decocms 2.348.2 → 2.349.0

package/dist/server/node_modules/protobufjs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "protobufjs",
-  "version": "7.5.5",
+  "version": "8.0.0",
   "versionScheme": "~",
   "description": "Protocol Buffers for JavaScript (& TypeScript).",
   "author": "Daniel Wirtz <dcode+protobufjs@dcode.io>",

package/dist/server/node_modules/protobufjs/src/message.js

@@ -13,12 +13,8 @@ var util = require("./util/minimal");
 function Message(properties) {
     // not used internally
     if (properties)
-        for (var keys = Object.keys(properties), i = 0; i < keys.length; ++i) {
-            var key = keys[i];
-            if (key === "__proto__")
-                continue;
-            this[key] = properties[key];
-        }
+        for (var keys = Object.keys(properties), i = 0; i < keys.length; ++i)
+            this[keys[i]] = properties[keys[i]];
 }
 
 /**
@@ -140,4 +136,4 @@ Message.prototype.toJSON = function toJSON() {
     return this.$type.toObject(this, util.toJSONOptions);
 };
 
-/*eslint-enable valid-jsdoc*/
+/*eslint-enable valid-jsdoc*/

package/dist/server/node_modules/protobufjs/src/object.js

@@ -10,9 +10,10 @@ var Root; // cyclic
 
 /* eslint-disable no-warning-comments */
 // TODO: Replace with embedded proto.
-var editions2023Defaults = {enum_type: "OPEN", field_presence: "EXPLICIT", json_format: "ALLOW", message_encoding: "LENGTH_PREFIXED", repeated_field_encoding: "PACKED", utf8_validation: "VERIFY"};
-var proto2Defaults = {enum_type: "CLOSED", field_presence: "EXPLICIT", json_format: "LEGACY_BEST_EFFORT", message_encoding: "LENGTH_PREFIXED", repeated_field_encoding: "EXPANDED", utf8_validation: "NONE"};
-var proto3Defaults = {enum_type: "OPEN", field_presence: "IMPLICIT", json_format: "ALLOW", message_encoding: "LENGTH_PREFIXED", repeated_field_encoding: "PACKED", utf8_validation: "VERIFY"};
+var editions2024Defaults = {enum_type: "OPEN", field_presence: "EXPLICIT", json_format: "ALLOW", message_encoding: "LENGTH_PREFIXED", repeated_field_encoding: "PACKED", utf8_validation: "VERIFY", enforce_naming_style: "STYLE2024", default_symbol_visibility: "EXPORT_TOP_LEVEL" };
+var editions2023Defaults = {enum_type: "OPEN", field_presence: "EXPLICIT", json_format: "ALLOW", message_encoding: "LENGTH_PREFIXED", repeated_field_encoding: "PACKED", utf8_validation: "VERIFY", enforce_naming_style: "STYLE_LEGACY", default_symbol_visibility: "EXPORT_ALL" };
+var proto2Defaults = {enum_type: "CLOSED", field_presence: "EXPLICIT", json_format: "LEGACY_BEST_EFFORT", message_encoding: "LENGTH_PREFIXED", repeated_field_encoding: "EXPANDED", utf8_validation: "NONE", enforce_naming_style: "STYLE_LEGACY", default_symbol_visibility: "EXPORT_ALL" };
+var proto3Defaults = {enum_type: "OPEN", field_presence: "IMPLICIT", json_format: "ALLOW", message_encoding: "LENGTH_PREFIXED", repeated_field_encoding: "PACKED", utf8_validation: "VERIFY", enforce_naming_style: "STYLE_LEGACY", default_symbol_visibility: "EXPORT_ALL" };
 
 /**
  * Constructs a new reflection object instance.
@@ -225,6 +226,8 @@ ReflectionObject.prototype._resolveFeatures = function _resolveFeatures(edition)
             defaults = Object.assign({}, proto3Defaults);
         } else if (edition === "2023") {
             defaults = Object.assign({}, editions2023Defaults);
+        } else if (edition === "2024") {
+            defaults = Object.assign({}, editions2024Defaults);
         } else {
             throw new Error("Unknown edition: " + edition);
         }

package/dist/server/node_modules/protobufjs/src/parse.js

@@ -261,6 +261,16 @@ function parse(source, root, options) {
         var token = peek();
         var whichImports;
         switch (token) {
+            case "option":
+                if (edition < "2024") {
+                    throw illegal("option");
+                }
+                // Import options are only used for resolving options, which we don't
+                // do.  We can just throw them out.
+                next();
+                readString();
+                skip(";");
+                return;
             case "weak":
                 whichImports = weakImports || (weakImports = []);
                 next();
@@ -291,7 +301,7 @@ function parse(source, root, options) {
     function parseEdition() {
         skip("=");
         edition = readString();
-        const supportedEditions = ["2023"];
+        const supportedEditions = ["2023", "2024"];
 
         /* istanbul ignore if */
         if (!supportedEditions.includes(edition))
@@ -317,6 +327,22 @@ function parse(source, root, options) {
                 parseEnum(parent, token);
                 return true;
 
+            case "export":
+            case "local":
+                if (edition < "2024") {
+                    return false;
+                }
+                token = next();
+                if (token === "export" || token === "local") {
+                    return false;
+                }
+                if (token !== "message" && token !== "enum") {
+                    return false;
+                }
+                /* eslint-disable no-warning-comments */
+                // TODO: actually enforce visiblity modifiers like protoc does.
+                return parseCommon(parent, token);
+
             case "service":
                 parseService(parent, token);
                 return true;
@@ -527,6 +553,24 @@ function parse(source, root, options) {
                     readRanges(type.reserved || (type.reserved = []), true);
                     break;
 
+                case "export":
+                case "local":
+                    if (edition < "2024") {
+                        throw illegal(token);
+                    }
+                    token = next();
+                    switch (token) {
+                        case "message":
+                            parseType(type, token);
+                            break;
+                        case "enum":
+                            parseType(type, token);
+                            break;
+                        default:
+                            throw illegal(token);
+                    }
+                    break;
+
                 /* istanbul ignore next */
                 default:
                     throw illegal(token); // there are no groups with proto3 semantics

package/dist/server/node_modules/protobufjs/src/type.js

@@ -29,7 +29,6 @@ var Enum      = require("./enum"),
  * @param {Object.<string,*>} [options] Declared options
  */
 function Type(name, options) {
-    name = name.replace(/\W/g, "");
     Namespace.call(this, name, options);
 
     /**

package/dist/server/server.js

@@ -2885,7 +2885,7 @@ Caused by: ${X.stack}`}};$h=class $h extends uY{constructor($,X){super($,X);this
           AND "organizationId" NOT IN (
             SELECT "organizationId" FROM "member" WHERE "userId" = ${H.id}
           )
-      `.execute(F),await m1`DELETE FROM "member" WHERE "userId" = ${X.id}`.execute(F),await m1`DELETE FROM "user" WHERE "id" = ${X.id}`.execute(F)})}catch(F){console.error("[SSO] Failed to merge duplicate user:",F)}}var BR8=($)=>{return{trustEmailVerified:!0,provisionUser:wR8,defaultSSO:[{domain:$.domain,providerId:$.providerId,oidcConfig:{issuer:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/v2.0`,pkce:!0,clientId:$.MS_CLIENT_ID,clientSecret:$.MS_CLIENT_SECRET,discoveryEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/v2.0/.well-known/openid-configuration`,authorizationEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/oauth2/v2.0/authorize`,tokenEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/oauth2/v2.0/token`,jwksEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/discovery/v2.0/keys`,userInfoEndpoint:"https://graph.microsoft.com/oidc/userinfo",tokenEndpointAuthentication:"client_secret_post",scopes:$.scopes,mapping:{id:"sub",email:"email",emailVerified:"email_verified",name:"name",image:"picture",extraFields:{emailVerified:"email_verified",oid:"oid"}}}}]}},NR8=($)=>{return{trustEmailVerified:!0,defaultSSO:[{domain:$.domain,providerId:$.providerId,oidcConfig:{issuer:"https://accounts.google.com",pkce:!0,clientId:$.GOOGLE_CLIENT_ID,clientSecret:$.GOOGLE_CLIENT_SECRET,discoveryEndpoint:"https://accounts.google.com/.well-known/openid-configuration",authorizationEndpoint:"https://accounts.google.com/o/oauth2/v2/auth",tokenEndpoint:"https://oauth2.googleapis.com/token",jwksEndpoint:"https://www.googleapis.com/oauth2/v3/certs",userInfoEndpoint:"https://openidconnect.googleapis.com/v1/userinfo",tokenEndpointAuthentication:"client_secret_post",scopes:$.scopes,mapping:{id:"sub",email:"email",emailVerified:"email_verified",name:"name",image:"picture",extraFields:{emailVerified:"email_verified",hd:"hd"}}}}]}},X36=($)=>{if($.providerId==="microsoft")return BR8($);if($.providerId==="google")return NR8($);throw Error(`Unsupported provider: ${$.providerId}`)};var Y36=z(()=>{m5();CX();BD()});var K36={};R6(K36,{resetPasswordEnabled:()=>py1,authConfig:()=>p8,auth:()=>n5,GENERIC_EMAIL_DOMAINS:()=>$z});function DR8($){return $.toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}function zR8(){let $=Math.floor(Math.random()*Q36.length),X=Math.floor(Math.random()*G36.length),Y=Q36[$]??"deco",G=G36[X]??"studio";return`${Y}-${G}`}function VR8(){let $=[WY1];try{let X=new URL(WY1);if(X.hostname==="localhost")$.push(WY1.replace("localhost","127.0.0.1"));else if(X.hostname==="127.0.0.1")$.push(WY1.replace("127.0.0.1","localhost"))}catch{}return $}var G36,Q36,OR8,LR8,iy1,jR8,ER8,PR8,J36,p8,W36=void 0,Zq0=void 0,py1=!1,qR8,$z,AR8,TR8,WY1,Z36,n5;var Xz=z(()=>{T5();l80();Yq4();cA4();eQ0();bZ0();UZ0();cD1();RV4();xZ0();$X();UD();mI4();BD();tI4();iz1();sI4();eW6();$36();j91();Y36();G36=["labs","agent","studio","workspace","systems","core","cloud","works"],Q36=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"];OR8=Object.values(G11()).map(($)=>$.map((X)=>X.name)).flat(),LR8={...vd,self:["*",...OR8]},iy1=jB(LR8),jR8=iy1.newRole({self:["*"],...Cd.statements}),ER8=iy1.newRole({self:["*"],...Cd.statements}),PR8=iy1.newRole({self:["*"],...Cd.statements}),J36=Object.values(G11()).map(($)=>$.map((X)=>`self:${X.name}`)).flat(),p8=T2().auth;if(p8.inviteEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=k2(p8.emailProviders,p8.inviteEmailProviderId);if($){let X=S2($);W36=async(Y)=>{let G=Y.inviter.user?.name||Y.inviter.user?.email,Q=`${cZ()}/auth/accept-invitation?invitationId=${Y.invitation.id}&redirectTo=/${Y.organization.slug}`;await X({to:Y.email,subject:`You've been invited to join ${Y.organization.name}`,html:v2({preheader:`${G} has invited you to join ${Y.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${G}</strong> has invited you to join <strong>${Y.organization.name}</strong> on deco Studio.`,body:D61("Accept invitation",Q),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(p8.resetPasswordEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=k2(p8.emailProviders,p8.resetPasswordEmailProviderId);if($){let X=S2($);py1=!0,Zq0=async({user:Y,url:G})=>{await X({to:Y.email,subject:"Reset your password",html:v2({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:D61("Reset password",G)+pz1("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}qR8=[dJ0({organizationCreation:{afterCreate:async($)=>{await sW6($.organization.id,$.member.userId)}},ac:iy1,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:tp,resourceNameValidation:($)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test($)}}},roles:{user:jR8,admin:ER8,owner:PR8},sendInvitationEmail:W36}),AZ0({loginPage:"/login",oidcConfig:{scopes:J36,metadata:{scopes_supported:J36},loginPage:"/login"}}),XZ0({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:($)=>{if($.headers?.get("X-MCP-Session-Auth")==="true")return null;let Y=$.headers?.get("Authorization");if(Y?.startsWith("Bearer "))return Y.replace("Bearer ","").trim();return null},permissions:{defaultPermissions:{self:["ORGANIZATION_LIST","ORGANIZATION_GET","ORGANIZATION_MEMBER_LIST","COLLECTION_CONNECTIONS_LIST","COLLECTION_CONNECTIONS_GET","API_KEY_CREATE","API_KEY_LIST"]}},rateLimit:{enabled:!1}}),iD1({defaultRole:"user",adminRoles:["admin","owner"],roles:{...D2,owner:mD1}}),IZ0(),wZ0({jwt:{expirationTime:"5m"}}),Xq4(p8.ssoConfig?X36(p8.ssoConfig):void 0),...p8.magicLinkConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[zZ0(oI4(p8.magicLinkConfig,p8.emailProviders))]:[],...p8.emailOtpConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[FZ0(aI4(p8.emailOtpConfig,p8.emailProviders))]:[]],$z=new Set(["gmail.com","googlemail.com","outlook.com","hotmail.com","live.com","yahoo.com","yahoo.co.uk","icloud.com","me.com","mac.com","aol.com","protonmail.com","proton.me","zoho.com","yandex.com","mail.com","gmx.com","gmx.net","tutanota.com","fastmail.com"]),AR8=w61(),TR8=pI4(AR8),WY1=cZ();Z36=f4(),n5=sQ0({secret:Z36.betterAuthSecret||"deco-default-secret-k7x9m2p4q8w3n5v6",baseURL:WY1,trustedOrigins:VR8(),database:TR8,socialProviders:p8.socialProviders,...p8.ssoConfig&&{account:{accountLinking:{trustedProviders:[p8.ssoConfig.providerId]}}},emailAndPassword:{enabled:p8.emailAndPassword.enabled,...Zq0&&{sendResetPassword:Zq0}},rateLimit:{enabled:!Z36.disableRateLimit,window:60,max:1e4},plugins:qR8,databaseHooks:{user:{create:{after:async($)=>{if(Jq0({id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified}),j6.capture({distinctId:$.id,event:"user_signed_up",properties:{email:$.email,email_domain:$.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!$.emailVerified,has_name:!!$.name}}),$.emailVerified){let G=$.email?.split("@")[1]?.toLowerCase();if(G&&!$z.has(G))return}if(T2().autoCreateOrganizationOnSignup===!1)return;let X=$.name?$.name.split(" ")[0]:$.email.split("@")[0],Y=3;for(let G=0;G<Y;G++){let Q=`${X} ${zR8()}`,J=DR8(Q);try{let W=(await n5.api.createOrganization({body:{name:Q,slug:J,userId:$.id}}))?.id??void 0;if(W)j6.groupIdentify({groupType:"organization",groupKey:W,properties:{name:Q,slug:J,created_at:new Date().toISOString(),created_via:"signup_default"}}),j6.capture({distinctId:$.id,event:"organization_created",groups:{organization:W},properties:{organization_id:W,organization_slug:J,created_via:"signup_default"}});return}catch(Z){if(!(Z instanceof Error&&("body"in Z)&&Z.body?.code==="ORGANIZATION_ALREADY_EXISTS")||G===Y-1){console.error("Failed to create default organization:",Z);return}}}}}},session:{create:{after:async($)=>{let X=await fX().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",$.userId).executeTakeFirst();if(!X)return;Jq0({id:X.id,email:X.email,name:X.name??null,emailVerified:!!X.emailVerified})}}}}})});function Wq0($,X){return`${$}:${X}`}function H36($){let X=$?.ttlMs??120000,Y=$?.maxSize??1e4,G=new Map;function Q(){if(G.size<=Y)return;let J=Date.now();for(let[Z,W]of G)if(W.expiresAt<=J)G.delete(Z);if(G.size>Y){let Z=G.size-Y,W=0;for(let H of G.keys()){if(W>=Z)break;G.delete(H),W++}}}return{get(J,Z){let W=Wq0(J,Z),H=G.get(W);if(!H)return;if(H.expiresAt<=Date.now()){G.delete(W);return}return H.role},set(J,Z,W){let H=Wq0(J,Z);G.set(H,{role:W,expiresAt:Date.now()+X,organizationId:Z}),Q()},invalidate(J,Z){G.delete(Wq0(J,Z))},invalidateOrg(J){for(let[Z,W]of G)if(W.organizationId===J)G.delete(Z)}}}var F36=()=>{};var Kq0=()=>{};var U36=()=>{};var MR8,PRY;var B36=z(()=>{F36();Kq0();dO();U36();MR8={br:".br",zstd:".zst",gzip:".gz"},PRY=Object.keys(MR8)});var N36=z(()=>{B36()});var w36=()=>{};var D36=z(()=>{w36()});var z36=()=>{};var O36=z(()=>{S80()});var Hq0=z(()=>{iO();O36()});var Fq0="x-hono-disable-ssg",uRY;var Uq0=z(()=>{Hq0();uRY=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[Fq0]:"true"}})}catch{return null}})()});var L36=z(()=>{WU1()});var Bq0=z(()=>{L36()});var j36=z(()=>{D36();z36();Kq0();Uq0();Bq0();Hq0()});var E36=z(()=>{Uq0();Bq0();j36()});var qSY;var P36=z(()=>{E36();({write:qSY}=Bun)});var SR8=class{#$;constructor($){this.#$=$,this.raw=$.raw,this.url=$.url?new URL($.url):null,this.protocol=$.protocol??null}send($,X){this.#$.send($,X??{})}raw;binaryType="arraybuffer";get readyState(){return this.#$.readyState}url;protocol;close($,X){this.#$.close($,X)}},q36=($)=>{return(...X)=>{if(typeof X[0]==="function"){let[Y,G]=X;return async function(J,Z){let W=await Y(J),H=await $(J,W,G);if(H)return H;await Z()}}else{let[Y,G,Q]=X;return(async()=>{let J=await $(Y,G,Q);if(!J)throw Error("Failed to upgrade WebSocket");return J})()}}};var A36=()=>{};var KY1=($)=>("server"in $.env)?$.env.server:$.env;var ny1=()=>{};var kR8;var T36=z(()=>{A36();ny1();kR8=q36(($,X)=>{let Y=KY1($);if(!Y)throw TypeError("env has to include the 2nd argument of fetch.");if(Y.upgrade($.req.raw,{data:{events:X,url:new URL($.req.url),protocol:$.req.url}}))return new Response(null);return})});var Nq0=($)=>{let X=KY1($);if(!X)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof X.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let Y=X.requestIP($.req.raw);if(!Y)return{remote:{}};return{remote:{address:Y.address,addressType:Y.family==="IPv6"||Y.family==="IPv4"?Y.family:void 0,port:Y.port}}};var V36=z(()=>{ny1()});var M36=z(()=>{N36();P36();T36();V36();ny1()});var I36;var R36=z(()=>{I36={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});var ay1={};R6(ay1,{waitForSeed:()=>xR8,seedLocalMode:()=>bR8,markSeedComplete:()=>yR8,isLocalMode:()=>Gh,getLocalAdminUser:()=>wq0,getLocalAdminPassword:()=>ry1});import{userInfo as vR8}from"os";async function ry1(){return f4().betterAuthSecret||"local-mode-default"}function S36(){try{return vR8().username||"local"}catch{return"local"}}function CR8($){return $.charAt(0).toUpperCase()+$.slice(1)}async function _R8(){let $=fX(),X=await $.db.selectFrom("user").select($.db.fn.countAll().as("count")).executeTakeFirst();return Number(X?.count??0)===0}async function bR8(){if(!await _R8())return!1;let X=S36(),Y=`${X}@localhost.mesh`,G=CR8(X),Q=await ry1(),J=await n5.api.signUpEmail({body:{email:Y,password:Q,name:G}});if(!J?.user?.id)throw Error("Failed to create local admin user");let Z=J.user.id,W=fX();await W.db.updateTable("user").set({role:"admin"}).where("id","=",Z).execute();let H=`${X}-local`.toLowerCase().replace(/[^a-z0-9-]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,""),F=`${G} Local`;return await W.db.updateTable("organization").set({name:F,slug:H}).where("id","in",(U)=>U.selectFrom("member").select("organizationId").where("userId","=",Z)).execute(),!0}async function wq0(){let $=fX(),X=`${S36()}@localhost.mesh`;return $.db.selectFrom("user").where("email","=",X).selectAll().executeTakeFirst()}function Gh(){return f4().localMode}function yR8(){k36()}function xR8(){return fR8}var k36,fR8;var wr=z(()=>{BD();T5();Xz();fR8=new Promise(($)=>{if(k36=$,!Gh())$()})});function v36(){let $=Object.keys(p8.socialProviders??{}),X=$.length>0,Y=$.map((Q)=>({name:Q,icon:I36[Q].icon})),G=f4().localMode;return{emailAndPassword:{enabled:p8.emailAndPassword?.enabled??!1},magicLink:{enabled:p8.magicLinkConfig?.enabled??!1},emailOtp:{enabled:p8.emailOtpConfig?.enabled??!1},resetPassword:{enabled:py1},socialProviders:{enabled:X,providers:Y},sso:p8.ssoConfig?{enabled:!0,providerId:p8.ssoConfig.providerId}:{enabled:!1},stdioEnabled:G,localMode:Gh()}}var Dr,C36;var Dq0=z(()=>{HX();M36();$X();T5();Xz();BD();Cz0();sB0();R36();wr();Dr=new Z6;Dr.post("/local-session",async($)=>{if(!Gh())return $.json({success:!1,error:"Local mode is not active"},403);let X;try{X=Nq0($).remote.address}catch{}if(!(X==="127.0.0.1"||X==="::1"||X==="::ffff:127.0.0.1"))return $.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:G}=await Promise.resolve().then(() => (wr(),ay1));await G();let{auth:Q}=await Promise.resolve().then(() => (Xz(),K36)),J=await wq0();if(!J)return $.json({success:!1,error:"Local admin user not found"},500);let Z=await ry1();return await Q.api.signInEmail({body:{email:J.email,password:Z},asResponse:!0})}catch(G){return console.error("Failed to create local session:",G),$.json({success:!1,error:G instanceof Error?G.message:"Failed to create local session"},500)}});Dr.get("/domain-lookup",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({found:!1,organizations:[]});let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({found:!1,organizations:[]});try{let Q=await new XE(fX().db).getAllByDomain(Y);if(Q.length===0)return $.json({found:!1,organizations:[]});let J=await fX().db.selectFrom("organization").select(["id","name","slug","logo"]).where("id","in",Q.map((H)=>H.organizationId)).execute(),Z=new Map(J.map((H)=>[H.id,H])),W=Q.map((H)=>{let F=Z.get(H.organizationId);if(!F)return null;return{id:F.id,name:F.name,slug:F.slug,logo:F.logo,autoJoinEnabled:H.autoJoinEnabled}}).filter((H)=>H!==null);return $.json({found:W.length>0,organizations:W})}catch(G){return console.error("[Auth] Domain lookup failed:",G),$.json({success:!1,error:"Domain lookup failed"},500)}});Dr.post("/domain-join",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({success:!1,error:"Email must be verified to join"},403);let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({success:!1,error:"Generic email domains cannot auto-join"},403);let G=await $.req.json().catch(()=>({})),Q=typeof G.organizationSlug==="string"&&G.organizationSlug.trim()?G.organizationSlug.trim():null;try{let J=fX().db,H=(await new XE(J).getAllByDomain(Y)).filter((U)=>U.autoJoinEnabled);if(H.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let F;if(Q){let U=await J.selectFrom("organization").select(["id","slug"]).where("slug","=",Q).executeTakeFirst();if(!U||!H.some((B)=>B.organizationId===U.id))return $.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);F=U}else if(H.length===1){let U=await J.selectFrom("organization").select(["id","slug"]).where("id","=",H[0].organizationId).executeTakeFirst();if(!U)return $.json({success:!1,error:"Organization not found"},404);F=U}else return $.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await n5.api.addMember({body:{userId:X.user.id,role:"user",organizationId:F.id}})}catch(U){if(!(U instanceof Error?U.message.toLowerCase():"").includes("already a member"))return console.error("[Auth] Domain join addMember failed:",U),$.json({success:!1,error:"Failed to join organization"},500)}return j6.capture({distinctId:X.user.id,event:"organization_domain_joined",groups:{organization:F.id},properties:{organization_id:F.id,organization_slug:F.slug,email_domain:Y}}),$.json({success:!0,slug:F.slug})}catch(J){return j6.captureException(J,X.user.id),console.error("[Auth] Domain join failed:",J),$.json({success:!1,error:"Failed to join organization"},500)}});Dr.post("/domain-setup",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({success:!1,error:"Email must be verified"},403);let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({success:!1,error:"Corporate email required"},403);let G=await $.req.json().catch(()=>({})),Q=typeof G.name==="string"&&G.name.trim().length>0?G.name.trim():null,J=typeof G.logo==="string"&&G.logo.length>0?G.logo:null,Z=G.claimDomain!==!1;try{let W=fX().db,H=new XE(W),F=await H.getAllByDomain(Y);if(F.length>0){let T=await W.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",X.user.id).where("member.organizationId","in",F.map((I)=>I.organizationId)).executeTakeFirst();if(T)return $.json({success:!0,slug:T.slug,alreadyExists:!0})}let U=Y.split(".")[0]??Y,B=Q??U.charAt(0).toUpperCase()+U.slice(1),N=(Q??U).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||U.toLowerCase().replace(/[^a-z0-9-]/g,""),w=null;for(let I=0;I<3;I++){let M=I===0?"":`-${Math.random().toString(36).slice(2,6)}`,R=I===0?B:`${B}${M}`,S=`${N}${M}`;try{w=await n5.api.createOrganization({body:{name:R,slug:S,userId:X.user.id}});break}catch(C){if(!(C instanceof Error&&("body"in C)&&C.body?.code==="ORGANIZATION_ALREADY_EXISTS")||I===2)throw C}}if(!w?.id)throw Error("Failed to create organization");let D=w.id;if(Z)await H.setDomain(D,Y,!0);let O=!1,j=null,E=null;try{let T=f4().firecrawlApiKey;if(T){let I=await Yq1(Y,T,B);if(I){let M=new z91(fX().db),R=await M.create(D,I);if(await M.setDefault(R.id,D),O=!0,I.name&&I.name!==B)j=I.name;E=I.favicon??I.logo??null}}}catch(T){console.error("[Auth] Brand extraction failed (non-fatal):",T)}let P={};if(!Q&&j)P.name=j;if(J)P.logo=J;else if(E)P.logo=E;if(Object.keys(P).length>0)try{await n5.api.updateOrganization({headers:$.req.raw.headers,body:{organizationId:D,data:P}})}catch(T){console.error("[Auth] Org update failed (non-fatal):",T)}return j6.identify({distinctId:X.user.id,properties:{email:X.user.email,$set:{email:X.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),j6.groupIdentify({groupType:"organization",groupKey:D,properties:{name:w.slug??N,slug:w.slug??N,email_domain:Y,brand_extracted:O,created_at:new Date().toISOString()}}),j6.capture({distinctId:X.user.id,event:"organization_created",groups:{organization:D},properties:{organization_id:D,organization_slug:w.slug??N,email_domain:Y,brand_extracted:O}}),$.json({success:!0,slug:w.slug??N,brandExtracted:O})}catch(W){return j6.captureException(W,X.user?.id),console.error("[Auth] Domain setup failed:",W),$.json({success:!1,error:"Failed to set up organization"},500)}});Dr.get("/org-access-status/:slug",async($)=>{let X=$.req.param("slug"),Y=await n5.api.getSession({headers:$.req.raw.headers});if(!Y?.user)return $.json({success:!1,error:"Authentication required"},401);let G=fX().db,Q=await G.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",X).executeTakeFirst();if(!Q)return $.json({status:"not-found"});let J={id:Q.id,name:Q.name,slug:Q.slug,logo:Q.logo};if(await G.selectFrom("member").select(["id"]).where("userId","=",Y.user.id).where("organizationId","=",Q.id).executeTakeFirst())return $.json({status:"member",organization:J});try{let W=await n5.api.listUserInvitations({headers:$.req.raw.headers}),H=Date.now(),F=W.find((U)=>U.organizationId===Q.id&&U.status==="pending"&&new Date(U.expiresAt).getTime()>H);if(F)return $.json({status:"pending-invite",invitation:{id:F.id},organization:J})}catch(W){console.error("[Auth] listUserInvitations failed:",W)}if(Y.user.emailVerified){let W=Y.user.email?.split("@")[1]?.toLowerCase();if(W&&!$z.has(W)){let H=await new XE(G).getByOrganizationId(Q.id);if(H?.autoJoinEnabled&&H.domain===W)return $.json({status:"auto-domain-join",organization:{...J,domain:W}})}}return $.json({status:"no-access",organization:J})});C36=Dr});function gR8($){$.get("/status",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!await Oq0(Y,Y.auth.user.id,G))return X.json({error:"Not a member of this organization"},403);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J||!J.enforced)return X.json({ssoRequired:!1});let Z=await Y.storage.orgSsoSessions.isValid(Y.auth.user.id,G);return X.json({ssoRequired:!0,authenticated:Z,issuer:J.issuer,domain:J.domain})}),$.get("/authorize",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!await Oq0(Y,Y.auth.user.id,G))return X.json({error:"Not a member of this organization"},403);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J)return X.json({error:"SSO not configured for this organization"},404);let Z=await zq0(J.issuer,J.discoveryEndpoint),W=hR8(),H=await uR8(W),F=crypto.randomUUID(),U=JSON.stringify({state:F,codeVerifier:W,orgId:G,userId:Y.auth.user.id});x80(X,"org_sso_state",U,{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:600});let B=new URLSearchParams({response_type:"code",client_id:J.clientId,redirect_uri:`${Y.baseUrl}/api/org-sso/callback`,scope:J.scopes.join(" "),state:F,code_challenge:H,code_challenge_method:"S256"}),N=`${Z.authorization_endpoint}?${B.toString()}`;return X.redirect(N)}),$.get("/callback",async(X)=>{let Y=X.get("meshContext"),G=X.req.query("code"),Q=X.req.query("state"),J=X.req.query("error");if(J)return X.redirect(`/?sso_error=${encodeURIComponent(J)}`);if(!G||!Q)return X.redirect("/?sso_error=missing_code_or_state");let Z=DU1(X,"org_sso_state");if(!Z)return X.redirect("/?sso_error=state_expired");x80(X,"org_sso_state","",{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:0});let W;try{W=JSON.parse(Z)}catch{return X.redirect("/?sso_error=invalid_state")}if(W.state!==Q)return X.redirect("/?sso_error=state_mismatch");if(!Y.auth.user||Y.auth.user.id!==W.userId)return X.redirect("/?sso_error=session_expired");let H=await Y.storage.orgSsoConfig.getByOrgId(W.orgId);if(!H)return X.redirect("/?sso_error=sso_not_configured");let F=await zq0(H.issuer,H.discoveryEndpoint),U=await fetch(F.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:G,redirect_uri:`${Y.baseUrl}/api/org-sso/callback`,client_id:H.clientId,client_secret:H.clientSecret,code_verifier:W.codeVerifier})});if(!U.ok)return console.error("[org-sso] Token exchange failed:",await U.text()),X.redirect("/?sso_error=token_exchange_failed");let B=await U.json();if(!B.id_token)return X.redirect("/?sso_error=no_id_token");try{let D=tw(new URL(F.jwks_uri)),{payload:O}=await s8(B.id_token,D,{issuer:H.issuer,audience:H.clientId}),j=O.email?.toLowerCase(),E=Y.auth.user.email?.toLowerCase();if(!j||j!==E)return console.error(`[org-sso] Email mismatch: token=${j}, user=${E}`),X.redirect("/?sso_error=email_mismatch")}catch(D){return console.error("[org-sso] ID token verification failed:",D),X.redirect("/?sso_error=token_verification_failed")}await Y.storage.orgSsoSessions.upsert(Y.auth.user.id,W.orgId);let N=await Oq0(Y,Y.auth.user.id,W.orgId),w=N?.orgSlug?`/${N.orgSlug}`:"/";return X.redirect(w)}),$.get("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!mR8(Y))return X.json({error:"Admin role required"},403);let Q=await Y.storage.orgSsoConfig.getByOrgId(G);if(!Q)return X.json({configured:!1});return X.json({configured:!0,config:Y.storage.orgSsoConfig.toPublic(Q)})}),$.post("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);let Q=await X.req.json();if(!Q.issuer||!Q.clientId||!Q.domain)return X.json({error:"issuer, clientId, and domain are required"},400);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J&&!Q.clientSecret)return X.json({error:"clientSecret is required for initial SSO setup"},400);let Z=Q.clientSecret||J?.clientSecret||"";try{await zq0(Q.issuer,Q.discoveryEndpoint)}catch(H){return X.json({error:"Failed to reach OIDC discovery endpoint",details:H instanceof Error?H.message:String(H)},400)}let W=await Y.storage.orgSsoConfig.upsert(G,{issuer:Q.issuer,clientId:Q.clientId,clientSecret:Z,discoveryEndpoint:Q.discoveryEndpoint,scopes:Q.scopes,domain:Q.domain,enforced:Q.enforced});return X.json({success:!0,config:Y.storage.orgSsoConfig.toPublic(W)})}),$.post("/config/enforce",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);let Q=await X.req.json();if(!await Y.storage.orgSsoConfig.getByOrgId(G))return X.json({error:"SSO must be configured before enforcing"},400);return await Y.storage.orgSsoConfig.setEnforced(G,Q.enforced),X.json({success:!0,enforced:Q.enforced})}),$.delete("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);return await Y.storage.orgSsoConfig.delete(G),X.json({success:!0})})}function ty1($){let X;try{X=new URL($)}catch{throw Error(`Invalid URL: ${$}`)}let Y=f4().localMode;if(X.protocol!=="https:"&&!(Y&&X.protocol==="http:"))throw Error(`OIDC URL must use HTTPS: ${$}`);let G=X.hostname,Q=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[fd/,/^\[fe80:/,/^localhost$/i],J=/^127\.|^\[::1\]$|^localhost$/i.test(G);if(Y&&J)return;for(let Z of Q)if(Z.test(G))throw Error(`OIDC URL must not point to a private network address: ${G}`)}async function zq0($,X){let Y=X||$,G=_36.get(Y);if(G&&G.expiresAt>Date.now())return G.doc;let Q=X||`${$.replace(/\/$/,"")}/.well-known/openid-configuration`;ty1(Q);let J=await fetch(Q);if(!J.ok)throw Error(`OIDC discovery failed: ${J.status} ${J.statusText}`);let Z=await J.json();if(!Z.authorization_endpoint||!Z.token_endpoint||!Z.jwks_uri)throw Error("OIDC discovery document missing required endpoints");return ty1(Z.authorization_endpoint),ty1(Z.token_endpoint),ty1(Z.jwks_uri),_36.set(Y,{doc:Z,expiresAt:Date.now()+3600000}),Z}function hR8(){let $=new Uint8Array(32);return crypto.getRandomValues($),btoa(String.fromCharCode(...$)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function uR8($){let Y=new TextEncoder().encode($),G=await crypto.subtle.digest("SHA-256",Y);return btoa(String.fromCharCode(...new Uint8Array(G))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function Oq0($,X,Y){return await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug as orgSlug","member.role"]).where("member.userId","=",X).where("member.organizationId","=",Y).executeTakeFirst()??null}function mR8($){let X=$.auth.user?.role;if(!X)return!1;return tp.includes(X)}function Lq0($){return $.auth.user?.role==="owner"}var oy1=()=>{let $=new Z6;return gR8($),$},_36;var jq0=z(()=>{HX();g80();m5();T5();j91();_36=new Map});function dR8($){if($==="claude-code")return lR8;if($==="codex")return cR8;return null}function b36($,X){return dR8($)?.[X]??null}var lR8,cR8;var f36=z(()=>{lR8={fast:{modelId:"claude-code:haiku",label:"Haiku"},smart:{modelId:"claude-code:sonnet",label:"Sonnet"},thinking:{modelId:"claude-code:opus",label:"Opus"}},cR8={fast:{modelId:"codex:gpt-5.4-mini",label:"GPT-5.4 Mini"},smart:{modelId:"codex:gpt-5.3-codex",label:"GPT-5.3 Codex"},thinking:{modelId:"codex:gpt-5.5",label:"GPT-5.5"}}});function y36($){return $.type==="tool-call"&&$.toolName==="todo_write"&&typeof $.toolCallId==="string"}function iR8($){return $.type==="tool-result"&&$.toolName==="todo_write"&&typeof $.toolCallId==="string"}function x36($){let X=null;for(let G=$.length-1;G>=0&&X===null;G--){let J=$[G].content;if(!Array.isArray(J))continue;for(let Z=J.length-1;Z>=0;Z--){let W=J[Z];if(y36(W)){X=W.toolCallId;break}}}if(X===null)return $;let Y=X;return $.map((G)=>{let Q=G.content;if(!Array.isArray(Q))return G;let J=Q.filter((Z)=>{if(y36(Z))return Z.toolCallId===Y;if(iR8(Z))return Z.toolCallId===Y;return!0});if(J.length===Q.length)return G;return{...G,content:J}})}function g36($){let X=$.filter((G)=>G.role==="system"),Y=$.find((G)=>G.role!=="system");return{systemMessages:X,requestMessage:Y}}function pR8($){let X=!1,Y=$.map((G)=>{if(G.role!=="assistant")return G;if(!G.parts.some((J)=>("state"in J)&&J.state==="approval-requested"))return G;return X=!0,{...G,parts:G.parts.map((J)=>{if(!("state"in J)||J.state!=="approval-requested"||!("approval"in J)||!J.approval)return J;return{...J,state:"output-denied",approval:{...J.approval,approved:!1,reason:"User sent a new message without approving this tool call."}}})}});return X?Y:$}function nR8($){let[X,Y]=$.reduce((G,Q)=>{if(Q.role==="system")G[0].push(Q);else G[1].push(Q);return G},[[],[]]);return{systemMessages:X,messages:Y}}async function rR8($,X){return await $.loadHistory(X)}function aR8($,X){let Y=$.filter((J)=>J.parts&&J.parts.length>0);if(!X)return Y;let G=Y.findIndex((J)=>J.id===X.id);return G>=0?[...Y.slice(0,G),X]:[...Y,X]}async function h36($,X,Y,G){let Q=await rR8($,G),J=aR8(Q,X);return[...Y,...J]}async function u36($,X){let Y=$.filter((B)=>B.role!=="assistant"||B.parts&&B.parts.length>0),G=await zX1({messages:Y}),Q=pR8(G),J=await AV(Q,{tools:X.tools,ignoreIncompleteToolCalls:!0}),{systemMessages:Z,messages:W}=nR8(J),H=x36(W),U=Ej0({messages:H,reasoning:"all",emptyMessages:"remove",toolCalls:"none"}).map((B)=>{if(B.role!=="assistant")return B;let N=Array.isArray(B.content)?B.content.filter((w)=>w.type!=="reasoning"&&w.type!=="thinking"&&w.type!=="redacted-reasoning").map((w)=>{let D=w;if("providerOptions"in D||"providerMetadata"in D){let{providerOptions:O,providerMetadata:j,...E}=D;if(D.type==="tool-call"){let P=j?.google,T=O?.google;return{...E,...P?{providerMetadata:{google:P}}:{},...T?{providerOptions:{google:T}}:{}}}return E}return w}):B.content;return{...B,content:Array.isArray(N)&&N.length===0?[{type:"text",text:""}]:N,providerOptions:void 0,providerMetadata:void 0}});return{systemMessages:Z,messages:U,originalMessages:G}}var sy1=z(()=>{q5()});function PW($){return`mesh-storage://${$}`}function Qh($){if(!$.startsWith("mesh-storage://"))return null;return $.slice(15)}function Eq0(){return/mesh-storage:\/\/([^\s"'<>[\]]+)/g}function tR8($,X,Y){return`${$}/api/${X}/files/${Y}`}function sR8($){return $.type==="file"&&"mediaType"in $&&typeof $.mediaType==="string"&&oR8.has($.mediaType)}function m36($){let X=$.match(/^data:([^;]+);base64,(.+)$/s);if(!X)return null;let[,Y,G]=X;try{let Q=atob(G),J=new Uint8Array(Q.length);for(let Z=0;Z<Q.length;Z++)J[Z]=Q.charCodeAt(Z);return{mimeType:Y,bytes:J}}catch{return null}}function l36($){return{"image/png":"png","image/jpeg":"jpg","image/gif":"gif","image/webp":"webp","image/svg+xml":"svg","application/pdf":"pdf","text/plain":"txt","text/html":"html","application/json":"json"}[$]??"bin"}async function c36($,X,Y,G){if(!G.objectStorage)return null;try{return await G.objectStorage.put(X,$,{contentType:Y}),X}catch(Q){return console.error("[file-materializer] Failed to upload file:",Q),null}}async function Jh($,X){if(!X.objectStorage)return null;try{return await X.objectStorage.presignedGetUrl($,eR8)}catch(Y){return console.error("[file-materializer] Failed to generate presigned URL:",Y),null}}async function d36($,X){if(!X.organization)return $;let Y=X.organization.slug;if(!Y)return $;let G=$.findLastIndex((D)=>D.role==="user");if(G===-1)return $;let Q=$[G],J=Q.parts.filter((D)=>D.type==="file"&&("url"in D)&&typeof D.url==="string"&&D.url.startsWith("data:"));if(J.length===0)return $;let W=(await Promise.all(J.map(async(D)=>{if(D.type!=="file"||!("url"in D)||typeof D.url!=="string")return null;let O=m36(D.url);if(!O)return null;let j=l36(O.mimeType),E=`chat-uploads/${crypto.randomUUID()}.${j}`,P=await c36(O.bytes,E,O.mimeType,X);if(!P)return null;let T="filename"in D&&typeof D.filename==="string"?D.filename:E;return{dataUrl:D.url,meshStorageUrl:PW(P),redirectUrl:tR8(X.baseUrl,Y,P),filename:T}}))).filter((D)=>D!==null);if(W.length===0)return $;let F=`[Uploaded files \u2014 use these URLs when calling tools]
+      `.execute(F),await m1`DELETE FROM "member" WHERE "userId" = ${X.id}`.execute(F),await m1`DELETE FROM "user" WHERE "id" = ${X.id}`.execute(F)})}catch(F){console.error("[SSO] Failed to merge duplicate user:",F)}}var BR8=($)=>{return{trustEmailVerified:!0,provisionUser:wR8,defaultSSO:[{domain:$.domain,providerId:$.providerId,oidcConfig:{issuer:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/v2.0`,pkce:!0,clientId:$.MS_CLIENT_ID,clientSecret:$.MS_CLIENT_SECRET,discoveryEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/v2.0/.well-known/openid-configuration`,authorizationEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/oauth2/v2.0/authorize`,tokenEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/oauth2/v2.0/token`,jwksEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/discovery/v2.0/keys`,userInfoEndpoint:"https://graph.microsoft.com/oidc/userinfo",tokenEndpointAuthentication:"client_secret_post",scopes:$.scopes,mapping:{id:"sub",email:"email",emailVerified:"email_verified",name:"name",image:"picture",extraFields:{emailVerified:"email_verified",oid:"oid"}}}}]}},NR8=($)=>{return{trustEmailVerified:!0,defaultSSO:[{domain:$.domain,providerId:$.providerId,oidcConfig:{issuer:"https://accounts.google.com",pkce:!0,clientId:$.GOOGLE_CLIENT_ID,clientSecret:$.GOOGLE_CLIENT_SECRET,discoveryEndpoint:"https://accounts.google.com/.well-known/openid-configuration",authorizationEndpoint:"https://accounts.google.com/o/oauth2/v2/auth",tokenEndpoint:"https://oauth2.googleapis.com/token",jwksEndpoint:"https://www.googleapis.com/oauth2/v3/certs",userInfoEndpoint:"https://openidconnect.googleapis.com/v1/userinfo",tokenEndpointAuthentication:"client_secret_post",scopes:$.scopes,mapping:{id:"sub",email:"email",emailVerified:"email_verified",name:"name",image:"picture",extraFields:{emailVerified:"email_verified",hd:"hd"}}}}]}},X36=($)=>{if($.providerId==="microsoft")return BR8($);if($.providerId==="google")return NR8($);throw Error(`Unsupported provider: ${$.providerId}`)};var Y36=z(()=>{m5();CX();BD()});var K36={};R6(K36,{resetPasswordEnabled:()=>py1,authConfig:()=>p8,auth:()=>n5,GENERIC_EMAIL_DOMAINS:()=>$z});function DR8($){return $.toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}function zR8(){let $=Math.floor(Math.random()*Q36.length),X=Math.floor(Math.random()*G36.length),Y=Q36[$]??"deco",G=G36[X]??"studio";return`${Y}-${G}`}function VR8(){let $=[WY1];try{let X=new URL(WY1);if(X.hostname==="localhost")$.push(WY1.replace("localhost","127.0.0.1"));else if(X.hostname==="127.0.0.1")$.push(WY1.replace("127.0.0.1","localhost"))}catch{}return $}var G36,Q36,OR8,LR8,iy1,jR8,ER8,PR8,J36,p8,W36=void 0,Zq0=void 0,py1=!1,qR8,$z,AR8,TR8,WY1,Z36,n5;var Xz=z(()=>{T5();l80();Yq4();cA4();eQ0();bZ0();UZ0();cD1();RV4();xZ0();$X();UD();mI4();BD();tI4();iz1();sI4();eW6();$36();j91();Y36();G36=["labs","agent","studio","workspace","systems","core","cloud","works"],Q36=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"];OR8=Object.values(G11()).map(($)=>$.map((X)=>X.name)).flat(),LR8={...vd,self:["*",...OR8]},iy1=jB(LR8),jR8=iy1.newRole({self:["*"],...Cd.statements}),ER8=iy1.newRole({self:["*"],...Cd.statements}),PR8=iy1.newRole({self:["*"],...Cd.statements}),J36=Object.values(G11()).map(($)=>$.map((X)=>`self:${X.name}`)).flat(),p8=T2().auth;if(p8.inviteEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=k2(p8.emailProviders,p8.inviteEmailProviderId);if($){let X=S2($);W36=async(Y)=>{let G=Y.inviter.user?.name||Y.inviter.user?.email,Q=`${cZ()}/auth/accept-invitation?invitationId=${Y.invitation.id}&redirectTo=/${Y.organization.slug}`;await X({to:Y.email,subject:`You've been invited to join ${Y.organization.name}`,html:v2({preheader:`${G} has invited you to join ${Y.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${G}</strong> has invited you to join <strong>${Y.organization.name}</strong> on deco Studio.`,body:D61("Accept invitation",Q),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(p8.resetPasswordEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=k2(p8.emailProviders,p8.resetPasswordEmailProviderId);if($){let X=S2($);py1=!0,Zq0=async({user:Y,url:G})=>{await X({to:Y.email,subject:"Reset your password",html:v2({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:D61("Reset password",G)+pz1("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}qR8=[dJ0({organizationCreation:{afterCreate:async($)=>{await sW6($.organization.id,$.member.userId)}},ac:iy1,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:tp,resourceNameValidation:($)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test($)}}},roles:{user:jR8,admin:ER8,owner:PR8},sendInvitationEmail:W36}),AZ0({loginPage:"/login",oidcConfig:{scopes:J36,metadata:{scopes_supported:J36},loginPage:"/login"}}),XZ0({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:($)=>{if($.headers?.get("X-MCP-Session-Auth")==="true")return null;let Y=$.headers?.get("Authorization");if(Y?.startsWith("Bearer "))return Y.replace("Bearer ","").trim();return null},permissions:{defaultPermissions:{self:["ORGANIZATION_LIST","ORGANIZATION_GET","ORGANIZATION_MEMBER_LIST","COLLECTION_CONNECTIONS_LIST","COLLECTION_CONNECTIONS_GET","API_KEY_CREATE","API_KEY_LIST"]}},rateLimit:{enabled:!1}}),iD1({defaultRole:"user",adminRoles:["admin","owner"],roles:{...D2,owner:mD1}}),IZ0(),wZ0({jwt:{expirationTime:"5m"}}),Xq4(p8.ssoConfig?X36(p8.ssoConfig):void 0),...p8.magicLinkConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[zZ0(oI4(p8.magicLinkConfig,p8.emailProviders))]:[],...p8.emailOtpConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[FZ0(aI4(p8.emailOtpConfig,p8.emailProviders))]:[]],$z=new Set(["gmail.com","googlemail.com","outlook.com","hotmail.com","live.com","yahoo.com","yahoo.co.uk","icloud.com","me.com","mac.com","aol.com","protonmail.com","proton.me","zoho.com","yandex.com","mail.com","gmx.com","gmx.net","tutanota.com","fastmail.com"]),AR8=w61(),TR8=pI4(AR8),WY1=cZ();Z36=f4(),n5=sQ0({secret:Z36.betterAuthSecret||"deco-default-secret-k7x9m2p4q8w3n5v6",baseURL:WY1,trustedOrigins:VR8(),database:TR8,socialProviders:p8.socialProviders,...p8.ssoConfig&&{account:{accountLinking:{trustedProviders:[p8.ssoConfig.providerId]}}},emailAndPassword:{enabled:p8.emailAndPassword.enabled,...Zq0&&{sendResetPassword:Zq0}},rateLimit:{enabled:!Z36.disableRateLimit,window:60,max:1e4},plugins:qR8,databaseHooks:{user:{create:{after:async($)=>{if(Jq0({id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified}),j6.capture({distinctId:$.id,event:"user_signed_up",properties:{email:$.email,email_domain:$.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!$.emailVerified,has_name:!!$.name}}),$.emailVerified){let G=$.email?.split("@")[1]?.toLowerCase();if(G&&!$z.has(G))return}if(T2().autoCreateOrganizationOnSignup===!1)return;let X=$.name?$.name.split(" ")[0]:$.email.split("@")[0],Y=3;for(let G=0;G<Y;G++){let Q=`${X} ${zR8()}`,J=DR8(Q);try{let W=(await n5.api.createOrganization({body:{name:Q,slug:J,userId:$.id}}))?.id??void 0;if(W)j6.groupIdentify({groupType:"organization",groupKey:W,properties:{name:Q,slug:J,created_at:new Date().toISOString(),created_via:"signup_default"}}),j6.capture({distinctId:$.id,event:"organization_created",groups:{organization:W},properties:{organization_id:W,organization_slug:J,created_via:"signup_default"}});return}catch(Z){if(!(Z instanceof Error&&("body"in Z)&&Z.body?.code==="ORGANIZATION_ALREADY_EXISTS")||G===Y-1){console.error("Failed to create default organization:",Z);return}}}}}},session:{create:{after:async($)=>{let X=await fX().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",$.userId).executeTakeFirst();if(!X)return;Jq0({id:X.id,email:X.email,name:X.name??null,emailVerified:!!X.emailVerified})}}}}})});function Wq0($,X){return`${$}:${X}`}function H36($){let X=$?.ttlMs??120000,Y=$?.maxSize??1e4,G=new Map;function Q(){if(G.size<=Y)return;let J=Date.now();for(let[Z,W]of G)if(W.expiresAt<=J)G.delete(Z);if(G.size>Y){let Z=G.size-Y,W=0;for(let H of G.keys()){if(W>=Z)break;G.delete(H),W++}}}return{get(J,Z){let W=Wq0(J,Z),H=G.get(W);if(!H)return;if(H.expiresAt<=Date.now()){G.delete(W);return}return H.role},set(J,Z,W){let H=Wq0(J,Z);G.set(H,{role:W,expiresAt:Date.now()+X,organizationId:Z}),Q()},invalidate(J,Z){G.delete(Wq0(J,Z))},invalidateOrg(J){for(let[Z,W]of G)if(W.organizationId===J)G.delete(Z)}}}var F36=()=>{};var Kq0=()=>{};var U36=()=>{};var MR8,PRY;var B36=z(()=>{F36();Kq0();dO();U36();MR8={br:".br",zstd:".zst",gzip:".gz"},PRY=Object.keys(MR8)});var N36=z(()=>{B36()});var w36=()=>{};var D36=z(()=>{w36()});var z36=()=>{};var O36=z(()=>{S80()});var Hq0=z(()=>{iO();O36()});var Fq0="x-hono-disable-ssg",uRY;var Uq0=z(()=>{Hq0();uRY=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[Fq0]:"true"}})}catch{return null}})()});var L36=z(()=>{WU1()});var Bq0=z(()=>{L36()});var j36=z(()=>{D36();z36();Kq0();Uq0();Bq0();Hq0()});var E36=z(()=>{Uq0();Bq0();j36()});var qSY;var P36=z(()=>{E36();({write:qSY}=Bun)});var SR8=class{#$;constructor($){this.#$=$,this.raw=$.raw,this.url=$.url?new URL($.url):null,this.protocol=$.protocol??null}send($,X){this.#$.send($,X??{})}raw;binaryType="arraybuffer";get readyState(){return this.#$.readyState}url;protocol;close($,X){this.#$.close($,X)}},q36=($)=>{return(...X)=>{if(typeof X[0]==="function"){let[Y,G]=X;return async function(J,Z){let W=await Y(J),H=await $(J,W,G);if(H)return H;await Z()}}else{let[Y,G,Q]=X;return(async()=>{let J=await $(Y,G,Q);if(!J)throw Error("Failed to upgrade WebSocket");return J})()}}};var A36=()=>{};var KY1=($)=>("server"in $.env)?$.env.server:$.env;var ny1=()=>{};var kR8;var T36=z(()=>{A36();ny1();kR8=q36(($,X)=>{let Y=KY1($);if(!Y)throw TypeError("env has to include the 2nd argument of fetch.");if(Y.upgrade($.req.raw,{data:{events:X,url:new URL($.req.url),protocol:$.req.url}}))return new Response(null);return})});var Nq0=($)=>{let X=KY1($);if(!X)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof X.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let Y=X.requestIP($.req.raw);if(!Y)return{remote:{}};return{remote:{address:Y.address,addressType:Y.family==="IPv6"||Y.family==="IPv4"?Y.family:void 0,port:Y.port}}};var V36=z(()=>{ny1()});var M36=z(()=>{N36();P36();T36();V36();ny1()});var I36;var R36=z(()=>{I36={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});var ay1={};R6(ay1,{waitForSeed:()=>xR8,seedLocalMode:()=>bR8,markSeedComplete:()=>yR8,isLocalMode:()=>Gh,getLocalAdminUser:()=>wq0,getLocalAdminPassword:()=>ry1});import{userInfo as vR8}from"os";async function ry1(){return f4().betterAuthSecret||"local-mode-default"}function S36(){try{return vR8().username||"local"}catch{return"local"}}function CR8($){return $.charAt(0).toUpperCase()+$.slice(1)}async function _R8(){let $=fX(),X=await $.db.selectFrom("user").select($.db.fn.countAll().as("count")).executeTakeFirst();return Number(X?.count??0)===0}async function bR8(){if(!await _R8())return!1;let X=S36(),Y=`${X}@localhost.mesh`,G=CR8(X),Q=await ry1(),J=await n5.api.signUpEmail({body:{email:Y,password:Q,name:G}});if(!J?.user?.id)throw Error("Failed to create local admin user");let Z=J.user.id,W=fX();await W.db.updateTable("user").set({role:"admin"}).where("id","=",Z).execute();let H=`${X}-local`.toLowerCase().replace(/[^a-z0-9-]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,""),F=`${G} Local`;return await W.db.updateTable("organization").set({name:F,slug:H}).where("id","in",(U)=>U.selectFrom("member").select("organizationId").where("userId","=",Z)).execute(),!0}async function wq0(){let $=fX(),X=`${S36()}@localhost.mesh`;return $.db.selectFrom("user").where("email","=",X).selectAll().executeTakeFirst()}function Gh(){return f4().localMode}function yR8(){k36()}function xR8(){return fR8}var k36,fR8;var wr=z(()=>{BD();T5();Xz();fR8=new Promise(($)=>{if(k36=$,!Gh())$()})});function v36(){let $=Object.keys(p8.socialProviders??{}),X=$.length>0,Y=$.map((Q)=>({name:Q,icon:I36[Q].icon})),G=f4().localMode;return{emailAndPassword:{enabled:p8.emailAndPassword?.enabled??!1},magicLink:{enabled:p8.magicLinkConfig?.enabled??!1},emailOtp:{enabled:p8.emailOtpConfig?.enabled??!1},resetPassword:{enabled:py1},socialProviders:{enabled:X,providers:Y},sso:p8.ssoConfig?{enabled:!0,providerId:p8.ssoConfig.providerId}:{enabled:!1},stdioEnabled:G,localMode:Gh()}}var Dr,C36;var Dq0=z(()=>{HX();M36();$X();T5();Xz();BD();Cz0();sB0();R36();wr();Dr=new Z6;Dr.post("/local-session",async($)=>{if(!Gh())return $.json({success:!1,error:"Local mode is not active"},403);let X;try{X=Nq0($).remote.address}catch{}if(!(X==="127.0.0.1"||X==="::1"||X==="::ffff:127.0.0.1"))return $.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:G}=await Promise.resolve().then(() => (wr(),ay1));await G();let{auth:Q}=await Promise.resolve().then(() => (Xz(),K36)),J=await wq0();if(!J)return $.json({success:!1,error:"Local admin user not found"},500);let Z=await ry1();return await Q.api.signInEmail({body:{email:J.email,password:Z},asResponse:!0})}catch(G){return console.error("Failed to create local session:",G),$.json({success:!1,error:G instanceof Error?G.message:"Failed to create local session"},500)}});Dr.get("/domain-lookup",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({found:!1,organizations:[]});let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({found:!1,organizations:[]});try{let Q=await new XE(fX().db).getAllByDomain(Y);if(Q.length===0)return $.json({found:!1,organizations:[]});let J=await fX().db.selectFrom("organization").select(["id","name","slug","logo"]).where("id","in",Q.map((H)=>H.organizationId)).execute(),Z=new Map(J.map((H)=>[H.id,H])),W=Q.map((H)=>{let F=Z.get(H.organizationId);if(!F)return null;return{id:F.id,name:F.name,slug:F.slug,logo:F.logo,autoJoinEnabled:H.autoJoinEnabled}}).filter((H)=>H!==null);return $.json({found:W.length>0,organizations:W})}catch(G){return console.error("[Auth] Domain lookup failed:",G),$.json({success:!1,error:"Domain lookup failed"},500)}});Dr.post("/domain-join",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({success:!1,error:"Email must be verified to join"},403);let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({success:!1,error:"Generic email domains cannot auto-join"},403);let G=await $.req.json().catch(()=>({})),Q=typeof G.organizationSlug==="string"&&G.organizationSlug.trim()?G.organizationSlug.trim():null;try{let J=fX().db,H=(await new XE(J).getAllByDomain(Y)).filter((U)=>U.autoJoinEnabled);if(H.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let F;if(Q){let U=await J.selectFrom("organization").select(["id","slug"]).where("slug","=",Q).executeTakeFirst();if(!U||!H.some((B)=>B.organizationId===U.id))return $.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);F=U}else if(H.length===1){let U=await J.selectFrom("organization").select(["id","slug"]).where("id","=",H[0].organizationId).executeTakeFirst();if(!U)return $.json({success:!1,error:"Organization not found"},404);F=U}else return $.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await n5.api.addMember({body:{userId:X.user.id,role:"user",organizationId:F.id}})}catch(U){if(!(U instanceof Error?U.message.toLowerCase():"").includes("already a member"))return console.error("[Auth] Domain join addMember failed:",U),$.json({success:!1,error:"Failed to join organization"},500)}return j6.capture({distinctId:X.user.id,event:"organization_domain_joined",groups:{organization:F.id},properties:{organization_id:F.id,organization_slug:F.slug,email_domain:Y}}),$.json({success:!0,slug:F.slug})}catch(J){return j6.captureException(J,X.user.id),console.error("[Auth] Domain join failed:",J),$.json({success:!1,error:"Failed to join organization"},500)}});Dr.post("/domain-setup",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({success:!1,error:"Email must be verified"},403);let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({success:!1,error:"Corporate email required"},403);let G=await $.req.json().catch(()=>({})),Q=typeof G.name==="string"&&G.name.trim().length>0?G.name.trim():null,J=typeof G.logo==="string"&&G.logo.length>0?G.logo:null,Z=G.claimDomain!==!1;try{let W=fX().db,H=new XE(W),F=await H.getAllByDomain(Y);if(F.length>0){let T=await W.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",X.user.id).where("member.organizationId","in",F.map((I)=>I.organizationId)).executeTakeFirst();if(T)return $.json({success:!0,slug:T.slug,alreadyExists:!0})}let U=Y.split(".")[0]??Y,B=Q??U.charAt(0).toUpperCase()+U.slice(1),N=(Q??U).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||U.toLowerCase().replace(/[^a-z0-9-]/g,""),w=null;for(let I=0;I<3;I++){let M=I===0?"":`-${Math.random().toString(36).slice(2,6)}`,R=I===0?B:`${B}${M}`,S=`${N}${M}`;try{w=await n5.api.createOrganization({body:{name:R,slug:S,userId:X.user.id}});break}catch(C){if(!(C instanceof Error&&("body"in C)&&C.body?.code==="ORGANIZATION_ALREADY_EXISTS")||I===2)throw C}}if(!w?.id)throw Error("Failed to create organization");let D=w.id;if(Z)await H.setDomain(D,Y,!0);let O=!1,j=null,E=null;try{let T=f4().firecrawlApiKey;if(T){let I=await Yq1(Y,T,B);if(I){let M=new z91(fX().db),R=await M.create(D,I);if(await M.setDefault(R.id,D),O=!0,I.name&&I.name!==B)j=I.name;E=I.favicon??I.logo??null}}}catch(T){console.error("[Auth] Brand extraction failed (non-fatal):",T)}let P={};if(!Q&&j)P.name=j;if(J)P.logo=J;else if(E)P.logo=E;if(Object.keys(P).length>0)try{await n5.api.updateOrganization({headers:$.req.raw.headers,body:{organizationId:D,data:P}})}catch(T){console.error("[Auth] Org update failed (non-fatal):",T)}return j6.identify({distinctId:X.user.id,properties:{email:X.user.email,$set:{email:X.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),j6.groupIdentify({groupType:"organization",groupKey:D,properties:{name:w.slug??N,slug:w.slug??N,email_domain:Y,brand_extracted:O,created_at:new Date().toISOString()}}),j6.capture({distinctId:X.user.id,event:"organization_created",groups:{organization:D},properties:{organization_id:D,organization_slug:w.slug??N,email_domain:Y,brand_extracted:O}}),$.json({success:!0,slug:w.slug??N,brandExtracted:O})}catch(W){return j6.captureException(W,X.user?.id),console.error("[Auth] Domain setup failed:",W),$.json({success:!1,error:"Failed to set up organization"},500)}});Dr.get("/org-access-status/:slug",async($)=>{let X=$.req.param("slug"),Y=await n5.api.getSession({headers:$.req.raw.headers});if(!Y?.user)return $.json({success:!1,error:"Authentication required"},401);let G=fX().db,Q=await G.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",X).executeTakeFirst();if(!Q)return $.json({status:"not-found"});let J={id:Q.id,name:Q.name,slug:Q.slug,logo:Q.logo};if(await G.selectFrom("member").select(["id"]).where("userId","=",Y.user.id).where("organizationId","=",Q.id).executeTakeFirst())return $.json({status:"member",organization:J});try{let W=await n5.api.listUserInvitations({headers:$.req.raw.headers}),H=Date.now(),F=W.find((U)=>U.organizationId===Q.id&&U.status==="pending"&&new Date(U.expiresAt).getTime()>H);if(F)return $.json({status:"pending-invite",invitation:{id:F.id},organization:J})}catch(W){console.error("[Auth] listUserInvitations failed:",W)}if(Y.user.emailVerified){let W=Y.user.email?.split("@")[1]?.toLowerCase();if(W&&!$z.has(W)){let H=await new XE(G).getByOrganizationId(Q.id);if(H?.autoJoinEnabled&&H.domain===W)return $.json({status:"auto-domain-join",organization:{...J,domain:W}})}}return $.json({status:"no-access",organization:J})});C36=Dr});function gR8($){$.get("/status",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!await Oq0(Y,Y.auth.user.id,G))return X.json({error:"Not a member of this organization"},403);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J||!J.enforced)return X.json({ssoRequired:!1});let Z=await Y.storage.orgSsoSessions.isValid(Y.auth.user.id,G);return X.json({ssoRequired:!0,authenticated:Z,issuer:J.issuer,domain:J.domain})}),$.get("/authorize",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!await Oq0(Y,Y.auth.user.id,G))return X.json({error:"Not a member of this organization"},403);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J)return X.json({error:"SSO not configured for this organization"},404);let Z=await zq0(J.issuer,J.discoveryEndpoint),W=hR8(),H=await uR8(W),F=crypto.randomUUID(),U=JSON.stringify({state:F,codeVerifier:W,orgId:G,userId:Y.auth.user.id});x80(X,"org_sso_state",U,{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:600});let B=new URLSearchParams({response_type:"code",client_id:J.clientId,redirect_uri:`${Y.baseUrl}/api/org-sso/callback`,scope:J.scopes.join(" "),state:F,code_challenge:H,code_challenge_method:"S256"}),N=`${Z.authorization_endpoint}?${B.toString()}`;return X.redirect(N)}),$.get("/callback",async(X)=>{let Y=X.get("meshContext"),G=X.req.query("code"),Q=X.req.query("state"),J=X.req.query("error");if(J)return X.redirect(`/?sso_error=${encodeURIComponent(J)}`);if(!G||!Q)return X.redirect("/?sso_error=missing_code_or_state");let Z=DU1(X,"org_sso_state");if(!Z)return X.redirect("/?sso_error=state_expired");x80(X,"org_sso_state","",{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:0});let W;try{W=JSON.parse(Z)}catch{return X.redirect("/?sso_error=invalid_state")}if(W.state!==Q)return X.redirect("/?sso_error=state_mismatch");if(!Y.auth.user||Y.auth.user.id!==W.userId)return X.redirect("/?sso_error=session_expired");let H=await Y.storage.orgSsoConfig.getByOrgId(W.orgId);if(!H)return X.redirect("/?sso_error=sso_not_configured");let F=await zq0(H.issuer,H.discoveryEndpoint),U=await fetch(F.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:G,redirect_uri:`${Y.baseUrl}/api/org-sso/callback`,client_id:H.clientId,client_secret:H.clientSecret,code_verifier:W.codeVerifier})});if(!U.ok)return console.error("[org-sso] Token exchange failed:",await U.text()),X.redirect("/?sso_error=token_exchange_failed");let B=await U.json();if(!B.id_token)return X.redirect("/?sso_error=no_id_token");try{let D=tw(new URL(F.jwks_uri)),{payload:O}=await s8(B.id_token,D,{issuer:H.issuer,audience:H.clientId}),j=O.email?.toLowerCase(),E=Y.auth.user.email?.toLowerCase();if(!j||j!==E)return console.error(`[org-sso] Email mismatch: token=${j}, user=${E}`),X.redirect("/?sso_error=email_mismatch")}catch(D){return console.error("[org-sso] ID token verification failed:",D),X.redirect("/?sso_error=token_verification_failed")}await Y.storage.orgSsoSessions.upsert(Y.auth.user.id,W.orgId);let N=await Oq0(Y,Y.auth.user.id,W.orgId),w=N?.orgSlug?`/${N.orgSlug}`:"/";return X.redirect(w)}),$.get("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!mR8(Y))return X.json({error:"Admin role required"},403);let Q=await Y.storage.orgSsoConfig.getByOrgId(G);if(!Q)return X.json({configured:!1});return X.json({configured:!0,config:Y.storage.orgSsoConfig.toPublic(Q)})}),$.post("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);let Q=await X.req.json();if(!Q.issuer||!Q.clientId||!Q.domain)return X.json({error:"issuer, clientId, and domain are required"},400);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J&&!Q.clientSecret)return X.json({error:"clientSecret is required for initial SSO setup"},400);let Z=Q.clientSecret||J?.clientSecret||"";try{await zq0(Q.issuer,Q.discoveryEndpoint)}catch(H){return X.json({error:"Failed to reach OIDC discovery endpoint",details:H instanceof Error?H.message:String(H)},400)}let W=await Y.storage.orgSsoConfig.upsert(G,{issuer:Q.issuer,clientId:Q.clientId,clientSecret:Z,discoveryEndpoint:Q.discoveryEndpoint,scopes:Q.scopes,domain:Q.domain,enforced:Q.enforced});return X.json({success:!0,config:Y.storage.orgSsoConfig.toPublic(W)})}),$.post("/config/enforce",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);let Q=await X.req.json();if(!await Y.storage.orgSsoConfig.getByOrgId(G))return X.json({error:"SSO must be configured before enforcing"},400);return await Y.storage.orgSsoConfig.setEnforced(G,Q.enforced),X.json({success:!0,enforced:Q.enforced})}),$.delete("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);return await Y.storage.orgSsoConfig.delete(G),X.json({success:!0})})}function ty1($){let X;try{X=new URL($)}catch{throw Error(`Invalid URL: ${$}`)}let Y=f4().localMode;if(X.protocol!=="https:"&&!(Y&&X.protocol==="http:"))throw Error(`OIDC URL must use HTTPS: ${$}`);let G=X.hostname,Q=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[fd/,/^\[fe80:/,/^localhost$/i],J=/^127\.|^\[::1\]$|^localhost$/i.test(G);if(Y&&J)return;for(let Z of Q)if(Z.test(G))throw Error(`OIDC URL must not point to a private network address: ${G}`)}async function zq0($,X){let Y=X||$,G=_36.get(Y);if(G&&G.expiresAt>Date.now())return G.doc;let Q=X||`${$.replace(/\/$/,"")}/.well-known/openid-configuration`;ty1(Q);let J=await fetch(Q);if(!J.ok)throw Error(`OIDC discovery failed: ${J.status} ${J.statusText}`);let Z=await J.json();if(!Z.authorization_endpoint||!Z.token_endpoint||!Z.jwks_uri)throw Error("OIDC discovery document missing required endpoints");return ty1(Z.authorization_endpoint),ty1(Z.token_endpoint),ty1(Z.jwks_uri),_36.set(Y,{doc:Z,expiresAt:Date.now()+3600000}),Z}function hR8(){let $=new Uint8Array(32);return crypto.getRandomValues($),btoa(String.fromCharCode(...$)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function uR8($){let Y=new TextEncoder().encode($),G=await crypto.subtle.digest("SHA-256",Y);return btoa(String.fromCharCode(...new Uint8Array(G))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function Oq0($,X,Y){return await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug as orgSlug","member.role"]).where("member.userId","=",X).where("member.organizationId","=",Y).executeTakeFirst()??null}function mR8($){let X=$.auth.user?.role;if(!X)return!1;return tp.includes(X)}function Lq0($){return $.auth.user?.role==="owner"}var oy1=()=>{let $=new Z6;return gR8($),$},_36;var jq0=z(()=>{HX();g80();m5();T5();j91();_36=new Map});function dR8($){if($==="claude-code")return lR8;if($==="codex")return cR8;return null}function b36($,X){return dR8($)?.[X]??null}var lR8,cR8;var f36=z(()=>{lR8={fast:{modelId:"claude-code:haiku",label:"Haiku 4.5"},smart:{modelId:"claude-code:sonnet",label:"Sonnet 4.6"},thinking:{modelId:"claude-code:opus",label:"Opus 4.7"}},cR8={fast:{modelId:"codex:gpt-5.4-mini",label:"GPT-5.4 Mini"},smart:{modelId:"codex:gpt-5.3-codex",label:"GPT-5.3 Codex"},thinking:{modelId:"codex:gpt-5.5",label:"GPT-5.5"}}});function y36($){return $.type==="tool-call"&&$.toolName==="todo_write"&&typeof $.toolCallId==="string"}function iR8($){return $.type==="tool-result"&&$.toolName==="todo_write"&&typeof $.toolCallId==="string"}function x36($){let X=null;for(let G=$.length-1;G>=0&&X===null;G--){let J=$[G].content;if(!Array.isArray(J))continue;for(let Z=J.length-1;Z>=0;Z--){let W=J[Z];if(y36(W)){X=W.toolCallId;break}}}if(X===null)return $;let Y=X;return $.map((G)=>{let Q=G.content;if(!Array.isArray(Q))return G;let J=Q.filter((Z)=>{if(y36(Z))return Z.toolCallId===Y;if(iR8(Z))return Z.toolCallId===Y;return!0});if(J.length===Q.length)return G;return{...G,content:J}})}function g36($){let X=$.filter((G)=>G.role==="system"),Y=$.find((G)=>G.role!=="system");return{systemMessages:X,requestMessage:Y}}function pR8($){let X=!1,Y=$.map((G)=>{if(G.role!=="assistant")return G;if(!G.parts.some((J)=>("state"in J)&&J.state==="approval-requested"))return G;return X=!0,{...G,parts:G.parts.map((J)=>{if(!("state"in J)||J.state!=="approval-requested"||!("approval"in J)||!J.approval)return J;return{...J,state:"output-denied",approval:{...J.approval,approved:!1,reason:"User sent a new message without approving this tool call."}}})}});return X?Y:$}function nR8($){let[X,Y]=$.reduce((G,Q)=>{if(Q.role==="system")G[0].push(Q);else G[1].push(Q);return G},[[],[]]);return{systemMessages:X,messages:Y}}async function rR8($,X){return await $.loadHistory(X)}function aR8($,X){let Y=$.filter((J)=>J.parts&&J.parts.length>0);if(!X)return Y;let G=Y.findIndex((J)=>J.id===X.id);return G>=0?[...Y.slice(0,G),X]:[...Y,X]}async function h36($,X,Y,G){let Q=await rR8($,G),J=aR8(Q,X);return[...Y,...J]}async function u36($,X){let Y=$.filter((B)=>B.role!=="assistant"||B.parts&&B.parts.length>0),G=await zX1({messages:Y}),Q=pR8(G),J=await AV(Q,{tools:X.tools,ignoreIncompleteToolCalls:!0}),{systemMessages:Z,messages:W}=nR8(J),H=x36(W),U=Ej0({messages:H,reasoning:"all",emptyMessages:"remove",toolCalls:"none"}).map((B)=>{if(B.role!=="assistant")return B;let N=Array.isArray(B.content)?B.content.filter((w)=>w.type!=="reasoning"&&w.type!=="thinking"&&w.type!=="redacted-reasoning").map((w)=>{let D=w;if("providerOptions"in D||"providerMetadata"in D){let{providerOptions:O,providerMetadata:j,...E}=D;if(D.type==="tool-call"){let P=j?.google,T=O?.google;return{...E,...P?{providerMetadata:{google:P}}:{},...T?{providerOptions:{google:T}}:{}}}return E}return w}):B.content;return{...B,content:Array.isArray(N)&&N.length===0?[{type:"text",text:""}]:N,providerOptions:void 0,providerMetadata:void 0}});return{systemMessages:Z,messages:U,originalMessages:G}}var sy1=z(()=>{q5()});function PW($){return`mesh-storage://${$}`}function Qh($){if(!$.startsWith("mesh-storage://"))return null;return $.slice(15)}function Eq0(){return/mesh-storage:\/\/([^\s"'<>[\]]+)/g}function tR8($,X,Y){return`${$}/api/${X}/files/${Y}`}function sR8($){return $.type==="file"&&"mediaType"in $&&typeof $.mediaType==="string"&&oR8.has($.mediaType)}function m36($){let X=$.match(/^data:([^;]+);base64,(.+)$/s);if(!X)return null;let[,Y,G]=X;try{let Q=atob(G),J=new Uint8Array(Q.length);for(let Z=0;Z<Q.length;Z++)J[Z]=Q.charCodeAt(Z);return{mimeType:Y,bytes:J}}catch{return null}}function l36($){return{"image/png":"png","image/jpeg":"jpg","image/gif":"gif","image/webp":"webp","image/svg+xml":"svg","application/pdf":"pdf","text/plain":"txt","text/html":"html","application/json":"json"}[$]??"bin"}async function c36($,X,Y,G){if(!G.objectStorage)return null;try{return await G.objectStorage.put(X,$,{contentType:Y}),X}catch(Q){return console.error("[file-materializer] Failed to upload file:",Q),null}}async function Jh($,X){if(!X.objectStorage)return null;try{return await X.objectStorage.presignedGetUrl($,eR8)}catch(Y){return console.error("[file-materializer] Failed to generate presigned URL:",Y),null}}async function d36($,X){if(!X.organization)return $;let Y=X.organization.slug;if(!Y)return $;let G=$.findLastIndex((D)=>D.role==="user");if(G===-1)return $;let Q=$[G],J=Q.parts.filter((D)=>D.type==="file"&&("url"in D)&&typeof D.url==="string"&&D.url.startsWith("data:"));if(J.length===0)return $;let W=(await Promise.all(J.map(async(D)=>{if(D.type!=="file"||!("url"in D)||typeof D.url!=="string")return null;let O=m36(D.url);if(!O)return null;let j=l36(O.mimeType),E=`chat-uploads/${crypto.randomUUID()}.${j}`,P=await c36(O.bytes,E,O.mimeType,X);if(!P)return null;let T="filename"in D&&typeof D.filename==="string"?D.filename:E;return{dataUrl:D.url,meshStorageUrl:PW(P),redirectUrl:tR8(X.baseUrl,Y,P),filename:T}}))).filter((D)=>D!==null);if(W.length===0)return $;let F=`[Uploaded files \u2014 use these URLs when calling tools]
 ${W.map((D)=>`- ${D.filename}: ${D.meshStorageUrl}`).join(`
 `)}`,U=new Map(W.map((D)=>[D.dataUrl,D.meshStorageUrl])),B=Q.parts.map((D)=>{if(D.type!=="file"||!("url"in D)||typeof D.url!=="string")return D;let O=U.get(D.url);if(!O)return D;return{...D,url:O}}),N=B.findIndex((D)=>D.type==="text"),w;if(N!==-1)w=B.map((D,O)=>{if(O!==N||D.type!=="text")return D;return{...D,text:`${F}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "2.348.2",
+  "version": "2.349.0",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {

package/dist/client/assets/Tool01-Vwudm-zy.js

@@ -1 +0,0 @@
-import{r as t}from"./index-CRD1iOrS.js";const i=({size:e=24,color:o="currentColor",...r})=>t.createElement("svg",{viewBox:"0 0 24 24",width:e,height:e,stroke:o,strokeWidth:"2",fill:"none",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",...r},t.createElement("path",{d:"M16 10H3m17-4H3m17 8H3m13 4H3"}));i.displayName="AlignLeft";const a=({size:e=24,color:o="currentColor",...r})=>t.createElement("svg",{viewBox:"0 0 24 24",width:e,height:e,stroke:o,strokeWidth:"2",fill:"none",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",...r},t.createElement("path",{d:"M12 12h.01m3.525 3.536c-4.686 4.686-10.068 6.902-12.02 4.95-1.953-1.953.263-7.335 4.949-12.021 4.686-4.687 10.068-6.903 12.02-4.95 1.953 1.952-.263 7.334-4.949 12.02Zm0-7.072c4.686 4.687 6.902 10.069 4.95 12.021-1.953 1.953-7.335-.263-12.021-4.95-4.686-4.686-6.902-10.068-4.95-12.02 1.953-1.953 7.335.263 12.021 4.95ZM12.499 12a.5.5 0 1 1-1 0 .5.5 0 0 1 1 0Z"}));a.displayName="Atom01";const n=({size:e=24,color:o="currentColor",...r})=>t.createElement("svg",{viewBox:"0 0 24 24",width:e,height:e,stroke:o,strokeWidth:"2",fill:"none",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",...r},t.createElement("path",{d:"m7 15 5 5 5-5M7 9l5-5 5 5"}));n.displayName="ChevronSelectorVertical";const c=({size:e=24,color:o="currentColor",...r})=>t.createElement("svg",{viewBox:"0 0 24 24",width:e,height:e,stroke:o,strokeWidth:"2",fill:"none",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",...r},t.createElement("path",{d:"M2.876 18.116c.046-.414.069-.62.131-.814a2 2 0 0 1 .234-.485c.111-.17.259-.317.553-.61L17 3a2.828 2.828 0 1 1 4 4L7.794 20.206c-.294.294-.442.442-.611.553a2 2 0 0 1-.485.233c-.193.063-.4.086-.814.132L2.5 21.5l.376-3.384Z"}));c.displayName="Edit01";const l=({size:e=24,color:o="currentColor",...r})=>t.createElement("svg",{viewBox:"0 0 24 24",width:e,height:e,stroke:o,strokeWidth:"2",fill:"none",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",...r},t.createElement("path",{d:"M16.2 21H6.931c-.605 0-.908 0-1.049-.12a.5.5 0 0 1-.173-.42c.014-.183.228-.397.657-.826l8.503-8.503c.396-.396.594-.594.822-.668a1 1 0 0 1 .618 0c.228.074.426.272.822.668L21 15v1.2M16.2 21c1.68 0 2.52 0 3.162-.327a3 3 0 0 0 1.311-1.311C21 18.72 21 17.88 21 16.2M16.2 21H7.8c-1.68 0-2.52 0-3.162-.327a3 3 0 0 1-1.311-1.311C3 18.72 3 17.88 3 16.2V7.8c0-1.68 0-2.52.327-3.162a3 3 0 0 1 1.311-1.311C5.28 3 6.12 3 7.8 3h8.4c1.68 0 2.52 0 3.162.327a3 3 0 0 1 1.311 1.311C21 5.28 21 6.12 21 7.8v8.4M10.5 8.5a2 2 0 1 1-4 0 2 2 0 0 1 4 0Z"}));l.displayName="Image01";const s=({size:e=24,color:o="currentColor",...r})=>t.createElement("svg",{viewBox:"0 0 24 24",width:e,height:e,stroke:o,strokeWidth:"2",fill:"none",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",...r},t.createElement("path",{d:"M13 2 4.093 12.688c-.348.418-.523.628-.525.804a.5.5 0 0 0 .185.397c.138.111.41.111.955.111H12l-1 8 8.907-10.688c.348-.418.523-.628.525-.804a.5.5 0 0 0-.185-.397c-.138-.111-.41-.111-.955-.111H12l1-8Z"}));s.displayName="Lightning01";const d=({size:e=24,color:o="currentColor",...r})=>t.createElement("svg",{viewBox:"0 0 24 24",width:e,height:e,stroke:o,strokeWidth:"2",fill:"none",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",...r},t.createElement("path",{d:"m6.5 13 .784 1.569c.266.53.399.796.576 1.026a3 3 0 0 0 .545.545c.23.177.495.31 1.026.575L11 17.5l-1.569.785c-.53.265-.796.398-1.026.575a3 3 0 0 0-.545.545c-.177.23-.31.495-.576 1.026L6.5 22l-.784-1.569c-.266-.53-.399-.796-.576-1.026a3 3 0 0 0-.545-.545c-.23-.177-.495-.31-1.026-.575L2 17.5l1.569-.785c.53-.265.796-.398 1.026-.575a3 3 0 0 0 .545-.545c.177-.23.31-.495.576-1.026L6.5 13ZM15 2l1.179 3.064c.282.734.423 1.1.642 1.409a3 3 0 0 0 .706.706c.309.22.675.36 1.409.642L22 9l-3.064 1.179c-.734.282-1.1.423-1.409.642a3 3 0 0 0-.706.706c-.22.309-.36.675-.642 1.409L15 16l-1.179-3.064c-.282-.734-.423-1.1-.642-1.409a3 3 0 0 0-.706-.706c-.309-.22-.675-.36-1.409-.642L8 9l3.064-1.179c.734-.282 1.1-.423 1.409-.642a3 3 0 0 0 .706-.706c.22-.309.36-.675.642-1.409L15 2Z"}));d.displayName="Stars01";const h=({size:e=24,color:o="currentColor",...r})=>t.createElement("svg",{viewBox:"0 0 24 24",width:e,height:e,stroke:o,strokeWidth:"2",fill:"none",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",...r},t.createElement("path",{d:"M15.631 7.631c-.396-.396-.594-.594-.668-.822a1 1 0 0 1 0-.618c.074-.228.272-.426.668-.822L18.47 2.53a6 6 0 0 0-8.3 6.895c.12.49.179.734.168.888a.849.849 0 0 1-.11.392c-.07.138-.207.274-.48.547L3.5 17.5a2.121 2.121 0 0 0 3 3l6.248-6.248c.273-.273.41-.41.547-.48a.849.849 0 0 1 .392-.11c.154-.011.399.049.888.168a6 6 0 0 0 6.895-8.3l-2.84 2.84c-.396.396-.594.594-.822.668a1 1 0 0 1-.618 0c-.228-.074-.426-.272-.822-.668l-.738-.738Z"}));h.displayName="Tool01";export{a,c as b,l as c,h as d,i as e,n as f,s as i,d as t};