corsair 0.1.155 → 0.1.157

package/dist/chunk-INOGY5FC.js

@@ -0,0 +1,68 @@
+import{a as Ee,b as Lr,c as Nr}from"./chunk-6IURNA4L.js";import{a as $i,b as Wi,c as ji,d as $n}from"./chunk-XCTHEKDP.js";import{A as dn,B as Fr,C as es,a as Zi,b as Me,c as Gi,d as R,e as Y,f as Ji,g as ie,h as G,i as M,j as zi,k as ht,l as Vi,m as bt,n as be,o as ke,p as se,r as kt,s as qe,t as we,u as Wn,v as Yi,w as wt,x as Qi,y as jn,z as Xi}from"./chunk-WUEWJTDA.js";import{b as qi,c as Ki}from"./chunk-XPXWKPFZ.js";import{ZodBoolean as fg,ZodDate as yg,ZodEnum as mg,ZodNullable as hg,ZodNumber as bg,ZodObject as kg,ZodOptional as wg,ZodRecord as Cg,ZodString as Pg,ZodType as Tg}from"zod";var Ct=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","akta","alchemy","algolia","alibaba","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","anyapi","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","apollo","appointo","aryn","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beamer","beeminder","benchmarkemail","benzinga","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bigpictureio","bitbucket","bitwarden","blackbaud","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","booqable","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","builtwith","browserless","browsertool","bubble","bugsnag","buildkite","bunnycdn","bytedance","byteforms","cal","callpage","calendly","callingly","campaigncleaner","campayn","canny","canva","canvas","capsulecrm","carbone","castingwords","cdrplatform","celigo","certifier","chaser","chatbotkit","chatfai","chatwork","chmeetings","cincopa","circleci","claidai","classmarker","clay","clickhouse","clickmeeting","clickup","clicksend","clientary","clockify","close","cloro","cloudcart","cloudflare","cloudflareapikey","cloudinary","coassemble","codeinterpreter","coda","cody","coinbase","coinmarketcal","collegefootballdata","composio","confluence","connecteam","contactout","contentfulgraphql","contextdev","contextsevenmcp","convex","convoloai","cosmic","countdownapi","crowterminal","currentsapi","cursor","customerio","customgpt","cuttly","dadataru","daffy","databricks","datadog","dataforseo","datarobot","deepseek","devinmcp","diffbot","digitalocean","discord","dockerhub","docmosis","docupost","docsumo","docusign","dodopayments","doppler","dovetail","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","emelia","epicgames","everhour","exa","excel","exist","extractaai","facebook","faraday","figma","filevine","filloutforms","firecrawl","fireflies","fixer","flexisign","flutterwave","formbricks","fundable","gemini","giphy","github","gitlab","gladia","gmail","gmicloud","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","habitica","hackernews","harvest","hashnode","here","heygen","hookdeck","htmltoimage","hubspot","huggingface","humanitix","hunterio","imagior","imejisio","imgbb","insightoai","instagram","instantly","intercom","jigsawstack","jira","kaggle","keenable","kibana","kling","leexi","linear","linkedin","litescrape","loyverse","magichour","mailboxlayer","mailcheck","mailchimp","mailtrap","marketstack","merriamwebsterdict","minimax","monday","mrscraper","neon","nextdns","northflank","notion","ocrspace","ocrwebservice","octen","ollama","onedrive","onepassword","openai","openrouter","openweathermap","orbit","oura","outlook","pagerduty","parseur","pdfco","pdfmonkey","pdl","perplexityai","phantombuster","pinecone","plain","ploid","posthog","postman","prisma","pushbullet","razorpay","reddit","reducto","remoet","replicate","removebg","replicate","replyio","resend","retailed","revai","rootly","runpod","salesforce","saperly","sapsuccessfactors","scaleai","scrapegraphai","search1api","securitytrails","semanticscholar","sendgrid","sentry","serpapi","sharepoint","slack","slackbot","snapchat","sourcegraph","spoki","spotify","starton","strava","streamtime","stripe","studiobyai21labs","supabase","supadata","suzanne","surf","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticktick","tikhub","timecamp","timelink","tinypng","tinyfish","tinyurl","tisane","todoist","toggl","tokenmetrics","tpscheck","trello","tripadvisor","turso","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","typesafe","unione","unipile","uniswapapi","updownio","uploadcare","vapi","vaquill","vercel","veriphone","vestaboard","waboxapp","wakatime","webflow","webscrapingai","webvizio","whatsapp","whautomate","whoisfreaks","winstonai","witai","wix","wiza","workday","workiom","worldnewsapi","writer","xero","xquik","youcom","youtube","zendesk","zenserp","zohobigin","zohoinventory","zohomail","zoom","zoominfo"],ns={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",akta:"Akta",alchemy:"Alchemy",algolia:"Algolia",alibaba:"Alibaba Cloud Model Studio",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",anyapi:"AnyAPI",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",apollo:"Apollo",appointo:"Appointo",aryn:"Aryn",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beamer:"Beamer",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",benzinga:"Benzinga",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bigpictureio:"BigPicture.io",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blackbaud:"Blackbaud",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",booqable:"Booqable",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",builtwith:"BuiltWith",browserless:"Browserless",browsertool:"Browser Tool",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",bunnycdn:"Bunnycdn",bytedance:"ByteDance",byteforms:"ByteForms",cal:"Cal",callpage:"CallPage",calendly:"Calendly",callingly:"Callingly",campaigncleaner:"Campaign Cleaner",campayn:"Campayn",canny:"Canny",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",carbone:"Carbone",castingwords:"CastingWords",cdrplatform:"CDR Platform",celigo:"Celigo",certifier:"Certifier",chaser:"Chaser",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chatwork:"Chatwork",chmeetings:"ChMeetings",cincopa:"Cincopa",circleci:"CircleCI",claidai:"Claid.ai",classmarker:"ClassMarker",clay:"Clay",clickhouse:"Clickhouse",clickmeeting:"ClickMeeting",clickup:"ClickUp",clicksend:"ClickSend",clientary:"Clientary",clockify:"Clockify",close:"Close",cloro:"cloro",cloudcart:"CloudCart",cloudflare:"Cloudflare",cloudflareapikey:"Cloudflare API Key",cloudinary:"Cloudinary",coassemble:"Coassemble",codeinterpreter:"CodeInterpreter",coda:"Coda",cody:"Cody",coinbase:"Coinbase",coinmarketcal:"Coinmarketcal",collegefootballdata:"College Football Data",composio:"Composio",confluence:"Confluence",connecteam:"Connecteam",contactout:"ContactOut",contentfulgraphql:"Contentful GraphQL",contextdev:"Context.dev",contextsevenmcp:"Context7",convex:"Convex",convoloai:"ConvoloAi",cosmic:"Cosmic",countdownapi:"Countdown API",crowterminal:"CrowTerminal",currentsapi:"CurrentsApi",cursor:"Cursor",customerio:"Customer.io",customgpt:"CustomGPT",cuttly:"Cutt.ly",dadataru:"Dadataru",daffy:"Daffy",databricks:"Databricks",datadog:"Datadog",dataforseo:"DataForSEO",datarobot:"DataRobot",deepseek:"DeepSeek",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dockerhub:"Docker Hub",docmosis:"Docmosis",docupost:"Docupost",docsumo:"Docsumo",docusign:"DocuSign",dodopayments:"Dodo Payments",doppler:"Doppler",dovetail:"Dovetail",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",emelia:"Emelia",epicgames:"Epic Games",everhour:"Everhour",exa:"Exa",excel:"Excel",exist:"Exist",extractaai:"Extracta.ai",facebook:"Facebook",faraday:"Faraday",figma:"Figma",filevine:"Filevine",filloutforms:"FilloutForms",firecrawl:"Firecrawl",fireflies:"Fireflies",fixer:"Fixer",flexisign:"Flexisign",flutterwave:"Flutterwave",formbricks:"Formbricks",fundable:"Fundable",gemini:"Gemini",giphy:"Giphy",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",gmicloud:"GMI Cloud",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",hookdeck:"Hookdeck",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",humanitix:"Humanitix",hunterio:"Hunter.io",imagior:"Imagior",imejisio:"Imejis.io",imgbb:"ImgBB",insightoai:"Insighto.ai",instagram:"Instagram",instantly:"Instantly",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",keenable:"Keenable",kibana:"Kibana",kling:"Kling",leexi:"Leexi",linear:"Linear",linkedin:"LinkedIn",litescrape:"LiteScrape",loyverse:"Loyverse",magichour:"Magic Hour",mailboxlayer:"MailboxLayer",mailcheck:"Mailcheck",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",merriamwebsterdict:"Merriam-Webster Dictionary",minimax:"MiniMax",monday:"Monday",mrscraper:"MrScraper",neon:"Neon",nextdns:"NextDNS",northflank:"Northflank",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",octen:"Octen",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",openweathermap:"OpenWeatherMap",orbit:"Orbit",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfco:"PDF.co",pdfmonkey:"PDFMonkey",pdl:"People Data Labs",perplexityai:"Perplexity AI",phantombuster:"PhantomBuster",pinecone:"Pinecone",plain:"Plain",ploid:"Ploid",posthog:"PostHog",postman:"Postman",prisma:"Prisma",pushbullet:"Pushbullet",razorpay:"Razorpay",reddit:"Reddit",reducto:"Reducto",remoet:"Remoet",removebg:"remove.bg",replicate:"Replicate",replyio:"Reply.io",resend:"Resend",retailed:"Retailed",revai:"RevAI",rootly:"Rootly",runpod:"RunPod",salesforce:"Salesforce",saperly:"Saperly",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",search1api:"Search1API",securitytrails:"SecurityTrails",semanticscholar:"Semantic Scholar",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",sharepoint:"SharePoint",slack:"Slack",slackbot:"Slackbot",snapchat:"Snapchat",sourcegraph:"Sourcegraph",spoki:"Spoki",spotify:"Spotify",starton:"Starton",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",supadata:"Supadata",suzanne:"Suzanne",surf:"Surf",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticktick:"TickTick",tikhub:"TikHub",timecamp:"TimeCamp",timelink:"Timelink",tinypng:"TinyPNG",tinyfish:"TinyFish",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",tokenmetrics:"Token Metrics",tpscheck:"TPSCheck",trello:"Trello",tripadvisor:"Tripadvisor",turso:"Turso",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",typesafe:"TypeSafe",unione:"Unione",unipile:"Unipile",uniswapapi:"Uniswap",updownio:"Updown.io",uploadcare:"Uploadcare",vapi:"Vapi",vaquill:"Vaquill",vercel:"Vercel",veriphone:"Veriphone",vestaboard:"Vestaboard",waboxapp:"Waboxapp",wakatime:"WakaTime",webflow:"Webflow",webscrapingai:"WebScraping.AI",webvizio:"Webvizio",whatsapp:"WhatsApp",whautomate:"Whautomate",whoisfreaks:"Whoisfreaks",winstonai:"Winston AI",witai:"WitAi",wix:"Wix",wiza:"Wiza",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",writer:"Writer",xero:"Xero",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zenserp:"Zenserp",zohobigin:"Zoho Bigin",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Oe(e){let n=ns[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var Ce=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function U(e){return typeof e=="string"&&e.length>0}function fu(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function yu(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"||e==="managed_pricing"}function Pt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!U(n.connectUrl)||!U(n.token)||!U(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:U(n.environmentId)?n.environmentId:n.projectId};return U(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function Tt(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!U(r.tenantId)||!U(r.plugin)||!fu(r.status)||!yu(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:U(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function vt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!U(n.approvalUrl)||!U(n.token)||!U(n.projectId)||!U(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function pn(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(U(n.access_token))return{access_token:n.access_token,refresh_token:U(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:U(n.scope)?n.scope:void 0};throw new Error(U(n.error)?U(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function mu(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function hu(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;U(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function bu(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function ts(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!U(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!U(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",a=hu(o.fields),s=mu(o.missingRequiredFields),c=bu(o.status,o.connected,a,s);t.push({plugin:o.plugin,providerName:U(o.providerName)?o.providerName:o.plugin,authKind:i,status:c,connected:o.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function $r(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function rs(e,n,t){if(n===404&&t)return t;let r=$r(e);if(!r)return`Hub API returned HTTP ${n}`;if(!e||typeof e!="object")return r;let o=e,i=[r];if(typeof o.code=="string"&&o.code.length>0&&i.push(`Hub error code: ${o.code}`),typeof o.hint=="string"&&o.hint.length>0&&i.push("",o.hint),Array.isArray(o.fix)){let a=o.fix.filter(s=>typeof s=="string"&&s.trim().length>0);if(a.length>0){i.push("","What to do:");for(let s of a)i.push(`- ${s}`)}}if(o.received!==void 0)try{i.push("",`Hub received: ${JSON.stringify(o.received)}`)}catch{}if(o.details!==void 0)try{i.push("",`Details: ${JSON.stringify(o.details)}`)}catch{}return typeof o.creditsRequired=="number"&&i.push("",`Credits required for this call: ${o.creditsRequired}`),i.join(`
+`)}function os(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}var is="0.1.157";function ku(){return{"x-corsair-sdk-version":is}}function Rt(e){return e.replace(/\/$/,"")}function Wr(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return Ee()}catch{return null}}function ss(e){let n=Wr(e);return n?{"x-corsair-delivery-url":n}:{}}function as(e){let n=e.instanceKey?.trim();return n?{"x-corsair-instance-key":n}:{}}async function cs(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function wu(e,n,t){return rs(e,n,t)}function us(e,n,t){let r=os(e);throw r?new Ce({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):Object.assign(new Error(wu(e,n,t)),{status:n})}function ls(e){return typeof e=="object"&&e!==null&&"status"in e&&typeof e.status=="number"?e.status:void 0}async function S(e){let n=Rt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",signal:e.signal,headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...ss(e.hub),...as(e.hub),...ku(),...e.extraHeaders},body:JSON.stringify(e.body)}),r=await cs(t);return t.ok||us(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function K(e){let n=Rt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",...e.signal?{signal:e.signal}:{},headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...ss(e.hub),...as(e.hub)}}),r=await cs(t);return t.ok||us(r,t.status,e.notFoundMessage),e.parseResponse(r)}function At(e){return e&&typeof e=="object"?e:{}}function ds(e){let n=At(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function jr(e,n){return S({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=At(t);return{chat:r.thread,reply:ds(r.reply)}}})}async function qr(e,n){return S({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:ds})}async function Kr(e,n){return K({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=At(t).threads;return Array.isArray(r)?r:[]}})}async function Zr(e,n){return K({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=At(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as xu}from"crypto";var Cu="corsair:client-bridge";function Gr(e){return new URL(e).origin}function gn(e){let n=JSON.stringify({type:Cu,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Gr(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var Pu=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Jr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Pu.has(n)}catch{return!1}}function qn(e){return e==="development"?"browser":"server"}function ps(e){return qn(e)==="browser"}function gs(e){return Jr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Au}from"crypto";var De=60*1e3,Ke=300*1e3;import{createHmac as Tu,randomBytes as vu,timingSafeEqual as Ru}from"crypto";function Pe(){return vu(16).toString("base64url")}function Kn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Tu("sha256",t).update(e).digest("base64url")}function de(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let a=Kn(o,t);try{if(!Ru(Buffer.from(i,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function xt(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),a=Kn(i,n);return`${i}.${a}`}function Zn(e,n,t){let r=Math.floor(Date.now()/1e3);return xt(e,n,r+Math.floor(t/1e3))}function Ze(e){return decodeURIComponent(e)}function zr(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function fs(e){let n=e.trim();return n.length>0?n:null}function fn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function yn(e,n){if(!fs(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Au(16).toString("base64url"),iat:t,exp:t+Math.floor(De/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=Kn(o,n);return`${o}.${i}`}function He(e,n){return fs(n)?de(e,n):null}function Iu(e){let n=Gr(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function Vr(e){let n=yn(Iu(e),e.signingSecret);return fn(e.deliveryUrl,n)}function ys(e){if(qn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=xu(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:Vr(r)}}var Gn="https://auth.corsair.dev";var Te=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},Jn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function Yr(e){let n=(e.apiUrl?.trim()||Gn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"",o=t.startsWith("ck_cloud_");if(!t||!r&&!o)throw new Jn;return{apiUrl:n,projectApiKey:t,signingSecret:r,instanceKey:e.instanceKey?.trim()||void 0,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel,runtimeProofKey:e.runtimeProofKey?.trim()||void 0}}function It(e){return Yr(e)}function Su(e){let n=e.projectApiKey.startsWith("ck_cloud_");return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&(n||e.signingSecret.trim().length>0)}function j(e){let n=R(e).hub;if(!n||!Su(n))throw new Te;return n}function ms(e){return e.replace(/\/$/,"")}function St(e){return e.oauthCallbackUrl?ms(e.oauthCallbackUrl.trim()):`${ms(e.apiUrl)}/oauth/callback`}function mn(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";if(e.startsWith("ck_cloud_"))return"cloud";throw new Error("Hub API key must start with ck_dev_ (development), ck_prod_ (production), or ck_cloud_ (cloud)")}function hs(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let a=[null,void 0,""].includes(i)?null:i;await n({[o]:a})};return r}var Qr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function q(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,a=[...G[n].integration,...i],s=null,c={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:b.id,config:Qr(b.config),dek:b.dek??null},s},updateIntegration:async b=>{let k=await c.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),s=null}},l=null,u=async()=>{if(l)return l;let b=await c.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await se(b.dek,r),l},d=async()=>{let b=await c.getIntegration(),k=await u(),T=b.config;return!T||Object.keys(T).length===0?{}:we(T,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await u(),T;try{T=await d()}catch(O){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,O),T={}}let A={...T};for(let[O,te]of Object.entries(b))te===null?delete A[O]:A[O]=te;let F=qe(A,k);await c.updateIntegration({config:F})};return{get_dek:u,issue_new_dek:async()=>{let b=await c.getIntegration(),k=be(),T={};if(b.dek){let F=await se(b.dek,r),O=b.config;O&&Object.keys(O).length>0&&(T=Wn(O,F,k))}let A=await ke(k,r);return await c.updateIntegration({config:T,dek:A}),l=k,k},...hs(d,g,a)}}function N(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:a=[],ensureProvisioned:s}=e,c=[...G[n].account,...a],l=null,u=async()=>{if(l)return l;let P=!1;for(;;){let C=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!C){if(!P&&s){P=!0,await s();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return l={id:C.id,config:Qr(C.config),dek:C.dek??null},l}},d={kek:o,integrationName:t,tenantId:r,getIntegration:u,getAccount:async()=>{let P=!1;for(;;){let C=await u(),D=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",C.id).executeTakeFirst();if(!D){if(!P&&s){P=!0,await s();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return{id:D.id,config:Qr(D.config),dek:D.dek??null}}},updateAccount:async P=>{let C=await d.getAccount();await i.db.updateTable("corsair_accounts").set({...P.config!==void 0?{config:P.config}:{},...P.dek!==void 0?{dek:P.dek}:{},updated_at:new Date}).where("id","=",C.id).execute()}},p=null,g=null,f=null,h=async()=>{let P=await d.getAccount();if(!P.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p&&g===P.dek||(p=await se(P.dek,o),g=P.dek),p},b=async()=>{if(f)return f;let P=await d.getIntegration();if(!P.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await se(P.dek,o),f},k=async()=>{let P=await d.getAccount(),C=await h(),D=P.config;return!D||Object.keys(D).length===0?{}:we(D,C)},T=async()=>{let P=await d.getIntegration(),C=await b(),D=P.config;return!D||Object.keys(D).length===0?{}:we(D,C)},A=Promise.resolve(),F=P=>{let C=A.then(()=>O(P));return A=C.catch(()=>{}),C},O=async P=>{let C=await d.getAccount();if(!C.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);let D=await se(C.dek,o),L;try{let H=C.config;L=!H||Object.keys(H).length===0?{}:we(H,D)}catch(H){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,H),L={}}let re={...L};for(let[H,_e]of Object.entries(P))_e===null?delete re[H]:re[H]=_e;let B=qe(re,D);await d.updateAccount({config:B})},te={get_dek:h,issue_new_dek:async()=>{let P=await d.getAccount(),C=be(),D={},L=null;if(P.dek){L=await se(P.dek,o);let B=P.config;B&&Object.keys(B).length>0&&(D=Wn(B,L,C))}let re=await ke(C,o);if(L){let B=L;await i.db.transaction().execute(async H=>{await Xi(H,P.id,B,C),await H.updateTable("corsair_accounts").set({config:D,dek:re,updated_at:new Date}).where("id","=",P.id).execute()})}else await d.updateAccount({config:D,dek:re});return p=C,g=re,C},...hs(k,F,c)};return n==="oauth_2"&&(te.get_integration_credentials=async()=>{let P=await T();return{...P,client_id:P.client_id||null,client_secret:P.client_secret||null,redirect_url:P.redirect_url??null}}),te}async function bs(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=be(),i=await ke(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function ks(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=be(),s=await ke(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",i.id).execute(),a}var _u=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function Ue(e){return _u.has(e)}function Eu(e,n){return Ue(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function Mu(e){return!Ue(e)}function Ou(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"];case"managed_pricing":return[]}}function Du(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function Hu(e,n){let t=i=>n.find(a=>a.level==="account"&&a.name===i);if(!Ou(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function ws(e,n){if(!e)return!1;let t=ie(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function Uu(e,n){let r=e.authConfig?.[n]?.integration??[];return[...G[n].integration,...r]}function Bu(e,n){let r=e.authConfig?.[n]?.account??[];return[...G[n].account,...r]}function Fu(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return o.length>0?a="missing_integration":r.length===0?a="ready":i.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:Hu(n,t),fields:t,missingRequiredFields:r}}async function Ge(e,n,t){let r=M(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,a=i?.[r]?.integration??[],s=i?.[r]?.account??[],c=q({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),l=N({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:s}),u=Uu(n,r),d=Bu(n,r),p=[];for(let g of u)p.push({name:g,level:"integration",required:Eu(r,g),configured:await ws(c,g)});for(let g of d)p.push({name:g,level:"account",required:Mu(g),configured:await ws(l,g)});if(Du(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return Fu(n.id,r,p)}async function zn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let a of e.plugins){if(o&&!o.has(a.id))continue;let s=await Ge(e,a,r);s&&i.push(s)}return i}function _t(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var Cs=Symbol.for("corsair:internal"),Ps=new WeakMap,Ts=new WeakMap;function Lu(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function Nu(e){if(e.database){let t=Ps.get(e.database);return t||(t=new Map,Ps.set(e.database,t)),t}let n=Ts.get(e);return n||(n=new Map,Ts.set(e,n)),n}function $u(e){return e.multiTenancy?{withTenant:()=>({}),[Cs]:e}:{[Cs]:e}}async function hn(e,n){if(!e.database)return;let t=n.trim()||"default",r=Nu(e),o=Lu(t,e.plugins),i=r.get(o);if(i){await i;return}let a=(async()=>{let{setupCorsair:s}=await import("./setup-IEMDCUTH.js");await s($u(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,a),await a}import*as Vn from"crypto";function Be(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function Xr(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function bn(e,n){if(!n)throw new Error("OAuth state signing requires a configured kek. Pass kek to createCorsair().");let t=Vn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var eo=600*1e3;function Et(e,n){if(!n)return null;let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Vn.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(o,"base64url"),s=Buffer.from(i,"base64url");return a.length!==s.length||!Vn.timingSafeEqual(a,s)?null:Xr(r,{maxAgeMs:eo})}function vs(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function Rs(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function kn(e,n){await S({hub:e,path:"/connections/report",body:vs(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function Wu(e,n){try{let t=j(e);S({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof Te)return}}async function ju(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!M(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await Ge(n,e.plugin,r);o&&xs(e.hub,Rs({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function As(e,n){Wu(e,n)}function xs(e,n){S({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function wn(e){ju(e).catch(()=>{})}async function ve(e,n){let t=R(e);if(!M(n.plugin))return;let o=await Ge(t,n.plugin,n.tenantId);o&&As(e,Rs({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function Mt(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var Is=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function qu(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function Ku(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await se(n.dek,e.kek),r=Is(n.config),o={};Object.keys(r).length>0&&(o=we(r,t)),o[e.link.linkType]=e.link.externalId;let i=qe(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function Cn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:a,extraAccountFields:s=[]}=e,{accountId:c}=await qu({database:n,pluginId:r,tenantId:o}),l=!1;if(a){let u=N({authType:a,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:s}),d=`set_${i.linkType}`,p=u[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await Ku({database:n,kek:t,accountId:c,link:i})}async function no(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let c=await se(s.dek,t),u=Is(s.config)[o];if(!u)continue;if(kt(u,c)===i)return s}catch{continue}return null}async function Ot(e){return(await no(e))?.tenant_id??null}async function Ss(e){return Ot({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as _s from"querystring";function Je(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${_s.stringify(i)}`}async function Es(e,n){try{return await K({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function Pn(e,n,t,r){if(!n.subscribe)return;let o=j(e),i=await Es(o,n.id);if(!i)return;let a=await n.subscribe({keys:r},{webhookUrl:i});a&&await ve(e,{plugin:n,tenantId:t,verified:!0,webhookLink:a.webhookLink,webhookSecret:a.webhookSecret})}var Q=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function Ms(e){let n=e.oauthConfig;if(!n)throw new Q("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Zu(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let a=await i.executeTakeFirst();if(!a)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",a.id).executeTakeFirst())return;let c=be(),l=await ke(c,r),u=new Date;await o.insertInto("corsair_accounts").values({id:dn(),created_at:u,updated_at:u,tenant_id:t,integration_id:a.id,config:{},dek:l}).execute()})}async function to(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,a=R(e,()=>new Q("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=Y(a,n,p=>new Q("plugin_not_found",p)),c=Ms(s),u=await q({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!u)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Je({oauthConfig:c,clientId:u,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=bn(Be(n,r),a.kek);return{url:Je({oauthConfig:c,clientId:u,redirectUri:o,state:d}),state:d}}function Gu(e,n){return{...n??{},...e}}async function Yn(e,n){let{code:t,state:r,redirectUri:o}=n,i=R(e,()=>new Q("invalid_corsair_instance","Invalid corsair instance")),a,s;if(n.trusted){if(!n.plugin||!n.tenantId)throw new Q("invalid_state","trusted callback requires plugin and tenantId");a=n.plugin,s=n.tenantId}else{let h=Et(r,i.kek);if(!h)throw new Q("invalid_state","Invalid or tampered state parameter");a=h.plugin,s=h.tenantId}if(!i.database)throw new Q("no_database","No database configured on corsair instance");let c=Y(i,a,h=>new Q("plugin_not_found",h)),l=Ms(c),u=q({authType:"oauth_2",integrationName:a,kek:i.kek,database:i.database}),d=await u.get_client_id(),p=await u.get_client_secret();if(!d||!p)throw new Q("credentials_not_configured",`Credentials not configured for '${a}'`);await Zu(i.database,a,s,i.kek);let g=await Dt(t,d,p,l,o);if(!g.access_token)throw new Q("no_access_token",`No access_token returned from ${l.providerName}`);let f=N({authType:"oauth_2",integrationName:a,tenantId:s,kek:i.kek,database:i.database,extraAccountFields:[...c.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await ve(e,{plugin:c,tenantId:s}).catch(()=>{});try{let h=Gu(g,n.callbackParams),b=await Mt(i.plugins,a,h);if(b){try{let k=c.authConfig?.oauth_2?.account??[];await Cn({database:i.database,kek:i.kek,pluginId:a,tenantId:s,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${a}' tenant '${s}':`,k)}i.hub&&kn(i.hub,{plugin:a,tenantId:s,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${a}' tenant '${s}':`,h)}if(c.subscribe)try{await Pn(e,c,s,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${a}' tenant '${s}':`,h)}return{plugin:a,tenantId:s}}async function Ju(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??Pn,i=[],a=[];if(!t.database)return{renewed:i,failed:a};for(let s of r){let c=t.plugins.find(u=>u.id===s.integrationName);if(!c?.subscribe)continue;let l=`${c.id}/${s.tenantId}`;try{let u=M(c)??"oauth_2",d=N({authType:u,integrationName:c.id,tenantId:s.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...c.authConfig?.[u]?.account??[]]}),p=c.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:u,keys:g,hub:t.hub},"endpoint")}await o(n,c,s.tenantId,d),i.push(l)}catch(u){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,u),a.push(l)}}return{renewed:i,failed:a}}async function Os(e){let n=R(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return Ju({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function zu(e,n={}){let t=!1,r=()=>{t||(t=!0,Os(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function Ds(e){if(!R(e).database)throw new Error("A database must be configured to provision Corsair integrations");await Ht(e,{silent:!0})}async function Tn(e,n){let t=R(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await hn(t,n)}var Vu=Symbol.for("corsair:internal"),Yu=new Set(["access_token","refresh_token","expires_at","scope"]);function Qu(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Xu(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!Ue(t)&&!Yu.has(t)):n.filter(t=>!Ue(t))}function Hs(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function el(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function nl(e){return{[Vu]:Hs(e)}}async function Ut(e,n,t={}){let r=St(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,a=Hs(e),s=nl(e);for(let c of e.plugins){if(i&&!i.has(c.id))continue;let l=M(c);if(!l)continue;let u=Qu(l),d=t.providerNameOverrides?.[c.id]??Oe(c.id),p=await Ge(a,c,n),g=ht(c,l),f=Xu(l,g),h={plugin:c.id,providerName:d,authKind:u,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),u==="oauth"){let k=t.oauthModeOverrides?.[c.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let T=await to(s,c.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=T.url}catch(T){T instanceof Error&&/client_id not configured/i.test(T.message)||(h.setupError=T instanceof Error?T.message:`Could not prepare OAuth for ${c.id}`)}}o.push(h)}return o}async function Vy(e,n,t={}){let r=R(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return Ut({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function Us(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await hn(e.internalConfig??el(e),n)}async function Bs(e,n){await Tn(e,n)}async function Fs(e,n){let t=mn(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Ee({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Pt})}async function Ls(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await Us(t,n.tenantId);let r=await Ut(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return Fs(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function Bt(e,n){let t=R(e),r=j(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Bs(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,a=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,s=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,c=await Ut(o,n.tenantId,{pluginIds:i,oauthModeOverrides:a,providerNameOverrides:s});if(c.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return Fs(r,{tenantId:n.tenantId,plugins:c,deliveryUrl:n.deliveryUrl})}async function Ft(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(a=>a.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=R(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await tl(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function tl(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-S3U4IJK2.js"),{postHubConnectSession:i}=await import("./connect-S4ZCYX2K.js"),a={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(a,t.tenantId);let s=await r(a,t.tenantId,{pluginIds:t.pluginIds});if(s.length===0)throw new Error("No connectable plugins found for this tenant");let c=s.find(l=>l.setupError);if(c)throw new Error(c.setupError??`Could not prepare connect link for ${c.plugin}`);return i(e,{tenantId:t.tenantId,plugins:s})}function vn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var ae=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function rl(e){let n=e.oauthConfig;if(!n)throw new ae("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function ro(e,n){let t=R(e,()=>new ae("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ae("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new ae("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=Et(n,t.kek);if(!o)throw new ae("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:a}=o,s=Y(t,i,p=>new ae("plugin_not_found",p)),c=rl(s),u=await q({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!u)throw new ae("client_id_not_configured",`client_id not configured for '${i}'`);let d=Je({oauthConfig:c,clientId:u,redirectUri:r,state:n});return{plugin:i,tenantId:a,providerName:c.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as il}from"async_hooks";import{randomBytes as sl}from"crypto";import{v4 as al}from"uuid";var pe=class extends Error{reason;constructor(n,t="pending"){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError",this.reason=t}};async function Lt(e,n){let t=mn(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Ee({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:vt})}function Nt(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var oo="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function so(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Ns(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function io(e){return Nt(e)}async function ao(e,n){if(so(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Ns(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Lt(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:ol(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch(r){return console.warn(`[corsair/${n.plugin}] could not create an approval link for '${n.endpoint}': ${r instanceof Error?r.message:String(r)}`),null}}function ol(e){try{return JSON.parse(e)}catch{return e}}async function $t(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await ao(e,n);return{...n,approvalUrl:r}}async function co(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:a,endpoint:s,args:c,tenantId:l,expiresAt:u,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:a,endpoint:s,args:c});let g=await ao({manual:t,hub:r},{id:o,token:i,plugin:a,endpoint:s,args:JSON.stringify(c),tenant_id:l,expires_at:u});return so(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):io(g):oo:r?g?io(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:oo}var Wt=new il,$s={open:0,cautious:1,strict:2,readonly:3},Rn=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function uo(e,n){return e===void 0?n:n===void 0||$s[e]>=$s[n]?e:n}function jt(e,n){return Wt.run(uo(Wt.getStore(),e)??e,n)}function An(){return Wt.getStore()}function lo(e){return jt("readonly",e)}function qs(){return Wt.getStore()==="readonly"}function qt(e,n){if(qs()&&n!=="read")throw new Rn(e,n)}function ze(e,n){qt(e,n);let t=An();if(!(t===void 0||Kt(n,t)==="allow"))throw new pe(`Action '${e}' is a '${n}' operation and permission mode '${t}' does not allow it. The entity store cannot wait for approval.`,"policy")}var cl={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}},Ws={allow:0,require_approval:1,deny:2};function Ks(e,n){return e===void 0?n:Ws[e]>=Ws[n]?e:n}function Kt(e,n,t){return t!==void 0?t:cl[n][e]}function po(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Zs(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function js(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Gs(e){let n=Kt(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, widen the permission mode in force for this call.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",a).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,h=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${s.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?js(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let c=al(),l=sl(32).toString("hex"),u=e.timeoutMs??600*1e3,d=new Date(Date.now()+u).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:c,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:a,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${c}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?js(e.db,c,u):{result:"blocked",reason:"pending",id:c,token:l,expiresAt:d}}var w=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function _(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function ge(e){let n={error:e.code,message:e.message,...e.extra};return _(e.status,n)}function Fe(e){return new w(404,"not_found",e)}function $(e,n={}){return new w(400,"bad_request",e,n)}function go(e,n){return Y(e,n,t=>Fe(t))}async function Js(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=q({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=G[t].integration,i=r,a;try{a=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{a=o.map(()=>null)}let s=o.filter((l,u)=>a[u]==null),c;return t==="oauth_2"?c=!s.includes("client_id")&&!s.includes("client_secret"):c=s.length===0,{configured:c,missingFields:s}}async function zs(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await Js(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Zt(){return{ok:!0}}async function xn(e){return Promise.all(e.plugins.map(n=>zs(n,e)))}async function Gt(e,n){let t=go(e,n);return zs(t,e)}async function ul(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function Vs(e,n){let t=await ul(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function In(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let a=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function Jt(e,n){if(!n)throw $("Tenant id must be a non-empty string");return Vs(e,n)}async function zt(e,n){let t=n?.id?.trim();if(!t)throw $("Tenant id is required",{missingFields:["id"]});return Vs(e,t)}async function Vt(e,n){let t=n?.trim()||"default",r={},o=await zn(e,t);for(let i of o)r[i.plugin]=_t(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function Yt(e,n){let t=n?.plugin;if(typeof t!="string"||!t.trim())throw $("plugin is required",{missingFields:["plugin"]});let r=t.trim();go(e,r);let o=n?.tenantId;if(o!=null&&typeof o!="string")throw $("tenantId must be a string");let i=o?.trim()||"default";if(!e.database)return{ok:!0,disconnected:!1};let a=e.database.db,s=await a.selectFrom("corsair_integrations").select(["id"]).where("name","=",r).executeTakeFirst();if(!s)return{ok:!0,disconnected:!1};let c=!1;return await a.transaction().execute(async l=>{e.database?.isPg===!0&&await l.selectFrom("corsair_integrations").select("id").where("name","=",r).forUpdate().execute();let u=l.selectFrom("corsair_accounts").select("id").where("tenant_id","=",i).where("integration_id","=",s.id);await l.deleteFrom("corsair_events").where("account_id","in",u).execute(),await l.deleteFrom("corsair_entities").where("account_id","in",u).execute(),c=((await l.deleteFrom("corsair_accounts").where("tenant_id","=",i).where("integration_id","=",s.id).executeTakeFirst()).numDeletedRows??0n)>0n}),{ok:!0,disconnected:c}}async function fo(e,n){if(!e.database)throw Fe(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw Fe(`Permission '${n}' not found`);return $t(e,t)}function ll(e){if(!e.oauthConfig)throw $(`Plugin '${e.id}' has no oauthConfig`)}function dl(e){if(!e.manual)throw new w(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function yo(e){let n=dl(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new w(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function pl(e){let n=!!e.hub,t=vn(e.manual);if(!n&&!t)throw new w(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function Ys(e){if(!e.database||!e.kek)throw new w(500,"database_not_configured","A database and kek are required to issue connect links.")}async function gl(e,n){let t=n?.plugin?.trim();if(!t)throw $("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=go(e,t);ll(o);let i=yo(e);Ys(e);let a=await Js(o,e);if(!a.configured)throw new w(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=bn(Be(t,r),e.kek),c;try{c=new URL(i.baseUrl)}catch{throw new w(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return c.searchParams.set("state",s),{connectUrl:c.toString(),expiresAt:new Date(Date.now()+eo).toISOString(),tenantId:r}}async function fl(e,n,t){Ys(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let a=t.providerName?.trim();a&&(o.providerName=a);let s=await Bt(e,o);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt,tenantId:r}}async function Qt(e,n,t){return pl(n),n.hub?fl(e,n,t):gl(n,t)}async function Xt(e,n,t){if(n.hub&&!vn(n.manual))throw new w(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw $("state is required",{missingFields:["state"]});yo(n);try{return await ro(e,r)}catch(o){if(o instanceof ae)switch(o.code){case"invalid_state":throw $("Invalid or expired state");case"client_id_not_configured":throw new w(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new w(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function er(e,n,t){if(n.hub&&!vn(n.manual))throw new w(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw $("Missing required fields",{missingFields:i});let a=yo(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:o,redirectUri:a.redirectUri,callbackParams:t.callbackParams})}catch(c){if(c instanceof Error&&c.name==="OAuthCallbackError")switch(c.code){case"invalid_state":throw $("Invalid or expired state");case"credentials_not_configured":throw new w(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new w(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function mo(e,n){if(!e.database)throw Fe("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw Fe("Permission not found");return $t(e,t)}async function Qs(e,n){return"id"in n?fo(e,n.id):mo(e,n.token)}import{createCipheriv as Pl,createDecipheriv as th,randomBytes as ta,scryptSync as Tl}from"crypto";import{createHmac as ho,randomUUID as yl,timingSafeEqual as ea}from"crypto";function bo(e){return e.run??null}function ko(e){return e.probe??null}function na(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function nr(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=ho("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":yl()}}}function wo(e){let n=e.signingSecret.trim();if(!n)return!1;let t=na(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>Ke)return!1;let i=ho("sha256",n).update(e.body).digest("hex");try{return ea(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function Sn(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=na(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>Ke)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=ho("sha256",n).update(e.body).digest("hex");try{if(!ea(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function _n(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function tr(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function rr(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function Qn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function Co(e){return Qn(_n(e))}async function Po(e){let n=await sr({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=_n(n.body),r=tr({httpOk:n.ok,status:n.status,body:t}),o=Qn(t);if(!r||!o)throw new Error(ir({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function or(e){return rr(_n(e))}function ml(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function Xs(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var hl="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",bl="Check the delivery URL configured for this environment.";function kl(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${hl}`}function wl(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${bl}`}function Xn(e,n){let t=ml(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function ir(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Xn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return kl(e);if(e.status===404)return wl(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${Xs(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${Xs(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}var Cl=15e3;async function sr(e){let{body:n,headers:t}=nr(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n,signal:AbortSignal.timeout(Cl)}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Xn(e.deliveryUrl,r)}}}var vl="aes-256-gcm",Rl=12,Al=16,xl=16,Il=32;function Sl(e,n){return Tl(e.trim(),n,Il)}function To(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=ta(xl),o=Sl(t,r),i=ta(Rl),a=Pl(vl,o,i,{authTagLength:Al}),s=JSON.stringify(e),c=Buffer.concat([a.update(s,"utf8"),a.final()]),l=a.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),c.toString("base64")].join(":")}var _l=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function vo(e){if(e instanceof Zi)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!_l.some(t=>n.includes(t))}function El(e){if(!e)return[];let n=M(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!Ue(r)):[]}async function et(e,n){let t=R(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await Ht(e,{silent:!0});let[r,o]=await Promise.all([In(t),xn(t)]),i={tenants:r.map(a=>({id:a.id})),plugins:o.map(a=>{let s=El(t.plugins.find(c=>c.id===a.id));return{id:a.id,authType:a.authType,configured:a.configured,missingFields:a.missingFields,...s.length>0?{integrationCredentialFields:s}:{}}}),syncedAt:new Date().toISOString()};return To(i,n)}var fe=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function ar(e,n){let t=R(e,()=>new fe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new fe("no_database","Database not configured");let r=Y(t,n.plugin,u=>new fe("plugin_not_found",u)),o=M(r);if(!o)throw new fe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new fe("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await Tn(e,n.tenantId);let i=new Set(ht(r,o)),s=r.authConfig?.[o]?.account??[],c=N({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new fe("invalid_credentials",`Unknown credential field '${u}' for plugin '${n.plugin}'`);let p=ie(c,`set_${u}`);if(!p)throw new fe("invalid_credentials",`Cannot set credential field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new fe("invalid_credentials","Provide at least one credential field to save");return await ve(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var ye=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function Ro(e,n){let t=R(e,()=>new ye("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ye("no_database","Database not configured");let r=Y(t,n.plugin,u=>new ye("plugin_not_found",u)),o=M(r);if(!o)throw new ye("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await Ds(e);let i=new Set(Vi(r,o)),s=r.authConfig?.[o]?.integration??[],c=q({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:s}),l=0;for(let[u,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(u))throw new ye("invalid_credentials",`Unknown integration credential field '${u}' for plugin '${n.plugin}'`);let p=ie(c,`set_${u}`);if(!p)throw new ye("invalid_credentials",`Cannot set integration field '${u}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ye("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var cr=new Map;function Ml(e){for(let[n,t]of cr)t<=e&&cr.delete(n)}function ur(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();Ml(r);let o=cr.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(cr.set(t,r+n),{ok:!0})}var Le=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function En(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:a,scope:s,authType:c="managed",providerData:l}=n;if(!o.trim())throw new Le("no_access_token","Managed OAuth delivery missing access_token");let u=R(e,()=>new Le("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new Le("no_database","No database configured on corsair instance");let d=Y(u,t,g=>new Le("plugin_not_found",g));await Tn(e,r);let p=N({authType:c,integrationName:t,tenantId:r,kek:u.kek,database:u.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),a&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await p.set_scope(s),await ve(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await Mt(u.plugins,t,{access_token:o,refresh_token:i,scope:s,...l});if(g){try{let f=d.authConfig?.[c]?.account??[];await Cn({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:g,authType:c,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}u.hub&&kn(u.hub,{plugin:t,tenantId:r,link:g,authType:c})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await Pn(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function Ol(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function ra(e,n,t=[]){for(let[r,o]of Object.entries(e))if(Ol(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=ra(o,n,[...t,r]);if(i)return i}return null}function Dl(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function Hl(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function oa(e,n,t,r,o){let i=Dl(n),a=typeof t=="string"?JSON.parse(t):t;(!a||typeof a=="object"&&Object.keys(a).length===0)&&i["x-goog-resource-uri"]&&(a=Hl(i)||a);let c={headers:i,body:a,...r?{query:r}:{}},l=r?.tenantId||"default",u=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:Ct;for(let g of p){let f=u[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(c))continue;let h=ra(f.webhooks,c);if(!h)continue;let b=h.path.join("."),k={payload:a,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let T=await h.webhook.handler(k),A=!!Object.keys(T.returnToSender||{})?.length;return{plugin:g,action:b,body:a,response:A?{...T?.returnToSender,success:!0}:{success:!0},...T.responseHeaders&&{responseHeaders:T.responseHeaders}}}catch(T){return console.error(`Error executing webhook handler for ${g}.${b}:`,T),{plugin:g,action:b,body:a,response:{success:!1,error:T instanceof Error?T.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as Ul}from"crypto";import*as Ve from"vm";var ia="__corsairFailedStep",Bl=3e4,Ao=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function sa(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function aa(e,n){return`st_${Ul("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function lr(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var ca=new Set(["constructor","prototype","__proto__"]);function Re(e,n){if(e===null)return null;let t=typeof e;return t==="function"?Ll(e,n):t==="object"?Fl(e):e}function Fl(e){return new Proxy(e,{get(n,t){if(!ca.has(t))return Re(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Ll(e,n){return new Proxy(e,{apply:(t,r,o)=>Nl(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!ca.has(r))return Re(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Nl(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>Re(n,void 0),n=>{throw Re(n,void 0)}):Re(e,void 0)}function $l(e){let n=Object.create(null),t=Ve.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Ve.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),a=Ve.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),c=Ve.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=Re(e.corsair,void 0),n.__payload=o,n.__step=a,n.__console=c;let l=Ve.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let u,d=new Promise((p,g)=>{u=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(u))}async function xo(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(a,s)=>{if(o)throw o;let c=r++,l=aa(a,c);if(Object.hasOwn(n,l))return Re(n[l].output,void 0);try{let u=await s();return t.push({stepId:l,name:a,seq:c,status:"completed",output:u}),u}catch(u){if(sa(u))throw u;let d=lr(u);t.push({stepId:l,name:a,seq:c,status:"failed",error:d});let p=new Error(d);throw p[ia]=a,p}});i.sleep=async(a,s)=>{if(o)throw o;let c=r++,l=aa(a,c);if(Object.hasOwn(n,l))return;t.push({stepId:l,name:a,seq:c,status:"completed",output:null});let u=Number.isFinite(s)?Math.max(0,s):0;throw o=new Ao(Date.now()+u,a),o};try{await $l({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??Bl});let a=o;return a?{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(a){if(sa(a))return{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()};let s=lr(a),c=a!==null&&typeof a=="object"?a[ia]:void 0;return{status:"failed",steps:t,error:{message:s,...c?{failedStep:c}:{}}}}}import*as dr from"vm";var ua=1e4;async function Io(e){let n=Object.create(null),t=dr.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=Re(e.corsair,void 0);let r=jl(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await lo(()=>{let a=dr.runInContext(o,t,{filename:"corsair:probe",timeout:r});a.catch(()=>{});let s,c=new Promise((l,u)=>{s=setTimeout(()=>u(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([a,c]).finally(()=>clearTimeout(s))});return{status:"ok",value:Wl(i)}}catch(i){return{status:"error",error:lr(i)}}}function Wl(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function jl(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?ua:Math.min(e,ua)}function Ye(e){return e.deliveryMode==="auth.credentials"}function nt(e){return e.deliveryMode==="connections.sync"}function pr(e){return e.deliveryMode==="connect.create_link"}function tt(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function rt(e){return e.deliveryMode==="oauth.tokens"}function gr(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!Ye(e)&&!nt(e)&&!pr(e)&&!tt(e)&&!rt(e)}function ql(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function Kl(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await et(e,n)}}}}}catch(t){return{status:"failed",retryable:vo(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function Zl(e,n){try{let t=await Ft(e,n);return ql(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function So(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function Gl(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await Ot({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function Jl(e,n,t,r){let o=await Gl(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},a=await oa(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!a.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(a.response&&a.response.success===!1)return{status:"failed",retryable:!1,error:typeof a.response.error=="string"?a.response.error:"Webhook handler failed"};let s=a.response?.returnToSender,c=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(a.response?.data??a.response);return{status:"ok",webhookResponse:{status:a.response?.statusCode??200,body:c,headers:a.responseHeaders}}}async function zl(e,n){return await Yn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function Vl(e,n){return await En(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function Eo(e,n,t){let r=await _o(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function _o(e,n,t){let r=R(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function Yl(e,n){try{return await ar(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function Ql(e,n){try{return await Ro(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function la(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function Xl(e,n){try{let t=la(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await xo({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function ed(e,n){try{let t=la(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await Io({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function ot(e,n,t={}){let r=R(e),o=So(n.headers,"x-corsair-signature"),i=So(n.headers,"x-corsair-timestamp"),a=So(n.headers,"x-corsair-nonce"),s=!1;if(t.signingSecret?.trim()){let l=Sn({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!l.ok)return{status:"failed",retryable:!1,error:l.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let u=ur(`nonce:${a.trim()}`,Ke);if(!u.ok)return{status:"failed",retryable:!1,error:u.error};s=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let c;try{c=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(c.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(c.type){case"webhook":return Jl(e,r,c.payload,s);case"oauth.callback":return zl(e,c.payload);case"oauth.tokens":return Vl(e,c.payload);case"permission.approve":return _o(e,c.payload,"approved");case"permission.deny":return _o(e,c.payload,"denied");case"auth.credentials":return Yl(e,c.payload);case"integration.credentials":return Ql(e,c.payload);case"connect.create_link":return Zl(e,c.payload);case"connections.sync":{let l=t.signingSecret?.trim();return l?Kl(e,l):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?Xl(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?ed(e,c.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(c.type)}`}}}function nd(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var Mo=3,td=250;function rd(e){return e?.name==="AbortError"}async function od(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function id(e,n,t,r,o){for(let i=1;i<=Mo;i++){try{let a=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(a.ok)return await od(a)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(a){if(rd(a))throw a}i<Mo&&await pa(td)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${Mo} attempts; the run may be retried`),!1}async function sd(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:a,body:s,headers:c}=await i.json(),l=await t.process(e,{headers:c,body:s},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:u,body:d}=nd(l);return await id(n,t,o,{deliveryId:a,status:u,body:d},r)?"handled":"error"}var da=1e3,ad=5e3,cd=3e4;function pa(e){return new Promise(n=>setTimeout(n,e))}var fr=globalThis.__corsairConnectLoops??=new Map;function ud(e,n={fetch,process:ot}){let t;try{t=j(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(fr.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");fr.set(r,o);let i=()=>{fr.get(r)===o&&fr.delete(r)},a=!1,s=null;return(async()=>{let l=da,u=!1,d=async p=>{u||(console.warn("[corsair] connect loop error; retrying",p),u=!0),a||await pa(l),l=Math.min(l*2,ad)};try{for(;!a;){s=new AbortController;let p=setTimeout(()=>s?.abort(),cd);try{await sd(e,t,n,s.signal)==="error"?await d("pull or ack failed"):(u=!1,l=da)}catch(g){if(a)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{a=!0,s?.abort(),i()}}}function ga(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function ld(e,n){return n&&!n.has(e.id)?!1:M(e)!==null}async function fa(e,n,t={}){let r=R(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,a=await zn(r,o,{pluginIds:t.pluginIds}),s=new Map(a.map(l=>[l.plugin,l])),c=r.plugins.filter(l=>ld(l,i)).map(l=>{let u=M(l),d=s.get(l.id);return d?{plugin:l.id,providerName:Oe(l.id),authKind:ga(u),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:Oe(l.id),authKind:ga(u),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:c}}async function ya(e,n){let t=j(e);return K({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:Tt})}var Oo=/^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;function dd(e){return typeof e=="string"&&e.length>0}function yr(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty managed pricing credentials payload");let n=e;if(!dd(n.api_key))throw new Error("Hub API returned incomplete managed pricing credentials (expected api_key)");let t={api_key:n.api_key};n.expires_in!==void 0&&typeof n.expires_in=="number"&&Number.isFinite(n.expires_in)&&n.expires_in>0&&(t.expires_in=n.expires_in),typeof n.usage_path=="string"&&Oo.test(n.usage_path)&&(t.usage_path=n.usage_path);let r=n.job;r?.role==="start"&&typeof r.id_path=="string"&&Oo.test(r.id_path)&&(t.job={role:"start",id_path:r.id_path,...typeof r.status_operation=="string"?{status_operation:r.status_operation}:{}});let o=n.failed_when;return o&&typeof o.path=="string"&&Oo.test(o.path)&&(typeof o.equals=="boolean"||typeof o.equals=="string"||typeof o.equals=="number"&&Number.isFinite(o.equals)?t.failed_when={path:o.path,equals:o.equals}:o.equals===void 0&&o.empty===!0&&(t.failed_when={path:o.path,empty:!0})),t}var ma=1024*1024,ha=3e4;function Qe(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:ma}function Xe(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:ha}function Mn(e){return new w(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function pd(e){return new w(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function mr(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o(pd(n)),n)})])}finally{clearTimeout(t)}}async function hr(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:s,value:c}=await mr(()=>t.read(),n.bodyStallTimeoutMs);if(s)break;if(o+=c.byteLength,o>n.maxBodyBytes)throw Mn(n.maxBodyBytes);r.push(c)}let i=new Uint8Array(o),a=0;for(let s of r)i.set(s,a),a+=s.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var Do=new Map;function ba(e){let n;try{n=j(e)}catch{return}let t=Wr(n);t&&Do.get(n.projectApiKey)!==t&&(Do.set(n.projectApiKey,t),S({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{Do.delete(n.projectApiKey)}))}var gd=[".corsair.dev"];function fd(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function yd(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:fd(n)?!0:gd.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function ka(e){return!e||!yd(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function wa(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function Ho(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function Uo(e,n){let t=j(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=He(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=ur(`browser:${i.jti}`,De);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(nt(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let s=await et(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:s}}})}}if(pr(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let s=i.connectLinkPlugins?.filter(Boolean)??[];if(s.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let c=await Ft(e,{tenantId:i.tenantId,plugins:s});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:c.connectUrl,expiresAt:c.expiresAt}})}}if(Ye(i))return i.hubSuccessUrl?i.credentials?(await ar(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:Ho(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:Ho(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(tt(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await Eo(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(rt(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await En(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!gr(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await Yn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(s){let c=s instanceof Error?s.message:"Hub delivery failed";return nt(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:pr(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:Ye(i)&&i.hubSuccessUrl?{type:"redirect",url:Ho(i.hubSuccessUrl,{error:c})}:Ye(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:gn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:c})}:{type:"json",status:400,body:{error:c}}}return{type:"redirect",url:i.hubSuccessUrl}}async function Bo(e,n){let t=j(e),r=await ot(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,a=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:a}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:a}}function Fo(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function Lo(e,n){return n.method==="GET"?Uo(e,n.url):Bo(e,{headers:n.headers,body:n.body??""})}async function No(e,n){try{let t=await Lo(e,n);return Fo(t)}catch(t){if(t instanceof Te)return Response.json({error:t.message},{status:503});throw t}}async function en(e,n,t){ba(e);let r=n.method.toUpperCase(),o=ka(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await No(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await hr(n,{maxBodyBytes:Qe(t?.maxBodyBytes),bodyStallTimeoutMs:Xe(t?.bodyStallTimeoutMs)}):void 0});return wa(i,o)}var E=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function On(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function Dn(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var Ca=new WeakMap;function Ae(e,n,t){let r=Ca.get(e);r||(r=new Map,Ca.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var Pa=300;async function $o(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,a=n?.forceRefresh??!1,s=`managed:${o}:${i}`;return Ae(t,s,async()=>{let[c,l,u]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!c&&!u)throw new E(o,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&c&&l&&Number(l)>d+Pa)return{accessToken:c,expiresAt:Number(l),refreshed:!1};if(!u&&c&&!a){let f=l?Number(l):null;if(f===null||f>d+Pa)return{accessToken:c,expiresAt:f??d+3600,refreshed:!1}}if(!u)throw new E(o,"managed");let p=await hd(r,o,i,u),g=await Dn(t,p,l);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function md(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function hd(e,n,t,r){try{return await S({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:pn})}catch(o){let i=o instanceof Error?o.message:"";throw md(i)?new E(n,"managed"):o}}async function Ta(e,n){e._refreshAuth=async()=>(await $o(n,{forceRefresh:!0})).accessToken}import{randomUUID as wd}from"crypto";import{createHmac as bd}from"crypto";var kd="x-corsair-runtime-proof";function it(e,n){if(!e.runtimeProofKey)return{};let t=Math.floor((n.nowMs??Date.now())/1e3),r=bd("sha256",e.runtimeProofKey).update([t,n.path,n.plugin,n.tenantId,n.operation].join(`
+`)).digest("base64url");return{[kd]:`t=${t},v1=${r}`}}var Cd="",Pd=60,Td=1e4,Wo=new WeakMap;function br(e){let n=Rt(e.apiUrl),t=e.instanceKey?.trim()??"";return[encodeURIComponent(n),encodeURIComponent(e.projectApiKey),encodeURIComponent(t)].join(Cd)}function vd(e,n,t,r){let i=`${br(e)}:${n}:${t}`;return r?`${i}:${r}`:i}function Rd(e,n){return Wo.get(e)?.get(n)}function Ad(e,n,t){let r=Wo.get(e);r||(r=new Map,Wo.set(e,r)),r.set(n,t)}function xd(e,n){return e.expiresAt===null?!1:e.expiresAt>n+Pd}function kr(e,n){if(!n)throw new E(e,"managed_pricing",`[auth-missing:${e}:managed_pricing]: Hub config is required. Pass hub: { ... } to createCorsair().`)}async function jo(e,n){kr(e.plugin,e.hub);let t=n.operation.trim();if(!t)throw new E(e.plugin,"managed_pricing",`[auth-missing:${e.plugin}:managed_pricing]: Operation id is required for Hub metering.`);let r=n.forceRefresh??!1,o=n.idempotencyKey?.trim()||void 0,i=vd(e.hub,e.plugin,e.tenantId,t),s=`managed_pricing:${o?`call:${o}`:r?"force":"routine"}:${i}`;return Ae(e.cache,s,async()=>{let c=Math.floor(Date.now()/1e3);if(!r&&!o){let d=Rd(e.cache,i);if(d&&xd(d,c))return{apiKey:d.apiKey,expiresAt:d.expiresAt,fromCache:!0}}let l=await S({hub:e.hub,path:"/managed-pricing/credentials",body:{plugin:e.plugin,tenantId:e.tenantId,operation:t,...o?{idempotencyKey:o}:{},...n.cap!==void 0?{cap:n.cap}:{},...n.jobId?{jobId:n.jobId}:{}},extraHeaders:{...it(e.hub,{path:"/managed-pricing/credentials",plugin:e.plugin,tenantId:e.tenantId,operation:t}),"x-corsair-metered-operation":t,...o?{"x-corsair-idempotency-key":o}:{}},notFoundMessage:"Managed pricing is not configured for this project",parseResponse:yr,signal:AbortSignal.timeout(Td)}),u=l.expires_in!==void 0?c+l.expires_in:null;return o||Ad(e.cache,i,{apiKey:l.api_key,expiresAt:u}),{apiKey:l.api_key,expiresAt:u,fromCache:!1,...l.usage_path?{usagePath:l.usage_path}:{},...l.job?{startedJobIdPath:l.job.id_path}:{},...l.failed_when?{failedWhen:l.failed_when}:{}}})}function wr(){return{}}async function qo(e,n){kr(n.plugin,e.hub);let t=e.tenantId?.trim();if(!t)throw new E(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: tenantId is required for metered credentials.`);let r=(n.operation??e.meteredOperationId)?.trim();if(!r)throw new E(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: Endpoint operation id missing \u2014 cannot meter usage.`);let o=wd(),i={plugin:n.plugin,tenantId:t,operation:r,idempotencyKey:o};try{let a=await jo({hub:e.hub,plugin:n.plugin,tenantId:t,cache:n.cache},{operation:r,idempotencyKey:o,cap:n.cap,jobId:n.jobId});return{apiKey:a.apiKey,call:i,...a.usagePath?{usagePath:a.usagePath}:{},...a.startedJobIdPath?{startedJobIdPath:a.startedJobIdPath}:{},...a.failedWhen?{failedWhen:a.failedWhen}:{}}}catch(a){throw Id(a)&&await Ko(e.hub,i,a),a}}function Id(e){let n=typeof e=="object"&&e!==null&&"name"in e?e.name:void 0;return n==="TimeoutError"||n==="AbortError"||n==="TypeError"}async function va(e,n){return(await qo(e,n)).apiKey}function Sd(e){try{return e instanceof Error?`${e.name}: ${e.message}`:String(e)}catch{return"Unprintable thrown value"}}var Ra=3e3;function Aa(e,n){return it(e,{path:"/managed-pricing/usage/outcome",plugin:n.plugin,tenantId:n.tenantId,operation:n.operation})}async function Ko(e,n,t){let r=Sd(t);try{await S({hub:e,path:"/managed-pricing/usage/outcome",body:{...n,outcome:"failed",error:r.slice(0,300)},extraHeaders:Aa(e,n),parseResponse:o=>o,signal:AbortSignal.timeout(Ra)})}catch{}}function Cr(e,n){let t=e;for(let r of n.split(".")){if(!t||typeof t!="object")return;t=t[r]}return typeof t=="number"&&Number.isFinite(t)&&t>=0?t:void 0}function xa(e,n){let t=e;for(let r of n.path.split(".")){if(!t||typeof t!="object")return!1;t=t[r]}return"empty"in n?Array.isArray(t)&&t.length===0:t===n.equals}function _d(e){if(Array.isArray(e))for(let n of e){if(!n||typeof n!="object")continue;let{error:t,message:r}=n,o=[t,r].find(i=>typeof i=="string"&&i.length>0);if(o)return o}}function Ia(e,n){let t="empty"in n?`${n.path} was empty`:`${n.path} was ${JSON.stringify(n.equals)}`,r=e&&typeof e=="object"?e:{},o=[r.code,r.error].find(i=>typeof i=="string"&&i.length>0)??_d(r.errors);return o?`${t}: ${o}`:t}async function Sa(e,n,t){try{await S({hub:e,path:"/managed-pricing/usage/outcome",body:{...n,outcome:"succeeded",usage:{units:t}},extraHeaders:Aa(e,n),parseResponse:r=>r,signal:AbortSignal.timeout(Ra)})}catch{}}function _a(e){return{delivery:n=>en(e,n),deliveryOptions:n=>en(e,n)}}var Ea=1200*1e3;function Zo(){return Pe()}function Go(){return Ea}function Jo(e,n){return Zn(e,n,Ea)}function zo(e,n){return de(e,n)}function Vo(e){return Ze(e)}var Ma=600*1e3;function Yo(){return Pe()}function Qo(){return Ma}function Xo(e,n){return Zn(e,n,Ma)}function ei(e,n){return de(e,n)}function ni(e){return zr(e)}function ti(e){return Ze(e)}function ri(){return Pe()}function oi(e,n,t){return xt(e,n,Math.floor(t.getTime()/1e3))}function ii(e,n){return de(e,n)}function si(e){return Ze(e)}var nn=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${bt}`),this.name="CorsairKekMissingError"}};function Pr(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new nn;let a=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${bt}`)}})}async function Ed(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function Oa(e){let{integrationId:n,accountId:t}=await Ed(e);return{integrationId:n,accountId:t}}function Da(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>jr(t(),{tenantId:n,message:r}),list:()=>Kr(t(),{tenantId:n}),get:r=>({message:o=>qr(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>Zr(t(),{chatId:r,tenantId:n})})}}var Md=10*6e4,Od=5e3,Dd=3,Hd=3e3,Ud=2e3,Ha=new WeakMap;function Bd(e){let n=e?.kinds;if(!Array.isArray(n))throw new Error("job-kinds: no kinds array");let t=r=>typeof r=="string"&&r.length>0;return n.filter(r=>{let o=r;return!t(o?.plugin)||!t(o?.operation)?!1:o.role==="start"?t(o.id_path):o.role==="status"?t(o.id_arg)&&t(o.status_path):o.role==="scoped"?t(o.id_arg):!1})}async function Ba(e,n){let t=br(e),r=Ha.get(n);r||(r=new Map,Ha.set(n,r));let o=r.get(t);return o&&o.until>Date.now()?o.kinds:Ae(n,`managed_pricing:job_kinds:${t}`,async()=>{try{let i=await K({hub:e,path:"/managed-pricing/job-kinds",parseResponse:Bd,signal:AbortSignal.timeout(Ud)});return r.set(t,{kinds:i,until:Date.now()+Md}),i}catch{return r.set(t,{kinds:[],until:Date.now()+Od}),[]}})}function Fa(e,n,t){let r=n.toLowerCase();return e.find(o=>o.plugin===r&&o.operation===t)}function La(e,n){let t=e;for(let r of n.split(".")){if(!t||typeof t!="object")return;t=t[r]}return t}function Tr(e,n){let t=La(e,n);return typeof t=="string"&&t.length>0?t:void 0}function ai(e,n){if(e?.role==="start"&&e.cap_path){let t=La(n,e.cap_path);return typeof t=="number"?{cap:t}:{}}if(e?.role==="status"||e?.role==="scoped"){let t=Tr(n,e.id_arg);return t?{jobId:t}:{}}return{}}async function Ua(e,n,t,r=1){let o=it(e,{path:n,plugin:t.plugin,tenantId:t.tenantId,operation:t.operation});for(let i=1;i<=r;i++)try{return await S({hub:e,path:n,body:t,extraHeaders:o,parseResponse:a=>a,signal:AbortSignal.timeout(Hd)}),!0}catch(a){let s=ls(a);if(s!==void 0&&s!==429&&s<500)break;i<r&&await new Promise(c=>setTimeout(c,250*i))}return!1}async function Na(e,n,t,r,o){if(n.role==="scoped")return{startedJob:!1};if(n.role==="start"){let c=Tr(o,n.id_path);return!c||!t.idempotencyKey?{startedJob:!1}:(await Ua(e,"/managed-pricing/jobs",{...t,providerJobId:c},Dd),{startedJob:!0})}let i=Tr(r,n.id_arg),a=Tr(o,n.status_path);if(!i||!a)return{startedJob:!1};let s=n.usage_path?Cr(o,n.usage_path):void 0;return await Ua(e,"/managed-pricing/jobs/report",{plugin:t.plugin,tenantId:t.tenantId,operation:t.operation,providerJobId:i,providerStatus:a,...s!==void 0&&{units:s}}),{startedJob:!1}}function $a(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function Fd(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await Ls(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):$a(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function Ld(e,n,t){let r=bn(Be(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):$a(e,i),connectUrl:i}}async function Nd(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.error.authType==="managed_pricing"?{message:e.error.message,connectUrl:null}:e.manual&&vn(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?Ld(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?Fd({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function Wa(e){let{message:n,connectUrl:t}=await Nd(e);throw new E(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var vr="connect.request",ui="connect.cleared",$d=600*1e3;async function ci(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function Wd(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function jd(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[vr,ui]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function ja(e,n,t,r,o,i,a){if(a&&!i)throw new Error("encryptDataAtRest requires kek");let s=await jd(e,n,o),c=new Date(s),l=i?wt(r,await jn(e.db,n,i)):r;await e.db.insertInto("corsair_events").values({id:dn(),created_at:c,updated_at:c,account_id:n,event_type:t,payload:l}).execute()}async function qd(e,n,t=Date.now()){let r=await ci(e,n.tenantId,n.plugin);r&&await ja(e,r,vr,{plugin:n.plugin,connectUrl:n.connectUrl},t,n.kek,n.encryptDataAtRest)}function Kd(e){let n=e;if(typeof e=="string")try{n=JSON.parse(e)}catch{return null}return!n||typeof n!="object"||Array.isArray(n)?null:n}async function Zd(e,n,t,r,o,i){let a=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[vr,ui]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!a||a.event_type!==vr)return null;let s=a.created_at instanceof Date?a.created_at.getTime():Date.parse(String(a.created_at));if(r-s>o)return null;let c=a.payload;if(typeof c=="string")try{c=JSON.parse(c)}catch{return null}if(Yi(c)){if(!i)return null;try{c=Qi(c,await jn(e.db,n,i))}catch{return null}}let l=Kd(c);if(!l)return null;let u=l.plugin,d=l.connectUrl;return typeof u!="string"||typeof d!="string"?null:{plugin:u,connectUrl:d,requestedAt:new Date(s).toISOString(),tenantId:t,requestedAtMs:s,accountId:n}}async function li(e,n,t=Date.now(),r=$d,o){let i=await Wd(e,n);if(i.length===0)return null;let a=(await Promise.all(i.map(u=>Zd(e,u,n,t,r,o)))).filter(u=>u!==null);if(a.length===0)return null;a.sort((u,d)=>u.requestedAtMs-d.requestedAtMs||u.accountId.localeCompare(d.accountId));let{requestedAtMs:s,accountId:c,...l}=a[0];return l}async function qa(e,n,t=Date.now(),r,o,i){let a;if(r)a=await ci(e,n,r);else{let s=await li(e,n,t,void 0,o);a=s?await ci(e,n,s.plugin):null}a&&await ja(e,a,ui,{},t,o,i)}async function di(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await qd(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl,encryptDataAtRest:n.encryptDataAtRest,kek:n.kek})}catch{}}var Gd=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function Ka(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[a||"DEFAULT"]?.handler||Gd)(e,i)}var Za=new Map;function Jd(e){let n=Za.get(e);return n||(n=wr(),Za.set(e,n)),n}function zd(e){return typeof e=="function"}function pi({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:a=[],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:T,encryptDataAtRest:A}){for(let[F,O]of Object.entries(e)){let te=n?.[F];if(zd(O)){let P=te,C=[...a,F].join("."),D=async(L={})=>{let re=l?.[C];qt(C,re?.riskLevel??"write");let B,H=An(),_e=c?.mode,Bn=uo(H,_e);if(Bn){let v=re,I=v?.riskLevel??"write",V=c?.overrides?.[C],je=H!==void 0&&H!==_e&&Bn===H?Ks(V,Kt(I,H)):V,{result:un,reason:W,onComplete:Nn,token:mt,id:Ni,expiresAt:pu}=await Gs({pluginId:o,endpointPath:C,args:L,mode:Bn,override:je,riskLevel:I,meta:v,db:u,timeoutMs:d?po(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(un==="blocked"){let ln;W==="denied"?ln=`Action '${C}' was denied by the user. Await further instructions before proceeding.`:W==="policy"?ln=H?`Action '${C}' is blocked by permission mode '${H}'.`:`Action '${C}' is blocked by the permission policy. Update the corsair config to allow it.`:W==="timeout"?ln=`Action '${C}' timed out waiting for approval.`:mt&&Ni?ln=await co({permissionsOptions:d,manual:g,hub:f,permissionId:Ni,permissionToken:mt,plugin:o,endpoint:C,args:L,tenantId:p??"default",expiresAt:pu??new Date(Date.now()+(d?po(d.timeout):600*1e3)).toISOString(),operationPath:C}):ln=`Action '${C}' requires user approval before it can run.`;let gu=W==="denied"||W==="policy"||W==="timeout"?W:"pending";throw new pe(ln,gu)}B=Nn}let Br=async(v,I,V)=>{try{return await O(I,V)}catch(yt){if(yt instanceof Error){let je=await Ka(yt,o,C,typeof V=="object"&&V!==null?V:{args:V},i);if(v<(je.maxRetries||0)){let un=v+1;console.log(`Retrying (${un} / ${je.maxRetries})...`);let W;if(je.headersRetryAfterMs)W=je.headersRetryAfterMs;else switch(je.retryStrategy){case"exponential_backoff":W=Math.pow(2,un-1)*1e3;break;case"exponential_backoff_jitter":let Nn=Math.pow(2,un-1)*1e3,mt=(Math.random()-.5)*1e3;W=Math.max(0,Nn+mt);break;case"linear_1s":W=1e3;break;case"linear_2s":W=2e3;break;case"linear_3s":W=3e3;break;case"linear_4s":W=4e3;break;default:W=1e3;break}return await new Promise(Nn=>setTimeout(Nn,W)),await Br(un,I,V)}}throw yt}},lt,We,dt,pt,oe,gt={},Hi=!1,ft=async v=>{We&&f&&oe?.role!=="status"&&oe?.role!=="scoped"&&!Hi&&await Ko(f,We,v)},Ui=async(v,I)=>{if(!oe||!f||!We)return;Hi=(await Na(f,oe,We,v,I)).startedJob},Fn={},Bi=v=>{let I=pt&&xa(v,pt)?Ia(v,pt):void 0,V=dt?Cr(v,dt):void 0;Fn={...I!==void 0?{failure:I}:{},...V!==void 0?{units:V}:{}}},Fi=async()=>{if(!(!We||!f)){if(Fn.failure!==void 0){await ft(new Error(Fn.failure));return}!dt||oe||Fn.units===void 0||await Sa(f,We,Fn.units)}},uu={...t,meteredOperationId:C},lu=typeof t.tenantId=="string"?t.tenantId:void 0,du=h?M(h):void 0;try{if(du==="managed_pricing"&&f){let v=Jd(o);oe=Fa(await Ba(f,v),o,C),gt=ai(oe,L);let I=await qo({hub:f,tenantId:lu??p,meteredOperationId:C},{plugin:o,cache:v,operation:C,...gt});!oe&&I.startedJobIdPath&&(oe={plugin:o,operation:C,role:"start",id_path:I.startedJobIdPath,status_operation:""}),lt=I.apiKey,We=I.call,dt=I.usagePath,pt=I.failedWhen}else s&&(lt=await s(uu,"endpoint"))}catch(v){if(v instanceof Ce)throw h&&f&&wn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await di(u,{tenantId:v.tenantId??p,plugin:v.plugin,connectUrl:v.connectUrl,encryptDataAtRest:A,kek:A?b:void 0}),v;if(v instanceof E){h&&f&&wn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1});try{await Wa({error:v,manual:g,hub:f,plugin:h,tenantId:p,database:u,kek:b,plugins:k,multiTenancy:T})}catch(I){throw I instanceof E&&await di(u,{tenantId:I.tenantId??p,plugin:I.pluginId,connectUrl:I.connectUrl,encryptDataAtRest:A,kek:A?b:void 0}),I}}throw v}if(!P?.before&&!P?.after){let v;try{v=await Br(0,{...t,key:lt},L),Bi(v),await Ui(L,v),await B?.()}catch(I){throw await ft(I),I}return await Fi(),h&&f&&wn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),v}let Li={...t,key:lt},Ln;try{let v=P.before?await P.before(Li,L):{ctx:Li,args:L,continue:!0,passToAfter:void 0};if(v.continue===!1){await ft(new Error("Stopped by a before hook"));return}if(oe){let I=ai(oe,v.args);if(gt.cap!==I.cap||gt.jobId!==I.jobId)throw new Error(`A before hook changed ${C}'s ${oe.role==="start"?"cap":"job id"} after Corsair checked it, so the call did not run.`)}Ln=await Br(0,v.ctx,v.args),Bi(Ln),await Ui(v.args,Ln),await P.after?.(v.ctx,Ln,v.passToAfter),await B?.()}catch(v){throw await ft(v),v}return await Fi(),h&&f&&wn({hub:f,database:u,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),Ln};r[F]=D}else if(O&&typeof O=="object"){let P={};pi({endpoints:O,hooks:te,ctx:t,tree:P,pluginId:o,errorHandlers:i,currentPath:[...a,F],keyBuilder:s,permissionsConfig:c,endpointMeta:l,database:u,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:T,encryptDataAtRest:A}),r[F]=P}}}var me={findByEntityId:"read",existsByEntityId:"read",findIdByEntityId:"read",findById:"read",findManyByEntityIds:"read",list:"read",search:"read",count:"read",upsertByEntityId:"write",deleteById:"destructive",deleteByEntityId:"destructive"},Vd=/^\$+date$/;function Ga(e){if(typeof e!="object"||e===null||Array.isArray(e))return null;let n=Object.keys(e),t=n[0];return n.length!==1||!t||!Vd.test(t)?null:typeof e[t]=="string"?t:null}function tn(e){if(e instanceof Date)return{$date:e.toISOString()};if(Array.isArray(e))return e.map(tn);let n=Ga(e);return n?{[`$${n}`]:e[n]}:e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,tn(r)])):e}function rn(e){let n=Ga(e);if(n){let t=e[n];if(n!=="$date")return{[n.slice(1)]:t};let r=new Date(t);if(Number.isNaN(r.getTime()))throw $(`Invalid $date value "${t}" \u2014 expected an ISO 8601 timestamp`);return r}return Array.isArray(e)?e.map(rn):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,rn(r)])):e}async function gi(e,n,t){let r=Object.hasOwn(me,n.method)?me[n.method]:void 0;if(!r)throw new w(404,"unknown_db_method",`Unknown db method "${n.method}" \u2014 expected one of ${Object.keys(me).join(", ")}`);ze(`${n.plugin}.db.${n.entityType}.${n.method}`,r);let i=e?.[n.plugin]?.db;if(!i)throw new w(404,"unknown_plugin",`Plugin "${n.plugin}" has no entity store`);let a=Object.hasOwn(i,n.entityType)?i[n.entityType]:void 0,s=a?.[n.method];if(typeof s!="function")throw new w(404,"unknown_entity_type",`Plugin "${n.plugin}" has no entity type "${n.entityType}"`);return s.apply(a,t)}function Yd(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function fi({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,a]of Object.entries(e)){let s=n?.[i];if(Yd(a)){let c=s,l=async u=>{let d=(g,f)=>a.handler(g,f),p=o&&u?.hubVerified!==!0?await o(t,"webhook"):void 0;return!c?.before&&!c?.after?d({...t,key:p},u):(async()=>{let g={...t,key:p},f=c.before?await c.before(g,u):{ctx:g,args:u,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await c.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:a.match,handler:l}}else if(a&&typeof a=="object"){let c={};fi({webhooks:a,hooks:s,ctx:t,webhooksTree:c,keyBuilder:o}),r[i]=c}}}function Ja(e){return e&&typeof e=="object"?e:{}}async function za(e,n){return K({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Ja(t).workflows;return Array.isArray(r)?r:[]}})}async function Va(e,n){return K({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>Ja(t).workflow})}async function Ya(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Qa(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function Xa(e,n){return S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function yi(e){return e&&typeof e=="object"?e:{}}async function ec(e,n){return K({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=yi(t).runs;return Array.isArray(r)?r:[]}})}async function nc(e,n){return K({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=yi(t).runs;return Array.isArray(r)?r:[]}})}async function tc(e,n){return K({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>yi(t).run})}async function mi(e,n,t){await S({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var rc=(e,n)=>mi(e,"approve",n),oc=(e,n)=>mi(e,"deny",n),ic=(e,n)=>mi(e,"cancel",n);function sc(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?nc(t(),{workflowId:r.workflowId,tenantId:n}):ec(t(),{tenantId:n}),get:r=>tc(t(),{runId:r,tenantId:n}),approve:r=>rc(t(),{runId:r,tenantId:n}),deny:r=>oc(t(),{runId:r,tenantId:n}),cancel:r=>ic(t(),{runId:r,tenantId:n})}}function ac(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>Ya(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>za(t(),{tenantId:n}),get:o=>Va(t(),{workflowId:o,tenantId:n}),run:(o,i)=>Xa(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:sc(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>Qa(t(),{workflowId:o,tenantId:n,name:i})}}function Qd(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await Oa({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function Xd(e,n){let t={};for(let[r,o]of Object.entries(n))t[r]=new Proxy(o,{get(i,a){let s=i[a];if(typeof a!="string"||typeof s!="function")return s;let c=Object.hasOwn(me,a)?me[a]:void 0;if(!c)return s;let l=s;return async(...u)=>(ze(`${e}.db.${r}.${a}`,c),l.apply(i,u))}});return t}function ep(e,n,t,r,o){return e?Fr(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function hi(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:a,manualConfig:s,hubConfig:c,internalConfig:l}=n,u=r??"default",d=l&&t?()=>hn(l,u):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=Qd(t,f.id,u,d);if(h?.entities){let B={};for(let[H,_e]of Object.entries(h.entities)){let Bn=t?Fr(t.db,b,H,h.version,_e,l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o??""}:void 0):ep(void 0,b,H,h.version,_e);B[H]=Bn}g[f.id].db=B,p[f.id].db=Xd(f.id,B)}let k=f.options,T=f.authConfig,A;if(t&&o&&k?.authType){let B=T?.[k.authType]?.account??[];A=N({authType:k.authType,integrationName:f.id,tenantId:u,kek:o,database:t,extraAccountFields:B,ensureProvisioned:d}),p[f.id].keys=A}let F={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...A?{keys:A,authType:k?.authType}:{},tenantId:u,...l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o}:{},...c?{hub:c}:{}},O=f.endpoints??{},te=f.hooks,P={...i,...f.errorHandlers},C={},D=f.options?.permissions;pi({endpoints:O,hooks:te,ctx:F,tree:C,pluginId:f.id,errorHandlers:P,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:D,endpointMeta:f.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:f.oauthConfig,kek:o,tenantId:u}:void 0,hubConfig:c,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy,encryptDataAtRest:l?.encryptDataAtRest===!0}),Object.keys(C).length>0&&(p[f.id].api=C),F.endpoints=C;let L=f.webhooks??{},re=f.webhookHooks;if(Object.keys(L).length>0&&!zi(k?.authType)){let B={};fi({webhooks:L,hooks:re,ctx:F,webhooksTree:B,keyBuilder:f.keyBuilder}),p[f.id].webhooks=B,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=Da(c,u),p.workflows=ac(c,u),p}function cc(e,n,t){let r={};for(let o of e){let i=o.options,a=o.authConfig;if(i?.authType){let s=a?.[i.authType]?.integration??[],c=q({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:s});r[o.id]=c}}return r}var np=3e4;function Rr(e){let n=e.length;for(;n>0&&e[n-1]==="/";)n--;return e.slice(0,n)}function tp(e){let n=0;for(;n<e.length&&e[n]==="/";)n++;return e.slice(n)}function rp(e,n){return`${Rr(e)}/${tp(n)}`}function op(e,n){let t=n??{},{error:r,message:o,...i}=t;return typeof r!="string"?new w(e,"internal_error","Internal error"):new w(e,r,o,i)}var bi=Symbol("cloudRequestTimeout");async function J(e,n,t,r){let o=An(),i=e.fetch??globalThis.fetch,a=e.timeoutMs??np,s=new AbortController,c,l=new Promise(g=>{c=setTimeout(()=>{s.abort(),g(bi)},a)}),u;try{let g=i(rp(e.baseUrl,t),{method:n,headers:{authorization:`Bearer ${e.apiKey}`,"content-type":"application/json",...o?{"x-corsair-mode":o}:{}},body:r===void 0?void 0:JSON.stringify(r),signal:s.signal}).catch(h=>{if(s.signal.aborted)return bi;throw h}),f=await Promise.race([g,l]);if(f===bi)throw new w(0,"internal_error","Cloud request timed out");u=f}finally{clearTimeout(c)}let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw op(u.status,p);if(p===void 0)throw new w(u.status,"internal_error","Invalid or empty response body from runtime");return p}var z={invoke:"/:tenant/:plugin/call/:op",entityDb:"/:tenant/:plugin/db/:entity/:method",instances:"/instances",connectLinks:"/connect/links",tenants:"/tenants",tenant:"/tenants/:id",connectionStatus:"/connection-status",disconnect:"/disconnect",permission:"/permissions/:id",permissionLookup:"/permissions/lookup-by-token"};var ip=new Set(["keys","webhooks"]),sp=new Set(["chats","workflows"]),ki=new Set(["then","catch","finally"]);function he(e){return typeof e=="function"?e():Promise.resolve(e)}function uc(e,n,t,r){let o=async(...i)=>{let a=await he(e);return(await J(a,"POST",z.invoke.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":op",r.map(encodeURIComponent).join(".")),{args:i[0]})).data};return new Proxy(o,{get(i,a){if(!(typeof a!="string"||ki.has(a)))return uc(e,n,t,[...r,a])}})}function ap(e,n,t){return new Proxy({},{get(r,o){if(!(typeof o!="string"||ki.has(o)))return new Proxy({},{get(i,a){if(typeof a!="string")return;let s=Object.hasOwn(me,a)?me[a]:void 0;if(s)return async(...c)=>{ze(`${t}.db.${o}.${a}`,s);let l=await he(e),u=await J(l,"POST",z.entityDb.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":entity",encodeURIComponent(o)).replace(":method",encodeURIComponent(a)),{args:tn(c)});return rn(u.data)}}})}})}function Ar(e,n){let t=e?new Set(e.map(r=>r.id)):null;return new Proxy({},{get(r,o){if(!(typeof o!="string"||ki.has(o))){if(sp.has(o))throw new Error(`"${o}" is not available in cloud mode (deferred)`);if(t&&!t.has(o))throw new Error(`Unknown plugin "${o}"`);return new Proxy({},{get(i,a){if(a==="api")return uc(n.transport,n.tenantId,o,[]);if(a==="db")return ap(n.transport,n.tenantId,o);if(typeof a=="string"&&ip.has(a))throw new Error(`"${a}" is not available in cloud mode (deferred)`)}})}}})}function xr(e){return{connect:{createLink:n=>{if(!n.plugin||!n.tenantId)throw new Error('connect.createLink requires both "plugin" and "tenantId" in cloud mode');return he(e).then(t=>J(t,"POST",z.connectLinks,n))}},tenants:{create:n=>he(e).then(t=>J(t,"POST",z.tenants,n)),list:()=>he(e).then(n=>J(n,"GET",z.tenants)),get:n=>he(e).then(t=>J(t,"GET",z.tenant.replace(":id",encodeURIComponent(n))))},connectionStatus:{get:n=>he(e).then(t=>J(t,"GET",`${z.connectionStatus}?tenantId=${encodeURIComponent(n.tenantId)}`))},disconnect:n=>he(e).then(t=>J(t,"POST",z.disconnect,n)),permissions:{get:n=>he(e).then(t=>"id"in n?J(t,"GET",z.permission.replace(":id",encodeURIComponent(n.id))):J(t,"POST",z.permissionLookup,{token:n.token}))}}}var xe=class extends w{type;retryable;param;docUrl;requestId;constructor(n,t){super(n,t.code,t.message,{...t}),this.name="CloudApiError",this.type=t.type??"api_error",this.retryable=t.retryable??(n===0||n===429||n>=500),this.param=t.param,this.docUrl=t.doc_url,this.requestId=t.request_id}};function st(e,n,t){let r=t?.get("request-id")?.trim()||void 0,i=(n??{}).error;if(typeof i=="string"){let a=n.message;return new xe(e,{code:i,message:typeof a=="string"?a:void 0,request_id:r})}return i&&typeof i=="object"&&typeof i.code=="string"?new xe(e,{request_id:r,...i}):new xe(e,{code:e===0?"request_failed":"internal_error",message:`Corsair Cloud returned ${e} with no error body`,request_id:r})}var cp=3e4,up=new Set(["GET","HEAD","PUT","DELETE"]),lp=/^[a-z][a-z0-9-]{0,31}$/;function on(e,n){if(!lp.test(e))throw new Error(`${n}: "${e}" is not a valid instance key. Lowercase letter first, then letters, digits or hyphens, up to 32 characters.`)}function sn(e){let n=new URLSearchParams;for(let[r,o]of Object.entries(e))o!==void 0&&n.set(r,String(o));let t=n.toString();return t?`?${t}`:""}function x(e,n){return`${e}/${encodeURIComponent(n)}`}async function Ir(e,n,t,r,o={}){let i=e.fetch??globalThis.fetch,a=new AbortController;o.signal?.aborted&&a.abort();let s=()=>a.abort();o.signal?.addEventListener("abort",s,{once:!0});let c=setTimeout(()=>a.abort(),e.timeoutMs??cp),l={authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"};e.apiVersion&&(l["corsair-version"]=e.apiVersion),o.idempotencyKey&&(l["idempotency-key"]=o.idempotencyKey),o.requestId&&(l["x-corsair-request-id"]=o.requestId);let u;try{u=await i(`${e.baseUrl}${t}`,{method:n,headers:l,body:r===void 0?void 0:JSON.stringify(r),signal:a.signal});let d=await u.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!u.ok)throw st(u.status,p,u.headers);if(p===void 0&&u.status!==204)throw st(u.status,void 0,u.headers);return p}catch(d){if(o.signal?.aborted||d instanceof xe)throw d;let p=up.has(n),g=u?p?!0:void 0:p||!!o.idempotencyKey;throw st(u?.status??0,{error:{code:"request_failed",message:d instanceof Error?d.message:String(d),retryable:g}},u?.headers)}finally{clearTimeout(c),o.signal?.removeEventListener("abort",s)}}function wi(e,n){on(n,"withInstance");let t=(s,c,l,u)=>Ir(e,s,c,l,u),r=(...s)=>[n,...s].join(":"),o=s=>sn({...s,instance:n}),i=s=>`${x("/instances",n)}${s}`,a=s=>`${x("/webhooks",r(s))}/deliveries`;return{instanceKey:n,tenants:{list:(s={},c)=>t("GET",`/tenants${o(s)}`,void 0,c),create:(s,c)=>t("POST","/tenants",{...s,instance:n},c),get:(s,c)=>t("GET",x("/tenants",r(s)),void 0,c),update:(s,c,l)=>t("PATCH",x("/tenants",r(s)),c,l),delete:(s,c)=>t("DELETE",x("/tenants",r(s)),void 0,c)},access:{list:(s={},c)=>t("GET",`/access${o(s)}`,void 0,c),get:(s,c)=>t("GET",x("/access",r(s)),void 0,c),set:(s,c,l)=>t("PUT",x("/access",r(s)),c,l),revoke:(s,c)=>t("DELETE",x("/access",r(s)),void 0,c)},connections:{list:(s={},c)=>t("GET",`/connections${o(s)}`,void 0,c),get:(s,c,l)=>t("GET",x("/connections",r(s,c)),void 0,l),delete:(s,c,l)=>t("DELETE",x("/connections",r(s,c)),void 0,l)},connect:{createSession:(s,c)=>t("POST","/connect/sessions",{...s,instance:n},c)},integrations:{list:(s={},c)=>t("GET",`/integrations${o(s)}`,void 0,c),get:(s,c)=>t("GET",x("/integrations",r(s)),void 0,c),put:(s,c,l)=>t("PUT",x("/integrations",r(s)),c,l),delete:(s,c)=>t("DELETE",x("/integrations",r(s)),void 0,c),operations:(s,c)=>t("GET",`${x("/integrations",r(s))}/operations`,void 0,c),oauthApp:{get:(s,c)=>t("GET",`${x("/integrations",r(s))}/oauth-app`,void 0,c),put:(s,c,l)=>t("PUT",`${x("/integrations",r(s))}/oauth-app`,c,l),delete:(s,c)=>t("DELETE",`${x("/integrations",r(s))}/oauth-app`,void 0,c)}},webhooks:{list:(s={},c)=>t("GET",`/webhooks${o(s)}`,void 0,c),create:(s,c)=>t("POST","/webhooks",{...s,instance:n},c),get:(s,c)=>t("GET",x("/webhooks",r(s)),void 0,c),delete:(s,c)=>t("DELETE",x("/webhooks",r(s)),void 0,c),rotateSecret:(s,c,l)=>t("POST",`${x("/webhooks",r(s))}/rotate-secret`,c,l),deliveries:{list:(s,c={},l)=>t("GET",`${a(s)}${sn(c)}`,void 0,l),get:(s,c,l)=>t("GET",x(a(s),c),void 0,l),retry:(s,c,l)=>t("POST",`${x(a(s),c)}/retry`,void 0,l)}},signingSecret:{get:s=>t("GET",i("/signing-secret"),void 0,s),rotate:s=>t("POST",i("/signing-secret/rotate"),void 0,s)},apply:s=>t("POST",i("/apply"),void 0,s),removeFromRuntime:s=>t("POST",i("/remove"),void 0,s),reconcile:s=>t("POST",i("/reconcile"),void 0,s)}}function Ci(e){let n=(t,r,o,i)=>Ir(e,t,r,o,i);return{project:{get:t=>n("GET","/project",void 0,t)},keys:{get:t=>n("GET","/keys",void 0,t),rotate:t=>n("POST","/keys/rotate",void 0,t)},instances:{list:(t={},r)=>n("GET",`/instances${sn(t)}`,void 0,r),create:(t,r)=>(on(t.instance_key,"instances.create"),n("POST","/instances",t,r)),get:(t,r)=>(on(t,"instances.get"),n("GET",x("/instances",t),void 0,r)),update:(t,r,o)=>(on(t,"instances.update"),n("PATCH",x("/instances",t),r,o)),delete:(t,r)=>(on(t,"instances.delete"),n("DELETE",x("/instances",t),void 0,r))},integrations:{catalog:(t={},r)=>n("GET",`/integrations/catalog${sn(t)}`,void 0,r)},mcp:{links:{list:(t={},r)=>n("GET",`/mcp/links${sn(t)}`,void 0,r),mint:(t,r)=>n("POST","/mcp/links",t,r),get:(t,r)=>n("GET",x("/mcp/links",t),void 0,r),update:(t,r,o)=>n("PATCH",x("/mcp/links",t),r,o),delete:(t,r)=>n("DELETE",x("/mcp/links",t),void 0,r),rotate:(t,r)=>n("POST",`${x("/mcp/links",t)}/rotate`,void 0,r)},tokens:{mint:(t,r)=>n("POST","/mcp/tokens",t,r)}}}}var lc="default",dp="corsairCloud: the management API needs a ck_cloud_<slug>.<secret> key, or an explicit `managementUrl`.",pp=new Set(["then","catch","finally","toString","toJSON","valueOf","constructor","inspect",Symbol.toPrimitive,Symbol.toStringTag,Symbol.iterator,Symbol.asyncIterator]);function Pi(e={}){return new Proxy(e,{get(n,t,r){if(Reflect.has(n,t))return Reflect.get(n,t,r);if(!pp.has(t))throw new Error(dp)}})}function Ie(e){throw new Error(`"${e}" is not available in cloud mode (deferred)`)}function gp(e){let n=e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim();if(!n)throw new Error("Cloud mode (ck_cloud_ key) requires a base URL \u2014 set hub.baseUrl or CORSAIR_CLOUD_URL.");return $n(n),n}function dc(e){return!!(e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim())}function fp(e,n){let t=xr(e);return{ok:()=>Ie("manage.ok"),tenants:t.tenants,plugins:{list:()=>Ie("manage.plugins.list"),get:()=>Ie("manage.plugins.get")},connectionStatus:{get:r=>{let o=r?.tenantId||void 0;if(!o&&n)throw new Error("connectionStatus.get requires a tenantId in multi-tenant mode");return t.connectionStatus.get({tenantId:o??lc})}},permissions:t.permissions,connect:{createLink:t.connect.createLink,resolve:()=>Ie("manage.connect.resolve"),oauthCallback:()=>Ie("manage.connect.oauthCallback")},disconnect:t.disconnect}}function yp(e,n){let t=fp(e,n.multiTenancy);if(n.multiTenancy)return{withTenant:a=>{if(!a)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return Ar(n.plugins,{transport:e,tenantId:a})},get keys(){return Ie("keys")},get permissions(){return Ie("permissions")},manage:t};let r=Ar(n.plugins,{transport:e,tenantId:lc}),o={manage:t,get keys(){return Ie("keys")},get permissions(){return Ie("permissions")}};return new Proxy(r,{get(a,s,c){return typeof s=="string"&&s in o?Reflect.get(o,s,c):Reflect.get(a,s,c)}})}function pc(e){return yp({baseUrl:gp(e.hub),apiKey:e.hub.projectApiKey},{multiTenancy:!!e.multiTenancy,plugins:e.plugins})}function mp(e){let n=Rr(e),t="/api/corsair";return n.endsWith(t)?n.slice(0,-t.length):n}async function hp(e){let n=await J({...e,baseUrl:mp(e.baseUrl)},"GET",z.instances),t=new Map;for(let r of n.instances)$n(r.url,`Instance "${r.instanceKey}" URL`),t.set(r.instanceKey,r.url);return t}function bp(e){let n=e.apiKey?.trim();if(!n)throw new Error("corsairCloud: apiKey is required");let t=$i(n),r=e.url?.trim()||Wi(n);if(!r)throw new Error("corsairCloud: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");$n(r);let o={baseUrl:r,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs},a=(Rr(e.managementUrl?.trim()??"")||void 0)??(t?ji(r,t):null);a&&$n(a,"Management base URL");let s=a?{baseUrl:a,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs,apiVersion:e.apiVersion}:null,c=null;function l(g){return g&&c===g&&(c=null),c||(c=hp(o).catch(f=>{throw c=null,f})),c}async function u(g){let f=l(),b=(await f).get(g)??(await l(f)).get(g);if(b)return b;let k=[...(await l()).keys()].join(", ");throw new Error(`corsairCloud.withInstance("${g}"): no such instance \u2014 available: ${k||"(none)"}`)}let d=xr(o),p={tenants:d.tenants,permissions:d.permissions};return{manage:s?{...Ci(s),...p}:Pi(p),withInstance:g=>{let f=s?wi(s,g):Pi(),h=async()=>({...o,baseUrl:await u(g)}),b=xr(h),k={withTenant(T){if(!T)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return Ar(void 0,{transport:h,tenantId:T})},connectionStatus:b.connectionStatus,disconnect:b.disconnect,createConnectLink:b.connect.createLink};return s?{...f,...k}:Pi(k)}}}var kp="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function gc(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${kp}`),t):n}var wp=e=>new w(404,"unknown_plugin",`Plugin '${e}' is not registered.`),Cp=(e,n)=>new w(404,"unknown_op",`Operation '${n}' not found on plugin '${e}'.`),Sr=(e="/call")=>new w(403,"call_disabled",`The ${e} route is disabled. Construct managementHandler with { unsafeAllowUnauthenticated: true } to enable it \u2014 only when your own backend fronts the handler.`),Pp=e=>new w(401,"not_connected",`Tenant is not connected for plugin '${e}'. Reconnect and retry.`),fc=e=>new w(403,"permission_denied",`The call was blocked (${e}).`,{reason:e}),Tp=()=>new w(403,"approval_required","This action needs human approval before it can run. Approval is not resumable over HTTP in this version.",{reason:"pending"}),vp=(e,n)=>new w(502,"provider_error","The provider returned an error.",{providerStatus:e,body:n});function Rp(e,n){if(e instanceof w)return e;if(e instanceof E)return Pp(e.pluginId||n);if(e instanceof Rn)return fc("readonly");if(e instanceof pe)return e.reason==="pending"?Tp():fc(e.reason);if(e instanceof Error&&e.name==="ApiError"){let t=e;return vp(typeof t.status=="number"?t.status:502,t.body)}return console.error("[corsair] unhandled error in call operation",e),new w(500,"internal_error","Internal error")}var Ap=new WeakMap,yc=new WeakMap,xp=512;function mc(e,n){let t=e.get(n);return t||(t=new Map,e.set(n,t)),t}function Ip(e,n,t){if(n.size<=xp)return;let r=yc.get(e);for(let o of n.keys())if(o!==t&&(r?.get(o)??0)===0){n.delete(o);return}}function Sp(e,n,t){if(!n.multiTenancy)return{client:e};let r=typeof t=="string"?t.trim():"";if(!r)throw $("tenant is required for a multi-tenant runtime",{missingFields:["tenant"]});let o=mc(Ap,e),i=o.get(r);if(i)return o.delete(r),o.set(r,i),{client:i,tenantId:r};let a=e.withTenant(r);return o.set(r,a),Ip(e,o,r),{client:a,tenantId:r}}function _p(e,n){let t=e;for(let r of n.split(".")){if(t==null||typeof t!="object"||!Object.prototype.hasOwnProperty.call(t,r))return null;t=t[r]}return typeof t=="function"?t:null}function hc(e,n=[]){let t=[];for(let[r,o]of Object.entries(e??{}))typeof o=="function"?t.push([...n,r].join(".")):o&&typeof o=="object"&&t.push(...hc(o,[...n,r]));return t}function bc(e){let n={};for(let t of e.plugins)n[t.id]=hc(t.endpoints??{});return n}async function Ti(e,n,t,r){if(!n.plugins.some(s=>s.id===t.plugin))throw wp(t.plugin);let{client:o,tenantId:i}=Sp(e,n,t.tenant),a=i?mc(yc,e):null;a&&i&&a.set(i,(a.get(i)??0)+1);try{return await r(o)}catch(s){throw Rp(s,t.plugin)}finally{if(a&&i){let s=(a.get(i)??1)-1;s<=0?a.delete(i):a.set(i,s)}}}async function kc(e,n,{plugin:t,op:r,tenant:o,args:i}){return Ti(e,n,{plugin:t,tenant:o},a=>{let s=a[t],c=_p(s?.api,r);if(!c)throw Cp(t,r);return c(i??{})})}function an(e,n){if(e===void 0)return n;if(e===null)throw new w(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function at(e){if(e!==void 0)throw new w(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var Pc=[{method:"GET",pattern:"/ok",public:!0,handler:async()=>_(200,Zt())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>(at(n),_(200,await In(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>(at(t),_(201,await zt(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(at(t),_(200,await Jt(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>_(200,await xn(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>_(200,await Gt(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>_(200,await Vt(e,an(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(at(t),_(200,await fo(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",public:!0,handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?_(200,await mo(e,t)):_(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=an(r,o.tenantId);return _(200,await Qt(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",public:!0,handler:async({corsair:e,internal:n,query:t})=>_(200,await Xt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",public:!0,handler:async({corsair:e,internal:n,body:t})=>_(200,await er(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=an(t,n.tenantId)??"default",o=e.database?await li(e.database,r,void 0,void 0,e.encryptDataAtRest?e.kek:void 0):null;return _(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=an(t,r?.tenantId)??"default";return e.database&&await qa(e.database,o,void 0,r?.plugin,e.encryptDataAtRest?e.kek:void 0,e.encryptDataAtRest),_(200,{ok:!0})}},{method:"POST",pattern:"/disconnect",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n??{},o=an(t,r.tenantId);return _(200,await Yt(e,{...r,tenantId:o}))}},{method:"GET",pattern:"/call",handler:async({internal:e,allowCall:n})=>{if(!n)throw Sr();return _(200,{plugins:bc(e)})}},{method:"POST",pattern:"/:tenant/:plugin/db/:entityType/:method",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw Sr("/db");at(i);let s=o??{};if(s.args!==void 0&&!Array.isArray(s.args))throw $("args must be an array");let c=an(i,r.tenant),l=rn(s.args??[]),u=await Ti(e,n,{plugin:r.plugin,tenant:c},d=>Cc(t,()=>gi(d,{plugin:r.plugin,entityType:r.entityType,method:r.method},l)));return _(200,{data:tn(u)})}},{method:"POST",pattern:"/:tenant/:plugin/call/:op",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw Sr();let s=o??{},c=an(i,r.tenant),l=await Cc(t,()=>kc(e,n,{plugin:r.plugin,op:r.op,tenant:c,args:s.args}));return _(200,{data:l})}}];(()=>{let e=new Set;for(let n of Pc){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function Ep(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let a=t[i],s=r[i];if(a.startsWith(":"))o[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return o}function Mp(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function Op(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await hr(e,n).catch(o=>{throw o instanceof w?o:new w(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new w(400,"invalid_json","Request body is not valid JSON")}}var Dp="/api/corsair",wc=new Set(["open","cautious","strict","readonly"]);function Cc(e,n){let t=e.headers.get("x-corsair-mode");if(t===null)return n();if(!wc.has(t))throw $(`Unknown permission mode "${t}" \u2014 expected one of ${[...wc].join(", ")}`);return jt(t,n)}function Z(e,n={}){let t=n.basePath??Dp,r=Qe(n.maxBodyBytes),o=Xe(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},a=R(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async s=>{try{let c=s.headers.get("content-length");if(c!==null&&Number(c)>r)throw Mn(r);let l=new URL(s.url),u=Mp(l.pathname,t),d=s.method.toUpperCase();if(d==="OPTIONS"||u==="/"||u==="")return await en(e,s,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return _(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(l.searchParams);for(let g of Pc){if(g.method!==d)continue;let f=Ep(g.pattern,u);if(!f)continue;if(!g.public&&n.authenticate&&!await n.authenticate(s))return _(401,{error:"unauthorized",message:"invalid or missing credentials"});let h=await Op(s,i),b=n.resolveTenant?await n.resolveTenant(s):void 0;return await g.handler({corsair:e,internal:a,req:s,params:f,query:p,body:h,scopedTenant:b,allowCall:(n.unsafeAllowUnauthenticated??!1)||!!n.authenticate})}throw Fe(`No route for ${d} ${u}`)}catch(c){if(n.onError){let u=await n.onError(c,s);if(u)return u}if(c instanceof w)return ge(c);let l=c instanceof Error?c.message:"Internal server error";return _(500,{error:"internal_error",message:l})}}}function Hp(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function Up(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function Bp(e,n,t){let r=[],o=0,i=e();try{let a=await mr(()=>i.next(),t);for(;a.done!==!0;){let s=Up(a.value);if(o+=s.byteLength,o>n)throw Mn(n);r.push(s),a=await mr(()=>i.next(),t)}return Buffer.concat(r)}catch(a){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw a}}var Tc=!1;function Fp(){Tc||(Tc=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function Lp(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=Qe(n.maxBodyBytes),o=Xe(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(Fp(),i=JSON.stringify(e.body));else{let s=e[Symbol.asyncIterator];if(typeof s!="function")return;let c=await Bp(s.bind(e),r,o);c.length>0&&(i=c)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw Mn(r);return typeof i=="string"?i:i}function X(e){e.resume?.()}async function Ne(e,n={}){let t=Hp(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,a=new Headers;for(let[l,u]of Object.entries(e.headers))if(u!=null&&!Np.has(l.toLowerCase()))if(Array.isArray(u))for(let d of u)a.append(l,d);else a.set(l,u);let s={method:(e.method??"GET").toUpperCase(),headers:a},c=await Lp(e,n);return c!==void 0&&(s.body=c,a.has("content-type")||a.set("content-type","application/json")),new Request(i,s)}async function ee(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var Np=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function vc(e,n){let t=Z(e,n);return async(r,o,i)=>{try{let a=await t(await Ne(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await ee(o,a)}catch(a){if(a instanceof w&&o.headersSent!==!0){await ee(o,ge(a)),X(r);return}X(r),i(a)}}}function $p(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function Wp(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=$p(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function Rc(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function Ac(e,n){let t=Z(e,n);return async(r,o)=>{Wp(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let a=await t(await Ne(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await ee(o.raw,a)}catch(a){if(a instanceof w&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await ee(o.raw,ge(a)),X(i);return}throw X(i),a}}}function xc(e,n){let t=Z(e,n);return r=>t(r.req.raw)}function Ic(e,n){let t=Z(e,n);return{GET:t,POST:t,OPTIONS:t}}function Sc(e,n){let t=Z(e,n);return async(r,o)=>{try{let i=await t(await Ne(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await ee(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),X(r);return}if(i instanceof w){await ee(o,ge(i)),X(r);return}console.error("[corsair] management handler failed:",i),await ee(o,_(500,{error:"internal_error"})),X(r)}}}function _r(e,n){let t=Z(e,n);return r=>t(r.request)}function _c(e,n){let t=_r(e,n);return{GET:t,POST:t,OPTIONS:t}}function Ec(e,n){let t=_r(e,n);return{loader:t,action:t}}function Mc(e,n){let t=_r(e,n);return{GET:t,POST:t,OPTIONS:t}}function Oc(e,n){let t=_r(e,n);return{GET:t,POST:t,OPTIONS:t}}function Dc(e,n){let t=Z(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await Ne(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await ee(r.node.res,i)}catch(i){if(i instanceof w&&r.node.res.headersSent!==!0){await ee(r.node.res,ge(i)),X(o);return}throw X(o),i}}}function Hc(e,n){return Z(e,n)}function Uc(e){let n={[ct]:e};return{ok:Zt,tenants:{list:()=>In(e),create:t=>zt(e,t),get:t=>Jt(e,t)},plugins:{list:()=>xn(e),get:t=>Gt(e,t)},connectionStatus:{get:t=>Vt(e,t?.tenantId)},permissions:{get:t=>Qs(e,t)},connect:{createLink:t=>Qt(n,e,t),resolve:t=>Xt(n,e,t),oauthCallback:t=>er(n,e,t)},disconnect:t=>Yt(e,t)}}async function Bc(e,n,t,r,o="pending",i){if(i==="")throw new Error("encryptDataAtRest requires kek");if(!e)return null;try{let a=dn(),s=new Date,c=i?wt(r,await jn(e.db,n,i)):r;return await e.db.insertInto("corsair_events").values({id:a,created_at:s,updated_at:s,account_id:n,event_type:t,payload:c,status:o}).execute(),a}catch(a){return console.warn("Failed to log event:",a),null}}async function jp(e,n,t,r="pending"){if(e.encryptDataAtRest&&!e.kek)throw new Error("encryptDataAtRest requires kek");try{let o=await e.$getAccountId();return Bc(e.database,o,n,t,r,e.encryptDataAtRest?e.kek:void 0)}catch(o){return console.warn("Failed to log event:",o),null}}import*as Lc from"https";import*as Er from"querystring";var qp=["expires_in","refresh_token_expires_in"];function Fc(e){let n={...e};for(let t of qp){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function Kp(e){try{return Fc(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=Er.parse(e);return!n.access_token&&!n.error?null:Fc({...n})}function Dt(e,n,t,r,o){let i=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,c)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};a||(l.client_id=n,l.client_secret=t);let u=Er.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(u).toString()};a&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=Lc.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){c(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=Kp(f);h?s(h):c(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>c(new Error(`Request failed: ${g.message}`))),p.write(u),p.end()})}async function Nc(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[a,s,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(On({accessToken:a,expiresAt:s,forceRefresh:n?.forceRefresh}))return{accessToken:a,expiresAt:Number(s),refreshed:!1};if(!c)throw new E(o,"oauth_2");let l=await S({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:c},parseResponse:pn}),u=await Dn(t,l,s);return{accessToken:l.access_token,expiresAt:u,refreshed:!0}}async function $c(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:a="form",extraParams:s}=e,c={grant_type:"refresh_token",refresh_token:t,...s},l={Accept:"application/json"};i==="basic"?l.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?l.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(c.client_id=o),c.client_secret=r),a==="json"?l["Content-Type"]="application/json":l["Content-Type"]="application/x-www-form-urlencoded";let u=await fetch(n,{method:"POST",headers:l,body:a==="json"?JSON.stringify(c):new URLSearchParams(c)});if(!u.ok)throw new Error(`OAuth token refresh failed (${u.status}): ${await u.text()}`);let d=JSON.parse(await u.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function Wc(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new E(n.plugin,"oauth_2");let l={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},u=g=>Ae(e.keys,r,async()=>(await Nc(l,{forceRefresh:g})).accessToken);e._refreshAuth=()=>u(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return On({accessToken:d,expiresAt:p})?d:u(!1)}let o=t.client_secret,i=t.client_id,a=l=>Ae(e.keys,r,async()=>{let[u,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!l&&On({accessToken:u,expiresAt:d}))return u;if(!p)throw new E(n.plugin,"oauth_2");let g=await $c({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await Dn(e.keys,g,d),g.access_token});e._refreshAuth=()=>a(!0);let[s,c]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return On({accessToken:s,expiresAt:c})?s:a(!1)}var jc="  ";function ue(e){let n=e;return n._def??n.def??{}}function le(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function ce(e){return e.innerType??e.schema??e.out??e.in}function Kc(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return ce(e)}}function Zc(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Or(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Hn(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function Gc(e,n){return e.description??n.description}function Gp(e){let n=e;for(;n;){let t=ue(n),r=Gc(n,t);if(r)return r;let o=le(t);if(Ii(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=Kc(t,o);continue}break}}function Ii(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function ne(e){let n=ue(e),t=le(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Hn(n)[0]??"unknown");case"ZodEnum":return Hn(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=ce(n);return r?ne(r):"unknown"}case"ZodNullable":{let r=ce(n);return`${r?ne(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=ce(n);return r?ne(r):"unknown"}case"ZodArray":{let r=Zc(n);if(!r)return"unknown[]";let o=ue(r),i=le(o)==="ZodUnion",a=ne(r);return`${i?`(${a})`:a}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Or(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([a,s])=>{let c=le(ue(s));return`${c==="ZodOptional"||c==="ZodNullable"?a+"?":a}: ${ne(s)}`}).join(", ")} }`}case"ZodUnion":return Hn(n).map(r=>ne(r)).join(" | ");case"ZodIntersection":return`${ne(n.left)} & ${ne(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=Kc(n,t);return r?ne(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function Se(e){let n=ue(e),t=le(n),r=Gc(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??Hn(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=Hn(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=ce(n),i=o?Se(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=ce(n),i=o?Se(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=ce(n);return o?{...Se(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=Zc(n);return{kind:"array",optional:!1,description:r,items:o?Se(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=Or(e,n),i={};for(let[a,s]of Object.entries(o))i[a]=Se(s);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=Hn(n);for(let i of o){let a=ue(i);if(le(a)==="ZodObject")return{...Se(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=ce(n);return o?{...Se(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function Nv(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),a=e.find(u=>u.id===o);if(!a)return null;let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=$e(a.endpointMeta,s),l=$e(a.endpointSchemas,s);return!c&&!l?null:{input:l?.input?Se(l.input):null,output:l?.output?Se(l.output):null,description:c?.description}}var Si=["equals","contains","startsWith","endsWith","in"],Jp=["equals","gt","gte","lt","lte","in"],zp=["equals"],Vp=["equals","before","after","between"];function Jc(e){let n=ue(e);switch(le(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=ce(n);return r?Jc(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function _i(e){let n=ue(e),t=le(n);if(Ii(t)){let i=ce(n);return i?_i(i):{}}if(t!=="ZodObject")return{};let r=Or(e,n),o={};for(let[i,a]of Object.entries(r)){let s=Jc(a);s==="string"?o[i]={type:"string",operators:Si}:s==="number"?o[i]={type:"number",operators:Jp}:s==="boolean"?o[i]={type:"boolean",operators:zp}:s==="date"&&(o[i]={type:"date",operators:Vp})}return o}function zc(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function Ri(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&Ri(o,i,t)}}function Ai(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function xi(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];Ai(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&xi(o,i,t)}}function Ei(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!o)return null;let[i,a]=o;if(r.length===0)return Ai(a)?[i]:null;if(a!==null&&typeof a=="object"&&!Ai(a)){let s=Ei(a,r);if(s!==null)return[i,...s]}return null}function Vc(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let a="    ".repeat(i+2);t.push(`${a}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let a="    ".repeat(i+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var Yp=new Set(Ct);function cn(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(s=>s.id===r);if(!i)return Yp.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:cn(e);if(t==="webhooks"){if(!i.webhooks)return[];let s=[];return xi(i.webhooks,[],s),s.map(c=>`${i.id}.webhooks.${c}`)}if(t==="db"){let s=i.schema?.entities;return s?Object.keys(s).map(c=>`${i.id}.db.${c}.search`):[]}if(!i.endpoints)return[];let a=[];return Ri(i.endpoints,[],a),a.map(s=>`${i.id}.api.${s}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let a=[];xi(i.webhooks,[],a),o[i.id]=a.map(s=>`${i.id}.webhooks.${s}`)}else if(t==="db")for(let i of e){let a=i.schema?.entities;a&&(o[i.id]=Object.keys(a).map(s=>`${i.id}.db.${s}.search`))}else for(let i of e){if(!i.endpoints)continue;let a=[];Ri(i.endpoints,[],a),o[i.id]=a.map(s=>`${i.id}.api.${s}`)}return o}function $e(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function Qp(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),a=i.startsWith(".")?i.slice(1):i;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function vi(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function $v(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),a=e.find(s=>s.id===o);if(a){if(i.startsWith("db.")){let u=i.slice(3),d=u.lastIndexOf(".");if(d!==-1){let p=u.slice(0,d),g=u.slice(d+1),f=a.schema?.entities;if(g==="search"&&f){let h=zc(f,p);if(h){let[b,k]=h,T=_i(k),A=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${Si.join(", ")}]`];for(let[F,O]of Object.entries(T))A.push(`  ${F}?: ${O.type}  [${O.operators.join(", ")}]`);return A.push("}"),A.join(`
+`)}}}return vi(cn(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let u=i.slice(9);if(a.webhooks){let d=Ei(a.webhooks,u.split("."));if(d!==null){let p=d.join("."),g=$e(a.webhookSchemas,p.toLowerCase()),f=g?.response?ne(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${Mr(Un(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${Vc(o,d)}`),h.join(`
+
+`)}}return vi(cn(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=i;s.startsWith("api.")&&(s=s.slice(4));let c=$e(a.endpointMeta,s),l=$e(a.endpointSchemas,s);if(c||l){let u=[],d=[c?.riskLevel?`[${c.riskLevel}]`:"",c?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[c?.description,d].filter(Boolean).join("  ");return p&&u.push(p),l?.input&&u.push(`input ${Mr(Un(l.input))}`),l?.output&&u.push(`output ${Mr(Un(l.output))}`),u.join(`
+
+`)}}}return vi(cn(e),"Path not found. Available operations")}function qc(e){let n=e;for(;;){let t=ue(n),r=le(t);if(Ii(r)){let o=ce(t);if(!o)return n;n=o;continue}return n}}function Un(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=qc(e),t=ue(n);if(le(t)==="ZodObject"){let o=Or(n,t),i=[];for(let[a,s]of Object.entries(o)){let c=ue(s),l=le(c),u=l==="ZodOptional"||l==="ZodNullable",d=qc(s),p=Gp(s);i.push({key:a,optional:u,type:ne(d),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:i}}return{kind:"inline",type:ne(n)}}function Mr(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=jc.repeat(n+1),r=jc.repeat(n);return`{
+${e.fields.map(i=>{let a=i.optional?`${i.key}?`:i.key,s=i.description?`  // ${i.description}`:"";return`${t}${a}: ${i.type}${s}`}).join(`
+`)}
+${r}}`}return"unknown"}function Xp(e,n){let t=cn(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(u=>u.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let u of t){let{shortPath:d,lookupKey:p}=Qp(u,n),g=$e(r.endpointMeta,p),f=$e(r.endpointSchemas,p);!g&&!f||o.push({path:u,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Un(f?.input),output:Un(f?.output)})}o.sort((u,d)=>u.path.localeCompare(d.path));let i=[],a=cn(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let u of a){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=Ei(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=$e(r.webhookSchemas,b.toLowerCase()),T=k?.response?ne(k.response):void 0;i.push({path:u,description:k?.description,payload:Un(k?.payload),responseType:T,usageExample:Vc(n,h)})}i.sort((u,d)=>u.path.localeCompare(d.path));let s=[],c=cn(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(c)&&l)for(let u of c){let p=u.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let T=zc(l,b);if(!T)continue;let[A,F]=T,O=_i(F),te=Object.entries(O).map(([P,C])=>({field:P,type:C.type,operators:C.operators}));s.push({path:u,entityName:A,filters:[{field:"entity_id",type:"string",operators:Si},...te]})}return s.sort((u,d)=>u.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:s}}}import{randomUUID as Yc}from"crypto";async function eg(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=Yc(),o=Yc(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as ng}from"crypto";var Dr="https://graph.microsoft.com/v1.0",Mi=2e4,tg=60;async function rg(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let c=await fetch(`${Dr}/subscriptions`,{headers:r,signal:AbortSignal.timeout(Mi)});if(c.ok){let{value:l}=await c.json(),u=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(u.map(d=>fetch(`${Dr}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(Mi)}).catch(()=>{})))}}catch{}let o=ng(),i=new Date(Date.now()+tg*6e4).toISOString(),a=await fetch(`${Dr}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(Mi),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!a.ok)throw new Error(`MS Graph subscribe failed (${a.status}): ${await a.text()}`);let s=await a.json();return s.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:s.id},webhookSecret:o}):null}function Qc(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function og(e,n){let t=Qc(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function ig(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function Xc(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function eu(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function ut(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function sg(e){return ut(e.body)}function nu(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Hr(Array.isArray(r)?r:[r])}function tu(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let c of t){let l=Hr(Array.isArray(c)?c:[c]);if(l)return decodeURIComponent(l)}let r=nu({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let c of o){let l=n[c],u=Array.isArray(l)?l[0]:l;if(!(!u||typeof u!="string"))try{let p=(u.startsWith("http")?new URL(u):new URL(`https://example.invalid${u.startsWith("/")?u:`/${u}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=ut(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Hr([a?.validationToken])??null}function ag(e){if(tu(e))return!0;let n=ut(e.body??e.payload);return Xc(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Hr(e){for(let n of e){let t=eu(n);if(t)return t}}function cg(e){let t=ut(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var ct=Symbol.for("corsair:internal");function su(e){if(e.hub?.projectApiKey?.startsWith("ck_cloud_")&&dc(e.hub))return pc(e);let n=e.database?Ki(e.database,{dbTables:e.dbTables}):void 0,t=e.kek??"",r=n&&t?cc(e.plugins,n,t):Pr(!!n,!!t),o=gc(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?It(e.hub):void 0,encryptDataAtRest:e.encryptDataAtRest===!0},a=Zs(n),s=Uc(i);if(e.multiTenancy){let u=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=hi(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[ct]:i})},keys:r,permissions:a,manage:s},{[ct]:i});return ru(u,i.hub),iu(u,i.hub),u}let c=hi(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},c,{keys:r,permissions:a,manage:s,[ct]:i});return ru(l,i.hub),iu(l,i.hub),l}function ru(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-CZCDRM4L.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function ug(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var ou=globalThis.__corsairTunnels??=new Set,lg=1e3,dg=3e4;function pg(e){let n=e.schedule??((a,s)=>void setTimeout(a,s).unref?.()),t=e.minDelayMs??lg,r=e.maxDelayMs??dg,o=t,i=()=>{let a=!1,s=()=>{a||(a=!0,n(i,o),o=Math.min(o*2,r))};e.start(s).then(()=>{o=t}).catch(s)};i()}function iu(e,n){if(!ug(n))return;let t=n.projectApiKey;if(ou.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}ou.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??Lr;pg({start:a=>import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:a})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Nr}`)}).catch(s=>{throw console.warn(`[corsair] tunnel down: ${s instanceof Error?s.message:String(s)}. Retrying \u2014 run \`corsair setup\` if it doesn't recover.`),s})})}var gg={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Oi=gg;async function Ht(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},a=n?.caller??"script",s=Gi(e);if(!s)throw new Error("setupCorsair: invalid corsair instance");if(!s.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let c=Rg(e,s.plugins,n),l={...s,database:s.database},u=l.database.db;await Ig(l.database,i);let d=await Sg(u,l,c.tenantId,c.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Mg(e,c,n.credentials,l,o,i);let p=await Dg(d,c,o,a);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=su({plugins:s.plugins,database:u,kek:s.kek,multiTenancy:!0,...s.encryptDataAtRest?{encryptDataAtRest:!0}:{}}).withTenant(c.tenantId);await Hg(g,s.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function Di(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...G[n][t],...r])}function vg(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(s=>s.id===t);if(!o)continue;let i=M(o);if(!i)continue;let a=Di(o,i,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function Rg(e,n,t){let r=Ji(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&vg(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function cu(e,n){return Me(e)?n===0?!0:Object.values(e).every(t=>cu(t,n-1)):!1}function Ag(e){return cu(e,4)}var xg=es;function Ur(e){if(e instanceof kg){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Tg?Ur(r):"unknown";return n}return e instanceof hg?`${Ur(e.unwrap())} | null`:e instanceof wg?`${Ur(e.unwrap())} | undefined`:e instanceof mg?e.options.join(" | "):e instanceof Pg?"string":e instanceof bg?"number":e instanceof fg?"boolean":e instanceof yg?"date":e instanceof Cg?"jsonb":"unknown"}async function Ig(e,n){let t=await e.db.introspection.getTables(),r=new Set(t.map(i=>i.name)),o=e.tableNames??qi();for(let[i,a]of Object.entries(xg)){let s=o[i];if(!r.has(s)){let c=s!==i?` (dbTables.${i} \u2192 "${s}")`:"";n(`[corsair:setup] Table "${s}" does not exist${c}. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(Ur(a),null,2)}`)}}}async function Sg(e,n,t,r,o){let i=new Date,a=new Map;for(let s of n.plugins){let c=s.id,l=M(s),u=await e.selectFrom("corsair_integrations").selectAll().where("name","=",c).executeTakeFirst();if(!u){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:c,config:{},created_at:i,updated_at:i}).execute(),u=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${c}`)}let d=l?s.authConfig?.[l]?.integration??[]:[],p=l?s.authConfig?.[l]?.account??[]:[],g=l&&u?q({authType:l,integrationName:c,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(u&&!u.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${c}`)),!u||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",u.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:u.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${c}`)}f=h&&N({authType:l,integrationName:c,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${c}`))}a.set(c,{pluginId:c,authType:l,integration:g,account:f,integrationFields:[...G[l].integration,...d],accountFields:r?[...G[l].account,...p]:[]})}return a}function _g(e){if(!Me(e))return;let n=e.keys;return Me(n)?n:void 0}function Eg(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Mg(e,n,t,r,o,i){let a=_g(e),s=n.provisionAccounts?Eg(e,n.tenantId):void 0;for(let[c,l]of Object.entries(t)){let u=r.plugins.find(k=>k.id===c);if(!u){i(`[corsair:setup] Unknown plugin '${c}' \u2014 skipping credentials.`);continue}let d=M(u);if(!d){i(`[corsair:setup] Plugin '${c}' has no auth type \u2014 skipping credentials.`);continue}let p=Di(u,d,"integration"),g=Di(u,d,"account"),f=a?.[c],h=s?.[c],b=Me(h)?h.keys:void 0;for(let[k,T]of Object.entries(l))if(T){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${c}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let A=ie(f,`set_${k}`);if(!A){i(`[corsair:setup] Cannot set integration field '${k}' for '${c}'.`);continue}await A(T),o(`[corsair:setup] Set ${c} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${c}.${k}' on a multi-tenant instance`);let A=ie(b,`set_${k}`);if(!A){i(`[corsair:setup] Cannot set account field '${k}' for '${c}'.`);continue}await A(T),o(`[corsair:setup] Set ${c} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${c}'.`)}}}var au=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function Og(e,n,t,r,o,i,a,s,c){let l=[],u=[];for(let p of o){if(au.has(p))continue;let g=ie(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(au.has(p))continue;let g=ie(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||u.push(p)}let d=l.length===0&&u.length===0;if(n==="managed_pricing")s(`[corsair:setup] '${e}' (managed_pricing) uses Corsair metered credentials via Hub \u2014 nothing to store in your database. Pass hub: { ... } to createCorsair().`);else if(d)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...u];if(c==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of u){let h=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}s(g.join(`
+`))}}return d}async function Dg(e,n,t,r){let o=new Set;for(let i of e.values())await Og(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function Hg(e,n,t,r,o){if(!Ag(Oi)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=Oi,a=new Set(n.map(s=>s.id));for(let[s,c]of Object.entries(i)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let l=Me(e)?e[s]:void 0,u=Me(l)?l.api:void 0;if(u)for(let[d,p]of Object.entries(c))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${d}.${g}...`);try{let h=Me(u)?u[d]:void 0;await ie(h,g)?.(f)}catch(h){o(`[corsair:setup] ${s} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{ns as a,Oe as b,Ce as c,Pt as d,Tt as e,vt as f,pn as g,ts as h,$r as i,Jr as j,qn as k,ps as l,gs as m,De as n,Ke as o,Pe as p,fn as q,yn as r,He as s,Vr as t,ys as u,Gn as v,Te as w,Jn as x,Yr as y,It as z,j as A,St as B,mn as C,q as D,N as E,bs as F,ks as G,Ht as H,Mg as I,Be as J,Xr as K,kn as L,Cn as M,no as N,Ot as O,Ss as P,Je as Q,Q as R,to as S,Yn as T,Os as U,zu as V,Ut as W,Vy as X,Us as Y,Bs as Z,Fs as _,Ls as $,Bt as aa,ro as ba,pe as ca,Lt as da,Nt as ea,Rn as fa,jt as ga,An as ha,lo as ia,qs as ja,qt as ka,ze as la,w as ma,bo as na,ko as oa,nr as pa,wo as qa,Sn as ra,_n as sa,tr as ta,rr as ua,Qn as va,Co as wa,Po as xa,or as ya,Xn as za,ir as Aa,sr as Ba,Le as Ca,En as Da,oa as Ea,xo as Fa,Io as Ga,Ye as Ha,tt as Ia,rt as Ja,gr as Ka,Eo as La,ot as Ma,nd as Na,sd as Oa,ud as Pa,fa as Qa,ya as Ra,yr as Sa,ma as Ta,ha as Ua,Qe as Va,Xe as Wa,Uo as Xa,Bo as Ya,Fo as Za,Lo as _a,No as $a,en as ab,E as bb,$o as cb,Ta as db,kr as eb,jo as fb,wr as gb,va as hb,_a as ib,Zo as jb,Go as kb,Jo as lb,zo as mb,Vo as nb,Yo as ob,Qo as pb,Xo as qb,ei as rb,ni as sb,ti as tb,ri as ub,oi as vb,ii as wb,si as xb,nn as yb,me as zb,tn as Ab,rn as Bb,gi as Cb,xe as Db,bp as Eb,Z as Fb,vc as Gb,Rc as Hb,Ac as Ib,xc as Jb,Ic as Kb,Sc as Lb,_c as Mb,Ec as Nb,Mc as Ob,Oc as Pb,Dc as Qb,Hc as Rb,Bc as Sb,jp as Tb,Dt as Ub,Wc as Vb,Nv as Wb,cn as Xb,$v as Yb,Mr as Zb,Xp as _b,eg as $b,Dr as ac,rg as bc,Qc as cc,og as dc,ig as ec,Xc as fc,eu as gc,ut as hc,sg as ic,nu as jc,tu as kc,ag as lc,Hr as mc,cg as nc,ct as oc,su as pc,ug as qc,pg as rc};

package/dist/{connect-SS7I4OQB.js → connect-S4ZCYX2K.js}

@@ -1 +1 @@
-import{$ as b,_ as a,aa as c}from"./chunk-FN2XOWUK.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};
+import{$ as b,_ as a,aa as c}from"./chunk-INOGY5FC.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{c as createHubConnectSession,b as createHubConnectSessionForPlugin,a as postHubConnectSession};

package/dist/core.js

@@ -1 +1 @@
-import{$b as O,Ab as D,Bb as E,Cb as F,D as m,Db as G,E as n,Eb as H,F as o,G as p,Sb as I,Tb as J,Ub as K,Vb as L,Zb as M,_b as N,a,ac as P,b,ba as q,bb as A,bc as Q,c,ca as r,cc as R,dc as S,ec as T,fa as s,fc as U,ga as t,gc as V,ha as u,hc as W,ia as v,ic as X,ja as w,jc as Y,ka as x,kc as Z,la as y,lc as _,ma as z,mc as $,nc as aa,oc as ba,pc as ca,qc as da,rc as ea,yb as B,zb as C}from"./chunk-FN2XOWUK.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import{h as d,n as e,o as f,p as g,q as h,r as i,s as j,t as k,u as l}from"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{A as AuthMissingError,d as BASE_AUTH_FIELDS,ba as CORSAIR_INTERNAL,G as CloudApiError,B as CorsairKekMissingError,C as DB_METHOD_RISK,P as MS_GRAPH_API_BASE,z as ManagementApiError,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,u as activeMode,W as asRecord,y as assertModeAllows,x as assertReadonlyAllowed,F as callPluginDb,T as collectPluginWebhookMatchers,H as corsairCloud,n as createAccountKeyManager,ca as createCorsair,m as createIntegrationKeyManager,E as decodeDbArgs,aa as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,D as encodeDbArgs,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,K as exchangeCodeForTokens,Z as extractMicrosoftGraphValidationToken,$ as firstString,M as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,U as getHeader,L as getOAuthAccessToken,O as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,N as introspectPluginForDocs,_ as isMicrosoftGraphValidationHandshake,w as isReadonlyScopeActive,I as logEvent,J as logEventFromContext,R as matchWebhookPlugin,S as matchWebhookPluginAndTenant,Q as msGraphSubscribe,l as reEncryptConfig,X as readBodyRecord,Y as readQueryParam,q as resolveConnectLink,v as runReadonly,t as runWithMode,da as shouldStartTunnel,ea as superviseTunnel,V as toExternalId};
+import{$b as O,Ab as D,Bb as E,Cb as F,D as m,Db as G,E as n,Eb as H,F as o,G as p,Sb as I,Tb as J,Ub as K,Vb as L,Zb as M,_b as N,a,ac as P,b,ba as q,bb as A,bc as Q,c,ca as r,cc as R,dc as S,ec as T,fa as s,fc as U,ga as t,gc as V,ha as u,hc as W,ia as v,ic as X,ja as w,jc as Y,ka as x,kc as Z,la as y,lc as _,ma as z,mc as $,nc as aa,oc as ba,pc as ca,qc as da,rc as ea,yb as B,zb as C}from"./chunk-INOGY5FC.js";import"./chunk-6IURNA4L.js";import"./chunk-XCTHEKDP.js";import{h as d,n as e,o as f,p as g,q as h,r as i,s as j,t as k,u as l}from"./chunk-WUEWJTDA.js";import"./chunk-XPXWKPFZ.js";import"./chunk-Z2KT4F2U.js";import"./chunk-SOY77BN4.js";export{A as AuthMissingError,d as BASE_AUTH_FIELDS,ba as CORSAIR_INTERNAL,G as CloudApiError,B as CorsairKekMissingError,C as DB_METHOD_RISK,P as MS_GRAPH_API_BASE,z as ManagementApiError,r as PermissionRequiredError,a as ProviderDisplayNames,s as ReadonlyForbiddenError,c as ReconnectRequiredError,u as activeMode,W as asRecord,y as assertModeAllows,x as assertReadonlyAllowed,F as callPluginDb,T as collectPluginWebhookMatchers,H as corsairCloud,n as createAccountKeyManager,ca as createCorsair,m as createIntegrationKeyManager,E as decodeDbArgs,aa as decodePubSubData,k as decryptConfig,g as decryptDEK,i as decryptWithDEK,D as encodeDbArgs,j as encryptConfig,f as encryptDEK,h as encryptWithDEK,K as exchangeCodeForTokens,Z as extractMicrosoftGraphValidationToken,$ as firstString,M as formatDocSchemaShape,b as formatProviderDisplayName,e as generateDEK,U as getHeader,L as getOAuthAccessToken,O as googleChannelSubscribe,p as initializeAccountDEK,o as initializeIntegrationDEK,N as introspectPluginForDocs,_ as isMicrosoftGraphValidationHandshake,w as isReadonlyScopeActive,I as logEvent,J as logEventFromContext,R as matchWebhookPlugin,S as matchWebhookPluginAndTenant,Q as msGraphSubscribe,l as reEncryptConfig,X as readBodyRecord,Y as readQueryParam,q as resolveConnectLink,v as runReadonly,t as runWithMode,da as shouldStartTunnel,ea as superviseTunnel,V as toExternalId};