npm - decocms - Versions diffs - 3.103.0 → 3.103.2 - Mend

decocms 3.103.0 → 3.103.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (218) hide show

package/dist/server/server.js CHANGED Viewed

@@ -2503,7 +2503,7 @@ The expected part count is based on the byte-count of the input.params.Body,
 which was read from ${J} and is ${Q}.
 If this is not correct, provide an override value by setting a number
 to input.params.ContentLength in bytes.
-`);this.uploadedParts.sort((K,U)=>K.PartNumber-U.PartNumber);let W={...this.params,Body:void 0,UploadId:this.uploadId,MultipartUpload:{Parts:this.uploadedParts}};if(G=await this.client.send(new yh(W)),typeof G?.Location==="string"&&G.Location.includes("%2F"))G.Location=G.Location.replace(/%2F/g,"/")}else G=this.singleUploadResult;if(this.abortMultipartUploadCommand=null,this.tags.length)await this.client.send(new ih({...this.params,Tagging:{TagSet:this.tags}}));return G}async markUploadAsAborted(){if(this.uploadId&&!this.leavePartsOnError&&this.abortMultipartUploadCommand!==null)await this.client.send(this.abortMultipartUploadCommand),this.abortMultipartUploadCommand=null}__notifyProgress($){if(this.uploadEvent)this.emit(this.uploadEvent,$)}async __abortTimeout($){return new Promise((Z,G)=>{$.onabort=()=>{let X=Error("Upload aborted.");X.name="AbortError",G(X)}})}__validateUploadPart($){let Z=Ht($.data);if(Z===void 0)throw Error(`A dataPart was generated without a measurable data chunk size for part number ${$.partNumber}`);if($.partNumber===1&&$.lastPart)return;if(!$.lastPart&&Z!==this.partSize)throw Error(`The byte size for part number ${$.partNumber}, size ${Z} does not match expected size ${this.partSize}`)}__validateInput(){if(!this.client)throw Error("InputError: Upload requires a AWS client to do uploads with.");if(this.partSize<ly.MIN_PART_SIZE)throw Error(`EntityTooSmall: Your proposed upload part size [${this.partSize}] is smaller than the minimum allowed size [${ly.MIN_PART_SIZE}] (5MB)`);if(this.queueSize<1)throw Error("Queue size: Must have at least one uploading queue.")}}});var _q$=()=>{};var bq$=O(()=>{Cq$();_q$()});import{randomUUID as qs6}from"crypto";function fq$($,Z){if(!Ms6.has($))throw new uV(`Content type "${$}" is not allowed.`);if(!Number.isFinite(Z)||Z<=0)throw new uV("File size must be a positive number.");if(Z>dV)throw new uV(`File too large: ${Z} bytes (max ${dV}).`)}function ks6($){let Z=$.normalize("NFKD").replace(/[\u0300-\u036f]/g,"").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/-+/g,"-").replace(/^[-.]+|[-.]+$/g,"");if(Z.length<=80)return Z||"file";let G=Z.lastIndexOf(".");if(G>0&&Z.length-G<=10){let X=Z.slice(G);return Z.slice(0,80-X.length)+X}return Z.slice(0,80)}function xq$($){let Z=new Date,G=Z.getUTCFullYear().toString(),X=String(Z.getUTCMonth()+1).padStart(2,"0"),Y=qs6(),Q=ks6($.filename),J=`${G}/${X}/${Y}-${Q}`;return $.prefix?`${$.prefix}${J}`:J}var dV=104857600,Ms6,uV;var vq$=O(()=>{Ms6=new Set(["image/png","image/jpeg","image/gif","image/webp","image/svg+xml","image/avif","video/mp4","video/webm","video/quicktime","audio/mpeg","audio/wav","audio/ogg","application/pdf","application/json","application/zip","text/plain","text/csv","text/markdown","font/woff","font/woff2","font/ttf","font/otf"]);uV=class uV extends Error{constructor($){super($);this.name="UploadRejected"}}});var yq$=()=>{let $=new y1;return $.post("/file-configs/:id/upload",async(Z)=>{let G=Z.get("meshContext");if(!G.auth?.user?.id)throw new z$(401,{message:"Unauthorized"});let Y=G.organization?.id;if(!Y)throw new z$(400,{message:"Organization required"});await G.access.check("FILE_CONFIG_UPDATE");let Q=Z.req.param("id");if(!Q)throw new z$(400,{message:"Missing config id"});let J=Z.req.query("filename");if(!J)throw new z$(400,{message:"Missing `filename` query parameter"});let W=Z.req.header("content-type")||"application/octet-stream",K=Z.req.header("content-length"),U=K?Number(K):NaN;if(!Number.isFinite(U)||U<=0)throw new z$(411,{message:"Content-Length required and must be a positive number"});try{fq$(W,U)}catch(L){if(L instanceof uV)throw new z$(U>dV?413:400,{message:L.message});throw L}let w=Z.req.raw.body;if(!w)throw new z$(400,{message:"Empty request body"});let F=0,H=!1,N=w.pipeThrough(new TransformStream({transform(L,z){if(F+=L.byteLength,F>dV){H=!0,z.error(new uV(`File too large: stream exceeded ${dV} bytes.`));return}z.enqueue(L)}})),B;try{B=await aO0(G.storage.orgFileConfigs,G.storage.orgSites,Q,Y)}catch(L){if(L instanceof oO0)throw new z$(403,{message:L.message});throw L}let E=xq$({prefix:B.info.prefix,filename:J}),D=ha0(B);try{await new ly({client:D,params:{Bucket:B.info.bucket,Key:E,Body:N,ContentType:W},partSize:8388608,queueSize:4}).done()}catch(L){if(H)throw new z$(413,{message:`File too large: stream exceeded ${dV} bytes.`});throw new z$(502,{message:`Upload to bucket failed: ${L instanceof Error?L.message:String(L)}`})}return Z.json({key:E,publicUrl:rO0(B.info,E),contentType:W,size:F})}),$};var gq$=O(()=>{bq$();d6();PJ();ua0();vq$()});function hq$($){let Z=new y1;return Z.get("/kv/:key",async(G)=>{let Y=G.get("meshContext").organization?.id;if(!Y)return G.json({error:"Organization required"},400);let Q=G.req.param("key");if(r01(Q))return G.json({error:"Reserved key"},403);let J=await $.kvStorage.get(Y,Q);if(J===null)return G.json({error:"Not found"},404);return G.json({key:Q,value:J})}),Z.put("/kv/:key",_X({maxSize:Ss6,onError:(G)=>G.json({error:"Payload too large"},413)}),async(G)=>{let Y=G.get("meshContext").organization?.id;if(!Y)return G.json({error:"Organization required"},400);let Q=G.req.param("key");if(r01(Q))return G.json({error:"Reserved key"},403);let J;try{J=await G.req.json()}catch{return G.json({error:"Invalid JSON body"},400)}return await $.kvStorage.set(Y,Q,J),G.json({ok:!0})}),Z.delete("/kv/:key",async(G)=>{let Y=G.get("meshContext").organization?.id;if(!Y)return G.json({error:"Organization required"},400);let Q=G.req.param("key");if(r01(Q))return G.json({error:"Reserved key"},403);return await $.kvStorage.delete(Y,Q),G.json({ok:!0})}),Z}var Ss6=1048576,Vs6,r01=($)=>Vs6.some((Z)=>$.startsWith(Z));var cq$=O(()=>{d6();ky();Vs6=[Bl1]});function o01($,Z){if(/[.*>\s]/.test($)||/[.*>\s]/.test(Z))return null;return`mesh.org-fs.changes.${$}.${Z}`}function Nt($,Z,G){if(!$)return;let X=o01(Z,G);if(!X)return;try{$.publish(X)}catch{}}function mq$($,Z,G,X){let Y=NZ(G),Q={"Content-Type":Y,"Cache-Control":X?"public, max-age=0, must-revalidate":"private, max-age=0"};if(Y.startsWith("text/html"))Q["Content-Security-Policy"]="sandbox allow-scripts allow-modals";return $.body(Buffer.from(Z),200,Q)}function nq$($,Z){let G=my.get($);return!!G&&Date.now()<=G.resetAt&&G.count>=Z}function gs6($,Z){return!nq$($,xs6)&&!nq$(Z,vs6)}function pq$($,Z){let G=my.get($);if(!G||Z>G.resetAt)my.set($,{count:1,resetAt:Z+ys6});else G.count++}function hs6($,Z){let G=Date.now();if(my.size>5000){for(let[X,Y]of my)if(G>Y.resetAt)my.delete(X)}pq$($,G),pq$(Z,G)}function cs6($){return $.req.header("cf-connecting-ip")||$.req.header("x-real-ip")||$.req.header("x-forwarded-for")?.split(",")[0]?.trim()||"unknown"}function us6($){if($.req.header("x-forwarded-proto")==="https")return!0;try{return new URL($.req.url).protocol==="https:"}catch{return!1}}function ds6($,Z,G,X){let Y=Jb($,XS0(Z,G,X.govPath));if(!Y)return!1;return CI1(Y,{org:Z,volume:G,secret:X.secret,nowSec:Math.floor(Date.now()/1000)})?.govPath===X.govPath}function s01($,Z,G=401){let X=`/api/${encodeURIComponent(Z.orgSlug)}/fs/${encodeURIComponent(Z.volume)}/unlock?path=${encodeURIComponent(Z.path)}`,Y=`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Password required</title><style>
+`);this.uploadedParts.sort((K,U)=>K.PartNumber-U.PartNumber);let W={...this.params,Body:void 0,UploadId:this.uploadId,MultipartUpload:{Parts:this.uploadedParts}};if(G=await this.client.send(new yh(W)),typeof G?.Location==="string"&&G.Location.includes("%2F"))G.Location=G.Location.replace(/%2F/g,"/")}else G=this.singleUploadResult;if(this.abortMultipartUploadCommand=null,this.tags.length)await this.client.send(new ih({...this.params,Tagging:{TagSet:this.tags}}));return G}async markUploadAsAborted(){if(this.uploadId&&!this.leavePartsOnError&&this.abortMultipartUploadCommand!==null)await this.client.send(this.abortMultipartUploadCommand),this.abortMultipartUploadCommand=null}__notifyProgress($){if(this.uploadEvent)this.emit(this.uploadEvent,$)}async __abortTimeout($){return new Promise((Z,G)=>{$.onabort=()=>{let X=Error("Upload aborted.");X.name="AbortError",G(X)}})}__validateUploadPart($){let Z=Ht($.data);if(Z===void 0)throw Error(`A dataPart was generated without a measurable data chunk size for part number ${$.partNumber}`);if($.partNumber===1&&$.lastPart)return;if(!$.lastPart&&Z!==this.partSize)throw Error(`The byte size for part number ${$.partNumber}, size ${Z} does not match expected size ${this.partSize}`)}__validateInput(){if(!this.client)throw Error("InputError: Upload requires a AWS client to do uploads with.");if(this.partSize<ly.MIN_PART_SIZE)throw Error(`EntityTooSmall: Your proposed upload part size [${this.partSize}] is smaller than the minimum allowed size [${ly.MIN_PART_SIZE}] (5MB)`);if(this.queueSize<1)throw Error("Queue size: Must have at least one uploading queue.")}}});var _q$=()=>{};var bq$=O(()=>{Cq$();_q$()});import{randomUUID as qs6}from"crypto";function fq$($,Z){if(!Ms6.has($))throw new uV(`Content type "${$}" is not allowed.`);if(!Number.isFinite(Z)||Z<=0)throw new uV("File size must be a positive number.");if(Z>dV)throw new uV(`File too large: ${Z} bytes (max ${dV}).`)}function ks6($){let Z=$.normalize("NFKD").replace(/[\u0300-\u036f]/g,"").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/-+/g,"-").replace(/^[-.]+|[-.]+$/g,"");if(Z.length<=80)return Z||"file";let G=Z.lastIndexOf(".");if(G>0&&Z.length-G<=10){let X=Z.slice(G);return Z.slice(0,80-X.length)+X}return Z.slice(0,80)}function xq$($){let Z=new Date,G=Z.getUTCFullYear().toString(),X=String(Z.getUTCMonth()+1).padStart(2,"0"),Y=qs6(),Q=ks6($.filename),J=`${G}/${X}/${Y}-${Q}`;return $.prefix?`${$.prefix}${J}`:J}var dV=104857600,Ms6,uV;var vq$=O(()=>{Ms6=new Set(["image/png","image/jpeg","image/gif","image/webp","image/svg+xml","image/avif","video/mp4","video/webm","video/quicktime","audio/mpeg","audio/wav","audio/ogg","application/pdf","application/json","application/zip","text/plain","text/csv","text/markdown","font/woff","font/woff2","font/ttf","font/otf"]);uV=class uV extends Error{constructor($){super($);this.name="UploadRejected"}}});var yq$=()=>{let $=new y1;return $.post("/file-configs/:id/upload",async(Z)=>{let G=Z.get("meshContext");if(!G.auth?.user?.id)throw new z$(401,{message:"Unauthorized"});let Y=G.organization?.id;if(!Y)throw new z$(400,{message:"Organization required"});await G.access.check("FILE_CONFIG_UPDATE");let Q=Z.req.param("id");if(!Q)throw new z$(400,{message:"Missing config id"});let J=Z.req.query("filename");if(!J)throw new z$(400,{message:"Missing `filename` query parameter"});let W=Z.req.header("content-type")||"application/octet-stream",K=Z.req.header("content-length"),U=K?Number(K):NaN;if(!Number.isFinite(U)||U<=0)throw new z$(411,{message:"Content-Length required and must be a positive number"});try{fq$(W,U)}catch(L){if(L instanceof uV)throw new z$(U>dV?413:400,{message:L.message});throw L}let w=Z.req.raw.body;if(!w)throw new z$(400,{message:"Empty request body"});let F=0,H=!1,N=w.pipeThrough(new TransformStream({transform(L,z){if(F+=L.byteLength,F>dV){H=!0,z.error(new uV(`File too large: stream exceeded ${dV} bytes.`));return}z.enqueue(L)}})),B;try{B=await aO0(G.storage.orgFileConfigs,G.storage.orgSites,Q,Y)}catch(L){if(L instanceof oO0)throw new z$(403,{message:L.message});throw L}let E=xq$({prefix:B.info.prefix,filename:J}),D=ha0(B);try{await new ly({client:D,params:{Bucket:B.info.bucket,Key:E,Body:N,ContentType:W},partSize:8388608,queueSize:4}).done()}catch(L){if(H)throw new z$(413,{message:`File too large: stream exceeded ${dV} bytes.`});throw new z$(502,{message:`Upload to bucket failed: ${L instanceof Error?L.message:String(L)}`})}return Z.json({key:E,publicUrl:rO0(B.info,E),contentType:W,size:F})}),$};var gq$=O(()=>{bq$();d6();PJ();ua0();vq$()});function hq$($){let Z=new y1;return Z.get("/kv/:key",async(G)=>{let Y=G.get("meshContext").organization?.id;if(!Y)return G.json({error:"Organization required"},400);let Q=G.req.param("key");if(r01(Q))return G.json({error:"Reserved key"},403);let J=await $.kvStorage.get(Y,Q);if(J===null)return G.json({error:"Not found"},404);return G.json({key:Q,value:J})}),Z.put("/kv/:key",_X({maxSize:Ss6,onError:(G)=>G.json({error:"Payload too large"},413)}),async(G)=>{let Y=G.get("meshContext").organization?.id;if(!Y)return G.json({error:"Organization required"},400);let Q=G.req.param("key");if(r01(Q))return G.json({error:"Reserved key"},403);let J;try{J=await G.req.json()}catch{return G.json({error:"Invalid JSON body"},400)}return await $.kvStorage.set(Y,Q,J),G.json({ok:!0})}),Z.delete("/kv/:key",async(G)=>{let Y=G.get("meshContext").organization?.id;if(!Y)return G.json({error:"Organization required"},400);let Q=G.req.param("key");if(r01(Q))return G.json({error:"Reserved key"},403);return await $.kvStorage.delete(Y,Q),G.json({ok:!0})}),Z}var Ss6=1048576,Vs6,r01=($)=>Vs6.some((Z)=>$.startsWith(Z));var cq$=O(()=>{d6();ky();Vs6=[Bl1]});function o01($,Z){if(/[.*>\s]/.test($)||/[.*>\s]/.test(Z))return null;return`mesh.org-fs.changes.${$}.${Z}`}function Nt($,Z,G){if(!$)return;let X=o01(Z,G);if(!X)return;try{$.publish(X)}catch{}}function mq$($,Z,G,X){let Y=NZ(G),Q={"Content-Type":Y,"Cache-Control":X?"public, max-age=0, must-revalidate":"private, max-age=0"};if(Y.startsWith("text/html"))Q["Content-Security-Policy"]="sandbox allow-scripts allow-modals allow-same-origin";return $.body(Buffer.from(Z),200,Q)}function nq$($,Z){let G=my.get($);return!!G&&Date.now()<=G.resetAt&&G.count>=Z}function gs6($,Z){return!nq$($,xs6)&&!nq$(Z,vs6)}function pq$($,Z){let G=my.get($);if(!G||Z>G.resetAt)my.set($,{count:1,resetAt:Z+ys6});else G.count++}function hs6($,Z){let G=Date.now();if(my.size>5000){for(let[X,Y]of my)if(G>Y.resetAt)my.delete(X)}pq$($,G),pq$(Z,G)}function cs6($){return $.req.header("cf-connecting-ip")||$.req.header("x-real-ip")||$.req.header("x-forwarded-for")?.split(",")[0]?.trim()||"unknown"}function us6($){if($.req.header("x-forwarded-proto")==="https")return!0;try{return new URL($.req.url).protocol==="https:"}catch{return!1}}function ds6($,Z,G,X){let Y=Jb($,XS0(Z,G,X.govPath));if(!Y)return!1;return CI1(Y,{org:Z,volume:G,secret:X.secret,nowSec:Math.floor(Date.now()/1000)})?.govPath===X.govPath}function s01($,Z,G=401){let X=`/api/${encodeURIComponent(Z.orgSlug)}/fs/${encodeURIComponent(Z.volume)}/unlock?path=${encodeURIComponent(Z.path)}`,Y=`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Password required</title><style>
 :root{color-scheme:light dark}
 body{margin:0;min-height:100vh;display:grid;place-items:center;font:15px/1.5 ui-sans-serif,system-ui,sans-serif;background:#f6f6f7;color:#18181b}
 @media(prefers-color-scheme:dark){body{background:#0b0b0c;color:#fafafa}}
@@ -2560,5 +2560,5 @@ NKEYs are sensitive and should be treated as secrets.
 -----BEGIN USER NKEY SEED-----
 ${G}
 ------END USER NKEY SEED------
-`;return new TextEncoder().encode(X)}var F11,mV,qe6,uM$,w11="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",ke6,h$,g$,a8,cM$=24,iV,z3;var tM$=O(()=>{(function($){$.Operator="operator",$.Account="account",$.User="user",$.Activation="activation",$.AuthorizationResponse="authorization_response"})(F11||(F11={}));(function($){var Z=function(g,l){this.hi=g|0,this.lo=l|0},G=function(g){var l,h=new Float64Array(16);if(g)for(l=0;l<g.length;l++)h[l]=g[l];return h},X=function(){throw Error("no PRNG")},Y=new Uint8Array(16),Q=new Uint8Array(32);Q[0]=9;var J=G(),W=G([1]),K=G([56129,1]),U=G([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),w=G([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),F=G([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),H=G([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),N=G([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function B(g,l){return g<<l|g>>>32-l}function E(g,l){var h=g[l+3]&255;return h=h<<8|g[l+2]&255,h=h<<8|g[l+1]&255,h<<8|g[l+0]&255}function D(g,l){var h=g[l]<<24|g[l+1]<<16|g[l+2]<<8|g[l+3],r=g[l+4]<<24|g[l+5]<<16|g[l+6]<<8|g[l+7];return new Z(h,r)}function L(g,l,h){var r;for(r=0;r<4;r++)g[l+r]=h&255,h>>>=8}function z(g,l,h){g[l]=h.hi>>24&255,g[l+1]=h.hi>>16&255,g[l+2]=h.hi>>8&255,g[l+3]=h.hi&255,g[l+4]=h.lo>>24&255,g[l+5]=h.lo>>16&255,g[l+6]=h.lo>>8&255,g[l+7]=h.lo&255}function j(g,l,h,r,Y0){var W0,b0=0;for(W0=0;W0<Y0;W0++)b0|=g[l+W0]^h[r+W0];return(1&b0-1>>>8)-1}function P(g,l,h,r){return j(g,l,h,r,16)}function A(g,l,h,r){return j(g,l,h,r,32)}function M(g,l,h,r,Y0){var W0=new Uint32Array(16),b0=new Uint32Array(16),l0=new Uint32Array(16),P0=new Uint32Array(4),M0,j0,g0;for(M0=0;M0<4;M0++)b0[5*M0]=E(r,4*M0),b0[1+M0]=E(h,4*M0),b0[6+M0]=E(l,4*M0),b0[11+M0]=E(h,16+4*M0);for(M0=0;M0<16;M0++)l0[M0]=b0[M0];for(M0=0;M0<20;M0++){for(j0=0;j0<4;j0++){for(g0=0;g0<4;g0++)P0[g0]=b0[(5*j0+4*g0)%16];P0[1]^=B(P0[0]+P0[3]|0,7),P0[2]^=B(P0[1]+P0[0]|0,9),P0[3]^=B(P0[2]+P0[1]|0,13),P0[0]^=B(P0[3]+P0[2]|0,18);for(g0=0;g0<4;g0++)W0[4*j0+(j0+g0)%4]=P0[g0]}for(g0=0;g0<16;g0++)b0[g0]=W0[g0]}if(Y0){for(M0=0;M0<16;M0++)b0[M0]=b0[M0]+l0[M0]|0;for(M0=0;M0<4;M0++)b0[5*M0]=b0[5*M0]-E(r,4*M0)|0,b0[6+M0]=b0[6+M0]-E(l,4*M0)|0;for(M0=0;M0<4;M0++)L(g,4*M0,b0[5*M0]),L(g,16+4*M0,b0[6+M0])}else for(M0=0;M0<16;M0++)L(g,4*M0,b0[M0]+l0[M0]|0)}function S(g,l,h,r){return M(g,l,h,r,!1),0}function q(g,l,h,r){return M(g,l,h,r,!0),0}var V=new Uint8Array([101,120,112,97,110,100,32,51,50,45,98,121,116,101,32,107]);function t(g,l,h,r,Y0,W0,b0){var l0=new Uint8Array(16),P0=new Uint8Array(64),M0,j0;if(!Y0)return 0;for(j0=0;j0<16;j0++)l0[j0]=0;for(j0=0;j0<8;j0++)l0[j0]=W0[j0];while(Y0>=64){S(P0,l0,b0,V);for(j0=0;j0<64;j0++)g[l+j0]=(h?h[r+j0]:0)^P0[j0];M0=1;for(j0=8;j0<16;j0++)M0=M0+(l0[j0]&255)|0,l0[j0]=M0&255,M0>>>=8;if(Y0-=64,l+=64,h)r+=64}if(Y0>0){S(P0,l0,b0,V);for(j0=0;j0<Y0;j0++)g[l+j0]=(h?h[r+j0]:0)^P0[j0]}return 0}function f(g,l,h,r,Y0){return t(g,l,null,0,h,r,Y0)}function v(g,l,h,r,Y0){var W0=new Uint8Array(32);return q(W0,r,Y0,V),f(g,l,h,r.subarray(16),W0)}function e(g,l,h,r,Y0,W0,b0){var l0=new Uint8Array(32);return q(l0,W0,b0,V),t(g,l,h,r,Y0,W0.subarray(16),l0)}function o(g,l){var h,r=0;for(h=0;h<17;h++)r=r+(g[h]+l[h]|0)|0,g[h]=r&255,r>>>=8}var B0=new Uint32Array([5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,252]);function O0(g,l,h,r,Y0,W0){var b0,l0,P0,M0,j0=new Uint32Array(17),g0=new Uint32Array(17),o0=new Uint32Array(17),Z1=new Uint32Array(17),K1=new Uint32Array(17);for(P0=0;P0<17;P0++)g0[P0]=o0[P0]=0;for(P0=0;P0<16;P0++)g0[P0]=W0[P0];g0[3]&=15,g0[4]&=252,g0[7]&=15,g0[8]&=252,g0[11]&=15,g0[12]&=252,g0[15]&=15;while(Y0>0){for(P0=0;P0<17;P0++)Z1[P0]=0;for(P0=0;P0<16&&P0<Y0;++P0)Z1[P0]=h[r+P0];Z1[P0]=1,r+=P0,Y0-=P0,o(o0,Z1);for(l0=0;l0<17;l0++){j0[l0]=0;for(P0=0;P0<17;P0++)j0[l0]=j0[l0]+o0[P0]*(P0<=l0?g0[l0-P0]:320*g0[l0+17-P0]|0)|0|0}for(l0=0;l0<17;l0++)o0[l0]=j0[l0];M0=0;for(P0=0;P0<16;P0++)M0=M0+o0[P0]|0,o0[P0]=M0&255,M0>>>=8;M0=M0+o0[16]|0,o0[16]=M0&3,M0=5*(M0>>>2)|0;for(P0=0;P0<16;P0++)M0=M0+o0[P0]|0,o0[P0]=M0&255,M0>>>=8;M0=M0+o0[16]|0,o0[16]=M0}for(P0=0;P0<17;P0++)K1[P0]=o0[P0];o(o0,B0),b0=-(o0[16]>>>7)|0;for(P0=0;P0<17;P0++)o0[P0]^=b0&(K1[P0]^o0[P0]);for(P0=0;P0<16;P0++)Z1[P0]=W0[P0+16];Z1[16]=0,o(o0,Z1);for(P0=0;P0<16;P0++)g[l+P0]=o0[P0];return 0}function K0(g,l,h,r,Y0,W0){var b0=new Uint8Array(16);return O0(b0,0,h,r,Y0,W0),P(g,l,b0,0)}function J0(g,l,h,r,Y0){var W0;if(h<32)return-1;e(g,0,l,0,h,r,Y0),O0(g,16,g,32,h-32,g);for(W0=0;W0<16;W0++)g[W0]=0;return 0}function s(g,l,h,r,Y0){var W0,b0=new Uint8Array(32);if(h<32)return-1;if(v(b0,0,32,r,Y0),K0(l,16,l,32,h-32,b0)!==0)return-1;e(g,0,l,0,h,r,Y0);for(W0=0;W0<32;W0++)g[W0]=0;return 0}function T0(g,l){var h;for(h=0;h<16;h++)g[h]=l[h]|0}function F0(g){var l,h;for(h=0;h<16;h++)g[h]+=65536,l=Math.floor(g[h]/65536),g[(h+1)*(h<15?1:0)]+=l-1+37*(l-1)*(h===15?1:0),g[h]-=l*65536}function f0(g,l,h){var r,Y0=~(h-1);for(var W0=0;W0<16;W0++)r=Y0&(g[W0]^l[W0]),g[W0]^=r,l[W0]^=r}function m0(g,l){var h,r,Y0,W0=G(),b0=G();for(h=0;h<16;h++)b0[h]=l[h];F0(b0),F0(b0),F0(b0);for(r=0;r<2;r++){W0[0]=b0[0]-65517;for(h=1;h<15;h++)W0[h]=b0[h]-65535-(W0[h-1]>>16&1),W0[h-1]&=65535;W0[15]=b0[15]-32767-(W0[14]>>16&1),Y0=W0[15]>>16&1,W0[14]&=65535,f0(b0,W0,1-Y0)}for(h=0;h<16;h++)g[2*h]=b0[h]&255,g[2*h+1]=b0[h]>>8}function x0(g,l){var h=new Uint8Array(32),r=new Uint8Array(32);return m0(h,g),m0(r,l),A(h,0,r,0)}function i0(g){var l=new Uint8Array(32);return m0(l,g),l[0]&1}function H0(g,l){var h;for(h=0;h<16;h++)g[h]=l[2*h]+(l[2*h+1]<<8);g[15]&=32767}function V0(g,l,h){var r;for(r=0;r<16;r++)g[r]=l[r]+h[r]|0}function R0(g,l,h){var r;for(r=0;r<16;r++)g[r]=l[r]-h[r]|0}function w0(g,l,h){var r,Y0,W0=new Float64Array(31);for(r=0;r<31;r++)W0[r]=0;for(r=0;r<16;r++)for(Y0=0;Y0<16;Y0++)W0[r+Y0]+=l[r]*h[Y0];for(r=0;r<15;r++)W0[r]+=38*W0[r+16];for(r=0;r<16;r++)g[r]=W0[r];F0(g),F0(g)}function Q0(g,l){w0(g,l,l)}function G0(g,l){var h=G(),r;for(r=0;r<16;r++)h[r]=l[r];for(r=253;r>=0;r--)if(Q0(h,h),r!==2&&r!==4)w0(h,h,l);for(r=0;r<16;r++)g[r]=h[r]}function k0(g,l){var h=G(),r;for(r=0;r<16;r++)h[r]=l[r];for(r=250;r>=0;r--)if(Q0(h,h),r!==1)w0(h,h,l);for(r=0;r<16;r++)g[r]=h[r]}function i(g,l,h){var r=new Uint8Array(32),Y0=new Float64Array(80),W0,b0,l0=G(),P0=G(),M0=G(),j0=G(),g0=G(),o0=G();for(b0=0;b0<31;b0++)r[b0]=l[b0];r[31]=l[31]&127|64,r[0]&=248,H0(Y0,h);for(b0=0;b0<16;b0++)P0[b0]=Y0[b0],j0[b0]=l0[b0]=M0[b0]=0;l0[0]=j0[0]=1;for(b0=254;b0>=0;--b0)W0=r[b0>>>3]>>>(b0&7)&1,f0(l0,P0,W0),f0(M0,j0,W0),V0(g0,l0,M0),R0(l0,l0,M0),V0(M0,P0,j0),R0(P0,P0,j0),Q0(j0,g0),Q0(o0,l0),w0(l0,M0,l0),w0(M0,P0,g0),V0(g0,l0,M0),R0(l0,l0,M0),Q0(P0,l0),R0(M0,j0,o0),w0(l0,M0,K),V0(l0,l0,j0),w0(M0,M0,l0),w0(l0,j0,o0),w0(j0,P0,Y0),Q0(P0,g0),f0(l0,P0,W0),f0(M0,j0,W0);for(b0=0;b0<16;b0++)Y0[b0+16]=l0[b0],Y0[b0+32]=M0[b0],Y0[b0+48]=P0[b0],Y0[b0+64]=j0[b0];var Z1=Y0.subarray(32),K1=Y0.subarray(16);return G0(Z1,Z1),w0(K1,K1,Z1),m0(g,K1),0}function $0(g,l){return i(g,l,Q)}function p0(g,l){return X(l,32),$0(g,l)}function I0(g,l,h){var r=new Uint8Array(32);return i(r,h,l),q(g,Y,r,V)}var d=J0,m=s;function C0(g,l,h,r,Y0,W0){var b0=new Uint8Array(32);return I0(b0,Y0,W0),d(g,l,h,r,b0)}function v0(g,l,h,r,Y0,W0){var b0=new Uint8Array(32);return I0(b0,Y0,W0),m(g,l,h,r,b0)}function r0(){var g=0,l=0,h=0,r=0,Y0=65535,W0,b0,l0;for(l0=0;l0<arguments.length;l0++)W0=arguments[l0].lo,b0=arguments[l0].hi,g+=W0&Y0,l+=W0>>>16,h+=b0&Y0,r+=b0>>>16;return l+=g>>>16,h+=l>>>16,r+=h>>>16,new Z(h&Y0|r<<16,g&Y0|l<<16)}function s0(g,l){return new Z(g.hi>>>l,g.lo>>>l|g.hi<<32-l)}function x1(){var g=0,l=0,h;for(h=0;h<arguments.length;h++)g^=arguments[h].lo,l^=arguments[h].hi;return new Z(l,g)}function W8(g,l){var h,r,Y0=32-l;if(l<32)h=g.hi>>>l|g.lo<<Y0,r=g.lo>>>l|g.hi<<Y0;else if(l<64)h=g.lo>>>l|g.hi<<Y0,r=g.hi>>>l|g.lo<<Y0;return new Z(h,r)}function z4(g,l,h){var r=g.hi&l.hi^~g.hi&h.hi,Y0=g.lo&l.lo^~g.lo&h.lo;return new Z(r,Y0)}function l4(g,l,h){var r=g.hi&l.hi^g.hi&h.hi^l.hi&h.hi,Y0=g.lo&l.lo^g.lo&h.lo^l.lo&h.lo;return new Z(r,Y0)}function F5(g){return x1(W8(g,28),W8(g,34),W8(g,39))}function Z0(g){return x1(W8(g,14),W8(g,18),W8(g,41))}function W1(g){return x1(W8(g,1),W8(g,8),s0(g,7))}function m8(g){return x1(W8(g,19),W8(g,61),s0(g,6))}var t$=[new Z(1116352408,3609767458),new Z(1899447441,602891725),new Z(3049323471,3964484399),new Z(3921009573,2173295548),new Z(961987163,4081628472),new Z(1508970993,3053834265),new Z(2453635748,2937671579),new Z(2870763221,3664609560),new Z(3624381080,2734883394),new Z(310598401,1164996542),new Z(607225278,1323610764),new Z(1426881987,3590304994),new Z(1925078388,4068182383),new Z(2162078206,991336113),new Z(2614888103,633803317),new Z(3248222580,3479774868),new Z(3835390401,2666613458),new Z(4022224774,944711139),new Z(264347078,2341262773),new Z(604807628,2007800933),new Z(770255983,1495990901),new Z(1249150122,1856431235),new Z(1555081692,3175218132),new Z(1996064986,2198950837),new Z(2554220882,3999719339),new Z(2821834349,766784016),new Z(2952996808,2566594879),new Z(3210313671,3203337956),new Z(3336571891,1034457026),new Z(3584528711,2466948901),new Z(113926993,3758326383),new Z(338241895,168717936),new Z(666307205,1188179964),new Z(773529912,1546045734),new Z(1294757372,1522805485),new Z(1396182291,2643833823),new Z(1695183700,2343527390),new Z(1986661051,1014477480),new Z(2177026350,1206759142),new Z(2456956037,344077627),new Z(2730485921,1290863460),new Z(2820302411,3158454273),new Z(3259730800,3505952657),new Z(3345764771,106217008),new Z(3516065817,3606008344),new Z(3600352804,1432725776),new Z(4094571909,1467031594),new Z(275423344,851169720),new Z(430227734,3100823752),new Z(506948616,1363258195),new Z(659060556,3750685593),new Z(883997877,3785050280),new Z(958139571,3318307427),new Z(1322822218,3812723403),new Z(1537002063,2003034995),new Z(1747873779,3602036899),new Z(1955562222,1575990012),new Z(2024104815,1125592928),new Z(2227730452,2716904306),new Z(2361852424,442776044),new Z(2428436474,593698344),new Z(2756734187,3733110249),new Z(3204031479,2999351573),new Z(3329325298,3815920427),new Z(3391569614,3928383900),new Z(3515267271,566280711),new Z(3940187606,3454069534),new Z(4118630271,4000239992),new Z(116418474,1914138554),new Z(174292421,2731055270),new Z(289380356,3203993006),new Z(460393269,320620315),new Z(685471733,587496836),new Z(852142971,1086792851),new Z(1017036298,365543100),new Z(1126000580,2618297676),new Z(1288033470,3409855158),new Z(1501505948,4234509866),new Z(1607167915,987167468),new Z(1816402316,1246189591)];function D9(g,l,h){var r=[],Y0=[],W0=[],b0=[],l0,P0,M0;for(P0=0;P0<8;P0++)r[P0]=W0[P0]=D(g,8*P0);var j0=0;while(h>=128){for(P0=0;P0<16;P0++)b0[P0]=D(l,8*P0+j0);for(P0=0;P0<80;P0++){for(M0=0;M0<8;M0++)Y0[M0]=W0[M0];l0=r0(W0[7],Z0(W0[4]),z4(W0[4],W0[5],W0[6]),t$[P0],b0[P0%16]),Y0[7]=r0(l0,F5(W0[0]),l4(W0[0],W0[1],W0[2])),Y0[3]=r0(Y0[3],l0);for(M0=0;M0<8;M0++)W0[(M0+1)%8]=Y0[M0];if(P0%16===15)for(M0=0;M0<16;M0++)b0[M0]=r0(b0[M0],b0[(M0+9)%16],W1(b0[(M0+1)%16]),m8(b0[(M0+14)%16]))}for(P0=0;P0<8;P0++)W0[P0]=r0(W0[P0],r[P0]),r[P0]=W0[P0];j0+=128,h-=128}for(P0=0;P0<8;P0++)z(g,8*P0,r[P0]);return h}var f7=new Uint8Array([106,9,230,103,243,188,201,8,187,103,174,133,132,202,167,59,60,110,243,114,254,148,248,43,165,79,245,58,95,29,54,241,81,14,82,127,173,230,130,209,155,5,104,140,43,62,108,31,31,131,217,171,251,65,189,107,91,224,205,25,19,126,33,121]);function P8(g,l,h){var r=new Uint8Array(64),Y0=new Uint8Array(256),W0,b0=h;for(W0=0;W0<64;W0++)r[W0]=f7[W0];D9(r,l,h),h%=128;for(W0=0;W0<256;W0++)Y0[W0]=0;for(W0=0;W0<h;W0++)Y0[W0]=l[b0-h+W0];Y0[h]=128,h=256-128*(h<112?1:0),Y0[h-9]=0,z(Y0,h-8,new Z(b0/536870912|0,b0<<3)),D9(r,Y0,h);for(W0=0;W0<64;W0++)g[W0]=r[W0];return 0}function I6(g,l){var h=G(),r=G(),Y0=G(),W0=G(),b0=G(),l0=G(),P0=G(),M0=G(),j0=G();R0(h,g[1],g[0]),R0(j0,l[1],l[0]),w0(h,h,j0),V0(r,g[0],g[1]),V0(j0,l[0],l[1]),w0(r,r,j0),w0(Y0,g[3],l[3]),w0(Y0,Y0,w),w0(W0,g[2],l[2]),V0(W0,W0,W0),R0(b0,r,h),R0(l0,W0,Y0),V0(P0,W0,Y0),V0(M0,r,h),w0(g[0],b0,l0),w0(g[1],M0,P0),w0(g[2],P0,l0),w0(g[3],b0,M0)}function e4(g,l,h){var r;for(r=0;r<4;r++)f0(g[r],l[r],h)}function A5(g,l){var h=G(),r=G(),Y0=G();G0(Y0,l[2]),w0(h,l[0],Y0),w0(r,l[1],Y0),m0(g,r),g[31]^=i0(h)<<7}function $9(g,l,h){var r,Y0;T0(g[0],J),T0(g[1],W),T0(g[2],W),T0(g[3],J);for(Y0=255;Y0>=0;--Y0)r=h[Y0/8|0]>>(Y0&7)&1,e4(g,l,r),I6(l,g),I6(g,g),e4(g,l,r)}function L9(g,l){var h=[G(),G(),G(),G()];T0(h[0],F),T0(h[1],H),T0(h[2],W),w0(h[3],F,H),$9(g,h,l)}function _1(g,l,h){var r=new Uint8Array(64),Y0=[G(),G(),G(),G()],W0;if(!h)X(l,32);P8(r,l,32),r[0]&=248,r[31]&=127,r[31]|=64,L9(Y0,r),A5(g,Y0);for(W0=0;W0<32;W0++)l[W0+32]=g[W0];return 0}var A8=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]);function T8(g,l){var h,r,Y0,W0;for(r=63;r>=32;--r){h=0;for(Y0=r-32,W0=r-12;Y0<W0;++Y0)l[Y0]+=h-16*l[r]*A8[Y0-(r-32)],h=Math.floor((l[Y0]+128)/256),l[Y0]-=h*256;l[Y0]+=h,l[r]=0}h=0;for(Y0=0;Y0<32;Y0++)l[Y0]+=h-(l[31]>>4)*A8[Y0],h=l[Y0]>>8,l[Y0]&=255;for(Y0=0;Y0<32;Y0++)l[Y0]-=h*A8[Y0];for(r=0;r<32;r++)l[r+1]+=l[r]>>8,g[r]=l[r]&255}function s8(g){var l=new Float64Array(64),h;for(h=0;h<64;h++)l[h]=g[h];for(h=0;h<64;h++)g[h]=0;T8(g,l)}function _$(g,l,h,r){var Y0=new Uint8Array(64),W0=new Uint8Array(64),b0=new Uint8Array(64),l0,P0,M0=new Float64Array(64),j0=[G(),G(),G(),G()];P8(Y0,r,32),Y0[0]&=248,Y0[31]&=127,Y0[31]|=64;var g0=h+64;for(l0=0;l0<h;l0++)g[64+l0]=l[l0];for(l0=0;l0<32;l0++)g[32+l0]=Y0[32+l0];P8(b0,g.subarray(32),h+32),s8(b0),L9(j0,b0),A5(g,j0);for(l0=32;l0<64;l0++)g[l0]=r[l0];P8(W0,g,h+64),s8(W0);for(l0=0;l0<64;l0++)M0[l0]=0;for(l0=0;l0<32;l0++)M0[l0]=b0[l0];for(l0=0;l0<32;l0++)for(P0=0;P0<32;P0++)M0[l0+P0]+=W0[l0]*Y0[P0];return T8(g.subarray(32),M0),g0}function K8(g,l){var h=G(),r=G(),Y0=G(),W0=G(),b0=G(),l0=G(),P0=G();if(T0(g[2],W),H0(g[1],l),Q0(Y0,g[1]),w0(W0,Y0,U),R0(Y0,Y0,g[2]),V0(W0,g[2],W0),Q0(b0,W0),Q0(l0,b0),w0(P0,l0,b0),w0(h,P0,Y0),w0(h,h,W0),k0(h,h),w0(h,h,Y0),w0(h,h,W0),w0(h,h,W0),w0(g[0],h,W0),Q0(r,g[0]),w0(r,r,W0),x0(r,Y0))w0(g[0],g[0],N);if(Q0(r,g[0]),w0(r,r,W0),x0(r,Y0))return-1;if(i0(g[0])===l[31]>>7)R0(g[0],J,g[0]);return w0(g[3],g[0],g[1]),0}function EG(g,l,h,r){var Y0,W0=new Uint8Array(32),b0=new Uint8Array(64),l0=[G(),G(),G(),G()],P0=[G(),G(),G(),G()];if(h<64)return-1;if(K8(P0,r))return-1;for(Y0=0;Y0<h;Y0++)g[Y0]=l[Y0];for(Y0=0;Y0<32;Y0++)g[Y0+32]=r[Y0];if(P8(b0,g,h),s8(b0),$9(l0,P0,b0),L9(P0,l.subarray(32)),I6(l0,P0),A5(W0,l0),h-=64,A(l,0,W0,0)){for(Y0=0;Y0<h;Y0++)g[Y0]=0;return-1}for(Y0=0;Y0<h;Y0++)g[Y0]=l[Y0+64];return h}var R$=32,c6=24,t6=32,i8=16,$5=32,C=32,u=32,c=32,I=32,p=c6,y0=t6,d0=i8,Q1=64,w1=32,b1=64,V1=32,Z8=64;$.lowlevel={crypto_core_hsalsa20:q,crypto_stream_xor:e,crypto_stream:v,crypto_stream_salsa20_xor:t,crypto_stream_salsa20:f,crypto_onetimeauth:O0,crypto_onetimeauth_verify:K0,crypto_verify_16:P,crypto_verify_32:A,crypto_secretbox:J0,crypto_secretbox_open:s,crypto_scalarmult:i,crypto_scalarmult_base:$0,crypto_box_beforenm:I0,crypto_box_afternm:d,crypto_box:C0,crypto_box_open:v0,crypto_box_keypair:p0,crypto_hash:P8,crypto_sign:_$,crypto_sign_keypair:_1,crypto_sign_open:EG,crypto_secretbox_KEYBYTES:R$,crypto_secretbox_NONCEBYTES:c6,crypto_secretbox_ZEROBYTES:t6,crypto_secretbox_BOXZEROBYTES:i8,crypto_scalarmult_BYTES:$5,crypto_scalarmult_SCALARBYTES:C,crypto_box_PUBLICKEYBYTES:u,crypto_box_SECRETKEYBYTES:c,crypto_box_BEFORENMBYTES:I,crypto_box_NONCEBYTES:p,crypto_box_ZEROBYTES:y0,crypto_box_BOXZEROBYTES:d0,crypto_sign_BYTES:Q1,crypto_sign_PUBLICKEYBYTES:w1,crypto_sign_SECRETKEYBYTES:b1,crypto_sign_SEEDBYTES:V1,crypto_hash_BYTES:Z8,gf:G,D:U,L:A8,pack25519:m0,unpack25519:H0,M:w0,A:V0,S:Q0,Z:R0,pow2523:k0,add:I6,set25519:T0,modL:T8,scalarmult:$9,scalarbase:L9};function h1(g,l){if(g.length!==R$)throw Error("bad key size");if(l.length!==c6)throw Error("bad nonce size")}function D$(g,l){if(g.length!==u)throw Error("bad public key size");if(l.length!==c)throw Error("bad secret key size")}function G$(){for(var g=0;g<arguments.length;g++)if(!(arguments[g]instanceof Uint8Array))throw TypeError("unexpected type, use Uint8Array")}function f$(g){for(var l=0;l<g.length;l++)g[l]=0}$.randomBytes=function(g){var l=new Uint8Array(g);return X(l,g),l},$.secretbox=function(g,l,h){G$(g,l,h),h1(h,l);var r=new Uint8Array(t6+g.length),Y0=new Uint8Array(r.length);for(var W0=0;W0<g.length;W0++)r[W0+t6]=g[W0];return J0(Y0,r,r.length,l,h),Y0.subarray(i8)},$.secretbox.open=function(g,l,h){G$(g,l,h),h1(h,l);var r=new Uint8Array(i8+g.length),Y0=new Uint8Array(r.length);for(var W0=0;W0<g.length;W0++)r[W0+i8]=g[W0];if(r.length<32)return null;if(s(Y0,r,r.length,l,h)!==0)return null;return Y0.subarray(t6)},$.secretbox.keyLength=R$,$.secretbox.nonceLength=c6,$.secretbox.overheadLength=i8,$.scalarMult=function(g,l){if(G$(g,l),g.length!==C)throw Error("bad n size");if(l.length!==$5)throw Error("bad p size");var h=new Uint8Array($5);return i(h,g,l),h},$.scalarMult.base=function(g){if(G$(g),g.length!==C)throw Error("bad n size");var l=new Uint8Array($5);return $0(l,g),l},$.scalarMult.scalarLength=C,$.scalarMult.groupElementLength=$5,$.box=function(g,l,h,r){var Y0=$.box.before(h,r);return $.secretbox(g,l,Y0)},$.box.before=function(g,l){G$(g,l),D$(g,l);var h=new Uint8Array(I);return I0(h,g,l),h},$.box.after=$.secretbox,$.box.open=function(g,l,h,r){var Y0=$.box.before(h,r);return $.secretbox.open(g,l,Y0)},$.box.open.after=$.secretbox.open,$.box.keyPair=function(){var g=new Uint8Array(u),l=new Uint8Array(c);return p0(g,l),{publicKey:g,secretKey:l}},$.box.keyPair.fromSecretKey=function(g){if(G$(g),g.length!==c)throw Error("bad secret key size");var l=new Uint8Array(u);return $0(l,g),{publicKey:l,secretKey:new Uint8Array(g)}},$.box.publicKeyLength=u,$.box.secretKeyLength=c,$.box.sharedKeyLength=I,$.box.nonceLength=p,$.box.overheadLength=$.secretbox.overheadLength,$.sign=function(g,l){if(G$(g,l),l.length!==b1)throw Error("bad secret key size");var h=new Uint8Array(Q1+g.length);return _$(h,g,g.length,l),h},$.sign.open=function(g,l){if(G$(g,l),l.length!==w1)throw Error("bad public key size");var h=new Uint8Array(g.length),r=EG(h,g,g.length,l);if(r<0)return null;var Y0=new Uint8Array(r);for(var W0=0;W0<Y0.length;W0++)Y0[W0]=h[W0];return Y0},$.sign.detached=function(g,l){var h=$.sign(g,l),r=new Uint8Array(Q1);for(var Y0=0;Y0<r.length;Y0++)r[Y0]=h[Y0];return r},$.sign.detached.verify=function(g,l,h){if(G$(g,l,h),l.length!==Q1)throw Error("bad signature size");if(h.length!==w1)throw Error("bad public key size");var r=new Uint8Array(Q1+g.length),Y0=new Uint8Array(Q1+g.length),W0;for(W0=0;W0<Q1;W0++)r[W0]=l[W0];for(W0=0;W0<g.length;W0++)r[W0+Q1]=g[W0];return EG(Y0,r,r.length,h)>=0},$.sign.keyPair=function(){var g=new Uint8Array(w1),l=new Uint8Array(b1);return _1(g,l),{publicKey:g,secretKey:l}},$.sign.keyPair.fromSecretKey=function(g){if(G$(g),g.length!==b1)throw Error("bad secret key size");var l=new Uint8Array(w1);for(var h=0;h<l.length;h++)l[h]=g[32+h];return{publicKey:l,secretKey:new Uint8Array(g)}},$.sign.keyPair.fromSeed=function(g){if(G$(g),g.length!==V1)throw Error("bad seed size");var l=new Uint8Array(w1),h=new Uint8Array(b1);for(var r=0;r<32;r++)h[r]=g[r];return _1(l,h,!0),{publicKey:l,secretKey:h}},$.sign.publicKeyLength=w1,$.sign.secretKeyLength=b1,$.sign.seedLength=V1,$.sign.signatureLength=Q1,$.hash=function(g){G$(g);var l=new Uint8Array(Z8);return P8(l,g,g.length),l},$.hash.hashLength=Z8,$.verify=function(g,l){if(G$(g,l),g.length===0||l.length===0)return!1;if(g.length!==l.length)return!1;return j(g,0,l,0,g.length)===0?!0:!1},$.setPRNG=function(g){X=g},function(){var g=typeof globalThis<"u"?globalThis.crypto||globalThis.msCrypto:null;if(g&&g.getRandomValues){var l=65536;$.setPRNG(function(h,r){var Y0,W0=new Uint8Array(r);for(Y0=0;Y0<r;Y0+=l)g.getRandomValues(W0.subarray(Y0,Y0+Math.min(r-Y0,l)));for(Y0=0;Y0<r;Y0++)h[Y0]=W0[Y0];f$(W0)})}else if(g=u0("crypto"),g&&g.randomBytes)$.setPRNG(function(h,r){var Y0,W0=g.randomBytes(r);for(Y0=0;Y0<r;Y0++)h[Y0]=W0[Y0];f$(W0)})}()})(typeof ty<"u"&&es9?es9:globalThis.nacl=globalThis.nacl||{});mV=typeof ty<"u"&&es9?es9:globalThis.nacl,qe6={fromSeed:mV.sign.keyPair.fromSeed,sign:mV.sign.detached,verify:mV.sign.detached.verify,randomBytes:mV.randomBytes,scalarBaseMultiply:mV.scalarMult.base,seal:mV.box,open:mV.box.open};ke6=new Uint16Array([0,4129,8258,12387,16516,20645,24774,28903,33032,37161,41290,45419,49548,53677,57806,61935,4657,528,12915,8786,21173,17044,29431,25302,37689,33560,45947,41818,54205,50076,62463,58334,9314,13379,1056,5121,25830,29895,17572,21637,42346,46411,34088,38153,58862,62927,50604,54669,13907,9842,5649,1584,30423,26358,22165,18100,46939,42874,38681,34616,63455,59390,55197,51132,18628,22757,26758,30887,2112,6241,10242,14371,51660,55789,59790,63919,35144,39273,43274,47403,23285,19156,31415,27286,6769,2640,14899,10770,56317,52188,64447,60318,39801,35672,47931,43802,27814,31879,19684,23749,11298,15363,3168,7233,60846,64911,52716,56781,44330,48395,36200,40265,32407,28342,24277,20212,15891,11826,7761,3696,65439,61374,57309,53244,48923,44858,40793,36728,37256,33193,45514,41451,53516,49453,61774,57711,4224,161,12482,8419,20484,16421,28742,24679,33721,37784,41979,46042,49981,54044,58239,62302,689,4752,8947,13010,16949,21012,25207,29270,46570,42443,38312,34185,62830,58703,54572,50445,13538,9411,5280,1153,29798,25671,21540,17413,42971,47098,34713,38840,59231,63358,50973,55100,9939,14066,1681,5808,26199,30326,17941,22068,55628,51565,63758,59695,39368,35305,47498,43435,22596,18533,30726,26663,6336,2273,14466,10403,52093,56156,60223,64286,35833,39896,43963,48026,19061,23124,27191,31254,2801,6864,10931,14994,64814,60687,56684,52557,48554,44427,40424,36297,31782,27655,23652,19525,15522,11395,7392,3265,61215,65342,53085,57212,44955,49082,36825,40952,28183,32310,20053,24180,11923,16050,3793,7920]);h$=class h$ extends Error{name;code;chainedError;constructor($,Z){super($);this.name="NKeysError",this.code=$,this.chainedError=Z}};(function($){$.InvalidPrefixByte="nkeys: invalid prefix byte",$.InvalidKey="nkeys: invalid key",$.InvalidPublicKey="nkeys: invalid public key",$.InvalidSeedLen="nkeys: invalid seed length",$.InvalidSeed="nkeys: invalid seed",$.InvalidCurveSeed="nkeys: invalid curve seed",$.InvalidCurveKey="nkeys: not a valid curve key",$.InvalidCurveOperation="nkeys: curve key is not valid for sign/verify",$.InvalidNKeyOperation="keys: only curve key can seal/open",$.InvalidEncoding="nkeys: invalid encoded key",$.InvalidRecipient="nkeys: not a valid recipient public curve key",$.InvalidEncrypted="nkeys: encrypted input is not valid",$.CannotSign="nkeys: cannot sign, no private key available",$.PublicKeyOnly="nkeys: no seed or private key available",$.InvalidChecksum="nkeys: invalid checksum",$.SerializationError="nkeys: serialization error",$.ApiError="nkeys: api error",$.ClearedPair="nkeys: pair is cleared"})(g$||(g$={}));(function($){$[$.Unknown=-1]="Unknown",$[$.Seed=144]="Seed",$[$.Private=120]="Private",$[$.Operator=112]="Operator",$[$.Server=104]="Server",$[$.Cluster=16]="Cluster",$[$.Account=0]="Account",$[$.User=160]="User",$[$.Curve=184]="Curve"})(a8||(a8={}));iV=[120,107,118,49];Me6(qe6);(function($){$.v1="ed25519",$.v2="ed25519-nkey"})(z3||(z3={}))});function E11($){try{$?.clear?.()}catch{}}async function rM$({accountJwt:$,accountSigningKey:Z,expiresAt:G,permissions:X,userId:Y,allowedConnectionTypes:Q=["WEBSOCKET"]}){let J=nM$($),W=B11(J.sub),K=O11(new TextEncoder().encode(Z)),U=dM$();try{let w=await iM$(Y,U,W,{pub:{allow:X.publish.allow},sub:{allow:X.subscribe.allow},allowed_connection_types:Q},{algorithm:z3.v2,exp:Math.floor(G.getTime()/1000),signer:K});return new TextDecoder().decode(pM$(w,U))}finally{E11(U),E11(K),E11(W)}}var oM$=O(()=>{tM$()});function he6($){return/^wss?:\/\//i.test($.trim())?["WEBSOCKET"]:["STANDARD","WEBSOCKET"]}function aM$(){let $=new y1;return $.post("/links/session",async(Z)=>{let X=Z.get("meshContext").auth?.user?.id;if(!X)return Z.json({error:"Unauthorized"},401);let Y=L1();if(!Y.natsTunnelPublicEnabled)return Z.json(D11(),503);if(!Y.natsPublicUrl)return Z.json(D11(),503);if(!Y.natsAccountJwt||!Y.natsAccountSigningKey){if(!Y.localMode)return Z.json(D11(),503)}let Q=L3(X),J;if(Y.natsAccountJwt&&Y.natsAccountSigningKey){let W=new Date(Date.now()+Y.natsTunnelSessionTtlSeconds*1000);J=await rM$({accountJwt:Y.natsAccountJwt,accountSigningKey:Y.natsAccountSigningKey,expiresAt:W,permissions:yM$(Q),userId:X,allowedConnectionTypes:he6(Y.natsPublicUrl)})}return Z.json(gM$({publicUrl:Y.natsPublicUrl,userId:X,ttlSeconds:Y.natsTunnelSessionTtlSeconds,credentials:J}))}),$}var D11=()=>({error:"link session unavailable"});var sM$=O(()=>{d6();q8();hM$();oM$()});async function de6($,Z){try{return!await $.alive(Z)}catch(G){return console.warn(`[vm-events] alive probe failed for ${Z}; assuming alive: ${G instanceof Error?G.message:String(G)}`),!1}}async function le6($){let{ctx:Z,runner:G,claimName:X,userId:Y,projectRef:Q,sandboxProviderKind:J}=$;try{await G.delete(X)}catch(W){console.warn(`[vm-events] runner.delete failed for ${X}: ${W instanceof Error?W.message:String(W)}`)}try{await new UN(Z.db).delete({userId:Y,projectRef:Q},J)}catch(W){console.warn(`[vm-events] sandbox_runner_state delete failed for ${Y}/${Q}/${J}: ${W instanceof Error?W.message:String(W)}`)}}async function me6($){let{stream:Z,claimName:G,runner:X,signal:Y}=$;return new Promise((Q)=>{let J=!1,W=!1,K=null,U=(H)=>{if(J)return;J=!0,clearTimeout(w),Y.removeEventListener("abort",F),K?.unsubscribe(),Q(H)},w=setTimeout(()=>{if(W||J)return;Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),U(!1)},ce6),F=()=>U(!1);Y.addEventListener("abort",F,{once:!0}),K=Un(X,G,(H)=>{if(J)return;if(H.kind!=="claiming")W=!0;if(Z.writeSSE({event:"phase",data:JSON.stringify(H)}).catch(()=>{}),H.kind==="ready")U(!0);else if(H.kind==="failed")U(!1)})})}async function ie6($){let{stream:Z,runner:G,claimName:X,signal:Y}=$,Q=Date.now(),J=null;while(!Y.aborted){let K=null;try{K=await G.proxyDaemonRequest(X,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:Y})}catch(U){if(Y.aborted)return;if(Date.now()-Q<eM$){await m4($k$,{signal:Y}).catch(()=>{});continue}let w=U instanceof Error?U.message:String(U);await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${w}`})}).catch(()=>{});return}if(K.status===404){try{await K.body?.cancel()}catch{}if(Date.now()-Q<eM$){await m4($k$,{signal:Y}).catch(()=>{});continue}await Z.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${K.status}).`})}).catch(()=>{});return}J=K;break}if(!J||!J.body)return;let W=J.body.getReader();try{while(!Y.aborted){let{value:K,done:U}=await W.read();if(U)break;if(K)await Z.write(K)}}catch{}finally{try{W.releaseLock()}catch{}}}var ce6=90000,ue6=15000,Zk$=()=>{let $=new y1;return $.get("/",async(Z)=>{let G=Z.var.meshContext;try{S0(G)}catch{return Z.json({error:"Unauthorized"},401)}let X=l1(G);if(!X)return Z.json({error:"Unauthorized"},401);let Y;try{Y=E0(G)}catch{return Z.json({error:"Organization scope required"},403)}let Q=Z.req.query("virtualMcpId"),J=Z.req.query("branch");if(!Q||!J)return Z.json({error:"virtualMcpId and branch are required"},400);let W=await G.storage.virtualMcps.findById(Q);if(!W||W.organization_id!==Y.id)return Z.json({error:"Virtual MCP not found"},404);let K=uU({orgId:Y.id,virtualMcpId:Q,branch:J}),U=Dy({userId:X,projectRef:K},J),w=W.metadata??null,F,H=null,N=null;try{let D=await Q3(G,{userId:X,branch:J,virtualMcpMetadata:w});F=D.provider,H=D.kind}catch(D){N=D instanceof Error?D:Error(String(D)),F=null}let B=H&&mU(e9(w),X,J,H),E=!!B&&B.sandboxHandle===U;if(!F)return yQ(Z,async(D)=>{await D.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:N?.message??"No sandbox runner configured on this mesh."})})});return Z.header("X-Accel-Buffering","no"),Z.header("Content-Encoding","identity"),yQ(Z,async(D)=>{let L=new AbortController,z=setInterval(()=>{D.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(z)})},ue6);D.onAbort(()=>{L.abort(),clearInterval(z)});try{if(E&&H){if(await de6(F,U)){await le6({ctx:G,runner:F,claimName:U,userId:X,projectRef:K,sandboxProviderKind:H}),await D.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await me6({stream:D,claimName:U,runner:F,signal:L.signal})||L.signal.aborted)return;await ie6({stream:D,runner:F,claimName:U,signal:L.signal})}finally{clearInterval(z)}})}),$},eM$=60000,$k$=500;var Gk$=O(()=>{d6();lV();jY();x7();PE0();wn();Fv();o50();TQ()});function pe6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function te6($,Z){let G=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(ne6)});if(!G.ok){let X=await G.text().catch(()=>G.statusText);throw console.error(`[deco-apps] Supabase error (${G.status}): ${X.slice(0,200)}`),Error(`External service error (${G.status})`)}return await G.json()}var ne6=1e4,re6=async($,Z)=>{if(!$.get("meshContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Xk$=()=>{let $=new y1;return $.use("*",re6),$.get("/",async(Z)=>{let G=L1(),X=G.decoSupabaseUrl,Y=G.decoSupabaseServiceKey;if(!X||!Y)return Z.json({apps:[]});try{let Q=await te6(X,Y);return Z.json({apps:pe6(Q)})}catch(Q){return console.error("[deco-apps] GET error:",Q),Z.json({error:"Failed to fetch apps"},502)}}),$};var Yk$=O(()=>{d6();q8()});import{z as f1}from"zod";function WK($,Z="invalid_request_error",G=null,X=null){return{error:{message:$,type:Z,param:G,code:X}}}function Q04($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let G=$.substring(0,Z),X=$.substring(Z+1);if(!G||!X)return null;return{credentialId:G,modelId:X}}function J04($,Z,G){try{return JSON.parse($)}catch{throw new Wk$(`Invalid JSON in tool call arguments for function '${G}' (tool_call_id: ${Z}): ${$}`)}}function W04($){let Z={};for(let G of $)if(G.role==="assistant"&&G.tool_calls)for(let X of G.tool_calls)Z[X.id]=X.function.name;return $.map((G)=>{switch(G.role){case"system":return{role:"system",content:G.content};case"user":if(typeof G.content==="string")return{role:"user",content:G.content};return{role:"user",content:G.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(G.tool_calls&&G.tool_calls.length>0)return{role:"assistant",content:G.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:J04(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:G.content??""};case"tool":let X=Z[G.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:G.tool_call_id,toolName:X,output:{type:"text",value:G.content}}]}}})}function K04($){let Z=$.map((G)=>{let X=G.function.parameters?UY(G.function.parameters):UY({type:"object",properties:{}});return[G.function.name,s$({description:G.function.description,inputSchema:X})]});return Object.fromEntries(Z)}function U04($){if(!$)return;return{openai:{response_format:$}}}function w04(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Qk$($,Z,G,X,Y,Q){let J={model:$,messages:Z,tools:G,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:Q};return Y?{...J,providerOptions:Y}:J}function Jk$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var oe6=256,ae6,se6,ee6,$04,Z04,G04,X04,Y04,Wk$,Kk$,Uk$;var wk$=O(()=>{f6();d6();lV();ae6=f1.object({type:f1.literal("function"),function:f1.object({name:f1.string(),description:f1.string().optional(),parameters:f1.record(f1.string(),f1.unknown()).optional()})}),se6=f1.object({id:f1.string(),type:f1.literal("function"),function:f1.object({name:f1.string(),arguments:f1.string()})}),ee6=f1.discriminatedUnion("role",[f1.object({role:f1.literal("system"),content:f1.string(),name:f1.string().optional()}),f1.object({role:f1.literal("user"),content:f1.union([f1.string(),f1.array(f1.union([f1.object({type:f1.literal("text"),text:f1.string()}),f1.object({type:f1.literal("image_url"),image_url:f1.object({url:f1.string(),detail:f1.string().optional()})})]))]),name:f1.string().optional()}),f1.object({role:f1.literal("assistant"),content:f1.string().nullable().optional(),name:f1.string().optional(),tool_calls:f1.array(se6).optional()}),f1.object({role:f1.literal("tool"),content:f1.string(),tool_call_id:f1.string()})]),$04=f1.object({type:f1.literal("text")}),Z04=f1.object({type:f1.literal("json_object")}),G04=f1.object({type:f1.literal("json_schema"),json_schema:f1.object({name:f1.string(),description:f1.string().optional(),schema:f1.record(f1.string(),f1.unknown()),strict:f1.boolean().optional()})}),X04=f1.union([$04,Z04,G04]),Y04=f1.object({model:f1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:f1.array(ee6),stream:f1.boolean().optional().default(!1),temperature:f1.number().min(0).max(2).optional(),max_tokens:f1.number().positive().optional(),top_p:f1.number().min(0).max(1).optional(),frequency_penalty:f1.number().min(-2).max(2).optional(),presence_penalty:f1.number().min(-2).max(2).optional(),stop:f1.union([f1.string(),f1.array(f1.string())]).optional(),tools:f1.array(ae6).optional(),tool_choice:f1.union([f1.literal("auto"),f1.literal("none"),f1.literal("required"),f1.object({type:f1.literal("function"),function:f1.object({name:f1.string()})})]).optional(),response_format:X04.optional(),user:f1.string().optional()});Wk$=class Wk$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Kk$=new y1;Kk$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("meshContext"),G=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(WK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(WK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==G)return $.json(WK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),Y=Y04.safeParse(X);if(!Y.success){let D=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(WK(`Invalid request: ${D.message}`,"invalid_request_error",D.path.length>0?D.path.join("."):null),400)}let Q=Y.data,J=Q04(Q.model);if(!J)return $.json(WK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let D=await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id});if(D.length===0)return $.json(WK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=D[0].id}let U;try{U=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(WK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let w=U.aiSdk.languageModel(K),F=W04(Q.messages),H=Q.tools?K04(Q.tools):void 0,N=U04(Q.response_format),B=w04(),E=Math.floor(Date.now()/1000);if(Q.stream)return yQ($,async(D)=>{let L=Qk$(w,F,H,Q,N,$.req.raw.signal);try{let z=PQ(L),j=!1,P=0,A="",M=async()=>{if(A.length===0)return;let S=A;A="",await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{content:S},finish_reason:null}]})})};for await(let S of z.fullStream){if(!j&&(S.type==="text-delta"||S.type==="tool-call"))await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),j=!0;if(S.type==="text-delta"){if(A+=S.text,A.length>=oe6)await M()}else if(S.type==="tool-call"){await M();let q=P++;await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:S.toolCallId,type:"function",function:{name:S.toolName,arguments:JSON.stringify(S.input)}}]},finish_reason:null}]})})}else if(S.type==="finish")await M(),await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{},finish_reason:Jk$(S.finishReason)}],usage:S.totalUsage?{prompt_tokens:S.totalUsage.inputTokens??0,completion_tokens:S.totalUsage.outputTokens??0,total_tokens:S.totalUsage.totalTokens??0}:void 0})})}await M(),await D.writeSSE({data:"[DONE]"})}catch(z){let j=z;console.error("[openai-compat:stream] Error:",j.message),await D.writeSSE({data:JSON.stringify({error:{message:j.message,type:"server_error"}})})}});else{let D=Qk$(w,F,H,Q,N,$.req.raw.signal),L=await GN(D),z={role:"assistant",content:L.text||null};if(L.toolCalls&&L.toolCalls.length>0)z.tool_calls=L.toolCalls.map((j)=>({id:j.toolCallId,type:"function",function:{name:j.toolName,arguments:JSON.stringify("input"in j?j.input:{})}})),z.content=null;return $.json({id:B,object:"chat.completion",created:E,model:Q.model,choices:[{index:0,message:z,finish_reason:Jk$(L.finishReason)}],usage:{prompt_tokens:L.usage?.inputTokens??0,completion_tokens:L.usage?.outputTokens??0,total_tokens:L.usage?.totalTokens??0}})}}catch(X){let Y=X;if(Y.name==="AbortError")return $.json(WK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(WK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(WK(Y.message,"server_error"),500)}});Uk$=Kk$});function H04(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??F04}}var Fk$,F04="https://ph.studio.decocms.com",Hk$;var Nk$=O(()=>{d6();m_0();RN();i7();q8();Ms0();Fk$=new y1;Fk$.get("/",($)=>{let Z={theme:yC1(),...SO().logo&&{logo:SO().logo},...qQ()&&{internalUrl:He()},...L1().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!L1().firecrawlApiKey,auth:nP$(),posthog:H04(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!qQ()&&L1().sandboxProviderKind==="agent-sandbox"}};return $.json({success:!0,config:Z})});Hk$=Fk$});function Bk$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals")}var Ok$,N04,B04,Ek$;var Dk$=O(()=>{d6();PJ();Dv();Xb();Ok$=new y1,N04=["range","if-none-match","if-modified-since"],B04=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];Ok$.get("/:org/files/*",async($)=>{let Z=$.get("meshContext"),G=Z.organization?.id;if(!Z.auth?.user?.id){if(My($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new z$(401,{message:"Authentication required"})}if(!G)throw new z$(401,{message:"Organization context required"});let X=$.req.path.replace(/^.*\/files\//,"");if(!X)throw new z$(400,{message:"Missing file key"});let Y=await En(X,Z);if(!Y)throw new z$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&jJ()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new z$(500,{message:"Invalid data URL from storage"});let[,U,w]=K,F=Buffer.from(w,"base64"),H=new Headers({"Content-Type":U,"Cache-Control":"private, max-age=86400"});return Bk$(H,U),new Response(F,{status:200,headers:H})}let Q=new Headers;for(let K of N04){let U=$.req.header(K);if(U)Q.set(K,U)}let J=await fetch(Y,{headers:Q});if(J.status===403||J.status===404)throw new z$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,X),new z$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of B04){let U=J.headers.get(K);if(U)W.set(K,U)}return W.set("Cache-Control","private, max-age=86400"),Bk$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});Ek$=Ok$});var jt=_((pV)=>{var O04=pV&&pV.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),E04=pV&&pV.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))O04(Z,$,G)};Object.defineProperty(pV,"__esModule",{value:!0});E04(dX(),pV)});var jk$=_((Lk$)=>{Object.defineProperty(Lk$,"__esModule",{value:!0});Lk$.version=void 0;Lk$.version="3.4.0"});var Tk$=_((KK)=>{var D04=KK&&KK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(KK,"__esModule",{value:!0});KK.NodeTransport=KK.VERSION=void 0;KK.nodeResolveHost=T04;var d4=jt(),L04=u0("net"),L11=u0("tls"),z04=u0("path"),Pk$=u0("fs"),j04=D04(u0("dns")),P04=jk$();KK.VERSION=P04.version;var A04="nats.js";class Ak${socket;version;lang;yields=[];signal=(0,d4.deferred)();closedNotification=(0,d4.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=A04,this.version=KK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:G}=this.options,{handshakeFirst:X}=G||{};try{if(X===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,d4.checkOptions)(Y,Z);let{tls_required:Q,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!X&&(Q||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(Q&&this.socket.encrypted!==!0)throw d4.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let Q=Y;if(!Q)Q=new d4.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=Q,W=J==="ECONNREFUSED"?new d4.errors.ConnectionError("connection refused",{cause:Q}):Q;throw this.socket?.destroy(),W}}dial($){let Z=(0,d4.deferred)(),G,X=(0,L04.createConnection)($.port,$.hostname,()=>{Z.resolve(X),X.removeAllListeners()});return X.on("error",(Y)=>{G=Y}),X.on("close",()=>{X.removeAllListeners(),Z.reject(G)}),X.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,d4.deferred)(),Z;return this.socket.on("data",(G)=>{this.yields.push(G);let X=d4.DataBuffer.concat(...this.yields),Y=(0,d4.extractProtocolMessage)(X);if(Y!=="")try{let Q=d4.INFO.exec(Y);if(!Q)throw Error("unexpected response from server");let J=JSON.parse(Q[1]);$.resolve(J)}catch(Q){$.reject(Q)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(G)=>{Z=G}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,d4.deferred)();try{if($=(0,z04.resolve)($),!(0,Pk$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,Pk$.readFile)($,(G,X)=>{if(G)return Z.reject(G);Z.resolve(X)})}catch(G){Z.reject(G)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:G,caFile:X,ca:Y,keyFile:Q,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(G)$.cert=G;if(Q){let W=await this.loadFile(Q);if(W)$.key=W}else if(J)$.key=J;if(X){let W=await this.loadFile(X);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,G={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)G.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};G=(0,d4.extend)(G,this.options.tls,Y)}catch(Y){return Promise.reject(new d4.errors.ConnectionError(Y.message,{cause:Y}))}let X=(0,d4.deferred)();try{let Y=(0,L11.connect)($.port,$.hostname,G,()=>{Y.removeAllListeners(),X.resolve(Y)});Y.on("error",(Q)=>{Z=Q}),Y.on("secureConnect",()=>{if(G.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{X.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){X.reject(new d4.errors.ConnectionError(Y.message,{cause:Y}))}return X}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Z=(0,d4.extend)(Z,this.options.tls,X)}catch(X){return Promise.reject(new d4.errors.ConnectionError(X.message,{cause:X}))}let G=(0,d4.deferred)();try{let X=(0,L11.connect)(Z,()=>{X.removeAllListeners(),G.resolve(X)});X.on("error",(Y)=>{$=Y}),X.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{G.reject($),X.removeAllListeners()})}catch(X){G.reject(new d4.errors.ConnectionError(X.message,{cause:X}))}return G}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,d4.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,d4.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof L11.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,d4.render)($)}`);let Z=(0,d4.deferred)();try{this.socket.write($,(G)=>{if(G){if(this.options.debug)console.error(`!!! ${(0,d4.render)($)}: ${G}`);return Z.reject(G)}return Z.resolve()})}catch(G){if(this.options.debug)console.error(`!!! ${(0,d4.render)($)}: ${G}`);Z.reject(G)}return Z}send($){this._send($).catch((G)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(G){if(this.options.debug)console.log("transport close terminated with an error",G)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(G){console.log(G)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}KK.NodeTransport=Ak$;function T04($){let Z=(0,d4.deferred)();return j04.default.lookup($,{all:!0},(G,X)=>{if(G){Z.reject(G);return}let Y=[];for(let Q of X)Y.push(Q.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var kk$=_((Mk$)=>{Object.defineProperty(Mk$,"__esModule",{value:!0});Mk$.connect=I04;var Ik$=Tk$(),Rk$=jt(),qk$=jt();function I04($={}){if((0,qk$.hasWsProtocol)($))return Promise.reject(qk$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,Rk$.setTransportFactory)({factory:()=>{return new Ik$.NodeTransport},dnsResolveFn:Ik$.nodeResolveHost}),Rk$.NatsConnectionImpl.connect($)}});var Sk$=_((Aw)=>{var q04=Aw&&Aw.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),M04=Aw&&Aw.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))q04(Z,$,G)};Object.defineProperty(Aw,"__esModule",{value:!0});Aw.connect=void 0;var k04=kk$();Object.defineProperty(Aw,"connect",{enumerable:!0,get:function(){return k04.connect}});M04(jt(),Aw)});function bk$($){let Z=$?.connectFn??_04,G=null,X=null,Y=!1,Q=!1,J=!1,W=[];function K(){return G!==null&&!G.isClosed()&&!G.isDraining()&&!J}function U(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let H of W)try{H()}catch{}}function w(H){(async()=>{for await(let N of H.status())if(N.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(N.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,X=null,U()})().catch(()=>{})}async function F(H,N){let B=0;while(!Q)try{G=await Z({servers:H,timeout:C04,reconnect:!0,maxReconnectAttempts:-1,...N?{authenticator:N}:{}}),console.log(`[NatsProvider] Connected to ${G.getServer()} after ${B} attempt(s)`),X=null,J=!1,w(G),U();return}catch{B++;let E=vX(V04,S04,B-1,2,0.5);await m4(E)}}return{init(H,N){if(Y)return;Y=!0,Q=!1;let B=N?.creds?Vk$.credsAuthenticator(new TextEncoder().encode(N.creds)):void 0;F(H,B).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?G:null},getJetStream(){if(!K())return null;if(!X)X=_k$.jetstream(G);return X},onReady(H){if(W.push(H),K())try{H()}catch{}},async drain(){if(Q=!0,Y=!1,X=null,J=!1,G){let H=G;G=null,await H.drain().catch(()=>{})}}}}function _04($){return Ck$.connect($)}var Vk$,Ck$,_k$,S04=100,V04=3000,C04=3000;var fk$=O(()=>{x7();Vk$=k(Pg(),1),Ck$=k(Sk$(),1),_k$=k(jB(),1)});function ry($){let Z=$?.ttlMs??60000,G=$?.maxSize??1e4,X=$?.updateRecencyOnGet??!1,Y=new Map;function Q(){if(Y.size<=G)return;let J=Date.now();for(let[W,K]of Y)if(K.expiresAt<=J)Y.delete(W);while(Y.size>G){let W=Y.keys().next().value;if(W===void 0)break;Y.delete(W)}}return{get(J){let W=Y.get(J);if(!W)return;if(W.expiresAt<=Date.now()){Y.delete(J);return}if(X)Y.delete(J),Y.set(J,W);return W.value},set(J,W){Y.delete(J),Y.set(J,{value:W,expiresAt:Date.now()+Z}),Q()},delete(J){Y.delete(J)},clear(){Y.clear()},size(){return Y.size}}}function z11($,Z){return`${$}.${Z}`}class j11{cache;constructor($){this.cache=ry({ttlMs:$?.ttlMs??b04,maxSize:$?.maxSize??f04})}async get($,Z){return this.cache.get(z11($,Z))??null}async set($,Z,G){this.cache.set(z11($,Z),G)}async invalidate($,Z){this.cache.delete(z11($,Z))}teardown(){this.cache.clear()}}var b04=600000,f04=5000;var xk$=()=>{};function bD0($,Z){return`${$}:${Z}`}function P11($){let Z=ry({ttlMs:$?.ttlMs??x04,maxSize:$?.maxSize??v04}),G=$?.getConnection,X=crypto.randomUUID(),Y=new TextEncoder,Q=new TextDecoder,J=null;function W(K,U){let w=G?.();if(!w)return;try{w.publish(vk$,Y.encode(JSON.stringify({organizationId:K,keyId:U,originId:X})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,U){return Z.get(bD0(K,U))},set(K,U,w){Z.set(bD0(K,U),w)},invalidate(K,U){Z.delete(bD0(K,U)),W(K,U)},start(){if(J)return;let K=G?.();if(!K)return;J=K.subscribe(vk$),(async()=>{for await(let U of J)try{let w=JSON.parse(Q.decode(U.data));if(w.originId===X)continue;Z.delete(bD0(w.organizationId,w.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var vk$="studio.ai-provider-keys.invalidate",x04=30000,v04=5000;var yk$=()=>{};class A11{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.sub)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;this.sub=Z.subscribe("mesh.decopilot.cancel");let G=new TextDecoder;(async()=>{for await(let X of this.sub)try{let Y=JSON.parse(G.decode(X.data));if(Y.originId===this.originId)continue;this.onCancel?.(Y.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;Z.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId})))}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}var gk$=($)=>{let Z;return()=>Z??=$()},T11,I11;var hk$=O(()=>{I5();T11=gk$(()=>y8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),I11=gk$(()=>y8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function l04(){return{name:yU,subjects:[`${Gl0}.>`],storage:j3.StorageType.File,max_age:h04,max_bytes:u04,max_msgs_per_subject:d04,discard:j3.DiscardPolicy.Old,retention:j3.RetentionPolicy.Limits,duplicate_window:c04,num_replicas:1}}class dk${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function ck$($){let Z=uk$.headers();for(let[G,X]of Object.entries($))Z.set(G,X);return Z}function p04($,Z){let G=0;return{publish(X,Y,Q,J){X.publish(Y,Q,J?{headers:J}:void 0).catch((W)=>{if(G++,g04().add(1,{"org.id":Z??"unknown"}),G===1||G%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${G} total):`,W)})},get errorCount(){return G}}}class R11{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=this.options.getJetStreamManager?await this.options.getJetStreamManager():await j3.jetstreamManager($),G=l04();try{await Z.streams.info(yU),await Z.streams.update(yU,G)}catch(X){if(X instanceof Error&&X.message.includes("stream not found"))await Z.streams.add(G);else if(X instanceof Error&&/can ?not change.*storage|storage type/i.test(X.message))await Z.streams.delete(yU),await Z.streams.add(G);else throw X}this.js=this.options.getJetStream(),this.jsm=Z,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,G,X){let Y=this.js;if(!Y){console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`);return}let Q=p04(Z,X),J=!1,W=()=>{if(J)return;J=!0;let U=S8$(Z);Y.publish(U.subject,U.data).catch(()=>{})};G.addEventListener("abort",W,{once:!0});let K=(U)=>{let w=performance.now(),F=Yl0(U,{runId:Z}),H=performance.now()-w;if(T11().record(H),I11().add(1,{"org.id":X??"unknown"}),n04?.record(H,F.reduce((N,B)=>N+B.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let N of F)Q.publish(Y,N.subject,N.data,N.headers?ck$(N.headers):void 0)};(async()=>{let U=$.getReader(),w=0,F=0;try{while(!0){let{done:H,value:N}=await U.read();if(H)break;if(K(N),F++,++w>=64)w=0,await new Promise((B)=>setImmediate(B))}}catch(H){console.warn(`[Decopilot] stream pump error for thread ${Z}:`,H?.message??H)}finally{if(U.releaseLock(),W(),i04)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:Q.errorCount}))}})()}async publishRawChunk($,Z,G){let X=this.js;if(!X)return!1;let Y=performance.now(),Q=Yl0(Z,{runId:$,dedup:G});if(T11().record(performance.now()-Y),I11().add(1),Q.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of Q)await X.publish(J.subject,J.data,{...J.headers?{headers:ck$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,G){let X=this.js;if(!X)return!1;let Y=k8$({runId:$,fenceToken:Z,finalSeq:G});return await X.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,G){let X=this.js;if(!X)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=G?.deliverPolicy==="new"?j3.DeliverPolicy.New:j3.DeliverPolicy.All,Q=G?.closeOnDone??!1,J=YN($),W;try{W=await(await X.consumers.get(yU,{filter_subjects:J,deliver_policy:Y})).consume()}catch(E){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",E?.message??E),null}let w=T50({messages:async function*(){try{for await(let E of W)yield{subject:E.subject,data:E.data,headers:E.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(P50()).pipeThrough(A50()).getReader(),F=!1,H=()=>{if(F)return;F=!0;try{w.releaseLock()}catch{}},N=!1,B=()=>{if(N)return;N=!0,W.stop(),w.cancel().catch(()=>{}),H()};return Z?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(E){for(;;){let{done:D,value:L}=await w.read();if(D){B(),E.close();return}let z=L;if(z.kind==="done"){if(Q){B(),E.close();return}continue}E.enqueue(z.chunk);return}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(yU,{filter:YN($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var j3,uk$,y04=($)=>{let Z;return()=>Z??=$()},g04,h04=86400000000000,c04=120000000000,u04=4294967296,d04=500000,m04,i04,n04;var lk$=O(()=>{Jl0();Wl0();Ql0();I5();hk$();j3=k(jB(),1),uk$=k(Pg(),1),g04=y04(()=>y8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));m04=process.env.STREAM_ENCODE_TRACE==="1",i04=process.env.DECOPILOT_STREAM_TRACE==="1";n04=m04?new dk$:null});import{z as $8}from"zod";var mk$,ik$,UK,q11,nk$,pk$,tk$,rk$,t04,ok$,ak$,sk$,ek$,$S$,r04,ZS$,K0Z,o04,a04=($)=>{return $.issues.map((Z)=>{return`${Z.path.length>0?Z.path.join("."):"frame"}: ${Z.message}`}).join("; ")},GS$=($)=>{return new TextEncoder().encode(JSON.stringify($))},XS$=($)=>{let Z;try{Z=JSON.parse(new TextDecoder().decode($))}catch(Q){throw TypeError("malformed JSON in tunnel frame",{cause:Q})}if(Z===null||typeof Z!=="object"||Array.isArray(Z))throw TypeError("frame must be an object");if(!("type"in Z))throw TypeError("frame type missing");let G=Z.type,X=typeof G==="string"?o04[G]:void 0;if(!X)throw TypeError(`unknown frame type: ${String(G)}`);let Y=X.safeParse(Z);if(!Y.success)throw TypeError(`invalid tunnel frame: ${a04(Y.error)}`);return Y.data};var YS$=O(()=>{mk$=$8.string().regex(/^[A-Za-z0-9_-]*$/u),ik$=$8.array($8.tuple([$8.string(),$8.string()])),UK=$8.string().regex(/^[A-Za-z0-9_-]+$/u),q11=$8.string().min(1),nk$=$8.object({type:$8.literal("request.start"),protocol:$8.literal("tunnel.v1"),requestId:UK,method:$8.string().min(1),url:$8.string().min(1),headers:ik$,replySubject:q11,bodySubject:q11.optional(),abortSubject:q11,deadlineUnixMs:$8.number().int().nonnegative().optional()}),pk$=$8.object({type:$8.literal("request.chunk"),requestId:UK,seq:$8.number().int().nonnegative(),data:mk$}),tk$=$8.object({type:$8.literal("request.end"),requestId:UK,seq:$8.number().int().nonnegative()}),rk$=$8.object({type:$8.literal("request.error"),requestId:UK,code:$8.string().min(1),message:$8.string()}),t04=$8.union([pk$,tk$,rk$]),ok$=$8.object({type:$8.literal("response.ack"),requestId:UK}),ak$=$8.object({type:$8.literal("response.start"),requestId:UK,status:$8.number().int().min(100).max(599),statusText:$8.string().optional(),headers:ik$}),sk$=$8.object({type:$8.literal("response.chunk"),requestId:UK,seq:$8.number().int().nonnegative(),data:mk$}),ek$=$8.object({type:$8.literal("response.end"),requestId:UK,seq:$8.number().int().nonnegative()}),$S$=$8.object({type:$8.literal("response.error"),requestId:UK,code:$8.string().min(1),message:$8.string()}),r04=$8.union([ok$,ak$,sk$,ek$,$S$]),ZS$=$8.object({type:$8.literal("abort"),requestId:UK,reason:$8.string().optional()}),K0Z=$8.union([nk$,t04,r04,ZS$]),o04={"request.start":nk$,"request.chunk":pk$,"request.end":tk$,"request.error":rk$,"response.ack":ok$,"response.start":ak$,"response.chunk":sk$,"response.end":ek$,"response.error":$S$,abort:ZS$}});var s04=($)=>{return $.replaceAll("+","-").replaceAll("/","_").replaceAll("=","")},e04=($)=>{let Z=$.replaceAll("-","+").replaceAll("_","/"),G=(4-Z.length%4)%4;return Z+"=".repeat(G)},$14=($)=>{let Z=[];for(let G=0;G<$.length;G+=32768)Z.push(String.fromCharCode(...$.subarray(G,G+32768)));return Z.join("")},Z14=($)=>{let Z=new Uint8Array($.length);for(let G=0;G<$.length;G+=32768){let X=$.slice(G,G+32768);Z.set(Uint8Array.from(X,(Y)=>Y.charCodeAt(0)),G)}return Z},QS$=($)=>{return s04(btoa($14($)))},JS$=($)=>{return Z14(atob(e04($)))},G14;var WS$=O(()=>{G14=class G14{#$=[];#Z;#G=!1;#Q=new Set;push($){if(this.#G)return;let Z=this.#Y();if(Z){Z.resolve({value:$,done:!1});return}this.#$.push($)}close(){if(this.#G)return;this.#G=!0,this.#X()}fail($){if(this.#G)return;this.#Z=$,this.#G=!0,this.#J($)}[Symbol.asyncIterator](){let $=!1,Z=new Set;return{next:()=>{if($)return Promise.resolve({value:void 0,done:!0});if(this.#$.length>0)return Promise.resolve({value:this.#$.shift(),done:!1});if(this.#Z)return Promise.reject(this.#Z);if(this.#G)return Promise.resolve({value:void 0,done:!0});return new Promise((G,X)=>{let Y;Y={resolve:(Q)=>{Z.delete(Y),G(Q)},reject:(Q)=>{Z.delete(Y),X(Q)}},Z.add(Y),this.#Q.add(Y)})},return:()=>{$=!0;for(let G of Z)this.#Q.delete(G),G.resolve({value:void 0,done:!0});return Z.clear(),Promise.resolve({value:void 0,done:!0})}}}#Y(){for(let $ of this.#Q)return this.#Q.delete($),$;return}#X(){for(let $ of this.#Q)$.resolve({value:void 0,done:!0});this.#Q.clear()}#J($){for(let Z of this.#Q)Z.reject($);this.#Q.clear()}}});function*H14($,Z){for(let G=0;G<$.length;G+=Z)yield $.subarray(G,G+Z)}class j14{maxSize;ttlMs;now;#$=new Map;constructor($,Z,G=Date.now){this.maxSize=$;this.ttlMs=Z;this.now=G}get($){let Z=this.#$.get($);if(!Z)return;if(Z.expiresAt<=this.now()){this.#$.delete($);return}return Z.value}has($){return this.get($)!==void 0}set($,Z){let G=this.now();this.prune(G),this.#$.delete($),this.#$.set($,{value:Z,expiresAt:G+this.ttlMs});while(this.#$.size>this.maxSize){let X=this.#$.keys().next().value;if(X===void 0)return;this.#$.delete(X)}}take($){let Z=this.get($);return this.#$.delete($),Z}clear(){this.#$.clear()}prune($){for(let[Z,G]of this.#$)if(G.expiresAt<=$)this.#$.delete(Z)}}var X14=30000,Y14=1000,Q14=65536,hQ,J14=($)=>{return"connection"in $},W14=($)=>{let Z=J14($)?$:{connection:$};return{connection:Z.connection,timeoutMs:Z.timeoutMs??0,firstFrameTimeoutMs:Z.firstFrameTimeoutMs??X14,idleTimeoutMs:Z.idleTimeoutMs??0,republishIntervalMs:Z.republishIntervalMs??Y14,maxChunkBytes:Z.maxChunkBytes??Q14,diagnostics:Z.diagnostics}},KS$=($)=>{return Array.from($.entries())},K14=($)=>{return $!==void 0&&!($ instanceof Headers)&&typeof $!=="function"&&typeof $[Symbol.iterator]==="function"},U14=($,Z,G)=>{if(K14(Z?.headers))return Array.from(Z?.headers,([X,Y])=>[String(X),String(Y)]);if($ instanceof Request)return KS$(G.headers);return KS$(G.headers)},US$=($)=>{let Z=new Headers;for(let[G,X]of $)Z.append(G,X);return Z},w14=()=>{return crypto.randomUUID().replaceAll("-","")},F14=($)=>{try{$?.unsubscribe()}catch{}},N14=($)=>{if(!Number.isSafeInteger($)||$<1)throw TypeError("maxChunkBytes must be a positive safe integer")},B14=($,Z)=>{return $==="HEAD"||Z===204||Z===205||Z===304},GB=($,Z,G)=>{$.publish(Z,GS$(G))},O14=($)=>{return $.type.startsWith("response.")},M11=($)=>{let Z=$.reason;if(Z instanceof Error)return Z.message;if(typeof Z==="string")return Z;return"aborted"},E14=($)=>{if($==="idle")return new hQ("tunnel_idle_timeout","no response frame within idleTimeoutMs");return new hQ("tunnel_no_first_frame","no response frame arrived before firstFrameTimeoutMs")},wS$=async($,Z,G,X,Y="first_frame")=>{while(!0){let Q,J;try{let W=await Promise.race([$.next(),new Promise((U,w)=>{if(X.aborted){w(X.reason);return}let F=()=>w(X.reason);J=()=>{X.removeEventListener("abort",F)},X.addEventListener("abort",F,{once:!0})}),...G>0?[new Promise((U,w)=>{Q=setTimeout(()=>{w(E14(Y))},G)})]:[]]);if(W.done)return{value:void 0,done:!0};let K=XS$(W.value.data);if(!O14(K)||K.requestId!==Z)continue;return{value:K,done:!1}}finally{if(J?.(),Q)clearTimeout(Q)}}},D14=async($)=>{let Z=!1;while(!0){let G=await wS$($.iterator,$.requestId,Z?0:$.firstFrameTimeoutMs,$.signal);if(G.done)throw new hQ("tunnel_response_closed","response subscription closed before response.start");if(!Z)Z=!0,$.onFirstResponseFrame();if(G.value.type==="response.ack")continue;if(G.value.type==="response.start")return G.value;if(G.value.type==="response.error")throw new hQ(G.value.code,G.value.message);throw new hQ("tunnel_unexpected_response_frame",`expected response.start, got ${G.value.type}`)}},L14=async($)=>{let Z=$.body.getReader(),G=0,X=!1,Y=()=>{X=!0,Z.cancel($.signal.reason).catch(()=>{})};try{if($.signal.aborted){Y();return}$.signal.addEventListener("abort",Y,{once:!0});while(!0){let{done:Q,value:J}=await Z.read();if(X)return;if(Q){GB($.connection,$.subject,{type:"request.end",requestId:$.requestId,seq:G});return}for(let W of H14(J,$.maxChunkBytes)){if(X)return;GB($.connection,$.subject,{type:"request.chunk",requestId:$.requestId,seq:G,data:QS$(W)}),G++}}}catch(Q){if(X)return;GB($.connection,$.subject,{type:"request.error",requestId:$.requestId,code:"tunnel_request_body_error",message:Q instanceof Error?Q.message:String(Q)})}finally{$.signal.removeEventListener("abort",Y),Z.releaseLock()}},z14=($)=>{return new ReadableStream({async pull(Z){while(!0)try{let G=await wS$($.iterator,$.requestId,$.idleTimeoutMs,$.signal,"idle");if(G.done){Z.error(new hQ("tunnel_response_closed","response subscription closed before response.end")),$.cleanup();return}let X=G.value;if(X.type==="response.ack"||X.type==="response.start")continue;if(X.type==="response.chunk"){Z.enqueue(JS$(X.data));return}if(X.type==="response.end"){Z.close(),$.cleanup();return}Z.error(new hQ(X.code,X.message)),$.cleanup();return}catch(G){Z.error(G),$.cleanup();return}},cancel(){GB($.connection,$.abortSubject,{type:"abort",requestId:$.requestId,reason:"response_body_cancelled"}),$.cleanup()}},{highWaterMark:0})},XB=($)=>{let Z=W14($);return N14(Z.maxChunkBytes),async(G,X)=>{let Y=xM$(G),Q=new Request(G,X),J=w14(),W=vM$(Y.hostname,J),K=new AbortController,U=new AbortController,w=!1,F,H,N,B,E=!1,D=(P=new hQ("tunnel_closed","tunnel request closed"))=>{if(w)return;if(w=!0,F14(F),Q.body&&!E)Q.body.cancel(P).catch(()=>{});if(U.abort(P),K.abort(P),N)clearInterval(N);if(B)clearTimeout(B);Q.signal.removeEventListener("abort",L)},L=()=>{let P=new hQ("tunnel_aborted",M11(Q.signal));GB(Z.connection,W.abort,{type:"abort",requestId:J,reason:M11(Q.signal)}),K.abort(P),D(P)};if(Q.signal.aborted)throw new hQ("tunnel_aborted",M11(Q.signal));if(F=Z.connection.subscribe(W.reply),H=F[Symbol.asyncIterator](),Q.signal.addEventListener("abort",L,{once:!0}),Z.timeoutMs>0)B=setTimeout(()=>{let P=new hQ("tunnel_timeout",`tunnel request timed out after ${Z.timeoutMs}ms`);GB(Z.connection,W.abort,{type:"abort",requestId:J,reason:"tunnel_timeout"}),K.abort(P),D(P)},Z.timeoutMs);let z={type:"request.start",protocol:"tunnel.v1",requestId:J,method:Q.method,url:Y.pathWithSearch,headers:U14(G,X,Q),replySubject:W.reply,abortSubject:W.abort,...Q.body?{bodySubject:W.body}:{},...Z.timeoutMs>0?{deadlineUnixMs:Date.now()+Z.timeoutMs}:{}};GB(Z.connection,W.request,z),N=Z.republishIntervalMs>0?setInterval(()=>{if(!E)GB(Z.connection,W.request,z)},Z.republishIntervalMs):void 0;let j=()=>{if(E)return;E=!0,(Q.body?L14({connection:Z.connection,subject:W.body,requestId:J,body:Q.body,maxChunkBytes:Z.maxChunkBytes,signal:U.signal}):void 0)?.catch((A)=>{Z.diagnostics?.({event:"request_body_error",requestId:J,subject:W.body,error:A instanceof Error?A.message:String(A)})})};try{let P=await D14({iterator:H,requestId:J,firstFrameTimeoutMs:Z.firstFrameTimeoutMs,signal:K.signal,onFirstResponseFrame:()=>{if(N)clearInterval(N);j()}});if(B14(Q.method,P.status))return D(),new Response(null,{status:P.status,statusText:P.statusText,headers:US$(P.headers)});return new Response(z14({connection:Z.connection,abortSubject:W.abort,iterator:H,requestId:J,idleTimeoutMs:Z.idleTimeoutMs,signal:K.signal,cleanup:D}),{status:P.status,statusText:P.statusText,headers:US$(P.headers)})}catch(P){throw D(P instanceof Error?P:Error(String(P))),P}}};var FS$=O(()=>{YS$();WS$();SD0();hQ=class hQ extends Error{code;constructor($,Z,G){super(`${$}: ${Z}`,G);this.code=$;this.name="TunnelTransportError"}}});var fD0=O(()=>{FS$()});function HS$($){let Z=$.createFetch??P14,G=$.timeoutMs??2000;return async(X)=>{try{let Y=$.getConnection();if(!Y)return k11;let Q=L3(X),W=await Z(Y,G)(`tunnel://${Q}/api/links/status`,{method:"GET"});if(!W.ok)return k11;let K=await W.json();return{online:!0,hostname:K.hostname,capabilities:K.capabilities??[],cliVersion:K.cliVersion}}catch{return k11}}}var k11,P14=($,Z)=>XB({connection:$,firstFrameTimeoutMs:Z});var NS$=O(()=>{fD0();Lt();k11={online:!1,capabilities:[]}});async function*A14($){if(!$.body){yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};return}let Z=$.body.getReader(),G=!1;try{yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};while(!0){let{done:X,value:Y}=await Z.read();if(X){G=!0;return}yield{data:Buffer.from(Y).toString("base64")}}}finally{try{if(!G)await Z.cancel()}catch{}finally{Z.releaseLock()}}}function BS$($){let Z=$.createFetch??((G)=>XB({connection:G,idleTimeoutMs:T14}));return async function*(X,Y,Q){let J=$.getConnection();if(!J)throw Error("link_unavailable: NATS unavailable");let W=L3(X),K=Z(J),U={method:Y.method,headers:Y.headers,signal:Q?.signal};if(Y.body!=null)U.body=Y.body;let w=await K(`tunnel://${W}${Y.path}`,U);yield*A14(w)}}var T14=45000;var OS$=O(()=>{fD0();Lt()});import{z as P3}from"zod";function ES$($){return JSON.stringify($)}var y0Z;var DS$=O(()=>{y0Z=P3.discriminatedUnion("type",[P3.object({type:P3.literal("cancel"),runId:P3.string()}),P3.object({type:P3.literal("cancel_req"),reqId:P3.string()}),P3.object({type:P3.literal("keep_alive")}),P3.object({type:P3.literal("shutdown")})])});function LS$($){let Z=$.createFetch??((G)=>XB({connection:G,idleTimeoutMs:I14}));return{async publish(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=L3(G),K=await Z(Q)(`tunnel://${J}/api/links/work`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel work publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}function zS$($){let Z=$.createFetch??XB;return{async publishControlFrame(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=L3(G),K=await Z(Q)(`tunnel://${J}/api/links/control`,{method:"POST",headers:{"content-type":"application/json"},body:ES$(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel control publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}var I14=45000;var jS$=O(()=>{fD0();DS$();Lt()});function PS$($,Z){switch($.type){case"START":{let G={type:"RUN_STARTED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,runConfig:$.runConfig,podId:$.podId};if(Z?.status.tag==="running")return[{type:"PREVIOUS_RUN_ABORTED",taskId:$.taskId,orgId:Z.orgId},G];return[G]}case"STEP_DONE":{if(Z?.status.tag!=="running")return[];return[{type:"STEP_COMPLETED",taskId:$.taskId,orgId:Z.orgId,stepCount:Z.status.stepCount+1}]}case"FINISH":{if(Z==null||Z.status.tag!=="running")return[];let{stepCount:G}=Z.status;if($.threadStatus==="completed")return[{type:"RUN_COMPLETED",taskId:$.taskId,orgId:Z.orgId,stepCount:G}];if($.threadStatus==="requires_action")return[{type:"RUN_REQUIRES_ACTION",taskId:$.taskId,orgId:Z.orgId,stepCount:G}];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:"error"}]}case"CANCEL":{if(Z?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:"cancelled"}]}case"RESUME":{if(Z?.status.tag==="running")return[];return[{type:"RUN_RESUMED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,podId:$.podId}]}case"FORCE_FAIL":{if($.reason==="ghost")return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z?.orgId??$.orgId,reason:$.reason}];if(Z?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:$.reason}]}}}function AS$($,Z,G=new Date){switch(Z.type){case"RUN_STARTED":return{taskId:Z.taskId,orgId:Z.orgId,userId:Z.userId,status:{tag:"running",abortController:Z.abortController,stepCount:0,startedAt:G}};case"RUN_RESUMED":return{taskId:Z.taskId,orgId:Z.orgId,userId:Z.userId,status:{tag:"running",abortController:Z.abortController,stepCount:0,startedAt:G}};case"STEP_COMPLETED":if($?.status.tag!=="running")return $;return{...$,status:{...$.status,stepCount:Z.stepCount}};case"RUN_COMPLETED":return;case"RUN_REQUIRES_ACTION":return;case"RUN_FAILED":return;case"PREVIOUS_RUN_ABORTED":return}}async function TS$($,Z,G,X){let{storage:Y,sseHub:Q}=X,J=await Y.get($,Z);Q.emit(Z,zJ($,G,{virtualMcpId:J?.virtual_mcp_id??void 0,createdBy:J?.created_by,triggerId:J?.trigger_id,title:J?.title,branch:J?.branch??null,createdAt:J?.created_at,updatedAt:J?.updated_at})),Q.emit(Z,ac($,G))}async function q14($,Z){let{storage:G,sseHub:X}=Z;switch($.type){case"RUN_STARTED":{await G.update($.taskId,$.orgId,{status:"in_progress",run_config:$.runConfig??null,run_started_at:new Date().toISOString(),last_progress_at:null,failure_reason:null,failure_kind:null});let Y=await G.get($.taskId,$.orgId);X.emit($.orgId,zJ($.taskId,"in_progress",{virtualMcpId:Y?.virtual_mcp_id??void 0,createdBy:Y?.created_by,triggerId:Y?.trigger_id,title:Y?.title,branch:Y?.branch??null,createdAt:Y?.created_at,updatedAt:Y?.updated_at}));return}case"RUN_RESUMED":{await G.update($.taskId,$.orgId,{run_started_at:new Date().toISOString()});let Y=await G.get($.taskId,$.orgId);X.emit($.orgId,zJ($.taskId,"in_progress",{virtualMcpId:Y?.virtual_mcp_id??void 0,createdBy:Y?.created_by,triggerId:Y?.trigger_id,title:Y?.title,branch:Y?.branch??null,createdAt:Y?.created_at,updatedAt:Y?.updated_at}));return}case"STEP_COMPLETED":X.emit($.orgId,e00($.taskId,$.stepCount));return;case"RUN_COMPLETED":await TS$($.taskId,$.orgId,"completed",Z);return;case"RUN_REQUIRES_ACTION":await TS$($.taskId,$.orgId,"requires_action",Z);return;case"RUN_FAILED":{if($.reason==="ghost"){if(!await G.forceFailIfInProgress($.taskId,$.orgId))return;await G.update($.taskId,$.orgId,{run_config:null,run_started_at:null})}else await G.update($.taskId,$.orgId,{status:"failed",run_config:null,run_started_at:null,...$.reason==="reaped"?{failure_reason:R14,failure_kind:"stall"}:{}});let Y=await G.get($.taskId,$.orgId);X.emit($.orgId,zJ($.taskId,"failed",{virtualMcpId:Y?.virtual_mcp_id??void 0,createdBy:Y?.created_by,triggerId:Y?.trigger_id,title:Y?.title,branch:Y?.branch??null,createdAt:Y?.created_at,updatedAt:Y?.updated_at})),X.emit($.orgId,ac($.taskId,"failed"));return}case"PREVIOUS_RUN_ABORTED":return}}async function IS$($,Z){for(let{event:G}of $)await q14(G,Z)}var R14="Run stalled \u2014 no progress within the idle timeout window";var RS$=O(()=>{$6()});function qS$($){return $.now-$.lastProgressAt>$.idleTimeoutMs}function MS$($){return Math.max($.persistedLastProgressAt??Number.NEGATIVE_INFINITY,$.currentRunStartedAt)}class S11{deps;clock;states=new Map;reaperTimer=null;constructor($,Z=()=>new Date){this.deps=$;this.clock=Z;this.reaperTimer=setInterval(()=>{this.reapStaleRuns().catch((G)=>{console.error("[RunRegistry] Reaper sweep failed",G)})},M14)}async execute($){let Z=this.dispatch($);return await this.react(Z),Z}dispatch($){let Z=this.states.get($.taskId),G=PS$($,Z),X=[];for(let Y of G){let Q=this.states.get(Y.taskId);if(Y.type==="PREVIOUS_RUN_ABORTED"||Y.type==="RUN_FAILED"){if(Q?.status.tag==="running")Q.status.abortController.abort()}let J=AS$(Q,Y,this.clock());if(J===void 0)this.states.delete(Y.taskId);else this.states.set(Y.taskId,J);if(X.push({event:Y,state:J}),k14.has(Y.type))SS$().add(1,{"org.id":Y.orgId});else if(S14.has(Y.type)&&Q?.status.tag==="running")SS$().add(-1,{"org.id":Y.orgId})}return X}react($){return IS$($,this.deps)}getAbortSignal($){let Z=this.states.get($);if(Z?.status.tag==="running")return Z.status.abortController.signal;return null}isRunning($){return this.states.get($)?.status.tag==="running"}async stopAll(){for(let[,$]of this.states)if($.status.tag==="running")$.status.abortController.abort();this.states.clear()}dispose(){if(this.reaperTimer)clearInterval(this.reaperTimer),this.reaperTimer=null}async reapStaleRuns(){let $=this.clock().getTime(),Z=[...this.states].filter(([,G])=>G.status.tag==="running");for(let[G,X]of Z){if(this.states.get(G)?.status.tag!=="running")continue;let Q;try{let W=await this.deps.storage.getProgress(G,X.orgId);Q=MS$({persistedLastProgressAt:W?.lastProgressAt??null,currentRunStartedAt:X.status.startedAt.getTime()})}catch(W){console.warn(`[RunRegistry] Reaper progress read failed for ${G}; skipping`,W);continue}if(!qS$({lastProgressAt:Q,now:$,idleTimeoutMs:kS$}))continue;let J=await this.deps.storage.get(G,X.orgId).catch(()=>null);if(J&&J.status!=="in_progress"){let W=this.states.get(G);if(W?.status.tag==="running")W.status.abortController.abort();this.states.delete(G);continue}console.warn(`[RunRegistry] Reaping stuck run for thread ${G} (idle > ${kS$/60000}m) ...`),V14().add(1,{"org.id":X.orgId,reason:"idle_timeout"}),await this.execute({type:"FORCE_FAIL",taskId:G,reason:"reaped"}).catch((W)=>{console.error("[RunRegistry] Reaper execute failed",W)})}}}var M14=300000,kS$=600000,k14,S14,VS$=($)=>{let Z;return()=>Z??=$()},SS$,V14;var CS$=O(()=>{RS$();I5();k14=new Set(["RUN_STARTED","RUN_RESUMED"]),S14=new Set(["RUN_COMPLETED","RUN_FAILED","RUN_REQUIRES_ACTION","PREVIOUS_RUN_ABORTED"]),SS$=VS$(()=>y8.createUpDownCounter("decopilot.stream.inflight",{description:"Number of in-flight decopilot stream requests",unit:"{requests}"})),V14=VS$(()=>y8.createCounter("decopilot.run.reaped",{description:"Number of decopilot runs force-failed by the progress-based reaper",unit:"{runs}"}))});function xD0($,Z,G,X){if(!X)return!1;return $.emit(Z,zJ(G,X.status,{title:X.title??void 0,virtualMcpId:X.virtual_mcp_id??void 0,createdBy:X.created_by??void 0,triggerId:X.trigger_id??null,branch:X.branch??null,createdAt:X.created_at,updatedAt:X.updated_at})),!0}var _S$=O(()=>{$6()});class V11{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as C14,rm as vD0}from"fs/promises";import{join as yD0}from"path";async function gD0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-_14),Z.setUTCHours(0,0,0,0);let G=0;try{let X=await tV($);for(let Y of X)if(/^\d{4}$/.test(Y))G+=await bS$($,Y,Z);else if(!Y.startsWith(".")){let Q=yD0($,Y),J=await tV(Q);for(let K of J){if(!/^\d{4}$/.test(K))continue;G+=await bS$(Q,K,Z)}if((await tV(Q)).length===0)await vD0(Q,{recursive:!0,force:!0})}}catch(X){console.warn("monitoring retention cleanup failed:",X)}return G}async function bS$($,Z,G){let X=0,Y=yD0($,Z),Q=await tV(Y);for(let W of Q){if(!/^\d{2}$/.test(W))continue;let K=yD0(Y,W),U=await tV(K);for(let F of U){if(!/^\d{2}$/.test(F))continue;let H=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(H.getTime()))continue;if(H<G){let N=yD0(K,F);await vD0(N,{recursive:!0,force:!0}),X++}}if((await tV(K)).length===0)await vD0(K,{recursive:!0,force:!0})}if((await tV(Y)).length===0)await vD0(Y,{recursive:!0,force:!0});return X}async function tV($){try{return(await C14($)).filter((G)=>!G.startsWith("."))}catch{return[]}}var _14=30;var C11=()=>{};import{DBOS as _11,SchedulerMode as b14}from"@dbos-inc/dbos-sdk";async function x14(){let $=[uQ(),oV(),HK()],Z=0;for(let G of $)try{Z+=await gD0(G)}catch(X){console.error("[monitoring-retention] cleanup failed:",X)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function v14($,Z){await _11.runStep(()=>x14(),{name:"monitoringRetention"})}function xS$(){if(fS$)return;fS$=!0;let $=_11.registerWorkflow(v14,{name:"monitoringRetentionWorkflow"});_11.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:f14,mode:b14.ExactlyOncePerIntervalWhenActive})}var f14="23 4 * * *",fS$=!1;var vS$=O(()=>{yX();C11()});function yS$($){return async(Z,G)=>{let X=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",G).where("member.organizationId","=",Z).executeTakeFirst();if(!X)return console.warn(`[automationContextFactory] User ${G} not found in org ${Z} \u2014 returning null`),null;let Y=await uH.create();Y.auth.user={id:G,role:X.role},Y.organization={id:X.orgId,slug:X.orgSlug,name:X.orgName};let Q=await Nc0($.db,Z,X.role);return Y.boundAuth=Hc0({auth:Y.authInstance,headers:new Headers,role:X.role,permissions:Q,userId:G}),Y.access=new OE(G,void 0,Y.boundAuth,X.role,"self"),U40(Y,{id:X.orgId,slug:X.orgSlug}),Y}}var gS$=O(()=>{EE();im()});function y14(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function h14(){for(let $ of g14)$()}function hS$($){let Z=[...b11.logs,$];b11={...b11,logs:Z.length>500?Z.slice(-500):Z},h14()}function f11(){return c14}var b11,g14,c14=!1;var x11=O(()=>{b11=y14(),g14=new Set});import{EventEmitter as u14}from"events";var v11;var cS$=O(()=>{x11();v11=new u14;v11.on("request",($)=>{hS$($)})});function uS$(){return async($,Z)=>{let G=Date.now(),X=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let Q="",J=!1;if(Y.startsWith("/mcp")&&X==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let H=await $.req.raw.clone().json();if(H.method==="tools/call"&&H.params?.name){let N=oy(H.params.name),B=H.params.arguments||{},E=Object.keys(B).map((L)=>oy(L)),D=E.length>0?E.slice(0,3).join(",")+(E.length>3?"\u2026":""):"";Q=`${s4.tool}${N}${s4.dim}(${D})${s4.reset}`}else if(H.method)Q=`${s4.dim}${oy(H.method)}${s4.reset}`}}catch{}}let W=oy(Y);if(Y.startsWith("/mcp/conn_")){let w=Y.split("/")[2]??"";W=`/mcp/${s4.mcp}${oy(w.slice(0,12))}\u2026${s4.reset}`}else if(Y==="/mcp")W=`${s4.mcp}/mcp${s4.reset}`;else if(Y==="/mcp/registry")W=`${s4.mcp}/mcp/registry${s4.reset}`;let K=l14(X),U=J?"\u25C0":"\u2190";if(!f11())console.log(`${s4.dim}${U}${s4.reset} ${K}${X}${s4.reset} ${W}${Q?` ${Q}`:""}`);try{await Z()}finally{let w=Date.now()-G,F=$.res.status,H=d14(F),N=w<1000?`${w}ms`:`${(w/1000).toFixed(1)}s`,B=J?"\u25B6":"\u2192";if(!f11())console.log(`${s4.dim}${B}${s4.reset} ${K}${X}${s4.reset} ${W}${Q?` ${Q}`:""} ${H}${F}${s4.reset} ${s4.duration}${N}${s4.reset}`);v11.emit("request",{method:X,path:oy(Y),status:F,duration:w,timestamp:new Date})}}}var s4,d14=($)=>{if($>=500)return s4.serverError;if($>=400)return s4.clientError;if($>=300)return s4.redirect;return s4.ok},l14=($)=>{return s4[$]||s4.reset},oy=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var dS$=O(()=>{x11();cS$();s4={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as nS$}from"crypto";import{mkdir as m14,readdir as i14,rm as lS$,stat as pS$}from"fs/promises";import{join as g11,relative as n14}from"path";import{z as P$}from"zod";function rS$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return g11(p14,Z)}function oS$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function y11($,Z){let G=rS$($),X=oS$(Z);return g11(G,X)}function t14($,Z,G,X){let Y=L1().encryptionKey||"dev-secret",Q=`${$}:${Z}:${G}:${X}`;return nS$("sha256",Y).update(Q).digest("hex")}function iS$($,Z,G,X,Y){let Q=Math.floor(Date.now()/1000)+X,J=t14(Z,G,Q,Y),W=new URL(`/api/dev-assets/${Z}/${oS$(G)}`,$);return W.searchParams.set("expires",Q.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function aS$($,Z,G){let X=`${$}:${Z.getTime()}:${G}`;return`"${nS$("md5","etag").update(X).digest("hex")}"`}async function sS$($,Z,G,X,Y){try{let Q=await i14($,{withFileTypes:!0});for(let J of Q){let W=g11($,J.name),U=n14(Z,W).replace(/\\/g,"/");if(G&&!U.startsWith(G))continue;if(J.isDirectory())if(X){let w=U+"/";if(!G||w.startsWith(G)){if(!(G?U.slice(G.length):U).includes("/"))Y.commonPrefixes.add(w)}}else await sS$(W,Z,G,X,Y);else if(J.isFile()){if(X&&G){let w=U.slice(G.length);if(w.includes(X)){let F=w.indexOf(X),H=G+w.slice(0,F+1);Y.commonPrefixes.add(H);continue}}try{let w=await pS$(W);Y.objects.push({key:U,size:w.size,lastModified:w.mtime.toISOString(),etag:aS$(W,w.mtime,w.size)})}catch{}}}}catch{}}function eS$($,Z){let X=E0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:P$.object({prefix:P$.string().optional(),maxKeys:P$.number().optional().default(1000),continuationToken:P$.string().optional(),delimiter:P$.string().optional()}),outputSchema:P$.object({objects:P$.array(P$.object({key:P$.string(),size:P$.number(),lastModified:P$.string(),etag:P$.string()})),nextContinuationToken:P$.string().optional(),isTruncated:P$.boolean(),commonPrefixes:P$.array(P$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=Q.prefix||"",W=Q.maxKeys??1000,K=Q.delimiter,U=Q.continuationToken,w=rS$(X);await m14(w,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await sS$(w,w,J,K,F),F.objects.sort((D,L)=>D.key.localeCompare(L.key));let H=0;if(U){if(H=F.objects.findIndex((D)=>D.key>U),H===-1)H=F.objects.length}let N=F.objects.slice(H,H+W),B=H+W<F.objects.length,E=B?N[N.length-1]?.key:void 0;return{objects:N,isTruncated:B,nextContinuationToken:E,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({contentType:P$.string().optional(),contentLength:P$.number(),lastModified:P$.string(),etag:P$.string(),metadata:P$.record(P$.string(),P$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=y11(X,Q.key),W=await pS$(J);return{contentType:fe0(Q.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:aS$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??mS$;return{url:iS$(Z,X,Q.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional(),contentType:P$.string().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??mS$;return{url:iS$(Z,X,Q.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({success:P$.boolean(),key:P$.string()}),handler:async(Y)=>{let Q=Y,J=y11(X,Q.key);try{return await lS$(J),{success:!0,key:Q.key}}catch{return{success:!1,key:Q.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:P$.object({keys:P$.array(P$.string()).max(1000)}),outputSchema:P$.object({deleted:P$.array(P$.string()),errors:P$.array(P$.object({key:P$.string(),message:P$.string()}))}),handler:async(Y)=>{let Q=Y,J=[],W=[];return await Promise.all(Q.keys.map(async(K)=>{let U=y11(X,K);try{await lS$(U),J.push(K)}catch(w){W.push({key:K,message:w instanceof Error?w.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function h11($,Z,G){let X=eS$(Z,G),Y=new $U({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:O5});for(let J of X){let W="shape"in J.inputSchema?J.inputSchema.shape:P$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:P$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(U)=>{try{let w=await J.handler(U);return{content:[{type:"text",text:JSON.stringify(w)}],structuredContent:w}}catch(w){return{content:[{type:"text",text:`Error: ${w.message}`}],isError:!0}}})}let Q=new MY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(Q),cW(Y,Q,$,"mcp:dev-assets")}async function $V$($,Z,G,X){let Q=eS$(G,X).find((J)=>J.name===$);if(!Q)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await Q.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var p14="./data/assets",mS$=3600,tS$,ZV$;var GV$=O(()=>{q8();jn();d6();ec();Pv();H7();rE0();tS$=new y1;tS$.all("/",async($)=>{let Z=$.get("meshContext"),G=new URL($.req.url),X=`${G.protocol}//${G.host}`;return h11($.req.raw,Z,X)});ZV$=tS$});var XV$={};e8(XV$,{mountDevRoutes:()=>r14});function r14($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(X)=>{let Y=X.get("meshContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`;return h11(X.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(X)=>{let Y=X.get("meshContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`,W=X.req.param("toolName");if(!W)return X.json({error:"Missing tool name"},400);let K=await X.req.json(),U=await $V$(W,K,Y,J);if(U.isError)return X.json(U.content,500);return X.json(U.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",ZV$);let G=new y1;G.use("*",vQ({mountPath:"/api/dev-assets"})),G.route("/",tE0({orgFromPath:!1})),$.route("/api/dev-assets",G)}var YV$=O(()=>{d6();Me0();rE0();GV$()});var QV$=O(()=>{xc0();vc0();aE()});var hD0=O(()=>{QV$()});var WV$={};e8(WV$,{streamAgent:()=>JV$,createDecopilotClient:()=>a14});async function o14($){let{parseJsonEventStream:Z,uiMessageChunkSchema:G}=await Promise.resolve().then(() => (f6(),sd0));return Z({stream:$,schema:G}).pipeThrough(new TransformStream({transform(X,Y){if(!X.success)throw X.error;Y.enqueue(X.value)}}))}async function JV$($,Z,G,X,Y){let{readUIMessageStream:Q}=await Promise.resolve().then(() => (f6(),sd0)),J=G.value??G.id;if(!J)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let W=X.credentialId??G.credentialId,K=X.thinking??G.thinking,U=K?.id,w={messages:X.messages,...U?{models:{credentialId:W,thinking:K,...X.fast??G.fast?{fast:X.fast??G.fast}:{}}}:{},agent:{id:J},temperature:X.temperature??G.temperature,toolApprovalLevel:X.toolApprovalLevel??G.toolApprovalLevel,mode:X.mode??G.mode??"default",...X.memory?{memory:X.memory}:{},...X.thread_id?{thread_id:X.thread_id}:{}},F=await fetch($,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":Z,Authorization:`Bearer ${Z}`},body:JSON.stringify(w),signal:Y?.signal});if(!F.ok){let N=await F.text().catch(()=>""),B=`HTTP ${F.status}`;try{let E=JSON.parse(N);if(E?.error)B=E.error}catch{if(N)B=N}throw Error(B)}if(!F.body)throw Error("Empty response body from decopilot stream");let H=await o14(F.body);return Q({stream:H})}function a14($){let{baseUrl:Z,orgSlug:G,token:X}=$,Y=`${Z}/${G}/decopilot/runtime/stream`;return{stream(Q,J){let W={__type:"@deco/agent",id:Q.agent.id,credentialId:Q.credentialId??"",thinking:Q.thinking??{id:"",title:""},fast:Q.fast,toolApprovalLevel:Q.toolApprovalLevel,mode:Q.mode,temperature:Q.temperature};return JV$(Y,X,W,Q,J)}}}import{z as xX}from"zod";function KV$($){let Z=$.properties;if(!Z)return $;for(let G of Object.values(Z)){let X=G.properties;if(!X?.__type?.const)continue;let Y=X.__type.const,Q=s14.get(Y);if(!Q)continue;let J=Q.map((W)=>({name:String(W.name),...W.inputSchema&&{inputSchema:xX.toJSONSchema(W.inputSchema)},...W.outputSchema&&{outputSchema:xX.toJSONSchema(W.outputSchema)}}));X.__binding={const:J}}return $}var s14,i1Z,e14=($)=>{return typeof $==="object"&&$!==null&&$.__type==="@deco/agent"},u11=($)=>{return typeof $==="object"&&$!==null&&typeof $.__type==="string"&&$.__type!=="@deco/agent"&&typeof $.value==="string"},cD0=($,Z,G)=>{let X=G?{"x-caller-app":G}:void 0;if(Z.cookie)X??={},X.cookie=Z.cookie;if(Z.token)X??={},X["x-mesh-token"]=Z.token;return{type:"HTTP",url:new URL(`/mcp/${$}`,Z.meshUrl).href,token:Z.token,headers:X}},$$4=($,Z,G)=>{let X=cD0($,Z,G);return new Proxy(Mx.forConnection(X),{get(Y,Q){if(Q==="value")return $;if(Q==="__type")return G;return Y[Q]}})},Z$4=($,Z)=>{let G=Z.organizationSlug;if(!G)throw Error("organizationSlug is required for agent bindings");let X=`${Z.meshUrl}/api/${G}/decopilot/runtime/stream`;return{STREAM:async(Y,Q)=>{let{streamAgent:J}=await Promise.resolve().then(() => WV$);return J(X,Z.token,$,Y,Q)}}},c11=($,Z)=>{if($===null||$===void 0)return $;if(Array.isArray($))return $.map((G)=>c11(G,Z));if(typeof $==="object"){if(e14($))return Z$4($,Z);if(u11($))return $$4($.value,Z,$.__type);let G={};for(let[X,Y]of Object.entries($))G[X]=c11(Y,Z);return G}return $},UV$=($)=>{return c11($.state,$)};var ay=O(()=>{hD0();s14=new Map;i1Z=xX.object({id:xX.string(),title:xX.string(),capabilities:xX.object({vision:xX.boolean().optional(),text:xX.boolean().optional(),tools:xX.boolean().optional(),reasoning:xX.boolean().optional()}).passthrough().optional(),provider:xX.string().optional().nullable(),limits:xX.object({contextWindow:xX.number().optional(),maxOutputTokens:xX.number().optional()}).passthrough().optional()})});var G$4,wV$=($,Z,G)=>{if(!Z)return null;if($===void 0||$==="*")return"*";if(typeof $==="string")return $===Z?$:null;if(Array.isArray($))return $.includes(Z)?Z:null;if(typeof $==="function")return $(Z,G)??null;return null},X$4=($,Z,G)=>{let X=Z.headers.get("Origin"),Y=wV$(G.origin,X,Z);if(Y)$.set("Access-Control-Allow-Origin",Y);if(G.credentials)$.set("Access-Control-Allow-Credentials","true");if(G.exposeHeaders?.length)$.set("Access-Control-Expose-Headers",G.exposeHeaders.join(", "))},FV$=($,Z)=>{let G=new Headers,X=$.headers.get("Origin"),Y=wV$(Z.origin,X,$);if(Y)G.set("Access-Control-Allow-Origin",Y);if(Z.credentials)G.set("Access-Control-Allow-Credentials","true");let Q=Z.allowMethods??G$4;G.set("Access-Control-Allow-Methods",Q.join(", "));let J=$.headers.get("Access-Control-Request-Headers");if(Z.allowHeaders?.length)G.set("Access-Control-Allow-Headers",Z.allowHeaders.join(", "));else if(J)G.set("Access-Control-Allow-Headers",J);if(Z.maxAge!==void 0)G.set("Access-Control-Max-Age",Z.maxAge.toString());return new Response(null,{status:204,headers:G})},HV$=($,Z,G)=>{let X=new Headers($.headers);return X$4(X,Z,G),new Response($.body,{status:$.status,statusText:$.statusText,headers:X})};var NV$=O(()=>{G$4=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function BV$($=32){let G=new Uint8Array($);return crypto.getRandomValues(G),Array.from(G,(X)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[X%62]).join("")}function Y$4($){try{let Z=new URL($);return Z.protocol==="https:"||Z.hostname==="localhost"||Z.hostname.endsWith(".localhost")||Z.hostname==="127.0.0.1"||!Z.protocol.startsWith("http")}catch{return!1}}function OV$($){return btoa(JSON.stringify($)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function EV$($){try{let Z=$.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(Z))}catch{return null}}function DV$($){return{handleProtectedResourceMetadata:(U)=>{let w=wK(new URL(U.url)),F=`${w.origin}/mcp`;return Response.json({resource:F,authorization_servers:[w.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(U)=>{let F=wK(new URL(U.url)).origin;return Response.json({issuer:F,authorization_endpoint:`${F}/authorize`,token_endpoint:`${F}/token`,registration_endpoint:`${F}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(U)=>{let w=wK(new URL(U.url)),F=w.searchParams.get("redirect_uri"),H=w.searchParams.get("response_type"),N=w.searchParams.get("state"),B=w.searchParams.get("code_challenge"),E=w.searchParams.get("code_challenge_method");if(!F)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(H!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let D=wK(new URL(`${w.origin}/oauth/callback`)),L=D.toString(),j=OV$({redirectUri:F,clientState:N??void 0,codeChallenge:B??void 0,codeChallengeMethod:E??void 0,oauthCallbackUri:L});D.searchParams.set("state",j);let P=$.authorizationUrl(D.toString());return Response.redirect(P,302)},handleOAuthCallback:async(U)=>{let w=wK(new URL(U.url)),F=w.searchParams.get("code"),H=w.searchParams.get("state"),N=w.searchParams.get("error"),B=H?EV$(H):null;if(N){let E=w.searchParams.get("error_description")??"Authorization failed";if(B?.redirectUri){let D=wK(new URL(B.redirectUri));if(D.searchParams.set("error",N),D.searchParams.set("error_description",E),B.clientState)D.searchParams.set("state",B.clientState);return Response.redirect(D.toString(),302)}return Response.json({error:N,error_description:E},{status:400})}if(!F||!B)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let E=B.oauthCallbackUri??wK(new URL(`${w.origin}/oauth/callback`)).toString(),D={code:F,redirect_uri:E},L=await $.exchangeCode(D),z={accessToken:L.access_token,tokenType:L.token_type,refreshToken:L.refresh_token,expiresIn:L.expires_in,scope:L.scope,codeChallenge:B.codeChallenge,codeChallengeMethod:B.codeChallengeMethod},j=OV$(z),P=wK(new URL(B.redirectUri));if(P.searchParams.set("code",j),B.clientState)P.searchParams.set("state",B.clientState);return Response.redirect(P.toString(),302)}catch(E){console.error("OAuth callback error:",E);let D=wK(new URL(B.redirectUri));if(D.searchParams.set("error","server_error"),D.searchParams.set("error_description","Failed to exchange authorization code"),B.clientState)D.searchParams.set("state",B.clientState);return Response.redirect(D.toString(),302)}},handleToken:async(U)=>{try{let w=U.headers.get("content-type")??"",F;if(w.includes("application/x-www-form-urlencoded")){let z=await U.formData();F=Object.fromEntries(z.entries())}else{let z=await U.json();if(typeof z!=="object"||z===null||Array.isArray(z))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});F=z}let{code:H,code_verifier:N,grant_type:B,refresh_token:E}=F;if(B==="refresh_token"){if(typeof E!=="string"||!E)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!$.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let z;try{z=await $.refreshToken(E)}catch(P){if(P instanceof d11)return Response.json({error:P.error,...P.errorDescription?{error_description:P.errorDescription}:{}},{status:400});throw P}let j={access_token:z.access_token,token_type:z.token_type};if(z.refresh_token)j.refresh_token=z.refresh_token;if(z.expires_in!==void 0)j.expires_in=z.expires_in;if(z.scope)j.scope=z.scope;return Response.json(j,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(B!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof H!=="string"||!H)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let D=EV$(H);if(!D||!D.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(D.codeChallenge){if(typeof N!=="string"||!N)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let z;if(D.codeChallengeMethod==="S256"){let P=new TextEncoder().encode(N),A=await crypto.subtle.digest("SHA-256",P);z=btoa(String.fromCharCode(...new Uint8Array(A))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else z=N;if(z!==D.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let L={access_token:D.accessToken,token_type:D.tokenType};if(D.refreshToken)L.refresh_token=D.refreshToken;if(D.expiresIn!==void 0)L.expires_in=D.expiresIn;if(D.scope)L.scope=D.scope;return Response.json(L,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Token exchange error:",w),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(U)=>{try{let w=await U.json();if(!w.redirect_uris||w.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let E of w.redirect_uris)if(!Y$4(E))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${E}`},{status:400});let F=BV$(32),H=w.token_endpoint_auth_method!=="none"?BV$(32):void 0,N=Math.floor(Date.now()/1000),B={client_id:F,client_secret:H,client_name:w.client_name,redirect_uris:w.redirect_uris,grant_types:w.grant_types??["authorization_code"],response_types:w.response_types??["code"],token_endpoint_auth_method:w.token_endpoint_auth_method??"client_secret_post",scope:w.scope,client_id_issued_at:N,client_secret_expires_at:0};if($.persistence)await $.persistence.saveClient(B);return new Response(JSON.stringify(B),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Client registration error:",w),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(U)=>{let H=`Bearer resource_metadata="${`${wK(new URL(U.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":H,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(U)=>U.headers.has("Authorization")}}var d11,wK=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $};var l11=O(()=>{d11=class d11 extends Error{error;errorDescription;constructor($="invalid_grant",Z){super(Z??$);this.name="OAuthInvalidGrantError",this.error=$,this.errorDescription=Z}}});import{AsyncLocalStorage as Q$4}from"async_hooks";var LV$,Pt;var m11=O(()=>{LV$=new Q$4,Pt={getStore:()=>{return LV$.getStore()},run:($,Z,...G)=>LV$.run($,Z,...G)}});var jV$="SELF",dD0=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},PV$=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},zV$="::",AV$=($)=>{let Z=$.indexOf(zV$);if(Z===-1)return null;let G=$.substring(0,Z),X=$.substring(Z+zV$.length);return[G,X]},J$4=($)=>{if(!$.startsWith("cron/"))return null;let Z=$.substring(5),G=Z.indexOf("/");if(G===-1)return null;let X=Z.substring(0,G),Y=Z.substring(G+1);return[X,Y]},TV$=($)=>{if(dD0($))return[];return Object.keys($)},W$4=($,Z)=>{if(dD0($))return $.events;let G=$[Z];if(!G)return[];if(PV$(G))return G.events;return Object.keys(G)},uD0=($,Z,G)=>{if($===jV$){if(!G)return console.warn("[Event] SELF binding used but no connectionId available"),null;return G}let X=Z[$];if(!u11(X))return console.warn(`[Event] Binding "${$}" not found in state`),null;return X.value},K$4=($,Z,G)=>{let X=Z;if(dD0($)){let Q=[];for(let J of $.events){let W=AV$(J);if(!W){console.warn(`[Event] Global handler event "${J}" must be prefixed with BINDING:: (e.g., "SELF::${J}" or "DATABASE::${J}")`);continue}let[K,U]=W,w=uD0(K,X,G);if(!w)continue;Q.push({eventType:U,publisher:w})}return Q}let Y=[];for(let Q of TV$($)){let J=uD0(Q,X,G);if(!J)continue;let W=W$4($,Q);for(let K of W)Y.push({eventType:K,publisher:J})}return Y},U$4=($)=>{let Z=new Map;for(let G of $){let X=G.source,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},w$4=($)=>{let Z=new Map;for(let G of $){let X=G.type,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},F$4=($)=>{let Z={},G={},X=!1,Y=0,Q=[];for(let J of $){if(J.results)Object.assign(G,J.results);if(J.success===!1){if(X=!0,J.error)Q.push(J.error)}if(J.processedCount!==void 0)Y+=J.processedCount}if(Object.keys(G).length>0)Z.results=G;if(Z.success=!X,Q.length>0)Z.error=Q.join("; ");if(Y>0)Z.processedCount=Y;return Z},H$4=async($,Z,G,X,Y)=>{let Q=X;if(dD0($)){let w=new Set;for(let H of $.events){let N=AV$(H);if(!N)continue;let[B,E]=N,D=uD0(B,Q,Y);if(!D)continue;w.add(`${D}:${E}`)}let F=Z.filter((H)=>{let N=`${H.source}:${H.type}`;return w.has(N)});if(F.length===0)return{success:!0};try{return await $.handler({events:F},G)}catch(H){return{success:!1,error:H instanceof Error?H.message:String(H)}}}let J=new Map;for(let w of TV$($)){let F=uD0(w,Q,Y);if(F)J.set(F,w)}let W=U$4(Z),K=[];for(let[w,F]of W){let H=J.get(w);if(!H)continue;let N=$[H];if(!N)continue;if(PV$(N)){K.push((async()=>{try{return await N.handler({events:F},G)}catch(D){let L={};for(let z of F)L[z.id]={success:!1,error:D instanceof Error?D.message:String(D)};return{results:L}}})());continue}let B=N,E=w$4(F);for(let[D,L]of E){let z=B[D];if(!z)continue;K.push((async()=>{try{let j=await z({events:L},G),P={};for(let A of L)P[A.id]=j;return{results:P}}catch(j){let P={};for(let A of L)P[A.id]={success:!1,error:j instanceof Error?j.message:String(j)};return{results:P}}})())}}let U=await Promise.all(K);if(U.length===0)return{success:!0};return F$4(U)},IV$;var i11=O(()=>{ay();IV$={subscriptions:K$4,execute:H$4,parseCron:J$4}});function N$4($,Z){let G=cD0("self",{meshUrl:$,token:Z});return Mx.forConnection(G)}function B$4($,Z){switch(Z.type){case"cron":return{automation_id:$,type:"cron",cron_expression:Z.cron};case"event":return{automation_id:$,type:"event",connection_id:Z.connectionId,event_type:Z.eventType,params:Z.params};case"webhook":return{automation_id:$,type:"webhook"}}}function RV$($,Z,G){return async(X)=>{if(!$)throw Error("createAgent: missing meshUrl in MESH_REQUEST_CONTEXT");let Y=N$4($,Z),J=(await Y.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["title"],operator:"eq",value:X.name}]},limit:1})).items.find((w)=>w.title===X.name);if(J)return{id:J.id,automations:[],automationIds:[],alreadyExisted:!0};let W=X.tools&&X.tools.length>0?X.tools.map((w)=>({connection_id:w.connectionId,selected_tools:w.tools??null,selected_resources:null,selected_prompts:null})):G?[{connection_id:G,selected_tools:null,selected_resources:null,selected_prompts:null}]:[],{item:K}=await Y.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:X.name,description:X.description,metadata:X.instructions?{instructions:X.instructions}:void 0,connections:W}}),U=[];for(let w of X.automations??[]){let F=await Y.AUTOMATION_CREATE({name:w.name,virtual_mcp_id:K.id,messages:w.messages,models:w.models,tools:w.tools,active:w.active??!0}),H=[];for(let N of w.triggers??[])try{let B=await Y.AUTOMATION_TRIGGER_ADD(B$4(F.id,N));H.push({type:N.type,ok:!0,id:B.id,webhook:B.webhook??void 0})}catch(B){H.push({type:N.type,ok:!1,error:B instanceof Error?B.message:String(B)})}U.push({id:F.id,name:w.name,triggers:H})}return{id:K.id,automations:U,automationIds:U.map((w)=>w.id),alreadyExisted:!1}}}var n11=O(()=>{ay();hD0()});import{z as JZ}from"zod";function Tw($){return{...$,execute:(Z)=>{let G=At(Z.runtimeContext);return $.execute({...Z,runtimeContext:G},G)}}}var At=($)=>{let Z=Pt.getStore();if(!Z){if($)return $;throw Error("Missing context, did you forget to call State.bind?")}return Z},qV$=($)=>{let Z=$.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:Z?.connectionId,meshUrl:Z?.meshUrl,token:Z?.token}},O$4=({events:$,configuration:{state:Z,scopes:G,onChange:X,onInstall:Y}={}}={})=>{let Q=Z?KV$(JZ.toJSONSchema(Z)):{type:"object",properties:{}};return[...X||Y||$?[Tw({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:JZ.object({state:Z??JZ.unknown(),scopes:JZ.array(JZ.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')"),firstRun:JZ.boolean().optional().describe("True on the first configuration save for this connection \u2014 fires onInstall."),vault:JZ.object({baseUrl:JZ.string(),org:JZ.string(),subjectConnectionId:JZ.string(),token:JZ.string()}).optional()}),outputSchema:JZ.object({}),execute:async(J)=>{let W=J.context.state,K=J.context.vault;if(await X?.(J.runtimeContext.env,{state:W,scopes:J.context.scopes,vault:K}),Y&&J.context.firstRun){let{meshUrl:U,token:w,connectionId:F}=qV$(J);await Y(J.runtimeContext.env,{createAgent:RV$(U,w,F),vault:K})}return Promise.resolve({})}})]:[],...$?.handlers?[Tw({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:C40,outputSchema:_40,execute:async(J)=>{let W=J.runtimeContext.env,K=W.MESH_REQUEST_CONTEXT?.state,{connectionId:U}=qV$(J);return IV$.execute($.handlers,J.context.events,W,K,U)}})]:[],Tw({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:JZ.object({}),outputSchema:JZ.object({stateSchema:JZ.unknown(),scopes:JZ.array(JZ.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:Q,scopes:[...G??[]]})}})]},MV$=($)=>{let Z=null,G=null,X=null,Y=!1,Q=()=>{if(!Y)console.warn("[runtime] Passing factory functions to tools/prompts/resources is deprecated. Pass createTool()/createPrompt()/createResource() instances directly."),Y=!0},J=(N)=>typeof N==="object"&&N!==null&&(("id"in N)||("name"in N)||("uri"in N));async function W(N,B){if(!N)return[];return(await Promise.all(N.flatMap(async(E)=>{if(J(E))return[E];Q();let D=await E(B);if(Array.isArray(D))return D;return[D]}))).flat()}let K=async(N)=>{if(Z)return Z;if(G)return G;return G=(async()=>{try{let B;if(typeof $.tools==="function")Q(),B=await $.tools(N);else B=await W($.tools,N);B.push(...O$4({...$}));let E;if(typeof $.prompts==="function")Q(),E=await $.prompts(N);else E=await W($.prompts,N);let D;if(typeof $.resources==="function")Q(),D=await $.resources(N);else D=await W($.resources,N);let L={tools:B,prompts:E,resources:D};return Z=L,L}catch(B){throw G=null,B}})(),G},U=(N,B)=>{for(let E of B.tools)N.registerTool(E.id,{_meta:E._meta,title:E.title,description:E.description,annotations:E.annotations,inputSchema:E.inputSchema&&"shape"in E.inputSchema?E.inputSchema:JZ.object({}),outputSchema:E.outputSchema&&typeof E.outputSchema==="object"&&"shape"in E.outputSchema?E.outputSchema:void 0},async(D)=>{let L=At(),z=await E.execute({context:D,runtimeContext:L},L);if(z!=null&&typeof z==="object"&&"content"in z&&Array.isArray(z.content)&&z.content.every((j)=>j!=null&&typeof j==="object"&&("type"in j)&&typeof j.type==="string"))return z;return{structuredContent:z,content:[{type:"text",text:JSON.stringify(z)}]}});for(let E of B.prompts)N.registerPrompt(E.name,{title:E.title,description:E.description,argsSchema:E.argsSchema?E.argsSchema:JZ.object({}).shape},async(D)=>{let L=At();return await E.execute({args:D,runtimeContext:L},L)});for(let E of B.resources)N.resource(E.name,E.uri,{description:E.description,mimeType:E.mimeType},async(D)=>{let L=At(),z=await E.read({uri:D,runtimeContext:L},L),j=z._meta??void 0;if(z.text!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,text:z.text,...j!==void 0?{_meta:j}:{}}]};else if(z.blob!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,blob:z.blob,...j!==void 0?{_meta:j}:{}}]};return{contents:[{uri:z.uri,mimeType:z.mimeType,text:""}]}})},w=async(N)=>{await $.before?.(N);let{instructions:B,...E}=$.serverInfo??{},D=new $U({...E,name:E.name??"@deco/mcp-api",version:E.version??"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:O5,...B&&{instructions:B}}),L=await K(N);U(D,L);let z="tools/list",j=D.server._requestHandlers,P=j.get(z);if(P)j.set(z,async(A,M)=>{if(!X)X=await P(A,M);return X});return{server:D,...L}};return{fetch:async(N,B)=>{let{server:E}=await w(B),D=new MY;await E.connect(D);let L=()=>{try{D.close?.()}catch{}try{E.close?.()}catch{}};try{let z=await D.handleRequest(N),j=z.headers.get("content-type");if(!(j?.includes("text/event-stream")||j?.includes("application/json-rpc"))||!z.body)return L(),z;let{readable:A,writable:M}=new TransformStream;return z.body.pipeTo(M).catch(()=>{}).finally(L),new Response(A,{status:z.status,statusText:z.statusText,headers:z.headers})}catch(z){throw L(),z}},callTool:async({toolCallId:N,toolCallInput:B})=>{let E=Pt.getStore();if(!E)throw Error("Missing state, did you forget to call State.bind?");let D=E?.env,{tools:L}=await K(D),j=L.find((A)=>A.id===N)?.execute;if(!j)throw Error(`Tool ${N} not found or does not have an execute function`);let P=At();return j({context:B,runtimeContext:P},P)}}};var lD0=O(()=>{cc0();H7();ec();Pv();ay();i11();m11();n11();i11();n11()});import{decodeJwt as kV$}from"jose";var E$4=({env:$,server:Z,url:G})=>{$.SELF=new Proxy({},{get:(X,Y)=>{if(Y==="toJSON")return null;return async(Q)=>{return await Z.callTool({toolCallId:Y,toolCallInput:Q})}}}),$.IS_LOCAL=(G?.startsWith("http://localhost")||G?.startsWith("http://127.0.0.1"))??!1},SV$=($)=>()=>{return{...$??{}}},D$4=({env:$,server:Z,tokenOrContext:G,url:X,authToken:Y})=>{let Q=$,J=Y?Y.split(" ")[1]:void 0,W;if(typeof G==="string"){let K=kV$(G),U=K.metadata??{};W={authorization:J,state:K.state??U.state??{},token:G,meshUrl:K.meshUrl??U.meshUrl,connectionId:K.connectionId??U.connectionId,organizationId:K.organizationId??U.organizationId,organizationName:K.organizationName??U.organizationName,organizationSlug:K.organizationSlug??U.organizationSlug,ensureAuthenticated:SV$(K.user??K.sub)}}else if(typeof G==="object"){W=G;let K=kV$(G.token),U=K.metadata??{},w=K.appName;W.authorization??=J,W.callerApp=w,W.connectionId??=K.connectionId??U.connectionId,W.organizationId??=K.organizationId??U.organizationId,W.organizationName??=K.organizationName??U.organizationName,W.organizationSlug??=K.organizationSlug??U.organizationSlug,W.ensureAuthenticated=SV$(K.user??K.sub)}else W={state:{},authorization:J,token:void 0,meshUrl:void 0,connectionId:void 0,ensureAuthenticated:()=>{throw Error("Unauthorized")}};return Q.MESH_REQUEST_CONTEXT=W,W.state=UV$(W),E$4({env:Q,server:Z,url:X}),Q},L$4,VV$=($)=>{let Z=MV$($),G=$.cors??L$4,X=$.oauth,Y=X?DV$(X):null,Q=async(J,W,K)=>{let U=new URL(J.url);if(Y){if(U.pathname==="/.well-known/oauth-protected-resource"||U.pathname==="/mcp/.well-known/oauth-protected-resource")return Y.handleProtectedResourceMetadata(J);if(U.pathname==="/.well-known/oauth-authorization-server")return Y.handleAuthorizationServerMetadata(J);if(U.pathname==="/authorize")return Y.handleAuthorize(J);if(U.pathname==="/oauth/callback")return Y.handleOAuthCallback(J);if(U.pathname==="/token"&&J.method==="POST")return Y.handleToken(J);if((U.pathname==="/register"||U.pathname==="/mcp/register")&&J.method==="POST")return Y.handleClientRegistration(J)}if(U.pathname==="/mcp"){if(J.method==="GET")return new Response("Method not allowed",{status:405});if(Y&&!Y.hasAuth(J)){let w=J.clone();try{if((await w.json())?.method!=="tools/list")return Y.createUnauthorizedResponse(J)}catch{return Y.createUnauthorizedResponse(J)}}return Z.fetch(J,W,K)}if(U.pathname.startsWith("/mcp/call-tool")){let w=U.pathname.split("/").pop();if(!w)return new Response("Not found",{status:404});let F=await J.json(),H=await Z.callTool({toolCallId:w,toolCallInput:F});return new Response(JSON.stringify(H),{headers:{"Content-Type":"application/json"}})}return $.fetch?.(J,W,K)||new Response("Not found",{status:404})};return{fetch:async(J,W,K)=>{if(new URL(J.url).pathname==="/_healthcheck")return new Response("OK",{status:200});if(G!==!1&&J.method==="OPTIONS")return FV$(J,G??{});let U=D$4({authToken:J.headers.get("authorization")??null,env:{...process.env,...W},server:Z,tokenOrContext:J.headers.get("x-mesh-token")??void 0,url:J.url}),w=await Pt.run({req:J,env:U,ctx:K},async()=>await Q(J,U,K));if(G!==!1)return HV$(w,J,G??{});return w}}};var CV$=O(()=>{ay();NV$();l11();l11();m11();lD0();lD0();ay();hD0();L$4={origin:($)=>{if($.includes("localhost")||$.includes("127.0.0.1"))return $;return $},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"]}});import{z as p11}from"zod";function P$4($,Z){let G=Tw({id:"COLLECTION_REGISTRY_APP_LIST",description:"List public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:Hy,outputSchema:Ny,execute:async({context:W})=>{let K={limit:W.limit,offset:W.offset,cursor:W.cursor,tags:W.tags,categories:W.categories,where:W.where},U=`${Z}:${JSON.stringify(K)}`,w=_V$.get(U);if(w)return w;let F=await $.listPublic(Z,K);return _V$.set(U,F),F}}),X=Tw({id:"COLLECTION_REGISTRY_APP_GET",description:"Get a public registry item by ID or name",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:eW,outputSchema:SV,execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{item:null};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{item:U};return{item:null}}}),Y=Tw({id:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get available versions of a public registry item",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:eW,outputSchema:p11.object({versions:p11.array(SV.shape.item)}),execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{versions:[]};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{versions:[U]};return{versions:[]}}}),Q=Tw({id:"COLLECTION_REGISTRY_APP_SEARCH",description:"Search public registry items returning minimal data (id, title, tags, categories, is_public). Use this instead of LIST when you need to find items efficiently without loading full details.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:XE0,outputSchema:YE0,execute:async({context:W})=>{return await $.search(Z,W,{publicOnly:!0})}}),J=Tw({id:"COLLECTION_REGISTRY_APP_FILTERS",description:"Get available tags and categories for public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:p11.object({}),outputSchema:By,execute:async()=>{return await $.getFilters(Z,{publicOnly:!0})}});return[G,Q,X,Y,J]}function bV$($){let Z=$.db,G=new Mf(Z);return async(X)=>{let Y=X.req.param("orgSlug")??X.req.param("org");if(!Y)return X.json({error:"Organization not found"},404);let Q=await Z.selectFrom("organization").select(["id","slug","name"]).where("slug","=",Y).executeTakeFirst();if(!Q)return X.json({error:"Organization not found"},404);let J=P$4(G,Q.id),W=VV$({tools:J}),K=new URL(X.req.url),U=X.req.path.indexOf("/registry"),w=U>=0?X.req.path.slice(U+9):"",F=new URL(w||"/",K.origin);K.searchParams.forEach((B,E)=>{F.searchParams.set(E,B)});let H=new Request(F.toString(),{method:X.req.method,headers:X.req.raw.headers,body:X.req.method!=="GET"&&X.req.method!=="HEAD"?X.req.raw.body:void 0}),N={organizationId:Q.id,db:Z,MESH_REQUEST_CONTEXT:{},MESH_APP_DEPLOYMENT_ID:"public-registry",IS_LOCAL:!1};return await W.fetch(H,N,X)}}var z$4=3600000,j$4=500,_V$;var fV$=O(()=>{CV$();lD0();cv0();e5();_V$=ry({ttlMs:z$4,maxSize:j$4,updateRecencyOnGet:!0})});import{sql as A$4}from"kysely";import{randomUUID as xV$}from"crypto";import{z as T$4}from"zod";async function R$4($){let Z=new Date().toISOString(),G=xV$(),X=w4.SELF($.organizationId),Y="registry.publish_request.created",Q={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:G,organization_id:$.organizationId,type:"registry.publish_request.created",source:X,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(Q),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",X)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:xV$(),event_id:G,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await A$4`SELECT pg_notify('mesh_events', ${G})`.execute($.db)}catch{}}async function q$4($,Z){let X=(await $.selectFrom("organization").select(["id"]).where("id","=",Z).execute())[0];if(X?.id)return X.id;return(await $.selectFrom("organization").select(["id"]).where("slug","=",Z).execute())[0]?.id??null}async function M$4($,Z){let G=await $.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",Z).where("virtual_mcp_plugin_configs.plugin_id","=",VV).execute();for(let X of G){let Y=X.settings,Q=typeof Y==="string"?(()=>{try{return JSON.parse(Y)}catch{return{}}})():Y??{};if(Q.acceptPublishRequests===!0){let J=Q.rateLimitWindow==="minute"?"minute":"hour",W=Q.rateLimitMax,K=typeof W==="number"&&Number.isFinite(W)&&W>=1?Math.floor(W):yV$;return{acceptPublishRequests:!0,requireApiToken:Q.requireApiToken===!0,rateLimitEnabled:Q.rateLimitEnabled===void 0?vV$:Q.rateLimitEnabled===!0,rateLimitWindow:J,rateLimitMax:K}}}return{acceptPublishRequests:!1,requireApiToken:!1,rateLimitEnabled:vV$,rateLimitWindow:I$4,rateLimitMax:yV$}}async function k$4($,Z,G){let X=G==="minute"?60000:3600000,Y=new Date(Date.now()-X).toISOString(),Q=await $.selectFrom("private_registry_publish_request").select((J)=>J.fn.countAll().as("count")).where("organization_id","=",Z).where("created_at",">=",Y).executeTakeFirst();return Number(Q?.count??0)}async function S$4($,Z,G,X){let Y=await $.selectFrom("private_registry_item").select(["id","title"]).where("organization_id","=",Z).where((Q)=>Q.or([Q("id","=",G),Q("title","=",X)])).executeTakeFirst();return Y?{id:String(Y.id),title:String(Y.title)}:null}function gV$($){let{db:Z,db:G}=$,X=new kf(G),Y=new Sf(G);return async(Q)=>{let J=Q.req.param("orgRef")??Q.req.param("org");if(!J)return Q.json({error:"Organization not found"},404);let W=await q$4(Z,J);if(!W)return Q.json({error:"Organization not found"},404);let K=await M$4(Z,W);if(!K.acceptPublishRequests)return Q.json({error:"Publish requests are not enabled for this registry."},403);if(K.requireApiToken){let N=Q.req.header("Authorization"),B=N?.startsWith("Bearer ")?N.slice(7).trim():null;if(!B)return Q.json({error:"API key required. Use Authorization: Bearer <key>"},401);if(!await Y.validate(W,B))return Q.json({error:"Invalid API key"},401)}if(K.rateLimitEnabled){if(await k$4(G,W,K.rateLimitWindow)>=K.rateLimitMax)return Q.json({error:"Too many publish requests. Please try again later.",retryAfterSeconds:K.rateLimitWindow==="minute"?60:3600},429)}let U;try{U=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}let w=rL$.safeParse(U);if(!w.success)return Q.json({error:"Invalid publish request payload",details:T$4.treeifyError(w.error)},400);let F=await S$4(G,W,w.data.data.id,w.data.data.title);if(F)return Q.json({error:"A registry item with the same id or title already exists. Please use a different name/id.",conflict:F},409);let H=await X.createOrUpdate({organization_id:W,requested_id:w.data.data.id,title:w.data.data.title,description:w.data.data.description??null,_meta:w.data.data._meta,server:w.data.data.server,requester_name:w.data.requester?.name??null,requester_email:w.data.requester?.email??null});try{await R$4({db:Z,organizationId:W,request:H})}catch(N){console.warn("[private-registry] failed to emit publish-request event:",N)}return p1.capture({distinctId:w.data.requester?.email??`org:${W}`,event:"registry_publish_request_submitted",groups:{organization:W},properties:{organization_id:W,request_id:H.id,requested_id:H.requested_id,title:w.data.data.title,requester_email:w.data.requester?.email??null}}),Q.json({id:H.id,requested_id:H.requested_id,status:H.status},201)}}var vV$=!0,I$4="hour",yV$=100;var hV$=O(()=>{f4();$6();Oy();uv0();dv0();e5()});var cV$={};e8(cV$,{createPublishRequestHandler:()=>gV$,createPublicMCPHandler:()=>bV$});var uV$=O(()=>{fV$();hV$()});var Xn0={};e8(Xn0,{watchHandler:()=>nV$,getProxyDispatch:()=>b$4,createApp:()=>u$4});import{readFileSync as V$4}from"fs";import{PrometheusSerializer as C$4}from"@opentelemetry/exporter-prometheus";import{DBOS as Tt}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as y$4,oAuthProtectedResourceMetadata as g$4}from"better-auth/plugins";async function _$4($){let Z=$.connect(),G;try{G=await Promise.race([Z,lV$(dV$)])}catch{return Z.then((X)=>X.release(!0)).catch(()=>{}),!1}try{return await Promise.race([G.query("SELECT 1"),lV$(dV$)]),G.release(),!0}catch{return G.release(!0),!1}}function lV$($){return new Promise((Z,G)=>setTimeout(()=>G(Error("pg health-check timeout")),$))}function b$4(){if(!t11)throw Error("getProxyDispatch() called before createApp() or without NATS \u2014 proxy dispatch unavailable");return t11}async function f$4($,Z){let{items:G}=await $.storage.connections.list(Z,{where:{field:["connection_url"],operator:"like",value:`${dV1}%`},limit:1}),X=G[0];if(!X?.configuration_state)return null;return X.configuration_state.project_locator}function x$4($){let Z=new URLSearchParams;if($){let[G,X]=$.split("/");if(G)Z.set("workspace_hint",G);if(X)Z.set("project_hint",X)}else Z.set("auto_personal","true");return Z.set("force_new","true"),Z}async function u$4($={}){let Z=$.database??g6(),G=!1;YZ.stop().catch((d)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",d)});let X,Y,Q=new j11,J,W,K,U,w,F=null;if($.disableNats)J=P11(),X={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},Y=new Pn,W={start:async()=>{},broadcast:()=>{},publishControlFrame:()=>{},stop:async()=>{}},w=void 0,K={init:async()=>{},pump:(d)=>{(async()=>{let m=d.getReader();try{while(!0){let{done:C0}=await m.read();if(C0)break}}catch{}finally{m.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{F=bk$();let d=L1().natsCredsPath,m;if(d)try{m=V$4(d,"utf8")}catch(x1){console.error(`[app] failed to read NATS_CREDS at ${d}; connecting anonymously`,x1)}F.init(L1().natsUrls,m?{creds:m}:void 0);let C0=tv0()?new hf0({getJetStream:()=>F.getJetStream()}):null;C0?.init().catch(()=>{}),X=C0;let v0=new on0({getJetStream:()=>F.getJetStream()});v0.init().catch(()=>{}),Y=v0,J=P11({getConnection:()=>F.getConnection()}),W=new A11({getConnection:()=>F.getConnection()}),K=new R11({getConnection:()=>F.getConnection(),getJetStream:()=>F.getJetStream()}),U=HS$({getConnection:()=>F.getConnection()}),w=LS$({getConnection:()=>F.getConnection()});let r0=zS$({getConnection:()=>F.getConnection()}),s0=W;W={start:(x1)=>s0.start(x1),broadcast:(x1)=>s0.broadcast(x1),publishControlFrame:(x1,W8)=>{r0.publishControlFrame(x1,W8).catch((z4)=>{console.warn("[TunnelControl] publishControlFrame failed (non-critical):",z4)})},stop:()=>s0.stop()},qP$(F),F.onReady(()=>{C0?.init().catch((x1)=>{console.error("[McpListCache] Deferred init failed:",x1)}),v0.init().catch((x1)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",x1)}),J.start(),Cl1(()=>F.getConnection()),K.init().catch((x1)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",x1)})})}if(sy)await sy();cf0(X),an0(Y);let N={storage:new xf(Z.db),sseHub:YZ},B=new S11(N),E=new Ll(Z.db),D=new V11(E);D.start(),W.start((d)=>{v50(d),B.execute({type:"CANCEL",taskId:d}).catch((m)=>{console.error("[Decopilot] CancelBroadcast execute failed:",m)})}).catch((d)=>{console.error("[Decopilot] CancelBroadcast start failed:",d)}),F?.onReady(()=>{W.start().catch((d)=>{console.error("[CancelBroadcast] Deferred start failed:",d)})}),K.init().catch((d)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",d)}),sy=async()=>{await B.stopAll(),B.dispose(),D.dispose(),W.stop().catch(()=>{}),K.teardown(),X?.teardown(),Q.teardown(),J.teardown(),_l1(),Y.teardown(),cf0(null),an0(null)};let L=new y1;if(L.use("*",g_0({enabled:(d)=>Jb(d,"debug")==="1"})),L.use("*",WL0),L.use("/*",MC1({origin:(d)=>{if(d.includes("localhost")||d.includes("127.0.0.1"))return d;return d},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),L.use("*",async(d,m)=>{if(await m(),d.req.path.includes("/files/"))return;if(d.req.path.includes("/fs/")&&d.req.path.endsWith("/read"))return;d.header("X-Frame-Options","DENY"),d.header("Content-Security-Policy","frame-ancestors 'none'")}),!L1().noTui)L.use("*",uS$());L.use("*",async(d,m)=>{if(await m(),Gg(d.req.path))return;if(d.res.status>=500){let v0=await d.res.clone().text();console.error(`[5xx Response] ${d.req.method} ${d.req.path} - ${d.res.status}:`,v0)}}),L.get(gX.HEALTH,(d)=>{if(G)return d.json({status:"shutting_down"},503);return d.json({status:"ok"})}),L.get(gX.HEALTH_LIVE,(d)=>{return d.json({status:"ok"})}),L.get(gX.HEALTH_READY,async(d)=>{if(G)return d.json({status:"shutting_down"},503);let m={};if(m.postgres={status:await _$4(Z.pool)?"up":"down"},F)m.nats=F.isConnected()?{status:"up"}:{status:"down"};else m.nats={status:"down"};let C0=m.postgres.status==="up",v0=C0?200:503;return d.json({status:C0?"ready":"not_ready",services:m},v0)}),L.get(gX.METRICS,async(d)=>{try{let m=await FL0.collect(),C0=v$4.serialize(m.resourceMetrics);return d.text(C0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(m){return console.error("Failed to collect metrics:",m),d.text("# Error collecting metrics",500)}}),L.route("/api/config",Hk$),L.route("/api/auth/custom",pP$),L.all("/api/auth/*",async(d)=>{return await s6.handler(d.req.raw)});let z=Jo1();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",bV),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",bV),L.route("/",z),L.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",nm),L.route("/",wo1()),L.use("/oauth-proxy/:connectionId/*",bV),L.all("/oauth-proxy/:connectionId/*",mV$);let j=async(d)=>{let C0=await h$4()(d.req.raw),v0=await C0.json();return Response.json(v0,C0)};L.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",bV),L.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",j);let P=async(d)=>{let C0=await c$4()(d.req.raw),v0=await C0.json();return Response.json(v0,C0)};L.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",P);let A=AP$({ttlMs:120000}),M=await nr1({db:Z.db,auth:s6,encryption:{key:L1().encryptionKey},observability:{tracer:Rw,meter:y8},modelListCache:Q,providerKeyCache:J,memberRoleCache:A,linkStatusProbe:U,publishLinkControlFrame:(d,m)=>W.publishControlFrame(d,m)});uH.set(M);let S=new hO(L1().encryptionKey);xI1({db:Z.db,baseUrl:g3()});let q=P80(Z.db),V=new wl(Z.db),t=yS$({db:Z.db});in0({storage:q,meshContextFactory:t}),Tl0({meshContextFactory:t,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:YZ},prepareLinkWorkFn:vI$,workPublisher:w}),Ll0({dispatchRunFn:fI$,meshContextFactory:t,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:YZ}});let f=new xf(Z.db);c8$({getJetStream:()=>F?.getJetStream()??null,getJetStreamManager:async()=>{let d=F?.getConnection();return d?await iV$.jetstreamManager(d):null},messageParts:f.messageParts(),resolveRun:async(d)=>{let m=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",d).executeTakeFirst();return m?{orgId:m.organization_id,createdBy:m.created_by,version:m.message_storage_version??1,status:m.status,runFenceToken:m.run_fence_token,title:m.title??null}:null},completeRunIfNotCompleted:async(d,m)=>{let C0=await f.completeRunIfNotCompleted(d,m);return xD0(YZ,m,d,C0),C0},markRunRequiresAction:async(d,m)=>{let C0=await f.requiresActionIfInProgress(d,m);return xD0(YZ,m,d,C0),C0},markRunFailed:async(d,m,C0,v0)=>{let r0=await f.markRunFailed(d,m,C0,v0);return xD0(YZ,m,d,r0),r0},persistTitle:(d,m,C0)=>f.update(d,m,{title:C0}),onTitleUpdated:async({runId:d,orgId:m,title:C0})=>{let v0=await f.get(d,m).catch(()=>null);YZ.emit(m,zJ(d,v0?.status??"in_progress",{title:C0,virtualMcpId:v0?.virtual_mcp_id??void 0,createdBy:v0?.created_by,triggerId:v0?.trigger_id,branch:v0?.branch??null,createdAt:v0?.created_at,updatedAt:v0?.updated_at}))},bumpProgress:async({runId:d,orgId:m})=>{await f.bumpProgress(d,m)},recordCompleted:async({runId:d,orgId:m,distinctId:C0,usage:v0})=>{p1.capture({distinctId:C0,event:"chat_message_completed",groups:{organization:m},properties:{organization_id:m,thread_id:d,transport:"projector",input_tokens:v0.inputTokens,output_tokens:v0.outputTokens,total_tokens:v0.totalTokens}})},recordFailed:async({runId:d,orgId:m,distinctId:C0,reason:v0,kind:r0})=>{p1.capture({distinctId:C0,event:"chat_message_failed",groups:{organization:m},properties:{organization_id:m,thread_id:d,transport:"projector",error_category:r0,error_message:v0}})},purgeRun:async(d)=>{K.purge(d)}}),NQ$({meshContextFactory:t,systemDatabaseUrl:ab1(L1().databaseUrl,L1().databasePgSsl),streamBuffer:K}),xS$(),vI1();let v=async(d,m,C0)=>{let v0=await q.findById(d,m);if(!v0)throw Error("Automation not found");return tn0({automationId:v0.id,organizationId:v0.organization_id,triggerId:null})},e=new Sy(q,({automation:d,trigger:m,contextMessages:C0,idempotencyKey:v0})=>zn({automationId:d.id,organizationId:d.organization_id,triggerId:m.id,contextMessages:C0},{idempotencyKey:v0})),o=[uQ(),oV(),HK()];for(let d of o)gD0(d).then(()=>{}).catch((m)=>console.error("[monitoring] Retention cleanup failed:",m));let B0=()=>Z.db.deleteFrom("apikey").where("expiresAt","<",new Date).execute().then(()=>{}).catch((d)=>console.error("[auth] Expired API key cleanup failed:",d));B0(),setInterval(B0,86400000).unref(),L.use("*",async(d,m)=>{if(QL0(d.req.path))return m();let C0={measure:async(r0,s0)=>{eY(d,r0);try{return await s0()}finally{$Y(d,r0)}}},v0=await uH.create(d.req.raw,{timings:C0});v0.automationRunner=v,d.set("meshContext",v0);try{await m()}finally{let r0=v0.pendingRevalidations;if(r0.length>0)Promise.race([Promise.allSettled(r0),new Promise((x1)=>setTimeout(x1,30000))]).catch((x1)=>console.error("[mesh] revalidation cleanup error:",x1))}}),L.use("/api/:org/decopilot/*",fV),L.use("/api/:org/v1/*",fV),L.use("/api/:org/files/*",fV),L.use("*",async(d,m)=>{let C0=d.req.path;if(C0.startsWith("/api/org-sso/")||C0.startsWith("/api/auth/")||C0.startsWith("/api/tools/management")||C0.startsWith("/oauth-proxy/"))return m();let v0=d.get("meshContext");if(!v0?.organization?.id||!v0?.auth?.user?.id)return m();if(!(await v0.storage.orgSsoConfig.getByOrgId(v0.organization.id))?.enforced)return m();if(!await v0.storage.orgSsoSessions.isValid(v0.auth.user.id,v0.organization.id))return d.json({error:"SSO authentication required for this organization"},403);return m()});let O0=new y1;O0.use("*",vQ({mountPath:"/api/org-sso"})),O0.route("/",DE0()),L.route("/api/org-sso",O0),L.get("/api/tools/management",(d)=>{return d.json({tools:c_0,grouped:kO()})}),L.use("/mcp/*",async(d,m)=>{eY(d,"mcp");try{return await m()}finally{$Y(d,"mcp")}});let K0=async(d,m)=>{let C0=d.var.meshContext;if(!C0.auth.user?.id&&!C0.auth.apiKey?.id){let v0=new URL(d.req.url);return d.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${v0.origin}${v0.pathname}/.well-known/oauth-protected-resource"`}})}return await m()};if(L.use("/mcp/:connectionId?",K0),L.use("/mcp/gateway/:virtualMcpId?",K0),L.use("/mcp/virtual-mcp/:virtualMcpId?",K0),L.use("/mcp/self",K0),jJ()){let{mountDevRoutes:d}=(YV$(),rD0(XV$));d(L,K0)}let J0=new y1;J0.use("*",vQ({mountPath:"/mcp"})),J0.route("/",YN0()),L.route("/mcp",J0);let s=new y1;s.use("*",vQ({mountPath:"/mcp/self"})),s.route("/",ID0()),L.route("/mcp/self",s);let T0=new y1;T0.use("*",vQ({mountPath:"/mcp"})),T0.route("/",WN0()),L.route("/mcp",T0),L.use("/api/:org/models/*",async(d,m)=>{eY(d,"llm_models");try{return await m()}finally{$Y(d,"llm_models")}});let F0=Re0({cancelBroadcast:W,streamBuffer:K,runRegistry:B,linkStatusProbe:U});if(L.route("/api",F0),F!=null)t11=BS$({getConnection:()=>F?.getConnection()??null});L.route("/api",aM$()),L.get("/api/links/me",async(d)=>{try{let m=d.req.header("authorization")??"",C0=/^Bearer\s+(.+)$/i.exec(m),v0=null;if(C0){let s0=(C0[1]??"").trim();v0=await fM$(s0,s6.api)}else v0=d.get("meshContext")?.auth?.user?.id??null;if(!v0)return d.json({error:"unauthorized"},401);let r0=U?await U(v0):{online:!1,capabilities:[]};if(!r0.online)return d.json(null);return d.json({hostname:r0.hostname,cliVersion:r0.cliVersion})}catch(m){return console.error("[links/me] presence probe failed; reporting offline:",m instanceof Error?m.message:String(m)),d.json(null)}}),L.use("/api/:org/files/*",fV),L.route("/api",Ek$);let f0=new y1;f0.use("*",vQ({mountPath:"/api"})),f0.route("/",RD0()),L.route("/api",f0),L.route("/api",Uk$);let m0=new y1;m0.use("*",vQ({mountPath:"/api"})),m0.route("/",qD0({tokenStorage:V,automationEventDispatcher:e})),L.route("/api",m0);let x0=new Hl(Z.db),i0=new y1;i0.use("*",vQ({mountPath:"/api"})),i0.route("/",iE0()),L.route("/api",i0),L.route("/api/deco-sites",$R$()),L.route("/api/deco-apps",Xk$());let H0=new y1;H0.use("*",vQ({mountPath:"/api/deco-sites"})),H0.route("/",pE0()),L.route("/api/deco-sites",H0);let V0=new y1;V0.use("*",vQ({mountPath:"/api/vm-events"})),V0.route("/",Zk$()),L.route("/api/vm-events",V0);let{createPublishRequestHandler:R0,createPublicMCPHandler:w0}=await Promise.resolve().then(() => (uV$(),cV$)),Q0={db:Z.db,vault:{encrypt:(d)=>S.encrypt(d),decrypt:(d)=>S.decrypt(d)}},G0=R0(Q0),k0=w0(Q0);L.use("/org/:orgRef/registry/publish-request",bV),L.post("/org/:orgRef/registry/publish-request",G0),L.use("/org/:orgSlug/registry/*",bV),L.all("/org/:orgSlug/registry/*",k0),L.post("/api/:org/registry/publish-request",G0),L.all("/api/:org/registry/*",k0);let i=_M$({kvStorage:x0,runRegistry:B,streamBuffer:K,sseHub:YZ,cancelBroadcast:W,tokenStorage:V,automationEventDispatcher:e,mountDevAssets:jJ(),mcpAuth:K0,oauthProxyHandler:mV$,watchHandler:nV$,betterAuthProtectedResourceHandler:j,getNatsConnection:()=>F?.getConnection()??null});return L.route("/api/:org",i),L.notFound((d)=>{return d.json({error:"Not Found",path:d.req.path},404)}),L.onError(uI$),Object.assign(L,{markShuttingDown:()=>{G=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([YZ.stop(),sy?Promise.resolve(sy()).finally(()=>{sy=null}):Promise.resolve()]),F)await F.drain().catch((d)=>console.error("[shutdown] NATS drain error:",d));console.log("[shutdown] Flushing telemetry..."),await fY().catch((d)=>console.error("[shutdown] Telemetry flush error:",d)),console.log("[shutdown] Closing database..."),await eb1(Z).catch((d)=>console.error("[shutdown] Database close error:",d)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await Tt.registerQueue(cQ,{partitionQueue:!0,concurrency:dn0,minPollingIntervalMs:ln0}),await Tt.registerQueue(A3,{partitionQueue:!0,concurrency:Al0}),await Tt.registerQueue(Iw,{partitionQueue:!0,concurrency:Dl0}),await Tt.registerQueue(QB,{partitionQueue:!0,concurrency:HQ$}),await Se0(q),await Promise.allSettled(["automations-gate","automations-global"].map((d)=>Tt.deleteQueue(d))),await mn0(Z.pool),Ay1().catch((d)=>{console.error("[studio-pack-backfill] failed:",d)}),yI1().catch((d)=>{console.error("[org-fs] public-sets boot sync kick failed:",d)})}})}var iV$,dV$=5000,t11=null,sy=null,mV$=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let G=$.req.path.split("/").filter(Boolean),X=G[G.length-1],Y=$.get("meshContext");if(!Y)Y=await uH.create($.req.raw),$.set("meshContext",Y);let Q=$.req.param("org")?Y.organization?.id:void 0,J=await Y.storage.connections.findById(Z,Q);if(!J?.connection_url)return $.json({error:"Connection not found"},404);let W=await zx(J.connection_url),K,U=new URL(J.connection_url);if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=U.origin;let w=await pm(K);if(!w.ok)return $.json({error:"Failed to get auth server metadata"},502);let F=await w.json(),H;if(X==="authorize")H=F.authorization_endpoint;else if(X==="token")H=F.token_endpoint;else if(X==="register")H=F.registration_endpoint;if(!H)return $.json({error:`Unknown OAuth endpoint: ${X}`},404);let N=new URL(H),B=new URL($.req.url);if(N.search=B.search,X==="authorize"){let q=N.searchParams.get("redirect_uri");if(q){let V=L1().baseUrl??B.origin;try{let t=new URL(q),f=new URL(V);if(!(t.origin===f.origin||t.hostname==="localhost"))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}N.searchParams.set("redirect_uri",q)}if(N.searchParams.has("resource"))N.searchParams.set("resource",J.connection_url);if(lV1(J.connection_url))try{let V=await f$4(Y,J.organization_id),t=x$4(V);for(let[f,v]of t)N.searchParams.set(f,v)}catch(V){console.warn("[oauth-proxy] Failed to get smart OAuth params, proceeding without:",V)}return $.redirect(N.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},D=$.req.header("Content-Type");if(D)E["Content-Type"]=D;let L=$.req.header("Authorization");if(L)E.Authorization=L;let z,j=null,P=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(X==="token"&&D?.includes("application/x-www-form-urlencoded")){if(L?.toLowerCase().startsWith("basic "))try{let v=atob(L.slice(6).trim()),e=v.indexOf(":");if(e!==-1){let o=decodeURIComponent(v.slice(0,e)),B0=decodeURIComponent(v.slice(e+1));j=o||null,P=B0||null}}catch{}let q=await $.req.formData();if(q.has("resource"))q.set("resource",J.connection_url);let V=q.get("client_id"),t=q.get("client_secret");if(typeof V==="string"&&V)j=V;if(typeof t==="string"&&t)P=t;let f=new URLSearchParams;for(let[v,e]of q.entries())f.append(v,e.toString());z=f.toString()}else if(X==="register"&&D?.toLowerCase().includes("application/json")){let q=await Y.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",J.organization_id).executeTakeFirst(),V=await $.req.text(),t={};try{t=V?JSON.parse(V):{}}catch{z=V}let f=typeof t==="object"&&t!==null&&!Array.isArray(t);if(z===void 0&&!f)z=V;if(z===void 0){let v=t,e=v.metadata&&typeof v.metadata==="object"?v.metadata:{};v.metadata={...e,organization_id:J.organization_id,...q?.slug?{organization_slug:q.slug}:{},...q?.name?{organization_name:q.name}:{}},z=JSON.stringify(v),E["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let A=await fetch(N.toString(),{method:$.req.method,headers:E,body:z,duplex:"half",redirect:"manual"}),M=new Headers,S=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[q,V]of A.headers.entries())if(!S.includes(q.toLowerCase()))M.set(q,V);if(X==="token"&&A.ok){let q=await A.text();try{let V=JSON.parse(q);if(typeof V.access_token==="string"&&V.access_token){let t=typeof V.expires_in==="number"?new Date(Date.now()+V.expires_in*1000):null,f=null;try{f=await jx(J.connection_url)??H}catch{f=H}let v={connectionId:Z,accessToken:V.access_token,refreshToken:typeof V.refresh_token==="string"?V.refresh_token:null,scope:typeof V.scope==="string"?V.scope:null,expiresAt:t,clientId:j,clientSecret:P,tokenEndpoint:f};await new V5(Y.db,Y.vault).upsert(v)}}catch(V){console.error("[oauth-proxy] failed to persist downstream token:",V)}return new Response(q,{status:A.status,statusText:A.statusText,headers:M})}return new Response(A.body,{status:A.status,statusText:A.statusText,headers:M})},nV$=async($)=>{let Z=$.var.meshContext;if(!(Z.auth.user?.id??Z.auth.apiKey?.userId))return $.json({error:"Unauthorized"},401);let X=Z.organization?.id;if(!X)return $.json({error:"organization id missing"},400);let Y=$.req.query("types"),Q=Y?Y.split(",").map((W)=>W.trim()).filter(Boolean):null,J=crypto.randomUUID();return yQ($,async(W)=>{if(await W.writeSSE({event:"connected",data:JSON.stringify({listenerId:J,organizationId:X,typePatterns:Q,connectedAt:new Date().toISOString()})}),!YZ.add({id:J,organizationId:X,typePatterns:Q?.length?Q:null,push:(w)=>{W.writeSSE({id:w.id,event:w.type,data:JSON.stringify(w)}).catch(()=>{YZ.remove(X,J)})}})){await W.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{W.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U)})},30000);await new Promise((w)=>{W.onAbort(()=>{clearInterval(U),YZ.remove(X,J),w()})})})},v$4,h$4=()=>g$4(s6),c$4=()=>y$4(s6);var Yn0=O(()=>{q8();gI1();i7();Xb();$6();d6();B10();kC1();h_0();_U();im();js0();AJ();I5();f4();Ms0();Cs0();hI$();qe0();iJ();w40();Me0();dI$();ke0();bM$();sM$();Gk$();be0();Yk$();QN0();tm();wk$();KN0();Z11();Nk$();Dk$();$11();e01();ft();e10();fk$();XY();h80();Bl();en0();xk$();yk$();lk$();NS$();OS$();jS$();CS$();_S$();Wy0();Hy0();vS$();w$0();C11();yX();Ve0();xi();Ol0();w$0();Ae0();Cv0();_v0();gS$();Wb();dS$();lV();js0();Lv();y50();iV$=k(jB(),1);v$4=new C$4});var oV$={};e8(oV$,{resolveClientDir:()=>t$4,resolveAssetPathWithTraversalCheck:()=>rV$,isPathWithinDirectory:()=>tV$,createAssetHandler:()=>r$4});import{resolve as It,dirname as d$4,join as l$4,extname as m$4,basename as i$4,sep as pV$}from"path";function n$4($,Z){if($===Z||i$4($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${pV$}assets${pV$}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function tV$($,Z){let G=It(Z),X=It($);return X===G||X.startsWith(G+"/")}function rV$({requestPath:$,clientDir:Z}){let G=$.startsWith("/")?$.slice(1):$,X=It(Z,G);if(!tV$(X,Z))return null;return X}function t$4($,Z="../client"){let G=new URL($),X=d$4(G.pathname);return It(X,Z)}function r$4($={}){let{env:Z="production",clientDir:G=p$4,isServerPath:X=()=>!1}=$;if(Z==="development")return async function(Q){return null};return async function(Q){if(Q.method!=="GET")return null;let J=new URL(Q.url),W;try{W=decodeURIComponent(J.pathname)}catch{return null}if(X(W))return null;let K=rV$({requestPath:W,clientDir:G});if(!K)return null;let U=l$4(K,"index.html"),w=It(G,"index.html"),F=Q.headers.get("accept"),N=F?.includes("text/html")||F?.includes("*/*")&&["",".html"].includes(m$4(K))?[U,w]:[];for(let B of[K,...N])try{let E=Bun.file(B);if(await E.exists())return new Response(E,{headers:n$4(B,w)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var p$4="./dist/client";var aV$=()=>{};var sV$={};e8(sV$,{tryUpgradePreviewWs:()=>G84,tryHandlePreviewHttp:()=>Z84,previewWebSocketHandler:()=>X84,parsePreviewBaseDomain:()=>$84,isPreviewWsData:()=>mD0,extractHandleFromHost:()=>r11});function s$4($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function e$4(){return new Response(a$4,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function $84($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,G;try{G=new URL(Z)}catch{return null}let X=G.hostname;if($.includes("{handle}")){let Y=X.indexOf(".");if(Y<=0||Y===X.length-1)return null;return X.slice(Y+1)}return X}function r11($,Z){if(!$||!Z)return null;let G=$.indexOf(":"),X=(G>=0?$.slice(0,G):$).toLowerCase(),Q=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!X.endsWith(Q))return null;let J=X.slice(0,X.length-Q.length);if(!J||J.includes("."))return null;return J}async function Z84($,Z){let G=r11($.headers.get("host"),Z.baseDomain);if(!G)return null;let X=await Z.getRunner();if(!X)return qt(503,"preview proxy not configured");let Y=await X.proxyPreviewRequest(G,$);if(Y.headers.get(pS)&&s$4($))return e$4();return Y.headers.delete(pS),Y}function qt($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function mD0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function G84($,Z,G){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let X=r11($.headers.get("host"),G.baseDomain);if(!X)return null;let Y=await G.getRunner();if(!Y)return qt(503,"preview proxy not configured");let Q=await Y.resolvePreviewUpstreamUrl(X);if(!Q)return qt(404,"sandbox not found");let J=new URL($.url);if(J.pathname.startsWith("/_sandbox")||J.pathname.startsWith("/_decopilot_vm"))return qt(404,"not found");let W=`${Q.replace(/^http/,"ws")}${J.pathname}${J.search}`,K=$.headers.get("sec-websocket-protocol"),U=K?K.split(",").map((H)=>H.trim()).filter(Boolean):[],w={kind:"preview",upstreamUrl:W,upstreamProtocols:U,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:w}))return qt(426,"upgrade failed");return}function Rt($,Z,G,X){if(Z.closed)return;Z.closed=!0;try{$.close(G,X)}catch{}try{Z.upstream?.close()}catch{}}var o$4=256,a$4='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',X84;var eV$=O(()=>{ei0();X84={open($){let Z=$.data;if(!mD0(Z))return;let G;try{G=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(X){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${X instanceof Error?X.message:String(X)}`),Rt($,Z,1011,"upstream connect failed");return}G.binaryType="arraybuffer",Z.upstream=G,G.addEventListener("open",()=>{while(Z.pending.length>0){let X=Z.pending.shift();if(X!==void 0)G.send(X)}}),G.addEventListener("message",(X)=>{if(Z.closed)return;$.send(X.data)}),G.addEventListener("close",(X)=>{Rt($,Z,X.code||1000,X.reason||"")}),G.addEventListener("error",()=>{Rt($,Z,1011,"upstream error")})},message($,Z){let G=$.data;if(!mD0(G))return;let X=G.upstream;if(X&&X.readyState===WebSocket.OPEN){X.send(Z);return}if(G.pending.length>=o$4){Rt($,G,1011,"preview ws backlog overflow");return}G.pending.push(Z)},close($){let Z=$.data;if(!mD0(Z))return;Rt($,Z,1000,"")}}});var XC$={};e8(XC$,{printBanner:()=>Q84,bannerLines:()=>GC$,BANNER_LINES:()=>$C$,BANNER_GRADIENT:()=>ZC$});function Y84($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function GC$($){let Z=$C$.map((G,X)=>{let[Y,Q,J]=Y84(ZC$[X]);return`\x1B[38;2;${Y};${Q};${J}m${G}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function Q84($){console.log("");for(let Z of GC$($))console.log(Z);console.log("")}var $C$,ZC$;var YC$=O(()=>{$C$=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],ZC$=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});var JC$={};e8(JC$,{bootstrapDevLinkSession:()=>B84});import{existsSync as J84}from"fs";import{chmod as W84,mkdir as K84,rename as U84,writeFile as w84}from"fs/promises";import{dirname as F84,join as QC$}from"path";function H84($){return QC$($,"dev-link")}function N84($){let Z=process.env.DEV_LINK_SESSION_PATH;if(Z&&Z.trim()!=="")return Z;return QC$(H84($),"session.json")}async function B84($,Z){let G=N84($),X=g6().db,Y=qQ()?await On():await X.selectFrom("user").select(["id","email","name"]).orderBy("createdAt","desc").executeTakeFirst();if(!Y?.id)return null;if(J84(G))try{let U=await Bun.file(G).json(),w=U.user?.sub,F=U.accessToken;if(w===Y.id&&typeof F==="string"){if(await s6.api.verifyApiKey({body:{key:F}}).then((N)=>N?.valid===!0).catch(()=>!1))return{path:G,userSub:w}}}catch{}let Q=null;try{Q=await s6.api.createApiKey({body:{name:"dev-link (auto-minted by bun run dev)",userId:Y.id,permissions:{"*":["*"]},expiresIn:2592000,rateLimitEnabled:!1}})}catch(K){return console.warn("[dev-link] failed to mint API key:",K instanceof Error?K.message:String(K)),null}if(!Q?.key)return null;let J={target:Z,clientId:"dev-link",user:{sub:Y.id,...Y.email?{email:Y.email}:{},...Y.name?{name:Y.name}:{}},accessToken:Q.key,createdAt:new Date().toISOString()};await K84(F84(G),{recursive:!0});let W=`${G}.tmp`;return await w84(W,JSON.stringify(J,null,2),{mode:384}),await W84(W,384),await U84(W,G),{path:G,userSub:Y.id}}var WC$=O(()=>{AJ();_U();RN()});x7();var Y$1="3";function Q$1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:Y$1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}q8();I5();function j_$(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function OL0($,Z){for(let G=0;G<$.length;G++){let X=$[G];if(X===void 0)continue;if(X===Z)return $[G+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function c$1(){let $=j_$();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:OL0($,"--cpu-prof-dir")??process.cwd(),name:OL0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(OL0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}LL0();var yt;function r$1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let G=WB();if(!G)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),Q=Y(),J=Object.entries(Q.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);X={objectCount:Q.objectCount,heapSize:Q.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:G.rss,heapUsed:G.heapUsed,heapTotal:G.heapTotal,external:G.external,arrayBuffers:G.arrayBuffers,...X}))};return Z().catch(()=>{}),yt=setInterval(()=>void Z().catch(()=>{}),$),yt.unref?.(),process.on("SIGUSR2",()=>{try{let G=Bun.generateHeapSnapshot("v8"),X=typeof G==="string"?G:JSON.stringify(G),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(G){console.error("[heap-watch] snapshot failed:",G)}}),()=>{if(yt)clearInterval(yt)}}import*as T_$ from"bun:jsc";var{startSamplingProfiler:I_$,samplingProfilerStackTraces:R_$}=T_$;function o$1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{I_$()}catch(Q){return console.error("[stall-watchdog] failed to start sampling profiler:",Q),()=>{}}let G,X=performance.now()+Z,Y=()=>{let Q=performance.now(),J=Q-X;X=Q+Z;let W=[];try{W=R_$()?.traces??[]}catch{}if(J>$&&W.length>0){let K=new Map;for(let w of W){let F=w.frames.find((B)=>B.sourceURL&&!/Unknown Executable/.test(B.category??""))??w.frames[0];if(!F)continue;let H=(F.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),N=`${F.name??"?"} @ ${H}:${F.line??"?"}`;K.set(N,(K.get(N)??0)+1)}let U=[...K.entries()].sort((w,F)=>F[1]-w[1]).slice(0,8).map(([w,F])=>({frame:w,count:F}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:W.length,top:U}))}G=setTimeout(Y,Z),G.unref?.()};return G=setTimeout(Y,Z),G.unref?.(),()=>{if(G)clearTimeout(G)}}function a$1(){c$1();let $=[r$1(),t$1(),o$1()];return()=>{for(let Z of $)Z()}}import{existsSync as A84}from"fs";var bY=L1();g$1();var{DBOS:Mt,DBOSClient:O84}=await import("@dbos-inc/dbos-sdk");function HC$($,Z){if(!Z)return $;let G=new URL($);if(!G.searchParams.has("sslmode"))G.searchParams.set("sslmode","verify-full");return G.toString()}var E84=[cQ,A3,Iw,QB],D84=bY.dispatchRole==="worker"?E84:bY.dispatchRole==="api"?[]:void 0;Mt.setConfig(Q$1({systemDatabaseUrl:HC$(bY.databaseUrl,bY.databasePgSsl),poolSize:Number(process.env.DBOS_POOL_SIZE??5),executorID:bY.podName,listenQueues:D84}));var{createApp:L84}=await Promise.resolve().then(() => (Yn0(),Xn0)),{isServerPath:z84}=await Promise.resolve().then(() => (ft(),P$1)),{createAssetHandler:j84,resolveClientDir:NC$}=await Promise.resolve().then(() => (aV$(),oV$)),P84=bY.port,KC$=NC$(import.meta.url,"../client"),T84=A84(KC$)?KC$:NC$(import.meta.url,"../dist/client"),I84=j84({clientDir:T84,isServerPath:z84}),R84={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function q84($){let Z=new Headers($.headers);for(let[G,X]of Object.entries(R84))Z.set(G,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:M84,tryHandlePreviewHttp:k84,tryUpgradePreviewWs:S84,previewWebSocketHandler:o11,isPreviewWsData:a11}=await Promise.resolve().then(() => (eV$(),sV$)),{getOrInitSharedRunner:V84}=await Promise.resolve().then(() => (wn(),HY$)),BC$=M84(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),UC$={baseDomain:BC$??"",getRunner:V84},iD0=await L84(),s11=process.env.DBOS_CONDUCTOR_KEY?.trim(),wC$=process.env.DBOS_CONDUCTOR_URL?.trim();await Mt.launch({...s11?{conductorKey:s11}:{},...s11&&wC$?{conductorURL:wC$}:{}});console.log(`[dbos] application version: ${Mt.applicationVersion}`);await iD0.initDbos();if(!bY.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (YC$(),XC$));console.log("");for(let Z of $())console.log(Z)}var C84=Bun.serve({idleTimeout:0,port:P84,hostname:"0.0.0.0",fetch:async($,Z)=>{if(BC$){let X=await S84($,Z,UC$);if(X===void 0)return;if(X)return X;let Y=await k84($,UC$);if(Y)return Y}let G=await I84($);if(G)return q84(G);return iD0.fetch($,{server:Z})},websocket:{open($){if(a11($.data))o11.open($)},message($,Z){if(a11($.data))o11.message($,Z)},close($){if(a11($.data))o11.close($)}},development:!1}),_84=a$1();if(bY.localMode)Promise.resolve().then(() => (RN(),gH0)).then(async({seedLocalMode:$,markSeedComplete:Z})=>{try{let G=await $();if(process.env.DEV_LINK_SESSION_PATH)try{let{bootstrapDevLinkSession:X}=await Promise.resolve().then(() => (WC$(),JC$)),Y=bY.baseUrl??`http://localhost:${bY.port}`,Q=await X(bY.dataDir,Y);if(Q)console.log(`[dev-link] session ready at ${Q.path} (userSub=${Q.userSub})`);else console.warn("[dev-link] no admin user yet \u2014 skipping session bootstrap. The auto-spawned link will refuse to start until an admin exists.")}catch(X){console.error("[dev-link] bootstrap failed:",X)}}catch(G){console.error("Failed to seed local mode:",G)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (RN(),gH0));Z()}catch{}});var FC$=!1;async function b84($){let Z;try{Z=await O84.create({systemDatabaseUrl:HC$(bY.databaseUrl,bY.databasePgSsl),systemDatabaseSchemaName:"dbos"});let G=await Z.listWorkflows({status:"PENDING",queueName:A3,executorId:$,loadInput:!1,loadOutput:!1});if(G.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let X=G.map((Y)=>Y.workflowID);await Z.resumeWorkflows(X,{queueName:A3}),console.log(`[shutdown] re-enqueued ${X.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,X)}catch(G){console.error("[shutdown] thread-gate handoff failed:",G)}finally{await Z?.destroy().catch(()=>{})}}async function nD0($){if(FC$)return;FC$=!0,console.log(`
+`;return new TextEncoder().encode(X)}var F11,mV,qe6,uM$,w11="ABCDEFGHIJKLMNOPQRSTUVWXYZ234567",ke6,h$,g$,a8,cM$=24,iV,z3;var tM$=O(()=>{(function($){$.Operator="operator",$.Account="account",$.User="user",$.Activation="activation",$.AuthorizationResponse="authorization_response"})(F11||(F11={}));(function($){var Z=function(g,l){this.hi=g|0,this.lo=l|0},G=function(g){var l,h=new Float64Array(16);if(g)for(l=0;l<g.length;l++)h[l]=g[l];return h},X=function(){throw Error("no PRNG")},Y=new Uint8Array(16),Q=new Uint8Array(32);Q[0]=9;var J=G(),W=G([1]),K=G([56129,1]),U=G([30883,4953,19914,30187,55467,16705,2637,112,59544,30585,16505,36039,65139,11119,27886,20995]),w=G([61785,9906,39828,60374,45398,33411,5274,224,53552,61171,33010,6542,64743,22239,55772,9222]),F=G([54554,36645,11616,51542,42930,38181,51040,26924,56412,64982,57905,49316,21502,52590,14035,8553]),H=G([26200,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214,26214]),N=G([41136,18958,6951,50414,58488,44335,6150,12099,55207,15867,153,11085,57099,20417,9344,11139]);function B(g,l){return g<<l|g>>>32-l}function E(g,l){var h=g[l+3]&255;return h=h<<8|g[l+2]&255,h=h<<8|g[l+1]&255,h<<8|g[l+0]&255}function D(g,l){var h=g[l]<<24|g[l+1]<<16|g[l+2]<<8|g[l+3],r=g[l+4]<<24|g[l+5]<<16|g[l+6]<<8|g[l+7];return new Z(h,r)}function L(g,l,h){var r;for(r=0;r<4;r++)g[l+r]=h&255,h>>>=8}function z(g,l,h){g[l]=h.hi>>24&255,g[l+1]=h.hi>>16&255,g[l+2]=h.hi>>8&255,g[l+3]=h.hi&255,g[l+4]=h.lo>>24&255,g[l+5]=h.lo>>16&255,g[l+6]=h.lo>>8&255,g[l+7]=h.lo&255}function j(g,l,h,r,Y0){var W0,b0=0;for(W0=0;W0<Y0;W0++)b0|=g[l+W0]^h[r+W0];return(1&b0-1>>>8)-1}function P(g,l,h,r){return j(g,l,h,r,16)}function A(g,l,h,r){return j(g,l,h,r,32)}function M(g,l,h,r,Y0){var W0=new Uint32Array(16),b0=new Uint32Array(16),l0=new Uint32Array(16),P0=new Uint32Array(4),M0,j0,g0;for(M0=0;M0<4;M0++)b0[5*M0]=E(r,4*M0),b0[1+M0]=E(h,4*M0),b0[6+M0]=E(l,4*M0),b0[11+M0]=E(h,16+4*M0);for(M0=0;M0<16;M0++)l0[M0]=b0[M0];for(M0=0;M0<20;M0++){for(j0=0;j0<4;j0++){for(g0=0;g0<4;g0++)P0[g0]=b0[(5*j0+4*g0)%16];P0[1]^=B(P0[0]+P0[3]|0,7),P0[2]^=B(P0[1]+P0[0]|0,9),P0[3]^=B(P0[2]+P0[1]|0,13),P0[0]^=B(P0[3]+P0[2]|0,18);for(g0=0;g0<4;g0++)W0[4*j0+(j0+g0)%4]=P0[g0]}for(g0=0;g0<16;g0++)b0[g0]=W0[g0]}if(Y0){for(M0=0;M0<16;M0++)b0[M0]=b0[M0]+l0[M0]|0;for(M0=0;M0<4;M0++)b0[5*M0]=b0[5*M0]-E(r,4*M0)|0,b0[6+M0]=b0[6+M0]-E(l,4*M0)|0;for(M0=0;M0<4;M0++)L(g,4*M0,b0[5*M0]),L(g,16+4*M0,b0[6+M0])}else for(M0=0;M0<16;M0++)L(g,4*M0,b0[M0]+l0[M0]|0)}function S(g,l,h,r){return M(g,l,h,r,!1),0}function q(g,l,h,r){return M(g,l,h,r,!0),0}var V=new Uint8Array([101,120,112,97,110,100,32,51,50,45,98,121,116,101,32,107]);function t(g,l,h,r,Y0,W0,b0){var l0=new Uint8Array(16),P0=new Uint8Array(64),M0,j0;if(!Y0)return 0;for(j0=0;j0<16;j0++)l0[j0]=0;for(j0=0;j0<8;j0++)l0[j0]=W0[j0];while(Y0>=64){S(P0,l0,b0,V);for(j0=0;j0<64;j0++)g[l+j0]=(h?h[r+j0]:0)^P0[j0];M0=1;for(j0=8;j0<16;j0++)M0=M0+(l0[j0]&255)|0,l0[j0]=M0&255,M0>>>=8;if(Y0-=64,l+=64,h)r+=64}if(Y0>0){S(P0,l0,b0,V);for(j0=0;j0<Y0;j0++)g[l+j0]=(h?h[r+j0]:0)^P0[j0]}return 0}function f(g,l,h,r,Y0){return t(g,l,null,0,h,r,Y0)}function v(g,l,h,r,Y0){var W0=new Uint8Array(32);return q(W0,r,Y0,V),f(g,l,h,r.subarray(16),W0)}function e(g,l,h,r,Y0,W0,b0){var l0=new Uint8Array(32);return q(l0,W0,b0,V),t(g,l,h,r,Y0,W0.subarray(16),l0)}function o(g,l){var h,r=0;for(h=0;h<17;h++)r=r+(g[h]+l[h]|0)|0,g[h]=r&255,r>>>=8}var B0=new Uint32Array([5,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,252]);function O0(g,l,h,r,Y0,W0){var b0,l0,P0,M0,j0=new Uint32Array(17),g0=new Uint32Array(17),o0=new Uint32Array(17),Z1=new Uint32Array(17),K1=new Uint32Array(17);for(P0=0;P0<17;P0++)g0[P0]=o0[P0]=0;for(P0=0;P0<16;P0++)g0[P0]=W0[P0];g0[3]&=15,g0[4]&=252,g0[7]&=15,g0[8]&=252,g0[11]&=15,g0[12]&=252,g0[15]&=15;while(Y0>0){for(P0=0;P0<17;P0++)Z1[P0]=0;for(P0=0;P0<16&&P0<Y0;++P0)Z1[P0]=h[r+P0];Z1[P0]=1,r+=P0,Y0-=P0,o(o0,Z1);for(l0=0;l0<17;l0++){j0[l0]=0;for(P0=0;P0<17;P0++)j0[l0]=j0[l0]+o0[P0]*(P0<=l0?g0[l0-P0]:320*g0[l0+17-P0]|0)|0|0}for(l0=0;l0<17;l0++)o0[l0]=j0[l0];M0=0;for(P0=0;P0<16;P0++)M0=M0+o0[P0]|0,o0[P0]=M0&255,M0>>>=8;M0=M0+o0[16]|0,o0[16]=M0&3,M0=5*(M0>>>2)|0;for(P0=0;P0<16;P0++)M0=M0+o0[P0]|0,o0[P0]=M0&255,M0>>>=8;M0=M0+o0[16]|0,o0[16]=M0}for(P0=0;P0<17;P0++)K1[P0]=o0[P0];o(o0,B0),b0=-(o0[16]>>>7)|0;for(P0=0;P0<17;P0++)o0[P0]^=b0&(K1[P0]^o0[P0]);for(P0=0;P0<16;P0++)Z1[P0]=W0[P0+16];Z1[16]=0,o(o0,Z1);for(P0=0;P0<16;P0++)g[l+P0]=o0[P0];return 0}function K0(g,l,h,r,Y0,W0){var b0=new Uint8Array(16);return O0(b0,0,h,r,Y0,W0),P(g,l,b0,0)}function J0(g,l,h,r,Y0){var W0;if(h<32)return-1;e(g,0,l,0,h,r,Y0),O0(g,16,g,32,h-32,g);for(W0=0;W0<16;W0++)g[W0]=0;return 0}function s(g,l,h,r,Y0){var W0,b0=new Uint8Array(32);if(h<32)return-1;if(v(b0,0,32,r,Y0),K0(l,16,l,32,h-32,b0)!==0)return-1;e(g,0,l,0,h,r,Y0);for(W0=0;W0<32;W0++)g[W0]=0;return 0}function T0(g,l){var h;for(h=0;h<16;h++)g[h]=l[h]|0}function F0(g){var l,h;for(h=0;h<16;h++)g[h]+=65536,l=Math.floor(g[h]/65536),g[(h+1)*(h<15?1:0)]+=l-1+37*(l-1)*(h===15?1:0),g[h]-=l*65536}function f0(g,l,h){var r,Y0=~(h-1);for(var W0=0;W0<16;W0++)r=Y0&(g[W0]^l[W0]),g[W0]^=r,l[W0]^=r}function m0(g,l){var h,r,Y0,W0=G(),b0=G();for(h=0;h<16;h++)b0[h]=l[h];F0(b0),F0(b0),F0(b0);for(r=0;r<2;r++){W0[0]=b0[0]-65517;for(h=1;h<15;h++)W0[h]=b0[h]-65535-(W0[h-1]>>16&1),W0[h-1]&=65535;W0[15]=b0[15]-32767-(W0[14]>>16&1),Y0=W0[15]>>16&1,W0[14]&=65535,f0(b0,W0,1-Y0)}for(h=0;h<16;h++)g[2*h]=b0[h]&255,g[2*h+1]=b0[h]>>8}function x0(g,l){var h=new Uint8Array(32),r=new Uint8Array(32);return m0(h,g),m0(r,l),A(h,0,r,0)}function i0(g){var l=new Uint8Array(32);return m0(l,g),l[0]&1}function H0(g,l){var h;for(h=0;h<16;h++)g[h]=l[2*h]+(l[2*h+1]<<8);g[15]&=32767}function V0(g,l,h){var r;for(r=0;r<16;r++)g[r]=l[r]+h[r]|0}function R0(g,l,h){var r;for(r=0;r<16;r++)g[r]=l[r]-h[r]|0}function w0(g,l,h){var r,Y0,W0=new Float64Array(31);for(r=0;r<31;r++)W0[r]=0;for(r=0;r<16;r++)for(Y0=0;Y0<16;Y0++)W0[r+Y0]+=l[r]*h[Y0];for(r=0;r<15;r++)W0[r]+=38*W0[r+16];for(r=0;r<16;r++)g[r]=W0[r];F0(g),F0(g)}function Q0(g,l){w0(g,l,l)}function G0(g,l){var h=G(),r;for(r=0;r<16;r++)h[r]=l[r];for(r=253;r>=0;r--)if(Q0(h,h),r!==2&&r!==4)w0(h,h,l);for(r=0;r<16;r++)g[r]=h[r]}function k0(g,l){var h=G(),r;for(r=0;r<16;r++)h[r]=l[r];for(r=250;r>=0;r--)if(Q0(h,h),r!==1)w0(h,h,l);for(r=0;r<16;r++)g[r]=h[r]}function i(g,l,h){var r=new Uint8Array(32),Y0=new Float64Array(80),W0,b0,l0=G(),P0=G(),M0=G(),j0=G(),g0=G(),o0=G();for(b0=0;b0<31;b0++)r[b0]=l[b0];r[31]=l[31]&127|64,r[0]&=248,H0(Y0,h);for(b0=0;b0<16;b0++)P0[b0]=Y0[b0],j0[b0]=l0[b0]=M0[b0]=0;l0[0]=j0[0]=1;for(b0=254;b0>=0;--b0)W0=r[b0>>>3]>>>(b0&7)&1,f0(l0,P0,W0),f0(M0,j0,W0),V0(g0,l0,M0),R0(l0,l0,M0),V0(M0,P0,j0),R0(P0,P0,j0),Q0(j0,g0),Q0(o0,l0),w0(l0,M0,l0),w0(M0,P0,g0),V0(g0,l0,M0),R0(l0,l0,M0),Q0(P0,l0),R0(M0,j0,o0),w0(l0,M0,K),V0(l0,l0,j0),w0(M0,M0,l0),w0(l0,j0,o0),w0(j0,P0,Y0),Q0(P0,g0),f0(l0,P0,W0),f0(M0,j0,W0);for(b0=0;b0<16;b0++)Y0[b0+16]=l0[b0],Y0[b0+32]=M0[b0],Y0[b0+48]=P0[b0],Y0[b0+64]=j0[b0];var Z1=Y0.subarray(32),K1=Y0.subarray(16);return G0(Z1,Z1),w0(K1,K1,Z1),m0(g,K1),0}function $0(g,l){return i(g,l,Q)}function p0(g,l){return X(l,32),$0(g,l)}function I0(g,l,h){var r=new Uint8Array(32);return i(r,h,l),q(g,Y,r,V)}var d=J0,m=s;function C0(g,l,h,r,Y0,W0){var b0=new Uint8Array(32);return I0(b0,Y0,W0),d(g,l,h,r,b0)}function v0(g,l,h,r,Y0,W0){var b0=new Uint8Array(32);return I0(b0,Y0,W0),m(g,l,h,r,b0)}function r0(){var g=0,l=0,h=0,r=0,Y0=65535,W0,b0,l0;for(l0=0;l0<arguments.length;l0++)W0=arguments[l0].lo,b0=arguments[l0].hi,g+=W0&Y0,l+=W0>>>16,h+=b0&Y0,r+=b0>>>16;return l+=g>>>16,h+=l>>>16,r+=h>>>16,new Z(h&Y0|r<<16,g&Y0|l<<16)}function s0(g,l){return new Z(g.hi>>>l,g.lo>>>l|g.hi<<32-l)}function x1(){var g=0,l=0,h;for(h=0;h<arguments.length;h++)g^=arguments[h].lo,l^=arguments[h].hi;return new Z(l,g)}function W8(g,l){var h,r,Y0=32-l;if(l<32)h=g.hi>>>l|g.lo<<Y0,r=g.lo>>>l|g.hi<<Y0;else if(l<64)h=g.lo>>>l|g.hi<<Y0,r=g.hi>>>l|g.lo<<Y0;return new Z(h,r)}function z4(g,l,h){var r=g.hi&l.hi^~g.hi&h.hi,Y0=g.lo&l.lo^~g.lo&h.lo;return new Z(r,Y0)}function l4(g,l,h){var r=g.hi&l.hi^g.hi&h.hi^l.hi&h.hi,Y0=g.lo&l.lo^g.lo&h.lo^l.lo&h.lo;return new Z(r,Y0)}function F5(g){return x1(W8(g,28),W8(g,34),W8(g,39))}function Z0(g){return x1(W8(g,14),W8(g,18),W8(g,41))}function W1(g){return x1(W8(g,1),W8(g,8),s0(g,7))}function m8(g){return x1(W8(g,19),W8(g,61),s0(g,6))}var t$=[new Z(1116352408,3609767458),new Z(1899447441,602891725),new Z(3049323471,3964484399),new Z(3921009573,2173295548),new Z(961987163,4081628472),new Z(1508970993,3053834265),new Z(2453635748,2937671579),new Z(2870763221,3664609560),new Z(3624381080,2734883394),new Z(310598401,1164996542),new Z(607225278,1323610764),new Z(1426881987,3590304994),new Z(1925078388,4068182383),new Z(2162078206,991336113),new Z(2614888103,633803317),new Z(3248222580,3479774868),new Z(3835390401,2666613458),new Z(4022224774,944711139),new Z(264347078,2341262773),new Z(604807628,2007800933),new Z(770255983,1495990901),new Z(1249150122,1856431235),new Z(1555081692,3175218132),new Z(1996064986,2198950837),new Z(2554220882,3999719339),new Z(2821834349,766784016),new Z(2952996808,2566594879),new Z(3210313671,3203337956),new Z(3336571891,1034457026),new Z(3584528711,2466948901),new Z(113926993,3758326383),new Z(338241895,168717936),new Z(666307205,1188179964),new Z(773529912,1546045734),new Z(1294757372,1522805485),new Z(1396182291,2643833823),new Z(1695183700,2343527390),new Z(1986661051,1014477480),new Z(2177026350,1206759142),new Z(2456956037,344077627),new Z(2730485921,1290863460),new Z(2820302411,3158454273),new Z(3259730800,3505952657),new Z(3345764771,106217008),new Z(3516065817,3606008344),new Z(3600352804,1432725776),new Z(4094571909,1467031594),new Z(275423344,851169720),new Z(430227734,3100823752),new Z(506948616,1363258195),new Z(659060556,3750685593),new Z(883997877,3785050280),new Z(958139571,3318307427),new Z(1322822218,3812723403),new Z(1537002063,2003034995),new Z(1747873779,3602036899),new Z(1955562222,1575990012),new Z(2024104815,1125592928),new Z(2227730452,2716904306),new Z(2361852424,442776044),new Z(2428436474,593698344),new Z(2756734187,3733110249),new Z(3204031479,2999351573),new Z(3329325298,3815920427),new Z(3391569614,3928383900),new Z(3515267271,566280711),new Z(3940187606,3454069534),new Z(4118630271,4000239992),new Z(116418474,1914138554),new Z(174292421,2731055270),new Z(289380356,3203993006),new Z(460393269,320620315),new Z(685471733,587496836),new Z(852142971,1086792851),new Z(1017036298,365543100),new Z(1126000580,2618297676),new Z(1288033470,3409855158),new Z(1501505948,4234509866),new Z(1607167915,987167468),new Z(1816402316,1246189591)];function D9(g,l,h){var r=[],Y0=[],W0=[],b0=[],l0,P0,M0;for(P0=0;P0<8;P0++)r[P0]=W0[P0]=D(g,8*P0);var j0=0;while(h>=128){for(P0=0;P0<16;P0++)b0[P0]=D(l,8*P0+j0);for(P0=0;P0<80;P0++){for(M0=0;M0<8;M0++)Y0[M0]=W0[M0];l0=r0(W0[7],Z0(W0[4]),z4(W0[4],W0[5],W0[6]),t$[P0],b0[P0%16]),Y0[7]=r0(l0,F5(W0[0]),l4(W0[0],W0[1],W0[2])),Y0[3]=r0(Y0[3],l0);for(M0=0;M0<8;M0++)W0[(M0+1)%8]=Y0[M0];if(P0%16===15)for(M0=0;M0<16;M0++)b0[M0]=r0(b0[M0],b0[(M0+9)%16],W1(b0[(M0+1)%16]),m8(b0[(M0+14)%16]))}for(P0=0;P0<8;P0++)W0[P0]=r0(W0[P0],r[P0]),r[P0]=W0[P0];j0+=128,h-=128}for(P0=0;P0<8;P0++)z(g,8*P0,r[P0]);return h}var f7=new Uint8Array([106,9,230,103,243,188,201,8,187,103,174,133,132,202,167,59,60,110,243,114,254,148,248,43,165,79,245,58,95,29,54,241,81,14,82,127,173,230,130,209,155,5,104,140,43,62,108,31,31,131,217,171,251,65,189,107,91,224,205,25,19,126,33,121]);function P8(g,l,h){var r=new Uint8Array(64),Y0=new Uint8Array(256),W0,b0=h;for(W0=0;W0<64;W0++)r[W0]=f7[W0];D9(r,l,h),h%=128;for(W0=0;W0<256;W0++)Y0[W0]=0;for(W0=0;W0<h;W0++)Y0[W0]=l[b0-h+W0];Y0[h]=128,h=256-128*(h<112?1:0),Y0[h-9]=0,z(Y0,h-8,new Z(b0/536870912|0,b0<<3)),D9(r,Y0,h);for(W0=0;W0<64;W0++)g[W0]=r[W0];return 0}function I6(g,l){var h=G(),r=G(),Y0=G(),W0=G(),b0=G(),l0=G(),P0=G(),M0=G(),j0=G();R0(h,g[1],g[0]),R0(j0,l[1],l[0]),w0(h,h,j0),V0(r,g[0],g[1]),V0(j0,l[0],l[1]),w0(r,r,j0),w0(Y0,g[3],l[3]),w0(Y0,Y0,w),w0(W0,g[2],l[2]),V0(W0,W0,W0),R0(b0,r,h),R0(l0,W0,Y0),V0(P0,W0,Y0),V0(M0,r,h),w0(g[0],b0,l0),w0(g[1],M0,P0),w0(g[2],P0,l0),w0(g[3],b0,M0)}function e4(g,l,h){var r;for(r=0;r<4;r++)f0(g[r],l[r],h)}function A5(g,l){var h=G(),r=G(),Y0=G();G0(Y0,l[2]),w0(h,l[0],Y0),w0(r,l[1],Y0),m0(g,r),g[31]^=i0(h)<<7}function $9(g,l,h){var r,Y0;T0(g[0],J),T0(g[1],W),T0(g[2],W),T0(g[3],J);for(Y0=255;Y0>=0;--Y0)r=h[Y0/8|0]>>(Y0&7)&1,e4(g,l,r),I6(l,g),I6(g,g),e4(g,l,r)}function L9(g,l){var h=[G(),G(),G(),G()];T0(h[0],F),T0(h[1],H),T0(h[2],W),w0(h[3],F,H),$9(g,h,l)}function _1(g,l,h){var r=new Uint8Array(64),Y0=[G(),G(),G(),G()],W0;if(!h)X(l,32);P8(r,l,32),r[0]&=248,r[31]&=127,r[31]|=64,L9(Y0,r),A5(g,Y0);for(W0=0;W0<32;W0++)l[W0+32]=g[W0];return 0}var A8=new Float64Array([237,211,245,92,26,99,18,88,214,156,247,162,222,249,222,20,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,16]);function T8(g,l){var h,r,Y0,W0;for(r=63;r>=32;--r){h=0;for(Y0=r-32,W0=r-12;Y0<W0;++Y0)l[Y0]+=h-16*l[r]*A8[Y0-(r-32)],h=Math.floor((l[Y0]+128)/256),l[Y0]-=h*256;l[Y0]+=h,l[r]=0}h=0;for(Y0=0;Y0<32;Y0++)l[Y0]+=h-(l[31]>>4)*A8[Y0],h=l[Y0]>>8,l[Y0]&=255;for(Y0=0;Y0<32;Y0++)l[Y0]-=h*A8[Y0];for(r=0;r<32;r++)l[r+1]+=l[r]>>8,g[r]=l[r]&255}function s8(g){var l=new Float64Array(64),h;for(h=0;h<64;h++)l[h]=g[h];for(h=0;h<64;h++)g[h]=0;T8(g,l)}function _$(g,l,h,r){var Y0=new Uint8Array(64),W0=new Uint8Array(64),b0=new Uint8Array(64),l0,P0,M0=new Float64Array(64),j0=[G(),G(),G(),G()];P8(Y0,r,32),Y0[0]&=248,Y0[31]&=127,Y0[31]|=64;var g0=h+64;for(l0=0;l0<h;l0++)g[64+l0]=l[l0];for(l0=0;l0<32;l0++)g[32+l0]=Y0[32+l0];P8(b0,g.subarray(32),h+32),s8(b0),L9(j0,b0),A5(g,j0);for(l0=32;l0<64;l0++)g[l0]=r[l0];P8(W0,g,h+64),s8(W0);for(l0=0;l0<64;l0++)M0[l0]=0;for(l0=0;l0<32;l0++)M0[l0]=b0[l0];for(l0=0;l0<32;l0++)for(P0=0;P0<32;P0++)M0[l0+P0]+=W0[l0]*Y0[P0];return T8(g.subarray(32),M0),g0}function K8(g,l){var h=G(),r=G(),Y0=G(),W0=G(),b0=G(),l0=G(),P0=G();if(T0(g[2],W),H0(g[1],l),Q0(Y0,g[1]),w0(W0,Y0,U),R0(Y0,Y0,g[2]),V0(W0,g[2],W0),Q0(b0,W0),Q0(l0,b0),w0(P0,l0,b0),w0(h,P0,Y0),w0(h,h,W0),k0(h,h),w0(h,h,Y0),w0(h,h,W0),w0(h,h,W0),w0(g[0],h,W0),Q0(r,g[0]),w0(r,r,W0),x0(r,Y0))w0(g[0],g[0],N);if(Q0(r,g[0]),w0(r,r,W0),x0(r,Y0))return-1;if(i0(g[0])===l[31]>>7)R0(g[0],J,g[0]);return w0(g[3],g[0],g[1]),0}function EG(g,l,h,r){var Y0,W0=new Uint8Array(32),b0=new Uint8Array(64),l0=[G(),G(),G(),G()],P0=[G(),G(),G(),G()];if(h<64)return-1;if(K8(P0,r))return-1;for(Y0=0;Y0<h;Y0++)g[Y0]=l[Y0];for(Y0=0;Y0<32;Y0++)g[Y0+32]=r[Y0];if(P8(b0,g,h),s8(b0),$9(l0,P0,b0),L9(P0,l.subarray(32)),I6(l0,P0),A5(W0,l0),h-=64,A(l,0,W0,0)){for(Y0=0;Y0<h;Y0++)g[Y0]=0;return-1}for(Y0=0;Y0<h;Y0++)g[Y0]=l[Y0+64];return h}var R$=32,c6=24,t6=32,i8=16,$5=32,C=32,u=32,c=32,I=32,p=c6,y0=t6,d0=i8,Q1=64,w1=32,b1=64,V1=32,Z8=64;$.lowlevel={crypto_core_hsalsa20:q,crypto_stream_xor:e,crypto_stream:v,crypto_stream_salsa20_xor:t,crypto_stream_salsa20:f,crypto_onetimeauth:O0,crypto_onetimeauth_verify:K0,crypto_verify_16:P,crypto_verify_32:A,crypto_secretbox:J0,crypto_secretbox_open:s,crypto_scalarmult:i,crypto_scalarmult_base:$0,crypto_box_beforenm:I0,crypto_box_afternm:d,crypto_box:C0,crypto_box_open:v0,crypto_box_keypair:p0,crypto_hash:P8,crypto_sign:_$,crypto_sign_keypair:_1,crypto_sign_open:EG,crypto_secretbox_KEYBYTES:R$,crypto_secretbox_NONCEBYTES:c6,crypto_secretbox_ZEROBYTES:t6,crypto_secretbox_BOXZEROBYTES:i8,crypto_scalarmult_BYTES:$5,crypto_scalarmult_SCALARBYTES:C,crypto_box_PUBLICKEYBYTES:u,crypto_box_SECRETKEYBYTES:c,crypto_box_BEFORENMBYTES:I,crypto_box_NONCEBYTES:p,crypto_box_ZEROBYTES:y0,crypto_box_BOXZEROBYTES:d0,crypto_sign_BYTES:Q1,crypto_sign_PUBLICKEYBYTES:w1,crypto_sign_SECRETKEYBYTES:b1,crypto_sign_SEEDBYTES:V1,crypto_hash_BYTES:Z8,gf:G,D:U,L:A8,pack25519:m0,unpack25519:H0,M:w0,A:V0,S:Q0,Z:R0,pow2523:k0,add:I6,set25519:T0,modL:T8,scalarmult:$9,scalarbase:L9};function h1(g,l){if(g.length!==R$)throw Error("bad key size");if(l.length!==c6)throw Error("bad nonce size")}function D$(g,l){if(g.length!==u)throw Error("bad public key size");if(l.length!==c)throw Error("bad secret key size")}function G$(){for(var g=0;g<arguments.length;g++)if(!(arguments[g]instanceof Uint8Array))throw TypeError("unexpected type, use Uint8Array")}function f$(g){for(var l=0;l<g.length;l++)g[l]=0}$.randomBytes=function(g){var l=new Uint8Array(g);return X(l,g),l},$.secretbox=function(g,l,h){G$(g,l,h),h1(h,l);var r=new Uint8Array(t6+g.length),Y0=new Uint8Array(r.length);for(var W0=0;W0<g.length;W0++)r[W0+t6]=g[W0];return J0(Y0,r,r.length,l,h),Y0.subarray(i8)},$.secretbox.open=function(g,l,h){G$(g,l,h),h1(h,l);var r=new Uint8Array(i8+g.length),Y0=new Uint8Array(r.length);for(var W0=0;W0<g.length;W0++)r[W0+i8]=g[W0];if(r.length<32)return null;if(s(Y0,r,r.length,l,h)!==0)return null;return Y0.subarray(t6)},$.secretbox.keyLength=R$,$.secretbox.nonceLength=c6,$.secretbox.overheadLength=i8,$.scalarMult=function(g,l){if(G$(g,l),g.length!==C)throw Error("bad n size");if(l.length!==$5)throw Error("bad p size");var h=new Uint8Array($5);return i(h,g,l),h},$.scalarMult.base=function(g){if(G$(g),g.length!==C)throw Error("bad n size");var l=new Uint8Array($5);return $0(l,g),l},$.scalarMult.scalarLength=C,$.scalarMult.groupElementLength=$5,$.box=function(g,l,h,r){var Y0=$.box.before(h,r);return $.secretbox(g,l,Y0)},$.box.before=function(g,l){G$(g,l),D$(g,l);var h=new Uint8Array(I);return I0(h,g,l),h},$.box.after=$.secretbox,$.box.open=function(g,l,h,r){var Y0=$.box.before(h,r);return $.secretbox.open(g,l,Y0)},$.box.open.after=$.secretbox.open,$.box.keyPair=function(){var g=new Uint8Array(u),l=new Uint8Array(c);return p0(g,l),{publicKey:g,secretKey:l}},$.box.keyPair.fromSecretKey=function(g){if(G$(g),g.length!==c)throw Error("bad secret key size");var l=new Uint8Array(u);return $0(l,g),{publicKey:l,secretKey:new Uint8Array(g)}},$.box.publicKeyLength=u,$.box.secretKeyLength=c,$.box.sharedKeyLength=I,$.box.nonceLength=p,$.box.overheadLength=$.secretbox.overheadLength,$.sign=function(g,l){if(G$(g,l),l.length!==b1)throw Error("bad secret key size");var h=new Uint8Array(Q1+g.length);return _$(h,g,g.length,l),h},$.sign.open=function(g,l){if(G$(g,l),l.length!==w1)throw Error("bad public key size");var h=new Uint8Array(g.length),r=EG(h,g,g.length,l);if(r<0)return null;var Y0=new Uint8Array(r);for(var W0=0;W0<Y0.length;W0++)Y0[W0]=h[W0];return Y0},$.sign.detached=function(g,l){var h=$.sign(g,l),r=new Uint8Array(Q1);for(var Y0=0;Y0<r.length;Y0++)r[Y0]=h[Y0];return r},$.sign.detached.verify=function(g,l,h){if(G$(g,l,h),l.length!==Q1)throw Error("bad signature size");if(h.length!==w1)throw Error("bad public key size");var r=new Uint8Array(Q1+g.length),Y0=new Uint8Array(Q1+g.length),W0;for(W0=0;W0<Q1;W0++)r[W0]=l[W0];for(W0=0;W0<g.length;W0++)r[W0+Q1]=g[W0];return EG(Y0,r,r.length,h)>=0},$.sign.keyPair=function(){var g=new Uint8Array(w1),l=new Uint8Array(b1);return _1(g,l),{publicKey:g,secretKey:l}},$.sign.keyPair.fromSecretKey=function(g){if(G$(g),g.length!==b1)throw Error("bad secret key size");var l=new Uint8Array(w1);for(var h=0;h<l.length;h++)l[h]=g[32+h];return{publicKey:l,secretKey:new Uint8Array(g)}},$.sign.keyPair.fromSeed=function(g){if(G$(g),g.length!==V1)throw Error("bad seed size");var l=new Uint8Array(w1),h=new Uint8Array(b1);for(var r=0;r<32;r++)h[r]=g[r];return _1(l,h,!0),{publicKey:l,secretKey:h}},$.sign.publicKeyLength=w1,$.sign.secretKeyLength=b1,$.sign.seedLength=V1,$.sign.signatureLength=Q1,$.hash=function(g){G$(g);var l=new Uint8Array(Z8);return P8(l,g,g.length),l},$.hash.hashLength=Z8,$.verify=function(g,l){if(G$(g,l),g.length===0||l.length===0)return!1;if(g.length!==l.length)return!1;return j(g,0,l,0,g.length)===0?!0:!1},$.setPRNG=function(g){X=g},function(){var g=typeof globalThis<"u"?globalThis.crypto||globalThis.msCrypto:null;if(g&&g.getRandomValues){var l=65536;$.setPRNG(function(h,r){var Y0,W0=new Uint8Array(r);for(Y0=0;Y0<r;Y0+=l)g.getRandomValues(W0.subarray(Y0,Y0+Math.min(r-Y0,l)));for(Y0=0;Y0<r;Y0++)h[Y0]=W0[Y0];f$(W0)})}else if(g=u0("crypto"),g&&g.randomBytes)$.setPRNG(function(h,r){var Y0,W0=g.randomBytes(r);for(Y0=0;Y0<r;Y0++)h[Y0]=W0[Y0];f$(W0)})}()})(typeof ty<"u"&&es9?es9:globalThis.nacl=globalThis.nacl||{});mV=typeof ty<"u"&&es9?es9:globalThis.nacl,qe6={fromSeed:mV.sign.keyPair.fromSeed,sign:mV.sign.detached,verify:mV.sign.detached.verify,randomBytes:mV.randomBytes,scalarBaseMultiply:mV.scalarMult.base,seal:mV.box,open:mV.box.open};ke6=new Uint16Array([0,4129,8258,12387,16516,20645,24774,28903,33032,37161,41290,45419,49548,53677,57806,61935,4657,528,12915,8786,21173,17044,29431,25302,37689,33560,45947,41818,54205,50076,62463,58334,9314,13379,1056,5121,25830,29895,17572,21637,42346,46411,34088,38153,58862,62927,50604,54669,13907,9842,5649,1584,30423,26358,22165,18100,46939,42874,38681,34616,63455,59390,55197,51132,18628,22757,26758,30887,2112,6241,10242,14371,51660,55789,59790,63919,35144,39273,43274,47403,23285,19156,31415,27286,6769,2640,14899,10770,56317,52188,64447,60318,39801,35672,47931,43802,27814,31879,19684,23749,11298,15363,3168,7233,60846,64911,52716,56781,44330,48395,36200,40265,32407,28342,24277,20212,15891,11826,7761,3696,65439,61374,57309,53244,48923,44858,40793,36728,37256,33193,45514,41451,53516,49453,61774,57711,4224,161,12482,8419,20484,16421,28742,24679,33721,37784,41979,46042,49981,54044,58239,62302,689,4752,8947,13010,16949,21012,25207,29270,46570,42443,38312,34185,62830,58703,54572,50445,13538,9411,5280,1153,29798,25671,21540,17413,42971,47098,34713,38840,59231,63358,50973,55100,9939,14066,1681,5808,26199,30326,17941,22068,55628,51565,63758,59695,39368,35305,47498,43435,22596,18533,30726,26663,6336,2273,14466,10403,52093,56156,60223,64286,35833,39896,43963,48026,19061,23124,27191,31254,2801,6864,10931,14994,64814,60687,56684,52557,48554,44427,40424,36297,31782,27655,23652,19525,15522,11395,7392,3265,61215,65342,53085,57212,44955,49082,36825,40952,28183,32310,20053,24180,11923,16050,3793,7920]);h$=class h$ extends Error{name;code;chainedError;constructor($,Z){super($);this.name="NKeysError",this.code=$,this.chainedError=Z}};(function($){$.InvalidPrefixByte="nkeys: invalid prefix byte",$.InvalidKey="nkeys: invalid key",$.InvalidPublicKey="nkeys: invalid public key",$.InvalidSeedLen="nkeys: invalid seed length",$.InvalidSeed="nkeys: invalid seed",$.InvalidCurveSeed="nkeys: invalid curve seed",$.InvalidCurveKey="nkeys: not a valid curve key",$.InvalidCurveOperation="nkeys: curve key is not valid for sign/verify",$.InvalidNKeyOperation="keys: only curve key can seal/open",$.InvalidEncoding="nkeys: invalid encoded key",$.InvalidRecipient="nkeys: not a valid recipient public curve key",$.InvalidEncrypted="nkeys: encrypted input is not valid",$.CannotSign="nkeys: cannot sign, no private key available",$.PublicKeyOnly="nkeys: no seed or private key available",$.InvalidChecksum="nkeys: invalid checksum",$.SerializationError="nkeys: serialization error",$.ApiError="nkeys: api error",$.ClearedPair="nkeys: pair is cleared"})(g$||(g$={}));(function($){$[$.Unknown=-1]="Unknown",$[$.Seed=144]="Seed",$[$.Private=120]="Private",$[$.Operator=112]="Operator",$[$.Server=104]="Server",$[$.Cluster=16]="Cluster",$[$.Account=0]="Account",$[$.User=160]="User",$[$.Curve=184]="Curve"})(a8||(a8={}));iV=[120,107,118,49];Me6(qe6);(function($){$.v1="ed25519",$.v2="ed25519-nkey"})(z3||(z3={}))});function E11($){try{$?.clear?.()}catch{}}async function rM$({accountJwt:$,accountSigningKey:Z,expiresAt:G,permissions:X,userId:Y,allowedConnectionTypes:Q=["WEBSOCKET"]}){let J=nM$($),W=B11(J.sub),K=O11(new TextEncoder().encode(Z)),U=dM$();try{let w=await iM$(Y,U,W,{pub:{allow:X.publish.allow},sub:{allow:X.subscribe.allow},allowed_connection_types:Q},{algorithm:z3.v2,exp:Math.floor(G.getTime()/1000),signer:K});return new TextDecoder().decode(pM$(w,U))}finally{E11(U),E11(K),E11(W)}}var oM$=O(()=>{tM$()});function he6($){return/^wss?:\/\//i.test($.trim())?["WEBSOCKET"]:["STANDARD","WEBSOCKET"]}function aM$(){let $=new y1;return $.post("/links/session",async(Z)=>{let X=Z.get("meshContext").auth?.user?.id;if(!X)return Z.json({error:"Unauthorized"},401);let Y=L1();if(!Y.natsTunnelPublicEnabled)return Z.json(D11(),503);if(!Y.natsPublicUrl)return Z.json(D11(),503);if(!Y.natsAccountJwt||!Y.natsAccountSigningKey){if(!Y.localMode)return Z.json(D11(),503)}let Q=L3(X),J;if(Y.natsAccountJwt&&Y.natsAccountSigningKey){let W=new Date(Date.now()+Y.natsTunnelSessionTtlSeconds*1000);J=await rM$({accountJwt:Y.natsAccountJwt,accountSigningKey:Y.natsAccountSigningKey,expiresAt:W,permissions:yM$(Q),userId:X,allowedConnectionTypes:he6(Y.natsPublicUrl)})}return Z.json(gM$({publicUrl:Y.natsPublicUrl,userId:X,ttlSeconds:Y.natsTunnelSessionTtlSeconds,credentials:J}))}),$}var D11=()=>({error:"link session unavailable"});var sM$=O(()=>{d6();q8();hM$();oM$()});async function de6($,Z){try{return!await $.alive(Z)}catch(G){return console.warn(`[vm-events] alive probe failed for ${Z}; assuming alive: ${G instanceof Error?G.message:String(G)}`),!1}}async function le6($){let{ctx:Z,runner:G,claimName:X,userId:Y,projectRef:Q,sandboxProviderKind:J}=$;try{await G.delete(X)}catch(W){console.warn(`[vm-events] runner.delete failed for ${X}: ${W instanceof Error?W.message:String(W)}`)}try{await new UN(Z.db).delete({userId:Y,projectRef:Q},J)}catch(W){console.warn(`[vm-events] sandbox_runner_state delete failed for ${Y}/${Q}/${J}: ${W instanceof Error?W.message:String(W)}`)}}async function me6($){let{stream:Z,claimName:G,runner:X,signal:Y}=$;return new Promise((Q)=>{let J=!1,W=!1,K=null,U=(H)=>{if(J)return;J=!0,clearTimeout(w),Y.removeEventListener("abort",F),K?.unsubscribe(),Q(H)},w=setTimeout(()=>{if(W||J)return;Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"claim-never-created",message:"Sandbox claim was never created. The SANDBOX_START call may have failed earlier \u2014 check the start error."})}).catch(()=>{}),U(!1)},ce6),F=()=>U(!1);Y.addEventListener("abort",F,{once:!0}),K=Un(X,G,(H)=>{if(J)return;if(H.kind!=="claiming")W=!0;if(Z.writeSSE({event:"phase",data:JSON.stringify(H)}).catch(()=>{}),H.kind==="ready")U(!0);else if(H.kind==="failed")U(!1)})})}async function ie6($){let{stream:Z,runner:G,claimName:X,signal:Y}=$,Q=Date.now(),J=null;while(!Y.aborted){let K=null;try{K=await G.proxyDaemonRequest(X,"/_sandbox/events",{method:"GET",headers:new Headers({accept:"text/event-stream"}),body:null,signal:Y})}catch(U){if(Y.aborted)return;if(Date.now()-Q<eM$){await m4($k$,{signal:Y}).catch(()=>{});continue}let w=U instanceof Error?U.message:String(U);await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE error: ${w}`})}).catch(()=>{});return}if(K.status===404){try{await K.body?.cancel()}catch{}if(Date.now()-Q<eM$){await m4($k$,{signal:Y}).catch(()=>{});continue}await Z.writeSSE({event:"gone",data:""}).catch(()=>{});return}if(!K.ok||!K.body){try{await K.body?.cancel()}catch{}await Z.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:`Upstream daemon SSE failed (${K.status}).`})}).catch(()=>{});return}J=K;break}if(!J||!J.body)return;let W=J.body.getReader();try{while(!Y.aborted){let{value:K,done:U}=await W.read();if(U)break;if(K)await Z.write(K)}}catch{}finally{try{W.releaseLock()}catch{}}}var ce6=90000,ue6=15000,Zk$=()=>{let $=new y1;return $.get("/",async(Z)=>{let G=Z.var.meshContext;try{S0(G)}catch{return Z.json({error:"Unauthorized"},401)}let X=l1(G);if(!X)return Z.json({error:"Unauthorized"},401);let Y;try{Y=E0(G)}catch{return Z.json({error:"Organization scope required"},403)}let Q=Z.req.query("virtualMcpId"),J=Z.req.query("branch");if(!Q||!J)return Z.json({error:"virtualMcpId and branch are required"},400);let W=await G.storage.virtualMcps.findById(Q);if(!W||W.organization_id!==Y.id)return Z.json({error:"Virtual MCP not found"},404);let K=uU({orgId:Y.id,virtualMcpId:Q,branch:J}),U=Dy({userId:X,projectRef:K},J),w=W.metadata??null,F,H=null,N=null;try{let D=await Q3(G,{userId:X,branch:J,virtualMcpMetadata:w});F=D.provider,H=D.kind}catch(D){N=D instanceof Error?D:Error(String(D)),F=null}let B=H&&mU(e9(w),X,J,H),E=!!B&&B.sandboxHandle===U;if(!F)return yQ(Z,async(D)=>{await D.writeSSE({event:"phase",data:JSON.stringify({kind:"failed",reason:"unknown",message:N?.message??"No sandbox runner configured on this mesh."})})});return Z.header("X-Accel-Buffering","no"),Z.header("Content-Encoding","identity"),yQ(Z,async(D)=>{let L=new AbortController,z=setInterval(()=>{D.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(z)})},ue6);D.onAbort(()=>{L.abort(),clearInterval(z)});try{if(E&&H){if(await de6(F,U)){await le6({ctx:G,runner:F,claimName:U,userId:X,projectRef:K,sandboxProviderKind:H}),await D.writeSSE({event:"gone",data:""}).catch(()=>{});return}}if(!await me6({stream:D,claimName:U,runner:F,signal:L.signal})||L.signal.aborted)return;await ie6({stream:D,runner:F,claimName:U,signal:L.signal})}finally{clearInterval(z)}})}),$},eM$=60000,$k$=500;var Gk$=O(()=>{d6();lV();jY();x7();PE0();wn();Fv();o50();TQ()});function pe6($){return $.filter((Z)=>Z.vendors?.alias).map((Z)=>({name:Z.name,title:Z.title,description:Z.description,logo:Z.logo,category:Z.category,vendor:{alias:Z.vendors.alias,url:Z.vendors.url}}))}async function te6($,Z){let G=await fetch(`${$}/rest/v1/apps?select=name,title,description,logo,category,vendors(alias,url)`,{headers:{apikey:Z,Authorization:`Bearer ${Z}`,Accept:"application/json"},signal:AbortSignal.timeout(ne6)});if(!G.ok){let X=await G.text().catch(()=>G.statusText);throw console.error(`[deco-apps] Supabase error (${G.status}): ${X.slice(0,200)}`),Error(`External service error (${G.status})`)}return await G.json()}var ne6=1e4,re6=async($,Z)=>{if(!$.get("meshContext").auth.user?.id)return $.json({error:"Unauthorized"},401);return Z()},Xk$=()=>{let $=new y1;return $.use("*",re6),$.get("/",async(Z)=>{let G=L1(),X=G.decoSupabaseUrl,Y=G.decoSupabaseServiceKey;if(!X||!Y)return Z.json({apps:[]});try{let Q=await te6(X,Y);return Z.json({apps:pe6(Q)})}catch(Q){return console.error("[deco-apps] GET error:",Q),Z.json({error:"Failed to fetch apps"},502)}}),$};var Yk$=O(()=>{d6();q8()});import{z as f1}from"zod";function WK($,Z="invalid_request_error",G=null,X=null){return{error:{message:$,type:Z,param:G,code:X}}}function Q04($){if(!$)return null;let Z=$.indexOf(":");if(Z===-1)return{credentialId:null,modelId:$};let G=$.substring(0,Z),X=$.substring(Z+1);if(!G||!X)return null;return{credentialId:G,modelId:X}}function J04($,Z,G){try{return JSON.parse($)}catch{throw new Wk$(`Invalid JSON in tool call arguments for function '${G}' (tool_call_id: ${Z}): ${$}`)}}function W04($){let Z={};for(let G of $)if(G.role==="assistant"&&G.tool_calls)for(let X of G.tool_calls)Z[X.id]=X.function.name;return $.map((G)=>{switch(G.role){case"system":return{role:"system",content:G.content};case"user":if(typeof G.content==="string")return{role:"user",content:G.content};return{role:"user",content:G.content.map((Y)=>{if(Y.type==="text")return{type:"text",text:Y.text};return{type:"image",image:Y.image_url.url}})};case"assistant":if(G.tool_calls&&G.tool_calls.length>0)return{role:"assistant",content:G.tool_calls.map((Y)=>({type:"tool-call",toolCallId:Y.id,toolName:Y.function.name,input:J04(Y.function.arguments,Y.id,Y.function.name)}))};return{role:"assistant",content:G.content??""};case"tool":let X=Z[G.tool_call_id]??"unknown";return{role:"tool",content:[{type:"tool-result",toolCallId:G.tool_call_id,toolName:X,output:{type:"text",value:G.content}}]}}})}function K04($){let Z=$.map((G)=>{let X=G.function.parameters?UY(G.function.parameters):UY({type:"object",properties:{}});return[G.function.name,s$({description:G.function.description,inputSchema:X})]});return Object.fromEntries(Z)}function U04($){if(!$)return;return{openai:{response_format:$}}}function w04(){return`chatcmpl-${crypto.randomUUID().replace(/-/g,"").substring(0,29)}`}function Qk$($,Z,G,X,Y,Q){let J={model:$,messages:Z,tools:G,temperature:X.temperature,maxTokens:X.max_tokens,topP:X.top_p,frequencyPenalty:X.frequency_penalty,presencePenalty:X.presence_penalty,stopSequences:X.stop?Array.isArray(X.stop)?X.stop:[X.stop]:void 0,abortSignal:Q};return Y?{...J,providerOptions:Y}:J}function Jk$($){if($==="tool-calls")return"tool_calls";if($==="length")return"length";return"stop"}var oe6=256,ae6,se6,ee6,$04,Z04,G04,X04,Y04,Wk$,Kk$,Uk$;var wk$=O(()=>{f6();d6();lV();ae6=f1.object({type:f1.literal("function"),function:f1.object({name:f1.string(),description:f1.string().optional(),parameters:f1.record(f1.string(),f1.unknown()).optional()})}),se6=f1.object({id:f1.string(),type:f1.literal("function"),function:f1.object({name:f1.string(),arguments:f1.string()})}),ee6=f1.discriminatedUnion("role",[f1.object({role:f1.literal("system"),content:f1.string(),name:f1.string().optional()}),f1.object({role:f1.literal("user"),content:f1.union([f1.string(),f1.array(f1.union([f1.object({type:f1.literal("text"),text:f1.string()}),f1.object({type:f1.literal("image_url"),image_url:f1.object({url:f1.string(),detail:f1.string().optional()})})]))]),name:f1.string().optional()}),f1.object({role:f1.literal("assistant"),content:f1.string().nullable().optional(),name:f1.string().optional(),tool_calls:f1.array(se6).optional()}),f1.object({role:f1.literal("tool"),content:f1.string(),tool_call_id:f1.string()})]),$04=f1.object({type:f1.literal("text")}),Z04=f1.object({type:f1.literal("json_object")}),G04=f1.object({type:f1.literal("json_schema"),json_schema:f1.object({name:f1.string(),description:f1.string().optional(),schema:f1.record(f1.string(),f1.unknown()),strict:f1.boolean().optional()})}),X04=f1.union([$04,Z04,G04]),Y04=f1.object({model:f1.string().describe("Format: 'model_id' or 'credential_id:model_id'"),messages:f1.array(ee6),stream:f1.boolean().optional().default(!1),temperature:f1.number().min(0).max(2).optional(),max_tokens:f1.number().positive().optional(),top_p:f1.number().min(0).max(1).optional(),frequency_penalty:f1.number().min(-2).max(2).optional(),presence_penalty:f1.number().min(-2).max(2).optional(),stop:f1.union([f1.string(),f1.array(f1.string())]).optional(),tools:f1.array(ae6).optional(),tool_choice:f1.union([f1.literal("auto"),f1.literal("none"),f1.literal("required"),f1.object({type:f1.literal("function"),function:f1.object({name:f1.string()})})]).optional(),response_format:X04.optional(),user:f1.string().optional()});Wk$=class Wk$ extends Error{constructor($){super($);this.name="MessageConversionError"}};Kk$=new y1;Kk$.post("/:org/v1/chat/completions",async($)=>{let Z=$.get("meshContext"),G=$.req.param("org");try{if(!Z.auth.apiKey?.id)return $.json(WK("API key authentication required. Provide a valid API key via Authorization header.","authentication_error"),401);if(!Z.organization)return $.json(WK("Organization context is required. Ensure your API key has organization metadata.","invalid_request_error","organization"),400);if((Z.organization.slug??Z.organization.id)!==G)return $.json(WK("Organization mismatch. The API key's organization does not match the requested organization.","invalid_request_error","organization"),403);let X=await $.req.json(),Y=Y04.safeParse(X);if(!Y.success){let D=Y.error.issues[0]??{message:"Invalid request",path:[]};return $.json(WK(`Invalid request: ${D.message}`,"invalid_request_error",D.path.length>0?D.path.join("."):null),400)}let Q=Y.data,J=Q04(Q.model);if(!J)return $.json(WK("Invalid model format. Expected 'model_id' or 'credential_id:model_id' (e.g., 'claude-sonnet-4-6' or 'key_abc123:claude-sonnet-4-6')","invalid_request_error","model"),400);let{credentialId:W}=J,{modelId:K}=J;if(!W){let D=await Z.storage.aiProviderKeys.list({organizationId:Z.organization.id});if(D.length===0)return $.json(WK("No AI provider credentials configured for this organization. Add a credential in settings or specify one explicitly via 'credential_id:model_id'.","invalid_request_error","model"),400);W=D[0].id}let U;try{U=await Z.aiProviders.activate(W,Z.organization.id)}catch{return $.json(WK(`AI provider credential not found or inaccessible: ${W}`,"invalid_request_error","model"),404)}let w=U.aiSdk.languageModel(K),F=W04(Q.messages),H=Q.tools?K04(Q.tools):void 0,N=U04(Q.response_format),B=w04(),E=Math.floor(Date.now()/1000);if(Q.stream)return yQ($,async(D)=>{let L=Qk$(w,F,H,Q,N,$.req.raw.signal);try{let z=PQ(L),j=!1,P=0,A="",M=async()=>{if(A.length===0)return;let S=A;A="",await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{content:S},finish_reason:null}]})})};for await(let S of z.fullStream){if(!j&&(S.type==="text-delta"||S.type==="tool-call"))await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{role:"assistant",content:""},finish_reason:null}]})}),j=!0;if(S.type==="text-delta"){if(A+=S.text,A.length>=oe6)await M()}else if(S.type==="tool-call"){await M();let q=P++;await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{tool_calls:[{index:q,id:S.toolCallId,type:"function",function:{name:S.toolName,arguments:JSON.stringify(S.input)}}]},finish_reason:null}]})})}else if(S.type==="finish")await M(),await D.writeSSE({data:JSON.stringify({id:B,object:"chat.completion.chunk",created:E,model:Q.model,choices:[{index:0,delta:{},finish_reason:Jk$(S.finishReason)}],usage:S.totalUsage?{prompt_tokens:S.totalUsage.inputTokens??0,completion_tokens:S.totalUsage.outputTokens??0,total_tokens:S.totalUsage.totalTokens??0}:void 0})})}await M(),await D.writeSSE({data:"[DONE]"})}catch(z){let j=z;console.error("[openai-compat:stream] Error:",j.message),await D.writeSSE({data:JSON.stringify({error:{message:j.message,type:"server_error"}})})}});else{let D=Qk$(w,F,H,Q,N,$.req.raw.signal),L=await GN(D),z={role:"assistant",content:L.text||null};if(L.toolCalls&&L.toolCalls.length>0)z.tool_calls=L.toolCalls.map((j)=>({id:j.toolCallId,type:"function",function:{name:j.toolName,arguments:JSON.stringify("input"in j?j.input:{})}})),z.content=null;return $.json({id:B,object:"chat.completion",created:E,model:Q.model,choices:[{index:0,message:z,finish_reason:Jk$(L.finishReason)}],usage:{prompt_tokens:L.usage?.inputTokens??0,completion_tokens:L.usage?.outputTokens??0,total_tokens:L.usage?.totalTokens??0}})}}catch(X){let Y=X;if(Y.name==="AbortError")return $.json(WK("Request aborted","invalid_request_error"),400);if(Y.name==="MessageConversionError")return $.json(WK(Y.message,"invalid_request_error","messages"),400);return console.error("[openai-compat] Error:",Y.message,Y.stack),$.json(WK(Y.message,"server_error"),500)}});Uk$=Kk$});function H04(){let $=process.env.POSTHOG_KEY;if(!$)return null;return{key:$,host:process.env.POSTHOG_HOST??F04}}var Fk$,F04="https://ph.studio.decocms.com",Hk$;var Nk$=O(()=>{d6();m_0();RN();i7();q8();Ms0();Fk$=new y1;Fk$.get("/",($)=>{let Z={theme:yC1(),...SO().logo&&{logo:SO().logo},...qQ()&&{internalUrl:He()},...L1().enableDecoImport&&{enableDecoImport:!0},brandExtractEnabled:!!L1().firecrawlApiKey,auth:nP$(),posthog:H04(),googleMapsApiKey:process.env.GOOGLE_MAPS_API_KEY?.trim()||null,runtime:{agentSandbox:!qQ()&&L1().sandboxProviderKind==="agent-sandbox"}};return $.json({success:!0,config:Z})});Hk$=Fk$});function Bk$($,Z){if(Z.startsWith("text/html")||Z.startsWith("image/svg"))$.set("Content-Security-Policy","sandbox allow-scripts allow-modals allow-same-origin")}var Ok$,N04,B04,Ek$;var Dk$=O(()=>{d6();PJ();Dv();Xb();Ok$=new y1,N04=["range","if-none-match","if-modified-since"],B04=["content-type","content-length","content-range","accept-ranges","etag","last-modified"];Ok$.get("/:org/files/*",async($)=>{let Z=$.get("meshContext"),G=Z.organization?.id;if(!Z.auth?.user?.id){if(My($))return $.redirect(`/login?next=${encodeURIComponent($.req.path)}`,302);throw new z$(401,{message:"Authentication required"})}if(!G)throw new z$(401,{message:"Organization context required"});let X=$.req.path.replace(/^.*\/files\//,"");if(!X)throw new z$(400,{message:"Missing file key"});let Y=await En(X,Z);if(!Y)throw new z$(503,{message:"Object storage not configured"});if(Y.startsWith("data:")&&jJ()){let K=Y.match(/^data:([^;]+);base64,(.+)$/s);if(!K)throw new z$(500,{message:"Invalid data URL from storage"});let[,U,w]=K,F=Buffer.from(w,"base64"),H=new Headers({"Content-Type":U,"Cache-Control":"private, max-age=86400"});return Bk$(H,U),new Response(F,{status:200,headers:H})}let Q=new Headers;for(let K of N04){let U=$.req.header(K);if(U)Q.set(K,U)}let J=await fetch(Y,{headers:Q});if(J.status===403||J.status===404)throw new z$(404,{message:"File not found"});if(!J.ok&&J.status!==304&&J.status!==416)throw console.error(`[files] upstream storage error ${J.status} for key:`,X),new z$(502,{message:"Upstream storage error"});let W=new Headers;for(let K of B04){let U=J.headers.get(K);if(U)W.set(K,U)}return W.set("Cache-Control","private, max-age=86400"),Bk$(W,W.get("content-type")??""),new Response(J.body,{status:J.status,headers:W})});Ek$=Ok$});var jt=_((pV)=>{var O04=pV&&pV.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),E04=pV&&pV.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))O04(Z,$,G)};Object.defineProperty(pV,"__esModule",{value:!0});E04(dX(),pV)});var jk$=_((Lk$)=>{Object.defineProperty(Lk$,"__esModule",{value:!0});Lk$.version=void 0;Lk$.version="3.4.0"});var Tk$=_((KK)=>{var D04=KK&&KK.__importDefault||function($){return $&&$.__esModule?$:{default:$}};Object.defineProperty(KK,"__esModule",{value:!0});KK.NodeTransport=KK.VERSION=void 0;KK.nodeResolveHost=T04;var d4=jt(),L04=u0("net"),L11=u0("tls"),z04=u0("path"),Pk$=u0("fs"),j04=D04(u0("dns")),P04=jk$();KK.VERSION=P04.version;var A04="nats.js";class Ak${socket;version;lang;yields=[];signal=(0,d4.deferred)();closedNotification=(0,d4.deferred)();options;connected=!1;tlsName="";done=!1;closeError;constructor(){this.lang=A04,this.version=KK.VERSION}async connect($,Z){this.tlsName=$.tlsName,this.options=Z;let{tls:G}=this.options,{handshakeFirst:X}=G||{};try{if(X===!0)this.socket=await this.tlsFirst($);else this.socket=await this.dial($);if(this.done)this.socket?.destroy();let Y=await this.peekInfo();(0,d4.checkOptions)(Y,Z);let{tls_required:Q,tls_available:J}=Y,W=J===!0&&Z.tls!==null;if(!X&&(Q||W))this.socket=await this.startTLS();if(this.done)this.socket?.destroy();if(Q&&this.socket.encrypted!==!0)throw d4.errors.InvalidArgumentError.format("tls","is not available on this server");return this.connected=!0,this.setupHandlers(),this.signal.resolve(),Promise.resolve()}catch(Y){let Q=Y;if(!Q)Q=new d4.errors.ConnectionError("error connecting - node provided an undefined error");let{code:J}=Q,W=J==="ECONNREFUSED"?new d4.errors.ConnectionError("connection refused",{cause:Q}):Q;throw this.socket?.destroy(),W}}dial($){let Z=(0,d4.deferred)(),G,X=(0,L04.createConnection)($.port,$.hostname,()=>{Z.resolve(X),X.removeAllListeners()});return X.on("error",(Y)=>{G=Y}),X.on("close",()=>{X.removeAllListeners(),Z.reject(G)}),X.setNoDelay(!0),Z}get isClosed(){return this.done}close($){return this._closed($,!1)}peekInfo(){let $=(0,d4.deferred)(),Z;return this.socket.on("data",(G)=>{this.yields.push(G);let X=d4.DataBuffer.concat(...this.yields),Y=(0,d4.extractProtocolMessage)(X);if(Y!=="")try{let Q=d4.INFO.exec(Y);if(!Q)throw Error("unexpected response from server");let J=JSON.parse(Q[1]);$.resolve(J)}catch(Q){$.reject(Q)}finally{this.socket.removeAllListeners()}}),this.socket.on("error",(G)=>{Z=G}),this.socket.on("close",()=>{this.socket.removeAllListeners(),$.reject(Z)}),$}loadFile($){if(!$)return Promise.resolve();let Z=(0,d4.deferred)();try{if($=(0,z04.resolve)($),!(0,Pk$.existsSync)($))Z.reject(Error(`${$} doesn't exist`));(0,Pk$.readFile)($,(G,X)=>{if(G)return Z.reject(G);Z.resolve(X)})}catch(G){Z.reject(G)}return Z}async loadClientCerts(){let $={},{certFile:Z,cert:G,caFile:X,ca:Y,keyFile:Q,key:J}=this.options.tls;try{if(Z){let W=await this.loadFile(Z);if(W)$.cert=W}else if(G)$.cert=G;if(Q){let W=await this.loadFile(Q);if(W)$.key=W}else if(J)$.key=J;if(X){let W=await this.loadFile(X);if(W)$.ca=[W]}else if(Y)$.ca=Y;return Promise.resolve($)}catch(W){return Promise.reject(W)}}async tlsFirst($){let Z,G={servername:this.tlsName,rejectUnauthorized:!0};if(this.socket)G.socket=this.socket;if(typeof this.options.tls==="object")try{let Y=await this.loadClientCerts()||{};G=(0,d4.extend)(G,this.options.tls,Y)}catch(Y){return Promise.reject(new d4.errors.ConnectionError(Y.message,{cause:Y}))}let X=(0,d4.deferred)();try{let Y=(0,L11.connect)($.port,$.hostname,G,()=>{Y.removeAllListeners(),X.resolve(Y)});Y.on("error",(Q)=>{Z=Q}),Y.on("secureConnect",()=>{if(G.rejectUnauthorized===!1)return;if(!Y.authorized)throw Y.authorizationError}),Y.on("close",()=>{X.reject(Z),Y.removeAllListeners()}),Y.setNoDelay(!0)}catch(Y){X.reject(new d4.errors.ConnectionError(Y.message,{cause:Y}))}return X}async startTLS(){let $,Z={socket:this.socket,servername:this.tlsName,rejectUnauthorized:!0};if(typeof this.options.tls==="object")try{let X=await this.loadClientCerts()||{};Z=(0,d4.extend)(Z,this.options.tls,X)}catch(X){return Promise.reject(new d4.errors.ConnectionError(X.message,{cause:X}))}let G=(0,d4.deferred)();try{let X=(0,L11.connect)(Z,()=>{X.removeAllListeners(),G.resolve(X)});X.on("error",(Y)=>{$=Y}),X.on("secureConnect",()=>{if(Z.rejectUnauthorized===!1)return;if(!X.authorized)throw X.authorizationError}),X.on("close",()=>{G.reject($),X.removeAllListeners()})}catch(X){G.reject(new d4.errors.ConnectionError(X.message,{cause:X}))}return G}setupHandlers(){let $;this.socket.on("data",(Z)=>{return this.yields.push(Z),this.signal.resolve()}),this.socket.on("error",(Z)=>{$=Z}),this.socket.on("end",()=>{if(this.socket?.destroyed)return;this.socket?.write(new Uint8Array(0),()=>{this.socket?.end()})}),this.socket.on("close",()=>{this._closed($,!1)})}[Symbol.asyncIterator](){return this.iterate()}async*iterate(){while(!0){if(this.yields.length===0)await this.signal;let $=this.yields;this.yields=[];for(let Z=0;Z<$.length;Z++){if(this.options.debug)console.info(`> ${(0,d4.render)($[Z])}`);yield $[Z]}if(this.done)break;else if(this.yields.length===0)$.length=0,this.yields=$,this.signal=(0,d4.deferred)()}}discard(){if(this.done=!0,this.socket)try{this.socket.removeAllListeners(),this.socket.destroy()}catch{}}disconnect(){this._closed(void 0,!0).then().catch()}isEncrypted(){return this.socket instanceof L11.TLSSocket}_send($){if(this.isClosed||this.socket===void 0)return Promise.resolve();if(this.options.debug)console.info(`< ${(0,d4.render)($)}`);let Z=(0,d4.deferred)();try{this.socket.write($,(G)=>{if(G){if(this.options.debug)console.error(`!!! ${(0,d4.render)($)}: ${G}`);return Z.reject(G)}return Z.resolve()})}catch(G){if(this.options.debug)console.error(`!!! ${(0,d4.render)($)}: ${G}`);Z.reject(G)}return Z}send($){this._send($).catch((G)=>{})}async _closed($,Z=!0){if(!this.connected)return;if(this.done){this.socket?.destroy();return}if(this.closeError=$,!$&&this.socket&&Z)try{await this._send(new TextEncoder().encode(""))}catch(G){if(this.options.debug)console.log("transport close terminated with an error",G)}try{if(this.socket)this.socket.removeAllListeners(),this.socket?.destroy(),this.socket=void 0}catch(G){console.log(G)}this.done=!0,this.closedNotification.resolve(this.closeError)}closed(){return this.closedNotification}}KK.NodeTransport=Ak$;function T04($){let Z=(0,d4.deferred)();return j04.default.lookup($,{all:!0},(G,X)=>{if(G){Z.reject(G);return}let Y=[];for(let Q of X)Y.push(Q.address);if(Y.length===0)Y.push($);Z.resolve(Y)}),Z}});var kk$=_((Mk$)=>{Object.defineProperty(Mk$,"__esModule",{value:!0});Mk$.connect=I04;var Ik$=Tk$(),Rk$=jt(),qk$=jt();function I04($={}){if((0,qk$.hasWsProtocol)($))return Promise.reject(qk$.errors.InvalidArgumentError.format("servers","node client doesn't support websockets, use the 'wsconnect' function instead"));return(0,Rk$.setTransportFactory)({factory:()=>{return new Ik$.NodeTransport},dnsResolveFn:Ik$.nodeResolveHost}),Rk$.NatsConnectionImpl.connect($)}});var Sk$=_((Aw)=>{var q04=Aw&&Aw.__createBinding||(Object.create?function($,Z,G,X){if(X===void 0)X=G;var Y=Object.getOwnPropertyDescriptor(Z,G);if(!Y||("get"in Y?!Z.__esModule:Y.writable||Y.configurable))Y={enumerable:!0,get:function(){return Z[G]}};Object.defineProperty($,X,Y)}:function($,Z,G,X){if(X===void 0)X=G;$[X]=Z[G]}),M04=Aw&&Aw.__exportStar||function($,Z){for(var G in $)if(G!=="default"&&!Object.prototype.hasOwnProperty.call(Z,G))q04(Z,$,G)};Object.defineProperty(Aw,"__esModule",{value:!0});Aw.connect=void 0;var k04=kk$();Object.defineProperty(Aw,"connect",{enumerable:!0,get:function(){return k04.connect}});M04(jt(),Aw)});function bk$($){let Z=$?.connectFn??_04,G=null,X=null,Y=!1,Q=!1,J=!1,W=[];function K(){return G!==null&&!G.isClosed()&&!G.isDraining()&&!J}function U(){console.log(`[NatsProvider] fireReady: ${W.length} callbacks`);for(let H of W)try{H()}catch{}}function w(H){(async()=>{for await(let N of H.status())if(N.type==="disconnect")console.log("[NatsProvider] Disconnected"),J=!0;else if(N.type==="reconnect")console.log("[NatsProvider] Reconnected, re-firing ready callbacks"),J=!1,X=null,U()})().catch(()=>{})}async function F(H,N){let B=0;while(!Q)try{G=await Z({servers:H,timeout:C04,reconnect:!0,maxReconnectAttempts:-1,...N?{authenticator:N}:{}}),console.log(`[NatsProvider] Connected to ${G.getServer()} after ${B} attempt(s)`),X=null,J=!1,w(G),U();return}catch{B++;let E=vX(V04,S04,B-1,2,0.5);await m4(E)}}return{init(H,N){if(Y)return;Y=!0,Q=!1;let B=N?.creds?Vk$.credsAuthenticator(new TextEncoder().encode(N.creds)):void 0;F(H,B).catch(()=>{})},isConnected(){return K()},getConnection(){return K()?G:null},getJetStream(){if(!K())return null;if(!X)X=_k$.jetstream(G);return X},onReady(H){if(W.push(H),K())try{H()}catch{}},async drain(){if(Q=!0,Y=!1,X=null,J=!1,G){let H=G;G=null,await H.drain().catch(()=>{})}}}}function _04($){return Ck$.connect($)}var Vk$,Ck$,_k$,S04=100,V04=3000,C04=3000;var fk$=O(()=>{x7();Vk$=k(Pg(),1),Ck$=k(Sk$(),1),_k$=k(jB(),1)});function ry($){let Z=$?.ttlMs??60000,G=$?.maxSize??1e4,X=$?.updateRecencyOnGet??!1,Y=new Map;function Q(){if(Y.size<=G)return;let J=Date.now();for(let[W,K]of Y)if(K.expiresAt<=J)Y.delete(W);while(Y.size>G){let W=Y.keys().next().value;if(W===void 0)break;Y.delete(W)}}return{get(J){let W=Y.get(J);if(!W)return;if(W.expiresAt<=Date.now()){Y.delete(J);return}if(X)Y.delete(J),Y.set(J,W);return W.value},set(J,W){Y.delete(J),Y.set(J,{value:W,expiresAt:Date.now()+Z}),Q()},delete(J){Y.delete(J)},clear(){Y.clear()},size(){return Y.size}}}function z11($,Z){return`${$}.${Z}`}class j11{cache;constructor($){this.cache=ry({ttlMs:$?.ttlMs??b04,maxSize:$?.maxSize??f04})}async get($,Z){return this.cache.get(z11($,Z))??null}async set($,Z,G){this.cache.set(z11($,Z),G)}async invalidate($,Z){this.cache.delete(z11($,Z))}teardown(){this.cache.clear()}}var b04=600000,f04=5000;var xk$=()=>{};function bD0($,Z){return`${$}:${Z}`}function P11($){let Z=ry({ttlMs:$?.ttlMs??x04,maxSize:$?.maxSize??v04}),G=$?.getConnection,X=crypto.randomUUID(),Y=new TextEncoder,Q=new TextDecoder,J=null;function W(K,U){let w=G?.();if(!w)return;try{w.publish(vk$,Y.encode(JSON.stringify({organizationId:K,keyId:U,originId:X})))}catch(F){console.warn("[ProviderKeyCache] Publish failed (non-critical):",F)}}return{get(K,U){return Z.get(bD0(K,U))},set(K,U,w){Z.set(bD0(K,U),w)},invalidate(K,U){Z.delete(bD0(K,U)),W(K,U)},start(){if(J)return;let K=G?.();if(!K)return;J=K.subscribe(vk$),(async()=>{for await(let U of J)try{let w=JSON.parse(Q.decode(U.data));if(w.originId===X)continue;Z.delete(bD0(w.organizationId,w.keyId))}catch{}})().catch(console.error)},teardown(){J?.unsubscribe(),J=null,Z.clear()}}}var vk$="studio.ai-provider-keys.invalidate",x04=30000,v04=5000;var yk$=()=>{};class A11{options;sub=null;onCancel=null;encoder=new TextEncoder;originId=crypto.randomUUID();constructor($){this.options=$}async start($){if($)this.onCancel=$;if(this.sub)return;if(!this.onCancel)return;let Z=this.options.getConnection();if(!Z)return;this.sub=Z.subscribe("mesh.decopilot.cancel");let G=new TextDecoder;(async()=>{for await(let X of this.sub)try{let Y=JSON.parse(G.decode(X.data));if(Y.originId===this.originId)continue;this.onCancel?.(Y.taskId)}catch{}})().catch(console.error)}broadcast($){if(/[.*>\s]/.test($)){console.warn("[NatsCancelBroadcast] Invalid threadId, skipping broadcast");return}this.onCancel?.($);try{let Z=this.options.getConnection();if(!Z)return;Z.publish("mesh.decopilot.cancel",this.encoder.encode(JSON.stringify({taskId:$,originId:this.originId})))}catch(Z){console.warn("[NatsCancelBroadcast] Publish failed (non-critical):",Z)}}publishControlFrame($,Z){}async stop(){this.sub?.unsubscribe(),this.sub=null,this.onCancel=null}}var gk$=($)=>{let Z;return()=>Z??=$()},T11,I11;var hk$=O(()=>{I5();T11=gk$(()=>y8.createHistogram("decopilot.stream.encode_ms",{description:"Per-chunk JSON.stringify+encode time for decopilot stream",unit:"ms"})),I11=gk$(()=>y8.createCounter("decopilot.stream.published_chunks",{description:"Logical decopilot stream chunks published to JetStream",unit:"{chunks}"}))});function l04(){return{name:yU,subjects:[`${Gl0}.>`],storage:j3.StorageType.File,max_age:h04,max_bytes:u04,max_msgs_per_subject:d04,discard:j3.DiscardPolicy.Old,retention:j3.RetentionPolicy.Limits,duplicate_window:c04,num_replicas:1}}class dk${chunks=0;encodeMs=0;maxMs=0;bytes=0;windowStart=performance.now();constructor(){setInterval(()=>this.flush(),1e4).unref?.()}record($,Z){if(this.chunks++,this.encodeMs+=$,$>this.maxMs)this.maxMs=$;this.bytes+=Z}flush(){let $=performance.now(),Z=$-this.windowStart;if(this.chunks>0&&Z>0)console.warn(JSON.stringify({msg:"stream-encode-trace",windowMs:Math.round(Z),chunks:this.chunks,encodeMs:Math.round(this.encodeMs),pctOfLoop:+(this.encodeMs/Z*100).toFixed(1),maxChunkMs:+this.maxMs.toFixed(2),mbEncoded:+(this.bytes/1048576).toFixed(2)}));this.chunks=0,this.encodeMs=0,this.maxMs=0,this.bytes=0,this.windowStart=$}}function ck$($){let Z=uk$.headers();for(let[G,X]of Object.entries($))Z.set(G,X);return Z}function p04($,Z){let G=0;return{publish(X,Y,Q,J){X.publish(Y,Q,J?{headers:J}:void 0).catch((W)=>{if(G++,g04().add(1,{"org.id":Z??"unknown"}),G===1||G%100===0)console.warn(`[Decopilot] JetStream publish failed for thread ${$} (${G} total):`,W)})},get errorCount(){return G}}}class R11{options;js=null;jsm=null;constructor($){this.options=$}async init(){let $=this.options.getConnection();if(!$){console.log("[Decopilot] StreamBuffer.init skipped: NATS not connected yet");return}let Z=this.options.getJetStreamManager?await this.options.getJetStreamManager():await j3.jetstreamManager($),G=l04();try{await Z.streams.info(yU),await Z.streams.update(yU,G)}catch(X){if(X instanceof Error&&X.message.includes("stream not found"))await Z.streams.add(G);else if(X instanceof Error&&/can ?not change.*storage|storage type/i.test(X.message))await Z.streams.delete(yU),await Z.streams.add(G);else throw X}this.js=this.options.getJetStream(),this.jsm=Z,console.log(`[Decopilot] StreamBuffer.init ${this.js?"ready":"degraded (js=null)"}`)}pump($,Z,G,X){let Y=this.js;if(!Y){console.warn(`[Decopilot] pump: JetStream client unavailable for thread ${Z}; chunks NOT published to NATS`);return}let Q=p04(Z,X),J=!1,W=()=>{if(J)return;J=!0;let U=S8$(Z);Y.publish(U.subject,U.data).catch(()=>{})};G.addEventListener("abort",W,{once:!0});let K=(U)=>{let w=performance.now(),F=Yl0(U,{runId:Z}),H=performance.now()-w;if(T11().record(H),I11().add(1,{"org.id":X??"unknown"}),n04?.record(H,F.reduce((N,B)=>N+B.data.length,0)),F.length===0){console.warn(`[Decopilot] dropping oversized stream chunk for thread ${Z}`);return}for(let N of F)Q.publish(Y,N.subject,N.data,N.headers?ck$(N.headers):void 0)};(async()=>{let U=$.getReader(),w=0,F=0;try{while(!0){let{done:H,value:N}=await U.read();if(H)break;if(K(N),F++,++w>=64)w=0,await new Promise((B)=>setImmediate(B))}}catch(H){console.warn(`[Decopilot] stream pump error for thread ${Z}:`,H?.message??H)}finally{if(U.releaseLock(),W(),i04)console.warn(JSON.stringify({msg:"decopilot-stream-diag",event:"pump-done",taskId:Z,publishedChunks:F,publishErrors:Q.errorCount}))}})()}async publishRawChunk($,Z,G){let X=this.js;if(!X)return!1;let Y=performance.now(),Q=Yl0(Z,{runId:$,dedup:G});if(T11().record(performance.now()-Y),I11().add(1),Q.length===0)return console.warn(`[Decopilot] dropping oversized raw chunk for thread ${$} (> MAX_CHUNKED_BYTES)`),!0;for(let J of Q)await X.publish(J.subject,J.data,{...J.headers?{headers:ck$(J.headers)}:{},...J.msgId?{msgID:J.msgId}:{}});return!0}async publishDone($,Z,G){let X=this.js;if(!X)return!1;let Y=k8$({runId:$,fenceToken:Z,finalSeq:G});return await X.publish(Y.subject,Y.data,{msgID:Y.msgId}),!0}async createTailStream($,Z,G){let X=this.js;if(!X)return console.warn(`[Decopilot] createTailStream: JetStream client unavailable for thread ${$}; no live tail`),null;let Y=G?.deliverPolicy==="new"?j3.DeliverPolicy.New:j3.DeliverPolicy.All,Q=G?.closeOnDone??!1,J=YN($),W;try{W=await(await X.consumers.get(yU,{filter_subjects:J,deliver_policy:Y})).consume()}catch(E){return console.warn("[Decopilot] JetStream tail unavailable (non-critical):",E?.message??E),null}let w=T50({messages:async function*(){try{for await(let E of W)yield{subject:E.subject,data:E.data,headers:E.headers}}finally{W.stop()}}(),onCancel:()=>W.stop()}).pipeThrough(P50()).pipeThrough(A50()).getReader(),F=!1,H=()=>{if(F)return;F=!0;try{w.releaseLock()}catch{}},N=!1,B=()=>{if(N)return;N=!0,W.stop(),w.cancel().catch(()=>{}),H()};return Z?.addEventListener("abort",B,{once:!0}),new ReadableStream({async pull(E){for(;;){let{done:D,value:L}=await w.read();if(D){B(),E.close();return}let z=L;if(z.kind==="done"){if(Q){B(),E.close();return}continue}E.enqueue(z.chunk);return}},cancel(){B()}})}purge($){if(!this.jsm)return;this.jsm.streams.purge(yU,{filter:YN($)}).catch(()=>{})}teardown(){this.js=null,this.jsm=null}}var j3,uk$,y04=($)=>{let Z;return()=>Z??=$()},g04,h04=86400000000000,c04=120000000000,u04=4294967296,d04=500000,m04,i04,n04;var lk$=O(()=>{Jl0();Wl0();Ql0();I5();hk$();j3=k(jB(),1),uk$=k(Pg(),1),g04=y04(()=>y8.createCounter("decopilot.stream.publish_errors",{description:"Number of JetStream publish failures for decopilot stream chunks",unit:"{errors}"}));m04=process.env.STREAM_ENCODE_TRACE==="1",i04=process.env.DECOPILOT_STREAM_TRACE==="1";n04=m04?new dk$:null});import{z as $8}from"zod";var mk$,ik$,UK,q11,nk$,pk$,tk$,rk$,t04,ok$,ak$,sk$,ek$,$S$,r04,ZS$,K0Z,o04,a04=($)=>{return $.issues.map((Z)=>{return`${Z.path.length>0?Z.path.join("."):"frame"}: ${Z.message}`}).join("; ")},GS$=($)=>{return new TextEncoder().encode(JSON.stringify($))},XS$=($)=>{let Z;try{Z=JSON.parse(new TextDecoder().decode($))}catch(Q){throw TypeError("malformed JSON in tunnel frame",{cause:Q})}if(Z===null||typeof Z!=="object"||Array.isArray(Z))throw TypeError("frame must be an object");if(!("type"in Z))throw TypeError("frame type missing");let G=Z.type,X=typeof G==="string"?o04[G]:void 0;if(!X)throw TypeError(`unknown frame type: ${String(G)}`);let Y=X.safeParse(Z);if(!Y.success)throw TypeError(`invalid tunnel frame: ${a04(Y.error)}`);return Y.data};var YS$=O(()=>{mk$=$8.string().regex(/^[A-Za-z0-9_-]*$/u),ik$=$8.array($8.tuple([$8.string(),$8.string()])),UK=$8.string().regex(/^[A-Za-z0-9_-]+$/u),q11=$8.string().min(1),nk$=$8.object({type:$8.literal("request.start"),protocol:$8.literal("tunnel.v1"),requestId:UK,method:$8.string().min(1),url:$8.string().min(1),headers:ik$,replySubject:q11,bodySubject:q11.optional(),abortSubject:q11,deadlineUnixMs:$8.number().int().nonnegative().optional()}),pk$=$8.object({type:$8.literal("request.chunk"),requestId:UK,seq:$8.number().int().nonnegative(),data:mk$}),tk$=$8.object({type:$8.literal("request.end"),requestId:UK,seq:$8.number().int().nonnegative()}),rk$=$8.object({type:$8.literal("request.error"),requestId:UK,code:$8.string().min(1),message:$8.string()}),t04=$8.union([pk$,tk$,rk$]),ok$=$8.object({type:$8.literal("response.ack"),requestId:UK}),ak$=$8.object({type:$8.literal("response.start"),requestId:UK,status:$8.number().int().min(100).max(599),statusText:$8.string().optional(),headers:ik$}),sk$=$8.object({type:$8.literal("response.chunk"),requestId:UK,seq:$8.number().int().nonnegative(),data:mk$}),ek$=$8.object({type:$8.literal("response.end"),requestId:UK,seq:$8.number().int().nonnegative()}),$S$=$8.object({type:$8.literal("response.error"),requestId:UK,code:$8.string().min(1),message:$8.string()}),r04=$8.union([ok$,ak$,sk$,ek$,$S$]),ZS$=$8.object({type:$8.literal("abort"),requestId:UK,reason:$8.string().optional()}),K0Z=$8.union([nk$,t04,r04,ZS$]),o04={"request.start":nk$,"request.chunk":pk$,"request.end":tk$,"request.error":rk$,"response.ack":ok$,"response.start":ak$,"response.chunk":sk$,"response.end":ek$,"response.error":$S$,abort:ZS$}});var s04=($)=>{return $.replaceAll("+","-").replaceAll("/","_").replaceAll("=","")},e04=($)=>{let Z=$.replaceAll("-","+").replaceAll("_","/"),G=(4-Z.length%4)%4;return Z+"=".repeat(G)},$14=($)=>{let Z=[];for(let G=0;G<$.length;G+=32768)Z.push(String.fromCharCode(...$.subarray(G,G+32768)));return Z.join("")},Z14=($)=>{let Z=new Uint8Array($.length);for(let G=0;G<$.length;G+=32768){let X=$.slice(G,G+32768);Z.set(Uint8Array.from(X,(Y)=>Y.charCodeAt(0)),G)}return Z},QS$=($)=>{return s04(btoa($14($)))},JS$=($)=>{return Z14(atob(e04($)))},G14;var WS$=O(()=>{G14=class G14{#$=[];#Z;#G=!1;#Q=new Set;push($){if(this.#G)return;let Z=this.#Y();if(Z){Z.resolve({value:$,done:!1});return}this.#$.push($)}close(){if(this.#G)return;this.#G=!0,this.#X()}fail($){if(this.#G)return;this.#Z=$,this.#G=!0,this.#J($)}[Symbol.asyncIterator](){let $=!1,Z=new Set;return{next:()=>{if($)return Promise.resolve({value:void 0,done:!0});if(this.#$.length>0)return Promise.resolve({value:this.#$.shift(),done:!1});if(this.#Z)return Promise.reject(this.#Z);if(this.#G)return Promise.resolve({value:void 0,done:!0});return new Promise((G,X)=>{let Y;Y={resolve:(Q)=>{Z.delete(Y),G(Q)},reject:(Q)=>{Z.delete(Y),X(Q)}},Z.add(Y),this.#Q.add(Y)})},return:()=>{$=!0;for(let G of Z)this.#Q.delete(G),G.resolve({value:void 0,done:!0});return Z.clear(),Promise.resolve({value:void 0,done:!0})}}}#Y(){for(let $ of this.#Q)return this.#Q.delete($),$;return}#X(){for(let $ of this.#Q)$.resolve({value:void 0,done:!0});this.#Q.clear()}#J($){for(let Z of this.#Q)Z.reject($);this.#Q.clear()}}});function*H14($,Z){for(let G=0;G<$.length;G+=Z)yield $.subarray(G,G+Z)}class j14{maxSize;ttlMs;now;#$=new Map;constructor($,Z,G=Date.now){this.maxSize=$;this.ttlMs=Z;this.now=G}get($){let Z=this.#$.get($);if(!Z)return;if(Z.expiresAt<=this.now()){this.#$.delete($);return}return Z.value}has($){return this.get($)!==void 0}set($,Z){let G=this.now();this.prune(G),this.#$.delete($),this.#$.set($,{value:Z,expiresAt:G+this.ttlMs});while(this.#$.size>this.maxSize){let X=this.#$.keys().next().value;if(X===void 0)return;this.#$.delete(X)}}take($){let Z=this.get($);return this.#$.delete($),Z}clear(){this.#$.clear()}prune($){for(let[Z,G]of this.#$)if(G.expiresAt<=$)this.#$.delete(Z)}}var X14=30000,Y14=1000,Q14=65536,hQ,J14=($)=>{return"connection"in $},W14=($)=>{let Z=J14($)?$:{connection:$};return{connection:Z.connection,timeoutMs:Z.timeoutMs??0,firstFrameTimeoutMs:Z.firstFrameTimeoutMs??X14,idleTimeoutMs:Z.idleTimeoutMs??0,republishIntervalMs:Z.republishIntervalMs??Y14,maxChunkBytes:Z.maxChunkBytes??Q14,diagnostics:Z.diagnostics}},KS$=($)=>{return Array.from($.entries())},K14=($)=>{return $!==void 0&&!($ instanceof Headers)&&typeof $!=="function"&&typeof $[Symbol.iterator]==="function"},U14=($,Z,G)=>{if(K14(Z?.headers))return Array.from(Z?.headers,([X,Y])=>[String(X),String(Y)]);if($ instanceof Request)return KS$(G.headers);return KS$(G.headers)},US$=($)=>{let Z=new Headers;for(let[G,X]of $)Z.append(G,X);return Z},w14=()=>{return crypto.randomUUID().replaceAll("-","")},F14=($)=>{try{$?.unsubscribe()}catch{}},N14=($)=>{if(!Number.isSafeInteger($)||$<1)throw TypeError("maxChunkBytes must be a positive safe integer")},B14=($,Z)=>{return $==="HEAD"||Z===204||Z===205||Z===304},GB=($,Z,G)=>{$.publish(Z,GS$(G))},O14=($)=>{return $.type.startsWith("response.")},M11=($)=>{let Z=$.reason;if(Z instanceof Error)return Z.message;if(typeof Z==="string")return Z;return"aborted"},E14=($)=>{if($==="idle")return new hQ("tunnel_idle_timeout","no response frame within idleTimeoutMs");return new hQ("tunnel_no_first_frame","no response frame arrived before firstFrameTimeoutMs")},wS$=async($,Z,G,X,Y="first_frame")=>{while(!0){let Q,J;try{let W=await Promise.race([$.next(),new Promise((U,w)=>{if(X.aborted){w(X.reason);return}let F=()=>w(X.reason);J=()=>{X.removeEventListener("abort",F)},X.addEventListener("abort",F,{once:!0})}),...G>0?[new Promise((U,w)=>{Q=setTimeout(()=>{w(E14(Y))},G)})]:[]]);if(W.done)return{value:void 0,done:!0};let K=XS$(W.value.data);if(!O14(K)||K.requestId!==Z)continue;return{value:K,done:!1}}finally{if(J?.(),Q)clearTimeout(Q)}}},D14=async($)=>{let Z=!1;while(!0){let G=await wS$($.iterator,$.requestId,Z?0:$.firstFrameTimeoutMs,$.signal);if(G.done)throw new hQ("tunnel_response_closed","response subscription closed before response.start");if(!Z)Z=!0,$.onFirstResponseFrame();if(G.value.type==="response.ack")continue;if(G.value.type==="response.start")return G.value;if(G.value.type==="response.error")throw new hQ(G.value.code,G.value.message);throw new hQ("tunnel_unexpected_response_frame",`expected response.start, got ${G.value.type}`)}},L14=async($)=>{let Z=$.body.getReader(),G=0,X=!1,Y=()=>{X=!0,Z.cancel($.signal.reason).catch(()=>{})};try{if($.signal.aborted){Y();return}$.signal.addEventListener("abort",Y,{once:!0});while(!0){let{done:Q,value:J}=await Z.read();if(X)return;if(Q){GB($.connection,$.subject,{type:"request.end",requestId:$.requestId,seq:G});return}for(let W of H14(J,$.maxChunkBytes)){if(X)return;GB($.connection,$.subject,{type:"request.chunk",requestId:$.requestId,seq:G,data:QS$(W)}),G++}}}catch(Q){if(X)return;GB($.connection,$.subject,{type:"request.error",requestId:$.requestId,code:"tunnel_request_body_error",message:Q instanceof Error?Q.message:String(Q)})}finally{$.signal.removeEventListener("abort",Y),Z.releaseLock()}},z14=($)=>{return new ReadableStream({async pull(Z){while(!0)try{let G=await wS$($.iterator,$.requestId,$.idleTimeoutMs,$.signal,"idle");if(G.done){Z.error(new hQ("tunnel_response_closed","response subscription closed before response.end")),$.cleanup();return}let X=G.value;if(X.type==="response.ack"||X.type==="response.start")continue;if(X.type==="response.chunk"){Z.enqueue(JS$(X.data));return}if(X.type==="response.end"){Z.close(),$.cleanup();return}Z.error(new hQ(X.code,X.message)),$.cleanup();return}catch(G){Z.error(G),$.cleanup();return}},cancel(){GB($.connection,$.abortSubject,{type:"abort",requestId:$.requestId,reason:"response_body_cancelled"}),$.cleanup()}},{highWaterMark:0})},XB=($)=>{let Z=W14($);return N14(Z.maxChunkBytes),async(G,X)=>{let Y=xM$(G),Q=new Request(G,X),J=w14(),W=vM$(Y.hostname,J),K=new AbortController,U=new AbortController,w=!1,F,H,N,B,E=!1,D=(P=new hQ("tunnel_closed","tunnel request closed"))=>{if(w)return;if(w=!0,F14(F),Q.body&&!E)Q.body.cancel(P).catch(()=>{});if(U.abort(P),K.abort(P),N)clearInterval(N);if(B)clearTimeout(B);Q.signal.removeEventListener("abort",L)},L=()=>{let P=new hQ("tunnel_aborted",M11(Q.signal));GB(Z.connection,W.abort,{type:"abort",requestId:J,reason:M11(Q.signal)}),K.abort(P),D(P)};if(Q.signal.aborted)throw new hQ("tunnel_aborted",M11(Q.signal));if(F=Z.connection.subscribe(W.reply),H=F[Symbol.asyncIterator](),Q.signal.addEventListener("abort",L,{once:!0}),Z.timeoutMs>0)B=setTimeout(()=>{let P=new hQ("tunnel_timeout",`tunnel request timed out after ${Z.timeoutMs}ms`);GB(Z.connection,W.abort,{type:"abort",requestId:J,reason:"tunnel_timeout"}),K.abort(P),D(P)},Z.timeoutMs);let z={type:"request.start",protocol:"tunnel.v1",requestId:J,method:Q.method,url:Y.pathWithSearch,headers:U14(G,X,Q),replySubject:W.reply,abortSubject:W.abort,...Q.body?{bodySubject:W.body}:{},...Z.timeoutMs>0?{deadlineUnixMs:Date.now()+Z.timeoutMs}:{}};GB(Z.connection,W.request,z),N=Z.republishIntervalMs>0?setInterval(()=>{if(!E)GB(Z.connection,W.request,z)},Z.republishIntervalMs):void 0;let j=()=>{if(E)return;E=!0,(Q.body?L14({connection:Z.connection,subject:W.body,requestId:J,body:Q.body,maxChunkBytes:Z.maxChunkBytes,signal:U.signal}):void 0)?.catch((A)=>{Z.diagnostics?.({event:"request_body_error",requestId:J,subject:W.body,error:A instanceof Error?A.message:String(A)})})};try{let P=await D14({iterator:H,requestId:J,firstFrameTimeoutMs:Z.firstFrameTimeoutMs,signal:K.signal,onFirstResponseFrame:()=>{if(N)clearInterval(N);j()}});if(B14(Q.method,P.status))return D(),new Response(null,{status:P.status,statusText:P.statusText,headers:US$(P.headers)});return new Response(z14({connection:Z.connection,abortSubject:W.abort,iterator:H,requestId:J,idleTimeoutMs:Z.idleTimeoutMs,signal:K.signal,cleanup:D}),{status:P.status,statusText:P.statusText,headers:US$(P.headers)})}catch(P){throw D(P instanceof Error?P:Error(String(P))),P}}};var FS$=O(()=>{YS$();WS$();SD0();hQ=class hQ extends Error{code;constructor($,Z,G){super(`${$}: ${Z}`,G);this.code=$;this.name="TunnelTransportError"}}});var fD0=O(()=>{FS$()});function HS$($){let Z=$.createFetch??P14,G=$.timeoutMs??2000;return async(X)=>{try{let Y=$.getConnection();if(!Y)return k11;let Q=L3(X),W=await Z(Y,G)(`tunnel://${Q}/api/links/status`,{method:"GET"});if(!W.ok)return k11;let K=await W.json();return{online:!0,hostname:K.hostname,capabilities:K.capabilities??[],cliVersion:K.cliVersion}}catch{return k11}}}var k11,P14=($,Z)=>XB({connection:$,firstFrameTimeoutMs:Z});var NS$=O(()=>{fD0();Lt();k11={online:!1,capabilities:[]}});async function*A14($){if(!$.body){yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};return}let Z=$.body.getReader(),G=!1;try{yield{headers:{status:$.status,headers:Object.fromEntries($.headers.entries())}};while(!0){let{done:X,value:Y}=await Z.read();if(X){G=!0;return}yield{data:Buffer.from(Y).toString("base64")}}}finally{try{if(!G)await Z.cancel()}catch{}finally{Z.releaseLock()}}}function BS$($){let Z=$.createFetch??((G)=>XB({connection:G,idleTimeoutMs:T14}));return async function*(X,Y,Q){let J=$.getConnection();if(!J)throw Error("link_unavailable: NATS unavailable");let W=L3(X),K=Z(J),U={method:Y.method,headers:Y.headers,signal:Q?.signal};if(Y.body!=null)U.body=Y.body;let w=await K(`tunnel://${W}${Y.path}`,U);yield*A14(w)}}var T14=45000;var OS$=O(()=>{fD0();Lt()});import{z as P3}from"zod";function ES$($){return JSON.stringify($)}var y0Z;var DS$=O(()=>{y0Z=P3.discriminatedUnion("type",[P3.object({type:P3.literal("cancel"),runId:P3.string()}),P3.object({type:P3.literal("cancel_req"),reqId:P3.string()}),P3.object({type:P3.literal("keep_alive")}),P3.object({type:P3.literal("shutdown")})])});function LS$($){let Z=$.createFetch??((G)=>XB({connection:G,idleTimeoutMs:I14}));return{async publish(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=L3(G),K=await Z(Q)(`tunnel://${J}/api/links/work`,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel work publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}function zS$($){let Z=$.createFetch??XB;return{async publishControlFrame(G,X,Y){let Q=$.getConnection();if(!Q)throw Error("link_unavailable: NATS unavailable");let J=L3(G),K=await Z(Q)(`tunnel://${J}/api/links/control`,{method:"POST",headers:{"content-type":"application/json"},body:ES$(X),signal:Y?.signal});if(!K.ok){let U=await K.text().catch(()=>"");throw Error(`tunnel control publish failed (${K.status})${U?`: ${U}`:""}`)}await K.body?.cancel().catch(()=>{})}}}var I14=45000;var jS$=O(()=>{fD0();DS$();Lt()});function PS$($,Z){switch($.type){case"START":{let G={type:"RUN_STARTED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,runConfig:$.runConfig,podId:$.podId};if(Z?.status.tag==="running")return[{type:"PREVIOUS_RUN_ABORTED",taskId:$.taskId,orgId:Z.orgId},G];return[G]}case"STEP_DONE":{if(Z?.status.tag!=="running")return[];return[{type:"STEP_COMPLETED",taskId:$.taskId,orgId:Z.orgId,stepCount:Z.status.stepCount+1}]}case"FINISH":{if(Z==null||Z.status.tag!=="running")return[];let{stepCount:G}=Z.status;if($.threadStatus==="completed")return[{type:"RUN_COMPLETED",taskId:$.taskId,orgId:Z.orgId,stepCount:G}];if($.threadStatus==="requires_action")return[{type:"RUN_REQUIRES_ACTION",taskId:$.taskId,orgId:Z.orgId,stepCount:G}];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:"error"}]}case"CANCEL":{if(Z?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:"cancelled"}]}case"RESUME":{if(Z?.status.tag==="running")return[];return[{type:"RUN_RESUMED",taskId:$.taskId,orgId:$.orgId,userId:$.userId,abortController:$.abortController,podId:$.podId}]}case"FORCE_FAIL":{if($.reason==="ghost")return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z?.orgId??$.orgId,reason:$.reason}];if(Z?.status.tag!=="running")return[];return[{type:"RUN_FAILED",taskId:$.taskId,orgId:Z.orgId,reason:$.reason}]}}}function AS$($,Z,G=new Date){switch(Z.type){case"RUN_STARTED":return{taskId:Z.taskId,orgId:Z.orgId,userId:Z.userId,status:{tag:"running",abortController:Z.abortController,stepCount:0,startedAt:G}};case"RUN_RESUMED":return{taskId:Z.taskId,orgId:Z.orgId,userId:Z.userId,status:{tag:"running",abortController:Z.abortController,stepCount:0,startedAt:G}};case"STEP_COMPLETED":if($?.status.tag!=="running")return $;return{...$,status:{...$.status,stepCount:Z.stepCount}};case"RUN_COMPLETED":return;case"RUN_REQUIRES_ACTION":return;case"RUN_FAILED":return;case"PREVIOUS_RUN_ABORTED":return}}async function TS$($,Z,G,X){let{storage:Y,sseHub:Q}=X,J=await Y.get($,Z);Q.emit(Z,zJ($,G,{virtualMcpId:J?.virtual_mcp_id??void 0,createdBy:J?.created_by,triggerId:J?.trigger_id,title:J?.title,branch:J?.branch??null,createdAt:J?.created_at,updatedAt:J?.updated_at})),Q.emit(Z,ac($,G))}async function q14($,Z){let{storage:G,sseHub:X}=Z;switch($.type){case"RUN_STARTED":{await G.update($.taskId,$.orgId,{status:"in_progress",run_config:$.runConfig??null,run_started_at:new Date().toISOString(),last_progress_at:null,failure_reason:null,failure_kind:null});let Y=await G.get($.taskId,$.orgId);X.emit($.orgId,zJ($.taskId,"in_progress",{virtualMcpId:Y?.virtual_mcp_id??void 0,createdBy:Y?.created_by,triggerId:Y?.trigger_id,title:Y?.title,branch:Y?.branch??null,createdAt:Y?.created_at,updatedAt:Y?.updated_at}));return}case"RUN_RESUMED":{await G.update($.taskId,$.orgId,{run_started_at:new Date().toISOString()});let Y=await G.get($.taskId,$.orgId);X.emit($.orgId,zJ($.taskId,"in_progress",{virtualMcpId:Y?.virtual_mcp_id??void 0,createdBy:Y?.created_by,triggerId:Y?.trigger_id,title:Y?.title,branch:Y?.branch??null,createdAt:Y?.created_at,updatedAt:Y?.updated_at}));return}case"STEP_COMPLETED":X.emit($.orgId,e00($.taskId,$.stepCount));return;case"RUN_COMPLETED":await TS$($.taskId,$.orgId,"completed",Z);return;case"RUN_REQUIRES_ACTION":await TS$($.taskId,$.orgId,"requires_action",Z);return;case"RUN_FAILED":{if($.reason==="ghost"){if(!await G.forceFailIfInProgress($.taskId,$.orgId))return;await G.update($.taskId,$.orgId,{run_config:null,run_started_at:null})}else await G.update($.taskId,$.orgId,{status:"failed",run_config:null,run_started_at:null,...$.reason==="reaped"?{failure_reason:R14,failure_kind:"stall"}:{}});let Y=await G.get($.taskId,$.orgId);X.emit($.orgId,zJ($.taskId,"failed",{virtualMcpId:Y?.virtual_mcp_id??void 0,createdBy:Y?.created_by,triggerId:Y?.trigger_id,title:Y?.title,branch:Y?.branch??null,createdAt:Y?.created_at,updatedAt:Y?.updated_at})),X.emit($.orgId,ac($.taskId,"failed"));return}case"PREVIOUS_RUN_ABORTED":return}}async function IS$($,Z){for(let{event:G}of $)await q14(G,Z)}var R14="Run stalled \u2014 no progress within the idle timeout window";var RS$=O(()=>{$6()});function qS$($){return $.now-$.lastProgressAt>$.idleTimeoutMs}function MS$($){return Math.max($.persistedLastProgressAt??Number.NEGATIVE_INFINITY,$.currentRunStartedAt)}class S11{deps;clock;states=new Map;reaperTimer=null;constructor($,Z=()=>new Date){this.deps=$;this.clock=Z;this.reaperTimer=setInterval(()=>{this.reapStaleRuns().catch((G)=>{console.error("[RunRegistry] Reaper sweep failed",G)})},M14)}async execute($){let Z=this.dispatch($);return await this.react(Z),Z}dispatch($){let Z=this.states.get($.taskId),G=PS$($,Z),X=[];for(let Y of G){let Q=this.states.get(Y.taskId);if(Y.type==="PREVIOUS_RUN_ABORTED"||Y.type==="RUN_FAILED"){if(Q?.status.tag==="running")Q.status.abortController.abort()}let J=AS$(Q,Y,this.clock());if(J===void 0)this.states.delete(Y.taskId);else this.states.set(Y.taskId,J);if(X.push({event:Y,state:J}),k14.has(Y.type))SS$().add(1,{"org.id":Y.orgId});else if(S14.has(Y.type)&&Q?.status.tag==="running")SS$().add(-1,{"org.id":Y.orgId})}return X}react($){return IS$($,this.deps)}getAbortSignal($){let Z=this.states.get($);if(Z?.status.tag==="running")return Z.status.abortController.signal;return null}isRunning($){return this.states.get($)?.status.tag==="running"}async stopAll(){for(let[,$]of this.states)if($.status.tag==="running")$.status.abortController.abort();this.states.clear()}dispose(){if(this.reaperTimer)clearInterval(this.reaperTimer),this.reaperTimer=null}async reapStaleRuns(){let $=this.clock().getTime(),Z=[...this.states].filter(([,G])=>G.status.tag==="running");for(let[G,X]of Z){if(this.states.get(G)?.status.tag!=="running")continue;let Q;try{let W=await this.deps.storage.getProgress(G,X.orgId);Q=MS$({persistedLastProgressAt:W?.lastProgressAt??null,currentRunStartedAt:X.status.startedAt.getTime()})}catch(W){console.warn(`[RunRegistry] Reaper progress read failed for ${G}; skipping`,W);continue}if(!qS$({lastProgressAt:Q,now:$,idleTimeoutMs:kS$}))continue;let J=await this.deps.storage.get(G,X.orgId).catch(()=>null);if(J&&J.status!=="in_progress"){let W=this.states.get(G);if(W?.status.tag==="running")W.status.abortController.abort();this.states.delete(G);continue}console.warn(`[RunRegistry] Reaping stuck run for thread ${G} (idle > ${kS$/60000}m) ...`),V14().add(1,{"org.id":X.orgId,reason:"idle_timeout"}),await this.execute({type:"FORCE_FAIL",taskId:G,reason:"reaped"}).catch((W)=>{console.error("[RunRegistry] Reaper execute failed",W)})}}}var M14=300000,kS$=600000,k14,S14,VS$=($)=>{let Z;return()=>Z??=$()},SS$,V14;var CS$=O(()=>{RS$();I5();k14=new Set(["RUN_STARTED","RUN_RESUMED"]),S14=new Set(["RUN_COMPLETED","RUN_FAILED","RUN_REQUIRES_ACTION","PREVIOUS_RUN_ABORTED"]),SS$=VS$(()=>y8.createUpDownCounter("decopilot.stream.inflight",{description:"Number of in-flight decopilot stream requests",unit:"{requests}"})),V14=VS$(()=>y8.createCounter("decopilot.run.reaped",{description:"Number of decopilot runs force-failed by the progress-based reaper",unit:"{runs}"}))});function xD0($,Z,G,X){if(!X)return!1;return $.emit(Z,zJ(G,X.status,{title:X.title??void 0,virtualMcpId:X.virtual_mcp_id??void 0,createdBy:X.created_by??void 0,triggerId:X.trigger_id??null,branch:X.branch??null,createdAt:X.created_at,updatedAt:X.updated_at})),!0}var _S$=O(()=>{$6()});class V11{storage;options;timer=null;constructor($,Z={}){this.storage=$;this.options=Z}start(){if(this.timer)return;let $=this.options.intervalMs??300000;this.timer=setInterval(()=>{this.runOnce()},$)}async runOnce(){let $=this.options.staleAfterMs??3600000;try{let Z=await this.storage.sweepAbandoned($);if(Z>0)console.log(`[async-research-sweeper] marked ${Z} stale jobs as abandoned`);return Z}catch(Z){return console.error("[async-research-sweeper] sweep failed",Z),0}}dispose(){if(this.timer)clearInterval(this.timer),this.timer=null}}import{readdir as C14,rm as vD0}from"fs/promises";import{join as yD0}from"path";async function gD0($){let Z=new Date;Z.setUTCDate(Z.getUTCDate()-_14),Z.setUTCHours(0,0,0,0);let G=0;try{let X=await tV($);for(let Y of X)if(/^\d{4}$/.test(Y))G+=await bS$($,Y,Z);else if(!Y.startsWith(".")){let Q=yD0($,Y),J=await tV(Q);for(let K of J){if(!/^\d{4}$/.test(K))continue;G+=await bS$(Q,K,Z)}if((await tV(Q)).length===0)await vD0(Q,{recursive:!0,force:!0})}}catch(X){console.warn("monitoring retention cleanup failed:",X)}return G}async function bS$($,Z,G){let X=0,Y=yD0($,Z),Q=await tV(Y);for(let W of Q){if(!/^\d{2}$/.test(W))continue;let K=yD0(Y,W),U=await tV(K);for(let F of U){if(!/^\d{2}$/.test(F))continue;let H=new Date(`${Z}-${W}-${F}T00:00:00Z`);if(isNaN(H.getTime()))continue;if(H<G){let N=yD0(K,F);await vD0(N,{recursive:!0,force:!0}),X++}}if((await tV(K)).length===0)await vD0(K,{recursive:!0,force:!0})}if((await tV(Y)).length===0)await vD0(Y,{recursive:!0,force:!0});return X}async function tV($){try{return(await C14($)).filter((G)=>!G.startsWith("."))}catch{return[]}}var _14=30;var C11=()=>{};import{DBOS as _11,SchedulerMode as b14}from"@dbos-inc/dbos-sdk";async function x14(){let $=[uQ(),oV(),HK()],Z=0;for(let G of $)try{Z+=await gD0(G)}catch(X){console.error("[monitoring-retention] cleanup failed:",X)}return console.log(`[monitoring-retention] deleted ${Z} day-dir(s) across ${$.length} signal dir(s)`),{deleted:Z,dirs:$.length}}async function v14($,Z){await _11.runStep(()=>x14(),{name:"monitoringRetention"})}function xS$(){if(fS$)return;fS$=!0;let $=_11.registerWorkflow(v14,{name:"monitoringRetentionWorkflow"});_11.registerScheduled($,{name:"monitoringRetentionWorkflow",crontab:f14,mode:b14.ExactlyOncePerIntervalWhenActive})}var f14="23 4 * * *",fS$=!1;var vS$=O(()=>{yX();C11()});function yS$($){return async(Z,G)=>{let X=await $.db.selectFrom("member").innerJoin("organization","organization.id","member.organizationId").select(["member.role","organization.id as orgId","organization.slug as orgSlug","organization.name as orgName"]).where("member.userId","=",G).where("member.organizationId","=",Z).executeTakeFirst();if(!X)return console.warn(`[automationContextFactory] User ${G} not found in org ${Z} \u2014 returning null`),null;let Y=await uH.create();Y.auth.user={id:G,role:X.role},Y.organization={id:X.orgId,slug:X.orgSlug,name:X.orgName};let Q=await Nc0($.db,Z,X.role);return Y.boundAuth=Hc0({auth:Y.authInstance,headers:new Headers,role:X.role,permissions:Q,userId:G}),Y.access=new OE(G,void 0,Y.boundAuth,X.role,"self"),U40(Y,{id:X.orgId,slug:X.orgSlug}),Y}}var gS$=O(()=>{EE();im()});function y14(){return{services:[{name:"Postgres",status:"pending",port:0},{name:"NATS",status:"pending",port:0}],migrationsStatus:"pending",serverUrl:null,logs:[]}}function h14(){for(let $ of g14)$()}function hS$($){let Z=[...b11.logs,$];b11={...b11,logs:Z.length>500?Z.slice(-500):Z},h14()}function f11(){return c14}var b11,g14,c14=!1;var x11=O(()=>{b11=y14(),g14=new Set});import{EventEmitter as u14}from"events";var v11;var cS$=O(()=>{x11();v11=new u14;v11.on("request",($)=>{hS$($)})});function uS$(){return async($,Z)=>{let G=Date.now(),X=$.req.method,Y=$.req.path;if(Y==="/api/auth/get-session"||Y.includes("favicon")){await Z();return}let Q="",J=!1;if(Y.startsWith("/mcp")&&X==="POST"){J=!0;try{if($.req.header("Content-Type")?.includes("application/json")){let H=await $.req.raw.clone().json();if(H.method==="tools/call"&&H.params?.name){let N=oy(H.params.name),B=H.params.arguments||{},E=Object.keys(B).map((L)=>oy(L)),D=E.length>0?E.slice(0,3).join(",")+(E.length>3?"\u2026":""):"";Q=`${s4.tool}${N}${s4.dim}(${D})${s4.reset}`}else if(H.method)Q=`${s4.dim}${oy(H.method)}${s4.reset}`}}catch{}}let W=oy(Y);if(Y.startsWith("/mcp/conn_")){let w=Y.split("/")[2]??"";W=`/mcp/${s4.mcp}${oy(w.slice(0,12))}\u2026${s4.reset}`}else if(Y==="/mcp")W=`${s4.mcp}/mcp${s4.reset}`;else if(Y==="/mcp/registry")W=`${s4.mcp}/mcp/registry${s4.reset}`;let K=l14(X),U=J?"\u25C0":"\u2190";if(!f11())console.log(`${s4.dim}${U}${s4.reset} ${K}${X}${s4.reset} ${W}${Q?` ${Q}`:""}`);try{await Z()}finally{let w=Date.now()-G,F=$.res.status,H=d14(F),N=w<1000?`${w}ms`:`${(w/1000).toFixed(1)}s`,B=J?"\u25B6":"\u2192";if(!f11())console.log(`${s4.dim}${B}${s4.reset} ${K}${X}${s4.reset} ${W}${Q?` ${Q}`:""} ${H}${F}${s4.reset} ${s4.duration}${N}${s4.reset}`);v11.emit("request",{method:X,path:oy(Y),status:F,duration:w,timestamp:new Date})}}}var s4,d14=($)=>{if($>=500)return s4.serverError;if($>=400)return s4.clientError;if($>=300)return s4.redirect;return s4.ok},l14=($)=>{return s4[$]||s4.reset},oy=($)=>{return $.replace(/\r/g,"").replace(/\n/g,"").replace(/\x1b\[[0-9;]*m/g,"").replace(/[\x00-\x1f\x7f-\x9f]/g,"")};var dS$=O(()=>{x11();cS$();s4={reset:"\x1B[0m",dim:"\x1B[2m",bold:"\x1B[1m",GET:"\x1B[36m",POST:"\x1B[33m",PUT:"\x1B[35m",DELETE:"\x1B[31m",ok:"\x1B[32m",redirect:"\x1B[36m",clientError:"\x1B[33m",serverError:"\x1B[31m",mcp:"\x1B[35m",tool:"\x1B[96m",duration:"\x1B[90m"}});import{createHmac as nS$}from"crypto";import{mkdir as m14,readdir as i14,rm as lS$,stat as pS$}from"fs/promises";import{join as g11,relative as n14}from"path";import{z as P$}from"zod";function rS$($){let Z=$.replace(/[^a-zA-Z0-9_-]/g,"_");return g11(p14,Z)}function oS$($){return $.replace(/^\/+/,"").replace(/\.\./g,"")}function y11($,Z){let G=rS$($),X=oS$(Z);return g11(G,X)}function t14($,Z,G,X){let Y=L1().encryptionKey||"dev-secret",Q=`${$}:${Z}:${G}:${X}`;return nS$("sha256",Y).update(Q).digest("hex")}function iS$($,Z,G,X,Y){let Q=Math.floor(Date.now()/1000)+X,J=t14(Z,G,Q,Y),W=new URL(`/api/dev-assets/${Z}/${oS$(G)}`,$);return W.searchParams.set("expires",Q.toString()),W.searchParams.set("signature",J),W.searchParams.set("method",Y),W.toString()}function aS$($,Z,G){let X=`${$}:${Z.getTime()}:${G}`;return`"${nS$("md5","etag").update(X).digest("hex")}"`}async function sS$($,Z,G,X,Y){try{let Q=await i14($,{withFileTypes:!0});for(let J of Q){let W=g11($,J.name),U=n14(Z,W).replace(/\\/g,"/");if(G&&!U.startsWith(G))continue;if(J.isDirectory())if(X){let w=U+"/";if(!G||w.startsWith(G)){if(!(G?U.slice(G.length):U).includes("/"))Y.commonPrefixes.add(w)}}else await sS$(W,Z,G,X,Y);else if(J.isFile()){if(X&&G){let w=U.slice(G.length);if(w.includes(X)){let F=w.indexOf(X),H=G+w.slice(0,F+1);Y.commonPrefixes.add(H);continue}}try{let w=await pS$(W);Y.objects.push({key:U,size:w.size,lastModified:w.mtime.toISOString(),etag:aS$(W,w.mtime,w.size)})}catch{}}}}catch{}}function eS$($,Z){let X=E0($).id;return[{name:"LIST_OBJECTS",description:"List objects in the local assets directory with pagination support",inputSchema:P$.object({prefix:P$.string().optional(),maxKeys:P$.number().optional().default(1000),continuationToken:P$.string().optional(),delimiter:P$.string().optional()}),outputSchema:P$.object({objects:P$.array(P$.object({key:P$.string(),size:P$.number(),lastModified:P$.string(),etag:P$.string()})),nextContinuationToken:P$.string().optional(),isTruncated:P$.boolean(),commonPrefixes:P$.array(P$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=Q.prefix||"",W=Q.maxKeys??1000,K=Q.delimiter,U=Q.continuationToken,w=rS$(X);await m14(w,{recursive:!0});let F={objects:[],commonPrefixes:new Set};await sS$(w,w,J,K,F),F.objects.sort((D,L)=>D.key.localeCompare(L.key));let H=0;if(U){if(H=F.objects.findIndex((D)=>D.key>U),H===-1)H=F.objects.length}let N=F.objects.slice(H,H+W),B=H+W<F.objects.length,E=B?N[N.length-1]?.key:void 0;return{objects:N,isTruncated:B,nextContinuationToken:E,commonPrefixes:Array.from(F.commonPrefixes).sort()}}},{name:"GET_OBJECT_METADATA",description:"Get metadata for a file in the local assets directory",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({contentType:P$.string().optional(),contentLength:P$.number(),lastModified:P$.string(),etag:P$.string(),metadata:P$.record(P$.string(),P$.string()).optional()}),handler:async(Y)=>{let Q=Y,J=y11(X,Q.key),W=await pS$(J);return{contentType:fe0(Q.key),contentLength:W.size,lastModified:W.mtime.toISOString(),etag:aS$(J,W.mtime,W.size)}}},{name:"GET_PRESIGNED_URL",description:"Generate a presigned URL for downloading a file from local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??mS$;return{url:iS$(Z,X,Q.key,J,"GET"),expiresIn:J}}},{name:"PUT_PRESIGNED_URL",description:"Generate a presigned URL for uploading a file to local storage",inputSchema:P$.object({key:P$.string(),expiresIn:P$.number().optional(),contentType:P$.string().optional()}),outputSchema:P$.object({url:P$.string(),expiresIn:P$.number()}),handler:async(Y)=>{let Q=Y,J=Q.expiresIn??mS$;return{url:iS$(Z,X,Q.key,J,"PUT"),expiresIn:J}}},{name:"DELETE_OBJECT",description:"Delete a single file from local storage",inputSchema:P$.object({key:P$.string()}),outputSchema:P$.object({success:P$.boolean(),key:P$.string()}),handler:async(Y)=>{let Q=Y,J=y11(X,Q.key);try{return await lS$(J),{success:!0,key:Q.key}}catch{return{success:!1,key:Q.key}}}},{name:"DELETE_OBJECTS",description:"Delete multiple files from local storage",inputSchema:P$.object({keys:P$.array(P$.string()).max(1000)}),outputSchema:P$.object({deleted:P$.array(P$.string()),errors:P$.array(P$.object({key:P$.string(),message:P$.string()}))}),handler:async(Y)=>{let Q=Y,J=[],W=[];return await Promise.all(Q.keys.map(async(K)=>{let U=y11(X,K);try{await lS$(U),J.push(K)}catch(w){W.push({key:K,message:w instanceof Error?w.message:"Unknown error"})}})),{deleted:J,errors:W}}}]}async function h11($,Z,G){let X=eS$(Z,G),Y=new $U({name:"dev-assets-mcp",version:"1.0.0"},{capabilities:{tools:{}},jsonSchemaValidator:O5});for(let J of X){let W="shape"in J.inputSchema?J.inputSchema.shape:P$.object({}).shape,K=J.outputSchema&&"shape"in J.outputSchema?J.outputSchema.shape:P$.object({}).shape;Y.registerTool(J.name,{description:J.description??"",inputSchema:W,outputSchema:K,annotations:J.annotations,_meta:J._meta},async(U)=>{try{let w=await J.handler(U);return{content:[{type:"text",text:JSON.stringify(w)}],structuredContent:w}}catch(w){return{content:[{type:"text",text:`Error: ${w.message}`}],isError:!0}}})}let Q=new MY({enableJsonResponse:$.headers.get("Accept")?.includes("application/json")??!1});return await Y.connect(Q),cW(Y,Q,$,"mcp:dev-assets")}async function $V$($,Z,G,X){let Q=eS$(G,X).find((J)=>J.name===$);if(!Q)return{content:[{type:"text",text:`Tool not found: ${$}`}],isError:!0};try{let J=await Q.handler(Z);return{content:[{type:"text",text:JSON.stringify(J)}]}}catch(J){return{content:[{type:"text",text:J instanceof Error?J.message:String(J)}],isError:!0}}}var p14="./data/assets",mS$=3600,tS$,ZV$;var GV$=O(()=>{q8();jn();d6();ec();Pv();H7();rE0();tS$=new y1;tS$.all("/",async($)=>{let Z=$.get("meshContext"),G=new URL($.req.url),X=`${G.protocol}//${G.host}`;return h11($.req.raw,Z,X)});ZV$=tS$});var XV$={};e8(XV$,{mountDevRoutes:()=>r14});function r14($,Z){$.all("/mcp/:connectionId{.*_dev-assets$}",Z,async(X)=>{let Y=X.get("meshContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`;return h11(X.req.raw,Y,J)}),$.all("/mcp/:connectionId{.*_dev-assets$}/call-tool/:toolName",Z,async(X)=>{let Y=X.get("meshContext"),Q=new URL(X.req.url),J=`${Q.protocol}//${Q.host}`,W=X.req.param("toolName");if(!W)return X.json({error:"Missing tool name"},400);let K=await X.req.json(),U=await $V$(W,K,Y,J);if(U.isError)return X.json(U.content,500);return X.json(U.content)}),$.use("/mcp/dev-assets",Z),$.route("/mcp/dev-assets",ZV$);let G=new y1;G.use("*",vQ({mountPath:"/api/dev-assets"})),G.route("/",tE0({orgFromPath:!1})),$.route("/api/dev-assets",G)}var YV$=O(()=>{d6();Me0();rE0();GV$()});var QV$=O(()=>{xc0();vc0();aE()});var hD0=O(()=>{QV$()});var WV$={};e8(WV$,{streamAgent:()=>JV$,createDecopilotClient:()=>a14});async function o14($){let{parseJsonEventStream:Z,uiMessageChunkSchema:G}=await Promise.resolve().then(() => (f6(),sd0));return Z({stream:$,schema:G}).pipeThrough(new TransformStream({transform(X,Y){if(!X.success)throw X.error;Y.enqueue(X.value)}}))}async function JV$($,Z,G,X,Y){let{readUIMessageStream:Q}=await Promise.resolve().then(() => (f6(),sd0)),J=G.value??G.id;if(!J)throw Error("Agent binding has no id or value \u2014 cannot resolve agent");let W=X.credentialId??G.credentialId,K=X.thinking??G.thinking,U=K?.id,w={messages:X.messages,...U?{models:{credentialId:W,thinking:K,...X.fast??G.fast?{fast:X.fast??G.fast}:{}}}:{},agent:{id:J},temperature:X.temperature??G.temperature,toolApprovalLevel:X.toolApprovalLevel??G.toolApprovalLevel,mode:X.mode??G.mode??"default",...X.memory?{memory:X.memory}:{},...X.thread_id?{thread_id:X.thread_id}:{}},F=await fetch($,{method:"POST",headers:{"Content-Type":"application/json","x-mesh-token":Z,Authorization:`Bearer ${Z}`},body:JSON.stringify(w),signal:Y?.signal});if(!F.ok){let N=await F.text().catch(()=>""),B=`HTTP ${F.status}`;try{let E=JSON.parse(N);if(E?.error)B=E.error}catch{if(N)B=N}throw Error(B)}if(!F.body)throw Error("Empty response body from decopilot stream");let H=await o14(F.body);return Q({stream:H})}function a14($){let{baseUrl:Z,orgSlug:G,token:X}=$,Y=`${Z}/${G}/decopilot/runtime/stream`;return{stream(Q,J){let W={__type:"@deco/agent",id:Q.agent.id,credentialId:Q.credentialId??"",thinking:Q.thinking??{id:"",title:""},fast:Q.fast,toolApprovalLevel:Q.toolApprovalLevel,mode:Q.mode,temperature:Q.temperature};return JV$(Y,X,W,Q,J)}}}import{z as xX}from"zod";function KV$($){let Z=$.properties;if(!Z)return $;for(let G of Object.values(Z)){let X=G.properties;if(!X?.__type?.const)continue;let Y=X.__type.const,Q=s14.get(Y);if(!Q)continue;let J=Q.map((W)=>({name:String(W.name),...W.inputSchema&&{inputSchema:xX.toJSONSchema(W.inputSchema)},...W.outputSchema&&{outputSchema:xX.toJSONSchema(W.outputSchema)}}));X.__binding={const:J}}return $}var s14,i1Z,e14=($)=>{return typeof $==="object"&&$!==null&&$.__type==="@deco/agent"},u11=($)=>{return typeof $==="object"&&$!==null&&typeof $.__type==="string"&&$.__type!=="@deco/agent"&&typeof $.value==="string"},cD0=($,Z,G)=>{let X=G?{"x-caller-app":G}:void 0;if(Z.cookie)X??={},X.cookie=Z.cookie;if(Z.token)X??={},X["x-mesh-token"]=Z.token;return{type:"HTTP",url:new URL(`/mcp/${$}`,Z.meshUrl).href,token:Z.token,headers:X}},$$4=($,Z,G)=>{let X=cD0($,Z,G);return new Proxy(Mx.forConnection(X),{get(Y,Q){if(Q==="value")return $;if(Q==="__type")return G;return Y[Q]}})},Z$4=($,Z)=>{let G=Z.organizationSlug;if(!G)throw Error("organizationSlug is required for agent bindings");let X=`${Z.meshUrl}/api/${G}/decopilot/runtime/stream`;return{STREAM:async(Y,Q)=>{let{streamAgent:J}=await Promise.resolve().then(() => WV$);return J(X,Z.token,$,Y,Q)}}},c11=($,Z)=>{if($===null||$===void 0)return $;if(Array.isArray($))return $.map((G)=>c11(G,Z));if(typeof $==="object"){if(e14($))return Z$4($,Z);if(u11($))return $$4($.value,Z,$.__type);let G={};for(let[X,Y]of Object.entries($))G[X]=c11(Y,Z);return G}return $},UV$=($)=>{return c11($.state,$)};var ay=O(()=>{hD0();s14=new Map;i1Z=xX.object({id:xX.string(),title:xX.string(),capabilities:xX.object({vision:xX.boolean().optional(),text:xX.boolean().optional(),tools:xX.boolean().optional(),reasoning:xX.boolean().optional()}).passthrough().optional(),provider:xX.string().optional().nullable(),limits:xX.object({contextWindow:xX.number().optional(),maxOutputTokens:xX.number().optional()}).passthrough().optional()})});var G$4,wV$=($,Z,G)=>{if(!Z)return null;if($===void 0||$==="*")return"*";if(typeof $==="string")return $===Z?$:null;if(Array.isArray($))return $.includes(Z)?Z:null;if(typeof $==="function")return $(Z,G)??null;return null},X$4=($,Z,G)=>{let X=Z.headers.get("Origin"),Y=wV$(G.origin,X,Z);if(Y)$.set("Access-Control-Allow-Origin",Y);if(G.credentials)$.set("Access-Control-Allow-Credentials","true");if(G.exposeHeaders?.length)$.set("Access-Control-Expose-Headers",G.exposeHeaders.join(", "))},FV$=($,Z)=>{let G=new Headers,X=$.headers.get("Origin"),Y=wV$(Z.origin,X,$);if(Y)G.set("Access-Control-Allow-Origin",Y);if(Z.credentials)G.set("Access-Control-Allow-Credentials","true");let Q=Z.allowMethods??G$4;G.set("Access-Control-Allow-Methods",Q.join(", "));let J=$.headers.get("Access-Control-Request-Headers");if(Z.allowHeaders?.length)G.set("Access-Control-Allow-Headers",Z.allowHeaders.join(", "));else if(J)G.set("Access-Control-Allow-Headers",J);if(Z.maxAge!==void 0)G.set("Access-Control-Max-Age",Z.maxAge.toString());return new Response(null,{status:204,headers:G})},HV$=($,Z,G)=>{let X=new Headers($.headers);return X$4(X,Z,G),new Response($.body,{status:$.status,statusText:$.statusText,headers:X})};var NV$=O(()=>{G$4=["GET","HEAD","PUT","POST","DELETE","PATCH"]});function BV$($=32){let G=new Uint8Array($);return crypto.getRandomValues(G),Array.from(G,(X)=>"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"[X%62]).join("")}function Y$4($){try{let Z=new URL($);return Z.protocol==="https:"||Z.hostname==="localhost"||Z.hostname.endsWith(".localhost")||Z.hostname==="127.0.0.1"||!Z.protocol.startsWith("http")}catch{return!1}}function OV$($){return btoa(JSON.stringify($)).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function EV$($){try{let Z=$.replace(/-/g,"+").replace(/_/g,"/");return JSON.parse(atob(Z))}catch{return null}}function DV$($){return{handleProtectedResourceMetadata:(U)=>{let w=wK(new URL(U.url)),F=`${w.origin}/mcp`;return Response.json({resource:F,authorization_servers:[w.origin],scopes_supported:["*"],bearer_methods_supported:["header"],resource_signing_alg_values_supported:["RS256","none"]})},handleAuthorizationServerMetadata:(U)=>{let F=wK(new URL(U.url)).origin;return Response.json({issuer:F,authorization_endpoint:`${F}/authorize`,token_endpoint:`${F}/token`,registration_endpoint:`${F}/register`,scopes_supported:["*"],response_types_supported:["code"],response_modes_supported:["query"],grant_types_supported:["authorization_code","refresh_token"],token_endpoint_auth_methods_supported:["none","client_secret_post"],code_challenge_methods_supported:["S256","plain"]})},handleAuthorize:(U)=>{let w=wK(new URL(U.url)),F=w.searchParams.get("redirect_uri"),H=w.searchParams.get("response_type"),N=w.searchParams.get("state"),B=w.searchParams.get("code_challenge"),E=w.searchParams.get("code_challenge_method");if(!F)return Response.json({error:"invalid_request",error_description:"redirect_uri required"},{status:400});if(H!=="code")return Response.json({error:"unsupported_response_type",error_description:"Only 'code' is supported"},{status:400});let D=wK(new URL(`${w.origin}/oauth/callback`)),L=D.toString(),j=OV$({redirectUri:F,clientState:N??void 0,codeChallenge:B??void 0,codeChallengeMethod:E??void 0,oauthCallbackUri:L});D.searchParams.set("state",j);let P=$.authorizationUrl(D.toString());return Response.redirect(P,302)},handleOAuthCallback:async(U)=>{let w=wK(new URL(U.url)),F=w.searchParams.get("code"),H=w.searchParams.get("state"),N=w.searchParams.get("error"),B=H?EV$(H):null;if(N){let E=w.searchParams.get("error_description")??"Authorization failed";if(B?.redirectUri){let D=wK(new URL(B.redirectUri));if(D.searchParams.set("error",N),D.searchParams.set("error_description",E),B.clientState)D.searchParams.set("state",B.clientState);return Response.redirect(D.toString(),302)}return Response.json({error:N,error_description:E},{status:400})}if(!F||!B)return Response.json({error:"invalid_request",error_description:"Missing code or state"},{status:400});try{let E=B.oauthCallbackUri??wK(new URL(`${w.origin}/oauth/callback`)).toString(),D={code:F,redirect_uri:E},L=await $.exchangeCode(D),z={accessToken:L.access_token,tokenType:L.token_type,refreshToken:L.refresh_token,expiresIn:L.expires_in,scope:L.scope,codeChallenge:B.codeChallenge,codeChallengeMethod:B.codeChallengeMethod},j=OV$(z),P=wK(new URL(B.redirectUri));if(P.searchParams.set("code",j),B.clientState)P.searchParams.set("state",B.clientState);return Response.redirect(P.toString(),302)}catch(E){console.error("OAuth callback error:",E);let D=wK(new URL(B.redirectUri));if(D.searchParams.set("error","server_error"),D.searchParams.set("error_description","Failed to exchange authorization code"),B.clientState)D.searchParams.set("state",B.clientState);return Response.redirect(D.toString(),302)}},handleToken:async(U)=>{try{let w=U.headers.get("content-type")??"",F;if(w.includes("application/x-www-form-urlencoded")){let z=await U.formData();F=Object.fromEntries(z.entries())}else{let z=await U.json();if(typeof z!=="object"||z===null||Array.isArray(z))return Response.json({error:"invalid_request",error_description:"Request body must be a JSON object"},{status:400});F=z}let{code:H,code_verifier:N,grant_type:B,refresh_token:E}=F;if(B==="refresh_token"){if(typeof E!=="string"||!E)return Response.json({error:"invalid_request",error_description:"refresh_token is required and must be a string"},{status:400});if(!$.refreshToken)return Response.json({error:"unsupported_grant_type",error_description:"refresh_token grant not supported"},{status:400});let z;try{z=await $.refreshToken(E)}catch(P){if(P instanceof d11)return Response.json({error:P.error,...P.errorDescription?{error_description:P.errorDescription}:{}},{status:400});throw P}let j={access_token:z.access_token,token_type:z.token_type};if(z.refresh_token)j.refresh_token=z.refresh_token;if(z.expires_in!==void 0)j.expires_in=z.expires_in;if(z.scope)j.scope=z.scope;return Response.json(j,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}if(B!=="authorization_code")return Response.json({error:"unsupported_grant_type",error_description:"Only authorization_code and refresh_token supported"},{status:400});if(typeof H!=="string"||!H)return Response.json({error:"invalid_request",error_description:"code is required and must be a string"},{status:400});let D=EV$(H);if(!D||!D.accessToken)return Response.json({error:"invalid_grant",error_description:"Invalid or expired code"},{status:400});if(D.codeChallenge){if(typeof N!=="string"||!N)return Response.json({error:"invalid_grant",error_description:"code_verifier required and must be a string"},{status:400});let z;if(D.codeChallengeMethod==="S256"){let P=new TextEncoder().encode(N),A=await crypto.subtle.digest("SHA-256",P);z=btoa(String.fromCharCode(...new Uint8Array(A))).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}else z=N;if(z!==D.codeChallenge)return Response.json({error:"invalid_grant",error_description:"Invalid code_verifier"},{status:400})}let L={access_token:D.accessToken,token_type:D.tokenType};if(D.refreshToken)L.refresh_token=D.refreshToken;if(D.expiresIn!==void 0)L.expires_in=D.expiresIn;if(D.scope)L.scope=D.scope;return Response.json(L,{headers:{"Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Token exchange error:",w),Response.json({error:"server_error",error_description:"Failed to process token request"},{status:500})}},handleClientRegistration:async(U)=>{try{let w=await U.json();if(!w.redirect_uris||w.redirect_uris.length===0)return Response.json({error:"invalid_redirect_uri",error_description:"At least one redirect_uri is required"},{status:400});for(let E of w.redirect_uris)if(!Y$4(E))return Response.json({error:"invalid_redirect_uri",error_description:`Invalid redirect URI: ${E}`},{status:400});let F=BV$(32),H=w.token_endpoint_auth_method!=="none"?BV$(32):void 0,N=Math.floor(Date.now()/1000),B={client_id:F,client_secret:H,client_name:w.client_name,redirect_uris:w.redirect_uris,grant_types:w.grant_types??["authorization_code"],response_types:w.response_types??["code"],token_endpoint_auth_method:w.token_endpoint_auth_method??"client_secret_post",scope:w.scope,client_id_issued_at:N,client_secret_expires_at:0};if($.persistence)await $.persistence.saveClient(B);return new Response(JSON.stringify(B),{status:201,headers:{"Content-Type":"application/json","Cache-Control":"no-store",Pragma:"no-cache"}})}catch(w){return console.error("Client registration error:",w),Response.json({error:"invalid_client_metadata",error_description:"Invalid client registration request"},{status:400})}},createUnauthorizedResponse:(U)=>{let H=`Bearer resource_metadata="${`${wK(new URL(U.url)).origin}/.well-known/oauth-protected-resource`}", scope="*"`;return Response.json({jsonrpc:"2.0",error:{code:-32000,message:"Unauthorized: Authentication required"},id:null},{status:401,headers:{"WWW-Authenticate":H,"Access-Control-Expose-Headers":"WWW-Authenticate"}})},hasAuth:(U)=>U.headers.has("Authorization")}}var d11,wK=($)=>{if(!($.hostname==="localhost"||$.hostname.endsWith(".localhost")||$.hostname==="127.0.0.1"))$.protocol="https:";return $};var l11=O(()=>{d11=class d11 extends Error{error;errorDescription;constructor($="invalid_grant",Z){super(Z??$);this.name="OAuthInvalidGrantError",this.error=$,this.errorDescription=Z}}});import{AsyncLocalStorage as Q$4}from"async_hooks";var LV$,Pt;var m11=O(()=>{LV$=new Q$4,Pt={getStore:()=>{return LV$.getStore()},run:($,Z,...G)=>LV$.run($,Z,...G)}});var jV$="SELF",dD0=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},PV$=($)=>{return typeof $==="object"&&$!==null&&"handler"in $&&"events"in $&&typeof $.handler==="function"&&Array.isArray($.events)},zV$="::",AV$=($)=>{let Z=$.indexOf(zV$);if(Z===-1)return null;let G=$.substring(0,Z),X=$.substring(Z+zV$.length);return[G,X]},J$4=($)=>{if(!$.startsWith("cron/"))return null;let Z=$.substring(5),G=Z.indexOf("/");if(G===-1)return null;let X=Z.substring(0,G),Y=Z.substring(G+1);return[X,Y]},TV$=($)=>{if(dD0($))return[];return Object.keys($)},W$4=($,Z)=>{if(dD0($))return $.events;let G=$[Z];if(!G)return[];if(PV$(G))return G.events;return Object.keys(G)},uD0=($,Z,G)=>{if($===jV$){if(!G)return console.warn("[Event] SELF binding used but no connectionId available"),null;return G}let X=Z[$];if(!u11(X))return console.warn(`[Event] Binding "${$}" not found in state`),null;return X.value},K$4=($,Z,G)=>{let X=Z;if(dD0($)){let Q=[];for(let J of $.events){let W=AV$(J);if(!W){console.warn(`[Event] Global handler event "${J}" must be prefixed with BINDING:: (e.g., "SELF::${J}" or "DATABASE::${J}")`);continue}let[K,U]=W,w=uD0(K,X,G);if(!w)continue;Q.push({eventType:U,publisher:w})}return Q}let Y=[];for(let Q of TV$($)){let J=uD0(Q,X,G);if(!J)continue;let W=W$4($,Q);for(let K of W)Y.push({eventType:K,publisher:J})}return Y},U$4=($)=>{let Z=new Map;for(let G of $){let X=G.source,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},w$4=($)=>{let Z=new Map;for(let G of $){let X=G.type,Y=Z.get(X)||[];Y.push(G),Z.set(X,Y)}return Z},F$4=($)=>{let Z={},G={},X=!1,Y=0,Q=[];for(let J of $){if(J.results)Object.assign(G,J.results);if(J.success===!1){if(X=!0,J.error)Q.push(J.error)}if(J.processedCount!==void 0)Y+=J.processedCount}if(Object.keys(G).length>0)Z.results=G;if(Z.success=!X,Q.length>0)Z.error=Q.join("; ");if(Y>0)Z.processedCount=Y;return Z},H$4=async($,Z,G,X,Y)=>{let Q=X;if(dD0($)){let w=new Set;for(let H of $.events){let N=AV$(H);if(!N)continue;let[B,E]=N,D=uD0(B,Q,Y);if(!D)continue;w.add(`${D}:${E}`)}let F=Z.filter((H)=>{let N=`${H.source}:${H.type}`;return w.has(N)});if(F.length===0)return{success:!0};try{return await $.handler({events:F},G)}catch(H){return{success:!1,error:H instanceof Error?H.message:String(H)}}}let J=new Map;for(let w of TV$($)){let F=uD0(w,Q,Y);if(F)J.set(F,w)}let W=U$4(Z),K=[];for(let[w,F]of W){let H=J.get(w);if(!H)continue;let N=$[H];if(!N)continue;if(PV$(N)){K.push((async()=>{try{return await N.handler({events:F},G)}catch(D){let L={};for(let z of F)L[z.id]={success:!1,error:D instanceof Error?D.message:String(D)};return{results:L}}})());continue}let B=N,E=w$4(F);for(let[D,L]of E){let z=B[D];if(!z)continue;K.push((async()=>{try{let j=await z({events:L},G),P={};for(let A of L)P[A.id]=j;return{results:P}}catch(j){let P={};for(let A of L)P[A.id]={success:!1,error:j instanceof Error?j.message:String(j)};return{results:P}}})())}}let U=await Promise.all(K);if(U.length===0)return{success:!0};return F$4(U)},IV$;var i11=O(()=>{ay();IV$={subscriptions:K$4,execute:H$4,parseCron:J$4}});function N$4($,Z){let G=cD0("self",{meshUrl:$,token:Z});return Mx.forConnection(G)}function B$4($,Z){switch(Z.type){case"cron":return{automation_id:$,type:"cron",cron_expression:Z.cron};case"event":return{automation_id:$,type:"event",connection_id:Z.connectionId,event_type:Z.eventType,params:Z.params};case"webhook":return{automation_id:$,type:"webhook"}}}function RV$($,Z,G){return async(X)=>{if(!$)throw Error("createAgent: missing meshUrl in MESH_REQUEST_CONTEXT");let Y=N$4($,Z),J=(await Y.COLLECTION_VIRTUAL_MCP_LIST({where:{operator:"and",conditions:[{field:["title"],operator:"eq",value:X.name}]},limit:1})).items.find((w)=>w.title===X.name);if(J)return{id:J.id,automations:[],automationIds:[],alreadyExisted:!0};let W=X.tools&&X.tools.length>0?X.tools.map((w)=>({connection_id:w.connectionId,selected_tools:w.tools??null,selected_resources:null,selected_prompts:null})):G?[{connection_id:G,selected_tools:null,selected_resources:null,selected_prompts:null}]:[],{item:K}=await Y.COLLECTION_VIRTUAL_MCP_CREATE({data:{title:X.name,description:X.description,metadata:X.instructions?{instructions:X.instructions}:void 0,connections:W}}),U=[];for(let w of X.automations??[]){let F=await Y.AUTOMATION_CREATE({name:w.name,virtual_mcp_id:K.id,messages:w.messages,models:w.models,tools:w.tools,active:w.active??!0}),H=[];for(let N of w.triggers??[])try{let B=await Y.AUTOMATION_TRIGGER_ADD(B$4(F.id,N));H.push({type:N.type,ok:!0,id:B.id,webhook:B.webhook??void 0})}catch(B){H.push({type:N.type,ok:!1,error:B instanceof Error?B.message:String(B)})}U.push({id:F.id,name:w.name,triggers:H})}return{id:K.id,automations:U,automationIds:U.map((w)=>w.id),alreadyExisted:!1}}}var n11=O(()=>{ay();hD0()});import{z as JZ}from"zod";function Tw($){return{...$,execute:(Z)=>{let G=At(Z.runtimeContext);return $.execute({...Z,runtimeContext:G},G)}}}var At=($)=>{let Z=Pt.getStore();if(!Z){if($)return $;throw Error("Missing context, did you forget to call State.bind?")}return Z},qV$=($)=>{let Z=$.runtimeContext.env.MESH_REQUEST_CONTEXT;return{connectionId:Z?.connectionId,meshUrl:Z?.meshUrl,token:Z?.token}},O$4=({events:$,configuration:{state:Z,scopes:G,onChange:X,onInstall:Y}={}}={})=>{let Q=Z?KV$(JZ.toJSONSchema(Z)):{type:"object",properties:{}};return[...X||Y||$?[Tw({id:"ON_MCP_CONFIGURATION",description:"MCP Configuration On Change",inputSchema:JZ.object({state:Z??JZ.unknown(),scopes:JZ.array(JZ.string()).describe("Array of scopes in format 'KEY::SCOPE' (e.g., 'GMAIL::GetCurrentUser')"),firstRun:JZ.boolean().optional().describe("True on the first configuration save for this connection \u2014 fires onInstall."),vault:JZ.object({baseUrl:JZ.string(),org:JZ.string(),subjectConnectionId:JZ.string(),token:JZ.string()}).optional()}),outputSchema:JZ.object({}),execute:async(J)=>{let W=J.context.state,K=J.context.vault;if(await X?.(J.runtimeContext.env,{state:W,scopes:J.context.scopes,vault:K}),Y&&J.context.firstRun){let{meshUrl:U,token:w,connectionId:F}=qV$(J);await Y(J.runtimeContext.env,{createAgent:RV$(U,w,F),vault:K})}return Promise.resolve({})}})]:[],...$?.handlers?[Tw({id:"ON_EVENTS",description:"Receive and process CloudEvents from the event bus. Returns per-event or batch results.",inputSchema:C40,outputSchema:_40,execute:async(J)=>{let W=J.runtimeContext.env,K=W.MESH_REQUEST_CONTEXT?.state,{connectionId:U}=qV$(J);return IV$.execute($.handlers,J.context.events,W,K,U)}})]:[],Tw({id:"MCP_CONFIGURATION",description:"MCP Configuration",inputSchema:JZ.object({}),outputSchema:JZ.object({stateSchema:JZ.unknown(),scopes:JZ.array(JZ.string()).optional()}),execute:()=>{return Promise.resolve({stateSchema:Q,scopes:[...G??[]]})}})]},MV$=($)=>{let Z=null,G=null,X=null,Y=!1,Q=()=>{if(!Y)console.warn("[runtime] Passing factory functions to tools/prompts/resources is deprecated. Pass createTool()/createPrompt()/createResource() instances directly."),Y=!0},J=(N)=>typeof N==="object"&&N!==null&&(("id"in N)||("name"in N)||("uri"in N));async function W(N,B){if(!N)return[];return(await Promise.all(N.flatMap(async(E)=>{if(J(E))return[E];Q();let D=await E(B);if(Array.isArray(D))return D;return[D]}))).flat()}let K=async(N)=>{if(Z)return Z;if(G)return G;return G=(async()=>{try{let B;if(typeof $.tools==="function")Q(),B=await $.tools(N);else B=await W($.tools,N);B.push(...O$4({...$}));let E;if(typeof $.prompts==="function")Q(),E=await $.prompts(N);else E=await W($.prompts,N);let D;if(typeof $.resources==="function")Q(),D=await $.resources(N);else D=await W($.resources,N);let L={tools:B,prompts:E,resources:D};return Z=L,L}catch(B){throw G=null,B}})(),G},U=(N,B)=>{for(let E of B.tools)N.registerTool(E.id,{_meta:E._meta,title:E.title,description:E.description,annotations:E.annotations,inputSchema:E.inputSchema&&"shape"in E.inputSchema?E.inputSchema:JZ.object({}),outputSchema:E.outputSchema&&typeof E.outputSchema==="object"&&"shape"in E.outputSchema?E.outputSchema:void 0},async(D)=>{let L=At(),z=await E.execute({context:D,runtimeContext:L},L);if(z!=null&&typeof z==="object"&&"content"in z&&Array.isArray(z.content)&&z.content.every((j)=>j!=null&&typeof j==="object"&&("type"in j)&&typeof j.type==="string"))return z;return{structuredContent:z,content:[{type:"text",text:JSON.stringify(z)}]}});for(let E of B.prompts)N.registerPrompt(E.name,{title:E.title,description:E.description,argsSchema:E.argsSchema?E.argsSchema:JZ.object({}).shape},async(D)=>{let L=At();return await E.execute({args:D,runtimeContext:L},L)});for(let E of B.resources)N.resource(E.name,E.uri,{description:E.description,mimeType:E.mimeType},async(D)=>{let L=At(),z=await E.read({uri:D,runtimeContext:L},L),j=z._meta??void 0;if(z.text!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,text:z.text,...j!==void 0?{_meta:j}:{}}]};else if(z.blob!==void 0)return{contents:[{uri:z.uri,mimeType:z.mimeType,blob:z.blob,...j!==void 0?{_meta:j}:{}}]};return{contents:[{uri:z.uri,mimeType:z.mimeType,text:""}]}})},w=async(N)=>{await $.before?.(N);let{instructions:B,...E}=$.serverInfo??{},D=new $U({...E,name:E.name??"@deco/mcp-api",version:E.version??"1.0.0"},{capabilities:{tools:{},prompts:{},resources:{}},jsonSchemaValidator:O5,...B&&{instructions:B}}),L=await K(N);U(D,L);let z="tools/list",j=D.server._requestHandlers,P=j.get(z);if(P)j.set(z,async(A,M)=>{if(!X)X=await P(A,M);return X});return{server:D,...L}};return{fetch:async(N,B)=>{let{server:E}=await w(B),D=new MY;await E.connect(D);let L=()=>{try{D.close?.()}catch{}try{E.close?.()}catch{}};try{let z=await D.handleRequest(N),j=z.headers.get("content-type");if(!(j?.includes("text/event-stream")||j?.includes("application/json-rpc"))||!z.body)return L(),z;let{readable:A,writable:M}=new TransformStream;return z.body.pipeTo(M).catch(()=>{}).finally(L),new Response(A,{status:z.status,statusText:z.statusText,headers:z.headers})}catch(z){throw L(),z}},callTool:async({toolCallId:N,toolCallInput:B})=>{let E=Pt.getStore();if(!E)throw Error("Missing state, did you forget to call State.bind?");let D=E?.env,{tools:L}=await K(D),j=L.find((A)=>A.id===N)?.execute;if(!j)throw Error(`Tool ${N} not found or does not have an execute function`);let P=At();return j({context:B,runtimeContext:P},P)}}};var lD0=O(()=>{cc0();H7();ec();Pv();ay();i11();m11();n11();i11();n11()});import{decodeJwt as kV$}from"jose";var E$4=({env:$,server:Z,url:G})=>{$.SELF=new Proxy({},{get:(X,Y)=>{if(Y==="toJSON")return null;return async(Q)=>{return await Z.callTool({toolCallId:Y,toolCallInput:Q})}}}),$.IS_LOCAL=(G?.startsWith("http://localhost")||G?.startsWith("http://127.0.0.1"))??!1},SV$=($)=>()=>{return{...$??{}}},D$4=({env:$,server:Z,tokenOrContext:G,url:X,authToken:Y})=>{let Q=$,J=Y?Y.split(" ")[1]:void 0,W;if(typeof G==="string"){let K=kV$(G),U=K.metadata??{};W={authorization:J,state:K.state??U.state??{},token:G,meshUrl:K.meshUrl??U.meshUrl,connectionId:K.connectionId??U.connectionId,organizationId:K.organizationId??U.organizationId,organizationName:K.organizationName??U.organizationName,organizationSlug:K.organizationSlug??U.organizationSlug,ensureAuthenticated:SV$(K.user??K.sub)}}else if(typeof G==="object"){W=G;let K=kV$(G.token),U=K.metadata??{},w=K.appName;W.authorization??=J,W.callerApp=w,W.connectionId??=K.connectionId??U.connectionId,W.organizationId??=K.organizationId??U.organizationId,W.organizationName??=K.organizationName??U.organizationName,W.organizationSlug??=K.organizationSlug??U.organizationSlug,W.ensureAuthenticated=SV$(K.user??K.sub)}else W={state:{},authorization:J,token:void 0,meshUrl:void 0,connectionId:void 0,ensureAuthenticated:()=>{throw Error("Unauthorized")}};return Q.MESH_REQUEST_CONTEXT=W,W.state=UV$(W),E$4({env:Q,server:Z,url:X}),Q},L$4,VV$=($)=>{let Z=MV$($),G=$.cors??L$4,X=$.oauth,Y=X?DV$(X):null,Q=async(J,W,K)=>{let U=new URL(J.url);if(Y){if(U.pathname==="/.well-known/oauth-protected-resource"||U.pathname==="/mcp/.well-known/oauth-protected-resource")return Y.handleProtectedResourceMetadata(J);if(U.pathname==="/.well-known/oauth-authorization-server")return Y.handleAuthorizationServerMetadata(J);if(U.pathname==="/authorize")return Y.handleAuthorize(J);if(U.pathname==="/oauth/callback")return Y.handleOAuthCallback(J);if(U.pathname==="/token"&&J.method==="POST")return Y.handleToken(J);if((U.pathname==="/register"||U.pathname==="/mcp/register")&&J.method==="POST")return Y.handleClientRegistration(J)}if(U.pathname==="/mcp"){if(J.method==="GET")return new Response("Method not allowed",{status:405});if(Y&&!Y.hasAuth(J)){let w=J.clone();try{if((await w.json())?.method!=="tools/list")return Y.createUnauthorizedResponse(J)}catch{return Y.createUnauthorizedResponse(J)}}return Z.fetch(J,W,K)}if(U.pathname.startsWith("/mcp/call-tool")){let w=U.pathname.split("/").pop();if(!w)return new Response("Not found",{status:404});let F=await J.json(),H=await Z.callTool({toolCallId:w,toolCallInput:F});return new Response(JSON.stringify(H),{headers:{"Content-Type":"application/json"}})}return $.fetch?.(J,W,K)||new Response("Not found",{status:404})};return{fetch:async(J,W,K)=>{if(new URL(J.url).pathname==="/_healthcheck")return new Response("OK",{status:200});if(G!==!1&&J.method==="OPTIONS")return FV$(J,G??{});let U=D$4({authToken:J.headers.get("authorization")??null,env:{...process.env,...W},server:Z,tokenOrContext:J.headers.get("x-mesh-token")??void 0,url:J.url}),w=await Pt.run({req:J,env:U,ctx:K},async()=>await Q(J,U,K));if(G!==!1)return HV$(w,J,G??{});return w}}};var CV$=O(()=>{ay();NV$();l11();l11();m11();lD0();lD0();ay();hD0();L$4={origin:($)=>{if($.includes("localhost")||$.includes("127.0.0.1"))return $;return $},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"]}});import{z as p11}from"zod";function P$4($,Z){let G=Tw({id:"COLLECTION_REGISTRY_APP_LIST",description:"List public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:Hy,outputSchema:Ny,execute:async({context:W})=>{let K={limit:W.limit,offset:W.offset,cursor:W.cursor,tags:W.tags,categories:W.categories,where:W.where},U=`${Z}:${JSON.stringify(K)}`,w=_V$.get(U);if(w)return w;let F=await $.listPublic(Z,K);return _V$.set(U,F),F}}),X=Tw({id:"COLLECTION_REGISTRY_APP_GET",description:"Get a public registry item by ID or name",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:eW,outputSchema:SV,execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{item:null};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{item:U};return{item:null}}}),Y=Tw({id:"COLLECTION_REGISTRY_APP_VERSIONS",description:"Get available versions of a public registry item",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:eW,outputSchema:p11.object({versions:p11.array(SV.shape.item)}),execute:async({context:W})=>{let K=W.id??W.name;if(!K)return{versions:[]};let U=await $.findByIdOrName(Z,K);if(U&&U.is_public)return{versions:[U]};return{versions:[]}}}),Q=Tw({id:"COLLECTION_REGISTRY_APP_SEARCH",description:"Search public registry items returning minimal data (id, title, tags, categories, is_public). Use this instead of LIST when you need to find items efficiently without loading full details.",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:XE0,outputSchema:YE0,execute:async({context:W})=>{return await $.search(Z,W,{publicOnly:!0})}}),J=Tw({id:"COLLECTION_REGISTRY_APP_FILTERS",description:"Get available tags and categories for public registry items",annotations:{readOnlyHint:!0,idempotentHint:!0},inputSchema:p11.object({}),outputSchema:By,execute:async()=>{return await $.getFilters(Z,{publicOnly:!0})}});return[G,Q,X,Y,J]}function bV$($){let Z=$.db,G=new Mf(Z);return async(X)=>{let Y=X.req.param("orgSlug")??X.req.param("org");if(!Y)return X.json({error:"Organization not found"},404);let Q=await Z.selectFrom("organization").select(["id","slug","name"]).where("slug","=",Y).executeTakeFirst();if(!Q)return X.json({error:"Organization not found"},404);let J=P$4(G,Q.id),W=VV$({tools:J}),K=new URL(X.req.url),U=X.req.path.indexOf("/registry"),w=U>=0?X.req.path.slice(U+9):"",F=new URL(w||"/",K.origin);K.searchParams.forEach((B,E)=>{F.searchParams.set(E,B)});let H=new Request(F.toString(),{method:X.req.method,headers:X.req.raw.headers,body:X.req.method!=="GET"&&X.req.method!=="HEAD"?X.req.raw.body:void 0}),N={organizationId:Q.id,db:Z,MESH_REQUEST_CONTEXT:{},MESH_APP_DEPLOYMENT_ID:"public-registry",IS_LOCAL:!1};return await W.fetch(H,N,X)}}var z$4=3600000,j$4=500,_V$;var fV$=O(()=>{CV$();lD0();cv0();e5();_V$=ry({ttlMs:z$4,maxSize:j$4,updateRecencyOnGet:!0})});import{sql as A$4}from"kysely";import{randomUUID as xV$}from"crypto";import{z as T$4}from"zod";async function R$4($){let Z=new Date().toISOString(),G=xV$(),X=w4.SELF($.organizationId),Y="registry.publish_request.created",Q={requestId:$.request.id,requestedId:$.request.requested_id,title:$.request.title,status:$.request.status,createdAt:$.request.created_at,requester:{name:$.request.requester_name,email:$.request.requester_email}};await $.db.insertInto("events").values({id:G,organization_id:$.organizationId,type:"registry.publish_request.created",source:X,specversion:"1.0",subject:$.request.id,time:Z,datacontenttype:"application/json",dataschema:null,data:JSON.stringify(Q),cron:null,status:"pending",attempts:0,last_error:null,next_retry_at:null,created_at:Z,updated_at:Z}).execute();let J=await $.db.selectFrom("event_subscriptions").select(["id"]).where("organization_id","=",$.organizationId).where("enabled","=",1).where("event_type","=","registry.publish_request.created").where((W)=>W.or([W("publisher","is",null),W("publisher","=",X)])).execute();if(J.length>0)await $.db.insertInto("event_deliveries").values(J.map((W)=>({id:xV$(),event_id:G,subscription_id:W.id,status:"pending",attempts:0,last_error:null,delivered_at:null,next_retry_at:null,created_at:Z}))).execute();try{await A$4`SELECT pg_notify('mesh_events', ${G})`.execute($.db)}catch{}}async function q$4($,Z){let X=(await $.selectFrom("organization").select(["id"]).where("id","=",Z).execute())[0];if(X?.id)return X.id;return(await $.selectFrom("organization").select(["id"]).where("slug","=",Z).execute())[0]?.id??null}async function M$4($,Z){let G=await $.selectFrom("virtual_mcp_plugin_configs").innerJoin("connections","connections.id","virtual_mcp_plugin_configs.virtual_mcp_id").select(["virtual_mcp_plugin_configs.settings as settings"]).where("connections.organization_id","=",Z).where("virtual_mcp_plugin_configs.plugin_id","=",VV).execute();for(let X of G){let Y=X.settings,Q=typeof Y==="string"?(()=>{try{return JSON.parse(Y)}catch{return{}}})():Y??{};if(Q.acceptPublishRequests===!0){let J=Q.rateLimitWindow==="minute"?"minute":"hour",W=Q.rateLimitMax,K=typeof W==="number"&&Number.isFinite(W)&&W>=1?Math.floor(W):yV$;return{acceptPublishRequests:!0,requireApiToken:Q.requireApiToken===!0,rateLimitEnabled:Q.rateLimitEnabled===void 0?vV$:Q.rateLimitEnabled===!0,rateLimitWindow:J,rateLimitMax:K}}}return{acceptPublishRequests:!1,requireApiToken:!1,rateLimitEnabled:vV$,rateLimitWindow:I$4,rateLimitMax:yV$}}async function k$4($,Z,G){let X=G==="minute"?60000:3600000,Y=new Date(Date.now()-X).toISOString(),Q=await $.selectFrom("private_registry_publish_request").select((J)=>J.fn.countAll().as("count")).where("organization_id","=",Z).where("created_at",">=",Y).executeTakeFirst();return Number(Q?.count??0)}async function S$4($,Z,G,X){let Y=await $.selectFrom("private_registry_item").select(["id","title"]).where("organization_id","=",Z).where((Q)=>Q.or([Q("id","=",G),Q("title","=",X)])).executeTakeFirst();return Y?{id:String(Y.id),title:String(Y.title)}:null}function gV$($){let{db:Z,db:G}=$,X=new kf(G),Y=new Sf(G);return async(Q)=>{let J=Q.req.param("orgRef")??Q.req.param("org");if(!J)return Q.json({error:"Organization not found"},404);let W=await q$4(Z,J);if(!W)return Q.json({error:"Organization not found"},404);let K=await M$4(Z,W);if(!K.acceptPublishRequests)return Q.json({error:"Publish requests are not enabled for this registry."},403);if(K.requireApiToken){let N=Q.req.header("Authorization"),B=N?.startsWith("Bearer ")?N.slice(7).trim():null;if(!B)return Q.json({error:"API key required. Use Authorization: Bearer <key>"},401);if(!await Y.validate(W,B))return Q.json({error:"Invalid API key"},401)}if(K.rateLimitEnabled){if(await k$4(G,W,K.rateLimitWindow)>=K.rateLimitMax)return Q.json({error:"Too many publish requests. Please try again later.",retryAfterSeconds:K.rateLimitWindow==="minute"?60:3600},429)}let U;try{U=await Q.req.json()}catch{return Q.json({error:"Invalid JSON body"},400)}let w=rL$.safeParse(U);if(!w.success)return Q.json({error:"Invalid publish request payload",details:T$4.treeifyError(w.error)},400);let F=await S$4(G,W,w.data.data.id,w.data.data.title);if(F)return Q.json({error:"A registry item with the same id or title already exists. Please use a different name/id.",conflict:F},409);let H=await X.createOrUpdate({organization_id:W,requested_id:w.data.data.id,title:w.data.data.title,description:w.data.data.description??null,_meta:w.data.data._meta,server:w.data.data.server,requester_name:w.data.requester?.name??null,requester_email:w.data.requester?.email??null});try{await R$4({db:Z,organizationId:W,request:H})}catch(N){console.warn("[private-registry] failed to emit publish-request event:",N)}return p1.capture({distinctId:w.data.requester?.email??`org:${W}`,event:"registry_publish_request_submitted",groups:{organization:W},properties:{organization_id:W,request_id:H.id,requested_id:H.requested_id,title:w.data.data.title,requester_email:w.data.requester?.email??null}}),Q.json({id:H.id,requested_id:H.requested_id,status:H.status},201)}}var vV$=!0,I$4="hour",yV$=100;var hV$=O(()=>{f4();$6();Oy();uv0();dv0();e5()});var cV$={};e8(cV$,{createPublishRequestHandler:()=>gV$,createPublicMCPHandler:()=>bV$});var uV$=O(()=>{fV$();hV$()});var Xn0={};e8(Xn0,{watchHandler:()=>nV$,getProxyDispatch:()=>b$4,createApp:()=>u$4});import{readFileSync as V$4}from"fs";import{PrometheusSerializer as C$4}from"@opentelemetry/exporter-prometheus";import{DBOS as Tt}from"@dbos-inc/dbos-sdk";import{oAuthDiscoveryMetadata as y$4,oAuthProtectedResourceMetadata as g$4}from"better-auth/plugins";async function _$4($){let Z=$.connect(),G;try{G=await Promise.race([Z,lV$(dV$)])}catch{return Z.then((X)=>X.release(!0)).catch(()=>{}),!1}try{return await Promise.race([G.query("SELECT 1"),lV$(dV$)]),G.release(),!0}catch{return G.release(!0),!1}}function lV$($){return new Promise((Z,G)=>setTimeout(()=>G(Error("pg health-check timeout")),$))}function b$4(){if(!t11)throw Error("getProxyDispatch() called before createApp() or without NATS \u2014 proxy dispatch unavailable");return t11}async function f$4($,Z){let{items:G}=await $.storage.connections.list(Z,{where:{field:["connection_url"],operator:"like",value:`${dV1}%`},limit:1}),X=G[0];if(!X?.configuration_state)return null;return X.configuration_state.project_locator}function x$4($){let Z=new URLSearchParams;if($){let[G,X]=$.split("/");if(G)Z.set("workspace_hint",G);if(X)Z.set("project_hint",X)}else Z.set("auto_personal","true");return Z.set("force_new","true"),Z}async function u$4($={}){let Z=$.database??g6(),G=!1;YZ.stop().catch((d)=>{console.error("[SSEHub] Error stopping previous broadcast (HMR cleanup):",d)});let X,Y,Q=new j11,J,W,K,U,w,F=null;if($.disableNats)J=P11(),X={get:async()=>null,set:async()=>{},invalidate:async()=>{},teardown:()=>{}},Y=new Pn,W={start:async()=>{},broadcast:()=>{},publishControlFrame:()=>{},stop:async()=>{}},w=void 0,K={init:async()=>{},pump:(d)=>{(async()=>{let m=d.getReader();try{while(!0){let{done:C0}=await m.read();if(C0)break}}catch{}finally{m.releaseLock()}})()},publishRawChunk:async()=>!1,publishDone:async()=>!1,createTailStream:async()=>null,purge:()=>{},teardown:()=>{}};else{F=bk$();let d=L1().natsCredsPath,m;if(d)try{m=V$4(d,"utf8")}catch(x1){console.error(`[app] failed to read NATS_CREDS at ${d}; connecting anonymously`,x1)}F.init(L1().natsUrls,m?{creds:m}:void 0);let C0=tv0()?new hf0({getJetStream:()=>F.getJetStream()}):null;C0?.init().catch(()=>{}),X=C0;let v0=new on0({getJetStream:()=>F.getJetStream()});v0.init().catch(()=>{}),Y=v0,J=P11({getConnection:()=>F.getConnection()}),W=new A11({getConnection:()=>F.getConnection()}),K=new R11({getConnection:()=>F.getConnection(),getJetStream:()=>F.getJetStream()}),U=HS$({getConnection:()=>F.getConnection()}),w=LS$({getConnection:()=>F.getConnection()});let r0=zS$({getConnection:()=>F.getConnection()}),s0=W;W={start:(x1)=>s0.start(x1),broadcast:(x1)=>s0.broadcast(x1),publishControlFrame:(x1,W8)=>{r0.publishControlFrame(x1,W8).catch((z4)=>{console.warn("[TunnelControl] publishControlFrame failed (non-critical):",z4)})},stop:()=>s0.stop()},qP$(F),F.onReady(()=>{C0?.init().catch((x1)=>{console.error("[McpListCache] Deferred init failed:",x1)}),v0.init().catch((x1)=>{console.error("[ConnectionCircuitStore] Deferred init failed:",x1)}),J.start(),Cl1(()=>F.getConnection()),K.init().catch((x1)=>{console.warn("[Decopilot] StreamBuffer init failed (late-join disabled):",x1)})})}if(sy)await sy();cf0(X),an0(Y);let N={storage:new xf(Z.db),sseHub:YZ},B=new S11(N),E=new Ll(Z.db),D=new V11(E);D.start(),W.start((d)=>{v50(d),B.execute({type:"CANCEL",taskId:d}).catch((m)=>{console.error("[Decopilot] CancelBroadcast execute failed:",m)})}).catch((d)=>{console.error("[Decopilot] CancelBroadcast start failed:",d)}),F?.onReady(()=>{W.start().catch((d)=>{console.error("[CancelBroadcast] Deferred start failed:",d)})}),K.init().catch((d)=>{console.warn("[Decopilot] StreamBuffer init failed, attach/late-join disabled:",d)}),sy=async()=>{await B.stopAll(),B.dispose(),D.dispose(),W.stop().catch(()=>{}),K.teardown(),X?.teardown(),Q.teardown(),J.teardown(),_l1(),Y.teardown(),cf0(null),an0(null)};let L=new y1;if(L.use("*",g_0({enabled:(d)=>Jb(d,"debug")==="1"})),L.use("*",WL0),L.use("/*",MC1({origin:(d)=>{if(d.includes("localhost")||d.includes("127.0.0.1"))return d;return d},credentials:!0,allowMethods:["GET","POST","PUT","DELETE","OPTIONS"],allowHeaders:["Content-Type","Authorization","mcp-protocol-version"],exposeHeaders:["WWW-Authenticate"]})),L.use("*",async(d,m)=>{if(await m(),d.req.path.includes("/files/"))return;if(d.req.path.includes("/fs/")&&d.req.path.endsWith("/read"))return;d.header("X-Frame-Options","DENY"),d.header("Content-Security-Policy","frame-ancestors 'none'")}),!L1().noTui)L.use("*",uS$());L.use("*",async(d,m)=>{if(await m(),Gg(d.req.path))return;if(d.res.status>=500){let v0=await d.res.clone().text();console.error(`[5xx Response] ${d.req.method} ${d.req.path} - ${d.res.status}:`,v0)}}),L.get(gX.HEALTH,(d)=>{if(G)return d.json({status:"shutting_down"},503);return d.json({status:"ok"})}),L.get(gX.HEALTH_LIVE,(d)=>{return d.json({status:"ok"})}),L.get(gX.HEALTH_READY,async(d)=>{if(G)return d.json({status:"shutting_down"},503);let m={};if(m.postgres={status:await _$4(Z.pool)?"up":"down"},F)m.nats=F.isConnected()?{status:"up"}:{status:"down"};else m.nats={status:"down"};let C0=m.postgres.status==="up",v0=C0?200:503;return d.json({status:C0?"ready":"not_ready",services:m},v0)}),L.get(gX.METRICS,async(d)=>{try{let m=await FL0.collect(),C0=v$4.serialize(m.resourceMetrics);return d.text(C0,200,{"Content-Type":"text/plain; version=0.0.4; charset=utf-8"})}catch(m){return console.error("Failed to collect metrics:",m),d.text("# Error collecting metrics",500)}}),L.route("/api/config",Hk$),L.route("/api/auth/custom",pP$),L.all("/api/auth/*",async(d)=>{return await s6.handler(d.req.raw)});let z=Jo1();z.use("/.well-known/oauth-protected-resource/mcp/:connectionId",bV),z.use("/mcp/:connectionId/.well-known/oauth-protected-resource",bV),L.route("/",z),L.get("/.well-known/oauth-protected-resource/api/:org/mcp/:connectionId",nm),L.route("/",wo1()),L.use("/oauth-proxy/:connectionId/*",bV),L.all("/oauth-proxy/:connectionId/*",mV$);let j=async(d)=>{let C0=await h$4()(d.req.raw),v0=await C0.json();return Response.json(v0,C0)};L.use("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",bV),L.get("/mcp/:gateway?/:connectionId/.well-known/oauth-protected-resource/*",j);let P=async(d)=>{let C0=await c$4()(d.req.raw),v0=await C0.json();return Response.json(v0,C0)};L.get("/.well-known/oauth-authorization-server/*/:gateway?/:connectionId?",P);let A=AP$({ttlMs:120000}),M=await nr1({db:Z.db,auth:s6,encryption:{key:L1().encryptionKey},observability:{tracer:Rw,meter:y8},modelListCache:Q,providerKeyCache:J,memberRoleCache:A,linkStatusProbe:U,publishLinkControlFrame:(d,m)=>W.publishControlFrame(d,m)});uH.set(M);let S=new hO(L1().encryptionKey);xI1({db:Z.db,baseUrl:g3()});let q=P80(Z.db),V=new wl(Z.db),t=yS$({db:Z.db});in0({storage:q,meshContextFactory:t}),Tl0({meshContextFactory:t,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:YZ},prepareLinkWorkFn:vI$,workPublisher:w}),Ll0({dispatchRunFn:fI$,meshContextFactory:t,deps:{runRegistry:B,cancelBroadcast:W,streamBuffer:K,sseHub:YZ}});let f=new xf(Z.db);c8$({getJetStream:()=>F?.getJetStream()??null,getJetStreamManager:async()=>{let d=F?.getConnection();return d?await iV$.jetstreamManager(d):null},messageParts:f.messageParts(),resolveRun:async(d)=>{let m=await Z.db.selectFrom("threads").select(["organization_id","created_by","message_storage_version","status","run_fence_token","title"]).where("id","=",d).executeTakeFirst();return m?{orgId:m.organization_id,createdBy:m.created_by,version:m.message_storage_version??1,status:m.status,runFenceToken:m.run_fence_token,title:m.title??null}:null},completeRunIfNotCompleted:async(d,m)=>{let C0=await f.completeRunIfNotCompleted(d,m);return xD0(YZ,m,d,C0),C0},markRunRequiresAction:async(d,m)=>{let C0=await f.requiresActionIfInProgress(d,m);return xD0(YZ,m,d,C0),C0},markRunFailed:async(d,m,C0,v0)=>{let r0=await f.markRunFailed(d,m,C0,v0);return xD0(YZ,m,d,r0),r0},persistTitle:(d,m,C0)=>f.update(d,m,{title:C0}),onTitleUpdated:async({runId:d,orgId:m,title:C0})=>{let v0=await f.get(d,m).catch(()=>null);YZ.emit(m,zJ(d,v0?.status??"in_progress",{title:C0,virtualMcpId:v0?.virtual_mcp_id??void 0,createdBy:v0?.created_by,triggerId:v0?.trigger_id,branch:v0?.branch??null,createdAt:v0?.created_at,updatedAt:v0?.updated_at}))},bumpProgress:async({runId:d,orgId:m})=>{await f.bumpProgress(d,m)},recordCompleted:async({runId:d,orgId:m,distinctId:C0,usage:v0})=>{p1.capture({distinctId:C0,event:"chat_message_completed",groups:{organization:m},properties:{organization_id:m,thread_id:d,transport:"projector",input_tokens:v0.inputTokens,output_tokens:v0.outputTokens,total_tokens:v0.totalTokens}})},recordFailed:async({runId:d,orgId:m,distinctId:C0,reason:v0,kind:r0})=>{p1.capture({distinctId:C0,event:"chat_message_failed",groups:{organization:m},properties:{organization_id:m,thread_id:d,transport:"projector",error_category:r0,error_message:v0}})},purgeRun:async(d)=>{K.purge(d)}}),NQ$({meshContextFactory:t,systemDatabaseUrl:ab1(L1().databaseUrl,L1().databasePgSsl),streamBuffer:K}),xS$(),vI1();let v=async(d,m,C0)=>{let v0=await q.findById(d,m);if(!v0)throw Error("Automation not found");return tn0({automationId:v0.id,organizationId:v0.organization_id,triggerId:null})},e=new Sy(q,({automation:d,trigger:m,contextMessages:C0,idempotencyKey:v0})=>zn({automationId:d.id,organizationId:d.organization_id,triggerId:m.id,contextMessages:C0},{idempotencyKey:v0})),o=[uQ(),oV(),HK()];for(let d of o)gD0(d).then(()=>{}).catch((m)=>console.error("[monitoring] Retention cleanup failed:",m));let B0=()=>Z.db.deleteFrom("apikey").where("expiresAt","<",new Date).execute().then(()=>{}).catch((d)=>console.error("[auth] Expired API key cleanup failed:",d));B0(),setInterval(B0,86400000).unref(),L.use("*",async(d,m)=>{if(QL0(d.req.path))return m();let C0={measure:async(r0,s0)=>{eY(d,r0);try{return await s0()}finally{$Y(d,r0)}}},v0=await uH.create(d.req.raw,{timings:C0});v0.automationRunner=v,d.set("meshContext",v0);try{await m()}finally{let r0=v0.pendingRevalidations;if(r0.length>0)Promise.race([Promise.allSettled(r0),new Promise((x1)=>setTimeout(x1,30000))]).catch((x1)=>console.error("[mesh] revalidation cleanup error:",x1))}}),L.use("/api/:org/decopilot/*",fV),L.use("/api/:org/v1/*",fV),L.use("/api/:org/files/*",fV),L.use("*",async(d,m)=>{let C0=d.req.path;if(C0.startsWith("/api/org-sso/")||C0.startsWith("/api/auth/")||C0.startsWith("/api/tools/management")||C0.startsWith("/oauth-proxy/"))return m();let v0=d.get("meshContext");if(!v0?.organization?.id||!v0?.auth?.user?.id)return m();if(!(await v0.storage.orgSsoConfig.getByOrgId(v0.organization.id))?.enforced)return m();if(!await v0.storage.orgSsoSessions.isValid(v0.auth.user.id,v0.organization.id))return d.json({error:"SSO authentication required for this organization"},403);return m()});let O0=new y1;O0.use("*",vQ({mountPath:"/api/org-sso"})),O0.route("/",DE0()),L.route("/api/org-sso",O0),L.get("/api/tools/management",(d)=>{return d.json({tools:c_0,grouped:kO()})}),L.use("/mcp/*",async(d,m)=>{eY(d,"mcp");try{return await m()}finally{$Y(d,"mcp")}});let K0=async(d,m)=>{let C0=d.var.meshContext;if(!C0.auth.user?.id&&!C0.auth.apiKey?.id){let v0=new URL(d.req.url);return d.res=new Response(null,{status:401,headers:{"WWW-Authenticate":`Bearer realm="mcp",resource_metadata="${v0.origin}${v0.pathname}/.well-known/oauth-protected-resource"`}})}return await m()};if(L.use("/mcp/:connectionId?",K0),L.use("/mcp/gateway/:virtualMcpId?",K0),L.use("/mcp/virtual-mcp/:virtualMcpId?",K0),L.use("/mcp/self",K0),jJ()){let{mountDevRoutes:d}=(YV$(),rD0(XV$));d(L,K0)}let J0=new y1;J0.use("*",vQ({mountPath:"/mcp"})),J0.route("/",YN0()),L.route("/mcp",J0);let s=new y1;s.use("*",vQ({mountPath:"/mcp/self"})),s.route("/",ID0()),L.route("/mcp/self",s);let T0=new y1;T0.use("*",vQ({mountPath:"/mcp"})),T0.route("/",WN0()),L.route("/mcp",T0),L.use("/api/:org/models/*",async(d,m)=>{eY(d,"llm_models");try{return await m()}finally{$Y(d,"llm_models")}});let F0=Re0({cancelBroadcast:W,streamBuffer:K,runRegistry:B,linkStatusProbe:U});if(L.route("/api",F0),F!=null)t11=BS$({getConnection:()=>F?.getConnection()??null});L.route("/api",aM$()),L.get("/api/links/me",async(d)=>{try{let m=d.req.header("authorization")??"",C0=/^Bearer\s+(.+)$/i.exec(m),v0=null;if(C0){let s0=(C0[1]??"").trim();v0=await fM$(s0,s6.api)}else v0=d.get("meshContext")?.auth?.user?.id??null;if(!v0)return d.json({error:"unauthorized"},401);let r0=U?await U(v0):{online:!1,capabilities:[]};if(!r0.online)return d.json(null);return d.json({hostname:r0.hostname,cliVersion:r0.cliVersion})}catch(m){return console.error("[links/me] presence probe failed; reporting offline:",m instanceof Error?m.message:String(m)),d.json(null)}}),L.use("/api/:org/files/*",fV),L.route("/api",Ek$);let f0=new y1;f0.use("*",vQ({mountPath:"/api"})),f0.route("/",RD0()),L.route("/api",f0),L.route("/api",Uk$);let m0=new y1;m0.use("*",vQ({mountPath:"/api"})),m0.route("/",qD0({tokenStorage:V,automationEventDispatcher:e})),L.route("/api",m0);let x0=new Hl(Z.db),i0=new y1;i0.use("*",vQ({mountPath:"/api"})),i0.route("/",iE0()),L.route("/api",i0),L.route("/api/deco-sites",$R$()),L.route("/api/deco-apps",Xk$());let H0=new y1;H0.use("*",vQ({mountPath:"/api/deco-sites"})),H0.route("/",pE0()),L.route("/api/deco-sites",H0);let V0=new y1;V0.use("*",vQ({mountPath:"/api/vm-events"})),V0.route("/",Zk$()),L.route("/api/vm-events",V0);let{createPublishRequestHandler:R0,createPublicMCPHandler:w0}=await Promise.resolve().then(() => (uV$(),cV$)),Q0={db:Z.db,vault:{encrypt:(d)=>S.encrypt(d),decrypt:(d)=>S.decrypt(d)}},G0=R0(Q0),k0=w0(Q0);L.use("/org/:orgRef/registry/publish-request",bV),L.post("/org/:orgRef/registry/publish-request",G0),L.use("/org/:orgSlug/registry/*",bV),L.all("/org/:orgSlug/registry/*",k0),L.post("/api/:org/registry/publish-request",G0),L.all("/api/:org/registry/*",k0);let i=_M$({kvStorage:x0,runRegistry:B,streamBuffer:K,sseHub:YZ,cancelBroadcast:W,tokenStorage:V,automationEventDispatcher:e,mountDevAssets:jJ(),mcpAuth:K0,oauthProxyHandler:mV$,watchHandler:nV$,betterAuthProtectedResourceHandler:j,getNatsConnection:()=>F?.getConnection()??null});return L.route("/api/:org",i),L.notFound((d)=>{return d.json({error:"Not Found",path:d.req.path},404)}),L.onError(uI$),Object.assign(L,{markShuttingDown:()=>{G=!0},shutdown:async()=>{if(console.log("[shutdown] Stopping workers..."),await Promise.allSettled([YZ.stop(),sy?Promise.resolve(sy()).finally(()=>{sy=null}):Promise.resolve()]),F)await F.drain().catch((d)=>console.error("[shutdown] NATS drain error:",d));console.log("[shutdown] Flushing telemetry..."),await fY().catch((d)=>console.error("[shutdown] Telemetry flush error:",d)),console.log("[shutdown] Closing database..."),await eb1(Z).catch((d)=>console.error("[shutdown] Database close error:",d)),console.log("[shutdown] Cleanup complete.")},initDbos:async()=>{await Tt.registerQueue(cQ,{partitionQueue:!0,concurrency:dn0,minPollingIntervalMs:ln0}),await Tt.registerQueue(A3,{partitionQueue:!0,concurrency:Al0}),await Tt.registerQueue(Iw,{partitionQueue:!0,concurrency:Dl0}),await Tt.registerQueue(QB,{partitionQueue:!0,concurrency:HQ$}),await Se0(q),await Promise.allSettled(["automations-gate","automations-global"].map((d)=>Tt.deleteQueue(d))),await mn0(Z.pool),Ay1().catch((d)=>{console.error("[studio-pack-backfill] failed:",d)}),yI1().catch((d)=>{console.error("[org-fs] public-sets boot sync kick failed:",d)})}})}var iV$,dV$=5000,t11=null,sy=null,mV$=async($)=>{let Z=$.req.param("connectionId");if(!Z)return $.json({error:"Missing connectionId"},400);let G=$.req.path.split("/").filter(Boolean),X=G[G.length-1],Y=$.get("meshContext");if(!Y)Y=await uH.create($.req.raw),$.set("meshContext",Y);let Q=$.req.param("org")?Y.organization?.id:void 0,J=await Y.storage.connections.findById(Z,Q);if(!J?.connection_url)return $.json({error:"Connection not found"},404);let W=await zx(J.connection_url),K,U=new URL(J.connection_url);if(W.ok)K=(await W.json()).authorization_servers?.[0];if(!K)K=U.origin;let w=await pm(K);if(!w.ok)return $.json({error:"Failed to get auth server metadata"},502);let F=await w.json(),H;if(X==="authorize")H=F.authorization_endpoint;else if(X==="token")H=F.token_endpoint;else if(X==="register")H=F.registration_endpoint;if(!H)return $.json({error:`Unknown OAuth endpoint: ${X}`},404);let N=new URL(H),B=new URL($.req.url);if(N.search=B.search,X==="authorize"){let q=N.searchParams.get("redirect_uri");if(q){let V=L1().baseUrl??B.origin;try{let t=new URL(q),f=new URL(V);if(!(t.origin===f.origin||t.hostname==="localhost"))return $.json({error:"invalid_request",error_description:"redirect_uri is not allowed"},400)}catch{return $.json({error:"invalid_request",error_description:"redirect_uri is malformed"},400)}N.searchParams.set("redirect_uri",q)}if(N.searchParams.has("resource"))N.searchParams.set("resource",J.connection_url);if(lV1(J.connection_url))try{let V=await f$4(Y,J.organization_id),t=x$4(V);for(let[f,v]of t)N.searchParams.set(f,v)}catch(V){console.warn("[oauth-proxy] Failed to get smart OAuth params, proceeding without:",V)}return $.redirect(N.toString(),302)}let E={Accept:$.req.header("Accept")||"application/json"},D=$.req.header("Content-Type");if(D)E["Content-Type"]=D;let L=$.req.header("Authorization");if(L)E.Authorization=L;let z,j=null,P=null;if($.req.method!=="GET"&&$.req.method!=="HEAD")if(X==="token"&&D?.includes("application/x-www-form-urlencoded")){if(L?.toLowerCase().startsWith("basic "))try{let v=atob(L.slice(6).trim()),e=v.indexOf(":");if(e!==-1){let o=decodeURIComponent(v.slice(0,e)),B0=decodeURIComponent(v.slice(e+1));j=o||null,P=B0||null}}catch{}let q=await $.req.formData();if(q.has("resource"))q.set("resource",J.connection_url);let V=q.get("client_id"),t=q.get("client_secret");if(typeof V==="string"&&V)j=V;if(typeof t==="string"&&t)P=t;let f=new URLSearchParams;for(let[v,e]of q.entries())f.append(v,e.toString());z=f.toString()}else if(X==="register"&&D?.toLowerCase().includes("application/json")){let q=await Y.db.selectFrom("organization").select(["id","slug","name"]).where("id","=",J.organization_id).executeTakeFirst(),V=await $.req.text(),t={};try{t=V?JSON.parse(V):{}}catch{z=V}let f=typeof t==="object"&&t!==null&&!Array.isArray(t);if(z===void 0&&!f)z=V;if(z===void 0){let v=t,e=v.metadata&&typeof v.metadata==="object"?v.metadata:{};v.metadata={...e,organization_id:J.organization_id,...q?.slug?{organization_slug:q.slug}:{},...q?.name?{organization_name:q.name}:{}},z=JSON.stringify(v),E["Content-Type"]="application/json"}}else z=$.req.raw.body??void 0;let A=await fetch(N.toString(),{method:$.req.method,headers:E,body:z,duplex:"half",redirect:"manual"}),M=new Headers,S=["connection","keep-alive","transfer-encoding","content-encoding","content-length"];for(let[q,V]of A.headers.entries())if(!S.includes(q.toLowerCase()))M.set(q,V);if(X==="token"&&A.ok){let q=await A.text();try{let V=JSON.parse(q);if(typeof V.access_token==="string"&&V.access_token){let t=typeof V.expires_in==="number"?new Date(Date.now()+V.expires_in*1000):null,f=null;try{f=await jx(J.connection_url)??H}catch{f=H}let v={connectionId:Z,accessToken:V.access_token,refreshToken:typeof V.refresh_token==="string"?V.refresh_token:null,scope:typeof V.scope==="string"?V.scope:null,expiresAt:t,clientId:j,clientSecret:P,tokenEndpoint:f};await new V5(Y.db,Y.vault).upsert(v)}}catch(V){console.error("[oauth-proxy] failed to persist downstream token:",V)}return new Response(q,{status:A.status,statusText:A.statusText,headers:M})}return new Response(A.body,{status:A.status,statusText:A.statusText,headers:M})},nV$=async($)=>{let Z=$.var.meshContext;if(!(Z.auth.user?.id??Z.auth.apiKey?.userId))return $.json({error:"Unauthorized"},401);let X=Z.organization?.id;if(!X)return $.json({error:"organization id missing"},400);let Y=$.req.query("types"),Q=Y?Y.split(",").map((W)=>W.trim()).filter(Boolean):null,J=crypto.randomUUID();return yQ($,async(W)=>{if(await W.writeSSE({event:"connected",data:JSON.stringify({listenerId:J,organizationId:X,typePatterns:Q,connectedAt:new Date().toISOString()})}),!YZ.add({id:J,organizationId:X,typePatterns:Q?.length?Q:null,push:(w)=>{W.writeSSE({id:w.id,event:w.type,data:JSON.stringify(w)}).catch(()=>{YZ.remove(X,J)})}})){await W.writeSSE({event:"error",data:JSON.stringify({error:"Too many connections",message:"SSE connection limit reached. Try again later."})});return}let U=setInterval(()=>{W.writeSSE({event:"keepalive",data:""}).catch(()=>{clearInterval(U)})},30000);await new Promise((w)=>{W.onAbort(()=>{clearInterval(U),YZ.remove(X,J),w()})})})},v$4,h$4=()=>g$4(s6),c$4=()=>y$4(s6);var Yn0=O(()=>{q8();gI1();i7();Xb();$6();d6();B10();kC1();h_0();_U();im();js0();AJ();I5();f4();Ms0();Cs0();hI$();qe0();iJ();w40();Me0();dI$();ke0();bM$();sM$();Gk$();be0();Yk$();QN0();tm();wk$();KN0();Z11();Nk$();Dk$();$11();e01();ft();e10();fk$();XY();h80();Bl();en0();xk$();yk$();lk$();NS$();OS$();jS$();CS$();_S$();Wy0();Hy0();vS$();w$0();C11();yX();Ve0();xi();Ol0();w$0();Ae0();Cv0();_v0();gS$();Wb();dS$();lV();js0();Lv();y50();iV$=k(jB(),1);v$4=new C$4});var oV$={};e8(oV$,{resolveClientDir:()=>t$4,resolveAssetPathWithTraversalCheck:()=>rV$,isPathWithinDirectory:()=>tV$,createAssetHandler:()=>r$4});import{resolve as It,dirname as d$4,join as l$4,extname as m$4,basename as i$4,sep as pV$}from"path";function n$4($,Z){if($===Z||i$4($)==="index.html")return{"Cache-Control":"no-cache"};if($.includes(`${pV$}assets${pV$}`))return{"Cache-Control":"public, max-age=31536000, immutable"};return{}}function tV$($,Z){let G=It(Z),X=It($);return X===G||X.startsWith(G+"/")}function rV$({requestPath:$,clientDir:Z}){let G=$.startsWith("/")?$.slice(1):$,X=It(Z,G);if(!tV$(X,Z))return null;return X}function t$4($,Z="../client"){let G=new URL($),X=d$4(G.pathname);return It(X,Z)}function r$4($={}){let{env:Z="production",clientDir:G=p$4,isServerPath:X=()=>!1}=$;if(Z==="development")return async function(Q){return null};return async function(Q){if(Q.method!=="GET")return null;let J=new URL(Q.url),W;try{W=decodeURIComponent(J.pathname)}catch{return null}if(X(W))return null;let K=rV$({requestPath:W,clientDir:G});if(!K)return null;let U=l$4(K,"index.html"),w=It(G,"index.html"),F=Q.headers.get("accept"),N=F?.includes("text/html")||F?.includes("*/*")&&["",".html"].includes(m$4(K))?[U,w]:[];for(let B of[K,...N])try{let E=Bun.file(B);if(await E.exists())return new Response(E,{headers:n$4(B,w)})}catch{}if(W.includes("/assets/"))return new Response("Not Found",{status:404,headers:{"Cache-Control":"no-store"}});return null}}var p$4="./dist/client";var aV$=()=>{};var sV$={};e8(sV$,{tryUpgradePreviewWs:()=>G84,tryHandlePreviewHttp:()=>Z84,previewWebSocketHandler:()=>X84,parsePreviewBaseDomain:()=>$84,isPreviewWsData:()=>mD0,extractHandleFromHost:()=>r11});function s$4($){if($.method!=="GET")return!1;return($.headers.get("accept")??"").includes("text/html")}function e$4(){return new Response(a$4,{status:503,headers:{"content-type":"text/html; charset=utf-8","cache-control":"no-store","retry-after":"1","access-control-allow-origin":"*"}})}function $84($){if(!$||$.trim()==="")return null;let Z=$.includes("{handle}")?$.replace("{handle}","__handle__"):$,G;try{G=new URL(Z)}catch{return null}let X=G.hostname;if($.includes("{handle}")){let Y=X.indexOf(".");if(Y<=0||Y===X.length-1)return null;return X.slice(Y+1)}return X}function r11($,Z){if(!$||!Z)return null;let G=$.indexOf(":"),X=(G>=0?$.slice(0,G):$).toLowerCase(),Q=`.${Z.toLowerCase().replace(/^\.+|\.+$/g,"")}`;if(!X.endsWith(Q))return null;let J=X.slice(0,X.length-Q.length);if(!J||J.includes("."))return null;return J}async function Z84($,Z){let G=r11($.headers.get("host"),Z.baseDomain);if(!G)return null;let X=await Z.getRunner();if(!X)return qt(503,"preview proxy not configured");let Y=await X.proxyPreviewRequest(G,$);if(Y.headers.get(pS)&&s$4($))return e$4();return Y.headers.delete(pS),Y}function qt($,Z){return new Response(JSON.stringify({error:Z}),{status:$,headers:{"content-type":"application/json","access-control-allow-origin":"*"}})}function mD0($){return typeof $==="object"&&$!==null&&$.kind==="preview"}async function G84($,Z,G){if(($.headers.get("upgrade")??"").toLowerCase()!=="websocket")return null;let X=r11($.headers.get("host"),G.baseDomain);if(!X)return null;let Y=await G.getRunner();if(!Y)return qt(503,"preview proxy not configured");let Q=await Y.resolvePreviewUpstreamUrl(X);if(!Q)return qt(404,"sandbox not found");let J=new URL($.url);if(J.pathname.startsWith("/_sandbox")||J.pathname.startsWith("/_decopilot_vm"))return qt(404,"not found");let W=`${Q.replace(/^http/,"ws")}${J.pathname}${J.search}`,K=$.headers.get("sec-websocket-protocol"),U=K?K.split(",").map((H)=>H.trim()).filter(Boolean):[],w={kind:"preview",upstreamUrl:W,upstreamProtocols:U,pending:[],upstream:null,closed:!1};if(!Z.upgrade($,{data:w}))return qt(426,"upgrade failed");return}function Rt($,Z,G,X){if(Z.closed)return;Z.closed=!0;try{$.close(G,X)}catch{}try{Z.upstream?.close()}catch{}}var o$4=256,a$4='<!DOCTYPE html><html><head><meta charset="utf-8"><title>Connecting\u2026</title><style>body{font-family:system-ui,sans-serif;display:flex;align-items:center;justify-content:center;min-height:100vh;margin:0;background:#fafafa;color:#555}div{text-align:center;max-width:420px;padding:24px}h3{margin:0 0 8px}p{margin:0;font-size:14px;color:#999;line-height:1.5}</style></head><body><div><h3>Connecting to sandbox\u2026</h3><p>Waiting for the sandbox to come online. This page refreshes automatically.</p></div><script>setTimeout(function(){window.location.reload()},1500)</script></body></html>',X84;var eV$=O(()=>{ei0();X84={open($){let Z=$.data;if(!mD0(Z))return;let G;try{G=Z.upstreamProtocols.length>0?new WebSocket(Z.upstreamUrl,Z.upstreamProtocols):new WebSocket(Z.upstreamUrl)}catch(X){console.warn(`[preview-ws] failed to dial upstream ${Z.upstreamUrl}: ${X instanceof Error?X.message:String(X)}`),Rt($,Z,1011,"upstream connect failed");return}G.binaryType="arraybuffer",Z.upstream=G,G.addEventListener("open",()=>{while(Z.pending.length>0){let X=Z.pending.shift();if(X!==void 0)G.send(X)}}),G.addEventListener("message",(X)=>{if(Z.closed)return;$.send(X.data)}),G.addEventListener("close",(X)=>{Rt($,Z,X.code||1000,X.reason||"")}),G.addEventListener("error",()=>{Rt($,Z,1011,"upstream error")})},message($,Z){let G=$.data;if(!mD0(G))return;let X=G.upstream;if(X&&X.readyState===WebSocket.OPEN){X.send(Z);return}if(G.pending.length>=o$4){Rt($,G,1011,"preview ws backlog overflow");return}G.pending.push(Z)},close($){let Z=$.data;if(!mD0(Z))return;Rt($,Z,1000,"")}}});var XC$={};e8(XC$,{printBanner:()=>Q84,bannerLines:()=>GC$,BANNER_LINES:()=>$C$,BANNER_GRADIENT:()=>ZC$});function Y84($){let Z=Number.parseInt($.slice(1),16);return[Z>>16&255,Z>>8&255,Z&255]}function GC$($){let Z=$C$.map((G,X)=>{let[Y,Q,J]=Y84(ZC$[X]);return`\x1B[38;2;${Y};${Q};${J}m${G}\x1B[39m`});if($!==void 0)Z.push(`\x1B[2m  v${$}\x1B[22m`);return Z}function Q84($){console.log("");for(let Z of GC$($))console.log(Z);console.log("")}var $C$,ZC$;var YC$=O(()=>{$C$=[" \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588     \u2588\u2588\u2588\u2588\u2588\u2588\u2588   ","\u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588  \u2588\u2588\u2588\u2591\u2591\u2591\u2591\u2591\u2588\u2588\u2588 "," \u2591\u2588\u2588\u2588   \u2591\u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588  \u2588 \u2591  \u2588\u2588\u2588     \u2591\u2591\u2591  \u2588\u2588\u2588     \u2591\u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2588\u2588\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2591\u2588\u2588\u2588 \u2591\u2588\u2588\u2588\u2591\u2591\u2588   \u2591\u2588\u2588\u2588         \u2591\u2588\u2588\u2588      \u2591\u2588\u2588\u2588"," \u2591\u2588\u2588\u2588    \u2588\u2588\u2588  \u2591\u2588\u2588\u2588 \u2591   \u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588\u2591\u2591\u2588\u2588\u2588     \u2588\u2588\u2588 "," \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588   \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588 \u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588  \u2591\u2591\u2591\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2591  ","\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591   \u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591\u2591     \u2591\u2591\u2591\u2591\u2591\u2591\u2591   "],ZC$=["#00ff64","#00ee5e","#00dc56","#00c84e","#00b444","#00a03c","#008832","#006e28"]});var JC$={};e8(JC$,{bootstrapDevLinkSession:()=>B84});import{existsSync as J84}from"fs";import{chmod as W84,mkdir as K84,rename as U84,writeFile as w84}from"fs/promises";import{dirname as F84,join as QC$}from"path";function H84($){return QC$($,"dev-link")}function N84($){let Z=process.env.DEV_LINK_SESSION_PATH;if(Z&&Z.trim()!=="")return Z;return QC$(H84($),"session.json")}async function B84($,Z){let G=N84($),X=g6().db,Y=qQ()?await On():await X.selectFrom("user").select(["id","email","name"]).orderBy("createdAt","desc").executeTakeFirst();if(!Y?.id)return null;if(J84(G))try{let U=await Bun.file(G).json(),w=U.user?.sub,F=U.accessToken;if(w===Y.id&&typeof F==="string"){if(await s6.api.verifyApiKey({body:{key:F}}).then((N)=>N?.valid===!0).catch(()=>!1))return{path:G,userSub:w}}}catch{}let Q=null;try{Q=await s6.api.createApiKey({body:{name:"dev-link (auto-minted by bun run dev)",userId:Y.id,permissions:{"*":["*"]},expiresIn:2592000,rateLimitEnabled:!1}})}catch(K){return console.warn("[dev-link] failed to mint API key:",K instanceof Error?K.message:String(K)),null}if(!Q?.key)return null;let J={target:Z,clientId:"dev-link",user:{sub:Y.id,...Y.email?{email:Y.email}:{},...Y.name?{name:Y.name}:{}},accessToken:Q.key,createdAt:new Date().toISOString()};await K84(F84(G),{recursive:!0});let W=`${G}.tmp`;return await w84(W,JSON.stringify(J,null,2),{mode:384}),await W84(W,384),await U84(W,G),{path:G,userSub:Y.id}}var WC$=O(()=>{AJ();_U();RN()});x7();var Y$1="3";function Q$1($){return{name:"decocms",systemDatabaseUrl:$.systemDatabaseUrl,systemDatabaseSchemaName:"dbos",systemDatabasePoolSize:$.poolSize,runAdminServer:!1,executorID:$.executorID,applicationVersion:Y$1,...$.listenQueues!==void 0?{listenQueues:$.listenQueues}:{}}}q8();I5();function j_$(){let $=(process.env.BUN_OPTIONS??"").split(/\s+/).filter(Boolean);return[...process.argv.slice(1),...$]}function OL0($,Z){for(let G=0;G<$.length;G++){let X=$[G];if(X===void 0)continue;if(X===Z)return $[G+1];if(X.startsWith(`${Z}=`))return X.slice(Z.length+1)}return}function c$1(){let $=j_$();if($.includes("--cpu-prof")){console.log(JSON.stringify({msg:"cpu-profiling-active",dir:OL0($,"--cpu-prof-dir")??process.cwd(),name:OL0($,"--cpu-prof-name"),markdown:$.includes("--cpu-prof-md"),intervalUs:Number(OL0($,"--cpu-prof-interval")??1000),note:"profile is written on process exit"}));return}if(process.env.CPU_PROFILE)console.warn(JSON.stringify({msg:"cpu-profiling-requested-but-inactive",hint:'CPU profiling is a Bun launch flag. Set BUN_OPTIONS="--cpu-prof --cpu-prof-md --cpu-prof-dir=/tmp" before starting the process.'}))}LL0();var yt;function r$1(){if(process.env.HEAP_WATCH!=="1")return()=>{};let $=Number(process.env.HEAP_WATCH_INTERVAL_MS??60000),Z=async()=>{let G=WB();if(!G)return;let X={};try{let{heapStats:Y}=await import("bun:jsc"),Q=Y(),J=Object.entries(Q.objectTypeCounts).sort((W,K)=>K[1]-W[1]).slice(0,20);X={objectCount:Q.objectCount,heapSize:Q.heapSize,top:Object.fromEntries(J)}}catch{}console.log(JSON.stringify({msg:"heap-watch",ts:new Date().toISOString(),uptimeS:Math.round(process.uptime()),rss:G.rss,heapUsed:G.heapUsed,heapTotal:G.heapTotal,external:G.external,arrayBuffers:G.arrayBuffers,...X}))};return Z().catch(()=>{}),yt=setInterval(()=>void Z().catch(()=>{}),$),yt.unref?.(),process.on("SIGUSR2",()=>{try{let G=Bun.generateHeapSnapshot("v8"),X=typeof G==="string"?G:JSON.stringify(G),Y=`/tmp/heap-${process.pid}-${Date.now()}.heapsnapshot`;Bun.write(Y,X),console.log(JSON.stringify({msg:"heap-snapshot-written",path:Y}))}catch(G){console.error("[heap-watch] snapshot failed:",G)}}),()=>{if(yt)clearInterval(yt)}}import*as T_$ from"bun:jsc";var{startSamplingProfiler:I_$,samplingProfilerStackTraces:R_$}=T_$;function o$1(){if(process.env.STALL_WATCHDOG!=="1")return()=>{};let $=Number(process.env.STALL_WATCHDOG_MS??100),Z=Number(process.env.STALL_WATCHDOG_TICK_MS??50);try{I_$()}catch(Q){return console.error("[stall-watchdog] failed to start sampling profiler:",Q),()=>{}}let G,X=performance.now()+Z,Y=()=>{let Q=performance.now(),J=Q-X;X=Q+Z;let W=[];try{W=R_$()?.traces??[]}catch{}if(J>$&&W.length>0){let K=new Map;for(let w of W){let F=w.frames.find((B)=>B.sourceURL&&!/Unknown Executable/.test(B.category??""))??w.frames[0];if(!F)continue;let H=(F.sourceURL??"?").replace(/^.*\/node_modules\//,"node_modules/"),N=`${F.name??"?"} @ ${H}:${F.line??"?"}`;K.set(N,(K.get(N)??0)+1)}let U=[...K.entries()].sort((w,F)=>F[1]-w[1]).slice(0,8).map(([w,F])=>({frame:w,count:F}));console.warn(JSON.stringify({msg:"stall-stack",ts:new Date().toISOString(),lagMs:Math.round(J),samplesInWindow:W.length,top:U}))}G=setTimeout(Y,Z),G.unref?.()};return G=setTimeout(Y,Z),G.unref?.(),()=>{if(G)clearTimeout(G)}}function a$1(){c$1();let $=[r$1(),t$1(),o$1()];return()=>{for(let Z of $)Z()}}import{existsSync as A84}from"fs";var bY=L1();g$1();var{DBOS:Mt,DBOSClient:O84}=await import("@dbos-inc/dbos-sdk");function HC$($,Z){if(!Z)return $;let G=new URL($);if(!G.searchParams.has("sslmode"))G.searchParams.set("sslmode","verify-full");return G.toString()}var E84=[cQ,A3,Iw,QB],D84=bY.dispatchRole==="worker"?E84:bY.dispatchRole==="api"?[]:void 0;Mt.setConfig(Q$1({systemDatabaseUrl:HC$(bY.databaseUrl,bY.databasePgSsl),poolSize:Number(process.env.DBOS_POOL_SIZE??5),executorID:bY.podName,listenQueues:D84}));var{createApp:L84}=await Promise.resolve().then(() => (Yn0(),Xn0)),{isServerPath:z84}=await Promise.resolve().then(() => (ft(),P$1)),{createAssetHandler:j84,resolveClientDir:NC$}=await Promise.resolve().then(() => (aV$(),oV$)),P84=bY.port,KC$=NC$(import.meta.url,"../client"),T84=A84(KC$)?KC$:NC$(import.meta.url,"../dist/client"),I84=j84({clientDir:T84,isServerPath:z84}),R84={"X-Frame-Options":"DENY","Content-Security-Policy":"frame-ancestors 'none'"};function q84($){let Z=new Headers($.headers);for(let[G,X]of Object.entries(R84))Z.set(G,X);return new Response($.body,{status:$.status,statusText:$.statusText,headers:Z})}var{parsePreviewBaseDomain:M84,tryHandlePreviewHttp:k84,tryUpgradePreviewWs:S84,previewWebSocketHandler:o11,isPreviewWsData:a11}=await Promise.resolve().then(() => (eV$(),sV$)),{getOrInitSharedRunner:V84}=await Promise.resolve().then(() => (wn(),HY$)),BC$=M84(process.env.STUDIO_SANDBOX_PREVIEW_URL_PATTERN),UC$={baseDomain:BC$??"",getRunner:V84},iD0=await L84(),s11=process.env.DBOS_CONDUCTOR_KEY?.trim(),wC$=process.env.DBOS_CONDUCTOR_URL?.trim();await Mt.launch({...s11?{conductorKey:s11}:{},...s11&&wC$?{conductorURL:wC$}:{}});console.log(`[dbos] application version: ${Mt.applicationVersion}`);await iD0.initDbos();if(!bY.isCli){let{bannerLines:$}=await Promise.resolve().then(() => (YC$(),XC$));console.log("");for(let Z of $())console.log(Z)}var C84=Bun.serve({idleTimeout:0,port:P84,hostname:"0.0.0.0",fetch:async($,Z)=>{if(BC$){let X=await S84($,Z,UC$);if(X===void 0)return;if(X)return X;let Y=await k84($,UC$);if(Y)return Y}let G=await I84($);if(G)return q84(G);return iD0.fetch($,{server:Z})},websocket:{open($){if(a11($.data))o11.open($)},message($,Z){if(a11($.data))o11.message($,Z)},close($){if(a11($.data))o11.close($)}},development:!1}),_84=a$1();if(bY.localMode)Promise.resolve().then(() => (RN(),gH0)).then(async({seedLocalMode:$,markSeedComplete:Z})=>{try{let G=await $();if(process.env.DEV_LINK_SESSION_PATH)try{let{bootstrapDevLinkSession:X}=await Promise.resolve().then(() => (WC$(),JC$)),Y=bY.baseUrl??`http://localhost:${bY.port}`,Q=await X(bY.dataDir,Y);if(Q)console.log(`[dev-link] session ready at ${Q.path} (userSub=${Q.userSub})`);else console.warn("[dev-link] no admin user yet \u2014 skipping session bootstrap. The auto-spawned link will refuse to start until an admin exists.")}catch(X){console.error("[dev-link] bootstrap failed:",X)}}catch(G){console.error("Failed to seed local mode:",G)}finally{Z()}}).catch(async($)=>{console.error("Failed to load local-mode module:",$);try{let{markSeedComplete:Z}=await Promise.resolve().then(() => (RN(),gH0));Z()}catch{}});var FC$=!1;async function b84($){let Z;try{Z=await O84.create({systemDatabaseUrl:HC$(bY.databaseUrl,bY.databasePgSsl),systemDatabaseSchemaName:"dbos"});let G=await Z.listWorkflows({status:"PENDING",queueName:A3,executorId:$,loadInput:!1,loadOutput:!1});if(G.length===0){console.log(`[shutdown] no in-flight thread-gate gates to hand off (executor ${$})`);return}let X=G.map((Y)=>Y.workflowID);await Z.resumeWorkflows(X,{queueName:A3}),console.log(`[shutdown] re-enqueued ${X.length} in-flight thread-gate gate(s) for re-adoption by a live executor (from ${$}):`,X)}catch(G){console.error("[shutdown] thread-gate handoff failed:",G)}finally{await Z?.destroy().catch(()=>{})}}async function nD0($){if(FC$)return;FC$=!0,console.log(`
 [shutdown] Received ${$}, shutting down gracefully...`);let Z=Number(process.env.SHUTDOWN_GRACE_SECONDS??60)*1000,G=Math.max(Z-5000,1e4),X=setTimeout(()=>{console.error(`[shutdown] Timed out after ${G}ms, forcing exit.`),process.exit(1)},G);X.unref?.();let Y=0;try{_84(),iD0.markShuttingDown();let Q=Number(process.env.SHUTDOWN_DRAIN_MS??Math.floor(G*0.6));await m4(Q),await C84.stop(!0);let J=Mt.executorID;await Mt.shutdown(),await b84(J),await iD0.shutdown()}catch(Q){console.error("[shutdown] Error during shutdown:",Q),Y=1}clearTimeout(X),process.exit(Y)}process.on("SIGTERM",()=>nD0("SIGTERM"));process.on("SIGINT",()=>nD0("SIGINT"));process.on("SIGHUP",()=>nD0("SIGHUP"));process.on("unhandledRejection",($)=>{console.error("[process] Unhandled rejection:",$)});process.on("uncaughtException",($)=>{console.error("[process] Uncaught exception:",$),nD0("uncaughtException")});