export { C as CORSAIR_INTERNAL, a as CorsairInternalConfig, c as createCorsair } from './index-BpAiZmOk.js';
import { CorsairDatabase } from './db.js';
import { A as AccountKeyManagerFor, I as IntegrationKeyManagerFor, f as CorsairPluginSubscribeResult } from './index-bq7b_mHy.js';
export { g as AccountFieldNames, a6 as AgentReply, k as BASE_AUTH_FIELDS, B as BaseAuthFieldConfig, h as BaseKeyManager, M as BeforeHookResult, n as BindEndpoints, ae as BindWebhooks, ac as Bivariant, o as BoundEndpointFn, p as BoundEndpointTree, af as BoundWebhook, ag as BoundWebhookTree, m as CorsairClient, q as CorsairContext, r as CorsairEndpoint, t as CorsairErrorHandler, c as CorsairIntegration, N as CorsairKeyBuilder, Q as CorsairKeyBuilderBase, ah as CorsairOAuthWebhookTenantLinkResolver, z as CorsairPermissionsNamespace, C as CorsairPlugin, S as CorsairPluginContext, U as CorsairPluginSubscribe, e as CorsairSingleTenantClient, d as CorsairTenantWrapper, a7 as CorsairThreadsNamespace, ai as CorsairWebhook, aj as CorsairWebhookHandler, ak as CorsairWebhookMatcher, al as CorsairWebhookTenantMatcher, a8 as CreateThreadResult, V as EndpointHooks, X as EndpointMetaEntry, E as EndpointPathsOf, Y as EndpointRiskLevel, s as EndpointTree, D as EnforcePermissionOptions, F as EnforcePermissionResult, u as ErrorContext, v as ErrorHandler, w as ErrorHandlerAndMatchFunction, x as ErrorMatcher, i as IntegrationFieldNames, Z as KeyBuilderContext, j as OAuth2IntegrationCredentials, O as OAuthConfig, _ as PermissionMode, $ as PermissionPolicy, P as PluginAuthConfig, a0 as PluginEndpointMeta, a1 as PluginPermissionsConfig, am as RawWebhookRequest, K as ReadonlyForbiddenError, a2 as RequiredPluginEndpointMeta, a3 as RequiredPluginEndpointSchemas, a4 as RequiredPluginWebhookSchemas, R as RetryStrategies, y as RetryStrategy, a9 as ThreadHandle, aa as ThreadMessage, ab as ThreadSummary, T as TokenResponse, ad as UnionToIntersection, a5 as WebhookHooks, an as WebhookPathsOf, ao as WebhookRequest, ap as WebhookResponse, W as WebhookTenantMatch, aq as WebhookTree, G as assertReadonlyAllowed, l as exchangeCodeForTokens, J as isReadonlyScopeActive, L as runReadonly } from './index-bq7b_mHy.js';
export { A as AuthMissingError, D as DocSchemaFieldRow, a as DocSchemaShape, b as DocsApiEndpoint, c as DocsDbEntity, d as DocsDbFilterField, e as DocsWebhook, E as EndpointSchemaResult, I as IntrospectPluginForDocsResult, L as ListOperationsOptions, g as PermissionRequiredError, P as PluginDocsIntrospection, k as PluginWebhookMatchers, R as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, l as asRecord, h as collectPluginWebhookMatchers, n as decodePubSubData, o as extractMicrosoftGraphValidationToken, p as firstString, f as formatDocSchemaShape, q as getHeader, i as introspectPluginForDocs, s as isMicrosoftGraphValidationHandshake, m as matchWebhookPlugin, j as matchWebhookPluginAndTenant, t as readBodyRecord, u as readQueryParam, r as resolveConnectLink, v as toExternalId } from './tenant-match-utils-BEm23hGX.js';
import { A as AuthTypes } from './types-Bsv_KdHs.js';
export { g as AllProviders, B as BaseProviders, h as PickAuth, j as ProviderDisplayNames, i as formatProviderDisplayName } from './types-Bsv_KdHs.js';
import 'kysely';
import './index-eydqYIn0.js';
import 'zod';
import 'pg';
import 'postgres';
import './orm.js';

/**
 * Context interface with account ID resolver for logging events.
 */
interface EventLoggingContext {
    database?: CorsairDatabase | undefined;
    $getAccountId: () => Promise<string>;
}
/**
 * Logs an event to the corsair_events table.
 *
 * @param database - The database adapter
 * @param accountId - The account ID this event belongs to
 * @param eventType - The type of event (e.g., 'slack.message.created')
 * @param payload - The event payload data
 * @param status - The event status (defaults to 'pending')
 * @returns The event ID if successful, null if failed
 */
declare function logEvent(database: CorsairDatabase | undefined, accountId: string, eventType: string, payload: Record<string, unknown>, status?: 'pending' | 'processing' | 'completed' | 'failed'): Promise<string | null>;
/**
 * Logs an event from a plugin context, automatically resolving the account ID.
 * This is a convenience wrapper around `logEvent` for use in plugin endpoints.
 *
 * @param ctx - The plugin context with database and account ID resolver
 * @param eventType - The type of event (e.g., 'slack.message.created')
 * @param payload - The event payload data
 * @param status - The event status (defaults to 'pending')
 * @returns The event ID if successful, null if failed
 */
declare function logEventFromContext(ctx: EventLoggingContext, eventType: string, payload: Record<string, unknown>, status?: 'pending' | 'processing' | 'completed' | 'failed'): Promise<string | null>;

/**
 * Generates a new random Data Encryption Key (DEK).
 * The DEK is used to encrypt actual secrets (tokens, API keys, etc.)
 * @returns A base64-encoded random DEK
 */
declare function generateDEK(): string;
/**
 * Encrypts a DEK using the Key Encryption Key (KEK).
 * Uses AES-256-GCM with a derived key from the KEK.
 * Format: salt:iv:authTag:encryptedData (all base64)
 *
 * @param dek - The plaintext DEK to encrypt
 * @param kek - The Key Encryption Key (master key)
 * @returns The encrypted DEK string
 */
declare function encryptDEK(dek: string, kek: string): Promise<string>;
/**
 * Decrypts a DEK using the Key Encryption Key (KEK).
 *
 * @param encryptedDek - The encrypted DEK string (salt:iv:authTag:data format)
 * @param kek - The Key Encryption Key (master key)
 * @returns The decrypted plaintext DEK
 * @throws Error if decryption fails (wrong KEK or corrupted data)
 */
declare function decryptDEK(encryptedDek: string, kek: string): Promise<string>;
/**
 * Encrypts data using a DEK.
 * Format: iv:authTag:encryptedData (all base64)
 *
 * @param data - The plaintext data to encrypt
 * @param dek - The Data Encryption Key (base64-encoded)
 * @returns The encrypted data string
 */
declare function encryptWithDEK(data: string, dek: string): string;
/**
 * Decrypts data using a DEK.
 *
 * @param encryptedData - The encrypted data string (iv:authTag:data format)
 * @param dek - The Data Encryption Key (base64-encoded)
 * @returns The decrypted plaintext data
 * @throws Error if decryption fails
 */
declare function decryptWithDEK(encryptedData: string, dek: string): string;
/**
 * Encrypts a config object. Each value in the config is encrypted individually.
 *
 * @param config - The config object with string values to encrypt
 * @param dek - The Data Encryption Key
 * @returns A new object with encrypted values
 */
declare function encryptConfig(config: Record<string, string>, dek: string): Record<string, string>;
/**
 * Decrypts a config object. Each value in the config is decrypted individually.
 *
 * @param encryptedConfig - The config object with encrypted values
 * @param dek - The Data Encryption Key
 * @returns A new object with decrypted values
 */
declare function decryptConfig(encryptedConfig: Record<string, string>, dek: string): Record<string, string>;
/**
 * Re-encrypts a config from an old DEK to a new DEK.
 * Used during DEK rotation.
 *
 * @param encryptedConfig - The config encrypted with the old DEK
 * @param oldDek - The old Data Encryption Key
 * @param newDek - The new Data Encryption Key
 * @returns A new object with values re-encrypted using the new DEK
 */
declare function reEncryptConfig(encryptedConfig: Record<string, string>, oldDek: string, newDek: string): Record<string, string>;

type IntegrationKeyManagerOptions<T extends AuthTypes> = {
    authType: T;
    integrationName: string;
    kek: string;
    database: CorsairDatabase;
    /** Extra integration-level fields from plugin authConfig */
    extraIntegrationFields?: readonly string[];
};
/**
 * Creates an integration-level key manager for the given auth type.
 * The returned manager has auto-generated getters/setters for all fields
 * (base fields for the auth type + any extra fields from plugin authConfig).
 */
declare function createIntegrationKeyManager<T extends AuthTypes>(options: IntegrationKeyManagerOptions<T>): IntegrationKeyManagerFor<T>;
type AccountKeyManagerOptions<T extends AuthTypes> = {
    authType: T;
    integrationName: string;
    tenantId: string;
    kek: string;
    database: CorsairDatabase;
    /** Extra account-level fields from plugin authConfig */
    extraAccountFields?: readonly string[];
    ensureProvisioned?: () => Promise<void>;
};
/**
 * Creates an account-level key manager for the given auth type.
 * The returned manager has auto-generated getters/setters for all fields
 * (base fields for the auth type + any extra fields from plugin authConfig).
 * OAuth2 account managers also include `get_integration_credentials`.
 */
declare function createAccountKeyManager<T extends AuthTypes>(options: AccountKeyManagerOptions<T>): AccountKeyManagerFor<T>;
/**
 * Initializes an integration with a new DEK.
 * Call this when creating a new integration or when setting up encryption for the first time.
 */
declare function initializeIntegrationDEK(database: CorsairDatabase, integrationName: string, kek: string): Promise<string>;
/**
 * Initializes an account with a new DEK.
 * Call this when creating a new account or when setting up encryption for the first time.
 */
declare function initializeAccountDEK(database: CorsairDatabase, integrationName: string, tenantId: string, kek: string): Promise<string>;

/** Minimal shape we need from the account key manager (ctx.keys). */
type SubscribeCtx$1 = {
    keys: {
        get_access_token: () => Promise<string | null | undefined>;
    };
};
/**
 * Shared BYO subscribe for Google channel-watch providers (Calendar, Drive):
 * only the watch endpoint (and any extra body fields) differ. Opens a
 * notification channel pointed at the Hub URL and returns the routing link
 * (our generated channel id, echoed back in X-Goog-Channel-ID) + the channel
 * token Hub verifies via X-Goog-Channel-Token. No app-side verify, so nothing
 * is persisted locally.
 * No stale-channel cleanup: Google exposes no channel list API, so prior
 * channels can't be enumerated — they lapse at their TTL (expect brief
 * invalid-token noise after reconnects). Default TTLs are accepted;
 * oauth/renewal.ts re-arms before expiry.
 */
declare function googleChannelSubscribe(ctx: SubscribeCtx$1, input: {
    webhookUrl: string;
    watchUrl: string;
    body?: Record<string, unknown>;
}): Promise<CorsairPluginSubscribeResult | null>;

declare const MS_GRAPH_API_BASE = "https://graph.microsoft.com/v1.0";
/** Minimal shape we need from the account key manager (ctx.keys). */
type SubscribeCtx = {
    keys: {
        get_access_token: () => Promise<string | null | undefined>;
        set_webhook_signature: (value: string) => Promise<void>;
    };
};
/**
 * Shared BYO subscribe for every MS Graph plugin: only `resource` and
 * `changeType` differ per provider. Arms the Graph subscription and returns
 * the routing link (subscription_id) + verification secret (clientState) for
 * Hub to store. Token is freshly exchanged at connect time, so no refresh
 * dance here.
 */
declare function msGraphSubscribe(ctx: SubscribeCtx, input: {
    webhookUrl: string;
    resource: string;
    changeType: string;
}): Promise<CorsairPluginSubscribeResult | null>;

export { AccountKeyManagerFor, AuthTypes, CorsairPluginSubscribeResult, type EventLoggingContext, IntegrationKeyManagerFor, MS_GRAPH_API_BASE, createAccountKeyManager, createIntegrationKeyManager, decryptConfig, decryptDEK, decryptWithDEK, encryptConfig, encryptDEK, encryptWithDEK, generateDEK, googleChannelSubscribe, initializeAccountDEK, initializeIntegrationDEK, logEvent, logEventFromContext, msGraphSubscribe, reEncryptConfig };