corsair 0.1.153 → 0.1.155

package/dist/chunk-FN2XOWUK.js

@@ -0,0 +1,68 @@
+import{a as Ee,b as Br,c as Fr}from"./chunk-6IURNA4L.js";import{a as Bi,b as Fi,c as Li,d as Nn}from"./chunk-XCTHEKDP.js";import{A as dn,B as Ur,C as Vi,a as ji,b as Me,c as Wi,d as R,e as V,f as qi,g as oe,h as G,i as M,j as Ki,k as gt,l as Zi,m as ft,n as be,o as ke,p as ie,r as yt,s as qe,t as we,u as $n,v as Gi,w as mt,x as zi,y as jn,z as Ji}from"./chunk-WUEWJTDA.js";import{b as Ni,c as $i}from"./chunk-XPXWKPFZ.js";import{ZodBoolean as cg,ZodDate as ug,ZodEnum as lg,ZodNullable as dg,ZodNumber as pg,ZodObject as gg,ZodOptional as fg,ZodRecord as yg,ZodString as mg,ZodType as hg}from"zod";var ht=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","akta","alchemy","algolia","alibaba","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","anyapi","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","apollo","appointo","aryn","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beamer","beeminder","benchmarkemail","benzinga","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bigpictureio","bitbucket","bitwarden","blackbaud","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","booqable","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","builtwith","browserless","browsertool","bubble","bugsnag","buildkite","bunnycdn","bytedance","byteforms","cal","callpage","calendly","callingly","campaigncleaner","campayn","canny","canva","canvas","capsulecrm","carbone","castingwords","cdrplatform","celigo","certifier","chaser","chatbotkit","chatfai","chatwork","chmeetings","cincopa","circleci","claidai","classmarker","clay","clickhouse","clickmeeting","clickup","clicksend","clientary","clockify","close","cloro","cloudcart","cloudflare","cloudflareapikey","cloudinary","coassemble","codeinterpreter","coda","cody","coinbase","coinmarketcal","collegefootballdata","composio","confluence","connecteam","contactout","contentfulgraphql","contextdev","contextsevenmcp","convex","convoloai","cosmic","countdownapi","crowterminal","currentsapi","cursor","customerio","customgpt","cuttly","dadataru","daffy","databricks","datadog","dataforseo","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","docmosis","docupost","docsumo","docusign","dodopayments","doppler","dovetail","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","emelia","epicgames","everhour","exa","excel","exist","extractaai","facebook","faraday","figma","filevine","filloutforms","firecrawl","fireflies","fixer","flexisign","flutterwave","formbricks","fundable","gemini","giphy","github","gitlab","gladia","gmail","gmicloud","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","hookdeck","htmltoimage","hubspot","huggingface","humanitix","hunterio","imagior","imejisio","imgbb","insightoai","instagram","instantly","intercom","jigsawstack","jira","kaggle","keenable","kibana","kling","leexi","linear","linkedin","litescrape","loyverse","magichour","mailboxlayer","mailcheck","mailchimp","mailtrap","marketstack","merriamwebsterdict","minimax","monday","mrscraper","neon","nextdns","northflank","notion","ocrspace","ocrwebservice","octen","ollama","onedrive","onepassword","openai","openrouter","openweathermap","orbit","oura","outlook","pagerduty","parseur","pdfco","pdfmonkey","pdl","perplexityai","phantombuster","pinecone","plain","ploid","posthog","postman","prisma","pushbullet","razorpay","reddit","reducto","remoet","replicate","removebg","replicate","replyio","resend","retailed","revai","rootly","runpod","salesforce","saperly","sapsuccessfactors","scaleai","scrapegraphai","search1api","securitytrails","semanticscholar","sendgrid","sentry","serpapi","sharepoint","slack","slackbot","snapchat","sourcegraph","spoki","spotify","starton","strava","streamtime","stripe","studiobyai21labs","supabase","supadata","suzanne","surf","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","tikhub","timecamp","timelink","tinypng","tinyfish","tinyurl","tisane","todoist","toggl","tokenmetrics","tpscheck","trello","tripadvisor","turso","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","typesafe","unione","unipile","uniswapapi","updownio","uploadcare","vapi","vaquill","vercel","veriphone","vestaboard","waboxapp","wakatime","webflow","webscrapingai","webvizio","whatsapp","whautomate","whoisfreaks","winstonai","witai","wix","wiza","workday","workiom","worldnewsapi","writer","xero","xquik","youcom","youtube","zendesk","zenserp","zohobigin","zohoinventory","zohomail","zoom","zoominfo"],Yi={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",akta:"Akta",alchemy:"Alchemy",algolia:"Algolia",alibaba:"Alibaba Cloud Model Studio",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",anyapi:"AnyAPI",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",apollo:"Apollo",appointo:"Appointo",aryn:"Aryn",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beamer:"Beamer",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",benzinga:"Benzinga",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bigpictureio:"BigPicture.io",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blackbaud:"Blackbaud",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",booqable:"Booqable",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",builtwith:"BuiltWith",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",bunnycdn:"Bunnycdn",bytedance:"ByteDance",byteforms:"ByteForms",cal:"Cal",callpage:"CallPage",calendly:"Calendly",callingly:"Callingly",campaigncleaner:"Campaign Cleaner",campayn:"Campayn",canny:"Canny",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",carbone:"Carbone",castingwords:"CastingWords",cdrplatform:"CDR Platform",celigo:"Celigo",certifier:"Certifier",chaser:"Chaser",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chatwork:"Chatwork",chmeetings:"ChMeetings",cincopa:"Cincopa",circleci:"CircleCI",claidai:"Claid.ai",classmarker:"ClassMarker",clay:"Clay",clickhouse:"Clickhouse",clickmeeting:"ClickMeeting",clickup:"ClickUp",clicksend:"ClickSend",clientary:"Clientary",clockify:"Clockify",close:"Close",cloro:"cloro",cloudcart:"CloudCart",cloudflare:"Cloudflare",cloudflareapikey:"Cloudflare API Key",cloudinary:"Cloudinary",coassemble:"Coassemble",codeinterpreter:"CodeInterpreter",coda:"Coda",cody:"Cody",coinbase:"Coinbase",coinmarketcal:"Coinmarketcal",collegefootballdata:"College Football Data",composio:"Composio",confluence:"Confluence",connecteam:"Connecteam",contactout:"ContactOut",contentfulgraphql:"Contentful GraphQL",contextdev:"Context.dev",contextsevenmcp:"Context7",convex:"Convex",convoloai:"ConvoloAi",cosmic:"Cosmic",countdownapi:"Countdown API",crowterminal:"CrowTerminal",currentsapi:"CurrentsApi",cursor:"Cursor",customerio:"Customer.io",customgpt:"CustomGPT",cuttly:"Cutt.ly",dadataru:"Dadataru",daffy:"Daffy",databricks:"Databricks",datadog:"Datadog",dataforseo:"DataForSEO",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",docmosis:"Docmosis",docupost:"Docupost",docsumo:"Docsumo",docusign:"DocuSign",dodopayments:"Dodo Payments",doppler:"Doppler",dovetail:"Dovetail",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",emelia:"Emelia",epicgames:"Epic Games",everhour:"Everhour",exa:"Exa",excel:"Excel",exist:"Exist",extractaai:"Extracta.ai",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filevine:"Filevine",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",fixer:"Fixer",flexisign:"Flexisign",flutterwave:"Flutterwave",formbricks:"Formbricks",fundable:"Fundable",gemini:"Gemini",giphy:"Giphy",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",gmicloud:"GMI Cloud",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",hookdeck:"Hookdeck",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",humanitix:"Humanitix",hunterio:"Hunter.io",imagior:"Imagior",imejisio:"Imejis.io",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",instantly:"Instantly",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",keenable:"Keenable",kibana:"Kibana",kling:"Kling",leexi:"Leexi",linear:"Linear",linkedin:"LinkedIn",litescrape:"LiteScrape",loyverse:"Loyverse",magichour:"Magic Hour",mailboxlayer:"MailboxLayer",mailcheck:"Mailcheck",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",minimax:"MiniMax",monday:"Monday",mrscraper:"MrScraper",neon:"Neon",nextdns:"NextDNS",northflank:"Northflank",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",octen:"Octen",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",orbit:"Orbit",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfco:"PDF.co",pdfmonkey:"PDFMonkey",pdl:"People Data Labs",perplexityai:"Perplexity AI",phantombuster:"PhantomBuster",pinecone:"Pinecone",plain:"Plain",ploid:"Ploid",posthog:"PostHog",postman:"Postman",prisma:"Prisma",pushbullet:"Pushbullet",razorpay:"Razorpay",reddit:"Reddit",reducto:"Reducto",remoet:"Remoet",removebg:"remove.bg",replicate:"Replicate",replyio:"Reply.io",resend:"Resend",retailed:"Retailed",revai:"RevAI",rootly:"Rootly",runpod:"RunPod",salesforce:"Salesforce",saperly:"Saperly",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",search1api:"Search1API",securitytrails:"SecurityTrails",semanticscholar:"Semantic Scholar",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",slackbot:"Slackbot",snapchat:"Snapchat",sourcegraph:"Sourcegraph",spoki:"Spoki",spotify:"Spotify",starton:"Starton",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",supadata:"Supadata",suzanne:"Suzanne",surf:"Surf",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",tikhub:"TikHub",timecamp:"TimeCamp",timelink:"Timelink",tinypng:"TinyPNG",tinyfish:"TinyFish",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",tokenmetrics:"Token Metrics",tpscheck:"TPSCheck",trello:"Trello",tripadvisor:"Tripadvisor",turso:"Turso",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",typesafe:"TypeSafe",unione:"Unione",unipile:"Unipile",uniswapapi:"Uniswap",updownio:"Updown.io",uploadcare:"Uploadcare",vapi:"Vapi",vaquill:"Vaquill",vercel:"Vercel",veriphone:"Veriphone",vestaboard:"Vestaboard",waboxapp:"Waboxapp",wakatime:"WakaTime",webflow:"Webflow",webscrapingai:"WebScraping.AI",webvizio:"Webvizio",whatsapp:"WhatsApp",whautomate:"Whautomate",whoisfreaks:"Whoisfreaks",winstonai:"Winston AI",witai:"WitAi",wix:"Wix",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",writer:"Writer",xero:"Xero",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zenserp:"Zenserp",zohobigin:"Zoho Bigin",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Oe(e){let n=Yi[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var Ce=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function U(e){return typeof e=="string"&&e.length>0}function uu(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function lu(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"||e==="managed_pricing"}function bt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!U(n.connectUrl)||!U(n.token)||!U(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:U(n.environmentId)?n.environmentId:n.projectId};return U(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function kt(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!U(r.tenantId)||!U(r.plugin)||!uu(r.status)||!lu(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:U(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function wt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!U(n.approvalUrl)||!U(n.token)||!U(n.projectId)||!U(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function pn(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(U(n.access_token))return{access_token:n.access_token,refresh_token:U(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:U(n.scope)?n.scope:void 0};throw new Error(U(n.error)?U(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function du(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function pu(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;U(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function gu(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function Qi(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!U(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!U(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",a=pu(o.fields),s=du(o.missingRequiredFields),c=gu(o.status,o.connected,a,s);t.push({plugin:o.plugin,providerName:U(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function Lr(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function Xi(e,n,t){if(n===404&&t)return t;let r=Lr(e);if(!r)return`Hub API returned HTTP ${n}`;if(!e||typeof e!="object")return r;let o=e,i=[r];if(typeof o.code=="string"&&o.code.length>0&&i.push(`Hub error code: ${o.code}`),typeof o.hint=="string"&&o.hint.length>0&&i.push("",o.hint),Array.isArray(o.fix)){let a=o.fix.filter(s=>typeof s=="string"&&s.trim().length>0);if(a.length>0){i.push("","What to do:");for(let s of a)i.push(`- ${s}`)}}if(o.received!==void 0)try{i.push("",`Hub received: ${JSON.stringify(o.received)}`)}catch{}if(o.details!==void 0)try{i.push("",`Details: ${JSON.stringify(o.details)}`)}catch{}return typeof o.creditsRequired=="number"&&i.push("",`Credits required for this call: ${o.creditsRequired}`),i.join(`
+`)}function es(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}var ns="0.1.155";function fu(){return{"x-corsair-sdk-version":ns}}function Ct(e){return e.replace(/\/$/,"")}function Nr(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return Ee()}catch{return null}}function ts(e){let n=Nr(e);return n?{"x-corsair-delivery-url":n}:{}}function rs(e){let n=e.instanceKey?.trim();return n?{"x-corsair-instance-key":n}:{}}async function os(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function yu(e,n,t){return Xi(e,n,t)}function is(e,n,t){let r=es(e);throw r?new Ce({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):Object.assign(new Error(yu(e,n,t)),{status:n})}function ss(e){return typeof e=="object"&&e!==null&&"status"in e&&typeof e.status=="number"?e.status:void 0}async function I(e){let n=Ct(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",signal:e.signal,headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...ts(e.hub),...rs(e.hub),...fu(),...e.extraHeaders},body:JSON.stringify(e.body)}),r=await os(t);return t.ok||is(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function K(e){let n=Ct(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",...e.signal?{signal:e.signal}:{},headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...ts(e.hub),...rs(e.hub)}}),r=await os(t);return t.ok||is(r,t.status,e.notFoundMessage),e.parseResponse(r)}function Pt(e){return e&&typeof e=="object"?e:{}}function as(e){let n=Pt(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function $r(e,n){return I({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=Pt(t);return{chat:r.thread,reply:as(r.reply)}}})}async function jr(e,n){return I({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:as})}async function Wr(e,n){return K({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Pt(t).threads;return Array.isArray(r)?r:[]}})}async function qr(e,n){return K({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=Pt(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Pu}from"crypto";var mu="corsair:client-bridge";function Kr(e){return new URL(e).origin}function gn(e){let n=JSON.stringify({type:mu,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Kr(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var hu=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Zr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:hu.has(n)}catch{return!1}}function Wn(e){return e==="development"?"browser":"server"}function cs(e){return Wn(e)==="browser"}function us(e){return Zr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Cu}from"crypto";var De=60*1e3,Ke=300*1e3;import{createHmac as bu,randomBytes as ku,timingSafeEqual as wu}from"crypto";function Pe(){return ku(16).toString("base64url")}function qn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return bu("sha256",t).update(e).digest("base64url")}function de(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let a=qn(o,t);try{if(!wu(Buffer.from(i,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function Tt(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),a=qn(i,n);return`${i}.${a}`}function Kn(e,n,t){let r=Math.floor(Date.now()/1e3);return Tt(e,n,r+Math.floor(t/1e3))}function Ze(e){return decodeURIComponent(e)}function Gr(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function ls(e){let n=e.trim();return n.length>0?n:null}function fn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function yn(e,n){if(!ls(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Cu(16).toString("base64url"),iat:t,exp:t+Math.floor(De/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=qn(o,n);return`${o}.${i}`}function He(e,n){return ls(n)?de(e,n):null}function Tu(e){let n=Kr(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function zr(e){let n=yn(Tu(e),e.signingSecret);return fn(e.deliveryUrl,n)}function ds(e){if(Wn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Pu(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:zr(r)}}var Zn="https://auth.corsair.dev";var Te=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},Gn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function Jr(e){let n=(e.apiUrl?.trim()||Zn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"",o=t.startsWith("ck_cloud_");if(!t||!r&&!o)throw new Gn;return{apiUrl:n,projectApiKey:t,signingSecret:r,instanceKey:e.instanceKey?.trim()||void 0,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel,runtimeProofKey:e.runtimeProofKey?.trim()||void 0}}function vt(e){return Jr(e)}function vu(e){let n=e.projectApiKey.startsWith("ck_cloud_");return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&(n||e.signingSecret.trim().length>0)}function W(e){let n=R(e).hub;if(!n||!vu(n))throw new Te;return n}function ps(e){return e.replace(/\/$/,"")}function Rt(e){return e.oauthCallbackUrl?ps(e.oauthCallbackUrl.trim()):`${ps(e.apiUrl)}/oauth/callback`}function mn(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";if(e.startsWith("ck_cloud_"))return"cloud";throw new Error("Hub API key must start with ck_dev_ (development), ck_prod_ (production), or ck_cloud_ (cloud)")}function gs(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let a=[null,void 0,""].includes(i)?null:i;await n({[o]:a})};return r}var Vr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function q(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,a=[...G[n].integration,...i],s=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:b.id,config:Vr(b.config),dek:b.dek??null},s},updateIntegration:async b=>{let k=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),s=null}},l=null,u=async()=>{if(l)return l;let b=await c.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await ie(b.dek,r),l},d=async()=>{let b=await c.getIntegration(),k=await u(),T=b.config;return!T||Object.keys(T).length===0?{}:we(T,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await u(),T;try{T=await d()}catch(O){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,O),T={}}let A={...T};for(let[O,ne]of Object.entries(b))ne===null?delete A[O]:A[O]=ne;let F=qe(A,k);await c.updateIntegration({config:F})};return{get_dek:u,issue_new_dek:async()=>{let b=await c.getIntegration(),k=be(),T={};if(b.dek){let F=await ie(b.dek,r),O=b.config;O&&Object.keys(O).length>0&&(T=$n(O,F,k))}let A=await ke(k,r);return await c.updateIntegration({config:T,dek:A}),l=k,k},...gs(d,g,a)}}function N(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:a=[],ensureProvisioned:s}=e,c=[...G[n].account,...a],l=null,u=async()=>{if(l)return l;let P=!1;for(;;){let C=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!C){if(!P&&s){P=!0,await s();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return l={id:C.id,config:Vr(C.config),dek:C.dek??null},l}},d={kek:o,integrationName:t,tenantId:r,getIntegration:u,getAccount:async()=>{let P=!1;for(;;){let C=await u(),D=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",C.id).executeTakeFirst();if(!D){if(!P&&s){P=!0,await s();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return{id:D.id,config:Vr(D.config),dek:D.dek??null}}},updateAccount:async P=>{let C=await d.getAccount();await i.db.updateTable("corsair_accounts").set({...P.config!==void 0?{config:P.config}:{},...P.dek!==void 0?{dek:P.dek}:{},updated_at:new Date}).where("id","=",C.id).execute()}},p=null,g=null,f=null,h=async()=>{let P=await d.getAccount();if(!P.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p&&g===P.dek||(p=await ie(P.dek,o),g=P.dek),p},b=async()=>{if(f)return f;let P=await d.getIntegration();if(!P.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await ie(P.dek,o),f},k=async()=>{let P=await d.getAccount(),C=await h(),D=P.config;return!D||Object.keys(D).length===0?{}:we(D,C)},T=async()=>{let P=await d.getIntegration(),C=await b(),D=P.config;return!D||Object.keys(D).length===0?{}:we(D,C)},A=Promise.resolve(),F=P=>{let C=A.then(()=>O(P));return A=C.catch(()=>{}),C},O=async P=>{let C=await d.getAccount();if(!C.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);let D=await ie(C.dek,o),L;try{let H=C.config;L=!H||Object.keys(H).length===0?{}:we(H,D)}catch(H){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,H),L={}}let te={...L};for(let[H,_e]of Object.entries(P))_e===null?delete te[H]:te[H]=_e;let B=qe(te,D);await d.updateAccount({config:B})},ne={get_dek:h,issue_new_dek:async()=>{let P=await d.getAccount(),C=be(),D={},L=null;if(P.dek){L=await ie(P.dek,o);let B=P.config;B&&Object.keys(B).length>0&&(D=$n(B,L,C))}let te=await ke(C,o);if(L){let B=L;await i.db.transaction().execute(async H=>{await Ji(H,P.id,B,C),await H.updateTable("corsair_accounts").set({config:D,dek:te,updated_at:new Date}).where("id","=",P.id).execute()})}else await d.updateAccount({config:D,dek:te});return p=C,g=te,C},...gs(k,F,c)};return n==="oauth_2"&&(ne.get_integration_credentials=async()=>{let P=await T();return{...P,client_id:P.client_id||null,client_secret:P.client_secret||null,redirect_url:P.redirect_url??null}}),ne}async function fs(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=be(),i=await ke(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function ys(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=be(),s=await ke(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",i.id).execute(),a}var Ru=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function Ue(e){return Ru.has(e)}function Au(e,n){return Ue(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function xu(e){return!Ue(e)}function Iu(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"];case"managed_pricing":return[]}}function Su(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function _u(e,n){let t=i=>n.find(a=>a.level==="account"&&a.name===i);if(!Iu(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function ms(e,n){if(!e)return!1;let t=oe(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function Eu(e,n){let r=e.authConfig?.[n]?.integration??[];return[...G[n].integration,...r]}function Mu(e,n){let r=e.authConfig?.[n]?.account??[];return[...G[n].account,...r]}function Ou(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return o.length>0?a="missing_integration":r.length===0?a="ready":i.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:_u(n,t),fields:t,missingRequiredFields:r}}async function Ge(e,n,t){let r=M(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,a=i?.[r]?.integration??[],s=i?.[r]?.account??[],c=q({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),l=N({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:s}),u=Eu(n,r),d=Mu(n,r),p=[];for(let g of u)p.push({name:g,level:"integration",required:Au(r,g),configured:await ms(c,g)});for(let g of d)p.push({name:g,level:"account",required:xu(g),configured:await ms(l,g)});if(Su(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return Ou(n.id,r,p)}async function zn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let a of e.plugins){if(o&&!o.has(a.id))continue;let s=await Ge(e,a,r);s&&i.push(s)}return i}function At(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var hs=Symbol.for("corsair:internal"),bs=new WeakMap,ks=new WeakMap;function Du(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function Hu(e){if(e.database){let t=bs.get(e.database);return t||(t=new Map,bs.set(e.database,t)),t}let n=ks.get(e);return n||(n=new Map,ks.set(e,n)),n}function Uu(e){return e.multiTenancy?{withTenant:()=>({}),[hs]:e}:{[hs]:e}}async function hn(e,n){if(!e.database)return;let t=n.trim()||"default",r=Hu(e),o=Du(t,e.plugins),i=r.get(o);if(i){await i;return}let a=(async()=>{let{setupCorsair:s}=await import("./setup-CIE4SA7M.js");await s(Uu(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,a),await a}import*as Jn from"crypto";function Be(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function Yr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function bn(e,n){if(!n)throw new Error("OAuth state signing requires a configured kek. Pass kek to createCorsair().");let t=Jn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var Qr=600*1e3;function xt(e,n){if(!n)return null;let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Jn.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(o,"base64url"),s=Buffer.from(i,"base64url");return a.length!==s.length||!Jn.timingSafeEqual(a,s)?null:Yr(r,{maxAgeMs:Qr})}function ws(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function Cs(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function kn(e,n){await I({hub:e,path:"/connections/report",body:ws(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function Bu(e,n){try{let t=W(e);I({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof Te)return}}async function Fu(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!M(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ge(n,e.plugin,r);o&&Ts(e.hub,Cs({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function Ps(e,n){Bu(e,n)}function Ts(e,n){I({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function wn(e){Fu(e).catch(()=>{})}async function ve(e,n){let t=R(e);if(!M(n.plugin))return;let o=await Ge(t,n.plugin,n.tenantId);o&&Ps(e,Cs({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function It(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var vs=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function Lu(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function Nu(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await ie(n.dek,e.kek),r=vs(n.config),o={};Object.keys(r).length>0&&(o=we(r,t)),o[e.link.linkType]=e.link.externalId;let i=qe(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function Cn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:a,extraAccountFields:s=[]}=e,{accountId:c}=await Lu({database:n,pluginId:r,tenantId:o}),l=!1;if(a){let u=N({authType:a,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:s}),d=`set_${i.linkType}`,p=u[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await Nu({database:n,kek:t,accountId:c,link:i})}async function Xr(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let c=await ie(s.dek,t),u=vs(s.config)[o];if(!u)continue;if(yt(u,c)===i)return s}catch{continue}return null}async function St(e){return(await Xr(e))?.tenant_id??null}async function Rs(e){return St({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as As from"querystring";function ze(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${As.stringify(i)}`}async function xs(e,n){try{return await K({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function Pn(e,n,t,r){if(!n.subscribe)return;let o=W(e),i=await xs(o,n.id);if(!i)return;let a=await n.subscribe({keys:r},{webhookUrl:i});a&&await ve(e,{plugin:n,tenantId:t,verified:!0,webhookLink:a.webhookLink,webhookSecret:a.webhookSecret})}var Y=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function Is(e){let n=e.oauthConfig;if(!n)throw new Y("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function $u(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let a=await i.executeTakeFirst();if(!a)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",a.id).executeTakeFirst())return;let c=be(),l=await ke(c,r),u=new Date;await o.insertInto("corsair_accounts").values({id:dn(),created_at:u,updated_at:u,tenant_id:t,integration_id:a.id,config:{},dek:l}).execute()})}async function eo(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,a=R(e,()=>new Y("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=V(a,n,p=>new Y("plugin_not_found",p)),c=Is(s),u=await q({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!u)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(ze({oauthConfig:c,clientId:u,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=bn(Be(n,r),a.kek);return{url:ze({oauthConfig:c,clientId:u,redirectUri:o,state:d}),state:d}}function ju(e,n){return{...n??{},...e}}async function Vn(e,n){let{code:t,state:r,redirectUri:o}=n,i=R(e,()=>new Y("invalid_corsair_instance","Invalid corsair instance")),a,s;if(n.trusted){if(!n.plugin||!n.tenantId)throw new Y("invalid_state","trusted callback requires plugin and tenantId");a=n.plugin,s=n.tenantId}else{let h=xt(r,i.kek);if(!h)throw new Y("invalid_state","Invalid or tampered state parameter");a=h.plugin,s=h.tenantId}if(!i.database)throw new Y("no_database","No database configured on corsair instance");let c=V(i,a,h=>new Y("plugin_not_found",h)),l=Is(c),u=q({authType:"oauth_2",integrationName:a,kek:i.kek,database:i.database}),d=await u.get_client_id(),p=await u.get_client_secret();if(!d||!p)throw new Y("credentials_not_configured",`Credentials not configured for '${a}'`);await $u(i.database,a,s,i.kek);let g=await _t(t,d,p,l,o);if(!g.access_token)throw new Y("no_access_token",`No access_token returned from ${l.providerName}`);let f=N({authType:"oauth_2",integrationName:a,tenantId:s,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await ve(e,{plugin:c,tenantId:s}).catch(()=>{});try{let h=ju(g,n.callbackParams),b=await It(i.plugins,a,h);if(b){try{let k=c.authConfig?.oauth_2?.account??[];await Cn({database:i.database,kek:i.kek,pluginId:a,tenantId:s,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${a}' tenant '${s}':`,k)}i.hub&&kn(i.hub,{plugin:a,tenantId:s,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${a}' tenant '${s}':`,h)}if(c.subscribe)try{await Pn(e,c,s,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${a}' tenant '${s}':`,h)}return{plugin:a,tenantId:s}}async function Wu(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??Pn,i=[],a=[];if(!t.database)return{renewed:i,failed:a};for(let s of r){let c=t.plugins.find(u=>u.id===s.integrationName);if(!c?.subscribe)continue;let l=`${c.id}/${s.tenantId}`;try{let u=M(c)??"oauth_2",d=N({authType:u,integrationName:c.id,tenantId:s.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[u]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:u,keys:g,hub:t.hub},"endpoint")}await o(n,c,s.tenantId,d),i.push(l)}catch(u){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,u),a.push(l)}}return{renewed:i,failed:a}}async function Ss(e){let n=R(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return Wu({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function qu(e,n={}){let t=!1,r=()=>{t||(t=!0,Ss(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function _s(e){if(!R(e).database)throw new Error("A database must be configured to provision Corsair integrations");await Et(e,{silent:!0})}async function Tn(e,n){let t=R(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await hn(t,n)}var Ku=Symbol.for("corsair:internal"),Zu=new Set(["access_token","refresh_token","expires_at","scope"]);function Gu(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function zu(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!Ue(t)&&!Zu.has(t)):n.filter(t=>!Ue(t))}function Es(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function Ju(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function Vu(e){return{[Ku]:Es(e)}}async function Mt(e,n,t={}){let r=Rt(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,a=Es(e),s=Vu(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let l=M(c);if(!l)continue;let u=Gu(l),d=t.providerNameOverrides?.[c.id]??Oe(c.id),p=await Ge(a,c,n),g=gt(c,l),f=zu(l,g),h={plugin:c.id,providerName:d,authKind:u,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),u==="oauth"){let k=t.oauthModeOverrides?.[c.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let T=await eo(s,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=T.url}catch(T){T instanceof Error&&/client_id not configured/i.test(T.message)||(h.setupError=T instanceof Error?T.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function qy(e,n,t={}){let r=R(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return Mt({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function Ms(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await hn(e.internalConfig??Ju(e),n)}async function Os(e,n){await Tn(e,n)}async function Ds(e,n){let t=mn(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Ee({deliveryUrl:n.deliveryUrl})),I({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:bt})}async function Hs(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await Ms(t,n.tenantId);let r=await Mt(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return Ds(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function Ot(e,n){let t=R(e),r=W(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Os(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,a=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,s=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await Mt(o,n.tenantId,{pluginIds:i,oauthModeOverrides:a,providerNameOverrides:s});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return Ds(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function Dt(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(a=>a.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=R(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await Yu(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function Yu(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-ZSWDLN74.js"),{postHubConnectSession:i}=await import("./connect-SS7I4OQB.js"),a={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(a,t.tenantId);let s=await r(a,t.tenantId,{pluginIds:t.pluginIds});if(s.length===0)throw new Error("No connectable plugins found for this tenant");let c=s.find(l=>l.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:s})}function vn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var se=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Qu(e){let n=e.oauthConfig;if(!n)throw new se("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function no(e,n){let t=R(e,()=>new se("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new se("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new se("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=xt(n,t.kek);if(!o)throw new se("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:a}=o,s=V(t,i,p=>new se("plugin_not_found",p)),c=Qu(s),u=await q({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!u)throw new se("client_id_not_configured",`client_id not configured for '${i}'`);let d=ze({oauthConfig:c,clientId:u,redirectUri:r,state:n});return{plugin:i,tenantId:a,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as el}from"async_hooks";import{randomBytes as nl}from"crypto";import{v4 as tl}from"uuid";var pe=class extends Error{reason;constructor(n,t="pending"){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError",this.reason=t}};async function Ht(e,n){let t=mn(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Ee({deliveryUrl:n.deliveryUrl})),I({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:wt})}function Ut(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var to="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function oo(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Us(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function ro(e){return Ut(e)}async function io(e,n){if(oo(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Us(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Ht(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:Xu(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch(r){return console.warn(`[corsair/${n.plugin}] could not create an approval link for '${n.endpoint}': ${r instanceof Error?r.message:String(r)}`),null}}function Xu(e){try{return JSON.parse(e)}catch{return e}}async function Bt(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await io(e,n);return{...n,approvalUrl:r}}async function so(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:a,endpoint:s,args:c,tenantId:l,expiresAt:u,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:a,endpoint:s,args:c});let g=await io({manual:t,hub:r},{id:o,token:i,plugin:a,endpoint:s,args:JSON.stringify(c),tenant_id:l,expires_at:u});return oo(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):ro(g):to:r?g?ro(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:to}var Ft=new el,Bs={open:0,cautious:1,strict:2,readonly:3},Rn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function ao(e,n){return e===void 0?n:n===void 0||Bs[e]>=Bs[n]?e:n}function Lt(e,n){return Ft.run(ao(Ft.getStore(),e)??e,n)}function An(){return Ft.getStore()}function co(e){return Lt("readonly",e)}function Ns(){return Ft.getStore()==="readonly"}function Nt(e,n){if(Ns()&&n!=="read")throw new Rn(e,n)}function Je(e,n){Nt(e,n);let t=An();if(!(t===void 0||$t(n,t)==="allow"))throw new pe(`Action '${e}' is a '${n}' operation and permission mode '${t}' does not allow it. The entity store cannot wait for approval.`,"policy")}var rl={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}},Fs={allow:0,require_approval:1,deny:2};function $s(e,n){return e===void 0?n:Fs[e]>=Fs[n]?e:n}function $t(e,n,t){return t!==void 0?t:rl[n][e]}function uo(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function js(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Ls(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Ws(e){let n=$t(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, widen the permission mode in force for this call.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",a).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,h=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${s.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Ls(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let c=tl(),l=nl(32).toString("hex"),u=e.timeoutMs??600*1e3,d=new Date(Date.now()+u).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:c,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:a,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${c}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Ls(e.db,c,u):{result:"blocked",reason:"pending",id:c,token:l,expiresAt:d}}var w=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function _(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function ge(e){let n={error:e.code,message:e.message,...e.extra};return _(e.status,n)}function Fe(e){return new w(404,"not_found",e)}function $(e,n={}){return new w(400,"bad_request",e,n)}function lo(e,n){return V(e,n,t=>Fe(t))}async function qs(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=q({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=G[t].integration,i=r,a;try{a=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{a=o.map(()=>null)}let s=o.filter((l,u)=>a[u]==null),c;return t==="oauth_2"?c=!s.includes("client_id")&&!s.includes("client_secret"):c=s.length===0,{configured:c,missingFields:s}}async function Ks(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await qs(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function jt(){return{ok:!0}}async function xn(e){return Promise.all(e.plugins.map(n=>Ks(n,e)))}async function Wt(e,n){let t=lo(e,n);return Ks(t,e)}async function ol(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function Zs(e,n){let t=await ol(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function In(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let a=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function qt(e,n){if(!n)throw $("Tenant id must be a non-empty string");return Zs(e,n)}async function Kt(e,n){let t=n?.id?.trim();if(!t)throw $("Tenant id is required",{missingFields:["id"]});return Zs(e,t)}async function Zt(e,n){let t=n?.trim()||"default",r={},o=await zn(e,t);for(let i of o)r[i.plugin]=At(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function Gt(e,n){let t=n?.plugin;if(typeof t!="string"||!t.trim())throw $("plugin is required",{missingFields:["plugin"]});let r=t.trim();lo(e,r);let o=n?.tenantId;if(o!=null&&typeof o!="string")throw $("tenantId must be a string");let i=o?.trim()||"default";if(!e.database)return{ok:!0,disconnected:!1};let a=e.database.db,s=await a.selectFrom("corsair_integrations").select(["id"]).where("name","=",r).executeTakeFirst();if(!s)return{ok:!0,disconnected:!1};let c=!1;return await a.transaction().execute(async l=>{e.database?.isPg===!0&&await l.selectFrom("corsair_integrations").select("id").where("name","=",r).forUpdate().execute();let u=l.selectFrom("corsair_accounts").select("id").where("tenant_id","=",i).where("integration_id","=",s.id);await l.deleteFrom("corsair_events").where("account_id","in",u).execute(),await l.deleteFrom("corsair_entities").where("account_id","in",u).execute(),c=((await l.deleteFrom("corsair_accounts").where("tenant_id","=",i).where("integration_id","=",s.id).executeTakeFirst()).numDeletedRows??0n)>0n}),{ok:!0,disconnected:c}}async function po(e,n){if(!e.database)throw Fe(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw Fe(`Permission '${n}' not found`);return Bt(e,t)}function il(e){if(!e.oauthConfig)throw $(`Plugin '${e.id}' has no oauthConfig`)}function sl(e){if(!e.manual)throw new w(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function go(e){let n=sl(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new w(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function al(e){let n=!!e.hub,t=vn(e.manual);if(!n&&!t)throw new w(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function Gs(e){if(!e.database||!e.kek)throw new w(500,"database_not_configured","A database and kek are required to issue connect links.")}async function cl(e,n){let t=n?.plugin?.trim();if(!t)throw $("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=lo(e,t);il(o);let i=go(e);Gs(e);let a=await qs(o,e);if(!a.configured)throw new w(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=bn(Be(t,r),e.kek),c;try{c=new URL(i.baseUrl)}catch{throw new w(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return c.searchParams.set("state",s),{connectUrl:c.toString(),expiresAt:new Date(Date.now()+Qr).toISOString(),tenantId:r}}async function ul(e,n,t){Gs(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let a=t.providerName?.trim();a&&(o.providerName=a);let s=await Ot(e,o);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt,tenantId:r}}async function zt(e,n,t){return al(n),n.hub?ul(e,n,t):cl(n,t)}async function Jt(e,n,t){if(n.hub&&!vn(n.manual))throw new w(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw $("state is required",{missingFields:["state"]});go(n);try{return await no(e,r)}catch(o){if(o instanceof se)switch(o.code){case"invalid_state":throw $("Invalid or expired state");case"client_id_not_configured":throw new w(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new w(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function Vt(e,n,t){if(n.hub&&!vn(n.manual))throw new w(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw $("Missing required fields",{missingFields:i});let a=go(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:o,redirectUri:a.redirectUri,callbackParams:t.callbackParams})}catch(c){if(c instanceof Error&&c.name==="OAuthCallbackError")switch(c.code){case"invalid_state":throw $("Invalid or expired state");case"credentials_not_configured":throw new w(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new w(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function fo(e,n){if(!e.database)throw Fe("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw Fe("Permission not found");return Bt(e,t)}async function zs(e,n){return"id"in n?po(e,n.id):fo(e,n.token)}import{createCipheriv as hl,createDecipheriv as Vm,randomBytes as Qs,scryptSync as bl}from"crypto";import{createHmac as yo,randomUUID as ll,timingSafeEqual as Vs}from"crypto";function mo(e){return e.run??null}function ho(e){return e.probe??null}function Ys(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function Yt(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=yo("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":ll()}}}function bo(e){let n=e.signingSecret.trim();if(!n)return!1;let t=Ys(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>Ke)return!1;let i=yo("sha256",n).update(e.body).digest("hex");try{return Vs(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function Sn(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=Ys(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>Ke)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=yo("sha256",n).update(e.body).digest("hex");try{if(!Vs(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function _n(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function Qt(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function Xt(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function Yn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function ko(e){return Yn(_n(e))}async function wo(e){let n=await tr({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=_n(n.body),r=Qt({httpOk:n.ok,status:n.status,body:t}),o=Yn(t);if(!r||!o)throw new Error(nr({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function er(e){return Xt(_n(e))}function dl(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function Js(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var pl="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",gl="Check the delivery URL configured for this environment.";function fl(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${pl}`}function yl(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${gl}`}function Qn(e,n){let t=dl(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function nr(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Qn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return fl(e);if(e.status===404)return yl(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${Js(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${Js(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}var ml=15e3;async function tr(e){let{body:n,headers:t}=Yt(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n,signal:AbortSignal.timeout(ml)}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Qn(e.deliveryUrl,r)}}}var kl="aes-256-gcm",wl=12,Cl=16,Pl=16,Tl=32;function vl(e,n){return bl(e.trim(),n,Tl)}function Co(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=Qs(Pl),o=vl(t,r),i=Qs(wl),a=hl(kl,o,i,{authTagLength:Cl}),s=JSON.stringify(e),c=Buffer.concat([a.update(s,"utf8"),a.final()]),l=a.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),c.toString("base64")].join(":")}var Rl=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function Po(e){if(e instanceof ji)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!Rl.some(t=>n.includes(t))}function Al(e){if(!e)return[];let n=M(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!Ue(r)):[]}async function Xn(e,n){let t=R(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await Et(e,{silent:!0});let[r,o]=await Promise.all([In(t),xn(t)]),i={tenants:r.map(a=>({id:a.id})),plugins:o.map(a=>{let s=Al(t.plugins.find(c=>c.id===a.id));return{id:a.id,authType:a.authType,configured:a.configured,missingFields:a.missingFields,...s.length>0?{integrationCredentialFields:s}:{}}}),syncedAt:new Date().toISOString()};return Co(i,n)}var fe=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function rr(e,n){let t=R(e,()=>new fe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new fe("no_database","Database not configured");let r=V(t,n.plugin,u=>new fe("plugin_not_found",u)),o=M(r);if(!o)throw new fe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new fe("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await Tn(e,n.tenantId);let i=new Set(gt(r,o)),s=r.authConfig?.[o]?.account??[],c=N({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new fe("invalid_credentials",`Unknown credential field '${u}' for plugin '${n.plugin}'`);let p=oe(c,`set_${u}`);if(!p)throw new fe("invalid_credentials",`Cannot set credential field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new fe("invalid_credentials","Provide at least one credential field to save");return await ve(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var ye=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function To(e,n){let t=R(e,()=>new ye("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ye("no_database","Database not configured");let r=V(t,n.plugin,u=>new ye("plugin_not_found",u)),o=M(r);if(!o)throw new ye("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await _s(e);let i=new Set(Zi(r,o)),s=r.authConfig?.[o]?.integration??[],c=q({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new ye("invalid_credentials",`Unknown integration credential field '${u}' for plugin '${n.plugin}'`);let p=oe(c,`set_${u}`);if(!p)throw new ye("invalid_credentials",`Cannot set integration field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ye("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var or=new Map;function xl(e){for(let[n,t]of or)t<=e&&or.delete(n)}function ir(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();xl(r);let o=or.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(or.set(t,r+n),{ok:!0})}var Le=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function En(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:a,scope:s,authType:c="managed",providerData:l}=n;if(!o.trim())throw new Le("no_access_token","Managed OAuth delivery missing access_token");let u=R(e,()=>new Le("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new Le("no_database","No database configured on corsair instance");let d=V(u,t,g=>new Le("plugin_not_found",g));await Tn(e,r);let p=N({authType:c,integrationName:t,tenantId:r,kek:u.kek,database:u.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),a&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await p.set_scope(s),await ve(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await It(u.plugins,t,{access_token:o,refresh_token:i,scope:s,...l});if(g){try{let f=d.authConfig?.[c]?.account??[];await Cn({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:g,authType:c,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}u.hub&&kn(u.hub,{plugin:t,tenantId:r,link:g,authType:c})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await Pn(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function Il(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Xs(e,n,t=[]){for(let[r,o]of Object.entries(e))if(Il(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=Xs(o,n,[...t,r]);if(i)return i}return null}function Sl(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function _l(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function ea(e,n,t,r,o){let i=Sl(n),a=typeof t=="string"?JSON.parse(t):t;(!a||typeof a=="object"&&Object.keys(a).length===0)&&i["x-goog-resource-uri"]&&(a=_l(i)||a);let c={headers:i,body:a,...r?{query:r}:{}},l=r?.tenantId||"default",u=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:ht;for(let g of p){let f=u[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(c))continue;let h=Xs(f.webhooks,c);if(!h)continue;let b=h.path.join("."),k={payload:a,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let T=await h.webhook.handler(k),A=!!Object.keys(T.returnToSender||{})?.length;return{plugin:g,action:b,body:a,response:A?{...T?.returnToSender,success:!0}:{success:!0},...T.responseHeaders&&{responseHeaders:T.responseHeaders}}}catch(T){return console.error(`Error executing webhook handler for ${g}.${b}:`,T),{plugin:g,action:b,body:a,response:{success:!1,error:T instanceof Error?T.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as El}from"crypto";import*as Ve from"vm";var na="__corsairFailedStep",Ml=3e4,vo=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function ta(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function ra(e,n){return`st_${El("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function sr(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var oa=new Set(["constructor","prototype","__proto__"]);function Re(e,n){if(e===null)return null;let t=typeof e;return t==="function"?Dl(e,n):t==="object"?Ol(e):e}function Ol(e){return new Proxy(e,{get(n,t){if(!oa.has(t))return Re(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Dl(e,n){return new Proxy(e,{apply:(t,r,o)=>Hl(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!oa.has(r))return Re(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Hl(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>Re(n,void 0),n=>{throw Re(n,void 0)}):Re(e,void 0)}function Ul(e){let n=Object.create(null),t=Ve.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Ve.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),a=Ve.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),c=Ve.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=Re(e.corsair,void 0),n.__payload=o,n.__step=a,n.__console=c;let l=Ve.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let u,d=new Promise((p,g)=>{u=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(u))}async function Ro(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(a,s)=>{if(o)throw o;let c=r++,l=ra(a,c);if(Object.hasOwn(n,l))return Re(n[l].output,void 0);try{let u=await s();return t.push({stepId:l,name:a,seq:c,status:"completed",output:u}),u}catch(u){if(ta(u))throw u;let d=sr(u);t.push({stepId:l,name:a,seq:c,status:"failed",error:d});let p=new Error(d);throw p[na]=a,p}});i.sleep=async(a,s)=>{if(o)throw o;let c=r++,l=ra(a,c);if(Object.hasOwn(n,l))return;t.push({stepId:l,name:a,seq:c,status:"completed",output:null});let u=Number.isFinite(s)?Math.max(0,s):0;throw o=new vo(Date.now()+u,a),o};try{await Ul({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??Ml});let a=o;return a?{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(a){if(ta(a))return{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()};let s=sr(a),c=a!==null&&typeof a=="object"?a[na]:void 0;return{status:"failed",steps:t,error:{message:s,...c?{failedStep:c}:{}}}}}import*as ar from"vm";var ia=1e4;async function Ao(e){let n=Object.create(null),t=ar.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=Re(e.corsair,void 0);let r=Fl(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await co(()=>{let a=ar.runInContext(o,t,{filename:"corsair:probe",timeout:r});a.catch(()=>{});let s,c=new Promise((l,u)=>{s=setTimeout(()=>u(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([a,c]).finally(()=>clearTimeout(s))});return{status:"ok",value:Bl(i)}}catch(i){return{status:"error",error:sr(i)}}}function Bl(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function Fl(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?ia:Math.min(e,ia)}function Ye(e){return e.deliveryMode==="auth.credentials"}function et(e){return e.deliveryMode==="connections.sync"}function cr(e){return e.deliveryMode==="connect.create_link"}function nt(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function tt(e){return e.deliveryMode==="oauth.tokens"}function ur(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!Ye(e)&&!et(e)&&!cr(e)&&!nt(e)&&!tt(e)}function Ll(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function Nl(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await Xn(e,n)}}}}}catch(t){return{status:"failed",retryable:Po(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function $l(e,n){try{let t=await Dt(e,n);return Ll(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function xo(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function jl(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await St({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function Wl(e,n,t,r){let o=await jl(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},a=await ea(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!a.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(a.response&&a.response.success===!1)return{status:"failed",retryable:!1,error:typeof a.response.error=="string"?a.response.error:"Webhook handler failed"};let s=a.response?.returnToSender,c=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(a.response?.data??a.response);return{status:"ok",webhookResponse:{status:a.response?.statusCode??200,body:c,headers:a.responseHeaders}}}async function ql(e,n){return await Vn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function Kl(e,n){return await En(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function So(e,n,t){let r=await Io(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function Io(e,n,t){let r=R(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function Zl(e,n){try{return await rr(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function Gl(e,n){try{return await To(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function sa(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function zl(e,n){try{let t=sa(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await Ro({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function Jl(e,n){try{let t=sa(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await Ao({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function rt(e,n,t={}){let r=R(e),o=xo(n.headers,"x-corsair-signature"),i=xo(n.headers,"x-corsair-timestamp"),a=xo(n.headers,"x-corsair-nonce"),s=!1;if(t.signingSecret?.trim()){let l=Sn({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!l.ok)return{status:"failed",retryable:!1,error:l.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let u=ir(`nonce:${a.trim()}`,Ke);if(!u.ok)return{status:"failed",retryable:!1,error:u.error};s=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let c;try{c=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(c.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(c.type){case"webhook":return Wl(e,r,c.payload,s);case"oauth.callback":return ql(e,c.payload);case"oauth.tokens":return Kl(e,c.payload);case"permission.approve":return Io(e,c.payload,"approved");case"permission.deny":return Io(e,c.payload,"denied");case"auth.credentials":return Zl(e,c.payload);case"integration.credentials":return Gl(e,c.payload);case"connect.create_link":return $l(e,c.payload);case"connections.sync":{let l=t.signingSecret?.trim();return l?Nl(e,l):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?zl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?Jl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(c.type)}`}}}function Vl(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var _o=3,Yl=250;function Ql(e){return e?.name==="AbortError"}async function Xl(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function ed(e,n,t,r,o){for(let i=1;i<=_o;i++){try{let a=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(a.ok)return await Xl(a)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(a){if(Ql(a))throw a}i<_o&&await ca(Yl)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${_o} attempts; the run may be retried`),!1}async function nd(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:a,body:s,headers:c}=await i.json(),l=await t.process(e,{headers:c,body:s},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:u,body:d}=Vl(l);return await ed(n,t,o,{deliveryId:a,status:u,body:d},r)?"handled":"error"}var aa=1e3,td=5e3,rd=3e4;function ca(e){return new Promise(n=>setTimeout(n,e))}var lr=globalThis.__corsairConnectLoops??=new Map;function od(e,n={fetch,process:rt}){let t;try{t=W(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(lr.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");lr.set(r,o);let i=()=>{lr.get(r)===o&&lr.delete(r)},a=!1,s=null;return(async()=>{let l=aa,u=!1,d=async p=>{u||(console.warn("[corsair] connect loop error; retrying",p),u=!0),a||await ca(l),l=Math.min(l*2,td)};try{for(;!a;){s=new AbortController;let p=setTimeout(()=>s?.abort(),rd);try{await nd(e,t,n,s.signal)==="error"?await d("pull or ack failed"):(u=!1,l=aa)}catch(g){if(a)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{a=!0,s?.abort(),i()}}}function ua(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function id(e,n){return n&&!n.has(e.id)?!1:M(e)!==null}async function la(e,n,t={}){let r=R(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,a=await zn(r,o,{pluginIds:t.pluginIds}),s=new Map(a.map(l=>[l.plugin,l])),c=r.plugins.filter(l=>id(l,i)).map(l=>{let u=M(l),d=s.get(l.id);return d?{plugin:l.id,providerName:Oe(l.id),authKind:ua(u),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:Oe(l.id),authKind:ua(u),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:c}}async function da(e,n){let t=W(e);return K({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:kt})}var pa=/^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;function sd(e){return typeof e=="string"&&e.length>0}function dr(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty managed pricing credentials payload");let n=e;if(!sd(n.api_key))throw new Error("Hub API returned incomplete managed pricing credentials (expected api_key)");let t={api_key:n.api_key};n.expires_in!==void 0&&typeof n.expires_in=="number"&&Number.isFinite(n.expires_in)&&n.expires_in>0&&(t.expires_in=n.expires_in),typeof n.usage_path=="string"&&pa.test(n.usage_path)&&(t.usage_path=n.usage_path);let r=n.job;return r?.role==="start"&&typeof r.id_path=="string"&&pa.test(r.id_path)&&(t.job={role:"start",id_path:r.id_path,...typeof r.status_operation=="string"?{status_operation:r.status_operation}:{}}),t}var ga=1024*1024,fa=3e4;function Qe(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:ga}function Xe(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:fa}function Mn(e){return new w(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function ad(e){return new w(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function pr(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o(ad(n)),n)})])}finally{clearTimeout(t)}}async function gr(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:s,value:c}=await pr(()=>t.read(),n.bodyStallTimeoutMs);if(s)break;if(o+=c.byteLength,o>n.maxBodyBytes)throw Mn(n.maxBodyBytes);r.push(c)}let i=new Uint8Array(o),a=0;for(let s of r)i.set(s,a),a+=s.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var Eo=new Map;function ya(e){let n;try{n=W(e)}catch{return}let t=Nr(n);t&&Eo.get(n.projectApiKey)!==t&&(Eo.set(n.projectApiKey,t),I({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{Eo.delete(n.projectApiKey)}))}var cd=[".corsair.dev"];function ud(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function ld(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:ud(n)?!0:cd.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function ma(e){return!e||!ld(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function ha(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function Mo(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function Oo(e,n){let t=W(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=He(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=ir(`browser:${i.jti}`,De);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(et(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let s=await Xn(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:s}}})}}if(cr(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let s=i.connectLinkPlugins?.filter(Boolean)??[];if(s.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let c=await Dt(e,{tenantId:i.tenantId,plugins:s});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:c.connectUrl,expiresAt:c.expiresAt}})}}if(Ye(i))return i.hubSuccessUrl?i.credentials?(await rr(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:Mo(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:Mo(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(nt(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await So(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(tt(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await En(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!ur(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await Vn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(s){let c=s instanceof Error?s.message:"Hub delivery failed";return et(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:cr(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:Ye(i)&&i.hubSuccessUrl?{type:"redirect",url:Mo(i.hubSuccessUrl,{error:c})}:Ye(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:{type:"json",status:400,body:{error:c}}}return{type:"redirect",url:i.hubSuccessUrl}}async function Do(e,n){let t=W(e),r=await rt(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,a=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:a}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:a}}function Ho(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function Uo(e,n){return n.method==="GET"?Oo(e,n.url):Do(e,{headers:n.headers,body:n.body??""})}async function Bo(e,n){try{let t=await Uo(e,n);return Ho(t)}catch(t){if(t instanceof Te)return Response.json({error:t.message},{status:503});throw t}}async function en(e,n,t){ya(e);let r=n.method.toUpperCase(),o=ma(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await Bo(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await gr(n,{maxBodyBytes:Qe(t?.maxBodyBytes),bodyStallTimeoutMs:Xe(t?.bodyStallTimeoutMs)}):void 0});return ha(i,o)}var E=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function On(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function Dn(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var ba=new WeakMap;function Ae(e,n,t){let r=ba.get(e);r||(r=new Map,ba.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var ka=300;async function Fo(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,a=n?.forceRefresh??!1,s=`managed:${o}:${i}`;return Ae(t,s,async()=>{let[c,l,u]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!c&&!u)throw new E(o,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&c&&l&&Number(l)>d+ka)return{accessToken:c,expiresAt:Number(l),refreshed:!1};if(!u&&c&&!a){let f=l?Number(l):null;if(f===null||f>d+ka)return{accessToken:c,expiresAt:f??d+3600,refreshed:!1}}if(!u)throw new E(o,"managed");let p=await pd(r,o,i,u),g=await Dn(t,p,l);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function dd(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function pd(e,n,t,r){try{return await I({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:pn})}catch(o){let i=o instanceof Error?o.message:"";throw dd(i)?new E(n,"managed"):o}}async function wa(e,n){e._refreshAuth=async()=>(await Fo(n,{forceRefresh:!0})).accessToken}import{randomUUID as yd}from"crypto";import{createHmac as gd}from"crypto";var fd="x-corsair-runtime-proof";function ot(e,n){if(!e.runtimeProofKey)return{};let t=Math.floor((n.nowMs??Date.now())/1e3),r=gd("sha256",e.runtimeProofKey).update([t,n.path,n.plugin,n.tenantId,n.operation].join(`
+`)).digest("base64url");return{[fd]:`t=${t},v1=${r}`}}var md="",hd=60,bd=1e4,Lo=new WeakMap;function fr(e){let n=Ct(e.apiUrl),t=e.instanceKey?.trim()??"";return[encodeURIComponent(n),encodeURIComponent(e.projectApiKey),encodeURIComponent(t)].join(md)}function kd(e,n,t,r){let i=`${fr(e)}:${n}:${t}`;return r?`${i}:${r}`:i}function wd(e,n){return Lo.get(e)?.get(n)}function Cd(e,n,t){let r=Lo.get(e);r||(r=new Map,Lo.set(e,r)),r.set(n,t)}function Pd(e,n){return e.expiresAt===null?!1:e.expiresAt>n+hd}function yr(e,n){if(!n)throw new E(e,"managed_pricing",`[auth-missing:${e}:managed_pricing]: Hub config is required. Pass hub: { ... } to createCorsair().`)}async function No(e,n){yr(e.plugin,e.hub);let t=n.operation.trim();if(!t)throw new E(e.plugin,"managed_pricing",`[auth-missing:${e.plugin}:managed_pricing]: Operation id is required for Hub metering.`);let r=n.forceRefresh??!1,o=n.idempotencyKey?.trim()||void 0,i=kd(e.hub,e.plugin,e.tenantId,t),s=`managed_pricing:${o?`call:${o}`:r?"force":"routine"}:${i}`;return Ae(e.cache,s,async()=>{let c=Math.floor(Date.now()/1e3);if(!r&&!o){let d=wd(e.cache,i);if(d&&Pd(d,c))return{apiKey:d.apiKey,expiresAt:d.expiresAt,fromCache:!0}}let l=await I({hub:e.hub,path:"/managed-pricing/credentials",body:{plugin:e.plugin,tenantId:e.tenantId,operation:t,...o?{idempotencyKey:o}:{},...n.cap!==void 0?{cap:n.cap}:{},...n.jobId?{jobId:n.jobId}:{}},extraHeaders:{...ot(e.hub,{path:"/managed-pricing/credentials",plugin:e.plugin,tenantId:e.tenantId,operation:t}),"x-corsair-metered-operation":t,...o?{"x-corsair-idempotency-key":o}:{}},notFoundMessage:"Managed pricing is not configured for this project",parseResponse:dr,signal:AbortSignal.timeout(bd)}),u=l.expires_in!==void 0?c+l.expires_in:null;return o||Cd(e.cache,i,{apiKey:l.api_key,expiresAt:u}),{apiKey:l.api_key,expiresAt:u,fromCache:!1,...l.usage_path?{usagePath:l.usage_path}:{},...l.job?{startedJobIdPath:l.job.id_path}:{}}})}function mr(){return{}}async function $o(e,n){yr(n.plugin,e.hub);let t=e.tenantId?.trim();if(!t)throw new E(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: tenantId is required for metered credentials.`);let r=(n.operation??e.meteredOperationId)?.trim();if(!r)throw new E(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: Endpoint operation id missing \u2014 cannot meter usage.`);let o=yd(),i={plugin:n.plugin,tenantId:t,operation:r,idempotencyKey:o};try{let a=await No({hub:e.hub,plugin:n.plugin,tenantId:t,cache:n.cache},{operation:r,idempotencyKey:o,cap:n.cap,jobId:n.jobId});return{apiKey:a.apiKey,call:i,...a.usagePath?{usagePath:a.usagePath}:{},...a.startedJobIdPath?{startedJobIdPath:a.startedJobIdPath}:{}}}catch(a){throw Td(a)&&await jo(e.hub,i,a),a}}function Td(e){let n=typeof e=="object"&&e!==null&&"name"in e?e.name:void 0;return n==="TimeoutError"||n==="AbortError"||n==="TypeError"}async function Ca(e,n){return(await $o(e,n)).apiKey}function vd(e){try{return e instanceof Error?`${e.name}: ${e.message}`:String(e)}catch{return"Unprintable thrown value"}}var Pa=3e3;function Ta(e,n){return ot(e,{path:"/managed-pricing/usage/outcome",plugin:n.plugin,tenantId:n.tenantId,operation:n.operation})}async function jo(e,n,t){let r=vd(t);try{await I({hub:e,path:"/managed-pricing/usage/outcome",body:{...n,outcome:"failed",error:r.slice(0,300)},extraHeaders:Ta(e,n),parseResponse:o=>o,signal:AbortSignal.timeout(Pa)})}catch{}}function hr(e,n){let t=e;for(let r of n.split(".")){if(!t||typeof t!="object")return;t=t[r]}return typeof t=="number"&&Number.isFinite(t)&&t>=0?t:void 0}async function va(e,n,t){try{await I({hub:e,path:"/managed-pricing/usage/outcome",body:{...n,outcome:"succeeded",usage:{units:t}},extraHeaders:Ta(e,n),parseResponse:r=>r,signal:AbortSignal.timeout(Pa)})}catch{}}function Ra(e){return{delivery:n=>en(e,n),deliveryOptions:n=>en(e,n)}}var Aa=1200*1e3;function Wo(){return Pe()}function qo(){return Aa}function Ko(e,n){return Kn(e,n,Aa)}function Zo(e,n){return de(e,n)}function Go(e){return Ze(e)}var xa=600*1e3;function zo(){return Pe()}function Jo(){return xa}function Vo(e,n){return Kn(e,n,xa)}function Yo(e,n){return de(e,n)}function Qo(e){return Gr(e)}function Xo(e){return Ze(e)}function ei(){return Pe()}function ni(e,n,t){return Tt(e,n,Math.floor(t.getTime()/1e3))}function ti(e,n){return de(e,n)}function ri(e){return Ze(e)}var nn=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${ft}`),this.name="CorsairKekMissingError"}};function br(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new nn;let a=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${ft}`)}})}async function Rd(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function Ia(e){let{integrationId:n,accountId:t}=await Rd(e);return{integrationId:n,accountId:t}}function Sa(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>$r(t(),{tenantId:n,message:r}),list:()=>Wr(t(),{tenantId:n}),get:r=>({message:o=>jr(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>qr(t(),{chatId:r,tenantId:n})})}}var Ad=10*6e4,xd=5e3,Id=3,Sd=3e3,_d=2e3,_a=new WeakMap;function Ed(e){let n=e?.kinds;if(!Array.isArray(n))throw new Error("job-kinds: no kinds array");let t=r=>typeof r=="string"&&r.length>0;return n.filter(r=>{let o=r;return!t(o?.plugin)||!t(o?.operation)?!1:o.role==="start"?t(o.id_path):o.role==="status"?t(o.id_arg)&&t(o.status_path):o.role==="scoped"?t(o.id_arg):!1})}async function Ma(e,n){let t=fr(e),r=_a.get(n);r||(r=new Map,_a.set(n,r));let o=r.get(t);return o&&o.until>Date.now()?o.kinds:Ae(n,`managed_pricing:job_kinds:${t}`,async()=>{try{let i=await K({hub:e,path:"/managed-pricing/job-kinds",parseResponse:Ed,signal:AbortSignal.timeout(_d)});return r.set(t,{kinds:i,until:Date.now()+Ad}),i}catch{return r.set(t,{kinds:[],until:Date.now()+xd}),[]}})}function Oa(e,n,t){let r=n.toLowerCase();return e.find(o=>o.plugin===r&&o.operation===t)}function Da(e,n){let t=e;for(let r of n.split(".")){if(!t||typeof t!="object")return;t=t[r]}return t}function kr(e,n){let t=Da(e,n);return typeof t=="string"&&t.length>0?t:void 0}function oi(e,n){if(e?.role==="start"&&e.cap_path){let t=Da(n,e.cap_path);return typeof t=="number"?{cap:t}:{}}if(e?.role==="status"||e?.role==="scoped"){let t=kr(n,e.id_arg);return t?{jobId:t}:{}}return{}}async function Ea(e,n,t,r=1){let o=ot(e,{path:n,plugin:t.plugin,tenantId:t.tenantId,operation:t.operation});for(let i=1;i<=r;i++)try{return await I({hub:e,path:n,body:t,extraHeaders:o,parseResponse:a=>a,signal:AbortSignal.timeout(Sd)}),!0}catch(a){let s=ss(a);if(s!==void 0&&s!==429&&s<500)break;i<r&&await new Promise(c=>setTimeout(c,250*i))}return!1}async function Ha(e,n,t,r,o){if(n.role==="scoped")return{startedJob:!1};if(n.role==="start"){let c=kr(o,n.id_path);return!c||!t.idempotencyKey?{startedJob:!1}:(await Ea(e,"/managed-pricing/jobs",{...t,providerJobId:c},Id),{startedJob:!0})}let i=kr(r,n.id_arg),a=kr(o,n.status_path);if(!i||!a)return{startedJob:!1};let s=n.usage_path?hr(o,n.usage_path):void 0;return await Ea(e,"/managed-pricing/jobs/report",{plugin:t.plugin,tenantId:t.tenantId,operation:t.operation,providerJobId:i,providerStatus:a,...s!==void 0&&{units:s}}),{startedJob:!1}}function Ua(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function Md(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await Hs(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):Ua(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function Od(e,n,t){let r=bn(Be(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):Ua(e,i),connectUrl:i}}async function Dd(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.error.authType==="managed_pricing"?{message:e.error.message,connectUrl:null}:e.manual&&vn(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?Od(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?Md({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function Ba(e){let{message:n,connectUrl:t}=await Dd(e);throw new E(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var wr="connect.request",si="connect.cleared",Hd=600*1e3;async function ii(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function Ud(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function Bd(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[wr,si]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function Fa(e,n,t,r,o,i,a){if(a&&!i)throw new Error("encryptDataAtRest requires kek");let s=await Bd(e,n,o),c=new Date(s),l=i?mt(r,await jn(e.db,n,i)):r;await e.db.insertInto("corsair_events").values({id:dn(),created_at:c,updated_at:c,account_id:n,event_type:t,payload:l}).execute()}async function Fd(e,n,t=Date.now()){let r=await ii(e,n.tenantId,n.plugin);r&&await Fa(e,r,wr,{plugin:n.plugin,connectUrl:n.connectUrl},t,n.kek,n.encryptDataAtRest)}function Ld(e){let n=e;if(typeof e=="string")try{n=JSON.parse(e)}catch{return null}return!n||typeof n!="object"||Array.isArray(n)?null:n}async function Nd(e,n,t,r,o,i){let a=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[wr,si]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!a||a.event_type!==wr)return null;let s=a.created_at instanceof Date?a.created_at.getTime():Date.parse(String(a.created_at));if(r-s>o)return null;let c=a.payload;if(typeof c=="string")try{c=JSON.parse(c)}catch{return null}if(Gi(c)){if(!i)return null;try{c=zi(c,await jn(e.db,n,i))}catch{return null}}let l=Ld(c);if(!l)return null;let u=l.plugin,d=l.connectUrl;return typeof u!="string"||typeof d!="string"?null:{plugin:u,connectUrl:d,requestedAt:new Date(s).toISOString(),tenantId:t,requestedAtMs:s,accountId:n}}async function ai(e,n,t=Date.now(),r=Hd,o){let i=await Ud(e,n);if(i.length===0)return null;let a=(await Promise.all(i.map(u=>Nd(e,u,n,t,r,o)))).filter(u=>u!==null);if(a.length===0)return null;a.sort((u,d)=>u.requestedAtMs-d.requestedAtMs||u.accountId.localeCompare(d.accountId));let{requestedAtMs:s,accountId:c,...l}=a[0];return l}async function La(e,n,t=Date.now(),r,o,i){let a;if(r)a=await ii(e,n,r);else{let s=await ai(e,n,t,void 0,o);a=s?await ii(e,n,s.plugin):null}a&&await Fa(e,a,si,{},t,o,i)}async function ci(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await Fd(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl,encryptDataAtRest:n.encryptDataAtRest,kek:n.kek})}catch{}}var $d=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function Na(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[a||"DEFAULT"]?.handler||$d)(e,i)}var $a=new Map;function jd(e){let n=$a.get(e);return n||(n=mr(),$a.set(e,n)),n}function Wd(e){return typeof e=="function"}function ui({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:a=[],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:T,encryptDataAtRest:A}){for(let[F,O]of Object.entries(e)){let ne=n?.[F];if(Wd(O)){let P=ne,C=[...a,F].join("."),D=async(L={})=>{let te=l?.[C];Nt(C,te?.riskLevel??"write");let B,H=An(),_e=c?.mode,Bn=ao(H,_e);if(Bn){let v=te,S=v?.riskLevel??"write",le=c?.overrides?.[C],We=H!==void 0&&H!==_e&&Bn===H?$s(le,$t(S,H)):le,{result:un,reason:j,onComplete:Ln,token:pt,id:Ui,expiresAt:au}=await Ws({pluginId:o,endpointPath:C,args:L,mode:Bn,override:We,riskLevel:S,meta:v,db:u,timeoutMs:d?uo(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(un==="blocked"){let ln;j==="denied"?ln=`Action '${C}' was denied by the user. Await further instructions before proceeding.`:j==="policy"?ln=H?`Action '${C}' is blocked by permission mode '${H}'.`:`Action '${C}' is blocked by the permission policy. Update the corsair config to allow it.`:j==="timeout"?ln=`Action '${C}' timed out waiting for approval.`:pt&&Ui?ln=await so({permissionsOptions:d,manual:g,hub:f,permissionId:Ui,permissionToken:pt,plugin:o,endpoint:C,args:L,tenantId:p??"default",expiresAt:au??new Date(Date.now()+(d?uo(d.timeout):600*1e3)).toISOString(),operationPath:C}):ln=`Action '${C}' requires user approval before it can run.`;let cu=j==="denied"||j==="policy"||j==="timeout"?j:"pending";throw new pe(ln,cu)}B=Ln}let Or=async(v,S,le)=>{try{return await O(S,le)}catch(dt){if(dt instanceof Error){let We=await Na(dt,o,C,typeof le=="object"&&le!==null?le:{args:le},i);if(v<(We.maxRetries||0)){let un=v+1;console.log(`Retrying (${un} / ${We.maxRetries})...`);let j;if(We.headersRetryAfterMs)j=We.headersRetryAfterMs;else switch(We.retryStrategy){case"exponential_backoff":j=Math.pow(2,un-1)*1e3;break;case"exponential_backoff_jitter":let Ln=Math.pow(2,un-1)*1e3,pt=(Math.random()-.5)*1e3;j=Math.max(0,Ln+pt);break;case"linear_1s":j=1e3;break;case"linear_2s":j=2e3;break;case"linear_3s":j=3e3;break;case"linear_4s":j=4e3;break;default:j=1e3;break}return await new Promise(Ln=>setTimeout(Ln,j)),await Or(un,S,le)}}throw dt}},ut,je,Dr,re,lt={},Mi=!1,Hr=async v=>{je&&f&&re?.role!=="status"&&re?.role!=="scoped"&&!Mi&&await jo(f,je,v)},Oi=async(v,S)=>{if(!re||!f||!je)return;Mi=(await Ha(f,re,je,v,S)).startedJob},Di=async v=>{if(!je||!f||!Dr||re)return;let S=hr(v,Dr);S!==void 0&&await va(f,je,S)},ou={...t,meteredOperationId:C},iu=typeof t.tenantId=="string"?t.tenantId:void 0,su=h?M(h):void 0;try{if(su==="managed_pricing"&&f){let v=jd(o);re=Oa(await Ma(f,v),o,C),lt=oi(re,L);let S=await $o({hub:f,tenantId:iu??p,meteredOperationId:C},{plugin:o,cache:v,operation:C,...lt});!re&&S.startedJobIdPath&&(re={plugin:o,operation:C,role:"start",id_path:S.startedJobIdPath,status_operation:""}),ut=S.apiKey,je=S.call,Dr=S.usagePath}else s&&(ut=await s(ou,"endpoint"))}catch(v){if(v instanceof Ce)throw h&&f&&wn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await ci(u,{tenantId:v.tenantId??p,plugin:v.plugin,connectUrl:v.connectUrl,encryptDataAtRest:A,kek:A?b:void 0}),v;if(v instanceof E){h&&f&&wn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1});try{await Ba({error:v,manual:g,hub:f,plugin:h,tenantId:p,database:u,kek:b,plugins:k,multiTenancy:T})}catch(S){throw S instanceof E&&await ci(u,{tenantId:S.tenantId??p,plugin:S.pluginId,connectUrl:S.connectUrl,encryptDataAtRest:A,kek:A?b:void 0}),S}}throw v}if(!P?.before&&!P?.after){let v;try{v=await Or(0,{...t,key:ut},L),await Oi(L,v),await B?.()}catch(S){throw await Hr(S),S}return await Di(v),h&&f&&wn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),v}let Hi={...t,key:ut},Fn;try{let v=P.before?await P.before(Hi,L):{ctx:Hi,args:L,continue:!0,passToAfter:void 0};if(v.continue===!1){await Hr(new Error("Stopped by a before hook"));return}if(re){let S=oi(re,v.args);if(lt.cap!==S.cap||lt.jobId!==S.jobId)throw new Error(`A before hook changed ${C}'s ${re.role==="start"?"cap":"job id"} after Corsair checked it, so the call did not run.`)}Fn=await Or(0,v.ctx,v.args),await Oi(v.args,Fn),await P.after?.(v.ctx,Fn,v.passToAfter),await B?.()}catch(v){throw await Hr(v),v}return await Di(Fn),h&&f&&wn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),Fn};r[F]=D}else if(O&&typeof O=="object"){let P={};ui({endpoints:O,hooks:ne,ctx:t,tree:P,pluginId:o,errorHandlers:i,currentPath:[...a,F],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:T,encryptDataAtRest:A}),r[F]=P}}}var me={findByEntityId:"read",existsByEntityId:"read",findIdByEntityId:"read",findById:"read",findManyByEntityIds:"read",list:"read",search:"read",count:"read",upsertByEntityId:"write",deleteById:"destructive",deleteByEntityId:"destructive"},qd=/^\$+date$/;function ja(e){if(typeof e!="object"||e===null||Array.isArray(e))return null;let n=Object.keys(e),t=n[0];return n.length!==1||!t||!qd.test(t)?null:typeof e[t]=="string"?t:null}function tn(e){if(e instanceof Date)return{$date:e.toISOString()};if(Array.isArray(e))return e.map(tn);let n=ja(e);return n?{[`$${n}`]:e[n]}:e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,tn(r)])):e}function rn(e){let n=ja(e);if(n){let t=e[n];if(n!=="$date")return{[n.slice(1)]:t};let r=new Date(t);if(Number.isNaN(r.getTime()))throw $(`Invalid $date value "${t}" \u2014 expected an ISO 8601 timestamp`);return r}return Array.isArray(e)?e.map(rn):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,rn(r)])):e}async function li(e,n,t){let r=Object.hasOwn(me,n.method)?me[n.method]:void 0;if(!r)throw new w(404,"unknown_db_method",`Unknown db method "${n.method}" \u2014 expected one of ${Object.keys(me).join(", ")}`);Je(`${n.plugin}.db.${n.entityType}.${n.method}`,r);let i=e?.[n.plugin]?.db;if(!i)throw new w(404,"unknown_plugin",`Plugin "${n.plugin}" has no entity store`);let a=Object.hasOwn(i,n.entityType)?i[n.entityType]:void 0,s=a?.[n.method];if(typeof s!="function")throw new w(404,"unknown_entity_type",`Plugin "${n.plugin}" has no entity type "${n.entityType}"`);return s.apply(a,t)}function Kd(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function di({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,a]of Object.entries(e)){let s=n?.[i];if(Kd(a)){let c=s,l=async u=>{let d=(g,f)=>a.handler(g,f),p=o&&u?.hubVerified!==!0?await o(t,"webhook"):void 0;return!c?.before&&!c?.after?d({...t,key:p},u):(async()=>{let g={...t,key:p},f=c.before?await c.before(g,u):{ctx:g,args:u,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await c.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:a.match,handler:l}}else if(a&&typeof a=="object"){let c={};di({webhooks:a,hooks:s,ctx:t,webhooksTree:c,keyBuilder:o}),r[i]=c}}}function Wa(e){return e&&typeof e=="object"?e:{}}async function qa(e,n){return K({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Wa(t).workflows;return Array.isArray(r)?r:[]}})}async function Ka(e,n){return K({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>Wa(t).workflow})}async function Za(e,n){await I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Ga(e,n){await I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function za(e,n){return I({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function pi(e){return e&&typeof e=="object"?e:{}}async function Ja(e,n){return K({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=pi(t).runs;return Array.isArray(r)?r:[]}})}async function Va(e,n){return K({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=pi(t).runs;return Array.isArray(r)?r:[]}})}async function Ya(e,n){return K({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>pi(t).run})}async function gi(e,n,t){await I({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var Qa=(e,n)=>gi(e,"approve",n),Xa=(e,n)=>gi(e,"deny",n),ec=(e,n)=>gi(e,"cancel",n);function nc(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?Va(t(),{workflowId:r.workflowId,tenantId:n}):Ja(t(),{tenantId:n}),get:r=>Ya(t(),{runId:r,tenantId:n}),approve:r=>Qa(t(),{runId:r,tenantId:n}),deny:r=>Xa(t(),{runId:r,tenantId:n}),cancel:r=>ec(t(),{runId:r,tenantId:n})}}function tc(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>Za(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>qa(t(),{tenantId:n}),get:o=>Ka(t(),{workflowId:o,tenantId:n}),run:(o,i)=>za(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:nc(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>Ga(t(),{workflowId:o,tenantId:n,name:i})}}function Zd(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await Ia({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function Gd(e,n){let t={};for(let[r,o]of Object.entries(n))t[r]=new Proxy(o,{get(i,a){let s=i[a];if(typeof a!="string"||typeof s!="function")return s;let c=Object.hasOwn(me,a)?me[a]:void 0;if(!c)return s;let l=s;return async(...u)=>(Je(`${e}.db.${r}.${a}`,c),l.apply(i,u))}});return t}function zd(e,n,t,r,o){return e?Ur(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function fi(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:a,manualConfig:s,hubConfig:c,internalConfig:l}=n,u=r??"default",d=l&&t?()=>hn(l,u):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=Zd(t,f.id,u,d);if(h?.entities){let B={};for(let[H,_e]of Object.entries(h.entities)){let Bn=t?Ur(t.db,b,H,h.version,_e,l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o??""}:void 0):zd(void 0,b,H,h.version,_e);B[H]=Bn}g[f.id].db=B,p[f.id].db=Gd(f.id,B)}let k=f.options,T=f.authConfig,A;if(t&&o&&k?.authType){let B=T?.[k.authType]?.account??[];A=N({authType:k.authType,integrationName:f.id,tenantId:u,kek:o,database:t,extraAccountFields:B,ensureProvisioned:d}),p[f.id].keys=A}let F={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...A?{keys:A,authType:k?.authType}:{},tenantId:u,...l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o}:{},...c?{hub:c}:{}},O=f.endpoints??{},ne=f.hooks,P={...i,...f.errorHandlers},C={},D=f.options?.permissions;ui({endpoints:O,hooks:ne,ctx:F,tree:C,pluginId:f.id,errorHandlers:P,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:D,endpointMeta:f.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:f.oauthConfig,kek:o,tenantId:u}:void 0,hubConfig:c,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy,encryptDataAtRest:l?.encryptDataAtRest===!0}),Object.keys(C).length>0&&(p[f.id].api=C),F.endpoints=C;let L=f.webhooks??{},te=f.webhookHooks;if(Object.keys(L).length>0&&!Ki(k?.authType)){let B={};di({webhooks:L,hooks:te,ctx:F,webhooksTree:B,keyBuilder:f.keyBuilder}),p[f.id].webhooks=B,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=Sa(c,u),p.workflows=tc(c,u),p}function rc(e,n,t){let r={};for(let o of e){let i=o.options,a=o.authConfig;if(i?.authType){let s=a?.[i.authType]?.integration??[],c=q({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:s});r[o.id]=c}}return r}var Jd=3e4;function Cr(e){let n=e.length;for(;n>0&&e[n-1]==="/";)n--;return e.slice(0,n)}function Vd(e){let n=0;for(;n<e.length&&e[n]==="/";)n++;return e.slice(n)}function Yd(e,n){return`${Cr(e)}/${Vd(n)}`}function Qd(e,n){let t=n??{},{error:r,message:o,...i}=t;return typeof r!="string"?new w(e,"internal_error","Internal error"):new w(e,r,o,i)}var yi=Symbol("cloudRequestTimeout");async function z(e,n,t,r){let o=An(),i=e.fetch??globalThis.fetch,a=e.timeoutMs??Jd,s=new AbortController,c,l=new Promise(g=>{c=setTimeout(()=>{s.abort(),g(yi)},a)}),u;try{let g=i(Yd(e.baseUrl,t),{method:n,headers:{authorization:`Bearer ${e.apiKey}`,"content-type":"application/json",...o?{"x-corsair-mode":o}:{}},body:r===void 0?void 0:JSON.stringify(r),signal:s.signal}).catch(h=>{if(s.signal.aborted)return yi;throw h}),f=await Promise.race([g,l]);if(f===yi)throw new w(0,"internal_error","Cloud request timed out");u=f}finally{clearTimeout(c)}let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw Qd(u.status,p);if(p===void 0)throw new w(u.status,"internal_error","Invalid or empty response body from runtime");return p}var J={invoke:"/:tenant/:plugin/call/:op",entityDb:"/:tenant/:plugin/db/:entity/:method",instances:"/instances",connectLinks:"/connect/links",tenants:"/tenants",tenant:"/tenants/:id",connectionStatus:"/connection-status",disconnect:"/disconnect",permission:"/permissions/:id",permissionLookup:"/permissions/lookup-by-token"};var Xd=new Set(["keys","webhooks"]),ep=new Set(["chats","workflows"]),mi=new Set(["then","catch","finally"]);function he(e){return typeof e=="function"?e():Promise.resolve(e)}function oc(e,n,t,r){let o=async(...i)=>{let a=await he(e);return(await z(a,"POST",J.invoke.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":op",r.map(encodeURIComponent).join(".")),{args:i[0]})).data};return new Proxy(o,{get(i,a){if(!(typeof a!="string"||mi.has(a)))return oc(e,n,t,[...r,a])}})}function np(e,n,t){return new Proxy({},{get(r,o){if(!(typeof o!="string"||mi.has(o)))return new Proxy({},{get(i,a){if(typeof a!="string")return;let s=Object.hasOwn(me,a)?me[a]:void 0;if(s)return async(...c)=>{Je(`${t}.db.${o}.${a}`,s);let l=await he(e),u=await z(l,"POST",J.entityDb.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":entity",encodeURIComponent(o)).replace(":method",encodeURIComponent(a)),{args:tn(c)});return rn(u.data)}}})}})}function Pr(e,n){let t=e?new Set(e.map(r=>r.id)):null;return new Proxy({},{get(r,o){if(!(typeof o!="string"||mi.has(o))){if(ep.has(o))throw new Error(`"${o}" is not available in cloud mode (deferred)`);if(t&&!t.has(o))throw new Error(`Unknown plugin "${o}"`);return new Proxy({},{get(i,a){if(a==="api")return oc(n.transport,n.tenantId,o,[]);if(a==="db")return np(n.transport,n.tenantId,o);if(typeof a=="string"&&Xd.has(a))throw new Error(`"${a}" is not available in cloud mode (deferred)`)}})}}})}function Tr(e){return{connect:{createLink:n=>{if(!n.plugin||!n.tenantId)throw new Error('connect.createLink requires both "plugin" and "tenantId" in cloud mode');return he(e).then(t=>z(t,"POST",J.connectLinks,n))}},tenants:{create:n=>he(e).then(t=>z(t,"POST",J.tenants,n)),list:()=>he(e).then(n=>z(n,"GET",J.tenants)),get:n=>he(e).then(t=>z(t,"GET",J.tenant.replace(":id",encodeURIComponent(n))))},connectionStatus:{get:n=>he(e).then(t=>z(t,"GET",`${J.connectionStatus}?tenantId=${encodeURIComponent(n.tenantId)}`))},disconnect:n=>he(e).then(t=>z(t,"POST",J.disconnect,n)),permissions:{get:n=>he(e).then(t=>"id"in n?z(t,"GET",J.permission.replace(":id",encodeURIComponent(n.id))):z(t,"POST",J.permissionLookup,{token:n.token}))}}}var xe=class extends w{type;retryable;param;docUrl;requestId;constructor(n,t){super(n,t.code,t.message,{...t}),this.name="CloudApiError",this.type=t.type??"api_error",this.retryable=t.retryable??(n===0||n===429||n>=500),this.param=t.param,this.docUrl=t.doc_url,this.requestId=t.request_id}};function it(e,n,t){let r=t?.get("request-id")?.trim()||void 0,i=(n??{}).error;if(typeof i=="string"){let a=n.message;return new xe(e,{code:i,message:typeof a=="string"?a:void 0,request_id:r})}return i&&typeof i=="object"&&typeof i.code=="string"?new xe(e,{request_id:r,...i}):new xe(e,{code:e===0?"request_failed":"internal_error",message:`Corsair Cloud returned ${e} with no error body`,request_id:r})}var tp=3e4,rp=new Set(["GET","HEAD","PUT","DELETE"]),op=/^[a-z][a-z0-9-]{0,31}$/;function on(e,n){if(!op.test(e))throw new Error(`${n}: "${e}" is not a valid instance key. Lowercase letter first, then letters, digits or hyphens, up to 32 characters.`)}function sn(e){let n=new URLSearchParams;for(let[r,o]of Object.entries(e))o!==void 0&&n.set(r,String(o));let t=n.toString();return t?`?${t}`:""}function x(e,n){return`${e}/${encodeURIComponent(n)}`}async function vr(e,n,t,r,o={}){let i=e.fetch??globalThis.fetch,a=new AbortController;o.signal?.aborted&&a.abort();let s=()=>a.abort();o.signal?.addEventListener("abort",s,{once:!0});let c=setTimeout(()=>a.abort(),e.timeoutMs??tp),l={authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"};e.apiVersion&&(l["corsair-version"]=e.apiVersion),o.idempotencyKey&&(l["idempotency-key"]=o.idempotencyKey),o.requestId&&(l["x-corsair-request-id"]=o.requestId);let u;try{u=await i(`${e.baseUrl}${t}`,{method:n,headers:l,body:r===void 0?void 0:JSON.stringify(r),signal:a.signal});let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw it(u.status,p,u.headers);if(p===void 0&&u.status!==204)throw it(u.status,void 0,u.headers);return p}catch(d){if(o.signal?.aborted||d instanceof xe)throw d;let p=rp.has(n),g=u?p?!0:void 0:p||!!o.idempotencyKey;throw it(u?.status??0,{error:{code:"request_failed",message:d instanceof Error?d.message:String(d),retryable:g}},u?.headers)}finally{clearTimeout(c),o.signal?.removeEventListener("abort",s)}}function hi(e,n){on(n,"withInstance");let t=(s,c,l,u)=>vr(e,s,c,l,u),r=(...s)=>[n,...s].join(":"),o=s=>sn({...s,instance:n}),i=s=>`${x("/instances",n)}${s}`,a=s=>`${x("/webhooks",r(s))}/deliveries`;return{instanceKey:n,tenants:{list:(s={},c)=>t("GET",`/tenants${o(s)}`,void 0,c),create:(s,c)=>t("POST","/tenants",{...s,instance:n},c),get:(s,c)=>t("GET",x("/tenants",r(s)),void 0,c),update:(s,c,l)=>t("PATCH",x("/tenants",r(s)),c,l),delete:(s,c)=>t("DELETE",x("/tenants",r(s)),void 0,c)},access:{list:(s={},c)=>t("GET",`/access${o(s)}`,void 0,c),get:(s,c)=>t("GET",x("/access",r(s)),void 0,c),set:(s,c,l)=>t("PUT",x("/access",r(s)),c,l),revoke:(s,c)=>t("DELETE",x("/access",r(s)),void 0,c)},connections:{list:(s={},c)=>t("GET",`/connections${o(s)}`,void 0,c),get:(s,c,l)=>t("GET",x("/connections",r(s,c)),void 0,l),delete:(s,c,l)=>t("DELETE",x("/connections",r(s,c)),void 0,l)},connect:{createSession:(s,c)=>t("POST","/connect/sessions",{...s,instance:n},c)},integrations:{list:(s={},c)=>t("GET",`/integrations${o(s)}`,void 0,c),get:(s,c)=>t("GET",x("/integrations",r(s)),void 0,c),put:(s,c,l)=>t("PUT",x("/integrations",r(s)),c,l),delete:(s,c)=>t("DELETE",x("/integrations",r(s)),void 0,c),operations:(s,c)=>t("GET",`${x("/integrations",r(s))}/operations`,void 0,c),oauthApp:{get:(s,c)=>t("GET",`${x("/integrations",r(s))}/oauth-app`,void 0,c),put:(s,c,l)=>t("PUT",`${x("/integrations",r(s))}/oauth-app`,c,l),delete:(s,c)=>t("DELETE",`${x("/integrations",r(s))}/oauth-app`,void 0,c)}},webhooks:{list:(s={},c)=>t("GET",`/webhooks${o(s)}`,void 0,c),create:(s,c)=>t("POST","/webhooks",{...s,instance:n},c),get:(s,c)=>t("GET",x("/webhooks",r(s)),void 0,c),delete:(s,c)=>t("DELETE",x("/webhooks",r(s)),void 0,c),rotateSecret:(s,c,l)=>t("POST",`${x("/webhooks",r(s))}/rotate-secret`,c,l),deliveries:{list:(s,c={},l)=>t("GET",`${a(s)}${sn(c)}`,void 0,l),get:(s,c,l)=>t("GET",x(a(s),c),void 0,l),retry:(s,c,l)=>t("POST",`${x(a(s),c)}/retry`,void 0,l)}},signingSecret:{get:s=>t("GET",i("/signing-secret"),void 0,s),rotate:s=>t("POST",i("/signing-secret/rotate"),void 0,s)},apply:s=>t("POST",i("/apply"),void 0,s),removeFromRuntime:s=>t("POST",i("/remove"),void 0,s),reconcile:s=>t("POST",i("/reconcile"),void 0,s)}}function bi(e){let n=(t,r,o,i)=>vr(e,t,r,o,i);return{project:{get:t=>n("GET","/project",void 0,t)},keys:{get:t=>n("GET","/keys",void 0,t),rotate:t=>n("POST","/keys/rotate",void 0,t)},instances:{list:(t={},r)=>n("GET",`/instances${sn(t)}`,void 0,r),create:(t,r)=>(on(t.instance_key,"instances.create"),n("POST","/instances",t,r)),get:(t,r)=>(on(t,"instances.get"),n("GET",x("/instances",t),void 0,r)),update:(t,r,o)=>(on(t,"instances.update"),n("PATCH",x("/instances",t),r,o)),delete:(t,r)=>(on(t,"instances.delete"),n("DELETE",x("/instances",t),void 0,r))},integrations:{catalog:(t={},r)=>n("GET",`/integrations/catalog${sn(t)}`,void 0,r)},mcp:{links:{list:(t={},r)=>n("GET",`/mcp/links${sn(t)}`,void 0,r),mint:(t,r)=>n("POST","/mcp/links",t,r),get:(t,r)=>n("GET",x("/mcp/links",t),void 0,r),update:(t,r,o)=>n("PATCH",x("/mcp/links",t),r,o),delete:(t,r)=>n("DELETE",x("/mcp/links",t),void 0,r),rotate:(t,r)=>n("POST",`${x("/mcp/links",t)}/rotate`,void 0,r)},tokens:{mint:(t,r)=>n("POST","/mcp/tokens",t,r)}}}}var ic="default",ip="corsairCloud: the management API needs a ck_cloud_<slug>.<secret> key, or an explicit `managementUrl`.",sp=new Set(["then","catch","finally","toString","toJSON","valueOf","constructor","inspect",Symbol.toPrimitive,Symbol.toStringTag,Symbol.iterator,Symbol.asyncIterator]);function ki(e={}){return new Proxy(e,{get(n,t,r){if(Reflect.has(n,t))return Reflect.get(n,t,r);if(!sp.has(t))throw new Error(ip)}})}function Ie(e){throw new Error(`"${e}" is not available in cloud mode (deferred)`)}function ap(e){let n=e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim();if(!n)throw new Error("Cloud mode (ck_cloud_ key) requires a base URL \u2014 set hub.baseUrl or CORSAIR_CLOUD_URL.");return Nn(n),n}function sc(e){return!!(e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim())}function cp(e,n){let t=Tr(e);return{ok:()=>Ie("manage.ok"),tenants:t.tenants,plugins:{list:()=>Ie("manage.plugins.list"),get:()=>Ie("manage.plugins.get")},connectionStatus:{get:r=>{let o=r?.tenantId||void 0;if(!o&&n)throw new Error("connectionStatus.get requires a tenantId in multi-tenant mode");return t.connectionStatus.get({tenantId:o??ic})}},permissions:t.permissions,connect:{createLink:t.connect.createLink,resolve:()=>Ie("manage.connect.resolve"),oauthCallback:()=>Ie("manage.connect.oauthCallback")},disconnect:t.disconnect}}function up(e,n){let t=cp(e,n.multiTenancy);if(n.multiTenancy)return{withTenant:a=>{if(!a)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return Pr(n.plugins,{transport:e,tenantId:a})},get keys(){return Ie("keys")},get permissions(){return Ie("permissions")},manage:t};let r=Pr(n.plugins,{transport:e,tenantId:ic}),o={manage:t,get keys(){return Ie("keys")},get permissions(){return Ie("permissions")}};return new Proxy(r,{get(a,s,c){return typeof s=="string"&&s in o?Reflect.get(o,s,c):Reflect.get(a,s,c)}})}function ac(e){return up({baseUrl:ap(e.hub),apiKey:e.hub.projectApiKey},{multiTenancy:!!e.multiTenancy,plugins:e.plugins})}function lp(e){let n=Cr(e),t="/api/corsair";return n.endsWith(t)?n.slice(0,-t.length):n}async function dp(e){let n=await z({...e,baseUrl:lp(e.baseUrl)},"GET",J.instances),t=new Map;for(let r of n.instances)Nn(r.url,`Instance "${r.instanceKey}" URL`),t.set(r.instanceKey,r.url);return t}function pp(e){let n=e.apiKey?.trim();if(!n)throw new Error("corsairCloud: apiKey is required");let t=Bi(n),r=e.url?.trim()||Fi(n);if(!r)throw new Error("corsairCloud: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");Nn(r);let o={baseUrl:r,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs},a=(Cr(e.managementUrl?.trim()??"")||void 0)??(t?Li(r,t):null);a&&Nn(a,"Management base URL");let s=a?{baseUrl:a,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs,apiVersion:e.apiVersion}:null,c=null;function l(g){return g&&c===g&&(c=null),c||(c=dp(o).catch(f=>{throw c=null,f})),c}async function u(g){let f=l(),b=(await f).get(g)??(await l(f)).get(g);if(b)return b;let k=[...(await l()).keys()].join(", ");throw new Error(`corsairCloud.withInstance("${g}"): no such instance \u2014 available: ${k||"(none)"}`)}let d=Tr(o),p={tenants:d.tenants,permissions:d.permissions};return{manage:s?{...bi(s),...p}:ki(p),withInstance:g=>{let f=s?hi(s,g):ki(),h=async()=>({...o,baseUrl:await u(g)}),b=Tr(h),k={withTenant(T){if(!T)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return Pr(void 0,{transport:h,tenantId:T})},connectionStatus:b.connectionStatus,disconnect:b.disconnect,createConnectLink:b.connect.createLink};return s?{...f,...k}:ki(k)}}}var gp="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function cc(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${gp}`),t):n}var fp=e=>new w(404,"unknown_plugin",`Plugin '${e}' is not registered.`),yp=(e,n)=>new w(404,"unknown_op",`Operation '${n}' not found on plugin '${e}'.`),Rr=(e="/call")=>new w(403,"call_disabled",`The ${e} route is disabled. Construct managementHandler with { unsafeAllowUnauthenticated: true } to enable it \u2014 only when your own backend fronts the handler.`),mp=e=>new w(401,"not_connected",`Tenant is not connected for plugin '${e}'. Reconnect and retry.`),uc=e=>new w(403,"permission_denied",`The call was blocked (${e}).`,{reason:e}),hp=()=>new w(403,"approval_required","This action needs human approval before it can run. Approval is not resumable over HTTP in this version.",{reason:"pending"}),bp=(e,n)=>new w(502,"provider_error","The provider returned an error.",{providerStatus:e,body:n});function kp(e,n){if(e instanceof w)return e;if(e instanceof E)return mp(e.pluginId||n);if(e instanceof Rn)return uc("readonly");if(e instanceof pe)return e.reason==="pending"?hp():uc(e.reason);if(e instanceof Error&&e.name==="ApiError"){let t=e;return bp(typeof t.status=="number"?t.status:502,t.body)}return console.error("[corsair] unhandled error in call operation",e),new w(500,"internal_error","Internal error")}var wp=new WeakMap,lc=new WeakMap,Cp=512;function dc(e,n){let t=e.get(n);return t||(t=new Map,e.set(n,t)),t}function Pp(e,n,t){if(n.size<=Cp)return;let r=lc.get(e);for(let o of n.keys())if(o!==t&&(r?.get(o)??0)===0){n.delete(o);return}}function Tp(e,n,t){if(!n.multiTenancy)return{client:e};let r=typeof t=="string"?t.trim():"";if(!r)throw $("tenant is required for a multi-tenant runtime",{missingFields:["tenant"]});let o=dc(wp,e),i=o.get(r);if(i)return o.delete(r),o.set(r,i),{client:i,tenantId:r};let a=e.withTenant(r);return o.set(r,a),Pp(e,o,r),{client:a,tenantId:r}}function vp(e,n){let t=e;for(let r of n.split(".")){if(t==null||typeof t!="object"||!Object.prototype.hasOwnProperty.call(t,r))return null;t=t[r]}return typeof t=="function"?t:null}function pc(e,n=[]){let t=[];for(let[r,o]of Object.entries(e??{}))typeof o=="function"?t.push([...n,r].join(".")):o&&typeof o=="object"&&t.push(...pc(o,[...n,r]));return t}function gc(e){let n={};for(let t of e.plugins)n[t.id]=pc(t.endpoints??{});return n}async function wi(e,n,t,r){if(!n.plugins.some(s=>s.id===t.plugin))throw fp(t.plugin);let{client:o,tenantId:i}=Tp(e,n,t.tenant),a=i?dc(lc,e):null;a&&i&&a.set(i,(a.get(i)??0)+1);try{return await r(o)}catch(s){throw kp(s,t.plugin)}finally{if(a&&i){let s=(a.get(i)??1)-1;s<=0?a.delete(i):a.set(i,s)}}}async function fc(e,n,{plugin:t,op:r,tenant:o,args:i}){return wi(e,n,{plugin:t,tenant:o},a=>{let s=a[t],c=vp(s?.api,r);if(!c)throw yp(t,r);return c(i??{})})}function an(e,n){if(e===void 0)return n;if(e===null)throw new w(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function st(e){if(e!==void 0)throw new w(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var hc=[{method:"GET",pattern:"/ok",public:!0,handler:async()=>_(200,jt())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>(st(n),_(200,await In(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>(st(t),_(201,await Kt(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(st(t),_(200,await qt(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>_(200,await xn(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>_(200,await Wt(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>_(200,await Zt(e,an(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(st(t),_(200,await po(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",public:!0,handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?_(200,await fo(e,t)):_(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=an(r,o.tenantId);return _(200,await zt(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",public:!0,handler:async({corsair:e,internal:n,query:t})=>_(200,await Jt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",public:!0,handler:async({corsair:e,internal:n,body:t})=>_(200,await Vt(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=an(t,n.tenantId)??"default",o=e.database?await ai(e.database,r,void 0,void 0,e.encryptDataAtRest?e.kek:void 0):null;return _(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=an(t,r?.tenantId)??"default";return e.database&&await La(e.database,o,void 0,r?.plugin,e.encryptDataAtRest?e.kek:void 0,e.encryptDataAtRest),_(200,{ok:!0})}},{method:"POST",pattern:"/disconnect",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n??{},o=an(t,r.tenantId);return _(200,await Gt(e,{...r,tenantId:o}))}},{method:"GET",pattern:"/call",handler:async({internal:e,allowCall:n})=>{if(!n)throw Rr();return _(200,{plugins:gc(e)})}},{method:"POST",pattern:"/:tenant/:plugin/db/:entityType/:method",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw Rr("/db");st(i);let s=o??{};if(s.args!==void 0&&!Array.isArray(s.args))throw $("args must be an array");let c=an(i,r.tenant),l=rn(s.args??[]),u=await wi(e,n,{plugin:r.plugin,tenant:c},d=>mc(t,()=>li(d,{plugin:r.plugin,entityType:r.entityType,method:r.method},l)));return _(200,{data:tn(u)})}},{method:"POST",pattern:"/:tenant/:plugin/call/:op",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw Rr();let s=o??{},c=an(i,r.tenant),l=await mc(t,()=>fc(e,n,{plugin:r.plugin,op:r.op,tenant:c,args:s.args}));return _(200,{data:l})}}];(()=>{let e=new Set;for(let n of hc){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function Rp(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let a=t[i],s=r[i];if(a.startsWith(":"))o[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return o}function Ap(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function xp(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await gr(e,n).catch(o=>{throw o instanceof w?o:new w(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new w(400,"invalid_json","Request body is not valid JSON")}}var Ip="/api/corsair",yc=new Set(["open","cautious","strict","readonly"]);function mc(e,n){let t=e.headers.get("x-corsair-mode");if(t===null)return n();if(!yc.has(t))throw $(`Unknown permission mode "${t}" \u2014 expected one of ${[...yc].join(", ")}`);return Lt(t,n)}function Z(e,n={}){let t=n.basePath??Ip,r=Qe(n.maxBodyBytes),o=Xe(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},a=R(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async s=>{try{let c=s.headers.get("content-length");if(c!==null&&Number(c)>r)throw Mn(r);let l=new URL(s.url),u=Ap(l.pathname,t),d=s.method.toUpperCase();if(d==="OPTIONS"||u==="/"||u==="")return await en(e,s,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return _(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(l.searchParams);for(let g of hc){if(g.method!==d)continue;let f=Rp(g.pattern,u);if(!f)continue;if(!g.public&&n.authenticate&&!await n.authenticate(s))return _(401,{error:"unauthorized",message:"invalid or missing credentials"});let h=await xp(s,i),b=n.resolveTenant?await n.resolveTenant(s):void 0;return await g.handler({corsair:e,internal:a,req:s,params:f,query:p,body:h,scopedTenant:b,allowCall:(n.unsafeAllowUnauthenticated??!1)||!!n.authenticate})}throw Fe(`No route for ${d} ${u}`)}catch(c){if(n.onError){let u=await n.onError(c,s);if(u)return u}if(c instanceof w)return ge(c);let l=c instanceof Error?c.message:"Internal server error";return _(500,{error:"internal_error",message:l})}}}function Sp(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function _p(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function Ep(e,n,t){let r=[],o=0,i=e();try{let a=await pr(()=>i.next(),t);for(;a.done!==!0;){let s=_p(a.value);if(o+=s.byteLength,o>n)throw Mn(n);r.push(s),a=await pr(()=>i.next(),t)}return Buffer.concat(r)}catch(a){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw a}}var bc=!1;function Mp(){bc||(bc=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function Op(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=Qe(n.maxBodyBytes),o=Xe(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(Mp(),i=JSON.stringify(e.body));else{let s=e[Symbol.asyncIterator];if(typeof s!="function")return;let c=await Ep(s.bind(e),r,o);c.length>0&&(i=c)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw Mn(r);return typeof i=="string"?i:i}function Q(e){e.resume?.()}async function Ne(e,n={}){let t=Sp(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,a=new Headers;for(let[l,u]of Object.entries(e.headers))if(u!=null&&!Dp.has(l.toLowerCase()))if(Array.isArray(u))for(let d of u)a.append(l,d);else a.set(l,u);let s={method:(e.method??"GET").toUpperCase(),headers:a},c=await Op(e,n);return c!==void 0&&(s.body=c,a.has("content-type")||a.set("content-type","application/json")),new Request(i,s)}async function X(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var Dp=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function kc(e,n){let t=Z(e,n);return async(r,o,i)=>{try{let a=await t(await Ne(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await X(o,a)}catch(a){if(a instanceof w&&o.headersSent!==!0){await X(o,ge(a)),Q(r);return}Q(r),i(a)}}}function Hp(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function Up(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=Hp(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function wc(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function Cc(e,n){let t=Z(e,n);return async(r,o)=>{Up(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let a=await t(await Ne(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await X(o.raw,a)}catch(a){if(a instanceof w&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await X(o.raw,ge(a)),Q(i);return}throw Q(i),a}}}function Pc(e,n){let t=Z(e,n);return r=>t(r.req.raw)}function Tc(e,n){let t=Z(e,n);return{GET:t,POST:t,OPTIONS:t}}function vc(e,n){let t=Z(e,n);return async(r,o)=>{try{let i=await t(await Ne(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await X(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),Q(r);return}if(i instanceof w){await X(o,ge(i)),Q(r);return}console.error("[corsair] management handler failed:",i),await X(o,_(500,{error:"internal_error"})),Q(r)}}}function Ar(e,n){let t=Z(e,n);return r=>t(r.request)}function Rc(e,n){let t=Ar(e,n);return{GET:t,POST:t,OPTIONS:t}}function Ac(e,n){let t=Ar(e,n);return{loader:t,action:t}}function xc(e,n){let t=Ar(e,n);return{GET:t,POST:t,OPTIONS:t}}function Ic(e,n){let t=Ar(e,n);return{GET:t,POST:t,OPTIONS:t}}function Sc(e,n){let t=Z(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await Ne(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await X(r.node.res,i)}catch(i){if(i instanceof w&&r.node.res.headersSent!==!0){await X(r.node.res,ge(i)),Q(o);return}throw Q(o),i}}}function _c(e,n){return Z(e,n)}function Ec(e){let n={[at]:e};return{ok:jt,tenants:{list:()=>In(e),create:t=>Kt(e,t),get:t=>qt(e,t)},plugins:{list:()=>xn(e),get:t=>Wt(e,t)},connectionStatus:{get:t=>Zt(e,t?.tenantId)},permissions:{get:t=>zs(e,t)},connect:{createLink:t=>zt(n,e,t),resolve:t=>Jt(n,e,t),oauthCallback:t=>Vt(n,e,t)},disconnect:t=>Gt(e,t)}}async function Mc(e,n,t,r,o="pending",i){if(i==="")throw new Error("encryptDataAtRest requires kek");if(!e)return null;try{let a=dn(),s=new Date,c=i?mt(r,await jn(e.db,n,i)):r;return await e.db.insertInto("corsair_events").values({id:a,created_at:s,updated_at:s,account_id:n,event_type:t,payload:c,status:o}).execute(),a}catch(a){return console.warn("Failed to log event:",a),null}}async function Bp(e,n,t,r="pending"){if(e.encryptDataAtRest&&!e.kek)throw new Error("encryptDataAtRest requires kek");try{let o=await e.$getAccountId();return Mc(e.database,o,n,t,r,e.encryptDataAtRest?e.kek:void 0)}catch(o){return console.warn("Failed to log event:",o),null}}import*as Dc from"https";import*as xr from"querystring";var Fp=["expires_in","refresh_token_expires_in"];function Oc(e){let n={...e};for(let t of Fp){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function Lp(e){try{return Oc(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=xr.parse(e);return!n.access_token&&!n.error?null:Oc({...n})}function _t(e,n,t,r,o){let i=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,c)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};a||(l.client_id=n,l.client_secret=t);let u=xr.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(u).toString()};a&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=Dc.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){c(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=Lp(f);h?s(h):c(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>c(new Error(`Request failed: ${g.message}`))),p.write(u),p.end()})}async function Hc(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[a,s,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(On({accessToken:a,expiresAt:s,forceRefresh:n?.forceRefresh}))return{accessToken:a,expiresAt:Number(s),refreshed:!1};if(!c)throw new E(o,"oauth_2");let l=await I({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:c},parseResponse:pn}),u=await Dn(t,l,s);return{accessToken:l.access_token,expiresAt:u,refreshed:!0}}async function Uc(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:a="form",extraParams:s}=e,c={grant_type:"refresh_token",refresh_token:t,...s},l={Accept:"application/json"};i==="basic"?l.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?l.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(c.client_id=o),c.client_secret=r),a==="json"?l["Content-Type"]="application/json":l["Content-Type"]="application/x-www-form-urlencoded";let u=await fetch(n,{method:"POST",headers:l,body:a==="json"?JSON.stringify(c):new URLSearchParams(c)});if(!u.ok)throw new Error(`OAuth token refresh failed (${u.status}): ${await u.text()}`);let d=JSON.parse(await u.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function Bc(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new E(n.plugin,"oauth_2");let l={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},u=g=>Ae(e.keys,r,async()=>(await Hc(l,{forceRefresh:g})).accessToken);e._refreshAuth=()=>u(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return On({accessToken:d,expiresAt:p})?d:u(!1)}let o=t.client_secret,i=t.client_id,a=l=>Ae(e.keys,r,async()=>{let[u,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!l&&On({accessToken:u,expiresAt:d}))return u;if(!p)throw new E(n.plugin,"oauth_2");let g=await Uc({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await Dn(e.keys,g,d),g.access_token});e._refreshAuth=()=>a(!0);let[s,c]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return On({accessToken:s,expiresAt:c})?s:a(!1)}var Fc="  ";function ce(e){let n=e;return n._def??n.def??{}}function ue(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function ae(e){return e.innerType??e.schema??e.out??e.in}function Nc(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return ae(e)}}function $c(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Sr(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Hn(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function jc(e,n){return e.description??n.description}function $p(e){let n=e;for(;n;){let t=ce(n),r=jc(n,t);if(r)return r;let o=ue(t);if(Ri(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=Nc(t,o);continue}break}}function Ri(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function ee(e){let n=ce(e),t=ue(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Hn(n)[0]??"unknown");case"ZodEnum":return Hn(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=ae(n);return r?ee(r):"unknown"}case"ZodNullable":{let r=ae(n);return`${r?ee(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=ae(n);return r?ee(r):"unknown"}case"ZodArray":{let r=$c(n);if(!r)return"unknown[]";let o=ce(r),i=ue(o)==="ZodUnion",a=ee(r);return`${i?`(${a})`:a}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Sr(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([a,s])=>{let c=ue(ce(s));return`${c==="ZodOptional"||c==="ZodNullable"?a+"?":a}: ${ee(s)}`}).join(", ")} }`}case"ZodUnion":return Hn(n).map(r=>ee(r)).join(" | ");case"ZodIntersection":return`${ee(n.left)} & ${ee(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=Nc(n,t);return r?ee(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function Se(e){let n=ce(e),t=ue(n),r=jc(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??Hn(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=Hn(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=ae(n),i=o?Se(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=ae(n),i=o?Se(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=ae(n);return o?{...Se(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=$c(n);return{kind:"array",optional:!1,description:r,items:o?Se(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=Sr(e,n),i={};for(let[a,s]of Object.entries(o))i[a]=Se(s);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=Hn(n);for(let i of o){let a=ce(i);if(ue(a)==="ZodObject")return{...Se(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=ae(n);return o?{...Se(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function Dv(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),a=e.find(u=>u.id===o);if(!a)return null;let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=$e(a.endpointMeta,s),l=$e(a.endpointSchemas,s);return!c&&!l?null:{input:l?.input?Se(l.input):null,output:l?.output?Se(l.output):null,description:c?.description}}var Ai=["equals","contains","startsWith","endsWith","in"],jp=["equals","gt","gte","lt","lte","in"],Wp=["equals"],qp=["equals","before","after","between"];function Wc(e){let n=ce(e);switch(ue(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=ae(n);return r?Wc(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function xi(e){let n=ce(e),t=ue(n);if(Ri(t)){let i=ae(n);return i?xi(i):{}}if(t!=="ZodObject")return{};let r=Sr(e,n),o={};for(let[i,a]of Object.entries(r)){let s=Wc(a);s==="string"?o[i]={type:"string",operators:Ai}:s==="number"?o[i]={type:"number",operators:jp}:s==="boolean"?o[i]={type:"boolean",operators:Wp}:s==="date"&&(o[i]={type:"date",operators:qp})}return o}function qc(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function Pi(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&Pi(o,i,t)}}function Ti(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function vi(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];Ti(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&vi(o,i,t)}}function Ii(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!o)return null;let[i,a]=o;if(r.length===0)return Ti(a)?[i]:null;if(a!==null&&typeof a=="object"&&!Ti(a)){let s=Ii(a,r);if(s!==null)return[i,...s]}return null}function Kc(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let a="    ".repeat(i+2);t.push(`${a}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let a="    ".repeat(i+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var Kp=new Set(ht);function cn(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(s=>s.id===r);if(!i)return Kp.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:cn(e);if(t==="webhooks"){if(!i.webhooks)return[];let s=[];return vi(i.webhooks,[],s),s.map(c=>`${i.id}.webhooks.${c}`)}if(t==="db"){let s=i.schema?.entities;return s?Object.keys(s).map(c=>`${i.id}.db.${c}.search`):[]}if(!i.endpoints)return[];let a=[];return Pi(i.endpoints,[],a),a.map(s=>`${i.id}.api.${s}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let a=[];vi(i.webhooks,[],a),o[i.id]=a.map(s=>`${i.id}.webhooks.${s}`)}else if(t==="db")for(let i of e){let a=i.schema?.entities;a&&(o[i.id]=Object.keys(a).map(s=>`${i.id}.db.${s}.search`))}else for(let i of e){if(!i.endpoints)continue;let a=[];Pi(i.endpoints,[],a),o[i.id]=a.map(s=>`${i.id}.api.${s}`)}return o}function $e(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function Zp(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),a=i.startsWith(".")?i.slice(1):i;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function Ci(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function Hv(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),a=e.find(s=>s.id===o);if(a){if(i.startsWith("db.")){let u=i.slice(3),d=u.lastIndexOf(".");if(d!==-1){let p=u.slice(0,d),g=u.slice(d+1),f=a.schema?.entities;if(g==="search"&&f){let h=qc(f,p);if(h){let[b,k]=h,T=xi(k),A=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${Ai.join(", ")}]`];for(let[F,O]of Object.entries(T))A.push(`  ${F}?: ${O.type}  [${O.operators.join(", ")}]`);return A.push("}"),A.join(`
+`)}}}return Ci(cn(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let u=i.slice(9);if(a.webhooks){let d=Ii(a.webhooks,u.split("."));if(d!==null){let p=d.join("."),g=$e(a.webhookSchemas,p.toLowerCase()),f=g?.response?ee(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${Ir(Un(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${Kc(o,d)}`),h.join(`
+
+`)}}return Ci(cn(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=$e(a.endpointMeta,s),l=$e(a.endpointSchemas,s);if(c||l){let u=[],d=[c?.riskLevel?`[${c.riskLevel}]`:"",c?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[c?.description,d].filter(Boolean).join("  ");return p&&u.push(p),l?.input&&u.push(`input ${Ir(Un(l.input))}`),l?.output&&u.push(`output ${Ir(Un(l.output))}`),u.join(`
+
+`)}}}return Ci(cn(e),"Path not found. Available operations")}function Lc(e){let n=e;for(;;){let t=ce(n),r=ue(t);if(Ri(r)){let o=ae(t);if(!o)return n;n=o;continue}return n}}function Un(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=Lc(e),t=ce(n);if(ue(t)==="ZodObject"){let o=Sr(n,t),i=[];for(let[a,s]of Object.entries(o)){let c=ce(s),l=ue(c),u=l==="ZodOptional"||l==="ZodNullable",d=Lc(s),p=$p(s);i.push({key:a,optional:u,type:ee(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:ee(n)}}function Ir(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=Fc.repeat(n+1),r=Fc.repeat(n);return`{
+${e.fields.map(i=>{let a=i.optional?`${i.key}?`:i.key,s=i.description?`  // ${i.description}`:"";return`${t}${a}: ${i.type}${s}`}).join(`
+`)}
+${r}}`}return"unknown"}function Gp(e,n){let t=cn(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(u=>u.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let u of t){let{shortPath:d,lookupKey:p}=Zp(u,n),g=$e(r.endpointMeta,p),f=$e(r.endpointSchemas,p);!g&&!f||o.push({path:u,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Un(f?.input),output:Un(f?.output)})}o.sort((u,d)=>u.path.localeCompare(d.path));let i=[],a=cn(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let u of a){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=Ii(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=$e(r.webhookSchemas,b.toLowerCase()),T=k?.response?ee(k.response):void 0;i.push({path:u,description:k?.description,payload:Un(k?.payload),responseType:T,usageExample:Kc(n,h)})}i.sort((u,d)=>u.path.localeCompare(d.path));let s=[],c=cn(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(c)&&l)for(let u of c){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let T=qc(l,b);if(!T)continue;let[A,F]=T,O=xi(F),ne=Object.entries(O).map(([P,C])=>({field:P,type:C.type,operators:C.operators}));s.push({path:u,entityName:A,filters:[{field:"entity_id",type:"string",operators:Ai},...ne]})}return s.sort((u,d)=>u.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:s}}}import{randomUUID as Zc}from"crypto";async function zp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Zc(),o=Zc(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as Jp}from"crypto";var _r="https://graph.microsoft.com/v1.0",Si=2e4,Vp=60;async function Yp(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${_r}/subscriptions`,{headers:r,signal:AbortSignal.timeout(Si)});if(c.ok){let{value:l}=await c.json(),u=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(u.map(d=>fetch(`${_r}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(Si)}).catch(()=>{})))}}catch{}let o=Jp(),i=new Date(Date.now()+Vp*6e4).toISOString(),a=await fetch(`${_r}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(Si),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!a.ok)throw new Error(`MS Graph subscribe failed (${a.status}): ${await a.text()}`);let s=await a.json();return s.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:s.id},webhookSecret:o}):null}function Gc(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function Qp(e,n){let t=Gc(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function Xp(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function zc(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function Jc(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function ct(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function eg(e){return ct(e.body)}function Vc(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Er(Array.isArray(r)?r:[r])}function Yc(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let l=Er(Array.isArray(c)?c:[c]);if(l)return decodeURIComponent(l)}let r=Vc({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let l=n[c],u=Array.isArray(l)?l[0]:l;if(!(!u||typeof u!="string"))try{let p=(u.startsWith("http")?new URL(u):new URL(`https://example.invalid${u.startsWith("/")?u:`/${u}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=ct(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Er([a?.validationToken])??null}function ng(e){if(Yc(e))return!0;let n=ct(e.body??e.payload);return zc(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Er(e){for(let n of e){let t=Jc(n);if(t)return t}}function tg(e){let t=ct(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var at=Symbol.for("corsair:internal");function nu(e){if(e.hub?.projectApiKey?.startsWith("ck_cloud_")&&sc(e.hub))return ac(e);let n=e.database?$i(e.database,{dbTables:e.dbTables}):void 0,t=e.kek??"",r=n&&t?rc(e.plugins,n,t):br(!!n,!!t),o=cc(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?vt(e.hub):void 0,encryptDataAtRest:e.encryptDataAtRest===!0},a=js(n),s=Ec(i);if(e.multiTenancy){let u=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=fi(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[at]:i})},keys:r,permissions:a,manage:s},{[at]:i});return Qc(u,i.hub),eu(u,i.hub),u}let c=fi(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},c,{keys:r,permissions:a,manage:s,[at]:i});return Qc(l,i.hub),eu(l,i.hub),l}function Qc(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-N7WXSPM3.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function rg(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var Xc=globalThis.__corsairTunnels??=new Set,og=1e3,ig=3e4;function sg(e){let n=e.schedule??((a,s)=>void setTimeout(a,s).unref?.()),t=e.minDelayMs??og,r=e.maxDelayMs??ig,o=t,i=()=>{let a=!1,s=()=>{a||(a=!0,n(i,o),o=Math.min(o*2,r))};e.start(s).then(()=>{o=t}).catch(s)};i()}function eu(e,n){if(!rg(n))return;let t=n.projectApiKey;if(Xc.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}Xc.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Br;sg({start:a=>import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:a})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Fr}`)}).catch(s=>{throw console.warn(`[corsair] tunnel down: ${s instanceof Error?s.message:String(s)}. Retrying \u2014 run \`corsair setup\` if it doesn't recover.`),s})})}var ag={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},_i=ag;async function Et(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},a=n?.caller??"script",s=Wi(e);if(!s)throw new Error("setupCorsair: invalid corsair instance");if(!s.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=kg(e,s.plugins,n),l={...s,database:s.database},u=l.database.db;await Pg(l.database,i);let d=await Tg(u,l,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Ag(e,c,n.credentials,l,o,i);let p=await Ig(d,c,o,a);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=nu({plugins:s.plugins,database:u,kek:s.kek,multiTenancy:!0,...s.encryptDataAtRest?{encryptDataAtRest:!0}:{}}).withTenant(c.tenantId);await Sg(g,s.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function Ei(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...G[n][t],...r])}function bg(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(s=>s.id===t);if(!o)continue;let i=M(o);if(!i)continue;let a=Ei(o,i,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function kg(e,n,t){let r=qi(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&bg(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function ru(e,n){return Me(e)?n===0?!0:Object.values(e).every(t=>ru(t,n-1)):!1}function wg(e){return ru(e,4)}var Cg=Vi;function Mr(e){if(e instanceof gg){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof hg?Mr(r):"unknown";return n}return e instanceof dg?`${Mr(e.unwrap())} | null`:e instanceof fg?`${Mr(e.unwrap())} | undefined`:e instanceof lg?e.options.join(" | "):e instanceof mg?"string":e instanceof pg?"number":e instanceof cg?"boolean":e instanceof ug?"date":e instanceof yg?"jsonb":"unknown"}async function Pg(e,n){let t=await e.db.introspection.getTables(),r=new Set(t.map(i=>i.name)),o=e.tableNames??Ni();for(let[i,a]of Object.entries(Cg)){let s=o[i];if(!r.has(s)){let c=s!==i?` (dbTables.${i} \u2192 "${s}")`:"";n(`[corsair:setup] Table "${s}" does not exist${c}. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(Mr(a),null,2)}`)}}}async function Tg(e,n,t,r,o){let i=new Date,a=new Map;for(let s of n.plugins){let c=s.id,l=M(s),u=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!u){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),u=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=l?s.authConfig?.[l]?.integration??[]:[],p=l?s.authConfig?.[l]?.account??[]:[],g=l&&u?q({authType:l,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(u&&!u.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!u||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",u.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:u.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&N({authType:l,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}a.set(c,{pluginId:c,authType:l,integration:g,account:f,integrationFields:[...G[l].integration,...d],accountFields:r?[...G[l].account,...p]:[]})}return a}function vg(e){if(!Me(e))return;let n=e.keys;return Me(n)?n:void 0}function Rg(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Ag(e,n,t,r,o,i){let a=vg(e),s=n.provisionAccounts?Rg(e,n.tenantId):void 0;for(let[c,l]of Object.entries(t)){let u=r.plugins.find(k=>k.id===c);if(!u){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=M(u);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=Ei(u,d,"integration"),g=Ei(u,d,"account"),f=a?.[c],h=s?.[c],b=Me(h)?h.keys:void 0;for(let[k,T]of Object.entries(l))if(T){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let A=oe(f,`set_${k}`);if(!A){i(`[corsair:setup] Cannot set integration field '${k}' for '${c}'.`);continue}await A(T),o(`[corsair:setup] Set ${c} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${k}' on a multi-tenant instance`);let A=oe(b,`set_${k}`);if(!A){i(`[corsair:setup] Cannot set account field '${k}' for '${c}'.`);continue}await A(T),o(`[corsair:setup] Set ${c} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${c}'.`)}}}var tu=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function xg(e,n,t,r,o,i,a,s,c){let l=[],u=[];for(let p of o){if(tu.has(p))continue;let g=oe(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(tu.has(p))continue;let g=oe(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}let d=l.length===0&&u.length===0;if(n==="managed_pricing")s(`[corsair:setup] '${e}' (managed_pricing) uses Corsair metered credentials via Hub \u2014 nothing to store in your database. Pass hub: { ... } to createCorsair().`);else if(d)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...u];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of u){let h=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}s(g.join(`
+`))}}return d}async function Ig(e,n,t,r){let o=new Set;for(let i of e.values())await xg(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function Sg(e,n,t,r,o){if(!wg(_i)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=_i,a=new Set(n.map(s=>s.id));for(let[s,c]of Object.entries(i)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let l=Me(e)?e[s]:void 0,u=Me(l)?l.api:void 0;if(u)for(let[d,p]of Object.entries(c))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${d}.${g}...`);try{let h=Me(u)?u[d]:void 0;await oe(h,g)?.(f)}catch(h){o(`[corsair:setup] ${s} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{Yi as a,Oe as b,Ce as c,bt as d,kt as e,wt as f,pn as g,Qi as h,Lr as i,Zr as j,Wn as k,cs as l,us as m,De as n,Ke as o,Pe as p,fn as q,yn as r,He as s,zr as t,ds as u,Zn as v,Te as w,Gn as x,Jr as y,vt as z,W as A,Rt as B,mn as C,q as D,N as E,fs as F,ys as G,Et as H,Ag as I,Be as J,Yr as K,kn as L,Cn as M,Xr as N,St as O,Rs as P,ze as Q,Y as R,eo as S,Vn as T,Ss as U,qu as V,Mt as W,qy as X,Ms as Y,Os as Z,Ds as _,Hs as $,Ot as aa,no as ba,pe as ca,Ht as da,Ut as ea,Rn as fa,Lt as ga,An as ha,co as ia,Ns as ja,Nt as ka,Je as la,w as ma,mo as na,ho as oa,Yt as pa,bo as qa,Sn as ra,_n as sa,Qt as ta,Xt as ua,Yn as va,ko as wa,wo as xa,er as ya,Qn as za,nr as Aa,tr as Ba,Le as Ca,En as Da,ea as Ea,Ro as Fa,Ao as Ga,Ye as Ha,nt as Ia,tt as Ja,ur as Ka,So as La,rt as Ma,Vl as Na,nd as Oa,od as Pa,la as Qa,da as Ra,dr as Sa,ga as Ta,fa as Ua,Qe as Va,Xe as Wa,Oo as Xa,Do as Ya,Ho as Za,Uo as _a,Bo as $a,en as ab,E as bb,Fo as cb,wa as db,yr as eb,No as fb,mr as gb,Ca as hb,Ra as ib,Wo as jb,qo as kb,Ko as lb,Zo as mb,Go as nb,zo as ob,Jo as pb,Vo as qb,Yo as rb,Qo as sb,Xo as tb,ei as ub,ni as vb,ti as wb,ri as xb,nn as yb,me as zb,tn as Ab,rn as Bb,li as Cb,xe as Db,pp as Eb,Z as Fb,kc as Gb,wc as Hb,Cc as Ib,Pc as Jb,Tc as Kb,vc as Lb,Rc as Mb,Ac as Nb,xc as Ob,Ic as Pb,Sc as Qb,_c as Rb,Mc as Sb,Bp as Tb,_t as Ub,Bc as Vb,Dv as Wb,cn as Xb,Hv as Yb,Ir as Zb,Gp as _b,zp as $b,_r as ac,Yp as bc,Gc as cc,Qp as dc,Xp as ec,zc as fc,Jc as gc,ct as hc,eg as ic,Vc as jc,Yc as kc,ng as lc,Er as mc,tg as nc,at as oc,nu as pc,rg as qc,sg as rc};

package/dist/{connect-NL5EVPMX.js → connect-SS7I4OQB.js}

@@ -1 +1 @@
-import{$ as b,_ as a,aa as c}from"./chunk-PR4HGVXE.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};
+import{$ as b,_ as a,aa as c}from"./chunk-FN2XOWUK.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/core.js

@@ -1 +1 @@
-import{$b as O,Ab as D,Bb as E,Cb as F,D as m,Db as G,E as n,Eb as H,F as o,G as p,Sb as I,Tb as J,Ub as K,Vb as L,Zb as M,_b as N,a,ac as P,b,ba as q,bb as A,bc as Q,c,ca as r,cc as R,dc as S,ec as T,fa as s,fc as U,ga as t,gc as V,ha as u,hc as W,ia as v,ic as X,ja as w,jc as Y,ka as x,kc as Z,la as y,lc as _,ma as z,mc as $,nc as aa,oc as ba,pc as ca,qc as da,rc as ea,yb as B,zb as C}from"./chunk-PR4HGVXE.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import{h as d,n as e,o as f,p as g,q as h,r as i,s as j,t as k,u as l}from"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{A as AuthMissingError,d as BASE_AUTH_FIELDS,ba as CORSAIR_INTERNAL,G as CloudApiError,B as CorsairKekMissingError,C as DB_METHOD_RISK,P as MS_GRAPH_API_BASE,z as ManagementApiError,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,u as activeMode,W as asRecord,y as assertModeAllows,x as assertReadonlyAllowed,F as callPluginDb,T as collectPluginWebhookMatchers,H as corsairCloud,n as createAccountKeyManager,ca as createCorsair,m as createIntegrationKeyManager,E as decodeDbArgs,aa as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,D as encodeDbArgs,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,K as exchangeCodeForTokens,Z as extractMicrosoftGraphValidationToken,$ as firstString,M as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,U as getHeader,L as getOAuthAccessToken,O as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,N as introspectPluginForDocs,_ as isMicrosoftGraphValidationHandshake,w as isReadonlyScopeActive,I as logEvent,J as logEventFromContext,R as matchWebhookPlugin,S as matchWebhookPluginAndTenant,Q as msGraphSubscribe,l as reEncryptConfig,X as readBodyRecord,Y as readQueryParam,q as resolveConnectLink,v as runReadonly,t as runWithMode,da as shouldStartTunnel,ea as superviseTunnel,V as toExternalId};
+import{$b as O,Ab as D,Bb as E,Cb as F,D as m,Db as G,E as n,Eb as H,F as o,G as p,Sb as I,Tb as J,Ub as K,Vb as L,Zb as M,_b as N,a,ac as P,b,ba as q,bb as A,bc as Q,c,ca as r,cc as R,dc as S,ec as T,fa as s,fc as U,ga as t,gc as V,ha as u,hc as W,ia as v,ic as X,ja as w,jc as Y,ka as x,kc as Z,la as y,lc as _,ma as z,mc as $,nc as aa,oc as ba,pc as ca,qc as da,rc as ea,yb as B,zb as C}from"./chunk-FN2XOWUK.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import{h as d,n as e,o as f,p as g,q as h,r as i,s as j,t as k,u as l}from"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{A as AuthMissingError,d as BASE_AUTH_FIELDS,ba as CORSAIR_INTERNAL,G as CloudApiError,B as CorsairKekMissingError,C as DB_METHOD_RISK,P as MS_GRAPH_API_BASE,z as ManagementApiError,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,u as activeMode,W as asRecord,y as assertModeAllows,x as assertReadonlyAllowed,F as callPluginDb,T as collectPluginWebhookMatchers,H as corsairCloud,n as createAccountKeyManager,ca as createCorsair,m as createIntegrationKeyManager,E as decodeDbArgs,aa as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,D as encodeDbArgs,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,K as exchangeCodeForTokens,Z as extractMicrosoftGraphValidationToken,$ as firstString,M as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,U as getHeader,L as getOAuthAccessToken,O as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,N as introspectPluginForDocs,_ as isMicrosoftGraphValidationHandshake,w as isReadonlyScopeActive,I as logEvent,J as logEventFromContext,R as matchWebhookPlugin,S as matchWebhookPluginAndTenant,Q as msGraphSubscribe,l as reEncryptConfig,X as readBodyRecord,Y as readQueryParam,q as resolveConnectLink,v as runReadonly,t as runWithMode,da as shouldStartTunnel,ea as superviseTunnel,V as toExternalId};