import { A as AuthTypes } from './types-Bsv_KdHs.js';
export { i as formatProviderDisplayName } from './types-Bsv_KdHs.js';
import { as as HubOAuthMode, at as HubConnectSessionResult, au as HubPermissionSessionResult, H as HubConfig, av as HubConfigInput, aw as HubConnectSessionInput, ax as HubListProjectConnectionsInput, A as AccountKeyManagerFor, ay as HubPermissionSessionInput } from './index-bq7b_mHy.js';
export { az as DEFAULT_HUB_API_URL, aA as HubEnvironmentSlug } from './index-bq7b_mHy.js';
import { j as TunnelType, R as RunResultPayload, f as ProcessCorsairRequest, l as WebhookTenantLink } from './index-DnJqGDij.js';
export { m as BROWSER_DELIVERY_TTL_MS, n as BrowserDeliveryMode, B as BrowserDeliveryPayload, S as SIGNED_TUNNEL_REPLAY_WINDOW_MS, i as TunnelEnvelope } from './index-DnJqGDij.js';
export { b as buildBrowserDeliveryRedirectUrl, s as signBrowserDeliveryToken, v as verifyBrowserDeliveryToken } from './browser-delivery-B7lsTRG3.js';
import './index-eydqYIn0.js';
import 'zod';
import './db.js';
import 'kysely';
import 'pg';
import 'postgres';
import './orm.js';

type HubEnvironmentSlug = 'development' | 'production';
type DeliveryTransport = 'browser' | 'server';
declare function isLoopbackUrl(url: string): boolean;
declare function resolveDeliveryTransport(slug: HubEnvironmentSlug): DeliveryTransport;
declare function usesBrowserDelivery(slug: HubEnvironmentSlug): boolean;
declare function validateProductionDeliveryUrl(deliveryUrl: string): string | null;

type ClientBridgeDeliverySpec = {
    deliveryMode: 'connections.sync';
    deliveryUrl: string;
    projectId: string;
    signingSecret: string;
    hubOrigin: string;
    requestId: string;
} | {
    deliveryMode: 'connect.create_link';
    deliveryUrl: string;
    projectId: string;
    signingSecret: string;
    hubOrigin: string;
    requestId: string;
    tenantId: string;
    plugins: string[];
};
type ClientBridgeTransportResult = {
    transport: 'server';
} | {
    transport: 'browser';
    deliveryUrl: string;
    requestId: string;
};
declare function buildClientBridgeBrowserDeliveryUrl(spec: ClientBridgeDeliverySpec): string;
type PrepareClientBridgeDeliveryTransportInput = {
    deliveryMode: 'connections.sync';
    deliveryUrl: string;
    projectId: string;
    signingSecret: string;
    hubOrigin?: string;
    environmentSlug: HubEnvironmentSlug;
} | {
    deliveryMode: 'connect.create_link';
    deliveryUrl: string;
    projectId: string;
    signingSecret: string;
    hubOrigin?: string;
    environmentSlug: HubEnvironmentSlug;
    tenantId: string;
    plugins: string[];
};
declare function prepareClientBridgeDeliveryTransport(spec: PrepareClientBridgeDeliveryTransportInput): ClientBridgeTransportResult;

type ConnectAuthKind = 'oauth' | 'api_key' | 'bot_token';
type ConnectPluginManifestEntry = {
    plugin: string;
    providerName: string;
    authKind: ConnectAuthKind;
    credentialFields?: string[];
    alreadyConfigured?: boolean;
    oauthMode?: HubOAuthMode;
    oauthUrl?: string;
    setupError?: string;
};
type HubProjectConnection = {
    tenantId: string;
    plugin: string;
    authType: AuthTypes;
    status: ConnectAuthStatusLevel;
    connected: boolean;
    verified: boolean;
    missingFields: string[];
    reportedAt: string;
};
type ConnectAuthFieldStatus = {
    name: string;
    level: 'integration' | 'account';
    required: boolean;
    configured: boolean;
};
type ConnectAuthStatusLevel = 'ready' | 'partial' | 'not_started' | 'missing_integration';
type ConnectStatusPluginEntry = {
    plugin: string;
    providerName: string;
    authKind: ConnectAuthKind;
    status: ConnectAuthStatusLevel;
    connected: boolean;
    fields: ConnectAuthFieldStatus[];
    missingRequiredFields: string[];
};
type ConnectStatusResponse = {
    tenantId: string;
    plugins: ConnectStatusPluginEntry[];
};
type CreateConnectSessionRequestBody = {
    tenantId: string;
    /** Required for development environment; ignored for production. */
    deliveryUrl?: string;
    plugins: ConnectPluginManifestEntry[];
};
type CreatePermissionSessionRequestBody = {
    permissionId: string;
    permissionToken: string;
    plugin: string;
    endpoint: string;
    args: unknown;
    tenantId: string;
    /** Required for development environment; ignored for production. */
    deliveryUrl?: string;
    expiresAt: string;
};
type HubOAuthRefreshResponse = {
    access_token: string;
    refresh_token?: string;
    expires_in?: number;
    scope?: string;
};
declare function parseConnectSessionResponse(payload: unknown): HubConnectSessionResult;
declare function parseProjectConnectionsResponse(payload: unknown): HubProjectConnection[];
declare function parsePermissionSessionResponse(payload: unknown): HubPermissionSessionResult;
declare function parseOAuthRefreshResponse(payload: unknown): HubOAuthRefreshResponse;
declare function parseConnectStatusResponse(payload: unknown): ConnectStatusResponse;
declare function parseHubApiErrorBody(payload: unknown): string | null;

declare class HubNotConfiguredError extends Error {
    constructor();
}
declare function normalizeHubConfig(input: HubConfigInput): HubConfig;
declare function getHubConfig(corsair: unknown): HubConfig;
declare function resolveHubOAuthCallbackUrl(config: HubConfig): string;
declare function inferHubEnvironmentSlug(apiKey: string): 'development' | 'production';

/**
 * Creates a hosted Hub connect session from a corsair instance.
 *
 * Reads plugins, database, and kek from the instance, builds the connect
 * manifest (one plugin when `input.plugin` is set, otherwise all configured
 * plugins), provisions account rows, then calls {@link postHubConnectSession}.
 *
 * Used by `manage.connect.createLink` and other management APIs that already
 * hold the corsair instance.
 */
declare function createHubConnectSession(corsair: unknown, input: HubConnectSessionInput): Promise<HubConnectSessionResult>;

type ConnectCreateLinkDeliveryResult = {
    connectUrl: string;
    expiresAt?: string;
};

declare function getConnectStatusForTenant(corsair: unknown, tenantId: string, options?: {
    pluginIds?: string[];
}): Promise<ConnectStatusResponse>;

declare function listHubProjectConnections(corsair: unknown, input: HubListProjectConnectionsInput): Promise<HubProjectConnection[]>;

/**
 * Server (production) delivery — hub POSTs a signed JSON envelope to the app's public delivery URL.
 *
 * Used when the app has a reachable `deliveryUrl` (non-loopback). The hub signs the body with
 * HMAC-SHA256 and sends standard `x-corsair-*` headers. The app verifies via
 * {@link verifySignedTunnelDelivery} before handling the payload.
 */

/**
 * HTTP headers attached to every server-side delivery POST from the hub.
 */
type SignedDeliveryHeaders = {
    /** HMAC-SHA256 signature of the raw request body, prefixed with `sha256=`. */
    'x-corsair-signature': string;
    /** Unix timestamp (seconds) when the envelope was signed; used for replay protection. */
    'x-corsair-timestamp': string;
    /** Corsair project id (`proj_*`) the delivery belongs to. */
    'x-corsair-project': string;
    /** Unique nonce for this delivery attempt (one envelope per request). */
    'x-corsair-nonce': string;
    /** Always `application/json`. */
    'content-type': string;
};
/**
 * Result of {@link deliverSignedEnvelope} after the hub POSTs to the app's delivery URL.
 */
type SignedEnvelopeDeliveryResult = {
    /** Whether the HTTP response was in the 2xx range. */
    ok: boolean;
    /** HTTP status code, or `0` if the request failed to reach the server (network error). */
    status: number;
    /** Raw response body text from the app. */
    body: string;
};
/**
 * Parsed JSON body the app returns to acknowledge a server delivery.
 *
 * Success is indicated by HTTP 204, `{ "status": "ok" }`, or `{ "ok": true }`.
 */
type ServerDeliveryAckBody = {
    /** Alternative success flag used by some delivery handlers. */
    ok?: boolean;
    /** Primary success indicator: `"ok"` means the payload was applied. */
    status?: string;
    /** Human-readable error when delivery was rejected by the app. */
    error?: string;
    /** Hosted connect URL returned by connect.create_link deliveries. */
    connectUrl?: string;
    /** ISO expiry for connect.create_link deliveries. */
    expiresAt?: string;
    /** Encrypted tenant/plugin manifest returned by connections.sync deliveries. */
    sync?: {
        encrypted: string;
    };
    /** Workflow execution outcome returned by `run` deliveries. */
    run?: RunResultPayload;
};
/**
 * Reads the workflow run outcome from a parsed delivery ack body.
 */
declare function extractRunFromDeliveryAck(body: ServerDeliveryAckBody): RunResultPayload | null;
/**
 * Signs a tunnel envelope for server POST delivery.
 *
 * @param input.projectId - Project that owns this delivery.
 * @param input.signingSecret - Per-project signing secret.
 * @param input.type - Envelope discriminator (e.g. `oauth.callback`, `permission.approve`).
 * @param input.payload - Type-specific payload object serialized into the envelope body.
 */
declare function signDeliveryEnvelope(input: {
    projectId: string;
    signingSecret: string;
    type: TunnelType;
    payload: unknown;
}): {
    body: string;
    headers: SignedDeliveryHeaders;
};
/**
 * Verifies the HMAC signature and timestamp window of an incoming server delivery request.
 *
 * Returns a boolean for low-level checks. Prefer {@link verifySignedTunnelDelivery} in
 * application code for structured error messages.
 */
declare function verifyDeliveryEnvelope(input: {
    body: string;
    signatureHeader: string | null | undefined;
    timestampHeader: string | null | undefined;
    signingSecret: string;
}): boolean;
/**
 * Verifies an incoming server delivery POST from the app side (`processCorsair` / tunnel handler).
 *
 * Checks signing secret presence, HMAC validity, and timestamp replay window. Returns structured
 * errors suitable for HTTP 401/400 responses.
 */
declare function verifySignedTunnelDelivery(input: {
    body: string;
    signatureHeader: string | undefined;
    timestampHeader: string | undefined;
    signingSecret: string;
}): {
    ok: true;
} | {
    ok: false;
    error: string;
};
/**
 * Parses the app's JSON acknowledgment body after a server delivery POST.
 */
declare function parseServerDeliveryAckBody(body: string): ServerDeliveryAckBody;
/**
 * Determines whether the app accepted a server delivery based on HTTP status and body.
 */
declare function isServerDeliveryAckSuccessful(input: {
    httpOk: boolean;
    status: number;
    body: ServerDeliveryAckBody;
}): boolean;
/**
 * Reads the encrypted connections.sync payload from a parsed delivery ack body.
 */
declare function extractSyncFromDeliveryAck(body: ServerDeliveryAckBody): {
    encrypted: string;
} | null;
declare function extractConnectLinkFromDeliveryAck(body: ServerDeliveryAckBody): ConnectCreateLinkDeliveryResult | null;
/**
 * Parses connect link payload from a raw delivery HTTP body.
 */
declare function parseConnectLinkFromDeliveryBody(body: string): ConnectCreateLinkDeliveryResult | null;
/**
 * POSTs a connect.create_link envelope to the app's delivery URL.
 */
declare function deliverConnectCreateLink(input: {
    deliveryUrl: string;
    projectId: string;
    signingSecret: string;
    tenantId: string;
    plugins: string[];
}): Promise<ConnectCreateLinkDeliveryResult>;
/**
 * Parses sync payload from a raw delivery HTTP body using the standard ack contract.
 */
declare function parseSyncFromDeliveryBody(body: string): {
    encrypted: string;
} | null;
/**
 * Formats a fetch/network failure into a user-facing delivery reachability error.
 */
declare function describeDeliveryNetworkError(deliveryUrl: string, error: unknown): string;
/**
 * Input to {@link formatServerDeliveryError}.
 */
type FormatServerDeliveryErrorInput = {
    deliveryUrl: string;
    status: number;
    body: string;
    ack: ServerDeliveryAckBody;
};
/**
 * Formats a user-facing error when server delivery fails (network, HTTP error, or app rejection).
 */
declare function formatServerDeliveryError(input: FormatServerDeliveryErrorInput): string;
/**
 * Signs and POSTs a tunnel envelope to the app's delivery URL (hub-side server delivery).
 *
 * Used by the hub for production credential transfer, OAuth callbacks, permission decisions,
 * and connect status introspection.
 */
declare function deliverSignedEnvelope(input: {
    deliveryUrl: string;
    projectId: string;
    signingSecret: string;
    type: TunnelType;
    payload: unknown;
}): Promise<SignedEnvelopeDeliveryResult>;

type HubDeliveryResult = {
    type: 'redirect';
    url: string;
} | {
    type: 'json';
    body: unknown;
    status: number;
    headers?: Record<string, string>;
} | {
    type: 'text';
    body: string | null;
    status: number;
    headers?: Record<string, string>;
};
type HubDeliveryRequest = {
    method: 'GET' | 'POST';
    url: string;
    headers: ProcessCorsairRequest['headers'];
    body?: string;
};
declare function handleHubDeliveryGet(corsair: unknown, requestUrl: string): Promise<HubDeliveryResult>;
declare function handleHubDeliveryPost(corsair: unknown, request: ProcessCorsairRequest): Promise<HubDeliveryResult>;
declare function hubDeliveryToResponse(result: HubDeliveryResult): Response;
declare function handleHubDeliveryRequest(corsair: unknown, request: HubDeliveryRequest): Promise<HubDeliveryResult>;
declare function respondToHubDelivery(corsair: unknown, request: HubDeliveryRequest): Promise<Response>;
declare function respondToHubDeliveryFromRequest(corsair: unknown, request: Request): Promise<Response>;

type ManagedAuthContext = {
    keys: AccountKeyManagerFor<'managed'>;
    hub: HubConfig;
    plugin: string;
    tenantId: string;
};
type ManagedAccessTokenResult = {
    accessToken: string;
    expiresAt: number;
    refreshed: boolean;
};
declare function getManagedAccessToken(ctx: ManagedAuthContext, options?: {
    forceRefresh?: boolean;
}): Promise<ManagedAccessTokenResult>;
declare function attachManagedRefreshAuth(ctx: Record<string, unknown>, managedContext: ManagedAuthContext): Promise<void>;

type ManagedOAuthDeliveryErrorCode = 'invalid_corsair_instance' | 'no_database' | 'plugin_not_found' | 'no_access_token';
declare class ManagedOAuthDeliveryError extends Error {
    readonly code: ManagedOAuthDeliveryErrorCode;
    constructor(code: ManagedOAuthDeliveryErrorCode, message: string);
}
type ProcessManagedOAuthDeliveryOptions = {
    plugin: string;
    tenantId: string;
    accessToken: string;
    refreshToken?: string;
    expiresIn?: number;
    scope?: string;
};
type ProcessManagedOAuthDeliveryResult = {
    plugin: string;
    tenantId: string;
};
declare function processManagedOAuthDelivery(corsair: unknown, options: ProcessManagedOAuthDeliveryOptions): Promise<ProcessManagedOAuthDeliveryResult>;

declare function createHubPermissionSession(hub: HubConfig, input: HubPermissionSessionInput): Promise<HubPermissionSessionResult>;
declare function formatHubApprovalMessage(approvalUrl: string): string;

/**
 * Forwards a resolved webhook tenant link to Hub (fire-and-forget). Called after
 * OAuth completes (email-style links) and after a watch/subscription is created
 * (channel_id / subscription_id). No-op unless Hub is configured.
 */
declare function registerHubWebhookTenantLink(hub: HubConfig, input: {
    plugin: string;
    tenantId: string;
    link: WebhookTenantLink;
    authType?: AuthTypes;
}): Promise<void>;

/**
 * One knob: `CORSAIR_DELIVERY_URL` (full endpoint, wins over everything).
 * Without it, auto-detects `http://localhost:{PORT}/api/corsair` — PORT is
 * set by the runtime, not something users configure for Corsair.
 */
declare function resolveHubDeliveryUrl(input?: {
    deliveryUrl?: string;
}): string;

declare function createHubRouteHandlers(corsair: unknown): {
    delivery: (request: Request) => Promise<Response>;
    deliveryOptions: (request: Request) => Promise<Response>;
};

/**
 * Connect session URL tokens — the token in `/connect/[token]` for the hosted sign-in page.
 *
 * One session can cover multiple plugins. The SDK creates a session via REST; the hub returns
 * a connect URL containing this signed token. The UI loads session state by verifying it.
 */
/**
 * Decoded payload inside a connect session URL token.
 */
type ConnectSessionTokenPayload = {
    /** Unique session id; matches `setup_sessions.jti` in the hub DB. */
    jti: string;
    /** Corsair project id (`proj_*`). */
    projectId: string;
    /** Corsair environment id (`env_*`). */
    environmentId: string;
    /** Tenant being set up. */
    tenantId: string;
    /** App delivery endpoint used for credential transfer for this session. */
    deliveryUrl: string;
    /** Unix expiry (seconds). */
    exp: number;
    /** Unix issued-at (seconds). */
    iat: number;
};
/** Creates a new jti for a connect session row. */
declare function createConnectSessionJti(): string;
/** Default TTL for connect session URL tokens (20 minutes). */
declare function getConnectSessionExpiryMs(): number;
/**
 * Signs the token embedded in the connect page URL (`/connect/[token]`).
 */
declare function signConnectSessionToken(payload: Omit<ConnectSessionTokenPayload, 'exp' | 'iat'>, signingSecret: string): string;
/**
 * Verifies a connect session URL token when the connect UI or API loads session state.
 */
declare function verifyConnectSessionToken(token: string, signingSecret: string): ConnectSessionTokenPayload | null;
/** Decodes a connect session token from a URL path segment. */
declare function decodeConnectSessionTokenFromPath(encoded: string): string;

/**
 * Per-plugin OAuth state tokens stored in the hub DB during the connect sign-in flow.
 *
 * When a user starts OAuth for one plugin, the SDK registers a connect token keyed by
 * `oauthState`. The hub OAuth callback looks up this token to know which plugin, tenant,
 * and delivery URL to complete. Distinct from {@link ConnectSessionTokenPayload} which
 * covers the multi-plugin connect page URL.
 */

/**
 * Decoded payload inside a per-plugin OAuth connect token.
 */
type ConnectTokenPayload = {
    /** Unique id for this OAuth attempt; matches `connect_tokens.jti` in the hub DB. */
    jti: string;
    /** Corsair project id (`proj_*`). */
    projectId: string;
    /** Plugin being connected (e.g. `github`, `slack`). */
    plugin: string;
    /** Tenant within the app receiving credentials. */
    tenantId: string;
    /** Display name shown on the connect UI. */
    providerName: string;
    /** Authorization URL the user was sent to (BYO OAuth). */
    oauthUrl: string;
    /** OAuth state parameter echoed back by the provider; used to look up this token. */
    state: string;
    /** OAuth redirect URI registered for this flow (hub callback URL). */
    redirectUri: string;
    /** App delivery endpoint for credential transfer after OAuth completes. */
    deliveryUrl: string;
    /** BYO (app holds OAuth app) vs managed (hub holds OAuth app). */
    oauthMode: HubOAuthMode;
    /** Unix expiry (seconds). */
    exp: number;
    /** Unix issued-at (seconds). */
    iat: number;
};
/** Creates a new jti for a connect OAuth token row. */
declare function createConnectTokenJti(): string;
/** Default TTL for connect OAuth tokens (10 minutes). */
declare function getConnectTokenExpiryMs(): number;
/**
 * Signs a connect OAuth token embedded in the DB and used during the OAuth callback.
 */
declare function signConnectToken(payload: Omit<ConnectTokenPayload, 'exp' | 'iat'>, signingSecret: string): string;
/**
 * Verifies a connect OAuth token (e.g. to read `oauthMode` during callback).
 */
declare function verifyConnectToken(token: string, signingSecret: string): ConnectTokenPayload | null;
/** Encodes a connect token for use in a URL path. */
declare function encodeConnectTokenForPath(token: string): string;
/** Decodes a connect token from a URL path segment. */
declare function decodeConnectTokenFromPath(encoded: string): string;

/**
 * Permission approval session tokens — the token in `/approve/[token]` for the permissions page.
 *
 * When an agent needs human approval for a sensitive operation, the SDK creates a permission
 * session. The hub returns an approval URL with this signed token. Expiry is caller-controlled
 * (SDK provides `expiresAt`) rather than a fixed TTL.
 */
/**
 * Decoded payload inside a permission approval URL token.
 */
type PermissionTokenPayload = {
    /** Unique session id; matches `permission_sessions.jti` in the hub DB. */
    jti: string;
    /** Corsair project id (`proj_*`). */
    projectId: string;
    /** Plugin whose operation requires approval. */
    plugin: string;
    /** Corsair operation path being approved (e.g. `api.messages.post`). */
    endpoint: string;
    /** Tenant the operation targets. */
    tenantId: string;
    /** App delivery endpoint where the approve/deny decision is sent. */
    deliveryUrl: string;
    /** Unix expiry (seconds); set from SDK `expiresAt`. */
    exp: number;
    /** Unix issued-at (seconds). */
    iat: number;
};
/** Creates a new jti for a permission session row. */
declare function createPermissionSessionJti(): string;
/**
 * Signs the token embedded in the permission approval page URL (`/approve/[token]`).
 *
 * @param expiresAt - SDK-provided deadline for the approval request.
 */
declare function signPermissionToken(payload: Omit<PermissionTokenPayload, 'exp' | 'iat'>, signingSecret: string, expiresAt: Date): string;
/**
 * Verifies a permission approval URL token when the approve UI loads session state.
 */
declare function verifyPermissionToken(token: string, signingSecret: string): PermissionTokenPayload | null;
/** Decodes a permission token from a URL path segment. */
declare function decodePermissionTokenFromPath(encoded: string): string;

/**
 * Low-level HMAC signing primitives shared by all hub token types.
 *
 * Hub uses a consistent wire format: `base64url(JSON payload).base64url(HMAC-SHA256 signature)`.
 * Session URL tokens (connect, permission) and browser delivery tokens all build on these helpers.
 */
/**
 * Creates a unique token id (jti) for one-time or idempotent delivery tracking.
 */
declare function createSignedTokenJti(): string;

export { type ClientBridgeDeliverySpec, type ClientBridgeTransportResult, type ConnectAuthFieldStatus, type ConnectAuthKind, type ConnectAuthStatusLevel, type ConnectCreateLinkDeliveryResult, type ConnectPluginManifestEntry, type ConnectSessionTokenPayload, type ConnectStatusPluginEntry, type ConnectStatusResponse, type ConnectTokenPayload, type CreateConnectSessionRequestBody, type CreatePermissionSessionRequestBody, type FormatServerDeliveryErrorInput, HubConfig, HubConfigInput, HubConnectSessionInput, HubConnectSessionResult, type HubDeliveryRequest, type HubDeliveryResult, HubListProjectConnectionsInput, HubNotConfiguredError, HubOAuthMode, type HubOAuthRefreshResponse, HubPermissionSessionInput, HubPermissionSessionResult, type HubProjectConnection, type ManagedAccessTokenResult, type ManagedAuthContext, ManagedOAuthDeliveryError, type PermissionTokenPayload, type PrepareClientBridgeDeliveryTransportInput, type ProcessManagedOAuthDeliveryOptions, type ProcessManagedOAuthDeliveryResult, type ServerDeliveryAckBody, type SignedDeliveryHeaders, type SignedEnvelopeDeliveryResult, TunnelType, attachManagedRefreshAuth, buildClientBridgeBrowserDeliveryUrl, createConnectSessionJti, createConnectTokenJti, createHubConnectSession, createHubPermissionSession, createHubRouteHandlers, createPermissionSessionJti, createSignedTokenJti, decodeConnectSessionTokenFromPath, decodeConnectTokenFromPath, decodePermissionTokenFromPath, deliverConnectCreateLink, deliverSignedEnvelope, describeDeliveryNetworkError, encodeConnectTokenForPath, extractConnectLinkFromDeliveryAck, extractRunFromDeliveryAck, extractSyncFromDeliveryAck, formatHubApprovalMessage, formatServerDeliveryError, getConnectSessionExpiryMs, getConnectStatusForTenant, getConnectTokenExpiryMs, getHubConfig, getManagedAccessToken, handleHubDeliveryGet, handleHubDeliveryPost, handleHubDeliveryRequest, hubDeliveryToResponse, inferHubEnvironmentSlug, isLoopbackUrl, isServerDeliveryAckSuccessful, listHubProjectConnections, normalizeHubConfig, parseConnectLinkFromDeliveryBody, parseConnectSessionResponse, parseConnectStatusResponse, parseHubApiErrorBody, parseOAuthRefreshResponse, parsePermissionSessionResponse, parseProjectConnectionsResponse, parseServerDeliveryAckBody, parseSyncFromDeliveryBody, prepareClientBridgeDeliveryTransport, processManagedOAuthDelivery, registerHubWebhookTenantLink, resolveDeliveryTransport, resolveHubDeliveryUrl, resolveHubOAuthCallbackUrl, respondToHubDelivery, respondToHubDeliveryFromRequest, signConnectSessionToken, signConnectToken, signDeliveryEnvelope, signPermissionToken, usesBrowserDelivery, validateProductionDeliveryUrl, verifyConnectSessionToken, verifyConnectToken, verifyDeliveryEnvelope, verifyPermissionToken, verifySignedTunnelDelivery };