corsair 0.1.94 → 0.1.95

package/dist/chunk-IGJCF7OM.js

@@ -0,0 +1,38 @@
+import{a as ie,b as dr,c as T,d as $,e as pr,f as G,g as D,h as O,i as nn,j as gr,k as Jn,l as fr,m as yr}from"./chunk-FLNFC4KL.js";import{a as lr}from"./chunk-IGGCNGU2.js";var tn=["agentql","ahrefs","airtable","amplitude","asana","bitwarden","bluesky","box","cal","calendly","cloudflare","cursor","discord","dodopayments","dropbox","exa","figma","firecrawl","fireflies","github","gitlab","gmail","googlecalendar","googledrive","googlesheets","grafana","hackernews","hubspot","intercom","jira","linear","monday","notion","onedrive","openweathermap","oura","outlook","pagerduty","posthog","razorpay","reddit","resend","sentry","sharepoint","slack","spotify","strava","stripe","tally","tavily","teams","telegram","todoist","trello","twilio","twitter","twitterapiio","typeform","vapi","xquik","youtube","zendesk","zohomail","zoom"],mr={agentql:"AgentQL",ahrefs:"Ahrefs",airtable:"Airtable",amplitude:"Amplitude",asana:"Asana",bitwarden:"Bitwarden",bluesky:"Bluesky",box:"Box",cal:"Cal",calendly:"Calendly",cloudflare:"Cloudflare",cursor:"Cursor",discord:"Discord",dodopayments:"Dodo Payments",dropbox:"Dropbox",exa:"Exa",figma:"Figma",firecrawl:"Firecrawl",fireflies:"Fireflies",github:"GitHub",gitlab:"GitLab",gmail:"Gmail",googlecalendar:"Google Calendar",googledrive:"Google Drive",googlesheets:"Google Sheets",grafana:"Grafana",hackernews:"Hacker News",hubspot:"HubSpot",intercom:"Intercom",jira:"Jira",linear:"Linear",monday:"Monday",notion:"Notion",onedrive:"OneDrive",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",resend:"Resend",sentry:"Sentry",sharepoint:"SharePoint",slack:"Slack",spotify:"Spotify",strava:"Strava",stripe:"Stripe",tally:"Tally",tavily:"Tavily",teams:"Teams",telegram:"Telegram",todoist:"Todoist",trello:"Trello",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",typeform:"Typeform",vapi:"Vapi",xquik:"XQuik",youtube:"YouTube",zendesk:"Zendesk",zohomail:"Zoho Mail",zoom:"Zoom"};function se(e){let n=mr[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var Le="https://auth.corsair.dev";var he=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}};function rn(e){let n=(e.apiUrl?.trim()||Le).replace(/\/$/,""),t=e.projectApiKey.trim(),r=e.signingSecret.trim();if(!t||!r)throw new Error("Hub config requires non-empty projectApiKey and signingSecret");return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,"")}}function Ko(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function Y(e){let n=T(e).hub;if(!n||!Ko(n))throw new he;return n}function hr(e){return e.replace(/\/$/,"")}function on(e){return e.oauthCallbackUrl?hr(e.oauthCallbackUrl.trim()):`${hr(e.apiUrl)}/oauth/callback`}function xe(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}function v(e){return typeof e=="string"&&e.length>0}function qo(e){return e==="pending"||e==="connected"||e==="failed"}function Zo(e){return e==="oauth"||e==="api_key"||e==="bot_token"}function sn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!v(n.connectUrl)||!v(n.token)||!v(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:v(n.environmentId)?n.environmentId:n.projectId};return v(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function an(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;!v(r.tenantId)||!v(r.plugin)||!qo(r.status)||!Zo(r.authKind)||n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authKind:r.authKind,connectedAt:v(r.connectedAt)?r.connectedAt:null,expiresAt:v(r.expiresAt)?r.expiresAt:null})}return n}function un(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!v(n.approvalUrl)||!v(n.token)||!v(n.projectId)||!v(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function cn(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(v(n.access_token))return{access_token:n.access_token,refresh_token:v(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:v(n.scope)?n.scope:void 0};throw new Error(v(n.error)?v(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Go(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function Jo(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;v(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function zo(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(o=>o.level==="integration"&&o.required&&!o.configured)?"missing_integration":t.some(o=>o.level==="account"&&o.required&&o.configured)?"partial":(r.length>0,"not_started")}function kr(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!v(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let i=r;if(!v(i.plugin)||typeof i.connected!="boolean")continue;let o=i.authKind==="oauth"||i.authKind==="api_key"||i.authKind==="bot_token"?i.authKind:"api_key",a=Jo(i.fields),s=Go(i.missingRequiredFields),u=zo(i.status,i.connected,a,s);t.push({plugin:i.plugin,providerName:v(i.providerName)?i.providerName:i.plugin,authKind:o,status:u,connected:i.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function ln(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function br(e){return e.replace(/\/$/,"")}async function Cr(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function wr(e,n,t){if(n===404&&t)return t;let r=ln(e);return r||`Hub API returned HTTP ${n}`}async function Re(e){let n=br(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`},body:JSON.stringify(e.body)}),r=await Cr(t);if(!t.ok)throw new Error(wr(r,t.status,e.notFoundMessage));return e.parseResponse(r)}async function Pr(e){let n=br(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`}}),r=await Cr(t);if(!t.ok)throw new Error(wr(r,t.status,e.notFoundMessage));return e.parseResponse(r)}import{createCipheriv as Tr,createDecipheriv as vr,randomBytes as dn,scrypt as Vo}from"crypto";import{promisify as Yo}from"util";var Ar=Yo(Vo),pn="aes-256-gcm",xr=12,gn=16,Qo=16,We=32;function Q(){return dn(We).toString("base64")}async function X(e,n){let t=dn(Qo),r=await Ar(n,t,We),i=dn(xr),o=Tr(pn,r,i,{authTagLength:gn}),a=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[t.toString("base64"),i.toString("base64"),s.toString("base64"),a.toString("base64")].join(":")}async function N(e,n){let[t,r,i,o]=e.split(":");if(!t||!r||!i||!o)throw new Error("Invalid encrypted DEK format");let a=Buffer.from(t,"base64"),s=Buffer.from(r,"base64"),u=Buffer.from(i,"base64"),l=Buffer.from(o,"base64"),d=await Ar(n,a,We),c=vr(pn,d,s,{authTagLength:gn});return c.setAuthTag(u),Buffer.concat([c.update(l),c.final()]).toString("utf8")}function zn(e,n){let t=Buffer.from(n,"base64"),r=dn(xr),i=Tr(pn,t,r,{authTagLength:gn}),o=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[r.toString("base64"),a.toString("base64"),o.toString("base64")].join(":")}function je(e,n){let[t,r,i]=e.split(":");if(!t||!r||!i)throw new Error("Invalid encrypted data format");let o=Buffer.from(n,"base64"),a=Buffer.from(t,"base64"),s=Buffer.from(r,"base64"),u=Buffer.from(i,"base64"),l=vr(pn,o,a,{authTagLength:gn});return l.setAuthTag(s),Buffer.concat([l.update(u),l.final()]).toString("utf8")}function ae(e,n){let t={};for(let[r,i]of Object.entries(e))t[r]=zn(i,n);return t}function ee(e,n){let t={};for(let[r,i]of Object.entries(e))t[r]=je(i,n);return t}function Ke(e,n,t){let r=ee(e,n);return ae(r,t)}function Rr(e,n,t){let r={};for(let i of t)r[`get_${i}`]=async()=>(await e())[i]??null,r[`set_${i}`]=async o=>{let a=[null,void 0,""].includes(o)?null:o;await n({[i]:a})};return r}var Vn=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function _(e){let{authType:n,integrationName:t,kek:r,database:i,extraIntegrationFields:o=[]}=e,a=[...D[n].integration,...o],s=null,u={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let f=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!f)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:f.id,config:Vn(f.config),dek:f.dek??null},s},updateIntegration:async f=>{let y=await u.getIntegration();await i.db.updateTable("corsair_integrations").set({...f.config!==void 0?{config:f.config}:{},...f.dek!==void 0?{dek:f.dek}:{},updated_at:new Date}).where("id","=",y.id).execute(),s=null}},l=null,d=async()=>{if(l)return l;let f=await u.getIntegration();if(!f.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await N(f.dek,r),l},c=async()=>{let f=await u.getIntegration(),y=await d(),m=f.config;return!m||Object.keys(m).length===0?{}:ee(m,y)};return{get_dek:d,issue_new_dek:async()=>{let f=await u.getIntegration(),y=Q(),m={};if(f.dek){let P=await N(f.dek,r),w=f.config;w&&Object.keys(w).length>0&&(m=Ke(w,P,y))}let h=await X(y,r);return await u.updateIntegration({config:m,dek:h}),l=y,y},...Rr(c,async f=>{let y=await d(),m;try{m=await c()}catch(w){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,w),m={}}let h={...m};for(let[w,k]of Object.entries(f))k===null?delete h[w]:h[w]=k;let P=ae(h,y);await u.updateIntegration({config:P})},a)}}function R(e){let{authType:n,integrationName:t,tenantId:r,kek:i,database:o,extraAccountFields:a=[]}=e,s=[...D[n].account,...a],u=null,l=null,d=async()=>{if(l)return l;let k=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!k)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return l={id:k.id,config:Vn(k.config),dek:k.dek??null},l},c={kek:i,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(u)return u;let k=await d(),b=await o.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",k.id).executeTakeFirst();if(!b)throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`);return u={id:b.id,config:Vn(b.config),dek:b.dek??null},u},updateAccount:async k=>{let b=await c.getAccount();await o.db.updateTable("corsair_accounts").set({...k.config!==void 0?{config:k.config}:{},...k.dek!==void 0?{dek:k.dek}:{},updated_at:new Date}).where("id","=",b.id).execute(),u=null}},p=null,g=null,f=async()=>{if(p)return p;let k=await c.getAccount();if(!k.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p=await N(k.dek,i),p},y=async()=>{if(g)return g;let k=await c.getIntegration();if(!k.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return g=await N(k.dek,i),g},m=async()=>{let k=await c.getAccount(),b=await f(),C=k.config;return!C||Object.keys(C).length===0?{}:ee(C,b)},h=async()=>{let k=await c.getIntegration(),b=await y(),C=k.config;return!C||Object.keys(C).length===0?{}:ee(C,b)},w={get_dek:f,issue_new_dek:async()=>{let k=await c.getAccount(),b=Q(),C={};if(k.dek){let S=await N(k.dek,i),E=k.config;E&&Object.keys(E).length>0&&(C=Ke(E,S,b))}let F=await X(b,i);return await c.updateAccount({config:C,dek:F}),p=b,b},...Rr(m,async k=>{let b=await f(),C;try{C=await m()}catch(E){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,E),C={}}let F={...C};for(let[E,I]of Object.entries(k))I===null?delete F[E]:F[E]=I;let S=ae(F,b);await c.updateAccount({config:S})},s)};return n==="oauth_2"&&(w.get_integration_credentials=async()=>{let k=await h();return{client_id:k.client_id||null,client_secret:k.client_secret||null,redirect_url:k.redirect_url??null}}),w}async function Sr(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let i=Q(),o=await X(i,t);return await e.db.updateTable("corsair_integrations").set({dek:o,updated_at:new Date}).where("id","=",r.id).execute(),i}async function Ir(e,n,t,r){let i=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!i)throw new Error(`Integration "${n}" not found.`);let o=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",i.id).executeTakeFirst();if(!o)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=Q(),s=await X(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",o.id).execute(),a}var Xo=new Set(["webhook_signature","expires_at","scope","redirect_url"]);function Se(e){return Xo.has(e)}function ei(e,n){return Se(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function ni(e){return!Se(e)}function ti(e){switch(e){case"oauth_2":case"managed":return["access_token","refresh_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function ri(e,n){return ti(e).every(r=>n.find(o=>o.level==="account"&&o.name===r)?.configured??!1)}async function _r(e,n){if(!e)return!1;let t=G(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function oi(e,n){let r=e.authConfig?.[n]?.integration??[];return[...D[n].integration,...r]}function ii(e,n){let r=e.authConfig?.[n]?.account??[];return[...D[n].account,...r]}function si(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return i.length>0?a="missing_integration":r.length===0?a="ready":o.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:ri(n,t),fields:t,missingRequiredFields:r}}async function fn(e,n,t){let r=O(n);if(!r||!e.database||!e.kek)return null;let i=t.trim()||"default",o=n.authConfig,a=o?.[r]?.integration??[],s=o?.[r]?.account??[],u=_({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),l=R({authType:r,integrationName:n.id,tenantId:i,kek:e.kek,database:e.database,extraAccountFields:s}),d=oi(n,r),c=ii(n,r),p=[];for(let g of d)p.push({name:g,level:"integration",required:ei(r,g),configured:await _r(u,g)});for(let g of c)p.push({name:g,level:"account",required:ni(g),configured:await _r(l,g)});return si(n.id,r,p)}async function qe(e,n,t={}){let r=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,o=[];for(let a of e.plugins){if(i&&!i.has(a.id))continue;let s=await fn(e,a,r);s&&o.push(s)}return o}function yn(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}import{ZodBoolean as ui,ZodDate as ci,ZodEnum as li,ZodNullable as di,ZodNumber as pi,ZodObject as gi,ZodOptional as fi,ZodRecord as yi,ZodString as mi,ZodType as hi}from"zod";var ai={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},Yn=ai;async function Dr(e,n){let t=[],r=n?.silent??!1,i=g=>{t.push(g),r||console.log(g)},o=g=>{t.push(g),r||console.warn(g)},a=n?.caller??"script",s=dr(e);if(!s)throw new Error("setupCorsair: invalid corsair instance");if(!s.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let u=bi(e,s.plugins,n),l={...s,database:s.database},d=l.database.db;await Pi(d,o);let c=await Ti(d,l,u.tenantId,u.provisionAccounts,i);n?.credentials&&Object.keys(n.credentials).length>0&&await xi(e,u,n.credentials,l,i,o);let p=await Si(c,u,i,a);if(n?.backfill){i("[corsair:setup] Starting backfill...");let g=Mr({plugins:s.plugins,database:d,kek:s.kek,multiTenancy:!0}).withTenant(u.tenantId);await Ii(g,s.plugins,p,i,o),i("[corsair:setup] Backfill complete.")}return t.join(`
+`)}function Qn(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...D[n][t],...r])}function ki(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let i=n.find(s=>s.id===t);if(!i)continue;let o=O(i);if(!o)continue;let a=Qn(i,o,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function bi(e,n,t){let r=pr(e),i=t?.tenantId?.trim(),o=i!==void 0&&i.length>0;if(r&&t?.backfill&&!o)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&ki(t?.credentials,n)&&!o)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(o&&!i)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:o,tenantId:o?i:"default",provisionAccounts:!r||o}}function Or(e,n){return ie(e)?n===0?!0:Object.values(e).every(t=>Or(t,n-1)):!1}function Ci(e){return Or(e,4)}var wi={...fr};function mn(e){if(e instanceof gi){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof hi?mn(r):"unknown";return n}return e instanceof di?`${mn(e.unwrap())} | null`:e instanceof fi?`${mn(e.unwrap())} | undefined`:e instanceof li?e.options.join(" | "):e instanceof mi?"string":e instanceof pi?"number":e instanceof ui?"boolean":e instanceof ci?"date":e instanceof yi?"jsonb":"unknown"}async function Pi(e,n){let t=await e.introspection.getTables(),r=new Set(t.map(i=>i.name));for(let[i,o]of Object.entries(wi))r.has(i)||n(`[corsair:setup] Table "${i}" does not exist. Run your database migrations before calling setupCorsair.
+Schema: ${JSON.stringify(mn(o),null,2)}`)}async function Ti(e,n,t,r,i){let o=new Date,a=new Map;for(let s of n.plugins){let u=s.id,l=O(s),d=await e.selectFrom("corsair_integrations").selectAll().where("name","=",u).executeTakeFirst();if(!d){let y=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:y,name:u,config:{},created_at:o,updated_at:o}).execute(),d=await e.selectFrom("corsair_integrations").selectAll().where("id","=",y).executeTakeFirst(),i(`[corsair:setup] Created integration: ${u}`)}let c=l?s.authConfig?.[l]?.integration??[]:[],p=l?s.authConfig?.[l]?.account??[]:[],g=l&&d?_({authType:l,integrationName:u,kek:n.kek,database:n.database,extraIntegrationFields:c}):void 0;if(d&&!d.dek&&g&&(await g.issue_new_dek(),i(`[corsair:setup] Issued integration DEK: ${u}`)),!d||!l||!g)continue;let f;if(r){let y=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",d.id).executeTakeFirst();if(!y){let m=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:m,tenant_id:t,integration_id:d.id,config:{},created_at:o,updated_at:o}).execute(),y=await e.selectFrom("corsair_accounts").selectAll().where("id","=",m).executeTakeFirst(),i(`[corsair:setup] Created account: ${u}`)}f=y&&R({authType:l,integrationName:u,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),y&&f&&!y.dek&&(await f.issue_new_dek(),i(`[corsair:setup] Issued account DEK: ${u}`))}a.set(u,{pluginId:u,authType:l,integration:g,account:f,integrationFields:[...D[l].integration,...c],accountFields:r?[...D[l].account,...p]:[]})}return a}function vi(e){if(!ie(e))return;let n=e.keys;return ie(n)?n:void 0}function Ai(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function xi(e,n,t,r,i,o){let a=vi(e),s=n.provisionAccounts?Ai(e,n.tenantId):void 0;for(let[u,l]of Object.entries(t)){let d=r.plugins.find(h=>h.id===u);if(!d){o(`[corsair:setup] Unknown plugin '${u}' \u2014 skipping credentials.`);continue}let c=O(d);if(!c){o(`[corsair:setup] Plugin '${u}' has no auth type \u2014 skipping credentials.`);continue}let p=Qn(d,c,"integration"),g=Qn(d,c,"account"),f=a?.[u],y=s?.[u],m=ie(y)?y.keys:void 0;for(let[h,P]of Object.entries(l))if(P){if(p.has(h)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${u}.${h}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let w=G(f,`set_${h}`);if(!w){o(`[corsair:setup] Cannot set integration field '${h}' for '${u}'.`);continue}await w(P),i(`[corsair:setup] Set ${u} integration.${h}`);continue}if(g.has(h)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${u}.${h}' on a multi-tenant instance`);let w=G(m,`set_${h}`);if(!w){o(`[corsair:setup] Cannot set account field '${h}' for '${u}'.`);continue}await w(P),i(`[corsair:setup] Set ${u} account.${h} (tenant=${n.tenantId})`);continue}o(`[corsair:setup] Unknown credential field '${h}' for plugin '${u}'.`)}}}var Er=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function Ri(e,n,t,r,i,o,a,s,u){let l=[],d=[];for(let p of i){if(Er.has(p))continue;let g=G(t,`get_${p}`);if(!g)continue;let f=null;try{let y=await g();f=typeof y=="string"?y:null}catch{}f||l.push(p)}if(r&&o.length>0)for(let p of o){if(Er.has(p))continue;let g=G(r,`get_${p}`);if(!g)continue;let f=null;try{let y=await g();f=typeof y=="string"?y:null}catch{}f||d.push(p)}let c=l.length===0&&d.length===0;if(c)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...d];if(u==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
+  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of d){let y=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${y}.keys.set_${f}(value)`)}s(g.join(`
+`))}}return c}async function Si(e,n,t,r){let i=new Set;for(let o of e.values())await Ri(o.pluginId,o.authType,o.integration,o.account,o.integrationFields,o.accountFields,n,t,r)&&i.add(o.pluginId);return i}async function Ii(e,n,t,r,i){if(!Ci(Yn)){i("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let o=Yn,a=new Set(n.map(s=>s.id));for(let[s,u]of Object.entries(o)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let l=ie(e)?e[s]:void 0,d=ie(l)?l.api:void 0;if(d)for(let[c,p]of Object.entries(u))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${c}.${g}...`);try{let y=ie(d)?d[c]:void 0;await G(y,g)?.(f)}catch(y){i(`[corsair:setup] ${s} \u203A ${c}.${g} failed: `+(y instanceof Error?y.message:String(y)))}}}}async function Ie(e,n){if(!T(e).database)throw new Error("A database must be configured to provision Corsair for connect");await Dr(e,{tenantId:n,silent:!0})}var _i=Symbol.for("corsair:internal"),Ei=new Set(["access_token","refresh_token","expires_at","scope"]);function Di(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Oi(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!Se(t)&&!Ei.has(t)):n.filter(t=>!Se(t))}function Hr(e){return{plugins:e.plugins,database:e.database,kek:e.kek,multiTenancy:!1}}function Fr(e){return{[_i]:Hr(e)}}async function et(e,n,t={}){let r=on(e.hub),i=[],o=t.pluginIds?new Set(t.pluginIds):null,a=Hr(e),s=Fr(e);for(let u of e.plugins){if(o&&!o.has(u.id))continue;let l=O(u);if(!l)continue;let d=Di(l),c=t.providerNameOverrides?.[u.id]??se(u.id),p=await fn(a,u,n),g=nn(u,l),f=Oi(l,g),y={plugin:u.id,providerName:c,authKind:d,alreadyConfigured:p?.connected??!1};if(f.length>0&&(y.credentialFields=f),d==="oauth"){let h=t.oauthModeOverrides?.[u.id]??(l==="managed"?"managed":"byo");if(y.oauthMode=h,!t.skipOAuthUrlGeneration&&h!=="managed")try{let P=await Xn(s,u.id,{tenantId:n,redirectUri:r,hubConnect:!0});y.oauthUrl=P.url}catch(P){y.setupError=P instanceof Error?P.message:`Could not prepare OAuth for ${u.id}`}}i.push(y)}return i}async function nt(e,n){if(!e.database)throw new Error("A database must be configured to provision Corsair for connect");await Ie(Fr(e),n)}var Mi="3000",Hi="/api/corsair";function tt(e){return e.replace(/\/$/,"")}function Fi(e,n){return`${tt(e)}${n}`}function Ur(e){return e.startsWith("http")?e:`https://${e}`}function _e(e){let n=e?.deliveryUrl?.trim();if(n)return tt(n);let t=e?.deliveryPath?.trim()||Hi,r=t.startsWith("/")?t:`/${t}`,i=process.env.CORSAIR_DELIVERY_URL?.trim();if(i)return tt(Ur(i));let o=process.env.APP_URL?.trim()||process.env.NEXT_PUBLIC_APP_URL?.trim()||process.env.VERCEL_URL?.trim();return o?Fi(Ur(o),r):`http://localhost:${process.env.PORT?.trim()||Mi}${r}`}async function Br(e,n){let t=xe(e.projectApiKey),r={tenantId:n.tenantId,plugins:n.plugins};return t==="development"&&(r.deliveryUrl=_e({deliveryUrl:n.deliveryUrl})),Re({hub:e,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:sn})}async function rt(e,n){let t={plugins:n.plugins,database:n.database,kek:n.kek,hub:e};await nt(t,n.tenantId);let r=await et(t,n.tenantId,{pluginIds:[n.plugin.id]});if(r.length===0)throw new Error(`Plugin '${n.plugin.id}' is not configured on this Corsair instance`);return Br(e,{tenantId:n.tenantId,plugins:r,deliveryUrl:n.deliveryUrl})}async function hn(e,n){let t=T(e),r=Y(e),i={plugins:t.plugins,database:t.database,kek:t.kek,hub:r};await nt(i,n.tenantId);let o=n.plugin?[n.plugin]:void 0,a=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,s=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,u=await et(i,n.tenantId,{pluginIds:o,oauthModeOverrides:a,providerNameOverrides:s});if(u.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");return Br(r,{tenantId:n.tenantId,plugins:u,deliveryUrl:n.deliveryUrl})}function $r(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ui(e,n){return n&&!n.has(e.id)?!1:O(e)!==null}async function Ee(e,n,t={}){let r=T(e),i=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,a=await qe(r,i,{pluginIds:t.pluginIds}),s=new Map(a.map(l=>[l.plugin,l])),u=r.plugins.filter(l=>Ui(l,o)).map(l=>{let d=O(l),c=s.get(l.id);return c?{plugin:l.id,providerName:se(l.id),authKind:$r(d),status:c.status,connected:c.connected,fields:c.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:c.missingRequiredFields}:{plugin:l.id,providerName:se(l.id),authKind:$r(d),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:i,plugins:u}}async function Nr(e,n){let t=Y(e);return Pr({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:an})}var Bi=new Set(["localhost","127.0.0.1","[::1]","::1"]);function ot(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Bi.has(n)}catch{return!1}}function it(e){return e==="development"?"browser":"server"}function Lr(e){return it(e)==="browser"}function Wr(e){return ot(e)?"Production delivery URL must be a public URL, not localhost":null}var ue=6e4,ke=3e5;var J=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function kn(e,n){let t=T(e,()=>new J("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new J("no_database","Database not configured");let r=$(t,n.plugin,d=>new J("plugin_not_found",d)),i=O(r);if(!i)throw new J("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(i==="oauth_2"||i==="managed")throw new J("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await Ie(e,n.tenantId);let o=new Set(nn(r,i)),s=r.authConfig?.[i]?.account??[],u=R({authType:i,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),l=0;for(let[d,c]of Object.entries(n.credentials)){if(!c.trim())continue;if(!o.has(d))throw new J("invalid_credentials",`Unknown credential field '${d}' for plugin '${n.plugin}'`);let p=G(u,`set_${d}`);if(!p)throw new J("invalid_credentials",`Cannot set credential field '${d}' for plugin '${n.plugin}'`);await p(c.trim()),l+=1}if(l===0)throw new J("invalid_credentials","Provide at least one credential field to save");return{plugin:n.plugin,tenantId:n.tenantId}}var bn=new Map;function $i(e){for(let[n,t]of bn)t<=e&&bn.delete(n)}function Cn(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};let r=Date.now();return $i(r),bn.has(t)?{ok:!1,error:"Delivery request already consumed"}:(bn.set(t,r+n),{ok:!0})}async function wn(e,n,t){for(let r of e){if(r.id!==n)continue;let i=r.oauthWebhookTenantLinkResolver;return i?i(t):null}return null}var jr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function Ni(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function Li(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await N(n.dek,e.kek),r=jr(n.config),i={};Object.keys(r).length>0&&(i=ee(r,t)),i[e.link.linkType]=e.link.externalId;let o=ae(i,t);await e.database.db.updateTable("corsair_accounts").set({config:o,updated_at:new Date}).where("id","=",n.id).execute()}async function De(e){let{database:n,kek:t,pluginId:r,tenantId:i,link:o,authType:a,extraAccountFields:s=[]}=e,{accountId:u}=await Ni({database:n,pluginId:r,tenantId:i}),l=!1;if(a){let d=R({authType:a,integrationName:r,tenantId:i,kek:t,database:n,extraAccountFields:s}),c=`set_${o.linkType}`,p=d[c];typeof p=="function"&&(await p(o.externalId),l=!0)}l||await Li({database:n,kek:t,accountId:u,link:o})}async function st(e){let{database:n,kek:t,pluginId:r,linkType:i,externalId:o}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let u=await N(s.dek,t),d=jr(s.config)[i];if(!d)continue;if(je(d,u)===o)return s}catch{continue}return null}async function Pn(e){return(await st(e))?.tenant_id??null}async function Kr(e){return Pn({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}var ce=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function Oe(e,n){let{plugin:t,tenantId:r,accessToken:i,refreshToken:o,expiresIn:a,scope:s}=n;if(!i.trim())throw new ce("no_access_token","Managed OAuth delivery missing access_token");let u=T(e,()=>new ce("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new ce("no_database","No database configured on corsair instance");let l=$(u,t,c=>new ce("plugin_not_found",c));await Ie(e,r);let d=R({authType:"managed",integrationName:t,tenantId:r,kek:u.kek,database:u.database});await d.set_access_token(i),o&&await d.set_refresh_token(o),a&&await d.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await d.set_scope(s);try{let c=await wn(u.plugins,t,{access_token:i,refresh_token:o,scope:s});if(c)try{let p=l.authConfig?.managed?.account??[];await De({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:c,authType:"managed",extraAccountFields:p})}catch(p){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,p)}}catch(c){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,c)}return{plugin:t,tenantId:r}}import{createHmac as at,randomUUID as Wi,timingSafeEqual as qr}from"crypto";function Zr(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function Tn(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=at("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":Wi()}}}function ut(e){let n=e.signingSecret.trim();if(!n)return!1;let t=Zr(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>3e5)return!1;let o=at("sha256",n).update(e.body).digest("hex");try{return qr(Buffer.from(o,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function Me(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=Zr(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>3e5)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let o=at("sha256",n).update(e.body).digest("hex");try{if(!qr(Buffer.from(o,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function ct(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function lt(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function dt(e){return e.status===0?`Could not reach delivery URL (${e.deliveryUrl}): ${e.ack.error??e.body}`:e.ack.error??e.body??`HTTP ${e.status}`}async function pt(e){let{body:n,headers:t}=Tn(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n}),i=await r.text();return{ok:r.ok,status:r.status,body:i}}catch(r){return{ok:!1,status:0,body:r instanceof Error?r.message:"Delivery request failed"}}}function ji(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Gr(e,n,t=[]){for(let[r,i]of Object.entries(e))if(ji(i)){if(i.match(n))return{webhook:i,path:[...t,r]}}else if(i&&typeof i=="object"){let o=Gr(i,n,[...t,r]);if(o)return o}return null}function Ki(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function qi(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function Jr(e,n,t,r){let i=Ki(n),o=typeof t=="string"?JSON.parse(t):t;(!o||typeof o=="object"&&Object.keys(o).length===0)&&i["x-goog-resource-uri"]&&(o=qi(i)||o);let s={headers:i,body:o,...r?{query:r}:{}},u=r?.tenantId||"default",l=e.withTenant?e.withTenant(u):e,d=tn;for(let c of d){let p=l[c];if(!p||!p.webhooks||p.pluginWebhookMatcher&&!p.pluginWebhookMatcher(s))continue;let g=Gr(p.webhooks,s);if(!g)continue;let f=g.path.join("."),y={payload:o,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{}};try{let m=await g.webhook.handler(y),h=!!Object.keys(m.returnToSender||{})?.length;return{plugin:c,action:f,body:o,response:h?{...m?.returnToSender,success:!0}:{success:!0},...m.responseHeaders&&{responseHeaders:m.responseHeaders}}}catch(m){return console.error(`Error executing webhook handler for ${c}.${f}:`,m),{plugin:c,action:f,body:o,response:{success:!1,error:m instanceof Error?m.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{randomBytes as zi}from"crypto";import{createHmac as Zi,randomBytes as Gi,timingSafeEqual as Ji}from"crypto";function ne(){return Gi(16).toString("base64url")}function Ze(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Zi("sha256",t).update(e).digest("base64url")}function z(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[i,o]=r;if(!i||!o)return null;let a=Ze(i,t);try{if(!Ji(Buffer.from(o,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(i,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function vn(e,n,t){let r=Math.floor(Date.now()/1e3),i={...e,iat:r,exp:t},o=Buffer.from(JSON.stringify(i)).toString("base64url"),a=Ze(o,n);return`${o}.${a}`}function Ge(e,n,t){let r=Math.floor(Date.now()/1e3);return vn(e,n,r+Math.floor(t/1e3))}function be(e){return decodeURIComponent(e)}function gt(e){return encodeURIComponent(e)}function zr(e){let n=e.trim();return n.length>0?n:null}function An(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function xn(e,n){if(!zr(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??zi(16).toString("base64url"),iat:t,exp:t+Math.floor(6e4/1e3)},i=Buffer.from(JSON.stringify(r)).toString("base64url"),o=Ze(i,n);return`${i}.${o}`}function le(e,n){return zr(n)?z(e,n):null}function Ce(e){return e.deliveryMode==="connect.status"}function we(e){return e.deliveryMode==="auth.credentials"}function Je(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function ze(e){return e.deliveryMode==="oauth.tokens"}function Rn(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!Ce(e)&&!we(e)&&!Je(e)&&!ze(e)}function ft(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function Vi(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await Pn({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function Yi(e,n,t){let r=await Vi(e,n,t),i={...t.query??{},...r?{tenantId:r}:{}},o=await Jr(e,t.headers,t.body,i);if(!o.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(o.response&&o.response.success===!1)return{status:"failed",retryable:!1,error:typeof o.response.error=="string"?o.response.error:"Webhook handler failed"};let a=o.response?.returnToSender,s=a&&typeof a=="object"&&typeof a.validationToken=="string"&&Object.keys(a).length===1?a.validationToken:a||(o.response?.data??o.response);return{status:"ok",webhookResponse:{status:o.response?.statusCode??200,body:s,headers:o.responseHeaders}}}async function Qi(e,n){return await Ve(e,n),{status:"ok"}}async function Xi(e,n){return await Oe(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope}),{status:"ok"}}async function mt(e,n,t){let r=await yt(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function yt(e,n,t){let r=T(e),i=n.token?.trim();if(!i)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let o=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",i).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<o?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function es(e,n){try{return await kn(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function ns(e,n){let t=n.tenantId?.trim()||"default";try{return{status:"ok",webhookResponse:{status:200,body:await Ee(e,t,{pluginIds:n.plugins})}}}catch(r){return{status:"failed",retryable:!1,error:r instanceof Error?r.message:"Connect status introspection failed"}}}async function ht(e,n,t={}){let r=T(e),i=ft(n.headers,"x-corsair-signature"),o=ft(n.headers,"x-corsair-timestamp"),a=ft(n.headers,"x-corsair-nonce");if(t.signingSecret?.trim()){let u=Me({body:n.body,signatureHeader:i,timestampHeader:o,signingSecret:t.signingSecret});if(!u.ok)return{status:"failed",retryable:!1,error:u.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let l=Cn(`nonce:${a.trim()}`,3e5);if(!l.ok)return{status:"failed",retryable:!1,error:l.error}}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let s;try{s=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}switch(s.type){case"webhook":return Yi(e,r,s.payload);case"oauth.callback":return Qi(e,s.payload);case"oauth.tokens":return Xi(e,s.payload);case"permission.approve":return yt(e,s.payload,"approved");case"permission.deny":return yt(e,s.payload,"denied");case"auth.credentials":return es(e,s.payload);case"connect.status":return ns(e,s.payload);default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${s.type}`}}}var ts="corsair:client-bridge";function Vr(e){let n=JSON.stringify({type:ts,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(e.hubOrigin);return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
+(function () {
+  var message = ${n};
+  var targetOrigin = ${t};
+  if (window.parent && window.parent !== window) {
+    window.parent.postMessage(message, targetOrigin);
+  }
+})();
+</script></body></html>`}var rs=[".corsair.dev"];function os(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function is(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:os(n)?!0:rs.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function Yr(e){return!e||!is(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function Qr(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,i]of Object.entries(n))t.set(r,i);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function Sn(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function kt(e,n){let t=Y(e),i=new URL(n).searchParams.get("d");if(!i)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let o=le(i,t.signingSecret);if(!o)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=Cn(`browser:${o.jti}`,6e4);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(Ce(o)){if(!o.hubSuccessUrl)return{type:"json",status:400,body:{error:"Connect status delivery missing hubSuccessUrl"}};let s=o.tenantId?.trim()||"default",u=await Ee(e,s,{pluginIds:o.statusPlugins});return{type:"redirect",url:Sn(o.hubSuccessUrl,{status:u})}}if(we(o))return o.hubSuccessUrl?o.credentials?(await kn(e,{plugin:o.plugin,tenantId:o.tenantId,credentials:o.credentials}),{type:"redirect",url:Sn(o.hubSuccessUrl,{connectedPlugin:o.plugin})}):{type:"redirect",url:Sn(o.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(Je(o)){if(!o.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await mt(e,o.permissionToken,o.deliveryMode==="permission.approve"?"approved":"denied")}else if(ze(o)){if(!o.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await Oe(e,{plugin:o.plugin,tenantId:o.tenantId,accessToken:o.accessToken,refreshToken:o.refreshToken,expiresIn:o.expiresIn,scope:o.scope})}else{if(!Rn(o)||!o.code||!o.state||!o.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await Ve(e,{code:o.code,state:o.state,redirectUri:o.redirectUri})}}catch(s){let u=s instanceof Error?s.message:"Hub delivery failed";return(Ce(o)||we(o))&&o.hubSuccessUrl?{type:"redirect",url:Sn(o.hubSuccessUrl,{error:u})}:(Ce(o)||we(o))&&o.hubOrigin&&o.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:Vr({hubOrigin:o.hubOrigin,requestId:o.requestId,ok:!1,error:u})}:{type:"json",status:400,body:{error:u}}}return{type:"redirect",url:o.hubSuccessUrl}}async function bt(e,n){let t=Y(e),r=await ht(e,n,{signingSecret:t.signingSecret});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let i=r.webhookResponse;if(!i)return{type:"json",status:200,body:{status:"ok"}};let o=i.status??200,a=i.headers;return i.body&&typeof i.body=="object"&&!(i.body instanceof ArrayBuffer)?{type:"json",status:o,body:i.body,headers:a}:{type:"text",status:o,body:typeof i.body=="string"?i.body:i.body?JSON.stringify(i.body):null,headers:a}}function Ct(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function wt(e,n){return n.method==="GET"?kt(e,n.url):bt(e,{headers:n.headers,body:n.body??""})}async function Pt(e,n){try{let t=await wt(e,n);return Ct(t)}catch(t){if(t instanceof he)return Response.json({error:t.message},{status:503});throw t}}async function Pe(e,n){let t=n.method.toUpperCase(),r=Yr(n.headers.get("origin"));if(t==="OPTIONS")return r?new Response(null,{status:204,headers:r}):Response.json({error:"Method not allowed"},{status:405});if(t!=="GET"&&t!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await Pt(e,{method:t,url:n.url,headers:n.headers,body:t==="POST"?await n.text():void 0});return Qr(i,r)}var te=class extends Error{pluginId;authType;constructor(n,t,r){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t}};var Xr=300;async function Tt(e,n){let{keys:t,hub:r,plugin:i,tenantId:o}=e,a=n?.forceRefresh??!1,[s,u,l]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!s&&!l)throw new te(i,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&s&&u&&Number(u)>d+Xr)return{accessToken:s,expiresAt:Number(u),refreshed:!1};if(!l&&s&&!a){let g=u?Number(u):null;if(g===null||g>d+Xr)return{accessToken:s,expiresAt:g??d+3600,refreshed:!1}}let c=await Re({hub:r,path:"/oauth/refresh",body:{plugin:i,tenantId:o},parseResponse:cn}),p=c.expires_in?d+c.expires_in:u?Number(u):d+3600;return await t.set_access_token(c.access_token),await t.set_expires_at(String(p)),c.refresh_token&&await t.set_refresh_token(c.refresh_token),c.scope&&await t.set_scope(c.scope),{accessToken:c.access_token,expiresAt:p,refreshed:!0}}async function eo(e,n){e._refreshAuth=async()=>(await Tt(n,{forceRefresh:!0})).accessToken}async function In(e,n){let t=xe(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return t==="development"&&(r.deliveryUrl=_e({deliveryUrl:n.deliveryUrl})),Re({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:un})}function _n(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}function no(e){return{delivery:n=>Pe(e,n),deliveryOptions:n=>Pe(e,n)}}var to=1200*1e3;function vt(){return ne()}function At(){return to}function xt(e,n){return Ge(e,n,to)}function Rt(e,n){return z(e,n)}function St(e){return be(e)}var ro=600*1e3;function It(){return ne()}function _t(){return ro}function Et(e,n){return Ge(e,n,ro)}function Dt(e,n){return z(e,n)}function Ot(e){return gt(e)}function Mt(e){return be(e)}function Ht(){return ne()}function Ft(e,n,t){return vn(e,n,Math.floor(t.getTime()/1e3))}function Ut(e,n){return z(e,n)}function Bt(e){return be(e)}function En(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(i,o){let a=t.length>1;throw new Error(`corsair.keys.${String(o)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
+
+To generate a KEK, run: openssl rand -base64 ${We}`)}})}function He(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}import*as Ye from"crypto";function de(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function $t(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let i=r;return n!==void 0&&typeof i.iat=="number"&&Date.now()-i.iat>n?null:i}return null}catch{return null}}function Fe(e,n){let t=Ye.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var Nt=600*1e3;function Dn(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),i=e.slice(t+1),o=Ye.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(i,"base64url"),s=Buffer.from(o,"base64url");return a.length!==s.length||!Ye.timingSafeEqual(a,s)?null:$t(r,{maxAgeMs:Nt})}function Lt(e,n){return`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${n}`}async function ss(e,n){let t=e.hub;if(!t||!n.database||!n.kek)return null;try{return(await rt(t,{tenantId:n.tenantId,plugin:n.plugin,database:n.database,kek:n.kek,plugins:n.plugins})).connectUrl}catch{return null}}async function as(e){let n=e.hub;if(n&&e.database&&e.kek)try{let r=await rt(n,{tenantId:e.tenantId,plugin:e.plugin,database:e.database,kek:e.kek,plugins:e.plugins});return e.manual?.onAuthMissing?e.manual.onAuthMissing({plugin:e.pluginId,connectUrl:r.connectUrl,state:r.token}):Lt(e.pluginId,r.connectUrl)}catch{return`[auth-missing:${e.pluginId}:${e.authType}] Authentication required. Could not create connect link. Check hub configuration and server logs.`}let t=await ss({manual:e.manual,hub:e.hub},{plugin:e.plugin,tenantId:e.tenantId,database:e.database,kek:e.kek,plugins:e.plugins});return t?Lt(e.pluginId,t):`[auth-missing:${e.pluginId}:${e.authType}]`}function us(e,n,t){let r=Fe(de(e,n.tenantId??t??"default"),n.kek),i=new URL(n.baseUrl);i.searchParams.set("state",r);let o=i.toString();return n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:o,state:r}):Lt(e,o)}async function oo(e){let n=e.tenantId??"default",t=e.error.pluginId;return e.manual&&He(e.manual)&&e.manual.oauthConfig&&e.manual.kek&&e.error.authType==="oauth_2"?us(t,{...e.manual,baseUrl:e.manual.baseUrl,kek:e.manual.kek},e.tenantId):e.hub&&e.plugin&&e.kek&&e.database&&e.plugins?as({manual:e.manual,hub:e.hub,plugin:e.plugin,pluginId:t,tenantId:n,authType:e.error.authType,database:e.database,kek:e.kek,plugins:e.plugins}):e.error.message}var cs=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function io(e,n,t,r,i){let o={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(i).find(l=>i[l]?.match(e,o));return await(i[a||"DEFAULT"]?.handler||cs)(e,o)}import{randomBytes as ds}from"crypto";import{v4 as ps}from"uuid";var Wt="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Kt(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function so(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function jt(e){return _n(e)}async function qt(e,n){if(Kt(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?so(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await In(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:ls(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function ls(e){try{return JSON.parse(e)}catch{return e}}async function On(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await qt(e,n);return{...n,approvalUrl:r}}async function Zt(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:i,permissionToken:o,plugin:a,endpoint:s,args:u,tenantId:l,expiresAt:d,operationPath:c}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:o,id:i,plugin:a,endpoint:s,args:u});let g=await qt({manual:t,hub:r},{id:i,token:o,plugin:a,endpoint:s,args:JSON.stringify(u),tenant_id:l,expires_at:d});return Kt(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):jt(g):Wt:r?g?jt(g):`Action '${c}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:Wt}var gs={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function fs(e,n,t){return t!==void 0?t:gs[n][e]}function Gt(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let i=parseInt(r[1],10);switch(r[2]){case"d":t+=i*864e5;break;case"h":t+=i*36e5;break;case"m":t+=i*6e4;break;case"s":t+=i*1e3;break}}return t>0?t:600*1e3}function uo(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function ao(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let i=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!i)return{result:"blocked",reason:"pending"};if(i.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(i.status==="denied")return{result:"blocked",reason:"denied"};if(i.status==="expired"||i.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(o=>setTimeout(o,500))}return{result:"blocked",reason:"timeout"}}async function co(e){let n=fs(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
+  Action: ${r}`,`
+  To allow this, update the permission mode or add an override in your corsair config.`),{result:"blocked",reason:"policy"};let i=JSON.stringify(e.args),o=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",i).where("tenant_id","=",a).where("expires_at",">",o).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,y=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",y).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
+  Action: ${r}`,`
+  Permission ID: ${s.id}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?ao(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let u=ps(),l=ds(32).toString("hex"),d=e.timeoutMs??600*1e3,c=new Date(Date.now()+d).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:u,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:i,tenant_id:a,status:"pending",expires_at:c}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
+  Action: ${r}`,`
+  Permission ID:    ${u}`,`
+  Permission token: ${l}`,`
+  Expires at:       ${c}`,`
+  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?ao(e.db,u,d):{result:"blocked",reason:"pending",id:u,token:l,expiresAt:c}}function ys(e){return typeof e=="function"}function Jt({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:i,errorHandlers:o,currentPath:a=[],keyBuilder:s,permissionsConfig:u,endpointMeta:l,database:d,permissionsOptions:c,tenantId:p,manualConfig:g,hubConfig:f,plugin:y,kek:m,allPlugins:h}){for(let[P,w]of Object.entries(e)){let k=n?.[P];if(ys(w)){let b=k,C=[...a,P].join("."),F=async(S={})=>{let E;if(u){let U=l?.[C],{result:en,reason:q,onComplete:Ne,token:V,id:me,expiresAt:B}=await co({pluginId:i,endpointPath:C,args:S,mode:u.mode,override:u.overrides?.[C],riskLevel:U?.riskLevel??"write",meta:U,db:d,timeoutMs:c?Gt(c.timeout):void 0,tenantId:p,approvalMode:c?.mode});if(en==="blocked"){let Z;throw q==="denied"?Z=`Action '${C}' was denied by the user. Await further instructions before proceeding.`:q==="policy"?Z=`Action '${C}' is blocked by the permission policy. Update the corsair config to allow it.`:q==="timeout"?Z=`Action '${C}' timed out waiting for approval.`:V&&me?Z=await Zt({permissionsOptions:c,manual:g,hub:f,permissionId:me,permissionToken:V,plugin:i,endpoint:C,args:S,tenantId:p??"default",expiresAt:B??new Date(Date.now()+(c?Gt(c.timeout):600*1e3)).toISOString(),operationPath:C}):Z=`Action '${C}' requires user approval before it can run.`,new Error(Z)}E=Ne}let I=async(U,en,q)=>{try{return await w(en,q)}catch(Ne){if(Ne instanceof Error){let V=await io(Ne,i,C,typeof q=="object"&&q!==null?q:{args:q},o);if(U<(V.maxRetries||0)){let me=U+1;console.log(`Retrying (${me} / ${V.maxRetries})...`);let B;if(V.headersRetryAfterMs)B=V.headersRetryAfterMs;else switch(V.retryStrategy){case"exponential_backoff":B=Math.pow(2,me-1)*1e3;break;case"exponential_backoff_jitter":let Z=Math.pow(2,me-1)*1e3,jo=(Math.random()-.5)*1e3;B=Math.max(0,Z+jo);break;case"linear_1s":B=1e3;break;case"linear_2s":B=2e3;break;case"linear_3s":B=3e3;break;case"linear_4s":B=4e3;break;default:B=1e3;break}await new Promise(Z=>setTimeout(Z,B)),await I(me,en,q),console.log(`[corsair:${i}:${C}] Retry strategy:`,V)}}throw Ne}},fe;try{fe=s?await s(t,"endpoint"):void 0}catch(U){if(U instanceof te)return oo({error:U,manual:g,hub:f,plugin:y,tenantId:p,database:d,kek:m,plugins:h});throw U}if(!b?.before&&!b?.after){let U=await I(0,{...t,key:fe},S);return await E?.(),U}let $e={...t,key:fe},ye=b.before?await b.before($e,S):{ctx:$e,args:S,continue:!0,passToAfter:void 0};if(ye.continue===!1)return;let cr=await I(0,ye.ctx,ye.args);return await b.after?.(ye.ctx,cr,ye.passToAfter),await E?.(),cr};r[P]=F}else if(w&&typeof w=="object"){let b={};Jt({endpoints:w,hooks:k,ctx:t,tree:b,pluginId:i,errorHandlers:o,currentPath:[...a,P],keyBuilder:s,permissionsConfig:u,endpointMeta:l,database:d,permissionsOptions:c,tenantId:p,manualConfig:g,hubConfig:f,plugin:y,kek:m,allPlugins:h}),r[P]=b}}}function ms(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function zt({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:i}){for(let[o,a]of Object.entries(e)){let s=n?.[o];if(ms(a)){let u=s,l=async d=>{let c=(g,f)=>a.handler(g,f),p=i?await i(t,"webhook"):void 0;return!u?.before&&!u?.after?c({...t,key:p},d):(async()=>{let g={...t,key:p},f=u.before?await u.before(g,d):{ctx:g,args:d,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let y=await c(f.ctx,f.args);return y?.success===!0&&await u.after?.(f.ctx,y,f.passToAfter),y})()};r[o]={match:a.match,handler:l}}else if(a&&typeof a=="object"){let u={};zt({webhooks:a,hooks:s,ctx:t,webhooksTree:u,keyBuilder:i}),r[o]=u}}}function hs(e,n,t){let r=null;return async()=>{if(r)return r;if(!e)throw new Error("Database not configured");let i=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!i)throw new Error(`Integration "${n}" not found. Make sure to create the integration first.`);let o=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",i.id).executeTakeFirst();if(!o)throw new Error(`Account not found for tenant "${t}" and integration "${n}". Make sure to create the account first.`);return r=o.id,r}}function ks(e,n,t,r,i){return e?Jn(e.db,n,t,r,i):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function Vt(e,n){let{database:t,tenantId:r,kek:i,rootErrorHandlers:o,permissionsOptions:a,manualConfig:s,hubConfig:u}=n,l={},d={};for(let c of e)l[c.id]={},d[c.id]={};for(let c of e){let p=c.schema,g=r??"default",f=hs(t,c.id,g);if(p?.entities){let I={};for(let[fe,$e]of Object.entries(p.entities)){let ye=t?Jn(t.db,f,fe,p.version,$e):ks(void 0,f,fe,p.version,$e);I[fe]=ye}d[c.id].db=I,l[c.id].db=I}let y=c.options,m=c.authConfig,h;if(t&&i&&y?.authType){let I=m?.[y.authType]?.account??[];h=R({authType:y.authType,integrationName:c.id,tenantId:g,kek:i,database:t,extraAccountFields:I}),l[c.id].keys=h}let P={database:t,db:d[c.id]?.db??{},$getAccountId:f,...c.options?{options:c.options}:{},...h?{keys:h,authType:y?.authType}:{},tenantId:g,...u?{hub:u}:{}},w=c.endpoints??{},k=c.hooks,b={...o,...c.errorHandlers},C={},F=c.options?.permissions;Jt({endpoints:w,hooks:k,ctx:P,tree:C,pluginId:c.id,errorHandlers:b,currentPath:[],keyBuilder:c.keyBuilder,permissionsConfig:F,endpointMeta:c.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:c.oauthConfig,kek:i,tenantId:g}:void 0,hubConfig:u,plugin:c,kek:i,allPlugins:e}),Object.keys(C).length>0&&(l[c.id].api=C),P.endpoints=C;let S=c.webhooks??{},E=c.webhookHooks;if(Object.keys(S).length>0){let I={};zt({webhooks:S,hooks:E,ctx:P,webhooksTree:I,keyBuilder:c.keyBuilder}),l[c.id].webhooks=I,c.pluginWebhookMatcher&&(l[c.id].pluginWebhookMatcher=c.pluginWebhookMatcher),c.pluginTenantWebhookMatcher&&(l[c.id].pluginTenantWebhookMatcher=c.pluginTenantWebhookMatcher)}}return l}function lo(e,n,t){let r={};for(let i of e){let o=i.options,a=i.authConfig;if(o?.authType){let s=a?.[o.authType]?.integration??[],u=_({authType:o.authType,integrationName:i.id,kek:t,database:n,extraIntegrationFields:s});r[i.id]=u}}return r}var bs="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function po(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${bs}`),t):n}import*as go from"querystring";function Te(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:i}=e,o={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:i};return`${n.authUrl}?${go.stringify(o)}`}var L=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function Cs(e){let n=e.oauthConfig;if(!n)throw new L("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Yt(e,n){let t=T(e,()=>new L("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new L("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new L("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let i=Dn(n,t.kek);if(!i)throw new L("invalid_state","Invalid or tampered state parameter");let{plugin:o,tenantId:a}=i,s=$(t,o,p=>new L("plugin_not_found",p)),u=Cs(s),d=await _({authType:"oauth_2",integrationName:o,kek:t.kek,database:t.database}).get_client_id();if(!d)throw new L("client_id_not_configured",`client_id not configured for '${o}'`);let c=Te({oauthConfig:u,clientId:d,redirectUri:r,state:n});return{plugin:o,tenantId:a,providerName:u.providerName,oauthUrl:c,state:n}}var A=class extends Error{status;code;extra;constructor(n,t,r,i={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=i}};function x(e,n){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json"}})}function fo(e){let n={error:e.code,message:e.message,...e.extra};return x(e.status,n)}function pe(e){return new A(404,"not_found",e)}function re(e,n={}){return new A(400,"bad_request",e,n)}function yo(e,n){return $(e,n,t=>pe(t))}async function mo(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=_({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),i=D[t].integration,o=r,a;try{a=await Promise.all(i.map(l=>o[`get_${l}`]()))}catch{a=i.map(()=>null)}let s=i.filter((l,d)=>a[d]==null),u;return t==="oauth_2"?u=!s.includes("client_id")&&!s.includes("client_secret"):u=s.length===0,{configured:u,missingFields:s}}async function ho(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:i,missingFields:o}=await mo(e,n);return{id:e.id,authType:t,configured:i,missingFields:o,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Mn(){return{ok:!0}}async function Hn(e){return Promise.all(e.plugins.map(n=>ho(n,e)))}async function Fn(e,n){let t=yo(e,n);return ho(t,e)}async function ws(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function ko(e,n){let t=await ws(e,n),r=t.filter(i=>i.hasCredentials).map(i=>i.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function Un(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let i=r.tenant_id;if(!i)continue;let o=n.get(i);o||(o={id:i,accounts:[],connectedPlugins:[]},n.set(i,o));let a=!!r.dek;o.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&o.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function Bn(e,n){if(!n)throw re("Tenant id must be a non-empty string");return ko(e,n)}async function $n(e,n){let t=n?.id?.trim();if(!t)throw re("Tenant id is required",{missingFields:["id"]});return ko(e,t)}async function Nn(e,n){let t=n?.trim()||"default",r={},i=await qe(e,t);for(let o of i)r[o.plugin]=yn(o);for(let o of e.plugins)o.id in r||(!o.options?.authType||!e.database||!e.kek?r[o.id]="missing_credentials":r[o.id]="not_connected");return r}async function Qt(e,n){if(!e.database)throw pe(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw pe(`Permission '${n}' not found`);return On(e,t)}function Ps(e){if(!e.oauthConfig)throw re(`Plugin '${e.id}' has no oauthConfig`)}function Ts(e){if(!e.manual)throw new A(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function Xt(e){let n=Ts(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new A(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function vs(e){let n=!!e.hub,t=He(e.manual);if(!n&&!t)throw new A(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function bo(e){if(!e.database||!e.kek)throw new A(500,"database_not_configured","A database and kek are required to issue connect links.")}async function As(e,n){let t=n?.plugin?.trim();if(!t)throw re("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",i=yo(e,t);Ps(i);let o=Xt(e);bo(e);let a=await mo(i,e);if(!a.configured)throw new A(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=Fe(de(t,r),e.kek),u;try{u=new URL(o.baseUrl)}catch{throw new A(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return u.searchParams.set("state",s),{connectUrl:u.toString(),expiresAt:new Date(Date.now()+Nt).toISOString()}}async function xs(e,n,t){bo(n);let i={tenantId:t.tenantId?.trim()||"default",oauthMode:t.oauthMode},o=t.plugin?.trim();o&&(i.plugin=o);let a=t.providerName?.trim();a&&(i.providerName=a);let s=await hn(e,i);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt}}async function Ln(e,n,t){return vs(n),n.hub?xs(e,n,t):As(n,t)}async function Wn(e,n,t){if(n.hub&&!He(n.manual))throw new A(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw re("state is required",{missingFields:["state"]});Xt(n);try{return await Yt(e,r)}catch(i){if(i instanceof L)switch(i.code){case"invalid_state":throw re("Invalid or expired state");case"client_id_not_configured":throw new A(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new A(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function jn(e,n,t){if(n.hub&&!He(n.manual))throw new A(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),i=t?.state?.trim(),o=[];if(r||o.push("code"),i||o.push("state"),o.length)throw re("Missing required fields",{missingFields:o});let a=Xt(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:i,redirectUri:a.redirectUri})}catch(u){if(u instanceof Error&&u.name==="OAuthCallbackError")switch(u.code){case"invalid_state":throw re("Invalid or expired state");case"credentials_not_configured":throw new A(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new A(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function er(e,n){if(!e.database)throw pe("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw pe("Permission not found");return On(e,t)}async function Co(e,n){return"id"in n?Qt(e,n.id):er(e,n.token)}var wo=[{method:"GET",pattern:"/ok",handler:async()=>x(200,Mn())},{method:"GET",pattern:"/tenants",handler:async({internal:e})=>x(200,await Un(e))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n})=>x(201,await $n(e,n))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n})=>x(200,await Bn(e,n.id))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>x(200,await Hn(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>x(200,await Fn(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n})=>x(200,await Nn(e,n.tenantId))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n})=>x(200,await Qt(e,n.id))},{method:"POST",pattern:"/permissions/lookup-by-token",handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?x(200,await er(e,t)):x(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t})=>x(200,await Ln(e,n,t))},{method:"GET",pattern:"/connect/resolve",handler:async({corsair:e,internal:n,query:t})=>x(200,await Wn(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",handler:async({corsair:e,internal:n,body:t})=>x(200,await jn(e,n,t))}];(()=>{let e=new Set;for(let n of wo){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function Rs(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let i={};for(let o=0;o<t.length;o++){let a=t[o],s=r[o];if(a.startsWith(":"))i[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return i}function Ss(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function Is(e){if(!(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json")))try{let t=await e.text();return t?JSON.parse(t):void 0}catch{throw new A(400,"invalid_json","Request body is not valid JSON")}}var _s="/api/corsair";function ve(e,n={}){let t=n.basePath??_s,r=T(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async i=>{try{let o=new URL(i.url),a=Ss(o.pathname,t),s=i.method.toUpperCase();if(s==="OPTIONS"||a==="/"||a==="")return await Pe(e,i);if(s!=="GET"&&s!=="POST")return x(405,{error:"method_not_allowed",message:`Method ${s} not allowed`});let u=Object.fromEntries(o.searchParams);for(let l of wo){if(l.method!==s)continue;let d=Rs(l.pattern,a);if(!d)continue;let c=await Is(i);return await l.handler({corsair:e,internal:r,req:i,params:d,query:u,body:c})}throw pe(`No route for ${s} ${a}`)}catch(o){if(n.onError){let s=await n.onError(o,i);if(s)return s}if(o instanceof A)return fo(o);let a=o instanceof Error?o.message:"Internal server error";return x(500,{error:"internal_error",message:a})}}}function Es(e){let n=e.get?.("host")??"localhost",t=e.protocol??"http",r=e.originalUrl??e.url,i=`${t}://${n}${r}`,o=new Headers;for(let[u,l]of Object.entries(e.headers))if(l!=null)if(Array.isArray(l))for(let d of l)o.append(u,d);else o.set(u,l);let a=e.method!=="GET"&&e.method!=="HEAD",s={method:e.method,headers:o};return a&&e.body!==void 0&&(s.body=typeof e.body=="string"?e.body:JSON.stringify(e.body),o.has("content-type")||o.set("content-type","application/json")),new Request(i,s)}async function Ds(e,n){e.status(n.status),n.headers.forEach((r,i)=>e.setHeader(i,r));let t=Buffer.from(await n.arrayBuffer());e.send(t)}function Po(e,n){let t=ve(e,n);return async(r,i,o)=>{try{let a=await t(Es(r));await Ds(i,a)}catch(a){o(a)}}}function To(e,n){let t=ve(e,n);return r=>t(r.req.raw)}function vo(e,n){let t=ve(e,n);return{GET:t,POST:t,OPTIONS:t}}function Ao(e){let n={[Qe]:e};return{ok:Mn,tenants:{list:()=>Un(e),create:t=>$n(e,t),get:t=>Bn(e,t)},plugins:{list:()=>Hn(e),get:t=>Fn(e,t)},connectionStatus:{get:t=>Nn(e,t?.tenantId)},permissions:{get:t=>Co(e,t)},connect:{createLink:t=>Ln(n,e,t),resolve:t=>Wn(n,e,t),oauthCallback:t=>jn(n,e,t)}}}async function xo(e,n,t,r,i="pending"){if(!e)return null;try{let o=gr(),a=new Date;return await e.db.insertInto("corsair_events").values({id:o,created_at:a,updated_at:a,account_id:n,event_type:t,payload:r,status:i}).execute(),o}catch(o){return console.warn("Failed to log event:",o),null}}async function Os(e,n,t,r="pending"){try{let i=await e.$getAccountId();return xo(e.database,i,n,t,r)}catch(i){return console.warn("Failed to log event:",i),null}}import*as Ro from"https";import*as So from"querystring";function Kn(e,n,t,r,i){let o=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,u)=>{let l={code:e.trim(),redirect_uri:i,grant_type:"authorization_code"};a||(l.client_id=n,l.client_secret=t);let d=So.stringify(l),c={"Content-Type":"application/x-www-form-urlencoded","Content-Length":Buffer.byteLength(d).toString()};a&&(c.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=Ro.request({hostname:o.hostname,...o.port?{port:Number(o.port)}:{},path:o.pathname+o.search,method:"POST",headers:c},g=>{let f="";g.on("data",y=>{f+=y}),g.on("end",()=>{if(g.statusCode!==200){u(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}try{s(JSON.parse(f))}catch{u(new Error(`Token endpoint returned non-JSON response: ${f}`))}})});p.on("error",g=>u(new Error(`Request failed: ${g.message}`))),p.write(d),p.end()})}var Io="  ";function j(e){let n=e;return n._def??n.def??{}}function K(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function W(e){return e.innerType??e.schema??e.out??e.in}function Eo(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return W(e)}}function Do(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Zn(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Ue(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function Oo(e,n){return e.description??n.description}function Ms(e){let n=e;for(;n;){let t=j(n),r=Oo(n,t);if(r)return r;let i=K(t);if(ir(i)||i==="ZodPipe"||i==="ZodEffects"||i==="ZodTransform"){n=Eo(t,i);continue}break}}function ir(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function M(e){let n=j(e),t=K(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Ue(n)[0]??"unknown");case"ZodEnum":return Ue(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=W(n);return r?M(r):"unknown"}case"ZodNullable":{let r=W(n);return`${r?M(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=W(n);return r?M(r):"unknown"}case"ZodArray":{let r=Do(n);if(!r)return"unknown[]";let i=j(r),o=K(i)==="ZodUnion",a=M(r);return`${o?`(${a})`:a}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Zn(e,n),i=Object.entries(r);return i.length===0?"{}":`{ ${i.map(([a,s])=>{let u=K(j(s));return`${u==="ZodOptional"||u==="ZodNullable"?a+"?":a}: ${M(s)}`}).join(", ")} }`}case"ZodUnion":return Ue(n).map(r=>M(r)).join(" | ");case"ZodIntersection":return`${M(n.left)} & ${M(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=Eo(n,t);return r?M(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function oe(e){let n=j(e),t=K(n),r=Oo(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let i=n.value??Ue(n)[0],o=typeof i=="string"||typeof i=="number"||typeof i=="boolean"?i:String(i??"");return{kind:"literal",optional:!1,description:r,value:o}}case"ZodEnum":{let i=Ue(n).map(o=>String(o));return{kind:"string",optional:!1,description:r,enum:i}}case"ZodOptional":{let i=W(n),o=i?oe(i):{kind:"unknown",optional:!1};return{...o,optional:!0,description:r??o.description}}case"ZodNullable":{let i=W(n),o=i?oe(i):{kind:"unknown",optional:!1};return{...o,optional:!0,description:r??o.description}}case"ZodDefault":case"ZodCatch":{let i=W(n);return i?{...oe(i),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let i=Do(n);return{kind:"array",optional:!1,description:r,items:i?oe(i):{kind:"unknown",optional:!1}}}case"ZodObject":{let i=Zn(e,n),o={};for(let[a,s]of Object.entries(i))o[a]=oe(s);return{kind:"object",optional:!1,description:r,fields:o}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let i=Ue(n);for(let o of i){let a=j(o);if(K(a)==="ZodObject")return{...oe(o),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let i=W(n);return i?{...oe(i),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function Cd(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let i=t.slice(0,r),o=t.slice(r+1),a=e.find(d=>d.id===i);if(!a)return null;let s=o;s.startsWith("api.")&&(s=s.slice(4));let u=ge(a.endpointMeta,s),l=ge(a.endpointSchemas,s);return!u&&!l?null:{input:l?.input?oe(l.input):null,output:l?.output?oe(l.output):null,description:u?.description}}var sr=["equals","contains","startsWith","endsWith","in"],Hs=["equals","gt","gte","lt","lte","in"],Fs=["equals"],Us=["equals","before","after","between"];function Mo(e){let n=j(e);switch(K(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=W(n);return r?Mo(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function ar(e){let n=j(e),t=K(n);if(ir(t)){let o=W(n);return o?ar(o):{}}if(t!=="ZodObject")return{};let r=Zn(e,n),i={};for(let[o,a]of Object.entries(r)){let s=Mo(a);s==="string"?i[o]={type:"string",operators:sr}:s==="number"?i[o]={type:"number",operators:Hs}:s==="boolean"?i[o]={type:"boolean",operators:Fs}:s==="date"&&(i[o]={type:"date",operators:Us})}return i}function Ho(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function tr(e,n,t){for(let[r,i]of Object.entries(e)){let o=[...n,r];typeof i=="function"?t.push(o.join(".")):i!==null&&typeof i=="object"&&tr(i,o,t)}}function rr(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function or(e,n,t){for(let[r,i]of Object.entries(e)){let o=[...n,r];rr(i)?t.push(o.join(".")):i!==null&&typeof i=="object"&&or(i,o,t)}}function ur(e,n){if(n.length===0)return null;let[t,...r]=n,i=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!i)return null;let[o,a]=i;if(r.length===0)return rr(a)?[o]:null;if(a!==null&&typeof a=="object"&&!rr(a)){let s=ur(a,r);if(s!==null)return[o,...s]}return null}function Fo(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let o=0;o<n.length;o++){let a="    ".repeat(o+2);t.push(`${a}${n[o]}: {`)}let r="    ".repeat(n.length+2),i=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${i}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let o=n.length-1;o>=0;o--){let a="    ".repeat(o+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
+`)}var Bs=new Set(tn);function Ae(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let o=e.find(s=>s.id===r);if(!o)return Bs.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:Ae(e);if(t==="webhooks"){if(!o.webhooks)return[];let s=[];return or(o.webhooks,[],s),s.map(u=>`${o.id}.webhooks.${u}`)}if(t==="db"){let s=o.schema?.entities;return s?Object.keys(s).map(u=>`${o.id}.db.${u}.search`):[]}if(!o.endpoints)return[];let a=[];return tr(o.endpoints,[],a),a.map(s=>`${o.id}.api.${s}`)}let i={};if(t==="webhooks")for(let o of e){if(!o.webhooks)continue;let a=[];or(o.webhooks,[],a),i[o.id]=a.map(s=>`${o.id}.webhooks.${s}`)}else if(t==="db")for(let o of e){let a=o.schema?.entities;a&&(i[o.id]=Object.keys(a).map(s=>`${o.id}.db.${s}.search`))}else for(let o of e){if(!o.endpoints)continue;let a=[];tr(o.endpoints,[],a),i[o.id]=a.map(s=>`${o.id}.api.${s}`)}return i}function ge(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function $s(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let o=t.slice(n.length+1),a=o.startsWith(".")?o.slice(1):o;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let i=e.slice(n.length+1);return i.toLowerCase().startsWith("api.")&&(i=i.slice(4)),{shortPath:i,lookupKey:i.toLowerCase()}}function nr(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
+  ${e.join(", ")}`:`${n}:
+`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
+`)}function wd(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let i=t.slice(0,r),o=t.slice(r+1),a=e.find(s=>s.id===i);if(a){if(o.startsWith("db.")){let d=o.slice(3),c=d.lastIndexOf(".");if(c!==-1){let p=d.slice(0,c),g=d.slice(c+1),f=a.schema?.entities;if(g==="search"&&f){let y=Ho(f,p);if(y){let[m,h]=y,P=ar(h),w=[`Search ${i} ${m} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${sr.join(", ")}]`];for(let[k,b]of Object.entries(P))w.push(`  ${k}?: ${b.type}  [${b.operators.join(", ")}]`);return w.push("}"),w.join(`
+`)}}}return nr(Ae(e,{type:"db"}),"Path not found. Available db operations")}if(o.startsWith("webhooks.")){let d=o.slice(9);if(a.webhooks){let c=ur(a.webhooks,d.split("."));if(c!==null){let p=c.join("."),g=ge(a.webhookSchemas,p.toLowerCase()),f=g?.response?M(g.response):null,y=[];return g?.description&&y.push(g.description),g?.payload&&y.push(`payload ${qn(Be(g.payload))}`),f&&y.push(`response: ${f}`),y.push(`usage:
+${Fo(i,c)}`),y.join(`
+
+`)}}return nr(Ae(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=o;s.startsWith("api.")&&(s=s.slice(4));let u=ge(a.endpointMeta,s),l=ge(a.endpointSchemas,s);if(u||l){let d=[],c=[u?.riskLevel?`[${u.riskLevel}]`:"",u?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[u?.description,c].filter(Boolean).join("  ");return p&&d.push(p),l?.input&&d.push(`input ${qn(Be(l.input))}`),l?.output&&d.push(`output ${qn(Be(l.output))}`),d.join(`
+
+`)}}}return nr(Ae(e),"Path not found. Available operations")}function _o(e){let n=e;for(;;){let t=j(n),r=K(t);if(ir(r)){let i=W(t);if(!i)return n;n=i;continue}return n}}function Be(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=_o(e),t=j(n);if(K(t)==="ZodObject"){let i=Zn(n,t),o=[];for(let[a,s]of Object.entries(i)){let u=j(s),l=K(u),d=l==="ZodOptional"||l==="ZodNullable",c=_o(s),p=Ms(s);o.push({key:a,optional:d,type:M(c),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:o}}return{kind:"inline",type:M(n)}}function qn(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=Io.repeat(n+1),r=Io.repeat(n);return`{
+${e.fields.map(o=>{let a=o.optional?`${o.key}?`:o.key,s=o.description?`  // ${o.description}`:"";return`${t}${a}: ${o.type}${s}`}).join(`
+`)}
+${r}}`}return"unknown"}function Ns(e,n){let t=Ae(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(d=>d.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let i=[];for(let d of t){let{shortPath:c,lookupKey:p}=$s(d,n),g=ge(r.endpointMeta,p),f=ge(r.endpointSchemas,p);!g&&!f||i.push({path:d,shortPath:c,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Be(f?.input),output:Be(f?.output)})}i.sort((d,c)=>d.path.localeCompare(c.path));let o=[],a=Ae(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let d of a){let p=d.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),y=ur(r.webhooks,f.split("."));if(y===null)continue;let m=y.join("."),h=ge(r.webhookSchemas,m.toLowerCase()),P=h?.response?M(h.response):void 0;o.push({path:d,description:h?.description,payload:Be(h?.payload),responseType:P,usageExample:Fo(n,y)})}o.sort((d,c)=>d.path.localeCompare(c.path));let s=[],u=Ae(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(u)&&l)for(let d of u){let p=d.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),y=f.lastIndexOf(".");if(y===-1)continue;let m=f.slice(0,y);if(f.slice(y+1)!=="search")continue;let P=Ho(l,m);if(!P)continue;let[w,k]=P,b=ar(k),C=Object.entries(b).map(([F,S])=>({field:F,type:S.type,operators:S.operators}));s.push({path:d,entityName:w,filters:[{field:"entity_id",type:"string",operators:sr},...C]})}return s.sort((d,c)=>d.path.localeCompare(c.path)),{ok:!0,data:{pluginId:n,api:i,webhooks:o,db:s}}}function Uo(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function Ls(e,n){let t=Uo(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let i=r.pluginTenantWebhookMatcher(n);return i?{plugin:t,tenantMatch:i}:null}function Ws(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function Bo(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function $o(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function Xe(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function js(e){return Xe(e.body)}function No(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Gn(Array.isArray(r)?r:[r])}function Lo(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let u of t){let l=Gn(Array.isArray(u)?u:[u]);if(l)return decodeURIComponent(l)}let r=No({query:e.query},"validationToken");if(r)return r;let i=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let u of i){let l=n[u],d=Array.isArray(l)?l[0]:l;if(!(!d||typeof d!="string"))try{let p=(d.startsWith("http")?new URL(d):new URL(`https://example.invalid${d.startsWith("/")?d:`/${d}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let o=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=Xe(typeof o=="string"?(()=>{try{return JSON.parse(o)}catch{return o}})():o);return Gn([a?.validationToken])??null}function Ks(e){if(Lo(e))return!0;let n=Xe(e.body??e.payload);return Bo(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Gn(e){for(let n of e){let t=$o(n);if(t)return t}}function qs(e){let t=Xe(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var Qe=Symbol.for("corsair:internal");function Mr(e){let n=e.database?lr(e.database):void 0,t=n&&e.kek?lo(e.plugins,n,e.kek):En(!!n,!!e.kek),r=po(e),i={plugins:e.plugins,database:n,kek:e.kek,multiTenancy:!!e.multiTenancy,permissions:r,manual:e.manual,hub:e.hub?rn(e.hub):void 0},o=uo(n),a=Ao(i);if(e.multiTenancy)return Object.assign({withTenant:u=>{if(!u)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let l=Vt(e.plugins,{database:n,tenantId:u,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:i.hub});return Object.assign(l,{[Qe]:i})},keys:t,permissions:o,manage:a},{[Qe]:i});let s=Vt(e.plugins,{database:n,tenantId:void 0,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:i.hub});return Object.assign({},s,{keys:t,permissions:o,manage:a,[Qe]:i})}var H=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function Wo(e){let n=e.oauthConfig;if(!n)throw new H("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Zs(e,n,t,r){let i=yr(e),o=await i.integrations.findByName(n);if(!o)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await i.accounts.findOne({tenant_id:t,integration_id:o.id}))return;let s=Q(),u=await X(s,r);await i.accounts.create({tenant_id:t,integration_id:o.id,config:{},dek:u})}async function Xn(e,n,t){let{tenantId:r,redirectUri:i,hubConnect:o=!1}=t,a=T(e,()=>new H("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=$(a,n,p=>new H("plugin_not_found",p)),u=Wo(s),d=await _({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!d)throw new Error(`client_id not configured for '${n}'`);if(o){let p=new URL(Te({oauthConfig:u,clientId:d,redirectUri:i,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let c=Fe(de(n,r),a.kek);return{url:Te({oauthConfig:u,clientId:d,redirectUri:i,state:c}),state:c}}async function Ve(e,n){let{code:t,state:r,redirectUri:i}=n,o=T(e,()=>new H("invalid_corsair_instance","Invalid corsair instance")),a=Dn(r,o.kek);if(!a)throw new H("invalid_state","Invalid or tampered state parameter");let{plugin:s,tenantId:u}=a;if(!o.database)throw new H("no_database","No database configured on corsair instance");let l=$(o,s,m=>new H("plugin_not_found",m)),d=Wo(l),c=_({authType:"oauth_2",integrationName:s,kek:o.kek,database:o.database}),p=await c.get_client_id(),g=await c.get_client_secret();if(!p||!g)throw new H("credentials_not_configured",`Credentials not configured for '${s}'`);await Zs(o.database,s,u,o.kek);let f=await Kn(t,p,g,d,i);if(!f.access_token)throw new H("no_access_token",`No access_token returned from ${d.providerName}`);let y=R({authType:"oauth_2",integrationName:s,tenantId:u,kek:o.kek,database:o.database});await y.set_access_token(f.access_token),f.refresh_token&&await y.set_refresh_token(f.refresh_token),f.expires_in&&await y.set_expires_at(String(Math.floor(Date.now()/1e3)+f.expires_in));try{let m=await wn(o.plugins,s,f);if(m)try{let h=l.authConfig?.oauth_2?.account??[];await De({database:o.database,kek:o.kek,pluginId:s,tenantId:u,link:m,authType:"oauth_2",extraAccountFields:h})}catch(h){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${u}':`,h)}}catch(m){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${u}':`,m)}return{plugin:s,tenantId:u}}export{mr as a,se as b,Le as c,he as d,rn as e,Y as f,on as g,xe as h,sn as i,an as j,un as k,cn as l,kr as m,ln as n,Q as o,X as p,N as q,zn as r,je as s,ae as t,ee as u,Ke as v,_ as w,R as x,Sr as y,Ir as z,de as A,$t as B,De as C,st as D,Pn as E,Kr as F,Te as G,H,Xn as I,Ve as J,Dr as K,xi as L,_e as M,hn as N,Ee as O,Nr as P,ot as Q,it as R,Lr as S,Wr as T,ue as U,ke as V,ce as W,Oe as X,Tn as Y,ut as Z,Me as _,ct as $,lt as aa,dt as ba,pt as ca,Jr as da,ne as ea,An as fa,xn as ga,le as ha,Ce as ia,we as ja,Je as ka,ze as la,Rn as ma,mt as na,ht as oa,kt as pa,bt as qa,Ct as ra,wt as sa,Pt as ta,Pe as ua,te as va,Tt as wa,eo as xa,In as ya,_n as za,no as Aa,vt as Ba,At as Ca,xt as Da,Rt as Ea,St as Fa,It as Ga,_t as Ha,Et as Ia,Dt as Ja,Ot as Ka,Mt as La,Ht as Ma,Ft as Na,Ut as Oa,Bt as Pa,Yt as Qa,ve as Ra,Po as Sa,To as Ta,vo as Ua,xo as Va,Os as Wa,Kn as Xa,Cd as Ya,Ae as Za,wd as _a,qn as $a,Ns as ab,Uo as bb,Ls as cb,Ws as db,Bo as eb,$o as fb,Xe as gb,js as hb,No as ib,Lo as jb,Ks as kb,Gn as lb,qs as mb,Qe as nb,Mr as ob};

package/dist/core.js

@@ -1 +1 @@
-import{$a as u,Qa as q,Va as r,Wa as s,Xa as t,a,ab as v,b,bb as w,cb as x,db as y,eb as z,fb as A,gb as B,hb as C,ib as D,jb as E,kb as F,lb as G,mb as H,nb as I,o as d,ob as J,p as e,q as f,r as g,s as h,t as i,u as j,v as k,va as p,w as l,x as m,y as n,z as o}from"./chunk-BI3ICPNA.js";import{g as c}from"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{p as AuthMissingError,c as BASE_AUTH_FIELDS,I as CORSAIR_INTERNAL,a as ProviderDisplayNames,B as asRecord,y as collectPluginWebhookMatchers,m as createAccountKeyManager,J as createCorsair,l as createIntegrationKeyManager,H as decodePubSubData,j as decryptConfig,f as decryptDEK,h as decryptWithDEK,i as encryptConfig,e as encryptDEK,g as encryptWithDEK,t as exchangeCodeForTokens,E as extractMicrosoftGraphValidationToken,G as firstString,u as formatDocSchemaShape,b as formatProviderDisplayName,d as generateDEK,z as getHeader,o as initializeAccountDEK,n as initializeIntegrationDEK,v as introspectPluginForDocs,F as isMicrosoftGraphValidationHandshake,r as logEvent,s as logEventFromContext,w as matchWebhookPlugin,x as matchWebhookPluginAndTenant,k as reEncryptConfig,C as readBodyRecord,D as readQueryParam,q as resolveConnectLink,A as toExternalId};
+import{$a as u,Qa as q,Va as r,Wa as s,Xa as t,a,ab as v,b,bb as w,cb as x,db as y,eb as z,fb as A,gb as B,hb as C,ib as D,jb as E,kb as F,lb as G,mb as H,nb as I,o as d,ob as J,p as e,q as f,r as g,s as h,t as i,u as j,v as k,va as p,w as l,x as m,y as n,z as o}from"./chunk-IGJCF7OM.js";import{g as c}from"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{p as AuthMissingError,c as BASE_AUTH_FIELDS,I as CORSAIR_INTERNAL,a as ProviderDisplayNames,B as asRecord,y as collectPluginWebhookMatchers,m as createAccountKeyManager,J as createCorsair,l as createIntegrationKeyManager,H as decodePubSubData,j as decryptConfig,f as decryptDEK,h as decryptWithDEK,i as encryptConfig,e as encryptDEK,g as encryptWithDEK,t as exchangeCodeForTokens,E as extractMicrosoftGraphValidationToken,G as firstString,u as formatDocSchemaShape,b as formatProviderDisplayName,d as generateDEK,z as getHeader,o as initializeAccountDEK,n as initializeIntegrationDEK,v as introspectPluginForDocs,F as isMicrosoftGraphValidationHandshake,r as logEvent,s as logEventFromContext,w as matchWebhookPlugin,x as matchWebhookPluginAndTenant,k as reEncryptConfig,C as readBodyRecord,D as readQueryParam,q as resolveConnectLink,A as toExternalId};

package/dist/hub.d.ts

@@ -89,6 +89,16 @@ declare function getHubConfig(corsair: unknown): HubConfig;
 declare function resolveHubOAuthCallbackUrl(config: HubConfig): string;
 declare function inferHubEnvironmentSlug(apiKey: string): 'development' | 'production';
 
+/**
+ * Creates a hosted Hub connect session from a corsair instance.
+ *
+ * Reads plugins, database, and kek from the instance, builds the connect
+ * manifest (one plugin when `input.plugin` is set, otherwise all configured
+ * plugins), provisions account rows, then calls {@link postHubConnectSession}.
+ *
+ * Used by `manage.connect.createLink` and other management APIs that already
+ * hold the corsair instance.
+ */
 declare function createHubConnectSession(corsair: unknown, input: HubConnectSessionInput): Promise<HubConnectSessionResult>;
 
 declare function getConnectStatusForTenant(corsair: unknown, tenantId: string, options?: {

package/dist/hub.js

@@ -1 +1 @@
-import{$ as C,Aa as U,Ba as V,Ca as W,Da as X,Ea as Y,Fa as Z,Ga as _,Ha as $,Ia as aa,Ja as ba,Ka as ca,La as da,M as n,Ma as ea,N as o,Na as fa,O as p,Oa as ga,P as q,Pa as ha,Q as r,R as s,S as t,T as u,U as v,V as w,W as x,X as y,Y as z,Z as A,_ as B,aa as D,b as a,ba as E,c as b,ca as F,d as c,e as d,ea as G,f as e,fa as H,g as f,ga as I,h as g,ha as J,i as h,j as i,k as j,l as k,m as l,n as m,pa as K,qa as L,ra as M,sa as N,ta as O,ua as P,wa as Q,xa as R,ya as S,za as T}from"./chunk-BI3ICPNA.js";import"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{v as BROWSER_DELIVERY_TTL_MS,b as DEFAULT_HUB_API_URL,c as HubNotConfiguredError,x as ManagedOAuthDeliveryError,w as SIGNED_TUNNEL_REPLAY_WINDOW_MS,R as attachManagedRefreshAuth,H as buildBrowserDeliveryRedirectUrl,V as createConnectSessionJti,_ as createConnectTokenJti,o as createHubConnectSession,S as createHubPermissionSession,U as createHubRouteHandlers,ea as createPermissionSessionJti,G as createSignedTokenJti,Z as decodeConnectSessionTokenFromPath,da as decodeConnectTokenFromPath,ha as decodePermissionTokenFromPath,F as deliverSignedEnvelope,ca as encodeConnectTokenForPath,T as formatHubApprovalMessage,a as formatProviderDisplayName,E as formatServerDeliveryError,W as getConnectSessionExpiryMs,p as getConnectStatusForTenant,$ as getConnectTokenExpiryMs,e as getHubConfig,Q as getManagedAccessToken,K as handleHubDeliveryGet,L as handleHubDeliveryPost,N as handleHubDeliveryRequest,M as hubDeliveryToResponse,g as inferHubEnvironmentSlug,r as isLoopbackUrl,D as isServerDeliveryAckSuccessful,q as listHubProjectConnections,d as normalizeHubConfig,h as parseConnectSessionResponse,l as parseConnectStatusResponse,m as parseHubApiErrorBody,k as parseOAuthRefreshResponse,j as parsePermissionSessionResponse,i as parseProjectConnectionsResponse,C as parseServerDeliveryAckBody,y as processManagedOAuthDelivery,s as resolveDeliveryTransport,n as resolveHubDeliveryUrl,f as resolveHubOAuthCallbackUrl,O as respondToHubDelivery,P as respondToHubDeliveryFromRequest,I as signBrowserDeliveryToken,X as signConnectSessionToken,aa as signConnectToken,z as signDeliveryEnvelope,fa as signPermissionToken,t as usesBrowserDelivery,u as validateProductionDeliveryUrl,J as verifyBrowserDeliveryToken,Y as verifyConnectSessionToken,ba as verifyConnectToken,A as verifyDeliveryEnvelope,ga as verifyPermissionToken,B as verifySignedTunnelDelivery};
+import{$ as C,Aa as U,Ba as V,Ca as W,Da as X,Ea as Y,Fa as Z,Ga as _,Ha as $,Ia as aa,Ja as ba,Ka as ca,La as da,M as n,Ma as ea,N as o,Na as fa,O as p,Oa as ga,P as q,Pa as ha,Q as r,R as s,S as t,T as u,U as v,V as w,W as x,X as y,Y as z,Z as A,_ as B,aa as D,b as a,ba as E,c as b,ca as F,d as c,e as d,ea as G,f as e,fa as H,g as f,ga as I,h as g,ha as J,i as h,j as i,k as j,l as k,m as l,n as m,pa as K,qa as L,ra as M,sa as N,ta as O,ua as P,wa as Q,xa as R,ya as S,za as T}from"./chunk-IGJCF7OM.js";import"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{v as BROWSER_DELIVERY_TTL_MS,b as DEFAULT_HUB_API_URL,c as HubNotConfiguredError,x as ManagedOAuthDeliveryError,w as SIGNED_TUNNEL_REPLAY_WINDOW_MS,R as attachManagedRefreshAuth,H as buildBrowserDeliveryRedirectUrl,V as createConnectSessionJti,_ as createConnectTokenJti,o as createHubConnectSession,S as createHubPermissionSession,U as createHubRouteHandlers,ea as createPermissionSessionJti,G as createSignedTokenJti,Z as decodeConnectSessionTokenFromPath,da as decodeConnectTokenFromPath,ha as decodePermissionTokenFromPath,F as deliverSignedEnvelope,ca as encodeConnectTokenForPath,T as formatHubApprovalMessage,a as formatProviderDisplayName,E as formatServerDeliveryError,W as getConnectSessionExpiryMs,p as getConnectStatusForTenant,$ as getConnectTokenExpiryMs,e as getHubConfig,Q as getManagedAccessToken,K as handleHubDeliveryGet,L as handleHubDeliveryPost,N as handleHubDeliveryRequest,M as hubDeliveryToResponse,g as inferHubEnvironmentSlug,r as isLoopbackUrl,D as isServerDeliveryAckSuccessful,q as listHubProjectConnections,d as normalizeHubConfig,h as parseConnectSessionResponse,l as parseConnectStatusResponse,m as parseHubApiErrorBody,k as parseOAuthRefreshResponse,j as parsePermissionSessionResponse,i as parseProjectConnectionsResponse,C as parseServerDeliveryAckBody,y as processManagedOAuthDelivery,s as resolveDeliveryTransport,n as resolveHubDeliveryUrl,f as resolveHubOAuthCallbackUrl,O as respondToHubDelivery,P as respondToHubDeliveryFromRequest,I as signBrowserDeliveryToken,X as signConnectSessionToken,aa as signConnectToken,z as signDeliveryEnvelope,fa as signPermissionToken,t as usesBrowserDelivery,u as validateProductionDeliveryUrl,J as verifyBrowserDeliveryToken,Y as verifyConnectSessionToken,ba as verifyConnectToken,A as verifyDeliveryEnvelope,ga as verifyPermissionToken,B as verifySignedTunnelDelivery};

package/dist/index.js

@@ -1,3 +1,3 @@
-import{a as N,b as j}from"./chunk-XLNT2UI2.js";import{$a as m,C as y,D as h,E as k,F as x,K as P,Qa as I,Ra as O,Sa as R,Ta as T,Ua as A,Ya as l,Za as c,_a as d,bb as L,cb as W,da as b,db as F,eb as v,fb as E,gb as _,hb as $,lb as M,mb as D,nb as g,oa as S,ob as H,va as w}from"./chunk-BI3ICPNA.js";import"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";function s(n){let t=n[g];if(!t)throw new Error("listOperations / getSchema: invalid corsair instance. Pass the value returned by createCorsair() or corsair.withTenant().");return t.plugins}function B(n,t){let r=c(s(n),t);return typeof r=="string"?r:Array.isArray(r)?r.join(`
+import{a as N,b as j}from"./chunk-XLNT2UI2.js";import{$a as m,C as y,D as h,E as k,F as x,K as P,Qa as I,Ra as O,Sa as R,Ta as T,Ua as A,Ya as l,Za as c,_a as d,bb as L,cb as W,da as b,db as F,eb as v,fb as E,gb as _,hb as $,lb as M,mb as D,nb as g,oa as S,ob as H,va as w}from"./chunk-IGJCF7OM.js";import"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";function s(n){let t=n[g];if(!t)throw new Error("listOperations / getSchema: invalid corsair instance. Pass the value returned by createCorsair() or corsair.withTenant().");return t.plugins}function B(n,t){let r=c(s(n),t);return typeof r=="string"?r:Array.isArray(r)?r.join(`
 `):Object.values(r).flat().join(`
 `)}function J(n,t){return d(s(n),t)}function q(n,t){return l(s(n),t)}var Y=Symbol.for("corsair:internal");function z(n,t){let r=n;for(let e of t){if(!r||typeof r!="object")return null;r=r[e]}return typeof r=="function"?r:null}function C(n){return n[Y]?.database}async function G(n,t){let r=new Date().toISOString(),e=await n.permissions.find_by_token(t);if(!e)return console.error("executePermission: no permission found for token."),{error:"executePermission: no permission found for token."};if(e.status!=="approved")return console.error(`executePermission: permission '${e.id}' is '${e.status}', expected 'approved'.`),{endpoint:e.endpoint,plugin:e.plugin,result:null,error:`executePermission: permission '${e.id}' is '${e.status}', expected 'approved'.`};if(e.expires_at<r){let o=C(n);return o&&await o.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",e.id).execute(),console.error(`executePermission: permission '${e.id}' has expired.`),{error:`executePermission: permission '${e.id}' has expired.`,endpoint:e.endpoint,plugin:e.plugin,result:null}}let f=e.tenant_id??"default",a=(n.withTenant?n.withTenant(f):n)[e.plugin];if(!a?.api)return console.error(`executePermission: plugin '${e.plugin}' not found or has no API on this corsair instance.`),{error:`executePermission: plugin '${e.plugin}' not found or has no API on this corsair instance.`,plugin:e.plugin,endpoint:e.endpoint,result:null};let p=z(a.api,e.endpoint.split("."));if(!p)return console.error(`executePermission: endpoint '${e.endpoint}' not found in plugin '${e.plugin}'.`),{endpoint:e.endpoint,plugin:e.plugin,result:null,error:`executePermission: endpoint '${e.endpoint}' not found in plugin '${e.plugin}'.`};await n.permissions.set_executing(e.id);try{let o=typeof e.args=="string"?JSON.parse(e.args):e.args,i=await p(o);return await n.permissions.set_completed(e.id),{plugin:e.plugin,endpoint:e.endpoint,result:i}}catch(o){let i=o instanceof Error?o.message:String(o),u=C(n);return u&&await u.db.updateTable("corsair_permissions").set({status:"failed",error:i,updated_at:new Date}).where("id","=",e.id).execute(),{plugin:e.plugin,endpoint:e.endpoint,result:null,error:i}}}export{w as AuthMissingError,N as CorsairClientError,_ as asRecord,F as collectPluginWebhookMatchers,H as createCorsair,j as createCorsairClient,D as decodePubSubData,G as executePermission,M as firstString,m as formatDocSchemaShape,v as getHeader,J as getSchema,q as getStructuredSchema,B as listOperations,O as managementHandler,L as matchWebhookPlugin,W as matchWebhookPluginAndTenant,S as processCorsair,b as processWebhook,$ as readBodyRecord,h as resolveAccountFromWebhookLink,I as resolveConnectLink,x as resolveTenantFromWebhookLink,k as resolveTenantIdFromWebhookLink,y as setWebhookTenantLink,P as setupCorsair,R as toExpressHandler,E as toExternalId,T as toHonoHandler,A as toNextJsHandler};

package/dist/oauth.js

@@ -1 +1 @@
-import{A as a,B as b,G as c,H as d,I as e,J as f}from"./chunk-BI3ICPNA.js";import"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{d as OAuthCallbackError,c as buildOAuthAuthorizeUrl,b as decodeOAuthState,a as encodeOAuthState,e as generateOAuthUrl,f as processOAuthCallback};
+import{A as a,B as b,G as c,H as d,I as e,J as f}from"./chunk-IGJCF7OM.js";import"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{d as OAuthCallbackError,c as buildOAuthAuthorizeUrl,b as decodeOAuthState,a as encodeOAuthState,e as generateOAuthUrl,f as processOAuthCallback};

package/dist/setup.d.ts

@@ -37,6 +37,11 @@ interface SetupCorsairOptions {
      * as runnable CLI flags instead of JS method calls.
      */
     caller?: 'cli' | 'script';
+    /**
+     * When true, setup messages are collected in the return value only — nothing
+     * is written to stdout/stderr. Used for internal provisioning (e.g. Hub connect).
+     */
+    silent?: boolean;
 }
 type SetupLog = (msg: string) => void;
 type SetupWarn = (msg: string) => void;

package/dist/setup.js

@@ -1 +1 @@
-import{K as a,L as b}from"./chunk-BI3ICPNA.js";import"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{b as applySetupCredentials,a as setupCorsair};
+import{K as a,L as b}from"./chunk-IGJCF7OM.js";import"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{b as applySetupCredentials,a as setupCorsair};

package/dist/tunnel.js

@@ -1 +1 @@
-import{C as a,D as b,E as c,F as d,ha as e,ia as f,ja as g,ka as h,la as i,ma as j,na as k,oa as l}from"./chunk-BI3ICPNA.js";import"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{k as applyPermissionDecision,g as isAuthCredentialsBrowserDelivery,j as isByoOAuthBrowserDelivery,f as isConnectStatusBrowserDelivery,i as isManagedBrowserDelivery,h as isPermissionBrowserDelivery,l as processCorsair,b as resolveAccountFromWebhookLink,d as resolveTenantFromWebhookLink,c as resolveTenantIdFromWebhookLink,a as setWebhookTenantLink,e as verifyBrowserDeliveryToken};
+import{C as a,D as b,E as c,F as d,ha as e,ia as f,ja as g,ka as h,la as i,ma as j,na as k,oa as l}from"./chunk-IGJCF7OM.js";import"./chunk-FLNFC4KL.js";import"./chunk-IGGCNGU2.js";import"./chunk-QAIKSQAD.js";export{k as applyPermissionDecision,g as isAuthCredentialsBrowserDelivery,j as isByoOAuthBrowserDelivery,f as isConnectStatusBrowserDelivery,i as isManagedBrowserDelivery,h as isPermissionBrowserDelivery,l as processCorsair,b as resolveAccountFromWebhookLink,d as resolveTenantFromWebhookLink,c as resolveTenantIdFromWebhookLink,a as setWebhookTenantLink,e as verifyBrowserDeliveryToken};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "corsair",
-  "version": "0.1.94",
+  "version": "0.1.95",
   "description": "",
   "type": "module",
   "main": "./dist/index.js",

package/dist/chunk-BI3ICPNA.js

@@ -1,38 +0,0 @@
-import{a as ie,b as or,c as T,d as N,e as ir,f as J,g as E,h as H,i as Xe,j as sr,k as qn,l as ar,m as ur}from"./chunk-FLNFC4KL.js";import{a as rr}from"./chunk-IGGCNGU2.js";var en=["agentql","ahrefs","airtable","amplitude","asana","bitwarden","bluesky","box","cal","calendly","cloudflare","cursor","discord","dodopayments","dropbox","exa","figma","firecrawl","fireflies","github","gitlab","gmail","googlecalendar","googledrive","googlesheets","grafana","hackernews","hubspot","intercom","jira","linear","monday","notion","onedrive","openweathermap","oura","outlook","pagerduty","posthog","razorpay","reddit","resend","sentry","sharepoint","slack","spotify","strava","stripe","tally","tavily","teams","telegram","todoist","trello","twilio","twitter","twitterapiio","typeform","vapi","xquik","youtube","zendesk","zohomail","zoom"],cr={agentql:"AgentQL",ahrefs:"Ahrefs",airtable:"Airtable",amplitude:"Amplitude",asana:"Asana",bitwarden:"Bitwarden",bluesky:"Bluesky",box:"Box",cal:"Cal",calendly:"Calendly",cloudflare:"Cloudflare",cursor:"Cursor",discord:"Discord",dodopayments:"Dodo Payments",dropbox:"Dropbox",exa:"Exa",figma:"Figma",firecrawl:"Firecrawl",fireflies:"Fireflies",github:"GitHub",gitlab:"GitLab",gmail:"Gmail",googlecalendar:"Google Calendar",googledrive:"Google Drive",googlesheets:"Google Sheets",grafana:"Grafana",hackernews:"Hacker News",hubspot:"HubSpot",intercom:"Intercom",jira:"Jira",linear:"Linear",monday:"Monday",notion:"Notion",onedrive:"OneDrive",openweathermap:"OpenWeatherMap",oura:"Oura",outlook:"Outlook",pagerduty:"PagerDuty",posthog:"PostHog",razorpay:"Razorpay",reddit:"Reddit",resend:"Resend",sentry:"Sentry",sharepoint:"SharePoint",slack:"Slack",spotify:"Spotify",strava:"Strava",stripe:"Stripe",tally:"Tally",tavily:"Tavily",teams:"Teams",telegram:"Telegram",todoist:"Todoist",trello:"Trello",twilio:"Twilio",twitter:"Twitter",twitterapiio:"Twitter API IO",typeform:"Typeform",vapi:"Vapi",xquik:"XQuik",youtube:"YouTube",zendesk:"Zendesk",zohomail:"Zoho Mail",zoom:"Zoom"};function se(e){let n=cr[e];return n||e.charAt(0).toUpperCase()+e.slice(1)}var $e="https://auth.corsair.dev";var ye=class extends Error{constructor(){super("Hub is not configured. Pass hub: { projectApiKey, signingSecret } to createCorsair()."),this.name="HubNotConfiguredError"}};function nn(e){let n=(e.apiUrl?.trim()||$e).replace(/\/$/,""),t=e.projectApiKey.trim(),r=e.signingSecret.trim();if(!t||!r)throw new Error("Hub config requires non-empty projectApiKey and signingSecret");return{apiUrl:n,projectApiKey:t,signingSecret:r,oauthCallbackUrl:e.oauthCallbackUrl?.trim().replace(/\/$/,"")}}function Ho(e){return e.apiUrl.trim().length>0&&e.projectApiKey.trim().length>0&&e.signingSecret.trim().length>0}function $(e){let n=T(e).hub;if(!n||!Ho(n))throw new ye;return n}function lr(e){return e.replace(/\/$/,"")}function tn(e){return e.oauthCallbackUrl?lr(e.oauthCallbackUrl.trim()):`${lr(e.apiUrl)}/oauth/callback`}function xe(e){if(e.startsWith("ck_dev_"))return"development";if(e.startsWith("ck_prod_"))return"production";throw new Error("Hub API key must start with ck_dev_ (development) or ck_prod_ (production)")}function v(e){return typeof e=="string"&&e.length>0}function Fo(e){return e==="pending"||e==="connected"||e==="failed"}function Uo(e){return e==="oauth"||e==="api_key"||e==="bot_token"}function rn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty connect session");let n=e;if(!v(n.connectUrl)||!v(n.token)||!v(n.projectId))throw new Error("Hub API returned an incomplete connect session (expected connectUrl, token, and projectId)");let t={connectUrl:n.connectUrl,token:n.token,projectId:n.projectId,environmentId:v(n.environmentId)?n.environmentId:n.projectId};return v(n.expiresAt)&&(t.expiresAt=n.expiresAt),t}function on(e){if(!Array.isArray(e))throw new Error("Hub API returned an invalid connections response (expected array)");let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;!v(r.tenantId)||!v(r.plugin)||!Fo(r.status)||!Uo(r.authKind)||n.push({tenantId:r.tenantId,plugin:r.plugin,status:r.status,authKind:r.authKind,connectedAt:v(r.connectedAt)?r.connectedAt:null,expiresAt:v(r.expiresAt)?r.expiresAt:null})}return n}function sn(e){if(!e||typeof e!="object")throw new Error("Hub API returned an empty permission session");let n=e;if(!v(n.approvalUrl)||!v(n.token)||!v(n.projectId)||!v(n.expiresAt))throw new Error("Hub API returned an incomplete permission session (expected approvalUrl, token, projectId, and expiresAt)");return{approvalUrl:n.approvalUrl,token:n.token,projectId:n.projectId,expiresAt:n.expiresAt}}function an(e){if(!e||typeof e!="object")throw new Error("Hub token refresh returned an empty response");let n=e;if(v(n.access_token))return{access_token:n.access_token,refresh_token:v(n.refresh_token)?n.refresh_token:void 0,expires_in:(()=>{if(typeof n.expires_in=="number")return n.expires_in;if(typeof n.expires_in=="string"&&n.expires_in.trim().length>0){let t=Number(n.expires_in);return Number.isFinite(t)?t:void 0}})(),scope:v(n.scope)?n.scope:void 0};throw new Error(v(n.error)?v(n.error_description)?n.error_description:n.error:"Hub token refresh returned no access_token")}function Bo(e){return Array.isArray(e)?e.filter(n=>typeof n=="string"):[]}function No(e){if(!Array.isArray(e))return[];let n=[];for(let t of e){if(!t||typeof t!="object")continue;let r=t;v(r.name)&&n.push({name:r.name,level:r.level==="integration"||r.level==="account"?r.level:"account",required:r.required===!0,configured:r.configured===!0})}return n}function $o(e,n,t,r){return e==="ready"||e==="partial"||e==="not_started"||e==="missing_integration"?e:n?"ready":t.some(o=>o.level==="integration"&&o.required&&!o.configured)?"missing_integration":t.some(o=>o.level==="account"&&o.required&&o.configured)?"partial":(r.length>0,"not_started")}function dr(e){if(!e||typeof e!="object")throw new Error("Connect status response was empty");let n=e;if(!v(n.tenantId)||!Array.isArray(n.plugins))throw new Error("Connect status response was incomplete (expected tenantId and plugins)");let t=[];for(let r of n.plugins){if(!r||typeof r!="object")continue;let i=r;if(!v(i.plugin)||typeof i.connected!="boolean")continue;let o=i.authKind==="oauth"||i.authKind==="api_key"||i.authKind==="bot_token"?i.authKind:"api_key",a=No(i.fields),s=Bo(i.missingRequiredFields),u=$o(i.status,i.connected,a,s);t.push({plugin:i.plugin,providerName:v(i.providerName)?i.providerName:i.plugin,authKind:o,status:u,connected:i.connected,fields:a,missingRequiredFields:s})}return{tenantId:n.tenantId,plugins:t}}function un(e){if(!e||typeof e!="object")return null;let n=e;return n.error??n.message??null}function pr(e){return e.replace(/\/$/,"")}async function gr(e){let n=e.headers.get("content-type")??"",t=await e.text();if(!t)return null;if(!n.includes("application/json")&&t.trimStart().startsWith("<"))throw new Error(`Hub API returned HTML instead of JSON (HTTP ${e.status}). Check HUB_API_URL and deploy the latest hub API.`);try{return JSON.parse(t)}catch{throw new Error(`Hub API returned invalid JSON (HTTP ${e.status})`)}}function fr(e,n,t){if(n===404&&t)return t;let r=un(e);return r||`Hub API returned HTTP ${n}`}async function Re(e){let n=pr(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.hub.projectApiKey}`},body:JSON.stringify(e.body)}),r=await gr(t);if(!t.ok)throw new Error(fr(r,t.status,e.notFoundMessage));return e.parseResponse(r)}async function yr(e){let n=pr(e.hub.apiUrl),t=await fetch(`${n}${e.path}`,{method:"GET",headers:{authorization:`Bearer ${e.hub.projectApiKey}`}}),r=await gr(t);if(!t.ok)throw new Error(fr(r,t.status,e.notFoundMessage));return e.parseResponse(r)}import{createCipheriv as hr,createDecipheriv as mr,randomBytes as cn,scrypt as Lo}from"crypto";import{promisify as Wo}from"util";var kr=Wo(Lo),ln="aes-256-gcm",br=12,dn=16,jo=16,Le=32;function Q(){return cn(Le).toString("base64")}async function X(e,n){let t=cn(jo),r=await kr(n,t,Le),i=cn(br),o=hr(ln,r,i,{authTagLength:dn}),a=Buffer.concat([o.update(e,"utf8"),o.final()]),s=o.getAuthTag();return[t.toString("base64"),i.toString("base64"),s.toString("base64"),a.toString("base64")].join(":")}async function L(e,n){let[t,r,i,o]=e.split(":");if(!t||!r||!i||!o)throw new Error("Invalid encrypted DEK format");let a=Buffer.from(t,"base64"),s=Buffer.from(r,"base64"),u=Buffer.from(i,"base64"),l=Buffer.from(o,"base64"),d=await kr(n,a,Le),c=mr(ln,d,s,{authTagLength:dn});return c.setAuthTag(u),Buffer.concat([c.update(l),c.final()]).toString("utf8")}function Gn(e,n){let t=Buffer.from(n,"base64"),r=cn(br),i=hr(ln,t,r,{authTagLength:dn}),o=Buffer.concat([i.update(e,"utf8"),i.final()]),a=i.getAuthTag();return[r.toString("base64"),a.toString("base64"),o.toString("base64")].join(":")}function We(e,n){let[t,r,i]=e.split(":");if(!t||!r||!i)throw new Error("Invalid encrypted data format");let o=Buffer.from(n,"base64"),a=Buffer.from(t,"base64"),s=Buffer.from(r,"base64"),u=Buffer.from(i,"base64"),l=mr(ln,o,a,{authTagLength:dn});return l.setAuthTag(s),Buffer.concat([l.update(u),l.final()]).toString("utf8")}function ae(e,n){let t={};for(let[r,i]of Object.entries(e))t[r]=Gn(i,n);return t}function ee(e,n){let t={};for(let[r,i]of Object.entries(e))t[r]=We(i,n);return t}function je(e,n,t){let r=ee(e,n);return ae(r,t)}function Cr(e,n,t){let r={};for(let i of t)r[`get_${i}`]=async()=>(await e())[i]??null,r[`set_${i}`]=async o=>{let a=[null,void 0,""].includes(o)?null:o;await n({[i]:a})};return r}var Jn=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};function I(e){let{authType:n,integrationName:t,kek:r,database:i,extraIntegrationFields:o=[]}=e,a=[...E[n].integration,...o],s=null,u={kek:r,integrationName:t,getIntegration:async()=>{if(s)return s;let f=await i.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!f)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return s={id:f.id,config:Jn(f.config),dek:f.dek??null},s},updateIntegration:async f=>{let y=await u.getIntegration();await i.db.updateTable("corsair_integrations").set({...f.config!==void 0?{config:f.config}:{},...f.dek!==void 0?{dek:f.dek}:{},updated_at:new Date}).where("id","=",y.id).execute(),s=null}},l=null,d=async()=>{if(l)return l;let f=await u.getIntegration();if(!f.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return l=await L(f.dek,r),l},c=async()=>{let f=await u.getIntegration(),y=await d(),h=f.config;return!h||Object.keys(h).length===0?{}:ee(h,y)};return{get_dek:d,issue_new_dek:async()=>{let f=await u.getIntegration(),y=Q(),h={};if(f.dek){let C=await L(f.dek,r),b=f.config;b&&Object.keys(b).length>0&&(h=je(b,C,y))}let m=await X(y,r);return await u.updateIntegration({config:h,dek:m}),l=y,y},...Cr(c,async f=>{let y=await d(),h;try{h=await c()}catch(b){console.error(`[corsair] Failed to decrypt config for integration "${t}", starting fresh:`,b),h={}}let m={...h};for(let[b,k]of Object.entries(f))k===null?delete m[b]:m[b]=k;let C=ae(m,y);await u.updateIntegration({config:C})},a)}}function S(e){let{authType:n,integrationName:t,tenantId:r,kek:i,database:o,extraAccountFields:a=[]}=e,s=[...E[n].account,...a],u=null,l=null,d=async()=>{if(l)return l;let k=await o.db.selectFrom("corsair_integrations").selectAll().where("name","=",t).executeTakeFirst();if(!k)throw new Error(`Integration "${t}" not found. Make sure to create the integration first.`);return l={id:k.id,config:Jn(k.config),dek:k.dek??null},l},c={kek:i,integrationName:t,tenantId:r,getIntegration:d,getAccount:async()=>{if(u)return u;let k=await d(),w=await o.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",r).where("integration_id","=",k.id).executeTakeFirst();if(!w)throw new Error(`Account not found for tenant "${r}" and integration "${t}". Make sure to create the account first.`);return u={id:w.id,config:Jn(w.config),dek:w.dek??null},u},updateAccount:async k=>{let w=await c.getAccount();await o.db.updateTable("corsair_accounts").set({...k.config!==void 0?{config:k.config}:{},...k.dek!==void 0?{dek:k.dek}:{},updated_at:new Date}).where("id","=",w.id).execute(),u=null}},p=null,g=null,f=async()=>{if(p)return p;let k=await c.getAccount();if(!k.dek)throw new Error(`No DEK found for account (tenant: "${r}", integration: "${t}"). Initialize the account first.`);return p=await L(k.dek,i),p},y=async()=>{if(g)return g;let k=await c.getIntegration();if(!k.dek)throw new Error(`No DEK found for integration "${t}". Initialize the integration first.`);return g=await L(k.dek,i),g},h=async()=>{let k=await c.getAccount(),w=await f(),P=k.config;return!P||Object.keys(P).length===0?{}:ee(P,w)},m=async()=>{let k=await c.getIntegration(),w=await y(),P=k.config;return!P||Object.keys(P).length===0?{}:ee(P,w)},b={get_dek:f,issue_new_dek:async()=>{let k=await c.getAccount(),w=Q(),P={};if(k.dek){let O=await L(k.dek,i),M=k.config;M&&Object.keys(M).length>0&&(P=je(M,O,w))}let D=await X(w,i);return await c.updateAccount({config:P,dek:D}),p=w,w},...Cr(h,async k=>{let w=await f(),P;try{P=await h()}catch(M){console.error(`[corsair] Failed to decrypt config for account (tenant: "${r}", integration: "${t}"), starting fresh:`,M),P={}}let D={...P};for(let[M,x]of Object.entries(k))x===null?delete D[M]:D[M]=x;let O=ae(D,w);await c.updateAccount({config:O})},s)};return n==="oauth_2"&&(b.get_integration_credentials=async()=>{let k=await m();return{client_id:k.client_id||null,client_secret:k.client_secret||null,redirect_url:k.redirect_url??null}}),b}async function wr(e,n,t){let r=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!r)throw new Error(`Integration "${n}" not found.`);let i=Q(),o=await X(i,t);return await e.db.updateTable("corsair_integrations").set({dek:o,updated_at:new Date}).where("id","=",r.id).execute(),i}async function Pr(e,n,t,r){let i=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!i)throw new Error(`Integration "${n}" not found.`);let o=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",i.id).executeTakeFirst();if(!o)throw new Error(`Account not found for tenant "${t}" and integration "${n}".`);let a=Q(),s=await X(a,r);return await e.db.updateTable("corsair_accounts").set({dek:s,updated_at:new Date}).where("id","=",o.id).execute(),a}var Ko=new Set(["webhook_signature","expires_at","scope","redirect_url"]);function Se(e){return Ko.has(e)}function Zo(e,n){return Se(n)?!1:e==="oauth_2"?n==="client_id"||n==="client_secret":!0}function qo(e){return!Se(e)}function Go(e){switch(e){case"oauth_2":case"managed":return["access_token","refresh_token"];case"api_key":return["api_key"];case"bot_token":return["bot_token"]}}function Jo(e,n){return Go(e).every(r=>n.find(o=>o.level==="account"&&o.name===r)?.configured??!1)}async function Tr(e,n){if(!e)return!1;let t=J(e,`get_${n}`);if(!t)return!1;try{let r=await t();return typeof r=="string"&&r.length>0}catch{return!1}}function zo(e,n){let r=e.authConfig?.[n]?.integration??[];return[...E[n].integration,...r]}function Vo(e,n){let r=e.authConfig?.[n]?.account??[];return[...E[n].account,...r]}function Yo(e,n,t){let r=t.filter(s=>s.required&&!s.configured).map(s=>s.name),i=t.filter(s=>s.level==="integration"&&s.required&&!s.configured).map(s=>s.name),o=t.filter(s=>s.level==="account"&&s.required&&s.configured),a;return i.length>0?a="missing_integration":r.length===0?a="ready":o.length>0?a="partial":a="not_started",{plugin:e,authType:n,status:a,connected:Jo(n,t),fields:t,missingRequiredFields:r}}async function pn(e,n,t){let r=H(n);if(!r||!e.database||!e.kek)return null;let i=t.trim()||"default",o=n.authConfig,a=o?.[r]?.integration??[],s=o?.[r]?.account??[],u=I({authType:r,integrationName:n.id,kek:e.kek,database:e.database,extraIntegrationFields:a}),l=S({authType:r,integrationName:n.id,tenantId:i,kek:e.kek,database:e.database,extraAccountFields:s}),d=zo(n,r),c=Vo(n,r),p=[];for(let g of d)p.push({name:g,level:"integration",required:Zo(r,g),configured:await Tr(u,g)});for(let g of c)p.push({name:g,level:"account",required:qo(g),configured:await Tr(l,g)});return Yo(n.id,r,p)}async function Ke(e,n,t={}){let r=n.trim()||"default",i=t.pluginIds?.length?new Set(t.pluginIds):null,o=[];for(let a of e.plugins){if(i&&!i.has(a.id))continue;let s=await pn(e,a,r);s&&o.push(s)}return o}function gn(e){return e.connected?"connected":e.status==="missing_integration"?"missing_credentials":"not_connected"}import{ZodBoolean as Xo,ZodDate as ei,ZodEnum as ni,ZodNullable as ti,ZodNumber as ri,ZodObject as oi,ZodOptional as ii,ZodRecord as si,ZodString as ai,ZodType as ui}from"zod";var Qo={slack:{channels:{list:{}},users:{list:{}}},linear:{projects:{list:{}},issues:{list:{}},users:{list:{}}},github:{issues:{list:{}},repositories:{list:{}}},discord:{guilds:{list:{}},channels:{list:{}}},hubspot:{contacts:{getMany:{}},companies:{getMany:{}},deals:{getMany:{}}},gmail:{messages:{list:{}},labels:{list:{}},drafts:{list:{}},threads:{list:{}}},googlecalendar:{events:{getMany:{}}},googledrive:{files:{list:{}},folders:{list:{}},sharedDrives:{list:{}}},notion:{databases:{getManyDatabases:{}},databasePages:{getManyDatabasePages:{}},users:{getManyUsers:{}}},airtable:{bases:{getMany:{}}},todoist:{projects:{getMany:{}},tasks:{getMany:{}}},cal:{bookings:{list:{}}},zohomail:{folders:{list:{}},messages:{list:{}}}},zn=Qo;async function Ar(e,n){let t=[],r=p=>{t.push(p),console.log(p)},i=p=>{t.push(p),console.warn(p)},o=n?.caller??"script",a=or(e);if(!a)throw new Error("setupCorsair: invalid corsair instance");if(!a.database)throw new Error("setupCorsair: a database must be configured on the corsair instance");let s=li(e,a.plugins,n),u={...a,database:a.database},l=u.database.db;await gi(l,i);let d=await fi(l,u,s.tenantId,s.provisionAccounts,r);n?.credentials&&Object.keys(n.credentials).length>0&&await mi(e,s,n.credentials,u,r,i);let c=await bi(d,s,r,o);if(n?.backfill){r("[corsair:setup] Starting backfill...");let p=Rr({plugins:a.plugins,database:l,kek:a.kek,multiTenancy:!0}).withTenant(s.tenantId);await Ci(p,a.plugins,c,r,i),r("[corsair:setup] Backfill complete.")}return t.join(`
-`)}function Vn(e,n,t){let r=t==="integration"?e.authConfig?.[n]?.integration??[]:e.authConfig?.[n]?.account??[];return new Set([...E[n][t],...r])}function ci(e,n){if(!e)return!1;for(let[t,r]of Object.entries(e)){let i=n.find(s=>s.id===t);if(!i)continue;let o=H(i);if(!o)continue;let a=Vn(i,o,"account");for(let s of Object.keys(r))if(a.has(s))return!0}return!1}function li(e,n,t){let r=ir(e),i=t?.tenantId?.trim(),o=i!==void 0&&i.length>0;if(r&&t?.backfill&&!o)throw new Error("setupCorsair: tenantId is required for backfill on a multi-tenant instance");if(r&&ci(t?.credentials,n)&&!o)throw new Error("setupCorsair: tenantId is required when setting account-level credentials on a multi-tenant instance");if(o&&!i)throw new Error("setupCorsair: tenantId must be a non-empty string");return{multiTenant:r,tenantIdProvided:o,tenantId:o?i:"default",provisionAccounts:!r||o}}function xr(e,n){return ie(e)?n===0?!0:Object.values(e).every(t=>xr(t,n-1)):!1}function di(e){return xr(e,4)}var pi={...ar};function fn(e){if(e instanceof oi){let n={};for(let[t,r]of Object.entries(e.shape))n[t]=r instanceof ui?fn(r):"unknown";return n}return e instanceof ti?`${fn(e.unwrap())} | null`:e instanceof ii?`${fn(e.unwrap())} | undefined`:e instanceof ni?e.options.join(" | "):e instanceof ai?"string":e instanceof ri?"number":e instanceof Xo?"boolean":e instanceof ei?"date":e instanceof si?"jsonb":"unknown"}async function gi(e,n){let t=await e.introspection.getTables(),r=new Set(t.map(i=>i.name));for(let[i,o]of Object.entries(pi))r.has(i)||n(`[corsair:setup] Table "${i}" does not exist. Run your database migrations before calling setupCorsair.
-Schema: ${JSON.stringify(fn(o),null,2)}`)}async function fi(e,n,t,r,i){let o=new Date,a=new Map;for(let s of n.plugins){let u=s.id,l=H(s),d=await e.selectFrom("corsair_integrations").selectAll().where("name","=",u).executeTakeFirst();if(!d){let y=crypto.randomUUID();await e.insertInto("corsair_integrations").values({id:y,name:u,config:{},created_at:o,updated_at:o}).execute(),d=await e.selectFrom("corsair_integrations").selectAll().where("id","=",y).executeTakeFirst(),i(`[corsair:setup] Created integration: ${u}`)}let c=l?s.authConfig?.[l]?.integration??[]:[],p=l?s.authConfig?.[l]?.account??[]:[],g=l&&d?I({authType:l,integrationName:u,kek:n.kek,database:n.database,extraIntegrationFields:c}):void 0;if(d&&!d.dek&&g&&(await g.issue_new_dek(),i(`[corsair:setup] Issued integration DEK: ${u}`)),!d||!l||!g)continue;let f;if(r){let y=await e.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",d.id).executeTakeFirst();if(!y){let h=crypto.randomUUID();await e.insertInto("corsair_accounts").values({id:h,tenant_id:t,integration_id:d.id,config:{},created_at:o,updated_at:o}).execute(),y=await e.selectFrom("corsair_accounts").selectAll().where("id","=",h).executeTakeFirst(),i(`[corsair:setup] Created account: ${u}`)}f=y&&S({authType:l,integrationName:u,tenantId:t,kek:n.kek,database:n.database,extraAccountFields:p}),y&&f&&!y.dek&&(await f.issue_new_dek(),i(`[corsair:setup] Issued account DEK: ${u}`))}a.set(u,{pluginId:u,authType:l,integration:g,account:f,integrationFields:[...E[l].integration,...c],accountFields:r?[...E[l].account,...p]:[]})}return a}function yi(e){if(!ie(e))return;let n=e.keys;return ie(n)?n:void 0}function hi(e,n){return"withTenant"in e&&typeof e.withTenant=="function"?e.withTenant(n):e}async function mi(e,n,t,r,i,o){let a=yi(e),s=n.provisionAccounts?hi(e,n.tenantId):void 0;for(let[u,l]of Object.entries(t)){let d=r.plugins.find(m=>m.id===u);if(!d){o(`[corsair:setup] Unknown plugin '${u}' \u2014 skipping credentials.`);continue}let c=H(d);if(!c){o(`[corsair:setup] Plugin '${u}' has no auth type \u2014 skipping credentials.`);continue}let p=Vn(d,c,"integration"),g=Vn(d,c,"account"),f=a?.[u],y=s?.[u],h=ie(y)?y.keys:void 0;for(let[m,C]of Object.entries(l))if(C){if(p.has(m)){if(n.multiTenant&&n.tenantIdProvided)throw new Error(`[corsair:setup] '${u}.${m}' is an integration-level credential shared across all tenants. You passed tenantId="${n.tenantId}", which only scopes account-level credentials. Run setup without --tenant if you intend to change this credential globally.`);let b=J(f,`set_${m}`);if(!b){o(`[corsair:setup] Cannot set integration field '${m}' for '${u}'.`);continue}await b(C),i(`[corsair:setup] Set ${u} integration.${m}`);continue}if(g.has(m)){if(n.multiTenant&&!n.tenantIdProvided)throw new Error(`setupCorsair: tenantId is required to set account-level credential '${u}.${m}' on a multi-tenant instance`);let b=J(h,`set_${m}`);if(!b){o(`[corsair:setup] Cannot set account field '${m}' for '${u}'.`);continue}await b(C),i(`[corsair:setup] Set ${u} account.${m} (tenant=${n.tenantId})`);continue}o(`[corsair:setup] Unknown credential field '${m}' for plugin '${u}'.`)}}}var vr=new Set(["webhook_signature","expires_at","scope","redirect_url"]);async function ki(e,n,t,r,i,o,a,s,u){let l=[],d=[];for(let p of i){if(vr.has(p))continue;let g=J(t,`get_${p}`);if(!g)continue;let f=null;try{let y=await g();f=typeof y=="string"?y:null}catch{}f||l.push(p)}if(r&&o.length>0)for(let p of o){if(vr.has(p))continue;let g=J(r,`get_${p}`);if(!g)continue;let f=null;try{let y=await g();f=typeof y=="string"?y:null}catch{}f||d.push(p)}let c=l.length===0&&d.length===0;if(c)s(`[corsair:setup] '${e}' (${n}) is configured \u2713`);else if(n==="managed")s(`[corsair:setup] '${e}' (managed) is not connected yet. Use Connect in your app \u2014 Corsair Hub delivers OAuth tokens after authorization.`);else{let p=[...l,...d];if(u==="cli"){let g=p.map(f=>`${f}=VALUE`).join(" ");s(`[corsair:setup] '${e}' (${n}) needs credentials. Run:
-  corsair setup --${e} ${g}`)}else{let g=[`[corsair:setup] '${e}' (${n}) needs credentials. Call:`];for(let f of l)g.push(`  await corsair.keys.${e}.set_${f}(value)`);for(let f of d){let y=a.provisionAccounts?a.tenantId==="default"?`corsair.${e}`:`corsair.withTenant(${JSON.stringify(a.tenantId)}).${e}`:`corsair.withTenant(<tenant>).${e}`;g.push(`  await ${y}.keys.set_${f}(value)`)}s(g.join(`
-`))}}return c}async function bi(e,n,t,r){let i=new Set;for(let o of e.values())await ki(o.pluginId,o.authType,o.integration,o.account,o.integrationFields,o.accountFields,n,t,r)&&i.add(o.pluginId);return i}async function Ci(e,n,t,r,i){if(!di(zn)){i("[corsair:setup] Backfill config is invalid - skipping backfill.");return}let o=zn,a=new Set(n.map(s=>s.id));for(let[s,u]of Object.entries(o)){if(!a.has(s))continue;if(!t.has(s)){r(`[corsair:setup] Skipping backfill for '${s}' \u2014 auth not configured.`);continue}let l=ie(e)?e[s]:void 0,d=ie(l)?l.api:void 0;if(d)for(let[c,p]of Object.entries(u))for(let[g,f]of Object.entries(p)){r(`[corsair:setup] Backfilling ${s} \u203A ${c}.${g}...`);try{let y=ie(d)?d[c]:void 0;await J(y,g)?.(f)}catch(y){i(`[corsair:setup] ${s} \u203A ${c}.${g} failed: `+(y instanceof Error?y.message:String(y)))}}}}async function Ie(e,n){if(!T(e).database)throw new Error("A database must be configured to provision Corsair for connect");await Ar(e,{tenantId:n})}var wi=new Set(["access_token","refresh_token","expires_at","scope"]);function Pi(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ti(e,n){return e==="oauth_2"||e==="managed"?n.filter(t=>!Se(t)&&!wi.has(t)):n.filter(t=>!Se(t))}async function Sr(e,n,t={}){let r=T(e),i=$(e),o=tn(i),a=[],s=t.pluginIds?new Set(t.pluginIds):null;for(let u of r.plugins){if(s&&!s.has(u.id))continue;let l=H(u);if(!l)continue;let d=Pi(l),c=t.providerNameOverrides?.[u.id]??se(u.id),p=await pn(r,u,n),g=Xe(u,l),f=Ti(l,g),y={plugin:u.id,providerName:c,authKind:d,alreadyConfigured:p?.connected??!1};if(f.length>0&&(y.credentialFields=f),d==="oauth"){let m=t.oauthModeOverrides?.[u.id]??(l==="managed"?"managed":"byo");if(y.oauthMode=m,!t.skipOAuthUrlGeneration&&m!=="managed")try{let C=await Yn(e,u.id,{tenantId:n,redirectUri:o,hubConnect:!0});y.oauthUrl=C.url}catch(C){y.setupError=C instanceof Error?C.message:`Could not prepare OAuth for ${u.id}`}}a.push(y)}return a}async function Ir(e,n){await Ie(e,n)}var vi="3000",Ai="/api/corsair";function Qn(e){return e.replace(/\/$/,"")}function xi(e,n){return`${Qn(e)}${n}`}function _r(e){return e.startsWith("http")?e:`https://${e}`}function _e(e){let n=e?.deliveryUrl?.trim();if(n)return Qn(n);let t=e?.deliveryPath?.trim()||Ai,r=t.startsWith("/")?t:`/${t}`,i=process.env.CORSAIR_DELIVERY_URL?.trim();if(i)return Qn(_r(i));let o=process.env.APP_URL?.trim()||process.env.NEXT_PUBLIC_APP_URL?.trim()||process.env.VERCEL_URL?.trim();return o?xi(_r(o),r):`http://localhost:${process.env.PORT?.trim()||vi}${r}`}async function yn(e,n){let t=$(e),r=xe(t.projectApiKey);await Ir(e,n.tenantId);let i=n.plugin?[n.plugin]:void 0,o=n.plugin&&n.oauthMode?{[n.plugin]:n.oauthMode}:void 0,a=n.plugin&&n.providerName?{[n.plugin]:n.providerName}:void 0,s=await Sr(e,n.tenantId,{pluginIds:i,oauthModeOverrides:o,providerNameOverrides:a});if(s.length===0)throw new Error(n.plugin?`Plugin '${n.plugin}' is not configured on this Corsair instance`:"No plugins are configured on this Corsair instance");let u={tenantId:n.tenantId,plugins:s};return r==="development"&&(u.deliveryUrl=_e({deliveryUrl:n.deliveryUrl})),Re({hub:t,path:"/connect/sessions",notFoundMessage:"Hub REST API not found at /connect/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:u,parseResponse:rn})}function Er(e){return e==="oauth_2"||e==="managed"?"oauth":e==="bot_token"?"bot_token":"api_key"}function Ri(e,n){return n&&!n.has(e.id)?!1:H(e)!==null}async function Ee(e,n,t={}){let r=T(e),i=n.trim()||"default",o=t.pluginIds?.length?new Set(t.pluginIds):null,a=await Ke(r,i,{pluginIds:t.pluginIds}),s=new Map(a.map(l=>[l.plugin,l])),u=r.plugins.filter(l=>Ri(l,o)).map(l=>{let d=H(l),c=s.get(l.id);return c?{plugin:l.id,providerName:se(l.id),authKind:Er(d),status:c.status,connected:c.connected,fields:c.fields.map(p=>({name:p.name,level:p.level,required:p.required,configured:p.configured})),missingRequiredFields:c.missingRequiredFields}:{plugin:l.id,providerName:se(l.id),authKind:Er(d),status:"not_started",connected:!1,fields:[],missingRequiredFields:[]}});return{tenantId:i,plugins:u}}async function Dr(e,n){let t=$(e);return yr({hub:t,path:`/projects/${encodeURIComponent(n.projectId)}/connections`,notFoundMessage:"Hub REST API not found at /projects/:id/connections. Check HUB_API_URL and ensure the Hub API is deployed.",parseResponse:on})}var Si=new Set(["localhost","127.0.0.1","[::1]","::1"]);function Xn(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Si.has(n)}catch{return!1}}function et(e){return e==="development"?"browser":"server"}function Or(e){return et(e)==="browser"}function Mr(e){return Xn(e)?"Production delivery URL must be a public URL, not localhost":null}var ue=6e4,he=3e5;var z=class extends Error{code;constructor(n,t){super(t),this.name="AuthCredentialsDeliveryError",this.code=n}};async function hn(e,n){let t=T(e,()=>new z("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new z("no_database","Database not configured");let r=N(t,n.plugin,d=>new z("plugin_not_found",d)),i=H(r);if(!i)throw new z("invalid_credentials",`Plugin '${r.id}' has no authType configured`);if(i==="oauth_2"||i==="managed")throw new z("invalid_credentials","OAuth plugins must be connected via sign-in, not credentials delivery");await Ie(e,n.tenantId);let o=new Set(Xe(r,i)),s=r.authConfig?.[i]?.account??[],u=S({authType:i,integrationName:n.plugin,tenantId:n.tenantId,kek:t.kek,database:t.database,extraAccountFields:s}),l=0;for(let[d,c]of Object.entries(n.credentials)){if(!c.trim())continue;if(!o.has(d))throw new z("invalid_credentials",`Unknown credential field '${d}' for plugin '${n.plugin}'`);let p=J(u,`set_${d}`);if(!p)throw new z("invalid_credentials",`Cannot set credential field '${d}' for plugin '${n.plugin}'`);await p(c.trim()),l+=1}if(l===0)throw new z("invalid_credentials","Provide at least one credential field to save");return{plugin:n.plugin,tenantId:n.tenantId}}var mn=new Map;function Ii(e){for(let[n,t]of mn)t<=e&&mn.delete(n)}function kn(e,n){let t=e.trim();if(!t)return{ok:!1,error:"Delivery replay key is required"};let r=Date.now();return Ii(r),mn.has(t)?{ok:!1,error:"Delivery request already consumed"}:(mn.set(t,r+n),{ok:!0})}async function bn(e,n,t){for(let r of e){if(r.id!==n)continue;let i=r.oauthWebhookTenantLinkResolver;return i?i(t):null}return null}var Hr=e=>{if(!e)return{};if(typeof e=="string")try{return JSON.parse(e)}catch{return{}}return e};async function _i(e){let n=await e.database.db.selectFrom("corsair_integrations").selectAll().where("name","=",e.pluginId).executeTakeFirst();if(!n)throw new Error(`Integration '${e.pluginId}' not found. Run setupCorsair before registering webhook tenant links.`);let t=await e.database.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",e.tenantId).where("integration_id","=",n.id).executeTakeFirst();if(!t)throw new Error(`Account not found for tenant '${e.tenantId}' and integration '${e.pluginId}'.`);return{integrationId:n.id,accountId:t.id}}async function Ei(e){let n=await e.database.db.selectFrom("corsair_accounts").selectAll().where("id","=",e.accountId).executeTakeFirst();if(!n?.dek)throw new Error(`Account '${e.accountId}' has no DEK.`);let t=await L(n.dek,e.kek),r=Hr(n.config),i={};Object.keys(r).length>0&&(i=ee(r,t)),i[e.link.linkType]=e.link.externalId;let o=ae(i,t);await e.database.db.updateTable("corsair_accounts").set({config:o,updated_at:new Date}).where("id","=",n.id).execute()}async function De(e){let{database:n,kek:t,pluginId:r,tenantId:i,link:o,authType:a,extraAccountFields:s=[]}=e,{accountId:u}=await _i({database:n,pluginId:r,tenantId:i}),l=!1;if(a){let d=S({authType:a,integrationName:r,tenantId:i,kek:t,database:n,extraAccountFields:s}),c=`set_${o.linkType}`,p=d[c];typeof p=="function"&&(await p(o.externalId),l=!0)}l||await Ei({database:n,kek:t,accountId:u,link:o})}async function nt(e){let{database:n,kek:t,pluginId:r,linkType:i,externalId:o}=e,a=await n.db.selectFrom("corsair_accounts as accounts").innerJoin("corsair_integrations as integrations","integrations.id","accounts.integration_id").selectAll("accounts").where("integrations.name","=",r).execute();for(let s of a)if(s.dek)try{let u=await L(s.dek,t),d=Hr(s.config)[i];if(!d)continue;if(We(d,u)===o)return s}catch{continue}return null}async function Cn(e){return(await nt(e))?.tenant_id??null}async function Fr(e){return Cn({database:e.database,kek:e.kek,pluginId:e.pluginId,linkType:e.match.linkType,externalId:e.match.externalId})}var ce=class extends Error{code;constructor(n,t){super(t),this.name="ManagedOAuthDeliveryError",this.code=n}};async function Oe(e,n){let{plugin:t,tenantId:r,accessToken:i,refreshToken:o,expiresIn:a,scope:s}=n;if(!i.trim())throw new ce("no_access_token","Managed OAuth delivery missing access_token");let u=T(e,()=>new ce("invalid_corsair_instance","Invalid corsair instance"));if(!u.database)throw new ce("no_database","No database configured on corsair instance");let l=N(u,t,c=>new ce("plugin_not_found",c));await Ie(e,r);let d=S({authType:"managed",integrationName:t,tenantId:r,kek:u.kek,database:u.database});await d.set_access_token(i),o&&await d.set_refresh_token(o),a&&await d.set_expires_at(String(Math.floor(Date.now()/1e3)+a)),s&&await d.set_scope(s);try{let c=await bn(u.plugins,t,{access_token:i,refresh_token:o,scope:s});if(c)try{let p=l.authConfig?.managed?.account??[];await De({database:u.database,kek:u.kek,pluginId:t,tenantId:r,link:c,authType:"managed",extraAccountFields:p})}catch(p){console.warn(`[corsair:managed-oauth] Failed to persist webhook tenant link for '${t}' tenant '${r}':`,p)}}catch(c){console.warn(`[corsair:managed-oauth] Failed to resolve webhook tenant link for '${t}' tenant '${r}':`,c)}return{plugin:t,tenantId:r}}import{createHmac as tt,randomUUID as Di,timingSafeEqual as Ur}from"crypto";function Br(e){if(e)return e.startsWith("sha256=")?e.slice(7):e}function wn(e){let n=JSON.stringify({type:e.type,payload:e.payload}),t=Math.floor(Date.now()/1e3).toString(),r=tt("sha256",e.signingSecret.trim()).update(n).digest("hex");return{body:n,headers:{"content-type":"application/json","x-corsair-signature":`sha256=${r}`,"x-corsair-timestamp":t,"x-corsair-project":e.projectId,"x-corsair-nonce":Di()}}}function rt(e){let n=e.signingSecret.trim();if(!n)return!1;let t=Br(e.signatureHeader);if(!t)return!1;let r=Number(e.timestampHeader);if(!Number.isFinite(r)||Math.abs(Date.now()-r*1e3)>3e5)return!1;let o=tt("sha256",n).update(e.body).digest("hex");try{return Ur(Buffer.from(o,"utf8"),Buffer.from(t,"utf8"))}catch{return!1}}function Me(e){let n=e.signingSecret.trim();if(!n)return{ok:!1,error:"Tunnel signing secret is required"};let t=Br(e.signatureHeader);if(!t)return{ok:!1,error:"Invalid tunnel signature"};let r=Number(e.timestampHeader);if(!Number.isFinite(r))return{ok:!1,error:"Invalid or missing tunnel timestamp"};if(Math.abs(Date.now()-r*1e3)>3e5)return{ok:!1,error:"Tunnel request timestamp is outside the allowed window"};let o=tt("sha256",n).update(e.body).digest("hex");try{if(!Ur(Buffer.from(o,"utf8"),Buffer.from(t,"utf8")))return{ok:!1,error:"Invalid tunnel signature"}}catch{return{ok:!1,error:"Invalid tunnel signature"}}return{ok:!0}}function ot(e){if(!e)return{};try{return JSON.parse(e)}catch{return{}}}function it(e){return e.httpOk&&(e.status===204||e.body.status==="ok"||e.body.ok===!0)}function st(e){return e.status===0?`Could not reach delivery URL (${e.deliveryUrl}): ${e.ack.error??e.body}`:e.ack.error??e.body??`HTTP ${e.status}`}async function at(e){let{body:n,headers:t}=wn(e);try{let r=await fetch(e.deliveryUrl,{method:"POST",headers:t,body:n}),i=await r.text();return{ok:r.ok,status:r.status,body:i}}catch(r){return{ok:!1,status:0,body:r instanceof Error?r.message:"Delivery request failed"}}}function Oi(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Nr(e,n,t=[]){for(let[r,i]of Object.entries(e))if(Oi(i)){if(i.match(n))return{webhook:i,path:[...t,r]}}else if(i&&typeof i=="object"){let o=Nr(i,n,[...t,r]);if(o)return o}return null}function Mi(e){let n={};for(let[t,r]of Object.entries(e))n[t.toLowerCase()]=Array.isArray(r)?r[0]:r;return n}function Hi(e){let n=e["x-goog-resource-uri"],t=e["x-goog-channel-id"];if(!n||!t)return null;let r={resourceId:e["x-goog-resource-id"]||"",resourceState:e["x-goog-resource-state"]||"",resourceUri:n,channelId:t,channelExpiration:e["x-goog-channel-expiration"]||""};return n.includes("/drive/")&&(r.kind="drive#change"),{message:{data:Buffer.from(JSON.stringify(r)).toString("base64"),messageId:e["x-goog-message-number"]||""}}}async function $r(e,n,t,r){let i=Mi(n),o=typeof t=="string"?JSON.parse(t):t;(!o||typeof o=="object"&&Object.keys(o).length===0)&&i["x-goog-resource-uri"]&&(o=Hi(i)||o);let s={headers:i,body:o,...r?{query:r}:{}},u=r?.tenantId||"default",l=e.withTenant?e.withTenant(u):e,d=en;for(let c of d){let p=l[c];if(!p||!p.webhooks||p.pluginWebhookMatcher&&!p.pluginWebhookMatcher(s))continue;let g=Nr(p.webhooks,s);if(!g)continue;let f=g.path.join("."),y={payload:o,headers:i,rawBody:typeof t=="string"?t:JSON.stringify(t),...r?{query:r}:{}};try{let h=await g.webhook.handler(y),m=!!Object.keys(h.returnToSender||{})?.length;return{plugin:c,action:f,body:o,response:m?{...h?.returnToSender,success:!0}:{success:!0},...h.responseHeaders&&{responseHeaders:h.responseHeaders}}}catch(h){return console.error(`Error executing webhook handler for ${c}.${f}:`,h),{plugin:c,action:f,body:o,response:{success:!1,error:h instanceof Error?h.message:"Unknown error"}}}}return{plugin:null,action:null,body:null}}import{randomBytes as Ni}from"crypto";import{createHmac as Fi,randomBytes as Ui,timingSafeEqual as Bi}from"crypto";function ne(){return Ui(16).toString("base64url")}function Ze(e,n){let t=n.trim();if(!t)throw new Error("Signing secret is required");return Fi("sha256",t).update(e).digest("base64url")}function V(e,n){let t=n.trim();if(!t)return null;let r=e.split(".");if(r.length!==2)return null;let[i,o]=r;if(!i||!o)return null;let a=Ze(i,t);try{if(!Bi(Buffer.from(o,"utf8"),Buffer.from(a,"utf8")))return null}catch{return null}let s;try{s=JSON.parse(Buffer.from(i,"base64url").toString("utf8"))}catch{return null}return s.exp*1e3<Date.now()?null:s}function Pn(e,n,t){let r=Math.floor(Date.now()/1e3),i={...e,iat:r,exp:t},o=Buffer.from(JSON.stringify(i)).toString("base64url"),a=Ze(o,n);return`${o}.${a}`}function qe(e,n,t){let r=Math.floor(Date.now()/1e3);return Pn(e,n,r+Math.floor(t/1e3))}function me(e){return decodeURIComponent(e)}function ut(e){return encodeURIComponent(e)}function Lr(e){let n=e.trim();return n.length>0?n:null}function Tn(e,n){let t=new URL(e);return t.searchParams.set("d",n),t.toString()}function vn(e,n){if(!Lr(n))throw new Error("Signing secret is required for browser delivery tokens");let t=Math.floor(Date.now()/1e3),r={...e,jti:e.jti??Ni(16).toString("base64url"),iat:t,exp:t+Math.floor(6e4/1e3)},i=Buffer.from(JSON.stringify(r)).toString("base64url"),o=Ze(i,n);return`${i}.${o}`}function le(e,n){return Lr(n)?V(e,n):null}function ke(e){return e.deliveryMode==="connect.status"}function be(e){return e.deliveryMode==="auth.credentials"}function Ge(e){return e.deliveryMode==="permission.approve"||e.deliveryMode==="permission.deny"}function Je(e){return e.deliveryMode==="oauth.tokens"}function An(e){return e.deliveryMode==="oauth.callback"||e.deliveryMode===void 0&&!ke(e)&&!be(e)&&!Ge(e)&&!Je(e)}function ct(e,n){if(e instanceof Headers)return e.get(n)??void 0;let t=e[n]??e[n.toLowerCase()];return Array.isArray(t)?t[0]:typeof t=="string"?t:void 0}async function $i(e,n,t){let r=typeof t.tenantId=="string"?t.tenantId:typeof t.query?.tenantId=="string"?t.query.tenantId:void 0;return r||(!n.database||!t.plugin||!t.linkType||!t.externalId?void 0:await Cn({database:n.database,kek:n.kek,pluginId:t.plugin,linkType:t.linkType,externalId:t.externalId})??void 0)}async function Li(e,n,t){let r=await $i(e,n,t),i={...t.query??{},...r?{tenantId:r}:{}},o=await $r(e,t.headers,t.body,i);if(!o.plugin)return{status:"failed",retryable:!1,error:"No matching webhook handler found"};if(o.response&&o.response.success===!1)return{status:"failed",retryable:!1,error:typeof o.response.error=="string"?o.response.error:"Webhook handler failed"};let a=o.response?.returnToSender,s=a&&typeof a=="object"&&typeof a.validationToken=="string"&&Object.keys(a).length===1?a.validationToken:a||(o.response?.data??o.response);return{status:"ok",webhookResponse:{status:o.response?.statusCode??200,body:s,headers:o.responseHeaders}}}async function Wi(e,n){return await ze(e,n),{status:"ok"}}async function ji(e,n){return await Oe(e,{plugin:n.plugin,tenantId:n.tenantId,accessToken:n.accessToken,refreshToken:n.refreshToken,expiresIn:n.expiresIn,scope:n.scope}),{status:"ok"}}async function dt(e,n,t){let r=await lt(e,{token:n},t);if(r.status!=="ok")throw new Error(r.error??"Permission decision failed")}async function lt(e,n,t){let r=T(e),i=n.token?.trim();if(!i)return{status:"failed",retryable:!1,error:"Permission token is required"};if(!r.database)return{status:"failed",retryable:!1,error:"Database not configured"};let o=new Date().toISOString(),a=await r.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",i).executeTakeFirst();return a?a.status!=="pending"?{status:"ok"}:a.expires_at<o?(await r.database.db.updateTable("corsair_permissions").set({status:"expired",updated_at:new Date}).where("id","=",a.id).execute(),{status:"failed",retryable:!1,error:"Permission has expired"}):(await r.database.db.updateTable("corsair_permissions").set({status:t,updated_at:new Date}).where("id","=",a.id).execute(),{status:"ok"}):{status:"failed",retryable:!1,error:"Permission not found"}}async function Ki(e,n){try{return await hn(e,n),{status:"ok"}}catch(t){return{status:"failed",retryable:!1,error:t instanceof Error?t.message:"Credential delivery failed"}}}async function Zi(e,n){let t=n.tenantId?.trim()||"default";try{return{status:"ok",webhookResponse:{status:200,body:await Ee(e,t,{pluginIds:n.plugins})}}}catch(r){return{status:"failed",retryable:!1,error:r instanceof Error?r.message:"Connect status introspection failed"}}}async function pt(e,n,t={}){let r=T(e),i=ct(n.headers,"x-corsair-signature"),o=ct(n.headers,"x-corsair-timestamp"),a=ct(n.headers,"x-corsair-nonce");if(t.signingSecret?.trim()){let u=Me({body:n.body,signatureHeader:i,timestampHeader:o,signingSecret:t.signingSecret});if(!u.ok)return{status:"failed",retryable:!1,error:u.error};if(!a?.trim())return{status:"failed",retryable:!1,error:"Missing tunnel nonce"};let l=kn(`nonce:${a.trim()}`,3e5);if(!l.ok)return{status:"failed",retryable:!1,error:l.error}}else if(!t.allowUnsignedTunnel)return{status:"failed",retryable:!1,error:"Tunnel signing secret is required"};let s;try{s=JSON.parse(n.body)}catch{return{status:"failed",retryable:!1,error:"Invalid tunnel envelope JSON"}}switch(s.type){case"webhook":return Li(e,r,s.payload);case"oauth.callback":return Wi(e,s.payload);case"oauth.tokens":return ji(e,s.payload);case"permission.approve":return lt(e,s.payload,"approved");case"permission.deny":return lt(e,s.payload,"denied");case"auth.credentials":return Ki(e,s.payload);case"connect.status":return Zi(e,s.payload);default:return{status:"failed",retryable:!1,error:`Unsupported tunnel type: ${s.type}`}}}var qi="corsair:client-bridge";function Wr(e){let n=JSON.stringify({type:qi,requestId:e.requestId,ok:e.ok,body:e.body??null,error:e.error??null}),t=JSON.stringify(e.hubOrigin);return`<!DOCTYPE html><html><head><meta charset="utf-8"></head><body><script>
-(function () {
-  var message = ${n};
-  var targetOrigin = ${t};
-  if (window.parent && window.parent !== window) {
-    window.parent.postMessage(message, targetOrigin);
-  }
-})();
-</script></body></html>`}var Gi=[".corsair.dev"];function Ji(e){return e==="localhost"||e==="127.0.0.1"||e==="[::1]"||e==="::1"}function zi(e){try{let{hostname:n,protocol:t}=new URL(e);return t!=="http:"&&t!=="https:"?!1:Ji(n)?!0:Gi.some(r=>n===r.slice(1)||n.endsWith(r))}catch{return!1}}function jr(e){return!e||!zi(e)?null:{"Access-Control-Allow-Origin":e,"Access-Control-Allow-Methods":"GET, POST, OPTIONS","Access-Control-Allow-Headers":"content-type, x-corsair-signature, x-corsair-timestamp, x-corsair-project, x-corsair-nonce, access-control-request-private-network","Access-Control-Allow-Private-Network":"true","Access-Control-Max-Age":"0",Vary:"Origin"}}function Kr(e,n){if(!n)return e;let t=new Headers(e.headers);for(let[r,i]of Object.entries(n))t.set(r,i);return new Response(e.body,{status:e.status,statusText:e.statusText,headers:t})}function xn(e,n){let t=new URL(e);return n.error?(t.searchParams.set("error",n.error),t.toString()):n.connectedPlugin?(t.searchParams.set("connected",n.connectedPlugin),t.toString()):(n.status!==void 0&&t.searchParams.set("status",Buffer.from(JSON.stringify(n.status)).toString("base64url")),t.toString())}async function gt(e,n){let t=$(e),i=new URL(n).searchParams.get("d");if(!i)return{type:"json",status:200,body:{status:"ok",message:"Corsair tunnel endpoint is active",timestamp:new Date().toISOString()}};let o=le(i,t.signingSecret);if(!o)return{type:"json",status:400,body:{error:"Invalid or expired delivery token"}};let a=kn(`browser:${o.jti}`,6e4);if(!a.ok)return{type:"json",status:400,body:{error:a.error}};try{if(ke(o)){if(!o.hubSuccessUrl)return{type:"json",status:400,body:{error:"Connect status delivery missing hubSuccessUrl"}};let s=o.tenantId?.trim()||"default",u=await Ee(e,s,{pluginIds:o.statusPlugins});return{type:"redirect",url:xn(o.hubSuccessUrl,{status:u})}}if(be(o))return o.hubSuccessUrl?o.credentials?(await hn(e,{plugin:o.plugin,tenantId:o.tenantId,credentials:o.credentials}),{type:"redirect",url:xn(o.hubSuccessUrl,{connectedPlugin:o.plugin})}):{type:"redirect",url:xn(o.hubSuccessUrl,{error:"Credential delivery missing credentials"})}:{type:"json",status:400,body:{error:"Credential delivery missing hubSuccessUrl"}};if(Ge(o)){if(!o.permissionToken)return{type:"json",status:400,body:{error:"Permission delivery missing permission token"}};await dt(e,o.permissionToken,o.deliveryMode==="permission.approve"?"approved":"denied")}else if(Je(o)){if(!o.accessToken)return{type:"json",status:400,body:{error:"Managed OAuth delivery missing access_token"}};await Oe(e,{plugin:o.plugin,tenantId:o.tenantId,accessToken:o.accessToken,refreshToken:o.refreshToken,expiresIn:o.expiresIn,scope:o.scope})}else{if(!An(o)||!o.code||!o.state||!o.redirectUri)return{type:"json",status:400,body:{error:"Invalid BYO OAuth delivery token"}};await ze(e,{code:o.code,state:o.state,redirectUri:o.redirectUri})}}catch(s){let u=s instanceof Error?s.message:"Hub delivery failed";return(ke(o)||be(o))&&o.hubSuccessUrl?{type:"redirect",url:xn(o.hubSuccessUrl,{error:u})}:(ke(o)||be(o))&&o.hubOrigin&&o.requestId?{type:"text",status:400,headers:{"Content-Type":"text/html; charset=utf-8"},body:Wr({hubOrigin:o.hubOrigin,requestId:o.requestId,ok:!1,error:u})}:{type:"json",status:400,body:{error:u}}}return{type:"redirect",url:o.hubSuccessUrl}}async function ft(e,n){let t=$(e),r=await pt(e,n,{signingSecret:t.signingSecret});if(r.status!=="ok")return{type:"json",status:r.retryable===!1?400:502,body:{error:r.error??"Tunnel processing failed"}};let i=r.webhookResponse;if(!i)return{type:"json",status:200,body:{status:"ok"}};let o=i.status??200,a=i.headers;return i.body&&typeof i.body=="object"&&!(i.body instanceof ArrayBuffer)?{type:"json",status:o,body:i.body,headers:a}:{type:"text",status:o,body:typeof i.body=="string"?i.body:i.body?JSON.stringify(i.body):null,headers:a}}function yt(e){if(e.type==="redirect")return Response.redirect(e.url,302);let n=new Headers;for(let[t,r]of Object.entries(e.headers??{}))typeof r=="string"&&n.set(t,r);return e.type==="json"?Response.json(e.body,{status:e.status,headers:n}):new Response(e.body,{status:e.status,headers:n})}async function ht(e,n){return n.method==="GET"?gt(e,n.url):ft(e,{headers:n.headers,body:n.body??""})}async function mt(e,n){try{let t=await ht(e,n);return yt(t)}catch(t){if(t instanceof ye)return Response.json({error:t.message},{status:503});throw t}}async function Ce(e,n){let t=n.method.toUpperCase(),r=jr(n.headers.get("origin"));if(t==="OPTIONS")return r?new Response(null,{status:204,headers:r}):Response.json({error:"Method not allowed"},{status:405});if(t!=="GET"&&t!=="POST")return Response.json({error:"Method not allowed"},{status:405});let i=await mt(e,{method:t,url:n.url,headers:n.headers,body:t==="POST"?await n.text():void 0});return Kr(i,r)}var te=class extends Error{pluginId;authType;constructor(n,t,r){super(r??`[auth-missing:${n}:${t}]`),Object.setPrototypeOf(this,new.target.prototype),this.name="AuthMissingError",this.pluginId=n,this.authType=t}};var Zr=300;async function kt(e,n){let{keys:t,hub:r,plugin:i,tenantId:o}=e,a=n?.forceRefresh??!1,[s,u,l]=await Promise.all([t.get_access_token(),t.get_expires_at(),t.get_refresh_token()]);if(!s&&!l)throw new te(i,"managed");let d=Math.floor(Date.now()/1e3);if(!a&&s&&u&&Number(u)>d+Zr)return{accessToken:s,expiresAt:Number(u),refreshed:!1};if(!l&&s&&!a){let g=u?Number(u):null;if(g===null||g>d+Zr)return{accessToken:s,expiresAt:g??d+3600,refreshed:!1}}let c=await Re({hub:r,path:"/oauth/refresh",body:{plugin:i,tenantId:o},parseResponse:an}),p=c.expires_in?d+c.expires_in:u?Number(u):d+3600;return await t.set_access_token(c.access_token),await t.set_expires_at(String(p)),c.refresh_token&&await t.set_refresh_token(c.refresh_token),c.scope&&await t.set_scope(c.scope),{accessToken:c.access_token,expiresAt:p,refreshed:!0}}async function qr(e,n){e._refreshAuth=async()=>(await kt(n,{forceRefresh:!0})).accessToken}async function Rn(e,n){let t=xe(e.projectApiKey),r={permissionId:n.permissionId,permissionToken:n.permissionToken,plugin:n.plugin,endpoint:n.endpoint,args:n.args,tenantId:n.tenantId,expiresAt:n.expiresAt};return t==="development"&&(r.deliveryUrl=_e({deliveryUrl:n.deliveryUrl})),Re({hub:e,path:"/permission/sessions",notFoundMessage:"Hub REST API not found at /permission/sessions. Check HUB_API_URL and ensure the Hub API is deployed.",body:r,parseResponse:sn})}function Sn(e){return`Approval required. Visit ${e} to approve or deny, then tell the agent to retry this action.`}function Gr(e){return{delivery:n=>Ce(e,n),deliveryOptions:n=>Ce(e,n)}}var Jr=1200*1e3;function bt(){return ne()}function Ct(){return Jr}function wt(e,n){return qe(e,n,Jr)}function Pt(e,n){return V(e,n)}function Tt(e){return me(e)}var zr=600*1e3;function vt(){return ne()}function At(){return zr}function xt(e,n){return qe(e,n,zr)}function Rt(e,n){return V(e,n)}function St(e){return ut(e)}function It(e){return me(e)}function _t(){return ne()}function Et(e,n,t){return Pn(e,n,Math.floor(t.getTime()/1e3))}function Dt(e,n){return V(e,n)}function Ot(e){return me(e)}function In(e,n){let t=[];e||t.push("database"),n||t.push("kek");let r={};return new Proxy(r,{get(i,o){let a=t.length>1;throw new Error(`corsair.keys.${String(o)}: Cannot access keys because ${t.join(" and ")} ${a?"are":"is"} not configured. Provide both 'database' and 'kek' in createCorsair() to enable key management.
-
-To generate a KEK, run: openssl rand -base64 ${Le}`)}})}import*as Ve from"crypto";function de(e,n){return Buffer.from(JSON.stringify({plugin:e,tenantId:n,iat:Date.now()})).toString("base64url")}function Mt(e,{maxAgeMs:n}={}){try{let t=e.includes(".")?e.split(".")[0]:e,r=JSON.parse(Buffer.from(t,"base64url").toString("utf-8"));if(r!==null&&typeof r=="object"&&"plugin"in r&&"tenantId"in r&&typeof r.plugin=="string"&&typeof r.tenantId=="string"){let i=r;return n!==void 0&&typeof i.iat=="number"&&Date.now()-i.iat>n?null:i}return null}catch{return null}}function He(e,n){let t=Ve.createHmac("sha256",n).update(e).digest("base64url");return`${e}.${t}`}var Ht=600*1e3;function _n(e,n){let t=e.lastIndexOf(".");if(t===-1)return null;let r=e.slice(0,t),i=e.slice(t+1),o=Ve.createHmac("sha256",n).update(r).digest("base64url"),a=Buffer.from(i,"base64url"),s=Buffer.from(o,"base64url");return a.length!==s.length||!Ve.timingSafeEqual(a,s)?null:Mt(r,{maxAgeMs:Ht})}function Fe(e){return!!(e?.baseUrl?.trim()&&e?.redirectUri?.trim())}var Vi=async(e,n)=>(console.error(`[corsair:${n.pluginId}:${n.operation}]`,{error:e.message,input:n.input}),{maxRetries:0});async function Vr(e,n,t,r,i){let o={pluginId:n,operation:t,input:r,originalError:e},a=Object.keys(i).find(l=>i[l]?.match(e,o));return await(i[a||"DEFAULT"]?.handler||Vi)(e,o)}import{randomBytes as Qi}from"crypto";import{v4 as Xi}from"uuid";var Ft="Permission approval required. Set manual.approvalBaseUrl (or use hub for hosted approval) so an approval URL can be generated. Optionally set manual.onApprovalRequired to customize the agent message.";function Bt(e){return e?e.approvalBaseUrl!==void 0||e.onApprovalRequired!==void 0:!1}function Yr(e,n){return`${e.replace(/\/+$/,"")}/${n}`}function Ut(e){return Sn(e)}async function Nt(e,n){if(Bt(e.manual)){let r=e.manual?.approvalBaseUrl?.trim();return r?Yr(r,n.token):null}let t=e.hub;if(!t)return null;try{return(await Rn(t,{permissionId:n.id,permissionToken:n.token,plugin:n.plugin,endpoint:n.endpoint,args:Yi(n.args),tenantId:n.tenant_id,expiresAt:n.expires_at})).approvalUrl}catch{return null}}function Yi(e){try{return JSON.parse(e)}catch{return e}}async function En(e,n){if(!(n.status==="pending"||n.status==="approved"))return{...n,approvalUrl:null};let r=await Nt(e,n);return{...n,approvalUrl:r}}async function $t(e){let{permissionsOptions:n,manual:t,hub:r,permissionId:i,permissionToken:o,plugin:a,endpoint:s,args:u,tenantId:l,expiresAt:d,operationPath:c}=e;if(n?.formatAsyncMessage)return n.formatAsyncMessage({token:o,id:i,plugin:a,endpoint:s,args:u});let g=await Nt({manual:t,hub:r},{id:i,token:o,plugin:a,endpoint:s,args:JSON.stringify(u),tenant_id:l,expires_at:d});return Bt(t)?g?t?.onApprovalRequired?t.onApprovalRequired({approvalUrl:g}):Ut(g):Ft:r?g?Ut(g):`Action '${c}' requires user approval before it can run. Could not create approval link. Check hub configuration and server logs.`:Ft}var es={open:{read:"allow",write:"allow",destructive:"allow"},cautious:{read:"allow",write:"allow",destructive:"require_approval"},strict:{read:"allow",write:"require_approval",destructive:"deny"},readonly:{read:"allow",write:"deny",destructive:"deny"}};function ns(e,n,t){return t!==void 0?t:es[n][e]}function Lt(e){let n=/(\d+)(d|h|m|s)/g,t=0,r;for(;(r=n.exec(e))!==null;){let i=parseInt(r[1],10);switch(r[2]){case"d":t+=i*864e5;break;case"h":t+=i*36e5;break;case"m":t+=i*6e4;break;case"s":t+=i*1e3;break}}return t>0?t:600*1e3}function Xr(e){return{async find_by_permission_id(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst()},async find_by_token(n){if(e)return e.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst()},async set_executing(n){e&&await e.db.updateTable("corsair_permissions").set({status:"executing",updated_at:new Date}).where("id","=",n).execute()},async set_completed(n){e&&await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}}}async function Qr(e,n,t){let r=Date.now()+t;for(;Date.now()<r;){let i=await e.db.selectFrom("corsair_permissions").select(["id","status"]).where("id","=",n).executeTakeFirst();if(!i)return{result:"blocked",reason:"pending"};if(i.status==="approved")return{result:"allow",onComplete:async()=>{await e.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",n).execute()}};if(i.status==="denied")return{result:"blocked",reason:"denied"};if(i.status==="expired"||i.status==="failed")return{result:"blocked",reason:"timeout"};await new Promise(o=>setTimeout(o,500))}return{result:"blocked",reason:"timeout"}}async function eo(e){let n=ns(e.riskLevel,e.mode,e.override);if(n==="allow")return{result:"allow"};let t=e.meta?.irreversible?" (irreversible)":"",r=e.meta?.description?`${e.meta.description}${t}`:`${e.pluginId}.${e.endpointPath}${t}`;if(n==="deny"||!e.db)return console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 denied by permission mode '${e.mode}'.`,`
-  Action: ${r}`,`
-  To allow this, update the permission mode or add an override in your corsair config.`),{result:"blocked",reason:"policy"};let i=JSON.stringify(e.args),o=new Date().toISOString(),a=e.tenantId??"default",s=await e.db.db.selectFrom("corsair_permissions").selectAll().where("plugin","=",e.pluginId).where("endpoint","=",e.endpointPath).where("args","=",i).where("tenant_id","=",a).where("expires_at",">",o).where("status","in",["pending","approved","executing"]).orderBy("created_at","desc").limit(1).executeTakeFirst();if(s){if(s.status==="approved"){let f=e.db,y=s.id;return{result:"allow",onComplete:async()=>{await f.db.updateTable("corsair_permissions").set({status:"completed",updated_at:new Date}).where("id","=",y).execute()}}}return s.status==="executing"?{result:"allow"}:(console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval already pending.`,`
-  Action: ${r}`,`
-  Permission ID: ${s.id}`,`
-  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Qr(e.db,s.id,e.timeoutMs??600*1e3):{result:"blocked",reason:"pending",id:s.id,token:s.token,expiresAt:s.expires_at})}let u=Xi(),l=Qi(32).toString("hex"),d=e.timeoutMs??600*1e3,c=new Date(Date.now()+d).toISOString();return await e.db.db.insertInto("corsair_permissions").values({id:u,created_at:new Date,updated_at:new Date,token:l,plugin:e.pluginId,endpoint:e.endpointPath,args:i,tenant_id:a,status:"pending",expires_at:c}).execute(),console.log(`[corsair/${e.pluginId}] '${e.endpointPath}' blocked \u2014 approval required.`,`
-  Action: ${r}`,`
-  Permission ID:    ${u}`,`
-  Permission token: ${l}`,`
-  Expires at:       ${c}`,`
-  Use the token to approve or deny this request.`),(typeof e.approvalMode=="function"?e.approvalMode():e.approvalMode)==="synchronous"?Qr(e.db,u,d):{result:"blocked",reason:"pending",id:u,token:l,expiresAt:c}}function ts(e){return typeof e=="function"}function rs(e,n,t){let r=He(de(e,n.tenantId??t??"default"),n.kek),i=new URL(n.baseUrl);i.searchParams.set("state",r);let o=i.toString(),a=n.onAuthMissing?n.onAuthMissing({plugin:e,connectUrl:o,state:r}):`[auth-missing:${e}] Authentication required. Direct the user to connect their account: ${o}`;return new Error(a)}function Wt({endpoints:e,hooks:n,ctx:t,tree:r,pluginId:i,errorHandlers:o,currentPath:a=[],keyBuilder:s,permissionsConfig:u,endpointMeta:l,database:d,permissionsOptions:c,tenantId:p,manualConfig:g,hubConfig:f}){for(let[y,h]of Object.entries(e)){let m=n?.[y];if(ts(h)){let C=m,b=[...a,y].join("."),k=async(w={})=>{let P;if(u){let _=l?.[b],{result:Ae,reason:q,onComplete:Ne,token:Y,id:fe,expiresAt:B}=await eo({pluginId:i,endpointPath:b,args:w,mode:u.mode,override:u.overrides?.[b],riskLevel:_?.riskLevel??"write",meta:_,db:d,timeoutMs:c?Lt(c.timeout):void 0,tenantId:p,approvalMode:c?.mode});if(Ae==="blocked"){let G;throw q==="denied"?G=`Action '${b}' was denied by the user. Await further instructions before proceeding.`:q==="policy"?G=`Action '${b}' is blocked by the permission policy. Update the corsair config to allow it.`:q==="timeout"?G=`Action '${b}' timed out waiting for approval.`:Y&&fe?G=await $t({permissionsOptions:c,manual:g,hub:f,permissionId:fe,permissionToken:Y,plugin:i,endpoint:b,args:w,tenantId:p??"default",expiresAt:B??new Date(Date.now()+(c?Lt(c.timeout):600*1e3)).toISOString(),operationPath:b}):G=`Action '${b}' requires user approval before it can run.`,new Error(G)}P=Ne}let D=async(_,Ae,q)=>{try{return await h(Ae,q)}catch(Ne){if(Ne instanceof Error){let Y=await Vr(Ne,i,b,typeof q=="object"&&q!==null?q:{args:q},o);if(_<(Y.maxRetries||0)){let fe=_+1;console.log(`Retrying (${fe} / ${Y.maxRetries})...`);let B;if(Y.headersRetryAfterMs)B=Y.headersRetryAfterMs;else switch(Y.retryStrategy){case"exponential_backoff":B=Math.pow(2,fe-1)*1e3;break;case"exponential_backoff_jitter":let G=Math.pow(2,fe-1)*1e3,Mo=(Math.random()-.5)*1e3;B=Math.max(0,G+Mo);break;case"linear_1s":B=1e3;break;case"linear_2s":B=2e3;break;case"linear_3s":B=3e3;break;case"linear_4s":B=4e3;break;default:B=1e3;break}await new Promise(G=>setTimeout(G,B)),await D(fe,Ae,q),console.log(`[corsair:${i}:${b}] Retry strategy:`,Y)}}throw Ne}},O;try{O=s?await s(t,"endpoint"):void 0}catch(_){throw g&&Fe(g)&&g.oauthConfig&&g.kek&&_ instanceof te&&_.authType==="oauth_2"?rs(i,g,p):_}if(!C?.before&&!C?.after){let _=await D(0,{...t,key:O},w);return await P?.(),_}let M={...t,key:O},x=C.before?await C.before(M,w):{ctx:M,args:w,continue:!0,passToAfter:void 0};if(x.continue===!1)return;let ve=await D(0,x.ctx,x.args);return await C.after?.(x.ctx,ve,x.passToAfter),await P?.(),ve};r[y]=k}else if(h&&typeof h=="object"){let C={};Wt({endpoints:h,hooks:m,ctx:t,tree:C,pluginId:i,errorHandlers:o,currentPath:[...a,y],keyBuilder:s,permissionsConfig:u,endpointMeta:l,database:d,permissionsOptions:c,tenantId:p,manualConfig:g,hubConfig:f}),r[y]=C}}}function os(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function jt({webhooks:e,hooks:n,ctx:t,webhooksTree:r,keyBuilder:i}){for(let[o,a]of Object.entries(e)){let s=n?.[o];if(os(a)){let u=s,l=async d=>{let c=(g,f)=>a.handler(g,f),p=i?await i(t,"webhook"):void 0;return!u?.before&&!u?.after?c({...t,key:p},d):(async()=>{let g={...t,key:p},f=u.before?await u.before(g,d):{ctx:g,args:d,continue:!0,passToAfter:void 0};if(f.continue===!1)return;let y=await c(f.ctx,f.args);return y?.success===!0&&await u.after?.(f.ctx,y,f.passToAfter),y})()};r[o]={match:a.match,handler:l}}else if(a&&typeof a=="object"){let u={};jt({webhooks:a,hooks:s,ctx:t,webhooksTree:u,keyBuilder:i}),r[o]=u}}}function is(e,n,t){let r=null;return async()=>{if(r)return r;if(!e)throw new Error("Database not configured");let i=await e.db.selectFrom("corsair_integrations").selectAll().where("name","=",n).executeTakeFirst();if(!i)throw new Error(`Integration "${n}" not found. Make sure to create the integration first.`);let o=await e.db.selectFrom("corsair_accounts").selectAll().where("tenant_id","=",t).where("integration_id","=",i.id).executeTakeFirst();if(!o)throw new Error(`Account not found for tenant "${t}" and integration "${n}". Make sure to create the account first.`);return r=o.id,r}}function ss(e,n,t,r,i){return e?qn(e.db,n,t,r,i):{findByEntityId:async()=>null,existsByEntityId:async()=>!1,findIdByEntityId:async()=>null,findById:async()=>null,findManyByEntityIds:async()=>[],list:async()=>[],search:async()=>[],upsertByEntityId:async()=>{throw new Error("Database not configured")},deleteById:async()=>!1,deleteByEntityId:async()=>!1,count:async()=>0}}function Kt(e,n){let{database:t,tenantId:r,kek:i,rootErrorHandlers:o,permissionsOptions:a,manualConfig:s,hubConfig:u}=n,l={},d={};for(let c of e)l[c.id]={},d[c.id]={};for(let c of e){let p=c.schema,g=r??"default",f=is(t,c.id,g);if(p?.entities){let x={};for(let[ve,_]of Object.entries(p.entities)){let Ae=t?qn(t.db,f,ve,p.version,_):ss(void 0,f,ve,p.version,_);x[ve]=Ae}d[c.id].db=x,l[c.id].db=x}let y=c.options,h=c.authConfig,m;if(t&&i&&y?.authType){let x=h?.[y.authType]?.account??[];m=S({authType:y.authType,integrationName:c.id,tenantId:g,kek:i,database:t,extraAccountFields:x}),l[c.id].keys=m}let C={database:t,db:d[c.id]?.db??{},$getAccountId:f,...c.options?{options:c.options}:{},...m?{keys:m,authType:y?.authType}:{},tenantId:g,...u?{hub:u}:{}},b=c.endpoints??{},k=c.hooks,w={...o,...c.errorHandlers},P={},D=c.options?.permissions;Wt({endpoints:b,hooks:k,ctx:C,tree:P,pluginId:c.id,errorHandlers:w,currentPath:[],keyBuilder:c.keyBuilder,permissionsConfig:D,endpointMeta:c.endpointMeta,database:t,permissionsOptions:a,tenantId:r,manualConfig:s?{...s,oauthConfig:c.oauthConfig,kek:i,tenantId:g}:void 0,hubConfig:u}),Object.keys(P).length>0&&(l[c.id].api=P),C.endpoints=P;let O=c.webhooks??{},M=c.webhookHooks;if(Object.keys(O).length>0){let x={};jt({webhooks:O,hooks:M,ctx:C,webhooksTree:x,keyBuilder:c.keyBuilder}),l[c.id].webhooks=x,c.pluginWebhookMatcher&&(l[c.id].pluginWebhookMatcher=c.pluginWebhookMatcher),c.pluginTenantWebhookMatcher&&(l[c.id].pluginTenantWebhookMatcher=c.pluginTenantWebhookMatcher)}}return l}function no(e,n,t){let r={};for(let i of e){let o=i.options,a=i.authConfig;if(o?.authType){let s=a?.[o.authType]?.integration??[],u=I({authType:o.authType,integrationName:i.id,kek:t,database:n,extraIntegrationFields:s});r[i.id]=u}}return r}var as="createCorsair({ approval: ... }) is deprecated. Rename to permissions: { timeout, onTimeout, mode }.";function to(e){let{permissions:n,approval:t}=e;if(n&&t)throw new Error("createCorsair was given both permissions and approval config. Use permissions only \u2014 approval is deprecated.");return t?(console.warn(`[corsair] ${as}`),t):n}import*as ro from"querystring";function we(e){let{oauthConfig:n,clientId:t,redirectUri:r,state:i}=e,o={...n.authParams,client_id:t,redirect_uri:r,response_type:"code",scope:n.scopes.join(" "),state:i};return`${n.authUrl}?${ro.stringify(o)}`}var W=class extends Error{code;constructor(n,t){super(t),this.name="ConnectError",this.code=n}};function us(e){let n=e.oauthConfig;if(!n)throw new W("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Zt(e,n){let t=T(e,()=>new W("invalid_corsair_instance","Invalid corsair instance"));if(!t.database)throw new W("no_database","No database configured on corsair instance");let r=t.manual?.redirectUri;if(!r)throw new W("no_redirect_uri","No redirectUri configured. Set manual.redirectUri in createCorsair().");let i=_n(n,t.kek);if(!i)throw new W("invalid_state","Invalid or tampered state parameter");let{plugin:o,tenantId:a}=i,s=N(t,o,p=>new W("plugin_not_found",p)),u=us(s),d=await I({authType:"oauth_2",integrationName:o,kek:t.kek,database:t.database}).get_client_id();if(!d)throw new W("client_id_not_configured",`client_id not configured for '${o}'`);let c=we({oauthConfig:u,clientId:d,redirectUri:r,state:n});return{plugin:o,tenantId:a,providerName:u.providerName,oauthUrl:c,state:n}}var A=class extends Error{status;code;extra;constructor(n,t,r,i={}){super(r??t),this.name="ManagementApiError",this.status=n,this.code=t,this.extra=i}};function R(e,n){return new Response(JSON.stringify(n),{status:e,headers:{"content-type":"application/json"}})}function oo(e){let n={error:e.code,message:e.message,...e.extra};return R(e.status,n)}function pe(e){return new A(404,"not_found",e)}function re(e,n={}){return new A(400,"bad_request",e,n)}function io(e,n){return N(e,n,t=>pe(t))}async function so(e,n){let t=e.options?.authType;if(!t||!n.database||!n.kek)return{configured:!1,missingFields:[]};let r=I({authType:t,integrationName:e.id,kek:n.kek,database:n.database}),i=E[t].integration,o=r,a;try{a=await Promise.all(i.map(l=>o[`get_${l}`]()))}catch{a=i.map(()=>null)}let s=i.filter((l,d)=>a[d]==null),u;return t==="oauth_2"?u=!s.includes("client_id")&&!s.includes("client_secret"):u=s.length===0,{configured:u,missingFields:s}}async function ao(e,n){let t=e.options?.authType??null,r=e.oauthConfig,{configured:i,missingFields:o}=await so(e,n);return{id:e.id,authType:t,configured:i,missingFields:o,oauth:r?{providerName:r.providerName,scopes:r.scopes,requiresRegisteredRedirect:!!r.requiresRegisteredRedirect}:null}}function Dn(){return{ok:!0}}async function On(e){return Promise.all(e.plugins.map(n=>ao(n,e)))}async function Mn(e,n){let t=io(e,n);return ao(t,e)}async function cs(e,n){return e.database?(await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.id as accountId","a.dek as dek","i.name as integrationName"]).where("a.tenant_id","=",n).execute()).map(r=>({integrationName:r.integrationName,hasCredentials:!!r.dek})):[]}async function uo(e,n){let t=await cs(e,n),r=t.filter(i=>i.hasCredentials).map(i=>i.integrationName);return{id:n,accounts:t,connectedPlugins:r}}async function Hn(e){let n=new Map;if(n.set("default",{id:"default",accounts:[],connectedPlugins:[]}),e.database){let t=await e.database.db.selectFrom("corsair_accounts as a").innerJoin("corsair_integrations as i","i.id","a.integration_id").select(["a.tenant_id","a.dek as dek","i.name as integrationName"]).execute();for(let r of t){let i=r.tenant_id;if(!i)continue;let o=n.get(i);o||(o={id:i,accounts:[],connectedPlugins:[]},n.set(i,o));let a=!!r.dek;o.accounts.push({integrationName:r.integrationName,hasCredentials:a}),a&&o.connectedPlugins.push(r.integrationName)}}return[...n.values()]}async function Fn(e,n){if(!n)throw re("Tenant id must be a non-empty string");return uo(e,n)}async function Un(e,n){let t=n?.id?.trim();if(!t)throw re("Tenant id is required",{missingFields:["id"]});return uo(e,t)}async function Bn(e,n){let t=n?.trim()||"default",r={},i=await Ke(e,t);for(let o of i)r[o.plugin]=gn(o);for(let o of e.plugins)o.id in r||(!o.options?.authType||!e.database||!e.kek?r[o.id]="missing_credentials":r[o.id]="not_connected");return r}async function qt(e,n){if(!e.database)throw pe(`Permission '${n}' not found`);let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("id","=",n).executeTakeFirst();if(!t)throw pe(`Permission '${n}' not found`);return En(e,t)}function ls(e){if(!e.oauthConfig)throw re(`Plugin '${e.id}' has no oauthConfig`)}function ds(e){if(!e.manual)throw new A(500,"connect_not_configured","createCorsair was not given manual config. Set { manual: { baseUrl, redirectUri } } to enable manual connect routes.");return e.manual}function Gt(e){let n=ds(e);if(!n.baseUrl?.trim()||!n.redirectUri?.trim())throw new A(500,"connect_not_configured","Manual connect requires manual.baseUrl and manual.redirectUri. Use hub for hosted connect, or set both URLs for manual OAuth.");return n}function ps(e){let n=!!e.hub,t=Fe(e.manual);if(!n&&!t)throw new A(500,"connect_not_configured","createCorsair was not given connect config. Set hub: { ... } for Hub mode, or manual: { baseUrl, redirectUri } for manual connect.")}function co(e){if(!e.database||!e.kek)throw new A(500,"database_not_configured","A database and kek are required to issue connect links.")}async function gs(e,n){let t=n?.plugin?.trim();if(!t)throw re("Plugin id is required",{missingFields:["plugin"]});let r=n.tenantId?.trim()||"default",i=io(e,t);ls(i);let o=Gt(e);co(e);let a=await so(i,e);if(!a.configured)throw new A(400,"missing_credentials",`Plugin '${t}' is missing OAuth client credentials`,{missingFields:a.missingFields});let s=He(de(t,r),e.kek),u;try{u=new URL(o.baseUrl)}catch{throw new A(500,"connect_misconfigured","manual.baseUrl is not a valid URL. Set a full URL including protocol (e.g. https://app.example.com/connect).")}return u.searchParams.set("state",s),{connectUrl:u.toString(),expiresAt:new Date(Date.now()+Ht).toISOString()}}async function fs(e,n,t){co(n);let i={tenantId:t.tenantId?.trim()||"default",oauthMode:t.oauthMode},o=t.plugin?.trim();o&&(i.plugin=o);let a=t.providerName?.trim();a&&(i.providerName=a);let s=await yn(e,i);return{connectUrl:s.connectUrl,expiresAt:s.expiresAt}}async function Nn(e,n,t){return ps(n),n.hub?fs(e,n,t):gs(n,t)}async function $n(e,n,t){if(n.hub&&!Fe(n.manual))throw new A(400,"hub_mode","resolve is not used with hub config. Redirect users to connectUrl from createLink.");let r=t?.trim();if(!r)throw re("state is required",{missingFields:["state"]});Gt(n);try{return await Zt(e,r)}catch(i){if(i instanceof W)switch(i.code){case"invalid_state":throw re("Invalid or expired state");case"client_id_not_configured":throw new A(400,"missing_credentials","OAuth client_id is not configured for this plugin",{missingFields:["client_id"]});case"no_redirect_uri":break}throw new A(500,"resolve_failed","Could not resolve connect link. Check server logs for details.")}}async function Ln(e,n,t){if(n.hub&&!Fe(n.manual))throw new A(400,"hub_mode","oauthCallback is not used with hub config. Hub delivers tokens to your deliveryUrl.");let r=t?.code?.trim(),i=t?.state?.trim(),o=[];if(r||o.push("code"),i||o.push("state"),o.length)throw re("Missing required fields",{missingFields:o});let a=Gt(n),{processOAuthCallback:s}=await import("./oauth.js");try{return await s(e,{code:r,state:i,redirectUri:a.redirectUri})}catch(u){if(u instanceof Error&&u.name==="OAuthCallbackError")switch(u.code){case"invalid_state":throw re("Invalid or expired state");case"credentials_not_configured":throw new A(400,"missing_credentials","OAuth client credentials are not configured for this plugin",{missingFields:["client_id","client_secret"]})}throw new A(502,"oauth_callback_failed","OAuth callback did not complete. Check server logs for details.")}}async function Jt(e,n){if(!e.database)throw pe("Permission not found");let t=await e.database.db.selectFrom("corsair_permissions").selectAll().where("token","=",n).executeTakeFirst();if(!t)throw pe("Permission not found");return En(e,t)}async function lo(e,n){return"id"in n?qt(e,n.id):Jt(e,n.token)}var po=[{method:"GET",pattern:"/ok",handler:async()=>R(200,Dn())},{method:"GET",pattern:"/tenants",handler:async({internal:e})=>R(200,await Hn(e))},{method:"POST",pattern:"/tenants",handler:async({internal:e,body:n})=>R(201,await Un(e,n))},{method:"GET",pattern:"/tenants/:id",handler:async({internal:e,params:n})=>R(200,await Fn(e,n.id))},{method:"GET",pattern:"/plugins",handler:async({internal:e})=>R(200,await On(e))},{method:"GET",pattern:"/plugins/:id",handler:async({internal:e,params:n})=>R(200,await Mn(e,n.id))},{method:"GET",pattern:"/connection-status",handler:async({internal:e,query:n})=>R(200,await Bn(e,n.tenantId))},{method:"GET",pattern:"/permissions/:id",handler:async({internal:e,params:n})=>R(200,await qt(e,n.id))},{method:"POST",pattern:"/permissions/lookup-by-token",handler:async({internal:e,body:n})=>{let t=n?.token?.trim();return t?R(200,await Jt(e,t)):R(400,{error:"bad_request",message:"token is required",missingFields:["token"]})}},{method:"POST",pattern:"/connect/links",handler:async({corsair:e,internal:n,body:t})=>R(200,await Nn(e,n,t))},{method:"GET",pattern:"/connect/resolve",handler:async({corsair:e,internal:n,query:t})=>R(200,await $n(e,n,t.state??""))},{method:"POST",pattern:"/connect/oauth/callback",handler:async({corsair:e,internal:n,body:t})=>R(200,await Ln(e,n,t))}];(()=>{let e=new Set;for(let n of po){let t=`${n.method} ${n.pattern}`;if(e.has(t))throw new Error(`Duplicate management route registered: ${t}`);e.add(t)}})();function ys(e,n){let t=e.split("/").filter(Boolean),r=n.split("/").filter(Boolean);if(t.length!==r.length)return null;let i={};for(let o=0;o<t.length;o++){let a=t[o],s=r[o];if(a.startsWith(":"))i[a.slice(1)]=decodeURIComponent(s);else if(a!==s)return null}return i}function hs(e,n){if(!n)return e;let t=n.endsWith("/")?n.slice(0,-1):n;return e===t?"/":e.startsWith(`${t}/`)?e.slice(t.length):e}async function ms(e){if(!(e.method==="GET"||e.method==="HEAD"||!(e.headers.get("content-type")??"").includes("application/json")))try{let t=await e.text();return t?JSON.parse(t):void 0}catch{throw new A(400,"invalid_json","Request body is not valid JSON")}}var ks="/api/corsair";function Pe(e,n={}){let t=n.basePath??ks,r=T(e,()=>new Error("managementHandler: invalid corsair instance (missing internal config)"));return async i=>{try{let o=new URL(i.url),a=hs(o.pathname,t),s=i.method.toUpperCase();if(s==="OPTIONS"||a==="/"||a==="")return await Ce(e,i);if(s!=="GET"&&s!=="POST")return R(405,{error:"method_not_allowed",message:`Method ${s} not allowed`});let u=Object.fromEntries(o.searchParams);for(let l of po){if(l.method!==s)continue;let d=ys(l.pattern,a);if(!d)continue;let c=await ms(i);return await l.handler({corsair:e,internal:r,req:i,params:d,query:u,body:c})}throw pe(`No route for ${s} ${a}`)}catch(o){if(n.onError){let s=await n.onError(o,i);if(s)return s}if(o instanceof A)return oo(o);let a=o instanceof Error?o.message:"Internal server error";return R(500,{error:"internal_error",message:a})}}}function bs(e){let n=e.get?.("host")??"localhost",t=e.protocol??"http",r=e.originalUrl??e.url,i=`${t}://${n}${r}`,o=new Headers;for(let[u,l]of Object.entries(e.headers))if(l!=null)if(Array.isArray(l))for(let d of l)o.append(u,d);else o.set(u,l);let a=e.method!=="GET"&&e.method!=="HEAD",s={method:e.method,headers:o};return a&&e.body!==void 0&&(s.body=typeof e.body=="string"?e.body:JSON.stringify(e.body),o.has("content-type")||o.set("content-type","application/json")),new Request(i,s)}async function Cs(e,n){e.status(n.status),n.headers.forEach((r,i)=>e.setHeader(i,r));let t=Buffer.from(await n.arrayBuffer());e.send(t)}function go(e,n){let t=Pe(e,n);return async(r,i,o)=>{try{let a=await t(bs(r));await Cs(i,a)}catch(a){o(a)}}}function fo(e,n){let t=Pe(e,n);return r=>t(r.req.raw)}function yo(e,n){let t=Pe(e,n);return{GET:t,POST:t,OPTIONS:t}}function ho(e){let n={[Ye]:e};return{ok:Dn,tenants:{list:()=>Hn(e),create:t=>Un(e,t),get:t=>Fn(e,t)},plugins:{list:()=>On(e),get:t=>Mn(e,t)},connectionStatus:{get:t=>Bn(e,t?.tenantId)},permissions:{get:t=>lo(e,t)},connect:{createLink:t=>Nn(n,e,t),resolve:t=>$n(n,e,t),oauthCallback:t=>Ln(n,e,t)}}}async function mo(e,n,t,r,i="pending"){if(!e)return null;try{let o=sr(),a=new Date;return await e.db.insertInto("corsair_events").values({id:o,created_at:a,updated_at:a,account_id:n,event_type:t,payload:r,status:i}).execute(),o}catch(o){return console.warn("Failed to log event:",o),null}}async function ws(e,n,t,r="pending"){try{let i=await e.$getAccountId();return mo(e.database,i,n,t,r)}catch(i){return console.warn("Failed to log event:",i),null}}import*as ko from"https";import*as bo from"querystring";function Wn(e,n,t,r,i){let o=new URL(r.tokenUrl),a=r.tokenAuthMethod==="basic";return new Promise((s,u)=>{let l={code:e.trim(),redirect_uri:i,grant_type:"authorization_code"};a||(l.client_id=n,l.client_secret=t);let d=bo.stringify(l),c={"Content-Type":"application/x-www-form-urlencoded","Content-Length":Buffer.byteLength(d).toString()};a&&(c.Authorization=`Basic ${Buffer.from(`${n}:${t}`).toString("base64")}`);let p=ko.request({hostname:o.hostname,...o.port?{port:Number(o.port)}:{},path:o.pathname+o.search,method:"POST",headers:c},g=>{let f="";g.on("data",y=>{f+=y}),g.on("end",()=>{if(g.statusCode!==200){u(new Error(`Token exchange failed (${g.statusCode}): ${f}`));return}try{s(JSON.parse(f))}catch{u(new Error(`Token endpoint returned non-JSON response: ${f}`))}})});p.on("error",g=>u(new Error(`Request failed: ${g.message}`))),p.write(d),p.end()})}var Co="  ";function K(e){let n=e;return n._def??n.def??{}}function Z(e){let n=e.typeName;if(n)return n;let t=e.type;if(t)return`Zod${t.split("_").map(r=>r.charAt(0).toUpperCase()+r.slice(1)).join("")}`}function j(e){return e.innerType??e.schema??e.out??e.in}function Po(e,n){switch(n){case"ZodPipe":return e.in??e.innerType;case"ZodEffects":return e.schema??e.innerType;case"ZodTransform":return e.schema??e.innerType??e.in;default:return j(e)}}function To(e){let n=e.type;return e.element??(typeof n=="string"?void 0:n)}function Kn(e,n){let t=n.shape??e.shape;return typeof t=="function"?t():t}function Ue(e){return Array.isArray(e.options)?e.options:Array.isArray(e.values)?e.values:e.entries!==null&&typeof e.entries=="object"&&!Array.isArray(e.entries)?Object.values(e.entries):[]}function vo(e,n){return e.description??n.description}function Ps(e){let n=e;for(;n;){let t=K(n),r=vo(n,t);if(r)return r;let i=Z(t);if(Xt(i)||i==="ZodPipe"||i==="ZodEffects"||i==="ZodTransform"){n=Po(t,i);continue}break}}function Xt(e){return e==="ZodOptional"||e==="ZodNullable"||e==="ZodDefault"||e==="ZodCatch"}function F(e){let n=K(e),t=Z(n);switch(t){case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"Date";case"ZodNull":return"null";case"ZodUnknown":case"ZodAny":return"any";case"ZodLiteral":return String(n.value??Ue(n)[0]??"unknown");case"ZodEnum":return Ue(n).map(r=>String(r)).join(" | ");case"ZodOptional":{let r=j(n);return r?F(r):"unknown"}case"ZodNullable":{let r=j(n);return`${r?F(r):"unknown"} | null`}case"ZodDefault":case"ZodCatch":{let r=j(n);return r?F(r):"unknown"}case"ZodArray":{let r=To(n);if(!r)return"unknown[]";let i=K(r),o=Z(i)==="ZodUnion",a=F(r);return`${o?`(${a})`:a}[]`}case"ZodRecord":return"{}";case"ZodObject":{let r=Kn(e,n),i=Object.entries(r);return i.length===0?"{}":`{ ${i.map(([a,s])=>{let u=Z(K(s));return`${u==="ZodOptional"||u==="ZodNullable"?a+"?":a}: ${F(s)}`}).join(", ")} }`}case"ZodUnion":return Ue(n).map(r=>F(r)).join(" | ");case"ZodIntersection":return`${F(n.left)} & ${F(n.right)}`;case"ZodPipe":case"ZodTransform":case"ZodEffects":{let r=Po(n,t);return r?F(r):"unknown"}default:return(t??"unknown").replace("Zod","").toLowerCase()}}function oe(e){let n=K(e),t=Z(n),r=vo(e,n);switch(t){case"ZodString":return{kind:"string",optional:!1,description:r};case"ZodNumber":return{kind:"number",optional:!1,description:r};case"ZodBoolean":return{kind:"boolean",optional:!1,description:r};case"ZodLiteral":{let i=n.value??Ue(n)[0],o=typeof i=="string"||typeof i=="number"||typeof i=="boolean"?i:String(i??"");return{kind:"literal",optional:!1,description:r,value:o}}case"ZodEnum":{let i=Ue(n).map(o=>String(o));return{kind:"string",optional:!1,description:r,enum:i}}case"ZodOptional":{let i=j(n),o=i?oe(i):{kind:"unknown",optional:!1};return{...o,optional:!0,description:r??o.description}}case"ZodNullable":{let i=j(n),o=i?oe(i):{kind:"unknown",optional:!1};return{...o,optional:!0,description:r??o.description}}case"ZodDefault":case"ZodCatch":{let i=j(n);return i?{...oe(i),description:r}:{kind:"unknown",optional:!1,description:r}}case"ZodArray":{let i=To(n);return{kind:"array",optional:!1,description:r,items:i?oe(i):{kind:"unknown",optional:!1}}}case"ZodObject":{let i=Kn(e,n),o={};for(let[a,s]of Object.entries(i))o[a]=oe(s);return{kind:"object",optional:!1,description:r,fields:o}}case"ZodRecord":return{kind:"unknown",optional:!1,description:r};case"ZodUnion":{let i=Ue(n);for(let o of i){let a=K(o);if(Z(a)==="ZodObject")return{...oe(o),description:r}}return{kind:"unknown",optional:!1,description:r}}case"ZodIntersection":case"ZodPipe":case"ZodTransform":case"ZodEffects":{let i=j(n);return i?{...oe(i),description:r}:{kind:"unknown",optional:!1,description:r}}default:return{kind:"unknown",optional:!1,description:r}}}function td(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r===-1)return null;let i=t.slice(0,r),o=t.slice(r+1),a=e.find(d=>d.id===i);if(!a)return null;let s=o;s.startsWith("api.")&&(s=s.slice(4));let u=ge(a.endpointMeta,s),l=ge(a.endpointSchemas,s);return!u&&!l?null:{input:l?.input?oe(l.input):null,output:l?.output?oe(l.output):null,description:u?.description}}var er=["equals","contains","startsWith","endsWith","in"],Ts=["equals","gt","gte","lt","lte","in"],vs=["equals"],As=["equals","before","after","between"];function Ao(e){let n=K(e);switch(Z(n)){case"ZodOptional":case"ZodNullable":case"ZodDefault":case"ZodCatch":{let r=j(n);return r?Ao(r):null}case"ZodString":return"string";case"ZodNumber":return"number";case"ZodBoolean":return"boolean";case"ZodDate":return"date";default:return null}}function nr(e){let n=K(e),t=Z(n);if(Xt(t)){let o=j(n);return o?nr(o):{}}if(t!=="ZodObject")return{};let r=Kn(e,n),i={};for(let[o,a]of Object.entries(r)){let s=Ao(a);s==="string"?i[o]={type:"string",operators:er}:s==="number"?i[o]={type:"number",operators:Ts}:s==="boolean"?i[o]={type:"boolean",operators:vs}:s==="date"&&(i[o]={type:"date",operators:As})}return i}function xo(e,n){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return[t,r]}function Vt(e,n,t){for(let[r,i]of Object.entries(e)){let o=[...n,r];typeof i=="function"?t.push(o.join(".")):i!==null&&typeof i=="object"&&Vt(i,o,t)}}function Yt(e){return e!==null&&typeof e=="object"&&"match"in e&&"handler"in e&&typeof e.match=="function"&&typeof e.handler=="function"}function Qt(e,n,t){for(let[r,i]of Object.entries(e)){let o=[...n,r];Yt(i)?t.push(o.join(".")):i!==null&&typeof i=="object"&&Qt(i,o,t)}}function tr(e,n){if(n.length===0)return null;let[t,...r]=n,i=Object.entries(e).find(([s])=>s.toLowerCase()===t);if(!i)return null;let[o,a]=i;if(r.length===0)return Yt(a)?[o]:null;if(a!==null&&typeof a=="object"&&!Yt(a)){let s=tr(a,r);if(s!==null)return[o,...s]}return null}function Ro(e,n){let t=[];t.push(`${e}({`),t.push("    webhookHooks: {");for(let o=0;o<n.length;o++){let a="    ".repeat(o+2);t.push(`${a}${n[o]}: {`)}let r="    ".repeat(n.length+2),i=r+"    ";t.push(`${r}before(ctx, args) {`),t.push(`${i}return { ctx, args };`),t.push(`${r}},`),t.push(`${r}after(ctx, response) {`),t.push(`${r}},`);for(let o=n.length-1;o>=0;o--){let a="    ".repeat(o+2);t.push(`${a}},`)}return t.push("    },"),t.push("})"),t.join(`
-`)}var xs=new Set(en);function Te(e,n){let t=n?.type??"api",r=n?.plugin;if(r!==void 0){let o=e.find(s=>s.id===r);if(!o)return xs.has(r)?`This plugin (${r}) is not configured. Please add it to the Corsair instance to see its associated methods.`:Te(e);if(t==="webhooks"){if(!o.webhooks)return[];let s=[];return Qt(o.webhooks,[],s),s.map(u=>`${o.id}.webhooks.${u}`)}if(t==="db"){let s=o.schema?.entities;return s?Object.keys(s).map(u=>`${o.id}.db.${u}.search`):[]}if(!o.endpoints)return[];let a=[];return Vt(o.endpoints,[],a),a.map(s=>`${o.id}.api.${s}`)}let i={};if(t==="webhooks")for(let o of e){if(!o.webhooks)continue;let a=[];Qt(o.webhooks,[],a),i[o.id]=a.map(s=>`${o.id}.webhooks.${s}`)}else if(t==="db")for(let o of e){let a=o.schema?.entities;a&&(i[o.id]=Object.keys(a).map(s=>`${o.id}.db.${s}.search`))}else for(let o of e){if(!o.endpoints)continue;let a=[];Vt(o.endpoints,[],a),i[o.id]=a.map(s=>`${o.id}.api.${s}`)}return i}function ge(e,n){if(e){for(let[t,r]of Object.entries(e))if(t.toLowerCase()===n)return r}}function Rs(e,n){let t=e.toLowerCase(),r=n.toLowerCase();if(!t.startsWith(`${r}.`)){let o=t.slice(n.length+1),a=o.startsWith(".")?o.slice(1):o;return a.startsWith("api.")&&(a=a.slice(4)),{shortPath:a,lookupKey:a}}let i=e.slice(n.length+1);return i.toLowerCase().startsWith("api.")&&(i=i.slice(4)),{shortPath:i,lookupKey:i.toLowerCase()}}function zt(e,n){return typeof e=="string"?e:Array.isArray(e)?`${n}:
-  ${e.join(", ")}`:`${n}:
-`+Object.entries(e).map(([t,r])=>`  ${t}: ${r.join(", ")}`).join(`
-`)}function rd(e,n){let t=n.toLowerCase(),r=t.indexOf(".");if(r!==-1){let i=t.slice(0,r),o=t.slice(r+1),a=e.find(s=>s.id===i);if(a){if(o.startsWith("db.")){let d=o.slice(3),c=d.lastIndexOf(".");if(c!==-1){let p=d.slice(0,c),g=d.slice(c+1),f=a.schema?.entities;if(g==="search"&&f){let y=xo(f,p);if(y){let[h,m]=y,C=nr(m),b=[`Search ${i} ${h} stored in the local database.`,"Pass limit and offset as numbers for pagination.","","filters {",`  entity_id: string  [${er.join(", ")}]`];for(let[k,w]of Object.entries(C))b.push(`  ${k}?: ${w.type}  [${w.operators.join(", ")}]`);return b.push("}"),b.join(`
-`)}}}return zt(Te(e,{type:"db"}),"Path not found. Available db operations")}if(o.startsWith("webhooks.")){let d=o.slice(9);if(a.webhooks){let c=tr(a.webhooks,d.split("."));if(c!==null){let p=c.join("."),g=ge(a.webhookSchemas,p.toLowerCase()),f=g?.response?F(g.response):null,y=[];return g?.description&&y.push(g.description),g?.payload&&y.push(`payload ${jn(Be(g.payload))}`),f&&y.push(`response: ${f}`),y.push(`usage:
-${Ro(i,c)}`),y.join(`
-
-`)}}return zt(Te(e,{type:"webhooks"}),"Path not found. Available webhooks")}let s=o;s.startsWith("api.")&&(s=s.slice(4));let u=ge(a.endpointMeta,s),l=ge(a.endpointSchemas,s);if(u||l){let d=[],c=[u?.riskLevel?`[${u.riskLevel}]`:"",u?.irreversible?"[irreversible]":""].filter(Boolean).join(" "),p=[u?.description,c].filter(Boolean).join("  ");return p&&d.push(p),l?.input&&d.push(`input ${jn(Be(l.input))}`),l?.output&&d.push(`output ${jn(Be(l.output))}`),d.join(`
-
-`)}}}return zt(Te(e),"Path not found. Available operations")}function wo(e){let n=e;for(;;){let t=K(n),r=Z(t);if(Xt(r)){let i=j(t);if(!i)return n;n=i;continue}return n}}function Be(e){if(e===void 0)return{kind:"inline",type:"unknown"};let n=wo(e),t=K(n);if(Z(t)==="ZodObject"){let i=Kn(n,t),o=[];for(let[a,s]of Object.entries(i)){let u=K(s),l=Z(u),d=l==="ZodOptional"||l==="ZodNullable",c=wo(s),p=Ps(s);o.push({key:a,optional:d,type:F(c),...p!==void 0?{description:p}:{}})}return{kind:"object",fields:o}}return{kind:"inline",type:F(n)}}function jn(e,n=0){if(e===void 0)return"{}";if(e.kind==="inline")return e.type;if(e.kind==="object"){if(e.fields.length===0)return"{}";let t=Co.repeat(n+1),r=Co.repeat(n);return`{
-${e.fields.map(o=>{let a=o.optional?`${o.key}?`:o.key,s=o.description?`  // ${o.description}`:"";return`${t}${a}: ${o.type}${s}`}).join(`
-`)}
-${r}}`}return"unknown"}function Ss(e,n){let t=Te(e,{plugin:n,type:"api"});if(typeof t=="string")return{ok:!1,error:t};if(!Array.isArray(t))return{ok:!1,error:"list_operations did not return a path array \u2014 pass a configured plugin id."};let r=e.find(d=>d.id===n);if(!r)return{ok:!1,error:`Plugin "${n}" is not configured on this instance.`};let i=[];for(let d of t){let{shortPath:c,lookupKey:p}=Rs(d,n),g=ge(r.endpointMeta,p),f=ge(r.endpointSchemas,p);!g&&!f||i.push({path:d,shortPath:c,description:g?.description,riskLevel:g?.riskLevel,irreversible:g?.irreversible,input:Be(f?.input),output:Be(f?.output)})}i.sort((d,c)=>d.path.localeCompare(c.path));let o=[],a=Te(e,{plugin:n,type:"webhooks"});if(Array.isArray(a)&&r.webhooks)for(let d of a){let p=d.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("webhooks."))continue;let f=g.slice(9),y=tr(r.webhooks,f.split("."));if(y===null)continue;let h=y.join("."),m=ge(r.webhookSchemas,h.toLowerCase()),C=m?.response?F(m.response):void 0;o.push({path:d,description:m?.description,payload:Be(m?.payload),responseType:C,usageExample:Ro(n,y)})}o.sort((d,c)=>d.path.localeCompare(c.path));let s=[],u=Te(e,{plugin:n,type:"db"}),l=r.schema?.entities;if(Array.isArray(u)&&l)for(let d of u){let p=d.toLowerCase().slice(n.length+1),g=p.startsWith(".")?p.slice(1):p;if(!g.startsWith("db."))continue;let f=g.slice(3),y=f.lastIndexOf(".");if(y===-1)continue;let h=f.slice(0,y);if(f.slice(y+1)!=="search")continue;let C=xo(l,h);if(!C)continue;let[b,k]=C,w=nr(k),P=Object.entries(w).map(([D,O])=>({field:D,type:O.type,operators:O.operators}));s.push({path:d,entityName:b,filters:[{field:"entity_id",type:"string",operators:er},...P]})}return s.sort((d,c)=>d.path.localeCompare(c.path)),{ok:!0,data:{pluginId:n,api:i,webhooks:o,db:s}}}function So(e,n){for(let[t,r]of Object.entries(e))if(r?.pluginWebhookMatcher&&r.pluginWebhookMatcher(n))return t;return null}function Is(e,n){let t=So(e,n);if(!t)return null;let r=e[t];if(!r?.pluginTenantWebhookMatcher)return null;let i=r.pluginTenantWebhookMatcher(n);return i?{plugin:t,tenantMatch:i}:null}function _s(e){let n={};for(let t of e)!t.pluginWebhookMatcher&&!t.pluginTenantWebhookMatcher||(n[t.id]={pluginWebhookMatcher:t.pluginWebhookMatcher,pluginTenantWebhookMatcher:t.pluginTenantWebhookMatcher});return n}function Io(e,n){let t=n.toLowerCase(),r=e[t]??e[n];return Array.isArray(r)?r[0]:typeof r=="string"?r:void 0}function _o(e){if(typeof e=="string"){let n=e.trim();return n.length>0?n:void 0}if(typeof e=="number"&&Number.isFinite(e))return String(e)}function Qe(e){return!e||typeof e!="object"||Array.isArray(e)?null:e}function Es(e){return Qe(e.body)}function Eo(e,n){let t=e.query;if(!t)return;let r=t[n]??t[n.toLowerCase()];return Zn(Array.isArray(r)?r:[r])}function Do(e){let n=e.headers??{},t=[n.validationtoken,n.validationToken,n["validation-token"],n["ms-validation-token"]];for(let u of t){let l=Zn(Array.isArray(u)?u:[u]);if(l)return decodeURIComponent(l)}let r=Eo({query:e.query},"validationToken");if(r)return r;let i=["x-forwarded-uri","x-original-uri","x-rewrite-url","x-envoy-original-path","referer"];for(let u of i){let l=n[u],d=Array.isArray(l)?l[0]:l;if(!(!d||typeof d!="string"))try{let p=(d.startsWith("http")?new URL(d):new URL(`https://example.invalid${d.startsWith("/")?d:`/${d}`}`)).searchParams.get("validationToken");if(p?.trim())return p.trim()}catch{continue}}let o=e.payload!==void 0?e.payload:e.body!==void 0?e.body:void 0,a=Qe(typeof o=="string"?(()=>{try{return JSON.parse(o)}catch{return o}})():o);return Zn([a?.validationToken])??null}function Ds(e){if(Do(e))return!0;let n=Qe(e.body??e.payload);return Io(e.headers??{},"content-type")?.includes("text/plain")?!n||Object.keys(n).length===0:!1}function Zn(e){for(let n of e){let t=_o(n);if(t)return t}}function Os(e){let t=Qe(e.message)?.data;if(typeof t!="string")return null;try{return JSON.parse(Buffer.from(t,"base64").toString("utf8"))}catch{return null}}var Ye=Symbol.for("corsair:internal");function Rr(e){let n=e.database?rr(e.database):void 0,t=n&&e.kek?no(e.plugins,n,e.kek):In(!!n,!!e.kek),r=to(e),i={plugins:e.plugins,database:n,kek:e.kek,multiTenancy:!!e.multiTenancy,permissions:r,manual:e.manual,hub:e.hub?nn(e.hub):void 0},o=Xr(n),a=ho(i);if(e.multiTenancy)return Object.assign({withTenant:u=>{if(!u)throw new Error("corsair.withTenant(tenantId): tenantId must be a non-empty string");let l=Kt(e.plugins,{database:n,tenantId:u,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:i.hub});return Object.assign(l,{[Ye]:i})},keys:t,permissions:o,manage:a},{[Ye]:i});let s=Kt(e.plugins,{database:n,tenantId:void 0,kek:e.kek,rootErrorHandlers:e.errorHandlers,permissionsOptions:r,manualConfig:e.manual,hubConfig:i.hub});return Object.assign({},s,{keys:t,permissions:o,manage:a,[Ye]:i})}var U=class extends Error{code;constructor(n,t){super(t),this.name="OAuthCallbackError",this.code=n}};function Oo(e){let n=e.oauthConfig;if(!n)throw new U("plugin_has_no_oauth_config",`Plugin '${e.id}' has no oauthConfig`);return n}async function Ms(e,n,t,r){let i=ur(e),o=await i.integrations.findByName(n);if(!o)throw new Error(`Integration '${n}' not found. Run setupCorsair first.`);if(await i.accounts.findOne({tenant_id:t,integration_id:o.id}))return;let s=Q(),u=await X(s,r);await i.accounts.create({tenant_id:t,integration_id:o.id,config:{},dek:u})}async function Yn(e,n,t){let{tenantId:r,redirectUri:i,hubConnect:o=!1}=t,a=T(e,()=>new U("invalid_corsair_instance","Invalid corsair instance"));if(!a.database)throw new Error("No database configured on corsair instance");let s=N(a,n,p=>new U("plugin_not_found",p)),u=Oo(s),d=await I({authType:"oauth_2",integrationName:n,kek:a.kek,database:a.database}).get_client_id();if(!d)throw new Error(`client_id not configured for '${n}'`);if(o){let p=new URL(we({oauthConfig:u,clientId:d,redirectUri:i,state:""}));return p.searchParams.delete("state"),{url:p.toString(),state:""}}let c=He(de(n,r),a.kek);return{url:we({oauthConfig:u,clientId:d,redirectUri:i,state:c}),state:c}}async function ze(e,n){let{code:t,state:r,redirectUri:i}=n,o=T(e,()=>new U("invalid_corsair_instance","Invalid corsair instance")),a=_n(r,o.kek);if(!a)throw new U("invalid_state","Invalid or tampered state parameter");let{plugin:s,tenantId:u}=a;if(!o.database)throw new U("no_database","No database configured on corsair instance");let l=N(o,s,h=>new U("plugin_not_found",h)),d=Oo(l),c=I({authType:"oauth_2",integrationName:s,kek:o.kek,database:o.database}),p=await c.get_client_id(),g=await c.get_client_secret();if(!p||!g)throw new U("credentials_not_configured",`Credentials not configured for '${s}'`);await Ms(o.database,s,u,o.kek);let f=await Wn(t,p,g,d,i);if(!f.access_token)throw new U("no_access_token",`No access_token returned from ${d.providerName}`);let y=S({authType:"oauth_2",integrationName:s,tenantId:u,kek:o.kek,database:o.database});await y.set_access_token(f.access_token),f.refresh_token&&await y.set_refresh_token(f.refresh_token),f.expires_in&&await y.set_expires_at(String(Math.floor(Date.now()/1e3)+f.expires_in));try{let h=await bn(o.plugins,s,f);if(h)try{let m=l.authConfig?.oauth_2?.account??[];await De({database:o.database,kek:o.kek,pluginId:s,tenantId:u,link:h,authType:"oauth_2",extraAccountFields:m})}catch(m){console.warn(`[corsair:oauth] Failed to persist webhook tenant link for '${s}' tenant '${u}':`,m)}}catch(h){console.warn(`[corsair:oauth] Failed to resolve webhook tenant link for '${s}' tenant '${u}':`,h)}return{plugin:s,tenantId:u}}export{cr as a,se as b,$e as c,ye as d,nn as e,$ as f,tn as g,xe as h,rn as i,on as j,sn as k,an as l,dr as m,un as n,Q as o,X as p,L as q,Gn as r,We as s,ae as t,ee as u,je as v,I as w,S as x,wr as y,Pr as z,de as A,Mt as B,De as C,nt as D,Cn as E,Fr as F,we as G,U as H,Yn as I,ze as J,Ar as K,mi as L,_e as M,yn as N,Ee as O,Dr as P,Xn as Q,et as R,Or as S,Mr as T,ue as U,he as V,ce as W,Oe as X,wn as Y,rt as Z,Me as _,ot as $,it as aa,st as ba,at as ca,$r as da,ne as ea,Tn as fa,vn as ga,le as ha,ke as ia,be as ja,Ge as ka,Je as la,An as ma,dt as na,pt as oa,gt as pa,ft as qa,yt as ra,ht as sa,mt as ta,Ce as ua,te as va,kt as wa,qr as xa,Rn as ya,Sn as za,Gr as Aa,bt as Ba,Ct as Ca,wt as Da,Pt as Ea,Tt as Fa,vt as Ga,At as Ha,xt as Ia,Rt as Ja,St as Ka,It as La,_t as Ma,Et as Na,Dt as Oa,Ot as Pa,Zt as Qa,Pe as Ra,go as Sa,fo as Ta,yo as Ua,mo as Va,ws as Wa,Wn as Xa,td as Ya,Te as Za,rd as _a,jn as $a,Ss as ab,So as bb,Is as cb,_s as db,Io as eb,_o as fb,Qe as gb,Es as hb,Eo as ib,Do as jb,Ds as kb,Zn as lb,Os as mb,Ye as nb,Rr as ob};