corsair 0.1.149 → 0.1.150

package/dist/{browser-delivery-D9B1ljAd.d.ts → browser-delivery-UORWwkFD.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-cpdyBUZ9.js';
+import { B as BrowserDeliveryPayload } from './index-C06B-Xq6.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/chunk-3WCADXAW.js

@@ -0,0 +1,67 @@
+import{a as Se,b as Sr,c as _r}from"./chunk-6IURNA4L.js";import{a as vi,b as Ri,c as Ai,d as Fn}from"./chunk-XCTHEKDP.js";import{A as un,B as Ir,C as Bi,a as Si,b as _e,c as _i,d as v,e as J,f as Ei,g as te,h as K,i as _,j as Oi,k as ut,l as Mi,m as lt,n as he,o as be,p as re,r as dt,s as $e,t as ke,u as Ln,v as Di,w as pt,x as Hi,y as Nn,z as Ui}from"./chunk-WUEWJTDA.js";import{b as xi,c as Ii}from"./chunk-XPXWKPFZ.js";import{ZodBoolean as Ap,ZodDate as xp,ZodEnum as Ip,ZodNullable as Sp,ZodNumber as _p,ZodObject as Ep,ZodOptional as Op,ZodRecord as Mp,ZodString as Dp,ZodType as Hp}from"zod";var gt=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","akta","alchemy","algolia","alibaba","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","apollo","appointo","aryn","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beamer","beeminder","benchmarkemail","benzinga","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bigpictureio","bitbucket","bitwarden","blackbaud","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","booqable","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","builtwith","browserless","browsertool","bubble","bugsnag","buildkite","bunnycdn","bytedance","byteforms","cal","callpage","calendly","callingly","campaigncleaner","campayn","canny","canva","canvas","capsulecrm","carbone","castingwords","cdrplatform","celigo","certifier","chaser","chatbotkit","chatfai","chatwork","chmeetings","cincopa","circleci","claidai","classmarker","clay","clickhouse","clickmeeting","clickup","clicksend","clientary","clockify","close","cloro","cloudcart","cloudflare","cloudflareapikey","cloudinary","coassemble","codeinterpreter","coda","cody","coinbase","coinmarketcal","collegefootballdata","composio","confluence","connecteam","contactout","contentfulgraphql","contextdev","contextsevenmcp","convex","convoloai","cosmic","countdownapi","crowterminal","currentsapi","cursor","customerio","customgpt","cuttly","dadataru","daffy","databricks","datadog","dataforseo","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","docmosis","docupost","docsumo","docusign","dodopayments","doppler","dovetail","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","emelia","epicgames","everhour","exa","exist","extractaai","facebook","faraday","figma","filevine","filloutforms","firecrawl","fireflies","fixer","flexisign","flutterwave","formbricks","fundable","gemini","giphy","github","gitlab","gladia","gmail","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","hookdeck","htmltoimage","hubspot","huggingface","humanitix","hunterio","imagior","imejisio","imgbb","insightoai","instagram","intercom","jigsawstack","jira","kaggle","keenable","kibana","kling","leexi","linear","linkedin","litescrape","loyverse","magichour","mailboxlayer","mailcheck","mailchimp","mailtrap","marketstack","merriamwebsterdict","minimax","monday","mrscraper","neon","nextdns","northflank","notion","ocrspace","ocrwebservice","octen","ollama","onedrive","onepassword","openai","openrouter","openweathermap","orbit","oura","outlook","pagerduty","parseur","pdfco","pdfmonkey","pdl","perplexityai","phantombuster","pinecone","plain","ploid","posthog","postman","prisma","pushbullet","razorpay","reddit","reducto","remoet","replicate","removebg","replicate","replyio","resend","retailed","revai","rootly","runpod","salesforce","saperly","sapsuccessfactors","scaleai","scrapegraphai","search1api","securitytrails","semanticscholar","sendgrid","sentry","serpapi","sharepoint","slack","slackbot","snapchat","sourcegraph","spoki","spotify","starton","strava","streamtime","stripe","studiobyai21labs","supabase","supadata","suzanne","surf","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","timecamp","timelink","tinypng","tinyfish","tinyurl","tisane","todoist","toggl","tokenmetrics","tpscheck","trello","tripadvisor","turso","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","unione","uniswapapi","updownio","uploadcare","vapi","vaquill","vercel","veriphone","vestaboard","waboxapp","wakatime","webflow","webscrapingai","webvizio","whatsapp","whautomate","whoisfreaks","winstonai","witai","wix","wiza","workday","workiom","worldnewsapi","writer","xero","xquik","youcom","youtube","zendesk","zenserp","zohobigin","zohoinventory","zohomail","zoom","zoominfo"],Fi={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",akta:"Akta",alchemy:"Alchemy",algolia:"Algolia",alibaba:"Alibaba Cloud Model Studio",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",apollo:"Apollo",appointo:"Appointo",aryn:"Aryn",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beamer:"Beamer",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",benzinga:"Benzinga",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bigpictureio:"BigPicture.io",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blackbaud:"Blackbaud",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",booqable:"Booqable",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",builtwith:"BuiltWith",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",bunnycdn:"Bunnycdn",bytedance:"ByteDance",byteforms:"ByteForms",cal:"Cal",callpage:"CallPage",calendly:"Calendly",callingly:"Callingly",campaigncleaner:"Campaign Cleaner",campayn:"Campayn",canny:"Canny",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",carbone:"Carbone",castingwords:"CastingWords",cdrplatform:"CDR Platform",celigo:"Celigo",certifier:"Certifier",chaser:"Chaser",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chatwork:"Chatwork",chmeetings:"ChMeetings",cincopa:"Cincopa",circleci:"CircleCI",claidai:"Claid.ai",classmarker:"ClassMarker",clay:"Clay",clickhouse:"Clickhouse",clickmeeting:"ClickMeeting",clickup:"ClickUp",clicksend:"ClickSend",clientary:"Clientary",clockify:"Clockify",close:"Close",cloro:"cloro",cloudcart:"CloudCart",cloudflare:"Cloudflare",cloudflareapikey:"Cloudflare API Key",cloudinary:"Cloudinary",coassemble:"Coassemble",codeinterpreter:"CodeInterpreter",coda:"Coda",cody:"Cody",coinbase:"Coinbase",coinmarketcal:"Coinmarketcal",collegefootballdata:"College Football Data",composio:"Composio",confluence:"Confluence",connecteam:"Connecteam",contactout:"ContactOut",contentfulgraphql:"Contentful GraphQL",contextdev:"Context.dev",contextsevenmcp:"Context7",convex:"Convex",convoloai:"ConvoloAi",cosmic:"Cosmic",countdownapi:"Countdown API",crowterminal:"CrowTerminal",currentsapi:"CurrentsApi",cursor:"Cursor",customerio:"Customer.io",customgpt:"CustomGPT",cuttly:"Cutt.ly",dadataru:"Dadataru",daffy:"Daffy",databricks:"Databricks",datadog:"Datadog",dataforseo:"DataForSEO",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",docmosis:"Docmosis",docupost:"Docupost",docsumo:"Docsumo",docusign:"DocuSign",dodopayments:"Dodo Payments",doppler:"Doppler",dovetail:"Dovetail",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",emelia:"Emelia",epicgames:"Epic Games",everhour:"Everhour",exa:"Exa",exist:"Exist",extractaai:"Extracta.ai",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filevine:"Filevine",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",fixer:"Fixer",flexisign:"Flexisign",flutterwave:"Flutterwave",formbricks:"Formbricks",fundable:"Fundable",gemini:"Gemini",giphy:"Giphy",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",hookdeck:"Hookdeck",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",humanitix:"Humanitix",hunterio:"Hunter.io",imagior:"Imagior",imejisio:"Imejis.io",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",keenable:"Keenable",kibana:"Kibana",kling:"Kling",leexi:"Leexi",linear:"Linear",linkedin:"LinkedIn",litescrape:"LiteScrape",loyverse:"Loyverse",magichour:"Magic Hour",mailboxlayer:"MailboxLayer",mailcheck:"Mailcheck",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",minimax:"MiniMax",monday:"Monday",mrscraper:"MrScraper",neon:"Neon",nextdns:"NextDNS",northflank:"Northflank",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",octen:"Octen",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",orbit:"Orbit",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfco:"PDF.co",pdfmonkey:"PDFMonkey",pdl:"People Data Labs",perplexityai:"Perplexity AI",phantombuster:"PhantomBuster",pinecone:"Pinecone",plain:"Plain",ploid:"Ploid",posthog:"PostHog",postman:"Postman",prisma:"Prisma",pushbullet:"Pushbullet",razorpay:"Razorpay",reddit:"Reddit",reducto:"Reducto",remoet:"Remoet",removebg:"remove.bg",replicate:"Replicate",replyio:"Reply.io",resend:"Resend",retailed:"Retailed",revai:"RevAI",rootly:"Rootly",runpod:"RunPod",salesforce:"Salesforce",saperly:"Saperly",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",search1api:"Search1API",securitytrails:"SecurityTrails",semanticscholar:"Semantic Scholar",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",slackbot:"Slackbot",snapchat:"Snapchat",sourcegraph:"Sourcegraph",spoki:"Spoki",spotify:"Spotify",starton:"Starton",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",supadata:"Supadata",suzanne:"Suzanne",surf:"Surf",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",timecamp:"TimeCamp",timelink:"Timelink",tinypng:"TinyPNG",tinyfish:"TinyFish",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",tokenmetrics:"Token Metrics",tpscheck:"TPSCheck",trello:"Trello",tripadvisor:"Tripadvisor",turso:"Turso",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",unione:"Unione",uniswapapi:"Uniswap",updownio:"Updown.io",uploadcare:"Uploadcare",vapi:"Vapi",vaquill:"Vaquill",vercel:"Vercel",veriphone:"Veriphone",vestaboard:"Vestaboard",waboxapp:"Waboxapp",wakatime:"WakaTime",webflow:"Webflow",webscrapingai:"WebScraping.AI",webvizio:"Webvizio",whatsapp:"WhatsApp",whautomate:"Whautomate",whoisfreaks:"Whoisfreaks",winstonai:"Winston AI",witai:"WitAi",wix:"Wix",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",writer:"Writer",xero:"Xero",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zenserp:"Zenserp",zohobigin:"Zoho Bigin",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Ee(e){let n=Fi[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var we=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function D(e){return typeof e=="string"&&e.length>0}function Lc(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Nc(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"||e==="managed_pricing"}function ft(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!D(n.connectUrl)||!D(n.token)||!D(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:D(n.environmentId)?n.environmentId:n.projectId};return D(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function yt(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!D(r.tenantId)||!D(r.plugin)||!Lc(r.status)||!Nc(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:D(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function mt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!D(n.approvalUrl)||!D(n.token)||!D(n.projectId)||!D(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function ln(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(D(n.access_token))return{access_token:n.access_token,refresh_token:D(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:D(n.scope)?n.scope:void 0};throw new Error(D(n.error)?D(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function $c(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Wc(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;D(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function qc(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function Li(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!D(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!D(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",a=Wc(o.fields),s=$c(o.missingRequiredFields),c=qc(o.status,o.connected,a,s);t.push({plugin:o.plugin,providerName:D(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function Er(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Ni(e,n,t){if(n===404&&t)return t;let r=Er(e);if(!r)return`Hub API returned HTTP ${n}`;if(!e||typeof e!="object")return r;let o=e,i=[r];if(typeof o.code=="string"&&o.code.length>0&&i.push(`Hub error code: ${o.code}`),typeof o.hint=="string"&&o.hint.length>0&&i.push("",o.hint),Array.isArray(o.fix)){let a=o.fix.filter(s=>typeof s=="string"&&s.trim().length>0);if(a.length>0){i.push("","What to do:");for(let s of a)i.push(`- ${s}`)}}if(o.received!==void 0)try{i.push("",`Hub received: ${JSON.stringify(o.received)}`)}catch{}if(o.details!==void 0)try{i.push("",`Details: ${JSON.stringify(o.details)}`)}catch{}return typeof o.creditsRequired=="number"&&i.push("",`Credits required for this call: ${o.creditsRequired}`),i.join(`
+`)}function $i(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}var Wi="0.1.149";function jc(){return{"x-corsair-sdk-version":Wi}}function ht(e){return e.replace(/\/$/,"")}function Or(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return Se()}catch{return null}}function qi(e){let n=Or(e);return n?{"x-corsair-delivery-url":n}:{}}function ji(e){let n=e.instanceKey?.trim();return n?{"x-corsair-instance-key":n}:{}}async function Ki(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Kc(e,n,t){return Ni(e,n,t)}function Zi(e,n,t){let r=$i(e);throw r?new we({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(Kc(e,n,t))}async function S(e){let n=ht(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...qi(e.hub),...ji(e.hub),...jc(),...e.extraHeaders},body:JSON.stringify(e.body)}),r=await Ki(t);return t.ok||Zi(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function Z(e){let n=ht(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...qi(e.hub),...ji(e.hub)}}),r=await Ki(t);return t.ok||Zi(r,t.status,e.notFoundMessage),e.parseResponse(r)}function bt(e){return e&&typeof e=="object"?e:{}}function Gi(e){let n=bt(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Mr(e,n){return S({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=bt(t);return{chat:r.thread,reply:Gi(r.reply)}}})}async function Dr(e,n){return S({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Gi})}async function Hr(e,n){return Z({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=bt(t).threads;return Array.isArray(r)?r:[]}})}async function Ur(e,n){return Z({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=bt(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Qc}from"crypto";var Zc="corsair:client-bridge";function Br(e){return new URL(e).origin}function dn(e){let n=JSON.stringify({type:Zc,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Br(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var Gc=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Fr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Gc.has(n)}catch{return!1}}function $n(e){return e==="development"?"browser":"server"}function zi(e){return $n(e)==="browser"}function Ji(e){return Fr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Yc}from"crypto";var Oe=60*1e3,We=300*1e3;import{createHmac as zc,randomBytes as Jc,timingSafeEqual as Vc}from"crypto";function Ce(){return Jc(16).toString("base64url")}function Wn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return zc("sha256",t).update(e).digest("base64url")}function ue(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let a=Wn(o,t);try{if(!Vc(Buffer.from(i,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function kt(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),a=Wn(i,n);return`${i}.${a}`}function qn(e,n,t){let r=Math.floor(Date.now()/1e3);return kt(e,n,r+Math.floor(t/1e3))}function qe(e){return decodeURIComponent(e)}function Lr(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function Vi(e){let n=e.trim();return n.length>0?n:null}function pn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function gn(e,n){if(!Vi(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Yc(16).toString("base64url"),iat:t,exp:t+Math.floor(Oe/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=Wn(o,n);return`${o}.${i}`}function Me(e,n){return Vi(n)?ue(e,n):null}function Xc(e){let n=Br(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function Nr(e){let n=gn(Xc(e),e.signingSecret);return pn(e.deliveryUrl,n)}function Yi(e){if($n(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Qc(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:Nr(r)}}var jn="https://auth.corsair.dev";var Te=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},Kn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function $r(e){let n=(e.apiUrl?.trim()||jn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"",o=t.startsWith("ck_cloud_");if(!t||!r&&!o)throw new Kn;return{apiUrl:n,projectApiKey:t,signingSecret:r,instanceKey:e.instanceKey?.trim()||void 0,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel}}function wt(e){return $r(e)}function eu(e){let n=e.projectApiKey.startsWith("ck_cloud_");return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&(n||e.signingSecret.trim().length>0)}function $(e){let n=v(e).hub;if(!n||!eu(n))throw new Te;return n}function Qi(e){return e.replace(/\/$/,"")}function Ct(e){return e.oauthCallbackUrl?Qi(e.oauthCallbackUrl.trim()):`${Qi(e.apiUrl)}/oauth/callback`}function fn(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";if(e.startsWith("ck_cloud_"))return"cloud";throw new Error("Hub API key must start with ck_dev_ (development), ck_prod_ (production), or ck_cloud_ (cloud)")}function Xi(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let a=[null,void 0,""].includes(i)?null:i;await n({[o]:a})};return r}var Wr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function W(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,a=[...K[n].integration,...i],s=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:b.id,config:Wr(b.config),dek:b.dek??null},s},updateIntegration:async b=>{let k=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),s=null}},l=null,u=async()=>{if(l)return l;let b=await c.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await re(b.dek,r),l},d=async()=>{let b=await c.getIntegration(),k=await u(),P=b.config;return!P||Object.keys(P).length===0?{}:ke(P,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await u(),P;try{P=await d()}catch(E){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,E),P={}}let R={...P};for(let[E,ee]of Object.entries(b))ee===null?delete R[E]:R[E]=ee;let U=$e(R,k);await c.updateIntegration({config:U})};return{get_dek:u,issue_new_dek:async()=>{let b=await c.getIntegration(),k=he(),P={};if(b.dek){let U=await re(b.dek,r),E=b.config;E&&Object.keys(E).length>0&&(P=Ln(E,U,k))}let R=await be(k,r);return await c.updateIntegration({config:P,dek:R}),l=k,k},...Xi(d,g,a)}}function B(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:a=[],ensureProvisioned:s}=e,c=[...K[n].account,...a],l=null,u=async()=>{if(l)return l;let C=!1;for(;;){let T=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!T){if(!C&&s){C=!0,await s();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return l={id:T.id,config:Wr(T.config),dek:T.dek??null},l}},d={kek:o,integrationName:t,tenantId:r,getIntegration:u,getAccount:async()=>{let C=!1;for(;;){let T=await u(),O=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",T.id).executeTakeFirst();if(!O){if(!C&&s){C=!0,await s();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return{id:O.id,config:Wr(O.config),dek:O.dek??null}}},updateAccount:async C=>{let T=await d.getAccount();await i.db.updateTable("corsair_accounts").set({...C.config!==void 0?{config:C.config}:{},...C.dek!==void 0?{dek:C.dek}:{},updated_at:new Date}).where("id","=",T.id).execute()}},p=null,g=null,f=null,h=async()=>{let C=await d.getAccount();if(!C.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p&&g===C.dek||(p=await re(C.dek,o),g=C.dek),p},b=async()=>{if(f)return f;let C=await d.getIntegration();if(!C.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await re(C.dek,o),f},k=async()=>{let C=await d.getAccount(),T=await h(),O=C.config;return!O||Object.keys(O).length===0?{}:ke(O,T)},P=async()=>{let C=await d.getIntegration(),T=await b(),O=C.config;return!O||Object.keys(O).length===0?{}:ke(O,T)},R=Promise.resolve(),U=C=>{let T=R.then(()=>E(C));return R=T.catch(()=>{}),T},E=async C=>{let T=await d.getAccount();if(!T.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);let O=await re(T.dek,o),L;try{let M=T.config;L=!M||Object.keys(M).length===0?{}:ke(M,O)}catch(M){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,M),L={}}let ne={...L};for(let[M,Ie]of Object.entries(C))Ie===null?delete ne[M]:ne[M]=Ie;let H=$e(ne,O);await d.updateAccount({config:H})},ee={get_dek:h,issue_new_dek:async()=>{let C=await d.getAccount(),T=he(),O={},L=null;if(C.dek){L=await re(C.dek,o);let H=C.config;H&&Object.keys(H).length>0&&(O=Ln(H,L,T))}let ne=await be(T,o);if(L){let H=L;await i.db.transaction().execute(async M=>{await Ui(M,C.id,H,T),await M.updateTable("corsair_accounts").set({config:O,dek:ne,updated_at:new Date}).where("id","=",C.id).execute()})}else await d.updateAccount({config:O,dek:ne});return p=T,g=ne,T},...Xi(k,U,c)};return n==="oauth_2"&&(ee.get_integration_credentials=async()=>{let C=await P();return{...C,client_id:C.client_id||null,client_secret:C.client_secret||null,redirect_url:C.redirect_url??null}}),ee}async function es(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=he(),i=await be(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function ns(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=he(),s=await be(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",i.id).execute(),a}var nu=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function De(e){return nu.has(e)}function tu(e,n){return De(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function ru(e){return!De(e)}function ou(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"];case"managed_pricing":return[]}}function iu(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function su(e,n){let t=i=>n.find(a=>a.level==="account"&&a.name===i);if(!ou(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function ts(e,n){if(!e)return!1;let t=te(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function au(e,n){let r=e.authConfig?.[n]?.integration??[];return[...K[n].integration,...r]}function cu(e,n){let r=e.authConfig?.[n]?.account??[];return[...K[n].account,...r]}function uu(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return o.length>0?a="missing_integration":r.length===0?a="ready":i.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:su(n,t),fields:t,missingRequiredFields:r}}async function je(e,n,t){let r=_(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,a=i?.[r]?.integration??[],s=i?.[r]?.account??[],c=W({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),l=B({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:s}),u=au(n,r),d=cu(n,r),p=[];for(let g of u)p.push({name:g,level:"integration",required:tu(r,g),configured:await ts(c,g)});for(let g of d)p.push({name:g,level:"account",required:ru(g),configured:await ts(l,g)});if(iu(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return uu(n.id,r,p)}async function Zn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let a of e.plugins){if(o&&!o.has(a.id))continue;let s=await je(e,a,r);s&&i.push(s)}return i}function Tt(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var rs=Symbol.for("corsair:internal"),os=new WeakMap,is=new WeakMap;function lu(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function du(e){if(e.database){let t=os.get(e.database);return t||(t=new Map,os.set(e.database,t)),t}let n=is.get(e);return n||(n=new Map,is.set(e,n)),n}function pu(e){return e.multiTenancy?{withTenant:()=>({}),[rs]:e}:{[rs]:e}}async function yn(e,n){if(!e.database)return;let t=n.trim()||"default",r=du(e),o=lu(t,e.plugins),i=r.get(o);if(i){await i;return}let a=(async()=>{let{setupCorsair:s}=await import("./setup-XQPRIVAQ.js");await s(pu(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,a),await a}import*as Gn from"crypto";function He(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function qr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function mn(e,n){if(!n)throw new Error("OAuth state signing requires a configured kek. Pass kek to createCorsair().");let t=Gn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var jr=600*1e3;function Pt(e,n){if(!n)return null;let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Gn.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(o,"base64url"),s=Buffer.from(i,"base64url");return a.length!==s.length||!Gn.timingSafeEqual(a,s)?null:qr(r,{maxAgeMs:jr})}function ss(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function as(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function hn(e,n){await S({hub:e,path:"/connections/report",body:ss(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function gu(e,n){try{let t=$(e);S({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof Te)return}}async function fu(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!_(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await je(n,e.plugin,r);o&&us(e.hub,as({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function cs(e,n){gu(e,n)}function us(e,n){S({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function bn(e){fu(e).catch(()=>{})}async function Pe(e,n){let t=v(e);if(!_(n.plugin))return;let o=await je(t,n.plugin,n.tenantId);o&&cs(e,as({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function vt(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var ls=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function yu(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function mu(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await re(n.dek,e.kek),r=ls(n.config),o={};Object.keys(r).length>0&&(o=ke(r,t)),o[e.link.linkType]=e.link.externalId;let i=$e(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function kn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:a,extraAccountFields:s=[]}=e,{accountId:c}=await yu({database:n,pluginId:r,tenantId:o}),l=!1;if(a){let u=B({authType:a,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:s}),d=`set_${i.linkType}`,p=u[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await mu({database:n,kek:t,accountId:c,link:i})}async function Kr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let c=await re(s.dek,t),u=ls(s.config)[o];if(!u)continue;if(dt(u,c)===i)return s}catch{continue}return null}async function Rt(e){return(await Kr(e))?.tenant_id??null}async function ds(e){return Rt({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as ps from"querystring";function Ke(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${ps.stringify(i)}`}async function gs(e,n){try{return await Z({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function wn(e,n,t,r){if(!n.subscribe)return;let o=$(e),i=await gs(o,n.id);if(!i)return;let a=await n.subscribe({keys:r},{webhookUrl:i});a&&await Pe(e,{plugin:n,tenantId:t,verified:!0,webhookLink:a.webhookLink,webhookSecret:a.webhookSecret})}var V=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function fs(e){let n=e.oauthConfig;if(!n)throw new V("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function hu(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let a=await i.executeTakeFirst();if(!a)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",a.id).executeTakeFirst())return;let c=he(),l=await be(c,r),u=new Date;await o.insertInto("corsair_accounts").values({id:un(),created_at:u,updated_at:u,tenant_id:t,integration_id:a.id,config:{},dek:l}).execute()})}async function Zr(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,a=v(e,()=>new V("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=J(a,n,p=>new V("plugin_not_found",p)),c=fs(s),u=await W({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!u)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Ke({oauthConfig:c,clientId:u,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=mn(He(n,r),a.kek);return{url:Ke({oauthConfig:c,clientId:u,redirectUri:o,state:d}),state:d}}function bu(e,n){return{...n??{},...e}}async function zn(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new V("invalid_corsair_instance","Invalid corsair instance")),a,s;if(n.trusted){if(!n.plugin||!n.tenantId)throw new V("invalid_state","trusted callback requires plugin and tenantId");a=n.plugin,s=n.tenantId}else{let h=Pt(r,i.kek);if(!h)throw new V("invalid_state","Invalid or tampered state parameter");a=h.plugin,s=h.tenantId}if(!i.database)throw new V("no_database","No database configured on corsair instance");let c=J(i,a,h=>new V("plugin_not_found",h)),l=fs(c),u=W({authType:"oauth_2",integrationName:a,kek:i.kek,database:i.database}),d=await u.get_client_id(),p=await u.get_client_secret();if(!d||!p)throw new V("credentials_not_configured",`Credentials not configured for '${a}'`);await hu(i.database,a,s,i.kek);let g=await At(t,d,p,l,o);if(!g.access_token)throw new V("no_access_token",`No access_token returned from ${l.providerName}`);let f=B({authType:"oauth_2",integrationName:a,tenantId:s,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await Pe(e,{plugin:c,tenantId:s}).catch(()=>{});try{let h=bu(g,n.callbackParams),b=await vt(i.plugins,a,h);if(b){try{let k=c.authConfig?.oauth_2?.account??[];await kn({database:i.database,kek:i.kek,pluginId:a,tenantId:s,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${a}' tenant '${s}':`,k)}i.hub&&hn(i.hub,{plugin:a,tenantId:s,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${a}' tenant '${s}':`,h)}if(c.subscribe)try{await wn(e,c,s,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${a}' tenant '${s}':`,h)}return{plugin:a,tenantId:s}}async function ku(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??wn,i=[],a=[];if(!t.database)return{renewed:i,failed:a};for(let s of r){let c=t.plugins.find(u=>u.id===s.integrationName);if(!c?.subscribe)continue;let l=`${c.id}/${s.tenantId}`;try{let u=_(c)??"oauth_2",d=B({authType:u,integrationName:c.id,tenantId:s.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[u]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:u,keys:g,hub:t.hub},"endpoint")}await o(n,c,s.tenantId,d),i.push(l)}catch(u){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,u),a.push(l)}}return{renewed:i,failed:a}}async function ys(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return ku({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function wu(e,n={}){let t=!1,r=()=>{t||(t=!0,ys(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function ms(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await xt(e,{silent:!0})}async function Cn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await yn(t,n)}var Cu=Symbol.for("corsair:internal"),Tu=new Set(["access_token","refresh_token","expires_at","scope"]);function Pu(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function vu(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!De(t)&&!Tu.has(t)):n.filter(t=>!De(t))}function hs(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function Ru(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function Au(e){return{[Cu]:hs(e)}}async function It(e,n,t={}){let r=Ct(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,a=hs(e),s=Au(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let l=_(c);if(!l)continue;let u=Pu(l),d=t.providerNameOverrides?.[c.id]??Ee(c.id),p=await je(a,c,n),g=ut(c,l),f=vu(l,g),h={plugin:c.id,providerName:d,authKind:u,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),u==="oauth"){let k=t.oauthModeOverrides?.[c.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let P=await Zr(s,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=P.url}catch(P){P instanceof Error&&/client_id not configured/i.test(P.message)||(h.setupError=P instanceof Error?P.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function cy(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return It({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function bs(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await yn(e.internalConfig??Ru(e),n)}async function ks(e,n){await Cn(e,n)}async function ws(e,n){let t=fn(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:ft})}async function Cs(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await bs(t,n.tenantId);let r=await It(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return ws(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function St(e,n){let t=v(e),r=$(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await ks(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,a=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,s=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await It(o,n.tenantId,{pluginIds:i,oauthModeOverrides:a,providerNameOverrides:s});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return ws(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function _t(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(a=>a.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await xu(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function xu(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-IHA55MQ5.js"),{postHubConnectSession:i}=await import("./connect-7WSPNIXG.js"),a={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(a,t.tenantId);let s=await r(a,t.tenantId,{pluginIds:t.pluginIds});if(s.length===0)throw new Error("No connectable plugins found for this tenant");let c=s.find(l=>l.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:s})}function Tn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var ie=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Iu(e){let n=e.oauthConfig;if(!n)throw new ie("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Gr(e,n){let t=v(e,()=>new ie("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ie("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new ie("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=Pt(n,t.kek);if(!o)throw new ie("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:a}=o,s=J(t,i,p=>new ie("plugin_not_found",p)),c=Iu(s),u=await W({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!u)throw new ie("client_id_not_configured",`client_id not configured for '${i}'`);let d=Ke({oauthConfig:c,clientId:u,redirectUri:r,state:n});return{plugin:i,tenantId:a,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as _u}from"async_hooks";import{randomBytes as Eu}from"crypto";import{v4 as Ou}from"uuid";var le=class extends Error{reason;constructor(n,t="pending"){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError",this.reason=t}};async function Et(e,n){let t=fn(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:mt})}function Ot(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var zr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Vr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Ts(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Jr(e){return Ot(e)}async function Yr(e,n){if(Vr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Ts(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Et(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:Su(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch(r){return console.warn(`[corsair/${n.plugin}] could not create an approval link for '${n.endpoint}': ${r instanceof Error?r.message:String(r)}`),null}}function Su(e){try{return JSON.parse(e)}catch{return e}}async function Mt(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Yr(e,n);return{...n,approvalUrl:r}}async function Qr(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:a,endpoint:s,args:c,tenantId:l,expiresAt:u,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:a,endpoint:s,args:c});let g=await Yr({manual:t,hub:r},{id:o,token:i,plugin:a,endpoint:s,args:JSON.stringify(c),tenant_id:l,expires_at:u});return Vr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Jr(g):zr:r?g?Jr(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:zr}var Dt=new _u,Ps={open:0,cautious:1,strict:2,readonly:3},Pn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function Xr(e,n){return e===void 0?n:n===void 0||Ps[e]>=Ps[n]?e:n}function Ht(e,n){return Dt.run(Xr(Dt.getStore(),e)??e,n)}function vn(){return Dt.getStore()}function eo(e){return Ht("readonly",e)}function As(){return Dt.getStore()==="readonly"}function Ut(e,n){if(As()&&n!=="read")throw new Pn(e,n)}function Ze(e,n){Ut(e,n);let t=vn();if(!(t===void 0||Bt(n,t)==="allow"))throw new le(`Action '${e}' is a '${n}' operation and permission mode '${t}' does not allow it. The entity store cannot wait for approval.`,"policy")}var Mu={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}},vs={allow:0,require_approval:1,deny:2};function xs(e,n){return e===void 0?n:vs[e]>=vs[n]?e:n}function Bt(e,n,t){return t!==void 0?t:Mu[n][e]}function no(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Is(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Rs(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Ss(e){let n=Bt(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, widen the permission mode in force for this call.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",a).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,h=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${s.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Rs(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let c=Ou(),l=Eu(32).toString("hex"),u=e.timeoutMs??600*1e3,d=new Date(Date.now()+u).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:c,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:a,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${c}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Rs(e.db,c,u):{result:"blocked",reason:"pending",id:c,token:l,expiresAt:d}}var w=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function x(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function de(e){let n={error:e.code,message:e.message,...e.extra};return x(e.status,n)}function Ue(e){return new w(404,"not_found",e)}function F(e,n={}){return new w(400,"bad_request",e,n)}function to(e,n){return J(e,n,t=>Ue(t))}async function _s(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=W({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=K[t].integration,i=r,a;try{a=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{a=o.map(()=>null)}let s=o.filter((l,u)=>a[u]==null),c;return t==="oauth_2"?c=!s.includes("client_id")&&!s.includes("client_secret"):c=s.length===0,{configured:c,missingFields:s}}async function Es(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await _s(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Ft(){return{ok:!0}}async function Rn(e){return Promise.all(e.plugins.map(n=>Es(n,e)))}async function Lt(e,n){let t=to(e,n);return Es(t,e)}async function Du(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function Os(e,n){let t=await Du(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function An(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let a=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function Nt(e,n){if(!n)throw F("Tenant id must be a non-empty string");return Os(e,n)}async function $t(e,n){let t=n?.id?.trim();if(!t)throw F("Tenant id is required",{missingFields:["id"]});return Os(e,t)}async function Wt(e,n){let t=n?.trim()||"default",r={},o=await Zn(e,t);for(let i of o)r[i.plugin]=Tt(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function qt(e,n){let t=n?.plugin;if(typeof t!="string"||!t.trim())throw F("plugin is required",{missingFields:["plugin"]});let r=t.trim();to(e,r);let o=n?.tenantId;if(o!=null&&typeof o!="string")throw F("tenantId must be a string");let i=o?.trim()||"default";if(!e.database)return{ok:!0,disconnected:!1};let a=e.database.db,s=await a.selectFrom("corsair_integrations").select(["id"]).where("name","=",r).executeTakeFirst();if(!s)return{ok:!0,disconnected:!1};let c=!1;return await a.transaction().execute(async l=>{e.database?.isPg===!0&&await l.selectFrom("corsair_integrations").select("id").where("name","=",r).forUpdate().execute();let u=l.selectFrom("corsair_accounts").select("id").where("tenant_id","=",i).where("integration_id","=",s.id);await l.deleteFrom("corsair_events").where("account_id","in",u).execute(),await l.deleteFrom("corsair_entities").where("account_id","in",u).execute(),c=((await l.deleteFrom("corsair_accounts").where("tenant_id","=",i).where("integration_id","=",s.id).executeTakeFirst()).numDeletedRows??0n)>0n}),{ok:!0,disconnected:c}}async function ro(e,n){if(!e.database)throw Ue(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw Ue(`Permission '${n}' not found`);return Mt(e,t)}function Hu(e){if(!e.oauthConfig)throw F(`Plugin '${e.id}' has no oauthConfig`)}function Uu(e){if(!e.manual)throw new w(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function oo(e){let n=Uu(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new w(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function Bu(e){let n=!!e.hub,t=Tn(e.manual);if(!n&&!t)throw new w(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function Ms(e){if(!e.database||!e.kek)throw new w(500,"database_not_configured","A database and kek are required to issue connect links.")}async function Fu(e,n){let t=n?.plugin?.trim();if(!t)throw F("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=to(e,t);Hu(o);let i=oo(e);Ms(e);let a=await _s(o,e);if(!a.configured)throw new w(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=mn(He(t,r),e.kek),c;try{c=new URL(i.baseUrl)}catch{throw new w(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return c.searchParams.set("state",s),{connectUrl:c.toString(),expiresAt:new Date(Date.now()+jr).toISOString(),tenantId:r}}async function Lu(e,n,t){Ms(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let a=t.providerName?.trim();a&&(o.providerName=a);let s=await St(e,o);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt,tenantId:r}}async function jt(e,n,t){return Bu(n),n.hub?Lu(e,n,t):Fu(n,t)}async function Kt(e,n,t){if(n.hub&&!Tn(n.manual))throw new w(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw F("state is required",{missingFields:["state"]});oo(n);try{return await Gr(e,r)}catch(o){if(o instanceof ie)switch(o.code){case"invalid_state":throw F("Invalid or expired state");case"client_id_not_configured":throw new w(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new w(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function Zt(e,n,t){if(n.hub&&!Tn(n.manual))throw new w(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw F("Missing required fields",{missingFields:i});let a=oo(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:o,redirectUri:a.redirectUri,callbackParams:t.callbackParams})}catch(c){if(c instanceof Error&&c.name==="OAuthCallbackError")switch(c.code){case"invalid_state":throw F("Invalid or expired state");case"credentials_not_configured":throw new w(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new w(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function io(e,n){if(!e.database)throw Ue("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw Ue("Permission not found");return Mt(e,t)}async function Ds(e,n){return"id"in n?ro(e,n.id):io(e,n.token)}import{createCipheriv as Gu,createDecipheriv as fm,randomBytes as Fs,scryptSync as zu}from"crypto";import{createHmac as so,randomUUID as Nu,timingSafeEqual as Us}from"crypto";function ao(e){return e.run??null}function co(e){return e.probe??null}function Bs(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function Gt(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=so("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":Nu()}}}function uo(e){let n=e.signingSecret.trim();if(!n)return!1;let t=Bs(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>We)return!1;let i=so("sha256",n).update(e.body).digest("hex");try{return Us(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function xn(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=Bs(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>We)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=so("sha256",n).update(e.body).digest("hex");try{if(!Us(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function In(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function zt(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function Jt(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function Jn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function lo(e){return Jn(In(e))}async function po(e){let n=await Qt({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=In(n.body),r=zt({httpOk:n.ok,status:n.status,body:t}),o=Jn(t);if(!r||!o)throw new Error(Yt({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function Vt(e){return Jt(In(e))}function $u(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function Hs(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var Wu="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",qu="Check the delivery URL configured for this environment.";function ju(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${Wu}`}function Ku(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${qu}`}function Vn(e,n){let t=$u(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function Yt(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Vn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return ju(e);if(e.status===404)return Ku(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${Hs(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${Hs(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}var Zu=15e3;async function Qt(e){let{body:n,headers:t}=Gt(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n,signal:AbortSignal.timeout(Zu)}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Vn(e.deliveryUrl,r)}}}var Ju="aes-256-gcm",Vu=12,Yu=16,Qu=16,Xu=32;function el(e,n){return zu(e.trim(),n,Xu)}function go(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=Fs(Qu),o=el(t,r),i=Fs(Vu),a=Gu(Ju,o,i,{authTagLength:Yu}),s=JSON.stringify(e),c=Buffer.concat([a.update(s,"utf8"),a.final()]),l=a.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),c.toString("base64")].join(":")}var nl=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function fo(e){if(e instanceof Si)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!nl.some(t=>n.includes(t))}function tl(e){if(!e)return[];let n=_(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!De(r)):[]}async function Yn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await xt(e,{silent:!0});let[r,o]=await Promise.all([An(t),Rn(t)]),i={tenants:r.map(a=>({id:a.id})),plugins:o.map(a=>{let s=tl(t.plugins.find(c=>c.id===a.id));return{id:a.id,authType:a.authType,configured:a.configured,missingFields:a.missingFields,...s.length>0?{integrationCredentialFields:s}:{}}}),syncedAt:new Date().toISOString()};return go(i,n)}var pe=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function Xt(e,n){let t=v(e,()=>new pe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new pe("no_database","Database not configured");let r=J(t,n.plugin,u=>new pe("plugin_not_found",u)),o=_(r);if(!o)throw new pe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new pe("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await Cn(e,n.tenantId);let i=new Set(ut(r,o)),s=r.authConfig?.[o]?.account??[],c=B({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new pe("invalid_credentials",`Unknown credential field '${u}' for plugin '${n.plugin}'`);let p=te(c,`set_${u}`);if(!p)throw new pe("invalid_credentials",`Cannot set credential field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new pe("invalid_credentials","Provide at least one credential field to save");return await Pe(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var ge=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function yo(e,n){let t=v(e,()=>new ge("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ge("no_database","Database not configured");let r=J(t,n.plugin,u=>new ge("plugin_not_found",u)),o=_(r);if(!o)throw new ge("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await ms(e);let i=new Set(Mi(r,o)),s=r.authConfig?.[o]?.integration??[],c=W({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new ge("invalid_credentials",`Unknown integration credential field '${u}' for plugin '${n.plugin}'`);let p=te(c,`set_${u}`);if(!p)throw new ge("invalid_credentials",`Cannot set integration field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ge("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var er=new Map;function rl(e){for(let[n,t]of er)t<=e&&er.delete(n)}function nr(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();rl(r);let o=er.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(er.set(t,r+n),{ok:!0})}var Be=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function Sn(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:a,scope:s,authType:c="managed",providerData:l}=n;if(!o.trim())throw new Be("no_access_token","Managed OAuth delivery missing access_token");let u=v(e,()=>new Be("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new Be("no_database","No database configured on corsair instance");let d=J(u,t,g=>new Be("plugin_not_found",g));await Cn(e,r);let p=B({authType:c,integrationName:t,tenantId:r,kek:u.kek,database:u.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),a&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await p.set_scope(s),await Pe(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await vt(u.plugins,t,{access_token:o,refresh_token:i,scope:s,...l});if(g){try{let f=d.authConfig?.[c]?.account??[];await kn({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:g,authType:c,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}u.hub&&hn(u.hub,{plugin:t,tenantId:r,link:g,authType:c})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await wn(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function ol(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Ls(e,n,t=[]){for(let[r,o]of Object.entries(e))if(ol(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=Ls(o,n,[...t,r]);if(i)return i}return null}function il(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function sl(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function Ns(e,n,t,r,o){let i=il(n),a=typeof t=="string"?JSON.parse(t):t;(!a||typeof a=="object"&&Object.keys(a).length===0)&&i["x-goog-resource-uri"]&&(a=sl(i)||a);let c={headers:i,body:a,...r?{query:r}:{}},l=r?.tenantId||"default",u=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:gt;for(let g of p){let f=u[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(c))continue;let h=Ls(f.webhooks,c);if(!h)continue;let b=h.path.join("."),k={payload:a,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let P=await h.webhook.handler(k),R=!!Object.keys(P.returnToSender||{})?.length;return{plugin:g,action:b,body:a,response:R?{...P?.returnToSender,success:!0}:{success:!0},...P.responseHeaders&&{responseHeaders:P.responseHeaders}}}catch(P){return console.error(`Error executing webhook handler for ${g}.${b}:`,P),{plugin:g,action:b,body:a,response:{success:!1,error:P instanceof Error?P.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as al}from"crypto";import*as Ge from"vm";var $s="__corsairFailedStep",cl=3e4,mo=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function Ws(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function qs(e,n){return`st_${al("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function tr(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var js=new Set(["constructor","prototype","__proto__"]);function ve(e,n){if(e===null)return null;let t=typeof e;return t==="function"?ll(e,n):t==="object"?ul(e):e}function ul(e){return new Proxy(e,{get(n,t){if(!js.has(t))return ve(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function ll(e,n){return new Proxy(e,{apply:(t,r,o)=>dl(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!js.has(r))return ve(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function dl(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>ve(n,void 0),n=>{throw ve(n,void 0)}):ve(e,void 0)}function pl(e){let n=Object.create(null),t=Ge.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Ge.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),a=Ge.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),c=Ge.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=ve(e.corsair,void 0),n.__payload=o,n.__step=a,n.__console=c;let l=Ge.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let u,d=new Promise((p,g)=>{u=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(u))}async function ho(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(a,s)=>{if(o)throw o;let c=r++,l=qs(a,c);if(Object.hasOwn(n,l))return ve(n[l].output,void 0);try{let u=await s();return t.push({stepId:l,name:a,seq:c,status:"completed",output:u}),u}catch(u){if(Ws(u))throw u;let d=tr(u);t.push({stepId:l,name:a,seq:c,status:"failed",error:d});let p=new Error(d);throw p[$s]=a,p}});i.sleep=async(a,s)=>{if(o)throw o;let c=r++,l=qs(a,c);if(Object.hasOwn(n,l))return;t.push({stepId:l,name:a,seq:c,status:"completed",output:null});let u=Number.isFinite(s)?Math.max(0,s):0;throw o=new mo(Date.now()+u,a),o};try{await pl({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??cl});let a=o;return a?{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(a){if(Ws(a))return{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()};let s=tr(a),c=a!==null&&typeof a=="object"?a[$s]:void 0;return{status:"failed",steps:t,error:{message:s,...c?{failedStep:c}:{}}}}}import*as rr from"vm";var Ks=1e4;async function bo(e){let n=Object.create(null),t=rr.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=ve(e.corsair,void 0);let r=fl(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await eo(()=>{let a=rr.runInContext(o,t,{filename:"corsair:probe",timeout:r});a.catch(()=>{});let s,c=new Promise((l,u)=>{s=setTimeout(()=>u(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([a,c]).finally(()=>clearTimeout(s))});return{status:"ok",value:gl(i)}}catch(i){return{status:"error",error:tr(i)}}}function gl(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function fl(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?Ks:Math.min(e,Ks)}function ze(e){return e.deliveryMode==="auth.credentials"}function Qn(e){return e.deliveryMode==="connections.sync"}function or(e){return e.deliveryMode==="connect.create_link"}function Xn(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function et(e){return e.deliveryMode==="oauth.tokens"}function ir(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!ze(e)&&!Qn(e)&&!or(e)&&!Xn(e)&&!et(e)}function yl(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function ml(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await Yn(e,n)}}}}}catch(t){return{status:"failed",retryable:fo(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function hl(e,n){try{let t=await _t(e,n);return yl(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function ko(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function bl(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await Rt({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function kl(e,n,t,r){let o=await bl(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},a=await Ns(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!a.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(a.response&&a.response.success===!1)return{status:"failed",retryable:!1,error:typeof a.response.error=="string"?a.response.error:"Webhook handler failed"};let s=a.response?.returnToSender,c=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(a.response?.data??a.response);return{status:"ok",webhookResponse:{status:a.response?.statusCode??200,body:c,headers:a.responseHeaders}}}async function wl(e,n){return await zn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function Cl(e,n){return await Sn(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function Co(e,n,t){let r=await wo(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function wo(e,n,t){let r=v(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function Tl(e,n){try{return await Xt(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function Pl(e,n){try{return await yo(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function Zs(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function vl(e,n){try{let t=Zs(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await ho({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function Rl(e,n){try{let t=Zs(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await bo({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function nt(e,n,t={}){let r=v(e),o=ko(n.headers,"x-corsair-signature"),i=ko(n.headers,"x-corsair-timestamp"),a=ko(n.headers,"x-corsair-nonce"),s=!1;if(t.signingSecret?.trim()){let l=xn({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!l.ok)return{status:"failed",retryable:!1,error:l.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let u=nr(`nonce:${a.trim()}`,We);if(!u.ok)return{status:"failed",retryable:!1,error:u.error};s=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let c;try{c=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(c.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(c.type){case"webhook":return kl(e,r,c.payload,s);case"oauth.callback":return wl(e,c.payload);case"oauth.tokens":return Cl(e,c.payload);case"permission.approve":return wo(e,c.payload,"approved");case"permission.deny":return wo(e,c.payload,"denied");case"auth.credentials":return Tl(e,c.payload);case"integration.credentials":return Pl(e,c.payload);case"connect.create_link":return hl(e,c.payload);case"connections.sync":{let l=t.signingSecret?.trim();return l?ml(e,l):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?vl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?Rl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(c.type)}`}}}function Al(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var To=3,xl=250;function Il(e){return e?.name==="AbortError"}async function Sl(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function _l(e,n,t,r,o){for(let i=1;i<=To;i++){try{let a=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(a.ok)return await Sl(a)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(a){if(Il(a))throw a}i<To&&await zs(xl)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${To} attempts; the run may be retried`),!1}async function El(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:a,body:s,headers:c}=await i.json(),l=await t.process(e,{headers:c,body:s},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:u,body:d}=Al(l);return await _l(n,t,o,{deliveryId:a,status:u,body:d},r)?"handled":"error"}var Gs=1e3,Ol=5e3,Ml=3e4;function zs(e){return new Promise(n=>setTimeout(n,e))}var sr=globalThis.__corsairConnectLoops??=new Map;function Dl(e,n={fetch,process:nt}){let t;try{t=$(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(sr.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");sr.set(r,o);let i=()=>{sr.get(r)===o&&sr.delete(r)},a=!1,s=null;return(async()=>{let l=Gs,u=!1,d=async p=>{u||(console.warn("[corsair] connect loop error; retrying",p),u=!0),a||await zs(l),l=Math.min(l*2,Ol)};try{for(;!a;){s=new AbortController;let p=setTimeout(()=>s?.abort(),Ml);try{await El(e,t,n,s.signal)==="error"?await d("pull or ack failed"):(u=!1,l=Gs)}catch(g){if(a)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{a=!0,s?.abort(),i()}}}function Js(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Hl(e,n){return n&&!n.has(e.id)?!1:_(e)!==null}async function Vs(e,n,t={}){let r=v(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,a=await Zn(r,o,{pluginIds:t.pluginIds}),s=new Map(a.map(l=>[l.plugin,l])),c=r.plugins.filter(l=>Hl(l,i)).map(l=>{let u=_(l),d=s.get(l.id);return d?{plugin:l.id,providerName:Ee(l.id),authKind:Js(u),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:Ee(l.id),authKind:Js(u),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:c}}async function Ys(e,n){let t=$(e);return Z({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:yt})}function Ul(e){return typeof e=="string"&&e.length>0}function ar(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty managed pricing credentials payload");let n=e;if(!Ul(n.api_key))throw new Error("Hub API returned incomplete managed pricing credentials (expected api_key)");let t={api_key:n.api_key};return n.expires_in!==void 0&&typeof n.expires_in=="number"&&Number.isFinite(n.expires_in)&&n.expires_in>0&&(t.expires_in=n.expires_in),t}var Qs=1024*1024,Xs=3e4;function Je(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:Qs}function Ve(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:Xs}function _n(e){return new w(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function Bl(e){return new w(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function cr(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o(Bl(n)),n)})])}finally{clearTimeout(t)}}async function ur(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:s,value:c}=await cr(()=>t.read(),n.bodyStallTimeoutMs);if(s)break;if(o+=c.byteLength,o>n.maxBodyBytes)throw _n(n.maxBodyBytes);r.push(c)}let i=new Uint8Array(o),a=0;for(let s of r)i.set(s,a),a+=s.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var Po=new Map;function ea(e){let n;try{n=$(e)}catch{return}let t=Or(n);t&&Po.get(n.projectApiKey)!==t&&(Po.set(n.projectApiKey,t),S({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{Po.delete(n.projectApiKey)}))}var Fl=[".corsair.dev"];function Ll(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function Nl(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Ll(n)?!0:Fl.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function na(e){return!e||!Nl(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function ta(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function vo(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function Ro(e,n){let t=$(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=Me(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=nr(`browser:${i.jti}`,Oe);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(Qn(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let s=await Yn(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:s}}})}}if(or(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let s=i.connectLinkPlugins?.filter(Boolean)??[];if(s.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let c=await _t(e,{tenantId:i.tenantId,plugins:s});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:c.connectUrl,expiresAt:c.expiresAt}})}}if(ze(i))return i.hubSuccessUrl?i.credentials?(await Xt(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:vo(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:vo(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(Xn(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await Co(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(et(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await Sn(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!ir(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await zn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(s){let c=s instanceof Error?s.message:"Hub delivery failed";return Qn(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:or(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:ze(i)&&i.hubSuccessUrl?{type:"redirect",url:vo(i.hubSuccessUrl,{error:c})}:ze(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:{type:"json",status:400,body:{error:c}}}return{type:"redirect",url:i.hubSuccessUrl}}async function Ao(e,n){let t=$(e),r=await nt(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,a=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:a}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:a}}function xo(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function Io(e,n){return n.method==="GET"?Ro(e,n.url):Ao(e,{headers:n.headers,body:n.body??""})}async function So(e,n){try{let t=await Io(e,n);return xo(t)}catch(t){if(t instanceof Te)return Response.json({error:t.message},{status:503});throw t}}async function Ye(e,n,t){ea(e);let r=n.method.toUpperCase(),o=na(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await So(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await ur(n,{maxBodyBytes:Je(t?.maxBodyBytes),bodyStallTimeoutMs:Ve(t?.bodyStallTimeoutMs)}):void 0});return ta(i,o)}var I=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function En(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function On(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var ra=new WeakMap;function Qe(e,n,t){let r=ra.get(e);r||(r=new Map,ra.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var oa=300;async function _o(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,a=n?.forceRefresh??!1,s=`managed:${o}:${i}`;return Qe(t,s,async()=>{let[c,l,u]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!c&&!u)throw new I(o,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&c&&l&&Number(l)>d+oa)return{accessToken:c,expiresAt:Number(l),refreshed:!1};if(!u&&c&&!a){let f=l?Number(l):null;if(f===null||f>d+oa)return{accessToken:c,expiresAt:f??d+3600,refreshed:!1}}if(!u)throw new I(o,"managed");let p=await Wl(r,o,i,u),g=await On(t,p,l);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function $l(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function Wl(e,n,t,r){try{return await S({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:ln})}catch(o){let i=o instanceof Error?o.message:"";throw $l(i)?new I(n,"managed"):o}}async function ia(e,n){e._refreshAuth=async()=>(await _o(n,{forceRefresh:!0})).accessToken}var ql="",jl=60,Eo=new WeakMap;function sa(e){let n=ht(e.apiUrl),t=e.instanceKey?.trim()??"";return[encodeURIComponent(n),encodeURIComponent(e.projectApiKey),encodeURIComponent(t)].join(ql)}function Kl(e,n,t,r){let i=`${sa(e)}:${n}:${t}`;return r?`${i}:${r}`:i}function Zl(e,n){return Eo.get(e)?.get(n)}function Gl(e,n,t){let r=Eo.get(e);r||(r=new Map,Eo.set(e,r)),r.set(n,t)}function zl(e,n){return e.expiresAt===null?!1:e.expiresAt>n+jl}function lr(e,n){if(!n)throw new I(e,"managed_pricing",`[auth-missing:${e}:managed_pricing]: Hub config is required. Pass hub: { ... } to createCorsair().`)}async function Oo(e,n){lr(e.plugin,e.hub);let t=n.operation.trim();if(!t)throw new I(e.plugin,"managed_pricing",`[auth-missing:${e.plugin}:managed_pricing]: Operation id is required for Hub metering.`);let r=n.forceRefresh??!1,o=Kl(e.hub,e.plugin,e.tenantId,t),a=`managed_pricing:${r?"force":"routine"}:${o}`;return Qe(e.cache,a,async()=>{let s=Math.floor(Date.now()/1e3);if(!r){let u=Zl(e.cache,o);if(u&&zl(u,s))return{apiKey:u.apiKey,expiresAt:u.expiresAt,fromCache:!0}}let c=await S({hub:e.hub,path:"/managed-pricing/credentials",body:{plugin:e.plugin,tenantId:e.tenantId,operation:t},extraHeaders:{"x-corsair-metered-operation":t},notFoundMessage:"Managed pricing is not configured for this project",parseResponse:ar}),l=c.expires_in!==void 0?s+c.expires_in:null;return Gl(e.cache,o,{apiKey:c.api_key,expiresAt:l}),{apiKey:c.api_key,expiresAt:l,fromCache:!1}})}function dr(){return{}}async function pr(e,n){lr(n.plugin,e.hub);let t=e.tenantId?.trim();if(!t)throw new I(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: tenantId is required for metered credentials.`);let r=(n.operation??e.meteredOperationId)?.trim();if(!r)throw new I(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: Endpoint operation id missing \u2014 cannot meter usage.`);return(await Oo({hub:e.hub,plugin:n.plugin,tenantId:t,cache:n.cache},{operation:r})).apiKey}function aa(e){return{delivery:n=>Ye(e,n),deliveryOptions:n=>Ye(e,n)}}var ca=1200*1e3;function Mo(){return Ce()}function Do(){return ca}function Ho(e,n){return qn(e,n,ca)}function Uo(e,n){return ue(e,n)}function Bo(e){return qe(e)}var ua=600*1e3;function Fo(){return Ce()}function Lo(){return ua}function No(e,n){return qn(e,n,ua)}function $o(e,n){return ue(e,n)}function Wo(e){return Lr(e)}function qo(e){return qe(e)}function jo(){return Ce()}function Ko(e,n,t){return kt(e,n,Math.floor(t.getTime()/1e3))}function Zo(e,n){return ue(e,n)}function Go(e){return qe(e)}var Xe=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${lt}`),this.name="CorsairKekMissingError"}};function gr(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new Xe;let a=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${lt}`)}})}async function Jl(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function la(e){let{integrationId:n,accountId:t}=await Jl(e);return{integrationId:n,accountId:t}}function da(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>Mr(t(),{tenantId:n,message:r}),list:()=>Hr(t(),{tenantId:n}),get:r=>({message:o=>Dr(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>Ur(t(),{chatId:r,tenantId:n})})}}function pa(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function Vl(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await Cs(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):pa(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function Yl(e,n,t){let r=mn(He(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):pa(e,i),connectUrl:i}}async function Ql(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.error.authType==="managed_pricing"?{message:e.error.message,connectUrl:null}:e.manual&&Tn(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?Yl(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?Vl({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function ga(e){let{message:n,connectUrl:t}=await Ql(e);throw new I(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var fr="connect.request",Jo="connect.cleared",Xl=600*1e3;async function zo(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function ed(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function nd(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[fr,Jo]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function fa(e,n,t,r,o,i,a){if(a&&!i)throw new Error("encryptDataAtRest requires kek");let s=await nd(e,n,o),c=new Date(s),l=i?pt(r,await Nn(e.db,n,i)):r;await e.db.insertInto("corsair_events").values({id:un(),created_at:c,updated_at:c,account_id:n,event_type:t,payload:l}).execute()}async function td(e,n,t=Date.now()){let r=await zo(e,n.tenantId,n.plugin);r&&await fa(e,r,fr,{plugin:n.plugin,connectUrl:n.connectUrl},t,n.kek,n.encryptDataAtRest)}function rd(e){let n=e;if(typeof e=="string")try{n=JSON.parse(e)}catch{return null}return!n||typeof n!="object"||Array.isArray(n)?null:n}async function od(e,n,t,r,o,i){let a=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[fr,Jo]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!a||a.event_type!==fr)return null;let s=a.created_at instanceof Date?a.created_at.getTime():Date.parse(String(a.created_at));if(r-s>o)return null;let c=a.payload;if(typeof c=="string")try{c=JSON.parse(c)}catch{return null}if(Di(c)){if(!i)return null;try{c=Hi(c,await Nn(e.db,n,i))}catch{return null}}let l=rd(c);if(!l)return null;let u=l.plugin,d=l.connectUrl;return typeof u!="string"||typeof d!="string"?null:{plugin:u,connectUrl:d,requestedAt:new Date(s).toISOString(),tenantId:t,requestedAtMs:s,accountId:n}}async function Vo(e,n,t=Date.now(),r=Xl,o){let i=await ed(e,n);if(i.length===0)return null;let a=(await Promise.all(i.map(u=>od(e,u,n,t,r,o)))).filter(u=>u!==null);if(a.length===0)return null;a.sort((u,d)=>u.requestedAtMs-d.requestedAtMs||u.accountId.localeCompare(d.accountId));let{requestedAtMs:s,accountId:c,...l}=a[0];return l}async function ya(e,n,t=Date.now(),r,o,i){let a;if(r)a=await zo(e,n,r);else{let s=await Vo(e,n,t,void 0,o);a=s?await zo(e,n,s.plugin):null}a&&await fa(e,a,Jo,{},t,o,i)}async function Yo(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await td(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl,encryptDataAtRest:n.encryptDataAtRest,kek:n.kek})}catch{}}var id=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function ma(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[a||"DEFAULT"]?.handler||id)(e,i)}var ha=new Map;function sd(e){let n=ha.get(e);return n||(n=dr(),ha.set(e,n)),n}function ad(e){return typeof e=="function"}function Qo({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:a=[],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:P,encryptDataAtRest:R}){for(let[U,E]of Object.entries(e)){let ee=n?.[U];if(ad(E)){let C=ee,T=[...a,U].join("."),O=async(L={})=>{let ne=l?.[T];Ut(T,ne?.riskLevel??"write");let H,M=vn(),Ie=c?.mode,Hn=Xr(M,Ie);if(Hn){let q=ne,oe=q?.riskLevel??"write",me=c?.overrides?.[T],Ne=M!==void 0&&M!==Ie&&Hn===M?xs(me,Bt(oe,M)):me,{result:an,reason:N,onComplete:Bn,token:ct,id:Pi,expiresAt:Bc}=await Ss({pluginId:o,endpointPath:T,args:L,mode:Hn,override:Ne,riskLevel:oe,meta:q,db:u,timeoutMs:d?no(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(an==="blocked"){let cn;N==="denied"?cn=`Action '${T}' was denied by the user. Await further instructions before proceeding.`:N==="policy"?cn=M?`Action '${T}' is blocked by permission mode '${M}'.`:`Action '${T}' is blocked by the permission policy. Update the corsair config to allow it.`:N==="timeout"?cn=`Action '${T}' timed out waiting for approval.`:ct&&Pi?cn=await Qr({permissionsOptions:d,manual:g,hub:f,permissionId:Pi,permissionToken:ct,plugin:o,endpoint:T,args:L,tenantId:p??"default",expiresAt:Bc??new Date(Date.now()+(d?no(d.timeout):600*1e3)).toISOString(),operationPath:T}):cn=`Action '${T}' requires user approval before it can run.`;let Fc=N==="denied"||N==="policy"||N==="timeout"?N:"pending";throw new le(cn,Fc)}H=Bn}let xr=async(q,oe,me)=>{try{return await E(oe,me)}catch(at){if(at instanceof Error){let Ne=await ma(at,o,T,typeof me=="object"&&me!==null?me:{args:me},i);if(q<(Ne.maxRetries||0)){let an=q+1;console.log(`Retrying (${an} / ${Ne.maxRetries})...`);let N;if(Ne.headersRetryAfterMs)N=Ne.headersRetryAfterMs;else switch(Ne.retryStrategy){case"exponential_backoff":N=Math.pow(2,an-1)*1e3;break;case"exponential_backoff_jitter":let Bn=Math.pow(2,an-1)*1e3,ct=(Math.random()-.5)*1e3;N=Math.max(0,Bn+ct);break;case"linear_1s":N=1e3;break;case"linear_2s":N=2e3;break;case"linear_3s":N=3e3;break;case"linear_4s":N=4e3;break;default:N=1e3;break}return await new Promise(Bn=>setTimeout(Bn,N)),await xr(an,oe,me)}}throw at}},st,Dc={...t,meteredOperationId:T},Hc=typeof t.tenantId=="string"?t.tenantId:void 0,Uc=h?_(h):void 0;try{Uc==="managed_pricing"&&f?st=await pr({hub:f,tenantId:Hc??p,meteredOperationId:T},{plugin:o,cache:sd(o),operation:T}):s&&(st=await s(Dc,"endpoint"))}catch(q){if(q instanceof we)throw h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await Yo(u,{tenantId:q.tenantId??p,plugin:q.plugin,connectUrl:q.connectUrl,encryptDataAtRest:R,kek:R?b:void 0}),q;if(q instanceof I){h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1});try{await ga({error:q,manual:g,hub:f,plugin:h,tenantId:p,database:u,kek:b,plugins:k,multiTenancy:P})}catch(oe){throw oe instanceof I&&await Yo(u,{tenantId:oe.tenantId??p,plugin:oe.pluginId,connectUrl:oe.connectUrl,encryptDataAtRest:R,kek:R?b:void 0}),oe}}throw q}if(!C?.before&&!C?.after){let q=await xr(0,{...t,key:st},L);return await H?.(),h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),q}let Ci={...t,key:st},Un=C.before?await C.before(Ci,L):{ctx:Ci,args:L,continue:!0,passToAfter:void 0};if(Un.continue===!1)return;let Ti=await xr(0,Un.ctx,Un.args);return await C.after?.(Un.ctx,Ti,Un.passToAfter),await H?.(),h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),Ti};r[U]=O}else if(E&&typeof E=="object"){let C={};Qo({endpoints:E,hooks:ee,ctx:t,tree:C,pluginId:o,errorHandlers:i,currentPath:[...a,U],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:P,encryptDataAtRest:R}),r[U]=C}}}var fe={findByEntityId:"read",existsByEntityId:"read",findIdByEntityId:"read",findById:"read",findManyByEntityIds:"read",list:"read",search:"read",count:"read",upsertByEntityId:"write",deleteById:"destructive",deleteByEntityId:"destructive"},cd=/^\$+date$/;function ba(e){if(typeof e!="object"||e===null||Array.isArray(e))return null;let n=Object.keys(e),t=n[0];return n.length!==1||!t||!cd.test(t)?null:typeof e[t]=="string"?t:null}function en(e){if(e instanceof Date)return{$date:e.toISOString()};if(Array.isArray(e))return e.map(en);let n=ba(e);return n?{[`$${n}`]:e[n]}:e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,en(r)])):e}function nn(e){let n=ba(e);if(n){let t=e[n];if(n!=="$date")return{[n.slice(1)]:t};let r=new Date(t);if(Number.isNaN(r.getTime()))throw F(`Invalid $date value "${t}" \u2014 expected an ISO 8601 timestamp`);return r}return Array.isArray(e)?e.map(nn):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,nn(r)])):e}async function Xo(e,n,t){let r=Object.hasOwn(fe,n.method)?fe[n.method]:void 0;if(!r)throw new w(404,"unknown_db_method",`Unknown db method "${n.method}" \u2014 expected one of ${Object.keys(fe).join(", ")}`);Ze(`${n.plugin}.db.${n.entityType}.${n.method}`,r);let i=e?.[n.plugin]?.db;if(!i)throw new w(404,"unknown_plugin",`Plugin "${n.plugin}" has no entity store`);let a=Object.hasOwn(i,n.entityType)?i[n.entityType]:void 0,s=a?.[n.method];if(typeof s!="function")throw new w(404,"unknown_entity_type",`Plugin "${n.plugin}" has no entity type "${n.entityType}"`);return s.apply(a,t)}function ud(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function ei({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,a]of Object.entries(e)){let s=n?.[i];if(ud(a)){let c=s,l=async u=>{let d=(g,f)=>a.handler(g,f),p=o&&u?.hubVerified!==!0?await o(t,"webhook"):void 0;return!c?.before&&!c?.after?d({...t,key:p},u):(async()=>{let g={...t,key:p},f=c.before?await c.before(g,u):{ctx:g,args:u,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await c.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:a.match,handler:l}}else if(a&&typeof a=="object"){let c={};ei({webhooks:a,hooks:s,ctx:t,webhooksTree:c,keyBuilder:o}),r[i]=c}}}function ka(e){return e&&typeof e=="object"?e:{}}async function wa(e,n){return Z({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=ka(t).workflows;return Array.isArray(r)?r:[]}})}async function Ca(e,n){return Z({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>ka(t).workflow})}async function Ta(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Pa(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function va(e,n){return S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function ni(e){return e&&typeof e=="object"?e:{}}async function Ra(e,n){return Z({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=ni(t).runs;return Array.isArray(r)?r:[]}})}async function Aa(e,n){return Z({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=ni(t).runs;return Array.isArray(r)?r:[]}})}async function xa(e,n){return Z({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>ni(t).run})}async function ti(e,n,t){await S({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var Ia=(e,n)=>ti(e,"approve",n),Sa=(e,n)=>ti(e,"deny",n),_a=(e,n)=>ti(e,"cancel",n);function Ea(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?Aa(t(),{workflowId:r.workflowId,tenantId:n}):Ra(t(),{tenantId:n}),get:r=>xa(t(),{runId:r,tenantId:n}),approve:r=>Ia(t(),{runId:r,tenantId:n}),deny:r=>Sa(t(),{runId:r,tenantId:n}),cancel:r=>_a(t(),{runId:r,tenantId:n})}}function Oa(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>Ta(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>wa(t(),{tenantId:n}),get:o=>Ca(t(),{workflowId:o,tenantId:n}),run:(o,i)=>va(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:Ea(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>Pa(t(),{workflowId:o,tenantId:n,name:i})}}function ld(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await la({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function dd(e,n){let t={};for(let[r,o]of Object.entries(n))t[r]=new Proxy(o,{get(i,a){let s=i[a];if(typeof a!="string"||typeof s!="function")return s;let c=Object.hasOwn(fe,a)?fe[a]:void 0;if(!c)return s;let l=s;return async(...u)=>(Ze(`${e}.db.${r}.${a}`,c),l.apply(i,u))}});return t}function pd(e,n,t,r,o){return e?Ir(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function ri(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:a,manualConfig:s,hubConfig:c,internalConfig:l}=n,u=r??"default",d=l&&t?()=>yn(l,u):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=ld(t,f.id,u,d);if(h?.entities){let H={};for(let[M,Ie]of Object.entries(h.entities)){let Hn=t?Ir(t.db,b,M,h.version,Ie,l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o??""}:void 0):pd(void 0,b,M,h.version,Ie);H[M]=Hn}g[f.id].db=H,p[f.id].db=dd(f.id,H)}let k=f.options,P=f.authConfig,R;if(t&&o&&k?.authType){let H=P?.[k.authType]?.account??[];R=B({authType:k.authType,integrationName:f.id,tenantId:u,kek:o,database:t,extraAccountFields:H,ensureProvisioned:d}),p[f.id].keys=R}let U={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...R?{keys:R,authType:k?.authType}:{},tenantId:u,...l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o}:{},...c?{hub:c}:{}},E=f.endpoints??{},ee=f.hooks,C={...i,...f.errorHandlers},T={},O=f.options?.permissions;Qo({endpoints:E,hooks:ee,ctx:U,tree:T,pluginId:f.id,errorHandlers:C,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:O,endpointMeta:f.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:f.oauthConfig,kek:o,tenantId:u}:void 0,hubConfig:c,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy,encryptDataAtRest:l?.encryptDataAtRest===!0}),Object.keys(T).length>0&&(p[f.id].api=T),U.endpoints=T;let L=f.webhooks??{},ne=f.webhookHooks;if(Object.keys(L).length>0&&!Oi(k?.authType)){let H={};ei({webhooks:L,hooks:ne,ctx:U,webhooksTree:H,keyBuilder:f.keyBuilder}),p[f.id].webhooks=H,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=da(c,u),p.workflows=Oa(c,u),p}function Ma(e,n,t){let r={};for(let o of e){let i=o.options,a=o.authConfig;if(i?.authType){let s=a?.[i.authType]?.integration??[],c=W({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:s});r[o.id]=c}}return r}var gd=3e4;function yr(e){let n=e.length;for(;n>0&&e[n-1]==="/";)n--;return e.slice(0,n)}function fd(e){let n=0;for(;n<e.length&&e[n]==="/";)n++;return e.slice(n)}function yd(e,n){return`${yr(e)}/${fd(n)}`}function md(e,n){let t=n??{},{error:r,message:o,...i}=t;return typeof r!="string"?new w(e,"internal_error","Internal error"):new w(e,r,o,i)}var oi=Symbol("cloudRequestTimeout");async function G(e,n,t,r){let o=vn(),i=e.fetch??globalThis.fetch,a=e.timeoutMs??gd,s=new AbortController,c,l=new Promise(g=>{c=setTimeout(()=>{s.abort(),g(oi)},a)}),u;try{let g=i(yd(e.baseUrl,t),{method:n,headers:{authorization:`Bearer ${e.apiKey}`,"content-type":"application/json",...o?{"x-corsair-mode":o}:{}},body:r===void 0?void 0:JSON.stringify(r),signal:s.signal}).catch(h=>{if(s.signal.aborted)return oi;throw h}),f=await Promise.race([g,l]);if(f===oi)throw new w(0,"internal_error","Cloud request timed out");u=f}finally{clearTimeout(c)}let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw md(u.status,p);if(p===void 0)throw new w(u.status,"internal_error","Invalid or empty response body from runtime");return p}var z={invoke:"/:tenant/:plugin/call/:op",entityDb:"/:tenant/:plugin/db/:entity/:method",instances:"/instances",connectLinks:"/connect/links",tenants:"/tenants",tenant:"/tenants/:id",connectionStatus:"/connection-status",disconnect:"/disconnect",permission:"/permissions/:id",permissionLookup:"/permissions/lookup-by-token"};var hd=new Set(["keys","webhooks"]),bd=new Set(["chats","workflows"]),ii=new Set(["then","catch","finally"]);function ye(e){return typeof e=="function"?e():Promise.resolve(e)}function Da(e,n,t,r){let o=async(...i)=>{let a=await ye(e);return(await G(a,"POST",z.invoke.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":op",r.map(encodeURIComponent).join(".")),{args:i[0]})).data};return new Proxy(o,{get(i,a){if(!(typeof a!="string"||ii.has(a)))return Da(e,n,t,[...r,a])}})}function kd(e,n,t){return new Proxy({},{get(r,o){if(!(typeof o!="string"||ii.has(o)))return new Proxy({},{get(i,a){if(typeof a!="string")return;let s=Object.hasOwn(fe,a)?fe[a]:void 0;if(s)return async(...c)=>{Ze(`${t}.db.${o}.${a}`,s);let l=await ye(e),u=await G(l,"POST",z.entityDb.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":entity",encodeURIComponent(o)).replace(":method",encodeURIComponent(a)),{args:en(c)});return nn(u.data)}}})}})}function mr(e,n){let t=e?new Set(e.map(r=>r.id)):null;return new Proxy({},{get(r,o){if(!(typeof o!="string"||ii.has(o))){if(bd.has(o))throw new Error(`"${o}" is not available in cloud mode (deferred)`);if(t&&!t.has(o))throw new Error(`Unknown plugin "${o}"`);return new Proxy({},{get(i,a){if(a==="api")return Da(n.transport,n.tenantId,o,[]);if(a==="db")return kd(n.transport,n.tenantId,o);if(typeof a=="string"&&hd.has(a))throw new Error(`"${a}" is not available in cloud mode (deferred)`)}})}}})}function hr(e){return{connect:{createLink:n=>{if(!n.plugin||!n.tenantId)throw new Error('connect.createLink requires both "plugin" and "tenantId" in cloud mode');return ye(e).then(t=>G(t,"POST",z.connectLinks,n))}},tenants:{create:n=>ye(e).then(t=>G(t,"POST",z.tenants,n)),list:()=>ye(e).then(n=>G(n,"GET",z.tenants)),get:n=>ye(e).then(t=>G(t,"GET",z.tenant.replace(":id",encodeURIComponent(n))))},connectionStatus:{get:n=>ye(e).then(t=>G(t,"GET",`${z.connectionStatus}?tenantId=${encodeURIComponent(n.tenantId)}`))},disconnect:n=>ye(e).then(t=>G(t,"POST",z.disconnect,n)),permissions:{get:n=>ye(e).then(t=>"id"in n?G(t,"GET",z.permission.replace(":id",encodeURIComponent(n.id))):G(t,"POST",z.permissionLookup,{token:n.token}))}}}var Re=class extends w{type;retryable;param;docUrl;requestId;constructor(n,t){super(n,t.code,t.message,{...t}),this.name="CloudApiError",this.type=t.type??"api_error",this.retryable=t.retryable??(n===0||n===429||n>=500),this.param=t.param,this.docUrl=t.doc_url,this.requestId=t.request_id}};function tt(e,n,t){let r=t?.get("request-id")?.trim()||void 0,i=(n??{}).error;if(typeof i=="string"){let a=n.message;return new Re(e,{code:i,message:typeof a=="string"?a:void 0,request_id:r})}return i&&typeof i=="object"&&typeof i.code=="string"?new Re(e,{request_id:r,...i}):new Re(e,{code:e===0?"request_failed":"internal_error",message:`Corsair Cloud returned ${e} with no error body`,request_id:r})}var wd=3e4,Cd=new Set(["GET","HEAD","PUT","DELETE"]),Td=/^[a-z][a-z0-9-]{0,31}$/;function tn(e,n){if(!Td.test(e))throw new Error(`${n}: "${e}" is not a valid instance key. Lowercase letter first, then letters, digits or hyphens, up to 32 characters.`)}function rn(e){let n=new URLSearchParams;for(let[r,o]of Object.entries(e))o!==void 0&&n.set(r,String(o));let t=n.toString();return t?`?${t}`:""}function A(e,n){return`${e}/${encodeURIComponent(n)}`}async function br(e,n,t,r,o={}){let i=e.fetch??globalThis.fetch,a=new AbortController;o.signal?.aborted&&a.abort();let s=()=>a.abort();o.signal?.addEventListener("abort",s,{once:!0});let c=setTimeout(()=>a.abort(),e.timeoutMs??wd),l={authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"};e.apiVersion&&(l["corsair-version"]=e.apiVersion),o.idempotencyKey&&(l["idempotency-key"]=o.idempotencyKey),o.requestId&&(l["x-corsair-request-id"]=o.requestId);let u;try{u=await i(`${e.baseUrl}${t}`,{method:n,headers:l,body:r===void 0?void 0:JSON.stringify(r),signal:a.signal});let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw tt(u.status,p,u.headers);if(p===void 0&&u.status!==204)throw tt(u.status,void 0,u.headers);return p}catch(d){if(o.signal?.aborted||d instanceof Re)throw d;let p=Cd.has(n),g=u?p?!0:void 0:p||!!o.idempotencyKey;throw tt(u?.status??0,{error:{code:"request_failed",message:d instanceof Error?d.message:String(d),retryable:g}},u?.headers)}finally{clearTimeout(c),o.signal?.removeEventListener("abort",s)}}function si(e,n){tn(n,"withInstance");let t=(s,c,l,u)=>br(e,s,c,l,u),r=(...s)=>[n,...s].join(":"),o=s=>rn({...s,instance:n}),i=s=>`${A("/instances",n)}${s}`,a=s=>`${A("/webhooks",r(s))}/deliveries`;return{instanceKey:n,tenants:{list:(s={},c)=>t("GET",`/tenants${o(s)}`,void 0,c),create:(s,c)=>t("POST","/tenants",{...s,instance:n},c),get:(s,c)=>t("GET",A("/tenants",r(s)),void 0,c),update:(s,c,l)=>t("PATCH",A("/tenants",r(s)),c,l),delete:(s,c)=>t("DELETE",A("/tenants",r(s)),void 0,c)},access:{list:(s={},c)=>t("GET",`/access${o(s)}`,void 0,c),get:(s,c)=>t("GET",A("/access",r(s)),void 0,c),set:(s,c,l)=>t("PUT",A("/access",r(s)),c,l),revoke:(s,c)=>t("DELETE",A("/access",r(s)),void 0,c)},connections:{list:(s={},c)=>t("GET",`/connections${o(s)}`,void 0,c),get:(s,c,l)=>t("GET",A("/connections",r(s,c)),void 0,l),delete:(s,c,l)=>t("DELETE",A("/connections",r(s,c)),void 0,l)},connect:{createSession:(s,c)=>t("POST","/connect/sessions",{...s,instance:n},c)},integrations:{list:(s={},c)=>t("GET",`/integrations${o(s)}`,void 0,c),get:(s,c)=>t("GET",A("/integrations",r(s)),void 0,c),put:(s,c,l)=>t("PUT",A("/integrations",r(s)),c,l),delete:(s,c)=>t("DELETE",A("/integrations",r(s)),void 0,c),operations:(s,c)=>t("GET",`${A("/integrations",r(s))}/operations`,void 0,c),oauthApp:{get:(s,c)=>t("GET",`${A("/integrations",r(s))}/oauth-app`,void 0,c),put:(s,c,l)=>t("PUT",`${A("/integrations",r(s))}/oauth-app`,c,l),delete:(s,c)=>t("DELETE",`${A("/integrations",r(s))}/oauth-app`,void 0,c)}},webhooks:{list:(s={},c)=>t("GET",`/webhooks${o(s)}`,void 0,c),create:(s,c)=>t("POST","/webhooks",{...s,instance:n},c),get:(s,c)=>t("GET",A("/webhooks",r(s)),void 0,c),delete:(s,c)=>t("DELETE",A("/webhooks",r(s)),void 0,c),rotateSecret:(s,c,l)=>t("POST",`${A("/webhooks",r(s))}/rotate-secret`,c,l),deliveries:{list:(s,c={},l)=>t("GET",`${a(s)}${rn(c)}`,void 0,l),get:(s,c,l)=>t("GET",A(a(s),c),void 0,l),retry:(s,c,l)=>t("POST",`${A(a(s),c)}/retry`,void 0,l)}},signingSecret:{get:s=>t("GET",i("/signing-secret"),void 0,s),rotate:s=>t("POST",i("/signing-secret/rotate"),void 0,s)},apply:s=>t("POST",i("/apply"),void 0,s),removeFromRuntime:s=>t("POST",i("/remove"),void 0,s),reconcile:s=>t("POST",i("/reconcile"),void 0,s)}}function ai(e){let n=(t,r,o,i)=>br(e,t,r,o,i);return{project:{get:t=>n("GET","/project",void 0,t)},keys:{get:t=>n("GET","/keys",void 0,t),rotate:t=>n("POST","/keys/rotate",void 0,t)},instances:{list:(t={},r)=>n("GET",`/instances${rn(t)}`,void 0,r),create:(t,r)=>(tn(t.instance_key,"instances.create"),n("POST","/instances",t,r)),get:(t,r)=>(tn(t,"instances.get"),n("GET",A("/instances",t),void 0,r)),update:(t,r,o)=>(tn(t,"instances.update"),n("PATCH",A("/instances",t),r,o)),delete:(t,r)=>(tn(t,"instances.delete"),n("DELETE",A("/instances",t),void 0,r))},integrations:{catalog:(t={},r)=>n("GET",`/integrations/catalog${rn(t)}`,void 0,r)},mcp:{links:{list:(t={},r)=>n("GET",`/mcp/links${rn(t)}`,void 0,r),mint:(t,r)=>n("POST","/mcp/links",t,r),get:(t,r)=>n("GET",A("/mcp/links",t),void 0,r),update:(t,r,o)=>n("PATCH",A("/mcp/links",t),r,o),delete:(t,r)=>n("DELETE",A("/mcp/links",t),void 0,r),rotate:(t,r)=>n("POST",`${A("/mcp/links",t)}/rotate`,void 0,r)},tokens:{mint:(t,r)=>n("POST","/mcp/tokens",t,r)}}}}var Ha="default",Pd="corsairCloud: the management API needs a ck_cloud_<slug>.<secret> key, or an explicit `managementUrl`.",vd=new Set(["then","catch","finally","toString","toJSON","valueOf","constructor","inspect",Symbol.toPrimitive,Symbol.toStringTag,Symbol.iterator,Symbol.asyncIterator]);function ci(e={}){return new Proxy(e,{get(n,t,r){if(Reflect.has(n,t))return Reflect.get(n,t,r);if(!vd.has(t))throw new Error(Pd)}})}function Ae(e){throw new Error(`"${e}" is not available in cloud mode (deferred)`)}function Rd(e){let n=e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim();if(!n)throw new Error("Cloud mode (ck_cloud_ key) requires a base URL \u2014 set hub.baseUrl or CORSAIR_CLOUD_URL.");return Fn(n),n}function Ua(e){return!!(e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim())}function Ad(e,n){let t=hr(e);return{ok:()=>Ae("manage.ok"),tenants:t.tenants,plugins:{list:()=>Ae("manage.plugins.list"),get:()=>Ae("manage.plugins.get")},connectionStatus:{get:r=>{let o=r?.tenantId||void 0;if(!o&&n)throw new Error("connectionStatus.get requires a tenantId in multi-tenant mode");return t.connectionStatus.get({tenantId:o??Ha})}},permissions:t.permissions,connect:{createLink:t.connect.createLink,resolve:()=>Ae("manage.connect.resolve"),oauthCallback:()=>Ae("manage.connect.oauthCallback")},disconnect:t.disconnect}}function xd(e,n){let t=Ad(e,n.multiTenancy);if(n.multiTenancy)return{withTenant:a=>{if(!a)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return mr(n.plugins,{transport:e,tenantId:a})},get keys(){return Ae("keys")},get permissions(){return Ae("permissions")},manage:t};let r=mr(n.plugins,{transport:e,tenantId:Ha}),o={manage:t,get keys(){return Ae("keys")},get permissions(){return Ae("permissions")}};return new Proxy(r,{get(a,s,c){return typeof s=="string"&&s in o?Reflect.get(o,s,c):Reflect.get(a,s,c)}})}function Ba(e){return xd({baseUrl:Rd(e.hub),apiKey:e.hub.projectApiKey},{multiTenancy:!!e.multiTenancy,plugins:e.plugins})}function Id(e){let n=yr(e),t="/api/corsair";return n.endsWith(t)?n.slice(0,-t.length):n}async function Sd(e){let n=await G({...e,baseUrl:Id(e.baseUrl)},"GET",z.instances),t=new Map;for(let r of n.instances)Fn(r.url,`Instance "${r.instanceKey}" URL`),t.set(r.instanceKey,r.url);return t}function _d(e){let n=e.apiKey?.trim();if(!n)throw new Error("corsairCloud: apiKey is required");let t=vi(n),r=e.url?.trim()||Ri(n);if(!r)throw new Error("corsairCloud: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");Fn(r);let o={baseUrl:r,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs},a=(yr(e.managementUrl?.trim()??"")||void 0)??(t?Ai(r,t):null);a&&Fn(a,"Management base URL");let s=a?{baseUrl:a,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs,apiVersion:e.apiVersion}:null,c=null;function l(g){return g&&c===g&&(c=null),c||(c=Sd(o).catch(f=>{throw c=null,f})),c}async function u(g){let f=l(),b=(await f).get(g)??(await l(f)).get(g);if(b)return b;let k=[...(await l()).keys()].join(", ");throw new Error(`corsairCloud.withInstance("${g}"): no such instance \u2014 available: ${k||"(none)"}`)}let d=hr(o),p={tenants:d.tenants,permissions:d.permissions};return{manage:s?{...ai(s),...p}:ci(p),withInstance:g=>{let f=s?si(s,g):ci(),h=async()=>({...o,baseUrl:await u(g)}),b=hr(h),k={withTenant(P){if(!P)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return mr(void 0,{transport:h,tenantId:P})},connectionStatus:b.connectionStatus,disconnect:b.disconnect,createConnectLink:b.connect.createLink};return s?{...f,...k}:ci(k)}}}var Ed="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function Fa(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${Ed}`),t):n}var Od=e=>new w(404,"unknown_plugin",`Plugin '${e}' is not registered.`),Md=(e,n)=>new w(404,"unknown_op",`Operation '${n}' not found on plugin '${e}'.`),kr=(e="/call")=>new w(403,"call_disabled",`The ${e} route is disabled. Construct managementHandler with { unsafeAllowUnauthenticated: true } to enable it \u2014 only when your own backend fronts the handler.`),Dd=e=>new w(401,"not_connected",`Tenant is not connected for plugin '${e}'. Reconnect and retry.`),La=e=>new w(403,"permission_denied",`The call was blocked (${e}).`,{reason:e}),Hd=()=>new w(403,"approval_required","This action needs human approval before it can run. Approval is not resumable over HTTP in this version.",{reason:"pending"}),Ud=(e,n)=>new w(502,"provider_error","The provider returned an error.",{providerStatus:e,body:n});function Bd(e,n){if(e instanceof w)return e;if(e instanceof I)return Dd(e.pluginId||n);if(e instanceof Pn)return La("readonly");if(e instanceof le)return e.reason==="pending"?Hd():La(e.reason);if(e instanceof Error&&e.name==="ApiError"){let t=e;return Ud(typeof t.status=="number"?t.status:502,t.body)}return console.error("[corsair] unhandled error in call operation",e),new w(500,"internal_error","Internal error")}var Fd=new WeakMap,Na=new WeakMap,Ld=512;function $a(e,n){let t=e.get(n);return t||(t=new Map,e.set(n,t)),t}function Nd(e,n,t){if(n.size<=Ld)return;let r=Na.get(e);for(let o of n.keys())if(o!==t&&(r?.get(o)??0)===0){n.delete(o);return}}function $d(e,n,t){if(!n.multiTenancy)return{client:e};let r=typeof t=="string"?t.trim():"";if(!r)throw F("tenant is required for a multi-tenant runtime",{missingFields:["tenant"]});let o=$a(Fd,e),i=o.get(r);if(i)return o.delete(r),o.set(r,i),{client:i,tenantId:r};let a=e.withTenant(r);return o.set(r,a),Nd(e,o,r),{client:a,tenantId:r}}function Wd(e,n){let t=e;for(let r of n.split(".")){if(t==null||typeof t!="object"||!Object.prototype.hasOwnProperty.call(t,r))return null;t=t[r]}return typeof t=="function"?t:null}function Wa(e,n=[]){let t=[];for(let[r,o]of Object.entries(e??{}))typeof o=="function"?t.push([...n,r].join(".")):o&&typeof o=="object"&&t.push(...Wa(o,[...n,r]));return t}function qa(e){let n={};for(let t of e.plugins)n[t.id]=Wa(t.endpoints??{});return n}async function ui(e,n,t,r){if(!n.plugins.some(s=>s.id===t.plugin))throw Od(t.plugin);let{client:o,tenantId:i}=$d(e,n,t.tenant),a=i?$a(Na,e):null;a&&i&&a.set(i,(a.get(i)??0)+1);try{return await r(o)}catch(s){throw Bd(s,t.plugin)}finally{if(a&&i){let s=(a.get(i)??1)-1;s<=0?a.delete(i):a.set(i,s)}}}async function ja(e,n,{plugin:t,op:r,tenant:o,args:i}){return ui(e,n,{plugin:t,tenant:o},a=>{let s=a[t],c=Wd(s?.api,r);if(!c)throw Md(t,r);return c(i??{})})}function on(e,n){if(e===void 0)return n;if(e===null)throw new w(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function rt(e){if(e!==void 0)throw new w(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var Ga=[{method:"GET",pattern:"/ok",public:!0,handler:async()=>x(200,Ft())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>(rt(n),x(200,await An(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>(rt(t),x(201,await $t(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(rt(t),x(200,await Nt(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>x(200,await Rn(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>x(200,await Lt(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>x(200,await Wt(e,on(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(rt(t),x(200,await ro(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",public:!0,handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?x(200,await io(e,t)):x(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=on(r,o.tenantId);return x(200,await jt(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",public:!0,handler:async({corsair:e,internal:n,query:t})=>x(200,await Kt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",public:!0,handler:async({corsair:e,internal:n,body:t})=>x(200,await Zt(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=on(t,n.tenantId)??"default",o=e.database?await Vo(e.database,r,void 0,void 0,e.encryptDataAtRest?e.kek:void 0):null;return x(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=on(t,r?.tenantId)??"default";return e.database&&await ya(e.database,o,void 0,r?.plugin,e.encryptDataAtRest?e.kek:void 0,e.encryptDataAtRest),x(200,{ok:!0})}},{method:"POST",pattern:"/disconnect",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n??{},o=on(t,r.tenantId);return x(200,await qt(e,{...r,tenantId:o}))}},{method:"GET",pattern:"/call",handler:async({internal:e,allowCall:n})=>{if(!n)throw kr();return x(200,{plugins:qa(e)})}},{method:"POST",pattern:"/:tenant/:plugin/db/:entityType/:method",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw kr("/db");rt(i);let s=o??{};if(s.args!==void 0&&!Array.isArray(s.args))throw F("args must be an array");let c=on(i,r.tenant),l=nn(s.args??[]),u=await ui(e,n,{plugin:r.plugin,tenant:c},d=>Za(t,()=>Xo(d,{plugin:r.plugin,entityType:r.entityType,method:r.method},l)));return x(200,{data:en(u)})}},{method:"POST",pattern:"/:tenant/:plugin/call/:op",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw kr();let s=o??{},c=on(i,r.tenant),l=await Za(t,()=>ja(e,n,{plugin:r.plugin,op:r.op,tenant:c,args:s.args}));return x(200,{data:l})}}];(()=>{let e=new Set;for(let n of Ga){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function qd(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let a=t[i],s=r[i];if(a.startsWith(":"))o[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return o}function jd(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function Kd(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await ur(e,n).catch(o=>{throw o instanceof w?o:new w(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new w(400,"invalid_json","Request body is not valid JSON")}}var Zd="/api/corsair",Ka=new Set(["open","cautious","strict","readonly"]);function Za(e,n){let t=e.headers.get("x-corsair-mode");if(t===null)return n();if(!Ka.has(t))throw F(`Unknown permission mode "${t}" \u2014 expected one of ${[...Ka].join(", ")}`);return Ht(t,n)}function j(e,n={}){let t=n.basePath??Zd,r=Je(n.maxBodyBytes),o=Ve(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},a=v(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async s=>{try{let c=s.headers.get("content-length");if(c!==null&&Number(c)>r)throw _n(r);let l=new URL(s.url),u=jd(l.pathname,t),d=s.method.toUpperCase();if(d==="OPTIONS"||u==="/"||u==="")return await Ye(e,s,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return x(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(l.searchParams);for(let g of Ga){if(g.method!==d)continue;let f=qd(g.pattern,u);if(!f)continue;if(!g.public&&n.authenticate&&!await n.authenticate(s))return x(401,{error:"unauthorized",message:"invalid or missing credentials"});let h=await Kd(s,i),b=n.resolveTenant?await n.resolveTenant(s):void 0;return await g.handler({corsair:e,internal:a,req:s,params:f,query:p,body:h,scopedTenant:b,allowCall:(n.unsafeAllowUnauthenticated??!1)||!!n.authenticate})}throw Ue(`No route for ${d} ${u}`)}catch(c){if(n.onError){let u=await n.onError(c,s);if(u)return u}if(c instanceof w)return de(c);let l=c instanceof Error?c.message:"Internal server error";return x(500,{error:"internal_error",message:l})}}}function Gd(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function zd(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function Jd(e,n,t){let r=[],o=0,i=e();try{let a=await cr(()=>i.next(),t);for(;a.done!==!0;){let s=zd(a.value);if(o+=s.byteLength,o>n)throw _n(n);r.push(s),a=await cr(()=>i.next(),t)}return Buffer.concat(r)}catch(a){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw a}}var za=!1;function Vd(){za||(za=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function Yd(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=Je(n.maxBodyBytes),o=Ve(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(Vd(),i=JSON.stringify(e.body));else{let s=e[Symbol.asyncIterator];if(typeof s!="function")return;let c=await Jd(s.bind(e),r,o);c.length>0&&(i=c)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw _n(r);return typeof i=="string"?i:i}function Y(e){e.resume?.()}async function Fe(e,n={}){let t=Gd(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,a=new Headers;for(let[l,u]of Object.entries(e.headers))if(u!=null&&!Qd.has(l.toLowerCase()))if(Array.isArray(u))for(let d of u)a.append(l,d);else a.set(l,u);let s={method:(e.method??"GET").toUpperCase(),headers:a},c=await Yd(e,n);return c!==void 0&&(s.body=c,a.has("content-type")||a.set("content-type","application/json")),new Request(i,s)}async function Q(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var Qd=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function Ja(e,n){let t=j(e,n);return async(r,o,i)=>{try{let a=await t(await Fe(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(o,a)}catch(a){if(a instanceof w&&o.headersSent!==!0){await Q(o,de(a)),Y(r);return}Y(r),i(a)}}}function Xd(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function ep(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=Xd(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function Va(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function Ya(e,n){let t=j(e,n);return async(r,o)=>{ep(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let a=await t(await Fe(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await Q(o.raw,a)}catch(a){if(a instanceof w&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await Q(o.raw,de(a)),Y(i);return}throw Y(i),a}}}function Qa(e,n){let t=j(e,n);return r=>t(r.req.raw)}function Xa(e,n){let t=j(e,n);return{GET:t,POST:t,OPTIONS:t}}function ec(e,n){let t=j(e,n);return async(r,o)=>{try{let i=await t(await Fe(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),Y(r);return}if(i instanceof w){await Q(o,de(i)),Y(r);return}console.error("[corsair] management handler failed:",i),await Q(o,x(500,{error:"internal_error"})),Y(r)}}}function wr(e,n){let t=j(e,n);return r=>t(r.request)}function nc(e,n){let t=wr(e,n);return{GET:t,POST:t,OPTIONS:t}}function tc(e,n){let t=wr(e,n);return{loader:t,action:t}}function rc(e,n){let t=wr(e,n);return{GET:t,POST:t,OPTIONS:t}}function oc(e,n){let t=wr(e,n);return{GET:t,POST:t,OPTIONS:t}}function ic(e,n){let t=j(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await Fe(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await Q(r.node.res,i)}catch(i){if(i instanceof w&&r.node.res.headersSent!==!0){await Q(r.node.res,de(i)),Y(o);return}throw Y(o),i}}}function sc(e,n){return j(e,n)}function ac(e){let n={[ot]:e};return{ok:Ft,tenants:{list:()=>An(e),create:t=>$t(e,t),get:t=>Nt(e,t)},plugins:{list:()=>Rn(e),get:t=>Lt(e,t)},connectionStatus:{get:t=>Wt(e,t?.tenantId)},permissions:{get:t=>Ds(e,t)},connect:{createLink:t=>jt(n,e,t),resolve:t=>Kt(n,e,t),oauthCallback:t=>Zt(n,e,t)},disconnect:t=>qt(e,t)}}async function cc(e,n,t,r,o="pending",i){if(i==="")throw new Error("encryptDataAtRest requires kek");if(!e)return null;try{let a=un(),s=new Date,c=i?pt(r,await Nn(e.db,n,i)):r;return await e.db.insertInto("corsair_events").values({id:a,created_at:s,updated_at:s,account_id:n,event_type:t,payload:c,status:o}).execute(),a}catch(a){return console.warn("Failed to log event:",a),null}}async function np(e,n,t,r="pending"){if(e.encryptDataAtRest&&!e.kek)throw new Error("encryptDataAtRest requires kek");try{let o=await e.$getAccountId();return cc(e.database,o,n,t,r,e.encryptDataAtRest?e.kek:void 0)}catch(o){return console.warn("Failed to log event:",o),null}}import*as lc from"https";import*as Cr from"querystring";var tp=["expires_in","refresh_token_expires_in"];function uc(e){let n={...e};for(let t of tp){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function rp(e){try{return uc(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=Cr.parse(e);return!n.access_token&&!n.error?null:uc({...n})}function At(e,n,t,r,o){let i=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,c)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};a||(l.client_id=n,l.client_secret=t);let u=Cr.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(u).toString()};a&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=lc.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){c(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=rp(f);h?s(h):c(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>c(new Error(`Request failed: ${g.message}`))),p.write(u),p.end()})}async function dc(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[a,s,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(En({accessToken:a,expiresAt:s,forceRefresh:n?.forceRefresh}))return{accessToken:a,expiresAt:Number(s),refreshed:!1};if(!c)throw new I(o,"oauth_2");let l=await S({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:c},parseResponse:ln}),u=await On(t,l,s);return{accessToken:l.access_token,expiresAt:u,refreshed:!0}}async function pc(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:a="form",extraParams:s}=e,c={grant_type:"refresh_token",refresh_token:t,...s},l={Accept:"application/json"};i==="basic"?l.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?l.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(c.client_id=o),c.client_secret=r),a==="json"?l["Content-Type"]="application/json":l["Content-Type"]="application/x-www-form-urlencoded";let u=await fetch(n,{method:"POST",headers:l,body:a==="json"?JSON.stringify(c):new URLSearchParams(c)});if(!u.ok)throw new Error(`OAuth token refresh failed (${u.status}): ${await u.text()}`);let d=JSON.parse(await u.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function gc(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new I(n.plugin,"oauth_2");let l={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},u=g=>Qe(e.keys,r,async()=>(await dc(l,{forceRefresh:g})).accessToken);e._refreshAuth=()=>u(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return En({accessToken:d,expiresAt:p})?d:u(!1)}let o=t.client_secret,i=t.client_id,a=l=>Qe(e.keys,r,async()=>{let[u,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!l&&En({accessToken:u,expiresAt:d}))return u;if(!p)throw new I(n.plugin,"oauth_2");let g=await pc({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await On(e.keys,g,d),g.access_token});e._refreshAuth=()=>a(!0);let[s,c]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return En({accessToken:s,expiresAt:c})?s:a(!1)}var fc="  ";function ae(e){let n=e;return n._def??n.def??{}}function ce(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function se(e){return e.innerType??e.schema??e.out??e.in}function mc(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return se(e)}}function hc(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Pr(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Mn(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function bc(e,n){return e.description??n.description}function ip(e){let n=e;for(;n;){let t=ae(n),r=bc(n,t);if(r)return r;let o=ce(t);if(fi(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=mc(t,o);continue}break}}function fi(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function X(e){let n=ae(e),t=ce(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Mn(n)[0]??"unknown");case"ZodEnum":return Mn(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=se(n);return r?X(r):"unknown"}case"ZodNullable":{let r=se(n);return`${r?X(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=se(n);return r?X(r):"unknown"}case"ZodArray":{let r=hc(n);if(!r)return"unknown[]";let o=ae(r),i=ce(o)==="ZodUnion",a=X(r);return`${i?`(${a})`:a}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Pr(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([a,s])=>{let c=ce(ae(s));return`${c==="ZodOptional"||c==="ZodNullable"?a+"?":a}: ${X(s)}`}).join(", ")} }`}case"ZodUnion":return Mn(n).map(r=>X(r)).join(" | ");case"ZodIntersection":return`${X(n.left)} & ${X(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=mc(n,t);return r?X(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function xe(e){let n=ae(e),t=ce(n),r=bc(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??Mn(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=Mn(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=se(n),i=o?xe(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=se(n),i=o?xe(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=se(n);return o?{...xe(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=hc(n);return{kind:"array",optional:!1,description:r,items:o?xe(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=Pr(e,n),i={};for(let[a,s]of Object.entries(o))i[a]=xe(s);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=Mn(n);for(let i of o){let a=ae(i);if(ce(a)==="ZodObject")return{...xe(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=se(n);return o?{...xe(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function NP(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),a=e.find(u=>u.id===o);if(!a)return null;let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=Le(a.endpointMeta,s),l=Le(a.endpointSchemas,s);return!c&&!l?null:{input:l?.input?xe(l.input):null,output:l?.output?xe(l.output):null,description:c?.description}}var yi=["equals","contains","startsWith","endsWith","in"],sp=["equals","gt","gte","lt","lte","in"],ap=["equals"],cp=["equals","before","after","between"];function kc(e){let n=ae(e);switch(ce(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=se(n);return r?kc(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function mi(e){let n=ae(e),t=ce(n);if(fi(t)){let i=se(n);return i?mi(i):{}}if(t!=="ZodObject")return{};let r=Pr(e,n),o={};for(let[i,a]of Object.entries(r)){let s=kc(a);s==="string"?o[i]={type:"string",operators:yi}:s==="number"?o[i]={type:"number",operators:sp}:s==="boolean"?o[i]={type:"boolean",operators:ap}:s==="date"&&(o[i]={type:"date",operators:cp})}return o}function wc(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function di(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&di(o,i,t)}}function pi(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function gi(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];pi(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&gi(o,i,t)}}function hi(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!o)return null;let[i,a]=o;if(r.length===0)return pi(a)?[i]:null;if(a!==null&&typeof a=="object"&&!pi(a)){let s=hi(a,r);if(s!==null)return[i,...s]}return null}function Cc(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let a="    ".repeat(i+2);t.push(`${a}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let a="    ".repeat(i+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var up=new Set(gt);function sn(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(s=>s.id===r);if(!i)return up.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:sn(e);if(t==="webhooks"){if(!i.webhooks)return[];let s=[];return gi(i.webhooks,[],s),s.map(c=>`${i.id}.webhooks.${c}`)}if(t==="db"){let s=i.schema?.entities;return s?Object.keys(s).map(c=>`${i.id}.db.${c}.search`):[]}if(!i.endpoints)return[];let a=[];return di(i.endpoints,[],a),a.map(s=>`${i.id}.api.${s}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let a=[];gi(i.webhooks,[],a),o[i.id]=a.map(s=>`${i.id}.webhooks.${s}`)}else if(t==="db")for(let i of e){let a=i.schema?.entities;a&&(o[i.id]=Object.keys(a).map(s=>`${i.id}.db.${s}.search`))}else for(let i of e){if(!i.endpoints)continue;let a=[];di(i.endpoints,[],a),o[i.id]=a.map(s=>`${i.id}.api.${s}`)}return o}function Le(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function lp(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),a=i.startsWith(".")?i.slice(1):i;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function li(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function $P(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),a=e.find(s=>s.id===o);if(a){if(i.startsWith("db.")){let u=i.slice(3),d=u.lastIndexOf(".");if(d!==-1){let p=u.slice(0,d),g=u.slice(d+1),f=a.schema?.entities;if(g==="search"&&f){let h=wc(f,p);if(h){let[b,k]=h,P=mi(k),R=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${yi.join(", ")}]`];for(let[U,E]of Object.entries(P))R.push(`  ${U}?: ${E.type}  [${E.operators.join(", ")}]`);return R.push("}"),R.join(`
+`)}}}return li(sn(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let u=i.slice(9);if(a.webhooks){let d=hi(a.webhooks,u.split("."));if(d!==null){let p=d.join("."),g=Le(a.webhookSchemas,p.toLowerCase()),f=g?.response?X(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${Tr(Dn(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${Cc(o,d)}`),h.join(`
+
+`)}}return li(sn(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=Le(a.endpointMeta,s),l=Le(a.endpointSchemas,s);if(c||l){let u=[],d=[c?.riskLevel?`[${c.riskLevel}]`:"",c?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[c?.description,d].filter(Boolean).join("  ");return p&&u.push(p),l?.input&&u.push(`input ${Tr(Dn(l.input))}`),l?.output&&u.push(`output ${Tr(Dn(l.output))}`),u.join(`
+
+`)}}}return li(sn(e),"Path not found. Available operations")}function yc(e){let n=e;for(;;){let t=ae(n),r=ce(t);if(fi(r)){let o=se(t);if(!o)return n;n=o;continue}return n}}function Dn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=yc(e),t=ae(n);if(ce(t)==="ZodObject"){let o=Pr(n,t),i=[];for(let[a,s]of Object.entries(o)){let c=ae(s),l=ce(c),u=l==="ZodOptional"||l==="ZodNullable",d=yc(s),p=ip(s);i.push({key:a,optional:u,type:X(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:X(n)}}function Tr(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=fc.repeat(n+1),r=fc.repeat(n);return`{
+${e.fields.map(i=>{let a=i.optional?`${i.key}?`:i.key,s=i.description?`  // ${i.description}`:"";return`${t}${a}: ${i.type}${s}`}).join(`
+`)}
+${r}}`}return"unknown"}function dp(e,n){let t=sn(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(u=>u.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let u of t){let{shortPath:d,lookupKey:p}=lp(u,n),g=Le(r.endpointMeta,p),f=Le(r.endpointSchemas,p);!g&&!f||o.push({path:u,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Dn(f?.input),output:Dn(f?.output)})}o.sort((u,d)=>u.path.localeCompare(d.path));let i=[],a=sn(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let u of a){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=hi(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=Le(r.webhookSchemas,b.toLowerCase()),P=k?.response?X(k.response):void 0;i.push({path:u,description:k?.description,payload:Dn(k?.payload),responseType:P,usageExample:Cc(n,h)})}i.sort((u,d)=>u.path.localeCompare(d.path));let s=[],c=sn(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(c)&&l)for(let u of c){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let P=wc(l,b);if(!P)continue;let[R,U]=P,E=mi(U),ee=Object.entries(E).map(([C,T])=>({field:C,type:T.type,operators:T.operators}));s.push({path:u,entityName:R,filters:[{field:"entity_id",type:"string",operators:yi},...ee]})}return s.sort((u,d)=>u.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:s}}}import{randomUUID as Tc}from"crypto";async function pp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Tc(),o=Tc(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as gp}from"crypto";var vr="https://graph.microsoft.com/v1.0",bi=2e4,fp=60;async function yp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${vr}/subscriptions`,{headers:r,signal:AbortSignal.timeout(bi)});if(c.ok){let{value:l}=await c.json(),u=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(u.map(d=>fetch(`${vr}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(bi)}).catch(()=>{})))}}catch{}let o=gp(),i=new Date(Date.now()+fp*6e4).toISOString(),a=await fetch(`${vr}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(bi),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!a.ok)throw new Error(`MS Graph subscribe failed (${a.status}): ${await a.text()}`);let s=await a.json();return s.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:s.id},webhookSecret:o}):null}function Pc(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function mp(e,n){let t=Pc(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function hp(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function vc(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function Rc(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function it(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function bp(e){return it(e.body)}function Ac(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Rr(Array.isArray(r)?r:[r])}function xc(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let l=Rr(Array.isArray(c)?c:[c]);if(l)return decodeURIComponent(l)}let r=Ac({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let l=n[c],u=Array.isArray(l)?l[0]:l;if(!(!u||typeof u!="string"))try{let p=(u.startsWith("http")?new URL(u):new URL(`https://example.invalid${u.startsWith("/")?u:`/${u}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=it(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Rr([a?.validationToken])??null}function kp(e){if(xc(e))return!0;let n=it(e.body??e.payload);return vc(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Rr(e){for(let n of e){let t=Rc(n);if(t)return t}}function wp(e){let t=it(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var ot=Symbol.for("corsair:internal");function Ec(e){if(e.hub?.projectApiKey?.startsWith("ck_cloud_")&&Ua(e.hub))return Ba(e);let n=e.database?Ii(e.database,{dbTables:e.dbTables}):void 0,t=e.kek??"",r=n&&t?Ma(e.plugins,n,t):gr(!!n,!!t),o=Fa(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?wt(e.hub):void 0,encryptDataAtRest:e.encryptDataAtRest===!0},a=Is(n),s=ac(i);if(e.multiTenancy){let u=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=ri(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[ot]:i})},keys:r,permissions:a,manage:s},{[ot]:i});return Ic(u,i.hub),_c(u,i.hub),u}let c=ri(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},c,{keys:r,permissions:a,manage:s,[ot]:i});return Ic(l,i.hub),_c(l,i.hub),l}function Ic(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-I43UGI2N.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function Cp(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var Sc=globalThis.__corsairTunnels??=new Set,Tp=1e3,Pp=3e4;function vp(e){let n=e.schedule??((a,s)=>void setTimeout(a,s).unref?.()),t=e.minDelayMs??Tp,r=e.maxDelayMs??Pp,o=t,i=()=>{let a=!1,s=()=>{a||(a=!0,n(i,o),o=Math.min(o*2,r))};e.start(s).then(()=>{o=t}).catch(s)};i()}function _c(e,n){if(!Cp(n))return;let t=n.projectApiKey;if(Sc.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}Sc.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Sr;vp({start:a=>import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:a})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${_r}`)}).catch(s=>{throw console.warn(`[corsair] tunnel down: ${s instanceof Error?s.message:String(s)}. Retrying \u2014 run \`corsair setup\` if it doesn't recover.`),s})})}var Rp={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},ki=Rp;async function xt(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},a=n?.caller??"script",s=_i(e);if(!s)throw new Error("setupCorsair: invalid corsair instance");if(!s.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=Bp(e,s.plugins,n),l={...s,database:s.database},u=l.database.db;await Np(l.database,i);let d=await $p(u,l,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await jp(e,c,n.credentials,l,o,i);let p=await Zp(d,c,o,a);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=Ec({plugins:s.plugins,database:u,kek:s.kek,multiTenancy:!0,...s.encryptDataAtRest?{encryptDataAtRest:!0}:{}}).withTenant(c.tenantId);await Gp(g,s.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function wi(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...K[n][t],...r])}function Up(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(s=>s.id===t);if(!o)continue;let i=_(o);if(!i)continue;let a=wi(o,i,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function Bp(e,n,t){let r=Ei(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Up(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function Mc(e,n){return _e(e)?n===0?!0:Object.values(e).every(t=>Mc(t,n-1)):!1}function Fp(e){return Mc(e,4)}var Lp=Bi;function Ar(e){if(e instanceof Ep){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Hp?Ar(r):"unknown";return n}return e instanceof Sp?`${Ar(e.unwrap())} | null`:e instanceof Op?`${Ar(e.unwrap())} | undefined`:e instanceof Ip?e.options.join(" | "):e instanceof Dp?"string":e instanceof _p?"number":e instanceof Ap?"boolean":e instanceof xp?"date":e instanceof Mp?"jsonb":"unknown"}async function Np(e,n){let t=await e.db.introspection.getTables(),r=new Set(t.map(i=>i.name)),o=e.tableNames??xi();for(let[i,a]of Object.entries(Lp)){let s=o[i];if(!r.has(s)){let c=s!==i?` (dbTables.${i} \u2192 "${s}")`:"";n(`[corsair:setup] Table "${s}" does not exist${c}. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(Ar(a),null,2)}`)}}}async function $p(e,n,t,r,o){let i=new Date,a=new Map;for(let s of n.plugins){let c=s.id,l=_(s),u=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!u){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),u=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=l?s.authConfig?.[l]?.integration??[]:[],p=l?s.authConfig?.[l]?.account??[]:[],g=l&&u?W({authType:l,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(u&&!u.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!u||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",u.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:u.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&B({authType:l,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}a.set(c,{pluginId:c,authType:l,integration:g,account:f,integrationFields:[...K[l].integration,...d],accountFields:r?[...K[l].account,...p]:[]})}return a}function Wp(e){if(!_e(e))return;let n=e.keys;return _e(n)?n:void 0}function qp(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function jp(e,n,t,r,o,i){let a=Wp(e),s=n.provisionAccounts?qp(e,n.tenantId):void 0;for(let[c,l]of Object.entries(t)){let u=r.plugins.find(k=>k.id===c);if(!u){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=_(u);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=wi(u,d,"integration"),g=wi(u,d,"account"),f=a?.[c],h=s?.[c],b=_e(h)?h.keys:void 0;for(let[k,P]of Object.entries(l))if(P){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let R=te(f,`set_${k}`);if(!R){i(`[corsair:setup] Cannot set integration field '${k}' for '${c}'.`);continue}await R(P),o(`[corsair:setup] Set ${c} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${k}' on a multi-tenant instance`);let R=te(b,`set_${k}`);if(!R){i(`[corsair:setup] Cannot set account field '${k}' for '${c}'.`);continue}await R(P),o(`[corsair:setup] Set ${c} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${c}'.`)}}}var Oc=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function Kp(e,n,t,r,o,i,a,s,c){let l=[],u=[];for(let p of o){if(Oc.has(p))continue;let g=te(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(Oc.has(p))continue;let g=te(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}let d=l.length===0&&u.length===0;if(n==="managed_pricing")s(`[corsair:setup] '${e}' (managed_pricing) uses Corsair metered credentials via Hub \u2014 nothing to store in your database. Pass hub: { ... } to createCorsair().`);else if(d)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...u];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of u){let h=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}s(g.join(`
+`))}}return d}async function Zp(e,n,t,r){let o=new Set;for(let i of e.values())await Kp(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function Gp(e,n,t,r,o){if(!Fp(ki)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=ki,a=new Set(n.map(s=>s.id));for(let[s,c]of Object.entries(i)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let l=_e(e)?e[s]:void 0,u=_e(l)?l.api:void 0;if(u)for(let[d,p]of Object.entries(c))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${d}.${g}...`);try{let h=_e(u)?u[d]:void 0;await te(h,g)?.(f)}catch(h){o(`[corsair:setup] ${s} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{Fi as a,Ee as b,we as c,ft as d,yt as e,mt as f,ln as g,Li as h,Er as i,Fr as j,$n as k,zi as l,Ji as m,Oe as n,We as o,Ce as p,pn as q,gn as r,Me as s,Nr as t,Yi as u,jn as v,Te as w,Kn as x,$r as y,wt as z,$ as A,Ct as B,fn as C,W as D,B as E,es as F,ns as G,xt as H,jp as I,He as J,qr as K,hn as L,kn as M,Kr as N,Rt as O,ds as P,Ke as Q,V as R,Zr as S,zn as T,ys as U,wu as V,It as W,cy as X,bs as Y,ks as Z,ws as _,Cs as $,St as aa,Gr as ba,le as ca,Et as da,Ot as ea,Pn as fa,Ht as ga,vn as ha,eo as ia,As as ja,Ut as ka,Ze as la,w as ma,ao as na,co as oa,Gt as pa,uo as qa,xn as ra,In as sa,zt as ta,Jt as ua,Jn as va,lo as wa,po as xa,Vt as ya,Vn as za,Yt as Aa,Qt as Ba,Be as Ca,Sn as Da,Ns as Ea,ho as Fa,bo as Ga,ze as Ha,Xn as Ia,et as Ja,ir as Ka,Co as La,nt as Ma,Al as Na,El as Oa,Dl as Pa,Vs as Qa,Ys as Ra,ar as Sa,Qs as Ta,Xs as Ua,Je as Va,Ve as Wa,Ro as Xa,Ao as Ya,xo as Za,Io as _a,So as $a,Ye as ab,I as bb,_o as cb,ia as db,lr as eb,Oo as fb,dr as gb,pr as hb,aa as ib,Mo as jb,Do as kb,Ho as lb,Uo as mb,Bo as nb,Fo as ob,Lo as pb,No as qb,$o as rb,Wo as sb,qo as tb,jo as ub,Ko as vb,Zo as wb,Go as xb,Xe as yb,fe as zb,en as Ab,nn as Bb,Xo as Cb,Re as Db,_d as Eb,j as Fb,Ja as Gb,Va as Hb,Ya as Ib,Qa as Jb,Xa as Kb,ec as Lb,nc as Mb,tc as Nb,rc as Ob,oc as Pb,ic as Qb,sc as Rb,cc as Sb,np as Tb,At as Ub,gc as Vb,NP as Wb,sn as Xb,$P as Yb,Tr as Zb,dp as _b,pp as $b,vr as ac,yp as bc,Pc as cc,mp as dc,hp as ec,vc as fc,Rc as gc,it as hc,bp as ic,Ac as jc,xc as kc,kp as lc,Rr as mc,wp as nc,ot as oc,Ec as pc,Cp as qc,vp as rc};