import { C as CorsairClientOptions, a as CorsairManagementClient } from './types-MvrzaDrs.js';
export { b as CorsairClientError } from './types-MvrzaDrs.js';
export { c as createCorsair } from './index-BpAiZmOk.js';
import { e as CorsairSingleTenantClient, C as CorsairPlugin, d as CorsairTenantWrapper, m as CorsairClient, z as CorsairPermissionsNamespace, ag as BoundWebhookTree, am as RawWebhookRequest, al as CorsairWebhookTenantMatcher, ap as WebhookResponse } from './index-bq7b_mHy.js';
export { ar as CorsairManageNamespace, b as CorsairManualConfig, a as CorsairPermissionsOptions, K as ReadonlyForbiddenError, L as runReadonly } from './index-bq7b_mHy.js';
import { F as FormFieldSchema, L as ListOperationsOptions } from './tenant-match-utils-BEm23hGX.js';
export { A as AuthMissingError, g as PermissionRequiredError, k as PluginWebhookMatchers, R as ResolveConnectLinkResult, W as WebhookPluginTenantMatch, l as asRecord, h as collectPluginWebhookMatchers, n as decodePubSubData, p as firstString, f as formatDocSchemaShape, q as getHeader, m as matchWebhookPlugin, j as matchWebhookPluginAndTenant, t as readBodyRecord, r as resolveConnectLink, v as toExternalId } from './tenant-match-utils-BEm23hGX.js';
export { SetupCorsairOptions, setupCorsair } from './setup.js';
export { O as OAuthCallbackTunnelPayload, P as ProcessCorsairOptions, f as ProcessCorsairRequest, k as ResolveAccountFromWebhookLinkInput, T as TunnelAck, i as TunnelEnvelope, j as TunnelType, l as WebhookTenantLink, W as WebhookTunnelPayload, p as processCorsair, r as resolveAccountFromWebhookLink, g as resolveTenantFromWebhookLink, h as resolveTenantIdFromWebhookLink, s as setWebhookTenantLink } from './index-DnJqGDij.js';
import { B as BaseProviders } from './types-Bsv_KdHs.js';
export { c as ConnectLink, a as ConnectionStatus, d as CreateConnectLinkInput, C as CreateTenantInput, M as ManagementOk, e as OAuthCallbackInput, O as OAuthCallbackResult, f as PermissionLookupInput, b as PermissionRecord, k as PluginConnectionState, P as PluginInfo, R as ResolvedConnectLink, T as Tenant } from './types-Bsv_KdHs.js';
import './db.js';
import 'kysely';
import './index-eydqYIn0.js';
import 'zod';
import 'pg';
import 'postgres';
import './orm.js';

type ManagementHandlerOptions = {
    /** Path prefix the handler is mounted at, e.g. '/api/corsair'. Stripped before dispatch. */
    basePath?: string;
    /** Override the default error response. Return undefined to fall through. */
    onError?: (err: unknown, req: Request) => Response | Promise<Response> | undefined;
};
declare function managementHandler(corsair: unknown, opts?: ManagementHandlerOptions): (req: Request) => Promise<Response>;

type ExpressLikeRequest = {
    method: string;
    originalUrl: string;
    url: string;
    headers: Record<string, string | string[] | undefined>;
    body?: unknown;
    protocol?: string;
    get?: (name: string) => string | undefined;
};
type ExpressLikeResponse = {
    status: (code: number) => ExpressLikeResponse;
    setHeader: (name: string, value: string) => void;
    send: (body: string | Buffer) => void;
};
type ExpressLikeNext = (err?: unknown) => void;
type ExpressHandler = (req: ExpressLikeRequest, res: ExpressLikeResponse, next: ExpressLikeNext) => Promise<void>;
declare function toExpressHandler(corsair: unknown, opts?: ManagementHandlerOptions): ExpressHandler;

type HonoLikeContext = {
    req: {
        raw: Request;
    };
};
type HonoHandler = (c: HonoLikeContext) => Response | Promise<Response>;
declare function toHonoHandler(corsair: unknown, opts?: ManagementHandlerOptions): HonoHandler;

declare function toNextJsHandler(corsair: unknown, opts?: ManagementHandlerOptions): {
    GET: (req: Request) => Promise<Response>;
    POST: (req: Request) => Promise<Response>;
    OPTIONS: (req: Request) => Promise<Response>;
};

declare function createCorsairClient(opts: CorsairClientOptions): CorsairManagementClient;

type InspectCorsairPlugin = {
    id: CorsairPlugin['id'];
};
/**
 * Any form of Corsair instance:
 * - single-tenant client (`createCorsair({ ... })`)
 * - multi-tenant wrapper (`createCorsair({ multiTenancy: true, ... })`)
 * - tenant-scoped client (`corsair.withTenant("tenant-id")`)
 */
type AnyCorsairInstance = CorsairSingleTenantClient<readonly InspectCorsairPlugin[]> | CorsairTenantWrapper<readonly InspectCorsairPlugin[]> | CorsairClient<readonly InspectCorsairPlugin[]>;
/**
 * Lists available operations (API endpoints, webhooks, or database entities) for the configured plugins.
 * Returns a newline-separated string with one operation path per line.
 *
 * Accepts single-tenant instances, multi-tenant wrappers, and tenant-scoped clients.
 *
 * @example
 * listOperations(corsair)
 * // "slack.api.channels.list\nslack.api.messages.post\n..."
 *
 * listOperations(corsair, { plugin: 'slack' })
 * // "slack.api.channels.list\nslack.api.messages.post\n..."
 *
 * listOperations(corsair, { plugin: 'slack', type: 'webhooks' })
 * // "slack.webhooks.messages.message\nslack.webhooks.channels.created\n..."
 */
declare function listOperations(corsair: AnyCorsairInstance, options?: ListOperationsOptions): string;
/**
 * Returns a plain-text TypeScript-style type declaration for a specific operation path.
 *
 * Accepts single-tenant instances, multi-tenant wrappers, and tenant-scoped clients.
 * Casing is ignored — the path is lowercased before lookup.
 * If the path is not found, returns a list of available paths for self-correction.
 *
 * @example
 * getSchema(corsair, 'slack.api.messages.post')
 * // "Post a message to a channel  [write]\n\ninput {\n  channel: string\n  text?: string\n  ..."
 *
 * getSchema(corsair, 'slack.api.invalid')
 * // "Path not found. Available operations:\n  slack: slack.api.channels.list, ..."
 */
declare function getSchema(corsair: AnyCorsairInstance, path: string): string;
/**
 * Returns a machine-readable, JSON-serializable form schema for a given operation path.
 * Unlike {@link getSchema} (which returns a TypeScript-style string), this returns
 * structured field definitions suitable for driving dynamic form UIs.
 *
 * Returns `null` if the path does not resolve to a known endpoint.
 */
declare function getStructuredSchema(corsair: AnyCorsairInstance, path: string): {
    input: FormFieldSchema | null;
    output: FormFieldSchema | null;
    description?: string;
} | null;

/**
 * The corsair instance type for permission execution.
 * Must expose the `permissions` namespace and optionally a `withTenant` method.
 * The withTenant return type is intentionally broad — we only need to index into it
 * by plugin name, and we cast the result to PluginWithApi at the call site.
 */
type CorsairInstance$1 = {
    permissions: CorsairPermissionsNamespace;
    withTenant?: (tenantId: string) => Record<string, unknown>;
    [key: string]: unknown;
};
type PermissionExecuteResult = {
    plugin?: string;
    endpoint?: string;
    result?: unknown;
    error?: string;
};
/**
 * Deterministically executes a pending permission request by directly calling
 * the bound endpoint with the frozen args stored in the approval record.
 *
 * This is the approval-side counterpart to processWebhook. Instead of resuming
 * the LLM to re-derive the action, this function looks up the pending permission
 * record, navigates corsair[plugin].api[...endpoint path] to find the bound
 * function, and calls it with the exact args that were stored — no LLM
 * involvement required.
 *
 * Lifecycle:
 * 1. Fetches the permission record via corsair.permissions.find_by_permission_id
 * 2. Validates the record is approved (human has signed off) and not expired
 * 3. Resolves the tenant-scoped corsair instance (via withTenant if multi-tenant)
 * 4. Sets status to 'executing' via corsair.permissions.set_executing
 * 5. Navigates corsair[plugin].api[...endpoint path] to find the bound function
 * 6. Calls the function with the stored args (JSON-parsed)
 * 7. Sets status to 'completed' via corsair.permissions.set_completed
 * 8. Returns the result, or an error object if the endpoint gracefully exits
 *
 * @param corsair - The corsair instance (returned from createCorsair)
 * @param token - The token embedded in the review URL for the corsair_permissions record
 */
declare function executePermission(corsair: CorsairInstance$1, token: string): Promise<PermissionExecuteResult>;

interface WebhookHeaders {
    [key: string]: string | string[] | undefined;
}
interface WebhookBody {
    [key: string]: unknown;
}
type WebhookFilterResult = {
    /** The plugin that matched the webhook (e.g. 'slack', 'linear'), or null if no match */
    plugin: (typeof BaseProviders)[number] | null;
    /** The path to the matched webhook handler (e.g. 'channels.created'), or null if no match */
    action: string | null;
    /** The parsed request body */
    body: unknown;
    /** The response from the webhook handler, if one was executed */
    response?: WebhookResponse<unknown>;
    /** HTTP response headers to set on the outgoing HTTP response (e.g. for Asana X-Hook-Secret handshake) */
    responseHeaders?: Record<string, string>;
};
/**
 * A plugin namespace on the corsair instance that may have webhooks.
 */
type PluginWithWebhooks = {
    webhooks?: BoundWebhookTree;
    /** Plugin-level matcher to quickly check if a webhook is for this plugin */
    pluginWebhookMatcher?: (request: RawWebhookRequest) => boolean;
    /** Extracts the external tenant lookup key for this plugin's webhook */
    pluginTenantWebhookMatcher?: CorsairWebhookTenantMatcher;
};
/**
 * The corsair instance type - a record of plugin namespaces.
 */
type CorsairInstance = Record<string, PluginWithWebhooks | undefined> & {
    withTenant?: (tenantId: string) => CorsairInstance;
};
/**
 * Filters an incoming webhook request through all plugins in a corsair instance.
 *
 * Goes through each enabled plugin to find a matching webhook handler.
 * If a match is found, the handler is executed and the result is returned.
 *
 * @param corsair - The corsair instance (returned from createCorsair)
 * @param headers - The HTTP headers from the webhook request
 * @param body - The request body (string or parsed object)
 * @param query - The query parameters from the webhook request (optional)
 * @returns The filter result with plugin, action, body, and optional response
 *
 * @example
 * ```ts
 * const corsair = createCorsair({
 *   plugins: [slack({ ... }), linear({ ... })],
 * });
 *
 * // In your webhook endpoint handler:
 * const result = await processWebhook(corsair, req.headers, req.body, req.query);
 *
 * if (result.plugin) {
 *   console.log(`Handled by ${result.plugin}.${result.action}`);
 * }
 * ```
 */
declare function processWebhook(corsair: CorsairInstance, headers: WebhookHeaders, body: WebhookBody | string, query?: {
    tenantId?: string;
    [x: string]: string | string[] | undefined;
}, options?: {
    /**
     * Authoritative plugin id for hub-verified deliveries (Hub routed the
     * event by its per-plugin endpoint, so the id is trusted). Bypasses
     * shape-matching, which cannot distinguish MS Graph siblings — their
     * notification bodies are identical and some pluginWebhookMatchers are
     * wildcards.
     */
    plugin?: string;
}): Promise<WebhookFilterResult>;

export { type AnyCorsairInstance, CorsairClientOptions, CorsairManagementClient, type ExpressHandler, FormFieldSchema, type HonoHandler, ListOperationsOptions, type ManagementHandlerOptions, type PermissionExecuteResult, createCorsairClient, executePermission, getSchema, getStructuredSchema, listOperations, managementHandler, processWebhook, toExpressHandler, toHonoHandler, toNextJsHandler };