corsair 0.1.141 → 0.1.143

package/dist/{browser-delivery-cP_cNQRX.d.ts → browser-delivery-CwVUOZrB.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-xRPYZuqr.js';
+import { B as BrowserDeliveryPayload } from './index-CqHpOTQt.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/chunk-IC7VFQ7K.js

@@ -0,0 +1,66 @@
+import{a as Se,b as kr,c as wr}from"./chunk-6IURNA4L.js";import{a as di,b as pi,c as gi,d as Un}from"./chunk-XCTHEKDP.js";import{a as mi,b as _e,c as hi,d as v,e as J,f as bi,g as ne,h as K,i as E,j as ki,k as it,l as wi,m as dn,n as br,o as Ci}from"./chunk-BRUFMVTV.js";import{b as fi,c as yi}from"./chunk-XPXWKPFZ.js";import{ZodBoolean as op,ZodDate as ip,ZodEnum as sp,ZodNullable as ap,ZodNumber as cp,ZodObject as up,ZodOptional as lp,ZodRecord as dp,ZodString as pp,ZodType as gp}from"zod";var st=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","alchemy","algolia","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","appointo","aryn","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beamer","beeminder","benchmarkemail","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bigpictureio","bitbucket","bitwarden","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","booqable","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","browserless","browsertool","bubble","bugsnag","buildkite","bunnycdn","byteforms","cal","calendly","campaigncleaner","campayn","canny","canva","canvas","capsulecrm","carbone","castingwords","cdrplatform","certifier","chaser","chatbotkit","chatfai","chmeetings","cincopa","circleci","classmarker","clickhouse","clickmeeting","clientary","clockify","cloudcart","cloudflare","cloudflareapikey","cloudinary","cody","coinbase","collegefootballdata","confluence","connecteam","contentfulgraphql","contextsevenmcp","convoloai","cosmic","countdownapi","crowterminal","currentsapi","cursor","customerio","customgpt","dadataru","databricks","datadog","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","docupost","dodopayments","doppler","dovetail","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","emelia","epicgames","everhour","exa","exist","extractaai","facebook","faraday","figma","filevine","filloutforms","firecrawl","fireflies","flexisign","flutterwave","formbricks","gemini","giphy","github","gitlab","gladia","gmail","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","hookdeck","htmltoimage","hubspot","huggingface","imagior","humanitix","imejisio","imgbb","insightoai","instagram","intercom","jigsawstack","jira","kaggle","kibana","leexi","linear","linkedin","loyverse","mailboxlayer","mailcheck","mailchimp","mailtrap","marketstack","merriamwebsterdict","monday","neon","nextdns","northflank","notion","ocrspace","ocrwebservice","ollama","onedrive","onepassword","openai","openrouter","openweathermap","oura","outlook","pagerduty","parseur","pdfco","pdfmonkey","perplexityai","phantombuster","pinecone","plain","posthog","postman","prisma","pushbullet","razorpay","reddit","reducto","replicate","removebg","replyio","resend","retailed","rootly","runpod","salesforce","sapsuccessfactors","scaleai","scrapegraphai","securitytrails","semanticscholar","sendgrid","sentry","serpapi","sharepoint","slack","snapchat","slackbot","sourcegraph","spoki","spotify","strava","streamtime","stripe","studiobyai21labs","supabase","supadata","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","timecamp","timelink","tinyurl","tisane","todoist","toggl","tokenmetrics","tpscheck","trello","tripadvisor","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","unione","uniswapapi","uploadcare","vapi","vercel","veriphone","vestaboard","waboxapp","wakatime","webflow","webscrapingai","webvizio","whatsapp","whoisfreaks","whautomate","winstonai","witai","wix","wiza","workday","workiom","worldnewsapi","xero","writer","xquik","youcom","youtube","zendesk","zenserp","zohobigin","zohoinventory","zohomail","zoom","zoominfo"],Ti={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",alchemy:"Alchemy",algolia:"Algolia",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",appointo:"Appointo",aryn:"Aryn",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beamer:"Beamer",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bigpictureio:"BigPicture.io",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",booqable:"Booqable",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",bunnycdn:"Bunnycdn",byteforms:"ByteForms",cal:"Cal",calendly:"Calendly",campaigncleaner:"Campaign Cleaner",campayn:"Campayn",canny:"Canny",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",carbone:"Carbone",castingwords:"CastingWords",cdrplatform:"CDR Platform",certifier:"Certifier",chaser:"Chaser",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chmeetings:"ChMeetings",cincopa:"Cincopa",circleci:"CircleCI",classmarker:"ClassMarker",clickhouse:"Clickhouse",clickmeeting:"ClickMeeting",clientary:"Clientary",clockify:"Clockify",cloudcart:"CloudCart",cloudflare:"Cloudflare",cloudflareapikey:"Cloudflare API Key",cloudinary:"Cloudinary",cody:"Cody",coinbase:"Coinbase",collegefootballdata:"College Football Data",confluence:"Confluence",connecteam:"Connecteam",contentfulgraphql:"Contentful GraphQL",contextsevenmcp:"Context7",convoloai:"ConvoloAi",cosmic:"Cosmic",countdownapi:"Countdown API",crowterminal:"CrowTerminal",currentsapi:"CurrentsApi",cursor:"Cursor",customerio:"Customer.io",customgpt:"CustomGPT",dadataru:"Dadataru",databricks:"Databricks",datadog:"Datadog",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",docupost:"Docupost",dodopayments:"Dodo Payments",doppler:"Doppler",dovetail:"Dovetail",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",emelia:"Emelia",epicgames:"Epic Games",everhour:"Everhour",exa:"Exa",exist:"Exist",extractaai:"Extracta.ai",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filevine:"Filevine",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",flexisign:"Flexisign",flutterwave:"Flutterwave",formbricks:"Formbricks",gemini:"Gemini",giphy:"Giphy",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",hookdeck:"Hookdeck",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",imagior:"Imagior",humanitix:"Humanitix",imejisio:"Imejis.io",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",kibana:"Kibana",leexi:"Leexi",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailboxlayer:"MailboxLayer",mailcheck:"Mailcheck",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",monday:"Monday",neon:"Neon",nextdns:"NextDNS",northflank:"Northflank",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfco:"PDF.co",pdfmonkey:"PDFMonkey",perplexityai:"Perplexity AI",phantombuster:"PhantomBuster",pinecone:"Pinecone",plain:"Plain",posthog:"PostHog",postman:"Postman",prisma:"Prisma",pushbullet:"Pushbullet",razorpay:"Razorpay",reddit:"Reddit",reducto:"Reducto",replicate:"Replicate",removebg:"remove.bg",replyio:"Reply.io",resend:"Resend",retailed:"Retailed",rootly:"Rootly",runpod:"RunPod",salesforce:"Salesforce",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",securitytrails:"SecurityTrails",semanticscholar:"Semantic Scholar",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",snapchat:"Snapchat",slackbot:"Slackbot",sourcegraph:"Sourcegraph",spoki:"Spoki",spotify:"Spotify",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",supadata:"Supadata",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",timecamp:"TimeCamp",timelink:"Timelink",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",tokenmetrics:"Token Metrics",tpscheck:"TPSCheck",trello:"Trello",tripadvisor:"Tripadvisor",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",unione:"Unione",uniswapapi:"Uniswap",uploadcare:"Uploadcare",vapi:"Vapi",vercel:"Vercel",veriphone:"Veriphone",vestaboard:"Vestaboard",waboxapp:"Waboxapp",wakatime:"WakaTime",webflow:"Webflow",webscrapingai:"WebScraping.AI",webvizio:"Webvizio",whatsapp:"WhatsApp",whoisfreaks:"Whoisfreaks",whautomate:"Whautomate",winstonai:"Winston AI",witai:"WitAi",wix:"Wix",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",xero:"Xero",writer:"Writer",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zenserp:"Zenserp",zohobigin:"Zoho Bigin",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Ee(e){let n=Ti[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var he=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function O(e){return typeof e=="string"&&e.length>0}function hc(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function bc(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"||e==="managed_pricing"}function at(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!O(n.connectUrl)||!O(n.token)||!O(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:O(n.environmentId)?n.environmentId:n.projectId};return O(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function ct(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!O(r.tenantId)||!O(r.plugin)||!hc(r.status)||!bc(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:O(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function ut(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!O(n.approvalUrl)||!O(n.token)||!O(n.projectId)||!O(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function pn(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(O(n.access_token))return{access_token:n.access_token,refresh_token:O(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:O(n.scope)?n.scope:void 0};throw new Error(O(n.error)?O(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function kc(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function wc(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;O(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function Cc(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function vi(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!O(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!O(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",a=wc(o.fields),s=kc(o.missingRequiredFields),c=Cc(o.status,o.connected,a,s);t.push({plugin:o.plugin,providerName:O(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function lt(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Pi(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}function dt(e){return e.replace(/\/$/,"")}function Cr(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return Se()}catch{return null}}function Ri(e){let n=Cr(e);return n?{"x-corsair-delivery-url":n}:{}}function Ai(e){let n=e.instanceKey?.trim();return n?{"x-corsair-instance-key":n}:{}}async function xi(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Tc(e,n,t){if(n===404&&t)return t;let r=lt(e);return r||`Hub API returned HTTP ${n}`}function Ii(e,n,t){let r=Pi(e);throw r?new he({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(Tc(e,n,t))}async function S(e){let n=dt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...Ri(e.hub),...Ai(e.hub)},body:JSON.stringify(e.body)}),r=await xi(t);return t.ok||Ii(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function G(e){let n=dt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...Ri(e.hub),...Ai(e.hub)}}),r=await xi(t);return t.ok||Ii(r,t.status,e.notFoundMessage),e.parseResponse(r)}function pt(e){return e&&typeof e=="object"?e:{}}function Si(e){let n=pt(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Tr(e,n){return S({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=pt(t);return{chat:r.thread,reply:Si(r.reply)}}})}async function vr(e,n){return S({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Si})}async function Pr(e,n){return G({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=pt(t).threads;return Array.isArray(r)?r:[]}})}async function Rr(e,n){return G({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=pt(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Sc}from"crypto";var vc="corsair:client-bridge";function Ar(e){return new URL(e).origin}function gn(e){let n=JSON.stringify({type:vc,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Ar(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var Pc=new Set(["localhost","127.0.0.1","[::1]","::1"]);function xr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Pc.has(n)}catch{return!1}}function Ln(e){return e==="development"?"browser":"server"}function _i(e){return Ln(e)==="browser"}function Ei(e){return xr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Ic}from"crypto";var Oe=60*1e3,je=300*1e3;import{createHmac as Rc,randomBytes as Ac,timingSafeEqual as xc}from"crypto";function be(){return Ac(16).toString("base64url")}function Fn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Rc("sha256",t).update(e).digest("base64url")}function de(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let a=Fn(o,t);try{if(!xc(Buffer.from(i,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function gt(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),a=Fn(i,n);return`${i}.${a}`}function Nn(e,n,t){let r=Math.floor(Date.now()/1e3);return gt(e,n,r+Math.floor(t/1e3))}function Ke(e){return decodeURIComponent(e)}function Ir(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function Oi(e){let n=e.trim();return n.length>0?n:null}function fn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function yn(e,n){if(!Oi(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Ic(16).toString("base64url"),iat:t,exp:t+Math.floor(Oe/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=Fn(o,n);return`${o}.${i}`}function De(e,n){return Oi(n)?de(e,n):null}function _c(e){let n=Ar(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function Sr(e){let n=yn(_c(e),e.signingSecret);return fn(e.deliveryUrl,n)}function Di(e){if(Ln(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Sc(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:Sr(r)}}var $n="https://auth.corsair.dev";var ke=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},Wn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function _r(e){let n=(e.apiUrl?.trim()||$n).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"",o=t.startsWith("ck_cloud_");if(!t||!r&&!o)throw new Wn;return{apiUrl:n,projectApiKey:t,signingSecret:r,instanceKey:e.instanceKey?.trim()||void 0,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function ft(e){return _r(e)}function Ec(e){let n=e.projectApiKey.startsWith("ck_cloud_");return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&(n||e.signingSecret.trim().length>0)}function L(e){let n=v(e).hub;if(!n||!Ec(n))throw new ke;return n}function Mi(e){return e.replace(/\/$/,"")}function yt(e){return e.oauthCallbackUrl?Mi(e.oauthCallbackUrl.trim()):`${Mi(e.apiUrl)}/oauth/callback`}function mn(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";if(e.startsWith("ck_cloud_"))return"cloud";throw new Error("Hub API key must start with ck_dev_ (development), ck_prod_ (production), or ck_cloud_ (cloud)")}import{createCipheriv as Hi,createDecipheriv as Bi,randomBytes as mt,scrypt as Oc}from"crypto";import{promisify as Dc}from"util";var Ui=Dc(Oc),ht="aes-256-gcm",Li=12,bt=16,Mc=16,Ge=32;function we(){return mt(Ge).toString("base64")}async function Ce(e,n){let t=mt(Mc),r=await Ui(n,t,Ge),o=mt(Li),i=Hi(ht,r,o,{authTagLength:bt}),a=Buffer.concat([i.update(e,"utf8"),i.final()]),s=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),s.toString("base64"),a.toString("base64")].join(":")}async function te(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let a=Buffer.from(t,"base64"),s=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),u=Buffer.from(i,"base64"),l=await Ui(n,a,Ge),d=Bi(ht,l,s,{authTagLength:bt});return d.setAuthTag(c),Buffer.concat([d.update(u),d.final()]).toString("utf8")}function Er(e,n){let t=Buffer.from(n,"base64"),r=mt(Li),o=Hi(ht,t,r,{authTagLength:bt}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),a=o.getAuthTag();return[r.toString("base64"),a.toString("base64"),i.toString("base64")].join(":")}function qn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),a=Buffer.from(t,"base64"),s=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),u=Bi(ht,i,a,{authTagLength:bt});return u.setAuthTag(s),Buffer.concat([u.update(c),u.final()]).toString("utf8")}function Me(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=Er(o,n);return t}function pe(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=qn(o,n);return t}function jn(e,n,t){let r=pe(e,n);return Me(r,t)}function Fi(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let a=[null,void 0,""].includes(i)?null:i;await n({[o]:a})};return r}var Or=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function F(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,a=[...K[n].integration,...i],s=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:b.id,config:Or(b.config),dek:b.dek??null},s},updateIntegration:async b=>{let k=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),s=null}},u=null,l=async()=>{if(u)return u;let b=await c.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return u=await te(b.dek,r),u},d=async()=>{let b=await c.getIntegration(),k=await l(),T=b.config;return!T||Object.keys(T).length===0?{}:pe(T,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await l(),T;try{T=await d()}catch(D){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,D),T={}}let P={...T};for(let[D,H]of Object.entries(b))H===null?delete P[D]:P[D]=H;let M=Me(P,k);await c.updateIntegration({config:M})};return{get_dek:l,issue_new_dek:async()=>{let b=await c.getIntegration(),k=we(),T={};if(b.dek){let M=await te(b.dek,r),D=b.config;D&&Object.keys(D).length>0&&(T=jn(D,M,k))}let P=await Ce(k,r);return await c.updateIntegration({config:T,dek:P}),u=k,k},...Fi(d,g,a)}}function U(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:a=[],ensureProvisioned:s}=e,c=[...K[n].account,...a],u=null,l=async()=>{if(u)return u;let C=!1;for(;;){let R=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!R){if(!C&&s){C=!0,await s();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return u={id:R.id,config:Or(R.config),dek:R.dek??null},u}},d={kek:o,integrationName:t,tenantId:r,getIntegration:l,getAccount:async()=>{let C=!1;for(;;){let R=await l(),x=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",R.id).executeTakeFirst();if(!x){if(!C&&s){C=!0,await s();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return{id:x.id,config:Or(x.config),dek:x.dek??null}}},updateAccount:async C=>{let R=await d.getAccount();await i.db.updateTable("corsair_accounts").set({...C.config!==void 0?{config:C.config}:{},...C.dek!==void 0?{dek:C.dek}:{},updated_at:new Date}).where("id","=",R.id).execute()}},p=null,g=null,f=null,h=async()=>{let C=await d.getAccount();if(!C.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p&&g===C.dek||(p=await te(C.dek,o),g=C.dek),p},b=async()=>{if(f)return f;let C=await d.getIntegration();if(!C.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await te(C.dek,o),f},k=async()=>{let C=await d.getAccount(),R=await h(),x=C.config;return!x||Object.keys(x).length===0?{}:pe(x,R)},T=async()=>{let C=await d.getIntegration(),R=await b(),x=C.config;return!x||Object.keys(x).length===0?{}:pe(x,R)},P=Promise.resolve(),M=C=>{let R=P.then(()=>D(C));return P=R.catch(()=>{}),R},D=async C=>{let R=await d.getAccount();if(!R.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);let x=await te(R.dek,o),ee;try{let $=R.config;ee=!$||Object.keys($).length===0?{}:pe($,x)}catch($){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,$),ee={}}let re={...ee};for(let[$,xe]of Object.entries(C))xe===null?delete re[$]:re[$]=xe;let B=Me(re,x);await d.updateAccount({config:B})},H={get_dek:h,issue_new_dek:async()=>{let C=await d.getAccount(),R=we(),x={};if(C.dek){let re=await te(C.dek,o),B=C.config;B&&Object.keys(B).length>0&&(x=jn(B,re,R))}let ee=await Ce(R,o);return await d.updateAccount({config:x,dek:ee}),p=R,g=ee,R},...Fi(k,M,c)};return n==="oauth_2"&&(H.get_integration_credentials=async()=>{let C=await T();return{...C,client_id:C.client_id||null,client_secret:C.client_secret||null,redirect_url:C.redirect_url??null}}),H}async function Ni(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=we(),i=await Ce(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function $i(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=we(),s=await Ce(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",i.id).execute(),a}var Hc=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function He(e){return Hc.has(e)}function Bc(e,n){return He(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function Uc(e){return!He(e)}function Lc(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"];case"managed_pricing":return[]}}function Fc(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function Nc(e,n){let t=i=>n.find(a=>a.level==="account"&&a.name===i);if(!Lc(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function Wi(e,n){if(!e)return!1;let t=ne(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function $c(e,n){let r=e.authConfig?.[n]?.integration??[];return[...K[n].integration,...r]}function Wc(e,n){let r=e.authConfig?.[n]?.account??[];return[...K[n].account,...r]}function qc(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return o.length>0?a="missing_integration":r.length===0?a="ready":i.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:Nc(n,t),fields:t,missingRequiredFields:r}}async function Ze(e,n,t){let r=E(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,a=i?.[r]?.integration??[],s=i?.[r]?.account??[],c=F({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),u=U({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:s}),l=$c(n,r),d=Wc(n,r),p=[];for(let g of l)p.push({name:g,level:"integration",required:Bc(r,g),configured:await Wi(c,g)});for(let g of d)p.push({name:g,level:"account",required:Uc(g),configured:await Wi(u,g)});if(Fc(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return qc(n.id,r,p)}async function Kn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let a of e.plugins){if(o&&!o.has(a.id))continue;let s=await Ze(e,a,r);s&&i.push(s)}return i}function kt(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var qi=Symbol.for("corsair:internal"),ji=new WeakMap,Ki=new WeakMap;function jc(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function Kc(e){if(e.database){let t=ji.get(e.database);return t||(t=new Map,ji.set(e.database,t)),t}let n=Ki.get(e);return n||(n=new Map,Ki.set(e,n)),n}function Gc(e){return e.multiTenancy?{withTenant:()=>({}),[qi]:e}:{[qi]:e}}async function hn(e,n){if(!e.database)return;let t=n.trim()||"default",r=Kc(e),o=jc(t,e.plugins),i=r.get(o);if(i){await i;return}let a=(async()=>{let{setupCorsair:s}=await import("./setup-FMJS46JR.js");await s(Gc(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,a),await a}import*as Gn from"crypto";function Be(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function Dr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function bn(e,n){if(!n)throw new Error("OAuth state signing requires a configured kek. Pass kek to createCorsair().");let t=Gn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var Mr=600*1e3;function wt(e,n){if(!n)return null;let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Gn.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(o,"base64url"),s=Buffer.from(i,"base64url");return a.length!==s.length||!Gn.timingSafeEqual(a,s)?null:Dr(r,{maxAgeMs:Mr})}function Gi(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function Zi(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function kn(e,n){await S({hub:e,path:"/connections/report",body:Gi(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function Zc(e,n){try{let t=L(e);S({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof ke)return}}async function zc(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!E(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ze(n,e.plugin,r);o&&Ji(e.hub,Zi({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function zi(e,n){Zc(e,n)}function Ji(e,n){S({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function wn(e){zc(e).catch(()=>{})}async function Te(e,n){let t=v(e);if(!E(n.plugin))return;let o=await Ze(t,n.plugin,n.tenantId);o&&zi(e,Zi({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function Ct(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var Vi=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function Jc(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function Vc(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await te(n.dek,e.kek),r=Vi(n.config),o={};Object.keys(r).length>0&&(o=pe(r,t)),o[e.link.linkType]=e.link.externalId;let i=Me(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function Cn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:a,extraAccountFields:s=[]}=e,{accountId:c}=await Jc({database:n,pluginId:r,tenantId:o}),u=!1;if(a){let l=U({authType:a,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:s}),d=`set_${i.linkType}`,p=l[d];typeof p=="function"&&(await p(i.externalId),u=!0)}u||await Vc({database:n,kek:t,accountId:c,link:i})}async function Hr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let c=await te(s.dek,t),l=Vi(s.config)[o];if(!l)continue;if(qn(l,c)===i)return s}catch{continue}return null}async function Tt(e){return(await Hr(e))?.tenant_id??null}async function Yi(e){return Tt({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as Qi from"querystring";function ze(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${Qi.stringify(i)}`}async function Xi(e,n){try{return await G({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function Tn(e,n,t,r){if(!n.subscribe)return;let o=L(e),i=await Xi(o,n.id);if(!i)return;let a=await n.subscribe({keys:r},{webhookUrl:i});a&&await Te(e,{plugin:n,tenantId:t,verified:!0,webhookLink:a.webhookLink,webhookSecret:a.webhookSecret})}var V=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function es(e){let n=e.oauthConfig;if(!n)throw new V("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Yc(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let a=await i.executeTakeFirst();if(!a)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",a.id).executeTakeFirst())return;let c=we(),u=await Ce(c,r),l=new Date;await o.insertInto("corsair_accounts").values({id:dn(),created_at:l,updated_at:l,tenant_id:t,integration_id:a.id,config:{},dek:u}).execute()})}async function Br(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,a=v(e,()=>new V("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=J(a,n,p=>new V("plugin_not_found",p)),c=es(s),l=await F({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!l)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(ze({oauthConfig:c,clientId:l,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=bn(Be(n,r),a.kek);return{url:ze({oauthConfig:c,clientId:l,redirectUri:o,state:d}),state:d}}function Qc(e,n){return{...n??{},...e}}async function Zn(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new V("invalid_corsair_instance","Invalid corsair instance")),a,s;if(n.trusted){if(!n.plugin||!n.tenantId)throw new V("invalid_state","trusted callback requires plugin and tenantId");a=n.plugin,s=n.tenantId}else{let h=wt(r,i.kek);if(!h)throw new V("invalid_state","Invalid or tampered state parameter");a=h.plugin,s=h.tenantId}if(!i.database)throw new V("no_database","No database configured on corsair instance");let c=J(i,a,h=>new V("plugin_not_found",h)),u=es(c),l=F({authType:"oauth_2",integrationName:a,kek:i.kek,database:i.database}),d=await l.get_client_id(),p=await l.get_client_secret();if(!d||!p)throw new V("credentials_not_configured",`Credentials not configured for '${a}'`);await Yc(i.database,a,s,i.kek);let g=await vt(t,d,p,u,o);if(!g.access_token)throw new V("no_access_token",`No access_token returned from ${u.providerName}`);let f=U({authType:"oauth_2",integrationName:a,tenantId:s,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await Te(e,{plugin:c,tenantId:s}).catch(()=>{});try{let h=Qc(g,n.callbackParams),b=await Ct(i.plugins,a,h);if(b){try{let k=c.authConfig?.oauth_2?.account??[];await Cn({database:i.database,kek:i.kek,pluginId:a,tenantId:s,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${a}' tenant '${s}':`,k)}i.hub&&kn(i.hub,{plugin:a,tenantId:s,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${a}' tenant '${s}':`,h)}if(c.subscribe)try{await Tn(e,c,s,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${a}' tenant '${s}':`,h)}return{plugin:a,tenantId:s}}async function Xc(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??Tn,i=[],a=[];if(!t.database)return{renewed:i,failed:a};for(let s of r){let c=t.plugins.find(l=>l.id===s.integrationName);if(!c?.subscribe)continue;let u=`${c.id}/${s.tenantId}`;try{let l=E(c)??"oauth_2",d=U({authType:l,integrationName:c.id,tenantId:s.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[l]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:l,keys:g,hub:t.hub},"endpoint")}await o(n,c,s.tenantId,d),i.push(u)}catch(l){console.warn(`[corsair:renewal] re-subscribe failed for '${u}':`,l),a.push(u)}}return{renewed:i,failed:a}}async function ns(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return Xc({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function eu(e,n={}){let t=!1,r=()=>{t||(t=!0,ns(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function ts(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await Pt(e,{silent:!0})}async function vn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await hn(t,n)}var nu=Symbol.for("corsair:internal"),tu=new Set(["access_token","refresh_token","expires_at","scope"]);function ru(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function ou(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!He(t)&&!tu.has(t)):n.filter(t=>!He(t))}function rs(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function iu(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function su(e){return{[nu]:rs(e)}}async function Rt(e,n,t={}){let r=yt(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,a=rs(e),s=su(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let u=E(c);if(!u)continue;let l=ru(u),d=t.providerNameOverrides?.[c.id]??Ee(c.id),p=await Ze(a,c,n),g=it(c,u),f=ou(u,g),h={plugin:c.id,providerName:d,authKind:l,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),l==="oauth"){let k=t.oauthModeOverrides?.[c.id]??(u==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let T=await Br(s,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=T.url}catch(T){T instanceof Error&&/client_id not configured/i.test(T.message)||(h.setupError=T instanceof Error?T.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function Nf(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return Rt({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function os(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await hn(e.internalConfig??iu(e),n)}async function is(e,n){await vn(e,n)}async function ss(e,n){let t=mn(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:at})}async function as(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await os(t,n.tenantId);let r=await Rt(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return ss(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function At(e,n){let t=v(e),r=L(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await is(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,a=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,s=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await Rt(o,n.tenantId,{pluginIds:i,oauthModeOverrides:a,providerNameOverrides:s});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return ss(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function xt(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(a=>a.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await au(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function au(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-BWFC4KIC.js"),{postHubConnectSession:i}=await import("./connect-6JIVRVND.js"),a={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(a,t.tenantId);let s=await r(a,t.tenantId,{pluginIds:t.pluginIds});if(s.length===0)throw new Error("No connectable plugins found for this tenant");let c=s.find(u=>u.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:s})}function Pn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var ie=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function cu(e){let n=e.oauthConfig;if(!n)throw new ie("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Ur(e,n){let t=v(e,()=>new ie("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ie("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new ie("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=wt(n,t.kek);if(!o)throw new ie("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:a}=o,s=J(t,i,p=>new ie("plugin_not_found",p)),c=cu(s),l=await F({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!l)throw new ie("client_id_not_configured",`client_id not configured for '${i}'`);let d=ze({oauthConfig:c,clientId:l,redirectUri:r,state:n});return{plugin:i,tenantId:a,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as lu}from"async_hooks";import{randomBytes as du}from"crypto";import{v4 as pu}from"uuid";async function It(e,n){let t=mn(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:ut})}function St(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var Lr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Nr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function cs(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Fr(e){return St(e)}async function $r(e,n){if(Nr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?cs(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await It(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:uu(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch(r){return console.warn(`[corsair/${n.plugin}] could not create an approval link for '${n.endpoint}': ${r instanceof Error?r.message:String(r)}`),null}}function uu(e){try{return JSON.parse(e)}catch{return e}}async function _t(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await $r(e,n);return{...n,approvalUrl:r}}async function Wr(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:a,endpoint:s,args:c,tenantId:u,expiresAt:l,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:a,endpoint:s,args:c});let g=await $r({manual:t,hub:r},{id:o,token:i,plugin:a,endpoint:s,args:JSON.stringify(c),tenant_id:u,expires_at:l});return Nr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Fr(g):Lr:r?g?Fr(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:Lr}var Ue=class extends Error{reason;constructor(n,t="pending"){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError",this.reason=t}};var ls=new lu,Rn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function qr(e){return ls.run(!0,e)}function ds(){return ls.getStore()===!0}function Je(e,n){if(ds()&&n!=="read")throw new Rn(e,n)}var gu={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function fu(e,n,t){return t!==void 0?t:gu[n][e]}function jr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function ps(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function us(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function gs(e){let n=fu(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, update the permission mode or add an override in your corsair config.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",a).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,h=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${s.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?us(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let c=pu(),u=du(32).toString("hex"),l=e.timeoutMs??600*1e3,d=new Date(Date.now()+l).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:c,created_at:new Date,updated_at:new Date,token:u,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:a,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${c}`,`
+  Permission token: ${u}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?us(e.db,c,l):{result:"blocked",reason:"pending",id:c,token:u,expiresAt:d}}var w=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function I(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function ge(e){let n={error:e.code,message:e.message,...e.extra};return I(e.status,n)}function Le(e){return new w(404,"not_found",e)}function N(e,n={}){return new w(400,"bad_request",e,n)}function Kr(e,n){return J(e,n,t=>Le(t))}async function fs(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=F({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=K[t].integration,i=r,a;try{a=await Promise.all(o.map(u=>i[`get_${u}`]()))}catch{a=o.map(()=>null)}let s=o.filter((u,l)=>a[l]==null),c;return t==="oauth_2"?c=!s.includes("client_id")&&!s.includes("client_secret"):c=s.length===0,{configured:c,missingFields:s}}async function ys(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await fs(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Et(){return{ok:!0}}async function An(e){return Promise.all(e.plugins.map(n=>ys(n,e)))}async function Ot(e,n){let t=Kr(e,n);return ys(t,e)}async function yu(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function ms(e,n){let t=await yu(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function xn(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let a=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function Dt(e,n){if(!n)throw N("Tenant id must be a non-empty string");return ms(e,n)}async function Mt(e,n){let t=n?.id?.trim();if(!t)throw N("Tenant id is required",{missingFields:["id"]});return ms(e,t)}async function Ht(e,n){let t=n?.trim()||"default",r={},o=await Kn(e,t);for(let i of o)r[i.plugin]=kt(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function Bt(e,n){let t=n?.plugin;if(typeof t!="string"||!t.trim())throw N("plugin is required",{missingFields:["plugin"]});let r=t.trim();Kr(e,r);let o=n?.tenantId;if(o!=null&&typeof o!="string")throw N("tenantId must be a string");let i=o?.trim()||"default";if(!e.database)return{ok:!0,disconnected:!1};let a=e.database.db,s=await a.selectFrom("corsair_integrations").select(["id"]).where("name","=",r).executeTakeFirst();if(!s)return{ok:!0,disconnected:!1};let c=!1;return await a.transaction().execute(async u=>{e.database?.isPg===!0&&await u.selectFrom("corsair_integrations").select("id").where("name","=",r).forUpdate().execute();let l=u.selectFrom("corsair_accounts").select("id").where("tenant_id","=",i).where("integration_id","=",s.id);await u.deleteFrom("corsair_events").where("account_id","in",l).execute(),await u.deleteFrom("corsair_entities").where("account_id","in",l).execute(),c=((await u.deleteFrom("corsair_accounts").where("tenant_id","=",i).where("integration_id","=",s.id).executeTakeFirst()).numDeletedRows??0n)>0n}),{ok:!0,disconnected:c}}async function Gr(e,n){if(!e.database)throw Le(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw Le(`Permission '${n}' not found`);return _t(e,t)}function mu(e){if(!e.oauthConfig)throw N(`Plugin '${e.id}' has no oauthConfig`)}function hu(e){if(!e.manual)throw new w(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function Zr(e){let n=hu(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new w(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function bu(e){let n=!!e.hub,t=Pn(e.manual);if(!n&&!t)throw new w(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function hs(e){if(!e.database||!e.kek)throw new w(500,"database_not_configured","A database and kek are required to issue connect links.")}async function ku(e,n){let t=n?.plugin?.trim();if(!t)throw N("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=Kr(e,t);mu(o);let i=Zr(e);hs(e);let a=await fs(o,e);if(!a.configured)throw new w(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=bn(Be(t,r),e.kek),c;try{c=new URL(i.baseUrl)}catch{throw new w(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return c.searchParams.set("state",s),{connectUrl:c.toString(),expiresAt:new Date(Date.now()+Mr).toISOString(),tenantId:r}}async function wu(e,n,t){hs(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let a=t.providerName?.trim();a&&(o.providerName=a);let s=await At(e,o);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt,tenantId:r}}async function Ut(e,n,t){return bu(n),n.hub?wu(e,n,t):ku(n,t)}async function Lt(e,n,t){if(n.hub&&!Pn(n.manual))throw new w(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw N("state is required",{missingFields:["state"]});Zr(n);try{return await Ur(e,r)}catch(o){if(o instanceof ie)switch(o.code){case"invalid_state":throw N("Invalid or expired state");case"client_id_not_configured":throw new w(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new w(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function Ft(e,n,t){if(n.hub&&!Pn(n.manual))throw new w(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw N("Missing required fields",{missingFields:i});let a=Zr(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:o,redirectUri:a.redirectUri,callbackParams:t.callbackParams})}catch(c){if(c instanceof Error&&c.name==="OAuthCallbackError")switch(c.code){case"invalid_state":throw N("Invalid or expired state");case"credentials_not_configured":throw new w(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new w(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function zr(e,n){if(!e.database)throw Le("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw Le("Permission not found");return _t(e,t)}async function bs(e,n){return"id"in n?Gr(e,n.id):zr(e,n.token)}import{createCipheriv as Iu,createDecipheriv as Ky,randomBytes as Ts,scryptSync as Su}from"crypto";import{createHmac as Jr,randomUUID as Cu,timingSafeEqual as ws}from"crypto";function Vr(e){return e.run??null}function Yr(e){return e.probe??null}function Cs(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function Nt(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=Jr("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":Cu()}}}function Qr(e){let n=e.signingSecret.trim();if(!n)return!1;let t=Cs(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>je)return!1;let i=Jr("sha256",n).update(e.body).digest("hex");try{return ws(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function In(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=Cs(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>je)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=Jr("sha256",n).update(e.body).digest("hex");try{if(!ws(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function Sn(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function $t(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function Wt(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function zn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function Xr(e){return zn(Sn(e))}async function eo(e){let n=await Kt({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=Sn(n.body),r=$t({httpOk:n.ok,status:n.status,body:t}),o=zn(t);if(!r||!o)throw new Error(jt({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function qt(e){return Wt(Sn(e))}function Tu(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function ks(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var vu="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",Pu="Check the delivery URL configured for this environment.";function Ru(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${vu}`}function Au(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${Pu}`}function Jn(e,n){let t=Tu(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function jt(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Jn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return Ru(e);if(e.status===404)return Au(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${ks(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${ks(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}var xu=15e3;async function Kt(e){let{body:n,headers:t}=Nt(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n,signal:AbortSignal.timeout(xu)}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Jn(e.deliveryUrl,r)}}}var _u="aes-256-gcm",Eu=12,Ou=16,Du=16,Mu=32;function Hu(e,n){return Su(e.trim(),n,Mu)}function no(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=Ts(Du),o=Hu(t,r),i=Ts(Eu),a=Iu(_u,o,i,{authTagLength:Ou}),s=JSON.stringify(e),c=Buffer.concat([a.update(s,"utf8"),a.final()]),u=a.getAuthTag();return[r.toString("base64"),i.toString("base64"),u.toString("base64"),c.toString("base64")].join(":")}var Bu=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function to(e){if(e instanceof mi)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!Bu.some(t=>n.includes(t))}function Uu(e){if(!e)return[];let n=E(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!He(r)):[]}async function Vn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await Pt(e,{silent:!0});let[r,o]=await Promise.all([xn(t),An(t)]),i={tenants:r.map(a=>({id:a.id})),plugins:o.map(a=>{let s=Uu(t.plugins.find(c=>c.id===a.id));return{id:a.id,authType:a.authType,configured:a.configured,missingFields:a.missingFields,...s.length>0?{integrationCredentialFields:s}:{}}}),syncedAt:new Date().toISOString()};return no(i,n)}var fe=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function Gt(e,n){let t=v(e,()=>new fe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new fe("no_database","Database not configured");let r=J(t,n.plugin,l=>new fe("plugin_not_found",l)),o=E(r);if(!o)throw new fe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new fe("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await vn(e,n.tenantId);let i=new Set(it(r,o)),s=r.authConfig?.[o]?.account??[],c=U({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),u=0;for(let[l,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(l))throw new fe("invalid_credentials",`Unknown credential field '${l}' for plugin '${n.plugin}'`);let p=ne(c,`set_${l}`);if(!p)throw new fe("invalid_credentials",`Cannot set credential field '${l}' for plugin '${n.plugin}'`);await p(d.trim()),u+=1}if(u===0)throw new fe("invalid_credentials","Provide at least one credential field to save");return await Te(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var ye=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function ro(e,n){let t=v(e,()=>new ye("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ye("no_database","Database not configured");let r=J(t,n.plugin,l=>new ye("plugin_not_found",l)),o=E(r);if(!o)throw new ye("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await ts(e);let i=new Set(wi(r,o)),s=r.authConfig?.[o]?.integration??[],c=F({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:s}),u=0;for(let[l,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(l))throw new ye("invalid_credentials",`Unknown integration credential field '${l}' for plugin '${n.plugin}'`);let p=ne(c,`set_${l}`);if(!p)throw new ye("invalid_credentials",`Cannot set integration field '${l}' for plugin '${n.plugin}'`);await p(d.trim()),u+=1}if(u===0)throw new ye("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var Zt=new Map;function Lu(e){for(let[n,t]of Zt)t<=e&&Zt.delete(n)}function zt(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();Lu(r);let o=Zt.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(Zt.set(t,r+n),{ok:!0})}var Fe=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function _n(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:a,scope:s,authType:c="managed",providerData:u}=n;if(!o.trim())throw new Fe("no_access_token","Managed OAuth delivery missing access_token");let l=v(e,()=>new Fe("invalid_corsair_instance","Invalid corsair instance"));if(!l.database)throw new Fe("no_database","No database configured on corsair instance");let d=J(l,t,g=>new Fe("plugin_not_found",g));await vn(e,r);let p=U({authType:c,integrationName:t,tenantId:r,kek:l.kek,database:l.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),a&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await p.set_scope(s),await Te(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await Ct(l.plugins,t,{access_token:o,refresh_token:i,scope:s,...u});if(g){try{let f=d.authConfig?.[c]?.account??[];await Cn({database:l.database,kek:l.kek,pluginId:t,tenantId:r,link:g,authType:c,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}l.hub&&kn(l.hub,{plugin:t,tenantId:r,link:g,authType:c})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await Tn(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function Fu(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function vs(e,n,t=[]){for(let[r,o]of Object.entries(e))if(Fu(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=vs(o,n,[...t,r]);if(i)return i}return null}function Nu(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function $u(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function Ps(e,n,t,r,o){let i=Nu(n),a=typeof t=="string"?JSON.parse(t):t;(!a||typeof a=="object"&&Object.keys(a).length===0)&&i["x-goog-resource-uri"]&&(a=$u(i)||a);let c={headers:i,body:a,...r?{query:r}:{}},u=r?.tenantId||"default",l=e.withTenant?e.withTenant(u):e,d=o?.plugin,p=d?[d]:st;for(let g of p){let f=l[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(c))continue;let h=vs(f.webhooks,c);if(!h)continue;let b=h.path.join("."),k={payload:a,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let T=await h.webhook.handler(k),P=!!Object.keys(T.returnToSender||{})?.length;return{plugin:g,action:b,body:a,response:P?{...T?.returnToSender,success:!0}:{success:!0},...T.responseHeaders&&{responseHeaders:T.responseHeaders}}}catch(T){return console.error(`Error executing webhook handler for ${g}.${b}:`,T),{plugin:g,action:b,body:a,response:{success:!1,error:T instanceof Error?T.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as Wu}from"crypto";import*as Ve from"vm";var Rs="__corsairFailedStep",qu=3e4,oo=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function As(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function xs(e,n){return`st_${Wu("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function Jt(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var Is=new Set(["constructor","prototype","__proto__"]);function ve(e,n){if(e===null)return null;let t=typeof e;return t==="function"?Ku(e,n):t==="object"?ju(e):e}function ju(e){return new Proxy(e,{get(n,t){if(!Is.has(t))return ve(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Ku(e,n){return new Proxy(e,{apply:(t,r,o)=>Gu(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!Is.has(r))return ve(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Gu(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>ve(n,void 0),n=>{throw ve(n,void 0)}):ve(e,void 0)}function Zu(e){let n=Object.create(null),t=Ve.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Ve.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),a=Ve.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),c=Ve.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=ve(e.corsair,void 0),n.__payload=o,n.__step=a,n.__console=c;let u=Ve.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});u.catch(()=>{});let l,d=new Promise((p,g)=>{l=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([u,d]).finally(()=>clearTimeout(l))}async function io(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(a,s)=>{if(o)throw o;let c=r++,u=xs(a,c);if(Object.hasOwn(n,u))return ve(n[u].output,void 0);try{let l=await s();return t.push({stepId:u,name:a,seq:c,status:"completed",output:l}),l}catch(l){if(As(l))throw l;let d=Jt(l);t.push({stepId:u,name:a,seq:c,status:"failed",error:d});let p=new Error(d);throw p[Rs]=a,p}});i.sleep=async(a,s)=>{if(o)throw o;let c=r++,u=xs(a,c);if(Object.hasOwn(n,u))return;t.push({stepId:u,name:a,seq:c,status:"completed",output:null});let l=Number.isFinite(s)?Math.max(0,s):0;throw o=new oo(Date.now()+l,a),o};try{await Zu({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??qu});let a=o;return a?{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(a){if(As(a))return{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()};let s=Jt(a),c=a!==null&&typeof a=="object"?a[Rs]:void 0;return{status:"failed",steps:t,error:{message:s,...c?{failedStep:c}:{}}}}}import*as Vt from"vm";var Ss=1e4;async function so(e){let n=Object.create(null),t=Vt.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=ve(e.corsair,void 0);let r=Ju(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await qr(()=>{let a=Vt.runInContext(o,t,{filename:"corsair:probe",timeout:r});a.catch(()=>{});let s,c=new Promise((u,l)=>{s=setTimeout(()=>l(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([a,c]).finally(()=>clearTimeout(s))});return{status:"ok",value:zu(i)}}catch(i){return{status:"error",error:Jt(i)}}}function zu(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function Ju(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?Ss:Math.min(e,Ss)}function Ye(e){return e.deliveryMode==="auth.credentials"}function Yn(e){return e.deliveryMode==="connections.sync"}function Yt(e){return e.deliveryMode==="connect.create_link"}function Qn(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function Xn(e){return e.deliveryMode==="oauth.tokens"}function Qt(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!Ye(e)&&!Yn(e)&&!Yt(e)&&!Qn(e)&&!Xn(e)}function Vu(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function Yu(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await Vn(e,n)}}}}}catch(t){return{status:"failed",retryable:to(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function Qu(e,n){try{let t=await xt(e,n);return Vu(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function ao(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function Xu(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await Tt({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function el(e,n,t,r){let o=await Xu(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},a=await Ps(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!a.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(a.response&&a.response.success===!1)return{status:"failed",retryable:!1,error:typeof a.response.error=="string"?a.response.error:"Webhook handler failed"};let s=a.response?.returnToSender,c=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(a.response?.data??a.response);return{status:"ok",webhookResponse:{status:a.response?.statusCode??200,body:c,headers:a.responseHeaders}}}async function nl(e,n){return await Zn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function tl(e,n){return await _n(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function uo(e,n,t){let r=await co(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function co(e,n,t){let r=v(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function rl(e,n){try{return await Gt(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function ol(e,n){try{return await ro(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function _s(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function il(e,n){try{let t=_s(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await io({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function sl(e,n){try{let t=_s(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await so({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function et(e,n,t={}){let r=v(e),o=ao(n.headers,"x-corsair-signature"),i=ao(n.headers,"x-corsair-timestamp"),a=ao(n.headers,"x-corsair-nonce"),s=!1;if(t.signingSecret?.trim()){let u=In({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!u.ok)return{status:"failed",retryable:!1,error:u.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let l=zt(`nonce:${a.trim()}`,je);if(!l.ok)return{status:"failed",retryable:!1,error:l.error};s=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let c;try{c=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(c.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(c.type){case"webhook":return el(e,r,c.payload,s);case"oauth.callback":return nl(e,c.payload);case"oauth.tokens":return tl(e,c.payload);case"permission.approve":return co(e,c.payload,"approved");case"permission.deny":return co(e,c.payload,"denied");case"auth.credentials":return rl(e,c.payload);case"integration.credentials":return ol(e,c.payload);case"connect.create_link":return Qu(e,c.payload);case"connections.sync":{let u=t.signingSecret?.trim();return u?Yu(e,u):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?il(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?sl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(c.type)}`}}}function al(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var lo=3,cl=250;function ul(e){return e?.name==="AbortError"}async function ll(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function dl(e,n,t,r,o){for(let i=1;i<=lo;i++){try{let a=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(a.ok)return await ll(a)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(a){if(ul(a))throw a}i<lo&&await Os(cl)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${lo} attempts; the run may be retried`),!1}async function pl(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:a,body:s,headers:c}=await i.json(),u=await t.process(e,{headers:c,body:s},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:l,body:d}=al(u);return await dl(n,t,o,{deliveryId:a,status:l,body:d},r)?"handled":"error"}var Es=1e3,gl=5e3,fl=3e4;function Os(e){return new Promise(n=>setTimeout(n,e))}var Xt=globalThis.__corsairConnectLoops??=new Map;function yl(e,n={fetch,process:et}){let t;try{t=L(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(Xt.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");Xt.set(r,o);let i=()=>{Xt.get(r)===o&&Xt.delete(r)},a=!1,s=null;return(async()=>{let u=Es,l=!1,d=async p=>{l||(console.warn("[corsair] connect loop error; retrying",p),l=!0),a||await Os(u),u=Math.min(u*2,gl)};try{for(;!a;){s=new AbortController;let p=setTimeout(()=>s?.abort(),fl);try{await pl(e,t,n,s.signal)==="error"?await d("pull or ack failed"):(l=!1,u=Es)}catch(g){if(a)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{a=!0,s?.abort(),i()}}}function Ds(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function ml(e,n){return n&&!n.has(e.id)?!1:E(e)!==null}async function Ms(e,n,t={}){let r=v(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,a=await Kn(r,o,{pluginIds:t.pluginIds}),s=new Map(a.map(u=>[u.plugin,u])),c=r.plugins.filter(u=>ml(u,i)).map(u=>{let l=E(u),d=s.get(u.id);return d?{plugin:u.id,providerName:Ee(u.id),authKind:Ds(l),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:u.id,providerName:Ee(u.id),authKind:Ds(l),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:c}}async function Hs(e,n){let t=L(e);return G({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:ct})}function hl(e){return typeof e=="string"&&e.length>0}function er(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty managed pricing credentials payload");let n=e;if(!hl(n.api_key))throw new Error("Hub API returned incomplete managed pricing credentials (expected api_key)");let t={api_key:n.api_key};return n.expires_in!==void 0&&typeof n.expires_in=="number"&&Number.isFinite(n.expires_in)&&n.expires_in>0&&(t.expires_in=n.expires_in),t}var Bs=1024*1024,Us=3e4;function Qe(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:Bs}function Xe(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:Us}function En(e){return new w(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function bl(e){return new w(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function nr(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o(bl(n)),n)})])}finally{clearTimeout(t)}}async function tr(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:s,value:c}=await nr(()=>t.read(),n.bodyStallTimeoutMs);if(s)break;if(o+=c.byteLength,o>n.maxBodyBytes)throw En(n.maxBodyBytes);r.push(c)}let i=new Uint8Array(o),a=0;for(let s of r)i.set(s,a),a+=s.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var po=new Map;function Ls(e){let n;try{n=L(e)}catch{return}let t=Cr(n);t&&po.get(n.projectApiKey)!==t&&(po.set(n.projectApiKey,t),S({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{po.delete(n.projectApiKey)}))}var kl=[".corsair.dev"];function wl(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function Cl(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:wl(n)?!0:kl.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function Fs(e){return!e||!Cl(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function Ns(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function go(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function fo(e,n){let t=L(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=De(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=zt(`browser:${i.jti}`,Oe);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(Yn(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let s=await Vn(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:s}}})}}if(Yt(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let s=i.connectLinkPlugins?.filter(Boolean)??[];if(s.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let c=await xt(e,{tenantId:i.tenantId,plugins:s});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:c.connectUrl,expiresAt:c.expiresAt}})}}if(Ye(i))return i.hubSuccessUrl?i.credentials?(await Gt(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:go(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:go(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(Qn(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await uo(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(Xn(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await _n(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!Qt(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await Zn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(s){let c=s instanceof Error?s.message:"Hub delivery failed";return Yn(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:Yt(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:Ye(i)&&i.hubSuccessUrl?{type:"redirect",url:go(i.hubSuccessUrl,{error:c})}:Ye(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:{type:"json",status:400,body:{error:c}}}return{type:"redirect",url:i.hubSuccessUrl}}async function yo(e,n){let t=L(e),r=await et(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,a=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:a}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:a}}function mo(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function ho(e,n){return n.method==="GET"?fo(e,n.url):yo(e,{headers:n.headers,body:n.body??""})}async function bo(e,n){try{let t=await ho(e,n);return mo(t)}catch(t){if(t instanceof ke)return Response.json({error:t.message},{status:503});throw t}}async function en(e,n,t){Ls(e);let r=n.method.toUpperCase(),o=Fs(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await bo(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await tr(n,{maxBodyBytes:Qe(t?.maxBodyBytes),bodyStallTimeoutMs:Xe(t?.bodyStallTimeoutMs)}):void 0});return Ns(i,o)}var _=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function On(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function Dn(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var $s=new WeakMap;function nn(e,n,t){let r=$s.get(e);r||(r=new Map,$s.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var Ws=300;async function ko(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,a=n?.forceRefresh??!1,s=`managed:${o}:${i}`;return nn(t,s,async()=>{let[c,u,l]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!c&&!l)throw new _(o,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&c&&u&&Number(u)>d+Ws)return{accessToken:c,expiresAt:Number(u),refreshed:!1};if(!l&&c&&!a){let f=u?Number(u):null;if(f===null||f>d+Ws)return{accessToken:c,expiresAt:f??d+3600,refreshed:!1}}if(!l)throw new _(o,"managed");let p=await vl(r,o,i,l),g=await Dn(t,p,u);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function Tl(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function vl(e,n,t,r){try{return await S({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:pn})}catch(o){let i=o instanceof Error?o.message:"";throw Tl(i)?new _(n,"managed"):o}}async function qs(e,n){e._refreshAuth=async()=>(await ko(n,{forceRefresh:!0})).accessToken}var Pl="",Rl=60,wo=new WeakMap;function js(e){let n=dt(e.apiUrl),t=e.instanceKey?.trim()??"";return[encodeURIComponent(n),encodeURIComponent(e.projectApiKey),encodeURIComponent(t)].join(Pl)}function Al(e,n,t,r){let i=`${js(e)}:${n}:${t}`;return r?`${i}:${r}`:i}function xl(e,n){return wo.get(e)?.get(n)}function Il(e,n,t){let r=wo.get(e);r||(r=new Map,wo.set(e,r)),r.set(n,t)}function Sl(e,n){return e.expiresAt===null?!1:e.expiresAt>n+Rl}function Co(e,n){if(!n)throw new _(e,"managed_pricing",`[auth-missing:${e}:managed_pricing]: Hub config is required. Pass hub: { ... } to createCorsair().`)}async function Ks(e,n){Co(e.plugin,e.hub);let t=n?.forceRefresh??!1,r=Al(e.hub,e.plugin,e.tenantId,n?.operation),i=`managed_pricing:${t?"force":"routine"}:${r}`;return nn(e.cache,i,async()=>{let a=Math.floor(Date.now()/1e3);if(!t){let u=xl(e.cache,r);if(u&&Sl(u,a))return{apiKey:u.apiKey,expiresAt:u.expiresAt,fromCache:!0}}let s=await S({hub:e.hub,path:"/managed-pricing/credentials",body:{plugin:e.plugin,tenantId:e.tenantId,...n?.operation?{operation:n.operation}:{}},notFoundMessage:"Managed pricing is not configured for this project",parseResponse:er}),c=s.expires_in!==void 0?a+s.expires_in:null;return Il(e.cache,r,{apiKey:s.api_key,expiresAt:c}),{apiKey:s.api_key,expiresAt:c,fromCache:!1}})}function Gs(){return{}}function Zs(e){return{delivery:n=>en(e,n),deliveryOptions:n=>en(e,n)}}var zs=1200*1e3;function To(){return be()}function vo(){return zs}function Po(e,n){return Nn(e,n,zs)}function Ro(e,n){return de(e,n)}function Ao(e){return Ke(e)}var Js=600*1e3;function xo(){return be()}function Io(){return Js}function So(e,n){return Nn(e,n,Js)}function _o(e,n){return de(e,n)}function Eo(e){return Ir(e)}function Oo(e){return Ke(e)}function Do(){return be()}function Mo(e,n,t){return gt(e,n,Math.floor(t.getTime()/1e3))}function Ho(e,n){return de(e,n)}function Bo(e){return Ke(e)}var tn=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${Ge}`),this.name="CorsairKekMissingError"}};function rr(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new tn;let a=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${Ge}`)}})}async function _l(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function Vs(e){let{integrationId:n,accountId:t}=await _l(e);return{integrationId:n,accountId:t}}function Ys(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>Tr(t(),{tenantId:n,message:r}),list:()=>Pr(t(),{tenantId:n}),get:r=>({message:o=>vr(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>Rr(t(),{chatId:r,tenantId:n})})}}function Qs(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function El(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await as(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):Qs(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function Ol(e,n,t){let r=bn(Be(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):Qs(e,i),connectUrl:i}}async function Dl(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.error.authType==="managed_pricing"?{message:e.error.message,connectUrl:null}:e.manual&&Pn(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?Ol(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?El({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function Xs(e){let{message:n,connectUrl:t}=await Dl(e);throw new _(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var or="connect.request",Lo="connect.cleared",Ml=600*1e3;async function Uo(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function Hl(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function Bl(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[or,Lo]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function ea(e,n,t,r,o){let i=await Bl(e,n,o),a=new Date(i);await e.db.insertInto("corsair_events").values({id:dn(),created_at:a,updated_at:a,account_id:n,event_type:t,payload:r}).execute()}async function Ul(e,n,t=Date.now()){let r=await Uo(e,n.tenantId,n.plugin);r&&await ea(e,r,or,{plugin:n.plugin,connectUrl:n.connectUrl},t)}function Ll(e){let n=e;if(typeof e=="string")try{n=JSON.parse(e)}catch{return null}return!n||typeof n!="object"||Array.isArray(n)?null:n}async function Fl(e,n,t,r,o){let i=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[or,Lo]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!i||i.event_type!==or)return null;let a=i.created_at instanceof Date?i.created_at.getTime():Date.parse(String(i.created_at));if(r-a>o)return null;let s=Ll(i.payload);if(!s)return null;let c=s.plugin,u=s.connectUrl;return typeof c!="string"||typeof u!="string"?null:{plugin:c,connectUrl:u,requestedAt:new Date(a).toISOString(),tenantId:t,requestedAtMs:a,accountId:n}}async function Fo(e,n,t=Date.now(),r=Ml){let o=await Hl(e,n);if(o.length===0)return null;let i=(await Promise.all(o.map(u=>Fl(e,u,n,t,r)))).filter(u=>u!==null);if(i.length===0)return null;i.sort((u,l)=>u.requestedAtMs-l.requestedAtMs||u.accountId.localeCompare(l.accountId));let{requestedAtMs:a,accountId:s,...c}=i[0];return c}async function na(e,n,t=Date.now(),r){let o;if(r)o=await Uo(e,n,r);else{let i=await Fo(e,n,t);o=i?await Uo(e,n,i.plugin):null}o&&await ea(e,o,Lo,{},t)}async function No(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await Ul(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl})}catch{}}var Nl=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function ta(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(o).find(u=>o[u]?.match(e,i));return await(o[a||"DEFAULT"]?.handler||Nl)(e,i)}function $l(e){return typeof e=="function"}function $o({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:a=[],keyBuilder:s,permissionsConfig:c,endpointMeta:u,database:l,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:T}){for(let[P,M]of Object.entries(e)){let D=n?.[P];if($l(M)){let H=D,C=[...a,P].join("."),R=async(x={})=>{let ee=u?.[C];Je(C,ee?.riskLevel??"write");let re;if(c){let W=ee,{result:ue,reason:j,onComplete:Bn,token:Ie,id:qe,expiresAt:oe}=await gs({pluginId:o,endpointPath:C,args:x,mode:c.mode,override:c.overrides?.[C],riskLevel:W?.riskLevel??"write",meta:W,db:l,timeoutMs:d?jr(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(ue==="blocked"){let le;j==="denied"?le=`Action '${C}' was denied by the user. Await further instructions before proceeding.`:j==="policy"?le=`Action '${C}' is blocked by the permission policy. Update the corsair config to allow it.`:j==="timeout"?le=`Action '${C}' timed out waiting for approval.`:Ie&&qe?le=await Wr({permissionsOptions:d,manual:g,hub:f,permissionId:qe,permissionToken:Ie,plugin:o,endpoint:C,args:x,tenantId:p??"default",expiresAt:oe??new Date(Date.now()+(d?jr(d.timeout):600*1e3)).toISOString(),operationPath:C}):le=`Action '${C}' requires user approval before it can run.`;let hr=j==="denied"||j==="policy"||j==="timeout"?j:"pending";throw new Ue(le,hr)}re=Bn}let B=async(W,ue,j)=>{try{return await M(ue,j)}catch(Bn){if(Bn instanceof Error){let Ie=await ta(Bn,o,C,typeof j=="object"&&j!==null?j:{args:j},i);if(W<(Ie.maxRetries||0)){let qe=W+1;console.log(`Retrying (${qe} / ${Ie.maxRetries})...`);let oe;if(Ie.headersRetryAfterMs)oe=Ie.headersRetryAfterMs;else switch(Ie.retryStrategy){case"exponential_backoff":oe=Math.pow(2,qe-1)*1e3;break;case"exponential_backoff_jitter":let le=Math.pow(2,qe-1)*1e3,hr=(Math.random()-.5)*1e3;oe=Math.max(0,le+hr);break;case"linear_1s":oe=1e3;break;case"linear_2s":oe=2e3;break;case"linear_3s":oe=3e3;break;case"linear_4s":oe=4e3;break;default:oe=1e3;break}return await new Promise(le=>setTimeout(le,oe)),await B(qe,ue,j)}}throw Bn}},$;try{$=s?await s(t,"endpoint"):void 0}catch(W){if(W instanceof he)throw h&&f&&wn({hub:f,database:l,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await No(l,{tenantId:W.tenantId??p,plugin:W.plugin,connectUrl:W.connectUrl}),W;if(W instanceof _){h&&f&&wn({hub:f,database:l,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1});try{await Xs({error:W,manual:g,hub:f,plugin:h,tenantId:p,database:l,kek:b,plugins:k,multiTenancy:T})}catch(ue){throw ue instanceof _&&await No(l,{tenantId:ue.tenantId??p,plugin:ue.pluginId,connectUrl:ue.connectUrl}),ue}}throw W}if(!H?.before&&!H?.after){let W=await B(0,{...t,key:$},x);return await re?.(),h&&f&&wn({hub:f,database:l,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),W}let xe={...t,key:$},We=H.before?await H.before(xe,x):{ctx:xe,args:x,continue:!0,passToAfter:void 0};if(We.continue===!1)return;let li=await B(0,We.ctx,We.args);return await H.after?.(We.ctx,li,We.passToAfter),await re?.(),h&&f&&wn({hub:f,database:l,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),li};r[P]=R}else if(M&&typeof M=="object"){let H={};$o({endpoints:M,hooks:D,ctx:t,tree:H,pluginId:o,errorHandlers:i,currentPath:[...a,P],keyBuilder:s,permissionsConfig:c,endpointMeta:u,database:l,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:T}),r[P]=H}}}function Wl(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Wo({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,a]of Object.entries(e)){let s=n?.[i];if(Wl(a)){let c=s,u=async l=>{let d=(g,f)=>a.handler(g,f),p=o&&l?.hubVerified!==!0?await o(t,"webhook"):void 0;return!c?.before&&!c?.after?d({...t,key:p},l):(async()=>{let g={...t,key:p},f=c.before?await c.before(g,l):{ctx:g,args:l,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await c.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:a.match,handler:u}}else if(a&&typeof a=="object"){let c={};Wo({webhooks:a,hooks:s,ctx:t,webhooksTree:c,keyBuilder:o}),r[i]=c}}}function ra(e){return e&&typeof e=="object"?e:{}}async function oa(e,n){return G({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=ra(t).workflows;return Array.isArray(r)?r:[]}})}async function ia(e,n){return G({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>ra(t).workflow})}async function sa(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function aa(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function ca(e,n){return S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function qo(e){return e&&typeof e=="object"?e:{}}async function ua(e,n){return G({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=qo(t).runs;return Array.isArray(r)?r:[]}})}async function la(e,n){return G({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=qo(t).runs;return Array.isArray(r)?r:[]}})}async function da(e,n){return G({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>qo(t).run})}async function jo(e,n,t){await S({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var pa=(e,n)=>jo(e,"approve",n),ga=(e,n)=>jo(e,"deny",n),fa=(e,n)=>jo(e,"cancel",n);function ya(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?la(t(),{workflowId:r.workflowId,tenantId:n}):ua(t(),{tenantId:n}),get:r=>da(t(),{runId:r,tenantId:n}),approve:r=>pa(t(),{runId:r,tenantId:n}),deny:r=>ga(t(),{runId:r,tenantId:n}),cancel:r=>fa(t(),{runId:r,tenantId:n})}}function ma(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>sa(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>oa(t(),{tenantId:n}),get:o=>ia(t(),{workflowId:o,tenantId:n}),run:(o,i)=>ca(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:ya(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>aa(t(),{workflowId:o,tenantId:n,name:i})}}function ql(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await Vs({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function jl(e,n,t,r,o){return e?br(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function Ko(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:a,manualConfig:s,hubConfig:c,internalConfig:u}=n,l=r??"default",d=u&&t?()=>hn(u,l):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=ql(t,f.id,l,d);if(h?.entities){let B={};for(let[$,xe]of Object.entries(h.entities)){let We=t?br(t.db,b,$,h.version,xe):jl(void 0,b,$,h.version,xe);B[$]=We}g[f.id].db=B,p[f.id].db=B}let k=f.options,T=f.authConfig,P;if(t&&o&&k?.authType){let B=T?.[k.authType]?.account??[];P=U({authType:k.authType,integrationName:f.id,tenantId:l,kek:o,database:t,extraAccountFields:B,ensureProvisioned:d}),p[f.id].keys=P}let M={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...P?{keys:P,authType:k?.authType}:{},tenantId:l,...c?{hub:c}:{}},D=f.endpoints??{},H=f.hooks,C={...i,...f.errorHandlers},R={},x=f.options?.permissions;$o({endpoints:D,hooks:H,ctx:M,tree:R,pluginId:f.id,errorHandlers:C,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:x,endpointMeta:f.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:f.oauthConfig,kek:o,tenantId:l}:void 0,hubConfig:c,plugin:f,kek:o,allPlugins:e,multiTenancy:u?.multiTenancy}),Object.keys(R).length>0&&(p[f.id].api=R),M.endpoints=R;let ee=f.webhooks??{},re=f.webhookHooks;if(Object.keys(ee).length>0&&!ki(k?.authType)){let B={};Wo({webhooks:ee,hooks:re,ctx:M,webhooksTree:B,keyBuilder:f.keyBuilder}),p[f.id].webhooks=B,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=Ys(c,l),p.workflows=ma(c,l),p}function ha(e,n,t){let r={};for(let o of e){let i=o.options,a=o.authConfig;if(i?.authType){let s=a?.[i.authType]?.integration??[],c=F({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:s});r[o.id]=c}}return r}var rn={findByEntityId:"read",existsByEntityId:"read",findIdByEntityId:"read",findById:"read",findManyByEntityIds:"read",list:"read",search:"read",count:"read",upsertByEntityId:"write",deleteById:"destructive",deleteByEntityId:"destructive"},Kl=/^\$+date$/;function ba(e){if(typeof e!="object"||e===null||Array.isArray(e))return null;let n=Object.keys(e),t=n[0];return n.length!==1||!t||!Kl.test(t)?null:typeof e[t]=="string"?t:null}function on(e){if(e instanceof Date)return{$date:e.toISOString()};if(Array.isArray(e))return e.map(on);let n=ba(e);return n?{[`$${n}`]:e[n]}:e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,on(r)])):e}function sn(e){let n=ba(e);if(n){let t=e[n];if(n!=="$date")return{[n.slice(1)]:t};let r=new Date(t);if(Number.isNaN(r.getTime()))throw N(`Invalid $date value "${t}" \u2014 expected an ISO 8601 timestamp`);return r}return Array.isArray(e)?e.map(sn):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,sn(r)])):e}async function Go(e,n,t){let r=Object.hasOwn(rn,n.method)?rn[n.method]:void 0;if(!r)throw new w(404,"unknown_db_method",`Unknown db method "${n.method}" \u2014 expected one of ${Object.keys(rn).join(", ")}`);Je(`${n.plugin}.db.${n.entityType}.${n.method}`,r);let i=e?.[n.plugin]?.db;if(!i)throw new w(404,"unknown_plugin",`Plugin "${n.plugin}" has no entity store`);let a=Object.hasOwn(i,n.entityType)?i[n.entityType]:void 0,s=a?.[n.method];if(typeof s!="function")throw new w(404,"unknown_entity_type",`Plugin "${n.plugin}" has no entity type "${n.entityType}"`);return s.apply(a,t)}var Gl=3e4;function ir(e){let n=e.length;for(;n>0&&e[n-1]==="/";)n--;return e.slice(0,n)}function Zl(e){let n=0;for(;n<e.length&&e[n]==="/";)n++;return e.slice(n)}function zl(e,n){return`${ir(e)}/${Zl(n)}`}function Jl(e,n){let t=n??{},{error:r,message:o,...i}=t;return typeof r!="string"?new w(e,"internal_error","Internal error"):new w(e,r,o,i)}var Zo=Symbol("cloudRequestTimeout");async function Z(e,n,t,r){let o=e.fetch??globalThis.fetch,i=e.timeoutMs??Gl,a=new AbortController,s,c=new Promise(p=>{s=setTimeout(()=>{a.abort(),p(Zo)},i)}),u;try{let p=o(zl(e.baseUrl,t),{method:n,headers:{authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"},body:r===void 0?void 0:JSON.stringify(r),signal:a.signal}).catch(f=>{if(a.signal.aborted)return Zo;throw f}),g=await Promise.race([p,c]);if(g===Zo)throw new w(0,"internal_error","Cloud request timed out");u=g}finally{clearTimeout(s)}let l=await u.text(),d;try{d=l?JSON.parse(l):void 0}catch{d=void 0}if(!u.ok)throw Jl(u.status,d);if(d===void 0)throw new w(u.status,"internal_error","Invalid or empty response body from runtime");return d}var z={invoke:"/:tenant/:plugin/call/:op",entityDb:"/:tenant/:plugin/db/:entity/:method",instances:"/instances",connectLinks:"/connect/links",tenants:"/tenants",tenant:"/tenants/:id",connectionStatus:"/connection-status",disconnect:"/disconnect",permission:"/permissions/:id",permissionLookup:"/permissions/lookup-by-token"};var Vl=new Set(["keys","webhooks"]),Yl=new Set(["chats","workflows"]),zo=new Set(["then","catch","finally"]);function me(e){return typeof e=="function"?e():Promise.resolve(e)}function ka(e,n,t,r){let o=async(...i)=>{let a=await me(e);return(await Z(a,"POST",z.invoke.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":op",r.map(encodeURIComponent).join(".")),{args:i[0]})).data};return new Proxy(o,{get(i,a){if(!(typeof a!="string"||zo.has(a)))return ka(e,n,t,[...r,a])}})}function Ql(e,n,t){return new Proxy({},{get(r,o){if(!(typeof o!="string"||zo.has(o)))return new Proxy({},{get(i,a){if(typeof a!="string")return;let s=Object.hasOwn(rn,a)?rn[a]:void 0;if(s)return async(...c)=>{Je(`${t}.db.${o}.${a}`,s);let u=await me(e),l=await Z(u,"POST",z.entityDb.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":entity",encodeURIComponent(o)).replace(":method",encodeURIComponent(a)),{args:on(c)});return sn(l.data)}}})}})}function sr(e,n){let t=e?new Set(e.map(r=>r.id)):null;return new Proxy({},{get(r,o){if(!(typeof o!="string"||zo.has(o))){if(Yl.has(o))throw new Error(`"${o}" is not available in cloud mode (deferred)`);if(t&&!t.has(o))throw new Error(`Unknown plugin "${o}"`);return new Proxy({},{get(i,a){if(a==="api")return ka(n.transport,n.tenantId,o,[]);if(a==="db")return Ql(n.transport,n.tenantId,o);if(typeof a=="string"&&Vl.has(a))throw new Error(`"${a}" is not available in cloud mode (deferred)`)}})}}})}function ar(e){return{connect:{createLink:n=>{if(!n.plugin||!n.tenantId)throw new Error('connect.createLink requires both "plugin" and "tenantId" in cloud mode');return me(e).then(t=>Z(t,"POST",z.connectLinks,n))}},tenants:{create:n=>me(e).then(t=>Z(t,"POST",z.tenants,n)),list:()=>me(e).then(n=>Z(n,"GET",z.tenants)),get:n=>me(e).then(t=>Z(t,"GET",z.tenant.replace(":id",encodeURIComponent(n))))},connectionStatus:{get:n=>me(e).then(t=>Z(t,"GET",`${z.connectionStatus}?tenantId=${encodeURIComponent(n.tenantId)}`))},disconnect:n=>me(e).then(t=>Z(t,"POST",z.disconnect,n)),permissions:{get:n=>me(e).then(t=>"id"in n?Z(t,"GET",z.permission.replace(":id",encodeURIComponent(n.id))):Z(t,"POST",z.permissionLookup,{token:n.token}))}}}var Pe=class extends w{type;retryable;param;docUrl;requestId;constructor(n,t){super(n,t.code,t.message,{...t}),this.name="CloudApiError",this.type=t.type??"api_error",this.retryable=t.retryable??(n===0||n===429||n>=500),this.param=t.param,this.docUrl=t.doc_url,this.requestId=t.request_id}};function nt(e,n,t){let r=t?.get("request-id")?.trim()||void 0,i=(n??{}).error;if(typeof i=="string"){let a=n.message;return new Pe(e,{code:i,message:typeof a=="string"?a:void 0,request_id:r})}return i&&typeof i=="object"&&typeof i.code=="string"?new Pe(e,{request_id:r,...i}):new Pe(e,{code:e===0?"request_failed":"internal_error",message:`Corsair Cloud returned ${e} with no error body`,request_id:r})}var Xl=3e4,ed=new Set(["GET","HEAD","PUT","DELETE"]),nd=/^[a-z][a-z0-9-]{0,31}$/;function an(e,n){if(!nd.test(e))throw new Error(`${n}: "${e}" is not a valid instance key. Lowercase letter first, then letters, digits or hyphens, up to 32 characters.`)}function cn(e){let n=new URLSearchParams;for(let[r,o]of Object.entries(e))o!==void 0&&n.set(r,String(o));let t=n.toString();return t?`?${t}`:""}function A(e,n){return`${e}/${encodeURIComponent(n)}`}async function cr(e,n,t,r,o={}){let i=e.fetch??globalThis.fetch,a=new AbortController;o.signal?.aborted&&a.abort();let s=()=>a.abort();o.signal?.addEventListener("abort",s,{once:!0});let c=setTimeout(()=>a.abort(),e.timeoutMs??Xl),u={authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"};e.apiVersion&&(u["corsair-version"]=e.apiVersion),o.idempotencyKey&&(u["idempotency-key"]=o.idempotencyKey),o.requestId&&(u["x-corsair-request-id"]=o.requestId);let l;try{l=await i(`${e.baseUrl}${t}`,{method:n,headers:u,body:r===void 0?void 0:JSON.stringify(r),signal:a.signal});let d=await l.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!l.ok)throw nt(l.status,p,l.headers);if(p===void 0&&l.status!==204)throw nt(l.status,void 0,l.headers);return p}catch(d){if(o.signal?.aborted||d instanceof Pe)throw d;let p=ed.has(n),g=l?p?!0:void 0:p||!!o.idempotencyKey;throw nt(l?.status??0,{error:{code:"request_failed",message:d instanceof Error?d.message:String(d),retryable:g}},l?.headers)}finally{clearTimeout(c),o.signal?.removeEventListener("abort",s)}}function Jo(e,n){an(n,"withInstance");let t=(s,c,u,l)=>cr(e,s,c,u,l),r=(...s)=>[n,...s].join(":"),o=s=>cn({...s,instance:n}),i=s=>`${A("/instances",n)}${s}`,a=s=>`${A("/webhooks",r(s))}/deliveries`;return{instanceKey:n,tenants:{list:(s={},c)=>t("GET",`/tenants${o(s)}`,void 0,c),create:(s,c)=>t("POST","/tenants",{...s,instance:n},c),get:(s,c)=>t("GET",A("/tenants",r(s)),void 0,c),update:(s,c,u)=>t("PATCH",A("/tenants",r(s)),c,u),delete:(s,c)=>t("DELETE",A("/tenants",r(s)),void 0,c)},access:{list:(s={},c)=>t("GET",`/access${o(s)}`,void 0,c),get:(s,c)=>t("GET",A("/access",r(s)),void 0,c),set:(s,c,u)=>t("PUT",A("/access",r(s)),c,u),revoke:(s,c)=>t("DELETE",A("/access",r(s)),void 0,c)},connections:{list:(s={},c)=>t("GET",`/connections${o(s)}`,void 0,c),get:(s,c,u)=>t("GET",A("/connections",r(s,c)),void 0,u),delete:(s,c,u)=>t("DELETE",A("/connections",r(s,c)),void 0,u)},connect:{createSession:(s,c)=>t("POST","/connect/sessions",{...s,instance:n},c)},integrations:{list:(s={},c)=>t("GET",`/integrations${o(s)}`,void 0,c),get:(s,c)=>t("GET",A("/integrations",r(s)),void 0,c),put:(s,c,u)=>t("PUT",A("/integrations",r(s)),c,u),delete:(s,c)=>t("DELETE",A("/integrations",r(s)),void 0,c),operations:(s,c)=>t("GET",`${A("/integrations",r(s))}/operations`,void 0,c),oauthApp:{get:(s,c)=>t("GET",`${A("/integrations",r(s))}/oauth-app`,void 0,c),put:(s,c,u)=>t("PUT",`${A("/integrations",r(s))}/oauth-app`,c,u),delete:(s,c)=>t("DELETE",`${A("/integrations",r(s))}/oauth-app`,void 0,c)}},webhooks:{list:(s={},c)=>t("GET",`/webhooks${o(s)}`,void 0,c),create:(s,c)=>t("POST","/webhooks",{...s,instance:n},c),get:(s,c)=>t("GET",A("/webhooks",r(s)),void 0,c),delete:(s,c)=>t("DELETE",A("/webhooks",r(s)),void 0,c),rotateSecret:(s,c,u)=>t("POST",`${A("/webhooks",r(s))}/rotate-secret`,c,u),deliveries:{list:(s,c={},u)=>t("GET",`${a(s)}${cn(c)}`,void 0,u),get:(s,c,u)=>t("GET",A(a(s),c),void 0,u),retry:(s,c,u)=>t("POST",`${A(a(s),c)}/retry`,void 0,u)}},signingSecret:{get:s=>t("GET",i("/signing-secret"),void 0,s),rotate:s=>t("POST",i("/signing-secret/rotate"),void 0,s)},apply:s=>t("POST",i("/apply"),void 0,s),removeFromRuntime:s=>t("POST",i("/remove"),void 0,s),reconcile:s=>t("POST",i("/reconcile"),void 0,s)}}function Vo(e){let n=(t,r,o,i)=>cr(e,t,r,o,i);return{project:{get:t=>n("GET","/project",void 0,t)},keys:{get:t=>n("GET","/keys",void 0,t),rotate:t=>n("POST","/keys/rotate",void 0,t)},instances:{list:(t={},r)=>n("GET",`/instances${cn(t)}`,void 0,r),create:(t,r)=>(an(t.instance_key,"instances.create"),n("POST","/instances",t,r)),get:(t,r)=>(an(t,"instances.get"),n("GET",A("/instances",t),void 0,r)),update:(t,r,o)=>(an(t,"instances.update"),n("PATCH",A("/instances",t),r,o)),delete:(t,r)=>(an(t,"instances.delete"),n("DELETE",A("/instances",t),void 0,r))},integrations:{catalog:(t={},r)=>n("GET",`/integrations/catalog${cn(t)}`,void 0,r)},mcp:{links:{list:(t={},r)=>n("GET",`/mcp/links${cn(t)}`,void 0,r),mint:(t,r)=>n("POST","/mcp/links",t,r),get:(t,r)=>n("GET",A("/mcp/links",t),void 0,r),update:(t,r,o)=>n("PATCH",A("/mcp/links",t),r,o),delete:(t,r)=>n("DELETE",A("/mcp/links",t),void 0,r),rotate:(t,r)=>n("POST",`${A("/mcp/links",t)}/rotate`,void 0,r)},tokens:{mint:(t,r)=>n("POST","/mcp/tokens",t,r)}}}}var wa="default",td="corsairCloud: the management API needs a ck_cloud_<slug>.<secret> key, or an explicit `managementUrl`.",rd=new Set(["then","catch","finally","toString","toJSON","valueOf","constructor","inspect",Symbol.toPrimitive,Symbol.toStringTag,Symbol.iterator,Symbol.asyncIterator]);function Yo(e={}){return new Proxy(e,{get(n,t,r){if(Reflect.has(n,t))return Reflect.get(n,t,r);if(!rd.has(t))throw new Error(td)}})}function Re(e){throw new Error(`"${e}" is not available in cloud mode (deferred)`)}function od(e){let n=e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim();if(!n)throw new Error("Cloud mode (ck_cloud_ key) requires a base URL \u2014 set hub.baseUrl or CORSAIR_CLOUD_URL.");return Un(n),n}function Ca(e){return!!(e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim())}function id(e,n){let t=ar(e);return{ok:()=>Re("manage.ok"),tenants:t.tenants,plugins:{list:()=>Re("manage.plugins.list"),get:()=>Re("manage.plugins.get")},connectionStatus:{get:r=>{let o=r?.tenantId||void 0;if(!o&&n)throw new Error("connectionStatus.get requires a tenantId in multi-tenant mode");return t.connectionStatus.get({tenantId:o??wa})}},permissions:t.permissions,connect:{createLink:t.connect.createLink,resolve:()=>Re("manage.connect.resolve"),oauthCallback:()=>Re("manage.connect.oauthCallback")},disconnect:t.disconnect}}function sd(e,n){let t=id(e,n.multiTenancy);if(n.multiTenancy)return{withTenant:a=>{if(!a)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return sr(n.plugins,{transport:e,tenantId:a})},get keys(){return Re("keys")},get permissions(){return Re("permissions")},manage:t};let r=sr(n.plugins,{transport:e,tenantId:wa}),o={manage:t,get keys(){return Re("keys")},get permissions(){return Re("permissions")}};return new Proxy(r,{get(a,s,c){return typeof s=="string"&&s in o?Reflect.get(o,s,c):Reflect.get(a,s,c)}})}function Ta(e){return sd({baseUrl:od(e.hub),apiKey:e.hub.projectApiKey},{multiTenancy:!!e.multiTenancy,plugins:e.plugins})}function ad(e){let n=ir(e),t="/api/corsair";return n.endsWith(t)?n.slice(0,-t.length):n}async function cd(e){let n=await Z({...e,baseUrl:ad(e.baseUrl)},"GET",z.instances),t=new Map;for(let r of n.instances)Un(r.url,`Instance "${r.instanceKey}" URL`),t.set(r.instanceKey,r.url);return t}function ud(e){let n=e.apiKey?.trim();if(!n)throw new Error("corsairCloud: apiKey is required");let t=di(n),r=e.url?.trim()||pi(n);if(!r)throw new Error("corsairCloud: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");Un(r);let o={baseUrl:r,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs},a=(ir(e.managementUrl?.trim()??"")||void 0)??(t?gi(r,t):null);a&&Un(a,"Management base URL");let s=a?{baseUrl:a,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs,apiVersion:e.apiVersion}:null,c=null;function u(g){return g&&c===g&&(c=null),c||(c=cd(o).catch(f=>{throw c=null,f})),c}async function l(g){let f=u(),b=(await f).get(g)??(await u(f)).get(g);if(b)return b;let k=[...(await u()).keys()].join(", ");throw new Error(`corsairCloud.withInstance("${g}"): no such instance \u2014 available: ${k||"(none)"}`)}let d=ar(o),p={tenants:d.tenants,permissions:d.permissions};return{manage:s?{...Vo(s),...p}:Yo(p),withInstance:g=>{let f=s?Jo(s,g):Yo(),h=async()=>({...o,baseUrl:await l(g)}),b=ar(h),k={withTenant(T){if(!T)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return sr(void 0,{transport:h,tenantId:T})},connectionStatus:b.connectionStatus,disconnect:b.disconnect,createConnectLink:b.connect.createLink};return s?{...f,...k}:Yo(k)}}}var ld="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function va(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${ld}`),t):n}var dd=e=>new w(404,"unknown_plugin",`Plugin '${e}' is not registered.`),pd=(e,n)=>new w(404,"unknown_op",`Operation '${n}' not found on plugin '${e}'.`),ur=(e="/call")=>new w(403,"call_disabled",`The ${e} route is disabled. Construct managementHandler with { unsafeAllowUnauthenticated: true } to enable it \u2014 only when your own backend fronts the handler.`),gd=e=>new w(401,"not_connected",`Tenant is not connected for plugin '${e}'. Reconnect and retry.`),Pa=e=>new w(403,"permission_denied",`The call was blocked (${e}).`,{reason:e}),fd=()=>new w(403,"approval_required","This action needs human approval before it can run. Approval is not resumable over HTTP in this version.",{reason:"pending"}),yd=(e,n)=>new w(502,"provider_error","The provider returned an error.",{providerStatus:e,body:n});function md(e,n){if(e instanceof w)return e;if(e instanceof _)return gd(e.pluginId||n);if(e instanceof Rn)return Pa("readonly");if(e instanceof Ue)return e.reason==="pending"?fd():Pa(e.reason);if(e instanceof Error&&e.name==="ApiError"){let t=e;return yd(typeof t.status=="number"?t.status:502,t.body)}return console.error("[corsair] unhandled error in call operation",e),new w(500,"internal_error","Internal error")}var hd=new WeakMap,Ra=new WeakMap,bd=512;function Aa(e,n){let t=e.get(n);return t||(t=new Map,e.set(n,t)),t}function kd(e,n,t){if(n.size<=bd)return;let r=Ra.get(e);for(let o of n.keys())if(o!==t&&(r?.get(o)??0)===0){n.delete(o);return}}function wd(e,n,t){if(!n.multiTenancy)return{client:e};let r=typeof t=="string"?t.trim():"";if(!r)throw N("tenant is required for a multi-tenant runtime",{missingFields:["tenant"]});let o=Aa(hd,e),i=o.get(r);if(i)return o.delete(r),o.set(r,i),{client:i,tenantId:r};let a=e.withTenant(r);return o.set(r,a),kd(e,o,r),{client:a,tenantId:r}}function Cd(e,n){let t=e;for(let r of n.split(".")){if(t==null||typeof t!="object"||!Object.prototype.hasOwnProperty.call(t,r))return null;t=t[r]}return typeof t=="function"?t:null}function xa(e,n=[]){let t=[];for(let[r,o]of Object.entries(e??{}))typeof o=="function"?t.push([...n,r].join(".")):o&&typeof o=="object"&&t.push(...xa(o,[...n,r]));return t}function Ia(e){let n={};for(let t of e.plugins)n[t.id]=xa(t.endpoints??{});return n}async function Qo(e,n,t,r){if(!n.plugins.some(s=>s.id===t.plugin))throw dd(t.plugin);let{client:o,tenantId:i}=wd(e,n,t.tenant),a=i?Aa(Ra,e):null;a&&i&&a.set(i,(a.get(i)??0)+1);try{return await r(o)}catch(s){throw md(s,t.plugin)}finally{if(a&&i){let s=(a.get(i)??1)-1;s<=0?a.delete(i):a.set(i,s)}}}async function Sa(e,n,{plugin:t,op:r,tenant:o,args:i}){return Qo(e,n,{plugin:t,tenant:o},a=>{let s=a[t],c=Cd(s?.api,r);if(!c)throw pd(t,r);return c(i??{})})}function un(e,n){if(e===void 0)return n;if(e===null)throw new w(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function tt(e){if(e!==void 0)throw new w(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var _a=[{method:"GET",pattern:"/ok",public:!0,handler:async()=>I(200,Et())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>(tt(n),I(200,await xn(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>(tt(t),I(201,await Mt(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(tt(t),I(200,await Dt(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>I(200,await An(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>I(200,await Ot(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>I(200,await Ht(e,un(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(tt(t),I(200,await Gr(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",public:!0,handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?I(200,await zr(e,t)):I(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=un(r,o.tenantId);return I(200,await Ut(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",public:!0,handler:async({corsair:e,internal:n,query:t})=>I(200,await Lt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",public:!0,handler:async({corsair:e,internal:n,body:t})=>I(200,await Ft(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=un(t,n.tenantId)??"default",o=e.database?await Fo(e.database,r):null;return I(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=un(t,r?.tenantId)??"default";return e.database&&await na(e.database,o,void 0,r?.plugin),I(200,{ok:!0})}},{method:"POST",pattern:"/disconnect",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n??{},o=un(t,r.tenantId);return I(200,await Bt(e,{...r,tenantId:o}))}},{method:"GET",pattern:"/call",handler:async({internal:e,allowCall:n})=>{if(!n)throw ur();return I(200,{plugins:Ia(e)})}},{method:"POST",pattern:"/:tenant/:plugin/db/:entityType/:method",handler:async({corsair:e,internal:n,params:t,body:r,scopedTenant:o,allowCall:i})=>{if(!i)throw ur("/db");tt(o);let a=r??{};if(a.args!==void 0&&!Array.isArray(a.args))throw N("args must be an array");let s=un(o,t.tenant),c=sn(a.args??[]),u=await Qo(e,n,{plugin:t.plugin,tenant:s},l=>Go(l,{plugin:t.plugin,entityType:t.entityType,method:t.method},c));return I(200,{data:on(u)})}},{method:"POST",pattern:"/:tenant/:plugin/call/:op",handler:async({corsair:e,internal:n,params:t,body:r,scopedTenant:o,allowCall:i})=>{if(!i)throw ur();let a=r??{},s=un(o,t.tenant),c=await Sa(e,n,{plugin:t.plugin,op:t.op,tenant:s,args:a.args});return I(200,{data:c})}}];(()=>{let e=new Set;for(let n of _a){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function Td(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let a=t[i],s=r[i];if(a.startsWith(":"))o[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return o}function vd(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function Pd(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await tr(e,n).catch(o=>{throw o instanceof w?o:new w(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new w(400,"invalid_json","Request body is not valid JSON")}}var Rd="/api/corsair";function q(e,n={}){let t=n.basePath??Rd,r=Qe(n.maxBodyBytes),o=Xe(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},a=v(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async s=>{try{let c=s.headers.get("content-length");if(c!==null&&Number(c)>r)throw En(r);let u=new URL(s.url),l=vd(u.pathname,t),d=s.method.toUpperCase();if(d==="OPTIONS"||l==="/"||l==="")return await en(e,s,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return I(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(u.searchParams);for(let g of _a){if(g.method!==d)continue;let f=Td(g.pattern,l);if(!f)continue;if(!g.public&&n.authenticate&&!await n.authenticate(s))return I(401,{error:"unauthorized",message:"invalid or missing credentials"});let h=await Pd(s,i),b=n.resolveTenant?await n.resolveTenant(s):void 0;return await g.handler({corsair:e,internal:a,req:s,params:f,query:p,body:h,scopedTenant:b,allowCall:(n.unsafeAllowUnauthenticated??!1)||!!n.authenticate})}throw Le(`No route for ${d} ${l}`)}catch(c){if(n.onError){let l=await n.onError(c,s);if(l)return l}if(c instanceof w)return ge(c);let u=c instanceof Error?c.message:"Internal server error";return I(500,{error:"internal_error",message:u})}}}function Ad(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function xd(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function Id(e,n,t){let r=[],o=0,i=e();try{let a=await nr(()=>i.next(),t);for(;a.done!==!0;){let s=xd(a.value);if(o+=s.byteLength,o>n)throw En(n);r.push(s),a=await nr(()=>i.next(),t)}return Buffer.concat(r)}catch(a){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw a}}var Ea=!1;function Sd(){Ea||(Ea=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function _d(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=Qe(n.maxBodyBytes),o=Xe(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(Sd(),i=JSON.stringify(e.body));else{let s=e[Symbol.asyncIterator];if(typeof s!="function")return;let c=await Id(s.bind(e),r,o);c.length>0&&(i=c)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw En(r);return typeof i=="string"?i:i}function Y(e){e.resume?.()}async function Ne(e,n={}){let t=Ad(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,a=new Headers;for(let[u,l]of Object.entries(e.headers))if(l!=null&&!Ed.has(u.toLowerCase()))if(Array.isArray(l))for(let d of l)a.append(u,d);else a.set(u,l);let s={method:(e.method??"GET").toUpperCase(),headers:a},c=await _d(e,n);return c!==void 0&&(s.body=c,a.has("content-type")||a.set("content-type","application/json")),new Request(i,s)}async function Q(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var Ed=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function Oa(e,n){let t=q(e,n);return async(r,o,i)=>{try{let a=await t(await Ne(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(o,a)}catch(a){if(a instanceof w&&o.headersSent!==!0){await Q(o,ge(a)),Y(r);return}Y(r),i(a)}}}function Od(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function Dd(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=Od(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function Da(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function Ma(e,n){let t=q(e,n);return async(r,o)=>{Dd(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let a=await t(await Ne(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await Q(o.raw,a)}catch(a){if(a instanceof w&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await Q(o.raw,ge(a)),Y(i);return}throw Y(i),a}}}function Ha(e,n){let t=q(e,n);return r=>t(r.req.raw)}function Ba(e,n){let t=q(e,n);return{GET:t,POST:t,OPTIONS:t}}function Ua(e,n){let t=q(e,n);return async(r,o)=>{try{let i=await t(await Ne(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),Y(r);return}if(i instanceof w){await Q(o,ge(i)),Y(r);return}console.error("[corsair] management handler failed:",i),await Q(o,I(500,{error:"internal_error"})),Y(r)}}}function lr(e,n){let t=q(e,n);return r=>t(r.request)}function La(e,n){let t=lr(e,n);return{GET:t,POST:t,OPTIONS:t}}function Fa(e,n){let t=lr(e,n);return{loader:t,action:t}}function Na(e,n){let t=lr(e,n);return{GET:t,POST:t,OPTIONS:t}}function $a(e,n){let t=lr(e,n);return{GET:t,POST:t,OPTIONS:t}}function Wa(e,n){let t=q(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await Ne(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(r.node.res,i)}catch(i){if(i instanceof w&&r.node.res.headersSent!==!0){await Q(r.node.res,ge(i)),Y(o);return}throw Y(o),i}}}function qa(e,n){return q(e,n)}function ja(e){let n={[rt]:e};return{ok:Et,tenants:{list:()=>xn(e),create:t=>Mt(e,t),get:t=>Dt(e,t)},plugins:{list:()=>An(e),get:t=>Ot(e,t)},connectionStatus:{get:t=>Ht(e,t?.tenantId)},permissions:{get:t=>bs(e,t)},connect:{createLink:t=>Ut(n,e,t),resolve:t=>Lt(n,e,t),oauthCallback:t=>Ft(n,e,t)},disconnect:t=>Bt(e,t)}}async function Ka(e,n,t,r,o="pending"){if(!e)return null;try{let i=dn(),a=new Date;return await e.db.insertInto("corsair_events").values({id:i,created_at:a,updated_at:a,account_id:n,event_type:t,payload:r,status:o}).execute(),i}catch(i){return console.warn("Failed to log event:",i),null}}async function Md(e,n,t,r="pending"){try{let o=await e.$getAccountId();return Ka(e.database,o,n,t,r)}catch(o){return console.warn("Failed to log event:",o),null}}import*as Za from"https";import*as dr from"querystring";var Hd=["expires_in","refresh_token_expires_in"];function Ga(e){let n={...e};for(let t of Hd){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function Bd(e){try{return Ga(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=dr.parse(e);return!n.access_token&&!n.error?null:Ga({...n})}function vt(e,n,t,r,o){let i=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,c)=>{let u={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};a||(u.client_id=n,u.client_secret=t);let l=dr.stringify(u),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(l).toString()};a&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=Za.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){c(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=Bd(f);h?s(h):c(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>c(new Error(`Request failed: ${g.message}`))),p.write(l),p.end()})}async function za(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[a,s,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(On({accessToken:a,expiresAt:s,forceRefresh:n?.forceRefresh}))return{accessToken:a,expiresAt:Number(s),refreshed:!1};if(!c)throw new _(o,"oauth_2");let u=await S({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:c},parseResponse:pn}),l=await Dn(t,u,s);return{accessToken:u.access_token,expiresAt:l,refreshed:!0}}async function Ja(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:a="form",extraParams:s}=e,c={grant_type:"refresh_token",refresh_token:t,...s},u={Accept:"application/json"};i==="basic"?u.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?u.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(c.client_id=o),c.client_secret=r),a==="json"?u["Content-Type"]="application/json":u["Content-Type"]="application/x-www-form-urlencoded";let l=await fetch(n,{method:"POST",headers:u,body:a==="json"?JSON.stringify(c):new URLSearchParams(c)});if(!l.ok)throw new Error(`OAuth token refresh failed (${l.status}): ${await l.text()}`);let d=JSON.parse(await l.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function Va(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new _(n.plugin,"oauth_2");let u={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},l=g=>nn(e.keys,r,async()=>(await za(u,{forceRefresh:g})).accessToken);e._refreshAuth=()=>l(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return On({accessToken:d,expiresAt:p})?d:l(!1)}let o=t.client_secret,i=t.client_id,a=u=>nn(e.keys,r,async()=>{let[l,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!u&&On({accessToken:l,expiresAt:d}))return l;if(!p)throw new _(n.plugin,"oauth_2");let g=await Ja({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await Dn(e.keys,g,d),g.access_token});e._refreshAuth=()=>a(!0);let[s,c]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return On({accessToken:s,expiresAt:c})?s:a(!1)}var Ya="  ";function ae(e){let n=e;return n._def??n.def??{}}function ce(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function se(e){return e.innerType??e.schema??e.out??e.in}function Xa(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return se(e)}}function ec(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function gr(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Mn(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function nc(e,n){return e.description??n.description}function Ud(e){let n=e;for(;n;){let t=ae(n),r=nc(n,t);if(r)return r;let o=ce(t);if(ri(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=Xa(t,o);continue}break}}function ri(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function X(e){let n=ae(e),t=ce(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Mn(n)[0]??"unknown");case"ZodEnum":return Mn(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=se(n);return r?X(r):"unknown"}case"ZodNullable":{let r=se(n);return`${r?X(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=se(n);return r?X(r):"unknown"}case"ZodArray":{let r=ec(n);if(!r)return"unknown[]";let o=ae(r),i=ce(o)==="ZodUnion",a=X(r);return`${i?`(${a})`:a}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=gr(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([a,s])=>{let c=ce(ae(s));return`${c==="ZodOptional"||c==="ZodNullable"?a+"?":a}: ${X(s)}`}).join(", ")} }`}case"ZodUnion":return Mn(n).map(r=>X(r)).join(" | ");case"ZodIntersection":return`${X(n.left)} & ${X(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=Xa(n,t);return r?X(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function Ae(e){let n=ae(e),t=ce(n),r=nc(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??Mn(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=Mn(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=se(n),i=o?Ae(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=se(n),i=o?Ae(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=se(n);return o?{...Ae(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=ec(n);return{kind:"array",optional:!1,description:r,items:o?Ae(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=gr(e,n),i={};for(let[a,s]of Object.entries(o))i[a]=Ae(s);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=Mn(n);for(let i of o){let a=ae(i);if(ce(a)==="ZodObject")return{...Ae(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=se(n);return o?{...Ae(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function uv(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),a=e.find(l=>l.id===o);if(!a)return null;let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=$e(a.endpointMeta,s),u=$e(a.endpointSchemas,s);return!c&&!u?null:{input:u?.input?Ae(u.input):null,output:u?.output?Ae(u.output):null,description:c?.description}}var oi=["equals","contains","startsWith","endsWith","in"],Ld=["equals","gt","gte","lt","lte","in"],Fd=["equals"],Nd=["equals","before","after","between"];function tc(e){let n=ae(e);switch(ce(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=se(n);return r?tc(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function ii(e){let n=ae(e),t=ce(n);if(ri(t)){let i=se(n);return i?ii(i):{}}if(t!=="ZodObject")return{};let r=gr(e,n),o={};for(let[i,a]of Object.entries(r)){let s=tc(a);s==="string"?o[i]={type:"string",operators:oi}:s==="number"?o[i]={type:"number",operators:Ld}:s==="boolean"?o[i]={type:"boolean",operators:Fd}:s==="date"&&(o[i]={type:"date",operators:Nd})}return o}function rc(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function ei(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&ei(o,i,t)}}function ni(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function ti(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];ni(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&ti(o,i,t)}}function si(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!o)return null;let[i,a]=o;if(r.length===0)return ni(a)?[i]:null;if(a!==null&&typeof a=="object"&&!ni(a)){let s=si(a,r);if(s!==null)return[i,...s]}return null}function oc(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let a="    ".repeat(i+2);t.push(`${a}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let a="    ".repeat(i+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var $d=new Set(st);function ln(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(s=>s.id===r);if(!i)return $d.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:ln(e);if(t==="webhooks"){if(!i.webhooks)return[];let s=[];return ti(i.webhooks,[],s),s.map(c=>`${i.id}.webhooks.${c}`)}if(t==="db"){let s=i.schema?.entities;return s?Object.keys(s).map(c=>`${i.id}.db.${c}.search`):[]}if(!i.endpoints)return[];let a=[];return ei(i.endpoints,[],a),a.map(s=>`${i.id}.api.${s}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let a=[];ti(i.webhooks,[],a),o[i.id]=a.map(s=>`${i.id}.webhooks.${s}`)}else if(t==="db")for(let i of e){let a=i.schema?.entities;a&&(o[i.id]=Object.keys(a).map(s=>`${i.id}.db.${s}.search`))}else for(let i of e){if(!i.endpoints)continue;let a=[];ei(i.endpoints,[],a),o[i.id]=a.map(s=>`${i.id}.api.${s}`)}return o}function $e(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function Wd(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),a=i.startsWith(".")?i.slice(1):i;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function Xo(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function lv(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),a=e.find(s=>s.id===o);if(a){if(i.startsWith("db.")){let l=i.slice(3),d=l.lastIndexOf(".");if(d!==-1){let p=l.slice(0,d),g=l.slice(d+1),f=a.schema?.entities;if(g==="search"&&f){let h=rc(f,p);if(h){let[b,k]=h,T=ii(k),P=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${oi.join(", ")}]`];for(let[M,D]of Object.entries(T))P.push(`  ${M}?: ${D.type}  [${D.operators.join(", ")}]`);return P.push("}"),P.join(`
+`)}}}return Xo(ln(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let l=i.slice(9);if(a.webhooks){let d=si(a.webhooks,l.split("."));if(d!==null){let p=d.join("."),g=$e(a.webhookSchemas,p.toLowerCase()),f=g?.response?X(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${pr(Hn(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${oc(o,d)}`),h.join(`
+
+`)}}return Xo(ln(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=$e(a.endpointMeta,s),u=$e(a.endpointSchemas,s);if(c||u){let l=[],d=[c?.riskLevel?`[${c.riskLevel}]`:"",c?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[c?.description,d].filter(Boolean).join("  ");return p&&l.push(p),u?.input&&l.push(`input ${pr(Hn(u.input))}`),u?.output&&l.push(`output ${pr(Hn(u.output))}`),l.join(`
+
+`)}}}return Xo(ln(e),"Path not found. Available operations")}function Qa(e){let n=e;for(;;){let t=ae(n),r=ce(t);if(ri(r)){let o=se(t);if(!o)return n;n=o;continue}return n}}function Hn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=Qa(e),t=ae(n);if(ce(t)==="ZodObject"){let o=gr(n,t),i=[];for(let[a,s]of Object.entries(o)){let c=ae(s),u=ce(c),l=u==="ZodOptional"||u==="ZodNullable",d=Qa(s),p=Ud(s);i.push({key:a,optional:l,type:X(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:X(n)}}function pr(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=Ya.repeat(n+1),r=Ya.repeat(n);return`{
+${e.fields.map(i=>{let a=i.optional?`${i.key}?`:i.key,s=i.description?`  // ${i.description}`:"";return`${t}${a}: ${i.type}${s}`}).join(`
+`)}
+${r}}`}return"unknown"}function qd(e,n){let t=ln(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(l=>l.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let l of t){let{shortPath:d,lookupKey:p}=Wd(l,n),g=$e(r.endpointMeta,p),f=$e(r.endpointSchemas,p);!g&&!f||o.push({path:l,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Hn(f?.input),output:Hn(f?.output)})}o.sort((l,d)=>l.path.localeCompare(d.path));let i=[],a=ln(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let l of a){let p=l.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=si(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=$e(r.webhookSchemas,b.toLowerCase()),T=k?.response?X(k.response):void 0;i.push({path:l,description:k?.description,payload:Hn(k?.payload),responseType:T,usageExample:oc(n,h)})}i.sort((l,d)=>l.path.localeCompare(d.path));let s=[],c=ln(e,{plugin:n,type:"db"}),u=r.schema?.entities;if(Array.isArray(c)&&u)for(let l of c){let p=l.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let T=rc(u,b);if(!T)continue;let[P,M]=T,D=ii(M),H=Object.entries(D).map(([C,R])=>({field:C,type:R.type,operators:R.operators}));s.push({path:l,entityName:P,filters:[{field:"entity_id",type:"string",operators:oi},...H]})}return s.sort((l,d)=>l.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:s}}}import{randomUUID as ic}from"crypto";async function jd(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=ic(),o=ic(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as Kd}from"crypto";var fr="https://graph.microsoft.com/v1.0",ai=2e4,Gd=60;async function Zd(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${fr}/subscriptions`,{headers:r,signal:AbortSignal.timeout(ai)});if(c.ok){let{value:u}=await c.json(),l=(u??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(l.map(d=>fetch(`${fr}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(ai)}).catch(()=>{})))}}catch{}let o=Kd(),i=new Date(Date.now()+Gd*6e4).toISOString(),a=await fetch(`${fr}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(ai),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!a.ok)throw new Error(`MS Graph subscribe failed (${a.status}): ${await a.text()}`);let s=await a.json();return s.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:s.id},webhookSecret:o}):null}function sc(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function zd(e,n){let t=sc(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function Jd(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function ac(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function cc(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function ot(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function Vd(e){return ot(e.body)}function uc(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return yr(Array.isArray(r)?r:[r])}function lc(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let u=yr(Array.isArray(c)?c:[c]);if(u)return decodeURIComponent(u)}let r=uc({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let u=n[c],l=Array.isArray(u)?u[0]:u;if(!(!l||typeof l!="string"))try{let p=(l.startsWith("http")?new URL(l):new URL(`https://example.invalid${l.startsWith("/")?l:`/${l}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=ot(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return yr([a?.validationToken])??null}function Yd(e){if(lc(e))return!0;let n=ot(e.body??e.payload);return ac(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function yr(e){for(let n of e){let t=cc(n);if(t)return t}}function Qd(e){let t=ot(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var rt=Symbol.for("corsair:internal");function fc(e){if(e.hub?.projectApiKey?.startsWith("ck_cloud_")&&Ca(e.hub))return Ta(e);let n=e.database?yi(e.database,{dbTables:e.dbTables}):void 0,t=e.kek??"",r=n&&t?ha(e.plugins,n,t):rr(!!n,!!t),o=va(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?ft(e.hub):void 0},a=ps(n),s=ja(i);if(e.multiTenancy){let l=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=Ko(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[rt]:i})},keys:r,permissions:a,manage:s},{[rt]:i});return dc(l,i.hub),gc(l,i.hub),l}let c=Ko(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),u=Object.assign({},c,{keys:r,permissions:a,manage:s,[rt]:i});return dc(u,i.hub),gc(u,i.hub),u}function dc(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-NKGH4LEL.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function Xd(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var pc=globalThis.__corsairTunnels??=new Set,ep=1e3,np=3e4;function tp(e){let n=e.schedule??((a,s)=>void setTimeout(a,s).unref?.()),t=e.minDelayMs??ep,r=e.maxDelayMs??np,o=t,i=()=>{let a=!1,s=()=>{a||(a=!0,n(i,o),o=Math.min(o*2,r))};e.start(s).then(()=>{o=t}).catch(s)};i()}function gc(e,n){if(!Xd(n))return;let t=n.projectApiKey;if(pc.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}pc.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??kr;tp({start:a=>import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:a})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${wr}`)}).catch(s=>{throw console.warn(`[corsair] tunnel down: ${s instanceof Error?s.message:String(s)}. Retrying \u2014 run \`corsair setup\` if it doesn't recover.`),s})})}var rp={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},ci=rp;async function Pt(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},a=n?.caller??"script",s=hi(e);if(!s)throw new Error("setupCorsair: invalid corsair instance");if(!s.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=yp(e,s.plugins,n),u={...s,database:s.database},l=u.database.db;await bp(u.database,i);let d=await kp(l,u,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Tp(e,c,n.credentials,u,o,i);let p=await Pp(d,c,o,a);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=fc({plugins:s.plugins,database:l,kek:s.kek,multiTenancy:!0}).withTenant(c.tenantId);await Rp(g,s.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function ui(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...K[n][t],...r])}function fp(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(s=>s.id===t);if(!o)continue;let i=E(o);if(!i)continue;let a=ui(o,i,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function yp(e,n,t){let r=bi(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&fp(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function mc(e,n){return _e(e)?n===0?!0:Object.values(e).every(t=>mc(t,n-1)):!1}function mp(e){return mc(e,4)}var hp=Ci;function mr(e){if(e instanceof up){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof gp?mr(r):"unknown";return n}return e instanceof ap?`${mr(e.unwrap())} | null`:e instanceof lp?`${mr(e.unwrap())} | undefined`:e instanceof sp?e.options.join(" | "):e instanceof pp?"string":e instanceof cp?"number":e instanceof op?"boolean":e instanceof ip?"date":e instanceof dp?"jsonb":"unknown"}async function bp(e,n){let t=await e.db.introspection.getTables(),r=new Set(t.map(i=>i.name)),o=e.tableNames??fi();for(let[i,a]of Object.entries(hp)){let s=o[i];if(!r.has(s)){let c=s!==i?` (dbTables.${i} \u2192 "${s}")`:"";n(`[corsair:setup] Table "${s}" does not exist${c}. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(mr(a),null,2)}`)}}}async function kp(e,n,t,r,o){let i=new Date,a=new Map;for(let s of n.plugins){let c=s.id,u=E(s),l=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!l){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),l=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=u?s.authConfig?.[u]?.integration??[]:[],p=u?s.authConfig?.[u]?.account??[]:[],g=u&&l?F({authType:u,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(l&&!l.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!l||!u||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",l.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:l.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&U({authType:u,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}a.set(c,{pluginId:c,authType:u,integration:g,account:f,integrationFields:[...K[u].integration,...d],accountFields:r?[...K[u].account,...p]:[]})}return a}function wp(e){if(!_e(e))return;let n=e.keys;return _e(n)?n:void 0}function Cp(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Tp(e,n,t,r,o,i){let a=wp(e),s=n.provisionAccounts?Cp(e,n.tenantId):void 0;for(let[c,u]of Object.entries(t)){let l=r.plugins.find(k=>k.id===c);if(!l){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=E(l);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=ui(l,d,"integration"),g=ui(l,d,"account"),f=a?.[c],h=s?.[c],b=_e(h)?h.keys:void 0;for(let[k,T]of Object.entries(u))if(T){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let P=ne(f,`set_${k}`);if(!P){i(`[corsair:setup] Cannot set integration field '${k}' for '${c}'.`);continue}await P(T),o(`[corsair:setup] Set ${c} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${k}' on a multi-tenant instance`);let P=ne(b,`set_${k}`);if(!P){i(`[corsair:setup] Cannot set account field '${k}' for '${c}'.`);continue}await P(T),o(`[corsair:setup] Set ${c} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${c}'.`)}}}var yc=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function vp(e,n,t,r,o,i,a,s,c){let u=[],l=[];for(let p of o){if(yc.has(p))continue;let g=ne(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}if(r&&i.length>0)for(let p of i){if(yc.has(p))continue;let g=ne(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}let d=u.length===0&&l.length===0;if(n==="managed_pricing")s(`[corsair:setup] '${e}' (managed_pricing) uses Corsair metered credentials via Hub \u2014 nothing to store in your database. Pass hub: { ... } to createCorsair().`);else if(d)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...u,...l];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of u)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of l){let h=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}s(g.join(`
+`))}}return d}async function Pp(e,n,t,r){let o=new Set;for(let i of e.values())await vp(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function Rp(e,n,t,r,o){if(!mp(ci)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=ci,a=new Set(n.map(s=>s.id));for(let[s,c]of Object.entries(i)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let u=_e(e)?e[s]:void 0,l=_e(u)?u.api:void 0;if(l)for(let[d,p]of Object.entries(c))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${d}.${g}...`);try{let h=_e(l)?l[d]:void 0;await ne(h,g)?.(f)}catch(h){o(`[corsair:setup] ${s} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{Ti as a,Ee as b,he as c,at as d,ct as e,ut as f,pn as g,vi as h,lt as i,xr as j,Ln as k,_i as l,Ei as m,Oe as n,je as o,be as p,fn as q,yn as r,De as s,Sr as t,Di as u,$n as v,ke as w,Wn as x,_r as y,ft as z,L as A,yt as B,mn as C,we as D,Ce as E,te as F,Er as G,qn as H,Me as I,pe as J,jn as K,F as L,U as M,Ni as N,$i as O,Pt as P,Tp as Q,Be as R,Dr as S,kn as T,Cn as U,Hr as V,Tt as W,Yi as X,ze as Y,V as Z,Br as _,Zn as $,ns as aa,eu as ba,Rt as ca,Nf as da,os as ea,is as fa,ss as ga,as as ha,At as ia,Ur as ja,It as ka,St as la,Ue as ma,Rn as na,qr as oa,ds as pa,Je as qa,w as ra,Vr as sa,Yr as ta,Nt as ua,Qr as va,In as wa,Sn as xa,$t as ya,Wt as za,zn as Aa,Xr as Ba,eo as Ca,qt as Da,Jn as Ea,jt as Fa,Kt as Ga,Fe as Ha,_n as Ia,Ps as Ja,io as Ka,so as La,Ye as Ma,Qn as Na,Xn as Oa,Qt as Pa,uo as Qa,et as Ra,al as Sa,pl as Ta,yl as Ua,Ms as Va,Hs as Wa,er as Xa,Bs as Ya,Us as Za,Qe as _a,Xe as $a,fo as ab,yo as bb,mo as cb,ho as db,bo as eb,en as fb,_ as gb,ko as hb,qs as ib,Co as jb,Ks as kb,Gs as lb,Zs as mb,To as nb,vo as ob,Po as pb,Ro as qb,Ao as rb,xo as sb,Io as tb,So as ub,_o as vb,Eo as wb,Oo as xb,Do as yb,Mo as zb,Ho as Ab,Bo as Bb,tn as Cb,rn as Db,on as Eb,sn as Fb,Go as Gb,Pe as Hb,ud as Ib,q as Jb,Oa as Kb,Da as Lb,Ma as Mb,Ha as Nb,Ba as Ob,Ua as Pb,La as Qb,Fa as Rb,Na as Sb,$a as Tb,Wa as Ub,qa as Vb,Ka as Wb,Md as Xb,vt as Yb,Va as Zb,uv as _b,ln as $b,lv as ac,pr as bc,qd as cc,jd as dc,fr as ec,Zd as fc,sc as gc,zd as hc,Jd as ic,ac as jc,cc as kc,ot as lc,Vd as mc,uc as nc,lc as oc,Yd as pc,yr as qc,Qd as rc,rt as sc,fc as tc,Xd as uc,tp as vc};

package/dist/chunk-XCTHEKDP.js

@@ -0,0 +1 @@
+var e="api.corsair.cloud",s=new Set(["localhost","127.0.0.1","[::1]","::1"]);function i(t){if(!t.startsWith("ck_cloud_"))return null;let r=t.slice(9),o=r.indexOf(".");if(o<=0)return null;let n=r.slice(0,o);return/^[a-z0-9]+$/.test(n)?n:null}function a(t){let r=i(t);return r?`https://${e}/${r}/api/corsair`:null}function u(t,r){return`${new URL(t).origin}/v1/projects/${r}`}function p(t,r="Cloud base URL"){let o;try{o=new URL(t)}catch{throw new Error(`${r} is not a valid URL: "${t}"`)}if(o.search||o.hash)throw new Error(`${r} must not contain a query or fragment (got "${t}") \u2014 path segments are appended to it.`);if(o.protocol!=="https:"&&!(o.protocol==="http:"&&s.has(o.hostname)))throw new Error(`${r} must use https:// (got "${t}") \u2014 http:// is only allowed for localhost/127.0.0.1, since the project key is sent as a bearer token.`)}export{i as a,a as b,u as c,p as d};

package/dist/{connect-73AAKXSA.js → connect-6JIVRVND.js}

@@ -1 +1 @@
-import{ga as a,ha as b,ia as c}from"./chunk-OFDCTRKH.js";import"./chunk-6IURNA4L.js";import"./chunk-QAK6BJXE.js";import"./chunk-BRUFMVTV.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};
+import{ga as a,ha as b,ia as c}from"./chunk-IC7VFQ7K.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import"./chunk-BRUFMVTV.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/connect.js

@@ -1 +1 @@
-import{a as h,b as d}from"./chunk-QAK6BJXE.js";import"./chunk-SOY77BN4.js";function g(e,t){let n=t.endsWith("/")?t.slice(0,-1):t;return n?e===n?"":e.startsWith(`${n}/`)?e.slice(n.length):e:e}function U(e){let t=e.url??h(e.apiKey);if(!t)throw new Error("corsairConnect: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");if(d(t,"Cloud proxy URL"),!e.authorize&&!e.allowUnauthenticated)throw new Error("corsairConnect requires `authorize` to gate callers. To intentionally run an open proxy (any caller can invoke any op with your key), pass `allowUnauthenticated: true`.");e.authorize||console.warn("[corsair] corsairConnect is running with allowUnauthenticated \u2014 this route forwards any tenant/plugin/op with your cloud key.");let n=t.endsWith("/")?t.slice(0,-1):t,y=e.basePath??"/api/corsair";return async r=>{if(e.authorize){let a;try{a=await e.authorize(r)}catch{a=!1}if(!a)return new Response(JSON.stringify({error:"unauthorized"}),{status:401,headers:{"content-type":"application/json"}})}let i=new URL(r.url),p=g(i.pathname,y),f=`${n}${p}${i.search}`,o=new Headers,c=r.headers.get("content-type");c&&o.set("content-type",c),o.set("authorization",`Bearer ${e.apiKey}`);let w=r.method!=="GET"&&r.method!=="HEAD",s=await fetch(f,{method:r.method,headers:o,body:w?await r.arrayBuffer():void 0}),u=new Headers,l=s.headers.get("content-type");return l&&u.set("content-type",l),new Response(s.body,{status:s.status,headers:u})}}export{U as corsairConnect};
+import{b as h,d}from"./chunk-XCTHEKDP.js";import"./chunk-SOY77BN4.js";function g(e,t){let n=t.endsWith("/")?t.slice(0,-1):t;return n?e===n?"":e.startsWith(`${n}/`)?e.slice(n.length):e:e}function U(e){let t=e.url??h(e.apiKey);if(!t)throw new Error("corsairConnect: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");if(d(t,"Cloud proxy URL"),!e.authorize&&!e.allowUnauthenticated)throw new Error("corsairConnect requires `authorize` to gate callers. To intentionally run an open proxy (any caller can invoke any op with your key), pass `allowUnauthenticated: true`.");e.authorize||console.warn("[corsair] corsairConnect is running with allowUnauthenticated \u2014 this route forwards any tenant/plugin/op with your cloud key.");let n=t.endsWith("/")?t.slice(0,-1):t,y=e.basePath??"/api/corsair";return async r=>{if(e.authorize){let a;try{a=await e.authorize(r)}catch{a=!1}if(!a)return new Response(JSON.stringify({error:"unauthorized"}),{status:401,headers:{"content-type":"application/json"}})}let i=new URL(r.url),p=g(i.pathname,y),f=`${n}${p}${i.search}`,o=new Headers,c=r.headers.get("content-type");c&&o.set("content-type",c),o.set("authorization",`Bearer ${e.apiKey}`);let w=r.method!=="GET"&&r.method!=="HEAD",s=await fetch(f,{method:r.method,headers:o,body:w?await r.arrayBuffer():void 0}),u=new Headers,l=s.headers.get("content-type");return l&&u.set("content-type",l),new Response(s.body,{status:s.status,headers:u})}}export{U as corsairConnect};