corsair 0.1.157 → 0.1.159

package/dist/{browser-delivery-Dn04Z-ah.d.ts → browser-delivery-CwcDrwrc.d.ts}

@@ -1,4 +1,4 @@
-import { B as BrowserDeliveryPayload } from './index-C9BKDXFA.js';
+import { B as BrowserDeliveryPayload } from './index-COtLo-VI.js';
 
 /**
  * Browser (client) delivery — hub redirects the user's browser to the app with `?d=<token>`.

package/dist/chunk-6BGHJVGN.js

@@ -0,0 +1,68 @@
+import{a as Ee,b as $r,c as Wr}from"./chunk-6IURNA4L.js";import{a as ji,b as Ki,c as Zi,d as $n}from"./chunk-XCTHEKDP.js";import{A as pn,B as Nr,C as rs,a as Ji,b as Me,c as Vi,d as R,e as Q,f as Yi,g as se,h as z,i as M,j as Qi,k as ht,l as Xi,m as bt,n as be,o as ke,p as ae,r as kt,s as Ke,t as we,u as Wn,v as es,w as wt,x as ns,y as qn,z as ts}from"./chunk-XFXMLS67.js";import{b as Gi,c as zi}from"./chunk-XPXWKPFZ.js";import{ZodBoolean as Sg,ZodDate as _g,ZodEnum as Eg,ZodNullable as Mg,ZodNumber as Og,ZodObject as Dg,ZodOptional as Hg,ZodRecord as Ug,ZodString as Fg,ZodType as Bg}from"zod";var Ct=["ably","abstract","abuseipdb","abyssale","accrediblecertificates","activecampaign","activetrail","addresszen","aeroleads","affinda","agencyzoom","agentmail","agentql","agenty","agiled","agilitycms","ahrefs","aimlapi","airtable","aivoov","akta","alchemy","algolia","alibaba","allimagesai","alphavantage","altoviz","alttextai","amara","ambee","ambientweather","amcards","amplitude","anchorbrowser","anonyflow","anthropicadministrator","anyapi","apaleo","api2pdf","apibible","apify","apilabz","apininjas","apipie","apisports","apollo","appointo","aryn","asana","ascora","ashby","asindataapi","asticaai","asyncinterview","attio","autom","ayrshare","backendless","bannerbear","bart","basecamp","baselinker","basin","beaconstac","beamer","beeminder","benchmarkemail","benzinga","bestbuy","bettercontact","betterproposals","betterstack","bigdatacloud","bigmailer","bigml","bigpictureio","bitbucket","bitwarden","blackbaud","blazemeter","blocknative","bluesky","boldsign","boloforms","boltiot","bonsai","bookingmood","booqable","borneo","botbaba","botpress","botsonic","bouncer","box","boxhero","brandfetch","breathehr","brevo","brex","brightdata","browseai","browserless","browsertool","browseruse","bubble","bugsnag","buildkite","builtwith","bunnycdn","bytedance","byteforms","cal","calendly","callingly","callpage","campaigncleaner","campayn","canny","canva","canvas","capsulecrm","carbone","castingwords","cdrplatform","celigo","certifier","chaser","chatbotkit","chatfai","chatwork","chmeetings","cincopa","circleci","claidai","classmarker","clay","clickhouse","clickmeeting","clicksend","clickup","clientary","clockify","cloro","close","cloudcart","cloudflare","cloudflareapikey","cloudinary","coassemble","coda","codacy","codeinterpreter","codereadr","cody","coinbase","coinmarketcal","coinmarketcap","collegefootballdata","composio","confluence","connecteam","contactout","contentfulgraphql","contextdev","contextsevenmcp","convex","convoloai","cosmic","countdownapi","crowterminal","currentsapi","cursor","customerio","customgpt","cuttly","dadataru","daffy","databricks","datadog","dataforseo","datarobot","deepseek","desktime","devinmcp","diffbot","digitalocean","discord","dnsfilter","dockerhub","docmosis","docsumo","docupost","docusign","dodopayments","doppler","dovetail","dreamstudio","dripcel","dropbox","dropboxsign","dynapictures","elevenlabs","emailoctopus","emelia","enginemailer","enigma","epicgames","esignatures","esputnik","eventzilla","everhour","exa","excel","exist","extractaai","facebook","fal","faraday","figma","filevine","filloutforms","finerworks","firecrawl","fireflies","fixer","flexisign","flutterwave","followupboss","formbricks","foursquare","fundable","gemini","giphy","github","gitlab","gladia","gmail","gmicloud","googleaddressvalidation","googleanalytics","googlebigquery","googlecalendar","googlecloudvision","googledocs","googledrive","googlemaps","googlemeet","googlesheets","grafana","griptape","groqcloud","gumroad","habitica","hackernews","harvest","hashnode","here","heygen","higgsfield","hookdeck","htmltoimage","hubspot","huggingface","humanitix","hunterio","imagior","imejisio","imgbb","inboxkit","insightoai","instagram","instantly","intercom","jigsawstack","jira","kaggle","keenable","kibana","kling","leexi","lever","linear","linkedin","litescrape","loyverse","magichour","mailboxlayer","mailcheck","mailchimp","mailtrap","marketstack","mem0","merriamwebsterdict","minimax","monday","mrscraper","neon","netsuite","nextdns","northflank","notion","ocrspace","ocrwebservice","octen","ollama","onedrive","onepassword","openai","openrouter","opensea","openweathermap","orbit","oura","outlook","pagerduty","parseur","pdfco","pdfmonkey","pdl","perplexityai","phantombuster","pinecone","plain","ploid","posthog","postman","prisma","pushbullet","qdrant","razorpay","recallai","reddit","reducto","remoet","removebg","render","replicate","replicate","replyio","resend","retailed","retellai","revai","rootly","runpod","salesflare","salesforce","saperly","sapsuccessfactors","scaleai","scrapegraphai","search1api","securitytrails","semanticscholar","sendgrid","sentry","serpapi","servicenow","sharepoint","slack","slackbot","snapchat","snowflake","sourcegraph","spoki","spotify","starton","strava","streamtime","stripe","studiobyai21labs","supabase","supadata","surf","suzanne","synthflowai","tally","tavily","tavilymcp","teams","telegram","textrazor","ticketmaster","ticktick","tikhub","timecamp","timelink","timely","tinyfish","tinypng","tinyurl","tisane","todoist","toggl","tokenmetrics","tpscheck","trello","tripadvisor","turbotpipes","turso","twentyonerisk","twilio","twitter","twitterapiio","twochat","typeform","typesafe","unione","unipile","uniswapapi","updownio","uploadcare","vapi","vaquill","vercel","veriphone","vestaboard","waboxapp","wakatime","webflow","webscrapingai","webvizio","whatsapp","whautomate","whoisfreaks","winstonai","witai","wix","wiza","woodpeckerco","workable","workday","workiom","worldnewsapi","writer","xero","xquik","youcom","youtube","zendesk","zenserp","zohobigin","zohodesk","zohoinventory","zohomail","zoom","zoominfo"],os={ably:"Ably",abstract:"Abstract",abuseipdb:"AbuseIPDB",abyssale:"Abyssale",accrediblecertificates:"Accredible Certificates",activecampaign:"ActiveCampaign",activetrail:"Active Trail",addresszen:"Addresszen",aeroleads:"Aeroleads",affinda:"Affinda",agencyzoom:"AgencyZoom",agentmail:"AgentMail",agentql:"AgentQL",agenty:"Agenty",agiled:"Agiled",agilitycms:"Agility CMS",ahrefs:"Ahrefs",aimlapi:"AI/ML API",airtable:"Airtable",aivoov:"AiVOOV",akta:"Akta",alchemy:"Alchemy",algolia:"Algolia",alibaba:"Alibaba Cloud Model Studio",allimagesai:"All Images AI",alphavantage:"Alpha Vantage",altoviz:"Altoviz",alttextai:"AltText.ai",amara:"Amara",ambee:"Ambee",ambientweather:"Ambient Weather",amcards:"AMcards",amplitude:"Amplitude",anchorbrowser:"Anchor Browser",anonyflow:"Anonyflow",anthropicadministrator:"Anthropic Administrator",anyapi:"AnyAPI",apaleo:"Apaleo",api2pdf:"API2PDF",apibible:"API.Bible",apify:"Apify",apilabz:"API Labz",apininjas:"API Ninjas",apipie:"APIpie AI",apisports:"API-Sports",apollo:"Apollo",appointo:"Appointo",aryn:"Aryn",asana:"Asana",ascora:"Ascora",ashby:"Ashby",asindataapi:"ASIN Data API",asticaai:"Astica AI",asyncinterview:"Async Interview",attio:"Attio",autom:"Autom",ayrshare:"Ayrshare",backendless:"Backendless",bannerbear:"Bannerbear",bart:"BART",basecamp:"Basecamp",baselinker:"BaseLinker",basin:"Basin",beaconstac:"Beaconstac",beamer:"Beamer",beeminder:"Beeminder",benchmarkemail:"BenchmarkEmail",benzinga:"Benzinga",bestbuy:"Best Buy",bettercontact:"BetterContact",betterproposals:"Better Proposals",betterstack:"Better Stack",bigdatacloud:"BigDataCloud",bigmailer:"BigMailer",bigml:"BigML",bigpictureio:"BigPicture.io",bitbucket:"Bitbucket",bitwarden:"Bitwarden",blackbaud:"Blackbaud",blazemeter:"BlazeMeter",blocknative:"Blocknative",bluesky:"Bluesky",boldsign:"Boldsign",boloforms:"Boloforms",boltiot:"Bolt IoT",bonsai:"Bonsai",bookingmood:"Bookingmood",booqable:"Booqable",borneo:"Borneo",botbaba:"Botbaba",botpress:"Botpress",botsonic:"Botsonic",bouncer:"Bouncer",box:"Box",boxhero:"BoxHero",brandfetch:"Brandfetch",breathehr:"Breathe HR",brevo:"Brevo",brex:"Brex",brightdata:"Bright Data",browseai:"Browse AI",browserless:"Browserless",browsertool:"Browser Tool",browseruse:"Browser Use",bubble:"Bubble",bugsnag:"BugSnag",buildkite:"Buildkite",builtwith:"BuiltWith",bunnycdn:"Bunnycdn",bytedance:"ByteDance",byteforms:"ByteForms",cal:"Cal",calendly:"Calendly",callingly:"Callingly",callpage:"CallPage",campaigncleaner:"Campaign Cleaner",campayn:"Campayn",canny:"Canny",canva:"Canva",canvas:"Canvas LMS",capsulecrm:"Capsule CRM",carbone:"Carbone",castingwords:"CastingWords",cdrplatform:"CDR Platform",celigo:"Celigo",certifier:"Certifier",chaser:"Chaser",chatbotkit:"ChatBotKit",chatfai:"ChatFAI",chatwork:"Chatwork",chmeetings:"ChMeetings",cincopa:"Cincopa",circleci:"CircleCI",claidai:"Claid.ai",classmarker:"ClassMarker",clay:"Clay",clickhouse:"Clickhouse",clickmeeting:"ClickMeeting",clicksend:"ClickSend",clickup:"ClickUp",clientary:"Clientary",clockify:"Clockify",cloro:"cloro",close:"Close",cloudcart:"CloudCart",cloudflare:"Cloudflare",cloudflareapikey:"Cloudflare API Key",cloudinary:"Cloudinary",coassemble:"Coassemble",coda:"Coda",codacy:"Codacy",codeinterpreter:"CodeInterpreter",codereadr:"CodeREADr",cody:"Cody",coinbase:"Coinbase",coinmarketcal:"Coinmarketcal",coinmarketcap:"CoinMarketCap",collegefootballdata:"College Football Data",composio:"Composio",confluence:"Confluence",connecteam:"Connecteam",contactout:"ContactOut",contentfulgraphql:"Contentful GraphQL",contextdev:"Context.dev",contextsevenmcp:"Context7",convex:"Convex",convoloai:"ConvoloAi",cosmic:"Cosmic",countdownapi:"Countdown API",crowterminal:"CrowTerminal",currentsapi:"CurrentsApi",cursor:"Cursor",customerio:"Customer.io",customgpt:"CustomGPT",cuttly:"Cutt.ly",dadataru:"Dadataru",daffy:"Daffy",databricks:"Databricks",datadog:"Datadog",dataforseo:"DataForSEO",datarobot:"DataRobot",deepseek:"DeepSeek",desktime:"DeskTime",devinmcp:"Devin MCP",diffbot:"Diffbot",digitalocean:"DigitalOcean",discord:"Discord",dnsfilter:"DNSFilter",dockerhub:"Docker Hub",docmosis:"Docmosis",docsumo:"Docsumo",docupost:"Docupost",docusign:"DocuSign",dodopayments:"Dodo Payments",doppler:"Doppler",dovetail:"Dovetail",dreamstudio:"DreamStudio",dripcel:"Dripcel",dropbox:"Dropbox",dropboxsign:"Dropbox Sign",dynapictures:"Dynapictures",elevenlabs:"ElevenLabs",emailoctopus:"EmailOctopus",emelia:"Emelia",enginemailer:"Enginemailer",enigma:"Enigma",epicgames:"Epic Games",esignatures:"eSignatures",esputnik:"eSputnik",eventzilla:"Eventzilla",everhour:"Everhour",exa:"Exa",excel:"Excel",exist:"Exist",extractaai:"Extracta.ai",facebook:"Facebook",fal:"fal",faraday:"Faraday",figma:"Figma",filevine:"Filevine",filloutforms:"FilloutForms",finerworks:"FinerWorks",firecrawl:"Firecrawl",fireflies:"Fireflies",fixer:"Fixer",flexisign:"Flexisign",flutterwave:"Flutterwave",followupboss:"Follow Up Boss",formbricks:"Formbricks",foursquare:"Foursquare",fundable:"Fundable",gemini:"Gemini",giphy:"Giphy",github:"GitHub",gitlab:"GitLab",gladia:"Gladia",gmail:"Gmail",gmicloud:"GMI Cloud",googleaddressvalidation:"Google Address Validation",googleanalytics:"Google Analytics",googlebigquery:"Google BigQuery",googlecalendar:"Google Calendar",googlecloudvision:"Google Cloud Vision",googledocs:"Google Docs",googledrive:"Google Drive",googlemaps:"Google Maps",googlemeet:"Google Meet",googlesheets:"Google Sheets",grafana:"Grafana",griptape:"Griptape",groqcloud:"GroqCloud",gumroad:"Gumroad",habitica:"Habitica",hackernews:"Hacker News",harvest:"Harvest",hashnode:"Hashnode",here:"HERE",heygen:"HeyGen",higgsfield:"Higgsfield",hookdeck:"Hookdeck",htmltoimage:"HtmlToImage",hubspot:"HubSpot",huggingface:"Hugging Face",humanitix:"Humanitix",hunterio:"Hunter.io",imagior:"Imagior",imejisio:"Imejis.io",imgbb:"ImgBB",inboxkit:"InboxKit",insightoai:"Insighto.ai",instagram:"Instagram",instantly:"Instantly",intercom:"Intercom",jigsawstack:"JigsawStack",jira:"Jira",kaggle:"Kaggle",keenable:"Keenable",kibana:"Kibana",kling:"Kling",leexi:"Leexi",lever:"Lever",linear:"Linear",linkedin:"LinkedIn",litescrape:"LiteScrape",loyverse:"Loyverse",magichour:"Magic Hour",mailboxlayer:"MailboxLayer",mailcheck:"Mailcheck",mailchimp:"Mailchimp",mailtrap:"Mailtrap",marketstack:"Marketstack",mem0:"Mem0",merriamwebsterdict:"Merriam-Webster Dictionary",minimax:"MiniMax",monday:"Monday",mrscraper:"MrScraper",neon:"Neon",netsuite:"NetSuite",nextdns:"NextDNS",northflank:"Northflank",notion:"Notion",ocrspace:"OCR.space",ocrwebservice:"OcrWebService",octen:"Octen",ollama:"Ollama",onedrive:"OneDrive",onepassword:"1Password",openai:"OpenAI",openrouter:"OpenRouter",opensea:"OpenSea",openweathermap:"OpenWeatherMap",orbit:"Orbit",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",parseur:"Parseur",pdfco:"PDF.co",pdfmonkey:"PDFMonkey",pdl:"People Data Labs",perplexityai:"Perplexity AI",phantombuster:"PhantomBuster",pinecone:"Pinecone",plain:"Plain",ploid:"Ploid",posthog:"PostHog",postman:"Postman",prisma:"Prisma",pushbullet:"Pushbullet",qdrant:"Qdrant",razorpay:"Razorpay",recallai:"Recall.ai",reddit:"Reddit",reducto:"Reducto",remoet:"Remoet",removebg:"remove.bg",render:"Render",replicate:"Replicate",replyio:"Reply.io",resend:"Resend",retailed:"Retailed",retellai:"Retell AI",revai:"RevAI",rootly:"Rootly",runpod:"RunPod",salesflare:"Salesflare",salesforce:"Salesforce",saperly:"Saperly",sapsuccessfactors:"SAP SuccessFactors",scaleai:"Scale AI",scrapegraphai:"ScrapeGraphAI",search1api:"Search1API",securitytrails:"SecurityTrails",semanticscholar:"Semantic Scholar",sendgrid:"SendGrid",sentry:"Sentry",serpapi:"Serpapi",servicenow:"ServiceNow",sharepoint:"SharePoint",slack:"Slack",slackbot:"Slackbot",snapchat:"Snapchat",snowflake:"Snowflake",sourcegraph:"Sourcegraph",spoki:"Spoki",spotify:"Spotify",starton:"Starton",strava:"Strava",streamtime:"Streamtime",stripe:"Stripe",studiobyai21labs:"StudioByAI21Labs",supabase:"Supabase",supadata:"Supadata",surf:"Surf",suzanne:"Suzanne",synthflowai:"Synthflow AI",tally:"Tally",tavily:"Tavily",tavilymcp:"Tavily MCP",teams:"Teams",telegram:"Telegram",textrazor:"TextRazor",ticketmaster:"Ticketmaster",ticktick:"TickTick",tikhub:"TikHub",timecamp:"TimeCamp",timelink:"Timelink",timely:"Timely",tinyfish:"TinyFish",tinypng:"TinyPNG",tinyurl:"TinyURL",tisane:"Tisane",todoist:"Todoist",toggl:"Toggl",tokenmetrics:"Token Metrics",tpscheck:"TPSCheck",trello:"Trello",tripadvisor:"Tripadvisor",turbotpipes:"Turbot Pipes",turso:"Turso",twentyonerisk:"TwentyOneRisk",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",twochat:"TwoChat",typeform:"Typeform",typesafe:"TypeSafe",unione:"Unione",unipile:"Unipile",uniswapapi:"Uniswap",updownio:"Updown.io",uploadcare:"Uploadcare",vapi:"Vapi",vaquill:"Vaquill",vercel:"Vercel",veriphone:"Veriphone",vestaboard:"Vestaboard",waboxapp:"Waboxapp",wakatime:"WakaTime",webflow:"Webflow",webscrapingai:"WebScraping.AI",webvizio:"Webvizio",whatsapp:"WhatsApp",whautomate:"Whautomate",whoisfreaks:"Whoisfreaks",winstonai:"Winston AI",witai:"WitAi",wix:"Wix",wiza:"Wiza",woodpeckerco:"Woodpecker Co",workable:"Workable",workday:"Workday",workiom:"Workiom",worldnewsapi:"World News API",writer:"Writer",xero:"Xero",xquik:"XQuik",youcom:"You.com",youtube:"YouTube",zendesk:"Zendesk",zenserp:"Zenserp",zohobigin:"Zoho Bigin",zohodesk:"Zoho Desk",zohoinventory:"Zoho Inventory",zohomail:"Zoho Mail",zoom:"Zoom",zoominfo:"ZoomInfo"};function Oe(e){let n=os[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var Ce=class extends Error{connectUrl;plugin;tenantId;reason;constructor(n){super(n.message??"Reconnect required"),Object.setPrototypeOf(this,new.target.prototype),this.name="ReconnectRequiredError",this.connectUrl=n.connectUrl,this.plugin=n.plugin,this.tenantId=n.tenantId,this.reason=n.reason}};function U(e){return typeof e=="string"&&e.length>0}function wc(e){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"}function Cc(e){return e==="oauth_2"||e==="api_key"||e==="bot_token"||e==="managed"||e==="managed_pricing"}function Tt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!U(n.connectUrl)||!U(n.token)||!U(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:U(n.environmentId)?n.environmentId:n.projectId};return U(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function Pt(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;if(!U(r.tenantId)||!U(r.plugin)||!wc(r.status)||!Cc(r.authType)||typeof r.connected!="boolean"||typeof r.verified!="boolean")continue;let o=Array.isArray(r.missingFields)?r.missingFields.filter(i=>typeof i=="string"):[];n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authType:r.authType,connected:r.connected,verified:r.verified,missingFields:o,reportedAt:U(r.reportedAt)?r.reportedAt:new Date().toISOString()})}return n}function vt(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!U(n.approvalUrl)||!U(n.token)||!U(n.projectId)||!U(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function gn(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(U(n.access_token))return{access_token:n.access_token,refresh_token:U(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:U(n.scope)?n.scope:void 0};throw new Error(U(n.error)?U(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Tc(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Pc(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;U(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function vc(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(i=>i.level==="integration"&&i.required&&!i.configured)?"missing_integration":t.some(i=>i.level==="account"&&i.required&&i.configured)?"partial":(r.length>0,"not_started")}function is(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!U(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let o=r;if(!U(o.plugin)||typeof o.connected!="boolean")continue;let i=o.authKind==="oauth"||o.authKind==="api_key"||o.authKind==="bot_token"?o.authKind:"api_key",a=Pc(o.fields),s=Tc(o.missingRequiredFields),u=vc(o.status,o.connected,a,s);t.push({plugin:o.plugin,providerName:U(o.providerName)?o.providerName:o.plugin,authKind:i,status:u,connected:o.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function qr(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function ss(e,n,t){if(n===404&&t)return t;let r=qr(e);if(!r)return`Hub API returned HTTP ${n}`;if(!e||typeof e!="object")return r;let o=e,i=[r];if(typeof o.code=="string"&&o.code.length>0&&i.push(`Hub error code: ${o.code}`),typeof o.hint=="string"&&o.hint.length>0&&i.push("",o.hint),Array.isArray(o.fix)){let a=o.fix.filter(s=>typeof s=="string"&&s.trim().length>0);if(a.length>0){i.push("","What to do:");for(let s of a)i.push(`- ${s}`)}}if(o.received!==void 0)try{i.push("",`Hub received: ${JSON.stringify(o.received)}`)}catch{}if(o.details!==void 0)try{i.push("",`Details: ${JSON.stringify(o.details)}`)}catch{}return typeof o.creditsRequired=="number"&&i.push("",`Credits required for this call: ${o.creditsRequired}`),i.join(`
+`)}function as(e){if(!e||typeof e!="object")return null;let n=e;if(n.errorType!=="reconnect_required")return null;let t=r=>typeof r=="string"&&r.length>0?r:null;return{message:t(n.error),connectUrl:t(n.connectUrl),plugin:t(n.plugin),tenantId:t(n.tenantId),reason:t(n.reason)}}var us="0.1.157";function Rc(){return{"x-corsair-sdk-version":us}}function Rt(e){return e.replace(/\/$/,"")}function jr(e){if(!e.projectApiKey.startsWith("ck_dev_"))return null;try{return Ee()}catch{return null}}function cs(e){let n=jr(e);return n?{"x-corsair-delivery-url":n}:{}}function ls(e){let n=e.instanceKey?.trim();return n?{"x-corsair-instance-key":n}:{}}async function ds(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function Ac(e,n,t){return ss(e,n,t)}function ps(e,n,t){let r=as(e);throw r?new Ce({message:r.message??void 0,connectUrl:r.connectUrl,plugin:r.plugin,tenantId:r.tenantId,reason:r.reason??void 0}):Object.assign(new Error(Ac(e,n,t)),{status:n})}function gs(e){return typeof e=="object"&&e!==null&&"status"in e&&typeof e.status=="number"?e.status:void 0}async function S(e){let n=Rt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",signal:e.signal,headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`,...cs(e.hub),...ls(e.hub),...Rc(),...e.extraHeaders},body:JSON.stringify(e.body)}),r=await ds(t);return t.ok||ps(r,t.status,e.notFoundMessage),e.parseResponse(r)}async function Z(e){let n=Rt(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",...e.signal?{signal:e.signal}:{},headers:{authorization:`Bearer ${e.hub.projectApiKey}`,...cs(e.hub),...ls(e.hub)}}),r=await ds(t);return t.ok||ps(r,t.status,e.notFoundMessage),e.parseResponse(r)}function At(e){return e&&typeof e=="object"?e:{}}function fs(e){let n=At(e);return{chatId:n.threadId,message:n.message,workflowId:n.workflowId??null,action:n.action}}async function Kr(e,n){return S({hub:e,path:"/threads",body:{tenantId:n.tenantId,message:n.message},parseResponse:t=>{let r=At(t);return{chat:r.thread,reply:fs(r.reply)}}})}async function Zr(e,n){return S({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages`,body:{tenantId:n.tenantId,message:n.message},notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:fs})}async function Gr(e,n){return Z({hub:e,path:`/threads?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=At(t).threads;return Array.isArray(r)?r:[]}})}async function zr(e,n){return Z({hub:e,path:`/threads/${encodeURIComponent(n.chatId)}/messages?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Chat "${n.chatId}" not found`,parseResponse:t=>{let r=At(t).messages;return Array.isArray(r)?r:[]}})}import{randomUUID as Oc}from"crypto";var xc="corsair:client-bridge";function Jr(e){return new URL(e).origin}function fn(e){let n=JSON.stringify({type:xc,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(Jr(e.hubOrigin));return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var Ic=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Vr(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Ic.has(n)}catch{return!1}}function jn(e){return e==="development"?"browser":"server"}function ys(e){return jn(e)==="browser"}function ms(e){return Vr(e)?"Production delivery URL must be a public URL, not localhost":null}import{randomBytes as Mc}from"crypto";var De=60*1e3,Ze=300*1e3;import{createHmac as Sc,randomBytes as _c,timingSafeEqual as Ec}from"crypto";function Te(){return _c(16).toString("base64url")}function Kn(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Sc("sha256",t).update(e).digest("base64url")}function de(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[o,i]=r;if(!o||!i)return null;let a=Kn(o,t);try{if(!Ec(Buffer.from(i,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(o,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function xt(e,n,t){let r=Math.floor(Date.now()/1e3),o={...e,iat:r,exp:t},i=Buffer.from(JSON.stringify(o)).toString("base64url"),a=Kn(i,n);return`${i}.${a}`}function Zn(e,n,t){let r=Math.floor(Date.now()/1e3);return xt(e,n,r+Math.floor(t/1e3))}function Ge(e){return decodeURIComponent(e)}function Yr(e){return encodeURIComponent(e).replace(/\./g,"%2E")}function hs(e){let n=e.trim();return n.length>0?n:null}function yn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function mn(e,n){if(!hs(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Mc(16).toString("base64url"),iat:t,exp:t+Math.floor(De/1e3)},o=Buffer.from(JSON.stringify(r)).toString("base64url"),i=Kn(o,n);return`${o}.${i}`}function He(e,n){return hs(n)?de(e,n):null}function Dc(e){let n=Jr(e.hubOrigin),t={connectJti:e.requestId,projectId:e.projectId,hubSuccessUrl:e.hubOrigin,deliveryMode:e.deliveryMode,hubOrigin:n,requestId:e.requestId};switch(e.deliveryMode){case"connections.sync":return{...t,plugin:"connections.sync",tenantId:"*"};case"connect.create_link":return{...t,plugin:"connect.create_link",tenantId:e.tenantId,connectLinkPlugins:e.plugins}}}function Qr(e){let n=mn(Dc(e),e.signingSecret);return yn(e.deliveryUrl,n)}function bs(e){if(jn(e.environmentSlug)==="server")return{transport:"server"};if(!e.hubOrigin)throw new Error(`hubOrigin is required for development ${e.deliveryMode} delivery`);let t=Oc(),r={...e,hubOrigin:e.hubOrigin,requestId:t};return{transport:"browser",requestId:t,deliveryUrl:Qr(r)}}var Gn="https://auth.corsair.dev";var Pe=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}},zn=class extends Error{constructor(){super("Hub credentials are missing. Pass hub: { projectApiKey, signingSecret } to createCorsair() with non-empty values, or omit `hub` entirely if you are not using Corsair Hub."),this.name="HubCredentialsMissingError"}};function Xr(e){let n=(e.apiUrl?.trim()||Gn).replace(/\/$/,""),t=e.projectApiKey?.trim()??"",r=e.signingSecret?.trim()??"",o=t.startsWith("ck_cloud_");if(!t||!r&&!o)throw new zn;return{apiUrl:n,projectApiKey:t,signingSecret:r,instanceKey:e.instanceKey?.trim()||void 0,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,""),redirectURL:e.redirectURL?.trim()||void 0,allowWorkflowExecution:e.allowWorkflowExecution??!1,tunnel:e.tunnel,runtimeProofKey:e.runtimeProofKey?.trim()||void 0}}function It(e){return Xr(e)}function Hc(e){let n=e.projectApiKey.startsWith("ck_cloud_");return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&(n||e.signingSecret.trim().length>0)}function j(e){let n=R(e).hub;if(!n||!Hc(n))throw new Pe;return n}function ks(e){return e.replace(/\/$/,"")}function St(e){return e.oauthCallbackUrl?ks(e.oauthCallbackUrl.trim()):`${ks(e.apiUrl)}/oauth/callback`}function hn(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";if(e.startsWith("ck_cloud_"))return"cloud";throw new Error("Hub API key must start with ck_dev_ (development), ck_prod_ (production), or ck_cloud_ (cloud)")}function ws(e,n,t){let r={};for(let o of t)r[`get_${o}`]=async()=>(await e())[o]??null,r[`set_${o}`]=async i=>{let a=[null,void 0,""].includes(i)?null:i;await n({[o]:a})};return r}var eo=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function K(e){let{authType:n,integrationName:t,kek:r,database:o,extraIntegrationFields:i=[]}=e,a=[...z[n].integration,...i],s=null,u={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let b=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!b)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:b.id,config:eo(b.config),dek:b.dek??null},s},updateIntegration:async b=>{let k=await u.getIntegration();await o.db.updateTable("corsair_integrations").set({...b.config!==void 0?{config:b.config}:{},...b.dek!==void 0?{dek:b.dek}:{},updated_at:new Date}).where("id","=",k.id).execute(),s=null}},l=null,c=async()=>{if(l)return l;let b=await u.getIntegration();if(!b.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await ae(b.dek,r),l},d=async()=>{let b=await u.getIntegration(),k=await c(),P=b.config;return!P||Object.keys(P).length===0?{}:we(P,k)},p=Promise.resolve(),g=b=>{let k=p.then(()=>f(b));return p=k.catch(()=>{}),k},f=async b=>{let k=await c(),P;try{P=await d()}catch(O){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,O),P={}}let A={...P};for(let[O,re]of Object.entries(b))re===null?delete A[O]:A[O]=re;let B=Ke(A,k);await u.updateIntegration({config:B})};return{get_dek:c,issue_new_dek:async()=>{let b=await u.getIntegration(),k=be(),P={};if(b.dek){let B=await ae(b.dek,r),O=b.config;O&&Object.keys(O).length>0&&(P=Wn(O,B,k))}let A=await ke(k,r);return await u.updateIntegration({config:P,dek:A}),l=k,k},...ws(d,g,a)}}function N(e){let{authType:n,integrationName:t,tenantId:r,kek:o,database:i,extraAccountFields:a=[],ensureProvisioned:s}=e,u=[...z[n].account,...a],l=null,c=async()=>{if(l)return l;let T=!1;for(;;){let C=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!C){if(!T&&s){T=!0,await s();continue}throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`)}return l={id:C.id,config:eo(C.config),dek:C.dek??null},l}},d={kek:o,integrationName:t,tenantId:r,getIntegration:c,getAccount:async()=>{let T=!1;for(;;){let C=await c(),D=await i.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",C.id).executeTakeFirst();if(!D){if(!T&&s){T=!0,await s();continue}throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`)}return{id:D.id,config:eo(D.config),dek:D.dek??null}}},updateAccount:async T=>{let C=await d.getAccount();await i.db.updateTable("corsair_accounts").set({...T.config!==void 0?{config:T.config}:{},...T.dek!==void 0?{dek:T.dek}:{},updated_at:new Date}).where("id","=",C.id).execute()}},p=null,g=null,f=null,h=async()=>{let T=await d.getAccount();if(!T.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p&&g===T.dek||(p=await ae(T.dek,o),g=T.dek),p},b=async()=>{if(f)return f;let T=await d.getIntegration();if(!T.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return f=await ae(T.dek,o),f},k=async()=>{let T=await d.getAccount(),C=await h(),D=T.config;return!D||Object.keys(D).length===0?{}:we(D,C)},P=async()=>{let T=await d.getIntegration(),C=await b(),D=T.config;return!D||Object.keys(D).length===0?{}:we(D,C)},A=Promise.resolve(),B=T=>{let C=A.then(()=>O(T));return A=C.catch(()=>{}),C},O=async T=>{let C=await d.getAccount();if(!C.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);let D=await ae(C.dek,o),L;try{let H=C.config;L=!H||Object.keys(H).length===0?{}:we(H,D)}catch(H){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,H),L={}}let oe={...L};for(let[H,_e]of Object.entries(T))_e===null?delete oe[H]:oe[H]=_e;let F=Ke(oe,D);await d.updateAccount({config:F})},re={get_dek:h,issue_new_dek:async()=>{let T=await d.getAccount(),C=be(),D={},L=null;if(T.dek){L=await ae(T.dek,o);let F=T.config;F&&Object.keys(F).length>0&&(D=Wn(F,L,C))}let oe=await ke(C,o);if(L){let F=L;await i.db.transaction().execute(async H=>{await ts(H,T.id,F,C),await H.updateTable("corsair_accounts").set({config:D,dek:oe,updated_at:new Date}).where("id","=",T.id).execute()})}else await d.updateAccount({config:D,dek:oe});return p=C,g=oe,C},...ws(k,B,u)};return n==="oauth_2"&&(re.get_integration_credentials=async()=>{let T=await P();return{...T,client_id:T.client_id||null,client_secret:T.client_secret||null,redirect_url:T.redirect_url??null}}),re}async function Cs(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let o=be(),i=await ke(o,t);return await e.db.updateTable("corsair_integrations").set({dek:i,updated_at:new Date}).where("id","=",r.id).execute(),o}async function Ts(e,n,t,r){let o=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!o)throw new Error(`Integration "${n}" not found.`);let i=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",o.id).executeTakeFirst();if(!i)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=be(),s=await ke(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",i.id).execute(),a}var Uc=new Set(["webhook_signature","expires_at","scope","redirect_url","refresh_token"]);function Ue(e){return Uc.has(e)}function Fc(e,n){return Ue(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function Bc(e){return!Ue(e)}function Lc(e){switch(e){case"oauth_2":case"managed":return["access_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"];case"managed_pricing":return[]}}function Nc(e,n){return e!=="oauth_2"&&e!=="managed"?!1:n.some(t=>t.level==="account"&&t.name==="expires_at"&&t.configured)}function $c(e,n){let t=i=>n.find(a=>a.level==="account"&&a.name===i);if(!Lc(e).every(i=>t(i)?.configured))return!1;let o=t("refresh_token");return o?.required?!!o.configured:!0}async function Ps(e,n){if(!e)return!1;let t=se(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function Wc(e,n){let r=e.authConfig?.[n]?.integration??[];return[...z[n].integration,...r]}function qc(e,n){let r=e.authConfig?.[n]?.account??[];return[...z[n].account,...r]}function jc(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return o.length>0?a="missing_integration":r.length===0?a="ready":i.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:$c(n,t),fields:t,missingRequiredFields:r}}async function ze(e,n,t){let r=M(n);if(!r||!e.database||!e.kek)return null;let o=t.trim()||"default",i=n.authConfig,a=i?.[r]?.integration??[],s=i?.[r]?.account??[],u=K({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),l=N({authType:r,integrationName:n.id,tenantId:o,kek:e.kek,database:e.database,extraAccountFields:s}),c=Wc(n,r),d=qc(n,r),p=[];for(let g of c)p.push({name:g,level:"integration",required:Fc(r,g),configured:await Ps(u,g)});for(let g of d)p.push({name:g,level:"account",required:Bc(g),configured:await Ps(l,g)});if(Nc(r,p)){let g=p.find(f=>f.level==="account"&&f.name==="refresh_token");g&&(g.required=!0)}return jc(n.id,r,p)}async function Jn(e,n,t={}){let r=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,i=[];for(let a of e.plugins){if(o&&!o.has(a.id))continue;let s=await ze(e,a,r);s&&i.push(s)}return i}function _t(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}var vs=Symbol.for("corsair:internal"),Rs=new WeakMap,As=new WeakMap;function Kc(e,n){let t=n.map(r=>r.id).sort().join("\0");return`${e}\0${t}`}function Zc(e){if(e.database){let t=Rs.get(e.database);return t||(t=new Map,Rs.set(e.database,t)),t}let n=As.get(e);return n||(n=new Map,As.set(e,n)),n}function Gc(e){return e.multiTenancy?{withTenant:()=>({}),[vs]:e}:{[vs]:e}}async function bn(e,n){if(!e.database)return;let t=n.trim()||"default",r=Zc(e),o=Kc(t,e.plugins),i=r.get(o);if(i){await i;return}let a=(async()=>{let{setupCorsair:s}=await import("./setup-ARDZGG7H.js");await s(Gc(e),{tenantId:e.multiTenancy?t:void 0,silent:!0})})().finally(()=>{r.delete(o)});r.set(o,a),await a}import*as Vn from"crypto";function Fe(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function no(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let o=r;return n!==void 0&&typeof o.iat=="number"&&Date.now()-o.iat>n?null:o}return null}catch{return null}}function kn(e,n){if(!n)throw new Error("OAuth state signing requires a configured kek. Pass kek to createCorsair().");let t=Vn.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var to=600*1e3;function Et(e,n){if(!n)return null;let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),o=e.slice(t+1),i=Vn.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(o,"base64url"),s=Buffer.from(i,"base64url");return a.length!==s.length||!Vn.timingSafeEqual(a,s)?null:no(r,{maxAgeMs:to})}function xs(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType??"oauth_2",status:"ready",connected:!0,verified:!0,webhookLink:e.link}}function Is(e){return{tenantId:e.tenantId,plugin:e.plugin,authType:e.authType,status:e.status,connected:e.connected,verified:e.verified,missingFields:e.missingFields,webhookLink:e.webhookLink,webhookSecret:e.webhookSecret}}async function wn(e,n){await S({hub:e,path:"/connections/report",body:xs(n),parseResponse:()=>({ok:!0})}).catch(()=>{})}function zc(e,n){try{let t=j(e);S({hub:t,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}catch(t){if(t instanceof Pe)return}}async function Jc(e){if(!e.hub||!e.database||!e.kek)return;let n={database:e.database,kek:e.kek,plugins:e.plugins};if(!M(e.plugin))return;let r=e.tenantId?.trim()||"default",o=await ze(n,e.plugin,r);o&&_s(e.hub,Is({tenantId:r,plugin:e.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:e.verified??o.connected,missingFields:o.missingRequiredFields}))}function Ss(e,n){zc(e,n)}function _s(e,n){S({hub:e,path:"/connections/report",body:n,parseResponse:()=>({ok:!0})}).catch(()=>{})}function Cn(e){Jc(e).catch(()=>{})}async function ve(e,n){let t=R(e);if(!M(n.plugin))return;let o=await ze(t,n.plugin,n.tenantId);o&&Ss(e,Is({tenantId:n.tenantId.trim()||"default",plugin:n.plugin.id,authType:o.authType,status:o.status,connected:o.connected,verified:n.verified??o.connected,missingFields:o.missingRequiredFields,webhookLink:n.webhookLink,webhookSecret:n.webhookSecret}))}async function Mt(e,n,t){for(let r of e){if(r.id!==n)continue;let o=r.oauthWebhookTenantLinkResolver;return o?o(t):null}return null}var Es=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function Vc(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function Yc(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await ae(n.dek,e.kek),r=Es(n.config),o={};Object.keys(r).length>0&&(o=we(r,t)),o[e.link.linkType]=e.link.externalId;let i=Ke(o,t);await e.database.db.updateTable("corsair_accounts").set({config:i,updated_at:new Date}).where("id","=",n.id).execute()}async function Tn(e){let{database:n,kek:t,pluginId:r,tenantId:o,link:i,authType:a,extraAccountFields:s=[]}=e,{accountId:u}=await Vc({database:n,pluginId:r,tenantId:o}),l=!1;if(a){let c=N({authType:a,integrationName:r,tenantId:o,kek:t,database:n,extraAccountFields:s}),d=`set_${i.linkType}`,p=c[d];typeof p=="function"&&(await p(i.externalId),l=!0)}l||await Yc({database:n,kek:t,accountId:u,link:i})}async function ro(e){let{database:n,kek:t,pluginId:r,linkType:o,externalId:i}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let u=await ae(s.dek,t),c=Es(s.config)[o];if(!c)continue;if(kt(c,u)===i)return s}catch{continue}return null}async function Ot(e){return(await ro(e))?.tenant_id??null}async function Ms(e){return Ot({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}import*as Os from"querystring";function Je(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:o}=e,i={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:o};return`${n.authUrl}?${Os.stringify(i)}`}async function Ds(e,n){try{return await Z({hub:e,path:`/webhooks/endpoint?plugin=${encodeURIComponent(n)}`,parseResponse:t=>t?.url??null})}catch{return null}}async function Pn(e,n,t,r){if(!n.subscribe)return;let o=j(e),i=await Ds(o,n.id);if(!i)return;let a=await n.subscribe({keys:r},{webhookUrl:i});a&&await ve(e,{plugin:n,tenantId:t,verified:!0,webhookLink:a.webhookLink,webhookSecret:a.webhookSecret})}var X=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function Hs(e){let n=e.oauthConfig;if(!n)throw new X("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Qc(e,n,t,r){await e.db.transaction().execute(async o=>{let i=o.selectFrom("corsair_integrations").select(["id"]).where("name","=",n);e.isPg===!0&&(i=i.forUpdate());let a=await i.executeTakeFirst();if(!a)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await o.selectFrom("corsair_accounts").select("id").where("tenant_id","=",t).where("integration_id","=",a.id).executeTakeFirst())return;let u=be(),l=await ke(u,r),c=new Date;await o.insertInto("corsair_accounts").values({id:pn(),created_at:c,updated_at:c,tenant_id:t,integration_id:a.id,config:{},dek:l}).execute()})}async function oo(e,n,t){let{tenantId:r,redirectUri:o,hubConnect:i=!1}=t,a=R(e,()=>new X("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=Q(a,n,p=>new X("plugin_not_found",p)),u=Hs(s),c=await K({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!c)throw new Error(`client_id not configured for '${n}'`);if(i){let p=new URL(Je({oauthConfig:u,clientId:c,redirectUri:o,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let d=kn(Fe(n,r),a.kek);return{url:Je({oauthConfig:u,clientId:c,redirectUri:o,state:d}),state:d}}function Xc(e,n){return{...n??{},...e}}async function Yn(e,n){let{code:t,state:r,redirectUri:o}=n,i=R(e,()=>new X("invalid_corsair_instance","Invalid corsair instance")),a,s;if(n.trusted){if(!n.plugin||!n.tenantId)throw new X("invalid_state","trusted callback requires plugin and tenantId");a=n.plugin,s=n.tenantId}else{let h=Et(r,i.kek);if(!h)throw new X("invalid_state","Invalid or tampered state parameter");a=h.plugin,s=h.tenantId}if(!i.database)throw new X("no_database","No database configured on corsair instance");let u=Q(i,a,h=>new X("plugin_not_found",h)),l=Hs(u),c=K({authType:"oauth_2",integrationName:a,kek:i.kek,database:i.database}),d=await c.get_client_id(),p=await c.get_client_secret();if(!d||!p)throw new X("credentials_not_configured",`Credentials not configured for '${a}'`);await Qc(i.database,a,s,i.kek);let g=await Dt(t,d,p,l,o);if(!g.access_token)throw new X("no_access_token",`No access_token returned from ${l.providerName}`);let f=N({authType:"oauth_2",integrationName:a,tenantId:s,kek:i.kek,database:i.database,extraAccountFields:[...u.authConfig?.oauth_2?.account??[]]});await f.set_access_token(g.access_token),g.refresh_token&&await f.set_refresh_token(g.refresh_token),g.expires_in&&await f.set_expires_at(String(Math.floor(Date.now()/1e3)+g.expires_in)),await ve(e,{plugin:u,tenantId:s}).catch(()=>{});try{let h=Xc(g,n.callbackParams),b=await Mt(i.plugins,a,h);if(b){try{let k=u.authConfig?.oauth_2?.account??[];await Tn({database:i.database,kek:i.kek,pluginId:a,tenantId:s,link:b,authType:"oauth_2",extraAccountFields:k})}catch(k){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${a}' tenant '${s}':`,k)}i.hub&&wn(i.hub,{plugin:a,tenantId:s,link:b,authType:"oauth_2"})}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${a}' tenant '${s}':`,h)}if(u.subscribe)try{await Pn(e,u,s,f)}catch(h){console.warn(`[corsair:oauth] BYO subscribe failed for '${a}' tenant '${s}':`,h)}return{plugin:a,tenantId:s}}async function el(e){let{corsair:n,internal:t,rows:r}=e,o=e.subscribeAndReport??Pn,i=[],a=[];if(!t.database)return{renewed:i,failed:a};for(let s of r){let u=t.plugins.find(c=>c.id===s.integrationName);if(!u?.subscribe)continue;let l=`${u.id}/${s.tenantId}`;try{let c=M(u)??"oauth_2",d=N({authType:c,integrationName:u.id,tenantId:s.tenantId,kek:t.kek,database:t.database,extraAccountFields:[...u.authConfig?.[c]?.account??[]]}),p=u.keyBuilder;if(p){let g=Object.create(d,{get_expires_at:{value:async()=>"0"}});await p({authType:c,keys:g,hub:t.hub},"endpoint")}await o(n,u,s.tenantId,d),i.push(l)}catch(c){console.warn(`[corsair:renewal] re-subscribe failed for '${l}':`,c),a.push(l)}}return{renewed:i,failed:a}}async function Us(e){let n=R(e);if(!n.database)return{renewed:[],failed:[]};let t=await n.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id as tenantId","i.name as integrationName"]).where("a.dek","is not",null).execute();return el({corsair:e,internal:n,rows:t.filter(r=>!!r.tenantId)})}function nl(e,n={}){let t=!1,r=()=>{t||(t=!0,Us(e).catch(i=>console.warn("[corsair:renewal] renewal pass failed:",i)).finally(()=>{t=!1}))};r();let o=setInterval(r,(n.intervalMinutes??45)*6e4);return o.unref?.(),()=>clearInterval(o)}async function Fs(e){if(!R(e).database)throw new Error("A database must be configured to provision Corsair integrations");await Ht(e,{silent:!0})}async function vn(e,n){let t=R(e);if(!t.database)throw new Error("A database must be configured to provision Corsair for connect");await bn(t,n)}var tl=Symbol.for("corsair:internal"),rl=new Set(["access_token","refresh_token","expires_at","scope"]);function ol(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function il(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!Ue(t)&&!rl.has(t)):n.filter(t=>!Ue(t))}function Bs(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function sl(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:e.multiTenancy??!1,encryptDataAtRest:!1}}function al(e){return{[tl]:Bs(e)}}async function Ut(e,n,t={}){let r=St(e.hub),o=[],i=t.pluginIds?new Set(t.pluginIds):null,a=Bs(e),s=al(e);for(let u of e.plugins){if(i&&!i.has(u.id))continue;let l=M(u);if(!l)continue;let c=ol(l),d=t.providerNameOverrides?.[u.id]??Oe(u.id),p=await ze(a,u,n),g=ht(u,l),f=il(l,g),h={plugin:u.id,providerName:d,authKind:c,alreadyConfigured:p?.connected??!1};if(f.length>0&&(h.credentialFields=f),c==="oauth"){let k=t.oauthModeOverrides?.[u.id]??(l==="managed"?"managed":"byo");if(h.oauthMode=k,!t.skipOAuthUrlGeneration&&k!=="managed")try{let P=await oo(s,u.id,{tenantId:n,redirectUri:r,hubConnect:!0});h.oauthUrl=P.url}catch(P){P instanceof Error&&/client_id not configured/i.test(P.message)||(h.setupError=P instanceof Error?P.message:`Could not prepare OAuth for ${u.id}`)}}o.push(h)}return o}async function dm(e,n,t={}){let r=R(e),o=r.hub;if(!o)throw new Error("Hub is not configured");return Ut({plugins:r.plugins,database:r.database,kek:r.kek,hub:o},n,t)}async function Ls(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await bn(e.internalConfig??sl(e),n)}async function Ns(e,n){await vn(e,n)}async function $s(e,n){let t=hn(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Ee({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:Tt})}async function Ws(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await Ls(t,n.tenantId);let r=await Ut(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return $s(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function Ft(e,n){let t=R(e),r=j(e),o={plugins:t.plugins,database:t.database,kek:t.kek,hub:r,multiTenancy:t.multiTenancy,internalConfig:t};await Ns(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,a=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,s=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,u=await Ut(o,n.tenantId,{pluginIds:i,oauthModeOverrides:a,providerNameOverrides:s});if(u.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return $s(r,{tenantId:n.tenantId,plugins:u,deliveryUrl:n.deliveryUrl})}async function Bt(e,n){let t=n.tenantId.trim();if(!t)throw new Error("tenantId is required");let r=n.plugins.map(a=>a.trim()).filter(Boolean);if(r.length===0)throw new Error("At least one plugin is required");let o=R(e);if(!o.hub)throw new Error("Hub is not configured on this Corsair instance");if(!o.database)throw new Error("Database not configured");let i=await ul(o.hub,{plugins:o.plugins,database:o.database,kek:o.kek,multiTenancy:o.multiTenancy},{tenantId:t,pluginIds:r});return{connectUrl:i.connectUrl,expiresAt:i.expiresAt}}async function ul(e,n,t){let{buildConnectPluginManifestFromContext:r,ensureConnectAccountRowsFromContext:o}=await import("./setup-introspect-YUSMF6SC.js"),{postHubConnectSession:i}=await import("./connect-ZWHNFP6U.js"),a={plugins:n.plugins,database:n.database,kek:n.kek,hub:e,multiTenancy:n.multiTenancy};await o(a,t.tenantId);let s=await r(a,t.tenantId,{pluginIds:t.pluginIds});if(s.length===0)throw new Error("No connectable plugins found for this tenant");let u=s.find(l=>l.setupError);if(u)throw new Error(u.setupError??`Could not prepare connect link for ${u.plugin}`);return i(e,{tenantId:t.tenantId,plugins:s})}function Rn(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var ce=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function cl(e){let n=e.oauthConfig;if(!n)throw new ce("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function io(e,n){let t=R(e,()=>new ce("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ce("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new ce("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let o=Et(n,t.kek);if(!o)throw new ce("invalid_state","Invalid or tampered state parameter");let{plugin:i,tenantId:a}=o,s=Q(t,i,p=>new ce("plugin_not_found",p)),u=cl(s),c=await K({authType:"oauth_2",integrationName:i,kek:t.kek,database:t.database}).get_client_id();if(!c)throw new ce("client_id_not_configured",`client_id not configured for '${i}'`);let d=Je({oauthConfig:u,clientId:c,redirectUri:r,state:n});return{plugin:i,tenantId:a,providerName:u.providerName,oauthUrl:d,state:n}}import{AsyncLocalStorage as dl}from"async_hooks";import{randomBytes as pl}from"crypto";import{v4 as gl}from"uuid";var pe=class extends Error{reason;constructor(n,t="pending"){super(n),Object.setPrototypeOf(this,new.target.prototype),this.name="PermissionRequiredError",this.reason=t}};async function Lt(e,n){let t=hn(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return e.redirectURL&&(r.redirectUri=e.redirectURL),t==="development"&&(r.deliveryUrl=Ee({deliveryUrl:n.deliveryUrl})),S({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:vt})}function Nt(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}var so="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function uo(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function qs(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function ao(e){return Nt(e)}async function co(e,n){if(uo(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?qs(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Lt(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:ll(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch(r){return console.warn(`[corsair/${n.plugin}] could not create an approval link for '${n.endpoint}': ${r instanceof Error?r.message:String(r)}`),null}}function ll(e){try{return JSON.parse(e)}catch{return e}}async function $t(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await co(e,n);return{...n,approvalUrl:r}}async function lo(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:o,permissionToken:i,plugin:a,endpoint:s,args:u,tenantId:l,expiresAt:c,operationPath:d}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:i,id:o,plugin:a,endpoint:s,args:u});let g=await co({manual:t,hub:r},{id:o,token:i,plugin:a,endpoint:s,args:JSON.stringify(u),tenant_id:l,expires_at:c});return uo(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):ao(g):so:r?g?ao(g):`Action '${d}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:so}var Wt=new dl,js={open:0,cautious:1,strict:2,readonly:3},An=class extends Error{endpointPath;riskLevel;constructor(n,t){super(`Action '${n}' is a '${t}' operation and is forbidden in readonly mode. Only read operations are permitted \u2014 rewrite the script to avoid write/destructive actions.`),this.name="ReadonlyForbiddenError",this.endpointPath=n,this.riskLevel=t}};function po(e,n){return e===void 0?n:n===void 0||js[e]>=js[n]?e:n}function qt(e,n){return Wt.run(po(Wt.getStore(),e)??e,n)}function xn(){return Wt.getStore()}function go(e){return qt("readonly",e)}function Gs(){return Wt.getStore()==="readonly"}function jt(e,n){if(Gs()&&n!=="read")throw new An(e,n)}function Ve(e,n){jt(e,n);let t=xn();if(!(t===void 0||Kt(n,t)==="allow"))throw new pe(`Action '${e}' is a '${n}' operation and permission mode '${t}' does not allow it. The entity store cannot wait for approval.`,"policy")}var fl={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}},Ks={allow:0,require_approval:1,deny:2};function zs(e,n){return e===void 0?n:Ks[e]>=Ks[n]?e:n}function Kt(e,n,t){return t!==void 0?t:fl[n][e]}function fo(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let o=parseInt(r[1],10);switch(r[2]){case"d":t+=o*864e5;break;case"h":t+=o*36e5;break;case"m":t+=o*6e4;break;case"s":t+=o*1e3;break}}return t>0?t:600*1e3}function Js(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Zs(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let o=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!o)return{result:"blocked",reason:"pending"};if(o.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(o.status==="denied")return{result:"blocked",reason:"denied"};if(o.status==="expired"||o.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(i=>setTimeout(i,500))}return{result:"blocked",reason:"timeout"}}async function Vs(e){let n=Kt(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, widen the permission mode in force for this call.`),{result:"blocked",reason:"policy"};let o=JSON.stringify(e.args),i=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",o).where("tenant_id","=",a).where("expires_at",">",i).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,h=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",h).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${s.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Zs(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let u=gl(),l=pl(32).toString("hex"),c=e.timeoutMs??600*1e3,d=new Date(Date.now()+c).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:u,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:o,tenant_id:a,status:"pending",expires_at:d}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${u}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${d}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Zs(e.db,u,c):{result:"blocked",reason:"pending",id:u,token:l,expiresAt:d}}var w=class extends Error{status;code;extra;constructor(n,t,r,o={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=o}};function _(e,n,t){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json",...t}})}function ge(e){let n={error:e.code,message:e.message,...e.extra};return _(e.status,n)}function Be(e){return new w(404,"not_found",e)}function $(e,n={}){return new w(400,"bad_request",e,n)}function yo(e,n){return Q(e,n,t=>Be(t))}async function Ys(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=K({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),o=z[t].integration,i=r,a;try{a=await Promise.all(o.map(l=>i[`get_${l}`]()))}catch{a=o.map(()=>null)}let s=o.filter((l,c)=>a[c]==null),u;return t==="oauth_2"?u=!s.includes("client_id")&&!s.includes("client_secret"):u=s.length===0,{configured:u,missingFields:s}}async function Qs(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:o,missingFields:i}=await Ys(e,n);return{id:e.id,authType:t,configured:o,missingFields:i,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Zt(){return{ok:!0}}async function In(e){return Promise.all(e.plugins.map(n=>Qs(n,e)))}async function Gt(e,n){let t=yo(e,n);return Qs(t,e)}async function yl(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function Xs(e,n){let t=await yl(e,n),r=t.filter(o=>o.hasCredentials).map(o=>o.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function Sn(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let o=r.tenant_id;if(!o)continue;let i=n.get(o);i||(i={id:o,accounts:[],connectedPlugins:[]},n.set(o,i));let a=!!r.dek;i.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&i.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function zt(e,n){if(!n)throw $("Tenant id must be a non-empty string");return Xs(e,n)}async function Jt(e,n){let t=n?.id?.trim();if(!t)throw $("Tenant id is required",{missingFields:["id"]});return Xs(e,t)}async function Vt(e,n){let t=n?.trim()||"default",r={},o=await Jn(e,t);for(let i of o)r[i.plugin]=_t(i);for(let i of e.plugins)i.id in r||(!i.options?.authType||!e.database||!e.kek?r[i.id]="missing_credentials":r[i.id]="not_connected");return r}async function Yt(e,n){let t=n?.plugin;if(typeof t!="string"||!t.trim())throw $("plugin is required",{missingFields:["plugin"]});let r=t.trim();yo(e,r);let o=n?.tenantId;if(o!=null&&typeof o!="string")throw $("tenantId must be a string");let i=o?.trim()||"default";if(!e.database)return{ok:!0,disconnected:!1};let a=e.database.db,s=await a.selectFrom("corsair_integrations").select(["id"]).where("name","=",r).executeTakeFirst();if(!s)return{ok:!0,disconnected:!1};let u=!1;return await a.transaction().execute(async l=>{e.database?.isPg===!0&&await l.selectFrom("corsair_integrations").select("id").where("name","=",r).forUpdate().execute();let c=l.selectFrom("corsair_accounts").select("id").where("tenant_id","=",i).where("integration_id","=",s.id);await l.deleteFrom("corsair_events").where("account_id","in",c).execute(),await l.deleteFrom("corsair_entities").where("account_id","in",c).execute(),u=((await l.deleteFrom("corsair_accounts").where("tenant_id","=",i).where("integration_id","=",s.id).executeTakeFirst()).numDeletedRows??0n)>0n}),{ok:!0,disconnected:u}}async function mo(e,n){if(!e.database)throw Be(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw Be(`Permission '${n}' not found`);return $t(e,t)}function ml(e){if(!e.oauthConfig)throw $(`Plugin '${e.id}' has no oauthConfig`)}function hl(e){if(!e.manual)throw new w(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function ho(e){let n=hl(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new w(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function bl(e){let n=!!e.hub,t=Rn(e.manual);if(!n&&!t)throw new w(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function ea(e){if(!e.database||!e.kek)throw new w(500,"database_not_configured","A database and kek are required to issue connect links.")}async function kl(e,n){let t=n?.plugin?.trim();if(!t)throw $("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",o=yo(e,t);ml(o);let i=ho(e);ea(e);let a=await Ys(o,e);if(!a.configured)throw new w(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=kn(Fe(t,r),e.kek),u;try{u=new URL(i.baseUrl)}catch{throw new w(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return u.searchParams.set("state",s),{connectUrl:u.toString(),expiresAt:new Date(Date.now()+to).toISOString(),tenantId:r}}async function wl(e,n,t){ea(n);let r=t.tenantId?.trim()||"default",o={tenantId:r,oauthMode:t.oauthMode},i=t.plugin?.trim();i&&(o.plugin=i);let a=t.providerName?.trim();a&&(o.providerName=a);let s=await Ft(e,o);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt,tenantId:r}}async function Qt(e,n,t){return bl(n),n.hub?wl(e,n,t):kl(n,t)}async function Xt(e,n,t){if(n.hub&&!Rn(n.manual))throw new w(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw $("state is required",{missingFields:["state"]});ho(n);try{return await io(e,r)}catch(o){if(o instanceof ce)switch(o.code){case"invalid_state":throw $("Invalid or expired state");case"client_id_not_configured":throw new w(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new w(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function er(e,n,t){if(n.hub&&!Rn(n.manual))throw new w(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),o=t?.state?.trim(),i=[];if(r||i.push("code"),o||i.push("state"),i.length)throw $("Missing required fields",{missingFields:i});let a=ho(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:o,redirectUri:a.redirectUri,callbackParams:t.callbackParams})}catch(u){if(u instanceof Error&&u.name==="OAuthCallbackError")switch(u.code){case"invalid_state":throw $("Invalid or expired state");case"credentials_not_configured":throw new w(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new w(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function bo(e,n){if(!e.database)throw Be("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw Be("Permission not found");return $t(e,t)}async function na(e,n){return"id"in n?mo(e,n.id):bo(e,n.token)}import{createCipheriv as Il,createDecipheriv as hh,randomBytes as ia,scryptSync as Sl}from"crypto";import{createHmac as ko,randomUUID as Cl,timingSafeEqual as ra}from"crypto";function wo(e){return e.run??null}function Co(e){return e.probe??null}function oa(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function nr(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=ko("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":Cl()}}}function To(e){let n=e.signingSecret.trim();if(!n)return!1;let t=oa(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>Ze)return!1;let i=ko("sha256",n).update(e.body).digest("hex");try{return ra(Buffer.from(i,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function _n(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=oa(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>Ze)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let i=ko("sha256",n).update(e.body).digest("hex");try{if(!ra(Buffer.from(i,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function En(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function tr(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function rr(e){let n=e.sync?.encrypted;return typeof n!="string"||!n.trim()?null:{encrypted:n.trim()}}function Qn(e){let n=e.connectUrl?.trim();return n?{connectUrl:n,expiresAt:e.expiresAt}:null}function Po(e){return Qn(En(e))}async function vo(e){let n=await sr({deliveryUrl:e.deliveryUrl,projectId:e.projectId,signingSecret:e.signingSecret,type:"connect.create_link",payload:{tenantId:e.tenantId,plugins:e.plugins}}),t=En(n.body),r=tr({httpOk:n.ok,status:n.status,body:t}),o=Qn(t);if(!r||!o)throw new Error(ir({deliveryUrl:e.deliveryUrl,status:n.status,body:n.body,ack:t}));return o}function or(e){return rr(En(e))}function Tl(e){let n=e;for(;n;){if(n instanceof Error){let t=n.code;if(typeof t=="string")return t;n=n.cause;continue}if(typeof n=="object"&&n!==null&&"code"in n){let t=n.code;if(typeof t=="string")return t}break}}function ta(e,n=200){let t=e.trim();return t.length<=n?t:`${t.slice(0,n)}\u2026`}var Pl="Verify hub.signingSecret in your app matches the signing secret shown in Hub project settings.",vl="Check the delivery URL configured for this environment.";function Rl(e){return`${e.ack.error?`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`:`App rejected the signed delivery (HTTP ${e.status} from ${e.deliveryUrl})`}. ${Pl}`}function Al(e){return`${e.ack.error?`${e.ack.error} (HTTP 404 from ${e.deliveryUrl})`:`Delivery endpoint not found at ${e.deliveryUrl} (HTTP 404)`}. ${vl}`}function Xn(e,n){let t=Tl(n),r=n instanceof Error?n.message:"Delivery request failed",o;switch(t){case"ECONNREFUSED":o="connection refused \u2014 nothing accepted a TCP connection on that host and port";break;case"ENOTFOUND":o="host not found \u2014 DNS could not resolve the hostname";break;case"ETIMEDOUT":case"UND_ERR_CONNECT_TIMEOUT":o="connection timed out before the app responded";break;case"ECONNRESET":o="connection reset while talking to the app";break;case"CERT_HAS_EXPIRED":case"UNABLE_TO_VERIFY_LEAF_SIGNATURE":case"DEPTH_ZERO_SELF_SIGNED_CERT":o=`TLS certificate error (${t})`;break;default:o=r==="fetch failed"&&t?`${r} (${t})`:r}return[`Could not reach ${e}`,o].join(". ")}function ir(e){if(e.status===0)return e.ack.error?e.ack.error:e.body.startsWith("Could not reach")?e.body:Xn(e.deliveryUrl,new Error(e.body||"Delivery request failed"));if(e.status===401||e.status===403)return Rl(e);if(e.status===404)return Al(e);if(e.ack.error)return`${e.ack.error} (HTTP ${e.status} from ${e.deliveryUrl})`;if(e.status>=500){let t=e.body.trim();return t?`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl}): ${ta(t)}`:`App failed while processing the delivery (HTTP ${e.status} from ${e.deliveryUrl})`}let n=e.body.trim();return n?`${ta(n)} (HTTP ${e.status} from ${e.deliveryUrl})`:`Delivery failed with HTTP ${e.status} from ${e.deliveryUrl}`}var xl=15e3;async function sr(e){let{body:n,headers:t}=nr(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n,signal:AbortSignal.timeout(xl)}),o=await r.text();return{ok:r.ok,status:r.status,body:o}}catch(r){return{ok:!1,status:0,body:Xn(e.deliveryUrl,r)}}}var _l="aes-256-gcm",El=12,Ml=16,Ol=16,Dl=32;function Hl(e,n){return Sl(e.trim(),n,Dl)}function Ro(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required to encrypt sync manifest");let r=ia(Ol),o=Hl(t,r),i=ia(El),a=Il(_l,o,i,{authTagLength:Ml}),s=JSON.stringify(e),u=Buffer.concat([a.update(s,"utf8"),a.final()]),l=a.getAuthTag();return[r.toString("base64"),i.toString("base64"),l.toString("base64"),u.toString("base64")].join(":")}var Ul=["invalid corsair instance","a database must be configured to sync connections from the app","a database must be configured on the corsair instance","signing secret is required to encrypt sync manifest"];function Ao(e){if(e instanceof Ji)return!1;if(!(e instanceof Error))return!0;let n=e.message.toLowerCase();return!Ul.some(t=>n.includes(t))}function Fl(e){if(!e)return[];let n=M(e);return n?(e.authConfig?.[n]?.integration??[]).filter(r=>!Ue(r)):[]}async function et(e,n){let t=R(e);if(!t.database)throw new Error("A database must be configured to sync connections from the app");await Ht(e,{silent:!0});let[r,o]=await Promise.all([Sn(t),In(t)]),i={tenants:r.map(a=>({id:a.id})),plugins:o.map(a=>{let s=Fl(t.plugins.find(u=>u.id===a.id));return{id:a.id,authType:a.authType,configured:a.configured,missingFields:a.missingFields,...s.length>0?{integrationCredentialFields:s}:{}}}),syncedAt:new Date().toISOString()};return Ro(i,n)}var fe=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function ar(e,n){let t=R(e,()=>new fe("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new fe("no_database","Database not configured");let r=Q(t,n.plugin,c=>new fe("plugin_not_found",c)),o=M(r);if(!o)throw new fe("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(o==="oauth_2"||o==="managed")throw new fe("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await vn(e,n.tenantId);let i=new Set(ht(r,o)),s=r.authConfig?.[o]?.account??[],u=N({authType:o,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),l=0;for(let[c,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(c))throw new fe("invalid_credentials",`Unknown credential field '${c}' for plugin '${n.plugin}'`);let p=se(u,`set_${c}`);if(!p)throw new fe("invalid_credentials",`Cannot set credential field '${c}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new fe("invalid_credentials","Provide at least one credential field to save");return await ve(e,{plugin:r,tenantId:n.tenantId}).catch(()=>{}),{plugin:n.plugin,tenantId:n.tenantId}}var ye=class extends Error{code;constructor(n,t){super(t),this.name="IntegrationCredentialsDeliveryError",this.code=n}};async function xo(e,n){let t=R(e,()=>new ye("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new ye("no_database","Database not configured");let r=Q(t,n.plugin,c=>new ye("plugin_not_found",c)),o=M(r);if(!o)throw new ye("invalid_credentials",`Plugin '${r.id}' has no authType configured`);await Fs(e);let i=new Set(Xi(r,o)),s=r.authConfig?.[o]?.integration??[],u=K({authType:o,integrationName:n.plugin,kek:t.kek,database:t.database,extraIntegrationFields:s}),l=0;for(let[c,d]of Object.entries(n.credentials)){if(!d.trim())continue;if(!i.has(c))throw new ye("invalid_credentials",`Unknown integration credential field '${c}' for plugin '${n.plugin}'`);let p=se(u,`set_${c}`);if(!p)throw new ye("invalid_credentials",`Cannot set integration field '${c}' for plugin '${n.plugin}'`);await p(d.trim()),l+=1}if(l===0)throw new ye("invalid_credentials","Provide at least one integration credential field to save");return{plugin:n.plugin}}var ur=new Map;function Bl(e){for(let[n,t]of ur)t<=e&&ur.delete(n)}function cr(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};if(!Number.isFinite(n)||n<=0)return{ok:!1,error:"Delivery replay TTL must be a positive number"};let r=Date.now();Bl(r);let o=ur.get(t);return o!==void 0&&o>r?{ok:!1,error:"Delivery request already consumed"}:(ur.set(t,r+n),{ok:!0})}var Le=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function Mn(e,n){let{plugin:t,tenantId:r,accessToken:o,refreshToken:i,expiresIn:a,scope:s,authType:u="managed",providerData:l}=n;if(!o.trim())throw new Le("no_access_token","Managed OAuth delivery missing access_token");let c=R(e,()=>new Le("invalid_corsair_instance","Invalid corsair instance"));if(!c.database)throw new Le("no_database","No database configured on corsair instance");let d=Q(c,t,g=>new Le("plugin_not_found",g));await vn(e,r);let p=N({authType:u,integrationName:t,tenantId:r,kek:c.kek,database:c.database});await p.set_access_token(o),i&&await p.set_refresh_token(i),a&&await p.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await p.set_scope(s),await ve(e,{plugin:d,tenantId:r}).catch(()=>{});try{let g=await Mt(c.plugins,t,{access_token:o,refresh_token:i,scope:s,...l});if(g){try{let f=d.authConfig?.[u]?.account??[];await Tn({database:c.database,kek:c.kek,pluginId:t,tenantId:r,link:g,authType:u,extraAccountFields:f})}catch(f){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,f)}c.hub&&wn(c.hub,{plugin:t,tenantId:r,link:g,authType:u})}}catch(g){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,g)}return await Pn(e,d,r,p).catch(g=>{console.warn(`[corsair:managed-oauth] subscribe failed for '${t}' tenant '${r}':`,g)}),{plugin:t,tenantId:r}}function Ll(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function sa(e,n,t=[]){for(let[r,o]of Object.entries(e))if(Ll(o)){if(o.match(n))return{webhook:o,path:[...t,r]}}else if(o&&typeof o=="object"){let i=sa(o,n,[...t,r]);if(i)return i}return null}function Nl(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function $l(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function aa(e,n,t,r,o){let i=Nl(n),a=typeof t=="string"?JSON.parse(t):t;(!a||typeof a=="object"&&Object.keys(a).length===0)&&i["x-goog-resource-uri"]&&(a=$l(i)||a);let u={headers:i,body:a,...r?{query:r}:{}},l=r?.tenantId||"default",c=e.withTenant?e.withTenant(l):e,d=o?.plugin,p=d?[d]:Ct;for(let g of p){let f=c[g];if(!f||!f.webhooks||!d&&f.pluginWebhookMatcher&&!f.pluginWebhookMatcher(u))continue;let h=sa(f.webhooks,u);if(!h)continue;let b=h.path.join("."),k={payload:a,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{},...o?.hubVerified?{hubVerified:!0}:{}};try{let P=await h.webhook.handler(k),A=!!Object.keys(P.returnToSender||{})?.length;return{plugin:g,action:b,body:a,response:A?{...P?.returnToSender,success:!0}:{success:!0},...P.responseHeaders&&{responseHeaders:P.responseHeaders}}}catch(P){return console.error(`Error executing webhook handler for ${g}.${b}:`,P),{plugin:g,action:b,body:a,response:{success:!1,error:P instanceof Error?P.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{createHash as Wl}from"crypto";import*as Ye from"vm";var ua="__corsairFailedStep",ql=3e4,Io=class{constructor(n,t){this.wakeAt=n;this.stepName=t}__corsairSleep=!0};function ca(e){return typeof e=="object"&&e!==null&&e.__corsairSleep===!0}function la(e,n){return`st_${Wl("sha256").update(`${n} ${e}`).digest("hex").slice(0,16)}`}function lr(e){if(e instanceof Error)return e.message;if(e!==null&&typeof e=="object"&&"message"in e){let n=e.message;if(typeof n=="string")return n}return String(e)}var da=new Set(["constructor","prototype","__proto__"]);function Re(e,n){if(e===null)return null;let t=typeof e;return t==="function"?Kl(e,n):t==="object"?jl(e):e}function jl(e){return new Proxy(e,{get(n,t){if(!da.has(t))return Re(Reflect.get(n,t,n),n)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Kl(e,n){return new Proxy(e,{apply:(t,r,o)=>Zl(Reflect.apply(t,n,o)),construct(){throw new Error("Workflow code may not construct host objects")},get(t,r){if(!da.has(r))return Re(Reflect.get(t,r,t),t)},getPrototypeOf:()=>null,setPrototypeOf:()=>!1,defineProperty:()=>!1,set:()=>!1,deleteProperty:()=>!1})}function Zl(e){return e!==null&&typeof e=="object"&&typeof e.then=="function"?Promise.resolve(e).then(n=>Re(n,void 0),n=>{throw Re(n,void 0)}):Re(e,void 0)}function Gl(e){let n=Object.create(null),t=Ye.createContext(n,{name:"corsair-workflow",codeGeneration:{strings:!1,wasm:!1}}),o=Ye.runInContext("(s) => JSON.parse(s)",t,{filename:"corsair:sandbox:json"})(JSON.stringify(e.payload??null)),a=Ye.runInContext(`(function (hostRun, hostSleep) {
+			const step = function step(name, fn) { return hostRun(name, fn); };
+			step.sleep = function sleep(name, ms) { return hostSleep(name, ms); };
+			return step;
+		})`,t,{filename:"corsair:sandbox:step"})((p,g)=>e.step(p,g),(p,g)=>e.step.sleep(p,g)),u=Ye.runInContext(`(function (sink) {
+			const fwd = (level) => function () {
+				try { sink(level, Array.prototype.slice.call(arguments)); } catch (_e) {}
+			};
+			return { log: fwd('log'), info: fwd('info'), warn: fwd('warn'), error: fwd('error'), debug: fwd('debug') };
+		})`,t,{filename:"corsair:sandbox:console"})((p,g)=>{let f=console[p]??console.log;try{f(...g)}catch{}});n.__corsair=Re(e.corsair,void 0),n.__payload=o,n.__step=a,n.__console=u;let l=Ye.runInContext(`(function () {
+			'use strict';
+			const module = { exports: {} };
+			const require = function (id) {
+				throw new Error('Workflow code may not import modules (attempted to require "' + id + '")');
+			};
+			(function (exports, module, require, console) {
+${e.code}
+			})(module.exports, module, require, __console);
+			const main = module.exports.main;
+			if (typeof main !== 'function') {
+				throw new Error('Workflow code must export a \`main\` function');
+			}
+			return main(__corsair, __payload, __step);
+		})()`,t,{filename:"corsair:workflow",timeout:e.timeoutMs});l.catch(()=>{});let c,d=new Promise((p,g)=>{c=setTimeout(()=>g(new Error(`Workflow exceeded ${e.timeoutMs}ms time limit`)),e.timeoutMs)});return Promise.race([l,d]).finally(()=>clearTimeout(c))}async function So(e){let n=e.memoizedSteps??{},t=[],r=0,o=null,i=(async(a,s)=>{if(o)throw o;let u=r++,l=la(a,u);if(Object.hasOwn(n,l))return Re(n[l].output,void 0);try{let c=await s();return t.push({stepId:l,name:a,seq:u,status:"completed",output:c}),c}catch(c){if(ca(c))throw c;let d=lr(c);t.push({stepId:l,name:a,seq:u,status:"failed",error:d});let p=new Error(d);throw p[ua]=a,p}});i.sleep=async(a,s)=>{if(o)throw o;let u=r++,l=la(a,u);if(Object.hasOwn(n,l))return;t.push({stepId:l,name:a,seq:u,status:"completed",output:null});let c=Number.isFinite(s)?Math.max(0,s):0;throw o=new Io(Date.now()+c,a),o};try{await Gl({code:e.code,corsair:e.corsair,payload:e.payload,step:i,timeoutMs:e.timeoutMs??ql});let a=o;return a?{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()}:{status:"completed",steps:t}}catch(a){if(ca(a))return{status:"sleeping",steps:t,sleepUntil:new Date(a.wakeAt).toISOString()};let s=lr(a),u=a!==null&&typeof a=="object"?a[ua]:void 0;return{status:"failed",steps:t,error:{message:s,...u?{failedStep:u}:{}}}}}import*as dr from"vm";var pa=1e4;async function _o(e){let n=Object.create(null),t=dr.createContext(n,{name:"corsair-probe",codeGeneration:{strings:!1,wasm:!1}});n.corsair=Re(e.corsair,void 0);let r=Jl(e.timeoutMs),o=`(async () => {
+const __result = await (async () => {
+${e.code}
+})();
+return JSON.stringify(__result) ?? 'null';
+})()`;try{let i=await go(()=>{let a=dr.runInContext(o,t,{filename:"corsair:probe",timeout:r});a.catch(()=>{});let s,u=new Promise((l,c)=>{s=setTimeout(()=>c(new Error(`Probe exceeded ${r}ms time limit`)),r)});return Promise.race([a,u]).finally(()=>clearTimeout(s))});return{status:"ok",value:zl(i)}}catch(i){return{status:"error",error:lr(i)}}}function zl(e){if(typeof e!="string")throw new Error(`Probe returned a non-string result (${typeof e})`);return JSON.parse(e)}function Jl(e){return typeof e!="number"||!Number.isFinite(e)||e<=0?pa:Math.min(e,pa)}function Qe(e){return e.deliveryMode==="auth.credentials"}function nt(e){return e.deliveryMode==="connections.sync"}function pr(e){return e.deliveryMode==="connect.create_link"}function tt(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function rt(e){return e.deliveryMode==="oauth.tokens"}function gr(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!Qe(e)&&!nt(e)&&!pr(e)&&!tt(e)&&!rt(e)}function Vl(e){return{status:"ok",connectLink:{connectUrl:e.connectUrl,expiresAt:e.expiresAt},webhookResponse:{status:200,body:{status:"ok",connectUrl:e.connectUrl,expiresAt:e.expiresAt}}}}async function Yl(e,n){try{return{status:"ok",webhookResponse:{status:200,body:{status:"ok",sync:{encrypted:await et(e,n)}}}}}catch(t){return{status:"failed",retryable:Ao(t),error:t instanceof Error?t.message:"Connections sync delivery failed"}}}async function Ql(e,n){try{let t=await Bt(e,n);return Vl(t)}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Connect link delivery failed"}}}function Eo(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function Xl(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await Ot({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function ed(e,n,t,r){let o=await Xl(e,n,t),i={...t.query??{},...o?{tenantId:o}:{}},a=await aa(e,t.headers,t.body,i,{plugin:t.plugin,hubVerified:r&&t.hubVerified===!0});if(!a.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(a.response&&a.response.success===!1)return{status:"failed",retryable:!1,error:typeof a.response.error=="string"?a.response.error:"Webhook handler failed"};let s=a.response?.returnToSender,u=s&&typeof s=="object"&&typeof s.validationToken=="string"&&Object.keys(s).length===1?s.validationToken:s||(a.response?.data??a.response);return{status:"ok",webhookResponse:{status:a.response?.statusCode??200,body:u,headers:a.responseHeaders}}}async function nd(e,n){return await Yn(e,{code:n.code,state:n.state,redirectUri:n.redirectUri,callbackParams:n.callbackParams,...n.plugin&&n.tenantId?{trusted:!0,plugin:n.plugin,tenantId:n.tenantId}:{}}),{status:"ok"}}async function td(e,n){return await Mn(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope,authType:n.authType,providerData:n.providerData}),{status:"ok"}}async function Oo(e,n,t){let r=await Mo(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function Mo(e,n,t){let r=R(e),o=n.token?.trim();if(!o)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let i=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",o).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<i?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function rd(e,n){try{return await ar(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function od(e,n){try{return await xo(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Integration credential delivery failed"}}}function ga(e,n){let t=e;return n&&typeof t?.withTenant=="function"?t.withTenant(n):e}async function id(e,n){try{let t=ga(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",run:await So({corsair:t,code:n.code,payload:n.trigger?.payload??null,memoizedSteps:n.memoizedSteps})}}}}catch(t){return{status:"failed",retryable:!0,error:t instanceof Error?t.message:"Workflow run failed"}}}async function sd(e,n){try{let t=ga(e,n.tenantId);return{status:"ok",webhookResponse:{status:200,body:{status:"ok",probe:await _o({corsair:t,code:n.code,timeoutMs:n.timeoutMs})}}}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Probe failed"}}}async function ot(e,n,t={}){let r=R(e),o=Eo(n.headers,"x-corsair-signature"),i=Eo(n.headers,"x-corsair-timestamp"),a=Eo(n.headers,"x-corsair-nonce"),s=!1;if(t.signingSecret?.trim()){let l=_n({body:n.body,signatureHeader:o,timestampHeader:i,signingSecret:t.signingSecret});if(!l.ok)return{status:"failed",retryable:!1,error:l.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let c=cr(`nonce:${a.trim()}`,Ze);if(!c.ok)return{status:"failed",retryable:!1,error:c.error};s=!0}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let u;try{u=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}if(u.type==="connect.status")return{status:"failed",retryable:!1,error:"connect.status is deprecated; use connections.sync signed delivery instead"};switch(u.type){case"webhook":return ed(e,r,u.payload,s);case"oauth.callback":return nd(e,u.payload);case"oauth.tokens":return td(e,u.payload);case"permission.approve":return Mo(e,u.payload,"approved");case"permission.deny":return Mo(e,u.payload,"denied");case"auth.credentials":return rd(e,u.payload);case"integration.credentials":return od(e,u.payload);case"connect.create_link":return Ql(e,u.payload);case"connections.sync":{let l=t.signingSecret?.trim();return l?Yl(e,l):{status:"failed",retryable:!1,error:"Tunnel signing secret is required for connections.sync"}}case"run":return t.allowWorkflowExecution?id(e,u.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};case"probe":return t.allowWorkflowExecution?sd(e,u.payload):{status:"failed",retryable:!1,error:"Workflow execution is not enabled (set allowWorkflowExecution: true)"};default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${String(u.type)}`}}}function ad(e){let n=e.webhookResponse;return e.status==="ok"?{status:n?.status??200,body:n?.body??{status:"ok"}}:{status:n?.status??502,body:n?.body??{status:"error",error:e.error??"delivery failed"}}}var Do=3,ud=250;function cd(e){return e?.name==="AbortError"}async function ld(e){try{return(await e.json())?.ok!==!1}catch{return!0}}async function dd(e,n,t,r,o){for(let i=1;i<=Do;i++){try{let a=await n.fetch(`${e.apiUrl}/api/dev/ack`,{method:"POST",headers:{...t,"content-type":"application/json"},body:JSON.stringify(r),signal:o});if(a.ok)return await ld(a)||console.warn(`[corsair] hub did not record delivery ${r.deliveryId} (already timed out); the run may be retried`),!0}catch(a){if(cd(a))throw a}i<Do&&await ya(ud)}return console.warn(`[corsair] failed to acknowledge delivery ${r.deliveryId} after ${Do} attempts; the run may be retried`),!1}async function pd(e,n,t,r){let o={authorization:`Bearer ${n.projectApiKey}`},i=await t.fetch(`${n.apiUrl}/api/dev/pull`,{headers:o,signal:r});if(i.status===204)return"idle";if(!i.ok)return"error";let{deliveryId:a,body:s,headers:u}=await i.json(),l=await t.process(e,{headers:u,body:s},{signingSecret:n.signingSecret,allowWorkflowExecution:n.allowWorkflowExecution}),{status:c,body:d}=ad(l);return await dd(n,t,o,{deliveryId:a,status:c,body:d},r)?"handled":"error"}var fa=1e3,gd=5e3,fd=3e4;function ya(e){return new Promise(n=>setTimeout(n,e))}var fr=globalThis.__corsairConnectLoops??=new Map;function yd(e,n={fetch,process:ot}){let t;try{t=j(e)}catch{return{stop:()=>{}}}if(!t.projectApiKey.startsWith("ck_dev_"))return{stop:()=>{}};if(!t.allowWorkflowExecution)return console.warn("[corsair] workflow executions not enabled. Please set hub: { ..., allowWorkflowExecution: true }"),{stop:()=>{}};let r=t.projectApiKey;if(fr.has(r))return{stop:()=>{}};let o=Symbol("corsair-connect-loop");fr.set(r,o);let i=()=>{fr.get(r)===o&&fr.delete(r)},a=!1,s=null;return(async()=>{let l=fa,c=!1,d=async p=>{c||(console.warn("[corsair] connect loop error; retrying",p),c=!0),a||await ya(l),l=Math.min(l*2,gd)};try{for(;!a;){s=new AbortController;let p=setTimeout(()=>s?.abort(),fd);try{await pd(e,t,n,s.signal)==="error"?await d("pull or ack failed"):(c=!1,l=fa)}catch(g){if(a)break;await d(g instanceof Error?g.message:g)}finally{clearTimeout(p)}}}finally{i()}})(),{stop:()=>{a=!0,s?.abort(),i()}}}function ma(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function md(e,n){return n&&!n.has(e.id)?!1:M(e)!==null}async function ha(e,n,t={}){let r=R(e),o=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,a=await Jn(r,o,{pluginIds:t.pluginIds}),s=new Map(a.map(l=>[l.plugin,l])),u=r.plugins.filter(l=>md(l,i)).map(l=>{let c=M(l),d=s.get(l.id);return d?{plugin:l.id,providerName:Oe(l.id),authKind:ma(c),status:d.status,connected:d.connected,fields:d.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:d.missingRequiredFields}:{plugin:l.id,providerName:Oe(l.id),authKind:ma(c),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:o,plugins:u}}async function ba(e,n){let t=j(e);return Z({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:Pt})}var Ho=/^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;function hd(e){return typeof e=="string"&&e.length>0}function yr(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty managed pricing credentials payload");let n=e;if(!hd(n.api_key))throw new Error("Hub API returned incomplete managed pricing credentials (expected api_key)");let t={api_key:n.api_key};n.expires_in!==void 0&&typeof n.expires_in=="number"&&Number.isFinite(n.expires_in)&&n.expires_in>0&&(t.expires_in=n.expires_in),typeof n.usage_path=="string"&&Ho.test(n.usage_path)&&(t.usage_path=n.usage_path);let r=n.job;r?.role==="start"&&typeof r.id_path=="string"&&Ho.test(r.id_path)&&(t.job={role:"start",id_path:r.id_path,...typeof r.status_operation=="string"?{status_operation:r.status_operation}:{}});let o=n.failed_when;return o&&typeof o.path=="string"&&Ho.test(o.path)&&(typeof o.equals=="boolean"||typeof o.equals=="string"||typeof o.equals=="number"&&Number.isFinite(o.equals)?t.failed_when={path:o.path,equals:o.equals}:o.equals===void 0&&o.empty===!0&&(t.failed_when={path:o.path,empty:!0})),t}var ka=1024*1024,wa=3e4;function Xe(e){return e!==void 0&&Number.isFinite(e)&&e>0?e:ka}function en(e){return e!==void 0&&Number.isFinite(e)&&e>=0?e:wa}function On(e){return new w(413,"payload_too_large",`Request body exceeds the ${e}-byte limit`)}function bd(e){return new w(408,"request_timeout",`Request body stalled: no bytes received for ${e}ms`)}async function mr(e,n){if(!(n>0))return e();let t;try{return await Promise.race([e(),new Promise((r,o)=>{t=setTimeout(()=>o(bd(n)),n)})])}finally{clearTimeout(t)}}async function hr(e,n){if(e.body===null)return"";let t=e.body.getReader();try{let r=[],o=0;for(;;){let{done:s,value:u}=await mr(()=>t.read(),n.bodyStallTimeoutMs);if(s)break;if(o+=u.byteLength,o>n.maxBodyBytes)throw On(n.maxBodyBytes);r.push(u)}let i=new Uint8Array(o),a=0;for(let s of r)i.set(s,a),a+=s.byteLength;return new TextDecoder().decode(i)}catch(r){throw t.cancel().catch(()=>{}),r}}var Uo=new Map;function Ca(e){let n;try{n=j(e)}catch{return}let t=jr(n);t&&Uo.get(n.projectApiKey)!==t&&(Uo.set(n.projectApiKey,t),S({hub:n,path:"/apps/announce",body:{deliveryUrl:t},parseResponse:()=>({ok:!0})}).catch(()=>{Uo.delete(n.projectApiKey)}))}var kd=[".corsair.dev"];function wd(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function Cd(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:wd(n)?!0:kd.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function Ta(e){return!e||!Cd(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function Pa(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,o]of Object.entries(n))t.set(r,o);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function Fo(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function Bo(e,n){let t=j(e),o=new URL(n).searchParams.get("d");if(!o)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let i=He(o,t.signingSecret);if(!i)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=cr(`browser:${i.jti}`,De);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(nt(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connections sync delivery requires hubOrigin and requestId for client bridge"}};let s=await et(e,t.signingSecret);return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:fn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",sync:{encrypted:s}}})}}if(pr(i)){if(!i.hubOrigin||!i.requestId)return{type:"json",status:400,body:{error:"Connect link delivery requires hubOrigin and requestId for client bridge"}};let s=i.connectLinkPlugins?.filter(Boolean)??[];if(s.length===0)return{type:"json",status:400,body:{error:"Connect link delivery requires at least one plugin in connectLinkPlugins"}};let u=await Bt(e,{tenantId:i.tenantId,plugins:s});return{type:"text",status:200,headers:{"Content-Type":"text/html; charset=utf-8"},body:fn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!0,body:{status:"ok",connectUrl:u.connectUrl,expiresAt:u.expiresAt}})}}if(Qe(i))return i.hubSuccessUrl?i.credentials?(await ar(e,{plugin:i.plugin,tenantId:i.tenantId,credentials:i.credentials}),{type:"redirect",url:Fo(i.hubSuccessUrl,{connectedPlugin:i.plugin})}):{type:"redirect",url:Fo(i.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(tt(i)){if(!i.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await Oo(e,i.permissionToken,i.deliveryMode==="permission.approve"?"approved":"denied")}else if(rt(i)){if(!i.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await Mn(e,{plugin:i.plugin,tenantId:i.tenantId,accessToken:i.accessToken,refreshToken:i.refreshToken,expiresIn:i.expiresIn,scope:i.scope,authType:i.authType,providerData:i.providerData})}else{if(!gr(i)||!i.code||!i.state||!i.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await Yn(e,{code:i.code,state:i.state,redirectUri:i.redirectUri,trusted:!0,plugin:i.plugin,tenantId:i.tenantId})}}catch(s){let u=s instanceof Error?s.message:"Hub delivery failed";return nt(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:fn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:u})}:pr(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:fn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:u})}:Qe(i)&&i.hubSuccessUrl?{type:"redirect",url:Fo(i.hubSuccessUrl,{error:u})}:Qe(i)&&i.hubOrigin&&i.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:fn({hubOrigin:i.hubOrigin,requestId:i.requestId,ok:!1,error:u})}:{type:"json",status:400,body:{error:u}}}return{type:"redirect",url:i.hubSuccessUrl}}async function Lo(e,n){let t=j(e),r=await ot(e,n,{signingSecret:t.signingSecret,allowWorkflowExecution:t.allowWorkflowExecution});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let o=r.webhookResponse;if(!o)return{type:"json",status:200,body:{status:"ok"}};let i=o.status??200,a=o.headers;return o.body&&typeof o.body=="object"&&!(o.body instanceof ArrayBuffer)?{type:"json",status:i,body:o.body,headers:a}:{type:"text",status:i,body:typeof o.body=="string"?o.body:o.body?JSON.stringify(o.body):null,headers:a}}function No(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function $o(e,n){return n.method==="GET"?Bo(e,n.url):Lo(e,{headers:n.headers,body:n.body??""})}async function Wo(e,n){try{let t=await $o(e,n);return No(t)}catch(t){if(t instanceof Pe)return Response.json({error:t.message},{status:503});throw t}}async function nn(e,n,t){Ca(e);let r=n.method.toUpperCase(),o=Ta(n.headers.get("origin"));if(r==="OPTIONS")return o?new Response(null,{status:204,headers:o}):Response.json({error:"Method not allowed"},{status:405});if(r!=="GET"&&r!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await Wo(e,{method:r,url:n.url,headers:n.headers,body:r==="POST"?await hr(n,{maxBodyBytes:Xe(t?.maxBodyBytes),bodyStallTimeoutMs:en(t?.bodyStallTimeoutMs)}):void 0});return Pa(i,o)}var E=class extends Error{pluginId;authType;connectUrl;tenantId;constructor(n,t,r,o){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t,this.connectUrl=o?.connectUrl??null,this.tenantId=o?.tenantId??null}};function Dn(e){if(e.forceRefresh||!e.accessToken)return!1;if(!e.expiresAt)return!0;let n=e.now??Math.floor(Date.now()/1e3);return Number(e.expiresAt)>n+300}async function Hn(e,n,t){let r=Math.floor(Date.now()/1e3),o=t?Number(t):Number.NaN,i=typeof n.expires_in=="number"?r+n.expires_in:Number.isFinite(o)&&o>r?o:r+3600;return await e.set_access_token(n.access_token),await e.set_expires_at(String(i)),n.refresh_token&&await e.set_refresh_token(n.refresh_token),n.scope&&await e.set_scope(n.scope),i}var va=new WeakMap;function Ae(e,n,t){let r=va.get(e);r||(r=new Map,va.set(e,r));let o=r.get(n);if(o!==void 0)return o;let i=t().finally(()=>{r.delete(n)});return r.set(n,i),i}var Ra=300;async function qo(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,a=n?.forceRefresh??!1,s=`managed:${o}:${i}`;return Ae(t,s,async()=>{let[u,l,c]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!u&&!c)throw new E(o,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&u&&l&&Number(l)>d+Ra)return{accessToken:u,expiresAt:Number(l),refreshed:!1};if(!c&&u&&!a){let f=l?Number(l):null;if(f===null||f>d+Ra)return{accessToken:u,expiresAt:f??d+3600,refreshed:!1}}if(!c)throw new E(o,"managed");let p=await Pd(r,o,i,c),g=await Hn(t,p,l);return{accessToken:p.access_token,expiresAt:g,refreshed:!0}})}function Td(e){return e.includes("Managed OAuth connection not found")||e.includes("Managed OAuth connection has no tokens")}async function Pd(e,n,t,r){try{return await S({hub:e,path:"/oauth/refresh",body:{plugin:n,tenantId:t,refresh_token:r},parseResponse:gn})}catch(o){let i=o instanceof Error?o.message:"";throw Td(i)?new E(n,"managed"):o}}async function Aa(e,n){e._refreshAuth=async()=>(await qo(n,{forceRefresh:!0})).accessToken}import{randomUUID as Ad}from"crypto";import{createHmac as vd}from"crypto";var Rd="x-corsair-runtime-proof";function it(e,n){if(!e.runtimeProofKey)return{};let t=Math.floor((n.nowMs??Date.now())/1e3),r=vd("sha256",e.runtimeProofKey).update([t,n.path,n.plugin,n.tenantId,n.operation].join(`
+`)).digest("base64url");return{[Rd]:`t=${t},v1=${r}`}}var xd="",Id=60,Sd=1e4,jo=new WeakMap;function br(e){let n=Rt(e.apiUrl),t=e.instanceKey?.trim()??"";return[encodeURIComponent(n),encodeURIComponent(e.projectApiKey),encodeURIComponent(t)].join(xd)}function _d(e,n,t,r){let i=`${br(e)}:${n}:${t}`;return r?`${i}:${r}`:i}function Ed(e,n){return jo.get(e)?.get(n)}function Md(e,n,t){let r=jo.get(e);r||(r=new Map,jo.set(e,r)),r.set(n,t)}function Od(e,n){return e.expiresAt===null?!1:e.expiresAt>n+Id}function kr(e,n){if(!n)throw new E(e,"managed_pricing",`[auth-missing:${e}:managed_pricing]: Hub config is required. Pass hub: { ... } to createCorsair().`)}async function Ko(e,n){kr(e.plugin,e.hub);let t=n.operation.trim();if(!t)throw new E(e.plugin,"managed_pricing",`[auth-missing:${e.plugin}:managed_pricing]: Operation id is required for Hub metering.`);let r=n.forceRefresh??!1,o=n.idempotencyKey?.trim()||void 0,i=_d(e.hub,e.plugin,e.tenantId,t),s=`managed_pricing:${o?`call:${o}`:r?"force":"routine"}:${i}`;return Ae(e.cache,s,async()=>{let u=Math.floor(Date.now()/1e3);if(!r&&!o){let d=Ed(e.cache,i);if(d&&Od(d,u))return{apiKey:d.apiKey,expiresAt:d.expiresAt,fromCache:!0}}let l=await S({hub:e.hub,path:"/managed-pricing/credentials",body:{plugin:e.plugin,tenantId:e.tenantId,operation:t,...o?{idempotencyKey:o}:{},...n.cap!==void 0?{cap:n.cap}:{},...n.jobId?{jobId:n.jobId}:{}},extraHeaders:{...it(e.hub,{path:"/managed-pricing/credentials",plugin:e.plugin,tenantId:e.tenantId,operation:t}),"x-corsair-metered-operation":t,...o?{"x-corsair-idempotency-key":o}:{}},notFoundMessage:"Managed pricing is not configured for this project",parseResponse:yr,signal:AbortSignal.timeout(Sd)}),c=l.expires_in!==void 0?u+l.expires_in:null;return o||Md(e.cache,i,{apiKey:l.api_key,expiresAt:c}),{apiKey:l.api_key,expiresAt:c,fromCache:!1,...l.usage_path?{usagePath:l.usage_path}:{},...l.job?{startedJobIdPath:l.job.id_path}:{},...l.failed_when?{failedWhen:l.failed_when}:{}}})}function wr(){return{}}async function Zo(e,n){kr(n.plugin,e.hub);let t=e.tenantId?.trim();if(!t)throw new E(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: tenantId is required for metered credentials.`);let r=(n.operation??e.meteredOperationId)?.trim();if(!r)throw new E(n.plugin,"managed_pricing",`[auth-missing:${n.plugin}:managed_pricing]: Endpoint operation id missing \u2014 cannot meter usage.`);let o=Ad(),i={plugin:n.plugin,tenantId:t,operation:r,idempotencyKey:o};try{let a=await Ko({hub:e.hub,plugin:n.plugin,tenantId:t,cache:n.cache},{operation:r,idempotencyKey:o,cap:n.cap,jobId:n.jobId});return{apiKey:a.apiKey,call:i,...a.usagePath?{usagePath:a.usagePath}:{},...a.startedJobIdPath?{startedJobIdPath:a.startedJobIdPath}:{},...a.failedWhen?{failedWhen:a.failedWhen}:{}}}catch(a){throw Dd(a)&&await Go(e.hub,i,a),a}}function Dd(e){let n=typeof e=="object"&&e!==null&&"name"in e?e.name:void 0;return n==="TimeoutError"||n==="AbortError"||n==="TypeError"}async function xa(e,n){return(await Zo(e,n)).apiKey}function Hd(e){try{return e instanceof Error?`${e.name}: ${e.message}`:String(e)}catch{return"Unprintable thrown value"}}var Ia=3e3;function Sa(e,n){return it(e,{path:"/managed-pricing/usage/outcome",plugin:n.plugin,tenantId:n.tenantId,operation:n.operation})}async function Go(e,n,t){let r=Hd(t);try{await S({hub:e,path:"/managed-pricing/usage/outcome",body:{...n,outcome:"failed",error:r.slice(0,300)},extraHeaders:Sa(e,n),parseResponse:o=>o,signal:AbortSignal.timeout(Ia)})}catch{}}function Cr(e,n){let t=e;for(let r of n.split(".")){if(!t||typeof t!="object")return;t=t[r]}return typeof t=="number"&&Number.isFinite(t)&&t>=0?t:void 0}function _a(e,n){let t=e;for(let r of n.path.split(".")){if(!t||typeof t!="object")return!1;t=t[r]}return"empty"in n?Array.isArray(t)&&t.length===0:t===n.equals}function Ud(e){if(Array.isArray(e))for(let n of e){if(!n||typeof n!="object")continue;let{error:t,message:r}=n,o=[t,r].find(i=>typeof i=="string"&&i.length>0);if(o)return o}}function Ea(e,n){let t="empty"in n?`${n.path} was empty`:`${n.path} was ${JSON.stringify(n.equals)}`,r=e&&typeof e=="object"?e:{},o=[r.code,r.error].find(i=>typeof i=="string"&&i.length>0)??Ud(r.errors);return o?`${t}: ${o}`:t}async function Ma(e,n,t){try{await S({hub:e,path:"/managed-pricing/usage/outcome",body:{...n,outcome:"succeeded",usage:{units:t}},extraHeaders:Sa(e,n),parseResponse:r=>r,signal:AbortSignal.timeout(Ia)})}catch{}}function Oa(e){return{delivery:n=>nn(e,n),deliveryOptions:n=>nn(e,n)}}var Da=1200*1e3;function zo(){return Te()}function Jo(){return Da}function Vo(e,n){return Zn(e,n,Da)}function Yo(e,n){return de(e,n)}function Qo(e){return Ge(e)}var Ha=600*1e3;function Xo(){return Te()}function ei(){return Ha}function ni(e,n){return Zn(e,n,Ha)}function ti(e,n){return de(e,n)}function ri(e){return Yr(e)}function oi(e){return Ge(e)}function ii(){return Te()}function si(e,n,t){return xt(e,n,Math.floor(t.getTime()/1e3))}function ai(e,n){return de(e,n)}function ui(e){return Ge(e)}var tn=class extends Error{constructor(){super(`Corsair KEK is missing. Pass \`kek\` to createCorsair() or set CORSAIR_KEK in your environment. Generate one with: openssl rand -base64 ${bt}`),this.name="CorsairKekMissingError"}};function Tr(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(o,i){if(e&&!n)throw new tn;let a=t.length>1;throw new Error(`corsair.keys.${String(i)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${bt}`)}})}async function Fd(e){let n=!1;for(;;){let t=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.integrationName).executeTakeFirst();if(!t){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Integration "${e.integrationName}" not found. Make sure to create the integration first.`)}let r=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",t.id).executeTakeFirst();if(!r){if(!n&&e.ensureProvisioned){n=!0,await e.ensureProvisioned();continue}throw new Error(`Account not found for tenant "${e.tenantId}" and integration "${e.integrationName}". Make sure to create the account first.`)}return{integrationId:t.id,accountId:r.id,integration:{id:t.id,config:t.config,dek:t.dek??null},account:{id:r.id,config:r.config,dek:r.dek??null}}}}async function Ua(e){let{integrationId:n,accountId:t}=await Fd(e);return{integrationId:n,accountId:t}}function Fa(e,n){let t=()=>{if(!e)throw new Error("corsair.chats requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{create:r=>Kr(t(),{tenantId:n,message:r}),list:()=>Gr(t(),{tenantId:n}),get:r=>({message:o=>Zr(t(),{chatId:r,tenantId:n,message:o}),listMessages:()=>zr(t(),{chatId:r,tenantId:n})})}}var Bd=10*6e4,Ld=5e3,Nd=3,$d=3e3,Wd=2e3,Ba=new WeakMap;function qd(e){let n=e?.kinds;if(!Array.isArray(n))throw new Error("job-kinds: no kinds array");let t=r=>typeof r=="string"&&r.length>0;return n.filter(r=>{let o=r;return!t(o?.plugin)||!t(o?.operation)?!1:o.role==="start"?t(o.id_path):o.role==="status"?t(o.id_arg)&&t(o.status_path):o.role==="scoped"?t(o.id_arg):!1})}async function Na(e,n){let t=br(e),r=Ba.get(n);r||(r=new Map,Ba.set(n,r));let o=r.get(t);return o&&o.until>Date.now()?o.kinds:Ae(n,`managed_pricing:job_kinds:${t}`,async()=>{try{let i=await Z({hub:e,path:"/managed-pricing/job-kinds",parseResponse:qd,signal:AbortSignal.timeout(Wd)});return r.set(t,{kinds:i,until:Date.now()+Bd}),i}catch{return r.set(t,{kinds:[],until:Date.now()+Ld}),[]}})}function $a(e,n,t){let r=n.toLowerCase();return e.find(o=>o.plugin===r&&o.operation===t)}function Wa(e,n){let t=e;for(let r of n.split(".")){if(!t||typeof t!="object")return;t=t[r]}return t}function Pr(e,n){let t=Wa(e,n);return typeof t=="string"&&t.length>0?t:void 0}function ci(e,n){if(e?.role==="start"&&e.cap_path){let t=Wa(n,e.cap_path);return typeof t=="number"?{cap:t}:{}}if(e?.role==="status"||e?.role==="scoped"){let t=Pr(n,e.id_arg);return t?{jobId:t}:{}}return{}}async function La(e,n,t,r=1){let o=it(e,{path:n,plugin:t.plugin,tenantId:t.tenantId,operation:t.operation});for(let i=1;i<=r;i++)try{return await S({hub:e,path:n,body:t,extraHeaders:o,parseResponse:a=>a,signal:AbortSignal.timeout($d)}),!0}catch(a){let s=gs(a);if(s!==void 0&&s!==429&&s<500)break;i<r&&await new Promise(u=>setTimeout(u,250*i))}return!1}async function qa(e,n,t,r,o){if(n.role==="scoped")return{startedJob:!1};if(n.role==="start"){let u=Pr(o,n.id_path);return!u||!t.idempotencyKey?{startedJob:!1}:(await La(e,"/managed-pricing/jobs",{...t,providerJobId:u},Nd),{startedJob:!0})}let i=Pr(r,n.id_arg),a=Pr(o,n.status_path);if(!i||!a)return{startedJob:!1};let s=n.usage_path?Cr(o,n.usage_path):void 0;return await La(e,"/managed-pricing/jobs/report",{plugin:t.plugin,tenantId:t.tenantId,operation:t.operation,providerJobId:i,providerStatus:a,...s!==void 0&&{units:s}}),{startedJob:!1}}function ja(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function jd(e){let n=e.hub;if(n&&e.database&&e.kek)try{let t=await Ws(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy});return{message:e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:t.connectUrl,state:t.token}):ja(e.pluginId,t.connectUrl),connectUrl:t.connectUrl}}catch{return{message:`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`,connectUrl:null}}return{message:`[auth-missing:${e.pluginId}:${e.authType}]`,connectUrl:null}}function Kd(e,n,t){let r=kn(Fe(e,n.tenantId??t??"default"),n.kek),o=new URL(n.baseUrl);o.searchParams.set("state",r);let i=o.toString();return{message:n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:i,state:r}):ja(e,i),connectUrl:i}}async function Zd(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.error.authType==="managed_pricing"?{message:e.error.message,connectUrl:null}:e.manual&&Rn(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?Kd(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?jd({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins,multiTenancy:e.multiTenancy}):{message:e.error.message,connectUrl:null}}async function Ka(e){let{message:n,connectUrl:t}=await Zd(e);throw new E(e.error.pluginId,e.error.authType,n,{connectUrl:t,tenantId:e.tenantId??"default"})}var vr="connect.request",di="connect.cleared",Gd=600*1e3;async function li(e,n,t){let r=await e.db.selectFrom("corsair_integrations").select("id").where("name","=",t).executeTakeFirst();return r?(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).where("integration_id","=",r.id).executeTakeFirst())?.id??null:null}async function zd(e,n){return(await e.db.selectFrom("corsair_accounts").select("id").where("tenant_id","=",n).execute()).map(r=>r.id)}async function Jd(e,n,t){let r=await e.db.selectFrom("corsair_events").select("created_at").where("account_id","=",n).where("event_type","in",[vr,di]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!r)return t;let o=r.created_at instanceof Date?r.created_at.getTime():Date.parse(String(r.created_at));return Math.max(t,o+1)}async function Za(e,n,t,r,o,i,a){if(a&&!i)throw new Error("encryptDataAtRest requires kek");let s=await Jd(e,n,o),u=new Date(s),l=i?wt(r,await qn(e.db,n,i)):r;await e.db.insertInto("corsair_events").values({id:pn(),created_at:u,updated_at:u,account_id:n,event_type:t,payload:l}).execute()}async function Vd(e,n,t=Date.now()){let r=await li(e,n.tenantId,n.plugin);r&&await Za(e,r,vr,{plugin:n.plugin,connectUrl:n.connectUrl},t,n.kek,n.encryptDataAtRest)}function Yd(e){let n=e;if(typeof e=="string")try{n=JSON.parse(e)}catch{return null}return!n||typeof n!="object"||Array.isArray(n)?null:n}async function Qd(e,n,t,r,o,i){let a=await e.db.selectFrom("corsair_events").select(["event_type","payload","created_at"]).where("account_id","=",n).where("event_type","in",[vr,di]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(!a||a.event_type!==vr)return null;let s=a.created_at instanceof Date?a.created_at.getTime():Date.parse(String(a.created_at));if(r-s>o)return null;let u=a.payload;if(typeof u=="string")try{u=JSON.parse(u)}catch{return null}if(es(u)){if(!i)return null;try{u=ns(u,await qn(e.db,n,i))}catch{return null}}let l=Yd(u);if(!l)return null;let c=l.plugin,d=l.connectUrl;return typeof c!="string"||typeof d!="string"?null:{plugin:c,connectUrl:d,requestedAt:new Date(s).toISOString(),tenantId:t,requestedAtMs:s,accountId:n}}async function pi(e,n,t=Date.now(),r=Gd,o){let i=await zd(e,n);if(i.length===0)return null;let a=(await Promise.all(i.map(c=>Qd(e,c,n,t,r,o)))).filter(c=>c!==null);if(a.length===0)return null;a.sort((c,d)=>c.requestedAtMs-d.requestedAtMs||c.accountId.localeCompare(d.accountId));let{requestedAtMs:s,accountId:u,...l}=a[0];return l}async function Ga(e,n,t=Date.now(),r,o,i){let a;if(r)a=await li(e,n,r);else{let s=await pi(e,n,t,void 0,o);a=s?await li(e,n,s.plugin):null}a&&await Za(e,a,di,{},t,o,i)}async function gi(e,n){if(!(!e||!n.plugin||!n.connectUrl))try{await Vd(e,{tenantId:n.tenantId??"default",plugin:n.plugin,connectUrl:n.connectUrl,encryptDataAtRest:n.encryptDataAtRest,kek:n.kek})}catch{}}var Xd=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function za(e,n,t,r,o){let i={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(o).find(l=>o[l]?.match(e,i));return await(o[a||"DEFAULT"]?.handler||Xd)(e,i)}var Ja=new Map;function ep(e){let n=Ja.get(e);return n||(n=wr(),Ja.set(e,n)),n}function np(e){return typeof e=="function"}function fi({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:o,errorHandlers:i,currentPath:a=[],keyBuilder:s,permissionsConfig:u,endpointMeta:l,database:c,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:P,encryptDataAtRest:A}){for(let[B,O]of Object.entries(e)){let re=n?.[B];if(np(O)){let T=re,C=[...a,B].join("."),D=async(L={})=>{let oe=l?.[C];jt(C,oe?.riskLevel??"write");let F,H=xn(),_e=u?.mode,Fn=po(H,_e);if(Fn){let v=oe,I=v?.riskLevel??"write",Y=u?.overrides?.[C],je=H!==void 0&&H!==_e&&Fn===H?zs(Y,Kt(I,H)):Y,{result:ln,reason:q,onComplete:Nn,token:mt,id:qi,expiresAt:bc}=await Vs({pluginId:o,endpointPath:C,args:L,mode:Fn,override:je,riskLevel:I,meta:v,db:c,timeoutMs:d?fo(d.timeout):void 0,tenantId:p,approvalMode:d?.mode});if(ln==="blocked"){let dn;q==="denied"?dn=`Action '${C}' was denied by the user. Await further instructions before proceeding.`:q==="policy"?dn=H?`Action '${C}' is blocked by permission mode '${H}'.`:`Action '${C}' is blocked by the permission policy. Update the corsair config to allow it.`:q==="timeout"?dn=`Action '${C}' timed out waiting for approval.`:mt&&qi?dn=await lo({permissionsOptions:d,manual:g,hub:f,permissionId:qi,permissionToken:mt,plugin:o,endpoint:C,args:L,tenantId:p??"default",expiresAt:bc??new Date(Date.now()+(d?fo(d.timeout):600*1e3)).toISOString(),operationPath:C}):dn=`Action '${C}' requires user approval before it can run.`;let kc=q==="denied"||q==="policy"||q==="timeout"?q:"pending";throw new pe(dn,kc)}F=Nn}let Lr=async(v,I,Y)=>{try{return await O(I,Y)}catch(yt){if(yt instanceof Error){let je=await za(yt,o,C,typeof Y=="object"&&Y!==null?Y:{args:Y},i);if(v<(je.maxRetries||0)){let ln=v+1;console.log(`Retrying (${ln} / ${je.maxRetries})...`);let q;if(je.headersRetryAfterMs)q=je.headersRetryAfterMs;else switch(je.retryStrategy){case"exponential_backoff":q=Math.pow(2,ln-1)*1e3;break;case"exponential_backoff_jitter":let Nn=Math.pow(2,ln-1)*1e3,mt=(Math.random()-.5)*1e3;q=Math.max(0,Nn+mt);break;case"linear_1s":q=1e3;break;case"linear_2s":q=2e3;break;case"linear_3s":q=3e3;break;case"linear_4s":q=4e3;break;default:q=1e3;break}return await new Promise(Nn=>setTimeout(Nn,q)),await Lr(ln,I,Y)}}throw yt}},lt,qe,dt,pt,ie,gt={},Bi=!1,ft=async v=>{qe&&f&&ie?.role!=="status"&&ie?.role!=="scoped"&&!Bi&&await Go(f,qe,v)},Li=async(v,I)=>{if(!ie||!f||!qe)return;Bi=(await qa(f,ie,qe,v,I)).startedJob},Bn={},Ni=v=>{let I=pt&&_a(v,pt)?Ea(v,pt):void 0,Y=dt?Cr(v,dt):void 0;Bn={...I!==void 0?{failure:I}:{},...Y!==void 0?{units:Y}:{}}},$i=async()=>{if(!(!qe||!f)){if(Bn.failure!==void 0){await ft(new Error(Bn.failure));return}!dt||ie||Bn.units===void 0||await Ma(f,qe,Bn.units)}},yc={...t,meteredOperationId:C},mc=typeof t.tenantId=="string"?t.tenantId:void 0,hc=h?M(h):void 0;try{if(hc==="managed_pricing"&&f){let v=ep(o);ie=$a(await Na(f,v),o,C),gt=ci(ie,L);let I=await Zo({hub:f,tenantId:mc??p,meteredOperationId:C},{plugin:o,cache:v,operation:C,...gt});!ie&&I.startedJobIdPath&&(ie={plugin:o,operation:C,role:"start",id_path:I.startedJobIdPath,status_operation:""}),lt=I.apiKey,qe=I.call,dt=I.usagePath,pt=I.failedWhen}else s&&(lt=await s(yc,"endpoint"))}catch(v){if(v instanceof Ce)throw h&&f&&Cn({hub:f,database:c,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1}),await gi(c,{tenantId:v.tenantId??p,plugin:v.plugin,connectUrl:v.connectUrl,encryptDataAtRest:A,kek:A?b:void 0}),v;if(v instanceof E){h&&f&&Cn({hub:f,database:c,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!1});try{await Ka({error:v,manual:g,hub:f,plugin:h,tenantId:p,database:c,kek:b,plugins:k,multiTenancy:P})}catch(I){throw I instanceof E&&await gi(c,{tenantId:I.tenantId??p,plugin:I.pluginId,connectUrl:I.connectUrl,encryptDataAtRest:A,kek:A?b:void 0}),I}}throw v}if(!T?.before&&!T?.after){let v;try{v=await Lr(0,{...t,key:lt},L),Ni(v),await Li(L,v),await F?.()}catch(I){throw await ft(I),I}return await $i(),h&&f&&Cn({hub:f,database:c,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),v}let Wi={...t,key:lt},Ln;try{let v=T.before?await T.before(Wi,L):{ctx:Wi,args:L,continue:!0,passToAfter:void 0};if(v.continue===!1){await ft(new Error("Stopped by a before hook"));return}if(ie){let I=ci(ie,v.args);if(gt.cap!==I.cap||gt.jobId!==I.jobId)throw new Error(`A before hook changed ${C}'s ${ie.role==="start"?"cap":"job id"} after Corsair checked it, so the call did not run.`)}Ln=await Lr(0,v.ctx,v.args),Ni(Ln),await Li(v.args,Ln),await T.after?.(v.ctx,Ln,v.passToAfter),await F?.()}catch(v){throw await ft(v),v}return await $i(),h&&f&&Cn({hub:f,database:c,kek:b,plugins:k??[],plugin:h,tenantId:p,verified:!0}),Ln};r[B]=D}else if(O&&typeof O=="object"){let T={};fi({endpoints:O,hooks:re,ctx:t,tree:T,pluginId:o,errorHandlers:i,currentPath:[...a,B],keyBuilder:s,permissionsConfig:u,endpointMeta:l,database:c,permissionsOptions:d,tenantId:p,manualConfig:g,hubConfig:f,plugin:h,kek:b,allPlugins:k,multiTenancy:P,encryptDataAtRest:A}),r[B]=T}}}var me={findByEntityId:"read",existsByEntityId:"read",findIdByEntityId:"read",findById:"read",findManyByEntityIds:"read",list:"read",search:"read",count:"read",upsertByEntityId:"write",deleteById:"destructive",deleteByEntityId:"destructive"},tp=/^\$+date$/;function Va(e){if(typeof e!="object"||e===null||Array.isArray(e))return null;let n=Object.keys(e),t=n[0];return n.length!==1||!t||!tp.test(t)?null:typeof e[t]=="string"?t:null}function rn(e){if(e instanceof Date)return{$date:e.toISOString()};if(Array.isArray(e))return e.map(rn);let n=Va(e);return n?{[`$${n}`]:e[n]}:e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,rn(r)])):e}function on(e){let n=Va(e);if(n){let t=e[n];if(n!=="$date")return{[n.slice(1)]:t};let r=new Date(t);if(Number.isNaN(r.getTime()))throw $(`Invalid $date value "${t}" \u2014 expected an ISO 8601 timestamp`);return r}return Array.isArray(e)?e.map(on):e&&typeof e=="object"?Object.fromEntries(Object.entries(e).map(([t,r])=>[t,on(r)])):e}async function yi(e,n,t){let r=Object.hasOwn(me,n.method)?me[n.method]:void 0;if(!r)throw new w(404,"unknown_db_method",`Unknown db method "${n.method}" \u2014 expected one of ${Object.keys(me).join(", ")}`);Ve(`${n.plugin}.db.${n.entityType}.${n.method}`,r);let i=e?.[n.plugin]?.db;if(!i)throw new w(404,"unknown_plugin",`Plugin "${n.plugin}" has no entity store`);let a=Object.hasOwn(i,n.entityType)?i[n.entityType]:void 0,s=a?.[n.method];if(typeof s!="function")throw new w(404,"unknown_entity_type",`Plugin "${n.plugin}" has no entity type "${n.entityType}"`);return s.apply(a,t)}function rp(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function mi({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:o}){for(let[i,a]of Object.entries(e)){let s=n?.[i];if(rp(a)){let u=s,l=async c=>{let d=(g,f)=>a.handler(g,f),p=o&&c?.hubVerified!==!0?await o(t,"webhook"):void 0;return!u?.before&&!u?.after?d({...t,key:p},c):(async()=>{let g={...t,key:p},f=u.before?await u.before(g,c):{ctx:g,args:c,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let h=await d(f.ctx,f.args);return h?.success===!0&&await u.after?.(f.ctx,h,f.passToAfter),h})()};r[i]={match:a.match,handler:l}}else if(a&&typeof a=="object"){let u={};mi({webhooks:a,hooks:s,ctx:t,webhooksTree:u,keyBuilder:o}),r[i]=u}}}function Ya(e){return e&&typeof e=="object"?e:{}}async function Qa(e,n){return Z({hub:e,path:`/workflows?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=Ya(t).workflows;return Array.isArray(r)?r:[]}})}async function Xa(e,n){return Z({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>Ya(t).workflow})}async function eu(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/status?tenantId=${encodeURIComponent(n.tenantId)}`,body:{status:n.status},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function nu(e,n){await S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/rename?tenantId=${encodeURIComponent(n.tenantId)}`,body:{name:n.name},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}async function tu(e,n){return S({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/run?tenantId=${encodeURIComponent(n.tenantId)}`,body:{payload:n.payload,idempotencyKey:n.idempotencyKey},notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>t})}function hi(e){return e&&typeof e=="object"?e:{}}async function ru(e,n){return Z({hub:e,path:`/runs?tenantId=${encodeURIComponent(n.tenantId)}`,parseResponse:t=>{let r=hi(t).runs;return Array.isArray(r)?r:[]}})}async function ou(e,n){return Z({hub:e,path:`/workflows/${encodeURIComponent(n.workflowId)}/runs?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Workflow "${n.workflowId}" not found`,parseResponse:t=>{let r=hi(t).runs;return Array.isArray(r)?r:[]}})}async function iu(e,n){return Z({hub:e,path:`/runs/${encodeURIComponent(n.runId)}?tenantId=${encodeURIComponent(n.tenantId)}`,notFoundMessage:`Run "${n.runId}" not found`,parseResponse:t=>hi(t).run})}async function bi(e,n,t){await S({hub:e,path:`/runs/${encodeURIComponent(t.runId)}/${n}?tenantId=${encodeURIComponent(t.tenantId)}`,body:{},notFoundMessage:`Run "${t.runId}" cannot be ${n==="cancel"?"canceled":`${n}d`} in its current state`,parseResponse:r=>r})}var su=(e,n)=>bi(e,"approve",n),au=(e,n)=>bi(e,"deny",n),uu=(e,n)=>bi(e,"cancel",n);function cu(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows.runs requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e};return{list:r=>r?.workflowId?ou(t(),{workflowId:r.workflowId,tenantId:n}):ru(t(),{tenantId:n}),get:r=>iu(t(),{runId:r,tenantId:n}),approve:r=>su(t(),{runId:r,tenantId:n}),deny:r=>au(t(),{runId:r,tenantId:n}),cancel:r=>uu(t(),{runId:r,tenantId:n})}}function lu(e,n){let t=()=>{if(!e)throw new Error("corsair.workflows requires Hub to be configured. Pass `hub` to createCorsair({ hub: { projectApiKey, ... } }).");return e},r=(o,i)=>eu(t(),{workflowId:o,tenantId:n,status:i});return{list:()=>Qa(t(),{tenantId:n}),get:o=>Xa(t(),{workflowId:o,tenantId:n}),run:(o,i)=>tu(t(),{workflowId:o,tenantId:n,payload:i?.payload,idempotencyKey:i?.idempotencyKey}),runs:cu(e,n),disable:o=>r(o,"inactive"),enable:o=>r(o,"active"),archive:o=>r(o,"archived"),unarchive:o=>r(o,"inactive"),rename:(o,i)=>nu(t(),{workflowId:o,tenantId:n,name:i})}}function op(e,n,t,r){let o=null;return async()=>{if(o)return o;if(!e)throw new Error("Database not configured");let{accountId:i}=await Ua({database:e,integrationName:n,tenantId:t,ensureProvisioned:r});return o=i,o}}function ip(e,n){let t={};for(let[r,o]of Object.entries(n))t[r]=new Proxy(o,{get(i,a){let s=i[a];if(typeof a!="string"||typeof s!="function")return s;let u=Object.hasOwn(me,a)?me[a]:void 0;if(!u)return s;let l=s;return async(...c)=>(Ve(`${e}.db.${r}.${a}`,u),l.apply(i,c))}});return t}function sp(e,n,t,r,o){return e?Nr(e.db,n,t,r,o):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function ki(e,n){let{database:t,tenantId:r,kek:o,rootErrorHandlers:i,permissionsOptions:a,manualConfig:s,hubConfig:u,internalConfig:l}=n,c=r??"default",d=l&&t?()=>bn(l,c):void 0,p={},g={};for(let f of e)p[f.id]={},g[f.id]={};for(let f of e){let h=f.schema,b=op(t,f.id,c,d);if(h?.entities){let F={};for(let[H,_e]of Object.entries(h.entities)){let Fn=t?Nr(t.db,b,H,h.version,_e,l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o??""}:void 0):sp(void 0,b,H,h.version,_e);F[H]=Fn}g[f.id].db=F,p[f.id].db=ip(f.id,F)}let k=f.options,P=f.authConfig,A;if(t&&o&&k?.authType){let F=P?.[k.authType]?.account??[];A=N({authType:k.authType,integrationName:f.id,tenantId:c,kek:o,database:t,extraAccountFields:F,ensureProvisioned:d}),p[f.id].keys=A}let B={database:t,db:g[f.id]?.db??{},$getAccountId:b,...f.options?{options:f.options}:{},...A?{keys:A,authType:k?.authType}:{},tenantId:c,...l?.encryptDataAtRest?{encryptDataAtRest:!0,kek:o}:{},...u?{hub:u}:{}},O=f.endpoints??{},re=f.hooks,T={...i,...f.errorHandlers},C={},D=f.options?.permissions;fi({endpoints:O,hooks:re,ctx:B,tree:C,pluginId:f.id,errorHandlers:T,currentPath:[],keyBuilder:f.keyBuilder,permissionsConfig:D,endpointMeta:f.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:f.oauthConfig,kek:o,tenantId:c}:void 0,hubConfig:u,plugin:f,kek:o,allPlugins:e,multiTenancy:l?.multiTenancy,encryptDataAtRest:l?.encryptDataAtRest===!0}),Object.keys(C).length>0&&(p[f.id].api=C),B.endpoints=C;let L=f.webhooks??{},oe=f.webhookHooks;if(Object.keys(L).length>0&&!Qi(k?.authType)){let F={};mi({webhooks:L,hooks:oe,ctx:B,webhooksTree:F,keyBuilder:f.keyBuilder}),p[f.id].webhooks=F,f.pluginWebhookMatcher&&(p[f.id].pluginWebhookMatcher=f.pluginWebhookMatcher),f.pluginTenantWebhookMatcher&&(p[f.id].pluginTenantWebhookMatcher=f.pluginTenantWebhookMatcher)}}return p.chats=Fa(u,c),p.workflows=lu(u,c),p}function du(e,n,t){let r={};for(let o of e){let i=o.options,a=o.authConfig;if(i?.authType){let s=a?.[i.authType]?.integration??[],u=K({authType:i.authType,integrationName:o.id,kek:t,database:n,extraIntegrationFields:s});r[o.id]=u}}return r}var ap=3e4;function Rr(e){let n=e.length;for(;n>0&&e[n-1]==="/";)n--;return e.slice(0,n)}function up(e){let n=0;for(;n<e.length&&e[n]==="/";)n++;return e.slice(n)}function cp(e,n){return`${Rr(e)}/${up(n)}`}function lp(e,n){let t=n??{},{error:r,message:o,...i}=t;return typeof r!="string"?new w(e,"internal_error","Internal error"):new w(e,r,o,i)}var wi=Symbol("cloudRequestTimeout");async function J(e,n,t,r){let o=xn(),i=e.fetch??globalThis.fetch,a=e.timeoutMs??ap,s=new AbortController,u,l=new Promise(g=>{u=setTimeout(()=>{s.abort(),g(wi)},a)}),c;try{let g=i(cp(e.baseUrl,t),{method:n,headers:{authorization:`Bearer ${e.apiKey}`,"content-type":"application/json",...o?{"x-corsair-mode":o}:{}},body:r===void 0?void 0:JSON.stringify(r),signal:s.signal}).catch(h=>{if(s.signal.aborted)return wi;throw h}),f=await Promise.race([g,l]);if(f===wi)throw new w(0,"internal_error","Cloud request timed out");c=f}finally{clearTimeout(u)}let d=await c.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!c.ok)throw lp(c.status,p);if(p===void 0)throw new w(c.status,"internal_error","Invalid or empty response body from runtime");return p}var V={invoke:"/:tenant/:plugin/call/:op",entityDb:"/:tenant/:plugin/db/:entity/:method",instances:"/instances",connectLinks:"/connect/links",tenants:"/tenants",tenant:"/tenants/:id",connectionStatus:"/connection-status",disconnect:"/disconnect",permission:"/permissions/:id",permissionLookup:"/permissions/lookup-by-token"};var dp=new Set(["keys","webhooks"]),pp=new Set(["chats","workflows"]),Ci=new Set(["then","catch","finally"]);function he(e){return typeof e=="function"?e():Promise.resolve(e)}function pu(e,n,t,r){let o=async(...i)=>{let a=await he(e);return(await J(a,"POST",V.invoke.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":op",r.map(encodeURIComponent).join(".")),{args:i[0]})).data};return new Proxy(o,{get(i,a){if(!(typeof a!="string"||Ci.has(a)))return pu(e,n,t,[...r,a])}})}function gp(e,n,t){return new Proxy({},{get(r,o){if(!(typeof o!="string"||Ci.has(o)))return new Proxy({},{get(i,a){if(typeof a!="string")return;let s=Object.hasOwn(me,a)?me[a]:void 0;if(s)return async(...u)=>{Ve(`${t}.db.${o}.${a}`,s);let l=await he(e),c=await J(l,"POST",V.entityDb.replace(":tenant",encodeURIComponent(n)).replace(":plugin",encodeURIComponent(t)).replace(":entity",encodeURIComponent(o)).replace(":method",encodeURIComponent(a)),{args:rn(u)});return on(c.data)}}})}})}function Ar(e,n){let t=e?new Set(e.map(r=>r.id)):null;return new Proxy({},{get(r,o){if(!(typeof o!="string"||Ci.has(o))){if(pp.has(o))throw new Error(`"${o}" is not available in cloud mode (deferred)`);if(t&&!t.has(o))throw new Error(`Unknown plugin "${o}"`);return new Proxy({},{get(i,a){if(a==="api")return pu(n.transport,n.tenantId,o,[]);if(a==="db")return gp(n.transport,n.tenantId,o);if(typeof a=="string"&&dp.has(a))throw new Error(`"${a}" is not available in cloud mode (deferred)`)}})}}})}function xr(e){return{connect:{createLink:n=>{if(!n.plugin||!n.tenantId)throw new Error('connect.createLink requires both "plugin" and "tenantId" in cloud mode');return he(e).then(t=>J(t,"POST",V.connectLinks,n))}},tenants:{create:n=>he(e).then(t=>J(t,"POST",V.tenants,n)),list:()=>he(e).then(n=>J(n,"GET",V.tenants)),get:n=>he(e).then(t=>J(t,"GET",V.tenant.replace(":id",encodeURIComponent(n))))},connectionStatus:{get:n=>he(e).then(t=>J(t,"GET",`${V.connectionStatus}?tenantId=${encodeURIComponent(n.tenantId)}`))},disconnect:n=>he(e).then(t=>J(t,"POST",V.disconnect,n)),permissions:{get:n=>he(e).then(t=>"id"in n?J(t,"GET",V.permission.replace(":id",encodeURIComponent(n.id))):J(t,"POST",V.permissionLookup,{token:n.token}))}}}var xe=class extends w{type;retryable;param;docUrl;requestId;constructor(n,t){super(n,t.code,t.message,{...t}),this.name="CloudApiError",this.type=t.type??"api_error",this.retryable=t.retryable??(n===0||n===429||n>=500),this.param=t.param,this.docUrl=t.doc_url,this.requestId=t.request_id}};function st(e,n,t){let r=t?.get("request-id")?.trim()||void 0,i=(n??{}).error;if(typeof i=="string"){let a=n.message;return new xe(e,{code:i,message:typeof a=="string"?a:void 0,request_id:r})}return i&&typeof i=="object"&&typeof i.code=="string"?new xe(e,{request_id:r,...i}):new xe(e,{code:e===0?"request_failed":"internal_error",message:`Corsair Cloud returned ${e} with no error body`,request_id:r})}var fp=3e4,yp=new Set(["GET","HEAD","PUT","DELETE"]),mp=/^[a-z][a-z0-9-]{0,31}$/;function sn(e,n){if(!mp.test(e))throw new Error(`${n}: "${e}" is not a valid instance key. Lowercase letter first, then letters, digits or hyphens, up to 32 characters.`)}function an(e){let n=new URLSearchParams;for(let[r,o]of Object.entries(e))o!==void 0&&n.set(r,String(o));let t=n.toString();return t?`?${t}`:""}function x(e,n){return`${e}/${encodeURIComponent(n)}`}async function Ir(e,n,t,r,o={}){let i=e.fetch??globalThis.fetch,a=new AbortController;o.signal?.aborted&&a.abort();let s=()=>a.abort();o.signal?.addEventListener("abort",s,{once:!0});let u=setTimeout(()=>a.abort(),e.timeoutMs??fp),l={authorization:`Bearer ${e.apiKey}`,"content-type":"application/json"};e.apiVersion&&(l["corsair-version"]=e.apiVersion),o.idempotencyKey&&(l["idempotency-key"]=o.idempotencyKey),o.requestId&&(l["x-corsair-request-id"]=o.requestId);let c;try{c=await i(`${e.baseUrl}${t}`,{method:n,headers:l,body:r===void 0?void 0:JSON.stringify(r),signal:a.signal});let d=await c.text(),p;try{p=d?JSON.parse(d):void 0}catch{p=void 0}if(!c.ok)throw st(c.status,p,c.headers);if(p===void 0&&c.status!==204)throw st(c.status,void 0,c.headers);return p}catch(d){if(o.signal?.aborted||d instanceof xe)throw d;let p=yp.has(n),g=c?p?!0:void 0:p||!!o.idempotencyKey;throw st(c?.status??0,{error:{code:"request_failed",message:d instanceof Error?d.message:String(d),retryable:g}},c?.headers)}finally{clearTimeout(u),o.signal?.removeEventListener("abort",s)}}function Ti(e,n){sn(n,"withInstance");let t=(s,u,l,c)=>Ir(e,s,u,l,c),r=(...s)=>[n,...s].join(":"),o=s=>an({...s,instance:n}),i=s=>`${x("/instances",n)}${s}`,a=s=>`${x("/webhooks",r(s))}/deliveries`;return{instanceKey:n,tenants:{list:(s={},u)=>t("GET",`/tenants${o(s)}`,void 0,u),create:(s,u)=>t("POST","/tenants",{...s,instance:n},u),get:(s,u)=>t("GET",x("/tenants",r(s)),void 0,u),update:(s,u,l)=>t("PATCH",x("/tenants",r(s)),u,l),delete:(s,u)=>t("DELETE",x("/tenants",r(s)),void 0,u)},access:{list:(s={},u)=>t("GET",`/access${o(s)}`,void 0,u),get:(s,u)=>t("GET",x("/access",r(s)),void 0,u),set:(s,u,l)=>t("PUT",x("/access",r(s)),u,l),revoke:(s,u)=>t("DELETE",x("/access",r(s)),void 0,u)},connections:{list:(s={},u)=>t("GET",`/connections${o(s)}`,void 0,u),get:(s,u,l)=>t("GET",x("/connections",r(s,u)),void 0,l),delete:(s,u,l)=>t("DELETE",x("/connections",r(s,u)),void 0,l)},connect:{createSession:(s,u)=>t("POST","/connect/sessions",{...s,instance:n},u)},integrations:{list:(s={},u)=>t("GET",`/integrations${o(s)}`,void 0,u),get:(s,u)=>t("GET",x("/integrations",r(s)),void 0,u),put:(s,u,l)=>t("PUT",x("/integrations",r(s)),u,l),delete:(s,u)=>t("DELETE",x("/integrations",r(s)),void 0,u),operations:(s,u)=>t("GET",`${x("/integrations",r(s))}/operations`,void 0,u),oauthApp:{get:(s,u)=>t("GET",`${x("/integrations",r(s))}/oauth-app`,void 0,u),put:(s,u,l)=>t("PUT",`${x("/integrations",r(s))}/oauth-app`,u,l),delete:(s,u)=>t("DELETE",`${x("/integrations",r(s))}/oauth-app`,void 0,u)}},webhooks:{list:(s={},u)=>t("GET",`/webhooks${o(s)}`,void 0,u),create:(s,u)=>t("POST","/webhooks",{...s,instance:n},u),get:(s,u)=>t("GET",x("/webhooks",r(s)),void 0,u),delete:(s,u)=>t("DELETE",x("/webhooks",r(s)),void 0,u),rotateSecret:(s,u,l)=>t("POST",`${x("/webhooks",r(s))}/rotate-secret`,u,l),deliveries:{list:(s,u={},l)=>t("GET",`${a(s)}${an(u)}`,void 0,l),get:(s,u,l)=>t("GET",x(a(s),u),void 0,l),retry:(s,u,l)=>t("POST",`${x(a(s),u)}/retry`,void 0,l)}},signingSecret:{get:s=>t("GET",i("/signing-secret"),void 0,s),rotate:s=>t("POST",i("/signing-secret/rotate"),void 0,s)},apply:s=>t("POST",i("/apply"),void 0,s),removeFromRuntime:s=>t("POST",i("/remove"),void 0,s),reconcile:s=>t("POST",i("/reconcile"),void 0,s)}}function Pi(e){let n=(t,r,o,i)=>Ir(e,t,r,o,i);return{project:{get:t=>n("GET","/project",void 0,t)},keys:{get:t=>n("GET","/keys",void 0,t),rotate:t=>n("POST","/keys/rotate",void 0,t)},instances:{list:(t={},r)=>n("GET",`/instances${an(t)}`,void 0,r),create:(t,r)=>(sn(t.instance_key,"instances.create"),n("POST","/instances",t,r)),get:(t,r)=>(sn(t,"instances.get"),n("GET",x("/instances",t),void 0,r)),update:(t,r,o)=>(sn(t,"instances.update"),n("PATCH",x("/instances",t),r,o)),delete:(t,r)=>(sn(t,"instances.delete"),n("DELETE",x("/instances",t),void 0,r))},integrations:{catalog:(t={},r)=>n("GET",`/integrations/catalog${an(t)}`,void 0,r)},mcp:{links:{list:(t={},r)=>n("GET",`/mcp/links${an(t)}`,void 0,r),mint:(t,r)=>n("POST","/mcp/links",t,r),get:(t,r)=>n("GET",x("/mcp/links",t),void 0,r),update:(t,r,o)=>n("PATCH",x("/mcp/links",t),r,o),delete:(t,r)=>n("DELETE",x("/mcp/links",t),void 0,r),rotate:(t,r)=>n("POST",`${x("/mcp/links",t)}/rotate`,void 0,r)},tokens:{mint:(t,r)=>n("POST","/mcp/tokens",t,r)}}}}var gu="default",hp="corsairCloud: the management API needs a ck_cloud_<slug>.<secret> key, or an explicit `managementUrl`.",bp=new Set(["then","catch","finally","toString","toJSON","valueOf","constructor","inspect",Symbol.toPrimitive,Symbol.toStringTag,Symbol.iterator,Symbol.asyncIterator]);function vi(e={}){return new Proxy(e,{get(n,t,r){if(Reflect.has(n,t))return Reflect.get(n,t,r);if(!bp.has(t))throw new Error(hp)}})}function Ie(e){throw new Error(`"${e}" is not available in cloud mode (deferred)`)}function kp(e){let n=e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim();if(!n)throw new Error("Cloud mode (ck_cloud_ key) requires a base URL \u2014 set hub.baseUrl or CORSAIR_CLOUD_URL.");return $n(n),n}function fu(e){return!!(e?.baseUrl?.trim()||process.env.CORSAIR_CLOUD_URL?.trim())}function wp(e,n){let t=xr(e);return{ok:()=>Ie("manage.ok"),tenants:t.tenants,plugins:{list:()=>Ie("manage.plugins.list"),get:()=>Ie("manage.plugins.get")},connectionStatus:{get:r=>{let o=r?.tenantId||void 0;if(!o&&n)throw new Error("connectionStatus.get requires a tenantId in multi-tenant mode");return t.connectionStatus.get({tenantId:o??gu})}},permissions:t.permissions,connect:{createLink:t.connect.createLink,resolve:()=>Ie("manage.connect.resolve"),oauthCallback:()=>Ie("manage.connect.oauthCallback")},disconnect:t.disconnect}}function Cp(e,n){let t=wp(e,n.multiTenancy);if(n.multiTenancy)return{withTenant:a=>{if(!a)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return Ar(n.plugins,{transport:e,tenantId:a})},get keys(){return Ie("keys")},get permissions(){return Ie("permissions")},manage:t};let r=Ar(n.plugins,{transport:e,tenantId:gu}),o={manage:t,get keys(){return Ie("keys")},get permissions(){return Ie("permissions")}};return new Proxy(r,{get(a,s,u){return typeof s=="string"&&s in o?Reflect.get(o,s,u):Reflect.get(a,s,u)}})}function yu(e){return Cp({baseUrl:kp(e.hub),apiKey:e.hub.projectApiKey},{multiTenancy:!!e.multiTenancy,plugins:e.plugins})}function Tp(e){let n=Rr(e),t="/api/corsair";return n.endsWith(t)?n.slice(0,-t.length):n}async function Pp(e){let n=await J({...e,baseUrl:Tp(e.baseUrl)},"GET",V.instances),t=new Map;for(let r of n.instances)$n(r.url,`Instance "${r.instanceKey}" URL`),t.set(r.instanceKey,r.url);return t}function vp(e){let n=e.apiKey?.trim();if(!n)throw new Error("corsairCloud: apiKey is required");let t=ji(n),r=e.url?.trim()||Ki(n);if(!r)throw new Error("corsairCloud: could not resolve a URL from apiKey \u2014 pass a ck_cloud_<slug>.<secret> key, or set `url` explicitly.");$n(r);let o={baseUrl:r,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs},a=(Rr(e.managementUrl?.trim()??"")||void 0)??(t?Zi(r,t):null);a&&$n(a,"Management base URL");let s=a?{baseUrl:a,apiKey:n,fetch:e.fetch,timeoutMs:e.timeoutMs,apiVersion:e.apiVersion}:null,u=null;function l(g){return g&&u===g&&(u=null),u||(u=Pp(o).catch(f=>{throw u=null,f})),u}async function c(g){let f=l(),b=(await f).get(g)??(await l(f)).get(g);if(b)return b;let k=[...(await l()).keys()].join(", ");throw new Error(`corsairCloud.withInstance("${g}"): no such instance \u2014 available: ${k||"(none)"}`)}let d=xr(o),p={tenants:d.tenants,permissions:d.permissions};return{manage:s?{...Pi(s),...p}:vi(p),withInstance:g=>{let f=s?Ti(s,g):vi(),h=async()=>({...o,baseUrl:await c(g)}),b=xr(h),k={withTenant(P){if(!P)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");return Ar(void 0,{transport:h,tenantId:P})},connectionStatus:b.connectionStatus,disconnect:b.disconnect,createConnectLink:b.connect.createLink};return s?{...f,...k}:vi(k)}}}var Rp="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function mu(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${Rp}`),t):n}var Ap=e=>new w(404,"unknown_plugin",`Plugin '${e}' is not registered.`),xp=(e,n)=>new w(404,"unknown_op",`Operation '${n}' not found on plugin '${e}'.`),Sr=(e="/call")=>new w(403,"call_disabled",`The ${e} route is disabled. Construct managementHandler with { unsafeAllowUnauthenticated: true } to enable it \u2014 only when your own backend fronts the handler.`),Ip=e=>new w(401,"not_connected",`Tenant is not connected for plugin '${e}'. Reconnect and retry.`),hu=e=>new w(403,"permission_denied",`The call was blocked (${e}).`,{reason:e}),Sp=()=>new w(403,"approval_required","This action needs human approval before it can run. Approval is not resumable over HTTP in this version.",{reason:"pending"}),_p=(e,n)=>new w(502,"provider_error","The provider returned an error.",{providerStatus:e,body:n});function Ep(e,n){if(e instanceof w)return e;if(e instanceof E)return Ip(e.pluginId||n);if(e instanceof An)return hu("readonly");if(e instanceof pe)return e.reason==="pending"?Sp():hu(e.reason);if(e instanceof Error&&e.name==="ApiError"){let t=e;return _p(typeof t.status=="number"?t.status:502,t.body)}return console.error("[corsair] unhandled error in call operation",e),new w(500,"internal_error","Internal error")}var Mp=new WeakMap,bu=new WeakMap,Op=512;function ku(e,n){let t=e.get(n);return t||(t=new Map,e.set(n,t)),t}function Dp(e,n,t){if(n.size<=Op)return;let r=bu.get(e);for(let o of n.keys())if(o!==t&&(r?.get(o)??0)===0){n.delete(o);return}}function Hp(e,n,t){if(!n.multiTenancy)return{client:e};let r=typeof t=="string"?t.trim():"";if(!r)throw $("tenant is required for a multi-tenant runtime",{missingFields:["tenant"]});let o=ku(Mp,e),i=o.get(r);if(i)return o.delete(r),o.set(r,i),{client:i,tenantId:r};let a=e.withTenant(r);return o.set(r,a),Dp(e,o,r),{client:a,tenantId:r}}function Up(e,n){let t=e;for(let r of n.split(".")){if(t==null||typeof t!="object"||!Object.prototype.hasOwnProperty.call(t,r))return null;t=t[r]}return typeof t=="function"?t:null}function wu(e,n=[]){let t=[];for(let[r,o]of Object.entries(e??{}))typeof o=="function"?t.push([...n,r].join(".")):o&&typeof o=="object"&&t.push(...wu(o,[...n,r]));return t}function Cu(e){let n={};for(let t of e.plugins)n[t.id]=wu(t.endpoints??{});return n}async function Ri(e,n,t,r){if(!n.plugins.some(s=>s.id===t.plugin))throw Ap(t.plugin);let{client:o,tenantId:i}=Hp(e,n,t.tenant),a=i?ku(bu,e):null;a&&i&&a.set(i,(a.get(i)??0)+1);try{return await r(o)}catch(s){throw Ep(s,t.plugin)}finally{if(a&&i){let s=(a.get(i)??1)-1;s<=0?a.delete(i):a.set(i,s)}}}async function Tu(e,n,{plugin:t,op:r,tenant:o,args:i}){return Ri(e,n,{plugin:t,tenant:o},a=>{let s=a[t],u=Up(s?.api,r);if(!u)throw xp(t,r);return u(i??{})})}function un(e,n){if(e===void 0)return n;if(e===null)throw new w(401,"unauthenticated","Could not determine the tenant for this request. Sign in and retry.");return e}function at(e){if(e!==void 0)throw new w(403,"forbidden","This route is disabled when resolveTenant is configured (end-user mode). Use a handler without resolveTenant, behind your own admin auth.")}var Ru=[{method:"GET",pattern:"/ok",public:!0,handler:async()=>_(200,Zt())},{method:"GET",pattern:"/tenants",handler:async({internal:e,scopedTenant:n})=>(at(n),_(200,await Sn(e)))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n,scopedTenant:t})=>(at(t),_(201,await Jt(e,n)))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(at(t),_(200,await zt(e,n.id)))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>_(200,await In(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>_(200,await Gt(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n,scopedTenant:t})=>_(200,await Vt(e,un(t,n.tenantId)))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n,scopedTenant:t})=>(at(t),_(200,await mo(e,n.id)))},{method:"POST",pattern:"/permissions/lookup-by-token",public:!0,handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?_(200,await bo(e,t)):_(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t,scopedTenant:r})=>{let o=t,i=un(r,o.tenantId);return _(200,await Qt(e,n,{...o,tenantId:i}))}},{method:"GET",pattern:"/connect/resolve",public:!0,handler:async({corsair:e,internal:n,query:t})=>_(200,await Xt(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",public:!0,handler:async({corsair:e,internal:n,body:t})=>_(200,await er(e,n,t))},{method:"GET",pattern:"/connect/request",handler:async({internal:e,query:n,scopedTenant:t})=>{let r=un(t,n.tenantId)??"default",o=e.database?await pi(e.database,r,void 0,void 0,e.encryptDataAtRest?e.kek:void 0):null;return _(200,{request:o},{"cache-control":"no-store"})}},{method:"POST",pattern:"/connect/request/clear",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n,o=un(t,r?.tenantId)??"default";return e.database&&await Ga(e.database,o,void 0,r?.plugin,e.encryptDataAtRest?e.kek:void 0,e.encryptDataAtRest),_(200,{ok:!0})}},{method:"POST",pattern:"/disconnect",handler:async({internal:e,body:n,scopedTenant:t})=>{let r=n??{},o=un(t,r.tenantId);return _(200,await Yt(e,{...r,tenantId:o}))}},{method:"GET",pattern:"/call",handler:async({internal:e,allowCall:n})=>{if(!n)throw Sr();return _(200,{plugins:Cu(e)})}},{method:"POST",pattern:"/:tenant/:plugin/db/:entityType/:method",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw Sr("/db");at(i);let s=o??{};if(s.args!==void 0&&!Array.isArray(s.args))throw $("args must be an array");let u=un(i,r.tenant),l=on(s.args??[]),c=await Ri(e,n,{plugin:r.plugin,tenant:u},d=>vu(t,()=>yi(d,{plugin:r.plugin,entityType:r.entityType,method:r.method},l)));return _(200,{data:rn(c)})}},{method:"POST",pattern:"/:tenant/:plugin/call/:op",handler:async({corsair:e,internal:n,req:t,params:r,body:o,scopedTenant:i,allowCall:a})=>{if(!a)throw Sr();let s=o??{},u=un(i,r.tenant),l=await vu(t,()=>Tu(e,n,{plugin:r.plugin,op:r.op,tenant:u,args:s.args}));return _(200,{data:l})}}];(()=>{let e=new Set;for(let n of Ru){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function Fp(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let o={};for(let i=0;i<t.length;i++){let a=t[i],s=r[i];if(a.startsWith(":"))o[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return o}function Bp(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function Lp(e,n){if(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json"))return;let r=await hr(e,n).catch(o=>{throw o instanceof w?o:new w(400,"invalid_json","Request body is not valid JSON")});if(r)try{return JSON.parse(r)}catch{throw new w(400,"invalid_json","Request body is not valid JSON")}}var Np="/api/corsair",Pu=new Set(["open","cautious","strict","readonly"]);function vu(e,n){let t=e.headers.get("x-corsair-mode");if(t===null)return n();if(!Pu.has(t))throw $(`Unknown permission mode "${t}" \u2014 expected one of ${[...Pu].join(", ")}`);return qt(t,n)}function G(e,n={}){let t=n.basePath??Np,r=Xe(n.maxBodyBytes),o=en(n.bodyStallTimeoutMs),i={maxBodyBytes:r,bodyStallTimeoutMs:o},a=R(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async s=>{try{let u=s.headers.get("content-length");if(u!==null&&Number(u)>r)throw On(r);let l=new URL(s.url),c=Bp(l.pathname,t),d=s.method.toUpperCase();if(d==="OPTIONS"||c==="/"||c==="")return await nn(e,s,{maxBodyBytes:r,bodyStallTimeoutMs:o});if(d!=="GET"&&d!=="POST")return _(405,{error:"method_not_allowed",message:`Method ${d} not allowed`});let p=Object.fromEntries(l.searchParams);for(let g of Ru){if(g.method!==d)continue;let f=Fp(g.pattern,c);if(!f)continue;if(!g.public&&n.authenticate&&!await n.authenticate(s))return _(401,{error:"unauthorized",message:"invalid or missing credentials"});let h=await Lp(s,i),b=n.resolveTenant?await n.resolveTenant(s):void 0;return await g.handler({corsair:e,internal:a,req:s,params:f,query:p,body:h,scopedTenant:b,allowCall:(n.unsafeAllowUnauthenticated??!1)||!!n.authenticate})}throw Be(`No route for ${d} ${c}`)}catch(u){if(n.onError){let c=await n.onError(u,s);if(c)return c}if(u instanceof w)return ge(u);let l=u instanceof Error?u.message:"Internal server error";return _(500,{error:"internal_error",message:l})}}}function $p(e,n){if(e.get)return e.get(n);let t=e.headers[n]??e.headers[n.toLowerCase()];return Array.isArray(t)?t[0]:t}function Wp(e){if(Buffer.isBuffer(e))return e;if(e instanceof Uint8Array)return Buffer.from(e);if(typeof e=="string")return Buffer.from(e,"utf8");throw new TypeError(`corsair adapter: unsupported stream chunk type ${typeof e}`)}async function qp(e,n,t){let r=[],o=0,i=e();try{let a=await mr(()=>i.next(),t);for(;a.done!==!0;){let s=Wp(a.value);if(o+=s.byteLength,o>n)throw On(n);r.push(s),a=await mr(()=>i.next(),t)}return Buffer.concat(r)}catch(a){try{Promise.resolve(i.return?.()).catch(()=>{})}catch{}throw a}}var Au=!1;function jp(){Au||(Au=!0,console.warn("[corsair] A JSON body parser consumed this request before the corsair adapter.","Re-serializing the parsed object is lossy and will likely fail Hub signature",'verification ("Invalid tunnel signature"). Fix on the corsair route only:',"Express \u2192 mount express.raw({ type: 'application/json' }) before the handler,","or capture raw bytes via express.json({ verify: (req, _res, buf) => { req.rawBody = buf; } }).","Fastify \u2192 call registerCorsairRawBodyParser(app) before listen()."))}async function Kp(e,n){let t=(e.method??"GET").toUpperCase();if(t==="GET"||t==="HEAD")return;let r=Xe(n.maxBodyBytes),o=en(n.bodyStallTimeoutMs),i;if(typeof e.rawBody=="string")i=e.rawBody;else if(e.rawBody instanceof Uint8Array)i=e.rawBody;else if(e.body!==void 0&&e.body!==null)typeof e.body=="string"||e.body instanceof Uint8Array?i=e.body:(jp(),i=JSON.stringify(e.body));else{let s=e[Symbol.asyncIterator];if(typeof s!="function")return;let u=await qp(s.bind(e),r,o);u.length>0&&(i=u)}if(i===void 0)return;if((typeof i=="string"?Buffer.byteLength(i,"utf8"):i.byteLength)>r)throw On(r);return typeof i=="string"?i:i}function ee(e){e.resume?.()}async function Ne(e,n={}){let t=$p(e,"host")??"localhost",r=e.protocol??"http",o=e.originalUrl??e.url??"/",i=`${r}://${t}${o}`,a=new Headers;for(let[l,c]of Object.entries(e.headers))if(c!=null&&!Zp.has(l.toLowerCase()))if(Array.isArray(c))for(let d of c)a.append(l,d);else a.set(l,c);let s={method:(e.method??"GET").toUpperCase(),headers:a},u=await Kp(e,n);return u!==void 0&&(s.body=u,a.has("content-type")||a.set("content-type","application/json")),new Request(i,s)}async function ne(e,n){typeof e.status=="function"?e.status(n.status):e.statusCode=n.status;let t=n.headers.getSetCookie();n.headers.forEach((o,i)=>{i!=="set-cookie"&&e.setHeader(i,o)}),t.length>0&&e.setHeader("set-cookie",t);let r=Buffer.from(await n.arrayBuffer());e.send?e.send(r):e.end?.(r)}var Zp=new Set(["connection","keep-alive","proxy-authenticate","proxy-authorization","te","trailer","transfer-encoding","upgrade","content-length"]);function xu(e,n){let t=G(e,n);return async(r,o,i)=>{try{let a=await t(await Ne(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await ne(o,a)}catch(a){if(a instanceof w&&o.headersSent!==!0){await ne(o,ge(a)),ee(r);return}ee(r),i(a)}}}function Gp(e,n){let t=e[n];return Array.isArray(t)?t[0]:t}function zp(e){let n=(e.method??"GET").toUpperCase();if(n==="GET"||n==="HEAD"||e.body!==void 0||e.rawBody!==void 0)return;let t=Gp(e.headers,"content-type");if(!(!t||!t.includes("application/json"))&&!(e.raw.readableEnded!==!0&&e.raw.complete!==!0))throw new Error("corsair: Fastify consumed this JSON body before the corsair adapter could read it. Call registerCorsairRawBodyParser(app) before listen() so the original bytes reach the adapter verbatim (Hub signs deliveries over the exact bytes it sent).")}function Iu(e){e.addContentTypeParser("application/json",{parseAs:"buffer"},(n,t,r)=>{n.rawBody=t;try{r(null,JSON.parse(t.toString("utf8")))}catch{r(Object.assign(new Error("Invalid JSON body"),{statusCode:400}))}})}function Su(e,n){let t=G(e,n);return async(r,o)=>{zp(r);let i={method:r.method??r.raw.method,url:r.url??r.raw.url,headers:r.headers,protocol:r.protocol,body:r.body,rawBody:r.rawBody,resume:r.raw.resume?.bind(r.raw),[Symbol.asyncIterator]:r.raw[Symbol.asyncIterator]?.bind(r.raw)};try{let a=await t(await Ne(i,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));o.hijack?.(),await ne(o.raw,a)}catch(a){if(a instanceof w&&o.raw.headersSent!==!0&&o.hijack){o.hijack(),await ne(o.raw,ge(a)),ee(i);return}throw ee(i),a}}}function _u(e,n){let t=G(e,n);return r=>t(r.req.raw)}function Eu(e,n){let t=G(e,n);return{GET:t,POST:t,OPTIONS:t}}function Mu(e,n){let t=G(e,n);return async(r,o)=>{try{let i=await t(await Ne(r,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await ne(o,i)}catch(i){if(o.headersSent===!0){console.error("[corsair] management response failed after headers were sent:",i),o.end?.(),ee(r);return}if(i instanceof w){await ne(o,ge(i)),ee(r);return}console.error("[corsair] management handler failed:",i),await ne(o,_(500,{error:"internal_error"})),ee(r)}}}function _r(e,n){let t=G(e,n);return r=>t(r.request)}function Ou(e,n){let t=_r(e,n);return{GET:t,POST:t,OPTIONS:t}}function Du(e,n){let t=_r(e,n);return{loader:t,action:t}}function Hu(e,n){let t=_r(e,n);return{GET:t,POST:t,OPTIONS:t}}function Uu(e,n){let t=_r(e,n);return{GET:t,POST:t,OPTIONS:t}}function Fu(e,n){let t=G(e,n);return async r=>{let o={method:r.node.req.method,url:r.node.req.url,headers:r.node.req.headers,protocol:r.node.req.protocol,body:r._body,rawBody:r.node.req.rawBody??r._rawBody,resume:r.node.req.resume?.bind(r.node.req),[Symbol.asyncIterator]:r.node.req[Symbol.asyncIterator]?.bind(r.node.req)};try{let i=await t(await Ne(o,{maxBodyBytes:n?.maxBodyBytes,bodyStallTimeoutMs:n?.bodyStallTimeoutMs}));await ne(r.node.res,i)}catch(i){if(i instanceof w&&r.node.res.headersSent!==!0){await ne(r.node.res,ge(i)),ee(o);return}throw ee(o),i}}}function Bu(e,n){return G(e,n)}function Lu(e){let n={[ut]:e};return{ok:Zt,tenants:{list:()=>Sn(e),create:t=>Jt(e,t),get:t=>zt(e,t)},plugins:{list:()=>In(e),get:t=>Gt(e,t)},connectionStatus:{get:t=>Vt(e,t?.tenantId)},permissions:{get:t=>na(e,t)},connect:{createLink:t=>Qt(n,e,t),resolve:t=>Xt(n,e,t),oauthCallback:t=>er(n,e,t)},disconnect:t=>Yt(e,t)}}async function Nu(e,n,t,r,o="pending",i){if(i==="")throw new Error("encryptDataAtRest requires kek");if(!e)return null;try{let a=pn(),s=new Date,u=i?wt(r,await qn(e.db,n,i)):r;return await e.db.insertInto("corsair_events").values({id:a,created_at:s,updated_at:s,account_id:n,event_type:t,payload:u,status:o}).execute(),a}catch(a){return console.warn("Failed to log event:",a),null}}async function Jp(e,n,t,r="pending"){if(e.encryptDataAtRest&&!e.kek)throw new Error("encryptDataAtRest requires kek");try{let o=await e.$getAccountId();return Nu(e.database,o,n,t,r,e.encryptDataAtRest?e.kek:void 0)}catch(o){return console.warn("Failed to log event:",o),null}}import*as Wu from"https";import*as Er from"querystring";var Vp=["expires_in","refresh_token_expires_in"];function $u(e){let n={...e};for(let t of Vp){let r=e[t];if(typeof r=="string"){let o=Number(r);n[t]=Number.isFinite(o)?o:void 0}}return n}function Yp(e){try{return $u(JSON.parse(e))}catch{}if(!e.includes("="))return null;let n=Er.parse(e);return!n.access_token&&!n.error?null:$u({...n})}function Dt(e,n,t,r,o){let i=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,u)=>{let l={code:e.trim(),redirect_uri:o,grant_type:"authorization_code"};a||(l.client_id=n,l.client_secret=t);let c=Er.stringify(l),d={"Content-Type":"application/x-www-form-urlencoded",Accept:"application/json","Content-Length":Buffer.byteLength(c).toString()};a&&(d.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=Wu.request({hostname:i.hostname,...i.port?{port:Number(i.port)}:{},path:i.pathname+i.search,method:"POST",headers:d},g=>{let f="";g.on("data",h=>{f+=h}),g.on("end",()=>{if(g.statusCode!==200){u(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}let h=Yp(f);h?s(h):u(new Error(`Token endpoint returned non-JSON response: ${f}`))})});p.on("error",g=>u(new Error(`Request failed: ${g.message}`))),p.write(c),p.end()})}async function qu(e,n){let{keys:t,hub:r,plugin:o,tenantId:i}=e,[a,s,u]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(Dn({accessToken:a,expiresAt:s,forceRefresh:n?.forceRefresh}))return{accessToken:a,expiresAt:Number(s),refreshed:!1};if(!u)throw new E(o,"oauth_2");let l=await S({hub:r,path:"/oauth/refresh",body:{plugin:o,tenantId:i,refresh_token:u},parseResponse:gn}),c=await Hn(t,l,s);return{accessToken:l.access_token,expiresAt:c,refreshed:!0}}async function ju(e){let{tokenUrl:n,refreshToken:t,clientSecret:r,clientId:o,tokenAuthMethod:i="body",bodyFormat:a="form",extraParams:s}=e,u={grant_type:"refresh_token",refresh_token:t,...s},l={Accept:"application/json"};i==="basic"?l.Authorization=`Basic ${Buffer.from(`${o??""}:${r}`).toString("base64")}`:i==="basic_secret_only"?l.Authorization=`Basic ${Buffer.from(`${r}:`).toString("base64")}`:(o&&(u.client_id=o),u.client_secret=r),a==="json"?l["Content-Type"]="application/json":l["Content-Type"]="application/x-www-form-urlencoded";let c=await fetch(n,{method:"POST",headers:l,body:a==="json"?JSON.stringify(u):new URLSearchParams(u)});if(!c.ok)throw new Error(`OAuth token refresh failed (${c.status}): ${await c.text()}`);let d=JSON.parse(await c.text());if(typeof d.access_token!="string"||d.access_token.length===0)throw new Error("OAuth token refresh returned no access_token");return{access_token:d.access_token,...typeof d.refresh_token=="string"&&d.refresh_token.length>0?{refresh_token:d.refresh_token}:{},...typeof d.expires_in=="number"?{expires_in:d.expires_in}:{},...typeof d.scope=="string"&&d.scope.length>0?{scope:d.scope}:{}}}async function Ku(e,n){let t=await e.keys.get_integration_credentials(),r=`${n.plugin}:${e.tenantId}`;if(!t.client_secret){if(!e.hub)throw new E(n.plugin,"oauth_2");let l={keys:e.keys,hub:e.hub,plugin:n.plugin,tenantId:e.tenantId},c=g=>Ae(e.keys,r,async()=>(await qu(l,{forceRefresh:g})).accessToken);e._refreshAuth=()=>c(!0);let[d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return Dn({accessToken:d,expiresAt:p})?d:c(!1)}let o=t.client_secret,i=t.client_id,a=l=>Ae(e.keys,r,async()=>{let[c,d,p]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at(),e.keys.get_refresh_token()]);if(!l&&Dn({accessToken:c,expiresAt:d}))return c;if(!p)throw new E(n.plugin,"oauth_2");let g=await ju({tokenUrl:n.tokenUrl,tokenAuthMethod:n.tokenAuthMethod,bodyFormat:n.bodyFormat,extraParams:n.extraParams,clientId:i,clientSecret:o,refreshToken:p});return await Hn(e.keys,g,d),g.access_token});e._refreshAuth=()=>a(!0);let[s,u]=await Promise.all([e.keys.get_access_token(),e.keys.get_expires_at()]);return Dn({accessToken:s,expiresAt:u})?s:a(!1)}var Zu="  ";function ue(e){let n=e;return n._def??n.def??{}}function le(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function te(e){return e.innerType??e.schema??e.out??e.in}function Vu(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return te(e)}}function Yu(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Dr(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function $e(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function Qu(e,n){return e.description??n.description}function Xp(e){let n=e;for(;n;){let t=ue(n),r=Qu(n,t);if(r)return r;let o=le(t);if(Hr(o)||o==="ZodPipe"||o==="ZodEffects"||o==="ZodTransform"){n=Vu(t,o);continue}break}}function Hr(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function eg(e){let n=0,t;for(let r=0;r<e.length;r++){let o=e[r];if(t){o===t&&(t=void 0);continue}if(o==='"'||o==="'")t=o;else if(o==="("||o==="{"||o==="["||o==="<")n++;else if(o===")"||o==="}"||o==="]"||o===">")n--;else if(n===0&&(o==="|"||o==="&"))return!0}return!1}function Mr(e){return eg(e)?`(${e})`:e}function Gu(e){return e===""?'""':String(e)}function Xu(e){let n=e.getter;return typeof n=="function"?n():void 0}var Ai=new Set;function ng(e){let n=[],t=0,r=0;for(let o=0;o<e.length;o++){let i=e[o];i==="("||i==="{"||i==="["||i==="<"?t++:i===")"||i==="}"||i==="]"||i===">"?t--:t===0&&i==="|"&&(n.push(e.slice(r,o).trim()),r=o+1)}return n.push(e.slice(r).trim()),n}var zu=["string","number","boolean","null","(recursive)[]","Record<string, (recursive)>"];function tg(e){let n=new Set(ng(e));return n.size===zu.length&&zu.every(t=>n.has(t))?"JsonValue":e}function rg(e,n,t){if(Ai.has(e))return t;let r=Xu(ue(e));if(!r)return t;Ai.add(e);try{return n(r)}finally{Ai.delete(e)}}function ec(e){let n=e;for(;n;){let t=ue(n),r=le(t);if(r==="ZodOptional")return!0;if(r!=="ZodNullable")return!1;n=te(t)}return!1}function W(e){let n=ue(e),t=le(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":{let r="value"in n?[n.value]:$e(n);return r.length>0?r.map(Gu).join(" | "):"unknown"}case"ZodEnum":return $e(n).map(Gu).join(" | ");case"ZodOptional":{let r=te(n);return r?W(r):"unknown"}case"ZodNullable":{let r=te(n);return`${r?W(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=te(n);return r?W(r):"unknown"}case"ZodArray":{let r=Yu(n);return r?`${Mr(W(r))}[]`:"unknown[]"}case"ZodRecord":{let r=n.keyType,o=n.valueType,i=r?W(r):"string",a=o?W(o):"any";return`Record<${i}, ${a}>`}case"ZodLazy":return rg(e,r=>tg(W(r)),"(recursive)");case"ZodTuple":{let r=Array.isArray(n.items)?n.items:[],o=n.rest,i=r.map(a=>W(a));return o&&i.push(`...${Mr(W(o))}[]`),`[${i.join(", ")}]`}case"ZodObject":{let r=Dr(e,n),o=Object.entries(r);return o.length===0?"{}":`{ ${o.map(([a,s])=>`${ec(s)?`${a}?`:a}: ${W(s)}`).join(", ")} }`}case"ZodUnion":return $e(n).map(r=>W(r)).join(" | ");case"ZodIntersection":return`${Mr(W(n.left))} & ${Mr(W(n.right))}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=Vu(n,t);return r?W(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function Se(e){let n=ue(e),t=le(n),r=Qu(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let o=n.value??$e(n)[0],i=typeof o=="string"||typeof o=="number"||typeof o=="boolean"?o:String(o??"");return{kind:"literal",optional:!1,description:r,value:i}}case"ZodEnum":{let o=$e(n).map(i=>String(i));return{kind:"string",optional:!1,description:r,enum:o}}case"ZodOptional":{let o=te(n),i=o?Se(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodNullable":{let o=te(n),i=o?Se(o):{kind:"unknown",optional:!1};return{...i,optional:!0,description:r??i.description}}case"ZodDefault":case"ZodCatch":{let o=te(n);return o?{...Se(o),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let o=Yu(n);return{kind:"array",optional:!1,description:r,items:o?Se(o):{kind:"unknown",optional:!1}}}case"ZodObject":{let o=Dr(e,n),i={};for(let[a,s]of Object.entries(o))i[a]=Se(s);return{kind:"object",optional:!1,description:r,fields:i}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let o=$e(n);for(let i of o){let a=ue(i);if(le(a)==="ZodObject")return{...Se(i),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let o=te(n);return o?{...Se(o),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function nR(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let o=t.slice(0,r),i=t.slice(r+1),a=e.find(c=>c.id===o);if(!a)return null;let s=i;s.startsWith("api.")&&(s=s.slice(4));let u=We(a.endpointMeta,s),l=We(a.endpointSchemas,s);return!u&&!l?null:{input:l?.input?Se(l.input):null,output:l?.output?Se(l.output):null,description:u?.description}}var Mi=["equals","contains","startsWith","endsWith","in"],og=["equals","gt","gte","lt","lte","in"],ig=["equals"],sg=["equals","before","after","between"];function ag(e){return typeof e=="string"?"string":typeof e=="number"?"number":typeof e=="boolean"?"boolean":null}function Ju(e){let n=e[0];return n&&e.every(t=>t===n)?n:null}function Ii(e){let n=ue(e);switch(le(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=te(n);return r?Ii(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";case"ZodEnum":case"ZodLiteral":{let r="value"in n?[n.value]:$e(n);return Ju(r.map(ag))}case"ZodUnion":return Ju($e(n).filter(r=>le(ue(r))!=="ZodNull").map(r=>Ii(r)));default:return null}}function Oi(e){let n=ue(e),t=le(n);if(Hr(t)){let i=te(n);return i?Oi(i):{}}if(t!=="ZodObject")return{};let r=Dr(e,n),o={};for(let[i,a]of Object.entries(r)){let s=Ii(a);s==="string"?o[i]={type:"string",operators:Mi}:s==="number"?o[i]={type:"number",operators:og}:s==="boolean"?o[i]={type:"boolean",operators:ig}:s==="date"&&(o[i]={type:"date",operators:sg})}return o}function nc(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function Si(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];typeof o=="function"?t.push(i.join(".")):o!==null&&typeof o=="object"&&Si(o,i,t)}}function _i(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Ei(e,n,t){for(let[r,o]of Object.entries(e)){let i=[...n,r];_i(o)?t.push(i.join(".")):o!==null&&typeof o=="object"&&Ei(o,i,t)}}function Di(e,n){if(n.length===0)return null;let[t,...r]=n,o=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!o)return null;let[i,a]=o;if(r.length===0)return _i(a)?[i]:null;if(a!==null&&typeof a=="object"&&!_i(a)){let s=Di(a,r);if(s!==null)return[i,...s]}return null}function tc(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let i=0;i<n.length;i++){let a="    ".repeat(i+2);t.push(`${a}${n[i]}: {`)}let r="    ".repeat(n.length+2),o=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${o}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let i=n.length-1;i>=0;i--){let a="    ".repeat(i+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var ug=new Set(Ct);function cn(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let i=e.find(s=>s.id===r);if(!i)return ug.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:cn(e);if(t==="webhooks"){if(!i.webhooks)return[];let s=[];return Ei(i.webhooks,[],s),s.map(u=>`${i.id}.webhooks.${u}`)}if(t==="db"){let s=i.schema?.entities;return s?Object.keys(s).map(u=>`${i.id}.db.${u}.search`):[]}if(!i.endpoints)return[];let a=[];return Si(i.endpoints,[],a),a.map(s=>`${i.id}.api.${s}`)}let o={};if(t==="webhooks")for(let i of e){if(!i.webhooks)continue;let a=[];Ei(i.webhooks,[],a),o[i.id]=a.map(s=>`${i.id}.webhooks.${s}`)}else if(t==="db")for(let i of e){let a=i.schema?.entities;a&&(o[i.id]=Object.keys(a).map(s=>`${i.id}.db.${s}.search`))}else for(let i of e){if(!i.endpoints)continue;let a=[];Si(i.endpoints,[],a),o[i.id]=a.map(s=>`${i.id}.api.${s}`)}return o}function We(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function cg(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let i=t.slice(n.length+1),a=i.startsWith(".")?i.slice(1):i;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let o=e.slice(n.length+1);return o.toLowerCase().startsWith("api.")&&(o=o.slice(4)),{shortPath:o,lookupKey:o.toLowerCase()}}function xi(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function tR(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let o=t.slice(0,r),i=t.slice(r+1),a=e.find(s=>s.id===o);if(a){if(i.startsWith("db.")){let c=i.slice(3),d=c.lastIndexOf(".");if(d!==-1){let p=c.slice(0,d),g=c.slice(d+1),f=a.schema?.entities;if(g==="search"&&f){let h=nc(f,p);if(h){let[b,k]=h,P=Oi(k),A=[`Search ${o} ${b} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${Mi.join(", ")}]`];for(let[B,O]of Object.entries(P))A.push(`  ${B}?: ${O.type}  [${O.operators.join(", ")}]`);return A.push("}"),A.join(`
+`)}}}return xi(cn(e,{type:"db"}),"Path not found. Available db operations")}if(i.startsWith("webhooks.")){let c=i.slice(9);if(a.webhooks){let d=Di(a.webhooks,c.split("."));if(d!==null){let p=d.join("."),g=We(a.webhookSchemas,p.toLowerCase()),f=g?.response?W(g.response):null,h=[];return g?.description&&h.push(g.description),g?.payload&&h.push(`payload ${Or(Un(g.payload))}`),f&&h.push(`response: ${f}`),h.push(`usage:
+${tc(o,d)}`),h.join(`
+
+`)}}return xi(cn(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=i;s.startsWith("api.")&&(s=s.slice(4));let u=We(a.endpointMeta,s),l=We(a.endpointSchemas,s);if(u||l){let c=[],d=[u?.riskLevel?`[${u.riskLevel}]`:"",u?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[u?.description,d].filter(Boolean).join("  ");return p&&c.push(p),l?.input&&c.push(`input ${Or(Un(l.input))}`),l?.output&&c.push(`output ${Or(Un(l.output))}`),c.join(`
+
+`)}}}return xi(cn(e),"Path not found. Available operations")}function lg(e){let n=e;for(;;){let t=ue(n),r=le(t);if(Hr(r)){let o=te(t);if(!o)return n;n=o;continue}if(r==="ZodLazy"){let o=Xu(t);if(!o||o===n)return n;n=o;continue}return n}}function dg(e){let n=e;for(;n;){let t=ue(n),r=le(t);if(r==="ZodDefault"){let o=t.defaultValue;return{value:typeof o=="function"?o():o}}if(!Hr(r))return;n=te(t)}}var pg=40;function gg(e,n){if(e&&/\bdefault/i.test(e))return e;let t=JSON.stringify(n);if(t===void 0||t.length>pg)return e;let r=`Defaults to ${t}.`;if(!e)return r;let o=e.trimEnd();return`${o}${/[.!?]$/.test(o)?"":"."} ${r}`}function Un(e,n="output"){if(e===void 0)return{kind:"inline",type:"unknown"};let t=lg(e),r=ue(t);if(le(r)==="ZodObject"){let i=Dr(t,r),a=[];for(let[s,u]of Object.entries(i)){let l=Xp(u),c=n==="input"?dg(u):void 0;c&&(l=gg(l,c.value)),a.push({key:s,optional:ec(u)||c!==void 0,type:W(u),...l!==void 0?{description:l}:{}})}return{kind:"object",fields:a}}return{kind:"inline",type:W(e)}}function Or(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=Zu.repeat(n+1),r=Zu.repeat(n);return`{
+${e.fields.map(i=>{let a=i.optional?`${i.key}?`:i.key,s=i.description?`  // ${i.description}`:"";return`${t}${a}: ${i.type}${s}`}).join(`
+`)}
+${r}}`}return"unknown"}function fg(e,n){let t=cn(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(c=>c.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let o=[];for(let c of t){let{shortPath:d,lookupKey:p}=cg(c,n),g=We(r.endpointMeta,p),f=We(r.endpointSchemas,p);!g&&!f||o.push({path:c,shortPath:d,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,...g?.job?{job:g.job}:{},input:Un(f?.input,"input"),output:Un(f?.output)})}o.sort((c,d)=>c.path.localeCompare(d.path));let i=[],a=cn(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let c of a){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),h=Di(r.webhooks,f.split("."));if(h===null)continue;let b=h.join("."),k=We(r.webhookSchemas,b.toLowerCase()),P=k?.response?W(k.response):void 0;i.push({path:c,description:k?.description,payload:Un(k?.payload),responseType:P,usageExample:tc(n,h)})}i.sort((c,d)=>c.path.localeCompare(d.path));let s=[],u=cn(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(u)&&l)for(let c of u){let p=c.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),h=f.lastIndexOf(".");if(h===-1)continue;let b=f.slice(0,h);if(f.slice(h+1)!=="search")continue;let P=nc(l,b);if(!P)continue;let[A,B]=P,O=Oi(B),re=Object.entries(O).map(([T,C])=>({field:T,type:C.type,operators:C.operators}));s.push({path:c,entityName:A,filters:[{field:"entity_id",type:"string",operators:Mi},...re]})}return s.sort((c,d)=>c.path.localeCompare(d.path)),{ok:!0,data:{pluginId:n,api:o,webhooks:i,db:s}}}import{randomUUID as rc}from"crypto";async function yg(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r=rc(),o=rc(),i=await fetch(n.watchUrl,{method:"POST",signal:AbortSignal.timeout(2e4),headers:{authorization:`Bearer ${t}`,"content-type":"application/json"},body:JSON.stringify({id:r,type:"web_hook",address:n.webhookUrl,token:o,...n.body})});if(!i.ok)throw new Error(`Google channel watch failed (${i.status}): ${await i.text()}`);return{webhookLink:{linkType:"channel_id",externalId:r},webhookSecret:o}}import{randomUUID as mg}from"crypto";var Ur="https://graph.microsoft.com/v1.0",Hi=2e4,hg=60;async function bg(e,n){let t=await e.keys.get_access_token();if(!t)return null;let r={authorization:`Bearer ${t}`};try{let u=await fetch(`${Ur}/subscriptions`,{headers:r,signal:AbortSignal.timeout(Hi)});if(u.ok){let{value:l}=await u.json(),c=(l??[]).filter(d=>d.notificationUrl===n.webhookUrl);await Promise.all(c.map(d=>fetch(`${Ur}/subscriptions/${d.id}`,{method:"DELETE",headers:r,signal:AbortSignal.timeout(Hi)}).catch(()=>{})))}}catch{}let o=mg(),i=new Date(Date.now()+hg*6e4).toISOString(),a=await fetch(`${Ur}/subscriptions`,{method:"POST",headers:{...r,"content-type":"application/json"},signal:AbortSignal.timeout(Hi),body:JSON.stringify({changeType:n.changeType,notificationUrl:n.webhookUrl,resource:n.resource,expirationDateTime:i,clientState:o})});if(!a.ok)throw new Error(`MS Graph subscribe failed (${a.status}): ${await a.text()}`);let s=await a.json();return s.id?(await e.keys.set_webhook_signature(o),{webhookLink:{linkType:"subscription_id",externalId:s.id},webhookSecret:o}):null}function oc(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function kg(e,n){let t=oc(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let o=r.pluginTenantWebhookMatcher(n);return o?{plugin:t,tenantMatch:o}:null}function wg(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function ic(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function sc(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function ct(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function Cg(e){return ct(e.body)}function ac(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Fr(Array.isArray(r)?r:[r])}function uc(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let u of t){let l=Fr(Array.isArray(u)?u:[u]);if(l)return decodeURIComponent(l)}let r=ac({query:e.query},"validationToken");if(r)return r;let o=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let u of o){let l=n[u],c=Array.isArray(l)?l[0]:l;if(!(!c||typeof c!="string"))try{let p=(c.startsWith("http")?new URL(c):new URL(`https://example.invalid${c.startsWith("/")?c:`/${c}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let i=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=ct(typeof i=="string"?(()=>{try{return JSON.parse(i)}catch{return i}})():i);return Fr([a?.validationToken])??null}function Tg(e){if(uc(e))return!0;let n=ct(e.body??e.payload);return ic(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Fr(e){for(let n of e){let t=sc(n);if(t)return t}}function Pg(e){let t=ct(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var ut=Symbol.for("corsair:internal");function pc(e){if(e.hub?.projectApiKey?.startsWith("ck_cloud_")&&fu(e.hub))return yu(e);let n=e.database?zi(e.database,{dbTables:e.dbTables}):void 0,t=e.kek??"",r=n&&t?du(e.plugins,n,t):Tr(!!n,!!t),o=mu(e),i={plugins:e.plugins,database:n,kek:t,multiTenancy:!!e.multiTenancy,permissions:o,manual:e.manual,hub:e.hub?It(e.hub):void 0,encryptDataAtRest:e.encryptDataAtRest===!0},a=Js(n),s=Lu(i);if(e.multiTenancy){let c=Object.assign({withTenant:d=>{if(!d)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let p=ki(e.plugins,{database:n,tenantId:d,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i});return Object.assign(p,{[ut]:i})},keys:r,permissions:a,manage:s},{[ut]:i});return cc(c,i.hub),dc(c,i.hub),c}let u=ki(e.plugins,{database:n,tenantId:void 0,kek:t,rootErrorHandlers:e.errorHandlers,permissionsOptions:o,manualConfig:e.manual,hubConfig:i.hub,internalConfig:i}),l=Object.assign({},u,{keys:r,permissions:a,manage:s,[ut]:i});return cc(l,i.hub),dc(l,i.hub),l}function cc(e,n){n?.projectApiKey?.startsWith("ck_dev_")&&import("./loop-SPHFLIY2.js").then(t=>t.startConnectLoop(e)).catch(()=>{})}function vg(e){return e?.projectApiKey?.startsWith("ck_dev_")?e.tunnel!==!1&&process.env.CORSAIR_TUNNEL!=="0":!1}var lc=globalThis.__corsairTunnels??=new Set,Rg=1e3,Ag=3e4;function xg(e){let n=e.schedule??((a,s)=>void setTimeout(a,s).unref?.()),t=e.minDelayMs??Rg,r=e.maxDelayMs??Ag,o=t,i=()=>{let a=!1,s=()=>{a||(a=!0,n(i,o),o=Math.min(o*2,r))};e.start(s).then(()=>{o=t}).catch(s)};i()}function dc(e,n){if(!vg(n))return;let t=n.projectApiKey;if(lc.has(t))return;let r=Number(process.env.PORT);if(!Number.isInteger(r)||r<1||r>65535){console.error("[corsair] PORT is not set \u2014 dev tunnel skipped. Set PORT to your app port, or run `corsair http <port>`.");return}lc.add(t);let o=typeof n.tunnel=="object"?n.tunnel:{},i=process.env.CORSAIR_FRP_HOST??o.shareHost??$r;xg({start:a=>import("./hub/tunnel/run-tunnel.js").then(s=>s.runTunnel({port:r,apiUrl:n.apiUrl,apiKey:t,shareHost:i,onClose:a})).then(({url:s})=>{console.log(`[corsair] tunnel active: ${s}${Wr}`)}).catch(s=>{throw console.warn(`[corsair] tunnel down: ${s instanceof Error?s.message:String(s)}. Retrying \u2014 run \`corsair setup\` if it doesn't recover.`),s})})}var Ig={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googlemeet:{conferenceRecords:{list:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Ui=Ig;async function Ht(e,n){let t=[],r=n?.silent??!1,o=g=>{t.push(g),r||console.log(g)},i=g=>{t.push(g),r||console.warn(g)},a=n?.caller??"script",s=Vi(e);if(!s)throw new Error("setupCorsair: invalid corsair instance");if(!s.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let u=Ng(e,s.plugins,n),l={...s,database:s.database},c=l.database.db;await qg(l.database,i);let d=await jg(c,l,u.tenantId,u.provisionAccounts,o);n?.credentials&&Object.keys(n.credentials).length>0&&await Gg(e,u,n.credentials,l,o,i);let p=await Jg(d,u,o,a);if(n?.backfill){o("[corsair:setup] Starting backfill...");let g=pc({plugins:s.plugins,database:c,kek:s.kek,multiTenancy:!0,...s.encryptDataAtRest?{encryptDataAtRest:!0}:{}}).withTenant(u.tenantId);await Vg(g,s.plugins,p,o,i),o("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function Fi(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...z[n][t],...r])}function Lg(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let o=n.find(s=>s.id===t);if(!o)continue;let i=M(o);if(!i)continue;let a=Fi(o,i,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function Ng(e,n,t){let r=Yi(e),o=t?.tenantId?.trim(),i=o!==void 0&&o.length>0;if(r&&t?.backfill&&!i)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&Lg(t?.credentials,n)&&!i)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(i&&!o)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:i,tenantId:i?o:"default",provisionAccounts:!r||i}}function fc(e,n){return Me(e)?n===0?!0:Object.values(e).every(t=>fc(t,n-1)):!1}function $g(e){return fc(e,4)}var Wg=rs;function Br(e){if(e instanceof Dg){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof Bg?Br(r):"unknown";return n}return e instanceof Mg?`${Br(e.unwrap())} | null`:e instanceof Hg?`${Br(e.unwrap())} | undefined`:e instanceof Eg?e.options.join(" | "):e instanceof Fg?"string":e instanceof Og?"number":e instanceof Sg?"boolean":e instanceof _g?"date":e instanceof Ug?"jsonb":"unknown"}async function qg(e,n){let t=await e.db.introspection.getTables(),r=new Set(t.map(i=>i.name)),o=e.tableNames??Gi();for(let[i,a]of Object.entries(Wg)){let s=o[i];if(!r.has(s)){let u=s!==i?` (dbTables.${i} \u2192 "${s}")`:"";n(`[corsair:setup] Table "${s}" does not exist${u}. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(Br(a),null,2)}`)}}}async function jg(e,n,t,r,o){let i=new Date,a=new Map;for(let s of n.plugins){let u=s.id,l=M(s),c=await e.selectFrom("corsair_integrations").selectAll().where("name","=",u).executeTakeFirst();if(!c){let h=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:h,name:u,config:{},created_at:i,updated_at:i}).execute(),c=await e.selectFrom("corsair_integrations").selectAll().where("id","=",h).executeTakeFirst(),o(`[corsair:setup] Created integration: ${u}`)}let d=l?s.authConfig?.[l]?.integration??[]:[],p=l?s.authConfig?.[l]?.account??[]:[],g=l&&c?K({authType:l,integrationName:u,kek:n.kek,database:n.database,extraIntegrationFields:d}):void 0;if(c&&!c.dek&&g&&(await g.issue_new_dek(),o(`[corsair:setup] Issued integration DEK: ${u}`)),!c||!l||!g)continue;let f;if(r){let h=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",c.id).executeTakeFirst();if(!h){let b=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:b,tenant_id:t,integration_id:c.id,config:{},created_at:i,updated_at:i}).execute(),h=await e.selectFrom("corsair_accounts").selectAll().where("id","=",b).executeTakeFirst(),o(`[corsair:setup] Created account: ${u}`)}f=h&&N({authType:l,integrationName:u,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),h&&f&&!h.dek&&(await f.issue_new_dek(),o(`[corsair:setup] Issued account DEK: ${u}`))}a.set(u,{pluginId:u,authType:l,integration:g,account:f,integrationFields:[...z[l].integration,...d],accountFields:r?[...z[l].account,...p]:[]})}return a}function Kg(e){if(!Me(e))return;let n=e.keys;return Me(n)?n:void 0}function Zg(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function Gg(e,n,t,r,o,i){let a=Kg(e),s=n.provisionAccounts?Zg(e,n.tenantId):void 0;for(let[u,l]of Object.entries(t)){let c=r.plugins.find(k=>k.id===u);if(!c){i(`[corsair:setup] Unknown plugin '${u}' \u2014 skipping credentials.`);continue}let d=M(c);if(!d){i(`[corsair:setup] Plugin '${u}' has no auth type \u2014 skipping credentials.`);continue}let p=Fi(c,d,"integration"),g=Fi(c,d,"account"),f=a?.[u],h=s?.[u],b=Me(h)?h.keys:void 0;for(let[k,P]of Object.entries(l))if(P){if(p.has(k)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${u}.${k}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let A=se(f,`set_${k}`);if(!A){i(`[corsair:setup] Cannot set integration field '${k}' for '${u}'.`);continue}await A(P),o(`[corsair:setup] Set ${u} integration.${k}`);continue}if(g.has(k)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${u}.${k}' on a multi-tenant instance`);let A=se(b,`set_${k}`);if(!A){i(`[corsair:setup] Cannot set account field '${k}' for '${u}'.`);continue}await A(P),o(`[corsair:setup] Set ${u} account.${k} (tenant=${n.tenantId})`);continue}i(`[corsair:setup] Unknown credential field '${k}' for plugin '${u}'.`)}}}var gc=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function zg(e,n,t,r,o,i,a,s,u){let l=[],c=[];for(let p of o){if(gc.has(p))continue;let g=se(t,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||l.push(p)}if(r&&i.length>0)for(let p of i){if(gc.has(p))continue;let g=se(r,`get_${p}`);if(!g)continue;let f=null;try{let h=await g();f=typeof h=="string"?h:null}catch{}f||c.push(p)}let d=l.length===0&&c.length===0;if(n==="managed_pricing")s(`[corsair:setup] '${e}' (managed_pricing) uses Corsair metered credentials via Hub \u2014 nothing to store in your database. Pass hub: { ... } to createCorsair().`);else if(d)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...c];if(u==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of c){let h=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${h}.keys.set_${f}(value)`)}s(g.join(`
+`))}}return d}async function Jg(e,n,t,r){let o=new Set;for(let i of e.values())await zg(i.pluginId,i.authType,i.integration,i.account,i.integrationFields,i.accountFields,n,t,r)&&o.add(i.pluginId);return o}async function Vg(e,n,t,r,o){if(!$g(Ui)){o("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let i=Ui,a=new Set(n.map(s=>s.id));for(let[s,u]of Object.entries(i)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let l=Me(e)?e[s]:void 0,c=Me(l)?l.api:void 0;if(c)for(let[d,p]of Object.entries(u))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${d}.${g}...`);try{let h=Me(c)?c[d]:void 0;await se(h,g)?.(f)}catch(h){o(`[corsair:setup] ${s} \u203A ${d}.${g} failed: `+(h instanceof Error?h.message:String(h)))}}}}export{os as a,Oe as b,Ce as c,Tt as d,Pt as e,vt as f,gn as g,is as h,qr as i,Vr as j,jn as k,ys as l,ms as m,De as n,Ze as o,Te as p,yn as q,mn as r,He as s,Qr as t,bs as u,Gn as v,Pe as w,zn as x,Xr as y,It as z,j as A,St as B,hn as C,K as D,N as E,Cs as F,Ts as G,Ht as H,Gg as I,Fe as J,no as K,wn as L,Tn as M,ro as N,Ot as O,Ms as P,Je as Q,X as R,oo as S,Yn as T,Us as U,nl as V,Ut as W,dm as X,Ls as Y,Ns as Z,$s as _,Ws as $,Ft as aa,io as ba,pe as ca,Lt as da,Nt as ea,An as fa,qt as ga,xn as ha,go as ia,Gs as ja,jt as ka,Ve as la,w as ma,wo as na,Co as oa,nr as pa,To as qa,_n as ra,En as sa,tr as ta,rr as ua,Qn as va,Po as wa,vo as xa,or as ya,Xn as za,ir as Aa,sr as Ba,Le as Ca,Mn as Da,aa as Ea,So as Fa,_o as Ga,Qe as Ha,tt as Ia,rt as Ja,gr as Ka,Oo as La,ot as Ma,ad as Na,pd as Oa,yd as Pa,ha as Qa,ba as Ra,yr as Sa,ka as Ta,wa as Ua,Xe as Va,en as Wa,Bo as Xa,Lo as Ya,No as Za,$o as _a,Wo as $a,nn as ab,E as bb,qo as cb,Aa as db,kr as eb,Ko as fb,wr as gb,xa as hb,Oa as ib,zo as jb,Jo as kb,Vo as lb,Yo as mb,Qo as nb,Xo as ob,ei as pb,ni as qb,ti as rb,ri as sb,oi as tb,ii as ub,si as vb,ai as wb,ui as xb,tn as yb,me as zb,rn as Ab,on as Bb,yi as Cb,xe as Db,vp as Eb,G as Fb,xu as Gb,Iu as Hb,Su as Ib,_u as Jb,Eu as Kb,Mu as Lb,Ou as Mb,Du as Nb,Hu as Ob,Uu as Pb,Fu as Qb,Bu as Rb,Nu as Sb,Jp as Tb,Dt as Ub,Ku as Vb,nR as Wb,cn as Xb,tR as Yb,Or as Zb,fg as _b,yg as $b,Ur as ac,bg as bc,oc as cc,kg as dc,wg as ec,ic as fc,sc as gc,ct as hc,Cg as ic,ac as jc,uc as kc,Tg as lc,Fr as mc,Pg as nc,ut as oc,pc,vg as qc,xg as rc};