decocms 2.348.2 → 2.349.1

package/dist/server/node_modules/ansi-styles/index.js

@@ -0,0 +1,223 @@
+const ANSI_BACKGROUND_OFFSET = 10;
+
+const wrapAnsi16 = (offset = 0) => code => `\u001B[${code + offset}m`;
+
+const wrapAnsi256 = (offset = 0) => code => `\u001B[${38 + offset};5;${code}m`;
+
+const wrapAnsi16m = (offset = 0) => (red, green, blue) => `\u001B[${38 + offset};2;${red};${green};${blue}m`;
+
+const styles = {
+	modifier: {
+		reset: [0, 0],
+		// 21 isn't widely supported and 22 does the same thing
+		bold: [1, 22],
+		dim: [2, 22],
+		italic: [3, 23],
+		underline: [4, 24],
+		overline: [53, 55],
+		inverse: [7, 27],
+		hidden: [8, 28],
+		strikethrough: [9, 29],
+	},
+	color: {
+		black: [30, 39],
+		red: [31, 39],
+		green: [32, 39],
+		yellow: [33, 39],
+		blue: [34, 39],
+		magenta: [35, 39],
+		cyan: [36, 39],
+		white: [37, 39],
+
+		// Bright color
+		blackBright: [90, 39],
+		gray: [90, 39], // Alias of `blackBright`
+		grey: [90, 39], // Alias of `blackBright`
+		redBright: [91, 39],
+		greenBright: [92, 39],
+		yellowBright: [93, 39],
+		blueBright: [94, 39],
+		magentaBright: [95, 39],
+		cyanBright: [96, 39],
+		whiteBright: [97, 39],
+	},
+	bgColor: {
+		bgBlack: [40, 49],
+		bgRed: [41, 49],
+		bgGreen: [42, 49],
+		bgYellow: [43, 49],
+		bgBlue: [44, 49],
+		bgMagenta: [45, 49],
+		bgCyan: [46, 49],
+		bgWhite: [47, 49],
+
+		// Bright color
+		bgBlackBright: [100, 49],
+		bgGray: [100, 49], // Alias of `bgBlackBright`
+		bgGrey: [100, 49], // Alias of `bgBlackBright`
+		bgRedBright: [101, 49],
+		bgGreenBright: [102, 49],
+		bgYellowBright: [103, 49],
+		bgBlueBright: [104, 49],
+		bgMagentaBright: [105, 49],
+		bgCyanBright: [106, 49],
+		bgWhiteBright: [107, 49],
+	},
+};
+
+export const modifierNames = Object.keys(styles.modifier);
+export const foregroundColorNames = Object.keys(styles.color);
+export const backgroundColorNames = Object.keys(styles.bgColor);
+export const colorNames = [...foregroundColorNames, ...backgroundColorNames];
+
+function assembleStyles() {
+	const codes = new Map();
+
+	for (const [groupName, group] of Object.entries(styles)) {
+		for (const [styleName, style] of Object.entries(group)) {
+			styles[styleName] = {
+				open: `\u001B[${style[0]}m`,
+				close: `\u001B[${style[1]}m`,
+			};
+
+			group[styleName] = styles[styleName];
+
+			codes.set(style[0], style[1]);
+		}
+
+		Object.defineProperty(styles, groupName, {
+			value: group,
+			enumerable: false,
+		});
+	}
+
+	Object.defineProperty(styles, 'codes', {
+		value: codes,
+		enumerable: false,
+	});
+
+	styles.color.close = '\u001B[39m';
+	styles.bgColor.close = '\u001B[49m';
+
+	styles.color.ansi = wrapAnsi16();
+	styles.color.ansi256 = wrapAnsi256();
+	styles.color.ansi16m = wrapAnsi16m();
+	styles.bgColor.ansi = wrapAnsi16(ANSI_BACKGROUND_OFFSET);
+	styles.bgColor.ansi256 = wrapAnsi256(ANSI_BACKGROUND_OFFSET);
+	styles.bgColor.ansi16m = wrapAnsi16m(ANSI_BACKGROUND_OFFSET);
+
+	// From https://github.com/Qix-/color-convert/blob/3f0e0d4e92e235796ccb17f6e85c72094a651f49/conversions.js
+	Object.defineProperties(styles, {
+		rgbToAnsi256: {
+			value(red, green, blue) {
+				// We use the extended greyscale palette here, with the exception of
+				// black and white. normal palette only has 4 greyscale shades.
+				if (red === green && green === blue) {
+					if (red < 8) {
+						return 16;
+					}
+
+					if (red > 248) {
+						return 231;
+					}
+
+					return Math.round(((red - 8) / 247) * 24) + 232;
+				}
+
+				return 16
+					+ (36 * Math.round(red / 255 * 5))
+					+ (6 * Math.round(green / 255 * 5))
+					+ Math.round(blue / 255 * 5);
+			},
+			enumerable: false,
+		},
+		hexToRgb: {
+			value(hex) {
+				const matches = /[a-f\d]{6}|[a-f\d]{3}/i.exec(hex.toString(16));
+				if (!matches) {
+					return [0, 0, 0];
+				}
+
+				let [colorString] = matches;
+
+				if (colorString.length === 3) {
+					colorString = [...colorString].map(character => character + character).join('');
+				}
+
+				const integer = Number.parseInt(colorString, 16);
+
+				return [
+					/* eslint-disable no-bitwise */
+					(integer >> 16) & 0xFF,
+					(integer >> 8) & 0xFF,
+					integer & 0xFF,
+					/* eslint-enable no-bitwise */
+				];
+			},
+			enumerable: false,
+		},
+		hexToAnsi256: {
+			value: hex => styles.rgbToAnsi256(...styles.hexToRgb(hex)),
+			enumerable: false,
+		},
+		ansi256ToAnsi: {
+			value(code) {
+				if (code < 8) {
+					return 30 + code;
+				}
+
+				if (code < 16) {
+					return 90 + (code - 8);
+				}
+
+				let red;
+				let green;
+				let blue;
+
+				if (code >= 232) {
+					red = (((code - 232) * 10) + 8) / 255;
+					green = red;
+					blue = red;
+				} else {
+					code -= 16;
+
+					const remainder = code % 36;
+
+					red = Math.floor(code / 36) / 5;
+					green = Math.floor(remainder / 6) / 5;
+					blue = (remainder % 6) / 5;
+				}
+
+				const value = Math.max(red, green, blue) * 2;
+
+				if (value === 0) {
+					return 30;
+				}
+
+				// eslint-disable-next-line no-bitwise
+				let result = 30 + ((Math.round(blue) << 2) | (Math.round(green) << 1) | Math.round(red));
+
+				if (value === 2) {
+					result += 60;
+				}
+
+				return result;
+			},
+			enumerable: false,
+		},
+		rgbToAnsi: {
+			value: (red, green, blue) => styles.ansi256ToAnsi(styles.rgbToAnsi256(red, green, blue)),
+			enumerable: false,
+		},
+		hexToAnsi: {
+			value: hex => styles.ansi256ToAnsi(styles.hexToAnsi256(hex)),
+			enumerable: false,
+		},
+	});
+
+	return styles;
+}
+
+const ansiStyles = assembleStyles();
+
+export default ansiStyles;

package/dist/server/node_modules/ansi-styles/license

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/dist/server/node_modules/ansi-styles/package.json

@@ -0,0 +1,54 @@
+{
+	"name": "ansi-styles",
+	"version": "6.2.3",
+	"description": "ANSI escape codes for styling strings in the terminal",
+	"license": "MIT",
+	"repository": "chalk/ansi-styles",
+	"funding": "https://github.com/chalk/ansi-styles?sponsor=1",
+	"author": {
+		"name": "Sindre Sorhus",
+		"email": "sindresorhus@gmail.com",
+		"url": "https://sindresorhus.com"
+	},
+	"type": "module",
+	"exports": "./index.js",
+	"engines": {
+		"node": ">=12"
+	},
+	"scripts": {
+		"test": "xo && ava && tsd",
+		"screenshot": "svg-term --command='node screenshot' --out=screenshot.svg --padding=3 --width=55 --height=3 --at=1000 --no-cursor"
+	},
+	"files": [
+		"index.js",
+		"index.d.ts"
+	],
+	"keywords": [
+		"ansi",
+		"styles",
+		"color",
+		"colour",
+		"colors",
+		"terminal",
+		"console",
+		"cli",
+		"string",
+		"tty",
+		"escape",
+		"formatting",
+		"rgb",
+		"256",
+		"shell",
+		"xterm",
+		"log",
+		"logging",
+		"command-line",
+		"text"
+	],
+	"devDependencies": {
+		"ava": "^6.1.3",
+		"svg-term-cli": "^2.1.1",
+		"tsd": "^0.31.1",
+		"xo": "^0.58.0"
+	}
+}

package/dist/server/node_modules/ansi-styles/readme.md

@@ -0,0 +1,173 @@
+# ansi-styles
+
+> [ANSI escape codes](https://en.wikipedia.org/wiki/ANSI_escape_code#Colors_and_Styles) for styling strings in the terminal
+
+You probably want the higher-level [chalk](https://github.com/chalk/chalk) module for styling your strings.
+
+![](screenshot.png)
+
+## Install
+
+```sh
+npm install ansi-styles
+```
+
+## Usage
+
+```js
+import styles from 'ansi-styles';
+
+console.log(`${styles.green.open}Hello world!${styles.green.close}`);
+
+
+// Color conversion between 256/truecolor
+// NOTE: When converting from truecolor to 256 colors, the original color
+//       may be degraded to fit the new color palette. This means terminals
+//       that do not support 16 million colors will best-match the
+//       original color.
+console.log(`${styles.color.ansi(styles.rgbToAnsi(199, 20, 250))}Hello World${styles.color.close}`)
+console.log(`${styles.color.ansi256(styles.rgbToAnsi256(199, 20, 250))}Hello World${styles.color.close}`)
+console.log(`${styles.color.ansi16m(...styles.hexToRgb('#abcdef'))}Hello World${styles.color.close}`)
+```
+
+## API
+
+### `open` and `close`
+
+Each style has an `open` and `close` property.
+
+### `modifierNames`, `foregroundColorNames`, `backgroundColorNames`, and `colorNames`
+
+All supported style strings are exposed as an array of strings for convenience. `colorNames` is the combination of `foregroundColorNames` and `backgroundColorNames`.
+
+This can be useful if you need to validate input:
+
+```js
+import {modifierNames, foregroundColorNames} from 'ansi-styles';
+
+console.log(modifierNames.includes('bold'));
+//=> true
+
+console.log(foregroundColorNames.includes('pink'));
+//=> false
+```
+
+## Styles
+
+### Modifiers
+
+- `reset`
+- `bold`
+- `dim`
+- `italic` *(Not widely supported)*
+- `underline`
+- `overline` *Supported on VTE-based terminals, the GNOME terminal, mintty, and Git Bash.*
+- `inverse`
+- `hidden`
+- `strikethrough` *(Not widely supported)*
+
+### Colors
+
+- `black`
+- `red`
+- `green`
+- `yellow`
+- `blue`
+- `magenta`
+- `cyan`
+- `white`
+- `blackBright` (alias: `gray`, `grey`)
+- `redBright`
+- `greenBright`
+- `yellowBright`
+- `blueBright`
+- `magentaBright`
+- `cyanBright`
+- `whiteBright`
+
+### Background colors
+
+- `bgBlack`
+- `bgRed`
+- `bgGreen`
+- `bgYellow`
+- `bgBlue`
+- `bgMagenta`
+- `bgCyan`
+- `bgWhite`
+- `bgBlackBright` (alias: `bgGray`, `bgGrey`)
+- `bgRedBright`
+- `bgGreenBright`
+- `bgYellowBright`
+- `bgBlueBright`
+- `bgMagentaBright`
+- `bgCyanBright`
+- `bgWhiteBright`
+
+## Advanced usage
+
+By default, you get a map of styles, but the styles are also available as groups. They are non-enumerable so they don't show up unless you access them explicitly. This makes it easier to expose only a subset in a higher-level module.
+
+- `styles.modifier`
+- `styles.color`
+- `styles.bgColor`
+
+###### Example
+
+```js
+import styles from 'ansi-styles';
+
+console.log(styles.color.green.open);
+```
+
+Raw escape codes (i.e. without the CSI escape prefix `\u001B[` and render mode postfix `m`) are available under `styles.codes`, which returns a `Map` with the open codes as keys and close codes as values.
+
+###### Example
+
+```js
+import styles from 'ansi-styles';
+
+console.log(styles.codes.get(36));
+//=> 39
+```
+
+## 16 / 256 / 16 million (TrueColor) support
+
+`ansi-styles` allows converting between various color formats and ANSI escapes, with support for 16, 256 and [16 million colors](https://gist.github.com/XVilka/8346728).
+
+The following color spaces are supported:
+
+- `rgb`
+- `hex`
+- `ansi256`
+- `ansi`
+
+To use these, call the associated conversion function with the intended output, for example:
+
+```js
+import styles from 'ansi-styles';
+
+styles.color.ansi(styles.rgbToAnsi(100, 200, 15)); // RGB to 16 color ansi foreground code
+styles.bgColor.ansi(styles.hexToAnsi('#C0FFEE')); // HEX to 16 color ansi foreground code
+
+styles.color.ansi256(styles.rgbToAnsi256(100, 200, 15)); // RGB to 256 color ansi foreground code
+styles.bgColor.ansi256(styles.hexToAnsi256('#C0FFEE')); // HEX to 256 color ansi foreground code
+
+styles.color.ansi16m(100, 200, 15); // RGB to 16 million color foreground code
+styles.bgColor.ansi16m(...styles.hexToRgb('#C0FFEE')); // Hex (RGB) to 16 million color foreground code
+```
+
+## Related
+
+- [ansi-escapes](https://github.com/sindresorhus/ansi-escapes) - ANSI escape codes for manipulating the terminal
+
+## Maintainers
+
+- [Sindre Sorhus](https://github.com/sindresorhus)
+- [Josh Junon](https://github.com/qix-)
+
+## For enterprise
+
+Available as part of the Tidelift Subscription.
+
+The maintainers of `ansi-styles` and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. [Learn more.](https://tidelift.com/subscription/pkg/npm-ansi-styles?utm_source=npm-ansi-styles&utm_medium=referral&utm_campaign=enterprise&utm_term=repo)

package/dist/server/server.js

@@ -2885,7 +2885,7 @@ Caused by: ${X.stack}`}};$h=class $h extends uY{constructor($,X){super($,X);this
           AND "organizationId" NOT IN (
             SELECT "organizationId" FROM "member" WHERE "userId" = ${H.id}
           )
-      `.execute(F),await m1`DELETE FROM "member" WHERE "userId" = ${X.id}`.execute(F),await m1`DELETE FROM "user" WHERE "id" = ${X.id}`.execute(F)})}catch(F){console.error("[SSO] Failed to merge duplicate user:",F)}}var BR8=($)=>{return{trustEmailVerified:!0,provisionUser:wR8,defaultSSO:[{domain:$.domain,providerId:$.providerId,oidcConfig:{issuer:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/v2.0`,pkce:!0,clientId:$.MS_CLIENT_ID,clientSecret:$.MS_CLIENT_SECRET,discoveryEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/v2.0/.well-known/openid-configuration`,authorizationEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/oauth2/v2.0/authorize`,tokenEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/oauth2/v2.0/token`,jwksEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/discovery/v2.0/keys`,userInfoEndpoint:"https://graph.microsoft.com/oidc/userinfo",tokenEndpointAuthentication:"client_secret_post",scopes:$.scopes,mapping:{id:"sub",email:"email",emailVerified:"email_verified",name:"name",image:"picture",extraFields:{emailVerified:"email_verified",oid:"oid"}}}}]}},NR8=($)=>{return{trustEmailVerified:!0,defaultSSO:[{domain:$.domain,providerId:$.providerId,oidcConfig:{issuer:"https://accounts.google.com",pkce:!0,clientId:$.GOOGLE_CLIENT_ID,clientSecret:$.GOOGLE_CLIENT_SECRET,discoveryEndpoint:"https://accounts.google.com/.well-known/openid-configuration",authorizationEndpoint:"https://accounts.google.com/o/oauth2/v2/auth",tokenEndpoint:"https://oauth2.googleapis.com/token",jwksEndpoint:"https://www.googleapis.com/oauth2/v3/certs",userInfoEndpoint:"https://openidconnect.googleapis.com/v1/userinfo",tokenEndpointAuthentication:"client_secret_post",scopes:$.scopes,mapping:{id:"sub",email:"email",emailVerified:"email_verified",name:"name",image:"picture",extraFields:{emailVerified:"email_verified",hd:"hd"}}}}]}},X36=($)=>{if($.providerId==="microsoft")return BR8($);if($.providerId==="google")return NR8($);throw Error(`Unsupported provider: ${$.providerId}`)};var Y36=z(()=>{m5();CX();BD()});var K36={};R6(K36,{resetPasswordEnabled:()=>py1,authConfig:()=>p8,auth:()=>n5,GENERIC_EMAIL_DOMAINS:()=>$z});function DR8($){return $.toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}function zR8(){let $=Math.floor(Math.random()*Q36.length),X=Math.floor(Math.random()*G36.length),Y=Q36[$]??"deco",G=G36[X]??"studio";return`${Y}-${G}`}function VR8(){let $=[WY1];try{let X=new URL(WY1);if(X.hostname==="localhost")$.push(WY1.replace("localhost","127.0.0.1"));else if(X.hostname==="127.0.0.1")$.push(WY1.replace("127.0.0.1","localhost"))}catch{}return $}var G36,Q36,OR8,LR8,iy1,jR8,ER8,PR8,J36,p8,W36=void 0,Zq0=void 0,py1=!1,qR8,$z,AR8,TR8,WY1,Z36,n5;var Xz=z(()=>{T5();l80();Yq4();cA4();eQ0();bZ0();UZ0();cD1();RV4();xZ0();$X();UD();mI4();BD();tI4();iz1();sI4();eW6();$36();j91();Y36();G36=["labs","agent","studio","workspace","systems","core","cloud","works"],Q36=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"];OR8=Object.values(G11()).map(($)=>$.map((X)=>X.name)).flat(),LR8={...vd,self:["*",...OR8]},iy1=jB(LR8),jR8=iy1.newRole({self:["*"],...Cd.statements}),ER8=iy1.newRole({self:["*"],...Cd.statements}),PR8=iy1.newRole({self:["*"],...Cd.statements}),J36=Object.values(G11()).map(($)=>$.map((X)=>`self:${X.name}`)).flat(),p8=T2().auth;if(p8.inviteEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=k2(p8.emailProviders,p8.inviteEmailProviderId);if($){let X=S2($);W36=async(Y)=>{let G=Y.inviter.user?.name||Y.inviter.user?.email,Q=`${cZ()}/auth/accept-invitation?invitationId=${Y.invitation.id}&redirectTo=/${Y.organization.slug}`;await X({to:Y.email,subject:`You've been invited to join ${Y.organization.name}`,html:v2({preheader:`${G} has invited you to join ${Y.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${G}</strong> has invited you to join <strong>${Y.organization.name}</strong> on deco Studio.`,body:D61("Accept invitation",Q),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(p8.resetPasswordEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=k2(p8.emailProviders,p8.resetPasswordEmailProviderId);if($){let X=S2($);py1=!0,Zq0=async({user:Y,url:G})=>{await X({to:Y.email,subject:"Reset your password",html:v2({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:D61("Reset password",G)+pz1("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}qR8=[dJ0({organizationCreation:{afterCreate:async($)=>{await sW6($.organization.id,$.member.userId)}},ac:iy1,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:tp,resourceNameValidation:($)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test($)}}},roles:{user:jR8,admin:ER8,owner:PR8},sendInvitationEmail:W36}),AZ0({loginPage:"/login",oidcConfig:{scopes:J36,metadata:{scopes_supported:J36},loginPage:"/login"}}),XZ0({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:($)=>{if($.headers?.get("X-MCP-Session-Auth")==="true")return null;let Y=$.headers?.get("Authorization");if(Y?.startsWith("Bearer "))return Y.replace("Bearer ","").trim();return null},permissions:{defaultPermissions:{self:["ORGANIZATION_LIST","ORGANIZATION_GET","ORGANIZATION_MEMBER_LIST","COLLECTION_CONNECTIONS_LIST","COLLECTION_CONNECTIONS_GET","API_KEY_CREATE","API_KEY_LIST"]}},rateLimit:{enabled:!1}}),iD1({defaultRole:"user",adminRoles:["admin","owner"],roles:{...D2,owner:mD1}}),IZ0(),wZ0({jwt:{expirationTime:"5m"}}),Xq4(p8.ssoConfig?X36(p8.ssoConfig):void 0),...p8.magicLinkConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[zZ0(oI4(p8.magicLinkConfig,p8.emailProviders))]:[],...p8.emailOtpConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[FZ0(aI4(p8.emailOtpConfig,p8.emailProviders))]:[]],$z=new Set(["gmail.com","googlemail.com","outlook.com","hotmail.com","live.com","yahoo.com","yahoo.co.uk","icloud.com","me.com","mac.com","aol.com","protonmail.com","proton.me","zoho.com","yandex.com","mail.com","gmx.com","gmx.net","tutanota.com","fastmail.com"]),AR8=w61(),TR8=pI4(AR8),WY1=cZ();Z36=f4(),n5=sQ0({secret:Z36.betterAuthSecret||"deco-default-secret-k7x9m2p4q8w3n5v6",baseURL:WY1,trustedOrigins:VR8(),database:TR8,socialProviders:p8.socialProviders,...p8.ssoConfig&&{account:{accountLinking:{trustedProviders:[p8.ssoConfig.providerId]}}},emailAndPassword:{enabled:p8.emailAndPassword.enabled,...Zq0&&{sendResetPassword:Zq0}},rateLimit:{enabled:!Z36.disableRateLimit,window:60,max:1e4},plugins:qR8,databaseHooks:{user:{create:{after:async($)=>{if(Jq0({id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified}),j6.capture({distinctId:$.id,event:"user_signed_up",properties:{email:$.email,email_domain:$.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!$.emailVerified,has_name:!!$.name}}),$.emailVerified){let G=$.email?.split("@")[1]?.toLowerCase();if(G&&!$z.has(G))return}if(T2().autoCreateOrganizationOnSignup===!1)return;let X=$.name?$.name.split(" ")[0]:$.email.split("@")[0],Y=3;for(let G=0;G<Y;G++){let Q=`${X} ${zR8()}`,J=DR8(Q);try{let W=(await n5.api.createOrganization({body:{name:Q,slug:J,userId:$.id}}))?.id??void 0;if(W)j6.groupIdentify({groupType:"organization",groupKey:W,properties:{name:Q,slug:J,created_at:new Date().toISOString(),created_via:"signup_default"}}),j6.capture({distinctId:$.id,event:"organization_created",groups:{organization:W},properties:{organization_id:W,organization_slug:J,created_via:"signup_default"}});return}catch(Z){if(!(Z instanceof Error&&("body"in Z)&&Z.body?.code==="ORGANIZATION_ALREADY_EXISTS")||G===Y-1){console.error("Failed to create default organization:",Z);return}}}}}},session:{create:{after:async($)=>{let X=await fX().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",$.userId).executeTakeFirst();if(!X)return;Jq0({id:X.id,email:X.email,name:X.name??null,emailVerified:!!X.emailVerified})}}}}})});function Wq0($,X){return`${$}:${X}`}function H36($){let X=$?.ttlMs??120000,Y=$?.maxSize??1e4,G=new Map;function Q(){if(G.size<=Y)return;let J=Date.now();for(let[Z,W]of G)if(W.expiresAt<=J)G.delete(Z);if(G.size>Y){let Z=G.size-Y,W=0;for(let H of G.keys()){if(W>=Z)break;G.delete(H),W++}}}return{get(J,Z){let W=Wq0(J,Z),H=G.get(W);if(!H)return;if(H.expiresAt<=Date.now()){G.delete(W);return}return H.role},set(J,Z,W){let H=Wq0(J,Z);G.set(H,{role:W,expiresAt:Date.now()+X,organizationId:Z}),Q()},invalidate(J,Z){G.delete(Wq0(J,Z))},invalidateOrg(J){for(let[Z,W]of G)if(W.organizationId===J)G.delete(Z)}}}var F36=()=>{};var Kq0=()=>{};var U36=()=>{};var MR8,PRY;var B36=z(()=>{F36();Kq0();dO();U36();MR8={br:".br",zstd:".zst",gzip:".gz"},PRY=Object.keys(MR8)});var N36=z(()=>{B36()});var w36=()=>{};var D36=z(()=>{w36()});var z36=()=>{};var O36=z(()=>{S80()});var Hq0=z(()=>{iO();O36()});var Fq0="x-hono-disable-ssg",uRY;var Uq0=z(()=>{Hq0();uRY=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[Fq0]:"true"}})}catch{return null}})()});var L36=z(()=>{WU1()});var Bq0=z(()=>{L36()});var j36=z(()=>{D36();z36();Kq0();Uq0();Bq0();Hq0()});var E36=z(()=>{Uq0();Bq0();j36()});var qSY;var P36=z(()=>{E36();({write:qSY}=Bun)});var SR8=class{#$;constructor($){this.#$=$,this.raw=$.raw,this.url=$.url?new URL($.url):null,this.protocol=$.protocol??null}send($,X){this.#$.send($,X??{})}raw;binaryType="arraybuffer";get readyState(){return this.#$.readyState}url;protocol;close($,X){this.#$.close($,X)}},q36=($)=>{return(...X)=>{if(typeof X[0]==="function"){let[Y,G]=X;return async function(J,Z){let W=await Y(J),H=await $(J,W,G);if(H)return H;await Z()}}else{let[Y,G,Q]=X;return(async()=>{let J=await $(Y,G,Q);if(!J)throw Error("Failed to upgrade WebSocket");return J})()}}};var A36=()=>{};var KY1=($)=>("server"in $.env)?$.env.server:$.env;var ny1=()=>{};var kR8;var T36=z(()=>{A36();ny1();kR8=q36(($,X)=>{let Y=KY1($);if(!Y)throw TypeError("env has to include the 2nd argument of fetch.");if(Y.upgrade($.req.raw,{data:{events:X,url:new URL($.req.url),protocol:$.req.url}}))return new Response(null);return})});var Nq0=($)=>{let X=KY1($);if(!X)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof X.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let Y=X.requestIP($.req.raw);if(!Y)return{remote:{}};return{remote:{address:Y.address,addressType:Y.family==="IPv6"||Y.family==="IPv4"?Y.family:void 0,port:Y.port}}};var V36=z(()=>{ny1()});var M36=z(()=>{N36();P36();T36();V36();ny1()});var I36;var R36=z(()=>{I36={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});var ay1={};R6(ay1,{waitForSeed:()=>xR8,seedLocalMode:()=>bR8,markSeedComplete:()=>yR8,isLocalMode:()=>Gh,getLocalAdminUser:()=>wq0,getLocalAdminPassword:()=>ry1});import{userInfo as vR8}from"os";async function ry1(){return f4().betterAuthSecret||"local-mode-default"}function S36(){try{return vR8().username||"local"}catch{return"local"}}function CR8($){return $.charAt(0).toUpperCase()+$.slice(1)}async function _R8(){let $=fX(),X=await $.db.selectFrom("user").select($.db.fn.countAll().as("count")).executeTakeFirst();return Number(X?.count??0)===0}async function bR8(){if(!await _R8())return!1;let X=S36(),Y=`${X}@localhost.mesh`,G=CR8(X),Q=await ry1(),J=await n5.api.signUpEmail({body:{email:Y,password:Q,name:G}});if(!J?.user?.id)throw Error("Failed to create local admin user");let Z=J.user.id,W=fX();await W.db.updateTable("user").set({role:"admin"}).where("id","=",Z).execute();let H=`${X}-local`.toLowerCase().replace(/[^a-z0-9-]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,""),F=`${G} Local`;return await W.db.updateTable("organization").set({name:F,slug:H}).where("id","in",(U)=>U.selectFrom("member").select("organizationId").where("userId","=",Z)).execute(),!0}async function wq0(){let $=fX(),X=`${S36()}@localhost.mesh`;return $.db.selectFrom("user").where("email","=",X).selectAll().executeTakeFirst()}function Gh(){return f4().localMode}function yR8(){k36()}function xR8(){return fR8}var k36,fR8;var wr=z(()=>{BD();T5();Xz();fR8=new Promise(($)=>{if(k36=$,!Gh())$()})});function v36(){let $=Object.keys(p8.socialProviders??{}),X=$.length>0,Y=$.map((Q)=>({name:Q,icon:I36[Q].icon})),G=f4().localMode;return{emailAndPassword:{enabled:p8.emailAndPassword?.enabled??!1},magicLink:{enabled:p8.magicLinkConfig?.enabled??!1},emailOtp:{enabled:p8.emailOtpConfig?.enabled??!1},resetPassword:{enabled:py1},socialProviders:{enabled:X,providers:Y},sso:p8.ssoConfig?{enabled:!0,providerId:p8.ssoConfig.providerId}:{enabled:!1},stdioEnabled:G,localMode:Gh()}}var Dr,C36;var Dq0=z(()=>{HX();M36();$X();T5();Xz();BD();Cz0();sB0();R36();wr();Dr=new Z6;Dr.post("/local-session",async($)=>{if(!Gh())return $.json({success:!1,error:"Local mode is not active"},403);let X;try{X=Nq0($).remote.address}catch{}if(!(X==="127.0.0.1"||X==="::1"||X==="::ffff:127.0.0.1"))return $.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:G}=await Promise.resolve().then(() => (wr(),ay1));await G();let{auth:Q}=await Promise.resolve().then(() => (Xz(),K36)),J=await wq0();if(!J)return $.json({success:!1,error:"Local admin user not found"},500);let Z=await ry1();return await Q.api.signInEmail({body:{email:J.email,password:Z},asResponse:!0})}catch(G){return console.error("Failed to create local session:",G),$.json({success:!1,error:G instanceof Error?G.message:"Failed to create local session"},500)}});Dr.get("/domain-lookup",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({found:!1,organizations:[]});let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({found:!1,organizations:[]});try{let Q=await new XE(fX().db).getAllByDomain(Y);if(Q.length===0)return $.json({found:!1,organizations:[]});let J=await fX().db.selectFrom("organization").select(["id","name","slug","logo"]).where("id","in",Q.map((H)=>H.organizationId)).execute(),Z=new Map(J.map((H)=>[H.id,H])),W=Q.map((H)=>{let F=Z.get(H.organizationId);if(!F)return null;return{id:F.id,name:F.name,slug:F.slug,logo:F.logo,autoJoinEnabled:H.autoJoinEnabled}}).filter((H)=>H!==null);return $.json({found:W.length>0,organizations:W})}catch(G){return console.error("[Auth] Domain lookup failed:",G),$.json({success:!1,error:"Domain lookup failed"},500)}});Dr.post("/domain-join",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({success:!1,error:"Email must be verified to join"},403);let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({success:!1,error:"Generic email domains cannot auto-join"},403);let G=await $.req.json().catch(()=>({})),Q=typeof G.organizationSlug==="string"&&G.organizationSlug.trim()?G.organizationSlug.trim():null;try{let J=fX().db,H=(await new XE(J).getAllByDomain(Y)).filter((U)=>U.autoJoinEnabled);if(H.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let F;if(Q){let U=await J.selectFrom("organization").select(["id","slug"]).where("slug","=",Q).executeTakeFirst();if(!U||!H.some((B)=>B.organizationId===U.id))return $.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);F=U}else if(H.length===1){let U=await J.selectFrom("organization").select(["id","slug"]).where("id","=",H[0].organizationId).executeTakeFirst();if(!U)return $.json({success:!1,error:"Organization not found"},404);F=U}else return $.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await n5.api.addMember({body:{userId:X.user.id,role:"user",organizationId:F.id}})}catch(U){if(!(U instanceof Error?U.message.toLowerCase():"").includes("already a member"))return console.error("[Auth] Domain join addMember failed:",U),$.json({success:!1,error:"Failed to join organization"},500)}return j6.capture({distinctId:X.user.id,event:"organization_domain_joined",groups:{organization:F.id},properties:{organization_id:F.id,organization_slug:F.slug,email_domain:Y}}),$.json({success:!0,slug:F.slug})}catch(J){return j6.captureException(J,X.user.id),console.error("[Auth] Domain join failed:",J),$.json({success:!1,error:"Failed to join organization"},500)}});Dr.post("/domain-setup",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({success:!1,error:"Email must be verified"},403);let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({success:!1,error:"Corporate email required"},403);let G=await $.req.json().catch(()=>({})),Q=typeof G.name==="string"&&G.name.trim().length>0?G.name.trim():null,J=typeof G.logo==="string"&&G.logo.length>0?G.logo:null,Z=G.claimDomain!==!1;try{let W=fX().db,H=new XE(W),F=await H.getAllByDomain(Y);if(F.length>0){let T=await W.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",X.user.id).where("member.organizationId","in",F.map((I)=>I.organizationId)).executeTakeFirst();if(T)return $.json({success:!0,slug:T.slug,alreadyExists:!0})}let U=Y.split(".")[0]??Y,B=Q??U.charAt(0).toUpperCase()+U.slice(1),N=(Q??U).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||U.toLowerCase().replace(/[^a-z0-9-]/g,""),w=null;for(let I=0;I<3;I++){let M=I===0?"":`-${Math.random().toString(36).slice(2,6)}`,R=I===0?B:`${B}${M}`,S=`${N}${M}`;try{w=await n5.api.createOrganization({body:{name:R,slug:S,userId:X.user.id}});break}catch(C){if(!(C instanceof Error&&("body"in C)&&C.body?.code==="ORGANIZATION_ALREADY_EXISTS")||I===2)throw C}}if(!w?.id)throw Error("Failed to create organization");let D=w.id;if(Z)await H.setDomain(D,Y,!0);let O=!1,j=null,E=null;try{let T=f4().firecrawlApiKey;if(T){let I=await Yq1(Y,T,B);if(I){let M=new z91(fX().db),R=await M.create(D,I);if(await M.setDefault(R.id,D),O=!0,I.name&&I.name!==B)j=I.name;E=I.favicon??I.logo??null}}}catch(T){console.error("[Auth] Brand extraction failed (non-fatal):",T)}let P={};if(!Q&&j)P.name=j;if(J)P.logo=J;else if(E)P.logo=E;if(Object.keys(P).length>0)try{await n5.api.updateOrganization({headers:$.req.raw.headers,body:{organizationId:D,data:P}})}catch(T){console.error("[Auth] Org update failed (non-fatal):",T)}return j6.identify({distinctId:X.user.id,properties:{email:X.user.email,$set:{email:X.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),j6.groupIdentify({groupType:"organization",groupKey:D,properties:{name:w.slug??N,slug:w.slug??N,email_domain:Y,brand_extracted:O,created_at:new Date().toISOString()}}),j6.capture({distinctId:X.user.id,event:"organization_created",groups:{organization:D},properties:{organization_id:D,organization_slug:w.slug??N,email_domain:Y,brand_extracted:O}}),$.json({success:!0,slug:w.slug??N,brandExtracted:O})}catch(W){return j6.captureException(W,X.user?.id),console.error("[Auth] Domain setup failed:",W),$.json({success:!1,error:"Failed to set up organization"},500)}});Dr.get("/org-access-status/:slug",async($)=>{let X=$.req.param("slug"),Y=await n5.api.getSession({headers:$.req.raw.headers});if(!Y?.user)return $.json({success:!1,error:"Authentication required"},401);let G=fX().db,Q=await G.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",X).executeTakeFirst();if(!Q)return $.json({status:"not-found"});let J={id:Q.id,name:Q.name,slug:Q.slug,logo:Q.logo};if(await G.selectFrom("member").select(["id"]).where("userId","=",Y.user.id).where("organizationId","=",Q.id).executeTakeFirst())return $.json({status:"member",organization:J});try{let W=await n5.api.listUserInvitations({headers:$.req.raw.headers}),H=Date.now(),F=W.find((U)=>U.organizationId===Q.id&&U.status==="pending"&&new Date(U.expiresAt).getTime()>H);if(F)return $.json({status:"pending-invite",invitation:{id:F.id},organization:J})}catch(W){console.error("[Auth] listUserInvitations failed:",W)}if(Y.user.emailVerified){let W=Y.user.email?.split("@")[1]?.toLowerCase();if(W&&!$z.has(W)){let H=await new XE(G).getByOrganizationId(Q.id);if(H?.autoJoinEnabled&&H.domain===W)return $.json({status:"auto-domain-join",organization:{...J,domain:W}})}}return $.json({status:"no-access",organization:J})});C36=Dr});function gR8($){$.get("/status",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!await Oq0(Y,Y.auth.user.id,G))return X.json({error:"Not a member of this organization"},403);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J||!J.enforced)return X.json({ssoRequired:!1});let Z=await Y.storage.orgSsoSessions.isValid(Y.auth.user.id,G);return X.json({ssoRequired:!0,authenticated:Z,issuer:J.issuer,domain:J.domain})}),$.get("/authorize",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!await Oq0(Y,Y.auth.user.id,G))return X.json({error:"Not a member of this organization"},403);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J)return X.json({error:"SSO not configured for this organization"},404);let Z=await zq0(J.issuer,J.discoveryEndpoint),W=hR8(),H=await uR8(W),F=crypto.randomUUID(),U=JSON.stringify({state:F,codeVerifier:W,orgId:G,userId:Y.auth.user.id});x80(X,"org_sso_state",U,{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:600});let B=new URLSearchParams({response_type:"code",client_id:J.clientId,redirect_uri:`${Y.baseUrl}/api/org-sso/callback`,scope:J.scopes.join(" "),state:F,code_challenge:H,code_challenge_method:"S256"}),N=`${Z.authorization_endpoint}?${B.toString()}`;return X.redirect(N)}),$.get("/callback",async(X)=>{let Y=X.get("meshContext"),G=X.req.query("code"),Q=X.req.query("state"),J=X.req.query("error");if(J)return X.redirect(`/?sso_error=${encodeURIComponent(J)}`);if(!G||!Q)return X.redirect("/?sso_error=missing_code_or_state");let Z=DU1(X,"org_sso_state");if(!Z)return X.redirect("/?sso_error=state_expired");x80(X,"org_sso_state","",{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:0});let W;try{W=JSON.parse(Z)}catch{return X.redirect("/?sso_error=invalid_state")}if(W.state!==Q)return X.redirect("/?sso_error=state_mismatch");if(!Y.auth.user||Y.auth.user.id!==W.userId)return X.redirect("/?sso_error=session_expired");let H=await Y.storage.orgSsoConfig.getByOrgId(W.orgId);if(!H)return X.redirect("/?sso_error=sso_not_configured");let F=await zq0(H.issuer,H.discoveryEndpoint),U=await fetch(F.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:G,redirect_uri:`${Y.baseUrl}/api/org-sso/callback`,client_id:H.clientId,client_secret:H.clientSecret,code_verifier:W.codeVerifier})});if(!U.ok)return console.error("[org-sso] Token exchange failed:",await U.text()),X.redirect("/?sso_error=token_exchange_failed");let B=await U.json();if(!B.id_token)return X.redirect("/?sso_error=no_id_token");try{let D=tw(new URL(F.jwks_uri)),{payload:O}=await s8(B.id_token,D,{issuer:H.issuer,audience:H.clientId}),j=O.email?.toLowerCase(),E=Y.auth.user.email?.toLowerCase();if(!j||j!==E)return console.error(`[org-sso] Email mismatch: token=${j}, user=${E}`),X.redirect("/?sso_error=email_mismatch")}catch(D){return console.error("[org-sso] ID token verification failed:",D),X.redirect("/?sso_error=token_verification_failed")}await Y.storage.orgSsoSessions.upsert(Y.auth.user.id,W.orgId);let N=await Oq0(Y,Y.auth.user.id,W.orgId),w=N?.orgSlug?`/${N.orgSlug}`:"/";return X.redirect(w)}),$.get("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!mR8(Y))return X.json({error:"Admin role required"},403);let Q=await Y.storage.orgSsoConfig.getByOrgId(G);if(!Q)return X.json({configured:!1});return X.json({configured:!0,config:Y.storage.orgSsoConfig.toPublic(Q)})}),$.post("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);let Q=await X.req.json();if(!Q.issuer||!Q.clientId||!Q.domain)return X.json({error:"issuer, clientId, and domain are required"},400);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J&&!Q.clientSecret)return X.json({error:"clientSecret is required for initial SSO setup"},400);let Z=Q.clientSecret||J?.clientSecret||"";try{await zq0(Q.issuer,Q.discoveryEndpoint)}catch(H){return X.json({error:"Failed to reach OIDC discovery endpoint",details:H instanceof Error?H.message:String(H)},400)}let W=await Y.storage.orgSsoConfig.upsert(G,{issuer:Q.issuer,clientId:Q.clientId,clientSecret:Z,discoveryEndpoint:Q.discoveryEndpoint,scopes:Q.scopes,domain:Q.domain,enforced:Q.enforced});return X.json({success:!0,config:Y.storage.orgSsoConfig.toPublic(W)})}),$.post("/config/enforce",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);let Q=await X.req.json();if(!await Y.storage.orgSsoConfig.getByOrgId(G))return X.json({error:"SSO must be configured before enforcing"},400);return await Y.storage.orgSsoConfig.setEnforced(G,Q.enforced),X.json({success:!0,enforced:Q.enforced})}),$.delete("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);return await Y.storage.orgSsoConfig.delete(G),X.json({success:!0})})}function ty1($){let X;try{X=new URL($)}catch{throw Error(`Invalid URL: ${$}`)}let Y=f4().localMode;if(X.protocol!=="https:"&&!(Y&&X.protocol==="http:"))throw Error(`OIDC URL must use HTTPS: ${$}`);let G=X.hostname,Q=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[fd/,/^\[fe80:/,/^localhost$/i],J=/^127\.|^\[::1\]$|^localhost$/i.test(G);if(Y&&J)return;for(let Z of Q)if(Z.test(G))throw Error(`OIDC URL must not point to a private network address: ${G}`)}async function zq0($,X){let Y=X||$,G=_36.get(Y);if(G&&G.expiresAt>Date.now())return G.doc;let Q=X||`${$.replace(/\/$/,"")}/.well-known/openid-configuration`;ty1(Q);let J=await fetch(Q);if(!J.ok)throw Error(`OIDC discovery failed: ${J.status} ${J.statusText}`);let Z=await J.json();if(!Z.authorization_endpoint||!Z.token_endpoint||!Z.jwks_uri)throw Error("OIDC discovery document missing required endpoints");return ty1(Z.authorization_endpoint),ty1(Z.token_endpoint),ty1(Z.jwks_uri),_36.set(Y,{doc:Z,expiresAt:Date.now()+3600000}),Z}function hR8(){let $=new Uint8Array(32);return crypto.getRandomValues($),btoa(String.fromCharCode(...$)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function uR8($){let Y=new TextEncoder().encode($),G=await crypto.subtle.digest("SHA-256",Y);return btoa(String.fromCharCode(...new Uint8Array(G))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function Oq0($,X,Y){return await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug as orgSlug","member.role"]).where("member.userId","=",X).where("member.organizationId","=",Y).executeTakeFirst()??null}function mR8($){let X=$.auth.user?.role;if(!X)return!1;return tp.includes(X)}function Lq0($){return $.auth.user?.role==="owner"}var oy1=()=>{let $=new Z6;return gR8($),$},_36;var jq0=z(()=>{HX();g80();m5();T5();j91();_36=new Map});function dR8($){if($==="claude-code")return lR8;if($==="codex")return cR8;return null}function b36($,X){return dR8($)?.[X]??null}var lR8,cR8;var f36=z(()=>{lR8={fast:{modelId:"claude-code:haiku",label:"Haiku"},smart:{modelId:"claude-code:sonnet",label:"Sonnet"},thinking:{modelId:"claude-code:opus",label:"Opus"}},cR8={fast:{modelId:"codex:gpt-5.4-mini",label:"GPT-5.4 Mini"},smart:{modelId:"codex:gpt-5.3-codex",label:"GPT-5.3 Codex"},thinking:{modelId:"codex:gpt-5.5",label:"GPT-5.5"}}});function y36($){return $.type==="tool-call"&&$.toolName==="todo_write"&&typeof $.toolCallId==="string"}function iR8($){return $.type==="tool-result"&&$.toolName==="todo_write"&&typeof $.toolCallId==="string"}function x36($){let X=null;for(let G=$.length-1;G>=0&&X===null;G--){let J=$[G].content;if(!Array.isArray(J))continue;for(let Z=J.length-1;Z>=0;Z--){let W=J[Z];if(y36(W)){X=W.toolCallId;break}}}if(X===null)return $;let Y=X;return $.map((G)=>{let Q=G.content;if(!Array.isArray(Q))return G;let J=Q.filter((Z)=>{if(y36(Z))return Z.toolCallId===Y;if(iR8(Z))return Z.toolCallId===Y;return!0});if(J.length===Q.length)return G;return{...G,content:J}})}function g36($){let X=$.filter((G)=>G.role==="system"),Y=$.find((G)=>G.role!=="system");return{systemMessages:X,requestMessage:Y}}function pR8($){let X=!1,Y=$.map((G)=>{if(G.role!=="assistant")return G;if(!G.parts.some((J)=>("state"in J)&&J.state==="approval-requested"))return G;return X=!0,{...G,parts:G.parts.map((J)=>{if(!("state"in J)||J.state!=="approval-requested"||!("approval"in J)||!J.approval)return J;return{...J,state:"output-denied",approval:{...J.approval,approved:!1,reason:"User sent a new message without approving this tool call."}}})}});return X?Y:$}function nR8($){let[X,Y]=$.reduce((G,Q)=>{if(Q.role==="system")G[0].push(Q);else G[1].push(Q);return G},[[],[]]);return{systemMessages:X,messages:Y}}async function rR8($,X){return await $.loadHistory(X)}function aR8($,X){let Y=$.filter((J)=>J.parts&&J.parts.length>0);if(!X)return Y;let G=Y.findIndex((J)=>J.id===X.id);return G>=0?[...Y.slice(0,G),X]:[...Y,X]}async function h36($,X,Y,G){let Q=await rR8($,G),J=aR8(Q,X);return[...Y,...J]}async function u36($,X){let Y=$.filter((B)=>B.role!=="assistant"||B.parts&&B.parts.length>0),G=await zX1({messages:Y}),Q=pR8(G),J=await AV(Q,{tools:X.tools,ignoreIncompleteToolCalls:!0}),{systemMessages:Z,messages:W}=nR8(J),H=x36(W),U=Ej0({messages:H,reasoning:"all",emptyMessages:"remove",toolCalls:"none"}).map((B)=>{if(B.role!=="assistant")return B;let N=Array.isArray(B.content)?B.content.filter((w)=>w.type!=="reasoning"&&w.type!=="thinking"&&w.type!=="redacted-reasoning").map((w)=>{let D=w;if("providerOptions"in D||"providerMetadata"in D){let{providerOptions:O,providerMetadata:j,...E}=D;if(D.type==="tool-call"){let P=j?.google,T=O?.google;return{...E,...P?{providerMetadata:{google:P}}:{},...T?{providerOptions:{google:T}}:{}}}return E}return w}):B.content;return{...B,content:Array.isArray(N)&&N.length===0?[{type:"text",text:""}]:N,providerOptions:void 0,providerMetadata:void 0}});return{systemMessages:Z,messages:U,originalMessages:G}}var sy1=z(()=>{q5()});function PW($){return`mesh-storage://${$}`}function Qh($){if(!$.startsWith("mesh-storage://"))return null;return $.slice(15)}function Eq0(){return/mesh-storage:\/\/([^\s"'<>[\]]+)/g}function tR8($,X,Y){return`${$}/api/${X}/files/${Y}`}function sR8($){return $.type==="file"&&"mediaType"in $&&typeof $.mediaType==="string"&&oR8.has($.mediaType)}function m36($){let X=$.match(/^data:([^;]+);base64,(.+)$/s);if(!X)return null;let[,Y,G]=X;try{let Q=atob(G),J=new Uint8Array(Q.length);for(let Z=0;Z<Q.length;Z++)J[Z]=Q.charCodeAt(Z);return{mimeType:Y,bytes:J}}catch{return null}}function l36($){return{"image/png":"png","image/jpeg":"jpg","image/gif":"gif","image/webp":"webp","image/svg+xml":"svg","application/pdf":"pdf","text/plain":"txt","text/html":"html","application/json":"json"}[$]??"bin"}async function c36($,X,Y,G){if(!G.objectStorage)return null;try{return await G.objectStorage.put(X,$,{contentType:Y}),X}catch(Q){return console.error("[file-materializer] Failed to upload file:",Q),null}}async function Jh($,X){if(!X.objectStorage)return null;try{return await X.objectStorage.presignedGetUrl($,eR8)}catch(Y){return console.error("[file-materializer] Failed to generate presigned URL:",Y),null}}async function d36($,X){if(!X.organization)return $;let Y=X.organization.slug;if(!Y)return $;let G=$.findLastIndex((D)=>D.role==="user");if(G===-1)return $;let Q=$[G],J=Q.parts.filter((D)=>D.type==="file"&&("url"in D)&&typeof D.url==="string"&&D.url.startsWith("data:"));if(J.length===0)return $;let W=(await Promise.all(J.map(async(D)=>{if(D.type!=="file"||!("url"in D)||typeof D.url!=="string")return null;let O=m36(D.url);if(!O)return null;let j=l36(O.mimeType),E=`chat-uploads/${crypto.randomUUID()}.${j}`,P=await c36(O.bytes,E,O.mimeType,X);if(!P)return null;let T="filename"in D&&typeof D.filename==="string"?D.filename:E;return{dataUrl:D.url,meshStorageUrl:PW(P),redirectUrl:tR8(X.baseUrl,Y,P),filename:T}}))).filter((D)=>D!==null);if(W.length===0)return $;let F=`[Uploaded files \u2014 use these URLs when calling tools]
+      `.execute(F),await m1`DELETE FROM "member" WHERE "userId" = ${X.id}`.execute(F),await m1`DELETE FROM "user" WHERE "id" = ${X.id}`.execute(F)})}catch(F){console.error("[SSO] Failed to merge duplicate user:",F)}}var BR8=($)=>{return{trustEmailVerified:!0,provisionUser:wR8,defaultSSO:[{domain:$.domain,providerId:$.providerId,oidcConfig:{issuer:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/v2.0`,pkce:!0,clientId:$.MS_CLIENT_ID,clientSecret:$.MS_CLIENT_SECRET,discoveryEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/v2.0/.well-known/openid-configuration`,authorizationEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/oauth2/v2.0/authorize`,tokenEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/oauth2/v2.0/token`,jwksEndpoint:`https://login.microsoftonline.com/${$.MS_TENANT_ID}/discovery/v2.0/keys`,userInfoEndpoint:"https://graph.microsoft.com/oidc/userinfo",tokenEndpointAuthentication:"client_secret_post",scopes:$.scopes,mapping:{id:"sub",email:"email",emailVerified:"email_verified",name:"name",image:"picture",extraFields:{emailVerified:"email_verified",oid:"oid"}}}}]}},NR8=($)=>{return{trustEmailVerified:!0,defaultSSO:[{domain:$.domain,providerId:$.providerId,oidcConfig:{issuer:"https://accounts.google.com",pkce:!0,clientId:$.GOOGLE_CLIENT_ID,clientSecret:$.GOOGLE_CLIENT_SECRET,discoveryEndpoint:"https://accounts.google.com/.well-known/openid-configuration",authorizationEndpoint:"https://accounts.google.com/o/oauth2/v2/auth",tokenEndpoint:"https://oauth2.googleapis.com/token",jwksEndpoint:"https://www.googleapis.com/oauth2/v3/certs",userInfoEndpoint:"https://openidconnect.googleapis.com/v1/userinfo",tokenEndpointAuthentication:"client_secret_post",scopes:$.scopes,mapping:{id:"sub",email:"email",emailVerified:"email_verified",name:"name",image:"picture",extraFields:{emailVerified:"email_verified",hd:"hd"}}}}]}},X36=($)=>{if($.providerId==="microsoft")return BR8($);if($.providerId==="google")return NR8($);throw Error(`Unsupported provider: ${$.providerId}`)};var Y36=z(()=>{m5();CX();BD()});var K36={};R6(K36,{resetPasswordEnabled:()=>py1,authConfig:()=>p8,auth:()=>n5,GENERIC_EMAIL_DOMAINS:()=>$z});function DR8($){return $.toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")}function zR8(){let $=Math.floor(Math.random()*Q36.length),X=Math.floor(Math.random()*G36.length),Y=Q36[$]??"deco",G=G36[X]??"studio";return`${Y}-${G}`}function VR8(){let $=[WY1];try{let X=new URL(WY1);if(X.hostname==="localhost")$.push(WY1.replace("localhost","127.0.0.1"));else if(X.hostname==="127.0.0.1")$.push(WY1.replace("127.0.0.1","localhost"))}catch{}return $}var G36,Q36,OR8,LR8,iy1,jR8,ER8,PR8,J36,p8,W36=void 0,Zq0=void 0,py1=!1,qR8,$z,AR8,TR8,WY1,Z36,n5;var Xz=z(()=>{T5();l80();Yq4();cA4();eQ0();bZ0();UZ0();cD1();RV4();xZ0();$X();UD();mI4();BD();tI4();iz1();sI4();eW6();$36();j91();Y36();G36=["labs","agent","studio","workspace","systems","core","cloud","works"],Q36=["capybara","guarana","deco","samba","feijoada","capoeira","carnival"];OR8=Object.values(G11()).map(($)=>$.map((X)=>X.name)).flat(),LR8={...vd,self:["*",...OR8]},iy1=jB(LR8),jR8=iy1.newRole({self:["*"],...Cd.statements}),ER8=iy1.newRole({self:["*"],...Cd.statements}),PR8=iy1.newRole({self:["*"],...Cd.statements}),J36=Object.values(G11()).map(($)=>$.map((X)=>`self:${X.name}`)).flat(),p8=T2().auth;if(p8.inviteEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=k2(p8.emailProviders,p8.inviteEmailProviderId);if($){let X=S2($);W36=async(Y)=>{let G=Y.inviter.user?.name||Y.inviter.user?.email,Q=`${cZ()}/auth/accept-invitation?invitationId=${Y.invitation.id}&redirectTo=/${Y.organization.slug}`;await X({to:Y.email,subject:`You've been invited to join ${Y.organization.name}`,html:v2({preheader:`${G} has invited you to join ${Y.organization.name} on deco Studio.`,heading:"You've been invited",subheading:`<strong>${G}</strong> has invited you to join <strong>${Y.organization.name}</strong> on deco Studio.`,body:D61("Accept invitation",Q),footnote:"If you weren\u2019t expecting an invitation, you can safely ignore this email."})})}}}if(p8.resetPasswordEmailProviderId&&p8.emailProviders&&p8.emailProviders.length>0){let $=k2(p8.emailProviders,p8.resetPasswordEmailProviderId);if($){let X=S2($);py1=!0,Zq0=async({user:Y,url:G})=>{await X({to:Y.email,subject:"Reset your password",html:v2({preheader:"We received a request to reset the password on your deco Studio account.",heading:"Reset your password",subheading:"We received a password reset request for your account. Click the button below to choose a new password.",body:D61("Reset password",G)+pz1("This link expires in 24\xA0hours. If you didn\u2019t request a password reset, no action is needed.",!0),footnote:"If you didn\u2019t request a password reset, you can safely ignore this email."})})}}}qR8=[dJ0({organizationCreation:{afterCreate:async($)=>{await sW6($.organization.id,$.member.userId)}},ac:iy1,creatorRole:"owner",allowUserToCreateOrganization:!0,dynamicAccessControl:{enabled:!0,maximumRolesPerOrganization:500,enableCustomResources:!0,allowedRolesToCreateResources:tp,resourceNameValidation:($)=>{return{valid:/^[a-zA-Z0-9-_]+$/.test($)}}},roles:{user:jR8,admin:ER8,owner:PR8},sendInvitationEmail:W36}),AZ0({loginPage:"/login",oidcConfig:{scopes:J36,metadata:{scopes_supported:J36},loginPage:"/login"}}),XZ0({enableMetadata:!0,maximumNameLength:64,keyExpiration:{minExpiresIn:0.003472222222222222},enableSessionForAPIKeys:!0,customAPIKeyGetter:($)=>{if($.headers?.get("X-MCP-Session-Auth")==="true")return null;let Y=$.headers?.get("Authorization");if(Y?.startsWith("Bearer "))return Y.replace("Bearer ","").trim();return null},permissions:{defaultPermissions:{self:["ORGANIZATION_LIST","ORGANIZATION_GET","ORGANIZATION_MEMBER_LIST","COLLECTION_CONNECTIONS_LIST","COLLECTION_CONNECTIONS_GET","API_KEY_CREATE","API_KEY_LIST"]}},rateLimit:{enabled:!1}}),iD1({defaultRole:"user",adminRoles:["admin","owner"],roles:{...D2,owner:mD1}}),IZ0(),wZ0({jwt:{expirationTime:"5m"}}),Xq4(p8.ssoConfig?X36(p8.ssoConfig):void 0),...p8.magicLinkConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[zZ0(oI4(p8.magicLinkConfig,p8.emailProviders))]:[],...p8.emailOtpConfig?.enabled&&p8.emailProviders&&p8.emailProviders.length>0?[FZ0(aI4(p8.emailOtpConfig,p8.emailProviders))]:[]],$z=new Set(["gmail.com","googlemail.com","outlook.com","hotmail.com","live.com","yahoo.com","yahoo.co.uk","icloud.com","me.com","mac.com","aol.com","protonmail.com","proton.me","zoho.com","yandex.com","mail.com","gmx.com","gmx.net","tutanota.com","fastmail.com"]),AR8=w61(),TR8=pI4(AR8),WY1=cZ();Z36=f4(),n5=sQ0({secret:Z36.betterAuthSecret||"deco-default-secret-k7x9m2p4q8w3n5v6",baseURL:WY1,trustedOrigins:VR8(),database:TR8,socialProviders:p8.socialProviders,...p8.ssoConfig&&{account:{accountLinking:{trustedProviders:[p8.ssoConfig.providerId]}}},emailAndPassword:{enabled:p8.emailAndPassword.enabled,...Zq0&&{sendResetPassword:Zq0}},rateLimit:{enabled:!Z36.disableRateLimit,window:60,max:1e4},plugins:qR8,databaseHooks:{user:{create:{after:async($)=>{if(Jq0({id:$.id,email:$.email,name:$.name??null,emailVerified:!!$.emailVerified}),j6.capture({distinctId:$.id,event:"user_signed_up",properties:{email:$.email,email_domain:$.email?.split("@")[1]?.toLowerCase()??null,email_verified:!!$.emailVerified,has_name:!!$.name}}),$.emailVerified){let G=$.email?.split("@")[1]?.toLowerCase();if(G&&!$z.has(G))return}if(T2().autoCreateOrganizationOnSignup===!1)return;let X=$.name?$.name.split(" ")[0]:$.email.split("@")[0],Y=3;for(let G=0;G<Y;G++){let Q=`${X} ${zR8()}`,J=DR8(Q);try{let W=(await n5.api.createOrganization({body:{name:Q,slug:J,userId:$.id}}))?.id??void 0;if(W)j6.groupIdentify({groupType:"organization",groupKey:W,properties:{name:Q,slug:J,created_at:new Date().toISOString(),created_via:"signup_default"}}),j6.capture({distinctId:$.id,event:"organization_created",groups:{organization:W},properties:{organization_id:W,organization_slug:J,created_via:"signup_default"}});return}catch(Z){if(!(Z instanceof Error&&("body"in Z)&&Z.body?.code==="ORGANIZATION_ALREADY_EXISTS")||G===Y-1){console.error("Failed to create default organization:",Z);return}}}}}},session:{create:{after:async($)=>{let X=await fX().db.selectFrom("user").select(["id","email","name","emailVerified"]).where("id","=",$.userId).executeTakeFirst();if(!X)return;Jq0({id:X.id,email:X.email,name:X.name??null,emailVerified:!!X.emailVerified})}}}}})});function Wq0($,X){return`${$}:${X}`}function H36($){let X=$?.ttlMs??120000,Y=$?.maxSize??1e4,G=new Map;function Q(){if(G.size<=Y)return;let J=Date.now();for(let[Z,W]of G)if(W.expiresAt<=J)G.delete(Z);if(G.size>Y){let Z=G.size-Y,W=0;for(let H of G.keys()){if(W>=Z)break;G.delete(H),W++}}}return{get(J,Z){let W=Wq0(J,Z),H=G.get(W);if(!H)return;if(H.expiresAt<=Date.now()){G.delete(W);return}return H.role},set(J,Z,W){let H=Wq0(J,Z);G.set(H,{role:W,expiresAt:Date.now()+X,organizationId:Z}),Q()},invalidate(J,Z){G.delete(Wq0(J,Z))},invalidateOrg(J){for(let[Z,W]of G)if(W.organizationId===J)G.delete(Z)}}}var F36=()=>{};var Kq0=()=>{};var U36=()=>{};var MR8,PRY;var B36=z(()=>{F36();Kq0();dO();U36();MR8={br:".br",zstd:".zst",gzip:".gz"},PRY=Object.keys(MR8)});var N36=z(()=>{B36()});var w36=()=>{};var D36=z(()=>{w36()});var z36=()=>{};var O36=z(()=>{S80()});var Hq0=z(()=>{iO();O36()});var Fq0="x-hono-disable-ssg",uRY;var Uq0=z(()=>{Hq0();uRY=(()=>{try{return new Response("SSG is disabled",{status:404,headers:{[Fq0]:"true"}})}catch{return null}})()});var L36=z(()=>{WU1()});var Bq0=z(()=>{L36()});var j36=z(()=>{D36();z36();Kq0();Uq0();Bq0();Hq0()});var E36=z(()=>{Uq0();Bq0();j36()});var qSY;var P36=z(()=>{E36();({write:qSY}=Bun)});var SR8=class{#$;constructor($){this.#$=$,this.raw=$.raw,this.url=$.url?new URL($.url):null,this.protocol=$.protocol??null}send($,X){this.#$.send($,X??{})}raw;binaryType="arraybuffer";get readyState(){return this.#$.readyState}url;protocol;close($,X){this.#$.close($,X)}},q36=($)=>{return(...X)=>{if(typeof X[0]==="function"){let[Y,G]=X;return async function(J,Z){let W=await Y(J),H=await $(J,W,G);if(H)return H;await Z()}}else{let[Y,G,Q]=X;return(async()=>{let J=await $(Y,G,Q);if(!J)throw Error("Failed to upgrade WebSocket");return J})()}}};var A36=()=>{};var KY1=($)=>("server"in $.env)?$.env.server:$.env;var ny1=()=>{};var kR8;var T36=z(()=>{A36();ny1();kR8=q36(($,X)=>{let Y=KY1($);if(!Y)throw TypeError("env has to include the 2nd argument of fetch.");if(Y.upgrade($.req.raw,{data:{events:X,url:new URL($.req.url),protocol:$.req.url}}))return new Response(null);return})});var Nq0=($)=>{let X=KY1($);if(!X)throw TypeError("env has to include the 2nd argument of fetch.");if(typeof X.requestIP!=="function")throw TypeError("server.requestIP is not a function.");let Y=X.requestIP($.req.raw);if(!Y)return{remote:{}};return{remote:{address:Y.address,addressType:Y.family==="IPv6"||Y.family==="IPv4"?Y.family:void 0,port:Y.port}}};var V36=z(()=>{ny1()});var M36=z(()=>{N36();P36();T36();V36();ny1()});var I36;var R36=z(()=>{I36={google:{name:"Google",icon:"https://assets.decocache.com/webdraw/eb7480aa-a68b-4ce4-98ff-36aa121762a7/google.svg"},github:{name:"GitHub",icon:"https://assets.decocache.com/decocms/e02ce92e-6684-41a6-acfc-432977eb4878/github.png"},microsoft:{name:"Microsoft",icon:"https://assets.decocache.com/mcp/aa6f6e1a-6526-4bca-99cc-82e2ec38b0e4/microsoft.png"}}});var ay1={};R6(ay1,{waitForSeed:()=>xR8,seedLocalMode:()=>bR8,markSeedComplete:()=>yR8,isLocalMode:()=>Gh,getLocalAdminUser:()=>wq0,getLocalAdminPassword:()=>ry1});import{userInfo as vR8}from"os";async function ry1(){return f4().betterAuthSecret||"local-mode-default"}function S36(){try{return vR8().username||"local"}catch{return"local"}}function CR8($){return $.charAt(0).toUpperCase()+$.slice(1)}async function _R8(){let $=fX(),X=await $.db.selectFrom("user").select($.db.fn.countAll().as("count")).executeTakeFirst();return Number(X?.count??0)===0}async function bR8(){if(!await _R8())return!1;let X=S36(),Y=`${X}@localhost.mesh`,G=CR8(X),Q=await ry1(),J=await n5.api.signUpEmail({body:{email:Y,password:Q,name:G}});if(!J?.user?.id)throw Error("Failed to create local admin user");let Z=J.user.id,W=fX();await W.db.updateTable("user").set({role:"admin"}).where("id","=",Z).execute();let H=`${X}-local`.toLowerCase().replace(/[^a-z0-9-]/g,"-").replace(/-+/g,"-").replace(/^-|-$/g,""),F=`${G} Local`;return await W.db.updateTable("organization").set({name:F,slug:H}).where("id","in",(U)=>U.selectFrom("member").select("organizationId").where("userId","=",Z)).execute(),!0}async function wq0(){let $=fX(),X=`${S36()}@localhost.mesh`;return $.db.selectFrom("user").where("email","=",X).selectAll().executeTakeFirst()}function Gh(){return f4().localMode}function yR8(){k36()}function xR8(){return fR8}var k36,fR8;var wr=z(()=>{BD();T5();Xz();fR8=new Promise(($)=>{if(k36=$,!Gh())$()})});function v36(){let $=Object.keys(p8.socialProviders??{}),X=$.length>0,Y=$.map((Q)=>({name:Q,icon:I36[Q].icon})),G=f4().localMode;return{emailAndPassword:{enabled:p8.emailAndPassword?.enabled??!1},magicLink:{enabled:p8.magicLinkConfig?.enabled??!1},emailOtp:{enabled:p8.emailOtpConfig?.enabled??!1},resetPassword:{enabled:py1},socialProviders:{enabled:X,providers:Y},sso:p8.ssoConfig?{enabled:!0,providerId:p8.ssoConfig.providerId}:{enabled:!1},stdioEnabled:G,localMode:Gh()}}var Dr,C36;var Dq0=z(()=>{HX();M36();$X();T5();Xz();BD();Cz0();sB0();R36();wr();Dr=new Z6;Dr.post("/local-session",async($)=>{if(!Gh())return $.json({success:!1,error:"Local mode is not active"},403);let X;try{X=Nq0($).remote.address}catch{}if(!(X==="127.0.0.1"||X==="::1"||X==="::ffff:127.0.0.1"))return $.json({success:!1,error:"Forbidden"},403);try{let{waitForSeed:G}=await Promise.resolve().then(() => (wr(),ay1));await G();let{auth:Q}=await Promise.resolve().then(() => (Xz(),K36)),J=await wq0();if(!J)return $.json({success:!1,error:"Local admin user not found"},500);let Z=await ry1();return await Q.api.signInEmail({body:{email:J.email,password:Z},asResponse:!0})}catch(G){return console.error("Failed to create local session:",G),$.json({success:!1,error:G instanceof Error?G.message:"Failed to create local session"},500)}});Dr.get("/domain-lookup",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({found:!1,organizations:[]});let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({found:!1,organizations:[]});try{let Q=await new XE(fX().db).getAllByDomain(Y);if(Q.length===0)return $.json({found:!1,organizations:[]});let J=await fX().db.selectFrom("organization").select(["id","name","slug","logo"]).where("id","in",Q.map((H)=>H.organizationId)).execute(),Z=new Map(J.map((H)=>[H.id,H])),W=Q.map((H)=>{let F=Z.get(H.organizationId);if(!F)return null;return{id:F.id,name:F.name,slug:F.slug,logo:F.logo,autoJoinEnabled:H.autoJoinEnabled}}).filter((H)=>H!==null);return $.json({found:W.length>0,organizations:W})}catch(G){return console.error("[Auth] Domain lookup failed:",G),$.json({success:!1,error:"Domain lookup failed"},500)}});Dr.post("/domain-join",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({success:!1,error:"Email must be verified to join"},403);let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({success:!1,error:"Generic email domains cannot auto-join"},403);let G=await $.req.json().catch(()=>({})),Q=typeof G.organizationSlug==="string"&&G.organizationSlug.trim()?G.organizationSlug.trim():null;try{let J=fX().db,H=(await new XE(J).getAllByDomain(Y)).filter((U)=>U.autoJoinEnabled);if(H.length===0)return $.json({success:!1,error:"Auto-join is not available for this domain"},403);let F;if(Q){let U=await J.selectFrom("organization").select(["id","slug"]).where("slug","=",Q).executeTakeFirst();if(!U||!H.some((B)=>B.organizationId===U.id))return $.json({success:!1,error:"This organization is not available for auto-join with your email domain."},403);F=U}else if(H.length===1){let U=await J.selectFrom("organization").select(["id","slug"]).where("id","=",H[0].organizationId).executeTakeFirst();if(!U)return $.json({success:!1,error:"Organization not found"},404);F=U}else return $.json({success:!1,error:"Multiple organizations match this domain. Please pick one.",requiresSelection:!0},409);try{await n5.api.addMember({body:{userId:X.user.id,role:"user",organizationId:F.id}})}catch(U){if(!(U instanceof Error?U.message.toLowerCase():"").includes("already a member"))return console.error("[Auth] Domain join addMember failed:",U),$.json({success:!1,error:"Failed to join organization"},500)}return j6.capture({distinctId:X.user.id,event:"organization_domain_joined",groups:{organization:F.id},properties:{organization_id:F.id,organization_slug:F.slug,email_domain:Y}}),$.json({success:!0,slug:F.slug})}catch(J){return j6.captureException(J,X.user.id),console.error("[Auth] Domain join failed:",J),$.json({success:!1,error:"Failed to join organization"},500)}});Dr.post("/domain-setup",async($)=>{let X=await n5.api.getSession({headers:$.req.raw.headers});if(!X?.user)return $.json({success:!1,error:"Authentication required"},401);if(!X.user.emailVerified)return $.json({success:!1,error:"Email must be verified"},403);let Y=X.user.email?.split("@")[1]?.toLowerCase();if(!Y||$z.has(Y))return $.json({success:!1,error:"Corporate email required"},403);let G=await $.req.json().catch(()=>({})),Q=typeof G.name==="string"&&G.name.trim().length>0?G.name.trim():null,J=typeof G.logo==="string"&&G.logo.length>0?G.logo:null,Z=G.claimDomain!==!1;try{let W=fX().db,H=new XE(W),F=await H.getAllByDomain(Y);if(F.length>0){let T=await W.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug"]).where("member.userId","=",X.user.id).where("member.organizationId","in",F.map((I)=>I.organizationId)).executeTakeFirst();if(T)return $.json({success:!0,slug:T.slug,alreadyExists:!0})}let U=Y.split(".")[0]??Y,B=Q??U.charAt(0).toUpperCase()+U.slice(1),N=(Q??U).toLowerCase().trim().replace(/[^a-z0-9\s_-]+/g,"").replace(/[\s_-]+/g,"-").replace(/^-+|-+$/g,"")||U.toLowerCase().replace(/[^a-z0-9-]/g,""),w=null;for(let I=0;I<3;I++){let M=I===0?"":`-${Math.random().toString(36).slice(2,6)}`,R=I===0?B:`${B}${M}`,S=`${N}${M}`;try{w=await n5.api.createOrganization({body:{name:R,slug:S,userId:X.user.id}});break}catch(C){if(!(C instanceof Error&&("body"in C)&&C.body?.code==="ORGANIZATION_ALREADY_EXISTS")||I===2)throw C}}if(!w?.id)throw Error("Failed to create organization");let D=w.id;if(Z)await H.setDomain(D,Y,!0);let O=!1,j=null,E=null;try{let T=f4().firecrawlApiKey;if(T){let I=await Yq1(Y,T,B);if(I){let M=new z91(fX().db),R=await M.create(D,I);if(await M.setDefault(R.id,D),O=!0,I.name&&I.name!==B)j=I.name;E=I.favicon??I.logo??null}}}catch(T){console.error("[Auth] Brand extraction failed (non-fatal):",T)}let P={};if(!Q&&j)P.name=j;if(J)P.logo=J;else if(E)P.logo=E;if(Object.keys(P).length>0)try{await n5.api.updateOrganization({headers:$.req.raw.headers,body:{organizationId:D,data:P}})}catch(T){console.error("[Auth] Org update failed (non-fatal):",T)}return j6.identify({distinctId:X.user.id,properties:{email:X.user.email,$set:{email:X.user.email},$set_once:{first_organization_created_at:new Date().toISOString()}}}),j6.groupIdentify({groupType:"organization",groupKey:D,properties:{name:w.slug??N,slug:w.slug??N,email_domain:Y,brand_extracted:O,created_at:new Date().toISOString()}}),j6.capture({distinctId:X.user.id,event:"organization_created",groups:{organization:D},properties:{organization_id:D,organization_slug:w.slug??N,email_domain:Y,brand_extracted:O}}),$.json({success:!0,slug:w.slug??N,brandExtracted:O})}catch(W){return j6.captureException(W,X.user?.id),console.error("[Auth] Domain setup failed:",W),$.json({success:!1,error:"Failed to set up organization"},500)}});Dr.get("/org-access-status/:slug",async($)=>{let X=$.req.param("slug"),Y=await n5.api.getSession({headers:$.req.raw.headers});if(!Y?.user)return $.json({success:!1,error:"Authentication required"},401);let G=fX().db,Q=await G.selectFrom("organization").select(["id","name","slug","logo"]).where("slug","=",X).executeTakeFirst();if(!Q)return $.json({status:"not-found"});let J={id:Q.id,name:Q.name,slug:Q.slug,logo:Q.logo};if(await G.selectFrom("member").select(["id"]).where("userId","=",Y.user.id).where("organizationId","=",Q.id).executeTakeFirst())return $.json({status:"member",organization:J});try{let W=await n5.api.listUserInvitations({headers:$.req.raw.headers}),H=Date.now(),F=W.find((U)=>U.organizationId===Q.id&&U.status==="pending"&&new Date(U.expiresAt).getTime()>H);if(F)return $.json({status:"pending-invite",invitation:{id:F.id},organization:J})}catch(W){console.error("[Auth] listUserInvitations failed:",W)}if(Y.user.emailVerified){let W=Y.user.email?.split("@")[1]?.toLowerCase();if(W&&!$z.has(W)){let H=await new XE(G).getByOrganizationId(Q.id);if(H?.autoJoinEnabled&&H.domain===W)return $.json({status:"auto-domain-join",organization:{...J,domain:W}})}}return $.json({status:"no-access",organization:J})});C36=Dr});function gR8($){$.get("/status",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!await Oq0(Y,Y.auth.user.id,G))return X.json({error:"Not a member of this organization"},403);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J||!J.enforced)return X.json({ssoRequired:!1});let Z=await Y.storage.orgSsoSessions.isValid(Y.auth.user.id,G);return X.json({ssoRequired:!0,authenticated:Z,issuer:J.issuer,domain:J.domain})}),$.get("/authorize",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!await Oq0(Y,Y.auth.user.id,G))return X.json({error:"Not a member of this organization"},403);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J)return X.json({error:"SSO not configured for this organization"},404);let Z=await zq0(J.issuer,J.discoveryEndpoint),W=hR8(),H=await uR8(W),F=crypto.randomUUID(),U=JSON.stringify({state:F,codeVerifier:W,orgId:G,userId:Y.auth.user.id});x80(X,"org_sso_state",U,{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:600});let B=new URLSearchParams({response_type:"code",client_id:J.clientId,redirect_uri:`${Y.baseUrl}/api/org-sso/callback`,scope:J.scopes.join(" "),state:F,code_challenge:H,code_challenge_method:"S256"}),N=`${Z.authorization_endpoint}?${B.toString()}`;return X.redirect(N)}),$.get("/callback",async(X)=>{let Y=X.get("meshContext"),G=X.req.query("code"),Q=X.req.query("state"),J=X.req.query("error");if(J)return X.redirect(`/?sso_error=${encodeURIComponent(J)}`);if(!G||!Q)return X.redirect("/?sso_error=missing_code_or_state");let Z=DU1(X,"org_sso_state");if(!Z)return X.redirect("/?sso_error=state_expired");x80(X,"org_sso_state","",{httpOnly:!0,secure:!0,sameSite:"Lax",path:"/api/org-sso/callback",maxAge:0});let W;try{W=JSON.parse(Z)}catch{return X.redirect("/?sso_error=invalid_state")}if(W.state!==Q)return X.redirect("/?sso_error=state_mismatch");if(!Y.auth.user||Y.auth.user.id!==W.userId)return X.redirect("/?sso_error=session_expired");let H=await Y.storage.orgSsoConfig.getByOrgId(W.orgId);if(!H)return X.redirect("/?sso_error=sso_not_configured");let F=await zq0(H.issuer,H.discoveryEndpoint),U=await fetch(F.token_endpoint,{method:"POST",headers:{"Content-Type":"application/x-www-form-urlencoded"},body:new URLSearchParams({grant_type:"authorization_code",code:G,redirect_uri:`${Y.baseUrl}/api/org-sso/callback`,client_id:H.clientId,client_secret:H.clientSecret,code_verifier:W.codeVerifier})});if(!U.ok)return console.error("[org-sso] Token exchange failed:",await U.text()),X.redirect("/?sso_error=token_exchange_failed");let B=await U.json();if(!B.id_token)return X.redirect("/?sso_error=no_id_token");try{let D=tw(new URL(F.jwks_uri)),{payload:O}=await s8(B.id_token,D,{issuer:H.issuer,audience:H.clientId}),j=O.email?.toLowerCase(),E=Y.auth.user.email?.toLowerCase();if(!j||j!==E)return console.error(`[org-sso] Email mismatch: token=${j}, user=${E}`),X.redirect("/?sso_error=email_mismatch")}catch(D){return console.error("[org-sso] ID token verification failed:",D),X.redirect("/?sso_error=token_verification_failed")}await Y.storage.orgSsoSessions.upsert(Y.auth.user.id,W.orgId);let N=await Oq0(Y,Y.auth.user.id,W.orgId),w=N?.orgSlug?`/${N.orgSlug}`:"/";return X.redirect(w)}),$.get("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!mR8(Y))return X.json({error:"Admin role required"},403);let Q=await Y.storage.orgSsoConfig.getByOrgId(G);if(!Q)return X.json({configured:!1});return X.json({configured:!0,config:Y.storage.orgSsoConfig.toPublic(Q)})}),$.post("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);let Q=await X.req.json();if(!Q.issuer||!Q.clientId||!Q.domain)return X.json({error:"issuer, clientId, and domain are required"},400);let J=await Y.storage.orgSsoConfig.getByOrgId(G);if(!J&&!Q.clientSecret)return X.json({error:"clientSecret is required for initial SSO setup"},400);let Z=Q.clientSecret||J?.clientSecret||"";try{await zq0(Q.issuer,Q.discoveryEndpoint)}catch(H){return X.json({error:"Failed to reach OIDC discovery endpoint",details:H instanceof Error?H.message:String(H)},400)}let W=await Y.storage.orgSsoConfig.upsert(G,{issuer:Q.issuer,clientId:Q.clientId,clientSecret:Z,discoveryEndpoint:Q.discoveryEndpoint,scopes:Q.scopes,domain:Q.domain,enforced:Q.enforced});return X.json({success:!0,config:Y.storage.orgSsoConfig.toPublic(W)})}),$.post("/config/enforce",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);let Q=await X.req.json();if(!await Y.storage.orgSsoConfig.getByOrgId(G))return X.json({error:"SSO must be configured before enforcing"},400);return await Y.storage.orgSsoConfig.setEnforced(G,Q.enforced),X.json({success:!0,enforced:Q.enforced})}),$.delete("/config",async(X)=>{let Y=X.get("meshContext");if(!Y.auth.user)return X.json({error:"Authentication required"},401);let G=Y.organization?.id;if(!G)return X.json({error:"Organization context required"},400);if(!Lq0(Y))return X.json({error:"Owner role required"},403);return await Y.storage.orgSsoConfig.delete(G),X.json({success:!0})})}function ty1($){let X;try{X=new URL($)}catch{throw Error(`Invalid URL: ${$}`)}let Y=f4().localMode;if(X.protocol!=="https:"&&!(Y&&X.protocol==="http:"))throw Error(`OIDC URL must use HTTPS: ${$}`);let G=X.hostname,Q=[/^127\./,/^10\./,/^172\.(1[6-9]|2\d|3[01])\./,/^192\.168\./,/^169\.254\./,/^0\./,/^\[::1\]$/,/^\[fd/,/^\[fe80:/,/^localhost$/i],J=/^127\.|^\[::1\]$|^localhost$/i.test(G);if(Y&&J)return;for(let Z of Q)if(Z.test(G))throw Error(`OIDC URL must not point to a private network address: ${G}`)}async function zq0($,X){let Y=X||$,G=_36.get(Y);if(G&&G.expiresAt>Date.now())return G.doc;let Q=X||`${$.replace(/\/$/,"")}/.well-known/openid-configuration`;ty1(Q);let J=await fetch(Q);if(!J.ok)throw Error(`OIDC discovery failed: ${J.status} ${J.statusText}`);let Z=await J.json();if(!Z.authorization_endpoint||!Z.token_endpoint||!Z.jwks_uri)throw Error("OIDC discovery document missing required endpoints");return ty1(Z.authorization_endpoint),ty1(Z.token_endpoint),ty1(Z.jwks_uri),_36.set(Y,{doc:Z,expiresAt:Date.now()+3600000}),Z}function hR8(){let $=new Uint8Array(32);return crypto.getRandomValues($),btoa(String.fromCharCode(...$)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function uR8($){let Y=new TextEncoder().encode($),G=await crypto.subtle.digest("SHA-256",Y);return btoa(String.fromCharCode(...new Uint8Array(G))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}async function Oq0($,X,Y){return await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["organization.slug as orgSlug","member.role"]).where("member.userId","=",X).where("member.organizationId","=",Y).executeTakeFirst()??null}function mR8($){let X=$.auth.user?.role;if(!X)return!1;return tp.includes(X)}function Lq0($){return $.auth.user?.role==="owner"}var oy1=()=>{let $=new Z6;return gR8($),$},_36;var jq0=z(()=>{HX();g80();m5();T5();j91();_36=new Map});function dR8($){if($==="claude-code")return lR8;if($==="codex")return cR8;return null}function b36($,X){return dR8($)?.[X]??null}var lR8,cR8;var f36=z(()=>{lR8={fast:{modelId:"claude-code:haiku",label:"Haiku 4.5"},smart:{modelId:"claude-code:sonnet",label:"Sonnet 4.6"},thinking:{modelId:"claude-code:opus",label:"Opus 4.7"}},cR8={fast:{modelId:"codex:gpt-5.4-mini",label:"GPT-5.4 Mini"},smart:{modelId:"codex:gpt-5.3-codex",label:"GPT-5.3 Codex"},thinking:{modelId:"codex:gpt-5.5",label:"GPT-5.5"}}});function y36($){return $.type==="tool-call"&&$.toolName==="todo_write"&&typeof $.toolCallId==="string"}function iR8($){return $.type==="tool-result"&&$.toolName==="todo_write"&&typeof $.toolCallId==="string"}function x36($){let X=null;for(let G=$.length-1;G>=0&&X===null;G--){let J=$[G].content;if(!Array.isArray(J))continue;for(let Z=J.length-1;Z>=0;Z--){let W=J[Z];if(y36(W)){X=W.toolCallId;break}}}if(X===null)return $;let Y=X;return $.map((G)=>{let Q=G.content;if(!Array.isArray(Q))return G;let J=Q.filter((Z)=>{if(y36(Z))return Z.toolCallId===Y;if(iR8(Z))return Z.toolCallId===Y;return!0});if(J.length===Q.length)return G;return{...G,content:J}})}function g36($){let X=$.filter((G)=>G.role==="system"),Y=$.find((G)=>G.role!=="system");return{systemMessages:X,requestMessage:Y}}function pR8($){let X=!1,Y=$.map((G)=>{if(G.role!=="assistant")return G;if(!G.parts.some((J)=>("state"in J)&&J.state==="approval-requested"))return G;return X=!0,{...G,parts:G.parts.map((J)=>{if(!("state"in J)||J.state!=="approval-requested"||!("approval"in J)||!J.approval)return J;return{...J,state:"output-denied",approval:{...J.approval,approved:!1,reason:"User sent a new message without approving this tool call."}}})}});return X?Y:$}function nR8($){let[X,Y]=$.reduce((G,Q)=>{if(Q.role==="system")G[0].push(Q);else G[1].push(Q);return G},[[],[]]);return{systemMessages:X,messages:Y}}async function rR8($,X){return await $.loadHistory(X)}function aR8($,X){let Y=$.filter((J)=>J.parts&&J.parts.length>0);if(!X)return Y;let G=Y.findIndex((J)=>J.id===X.id);return G>=0?[...Y.slice(0,G),X]:[...Y,X]}async function h36($,X,Y,G){let Q=await rR8($,G),J=aR8(Q,X);return[...Y,...J]}async function u36($,X){let Y=$.filter((B)=>B.role!=="assistant"||B.parts&&B.parts.length>0),G=await zX1({messages:Y}),Q=pR8(G),J=await AV(Q,{tools:X.tools,ignoreIncompleteToolCalls:!0}),{systemMessages:Z,messages:W}=nR8(J),H=x36(W),U=Ej0({messages:H,reasoning:"all",emptyMessages:"remove",toolCalls:"none"}).map((B)=>{if(B.role!=="assistant")return B;let N=Array.isArray(B.content)?B.content.filter((w)=>w.type!=="reasoning"&&w.type!=="thinking"&&w.type!=="redacted-reasoning").map((w)=>{let D=w;if("providerOptions"in D||"providerMetadata"in D){let{providerOptions:O,providerMetadata:j,...E}=D;if(D.type==="tool-call"){let P=j?.google,T=O?.google;return{...E,...P?{providerMetadata:{google:P}}:{},...T?{providerOptions:{google:T}}:{}}}return E}return w}):B.content;return{...B,content:Array.isArray(N)&&N.length===0?[{type:"text",text:""}]:N,providerOptions:void 0,providerMetadata:void 0}});return{systemMessages:Z,messages:U,originalMessages:G}}var sy1=z(()=>{q5()});function PW($){return`mesh-storage://${$}`}function Qh($){if(!$.startsWith("mesh-storage://"))return null;return $.slice(15)}function Eq0(){return/mesh-storage:\/\/([^\s"'<>[\]]+)/g}function tR8($,X,Y){return`${$}/api/${X}/files/${Y}`}function sR8($){return $.type==="file"&&"mediaType"in $&&typeof $.mediaType==="string"&&oR8.has($.mediaType)}function m36($){let X=$.match(/^data:([^;]+);base64,(.+)$/s);if(!X)return null;let[,Y,G]=X;try{let Q=atob(G),J=new Uint8Array(Q.length);for(let Z=0;Z<Q.length;Z++)J[Z]=Q.charCodeAt(Z);return{mimeType:Y,bytes:J}}catch{return null}}function l36($){return{"image/png":"png","image/jpeg":"jpg","image/gif":"gif","image/webp":"webp","image/svg+xml":"svg","application/pdf":"pdf","text/plain":"txt","text/html":"html","application/json":"json"}[$]??"bin"}async function c36($,X,Y,G){if(!G.objectStorage)return null;try{return await G.objectStorage.put(X,$,{contentType:Y}),X}catch(Q){return console.error("[file-materializer] Failed to upload file:",Q),null}}async function Jh($,X){if(!X.objectStorage)return null;try{return await X.objectStorage.presignedGetUrl($,eR8)}catch(Y){return console.error("[file-materializer] Failed to generate presigned URL:",Y),null}}async function d36($,X){if(!X.organization)return $;let Y=X.organization.slug;if(!Y)return $;let G=$.findLastIndex((D)=>D.role==="user");if(G===-1)return $;let Q=$[G],J=Q.parts.filter((D)=>D.type==="file"&&("url"in D)&&typeof D.url==="string"&&D.url.startsWith("data:"));if(J.length===0)return $;let W=(await Promise.all(J.map(async(D)=>{if(D.type!=="file"||!("url"in D)||typeof D.url!=="string")return null;let O=m36(D.url);if(!O)return null;let j=l36(O.mimeType),E=`chat-uploads/${crypto.randomUUID()}.${j}`,P=await c36(O.bytes,E,O.mimeType,X);if(!P)return null;let T="filename"in D&&typeof D.filename==="string"?D.filename:E;return{dataUrl:D.url,meshStorageUrl:PW(P),redirectUrl:tR8(X.baseUrl,Y,P),filename:T}}))).filter((D)=>D!==null);if(W.length===0)return $;let F=`[Uploaded files \u2014 use these URLs when calling tools]
 ${W.map((D)=>`- ${D.filename}: ${D.meshStorageUrl}`).join(`
 `)}`,U=new Map(W.map((D)=>[D.dataUrl,D.meshStorageUrl])),B=Q.parts.map((D)=>{if(D.type!=="file"||!("url"in D)||typeof D.url!=="string")return D;let O=U.get(D.url);if(!O)return D;return{...D,url:O}}),N=B.findIndex((D)=>D.type==="text"),w;if(N!==-1)w=B.map((D,O)=>{if(O!==N||D.type!=="text")return D;return{...D,text:`${F}
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "decocms",
-  "version": "2.348.2",
+  "version": "2.349.1",
   "description": "Deco CMS — Self-hostable MCP Gateway for managing AI connections and tools",
   "author": "Deco team",
   "repository": {

package/dist/client/assets/AlertCircle-mf2ZLEuj.js

@@ -1 +0,0 @@
-import{r}from"./index-CRD1iOrS.js";const i=({size:e=24,color:t="currentColor",...o})=>r.createElement("svg",{viewBox:"0 0 24 24",width:e,height:e,stroke:t,strokeWidth:"2",fill:"none",strokeLinecap:"round",strokeLinejoin:"round","aria-hidden":"true",...o},r.createElement("path",{d:"M12 8v4m0 4h.01M22 12c0 5.523-4.477 10-10 10S2 17.523 2 12 6.477 2 12 2s10 4.477 10 10Z"}));i.displayName="AlertCircle";export{i};