corsair 0.1.151 → 0.1.153

package/dist/{browser-delivery-tqFM2jpE.d.ts → browser-delivery-Dn04Z-ah.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-C4Q-Nj2c.js';
+import { B as BrowserDeliveryPayload } from './index-C9BKDXFA.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/chunk-PR4HGVXE.js

@@ -0,0 +1,68 @@
+import{a as Se,b as _r,c as Er}from"./chunk-6IURNA4L.js";import{a as xi,b as Ii,c as Si,d as Bn}from"./chunk-XCTHEKDP.js";import{A as un,B as Sr,C as Ni,a as Oi,b as _e,c as Mi,d as v,e as V,f as Di,g as re,h as Z,i as E,j as Hi,k as ct,l as Ui,m as ut,n as he,o as be,p as oe,r as lt,s as $e,t as ke,u as Fn,v as Bi,w as dt,x as Fi,y as Ln,z as Li}from"./chunk-WUEWJTDA.js";import{b as _i,c as Ei}from"./chunk-XPXWKPFZ.js";import{ZodBoolean as Fp,ZodDate as Lp,ZodEnum as Np,ZodNullable as $p,ZodNumber as Wp,ZodObject as qp,ZodOptional as jp,ZodRecord as Kp,ZodString as Zp,ZodType as Gp}from"zod";var pt=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","akta","alchemy","algolia","alibaba","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","anyapi","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","apollo","appointo","aryn","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beamer","beeminder","benchmarkemail","benzinga","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bigpictureio","bitbucket","bitwarden","blackbaud","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","booqable","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","builtwith","browserless","browsertool","bubble","bugsnag","buildkite","bunnycdn","bytedance","byteforms","cal","callpage","calendly","callingly","campaigncleaner","campayn","canny","canva","canvas","capsulecrm","carbone","castingwords","cdrplatform","celigo","certifier","chaser","chatbotkit","chatfai","chatwork","chmeetings","cincopa","circleci","claidai","classmarker","clay","clickhouse","clickmeeting","clickup","clicksend","clientary","clockify","close","cloro","cloudcart","cloudflare","cloudflareapikey","cloudinary","coassemble","codeinterpreter","coda","cody","coinbase","coinmarketcal","collegefootballdata","composio","confluence","connecteam","contactout","contentfulgraphql","contextdev","contextsevenmcp","convex","convoloai","cosmic","countdownapi","crowterminal","currentsapi","cursor","customerio","customgpt","cuttly","dadataru","daffy","databricks","datadog","dataforseo","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","docmosis","docupost","docsumo","docusign","dodopayments","doppler","dovetail","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","emelia","epicgames","everhour","exa","excel","exist","extractaai","facebook","faraday","figma","filevine","filloutforms","firecrawl","fireflies","fixer","flexisign","flutterwave","formbricks","fundable","gemini","giphy","github","gitlab","gladia","gmail","gmicloud","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","hookdeck","htmltoimage","hubspot","huggingface","humanitix","hunterio","imagior","imejisio","imgbb","insightoai","instagram","instantly","intercom","jigsawstack","jira","kaggle","keenable","kibana","kling","leexi","linear","linkedin","litescrape","loyverse","magichour","mailboxlayer","mailcheck","mailchimp","mailtrap","marketstack","merriamwebsterdict","minimax","monday","mrscraper","neon","nextdns","northflank","notion","ocrspace","ocrwebservice","octen","ollama","onedrive","onepassword","openai","openrouter","openweathermap","orbit","oura","outlook","pagerduty","parseur","pdfco","pdfmonkey","pdl","perplexityai","phantombuster","pinecone","plain","ploid","posthog","postman","prisma","pushbullet","razorpay","reddit","reducto","remoet","replicate","removebg","replicate","replyio","resend","retailed","revai","rootly","runpod","salesforce","saperly","sapsuccessfactors","scaleai","scrapegraphai","search1api","securitytrails","semanticscholar","sendgrid","sentry","serpapi","sharepoint","slack","slackbot","snapchat","sourcegraph","spoki","spotify","starton","strava","streamtime","stripe","studiobyai21labs","supabase","supadata","suzanne","surf","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","tikhub","timecamp","timelink","tinypng","tinyfish","tinyurl","tisane","todoist","toggl","tokenmetrics","tpscheck","trello","tripadvisor","turso","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","typesafe","unione","unipile","uniswapapi","updownio","uploadcare","vapi","vaquill","vercel","veriphone","vestaboard","waboxapp","wakatime","webflow","webscrapingai","webvizio","whatsapp","whautomate","whoisfreaks","winstonai","witai","wix","wiza","workday","workiom","worldnewsapi","writer","xero","xquik","youcom","youtube","zendesk","zenserp","zohobigin","zohoinventory","zohomail","zoom","zoominfo"],$i={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",akta:"Akta",alchemy:"Alchemy",algolia:"Algolia",alibaba:"Alibaba Cloud Model Studio",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",anyapi:"AnyAPI",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",apollo:"Apollo",appointo:"Appointo",aryn:"Aryn",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beamer:"Beamer",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",benzinga:"Benzinga",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bigpictureio:"BigPicture.io",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blackbaud:"Blackbaud",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",booqable:"Booqable",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",builtwith:"BuiltWith",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",bunnycdn:"Bunnycdn",bytedance:"ByteDance",byteforms:"ByteForms",cal:"Cal",callpage:"CallPage",calendly:"Calendly",callingly:"Callingly",campaigncleaner:"Campaign Cleaner",campayn:"Campayn",canny:"Canny",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",carbone:"Carbone",castingwords:"CastingWords",cdrplatform:"CDR Platform",celigo:"Celigo",certifier:"Certifier",chaser:"Chaser",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chatwork:"Chatwork",chmeetings:"ChMeetings",cincopa:"Cincopa",circleci:"CircleCI",claidai:"Claid.ai",classmarker:"ClassMarker",clay:"Clay",clickhouse:"Clickhouse",clickmeeting:"ClickMeeting",clickup:"ClickUp",clicksend:"ClickSend",clientary:"Clientary",clockify:"Clockify",close:"Close",cloro:"cloro",cloudcart:"CloudCart",cloudflare:"Cloudflare",cloudflareapikey:"Cloudflare API Key",cloudinary:"Cloudinary",coassemble:"Coassemble",codeinterpreter:"CodeInterpreter",coda:"Coda",cody:"Cody",coinbase:"Coinbase",coinmarketcal:"Coinmarketcal",collegefootballdata:"College Football Data",composio:"Composio",confluence:"Confluence",connecteam:"Connecteam",contactout:"ContactOut",contentfulgraphql:"Contentful GraphQL",contextdev:"Context.dev",contextsevenmcp:"Context7",convex:"Convex",convoloai:"ConvoloAi",cosmic:"Cosmic",countdownapi:"Countdown API",crowterminal:"CrowTerminal",currentsapi:"CurrentsApi",cursor:"Cursor",customerio:"Customer.io",customgpt:"CustomGPT",cuttly:"Cutt.ly",dadataru:"Dadataru",daffy:"Daffy",databricks:"Databricks",datadog:"Datadog",dataforseo:"DataForSEO",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",docmosis:"Docmosis",docupost:"Docupost",docsumo:"Docsumo",docusign:"DocuSign",dodopayments:"Dodo Payments",doppler:"Doppler",dovetail:"Dovetail",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",emelia:"Emelia",epicgames:"Epic Games",everhour:"Everhour",exa:"Exa",excel:"Excel",exist:"Exist",extractaai:"Extracta.ai",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filevine:"Filevine",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",fixer:"Fixer",flexisign:"Flexisign",flutterwave:"Flutterwave",formbricks:"Formbricks",fundable:"Fundable",gemini:"Gemini",giphy:"Giphy",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",gmicloud:"GMI Cloud",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",hookdeck:"Hookdeck",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",humanitix:"Humanitix",hunterio:"Hunter.io",imagior:"Imagior",imejisio:"Imejis.io",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",instantly:"Instantly",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",keenable:"Keenable",kibana:"Kibana",kling:"Kling",leexi:"Leexi",linear:"Linear",linkedin:"LinkedIn",litescrape:"LiteScrape",loyverse:"Loyverse",magichour:"Magic Hour",mailboxlayer:"MailboxLayer",mailcheck:"Mailcheck",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",minimax:"MiniMax",monday:"Monday",mrscraper:"MrScraper",neon:"Neon",nextdns:"NextDNS",northflank:"Northflank",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",octen:"Octen",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",orbit:"Orbit",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfco:"PDF.co",pdfmonkey:"PDFMonkey",pdl:"People Data Labs",perplexityai:"Perplexity AI",phantombuster:"PhantomBuster",pinecone:"Pinecone",plain:"Plain",ploid:"Ploid",posthog:"PostHog",postman:"Postman",prisma:"Prisma",pushbullet:"Pushbullet",razorpay:"Razorpay",reddit:"Reddit",reducto:"Reducto",remoet:"Remoet",removebg:"remove.bg",replicate:"Replicate",replyio:"Reply.io",resend:"Resend",retailed:"Retailed",revai:"RevAI",rootly:"Rootly",runpod:"RunPod",salesforce:"Salesforce",saperly:"Saperly",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",search1api:"Search1API",securitytrails:"SecurityTrails",semanticscholar:"Semantic Scholar",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",slackbot:"Slackbot",snapchat:"Snapchat",sourcegraph:"Sourcegraph",spoki:"Spoki",spotify:"Spotify",starton:"Starton",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",supadata:"Supadata",suzanne:"Suzanne",surf:"Surf",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",tikhub:"TikHub",timecamp:"TimeCamp",timelink:"Timelink",tinypng:"TinyPNG",tinyfish:"TinyFish",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",tokenmetrics:"Token Metrics",tpscheck:"TPSCheck",trello:"Trello",tripadvisor:"Tripadvisor",turso:"Turso",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",typesafe:"TypeSafe",unione:"Unione",unipile:"Unipile",uniswapapi:"Uniswap",updownio:"Updown.io",uploadcare:"Uploadcare",vapi:"Vapi",vaquill:"Vaquill",vercel:"Vercel",veriphone:"Veriphone",vestaboard:"Vestaboard",waboxapp:"Waboxapp",wakatime:"WakaTime",webflow:"Webflow",webscrapingai:"WebScraping.AI",webvizio:"Webvizio",whatsapp:"WhatsApp",whautomate:"Whautomate",whoisfreaks:"Whoisfreaks",winstonai:"Winston AI",witai:"WitAi",wix:"Wix",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",writer:"Writer",xero:"Xero",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zenserp:"Zenserp",zohobigin:"Zoho Bigin",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Ee(e){let n=$i[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var we=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function H(e){return typeof e=="string"&&e.length>0}function qc(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function jc(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"||e==="managed_pricing"}function gt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!H(n.connectUrl)||!H(n.token)||!H(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:H(n.environmentId)?n.environmentId:n.projectId};return H(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function ft(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!H(r.tenantId)||!H(r.plugin)||!qc(r.status)||!jc(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:H(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function yt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!H(n.approvalUrl)||!H(n.token)||!H(n.projectId)||!H(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function ln(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(H(n.access_token))return{access_token:n.access_token,refresh_token:H(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:H(n.scope)?n.scope:void 0};throw new Error(H(n.error)?H(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Kc(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Zc(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;H(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function Gc(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function Wi(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!H(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!H(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",a=Zc(o.fields),s=Kc(o.missingRequiredFields),c=Gc(o.status,o.connected,a,s);t.push({plugin:o.plugin,providerName:H(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function Or(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function qi(e,n,t){if(n===404&&t)return t;let r=Or(e);if(!r)return`Hub API returned HTTP ${n}`;if(!e||typeof e!="object")return r;let o=e,i=[r];if(typeof o.code=="string"&&o.code.length>0&&i.push(`Hub error code: ${o.code}`),typeof o.hint=="string"&&o.hint.length>0&&i.push("",o.hint),Array.isArray(o.fix)){let a=o.fix.filter(s=>typeof s=="string"&&s.trim().length>0);if(a.length>0){i.push("","What to do:");for(let s of a)i.push(`- ${s}`)}}if(o.received!==void 0)try{i.push("",`Hub received: ${JSON.stringify(o.received)}`)}catch{}if(o.details!==void 0)try{i.push("",`Details: ${JSON.stringify(o.details)}`)}catch{}return typeof o.creditsRequired=="number"&&i.push("",`Credits required for this call: ${o.creditsRequired}`),i.join(`
+`)}function ji(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}var Ki="0.1.153";function zc(){return{"x-corsair-sdk-version":Ki}}function mt(e){return e.replace(/\/$/,"")}function Mr(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return Se()}catch{return null}}function Zi(e){let n=Mr(e);return n?{"x-corsair-delivery-url":n}:{}}function Gi(e){let n=e.instanceKey?.trim();return n?{"x-corsair-instance-key":n}:{}}async function zi(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Jc(e,n,t){return qi(e,n,t)}function Ji(e,n,t){let r=ji(e);throw r?new we({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(Jc(e,n,t))}async function I(e){let n=mt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",signal:e.signal,headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...Zi(e.hub),...Gi(e.hub),...zc(),...e.extraHeaders},body:JSON.stringify(e.body)}),r=await zi(t);return t.ok||Ji(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function G(e){let n=mt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...Zi(e.hub),...Gi(e.hub)}}),r=await zi(t);return t.ok||Ji(r,t.status,e.notFoundMessage),e.parseResponse(r)}function ht(e){return e&&typeof e=="object"?e:{}}function Vi(e){let n=ht(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Dr(e,n){return I({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=ht(t);return{chat:r.thread,reply:Vi(r.reply)}}})}async function Hr(e,n){return I({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Vi})}async function Ur(e,n){return G({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=ht(t).threads;return Array.isArray(r)?r:[]}})}async function Br(e,n){return G({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=ht(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as tu}from"crypto";var Vc="corsair:client-bridge";function Fr(e){return new URL(e).origin}function dn(e){let n=JSON.stringify({type:Vc,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Fr(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var Yc=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Lr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Yc.has(n)}catch{return!1}}function Nn(e){return e==="development"?"browser":"server"}function Yi(e){return Nn(e)==="browser"}function Qi(e){return Lr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as nu}from"crypto";var Oe=60*1e3,We=300*1e3;import{createHmac as Qc,randomBytes as Xc,timingSafeEqual as eu}from"crypto";function Ce(){return Xc(16).toString("base64url")}function $n(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Qc("sha256",t).update(e).digest("base64url")}function ue(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let a=$n(o,t);try{if(!eu(Buffer.from(i,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function bt(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),a=$n(i,n);return`${i}.${a}`}function Wn(e,n,t){let r=Math.floor(Date.now()/1e3);return bt(e,n,r+Math.floor(t/1e3))}function qe(e){return decodeURIComponent(e)}function Nr(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function Xi(e){let n=e.trim();return n.length>0?n:null}function pn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function gn(e,n){if(!Xi(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??nu(16).toString("base64url"),iat:t,exp:t+Math.floor(Oe/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=$n(o,n);return`${o}.${i}`}function Me(e,n){return Xi(n)?ue(e,n):null}function ru(e){let n=Fr(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function $r(e){let n=gn(ru(e),e.signingSecret);return pn(e.deliveryUrl,n)}function es(e){if(Nn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=tu(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:$r(r)}}var qn="https://auth.corsair.dev";var Te=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},jn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function Wr(e){let n=(e.apiUrl?.trim()||qn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"",o=t.startsWith("ck_cloud_");if(!t||!r&&!o)throw new jn;return{apiUrl:n,projectApiKey:t,signingSecret:r,instanceKey:e.instanceKey?.trim()||void 0,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel,runtimeProofKey:e.runtimeProofKey?.trim()||void 0}}function kt(e){return Wr(e)}function ou(e){let n=e.projectApiKey.startsWith("ck_cloud_");return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&(n||e.signingSecret.trim().length>0)}function W(e){let n=v(e).hub;if(!n||!ou(n))throw new Te;return n}function ns(e){return e.replace(/\/$/,"")}function wt(e){return e.oauthCallbackUrl?ns(e.oauthCallbackUrl.trim()):`${ns(e.apiUrl)}/oauth/callback`}function fn(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";if(e.startsWith("ck_cloud_"))return"cloud";throw new Error("Hub API key must start with ck_dev_ (development), ck_prod_ (production), or ck_cloud_ (cloud)")}function ts(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let a=[null,void 0,""].includes(i)?null:i;await n({[o]:a})};return r}var qr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function q(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,a=[...Z[n].integration,...i],s=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:b.id,config:qr(b.config),dek:b.dek??null},s},updateIntegration:async b=>{let k=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),s=null}},l=null,u=async()=>{if(l)return l;let b=await c.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await oe(b.dek,r),l},d=async()=>{let b=await c.getIntegration(),k=await u(),P=b.config;return!P||Object.keys(P).length===0?{}:ke(P,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await u(),P;try{P=await d()}catch(O){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,O),P={}}let R={...P};for(let[O,ne]of Object.entries(b))ne===null?delete R[O]:R[O]=ne;let B=$e(R,k);await c.updateIntegration({config:B})};return{get_dek:u,issue_new_dek:async()=>{let b=await c.getIntegration(),k=he(),P={};if(b.dek){let B=await oe(b.dek,r),O=b.config;O&&Object.keys(O).length>0&&(P=Fn(O,B,k))}let R=await be(k,r);return await c.updateIntegration({config:P,dek:R}),l=k,k},...ts(d,g,a)}}function F(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:a=[],ensureProvisioned:s}=e,c=[...Z[n].account,...a],l=null,u=async()=>{if(l)return l;let C=!1;for(;;){let T=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!T){if(!C&&s){C=!0,await s();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return l={id:T.id,config:qr(T.config),dek:T.dek??null},l}},d={kek:o,integrationName:t,tenantId:r,getIntegration:u,getAccount:async()=>{let C=!1;for(;;){let T=await u(),M=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",T.id).executeTakeFirst();if(!M){if(!C&&s){C=!0,await s();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return{id:M.id,config:qr(M.config),dek:M.dek??null}}},updateAccount:async C=>{let T=await d.getAccount();await i.db.updateTable("corsair_accounts").set({...C.config!==void 0?{config:C.config}:{},...C.dek!==void 0?{dek:C.dek}:{},updated_at:new Date}).where("id","=",T.id).execute()}},p=null,g=null,f=null,h=async()=>{let C=await d.getAccount();if(!C.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p&&g===C.dek||(p=await oe(C.dek,o),g=C.dek),p},b=async()=>{if(f)return f;let C=await d.getIntegration();if(!C.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await oe(C.dek,o),f},k=async()=>{let C=await d.getAccount(),T=await h(),M=C.config;return!M||Object.keys(M).length===0?{}:ke(M,T)},P=async()=>{let C=await d.getIntegration(),T=await b(),M=C.config;return!M||Object.keys(M).length===0?{}:ke(M,T)},R=Promise.resolve(),B=C=>{let T=R.then(()=>O(C));return R=T.catch(()=>{}),T},O=async C=>{let T=await d.getAccount();if(!T.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);let M=await oe(T.dek,o),N;try{let D=T.config;N=!D||Object.keys(D).length===0?{}:ke(D,M)}catch(D){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,D),N={}}let te={...N};for(let[D,Ie]of Object.entries(C))Ie===null?delete te[D]:te[D]=Ie;let U=$e(te,M);await d.updateAccount({config:U})},ne={get_dek:h,issue_new_dek:async()=>{let C=await d.getAccount(),T=he(),M={},N=null;if(C.dek){N=await oe(C.dek,o);let U=C.config;U&&Object.keys(U).length>0&&(M=Fn(U,N,T))}let te=await be(T,o);if(N){let U=N;await i.db.transaction().execute(async D=>{await Li(D,C.id,U,T),await D.updateTable("corsair_accounts").set({config:M,dek:te,updated_at:new Date}).where("id","=",C.id).execute()})}else await d.updateAccount({config:M,dek:te});return p=T,g=te,T},...ts(k,B,c)};return n==="oauth_2"&&(ne.get_integration_credentials=async()=>{let C=await P();return{...C,client_id:C.client_id||null,client_secret:C.client_secret||null,redirect_url:C.redirect_url??null}}),ne}async function rs(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=he(),i=await be(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function os(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=he(),s=await be(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",i.id).execute(),a}var iu=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function De(e){return iu.has(e)}function su(e,n){return De(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function au(e){return!De(e)}function cu(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"];case"managed_pricing":return[]}}function uu(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function lu(e,n){let t=i=>n.find(a=>a.level==="account"&&a.name===i);if(!cu(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function is(e,n){if(!e)return!1;let t=re(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function du(e,n){let r=e.authConfig?.[n]?.integration??[];return[...Z[n].integration,...r]}function pu(e,n){let r=e.authConfig?.[n]?.account??[];return[...Z[n].account,...r]}function gu(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return o.length>0?a="missing_integration":r.length===0?a="ready":i.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:lu(n,t),fields:t,missingRequiredFields:r}}async function je(e,n,t){let r=E(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,a=i?.[r]?.integration??[],s=i?.[r]?.account??[],c=q({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),l=F({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:s}),u=du(n,r),d=pu(n,r),p=[];for(let g of u)p.push({name:g,level:"integration",required:su(r,g),configured:await is(c,g)});for(let g of d)p.push({name:g,level:"account",required:au(g),configured:await is(l,g)});if(uu(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return gu(n.id,r,p)}async function Kn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let a of e.plugins){if(o&&!o.has(a.id))continue;let s=await je(e,a,r);s&&i.push(s)}return i}function Ct(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var ss=Symbol.for("corsair:internal"),as=new WeakMap,cs=new WeakMap;function fu(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function yu(e){if(e.database){let t=as.get(e.database);return t||(t=new Map,as.set(e.database,t)),t}let n=cs.get(e);return n||(n=new Map,cs.set(e,n)),n}function mu(e){return e.multiTenancy?{withTenant:()=>({}),[ss]:e}:{[ss]:e}}async function yn(e,n){if(!e.database)return;let t=n.trim()||"default",r=yu(e),o=fu(t,e.plugins),i=r.get(o);if(i){await i;return}let a=(async()=>{let{setupCorsair:s}=await import("./setup-QAHEAJAK.js");await s(mu(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,a),await a}import*as Zn from"crypto";function He(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function jr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function mn(e,n){if(!n)throw new Error("OAuth state signing requires a configured kek. Pass kek to createCorsair().");let t=Zn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var Kr=600*1e3;function Tt(e,n){if(!n)return null;let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Zn.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(o,"base64url"),s=Buffer.from(i,"base64url");return a.length!==s.length||!Zn.timingSafeEqual(a,s)?null:jr(r,{maxAgeMs:Kr})}function us(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function ls(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function hn(e,n){await I({hub:e,path:"/connections/report",body:us(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function hu(e,n){try{let t=W(e);I({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof Te)return}}async function bu(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!E(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await je(n,e.plugin,r);o&&ps(e.hub,ls({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function ds(e,n){hu(e,n)}function ps(e,n){I({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function bn(e){bu(e).catch(()=>{})}async function Pe(e,n){let t=v(e);if(!E(n.plugin))return;let o=await je(t,n.plugin,n.tenantId);o&&ds(e,ls({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function Pt(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var gs=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function ku(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function wu(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await oe(n.dek,e.kek),r=gs(n.config),o={};Object.keys(r).length>0&&(o=ke(r,t)),o[e.link.linkType]=e.link.externalId;let i=$e(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function kn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:a,extraAccountFields:s=[]}=e,{accountId:c}=await ku({database:n,pluginId:r,tenantId:o}),l=!1;if(a){let u=F({authType:a,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:s}),d=`set_${i.linkType}`,p=u[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await wu({database:n,kek:t,accountId:c,link:i})}async function Zr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let c=await oe(s.dek,t),u=gs(s.config)[o];if(!u)continue;if(lt(u,c)===i)return s}catch{continue}return null}async function vt(e){return(await Zr(e))?.tenant_id??null}async function fs(e){return vt({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as ys from"querystring";function Ke(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${ys.stringify(i)}`}async function ms(e,n){try{return await G({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function wn(e,n,t,r){if(!n.subscribe)return;let o=W(e),i=await ms(o,n.id);if(!i)return;let a=await n.subscribe({keys:r},{webhookUrl:i});a&&await Pe(e,{plugin:n,tenantId:t,verified:!0,webhookLink:a.webhookLink,webhookSecret:a.webhookSecret})}var Y=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function hs(e){let n=e.oauthConfig;if(!n)throw new Y("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Cu(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let a=await i.executeTakeFirst();if(!a)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",a.id).executeTakeFirst())return;let c=he(),l=await be(c,r),u=new Date;await o.insertInto("corsair_accounts").values({id:un(),created_at:u,updated_at:u,tenant_id:t,integration_id:a.id,config:{},dek:l}).execute()})}async function Gr(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,a=v(e,()=>new Y("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=V(a,n,p=>new Y("plugin_not_found",p)),c=hs(s),u=await q({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!u)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Ke({oauthConfig:c,clientId:u,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=mn(He(n,r),a.kek);return{url:Ke({oauthConfig:c,clientId:u,redirectUri:o,state:d}),state:d}}function Tu(e,n){return{...n??{},...e}}async function Gn(e,n){let{code:t,state:r,redirectUri:o}=n,i=v(e,()=>new Y("invalid_corsair_instance","Invalid corsair instance")),a,s;if(n.trusted){if(!n.plugin||!n.tenantId)throw new Y("invalid_state","trusted callback requires plugin and tenantId");a=n.plugin,s=n.tenantId}else{let h=Tt(r,i.kek);if(!h)throw new Y("invalid_state","Invalid or tampered state parameter");a=h.plugin,s=h.tenantId}if(!i.database)throw new Y("no_database","No database configured on corsair instance");let c=V(i,a,h=>new Y("plugin_not_found",h)),l=hs(c),u=q({authType:"oauth_2",integrationName:a,kek:i.kek,database:i.database}),d=await u.get_client_id(),p=await u.get_client_secret();if(!d||!p)throw new Y("credentials_not_configured",`Credentials not configured for '${a}'`);await Cu(i.database,a,s,i.kek);let g=await Rt(t,d,p,l,o);if(!g.access_token)throw new Y("no_access_token",`No access_token returned from ${l.providerName}`);let f=F({authType:"oauth_2",integrationName:a,tenantId:s,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await Pe(e,{plugin:c,tenantId:s}).catch(()=>{});try{let h=Tu(g,n.callbackParams),b=await Pt(i.plugins,a,h);if(b){try{let k=c.authConfig?.oauth_2?.account??[];await kn({database:i.database,kek:i.kek,pluginId:a,tenantId:s,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${a}' tenant '${s}':`,k)}i.hub&&hn(i.hub,{plugin:a,tenantId:s,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${a}' tenant '${s}':`,h)}if(c.subscribe)try{await wn(e,c,s,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${a}' tenant '${s}':`,h)}return{plugin:a,tenantId:s}}async function Pu(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??wn,i=[],a=[];if(!t.database)return{renewed:i,failed:a};for(let s of r){let c=t.plugins.find(u=>u.id===s.integrationName);if(!c?.subscribe)continue;let l=`${c.id}/${s.tenantId}`;try{let u=E(c)??"oauth_2",d=F({authType:u,integrationName:c.id,tenantId:s.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[u]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:u,keys:g,hub:t.hub},"endpoint")}await o(n,c,s.tenantId,d),i.push(l)}catch(u){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,u),a.push(l)}}return{renewed:i,failed:a}}async function bs(e){let n=v(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return Pu({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function vu(e,n={}){let t=!1,r=()=>{t||(t=!0,bs(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function ks(e){if(!v(e).database)throw new Error("A database must be configured to provision Corsair integrations");await At(e,{silent:!0})}async function Cn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await yn(t,n)}var Ru=Symbol.for("corsair:internal"),Au=new Set(["access_token","refresh_token","expires_at","scope"]);function xu(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Iu(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!De(t)&&!Au.has(t)):n.filter(t=>!De(t))}function ws(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function Su(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function _u(e){return{[Ru]:ws(e)}}async function xt(e,n,t={}){let r=wt(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,a=ws(e),s=_u(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let l=E(c);if(!l)continue;let u=xu(l),d=t.providerNameOverrides?.[c.id]??Ee(c.id),p=await je(a,c,n),g=ct(c,l),f=Iu(l,g),h={plugin:c.id,providerName:d,authKind:u,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),u==="oauth"){let k=t.oauthModeOverrides?.[c.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let P=await Gr(s,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=P.url}catch(P){P instanceof Error&&/client_id not configured/i.test(P.message)||(h.setupError=P instanceof Error?P.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function wy(e,n,t={}){let r=v(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return xt({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function Cs(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await yn(e.internalConfig??Su(e),n)}async function Ts(e,n){await Cn(e,n)}async function Ps(e,n){let t=fn(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),I({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:gt})}async function vs(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await Cs(t,n.tenantId);let r=await xt(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return Ps(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function It(e,n){let t=v(e),r=W(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Ts(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,a=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,s=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await xt(o,n.tenantId,{pluginIds:i,oauthModeOverrides:a,providerNameOverrides:s});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return Ps(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function St(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(a=>a.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=v(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await Eu(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function Eu(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-SCJPGFQ2.js"),{postHubConnectSession:i}=await import("./connect-NL5EVPMX.js"),a={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(a,t.tenantId);let s=await r(a,t.tenantId,{pluginIds:t.pluginIds});if(s.length===0)throw new Error("No connectable plugins found for this tenant");let c=s.find(l=>l.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:s})}function Tn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var ie=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Ou(e){let n=e.oauthConfig;if(!n)throw new ie("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function zr(e,n){let t=v(e,()=>new ie("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ie("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new ie("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=Tt(n,t.kek);if(!o)throw new ie("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:a}=o,s=V(t,i,p=>new ie("plugin_not_found",p)),c=Ou(s),u=await q({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!u)throw new ie("client_id_not_configured",`client_id not configured for '${i}'`);let d=Ke({oauthConfig:c,clientId:u,redirectUri:r,state:n});return{plugin:i,tenantId:a,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as Du}from"async_hooks";import{randomBytes as Hu}from"crypto";import{v4 as Uu}from"uuid";var le=class extends Error{reason;constructor(n,t="pending"){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError",this.reason=t}};async function _t(e,n){let t=fn(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),I({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:yt})}function Et(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var Jr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Yr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Rs(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Vr(e){return Et(e)}async function Qr(e,n){if(Yr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Rs(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await _t(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:Mu(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch(r){return console.warn(`[corsair/${n.plugin}] could not create an approval link for '${n.endpoint}': ${r instanceof Error?r.message:String(r)}`),null}}function Mu(e){try{return JSON.parse(e)}catch{return e}}async function Ot(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Qr(e,n);return{...n,approvalUrl:r}}async function Xr(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:a,endpoint:s,args:c,tenantId:l,expiresAt:u,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:a,endpoint:s,args:c});let g=await Qr({manual:t,hub:r},{id:o,token:i,plugin:a,endpoint:s,args:JSON.stringify(c),tenant_id:l,expires_at:u});return Yr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Vr(g):Jr:r?g?Vr(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:Jr}var Mt=new Du,As={open:0,cautious:1,strict:2,readonly:3},Pn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function eo(e,n){return e===void 0?n:n===void 0||As[e]>=As[n]?e:n}function Dt(e,n){return Mt.run(eo(Mt.getStore(),e)??e,n)}function vn(){return Mt.getStore()}function no(e){return Dt("readonly",e)}function Ss(){return Mt.getStore()==="readonly"}function Ht(e,n){if(Ss()&&n!=="read")throw new Pn(e,n)}function Ze(e,n){Ht(e,n);let t=vn();if(!(t===void 0||Ut(n,t)==="allow"))throw new le(`Action '${e}' is a '${n}' operation and permission mode '${t}' does not allow it. The entity store cannot wait for approval.`,"policy")}var Bu={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}},xs={allow:0,require_approval:1,deny:2};function _s(e,n){return e===void 0?n:xs[e]>=xs[n]?e:n}function Ut(e,n,t){return t!==void 0?t:Bu[n][e]}function to(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Es(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Is(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Os(e){let n=Ut(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, widen the permission mode in force for this call.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",a).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,h=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${s.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Is(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let c=Uu(),l=Hu(32).toString("hex"),u=e.timeoutMs??600*1e3,d=new Date(Date.now()+u).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:c,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:a,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${c}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Is(e.db,c,u):{result:"blocked",reason:"pending",id:c,token:l,expiresAt:d}}var w=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function S(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function de(e){let n={error:e.code,message:e.message,...e.extra};return S(e.status,n)}function Ue(e){return new w(404,"not_found",e)}function L(e,n={}){return new w(400,"bad_request",e,n)}function ro(e,n){return V(e,n,t=>Ue(t))}async function Ms(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=q({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=Z[t].integration,i=r,a;try{a=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{a=o.map(()=>null)}let s=o.filter((l,u)=>a[u]==null),c;return t==="oauth_2"?c=!s.includes("client_id")&&!s.includes("client_secret"):c=s.length===0,{configured:c,missingFields:s}}async function Ds(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await Ms(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Bt(){return{ok:!0}}async function Rn(e){return Promise.all(e.plugins.map(n=>Ds(n,e)))}async function Ft(e,n){let t=ro(e,n);return Ds(t,e)}async function Fu(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function Hs(e,n){let t=await Fu(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function An(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let a=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function Lt(e,n){if(!n)throw L("Tenant id must be a non-empty string");return Hs(e,n)}async function Nt(e,n){let t=n?.id?.trim();if(!t)throw L("Tenant id is required",{missingFields:["id"]});return Hs(e,t)}async function $t(e,n){let t=n?.trim()||"default",r={},o=await Kn(e,t);for(let i of o)r[i.plugin]=Ct(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function Wt(e,n){let t=n?.plugin;if(typeof t!="string"||!t.trim())throw L("plugin is required",{missingFields:["plugin"]});let r=t.trim();ro(e,r);let o=n?.tenantId;if(o!=null&&typeof o!="string")throw L("tenantId must be a string");let i=o?.trim()||"default";if(!e.database)return{ok:!0,disconnected:!1};let a=e.database.db,s=await a.selectFrom("corsair_integrations").select(["id"]).where("name","=",r).executeTakeFirst();if(!s)return{ok:!0,disconnected:!1};let c=!1;return await a.transaction().execute(async l=>{e.database?.isPg===!0&&await l.selectFrom("corsair_integrations").select("id").where("name","=",r).forUpdate().execute();let u=l.selectFrom("corsair_accounts").select("id").where("tenant_id","=",i).where("integration_id","=",s.id);await l.deleteFrom("corsair_events").where("account_id","in",u).execute(),await l.deleteFrom("corsair_entities").where("account_id","in",u).execute(),c=((await l.deleteFrom("corsair_accounts").where("tenant_id","=",i).where("integration_id","=",s.id).executeTakeFirst()).numDeletedRows??0n)>0n}),{ok:!0,disconnected:c}}async function oo(e,n){if(!e.database)throw Ue(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw Ue(`Permission '${n}' not found`);return Ot(e,t)}function Lu(e){if(!e.oauthConfig)throw L(`Plugin '${e.id}' has no oauthConfig`)}function Nu(e){if(!e.manual)throw new w(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function io(e){let n=Nu(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new w(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function $u(e){let n=!!e.hub,t=Tn(e.manual);if(!n&&!t)throw new w(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function Us(e){if(!e.database||!e.kek)throw new w(500,"database_not_configured","A database and kek are required to issue connect links.")}async function Wu(e,n){let t=n?.plugin?.trim();if(!t)throw L("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=ro(e,t);Lu(o);let i=io(e);Us(e);let a=await Ms(o,e);if(!a.configured)throw new w(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=mn(He(t,r),e.kek),c;try{c=new URL(i.baseUrl)}catch{throw new w(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return c.searchParams.set("state",s),{connectUrl:c.toString(),expiresAt:new Date(Date.now()+Kr).toISOString(),tenantId:r}}async function qu(e,n,t){Us(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let a=t.providerName?.trim();a&&(o.providerName=a);let s=await It(e,o);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt,tenantId:r}}async function qt(e,n,t){return $u(n),n.hub?qu(e,n,t):Wu(n,t)}async function jt(e,n,t){if(n.hub&&!Tn(n.manual))throw new w(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw L("state is required",{missingFields:["state"]});io(n);try{return await zr(e,r)}catch(o){if(o instanceof ie)switch(o.code){case"invalid_state":throw L("Invalid or expired state");case"client_id_not_configured":throw new w(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new w(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function Kt(e,n,t){if(n.hub&&!Tn(n.manual))throw new w(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw L("Missing required fields",{missingFields:i});let a=io(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:o,redirectUri:a.redirectUri,callbackParams:t.callbackParams})}catch(c){if(c instanceof Error&&c.name==="OAuthCallbackError")switch(c.code){case"invalid_state":throw L("Invalid or expired state");case"credentials_not_configured":throw new w(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new w(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function so(e,n){if(!e.database)throw Ue("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw Ue("Permission not found");return Ot(e,t)}async function Bs(e,n){return"id"in n?oo(e,n.id):so(e,n.token)}import{createCipheriv as Yu,createDecipheriv as Am,randomBytes as $s,scryptSync as Qu}from"crypto";import{createHmac as ao,randomUUID as ju,timingSafeEqual as Ls}from"crypto";function co(e){return e.run??null}function uo(e){return e.probe??null}function Ns(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function Zt(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=ao("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":ju()}}}function lo(e){let n=e.signingSecret.trim();if(!n)return!1;let t=Ns(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>We)return!1;let i=ao("sha256",n).update(e.body).digest("hex");try{return Ls(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function xn(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=Ns(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>We)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=ao("sha256",n).update(e.body).digest("hex");try{if(!Ls(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function In(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function Gt(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function zt(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function zn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function po(e){return zn(In(e))}async function go(e){let n=await Yt({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=In(n.body),r=Gt({httpOk:n.ok,status:n.status,body:t}),o=zn(t);if(!r||!o)throw new Error(Vt({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function Jt(e){return zt(In(e))}function Ku(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function Fs(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var Zu="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",Gu="Check the delivery URL configured for this environment.";function zu(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${Zu}`}function Ju(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${Gu}`}function Jn(e,n){let t=Ku(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function Vt(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Jn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return zu(e);if(e.status===404)return Ju(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${Fs(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${Fs(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}var Vu=15e3;async function Yt(e){let{body:n,headers:t}=Zt(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n,signal:AbortSignal.timeout(Vu)}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Jn(e.deliveryUrl,r)}}}var Xu="aes-256-gcm",el=12,nl=16,tl=16,rl=32;function ol(e,n){return Qu(e.trim(),n,rl)}function fo(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=$s(tl),o=ol(t,r),i=$s(el),a=Yu(Xu,o,i,{authTagLength:nl}),s=JSON.stringify(e),c=Buffer.concat([a.update(s,"utf8"),a.final()]),l=a.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),c.toString("base64")].join(":")}var il=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function yo(e){if(e instanceof Oi)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!il.some(t=>n.includes(t))}function sl(e){if(!e)return[];let n=E(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!De(r)):[]}async function Vn(e,n){let t=v(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await At(e,{silent:!0});let[r,o]=await Promise.all([An(t),Rn(t)]),i={tenants:r.map(a=>({id:a.id})),plugins:o.map(a=>{let s=sl(t.plugins.find(c=>c.id===a.id));return{id:a.id,authType:a.authType,configured:a.configured,missingFields:a.missingFields,...s.length>0?{integrationCredentialFields:s}:{}}}),syncedAt:new Date().toISOString()};return fo(i,n)}var pe=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function Qt(e,n){let t=v(e,()=>new pe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new pe("no_database","Database not configured");let r=V(t,n.plugin,u=>new pe("plugin_not_found",u)),o=E(r);if(!o)throw new pe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new pe("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await Cn(e,n.tenantId);let i=new Set(ct(r,o)),s=r.authConfig?.[o]?.account??[],c=F({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new pe("invalid_credentials",`Unknown credential field '${u}' for plugin '${n.plugin}'`);let p=re(c,`set_${u}`);if(!p)throw new pe("invalid_credentials",`Cannot set credential field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new pe("invalid_credentials","Provide at least one credential field to save");return await Pe(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var ge=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function mo(e,n){let t=v(e,()=>new ge("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ge("no_database","Database not configured");let r=V(t,n.plugin,u=>new ge("plugin_not_found",u)),o=E(r);if(!o)throw new ge("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await ks(e);let i=new Set(Ui(r,o)),s=r.authConfig?.[o]?.integration??[],c=q({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new ge("invalid_credentials",`Unknown integration credential field '${u}' for plugin '${n.plugin}'`);let p=re(c,`set_${u}`);if(!p)throw new ge("invalid_credentials",`Cannot set integration field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ge("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var Xt=new Map;function al(e){for(let[n,t]of Xt)t<=e&&Xt.delete(n)}function er(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();al(r);let o=Xt.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(Xt.set(t,r+n),{ok:!0})}var Be=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function Sn(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:a,scope:s,authType:c="managed",providerData:l}=n;if(!o.trim())throw new Be("no_access_token","Managed OAuth delivery missing access_token");let u=v(e,()=>new Be("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new Be("no_database","No database configured on corsair instance");let d=V(u,t,g=>new Be("plugin_not_found",g));await Cn(e,r);let p=F({authType:c,integrationName:t,tenantId:r,kek:u.kek,database:u.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),a&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await p.set_scope(s),await Pe(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await Pt(u.plugins,t,{access_token:o,refresh_token:i,scope:s,...l});if(g){try{let f=d.authConfig?.[c]?.account??[];await kn({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:g,authType:c,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}u.hub&&hn(u.hub,{plugin:t,tenantId:r,link:g,authType:c})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await wn(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function cl(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Ws(e,n,t=[]){for(let[r,o]of Object.entries(e))if(cl(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=Ws(o,n,[...t,r]);if(i)return i}return null}function ul(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function ll(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function qs(e,n,t,r,o){let i=ul(n),a=typeof t=="string"?JSON.parse(t):t;(!a||typeof a=="object"&&Object.keys(a).length===0)&&i["x-goog-resource-uri"]&&(a=ll(i)||a);let c={headers:i,body:a,...r?{query:r}:{}},l=r?.tenantId||"default",u=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:pt;for(let g of p){let f=u[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(c))continue;let h=Ws(f.webhooks,c);if(!h)continue;let b=h.path.join("."),k={payload:a,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let P=await h.webhook.handler(k),R=!!Object.keys(P.returnToSender||{})?.length;return{plugin:g,action:b,body:a,response:R?{...P?.returnToSender,success:!0}:{success:!0},...P.responseHeaders&&{responseHeaders:P.responseHeaders}}}catch(P){return console.error(`Error executing webhook handler for ${g}.${b}:`,P),{plugin:g,action:b,body:a,response:{success:!1,error:P instanceof Error?P.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as dl}from"crypto";import*as Ge from"vm";var js="__corsairFailedStep",pl=3e4,ho=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function Ks(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function Zs(e,n){return`st_${dl("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function nr(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var Gs=new Set(["constructor","prototype","__proto__"]);function ve(e,n){if(e===null)return null;let t=typeof e;return t==="function"?fl(e,n):t==="object"?gl(e):e}function gl(e){return new Proxy(e,{get(n,t){if(!Gs.has(t))return ve(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function fl(e,n){return new Proxy(e,{apply:(t,r,o)=>yl(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!Gs.has(r))return ve(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function yl(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>ve(n,void 0),n=>{throw ve(n,void 0)}):ve(e,void 0)}function ml(e){let n=Object.create(null),t=Ge.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Ge.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),a=Ge.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),c=Ge.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=ve(e.corsair,void 0),n.__payload=o,n.__step=a,n.__console=c;let l=Ge.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let u,d=new Promise((p,g)=>{u=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(u))}async function bo(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(a,s)=>{if(o)throw o;let c=r++,l=Zs(a,c);if(Object.hasOwn(n,l))return ve(n[l].output,void 0);try{let u=await s();return t.push({stepId:l,name:a,seq:c,status:"completed",output:u}),u}catch(u){if(Ks(u))throw u;let d=nr(u);t.push({stepId:l,name:a,seq:c,status:"failed",error:d});let p=new Error(d);throw p[js]=a,p}});i.sleep=async(a,s)=>{if(o)throw o;let c=r++,l=Zs(a,c);if(Object.hasOwn(n,l))return;t.push({stepId:l,name:a,seq:c,status:"completed",output:null});let u=Number.isFinite(s)?Math.max(0,s):0;throw o=new ho(Date.now()+u,a),o};try{await ml({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??pl});let a=o;return a?{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(a){if(Ks(a))return{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()};let s=nr(a),c=a!==null&&typeof a=="object"?a[js]:void 0;return{status:"failed",steps:t,error:{message:s,...c?{failedStep:c}:{}}}}}import*as tr from"vm";var zs=1e4;async function ko(e){let n=Object.create(null),t=tr.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=ve(e.corsair,void 0);let r=bl(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await no(()=>{let a=tr.runInContext(o,t,{filename:"corsair:probe",timeout:r});a.catch(()=>{});let s,c=new Promise((l,u)=>{s=setTimeout(()=>u(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([a,c]).finally(()=>clearTimeout(s))});return{status:"ok",value:hl(i)}}catch(i){return{status:"error",error:nr(i)}}}function hl(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function bl(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?zs:Math.min(e,zs)}function ze(e){return e.deliveryMode==="auth.credentials"}function Yn(e){return e.deliveryMode==="connections.sync"}function rr(e){return e.deliveryMode==="connect.create_link"}function Qn(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function Xn(e){return e.deliveryMode==="oauth.tokens"}function or(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!ze(e)&&!Yn(e)&&!rr(e)&&!Qn(e)&&!Xn(e)}function kl(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function wl(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await Vn(e,n)}}}}}catch(t){return{status:"failed",retryable:yo(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function Cl(e,n){try{let t=await St(e,n);return kl(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function wo(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function Tl(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await vt({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function Pl(e,n,t,r){let o=await Tl(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},a=await qs(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!a.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(a.response&&a.response.success===!1)return{status:"failed",retryable:!1,error:typeof a.response.error=="string"?a.response.error:"Webhook handler failed"};let s=a.response?.returnToSender,c=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(a.response?.data??a.response);return{status:"ok",webhookResponse:{status:a.response?.statusCode??200,body:c,headers:a.responseHeaders}}}async function vl(e,n){return await Gn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function Rl(e,n){return await Sn(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function To(e,n,t){let r=await Co(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function Co(e,n,t){let r=v(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function Al(e,n){try{return await Qt(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function xl(e,n){try{return await mo(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function Js(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function Il(e,n){try{let t=Js(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await bo({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function Sl(e,n){try{let t=Js(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await ko({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function et(e,n,t={}){let r=v(e),o=wo(n.headers,"x-corsair-signature"),i=wo(n.headers,"x-corsair-timestamp"),a=wo(n.headers,"x-corsair-nonce"),s=!1;if(t.signingSecret?.trim()){let l=xn({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!l.ok)return{status:"failed",retryable:!1,error:l.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let u=er(`nonce:${a.trim()}`,We);if(!u.ok)return{status:"failed",retryable:!1,error:u.error};s=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let c;try{c=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(c.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(c.type){case"webhook":return Pl(e,r,c.payload,s);case"oauth.callback":return vl(e,c.payload);case"oauth.tokens":return Rl(e,c.payload);case"permission.approve":return Co(e,c.payload,"approved");case"permission.deny":return Co(e,c.payload,"denied");case"auth.credentials":return Al(e,c.payload);case"integration.credentials":return xl(e,c.payload);case"connect.create_link":return Cl(e,c.payload);case"connections.sync":{let l=t.signingSecret?.trim();return l?wl(e,l):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?Il(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?Sl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(c.type)}`}}}function _l(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var Po=3,El=250;function Ol(e){return e?.name==="AbortError"}async function Ml(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function Dl(e,n,t,r,o){for(let i=1;i<=Po;i++){try{let a=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(a.ok)return await Ml(a)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(a){if(Ol(a))throw a}i<Po&&await Ys(El)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${Po} attempts; the run may be retried`),!1}async function Hl(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:a,body:s,headers:c}=await i.json(),l=await t.process(e,{headers:c,body:s},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:u,body:d}=_l(l);return await Dl(n,t,o,{deliveryId:a,status:u,body:d},r)?"handled":"error"}var Vs=1e3,Ul=5e3,Bl=3e4;function Ys(e){return new Promise(n=>setTimeout(n,e))}var ir=globalThis.__corsairConnectLoops??=new Map;function Fl(e,n={fetch,process:et}){let t;try{t=W(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(ir.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");ir.set(r,o);let i=()=>{ir.get(r)===o&&ir.delete(r)},a=!1,s=null;return(async()=>{let l=Vs,u=!1,d=async p=>{u||(console.warn("[corsair] connect loop error; retrying",p),u=!0),a||await Ys(l),l=Math.min(l*2,Ul)};try{for(;!a;){s=new AbortController;let p=setTimeout(()=>s?.abort(),Bl);try{await Hl(e,t,n,s.signal)==="error"?await d("pull or ack failed"):(u=!1,l=Vs)}catch(g){if(a)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{a=!0,s?.abort(),i()}}}function Qs(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ll(e,n){return n&&!n.has(e.id)?!1:E(e)!==null}async function Xs(e,n,t={}){let r=v(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,a=await Kn(r,o,{pluginIds:t.pluginIds}),s=new Map(a.map(l=>[l.plugin,l])),c=r.plugins.filter(l=>Ll(l,i)).map(l=>{let u=E(l),d=s.get(l.id);return d?{plugin:l.id,providerName:Ee(l.id),authKind:Qs(u),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:Ee(l.id),authKind:Qs(u),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:c}}async function ea(e,n){let t=W(e);return G({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:ft})}function Nl(e){return typeof e=="string"&&e.length>0}function sr(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty managed pricing credentials payload");let n=e;if(!Nl(n.api_key))throw new Error("Hub API returned incomplete managed pricing credentials (expected api_key)");let t={api_key:n.api_key};return n.expires_in!==void 0&&typeof n.expires_in=="number"&&Number.isFinite(n.expires_in)&&n.expires_in>0&&(t.expires_in=n.expires_in),t}var na=1024*1024,ta=3e4;function Je(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:na}function Ve(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:ta}function _n(e){return new w(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function $l(e){return new w(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function ar(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o($l(n)),n)})])}finally{clearTimeout(t)}}async function cr(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:s,value:c}=await ar(()=>t.read(),n.bodyStallTimeoutMs);if(s)break;if(o+=c.byteLength,o>n.maxBodyBytes)throw _n(n.maxBodyBytes);r.push(c)}let i=new Uint8Array(o),a=0;for(let s of r)i.set(s,a),a+=s.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var vo=new Map;function ra(e){let n;try{n=W(e)}catch{return}let t=Mr(n);t&&vo.get(n.projectApiKey)!==t&&(vo.set(n.projectApiKey,t),I({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{vo.delete(n.projectApiKey)}))}var Wl=[".corsair.dev"];function ql(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function jl(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:ql(n)?!0:Wl.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function oa(e){return!e||!jl(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function ia(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function Ro(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function Ao(e,n){let t=W(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=Me(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=er(`browser:${i.jti}`,Oe);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(Yn(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let s=await Vn(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:s}}})}}if(rr(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let s=i.connectLinkPlugins?.filter(Boolean)??[];if(s.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let c=await St(e,{tenantId:i.tenantId,plugins:s});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:c.connectUrl,expiresAt:c.expiresAt}})}}if(ze(i))return i.hubSuccessUrl?i.credentials?(await Qt(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:Ro(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:Ro(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(Qn(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await To(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(Xn(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await Sn(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!or(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await Gn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(s){let c=s instanceof Error?s.message:"Hub delivery failed";return Yn(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:rr(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:ze(i)&&i.hubSuccessUrl?{type:"redirect",url:Ro(i.hubSuccessUrl,{error:c})}:ze(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:{type:"json",status:400,body:{error:c}}}return{type:"redirect",url:i.hubSuccessUrl}}async function xo(e,n){let t=W(e),r=await et(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,a=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:a}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:a}}function Io(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function So(e,n){return n.method==="GET"?Ao(e,n.url):xo(e,{headers:n.headers,body:n.body??""})}async function _o(e,n){try{let t=await So(e,n);return Io(t)}catch(t){if(t instanceof Te)return Response.json({error:t.message},{status:503});throw t}}async function Ye(e,n,t){ra(e);let r=n.method.toUpperCase(),o=oa(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await _o(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await cr(n,{maxBodyBytes:Je(t?.maxBodyBytes),bodyStallTimeoutMs:Ve(t?.bodyStallTimeoutMs)}):void 0});return ia(i,o)}var _=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function En(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function On(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var sa=new WeakMap;function Qe(e,n,t){let r=sa.get(e);r||(r=new Map,sa.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var aa=300;async function Eo(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,a=n?.forceRefresh??!1,s=`managed:${o}:${i}`;return Qe(t,s,async()=>{let[c,l,u]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!c&&!u)throw new _(o,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&c&&l&&Number(l)>d+aa)return{accessToken:c,expiresAt:Number(l),refreshed:!1};if(!u&&c&&!a){let f=l?Number(l):null;if(f===null||f>d+aa)return{accessToken:c,expiresAt:f??d+3600,refreshed:!1}}if(!u)throw new _(o,"managed");let p=await Zl(r,o,i,u),g=await On(t,p,l);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function Kl(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function Zl(e,n,t,r){try{return await I({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:ln})}catch(o){let i=o instanceof Error?o.message:"";throw Kl(i)?new _(n,"managed"):o}}async function ca(e,n){e._refreshAuth=async()=>(await Eo(n,{forceRefresh:!0})).accessToken}import{randomUUID as Jl}from"crypto";import{createHmac as Gl}from"crypto";var zl="x-corsair-runtime-proof";function Oo(e,n){if(!e.runtimeProofKey)return{};let t=Math.floor((n.nowMs??Date.now())/1e3),r=Gl("sha256",e.runtimeProofKey).update([t,n.path,n.plugin,n.tenantId,n.operation].join(`
+`)).digest("base64url");return{[zl]:`t=${t},v1=${r}`}}var Vl="",Yl=60,Ql=1e4,Mo=new WeakMap;function ua(e){let n=mt(e.apiUrl),t=e.instanceKey?.trim()??"";return[encodeURIComponent(n),encodeURIComponent(e.projectApiKey),encodeURIComponent(t)].join(Vl)}function Xl(e,n,t,r){let i=`${ua(e)}:${n}:${t}`;return r?`${i}:${r}`:i}function ed(e,n){return Mo.get(e)?.get(n)}function nd(e,n,t){let r=Mo.get(e);r||(r=new Map,Mo.set(e,r)),r.set(n,t)}function td(e,n){return e.expiresAt===null?!1:e.expiresAt>n+Yl}function ur(e,n){if(!n)throw new _(e,"managed_pricing",`[auth-missing:${e}:managed_pricing]: Hub config is required. Pass hub: { ... } to createCorsair().`)}async function Do(e,n){ur(e.plugin,e.hub);let t=n.operation.trim();if(!t)throw new _(e.plugin,"managed_pricing",`[auth-missing:${e.plugin}:managed_pricing]: Operation id is required for Hub metering.`);let r=n.forceRefresh??!1,o=n.idempotencyKey?.trim()||void 0,i=Xl(e.hub,e.plugin,e.tenantId,t),s=`managed_pricing:${o?`call:${o}`:r?"force":"routine"}:${i}`;return Qe(e.cache,s,async()=>{let c=Math.floor(Date.now()/1e3);if(!r&&!o){let d=ed(e.cache,i);if(d&&td(d,c))return{apiKey:d.apiKey,expiresAt:d.expiresAt,fromCache:!0}}let l=await I({hub:e.hub,path:"/managed-pricing/credentials",body:{plugin:e.plugin,tenantId:e.tenantId,operation:t,...o?{idempotencyKey:o}:{}},extraHeaders:{...Oo(e.hub,{path:"/managed-pricing/credentials",plugin:e.plugin,tenantId:e.tenantId,operation:t}),"x-corsair-metered-operation":t,...o?{"x-corsair-idempotency-key":o}:{}},notFoundMessage:"Managed pricing is not configured for this project",parseResponse:sr,signal:AbortSignal.timeout(Ql)}),u=l.expires_in!==void 0?c+l.expires_in:null;return o||nd(e.cache,i,{apiKey:l.api_key,expiresAt:u}),{apiKey:l.api_key,expiresAt:u,fromCache:!1}})}function lr(){return{}}async function Ho(e,n){ur(n.plugin,e.hub);let t=e.tenantId?.trim();if(!t)throw new _(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: tenantId is required for metered credentials.`);let r=(n.operation??e.meteredOperationId)?.trim();if(!r)throw new _(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: Endpoint operation id missing \u2014 cannot meter usage.`);let o=Jl(),i={plugin:n.plugin,tenantId:t,operation:r,idempotencyKey:o};try{return{apiKey:(await Do({hub:e.hub,plugin:n.plugin,tenantId:t,cache:n.cache},{operation:r,idempotencyKey:o})).apiKey,call:i}}catch(a){throw rd(a)&&await Uo(e.hub,i,a),a}}function rd(e){let n=typeof e=="object"&&e!==null&&"name"in e?e.name:void 0;return n==="TimeoutError"||n==="AbortError"||n==="TypeError"}async function la(e,n){return(await Ho(e,n)).apiKey}function od(e){try{return e instanceof Error?`${e.name}: ${e.message}`:String(e)}catch{return"Unprintable thrown value"}}var id=3e3;function sd(e,n){return Oo(e,{path:"/managed-pricing/usage/outcome",plugin:n.plugin,tenantId:n.tenantId,operation:n.operation})}async function Uo(e,n,t){let r=od(t);try{await I({hub:e,path:"/managed-pricing/usage/outcome",body:{...n,outcome:"failed",error:r.slice(0,300)},extraHeaders:sd(e,n),parseResponse:o=>o,signal:AbortSignal.timeout(id)})}catch{}}function da(e){return{delivery:n=>Ye(e,n),deliveryOptions:n=>Ye(e,n)}}var pa=1200*1e3;function Bo(){return Ce()}function Fo(){return pa}function Lo(e,n){return Wn(e,n,pa)}function No(e,n){return ue(e,n)}function $o(e){return qe(e)}var ga=600*1e3;function Wo(){return Ce()}function qo(){return ga}function jo(e,n){return Wn(e,n,ga)}function Ko(e,n){return ue(e,n)}function Zo(e){return Nr(e)}function Go(e){return qe(e)}function zo(){return Ce()}function Jo(e,n,t){return bt(e,n,Math.floor(t.getTime()/1e3))}function Vo(e,n){return ue(e,n)}function Yo(e){return qe(e)}var Xe=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${ut}`),this.name="CorsairKekMissingError"}};function dr(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new Xe;let a=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${ut}`)}})}async function ad(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function fa(e){let{integrationId:n,accountId:t}=await ad(e);return{integrationId:n,accountId:t}}function ya(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>Dr(t(),{tenantId:n,message:r}),list:()=>Ur(t(),{tenantId:n}),get:r=>({message:o=>Hr(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>Br(t(),{chatId:r,tenantId:n})})}}function ma(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function cd(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await vs(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):ma(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function ud(e,n,t){let r=mn(He(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):ma(e,i),connectUrl:i}}async function ld(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.error.authType==="managed_pricing"?{message:e.error.message,connectUrl:null}:e.manual&&Tn(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?ud(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?cd({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function ha(e){let{message:n,connectUrl:t}=await ld(e);throw new _(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var pr="connect.request",Xo="connect.cleared",dd=600*1e3;async function Qo(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function pd(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function gd(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[pr,Xo]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function ba(e,n,t,r,o,i,a){if(a&&!i)throw new Error("encryptDataAtRest requires kek");let s=await gd(e,n,o),c=new Date(s),l=i?dt(r,await Ln(e.db,n,i)):r;await e.db.insertInto("corsair_events").values({id:un(),created_at:c,updated_at:c,account_id:n,event_type:t,payload:l}).execute()}async function fd(e,n,t=Date.now()){let r=await Qo(e,n.tenantId,n.plugin);r&&await ba(e,r,pr,{plugin:n.plugin,connectUrl:n.connectUrl},t,n.kek,n.encryptDataAtRest)}function yd(e){let n=e;if(typeof e=="string")try{n=JSON.parse(e)}catch{return null}return!n||typeof n!="object"||Array.isArray(n)?null:n}async function md(e,n,t,r,o,i){let a=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[pr,Xo]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!a||a.event_type!==pr)return null;let s=a.created_at instanceof Date?a.created_at.getTime():Date.parse(String(a.created_at));if(r-s>o)return null;let c=a.payload;if(typeof c=="string")try{c=JSON.parse(c)}catch{return null}if(Bi(c)){if(!i)return null;try{c=Fi(c,await Ln(e.db,n,i))}catch{return null}}let l=yd(c);if(!l)return null;let u=l.plugin,d=l.connectUrl;return typeof u!="string"||typeof d!="string"?null:{plugin:u,connectUrl:d,requestedAt:new Date(s).toISOString(),tenantId:t,requestedAtMs:s,accountId:n}}async function ei(e,n,t=Date.now(),r=dd,o){let i=await pd(e,n);if(i.length===0)return null;let a=(await Promise.all(i.map(u=>md(e,u,n,t,r,o)))).filter(u=>u!==null);if(a.length===0)return null;a.sort((u,d)=>u.requestedAtMs-d.requestedAtMs||u.accountId.localeCompare(d.accountId));let{requestedAtMs:s,accountId:c,...l}=a[0];return l}async function ka(e,n,t=Date.now(),r,o,i){let a;if(r)a=await Qo(e,n,r);else{let s=await ei(e,n,t,void 0,o);a=s?await Qo(e,n,s.plugin):null}a&&await ba(e,a,Xo,{},t,o,i)}async function ni(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await fd(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl,encryptDataAtRest:n.encryptDataAtRest,kek:n.kek})}catch{}}var hd=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function wa(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[a||"DEFAULT"]?.handler||hd)(e,i)}var Ca=new Map;function bd(e){let n=Ca.get(e);return n||(n=lr(),Ca.set(e,n)),n}function kd(e){return typeof e=="function"}function ti({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:a=[],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:P,encryptDataAtRest:R}){for(let[B,O]of Object.entries(e)){let ne=n?.[B];if(kd(O)){let C=ne,T=[...a,B].join("."),M=async(N={})=>{let te=l?.[T];Ht(T,te?.riskLevel??"write");let U,D=vn(),Ie=c?.mode,Hn=eo(D,Ie);if(Hn){let A=te,K=A?.riskLevel??"write",me=c?.overrides?.[T],Ne=D!==void 0&&D!==Ie&&Hn===D?_s(me,Ut(K,D)):me,{result:an,reason:$,onComplete:Un,token:at,id:Ai,expiresAt:$c}=await Os({pluginId:o,endpointPath:T,args:N,mode:Hn,override:Ne,riskLevel:K,meta:A,db:u,timeoutMs:d?to(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(an==="blocked"){let cn;$==="denied"?cn=`Action '${T}' was denied by the user. Await further instructions before proceeding.`:$==="policy"?cn=D?`Action '${T}' is blocked by permission mode '${D}'.`:`Action '${T}' is blocked by the permission policy. Update the corsair config to allow it.`:$==="timeout"?cn=`Action '${T}' timed out waiting for approval.`:at&&Ai?cn=await Xr({permissionsOptions:d,manual:g,hub:f,permissionId:Ai,permissionToken:at,plugin:o,endpoint:T,args:N,tenantId:p??"default",expiresAt:$c??new Date(Date.now()+(d?to(d.timeout):600*1e3)).toISOString(),operationPath:T}):cn=`Action '${T}' requires user approval before it can run.`;let Wc=$==="denied"||$==="policy"||$==="timeout"?$:"pending";throw new le(cn,Wc)}U=Un}let Rr=async(A,K,me)=>{try{return await O(K,me)}catch(st){if(st instanceof Error){let Ne=await wa(st,o,T,typeof me=="object"&&me!==null?me:{args:me},i);if(A<(Ne.maxRetries||0)){let an=A+1;console.log(`Retrying (${an} / ${Ne.maxRetries})...`);let $;if(Ne.headersRetryAfterMs)$=Ne.headersRetryAfterMs;else switch(Ne.retryStrategy){case"exponential_backoff":$=Math.pow(2,an-1)*1e3;break;case"exponential_backoff_jitter":let Un=Math.pow(2,an-1)*1e3,at=(Math.random()-.5)*1e3;$=Math.max(0,Un+at);break;case"linear_1s":$=1e3;break;case"linear_2s":$=2e3;break;case"linear_3s":$=3e3;break;case"linear_4s":$=4e3;break;default:$=1e3;break}return await new Promise(Un=>setTimeout(Un,$)),await Rr(an,K,me)}}throw st}},it,Ar,xr=async A=>{Ar&&f&&await Uo(f,Ar,A)},Fc={...t,meteredOperationId:T},Lc=typeof t.tenantId=="string"?t.tenantId:void 0,Nc=h?E(h):void 0;try{if(Nc==="managed_pricing"&&f){let A=await Ho({hub:f,tenantId:Lc??p,meteredOperationId:T},{plugin:o,cache:bd(o),operation:T});it=A.apiKey,Ar=A.call}else s&&(it=await s(Fc,"endpoint"))}catch(A){if(A instanceof we)throw h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await ni(u,{tenantId:A.tenantId??p,plugin:A.plugin,connectUrl:A.connectUrl,encryptDataAtRest:R,kek:R?b:void 0}),A;if(A instanceof _){h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1});try{await ha({error:A,manual:g,hub:f,plugin:h,tenantId:p,database:u,kek:b,plugins:k,multiTenancy:P})}catch(K){throw K instanceof _&&await ni(u,{tenantId:K.tenantId??p,plugin:K.pluginId,connectUrl:K.connectUrl,encryptDataAtRest:R,kek:R?b:void 0}),K}}throw A}if(!C?.before&&!C?.after){let A;try{A=await Rr(0,{...t,key:it},N),await U?.()}catch(K){throw await xr(K),K}return h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),A}let Ri={...t,key:it},Ir;try{let A=C.before?await C.before(Ri,N):{ctx:Ri,args:N,continue:!0,passToAfter:void 0};if(A.continue===!1){await xr(new Error("Stopped by a before hook"));return}Ir=await Rr(0,A.ctx,A.args),await C.after?.(A.ctx,Ir,A.passToAfter),await U?.()}catch(A){throw await xr(A),A}return h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),Ir};r[B]=M}else if(O&&typeof O=="object"){let C={};ti({endpoints:O,hooks:ne,ctx:t,tree:C,pluginId:o,errorHandlers:i,currentPath:[...a,B],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:P,encryptDataAtRest:R}),r[B]=C}}}var fe={findByEntityId:"read",existsByEntityId:"read",findIdByEntityId:"read",findById:"read",findManyByEntityIds:"read",list:"read",search:"read",count:"read",upsertByEntityId:"write",deleteById:"destructive",deleteByEntityId:"destructive"},wd=/^\$+date$/;function Ta(e){if(typeof e!="object"||e===null||Array.isArray(e))return null;let n=Object.keys(e),t=n[0];return n.length!==1||!t||!wd.test(t)?null:typeof e[t]=="string"?t:null}function en(e){if(e instanceof Date)return{$date:e.toISOString()};if(Array.isArray(e))return e.map(en);let n=Ta(e);return n?{[`$${n}`]:e[n]}:e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,en(r)])):e}function nn(e){let n=Ta(e);if(n){let t=e[n];if(n!=="$date")return{[n.slice(1)]:t};let r=new Date(t);if(Number.isNaN(r.getTime()))throw L(`Invalid $date value "${t}" \u2014 expected an ISO 8601 timestamp`);return r}return Array.isArray(e)?e.map(nn):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,nn(r)])):e}async function ri(e,n,t){let r=Object.hasOwn(fe,n.method)?fe[n.method]:void 0;if(!r)throw new w(404,"unknown_db_method",`Unknown db method "${n.method}" \u2014 expected one of ${Object.keys(fe).join(", ")}`);Ze(`${n.plugin}.db.${n.entityType}.${n.method}`,r);let i=e?.[n.plugin]?.db;if(!i)throw new w(404,"unknown_plugin",`Plugin "${n.plugin}" has no entity store`);let a=Object.hasOwn(i,n.entityType)?i[n.entityType]:void 0,s=a?.[n.method];if(typeof s!="function")throw new w(404,"unknown_entity_type",`Plugin "${n.plugin}" has no entity type "${n.entityType}"`);return s.apply(a,t)}function Cd(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function oi({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,a]of Object.entries(e)){let s=n?.[i];if(Cd(a)){let c=s,l=async u=>{let d=(g,f)=>a.handler(g,f),p=o&&u?.hubVerified!==!0?await o(t,"webhook"):void 0;return!c?.before&&!c?.after?d({...t,key:p},u):(async()=>{let g={...t,key:p},f=c.before?await c.before(g,u):{ctx:g,args:u,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await c.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:a.match,handler:l}}else if(a&&typeof a=="object"){let c={};oi({webhooks:a,hooks:s,ctx:t,webhooksTree:c,keyBuilder:o}),r[i]=c}}}function Pa(e){return e&&typeof e=="object"?e:{}}async function va(e,n){return G({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Pa(t).workflows;return Array.isArray(r)?r:[]}})}async function Ra(e,n){return G({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>Pa(t).workflow})}async function Aa(e,n){await I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function xa(e,n){await I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Ia(e,n){return I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function ii(e){return e&&typeof e=="object"?e:{}}async function Sa(e,n){return G({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=ii(t).runs;return Array.isArray(r)?r:[]}})}async function _a(e,n){return G({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=ii(t).runs;return Array.isArray(r)?r:[]}})}async function Ea(e,n){return G({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>ii(t).run})}async function si(e,n,t){await I({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var Oa=(e,n)=>si(e,"approve",n),Ma=(e,n)=>si(e,"deny",n),Da=(e,n)=>si(e,"cancel",n);function Ha(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?_a(t(),{workflowId:r.workflowId,tenantId:n}):Sa(t(),{tenantId:n}),get:r=>Ea(t(),{runId:r,tenantId:n}),approve:r=>Oa(t(),{runId:r,tenantId:n}),deny:r=>Ma(t(),{runId:r,tenantId:n}),cancel:r=>Da(t(),{runId:r,tenantId:n})}}function Ua(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>Aa(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>va(t(),{tenantId:n}),get:o=>Ra(t(),{workflowId:o,tenantId:n}),run:(o,i)=>Ia(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:Ha(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>xa(t(),{workflowId:o,tenantId:n,name:i})}}function Td(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await fa({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function Pd(e,n){let t={};for(let[r,o]of Object.entries(n))t[r]=new Proxy(o,{get(i,a){let s=i[a];if(typeof a!="string"||typeof s!="function")return s;let c=Object.hasOwn(fe,a)?fe[a]:void 0;if(!c)return s;let l=s;return async(...u)=>(Ze(`${e}.db.${r}.${a}`,c),l.apply(i,u))}});return t}function vd(e,n,t,r,o){return e?Sr(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function ai(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:a,manualConfig:s,hubConfig:c,internalConfig:l}=n,u=r??"default",d=l&&t?()=>yn(l,u):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=Td(t,f.id,u,d);if(h?.entities){let U={};for(let[D,Ie]of Object.entries(h.entities)){let Hn=t?Sr(t.db,b,D,h.version,Ie,l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o??""}:void 0):vd(void 0,b,D,h.version,Ie);U[D]=Hn}g[f.id].db=U,p[f.id].db=Pd(f.id,U)}let k=f.options,P=f.authConfig,R;if(t&&o&&k?.authType){let U=P?.[k.authType]?.account??[];R=F({authType:k.authType,integrationName:f.id,tenantId:u,kek:o,database:t,extraAccountFields:U,ensureProvisioned:d}),p[f.id].keys=R}let B={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...R?{keys:R,authType:k?.authType}:{},tenantId:u,...l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o}:{},...c?{hub:c}:{}},O=f.endpoints??{},ne=f.hooks,C={...i,...f.errorHandlers},T={},M=f.options?.permissions;ti({endpoints:O,hooks:ne,ctx:B,tree:T,pluginId:f.id,errorHandlers:C,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:M,endpointMeta:f.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:f.oauthConfig,kek:o,tenantId:u}:void 0,hubConfig:c,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy,encryptDataAtRest:l?.encryptDataAtRest===!0}),Object.keys(T).length>0&&(p[f.id].api=T),B.endpoints=T;let N=f.webhooks??{},te=f.webhookHooks;if(Object.keys(N).length>0&&!Hi(k?.authType)){let U={};oi({webhooks:N,hooks:te,ctx:B,webhooksTree:U,keyBuilder:f.keyBuilder}),p[f.id].webhooks=U,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=ya(c,u),p.workflows=Ua(c,u),p}function Ba(e,n,t){let r={};for(let o of e){let i=o.options,a=o.authConfig;if(i?.authType){let s=a?.[i.authType]?.integration??[],c=q({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:s});r[o.id]=c}}return r}var Rd=3e4;function gr(e){let n=e.length;for(;n>0&&e[n-1]==="/";)n--;return e.slice(0,n)}function Ad(e){let n=0;for(;n<e.length&&e[n]==="/";)n++;return e.slice(n)}function xd(e,n){return`${gr(e)}/${Ad(n)}`}function Id(e,n){let t=n??{},{error:r,message:o,...i}=t;return typeof r!="string"?new w(e,"internal_error","Internal error"):new w(e,r,o,i)}var ci=Symbol("cloudRequestTimeout");async function z(e,n,t,r){let o=vn(),i=e.fetch??globalThis.fetch,a=e.timeoutMs??Rd,s=new AbortController,c,l=new Promise(g=>{c=setTimeout(()=>{s.abort(),g(ci)},a)}),u;try{let g=i(xd(e.baseUrl,t),{method:n,headers:{authorization:`Bearer ${e.apiKey}`,"content-type":"application/json",...o?{"x-corsair-mode":o}:{}},body:r===void 0?void 0:JSON.stringify(r),signal:s.signal}).catch(h=>{if(s.signal.aborted)return ci;throw h}),f=await Promise.race([g,l]);if(f===ci)throw new w(0,"internal_error","Cloud request timed out");u=f}finally{clearTimeout(c)}let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw Id(u.status,p);if(p===void 0)throw new w(u.status,"internal_error","Invalid or empty response body from runtime");return p}var J={invoke:"/:tenant/:plugin/call/:op",entityDb:"/:tenant/:plugin/db/:entity/:method",instances:"/instances",connectLinks:"/connect/links",tenants:"/tenants",tenant:"/tenants/:id",connectionStatus:"/connection-status",disconnect:"/disconnect",permission:"/permissions/:id",permissionLookup:"/permissions/lookup-by-token"};var Sd=new Set(["keys","webhooks"]),_d=new Set(["chats","workflows"]),ui=new Set(["then","catch","finally"]);function ye(e){return typeof e=="function"?e():Promise.resolve(e)}function Fa(e,n,t,r){let o=async(...i)=>{let a=await ye(e);return(await z(a,"POST",J.invoke.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":op",r.map(encodeURIComponent).join(".")),{args:i[0]})).data};return new Proxy(o,{get(i,a){if(!(typeof a!="string"||ui.has(a)))return Fa(e,n,t,[...r,a])}})}function Ed(e,n,t){return new Proxy({},{get(r,o){if(!(typeof o!="string"||ui.has(o)))return new Proxy({},{get(i,a){if(typeof a!="string")return;let s=Object.hasOwn(fe,a)?fe[a]:void 0;if(s)return async(...c)=>{Ze(`${t}.db.${o}.${a}`,s);let l=await ye(e),u=await z(l,"POST",J.entityDb.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":entity",encodeURIComponent(o)).replace(":method",encodeURIComponent(a)),{args:en(c)});return nn(u.data)}}})}})}function fr(e,n){let t=e?new Set(e.map(r=>r.id)):null;return new Proxy({},{get(r,o){if(!(typeof o!="string"||ui.has(o))){if(_d.has(o))throw new Error(`"${o}" is not available in cloud mode (deferred)`);if(t&&!t.has(o))throw new Error(`Unknown plugin "${o}"`);return new Proxy({},{get(i,a){if(a==="api")return Fa(n.transport,n.tenantId,o,[]);if(a==="db")return Ed(n.transport,n.tenantId,o);if(typeof a=="string"&&Sd.has(a))throw new Error(`"${a}" is not available in cloud mode (deferred)`)}})}}})}function yr(e){return{connect:{createLink:n=>{if(!n.plugin||!n.tenantId)throw new Error('connect.createLink requires both "plugin" and "tenantId" in cloud mode');return ye(e).then(t=>z(t,"POST",J.connectLinks,n))}},tenants:{create:n=>ye(e).then(t=>z(t,"POST",J.tenants,n)),list:()=>ye(e).then(n=>z(n,"GET",J.tenants)),get:n=>ye(e).then(t=>z(t,"GET",J.tenant.replace(":id",encodeURIComponent(n))))},connectionStatus:{get:n=>ye(e).then(t=>z(t,"GET",`${J.connectionStatus}?tenantId=${encodeURIComponent(n.tenantId)}`))},disconnect:n=>ye(e).then(t=>z(t,"POST",J.disconnect,n)),permissions:{get:n=>ye(e).then(t=>"id"in n?z(t,"GET",J.permission.replace(":id",encodeURIComponent(n.id))):z(t,"POST",J.permissionLookup,{token:n.token}))}}}var Re=class extends w{type;retryable;param;docUrl;requestId;constructor(n,t){super(n,t.code,t.message,{...t}),this.name="CloudApiError",this.type=t.type??"api_error",this.retryable=t.retryable??(n===0||n===429||n>=500),this.param=t.param,this.docUrl=t.doc_url,this.requestId=t.request_id}};function nt(e,n,t){let r=t?.get("request-id")?.trim()||void 0,i=(n??{}).error;if(typeof i=="string"){let a=n.message;return new Re(e,{code:i,message:typeof a=="string"?a:void 0,request_id:r})}return i&&typeof i=="object"&&typeof i.code=="string"?new Re(e,{request_id:r,...i}):new Re(e,{code:e===0?"request_failed":"internal_error",message:`Corsair Cloud returned ${e} with no error body`,request_id:r})}var Od=3e4,Md=new Set(["GET","HEAD","PUT","DELETE"]),Dd=/^[a-z][a-z0-9-]{0,31}$/;function tn(e,n){if(!Dd.test(e))throw new Error(`${n}: "${e}" is not a valid instance key. Lowercase letter first, then letters, digits or hyphens, up to 32 characters.`)}function rn(e){let n=new URLSearchParams;for(let[r,o]of Object.entries(e))o!==void 0&&n.set(r,String(o));let t=n.toString();return t?`?${t}`:""}function x(e,n){return`${e}/${encodeURIComponent(n)}`}async function mr(e,n,t,r,o={}){let i=e.fetch??globalThis.fetch,a=new AbortController;o.signal?.aborted&&a.abort();let s=()=>a.abort();o.signal?.addEventListener("abort",s,{once:!0});let c=setTimeout(()=>a.abort(),e.timeoutMs??Od),l={authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"};e.apiVersion&&(l["corsair-version"]=e.apiVersion),o.idempotencyKey&&(l["idempotency-key"]=o.idempotencyKey),o.requestId&&(l["x-corsair-request-id"]=o.requestId);let u;try{u=await i(`${e.baseUrl}${t}`,{method:n,headers:l,body:r===void 0?void 0:JSON.stringify(r),signal:a.signal});let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw nt(u.status,p,u.headers);if(p===void 0&&u.status!==204)throw nt(u.status,void 0,u.headers);return p}catch(d){if(o.signal?.aborted||d instanceof Re)throw d;let p=Md.has(n),g=u?p?!0:void 0:p||!!o.idempotencyKey;throw nt(u?.status??0,{error:{code:"request_failed",message:d instanceof Error?d.message:String(d),retryable:g}},u?.headers)}finally{clearTimeout(c),o.signal?.removeEventListener("abort",s)}}function li(e,n){tn(n,"withInstance");let t=(s,c,l,u)=>mr(e,s,c,l,u),r=(...s)=>[n,...s].join(":"),o=s=>rn({...s,instance:n}),i=s=>`${x("/instances",n)}${s}`,a=s=>`${x("/webhooks",r(s))}/deliveries`;return{instanceKey:n,tenants:{list:(s={},c)=>t("GET",`/tenants${o(s)}`,void 0,c),create:(s,c)=>t("POST","/tenants",{...s,instance:n},c),get:(s,c)=>t("GET",x("/tenants",r(s)),void 0,c),update:(s,c,l)=>t("PATCH",x("/tenants",r(s)),c,l),delete:(s,c)=>t("DELETE",x("/tenants",r(s)),void 0,c)},access:{list:(s={},c)=>t("GET",`/access${o(s)}`,void 0,c),get:(s,c)=>t("GET",x("/access",r(s)),void 0,c),set:(s,c,l)=>t("PUT",x("/access",r(s)),c,l),revoke:(s,c)=>t("DELETE",x("/access",r(s)),void 0,c)},connections:{list:(s={},c)=>t("GET",`/connections${o(s)}`,void 0,c),get:(s,c,l)=>t("GET",x("/connections",r(s,c)),void 0,l),delete:(s,c,l)=>t("DELETE",x("/connections",r(s,c)),void 0,l)},connect:{createSession:(s,c)=>t("POST","/connect/sessions",{...s,instance:n},c)},integrations:{list:(s={},c)=>t("GET",`/integrations${o(s)}`,void 0,c),get:(s,c)=>t("GET",x("/integrations",r(s)),void 0,c),put:(s,c,l)=>t("PUT",x("/integrations",r(s)),c,l),delete:(s,c)=>t("DELETE",x("/integrations",r(s)),void 0,c),operations:(s,c)=>t("GET",`${x("/integrations",r(s))}/operations`,void 0,c),oauthApp:{get:(s,c)=>t("GET",`${x("/integrations",r(s))}/oauth-app`,void 0,c),put:(s,c,l)=>t("PUT",`${x("/integrations",r(s))}/oauth-app`,c,l),delete:(s,c)=>t("DELETE",`${x("/integrations",r(s))}/oauth-app`,void 0,c)}},webhooks:{list:(s={},c)=>t("GET",`/webhooks${o(s)}`,void 0,c),create:(s,c)=>t("POST","/webhooks",{...s,instance:n},c),get:(s,c)=>t("GET",x("/webhooks",r(s)),void 0,c),delete:(s,c)=>t("DELETE",x("/webhooks",r(s)),void 0,c),rotateSecret:(s,c,l)=>t("POST",`${x("/webhooks",r(s))}/rotate-secret`,c,l),deliveries:{list:(s,c={},l)=>t("GET",`${a(s)}${rn(c)}`,void 0,l),get:(s,c,l)=>t("GET",x(a(s),c),void 0,l),retry:(s,c,l)=>t("POST",`${x(a(s),c)}/retry`,void 0,l)}},signingSecret:{get:s=>t("GET",i("/signing-secret"),void 0,s),rotate:s=>t("POST",i("/signing-secret/rotate"),void 0,s)},apply:s=>t("POST",i("/apply"),void 0,s),removeFromRuntime:s=>t("POST",i("/remove"),void 0,s),reconcile:s=>t("POST",i("/reconcile"),void 0,s)}}function di(e){let n=(t,r,o,i)=>mr(e,t,r,o,i);return{project:{get:t=>n("GET","/project",void 0,t)},keys:{get:t=>n("GET","/keys",void 0,t),rotate:t=>n("POST","/keys/rotate",void 0,t)},instances:{list:(t={},r)=>n("GET",`/instances${rn(t)}`,void 0,r),create:(t,r)=>(tn(t.instance_key,"instances.create"),n("POST","/instances",t,r)),get:(t,r)=>(tn(t,"instances.get"),n("GET",x("/instances",t),void 0,r)),update:(t,r,o)=>(tn(t,"instances.update"),n("PATCH",x("/instances",t),r,o)),delete:(t,r)=>(tn(t,"instances.delete"),n("DELETE",x("/instances",t),void 0,r))},integrations:{catalog:(t={},r)=>n("GET",`/integrations/catalog${rn(t)}`,void 0,r)},mcp:{links:{list:(t={},r)=>n("GET",`/mcp/links${rn(t)}`,void 0,r),mint:(t,r)=>n("POST","/mcp/links",t,r),get:(t,r)=>n("GET",x("/mcp/links",t),void 0,r),update:(t,r,o)=>n("PATCH",x("/mcp/links",t),r,o),delete:(t,r)=>n("DELETE",x("/mcp/links",t),void 0,r),rotate:(t,r)=>n("POST",`${x("/mcp/links",t)}/rotate`,void 0,r)},tokens:{mint:(t,r)=>n("POST","/mcp/tokens",t,r)}}}}var La="default",Hd="corsairCloud: the management API needs a ck_cloud_<slug>.<secret> key, or an explicit `managementUrl`.",Ud=new Set(["then","catch","finally","toString","toJSON","valueOf","constructor","inspect",Symbol.toPrimitive,Symbol.toStringTag,Symbol.iterator,Symbol.asyncIterator]);function pi(e={}){return new Proxy(e,{get(n,t,r){if(Reflect.has(n,t))return Reflect.get(n,t,r);if(!Ud.has(t))throw new Error(Hd)}})}function Ae(e){throw new Error(`"${e}" is not available in cloud mode (deferred)`)}function Bd(e){let n=e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim();if(!n)throw new Error("Cloud mode (ck_cloud_ key) requires a base URL \u2014 set hub.baseUrl or CORSAIR_CLOUD_URL.");return Bn(n),n}function Na(e){return!!(e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim())}function Fd(e,n){let t=yr(e);return{ok:()=>Ae("manage.ok"),tenants:t.tenants,plugins:{list:()=>Ae("manage.plugins.list"),get:()=>Ae("manage.plugins.get")},connectionStatus:{get:r=>{let o=r?.tenantId||void 0;if(!o&&n)throw new Error("connectionStatus.get requires a tenantId in multi-tenant mode");return t.connectionStatus.get({tenantId:o??La})}},permissions:t.permissions,connect:{createLink:t.connect.createLink,resolve:()=>Ae("manage.connect.resolve"),oauthCallback:()=>Ae("manage.connect.oauthCallback")},disconnect:t.disconnect}}function Ld(e,n){let t=Fd(e,n.multiTenancy);if(n.multiTenancy)return{withTenant:a=>{if(!a)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return fr(n.plugins,{transport:e,tenantId:a})},get keys(){return Ae("keys")},get permissions(){return Ae("permissions")},manage:t};let r=fr(n.plugins,{transport:e,tenantId:La}),o={manage:t,get keys(){return Ae("keys")},get permissions(){return Ae("permissions")}};return new Proxy(r,{get(a,s,c){return typeof s=="string"&&s in o?Reflect.get(o,s,c):Reflect.get(a,s,c)}})}function $a(e){return Ld({baseUrl:Bd(e.hub),apiKey:e.hub.projectApiKey},{multiTenancy:!!e.multiTenancy,plugins:e.plugins})}function Nd(e){let n=gr(e),t="/api/corsair";return n.endsWith(t)?n.slice(0,-t.length):n}async function $d(e){let n=await z({...e,baseUrl:Nd(e.baseUrl)},"GET",J.instances),t=new Map;for(let r of n.instances)Bn(r.url,`Instance "${r.instanceKey}" URL`),t.set(r.instanceKey,r.url);return t}function Wd(e){let n=e.apiKey?.trim();if(!n)throw new Error("corsairCloud: apiKey is required");let t=xi(n),r=e.url?.trim()||Ii(n);if(!r)throw new Error("corsairCloud: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");Bn(r);let o={baseUrl:r,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs},a=(gr(e.managementUrl?.trim()??"")||void 0)??(t?Si(r,t):null);a&&Bn(a,"Management base URL");let s=a?{baseUrl:a,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs,apiVersion:e.apiVersion}:null,c=null;function l(g){return g&&c===g&&(c=null),c||(c=$d(o).catch(f=>{throw c=null,f})),c}async function u(g){let f=l(),b=(await f).get(g)??(await l(f)).get(g);if(b)return b;let k=[...(await l()).keys()].join(", ");throw new Error(`corsairCloud.withInstance("${g}"): no such instance \u2014 available: ${k||"(none)"}`)}let d=yr(o),p={tenants:d.tenants,permissions:d.permissions};return{manage:s?{...di(s),...p}:pi(p),withInstance:g=>{let f=s?li(s,g):pi(),h=async()=>({...o,baseUrl:await u(g)}),b=yr(h),k={withTenant(P){if(!P)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return fr(void 0,{transport:h,tenantId:P})},connectionStatus:b.connectionStatus,disconnect:b.disconnect,createConnectLink:b.connect.createLink};return s?{...f,...k}:pi(k)}}}var qd="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function Wa(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${qd}`),t):n}var jd=e=>new w(404,"unknown_plugin",`Plugin '${e}' is not registered.`),Kd=(e,n)=>new w(404,"unknown_op",`Operation '${n}' not found on plugin '${e}'.`),hr=(e="/call")=>new w(403,"call_disabled",`The ${e} route is disabled. Construct managementHandler with { unsafeAllowUnauthenticated: true } to enable it \u2014 only when your own backend fronts the handler.`),Zd=e=>new w(401,"not_connected",`Tenant is not connected for plugin '${e}'. Reconnect and retry.`),qa=e=>new w(403,"permission_denied",`The call was blocked (${e}).`,{reason:e}),Gd=()=>new w(403,"approval_required","This action needs human approval before it can run. Approval is not resumable over HTTP in this version.",{reason:"pending"}),zd=(e,n)=>new w(502,"provider_error","The provider returned an error.",{providerStatus:e,body:n});function Jd(e,n){if(e instanceof w)return e;if(e instanceof _)return Zd(e.pluginId||n);if(e instanceof Pn)return qa("readonly");if(e instanceof le)return e.reason==="pending"?Gd():qa(e.reason);if(e instanceof Error&&e.name==="ApiError"){let t=e;return zd(typeof t.status=="number"?t.status:502,t.body)}return console.error("[corsair] unhandled error in call operation",e),new w(500,"internal_error","Internal error")}var Vd=new WeakMap,ja=new WeakMap,Yd=512;function Ka(e,n){let t=e.get(n);return t||(t=new Map,e.set(n,t)),t}function Qd(e,n,t){if(n.size<=Yd)return;let r=ja.get(e);for(let o of n.keys())if(o!==t&&(r?.get(o)??0)===0){n.delete(o);return}}function Xd(e,n,t){if(!n.multiTenancy)return{client:e};let r=typeof t=="string"?t.trim():"";if(!r)throw L("tenant is required for a multi-tenant runtime",{missingFields:["tenant"]});let o=Ka(Vd,e),i=o.get(r);if(i)return o.delete(r),o.set(r,i),{client:i,tenantId:r};let a=e.withTenant(r);return o.set(r,a),Qd(e,o,r),{client:a,tenantId:r}}function ep(e,n){let t=e;for(let r of n.split(".")){if(t==null||typeof t!="object"||!Object.prototype.hasOwnProperty.call(t,r))return null;t=t[r]}return typeof t=="function"?t:null}function Za(e,n=[]){let t=[];for(let[r,o]of Object.entries(e??{}))typeof o=="function"?t.push([...n,r].join(".")):o&&typeof o=="object"&&t.push(...Za(o,[...n,r]));return t}function Ga(e){let n={};for(let t of e.plugins)n[t.id]=Za(t.endpoints??{});return n}async function gi(e,n,t,r){if(!n.plugins.some(s=>s.id===t.plugin))throw jd(t.plugin);let{client:o,tenantId:i}=Xd(e,n,t.tenant),a=i?Ka(ja,e):null;a&&i&&a.set(i,(a.get(i)??0)+1);try{return await r(o)}catch(s){throw Jd(s,t.plugin)}finally{if(a&&i){let s=(a.get(i)??1)-1;s<=0?a.delete(i):a.set(i,s)}}}async function za(e,n,{plugin:t,op:r,tenant:o,args:i}){return gi(e,n,{plugin:t,tenant:o},a=>{let s=a[t],c=ep(s?.api,r);if(!c)throw Kd(t,r);return c(i??{})})}function on(e,n){if(e===void 0)return n;if(e===null)throw new w(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function tt(e){if(e!==void 0)throw new w(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var Ya=[{method:"GET",pattern:"/ok",public:!0,handler:async()=>S(200,Bt())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>(tt(n),S(200,await An(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>(tt(t),S(201,await Nt(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(tt(t),S(200,await Lt(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>S(200,await Rn(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>S(200,await Ft(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>S(200,await $t(e,on(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(tt(t),S(200,await oo(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",public:!0,handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?S(200,await so(e,t)):S(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=on(r,o.tenantId);return S(200,await qt(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",public:!0,handler:async({corsair:e,internal:n,query:t})=>S(200,await jt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",public:!0,handler:async({corsair:e,internal:n,body:t})=>S(200,await Kt(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=on(t,n.tenantId)??"default",o=e.database?await ei(e.database,r,void 0,void 0,e.encryptDataAtRest?e.kek:void 0):null;return S(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=on(t,r?.tenantId)??"default";return e.database&&await ka(e.database,o,void 0,r?.plugin,e.encryptDataAtRest?e.kek:void 0,e.encryptDataAtRest),S(200,{ok:!0})}},{method:"POST",pattern:"/disconnect",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n??{},o=on(t,r.tenantId);return S(200,await Wt(e,{...r,tenantId:o}))}},{method:"GET",pattern:"/call",handler:async({internal:e,allowCall:n})=>{if(!n)throw hr();return S(200,{plugins:Ga(e)})}},{method:"POST",pattern:"/:tenant/:plugin/db/:entityType/:method",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw hr("/db");tt(i);let s=o??{};if(s.args!==void 0&&!Array.isArray(s.args))throw L("args must be an array");let c=on(i,r.tenant),l=nn(s.args??[]),u=await gi(e,n,{plugin:r.plugin,tenant:c},d=>Va(t,()=>ri(d,{plugin:r.plugin,entityType:r.entityType,method:r.method},l)));return S(200,{data:en(u)})}},{method:"POST",pattern:"/:tenant/:plugin/call/:op",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw hr();let s=o??{},c=on(i,r.tenant),l=await Va(t,()=>za(e,n,{plugin:r.plugin,op:r.op,tenant:c,args:s.args}));return S(200,{data:l})}}];(()=>{let e=new Set;for(let n of Ya){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function np(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let a=t[i],s=r[i];if(a.startsWith(":"))o[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return o}function tp(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function rp(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await cr(e,n).catch(o=>{throw o instanceof w?o:new w(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new w(400,"invalid_json","Request body is not valid JSON")}}var op="/api/corsair",Ja=new Set(["open","cautious","strict","readonly"]);function Va(e,n){let t=e.headers.get("x-corsair-mode");if(t===null)return n();if(!Ja.has(t))throw L(`Unknown permission mode "${t}" \u2014 expected one of ${[...Ja].join(", ")}`);return Dt(t,n)}function j(e,n={}){let t=n.basePath??op,r=Je(n.maxBodyBytes),o=Ve(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},a=v(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async s=>{try{let c=s.headers.get("content-length");if(c!==null&&Number(c)>r)throw _n(r);let l=new URL(s.url),u=tp(l.pathname,t),d=s.method.toUpperCase();if(d==="OPTIONS"||u==="/"||u==="")return await Ye(e,s,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return S(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(l.searchParams);for(let g of Ya){if(g.method!==d)continue;let f=np(g.pattern,u);if(!f)continue;if(!g.public&&n.authenticate&&!await n.authenticate(s))return S(401,{error:"unauthorized",message:"invalid or missing credentials"});let h=await rp(s,i),b=n.resolveTenant?await n.resolveTenant(s):void 0;return await g.handler({corsair:e,internal:a,req:s,params:f,query:p,body:h,scopedTenant:b,allowCall:(n.unsafeAllowUnauthenticated??!1)||!!n.authenticate})}throw Ue(`No route for ${d} ${u}`)}catch(c){if(n.onError){let u=await n.onError(c,s);if(u)return u}if(c instanceof w)return de(c);let l=c instanceof Error?c.message:"Internal server error";return S(500,{error:"internal_error",message:l})}}}function ip(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function sp(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function ap(e,n,t){let r=[],o=0,i=e();try{let a=await ar(()=>i.next(),t);for(;a.done!==!0;){let s=sp(a.value);if(o+=s.byteLength,o>n)throw _n(n);r.push(s),a=await ar(()=>i.next(),t)}return Buffer.concat(r)}catch(a){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw a}}var Qa=!1;function cp(){Qa||(Qa=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function up(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=Je(n.maxBodyBytes),o=Ve(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(cp(),i=JSON.stringify(e.body));else{let s=e[Symbol.asyncIterator];if(typeof s!="function")return;let c=await ap(s.bind(e),r,o);c.length>0&&(i=c)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw _n(r);return typeof i=="string"?i:i}function Q(e){e.resume?.()}async function Fe(e,n={}){let t=ip(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,a=new Headers;for(let[l,u]of Object.entries(e.headers))if(u!=null&&!lp.has(l.toLowerCase()))if(Array.isArray(u))for(let d of u)a.append(l,d);else a.set(l,u);let s={method:(e.method??"GET").toUpperCase(),headers:a},c=await up(e,n);return c!==void 0&&(s.body=c,a.has("content-type")||a.set("content-type","application/json")),new Request(i,s)}async function X(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var lp=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function Xa(e,n){let t=j(e,n);return async(r,o,i)=>{try{let a=await t(await Fe(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await X(o,a)}catch(a){if(a instanceof w&&o.headersSent!==!0){await X(o,de(a)),Q(r);return}Q(r),i(a)}}}function dp(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function pp(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=dp(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function ec(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function nc(e,n){let t=j(e,n);return async(r,o)=>{pp(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let a=await t(await Fe(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await X(o.raw,a)}catch(a){if(a instanceof w&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await X(o.raw,de(a)),Q(i);return}throw Q(i),a}}}function tc(e,n){let t=j(e,n);return r=>t(r.req.raw)}function rc(e,n){let t=j(e,n);return{GET:t,POST:t,OPTIONS:t}}function oc(e,n){let t=j(e,n);return async(r,o)=>{try{let i=await t(await Fe(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await X(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),Q(r);return}if(i instanceof w){await X(o,de(i)),Q(r);return}console.error("[corsair] management handler failed:",i),await X(o,S(500,{error:"internal_error"})),Q(r)}}}function br(e,n){let t=j(e,n);return r=>t(r.request)}function ic(e,n){let t=br(e,n);return{GET:t,POST:t,OPTIONS:t}}function sc(e,n){let t=br(e,n);return{loader:t,action:t}}function ac(e,n){let t=br(e,n);return{GET:t,POST:t,OPTIONS:t}}function cc(e,n){let t=br(e,n);return{GET:t,POST:t,OPTIONS:t}}function uc(e,n){let t=j(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await Fe(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await X(r.node.res,i)}catch(i){if(i instanceof w&&r.node.res.headersSent!==!0){await X(r.node.res,de(i)),Q(o);return}throw Q(o),i}}}function lc(e,n){return j(e,n)}function dc(e){let n={[rt]:e};return{ok:Bt,tenants:{list:()=>An(e),create:t=>Nt(e,t),get:t=>Lt(e,t)},plugins:{list:()=>Rn(e),get:t=>Ft(e,t)},connectionStatus:{get:t=>$t(e,t?.tenantId)},permissions:{get:t=>Bs(e,t)},connect:{createLink:t=>qt(n,e,t),resolve:t=>jt(n,e,t),oauthCallback:t=>Kt(n,e,t)},disconnect:t=>Wt(e,t)}}async function pc(e,n,t,r,o="pending",i){if(i==="")throw new Error("encryptDataAtRest requires kek");if(!e)return null;try{let a=un(),s=new Date,c=i?dt(r,await Ln(e.db,n,i)):r;return await e.db.insertInto("corsair_events").values({id:a,created_at:s,updated_at:s,account_id:n,event_type:t,payload:c,status:o}).execute(),a}catch(a){return console.warn("Failed to log event:",a),null}}async function gp(e,n,t,r="pending"){if(e.encryptDataAtRest&&!e.kek)throw new Error("encryptDataAtRest requires kek");try{let o=await e.$getAccountId();return pc(e.database,o,n,t,r,e.encryptDataAtRest?e.kek:void 0)}catch(o){return console.warn("Failed to log event:",o),null}}import*as fc from"https";import*as kr from"querystring";var fp=["expires_in","refresh_token_expires_in"];function gc(e){let n={...e};for(let t of fp){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function yp(e){try{return gc(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=kr.parse(e);return!n.access_token&&!n.error?null:gc({...n})}function Rt(e,n,t,r,o){let i=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,c)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};a||(l.client_id=n,l.client_secret=t);let u=kr.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(u).toString()};a&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=fc.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){c(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=yp(f);h?s(h):c(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>c(new Error(`Request failed: ${g.message}`))),p.write(u),p.end()})}async function yc(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[a,s,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(En({accessToken:a,expiresAt:s,forceRefresh:n?.forceRefresh}))return{accessToken:a,expiresAt:Number(s),refreshed:!1};if(!c)throw new _(o,"oauth_2");let l=await I({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:c},parseResponse:ln}),u=await On(t,l,s);return{accessToken:l.access_token,expiresAt:u,refreshed:!0}}async function mc(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:a="form",extraParams:s}=e,c={grant_type:"refresh_token",refresh_token:t,...s},l={Accept:"application/json"};i==="basic"?l.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?l.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(c.client_id=o),c.client_secret=r),a==="json"?l["Content-Type"]="application/json":l["Content-Type"]="application/x-www-form-urlencoded";let u=await fetch(n,{method:"POST",headers:l,body:a==="json"?JSON.stringify(c):new URLSearchParams(c)});if(!u.ok)throw new Error(`OAuth token refresh failed (${u.status}): ${await u.text()}`);let d=JSON.parse(await u.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function hc(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new _(n.plugin,"oauth_2");let l={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},u=g=>Qe(e.keys,r,async()=>(await yc(l,{forceRefresh:g})).accessToken);e._refreshAuth=()=>u(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return En({accessToken:d,expiresAt:p})?d:u(!1)}let o=t.client_secret,i=t.client_id,a=l=>Qe(e.keys,r,async()=>{let[u,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!l&&En({accessToken:u,expiresAt:d}))return u;if(!p)throw new _(n.plugin,"oauth_2");let g=await mc({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await On(e.keys,g,d),g.access_token});e._refreshAuth=()=>a(!0);let[s,c]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return En({accessToken:s,expiresAt:c})?s:a(!1)}var bc="  ";function ae(e){let n=e;return n._def??n.def??{}}function ce(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function se(e){return e.innerType??e.schema??e.out??e.in}function wc(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return se(e)}}function Cc(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Cr(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Mn(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function Tc(e,n){return e.description??n.description}function hp(e){let n=e;for(;n;){let t=ae(n),r=Tc(n,t);if(r)return r;let o=ce(t);if(bi(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=wc(t,o);continue}break}}function bi(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function ee(e){let n=ae(e),t=ce(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Mn(n)[0]??"unknown");case"ZodEnum":return Mn(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=se(n);return r?ee(r):"unknown"}case"ZodNullable":{let r=se(n);return`${r?ee(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=se(n);return r?ee(r):"unknown"}case"ZodArray":{let r=Cc(n);if(!r)return"unknown[]";let o=ae(r),i=ce(o)==="ZodUnion",a=ee(r);return`${i?`(${a})`:a}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Cr(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([a,s])=>{let c=ce(ae(s));return`${c==="ZodOptional"||c==="ZodNullable"?a+"?":a}: ${ee(s)}`}).join(", ")} }`}case"ZodUnion":return Mn(n).map(r=>ee(r)).join(" | ");case"ZodIntersection":return`${ee(n.left)} & ${ee(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=wc(n,t);return r?ee(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function xe(e){let n=ae(e),t=ce(n),r=Tc(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??Mn(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=Mn(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=se(n),i=o?xe(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=se(n),i=o?xe(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=se(n);return o?{...xe(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=Cc(n);return{kind:"array",optional:!1,description:r,items:o?xe(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=Cr(e,n),i={};for(let[a,s]of Object.entries(o))i[a]=xe(s);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=Mn(n);for(let i of o){let a=ae(i);if(ce(a)==="ZodObject")return{...xe(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=se(n);return o?{...xe(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function rv(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),a=e.find(u=>u.id===o);if(!a)return null;let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=Le(a.endpointMeta,s),l=Le(a.endpointSchemas,s);return!c&&!l?null:{input:l?.input?xe(l.input):null,output:l?.output?xe(l.output):null,description:c?.description}}var ki=["equals","contains","startsWith","endsWith","in"],bp=["equals","gt","gte","lt","lte","in"],kp=["equals"],wp=["equals","before","after","between"];function Pc(e){let n=ae(e);switch(ce(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=se(n);return r?Pc(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function wi(e){let n=ae(e),t=ce(n);if(bi(t)){let i=se(n);return i?wi(i):{}}if(t!=="ZodObject")return{};let r=Cr(e,n),o={};for(let[i,a]of Object.entries(r)){let s=Pc(a);s==="string"?o[i]={type:"string",operators:ki}:s==="number"?o[i]={type:"number",operators:bp}:s==="boolean"?o[i]={type:"boolean",operators:kp}:s==="date"&&(o[i]={type:"date",operators:wp})}return o}function vc(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function yi(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&yi(o,i,t)}}function mi(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function hi(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];mi(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&hi(o,i,t)}}function Ci(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!o)return null;let[i,a]=o;if(r.length===0)return mi(a)?[i]:null;if(a!==null&&typeof a=="object"&&!mi(a)){let s=Ci(a,r);if(s!==null)return[i,...s]}return null}function Rc(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let a="    ".repeat(i+2);t.push(`${a}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let a="    ".repeat(i+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var Cp=new Set(pt);function sn(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(s=>s.id===r);if(!i)return Cp.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:sn(e);if(t==="webhooks"){if(!i.webhooks)return[];let s=[];return hi(i.webhooks,[],s),s.map(c=>`${i.id}.webhooks.${c}`)}if(t==="db"){let s=i.schema?.entities;return s?Object.keys(s).map(c=>`${i.id}.db.${c}.search`):[]}if(!i.endpoints)return[];let a=[];return yi(i.endpoints,[],a),a.map(s=>`${i.id}.api.${s}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let a=[];hi(i.webhooks,[],a),o[i.id]=a.map(s=>`${i.id}.webhooks.${s}`)}else if(t==="db")for(let i of e){let a=i.schema?.entities;a&&(o[i.id]=Object.keys(a).map(s=>`${i.id}.db.${s}.search`))}else for(let i of e){if(!i.endpoints)continue;let a=[];yi(i.endpoints,[],a),o[i.id]=a.map(s=>`${i.id}.api.${s}`)}return o}function Le(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function Tp(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),a=i.startsWith(".")?i.slice(1):i;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function fi(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function ov(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),a=e.find(s=>s.id===o);if(a){if(i.startsWith("db.")){let u=i.slice(3),d=u.lastIndexOf(".");if(d!==-1){let p=u.slice(0,d),g=u.slice(d+1),f=a.schema?.entities;if(g==="search"&&f){let h=vc(f,p);if(h){let[b,k]=h,P=wi(k),R=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${ki.join(", ")}]`];for(let[B,O]of Object.entries(P))R.push(`  ${B}?: ${O.type}  [${O.operators.join(", ")}]`);return R.push("}"),R.join(`
+`)}}}return fi(sn(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let u=i.slice(9);if(a.webhooks){let d=Ci(a.webhooks,u.split("."));if(d!==null){let p=d.join("."),g=Le(a.webhookSchemas,p.toLowerCase()),f=g?.response?ee(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${wr(Dn(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${Rc(o,d)}`),h.join(`
+
+`)}}return fi(sn(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=Le(a.endpointMeta,s),l=Le(a.endpointSchemas,s);if(c||l){let u=[],d=[c?.riskLevel?`[${c.riskLevel}]`:"",c?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[c?.description,d].filter(Boolean).join("  ");return p&&u.push(p),l?.input&&u.push(`input ${wr(Dn(l.input))}`),l?.output&&u.push(`output ${wr(Dn(l.output))}`),u.join(`
+
+`)}}}return fi(sn(e),"Path not found. Available operations")}function kc(e){let n=e;for(;;){let t=ae(n),r=ce(t);if(bi(r)){let o=se(t);if(!o)return n;n=o;continue}return n}}function Dn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=kc(e),t=ae(n);if(ce(t)==="ZodObject"){let o=Cr(n,t),i=[];for(let[a,s]of Object.entries(o)){let c=ae(s),l=ce(c),u=l==="ZodOptional"||l==="ZodNullable",d=kc(s),p=hp(s);i.push({key:a,optional:u,type:ee(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:ee(n)}}function wr(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=bc.repeat(n+1),r=bc.repeat(n);return`{
+${e.fields.map(i=>{let a=i.optional?`${i.key}?`:i.key,s=i.description?`  // ${i.description}`:"";return`${t}${a}: ${i.type}${s}`}).join(`
+`)}
+${r}}`}return"unknown"}function Pp(e,n){let t=sn(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(u=>u.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let u of t){let{shortPath:d,lookupKey:p}=Tp(u,n),g=Le(r.endpointMeta,p),f=Le(r.endpointSchemas,p);!g&&!f||o.push({path:u,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Dn(f?.input),output:Dn(f?.output)})}o.sort((u,d)=>u.path.localeCompare(d.path));let i=[],a=sn(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let u of a){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=Ci(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=Le(r.webhookSchemas,b.toLowerCase()),P=k?.response?ee(k.response):void 0;i.push({path:u,description:k?.description,payload:Dn(k?.payload),responseType:P,usageExample:Rc(n,h)})}i.sort((u,d)=>u.path.localeCompare(d.path));let s=[],c=sn(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(c)&&l)for(let u of c){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let P=vc(l,b);if(!P)continue;let[R,B]=P,O=wi(B),ne=Object.entries(O).map(([C,T])=>({field:C,type:T.type,operators:T.operators}));s.push({path:u,entityName:R,filters:[{field:"entity_id",type:"string",operators:ki},...ne]})}return s.sort((u,d)=>u.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:s}}}import{randomUUID as Ac}from"crypto";async function vp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Ac(),o=Ac(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as Rp}from"crypto";var Tr="https://graph.microsoft.com/v1.0",Ti=2e4,Ap=60;async function xp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${Tr}/subscriptions`,{headers:r,signal:AbortSignal.timeout(Ti)});if(c.ok){let{value:l}=await c.json(),u=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(u.map(d=>fetch(`${Tr}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(Ti)}).catch(()=>{})))}}catch{}let o=Rp(),i=new Date(Date.now()+Ap*6e4).toISOString(),a=await fetch(`${Tr}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(Ti),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!a.ok)throw new Error(`MS Graph subscribe failed (${a.status}): ${await a.text()}`);let s=await a.json();return s.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:s.id},webhookSecret:o}):null}function xc(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function Ip(e,n){let t=xc(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function Sp(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function Ic(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function Sc(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function ot(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function _p(e){return ot(e.body)}function _c(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Pr(Array.isArray(r)?r:[r])}function Ec(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let l=Pr(Array.isArray(c)?c:[c]);if(l)return decodeURIComponent(l)}let r=_c({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let l=n[c],u=Array.isArray(l)?l[0]:l;if(!(!u||typeof u!="string"))try{let p=(u.startsWith("http")?new URL(u):new URL(`https://example.invalid${u.startsWith("/")?u:`/${u}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=ot(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Pr([a?.validationToken])??null}function Ep(e){if(Ec(e))return!0;let n=ot(e.body??e.payload);return Ic(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Pr(e){for(let n of e){let t=Sc(n);if(t)return t}}function Op(e){let t=ot(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var rt=Symbol.for("corsair:internal");function Hc(e){if(e.hub?.projectApiKey?.startsWith("ck_cloud_")&&Na(e.hub))return $a(e);let n=e.database?Ei(e.database,{dbTables:e.dbTables}):void 0,t=e.kek??"",r=n&&t?Ba(e.plugins,n,t):dr(!!n,!!t),o=Wa(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?kt(e.hub):void 0,encryptDataAtRest:e.encryptDataAtRest===!0},a=Es(n),s=dc(i);if(e.multiTenancy){let u=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=ai(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[rt]:i})},keys:r,permissions:a,manage:s},{[rt]:i});return Oc(u,i.hub),Dc(u,i.hub),u}let c=ai(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},c,{keys:r,permissions:a,manage:s,[rt]:i});return Oc(l,i.hub),Dc(l,i.hub),l}function Oc(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-MAYYBW4P.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function Mp(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var Mc=globalThis.__corsairTunnels??=new Set,Dp=1e3,Hp=3e4;function Up(e){let n=e.schedule??((a,s)=>void setTimeout(a,s).unref?.()),t=e.minDelayMs??Dp,r=e.maxDelayMs??Hp,o=t,i=()=>{let a=!1,s=()=>{a||(a=!0,n(i,o),o=Math.min(o*2,r))};e.start(s).then(()=>{o=t}).catch(s)};i()}function Dc(e,n){if(!Mp(n))return;let t=n.projectApiKey;if(Mc.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}Mc.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??_r;Up({start:a=>import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:a})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Er}`)}).catch(s=>{throw console.warn(`[corsair] tunnel down: ${s instanceof Error?s.message:String(s)}. Retrying \u2014 run \`corsair setup\` if it doesn't recover.`),s})})}var Bp={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Pi=Bp;async function At(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},a=n?.caller??"script",s=Mi(e);if(!s)throw new Error("setupCorsair: invalid corsair instance");if(!s.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=Jp(e,s.plugins,n),l={...s,database:s.database},u=l.database.db;await Qp(l.database,i);let d=await Xp(u,l,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await tg(e,c,n.credentials,l,o,i);let p=await og(d,c,o,a);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=Hc({plugins:s.plugins,database:u,kek:s.kek,multiTenancy:!0,...s.encryptDataAtRest?{encryptDataAtRest:!0}:{}}).withTenant(c.tenantId);await ig(g,s.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function vi(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...Z[n][t],...r])}function zp(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(s=>s.id===t);if(!o)continue;let i=E(o);if(!i)continue;let a=vi(o,i,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function Jp(e,n,t){let r=Di(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&zp(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function Bc(e,n){return _e(e)?n===0?!0:Object.values(e).every(t=>Bc(t,n-1)):!1}function Vp(e){return Bc(e,4)}var Yp=Ni;function vr(e){if(e instanceof qp){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Gp?vr(r):"unknown";return n}return e instanceof $p?`${vr(e.unwrap())} | null`:e instanceof jp?`${vr(e.unwrap())} | undefined`:e instanceof Np?e.options.join(" | "):e instanceof Zp?"string":e instanceof Wp?"number":e instanceof Fp?"boolean":e instanceof Lp?"date":e instanceof Kp?"jsonb":"unknown"}async function Qp(e,n){let t=await e.db.introspection.getTables(),r=new Set(t.map(i=>i.name)),o=e.tableNames??_i();for(let[i,a]of Object.entries(Yp)){let s=o[i];if(!r.has(s)){let c=s!==i?` (dbTables.${i} \u2192 "${s}")`:"";n(`[corsair:setup] Table "${s}" does not exist${c}. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(vr(a),null,2)}`)}}}async function Xp(e,n,t,r,o){let i=new Date,a=new Map;for(let s of n.plugins){let c=s.id,l=E(s),u=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!u){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),u=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=l?s.authConfig?.[l]?.integration??[]:[],p=l?s.authConfig?.[l]?.account??[]:[],g=l&&u?q({authType:l,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(u&&!u.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!u||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",u.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:u.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&F({authType:l,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}a.set(c,{pluginId:c,authType:l,integration:g,account:f,integrationFields:[...Z[l].integration,...d],accountFields:r?[...Z[l].account,...p]:[]})}return a}function eg(e){if(!_e(e))return;let n=e.keys;return _e(n)?n:void 0}function ng(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function tg(e,n,t,r,o,i){let a=eg(e),s=n.provisionAccounts?ng(e,n.tenantId):void 0;for(let[c,l]of Object.entries(t)){let u=r.plugins.find(k=>k.id===c);if(!u){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=E(u);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=vi(u,d,"integration"),g=vi(u,d,"account"),f=a?.[c],h=s?.[c],b=_e(h)?h.keys:void 0;for(let[k,P]of Object.entries(l))if(P){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let R=re(f,`set_${k}`);if(!R){i(`[corsair:setup] Cannot set integration field '${k}' for '${c}'.`);continue}await R(P),o(`[corsair:setup] Set ${c} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${k}' on a multi-tenant instance`);let R=re(b,`set_${k}`);if(!R){i(`[corsair:setup] Cannot set account field '${k}' for '${c}'.`);continue}await R(P),o(`[corsair:setup] Set ${c} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${c}'.`)}}}var Uc=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function rg(e,n,t,r,o,i,a,s,c){let l=[],u=[];for(let p of o){if(Uc.has(p))continue;let g=re(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(Uc.has(p))continue;let g=re(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}let d=l.length===0&&u.length===0;if(n==="managed_pricing")s(`[corsair:setup] '${e}' (managed_pricing) uses Corsair metered credentials via Hub \u2014 nothing to store in your database. Pass hub: { ... } to createCorsair().`);else if(d)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...u];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of u){let h=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}s(g.join(`
+`))}}return d}async function og(e,n,t,r){let o=new Set;for(let i of e.values())await rg(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function ig(e,n,t,r,o){if(!Vp(Pi)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=Pi,a=new Set(n.map(s=>s.id));for(let[s,c]of Object.entries(i)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let l=_e(e)?e[s]:void 0,u=_e(l)?l.api:void 0;if(u)for(let[d,p]of Object.entries(c))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${d}.${g}...`);try{let h=_e(u)?u[d]:void 0;await re(h,g)?.(f)}catch(h){o(`[corsair:setup] ${s} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{$i as a,Ee as b,we as c,gt as d,ft as e,yt as f,ln as g,Wi as h,Or as i,Lr as j,Nn as k,Yi as l,Qi as m,Oe as n,We as o,Ce as p,pn as q,gn as r,Me as s,$r as t,es as u,qn as v,Te as w,jn as x,Wr as y,kt as z,W as A,wt as B,fn as C,q as D,F as E,rs as F,os as G,At as H,tg as I,He as J,jr as K,hn as L,kn as M,Zr as N,vt as O,fs as P,Ke as Q,Y as R,Gr as S,Gn as T,bs as U,vu as V,xt as W,wy as X,Cs as Y,Ts as Z,Ps as _,vs as $,It as aa,zr as ba,le as ca,_t as da,Et as ea,Pn as fa,Dt as ga,vn as ha,no as ia,Ss as ja,Ht as ka,Ze as la,w as ma,co as na,uo as oa,Zt as pa,lo as qa,xn as ra,In as sa,Gt as ta,zt as ua,zn as va,po as wa,go as xa,Jt as ya,Jn as za,Vt as Aa,Yt as Ba,Be as Ca,Sn as Da,qs as Ea,bo as Fa,ko as Ga,ze as Ha,Qn as Ia,Xn as Ja,or as Ka,To as La,et as Ma,_l as Na,Hl as Oa,Fl as Pa,Xs as Qa,ea as Ra,sr as Sa,na as Ta,ta as Ua,Je as Va,Ve as Wa,Ao as Xa,xo as Ya,Io as Za,So as _a,_o as $a,Ye as ab,_ as bb,Eo as cb,ca as db,ur as eb,Do as fb,lr as gb,la as hb,da as ib,Bo as jb,Fo as kb,Lo as lb,No as mb,$o as nb,Wo as ob,qo as pb,jo as qb,Ko as rb,Zo as sb,Go as tb,zo as ub,Jo as vb,Vo as wb,Yo as xb,Xe as yb,fe as zb,en as Ab,nn as Bb,ri as Cb,Re as Db,Wd as Eb,j as Fb,Xa as Gb,ec as Hb,nc as Ib,tc as Jb,rc as Kb,oc as Lb,ic as Mb,sc as Nb,ac as Ob,cc as Pb,uc as Qb,lc as Rb,pc as Sb,gp as Tb,Rt as Ub,hc as Vb,rv as Wb,sn as Xb,ov as Yb,wr as Zb,Pp as _b,vp as $b,Tr as ac,xp as bc,xc as cc,Ip as dc,Sp as ec,Ic as fc,Sc as gc,ot as hc,_p as ic,_c as jc,Ec as kc,Ep as lc,Pr as mc,Op as nc,rt as oc,Hc as pc,Mp as qc,Up as rc};