corsair 0.1.143 → 0.1.145

package/dist/{browser-delivery-CwVUOZrB.d.ts → browser-delivery-teTn2gwN.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-CqHpOTQt.js';
+import { B as BrowserDeliveryPayload } from './index-Bdxw7n-q.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/chunk-PHSO4JJR.js

@@ -0,0 +1,66 @@
+import{a as Se,b as xr,c as Ir}from"./chunk-6IURNA4L.js";import{a as Ti,b as Pi,c as vi,d as Fn}from"./chunk-XCTHEKDP.js";import{a as xi,b as _e,c as Ii,d as P,e as J,f as Si,g as ne,h as K,i as O,j as _i,k as ut,l as Ei,m as ln,n as Ar,o as Oi}from"./chunk-BRUFMVTV.js";import{b as Ri,c as Ai}from"./chunk-XPXWKPFZ.js";import{ZodBoolean as Cp,ZodDate as Tp,ZodEnum as Pp,ZodNullable as vp,ZodNumber as Rp,ZodObject as Ap,ZodOptional as xp,ZodRecord as Ip,ZodString as Sp,ZodType as _p}from"zod";var lt=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","alchemy","algolia","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","appointo","aryn","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beamer","beeminder","benchmarkemail","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bigpictureio","bitbucket","bitwarden","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","booqable","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","browserless","browsertool","bubble","bugsnag","buildkite","bunnycdn","byteforms","cal","calendly","campaigncleaner","campayn","canny","canva","canvas","capsulecrm","carbone","castingwords","cdrplatform","certifier","chaser","chatbotkit","chatfai","chmeetings","cincopa","circleci","classmarker","clickhouse","clickmeeting","clientary","clockify","cloudcart","cloudflare","cloudflareapikey","cloudinary","cody","coinbase","collegefootballdata","confluence","connecteam","contentfulgraphql","contextsevenmcp","convoloai","cosmic","countdownapi","crowterminal","currentsapi","cursor","customerio","customgpt","dadataru","databricks","datadog","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","docupost","dodopayments","doppler","dovetail","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","emelia","epicgames","everhour","exa","exist","extractaai","facebook","faraday","figma","filevine","filloutforms","firecrawl","fireflies","flexisign","flutterwave","formbricks","gemini","giphy","github","gitlab","gladia","gmail","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","hookdeck","htmltoimage","hubspot","huggingface","imagior","humanitix","imejisio","imgbb","insightoai","instagram","intercom","jigsawstack","jira","kaggle","kibana","leexi","linear","linkedin","loyverse","mailboxlayer","mailcheck","mailchimp","mailtrap","marketstack","merriamwebsterdict","monday","neon","nextdns","northflank","notion","ocrspace","ocrwebservice","ollama","onedrive","onepassword","openai","openrouter","openweathermap","oura","outlook","pagerduty","parseur","pdfco","pdfmonkey","perplexityai","phantombuster","pinecone","plain","posthog","postman","prisma","pushbullet","razorpay","reddit","reducto","replicate","removebg","replyio","resend","retailed","rootly","runpod","salesforce","sapsuccessfactors","scaleai","scrapegraphai","securitytrails","semanticscholar","sendgrid","sentry","serpapi","sharepoint","slack","snapchat","slackbot","sourcegraph","spoki","spotify","strava","streamtime","stripe","studiobyai21labs","supabase","supadata","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","timecamp","timelink","tinyurl","tisane","todoist","toggl","tokenmetrics","tpscheck","trello","tripadvisor","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","unione","uniswapapi","uploadcare","vapi","vercel","veriphone","vestaboard","waboxapp","wakatime","webflow","webscrapingai","webvizio","whatsapp","whoisfreaks","whautomate","winstonai","witai","wix","wiza","workday","workiom","worldnewsapi","xero","writer","xquik","youcom","youtube","zendesk","zenserp","zohobigin","zohoinventory","zohomail","zoom","zoominfo"],Mi={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",alchemy:"Alchemy",algolia:"Algolia",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",appointo:"Appointo",aryn:"Aryn",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beamer:"Beamer",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bigpictureio:"BigPicture.io",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",booqable:"Booqable",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",bunnycdn:"Bunnycdn",byteforms:"ByteForms",cal:"Cal",calendly:"Calendly",campaigncleaner:"Campaign Cleaner",campayn:"Campayn",canny:"Canny",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",carbone:"Carbone",castingwords:"CastingWords",cdrplatform:"CDR Platform",certifier:"Certifier",chaser:"Chaser",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chmeetings:"ChMeetings",cincopa:"Cincopa",circleci:"CircleCI",classmarker:"ClassMarker",clickhouse:"Clickhouse",clickmeeting:"ClickMeeting",clientary:"Clientary",clockify:"Clockify",cloudcart:"CloudCart",cloudflare:"Cloudflare",cloudflareapikey:"Cloudflare API Key",cloudinary:"Cloudinary",cody:"Cody",coinbase:"Coinbase",collegefootballdata:"College Football Data",confluence:"Confluence",connecteam:"Connecteam",contentfulgraphql:"Contentful GraphQL",contextsevenmcp:"Context7",convoloai:"ConvoloAi",cosmic:"Cosmic",countdownapi:"Countdown API",crowterminal:"CrowTerminal",currentsapi:"CurrentsApi",cursor:"Cursor",customerio:"Customer.io",customgpt:"CustomGPT",dadataru:"Dadataru",databricks:"Databricks",datadog:"Datadog",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",docupost:"Docupost",dodopayments:"Dodo Payments",doppler:"Doppler",dovetail:"Dovetail",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",emelia:"Emelia",epicgames:"Epic Games",everhour:"Everhour",exa:"Exa",exist:"Exist",extractaai:"Extracta.ai",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filevine:"Filevine",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",flexisign:"Flexisign",flutterwave:"Flutterwave",formbricks:"Formbricks",gemini:"Gemini",giphy:"Giphy",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",hookdeck:"Hookdeck",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",imagior:"Imagior",humanitix:"Humanitix",imejisio:"Imejis.io",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",kibana:"Kibana",leexi:"Leexi",linear:"Linear",linkedin:"LinkedIn",loyverse:"Loyverse",mailboxlayer:"MailboxLayer",mailcheck:"Mailcheck",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",monday:"Monday",neon:"Neon",nextdns:"NextDNS",northflank:"Northflank",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfco:"PDF.co",pdfmonkey:"PDFMonkey",perplexityai:"Perplexity AI",phantombuster:"PhantomBuster",pinecone:"Pinecone",plain:"Plain",posthog:"PostHog",postman:"Postman",prisma:"Prisma",pushbullet:"Pushbullet",razorpay:"Razorpay",reddit:"Reddit",reducto:"Reducto",replicate:"Replicate",removebg:"remove.bg",replyio:"Reply.io",resend:"Resend",retailed:"Retailed",rootly:"Rootly",runpod:"RunPod",salesforce:"Salesforce",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",securitytrails:"SecurityTrails",semanticscholar:"Semantic Scholar",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",snapchat:"Snapchat",slackbot:"Slackbot",sourcegraph:"Sourcegraph",spoki:"Spoki",spotify:"Spotify",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",supadata:"Supadata",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",timecamp:"TimeCamp",timelink:"Timelink",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",tokenmetrics:"Token Metrics",tpscheck:"TPSCheck",trello:"Trello",tripadvisor:"Tripadvisor",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",unione:"Unione",uniswapapi:"Uniswap",uploadcare:"Uploadcare",vapi:"Vapi",vercel:"Vercel",veriphone:"Veriphone",vestaboard:"Vestaboard",waboxapp:"Waboxapp",wakatime:"WakaTime",webflow:"Webflow",webscrapingai:"WebScraping.AI",webvizio:"Webvizio",whatsapp:"WhatsApp",whoisfreaks:"Whoisfreaks",whautomate:"Whautomate",winstonai:"Winston AI",witai:"WitAi",wix:"Wix",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",xero:"Xero",writer:"Writer",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zenserp:"Zenserp",zohobigin:"Zoho Bigin",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Ee(e){let n=Mi[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var ke=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function M(e){return typeof e=="string"&&e.length>0}function Dc(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Hc(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"||e==="managed_pricing"}function dt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!M(n.connectUrl)||!M(n.token)||!M(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:M(n.environmentId)?n.environmentId:n.projectId};return M(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function pt(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!M(r.tenantId)||!M(r.plugin)||!Dc(r.status)||!Hc(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:M(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function gt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!M(n.approvalUrl)||!M(n.token)||!M(n.projectId)||!M(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function dn(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(M(n.access_token))return{access_token:n.access_token,refresh_token:M(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:M(n.scope)?n.scope:void 0};throw new Error(M(n.error)?M(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Bc(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Uc(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;M(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function Lc(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function Di(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!M(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!M(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",a=Uc(o.fields),s=Bc(o.missingRequiredFields),c=Lc(o.status,o.connected,a,s);t.push({plugin:o.plugin,providerName:M(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function ft(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Hi(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}function yt(e){return e.replace(/\/$/,"")}function Sr(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return Se()}catch{return null}}function Bi(e){let n=Sr(e);return n?{"x-corsair-delivery-url":n}:{}}function Ui(e){let n=e.instanceKey?.trim();return n?{"x-corsair-instance-key":n}:{}}async function Li(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Fc(e,n,t){if(n===404&&t)return t;let r=ft(e);return r||`Hub API returned HTTP ${n}`}function Fi(e,n,t){let r=Hi(e);throw r?new ke({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(Fc(e,n,t))}async function S(e){let n=yt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...Bi(e.hub),...Ui(e.hub)},body:JSON.stringify(e.body)}),r=await Li(t);return t.ok||Fi(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function Z(e){let n=yt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...Bi(e.hub),...Ui(e.hub)}}),r=await Li(t);return t.ok||Fi(r,t.status,e.notFoundMessage),e.parseResponse(r)}function mt(e){return e&&typeof e=="object"?e:{}}function Ni(e){let n=mt(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function _r(e,n){return S({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=mt(t);return{chat:r.thread,reply:Ni(r.reply)}}})}async function Er(e,n){return S({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Ni})}async function Or(e,n){return Z({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=mt(t).threads;return Array.isArray(r)?r:[]}})}async function Mr(e,n){return Z({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=mt(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Zc}from"crypto";var Nc="corsair:client-bridge";function Dr(e){return new URL(e).origin}function pn(e){let n=JSON.stringify({type:Nc,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Dr(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var $c=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Hr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:$c.has(n)}catch{return!1}}function Nn(e){return e==="development"?"browser":"server"}function $i(e){return Nn(e)==="browser"}function Wi(e){return Hr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Kc}from"crypto";var Oe=60*1e3,We=300*1e3;import{createHmac as Wc,randomBytes as qc,timingSafeEqual as jc}from"crypto";function we(){return qc(16).toString("base64url")}function $n(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Wc("sha256",t).update(e).digest("base64url")}function ue(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let a=$n(o,t);try{if(!jc(Buffer.from(i,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function ht(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),a=$n(i,n);return`${i}.${a}`}function Wn(e,n,t){let r=Math.floor(Date.now()/1e3);return ht(e,n,r+Math.floor(t/1e3))}function qe(e){return decodeURIComponent(e)}function Br(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function qi(e){let n=e.trim();return n.length>0?n:null}function gn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function fn(e,n){if(!qi(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Kc(16).toString("base64url"),iat:t,exp:t+Math.floor(Oe/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=$n(o,n);return`${o}.${i}`}function Me(e,n){return qi(n)?ue(e,n):null}function Gc(e){let n=Dr(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function Ur(e){let n=fn(Gc(e),e.signingSecret);return gn(e.deliveryUrl,n)}function ji(e){if(Nn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Zc(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:Ur(r)}}var qn="https://auth.corsair.dev";var Ce=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},jn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function Lr(e){let n=(e.apiUrl?.trim()||qn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"",o=t.startsWith("ck_cloud_");if(!t||!r&&!o)throw new jn;return{apiUrl:n,projectApiKey:t,signingSecret:r,instanceKey:e.instanceKey?.trim()||void 0,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function bt(e){return Lr(e)}function zc(e){let n=e.projectApiKey.startsWith("ck_cloud_");return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&(n||e.signingSecret.trim().length>0)}function N(e){let n=P(e).hub;if(!n||!zc(n))throw new Ce;return n}function Ki(e){return e.replace(/\/$/,"")}function kt(e){return e.oauthCallbackUrl?Ki(e.oauthCallbackUrl.trim()):`${Ki(e.apiUrl)}/oauth/callback`}function yn(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";if(e.startsWith("ck_cloud_"))return"cloud";throw new Error("Hub API key must start with ck_dev_ (development), ck_prod_ (production), or ck_cloud_ (cloud)")}import{createCipheriv as Zi,createDecipheriv as Gi,randomBytes as wt,scrypt as Jc}from"crypto";import{promisify as Vc}from"util";var zi=Vc(Jc),Ct="aes-256-gcm",Ji=12,Tt=16,Yc=16,je=32;function Te(){return wt(je).toString("base64")}async function Pe(e,n){let t=wt(Yc),r=await zi(n,t,je),o=wt(Ji),i=Zi(Ct,r,o,{authTagLength:Tt}),a=Buffer.concat([i.update(e,"utf8"),i.final()]),s=i.getAuthTag();return[t.toString("base64"),o.toString("base64"),s.toString("base64"),a.toString("base64")].join(":")}async function te(e,n){let[t,r,o,i]=e.split(":");if(!t||!r||!o||!i)throw new Error("Invalid encrypted DEK format");let a=Buffer.from(t,"base64"),s=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),u=Buffer.from(i,"base64"),l=await zi(n,a,je),d=Gi(Ct,l,s,{authTagLength:Tt});return d.setAuthTag(c),Buffer.concat([d.update(u),d.final()]).toString("utf8")}function Fr(e,n){let t=Buffer.from(n,"base64"),r=wt(Ji),o=Zi(Ct,t,r,{authTagLength:Tt}),i=Buffer.concat([o.update(e,"utf8"),o.final()]),a=o.getAuthTag();return[r.toString("base64"),a.toString("base64"),i.toString("base64")].join(":")}function Kn(e,n){let[t,r,o]=e.split(":");if(!t||!r||!o)throw new Error("Invalid encrypted data format");let i=Buffer.from(n,"base64"),a=Buffer.from(t,"base64"),s=Buffer.from(r,"base64"),c=Buffer.from(o,"base64"),u=Gi(Ct,i,a,{authTagLength:Tt});return u.setAuthTag(s),Buffer.concat([u.update(c),u.final()]).toString("utf8")}function De(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=Fr(o,n);return t}function le(e,n){let t={};for(let[r,o]of Object.entries(e))t[r]=Kn(o,n);return t}function Zn(e,n,t){let r=le(e,n);return De(r,t)}function Vi(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let a=[null,void 0,""].includes(i)?null:i;await n({[o]:a})};return r}var Nr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function $(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,a=[...K[n].integration,...i],s=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:b.id,config:Nr(b.config),dek:b.dek??null},s},updateIntegration:async b=>{let k=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),s=null}},u=null,l=async()=>{if(u)return u;let b=await c.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return u=await te(b.dek,r),u},d=async()=>{let b=await c.getIntegration(),k=await l(),T=b.config;return!T||Object.keys(T).length===0?{}:le(T,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await l(),T;try{T=await d()}catch(D){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,D),T={}}let v={...T};for(let[D,B]of Object.entries(b))B===null?delete v[D]:v[D]=B;let H=De(v,k);await c.updateIntegration({config:H})};return{get_dek:l,issue_new_dek:async()=>{let b=await c.getIntegration(),k=Te(),T={};if(b.dek){let H=await te(b.dek,r),D=b.config;D&&Object.keys(D).length>0&&(T=Zn(D,H,k))}let v=await Pe(k,r);return await c.updateIntegration({config:T,dek:v}),u=k,k},...Vi(d,g,a)}}function U(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:a=[],ensureProvisioned:s}=e,c=[...K[n].account,...a],u=null,l=async()=>{if(u)return u;let C=!1;for(;;){let R=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!R){if(!C&&s){C=!0,await s();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return u={id:R.id,config:Nr(R.config),dek:R.dek??null},u}},d={kek:o,integrationName:t,tenantId:r,getIntegration:l,getAccount:async()=>{let C=!1;for(;;){let R=await l(),x=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",R.id).executeTakeFirst();if(!x){if(!C&&s){C=!0,await s();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return{id:x.id,config:Nr(x.config),dek:x.dek??null}}},updateAccount:async C=>{let R=await d.getAccount();await i.db.updateTable("corsair_accounts").set({...C.config!==void 0?{config:C.config}:{},...C.dek!==void 0?{dek:C.dek}:{},updated_at:new Date}).where("id","=",R.id).execute()}},p=null,g=null,f=null,h=async()=>{let C=await d.getAccount();if(!C.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p&&g===C.dek||(p=await te(C.dek,o),g=C.dek),p},b=async()=>{if(f)return f;let C=await d.getIntegration();if(!C.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await te(C.dek,o),f},k=async()=>{let C=await d.getAccount(),R=await h(),x=C.config;return!x||Object.keys(x).length===0?{}:le(x,R)},T=async()=>{let C=await d.getIntegration(),R=await b(),x=C.config;return!x||Object.keys(x).length===0?{}:le(x,R)},v=Promise.resolve(),H=C=>{let R=v.then(()=>D(C));return v=R.catch(()=>{}),R},D=async C=>{let R=await d.getAccount();if(!R.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);let x=await te(R.dek,o),ee;try{let q=R.config;ee=!q||Object.keys(q).length===0?{}:le(q,x)}catch(q){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,q),ee={}}let re={...ee};for(let[q,he]of Object.entries(C))he===null?delete re[q]:re[q]=he;let E=De(re,x);await d.updateAccount({config:E})},B={get_dek:h,issue_new_dek:async()=>{let C=await d.getAccount(),R=Te(),x={};if(C.dek){let re=await te(C.dek,o),E=C.config;E&&Object.keys(E).length>0&&(x=Zn(E,re,R))}let ee=await Pe(R,o);return await d.updateAccount({config:x,dek:ee}),p=R,g=ee,R},...Vi(k,H,c)};return n==="oauth_2"&&(B.get_integration_credentials=async()=>{let C=await T();return{...C,client_id:C.client_id||null,client_secret:C.client_secret||null,redirect_url:C.redirect_url??null}}),B}async function Yi(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=Te(),i=await Pe(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function Qi(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=Te(),s=await Pe(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",i.id).execute(),a}var Qc=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function He(e){return Qc.has(e)}function Xc(e,n){return He(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function eu(e){return!He(e)}function nu(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"];case"managed_pricing":return[]}}function tu(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function ru(e,n){let t=i=>n.find(a=>a.level==="account"&&a.name===i);if(!nu(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function Xi(e,n){if(!e)return!1;let t=ne(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function ou(e,n){let r=e.authConfig?.[n]?.integration??[];return[...K[n].integration,...r]}function iu(e,n){let r=e.authConfig?.[n]?.account??[];return[...K[n].account,...r]}function su(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return o.length>0?a="missing_integration":r.length===0?a="ready":i.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:ru(n,t),fields:t,missingRequiredFields:r}}async function Ke(e,n,t){let r=O(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,a=i?.[r]?.integration??[],s=i?.[r]?.account??[],c=$({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),u=U({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:s}),l=ou(n,r),d=iu(n,r),p=[];for(let g of l)p.push({name:g,level:"integration",required:Xc(r,g),configured:await Xi(c,g)});for(let g of d)p.push({name:g,level:"account",required:eu(g),configured:await Xi(u,g)});if(tu(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return su(n.id,r,p)}async function Gn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let a of e.plugins){if(o&&!o.has(a.id))continue;let s=await Ke(e,a,r);s&&i.push(s)}return i}function Pt(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var es=Symbol.for("corsair:internal"),ns=new WeakMap,ts=new WeakMap;function au(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function cu(e){if(e.database){let t=ns.get(e.database);return t||(t=new Map,ns.set(e.database,t)),t}let n=ts.get(e);return n||(n=new Map,ts.set(e,n)),n}function uu(e){return e.multiTenancy?{withTenant:()=>({}),[es]:e}:{[es]:e}}async function mn(e,n){if(!e.database)return;let t=n.trim()||"default",r=cu(e),o=au(t,e.plugins),i=r.get(o);if(i){await i;return}let a=(async()=>{let{setupCorsair:s}=await import("./setup-4VVYE5GX.js");await s(uu(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,a),await a}import*as zn from"crypto";function Be(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function $r(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function hn(e,n){if(!n)throw new Error("OAuth state signing requires a configured kek. Pass kek to createCorsair().");let t=zn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var Wr=600*1e3;function vt(e,n){if(!n)return null;let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=zn.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(o,"base64url"),s=Buffer.from(i,"base64url");return a.length!==s.length||!zn.timingSafeEqual(a,s)?null:$r(r,{maxAgeMs:Wr})}function rs(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function os(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function bn(e,n){await S({hub:e,path:"/connections/report",body:rs(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function lu(e,n){try{let t=N(e);S({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof Ce)return}}async function du(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!O(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ke(n,e.plugin,r);o&&ss(e.hub,os({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function is(e,n){lu(e,n)}function ss(e,n){S({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function kn(e){du(e).catch(()=>{})}async function ve(e,n){let t=P(e);if(!O(n.plugin))return;let o=await Ke(t,n.plugin,n.tenantId);o&&is(e,os({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function Rt(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var as=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function pu(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function gu(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await te(n.dek,e.kek),r=as(n.config),o={};Object.keys(r).length>0&&(o=le(r,t)),o[e.link.linkType]=e.link.externalId;let i=De(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function wn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:a,extraAccountFields:s=[]}=e,{accountId:c}=await pu({database:n,pluginId:r,tenantId:o}),u=!1;if(a){let l=U({authType:a,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:s}),d=`set_${i.linkType}`,p=l[d];typeof p=="function"&&(await p(i.externalId),u=!0)}u||await gu({database:n,kek:t,accountId:c,link:i})}async function qr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let c=await te(s.dek,t),l=as(s.config)[o];if(!l)continue;if(Kn(l,c)===i)return s}catch{continue}return null}async function At(e){return(await qr(e))?.tenant_id??null}async function cs(e){return At({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as us from"querystring";function Ze(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${us.stringify(i)}`}async function ls(e,n){try{return await Z({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function Cn(e,n,t,r){if(!n.subscribe)return;let o=N(e),i=await ls(o,n.id);if(!i)return;let a=await n.subscribe({keys:r},{webhookUrl:i});a&&await ve(e,{plugin:n,tenantId:t,verified:!0,webhookLink:a.webhookLink,webhookSecret:a.webhookSecret})}var V=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function ds(e){let n=e.oauthConfig;if(!n)throw new V("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function fu(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let a=await i.executeTakeFirst();if(!a)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",a.id).executeTakeFirst())return;let c=Te(),u=await Pe(c,r),l=new Date;await o.insertInto("corsair_accounts").values({id:ln(),created_at:l,updated_at:l,tenant_id:t,integration_id:a.id,config:{},dek:u}).execute()})}async function jr(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,a=P(e,()=>new V("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=J(a,n,p=>new V("plugin_not_found",p)),c=ds(s),l=await $({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!l)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Ze({oauthConfig:c,clientId:l,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=hn(Be(n,r),a.kek);return{url:Ze({oauthConfig:c,clientId:l,redirectUri:o,state:d}),state:d}}function yu(e,n){return{...n??{},...e}}async function Jn(e,n){let{code:t,state:r,redirectUri:o}=n,i=P(e,()=>new V("invalid_corsair_instance","Invalid corsair instance")),a,s;if(n.trusted){if(!n.plugin||!n.tenantId)throw new V("invalid_state","trusted callback requires plugin and tenantId");a=n.plugin,s=n.tenantId}else{let h=vt(r,i.kek);if(!h)throw new V("invalid_state","Invalid or tampered state parameter");a=h.plugin,s=h.tenantId}if(!i.database)throw new V("no_database","No database configured on corsair instance");let c=J(i,a,h=>new V("plugin_not_found",h)),u=ds(c),l=$({authType:"oauth_2",integrationName:a,kek:i.kek,database:i.database}),d=await l.get_client_id(),p=await l.get_client_secret();if(!d||!p)throw new V("credentials_not_configured",`Credentials not configured for '${a}'`);await fu(i.database,a,s,i.kek);let g=await xt(t,d,p,u,o);if(!g.access_token)throw new V("no_access_token",`No access_token returned from ${u.providerName}`);let f=U({authType:"oauth_2",integrationName:a,tenantId:s,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await ve(e,{plugin:c,tenantId:s}).catch(()=>{});try{let h=yu(g,n.callbackParams),b=await Rt(i.plugins,a,h);if(b){try{let k=c.authConfig?.oauth_2?.account??[];await wn({database:i.database,kek:i.kek,pluginId:a,tenantId:s,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${a}' tenant '${s}':`,k)}i.hub&&bn(i.hub,{plugin:a,tenantId:s,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${a}' tenant '${s}':`,h)}if(c.subscribe)try{await Cn(e,c,s,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${a}' tenant '${s}':`,h)}return{plugin:a,tenantId:s}}async function mu(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??Cn,i=[],a=[];if(!t.database)return{renewed:i,failed:a};for(let s of r){let c=t.plugins.find(l=>l.id===s.integrationName);if(!c?.subscribe)continue;let u=`${c.id}/${s.tenantId}`;try{let l=O(c)??"oauth_2",d=U({authType:l,integrationName:c.id,tenantId:s.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[l]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:l,keys:g,hub:t.hub},"endpoint")}await o(n,c,s.tenantId,d),i.push(u)}catch(l){console.warn(`[corsair:renewal] re-subscribe failed for '${u}':`,l),a.push(u)}}return{renewed:i,failed:a}}async function ps(e){let n=P(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return mu({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function hu(e,n={}){let t=!1,r=()=>{t||(t=!0,ps(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function gs(e){if(!P(e).database)throw new Error("A database must be configured to provision Corsair integrations");await It(e,{silent:!0})}async function Tn(e,n){let t=P(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await mn(t,n)}var bu=Symbol.for("corsair:internal"),ku=new Set(["access_token","refresh_token","expires_at","scope"]);function wu(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Cu(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!He(t)&&!ku.has(t)):n.filter(t=>!He(t))}function fs(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function Tu(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1}}function Pu(e){return{[bu]:fs(e)}}async function St(e,n,t={}){let r=kt(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,a=fs(e),s=Pu(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let u=O(c);if(!u)continue;let l=wu(u),d=t.providerNameOverrides?.[c.id]??Ee(c.id),p=await Ke(a,c,n),g=ut(c,u),f=Cu(u,g),h={plugin:c.id,providerName:d,authKind:l,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),l==="oauth"){let k=t.oauthModeOverrides?.[c.id]??(u==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let T=await jr(s,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=T.url}catch(T){T instanceof Error&&/client_id not configured/i.test(T.message)||(h.setupError=T instanceof Error?T.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function ry(e,n,t={}){let r=P(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return St({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function ys(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await mn(e.internalConfig??Tu(e),n)}async function ms(e,n){await Tn(e,n)}async function hs(e,n){let t=yn(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:dt})}async function bs(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await ys(t,n.tenantId);let r=await St(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return hs(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function _t(e,n){let t=P(e),r=N(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await ms(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,a=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,s=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await St(o,n.tenantId,{pluginIds:i,oauthModeOverrides:a,providerNameOverrides:s});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return hs(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function Et(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(a=>a.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=P(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await vu(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function vu(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-52WAGBIW.js"),{postHubConnectSession:i}=await import("./connect-XD2OCCDI.js"),a={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(a,t.tenantId);let s=await r(a,t.tenantId,{pluginIds:t.pluginIds});if(s.length===0)throw new Error("No connectable plugins found for this tenant");let c=s.find(u=>u.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:s})}function Pn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var ie=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Ru(e){let n=e.oauthConfig;if(!n)throw new ie("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Kr(e,n){let t=P(e,()=>new ie("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ie("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new ie("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=vt(n,t.kek);if(!o)throw new ie("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:a}=o,s=J(t,i,p=>new ie("plugin_not_found",p)),c=Ru(s),l=await $({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!l)throw new ie("client_id_not_configured",`client_id not configured for '${i}'`);let d=Ze({oauthConfig:c,clientId:l,redirectUri:r,state:n});return{plugin:i,tenantId:a,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as xu}from"async_hooks";import{randomBytes as Iu}from"crypto";import{v4 as Su}from"uuid";var de=class extends Error{reason;constructor(n,t="pending"){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError",this.reason=t}};async function Ot(e,n){let t=yn(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:gt})}function Mt(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var Zr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function zr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function ks(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Gr(e){return Mt(e)}async function Jr(e,n){if(zr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?ks(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Ot(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:Au(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch(r){return console.warn(`[corsair/${n.plugin}] could not create an approval link for '${n.endpoint}': ${r instanceof Error?r.message:String(r)}`),null}}function Au(e){try{return JSON.parse(e)}catch{return e}}async function Dt(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Jr(e,n);return{...n,approvalUrl:r}}async function Vr(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:a,endpoint:s,args:c,tenantId:u,expiresAt:l,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:a,endpoint:s,args:c});let g=await Jr({manual:t,hub:r},{id:o,token:i,plugin:a,endpoint:s,args:JSON.stringify(c),tenant_id:u,expires_at:l});return zr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Gr(g):Zr:r?g?Gr(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:Zr}var Ht=new xu,ws={open:0,cautious:1,strict:2,readonly:3},vn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function Yr(e,n){return e===void 0?n:n===void 0||ws[e]>=ws[n]?e:n}function Bt(e,n){return Ht.run(Yr(Ht.getStore(),e)??e,n)}function Rn(){return Ht.getStore()}function Qr(e){return Bt("readonly",e)}function Ps(){return Ht.getStore()==="readonly"}function Ut(e,n){if(Ps()&&n!=="read")throw new vn(e,n)}function Ge(e,n){Ut(e,n);let t=Rn();if(!(t===void 0||Lt(n,t)==="allow"))throw new de(`Action '${e}' is a '${n}' operation and permission mode '${t}' does not allow it. The entity store cannot wait for approval.`,"policy")}var _u={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}},Cs={allow:0,require_approval:1,deny:2};function vs(e,n){return e===void 0?n:Cs[e]>=Cs[n]?e:n}function Lt(e,n,t){return t!==void 0?t:_u[n][e]}function Xr(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Rs(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Ts(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function As(e){let n=Lt(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, widen the permission mode in force for this call.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",a).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,h=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${s.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Ts(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let c=Su(),u=Iu(32).toString("hex"),l=e.timeoutMs??600*1e3,d=new Date(Date.now()+l).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:c,created_at:new Date,updated_at:new Date,token:u,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:a,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${c}`,`
+  Permission token: ${u}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Ts(e.db,c,l):{result:"blocked",reason:"pending",id:c,token:u,expiresAt:d}}var w=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function I(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function pe(e){let n={error:e.code,message:e.message,...e.extra};return I(e.status,n)}function Ue(e){return new w(404,"not_found",e)}function L(e,n={}){return new w(400,"bad_request",e,n)}function eo(e,n){return J(e,n,t=>Ue(t))}async function xs(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=$({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=K[t].integration,i=r,a;try{a=await Promise.all(o.map(u=>i[`get_${u}`]()))}catch{a=o.map(()=>null)}let s=o.filter((u,l)=>a[l]==null),c;return t==="oauth_2"?c=!s.includes("client_id")&&!s.includes("client_secret"):c=s.length===0,{configured:c,missingFields:s}}async function Is(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await xs(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Ft(){return{ok:!0}}async function An(e){return Promise.all(e.plugins.map(n=>Is(n,e)))}async function Nt(e,n){let t=eo(e,n);return Is(t,e)}async function Eu(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function Ss(e,n){let t=await Eu(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function xn(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let a=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function $t(e,n){if(!n)throw L("Tenant id must be a non-empty string");return Ss(e,n)}async function Wt(e,n){let t=n?.id?.trim();if(!t)throw L("Tenant id is required",{missingFields:["id"]});return Ss(e,t)}async function qt(e,n){let t=n?.trim()||"default",r={},o=await Gn(e,t);for(let i of o)r[i.plugin]=Pt(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function jt(e,n){let t=n?.plugin;if(typeof t!="string"||!t.trim())throw L("plugin is required",{missingFields:["plugin"]});let r=t.trim();eo(e,r);let o=n?.tenantId;if(o!=null&&typeof o!="string")throw L("tenantId must be a string");let i=o?.trim()||"default";if(!e.database)return{ok:!0,disconnected:!1};let a=e.database.db,s=await a.selectFrom("corsair_integrations").select(["id"]).where("name","=",r).executeTakeFirst();if(!s)return{ok:!0,disconnected:!1};let c=!1;return await a.transaction().execute(async u=>{e.database?.isPg===!0&&await u.selectFrom("corsair_integrations").select("id").where("name","=",r).forUpdate().execute();let l=u.selectFrom("corsair_accounts").select("id").where("tenant_id","=",i).where("integration_id","=",s.id);await u.deleteFrom("corsair_events").where("account_id","in",l).execute(),await u.deleteFrom("corsair_entities").where("account_id","in",l).execute(),c=((await u.deleteFrom("corsair_accounts").where("tenant_id","=",i).where("integration_id","=",s.id).executeTakeFirst()).numDeletedRows??0n)>0n}),{ok:!0,disconnected:c}}async function no(e,n){if(!e.database)throw Ue(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw Ue(`Permission '${n}' not found`);return Dt(e,t)}function Ou(e){if(!e.oauthConfig)throw L(`Plugin '${e.id}' has no oauthConfig`)}function Mu(e){if(!e.manual)throw new w(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function to(e){let n=Mu(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new w(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function Du(e){let n=!!e.hub,t=Pn(e.manual);if(!n&&!t)throw new w(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function _s(e){if(!e.database||!e.kek)throw new w(500,"database_not_configured","A database and kek are required to issue connect links.")}async function Hu(e,n){let t=n?.plugin?.trim();if(!t)throw L("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=eo(e,t);Ou(o);let i=to(e);_s(e);let a=await xs(o,e);if(!a.configured)throw new w(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=hn(Be(t,r),e.kek),c;try{c=new URL(i.baseUrl)}catch{throw new w(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return c.searchParams.set("state",s),{connectUrl:c.toString(),expiresAt:new Date(Date.now()+Wr).toISOString(),tenantId:r}}async function Bu(e,n,t){_s(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let a=t.providerName?.trim();a&&(o.providerName=a);let s=await _t(e,o);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt,tenantId:r}}async function Kt(e,n,t){return Du(n),n.hub?Bu(e,n,t):Hu(n,t)}async function Zt(e,n,t){if(n.hub&&!Pn(n.manual))throw new w(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw L("state is required",{missingFields:["state"]});to(n);try{return await Kr(e,r)}catch(o){if(o instanceof ie)switch(o.code){case"invalid_state":throw L("Invalid or expired state");case"client_id_not_configured":throw new w(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new w(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function Gt(e,n,t){if(n.hub&&!Pn(n.manual))throw new w(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw L("Missing required fields",{missingFields:i});let a=to(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:o,redirectUri:a.redirectUri,callbackParams:t.callbackParams})}catch(c){if(c instanceof Error&&c.name==="OAuthCallbackError")switch(c.code){case"invalid_state":throw L("Invalid or expired state");case"credentials_not_configured":throw new w(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new w(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function ro(e,n){if(!e.database)throw Ue("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw Ue("Permission not found");return Dt(e,t)}async function Es(e,n){return"id"in n?no(e,n.id):ro(e,n.token)}import{createCipheriv as ju,createDecipheriv as um,randomBytes as Hs,scryptSync as Ku}from"crypto";import{createHmac as oo,randomUUID as Uu,timingSafeEqual as Ms}from"crypto";function io(e){return e.run??null}function so(e){return e.probe??null}function Ds(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function zt(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=oo("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":Uu()}}}function ao(e){let n=e.signingSecret.trim();if(!n)return!1;let t=Ds(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>We)return!1;let i=oo("sha256",n).update(e.body).digest("hex");try{return Ms(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function In(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=Ds(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>We)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=oo("sha256",n).update(e.body).digest("hex");try{if(!Ms(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function Sn(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function Jt(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function Vt(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function Vn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function co(e){return Vn(Sn(e))}async function uo(e){let n=await Xt({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=Sn(n.body),r=Jt({httpOk:n.ok,status:n.status,body:t}),o=Vn(t);if(!r||!o)throw new Error(Qt({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function Yt(e){return Vt(Sn(e))}function Lu(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function Os(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var Fu="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",Nu="Check the delivery URL configured for this environment.";function $u(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${Fu}`}function Wu(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${Nu}`}function Yn(e,n){let t=Lu(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function Qt(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Yn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return $u(e);if(e.status===404)return Wu(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${Os(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${Os(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}var qu=15e3;async function Xt(e){let{body:n,headers:t}=zt(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n,signal:AbortSignal.timeout(qu)}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Yn(e.deliveryUrl,r)}}}var Zu="aes-256-gcm",Gu=12,zu=16,Ju=16,Vu=32;function Yu(e,n){return Ku(e.trim(),n,Vu)}function lo(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=Hs(Ju),o=Yu(t,r),i=Hs(Gu),a=ju(Zu,o,i,{authTagLength:zu}),s=JSON.stringify(e),c=Buffer.concat([a.update(s,"utf8"),a.final()]),u=a.getAuthTag();return[r.toString("base64"),i.toString("base64"),u.toString("base64"),c.toString("base64")].join(":")}var Qu=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function po(e){if(e instanceof xi)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!Qu.some(t=>n.includes(t))}function Xu(e){if(!e)return[];let n=O(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!He(r)):[]}async function Qn(e,n){let t=P(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await It(e,{silent:!0});let[r,o]=await Promise.all([xn(t),An(t)]),i={tenants:r.map(a=>({id:a.id})),plugins:o.map(a=>{let s=Xu(t.plugins.find(c=>c.id===a.id));return{id:a.id,authType:a.authType,configured:a.configured,missingFields:a.missingFields,...s.length>0?{integrationCredentialFields:s}:{}}}),syncedAt:new Date().toISOString()};return lo(i,n)}var ge=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function er(e,n){let t=P(e,()=>new ge("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ge("no_database","Database not configured");let r=J(t,n.plugin,l=>new ge("plugin_not_found",l)),o=O(r);if(!o)throw new ge("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new ge("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await Tn(e,n.tenantId);let i=new Set(ut(r,o)),s=r.authConfig?.[o]?.account??[],c=U({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),u=0;for(let[l,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(l))throw new ge("invalid_credentials",`Unknown credential field '${l}' for plugin '${n.plugin}'`);let p=ne(c,`set_${l}`);if(!p)throw new ge("invalid_credentials",`Cannot set credential field '${l}' for plugin '${n.plugin}'`);await p(d.trim()),u+=1}if(u===0)throw new ge("invalid_credentials","Provide at least one credential field to save");return await ve(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var fe=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function go(e,n){let t=P(e,()=>new fe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new fe("no_database","Database not configured");let r=J(t,n.plugin,l=>new fe("plugin_not_found",l)),o=O(r);if(!o)throw new fe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await gs(e);let i=new Set(Ei(r,o)),s=r.authConfig?.[o]?.integration??[],c=$({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:s}),u=0;for(let[l,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(l))throw new fe("invalid_credentials",`Unknown integration credential field '${l}' for plugin '${n.plugin}'`);let p=ne(c,`set_${l}`);if(!p)throw new fe("invalid_credentials",`Cannot set integration field '${l}' for plugin '${n.plugin}'`);await p(d.trim()),u+=1}if(u===0)throw new fe("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var nr=new Map;function el(e){for(let[n,t]of nr)t<=e&&nr.delete(n)}function tr(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();el(r);let o=nr.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(nr.set(t,r+n),{ok:!0})}var Le=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function _n(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:a,scope:s,authType:c="managed",providerData:u}=n;if(!o.trim())throw new Le("no_access_token","Managed OAuth delivery missing access_token");let l=P(e,()=>new Le("invalid_corsair_instance","Invalid corsair instance"));if(!l.database)throw new Le("no_database","No database configured on corsair instance");let d=J(l,t,g=>new Le("plugin_not_found",g));await Tn(e,r);let p=U({authType:c,integrationName:t,tenantId:r,kek:l.kek,database:l.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),a&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await p.set_scope(s),await ve(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await Rt(l.plugins,t,{access_token:o,refresh_token:i,scope:s,...u});if(g){try{let f=d.authConfig?.[c]?.account??[];await wn({database:l.database,kek:l.kek,pluginId:t,tenantId:r,link:g,authType:c,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}l.hub&&bn(l.hub,{plugin:t,tenantId:r,link:g,authType:c})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await Cn(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function nl(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Bs(e,n,t=[]){for(let[r,o]of Object.entries(e))if(nl(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=Bs(o,n,[...t,r]);if(i)return i}return null}function tl(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function rl(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function Us(e,n,t,r,o){let i=tl(n),a=typeof t=="string"?JSON.parse(t):t;(!a||typeof a=="object"&&Object.keys(a).length===0)&&i["x-goog-resource-uri"]&&(a=rl(i)||a);let c={headers:i,body:a,...r?{query:r}:{}},u=r?.tenantId||"default",l=e.withTenant?e.withTenant(u):e,d=o?.plugin,p=d?[d]:lt;for(let g of p){let f=l[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(c))continue;let h=Bs(f.webhooks,c);if(!h)continue;let b=h.path.join("."),k={payload:a,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let T=await h.webhook.handler(k),v=!!Object.keys(T.returnToSender||{})?.length;return{plugin:g,action:b,body:a,response:v?{...T?.returnToSender,success:!0}:{success:!0},...T.responseHeaders&&{responseHeaders:T.responseHeaders}}}catch(T){return console.error(`Error executing webhook handler for ${g}.${b}:`,T),{plugin:g,action:b,body:a,response:{success:!1,error:T instanceof Error?T.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as ol}from"crypto";import*as ze from"vm";var Ls="__corsairFailedStep",il=3e4,fo=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function Fs(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function Ns(e,n){return`st_${ol("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function rr(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var $s=new Set(["constructor","prototype","__proto__"]);function Re(e,n){if(e===null)return null;let t=typeof e;return t==="function"?al(e,n):t==="object"?sl(e):e}function sl(e){return new Proxy(e,{get(n,t){if(!$s.has(t))return Re(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function al(e,n){return new Proxy(e,{apply:(t,r,o)=>cl(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!$s.has(r))return Re(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function cl(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>Re(n,void 0),n=>{throw Re(n,void 0)}):Re(e,void 0)}function ul(e){let n=Object.create(null),t=ze.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=ze.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),a=ze.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),c=ze.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=Re(e.corsair,void 0),n.__payload=o,n.__step=a,n.__console=c;let u=ze.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});u.catch(()=>{});let l,d=new Promise((p,g)=>{l=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([u,d]).finally(()=>clearTimeout(l))}async function yo(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(a,s)=>{if(o)throw o;let c=r++,u=Ns(a,c);if(Object.hasOwn(n,u))return Re(n[u].output,void 0);try{let l=await s();return t.push({stepId:u,name:a,seq:c,status:"completed",output:l}),l}catch(l){if(Fs(l))throw l;let d=rr(l);t.push({stepId:u,name:a,seq:c,status:"failed",error:d});let p=new Error(d);throw p[Ls]=a,p}});i.sleep=async(a,s)=>{if(o)throw o;let c=r++,u=Ns(a,c);if(Object.hasOwn(n,u))return;t.push({stepId:u,name:a,seq:c,status:"completed",output:null});let l=Number.isFinite(s)?Math.max(0,s):0;throw o=new fo(Date.now()+l,a),o};try{await ul({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??il});let a=o;return a?{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(a){if(Fs(a))return{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()};let s=rr(a),c=a!==null&&typeof a=="object"?a[Ls]:void 0;return{status:"failed",steps:t,error:{message:s,...c?{failedStep:c}:{}}}}}import*as or from"vm";var Ws=1e4;async function mo(e){let n=Object.create(null),t=or.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=Re(e.corsair,void 0);let r=dl(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await Qr(()=>{let a=or.runInContext(o,t,{filename:"corsair:probe",timeout:r});a.catch(()=>{});let s,c=new Promise((u,l)=>{s=setTimeout(()=>l(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([a,c]).finally(()=>clearTimeout(s))});return{status:"ok",value:ll(i)}}catch(i){return{status:"error",error:rr(i)}}}function ll(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function dl(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?Ws:Math.min(e,Ws)}function Je(e){return e.deliveryMode==="auth.credentials"}function Xn(e){return e.deliveryMode==="connections.sync"}function ir(e){return e.deliveryMode==="connect.create_link"}function et(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function nt(e){return e.deliveryMode==="oauth.tokens"}function sr(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!Je(e)&&!Xn(e)&&!ir(e)&&!et(e)&&!nt(e)}function pl(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function gl(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await Qn(e,n)}}}}}catch(t){return{status:"failed",retryable:po(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function fl(e,n){try{let t=await Et(e,n);return pl(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function ho(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function yl(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await At({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function ml(e,n,t,r){let o=await yl(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},a=await Us(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!a.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(a.response&&a.response.success===!1)return{status:"failed",retryable:!1,error:typeof a.response.error=="string"?a.response.error:"Webhook handler failed"};let s=a.response?.returnToSender,c=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(a.response?.data??a.response);return{status:"ok",webhookResponse:{status:a.response?.statusCode??200,body:c,headers:a.responseHeaders}}}async function hl(e,n){return await Jn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function bl(e,n){return await _n(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function ko(e,n,t){let r=await bo(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function bo(e,n,t){let r=P(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function kl(e,n){try{return await er(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function wl(e,n){try{return await go(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function qs(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function Cl(e,n){try{let t=qs(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await yo({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function Tl(e,n){try{let t=qs(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await mo({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function tt(e,n,t={}){let r=P(e),o=ho(n.headers,"x-corsair-signature"),i=ho(n.headers,"x-corsair-timestamp"),a=ho(n.headers,"x-corsair-nonce"),s=!1;if(t.signingSecret?.trim()){let u=In({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!u.ok)return{status:"failed",retryable:!1,error:u.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let l=tr(`nonce:${a.trim()}`,We);if(!l.ok)return{status:"failed",retryable:!1,error:l.error};s=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let c;try{c=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(c.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(c.type){case"webhook":return ml(e,r,c.payload,s);case"oauth.callback":return hl(e,c.payload);case"oauth.tokens":return bl(e,c.payload);case"permission.approve":return bo(e,c.payload,"approved");case"permission.deny":return bo(e,c.payload,"denied");case"auth.credentials":return kl(e,c.payload);case"integration.credentials":return wl(e,c.payload);case"connect.create_link":return fl(e,c.payload);case"connections.sync":{let u=t.signingSecret?.trim();return u?gl(e,u):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?Cl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?Tl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(c.type)}`}}}function Pl(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var wo=3,vl=250;function Rl(e){return e?.name==="AbortError"}async function Al(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function xl(e,n,t,r,o){for(let i=1;i<=wo;i++){try{let a=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(a.ok)return await Al(a)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(a){if(Rl(a))throw a}i<wo&&await Ks(vl)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${wo} attempts; the run may be retried`),!1}async function Il(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:a,body:s,headers:c}=await i.json(),u=await t.process(e,{headers:c,body:s},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:l,body:d}=Pl(u);return await xl(n,t,o,{deliveryId:a,status:l,body:d},r)?"handled":"error"}var js=1e3,Sl=5e3,_l=3e4;function Ks(e){return new Promise(n=>setTimeout(n,e))}var ar=globalThis.__corsairConnectLoops??=new Map;function El(e,n={fetch,process:tt}){let t;try{t=N(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(ar.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");ar.set(r,o);let i=()=>{ar.get(r)===o&&ar.delete(r)},a=!1,s=null;return(async()=>{let u=js,l=!1,d=async p=>{l||(console.warn("[corsair] connect loop error; retrying",p),l=!0),a||await Ks(u),u=Math.min(u*2,Sl)};try{for(;!a;){s=new AbortController;let p=setTimeout(()=>s?.abort(),_l);try{await Il(e,t,n,s.signal)==="error"?await d("pull or ack failed"):(l=!1,u=js)}catch(g){if(a)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{a=!0,s?.abort(),i()}}}function Zs(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ol(e,n){return n&&!n.has(e.id)?!1:O(e)!==null}async function Gs(e,n,t={}){let r=P(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,a=await Gn(r,o,{pluginIds:t.pluginIds}),s=new Map(a.map(u=>[u.plugin,u])),c=r.plugins.filter(u=>Ol(u,i)).map(u=>{let l=O(u),d=s.get(u.id);return d?{plugin:u.id,providerName:Ee(u.id),authKind:Zs(l),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:u.id,providerName:Ee(u.id),authKind:Zs(l),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:c}}async function zs(e,n){let t=N(e);return Z({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:pt})}function Ml(e){return typeof e=="string"&&e.length>0}function cr(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty managed pricing credentials payload");let n=e;if(!Ml(n.api_key))throw new Error("Hub API returned incomplete managed pricing credentials (expected api_key)");let t={api_key:n.api_key};return n.expires_in!==void 0&&typeof n.expires_in=="number"&&Number.isFinite(n.expires_in)&&n.expires_in>0&&(t.expires_in=n.expires_in),t}var Js=1024*1024,Vs=3e4;function Ve(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:Js}function Ye(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:Vs}function En(e){return new w(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function Dl(e){return new w(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function ur(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o(Dl(n)),n)})])}finally{clearTimeout(t)}}async function lr(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:s,value:c}=await ur(()=>t.read(),n.bodyStallTimeoutMs);if(s)break;if(o+=c.byteLength,o>n.maxBodyBytes)throw En(n.maxBodyBytes);r.push(c)}let i=new Uint8Array(o),a=0;for(let s of r)i.set(s,a),a+=s.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var Co=new Map;function Ys(e){let n;try{n=N(e)}catch{return}let t=Sr(n);t&&Co.get(n.projectApiKey)!==t&&(Co.set(n.projectApiKey,t),S({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{Co.delete(n.projectApiKey)}))}var Hl=[".corsair.dev"];function Bl(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function Ul(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Bl(n)?!0:Hl.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function Qs(e){return!e||!Ul(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function Xs(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function To(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function Po(e,n){let t=N(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=Me(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=tr(`browser:${i.jti}`,Oe);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(Xn(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let s=await Qn(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:pn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:s}}})}}if(ir(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let s=i.connectLinkPlugins?.filter(Boolean)??[];if(s.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let c=await Et(e,{tenantId:i.tenantId,plugins:s});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:pn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:c.connectUrl,expiresAt:c.expiresAt}})}}if(Je(i))return i.hubSuccessUrl?i.credentials?(await er(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:To(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:To(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(et(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await ko(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(nt(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await _n(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!sr(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await Jn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(s){let c=s instanceof Error?s.message:"Hub delivery failed";return Xn(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:pn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:ir(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:pn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:Je(i)&&i.hubSuccessUrl?{type:"redirect",url:To(i.hubSuccessUrl,{error:c})}:Je(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:pn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:{type:"json",status:400,body:{error:c}}}return{type:"redirect",url:i.hubSuccessUrl}}async function vo(e,n){let t=N(e),r=await tt(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,a=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:a}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:a}}function Ro(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function Ao(e,n){return n.method==="GET"?Po(e,n.url):vo(e,{headers:n.headers,body:n.body??""})}async function xo(e,n){try{let t=await Ao(e,n);return Ro(t)}catch(t){if(t instanceof Ce)return Response.json({error:t.message},{status:503});throw t}}async function Qe(e,n,t){Ys(e);let r=n.method.toUpperCase(),o=Qs(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await xo(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await lr(n,{maxBodyBytes:Ve(t?.maxBodyBytes),bodyStallTimeoutMs:Ye(t?.bodyStallTimeoutMs)}):void 0});return Xs(i,o)}var _=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function On(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function Mn(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var ea=new WeakMap;function Xe(e,n,t){let r=ea.get(e);r||(r=new Map,ea.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var na=300;async function Io(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,a=n?.forceRefresh??!1,s=`managed:${o}:${i}`;return Xe(t,s,async()=>{let[c,u,l]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!c&&!l)throw new _(o,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&c&&u&&Number(u)>d+na)return{accessToken:c,expiresAt:Number(u),refreshed:!1};if(!l&&c&&!a){let f=u?Number(u):null;if(f===null||f>d+na)return{accessToken:c,expiresAt:f??d+3600,refreshed:!1}}if(!l)throw new _(o,"managed");let p=await Fl(r,o,i,l),g=await Mn(t,p,u);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function Ll(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function Fl(e,n,t,r){try{return await S({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:dn})}catch(o){let i=o instanceof Error?o.message:"";throw Ll(i)?new _(n,"managed"):o}}async function ta(e,n){e._refreshAuth=async()=>(await Io(n,{forceRefresh:!0})).accessToken}var Nl="",$l=60,So=new WeakMap;function ra(e){let n=yt(e.apiUrl),t=e.instanceKey?.trim()??"";return[encodeURIComponent(n),encodeURIComponent(e.projectApiKey),encodeURIComponent(t)].join(Nl)}function Wl(e,n,t,r){let i=`${ra(e)}:${n}:${t}`;return r?`${i}:${r}`:i}function ql(e,n){return So.get(e)?.get(n)}function jl(e,n,t){let r=So.get(e);r||(r=new Map,So.set(e,r)),r.set(n,t)}function Kl(e,n){return e.expiresAt===null?!1:e.expiresAt>n+$l}function _o(e,n){if(!n)throw new _(e,"managed_pricing",`[auth-missing:${e}:managed_pricing]: Hub config is required. Pass hub: { ... } to createCorsair().`)}async function oa(e,n){_o(e.plugin,e.hub);let t=n?.forceRefresh??!1,r=Wl(e.hub,e.plugin,e.tenantId,n?.operation),i=`managed_pricing:${t?"force":"routine"}:${r}`;return Xe(e.cache,i,async()=>{let a=Math.floor(Date.now()/1e3);if(!t){let u=ql(e.cache,r);if(u&&Kl(u,a))return{apiKey:u.apiKey,expiresAt:u.expiresAt,fromCache:!0}}let s=await S({hub:e.hub,path:"/managed-pricing/credentials",body:{plugin:e.plugin,tenantId:e.tenantId,...n?.operation?{operation:n.operation}:{}},notFoundMessage:"Managed pricing is not configured for this project",parseResponse:cr}),c=s.expires_in!==void 0?a+s.expires_in:null;return jl(e.cache,r,{apiKey:s.api_key,expiresAt:c}),{apiKey:s.api_key,expiresAt:c,fromCache:!1}})}function ia(){return{}}function sa(e){return{delivery:n=>Qe(e,n),deliveryOptions:n=>Qe(e,n)}}var aa=1200*1e3;function Eo(){return we()}function Oo(){return aa}function Mo(e,n){return Wn(e,n,aa)}function Do(e,n){return ue(e,n)}function Ho(e){return qe(e)}var ca=600*1e3;function Bo(){return we()}function Uo(){return ca}function Lo(e,n){return Wn(e,n,ca)}function Fo(e,n){return ue(e,n)}function No(e){return Br(e)}function $o(e){return qe(e)}function Wo(){return we()}function qo(e,n,t){return ht(e,n,Math.floor(t.getTime()/1e3))}function jo(e,n){return ue(e,n)}function Ko(e){return qe(e)}var en=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${je}`),this.name="CorsairKekMissingError"}};function dr(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new en;let a=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${je}`)}})}async function Zl(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function ua(e){let{integrationId:n,accountId:t}=await Zl(e);return{integrationId:n,accountId:t}}function la(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>_r(t(),{tenantId:n,message:r}),list:()=>Or(t(),{tenantId:n}),get:r=>({message:o=>Er(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>Mr(t(),{chatId:r,tenantId:n})})}}function da(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function Gl(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await bs(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):da(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function zl(e,n,t){let r=hn(Be(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):da(e,i),connectUrl:i}}async function Jl(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.error.authType==="managed_pricing"?{message:e.error.message,connectUrl:null}:e.manual&&Pn(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?zl(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?Gl({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function pa(e){let{message:n,connectUrl:t}=await Jl(e);throw new _(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var pr="connect.request",Go="connect.cleared",Vl=600*1e3;async function Zo(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function Yl(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function Ql(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[pr,Go]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function ga(e,n,t,r,o){let i=await Ql(e,n,o),a=new Date(i);await e.db.insertInto("corsair_events").values({id:ln(),created_at:a,updated_at:a,account_id:n,event_type:t,payload:r}).execute()}async function Xl(e,n,t=Date.now()){let r=await Zo(e,n.tenantId,n.plugin);r&&await ga(e,r,pr,{plugin:n.plugin,connectUrl:n.connectUrl},t)}function ed(e){let n=e;if(typeof e=="string")try{n=JSON.parse(e)}catch{return null}return!n||typeof n!="object"||Array.isArray(n)?null:n}async function nd(e,n,t,r,o){let i=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[pr,Go]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!i||i.event_type!==pr)return null;let a=i.created_at instanceof Date?i.created_at.getTime():Date.parse(String(i.created_at));if(r-a>o)return null;let s=ed(i.payload);if(!s)return null;let c=s.plugin,u=s.connectUrl;return typeof c!="string"||typeof u!="string"?null:{plugin:c,connectUrl:u,requestedAt:new Date(a).toISOString(),tenantId:t,requestedAtMs:a,accountId:n}}async function zo(e,n,t=Date.now(),r=Vl){let o=await Yl(e,n);if(o.length===0)return null;let i=(await Promise.all(o.map(u=>nd(e,u,n,t,r)))).filter(u=>u!==null);if(i.length===0)return null;i.sort((u,l)=>u.requestedAtMs-l.requestedAtMs||u.accountId.localeCompare(l.accountId));let{requestedAtMs:a,accountId:s,...c}=i[0];return c}async function fa(e,n,t=Date.now(),r){let o;if(r)o=await Zo(e,n,r);else{let i=await zo(e,n,t);o=i?await Zo(e,n,i.plugin):null}o&&await ga(e,o,Go,{},t)}async function Jo(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await Xl(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl})}catch{}}var td=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function ya(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(o).find(u=>o[u]?.match(e,i));return await(o[a||"DEFAULT"]?.handler||td)(e,i)}function rd(e){return typeof e=="function"}function Vo({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:a=[],keyBuilder:s,permissionsConfig:c,endpointMeta:u,database:l,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:T}){for(let[v,H]of Object.entries(e)){let D=n?.[v];if(rd(H)){let B=D,C=[...a,v].join("."),R=async(x={})=>{let ee=u?.[C];Ut(C,ee?.riskLevel??"write");let re,E=Rn(),q=c?.mode,he=Yr(E,q);if(he){let W=ee,oe=W?.riskLevel??"write",be=c?.overrides?.[C],$e=E!==void 0&&E!==q&&he===E?vs(be,Lt(oe,E)):be,{result:cn,reason:F,onComplete:Ln,token:ct,id:Ci,expiresAt:Oc}=await As({pluginId:o,endpointPath:C,args:x,mode:he,override:$e,riskLevel:oe,meta:W,db:l,timeoutMs:d?Xr(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(cn==="blocked"){let un;F==="denied"?un=`Action '${C}' was denied by the user. Await further instructions before proceeding.`:F==="policy"?un=E?`Action '${C}' is blocked by permission mode '${E}'.`:`Action '${C}' is blocked by the permission policy. Update the corsair config to allow it.`:F==="timeout"?un=`Action '${C}' timed out waiting for approval.`:ct&&Ci?un=await Vr({permissionsOptions:d,manual:g,hub:f,permissionId:Ci,permissionToken:ct,plugin:o,endpoint:C,args:x,tenantId:p??"default",expiresAt:Oc??new Date(Date.now()+(d?Xr(d.timeout):600*1e3)).toISOString(),operationPath:C}):un=`Action '${C}' requires user approval before it can run.`;let Mc=F==="denied"||F==="policy"||F==="timeout"?F:"pending";throw new de(un,Mc)}re=Ln}let Bn=async(W,oe,be)=>{try{return await H(oe,be)}catch(at){if(at instanceof Error){let $e=await ya(at,o,C,typeof be=="object"&&be!==null?be:{args:be},i);if(W<($e.maxRetries||0)){let cn=W+1;console.log(`Retrying (${cn} / ${$e.maxRetries})...`);let F;if($e.headersRetryAfterMs)F=$e.headersRetryAfterMs;else switch($e.retryStrategy){case"exponential_backoff":F=Math.pow(2,cn-1)*1e3;break;case"exponential_backoff_jitter":let Ln=Math.pow(2,cn-1)*1e3,ct=(Math.random()-.5)*1e3;F=Math.max(0,Ln+ct);break;case"linear_1s":F=1e3;break;case"linear_2s":F=2e3;break;case"linear_3s":F=3e3;break;case"linear_4s":F=4e3;break;default:F=1e3;break}return await new Promise(Ln=>setTimeout(Ln,F)),await Bn(cn,oe,be)}}throw at}},Rr;try{Rr=s?await s(t,"endpoint"):void 0}catch(W){if(W instanceof ke)throw h&&f&&kn({hub:f,database:l,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await Jo(l,{tenantId:W.tenantId??p,plugin:W.plugin,connectUrl:W.connectUrl}),W;if(W instanceof _){h&&f&&kn({hub:f,database:l,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1});try{await pa({error:W,manual:g,hub:f,plugin:h,tenantId:p,database:l,kek:b,plugins:k,multiTenancy:T})}catch(oe){throw oe instanceof _&&await Jo(l,{tenantId:oe.tenantId??p,plugin:oe.pluginId,connectUrl:oe.connectUrl}),oe}}throw W}if(!B?.before&&!B?.after){let W=await Bn(0,{...t,key:Rr},x);return await re?.(),h&&f&&kn({hub:f,database:l,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),W}let ki={...t,key:Rr},Un=B.before?await B.before(ki,x):{ctx:ki,args:x,continue:!0,passToAfter:void 0};if(Un.continue===!1)return;let wi=await Bn(0,Un.ctx,Un.args);return await B.after?.(Un.ctx,wi,Un.passToAfter),await re?.(),h&&f&&kn({hub:f,database:l,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),wi};r[v]=R}else if(H&&typeof H=="object"){let B={};Vo({endpoints:H,hooks:D,ctx:t,tree:B,pluginId:o,errorHandlers:i,currentPath:[...a,v],keyBuilder:s,permissionsConfig:c,endpointMeta:u,database:l,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:T}),r[v]=B}}}var ye={findByEntityId:"read",existsByEntityId:"read",findIdByEntityId:"read",findById:"read",findManyByEntityIds:"read",list:"read",search:"read",count:"read",upsertByEntityId:"write",deleteById:"destructive",deleteByEntityId:"destructive"},od=/^\$+date$/;function ma(e){if(typeof e!="object"||e===null||Array.isArray(e))return null;let n=Object.keys(e),t=n[0];return n.length!==1||!t||!od.test(t)?null:typeof e[t]=="string"?t:null}function nn(e){if(e instanceof Date)return{$date:e.toISOString()};if(Array.isArray(e))return e.map(nn);let n=ma(e);return n?{[`$${n}`]:e[n]}:e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,nn(r)])):e}function tn(e){let n=ma(e);if(n){let t=e[n];if(n!=="$date")return{[n.slice(1)]:t};let r=new Date(t);if(Number.isNaN(r.getTime()))throw L(`Invalid $date value "${t}" \u2014 expected an ISO 8601 timestamp`);return r}return Array.isArray(e)?e.map(tn):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,tn(r)])):e}async function Yo(e,n,t){let r=Object.hasOwn(ye,n.method)?ye[n.method]:void 0;if(!r)throw new w(404,"unknown_db_method",`Unknown db method "${n.method}" \u2014 expected one of ${Object.keys(ye).join(", ")}`);Ge(`${n.plugin}.db.${n.entityType}.${n.method}`,r);let i=e?.[n.plugin]?.db;if(!i)throw new w(404,"unknown_plugin",`Plugin "${n.plugin}" has no entity store`);let a=Object.hasOwn(i,n.entityType)?i[n.entityType]:void 0,s=a?.[n.method];if(typeof s!="function")throw new w(404,"unknown_entity_type",`Plugin "${n.plugin}" has no entity type "${n.entityType}"`);return s.apply(a,t)}function id(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Qo({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,a]of Object.entries(e)){let s=n?.[i];if(id(a)){let c=s,u=async l=>{let d=(g,f)=>a.handler(g,f),p=o&&l?.hubVerified!==!0?await o(t,"webhook"):void 0;return!c?.before&&!c?.after?d({...t,key:p},l):(async()=>{let g={...t,key:p},f=c.before?await c.before(g,l):{ctx:g,args:l,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await c.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:a.match,handler:u}}else if(a&&typeof a=="object"){let c={};Qo({webhooks:a,hooks:s,ctx:t,webhooksTree:c,keyBuilder:o}),r[i]=c}}}function ha(e){return e&&typeof e=="object"?e:{}}async function ba(e,n){return Z({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=ha(t).workflows;return Array.isArray(r)?r:[]}})}async function ka(e,n){return Z({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>ha(t).workflow})}async function wa(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Ca(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Ta(e,n){return S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function Xo(e){return e&&typeof e=="object"?e:{}}async function Pa(e,n){return Z({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Xo(t).runs;return Array.isArray(r)?r:[]}})}async function va(e,n){return Z({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=Xo(t).runs;return Array.isArray(r)?r:[]}})}async function Ra(e,n){return Z({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>Xo(t).run})}async function ei(e,n,t){await S({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var Aa=(e,n)=>ei(e,"approve",n),xa=(e,n)=>ei(e,"deny",n),Ia=(e,n)=>ei(e,"cancel",n);function Sa(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?va(t(),{workflowId:r.workflowId,tenantId:n}):Pa(t(),{tenantId:n}),get:r=>Ra(t(),{runId:r,tenantId:n}),approve:r=>Aa(t(),{runId:r,tenantId:n}),deny:r=>xa(t(),{runId:r,tenantId:n}),cancel:r=>Ia(t(),{runId:r,tenantId:n})}}function _a(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>wa(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>ba(t(),{tenantId:n}),get:o=>ka(t(),{workflowId:o,tenantId:n}),run:(o,i)=>Ta(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:Sa(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>Ca(t(),{workflowId:o,tenantId:n,name:i})}}function sd(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await ua({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function ad(e,n){let t={};for(let[r,o]of Object.entries(n))t[r]=new Proxy(o,{get(i,a){let s=i[a];if(typeof a!="string"||typeof s!="function")return s;let c=Object.hasOwn(ye,a)?ye[a]:void 0;if(!c)return s;let u=s;return async(...l)=>(Ge(`${e}.db.${r}.${a}`,c),u.apply(i,l))}});return t}function cd(e,n,t,r,o){return e?Ar(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function ni(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:a,manualConfig:s,hubConfig:c,internalConfig:u}=n,l=r??"default",d=u&&t?()=>mn(u,l):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=sd(t,f.id,l,d);if(h?.entities){let E={};for(let[q,he]of Object.entries(h.entities)){let Bn=t?Ar(t.db,b,q,h.version,he):cd(void 0,b,q,h.version,he);E[q]=Bn}g[f.id].db=E,p[f.id].db=ad(f.id,E)}let k=f.options,T=f.authConfig,v;if(t&&o&&k?.authType){let E=T?.[k.authType]?.account??[];v=U({authType:k.authType,integrationName:f.id,tenantId:l,kek:o,database:t,extraAccountFields:E,ensureProvisioned:d}),p[f.id].keys=v}let H={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...v?{keys:v,authType:k?.authType}:{},tenantId:l,...c?{hub:c}:{}},D=f.endpoints??{},B=f.hooks,C={...i,...f.errorHandlers},R={},x=f.options?.permissions;Vo({endpoints:D,hooks:B,ctx:H,tree:R,pluginId:f.id,errorHandlers:C,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:x,endpointMeta:f.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:f.oauthConfig,kek:o,tenantId:l}:void 0,hubConfig:c,plugin:f,kek:o,allPlugins:e,multiTenancy:u?.multiTenancy}),Object.keys(R).length>0&&(p[f.id].api=R),H.endpoints=R;let ee=f.webhooks??{},re=f.webhookHooks;if(Object.keys(ee).length>0&&!_i(k?.authType)){let E={};Qo({webhooks:ee,hooks:re,ctx:H,webhooksTree:E,keyBuilder:f.keyBuilder}),p[f.id].webhooks=E,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=la(c,l),p.workflows=_a(c,l),p}function Ea(e,n,t){let r={};for(let o of e){let i=o.options,a=o.authConfig;if(i?.authType){let s=a?.[i.authType]?.integration??[],c=$({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:s});r[o.id]=c}}return r}var ud=3e4;function gr(e){let n=e.length;for(;n>0&&e[n-1]==="/";)n--;return e.slice(0,n)}function ld(e){let n=0;for(;n<e.length&&e[n]==="/";)n++;return e.slice(n)}function dd(e,n){return`${gr(e)}/${ld(n)}`}function pd(e,n){let t=n??{},{error:r,message:o,...i}=t;return typeof r!="string"?new w(e,"internal_error","Internal error"):new w(e,r,o,i)}var ti=Symbol("cloudRequestTimeout");async function G(e,n,t,r){let o=Rn(),i=e.fetch??globalThis.fetch,a=e.timeoutMs??ud,s=new AbortController,c,u=new Promise(g=>{c=setTimeout(()=>{s.abort(),g(ti)},a)}),l;try{let g=i(dd(e.baseUrl,t),{method:n,headers:{authorization:`Bearer ${e.apiKey}`,"content-type":"application/json",...o?{"x-corsair-mode":o}:{}},body:r===void 0?void 0:JSON.stringify(r),signal:s.signal}).catch(h=>{if(s.signal.aborted)return ti;throw h}),f=await Promise.race([g,u]);if(f===ti)throw new w(0,"internal_error","Cloud request timed out");l=f}finally{clearTimeout(c)}let d=await l.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!l.ok)throw pd(l.status,p);if(p===void 0)throw new w(l.status,"internal_error","Invalid or empty response body from runtime");return p}var z={invoke:"/:tenant/:plugin/call/:op",entityDb:"/:tenant/:plugin/db/:entity/:method",instances:"/instances",connectLinks:"/connect/links",tenants:"/tenants",tenant:"/tenants/:id",connectionStatus:"/connection-status",disconnect:"/disconnect",permission:"/permissions/:id",permissionLookup:"/permissions/lookup-by-token"};var gd=new Set(["keys","webhooks"]),fd=new Set(["chats","workflows"]),ri=new Set(["then","catch","finally"]);function me(e){return typeof e=="function"?e():Promise.resolve(e)}function Oa(e,n,t,r){let o=async(...i)=>{let a=await me(e);return(await G(a,"POST",z.invoke.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":op",r.map(encodeURIComponent).join(".")),{args:i[0]})).data};return new Proxy(o,{get(i,a){if(!(typeof a!="string"||ri.has(a)))return Oa(e,n,t,[...r,a])}})}function yd(e,n,t){return new Proxy({},{get(r,o){if(!(typeof o!="string"||ri.has(o)))return new Proxy({},{get(i,a){if(typeof a!="string")return;let s=Object.hasOwn(ye,a)?ye[a]:void 0;if(s)return async(...c)=>{Ge(`${t}.db.${o}.${a}`,s);let u=await me(e),l=await G(u,"POST",z.entityDb.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":entity",encodeURIComponent(o)).replace(":method",encodeURIComponent(a)),{args:nn(c)});return tn(l.data)}}})}})}function fr(e,n){let t=e?new Set(e.map(r=>r.id)):null;return new Proxy({},{get(r,o){if(!(typeof o!="string"||ri.has(o))){if(fd.has(o))throw new Error(`"${o}" is not available in cloud mode (deferred)`);if(t&&!t.has(o))throw new Error(`Unknown plugin "${o}"`);return new Proxy({},{get(i,a){if(a==="api")return Oa(n.transport,n.tenantId,o,[]);if(a==="db")return yd(n.transport,n.tenantId,o);if(typeof a=="string"&&gd.has(a))throw new Error(`"${a}" is not available in cloud mode (deferred)`)}})}}})}function yr(e){return{connect:{createLink:n=>{if(!n.plugin||!n.tenantId)throw new Error('connect.createLink requires both "plugin" and "tenantId" in cloud mode');return me(e).then(t=>G(t,"POST",z.connectLinks,n))}},tenants:{create:n=>me(e).then(t=>G(t,"POST",z.tenants,n)),list:()=>me(e).then(n=>G(n,"GET",z.tenants)),get:n=>me(e).then(t=>G(t,"GET",z.tenant.replace(":id",encodeURIComponent(n))))},connectionStatus:{get:n=>me(e).then(t=>G(t,"GET",`${z.connectionStatus}?tenantId=${encodeURIComponent(n.tenantId)}`))},disconnect:n=>me(e).then(t=>G(t,"POST",z.disconnect,n)),permissions:{get:n=>me(e).then(t=>"id"in n?G(t,"GET",z.permission.replace(":id",encodeURIComponent(n.id))):G(t,"POST",z.permissionLookup,{token:n.token}))}}}var Ae=class extends w{type;retryable;param;docUrl;requestId;constructor(n,t){super(n,t.code,t.message,{...t}),this.name="CloudApiError",this.type=t.type??"api_error",this.retryable=t.retryable??(n===0||n===429||n>=500),this.param=t.param,this.docUrl=t.doc_url,this.requestId=t.request_id}};function rt(e,n,t){let r=t?.get("request-id")?.trim()||void 0,i=(n??{}).error;if(typeof i=="string"){let a=n.message;return new Ae(e,{code:i,message:typeof a=="string"?a:void 0,request_id:r})}return i&&typeof i=="object"&&typeof i.code=="string"?new Ae(e,{request_id:r,...i}):new Ae(e,{code:e===0?"request_failed":"internal_error",message:`Corsair Cloud returned ${e} with no error body`,request_id:r})}var md=3e4,hd=new Set(["GET","HEAD","PUT","DELETE"]),bd=/^[a-z][a-z0-9-]{0,31}$/;function rn(e,n){if(!bd.test(e))throw new Error(`${n}: "${e}" is not a valid instance key. Lowercase letter first, then letters, digits or hyphens, up to 32 characters.`)}function on(e){let n=new URLSearchParams;for(let[r,o]of Object.entries(e))o!==void 0&&n.set(r,String(o));let t=n.toString();return t?`?${t}`:""}function A(e,n){return`${e}/${encodeURIComponent(n)}`}async function mr(e,n,t,r,o={}){let i=e.fetch??globalThis.fetch,a=new AbortController;o.signal?.aborted&&a.abort();let s=()=>a.abort();o.signal?.addEventListener("abort",s,{once:!0});let c=setTimeout(()=>a.abort(),e.timeoutMs??md),u={authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"};e.apiVersion&&(u["corsair-version"]=e.apiVersion),o.idempotencyKey&&(u["idempotency-key"]=o.idempotencyKey),o.requestId&&(u["x-corsair-request-id"]=o.requestId);let l;try{l=await i(`${e.baseUrl}${t}`,{method:n,headers:u,body:r===void 0?void 0:JSON.stringify(r),signal:a.signal});let d=await l.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!l.ok)throw rt(l.status,p,l.headers);if(p===void 0&&l.status!==204)throw rt(l.status,void 0,l.headers);return p}catch(d){if(o.signal?.aborted||d instanceof Ae)throw d;let p=hd.has(n),g=l?p?!0:void 0:p||!!o.idempotencyKey;throw rt(l?.status??0,{error:{code:"request_failed",message:d instanceof Error?d.message:String(d),retryable:g}},l?.headers)}finally{clearTimeout(c),o.signal?.removeEventListener("abort",s)}}function oi(e,n){rn(n,"withInstance");let t=(s,c,u,l)=>mr(e,s,c,u,l),r=(...s)=>[n,...s].join(":"),o=s=>on({...s,instance:n}),i=s=>`${A("/instances",n)}${s}`,a=s=>`${A("/webhooks",r(s))}/deliveries`;return{instanceKey:n,tenants:{list:(s={},c)=>t("GET",`/tenants${o(s)}`,void 0,c),create:(s,c)=>t("POST","/tenants",{...s,instance:n},c),get:(s,c)=>t("GET",A("/tenants",r(s)),void 0,c),update:(s,c,u)=>t("PATCH",A("/tenants",r(s)),c,u),delete:(s,c)=>t("DELETE",A("/tenants",r(s)),void 0,c)},access:{list:(s={},c)=>t("GET",`/access${o(s)}`,void 0,c),get:(s,c)=>t("GET",A("/access",r(s)),void 0,c),set:(s,c,u)=>t("PUT",A("/access",r(s)),c,u),revoke:(s,c)=>t("DELETE",A("/access",r(s)),void 0,c)},connections:{list:(s={},c)=>t("GET",`/connections${o(s)}`,void 0,c),get:(s,c,u)=>t("GET",A("/connections",r(s,c)),void 0,u),delete:(s,c,u)=>t("DELETE",A("/connections",r(s,c)),void 0,u)},connect:{createSession:(s,c)=>t("POST","/connect/sessions",{...s,instance:n},c)},integrations:{list:(s={},c)=>t("GET",`/integrations${o(s)}`,void 0,c),get:(s,c)=>t("GET",A("/integrations",r(s)),void 0,c),put:(s,c,u)=>t("PUT",A("/integrations",r(s)),c,u),delete:(s,c)=>t("DELETE",A("/integrations",r(s)),void 0,c),operations:(s,c)=>t("GET",`${A("/integrations",r(s))}/operations`,void 0,c),oauthApp:{get:(s,c)=>t("GET",`${A("/integrations",r(s))}/oauth-app`,void 0,c),put:(s,c,u)=>t("PUT",`${A("/integrations",r(s))}/oauth-app`,c,u),delete:(s,c)=>t("DELETE",`${A("/integrations",r(s))}/oauth-app`,void 0,c)}},webhooks:{list:(s={},c)=>t("GET",`/webhooks${o(s)}`,void 0,c),create:(s,c)=>t("POST","/webhooks",{...s,instance:n},c),get:(s,c)=>t("GET",A("/webhooks",r(s)),void 0,c),delete:(s,c)=>t("DELETE",A("/webhooks",r(s)),void 0,c),rotateSecret:(s,c,u)=>t("POST",`${A("/webhooks",r(s))}/rotate-secret`,c,u),deliveries:{list:(s,c={},u)=>t("GET",`${a(s)}${on(c)}`,void 0,u),get:(s,c,u)=>t("GET",A(a(s),c),void 0,u),retry:(s,c,u)=>t("POST",`${A(a(s),c)}/retry`,void 0,u)}},signingSecret:{get:s=>t("GET",i("/signing-secret"),void 0,s),rotate:s=>t("POST",i("/signing-secret/rotate"),void 0,s)},apply:s=>t("POST",i("/apply"),void 0,s),removeFromRuntime:s=>t("POST",i("/remove"),void 0,s),reconcile:s=>t("POST",i("/reconcile"),void 0,s)}}function ii(e){let n=(t,r,o,i)=>mr(e,t,r,o,i);return{project:{get:t=>n("GET","/project",void 0,t)},keys:{get:t=>n("GET","/keys",void 0,t),rotate:t=>n("POST","/keys/rotate",void 0,t)},instances:{list:(t={},r)=>n("GET",`/instances${on(t)}`,void 0,r),create:(t,r)=>(rn(t.instance_key,"instances.create"),n("POST","/instances",t,r)),get:(t,r)=>(rn(t,"instances.get"),n("GET",A("/instances",t),void 0,r)),update:(t,r,o)=>(rn(t,"instances.update"),n("PATCH",A("/instances",t),r,o)),delete:(t,r)=>(rn(t,"instances.delete"),n("DELETE",A("/instances",t),void 0,r))},integrations:{catalog:(t={},r)=>n("GET",`/integrations/catalog${on(t)}`,void 0,r)},mcp:{links:{list:(t={},r)=>n("GET",`/mcp/links${on(t)}`,void 0,r),mint:(t,r)=>n("POST","/mcp/links",t,r),get:(t,r)=>n("GET",A("/mcp/links",t),void 0,r),update:(t,r,o)=>n("PATCH",A("/mcp/links",t),r,o),delete:(t,r)=>n("DELETE",A("/mcp/links",t),void 0,r),rotate:(t,r)=>n("POST",`${A("/mcp/links",t)}/rotate`,void 0,r)},tokens:{mint:(t,r)=>n("POST","/mcp/tokens",t,r)}}}}var Ma="default",kd="corsairCloud: the management API needs a ck_cloud_<slug>.<secret> key, or an explicit `managementUrl`.",wd=new Set(["then","catch","finally","toString","toJSON","valueOf","constructor","inspect",Symbol.toPrimitive,Symbol.toStringTag,Symbol.iterator,Symbol.asyncIterator]);function si(e={}){return new Proxy(e,{get(n,t,r){if(Reflect.has(n,t))return Reflect.get(n,t,r);if(!wd.has(t))throw new Error(kd)}})}function xe(e){throw new Error(`"${e}" is not available in cloud mode (deferred)`)}function Cd(e){let n=e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim();if(!n)throw new Error("Cloud mode (ck_cloud_ key) requires a base URL \u2014 set hub.baseUrl or CORSAIR_CLOUD_URL.");return Fn(n),n}function Da(e){return!!(e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim())}function Td(e,n){let t=yr(e);return{ok:()=>xe("manage.ok"),tenants:t.tenants,plugins:{list:()=>xe("manage.plugins.list"),get:()=>xe("manage.plugins.get")},connectionStatus:{get:r=>{let o=r?.tenantId||void 0;if(!o&&n)throw new Error("connectionStatus.get requires a tenantId in multi-tenant mode");return t.connectionStatus.get({tenantId:o??Ma})}},permissions:t.permissions,connect:{createLink:t.connect.createLink,resolve:()=>xe("manage.connect.resolve"),oauthCallback:()=>xe("manage.connect.oauthCallback")},disconnect:t.disconnect}}function Pd(e,n){let t=Td(e,n.multiTenancy);if(n.multiTenancy)return{withTenant:a=>{if(!a)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return fr(n.plugins,{transport:e,tenantId:a})},get keys(){return xe("keys")},get permissions(){return xe("permissions")},manage:t};let r=fr(n.plugins,{transport:e,tenantId:Ma}),o={manage:t,get keys(){return xe("keys")},get permissions(){return xe("permissions")}};return new Proxy(r,{get(a,s,c){return typeof s=="string"&&s in o?Reflect.get(o,s,c):Reflect.get(a,s,c)}})}function Ha(e){return Pd({baseUrl:Cd(e.hub),apiKey:e.hub.projectApiKey},{multiTenancy:!!e.multiTenancy,plugins:e.plugins})}function vd(e){let n=gr(e),t="/api/corsair";return n.endsWith(t)?n.slice(0,-t.length):n}async function Rd(e){let n=await G({...e,baseUrl:vd(e.baseUrl)},"GET",z.instances),t=new Map;for(let r of n.instances)Fn(r.url,`Instance "${r.instanceKey}" URL`),t.set(r.instanceKey,r.url);return t}function Ad(e){let n=e.apiKey?.trim();if(!n)throw new Error("corsairCloud: apiKey is required");let t=Ti(n),r=e.url?.trim()||Pi(n);if(!r)throw new Error("corsairCloud: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");Fn(r);let o={baseUrl:r,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs},a=(gr(e.managementUrl?.trim()??"")||void 0)??(t?vi(r,t):null);a&&Fn(a,"Management base URL");let s=a?{baseUrl:a,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs,apiVersion:e.apiVersion}:null,c=null;function u(g){return g&&c===g&&(c=null),c||(c=Rd(o).catch(f=>{throw c=null,f})),c}async function l(g){let f=u(),b=(await f).get(g)??(await u(f)).get(g);if(b)return b;let k=[...(await u()).keys()].join(", ");throw new Error(`corsairCloud.withInstance("${g}"): no such instance \u2014 available: ${k||"(none)"}`)}let d=yr(o),p={tenants:d.tenants,permissions:d.permissions};return{manage:s?{...ii(s),...p}:si(p),withInstance:g=>{let f=s?oi(s,g):si(),h=async()=>({...o,baseUrl:await l(g)}),b=yr(h),k={withTenant(T){if(!T)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return fr(void 0,{transport:h,tenantId:T})},connectionStatus:b.connectionStatus,disconnect:b.disconnect,createConnectLink:b.connect.createLink};return s?{...f,...k}:si(k)}}}var xd="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function Ba(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${xd}`),t):n}var Id=e=>new w(404,"unknown_plugin",`Plugin '${e}' is not registered.`),Sd=(e,n)=>new w(404,"unknown_op",`Operation '${n}' not found on plugin '${e}'.`),hr=(e="/call")=>new w(403,"call_disabled",`The ${e} route is disabled. Construct managementHandler with { unsafeAllowUnauthenticated: true } to enable it \u2014 only when your own backend fronts the handler.`),_d=e=>new w(401,"not_connected",`Tenant is not connected for plugin '${e}'. Reconnect and retry.`),Ua=e=>new w(403,"permission_denied",`The call was blocked (${e}).`,{reason:e}),Ed=()=>new w(403,"approval_required","This action needs human approval before it can run. Approval is not resumable over HTTP in this version.",{reason:"pending"}),Od=(e,n)=>new w(502,"provider_error","The provider returned an error.",{providerStatus:e,body:n});function Md(e,n){if(e instanceof w)return e;if(e instanceof _)return _d(e.pluginId||n);if(e instanceof vn)return Ua("readonly");if(e instanceof de)return e.reason==="pending"?Ed():Ua(e.reason);if(e instanceof Error&&e.name==="ApiError"){let t=e;return Od(typeof t.status=="number"?t.status:502,t.body)}return console.error("[corsair] unhandled error in call operation",e),new w(500,"internal_error","Internal error")}var Dd=new WeakMap,La=new WeakMap,Hd=512;function Fa(e,n){let t=e.get(n);return t||(t=new Map,e.set(n,t)),t}function Bd(e,n,t){if(n.size<=Hd)return;let r=La.get(e);for(let o of n.keys())if(o!==t&&(r?.get(o)??0)===0){n.delete(o);return}}function Ud(e,n,t){if(!n.multiTenancy)return{client:e};let r=typeof t=="string"?t.trim():"";if(!r)throw L("tenant is required for a multi-tenant runtime",{missingFields:["tenant"]});let o=Fa(Dd,e),i=o.get(r);if(i)return o.delete(r),o.set(r,i),{client:i,tenantId:r};let a=e.withTenant(r);return o.set(r,a),Bd(e,o,r),{client:a,tenantId:r}}function Ld(e,n){let t=e;for(let r of n.split(".")){if(t==null||typeof t!="object"||!Object.prototype.hasOwnProperty.call(t,r))return null;t=t[r]}return typeof t=="function"?t:null}function Na(e,n=[]){let t=[];for(let[r,o]of Object.entries(e??{}))typeof o=="function"?t.push([...n,r].join(".")):o&&typeof o=="object"&&t.push(...Na(o,[...n,r]));return t}function $a(e){let n={};for(let t of e.plugins)n[t.id]=Na(t.endpoints??{});return n}async function ai(e,n,t,r){if(!n.plugins.some(s=>s.id===t.plugin))throw Id(t.plugin);let{client:o,tenantId:i}=Ud(e,n,t.tenant),a=i?Fa(La,e):null;a&&i&&a.set(i,(a.get(i)??0)+1);try{return await r(o)}catch(s){throw Md(s,t.plugin)}finally{if(a&&i){let s=(a.get(i)??1)-1;s<=0?a.delete(i):a.set(i,s)}}}async function Wa(e,n,{plugin:t,op:r,tenant:o,args:i}){return ai(e,n,{plugin:t,tenant:o},a=>{let s=a[t],c=Ld(s?.api,r);if(!c)throw Sd(t,r);return c(i??{})})}function sn(e,n){if(e===void 0)return n;if(e===null)throw new w(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function ot(e){if(e!==void 0)throw new w(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var Ka=[{method:"GET",pattern:"/ok",public:!0,handler:async()=>I(200,Ft())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>(ot(n),I(200,await xn(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>(ot(t),I(201,await Wt(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(ot(t),I(200,await $t(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>I(200,await An(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>I(200,await Nt(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>I(200,await qt(e,sn(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(ot(t),I(200,await no(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",public:!0,handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?I(200,await ro(e,t)):I(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=sn(r,o.tenantId);return I(200,await Kt(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",public:!0,handler:async({corsair:e,internal:n,query:t})=>I(200,await Zt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",public:!0,handler:async({corsair:e,internal:n,body:t})=>I(200,await Gt(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=sn(t,n.tenantId)??"default",o=e.database?await zo(e.database,r):null;return I(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=sn(t,r?.tenantId)??"default";return e.database&&await fa(e.database,o,void 0,r?.plugin),I(200,{ok:!0})}},{method:"POST",pattern:"/disconnect",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n??{},o=sn(t,r.tenantId);return I(200,await jt(e,{...r,tenantId:o}))}},{method:"GET",pattern:"/call",handler:async({internal:e,allowCall:n})=>{if(!n)throw hr();return I(200,{plugins:$a(e)})}},{method:"POST",pattern:"/:tenant/:plugin/db/:entityType/:method",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw hr("/db");ot(i);let s=o??{};if(s.args!==void 0&&!Array.isArray(s.args))throw L("args must be an array");let c=sn(i,r.tenant),u=tn(s.args??[]),l=await ai(e,n,{plugin:r.plugin,tenant:c},d=>ja(t,()=>Yo(d,{plugin:r.plugin,entityType:r.entityType,method:r.method},u)));return I(200,{data:nn(l)})}},{method:"POST",pattern:"/:tenant/:plugin/call/:op",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw hr();let s=o??{},c=sn(i,r.tenant),u=await ja(t,()=>Wa(e,n,{plugin:r.plugin,op:r.op,tenant:c,args:s.args}));return I(200,{data:u})}}];(()=>{let e=new Set;for(let n of Ka){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function Fd(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let a=t[i],s=r[i];if(a.startsWith(":"))o[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return o}function Nd(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function $d(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await lr(e,n).catch(o=>{throw o instanceof w?o:new w(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new w(400,"invalid_json","Request body is not valid JSON")}}var Wd="/api/corsair",qa=new Set(["open","cautious","strict","readonly"]);function ja(e,n){let t=e.headers.get("x-corsair-mode");if(t===null)return n();if(!qa.has(t))throw L(`Unknown permission mode "${t}" \u2014 expected one of ${[...qa].join(", ")}`);return Bt(t,n)}function j(e,n={}){let t=n.basePath??Wd,r=Ve(n.maxBodyBytes),o=Ye(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},a=P(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async s=>{try{let c=s.headers.get("content-length");if(c!==null&&Number(c)>r)throw En(r);let u=new URL(s.url),l=Nd(u.pathname,t),d=s.method.toUpperCase();if(d==="OPTIONS"||l==="/"||l==="")return await Qe(e,s,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return I(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(u.searchParams);for(let g of Ka){if(g.method!==d)continue;let f=Fd(g.pattern,l);if(!f)continue;if(!g.public&&n.authenticate&&!await n.authenticate(s))return I(401,{error:"unauthorized",message:"invalid or missing credentials"});let h=await $d(s,i),b=n.resolveTenant?await n.resolveTenant(s):void 0;return await g.handler({corsair:e,internal:a,req:s,params:f,query:p,body:h,scopedTenant:b,allowCall:(n.unsafeAllowUnauthenticated??!1)||!!n.authenticate})}throw Ue(`No route for ${d} ${l}`)}catch(c){if(n.onError){let l=await n.onError(c,s);if(l)return l}if(c instanceof w)return pe(c);let u=c instanceof Error?c.message:"Internal server error";return I(500,{error:"internal_error",message:u})}}}function qd(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function jd(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function Kd(e,n,t){let r=[],o=0,i=e();try{let a=await ur(()=>i.next(),t);for(;a.done!==!0;){let s=jd(a.value);if(o+=s.byteLength,o>n)throw En(n);r.push(s),a=await ur(()=>i.next(),t)}return Buffer.concat(r)}catch(a){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw a}}var Za=!1;function Zd(){Za||(Za=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function Gd(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=Ve(n.maxBodyBytes),o=Ye(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(Zd(),i=JSON.stringify(e.body));else{let s=e[Symbol.asyncIterator];if(typeof s!="function")return;let c=await Kd(s.bind(e),r,o);c.length>0&&(i=c)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw En(r);return typeof i=="string"?i:i}function Y(e){e.resume?.()}async function Fe(e,n={}){let t=qd(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,a=new Headers;for(let[u,l]of Object.entries(e.headers))if(l!=null&&!zd.has(u.toLowerCase()))if(Array.isArray(l))for(let d of l)a.append(u,d);else a.set(u,l);let s={method:(e.method??"GET").toUpperCase(),headers:a},c=await Gd(e,n);return c!==void 0&&(s.body=c,a.has("content-type")||a.set("content-type","application/json")),new Request(i,s)}async function Q(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var zd=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function Ga(e,n){let t=j(e,n);return async(r,o,i)=>{try{let a=await t(await Fe(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(o,a)}catch(a){if(a instanceof w&&o.headersSent!==!0){await Q(o,pe(a)),Y(r);return}Y(r),i(a)}}}function Jd(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function Vd(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=Jd(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function za(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function Ja(e,n){let t=j(e,n);return async(r,o)=>{Vd(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let a=await t(await Fe(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await Q(o.raw,a)}catch(a){if(a instanceof w&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await Q(o.raw,pe(a)),Y(i);return}throw Y(i),a}}}function Va(e,n){let t=j(e,n);return r=>t(r.req.raw)}function Ya(e,n){let t=j(e,n);return{GET:t,POST:t,OPTIONS:t}}function Qa(e,n){let t=j(e,n);return async(r,o)=>{try{let i=await t(await Fe(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),Y(r);return}if(i instanceof w){await Q(o,pe(i)),Y(r);return}console.error("[corsair] management handler failed:",i),await Q(o,I(500,{error:"internal_error"})),Y(r)}}}function br(e,n){let t=j(e,n);return r=>t(r.request)}function Xa(e,n){let t=br(e,n);return{GET:t,POST:t,OPTIONS:t}}function ec(e,n){let t=br(e,n);return{loader:t,action:t}}function nc(e,n){let t=br(e,n);return{GET:t,POST:t,OPTIONS:t}}function tc(e,n){let t=br(e,n);return{GET:t,POST:t,OPTIONS:t}}function rc(e,n){let t=j(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await Fe(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(r.node.res,i)}catch(i){if(i instanceof w&&r.node.res.headersSent!==!0){await Q(r.node.res,pe(i)),Y(o);return}throw Y(o),i}}}function oc(e,n){return j(e,n)}function ic(e){let n={[it]:e};return{ok:Ft,tenants:{list:()=>xn(e),create:t=>Wt(e,t),get:t=>$t(e,t)},plugins:{list:()=>An(e),get:t=>Nt(e,t)},connectionStatus:{get:t=>qt(e,t?.tenantId)},permissions:{get:t=>Es(e,t)},connect:{createLink:t=>Kt(n,e,t),resolve:t=>Zt(n,e,t),oauthCallback:t=>Gt(n,e,t)},disconnect:t=>jt(e,t)}}async function sc(e,n,t,r,o="pending"){if(!e)return null;try{let i=ln(),a=new Date;return await e.db.insertInto("corsair_events").values({id:i,created_at:a,updated_at:a,account_id:n,event_type:t,payload:r,status:o}).execute(),i}catch(i){return console.warn("Failed to log event:",i),null}}async function Yd(e,n,t,r="pending"){try{let o=await e.$getAccountId();return sc(e.database,o,n,t,r)}catch(o){return console.warn("Failed to log event:",o),null}}import*as cc from"https";import*as kr from"querystring";var Qd=["expires_in","refresh_token_expires_in"];function ac(e){let n={...e};for(let t of Qd){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function Xd(e){try{return ac(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=kr.parse(e);return!n.access_token&&!n.error?null:ac({...n})}function xt(e,n,t,r,o){let i=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,c)=>{let u={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};a||(u.client_id=n,u.client_secret=t);let l=kr.stringify(u),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(l).toString()};a&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=cc.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){c(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=Xd(f);h?s(h):c(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>c(new Error(`Request failed: ${g.message}`))),p.write(l),p.end()})}async function uc(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[a,s,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(On({accessToken:a,expiresAt:s,forceRefresh:n?.forceRefresh}))return{accessToken:a,expiresAt:Number(s),refreshed:!1};if(!c)throw new _(o,"oauth_2");let u=await S({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:c},parseResponse:dn}),l=await Mn(t,u,s);return{accessToken:u.access_token,expiresAt:l,refreshed:!0}}async function lc(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:a="form",extraParams:s}=e,c={grant_type:"refresh_token",refresh_token:t,...s},u={Accept:"application/json"};i==="basic"?u.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?u.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(c.client_id=o),c.client_secret=r),a==="json"?u["Content-Type"]="application/json":u["Content-Type"]="application/x-www-form-urlencoded";let l=await fetch(n,{method:"POST",headers:u,body:a==="json"?JSON.stringify(c):new URLSearchParams(c)});if(!l.ok)throw new Error(`OAuth token refresh failed (${l.status}): ${await l.text()}`);let d=JSON.parse(await l.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function dc(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new _(n.plugin,"oauth_2");let u={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},l=g=>Xe(e.keys,r,async()=>(await uc(u,{forceRefresh:g})).accessToken);e._refreshAuth=()=>l(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return On({accessToken:d,expiresAt:p})?d:l(!1)}let o=t.client_secret,i=t.client_id,a=u=>Xe(e.keys,r,async()=>{let[l,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!u&&On({accessToken:l,expiresAt:d}))return l;if(!p)throw new _(n.plugin,"oauth_2");let g=await lc({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await Mn(e.keys,g,d),g.access_token});e._refreshAuth=()=>a(!0);let[s,c]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return On({accessToken:s,expiresAt:c})?s:a(!1)}var pc="  ";function ae(e){let n=e;return n._def??n.def??{}}function ce(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function se(e){return e.innerType??e.schema??e.out??e.in}function fc(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return se(e)}}function yc(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Cr(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Dn(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function mc(e,n){return e.description??n.description}function ep(e){let n=e;for(;n;){let t=ae(n),r=mc(n,t);if(r)return r;let o=ce(t);if(pi(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=fc(t,o);continue}break}}function pi(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function X(e){let n=ae(e),t=ce(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Dn(n)[0]??"unknown");case"ZodEnum":return Dn(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=se(n);return r?X(r):"unknown"}case"ZodNullable":{let r=se(n);return`${r?X(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=se(n);return r?X(r):"unknown"}case"ZodArray":{let r=yc(n);if(!r)return"unknown[]";let o=ae(r),i=ce(o)==="ZodUnion",a=X(r);return`${i?`(${a})`:a}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Cr(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([a,s])=>{let c=ce(ae(s));return`${c==="ZodOptional"||c==="ZodNullable"?a+"?":a}: ${X(s)}`}).join(", ")} }`}case"ZodUnion":return Dn(n).map(r=>X(r)).join(" | ");case"ZodIntersection":return`${X(n.left)} & ${X(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=fc(n,t);return r?X(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function Ie(e){let n=ae(e),t=ce(n),r=mc(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??Dn(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=Dn(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=se(n),i=o?Ie(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=se(n),i=o?Ie(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=se(n);return o?{...Ie(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=yc(n);return{kind:"array",optional:!1,description:r,items:o?Ie(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=Cr(e,n),i={};for(let[a,s]of Object.entries(o))i[a]=Ie(s);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=Dn(n);for(let i of o){let a=ae(i);if(ce(a)==="ZodObject")return{...Ie(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=se(n);return o?{...Ie(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function EP(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),a=e.find(l=>l.id===o);if(!a)return null;let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=Ne(a.endpointMeta,s),u=Ne(a.endpointSchemas,s);return!c&&!u?null:{input:u?.input?Ie(u.input):null,output:u?.output?Ie(u.output):null,description:c?.description}}var gi=["equals","contains","startsWith","endsWith","in"],np=["equals","gt","gte","lt","lte","in"],tp=["equals"],rp=["equals","before","after","between"];function hc(e){let n=ae(e);switch(ce(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=se(n);return r?hc(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function fi(e){let n=ae(e),t=ce(n);if(pi(t)){let i=se(n);return i?fi(i):{}}if(t!=="ZodObject")return{};let r=Cr(e,n),o={};for(let[i,a]of Object.entries(r)){let s=hc(a);s==="string"?o[i]={type:"string",operators:gi}:s==="number"?o[i]={type:"number",operators:np}:s==="boolean"?o[i]={type:"boolean",operators:tp}:s==="date"&&(o[i]={type:"date",operators:rp})}return o}function bc(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function ui(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&ui(o,i,t)}}function li(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function di(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];li(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&di(o,i,t)}}function yi(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!o)return null;let[i,a]=o;if(r.length===0)return li(a)?[i]:null;if(a!==null&&typeof a=="object"&&!li(a)){let s=yi(a,r);if(s!==null)return[i,...s]}return null}function kc(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let a="    ".repeat(i+2);t.push(`${a}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let a="    ".repeat(i+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var op=new Set(lt);function an(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(s=>s.id===r);if(!i)return op.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:an(e);if(t==="webhooks"){if(!i.webhooks)return[];let s=[];return di(i.webhooks,[],s),s.map(c=>`${i.id}.webhooks.${c}`)}if(t==="db"){let s=i.schema?.entities;return s?Object.keys(s).map(c=>`${i.id}.db.${c}.search`):[]}if(!i.endpoints)return[];let a=[];return ui(i.endpoints,[],a),a.map(s=>`${i.id}.api.${s}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let a=[];di(i.webhooks,[],a),o[i.id]=a.map(s=>`${i.id}.webhooks.${s}`)}else if(t==="db")for(let i of e){let a=i.schema?.entities;a&&(o[i.id]=Object.keys(a).map(s=>`${i.id}.db.${s}.search`))}else for(let i of e){if(!i.endpoints)continue;let a=[];ui(i.endpoints,[],a),o[i.id]=a.map(s=>`${i.id}.api.${s}`)}return o}function Ne(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function ip(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),a=i.startsWith(".")?i.slice(1):i;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function ci(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function OP(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),a=e.find(s=>s.id===o);if(a){if(i.startsWith("db.")){let l=i.slice(3),d=l.lastIndexOf(".");if(d!==-1){let p=l.slice(0,d),g=l.slice(d+1),f=a.schema?.entities;if(g==="search"&&f){let h=bc(f,p);if(h){let[b,k]=h,T=fi(k),v=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${gi.join(", ")}]`];for(let[H,D]of Object.entries(T))v.push(`  ${H}?: ${D.type}  [${D.operators.join(", ")}]`);return v.push("}"),v.join(`
+`)}}}return ci(an(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let l=i.slice(9);if(a.webhooks){let d=yi(a.webhooks,l.split("."));if(d!==null){let p=d.join("."),g=Ne(a.webhookSchemas,p.toLowerCase()),f=g?.response?X(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${wr(Hn(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${kc(o,d)}`),h.join(`
+
+`)}}return ci(an(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=Ne(a.endpointMeta,s),u=Ne(a.endpointSchemas,s);if(c||u){let l=[],d=[c?.riskLevel?`[${c.riskLevel}]`:"",c?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[c?.description,d].filter(Boolean).join("  ");return p&&l.push(p),u?.input&&l.push(`input ${wr(Hn(u.input))}`),u?.output&&l.push(`output ${wr(Hn(u.output))}`),l.join(`
+
+`)}}}return ci(an(e),"Path not found. Available operations")}function gc(e){let n=e;for(;;){let t=ae(n),r=ce(t);if(pi(r)){let o=se(t);if(!o)return n;n=o;continue}return n}}function Hn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=gc(e),t=ae(n);if(ce(t)==="ZodObject"){let o=Cr(n,t),i=[];for(let[a,s]of Object.entries(o)){let c=ae(s),u=ce(c),l=u==="ZodOptional"||u==="ZodNullable",d=gc(s),p=ep(s);i.push({key:a,optional:l,type:X(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:X(n)}}function wr(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=pc.repeat(n+1),r=pc.repeat(n);return`{
+${e.fields.map(i=>{let a=i.optional?`${i.key}?`:i.key,s=i.description?`  // ${i.description}`:"";return`${t}${a}: ${i.type}${s}`}).join(`
+`)}
+${r}}`}return"unknown"}function sp(e,n){let t=an(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(l=>l.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let l of t){let{shortPath:d,lookupKey:p}=ip(l,n),g=Ne(r.endpointMeta,p),f=Ne(r.endpointSchemas,p);!g&&!f||o.push({path:l,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Hn(f?.input),output:Hn(f?.output)})}o.sort((l,d)=>l.path.localeCompare(d.path));let i=[],a=an(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let l of a){let p=l.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=yi(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=Ne(r.webhookSchemas,b.toLowerCase()),T=k?.response?X(k.response):void 0;i.push({path:l,description:k?.description,payload:Hn(k?.payload),responseType:T,usageExample:kc(n,h)})}i.sort((l,d)=>l.path.localeCompare(d.path));let s=[],c=an(e,{plugin:n,type:"db"}),u=r.schema?.entities;if(Array.isArray(c)&&u)for(let l of c){let p=l.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let T=bc(u,b);if(!T)continue;let[v,H]=T,D=fi(H),B=Object.entries(D).map(([C,R])=>({field:C,type:R.type,operators:R.operators}));s.push({path:l,entityName:v,filters:[{field:"entity_id",type:"string",operators:gi},...B]})}return s.sort((l,d)=>l.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:s}}}import{randomUUID as wc}from"crypto";async function ap(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=wc(),o=wc(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as cp}from"crypto";var Tr="https://graph.microsoft.com/v1.0",mi=2e4,up=60;async function lp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${Tr}/subscriptions`,{headers:r,signal:AbortSignal.timeout(mi)});if(c.ok){let{value:u}=await c.json(),l=(u??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(l.map(d=>fetch(`${Tr}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(mi)}).catch(()=>{})))}}catch{}let o=cp(),i=new Date(Date.now()+up*6e4).toISOString(),a=await fetch(`${Tr}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(mi),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!a.ok)throw new Error(`MS Graph subscribe failed (${a.status}): ${await a.text()}`);let s=await a.json();return s.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:s.id},webhookSecret:o}):null}function Cc(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function dp(e,n){let t=Cc(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function pp(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function Tc(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function Pc(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function st(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function gp(e){return st(e.body)}function vc(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Pr(Array.isArray(r)?r:[r])}function Rc(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let u=Pr(Array.isArray(c)?c:[c]);if(u)return decodeURIComponent(u)}let r=vc({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let u=n[c],l=Array.isArray(u)?u[0]:u;if(!(!l||typeof l!="string"))try{let p=(l.startsWith("http")?new URL(l):new URL(`https://example.invalid${l.startsWith("/")?l:`/${l}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=st(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Pr([a?.validationToken])??null}function fp(e){if(Rc(e))return!0;let n=st(e.body??e.payload);return Tc(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Pr(e){for(let n of e){let t=Pc(n);if(t)return t}}function yp(e){let t=st(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var it=Symbol.for("corsair:internal");function Sc(e){if(e.hub?.projectApiKey?.startsWith("ck_cloud_")&&Da(e.hub))return Ha(e);let n=e.database?Ai(e.database,{dbTables:e.dbTables}):void 0,t=e.kek??"",r=n&&t?Ea(e.plugins,n,t):dr(!!n,!!t),o=Ba(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?bt(e.hub):void 0},a=Rs(n),s=ic(i);if(e.multiTenancy){let l=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=ni(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[it]:i})},keys:r,permissions:a,manage:s},{[it]:i});return Ac(l,i.hub),Ic(l,i.hub),l}let c=ni(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),u=Object.assign({},c,{keys:r,permissions:a,manage:s,[it]:i});return Ac(u,i.hub),Ic(u,i.hub),u}function Ac(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-PH5SEPJY.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function mp(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var xc=globalThis.__corsairTunnels??=new Set,hp=1e3,bp=3e4;function kp(e){let n=e.schedule??((a,s)=>void setTimeout(a,s).unref?.()),t=e.minDelayMs??hp,r=e.maxDelayMs??bp,o=t,i=()=>{let a=!1,s=()=>{a||(a=!0,n(i,o),o=Math.min(o*2,r))};e.start(s).then(()=>{o=t}).catch(s)};i()}function Ic(e,n){if(!mp(n))return;let t=n.projectApiKey;if(xc.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}xc.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??xr;kp({start:a=>import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:a})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Ir}`)}).catch(s=>{throw console.warn(`[corsair] tunnel down: ${s instanceof Error?s.message:String(s)}. Retrying \u2014 run \`corsair setup\` if it doesn't recover.`),s})})}var wp={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},hi=wp;async function It(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},a=n?.caller??"script",s=Ii(e);if(!s)throw new Error("setupCorsair: invalid corsair instance");if(!s.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=Op(e,s.plugins,n),u={...s,database:s.database},l=u.database.db;await Hp(u.database,i);let d=await Bp(l,u,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Fp(e,c,n.credentials,u,o,i);let p=await $p(d,c,o,a);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=Sc({plugins:s.plugins,database:l,kek:s.kek,multiTenancy:!0}).withTenant(c.tenantId);await Wp(g,s.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function bi(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...K[n][t],...r])}function Ep(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(s=>s.id===t);if(!o)continue;let i=O(o);if(!i)continue;let a=bi(o,i,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function Op(e,n,t){let r=Si(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Ep(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function Ec(e,n){return _e(e)?n===0?!0:Object.values(e).every(t=>Ec(t,n-1)):!1}function Mp(e){return Ec(e,4)}var Dp=Oi;function vr(e){if(e instanceof Ap){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof _p?vr(r):"unknown";return n}return e instanceof vp?`${vr(e.unwrap())} | null`:e instanceof xp?`${vr(e.unwrap())} | undefined`:e instanceof Pp?e.options.join(" | "):e instanceof Sp?"string":e instanceof Rp?"number":e instanceof Cp?"boolean":e instanceof Tp?"date":e instanceof Ip?"jsonb":"unknown"}async function Hp(e,n){let t=await e.db.introspection.getTables(),r=new Set(t.map(i=>i.name)),o=e.tableNames??Ri();for(let[i,a]of Object.entries(Dp)){let s=o[i];if(!r.has(s)){let c=s!==i?` (dbTables.${i} \u2192 "${s}")`:"";n(`[corsair:setup] Table "${s}" does not exist${c}. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(vr(a),null,2)}`)}}}async function Bp(e,n,t,r,o){let i=new Date,a=new Map;for(let s of n.plugins){let c=s.id,u=O(s),l=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!l){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),l=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=u?s.authConfig?.[u]?.integration??[]:[],p=u?s.authConfig?.[u]?.account??[]:[],g=u&&l?$({authType:u,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(l&&!l.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!l||!u||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",l.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:l.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&U({authType:u,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}a.set(c,{pluginId:c,authType:u,integration:g,account:f,integrationFields:[...K[u].integration,...d],accountFields:r?[...K[u].account,...p]:[]})}return a}function Up(e){if(!_e(e))return;let n=e.keys;return _e(n)?n:void 0}function Lp(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Fp(e,n,t,r,o,i){let a=Up(e),s=n.provisionAccounts?Lp(e,n.tenantId):void 0;for(let[c,u]of Object.entries(t)){let l=r.plugins.find(k=>k.id===c);if(!l){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=O(l);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=bi(l,d,"integration"),g=bi(l,d,"account"),f=a?.[c],h=s?.[c],b=_e(h)?h.keys:void 0;for(let[k,T]of Object.entries(u))if(T){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let v=ne(f,`set_${k}`);if(!v){i(`[corsair:setup] Cannot set integration field '${k}' for '${c}'.`);continue}await v(T),o(`[corsair:setup] Set ${c} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${k}' on a multi-tenant instance`);let v=ne(b,`set_${k}`);if(!v){i(`[corsair:setup] Cannot set account field '${k}' for '${c}'.`);continue}await v(T),o(`[corsair:setup] Set ${c} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${c}'.`)}}}var _c=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function Np(e,n,t,r,o,i,a,s,c){let u=[],l=[];for(let p of o){if(_c.has(p))continue;let g=ne(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}if(r&&i.length>0)for(let p of i){if(_c.has(p))continue;let g=ne(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}let d=u.length===0&&l.length===0;if(n==="managed_pricing")s(`[corsair:setup] '${e}' (managed_pricing) uses Corsair metered credentials via Hub \u2014 nothing to store in your database. Pass hub: { ... } to createCorsair().`);else if(d)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...u,...l];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of u)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of l){let h=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}s(g.join(`
+`))}}return d}async function $p(e,n,t,r){let o=new Set;for(let i of e.values())await Np(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function Wp(e,n,t,r,o){if(!Mp(hi)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=hi,a=new Set(n.map(s=>s.id));for(let[s,c]of Object.entries(i)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let u=_e(e)?e[s]:void 0,l=_e(u)?u.api:void 0;if(l)for(let[d,p]of Object.entries(c))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${d}.${g}...`);try{let h=_e(l)?l[d]:void 0;await ne(h,g)?.(f)}catch(h){o(`[corsair:setup] ${s} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{Mi as a,Ee as b,ke as c,dt as d,pt as e,gt as f,dn as g,Di as h,ft as i,Hr as j,Nn as k,$i as l,Wi as m,Oe as n,We as o,we as p,gn as q,fn as r,Me as s,Ur as t,ji as u,qn as v,Ce as w,jn as x,Lr as y,bt as z,N as A,kt as B,yn as C,Te as D,Pe as E,te as F,Fr as G,Kn as H,De as I,le as J,Zn as K,$ as L,U as M,Yi as N,Qi as O,It as P,Fp as Q,Be as R,$r as S,bn as T,wn as U,qr as V,At as W,cs as X,Ze as Y,V as Z,jr as _,Jn as $,ps as aa,hu as ba,St as ca,ry as da,ys as ea,ms as fa,hs as ga,bs as ha,_t as ia,Kr as ja,de as ka,Ot as la,Mt as ma,vn as na,Bt as oa,Rn as pa,Qr as qa,Ps as ra,Ut as sa,Ge as ta,w as ua,io as va,so as wa,zt as xa,ao as ya,In as za,Sn as Aa,Jt as Ba,Vt as Ca,Vn as Da,co as Ea,uo as Fa,Yt as Ga,Yn as Ha,Qt as Ia,Xt as Ja,Le as Ka,_n as La,Us as Ma,yo as Na,mo as Oa,Je as Pa,et as Qa,nt as Ra,sr as Sa,ko as Ta,tt as Ua,Pl as Va,Il as Wa,El as Xa,Gs as Ya,zs as Za,cr as _a,Js as $a,Vs as ab,Ve as bb,Ye as cb,Po as db,vo as eb,Ro as fb,Ao as gb,xo as hb,Qe as ib,_ as jb,Io as kb,ta as lb,_o as mb,oa as nb,ia as ob,sa as pb,Eo as qb,Oo as rb,Mo as sb,Do as tb,Ho as ub,Bo as vb,Uo as wb,Lo as xb,Fo as yb,No as zb,$o as Ab,Wo as Bb,qo as Cb,jo as Db,Ko as Eb,en as Fb,ye as Gb,nn as Hb,tn as Ib,Yo as Jb,Ae as Kb,Ad as Lb,j as Mb,Ga as Nb,za as Ob,Ja as Pb,Va as Qb,Ya as Rb,Qa as Sb,Xa as Tb,ec as Ub,nc as Vb,tc as Wb,rc as Xb,oc as Yb,sc as Zb,Yd as _b,xt as $b,dc as ac,EP as bc,an as cc,OP as dc,wr as ec,sp as fc,ap as gc,Tr as hc,lp as ic,Cc as jc,dp as kc,pp as lc,Tc as mc,Pc as nc,st as oc,gp as pc,vc as qc,Rc as rc,fp as sc,Pr as tc,yp as uc,it as vc,Sc as wc,mp as xc,kp as yc};

package/dist/{connect-6JIVRVND.js → connect-XD2OCCDI.js}

@@ -1 +1 @@
-import{ga as a,ha as b,ia as c}from"./chunk-IC7VFQ7K.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import"./chunk-BRUFMVTV.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};
+import{ga as a,ha as b,ia as c}from"./chunk-PHSO4JJR.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import"./chunk-BRUFMVTV.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/core.d.ts

@@ -1,8 +1,8 @@
-export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair, s as shouldStartTunnel, b as superviseTunnel } from './index-B7HD2kK_.js';
+export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair, s as shouldStartTunnel, b as superviseTunnel } from './index-CyerNu8b.js';
 import { CorsairDatabase } from './db.js';
-import { A as AuthTypes, f as AccountKeyManagerFor, I as IntegrationKeyManagerFor, H as HubConfig, E as EndpointRiskLevel, g as CorsairPluginSubscribeResult } from './index-DfEX01TB.js';
-export { h as AccountFieldNames, n as AgentMessageRole, o as AgentReply, v as AllProviders, l as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, i as BaseKeyManager, w as BaseProviders, a3 as BeforeHookResult, D as BindEndpoints, ap as BindWebhooks, an as Bivariant, F as BoundEndpointFn, G as BoundEndpointTree, aq as BoundWebhook, ar as BoundWebhookTree, p as ChatHandle, q as ChatMessage, r as ChatSummary, s as CorsairChatsNamespace, u as CorsairClient, J as CorsairContext, K as CorsairEndpoint, N as CorsairErrorHandler, c as CorsairIntegration, a4 as CorsairKeyBuilder, a5 as CorsairKeyBuilderBase, as as CorsairOAuthWebhookTenantLinkResolver, Y as CorsairPermissionsNamespace, C as CorsairPlugin, a6 as CorsairPluginContext, a7 as CorsairPluginSubscribe, aj as CorsairRunsNamespace, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, at as CorsairWebhook, au as CorsairWebhookHandler, av as CorsairWebhookMatcher, aw as CorsairWebhookTenantMatcher, aC as CorsairWorkflowsNamespace, t as CreateChatResult, a8 as EndpointHooks, a9 as EndpointMetaEntry, L as EndpointPathsOf, M as EndpointTree, Z as EnforcePermissionOptions, _ as EnforcePermissionResult, Q as ErrorContext, R as ErrorHandler, S as ErrorHandlerAndMatchFunction, U as ErrorMatcher, j as IntegrationFieldNames, aa as KeyBuilderContext, k as OAuth2IntegrationCredentials, O as OAuthConfig, ab as PermissionMode, ac as PermissionPolicy, x as PickAuth, P as PluginAuthConfig, ad as PluginEndpointMeta, ae as PluginPermissionsConfig, z as ProviderDisplayNames, ax as RawWebhookRequest, a1 as ReadonlyForbiddenError, af as RequiredPluginEndpointMeta, ag as RequiredPluginEndpointSchemas, ah as RequiredPluginWebhookSchemas, V as RetryStrategies, X as RetryStrategy, T as TokenResponse, aD as TriggerRunResult, ao as UnionToIntersection, ai as WebhookHooks, ay as WebhookPathsOf, az as WebhookRequest, aA as WebhookResponse, W as WebhookTenantMatch, aB as WebhookTree, ak as WorkflowRun, al as WorkflowRunStatus, am as WorkflowRunStep, aE as WorkflowStatus, aF as WorkflowSummary, $ as assertReadonlyAllowed, m as exchangeCodeForTokens, y as formatProviderDisplayName, a0 as isReadonlyScopeActive, a2 as runReadonly } from './index-DfEX01TB.js';
-export { A as AuthMissingError, aa as AuthType, ag as CloudAccess, g as CloudApiError, aj as CloudCatalogIntegration, ap as CloudConnectSession, ah as CloudConnection, ay as CloudDeleted, am as CloudDelivery, az as CloudEmbeddedList, ae as CloudInstance, au as CloudInstanceApply, Q as CloudInstancePlane, av as CloudInstanceRemoval, ai as CloudIntegration, ax as CloudIntegrationOperations, as as CloudKey, at as CloudKeyRotation, an as CloudLink, K as CloudList, ao as CloudMcpToken, ak as CloudOauthApp, aw as CloudOperation, aA as CloudProject, a1 as CloudProjectPlane, aq as CloudSigningSecret, ar as CloudSigningSecretRotation, af as CloudTenant, al as CloudWebhook, a as CorsairCloudConfig, b as CorsairCloudInstance, c as CorsairCloudInstanceHandle, d as CorsairCloudManage, e as CorsairCloudRegistry, C as CorsairKekMissingError, S as CreateConnectSessionInput, a2 as CreateInstanceInput, T as CreateTenantInput, U as CreateWebhookInput, ac as CredentialSource, D as DocSchemaFieldRow, i as DocSchemaShape, j as DocsApiEndpoint, k as DocsDbEntity, l as DocsDbFilterField, m as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, a3 as LinkLine, L as ListOperationsOptions, N as ListQuery, M as ManagementApiError, a4 as MintLinkInput, a5 as MintTokenInput, a9 as Permission, ab as PermissionDecision, p as PermissionRequiredError, P as PluginDocsIntrospection, u as PluginWebhookMatchers, ad as ProjectStatus, X as PutIntegrationInput, Y as PutOauthAppInput, R as ReconnectRequiredError, O as RequestOptions, h as ResolveConnectLinkResult, Z as RotateWebhookSecretInput, _ as SetAccessInput, a6 as UpdateInstanceInput, a7 as UpdateLinkInput, $ as UpdateTenantInput, V as V1Transport, W as WebhookPluginTenantMatch, v as asRecord, a0 as buildInstancePlane, a8 as buildProjectPlane, q as collectPluginWebhookMatchers, f as corsairCloud, w as decodePubSubData, x as extractMicrosoftGraphValidationToken, y as firstString, n as formatDocSchemaShape, z as getHeader, o as introspectPluginForDocs, B as isMicrosoftGraphValidationHandshake, J as mapV1Error, s as matchWebhookPlugin, t as matchWebhookPluginAndTenant, F as readBodyRecord, G as readQueryParam, r as resolveConnectLink, H as toExternalId } from './tenant-match-utils-DeVV3u6D.js';
+import { A as AuthTypes, f as AccountKeyManagerFor, I as IntegrationKeyManagerFor, H as HubConfig, E as EndpointRiskLevel, g as CorsairPluginSubscribeResult } from './index-C0Ijyjo6.js';
+export { h as AccountFieldNames, n as AgentMessageRole, o as AgentReply, v as AllProviders, l as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, i as BaseKeyManager, w as BaseProviders, a6 as BeforeHookResult, D as BindEndpoints, as as BindWebhooks, aq as Bivariant, F as BoundEndpointFn, G as BoundEndpointTree, at as BoundWebhook, au as BoundWebhookTree, p as ChatHandle, q as ChatMessage, r as ChatSummary, s as CorsairChatsNamespace, u as CorsairClient, J as CorsairContext, K as CorsairEndpoint, N as CorsairErrorHandler, c as CorsairIntegration, a7 as CorsairKeyBuilder, a8 as CorsairKeyBuilderBase, av as CorsairOAuthWebhookTenantLinkResolver, Y as CorsairPermissionsNamespace, C as CorsairPlugin, a9 as CorsairPluginContext, aa as CorsairPluginSubscribe, am as CorsairRunsNamespace, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, aw as CorsairWebhook, ax as CorsairWebhookHandler, ay as CorsairWebhookMatcher, az as CorsairWebhookTenantMatcher, aF as CorsairWorkflowsNamespace, t as CreateChatResult, ab as EndpointHooks, ac as EndpointMetaEntry, L as EndpointPathsOf, M as EndpointTree, Z as EnforcePermissionOptions, _ as EnforcePermissionResult, Q as ErrorContext, R as ErrorHandler, S as ErrorHandlerAndMatchFunction, U as ErrorMatcher, j as IntegrationFieldNames, ad as KeyBuilderContext, k as OAuth2IntegrationCredentials, O as OAuthConfig, ae as PermissionMode, af as PermissionPolicy, x as PickAuth, P as PluginAuthConfig, ag as PluginEndpointMeta, ah as PluginPermissionsConfig, z as ProviderDisplayNames, aA as RawWebhookRequest, a3 as ReadonlyForbiddenError, ai as RequiredPluginEndpointMeta, aj as RequiredPluginEndpointSchemas, ak as RequiredPluginWebhookSchemas, V as RetryStrategies, X as RetryStrategy, T as TokenResponse, aG as TriggerRunResult, ar as UnionToIntersection, al as WebhookHooks, aB as WebhookPathsOf, aC as WebhookRequest, aD as WebhookResponse, W as WebhookTenantMatch, aE as WebhookTree, an as WorkflowRun, ao as WorkflowRunStatus, ap as WorkflowRunStep, aH as WorkflowStatus, aI as WorkflowSummary, $ as activeMode, a0 as assertModeAllows, a1 as assertReadonlyAllowed, m as exchangeCodeForTokens, y as formatProviderDisplayName, a2 as isReadonlyScopeActive, a4 as runReadonly, a5 as runWithMode } from './index-C0Ijyjo6.js';
+export { A as AuthMissingError, ab as AuthType, ah as CloudAccess, g as CloudApiError, ak as CloudCatalogIntegration, ar as CloudConnectSession, ai as CloudConnection, aA as CloudDeleted, an as CloudDelivery, aB as CloudEmbeddedList, af as CloudInstance, aw as CloudInstanceApply, Q as CloudInstancePlane, ax as CloudInstanceRemoval, aj as CloudIntegration, az as CloudIntegrationOperations, au as CloudKey, av as CloudKeyRotation, ap as CloudLink, ao as CloudLinkLine, K as CloudList, aq as CloudMcpToken, al as CloudOauthApp, ay as CloudOperation, aC as CloudProject, a1 as CloudProjectPlane, as as CloudSigningSecret, at as CloudSigningSecretRotation, ag as CloudTenant, am as CloudWebhook, a as CorsairCloudConfig, b as CorsairCloudInstance, c as CorsairCloudInstanceHandle, d as CorsairCloudManage, e as CorsairCloudRegistry, C as CorsairKekMissingError, S as CreateConnectSessionInput, a2 as CreateInstanceInput, T as CreateTenantInput, U as CreateWebhookInput, ad as CredentialSource, D as DocSchemaFieldRow, i as DocSchemaShape, j as DocsApiEndpoint, k as DocsDbEntity, l as DocsDbFilterField, m as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, a3 as LinkLine, a4 as LinkPolicy, L as ListOperationsOptions, N as ListQuery, M as ManagementApiError, a5 as MintLinkInput, a6 as MintTokenInput, aa as Permission, ac as PermissionDecision, p as PermissionRequiredError, P as PluginDocsIntrospection, u as PluginWebhookMatchers, ae as ProjectStatus, X as PutIntegrationInput, Y as PutOauthAppInput, R as ReconnectRequiredError, O as RequestOptions, h as ResolveConnectLinkResult, Z as RotateWebhookSecretInput, _ as SetAccessInput, a7 as UpdateInstanceInput, a8 as UpdateLinkInput, $ as UpdateTenantInput, V as V1Transport, W as WebhookPluginTenantMatch, v as asRecord, a0 as buildInstancePlane, a9 as buildProjectPlane, q as collectPluginWebhookMatchers, f as corsairCloud, w as decodePubSubData, x as extractMicrosoftGraphValidationToken, y as firstString, n as formatDocSchemaShape, z as getHeader, o as introspectPluginForDocs, B as isMicrosoftGraphValidationHandshake, J as mapV1Error, s as matchWebhookPlugin, t as matchWebhookPluginAndTenant, F as readBodyRecord, G as readQueryParam, r as resolveConnectLink, H as toExternalId } from './tenant-match-utils-CmvkIe3O.js';
 import 'kysely';
 import 'zod';
 import 'pg';