corsair 0.1.153 → 0.1.154

package/dist/chunk-SL7WQR3R.js

@@ -0,0 +1,68 @@
+import{a as Se,b as Er,c as Mr}from"./chunk-6IURNA4L.js";import{a as Si,b as _i,c as Ei,d as Fn}from"./chunk-XCTHEKDP.js";import{A as un,B as _r,C as Wi,a as Di,b as _e,c as Hi,d as R,e as V,f as Ui,g as re,h as Z,i as E,j as Bi,k as lt,l as Fi,m as dt,n as he,o as be,p as oe,r as pt,s as $e,t as ke,u as Ln,v as Li,w as gt,x as Ni,y as Nn,z as $i}from"./chunk-WUEWJTDA.js";import{b as Mi,c as Oi}from"./chunk-XPXWKPFZ.js";import{ZodBoolean as qp,ZodDate as jp,ZodEnum as Kp,ZodNullable as Zp,ZodNumber as Gp,ZodObject as zp,ZodOptional as Jp,ZodRecord as Vp,ZodString as Yp,ZodType as Qp}from"zod";var ft=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","akta","alchemy","algolia","alibaba","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","anyapi","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","apollo","appointo","aryn","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beamer","beeminder","benchmarkemail","benzinga","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bigpictureio","bitbucket","bitwarden","blackbaud","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","booqable","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","builtwith","browserless","browsertool","bubble","bugsnag","buildkite","bunnycdn","bytedance","byteforms","cal","callpage","calendly","callingly","campaigncleaner","campayn","canny","canva","canvas","capsulecrm","carbone","castingwords","cdrplatform","celigo","certifier","chaser","chatbotkit","chatfai","chatwork","chmeetings","cincopa","circleci","claidai","classmarker","clay","clickhouse","clickmeeting","clickup","clicksend","clientary","clockify","close","cloro","cloudcart","cloudflare","cloudflareapikey","cloudinary","coassemble","codeinterpreter","coda","cody","coinbase","coinmarketcal","collegefootballdata","composio","confluence","connecteam","contactout","contentfulgraphql","contextdev","contextsevenmcp","convex","convoloai","cosmic","countdownapi","crowterminal","currentsapi","cursor","customerio","customgpt","cuttly","dadataru","daffy","databricks","datadog","dataforseo","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","docmosis","docupost","docsumo","docusign","dodopayments","doppler","dovetail","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","emelia","epicgames","everhour","exa","excel","exist","extractaai","facebook","faraday","figma","filevine","filloutforms","firecrawl","fireflies","fixer","flexisign","flutterwave","formbricks","fundable","gemini","giphy","github","gitlab","gladia","gmail","gmicloud","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","hookdeck","htmltoimage","hubspot","huggingface","humanitix","hunterio","imagior","imejisio","imgbb","insightoai","instagram","instantly","intercom","jigsawstack","jira","kaggle","keenable","kibana","kling","leexi","linear","linkedin","litescrape","loyverse","magichour","mailboxlayer","mailcheck","mailchimp","mailtrap","marketstack","merriamwebsterdict","minimax","monday","mrscraper","neon","nextdns","northflank","notion","ocrspace","ocrwebservice","octen","ollama","onedrive","onepassword","openai","openrouter","openweathermap","orbit","oura","outlook","pagerduty","parseur","pdfco","pdfmonkey","pdl","perplexityai","phantombuster","pinecone","plain","ploid","posthog","postman","prisma","pushbullet","razorpay","reddit","reducto","remoet","replicate","removebg","replicate","replyio","resend","retailed","revai","rootly","runpod","salesforce","saperly","sapsuccessfactors","scaleai","scrapegraphai","search1api","securitytrails","semanticscholar","sendgrid","sentry","serpapi","sharepoint","slack","slackbot","snapchat","sourcegraph","spoki","spotify","starton","strava","streamtime","stripe","studiobyai21labs","supabase","supadata","suzanne","surf","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","tikhub","timecamp","timelink","tinypng","tinyfish","tinyurl","tisane","todoist","toggl","tokenmetrics","tpscheck","trello","tripadvisor","turso","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","typesafe","unione","unipile","uniswapapi","updownio","uploadcare","vapi","vaquill","vercel","veriphone","vestaboard","waboxapp","wakatime","webflow","webscrapingai","webvizio","whatsapp","whautomate","whoisfreaks","winstonai","witai","wix","wiza","workday","workiom","worldnewsapi","writer","xero","xquik","youcom","youtube","zendesk","zenserp","zohobigin","zohoinventory","zohomail","zoom","zoominfo"],qi={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",akta:"Akta",alchemy:"Alchemy",algolia:"Algolia",alibaba:"Alibaba Cloud Model Studio",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",anyapi:"AnyAPI",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",apollo:"Apollo",appointo:"Appointo",aryn:"Aryn",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beamer:"Beamer",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",benzinga:"Benzinga",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bigpictureio:"BigPicture.io",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blackbaud:"Blackbaud",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",booqable:"Booqable",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",builtwith:"BuiltWith",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",bunnycdn:"Bunnycdn",bytedance:"ByteDance",byteforms:"ByteForms",cal:"Cal",callpage:"CallPage",calendly:"Calendly",callingly:"Callingly",campaigncleaner:"Campaign Cleaner",campayn:"Campayn",canny:"Canny",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",carbone:"Carbone",castingwords:"CastingWords",cdrplatform:"CDR Platform",celigo:"Celigo",certifier:"Certifier",chaser:"Chaser",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chatwork:"Chatwork",chmeetings:"ChMeetings",cincopa:"Cincopa",circleci:"CircleCI",claidai:"Claid.ai",classmarker:"ClassMarker",clay:"Clay",clickhouse:"Clickhouse",clickmeeting:"ClickMeeting",clickup:"ClickUp",clicksend:"ClickSend",clientary:"Clientary",clockify:"Clockify",close:"Close",cloro:"cloro",cloudcart:"CloudCart",cloudflare:"Cloudflare",cloudflareapikey:"Cloudflare API Key",cloudinary:"Cloudinary",coassemble:"Coassemble",codeinterpreter:"CodeInterpreter",coda:"Coda",cody:"Cody",coinbase:"Coinbase",coinmarketcal:"Coinmarketcal",collegefootballdata:"College Football Data",composio:"Composio",confluence:"Confluence",connecteam:"Connecteam",contactout:"ContactOut",contentfulgraphql:"Contentful GraphQL",contextdev:"Context.dev",contextsevenmcp:"Context7",convex:"Convex",convoloai:"ConvoloAi",cosmic:"Cosmic",countdownapi:"Countdown API",crowterminal:"CrowTerminal",currentsapi:"CurrentsApi",cursor:"Cursor",customerio:"Customer.io",customgpt:"CustomGPT",cuttly:"Cutt.ly",dadataru:"Dadataru",daffy:"Daffy",databricks:"Databricks",datadog:"Datadog",dataforseo:"DataForSEO",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",docmosis:"Docmosis",docupost:"Docupost",docsumo:"Docsumo",docusign:"DocuSign",dodopayments:"Dodo Payments",doppler:"Doppler",dovetail:"Dovetail",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",emelia:"Emelia",epicgames:"Epic Games",everhour:"Everhour",exa:"Exa",excel:"Excel",exist:"Exist",extractaai:"Extracta.ai",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filevine:"Filevine",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",fixer:"Fixer",flexisign:"Flexisign",flutterwave:"Flutterwave",formbricks:"Formbricks",fundable:"Fundable",gemini:"Gemini",giphy:"Giphy",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",gmicloud:"GMI Cloud",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",hookdeck:"Hookdeck",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",humanitix:"Humanitix",hunterio:"Hunter.io",imagior:"Imagior",imejisio:"Imejis.io",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",instantly:"Instantly",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",keenable:"Keenable",kibana:"Kibana",kling:"Kling",leexi:"Leexi",linear:"Linear",linkedin:"LinkedIn",litescrape:"LiteScrape",loyverse:"Loyverse",magichour:"Magic Hour",mailboxlayer:"MailboxLayer",mailcheck:"Mailcheck",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",minimax:"MiniMax",monday:"Monday",mrscraper:"MrScraper",neon:"Neon",nextdns:"NextDNS",northflank:"Northflank",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",octen:"Octen",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",orbit:"Orbit",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfco:"PDF.co",pdfmonkey:"PDFMonkey",pdl:"People Data Labs",perplexityai:"Perplexity AI",phantombuster:"PhantomBuster",pinecone:"Pinecone",plain:"Plain",ploid:"Ploid",posthog:"PostHog",postman:"Postman",prisma:"Prisma",pushbullet:"Pushbullet",razorpay:"Razorpay",reddit:"Reddit",reducto:"Reducto",remoet:"Remoet",removebg:"remove.bg",replicate:"Replicate",replyio:"Reply.io",resend:"Resend",retailed:"Retailed",revai:"RevAI",rootly:"Rootly",runpod:"RunPod",salesforce:"Salesforce",saperly:"Saperly",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",search1api:"Search1API",securitytrails:"SecurityTrails",semanticscholar:"Semantic Scholar",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",slackbot:"Slackbot",snapchat:"Snapchat",sourcegraph:"Sourcegraph",spoki:"Spoki",spotify:"Spotify",starton:"Starton",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",supadata:"Supadata",suzanne:"Suzanne",surf:"Surf",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",tikhub:"TikHub",timecamp:"TimeCamp",timelink:"Timelink",tinypng:"TinyPNG",tinyfish:"TinyFish",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",tokenmetrics:"Token Metrics",tpscheck:"TPSCheck",trello:"Trello",tripadvisor:"Tripadvisor",turso:"Turso",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",typesafe:"TypeSafe",unione:"Unione",unipile:"Unipile",uniswapapi:"Uniswap",updownio:"Updown.io",uploadcare:"Uploadcare",vapi:"Vapi",vaquill:"Vaquill",vercel:"Vercel",veriphone:"Veriphone",vestaboard:"Vestaboard",waboxapp:"Waboxapp",wakatime:"WakaTime",webflow:"Webflow",webscrapingai:"WebScraping.AI",webvizio:"Webvizio",whatsapp:"WhatsApp",whautomate:"Whautomate",whoisfreaks:"Whoisfreaks",winstonai:"Winston AI",witai:"WitAi",wix:"Wix",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",writer:"Writer",xero:"Xero",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zenserp:"Zenserp",zohobigin:"Zoho Bigin",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Ee(e){let n=qi[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var we=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function H(e){return typeof e=="string"&&e.length>0}function Jc(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Vc(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"||e==="managed_pricing"}function yt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!H(n.connectUrl)||!H(n.token)||!H(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:H(n.environmentId)?n.environmentId:n.projectId};return H(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function mt(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!H(r.tenantId)||!H(r.plugin)||!Jc(r.status)||!Vc(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:H(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function ht(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!H(n.approvalUrl)||!H(n.token)||!H(n.projectId)||!H(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function ln(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(H(n.access_token))return{access_token:n.access_token,refresh_token:H(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:H(n.scope)?n.scope:void 0};throw new Error(H(n.error)?H(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Yc(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Qc(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;H(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function Xc(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function ji(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!H(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!H(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",a=Qc(o.fields),s=Yc(o.missingRequiredFields),c=Xc(o.status,o.connected,a,s);t.push({plugin:o.plugin,providerName:H(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function Or(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Ki(e,n,t){if(n===404&&t)return t;let r=Or(e);if(!r)return`Hub API returned HTTP ${n}`;if(!e||typeof e!="object")return r;let o=e,i=[r];if(typeof o.code=="string"&&o.code.length>0&&i.push(`Hub error code: ${o.code}`),typeof o.hint=="string"&&o.hint.length>0&&i.push("",o.hint),Array.isArray(o.fix)){let a=o.fix.filter(s=>typeof s=="string"&&s.trim().length>0);if(a.length>0){i.push("","What to do:");for(let s of a)i.push(`- ${s}`)}}if(o.received!==void 0)try{i.push("",`Hub received: ${JSON.stringify(o.received)}`)}catch{}if(o.details!==void 0)try{i.push("",`Details: ${JSON.stringify(o.details)}`)}catch{}return typeof o.creditsRequired=="number"&&i.push("",`Credits required for this call: ${o.creditsRequired}`),i.join(`
+`)}function Zi(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}var Gi="0.1.154";function eu(){return{"x-corsair-sdk-version":Gi}}function bt(e){return e.replace(/\/$/,"")}function Dr(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return Se()}catch{return null}}function zi(e){let n=Dr(e);return n?{"x-corsair-delivery-url":n}:{}}function Ji(e){let n=e.instanceKey?.trim();return n?{"x-corsair-instance-key":n}:{}}async function Vi(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function nu(e,n,t){return Ki(e,n,t)}function Yi(e,n,t){let r=Zi(e);throw r?new we({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):new Error(nu(e,n,t))}async function I(e){let n=bt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",signal:e.signal,headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...zi(e.hub),...Ji(e.hub),...eu(),...e.extraHeaders},body:JSON.stringify(e.body)}),r=await Vi(t);return t.ok||Yi(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function G(e){let n=bt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...zi(e.hub),...Ji(e.hub)}}),r=await Vi(t);return t.ok||Yi(r,t.status,e.notFoundMessage),e.parseResponse(r)}function kt(e){return e&&typeof e=="object"?e:{}}function Qi(e){let n=kt(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Hr(e,n){return I({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=kt(t);return{chat:r.thread,reply:Qi(r.reply)}}})}async function Ur(e,n){return I({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:Qi})}async function Br(e,n){return G({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=kt(t).threads;return Array.isArray(r)?r:[]}})}async function Fr(e,n){return G({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=kt(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as cu}from"crypto";var tu="corsair:client-bridge";function Lr(e){return new URL(e).origin}function dn(e){let n=JSON.stringify({type:tu,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Lr(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var ru=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Nr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:ru.has(n)}catch{return!1}}function $n(e){return e==="development"?"browser":"server"}function Xi(e){return $n(e)==="browser"}function es(e){return Nr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as au}from"crypto";var Me=60*1e3,We=300*1e3;import{createHmac as ou,randomBytes as iu,timingSafeEqual as su}from"crypto";function Ce(){return iu(16).toString("base64url")}function Wn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return ou("sha256",t).update(e).digest("base64url")}function ue(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let a=Wn(o,t);try{if(!su(Buffer.from(i,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function wt(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),a=Wn(i,n);return`${i}.${a}`}function qn(e,n,t){let r=Math.floor(Date.now()/1e3);return wt(e,n,r+Math.floor(t/1e3))}function qe(e){return decodeURIComponent(e)}function $r(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function ns(e){let n=e.trim();return n.length>0?n:null}function pn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function gn(e,n){if(!ns(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??au(16).toString("base64url"),iat:t,exp:t+Math.floor(Me/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=Wn(o,n);return`${o}.${i}`}function Oe(e,n){return ns(n)?ue(e,n):null}function uu(e){let n=Lr(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function Wr(e){let n=gn(uu(e),e.signingSecret);return pn(e.deliveryUrl,n)}function ts(e){if($n(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=cu(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:Wr(r)}}var jn="https://auth.corsair.dev";var Te=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},Kn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function qr(e){let n=(e.apiUrl?.trim()||jn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"",o=t.startsWith("ck_cloud_");if(!t||!r&&!o)throw new Kn;return{apiUrl:n,projectApiKey:t,signingSecret:r,instanceKey:e.instanceKey?.trim()||void 0,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel,runtimeProofKey:e.runtimeProofKey?.trim()||void 0}}function Ct(e){return qr(e)}function lu(e){let n=e.projectApiKey.startsWith("ck_cloud_");return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&(n||e.signingSecret.trim().length>0)}function q(e){let n=R(e).hub;if(!n||!lu(n))throw new Te;return n}function rs(e){return e.replace(/\/$/,"")}function Tt(e){return e.oauthCallbackUrl?rs(e.oauthCallbackUrl.trim()):`${rs(e.apiUrl)}/oauth/callback`}function fn(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";if(e.startsWith("ck_cloud_"))return"cloud";throw new Error("Hub API key must start with ck_dev_ (development), ck_prod_ (production), or ck_cloud_ (cloud)")}function os(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let a=[null,void 0,""].includes(i)?null:i;await n({[o]:a})};return r}var jr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function j(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,a=[...Z[n].integration,...i],s=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:b.id,config:jr(b.config),dek:b.dek??null},s},updateIntegration:async b=>{let k=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),s=null}},l=null,u=async()=>{if(l)return l;let b=await c.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await oe(b.dek,r),l},d=async()=>{let b=await c.getIntegration(),k=await u(),P=b.config;return!P||Object.keys(P).length===0?{}:ke(P,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await u(),P;try{P=await d()}catch(M){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,M),P={}}let A={...P};for(let[M,ne]of Object.entries(b))ne===null?delete A[M]:A[M]=ne;let B=$e(A,k);await c.updateIntegration({config:B})};return{get_dek:u,issue_new_dek:async()=>{let b=await c.getIntegration(),k=he(),P={};if(b.dek){let B=await oe(b.dek,r),M=b.config;M&&Object.keys(M).length>0&&(P=Ln(M,B,k))}let A=await be(k,r);return await c.updateIntegration({config:P,dek:A}),l=k,k},...os(d,g,a)}}function F(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:a=[],ensureProvisioned:s}=e,c=[...Z[n].account,...a],l=null,u=async()=>{if(l)return l;let C=!1;for(;;){let T=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!T){if(!C&&s){C=!0,await s();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return l={id:T.id,config:jr(T.config),dek:T.dek??null},l}},d={kek:o,integrationName:t,tenantId:r,getIntegration:u,getAccount:async()=>{let C=!1;for(;;){let T=await u(),O=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",T.id).executeTakeFirst();if(!O){if(!C&&s){C=!0,await s();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return{id:O.id,config:jr(O.config),dek:O.dek??null}}},updateAccount:async C=>{let T=await d.getAccount();await i.db.updateTable("corsair_accounts").set({...C.config!==void 0?{config:C.config}:{},...C.dek!==void 0?{dek:C.dek}:{},updated_at:new Date}).where("id","=",T.id).execute()}},p=null,g=null,f=null,h=async()=>{let C=await d.getAccount();if(!C.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p&&g===C.dek||(p=await oe(C.dek,o),g=C.dek),p},b=async()=>{if(f)return f;let C=await d.getIntegration();if(!C.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await oe(C.dek,o),f},k=async()=>{let C=await d.getAccount(),T=await h(),O=C.config;return!O||Object.keys(O).length===0?{}:ke(O,T)},P=async()=>{let C=await d.getIntegration(),T=await b(),O=C.config;return!O||Object.keys(O).length===0?{}:ke(O,T)},A=Promise.resolve(),B=C=>{let T=A.then(()=>M(C));return A=T.catch(()=>{}),T},M=async C=>{let T=await d.getAccount();if(!T.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);let O=await oe(T.dek,o),N;try{let D=T.config;N=!D||Object.keys(D).length===0?{}:ke(D,O)}catch(D){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,D),N={}}let te={...N};for(let[D,Ie]of Object.entries(C))Ie===null?delete te[D]:te[D]=Ie;let U=$e(te,O);await d.updateAccount({config:U})},ne={get_dek:h,issue_new_dek:async()=>{let C=await d.getAccount(),T=he(),O={},N=null;if(C.dek){N=await oe(C.dek,o);let U=C.config;U&&Object.keys(U).length>0&&(O=Ln(U,N,T))}let te=await be(T,o);if(N){let U=N;await i.db.transaction().execute(async D=>{await $i(D,C.id,U,T),await D.updateTable("corsair_accounts").set({config:O,dek:te,updated_at:new Date}).where("id","=",C.id).execute()})}else await d.updateAccount({config:O,dek:te});return p=T,g=te,T},...os(k,B,c)};return n==="oauth_2"&&(ne.get_integration_credentials=async()=>{let C=await P();return{...C,client_id:C.client_id||null,client_secret:C.client_secret||null,redirect_url:C.redirect_url??null}}),ne}async function is(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=he(),i=await be(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function ss(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=he(),s=await be(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",i.id).execute(),a}var du=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function De(e){return du.has(e)}function pu(e,n){return De(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function gu(e){return!De(e)}function fu(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"];case"managed_pricing":return[]}}function yu(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function mu(e,n){let t=i=>n.find(a=>a.level==="account"&&a.name===i);if(!fu(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function as(e,n){if(!e)return!1;let t=re(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function hu(e,n){let r=e.authConfig?.[n]?.integration??[];return[...Z[n].integration,...r]}function bu(e,n){let r=e.authConfig?.[n]?.account??[];return[...Z[n].account,...r]}function ku(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return o.length>0?a="missing_integration":r.length===0?a="ready":i.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:mu(n,t),fields:t,missingRequiredFields:r}}async function je(e,n,t){let r=E(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,a=i?.[r]?.integration??[],s=i?.[r]?.account??[],c=j({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),l=F({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:s}),u=hu(n,r),d=bu(n,r),p=[];for(let g of u)p.push({name:g,level:"integration",required:pu(r,g),configured:await as(c,g)});for(let g of d)p.push({name:g,level:"account",required:gu(g),configured:await as(l,g)});if(yu(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return ku(n.id,r,p)}async function Zn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let a of e.plugins){if(o&&!o.has(a.id))continue;let s=await je(e,a,r);s&&i.push(s)}return i}function Pt(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var cs=Symbol.for("corsair:internal"),us=new WeakMap,ls=new WeakMap;function wu(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function Cu(e){if(e.database){let t=us.get(e.database);return t||(t=new Map,us.set(e.database,t)),t}let n=ls.get(e);return n||(n=new Map,ls.set(e,n)),n}function Tu(e){return e.multiTenancy?{withTenant:()=>({}),[cs]:e}:{[cs]:e}}async function yn(e,n){if(!e.database)return;let t=n.trim()||"default",r=Cu(e),o=wu(t,e.plugins),i=r.get(o);if(i){await i;return}let a=(async()=>{let{setupCorsair:s}=await import("./setup-UHHPTIGQ.js");await s(Tu(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,a),await a}import*as Gn from"crypto";function He(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function Kr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function mn(e,n){if(!n)throw new Error("OAuth state signing requires a configured kek. Pass kek to createCorsair().");let t=Gn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var Zr=600*1e3;function vt(e,n){if(!n)return null;let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Gn.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(o,"base64url"),s=Buffer.from(i,"base64url");return a.length!==s.length||!Gn.timingSafeEqual(a,s)?null:Kr(r,{maxAgeMs:Zr})}function ds(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function ps(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function hn(e,n){await I({hub:e,path:"/connections/report",body:ds(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function Pu(e,n){try{let t=q(e);I({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof Te)return}}async function vu(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!E(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await je(n,e.plugin,r);o&&fs(e.hub,ps({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function gs(e,n){Pu(e,n)}function fs(e,n){I({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function bn(e){vu(e).catch(()=>{})}async function Pe(e,n){let t=R(e);if(!E(n.plugin))return;let o=await je(t,n.plugin,n.tenantId);o&&gs(e,ps({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function Rt(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var ys=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function Ru(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function Au(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await oe(n.dek,e.kek),r=ys(n.config),o={};Object.keys(r).length>0&&(o=ke(r,t)),o[e.link.linkType]=e.link.externalId;let i=$e(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function kn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:a,extraAccountFields:s=[]}=e,{accountId:c}=await Ru({database:n,pluginId:r,tenantId:o}),l=!1;if(a){let u=F({authType:a,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:s}),d=`set_${i.linkType}`,p=u[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await Au({database:n,kek:t,accountId:c,link:i})}async function Gr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let c=await oe(s.dek,t),u=ys(s.config)[o];if(!u)continue;if(pt(u,c)===i)return s}catch{continue}return null}async function At(e){return(await Gr(e))?.tenant_id??null}async function ms(e){return At({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as hs from"querystring";function Ke(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${hs.stringify(i)}`}async function bs(e,n){try{return await G({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function wn(e,n,t,r){if(!n.subscribe)return;let o=q(e),i=await bs(o,n.id);if(!i)return;let a=await n.subscribe({keys:r},{webhookUrl:i});a&&await Pe(e,{plugin:n,tenantId:t,verified:!0,webhookLink:a.webhookLink,webhookSecret:a.webhookSecret})}var Y=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function ks(e){let n=e.oauthConfig;if(!n)throw new Y("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function xu(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let a=await i.executeTakeFirst();if(!a)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",a.id).executeTakeFirst())return;let c=he(),l=await be(c,r),u=new Date;await o.insertInto("corsair_accounts").values({id:un(),created_at:u,updated_at:u,tenant_id:t,integration_id:a.id,config:{},dek:l}).execute()})}async function zr(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,a=R(e,()=>new Y("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=V(a,n,p=>new Y("plugin_not_found",p)),c=ks(s),u=await j({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!u)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Ke({oauthConfig:c,clientId:u,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=mn(He(n,r),a.kek);return{url:Ke({oauthConfig:c,clientId:u,redirectUri:o,state:d}),state:d}}function Iu(e,n){return{...n??{},...e}}async function zn(e,n){let{code:t,state:r,redirectUri:o}=n,i=R(e,()=>new Y("invalid_corsair_instance","Invalid corsair instance")),a,s;if(n.trusted){if(!n.plugin||!n.tenantId)throw new Y("invalid_state","trusted callback requires plugin and tenantId");a=n.plugin,s=n.tenantId}else{let h=vt(r,i.kek);if(!h)throw new Y("invalid_state","Invalid or tampered state parameter");a=h.plugin,s=h.tenantId}if(!i.database)throw new Y("no_database","No database configured on corsair instance");let c=V(i,a,h=>new Y("plugin_not_found",h)),l=ks(c),u=j({authType:"oauth_2",integrationName:a,kek:i.kek,database:i.database}),d=await u.get_client_id(),p=await u.get_client_secret();if(!d||!p)throw new Y("credentials_not_configured",`Credentials not configured for '${a}'`);await xu(i.database,a,s,i.kek);let g=await xt(t,d,p,l,o);if(!g.access_token)throw new Y("no_access_token",`No access_token returned from ${l.providerName}`);let f=F({authType:"oauth_2",integrationName:a,tenantId:s,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await Pe(e,{plugin:c,tenantId:s}).catch(()=>{});try{let h=Iu(g,n.callbackParams),b=await Rt(i.plugins,a,h);if(b){try{let k=c.authConfig?.oauth_2?.account??[];await kn({database:i.database,kek:i.kek,pluginId:a,tenantId:s,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${a}' tenant '${s}':`,k)}i.hub&&hn(i.hub,{plugin:a,tenantId:s,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${a}' tenant '${s}':`,h)}if(c.subscribe)try{await wn(e,c,s,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${a}' tenant '${s}':`,h)}return{plugin:a,tenantId:s}}async function Su(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??wn,i=[],a=[];if(!t.database)return{renewed:i,failed:a};for(let s of r){let c=t.plugins.find(u=>u.id===s.integrationName);if(!c?.subscribe)continue;let l=`${c.id}/${s.tenantId}`;try{let u=E(c)??"oauth_2",d=F({authType:u,integrationName:c.id,tenantId:s.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[u]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:u,keys:g,hub:t.hub},"endpoint")}await o(n,c,s.tenantId,d),i.push(l)}catch(u){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,u),a.push(l)}}return{renewed:i,failed:a}}async function ws(e){let n=R(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return Su({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function _u(e,n={}){let t=!1,r=()=>{t||(t=!0,ws(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function Cs(e){if(!R(e).database)throw new Error("A database must be configured to provision Corsair integrations");await It(e,{silent:!0})}async function Cn(e,n){let t=R(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await yn(t,n)}var Eu=Symbol.for("corsair:internal"),Mu=new Set(["access_token","refresh_token","expires_at","scope"]);function Ou(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Du(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!De(t)&&!Mu.has(t)):n.filter(t=>!De(t))}function Ts(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function Hu(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function Uu(e){return{[Eu]:Ts(e)}}async function St(e,n,t={}){let r=Tt(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,a=Ts(e),s=Uu(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let l=E(c);if(!l)continue;let u=Ou(l),d=t.providerNameOverrides?.[c.id]??Ee(c.id),p=await je(a,c,n),g=lt(c,l),f=Du(l,g),h={plugin:c.id,providerName:d,authKind:u,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),u==="oauth"){let k=t.oauthModeOverrides?.[c.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let P=await zr(s,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=P.url}catch(P){P instanceof Error&&/client_id not configured/i.test(P.message)||(h.setupError=P instanceof Error?P.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function Ry(e,n,t={}){let r=R(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return St({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function Ps(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await yn(e.internalConfig??Hu(e),n)}async function vs(e,n){await Cn(e,n)}async function Rs(e,n){let t=fn(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),I({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:yt})}async function As(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await Ps(t,n.tenantId);let r=await St(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return Rs(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function _t(e,n){let t=R(e),r=q(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await vs(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,a=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,s=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await St(o,n.tenantId,{pluginIds:i,oauthModeOverrides:a,providerNameOverrides:s});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return Rs(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function Et(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(a=>a.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=R(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await Bu(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function Bu(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-CMAVI5LB.js"),{postHubConnectSession:i}=await import("./connect-SYE5GQKI.js"),a={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(a,t.tenantId);let s=await r(a,t.tenantId,{pluginIds:t.pluginIds});if(s.length===0)throw new Error("No connectable plugins found for this tenant");let c=s.find(l=>l.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:s})}function Tn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var ie=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Fu(e){let n=e.oauthConfig;if(!n)throw new ie("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Jr(e,n){let t=R(e,()=>new ie("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ie("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new ie("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=vt(n,t.kek);if(!o)throw new ie("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:a}=o,s=V(t,i,p=>new ie("plugin_not_found",p)),c=Fu(s),u=await j({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!u)throw new ie("client_id_not_configured",`client_id not configured for '${i}'`);let d=Ke({oauthConfig:c,clientId:u,redirectUri:r,state:n});return{plugin:i,tenantId:a,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as Nu}from"async_hooks";import{randomBytes as $u}from"crypto";import{v4 as Wu}from"uuid";var le=class extends Error{reason;constructor(n,t="pending"){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError",this.reason=t}};async function Mt(e,n){let t=fn(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Se({deliveryUrl:n.deliveryUrl})),I({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:ht})}function Ot(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var Vr="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Qr(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function xs(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Yr(e){return Ot(e)}async function Xr(e,n){if(Qr(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?xs(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Mt(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:Lu(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch(r){return console.warn(`[corsair/${n.plugin}] could not create an approval link for '${n.endpoint}': ${r instanceof Error?r.message:String(r)}`),null}}function Lu(e){try{return JSON.parse(e)}catch{return e}}async function Dt(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Xr(e,n);return{...n,approvalUrl:r}}async function eo(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:a,endpoint:s,args:c,tenantId:l,expiresAt:u,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:a,endpoint:s,args:c});let g=await Xr({manual:t,hub:r},{id:o,token:i,plugin:a,endpoint:s,args:JSON.stringify(c),tenant_id:l,expires_at:u});return Qr(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Yr(g):Vr:r?g?Yr(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:Vr}var Ht=new Nu,Is={open:0,cautious:1,strict:2,readonly:3},Pn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function no(e,n){return e===void 0?n:n===void 0||Is[e]>=Is[n]?e:n}function Ut(e,n){return Ht.run(no(Ht.getStore(),e)??e,n)}function vn(){return Ht.getStore()}function to(e){return Ut("readonly",e)}function Es(){return Ht.getStore()==="readonly"}function Bt(e,n){if(Es()&&n!=="read")throw new Pn(e,n)}function Ze(e,n){Bt(e,n);let t=vn();if(!(t===void 0||Ft(n,t)==="allow"))throw new le(`Action '${e}' is a '${n}' operation and permission mode '${t}' does not allow it. The entity store cannot wait for approval.`,"policy")}var qu={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}},Ss={allow:0,require_approval:1,deny:2};function Ms(e,n){return e===void 0?n:Ss[e]>=Ss[n]?e:n}function Ft(e,n,t){return t!==void 0?t:qu[n][e]}function ro(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Os(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function _s(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Ds(e){let n=Ft(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, widen the permission mode in force for this call.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",a).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,h=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${s.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?_s(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let c=Wu(),l=$u(32).toString("hex"),u=e.timeoutMs??600*1e3,d=new Date(Date.now()+u).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:c,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:a,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${c}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?_s(e.db,c,u):{result:"blocked",reason:"pending",id:c,token:l,expiresAt:d}}var w=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function S(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function de(e){let n={error:e.code,message:e.message,...e.extra};return S(e.status,n)}function Ue(e){return new w(404,"not_found",e)}function L(e,n={}){return new w(400,"bad_request",e,n)}function oo(e,n){return V(e,n,t=>Ue(t))}async function Hs(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=j({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=Z[t].integration,i=r,a;try{a=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{a=o.map(()=>null)}let s=o.filter((l,u)=>a[u]==null),c;return t==="oauth_2"?c=!s.includes("client_id")&&!s.includes("client_secret"):c=s.length===0,{configured:c,missingFields:s}}async function Us(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await Hs(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Lt(){return{ok:!0}}async function Rn(e){return Promise.all(e.plugins.map(n=>Us(n,e)))}async function Nt(e,n){let t=oo(e,n);return Us(t,e)}async function ju(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function Bs(e,n){let t=await ju(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function An(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let a=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function $t(e,n){if(!n)throw L("Tenant id must be a non-empty string");return Bs(e,n)}async function Wt(e,n){let t=n?.id?.trim();if(!t)throw L("Tenant id is required",{missingFields:["id"]});return Bs(e,t)}async function qt(e,n){let t=n?.trim()||"default",r={},o=await Zn(e,t);for(let i of o)r[i.plugin]=Pt(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function jt(e,n){let t=n?.plugin;if(typeof t!="string"||!t.trim())throw L("plugin is required",{missingFields:["plugin"]});let r=t.trim();oo(e,r);let o=n?.tenantId;if(o!=null&&typeof o!="string")throw L("tenantId must be a string");let i=o?.trim()||"default";if(!e.database)return{ok:!0,disconnected:!1};let a=e.database.db,s=await a.selectFrom("corsair_integrations").select(["id"]).where("name","=",r).executeTakeFirst();if(!s)return{ok:!0,disconnected:!1};let c=!1;return await a.transaction().execute(async l=>{e.database?.isPg===!0&&await l.selectFrom("corsair_integrations").select("id").where("name","=",r).forUpdate().execute();let u=l.selectFrom("corsair_accounts").select("id").where("tenant_id","=",i).where("integration_id","=",s.id);await l.deleteFrom("corsair_events").where("account_id","in",u).execute(),await l.deleteFrom("corsair_entities").where("account_id","in",u).execute(),c=((await l.deleteFrom("corsair_accounts").where("tenant_id","=",i).where("integration_id","=",s.id).executeTakeFirst()).numDeletedRows??0n)>0n}),{ok:!0,disconnected:c}}async function io(e,n){if(!e.database)throw Ue(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw Ue(`Permission '${n}' not found`);return Dt(e,t)}function Ku(e){if(!e.oauthConfig)throw L(`Plugin '${e.id}' has no oauthConfig`)}function Zu(e){if(!e.manual)throw new w(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function so(e){let n=Zu(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new w(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function Gu(e){let n=!!e.hub,t=Tn(e.manual);if(!n&&!t)throw new w(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function Fs(e){if(!e.database||!e.kek)throw new w(500,"database_not_configured","A database and kek are required to issue connect links.")}async function zu(e,n){let t=n?.plugin?.trim();if(!t)throw L("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=oo(e,t);Ku(o);let i=so(e);Fs(e);let a=await Hs(o,e);if(!a.configured)throw new w(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=mn(He(t,r),e.kek),c;try{c=new URL(i.baseUrl)}catch{throw new w(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return c.searchParams.set("state",s),{connectUrl:c.toString(),expiresAt:new Date(Date.now()+Zr).toISOString(),tenantId:r}}async function Ju(e,n,t){Fs(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let a=t.providerName?.trim();a&&(o.providerName=a);let s=await _t(e,o);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt,tenantId:r}}async function Kt(e,n,t){return Gu(n),n.hub?Ju(e,n,t):zu(n,t)}async function Zt(e,n,t){if(n.hub&&!Tn(n.manual))throw new w(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw L("state is required",{missingFields:["state"]});so(n);try{return await Jr(e,r)}catch(o){if(o instanceof ie)switch(o.code){case"invalid_state":throw L("Invalid or expired state");case"client_id_not_configured":throw new w(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new w(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function Gt(e,n,t){if(n.hub&&!Tn(n.manual))throw new w(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw L("Missing required fields",{missingFields:i});let a=so(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:o,redirectUri:a.redirectUri,callbackParams:t.callbackParams})}catch(c){if(c instanceof Error&&c.name==="OAuthCallbackError")switch(c.code){case"invalid_state":throw L("Invalid or expired state");case"credentials_not_configured":throw new w(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new w(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function ao(e,n){if(!e.database)throw Ue("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw Ue("Permission not found");return Dt(e,t)}async function Ls(e,n){return"id"in n?io(e,n.id):ao(e,n.token)}import{createCipheriv as rl,createDecipheriv as Em,randomBytes as qs,scryptSync as ol}from"crypto";import{createHmac as co,randomUUID as Vu,timingSafeEqual as $s}from"crypto";function uo(e){return e.run??null}function lo(e){return e.probe??null}function Ws(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function zt(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=co("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":Vu()}}}function po(e){let n=e.signingSecret.trim();if(!n)return!1;let t=Ws(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>We)return!1;let i=co("sha256",n).update(e.body).digest("hex");try{return $s(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function xn(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=Ws(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>We)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=co("sha256",n).update(e.body).digest("hex");try{if(!$s(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function In(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function Jt(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function Vt(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function Jn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function go(e){return Jn(In(e))}async function fo(e){let n=await Xt({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=In(n.body),r=Jt({httpOk:n.ok,status:n.status,body:t}),o=Jn(t);if(!r||!o)throw new Error(Qt({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function Yt(e){return Vt(In(e))}function Yu(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function Ns(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var Qu="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",Xu="Check the delivery URL configured for this environment.";function el(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${Qu}`}function nl(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${Xu}`}function Vn(e,n){let t=Yu(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function Qt(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Vn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return el(e);if(e.status===404)return nl(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${Ns(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${Ns(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}var tl=15e3;async function Xt(e){let{body:n,headers:t}=zt(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n,signal:AbortSignal.timeout(tl)}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Vn(e.deliveryUrl,r)}}}var il="aes-256-gcm",sl=12,al=16,cl=16,ul=32;function ll(e,n){return ol(e.trim(),n,ul)}function yo(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=qs(cl),o=ll(t,r),i=qs(sl),a=rl(il,o,i,{authTagLength:al}),s=JSON.stringify(e),c=Buffer.concat([a.update(s,"utf8"),a.final()]),l=a.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),c.toString("base64")].join(":")}var dl=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function mo(e){if(e instanceof Di)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!dl.some(t=>n.includes(t))}function pl(e){if(!e)return[];let n=E(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!De(r)):[]}async function Yn(e,n){let t=R(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await It(e,{silent:!0});let[r,o]=await Promise.all([An(t),Rn(t)]),i={tenants:r.map(a=>({id:a.id})),plugins:o.map(a=>{let s=pl(t.plugins.find(c=>c.id===a.id));return{id:a.id,authType:a.authType,configured:a.configured,missingFields:a.missingFields,...s.length>0?{integrationCredentialFields:s}:{}}}),syncedAt:new Date().toISOString()};return yo(i,n)}var pe=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function er(e,n){let t=R(e,()=>new pe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new pe("no_database","Database not configured");let r=V(t,n.plugin,u=>new pe("plugin_not_found",u)),o=E(r);if(!o)throw new pe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new pe("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await Cn(e,n.tenantId);let i=new Set(lt(r,o)),s=r.authConfig?.[o]?.account??[],c=F({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new pe("invalid_credentials",`Unknown credential field '${u}' for plugin '${n.plugin}'`);let p=re(c,`set_${u}`);if(!p)throw new pe("invalid_credentials",`Cannot set credential field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new pe("invalid_credentials","Provide at least one credential field to save");return await Pe(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var ge=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function ho(e,n){let t=R(e,()=>new ge("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ge("no_database","Database not configured");let r=V(t,n.plugin,u=>new ge("plugin_not_found",u)),o=E(r);if(!o)throw new ge("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await Cs(e);let i=new Set(Fi(r,o)),s=r.authConfig?.[o]?.integration??[],c=j({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new ge("invalid_credentials",`Unknown integration credential field '${u}' for plugin '${n.plugin}'`);let p=re(c,`set_${u}`);if(!p)throw new ge("invalid_credentials",`Cannot set integration field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ge("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var nr=new Map;function gl(e){for(let[n,t]of nr)t<=e&&nr.delete(n)}function tr(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();gl(r);let o=nr.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(nr.set(t,r+n),{ok:!0})}var Be=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function Sn(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:a,scope:s,authType:c="managed",providerData:l}=n;if(!o.trim())throw new Be("no_access_token","Managed OAuth delivery missing access_token");let u=R(e,()=>new Be("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new Be("no_database","No database configured on corsair instance");let d=V(u,t,g=>new Be("plugin_not_found",g));await Cn(e,r);let p=F({authType:c,integrationName:t,tenantId:r,kek:u.kek,database:u.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),a&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await p.set_scope(s),await Pe(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await Rt(u.plugins,t,{access_token:o,refresh_token:i,scope:s,...l});if(g){try{let f=d.authConfig?.[c]?.account??[];await kn({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:g,authType:c,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}u.hub&&hn(u.hub,{plugin:t,tenantId:r,link:g,authType:c})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await wn(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function fl(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function js(e,n,t=[]){for(let[r,o]of Object.entries(e))if(fl(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=js(o,n,[...t,r]);if(i)return i}return null}function yl(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function ml(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function Ks(e,n,t,r,o){let i=yl(n),a=typeof t=="string"?JSON.parse(t):t;(!a||typeof a=="object"&&Object.keys(a).length===0)&&i["x-goog-resource-uri"]&&(a=ml(i)||a);let c={headers:i,body:a,...r?{query:r}:{}},l=r?.tenantId||"default",u=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:ft;for(let g of p){let f=u[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(c))continue;let h=js(f.webhooks,c);if(!h)continue;let b=h.path.join("."),k={payload:a,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let P=await h.webhook.handler(k),A=!!Object.keys(P.returnToSender||{})?.length;return{plugin:g,action:b,body:a,response:A?{...P?.returnToSender,success:!0}:{success:!0},...P.responseHeaders&&{responseHeaders:P.responseHeaders}}}catch(P){return console.error(`Error executing webhook handler for ${g}.${b}:`,P),{plugin:g,action:b,body:a,response:{success:!1,error:P instanceof Error?P.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as hl}from"crypto";import*as Ge from"vm";var Zs="__corsairFailedStep",bl=3e4,bo=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function Gs(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function zs(e,n){return`st_${hl("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function rr(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var Js=new Set(["constructor","prototype","__proto__"]);function ve(e,n){if(e===null)return null;let t=typeof e;return t==="function"?wl(e,n):t==="object"?kl(e):e}function kl(e){return new Proxy(e,{get(n,t){if(!Js.has(t))return ve(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function wl(e,n){return new Proxy(e,{apply:(t,r,o)=>Cl(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!Js.has(r))return ve(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Cl(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>ve(n,void 0),n=>{throw ve(n,void 0)}):ve(e,void 0)}function Tl(e){let n=Object.create(null),t=Ge.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Ge.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),a=Ge.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),c=Ge.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=ve(e.corsair,void 0),n.__payload=o,n.__step=a,n.__console=c;let l=Ge.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let u,d=new Promise((p,g)=>{u=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(u))}async function ko(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(a,s)=>{if(o)throw o;let c=r++,l=zs(a,c);if(Object.hasOwn(n,l))return ve(n[l].output,void 0);try{let u=await s();return t.push({stepId:l,name:a,seq:c,status:"completed",output:u}),u}catch(u){if(Gs(u))throw u;let d=rr(u);t.push({stepId:l,name:a,seq:c,status:"failed",error:d});let p=new Error(d);throw p[Zs]=a,p}});i.sleep=async(a,s)=>{if(o)throw o;let c=r++,l=zs(a,c);if(Object.hasOwn(n,l))return;t.push({stepId:l,name:a,seq:c,status:"completed",output:null});let u=Number.isFinite(s)?Math.max(0,s):0;throw o=new bo(Date.now()+u,a),o};try{await Tl({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??bl});let a=o;return a?{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(a){if(Gs(a))return{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()};let s=rr(a),c=a!==null&&typeof a=="object"?a[Zs]:void 0;return{status:"failed",steps:t,error:{message:s,...c?{failedStep:c}:{}}}}}import*as or from"vm";var Vs=1e4;async function wo(e){let n=Object.create(null),t=or.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=ve(e.corsair,void 0);let r=vl(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await to(()=>{let a=or.runInContext(o,t,{filename:"corsair:probe",timeout:r});a.catch(()=>{});let s,c=new Promise((l,u)=>{s=setTimeout(()=>u(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([a,c]).finally(()=>clearTimeout(s))});return{status:"ok",value:Pl(i)}}catch(i){return{status:"error",error:rr(i)}}}function Pl(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function vl(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?Vs:Math.min(e,Vs)}function ze(e){return e.deliveryMode==="auth.credentials"}function Qn(e){return e.deliveryMode==="connections.sync"}function ir(e){return e.deliveryMode==="connect.create_link"}function Xn(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function et(e){return e.deliveryMode==="oauth.tokens"}function sr(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!ze(e)&&!Qn(e)&&!ir(e)&&!Xn(e)&&!et(e)}function Rl(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function Al(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await Yn(e,n)}}}}}catch(t){return{status:"failed",retryable:mo(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function xl(e,n){try{let t=await Et(e,n);return Rl(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function Co(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function Il(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await At({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function Sl(e,n,t,r){let o=await Il(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},a=await Ks(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!a.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(a.response&&a.response.success===!1)return{status:"failed",retryable:!1,error:typeof a.response.error=="string"?a.response.error:"Webhook handler failed"};let s=a.response?.returnToSender,c=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(a.response?.data??a.response);return{status:"ok",webhookResponse:{status:a.response?.statusCode??200,body:c,headers:a.responseHeaders}}}async function _l(e,n){return await zn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function El(e,n){return await Sn(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function Po(e,n,t){let r=await To(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function To(e,n,t){let r=R(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function Ml(e,n){try{return await er(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function Ol(e,n){try{return await ho(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function Ys(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function Dl(e,n){try{let t=Ys(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await ko({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function Hl(e,n){try{let t=Ys(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await wo({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function nt(e,n,t={}){let r=R(e),o=Co(n.headers,"x-corsair-signature"),i=Co(n.headers,"x-corsair-timestamp"),a=Co(n.headers,"x-corsair-nonce"),s=!1;if(t.signingSecret?.trim()){let l=xn({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!l.ok)return{status:"failed",retryable:!1,error:l.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let u=tr(`nonce:${a.trim()}`,We);if(!u.ok)return{status:"failed",retryable:!1,error:u.error};s=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let c;try{c=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(c.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(c.type){case"webhook":return Sl(e,r,c.payload,s);case"oauth.callback":return _l(e,c.payload);case"oauth.tokens":return El(e,c.payload);case"permission.approve":return To(e,c.payload,"approved");case"permission.deny":return To(e,c.payload,"denied");case"auth.credentials":return Ml(e,c.payload);case"integration.credentials":return Ol(e,c.payload);case"connect.create_link":return xl(e,c.payload);case"connections.sync":{let l=t.signingSecret?.trim();return l?Al(e,l):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?Dl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?Hl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(c.type)}`}}}function Ul(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var vo=3,Bl=250;function Fl(e){return e?.name==="AbortError"}async function Ll(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function Nl(e,n,t,r,o){for(let i=1;i<=vo;i++){try{let a=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(a.ok)return await Ll(a)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(a){if(Fl(a))throw a}i<vo&&await Xs(Bl)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${vo} attempts; the run may be retried`),!1}async function $l(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:a,body:s,headers:c}=await i.json(),l=await t.process(e,{headers:c,body:s},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:u,body:d}=Ul(l);return await Nl(n,t,o,{deliveryId:a,status:u,body:d},r)?"handled":"error"}var Qs=1e3,Wl=5e3,ql=3e4;function Xs(e){return new Promise(n=>setTimeout(n,e))}var ar=globalThis.__corsairConnectLoops??=new Map;function jl(e,n={fetch,process:nt}){let t;try{t=q(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(ar.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");ar.set(r,o);let i=()=>{ar.get(r)===o&&ar.delete(r)},a=!1,s=null;return(async()=>{let l=Qs,u=!1,d=async p=>{u||(console.warn("[corsair] connect loop error; retrying",p),u=!0),a||await Xs(l),l=Math.min(l*2,Wl)};try{for(;!a;){s=new AbortController;let p=setTimeout(()=>s?.abort(),ql);try{await $l(e,t,n,s.signal)==="error"?await d("pull or ack failed"):(u=!1,l=Qs)}catch(g){if(a)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{a=!0,s?.abort(),i()}}}function ea(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Kl(e,n){return n&&!n.has(e.id)?!1:E(e)!==null}async function na(e,n,t={}){let r=R(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,a=await Zn(r,o,{pluginIds:t.pluginIds}),s=new Map(a.map(l=>[l.plugin,l])),c=r.plugins.filter(l=>Kl(l,i)).map(l=>{let u=E(l),d=s.get(l.id);return d?{plugin:l.id,providerName:Ee(l.id),authKind:ea(u),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:Ee(l.id),authKind:ea(u),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:c}}async function ta(e,n){let t=q(e);return G({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:mt})}var Zl=/^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;function Gl(e){return typeof e=="string"&&e.length>0}function cr(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty managed pricing credentials payload");let n=e;if(!Gl(n.api_key))throw new Error("Hub API returned incomplete managed pricing credentials (expected api_key)");let t={api_key:n.api_key};return n.expires_in!==void 0&&typeof n.expires_in=="number"&&Number.isFinite(n.expires_in)&&n.expires_in>0&&(t.expires_in=n.expires_in),typeof n.usage_path=="string"&&Zl.test(n.usage_path)&&(t.usage_path=n.usage_path),t}var ra=1024*1024,oa=3e4;function Je(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:ra}function Ve(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:oa}function _n(e){return new w(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function zl(e){return new w(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function ur(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o(zl(n)),n)})])}finally{clearTimeout(t)}}async function lr(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:s,value:c}=await ur(()=>t.read(),n.bodyStallTimeoutMs);if(s)break;if(o+=c.byteLength,o>n.maxBodyBytes)throw _n(n.maxBodyBytes);r.push(c)}let i=new Uint8Array(o),a=0;for(let s of r)i.set(s,a),a+=s.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var Ro=new Map;function ia(e){let n;try{n=q(e)}catch{return}let t=Dr(n);t&&Ro.get(n.projectApiKey)!==t&&(Ro.set(n.projectApiKey,t),I({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{Ro.delete(n.projectApiKey)}))}var Jl=[".corsair.dev"];function Vl(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function Yl(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Vl(n)?!0:Jl.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function sa(e){return!e||!Yl(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function aa(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function Ao(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function xo(e,n){let t=q(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=Oe(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=tr(`browser:${i.jti}`,Me);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(Qn(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let s=await Yn(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:s}}})}}if(ir(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let s=i.connectLinkPlugins?.filter(Boolean)??[];if(s.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let c=await Et(e,{tenantId:i.tenantId,plugins:s});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:c.connectUrl,expiresAt:c.expiresAt}})}}if(ze(i))return i.hubSuccessUrl?i.credentials?(await er(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:Ao(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:Ao(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(Xn(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await Po(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(et(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await Sn(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!sr(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await zn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(s){let c=s instanceof Error?s.message:"Hub delivery failed";return Qn(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:ir(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:ze(i)&&i.hubSuccessUrl?{type:"redirect",url:Ao(i.hubSuccessUrl,{error:c})}:ze(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:dn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:{type:"json",status:400,body:{error:c}}}return{type:"redirect",url:i.hubSuccessUrl}}async function Io(e,n){let t=q(e),r=await nt(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,a=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:a}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:a}}function So(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function _o(e,n){return n.method==="GET"?xo(e,n.url):Io(e,{headers:n.headers,body:n.body??""})}async function Eo(e,n){try{let t=await _o(e,n);return So(t)}catch(t){if(t instanceof Te)return Response.json({error:t.message},{status:503});throw t}}async function Ye(e,n,t){ia(e);let r=n.method.toUpperCase(),o=sa(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await Eo(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await lr(n,{maxBodyBytes:Je(t?.maxBodyBytes),bodyStallTimeoutMs:Ve(t?.bodyStallTimeoutMs)}):void 0});return aa(i,o)}var _=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function En(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function Mn(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var ca=new WeakMap;function Qe(e,n,t){let r=ca.get(e);r||(r=new Map,ca.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var ua=300;async function Mo(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,a=n?.forceRefresh??!1,s=`managed:${o}:${i}`;return Qe(t,s,async()=>{let[c,l,u]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!c&&!u)throw new _(o,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&c&&l&&Number(l)>d+ua)return{accessToken:c,expiresAt:Number(l),refreshed:!1};if(!u&&c&&!a){let f=l?Number(l):null;if(f===null||f>d+ua)return{accessToken:c,expiresAt:f??d+3600,refreshed:!1}}if(!u)throw new _(o,"managed");let p=await Xl(r,o,i,u),g=await Mn(t,p,l);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function Ql(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function Xl(e,n,t,r){try{return await I({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:ln})}catch(o){let i=o instanceof Error?o.message:"";throw Ql(i)?new _(n,"managed"):o}}async function la(e,n){e._refreshAuth=async()=>(await Mo(n,{forceRefresh:!0})).accessToken}import{randomUUID as td}from"crypto";import{createHmac as ed}from"crypto";var nd="x-corsair-runtime-proof";function Oo(e,n){if(!e.runtimeProofKey)return{};let t=Math.floor((n.nowMs??Date.now())/1e3),r=ed("sha256",e.runtimeProofKey).update([t,n.path,n.plugin,n.tenantId,n.operation].join(`
+`)).digest("base64url");return{[nd]:`t=${t},v1=${r}`}}var rd="",od=60,id=1e4,Do=new WeakMap;function da(e){let n=bt(e.apiUrl),t=e.instanceKey?.trim()??"";return[encodeURIComponent(n),encodeURIComponent(e.projectApiKey),encodeURIComponent(t)].join(rd)}function sd(e,n,t,r){let i=`${da(e)}:${n}:${t}`;return r?`${i}:${r}`:i}function ad(e,n){return Do.get(e)?.get(n)}function cd(e,n,t){let r=Do.get(e);r||(r=new Map,Do.set(e,r)),r.set(n,t)}function ud(e,n){return e.expiresAt===null?!1:e.expiresAt>n+od}function dr(e,n){if(!n)throw new _(e,"managed_pricing",`[auth-missing:${e}:managed_pricing]: Hub config is required. Pass hub: { ... } to createCorsair().`)}async function Ho(e,n){dr(e.plugin,e.hub);let t=n.operation.trim();if(!t)throw new _(e.plugin,"managed_pricing",`[auth-missing:${e.plugin}:managed_pricing]: Operation id is required for Hub metering.`);let r=n.forceRefresh??!1,o=n.idempotencyKey?.trim()||void 0,i=sd(e.hub,e.plugin,e.tenantId,t),s=`managed_pricing:${o?`call:${o}`:r?"force":"routine"}:${i}`;return Qe(e.cache,s,async()=>{let c=Math.floor(Date.now()/1e3);if(!r&&!o){let d=ad(e.cache,i);if(d&&ud(d,c))return{apiKey:d.apiKey,expiresAt:d.expiresAt,fromCache:!0}}let l=await I({hub:e.hub,path:"/managed-pricing/credentials",body:{plugin:e.plugin,tenantId:e.tenantId,operation:t,...o?{idempotencyKey:o}:{}},extraHeaders:{...Oo(e.hub,{path:"/managed-pricing/credentials",plugin:e.plugin,tenantId:e.tenantId,operation:t}),"x-corsair-metered-operation":t,...o?{"x-corsair-idempotency-key":o}:{}},notFoundMessage:"Managed pricing is not configured for this project",parseResponse:cr,signal:AbortSignal.timeout(id)}),u=l.expires_in!==void 0?c+l.expires_in:null;return o||cd(e.cache,i,{apiKey:l.api_key,expiresAt:u}),{apiKey:l.api_key,expiresAt:u,fromCache:!1,...l.usage_path?{usagePath:l.usage_path}:{}}})}function pr(){return{}}async function Uo(e,n){dr(n.plugin,e.hub);let t=e.tenantId?.trim();if(!t)throw new _(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: tenantId is required for metered credentials.`);let r=(n.operation??e.meteredOperationId)?.trim();if(!r)throw new _(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: Endpoint operation id missing \u2014 cannot meter usage.`);let o=td(),i={plugin:n.plugin,tenantId:t,operation:r,idempotencyKey:o};try{let a=await Ho({hub:e.hub,plugin:n.plugin,tenantId:t,cache:n.cache},{operation:r,idempotencyKey:o});return{apiKey:a.apiKey,call:i,...a.usagePath?{usagePath:a.usagePath}:{}}}catch(a){throw ld(a)&&await Bo(e.hub,i,a),a}}function ld(e){let n=typeof e=="object"&&e!==null&&"name"in e?e.name:void 0;return n==="TimeoutError"||n==="AbortError"||n==="TypeError"}async function pa(e,n){return(await Uo(e,n)).apiKey}function dd(e){try{return e instanceof Error?`${e.name}: ${e.message}`:String(e)}catch{return"Unprintable thrown value"}}var ga=3e3;function fa(e,n){return Oo(e,{path:"/managed-pricing/usage/outcome",plugin:n.plugin,tenantId:n.tenantId,operation:n.operation})}async function Bo(e,n,t){let r=dd(t);try{await I({hub:e,path:"/managed-pricing/usage/outcome",body:{...n,outcome:"failed",error:r.slice(0,300)},extraHeaders:fa(e,n),parseResponse:o=>o,signal:AbortSignal.timeout(ga)})}catch{}}function ya(e,n){let t=e;for(let r of n.split(".")){if(!t||typeof t!="object")return;t=t[r]}return typeof t=="number"&&Number.isFinite(t)&&t>=0?t:void 0}async function ma(e,n,t){try{await I({hub:e,path:"/managed-pricing/usage/outcome",body:{...n,outcome:"succeeded",usage:{units:t}},extraHeaders:fa(e,n),parseResponse:r=>r,signal:AbortSignal.timeout(ga)})}catch{}}function ha(e){return{delivery:n=>Ye(e,n),deliveryOptions:n=>Ye(e,n)}}var ba=1200*1e3;function Fo(){return Ce()}function Lo(){return ba}function No(e,n){return qn(e,n,ba)}function $o(e,n){return ue(e,n)}function Wo(e){return qe(e)}var ka=600*1e3;function qo(){return Ce()}function jo(){return ka}function Ko(e,n){return qn(e,n,ka)}function Zo(e,n){return ue(e,n)}function Go(e){return $r(e)}function zo(e){return qe(e)}function Jo(){return Ce()}function Vo(e,n,t){return wt(e,n,Math.floor(t.getTime()/1e3))}function Yo(e,n){return ue(e,n)}function Qo(e){return qe(e)}var Xe=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${dt}`),this.name="CorsairKekMissingError"}};function gr(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new Xe;let a=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${dt}`)}})}async function pd(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function wa(e){let{integrationId:n,accountId:t}=await pd(e);return{integrationId:n,accountId:t}}function Ca(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>Hr(t(),{tenantId:n,message:r}),list:()=>Br(t(),{tenantId:n}),get:r=>({message:o=>Ur(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>Fr(t(),{chatId:r,tenantId:n})})}}function Ta(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function gd(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await As(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):Ta(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function fd(e,n,t){let r=mn(He(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):Ta(e,i),connectUrl:i}}async function yd(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.error.authType==="managed_pricing"?{message:e.error.message,connectUrl:null}:e.manual&&Tn(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?fd(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?gd({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function Pa(e){let{message:n,connectUrl:t}=await yd(e);throw new _(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var fr="connect.request",ei="connect.cleared",md=600*1e3;async function Xo(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function hd(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function bd(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[fr,ei]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function va(e,n,t,r,o,i,a){if(a&&!i)throw new Error("encryptDataAtRest requires kek");let s=await bd(e,n,o),c=new Date(s),l=i?gt(r,await Nn(e.db,n,i)):r;await e.db.insertInto("corsair_events").values({id:un(),created_at:c,updated_at:c,account_id:n,event_type:t,payload:l}).execute()}async function kd(e,n,t=Date.now()){let r=await Xo(e,n.tenantId,n.plugin);r&&await va(e,r,fr,{plugin:n.plugin,connectUrl:n.connectUrl},t,n.kek,n.encryptDataAtRest)}function wd(e){let n=e;if(typeof e=="string")try{n=JSON.parse(e)}catch{return null}return!n||typeof n!="object"||Array.isArray(n)?null:n}async function Cd(e,n,t,r,o,i){let a=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[fr,ei]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!a||a.event_type!==fr)return null;let s=a.created_at instanceof Date?a.created_at.getTime():Date.parse(String(a.created_at));if(r-s>o)return null;let c=a.payload;if(typeof c=="string")try{c=JSON.parse(c)}catch{return null}if(Li(c)){if(!i)return null;try{c=Ni(c,await Nn(e.db,n,i))}catch{return null}}let l=wd(c);if(!l)return null;let u=l.plugin,d=l.connectUrl;return typeof u!="string"||typeof d!="string"?null:{plugin:u,connectUrl:d,requestedAt:new Date(s).toISOString(),tenantId:t,requestedAtMs:s,accountId:n}}async function ni(e,n,t=Date.now(),r=md,o){let i=await hd(e,n);if(i.length===0)return null;let a=(await Promise.all(i.map(u=>Cd(e,u,n,t,r,o)))).filter(u=>u!==null);if(a.length===0)return null;a.sort((u,d)=>u.requestedAtMs-d.requestedAtMs||u.accountId.localeCompare(d.accountId));let{requestedAtMs:s,accountId:c,...l}=a[0];return l}async function Ra(e,n,t=Date.now(),r,o,i){let a;if(r)a=await Xo(e,n,r);else{let s=await ni(e,n,t,void 0,o);a=s?await Xo(e,n,s.plugin):null}a&&await va(e,a,ei,{},t,o,i)}async function ti(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await kd(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl,encryptDataAtRest:n.encryptDataAtRest,kek:n.kek})}catch{}}var Td=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function Aa(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[a||"DEFAULT"]?.handler||Td)(e,i)}var xa=new Map;function Pd(e){let n=xa.get(e);return n||(n=pr(),xa.set(e,n)),n}function vd(e){return typeof e=="function"}function ri({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:a=[],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:P,encryptDataAtRest:A}){for(let[B,M]of Object.entries(e)){let ne=n?.[B];if(vd(M)){let C=ne,T=[...a,B].join("."),O=async(N={})=>{let te=l?.[T];Bt(T,te?.riskLevel??"write");let U,D=vn(),Ie=c?.mode,Hn=no(D,Ie);if(Hn){let v=te,$=v?.riskLevel??"write",me=c?.overrides?.[T],Ne=D!==void 0&&D!==Ie&&Hn===D?Ms(me,Ft($,D)):me,{result:an,reason:W,onComplete:Bn,token:ut,id:Ii,expiresAt:Gc}=await Ds({pluginId:o,endpointPath:T,args:N,mode:Hn,override:Ne,riskLevel:$,meta:v,db:u,timeoutMs:d?ro(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(an==="blocked"){let cn;W==="denied"?cn=`Action '${T}' was denied by the user. Await further instructions before proceeding.`:W==="policy"?cn=D?`Action '${T}' is blocked by permission mode '${D}'.`:`Action '${T}' is blocked by the permission policy. Update the corsair config to allow it.`:W==="timeout"?cn=`Action '${T}' timed out waiting for approval.`:ut&&Ii?cn=await eo({permissionsOptions:d,manual:g,hub:f,permissionId:Ii,permissionToken:ut,plugin:o,endpoint:T,args:N,tenantId:p??"default",expiresAt:Gc??new Date(Date.now()+(d?ro(d.timeout):600*1e3)).toISOString(),operationPath:T}):cn=`Action '${T}' requires user approval before it can run.`;let zc=W==="denied"||W==="policy"||W==="timeout"?W:"pending";throw new le(cn,zc)}U=Bn}let xr=async(v,$,me)=>{try{return await M($,me)}catch(ct){if(ct instanceof Error){let Ne=await Aa(ct,o,T,typeof me=="object"&&me!==null?me:{args:me},i);if(v<(Ne.maxRetries||0)){let an=v+1;console.log(`Retrying (${an} / ${Ne.maxRetries})...`);let W;if(Ne.headersRetryAfterMs)W=Ne.headersRetryAfterMs;else switch(Ne.retryStrategy){case"exponential_backoff":W=Math.pow(2,an-1)*1e3;break;case"exponential_backoff_jitter":let Bn=Math.pow(2,an-1)*1e3,ut=(Math.random()-.5)*1e3;W=Math.max(0,Bn+ut);break;case"linear_1s":W=1e3;break;case"linear_2s":W=2e3;break;case"linear_3s":W=3e3;break;case"linear_4s":W=4e3;break;default:W=1e3;break}return await new Promise(Bn=>setTimeout(Bn,W)),await xr(an,$,me)}}throw ct}},st,Un,Ir,Sr=async v=>{Un&&f&&await Bo(f,Un,v)},Ai=async v=>{if(!Un||!f||!Ir)return;let $=ya(v,Ir);$!==void 0&&await ma(f,Un,$)},jc={...t,meteredOperationId:T},Kc=typeof t.tenantId=="string"?t.tenantId:void 0,Zc=h?E(h):void 0;try{if(Zc==="managed_pricing"&&f){let v=await Uo({hub:f,tenantId:Kc??p,meteredOperationId:T},{plugin:o,cache:Pd(o),operation:T});st=v.apiKey,Un=v.call,Ir=v.usagePath}else s&&(st=await s(jc,"endpoint"))}catch(v){if(v instanceof we)throw h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await ti(u,{tenantId:v.tenantId??p,plugin:v.plugin,connectUrl:v.connectUrl,encryptDataAtRest:A,kek:A?b:void 0}),v;if(v instanceof _){h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1});try{await Pa({error:v,manual:g,hub:f,plugin:h,tenantId:p,database:u,kek:b,plugins:k,multiTenancy:P})}catch($){throw $ instanceof _&&await ti(u,{tenantId:$.tenantId??p,plugin:$.pluginId,connectUrl:$.connectUrl,encryptDataAtRest:A,kek:A?b:void 0}),$}}throw v}if(!C?.before&&!C?.after){let v;try{v=await xr(0,{...t,key:st},N),await U?.()}catch($){throw await Sr($),$}return await Ai(v),h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),v}let xi={...t,key:st},at;try{let v=C.before?await C.before(xi,N):{ctx:xi,args:N,continue:!0,passToAfter:void 0};if(v.continue===!1){await Sr(new Error("Stopped by a before hook"));return}at=await xr(0,v.ctx,v.args),await C.after?.(v.ctx,at,v.passToAfter),await U?.()}catch(v){throw await Sr(v),v}return await Ai(at),h&&f&&bn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),at};r[B]=O}else if(M&&typeof M=="object"){let C={};ri({endpoints:M,hooks:ne,ctx:t,tree:C,pluginId:o,errorHandlers:i,currentPath:[...a,B],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:P,encryptDataAtRest:A}),r[B]=C}}}var fe={findByEntityId:"read",existsByEntityId:"read",findIdByEntityId:"read",findById:"read",findManyByEntityIds:"read",list:"read",search:"read",count:"read",upsertByEntityId:"write",deleteById:"destructive",deleteByEntityId:"destructive"},Rd=/^\$+date$/;function Ia(e){if(typeof e!="object"||e===null||Array.isArray(e))return null;let n=Object.keys(e),t=n[0];return n.length!==1||!t||!Rd.test(t)?null:typeof e[t]=="string"?t:null}function en(e){if(e instanceof Date)return{$date:e.toISOString()};if(Array.isArray(e))return e.map(en);let n=Ia(e);return n?{[`$${n}`]:e[n]}:e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,en(r)])):e}function nn(e){let n=Ia(e);if(n){let t=e[n];if(n!=="$date")return{[n.slice(1)]:t};let r=new Date(t);if(Number.isNaN(r.getTime()))throw L(`Invalid $date value "${t}" \u2014 expected an ISO 8601 timestamp`);return r}return Array.isArray(e)?e.map(nn):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,nn(r)])):e}async function oi(e,n,t){let r=Object.hasOwn(fe,n.method)?fe[n.method]:void 0;if(!r)throw new w(404,"unknown_db_method",`Unknown db method "${n.method}" \u2014 expected one of ${Object.keys(fe).join(", ")}`);Ze(`${n.plugin}.db.${n.entityType}.${n.method}`,r);let i=e?.[n.plugin]?.db;if(!i)throw new w(404,"unknown_plugin",`Plugin "${n.plugin}" has no entity store`);let a=Object.hasOwn(i,n.entityType)?i[n.entityType]:void 0,s=a?.[n.method];if(typeof s!="function")throw new w(404,"unknown_entity_type",`Plugin "${n.plugin}" has no entity type "${n.entityType}"`);return s.apply(a,t)}function Ad(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function ii({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,a]of Object.entries(e)){let s=n?.[i];if(Ad(a)){let c=s,l=async u=>{let d=(g,f)=>a.handler(g,f),p=o&&u?.hubVerified!==!0?await o(t,"webhook"):void 0;return!c?.before&&!c?.after?d({...t,key:p},u):(async()=>{let g={...t,key:p},f=c.before?await c.before(g,u):{ctx:g,args:u,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await c.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:a.match,handler:l}}else if(a&&typeof a=="object"){let c={};ii({webhooks:a,hooks:s,ctx:t,webhooksTree:c,keyBuilder:o}),r[i]=c}}}function Sa(e){return e&&typeof e=="object"?e:{}}async function _a(e,n){return G({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Sa(t).workflows;return Array.isArray(r)?r:[]}})}async function Ea(e,n){return G({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>Sa(t).workflow})}async function Ma(e,n){await I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Oa(e,n){await I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Da(e,n){return I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function si(e){return e&&typeof e=="object"?e:{}}async function Ha(e,n){return G({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=si(t).runs;return Array.isArray(r)?r:[]}})}async function Ua(e,n){return G({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=si(t).runs;return Array.isArray(r)?r:[]}})}async function Ba(e,n){return G({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>si(t).run})}async function ai(e,n,t){await I({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var Fa=(e,n)=>ai(e,"approve",n),La=(e,n)=>ai(e,"deny",n),Na=(e,n)=>ai(e,"cancel",n);function $a(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?Ua(t(),{workflowId:r.workflowId,tenantId:n}):Ha(t(),{tenantId:n}),get:r=>Ba(t(),{runId:r,tenantId:n}),approve:r=>Fa(t(),{runId:r,tenantId:n}),deny:r=>La(t(),{runId:r,tenantId:n}),cancel:r=>Na(t(),{runId:r,tenantId:n})}}function Wa(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>Ma(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>_a(t(),{tenantId:n}),get:o=>Ea(t(),{workflowId:o,tenantId:n}),run:(o,i)=>Da(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:$a(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>Oa(t(),{workflowId:o,tenantId:n,name:i})}}function xd(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await wa({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function Id(e,n){let t={};for(let[r,o]of Object.entries(n))t[r]=new Proxy(o,{get(i,a){let s=i[a];if(typeof a!="string"||typeof s!="function")return s;let c=Object.hasOwn(fe,a)?fe[a]:void 0;if(!c)return s;let l=s;return async(...u)=>(Ze(`${e}.db.${r}.${a}`,c),l.apply(i,u))}});return t}function Sd(e,n,t,r,o){return e?_r(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function ci(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:a,manualConfig:s,hubConfig:c,internalConfig:l}=n,u=r??"default",d=l&&t?()=>yn(l,u):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=xd(t,f.id,u,d);if(h?.entities){let U={};for(let[D,Ie]of Object.entries(h.entities)){let Hn=t?_r(t.db,b,D,h.version,Ie,l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o??""}:void 0):Sd(void 0,b,D,h.version,Ie);U[D]=Hn}g[f.id].db=U,p[f.id].db=Id(f.id,U)}let k=f.options,P=f.authConfig,A;if(t&&o&&k?.authType){let U=P?.[k.authType]?.account??[];A=F({authType:k.authType,integrationName:f.id,tenantId:u,kek:o,database:t,extraAccountFields:U,ensureProvisioned:d}),p[f.id].keys=A}let B={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...A?{keys:A,authType:k?.authType}:{},tenantId:u,...l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o}:{},...c?{hub:c}:{}},M=f.endpoints??{},ne=f.hooks,C={...i,...f.errorHandlers},T={},O=f.options?.permissions;ri({endpoints:M,hooks:ne,ctx:B,tree:T,pluginId:f.id,errorHandlers:C,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:O,endpointMeta:f.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:f.oauthConfig,kek:o,tenantId:u}:void 0,hubConfig:c,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy,encryptDataAtRest:l?.encryptDataAtRest===!0}),Object.keys(T).length>0&&(p[f.id].api=T),B.endpoints=T;let N=f.webhooks??{},te=f.webhookHooks;if(Object.keys(N).length>0&&!Bi(k?.authType)){let U={};ii({webhooks:N,hooks:te,ctx:B,webhooksTree:U,keyBuilder:f.keyBuilder}),p[f.id].webhooks=U,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=Ca(c,u),p.workflows=Wa(c,u),p}function qa(e,n,t){let r={};for(let o of e){let i=o.options,a=o.authConfig;if(i?.authType){let s=a?.[i.authType]?.integration??[],c=j({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:s});r[o.id]=c}}return r}var _d=3e4;function yr(e){let n=e.length;for(;n>0&&e[n-1]==="/";)n--;return e.slice(0,n)}function Ed(e){let n=0;for(;n<e.length&&e[n]==="/";)n++;return e.slice(n)}function Md(e,n){return`${yr(e)}/${Ed(n)}`}function Od(e,n){let t=n??{},{error:r,message:o,...i}=t;return typeof r!="string"?new w(e,"internal_error","Internal error"):new w(e,r,o,i)}var ui=Symbol("cloudRequestTimeout");async function z(e,n,t,r){let o=vn(),i=e.fetch??globalThis.fetch,a=e.timeoutMs??_d,s=new AbortController,c,l=new Promise(g=>{c=setTimeout(()=>{s.abort(),g(ui)},a)}),u;try{let g=i(Md(e.baseUrl,t),{method:n,headers:{authorization:`Bearer ${e.apiKey}`,"content-type":"application/json",...o?{"x-corsair-mode":o}:{}},body:r===void 0?void 0:JSON.stringify(r),signal:s.signal}).catch(h=>{if(s.signal.aborted)return ui;throw h}),f=await Promise.race([g,l]);if(f===ui)throw new w(0,"internal_error","Cloud request timed out");u=f}finally{clearTimeout(c)}let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw Od(u.status,p);if(p===void 0)throw new w(u.status,"internal_error","Invalid or empty response body from runtime");return p}var J={invoke:"/:tenant/:plugin/call/:op",entityDb:"/:tenant/:plugin/db/:entity/:method",instances:"/instances",connectLinks:"/connect/links",tenants:"/tenants",tenant:"/tenants/:id",connectionStatus:"/connection-status",disconnect:"/disconnect",permission:"/permissions/:id",permissionLookup:"/permissions/lookup-by-token"};var Dd=new Set(["keys","webhooks"]),Hd=new Set(["chats","workflows"]),li=new Set(["then","catch","finally"]);function ye(e){return typeof e=="function"?e():Promise.resolve(e)}function ja(e,n,t,r){let o=async(...i)=>{let a=await ye(e);return(await z(a,"POST",J.invoke.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":op",r.map(encodeURIComponent).join(".")),{args:i[0]})).data};return new Proxy(o,{get(i,a){if(!(typeof a!="string"||li.has(a)))return ja(e,n,t,[...r,a])}})}function Ud(e,n,t){return new Proxy({},{get(r,o){if(!(typeof o!="string"||li.has(o)))return new Proxy({},{get(i,a){if(typeof a!="string")return;let s=Object.hasOwn(fe,a)?fe[a]:void 0;if(s)return async(...c)=>{Ze(`${t}.db.${o}.${a}`,s);let l=await ye(e),u=await z(l,"POST",J.entityDb.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":entity",encodeURIComponent(o)).replace(":method",encodeURIComponent(a)),{args:en(c)});return nn(u.data)}}})}})}function mr(e,n){let t=e?new Set(e.map(r=>r.id)):null;return new Proxy({},{get(r,o){if(!(typeof o!="string"||li.has(o))){if(Hd.has(o))throw new Error(`"${o}" is not available in cloud mode (deferred)`);if(t&&!t.has(o))throw new Error(`Unknown plugin "${o}"`);return new Proxy({},{get(i,a){if(a==="api")return ja(n.transport,n.tenantId,o,[]);if(a==="db")return Ud(n.transport,n.tenantId,o);if(typeof a=="string"&&Dd.has(a))throw new Error(`"${a}" is not available in cloud mode (deferred)`)}})}}})}function hr(e){return{connect:{createLink:n=>{if(!n.plugin||!n.tenantId)throw new Error('connect.createLink requires both "plugin" and "tenantId" in cloud mode');return ye(e).then(t=>z(t,"POST",J.connectLinks,n))}},tenants:{create:n=>ye(e).then(t=>z(t,"POST",J.tenants,n)),list:()=>ye(e).then(n=>z(n,"GET",J.tenants)),get:n=>ye(e).then(t=>z(t,"GET",J.tenant.replace(":id",encodeURIComponent(n))))},connectionStatus:{get:n=>ye(e).then(t=>z(t,"GET",`${J.connectionStatus}?tenantId=${encodeURIComponent(n.tenantId)}`))},disconnect:n=>ye(e).then(t=>z(t,"POST",J.disconnect,n)),permissions:{get:n=>ye(e).then(t=>"id"in n?z(t,"GET",J.permission.replace(":id",encodeURIComponent(n.id))):z(t,"POST",J.permissionLookup,{token:n.token}))}}}var Re=class extends w{type;retryable;param;docUrl;requestId;constructor(n,t){super(n,t.code,t.message,{...t}),this.name="CloudApiError",this.type=t.type??"api_error",this.retryable=t.retryable??(n===0||n===429||n>=500),this.param=t.param,this.docUrl=t.doc_url,this.requestId=t.request_id}};function tt(e,n,t){let r=t?.get("request-id")?.trim()||void 0,i=(n??{}).error;if(typeof i=="string"){let a=n.message;return new Re(e,{code:i,message:typeof a=="string"?a:void 0,request_id:r})}return i&&typeof i=="object"&&typeof i.code=="string"?new Re(e,{request_id:r,...i}):new Re(e,{code:e===0?"request_failed":"internal_error",message:`Corsair Cloud returned ${e} with no error body`,request_id:r})}var Bd=3e4,Fd=new Set(["GET","HEAD","PUT","DELETE"]),Ld=/^[a-z][a-z0-9-]{0,31}$/;function tn(e,n){if(!Ld.test(e))throw new Error(`${n}: "${e}" is not a valid instance key. Lowercase letter first, then letters, digits or hyphens, up to 32 characters.`)}function rn(e){let n=new URLSearchParams;for(let[r,o]of Object.entries(e))o!==void 0&&n.set(r,String(o));let t=n.toString();return t?`?${t}`:""}function x(e,n){return`${e}/${encodeURIComponent(n)}`}async function br(e,n,t,r,o={}){let i=e.fetch??globalThis.fetch,a=new AbortController;o.signal?.aborted&&a.abort();let s=()=>a.abort();o.signal?.addEventListener("abort",s,{once:!0});let c=setTimeout(()=>a.abort(),e.timeoutMs??Bd),l={authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"};e.apiVersion&&(l["corsair-version"]=e.apiVersion),o.idempotencyKey&&(l["idempotency-key"]=o.idempotencyKey),o.requestId&&(l["x-corsair-request-id"]=o.requestId);let u;try{u=await i(`${e.baseUrl}${t}`,{method:n,headers:l,body:r===void 0?void 0:JSON.stringify(r),signal:a.signal});let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw tt(u.status,p,u.headers);if(p===void 0&&u.status!==204)throw tt(u.status,void 0,u.headers);return p}catch(d){if(o.signal?.aborted||d instanceof Re)throw d;let p=Fd.has(n),g=u?p?!0:void 0:p||!!o.idempotencyKey;throw tt(u?.status??0,{error:{code:"request_failed",message:d instanceof Error?d.message:String(d),retryable:g}},u?.headers)}finally{clearTimeout(c),o.signal?.removeEventListener("abort",s)}}function di(e,n){tn(n,"withInstance");let t=(s,c,l,u)=>br(e,s,c,l,u),r=(...s)=>[n,...s].join(":"),o=s=>rn({...s,instance:n}),i=s=>`${x("/instances",n)}${s}`,a=s=>`${x("/webhooks",r(s))}/deliveries`;return{instanceKey:n,tenants:{list:(s={},c)=>t("GET",`/tenants${o(s)}`,void 0,c),create:(s,c)=>t("POST","/tenants",{...s,instance:n},c),get:(s,c)=>t("GET",x("/tenants",r(s)),void 0,c),update:(s,c,l)=>t("PATCH",x("/tenants",r(s)),c,l),delete:(s,c)=>t("DELETE",x("/tenants",r(s)),void 0,c)},access:{list:(s={},c)=>t("GET",`/access${o(s)}`,void 0,c),get:(s,c)=>t("GET",x("/access",r(s)),void 0,c),set:(s,c,l)=>t("PUT",x("/access",r(s)),c,l),revoke:(s,c)=>t("DELETE",x("/access",r(s)),void 0,c)},connections:{list:(s={},c)=>t("GET",`/connections${o(s)}`,void 0,c),get:(s,c,l)=>t("GET",x("/connections",r(s,c)),void 0,l),delete:(s,c,l)=>t("DELETE",x("/connections",r(s,c)),void 0,l)},connect:{createSession:(s,c)=>t("POST","/connect/sessions",{...s,instance:n},c)},integrations:{list:(s={},c)=>t("GET",`/integrations${o(s)}`,void 0,c),get:(s,c)=>t("GET",x("/integrations",r(s)),void 0,c),put:(s,c,l)=>t("PUT",x("/integrations",r(s)),c,l),delete:(s,c)=>t("DELETE",x("/integrations",r(s)),void 0,c),operations:(s,c)=>t("GET",`${x("/integrations",r(s))}/operations`,void 0,c),oauthApp:{get:(s,c)=>t("GET",`${x("/integrations",r(s))}/oauth-app`,void 0,c),put:(s,c,l)=>t("PUT",`${x("/integrations",r(s))}/oauth-app`,c,l),delete:(s,c)=>t("DELETE",`${x("/integrations",r(s))}/oauth-app`,void 0,c)}},webhooks:{list:(s={},c)=>t("GET",`/webhooks${o(s)}`,void 0,c),create:(s,c)=>t("POST","/webhooks",{...s,instance:n},c),get:(s,c)=>t("GET",x("/webhooks",r(s)),void 0,c),delete:(s,c)=>t("DELETE",x("/webhooks",r(s)),void 0,c),rotateSecret:(s,c,l)=>t("POST",`${x("/webhooks",r(s))}/rotate-secret`,c,l),deliveries:{list:(s,c={},l)=>t("GET",`${a(s)}${rn(c)}`,void 0,l),get:(s,c,l)=>t("GET",x(a(s),c),void 0,l),retry:(s,c,l)=>t("POST",`${x(a(s),c)}/retry`,void 0,l)}},signingSecret:{get:s=>t("GET",i("/signing-secret"),void 0,s),rotate:s=>t("POST",i("/signing-secret/rotate"),void 0,s)},apply:s=>t("POST",i("/apply"),void 0,s),removeFromRuntime:s=>t("POST",i("/remove"),void 0,s),reconcile:s=>t("POST",i("/reconcile"),void 0,s)}}function pi(e){let n=(t,r,o,i)=>br(e,t,r,o,i);return{project:{get:t=>n("GET","/project",void 0,t)},keys:{get:t=>n("GET","/keys",void 0,t),rotate:t=>n("POST","/keys/rotate",void 0,t)},instances:{list:(t={},r)=>n("GET",`/instances${rn(t)}`,void 0,r),create:(t,r)=>(tn(t.instance_key,"instances.create"),n("POST","/instances",t,r)),get:(t,r)=>(tn(t,"instances.get"),n("GET",x("/instances",t),void 0,r)),update:(t,r,o)=>(tn(t,"instances.update"),n("PATCH",x("/instances",t),r,o)),delete:(t,r)=>(tn(t,"instances.delete"),n("DELETE",x("/instances",t),void 0,r))},integrations:{catalog:(t={},r)=>n("GET",`/integrations/catalog${rn(t)}`,void 0,r)},mcp:{links:{list:(t={},r)=>n("GET",`/mcp/links${rn(t)}`,void 0,r),mint:(t,r)=>n("POST","/mcp/links",t,r),get:(t,r)=>n("GET",x("/mcp/links",t),void 0,r),update:(t,r,o)=>n("PATCH",x("/mcp/links",t),r,o),delete:(t,r)=>n("DELETE",x("/mcp/links",t),void 0,r),rotate:(t,r)=>n("POST",`${x("/mcp/links",t)}/rotate`,void 0,r)},tokens:{mint:(t,r)=>n("POST","/mcp/tokens",t,r)}}}}var Ka="default",Nd="corsairCloud: the management API needs a ck_cloud_<slug>.<secret> key, or an explicit `managementUrl`.",$d=new Set(["then","catch","finally","toString","toJSON","valueOf","constructor","inspect",Symbol.toPrimitive,Symbol.toStringTag,Symbol.iterator,Symbol.asyncIterator]);function gi(e={}){return new Proxy(e,{get(n,t,r){if(Reflect.has(n,t))return Reflect.get(n,t,r);if(!$d.has(t))throw new Error(Nd)}})}function Ae(e){throw new Error(`"${e}" is not available in cloud mode (deferred)`)}function Wd(e){let n=e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim();if(!n)throw new Error("Cloud mode (ck_cloud_ key) requires a base URL \u2014 set hub.baseUrl or CORSAIR_CLOUD_URL.");return Fn(n),n}function Za(e){return!!(e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim())}function qd(e,n){let t=hr(e);return{ok:()=>Ae("manage.ok"),tenants:t.tenants,plugins:{list:()=>Ae("manage.plugins.list"),get:()=>Ae("manage.plugins.get")},connectionStatus:{get:r=>{let o=r?.tenantId||void 0;if(!o&&n)throw new Error("connectionStatus.get requires a tenantId in multi-tenant mode");return t.connectionStatus.get({tenantId:o??Ka})}},permissions:t.permissions,connect:{createLink:t.connect.createLink,resolve:()=>Ae("manage.connect.resolve"),oauthCallback:()=>Ae("manage.connect.oauthCallback")},disconnect:t.disconnect}}function jd(e,n){let t=qd(e,n.multiTenancy);if(n.multiTenancy)return{withTenant:a=>{if(!a)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return mr(n.plugins,{transport:e,tenantId:a})},get keys(){return Ae("keys")},get permissions(){return Ae("permissions")},manage:t};let r=mr(n.plugins,{transport:e,tenantId:Ka}),o={manage:t,get keys(){return Ae("keys")},get permissions(){return Ae("permissions")}};return new Proxy(r,{get(a,s,c){return typeof s=="string"&&s in o?Reflect.get(o,s,c):Reflect.get(a,s,c)}})}function Ga(e){return jd({baseUrl:Wd(e.hub),apiKey:e.hub.projectApiKey},{multiTenancy:!!e.multiTenancy,plugins:e.plugins})}function Kd(e){let n=yr(e),t="/api/corsair";return n.endsWith(t)?n.slice(0,-t.length):n}async function Zd(e){let n=await z({...e,baseUrl:Kd(e.baseUrl)},"GET",J.instances),t=new Map;for(let r of n.instances)Fn(r.url,`Instance "${r.instanceKey}" URL`),t.set(r.instanceKey,r.url);return t}function Gd(e){let n=e.apiKey?.trim();if(!n)throw new Error("corsairCloud: apiKey is required");let t=Si(n),r=e.url?.trim()||_i(n);if(!r)throw new Error("corsairCloud: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");Fn(r);let o={baseUrl:r,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs},a=(yr(e.managementUrl?.trim()??"")||void 0)??(t?Ei(r,t):null);a&&Fn(a,"Management base URL");let s=a?{baseUrl:a,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs,apiVersion:e.apiVersion}:null,c=null;function l(g){return g&&c===g&&(c=null),c||(c=Zd(o).catch(f=>{throw c=null,f})),c}async function u(g){let f=l(),b=(await f).get(g)??(await l(f)).get(g);if(b)return b;let k=[...(await l()).keys()].join(", ");throw new Error(`corsairCloud.withInstance("${g}"): no such instance \u2014 available: ${k||"(none)"}`)}let d=hr(o),p={tenants:d.tenants,permissions:d.permissions};return{manage:s?{...pi(s),...p}:gi(p),withInstance:g=>{let f=s?di(s,g):gi(),h=async()=>({...o,baseUrl:await u(g)}),b=hr(h),k={withTenant(P){if(!P)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return mr(void 0,{transport:h,tenantId:P})},connectionStatus:b.connectionStatus,disconnect:b.disconnect,createConnectLink:b.connect.createLink};return s?{...f,...k}:gi(k)}}}var zd="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function za(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${zd}`),t):n}var Jd=e=>new w(404,"unknown_plugin",`Plugin '${e}' is not registered.`),Vd=(e,n)=>new w(404,"unknown_op",`Operation '${n}' not found on plugin '${e}'.`),kr=(e="/call")=>new w(403,"call_disabled",`The ${e} route is disabled. Construct managementHandler with { unsafeAllowUnauthenticated: true } to enable it \u2014 only when your own backend fronts the handler.`),Yd=e=>new w(401,"not_connected",`Tenant is not connected for plugin '${e}'. Reconnect and retry.`),Ja=e=>new w(403,"permission_denied",`The call was blocked (${e}).`,{reason:e}),Qd=()=>new w(403,"approval_required","This action needs human approval before it can run. Approval is not resumable over HTTP in this version.",{reason:"pending"}),Xd=(e,n)=>new w(502,"provider_error","The provider returned an error.",{providerStatus:e,body:n});function ep(e,n){if(e instanceof w)return e;if(e instanceof _)return Yd(e.pluginId||n);if(e instanceof Pn)return Ja("readonly");if(e instanceof le)return e.reason==="pending"?Qd():Ja(e.reason);if(e instanceof Error&&e.name==="ApiError"){let t=e;return Xd(typeof t.status=="number"?t.status:502,t.body)}return console.error("[corsair] unhandled error in call operation",e),new w(500,"internal_error","Internal error")}var np=new WeakMap,Va=new WeakMap,tp=512;function Ya(e,n){let t=e.get(n);return t||(t=new Map,e.set(n,t)),t}function rp(e,n,t){if(n.size<=tp)return;let r=Va.get(e);for(let o of n.keys())if(o!==t&&(r?.get(o)??0)===0){n.delete(o);return}}function op(e,n,t){if(!n.multiTenancy)return{client:e};let r=typeof t=="string"?t.trim():"";if(!r)throw L("tenant is required for a multi-tenant runtime",{missingFields:["tenant"]});let o=Ya(np,e),i=o.get(r);if(i)return o.delete(r),o.set(r,i),{client:i,tenantId:r};let a=e.withTenant(r);return o.set(r,a),rp(e,o,r),{client:a,tenantId:r}}function ip(e,n){let t=e;for(let r of n.split(".")){if(t==null||typeof t!="object"||!Object.prototype.hasOwnProperty.call(t,r))return null;t=t[r]}return typeof t=="function"?t:null}function Qa(e,n=[]){let t=[];for(let[r,o]of Object.entries(e??{}))typeof o=="function"?t.push([...n,r].join(".")):o&&typeof o=="object"&&t.push(...Qa(o,[...n,r]));return t}function Xa(e){let n={};for(let t of e.plugins)n[t.id]=Qa(t.endpoints??{});return n}async function fi(e,n,t,r){if(!n.plugins.some(s=>s.id===t.plugin))throw Jd(t.plugin);let{client:o,tenantId:i}=op(e,n,t.tenant),a=i?Ya(Va,e):null;a&&i&&a.set(i,(a.get(i)??0)+1);try{return await r(o)}catch(s){throw ep(s,t.plugin)}finally{if(a&&i){let s=(a.get(i)??1)-1;s<=0?a.delete(i):a.set(i,s)}}}async function ec(e,n,{plugin:t,op:r,tenant:o,args:i}){return fi(e,n,{plugin:t,tenant:o},a=>{let s=a[t],c=ip(s?.api,r);if(!c)throw Vd(t,r);return c(i??{})})}function on(e,n){if(e===void 0)return n;if(e===null)throw new w(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function rt(e){if(e!==void 0)throw new w(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var rc=[{method:"GET",pattern:"/ok",public:!0,handler:async()=>S(200,Lt())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>(rt(n),S(200,await An(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>(rt(t),S(201,await Wt(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(rt(t),S(200,await $t(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>S(200,await Rn(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>S(200,await Nt(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>S(200,await qt(e,on(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(rt(t),S(200,await io(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",public:!0,handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?S(200,await ao(e,t)):S(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=on(r,o.tenantId);return S(200,await Kt(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",public:!0,handler:async({corsair:e,internal:n,query:t})=>S(200,await Zt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",public:!0,handler:async({corsair:e,internal:n,body:t})=>S(200,await Gt(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=on(t,n.tenantId)??"default",o=e.database?await ni(e.database,r,void 0,void 0,e.encryptDataAtRest?e.kek:void 0):null;return S(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=on(t,r?.tenantId)??"default";return e.database&&await Ra(e.database,o,void 0,r?.plugin,e.encryptDataAtRest?e.kek:void 0,e.encryptDataAtRest),S(200,{ok:!0})}},{method:"POST",pattern:"/disconnect",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n??{},o=on(t,r.tenantId);return S(200,await jt(e,{...r,tenantId:o}))}},{method:"GET",pattern:"/call",handler:async({internal:e,allowCall:n})=>{if(!n)throw kr();return S(200,{plugins:Xa(e)})}},{method:"POST",pattern:"/:tenant/:plugin/db/:entityType/:method",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw kr("/db");rt(i);let s=o??{};if(s.args!==void 0&&!Array.isArray(s.args))throw L("args must be an array");let c=on(i,r.tenant),l=nn(s.args??[]),u=await fi(e,n,{plugin:r.plugin,tenant:c},d=>tc(t,()=>oi(d,{plugin:r.plugin,entityType:r.entityType,method:r.method},l)));return S(200,{data:en(u)})}},{method:"POST",pattern:"/:tenant/:plugin/call/:op",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw kr();let s=o??{},c=on(i,r.tenant),l=await tc(t,()=>ec(e,n,{plugin:r.plugin,op:r.op,tenant:c,args:s.args}));return S(200,{data:l})}}];(()=>{let e=new Set;for(let n of rc){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function sp(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let a=t[i],s=r[i];if(a.startsWith(":"))o[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return o}function ap(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function cp(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await lr(e,n).catch(o=>{throw o instanceof w?o:new w(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new w(400,"invalid_json","Request body is not valid JSON")}}var up="/api/corsair",nc=new Set(["open","cautious","strict","readonly"]);function tc(e,n){let t=e.headers.get("x-corsair-mode");if(t===null)return n();if(!nc.has(t))throw L(`Unknown permission mode "${t}" \u2014 expected one of ${[...nc].join(", ")}`);return Ut(t,n)}function K(e,n={}){let t=n.basePath??up,r=Je(n.maxBodyBytes),o=Ve(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},a=R(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async s=>{try{let c=s.headers.get("content-length");if(c!==null&&Number(c)>r)throw _n(r);let l=new URL(s.url),u=ap(l.pathname,t),d=s.method.toUpperCase();if(d==="OPTIONS"||u==="/"||u==="")return await Ye(e,s,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return S(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(l.searchParams);for(let g of rc){if(g.method!==d)continue;let f=sp(g.pattern,u);if(!f)continue;if(!g.public&&n.authenticate&&!await n.authenticate(s))return S(401,{error:"unauthorized",message:"invalid or missing credentials"});let h=await cp(s,i),b=n.resolveTenant?await n.resolveTenant(s):void 0;return await g.handler({corsair:e,internal:a,req:s,params:f,query:p,body:h,scopedTenant:b,allowCall:(n.unsafeAllowUnauthenticated??!1)||!!n.authenticate})}throw Ue(`No route for ${d} ${u}`)}catch(c){if(n.onError){let u=await n.onError(c,s);if(u)return u}if(c instanceof w)return de(c);let l=c instanceof Error?c.message:"Internal server error";return S(500,{error:"internal_error",message:l})}}}function lp(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function dp(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function pp(e,n,t){let r=[],o=0,i=e();try{let a=await ur(()=>i.next(),t);for(;a.done!==!0;){let s=dp(a.value);if(o+=s.byteLength,o>n)throw _n(n);r.push(s),a=await ur(()=>i.next(),t)}return Buffer.concat(r)}catch(a){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw a}}var oc=!1;function gp(){oc||(oc=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function fp(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=Je(n.maxBodyBytes),o=Ve(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(gp(),i=JSON.stringify(e.body));else{let s=e[Symbol.asyncIterator];if(typeof s!="function")return;let c=await pp(s.bind(e),r,o);c.length>0&&(i=c)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw _n(r);return typeof i=="string"?i:i}function Q(e){e.resume?.()}async function Fe(e,n={}){let t=lp(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,a=new Headers;for(let[l,u]of Object.entries(e.headers))if(u!=null&&!yp.has(l.toLowerCase()))if(Array.isArray(u))for(let d of u)a.append(l,d);else a.set(l,u);let s={method:(e.method??"GET").toUpperCase(),headers:a},c=await fp(e,n);return c!==void 0&&(s.body=c,a.has("content-type")||a.set("content-type","application/json")),new Request(i,s)}async function X(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var yp=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function ic(e,n){let t=K(e,n);return async(r,o,i)=>{try{let a=await t(await Fe(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await X(o,a)}catch(a){if(a instanceof w&&o.headersSent!==!0){await X(o,de(a)),Q(r);return}Q(r),i(a)}}}function mp(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function hp(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=mp(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function sc(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function ac(e,n){let t=K(e,n);return async(r,o)=>{hp(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let a=await t(await Fe(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await X(o.raw,a)}catch(a){if(a instanceof w&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await X(o.raw,de(a)),Q(i);return}throw Q(i),a}}}function cc(e,n){let t=K(e,n);return r=>t(r.req.raw)}function uc(e,n){let t=K(e,n);return{GET:t,POST:t,OPTIONS:t}}function lc(e,n){let t=K(e,n);return async(r,o)=>{try{let i=await t(await Fe(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await X(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),Q(r);return}if(i instanceof w){await X(o,de(i)),Q(r);return}console.error("[corsair] management handler failed:",i),await X(o,S(500,{error:"internal_error"})),Q(r)}}}function wr(e,n){let t=K(e,n);return r=>t(r.request)}function dc(e,n){let t=wr(e,n);return{GET:t,POST:t,OPTIONS:t}}function pc(e,n){let t=wr(e,n);return{loader:t,action:t}}function gc(e,n){let t=wr(e,n);return{GET:t,POST:t,OPTIONS:t}}function fc(e,n){let t=wr(e,n);return{GET:t,POST:t,OPTIONS:t}}function yc(e,n){let t=K(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await Fe(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await X(r.node.res,i)}catch(i){if(i instanceof w&&r.node.res.headersSent!==!0){await X(r.node.res,de(i)),Q(o);return}throw Q(o),i}}}function mc(e,n){return K(e,n)}function hc(e){let n={[ot]:e};return{ok:Lt,tenants:{list:()=>An(e),create:t=>Wt(e,t),get:t=>$t(e,t)},plugins:{list:()=>Rn(e),get:t=>Nt(e,t)},connectionStatus:{get:t=>qt(e,t?.tenantId)},permissions:{get:t=>Ls(e,t)},connect:{createLink:t=>Kt(n,e,t),resolve:t=>Zt(n,e,t),oauthCallback:t=>Gt(n,e,t)},disconnect:t=>jt(e,t)}}async function bc(e,n,t,r,o="pending",i){if(i==="")throw new Error("encryptDataAtRest requires kek");if(!e)return null;try{let a=un(),s=new Date,c=i?gt(r,await Nn(e.db,n,i)):r;return await e.db.insertInto("corsair_events").values({id:a,created_at:s,updated_at:s,account_id:n,event_type:t,payload:c,status:o}).execute(),a}catch(a){return console.warn("Failed to log event:",a),null}}async function bp(e,n,t,r="pending"){if(e.encryptDataAtRest&&!e.kek)throw new Error("encryptDataAtRest requires kek");try{let o=await e.$getAccountId();return bc(e.database,o,n,t,r,e.encryptDataAtRest?e.kek:void 0)}catch(o){return console.warn("Failed to log event:",o),null}}import*as wc from"https";import*as Cr from"querystring";var kp=["expires_in","refresh_token_expires_in"];function kc(e){let n={...e};for(let t of kp){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function wp(e){try{return kc(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=Cr.parse(e);return!n.access_token&&!n.error?null:kc({...n})}function xt(e,n,t,r,o){let i=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,c)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};a||(l.client_id=n,l.client_secret=t);let u=Cr.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(u).toString()};a&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=wc.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){c(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=wp(f);h?s(h):c(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>c(new Error(`Request failed: ${g.message}`))),p.write(u),p.end()})}async function Cc(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[a,s,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(En({accessToken:a,expiresAt:s,forceRefresh:n?.forceRefresh}))return{accessToken:a,expiresAt:Number(s),refreshed:!1};if(!c)throw new _(o,"oauth_2");let l=await I({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:c},parseResponse:ln}),u=await Mn(t,l,s);return{accessToken:l.access_token,expiresAt:u,refreshed:!0}}async function Tc(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:a="form",extraParams:s}=e,c={grant_type:"refresh_token",refresh_token:t,...s},l={Accept:"application/json"};i==="basic"?l.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?l.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(c.client_id=o),c.client_secret=r),a==="json"?l["Content-Type"]="application/json":l["Content-Type"]="application/x-www-form-urlencoded";let u=await fetch(n,{method:"POST",headers:l,body:a==="json"?JSON.stringify(c):new URLSearchParams(c)});if(!u.ok)throw new Error(`OAuth token refresh failed (${u.status}): ${await u.text()}`);let d=JSON.parse(await u.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function Pc(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new _(n.plugin,"oauth_2");let l={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},u=g=>Qe(e.keys,r,async()=>(await Cc(l,{forceRefresh:g})).accessToken);e._refreshAuth=()=>u(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return En({accessToken:d,expiresAt:p})?d:u(!1)}let o=t.client_secret,i=t.client_id,a=l=>Qe(e.keys,r,async()=>{let[u,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!l&&En({accessToken:u,expiresAt:d}))return u;if(!p)throw new _(n.plugin,"oauth_2");let g=await Tc({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await Mn(e.keys,g,d),g.access_token});e._refreshAuth=()=>a(!0);let[s,c]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return En({accessToken:s,expiresAt:c})?s:a(!1)}var vc="  ";function ae(e){let n=e;return n._def??n.def??{}}function ce(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function se(e){return e.innerType??e.schema??e.out??e.in}function Ac(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return se(e)}}function xc(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Pr(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function On(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function Ic(e,n){return e.description??n.description}function Tp(e){let n=e;for(;n;){let t=ae(n),r=Ic(n,t);if(r)return r;let o=ce(t);if(ki(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=Ac(t,o);continue}break}}function ki(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function ee(e){let n=ae(e),t=ce(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??On(n)[0]??"unknown");case"ZodEnum":return On(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=se(n);return r?ee(r):"unknown"}case"ZodNullable":{let r=se(n);return`${r?ee(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=se(n);return r?ee(r):"unknown"}case"ZodArray":{let r=xc(n);if(!r)return"unknown[]";let o=ae(r),i=ce(o)==="ZodUnion",a=ee(r);return`${i?`(${a})`:a}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Pr(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([a,s])=>{let c=ce(ae(s));return`${c==="ZodOptional"||c==="ZodNullable"?a+"?":a}: ${ee(s)}`}).join(", ")} }`}case"ZodUnion":return On(n).map(r=>ee(r)).join(" | ");case"ZodIntersection":return`${ee(n.left)} & ${ee(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=Ac(n,t);return r?ee(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function xe(e){let n=ae(e),t=ce(n),r=Ic(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??On(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=On(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=se(n),i=o?xe(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=se(n),i=o?xe(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=se(n);return o?{...xe(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=xc(n);return{kind:"array",optional:!1,description:r,items:o?xe(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=Pr(e,n),i={};for(let[a,s]of Object.entries(o))i[a]=xe(s);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=On(n);for(let i of o){let a=ae(i);if(ce(a)==="ZodObject")return{...xe(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=se(n);return o?{...xe(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function cv(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),a=e.find(u=>u.id===o);if(!a)return null;let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=Le(a.endpointMeta,s),l=Le(a.endpointSchemas,s);return!c&&!l?null:{input:l?.input?xe(l.input):null,output:l?.output?xe(l.output):null,description:c?.description}}var wi=["equals","contains","startsWith","endsWith","in"],Pp=["equals","gt","gte","lt","lte","in"],vp=["equals"],Rp=["equals","before","after","between"];function Sc(e){let n=ae(e);switch(ce(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=se(n);return r?Sc(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function Ci(e){let n=ae(e),t=ce(n);if(ki(t)){let i=se(n);return i?Ci(i):{}}if(t!=="ZodObject")return{};let r=Pr(e,n),o={};for(let[i,a]of Object.entries(r)){let s=Sc(a);s==="string"?o[i]={type:"string",operators:wi}:s==="number"?o[i]={type:"number",operators:Pp}:s==="boolean"?o[i]={type:"boolean",operators:vp}:s==="date"&&(o[i]={type:"date",operators:Rp})}return o}function _c(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function mi(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&mi(o,i,t)}}function hi(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function bi(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];hi(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&bi(o,i,t)}}function Ti(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!o)return null;let[i,a]=o;if(r.length===0)return hi(a)?[i]:null;if(a!==null&&typeof a=="object"&&!hi(a)){let s=Ti(a,r);if(s!==null)return[i,...s]}return null}function Ec(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let a="    ".repeat(i+2);t.push(`${a}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let a="    ".repeat(i+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var Ap=new Set(ft);function sn(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(s=>s.id===r);if(!i)return Ap.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:sn(e);if(t==="webhooks"){if(!i.webhooks)return[];let s=[];return bi(i.webhooks,[],s),s.map(c=>`${i.id}.webhooks.${c}`)}if(t==="db"){let s=i.schema?.entities;return s?Object.keys(s).map(c=>`${i.id}.db.${c}.search`):[]}if(!i.endpoints)return[];let a=[];return mi(i.endpoints,[],a),a.map(s=>`${i.id}.api.${s}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let a=[];bi(i.webhooks,[],a),o[i.id]=a.map(s=>`${i.id}.webhooks.${s}`)}else if(t==="db")for(let i of e){let a=i.schema?.entities;a&&(o[i.id]=Object.keys(a).map(s=>`${i.id}.db.${s}.search`))}else for(let i of e){if(!i.endpoints)continue;let a=[];mi(i.endpoints,[],a),o[i.id]=a.map(s=>`${i.id}.api.${s}`)}return o}function Le(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function xp(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),a=i.startsWith(".")?i.slice(1):i;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function yi(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function uv(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),a=e.find(s=>s.id===o);if(a){if(i.startsWith("db.")){let u=i.slice(3),d=u.lastIndexOf(".");if(d!==-1){let p=u.slice(0,d),g=u.slice(d+1),f=a.schema?.entities;if(g==="search"&&f){let h=_c(f,p);if(h){let[b,k]=h,P=Ci(k),A=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${wi.join(", ")}]`];for(let[B,M]of Object.entries(P))A.push(`  ${B}?: ${M.type}  [${M.operators.join(", ")}]`);return A.push("}"),A.join(`
+`)}}}return yi(sn(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let u=i.slice(9);if(a.webhooks){let d=Ti(a.webhooks,u.split("."));if(d!==null){let p=d.join("."),g=Le(a.webhookSchemas,p.toLowerCase()),f=g?.response?ee(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${Tr(Dn(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${Ec(o,d)}`),h.join(`
+
+`)}}return yi(sn(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=Le(a.endpointMeta,s),l=Le(a.endpointSchemas,s);if(c||l){let u=[],d=[c?.riskLevel?`[${c.riskLevel}]`:"",c?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[c?.description,d].filter(Boolean).join("  ");return p&&u.push(p),l?.input&&u.push(`input ${Tr(Dn(l.input))}`),l?.output&&u.push(`output ${Tr(Dn(l.output))}`),u.join(`
+
+`)}}}return yi(sn(e),"Path not found. Available operations")}function Rc(e){let n=e;for(;;){let t=ae(n),r=ce(t);if(ki(r)){let o=se(t);if(!o)return n;n=o;continue}return n}}function Dn(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=Rc(e),t=ae(n);if(ce(t)==="ZodObject"){let o=Pr(n,t),i=[];for(let[a,s]of Object.entries(o)){let c=ae(s),l=ce(c),u=l==="ZodOptional"||l==="ZodNullable",d=Rc(s),p=Tp(s);i.push({key:a,optional:u,type:ee(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:ee(n)}}function Tr(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=vc.repeat(n+1),r=vc.repeat(n);return`{
+${e.fields.map(i=>{let a=i.optional?`${i.key}?`:i.key,s=i.description?`  // ${i.description}`:"";return`${t}${a}: ${i.type}${s}`}).join(`
+`)}
+${r}}`}return"unknown"}function Ip(e,n){let t=sn(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(u=>u.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let u of t){let{shortPath:d,lookupKey:p}=xp(u,n),g=Le(r.endpointMeta,p),f=Le(r.endpointSchemas,p);!g&&!f||o.push({path:u,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Dn(f?.input),output:Dn(f?.output)})}o.sort((u,d)=>u.path.localeCompare(d.path));let i=[],a=sn(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let u of a){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=Ti(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=Le(r.webhookSchemas,b.toLowerCase()),P=k?.response?ee(k.response):void 0;i.push({path:u,description:k?.description,payload:Dn(k?.payload),responseType:P,usageExample:Ec(n,h)})}i.sort((u,d)=>u.path.localeCompare(d.path));let s=[],c=sn(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(c)&&l)for(let u of c){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let P=_c(l,b);if(!P)continue;let[A,B]=P,M=Ci(B),ne=Object.entries(M).map(([C,T])=>({field:C,type:T.type,operators:T.operators}));s.push({path:u,entityName:A,filters:[{field:"entity_id",type:"string",operators:wi},...ne]})}return s.sort((u,d)=>u.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:s}}}import{randomUUID as Mc}from"crypto";async function Sp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Mc(),o=Mc(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as _p}from"crypto";var vr="https://graph.microsoft.com/v1.0",Pi=2e4,Ep=60;async function Mp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${vr}/subscriptions`,{headers:r,signal:AbortSignal.timeout(Pi)});if(c.ok){let{value:l}=await c.json(),u=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(u.map(d=>fetch(`${vr}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(Pi)}).catch(()=>{})))}}catch{}let o=_p(),i=new Date(Date.now()+Ep*6e4).toISOString(),a=await fetch(`${vr}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(Pi),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!a.ok)throw new Error(`MS Graph subscribe failed (${a.status}): ${await a.text()}`);let s=await a.json();return s.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:s.id},webhookSecret:o}):null}function Oc(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function Op(e,n){let t=Oc(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function Dp(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function Dc(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function Hc(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function it(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function Hp(e){return it(e.body)}function Uc(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Rr(Array.isArray(r)?r:[r])}function Bc(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let l=Rr(Array.isArray(c)?c:[c]);if(l)return decodeURIComponent(l)}let r=Uc({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let l=n[c],u=Array.isArray(l)?l[0]:l;if(!(!u||typeof u!="string"))try{let p=(u.startsWith("http")?new URL(u):new URL(`https://example.invalid${u.startsWith("/")?u:`/${u}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=it(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Rr([a?.validationToken])??null}function Up(e){if(Bc(e))return!0;let n=it(e.body??e.payload);return Dc(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Rr(e){for(let n of e){let t=Hc(n);if(t)return t}}function Bp(e){let t=it(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var ot=Symbol.for("corsair:internal");function $c(e){if(e.hub?.projectApiKey?.startsWith("ck_cloud_")&&Za(e.hub))return Ga(e);let n=e.database?Oi(e.database,{dbTables:e.dbTables}):void 0,t=e.kek??"",r=n&&t?qa(e.plugins,n,t):gr(!!n,!!t),o=za(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?Ct(e.hub):void 0,encryptDataAtRest:e.encryptDataAtRest===!0},a=Os(n),s=hc(i);if(e.multiTenancy){let u=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=ci(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[ot]:i})},keys:r,permissions:a,manage:s},{[ot]:i});return Fc(u,i.hub),Nc(u,i.hub),u}let c=ci(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},c,{keys:r,permissions:a,manage:s,[ot]:i});return Fc(l,i.hub),Nc(l,i.hub),l}function Fc(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-TX5YA3Q3.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function Fp(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var Lc=globalThis.__corsairTunnels??=new Set,Lp=1e3,Np=3e4;function $p(e){let n=e.schedule??((a,s)=>void setTimeout(a,s).unref?.()),t=e.minDelayMs??Lp,r=e.maxDelayMs??Np,o=t,i=()=>{let a=!1,s=()=>{a||(a=!0,n(i,o),o=Math.min(o*2,r))};e.start(s).then(()=>{o=t}).catch(s)};i()}function Nc(e,n){if(!Fp(n))return;let t=n.projectApiKey;if(Lc.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}Lc.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Er;$p({start:a=>import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:a})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Mr}`)}).catch(s=>{throw console.warn(`[corsair] tunnel down: ${s instanceof Error?s.message:String(s)}. Retrying \u2014 run \`corsair setup\` if it doesn't recover.`),s})})}var Wp={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},vi=Wp;async function It(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},a=n?.caller??"script",s=Hi(e);if(!s)throw new Error("setupCorsair: invalid corsair instance");if(!s.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=eg(e,s.plugins,n),l={...s,database:s.database},u=l.database.db;await rg(l.database,i);let d=await og(u,l,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await ag(e,c,n.credentials,l,o,i);let p=await ug(d,c,o,a);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=$c({plugins:s.plugins,database:u,kek:s.kek,multiTenancy:!0,...s.encryptDataAtRest?{encryptDataAtRest:!0}:{}}).withTenant(c.tenantId);await lg(g,s.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function Ri(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...Z[n][t],...r])}function Xp(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(s=>s.id===t);if(!o)continue;let i=E(o);if(!i)continue;let a=Ri(o,i,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function eg(e,n,t){let r=Ui(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Xp(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function qc(e,n){return _e(e)?n===0?!0:Object.values(e).every(t=>qc(t,n-1)):!1}function ng(e){return qc(e,4)}var tg=Wi;function Ar(e){if(e instanceof zp){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Qp?Ar(r):"unknown";return n}return e instanceof Zp?`${Ar(e.unwrap())} | null`:e instanceof Jp?`${Ar(e.unwrap())} | undefined`:e instanceof Kp?e.options.join(" | "):e instanceof Yp?"string":e instanceof Gp?"number":e instanceof qp?"boolean":e instanceof jp?"date":e instanceof Vp?"jsonb":"unknown"}async function rg(e,n){let t=await e.db.introspection.getTables(),r=new Set(t.map(i=>i.name)),o=e.tableNames??Mi();for(let[i,a]of Object.entries(tg)){let s=o[i];if(!r.has(s)){let c=s!==i?` (dbTables.${i} \u2192 "${s}")`:"";n(`[corsair:setup] Table "${s}" does not exist${c}. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(Ar(a),null,2)}`)}}}async function og(e,n,t,r,o){let i=new Date,a=new Map;for(let s of n.plugins){let c=s.id,l=E(s),u=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!u){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),u=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=l?s.authConfig?.[l]?.integration??[]:[],p=l?s.authConfig?.[l]?.account??[]:[],g=l&&u?j({authType:l,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(u&&!u.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!u||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",u.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:u.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&F({authType:l,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}a.set(c,{pluginId:c,authType:l,integration:g,account:f,integrationFields:[...Z[l].integration,...d],accountFields:r?[...Z[l].account,...p]:[]})}return a}function ig(e){if(!_e(e))return;let n=e.keys;return _e(n)?n:void 0}function sg(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function ag(e,n,t,r,o,i){let a=ig(e),s=n.provisionAccounts?sg(e,n.tenantId):void 0;for(let[c,l]of Object.entries(t)){let u=r.plugins.find(k=>k.id===c);if(!u){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=E(u);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=Ri(u,d,"integration"),g=Ri(u,d,"account"),f=a?.[c],h=s?.[c],b=_e(h)?h.keys:void 0;for(let[k,P]of Object.entries(l))if(P){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let A=re(f,`set_${k}`);if(!A){i(`[corsair:setup] Cannot set integration field '${k}' for '${c}'.`);continue}await A(P),o(`[corsair:setup] Set ${c} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${k}' on a multi-tenant instance`);let A=re(b,`set_${k}`);if(!A){i(`[corsair:setup] Cannot set account field '${k}' for '${c}'.`);continue}await A(P),o(`[corsair:setup] Set ${c} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${c}'.`)}}}var Wc=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function cg(e,n,t,r,o,i,a,s,c){let l=[],u=[];for(let p of o){if(Wc.has(p))continue;let g=re(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(Wc.has(p))continue;let g=re(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}let d=l.length===0&&u.length===0;if(n==="managed_pricing")s(`[corsair:setup] '${e}' (managed_pricing) uses Corsair metered credentials via Hub \u2014 nothing to store in your database. Pass hub: { ... } to createCorsair().`);else if(d)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...u];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of u){let h=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}s(g.join(`
+`))}}return d}async function ug(e,n,t,r){let o=new Set;for(let i of e.values())await cg(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function lg(e,n,t,r,o){if(!ng(vi)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=vi,a=new Set(n.map(s=>s.id));for(let[s,c]of Object.entries(i)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let l=_e(e)?e[s]:void 0,u=_e(l)?l.api:void 0;if(u)for(let[d,p]of Object.entries(c))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${d}.${g}...`);try{let h=_e(u)?u[d]:void 0;await re(h,g)?.(f)}catch(h){o(`[corsair:setup] ${s} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{qi as a,Ee as b,we as c,yt as d,mt as e,ht as f,ln as g,ji as h,Or as i,Nr as j,$n as k,Xi as l,es as m,Me as n,We as o,Ce as p,pn as q,gn as r,Oe as s,Wr as t,ts as u,jn as v,Te as w,Kn as x,qr as y,Ct as z,q as A,Tt as B,fn as C,j as D,F as E,is as F,ss as G,It as H,ag as I,He as J,Kr as K,hn as L,kn as M,Gr as N,At as O,ms as P,Ke as Q,Y as R,zr as S,zn as T,ws as U,_u as V,St as W,Ry as X,Ps as Y,vs as Z,Rs as _,As as $,_t as aa,Jr as ba,le as ca,Mt as da,Ot as ea,Pn as fa,Ut as ga,vn as ha,to as ia,Es as ja,Bt as ka,Ze as la,w as ma,uo as na,lo as oa,zt as pa,po as qa,xn as ra,In as sa,Jt as ta,Vt as ua,Jn as va,go as wa,fo as xa,Yt as ya,Vn as za,Qt as Aa,Xt as Ba,Be as Ca,Sn as Da,Ks as Ea,ko as Fa,wo as Ga,ze as Ha,Xn as Ia,et as Ja,sr as Ka,Po as La,nt as Ma,Ul as Na,$l as Oa,jl as Pa,na as Qa,ta as Ra,cr as Sa,ra as Ta,oa as Ua,Je as Va,Ve as Wa,xo as Xa,Io as Ya,So as Za,_o as _a,Eo as $a,Ye as ab,_ as bb,Mo as cb,la as db,dr as eb,Ho as fb,pr as gb,pa as hb,ha as ib,Fo as jb,Lo as kb,No as lb,$o as mb,Wo as nb,qo as ob,jo as pb,Ko as qb,Zo as rb,Go as sb,zo as tb,Jo as ub,Vo as vb,Yo as wb,Qo as xb,Xe as yb,fe as zb,en as Ab,nn as Bb,oi as Cb,Re as Db,Gd as Eb,K as Fb,ic as Gb,sc as Hb,ac as Ib,cc as Jb,uc as Kb,lc as Lb,dc as Mb,pc as Nb,gc as Ob,fc as Pb,yc as Qb,mc as Rb,bc as Sb,bp as Tb,xt as Ub,Pc as Vb,cv as Wb,sn as Xb,uv as Yb,Tr as Zb,Ip as _b,Sp as $b,vr as ac,Mp as bc,Oc as cc,Op as dc,Dp as ec,Dc as fc,Hc as gc,it as hc,Hp as ic,Uc as jc,Bc as kc,Up as lc,Rr as mc,Bp as nc,ot as oc,$c as pc,Fp as qc,$p as rc};

package/dist/{connect-NL5EVPMX.js → connect-SYE5GQKI.js}

@@ -1 +1 @@
-import{$ as b,_ as a,aa as c}from"./chunk-PR4HGVXE.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};
+import{$ as b,_ as a,aa as c}from"./chunk-SL7WQR3R.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/core.js

@@ -1 +1 @@
-import{$b as O,Ab as D,Bb as E,Cb as F,D as m,Db as G,E as n,Eb as H,F as o,G as p,Sb as I,Tb as J,Ub as K,Vb as L,Zb as M,_b as N,a,ac as P,b,ba as q,bb as A,bc as Q,c,ca as r,cc as R,dc as S,ec as T,fa as s,fc as U,ga as t,gc as V,ha as u,hc as W,ia as v,ic as X,ja as w,jc as Y,ka as x,kc as Z,la as y,lc as _,ma as z,mc as $,nc as aa,oc as ba,pc as ca,qc as da,rc as ea,yb as B,zb as C}from"./chunk-PR4HGVXE.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import{h as d,n as e,o as f,p as g,q as h,r as i,s as j,t as k,u as l}from"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{A as AuthMissingError,d as BASE_AUTH_FIELDS,ba as CORSAIR_INTERNAL,G as CloudApiError,B as CorsairKekMissingError,C as DB_METHOD_RISK,P as MS_GRAPH_API_BASE,z as ManagementApiError,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,u as activeMode,W as asRecord,y as assertModeAllows,x as assertReadonlyAllowed,F as callPluginDb,T as collectPluginWebhookMatchers,H as corsairCloud,n as createAccountKeyManager,ca as createCorsair,m as createIntegrationKeyManager,E as decodeDbArgs,aa as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,D as encodeDbArgs,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,K as exchangeCodeForTokens,Z as extractMicrosoftGraphValidationToken,$ as firstString,M as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,U as getHeader,L as getOAuthAccessToken,O as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,N as introspectPluginForDocs,_ as isMicrosoftGraphValidationHandshake,w as isReadonlyScopeActive,I as logEvent,J as logEventFromContext,R as matchWebhookPlugin,S as matchWebhookPluginAndTenant,Q as msGraphSubscribe,l as reEncryptConfig,X as readBodyRecord,Y as readQueryParam,q as resolveConnectLink,v as runReadonly,t as runWithMode,da as shouldStartTunnel,ea as superviseTunnel,V as toExternalId};
+import{$b as O,Ab as D,Bb as E,Cb as F,D as m,Db as G,E as n,Eb as H,F as o,G as p,Sb as I,Tb as J,Ub as K,Vb as L,Zb as M,_b as N,a,ac as P,b,ba as q,bb as A,bc as Q,c,ca as r,cc as R,dc as S,ec as T,fa as s,fc as U,ga as t,gc as V,ha as u,hc as W,ia as v,ic as X,ja as w,jc as Y,ka as x,kc as Z,la as y,lc as _,ma as z,mc as $,nc as aa,oc as ba,pc as ca,qc as da,rc as ea,yb as B,zb as C}from"./chunk-SL7WQR3R.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import{h as d,n as e,o as f,p as g,q as h,r as i,s as j,t as k,u as l}from"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{A as AuthMissingError,d as BASE_AUTH_FIELDS,ba as CORSAIR_INTERNAL,G as CloudApiError,B as CorsairKekMissingError,C as DB_METHOD_RISK,P as MS_GRAPH_API_BASE,z as ManagementApiError,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,u as activeMode,W as asRecord,y as assertModeAllows,x as assertReadonlyAllowed,F as callPluginDb,T as collectPluginWebhookMatchers,H as corsairCloud,n as createAccountKeyManager,ca as createCorsair,m as createIntegrationKeyManager,E as decodeDbArgs,aa as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,D as encodeDbArgs,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,K as exchangeCodeForTokens,Z as extractMicrosoftGraphValidationToken,$ as firstString,M as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,U as getHeader,L as getOAuthAccessToken,O as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,N as introspectPluginForDocs,_ as isMicrosoftGraphValidationHandshake,w as isReadonlyScopeActive,I as logEvent,J as logEventFromContext,R as matchWebhookPlugin,S as matchWebhookPluginAndTenant,Q as msGraphSubscribe,l as reEncryptConfig,X as readBodyRecord,Y as readQueryParam,q as resolveConnectLink,v as runReadonly,t as runWithMode,da as shouldStartTunnel,ea as superviseTunnel,V as toExternalId};