoundWebhook, ar as BoundWebhookTree, p as ChatHandle, q as ChatMessage, r as ChatSummary, s as CorsairChatsNamespace, u as CorsairClient, G as CorsairContext, J as CorsairEndpoint, M as CorsairErrorHandler, c as CorsairIntegration, a3 as CorsairKeyBuilder, a4 as CorsairKeyBuilderBase, as as CorsairOAuthWebhookTenantLinkResolver, X as CorsairPermissionsNamespace, C as CorsairPlugin, a5 as CorsairPluginContext, a6 as CorsairPluginSubscribe, aj as CorsairRunsNamespace, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, at as CorsairWebhook, au as CorsairWebhookHandler, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, aC as CorsairWorkflowsNamespace, t as CreateChatResult, a7 as EndpointHooks, a8 as EndpointMetaEntry, K as EndpointPathsOf, a9 as EndpointRiskLevel, L as EndpointTree, Y as EnforcePermissionOptions, Z as EnforcePermissionResult, N as ErrorContext, Q as ErrorHandler, R as ErrorHandlerAndMatchFunction, S as ErrorMatcher, j as IntegrationFieldNames, aa as KeyBuilderContext, k as OAuth2IntegrationCredentials, O as OAuthConfig, ab as PermissionMode, ac as PermissionPolicy, x as PickAuth, P as PluginAuthConfig, ad as PluginEndpointMeta, ae as PluginPermissionsConfig, z as ProviderDisplayNames, ax as RawWebhookRequest, a0 as ReadonlyForbiddenError, af as RequiredPluginEndpointMeta, ag as RequiredPluginEndpointSchemas, ah as RequiredPluginWebhookSchemas, U as RetryStrategies, V as RetryStrategy, T as TokenResponse, aD as TriggerRunResult, ao as UnionToIntersection, ai as WebhookHooks, ay as WebhookPathsOf, az as WebhookRequest, aA as WebhookResponse, W as WebhookTenantMatch, aB as WebhookTree, ak as WorkflowRun, al as WorkflowRunStatus, am as WorkflowRunStep, aE as WorkflowStatus, aF as WorkflowSummary, _ as assertReadonlyAllowed, m as exchangeCodeForTokens, y as formatProviderDisplayName, $ as isReadonlyScopeActive, a1 as runReadonly } from './index-CkxZbZgd.js';
-export { A as AuthMissingError, C as CorsairKekMissingError, D as DocSchemaFieldRow, b as DocSchemaShape, c as DocsApiEndpoint, d as DocsDbEntity, e as DocsDbFilterField, f as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, h as PermissionRequiredError, P as PluginDocsIntrospection, l as PluginWebhookMatchers, R as ReconnectRequiredError, a as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, n as asRecord, j as collectPluginWebhookMatchers, o as decodePubSubData, p as extractMicrosoftGraphValidationToken, q as firstString, g as formatDocSchemaShape, s as getHeader, i as introspectPluginForDocs, t as isMicrosoftGraphValidationHandshake, m as matchWebhookPlugin, k as matchWebhookPluginAndTenant, u as readBodyRecord, v as readQueryParam, r as resolveConnectLink, w as toExternalId } from './tenant-match-utils-Cv9F7soB.js';
+import { A as AuthTypes, f as AccountKeyManagerFor, I as IntegrationKeyManagerFor, H as HubConfig, g as CorsairPluginSubscribeResult } from './index-Ba71z8av.js';
+export { h as AccountFieldNames, n as AgentMessageRole, o as AgentReply, v as AllProviders, l as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, i as BaseKeyManager, w as BaseProviders, a2 as BeforeHookResult, D as BindEndpoints, ap as BindWebhooks, an as Bivariant, E as BoundEndpointFn, F as BoundEndpointTree, aq as BoundWebhook, ar as BoundWebhookTree, p as ChatHandle, q as ChatMessage, r as ChatSummary, s as CorsairChatsNamespace, u as CorsairClient, G as CorsairContext, J as CorsairEndpoint, M as CorsairErrorHandler, c as CorsairIntegration, a3 as CorsairKeyBuilder, a4 as CorsairKeyBuilderBase, as as CorsairOAuthWebhookTenantLinkResolver, X as CorsairPermissionsNamespace, C as CorsairPlugin, a5 as CorsairPluginContext, a6 as CorsairPluginSubscribe, aj as CorsairRunsNamespace, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, at as CorsairWebhook, au as CorsairWebhookHandler, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, aC as CorsairWorkflowsNamespace, t as CreateChatResult, a7 as EndpointHooks, a8 as EndpointMetaEntry, K as EndpointPathsOf, a9 as EndpointRiskLevel, L as EndpointTree, Y as EnforcePermissionOptions, Z as EnforcePermissionResult, N as ErrorContext, Q as ErrorHandler, R as ErrorHandlerAndMatchFunction, S as ErrorMatcher, j as IntegrationFieldNames, aa as KeyBuilderContext, k as OAuth2IntegrationCredentials, O as OAuthConfig, ab as PermissionMode, ac as PermissionPolicy, x as PickAuth, P as PluginAuthConfig, ad as PluginEndpointMeta, ae as PluginPermissionsConfig, z as ProviderDisplayNames, ax as RawWebhookRequest, a0 as ReadonlyForbiddenError, af as RequiredPluginEndpointMeta, ag as RequiredPluginEndpointSchemas, ah as RequiredPluginWebhookSchemas, U as RetryStrategies, V as RetryStrategy, T as TokenResponse, aD as TriggerRunResult, ao as UnionToIntersection, ai as WebhookHooks, ay as WebhookPathsOf, az as WebhookRequest, aA as WebhookResponse, W as WebhookTenantMatch, aB as WebhookTree, ak as WorkflowRun, al as WorkflowRunStatus, am as WorkflowRunStep, aE as WorkflowStatus, aF as WorkflowSummary, _ as assertReadonlyAllowed, m as exchangeCodeForTokens, y as formatProviderDisplayName, $ as isReadonlyScopeActive, a1 as runReadonly } from './index-Ba71z8av.js';
+export { A as AuthMissingError, a as CorsairCloudInstance, b as CorsairCloudRegistry, C as CorsairKekMissingError, c as CreateCorsairCloudConfig, D as DocSchemaFieldRow, f as DocSchemaShape, g as DocsApiEndpoint, h as DocsDbEntity, i as DocsDbFilterField, j as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, m as PermissionRequiredError, P as PluginDocsIntrospection, q as PluginWebhookMatchers, R as ReconnectRequiredError, e as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, s as asRecord, n as collectPluginWebhookMatchers, d as createCorsairCloud, t as decodePubSubData, u as extractMicrosoftGraphValidationToken, v as firstString, k as formatDocSchemaShape, w as getHeader, l as introspectPluginForDocs, x as isMicrosoftGraphValidationHandshake, o as matchWebhookPlugin, p as matchWebhookPluginAndTenant, y as readBodyRecord, z as readQueryParam, r as resolveConnectLink, B as toExternalId } from './tenant-match-utils-B9Xc7dNa.js';
 import 'kysely';
 import 'zod';
 import 'pg';

package/dist/core.js

@@ -1 +1 @@
-import{$b as L,D as e,E as f,F as g,G as h,H as i,I as j,J as k,K as l,L as m,Lb as y,M as n,Mb as z,N as o,Nb as A,O as p,Ob as B,Sb as C,Tb as D,Ub as E,Vb as F,Wb as G,Xb as H,Yb as I,Zb as J,_b as K,a,ac as M,b,bc as N,c,cc as O,dc as P,eb as w,ec as Q,fc as R,gc as S,hc as T,ic as U,ja as q,jc as V,kc as W,ma as r,na as s,oa as t,pa as u,qa as v,xb as x}from"./chunk-XQZJJTZ7.js";import"./chunk-6IURNA4L.js";import{h as d}from"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{w as AuthMissingError,d as BASE_AUTH_FIELDS,T as CORSAIR_INTERNAL,x as CorsairKekMissingError,F as MS_GRAPH_API_BASE,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,M as asRecord,v as assertReadonlyAllowed,J as collectPluginWebhookMatchers,n as createAccountKeyManager,U as createCorsair,m as createIntegrationKeyManager,S as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,A as exchangeCodeForTokens,P as extractMicrosoftGraphValidationToken,R as firstString,C as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,K as getHeader,B as getOAuthAccessToken,E as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,D as introspectPluginForDocs,Q as isMicrosoftGraphValidationHandshake,u as isReadonlyScopeActive,y as logEvent,z as logEventFromContext,H as matchWebhookPlugin,I as matchWebhookPluginAndTenant,G as msGraphSubscribe,l as reEncryptConfig,N as readBodyRecord,O as readQueryParam,q as resolveConnectLink,t as runReadonly,V as shouldStartTunnel,W as superviseTunnel,L as toExternalId};
+import{$b as L,D as e,E as f,F as g,G as h,H as i,I as j,J as k,K as l,L as m,M as n,Mb as z,N as o,Nb as A,O as p,Ob as B,Pb as C,Tb as D,Ub as E,Vb as F,Wb as G,Xb as H,Yb as I,Zb as J,_b as K,a,ac as M,b,bc as N,c,cc as O,dc as P,eb as w,ec as Q,fc as R,gc as S,hc as T,ic as U,ja as q,jc as V,kc as W,lc as X,ma as r,na as s,oa as t,pa as u,qa as v,xb as x,yb as y}from"./chunk-IKQU6YIZ.js";import"./chunk-6IURNA4L.js";import{h as d}from"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{w as AuthMissingError,d as BASE_AUTH_FIELDS,U as CORSAIR_INTERNAL,x as CorsairKekMissingError,G as MS_GRAPH_API_BASE,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,N as asRecord,v as assertReadonlyAllowed,K as collectPluginWebhookMatchers,n as createAccountKeyManager,V as createCorsair,y as createCorsairCloud,m as createIntegrationKeyManager,T as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,B as exchangeCodeForTokens,Q as extractMicrosoftGraphValidationToken,S as firstString,D as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,L as getHeader,C as getOAuthAccessToken,F as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,E as introspectPluginForDocs,R as isMicrosoftGraphValidationHandshake,u as isReadonlyScopeActive,z as logEvent,A as logEventFromContext,I as matchWebhookPlugin,J as matchWebhookPluginAndTenant,H as msGraphSubscribe,l as reEncryptConfig,O as readBodyRecord,P as readQueryParam,q as resolveConnectLink,t as runReadonly,W as shouldStartTunnel,X as superviseTunnel,M as toExternalId};

package/dist/hub.d.ts

@@ -1,8 +1,8 @@
-import { aV as HubOAuthMode, A as AuthTypes, aW as HubConnectSessionResult, aX as HubPermissionSessionResult, H as HubConfig, aY as HubConfigInput, aZ as HubConnectSessionInput, a_ as HubListProjectConnectionsInput, f as AccountKeyManagerFor, a$ as HubPermissionSessionInput } from './index-CkxZbZgd.js';
-export { b0 as DEFAULT_HUB_API_URL, b1 as HubEnvironmentSlug, y as formatProviderDisplayName } from './index-CkxZbZgd.js';
-import { k as TunnelType, R as RunResultPayload, P as ProbeResultPayload, g as ProcessCorsairRequest, m as WebhookTenantLink } from './index-DUHdJscv.js';
-export { n as BROWSER_DELIVERY_TTL_MS, o as BrowserDeliveryMode, B as BrowserDeliveryPayload, S as SIGNED_TUNNEL_REPLAY_WINDOW_MS, j as TunnelEnvelope } from './index-DUHdJscv.js';
-export { b as buildBrowserDeliveryRedirectUrl, s as signBrowserDeliveryToken, v as verifyBrowserDeliveryToken } from './browser-delivery-lY7x4meY.js';
+import { aV as HubOAuthMode, A as AuthTypes, aW as HubConnectSessionResult, aX as HubPermissionSessionResult, H as HubConfig, aY as HubConfigInput, aZ as HubConnectSessionInput, a_ as HubListProjectConnectionsInput, f as AccountKeyManagerFor, a$ as HubPermissionSessionInput } from './index-Ba71z8av.js';
+export { b0 as DEFAULT_HUB_API_URL, b1 as HubEnvironmentSlug, y as formatProviderDisplayName } from './index-Ba71z8av.js';
+import { k as TunnelType, R as RunResultPayload, P as ProbeResultPayload, g as ProcessCorsairRequest, m as WebhookTenantLink } from './index-CkaSwl1Q.js';
+export { n as BROWSER_DELIVERY_TTL_MS, o as BrowserDeliveryMode, B as BrowserDeliveryPayload, S as SIGNED_TUNNEL_REPLAY_WINDOW_MS, j as TunnelEnvelope } from './index-CkaSwl1Q.js';
+export { b as buildBrowserDeliveryRedirectUrl, s as signBrowserDeliveryToken, v as verifyBrowserDeliveryToken } from './browser-delivery-5Lt0P6ay.js';
 import 'zod';
 import './db.js';
 import 'kysely';

package/dist/hub.js

@@ -1 +1 @@
-import{$a as _,A as z,Aa as P,B as A,Ba as Q,C as B,Ca as R,Da as S,Ea as T,Fa as U,Ga as V,Ha as W,T as C,Ua as X,Va as Y,_a as Z,ab as $,b as a,bb as aa,cb as ba,d as b,db as ca,e as c,f as d,fb as da,g as e,gb as ea,h as f,hb as fa,i as g,ia as D,ib as ga,j as i,jb as ha,k as j,ka as E,kb as ia,l as k,la as F,lb as ja,m as l,mb as ka,n as m,nb as la,o as n,ob as ma,p as o,pb as na,q as p,qb as oa,r as q,ra as G,rb as pa,s as r,sa as H,sb as qa,t as s,ta as I,tb as ra,u as t,ua as J,ub as sa,v as u,va as K,vb as ta,w as v,wa as L,wb as ua,x as w,xa as M,y as x,ya as N,z as y,za as O}from"./chunk-XQZJJTZ7.js";import{a as h,b as va,c as wa,d as xa,e as ya,f as za}from"./chunk-6IURNA4L.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{m as BROWSER_DELIVERY_TTL_MS,wa as CORSAIR_TUNNEL_PATH,va as CORSAIR_TUNNEL_ZONE,u as DEFAULT_HUB_API_URL,xa as FRPC_VERSION,w as HubCredentialsMissingError,v as HubNotConfiguredError,V as ManagedOAuthDeliveryError,n as SIGNED_TUNNEL_REPLAY_WINDOW_MS,ea as attachManagedRefreshAuth,p as buildBrowserDeliveryRedirectUrl,s as buildClientBridgeBrowserDeliveryUrl,ga as createConnectSessionJti,la as createConnectTokenJti,D as createHubConnectSession,E as createHubPermissionSession,fa as createHubRouteHandlers,ra as createPermissionSessionJti,o as createSignedTokenJti,ka as decodeConnectSessionTokenFromPath,qa as decodeConnectTokenFromPath,ua as decodePermissionTokenFromPath,Q as deliverConnectCreateLink,U as deliverSignedEnvelope,S as describeDeliveryNetworkError,pa as encodeConnectTokenForPath,O as extractConnectLinkFromDeliveryAck,H as extractProbeFromDeliveryAck,G as extractRunFromDeliveryAck,N as extractSyncFromDeliveryAck,F as formatHubApprovalMessage,a as formatProviderDisplayName,T as formatServerDeliveryError,ya as frpcPlatformKey,ha as getConnectSessionExpiryMs,X as getConnectStatusForTenant,ma as getConnectTokenExpiryMs,z as getHubConfig,da as getManagedAccessToken,Z as handleHubDeliveryGet,_ as handleHubDeliveryPost,aa as handleHubDeliveryRequest,$ as hubDeliveryToResponse,B as inferHubEnvironmentSlug,i as isLoopbackUrl,M as isServerDeliveryAckSuccessful,Y as listHubProjectConnections,x as normalizeHubConfig,P as parseConnectLinkFromDeliveryBody,b as parseConnectSessionResponse,f as parseConnectStatusResponse,g as parseHubApiErrorBody,e as parseOAuthRefreshResponse,d as parsePermissionSessionResponse,c as parseProjectConnectionsResponse,L as parseServerDeliveryAckBody,R as parseSyncFromDeliveryBody,t as prepareClientBridgeDeliveryTransport,W as processManagedOAuthDelivery,C as registerHubWebhookTenantLink,j as resolveDeliveryTransport,za as resolveFrpcBinary,y as resolveHubConfigInput,h as resolveHubDeliveryUrl,A as resolveHubOAuthCallbackUrl,ba as respondToHubDelivery,ca as respondToHubDeliveryFromRequest,q as signBrowserDeliveryToken,ia as signConnectSessionToken,na as signConnectToken,I as signDeliveryEnvelope,sa as signPermissionToken,k as usesBrowserDelivery,l as validateProductionDeliveryUrl,r as verifyBrowserDeliveryToken,ja as verifyConnectSessionToken,oa as verifyConnectToken,J as verifyDeliveryEnvelope,ta as verifyPermissionToken,K as verifySignedTunnelDelivery};
+import{$a as _,A as z,Aa as P,B as A,Ba as Q,C as B,Ca as R,Da as S,Ea as T,Fa as U,Ga as V,Ha as W,T as C,Ua as X,Va as Y,_a as Z,ab as $,b as a,bb as aa,cb as ba,d as b,db as ca,e as c,f as d,fb as da,g as e,gb as ea,h as f,hb as fa,i as g,ia as D,ib as ga,j as i,jb as ha,k as j,ka as E,kb as ia,l as k,la as F,lb as ja,m as l,mb as ka,n as m,nb as la,o as n,ob as ma,p as o,pb as na,q as p,qb as oa,r as q,ra as G,rb as pa,s as r,sa as H,sb as qa,t as s,ta as I,tb as ra,u as t,ua as J,ub as sa,v as u,va as K,vb as ta,w as v,wa as L,wb as ua,x as w,xa as M,y as x,ya as N,z as y,za as O}from"./chunk-IKQU6YIZ.js";import{a as h,b as va,c as wa,d as xa,e as ya,f as za}from"./chunk-6IURNA4L.js";import"./chunk-7AYINDN2.js";import"./chunk-N66TLOH2.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{m as BROWSER_DELIVERY_TTL_MS,wa as CORSAIR_TUNNEL_PATH,va as CORSAIR_TUNNEL_ZONE,u as DEFAULT_HUB_API_URL,xa as FRPC_VERSION,w as HubCredentialsMissingError,v as HubNotConfiguredError,V as ManagedOAuthDeliveryError,n as SIGNED_TUNNEL_REPLAY_WINDOW_MS,ea as attachManagedRefreshAuth,p as buildBrowserDeliveryRedirectUrl,s as buildClientBridgeBrowserDeliveryUrl,ga as createConnectSessionJti,la as createConnectTokenJti,D as createHubConnectSession,E as createHubPermissionSession,fa as createHubRouteHandlers,ra as createPermissionSessionJti,o as createSignedTokenJti,ka as decodeConnectSessionTokenFromPath,qa as decodeConnectTokenFromPath,ua as decodePermissionTokenFromPath,Q as deliverConnectCreateLink,U as deliverSignedEnvelope,S as describeDeliveryNetworkError,pa as encodeConnectTokenForPath,O as extractConnectLinkFromDeliveryAck,H as extractProbeFromDeliveryAck,G as extractRunFromDeliveryAck,N as extractSyncFromDeliveryAck,F as formatHubApprovalMessage,a as formatProviderDisplayName,T as formatServerDeliveryError,ya as frpcPlatformKey,ha as getConnectSessionExpiryMs,X as getConnectStatusForTenant,ma as getConnectTokenExpiryMs,z as getHubConfig,da as getManagedAccessToken,Z as handleHubDeliveryGet,_ as handleHubDeliveryPost,aa as handleHubDeliveryRequest,$ as hubDeliveryToResponse,B as inferHubEnvironmentSlug,i as isLoopbackUrl,M as isServerDeliveryAckSuccessful,Y as listHubProjectConnections,x as normalizeHubConfig,P as parseConnectLinkFromDeliveryBody,b as parseConnectSessionResponse,f as parseConnectStatusResponse,g as parseHubApiErrorBody,e as parseOAuthRefreshResponse,d as parsePermissionSessionResponse,c as parseProjectConnectionsResponse,L as parseServerDeliveryAckBody,R as parseSyncFromDeliveryBody,t as prepareClientBridgeDeliveryTransport,W as processManagedOAuthDelivery,C as registerHubWebhookTenantLink,j as resolveDeliveryTransport,za as resolveFrpcBinary,y as resolveHubConfigInput,h as resolveHubDeliveryUrl,A as resolveHubOAuthCallbackUrl,ba as respondToHubDelivery,ca as respondToHubDeliveryFromRequest,q as signBrowserDeliveryToken,ia as signConnectSessionToken,na as signConnectToken,I as signDeliveryEnvelope,sa as signPermissionToken,k as usesBrowserDelivery,l as validateProductionDeliveryUrl,r as verifyBrowserDeliveryToken,ja as verifyConnectSessionToken,oa as verifyConnectToken,J as verifyDeliveryEnvelope,ta as verifyPermissionToken,K as verifySignedTunnelDelivery};